Nintendo Switch Brew - User contributions [en]

Audio services

2021-09-15T00:25:24Z

Qlutoo: /* IAudioDevice */

= audout:u =
This is "nn::audio::detail::IAudioOutManager".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#ListAudioOuts|ListAudioOuts]]
|-
| 1 || [[#OpenAudioOut|OpenAudioOut]]
|-
| 2 || [3.0.0+] [[#ListAudioOutsAuto|ListAudioOutsAuto]]
|-
| 3 || [3.0.0+] [[#OpenAudioOutAuto|OpenAudioOutAuto]]
|}

== ListAudioOuts ==
Takes a type-0x6 output buffer containing an array of [[#AudioOutInfo]]. Returns an u32 '''Count'''.

== OpenAudioOut ==
Takes a PID-descriptor, a type-0x5 input buffer '''NameIn''', a type-0x6 output buffer '''NameOut''', an input [[#AudioOutParameter]], an input Process handle and an input [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]]. Returns an [[#IAudioOut]] and an output [[#AudioOutParameterInternal]].

== ListAudioOutsAuto ==
Same as [[#ListAudioOuts]], but takes a type-0x22 output buffer instead.

== OpenAudioOutAuto ==
Same as [[#OpenAudioOut]], but takes a type-0x21 input buffer and a type-0x22 output buffer instead.

== IAudioOut ==
This is "nn::audio::detail::IAudioOut".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetAudioOutState|GetAudioOutState]]
|-
| 1 || [[#Start|Start]]
|-
| 2 || [[#Stop|Stop]]
|-
| 3 || [[#AppendAudioOutBuffer|AppendAudioOutBuffer]]
|-
| 4 || [[#RegisterBufferEvent|RegisterBufferEvent]]
|-
| 5 || [[#GetReleasedAudioOutBuffers|GetReleasedAudioOutBuffers]]
|-
| 6 || [[#ContainsAudioOutBuffer|ContainsAudioOutBuffer]]
|-
| 7 || [3.0.0+] [[#AppendAudioOutBufferAuto|AppendAudioOutBufferAuto]]
|-
| 8 || [3.0.0+] [[#GetReleasedAudioOutBuffersAuto|GetReleasedAudioOutBuffersAuto]]
|-
| 9 || [4.0.0+] [[#GetAudioOutBufferCount|GetAudioOutBufferCount]]
|-
| 10 || [4.0.0+] [[#GetAudioOutPlayedSampleCount|GetAudioOutPlayedSampleCount]]
|-
| 11 || [4.0.0+] [[#FlushAudioOutBuffers|FlushAudioOutBuffers]]
|-
| 12 || [6.0.0+] [[#SetAudioOutVolume|SetAudioOutVolume]]
|-
| 13 || [6.0.0+] [[#GetAudioOutVolume|GetAudioOutVolume]]
|}

=== GetAudioOutState ===
No input. Returns an output [[#AudioOutState]].

=== Start ===
No input/output.

Starts audio playback using data from appended buffers.

=== Stop ===
No input/output.

Stops audio playback. This waits for audio playback to finish before returning.

=== AppendAudioOutBuffer ===
Takes a type-0x5 input buffer containing an [[#AudioOutBuffer]] and an input u64 '''BufferClientPtr'''. No output.

=== RegisterBufferEvent ===
No input. Returns an output Event handle.

The event is signalled when a buffer is released.

=== GetReleasedAudioOutBuffers ===
Takes a type-0x6 output buffer '''AudioBuffer'''. Returns an output u32 '''Count'''.

'''AudioBuffer''' will be filled with the identifiers from [[#AppendAudioOutBuffer]] of audio buffers that have been released.

=== ContainsAudioOutBuffer ===
Takes an input u64 '''AudioBufferPointer'''. Returns an output bool '''Contains'''.

=== AppendAudioOutBufferAuto ===
Same as [[#AppendAudioOutBuffer]], but takes a type-0x21 buffer instead.

=== GetReleasedAudioOutBuffersAuto ===
Same as [[#GetReleasedAudioOutBuffer]], but takes a type-0x22 buffer instead.

=== GetAudioOutBufferCount ===
No input. Returns an output u32 '''AudioOutBufferCount'''.

=== GetAudioOutPlayedSampleCount ===
No input. Returns an output u64 '''AudioOutPlayedSampleCount'''.

=== FlushAudioOutBuffers ===
No input. Returns an output bool '''Pending'''.

=== SetAudioOutVolume ===
Takes an input float '''AudioOutVolume'''. No output.

=== GetAudioOutVolume ===
No input. Returns an output float '''AudioOutVolume'''.

= audin:u =
This is "nn::audio::detail::IAudioInManager".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#ListAudioIns|ListAudioIns]]
|-
| 1 || [[#OpenAudioIn|OpenAudioIn]]
|-
| 2 || [3.0.0+] [[#ListAudioInsAuto|ListAudioInsAuto]]
|-
| 3 || [3.0.0+] [[#OpenAudioInAuto|OpenAudioInAuto]]
|-
| 4 || [3.0.0+] [[#ListAudioInsAutoFiltered|ListAudioInsAutoFiltered]]
|-
| 5 || [5.0.0+] [[#OpenAudioInProtocolSpecified|OpenAudioInProtocolSpecified]]
|}

== ListAudioIns ==
Takes a type-0x6 output buffer containing an array of [[#AudioInInfo]]. Returns an u32 '''Count'''.

== OpenAudioIn ==
Takes a PID-descriptor, a type-0x5 input buffer '''NameIn''', a type-0x6 output buffer '''NameOut''', an input [[#AudioInParameter]], an input Process handle and an input [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]]. Returns an [[#IAudioIn]] and an an output [[#AudioInParameterInternal]].

== ListAudioInsAuto ==
Same as [[#ListAudioIns]], but takes a type-0x22 output buffer instead.

== OpenAudioInAuto ==
Same as [[#OpenAudioIn]], but takes a type-0x21 input buffer and a type-0x22 output buffer instead.

== ListAudioInsAutoFiltered ==
Same as [[#ListAudioInsAuto]].

== OpenAudioInProtocolSpecified ==
Same as [[#OpenAudioIn]], but takes an additional input u64 '''Protocol'''.

== IAudioIn ==
This is "nn::audio::detail::IAudioIn".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetAudioInState|GetAudioInState]]
|-
| 1 || [[#Start_2|Start]]
|-
| 2 || [[#Stop_2|Stop]]
|-
| 3 || [[#AppendAudioInBuffer|AppendAudioInBuffer]]
|-
| 4 || [[#RegisterBufferEvent_2|RegisterBufferEvent]]
|-
| 5 || [[#GetReleasedAudioInBuffers|GetReleasedAudioInBuffers]]
|-
| 6 || [[#ContainsAudioInBuffer|ContainsAudioInBuffer]]
|-
| 7 || [3.0.0+] [[#AppendUacInBuffer|AppendUacInBuffer]]
|-
| 8 || [3.0.0+] [[#AppendAudioInBufferAuto|AppendAudioInBufferAuto]]
|-
| 9 || [3.0.0+] [[#GetReleasedAudioInBuffersAuto|GetReleasedAudioInBuffersAuto]]
|-
| 10 || [3.0.0+] [[#AppendUacInBufferAuto|AppendUacInBufferAuto]]
|-
| 11 || [4.0.0+] [[#GetAudioInBufferCount|GetAudioInBufferCount]]
|-
| 12 || [4.0.0+] [[#SetDeviceGain|SetDeviceGain]]
|-
| 13 || [4.0.0+] [[#GetDeviceGain|GetDeviceGain]]
|-
| 14 || [6.0.0+] [[#FlushAudioInBuffers|FlushAudioInBuffers]]
|}

=== GetAudioInState ===
No input. Returns an output [[#AudioInState]].

=== Start ===
No input/output.

=== Stop ===
No input/output.

=== AppendAudioInBuffer ===
Takes a type-0x5 input buffer containing an [[#AudioInBuffer]] and an input u64 '''BufferClientPtr'''. No output.

=== RegisterBufferEvent ===
No input. Returns an output Event handle.

The event is signalled when a buffer is released.

=== GetReleasedAudioInBuffers ===
Takes a type-0x6 output buffer '''AudioBuffer'''. Returns an output u32 '''Count'''.

'''AudioBuffer''' will be filled with the identifiers from [[#AppendAudioInBuffer]] of audio buffers that have been released.

=== ContainsAudioInBuffer ===
Takes an input u64 '''AudioBufferPointer'''. Returns an output bool '''Contains'''.

=== AppendUacInBuffer ===
Takes a type-0x5 input buffer containing an '''UacInBuffer''', an input u64 '''BufferClientPtr''' and an input Event handle. No output.

=== AppendAudioInBufferAuto ===
Same as [[#AppendAudioInBuffer]], but takes a type-0x21 buffer instead.

=== GetReleasedAudioInBuffersAuto ===
Same as [[#GetReleasedAudioInBuffer]], but takes a type-0x22 buffer instead.

=== AppendUacInBufferAuto ===
Same as [[#AppendUacInBuffer]], but takes a type-0x21 buffer instead.

=== GetAudioInBufferCount ===
No input. Returns an output u32 '''AudioInBufferCount'''.

=== SetDeviceGain ===
Takes an input float '''DeviceGain'''. No output.

=== GetDeviceGain ===
No input. Returns an output float '''DeviceGain'''.

=== FlushAudioInBuffers ===
No input. Returns an output bool '''Pending'''.

= audrec:u =
This is "nn::audio::detail::IFinalOutputRecorderManager".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#OpenFinalOutputRecorder]]
|}

== OpenFinalOutputRecorder ==
Takes an input [[#FinalOutputRecorderParameter]], an input Process handle and an input [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]]. Returns an [[#IFinalOutputRecorder]] and an output [[#FinalOutputRecorderParameterInternal]].

== IFinalOutputRecorder ==
This is "nn::audio::detail::IFinalOutputRecorder".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetFinalOutputRecorderState|GetFinalOutputRecorderState]]
|-
| 1 || [[#Start_3|Start]]
|-
| 2 || [[#Stop_3|Stop]]
|-
| 3 || [[#AppendFinalOutputRecorderBuffer|AppendFinalOutputRecorderBuffer]]
|-
| 4 || [[#RegisterBufferEvent_3|RegisterBufferEvent]]
|-
| 5 || [[#GetReleasedFinalOutputRecorderBuffers|GetReleasedFinalOutputRecorderBuffers]]
|-
| 6 || [[#ContainsFinalOutputRecorderBuffer|ContainsFinalOutputRecorderBuffer]]
|-
| 7 || [[#GetFinalOutputRecorderBufferEndTime|GetFinalOutputRecorderBufferEndTime]]
|-
| 8 || [3.0.0+] [[#AppendFinalOutputRecorderBufferAuto|AppendFinalOutputRecorderBufferAuto]]
|-
| 9 || [3.0.0+] [[#GetReleasedFinalOutputRecorderBuffersAuto|GetReleasedFinalOutputRecorderBuffersAuto]]
|-
| 10 || [6.0.0+] [[#FlushFinalOutputRecorderBuffers|FlushFinalOutputRecorderBuffers]]
|-
| 11 || [9.0.0+] [[#AttachWorkBuffer|AttachWorkBuffer]]
|}

=== GetFinalOutputRecorderState ===
No input. Returns an output [[#FinalOutputRecorderState]].

=== Start ===
No input/output.

=== Stop ===
No input/output.

=== AppendFinalOutputRecorderBuffer ===
Takes a type-0x5 input buffer containing an [[#FinalOutputRecorderBuffer]] and an input u64 '''BufferClientPtr'''. No output.

=== RegisterBufferEvent ===
No input. Returns an output Event handle.

The event is signalled when a buffer is released.

=== GetReleasedFinalOutputRecorderBuffers ===
Takes a type-0x6 output buffer '''FinalOutputRecorderBuffer'''. Returns two output u64s '''Count''' and '''Released'''.

'''FinalOutputRecorderBuffer''' will be filled with the identifiers from [[#AppendFinalOutputRecorderBuffer]] of recorder buffers that have been released.

=== ContainsFinalOutputRecorderBuffer ===
Takes an input u64 '''FinalOutputRecorderBufferPointer'''. Returns an output bool '''Contains'''.

=== GetFinalOutputRecorderBufferEndTime ===
Takes an input u64 '''FinalOutputRecorderBufferPointer'''. Returns an output u64 '''Released'''.

=== AppendFinalOutputRecorderBufferAuto ===
Same as [[#AppendFinalOutputRecorderBuffer]], but takes a type-0x21 buffer instead.

=== GetReleasedFinalOutputRecorderBuffersAuto ===
Same as [[#GetReleasedFinalOutputRecorderBuffers]], but takes a type-0x22 buffer instead.

=== FlushFinalOutputRecorderBuffers ===
No input. Returns an output bool '''Pending'''.

=== AttachWorkBuffer ===
Takes an input [[#FinalOutputRecorderWorkBufferParameterInternal]]. No output.

= auddev =
This is "nn::audio::detail::IAudioSnoopManager".

This was added with [6.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || EnableDspUsageMeasurement
|-
| 1 || DisableDspUsageMeasurement
|-
| 6 || GetDspUsage
|}

= audren:u =
This is "nn::audio::detail::IAudioRendererManager".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || OpenAudioRenderer
|-
| 1 || GetWorkBufferSize
|-
| 2 || [[#GetAudioDeviceService]]
|-
| 3 || [3.0.0+] OpenAudioRendererForManualExecution
|-
| 4 || [4.0.0+] GetAudioDeviceServiceWithRevisionInfo
|}

=== GetAudioDeviceService ===
Takes an input u64 [[AM_services#AppletResourceUserId|AppletResourceUserId]], returns an output [[#IAudioDevice]].

== IAudioRenderer ==
This is "nn::audio::detail::IAudioRenderer".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetSampleRate]]
|-
| 1 || [[#GetSampleCount]]
|-
| 2 || [[#GetMixBufferCount]]
|-
| 3 || [[#GetState]]
|-
| 4 || RequestUpdate
|-
| 5 || Start
|-
| 6 || Stop
|-
| 7 || QuerySystemEvent
|-
| 8 || [[#SetRenderingTimeLimit]]
|-
| 9 || [[#GetRenderingTimeLimit]]
|-
| 10 || [3.0.0+] RequestUpdateAuto
|-
| 11 || [3.0.0+] ExecuteAudioRendererRendering
|}

=== GetSampleRate ===
No input. Returns an u32 '''SampleRate'''.

=== GetSampleCount ===
No input. Returns an u32 '''SampleCount'''.

=== GetMixBufferCount ===
No input. Returns an u32 '''MixBufferCount'''.

=== GetState ===
No input. Returns an u32 '''State''' (0=Started, 1=Stopped).

=== SetRenderingTimeLimit ===
Takes an u32 '''RenderingTimeLimit'''. No output.

=== GetRenderingTimeLimit ===
No input. Returns an u32 '''RenderingTimeLimit'''.

== IAudioDevice ==
This is "nn::audio::detail::IAudioDevice".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#ListAudioDeviceName]]
|-
| 1 || [[#SetAudioDeviceOutputVolume]]
|-
| 2 || [[#GetAudioDeviceOutputVolume]]
|-
| 3 || GetActiveAudioDeviceName
|-
| 4 || QueryAudioDeviceSystemEvent
|-
| 5 || GetActiveChannelCount
|-
| 6 || [3.0.0+] [[#ListAudioDeviceNameAuto]]
|-
| 7 || [3.0.0+] [[#SetAudioDeviceOutputVolumeAuto]]
|-
| 8 || [3.0.0+] [[#GetAudioDeviceOutputVolumeAuto]]
|-
| 10 || [3.0.0+] GetActiveAudioDeviceNameAuto
|-
| 11 || [3.0.0+] QueryAudioDeviceInputEvent
|-
| 12 || [3.0.0+] QueryAudioDeviceOutputEvent
|-
| 13 || [5.0.0+] GetAudioSystemMasterVolumeSetting
|-
| 14 || [13.0.0+]
|}

=== ListAudioDeviceName ===
Takes a type-0x6 output buffer containing an array of '''DeviceName'''. Returns an output s32 for total number of output entries.

=== SetAudioDeviceOutputVolume ===
Takes a type-0x5 input buffer containing the '''DeviceName''' and a float. No output.

=== GetAudioDeviceOutputVolume ===
Takes a type-0x5 input buffer containing the '''DeviceName'''. Returns an output float.

=== ListAudioDeviceNameAuto ===
Takes a type-0x22 output buffer containing an array of '''DeviceName'''. Returns an output s32 for total number of output entries.

=== SetAudioDeviceOutputVolumeAuto ===
Takes a type-0x21 input buffer containing the '''DeviceName''' and a float. No output.

=== GetAudioDeviceOutputVolumeAuto ===
Takes a type-0x21 input buffer containing the '''DeviceName'''. Returns an output float.

= audout:a =
This is "nn::audio::detail::IAudioOutManagerForApplet".

This was removed with [11.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || RequestSuspend
|-
| 1 || RequestResume
|-
| 2 || GetProcessMasterVolume
|-
| 3 || SetProcessMasterVolume
|-
| 4 || [4.0.0+] GetProcessRecordVolume
|-
| 5 || [4.0.0+] SetProcessRecordVolume
|}

[4.0.0+] RequestSuspend/RequestResume no longer returns an output handle.

= audin:a =
This is "nn::audio::detail::IAudioInManagerForApplet".

This was removed with [11.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || RequestSuspend
|-
| 1 || RequestResume
|-
| 2 || GetProcessMasterVolume
|-
| 3 || SetProcessMasterVolume
|}

[4.0.0+] RequestSuspend/RequestResume no longer returns an output handle.

= audrec:a =
This is "nn::audio::detail::IFinalOutputRecorderManagerForApplet".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || RequestSuspend
|-
| 1 || RequestResume
|}

[4.0.0+] RequestSuspend/RequestResume no longer returns an output handle.

= audren:a =
This is "nn::audio::detail::IAudioRendererManagerForApplet".

This was removed with [11.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || RequestSuspend
|-
| 1 || RequestResume
|-
| 2 || GetProcessMasterVolume
|-
| 3 || SetProcessMasterVolume
|-
| 4 || RegisterAppletResourceUserId
|-
| 5 || UnregisterAppletResourceUserId
|-
| 6 || [4.0.0+] GetProcessRecordVolume
|-
| 7 || [4.0.0+] SetProcessRecordVolume
|}

[4.0.0+] RequestSuspend/RequestResume no longer returns an output handle.

= audout:d, audin:d, audrec:d, audren:d =
This is "nn::audio::detail::IAudioOutManagerForDebugger", "nn::audio::detail::IAudioInManagerForDebugger", "nn::audio::detail::IFinalOutputRecorderManagerForDebugger", "nn::audio::detail::IAudioRendererManagerForDebugger".

These were removed with [11.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#RequestSuspend]]
|-
| 1 || [[#RequestResume]]
|}

== RequestSuspend ==
Takes an u64 [[AM_services#AppletResourceUserId|AppletResourceUserId]].

== RequestResume ==
Takes an u64 [[AM_services#AppletResourceUserId|AppletResourceUserId]].

= audctl =
This is "nn::audioctrl::detail::IAudioController".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetTargetVolume
|-
| 1 || SetTargetVolume
|-
| 2 || GetTargetVolumeMin
|-
| 3 || GetTargetVolumeMax
|-
| 4 || IsTargetMute
|-
| 5 || SetTargetMute
|-
| 6 || IsTargetConnected
|-
| 7 || SetDefaultTarget
|-
| 8 || GetDefaultTarget
|-
| 9 || GetAudioOutputMode
|-
| 10 || SetAudioOutputMode
|-
| 11 || SetForceMutePolicy
|-
| 12 || GetForceMutePolicy
|-
| 13 || GetOutputModeSetting
|-
| 14 || SetOutputModeSetting
|-
| 15 || SetOutputTarget
|-
| 16 || SetInputTargetForceEnabled
|-
| 17 || [3.0.0+] SetHeadphoneOutputLevelMode
|-
| 18 || [3.0.0+] GetHeadphoneOutputLevelMode
|-
| 19 || [3.0.0+] AcquireAudioVolumeUpdateEventForPlayReport
|-
| 20 || [3.0.0+] AcquireAudioOutputDeviceUpdateEventForPlayReport
|-
| 21 || [3.0.0+] GetAudioOutputTargetForPlayReport
|-
| 22 || [3.0.0+] NotifyHeadphoneVolumeWarningDisplayedEvent
|-
| 23 || [4.0.0+] SetSystemOutputMasterVolume
|-
| 24 || [4.0.0+] GetSystemOutputMasterVolume
|-
| 25 || [4.0.0+] [[#GetAudioVolumeDataForPlayReport]]
|-
| 26 || [4.0.0+] [[#UpdateHeadphoneSettings]]
|-
| 27 || [7.0.0+] SetVolumeMappingTableForDev
|-
| 28 || [10.0.0+] GetAudioOutputChannelCountForPlayReport
|-
| 29 || [10.0.0+] BindAudioOutputChannelCountUpdateEventForPlayReport
|-
| 30 || [13.0.0+]
|-
| 31 || [13.0.0+]
|-
| 32 || [13.0.0+]
|-
| 33 || [13.0.0+]
|-
| 34 || [13.0.0+]
|-
| 10000 || [13.0.0+]
|-
| 10001 || [13.0.0+]
|-
| 10002 || [13.0.0+]
|}

== GetAudioVolumeDataForPlayReport ==
[13.0.0] Updated.

=== UpdateHeadphoneSettings ===
Takes one input bool. No output.
NS calls this with the result of IParentalControlService::IsRestrictionEnabled[https://switchbrew.org/wiki/Parental_Control_services#IParentalControlService].

= codecctl =
This is "nn::audio::detail::ICodecController".

This service no longer exists in [3.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Initialize]]
|-
| 1 || [[#Finalize]]
|-
| 2 || [[#Sleep]]
|-
| 3 || [[#Wake]]
|-
| 4 || [[#SetVolume]]
|-
| 5 || [[#GetVolumeMax]]
|-
| 6 || [[#GetVolumeMin]]
|-
| 7 || [[#SetActiveTarget]]
|-
| 8 || [[#GetActiveTarget]]
|-
| 9 || [[#BindHeadphoneMicJackInterrupt]]
|-
| 10 || [[#IsHeadphoneMicJackInserted]]
|-
| 11 || [[#ClearHeadphoneMicJackInterrupt]]
|-
| 12 || [[#IsRequested]]
|}

== Initialize ==
No input/output.

== Finalize ==
No input/output.

== Sleep ==
No input/output.

== Wake ==
No input/output.

== SetVolume ==
Takes an u32 '''Volume'''. No output.

== GetVolumeMax ==
No input. Returns an u32 '''VolumeMax'''.

== GetVolumeMin ==
No input. Returns an u32 '''VolumeMin'''.

== SetActiveTarget ==
Takes an u32 '''Target'''. No output.

== GetActiveTarget ==
No input. Returns an u32 '''Target'''.

== BindHeadphoneMicJackInterrupt ==
No input. Returns an event handle.

== IsHeadphoneMicJackInserted ==
No input. Returns a bool.

== ClearHeadphoneMicJackInterrupt ==
No input/output.

== IsRequested ==
No input. Returns a bool.

= hwopus =
This is "nn::codec::detail::IHardwareOpusDecoderManager".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#OpenHardwareOpusDecoder]]
|-
| 1 || [[#GetWorkBufferSize]]
|-
| 2 || [3.0.0+] [[#OpenHardwareOpusDecoderForMultiStream]]
|-
| 3 || [3.0.0+] [[#GetWorkBufferSizeForMultiStream]]
|-
| 4 || [12.0.0+] OpenHardwareOpusDecoderEx
|-
| 5 || [12.0.0+] GetWorkBufferSizeEx
|-
| 6 || [12.0.0+] OpenHardwareOpusDecoderForMultiStreamEx
|-
| 7 || [12.0.0+] GetWorkBufferSizeForMultiStreamEx
|}

Official sw can use either software libopus, or hwopus (libopus running on the ADSP) via "nn::codec::HardwareOpus*" (separate from the former).

== OpenHardwareOpusDecoder ==
Takes two s32s '''SampleRate''' and '''ChannelCount''' packed as an u64, an u32 '''WorkBufferSize''' and a TransferMemory handle for '''WorkBuffer'''. Returns an [[#IHardwareOpusDecoder]] object. The TransferMemory is created by the user-process with permissions=0.

== GetWorkBufferSize ==
Takes two s32s '''SampleRate''' and '''ChannelCount''' packed as an u64. Returns the u32 required size for the decoder's work buffer. Official user-processes align the output size to page-alignment.

== OpenHardwareOpusDecoderForMultiStream ==
Takes a type-0x19 input buffer, an u32 '''WorkBufferSize''' and a TransferMemory handle for '''WorkBuffer'''. Returns an [[#IHardwareOpusDecoder]] object. The TransferMemory is created by the user-process with permissions=0.

The input buffer is a [[#OpusMultiStreamParameters]] struct. The user-process initializes this struct the same way as [[#GetWorkBufferSizeForMultiStream]], except that an u8-array specified by the user is copied to +0x10 with size '''ChannelCount''', when '''ChannelCount''' above 0.

== GetWorkBufferSizeForMultiStream ==
Takes a type-0x19 input buffer. Returns the u32 required size for the decoder's work buffer. Official user-processes align the output size to page-alignment.

The input buffer is a [[#OpusMultiStreamParameters]] struct.

== OpenHardwareOpusDecoderEx ==
Takes a struct [[#OpusParametersEx]] and a u32 '''WorkBufferSize''' and a TransferMemory handle for '''WorkBuffer'''. Returns an [[#IHardwareOpusDecoder]] object. The TransferMemory is created by the user-process with permissions=0.

When ''UseLargeFrameSize'' in the parameter struct is 1 a larger output buffer that can store 120ms opus frames is used vs the default of 40ms.

== GetWorkBufferSizeEx ==
Takes a struct [[#OpusParametersEx]]. Returns the u32 required size for the decoder's work buffer. Official user-processes align the output size to page-alignment.

== OpenHardwareOpusDecoderForMultiStreamEx ==
Takes a type-0x19 input buffer, an u32 '''WorkBufferSize''' and a TransferMemory handle for '''WorkBuffer'''. Returns an [[#IHardwareOpusDecoder]] object. The TransferMemory is created by the user-process with permissions=0.

The input buffer is a [[#OpusMultiStreamParametersEx]] struct. When ''UseLargeFrameSize'' is 1 a larger output buffer that can store 120ms opus frames is used vs the default of 40ms.

== GetWorkBufferSizeForMultiStreamEx ==
Takes a type-0x19 input buffer. Returns the u32 required size for the decoder's work buffer. Official user-processes align the output size to page-alignment.

The input buffer is a [[#OpusMultiStreamParametersEx]] struct.

== IHardwareOpusDecoder ==
This is "nn::codec::detail::IHardwareOpusDecoder".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [4.0.0+] [[#DecodeInterleavedOld]] ([1.0.0-3.0.2] DecodeInterleaved)
|-
| 1 || [[#SetContext]]
|-
| 2 || [4.0.0+] [[#DecodeInterleavedForMultiStreamOld]] ([3.0.0-3.0.2] DecodeInterleavedForMultiStream)
|-
| 3 || [3.0.0+] [[#SetContextForMultiStream]]
|-
| 4 || [6.0.0+] [[#DecodeInterleavedWithPerfOld]] ([4.0.0-5.1.0] DecodeInterleavedWithPerf)
|-
| 5 || [6.0.0+] [[#DecodeInterleavedForMultiStreamWithPerfOld]] ([4.0.0-5.1.0] DecodeInterleavedForMultiStreamWithPerf)
|-
| 6 || [6.0.0+] DecodeInterleavedWithPerfAndResetOld ([6.0.0-6.2.0] DecodeInterleaved)
|-
| 7 || [6.0.0+] DecodeInterleavedForMultiStreamWithPerfAndResetOld ([6.0.0-6.2.0] DecodeInterleavedForMultiStream)
|-
| 8 || [7.0.0+] [[#DecodeInterleaved]]
|-
| 9 || [7.0.0+] [[#DecodeInterleavedForMultiStream]]
|}

=== DecodeInterleavedOld ===
Takes a type-0x5 input buffer ('''OpusDataIn''') and a type-0x6 output buffer ('''PcmDataOut'''). Decodes the Opus source data to PCM and returns output s32 '''DecodedDataSize''' and s32 '''DecodedSampleCount'''.

Calls the same func as [[#DecodeInterleaved]] internally with flag=0 and out_u64_ptr=NULL.

=== SetContext ===
Takes a type-0x5 input buffer ('''DecoderContextIn'''). Sends the unknown context data to the hardware decoder. The input buffer is unused.

=== DecodeInterleavedForMultiStreamOld ===
Takes a type-0x5 input buffer ('''OpusDataIn''') and a type-0x6 output buffer ('''PcmDataOut'''). Decodes the Opus source data to PCM and returns output s32 '''DecodedDataSize''' and s32 '''DecodedSampleCount'''.

Calls the same func as [[#DecodeInterleavedForMultiStream]] internally with flag=0 and out_u64_ptr=NULL.

=== SetContextForMultiStream ===
Takes a type-0x5 input buffer ('''DecoderContextIn'''). Sends the unknown context data to the hardware decoder.

=== DecodeInterleavedWithPerfOld ===
Takes a type-0x5 input buffer ('''OpusDataIn''') and a type-0x46 output buffer ('''PcmDataOut'''). Decodes the Opus source data to PCM and returns output s32 '''DecodedDataSize''', s32 '''DecodedSampleCount''', and an u64.

The output u64 is ignored by official user-processes.

Calls the same func as [[#DecodeInterleaved]] internally with flag=0.

=== DecodeInterleavedForMultiStreamWithPerfOld ===
Takes a type-0x5 input buffer ('''OpusDataIn''') and a type-0x46 output buffer ('''PcmDataOut'''). Decodes the Opus source data to PCM and returns output s32 '''DecodedDataSize''', s32 '''DecodedSampleCount''', and an u64.

The output u64 is ignored by official user-processes.

Calls the same func as [[#DecodeInterleavedForMultiStream]] internally with flag=0.

=== DecodeInterleaved ===
Takes an input u8 bool flag, a type-0x5 input buffer ('''OpusDataIn''') and a type-0x46 output buffer ('''PcmDataOut'''). Decodes the Opus source data to PCM and returns output s32 '''DecodedDataSize''', s32 '''DecodedSampleCount''', and an u64.

The bool flag indicates whether or not a reset of the decoder context is being requested.

=== DecodeInterleavedForMultiStream ===
Takes an input u8 bool flag, a type-0x5 input buffer ('''OpusDataIn''') and a type-0x46 output buffer ('''PcmDataOut'''). Decodes the Opus source data to PCM and returns output s32 '''DecodedDataSize''', s32 '''DecodedSampleCount''', and an u64.

The bool flag indicates whether or not a reset of the decoder context is being requested.

= auddebug =
This is "nn::audio::detail::IAudioDebugManager".

This service doesn't exist in retail units.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || ProfilerStart
|-
| 1 || ProfilerStop
|-
| 2 || CpuProfilerStart
|-
| 3 || CpuProfilerStop
|}

= aud:a =
This is "nn::audio::detail::IAudioSystemManagerForApplet".

This was added with [11.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || RegisterAppletResourceUserId
|-
| 1 || UnregisterAppletResourceUserId
|-
| 2 || RequestSuspendAudio
|-
| 3 || RequestResumeAudio
|-
| 4 || GetAudioOutputProcessMasterVolume
|-
| 5 || SetAudioOutputProcessMasterVolume
|-
| 6 || GetAudioInputProcessMasterVolume
|-
| 7 || SetAudioInputProcessMasterVolume
|-
| 8 || GetAudioOutputProcessRecordVolume
|-
| 9 || SetAudioOutputProcessRecordVolume
|}

= aud:d =
This is "nn::audio::detail::IAudioSystemManagerForDebugger".

This was added with [11.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || RequestSuspendAudioForDebug
|-
| 1 || RequestResumeAudioForDebug
|}

= SampleFormat =
This is "nn::audio::SampleFormat".

{| class="wikitable" border="1"
|-
! Value || Name
|-
| 0 || Invalid
|-
| 1 || PcmInt8
|-
| 2 || PcmInt16
|-
| 3 || PcmInt24
|-
| 4 || PcmInt32
|-
| 5 || PcmFloat
|-
| 6 || Adpcm
|}

= AudioOutState =
This is "nn::audio::AudioOutState".

{| class="wikitable" border="1"
|-
! Value || Name
|-
| 0 || Started
|-
| 1 || Stopped
|}

= AudioInState =
This is "nn::audio::AudioInState".

{| class="wikitable" border="1"
|-
! Value || Name
|-
| 0 || Started
|-
| 1 || Stopped
|}

= FinalOutputRecorderState =
This is "nn::audio::FinalOutputRecorderState".

{| class="wikitable" border="1"
|-
! Value || Name
|-
| 0 || Started
|-
| 1 || Stopped
|}

= AudioOutInfo =
This is "nn::audio::AudioOutInfo".

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x100
| Name
|}

= AudioInInfo =
This is "nn::audio::AudioInInfo".

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x100
| Name
|}

= AudioOutParameter =
This is "nn::audio::AudioOutParameter".

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| SampleRate
|-
| 0x4
| 0x2
| ChannelCount
|-
| 0x6
| 0x2
| Reserved
|}

= AudioInParameter =
This is "nn::audio::AudioInParameter".

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| SampleRate
|-
| 0x4
| 0x2
| ChannelCount
|-
| 0x6
| 0x2
| Reserved
|}

= AudioOutParameterInternal =
This is "nn::audio::detail::AudioOutParameterInternal".

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| SampleRate
|-
| 0x4
| 0x4
| ChannelCount
|-
| 0x8
| 0x4
| SampleFormat
|-
| 0xC
| 0x4
| State
|}

= AudioInParameterInternal =
This is "nn::audio::detail::AudioInParameterInternal".

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| SampleRate
|-
| 0x4
| 0x4
| ChannelCount
|-
| 0x8
| 0x4
| SampleFormat
|-
| 0xC
| 0x4
| State
|}

= AudioOutBuffer =
This is "nn::audio::AudioOutBuffer".

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| Pointer to next buffer (unused)
|-
| 0x8
| 0x8
| Pointer to sample buffer
|-
| 0x10
| 0x8
| Capacity of sample buffer
|-
| 0x18
| 0x8
| Size of data in the sample buffer
|-
| 0x20
| 0x8
| Offset of data in the sample buffer (unused/ignored?)
|}

= AudioInBuffer =
This is "nn::audio::AudioInBuffer".

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| Pointer to next buffer (unused)
|-
| 0x8
| 0x8
| Pointer to sample buffer
|-
| 0x10
| 0x8
| Capacity of sample buffer
|-
| 0x18
| 0x8
| Size of data in the sample buffer
|-
| 0x20
| 0x8
| Offset of data in the sample buffer (unused/ignored?)
|}

= FinalOutputRecorderBuffer =
This is "nn::audio::FinalOutputRecorderBuffer".

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| Released
|-
| 0x8
| 0x8
| Pointer to next buffer (unused)
|-
| 0x10
| 0x8
| Pointer to sample buffer
|-
| 0x18
| 0x8
| Capacity of sample buffer
|-
| 0x20
| 0x8
| Size of data in the sample buffer
|-
| 0x28
| 0x8
| Offset of data in the sample buffer (unused/ignored?)
|}

= FinalOutputRecorderParameter =
This is "nn::audio::FinalOutputRecorderParameter".

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| SampleRate
|}

= FinalOutputRecorderParameterInternal =
This is "nn::audio::detail::FinalOutputRecorderParameterInternal".

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| SampleRate
|-
| 0x4
| 0x4
| ChannelCount
|-
| 0x8
| 0x4
| SampleFormat
|-
| 0xC
| 0x4
| State
|}

= FinalOutputRecorderWorkBufferParameterInternal =
This is "nn::audio::detail::FinalOutputRecorderWorkBufferParameterInternal".

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
|
|-
| 0x8
| 0x8
|
|-
| 0x10
| 0x8
|
|}

= OpusParametersEx =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| SampleRate
|-
| 0x4
| 0x4
| ChannelCount
|-
| 0x8
| 0x4
| UseLargeFrameSize
|-
| 0xC
| 0x4
| Padding
|}

= OpusMultiStreamParameters =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| SampleRate
|-
| 0x4
| 0x4
| ChannelCount
|-
| 0x8
| 0x4
| Number of streams
|-
| 0xC
| 0x4
| Number of stereo streams
|-
| 0x10
| 0x100
| u8 array of channel mappings
|}

= OpusMultiStreamParametersEx =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| SampleRate
|-
| 0x4
| 0x4
| ChannelCount
|-
| 0x8
| 0x4
| Number of streams
|-
| 0xC
| 0x4
| Number of stereo streams
|-
| 0x10
| 0x4
| UseLargeFrameSize
|-
| 0x14
| 0x4
| Padding
|-
| 0x18
| 0x100
| u8 array of channel mappings
|}

[[Category:Services]]

Audio services

2021-09-15T00:23:48Z

Qlutoo: /* audctl */

= audout:u =
This is "nn::audio::detail::IAudioOutManager".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#ListAudioOuts|ListAudioOuts]]
|-
| 1 || [[#OpenAudioOut|OpenAudioOut]]
|-
| 2 || [3.0.0+] [[#ListAudioOutsAuto|ListAudioOutsAuto]]
|-
| 3 || [3.0.0+] [[#OpenAudioOutAuto|OpenAudioOutAuto]]
|}

== ListAudioOuts ==
Takes a type-0x6 output buffer containing an array of [[#AudioOutInfo]]. Returns an u32 '''Count'''.

== OpenAudioOut ==
Takes a PID-descriptor, a type-0x5 input buffer '''NameIn''', a type-0x6 output buffer '''NameOut''', an input [[#AudioOutParameter]], an input Process handle and an input [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]]. Returns an [[#IAudioOut]] and an output [[#AudioOutParameterInternal]].

== ListAudioOutsAuto ==
Same as [[#ListAudioOuts]], but takes a type-0x22 output buffer instead.

== OpenAudioOutAuto ==
Same as [[#OpenAudioOut]], but takes a type-0x21 input buffer and a type-0x22 output buffer instead.

== IAudioOut ==
This is "nn::audio::detail::IAudioOut".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetAudioOutState|GetAudioOutState]]
|-
| 1 || [[#Start|Start]]
|-
| 2 || [[#Stop|Stop]]
|-
| 3 || [[#AppendAudioOutBuffer|AppendAudioOutBuffer]]
|-
| 4 || [[#RegisterBufferEvent|RegisterBufferEvent]]
|-
| 5 || [[#GetReleasedAudioOutBuffers|GetReleasedAudioOutBuffers]]
|-
| 6 || [[#ContainsAudioOutBuffer|ContainsAudioOutBuffer]]
|-
| 7 || [3.0.0+] [[#AppendAudioOutBufferAuto|AppendAudioOutBufferAuto]]
|-
| 8 || [3.0.0+] [[#GetReleasedAudioOutBuffersAuto|GetReleasedAudioOutBuffersAuto]]
|-
| 9 || [4.0.0+] [[#GetAudioOutBufferCount|GetAudioOutBufferCount]]
|-
| 10 || [4.0.0+] [[#GetAudioOutPlayedSampleCount|GetAudioOutPlayedSampleCount]]
|-
| 11 || [4.0.0+] [[#FlushAudioOutBuffers|FlushAudioOutBuffers]]
|-
| 12 || [6.0.0+] [[#SetAudioOutVolume|SetAudioOutVolume]]
|-
| 13 || [6.0.0+] [[#GetAudioOutVolume|GetAudioOutVolume]]
|}

=== GetAudioOutState ===
No input. Returns an output [[#AudioOutState]].

=== Start ===
No input/output.

Starts audio playback using data from appended buffers.

=== Stop ===
No input/output.

Stops audio playback. This waits for audio playback to finish before returning.

=== AppendAudioOutBuffer ===
Takes a type-0x5 input buffer containing an [[#AudioOutBuffer]] and an input u64 '''BufferClientPtr'''. No output.

=== RegisterBufferEvent ===
No input. Returns an output Event handle.

The event is signalled when a buffer is released.

=== GetReleasedAudioOutBuffers ===
Takes a type-0x6 output buffer '''AudioBuffer'''. Returns an output u32 '''Count'''.

'''AudioBuffer''' will be filled with the identifiers from [[#AppendAudioOutBuffer]] of audio buffers that have been released.

=== ContainsAudioOutBuffer ===
Takes an input u64 '''AudioBufferPointer'''. Returns an output bool '''Contains'''.

=== AppendAudioOutBufferAuto ===
Same as [[#AppendAudioOutBuffer]], but takes a type-0x21 buffer instead.

=== GetReleasedAudioOutBuffersAuto ===
Same as [[#GetReleasedAudioOutBuffer]], but takes a type-0x22 buffer instead.

=== GetAudioOutBufferCount ===
No input. Returns an output u32 '''AudioOutBufferCount'''.

=== GetAudioOutPlayedSampleCount ===
No input. Returns an output u64 '''AudioOutPlayedSampleCount'''.

=== FlushAudioOutBuffers ===
No input. Returns an output bool '''Pending'''.

=== SetAudioOutVolume ===
Takes an input float '''AudioOutVolume'''. No output.

=== GetAudioOutVolume ===
No input. Returns an output float '''AudioOutVolume'''.

= audin:u =
This is "nn::audio::detail::IAudioInManager".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#ListAudioIns|ListAudioIns]]
|-
| 1 || [[#OpenAudioIn|OpenAudioIn]]
|-
| 2 || [3.0.0+] [[#ListAudioInsAuto|ListAudioInsAuto]]
|-
| 3 || [3.0.0+] [[#OpenAudioInAuto|OpenAudioInAuto]]
|-
| 4 || [3.0.0+] [[#ListAudioInsAutoFiltered|ListAudioInsAutoFiltered]]
|-
| 5 || [5.0.0+] [[#OpenAudioInProtocolSpecified|OpenAudioInProtocolSpecified]]
|}

== ListAudioIns ==
Takes a type-0x6 output buffer containing an array of [[#AudioInInfo]]. Returns an u32 '''Count'''.

== OpenAudioIn ==
Takes a PID-descriptor, a type-0x5 input buffer '''NameIn''', a type-0x6 output buffer '''NameOut''', an input [[#AudioInParameter]], an input Process handle and an input [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]]. Returns an [[#IAudioIn]] and an an output [[#AudioInParameterInternal]].

== ListAudioInsAuto ==
Same as [[#ListAudioIns]], but takes a type-0x22 output buffer instead.

== OpenAudioInAuto ==
Same as [[#OpenAudioIn]], but takes a type-0x21 input buffer and a type-0x22 output buffer instead.

== ListAudioInsAutoFiltered ==
Same as [[#ListAudioInsAuto]].

== OpenAudioInProtocolSpecified ==
Same as [[#OpenAudioIn]], but takes an additional input u64 '''Protocol'''.

== IAudioIn ==
This is "nn::audio::detail::IAudioIn".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetAudioInState|GetAudioInState]]
|-
| 1 || [[#Start_2|Start]]
|-
| 2 || [[#Stop_2|Stop]]
|-
| 3 || [[#AppendAudioInBuffer|AppendAudioInBuffer]]
|-
| 4 || [[#RegisterBufferEvent_2|RegisterBufferEvent]]
|-
| 5 || [[#GetReleasedAudioInBuffers|GetReleasedAudioInBuffers]]
|-
| 6 || [[#ContainsAudioInBuffer|ContainsAudioInBuffer]]
|-
| 7 || [3.0.0+] [[#AppendUacInBuffer|AppendUacInBuffer]]
|-
| 8 || [3.0.0+] [[#AppendAudioInBufferAuto|AppendAudioInBufferAuto]]
|-
| 9 || [3.0.0+] [[#GetReleasedAudioInBuffersAuto|GetReleasedAudioInBuffersAuto]]
|-
| 10 || [3.0.0+] [[#AppendUacInBufferAuto|AppendUacInBufferAuto]]
|-
| 11 || [4.0.0+] [[#GetAudioInBufferCount|GetAudioInBufferCount]]
|-
| 12 || [4.0.0+] [[#SetDeviceGain|SetDeviceGain]]
|-
| 13 || [4.0.0+] [[#GetDeviceGain|GetDeviceGain]]
|-
| 14 || [6.0.0+] [[#FlushAudioInBuffers|FlushAudioInBuffers]]
|}

=== GetAudioInState ===
No input. Returns an output [[#AudioInState]].

=== Start ===
No input/output.

=== Stop ===
No input/output.

=== AppendAudioInBuffer ===
Takes a type-0x5 input buffer containing an [[#AudioInBuffer]] and an input u64 '''BufferClientPtr'''. No output.

=== RegisterBufferEvent ===
No input. Returns an output Event handle.

The event is signalled when a buffer is released.

=== GetReleasedAudioInBuffers ===
Takes a type-0x6 output buffer '''AudioBuffer'''. Returns an output u32 '''Count'''.

'''AudioBuffer''' will be filled with the identifiers from [[#AppendAudioInBuffer]] of audio buffers that have been released.

=== ContainsAudioInBuffer ===
Takes an input u64 '''AudioBufferPointer'''. Returns an output bool '''Contains'''.

=== AppendUacInBuffer ===
Takes a type-0x5 input buffer containing an '''UacInBuffer''', an input u64 '''BufferClientPtr''' and an input Event handle. No output.

=== AppendAudioInBufferAuto ===
Same as [[#AppendAudioInBuffer]], but takes a type-0x21 buffer instead.

=== GetReleasedAudioInBuffersAuto ===
Same as [[#GetReleasedAudioInBuffer]], but takes a type-0x22 buffer instead.

=== AppendUacInBufferAuto ===
Same as [[#AppendUacInBuffer]], but takes a type-0x21 buffer instead.

=== GetAudioInBufferCount ===
No input. Returns an output u32 '''AudioInBufferCount'''.

=== SetDeviceGain ===
Takes an input float '''DeviceGain'''. No output.

=== GetDeviceGain ===
No input. Returns an output float '''DeviceGain'''.

=== FlushAudioInBuffers ===
No input. Returns an output bool '''Pending'''.

= audrec:u =
This is "nn::audio::detail::IFinalOutputRecorderManager".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#OpenFinalOutputRecorder]]
|}

== OpenFinalOutputRecorder ==
Takes an input [[#FinalOutputRecorderParameter]], an input Process handle and an input [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]]. Returns an [[#IFinalOutputRecorder]] and an output [[#FinalOutputRecorderParameterInternal]].

== IFinalOutputRecorder ==
This is "nn::audio::detail::IFinalOutputRecorder".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetFinalOutputRecorderState|GetFinalOutputRecorderState]]
|-
| 1 || [[#Start_3|Start]]
|-
| 2 || [[#Stop_3|Stop]]
|-
| 3 || [[#AppendFinalOutputRecorderBuffer|AppendFinalOutputRecorderBuffer]]
|-
| 4 || [[#RegisterBufferEvent_3|RegisterBufferEvent]]
|-
| 5 || [[#GetReleasedFinalOutputRecorderBuffers|GetReleasedFinalOutputRecorderBuffers]]
|-
| 6 || [[#ContainsFinalOutputRecorderBuffer|ContainsFinalOutputRecorderBuffer]]
|-
| 7 || [[#GetFinalOutputRecorderBufferEndTime|GetFinalOutputRecorderBufferEndTime]]
|-
| 8 || [3.0.0+] [[#AppendFinalOutputRecorderBufferAuto|AppendFinalOutputRecorderBufferAuto]]
|-
| 9 || [3.0.0+] [[#GetReleasedFinalOutputRecorderBuffersAuto|GetReleasedFinalOutputRecorderBuffersAuto]]
|-
| 10 || [6.0.0+] [[#FlushFinalOutputRecorderBuffers|FlushFinalOutputRecorderBuffers]]
|-
| 11 || [9.0.0+] [[#AttachWorkBuffer|AttachWorkBuffer]]
|}

=== GetFinalOutputRecorderState ===
No input. Returns an output [[#FinalOutputRecorderState]].

=== Start ===
No input/output.

=== Stop ===
No input/output.

=== AppendFinalOutputRecorderBuffer ===
Takes a type-0x5 input buffer containing an [[#FinalOutputRecorderBuffer]] and an input u64 '''BufferClientPtr'''. No output.

=== RegisterBufferEvent ===
No input. Returns an output Event handle.

The event is signalled when a buffer is released.

=== GetReleasedFinalOutputRecorderBuffers ===
Takes a type-0x6 output buffer '''FinalOutputRecorderBuffer'''. Returns two output u64s '''Count''' and '''Released'''.

'''FinalOutputRecorderBuffer''' will be filled with the identifiers from [[#AppendFinalOutputRecorderBuffer]] of recorder buffers that have been released.

=== ContainsFinalOutputRecorderBuffer ===
Takes an input u64 '''FinalOutputRecorderBufferPointer'''. Returns an output bool '''Contains'''.

=== GetFinalOutputRecorderBufferEndTime ===
Takes an input u64 '''FinalOutputRecorderBufferPointer'''. Returns an output u64 '''Released'''.

=== AppendFinalOutputRecorderBufferAuto ===
Same as [[#AppendFinalOutputRecorderBuffer]], but takes a type-0x21 buffer instead.

=== GetReleasedFinalOutputRecorderBuffersAuto ===
Same as [[#GetReleasedFinalOutputRecorderBuffers]], but takes a type-0x22 buffer instead.

=== FlushFinalOutputRecorderBuffers ===
No input. Returns an output bool '''Pending'''.

=== AttachWorkBuffer ===
Takes an input [[#FinalOutputRecorderWorkBufferParameterInternal]]. No output.

= auddev =
This is "nn::audio::detail::IAudioSnoopManager".

This was added with [6.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || EnableDspUsageMeasurement
|-
| 1 || DisableDspUsageMeasurement
|-
| 6 || GetDspUsage
|}

= audren:u =
This is "nn::audio::detail::IAudioRendererManager".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || OpenAudioRenderer
|-
| 1 || GetWorkBufferSize
|-
| 2 || [[#GetAudioDeviceService]]
|-
| 3 || [3.0.0+] OpenAudioRendererForManualExecution
|-
| 4 || [4.0.0+] GetAudioDeviceServiceWithRevisionInfo
|}

=== GetAudioDeviceService ===
Takes an input u64 [[AM_services#AppletResourceUserId|AppletResourceUserId]], returns an output [[#IAudioDevice]].

== IAudioRenderer ==
This is "nn::audio::detail::IAudioRenderer".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetSampleRate]]
|-
| 1 || [[#GetSampleCount]]
|-
| 2 || [[#GetMixBufferCount]]
|-
| 3 || [[#GetState]]
|-
| 4 || RequestUpdate
|-
| 5 || Start
|-
| 6 || Stop
|-
| 7 || QuerySystemEvent
|-
| 8 || [[#SetRenderingTimeLimit]]
|-
| 9 || [[#GetRenderingTimeLimit]]
|-
| 10 || [3.0.0+] RequestUpdateAuto
|-
| 11 || [3.0.0+] ExecuteAudioRendererRendering
|}

=== GetSampleRate ===
No input. Returns an u32 '''SampleRate'''.

=== GetSampleCount ===
No input. Returns an u32 '''SampleCount'''.

=== GetMixBufferCount ===
No input. Returns an u32 '''MixBufferCount'''.

=== GetState ===
No input. Returns an u32 '''State''' (0=Started, 1=Stopped).

=== SetRenderingTimeLimit ===
Takes an u32 '''RenderingTimeLimit'''. No output.

=== GetRenderingTimeLimit ===
No input. Returns an u32 '''RenderingTimeLimit'''.

== IAudioDevice ==
This is "nn::audio::detail::IAudioDevice".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#ListAudioDeviceName]]
|-
| 1 || [[#SetAudioDeviceOutputVolume]]
|-
| 2 || [[#GetAudioDeviceOutputVolume]]
|-
| 3 || GetActiveAudioDeviceName
|-
| 4 || QueryAudioDeviceSystemEvent
|-
| 5 || GetActiveChannelCount
|-
| 6 || [3.0.0+] [[#ListAudioDeviceNameAuto]]
|-
| 7 || [3.0.0+] [[#SetAudioDeviceOutputVolumeAuto]]
|-
| 8 || [3.0.0+] [[#GetAudioDeviceOutputVolumeAuto]]
|-
| 10 || [3.0.0+] GetActiveAudioDeviceNameAuto
|-
| 11 || [3.0.0+] QueryAudioDeviceInputEvent
|-
| 12 || [3.0.0+] QueryAudioDeviceOutputEvent
|-
| 13 || [5.0.0+] GetAudioSystemMasterVolumeSetting
|}

=== ListAudioDeviceName ===
Takes a type-0x6 output buffer containing an array of '''DeviceName'''. Returns an output s32 for total number of output entries.

=== SetAudioDeviceOutputVolume ===
Takes a type-0x5 input buffer containing the '''DeviceName''' and a float. No output.

=== GetAudioDeviceOutputVolume ===
Takes a type-0x5 input buffer containing the '''DeviceName'''. Returns an output float.

=== ListAudioDeviceNameAuto ===
Takes a type-0x22 output buffer containing an array of '''DeviceName'''. Returns an output s32 for total number of output entries.

=== SetAudioDeviceOutputVolumeAuto ===
Takes a type-0x21 input buffer containing the '''DeviceName''' and a float. No output.

=== GetAudioDeviceOutputVolumeAuto ===
Takes a type-0x21 input buffer containing the '''DeviceName'''. Returns an output float.

= audout:a =
This is "nn::audio::detail::IAudioOutManagerForApplet".

This was removed with [11.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || RequestSuspend
|-
| 1 || RequestResume
|-
| 2 || GetProcessMasterVolume
|-
| 3 || SetProcessMasterVolume
|-
| 4 || [4.0.0+] GetProcessRecordVolume
|-
| 5 || [4.0.0+] SetProcessRecordVolume
|}

[4.0.0+] RequestSuspend/RequestResume no longer returns an output handle.

= audin:a =
This is "nn::audio::detail::IAudioInManagerForApplet".

This was removed with [11.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || RequestSuspend
|-
| 1 || RequestResume
|-
| 2 || GetProcessMasterVolume
|-
| 3 || SetProcessMasterVolume
|}

[4.0.0+] RequestSuspend/RequestResume no longer returns an output handle.

= audrec:a =
This is "nn::audio::detail::IFinalOutputRecorderManagerForApplet".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || RequestSuspend
|-
| 1 || RequestResume
|}

[4.0.0+] RequestSuspend/RequestResume no longer returns an output handle.

= audren:a =
This is "nn::audio::detail::IAudioRendererManagerForApplet".

This was removed with [11.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || RequestSuspend
|-
| 1 || RequestResume
|-
| 2 || GetProcessMasterVolume
|-
| 3 || SetProcessMasterVolume
|-
| 4 || RegisterAppletResourceUserId
|-
| 5 || UnregisterAppletResourceUserId
|-
| 6 || [4.0.0+] GetProcessRecordVolume
|-
| 7 || [4.0.0+] SetProcessRecordVolume
|}

[4.0.0+] RequestSuspend/RequestResume no longer returns an output handle.

= audout:d, audin:d, audrec:d, audren:d =
This is "nn::audio::detail::IAudioOutManagerForDebugger", "nn::audio::detail::IAudioInManagerForDebugger", "nn::audio::detail::IFinalOutputRecorderManagerForDebugger", "nn::audio::detail::IAudioRendererManagerForDebugger".

These were removed with [11.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#RequestSuspend]]
|-
| 1 || [[#RequestResume]]
|}

== RequestSuspend ==
Takes an u64 [[AM_services#AppletResourceUserId|AppletResourceUserId]].

== RequestResume ==
Takes an u64 [[AM_services#AppletResourceUserId|AppletResourceUserId]].

= audctl =
This is "nn::audioctrl::detail::IAudioController".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetTargetVolume
|-
| 1 || SetTargetVolume
|-
| 2 || GetTargetVolumeMin
|-
| 3 || GetTargetVolumeMax
|-
| 4 || IsTargetMute
|-
| 5 || SetTargetMute
|-
| 6 || IsTargetConnected
|-
| 7 || SetDefaultTarget
|-
| 8 || GetDefaultTarget
|-
| 9 || GetAudioOutputMode
|-
| 10 || SetAudioOutputMode
|-
| 11 || SetForceMutePolicy
|-
| 12 || GetForceMutePolicy
|-
| 13 || GetOutputModeSetting
|-
| 14 || SetOutputModeSetting
|-
| 15 || SetOutputTarget
|-
| 16 || SetInputTargetForceEnabled
|-
| 17 || [3.0.0+] SetHeadphoneOutputLevelMode
|-
| 18 || [3.0.0+] GetHeadphoneOutputLevelMode
|-
| 19 || [3.0.0+] AcquireAudioVolumeUpdateEventForPlayReport
|-
| 20 || [3.0.0+] AcquireAudioOutputDeviceUpdateEventForPlayReport
|-
| 21 || [3.0.0+] GetAudioOutputTargetForPlayReport
|-
| 22 || [3.0.0+] NotifyHeadphoneVolumeWarningDisplayedEvent
|-
| 23 || [4.0.0+] SetSystemOutputMasterVolume
|-
| 24 || [4.0.0+] GetSystemOutputMasterVolume
|-
| 25 || [4.0.0+] [[#GetAudioVolumeDataForPlayReport]]
|-
| 26 || [4.0.0+] [[#UpdateHeadphoneSettings]]
|-
| 27 || [7.0.0+] SetVolumeMappingTableForDev
|-
| 28 || [10.0.0+] GetAudioOutputChannelCountForPlayReport
|-
| 29 || [10.0.0+] BindAudioOutputChannelCountUpdateEventForPlayReport
|-
| 30 || [13.0.0+]
|-
| 31 || [13.0.0+]
|-
| 32 || [13.0.0+]
|-
| 33 || [13.0.0+]
|-
| 34 || [13.0.0+]
|-
| 10000 || [13.0.0+]
|-
| 10001 || [13.0.0+]
|-
| 10002 || [13.0.0+]
|}

== GetAudioVolumeDataForPlayReport ==
[13.0.0] Updated.

=== UpdateHeadphoneSettings ===
Takes one input bool. No output.
NS calls this with the result of IParentalControlService::IsRestrictionEnabled[https://switchbrew.org/wiki/Parental_Control_services#IParentalControlService].

= codecctl =
This is "nn::audio::detail::ICodecController".

This service no longer exists in [3.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Initialize]]
|-
| 1 || [[#Finalize]]
|-
| 2 || [[#Sleep]]
|-
| 3 || [[#Wake]]
|-
| 4 || [[#SetVolume]]
|-
| 5 || [[#GetVolumeMax]]
|-
| 6 || [[#GetVolumeMin]]
|-
| 7 || [[#SetActiveTarget]]
|-
| 8 || [[#GetActiveTarget]]
|-
| 9 || [[#BindHeadphoneMicJackInterrupt]]
|-
| 10 || [[#IsHeadphoneMicJackInserted]]
|-
| 11 || [[#ClearHeadphoneMicJackInterrupt]]
|-
| 12 || [[#IsRequested]]
|}

== Initialize ==
No input/output.

== Finalize ==
No input/output.

== Sleep ==
No input/output.

== Wake ==
No input/output.

== SetVolume ==
Takes an u32 '''Volume'''. No output.

== GetVolumeMax ==
No input. Returns an u32 '''VolumeMax'''.

== GetVolumeMin ==
No input. Returns an u32 '''VolumeMin'''.

== SetActiveTarget ==
Takes an u32 '''Target'''. No output.

== GetActiveTarget ==
No input. Returns an u32 '''Target'''.

== BindHeadphoneMicJackInterrupt ==
No input. Returns an event handle.

== IsHeadphoneMicJackInserted ==
No input. Returns a bool.

== ClearHeadphoneMicJackInterrupt ==
No input/output.

== IsRequested ==
No input. Returns a bool.

= hwopus =
This is "nn::codec::detail::IHardwareOpusDecoderManager".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#OpenHardwareOpusDecoder]]
|-
| 1 || [[#GetWorkBufferSize]]
|-
| 2 || [3.0.0+] [[#OpenHardwareOpusDecoderForMultiStream]]
|-
| 3 || [3.0.0+] [[#GetWorkBufferSizeForMultiStream]]
|-
| 4 || [12.0.0+] OpenHardwareOpusDecoderEx
|-
| 5 || [12.0.0+] GetWorkBufferSizeEx
|-
| 6 || [12.0.0+] OpenHardwareOpusDecoderForMultiStreamEx
|-
| 7 || [12.0.0+] GetWorkBufferSizeForMultiStreamEx
|}

Official sw can use either software libopus, or hwopus (libopus running on the ADSP) via "nn::codec::HardwareOpus*" (separate from the former).

== OpenHardwareOpusDecoder ==
Takes two s32s '''SampleRate''' and '''ChannelCount''' packed as an u64, an u32 '''WorkBufferSize''' and a TransferMemory handle for '''WorkBuffer'''. Returns an [[#IHardwareOpusDecoder]] object. The TransferMemory is created by the user-process with permissions=0.

== GetWorkBufferSize ==
Takes two s32s '''SampleRate''' and '''ChannelCount''' packed as an u64. Returns the u32 required size for the decoder's work buffer. Official user-processes align the output size to page-alignment.

== OpenHardwareOpusDecoderForMultiStream ==
Takes a type-0x19 input buffer, an u32 '''WorkBufferSize''' and a TransferMemory handle for '''WorkBuffer'''. Returns an [[#IHardwareOpusDecoder]] object. The TransferMemory is created by the user-process with permissions=0.

The input buffer is a [[#OpusMultiStreamParameters]] struct. The user-process initializes this struct the same way as [[#GetWorkBufferSizeForMultiStream]], except that an u8-array specified by the user is copied to +0x10 with size '''ChannelCount''', when '''ChannelCount''' above 0.

== GetWorkBufferSizeForMultiStream ==
Takes a type-0x19 input buffer. Returns the u32 required size for the decoder's work buffer. Official user-processes align the output size to page-alignment.

The input buffer is a [[#OpusMultiStreamParameters]] struct.

== OpenHardwareOpusDecoderEx ==
Takes a struct [[#OpusParametersEx]] and a u32 '''WorkBufferSize''' and a TransferMemory handle for '''WorkBuffer'''. Returns an [[#IHardwareOpusDecoder]] object. The TransferMemory is created by the user-process with permissions=0.

When ''UseLargeFrameSize'' in the parameter struct is 1 a larger output buffer that can store 120ms opus frames is used vs the default of 40ms.

== GetWorkBufferSizeEx ==
Takes a struct [[#OpusParametersEx]]. Returns the u32 required size for the decoder's work buffer. Official user-processes align the output size to page-alignment.

== OpenHardwareOpusDecoderForMultiStreamEx ==
Takes a type-0x19 input buffer, an u32 '''WorkBufferSize''' and a TransferMemory handle for '''WorkBuffer'''. Returns an [[#IHardwareOpusDecoder]] object. The TransferMemory is created by the user-process with permissions=0.

The input buffer is a [[#OpusMultiStreamParametersEx]] struct. When ''UseLargeFrameSize'' is 1 a larger output buffer that can store 120ms opus frames is used vs the default of 40ms.

== GetWorkBufferSizeForMultiStreamEx ==
Takes a type-0x19 input buffer. Returns the u32 required size for the decoder's work buffer. Official user-processes align the output size to page-alignment.

The input buffer is a [[#OpusMultiStreamParametersEx]] struct.

== IHardwareOpusDecoder ==
This is "nn::codec::detail::IHardwareOpusDecoder".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [4.0.0+] [[#DecodeInterleavedOld]] ([1.0.0-3.0.2] DecodeInterleaved)
|-
| 1 || [[#SetContext]]
|-
| 2 || [4.0.0+] [[#DecodeInterleavedForMultiStreamOld]] ([3.0.0-3.0.2] DecodeInterleavedForMultiStream)
|-
| 3 || [3.0.0+] [[#SetContextForMultiStream]]
|-
| 4 || [6.0.0+] [[#DecodeInterleavedWithPerfOld]] ([4.0.0-5.1.0] DecodeInterleavedWithPerf)
|-
| 5 || [6.0.0+] [[#DecodeInterleavedForMultiStreamWithPerfOld]] ([4.0.0-5.1.0] DecodeInterleavedForMultiStreamWithPerf)
|-
| 6 || [6.0.0+] DecodeInterleavedWithPerfAndResetOld ([6.0.0-6.2.0] DecodeInterleaved)
|-
| 7 || [6.0.0+] DecodeInterleavedForMultiStreamWithPerfAndResetOld ([6.0.0-6.2.0] DecodeInterleavedForMultiStream)
|-
| 8 || [7.0.0+] [[#DecodeInterleaved]]
|-
| 9 || [7.0.0+] [[#DecodeInterleavedForMultiStream]]
|}

=== DecodeInterleavedOld ===
Takes a type-0x5 input buffer ('''OpusDataIn''') and a type-0x6 output buffer ('''PcmDataOut'''). Decodes the Opus source data to PCM and returns output s32 '''DecodedDataSize''' and s32 '''DecodedSampleCount'''.

Calls the same func as [[#DecodeInterleaved]] internally with flag=0 and out_u64_ptr=NULL.

=== SetContext ===
Takes a type-0x5 input buffer ('''DecoderContextIn'''). Sends the unknown context data to the hardware decoder. The input buffer is unused.

=== DecodeInterleavedForMultiStreamOld ===
Takes a type-0x5 input buffer ('''OpusDataIn''') and a type-0x6 output buffer ('''PcmDataOut'''). Decodes the Opus source data to PCM and returns output s32 '''DecodedDataSize''' and s32 '''DecodedSampleCount'''.

Calls the same func as [[#DecodeInterleavedForMultiStream]] internally with flag=0 and out_u64_ptr=NULL.

=== SetContextForMultiStream ===
Takes a type-0x5 input buffer ('''DecoderContextIn'''). Sends the unknown context data to the hardware decoder.

=== DecodeInterleavedWithPerfOld ===
Takes a type-0x5 input buffer ('''OpusDataIn''') and a type-0x46 output buffer ('''PcmDataOut'''). Decodes the Opus source data to PCM and returns output s32 '''DecodedDataSize''', s32 '''DecodedSampleCount''', and an u64.

The output u64 is ignored by official user-processes.

Calls the same func as [[#DecodeInterleaved]] internally with flag=0.

=== DecodeInterleavedForMultiStreamWithPerfOld ===
Takes a type-0x5 input buffer ('''OpusDataIn''') and a type-0x46 output buffer ('''PcmDataOut'''). Decodes the Opus source data to PCM and returns output s32 '''DecodedDataSize''', s32 '''DecodedSampleCount''', and an u64.

The output u64 is ignored by official user-processes.

Calls the same func as [[#DecodeInterleavedForMultiStream]] internally with flag=0.

=== DecodeInterleaved ===
Takes an input u8 bool flag, a type-0x5 input buffer ('''OpusDataIn''') and a type-0x46 output buffer ('''PcmDataOut'''). Decodes the Opus source data to PCM and returns output s32 '''DecodedDataSize''', s32 '''DecodedSampleCount''', and an u64.

The bool flag indicates whether or not a reset of the decoder context is being requested.

=== DecodeInterleavedForMultiStream ===
Takes an input u8 bool flag, a type-0x5 input buffer ('''OpusDataIn''') and a type-0x46 output buffer ('''PcmDataOut'''). Decodes the Opus source data to PCM and returns output s32 '''DecodedDataSize''', s32 '''DecodedSampleCount''', and an u64.

The bool flag indicates whether or not a reset of the decoder context is being requested.

= auddebug =
This is "nn::audio::detail::IAudioDebugManager".

This service doesn't exist in retail units.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || ProfilerStart
|-
| 1 || ProfilerStop
|-
| 2 || CpuProfilerStart
|-
| 3 || CpuProfilerStop
|}

= aud:a =
This is "nn::audio::detail::IAudioSystemManagerForApplet".

This was added with [11.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || RegisterAppletResourceUserId
|-
| 1 || UnregisterAppletResourceUserId
|-
| 2 || RequestSuspendAudio
|-
| 3 || RequestResumeAudio
|-
| 4 || GetAudioOutputProcessMasterVolume
|-
| 5 || SetAudioOutputProcessMasterVolume
|-
| 6 || GetAudioInputProcessMasterVolume
|-
| 7 || SetAudioInputProcessMasterVolume
|-
| 8 || GetAudioOutputProcessRecordVolume
|-
| 9 || SetAudioOutputProcessRecordVolume
|}

= aud:d =
This is "nn::audio::detail::IAudioSystemManagerForDebugger".

This was added with [11.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || RequestSuspendAudioForDebug
|-
| 1 || RequestResumeAudioForDebug
|}

= SampleFormat =
This is "nn::audio::SampleFormat".

{| class="wikitable" border="1"
|-
! Value || Name
|-
| 0 || Invalid
|-
| 1 || PcmInt8
|-
| 2 || PcmInt16
|-
| 3 || PcmInt24
|-
| 4 || PcmInt32
|-
| 5 || PcmFloat
|-
| 6 || Adpcm
|}

= AudioOutState =
This is "nn::audio::AudioOutState".

{| class="wikitable" border="1"
|-
! Value || Name
|-
| 0 || Started
|-
| 1 || Stopped
|}

= AudioInState =
This is "nn::audio::AudioInState".

{| class="wikitable" border="1"
|-
! Value || Name
|-
| 0 || Started
|-
| 1 || Stopped
|}

= FinalOutputRecorderState =
This is "nn::audio::FinalOutputRecorderState".

{| class="wikitable" border="1"
|-
! Value || Name
|-
| 0 || Started
|-
| 1 || Stopped
|}

= AudioOutInfo =
This is "nn::audio::AudioOutInfo".

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x100
| Name
|}

= AudioInInfo =
This is "nn::audio::AudioInInfo".

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x100
| Name
|}

= AudioOutParameter =
This is "nn::audio::AudioOutParameter".

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| SampleRate
|-
| 0x4
| 0x2
| ChannelCount
|-
| 0x6
| 0x2
| Reserved
|}

= AudioInParameter =
This is "nn::audio::AudioInParameter".

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| SampleRate
|-
| 0x4
| 0x2
| ChannelCount
|-
| 0x6
| 0x2
| Reserved
|}

= AudioOutParameterInternal =
This is "nn::audio::detail::AudioOutParameterInternal".

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| SampleRate
|-
| 0x4
| 0x4
| ChannelCount
|-
| 0x8
| 0x4
| SampleFormat
|-
| 0xC
| 0x4
| State
|}

= AudioInParameterInternal =
This is "nn::audio::detail::AudioInParameterInternal".

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| SampleRate
|-
| 0x4
| 0x4
| ChannelCount
|-
| 0x8
| 0x4
| SampleFormat
|-
| 0xC
| 0x4
| State
|}

= AudioOutBuffer =
This is "nn::audio::AudioOutBuffer".

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| Pointer to next buffer (unused)
|-
| 0x8
| 0x8
| Pointer to sample buffer
|-
| 0x10
| 0x8
| Capacity of sample buffer
|-
| 0x18
| 0x8
| Size of data in the sample buffer
|-
| 0x20
| 0x8
| Offset of data in the sample buffer (unused/ignored?)
|}

= AudioInBuffer =
This is "nn::audio::AudioInBuffer".

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| Pointer to next buffer (unused)
|-
| 0x8
| 0x8
| Pointer to sample buffer
|-
| 0x10
| 0x8
| Capacity of sample buffer
|-
| 0x18
| 0x8
| Size of data in the sample buffer
|-
| 0x20
| 0x8
| Offset of data in the sample buffer (unused/ignored?)
|}

= FinalOutputRecorderBuffer =
This is "nn::audio::FinalOutputRecorderBuffer".

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| Released
|-
| 0x8
| 0x8
| Pointer to next buffer (unused)
|-
| 0x10
| 0x8
| Pointer to sample buffer
|-
| 0x18
| 0x8
| Capacity of sample buffer
|-
| 0x20
| 0x8
| Size of data in the sample buffer
|-
| 0x28
| 0x8
| Offset of data in the sample buffer (unused/ignored?)
|}

= FinalOutputRecorderParameter =
This is "nn::audio::FinalOutputRecorderParameter".

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| SampleRate
|}

= FinalOutputRecorderParameterInternal =
This is "nn::audio::detail::FinalOutputRecorderParameterInternal".

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| SampleRate
|-
| 0x4
| 0x4
| ChannelCount
|-
| 0x8
| 0x4
| SampleFormat
|-
| 0xC
| 0x4
| State
|}

= FinalOutputRecorderWorkBufferParameterInternal =
This is "nn::audio::detail::FinalOutputRecorderWorkBufferParameterInternal".

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
|
|-
| 0x8
| 0x8
|
|-
| 0x10
| 0x8
|
|}

= OpusParametersEx =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| SampleRate
|-
| 0x4
| 0x4
| ChannelCount
|-
| 0x8
| 0x4
| UseLargeFrameSize
|-
| 0xC
| 0x4
| Padding
|}

= OpusMultiStreamParameters =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| SampleRate
|-
| 0x4
| 0x4
| ChannelCount
|-
| 0x8
| 0x4
| Number of streams
|-
| 0xC
| 0x4
| Number of stereo streams
|-
| 0x10
| 0x100
| u8 array of channel mappings
|}

= OpusMultiStreamParametersEx =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| SampleRate
|-
| 0x4
| 0x4
| ChannelCount
|-
| 0x8
| 0x4
| Number of streams
|-
| 0xC
| 0x4
| Number of stereo streams
|-
| 0x10
| 0x4
| UseLargeFrameSize
|-
| 0x14
| 0x4
| Padding
|-
| 0x18
| 0x100
| u8 array of channel mappings
|}

[[Category:Services]]

Bluetooth Driver services

2021-05-04T21:01:49Z

Qlutoo: Reverted edits by Qlutoo (talk) to last revision by Yellows8

= btdrv =
This is "nn::bluetooth::IBluetoothDriver".

Support for "nn::bluetooth::*" was added to sdknso with 6.x.

btdrv appears to be designed to only be used by the two sysmodules which use it, [[HID_services|hid]] and [[BTM_services|btm]]. This service uses global state, nothing service-session-specific.

This has max_sessions 30. IPC handling is done by the main-thread.

[11.0.0+] sdknso moved various functions/etc from "nn::bluetooth::" into "nn::bluetooth::hal::". This includes all functions exposing btdrv. These btdrv functions now automatically initialize the service if needed, the dedicated initialization function is now a stub since calling it is no longer needed. The internal "nn::bluetooth::user::" functions implementing [[#bt]] were moved to "nn::bluetooth::hal::user::", these are called by the the user-facing "nn::bluetooth::" functions.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#InitializeBluetoothDriver]]
|-
| 1 || [[#InitializeBluetooth]]
|-
| 2 || [[#EnableBluetooth]]
|-
| 3 || [[#DisableBluetooth]]
|-
| 4 || [[#FinalizeBluetooth]] ([?-8.1.1] [[#FinalizeBluetooth|CleanupBluetooth]])
|-
| 5 || [[#GetAdapterProperties]]
|-
| 6 || [[#GetAdapterProperty]]
|-
| 7 || [[#SetAdapterProperty]]
|-
| 8 || [[#StartInquiry]] ([?-8.1.1] [[#StartInquiry|StartDiscovery]])
|-
| 9 || [[#StopInquiry]] ([?-8.1.1] [[#StopInquiry|CancelDiscovery]])
|-
| 10 || [[#CreateBond]]
|-
| 11 || [[#RemoveBond]]
|-
| 12 || [[#CancelBond]]
|-
| 13 || [[#RespondToPinRequest]] ([?-8.1.1] [[#RespondToPinRequest|PinReply]])
|-
| 14 || [[#RespondToSspRequest]] ([?-8.1.1] [[#RespondToSspRequest|SspReply]])
|-
| 15 || [[#GetEventInfo]]
|-
| 16 || [[#InitializeHid]]
|-
| 17 || [[#OpenHidConnection]] ([?-8.1.1] [[#OpenHidConnection|HidConnect]])
|-
| 18 || [[#CloseHidConnection]] ([?-8.1.1] [[#CloseHidConnection|HidDisconnect]])
|-
| 19 || [[#WriteHidData]] ([?-8.1.1] [[#WriteHidData|HidSendData]])
|-
| 20 || [[#WriteHidData2]] ([?-8.1.1] [[#WriteHidData2|HidSendData2]])
|-
| 21 || [[#SetHidReport]] ([?-8.1.1] [[#HidSetReport]])
|-
| 22 || [[#GetHidReport]] ([?-8.1.1] [[#GetHidReport|HidGetReport]])
|-
| 23 || [[#TriggerConnection]] ([?-8.1.1] [[#HidWakeController]])
|-
| 24 || [[#AddPairedDeviceInfo]] ([?-8.1.1] [[#AddPairedDeviceInfo|HidAddPairedDevice]])
|-
| 25 || [[#GetPairedDeviceInfo]] ([?-8.1.1] [[#GetPairedDeviceInfo|HidGetPairedDevice]])
|-
| 26 || [[#FinalizeHid]] ([?-8.1.1] [[#FinalizeHid|CleanupHid]])
|-
| 27 || [[#GetHidEventInfo]] ([?-8.1.1] [[#GetHidEventInfo|HidGetEventInfo]])
|-
| 28 || [[#SetTsi]] ([?-8.1.1]] [[#SetTsi|ExtSetTsi]])
|-
| 29 || [[#EnableBurstMode]] ([?-8.1.1] [[#EnableBurstMode|ExtSetBurstMode]])
|-
| 30 || [[#SetZeroRetransmission]] ([?-8.1.1] [[#SetZeroRetransmission|ExtSetZeroRetran]])
|-
| 31 || [[#EnableMcMode]] ([?-8.1.1] [[#EnableMcMode|ExtSetMcMode]])
|-
| 32 || [[#EnableLlrScan]] ([?-8.1.1] [[#EnableLlrScan|ExtStartLlrMode]])
|-
| 33 || [[#DisableLlrScan]] ([?-8.1.1] [[#DisableLlrScan|ExtExitLlrMode]])
|-
| 34 || [[#EnableRadio]] ([?-8.1.1] [[#EnableRadio|ExtSetRadio]])
|-
| 35 || [[#SetVisibility]] ([?-8.1.1] [[#SetVisibility|ExtSetVisibility]])
|-
| 36 || [4.0.0+] [[#EnableTbfcScan]] ([4.0.0-8.1.1] [[#EnableTbfcScan|ExtSetTbfcScan]])
|-
| 37 ([1.0.0-3.0.2] 36) || [[#RegisterHidReportEvent]]
|-
| 38 ([1.0.0-3.0.2] 37) || [[#GetHidReportEventInfo]] ([?-8.1.1] [[#GetHidReportEventInfo|HidGetReportEventInfo]])
|-
| 39 ([1.0.0-3.0.2] 38) || [[#GetLatestPlr]]
|-
| 40 ([3.0.0-3.0.2] 39) || [3.0.0+] [[#GetPendingConnections]] ([?-8.1.1] [[#GetPendingConnections|ExtGetPendingConnections]])
|-
| 41 ([3.0.0-3.0.2] 40) || [3.0.0+] [[#GetChannelMap]]
|-
| 42 ([3.0.0-3.0.2] 41) || [3.0.0+] [[#EnableTxPowerBoostSetting]] ([?-8.1.1] [[#EnableTxPowerBoostSetting|EnableBluetoothBoostSetting]])
|-
| 43 ([3.0.0-3.0.2] 42) || [3.0.0+] [[#IsTxPowerBoostSettingEnabled]] ([?-8.1.1] [[#IsTxPowerBoostSettingEnabled|IsBluetoothBoostSettingEnabled]])
|-
| 44 ([3.0.0-3.0.2] 43) || [3.0.0+] [[#EnableAfhSetting]] ([?-8.1.1] [[#EnableAfhSetting|EnableBluetoothAfhSetting]])
|-
| 45 ([3.0.0-3.0.2] 44) || [3.0.0+] [[#IsAfhSettingEnabled]] ([?-8.1.1] [[#IsAfhSettingEnabled|IsBluetoothAfhSettingEnabled]])
|-
| 46 || [5.0.0+] [[#InitializeBle]] ([5.0.0-8.1.1] [[#InitializeBle|InitializeBluetoothLe]])
|-
| 47 || [5.0.0+] [[#EnableBle]] ([5.0.0-8.1.1] [[#EnableBle|EnableBluetoothLe]])
|-
| 48 || [5.0.0+] [[#DisableBle]] ([5.0.0-8.1.1] [[#DisableBle|DisableBluetoothLe]])
|-
| 49 || [5.0.0+] [[#FinalizeBle]] ([5.0.0-8.1.1] [[#FinalizeBle|CleanupBluetoothLe]])
|-
| 50 || [5.0.0+] [[#SetBleVisibility]] ([5.0.0-8.1.1] [[#SetBleVisibility|SetLeVisibility]])
|-
| 51 || [5.0.0+] [[#SetBleConnectionParameter]] ([5.0.0-8.1.1] [[#SetLeConnectionParameter]])
|-
| 52 || [5.0.0+] [[#SetBleDefaultConnectionParameter]] ([5.0.0-8.1.1] [[#SetLeDefaultConnectionParameter]])
|-
| 53 || [5.0.0+] [[#SetBleAdvertiseData]] ([5.0.0-8.1.1] [[#SetBleAdvertiseData|SetLeAdvertiseData]])
|-
| 54 || [5.0.0+] [[#SetBleAdvertiseParameter]] ([5.0.0-8.1.1] [[#SetBleAdvertiseParameter|SetLeAdvertiseParameter]])
|-
| 55 || [5.0.0+] [[#StartBleScan]] ([5.0.0-8.1.1] [[#StartBleScan|StartLeScan]])
|-
| 56 || [5.0.0+] [[#StopBleScan]] ([5.0.0-8.1.1] [[#StopBleScan|StopLeScan]])
|-
| 57 || [5.0.0+] [[#AddBleScanFilterCondition]] ([5.0.0-8.1.1] [[#AddBleScanFilterCondition|AddLeScanFilterCondition]])
|-
| 58 || [5.0.0+] [[#DeleteBleScanFilterCondition]] ([5.0.0-8.1.1] [[#DeleteBleScanFilterCondition|DeleteLeScanFilterCondition]])
|-
| 59 || [5.0.0+] [[#DeleteBleScanFilter]] ([5.0.0-8.1.1] [[#DeleteBleScanFilter|DeleteLeScanFilter]])
|-
| 60 || [5.0.0+] [[#ClearBleScanFilters]] ([5.0.0-8.1.1] [[#ClearBleScanFilters|ClearLeScanFilters]])
|-
| 61 || [5.0.0+] [[#EnableBleScanFilter]] ([5.0.0-8.1.1] [[#EnableBleScanFilter|EnableLeScanFilter]])
|-
| 62 || [5.0.0+] [[#RegisterGattClient]] ([5.0.0-8.1.1] [[#RegisterGattClient|RegisterLeClient]])
|-
| 63 || [5.0.0+] [[#UnregisterGattClient]] ([5.0.0-8.1.1] [[#UnregisterGattClient|UnregisterLeClient]])
|-
| 64 || [5.0.0+] [[#UnregisterAllGattClients]] ([5.0.0-8.1.1] [[#UnregisterAllGattClients|UnregisterLeClientAll]])
|-
| 65 || [5.0.0+] [[#ConnectGattServer]] ([5.0.0-8.1.1] [[#ConnectGattServer|LeClientConnect]])
|-
| 66 || [5.1.0+] [[#CancelConnectGattServer]] ([5.1.0-8.1.1] [[#CancelConnectGattServer|LeClientCancelConnection]])
|-
| 67 ([5.0.0-5.0.2] 66) || [5.0.0+] [[#DisconnectGattServer]] ([?-8.1.1] [[#DisconnectGattServer|LeClientCancelConnection]])
|-
| 68 ([5.0.0-5.0.2] 67) || [5.0.0+] [[#GetGattAttribute]] ([5.0.0-8.1.1] [[#GetGattAttribute|LeClientGetAttributes]])
|-
| 69 ([5.0.0-5.0.2] 68) || [5.0.0+] [[#GetGattService]] ([5.0.0-8.1.1] [[#GetGattService|LeClientDiscoverService]])
|-
| 70 ([5.0.0-5.0.2] 69) || [5.0.0+] [[#ConfigureAttMtu]] ([5.0.0-8.1.1] [[#ConfigureAttMtu|LeClientConfigureMtu]])
|-
| 71 ([5.0.0-5.0.2] 70) || [5.0.0+] [[#RegisterGattServer]] ([5.0.0-8.1.1] [[#RegisterGattServer|RegisterLeServer]])
|-
| 72 ([5.0.0-5.0.2] 71) || [5.0.0+] [[#UnregisterGattServer]] ([5.0.0-8.1.1] [[#UnregisterGattServer|UnregisterLeServer]])
|-
| 73 ([5.0.0-5.0.2] 72) || [5.0.0+] [[#ConnectGattClient]] ([5.0.0-8.1.1] [[#ConnectGattClient|LeServerConnect]])
|-
| 74 ([5.0.0-5.0.2] 73) || [5.0.0+] [[#DisconnectGattClient]] ([5.0.0-8.1.1] [[#LeServerDisconnect]])
|-
| 75 || [5.0.0+] [[#AddGattService]] ([5.0.0-8.1.1] [[#AddGattService|CreateLeService]])
|-
| 76 ([5.0.0-5.0.2] 74) || [5.0.0+] [[#EnableGattService]] ([5.0.0-8.1.1] [[#EnableGattService|StartLeService]])
|-
| 77 || [5.0.0+] [[#AddGattCharacteristic]] ([5.0.0-8.1.1] [[#AddGattCharacteristic|AddLeCharacteristic]])
|-
| 78 ([5.0.0-5.0.2] 76) || [5.0.0+] [[#AddGattDescriptor]] ([5.0.0-8.1.1] [[#AddGattDescriptor|AddLeDescriptor]])
|-
| 79 ([5.0.0-5.0.2] 78) || [5.0.0+] [[#GetBleManagedEventInfo]] ([5.0.0-8.1.1] [[#GetBleManagedEventInfo|GetLeCoreEventInfo]])
|-
| 80 ([5.0.0-5.0.2] 79) || [5.0.0+] [[#GetGattFirstCharacteristic]] ([5.0.0-8.1.1] [[#GetGattFirstCharacteristic|LeGetFirstCharacteristic]])
|-
| 81 ([5.0.0-5.0.2] 80) || [5.0.0+] [[#GetGattNextCharacteristic]] ([5.0.0-8.1.1] [[#GetGattNextCharacteristic|LeGetNextCharacteristic]])
|-
| 82 ([5.0.0-5.0.2] 81) || [5.0.0+] [[#GetGattFirstDescriptor]] ([5.0.0-8.1.1] [[#GetGattFirstDescriptor|LeGetFirstDescriptor]])
|-
| 83 ([5.0.0-5.0.2] 82) || [5.0.0+] [[#GetGattNextDescriptor]] ([5.0.0-8.1.1] [[#GetGattNextDescriptor|LeGetNextDescriptor]])
|-
| 84 || [5.0.0+] [[#RegisterGattManagedDataPath]] ([5.0.0-8.1.1] [[#RegisterGattManagedDataPath|RegisterLeCoreDataPath]])
|-
| 85 || [5.0.0+] [[#UnregisterGattManagedDataPath]] ([5.0.0-8.1.1] [[#UnregisterGattManagedDataPath|UnregisterLeCoreDataPath]])
|-
| 86 || [5.0.0+] [[#RegisterGattHidDataPath]] ([5.0.0-8.1.1] [[#RegisterGattHidDataPath|RegisterLeHidDataPath]])
|-
| 87 || [5.0.0+] [[#UnregisterGattHidDataPath]] ([5.0.0-8.1.1] [[#UnregisterGattHidDataPath|UnregisterLeHidDataPath]])
|-
| 88 || [5.0.0+] [[#RegisterGattDataPath]] ([5.0.0-8.1.1] [[#RegisterGattDataPath|RegisterLeDataPath]])
|-
| 89 ([5.0.0-5.0.2] 83) || [5.0.0+] [[#UnregisterGattDataPath]] ([5.0.0-8.1.1] [[#UnregisterGattDataPath|UnregisterLeDataPath]])
|-
| 90 ([5.0.0-5.0.2] 89) || [5.0.0+] [[#ReadGattCharacteristic]] ([5.0.0-8.1.1] [[#ReadGattCharacteristic|LeClientReadCharacteristic]])
|-
| 91 ([5.0.0-5.0.2] 90) || [5.0.0+] [[#ReadGattDescriptor]] ([5.0.0-8.1.1] [[#ReadGattDescriptor|LeClientReadDescriptor]])
|-
| 92 ([5.0.0-5.0.2] 91) || [5.0.0+] [[#WriteGattCharacteristic]] ([5.0.0-8.1.1] [[#WriteGattCharacteristic|LeClientWriteCharacteristic]])
|-
| 93 ([5.0.0-5.0.2] 92) || [5.0.0+] [[#WriteGattDescriptor]] ([5.0.0-8.1.1] [[#WriteGattDescriptor|LeClientWriteDescriptor]])
|-
| 94 || [5.0.0+] [[#RegisterGattNotification]] ([5.0.0-8.1.1] [[#RegisterGattNotification|LeClientRegisterNotification]])
|-
| 95 ([5.0.0-5.0.2] 93) || [5.0.0+] [[#UnregisterGattNotification]] ([5.0.0-8.1.1] [[#UnregisterGattNotification|LeClientDeregisterNotification]])
|-
| 96 ([5.0.0-5.0.2] 95) || [5.0.0+] [[#GetLeHidEventInfo]]
|-
| 97 ([5.0.0-5.0.2] 96) || [5.0.0+] [[#RegisterBleHidEvent]]
|-
| 98 || [5.1.0+] [[#SetBleScanParameter]] ([5.1.0-8.1.1] [[#SetBleScanParameter|SetLeScanParameter]])
|-
| 99 || [10.0.0+] [[#MoveToSecondaryPiconet]]
|-
| 100 || [12.0.0+] [[#IsBluetoothEnabled]]
|-
| 128 || [12.0.0+] [[#AcquireAudioEvent]]
|-
| 129 || [12.0.0+] [[#GetAudioEventInfo]]
|-
| 130 || [12.0.0+] [[#OpenAudioConnection]]
|-
| 131 || [12.0.0+] [[#CloseAudioConnection]]
|-
| 132 || [12.0.0+] [[#OpenAudioOut]]
|-
| 133 || [12.0.0+] [[#CloseAudioOut]]
|-
| 134 || [12.0.0+] [[#AcquireAudioOutStateChangedEvent]]
|-
| 135 || [12.0.0+] [[#StartAudioOut]]
|-
| 136 || [12.0.0+] [[#StopAudioOut]]
|-
| 137 || [12.0.0+] [[#GetAudioOutState]]
|-
| 138 || [12.0.0+] [[#GetAudioOutFeedingCodec]]
|-
| 139 || [12.0.0+] [[#GetAudioOutFeedingParameter]]
|-
| 140 || [12.0.0+] [[#AcquireAudioOutBufferAvailableEvent]]
|-
| 141 || [12.0.0+] [[#SendAudioData]]
|-
| 142 || [12.0.0+] [[#AcquireAudioControlInputStateChangedEvent]]
|-
| 143 || [12.0.0+] [[#GetAudioControlInputState]]
|-
| 144 || [12.0.0+] [[#AcquireAudioConnectionStateChangedEvent]]
|-
| 145 || [12.0.0+] [[#GetConnectedAudioDevice]]
|-
| 256 || [5.0.0+] [[#IsManufacturingMode]]
|-
| 257 || [7.0.0+] [[#EmulateBluetoothCrash]]
|-
| 258 || [9.0.0+] [[#GetBleChannelMap]]
|}

Cmds 46-83 were added with [4.0.0+].

Various cmds were moved/etc starting with [[#InitializeBle]] with [5.0.0+].

== InitializeBluetoothDriver ==
No input/output.

[1.0.0-10.2.0] This is the first cmd used during service init.

This just returns 0.

== InitializeBluetooth ==
No input, returns an output Event handle with EventClearMode=1.

This is used by [[BTM_services|btm]], this should not be used by other processes.

[1.0.0-11.0.1] This first initializes the funcptr table interfaces to the defaults (same as [[#DisableBluetooth]]). [[Settings_services#GetConfigurationId1|GetConfigurationId1]] is used, an error is thrown if the output string is empty, or if it matches "SDEV_00_01_00".

If the flag for [[#IsManufacturingMode]] is 0, or if this cmd was already used where that flag was 1, an interface funcptr is called. This is passed a ptr to a table of funcptrs. The ret is converted to a Result and returned if needed. [12.0.0+] A normal func is called instead, with no params/ret. This cmd always returns 0.

The above called func does the following:
* [1.0.0-11.0.1] A func is called, which copies the input funcptr table into global state. These are used for writing events into [[#EventInfo]].
* A func is called 5 times with input param = [1-5]. This initializes the specified nn::bluetooth::CircularBuffer (sharedmem and internal). [12.0.0+] This functionality is now inlined.
* A func is called for creating the "nn.bluetooth.HidMessageHandler" thread. [12.0.0+] This functionality is now inlined.

Lastly, the Event is ([1.0.0-11.0.1] created and) returned (which global state the Event is stored in depends on whether the code-path which calls the above funcptr was used).

== EnableBluetooth ==
No input/output.

This is used by [[BTM_services|btm]].

[1.0.0-11.0.1] This first calls an interface funcptr, on failure 0xCA71 is returned.

[1.0.0-11.0.1] A global fixed [[#Address]] is copied to stack, this stack data is then overwritten with the output from [[Settings_services|GetBluetoothBdAddress]]. If GetBluetoothBdAddress fails, this will Abort. Then the same funcptr used by [[#SetAdapterProperty]] is called with this stack data, with [[#BluetoothPropertyType|type2]]. A converted error is returned if needed.

[1.0.0-11.0.1] The last two bytes of the stack [[#Address]] are inverted (byteval = ~byteval), then the above funcptr is called with this for [[#BluetoothPropertyType|type3]]. Error conversion is handled if needed, then this returns 0.

The first funcptr called above does the following ([12.0.0+] this code is now inlined):
* Calls a GPIO func with param=0, [[SVC|sleeps]] for 10000000 nanoseconds, then calls the GPIO func again with param=1.
* [12.0.0+] Calls a func to update an interface object ptr to use the enabled-object. A vfunc for various interface objects are called, with Result 0xCA71 being returned if the ret is non-zero (failure after the first interface object will trigger an Abort).
* [12.0.0+] [[Settings_services|GetBluetoothBdAddress]] is used, on failure this will Abort. Then the same vfunc used by [[#SetAdapterProperty]] is called with the output from GetBluetoothBdAddress, with [[#AdapterPropertyType|type0]]. This will Abort on failure.
* [12.0.0+] The last two bytes of the stack [[#Address]] are inverted (byteval = ~byteval), then the above vfunc is called with this for [[#AdapterPropertyType|type3]]. This will Abort on failure, otherwise 0 is returned.
* [12.0.0+] Various code described below was moved into the above vfunc(s), etc.
* Calls a func for initializing the paired-devices table (empty).
* Calls a modified version of BSA_Boot, which handles BSA server initialization.
* Calls a func which uses <code>nn::os::InitializeEvent</code> and <code>nn::os::InitializeMutex</code> with global state.
* Calls a func which handles BSA client initialization. This also sends a message to the "nn.bluetooth.HidMessageHandler" thread for enabling bluetooth (which updates the interface funcptr tables, etc).
* Calls a func which enables HID-Host with BSA, and opens the UIPC channel where the registered funcptr is used for writing HID DATA [[#GetHidReportEventInfo|reports]] which were received.
* Calls a func which initializes global state and uses BSA for initializing Security.
* If the output flag from [[Settings_services#GetBluetoothBoostEnableFlag|GetBluetoothBoostEnableFlag]] is set, a func is called.
* If the output flag from [[Settings_services#GetBluetoothAfhEnableFlag|GetBluetoothAfhEnableFlag]] is not set, a func is called.

The GPIO func does the following:
* Initializes the [[Bus_services|gpio]] service.
* Uses [[Bus_services#OpenSession|OpenSession]] with value 0x03 (BtRst).
* Uses SetDirection with value 0x1.
* Uses SetValue with the param which was passed to this func.
* Does cleanup for the session object and exits the service.

[12.0.0+] The Enable vfunc called above for Audio does the following:
* Calls a func which does the following:
** Uses BSA to enable AV. Besides the callback, the only field in the passed struct which is set is <code>features</code>. This is set for "remote control target".
** Error handling + state setup is done.
** Uses BSA to register AV twice, with the default input struct.
** Error handling + state setup is done.
* If an error occurred in a certain range, a [[#FatalReason|fatal]] is triggered and 0 is returned.
* Otherwise when successful, state init is done then 0 is returned.

== DisableBluetooth ==
No input/output.

This is used by [[BTM_services|btm]].

[1.0.0-11.0.1] This calls an interface funcptr. On success, the funcs for updating the interface funcptr tables are called (same as [[#InitializeBluetooth]]). Then the converted ret is returned as needed.

* [12.0.0+] Vfuncs for various interface objects are called, with failure triggering an Abort in some cases.
* [12.0.0+] Calls funcs to update interfaces object ptrs to use the disabled-object.
* [12.0.0+] Calls the same GPIO func as [[#EnableBluetooth]] with param=0, then 0 is returned.
* [12.0.0+] Various code described below was moved into the above vfunc(s), etc.

When bluetooth is already disabled, that funcptr just returns 0. Otherwise when it's already enabled, it does the following:
* Calls a func which closes the HID-Host UIPC channel, and uses BSA for disabling HID-Host.
* Calls a func which uses <code>nn::os::FinalizeMutex</code> and <code>nn::os::FinalizeEvent</code> with global state.
* Uses <code>nn::os::InitializeEvent</code>, <code>nn::os::InitializeTimerEvent</code>, with a ptr for the former Event being written into global state.
* Uses BTA_DisableBluetooth.
* Uses <code>nn::os::StartOneShotTimerEvent</code> with a value of 5 seconds.
* Waits for either of the above to trigger using <code>nn::os::TryWaitEvent</code> and <code>nn::os::TryWaitTimerEvent</code>, with each loop iteration [[SVC|sleeping]] for 5000000 nanoseconds.
** The Event is signaled when disabling bluetooth finishes.
* Cleanup for the above Event/TimerEvent is done.
* Calls a func which handles BSA client cleanup.
* Calls a func which does the following:
** Calls a func which tells the "nn.bluetooth.TimerThread" to exit, then destroys that thread (GKI timer thread).
** Calls a func which just returns.
** Calls a func which handles GKI cleanup (including destroying the task threads).
** Calls a func which waits for the UIPC threads to exit + destroys the threads and handles cleanup.
* Calls the same GPIO func as [[#EnableBluetooth]] with param=0.
* Sends a message to the "nn.bluetooth.HidMessageHandler" thread for disabling bluetooth (which updates the interface funcptr tables, etc).

== FinalizeBluetooth ==
No input/output.

Not used by [[BTM_services|btm]], other processes should not use this.

Calls an interface funcptr, the ret is ignored. The Event setup by [[#InitializeBluetooth]] is closed. Lastly, the same funcs used by [[#InitializeBluetooth]] are called for initializing the interface funcptr tables to the defaults, then 0 is returned.

The above interface funcptr does the following (regardless of whether bluetooth is disabled/enabled):
* Calls a func which: uses <code>nn::os::SignalLightEvent</code> to tell the "nn.bluetooth.HidMessageHandler" thread to exit, then waits for the thread to exit and destroys the thread.
* Calls the same func as [[#InitializeBluetooth]] for setting event funcptrs in global state, except in this case the content of the input table is all NULL.
* Calls a func 5 times with param=[1-5]. This is the cleanup version of the nn::bluetooth::CircularBuffer setup func used by [[#InitializeBluetooth]].

== GetAdapterProperties ==
Takes a type-0x1A output buffer containing an [[#AdapterProperty]].

[12.0.0+] Takes a type-0x1A output buffer containing an [[#AdapterPropertySet]].

This is used by [[BTM_services|btm]].

== GetAdapterProperty ==
Takes an input [[#BluetoothPropertyType]] and a type-0xA output buffer.

[12.0.0+] Takes an input [[#AdapterPropertyType]] and a type-0x1A output buffer containing an [[#AdapterProperty]].

== SetAdapterProperty ==
Takes an input [[#BluetoothPropertyType]] and a type-0x9 input buffer.

[12.0.0+] Takes a type-0x19 input buffer containing an [[#AdapterProperty]], no output.

== StartInquiry ==
No input/output.

[12.0.0+] Takes an input BitFlagSet 32bit [[#ServiceFlag|services]] and s64 nanoseconds_duration, no output.

This is used by [[BTM_services|btm]].

This starts Inquiry, the output data will be available via [[#GetEventInfo]]. Inquiry will automatically stop in 10.24 seconds ([12.0.0+] calculated from the input duration instead).

[12.0.0+] When services is -1 the original defaults from pre-12.0.0 are used (besides duration). Otherwise, services is written into the parameter struct (masked with the all-allowed-BSA-services value), and the EventInfo for discovered devices are triggered when inquiry finishes instead of immediately.

== StopInquiry ==
No input/output.

This is used by [[BTM_services|btm]].

This stops Inquiry which was started by [[#StartInquiry]], if it's still active.

== CreateBond ==
Takes an input [[#Address]] and a type-0x19 input buffer containing a [[#TransportType]], no output.

[9.0.0+] Now only takes an [[#Address]] and a [[#TransportType]] without a buffer, no output.

The [[#TransportType]] is unused.

This is used by [[BTM_services|btm]].

== RemoveBond ==
Takes an input [[#Address]], no output.

This is used by [[BTM_services|btm]].

== CancelBond ==
Takes an input [[#Address]], no output.

This is used by [[BTM_services|btm]].

== RespondToPinRequest ==
Takes an input [[#Address]], a bool, an u8, a [[#BluetoothPinCode]], no output.

[12.0.0+] Takes an input [[#Address]], a [[#PinCode]], no output.

sdknso uses an user-specified s32 for the u8.

The sysmodule impl for the funcptr used with this cmd only uses the [[#Address]] - this and hard-coded PIN "0000" are written into the parameter struct (and a size field for the PIN).

[12.0.0+] The input [[#PinCode]] is now actually used and passed to BSA, instead of hard-coding the PIN.

== RespondToSspRequest ==
Takes an input [[#Address]], a [[#BluetoothSspVariant]], a bool, an u32, no output.

[12.0.0+] Takes an input [[#Address]], a bool, a [[#BluetoothSspVariant]], an u32, no output.

This is used by [[BTM_services|btm]].

The sysmodule impl for the funcptr/vfunc used with this cmd only uses the [[#Address]] and bool - the parameter struct size is only 0x7-bytes. The bool indicates whether the request is accepted.

== GetEventInfo ==
Takes a type-0xA output buffer and returns an output [[#EventType]].

This copies 0x400-bytes from state to the output buffer, copies the [[#EventType]] from state to output, and signals an event.

[12.0.0+] Mutex locking is now used, with the code prior to the event-signal. If a size field in state is 0, writing the output [[#EventType]]/buffer is skipped. Otherwise, the size field is reset to 0, the [[#EventType]] from state is copied to output, and the original size field is used to memcpy to the output buffer from state.

This is used by [[BTM_services|btm]].

See [[#EventInfo]].

== InitializeHid ==
Takes an input u16, returns an output Event with EventClearMode=1.

Originally sdknso used an user-specified value for the u16, however with [9.0.0+] it uses hard-coded value 0x1 instead.

This is used by [[BTM_services|btm]], this should not be used by other processes.

== OpenHidConnection ==
Takes an input [[#Address]], no output.

This just returns 0.

This is used by [[BTM_services|btm]].

== CloseHidConnection ==
Takes an input [[#Address]], no output.

This is used by [[BTM_services|btm]].

== HidSendData ==
Takes an input [[#Address]] and a type-0x19 input buffer containing a [[#HidData]], no output.

== WriteHidData ==
Takes an input [[#Address]] and a type-0x19 input buffer containing a [[#HidReport]], no output.

This is used by [[HID_services|hid]].

This sends a HID DATA transaction packet with report-type Output.

== WriteHidData2 ==
Takes an input [[#Address]] and a type-0x9 input buffer, no output.

This is internally the same as [[#WriteHidData]], with the input buffer being directly passed to the funcptr instead of a tmp copy of the input [[#HidReport]].

== HidSetReport ==
Takes an input [[#Address]], a [[#BluetoothHhReportType]], a type-0x19 input buffer containing a [[#HidData]], no output.

== SetHidReport ==
Takes an input [[#Address]], a [[#BluetoothHhReportType]], a type-0x19 input buffer containing a [[#HidReport]], no output.

This is used by [[HID_services|hid]].

This sends a HID SET_REPORT transaction packet.

== GetHidReport ==
Takes an input [[#Address]], an u8 report_id, a [[#BluetoothHhReportType]], no output.

This is used by [[HID_services|hid]].

This sends a HID GET_REPORT transaction packet. The report_id is sent in the packet for the Report Id, when non-zero.

== HidWakeController ==
Takes an input [[#Address]], no output.

== TriggerConnection ==
Takes an input [[#Address]] and an u16, no output.

This is used by [[BTM_services|btm]].

This calls an interface funcptr, then returns the converted ret as needed.

The funcptr does the following:
* Calls a func, returning the ret on failure. This uses a BSA extension (message 0x8CE), with the input u16 being used with this.
* Then another func is called, with the input [[#Address]], with the ret from here being returned. This throws an error if the device isn't paired. This opens a HID-Host connection to the specified [[#Address]]. The passed sec_mask is 0x12 (Inbound/outbound authentication required), and brcm_mask is set for enabling TBFC Page.

The handler for the above message with the used bit flag does the following:
* Uses HCI vendor command 0xFCC2 with param_len=0xE. Param data: u32 +0 = 0x14E18, u16 +4 = 0x20, u8 +6 = 0x2, u16 +7 = {input u16 message param value} (written via u8 writes), u32 +9 = 0x30200, u8 +0xD = 0.

== AddPairedDeviceInfo ==
Takes a type-0x19 input buffer containing [[Settings_services#BluetoothDevicesSettings|BluetoothDevicesSettings]], no output.

This is used by [[BTM_services|btm]].

[12.0.0+] If [[Settings_services#BluetoothDevicesSettings|TrustedServices]] is 0, value 0x100000 is used. When bit20 is set, HID is initialized for this device, otherwise when bitmask 0xC0000 is set (<code>if((TrustedServices & 0xC0000) != 0)</code>) [[#OpenAudioConnection|audio]] is initialized for this device.

== GetPairedDeviceInfo ==
Takes an input [[#Address]] and a type-0x1A output buffer containing [[Settings_services#BluetoothDevicesSettings|BluetoothDevicesSettings]].

This is used by [[BTM_services|btm]].

== FinalizeHid ==
No input/output.

Not used by [[BTM_services|btm]], other processes should not use this.

== GetHidEventInfo ==
Takes a type-0xA output buffer, returns an output [[#HidEventType]].

This copies 0x480-bytes from state to the output buffer. [[#HidEventType]] is set to: stateval!=0 ? 7 : 0. Once finished, this signals an event.

[12.0.0+] Mutex locking is now used, with the code prior to the event-signal. If a size field in state is 0, writing the output [[#HidEventType]]/buffer is skipped. Otherwise, the size field is reset to 0, the [[#HidEventType]] from state is copied to output, and the original size field is used to memcpy to the output buffer from state.

This is used by [[BTM_services|btm]].

See [[#HidEventInfo]].

== SetTsi ==
Takes an input [[#Address]] and an u8 Tsi, no output.

This is used by [[BTM_services|btm]].

The response will be available via [[#GetHidEventInfo]] ([12.0.0+] [[#GetEventInfo]]).

This uses a BSA extension.

Tsi: non-value-0xFF to Set (BSA message 0x8CA), value 0xFF to Exit (BSA message 0x8CB).

Set: this uses command HCI_Set_MWS_Signaling with data determined using the input u8. Then this uses Broadcom HCI vendor command 0xFD95 with param_len=0x2: param +0x0 = 0x1, +0x1 = {Tsi value}. When this vendor command is successful, it then uses command HCI_Sniff_Mode with data selected using the Tsi value as the array-index. If the remote device doesn't support this (status indicating error with Mode Change Event for the response to HCI_Sniff_Mode), an error will be thrown via the [[#GetHidEventInfo|EventInfo]]. That error can be resolved if the remote device uses the HCI_Sniff_Mode command prior to the Switch doing so.

Exit: this uses command HCI_Exit_Sniff_Mode.

== EnableBurstMode ==
Takes an input [[#Address]] and a bool, no output.

This is used by [[BTM_services|btm]].

The response will be available via [[#GetHidEventInfo]] ([12.0.0+] [[#GetEventInfo]]).

This uses a BSA extension.

bool flag: true = Set (BSA message 0x8CC), false = Exit (BSA message 0x8CD).

== SetZeroRetransmission ==
Takes an input [[#Address]] and a type-0x9 input buffer containing an array of u8s, no output.

The entry-count is clamped to a maximum of 5, the count can be 0. This buffer contains ReportIds.

This is used by [[BTM_services|btm]].

The response will be available via [[#GetHidEventInfo]] ([12.0.0+] [[#GetEventInfo]]).

This uses a BSA extension (message 0x8CF).

== EnableMcMode ==
Takes an input bool, no output.

This is used by [[BTM_services|btm]].

This uses a BSA extension (message 0x8CE).

== EnableLlrScan ==
No input/output.

This is used by [[BTM_services|btm]].

This uses a BSA extension (message 0x8CE).

== DisableLlrScan ==
No input/output.

This is used by [[BTM_services|btm]].

This uses a BSA extension (message 0x8CE).

== EnableRadio ==
Takes an input bool, no output.

This is used by [[BTM_services|btm]].

This uses a BSA extension (message 0x8CE).

The message is handled by using HCI vendor command 0xFC34 with param_len=0x1: param +0 = {input bool}.

== SetVisibility ==
Takes two input bools, no output.

The first bool controls Inquiry Scan, whether the device can be discovered during Inquiry. The second bool controls Page Scan, whether the device accepts connections.

This is used by [[BTM_services|btm]].

== EnableTbfcScan ==
Takes an input bool, no output.

This is used by [[BTM_services|btm]].

== RegisterHidReportEvent ==
No input, returns an output Event handle with EventClearMode=1.

This gets the Event handle for a previously created Event.

This is used by [[HID_services|hid]].

The Event is signaled when data is available with [[#GetHidReportEventInfo]].

== GetHidReportEventInfo ==
No input, takes a type-0xA output buffer and returns a [[#HidEventType]].

[7.0.0+] No longer takes a buffer or returns output, now returns an output sharedmem handle. sdknso maps this with size=0x3000 and permissions=RW-.

Originally this was used in a dedicated sdknso func, with [7.0.0+] this is now used at the start of the sdknso impl for [[#RegisterHidReportEvent]] if the above sharedmem was not mapped yet.

The [7.0.0+] GetHidReportEventInfo sdknso func loads data using the above sharedmem.

This is used by [[HID_services|hid]].

== GetLatestPlr ==
Takes a type-0x16 output buffer containing a [[#PlrList]] ([1.0.0-8.1.1] [[#PlrStatistics]]).

[12.0.0+] Takes a type-0xA output buffer containing an array of [[#PacketLostRate]], returns an output s32.

This calls an interface funcptr then returns 0.

The interface funcptr impl will Abort if the output struct ptr is NULL. Then data is copied from global state to output, doing double->u32 conversion as needed.

== GetPendingConnections ==
No input/output.

This is used by [[BTM_services|btm]].

The output data will be available via [[#GetHidEventInfo]] ([12.0.0+] [[#GetEventInfo]]).

== GetChannelMap ==
Takes a type-0x16 output buffer containing a [[#ChannelMapList]].

[12.0.0+] Takes two type-0xA output buffers, returns an output s32. The first buffer contains an array of [[#Address]], the second buffer contains an array of BitFlagSet with [[#Channel]] and bit-count=79.

This calls an interface funcptr then returns 0.

== EnableTxPowerBoostSetting ==
Takes an input bool, no output.

sdknso ignores errors from this. sdknso exposes this under "nn::bluetooth::debug::".

== IsTxPowerBoostSettingEnabled ==
No input, returns an output bool.

sdknso sets the tmpout_bool to 1, and uses that with the cmd. The sdknso func directly returns tmpout_bool, errors from the cmd are ignored.

sdknso exposes this under "nn::bluetooth::debug::".

== EnableAfhSetting ==
Takes an input bool, no output.

sdknso ignores errors from this. sdknso exposes this under "nn::bluetooth::debug::".

== IsAfhSettingEnabled ==
sdknso sets the tmpout_bool to 1, and uses that with the cmd. The sdknso func directly returns tmpout_bool, errors from the cmd are ignored.

sdknso exposes this under "nn::bluetooth::debug::".

== InitializeBle ==
No input, returns an output Event handle with EventClearMode=1.

This is used by [[BTM_services|btm]].

== EnableBle ==
No input/output.

This is used by [[BTM_services|btm]].

== DisableBle ==
No input/output.

This is used by [[BTM_services|btm]].

== FinalizeBle ==
No input/output.

== SetBleVisibility ==
Takes two input bools, no output.

First bool: whether the BLE device is discoverable. Second bool: whether the BLE device is connectable.

== SetLeConnectionParameter ==
Takes a [[#LeConnectionParams]], no output.

== SetBleConnectionParameter ==
Takes an input [[#Address]], a bool, a [[#BleConnectionParameter]], no output.

This is used by [[BTM_services|btm]].

== SetLeDefaultConnectionParameter ==
Takes a [[#LeConnectionParams]], no output.

== SetBleDefaultConnectionParameter ==
Takes a [[#BleConnectionParameter]], no output.

This is used by [[BTM_services|btm]].

== SetBleAdvertiseData ==
Takes a type-0x19 input buffer containing a [[#BleAdvertisePacketData]], no output.

== SetBleAdvertiseParameter ==
Takes an input [[#Address]], two u16s, no output.

== StartBleScan ==
No input/output.

This is used by [[BTM_services|btm]].

== StopBleScan ==
No input/output.

This is used by [[BTM_services|btm]].

== AddBleScanFilterCondition ==
Takes a type-0x19 input buffer containing a [[#BleAdvertiseFilter]], no output.

This is used by [[BTM_services|btm]].

== DeleteBleScanFilterCondition ==
Takes a type-0x19 input buffer containing a [[#BleAdvertiseFilter]], no output.

This is used by [[BTM_services|btm]].

== DeleteBleScanFilter ==
Takes an input u8, no output.

Originally the sdknso func used an u8 for the user-specified param, with [9.0.0+] it's a s32.

== ClearBleScanFilters ==
No input/output.

This is used by [[BTM_services|btm]].

== EnableBleScanFilter ==
Takes an input bool, no output.

This is used by [[BTM_services|btm]].

== RegisterGattClient ==
Takes an input [[#GattAttributeUuid]], no output.

This is used by [[BTM_services|btm]].

== UnregisterGattClient ==
Takes an input u8, no output.

== UnregisterAllGattClients ==
No input/output.

== ConnectGattServer ==
Takes an input u8, an [[#Address]], a bool, an [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]], no output.

This is used by [[BTM_services|btm]].

== CancelConnectGattServer ==
Takes an input u8, an [[#Address]], a bool, no output.

This is used by [[BTM_services|btm]].

== DisconnectGattServer ==
Takes an input u32, no output.

This is used by [[BTM_services|btm]].

== GetGattAttribute ==
Takes an [[#Address]] and an u32, no output.

[9.0.0+] Now takes an input u32, no output.

== GetGattService ==
Takes an input u32 and a [[#GattAttributeUuid]], no output.

== ConfigureAttMtu ==
Takes an input u16 and u32, no output.

This is used by [[BTM_services|btm]].

== RegisterGattServer ==
Takes an input [[#GattAttributeUuid]], no output.

== UnregisterGattServer ==
Takes an input u8, no output.

== ConnectGattClient ==
Takes an input u8, an [[#Address]], a bool, no output.

== LeServerDisconnect ==
Takes an input u8, an [[#Address]], no output.

== DisconnectGattClient ==
Takes an input u8, no output.

== AddGattService ==
Takes an input u8, an u8, a bool, a [[#GattAttributeUuid]], no output.

Originally sdknso used an user-specified u8 for the second u8, with [9.0.0+] that func param is now a s32.

== EnableGattService ==
Takes an input u8, a [[#GattAttributeUuid]], no output.

== AddGattCharacteristic ==
Takes an input u8, an u8, an u16, a [[#GattAttributeUuid]], a [[#GattAttributeUuid]], no output.

== AddGattDescriptor ==
Takes an input u8, an u16, a [[#GattAttributeUuid]], a [[#GattAttributeUuid]], no output.

== GetBleManagedEventInfo ==
Takes a type-0xA output buffer, returns an output [[#BleEventType]].

This copies 0x400-bytes from state to the output buffer, and copies the [[#BleEventType]] from state to output.

This is used by [[BTM_services|btm]].

== GetGattFirstCharacteristic ==
Takes an input bool, an u32, a [[#GattId]], a [[#GattAttributeUuid]], returns an output u8 Property and [[#GattId|CharacteristicId]].

== GetGattNextCharacteristic ==
Takes an input bool, an u32, a [[#GattId]], a [[#GattId]], a [[#GattAttributeUuid]], returns an output u8 Property and [[#GattId|CharacteristicId]].

== GetGattFirstDescriptor ==
Takes an input bool, an u32, a [[#GattId]], a [[#GattId]], a [[#GattAttributeUuid]], returns an output [[#GattId|DescriptorId]].

== GetGattNextDescriptor ==
Takes an input bool, an u32, a [[#GattId]], a [[#GattId]], a [[#GattId]], a [[#GattAttributeUuid]], returns an output [[#GattId|DescriptorId]].

== RegisterGattManagedDataPath ==
Takes an input [[#GattAttributeUuid]], no output.

This is used by [[BTM_services|btm]].

== UnregisterGattManagedDataPath ==
Takes an input [[#GattAttributeUuid]], no output.

== RegisterGattHidDataPath ==
Takes an input [[#GattAttributeUuid]], no output.

This is used by [[BTM_services|btm]].

== UnregisterGattHidDataPath ==
Takes an input [[#GattAttributeUuid]], no output.

This is used by [[BTM_services|btm]].

== RegisterGattDataPath ==
Takes an input [[#GattAttributeUuid]], no output.

This is used by [[BTM_services|btm]].

== UnregisterGattDataPath ==
Takes an input [[#GattAttributeUuid]], no output.

This is used by [[BTM_services|btm]].

== ReadGattCharacteristic ==
Takes an input bool PrimaryService, an u8, an u32 ConnectionHandle, a [[#GattId]], a [[#GattId]], no output.

This is used by [[HID_services|hid]] and [[BTM_services|btm]].

== ReadGattDescriptor ==
Takes an input bool PrimaryService, an u8, an u32 ConnectionHandle, a [[#GattId]], a [[#GattId]], a [[#GattId]], no output.

This is used by [[HID_services|hid]].

== WriteGattCharacteristic ==
Takes a type-0x9 input buffer, a bool PrimaryService, an u8, a bool, an u32 ConnectionHandle, a [[#GattId]], a [[#GattId]], no output.

The buffer size must be <=0x258.

This is used by [[HID_services|hid]] and [[BTM_services|btm]].

== WriteGattDescriptor ==
Takes a type-0x9 input buffer, a bool PrimaryService, an u8, an u32 ConnectionHandle, a [[#GattId]], a [[#GattId]], a [[#GattId]], no output.

The buffer size must be <=0x258.

This is used by [[HID_services|hid]] and [[BTM_services|btm]].

== RegisterGattNotification ==
Takes an input bool, an u32 ConnectionHandle, a [[#GattId]], a [[#GattId]], no output.

This is used by [[HID_services|hid]] and [[BTM_services|btm]].

== UnregisterGattNotification ==
Takes an input bool, an u32 ConnectionHandle, a [[#GattId]], a [[#GattId]], no output.

This is used by [[HID_services|hid]].

== GetLeHidEventInfo ==
Takes a type-0xA output buffer, returns an output [[#BleEventType]].

This copies 0x400-bytes from state to the output buffer, and copies the [[#BleEventType]] from state to output. This also resets the state which was used for the outbuf-copy. Once finished, this signals an event.

This is used by [[HID_services|hid]].

See [[#LeEventInfo]] for the output buffer.

== RegisterBleHidEvent ==
No input, returns an output Event handle with EventClearMode=1.

This is used by [[HID_services|hid]].

== SetBleScanParameter ==
Takes two input u16s, no output.

This is used by [[BTM_services|btm]].

== MoveToSecondaryPiconet ==
Takes an input [[#Address]], no output.

The response will be available via [[#GetHidEventInfo]] ([12.0.0+] [[#GetEventInfo]]).

This uses a BSA extension (message 0x8D0).

== IsBluetoothEnabled ==
No input, returns an output bool.

== AcquireAudioEvent ==
No input, returns an output Event handle.

sdknso uses an user-specified EventClearMode.

This just gets a previously-initialized Event from global state, [[#IsManufacturingMode]] is used to select which Event to use.

== GetAudioEventInfo ==
Takes a type-0xA output buffer, returns an output [[#AudioEventType]].

This is essentially the same as the other [12.0.0+] Get*EventInfo cmds, however in this case the output type is set to value 0 when no event is available.

See [[#AudioEventInfo]].

== OpenAudioConnection ==
Takes an input [[#Address]], no output.

This goes through state and eventually uses BSA to open an AV connection. The input struct has the RC flag set to true. sec_mask is set to require authentication and encryption.

== CloseAudioConnection ==
Takes an input [[#Address]], no output.

This goes through state and eventually uses BSA to close an AV connection.

== OpenAudioOut ==
Takes an input [[#Address]], returns an output u32 audio_handle.

== CloseAudioOut ==
Takes an input u32 [[#OpenAudioOut|audio_handle]], no output.

== AcquireAudioOutStateChangedEvent ==
Takes an input u32 [[#OpenAudioOut|audio_handle]], returns an output Event handle.

sdknso uses an user-specified EventClearMode.

== StartAudioOut ==
Takes an input u32 [[#OpenAudioOut|audio_handle]], a [[#PcmParameter]], a nn::TimeSpan latency, returns an output nn::TimeSpan latency and u64.

This eventually uses BSA to start an AV stream. The codec is "Raw PCM". Synchronous feeding mode is used.

== StopAudioOut ==
Takes an input u32 [[#OpenAudioOut|audio_handle]], no output.

This eventually uses BSA to stop an AV stream. The pause flag is set to false.

== GetAudioOutState ==
Takes an input u32 [[#OpenAudioOut|audio_handle]], returns an output [[#AudioOutState]].

== GetAudioOutFeedingCodec ==
Takes an input u32 [[#OpenAudioOut|audio_handle]], returns an output [[#AudioCodec]].

== GetAudioOutFeedingParameter ==
Takes an input u32 [[#OpenAudioOut|audio_handle]], returns an output [[#PcmParameter]].

== AcquireAudioOutBufferAvailableEvent ==
Takes an input u32 [[#OpenAudioOut|audio_handle]], returns an output Event handle.

sdknso uses an user-specified EventClearMode.

This gets an Event which was previously initialized.

== SendAudioData ==
Takes an input u32 [[#OpenAudioOut|audio_handle]], a type-0x9 input buffer, returns an output u64 transferred_size.

This eventually uses BSA to send the specified buffer to the required UIPC channel. If transferred_size doesn't match the buffer size, error 0x177A71 is returned. transferred_size is always either 0 (error occured) or the buffer size.

== AcquireAudioControlInputStateChangedEvent ==
No input, returns an output Event handle.

sdknso uses an user-specified EventClearMode.

This gets an Event which was previously initialized.

== GetAudioControlInputState ==
Takes a type-0xA output buffer containing an array of [[#AudioControlButtonState]], returns an output s32 total_out.

A maximum of 0xF entries can be returned.

== AcquireAudioConnectionStateChangedEvent ==
No input, returns an output Event handle.

sdknso uses an user-specified EventClearMode.

This gets an Event which was previously initialized.

== GetConnectedAudioDevice ==
Takes a type-0xA output buffer containing an array of [[#Address]], returns an output s32 total_out.

A maximum of 0x8 entries can be returned.

== IsManufacturingMode ==
No input, returns an output bool.

sdknso will Abort if this fails, the bool is returned instead of a Result. sdknso exposes this under "nn::bluetooth::debug::".

This calls the same two funcs as various other cmds etc. This writes the bool returned by the second func to output, then returns 0. The second func loads the bool from [[System_Settings|system-setting]] "bluetooth_debug!skip_boot". The first func is the same as the second one, except it writes the bool into global state. [12.0.0+] These two funcs now additionally load [[System_Settings|system-setting]] "bluetooth_config!skip_boot", which is ORRed with the first setting, then that's used for storing in state / returning the value.

This is used by [[BTM_services|btm]].

== EmulateBluetoothCrash ==
Takes an input [[#FatalReason]], no output.

sdknso masks the FatalReason with an u16-mask before passing it to the cmd. sdknso exposes this under "nn::bluetooth::debug::".

This writes data into a CircularBuffer (seperate from sharedmem) with type=0x29, where the data is an u16 determined using the input [[#FatalReason]]. This is only done if a state field is value 0x3, after calling the func for this the field is set to value 0. The thread handling that sent message then converts the u16 back into a [[#FatalReason]] for writing into [[#EventInfo]].

== GetBleChannelMap ==
Takes a type-0x16 output buffer containing a [[#ChannelMapList]].

[12.0.0+] Takes two type-0xA output buffers, returns an output s32. The first buffer contains an array of [[#Address]], the second buffer contains an array of BitFlagSet with [[#LeChannel]] and bit-count=40.

= bt =
This is "nn::bluetooth::IBluetoothUser".

This has max_sessions 30. IPC handling is done by the main-thread.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#LeClientReadCharacteristic]]
|-
| 1 || [[#LeClientReadDescriptor]]
|-
| 2 || [[#LeClientWriteCharacteristic]]
|-
| 3 || [[#LeClientWriteDescriptor]]
|-
| 4 || [[#LeClientRegisterNotification]]
|-
| 5 || [[#LeClientDeregisterNotification]]
|-
| 6 || [[#SetLeResponse]]
|-
| 7 || [[#LeSendIndication]]
|-
| 8 || [[#GetLeEventInfo]]
|-
| 9 || [[#RegisterBleEvent]]
|}

== LeClientReadCharacteristic ==
Takes a PID, a bool, an u8, an u32, a [[#GattId]], a [[#GattId]], an [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]], no output.

This is essentially the same as [[#ReadGattCharacteristic]], the AppletResourceUserId is unused.

== LeClientReadDescriptor ==
Takes a PID, a bool, an u8, an u32, a [[#GattId]], a [[#GattId]], a [[#GattId]], an [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]], no output.

This is essentially the same as [[#ReadGattDescriptor]], the AppletResourceUserId is unused.

== LeClientWriteCharacteristic ==
Takes a PID, a type-0x9 input buffer, a bool, an u8, a bool, an u32, a [[#GattId]], a [[#GattId]], an [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]], no output.

This is essentially the same as [[#WriteGattCharacteristic]], the AppletResourceUserId is unused.

== LeClientWriteDescriptor ==
Takes a PID, a type-0x9 input buffer, a bool, an u8, an u32, a [[#GattId]], a [[#GattId]], a [[#GattId]], an [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]], no output.

This is essentially the same as [[#WriteGattDescriptor]], the AppletResourceUserId is unused.

== LeClientRegisterNotification ==
Takes a PID, an input bool, an u32, a [[#GattId]], a [[#GattId]], an [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]], no output.

This is essentially the same as [[#RegisterGattNotification]], the AppletResourceUserId is unused.

== LeClientDeregisterNotification ==
Takes a PID, an input bool, an u32, a [[#GattId]], a [[#GattId]], an [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]], no output.

This is essentially the same as [[#UnregisterGattNotification]], the AppletResourceUserId is unused.

== SetLeResponse ==
Takes a PID, a type-0x9 input buffer, an u8, a [[#GattAttributeUuid]], a [[#GattAttributeUuid]], an [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]], no output.

The AppletResourceUserId is unused.

The buffer size must be <=0x258.

== LeSendIndication ==
Takes a PID, a type-0x9 input buffer, an u8, a bool, a [[#GattAttributeUuid]], a [[#GattAttributeUuid]], an [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]], no output.

The AppletResourceUserId is unused.

The buffer size used internally is clamped to max size 0x258.

== GetLeEventInfo ==
Takes a PID, a type-0xA output buffer, an [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]], returns an output [[#BleEventType]].

This is identical to [[#GetLeHidEventInfo]] except different state is used. The AppletResourceUserId is unused. See [[#LeEventInfo]] for the output buffer.

== RegisterBleEvent ==
Takes a PID, an [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]], returns an output Event handle with EventClearMode=1.

This is identical to [[#RegisterBleHidEvent]] except different Event state is used. The AppletResourceUserId is unused.

= BluetoothPropertyType =
This is u32 enum "nn::bluetooth::BluetoothPropertyType".

The sysmodule will Abort if the input type is unavailable / not recognized.

{| class="wikitable" border="1"
|-
! Value
! Description
! Buffer contents
|-
| 1 || Name || String, max length 0xF8 excluding NUL-terminator.
|-
| 2 || Address || [[#Address]]
|-
| 3 || || Only available with [[#SetAdapterProperty]]. Unknown, [[#Address]]. The default is the same as type2, with the last two bytes inverted.
This uses a BSA extension (message 0x8CE), the message handler which is used here uses HCI vendor command 0xFD98 with param_len=0x7: u8 param+0 = {whether the [[#Address]] is non-zero}, +1 6-bytes = {[[#Address]] with byte-order swapped}.
|-
| 5 || || 3-bytes, Class of Device.
|-
| 6 || || 1-byte, FeatureSet. The default is value 0x68.
|}

= AdapterPropertyType =
This is u32 enum "nn::bluetooth::hal::AdapterPropertyType".

The sysmodule will Abort if the input type is unavailable / not recognized.

{| class="wikitable" border="1"
|-
! Value
! Description
! Data contents
|-
| 0 || Address || [[#Address]]
|-
| 1 || Name || String, max length 0xF8 excluding NUL-terminator.
|-
| 2 || || 3-bytes, Class of Device.
|-
| 3 || || Only available with [[#SetAdapterProperty]]. Same as [[#BluetoothPropertyType]] type3.
|}

= TransportType =
This is u32 enum "nn::bluetooth::TransportType".

= BluetoothSspVariant =
This is u8 enum "nn::bluetooth::BluetoothSspVariant". [12.0.0+] This is u32 enum "nn::bluetooth::hal::BluetoothSspVariant".

= EventType =
This is u32 enum "nn::bluetooth::EventType".

{| class="wikitable" border="1"
|-
! Value
! Name
! Description
|-
| [1.0.0-11.0.1] 0 || || The funcptr which writes the data into state for this event is not called (only checked on [10.0.0]).
|-
| 0 ([1.0.0-11.0.1] 3) || || New device found during Inquiry.
|-
| 1 ([1.0.0-11.0.1] 4) || || Inquiry status changed.
|-
| 2 ([1.0.0-11.0.1] 5) || || Triggered by BSA_SEC_PIN_REQ_EVT: PIN code request for pairing.
|-
| 3 ([1.0.0-11.0.1] 6) || || Triggered by BSA_SEC_SP_CFM_REQ_EVT/BSA_SEC_SP_KEY_NOTIF_EVT: SSP confirm request / SSP passkey notification.
|-
| 4 ([1.0.0-11.0.1] 7) || || Connection
|-
| 5 || || [12.0.0+] [[#SetTsi|Tsi]]
|-
| 6 || || [12.0.0+] [[#EnableBurstMode|BurstMode]]
|-
| 7 || || [12.0.0+] [[#SetZeroRetransmission]]
|-
| 8 || || [12.0.0+] [[#GetPendingConnections]]
|-
| 9 || || [12.0.0+] [[#MoveToSecondaryPiconet]]
|-
| 10 ([1.0.0-11.0.1] 13) || || BluetoothCrash. Triggered by [[#EmulateBluetoothCrash]] and BSA_MGT_DISCONNECT_EVT.
|}

= ConnectionEventType =
This is the event value in [[#EventInfo]] when [[#EventType]] is type4 ([1.0.0-11.0.1] type7).

{| class="wikitable" border="1"
|-
! Value
! Name
! Description
|-
| 0 || || [1.0.0-11.0.1] Connection status.
|-
| 1 || || [1.0.0-11.0.1] Triggered by BSA_SEC_SP_CFM_REQ_EVT: SSP confirm request.
|-
| 2 || || [12.0.0+] Triggered by BSA_SEC_RESUMED_EVT: ACL Link is now Resumed.
|-
| 3 ([1.0.0-11.0.1] 2) || || Triggered by BSA_SEC_SUSPENDED_EVT: ACL Link is now Suspended.
|}

= BluetoothHhReportType =
This is u32 enum "nn::bluetooth::BluetoothHhReportType".

Bit0-1 directly control the HID bluetooth transaction report-type value. Bit2-3: these directly control the Parameter Reserved field for SetReport, for GetReport these control the Parameter Reserved and Size bits.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Other
|-
| 1 || Input
|-
| 2 || Output
|-
| 3 || Feature
|}

= HidEventType =
This is u32 enum "nn::bluetooth::HidEventType".

{| class="wikitable" border="1"
|-
! Value
! Name
! Description
|-
| 0 || || Connection. Only used with [[#GetHidEventInfo]].
|-
| 1 ([1.0.0-11.0.1] 4) || || DATA report on the Interrupt channel.
|-
| 2 ([1.0.0-11.0.1] 8) || || Response to SET_REPORT.
|-
| 3 ([1.0.0-11.0.1] 9) || || Response to GET_REPORT.
|-
| [1.0.0-11.0.1] 7 || || Response for extensions. Only used with [[#GetHidEventInfo]].
|}

= BleEventType =
This is u32 enum "nn::bluetooth::BleEventType".

= FatalReason =
This is u32 enum "nn::bluetooth::FatalReason".

This determines the u16 data to write into the CircularBuffer. [[#EmulateBluetoothCrash]] handles values outside of 1-2 the same as value 3.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Only for [[#EventInfo]]: invalid.
|-
| 1 || u16 data = 0x850. Can only be triggered by [[#EmulateBluetoothCrash]], not triggered by the sysmodule otherwise.
|-
| 2 || u16 data = 0x851. HCI command timeout.
|-
| 3 || u16 data = 0x852. HCI event HCI_Hardware_Error occurred.
|-
| 7 || Only for [[#EventInfo]]: triggered after enabling bluetooth, when a global state field is value 4 or 2.
|-
| 9 || [12.0.0+] Only for [[#EventInfo]]: triggered when bluetooth errors occur in a certain range, with various Audio interface vfuncs.
|}

= AdapterProperty =
This is "nn::bluetooth::AdapterProperty" ([12.0.0+] "nn::bluetooth::hal::AdapterProperty"). This is a 0x103-byte ([12.0.0+] 0x102-byte) struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x6 || Same as the data for [[#BluetoothPropertyType]] type2.
|-
| 0x6 || 0x3 || Same as the data for [[#BluetoothPropertyType]] type5.
|-
| 0x9 || 0xF9 || Same as the data for [[#BluetoothPropertyType]] type1 (last byte is not initialized).
|-
| 0x102 || 0x1 || Set to hard-coded value 0x68 (same as the data for [[#BluetoothPropertyType]] type6).
|}

[12.0.0+]:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || [[#AdapterPropertyType]]
|-
| 0x1 || 0x1 || Data size
|-
| 0x2 || {Above size} || Data, as specified by the type.
|}

= AdapterPropertySet =
This is "nn::bluetooth::hal::AdapterPropertySet". This is a 0x102-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x6 || Same as the data for [[#AdapterPropertyType]] type0.
|-
| 0x6 || 0x3 || Same as the data for [[#AdapterPropertyType]] type2.
|-
| 0x9 || 0xF9 || Same as the data for [[#AdapterPropertyType]] type1.
|}

= Address =
This is "nn::bluetooth::Address". This is a 0x6-byte struct with 1-byte alignment.

= EventInfo =
This is the output buffer for [[#GetEventInfo]]. The data stored here depends on the [[#EventType]].

[[#EventType|Type0]]:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 ||
|}

[12.0.0+] [[#EventType|Type0]]:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x6 || Device [[#Address|address]].
|-
| 0x6 || 0xF9 || Device name, NUL-terminated string.
|-
| 0xFF || 0x3 || Class of Device.
|-
| 0x102 || 0x6 || Reserved
|}

[12.0.0+] [[#EventType|Type1]]:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || Status: 0 = stopped, 1 = started.
|-
| 0x1 || 0x3 || Padding
|-
| 0x4 || 0x4 || services value from [[#StartInquiry]] when starting, otherwise this is value 0.
|}

[1.0.0-11.0.1] [[#EventType|Type3]]:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0xF9 || Device name, NUL-terminated string.
|-
| 0xF9 || 0x6 || Device [[#Address|address]].
|-
| 0xFF || 0x10 || Reserved
|-
| 0x10F || 0x3 || Class of Device.
|-
| 0x112 || 0x4 || Set to fixed value u32 0x1.
|-
| 0x116 || 0xFA || Reserved
|-
| 0x210 || 0x5C || Reserved
|-
| 0x26C || 0xF9 || Device name, NUL-terminated string. Same as name above, except starting at index 1.
|-
| 0x365 || 0x4 || s32 RSSI
|-
| 0x369 || 0x4 || Two bytes which are the same as name[11-12].
|-
| 0x36D || 0x10 || Reserved
|}

[1.0.0-11.0.1] [[#EventType|Type4]]:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || Status: 0 = stopped, 1 = started.
|}

[[#EventType|Type2]] ([1.0.0-11.0.1] type5):

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x6 || Device [[#Address|address]].
|-
| 0x6 || 0xF9 || Device name, NUL-terminated string.
|-
| 0xFF || 0x3 || Class of Device.
|}

[1.0.0-11.0.1] [[#EventType|Type6]]:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x6 || Device [[#Address|address]].
|-
| 0x6 || 0xF9 || Device name, NUL-terminated string.
|-
| 0xFF || 0x3 || Class of Device.
|-
| 0x102 || 0x2 || Padding
|-
| 0x104 || 0x4 || 0 = SSP confirm request, 3 = SSP passkey notification.
|-
| 0x108 || 0x4 || s32 Passkey, only set when the above field is value 3.
|}

[12.0.0+] [[#EventType|Type3]]:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x6 || Device [[#Address|address]].
|-
| 0x6 || 0xF9 || Device name, NUL-terminated string.
|-
| 0xFF || 0x3 || Class of Device.
|-
| 0x102 || 0x1 || bool flag for Just Works. With SSP passkey notification this is always 0.
|-
| 0x103 || 0x1 || Padding
|-
| 0x104 || 0x4 || s32 Passkey
|}

[1.0.0-11.0.1] [[#EventType|Type7]]:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || Status, always 0 except with [[#ConnectionEventType|event0]]: 2 = ACL Link is now Resumed (BSA_SEC_RESUMED_EVT), 9 = connection failed (pairing/authentication failed, or opening the hid connection failed).
|-
| 0x4 || 0x6 || Device [[#Address|address]].
|-
| 0xA || 0x2 || Padding
|-
| 0xC || 0x4 || [[#ConnectionEventType]]
|}

[12.0.0+] [[#EventType|Type4]]:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || [[#ConnectionEventType]]
|-
| 0x4 || 0x6 || Device [[#Address|address]].
|-
| 0xA || 0xFE || Reserved
|}

[12.0.0+] [[#EventType|Type5]]:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x6 || Device [[#Address|address]].
|-
| 0x6 || 0x1 || Status flag: 1 = success, 0 = failure.
|-
| 0x7 || 0x1 || Tsi value, when the above indicates success.
|}

[12.0.0+] [[#EventType|Type6]]:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x6 || Device [[#Address|address]].
|-
| 0x6 || 0x1 || Status flag: 1 = success, 0 = failure.
|-
| 0x7 || 0x1 || Input bool value from [[#EnableBurstMode]], when the above indicates success.
|}

[12.0.0+] [[#EventType|Type7]]:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x6 || Device [[#Address|address]].
|-
| 0x6 || 0x1 || Status flag: 1 = success, 0 = failure.
|-
| 0x7 || 0x1 || Bool flag, when the above indicates success.
|}

[12.0.0+] [[#EventType|Type8]]:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || Status flag: 0 = failure, 1 = success.
|-
| 0x1 || 0x3 || Padding
|-
| 0x4 || 0x4 || Count value.
|}

[12.0.0+] [[#EventType|Type9]]:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x6 || Device [[#Address|address]].
|-
| 0x6 || 0x1 || Status flag: 1 = success, 0 = failure.
|}

[[#EventType|Type10]] ([1.0.0-11.0.1] type13):

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 || [[#FatalReason]]
|}

= HidEventInfo =
This is the output buffer for [[#GetHidEventInfo]] / events in sharedmem. The data stored here depends on the [[#HidEventType]].

[[#HidEventType|Type0]], for [[#GetHidEventInfo]]:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x6 || Device [[#Address|address]].
|-
| 0x6 || 0x2 || Padding
|-
| 0x8 || 0x4 || Status:
[1.0.0-11.0.1] 0 = hid connection opened, 2 = hid connection closed, 8 = failed to open hid connection.

[12.0.0+] 0 = hid connection closed, 1 = hid connection opened, 2 = failed to open hid connection.
|}

= BluetoothPinCode =
This is "nn::bluetooth::BluetoothPinCode". This is a 0x10-byte struct with 1-byte alignment.

= PinCode =
This is "nn::bluetooth::hal::PinCode". This is a 0x11-byte struct with 1-byte alignment.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0xF || PinCode
|-
| 0xF || 0x1 || PinCode length, must be 0x1-0xF otherwise the sysmodule will Abort.
|}

= ServiceFlag =
This is "nn::bluetooth::hal::ServiceFlag". This is the same as the BSA service-mask.

= HidData =
This is "nn::bluetooth::HidData". This is a 0x282-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 || Size of the following data.
|-
| 0x2 || 0x280 || Data
|}

= HidReport =
This is "nn::bluetooth::HidReport". This is a 0x2BE-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 || Size of the following data.
|-
| 0x2 || 0x2BC || Data
|}

= PlrStatistics =
This is "nn::bluetooth::PlrStatistics". This is a 0x84-byte struct.

= PlrList =
This is "nn::bluetooth::PlrList". This is a 0xA4-byte struct.

= PacketLostRate =
This is "nn::bluetooth::hal::PacketLostRate".

= ChannelMapList =
This is "nn::bluetooth::ChannelMapList". This is a 0x88-byte struct.

= Channel =
This is "nn::bluetooth::hal::Channel".

= LeChannel =
This is "nn::bluetooth::hal::LeChannel".

= LeConnectionParams =
This is "nn::bluetooth::LeConnectionParams". This is a 0x14-byte struct with 2-byte alignment.

= BleConnectionParameter =
This is "nn::bluetooth::BleConnectionParameter". This is a 0xC-byte struct with 2-byte alignment.

= BleAdvertisePacketData =
This is "nn::bluetooth::BleAdvertisePacketData" ([5.0.0-8.1.1] "nn::bluetooth::LeAdvertiseData"). This is a 0xCC-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 ||
|-
| 0x4 || 0x1 ||
|-
| 0x5 || 0x1 || Size of the data at +0x6.
|-
| 0x6 || 0x1F ||
|-
| 0x25 || 0x3 || Padding
|-
| 0x28 || 0x1 || Total array entries for the below array, can be 0.
|-
| 0x29 || 0x7 || Padding
|-
| 0x30 || count*0x14 || Array entries, see below.
|-
| 0xA4 || 0x1 || Size of the data at +0xA8.
|-
| 0xA5 || 0x1 ||
|-
| 0xA6 || 0x2 || Padding
|-
| 0xA8 || 0x1F ||
|-
| 0xC7 || 0x1 ||
|-
| 0xC8 || 0x1 ||
|-
| 0xC9 || 0x3 || Padding
|}

Array entry:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 ||
|-
| 0x2 || 0x12 || Unused
|}

= BleAdvertiseFilter =
This is "nn::bluetooth::BleAdvertiseFilter". This is a 0x3E-byte struct.

= BleAdvertisePacketParameter =
This is "nn::bluetooth::BleAdvertisePacketParameter". This is a 8-byte struct with 1-byte alignment.

= BleScanResult =
This is "nn::bluetooth::BleScanResult". This is a 0x148-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 ||
|-
| 0x1 || 0x6 || [[#Address]]
|-
| 0x7 || 0x139 ||
|-
| 0x140 || 0x4 || s32
|-
| 0x144 || 0x4 || s32
|}

= BleConnectionInfo =
This is "nn::bluetooth::BleConnectionInfo". This is a 0xC-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || ConnectionHandle, 0xFFFFFFFF ([5.0.0-5.0.2] 0xFFFF) is invalid.
|-
| 0x4 || 0x6 || [[#Address]]
|-
| 0xA || 0x2 || Padding
|-
|}

= GattAttributeUuid =
This is "nn::bluetooth::GattAttributeUuid". This is a 0x14-byte struct with 4-byte alignment.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || UUID size, must be 0x2, 0x4, or 0x10.
|-
| 0x4 || 0x10 || UUID with the above size.
|}

= GattId =
This is "nn::bluetooth::GattId". This is a 0x18-byte struct with 4-byte alignment.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || InstanceId
|-
| 0x1 || 0x3 || Padding
|-
| 0x4 || 0x14 || [[#GattAttributeUuid]]
|}

= LeEventInfo =
This is a 0x400-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 ||
|-
| 0x4 || 0x4 ||
|-
| 0x8 || 0x1 ||
|-
| 0x9 || 0x3 || Padding
|-
| 0xC || 0x14 || [[#GattAttributeUuid]]
|-
| 0x20 || 0x14 || [[#GattAttributeUuid]]
|-
| 0x34 || 0x14 || [[#GattAttributeUuid]]
|-
| 0x48 || 0x2 || Size of the below data.
|-
| 0x4A || {above size} || Data.
|}

= BleClientGattOperationInfo =
This is "nn::bluetooth::BleClientGattOperationInfo". This is converted from [[#LeEventInfo]].

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || Converted from [[#LeEventInfo]]+0x0.
|-
| 0x1 || 0x3 || Padding
|-
| 0x4 || 0x4 || Same as [[#LeEventInfo]]+0x4.
|-
| 0x8 || 0x1 || Same as [[#LeEventInfo]]+0x8.
|-
| 0x9 || 0x3 || Padding
|-
| 0xC || 0x14 || Same as [[#LeEventInfo]]+0xC.
|-
| 0x20 || 0x14 || Same as [[#LeEventInfo]]+0x20.
|-
| 0x34 || 0x14 || Same as [[#LeEventInfo]]+0x34.
|-
| 0x48 || 0x8 || Same as [[#LeEventInfo]]+0x48.
|-
| 0x50 || {above size} || Same as [[#LeEventInfo]]+0x4A.
|}

= AudioEventType =
This is "nn::bluetooth::hal::AudioEventType". This is an u32 enum.

{| class="wikitable" border="1"
|-
! Value
! Name
! Description
|-
| 0 || || None
|-
| 1 || || Connection
|}

= AudioEventInfo =
This is the output buffer for [[#GetAudioEventInfo]]. The data stored here depends on the [[#AudioEventType]].

[[#AudioEventType|Type1]]:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || Status: 0 = AV connection closed, 1 = AV connection opened, 2 = failed to open AV connection.
|-
| 0x4 || 0x6 || Device [[#Address|address]].
|-
| 0xA || 0x2 || Padding
|}

= PcmParameter =
This is "nn::bluetooth::system::PcmParameter". This is a 0xC-byte struct with 4-byte alignment.

The sysmodule will Abort if any of these fields are invalid.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || Must be 0-3. Controls number of channels: 0 = mono, non-zero = stereo.
|-
| 0x4 || 0x4 || s32 SampleRate. Must be one of the following: 16000, 32000, 44100, 48000.
|-
| 0x8 || 0x4 || Bits per sample. Must be 8 or 16.
|}

= AudioOutState =
This is "nn::bluetooth::system::AudioOutState". This is an u32 enum.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Stopped
|-
| 1 || Started
|}

= AudioCodec =
This is "nn::bluetooth::system::AudioCodec". This is an u32 enum.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Raw PCM
|}

= AudioControlButtonState =
This is "nn::bluetooth::system::AudioControlButtonState". This is a 0x10-byte struct.

= Notes =
The output from <code>sudo hcitool info {BDADDR}</code> is identical for [1.0.0-11.0.0]:

BD Address: {BDADDR}
OUI Company: Nintendo Co.,Ltd (98-B6-E9)
Device Name: Nintendo Switch
LMP Version: 4.2 (0x8) LMP Subversion: 0x2409
Manufacturer: Broadcom Corporation (15)
Features page 0: 0xbf 0xfe 0xcf 0xfe 0xdb 0xff 0x7b 0x87
<3-slot packets> <5-slot packets> <encryption> <slot offset>
<timing accuracy> <role switch> <sniff mode> <RSSI>
<channel quality> <SCO link> <HV2 packets> <HV3 packets>
<u-law log> <A-law log> <CVSD> <paging scheme> <power control>
<transparent SCO> <broadcast encrypt> <EDR ACL 2 Mbps>
<EDR ACL 3 Mbps> <enhanced iscan> <interlaced iscan>
<interlaced pscan> <inquiry with RSSI> <extended SCO>
<EV4 packets> <EV5 packets> <AFH cap. slave>
<AFH class. slave> <LE support> <3-slot EDR ACL>
<5-slot EDR ACL> <sniff subrating> <pause encryption>
<AFH cap. master> <AFH class. master> <EDR eSCO 2 Mbps>
<EDR eSCO 3 Mbps> <3-slot EDR eSCO> <extended inquiry>
<LE and BR/EDR> <simple pairing> <encapsulated PDU>
<err. data report> <non-flush flag> <LSTO> <inquiry TX power>
<EPC> <extended features>
Features page 1: 0x0f 0x00 0x00 0x00 0x00 0x00 0x00 0x00
Features page 2: 0x7f 0x0b 0x00 0x00 0x00 0x00 0x00 0x00

The bluetooth driver implements the bluetooth protocol over h4/uart. It interfaces with the [[Bus_services#uart|uart]] service to actually talk with the bluetooth hardware.

The bluetooth stack is Broadcom/Cypress brcm BSA (for example, see [https://github.com/hardkernel/buildroot_linux_amlogic_brcm-bsa here]).

Various btdrv service commands use a custom BSA extension (message-ids based at 0x8CA/2250), this is referred to as "robson".

The following L2CAP services are registered (dynamic channels): SDP, ATT (GATT), RFCOMM, HID (PSMs: 0x11, 0x13, 0x8001, 0x8003).

<code>l2cu_send_peer_echo_rsp</code> is called with p_data=NULL and data_len=0, therefore no data is returned in the L2CAP ECHO response.

The following HID transaction types are supported (by <code>hidh_l2cif_data_ind</code>): HANDSHAKE, CONTROL (only param VIRTUAL_CABLE_UNPLUG is supported), DATA, DATAC.
* DATAC is not actually supported, since the callback function (<code>bta_hh_cback</code>) just frees the message and returns.

== Versions ==
{| class="wikitable" border="1"
|-
! System Version
! bsa_version_string
! bsa_version_info_string
! Config string
|-
| [1.0.0]
| BSA0106_01.60.00_
| Hayward_J3_Patch_20161118
| BCM4356A3_001.004.009.0045.0000
|-
| [2.0.0]
| BSA0106_01.60.00_
| Hayward_J5_RC_20161227
| BCM4356A3_001.004.009.0047.0049
|-
| [3.0.0-3.0.1]
| BSA0106_01.60.00_
| Hayward_K4_RC_20170504
| BCM4356A3_001.004.009.0054.0056
|-
| [4.0.0]
| BSA0106_01.60.00_
| Hayward_L4_RC_20170815
| CYW4356A3_001.004.009.0057.0059
|-
| [5.0.0]
| BSA0106_01.60.00_
| Hayward_M2_RC_20180109
| CYW4356A3_001.004.009.0059.0061
|-
| [5.1.0]
| BSA0106_01.60.00_
| Hayward_N1_RC_20180226
| CYW4356A3_001.004.009.0062.0064
|-
| [6.0.0-6.2.0]
| BSA0106_01.60.00_
| Hayward_N3_RC_20180612
| CYW4356A3_001.004.009.0062.0064
|-
| [7.0.0]
| BSA0106_01.60.00_
| Hayward_O1_RC_20180829
| CYW4356A3_001.004.009.0076.0077
|-
| [8.0.0-9.0.0]
| BSA0106_01.60.00_
| Hayward_P1_RC_20190121
| CYW4356A3_001.004.009.0076.0077
|-
| [10.0.0-11.0.0]
| BSA0106_01.60.00_
| Hayward_R2_RC_20191119
| CYW4356A3_001.004.009.0092.0095
|-
| [12.0.0]
| BSA0106_01.60.00_
| Hayward_T3_RC_20210224
| CYW4356A3_001.004.009.0092.0095
|}

<code>bsa_sv_tm_read_version_excback</code> copies bsa_version_string and concats with bsa_version_info_string to generate <code>tBSA_TM_READ_VERSION.bsa_server_version</code>.

[[Category:Services]]

Bluetooth Driver services

2021-04-19T00:45:03Z

Qlutoo:

= btdrv =
This is "nn::bluetooth::IBluetoothDriver".

Support for "nn::bluetooth::*" was added to sdknso with 6.x.

btdrv appears to be designed to only be used by the two sysmodules which use it, [[HID_services|hid]] and [[BTM_services|btm]]. This service uses global state, nothing service-session-specific.

This has max_sessions 30. IPC handling is done by the main-thread.

[11.0.0+] sdknso moved various functions/etc from "nn::bluetooth::" into "nn::bluetooth::hal::". This includes all functions exposing btdrv. These btdrv functions now automatically initialize the service if needed, the dedicated initialization function is now a stub since calling it is no longer needed. The internal "nn::bluetooth::user::" functions implementing [[#bt]] were moved to "nn::bluetooth::hal::user::", these are called by the the user-facing "nn::bluetooth::" functions.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#InitializeBluetoothDriver]]
|-
| 1 || [[#InitializeBluetooth]]
|-
| 2 || [[#EnableBluetooth]]
|-
| 3 || [[#DisableBluetooth]]
|-
| 4 || [[#FinalizeBluetooth]] ([?-8.1.1] [[#FinalizeBluetooth|CleanupBluetooth]])
|-
| 5 || [[#GetAdapterProperties]]
|-
| 6 || [[#GetAdapterProperty]]
|-
| 7 || [[#SetAdapterProperty]]
|-
| 8 || [[#StartInquiry]] ([?-8.1.1] [[#StartInquiry|StartDiscovery]])
|-
| 9 || [[#StopInquiry]] ([?-8.1.1] [[#StopInquiry|CancelDiscovery]])
|-
| 10 || [[#CreateBond]]
|-
| 11 || [[#RemoveBond]]
|-
| 12 || [[#CancelBond]]
|-
| 13 || [[#RespondToPinRequest]] ([?-8.1.1] [[#RespondToPinRequest|PinReply]])
|-
| 14 || [[#RespondToSspRequest]] ([?-8.1.1] [[#RespondToSspRequest|SspReply]])
|-
| 15 || [[#GetEventInfo]]
|-
| 16 || [[#InitializeHid]]
|-
| 17 || [[#OpenHidConnection]] ([?-8.1.1] [[#OpenHidConnection|HidConnect]])
|-
| 18 || [[#CloseHidConnection]] ([?-8.1.1] [[#CloseHidConnection|HidDisconnect]])
|-
| 19 || [[#WriteHidData]] ([?-8.1.1] [[#WriteHidData|HidSendData]])
|-
| 20 || [[#WriteHidData2]] ([?-8.1.1] [[#WriteHidData2|HidSendData2]])
|-
| 21 || [[#SetHidReport]] ([?-8.1.1] [[#HidSetReport]])
|-
| 22 || [[#GetHidReport]] ([?-8.1.1] [[#GetHidReport|HidGetReport]])
|-
| 23 || [[#TriggerConnection]] ([?-8.1.1] [[#HidWakeController]])
|-
| 24 || [[#AddPairedDeviceInfo]] ([?-8.1.1] [[#AddPairedDeviceInfo|HidAddPairedDevice]])
|-
| 25 || [[#GetPairedDeviceInfo]] ([?-8.1.1] [[#GetPairedDeviceInfo|HidGetPairedDevice]])
|-
| 26 || [[#FinalizeHid]] ([?-8.1.1] [[#FinalizeHid|CleanupHid]])
|-
| 27 || [[#GetHidEventInfo]] ([?-8.1.1] [[#GetHidEventInfo|HidGetEventInfo]])
|-
| 28 || [[#SetTsi]] ([?-8.1.1]] [[#SetTsi|ExtSetTsi]])
|-
| 29 || [[#EnableBurstMode]] ([?-8.1.1] [[#EnableBurstMode|ExtSetBurstMode]])
|-
| 30 || [[#SetZeroRetransmission]] ([?-8.1.1] [[#SetZeroRetransmission|ExtSetZeroRetran]])
|-
| 31 || [[#EnableMcMode]] ([?-8.1.1] [[#EnableMcMode|ExtSetMcMode]])
|-
| 32 || [[#EnableLlrScan]] ([?-8.1.1] [[#EnableLlrScan|ExtStartLlrMode]])
|-
| 33 || [[#DisableLlrScan]] ([?-8.1.1] [[#DisableLlrScan|ExtExitLlrMode]])
|-
| 34 || [[#EnableRadio]] ([?-8.1.1] [[#EnableRadio|ExtSetRadio]])
|-
| 35 || [[#SetVisibility]] ([?-8.1.1] [[#SetVisibility|ExtSetVisibility]])
|-
| 36 || [4.0.0+] [[#EnableTbfcScan]] ([4.0.0-8.1.1] [[#EnableTbfcScan|ExtSetTbfcScan]])
|-
| 37 ([1.0.0-3.0.2] 36) || [[#RegisterHidReportEvent]]
|-
| 38 ([1.0.0-3.0.2] 37) || [[#GetHidReportEventInfo]] ([?-8.1.1] [[#GetHidReportEventInfo|HidGetReportEventInfo]])
|-
| 39 ([1.0.0-3.0.2] 38) || [[#GetLatestPlr]]
|-
| 40 ([3.0.0-3.0.2] 39) || [3.0.0+] [[#GetPendingConnections]] ([?-8.1.1] [[#GetPendingConnections|ExtGetPendingConnections]])
|-
| 41 ([3.0.0-3.0.2] 40) || [3.0.0+] [[#GetChannelMap]]
|-
| 42 ([3.0.0-3.0.2] 41) || [3.0.0+] [[#EnableTxPowerBoostSetting]] ([?-8.1.1] [[#EnableTxPowerBoostSetting|EnableBluetoothBoostSetting]])
|-
| 43 ([3.0.0-3.0.2] 42) || [3.0.0+] [[#IsTxPowerBoostSettingEnabled]] ([?-8.1.1] [[#IsTxPowerBoostSettingEnabled|IsBluetoothBoostSettingEnabled]])
|-
| 44 ([3.0.0-3.0.2] 43) || [3.0.0+] [[#EnableAfhSetting]] ([?-8.1.1] [[#EnableAfhSetting|EnableBluetoothAfhSetting]])
|-
| 45 ([3.0.0-3.0.2] 44) || [3.0.0+] [[#IsAfhSettingEnabled]] ([?-8.1.1] [[#IsAfhSettingEnabled|IsBluetoothAfhSettingEnabled]])
|-
| 46 || [5.0.0+] [[#InitializeBle]] ([5.0.0-8.1.1] [[#InitializeBle|InitializeBluetoothLe]])
|-
| 47 || [5.0.0+] [[#EnableBle]] ([5.0.0-8.1.1] [[#EnableBle|EnableBluetoothLe]])
|-
| 48 || [5.0.0+] [[#DisableBle]] ([5.0.0-8.1.1] [[#DisableBle|DisableBluetoothLe]])
|-
| 49 || [5.0.0+] [[#FinalizeBle]] ([5.0.0-8.1.1] [[#FinalizeBle|CleanupBluetoothLe]])
|-
| 50 || [5.0.0+] [[#SetBleVisibility]] ([5.0.0-8.1.1] [[#SetBleVisibility|SetLeVisibility]])
|-
| 51 || [5.0.0+] [[#SetBleConnectionParameter]] ([5.0.0-8.1.1] [[#SetLeConnectionParameter]])
|-
| 52 || [5.0.0+] [[#SetBleDefaultConnectionParameter]] ([5.0.0-8.1.1] [[#SetLeDefaultConnectionParameter]])
|-
| 53 || [5.0.0+] [[#SetBleAdvertiseData]] ([5.0.0-8.1.1] [[#SetBleAdvertiseData|SetLeAdvertiseData]])
|-
| 54 || [5.0.0+] [[#SetBleAdvertiseParameter]] ([5.0.0-8.1.1] [[#SetBleAdvertiseParameter|SetLeAdvertiseParameter]])
|-
| 55 || [5.0.0+] [[#StartBleScan]] ([5.0.0-8.1.1] [[#StartBleScan|StartLeScan]])
|-
| 56 || [5.0.0+] [[#StopBleScan]] ([5.0.0-8.1.1] [[#StopBleScan|StopLeScan]])
|-
| 57 || [5.0.0+] [[#AddBleScanFilterCondition]] ([5.0.0-8.1.1] [[#AddBleScanFilterCondition|AddLeScanFilterCondition]])
|-
| 58 || [5.0.0+] [[#DeleteBleScanFilterCondition]] ([5.0.0-8.1.1] [[#DeleteBleScanFilterCondition|DeleteLeScanFilterCondition]])
|-
| 59 || [5.0.0+] [[#DeleteBleScanFilter]] ([5.0.0-8.1.1] [[#DeleteBleScanFilter|DeleteLeScanFilter]])
|-
| 60 || [5.0.0+] [[#ClearBleScanFilters]] ([5.0.0-8.1.1] [[#ClearBleScanFilters|ClearLeScanFilters]])
|-
| 61 || [5.0.0+] [[#EnableBleScanFilter]] ([5.0.0-8.1.1] [[#EnableBleScanFilter|EnableLeScanFilter]])
|-
| 62 || [5.0.0+] [[#RegisterGattClient]] ([5.0.0-8.1.1] [[#RegisterGattClient|RegisterLeClient]])
|-
| 63 || [5.0.0+] [[#UnregisterGattClient]] ([5.0.0-8.1.1] [[#UnregisterGattClient|UnregisterLeClient]])
|-
| 64 || [5.0.0+] [[#UnregisterAllGattClients]] ([5.0.0-8.1.1] [[#UnregisterAllGattClients|UnregisterLeClientAll]])
|-
| 65 || [5.0.0+] [[#ConnectGattServer]] ([5.0.0-8.1.1] [[#ConnectGattServer|LeClientConnect]])
|-
| 66 || [5.1.0+] [[#CancelConnectGattServer]] ([5.1.0-8.1.1] [[#CancelConnectGattServer|LeClientCancelConnection]])
|-
| 67 ([5.0.0-5.0.2] 66) || [5.0.0+] [[#DisconnectGattServer]] ([?-8.1.1] [[#DisconnectGattServer|LeClientCancelConnection]])
|-
| 68 ([5.0.0-5.0.2] 67) || [5.0.0+] [[#GetGattAttribute]] ([5.0.0-8.1.1] [[#GetGattAttribute|LeClientGetAttributes]])
|-
| 69 ([5.0.0-5.0.2] 68) || [5.0.0+] [[#GetGattService]] ([5.0.0-8.1.1] [[#GetGattService|LeClientDiscoverService]])
|-
| 70 ([5.0.0-5.0.2] 69) || [5.0.0+] [[#ConfigureAttMtu]] ([5.0.0-8.1.1] [[#ConfigureAttMtu|LeClientConfigureMtu]])
|-
| 71 ([5.0.0-5.0.2] 70) || [5.0.0+] [[#RegisterGattServer]] ([5.0.0-8.1.1] [[#RegisterGattServer|RegisterLeServer]])
|-
| 72 ([5.0.0-5.0.2] 71) || [5.0.0+] [[#UnregisterGattServer]] ([5.0.0-8.1.1] [[#UnregisterGattServer|UnregisterLeServer]])
|-
| 73 ([5.0.0-5.0.2] 72) || [5.0.0+] [[#ConnectGattClient]] ([5.0.0-8.1.1] [[#ConnectGattClient|LeServerConnect]])
|-
| 74 ([5.0.0-5.0.2] 73) || [5.0.0+] [[#DisconnectGattClient]] ([5.0.0-8.1.1] [[#LeServerDisconnect]])
|-
| 75 || [5.0.0+] [[#AddGattService]] ([5.0.0-8.1.1] [[#AddGattService|CreateLeService]])
|-
| 76 ([5.0.0-5.0.2] 74) || [5.0.0+] [[#EnableGattService]] ([5.0.0-8.1.1] [[#EnableGattService|StartLeService]])
|-
| 77 || [5.0.0+] [[#AddGattCharacteristic]] ([5.0.0-8.1.1] [[#AddGattCharacteristic|AddLeCharacteristic]])
|-
| 78 ([5.0.0-5.0.2] 76) || [5.0.0+] [[#AddGattDescriptor]] ([5.0.0-8.1.1] [[#AddGattDescriptor|AddLeDescriptor]])
|-
| 79 ([5.0.0-5.0.2] 78) || [5.0.0+] [[#GetBleManagedEventInfo]] ([5.0.0-8.1.1] [[#GetBleManagedEventInfo|GetLeCoreEventInfo]])
|-
| 80 ([5.0.0-5.0.2] 79) || [5.0.0+] [[#GetGattFirstCharacteristic]] ([5.0.0-8.1.1] [[#GetGattFirstCharacteristic|LeGetFirstCharacteristic]])
|-
| 81 ([5.0.0-5.0.2] 80) || [5.0.0+] [[#GetGattNextCharacteristic]] ([5.0.0-8.1.1] [[#GetGattNextCharacteristic|LeGetNextCharacteristic]])
|-
| 82 ([5.0.0-5.0.2] 81) || [5.0.0+] [[#GetGattFirstDescriptor]] ([5.0.0-8.1.1] [[#GetGattFirstDescriptor|LeGetFirstDescriptor]])
|-
| 83 ([5.0.0-5.0.2] 82) || [5.0.0+] [[#GetGattNextDescriptor]] ([5.0.0-8.1.1] [[#GetGattNextDescriptor|LeGetNextDescriptor]])
|-
| 84 || [5.0.0+] [[#RegisterGattManagedDataPath]] ([5.0.0-8.1.1] [[#RegisterGattManagedDataPath|RegisterLeCoreDataPath]])
|-
| 85 || [5.0.0+] [[#UnregisterGattManagedDataPath]] ([5.0.0-8.1.1] [[#UnregisterGattManagedDataPath|UnregisterLeCoreDataPath]])
|-
| 86 || [5.0.0+] [[#RegisterGattHidDataPath]] ([5.0.0-8.1.1] [[#RegisterGattHidDataPath|RegisterLeHidDataPath]])
|-
| 87 || [5.0.0+] [[#UnregisterGattHidDataPath]] ([5.0.0-8.1.1] [[#UnregisterGattHidDataPath|UnregisterLeHidDataPath]])
|-
| 88 || [5.0.0+] [[#RegisterGattDataPath]] ([5.0.0-8.1.1] [[#RegisterGattDataPath|RegisterLeDataPath]])
|-
| 89 ([5.0.0-5.0.2] 83) || [5.0.0+] [[#UnregisterGattDataPath]] ([5.0.0-8.1.1] [[#UnregisterGattDataPath|UnregisterLeDataPath]])
|-
| 90 ([5.0.0-5.0.2] 89) || [5.0.0+] [[#ReadGattCharacteristic]] ([5.0.0-8.1.1] [[#ReadGattCharacteristic|LeClientReadCharacteristic]])
|-
| 91 ([5.0.0-5.0.2] 90) || [5.0.0+] [[#ReadGattDescriptor]] ([5.0.0-8.1.1] [[#ReadGattDescriptor|LeClientReadDescriptor]])
|-
| 92 ([5.0.0-5.0.2] 91) || [5.0.0+] [[#WriteGattCharacteristic]] ([5.0.0-8.1.1] [[#WriteGattCharacteristic|LeClientWriteCharacteristic]])
|-
| 93 ([5.0.0-5.0.2] 92) || [5.0.0+] [[#WriteGattDescriptor]] ([5.0.0-8.1.1] [[#WriteGattDescriptor|LeClientWriteDescriptor]])
|-
| 94 || [5.0.0+] [[#RegisterGattNotification]] ([5.0.0-8.1.1] [[#RegisterGattNotification|LeClientRegisterNotification]])
|-
| 95 ([5.0.0-5.0.2] 93) || [5.0.0+] [[#UnregisterGattNotification]] ([5.0.0-8.1.1] [[#UnregisterGattNotification|LeClientDeregisterNotification]])
|-
| 96 ([5.0.0-5.0.2] 95) || [5.0.0+] [[#GetLeHidEventInfo]]
|-
| 97 ([5.0.0-5.0.2] 96) || [5.0.0+] [[#RegisterBleHidEvent]]
|-
| 98 || [5.1.0+] [[#SetBleScanParameter]] ([5.1.0-8.1.1] [[#SetBleScanParameter|SetLeScanParameter]])
|-
| 99 || [10.0.0+] [[#MoveToSecondaryPiconet]]
|-
| 100 || [12.0.0+] [[#IsBluetoothEnabled]]
|-
| 128 || [12.0.0+] [[#AcquireAudioEvent]]
|-
| 129 || [12.0.0+] [[#GetAudioEventInfo]]
|-
| 130 || [12.0.0+] [[#OpenAudioConnection]]
|-
| 131 || [12.0.0+] [[#CloseAudioConnection]]
|-
| 132 || [12.0.0+] [[#OpenAudioOut]]
|-
| 133 || [12.0.0+] [[#CloseAudioOut]]
|-
| 134 || [12.0.0+] [[#AcquireAudioOutStateChangedEvent]]
|-
| 135 || [12.0.0+] [[#StartAudioOut]]
|-
| 136 || [12.0.0+] [[#StopAudioOut]]
|-
| 137 || [12.0.0+] [[#GetAudioOutState]]
|-
| 138 || [12.0.0+] [[#GetAudioOutFeedingCodec]]
|-
| 139 || [12.0.0+] [[#GetAudioOutFeedingParameter]]
|-
| 140 || [12.0.0+] [[#AcquireAudioOutBufferAvailableEvent]]
|-
| 141 || [12.0.0+] [[#SendAudioData]]
|-
| 142 || [12.0.0+] [[#AcquireAudioControlInputStateChangedEvent]]
|-
| 143 || [12.0.0+] [[#GetAudioControlInputState]]
|-
| 144 || [12.0.0+] [[#AcquireAudioConnectionStateChangedEvent]]
|-
| 145 || [12.0.0+] [[#GetConnectedAudioDevice]]
|-
| 256 || [5.0.0+] [[#IsManufacturingMode]]
|-
| 257 || [7.0.0+] [[#EmulateBluetoothCrash]]
|-
| 258 || [9.0.0+] [[#GetBleChannelMap]]
|}

Cmds 46-83 were added with [4.0.0+].

Various cmds were moved/etc starting with [[#InitializeBle]] with [5.0.0+].

== InitializeBluetoothDriver ==
No input/output.

[1.0.0-10.2.0] This is the first cmd used during service init.

This just returns 0.

== InitializeBluetooth ==
No input, returns an output Event handle with EventClearMode=1.

This is used by [[BTM_services|btm]], this should not be used by other processes.

[1.0.0-11.0.1] This first initializes the funcptr table interfaces to the defaults (same as [[#DisableBluetooth]]). [[Settings_services#GetConfigurationId1|GetConfigurationId1]] is used, an error is thrown if the output string is empty, or if it matches "SDEV_00_01_00".

If the flag for [[#IsManufacturingMode]] is 0, or if this cmd was already used where that flag was 1, an interface funcptr is called. This is passed a ptr to a table of funcptrs. The ret is converted to a Result and returned if needed. [12.0.0+] A normal func is called instead, with no params/ret. This cmd always returns 0.

The above called func does the following:
* [1.0.0-11.0.1] A func is called, which copies the input funcptr table into global state. These are used for writing events into [[#EventInfo]].
* A func is called 5 times with input param = [1-5]. This initializes the specified nn::bluetooth::CircularBuffer (sharedmem and internal). [12.0.0+] This functionality is now inlined.
* A func is called for creating the "nn.bluetooth.HidMessageHandler" thread. [12.0.0+] This functionality is now inlined.

Lastly, the Event is ([1.0.0-11.0.1] created and) returned (which global state the Event is stored in depends on whether the code-path which calls the above funcptr was used).

== EnableBluetooth ==
No input/output.

This is used by [[BTM_services|btm]].

[1.0.0-11.0.1] This first calls an interface funcptr, on failure 0xCA71 is returned.

[1.0.0-11.0.1] A global fixed [[#Address]] is copied to stack, this stack data is then overwritten with the output from [[Settings_services|GetBluetoothBdAddress]]. If GetBluetoothBdAddress fails, this will Abort. Then the same funcptr used by [[#SetAdapterProperty]] is called with this stack data, with [[#BluetoothPropertyType|type2]]. A converted error is returned if needed.

[1.0.0-11.0.1] The last two bytes of the stack [[#Address]] are inverted (byteval = ~byteval), then the above funcptr is called with this for [[#BluetoothPropertyType|type3]]. Error conversion is handled if needed, then this returns 0.

The first funcptr called above does the following ([12.0.0+] this code is now inlined):
* Calls a GPIO func with param=0, [[SVC|sleeps]] for 10000000 nanoseconds, then calls the GPIO func again with param=1.
* [12.0.0+] Calls a func to update an interface object ptr to use the enabled-object. A vfunc for various interface objects are called, with Result 0xCA71 being returned if the ret is non-zero (failure after the first interface object will trigger an Abort).
* [12.0.0+] [[Settings_services|GetBluetoothBdAddress]] is used, on failure this will Abort. Then the same vfunc used by [[#SetAdapterProperty]] is called with the output from GetBluetoothBdAddress, with [[#AdapterPropertyType|type0]]. This will Abort on failure.
* [12.0.0+] The last two bytes of the stack [[#Address]] are inverted (byteval = ~byteval), then the above vfunc is called with this for [[#AdapterPropertyType|type3]]. This will Abort on failure, otherwise 0 is returned.
* [12.0.0+] Various code described below was moved into the above vfunc(s), etc.
* Calls a func for initializing the paired-devices table (empty).
* Calls a modified version of BSA_Boot, which handles BSA server initialization.
* Calls a func which uses <code>nn::os::InitializeEvent</code> and <code>nn::os::InitializeMutex</code> with global state.
* Calls a func which handles BSA client initialization. This also sends a message to the "nn.bluetooth.HidMessageHandler" thread for enabling bluetooth (which updates the interface funcptr tables, etc).
* Calls a func which enables HID-Host with BSA, and opens the UIPC channel where the registered funcptr is used for writing HID DATA [[#GetHidReportEventInfo|reports]] which were received.
* Calls a func which initializes global state and uses BSA for initializing Security.
* If the output flag from [[Settings_services#GetBluetoothBoostEnableFlag|GetBluetoothBoostEnableFlag]] is set, a func is called.
* If the output flag from [[Settings_services#GetBluetoothAfhEnableFlag|GetBluetoothAfhEnableFlag]] is not set, a func is called.

The GPIO func does the following:
* Initializes the [[Bus_services|gpio]] service.
* Uses [[Bus_services#OpenSession|OpenSession]] with value 0x03 (BtRst).
* Uses SetDirection with value 0x1.
* Uses SetValue with the param which was passed to this func.
* Does cleanup for the session object and exits the service.

[12.0.0+] The Enable vfunc called above for Audio does the following:
* Calls a func which does the following:
** Uses BSA to enable AV. Besides the callback, the only field in the passed struct which is set is <code>features</code>. This is set for "remote control target".
** Error handling + state setup is done.
** Uses BSA to register AV twice, with the default input struct.
** Error handling + state setup is done.
* If an error occurred in a certain range, a [[#FatalReason|fatal]] is triggered and 0 is returned.
* Otherwise when successful, state init is done then 0 is returned.

== DisableBluetooth ==
No input/output.

This is used by [[BTM_services|btm]].

[1.0.0-11.0.1] This calls an interface funcptr. On success, the funcs for updating the interface funcptr tables are called (same as [[#InitializeBluetooth]]). Then the converted ret is returned as needed.

* [12.0.0+] Vfuncs for various interface objects are called, with failure triggering an Abort in some cases.
* [12.0.0+] Calls funcs to update interfaces object ptrs to use the disabled-object.
* [12.0.0+] Calls the same GPIO func as [[#EnableBluetooth]] with param=0, then 0 is returned.
* [12.0.0+] Various code described below was moved into the above vfunc(s), etc.

When bluetooth is already disabled, that funcptr just returns 0. Otherwise when it's already enabled, it does the following:
* Calls a func which closes the HID-Host UIPC channel, and uses BSA for disabling HID-Host.
* Calls a func which uses <code>nn::os::FinalizeMutex</code> and <code>nn::os::FinalizeEvent</code> with global state.
* Uses <code>nn::os::InitializeEvent</code>, <code>nn::os::InitializeTimerEvent</code>, with a ptr for the former Event being written into global state.
* Uses BTA_DisableBluetooth.
* Uses <code>nn::os::StartOneShotTimerEvent</code> with a value of 5 seconds.
* Waits for either of the above to trigger using <code>nn::os::TryWaitEvent</code> and <code>nn::os::TryWaitTimerEvent</code>, with each loop iteration [[SVC|sleeping]] for 5000000 nanoseconds.
** The Event is signaled when disabling bluetooth finishes.
* Cleanup for the above Event/TimerEvent is done.
* Calls a func which handles BSA client cleanup.
* Calls a func which does the following:
** Calls a func which tells the "nn.bluetooth.TimerThread" to exit, then destroys that thread (GKI timer thread).
** Calls a func which just returns.
** Calls a func which handles GKI cleanup (including destroying the task threads).
** Calls a func which waits for the UIPC threads to exit + destroys the threads and handles cleanup.
* Calls the same GPIO func as [[#EnableBluetooth]] with param=0.
* Sends a message to the "nn.bluetooth.HidMessageHandler" thread for disabling bluetooth (which updates the interface funcptr tables, etc).

== FinalizeBluetooth ==
No input/output.

Not used by [[BTM_services|btm]], other processes should not use this.

Calls an interface funcptr, the ret is ignored. The Event setup by [[#InitializeBluetooth]] is closed. Lastly, the same funcs used by [[#InitializeBluetooth]] are called for initializing the interface funcptr tables to the defaults, then 0 is returned.

The above interface funcptr does the following (regardless of whether bluetooth is disabled/enabled):
* Calls a func which: uses <code>nn::os::SignalLightEvent</code> to tell the "nn.bluetooth.HidMessageHandler" thread to exit, then waits for the thread to exit and destroys the thread.
* Calls the same func as [[#InitializeBluetooth]] for setting event funcptrs in global state, except in this case the content of the input table is all NULL.
* Calls a func 5 times with param=[1-5]. This is the cleanup version of the nn::bluetooth::CircularBuffer setup func used by [[#InitializeBluetooth]].

== GetAdapterProperties ==
Takes a type-0x1A output buffer containing an [[#AdapterProperty]].

[12.0.0+] Takes a type-0x1A output buffer containing an [[#AdapterPropertySet]].

This is used by [[BTM_services|btm]].

== GetAdapterProperty ==
Takes an input [[#BluetoothPropertyType]] and a type-0xA output buffer.

[12.0.0+] Takes an input [[#AdapterPropertyType]] and a type-0x1A output buffer containing an [[#AdapterProperty]].

== SetAdapterProperty ==
Takes an input [[#BluetoothPropertyType]] and a type-0x9 input buffer.

[12.0.0+] Takes a type-0x19 input buffer containing an [[#AdapterProperty]], no output.

== StartInquiry ==
No input/output.

[12.0.0+] Takes an input BitFlagSet 32bit [[#ServiceFlag|services]] and s64 nanoseconds_duration, no output.

This is used by [[BTM_services|btm]].

This starts Inquiry, the output data will be available via [[#GetEventInfo]]. Inquiry will automatically stop in 10.24 seconds ([12.0.0+] calculated from the input duration instead).

[12.0.0+] When services is -1 the original defaults from pre-12.0.0 are used (besides duration). Otherwise, services is written into the parameter struct (masked with the all-allowed-BSA-services value), and the EventInfo for discovered devices are triggered when inquiry finishes instead of immediately.

== StopInquiry ==
No input/output.

This is used by [[BTM_services|btm]].

This stops Inquiry which was started by [[#StartInquiry]], if it's still active.

== CreateBond ==
Takes an input [[#Address]] and a type-0x19 input buffer containing a [[#TransportType]], no output.

[9.0.0+] Now only takes an [[#Address]] and a [[#TransportType]] without a buffer, no output.

The [[#TransportType]] is unused.

This is used by [[BTM_services|btm]].

== RemoveBond ==
Takes an input [[#Address]], no output.

This is used by [[BTM_services|btm]].

== CancelBond ==
Takes an input [[#Address]], no output.

This is used by [[BTM_services|btm]].

== RespondToPinRequest ==
Takes an input [[#Address]], a bool, an u8, a [[#BluetoothPinCode]], no output.

[12.0.0+] Takes an input [[#Address]], a [[#PinCode]], no output.

sdknso uses an user-specified s32 for the u8.

The sysmodule impl for the funcptr used with this cmd only uses the [[#Address]] - this and hard-coded PIN "0000" are written into the parameter struct (and a size field for the PIN).

[12.0.0+] The input [[#PinCode]] is now actually used and passed to BSA, instead of hard-coding the PIN.

== RespondToSspRequest ==
Takes an input [[#Address]], a [[#BluetoothSspVariant]], a bool, an u32, no output.

[12.0.0+] Takes an input [[#Address]], a bool, a [[#BluetoothSspVariant]], an u32, no output.

This is used by [[BTM_services|btm]].

The sysmodule impl for the funcptr/vfunc used with this cmd only uses the [[#Address]] and bool - the parameter struct size is only 0x7-bytes. The bool indicates whether the request is accepted.

== GetEventInfo ==
Takes a type-0xA output buffer and returns an output [[#EventType]].

This copies 0x400-bytes from state to the output buffer, copies the [[#EventType]] from state to output, and signals an event.

[12.0.0+] Mutex locking is now used, with the code prior to the event-signal. If a size field in state is 0, writing the output [[#EventType]]/buffer is skipped. Otherwise, the size field is reset to 0, the [[#EventType]] from state is copied to output, and the original size field is used to memcpy to the output buffer from state.

This is used by [[BTM_services|btm]].

See [[#EventInfo]].

== InitializeHid ==
Takes an input u16, returns an output Event with EventClearMode=1.

Originally sdknso used an user-specified value for the u16, however with [9.0.0+] it uses hard-coded value 0x1 instead.

This is used by [[BTM_services|btm]], this should not be used by other processes.

== OpenHidConnection ==
Takes an input [[#Address]], no output.

This just returns 0.

This is used by [[BTM_services|btm]].

== CloseHidConnection ==
Takes an input [[#Address]], no output.

This is used by [[BTM_services|btm]].

== HidSendData ==
Takes an input [[#Address]] and a type-0x19 input buffer containing a [[#HidData]], no output.

== WriteHidData ==
Takes an input [[#Address]] and a type-0x19 input buffer containing a [[#HidReport]], no output.

This is used by [[HID_services|hid]].

This sends a HID DATA transaction packet with report-type Output.

== WriteHidData2 ==
Takes an input [[#Address]] and a type-0x9 input buffer, no output.

This is internally the same as [[#WriteHidData]], with the input buffer being directly passed to the funcptr instead of a tmp copy of the input [[#HidReport]].

== HidSetReport ==
Takes an input [[#Address]], a [[#BluetoothHhReportType]], a type-0x19 input buffer containing a [[#HidData]], no output.

== SetHidReport ==
Takes an input [[#Address]], a [[#BluetoothHhReportType]], a type-0x19 input buffer containing a [[#HidReport]], no output.

This is used by [[HID_services|hid]].

This sends a HID SET_REPORT transaction packet.

== GetHidReport ==
Takes an input [[#Address]], an u8 report_id, a [[#BluetoothHhReportType]], no output.

This is used by [[HID_services|hid]].

This sends a HID GET_REPORT transaction packet. The report_id is sent in the packet for the Report Id, when non-zero.

== HidWakeController ==
Takes an input [[#Address]], no output.

== TriggerConnection ==
Takes an input [[#Address]] and an u16, no output.

This is used by [[BTM_services|btm]].

This calls an interface funcptr, then returns the converted ret as needed.

The funcptr does the following:
* Calls a func, returning the ret on failure. This uses a BSA extension (message 0x8CE), with the input u16 being used with this.
* Then another func is called, with the input [[#Address]], with the ret from here being returned. This throws an error if the device isn't paired. This opens a HID-Host connection to the specified [[#Address]]. The passed sec_mask is 0x12 (Inbound/outbound authentication required), and brcm_mask is set for enabling TBFC Page.

The handler for the above message with the used bit flag does the following:
* Uses HCI vendor command 0xFCC2 with param_len=0xE. Param data: u32 +0 = 0x14E18, u16 +4 = 0x20, u8 +6 = 0x2, u16 +7 = {input u16 message param value} (written via u8 writes), u32 +9 = 0x30200, u8 +0xD = 0.

== AddPairedDeviceInfo ==
Takes a type-0x19 input buffer containing [[Settings_services#BluetoothDevicesSettings|BluetoothDevicesSettings]], no output.

This is used by [[BTM_services|btm]].

[12.0.0+] If [[Settings_services#BluetoothDevicesSettings|TrustedServices]] is 0, value 0x100000 is used. When bit20 is set, HID is initialized for this device, otherwise when bitmask 0xC0000 is set (<code>if((TrustedServices & 0xC0000) != 0)</code>) [[#OpenAudioConnection|audio]] is initialized for this device.

== GetPairedDeviceInfo ==
Takes an input [[#Address]] and a type-0x1A output buffer containing [[Settings_services#BluetoothDevicesSettings|BluetoothDevicesSettings]].

This is used by [[BTM_services|btm]].

== FinalizeHid ==
No input/output.

Not used by [[BTM_services|btm]], other processes should not use this.

== GetHidEventInfo ==
Takes a type-0xA output buffer, returns an output [[#HidEventType]].

This copies 0x480-bytes from state to the output buffer. [[#HidEventType]] is set to: stateval!=0 ? 7 : 0. Once finished, this signals an event.

[12.0.0+] Mutex locking is now used, with the code prior to the event-signal. If a size field in state is 0, writing the output [[#HidEventType]]/buffer is skipped. Otherwise, the size field is reset to 0, the [[#HidEventType]] from state is copied to output, and the original size field is used to memcpy to the output buffer from state.

This is used by [[BTM_services|btm]].

See [[#HidEventInfo]].

== SetTsi ==
Takes an input [[#Address]] and an u8 Tsi, no output.

This is used by [[BTM_services|btm]].

The response will be available via [[#GetHidEventInfo]] ([12.0.0+] [[#GetEventInfo]]).

This uses a BSA extension.

Tsi: non-value-0xFF to Set (BSA message 0x8CA), value 0xFF to Exit (BSA message 0x8CB).

Set: this uses command HCI_Set_MWS_Signaling with data determined using the input u8. Then this uses Broadcom HCI vendor command 0xFD95 with param_len=0x2: param +0x0 = 0x1, +0x1 = {Tsi value}. When this vendor command is successful, it then uses command HCI_Sniff_Mode with data selected using the Tsi value as the array-index. If the remote device doesn't support this (status indicating error with Mode Change Event for the response to HCI_Sniff_Mode), an error will be thrown via the [[#GetHidEventInfo|EventInfo]]. That error can be resolved if the remote device uses the HCI_Sniff_Mode command prior to the Switch doing so.

Exit: this uses command HCI_Exit_Sniff_Mode.

== EnableBurstMode ==
Takes an input [[#Address]] and a bool, no output.

This is used by [[BTM_services|btm]].

The response will be available via [[#GetHidEventInfo]] ([12.0.0+] [[#GetEventInfo]]).

This uses a BSA extension.

bool flag: true = Set (BSA message 0x8CC), false = Exit (BSA message 0x8CD).

== SetZeroRetransmission ==
Takes an input [[#Address]] and a type-0x9 input buffer containing an array of u8s, no output.

The entry-count is clamped to a maximum of 5, the count can be 0. This buffer contains ReportIds.

This is used by [[BTM_services|btm]].

The response will be available via [[#GetHidEventInfo]] ([12.0.0+] [[#GetEventInfo]]).

This uses a BSA extension (message 0x8CF).

== EnableMcMode ==
Takes an input bool, no output.

This is used by [[BTM_services|btm]].

This uses a BSA extension (message 0x8CE).

== EnableLlrScan ==
No input/output.

This is used by [[BTM_services|btm]].

This uses a BSA extension (message 0x8CE).

== DisableLlrScan ==
No input/output.

This is used by [[BTM_services|btm]].

This uses a BSA extension (message 0x8CE).

== EnableRadio ==
Takes an input bool, no output.

This is used by [[BTM_services|btm]].

This uses a BSA extension (message 0x8CE).

The message is handled by using HCI vendor command 0xFC34 with param_len=0x1: param +0 = {input bool}.

== SetVisibility ==
Takes two input bools, no output.

The first bool controls Inquiry Scan, whether the device can be discovered during Inquiry. The second bool controls Page Scan, whether the device accepts connections.

This is used by [[BTM_services|btm]].

== EnableTbfcScan ==
Takes an input bool, no output.

This is used by [[BTM_services|btm]].

== RegisterHidReportEvent ==
No input, returns an output Event handle with EventClearMode=1.

This gets the Event handle for a previously created Event.

This is used by [[HID_services|hid]].

The Event is signaled when data is available with [[#GetHidReportEventInfo]].

== GetHidReportEventInfo ==
No input, takes a type-0xA output buffer and returns a [[#HidEventType]].

[7.0.0+] No longer takes a buffer or returns output, now returns an output sharedmem handle. sdknso maps this with size=0x3000 and permissions=RW-.

Originally this was used in a dedicated sdknso func, with [7.0.0+] this is now used at the start of the sdknso impl for [[#RegisterHidReportEvent]] if the above sharedmem was not mapped yet.

The [7.0.0+] GetHidReportEventInfo sdknso func loads data using the above sharedmem.

This is used by [[HID_services|hid]].

== GetLatestPlr ==
Takes a type-0x16 output buffer containing a [[#PlrList]] ([1.0.0-8.1.1] [[#PlrStatistics]]).

[12.0.0+] Takes a type-0xA output buffer containing an array of [[#PacketLostRate]], returns an output s32.

This calls an interface funcptr then returns 0.

The interface funcptr impl will Abort if the output struct ptr is NULL. Then data is copied from global state to output, doing double->u32 conversion as needed.

== GetPendingConnections ==
No input/output.

This is used by [[BTM_services|btm]].

The output data will be available via [[#GetHidEventInfo]] ([12.0.0+] [[#GetEventInfo]]).

== GetChannelMap ==
Takes a type-0x16 output buffer containing a [[#ChannelMapList]].

[12.0.0+] Takes two type-0xA output buffers, returns an output s32. The first buffer contains an array of [[#Address]], the second buffer contains an array of BitFlagSet with [[#Channel]] and bit-count=79.

This calls an interface funcptr then returns 0.

== EnableTxPowerBoostSetting ==
Takes an input bool, no output.

sdknso ignores errors from this. sdknso exposes this under "nn::bluetooth::debug::".

== IsTxPowerBoostSettingEnabled ==
No input, returns an output bool.

sdknso sets the tmpout_bool to 1, and uses that with the cmd. The sdknso func directly returns tmpout_bool, errors from the cmd are ignored.

sdknso exposes this under "nn::bluetooth::debug::".

== EnableAfhSetting ==
Takes an input bool, no output.

sdknso ignores errors from this. sdknso exposes this under "nn::bluetooth::debug::".

== IsAfhSettingEnabled ==
sdknso sets the tmpout_bool to 1, and uses that with the cmd. The sdknso func directly returns tmpout_bool, errors from the cmd are ignored.

sdknso exposes this under "nn::bluetooth::debug::".

== InitializeBle ==
No input, returns an output Event handle with EventClearMode=1.

This is used by [[BTM_services|btm]].

== EnableBle ==
No input/output.

This is used by [[BTM_services|btm]].

== DisableBle ==
No input/output.

This is used by [[BTM_services|btm]].

== FinalizeBle ==
No input/output.

== SetBleVisibility ==
Takes two input bools, no output.

First bool: whether the BLE device is discoverable. Second bool: whether the BLE device is connectable.

== SetLeConnectionParameter ==
Takes a [[#LeConnectionParams]], no output.

== SetBleConnectionParameter ==
Takes an input [[#Address]], a bool, a [[#BleConnectionParameter]], no output.

This is used by [[BTM_services|btm]].

== SetLeDefaultConnectionParameter ==
Takes a [[#LeConnectionParams]], no output.

== SetBleDefaultConnectionParameter ==
Takes a [[#BleConnectionParameter]], no output.

This is used by [[BTM_services|btm]].

== SetBleAdvertiseData ==
Takes a type-0x19 input buffer containing a [[#BleAdvertisePacketData]], no output.

== SetBleAdvertiseParameter ==
Takes an input [[#Address]], two u16s, no output.

== StartBleScan ==
No input/output.

This is used by [[BTM_services|btm]].

== StopBleScan ==
No input/output.

This is used by [[BTM_services|btm]].

== AddBleScanFilterCondition ==
Takes a type-0x19 input buffer containing a [[#BleAdvertiseFilter]], no output.

This is used by [[BTM_services|btm]].

== DeleteBleScanFilterCondition ==
Takes a type-0x19 input buffer containing a [[#BleAdvertiseFilter]], no output.

This is used by [[BTM_services|btm]].

== DeleteBleScanFilter ==
Takes an input u8, no output.

Originally the sdknso func used an u8 for the user-specified param, with [9.0.0+] it's a s32.

== ClearBleScanFilters ==
No input/output.

This is used by [[BTM_services|btm]].

== EnableBleScanFilter ==
Takes an input bool, no output.

This is used by [[BTM_services|btm]].

== RegisterGattClient ==
Takes an input [[#GattAttributeUuid]], no output.

This is used by [[BTM_services|btm]].

== UnregisterGattClient ==
Takes an input u8, no output.

== UnregisterAllGattClients ==
No input/output.

== ConnectGattServer ==
Takes an input u8, an [[#Address]], a bool, an [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]], no output.

This is used by [[BTM_services|btm]].

== CancelConnectGattServer ==
Takes an input u8, an [[#Address]], a bool, no output.

This is used by [[BTM_services|btm]].

== DisconnectGattServer ==
Takes an input u32, no output.

This is used by [[BTM_services|btm]].

== GetGattAttribute ==
Takes an [[#Address]] and an u32, no output.

[9.0.0+] Now takes an input u32, no output.

== GetGattService ==
Takes an input u32 and a [[#GattAttributeUuid]], no output.

== ConfigureAttMtu ==
Takes an input u16 and u32, no output.

This is used by [[BTM_services|btm]].

== RegisterGattServer ==
Takes an input [[#GattAttributeUuid]], no output.

== UnregisterGattServer ==
Takes an input u8, no output.

== ConnectGattClient ==
Takes an input u8, an [[#Address]], a bool, no output.

== LeServerDisconnect ==
Takes an input u8, an [[#Address]], no output.

== DisconnectGattClient ==
Takes an input u8, no output.

== AddGattService ==
Takes an input u8, an u8, a bool, a [[#GattAttributeUuid]], no output.

Originally sdknso used an user-specified u8 for the second u8, with [9.0.0+] that func param is now a s32.

== EnableGattService ==
Takes an input u8, a [[#GattAttributeUuid]], no output.

== AddGattCharacteristic ==
Takes an input u8, an u8, an u16, a [[#GattAttributeUuid]], a [[#GattAttributeUuid]], no output.

== AddGattDescriptor ==
Takes an input u8, an u16, a [[#GattAttributeUuid]], a [[#GattAttributeUuid]], no output.

== GetBleManagedEventInfo ==
Takes a type-0xA output buffer, returns an output [[#BleEventType]].

This copies 0x400-bytes from state to the output buffer, and copies the [[#BleEventType]] from state to output.

This is used by [[BTM_services|btm]].

== GetGattFirstCharacteristic ==
Takes an input bool, an u32, a [[#GattId]], a [[#GattAttributeUuid]], returns an output u8 Property and [[#GattId|CharacteristicId]].

== GetGattNextCharacteristic ==
Takes an input bool, an u32, a [[#GattId]], a [[#GattId]], a [[#GattAttributeUuid]], returns an output u8 Property and [[#GattId|CharacteristicId]].

== GetGattFirstDescriptor ==
Takes an input bool, an u32, a [[#GattId]], a [[#GattId]], a [[#GattAttributeUuid]], returns an output [[#GattId|DescriptorId]].

== GetGattNextDescriptor ==
Takes an input bool, an u32, a [[#GattId]], a [[#GattId]], a [[#GattId]], a [[#GattAttributeUuid]], returns an output [[#GattId|DescriptorId]].

== RegisterGattManagedDataPath ==
Takes an input [[#GattAttributeUuid]], no output.

This is used by [[BTM_services|btm]].

== UnregisterGattManagedDataPath ==
Takes an input [[#GattAttributeUuid]], no output.

== RegisterGattHidDataPath ==
Takes an input [[#GattAttributeUuid]], no output.

This is used by [[BTM_services|btm]].

== UnregisterGattHidDataPath ==
Takes an input [[#GattAttributeUuid]], no output.

This is used by [[BTM_services|btm]].

== RegisterGattDataPath ==
Takes an input [[#GattAttributeUuid]], no output.

This is used by [[BTM_services|btm]].

== UnregisterGattDataPath ==
Takes an input [[#GattAttributeUuid]], no output.

This is used by [[BTM_services|btm]].

== ReadGattCharacteristic ==
Takes an input bool PrimaryService, an u8, an u32 ConnectionHandle, a [[#GattId]], a [[#GattId]], no output.

This is used by [[HID_services|hid]] and [[BTM_services|btm]].

== ReadGattDescriptor ==
Takes an input bool PrimaryService, an u8, an u32 ConnectionHandle, a [[#GattId]], a [[#GattId]], a [[#GattId]], no output.

This is used by [[HID_services|hid]].

== WriteGattCharacteristic ==
Takes a type-0x9 input buffer, a bool PrimaryService, an u8, a bool, an u32 ConnectionHandle, a [[#GattId]], a [[#GattId]], no output.

The buffer size must be <=0x258.

This is used by [[HID_services|hid]] and [[BTM_services|btm]].

== WriteGattDescriptor ==
Takes a type-0x9 input buffer, a bool PrimaryService, an u8, an u32 ConnectionHandle, a [[#GattId]], a [[#GattId]], a [[#GattId]], no output.

The buffer size must be <=0x258.

This is used by [[HID_services|hid]] and [[BTM_services|btm]].

== RegisterGattNotification ==
Takes an input bool, an u32 ConnectionHandle, a [[#GattId]], a [[#GattId]], no output.

This is used by [[HID_services|hid]] and [[BTM_services|btm]].

== UnregisterGattNotification ==
Takes an input bool, an u32 ConnectionHandle, a [[#GattId]], a [[#GattId]], no output.

This is used by [[HID_services|hid]].

== GetLeHidEventInfo ==
Takes a type-0xA output buffer, returns an output [[#BleEventType]].

This copies 0x400-bytes from state to the output buffer, and copies the [[#BleEventType]] from state to output. This also resets the state which was used for the outbuf-copy. Once finished, this signals an event.

This is used by [[HID_services|hid]].

See [[#LeEventInfo]] for the output buffer.

== RegisterBleHidEvent ==
No input, returns an output Event handle with EventClearMode=1.

This is used by [[HID_services|hid]].

== SetBleScanParameter ==
Takes two input u16s, no output.

This is used by [[BTM_services|btm]].

== MoveToSecondaryPiconet ==
Takes an input [[#Address]], no output.

The response will be available via [[#GetHidEventInfo]] ([12.0.0+] [[#GetEventInfo]]).

This uses a BSA extension (message 0x8D0).

== IsBluetoothEnabled ==
No input, returns an output bool.

== AcquireAudioEvent ==
No input, returns an output Event handle.

sdknso uses an user-specified EventClearMode.

This just gets a previously-initialized Event from global state, [[#IsManufacturingMode]] is used to select which Event to use.

== GetAudioEventInfo ==
Takes a type-0xA output buffer, returns an output [[#AudioEventType]].

This is essentially the same as the other [12.0.0+] Get*EventInfo cmds, however in this case the output type is set to value 0 when no event is available.

See [[#AudioEventInfo]].

== OpenAudioConnection ==
Takes an input [[#Address]], no output.

This goes through state and eventually uses BSA to open an AV connection. The input struct has the RC flag set to true. sec_mask is set to require authentication and encryption.

== CloseAudioConnection ==
Takes an input [[#Address]], no output.

This goes through state and eventually uses BSA to close an AV connection.

== OpenAudioOut ==
Takes an input [[#Address]], returns an output u32 audio_handle.

== CloseAudioOut ==
Takes an input u32 [[#OpenAudioOut|audio_handle]], no output.

== AcquireAudioOutStateChangedEvent ==
Takes an input u32 [[#OpenAudioOut|audio_handle]], returns an output Event handle.

sdknso uses an user-specified EventClearMode.

== StartAudioOut ==
Takes an input u32 [[#OpenAudioOut|audio_handle]], a [[#PcmParameter]], a nn::TimeSpan latency, returns an output nn::TimeSpan latency and u64.

This eventually uses BSA to start an AV stream. The codec is "Raw PCM". Synchronous feeding mode is used.

== StopAudioOut ==
Takes an input u32 [[#OpenAudioOut|audio_handle]], no output.

This eventually uses BSA to stop an AV stream. The pause flag is set to false.

== GetAudioOutState ==
Takes an input u32 [[#OpenAudioOut|audio_handle]], returns an output [[#AudioOutState]].

== GetAudioOutFeedingCodec ==
Takes an input u32 [[#OpenAudioOut|audio_handle]], returns an output [[#AudioCodec]].

== GetAudioOutFeedingParameter ==
Takes an input u32 [[#OpenAudioOut|audio_handle]], returns an output [[#PcmParameter]].

== AcquireAudioOutBufferAvailableEvent ==
Takes an input u32 [[#OpenAudioOut|audio_handle]], returns an output Event handle.

sdknso uses an user-specified EventClearMode.

This gets an Event which was previously initialized.

== SendAudioData ==
Takes an input u32 [[#OpenAudioOut|audio_handle]], a type-0x9 input buffer, returns an output u64 transferred_size.

This eventually uses BSA to send the specified buffer to the required UIPC channel. If transferred_size doesn't match the buffer size, error 0x177A71 is returned. transferred_size is always either 0 (error occured) or the buffer size.

== AcquireAudioControlInputStateChangedEvent ==
No input, returns an output Event handle.

sdknso uses an user-specified EventClearMode.

This gets an Event which was previously initialized.

== GetAudioControlInputState ==
Takes a type-0xA output buffer containing an array of [[#AudioControlButtonState]], returns an output s32 total_out.

A maximum of 0xF entries can be returned.

== AcquireAudioConnectionStateChangedEvent ==
No input, returns an output Event handle.

sdknso uses an user-specified EventClearMode.

This gets an Event which was previously initialized.

== GetConnectedAudioDevice ==
Takes a type-0xA output buffer containing an array of [[#Address]], returns an output s32 total_out.

A maximum of 0x8 entries can be returned.

== IsManufacturingMode ==
No input, returns an output bool.

sdknso will Abort if this fails, the bool is returned instead of a Result. sdknso exposes this under "nn::bluetooth::debug::".

This calls the same two funcs as various other cmds etc. This writes the bool returned by the second func to output, then returns 0. The second func loads the bool from [[System_Settings|system-setting]] "bluetooth_debug!skip_boot". The first func is the same as the second one, except it writes the bool into global state. [12.0.0+] These two funcs now additionally load [[System_Settings|system-setting]] "bluetooth_config!skip_boot", which is ORRed with the first setting, then that's used for storing in state / returning the value.

This is used by [[BTM_services|btm]].

== EmulateBluetoothCrash ==
Takes an input [[#FatalReason]], no output.

sdknso masks the FatalReason with an u16-mask before passing it to the cmd. sdknso exposes this under "nn::bluetooth::debug::".

This writes data into a CircularBuffer (seperate from sharedmem) with type=0x29, where the data is an u16 determined using the input [[#FatalReason]]. This is only done if a state field is value 0x3, after calling the func for this the field is set to value 0. The thread handling that sent message then converts the u16 back into a [[#FatalReason]] for writing into [[#EventInfo]].

== GetBleChannelMap ==
Takes a type-0x16 output buffer containing a [[#ChannelMapList]].

[12.0.0+] Takes two type-0xA output buffers, returns an output s32. The first buffer contains an array of [[#Address]], the second buffer contains an array of BitFlagSet with [[#LeChannel]] and bit-count=40.

= bt =
This is "nn::bluetooth::IBluetoothUser".

This has max_sessions 30. IPC handling is done by the main-thread.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#LeClientReadCharacteristic]]
|-
| 1 || [[#LeClientReadDescriptor]]
|-
| 2 || [[#LeClientWriteCharacteristic]]
|-
| 3 || [[#LeClientWriteDescriptor]]
|-
| 4 || [[#LeClientRegisterNotification]]
|-
| 5 || [[#LeClientDeregisterNotification]]
|-
| 6 || [[#SetLeResponse]]
|-
| 7 || [[#LeSendIndication]]
|-
| 8 || [[#GetLeEventInfo]]
|-
| 9 || [[#RegisterBleEvent]]
|}

== LeClientReadCharacteristic ==
Takes a PID, a bool, an u8, an u32, a [[#GattId]], a [[#GattId]], an [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]], no output.

This is essentially the same as [[#ReadGattCharacteristic]], the AppletResourceUserId is unused.

== LeClientReadDescriptor ==
Takes a PID, a bool, an u8, an u32, a [[#GattId]], a [[#GattId]], a [[#GattId]], an [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]], no output.

This is essentially the same as [[#ReadGattDescriptor]], the AppletResourceUserId is unused.

== LeClientWriteCharacteristic ==
Takes a PID, a type-0x9 input buffer, a bool, an u8, a bool, an u32, a [[#GattId]], a [[#GattId]], an [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]], no output.

This is essentially the same as [[#WriteGattCharacteristic]], the AppletResourceUserId is unused.

== LeClientWriteDescriptor ==
Takes a PID, a type-0x9 input buffer, a bool, an u8, an u32, a [[#GattId]], a [[#GattId]], a [[#GattId]], an [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]], no output.

This is essentially the same as [[#WriteGattDescriptor]], the AppletResourceUserId is unused.

== LeClientRegisterNotification ==
Takes a PID, an input bool, an u32, a [[#GattId]], a [[#GattId]], an [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]], no output.

This is essentially the same as [[#RegisterGattNotification]], the AppletResourceUserId is unused.

== LeClientDeregisterNotification ==
Takes a PID, an input bool, an u32, a [[#GattId]], a [[#GattId]], an [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]], no output.

This is essentially the same as [[#UnregisterGattNotification]], the AppletResourceUserId is unused.

== SetLeResponse ==
Takes a PID, a type-0x9 input buffer, an u8, a [[#GattAttributeUuid]], a [[#GattAttributeUuid]], an [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]], no output.

The AppletResourceUserId is unused.

The buffer size must be <=0x258.

== LeSendIndication ==
Takes a PID, a type-0x9 input buffer, an u8, a bool, a [[#GattAttributeUuid]], a [[#GattAttributeUuid]], an [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]], no output.

The AppletResourceUserId is unused.

The buffer size used internally is clamped to max size 0x258.

== GetLeEventInfo ==
Takes a PID, a type-0xA output buffer, an [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]], returns an output [[#BleEventType]].

This is identical to [[#GetLeHidEventInfo]] except different state is used. The AppletResourceUserId is unused. See [[#LeEventInfo]] for the output buffer.

== RegisterBleEvent ==
Takes a PID, an [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]], returns an output Event handle with EventClearMode=1.

This is identical to [[#RegisterBleHidEvent]] except different Event state is used. The AppletResourceUserId is unused.

= BluetoothPropertyType =
This is u32 enum "nn::bluetooth::BluetoothPropertyType".

The sysmodule will Abort if the input type is unavailable / not recognized.

{| class="wikitable" border="1"
|-
! Value
! Description
! Buffer contents
|-
| 1 || Name || String, max length 0xF8 excluding NUL-terminator.
|-
| 2 || Address || [[#Address]]
|-
| 3 || || Only available with [[#SetAdapterProperty]]. Unknown, [[#Address]]. The default is the same as type2, with the last two bytes inverted.
This uses a BSA extension (message 0x8CE), the message handler which is used here uses HCI vendor command 0xFD98 with param_len=0x7: u8 param+0 = {whether the [[#Address]] is non-zero}, +1 6-bytes = {[[#Address]] with byte-order swapped}.
|-
| 5 || || 3-bytes, Class of Device.
|-
| 6 || || 1-byte, FeatureSet. The default is value 0x68.
|}

= AdapterPropertyType =
This is u32 enum "nn::bluetooth::hal::AdapterPropertyType".

The sysmodule will Abort if the input type is unavailable / not recognized.

{| class="wikitable" border="1"
|-
! Value
! Description
! Data contents
|-
| 0 || Address || [[#Address]]
|-
| 1 || Name || String, max length 0xF8 excluding NUL-terminator.
|-
| 2 || || 3-bytes, Class of Device.
|-
| 3 || || Only available with [[#SetAdapterProperty]]. Same as [[#BluetoothPropertyType]] type3.
|}

= TransportType =
This is u32 enum "nn::bluetooth::TransportType".

= BluetoothSspVariant =
This is u8 enum "nn::bluetooth::BluetoothSspVariant". [12.0.0+] This is u32 enum "nn::bluetooth::hal::BluetoothSspVariant".

= EventType =
This is u32 enum "nn::bluetooth::EventType".

{| class="wikitable" border="1"
|-
! Value
! Name
! Description
|-
| [1.0.0-11.0.1] 0 || || The funcptr which writes the data into state for this event is not called (only checked on [10.0.0]).
|-
| 0 ([1.0.0-11.0.1] 3) || || New device found during Inquiry.
|-
| 1 ([1.0.0-11.0.1] 4) || || Inquiry status changed.
|-
| 2 ([1.0.0-11.0.1] 5) || || Triggered by BSA_SEC_PIN_REQ_EVT: PIN code request for pairing.
|-
| 3 ([1.0.0-11.0.1] 6) || || Triggered by BSA_SEC_SP_CFM_REQ_EVT/BSA_SEC_SP_KEY_NOTIF_EVT: SSP confirm request / SSP passkey notification.
|-
| 4 ([1.0.0-11.0.1] 7) || || Connection
|-
| 5 || || [12.0.0+] [[#SetTsi|Tsi]]
|-
| 6 || || [12.0.0+] [[#EnableBurstMode|BurstMode]]
|-
| 7 || || [12.0.0+] [[#SetZeroRetransmission]]
|-
| 8 || || [12.0.0+] [[#GetPendingConnections]]
|-
| 9 || || [12.0.0+] [[#MoveToSecondaryPiconet]]
|-
| 10 ([1.0.0-11.0.1] 13) || || BluetoothCrash. Triggered by [[#EmulateBluetoothCrash]] and BSA_MGT_DISCONNECT_EVT.
|}

= ConnectionEventType =
This is the event value in [[#EventInfo]] when [[#EventType]] is type4 ([1.0.0-11.0.1] type7).

{| class="wikitable" border="1"
|-
! Value
! Name
! Description
|-
| 0 || || [1.0.0-11.0.1] Connection status.
|-
| 1 || || [1.0.0-11.0.1] Triggered by BSA_SEC_SP_CFM_REQ_EVT: SSP confirm request.
|-
| 2 || || [12.0.0+] Triggered by BSA_SEC_RESUMED_EVT: ACL Link is now Resumed.
|-
| 3 ([1.0.0-11.0.1] 2) || || Triggered by BSA_SEC_SUSPENDED_EVT: ACL Link is now Suspended.
|}

= BluetoothHhReportType =
This is u32 enum "nn::bluetooth::BluetoothHhReportType".

Bit0-1 directly control the HID bluetooth transaction report-type value. Bit2-3: these directly control the Parameter Reserved field for SetReport, for GetReport these control the Parameter Reserved and Size bits.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Other
|-
| 1 || Input
|-
| 2 || Output
|-
| 3 || Feature
|}

= HidEventType =
This is u32 enum "nn::bluetooth::HidEventType".

{| class="wikitable" border="1"
|-
! Value
! Name
! Description
|-
| 0 || || Connection. Only used with [[#GetHidEventInfo]].
|-
| 1 ([1.0.0-11.0.1] 4) || || DATA report on the Interrupt channel.
|-
| 2 ([1.0.0-11.0.1] 8) || || Response to SET_REPORT.
|-
| 3 ([1.0.0-11.0.1] 9) || || Response to GET_REPORT.
|-
| [1.0.0-11.0.1] 7 || || Response for extensions. Only used with [[#GetHidEventInfo]].
|}

= BleEventType =
This is u32 enum "nn::bluetooth::BleEventType".

= FatalReason =
This is u32 enum "nn::bluetooth::FatalReason".

This determines the u16 data to write into the CircularBuffer. [[#EmulateBluetoothCrash]] handles values outside of 1-2 the same as value 3.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Only for [[#EventInfo]]: invalid.
|-
| 1 || u16 data = 0x850. Can only be triggered by [[#EmulateBluetoothCrash]], not triggered by the sysmodule otherwise.
|-
| 2 || u16 data = 0x851. HCI command timeout.
|-
| 3 || u16 data = 0x852. HCI event HCI_Hardware_Error occurred.
|-
| 7 || Only for [[#EventInfo]]: triggered after enabling bluetooth, when a global state field is value 4 or 2.
|-
| 9 || [12.0.0+] Only for [[#EventInfo]]: triggered when bluetooth errors occur in a certain range, with various Audio interface vfuncs.
|}

= AdapterProperty =
This is "nn::bluetooth::AdapterProperty" ([12.0.0+] "nn::bluetooth::hal::AdapterProperty"). This is a 0x103-byte ([12.0.0+] 0x102-byte) struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x6 || Same as the data for [[#BluetoothPropertyType]] type2.
|-
| 0x6 || 0x3 || Same as the data for [[#BluetoothPropertyType]] type5.
|-
| 0x9 || 0xF9 || Same as the data for [[#BluetoothPropertyType]] type1 (last byte is not initialized).
|-
| 0x102 || 0x1 || Set to hard-coded value 0x68 (same as the data for [[#BluetoothPropertyType]] type6).
|}

[12.0.0+]:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || [[#AdapterPropertyType]]
|-
| 0x1 || 0x1 || Data size
|-
| 0x2 || {Above size} || Data, as specified by the type.
|}

= AdapterPropertySet =
This is "nn::bluetooth::hal::AdapterPropertySet". This is a 0x102-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x6 || Same as the data for [[#AdapterPropertyType]] type0.
|-
| 0x6 || 0x3 || Same as the data for [[#AdapterPropertyType]] type2.
|-
| 0x9 || 0xF9 || Same as the data for [[#AdapterPropertyType]] type1.
|}

= Address =
This is "nn::bluetooth::Address". This is a 0x6-byte struct with 1-byte alignment.

= EventInfo =
This is the output buffer for [[#GetEventInfo]]. The data stored here depends on the [[#EventType]].

[[#EventType|Type0]]:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 ||
|}

[12.0.0+] [[#EventType|Type0]]:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x6 || Device [[#Address|address]].
|-
| 0x6 || 0xF9 || Device name, NUL-terminated string.
|-
| 0xFF || 0x3 || Class of Device.
|-
| 0x102 || 0x6 || Reserved
|}

[12.0.0+] [[#EventType|Type1]]:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || Status: 0 = stopped, 1 = started.
|-
| 0x1 || 0x3 || Padding
|-
| 0x4 || 0x4 || services value from [[#StartInquiry]] when starting, otherwise this is value 0.
|}

[1.0.0-11.0.1] [[#EventType|Type3]]:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0xF9 || Device name, NUL-terminated string.
|-
| 0xF9 || 0x6 || Device [[#Address|address]].
|-
| 0xFF || 0x10 || Reserved
|-
| 0x10F || 0x3 || Class of Device.
|-
| 0x112 || 0x4 || Set to fixed value u32 0x1.
|-
| 0x116 || 0xFA || Reserved
|-
| 0x210 || 0x5C || Reserved
|-
| 0x26C || 0xF9 || Device name, NUL-terminated string. Same as name above, except starting at index 1.
|-
| 0x365 || 0x4 || s32 RSSI
|-
| 0x369 || 0x4 || Two bytes which are the same as name[11-12].
|-
| 0x36D || 0x10 || Reserved
|}

[1.0.0-11.0.1] [[#EventType|Type4]]:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || Status: 0 = stopped, 1 = started.
|}

[[#EventType|Type2]] ([1.0.0-11.0.1] type5):

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x6 || Device [[#Address|address]].
|-
| 0x6 || 0xF9 || Device name, NUL-terminated string.
|-
| 0xFF || 0x3 || Class of Device.
|}

[1.0.0-11.0.1] [[#EventType|Type6]]:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x6 || Device [[#Address|address]].
|-
| 0x6 || 0xF9 || Device name, NUL-terminated string.
|-
| 0xFF || 0x3 || Class of Device.
|-
| 0x102 || 0x2 || Padding
|-
| 0x104 || 0x4 || 0 = SSP confirm request, 3 = SSP passkey notification.
|-
| 0x108 || 0x4 || s32 Passkey, only set when the above field is value 3.
|}

[12.0.0+] [[#EventType|Type3]]:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x6 || Device [[#Address|address]].
|-
| 0x6 || 0xF9 || Device name, NUL-terminated string.
|-
| 0xFF || 0x3 || Class of Device.
|-
| 0x102 || 0x1 || bool flag for Just Works. With SSP passkey notification this is always 0.
|-
| 0x103 || 0x1 || Padding
|-
| 0x104 || 0x4 || s32 Passkey
|}

[1.0.0-11.0.1] [[#EventType|Type7]]:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || Status, always 0 except with [[#ConnectionEventType|event0]]: 2 = ACL Link is now Resumed (BSA_SEC_RESUMED_EVT), 9 = connection failed (pairing/authentication failed, or opening the hid connection failed).
|-
| 0x4 || 0x6 || Device [[#Address|address]].
|-
| 0xA || 0x2 || Padding
|-
| 0xC || 0x4 || [[#ConnectionEventType]]
|}

[12.0.0+] [[#EventType|Type4]]:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || [[#ConnectionEventType]]
|-
| 0x4 || 0x4 || Padding
|-
| 0x8 || 0x6 || Device [[#Address|address]].
|-
| 0xE || 0xFA || Reserved
|}

[12.0.0+] [[#EventType|Type5]]:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x6 || Device [[#Address|address]].
|-
| 0x6 || 0x1 || Status flag: 1 = success, 0 = failure.
|-
| 0x7 || 0x1 || Tsi value, when the above indicates success.
|}

[12.0.0+] [[#EventType|Type6]]:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x6 || Device [[#Address|address]].
|-
| 0x6 || 0x1 || Status flag: 1 = success, 0 = failure.
|-
| 0x7 || 0x1 || Input bool value from [[#EnableBurstMode]], when the above indicates success.
|}

[12.0.0+] [[#EventType|Type7]]:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x6 || Device [[#Address|address]].
|-
| 0x6 || 0x1 || Status flag: 1 = success, 0 = failure.
|-
| 0x7 || 0x1 || Bool flag, when the above indicates success.
|}

[12.0.0+] [[#EventType|Type8]]:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || Status flag: 0 = failure, 1 = success.
|-
| 0x1 || 0x3 || Padding
|-
| 0x4 || 0x4 || Count value.
|}

[12.0.0+] [[#EventType|Type9]]:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x6 || Device [[#Address|address]].
|-
| 0x6 || 0x1 || Status flag: 1 = success, 0 = failure.
|}

[[#EventType|Type10]] ([1.0.0-11.0.1] type13):

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 || [[#FatalReason]]
|}

= HidEventInfo =
This is the output buffer for [[#GetHidEventInfo]] / events in sharedmem. The data stored here depends on the [[#HidEventType]].

[[#HidEventType|Type0]], for [[#GetHidEventInfo]]:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x6 || Device [[#Address|address]].
|-
| 0x6 || 0x2 || Padding
|-
| 0x8 || 0x4 || Status:
[1.0.0-11.0.1] 0 = hid connection opened, 2 = hid connection closed, 8 = failed to open hid connection.

[12.0.0+] 0 = hid connection closed, 1 = hid connection opened, 2 = failed to open hid connection.
|}

= BluetoothPinCode =
This is "nn::bluetooth::BluetoothPinCode". This is a 0x10-byte struct with 1-byte alignment.

= PinCode =
This is "nn::bluetooth::hal::PinCode". This is a 0x11-byte struct with 1-byte alignment.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0xF || PinCode
|-
| 0xF || 0x1 || PinCode length, must be 0x1-0xF otherwise the sysmodule will Abort.
|}

= ServiceFlag =
This is "nn::bluetooth::hal::ServiceFlag". This is the same as the BSA service-mask.

= HidData =
This is "nn::bluetooth::HidData". This is a 0x282-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 || Size of the following data.
|-
| 0x2 || 0x280 || Data
|}

= HidReport =
This is "nn::bluetooth::HidReport". This is a 0x2BE-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 || Size of the following data.
|-
| 0x2 || 0x2BC || Data
|}

= PlrStatistics =
This is "nn::bluetooth::PlrStatistics". This is a 0x84-byte struct.

= PlrList =
This is "nn::bluetooth::PlrList". This is a 0xA4-byte struct.

= PacketLostRate =
This is "nn::bluetooth::hal::PacketLostRate".

= ChannelMapList =
This is "nn::bluetooth::ChannelMapList". This is a 0x88-byte struct.

= Channel =
This is "nn::bluetooth::hal::Channel".

= LeChannel =
This is "nn::bluetooth::hal::LeChannel".

= LeConnectionParams =
This is "nn::bluetooth::LeConnectionParams". This is a 0x14-byte struct with 2-byte alignment.

= BleConnectionParameter =
This is "nn::bluetooth::BleConnectionParameter". This is a 0xC-byte struct with 2-byte alignment.

= BleAdvertisePacketData =
This is "nn::bluetooth::BleAdvertisePacketData" ([5.0.0-8.1.1] "nn::bluetooth::LeAdvertiseData"). This is a 0xCC-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 ||
|-
| 0x4 || 0x1 ||
|-
| 0x5 || 0x1 || Size of the data at +0x6.
|-
| 0x6 || 0x1F ||
|-
| 0x25 || 0x3 || Padding
|-
| 0x28 || 0x1 || Total array entries for the below array, can be 0.
|-
| 0x29 || 0x7 || Padding
|-
| 0x30 || count*0x14 || Array entries, see below.
|-
| 0xA4 || 0x1 || Size of the data at +0xA8.
|-
| 0xA5 || 0x1 ||
|-
| 0xA6 || 0x2 || Padding
|-
| 0xA8 || 0x1F ||
|-
| 0xC7 || 0x1 ||
|-
| 0xC8 || 0x1 ||
|-
| 0xC9 || 0x3 || Padding
|}

Array entry:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x2 ||
|-
| 0x2 || 0x12 || Unused
|}

= BleAdvertiseFilter =
This is "nn::bluetooth::BleAdvertiseFilter". This is a 0x3E-byte struct.

= BleAdvertisePacketParameter =
This is "nn::bluetooth::BleAdvertisePacketParameter". This is a 8-byte struct with 1-byte alignment.

= BleScanResult =
This is "nn::bluetooth::BleScanResult". This is a 0x148-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 ||
|-
| 0x1 || 0x6 || [[#Address]]
|-
| 0x7 || 0x139 ||
|-
| 0x140 || 0x4 || s32
|-
| 0x144 || 0x4 || s32
|}

= BleConnectionInfo =
This is "nn::bluetooth::BleConnectionInfo". This is a 0xC-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || ConnectionHandle, 0xFFFFFFFF ([5.0.0-5.0.2] 0xFFFF) is invalid.
|-
| 0x4 || 0x6 || [[#Address]]
|-
| 0xA || 0x2 || Padding
|-
|}

= GattAttributeUuid =
This is "nn::bluetooth::GattAttributeUuid". This is a 0x14-byte struct with 4-byte alignment.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || UUID size, must be 0x2, 0x4, or 0x10.
|-
| 0x4 || 0x10 || UUID with the above size.
|}

= GattId =
This is "nn::bluetooth::GattId". This is a 0x18-byte struct with 4-byte alignment.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || InstanceId
|-
| 0x1 || 0x3 || Padding
|-
| 0x4 || 0x14 || [[#GattAttributeUuid]]
|}

= LeEventInfo =
This is a 0x400-byte struct.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 ||
|-
| 0x4 || 0x4 ||
|-
| 0x8 || 0x1 ||
|-
| 0x9 || 0x3 || Padding
|-
| 0xC || 0x14 || [[#GattAttributeUuid]]
|-
| 0x20 || 0x14 || [[#GattAttributeUuid]]
|-
| 0x34 || 0x14 || [[#GattAttributeUuid]]
|-
| 0x48 || 0x2 || Size of the below data.
|-
| 0x4A || {above size} || Data.
|}

= BleClientGattOperationInfo =
This is "nn::bluetooth::BleClientGattOperationInfo". This is converted from [[#LeEventInfo]].

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x1 || Converted from [[#LeEventInfo]]+0x0.
|-
| 0x1 || 0x3 || Padding
|-
| 0x4 || 0x4 || Same as [[#LeEventInfo]]+0x4.
|-
| 0x8 || 0x1 || Same as [[#LeEventInfo]]+0x8.
|-
| 0x9 || 0x3 || Padding
|-
| 0xC || 0x14 || Same as [[#LeEventInfo]]+0xC.
|-
| 0x20 || 0x14 || Same as [[#LeEventInfo]]+0x20.
|-
| 0x34 || 0x14 || Same as [[#LeEventInfo]]+0x34.
|-
| 0x48 || 0x8 || Same as [[#LeEventInfo]]+0x48.
|-
| 0x50 || {above size} || Same as [[#LeEventInfo]]+0x4A.
|}

= AudioEventType =
This is "nn::bluetooth::hal::AudioEventType". This is an u32 enum.

{| class="wikitable" border="1"
|-
! Value
! Name
! Description
|-
| 0 || || None
|-
| 1 || || Connection
|}

= AudioEventInfo =
This is the output buffer for [[#GetAudioEventInfo]]. The data stored here depends on the [[#AudioEventType]].

[[#AudioEventType|Type1]]:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || Status: 0 = AV connection closed, 1 = AV connection opened, 2 = failed to open AV connection.
|-
| 0x4 || 0x6 || Device [[#Address|address]].
|-
| 0xA || 0x2 || Padding
|}

= PcmParameter =
This is "nn::bluetooth::system::PcmParameter". This is a 0xC-byte struct with 4-byte alignment.

The sysmodule will Abort if any of these fields are invalid.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0 || 0x4 || Must be 0-3. Controls number of channels: 0 = mono, non-zero = stereo.
|-
| 0x4 || 0x4 || s32 SampleRate. Must be one of the following: 16000, 32000, 44100, 48000.
|-
| 0x8 || 0x4 || Bits per sample. Must be 8 or 16.
|}

= AudioOutState =
This is "nn::bluetooth::system::AudioOutState". This is an u32 enum.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Stopped
|-
| 1 || Started
|}

= AudioCodec =
This is "nn::bluetooth::system::AudioCodec". This is an u32 enum.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0 || Raw PCM
|}

= AudioControlButtonState =
This is "nn::bluetooth::system::AudioControlButtonState". This is a 0x10-byte struct.

= Notes =
The output from <code>sudo hcitool info {BDADDR}</code> is identical for [1.0.0-11.0.0]:

BD Address: {BDADDR}
OUI Company: Nintendo Co.,Ltd (98-B6-E9)
Device Name: Nintendo Switch
LMP Version: 4.2 (0x8) LMP Subversion: 0x2409
Manufacturer: Broadcom Corporation (15)
Features page 0: 0xbf 0xfe 0xcf 0xfe 0xdb 0xff 0x7b 0x87
<3-slot packets> <5-slot packets> <encryption> <slot offset>
<timing accuracy> <role switch> <sniff mode> <RSSI>
<channel quality> <SCO link> <HV2 packets> <HV3 packets>
<u-law log> <A-law log> <CVSD> <paging scheme> <power control>
<transparent SCO> <broadcast encrypt> <EDR ACL 2 Mbps>
<EDR ACL 3 Mbps> <enhanced iscan> <interlaced iscan>
<interlaced pscan> <inquiry with RSSI> <extended SCO>
<EV4 packets> <EV5 packets> <AFH cap. slave>
<AFH class. slave> <LE support> <3-slot EDR ACL>
<5-slot EDR ACL> <sniff subrating> <pause encryption>
<AFH cap. master> <AFH class. master> <EDR eSCO 2 Mbps>
<EDR eSCO 3 Mbps> <3-slot EDR eSCO> <extended inquiry>
<LE and BR/EDR> <simple pairing> <encapsulated PDU>
<err. data report> <non-flush flag> <LSTO> <inquiry TX power>
<EPC> <extended features>
Features page 1: 0x0f 0x00 0x00 0x00 0x00 0x00 0x00 0x00
Features page 2: 0x7f 0x0b 0x00 0x00 0x00 0x00 0x00 0x00

The bluetooth driver implements the bluetooth protocol over h4/uart. It interfaces with the [[Bus_services#uart|uart]] service to actually talk with the bluetooth hardware.

The bluetooth stack is Broadcom/Cypress brcm BSA (for example, see [https://github.com/hardkernel/buildroot_linux_amlogic_brcm-bsa here]).

Various btdrv service commands use a custom BSA extension (message-ids based at 0x8CA/2250), this is referred to as "robson".

The following L2CAP services are registered (dynamic channels): SDP, ATT (GATT), RFCOMM, HID (PSMs: 0x11, 0x13, 0x8001, 0x8003).

<code>l2cu_send_peer_echo_rsp</code> is called with p_data=NULL and data_len=0, therefore no data is returned in the L2CAP ECHO response.

The following HID transaction types are supported (by <code>hidh_l2cif_data_ind</code>): HANDSHAKE, CONTROL (only param VIRTUAL_CABLE_UNPLUG is supported), DATA, DATAC.
* DATAC is not actually supported, since the callback function (<code>bta_hh_cback</code>) just frees the message and returns.

== Versions ==
{| class="wikitable" border="1"
|-
! System Version
! bsa_version_string
! bsa_version_info_string
! Config string
|-
| [1.0.0]
| BSA0106_01.60.00_
| Hayward_J3_Patch_20161118
| BCM4356A3_001.004.009.0045.0000
|-
| [2.0.0]
| BSA0106_01.60.00_
| Hayward_J5_RC_20161227
| BCM4356A3_001.004.009.0047.0049
|-
| [3.0.0-3.0.1]
| BSA0106_01.60.00_
| Hayward_K4_RC_20170504
| BCM4356A3_001.004.009.0054.0056
|-
| [4.0.0]
| BSA0106_01.60.00_
| Hayward_L4_RC_20170815
| CYW4356A3_001.004.009.0057.0059
|-
| [5.0.0]
| BSA0106_01.60.00_
| Hayward_M2_RC_20180109
| CYW4356A3_001.004.009.0059.0061
|-
| [5.1.0]
| BSA0106_01.60.00_
| Hayward_N1_RC_20180226
| CYW4356A3_001.004.009.0062.0064
|-
| [6.0.0-6.2.0]
| BSA0106_01.60.00_
| Hayward_N3_RC_20180612
| CYW4356A3_001.004.009.0062.0064
|-
| [7.0.0]
| BSA0106_01.60.00_
| Hayward_O1_RC_20180829
| CYW4356A3_001.004.009.0076.0077
|-
| [8.0.0-9.0.0]
| BSA0106_01.60.00_
| Hayward_P1_RC_20190121
| CYW4356A3_001.004.009.0076.0077
|-
| [10.0.0-11.0.0]
| BSA0106_01.60.00_
| Hayward_R2_RC_20191119
| CYW4356A3_001.004.009.0092.0095
|-
| [12.0.0]
| BSA0106_01.60.00_
| Hayward_T3_RC_20210224
| CYW4356A3_001.004.009.0092.0095
|}

<code>bsa_sv_tm_read_version_excback</code> copies bsa_version_string and concats with bsa_version_info_string to generate <code>tBSA_TM_READ_VERSION.bsa_server_version</code>.

[[Category:Services]]

11.0.0

2020-12-09T17:28:15Z

Qlutoo: /* Web-applets */

The Switch 11.0.0 system update was released on December 1, 2020 (UTC). This Switch update was released for the following regions: ALL, and CHN.

Security flaws fixed: <fill this in manually later, see the updatedetails page from the ninupdates-report page(s) once available for now>.

==Change-log==
[https://en-americas-support.nintendo.com/app/answers/detail/a_id/22525/kw/nintendo%20switch%20system%20update Official] ALL change-log:
* Nintendo Switch Online was added to the HOME Menu.
*
* Access all Nintendo Switch Online services, from getting the latest information to checking your membership status.
* *This feature is not available in some countries/regions.
*
* A new feature that automatically downloads backed up save data was added to the Save Data Cloud.
*
* When using software with the same Nintendo Account linked to multiple systems, save data backed up from one console will automatically be downloaded to your other system(s).
* *To use this feature, it must be enabled under System Settings > Data Management > Save Data Cloud.
* *Save data will not be downloaded automatically unless save data for that software exists on the console. The first time only, users must download the save data manually.
* *A Nintendo Switch Online membership is required to use the Save Data Cloud service.
*
* A new Trending feature was added to the User Page.
*
* Users can check what software their friends are playing or have started playing recently.
* Information will not be displayed for friends who have their online status set to display to no one.
*
* Users can now transfer screenshots and videos from Album to their smart devices.
*
* Users can wirelessly connect their smart devices to Nintendo Switch to transfer the screenshots and videos saved within their Album.
* For screenshots, users can transfer a maximum of 10 screenshots and 1 video capture at once.
* *To connect, users must use their smart device to scan the QR Code displayed on the Nintendo Switch screen.
* For more information, please refer to the Nintendo Support website.
* *“QR Code” is a registered trademark of DENSO WAVE INCORPORATED.
*
*
* A new Copy to a Computer via USB Connection feature was added under System Settings > Data Management > Manage Screenshots and Videos.
*
* Users can use a USB cable to connect Nintendo Switch to their computers to copy the screenshots and videos saved under Album.
* * A USB charging cable [model HAC-010] or a USB-IF certified USB cable that supports data transfer is required to connect to a computer.
* For more information, please refer to the Nintendo Support website.
* * Connection via the Nintendo Switch dock is not supported. Please connect the Nintendo Switch system directly to the computer.
*
*
* Users can now select what download to prioritize when there are multiple downloads in progress.
*
* When there are multiple software, update data, or downloadable content downloads in progress, users can now select which they want to download first.
* You can set this under Download Options by selecting the icon for the software you want to download first on the HOME Menu.
*
*
* User icons were added.
*
* 12 user icons that commemorate the 35th anniversary of the Super Mario Bros. series were added.
*
* Users can now name preset button mappings with the Change Button Mapping feature.
* Brazilian Portuguese was added as a supported language.
*
* When users set their region to the Americas and their language to Português, the language used on the HOME Menu and in certain software will be displayed in Brazilian Portuguese.
*
* Several issues were fixed, and usability and stability were improved.

===BootImagePackage===
All files in RomFS were updated.

====Secure Monitor====
Secure Monitor was updated.

* The firmware revision magic was changed from 0x1AD to 0x1CE.
* Support was added for an additional DRAM model.

====Warmboot====
* The firmware revision magic was changed from 0x1AD to 0x1CE.

====Kernel====
* Kernel is now built with -Os instead of -O3
** Many functions are no longer inlined.
* crt0 deprivileging code now sets hypervisor EL2 registers.
* Logic for flushing entire data cache and invalidating entire TLB during init is now a function called by JumpFromEL2ToEL1 and DisableMmuICacheAndDCache instead of being duplicated.
* Initialize0 has had several things re-ordered/shuffled:
** InsertDevicePhysicalMemoryBlocks is now called immediately after the KernelCode region is inserted.
** "Needed device virtual space" is now calculated as 3 * (0x18000 + { sum of KernelAutoMap physical device regions } + GetUnknownDebugDeviceRegionSize()
** KernelMisc region size is now util::AlignUp(std::max(needed_device_virtual_space, 32_MB), 2_MB).
** Code for mapping the unknown debug address as UnknownDebug is no longer present.
** Slab region is now memset to zero after the linear region is mapped instead of before.
** Ranges are now more uniform; value in [range address / 2_MB, last_address / 2_MB] is generated and multipled by 2 MB instead of aligning down result.
* KMemoryRegion now has a "last_address" member replacing its "size" member.
** GetSize() now calculated as (last_address - address + 1)
* KMemoryRegionTree::Insert now takes in last address instead of size.
** Several callsites now verify that last_address != 0xFFFF...
* KMemoryRegionAllocator now uses a slabheap of count 200 instead of 1000.
* "Virtual" cores now supported, KThread now stores core ID/affinity for both virtual and physical.
* New SVC 0x37 "GetResourceLimitPeakValue"
** Returns the highest value that a resource limit's current has ever achieved.
** KResourceLimit now stores an array of peak values to enable this
* Two new kernel objects, KAlpha and KBeta (placeholder names, true object names are unknown and cannot be guessed without observing purpose).
** KAlpha has size 0x50, KBeta has size 0x88
** KObjectAllocators for KAlpha/KBeta receive counts 1, 6.
** KProcess has a list of KBeta, intrusive list node is at KBeta + 0x68.
* Four new SVCs, ID 0x39, 0x3A, 0x46, 0x47
** These are likely for interacting with KAlpha and KBeta, but on NX they are (presumably) if-def'd to be "return svc::ResultNotImplemented()"
* KThread had all of its members reordered and its unused members deleted
* Most KThread waits now use KThreadWaiterListIntrusiveNode instead of KThreadQueue
* KConditionVariable no longer uses global threads for the call to .nfind()
* KConditionVariable now sets the cv_key u32 value in userspace to 1 when a condvar has waiters, and to 0 when it does not.
** New nnSdk code relies on this behavior.
* SetupStackForUserModeThreadStarter (KThreadContext::Initialize) now sets X18 to (<cryptographically random u64> | 1), this value is unique for each thread.
** This is used for Pointer Authentication changes in web browser.
* KCoreLocalRegion deleted, replaced with pointer-to-current-thread
** TPIDR_EL1 != X18 now, and TPIDR_EL1 now always points to the exception thread stack.
* KSynchronization was deleted, replaced with namespaced or static-on-ksynchronization-object functions
* KSynchronizationObject now contains a pointer to thread queue, instead of an inline list
* KInterruptEvent no longer has an InterruptEventTask member
* KInterruptEventTask::Reset no longer calls KInterruptManager::ClearInterrupt, instead it calls a new function which returns a result
* KInterruptEventTask now has a KLightLock member
* KHardwareTimer is now an interrupt task again
* KHardwareTimer now has a new member "maximum_time", set to std::numeric_limits<s64>::value().
** Tasks will only be added to the task list if their time is <= maximum_time, this is in addition to the >= 1 checks previously.
* KIntrusiveRedBlackTreeNode now has common member functions instead of templated, size is now packed to 0x1C instead of 0x20.
** All Insert/Remove/etc operations are common regardless of the type the node is intrusive in.
* KDebugLogImpl::Initialize() now assumes uart has been configured for logging by the secure monitor, and does not perform tegra uart init sequence
* vsprintf, KDebugString::PutString are now fully inlined inside KVPrintf.
* KObjectContainer::Insert now returns void instead of Result
** Code which previously did R_TRY() now just calls.
* KPageHeapBitmapRng now has TinyMt as a data member, instead of directly implementing KPageHeap.
** This affects how constructor is invoked.
* New InfoType 24 ("FreeThreadCount") was added, gets the number of threads a process can allocate before exhausting its resource limit.
* KMemoryBlock/KMemoryInfo now has extra members tracking u8 non_contig_bitflags, u16 ipc_non_contig_lock_count, u16 device_non_contig_lock_count
* KMemoryBlockManager Update now takes non-contig flags to determine where to coalesce (all coalescing must now happen forwards instead of either direction)
* KMemoryBlockManagerUpdateAllocator no longer has a result member, instead it has ->Initialize() which takes in a number of blocks to allocate
* KMemoryManager::Allocate, KMemoryManager::AllocatePageGroup, KMemoryManager::AllocatePageGroupForProcess, now call KPageGroup::Open on the returned page group.
** All callsites for these functions no longer call open after allocating.
* KMemoryManager::Open is now KMemoryManager::OpenAdditionalReference, now checks that refcount is >= 1 instead of >= 0
* KPageTableBase now has an additional data member "disable_device_address_space_merge"
** KProcessPageTable::Initialize now takes in (process flags & 0x1000) as a bool argument to set this.
* Page table Query operations now return a number of blocks required to support the above when relevant
* KPageTable now uses 4 sw-reserved bits instead of 1
** Former bit 0x01.... ("Is Mapped") is now bit 0x40..... (PTE bit 58)
** PTE bit 55 "contiguous not allowed" was reworked for significantly more fine-grained control
*** PTE bit 55 is now "start of block non-contiguous", coalescing cannot occur if the first block in a coalesce has this block set.
*** PTE bit 56 is now "not-end-of-block non-contiguous", coalescing cannot occur if a block other than the last in a coalesce has this bit set
*** PTE bit 57 is now "end of block non-contiguous", coalescing cannot occur if the last block in a coalesce has this bit set
*** The old non-contiguous semantics are equivalent to 56 + 57 together.
** These bits are now returned by KPageTableImpl::Traverse
** Upper byte of KPageProperties is now bitflags to control management of these bits.
** Bit 0x1 = "Set/Clear PTE Bit55"
** Bit 0x2 = "Set PTE Bit56"
** Bit 0x4 = "Clear PTE Bit56"
** Bit 0x8 = "Set PTE Bit57"
** Bit 0x10 = "Clear PTE Bit57"
** Bit 0x20 = Force-Clear 56+57 + attempt to merge
* KMemoryBlockManager/KPageTable now prevent coalescing of blocks which are reprotected --- (for transfer memory, ipc, ...)
* They also do not coalesce adjacent GPU mappings that were mapped separately.
* They removed the 0x80 "AnyLocked" bit from KMemoryAttribute
* KMemoryBlock/KMemoryInfo now have additional u16 "device_non_coalesce_right_count".
** Like device_non_coalesce_left_count from previous 11.x, this now prevents merging with block to the right if set.
* KMemoryBlock::Add now takes in the memory block to the right instead of the size of the block to the right.
** This facilitates combining flags for the newly coalesced blocks.
* KPageTableBase::SetProcessMemoryPermission no longer sets non-coalesce bit 24.
* KDeviceAddressSpace::Map/KDeviceAddressSpace::Unmap now call new KPageTableBase function to update non-coalesce state according to partial map state.
* KDevicePageTable::UnmapImpl now invalidates TlbGroup in the failure case of adding to the page group.
* KPageTableBase::MakeAndOpenContiguousPageGroup is now KPageTableBase::MakePageGroupForDeviceAddressSpace, and now prevents coalescing until call completion.
** non_coalesce_mask 0x10 is used for this.
* KPageTableBase::UnmapCodeMemory no longer requires the whole range have the same state.
** It now invalidates instruction cache if any pages are code.
* KPageTable::UnknownVirtualFunction10 now takes in more arguments: _QWORD (address probably), _QWORD (size probably), two bools, _QWORD (address2 probably), _QWORD (size2 probably), void * (probably KAlpha * or KBeta *)
** Returns whether a comparison between address_probably and address_2_probably holds depending on flags at pointer + 0x10.
* KMemoryState_Io now goes to the alias code region in GetRegionAddress/Size (weird, seems like incorrect behavior)
** Also very weird: KPageTableBase::MapIo maps IO into the kernel map region, but KPageTableBase::QueryMapping panics if it is not in the alias code region.
** This "probably" causes kernel panic if mapping IO into process with 32-bit-no-alias address space type?

====FIRM Sysmodules====
FIRM sysmodules were updated. Specific diffs available below:
<check back for more diffs later>

==System Titles==
* All titles were updated, except for the following (minus stubbed titles): SharedFont, Dictionary, UrlBlackList, LibraryAppletMiiEdit.
* The previously stubbed 010000000000001B sysmodule was replaced with [[Capmtp_services|capmtp]].

The following sysmodules had IPC changes: [[USB_services|usb]], [[Settings_services|settings]], [[BCAT_services|bcat]], [[PTM_services|ptm]], [[Sockets_services|bsdsockets]], [[HID_services|hid]], [[Audio_services|audio]], [[WLAN_services|wlan]], [[Account_services|account]], [[NS_Services|ns]], [[PSC_services|psc]], [[Applet_Manager_services|am]], [[NIM_services|nim]], [[Display_services|vi]], [[Parental_Control_services|pctl]], [[Glue_services|glue]], [[ETicket_services|es]], [[Shared_Database_services|sdb]], [[OLSC_services|olsc]], [[PGL_services|pgl]], [[Filesystem_services|fs]], [[Loader_services|loader]], [[Services_API|sm]], [[Capture_services|capsrv]].

[[NPDM]] changes (see [[Services_API]] for service-hosting changes):
* All updated NPDMs now have [[NPDM#Flags|Flags]] bit5 set.
* ptm: Access to hshl:set and ins:r were added.
* ptm/hid: Various services were re-ordered in the Service Access Control.
* wlan now has access to csrng.
* ldn now has access to pl:u.
* pcv now has access to hshl:set.
* account now has access to ectx:w.
* ns now has access to pl:u.
* am: Access to the following was added: arp:r, aud:a, aud:d. Access to the following was removed: audin:a, audin:d, audout:a, audout:d, audren:a, audren:d. Access to hshl:set/hshl:sys was added.
* erpt: Access to svcGetResourceLimitLimitValue and svc 0x37 were added. Access to ectx:r was added.
* vi: The Handle Table Size was changed from 160 to 192. Access to the following services were added: erpt:c, gpio, i2c, lm, psc:m, pwm.
* glue now has access to hshl:sys, and access to psm was removed.
* creport now has access to fsp-srv.
* sdb now has access to bcat:s and pm:info.
* migration now has access to prepo:u.
* qlaunch now has access to [[Capmtp_services|capmtp]].
* [[Controller_Applet|LibraryAppletController]] now has access to [[NGCT_services|ngct:u]].
* [[Profile_Selector|LibraryAppletPlayerSelect]] now has access to [[OLSC_services|olsc:s]].
* [[Album_Applet|LibraryAppletPhotoViewer]]: Access to [[Sockets_services|bsd:u]] was replaced with [[Sockets_services|bsd:s]]. Access to [[LDN_services|lp2p:sys]] was added. Access to [[NS_Services|ns:am2]] was replaced with [[NS_Services|ns:ro]]. FS permission bit0 is now clear, MountContent* is no longer accessible.
* [[Internet_Browser|LibraryAppletLoginShare]] now has access to [[NS_Services|ns:web]].

RomFs changes:
* CertStore was [[SSL_services#CertStore|updated]].
* ErrorMessage: New errors were added / localization changes.
* BrowserDll: The following was updated: "/browser/ErrorPageFilteringTemplate.html", "/browser/MediaControls.css", "/browser/MediaControls.js", "/browser/RootCaEtc.pem", "/browser/RootCaSdkAdditional.pem", "/buildinfo/buildinfo.dat". The following was added: "/browser/MediaControlsInline.css", "/browser/MediaControlsInline.js".
** "/dll_0" and "/dll_1" were moved into "/nro/netfront/dll_{0/1}".
** "/lyt/Lhub.arc" was added.
** "/message/USpt/" was added.
* Help:
** "/legallines.htdocs/index.html" updated
** "/safe.htdocs/html/USpt/" added
** "/safe.htdocs/img/recyclenintendo.jpg" updated
** "/safe.htdocs/js/tapaction.js" updated
* NgWord: updated
* AvatarImage: More icons added.
* LocalNews: Added "/message/revision.txt" and "/message/USpt/".
* Eula:
** "/revision.txt" updated
** Updated "/EUru/Eula.msbt.szs", "/JPja/Eula.msbt.szs".
** Added "/USpt/".
* TimeZoneBinary: TZ info updated.
* FontNintendoExtension: "/nintendo_ext_003.bfttf" and "/nintendo_ext2_003.bfttf" were updated.
* FirmwareDebugSettings: updated
* FatalMessage: Updated "/pt-BR/GeneralMessage" and "/pt-BR/QuestMessage" were updated.
* ControllerIcon: "/lyt/ColorTable" updated
* PlatformConfigIcosa/PlatformConfigCopper/PlatformConfigHoag/PlatformConfigIcosaMariko: updated
* ControllerFirmware: "/TouchScreenFirmwareInfo.csv" updated
* NgWord2: updated
* FunctionBlackList:
** "/blacklist.dat" was replaced with "/blacklist.json".
* NgWordT: updated
* Applets: Various UI/graphics/sound/localization changes.
* Web-applets: "/buildinfo/buildinfo.dat" was updated, and "/.nrr/netfront.nrr" was renamed to "/.nrr/dll.nrr".
* [[Album_Applet|LibraryAppletPhotoViewer]]: In addition to the above, "/http/" was added, which contains the following:
** "index.html"
** "js/index.js"
** "styles/index.css"

The new Nintendo Switch Online menu (which can be launched via qlaunch) is handled by [[Internet_Browser#Whitelisted_Applets|LibraryAppletLoginShare]].

=== [[LDN_services|ldn]]-sysmodule ===
lp2p now supports using standard WPA2-PSK, which is used by [[#LibraryAppletPhotoViewer]].

=== [[SSL_services|ssl]]-sysmodule ===
TLS 1.3 is now [[SSL_services#SslVersion|supported]] if the user-process enables it.

See also [[#OSS]].

=== [[Creport|creport]]-sysmodule ===
* creport now has access to fsp-srv, this is used to retrieve debugging information that is now attached to error reports. The following functions are called (with output/info attached to erpts):
** GetSdCardSpeedMode
** GetSdCardCid
** GetSdCardUserAreaSize
** GetSdCardProtectedAreaSize
** GetAndClearSdCardErrorInfo
** IsGameCardInserted
** GetGameCardCid
** GetGameCardErrorReportInfo
** GetGameCardDeviceId
** GetMmcSpeedMode
** GetMmcCid
** GetMmcPatrolCount
** GetAndClearMmcErrorInfo
** GetMmcExtendedCsd
** GetAndClearMemoryReportInfo
** GetAndClearFileSystemProxyErrorInfo

=== [[Internet_Browser|Web-applets]] ===
These are now compiled with compiler Pointer Authentication / CFI mitigations enabled. This does not apply to non-web-applets.

Pointer Authentication uses the crc32x instruction, and x18 as a cryptographically-random u64 provided by the kernel.

This is used to add/subtract x30 starting with bit40, during functions entry/exit. The code for entry/exit is identical, except that entry does add, and exit uses subtract:
* The low 40-bits of x30 are extracted, then multiplied with x18.
* <code>crc32x w17, wzr, x17</code> (which uses the above value)
* Then the previously mentioned add/subtraction operation is done, with the output from the above shifted to bit40.

The x18 is OR'd by kernel with 1, to make sure it is odd. This means that the multiply is a bijection; in other words, no entropy is lost when doing the multiply. If this had not been done, a random value that is divisible by a large power of two (the attacker can just keep spawning threads until gets such a one), would have weak cookies that allows the scheme to be trivially broken.

CFI is implemented as follows: blr instructions no longer exist. When funcptrs are called, new functions are now called instead which handles the call. The u32 at funcptr_addr-4 must match 0xe7ffdefe, otherwise it will branch to undefined instruction 0x0000dead. Otherwise, it will jump to the funcptr_addr.

Almost all functions now have the above u32 at -4, therefore funcptr calls now have to start at the actual funcptr start. However, this doesn't apply to calls done during functions' exit: these directly br to the funcptr_addr without extra validation. The br instructions in the .plt were also replaced with branches to the function described above.

The above applies to all NSOs in ExeFs, except for LibraryAppletOfflineWeb which doesn't have it enabled. The NROs in the BrowserDll SystemData have it enabled for "/nro/netfront/dll_1/", however "dll_0" doesn't have it enabled (which is used by LibraryAppletOfflineWeb).

This is referred to in the build-path strings as "NX-NXFP2-a64-cfi" (nnSdkEmpty), and "NX64-cfi" (OSS).

=== LibraryAppletPhotoViewer ===
For details on the new sharing functionality in the Album applet, see [[Album_Applet|here]].

== OSS ==
[https://www.nintendo.co.jp/support/oss/index.html OSS] was updated.

Besides WebKit, [[SSL_services|NSS/NSPR]] was updated:
* NSPR was updated from 4.12 to 4.24.
* <code>#define NSSUTIL_VERSION "3.26"</code> was changed to <code>#define NSSUTIL_VERSION "3.49.1"</code>

Both src_{versions} directories were updated, with the same changes:
* "rocrt_nro.cpp" updated
* "NX-NXFP2-a64-cfi/rocrt.AssemblyOffset.h" Addded, identical to "NX-NXFP2-a64/rocrt.AssemblyOffset.h".

==See Also==
System update report(s):
* [https://yls8.mtheall.com/ninupdates/reports.php?date=2020-12-01_00-02-35&sys=hac]

{{NavboxVersions}}

[[Category:System versions]]

SVC

2019-09-10T01:07:17Z

Qlutoo:

__NOTOC__

= System calls =
{| class=wikitable
! Id || Name || In || Out
|-
| 0x1 || [[#svcSetHeapSize]] || W1=size || W0=result, X1=outaddr
|-
| 0x2 || [[#svcSetMemoryPermission]] || X0=addr, X1=size, W2=prot || W0=result
|-
| 0x3 || [[#svcSetMemoryAttribute]] || X0=addr, X1=size, W2=state0, W3=state1 || W0=result
|-
| 0x4 || [[#svcMapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x5 || [[#svcUnmapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x6 || [[#svcQueryMemory]] || X0=MemoryInfo*, X2=addr || W0=result, W1=PageInfo
|-
| 0x7 || [[#svcExitProcess]] || None ||
|-
| 0x8 || [[#svcCreateThread]] || X1=entry, X2=thread_context, X3=stacktop, W4=prio, W5=processor_id
R0=prio, R1=entry, R2=thread_context, R3=stacktop, R4=processor_id
|| W0=result, W1=handle
|-
| 0x9 || [[#svcStartThread]] || W0=thread_handle || W0=result
|-
| 0xA || [[#svcExitThread]] || None ||
|-
| 0xB || [[#svcSleepThread]] || X0=nano
R0=nano_lower32, R1=lower_upper32
||
|-
| 0xC || [[#svcGetThreadPriority]] || W1=thread_handle || W0=result, W1=prio
|-
| 0xD || [[#svcSetThreadPriority]] || W0=thread_handle, W1=prio || W0=result
|-
| 0xE || [[#svcGetThreadCoreMask]] || W2=thread_handle || W0=result, W1=out0, X2=out1
R0=result, R1=out0, R2=out1_lower32, R3=out1_upper32
|-
| 0xF || [[#svcSetThreadCoreMask]] || W0=thread_handle, W1=in, X2=in2
R0=thread_handle, R1=in, R2=in2_lower32, R3=in2_upper32
|| W0=result
|-
| 0x10 || [[#svcGetCurrentProcessorNumber]] || None || W0/X0=cpuid
|-
| 0x11 || [[#svcSignalEvent]] || W0=wevent_handle || W0=result
|-
| 0x12 || [[#svcClearEvent]] || W0=wevent_or_revent_handle || W0=result
|-
| 0x13 || [[#svcMapSharedMemory]] || W0=shmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x14 || svcUnmapSharedMemory || W0=shmem_handle, X1=addr, X2=size || W0=result
|-
| 0x15 || [[#svcCreateTransferMemory]] || X1=addr, X2=size, W3=perm || W0=result, W1=tmem_handle
|-
| 0x16 || svcCloseHandle || W0=handle || W0=result
|-
| 0x17 || svcResetSignal || W0=revent_or_process_handle || W0=result
|-
| 0x18 || [[#svcWaitSynchronization]] || X1=handles_ptr, W2=num_handles, X3=timeout
R0=timeout_lower32, R1=handles_ptr, R2=num_handles, R3=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x19 || [[#svcCancelSynchronization]] || W0=thread_handle || W0=result
|-
| 0x1A || svcArbitrateLock || W0=cur_thread_handle, X1=ptr, W2=req_thread_handle ||
|-
| 0x1B || svcArbitrateUnlock || X0=ptr ||
|-
| 0x1C || svcWaitProcessWideKeyAtomic || X0=ptr0, X1=ptr, W2=thread_handle, X3=timeout
R0=ptr0, R1=ptr, R2=thread_handle, R3=timeout_lower32, R4=timeout_upper32
|| W0=result
|-
| 0x1D || svcSignalProcessWideKey || X0=ptr, W1=value || W0=result
|-
| 0x1E || [[#svcGetSystemTick]] || None || X0={value of cntpct_el0}
R0=cntpct_el0_lower32, R1=cntpct_el0_upper32
|-
| 0x1F || svcConnectToNamedPort || X1=port_name_str || W0=result, W1=handle
|-
| 0x20 || svcSendSyncRequestLight || W0=light_session_handle, X1=? || W0=result
|-
| 0x21 || svcSendSyncRequest || X0=normal_session_handle || W0=result
|-
| 0x22 || [[#svcSendSyncRequestWithUserBuffer]] || X0=cmdbufptr, X1=size, X2=handle || W0=result
|-
| 0x23 || svcSendAsyncRequestWithUserBuffer || X1=cmdbufptr, X2=size, X3=handle || W0=result, W1=revent_handle
|-
| 0x24 || svcGetProcessId || W1=thread_or_process_or_debug_handle || W0=result, X1=pid
R0=result, R1=pid_lower32, R2=pid_upper32
|-
| 0x25 || svcGetThreadId || W1=thread_handle || W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x26 || [[#svcBreak]] || X0=break_reason,X1,X2=info || W0=result = 0
|-
| 0x27 || svcOutputDebugString || X0=str, X1=size || W0=result
|-
| 0x28 || svcReturnFromException || X0=result ||
|-
| 0x29 || [[#svcGetInfo]] || W1=info_id, X2=handle, X3=info_sub_id
R0=info_sub_id_lower32, R1=info_id, R2=handle, R3=info_sub_id_upper32
|| W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x2A || svcFlushEntireDataCache || None || None
|-
| 0x2B || svcFlushDataCache || X0=addr, X1=size || W0=result
|-
| 0x2C || [3.0.0+] [[#svcMapPhysicalMemory]] || X0=addr, X1=size || W0=result
|-
| 0x2D || [3.0.0+] svcUnmapPhysicalMemory || X0=addr, X1=size || W0=result
|-
| 0x2E || [5.0.0+] svcGetFutureThreadInfo || X3=timeout
R0=timeout_lower32, R1=timeout_upper32
|| W0=result, bunch of crap
|-
| 0x2F || svcGetLastThreadInfo || None || W0=result, W1,W2,W3,W4=unk, W5=truncated_u64, W6=bool
|-
| 0x30 || svcGetResourceLimitLimitValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
R0=result, R1=value_lower32, R2=value_upper32
|-
| 0x31 || svcGetResourceLimitCurrentValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
R0=result, R1=value_lower32, R2=value_upper32
|-
| 0x32 || svcSetThreadActivity || W0=thread_handle, W1=bool || W0=result
|-
| 0x33 || svcGetThreadContext3 || X0=[[#ThreadContext]]*, W1=thread_handle || W0=result
|-
| 0x34 || [4.0.0+] svcWaitForAddress || X0=ptr, W1=[[#ArbitrationType]], X2=value, X3=timeout
R0=ptr, R1=[[#ArbitrationType]], R2=value, R3=timeout_lower32, R4=timeout_upper32
||
|-
| 0x35 || [4.0.0+] svcSignalToAddress || X0=ptr, W1=[[#SignalType]], X2=value, W3=num_to_signal ||
|-
| 0x36 || [8.0.0+] svcSynchronizePreemptionState || None || W0=result
|- style="border-top: double"
| 0x3C || [[#svcDumpInfo]] || ||
|-
| 0x3D || [4.0.0+] svcDumpInfoNew || ||
|- style="border-top: double"
| 0x40 || svcCreateSession || W2=is_light, X3=name_ptr || W0=result, W1=server_handle, W2=client_handle
|-
| 0x41 || [[#svcAcceptSession]] || W1=port_handle || W0=result, W1=session_handle
|-
| 0x42 || svcReplyAndReceiveLight || W0=light_session_handle || W0=result, W1,W2,W3,W4,W5,W6,W7=out
|-
| 0x43 || [[#svcReplyAndReceive]] || X1=ptr_handles, W2=num_handles, X3=replytarget_handle(0=none), X4=timeout
R0=timeout_lower32, R1=ptr_handles, R2=num_handles, R3=replytarget_handle(0=none), R4=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x44 || svcReplyAndReceiveWithUserBuffer|| X1=buf, X2=sz, X3=ptr_handles, W4=num_handles, X5=replytarget_handle(0=none), X6=timeout
R0=num_handles, R1=buf, R2=sz, R3=ptr_handles, R4=replytarget_handle(0=none), R5=timeout_lower32, R6=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x45 || svcCreateEvent || None || W0=result, W1=wevent_handle, W2=revent_handle
|- style="border-top: double"
| 0x48 || [5.0.0+] [[#svcMapPhysicalMemoryUnsafe]] || X0=addr, X1=size || W0=result
|-
| 0x49 || [5.0.0+] svcUnmapPhysicalMemoryUnsafe || X0=addr, X1=size || W0=result
|-
| 0x4A || [5.0.0+] svcSetUnsafeLimit || X0=size || W0=result
|-
| 0x4B || [4.0.0+] [[#svcCreateCodeMemory]] || X1=addr, X2=size || W0=result, W1=code_memory_handle
|-
| 0x4C || [4.0.0+] [[#svcControlCodeMemory]] || W0=code_memory_handle, W1=[[#CodeMemoryOperation]], X2=dstaddr, X3=size, W4=perm
R0=code_memory_handle, R1=[[#CodeMemoryOperation]], R2=dstaddr_lower32, R3=dstaddr_upper32, R4=size_lower32, R5=size_upper32, R6=perm
|| W0=result
|-
| 0x4D || svcSleepSystem || None || None
|-
| 0x4E || [[#svcReadWriteRegister]] || X1=reg_addr, W2=rw_mask, W3=in_val
R0=rw_mask, R1=in_val, R2=reg_addr_lower32, R3=reg_addr_upper32
|| W0=result, W1=out_val
|-
| 0x4F || svcSetProcessActivity || W0=process_handle, W1=bool || W0=result
|-
| 0x50 || [[#svcCreateSharedMemory]] || W1=size, W2=myperm, W3=otherperm || W0=result, W1=shmem_handle
|-
| 0x51 || [[#svcMapTransferMemory]] || X0=tmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x52 || [[#svcUnmapTransferMemory]] || W0=tmemhandle, X1=addr, X2=size || W0=result
|-
| 0x53 || [[#svcCreateInterruptEvent]] || X1=irq_num, W2=flag || W0=result, W1=handle
|-
| 0x54 || [[#svcQueryPhysicalAddress]] || X1=addr || W0=result, X1=physaddr, X2=kerneladdr, X3=size
|-
| 0x55 || [[#svcQueryIoMapping]] || X1=physaddr, X2=size
R0=size, R2=physaddr_lower32, R3=physaddr_upper32
|| W0=result, X1=virtaddr
|-
| 0x56 || [[#svcCreateDeviceAddressSpace]] || X1=dev_as_start_addr, X2=dev_as_end_addr
R0=dev_as_end_addr_lower32, R1=dev_as_end_addr_upper32, R2=dev_as_start_addr_lower32, R3=dev_as_start_addr_upper32
|| W0=result, W1=dev_as_handle
|-
| 0x57 || [[#svcAttachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x58 || [[#svcDetachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x59 || [[#svcMapDeviceAddressSpaceByForce]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=rev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result
|-
| 0x5A || [[#svcMapDeviceAddressSpaceAligned]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=rev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result
|-
| 0x5B || svcMapDeviceAddressSpace || W1=dev_as_handle, W2=proc_handle, X3=dev_map_addr, X4=dev_as_size, X5=dev_as_addr, W6=perm
R0=dev_map_addr_lower32, R1=dev_as_handle, R2=proc_handle, R3=dev_map_addr_upper32, R4=dev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result, X1=mapped_size
R0=result, R1=mapped_size
|-
| 0x5C || [[#svcUnmapDeviceAddressSpace]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=dev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32
|| W0=result
|-
| 0x5D || svcInvalidateProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x5E || svcStoreProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x5F || svcFlushProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x60 || svcDebugActiveProcess || X1=pid
R2=pid_lower32, R3=pid_upper32
|| W0=result, W1=debug_handle
|-
| 0x61 || svcBreakDebugProcess || W0=debug_handle || W0=result
|-
| 0x62 || svcTerminateDebugProcess || W0=debug_handle || W0=result
|-
| 0x63 || svcGetDebugEvent || X0=[[#DebugEventInfo]]*, W1=debug_handle || W0=result
|-
| 0x64 || [[#svcContinueDebugEvent]] || [1.0.0-2.3.0] W0=debug_handle, W1=[[#ContinueDebugFlagsOld]], X2=thread_id
[3.0.0+] W0=debug_handle, W1=[[#ContinueDebugFlags]], X2=thread_id_list(u64 *), W3=num_tids (max 64, 0 means "all threads")
|| W0=result
|-
| 0x65 || svcGetProcessList || X1=pids_out_ptr, W2=max_out || W0=result, W1=num_out
|-
| 0x66 || svcGetThreadList || X1=tids_out_ptr, W2=max_out, W3=debug_handle_or_zero || W0=result, X1=num_out
|-
| 0x67 || svcGetDebugThreadContext || X0=ThreadContext*, X1=debug_handle, X2=thread_id, W3=[[#ThreadContextFlags]]
R0=ThreadContext*, R1=debug_handle, R2=thread_id_lower32, R3=thread_id_upper32, R4=[[#ThreadContextFlags]]
|| W0=result
|-
| 0x68 || svcSetDebugThreadContext || W0=debug_handle, X1=thread_id, X2=ThreadContext*, W3=[[#ThreadContextFlags]]
R0=debug_handle, R1=ThreadContext*, R2=thread_id_lower32, R3=thread_id_upper32, R4=[[#ThreadContextFlags]]
|| W0=result
|-
| 0x69 || svcQueryDebugProcessMemory || X0=[[#MemoryInfo]]*, X2=debug_handle, X3=addr || W0=result, W1=PageInfo
|-
| 0x6A || svcReadDebugProcessMemory || X0=buffer*, X1=debug_handle, X2=src_addr, X3=size || W0=result
|-
| 0x6B || svcWriteDebugProcessMemory || X0=debug_handle, X1=buffer*, X2=dst_addr, X3=size || W0=result
|-
| 0x6C || [[#svcSetHardwareBreakPoint]] || W0=HardwareBreakpointId, X1=watchpoint_flags/breakpoint_flags, X2=watchpoint_value/debug_handle
R0=HardwareBreakpointId, R1=value_lower32, R2=flags_lower32, R3=flags_upper32, R4=value_upper32
|| W0=result
|-
| 0x6D || svcGetDebugThreadParam || X2=debug_handle, X3=thread_id, W4=[[#DebugThreadParam]]
R0=thread_id_lower32, R1=thread_id_upper32, R2=debug_handle, R3=[[#DebugThreadParam]]
|| W0=result, X1=out0, W2=out1
R0=result, R1=out0_lower32, R2=out0_upper32, R3=out1
|- style="border-top: double"
| 0x6F || [5.0.0+] [[#svcGetSystemInfo]] || X1=info_id, X2=handle, X3=info_sub_id
R1=info_sub_id_lower32, R2=info_id, R3=handle, R4=info_sub_id_upper32
|| W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x70 || svcCreatePort || W2=max_sessions, W3=is_light, X4=name_ptr
R0=name_ptr, R2=max_sessions, R3=is_light
|| W0=result, W1=serverport_handle, W2=clientport_handle
|-
| 0x71 || svcManageNamedPort || X1=name_ptr, W2=max_sessions || W0=result, W1=serverport_handle
|-
| 0x72 || svcConnectToPort || W1=clientport_handle || W0=result, W1=session_handle
|-
| 0x73 || [[#svcSetProcessMemoryPermission]] || W0=process_handle, X1=addr, X2=size, W3=perm
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32, R5=perm
|| W0=result
|-
| 0x74 || [[#svcMapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size
R0=dstaddr, R1=process_handle, R2=srcaddr_lower32, R3=srcaddr_upper32, R4=size
|| W0=result
|-
| 0x75 || [[#svcUnmapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size
R0=dstaddr, R1=process_handle, R2=srcaddr_lower32, R3=srcaddr_upper32, R4=size
|| W0=result
|-
| 0x76 || [[#svcQueryProcessMemory]] || X0=meminfo_ptr, W2=process_handle, X3=addr
R0=meminfo_ptr, R1=addr_lower32, R2=process_handle, R3=addr_upper32
|| W0=result, W1=pageinfo
|-
| 0x77 || [[#svcMapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size
R0=process_handle, R1=srcaddr_lower32, R2=dstaddr_lower32, R3=dstaddr_upper32, R4=srcaddr_lower32, R5=size_lower32, R6=size_upper32
|| W0=result
|-
| 0x78 || [[#svcUnmapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size
R0=process_handle, R1=srcaddr_lower32, R2=dstaddr_lower32, R3=dstaddr_upper32, R4=srcaddr_lower32, R5=size_lower32, R6=size_upper32
|| W0=result
|-
| 0x79 || [[#svcCreateProcess]] || X1=procinfo_ptr, X2=caps_ptr, W3=cap_num || W0=result, W1=process_handle
|-
| 0x7A || svcStartProcess || W0=process_handle, W1=main_thread_prio, W2=default_cpuid, W3=main_thread_stacksz
R0=process_handle, R1=main_thread_prio, R2=default_cpuid, R3=main_thread_stacksz_lower32, R4=main_thread_stacksz_upper32
|| W0=result
|-
| 0x7B || svcTerminateProcess || W0=process_handle || W0=result
|-
| 0x7C || [[#svcGetProcessInfo]] || W0=process_handle, W1=[[#ProcessInfoType]]
R1=process_handle, R2=[[#ProcessInfoType]]
|| W0=result, X1=[[#ProcessState]]
R0=result, R1=[[#ProcessState]]_lower32, R2=[[#ProcessState]]_upper32
|-
| 0x7D || svcCreateResourceLimit || None || W0=result, W1=reslimit_handle
|-
| 0x7E || svcSetResourceLimitLimitValue || W0=reslimit_handle, W1=[[#LimitableResource]], X2=value
R0=reslimit_handle, R1=[[#LimitableResource]], R2=value_lower32, R3=value_upper32
|| W0=result
|-
| 0x7F || [[#svcCallSecureMonitor]] || X0=smc_sub_id, X1,X2,X3,X4,X5,X6,X7=smc_args
R0=smc_sub_id, R1, R2, R3=smc_args
|| X0,X1,X2,X3,X4,X5,X6,X7=result
R0,R1,R2,R3=result
|}

== svcSetHeapSize ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || OutAddr
|}
</div>

'''Description:''' Set the process heap to a given Size. It can both extend and shrink the heap.

Size must be a multiple of 0x200000 (2MB).

On success, the heap base-address (which is fixed by kernel, aslr'd, and always in the Heap memory region) is written to OutAddr.

Uses current process pool partition. The memory allocated counts towards the caller's process Memory ResourceLimit.

[2.0.0+] Size must be less than or equal to 4GB.

=== Result codes ===

'''0x0:''' Success.

'''0xCA01:''' Invalid size passed. It's either bigger than 4GB, or misaligned.

'''0xD001:''' Size is bigger than the Heap Region size.

'''0xCE01:''' KMemoryBlockAllocator slab allocator exhausted.

'''0xD401:''' The memory region is in an invalid state. Likely because a mapping was made in the heap region.

'''0x10801:''' Memory resource limit reached.

== svcSetMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || Prot
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change permission of page-aligned memory region.

Bit2 of permission (exec) is not allowed. Setting write-only is not allowed either (bit1).

This can be used to move back and forth between ---, r-- and rw-.

=== Result codes ===

'''0x0:''' Success. The memory region was reprotected.

'''0xCC01:''' Unaligned address specified.

'''0xCA01:''' Unaligned or zero size specified.

'''0xD401:''' The provided memory region does not fall within the userland address space.

'''0xD801:''' Invalid permission specified. Valid permissions are ---, r-- and rw-.

'''0xD401:''' The provided memory region was in an invalid state. The region must have the PermissionChangeAllowed bit set in its [[#MemoryState]], and must not have the IsBorrowed or IsUncached [[#MemoryAttribute]].

'''0xCE01:''' Kernel resource exhausted.

== svcSetMemoryAttribute ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || u32 || State0
|-
| (In) W3 || u32 || State1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change attribute of page-aligned memory region.

This is used to turn on/off caching for a given memory area. Useful when talking to devices such as the GPU.

What happens "under the hood" is the "Memory Attribute Indirection Register" index is changed from 2 to 3 in the MMU descriptor.

{| class=wikitable
! State0 || State1 || Action
|-
| 0 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 8 || Set bit3 in [[#MemoryAttribute]].
|}

== svcMapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps a memory range into a different range.

Mainly used for adding guard pages around stack.

Source range gets reprotected to --- (it can no longer be accessed), and bit0 is set in the source [[#MemoryAttribute]].

[1.0.0] This could be used to map into either the Alias Region or the Stack region.

[2.0.0+] This can only be used to map into the Stack region.

Code can get the range of the Alias region from [[#svcGetInfo]] id0=2,3, and on 2.0.0+ the range of the Stack region via [[#svcGetInfo]] id0=14, 15 (on 1.0.0, the Stack region had hardcoded limits).

When mapped into the Alias region, the mapped memory will have state 0x482907.

When mapped into the Stack region, the mapped memory will have state 0x5C3C0B.

== svcUnmapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps a region that was previously mapped with [[#svcMapMemory]].

It's possible to unmap ranges partially, you don't need to unmap the entire range "in one go".

The srcaddr/dstaddr must match what was given when the pages were originally mapped.

== svcQueryMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfo
|-
| (In) X2 || void* || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

'''Description:''' Query information about an address. Will always fetch the lowest page-aligned mapping that contains the provided address.

Outputs a [[#MemoryInfo]] struct.

== svcExitProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current process.

== svcCreateThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || void(*)(void*) || Entry
|-
| (In) X2 || R2 || void* || ThreadContext
|-
| (In) X3 || R3 || void* || StackTop
|-
| (In) W4 || R0 || u32 || Priority
|-
| (In) W5 || R4 || u32 || ProcessorId
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || Handle<Thread> || Handle
|}
</div>

'''Description:''' Create a thread in the current process.

Processor_id must be 0,1,2,3 or -2, where -2 uses the default cpuid for process.

== svcStartThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) None || ||
|}
</div>

'''Description:''' Starts the thread for the provided handle.

== svcExitThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current thread.

== svcSleepThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0, R1 || s64 || Nanoseconds
|-
|}
</div>

'''Description:''' Sleep for a specified amount of time, or yield thread.

Setting nanoseconds to 0, -1, or -2 indicates a yielding type.

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Value || Type
|-
| 0 || Yielding without core migration
|-
| -1 || Yielding with core migration
|-
| -2 || Yielding to any other thread
|-
|}
</div>

== svcGetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1|| Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || Priority
|}
</div>

'''Description:''' Get priority of provided thread handle.

== svcSetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0|| Handle<Thread> || Handle
|-
| (In) W1|| u32 || Priority
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set priority of provided thread handle.

Priority is a number 0-0x3F. Lower value means higher priority.

== svcGetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W2 || R2 || Handle<Thread> || Handle
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u32 || Out0
|-
| (Out) X2 || R2, R3 || u64 || Out1
|}
</div>

'''Description:''' Get affinity mask of provided thread handle.

== svcSetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Thread> || Handle
|-
| (In) W1 || R1 || u32 || In0
|-
| (In) X2 || R2, R3 || u64 || In1
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set affinity mask of provided thread handle.

== svcGetCurrentProcessorNumber ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0/X0 || u64 || CpuId
|}
</div>

'''Description:''' Get which cpu is executing the current thread.

Cpu-id is an integer in the range 0-3.

== svcSignalEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<WritableEvent> || Event
|-
| (Out) X0 || [[#Result]] || Result
|}
</div>

'''Description:''' Puts the given event in the signaled state.

Will wake up any thread currently waiting on this event. Can potentially trigger a reschedule.

Any calls to [[#svcWaitSynchronization]] on this handle will return immediately, until the event's signaled state is reset.

=== Result codes ===

'''0x0:''' Success. Event is now in signaled state.

'''0xE401:''' Invalid handle. The handle either does not exist, or is not a WritableEvent.

== svcClearEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<WritableEvent or ReadableEvent> || Event
|-
| (Out) X0 || [[#Result]] || Result
|}
</div>

'''Description:''' Takes the given event out of the signaled state.

=== Result codes ===

'''0x0:''' Success, the event is now in the not-signaled state.

'''0xE401:''' Invalid handle. The handle either does not exist, or is not a ReadableEvent nor a WritableEvent.

'''0xFA01:''' The handle was not in a signaled state.

== svcMapSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<SharedMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the block supplied by the handle. The required permissions are different for the process that created the handle and all other processes.

Increases reference count for the KSharedMemory object. Thus in order to release the memory associated with the object, all handles to it must be closed and all mappings must be unmapped.

== svcCreateTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<TransferMemory> || Handle
|}
</div>

This one reprotects the src block with perms you give it. It also sets bit0 into [[#MemoryAttribute]].

Executable bit perm not allowed.

Closing all handles automatically causes the bit0 in [[#MemoryAttribute]] to clear, and the permission to reset.

== svcWaitSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || Handle* || HandlesPtr
|-
| (In) W2 || R2 || u64 || HandlesNum
|-
| (In) X3 || R0, R3 || u64 || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u64 || HandleIndex
|}
</div>
Works with num_handles <= 0x40.

When zero handles are passed, this will wait forever until either timeout or cancellation occurs.

Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.

=== Object types ===

'''KDebug:''' signals when there is a new [[#DebugEventInfo|DebugEvent]] (retrievable via [[#svcGetDebugEvent]]).

'''KClientPort:''' signals when the number of sessions is less than the maximum allowed.

'''KProcess:''' signals when the process undergoes a state change (retrievable via [[#svcGetProcessInfo]]).

'''KReadableEvent:''' signals when the event's corresponding KWritableEvent has been signaled via svcSignalEvent.

'''KServerPort:''' signals when there is an incoming connection waiting to be [[#svcAcceptSession|accepted]].

'''KServerSession:''' signals when there is an incoming message waiting to be [[#svcReplyAndReceive|received]] or the pipe is closed.

'''KThread:''' signals when the thread has exited.

=== Result codes ===

'''0x0:''' Success. One of the objects was signaled before the timeout expired, or one of the objects is a Session with a closed remote. Handle index is updated to indicate which object signaled.

'''0x7601:''' Thread termination requested. Handle index is not updated.

'''0xe401:''' Invalid handle. Returned when one of the handles passed is invalid. Handle index is not updated.

'''0xe601:''' Invalid address. Returned when the handles pointer is not a readable address. Handle index is not updated.

'''0xea01:''' Timeout. Returned when no objects have been signaled within the timeout. Handle index is not updated.

'''0xec01:''' Interrupted. Returned when another thread uses [[#svcCancelSynchronization]] to cancel this thread. Handle index is not updated.

'''0xee01:''' Too many handles. Returned when the number of handles passed is > 0x40.

== svcCancelSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

If the referenced thread is currently in a synchronization call ([[#svcWaitSynchronization]], [[#svcReplyAndReceive]] or [[#svcReplyAndReceiveLight]]), that call will be interrupted and return 0xec01.
If that thread is not currently executing such a synchronization call, the next call to a synchronization call will return 0xec01.

This doesn't take force-pause (activity/debug pause) into account.

=== Result codes ===

'''0x0:''' Success. The thread was either interrupted or has had its flag set.

'''0xe401:''' Invalid handle. The handle given was either invalid or not a thread handle.

== svcGetSystemTick ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (Out) X0 || R0, R1 || u64 || Ticks
|}
</div>

Returns the value of cntpct_el0.

The frequency is 19200000 Hz (constant from official sw).

Official sw reads cntpct_el0 directly from usermode without using this SVC. [[ExeFS|sdk-nso]] has this SVC, but it's not known to be called anywhere.

== svcSendSyncRequestWithUserBuffer ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || CmdPtr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || Handle<Session> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size and CmdPtr must be 0x1000-aligned.

=== Result codes ===

'''0x0:''' Success.

'''0xcc01:''' CmdPtr is not 0x1000-aligned.

'''0xca01:''' Size is not 0x1000-aligned.

'''0xce01:''' KSessionRequest allocation failed (unlikely) or pointer buffer size exceeded.

'''0xe401:''' Handles does not exist, or handle is not an instance of KClientSession.

== svcBreak ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || Break Reason
|-
| (In) X1 || u64 ||
|-
| (In) X2 || u64 || Info
|-
| (Out) W0 || Result || 0 (Success)
|}
</div>

If the process is attached, report the Break event. Then, if svcContinueDebugEvent didn't apply IgnoreException on the thread: if TPIDR_EL0 is 0, adjust ELR_EL1 to retry to svc instruction (and set TPIDR_EL0 to 1).

Otherwise, if bit31 in reason isn't set, perform crash reporting (see Exception Handling section below), if it doesn't terminate the process adjust ELR_EL1 as well.

Otherwise just return 0.

== svcGetInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u32 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>
<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) R0 || u32 || InfoSubIdLower32
|-
| (In) R1 || u32 || InfoId
|-
| (In) R2 || Handle || Handle
|-
| (In) R3 || u32 || InfoSubIdUpper32
|-
| (Out) R0 || [[#Result]] || Ret
|-
| (Out) R1 || u32 || OutLower32
|-
| (Out) R2 || u32 || OutUpper32
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Process || 0 || 0 || AllowedCpuIdBitmask
|-
| Process || 1 || 0 || AllowedThreadPrioBitmask
|-
| Process || 2 || 0 || AliasRegionBaseAddr
|-
| Process || 3 || 0 || AliasRegionSize
|-
| Process || 4 || 0 || HeapRegionBaseAddr
|-
| Process || 5 || 0 || HeapRegionSize
|-
| Process || 6 || 0 || TotalMemoryAvailable. Total memory available(free+used).
|-
| Process || 7 || 0 || TotalMemoryUsage. Total used size of codebin memory + main-thread stack + allocated heap.
|-
| Zero || 8 || 0 || IsCurrentProcessBeingDebugged
|-
| Zero || 9 || 0 || Returns ResourceLimit handle for current process. Used by [[Process_Manager_services|PM]].
|-
| Zero || 10 || -1, {current coreid} || IdleTickCount
|-
| Zero || 11 || 0-3 || RandomEntropy from current process. TRNG. Used to seed usermode PRNGs.
|-
| Process || 12 || 0 || [2.0.0+] AddressSpaceBaseAddr
|-
| Process || 13 || 0 || [2.0.0+] AddressSpaceSize
|-
| Process || 14 || 0 || [2.0.0+] StackRegionBaseAddr
|-
| Process || 15 || 0 || [2.0.0+] StackRegionSize
|-
| Process || 16 || 0 || [3.0.0+] PersonalMmHeapSize
|-
| Process || 17 || 0 || [3.0.0+] PersonalMmHeapUsage
|-
| Process || 18 || 0 || [3.0.0+] TitleId
|-
| Zero || 19 || 0 || [4.0.0-4.1.0] PrivilegedProcessId_LowerBound
|-
| Zero || 19 || 1 || [4.0.0-4.1.0] PrivilegedProcessId_UpperBound
|-
| Process || 20 || 0 || [5.0.0+] UserExceptionContextAddr
|-
| Process || 21 || 0 || [6.0.0+] TotalMemoryAvailableWithoutMmHeap
|-
| Process || 22 || 0 || [6.0.0+] TotalMemoryUsedWithoutMmHeap
|-
| Process || 23 || 0 || [9.0.0+]
|-
| Thread || 0xF0000002 || 0-3, -1 || Thread Ticks. When 0-3 are passed, gets specific core CPU ticks spent on thread. When -1 is passed, gets total CPU ticks spent on thread.
|}

== svcMapPhysicalMemory ==
This is like svcSetHeapSize except you can allocate heap at any address you'd like.

Uses current process pool partition.

== svcDumpInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

Does nothing, just returns with registers set to all-zero.

== svcAcceptSession ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || Handle<Port> || Port
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ServerSession> || Session
|}
</div>

=== Result codes ===

'''0xf201:''' No session waiting to be accepted

== svcReplyAndReceive ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || *Handle<Port or ServerSession> || Handles
|-
| (In) W2 || R2 || u32 || NumHandles
|-
| (In) W3 || R3 || Handle<ServerSession> || ReplyTarget
|-
| (In) X4 || R0, R4 || u64 (nanoseconds) || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || u32 || HandleIndex
|}
</div>

If ReplyTarget is not zero, a reply from the TLS will be sent to that session.
Then it will wait until either of the passed sessions has an incoming message, is closed, a passed port has an incoming connection, or the timeout expires.
If there is an incoming message, it is copied to the TLS.

If ReplyTarget is zero, the TLS should contain a blank message. If this message has a C descriptor, the buffer it points to will be used as the pointer buffer. See [[IPC_Marshalling#IPC_buffers]]. Note that a pointer buffer cannot be specified if ReplyTarget is not zero.

After being validated, passed handles will be enumerated in order; even if a session has been closed, if one that appears earlier in the list has an incoming message, it will take priority and a result code of 0x0 will be returned.

=== Result codes ===

'''0x0:''' Success. Either a session has an incoming message or a port has an incoming connection. HandleIndex is set appropriately.

'''0xea01:''' Timeout. No handles were signalled before the timeout expired. HandleIndex is not updated.

'''0xf601:''' Port remote dead. One of the sessions has been closed. HandleIndex is set appropriately.

== svcMapPhysicalMemoryUnsafe ==
Same as [[#svcMapPhysicalMemory]] except it always uses pool partition 0.

== svcCreateCodeMemory ==
Takes an address range with backing memory to create the code memory object.

The memory is initially memset to 0xFF after being locked.

== svcControlCodeMemory ==
Maps the backing memory for a Code memory object into the current process.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapOwner]], memory permission must be RW-.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapSlave]], memory permission must be R-- or R-X.

Operations [[#CodeMemoryOperation|CodeMemoryOperation_UnmapOwner/CodeMemoryOperation_UnmapSlave]] unmap memory that was previously mapped this way.

This allows one "secure JIT" process to map the code memory as RW-, and the other "slave" process to map it R-X.

[5.0.0+] Error 0xE401 is now returned when the process owner of the Code memory object is the same as the current process.

== svcReadWriteRegister ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || RegAddr
|-
| (In) W2 || R0 || u64 || RwMask
|-
| (In) W3 || R1 || u64 || InValue
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u64 || OutValue
|}
</div>

Read/write IO registers with a hardcoded whitelist. Input address is physical-address and must be aligned to 4.

rw_mask is 0 for reading and 0xffffffff for writing. You can also write individual bits by using a mask value.

You can only write to registers inside physical pages 0x70019000 (MC), 0x7001C000 (MC0), 0x7001D000 (MC1), and they all share the same whitelist.

The whitelist is same for writing as for reading.

The whitelist is:

0x054, 0x090, 0x094, 0x098, 0x09c, 0x0a0, 0x0a4, 0x0a8, 0x0ac, 0x0b0, 0x0b4, 0x0b8, 0x0bc, 0x0c0, 0x0c4, 0x0c8, 0x0d0, 0x0d4, 0x0d8, 0x0dc, 0x0e0, 0x100, 0x108, 0x10c, 0x118, 0x11c, 0x124, 0x128, 0x12c, 0x130, 0x134, 0x138, 0x13c, 0x158, 0x15c, 0x164, 0x168, 0x16c, 0x170, 0x174, 0x178, 0x17c, 0x200, 0x204, 0x2e4, 0x2e8, 0x2ec, 0x2f4, 0x2f8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37c, 0x380, 0x390, 0x394, 0x398, 0x3ac, 0x3b8, 0x3bc, 0x3c0, 0x3c4, 0x3d8, 0x3e8, 0x41c, 0x420, 0x424, 0x428, 0x42c, 0x430, 0x44c, 0x47c, 0x480, 0x484, 0x50c, 0x554, 0x558, 0x55c, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69c, 0x6a0, 0x6a4, 0x6c0, 0x6c4, 0x6f0, 0x6f4, 0x960, 0x970, 0x974, 0xa20, 0xa24, 0xb88, 0xb8c, 0xbc4, 0xbc8, 0xbcc, 0xbd0, 0xbd4, 0xbd8, 0xbdc, 0xbe0, 0xbe4, 0xbe8, 0xbec, 0xc00, 0xc5c, 0xcac

[2.0.0+] Whitelist was extended with 0x4c4, 0x4c8, 0x4cc, 0x584, 0x588, 0x58c.

[2.0.0+] The IO registers in range 0x7000E400 (PMC) size 0xC00 skip the whitelist, and do a TrustZone call using [[SMC]] Id1 0xC3000008(ReadWriteRegister).

[4.0.0+] Access to the Memory Controller (0x70019000) also uses smcReadWriteRegister.

Here is the whitelist imposed by that SMC, relative to the start of the PMC registers:

0x000, 0x00c, 0x010, 0x014, 0x01c, 0x020, 0x02c, 0x030, 0x034, 0x038, 0x03c, 0x040, 0x044, 0x048, 0x0dc, 0x0e0, 0x0e4, 0x160, 0x164, 0x168, 0x170, 0x1a8, 0x1b8, 0x1bc, 0x1c0, 0x1c4, 0x1c8, 0x2b4, 0x2d4, 0x440, 0x4d8

Here is the whitelist imposed by smcReadWriteRegister (checked in addition to the whitelist in svcReadWriteRegister), relative to the start of the MC registers:

0x000, 0x004, 0x008, 0x00C, 0x010, 0x01C, 0x020, 0x030, 0x034, 0x050, 0x054, 0x090, 0x094, 0x098, 0x09C, 0x0A0, 0x0A4, 0x0A8, 0x0AC, 0x0B0, 0x0B4, 0x0B8, 0x0BC, 0x0C0, 0x0C4, 0x0C8, 0x0D0, 0x0D4, 0x0D8, 0x0DC, 0x0E0, 0x100, 0x108, 0x10C, 0x118, 0x11C, 0x124, 0x128, 0x12C, 0x130, 0x134, 0x138, 0x13C, 0x158, 0x15C, 0x164, 0x168, 0x16C, 0x170, 0x174, 0x178, 0x17C, 0x200, 0x204, 0x238, 0x240, 0x244, 0x250, 0x254, 0x258, 0x264, 0x268, 0x26C, 0x270, 0x274, 0x280, 0x284, 0x288, 0x28C, 0x294, 0x2E4, 0x2E8, 0x2EC, 0x2F4, 0x2F8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37C, 0x380, 0x390, 0x394, 0x398, 0x3AC, 0x3B8, 0x3BC, 0x3C0, 0x3C4, 0x3D8, 0x3E8, 0x41C, 0x420, 0x424, 0x428, 0x42C, 0x430, 0x44C, 0x47C, 0x480, 0x484, 0x4C4, 0x4C8, 0x4CC, 0x50C, 0x554, 0x558, 0x55C, 0x584, 0x588, 0x58C, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69C, 0x6A0, 0x6A4, 0x6C0, 0x6C4, 0x6F0, 0x6F4, 0x960, 0x970, 0x974, 0x9B8, 0xA20, 0xA24, 0xA88, 0xA94, 0xA98, 0xA9C, 0xAA0, 0xAA4, 0xAA8, 0xAAC, 0xAB0, 0xAB4, 0xAB8, 0xABC, 0xAC0, 0xAC4, 0xAC8, 0xACC, 0xAD0, 0xAD4, 0xAD8, 0xADC, 0xAE0, 0xB88, 0xB8C, 0xBC4, 0xBC8, 0xBCC, 0xBD0, 0xBD4, 0xBD8, 0xBDC, 0xBE0, 0xBE4, 0xBE8, 0xBEC, 0xC00, 0xC5C, 0xCAC

== svcCreateSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || LocalPerm
|-
| (In) W3 || [[#Permission]] || RemotePerm
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<SharedMemory> || MemHandle
|}
</div>

Other perm can be used to enforce permission 1, 3, or 0x10000000 if don't care.

Allocates memory from the current process' pool partition.

== svcMapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

The newly mapped pages will have [[#MemoryState]] type 0xE.

You must pass same size and permissions as given in svcCreateMemoryMirror, otherwise error.

== svcUnmapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must match size given in map syscall, otherwise there's an invalid-size error.

== svcCreateInterruptEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || IrqNum
|-
| (In) W2 || bool || Flags
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<ReadableEvent> || ReadableEventHandle
|}
</div>

Create an event handle for the given IRQ number. Waiting on this handle will wait until the IRQ is triggered. The flags argument configures the triggering. If it is false, the IRQ is active HIGH level sensitive, if it is true it is rising-edge sensitive.

=== Result codes ===

'''0x0:''' Success.

'''0xF001:''' Flags was > 1

'''0xF201:''' IRQ above 0x3FF or outside the [[NPDM#Kernel_Access_Control|IRQ access mask]] was given.

'''0xCE01:''' A SlabHeap was exhausted (too many interrupts created).

'''0xF401:''' IRQ already has an event registered.

'''0xD201:''' The handle table is full. Try closing some handles.

== svcQueryPhysicalAddress ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || Addr
|-
| (Out) W0 || [[#Result]]|| Ret
|-
| (Out) X1 || u64 || PhysAddr
|-
| (Out) X2 || u64 || KernelAddr
|-
| (Out) X3 || u64 || Size
|}
</div>

== svcQueryIoMapping ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || PhysAddr
|-
| (In) X2 || R0 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) X1 || R1 || void* || VirtAddr
|}
</div>

'''Description:''' Returns a virtual address mapped to a given IO range.

== svcCreateDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || StartAddr
|-
| (In) X2 || R0, R1 || u64 || EndAddr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || Handle<DeviceAddressSpace> || AddressSpaceHandle
|}
</div>

'''Description:''' Creates a virtual address space for binding device address spaces and returns a handle.

dev_as_start_addr is normally set to 0 and dev_as_end_addr is normally set to 0xFFFFFFFF.

== svcAttachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Attaches a device address space to a [[#DeviceName|device]].

== svcDetachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Detaches a device address space from a [[#DeviceName|device]].

== svcMapDeviceAddressSpaceByForce ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (In) W5 || R7 || [[#Permission]] || Permissions
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

dev_map_addr is the userspace destination address, while dev_as_addr is the source address between dev_as_start_addr and dev_as_end_addr (passed to [[#svcCreateDeviceAddressSpace]]).

The userspace destination address must have the [[SVC#MemoryState|MapDeviceAllowed]] bit set. Bit [[SVC#MemoryAttribute|IsDeviceMapped]] will be set after mapping.

== svcMapDeviceAddressSpaceAligned ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (In) W5 || R7 || [[#Permission]] || Permissions
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

Same as [[#svcMapDeviceAddressSpaceByForce]], but the userspace destination address must have the [[SVC#MemoryState|MapDeviceAlignedAllowed]] bit set instead.

== svcUnmapDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps an attached device address space from an userspace address.

== svcContinueDebugEvent ==

=== Result codes ===

'''0x0:''' Success. The process has been resumed.

'''0xe401:''' Invalid debug handle.

'''0xf401:''' Process has debug events queued or is already running.

== svcGetSystemInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Zero || 0 || 0 || TotalMemorySize_Application
|-
| Zero || 0 || 1 || TotalMemorySize_Applet
|-
| Zero || 0 || 2 || TotalMemorySize_System
|-
| Zero || 0 || 3 || TotalMemorySize_SystemUnsafe
|-
| Zero || 1 || 0 || CurrentMemorySize_Application
|-
| Zero || 1 || 1 || CurrentMemorySize_Applet
|-
| Zero || 1 || 2 || CurrentMemorySize_System
|-
| Zero || 1 || 3 || CurrentMemorySize_SystemUnsafe
|-
| Zero || 2 || 0 || PrivilegedProcessId_LowerBound
|-
| Zero || 2 || 1 || PrivilegedProcessId_UpperBound
|-
|}

== svcSetProcessMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || Addr
|-
| (In) X2 || R1, R4 || u64 || Size
|-
| (In) W3 || R5 || void* || Perm
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

This sets the memory permissions for the specified memory with the supplied process handle.

This throws an error(0xD801) when the input perm is >0x5, hence -WX and RWX are not allowed.

== svcMapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || u64 || DstAddr
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Maps the src address from the supplied process handle into the current process.

This allows mapping code and rodata with RW- permission.

== svcUnmapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || void* || DstAddr
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || u64 || SrcAddr
|-
| (In) X3 || R4 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessMemory]].

== svcQueryProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || [[#MemoryInfo]]* || MemInfoPtr
|-
| (In) W2 || R2 || Handle<Process> || ProcessHandle
|-
| (In) X3 || R1, R3 || u64 || Addr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || PageInfo || PageInfo
|}
</div>

Equivalent to [[#svcQueryMemory]] except takes a process handle.

== svcMapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || DstAddr
|-
| (In) X2 || R1, R4 || u64 || SrcAddr
|-
| (In) X3 || R5, R6 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Takes a process handle, and maps normal heap in that process as executable code in that process. Used when loading NROs. This does not support using the current-process handle alias.

== svcUnmapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || DstAddr
|-
| (In) X2 || R1, R4 || u64 || SrcAddr
|-
| (In) X3 || R5, R6 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessCodeMemory]].

== svcCreateProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#CreateProcessInfo]]* || InfoPtr
|-
| (In) X2 || u32* || CapabilitiesPtr
|-
| (In) X3 || u64 || CapabilitiesNum
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Process> || ProcessHandle
|}
</div>

Takes a [[#CreateProcessInfo]] as input.
CapabilitiesPtr points to an array of [[NPDM#Kernel_Access_Control|kernel capabilities]].
CapabilitiesNum is a number of capabilities in the CapabilitiesPtr array (number of element, not number of bytes).

=== Result codes ===

'''0x0:''' Success.

'''0xCA01:''' Attempted to map more code pages than available in address space.

'''0xCC01:''' Provided CodeAddr is invalid (make sure it's in range?)

'''0xE401:''' The resource handle passed is invalid.

'''0xE601:''' Attempt to copy procinfo from user-supplied pointer failed. Attempt to copy capabilities_num from user-supplied pointer failed.

'''0xE801:''' Attempted to create a 32-bit process with a 36-bit address space.

'''0xF001:''' Unused bits are set in mmuflags. Unknown address space type used.

== svcGetProcessInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R1 || Handle<Process> || ProcessHandle
|-
| (In) W1 || R2 || [[#ProcessInfoType]] || InfoType
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) X1 || R1, R2 || [[#ProcessState]] || State
|}
</div>

Returns an enum with value 0-7.

== svcCallSecureMonitor ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || u64 || [[SMC#ID_0|Function ID]]
|-
| (In) X1-X7 || R1-R3 || u64 || SMC sub-arguments
|-
| (Out) X0 || R0 || [[SMC#Errors|SMC Result]] || Result of SMC
|-
| (Out) X1-X7 || R1-R3 || u64 || SMC sub-output
|}
</div>

Takes in a SMC function ID in X0, and arguments for that SMC function in X1-X7.

Passing an invalid SMC function ID or calling from a core other than core 3 will result in a secure monitor panic.

The kernel parses bits 9-15 in the passed SMC function ID (per the ARM SMC calling convention), and when set uses as an indicator to translate a pointer in the associated register (X1-X7) to a physical address. The kernel will translate any address mapped as R-W, other addresses (R--, R-X, or invalid pointers) will be translated as 0/NULL.

Output is returned raw from the Secure Monitor; X0 will be the untranslated SMC result and X1-X7 will contain other SMC output (or be unchanged, depending on the SMC).

== Debugging ==
[2.0.0+] Exactly 6 debug SVCs require that [[SPL_services#GetConfig|IsDebugMode]] is non-zero. Error 0x4201 is returned otherwise.
* svcBreakDebugProcess
* svcContinueDebugEvent
* svcWriteDebugProcessMemory
* svcSetDebugThreadContext
* svcTerminateDebugProcess
* svcSetHardwareBreakPoint

svcDebugActiveProcess stops execution of the target process, the normal method for resuming it requires svcContinueDebugEvent(see above). Closing the debug handle also results in execution being resumed.

== svcSetHardwareBreakPoint ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || u32 || hardware_breakpoint_id
|-
| (In) X1 || R2, R3 || u64 || flags
|-
| (In) X2 || R1, R4 || u64 || value
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Sets one of the AArch64 hardware breakpoints. The nintendo switch has 6 hardware breakpoints, and 4 hardware watchpoints. The syscall has two behaviors depending on the value of hardware_breakpoint_id:

If hardware_breakpoint_id < 0x10, then it sets one of the AArch64 hardware breakpoints. Flags will go to DBGBCRn_EL1, and value to DBGBVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0x7F01E1. Furthermore, the kernel will or it with 0x4004, in order to set various security flags to guarantee the watchpoints only triggers for code in EL0. If the user asks for a Breakpoint Type of ContextIDR match, the kernel shall use the given debug_handle to set DBGBVRn_EL1 to the ContextID of the debugged process.

If hardware_breakpoint_id is between 0x10 and 0x20 (exclusive), then it sets one of the AArch64 hardware watchpoints. Flags will go to DBGWCRn_EL1, and the value to DBGWVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0xFF0F1FF9. Furthermore, the kernel will or it with 0x104004. This will set various security flags, and set the watchpoint type to be a Linked Watchpoint. This means that you need to link it to a Linked ContextIDR breakpoint. Check the ARM documentation for more information.

Note that hardware_breakpoint_id 0 to 4 match only to Virtual Address, while hardware_breakpoint_id 5 and 6 match against either Virtual Address, ContextID, or VMID. As such, if you are configuring a breakpoint to link for a watchpoint, make sure you use hardware_breakpoint_id 5 or 6.

For more documentation for hardware breakpoints, check out the AArch64 documentation for the [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0488h/way1382455558968.html DBGBCRn_EL1 register] and the [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0488h/way1382455560629.html DBGWCRn_EL1 register]

= Enum/Structures =
== ThreadContextFlags ==
Bitfield of one of more of these:

{| class=wikitable
! Bit || Bitmask || Name || Description
|-
| 0 || 1 || General-purpose registers || If in 64-bit mode, GPRs 0–28 will be read/written. If in 32-bit mode, GPRs 0–12 will be read/written.
|-
| 1 || 2 || Control registers || Reads/writes the FP, LR, PC, SP, PSTATE, and TPIDR registers.
|-
| 2 || 4 || Floating-point registers || Reads/writes the floating-point vector registers.
|-
| 3 || 8 || Floating-point control registers || Reads/writes the FPCR and FPSR registers.
|}

== DeviceName ==
{| class=wikitable
! Value || Name
|-
| 0 || DeviceName_AFI
|-
| 1 || DeviceName_AVPC
|-
| 2 || DeviceName_DC
|-
| 3 || DeviceName_DCB
|-
| 4 || DeviceName_HC
|-
| 5 || DeviceName_HDA
|-
| 6 || DeviceName_ISP2
|-
| 7 || DeviceName_MSENCNVENC
|-
| 8 || DeviceName_NV
|-
| 9 || DeviceName_NV2
|-
| 10 || DeviceName_PPCS
|-
| 11 || DeviceName_SATA
|-
| 12 || DeviceName_VI
|-
| 13 || DeviceName_VIC
|-
| 14 || DeviceName_XUSB_HOST
|-
| 15 || DeviceName_XUSB_DEV
|-
| 16 || DeviceName_TSEC
|-
| 17 || DeviceName_PPCS1
|-
| 18 || DeviceName_DC1
|-
| 19 || DeviceName_SDMMC1A
|-
| 20 || DeviceName_SDMMC2A
|-
| 21 || DeviceName_SDMMC3A
|-
| 22 || DeviceName_SDMMC4A
|-
| 23 || DeviceName_ISP2B
|-
| 24 || DeviceName_GPU
|-
| 25 || DeviceName_GPUB
|-
| 26 || DeviceName_PPCS2
|-
| 27 || DeviceName_NVDEC
|-
| 28 || DeviceName_APE
|-
| 29 || DeviceName_SE
|-
| 30 || DeviceName_NVJPG
|-
| 31 || DeviceName_HC1
|-
| 32 || DeviceName_SE1
|-
| 33 || DeviceName_AXIAP
|-
| 34 || DeviceName_ETR
|-
| 35 || DeviceName_TSECB
|-
| 36 || DeviceName_TSEC1
|-
| 37 || DeviceName_TSECB1
|-
| 38 || DeviceName_NVDEC1
|}

== CodeMemoryOperation ==
{| class=wikitable
! Value || Name
|-
| 0 || CodeMemoryOperation_MapOwner
|-
| 1 || CodeMemoryOperation_MapSlave
|-
| 2 || CodeMemoryOperation_UnmapOwner
|-
| 3 || CodeMemoryOperation_UnmapSlave
|}

== LimitableResource ==
{| class=wikitable
! Value || Name || Note
|-
| 0 || LimitableResource_Memory || Bytes of memory a process may allocate.
|-
| 1 || LimitableResource_Threads || Amount of threads a process can create.
|-
| 2 || LimitableResource_Events || Amount of events a process can create through svcCreateEvent or svcSendAsyncRequestWithUserBuffer.
|-
| 3 || LimitableResource_TransferMemories || Amount of TransferMemory a process can create through svcCreateTransferMemory.
|-
| 4 || LimitableResource_Sessions || Amount of session a process can create through svcCreateSession, svcConnectToPort or svcConnectToNamedPort.
|}

== ProcessInfoType ==

{| class=wikitable
! Value || Name
|-
| 0 || [[#ProcessState|ProcessInfoType_ProcessState]]
|-
|}

== ProcessState ==
{| class=wikitable
! Value || Name || Notes
|-
| 0 || ProcessState_Created ||
|-
| 1 || ProcessState_CreatedAttached ||
|-
| 2 || ProcessState_Started ||
|-
| 3 || ProcessState_Crashed || Processes will not enter this state unless they were created with [[#CreateProcessInfo|EnableDebug]].
|-
| 4 || ProcessState_StartedAttached ||
|-
| 5 || ProcessState_Exiting ||
|-
| 6 || ProcessState_Exited ||
|-
| 7 || ProcessState_DebugSuspended ||
|}

== DebugThreadParam ==
{| class=wikitable
! Value || Name
|-
| 0 || DebugThreadParam_DynamicPriority
|-
| 1 || DebugThreadParam_SchedulingStatus
|-
| 2 || DebugThreadParam_PreferredCpuCore
|-
| 3 || DebugThreadParam_CurrentCpuCore
|-
| 4 || DebugThreadParam_AffinityMask
|}

Dynamic priority: output in out2

Scheduling status: out1 contains bit0: is debug-suspended, bit1: is user-suspended (svcSetThreadActivity 1 or svcSetProcessActivity 1).
Out2 contains {suspended, idle, running, terminating} => {5, 0, 1, 4}

DebugThreadParam_PreferredCpuCore: output in out2

DebugThreadParam_CurrentCpuCore: output in out2

DebugThreadParam_AffinityMask: output in out1

== CreateProcessInfo ==
{| class=wikitable
! Offset || Length || Bits || Description
|-
| 0 || 12 || || ProcessName (doesn't have to be null-terminated)
|-
| 0x0C || 4 || || ProcessCategory (0: regular title, 1: kernel built-in)
|-
| 0x10 || 8 || || TitleId
|-
| 0x18 || 8 || || CodeAddr
|-
| 0x20 || 4 || || CodeNumPages
|-
| 0x24 || 4 || || Flags
|-
| || || Bit0 || IsAarch64
|-
| || || Bit3-1 || [[#AddressSpaceType]]
|-
| || || Bit4 || [2.0.0+] EnableDebug
|-
| || || Bit5 || EnableAslr
|-
| || || Bit6 || IsApplication
|-
| || || Bit7 || [4.0.0] UseSecureMemory
|-
| || || Bit10-7 || [5.0.0+] PoolPartition (0=Application, 1=Applet, 2=Sysmodule, 3=Nvservices)
|-
| || || Bit11 || [7.0.0+] OptimizeMemoryAllocation (Only allowed in combination with IsApplication).
|-
| 0x28 || 4 || || ResourceLimitHandle or zero
|-
| 0x2C || 4 || || [3.0.0+] SystemResourceNumPages
|}

On [1.0.0] there's only one pool.

On [2.0.0-4.0.0] PoolPartition is 1 for built-ins and 0 for rest.

On [5.0.0] PoolPartition is specified in CreateProcessArgs. There are now 4 pool partitions.

On [5.0.0] (maybe lower?) a zero ResourceLimitHandle defaults to sysmodule limits and 0x12300000 bytes of memory.

The PersonalMmHeap are allocated as follows:
* For the application, normal insecure pool is used. Carveout 5 is used to provide protection.
* For the applet, a pre-allocated secure pool segment of size 0x400000 is used.
* For sysmodules, secure pool is allocated.

=== AddressSpaceType ===
{| class=wikitable
! Type || Name || Width || Description
|-
| 0 || Normal_32Bit || 32 ||
|-
| 1 || Normal_36Bit || 36 ||
|-
| 2 || WithoutMap_32Bit || 32 || Appears to be missing map region [?]
|-
| 3 || [2.0.0+] Normal_39Bit || 39 ||
|}

== MemoryInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || 8 || BaseAddress
|-
| 8 || 8 || Size
|-
| 0x10 || 4 || MemoryType: lower 8 bits of [[#MemoryState]]
|-
| 0x14 || 4 || [[#MemoryAttribute]]
|-
| 0x18 || 4 || Permission (bit0: R, bit1: W, bit2: X)
|-
| 0x1C || 4 || IpcRefCount
|-
| 0x20 || 4 || DeviceRefCount
|-
| 0x24 || 4 || Padding: always zero
|}

== MemoryAttribute ==
{| class=wikitable
! Bits || Name || Description
|-
| 0 || IsBorrowed || Used by MapMemory, as an async IPC user buffer,
|-
| 1 || IsIpcLocked || True when IpcRefCount > 0
|-
| 2 || IsDeviceShared || True when DeviceRefCount > 0
|-
| 3 || IsUncached ||
|}

== MemoryState ==
{| class=wikitable
! Bits || Description || Meaning
|-
| 7-0 || Type ||
|-
| 8 || [[#svcSetMemoryPermission|PermissionChangeAllowed]] ||
|-
| 9 || ForceReadWritableByDebugSyscalls || Allows using [[#svcWriteDebugProcessMemory]] on segments mapped read-only.
|-
| 10 || IpcSendAllowed || Allows sending this region as an IPC A/B/W buffer with flags=0.
|-
| 11 || NonDeviceIpcSendAllowed || Allows sending this region as an IPC A/B/W buffer with flags=1.
|-
| 12 || NonSecureIpcSendAllowed || Allows sending this region as an IPC A/B/W buffer with flags=3.
|-
| 14 || [[#svcSetProcessMemoryPermission|ProcessPermissionChangeAllowed]] ||
|-
| 15 || [[#svcMapMemory|MapAllowed]] ||
|-
| 16 || [[#svcUnmapProcessCodeMemory|UnmapProcessCodeMemoryAllowed]] ||
|-
| 17 || [[#svcCreateTransferMemory|TransferMemoryAllowed]] ||
|-
| 18 || [[#svcQueryPhysicalAddress|QueryPhysicalAddressAllowed]] ||
|-
| 19 || MapDeviceAllowed ([[#svcMapDeviceAddressSpace]] and [[#svcMapDeviceAddressSpaceByForce]]) ||
|-
| 20 || [[#svcMapDeviceAddressSpaceAligned|MapDeviceAlignedAllowed]] ||
|-
| 21 || [[#svcSendSyncRequestWithUserBuffer|IpcBufferAllowed]] ||
|-
| 22 || IsPoolAllocated/IsReferenceCounted || The physical memory blocks backing this region are refcounted.
|-
| 23 || [[#svcMapProcessMemory|MapProcessAllowed]] ||
|-
| 24 || [[#svcSetMemoryAttribute|AttributeChangeAllowed]] ||
|-
| 25 || [4.0.0+] [[#svcCreateCodeMemory|CodeMemoryAllowed]] ||
|}

{| class=wikitable
! Value || Type || Meaning
|-
| 0x00000000 || MemoryType_Unmapped ||
|-
| 0x00002001 || MemoryType_Io || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00042002 || MemoryType_Normal || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00DC7E03 || MemoryType_CodeStatic || Mapped during [[#svcCreateProcess]].
|-
| [1.0.0+]

0x01FEBD04

[4.0.0+]

0x03FEBD04
|| MemoryType_CodeMutable || Transition from 0xDC7E03 performed by [[#svcSetProcessMemoryPermission]].
|-
| [1.0.0+]
0x017EBD05

[4.0.0+]

0x037EBD05
|| MemoryType_Heap || Mapped using [[#svcSetHeapSize]].
|-
| 0x00402006 || MemoryType_SharedMemory || Mapped using [[#svcMapSharedMemory]].
|-
| 0x00482907 || [1.0.0] MemoryType_Alias || Mapped using [[#svcMapMemory]].
|-
| 0x00DD7E08 || MemoryType_ModuleCodeStatic || Mapped using [[#svcMapProcessCodeMemory]].
|-
| [1.0.0+]

0x01FFBD09

[4.0.0+]

0x03FFBD09
|| MemoryType_ModuleCodeMutable || Transition from 0xDD7E08 performed by [[#svcSetProcessMemoryPermission]].
|-
| 0x005C3C0A || [[IPC_Marshalling|MemoryType_Ipc]] || IPC buffers with descriptor flags=0.
|-
| 0x005C3C0B || MemoryType_Stack || Mapped using [[#svcMapMemory]].
|-
| 0x0040200C || [[Thread Local Storage|MemoryType_ThreadLocal]] || Mapped during [[#svcCreateThread]].
|-
| 0x015C3C0D || MemoryType_TransferMemoryIsolated || Mapped using [[#svcMapTransferMemory]] when the owning process has perm=0.
|-
| 0x005C380E || MemoryType_TransferMemory || Mapped using [[#svcMapTransferMemory]] when the owning process has perm!=0.
|-
| 0x0040380F || MemoryType_ProcessMemory || Mapped using [[#svcMapProcessMemory]].
|-
| 0x00000010 || MemoryType_Reserved ||
|-
| 0x005C3811 || [[IPC_Marshalling|MemoryType_NonSecureIpc]] || IPC buffers with descriptor flags=1.
|-
| 0x004C2812 || [[IPC_Marshalling|MemoryType_NonDeviceIpc]] || IPC buffers with descriptor flags=3.
|-
| 0x00002013 || MemoryType_KernelStack || Mapped in kernel during [[#svcCreateThread]].
|-
| 0x00402214 || [4.0.0+] MemoryType_CodeReadOnly || Mapped in kernel during [[#svcControlCodeMemory]].
|-
| 0x00402015 || [4.0.0+] MemoryType_CodeWritable || Mapped in kernel during [[#svcControlCodeMemory]].
|}

== ArbitrationType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || WaitIfLessThan
|-
| 0x1 || DecrementAndWaitIfLessThan
|-
| 0x2 || WaitIfEqual
|-
|}

== SignalType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || Signal
|-
| 0x1 || SignalAndIncrementIfEqual
|-
| 0x2 || SignalAndModifyBasedOnWaitingThreadCountIfEqual
|-
|}

== ContinueDebugFlagsOld ==
[1.0.0-2.3.0]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: ResumeAllThreads or debug-suspended-thread-id needed)
|-
| 1 || 2 || SwallowException
|-
| 2 || 4 || ResumeAllThreads
|}

== ContinueDebugFlags ==
[3.0.0+]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: doesn't need to be set in the same call than Resume)
|-
| 1 || 2 || DontCatchExceptions
|-
| 2 || 4 || Resume
|-
| 3 || 8 || IgnoreOtherThreadsExceptions
|}

IgnoreExceptionsOfOthers is like IgnoreException but acts on all threads that aren't in the input list. The affected threads are resumed.

Only one of of Resume and IgnoreOtherThreadsExceptions can be set at a time.

If the input number of threads is 0, this means "all threads".

== DebugEventInfo ==

The below table is for the Aarch64 version of the system call. For A32, all u64 fields but title/process/thread id are actually u32, making the structure 0x28-byte-big (0x40 for a64).

Size: 0x40

{| class=wikitable
! Offset || Length || Description
|-
| 0 || u32 || EventType
|-
| 4 || u32 || Flags (bit0: NeedsContinue)
|-
| 8 || u64 || ThreadId
|-
| 0x10 || || PerTypeSpecifics
|}

AttachProcess specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || TitleId
|-
| 0x18 || u64 || ProcessId
|-
| 0x20 || char[12] || ProcessName
|-
| 0x2C || u32 || MmuFlags
|-
| 0x30 || u64 || [5.0.0+] UserExceptionContextAddr
|}

AttachThread specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ThreadId
|-
| 0x18 || u64 || TlsPtr
|-
| 0x20 || u64 || Entrypoint
|}

Exit specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32|| Type (0=PausedThread, 1=RunningThread, 2=ExitedProcess, 3=TerminatedProcess)
|}

Exception specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32 || ExceptionType
|-
| 0x18 || u64 || FaultRegister
|-
| 0x20 || || PerExceptionSpecifics
|}

=== DebugEventType ===
{| class=wikitable
! Value || Name
|-
| 0 || DebugEvent_AttachProcess
|-
| 1 || DebugEvent_AttachThread
|-
| 2 || DebugEvent_ExitProcess
|-
| 3 || DebugEvent_ExitThread
|-
| 4 || DebugEvent_Exception
|}

=== DebugExceptionType ===
{| class=wikitable
! Value || Name
|-
| 0 || Exception_Trap (*)
|-
| 1 || Exception_InstructionAbort
|-
| 2 || Exception_DataAbortMisc (**)
|-
| 3 || Exception_PcSpAlignmentFault
|-
| 4 || Exception_DebuggerAttached
|-
| 5 || Exception_BreakPoint
|-
| 6 || Exception_UserBreak
|-
| 7 || Exception_DebuggerBreak
|-
| 8 || Exception_BadSvcId
|-
| 9 || Exception_SError [not in 1.0.0]
|}

<nowiki>*</nowiki> Undefined instructions, software breakpoints, some other traps.

<nowiki>**</nowiki> Data aborts, FP traps, and everything else that doesn't belong to any of the above.

Trap specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Opcode
|}

BreakPoint specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || IsWatchpoint
|}

UserBreak specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Info0
|-
| 0x28 || u64 || Info1
|-
| 0x30 || u64 || Info2
|}

BadSvcId specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || SvcId
|}

= Exception handling =
First of all, a function that might be called by synchronous exception handler and that is called by the SError handler fetches the exception info, adjusts PC, panics on exceptions taken from EL1, then dispatches the exception.

The dispatcher has two mutually exclusive exception reporting methods:
* by storing information at the start of the process's TLS memregion (TPIDRRO_EL0) and jumping back to the crt0
* by using KDebug

KDebug dispatching is used when at least one of the following conditions are met:
* SMC ConfigItem KernelMemConfig bit 1 is NOT set (it isn't on retail), unless: this is a software or hardware breakpoint, or a watchpoint, or [4.0.0+?] the process is attached and this is a Google PNaCl trap instruction (see LLVM source)
* FAR doesn't point to a valid address in mapped-readable CodeStatic memory (i.e. this is the case for NRO and JIT memory) or this is one of the following exceptions (it particular, that doesn't include FP exceptions occurring in CodeStatic memory):
** Uncategorized
** IllegalState
** SupervisorCallA32
** SupervisorCallA64
** PCAlignment
** SPAlignment
** SError
** BreakpointLowerEl
** SoftwareStepLowerEl (note: no way set single-step flag; not parsed)
** WatchpointLowerEl
** SoftwareBreakpointA32 (note: not parsed)
** SoftwareBreakpointA64 (note: not parsed)

In all other cases the userland-handled exception path is taken.

KDebug path:

If the process is attached, the exception is reported to the KDebug. If the thread was continued using flag IgnoreExceptions, it returns from the exception as if nothing happened.

If the latter is not the case, or if the process isn't attached, proceed to [2.0.0+] crash reporting (or in [1.0.0] just terminate the process):
if EnableDebug is set, and depending on the process state (more than one crash per process isn't permitted) it may signal itself with ProcessState_Crashed so that PM asks NS to start creport so that creport attaches to it and reports the crashes. Otherwise, just terminate.

Userland reporting path and svcReturnFromException:

TLS region start (A64):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x148 || Exception stack
|-
| 0x148 || 0x78 || ExceptionFrameA64
|}

ExceptionFrameA64:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x48 (8*9) || GPRs 0..8.
|-
| 0x48 || 0x8 || lr
|-
| 0x50 || 0x8 || sp
|-
| 0x58 || 0x8 || pc (elr_el1)
|-
| 0x60 || 0x4 || pstate & 0xFF0FFE20
|-
| 0x64 || 0x4 || afsr0
|-
| 0x68 || 0x4 || afsr1
|-
| 0x6C || 0x4 || esr
|-
| 0x70 || 0x8 || far
|}

TLS region start (A32):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x178 || Exception stack
|-
| 0x148 || 0x44 || ExceptionFrameA32
|}

ExceptionFrameA32:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x20 (8*4) || GPRs 0..7.
|-
| 0x20 || 0x4 || sp
|-
| 0x24 || 0x4 || lr
|-
| 0x28 || 0x4 || pc (elr_el1)
|-
| 0x2C || 0x4 || tpidr_el0 = 1
|-
| 0x30 || 0x4 || cpsr & 0xFF0FFE20
|-
| 0x34 || 0x4 || afsr0
|-
| 0x38 || 0x4 || afsr1
|-
| 0x3C || 0x4 || esr
|-
| 0x40 || 0x4 || far
|}

In that case, after storing the regs in the TLS, the exception handler returns to the application's crt0 (entrypoint), with X0=<error description code> (see below) and X1=SP=frame=<stack top> (see above)

{| class=wikitable
! Desc. code || Meaning
|-
| 0x100 || Instruction abort
|-
| 0x102 || Misaligned PC
|-
| 0x103 || Misaligned SP
|-
| 0x106 || SError [not in 1.0.0?]
|-
| 0x301 || Bad SVC
|-
| 0x104 || Uncategorized, CP15RTTrap, CP15RRTTrap, CP14RTTrap, CP14RRTTrap, IllegalState, SystemRegisterTrap
|-
| 0x101 || None of the above, EC <= 0x34 and not a breakpoint
|-
|}

(During normal app boot the process is invoked with X0=0 and X1=main_thread_handle. The crt0 of retail apps determines whether to boot normally or handle an exception if X0 is set to 0 or not)

The application is supposed to promptly update the contents of elr_el1 to a user handler (and any other regs it sees fit) and call svcReturnFromException (error code) to call that handler. The latter is then expected to promptly abort the program.

svcReturnFromException updates the contents of the kernel stack frame with what the user provided in the TLS structure, sets TPIDR_EL0 to 1, then:
* if the provided error code is 0, gracefully pivots and returns from exception
* if it is not, replays the exception and pass it to the KDebug (see above). One can pass 0x10001 to prevent process termination. If the process is attached, this also prevents crash-collection/termination (different from the exception handler behavior)

If an exception occurs from the above user handler, the entire exception handling process will repeat with the new exception.

Note that if a thread that wasn't faulting calls svcReturnFromException, it signals an "invalid syscall" exception

Note that [[SMC|IsDebugMode]] is not used during exception-handling, except for enabling printing a message to UART-A. This UART code causes a system-hang on retail (likely due to a loop that doesn't exit). This printing doesn't seem to run when the process is attached for debugging?

SVC

2019-02-05T09:13:22Z

Qlutoo: /* CreateProcessInfo */

__NOTOC__

= System calls =
{| class=wikitable
! Id || Name || In || Out
|-
| 0x1 || [[#svcSetHeapSize]] || W1=size || W0=result, X1=outaddr
|-
| 0x2 || [[#svcSetMemoryPermission]] || X0=addr, X1=size, W2=prot || W0=result
|-
| 0x3 || [[#svcSetMemoryAttribute]] || X0=addr, X1=size, W2=state0, W3=state1 || W0=result
|-
| 0x4 || [[#svcMapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x5 || [[#svcUnmapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x6 || [[#svcQueryMemory]] || X0=MemoryInfo*, X2=addr || W0=result, W1=PageInfo
|-
| 0x7 || [[#svcExitProcess]] || None ||
|-
| 0x8 || [[#svcCreateThread]] || X1=entry, X2=thread_context, X3=stacktop, W4=prio, W5=processor_id || W0=result, W1=handle
|-
| 0x9 || [[#svcStartThread]] || W0=thread_handle || W0=result
|-
| 0xA || [[#svcExitThread]] || None ||
|-
| 0xB || [[#svcSleepThread]] || X0=nano ||
|-
| 0xC || [[#svcGetThreadPriority]] || W1=thread_handle || W0=result, W1=prio
|-
| 0xD || [[#svcSetThreadPriority]] || W0=thread_handle, W1=prio || W0=result
|-
| 0xE || [[#svcGetThreadCoreMask]] || W2=thread_handle || W0=result, W1=out, X2=out
|-
| 0xF || [[#svcSetThreadCoreMask]] || W0=thread_handle, W1=in, X2=in2 || W0=result
|-
| 0x10 || [[#svcGetCurrentProcessorNumber]] || None || W0/X0=cpuid
|-
| 0x11 || svcSignalEvent || W0=wevent_handle || W0=result
|-
| 0x12 || svcClearEvent || W0=wevent_or_revent_handle || W0=result
|-
| 0x13 || [[#svcMapSharedMemory]] || W0=shmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x14 || svcUnmapSharedMemory || W0=shmem_handle, X1=addr, X2=size || W0=result
|-
| 0x15 || [[#svcCreateTransferMemory]] || X1=addr, X2=size, W3=perm || W0=result, W1=tmem_handle
|-
| 0x16 || svcCloseHandle || W0=handle || W0=result
|-
| 0x17 || svcResetSignal || W0=revent_or_process_handle || W0=result
|-
| 0x18 || [[#svcWaitSynchronization]] || X1=handles_ptr, W2=num_handles. X3=timeout || W0=result, W1=handle_idx
|-
| 0x19 || [[#svcCancelSynchronization]] || W0=thread_handle || W0=result
|-
| 0x1A || svcArbitrateLock || W0=cur_thread_handle, X1=ptr, W2=req_thread_handle ||
|-
| 0x1B || svcArbitrateUnlock || X0=ptr ||
|-
| 0x1C || svcWaitProcessWideKeyAtomic || X0=ptr0, X1=ptr, W2=thread_handle, X3=timeout || W0=result
|-
| 0x1D || svcSignalProcessWideKey || X0=ptr, W1=value || W0=result
|-
| 0x1E || [[#svcGetSystemTick]] || None || X0={value of cntpct_el0}
|-
| 0x1F || svcConnectToNamedPort || X1=port_name_str || W0=result, W1=handle
|-
| 0x20 || svcSendSyncRequestLight || W0=light_session_handle, X1=? || W0=result
|-
| 0x21 || svcSendSyncRequest || X0=normal_session_handle || W0=result
|-
| 0x22 || [[#svcSendSyncRequestWithUserBuffer]] || X0=cmdbufptr, X1=size, X2=handle || W0=result
|-
| 0x23 || svcSendAsyncRequestWithUserBuffer || X1=cmdbufptr, X2=size, X3=handle || W0=result, W1=revent_handle
|-
| 0x24 || svcGetProcessId || W1=thread_or_process_or_debug_handle || W0=result, X1=pid
|-
| 0x25 || svcGetThreadId || W1=thread_handle || W0=result, X1=out
|-
| 0x26 || [[#svcBreak]] || X0=break_reason,X1,X2=info || W0=result = 0
|-
| 0x27 || svcOutputDebugString || X0=str, X1=size || W0=result
|-
| 0x28 || svcReturnFromException || X0=result ||
|-
| 0x29 || [[#svcGetInfo]] || X1=info_id, X2=handle, X3=info_sub_id || W0=result, X1=out
|-
| 0x2A || svcFlushEntireDataCache || None || None
|-
| 0x2B || svcFlushDataCache || X0=addr, X1=size || W0=result
|-
| 0x2C || [3.0.0+] [[#svcMapPhysicalMemory]] || X0=addr, X1=size || W0=result
|-
| 0x2D || [3.0.0+] svcUnmapPhysicalMemory || X0=addr, X1=size || W0=result
|-
| 0x2E || [5.0.0+] svcGetFutureThreadInfo || X3=timeout || W0=result, bunch of crap
|-
| 0x2F || svcGetLastThreadInfo || None || W0=result, W1,W2,W3,W4=unk, W5=truncated_u64, W6=bool
|-
| 0x30 || svcGetResourceLimitLimitValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
|-
| 0x31 || svcGetResourceLimitCurrentValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
|-
| 0x32 || svcSetThreadActivity || W0=thread_handle, W1=bool || W0=result
|-
| 0x33 || svcGetThreadContext3 || X0=[[#ThreadContext]]*, W1=thread_handle || W0=result
|-
| 0x34 || [4.0.0+] svcWaitForAddress || X0=ptr, W1=[[#ArbitrationType]], X2=value X3=timeout ||
|-
| 0x35 || [4.0.0+] svcSignalToAddress || X0=ptr, W1=[[#SignalType]], X2=value W3=num_to_signal ||
|- style="border-top: double"
| 0x3C || [[#svcDumpInfo]] || ||
|-
| 0x3D || [4.0.0+] svcDumpInfoNew || ||
|- style="border-top: double"
| 0x40 || svcCreateSession || W2=is_light, X3=? || W0=result, W1=server_handle, W2=client_handle
|-
| 0x41 || [[#svcAcceptSession]] || W1=port_handle || W0=result, W1=session_handle
|-
| 0x42 || svcReplyAndReceiveLight || W0=light_session_handle || W0=result, W1,W2,W3,W4,W5,W6,W7=out
|-
| 0x43 || [[#svcReplyAndReceive]] || X1=ptr_handles, W2=num_handles, X3=replytarget_handle(0=none), X4=timeout || W0=result, W1=handle_idx
|-
| 0x44 || svcReplyAndReceiveWithUserBuffer|| X1=buf, X2=sz, X3=ptr_handles, W4=num_handles, X5=replytarget_handle(0=none), X6=timeout || W0=result, W1=handle_idx
|-
| 0x45 || svcCreateEvent || None || W0=result, W1=wevent_handle, W2=revent_handle
|- style="border-top: double"
| 0x48 || [5.0.0+] [[#svcMapPhysicalMemoryUnsafe]] || X0=addr, X1=size || W0=result
|-
| 0x49 || [5.0.0+] svcUnmapPhysicalMemoryUnsafe || X0=addr, X1=size || W0=result
|-
| 0x4A || [5.0.0+] svcSetUnsafeLimit || X0=size || W0=result
|-
| 0x4B || [4.0.0+] [[#svcCreateCodeMemory]] || X1=addr, X2=size || W0=result, W1=code_memory_handle
|-
| 0x4C || [4.0.0+] [[#svcControlCodeMemory]] || W0=code_memory_handle, W1=[[#CodeMemoryOperation]], X2=dstaddr, X3=size, W4=perm || W0=result
|-
| 0x4D || svcSleepSystem || None || None
|-
| 0x4E || [[#svcReadWriteRegister]] || X1=reg_addr, W2=rw_mask, W3=in_val || W0=result, W1=out_val
|-
| 0x4F || svcSetProcessActivity || W0=process_handle, W1=bool || W0=result
|-
| 0x50 || [[#svcCreateSharedMemory]] || W1=size, W2=myperm, W3=otherperm || W0=result, W1=shmem_handle
|-
| 0x51 || [[#svcMapTransferMemory]] || X0=tmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x52 || [[#svcUnmapTransferMemory]] || W0=tmemhandle, X1=addr, X2=size || W0=result
|-
| 0x53 || [[#svcCreateInterruptEvent]] || X1=irq_num, W2=flag || W0=result, W1=handle
|-
| 0x54 || [[#svcQueryPhysicalAddress]] || X1=addr || W0=result, X1=physaddr, X2=kerneladdr, X3=size
|-
| 0x55 || [[#svcQueryIoMapping]] || X1=physaddr, X2=size || W0=result, X1=virtaddr
|-
| 0x56 || [[#svcCreateDeviceAddressSpace]] || X1=dev_as_start_addr, X2=dev_as_end_addr || W0=result, W1=dev_as_handle
|-
| 0x57 || [[#svcAttachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x58 || [[#svcDetachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x59 || [[#svcMapDeviceAddressSpaceByForce]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm || W0=result
|-
| 0x5A || [[#svcMapDeviceAddressSpaceAligned]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm || W0=result
|-
| 0x5B || svcMapDeviceAddressSpace || ||
|-
| 0x5C || [[#svcUnmapDeviceAddressSpace]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr || W0=result
|-
| 0x5D || svcInvalidateProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x5E || svcStoreProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x5F || svcFlushProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x60 || svcDebugActiveProcess || X1=pid || W0=result, W1=debug_handle
|-
| 0x61 || svcBreakDebugProcess || W0=debug_handle || W0=result
|-
| 0x62 || svcTerminateDebugProcess || W0=debug_handle || W0=result
|-
| 0x63 || svcGetDebugEvent || X0=[[#DebugEventInfo]]*, W1=debug_handle || W0=result
|-
| 0x64 || [[#svcContinueDebugEvent]] || [1.0.0-2.3.0] W0=debug_handle, W1=[[#ContinueDebugFlagsOld]], X2=thread_id
[3.0.0+] W0=debug_handle, W1=[[#ContinueDebugFlags]], X2=thread_id_list(u64 *), W3=num_tids (max 64, 0 means "all threads")
|| W0=result
|-
| 0x65 || svcGetProcessList || X1=pids_out_ptr, W2=max_out || W0=result, W1=num_out
|-
| 0x66 || svcGetThreadList || X1=tids_out_ptr, W2=max_out, W3=debug_handle_or_zero || W0=result, X1=num_out
|-
| 0x67 || svcGetDebugThreadContext || X0=ThreadContext*, X1=debug_handle, X2=thread_id, W3=[[#ThreadContextFlags]] || W0=result
|-
| 0x68 || svcSetDebugThreadContext || W0=debug_handle, X1=thread_id, X2=ThreadContext*, W3=[[#ThreadContextFlags]] || W0=result
|-
| 0x69 || svcQueryDebugProcessMemory || X0=[[#MemoryInfo]]*, X2=debug_handle, X3=addr || W0=result, W1=PageInfo
|-
| 0x6A || svcReadDebugProcessMemory || X0=buffer*, X1=debug_handle, X2=src_addr, X3=size || W0=result
|-
| 0x6B || svcWriteDebugProcessMemory || X0=debug_handle, X1=buffer*, X2=dst_addr, X3=size || W0=result
|-
| 0x6C || [[#svcSetHardwareBreakPoint]] || W0=HardwareBreakpointId, X1=watchpoint_flags/breakpoint_flags, X2=watchpoint_value/debug_handle ||
|-
| 0x6D || svcGetDebugThreadParam || X2=debug_handle, X3=thread_id, W4=[[#DebugThreadParam]] || W0=result, X1=out0, W2=out1
|- style="border-top: double"
| 0x6F || [5.0.0+] [[#svcGetSystemInfo]] || X1=info_id, X2=handle, X3=info_sub_id || W0=result, X1=out
|-
| 0x70 || svcCreatePort || W2=max_sessions, W3=is_light, X4=name_ptr || W0=result, W1=clientport_handle, W2=serverport_handle
|-
| 0x71 || svcManageNamedPort || X1=name_ptr, W2=max_sessions || W0=result, W1=serverport_handle
|-
| 0x72 || svcConnectToPort || W1=clientport_handle || W0=result, W1=session_handle
|-
| 0x73 || [[#svcSetProcessMemoryPermission]] || W0=process_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x74 || [[#svcMapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size || W0=result
|-
| 0x75 || [[#svcUnmapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size || W0=result
|-
| 0x76 || [[#svcQueryProcessMemory]] || X0=meminfo_ptr, W2=process_handle, X3=addr || W0=result, W1=pageinfo
|-
| 0x77 || [[#svcMapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x78 || [[#svcUnmapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x79 || [[#svcCreateProcess]] || X1=procinfo_ptr, X2=caps_ptr, W3=cap_num || W0=result, W1=process_handle
|-
| 0x7A || svcStartProcess || W0=process_handle, W1=main_thread_prio, W2=default_cpuid, W3=main_thread_stacksz || W0=result
|-
| 0x7B || svcTerminateProcess || W0=process_handle || W0=result
|-
| 0x7C || [[#svcGetProcessInfo]] || W0=process_handle, W1=[[#ProcessInfoType]] || W0=result, X1=[[#ProcessState]]
|-
| 0x7D || svcCreateResourceLimit || None || W0=result, W1=reslimit_handle
|-
| 0x7E || svcSetResourceLimitLimitValue || W0=reslimit_handle, W1=[[#LimitableResource]], X2=value || W0=result
|-
| 0x7F || svcCallSecureMonitor || X0=smc_sub_id, X1,X2,X3,X4,X5,X6,X7=smc_args || X0,X1,X2,X3,X4,X5,X6,X7=result
|}

== svcSetHeapSize ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || OutAddr
|}
</div>

'''Description:''' Set the process heap to a given Size. It can both extend and shrink the heap.

Size must be a multiple of 0x200000 (2MB).

On success, the heap base-address (which is fixed by kernel, aslr'd) is written to OutAddr.

Uses current process pool partition.

[2.0.0+] Size must be less than or equal to 4GB.

== svcSetMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || Prot
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change permission of page-aligned memory region.

Bit2 of permission (exec) is not allowed. Setting write-only is not allowed either (bit1).

This can be used to move back and forth between ---, r-- and rw-.

== svcSetMemoryAttribute ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || u32 || State0
|-
| (In) W3 || u32 || State1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change attribute of page-aligned memory region.

This is used to turn on/off caching for a given memory area. Useful when talking to devices such as the GPU.

What happens "under the hood" is the "Memory Attribute Indirection Register" index is changed from 2 to 3 in the MMU descriptor.

{| class=wikitable
! State0 || State1 || Action
|-
| 0 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 8 || Set bit3 in [[#MemoryAttribute]].
|}

== svcMapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps a memory range into a different range.

Mainly used for adding guard pages around stack.

Source range gets reprotected to --- (it can no longer be accessed), and bit0 is set in the source [[#MemoryAttribute]].

[1.0.0] This could be used to map into either the Alias Region or the Stack region.

[2.0.0+] This can only be used to map into the Stack region.

Code can get the range of the Alias region from [[#svcGetInfo]] id0=2,3, and on 2.0.0+ the range of the Stack region via [[#svcGetInfo]] id0=14, 15 (on 1.0.0, the Stack region had hardcoded limits).

When mapped into the Alias region, the mapped memory will have state 0x482907.

When mapped into the Stack region, the mapped memory will have state 0x5C3C0B.

== svcUnmapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps a region that was previously mapped with [[#svcMapMemory]].

It's possible to unmap ranges partially, you don't need to unmap the entire range "in one go".

The srcaddr/dstaddr must match what was given when the pages were originally mapped.

== svcQueryMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfo
|-
| (In) X2 || void* || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

'''Description:''' Query information about an address. Will always fetch the lowest page-aligned mapping that contains the provided address.

Outputs a [[#MemoryInfo]] struct.

== svcExitProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current process.

== svcCreateThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void(*)(void*) || Entry
|-
| (In) X2 || void* || ThreadContext
|-
| (In) X3 || void* || StackTop
|-
| (In) W4 || u32 || Priority
|-
| (In) W5 || u32 || ProcessorId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Thread> || Handle
|}
</div>

'''Description:''' Create a thread in the current process.

Processor_id must be 0,1,2,3 or -2, where -2 uses the default cpuid for process.

== svcStartThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) None || ||
|}
</div>

'''Description:''' Starts the thread for the provided handle.

== svcExitThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current thread.

== svcSleepThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || s64 || Nanoseconds
|-
|}
</div>

'''Description:''' Sleep for a specified amount of time, or yield thread.

Setting nanoseconds to 0, -1, or -2 indicates a yielding type.

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Value || Type
|-
| 0 || Yielding without core migration
|-
| -1 || Yielding with core migration
|-
| -2 || Yielding to any other thread
|-
|}
</div>

== svcGetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1|| Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || Priority
|}
</div>

'''Description:''' Get priority of provided thread handle.

== svcSetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0|| Handle<Thread> || Handle
|-
| (In) W1|| u32 || Priority
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set priority of provided thread handle.

Priority is a number 0-0x3F. Lower value means higher priority.

== svcGetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W2 || Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u32 || Out0
|-
| (Out) X2 || u64 || Out1
|}
</div>

'''Description:''' Get affinity mask of provided thread handle.

== svcSetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (In) W1 || u32 || In0
|-
| (In) X2 || u64 || In1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set affinity mask of provided thread handle.

== svcGetCurrentProcessorNumber ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0/X0 || u64 || CpuId
|}
</div>

'''Description:''' Get which cpu is executing the current thread.

Cpu-id is an integer in the range 0-3.

== svcMapSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<SharedMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the block supplied by the handle. The required permissions are different for the process that created the handle and all other processes.

Increases reference count for the KSharedMemory object. Thus in order to release the memory associated with the object, all handles to it must be closed and all mappings must be unmapped.

== svcCreateTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<TransferMemory> || Handle
|}
</div>

This one reprotects the src block with perms you give it. It also sets bit0 into [[#MemoryAttribute]].

Executable bit perm not allowed.

Closing all handles automatically causes the bit0 in [[#MemoryAttribute]] to clear, and the permission to reset.

== svcWaitSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || Handle* || HandlesPtr
|-
| (In) W2 || u64 || HandlesNum
|-
| (In) X3 || u64 || Timeout
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || HandleIndex
|}
</div>

Works with num_handles <= 0x40.

When zero handles are passed, this will wait forever until either timeout or cancellation occurs.

Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.

=== Object types ===

'''KDebug:''' signals when there is a new [[#DebugEventInfo|DebugEvent]] (retrievable via [[#svcGetDebugEvent]]).

'''KClientPort:''' signals when the number of sessions is less than the maximum allowed.

'''KProcess:''' signals when the process undergoes a state change (retrievable via [[#svcGetProcessInfo]]).

'''KReadableEvent:''' signals when the event's corresponding KWritableEvent has been signaled via svcSignalEvent.

'''KServerPort:''' signals when there is an incoming connection waiting to be [[#svcAcceptSession|accepted]].

'''KServerSession:''' signals when there is an incoming message waiting to be [[#svcReplyAndReceive|received]] or the pipe is closed.

'''KThread:''' signals when the thread has exited.

=== Result codes ===

'''0x0:''' Success. One of the objects was signaled before the timeout expired, or one of the objects is a Session with a closed remote. Handle index is updated to indicate which object signaled.

'''0x7601:''' Thread termination requested. Handle index is not updated.

'''0xe401:''' Invalid handle. Returned when one of the handles passed is invalid. Handle index is not updated.

'''0xe601:''' Invalid address. Returned when the handles pointer is not a readable address. Handle index is not updated.

'''0xea01:''' Timeout. Returned when no objects have been signaled within the timeout. Handle index is not updated.

'''0xec01:''' Interrupted. Returned when another thread uses [[#svcCancelSynchronization]] to cancel this thread. Handle index is not updated.

'''0xee01:''' Too many handles. Returned when the number of handles passed is > 0x40.

== svcCancelSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

If the referenced thread is currently in a synchronization call ([[#svcWaitSynchronization]], [[#svcReplyAndReceive]] or [[#svcReplyAndReceiveLight]]), that call will be interrupted and return 0xec01.
If that thread is not currently executing such a synchronization call, the next call to a synchronization call will return 0xec01.

This doesn't take force-pause (activity/debug pause) into account.

=== Result codes ===

'''0x0:''' Success. The thread was either interrupted or has had its flag set.

'''0xe401:''' Invalid handle. The handle given was either invalid or not a thread handle.

== svcGetSystemTick ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (Out) X0 || u64 || Ticks
|}
</div>

Returns the value of cntpct_el0.

The frequency is 19200000 Hz (constant from official sw).

Official sw reads cntpct_el0 directly from usermode without using this SVC. [[ExeFS|sdk-nso]] has this SVC, but it's not known to be called anywhere.

== svcSendSyncRequestWithUserBuffer ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || CmdPtr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || Handle<Session> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size and CmdPtr must be 0x1000-aligned.

=== Result codes ===

'''0x0:''' Success.

'''0xcc01:''' CmdPtr is not 0x1000-aligned.

'''0xca01:''' Size is not 0x1000-aligned.

'''0xce01:''' KSessionRequest allocation failed (unlikely) or pointer buffer size exceeded.

'''0xe401:''' Handles does not exist, or handle is not an instance of KClientSession.

== svcBreak ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || Break Reason
|-
| (In) X1 || u64 ||
|-
| (In) X2 || u64 || Info
|-
| (Out) W0 || Result || 0 (Success)
|}
</div>

If the process is attached, report the Break event. Then, if svcContinueDebugEvent didn't apply IgnoreException on the thread: if TPIDR_EL0 is 0, adjust ELR_EL1 to retry to svc instruction (and set TPIDR_EL0 to 1).

Otherwise, if bit31 in reason isn't set, perform crash reporting (see Exception Handling section below), if it doesn't terminate the process adjust ELR_EL1 as well.

Otherwise just return 0.

== svcGetInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Process || 0 || 0 || AllowedCpuIdBitmask
|-
| Process || 1 || 0 || AllowedThreadPrioBitmask
|-
| Process || 2 || 0 || AliasRegionBaseAddr
|-
| Process || 3 || 0 || AliasRegionSize
|-
| Process || 4 || 0 || HeapRegionBaseAddr
|-
| Process || 5 || 0 || HeapRegionSize
|-
| Process || 6 || 0 || TotalMemoryAvailable. Total memory available(free+used).
|-
| Process || 7 || 0 || TotalMemoryUsage. Total used size of codebin memory + main-thread stack + allocated heap.
|-
| Zero || 8 || 0 || IsCurrentProcessBeingDebugged
|-
| Zero || 9 || 0 || Returns ResourceLimit handle for current process. Used by [[Process_Manager_services|PM]].
|-
| Zero || 10 || -1, {current coreid} || IdleTickCount
|-
| Zero || 11 || 0-3 || RandomEntropy from current process. TRNG. Used to seed usermode PRNGs.
|-
| Process || 12 || 0 || [2.0.0+] AddressSpaceBaseAddr
|-
| Process || 13 || 0 || [2.0.0+] AddressSpaceSize
|-
| Process || 14 || 0 || [2.0.0+] StackRegionBaseAddr
|-
| Process || 15 || 0 || [2.0.0+] StackRegionSize
|-
| Process || 16 || 0 || [3.0.0+] PersonalMmHeapSize
|-
| Process || 17 || 0 || [3.0.0+] PersonalMmHeapUsage
|-
| Process || 18 || 0 || [3.0.0+] TitleId
|-
| Zero || 19 || 0 || [4.0.0-4.1.0] PrivilegedProcessId_LowerBound
|-
| Zero || 19 || 1 || [4.0.0-4.1.0] PrivilegedProcessId_UpperBound
|-
| Process || 20 || 0 || [5.0.0+] UserExceptionContextAddr
|-
| Process || 21 || 0 || [6.0.0+] TotalMemoryAvailableWithoutMmHeap
|-
| Process || 22 || 0 || [6.0.0+] TotalMemoryUsedWithoutMmHeap
|-
| Thread || 0xF0000002 || 0 || Scheduler related.
|}

== svcMapPhysicalMemory ==
This is like svcSetHeapSize except you can allocate heap at any address you'd like.

Uses current process pool partition.

== svcDumpInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

Does nothing, just returns with registers set to all-zero.

== svcAcceptSession ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || Handle<Port> || Port
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ServerSession> || Session
|}
</div>

=== Result codes ===

'''0xf201:''' No session waiting to be accepted

== svcReplyAndReceive ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || *Handle<Port or ServerSession> || Handles
|-
| (In) W2 || u32 || NumHandles
|-
| (In) W3 || Handle<ServerSession> || ReplyTarget
|-
| (In) X4 || u64 (nanoseconds) || Timeout
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || u32 || HandleIndex
|}
</div>

If ReplyTarget is not zero, a reply from the TLS will be sent to that session.
Then it will wait until either of the passed sessions has an incoming message, is closed, a passed port has an incoming connection, or the timeout expires.
If there is an incoming message, it is copied to the TLS.

If ReplyTarget is zero, the TLS should contain a blank message. If this message has a C descriptor, the buffer it points to will be used as the pointer buffer. See [[IPC_Marshalling#IPC_buffers]]. Note that a pointer buffer cannot be specified if ReplyTarget is not zero.

After being validated, passed handles will be enumerated in order; even if a session has been closed, if one that appears earlier in the list has an incoming message, it will take priority and a result code of 0x0 will be returned.

=== Result codes ===

'''0x0:''' Success. Either a session has an incoming message or a port has an incoming connection. HandleIndex is set appropriately.

'''0xea01:''' Timeout. No handles were signalled before the timeout expired. HandleIndex is not updated.

'''0xf601:''' Port remote dead. One of the sessions has been closed. HandleIndex is set appropriately.

== svcMapPhysicalMemoryUnsafe ==
Same as [[#svcMapPhysicalMemory]] except it always uses pool partition 0.

== svcCreateCodeMemory ==
Takes an address range with backing memory to create the code memory object.

The memory is initially memset to 0xFF after being locked.

== svcControlCodeMemory ==
Maps the backing memory for a Code memory object into the current process.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapOwner]], memory permission must be RW-.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapSlave]], memory permission must be R-- or R-X.

Operations [[#CodeMemoryOperation|CodeMemoryOperation_UnmapOwner/CodeMemoryOperation_UnmapSlave]] unmap memory that was previously mapped this way.

This allows one "secure JIT" process to map the code memory as RW-, and the other "slave" process to map it R-X.

[5.0.0+] Error 0xE401 is now returned when the process owner of the Code memory object is the same as the current process.

== svcReadWriteRegister ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || RegAddr
|-
| (In) W2 || u64 || RwMask
|-
| (In) W3 || u64 || InValue
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1|| u64 || OutValue
|}
</div>

Read/write IO registers with a hardcoded whitelist. Input address is physical-address and must be aligned to 4.

rw_mask is 0 for reading and 0xffffffff for writing. You can also write individual bits by using a mask value.

You can only write to registers inside physical pages 0x70019000 (MC), 0x7001C000 (MC0), 0x7001D000 (MC1), and they all share the same whitelist.

The whitelist is same for writing as for reading.

The whitelist is:

0x054, 0x090, 0x094, 0x098, 0x09c, 0x0a0, 0x0a4, 0x0a8, 0x0ac, 0x0b0, 0x0b4, 0x0b8, 0x0bc, 0x0c0, 0x0c4, 0x0c8, 0x0d0, 0x0d4, 0x0d8, 0x0dc, 0x0e0, 0x100, 0x108, 0x10c, 0x118, 0x11c, 0x124, 0x128, 0x12c, 0x130, 0x134, 0x138, 0x13c, 0x158, 0x15c, 0x164, 0x168, 0x16c, 0x170, 0x174, 0x178, 0x17c, 0x200, 0x204, 0x2e4, 0x2e8, 0x2ec, 0x2f4, 0x2f8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37c, 0x380, 0x390, 0x394, 0x398, 0x3ac, 0x3b8, 0x3bc, 0x3c0, 0x3c4, 0x3d8, 0x3e8, 0x41c, 0x420, 0x424, 0x428, 0x42c, 0x430, 0x44c, 0x47c, 0x480, 0x484, 0x50c, 0x554, 0x558, 0x55c, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69c, 0x6a0, 0x6a4, 0x6c0, 0x6c4, 0x6f0, 0x6f4, 0x960, 0x970, 0x974, 0xa20, 0xa24, 0xb88, 0xb8c, 0xbc4, 0xbc8, 0xbcc, 0xbd0, 0xbd4, 0xbd8, 0xbdc, 0xbe0, 0xbe4, 0xbe8, 0xbec, 0xc00, 0xc5c, 0xcac

[2.0.0+] Whitelist was extended with 0x4c4, 0x4c8, 0x4cc, 0x584, 0x588, 0x58c.

[2.0.0+] The IO registers in range 0x7000E400 (PMC) size 0xC00 skip the whitelist, and do a TrustZone call using [[SMC]] Id1 0xC3000008(ReadWriteRegister).

[4.0.0+] Access to the Memory Controller (0x70019000) also uses smcReadWriteRegister.

Here is the whitelist imposed by that SMC, relative to the start of the PMC registers:

0x000, 0x00c, 0x010, 0x014, 0x01c, 0x020, 0x02c, 0x030, 0x034, 0x038, 0x03c, 0x040, 0x044, 0x048, 0x0dc, 0x0e0, 0x0e4, 0x160, 0x164, 0x168, 0x170, 0x1a8, 0x1b8, 0x1bc, 0x1c0, 0x1c4, 0x1c8, 0x2b4, 0x2d4, 0x440, 0x4d8

Here is the whitelist imposed by smcReadWriteRegister (checked in addition to the whitelist in svcReadWriteRegister), relative to the start of the MC registers:

0x000, 0x004, 0x008, 0x00C, 0x010, 0x01C, 0x020, 0x030, 0x034, 0x050, 0x054, 0x090, 0x094, 0x098, 0x09C, 0x0A0, 0x0A4, 0x0A8, 0x0AC, 0x0B0, 0x0B4, 0x0B8, 0x0BC, 0x0C0, 0x0C4, 0x0C8, 0x0D0, 0x0D4, 0x0D8, 0x0DC, 0x0E0, 0x100, 0x108, 0x10C, 0x118, 0x11C, 0x124, 0x128, 0x12C, 0x130, 0x134, 0x138, 0x13C, 0x158, 0x15C, 0x164, 0x168, 0x16C, 0x170, 0x174, 0x178, 0x17C, 0x200, 0x204, 0x238, 0x240, 0x244, 0x250, 0x254, 0x258, 0x264, 0x268, 0x26C, 0x270, 0x274, 0x280, 0x284, 0x288, 0x28C, 0x294, 0x2E4, 0x2E8, 0x2EC, 0x2F4, 0x2F8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37C, 0x380, 0x390, 0x394, 0x398, 0x3AC, 0x3B8, 0x3BC, 0x3C0, 0x3C4, 0x3D8, 0x3E8, 0x41C, 0x420, 0x424, 0x428, 0x42C, 0x430, 0x44C, 0x47C, 0x480, 0x484, 0x4C4, 0x4C8, 0x4CC, 0x50C, 0x554, 0x558, 0x55C, 0x584, 0x588, 0x58C, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69C, 0x6A0, 0x6A4, 0x6C0, 0x6C4, 0x6F0, 0x6F4, 0x960, 0x970, 0x974, 0x9B8, 0xA20, 0xA24, 0xA88, 0xA94, 0xA98, 0xA9C, 0xAA0, 0xAA4, 0xAA8, 0xAAC, 0xAB0, 0xAB4, 0xAB8, 0xABC, 0xAC0, 0xAC4, 0xAC8, 0xACC, 0xAD0, 0xAD4, 0xAD8, 0xADC, 0xAE0, 0xB88, 0xB8C, 0xBC4, 0xBC8, 0xBCC, 0xBD0, 0xBD4, 0xBD8, 0xBDC, 0xBE0, 0xBE4, 0xBE8, 0xBEC, 0xC00, 0xC5C, 0xCAC

== svcCreateSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || LocalPerm
|-
| (In) W3 || [[#Permission]] || RemotePerm
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<SharedMemory> || MemHandle
|}
</div>

Other perm can be used to enforce permission 1, 3, or 0x10000000 if don't care.

Allocates memory from the current process' pool partition.

== svcMapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

The newly mapped pages will have [[#MemoryState]] type 0xE.

You must pass same size and permissions as given in svcCreateMemoryMirror, otherwise error.

== svcUnmapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must match size given in map syscall, otherwise there's an invalid-size error.

== svcCreateInterruptEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || IrqNum
|-
| (In) W2 || bool || Flags
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<ReadableEvent> || ReadableEventHandle
|}
</div>

Create an event handle for the given IRQ number. Waiting on this handle will wait until the IRQ is triggered. The flags argument configures the triggering. If it is false, the IRQ is active HIGH level sensitive, if it is true it is rising-edge sensitive.

=== Result codes ===

'''0x0:''' Success.

'''0xF001:''' Flags was > 1

'''0xF201:''' IRQ above 0x3FF or outside the [[NPDM#Kernel_Access_Control|IRQ access mask]] was given.

'''0xCE01:''' A SlabHeap was exhausted (too many interrupts created).

'''0xF401:''' IRQ already has an event registered.

'''0xD201:''' The handle table is full. Try closing some handles.

== svcQueryPhysicalAddress ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || Addr
|-
| (Out) W0 || [[#Result]]|| Ret
|-
| (Out) X1 || u64 || PhysAddr
|-
| (Out) X2 || u64 || KernelAddr
|-
| (Out) X3 || u64 || Size
|}
</div>

== svcQueryIoMapping ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || PhysAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || void* || VirtAddr
|}
</div>

'''Description:''' Returns a virtual address mapped to a given IO range.

== svcCreateDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || StartAddr
|-
| (In) X2 || u64 || EndAddr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<DeviceAddressSpace> || AddressSpaceHandle
|}
</div>

'''Description:''' Creates a virtual address space for binding device address spaces and returns a handle.

dev_as_start_addr is normally set to 0 and dev_as_end_addr is normally set to 0xFFFFFFFF.

== svcAttachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Attaches a device address space to a [[#DeviceName|device]].

== svcDetachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Detaches a device address space from a [[#DeviceName|device]].

== svcMapDeviceAddressSpaceByForce ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (In) W5 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

dev_map_addr is the userspace destination address, while dev_as_addr is the source address between dev_as_start_addr and dev_as_end_addr (passed to [[#svcCreateDeviceAddressSpace]]).

The userspace destination address must have the [[SVC#MemoryState|MapDeviceAllowed]] bit set. Bit [[SVC#MemoryAttribute|IsDeviceMapped]] will be set after mapping.

== svcMapDeviceAddressSpaceAligned ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (In) W5 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

Same as [[#svcMapDeviceAddressSpaceByForce]], but the userspace destination address must have the [[SVC#MemoryState|MapDeviceAlignedAllowed]] bit set instead.

== svcUnmapDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps an attached device address space from an userspace address.

== svcContinueDebugEvent ==

=== Result codes ===

'''0x0:''' Success. The process has been resumed.

'''0xe401:''' Invalid debug handle.

'''0xf401:''' Process has debug events queued.

== svcGetSystemInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Zero || 0 || 0 || TotalMemorySize_Application
|-
| Zero || 0 || 1 || TotalMemorySize_Applet
|-
| Zero || 0 || 2 || TotalMemorySize_System
|-
| Zero || 0 || 3 || TotalMemorySize_SystemUnsafe
|-
| Zero || 1 || 0 || CurrentMemorySize_Application
|-
| Zero || 1 || 1 || CurrentMemorySize_Applet
|-
| Zero || 1 || 2 || CurrentMemorySize_System
|-
| Zero || 1 || 3 || CurrentMemorySize_SystemUnsafe
|-
| Zero || 2 || 0 || PrivilegedProcessId_LowerBound
|-
| Zero || 2 || 1 || PrivilegedProcessId_UpperBound
|-
|}

== svcSetProcessMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || void* || Perm
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

This sets the memory permissions for the specified memory with the supplied process handle.

This throws an error(0xD801) when the input perm is >0x5, hence -WX and RWX are not allowed.

== svcMapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || DstAddr
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the src address from the supplied process handle into the current process.

This allows mapping code and rodata with RW- permission.

== svcUnmapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessMemory]].

== svcQueryProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfoPtr
|-
| (In) W2 || Handle<Process> || ProcessHandle
|-
| (In) X3 || u64 || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

Equivalent to [[#svcQueryMemory]] except takes a process handle.

== svcMapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Takes a process handle, and maps normal heap in that process as executable code in that process. Used when loading NROs. This does not support using the current-process handle alias.

== svcUnmapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessCodeMemory]].

== svcCreateProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#CreateProcessInfo]]* || InfoPtr
|-
| (In) X2 || u32* || CapabilitiesPtr
|-
| (In) X3 || u64 || CapabilitiesNum
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Process> || ProcessHandle
|}
</div>

Takes a [[#CreateProcessInfo]] as input.
CapabilitiesPtr points to an array of [[NPDM#Kernel_Access_Control|kernel capabilities]].
CapabilitiesNum is a number of capabilities in the CapabilitiesPtr array (number of element, not number of bytes).

=== Result codes ===

'''0x0:''' Success.

'''0xCA01:''' Attempted to map more code pages than available in address space.

'''0xCC01:''' Provided CodeAddr is invalid (make sure it's in range?)

'''0xE401:''' The resource handle passed is invalid.

'''0xE601:''' Attempt to copy procinfo from user-supplied pointer failed. Attempt to copy capabilities_num from user-supplied pointer failed.

'''0xE801:''' Attempted to create a 32-bit process with a 36-bit address space.

'''0xF001:''' Unused bits are set in mmuflags. Unknown address space type used.

== svcGetProcessInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || [[#ProcessState]] || State
|}
</div>

Returns an enum with value 0-7.

== Debugging ==
[2.0.0+] Exactly 6 debug SVCs require that [[SPL_services#GetConfig|IsDebugMode]] is non-zero. Error 0x4201 is returned otherwise.
* svcBreakDebugProcess
* svcContinueDebugEvent
* svcWriteDebugProcessMemory
* svcSetDebugThreadContext
* svcTerminateDebugProcess
* svcSetHardwareBreakPoint

svcDebugActiveProcess stops execution of the target process, the normal method for resuming it requires svcContinueDebugEvent(see above). Closing the debug handle also results in execution being resumed.

== svcSetHardwareBreakPoint ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || u32 || hardware_breakpoint_id
|-
| (In) W1 || u64 || flags
|-
| (In) W2 || u64 || value
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Sets one of the AArch64 hardware breakpoints. The nintendo switch has 6 hardware breakpoints, and 4 hardware watchpoints. The syscall has two behaviors depending on the value of hardware_breakpoint_id:

If hardware_breakpoint_id < 0x10, then it sets one of the AArch64 hardware breakpoints. Flags will go to DBGBCRn_EL1, and value to DBGBVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0x7F01E1. Furthermore, the kernel will or it with 0x4004, in order to set various security flags to guarantee the watchpoints only triggers for code in EL0. If the user asks for a Breakpoint Type of ContextIDR match, the kernel shall use the given debug_handle to set DBGBVRn_EL1 to the ContextID of the debugged process.

If hardware_breakpoint_id is between 0x10 and 0x20 (exclusive), then it sets one of the AArch64 hardware watchpoints. Flags will go to DBGWCRn_EL1, and the value to DBGWVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0xFF0F1FF9. Furthermore, the kernel will or it with 0x104004. This will set various security flags, and set the watchpoint type to be a Linked Watchpoint. This means that you need to link it to a Linked ContextIDR breakpoint. Check the ARM documentation for more information.

Note that hardware_breakpoint_id 0 to 4 match only to Virtual Address, while hardware_breakpoint_id 5 and 6 match against either Virtual Address, ContextID, or VMID. As such, if you are configuring a breakpoint to link for a watchpoint, make sure you use hardware_breakpoint_id 5 or 6.

For more documentation for hardware breakpoints, check out the AArch64 documentation for the [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0488h/way1382455558968.html DBGBCRn_EL1 register] and the [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0488h/way1382455560629.html DBGWCRn_EL1 register]

= Enum/Structures =
== ThreadContextRequestFlags ==
Bitfield of one of more of these:

{| class=wikitable
! Bit || Bitmask || Name
|-
| 0 || 1 || NormalContext
|-
| 1 || 2 ||
|-
| 2 || 4 ||
|-
| 3 || 8 ||
|}

== DeviceName ==
{| class=wikitable
! Value || Name
|-
| 0 || DeviceName_AFI
|-
| 1 || DeviceName_AVPC
|-
| 2 || DeviceName_DC
|-
| 3 || DeviceName_DCB
|-
| 4 || DeviceName_HC
|-
| 5 || DeviceName_HDA
|-
| 6 || DeviceName_ISP2
|-
| 7 || DeviceName_MSENCNVENC
|-
| 8 || DeviceName_NV
|-
| 9 || DeviceName_NV2
|-
| 10 || DeviceName_PPCS
|-
| 11 || DeviceName_SATA
|-
| 12 || DeviceName_VI
|-
| 13 || DeviceName_VIC
|-
| 14 || DeviceName_XUSB_HOST
|-
| 15 || DeviceName_XUSB_DEV
|-
| 16 || DeviceName_TSEC
|-
| 17 || DeviceName_PPCS1
|-
| 18 || DeviceName_DC1
|-
| 19 || DeviceName_SDMMC1A
|-
| 20 || DeviceName_SDMMC2A
|-
| 21 || DeviceName_SDMMC3A
|-
| 22 || DeviceName_SDMMC4A
|-
| 23 || DeviceName_ISP2B
|-
| 24 || DeviceName_GPU
|-
| 25 || DeviceName_GPUB
|-
| 26 || DeviceName_PPCS2
|-
| 27 || DeviceName_NVDEC
|-
| 28 || DeviceName_APE
|-
| 29 || DeviceName_SE
|-
| 30 || DeviceName_NVJPG
|-
| 31 || DeviceName_HC1
|-
| 32 || DeviceName_SE1
|-
| 33 || DeviceName_AXIAP
|-
| 34 || DeviceName_ETR
|-
| 35 || DeviceName_TSECB
|-
| 36 || DeviceName_TSEC1
|-
| 37 || DeviceName_TSECB1
|-
| 38 || DeviceName_NVDEC1
|}

== CodeMemoryOperation ==
{| class=wikitable
! Value || Name
|-
| 0 || CodeMemoryOperation_MapOwner
|-
| 1 || CodeMemoryOperation_MapSlave
|-
| 2 || CodeMemoryOperation_UnmapOwner
|-
| 3 || CodeMemoryOperation_UnmapSlave
|}

== LimitableResource ==
{| class=wikitable
! Value || Name
|-
| 0 || LimitableResource_Memory
|-
| 1 || LimitableResource_Threads
|-
| 2 || LimitableResource_Events
|-
| 3 || LimitableResource_TransferMemories
|-
| 4 || LimitableResource_Sessions
|}

== ProcessInfoType ==

{| class=wikitable
! Value || Name
|-
| 0 || [[#ProcessState|ProcessInfoType_ProcessState]]
|-
|}

== ProcessState ==
{| class=wikitable
! Value || Name || Notes
|-
| 0 || ProcessState_Created ||
|-
| 1 || ProcessState_CreatedAttached ||
|-
| 2 || ProcessState_Started ||
|-
| 3 || ProcessState_Crashed || Processes will not enter this state unless they were created with [[#CreateProcessInfo|EnableDebug]].
|-
| 4 || ProcessState_StartedAttached ||
|-
| 5 || ProcessState_Exiting ||
|-
| 6 || ProcessState_Exited ||
|-
| 7 || ProcessState_DebugSuspended ||
|}

== DebugThreadParam ==
{| class=wikitable
! Value || Name
|-
| 0 || DebugThreadParam_DynamicPriority
|-
| 1 || DebugThreadParam_SchedulingStatus
|-
| 2 || DebugThreadParam_PreferredCpuCore
|-
| 3 || DebugThreadParam_CurrentCpuCore
|-
| 4 || DebugThreadParam_AffinityMask
|}

Dynamic priority: output in out2

Scheduling status: out1 contains bit0: is debug-suspended, bit1: is user-suspended (svcSetThreadActivity 1 or svcSetProcessActivity 1).
Out2 contains {suspended, idle, running, terminating} => {5, 0, 1, 4}

DebugThreadParam_PreferredCpuCore: output in out2

DebugThreadParam_CurrentCpuCore: output in out2

DebugThreadParam_AffinityMask: output in out1

== CreateProcessInfo ==
{| class=wikitable
! Offset || Length || Bits || Description
|-
| 0 || 12 || || ProcessName (doesn't have to be null-terminated)
|-
| 0x0C || 4 || || ProcessCategory (0: regular title, 1: kernel built-in)
|-
| 0x10 || 8 || || TitleId
|-
| 0x18 || 8 || || CodeAddr
|-
| 0x20 || 4 || || CodeNumPages
|-
| 0x24 || 4 || || MmuFlags
|-
| || || Bit0 || IsAarch64
|-
| || || Bit3-1 || [[#AddressSpaceType]]
|-
| || || Bit4 || [2.0.0+] EnableDebug
|-
| || || Bit5 || EnableAslr
|-
| || || Bit6 || UseSystemMemBlocks
|-
| || || Bit7 || [4.0.0] ?
|-
| || || Bit10-7 || [5.0.0+] PoolPartition (0=Application, 1=Applet, 2=Sysmodule, 3=Nvservices)
|-
| || || Bit11 || [7.0.0+] Only allowed in combination with bit6.
|-
| 0x28 || 4 || || ResourceLimitHandle or zero
|-
| 0x2C || 4 || || [3.0.0+] PersonalMmHeapNumPages
|}

On [1.0.0] there's only one pool.

On [2.0.0-4.0.0] PoolPartition is 1 for built-ins and 0 for rest.

On [5.0.0] PoolPartition is specified in CreateProcessArgs. There are now 4 pool partitions.

On [5.0.0] (maybe lower?) a zero ResourceLimitHandle defaults to sysmodule limits and 0x12300000 bytes of memory.

The PersonalMmHeap are allocated as follows:
* For the application, normal insecure pool is used. Carveout 5 is used to provide protection.
* For the applet, a pre-allocated secure pool segment of size 0x400000 is used.
* For sysmodules, secure pool is allocated.

=== AddressSpaceType ===
{| class=wikitable
! Type || Name || Width || Description
|-
| 0 || Normal_32Bit || 32 ||
|-
| 1 || Normal_36Bit || 36 ||
|-
| 2 || WithoutMap_32Bit || 32 || Appears to be missing map region [?]
|-
| 3 || [2.0.0+] Normal_39Bit || 39 ||
|}

== MemoryInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || 8 || BaseAddress
|-
| 8 || 8 || Size
|-
| 0x10 || 4 || MemoryType: lower 8 bits of [[#MemoryState]]
|-
| 0x14 || 4 || [[#MemoryAttribute]]
|-
| 0x18 || 4 || Permission (bit0: R, bit1: W, bit2: X)
|-
| 0x1C || 4 || IpcRefCount
|-
| 0x20 || 4 || DeviceRefCount
|-
| 0x24 || 4 || Padding: always zero
|}

== MemoryAttribute ==
{| class=wikitable
! Bits || Description
|-
| 0 || IsBorrowed
|-
| 1 || IsIpcMapped: when IpcRefCount > 0.
|-
| 2 || IsDeviceMapped: when DeviceRefCount > 0.
|-
| 3 || IsUncached
|}

== MemoryState ==
{| class=wikitable
! Bits || Description
|-
| 7-0 || Type
|-
| 8 || [[#svcSetMemoryPermission|PermissionChangeAllowed]]
|-
| 9 || ForceReadWritableByDebugSyscalls
|-
| 10 || IpcSendAllowed_Type0
|-
| 11 || IpcSendAllowed_Type3
|-
| 12 || IpcSendAllowed_Type1
|-
| 14 || [[#svcSetProcessMemoryPermission|ProcessPermissionChangeAllowed]]
|-
| 15 || [[#svcMapMemory|MapAllowed]]
|-
| 16 || [[#svcUnmapProcessCodeMemory|UnmapProcessCodeMemoryAllowed]]
|-
| 17 || [[#svcCreateTransferMemory|TransferMemoryAllowed]]
|-
| 18 || [[#svcQueryPhysicalAddress|QueryPhysicalAddressAllowed]]
|-
| 19 || MapDeviceAllowed ([[#svcMapDeviceAddressSpace]] and [[#svcMapDeviceAddressSpaceByForce]])
|-
| 20 || [[#svcMapDeviceAddressSpaceAligned|MapDeviceAlignedAllowed]]
|-
| 21 || [[#svcSendSyncRequestWithUserBuffer|IpcBufferAllowed]]
|-
| 22 || IsPoolAllocated/IsReferenceCounted
|-
| 23 || [[#svcMapProcessMemory|MapProcessAllowed]]
|-
| 24 || [[#svcSetMemoryAttribute|AttributeChangeAllowed]]
|-
| 25 || [4.0.0+] CodeMemoryAllowed
|}

{| class=wikitable
! Value || Type || Meaning
|-
| 0x00000000 || MemoryType_Unmapped ||
|-
| 0x00002001 || MemoryType_Io || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00042002 || MemoryType_Normal || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00DC7E03 || MemoryType_CodeStatic || Mapped during [[#svcCreateProcess]].
|-
| [1.0.0+]

0x01FEBD04

[4.0.0+]

0x03FEBD04
|| MemoryType_CodeMutable || Transition from 0xDC7E03 performed by [[#svcSetProcessMemoryPermission]].
|-
| [1.0.0+]
0x017EBD05

[4.0.0+]

0x037EBD05
|| MemoryType_Heap || Mapped using [[#svcSetHeapSize]].
|-
| 0x00402006 || MemoryType_SharedMemory || Mapped using [[#svcMapSharedMemory]].
|-
| 0x00482907 || [1.0.0] MemoryType_Alias || Mapped using [[#svcMapMemory]].
|-
| 0x00DD7E08 || MemoryType_ModuleCodeStatic || Mapped using [[#svcMapProcessCodeMemory]].
|-
| [1.0.0+]

0x01FFBD09

[4.0.0+]

0x03FFBD09
|| MemoryType_ModuleCodeMutable || Transition from 0xDD7E08 performed by [[#svcSetProcessMemoryPermission]].
|-
| 0x005C3C0A || [[IPC_Marshalling|MemoryType_IpcBuffer0]] || IPC buffers with descriptor flags=0.
|-
| 0x005C3C0B || MemoryType_Stack || Mapped using [[#svcMapMemory]].
|-
| 0x0040200C || [[Thread Local Storage|MemoryType_ThreadLocal]] || Mapped during [[#svcCreateThread]].
|-
| 0x015C3C0D || MemoryType_TransferMemoryIsolated || Mapped using [[#svcMapTransferMemory]] when the owning process has perm=0.
|-
| 0x005C380E || MemoryType_TransferMemory || Mapped using [[#svcMapTransferMemory]] when the owning process has perm!=0.
|-
| 0x0040380F || MemoryType_ProcessMemory || Mapped using [[#svcMapProcessMemory]].
|-
| 0x00000010 || MemoryType_Reserved ||
|-
| 0x005C3811 || [[IPC_Marshalling|MemoryType_IpcBuffer1]] || IPC buffers with descriptor flags=1.
|-
| 0x004C2812 || [[IPC_Marshalling|MemoryType_IpcBuffer3]] || IPC buffers with descriptor flags=3.
|-
| 0x00002013 || MemoryType_KernelStack || Mapped in kernel during [[#svcCreateThread]].
|-
| 0x00402214 || [4.0.0+] MemoryType_CodeReadOnly || Mapped in kernel during [[#svcControlCodeMemory]].
|-
| 0x00402015 || [4.0.0+] MemoryType_CodeWritable || Mapped in kernel during [[#svcControlCodeMemory]].
|}

== ArbitrationType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || WaitIfLessThan
|-
| 0x1 || DecrementAndWaitIfLessThan
|-
| 0x2 || WaitIfEqual
|-
|}

== SignalType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || Signal
|-
| 0x1 || SignalAndIncrementIfEqual
|-
| 0x2 || SignalAndModifyBasedOnWaitingThreadCountIfEqual
|-
|}

== ContinueDebugFlagsOld ==
[1.0.0-2.3.0]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: ResumeAllThreads or debug-suspended-thread-id needed)
|-
| 1 || 2 || SwallowException
|-
| 2 || 4 || ResumeAllThreads
|}

== ContinueDebugFlags ==
[3.0.0+]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: doesn't need to be set in the same call than Resume)
|-
| 1 || 2 || DontCatchExceptions
|-
| 2 || 4 || Resume
|-
| 3 || 8 || IgnoreOtherThreadsExceptions
|}

IgnoreExceptionsOfOthers is like IgnoreException but acts on all threads that aren't in the input list. The affected threads are resumed.

Only one of of Resume and IgnoreOtherThreadsExceptions can be set at a time.

If the input number of threads is 0, this means "all threads".

== DebugEventInfo ==

The below table is for the Aarch64 version of the system call. For A32, all u64 fields but title/process/thread id are actually u32, making the structure 0x28-byte-big (0x40 for a64).

Size: 0x40

{| class=wikitable
! Offset || Length || Description
|-
| 0 || u32 || EventType
|-
| 4 || u32 || Flags (bit0: NeedsContinue)
|-
| 8 || u64 || ThreadId
|-
| 0x10 || || PerTypeSpecifics
|}

AttachProcess specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || TitleId
|-
| 0x18 || u64 || ProcessId
|-
| 0x20 || char[12] || ProcessName
|-
| 0x2C || u32 || MmuFlags
|-
| 0x30 || u64 || [5.0.0+] UserExceptionContextAddr
|}

AttachThread specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ThreadId
|-
| 0x18 || u64 || TlsPtr
|-
| 0x20 || u64 || Entrypoint
|}

Exit specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32|| Type (0=PausedThread, 1=RunningThread, 2=ExitedProcess, 3=TerminatedProcess)
|}

Exception specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32 || ExceptionType
|-
| 0x18 || u64 || FaultRegister
|-
| 0x20 || || PerExceptionSpecifics
|}

=== DebugEventType ===
{| class=wikitable
! Value || Name
|-
| 0 || DebugEvent_AttachProcess
|-
| 1 || DebugEvent_AttachThread
|-
| 2 || DebugEvent_ExitProcess
|-
| 3 || DebugEvent_ExitThread
|-
| 4 || DebugEvent_Exception
|}

=== DebugExceptionType ===
{| class=wikitable
! Value || Name
|-
| 0 || Exception_Trap (*)
|-
| 1 || Exception_InstructionAbort
|-
| 2 || Exception_DataAbortMisc (**)
|-
| 3 || Exception_PcSpAlignmentFault
|-
| 4 || Exception_DebuggerAttached
|-
| 5 || Exception_BreakPoint
|-
| 6 || Exception_UserBreak
|-
| 7 || Exception_DebuggerBreak
|-
| 8 || Exception_BadSvcId
|-
| 9 || Exception_SError [not in 1.0.0]
|}

<nowiki>*</nowiki> Undefined instructions, software breakpoints, some other traps.

<nowiki>**</nowiki> Data aborts, FP traps, and everything else that doesn't belong to any of the above.

Trap specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Opcode
|}

BreakPoint specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || IsWatchpoint
|}

UserBreak specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Info0
|-
| 0x28 || u64 || Info1
|-
| 0x30 || u64 || Info2
|}

BadSvcId specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || SvcId
|}

= Exception handling =
First of all, a function that might be called by synchronous exception handler and that is called by the SError handler fetches the exception info, adjusts PC, panics on exceptions taken from EL1, then dispatches the exception.

The dispatcher has two mutually exclusive exception reporting methods:
* by storing information at the start of the process's TLS memregion (TPIDRRO_EL0) and jumping back to the crt0
* by using KDebug

KDebug dispatching is used when at least one of the following conditions are met:
* SMC ConfigItem KernelMemConfig bit 1 is NOT set (it isn't on retail), unless: this is a software or hardware breakpoint, or a watchpoint, or [4.0.0+?] the process is attached and this is a Google PNaCl trap instruction (see LLVM source)
* FAR doesn't point to a valid address in mapped-readable CodeStatic memory (i.e. this is the case for NRO and JIT memory) or this is one of the following exceptions (it particular, that doesn't include FP exceptions occurring in CodeStatic memory):
** Uncategorized
** IllegalState
** SupervisorCallA32
** SupervisorCallA64
** PCAlignment
** SPAlignment
** SError
** BreakpointLowerEl
** SoftwareStepLowerEl (note: no way set single-step flag; not parsed)
** WatchpointLowerEl
** SoftwareBreakpointA32 (note: not parsed)
** SoftwareBreakpointA64 (note: not parsed)

In all other cases the userland-handled exception path is taken.

KDebug path:

If the process is attached, the exception is reported to the KDebug. If the thread was continued using flag IgnoreExceptions, it returns from the exception as if nothing happened.

If the latter is not the case, or if the process isn't attached, proceed to [2.0.0+] crash reporting (or in [1.0.0] just terminate the process):
if EnableDebug is set, and depending on the process state (more than one crash per process isn't permitted) it may signal itself with ProcessState_Crashed so that PM asks NS to start creport so that creport attaches to it and reports the crashes. Otherwise, just terminate.

Userland reporting path and svcReturnFromException:

TLS region start (A64):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x148 || Exception stack
|-
| 0x148 || 0x78 || ExceptionFrameA64
|}

ExceptionFrameA64:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x48 (8*9) || GPRs 0..8.
|-
| 0x48 || 0x8 || lr
|-
| 0x50 || 0x8 || sp
|-
| 0x58 || 0x8 || pc (elr_el1)
|-
| 0x60 || 0x4 || pstate & 0xFF0FFE20
|-
| 0x64 || 0x4 || afsr0
|-
| 0x68 || 0x4 || afsr1
|-
| 0x6C || 0x4 || esr
|-
| 0x70 || 0x8 || far
|}

TLS region start (A32):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x178 || Exception stack
|-
| 0x148 || 0x44 || ExceptionFrameA32
|}

ExceptionFrameA32:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x20 (8*4) || GPRs 0..7.
|-
| 0x20 || 0x4 || sp
|-
| 0x24 || 0x4 || lr
|-
| 0x28 || 0x4 || pc (elr_el1)
|-
| 0x2C || 0x4 || tpidr_el0 = 1
|-
| 0x30 || 0x4 || cpsr & 0xFF0FFE20
|-
| 0x34 || 0x4 || afsr0
|-
| 0x38 || 0x4 || afsr1
|-
| 0x3C || 0x4 || esr
|-
| 0x40 || 0x4 || far
|}

In that case, after storing the regs in the TLS, the exception handler returns to the application's crt0 (entrypoint), with X0=<error description code> (see below) and X1=SP=frame=<stack top> (see above)

{| class=wikitable
! Desc. code || Meaning
|-
| 0x100 || Instruction abort
|-
| 0x102 || Misaligned PC
|-
| 0x103 || Misaligned SP
|-
| 0x106 || SError [not in 1.0.0?]
|-
| 0x301 || Bad SVC
|-
| 0x104 || Uncategorized, CP15RTTrap, CP15RRTTrap, CP14RTTrap, CP14RRTTrap, IllegalState, SystemRegisterTrap
|-
| 0x101 || None of the above, EC <= 0x34 and not a breakpoint
|-
|}

(During normal app boot the process is invoked with X0=0 and X1=main_thread_handle. The crt0 of retail apps determines whether to boot normally or handle an exception if X0 is set to 0 or not)

The application is supposed to promptly update the contents of elr_el1 to a user handler (and any other regs it sees fit) and call svcReturnFromException (error code) to call that handler. The latter is then expected to promptly abort the program.

svcReturnFromException updates the contents of the kernel stack frame with what the user provided in the TLS structure, sets TPIDR_EL0 to 1, then:
* if the provided error code is 0, gracefully pivots and returns from exception
* if it is not, replays the exception and pass it to the KDebug (see above). One can pass 0x10001 to prevent process termination. If the process is attached, this also prevents crash-collection/termination (different from the exception handler behavior)

If an exception occurs from the above user handler, the entire exception handling process will repeat with the new exception.

Note that if a thread that wasn't faulting calls svcReturnFromException, it signals an "invalid syscall" exception

Note that [[SMC|IsDebugMode]] is not used during exception-handling, except for enabling printing a message to UART-A. This UART code causes a system-hang on retail (likely due to a loop that doesn't exit). This printing doesn't seem to run when the process is attached for debugging?

SVC

2019-02-05T09:09:48Z

Qlutoo: /* CreateProcessInfo */

__NOTOC__

= System calls =
{| class=wikitable
! Id || Name || In || Out
|-
| 0x1 || [[#svcSetHeapSize]] || W1=size || W0=result, X1=outaddr
|-
| 0x2 || [[#svcSetMemoryPermission]] || X0=addr, X1=size, W2=prot || W0=result
|-
| 0x3 || [[#svcSetMemoryAttribute]] || X0=addr, X1=size, W2=state0, W3=state1 || W0=result
|-
| 0x4 || [[#svcMapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x5 || [[#svcUnmapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x6 || [[#svcQueryMemory]] || X0=MemoryInfo*, X2=addr || W0=result, W1=PageInfo
|-
| 0x7 || [[#svcExitProcess]] || None ||
|-
| 0x8 || [[#svcCreateThread]] || X1=entry, X2=thread_context, X3=stacktop, W4=prio, W5=processor_id || W0=result, W1=handle
|-
| 0x9 || [[#svcStartThread]] || W0=thread_handle || W0=result
|-
| 0xA || [[#svcExitThread]] || None ||
|-
| 0xB || [[#svcSleepThread]] || X0=nano ||
|-
| 0xC || [[#svcGetThreadPriority]] || W1=thread_handle || W0=result, W1=prio
|-
| 0xD || [[#svcSetThreadPriority]] || W0=thread_handle, W1=prio || W0=result
|-
| 0xE || [[#svcGetThreadCoreMask]] || W2=thread_handle || W0=result, W1=out, X2=out
|-
| 0xF || [[#svcSetThreadCoreMask]] || W0=thread_handle, W1=in, X2=in2 || W0=result
|-
| 0x10 || [[#svcGetCurrentProcessorNumber]] || None || W0/X0=cpuid
|-
| 0x11 || svcSignalEvent || W0=wevent_handle || W0=result
|-
| 0x12 || svcClearEvent || W0=wevent_or_revent_handle || W0=result
|-
| 0x13 || [[#svcMapSharedMemory]] || W0=shmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x14 || svcUnmapSharedMemory || W0=shmem_handle, X1=addr, X2=size || W0=result
|-
| 0x15 || [[#svcCreateTransferMemory]] || X1=addr, X2=size, W3=perm || W0=result, W1=tmem_handle
|-
| 0x16 || svcCloseHandle || W0=handle || W0=result
|-
| 0x17 || svcResetSignal || W0=revent_or_process_handle || W0=result
|-
| 0x18 || [[#svcWaitSynchronization]] || X1=handles_ptr, W2=num_handles. X3=timeout || W0=result, W1=handle_idx
|-
| 0x19 || [[#svcCancelSynchronization]] || W0=thread_handle || W0=result
|-
| 0x1A || svcArbitrateLock || W0=cur_thread_handle, X1=ptr, W2=req_thread_handle ||
|-
| 0x1B || svcArbitrateUnlock || X0=ptr ||
|-
| 0x1C || svcWaitProcessWideKeyAtomic || X0=ptr0, X1=ptr, W2=thread_handle, X3=timeout || W0=result
|-
| 0x1D || svcSignalProcessWideKey || X0=ptr, W1=value || W0=result
|-
| 0x1E || [[#svcGetSystemTick]] || None || X0={value of cntpct_el0}
|-
| 0x1F || svcConnectToNamedPort || X1=port_name_str || W0=result, W1=handle
|-
| 0x20 || svcSendSyncRequestLight || W0=light_session_handle, X1=? || W0=result
|-
| 0x21 || svcSendSyncRequest || X0=normal_session_handle || W0=result
|-
| 0x22 || [[#svcSendSyncRequestWithUserBuffer]] || X0=cmdbufptr, X1=size, X2=handle || W0=result
|-
| 0x23 || svcSendAsyncRequestWithUserBuffer || X1=cmdbufptr, X2=size, X3=handle || W0=result, W1=revent_handle
|-
| 0x24 || svcGetProcessId || W1=thread_or_process_or_debug_handle || W0=result, X1=pid
|-
| 0x25 || svcGetThreadId || W1=thread_handle || W0=result, X1=out
|-
| 0x26 || [[#svcBreak]] || X0=break_reason,X1,X2=info || W0=result = 0
|-
| 0x27 || svcOutputDebugString || X0=str, X1=size || W0=result
|-
| 0x28 || svcReturnFromException || X0=result ||
|-
| 0x29 || [[#svcGetInfo]] || X1=info_id, X2=handle, X3=info_sub_id || W0=result, X1=out
|-
| 0x2A || svcFlushEntireDataCache || None || None
|-
| 0x2B || svcFlushDataCache || X0=addr, X1=size || W0=result
|-
| 0x2C || [3.0.0+] [[#svcMapPhysicalMemory]] || X0=addr, X1=size || W0=result
|-
| 0x2D || [3.0.0+] svcUnmapPhysicalMemory || X0=addr, X1=size || W0=result
|-
| 0x2E || [5.0.0+] svcGetFutureThreadInfo || X3=timeout || W0=result, bunch of crap
|-
| 0x2F || svcGetLastThreadInfo || None || W0=result, W1,W2,W3,W4=unk, W5=truncated_u64, W6=bool
|-
| 0x30 || svcGetResourceLimitLimitValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
|-
| 0x31 || svcGetResourceLimitCurrentValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
|-
| 0x32 || svcSetThreadActivity || W0=thread_handle, W1=bool || W0=result
|-
| 0x33 || svcGetThreadContext3 || X0=[[#ThreadContext]]*, W1=thread_handle || W0=result
|-
| 0x34 || [4.0.0+] svcWaitForAddress || X0=ptr, W1=[[#ArbitrationType]], X2=value X3=timeout ||
|-
| 0x35 || [4.0.0+] svcSignalToAddress || X0=ptr, W1=[[#SignalType]], X2=value W3=num_to_signal ||
|- style="border-top: double"
| 0x3C || [[#svcDumpInfo]] || ||
|-
| 0x3D || [4.0.0+] svcDumpInfoNew || ||
|- style="border-top: double"
| 0x40 || svcCreateSession || W2=is_light, X3=? || W0=result, W1=server_handle, W2=client_handle
|-
| 0x41 || [[#svcAcceptSession]] || W1=port_handle || W0=result, W1=session_handle
|-
| 0x42 || svcReplyAndReceiveLight || W0=light_session_handle || W0=result, W1,W2,W3,W4,W5,W6,W7=out
|-
| 0x43 || [[#svcReplyAndReceive]] || X1=ptr_handles, W2=num_handles, X3=replytarget_handle(0=none), X4=timeout || W0=result, W1=handle_idx
|-
| 0x44 || svcReplyAndReceiveWithUserBuffer|| X1=buf, X2=sz, X3=ptr_handles, W4=num_handles, X5=replytarget_handle(0=none), X6=timeout || W0=result, W1=handle_idx
|-
| 0x45 || svcCreateEvent || None || W0=result, W1=wevent_handle, W2=revent_handle
|- style="border-top: double"
| 0x48 || [5.0.0+] [[#svcMapPhysicalMemoryUnsafe]] || X0=addr, X1=size || W0=result
|-
| 0x49 || [5.0.0+] svcUnmapPhysicalMemoryUnsafe || X0=addr, X1=size || W0=result
|-
| 0x4A || [5.0.0+] svcSetUnsafeLimit || X0=size || W0=result
|-
| 0x4B || [4.0.0+] [[#svcCreateCodeMemory]] || X1=addr, X2=size || W0=result, W1=code_memory_handle
|-
| 0x4C || [4.0.0+] [[#svcControlCodeMemory]] || W0=code_memory_handle, W1=[[#CodeMemoryOperation]], X2=dstaddr, X3=size, W4=perm || W0=result
|-
| 0x4D || svcSleepSystem || None || None
|-
| 0x4E || [[#svcReadWriteRegister]] || X1=reg_addr, W2=rw_mask, W3=in_val || W0=result, W1=out_val
|-
| 0x4F || svcSetProcessActivity || W0=process_handle, W1=bool || W0=result
|-
| 0x50 || [[#svcCreateSharedMemory]] || W1=size, W2=myperm, W3=otherperm || W0=result, W1=shmem_handle
|-
| 0x51 || [[#svcMapTransferMemory]] || X0=tmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x52 || [[#svcUnmapTransferMemory]] || W0=tmemhandle, X1=addr, X2=size || W0=result
|-
| 0x53 || [[#svcCreateInterruptEvent]] || X1=irq_num, W2=flag || W0=result, W1=handle
|-
| 0x54 || [[#svcQueryPhysicalAddress]] || X1=addr || W0=result, X1=physaddr, X2=kerneladdr, X3=size
|-
| 0x55 || [[#svcQueryIoMapping]] || X1=physaddr, X2=size || W0=result, X1=virtaddr
|-
| 0x56 || [[#svcCreateDeviceAddressSpace]] || X1=dev_as_start_addr, X2=dev_as_end_addr || W0=result, W1=dev_as_handle
|-
| 0x57 || [[#svcAttachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x58 || [[#svcDetachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x59 || [[#svcMapDeviceAddressSpaceByForce]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm || W0=result
|-
| 0x5A || [[#svcMapDeviceAddressSpaceAligned]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm || W0=result
|-
| 0x5B || svcMapDeviceAddressSpace || ||
|-
| 0x5C || [[#svcUnmapDeviceAddressSpace]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr || W0=result
|-
| 0x5D || svcInvalidateProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x5E || svcStoreProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x5F || svcFlushProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x60 || svcDebugActiveProcess || X1=pid || W0=result, W1=debug_handle
|-
| 0x61 || svcBreakDebugProcess || W0=debug_handle || W0=result
|-
| 0x62 || svcTerminateDebugProcess || W0=debug_handle || W0=result
|-
| 0x63 || svcGetDebugEvent || X0=[[#DebugEventInfo]]*, W1=debug_handle || W0=result
|-
| 0x64 || [[#svcContinueDebugEvent]] || [1.0.0-2.3.0] W0=debug_handle, W1=[[#ContinueDebugFlagsOld]], X2=thread_id
[3.0.0+] W0=debug_handle, W1=[[#ContinueDebugFlags]], X2=thread_id_list(u64 *), W3=num_tids (max 64, 0 means "all threads")
|| W0=result
|-
| 0x65 || svcGetProcessList || X1=pids_out_ptr, W2=max_out || W0=result, W1=num_out
|-
| 0x66 || svcGetThreadList || X1=tids_out_ptr, W2=max_out, W3=debug_handle_or_zero || W0=result, X1=num_out
|-
| 0x67 || svcGetDebugThreadContext || X0=ThreadContext*, X1=debug_handle, X2=thread_id, W3=[[#ThreadContextFlags]] || W0=result
|-
| 0x68 || svcSetDebugThreadContext || W0=debug_handle, X1=thread_id, X2=ThreadContext*, W3=[[#ThreadContextFlags]] || W0=result
|-
| 0x69 || svcQueryDebugProcessMemory || X0=[[#MemoryInfo]]*, X2=debug_handle, X3=addr || W0=result, W1=PageInfo
|-
| 0x6A || svcReadDebugProcessMemory || X0=buffer*, X1=debug_handle, X2=src_addr, X3=size || W0=result
|-
| 0x6B || svcWriteDebugProcessMemory || X0=debug_handle, X1=buffer*, X2=dst_addr, X3=size || W0=result
|-
| 0x6C || [[#svcSetHardwareBreakPoint]] || W0=HardwareBreakpointId, X1=watchpoint_flags/breakpoint_flags, X2=watchpoint_value/debug_handle ||
|-
| 0x6D || svcGetDebugThreadParam || X2=debug_handle, X3=thread_id, W4=[[#DebugThreadParam]] || W0=result, X1=out0, W2=out1
|- style="border-top: double"
| 0x6F || [5.0.0+] [[#svcGetSystemInfo]] || X1=info_id, X2=handle, X3=info_sub_id || W0=result, X1=out
|-
| 0x70 || svcCreatePort || W2=max_sessions, W3=is_light, X4=name_ptr || W0=result, W1=clientport_handle, W2=serverport_handle
|-
| 0x71 || svcManageNamedPort || X1=name_ptr, W2=max_sessions || W0=result, W1=serverport_handle
|-
| 0x72 || svcConnectToPort || W1=clientport_handle || W0=result, W1=session_handle
|-
| 0x73 || [[#svcSetProcessMemoryPermission]] || W0=process_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x74 || [[#svcMapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size || W0=result
|-
| 0x75 || [[#svcUnmapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size || W0=result
|-
| 0x76 || [[#svcQueryProcessMemory]] || X0=meminfo_ptr, W2=process_handle, X3=addr || W0=result, W1=pageinfo
|-
| 0x77 || [[#svcMapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x78 || [[#svcUnmapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x79 || [[#svcCreateProcess]] || X1=procinfo_ptr, X2=caps_ptr, W3=cap_num || W0=result, W1=process_handle
|-
| 0x7A || svcStartProcess || W0=process_handle, W1=main_thread_prio, W2=default_cpuid, W3=main_thread_stacksz || W0=result
|-
| 0x7B || svcTerminateProcess || W0=process_handle || W0=result
|-
| 0x7C || [[#svcGetProcessInfo]] || W0=process_handle, W1=[[#ProcessInfoType]] || W0=result, X1=[[#ProcessState]]
|-
| 0x7D || svcCreateResourceLimit || None || W0=result, W1=reslimit_handle
|-
| 0x7E || svcSetResourceLimitLimitValue || W0=reslimit_handle, W1=[[#LimitableResource]], X2=value || W0=result
|-
| 0x7F || svcCallSecureMonitor || X0=smc_sub_id, X1,X2,X3,X4,X5,X6,X7=smc_args || X0,X1,X2,X3,X4,X5,X6,X7=result
|}

== svcSetHeapSize ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || OutAddr
|}
</div>

'''Description:''' Set the process heap to a given Size. It can both extend and shrink the heap.

Size must be a multiple of 0x200000 (2MB).

On success, the heap base-address (which is fixed by kernel, aslr'd) is written to OutAddr.

Uses current process pool partition.

[2.0.0+] Size must be less than or equal to 4GB.

== svcSetMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || Prot
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change permission of page-aligned memory region.

Bit2 of permission (exec) is not allowed. Setting write-only is not allowed either (bit1).

This can be used to move back and forth between ---, r-- and rw-.

== svcSetMemoryAttribute ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || u32 || State0
|-
| (In) W3 || u32 || State1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change attribute of page-aligned memory region.

This is used to turn on/off caching for a given memory area. Useful when talking to devices such as the GPU.

What happens "under the hood" is the "Memory Attribute Indirection Register" index is changed from 2 to 3 in the MMU descriptor.

{| class=wikitable
! State0 || State1 || Action
|-
| 0 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 8 || Set bit3 in [[#MemoryAttribute]].
|}

== svcMapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps a memory range into a different range.

Mainly used for adding guard pages around stack.

Source range gets reprotected to --- (it can no longer be accessed), and bit0 is set in the source [[#MemoryAttribute]].

[1.0.0] This could be used to map into either the Alias Region or the Stack region.

[2.0.0+] This can only be used to map into the Stack region.

Code can get the range of the Alias region from [[#svcGetInfo]] id0=2,3, and on 2.0.0+ the range of the Stack region via [[#svcGetInfo]] id0=14, 15 (on 1.0.0, the Stack region had hardcoded limits).

When mapped into the Alias region, the mapped memory will have state 0x482907.

When mapped into the Stack region, the mapped memory will have state 0x5C3C0B.

== svcUnmapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps a region that was previously mapped with [[#svcMapMemory]].

It's possible to unmap ranges partially, you don't need to unmap the entire range "in one go".

The srcaddr/dstaddr must match what was given when the pages were originally mapped.

== svcQueryMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfo
|-
| (In) X2 || void* || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

'''Description:''' Query information about an address. Will always fetch the lowest page-aligned mapping that contains the provided address.

Outputs a [[#MemoryInfo]] struct.

== svcExitProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current process.

== svcCreateThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void(*)(void*) || Entry
|-
| (In) X2 || void* || ThreadContext
|-
| (In) X3 || void* || StackTop
|-
| (In) W4 || u32 || Priority
|-
| (In) W5 || u32 || ProcessorId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Thread> || Handle
|}
</div>

'''Description:''' Create a thread in the current process.

Processor_id must be 0,1,2,3 or -2, where -2 uses the default cpuid for process.

== svcStartThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) None || ||
|}
</div>

'''Description:''' Starts the thread for the provided handle.

== svcExitThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current thread.

== svcSleepThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || s64 || Nanoseconds
|-
|}
</div>

'''Description:''' Sleep for a specified amount of time, or yield thread.

Setting nanoseconds to 0, -1, or -2 indicates a yielding type.

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Value || Type
|-
| 0 || Yielding without core migration
|-
| -1 || Yielding with core migration
|-
| -2 || Yielding to any other thread
|-
|}
</div>

== svcGetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1|| Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || Priority
|}
</div>

'''Description:''' Get priority of provided thread handle.

== svcSetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0|| Handle<Thread> || Handle
|-
| (In) W1|| u32 || Priority
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set priority of provided thread handle.

Priority is a number 0-0x3F. Lower value means higher priority.

== svcGetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W2 || Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u32 || Out0
|-
| (Out) X2 || u64 || Out1
|}
</div>

'''Description:''' Get affinity mask of provided thread handle.

== svcSetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (In) W1 || u32 || In0
|-
| (In) X2 || u64 || In1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set affinity mask of provided thread handle.

== svcGetCurrentProcessorNumber ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0/X0 || u64 || CpuId
|}
</div>

'''Description:''' Get which cpu is executing the current thread.

Cpu-id is an integer in the range 0-3.

== svcMapSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<SharedMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the block supplied by the handle. The required permissions are different for the process that created the handle and all other processes.

Increases reference count for the KSharedMemory object. Thus in order to release the memory associated with the object, all handles to it must be closed and all mappings must be unmapped.

== svcCreateTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<TransferMemory> || Handle
|}
</div>

This one reprotects the src block with perms you give it. It also sets bit0 into [[#MemoryAttribute]].

Executable bit perm not allowed.

Closing all handles automatically causes the bit0 in [[#MemoryAttribute]] to clear, and the permission to reset.

== svcWaitSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || Handle* || HandlesPtr
|-
| (In) W2 || u64 || HandlesNum
|-
| (In) X3 || u64 || Timeout
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || HandleIndex
|}
</div>

Works with num_handles <= 0x40.

When zero handles are passed, this will wait forever until either timeout or cancellation occurs.

Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.

=== Object types ===

'''KDebug:''' signals when there is a new [[#DebugEventInfo|DebugEvent]] (retrievable via [[#svcGetDebugEvent]]).

'''KClientPort:''' signals when the number of sessions is less than the maximum allowed.

'''KProcess:''' signals when the process undergoes a state change (retrievable via [[#svcGetProcessInfo]]).

'''KReadableEvent:''' signals when the event's corresponding KWritableEvent has been signaled via svcSignalEvent.

'''KServerPort:''' signals when there is an incoming connection waiting to be [[#svcAcceptSession|accepted]].

'''KServerSession:''' signals when there is an incoming message waiting to be [[#svcReplyAndReceive|received]] or the pipe is closed.

'''KThread:''' signals when the thread has exited.

=== Result codes ===

'''0x0:''' Success. One of the objects was signaled before the timeout expired, or one of the objects is a Session with a closed remote. Handle index is updated to indicate which object signaled.

'''0x7601:''' Thread termination requested. Handle index is not updated.

'''0xe401:''' Invalid handle. Returned when one of the handles passed is invalid. Handle index is not updated.

'''0xe601:''' Invalid address. Returned when the handles pointer is not a readable address. Handle index is not updated.

'''0xea01:''' Timeout. Returned when no objects have been signaled within the timeout. Handle index is not updated.

'''0xec01:''' Interrupted. Returned when another thread uses [[#svcCancelSynchronization]] to cancel this thread. Handle index is not updated.

'''0xee01:''' Too many handles. Returned when the number of handles passed is > 0x40.

== svcCancelSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

If the referenced thread is currently in a synchronization call ([[#svcWaitSynchronization]], [[#svcReplyAndReceive]] or [[#svcReplyAndReceiveLight]]), that call will be interrupted and return 0xec01.
If that thread is not currently executing such a synchronization call, the next call to a synchronization call will return 0xec01.

This doesn't take force-pause (activity/debug pause) into account.

=== Result codes ===

'''0x0:''' Success. The thread was either interrupted or has had its flag set.

'''0xe401:''' Invalid handle. The handle given was either invalid or not a thread handle.

== svcGetSystemTick ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (Out) X0 || u64 || Ticks
|}
</div>

Returns the value of cntpct_el0.

The frequency is 19200000 Hz (constant from official sw).

Official sw reads cntpct_el0 directly from usermode without using this SVC. [[ExeFS|sdk-nso]] has this SVC, but it's not known to be called anywhere.

== svcSendSyncRequestWithUserBuffer ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || CmdPtr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || Handle<Session> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size and CmdPtr must be 0x1000-aligned.

=== Result codes ===

'''0x0:''' Success.

'''0xcc01:''' CmdPtr is not 0x1000-aligned.

'''0xca01:''' Size is not 0x1000-aligned.

'''0xce01:''' KSessionRequest allocation failed (unlikely) or pointer buffer size exceeded.

'''0xe401:''' Handles does not exist, or handle is not an instance of KClientSession.

== svcBreak ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || Break Reason
|-
| (In) X1 || u64 ||
|-
| (In) X2 || u64 || Info
|-
| (Out) W0 || Result || 0 (Success)
|}
</div>

If the process is attached, report the Break event. Then, if svcContinueDebugEvent didn't apply IgnoreException on the thread: if TPIDR_EL0 is 0, adjust ELR_EL1 to retry to svc instruction (and set TPIDR_EL0 to 1).

Otherwise, if bit31 in reason isn't set, perform crash reporting (see Exception Handling section below), if it doesn't terminate the process adjust ELR_EL1 as well.

Otherwise just return 0.

== svcGetInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Process || 0 || 0 || AllowedCpuIdBitmask
|-
| Process || 1 || 0 || AllowedThreadPrioBitmask
|-
| Process || 2 || 0 || AliasRegionBaseAddr
|-
| Process || 3 || 0 || AliasRegionSize
|-
| Process || 4 || 0 || HeapRegionBaseAddr
|-
| Process || 5 || 0 || HeapRegionSize
|-
| Process || 6 || 0 || TotalMemoryAvailable. Total memory available(free+used).
|-
| Process || 7 || 0 || TotalMemoryUsage. Total used size of codebin memory + main-thread stack + allocated heap.
|-
| Zero || 8 || 0 || IsCurrentProcessBeingDebugged
|-
| Zero || 9 || 0 || Returns ResourceLimit handle for current process. Used by [[Process_Manager_services|PM]].
|-
| Zero || 10 || -1, {current coreid} || IdleTickCount
|-
| Zero || 11 || 0-3 || RandomEntropy from current process. TRNG. Used to seed usermode PRNGs.
|-
| Process || 12 || 0 || [2.0.0+] AddressSpaceBaseAddr
|-
| Process || 13 || 0 || [2.0.0+] AddressSpaceSize
|-
| Process || 14 || 0 || [2.0.0+] StackRegionBaseAddr
|-
| Process || 15 || 0 || [2.0.0+] StackRegionSize
|-
| Process || 16 || 0 || [3.0.0+] PersonalMmHeapSize
|-
| Process || 17 || 0 || [3.0.0+] PersonalMmHeapUsage
|-
| Process || 18 || 0 || [3.0.0+] TitleId
|-
| Zero || 19 || 0 || [4.0.0-4.1.0] PrivilegedProcessId_LowerBound
|-
| Zero || 19 || 1 || [4.0.0-4.1.0] PrivilegedProcessId_UpperBound
|-
| Process || 20 || 0 || [5.0.0+] UserExceptionContextAddr
|-
| Process || 21 || 0 || [6.0.0+] TotalMemoryAvailableWithoutMmHeap
|-
| Process || 22 || 0 || [6.0.0+] TotalMemoryUsedWithoutMmHeap
|-
| Thread || 0xF0000002 || 0 || Scheduler related.
|}

== svcMapPhysicalMemory ==
This is like svcSetHeapSize except you can allocate heap at any address you'd like.

Uses current process pool partition.

== svcDumpInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

Does nothing, just returns with registers set to all-zero.

== svcAcceptSession ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || Handle<Port> || Port
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ServerSession> || Session
|}
</div>

=== Result codes ===

'''0xf201:''' No session waiting to be accepted

== svcReplyAndReceive ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || *Handle<Port or ServerSession> || Handles
|-
| (In) W2 || u32 || NumHandles
|-
| (In) W3 || Handle<ServerSession> || ReplyTarget
|-
| (In) X4 || u64 (nanoseconds) || Timeout
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || u32 || HandleIndex
|}
</div>

If ReplyTarget is not zero, a reply from the TLS will be sent to that session.
Then it will wait until either of the passed sessions has an incoming message, is closed, a passed port has an incoming connection, or the timeout expires.
If there is an incoming message, it is copied to the TLS.

If ReplyTarget is zero, the TLS should contain a blank message. If this message has a C descriptor, the buffer it points to will be used as the pointer buffer. See [[IPC_Marshalling#IPC_buffers]]. Note that a pointer buffer cannot be specified if ReplyTarget is not zero.

After being validated, passed handles will be enumerated in order; even if a session has been closed, if one that appears earlier in the list has an incoming message, it will take priority and a result code of 0x0 will be returned.

=== Result codes ===

'''0x0:''' Success. Either a session has an incoming message or a port has an incoming connection. HandleIndex is set appropriately.

'''0xea01:''' Timeout. No handles were signalled before the timeout expired. HandleIndex is not updated.

'''0xf601:''' Port remote dead. One of the sessions has been closed. HandleIndex is set appropriately.

== svcMapPhysicalMemoryUnsafe ==
Same as [[#svcMapPhysicalMemory]] except it always uses pool partition 0.

== svcCreateCodeMemory ==
Takes an address range with backing memory to create the code memory object.

The memory is initially memset to 0xFF after being locked.

== svcControlCodeMemory ==
Maps the backing memory for a Code memory object into the current process.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapOwner]], memory permission must be RW-.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapSlave]], memory permission must be R-- or R-X.

Operations [[#CodeMemoryOperation|CodeMemoryOperation_UnmapOwner/CodeMemoryOperation_UnmapSlave]] unmap memory that was previously mapped this way.

This allows one "secure JIT" process to map the code memory as RW-, and the other "slave" process to map it R-X.

[5.0.0+] Error 0xE401 is now returned when the process owner of the Code memory object is the same as the current process.

== svcReadWriteRegister ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || RegAddr
|-
| (In) W2 || u64 || RwMask
|-
| (In) W3 || u64 || InValue
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1|| u64 || OutValue
|}
</div>

Read/write IO registers with a hardcoded whitelist. Input address is physical-address and must be aligned to 4.

rw_mask is 0 for reading and 0xffffffff for writing. You can also write individual bits by using a mask value.

You can only write to registers inside physical pages 0x70019000 (MC), 0x7001C000 (MC0), 0x7001D000 (MC1), and they all share the same whitelist.

The whitelist is same for writing as for reading.

The whitelist is:

0x054, 0x090, 0x094, 0x098, 0x09c, 0x0a0, 0x0a4, 0x0a8, 0x0ac, 0x0b0, 0x0b4, 0x0b8, 0x0bc, 0x0c0, 0x0c4, 0x0c8, 0x0d0, 0x0d4, 0x0d8, 0x0dc, 0x0e0, 0x100, 0x108, 0x10c, 0x118, 0x11c, 0x124, 0x128, 0x12c, 0x130, 0x134, 0x138, 0x13c, 0x158, 0x15c, 0x164, 0x168, 0x16c, 0x170, 0x174, 0x178, 0x17c, 0x200, 0x204, 0x2e4, 0x2e8, 0x2ec, 0x2f4, 0x2f8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37c, 0x380, 0x390, 0x394, 0x398, 0x3ac, 0x3b8, 0x3bc, 0x3c0, 0x3c4, 0x3d8, 0x3e8, 0x41c, 0x420, 0x424, 0x428, 0x42c, 0x430, 0x44c, 0x47c, 0x480, 0x484, 0x50c, 0x554, 0x558, 0x55c, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69c, 0x6a0, 0x6a4, 0x6c0, 0x6c4, 0x6f0, 0x6f4, 0x960, 0x970, 0x974, 0xa20, 0xa24, 0xb88, 0xb8c, 0xbc4, 0xbc8, 0xbcc, 0xbd0, 0xbd4, 0xbd8, 0xbdc, 0xbe0, 0xbe4, 0xbe8, 0xbec, 0xc00, 0xc5c, 0xcac

[2.0.0+] Whitelist was extended with 0x4c4, 0x4c8, 0x4cc, 0x584, 0x588, 0x58c.

[2.0.0+] The IO registers in range 0x7000E400 (PMC) size 0xC00 skip the whitelist, and do a TrustZone call using [[SMC]] Id1 0xC3000008(ReadWriteRegister).

[4.0.0+] Access to the Memory Controller (0x70019000) also uses smcReadWriteRegister.

Here is the whitelist imposed by that SMC, relative to the start of the PMC registers:

0x000, 0x00c, 0x010, 0x014, 0x01c, 0x020, 0x02c, 0x030, 0x034, 0x038, 0x03c, 0x040, 0x044, 0x048, 0x0dc, 0x0e0, 0x0e4, 0x160, 0x164, 0x168, 0x170, 0x1a8, 0x1b8, 0x1bc, 0x1c0, 0x1c4, 0x1c8, 0x2b4, 0x2d4, 0x440, 0x4d8

Here is the whitelist imposed by smcReadWriteRegister (checked in addition to the whitelist in svcReadWriteRegister), relative to the start of the MC registers:

0x000, 0x004, 0x008, 0x00C, 0x010, 0x01C, 0x020, 0x030, 0x034, 0x050, 0x054, 0x090, 0x094, 0x098, 0x09C, 0x0A0, 0x0A4, 0x0A8, 0x0AC, 0x0B0, 0x0B4, 0x0B8, 0x0BC, 0x0C0, 0x0C4, 0x0C8, 0x0D0, 0x0D4, 0x0D8, 0x0DC, 0x0E0, 0x100, 0x108, 0x10C, 0x118, 0x11C, 0x124, 0x128, 0x12C, 0x130, 0x134, 0x138, 0x13C, 0x158, 0x15C, 0x164, 0x168, 0x16C, 0x170, 0x174, 0x178, 0x17C, 0x200, 0x204, 0x238, 0x240, 0x244, 0x250, 0x254, 0x258, 0x264, 0x268, 0x26C, 0x270, 0x274, 0x280, 0x284, 0x288, 0x28C, 0x294, 0x2E4, 0x2E8, 0x2EC, 0x2F4, 0x2F8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37C, 0x380, 0x390, 0x394, 0x398, 0x3AC, 0x3B8, 0x3BC, 0x3C0, 0x3C4, 0x3D8, 0x3E8, 0x41C, 0x420, 0x424, 0x428, 0x42C, 0x430, 0x44C, 0x47C, 0x480, 0x484, 0x4C4, 0x4C8, 0x4CC, 0x50C, 0x554, 0x558, 0x55C, 0x584, 0x588, 0x58C, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69C, 0x6A0, 0x6A4, 0x6C0, 0x6C4, 0x6F0, 0x6F4, 0x960, 0x970, 0x974, 0x9B8, 0xA20, 0xA24, 0xA88, 0xA94, 0xA98, 0xA9C, 0xAA0, 0xAA4, 0xAA8, 0xAAC, 0xAB0, 0xAB4, 0xAB8, 0xABC, 0xAC0, 0xAC4, 0xAC8, 0xACC, 0xAD0, 0xAD4, 0xAD8, 0xADC, 0xAE0, 0xB88, 0xB8C, 0xBC4, 0xBC8, 0xBCC, 0xBD0, 0xBD4, 0xBD8, 0xBDC, 0xBE0, 0xBE4, 0xBE8, 0xBEC, 0xC00, 0xC5C, 0xCAC

== svcCreateSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || LocalPerm
|-
| (In) W3 || [[#Permission]] || RemotePerm
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<SharedMemory> || MemHandle
|}
</div>

Other perm can be used to enforce permission 1, 3, or 0x10000000 if don't care.

Allocates memory from the current process' pool partition.

== svcMapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

The newly mapped pages will have [[#MemoryState]] type 0xE.

You must pass same size and permissions as given in svcCreateMemoryMirror, otherwise error.

== svcUnmapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must match size given in map syscall, otherwise there's an invalid-size error.

== svcCreateInterruptEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || IrqNum
|-
| (In) W2 || bool || Flags
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<ReadableEvent> || ReadableEventHandle
|}
</div>

Create an event handle for the given IRQ number. Waiting on this handle will wait until the IRQ is triggered. The flags argument configures the triggering. If it is false, the IRQ is active HIGH level sensitive, if it is true it is rising-edge sensitive.

=== Result codes ===

'''0x0:''' Success.

'''0xF001:''' Flags was > 1

'''0xF201:''' IRQ above 0x3FF or outside the [[NPDM#Kernel_Access_Control|IRQ access mask]] was given.

'''0xCE01:''' A SlabHeap was exhausted (too many interrupts created).

'''0xF401:''' IRQ already has an event registered.

'''0xD201:''' The handle table is full. Try closing some handles.

== svcQueryPhysicalAddress ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || Addr
|-
| (Out) W0 || [[#Result]]|| Ret
|-
| (Out) X1 || u64 || PhysAddr
|-
| (Out) X2 || u64 || KernelAddr
|-
| (Out) X3 || u64 || Size
|}
</div>

== svcQueryIoMapping ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || PhysAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || void* || VirtAddr
|}
</div>

'''Description:''' Returns a virtual address mapped to a given IO range.

== svcCreateDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || StartAddr
|-
| (In) X2 || u64 || EndAddr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<DeviceAddressSpace> || AddressSpaceHandle
|}
</div>

'''Description:''' Creates a virtual address space for binding device address spaces and returns a handle.

dev_as_start_addr is normally set to 0 and dev_as_end_addr is normally set to 0xFFFFFFFF.

== svcAttachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Attaches a device address space to a [[#DeviceName|device]].

== svcDetachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Detaches a device address space from a [[#DeviceName|device]].

== svcMapDeviceAddressSpaceByForce ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (In) W5 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

dev_map_addr is the userspace destination address, while dev_as_addr is the source address between dev_as_start_addr and dev_as_end_addr (passed to [[#svcCreateDeviceAddressSpace]]).

The userspace destination address must have the [[SVC#MemoryState|MapDeviceAllowed]] bit set. Bit [[SVC#MemoryAttribute|IsDeviceMapped]] will be set after mapping.

== svcMapDeviceAddressSpaceAligned ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (In) W5 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

Same as [[#svcMapDeviceAddressSpaceByForce]], but the userspace destination address must have the [[SVC#MemoryState|MapDeviceAlignedAllowed]] bit set instead.

== svcUnmapDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps an attached device address space from an userspace address.

== svcContinueDebugEvent ==

=== Result codes ===

'''0x0:''' Success. The process has been resumed.

'''0xe401:''' Invalid debug handle.

'''0xf401:''' Process has debug events queued.

== svcGetSystemInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Zero || 0 || 0 || TotalMemorySize_Application
|-
| Zero || 0 || 1 || TotalMemorySize_Applet
|-
| Zero || 0 || 2 || TotalMemorySize_System
|-
| Zero || 0 || 3 || TotalMemorySize_SystemUnsafe
|-
| Zero || 1 || 0 || CurrentMemorySize_Application
|-
| Zero || 1 || 1 || CurrentMemorySize_Applet
|-
| Zero || 1 || 2 || CurrentMemorySize_System
|-
| Zero || 1 || 3 || CurrentMemorySize_SystemUnsafe
|-
| Zero || 2 || 0 || PrivilegedProcessId_LowerBound
|-
| Zero || 2 || 1 || PrivilegedProcessId_UpperBound
|-
|}

== svcSetProcessMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || void* || Perm
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

This sets the memory permissions for the specified memory with the supplied process handle.

This throws an error(0xD801) when the input perm is >0x5, hence -WX and RWX are not allowed.

== svcMapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || DstAddr
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the src address from the supplied process handle into the current process.

This allows mapping code and rodata with RW- permission.

== svcUnmapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessMemory]].

== svcQueryProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfoPtr
|-
| (In) W2 || Handle<Process> || ProcessHandle
|-
| (In) X3 || u64 || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

Equivalent to [[#svcQueryMemory]] except takes a process handle.

== svcMapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Takes a process handle, and maps normal heap in that process as executable code in that process. Used when loading NROs. This does not support using the current-process handle alias.

== svcUnmapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessCodeMemory]].

== svcCreateProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#CreateProcessInfo]]* || InfoPtr
|-
| (In) X2 || u32* || CapabilitiesPtr
|-
| (In) X3 || u64 || CapabilitiesNum
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Process> || ProcessHandle
|}
</div>

Takes a [[#CreateProcessInfo]] as input.
CapabilitiesPtr points to an array of [[NPDM#Kernel_Access_Control|kernel capabilities]].
CapabilitiesNum is a number of capabilities in the CapabilitiesPtr array (number of element, not number of bytes).

=== Result codes ===

'''0x0:''' Success.

'''0xCA01:''' Attempted to map more code pages than available in address space.

'''0xCC01:''' Provided CodeAddr is invalid (make sure it's in range?)

'''0xE401:''' The resource handle passed is invalid.

'''0xE601:''' Attempt to copy procinfo from user-supplied pointer failed. Attempt to copy capabilities_num from user-supplied pointer failed.

'''0xE801:''' Attempted to create a 32-bit process with a 36-bit address space.

'''0xF001:''' Unused bits are set in mmuflags. Unknown address space type used.

== svcGetProcessInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || [[#ProcessState]] || State
|}
</div>

Returns an enum with value 0-7.

== Debugging ==
[2.0.0+] Exactly 6 debug SVCs require that [[SPL_services#GetConfig|IsDebugMode]] is non-zero. Error 0x4201 is returned otherwise.
* svcBreakDebugProcess
* svcContinueDebugEvent
* svcWriteDebugProcessMemory
* svcSetDebugThreadContext
* svcTerminateDebugProcess
* svcSetHardwareBreakPoint

svcDebugActiveProcess stops execution of the target process, the normal method for resuming it requires svcContinueDebugEvent(see above). Closing the debug handle also results in execution being resumed.

== svcSetHardwareBreakPoint ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || u32 || hardware_breakpoint_id
|-
| (In) W1 || u64 || flags
|-
| (In) W2 || u64 || value
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Sets one of the AArch64 hardware breakpoints. The nintendo switch has 6 hardware breakpoints, and 4 hardware watchpoints. The syscall has two behaviors depending on the value of hardware_breakpoint_id:

If hardware_breakpoint_id < 0x10, then it sets one of the AArch64 hardware breakpoints. Flags will go to DBGBCRn_EL1, and value to DBGBVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0x7F01E1. Furthermore, the kernel will or it with 0x4004, in order to set various security flags to guarantee the watchpoints only triggers for code in EL0. If the user asks for a Breakpoint Type of ContextIDR match, the kernel shall use the given debug_handle to set DBGBVRn_EL1 to the ContextID of the debugged process.

If hardware_breakpoint_id is between 0x10 and 0x20 (exclusive), then it sets one of the AArch64 hardware watchpoints. Flags will go to DBGWCRn_EL1, and the value to DBGWVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0xFF0F1FF9. Furthermore, the kernel will or it with 0x104004. This will set various security flags, and set the watchpoint type to be a Linked Watchpoint. This means that you need to link it to a Linked ContextIDR breakpoint. Check the ARM documentation for more information.

Note that hardware_breakpoint_id 0 to 4 match only to Virtual Address, while hardware_breakpoint_id 5 and 6 match against either Virtual Address, ContextID, or VMID. As such, if you are configuring a breakpoint to link for a watchpoint, make sure you use hardware_breakpoint_id 5 or 6.

For more documentation for hardware breakpoints, check out the AArch64 documentation for the [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0488h/way1382455558968.html DBGBCRn_EL1 register] and the [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0488h/way1382455560629.html DBGWCRn_EL1 register]

= Enum/Structures =
== ThreadContextRequestFlags ==
Bitfield of one of more of these:

{| class=wikitable
! Bit || Bitmask || Name
|-
| 0 || 1 || NormalContext
|-
| 1 || 2 ||
|-
| 2 || 4 ||
|-
| 3 || 8 ||
|}

== DeviceName ==
{| class=wikitable
! Value || Name
|-
| 0 || DeviceName_AFI
|-
| 1 || DeviceName_AVPC
|-
| 2 || DeviceName_DC
|-
| 3 || DeviceName_DCB
|-
| 4 || DeviceName_HC
|-
| 5 || DeviceName_HDA
|-
| 6 || DeviceName_ISP2
|-
| 7 || DeviceName_MSENCNVENC
|-
| 8 || DeviceName_NV
|-
| 9 || DeviceName_NV2
|-
| 10 || DeviceName_PPCS
|-
| 11 || DeviceName_SATA
|-
| 12 || DeviceName_VI
|-
| 13 || DeviceName_VIC
|-
| 14 || DeviceName_XUSB_HOST
|-
| 15 || DeviceName_XUSB_DEV
|-
| 16 || DeviceName_TSEC
|-
| 17 || DeviceName_PPCS1
|-
| 18 || DeviceName_DC1
|-
| 19 || DeviceName_SDMMC1A
|-
| 20 || DeviceName_SDMMC2A
|-
| 21 || DeviceName_SDMMC3A
|-
| 22 || DeviceName_SDMMC4A
|-
| 23 || DeviceName_ISP2B
|-
| 24 || DeviceName_GPU
|-
| 25 || DeviceName_GPUB
|-
| 26 || DeviceName_PPCS2
|-
| 27 || DeviceName_NVDEC
|-
| 28 || DeviceName_APE
|-
| 29 || DeviceName_SE
|-
| 30 || DeviceName_NVJPG
|-
| 31 || DeviceName_HC1
|-
| 32 || DeviceName_SE1
|-
| 33 || DeviceName_AXIAP
|-
| 34 || DeviceName_ETR
|-
| 35 || DeviceName_TSECB
|-
| 36 || DeviceName_TSEC1
|-
| 37 || DeviceName_TSECB1
|-
| 38 || DeviceName_NVDEC1
|}

== CodeMemoryOperation ==
{| class=wikitable
! Value || Name
|-
| 0 || CodeMemoryOperation_MapOwner
|-
| 1 || CodeMemoryOperation_MapSlave
|-
| 2 || CodeMemoryOperation_UnmapOwner
|-
| 3 || CodeMemoryOperation_UnmapSlave
|}

== LimitableResource ==
{| class=wikitable
! Value || Name
|-
| 0 || LimitableResource_Memory
|-
| 1 || LimitableResource_Threads
|-
| 2 || LimitableResource_Events
|-
| 3 || LimitableResource_TransferMemories
|-
| 4 || LimitableResource_Sessions
|}

== ProcessInfoType ==

{| class=wikitable
! Value || Name
|-
| 0 || [[#ProcessState|ProcessInfoType_ProcessState]]
|-
|}

== ProcessState ==
{| class=wikitable
! Value || Name || Notes
|-
| 0 || ProcessState_Created ||
|-
| 1 || ProcessState_CreatedAttached ||
|-
| 2 || ProcessState_Started ||
|-
| 3 || ProcessState_Crashed || Processes will not enter this state unless they were created with [[#CreateProcessInfo|EnableDebug]].
|-
| 4 || ProcessState_StartedAttached ||
|-
| 5 || ProcessState_Exiting ||
|-
| 6 || ProcessState_Exited ||
|-
| 7 || ProcessState_DebugSuspended ||
|}

== DebugThreadParam ==
{| class=wikitable
! Value || Name
|-
| 0 || DebugThreadParam_DynamicPriority
|-
| 1 || DebugThreadParam_SchedulingStatus
|-
| 2 || DebugThreadParam_PreferredCpuCore
|-
| 3 || DebugThreadParam_CurrentCpuCore
|-
| 4 || DebugThreadParam_AffinityMask
|}

Dynamic priority: output in out2

Scheduling status: out1 contains bit0: is debug-suspended, bit1: is user-suspended (svcSetThreadActivity 1 or svcSetProcessActivity 1).
Out2 contains {suspended, idle, running, terminating} => {5, 0, 1, 4}

DebugThreadParam_PreferredCpuCore: output in out2

DebugThreadParam_CurrentCpuCore: output in out2

DebugThreadParam_AffinityMask: output in out1

== CreateProcessInfo ==
{| class=wikitable
! Offset || Length || Bits || Description
|-
| 0 || 12 || || ProcessName (doesn't have to be null-terminated)
|-
| 0x0C || 4 || || ProcessCategory (0: regular title, 1: kernel built-in)
|-
| 0x10 || 8 || || TitleId
|-
| 0x18 || 8 || || CodeAddr
|-
| 0x20 || 4 || || CodeNumPages
|-
| 0x24 || 4 || || MmuFlags
|-
| || || Bit0 || IsAarch64
|-
| || || Bit3-1 || [[#AddressSpaceType]]
|-
| || || Bit4 || [2.0.0+] EnableDebug
|-
| || || Bit5 || EnableAslr
|-
| || || Bit6 || UseSystemMemBlocks
|-
| || || Bit7 || [4.0.0] ?
|-
| || || Bit10-7 || [5.0.0+] PoolPartition (0=Application, 1=Applet, 2=Sysmodule, 3=Nvservices)
|-
| || || Bit11 || [7.0.0+] Only allowed in combination with bit6.
|-
| 0x28 || 4 || || ResourceLimitHandle or zero
|-
| 0x2C || 4 || || [3.0.0+] PersonalMmHeapNumPages
|}

On [1.0.0] there's only one pool.

On [2.0.0-4.0.0] PoolPartition is 1 for built-ins and 0 for rest.

On [5.0.0] PoolPartition is specified in CreateProcessArgs. There are now 4 pool partitions.

On [5.0.0] (maybe lower?) a zero ResourceLimitHandle defaults to sysmodule limits and 0x12300000 bytes of memory.

The PersonalMmHeap are allocated as follows:
* For the application, normal insecure pool is used. Carveout 5 is used to provide protection.
* For the applet, a pre-allocated secure pool segment of size 0x40000 is used.
* For sysmodules, secure pool is allocated.

=== AddressSpaceType ===
{| class=wikitable
! Type || Name || Width || Description
|-
| 0 || Normal_32Bit || 32 ||
|-
| 1 || Normal_36Bit || 36 ||
|-
| 2 || WithoutMap_32Bit || 32 || Appears to be missing map region [?]
|-
| 3 || [2.0.0+] Normal_39Bit || 39 ||
|}

== MemoryInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || 8 || BaseAddress
|-
| 8 || 8 || Size
|-
| 0x10 || 4 || MemoryType: lower 8 bits of [[#MemoryState]]
|-
| 0x14 || 4 || [[#MemoryAttribute]]
|-
| 0x18 || 4 || Permission (bit0: R, bit1: W, bit2: X)
|-
| 0x1C || 4 || IpcRefCount
|-
| 0x20 || 4 || DeviceRefCount
|-
| 0x24 || 4 || Padding: always zero
|}

== MemoryAttribute ==
{| class=wikitable
! Bits || Description
|-
| 0 || IsBorrowed
|-
| 1 || IsIpcMapped: when IpcRefCount > 0.
|-
| 2 || IsDeviceMapped: when DeviceRefCount > 0.
|-
| 3 || IsUncached
|}

== MemoryState ==
{| class=wikitable
! Bits || Description
|-
| 7-0 || Type
|-
| 8 || [[#svcSetMemoryPermission|PermissionChangeAllowed]]
|-
| 9 || ForceReadWritableByDebugSyscalls
|-
| 10 || IpcSendAllowed_Type0
|-
| 11 || IpcSendAllowed_Type3
|-
| 12 || IpcSendAllowed_Type1
|-
| 14 || [[#svcSetProcessMemoryPermission|ProcessPermissionChangeAllowed]]
|-
| 15 || [[#svcMapMemory|MapAllowed]]
|-
| 16 || [[#svcUnmapProcessCodeMemory|UnmapProcessCodeMemoryAllowed]]
|-
| 17 || [[#svcCreateTransferMemory|TransferMemoryAllowed]]
|-
| 18 || [[#svcQueryPhysicalAddress|QueryPhysicalAddressAllowed]]
|-
| 19 || MapDeviceAllowed ([[#svcMapDeviceAddressSpace]] and [[#svcMapDeviceAddressSpaceByForce]])
|-
| 20 || [[#svcMapDeviceAddressSpaceAligned|MapDeviceAlignedAllowed]]
|-
| 21 || [[#svcSendSyncRequestWithUserBuffer|IpcBufferAllowed]]
|-
| 22 || IsPoolAllocated/IsReferenceCounted
|-
| 23 || [[#svcMapProcessMemory|MapProcessAllowed]]
|-
| 24 || [[#svcSetMemoryAttribute|AttributeChangeAllowed]]
|-
| 25 || [4.0.0+] CodeMemoryAllowed
|}

{| class=wikitable
! Value || Type || Meaning
|-
| 0x00000000 || MemoryType_Unmapped ||
|-
| 0x00002001 || MemoryType_Io || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00042002 || MemoryType_Normal || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00DC7E03 || MemoryType_CodeStatic || Mapped during [[#svcCreateProcess]].
|-
| [1.0.0+]

0x01FEBD04

[4.0.0+]

0x03FEBD04
|| MemoryType_CodeMutable || Transition from 0xDC7E03 performed by [[#svcSetProcessMemoryPermission]].
|-
| [1.0.0+]
0x017EBD05

[4.0.0+]

0x037EBD05
|| MemoryType_Heap || Mapped using [[#svcSetHeapSize]].
|-
| 0x00402006 || MemoryType_SharedMemory || Mapped using [[#svcMapSharedMemory]].
|-
| 0x00482907 || [1.0.0] MemoryType_Alias || Mapped using [[#svcMapMemory]].
|-
| 0x00DD7E08 || MemoryType_ModuleCodeStatic || Mapped using [[#svcMapProcessCodeMemory]].
|-
| [1.0.0+]

0x01FFBD09

[4.0.0+]

0x03FFBD09
|| MemoryType_ModuleCodeMutable || Transition from 0xDD7E08 performed by [[#svcSetProcessMemoryPermission]].
|-
| 0x005C3C0A || [[IPC_Marshalling|MemoryType_IpcBuffer0]] || IPC buffers with descriptor flags=0.
|-
| 0x005C3C0B || MemoryType_Stack || Mapped using [[#svcMapMemory]].
|-
| 0x0040200C || [[Thread Local Storage|MemoryType_ThreadLocal]] || Mapped during [[#svcCreateThread]].
|-
| 0x015C3C0D || MemoryType_TransferMemoryIsolated || Mapped using [[#svcMapTransferMemory]] when the owning process has perm=0.
|-
| 0x005C380E || MemoryType_TransferMemory || Mapped using [[#svcMapTransferMemory]] when the owning process has perm!=0.
|-
| 0x0040380F || MemoryType_ProcessMemory || Mapped using [[#svcMapProcessMemory]].
|-
| 0x00000010 || MemoryType_Reserved ||
|-
| 0x005C3811 || [[IPC_Marshalling|MemoryType_IpcBuffer1]] || IPC buffers with descriptor flags=1.
|-
| 0x004C2812 || [[IPC_Marshalling|MemoryType_IpcBuffer3]] || IPC buffers with descriptor flags=3.
|-
| 0x00002013 || MemoryType_KernelStack || Mapped in kernel during [[#svcCreateThread]].
|-
| 0x00402214 || [4.0.0+] MemoryType_CodeReadOnly || Mapped in kernel during [[#svcControlCodeMemory]].
|-
| 0x00402015 || [4.0.0+] MemoryType_CodeWritable || Mapped in kernel during [[#svcControlCodeMemory]].
|}

== ArbitrationType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || WaitIfLessThan
|-
| 0x1 || DecrementAndWaitIfLessThan
|-
| 0x2 || WaitIfEqual
|-
|}

== SignalType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || Signal
|-
| 0x1 || SignalAndIncrementIfEqual
|-
| 0x2 || SignalAndModifyBasedOnWaitingThreadCountIfEqual
|-
|}

== ContinueDebugFlagsOld ==
[1.0.0-2.3.0]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: ResumeAllThreads or debug-suspended-thread-id needed)
|-
| 1 || 2 || SwallowException
|-
| 2 || 4 || ResumeAllThreads
|}

== ContinueDebugFlags ==
[3.0.0+]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: doesn't need to be set in the same call than Resume)
|-
| 1 || 2 || DontCatchExceptions
|-
| 2 || 4 || Resume
|-
| 3 || 8 || IgnoreOtherThreadsExceptions
|}

IgnoreExceptionsOfOthers is like IgnoreException but acts on all threads that aren't in the input list. The affected threads are resumed.

Only one of of Resume and IgnoreOtherThreadsExceptions can be set at a time.

If the input number of threads is 0, this means "all threads".

== DebugEventInfo ==

The below table is for the Aarch64 version of the system call. For A32, all u64 fields but title/process/thread id are actually u32, making the structure 0x28-byte-big (0x40 for a64).

Size: 0x40

{| class=wikitable
! Offset || Length || Description
|-
| 0 || u32 || EventType
|-
| 4 || u32 || Flags (bit0: NeedsContinue)
|-
| 8 || u64 || ThreadId
|-
| 0x10 || || PerTypeSpecifics
|}

AttachProcess specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || TitleId
|-
| 0x18 || u64 || ProcessId
|-
| 0x20 || char[12] || ProcessName
|-
| 0x2C || u32 || MmuFlags
|-
| 0x30 || u64 || [5.0.0+] UserExceptionContextAddr
|}

AttachThread specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ThreadId
|-
| 0x18 || u64 || TlsPtr
|-
| 0x20 || u64 || Entrypoint
|}

Exit specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32|| Type (0=PausedThread, 1=RunningThread, 2=ExitedProcess, 3=TerminatedProcess)
|}

Exception specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32 || ExceptionType
|-
| 0x18 || u64 || FaultRegister
|-
| 0x20 || || PerExceptionSpecifics
|}

=== DebugEventType ===
{| class=wikitable
! Value || Name
|-
| 0 || DebugEvent_AttachProcess
|-
| 1 || DebugEvent_AttachThread
|-
| 2 || DebugEvent_ExitProcess
|-
| 3 || DebugEvent_ExitThread
|-
| 4 || DebugEvent_Exception
|}

=== DebugExceptionType ===
{| class=wikitable
! Value || Name
|-
| 0 || Exception_Trap (*)
|-
| 1 || Exception_InstructionAbort
|-
| 2 || Exception_DataAbortMisc (**)
|-
| 3 || Exception_PcSpAlignmentFault
|-
| 4 || Exception_DebuggerAttached
|-
| 5 || Exception_BreakPoint
|-
| 6 || Exception_UserBreak
|-
| 7 || Exception_DebuggerBreak
|-
| 8 || Exception_BadSvcId
|-
| 9 || Exception_SError [not in 1.0.0]
|}

<nowiki>*</nowiki> Undefined instructions, software breakpoints, some other traps.

<nowiki>**</nowiki> Data aborts, FP traps, and everything else that doesn't belong to any of the above.

Trap specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Opcode
|}

BreakPoint specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || IsWatchpoint
|}

UserBreak specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Info0
|-
| 0x28 || u64 || Info1
|-
| 0x30 || u64 || Info2
|}

BadSvcId specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || SvcId
|}

= Exception handling =
First of all, a function that might be called by synchronous exception handler and that is called by the SError handler fetches the exception info, adjusts PC, panics on exceptions taken from EL1, then dispatches the exception.

The dispatcher has two mutually exclusive exception reporting methods:
* by storing information at the start of the process's TLS memregion (TPIDRRO_EL0) and jumping back to the crt0
* by using KDebug

KDebug dispatching is used when at least one of the following conditions are met:
* SMC ConfigItem KernelMemConfig bit 1 is NOT set (it isn't on retail), unless: this is a software or hardware breakpoint, or a watchpoint, or [4.0.0+?] the process is attached and this is a Google PNaCl trap instruction (see LLVM source)
* FAR doesn't point to a valid address in mapped-readable CodeStatic memory (i.e. this is the case for NRO and JIT memory) or this is one of the following exceptions (it particular, that doesn't include FP exceptions occurring in CodeStatic memory):
** Uncategorized
** IllegalState
** SupervisorCallA32
** SupervisorCallA64
** PCAlignment
** SPAlignment
** SError
** BreakpointLowerEl
** SoftwareStepLowerEl (note: no way set single-step flag; not parsed)
** WatchpointLowerEl
** SoftwareBreakpointA32 (note: not parsed)
** SoftwareBreakpointA64 (note: not parsed)

In all other cases the userland-handled exception path is taken.

KDebug path:

If the process is attached, the exception is reported to the KDebug. If the thread was continued using flag IgnoreExceptions, it returns from the exception as if nothing happened.

If the latter is not the case, or if the process isn't attached, proceed to [2.0.0+] crash reporting (or in [1.0.0] just terminate the process):
if EnableDebug is set, and depending on the process state (more than one crash per process isn't permitted) it may signal itself with ProcessState_Crashed so that PM asks NS to start creport so that creport attaches to it and reports the crashes. Otherwise, just terminate.

Userland reporting path and svcReturnFromException:

TLS region start (A64):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x148 || Exception stack
|-
| 0x148 || 0x78 || ExceptionFrameA64
|}

ExceptionFrameA64:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x48 (8*9) || GPRs 0..8.
|-
| 0x48 || 0x8 || lr
|-
| 0x50 || 0x8 || sp
|-
| 0x58 || 0x8 || pc (elr_el1)
|-
| 0x60 || 0x4 || pstate & 0xFF0FFE20
|-
| 0x64 || 0x4 || afsr0
|-
| 0x68 || 0x4 || afsr1
|-
| 0x6C || 0x4 || esr
|-
| 0x70 || 0x8 || far
|}

TLS region start (A32):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x178 || Exception stack
|-
| 0x148 || 0x44 || ExceptionFrameA32
|}

ExceptionFrameA32:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x20 (8*4) || GPRs 0..7.
|-
| 0x20 || 0x4 || sp
|-
| 0x24 || 0x4 || lr
|-
| 0x28 || 0x4 || pc (elr_el1)
|-
| 0x2C || 0x4 || tpidr_el0 = 1
|-
| 0x30 || 0x4 || cpsr & 0xFF0FFE20
|-
| 0x34 || 0x4 || afsr0
|-
| 0x38 || 0x4 || afsr1
|-
| 0x3C || 0x4 || esr
|-
| 0x40 || 0x4 || far
|}

In that case, after storing the regs in the TLS, the exception handler returns to the application's crt0 (entrypoint), with X0=<error description code> (see below) and X1=SP=frame=<stack top> (see above)

{| class=wikitable
! Desc. code || Meaning
|-
| 0x100 || Instruction abort
|-
| 0x102 || Misaligned PC
|-
| 0x103 || Misaligned SP
|-
| 0x106 || SError [not in 1.0.0?]
|-
| 0x301 || Bad SVC
|-
| 0x104 || Uncategorized, CP15RTTrap, CP15RRTTrap, CP14RTTrap, CP14RRTTrap, IllegalState, SystemRegisterTrap
|-
| 0x101 || None of the above, EC <= 0x34 and not a breakpoint
|-
|}

(During normal app boot the process is invoked with X0=0 and X1=main_thread_handle. The crt0 of retail apps determines whether to boot normally or handle an exception if X0 is set to 0 or not)

The application is supposed to promptly update the contents of elr_el1 to a user handler (and any other regs it sees fit) and call svcReturnFromException (error code) to call that handler. The latter is then expected to promptly abort the program.

svcReturnFromException updates the contents of the kernel stack frame with what the user provided in the TLS structure, sets TPIDR_EL0 to 1, then:
* if the provided error code is 0, gracefully pivots and returns from exception
* if it is not, replays the exception and pass it to the KDebug (see above). One can pass 0x10001 to prevent process termination. If the process is attached, this also prevents crash-collection/termination (different from the exception handler behavior)

If an exception occurs from the above user handler, the entire exception handling process will repeat with the new exception.

Note that if a thread that wasn't faulting calls svcReturnFromException, it signals an "invalid syscall" exception

Note that [[SMC|IsDebugMode]] is not used during exception-handling, except for enabling printing a message to UART-A. This UART code causes a system-hang on retail (likely due to a loop that doesn't exit). This printing doesn't seem to run when the process is attached for debugging?

SVC

2019-01-31T00:24:33Z

Qlutoo: /* CreateProcessInfo */

__NOTOC__

= System calls =
{| class=wikitable
! Id || Name || In || Out
|-
| 0x1 || [[#svcSetHeapSize]] || W1=size || W0=result, X1=outaddr
|-
| 0x2 || [[#svcSetMemoryPermission]] || X0=addr, X1=size, W2=prot || W0=result
|-
| 0x3 || [[#svcSetMemoryAttribute]] || X0=addr, X1=size, W2=state0, W3=state1 || W0=result
|-
| 0x4 || [[#svcMapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x5 || [[#svcUnmapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x6 || [[#svcQueryMemory]] || X0=MemoryInfo*, X2=addr || W0=result, W1=PageInfo
|-
| 0x7 || [[#svcExitProcess]] || None ||
|-
| 0x8 || [[#svcCreateThread]] || X1=entry, X2=thread_context, X3=stacktop, W4=prio, W5=processor_id || W0=result, W1=handle
|-
| 0x9 || [[#svcStartThread]] || W0=thread_handle || W0=result
|-
| 0xA || [[#svcExitThread]] || None ||
|-
| 0xB || [[#svcSleepThread]] || X0=nano ||
|-
| 0xC || [[#svcGetThreadPriority]] || W1=thread_handle || W0=result, W1=prio
|-
| 0xD || [[#svcSetThreadPriority]] || W0=thread_handle, W1=prio || W0=result
|-
| 0xE || [[#svcGetThreadCoreMask]] || W2=thread_handle || W0=result, W1=out, X2=out
|-
| 0xF || [[#svcSetThreadCoreMask]] || W0=thread_handle, W1=in, X2=in2 || W0=result
|-
| 0x10 || [[#svcGetCurrentProcessorNumber]] || None || W0/X0=cpuid
|-
| 0x11 || svcSignalEvent || W0=wevent_handle || W0=result
|-
| 0x12 || svcClearEvent || W0=wevent_or_revent_handle || W0=result
|-
| 0x13 || [[#svcMapSharedMemory]] || W0=shmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x14 || svcUnmapSharedMemory || W0=shmem_handle, X1=addr, X2=size || W0=result
|-
| 0x15 || [[#svcCreateTransferMemory]] || X1=addr, X2=size, W3=perm || W0=result, W1=tmem_handle
|-
| 0x16 || svcCloseHandle || W0=handle || W0=result
|-
| 0x17 || svcResetSignal || W0=revent_or_process_handle || W0=result
|-
| 0x18 || [[#svcWaitSynchronization]] || X1=handles_ptr, W2=num_handles. X3=timeout || W0=result, W1=handle_idx
|-
| 0x19 || [[#svcCancelSynchronization]] || W0=thread_handle || W0=result
|-
| 0x1A || svcArbitrateLock || W0=cur_thread_handle, X1=ptr, W2=req_thread_handle ||
|-
| 0x1B || svcArbitrateUnlock || X0=ptr ||
|-
| 0x1C || svcWaitProcessWideKeyAtomic || X0=ptr0, X1=ptr, W2=thread_handle, X3=timeout || W0=result
|-
| 0x1D || svcSignalProcessWideKey || X0=ptr, W1=value || W0=result
|-
| 0x1E || [[#svcGetSystemTick]] || None || X0={value of cntpct_el0}
|-
| 0x1F || svcConnectToNamedPort || X1=port_name_str || W0=result, W1=handle
|-
| 0x20 || svcSendSyncRequestLight || W0=light_session_handle, X1=? || W0=result
|-
| 0x21 || svcSendSyncRequest || X0=normal_session_handle || W0=result
|-
| 0x22 || [[#svcSendSyncRequestWithUserBuffer]] || X0=cmdbufptr, X1=size, X2=handle || W0=result
|-
| 0x23 || svcSendAsyncRequestWithUserBuffer || X1=cmdbufptr, X2=size, X3=handle || W0=result, W1=revent_handle
|-
| 0x24 || svcGetProcessId || W1=thread_or_process_or_debug_handle || W0=result, X1=pid
|-
| 0x25 || svcGetThreadId || W1=thread_handle || W0=result, X1=out
|-
| 0x26 || [[#svcBreak]] || X0=break_reason,X1,X2=info || W0=result = 0
|-
| 0x27 || svcOutputDebugString || X0=str, X1=size || W0=result
|-
| 0x28 || svcReturnFromException || X0=result ||
|-
| 0x29 || [[#svcGetInfo]] || X1=info_id, X2=handle, X3=info_sub_id || W0=result, X1=out
|-
| 0x2A || svcFlushEntireDataCache || None || None
|-
| 0x2B || svcFlushDataCache || X0=addr, X1=size || W0=result
|-
| 0x2C || [3.0.0+] [[#svcMapPhysicalMemory]] || X0=addr, X1=size || W0=result
|-
| 0x2D || [3.0.0+] svcUnmapPhysicalMemory || X0=addr, X1=size || W0=result
|-
| 0x2E || [5.0.0+] svcGetFutureThreadInfo || X3=timeout || W0=result, bunch of crap
|-
| 0x2F || svcGetLastThreadInfo || None || W0=result, W1,W2,W3,W4=unk, W5=truncated_u64, W6=bool
|-
| 0x30 || svcGetResourceLimitLimitValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
|-
| 0x31 || svcGetResourceLimitCurrentValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
|-
| 0x32 || svcSetThreadActivity || W0=thread_handle, W1=bool || W0=result
|-
| 0x33 || svcGetThreadContext3 || X0=[[#ThreadContext]]*, W1=thread_handle || W0=result
|-
| 0x34 || [4.0.0+] svcWaitForAddress || X0=ptr, W1=[[#ArbitrationType]], X2=value X3=timeout ||
|-
| 0x35 || [4.0.0+] svcSignalToAddress || X0=ptr, W1=[[#SignalType]], X2=value W3=num_to_signal ||
|- style="border-top: double"
| 0x3C || [[#svcDumpInfo]] || ||
|-
| 0x3D || [4.0.0+] svcDumpInfoNew || ||
|- style="border-top: double"
| 0x40 || svcCreateSession || W2=is_light, X3=? || W0=result, W1=server_handle, W2=client_handle
|-
| 0x41 || [[#svcAcceptSession]] || W1=port_handle || W0=result, W1=session_handle
|-
| 0x42 || svcReplyAndReceiveLight || W0=light_session_handle || W0=result, W1,W2,W3,W4,W5,W6,W7=out
|-
| 0x43 || [[#svcReplyAndReceive]] || X1=ptr_handles, W2=num_handles, X3=replytarget_handle(0=none), X4=timeout || W0=result, W1=handle_idx
|-
| 0x44 || svcReplyAndReceiveWithUserBuffer|| X1=buf, X2=sz, X3=ptr_handles, W4=num_handles, X5=replytarget_handle(0=none), X6=timeout || W0=result, W1=handle_idx
|-
| 0x45 || svcCreateEvent || None || W0=result, W1=wevent_handle, W2=revent_handle
|- style="border-top: double"
| 0x48 || [5.0.0+] [[#svcMapPhysicalMemoryUnsafe]] || X0=addr, X1=size || W0=result
|-
| 0x49 || [5.0.0+] svcUnmapPhysicalMemoryUnsafe || X0=addr, X1=size || W0=result
|-
| 0x4A || [5.0.0+] svcSetUnsafeLimit || X0=size || W0=result
|-
| 0x4B || [4.0.0+] [[#svcCreateCodeMemory]] || X1=addr, X2=size || W0=result, W1=code_memory_handle
|-
| 0x4C || [4.0.0+] [[#svcControlCodeMemory]] || W0=code_memory_handle, W1=[[#CodeMemoryOperation]], X2=dstaddr, X3=size, W4=perm || W0=result
|-
| 0x4D || svcSleepSystem || None || None
|-
| 0x4E || [[#svcReadWriteRegister]] || X1=reg_addr, W2=rw_mask, W3=in_val || W0=result, W1=out_val
|-
| 0x4F || svcSetProcessActivity || W0=process_handle, W1=bool || W0=result
|-
| 0x50 || [[#svcCreateSharedMemory]] || W1=size, W2=myperm, W3=otherperm || W0=result, W1=shmem_handle
|-
| 0x51 || [[#svcMapTransferMemory]] || X0=tmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x52 || [[#svcUnmapTransferMemory]] || W0=tmemhandle, X1=addr, X2=size || W0=result
|-
| 0x53 || [[#svcCreateInterruptEvent]] || X1=irq_num, W2=flag || W0=result, W1=handle
|-
| 0x54 || [[#svcQueryPhysicalAddress]] || X1=addr || W0=result, X1=physaddr, X2=kerneladdr, X3=size
|-
| 0x55 || [[#svcQueryIoMapping]] || X1=physaddr, X2=size || W0=result, X1=virtaddr
|-
| 0x56 || [[#svcCreateDeviceAddressSpace]] || X1=dev_as_start_addr, X2=dev_as_end_addr || W0=result, W1=dev_as_handle
|-
| 0x57 || [[#svcAttachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x58 || [[#svcDetachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x59 || [[#svcMapDeviceAddressSpaceByForce]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm || W0=result
|-
| 0x5A || [[#svcMapDeviceAddressSpaceAligned]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm || W0=result
|-
| 0x5B || svcMapDeviceAddressSpace || ||
|-
| 0x5C || [[#svcUnmapDeviceAddressSpace]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr || W0=result
|-
| 0x5D || svcInvalidateProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x5E || svcStoreProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x5F || svcFlushProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x60 || svcDebugActiveProcess || X1=pid || W0=result, W1=debug_handle
|-
| 0x61 || svcBreakDebugProcess || W0=debug_handle || W0=result
|-
| 0x62 || svcTerminateDebugProcess || W0=debug_handle || W0=result
|-
| 0x63 || svcGetDebugEvent || X0=[[#DebugEventInfo]]*, W1=debug_handle || W0=result
|-
| 0x64 || [[#svcContinueDebugEvent]] || [1.0.0-2.3.0] W0=debug_handle, W1=[[#ContinueDebugFlagsOld]], X2=thread_id
[3.0.0+] W0=debug_handle, W1=[[#ContinueDebugFlags]], X2=thread_id_list(u64 *), W3=num_tids (max 64, 0 means "all threads")
|| W0=result
|-
| 0x65 || svcGetProcessList || X1=pids_out_ptr, W2=max_out || W0=result, W1=num_out
|-
| 0x66 || svcGetThreadList || X1=tids_out_ptr, W2=max_out, W3=debug_handle_or_zero || W0=result, X1=num_out
|-
| 0x67 || svcGetDebugThreadContext || X0=ThreadContext*, X1=debug_handle, X2=thread_id, W3=[[#ThreadContextFlags]] || W0=result
|-
| 0x68 || svcSetDebugThreadContext || W0=debug_handle, X1=thread_id, X2=ThreadContext*, W3=[[#ThreadContextFlags]] || W0=result
|-
| 0x69 || svcQueryDebugProcessMemory || X0=[[#MemoryInfo]]*, X2=debug_handle, X3=addr || W0=result, W1=PageInfo
|-
| 0x6A || svcReadDebugProcessMemory || X0=buffer*, X1=debug_handle, X2=src_addr, X3=size || W0=result
|-
| 0x6B || svcWriteDebugProcessMemory || X0=debug_handle, X1=buffer*, X2=dst_addr, X3=size || W0=result
|-
| 0x6C || [[#svcSetHardwareBreakPoint]] || W0=HardwareBreakpointId, X1=watchpoint_flags/breakpoint_flags, X2=watchpoint_value/debug_handle ||
|-
| 0x6D || svcGetDebugThreadParam || X2=debug_handle, X3=thread_id, W4=[[#DebugThreadParam]] || W0=result, X1=out0, W2=out1
|- style="border-top: double"
| 0x6F || [5.0.0+] [[#svcGetSystemInfo]] || X1=info_id, X2=handle, X3=info_sub_id || W0=result, X1=out
|-
| 0x70 || svcCreatePort || W2=max_sessions, W3=is_light, X4=name_ptr || W0=result, W1=clientport_handle, W2=serverport_handle
|-
| 0x71 || svcManageNamedPort || X1=name_ptr, W2=max_sessions || W0=result, W1=serverport_handle
|-
| 0x72 || svcConnectToPort || W1=clientport_handle || W0=result, W1=session_handle
|-
| 0x73 || [[#svcSetProcessMemoryPermission]] || W0=process_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x74 || [[#svcMapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size || W0=result
|-
| 0x75 || [[#svcUnmapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size || W0=result
|-
| 0x76 || [[#svcQueryProcessMemory]] || X0=meminfo_ptr, W2=process_handle, X3=addr || W0=result, W1=pageinfo
|-
| 0x77 || [[#svcMapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x78 || [[#svcUnmapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x79 || [[#svcCreateProcess]] || X1=procinfo_ptr, X2=caps_ptr, W3=cap_num || W0=result, W1=process_handle
|-
| 0x7A || svcStartProcess || W0=process_handle, W1=main_thread_prio, W2=default_cpuid, W3=main_thread_stacksz || W0=result
|-
| 0x7B || svcTerminateProcess || W0=process_handle || W0=result
|-
| 0x7C || [[#svcGetProcessInfo]] || W0=process_handle, W1=[[#ProcessInfoType]] || W0=result, X1=[[#ProcessState]]
|-
| 0x7D || svcCreateResourceLimit || None || W0=result, W1=reslimit_handle
|-
| 0x7E || svcSetResourceLimitLimitValue || W0=reslimit_handle, W1=[[#LimitableResource]], X2=value || W0=result
|-
| 0x7F || svcCallSecureMonitor || X0=smc_sub_id, X1,X2,X3,X4,X5,X6,X7=smc_args || X0,X1,X2,X3,X4,X5,X6,X7=result
|}

== svcSetHeapSize ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || OutAddr
|}
</div>

'''Description:''' Set the process heap to a given Size. It can both extend and shrink the heap.

Size must be a multiple of 0x200000 (2MB).

On success, the heap base-address (which is fixed by kernel, aslr'd) is written to OutAddr.

Uses current process pool partition.

[2.0.0+] Size must be less than or equal to 4GB.

== svcSetMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || Prot
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change permission of page-aligned memory region.

Bit2 of permission (exec) is not allowed. Setting write-only is not allowed either (bit1).

This can be used to move back and forth between ---, r-- and rw-.

== svcSetMemoryAttribute ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || u32 || State0
|-
| (In) W3 || u32 || State1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change attribute of page-aligned memory region.

This is used to turn on/off caching for a given memory area. Useful when talking to devices such as the GPU.

What happens "under the hood" is the "Memory Attribute Indirection Register" index is changed from 2 to 3 in the MMU descriptor.

{| class=wikitable
! State0 || State1 || Action
|-
| 0 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 8 || Set bit3 in [[#MemoryAttribute]].
|}

== svcMapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps a memory range into a different range.

Mainly used for adding guard pages around stack.

Source range gets reprotected to --- (it can no longer be accessed), and bit0 is set in the source [[#MemoryAttribute]].

[1.0.0] This could be used to map into either the Alias Region or the Stack region.

[2.0.0+] This can only be used to map into the Stack region.

Code can get the range of the Alias region from [[#svcGetInfo]] id0=2,3, and on 2.0.0+ the range of the Stack region via [[#svcGetInfo]] id0=14, 15 (on 1.0.0, the Stack region had hardcoded limits).

When mapped into the Alias region, the mapped memory will have state 0x482907.

When mapped into the Stack region, the mapped memory will have state 0x5C3C0B.

== svcUnmapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps a region that was previously mapped with [[#svcMapMemory]].

It's possible to unmap ranges partially, you don't need to unmap the entire range "in one go".

The srcaddr/dstaddr must match what was given when the pages were originally mapped.

== svcQueryMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfo
|-
| (In) X2 || void* || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

'''Description:''' Query information about an address. Will always fetch the lowest page-aligned mapping that contains the provided address.

Outputs a [[#MemoryInfo]] struct.

== svcExitProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current process.

== svcCreateThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void(*)(void*) || Entry
|-
| (In) X2 || void* || ThreadContext
|-
| (In) X3 || void* || StackTop
|-
| (In) W4 || u32 || Priority
|-
| (In) W5 || u32 || ProcessorId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Thread> || Handle
|}
</div>

'''Description:''' Create a thread in the current process.

Processor_id must be 0,1,2,3 or -2, where -2 uses the default cpuid for process.

== svcStartThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) None || ||
|}
</div>

'''Description:''' Starts the thread for the provided handle.

== svcExitThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current thread.

== svcSleepThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || s64 || Nanoseconds
|-
|}
</div>

'''Description:''' Sleep for a specified amount of time, or yield thread.

Setting nanoseconds to 0, -1, or -2 indicates a yielding type.

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Value || Type
|-
| 0 || Yielding without core migration
|-
| -1 || Yielding with core migration
|-
| -2 || Yielding to any other thread
|-
|}
</div>

== svcGetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1|| Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || Priority
|}
</div>

'''Description:''' Get priority of provided thread handle.

== svcSetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0|| Handle<Thread> || Handle
|-
| (In) W1|| u32 || Priority
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set priority of provided thread handle.

Priority is a number 0-0x3F. Lower value means higher priority.

== svcGetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W2 || Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u32 || Out0
|-
| (Out) X2 || u64 || Out1
|}
</div>

'''Description:''' Get affinity mask of provided thread handle.

== svcSetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (In) W1 || u32 || In0
|-
| (In) X2 || u64 || In1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set affinity mask of provided thread handle.

== svcGetCurrentProcessorNumber ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0/X0 || u64 || CpuId
|}
</div>

'''Description:''' Get which cpu is executing the current thread.

Cpu-id is an integer in the range 0-3.

== svcMapSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<SharedMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the block supplied by the handle. The required permissions are different for the process that created the handle and all other processes.

Increases reference count for the KSharedMemory object. Thus in order to release the memory associated with the object, all handles to it must be closed and all mappings must be unmapped.

== svcCreateTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<TransferMemory> || Handle
|}
</div>

This one reprotects the src block with perms you give it. It also sets bit0 into [[#MemoryAttribute]].

Executable bit perm not allowed.

Closing all handles automatically causes the bit0 in [[#MemoryAttribute]] to clear, and the permission to reset.

== svcWaitSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || Handle* || HandlesPtr
|-
| (In) W2 || u64 || HandlesNum
|-
| (In) X3 || u64 || Timeout
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || HandleIndex
|}
</div>

Works with num_handles <= 0x40.

When zero handles are passed, this will wait forever until either timeout or cancellation occurs.

Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.

=== Object types ===

'''KDebug:''' signals when there is a new [[#DebugEventInfo|DebugEvent]] (retrievable via [[#svcGetDebugEvent]]).

'''KClientPort:''' signals when the number of sessions is less than the maximum allowed.

'''KProcess:''' signals when the process undergoes a state change (retrievable via [[#svcGetProcessInfo]]).

'''KReadableEvent:''' signals when the event's corresponding KWritableEvent has been signaled via svcSignalEvent.

'''KServerPort:''' signals when there is an incoming connection waiting to be [[#svcAcceptSession|accepted]].

'''KServerSession:''' signals when there is an incoming message waiting to be [[#svcReplyAndReceive|received]] or the pipe is closed.

'''KThread:''' signals when the thread has exited.

=== Result codes ===

'''0x0:''' Success. One of the objects was signaled before the timeout expired, or one of the objects is a Session with a closed remote. Handle index is updated to indicate which object signaled.

'''0x7601:''' Thread termination requested. Handle index is not updated.

'''0xe401:''' Invalid handle. Returned when one of the handles passed is invalid. Handle index is not updated.

'''0xe601:''' Invalid address. Returned when the handles pointer is not a readable address. Handle index is not updated.

'''0xea01:''' Timeout. Returned when no objects have been signaled within the timeout. Handle index is not updated.

'''0xec01:''' Interrupted. Returned when another thread uses [[#svcCancelSynchronization]] to cancel this thread. Handle index is not updated.

'''0xee01:''' Too many handles. Returned when the number of handles passed is > 0x40.

== svcCancelSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

If the referenced thread is currently in a synchronization call ([[#svcWaitSynchronization]], [[#svcReplyAndReceive]] or [[#svcReplyAndReceiveLight]]), that call will be interrupted and return 0xec01.
If that thread is not currently executing such a synchronization call, the next call to a synchronization call will return 0xec01.

This doesn't take force-pause (activity/debug pause) into account.

=== Result codes ===

'''0x0:''' Success. The thread was either interrupted or has had its flag set.

'''0xe401:''' Invalid handle. The handle given was either invalid or not a thread handle.

== svcGetSystemTick ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (Out) X0 || u64 || Ticks
|}
</div>

Returns the value of cntpct_el0.

The frequency is 19200000 Hz (constant from official sw).

Official sw reads cntpct_el0 directly from usermode without using this SVC. [[ExeFS|sdk-nso]] has this SVC, but it's not known to be called anywhere.

== svcSendSyncRequestWithUserBuffer ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || CmdPtr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || Handle<Session> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size and CmdPtr must be 0x1000-aligned.

=== Result codes ===

'''0x0:''' Success.

'''0xcc01:''' CmdPtr is not 0x1000-aligned.

'''0xca01:''' Size is not 0x1000-aligned.

'''0xce01:''' KSessionRequest allocation failed (unlikely) or pointer buffer size exceeded.

'''0xe401:''' Handles does not exist, or handle is not an instance of KClientSession.

== svcBreak ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || Break Reason
|-
| (In) X1 || u64 ||
|-
| (In) X2 || u64 || Info
|-
| (Out) W0 || Result || 0 (Success)
|}
</div>

If the process is attached, report the Break event. Then, if svcContinueDebugEvent didn't apply IgnoreException on the thread: if TPIDR_EL0 is 0, adjust ELR_EL1 to retry to svc instruction (and set TPIDR_EL0 to 1).

Otherwise, if bit31 in reason isn't set, perform crash reporting (see Exception Handling section below), if it doesn't terminate the process adjust ELR_EL1 as well.

Otherwise just return 0.

== svcGetInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Process || 0 || 0 || AllowedCpuIdBitmask
|-
| Process || 1 || 0 || AllowedThreadPrioBitmask
|-
| Process || 2 || 0 || AliasRegionBaseAddr
|-
| Process || 3 || 0 || AliasRegionSize
|-
| Process || 4 || 0 || HeapRegionBaseAddr
|-
| Process || 5 || 0 || HeapRegionSize
|-
| Process || 6 || 0 || TotalMemoryAvailable. Total memory available(free+used).
|-
| Process || 7 || 0 || TotalMemoryUsage. Total used size of codebin memory + main-thread stack + allocated heap.
|-
| Zero || 8 || 0 || IsCurrentProcessBeingDebugged
|-
| Zero || 9 || 0 || Returns ResourceLimit handle for current process. Used by [[Process_Manager_services|PM]].
|-
| Zero || 10 || -1, {current coreid} || IdleTickCount
|-
| Zero || 11 || 0-3 || RandomEntropy from current process. TRNG. Used to seed usermode PRNGs.
|-
| Process || 12 || 0 || [2.0.0+] AddressSpaceBaseAddr
|-
| Process || 13 || 0 || [2.0.0+] AddressSpaceSize
|-
| Process || 14 || 0 || [2.0.0+] StackRegionBaseAddr
|-
| Process || 15 || 0 || [2.0.0+] StackRegionSize
|-
| Process || 16 || 0 || [3.0.0+] PersonalMmHeapSize
|-
| Process || 17 || 0 || [3.0.0+] PersonalMmHeapUsage
|-
| Process || 18 || 0 || [3.0.0+] TitleId
|-
| Zero || 19 || 0 || [4.0.0-4.1.0] PrivilegedProcessId_LowerBound
|-
| Zero || 19 || 1 || [4.0.0-4.1.0] PrivilegedProcessId_UpperBound
|-
| Process || 20 || 0 || [5.0.0+] UserExceptionContextAddr
|-
| Process || 21 || 0 || [6.0.0+] TotalMemoryAvailableWithoutMmHeap
|-
| Process || 22 || 0 || [6.0.0+] TotalMemoryUsedWithoutMmHeap
|-
| Thread || 0xF0000002 || 0 || Scheduler related.
|}

== svcMapPhysicalMemory ==
This is like svcSetHeapSize except you can allocate heap at any address you'd like.

Uses current process pool partition.

== svcDumpInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

Does nothing, just returns with registers set to all-zero.

== svcAcceptSession ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || Handle<Port> || Port
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ServerSession> || Session
|}
</div>

=== Result codes ===

'''0xf201:''' No session waiting to be accepted

== svcReplyAndReceive ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || *Handle<Port or ServerSession> || Handles
|-
| (In) W2 || u32 || NumHandles
|-
| (In) W3 || Handle<ServerSession> || ReplyTarget
|-
| (In) X4 || u64 (nanoseconds) || Timeout
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || u32 || HandleIndex
|}
</div>

If ReplyTarget is not zero, a reply from the TLS will be sent to that session.
Then it will wait until either of the passed sessions has an incoming message, is closed, a passed port has an incoming connection, or the timeout expires.
If there is an incoming message, it is copied to the TLS.

If ReplyTarget is zero, the TLS should contain a blank message. If this message has a C descriptor, the buffer it points to will be used as the pointer buffer. See [[IPC_Marshalling#IPC_buffers]]. Note that a pointer buffer cannot be specified if ReplyTarget is not zero.

After being validated, passed handles will be enumerated in order; even if a session has been closed, if one that appears earlier in the list has an incoming message, it will take priority and a result code of 0x0 will be returned.

=== Result codes ===

'''0x0:''' Success. Either a session has an incoming message or a port has an incoming connection. HandleIndex is set appropriately.

'''0xea01:''' Timeout. No handles were signalled before the timeout expired. HandleIndex is not updated.

'''0xf601:''' Port remote dead. One of the sessions has been closed. HandleIndex is set appropriately.

== svcMapPhysicalMemoryUnsafe ==
Same as [[#svcMapPhysicalMemory]] except it always uses pool partition 0.

== svcCreateCodeMemory ==
Takes an address range with backing memory to create the code memory object.

The memory is initially memset to 0xFF after being locked.

== svcControlCodeMemory ==
Maps the backing memory for a Code memory object into the current process.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapOwner]], memory permission must be RW-.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapSlave]], memory permission must be R-- or R-X.

Operations [[#CodeMemoryOperation|CodeMemoryOperation_UnmapOwner/CodeMemoryOperation_UnmapSlave]] unmap memory that was previously mapped this way.

This allows one "secure JIT" process to map the code memory as RW-, and the other "slave" process to map it R-X.

[5.0.0+] Error 0xE401 is now returned when the process owner of the Code memory object is the same as the current process.

== svcReadWriteRegister ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || RegAddr
|-
| (In) W2 || u64 || RwMask
|-
| (In) W3 || u64 || InValue
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1|| u64 || OutValue
|}
</div>

Read/write IO registers with a hardcoded whitelist. Input address is physical-address and must be aligned to 4.

rw_mask is 0 for reading and 0xffffffff for writing. You can also write individual bits by using a mask value.

You can only write to registers inside physical pages 0x70019000 (MC), 0x7001C000 (MC0), 0x7001D000 (MC1), and they all share the same whitelist.

The whitelist is same for writing as for reading.

The whitelist is:

0x054, 0x090, 0x094, 0x098, 0x09c, 0x0a0, 0x0a4, 0x0a8, 0x0ac, 0x0b0, 0x0b4, 0x0b8, 0x0bc, 0x0c0, 0x0c4, 0x0c8, 0x0d0, 0x0d4, 0x0d8, 0x0dc, 0x0e0, 0x100, 0x108, 0x10c, 0x118, 0x11c, 0x124, 0x128, 0x12c, 0x130, 0x134, 0x138, 0x13c, 0x158, 0x15c, 0x164, 0x168, 0x16c, 0x170, 0x174, 0x178, 0x17c, 0x200, 0x204, 0x2e4, 0x2e8, 0x2ec, 0x2f4, 0x2f8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37c, 0x380, 0x390, 0x394, 0x398, 0x3ac, 0x3b8, 0x3bc, 0x3c0, 0x3c4, 0x3d8, 0x3e8, 0x41c, 0x420, 0x424, 0x428, 0x42c, 0x430, 0x44c, 0x47c, 0x480, 0x484, 0x50c, 0x554, 0x558, 0x55c, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69c, 0x6a0, 0x6a4, 0x6c0, 0x6c4, 0x6f0, 0x6f4, 0x960, 0x970, 0x974, 0xa20, 0xa24, 0xb88, 0xb8c, 0xbc4, 0xbc8, 0xbcc, 0xbd0, 0xbd4, 0xbd8, 0xbdc, 0xbe0, 0xbe4, 0xbe8, 0xbec, 0xc00, 0xc5c, 0xcac

[2.0.0+] Whitelist was extended with 0x4c4, 0x4c8, 0x4cc, 0x584, 0x588, 0x58c.

[2.0.0+] The IO registers in range 0x7000E400 (PMC) size 0xC00 skip the whitelist, and do a TrustZone call using [[SMC]] Id1 0xC3000008(ReadWriteRegister).

[4.0.0+] Access to the Memory Controller (0x70019000) also uses smcReadWriteRegister.

Here is the whitelist imposed by that SMC, relative to the start of the PMC registers:

0x000, 0x00c, 0x010, 0x014, 0x01c, 0x020, 0x02c, 0x030, 0x034, 0x038, 0x03c, 0x040, 0x044, 0x048, 0x0dc, 0x0e0, 0x0e4, 0x160, 0x164, 0x168, 0x170, 0x1a8, 0x1b8, 0x1bc, 0x1c0, 0x1c4, 0x1c8, 0x2b4, 0x2d4, 0x440, 0x4d8

Here is the whitelist imposed by smcReadWriteRegister (checked in addition to the whitelist in svcReadWriteRegister), relative to the start of the MC registers:

0x000, 0x004, 0x008, 0x00C, 0x010, 0x01C, 0x020, 0x030, 0x034, 0x050, 0x054, 0x090, 0x094, 0x098, 0x09C, 0x0A0, 0x0A4, 0x0A8, 0x0AC, 0x0B0, 0x0B4, 0x0B8, 0x0BC, 0x0C0, 0x0C4, 0x0C8, 0x0D0, 0x0D4, 0x0D8, 0x0DC, 0x0E0, 0x100, 0x108, 0x10C, 0x118, 0x11C, 0x124, 0x128, 0x12C, 0x130, 0x134, 0x138, 0x13C, 0x158, 0x15C, 0x164, 0x168, 0x16C, 0x170, 0x174, 0x178, 0x17C, 0x200, 0x204, 0x238, 0x240, 0x244, 0x250, 0x254, 0x258, 0x264, 0x268, 0x26C, 0x270, 0x274, 0x280, 0x284, 0x288, 0x28C, 0x294, 0x2E4, 0x2E8, 0x2EC, 0x2F4, 0x2F8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37C, 0x380, 0x390, 0x394, 0x398, 0x3AC, 0x3B8, 0x3BC, 0x3C0, 0x3C4, 0x3D8, 0x3E8, 0x41C, 0x420, 0x424, 0x428, 0x42C, 0x430, 0x44C, 0x47C, 0x480, 0x484, 0x4C4, 0x4C8, 0x4CC, 0x50C, 0x554, 0x558, 0x55C, 0x584, 0x588, 0x58C, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69C, 0x6A0, 0x6A4, 0x6C0, 0x6C4, 0x6F0, 0x6F4, 0x960, 0x970, 0x974, 0x9B8, 0xA20, 0xA24, 0xA88, 0xA94, 0xA98, 0xA9C, 0xAA0, 0xAA4, 0xAA8, 0xAAC, 0xAB0, 0xAB4, 0xAB8, 0xABC, 0xAC0, 0xAC4, 0xAC8, 0xACC, 0xAD0, 0xAD4, 0xAD8, 0xADC, 0xAE0, 0xB88, 0xB8C, 0xBC4, 0xBC8, 0xBCC, 0xBD0, 0xBD4, 0xBD8, 0xBDC, 0xBE0, 0xBE4, 0xBE8, 0xBEC, 0xC00, 0xC5C, 0xCAC

== svcCreateSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || LocalPerm
|-
| (In) W3 || [[#Permission]] || RemotePerm
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<SharedMemory> || MemHandle
|}
</div>

Other perm can be used to enforce permission 1, 3, or 0x10000000 if don't care.

Allocates memory from the current process' pool partition.

== svcMapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

The newly mapped pages will have [[#MemoryState]] type 0xE.

You must pass same size and permissions as given in svcCreateMemoryMirror, otherwise error.

== svcUnmapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must match size given in map syscall, otherwise there's an invalid-size error.

== svcCreateInterruptEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || IrqNum
|-
| (In) W2 || bool || Flags
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<ReadableEvent> || ReadableEventHandle
|}
</div>

Create an event handle for the given IRQ number. Waiting on this handle will wait until the IRQ is triggered. The flags argument configures the triggering. If it is false, the IRQ is active HIGH level sensitive, if it is true it is rising-edge sensitive.

=== Result codes ===

'''0x0:''' Success.

'''0xF001:''' Flags was > 1

'''0xF201:''' IRQ above 0x3FF or outside the [[NPDM#Kernel_Access_Control|IRQ access mask]] was given.

'''0xCE01:''' A SlabHeap was exhausted (too many interrupts created).

'''0xF401:''' IRQ already has an event registered.

'''0xD201:''' The handle table is full. Try closing some handles.

== svcQueryPhysicalAddress ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || Addr
|-
| (Out) W0 || [[#Result]]|| Ret
|-
| (Out) X1 || u64 || PhysAddr
|-
| (Out) X2 || u64 || KernelAddr
|-
| (Out) X3 || u64 || Size
|}
</div>

== svcQueryIoMapping ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || PhysAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || void* || VirtAddr
|}
</div>

'''Description:''' Returns a virtual address mapped to a given IO range.

== svcCreateDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || StartAddr
|-
| (In) X2 || u64 || EndAddr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<DeviceAddressSpace> || AddressSpaceHandle
|}
</div>

'''Description:''' Creates a virtual address space for binding device address spaces and returns a handle.

dev_as_start_addr is normally set to 0 and dev_as_end_addr is normally set to 0xFFFFFFFF.

== svcAttachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Attaches a device address space to a [[#DeviceName|device]].

== svcDetachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Detaches a device address space from a [[#DeviceName|device]].

== svcMapDeviceAddressSpaceByForce ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (In) W5 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

dev_map_addr is the userspace destination address, while dev_as_addr is the source address between dev_as_start_addr and dev_as_end_addr (passed to [[#svcCreateDeviceAddressSpace]]).

The userspace destination address must have the [[SVC#MemoryState|MapDeviceAllowed]] bit set. Bit [[SVC#MemoryAttribute|IsDeviceMapped]] will be set after mapping.

== svcMapDeviceAddressSpaceAligned ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (In) W5 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

Same as [[#svcMapDeviceAddressSpaceByForce]], but the userspace destination address must have the [[SVC#MemoryState|MapDeviceAlignedAllowed]] bit set instead.

== svcUnmapDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps an attached device address space from an userspace address.

== svcContinueDebugEvent ==

=== Result codes ===

'''0x0:''' Success. The process has been resumed.

'''0xe401:''' Invalid debug handle.

'''0xf401:''' Process has debug events queued.

== svcGetSystemInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Zero || 0 || 0 || TotalMemorySize_Application
|-
| Zero || 0 || 1 || TotalMemorySize_Applet
|-
| Zero || 0 || 2 || TotalMemorySize_System
|-
| Zero || 0 || 3 || TotalMemorySize_SystemUnsafe
|-
| Zero || 1 || 0 || CurrentMemorySize_Application
|-
| Zero || 1 || 1 || CurrentMemorySize_Applet
|-
| Zero || 1 || 2 || CurrentMemorySize_System
|-
| Zero || 1 || 3 || CurrentMemorySize_SystemUnsafe
|-
| Zero || 2 || 0 || PrivilegedProcessId_LowerBound
|-
| Zero || 2 || 1 || PrivilegedProcessId_UpperBound
|-
|}

== svcSetProcessMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || void* || Perm
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

This sets the memory permissions for the specified memory with the supplied process handle.

This throws an error(0xD801) when the input perm is >0x5, hence -WX and RWX are not allowed.

== svcMapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || DstAddr
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the src address from the supplied process handle into the current process.

This allows mapping code and rodata with RW- permission.

== svcUnmapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessMemory]].

== svcQueryProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfoPtr
|-
| (In) W2 || Handle<Process> || ProcessHandle
|-
| (In) X3 || u64 || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

Equivalent to [[#svcQueryMemory]] except takes a process handle.

== svcMapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Takes a process handle, and maps normal heap in that process as executable code in that process. Used when loading NROs. This does not support using the current-process handle alias.

== svcUnmapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessCodeMemory]].

== svcCreateProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#CreateProcessInfo]]* || InfoPtr
|-
| (In) X2 || u32* || CapabilitiesPtr
|-
| (In) X3 || u64 || CapabilitiesNum
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Process> || ProcessHandle
|}
</div>

Takes a [[#CreateProcessInfo]] as input.
CapabilitiesPtr points to an array of [[NPDM#Kernel_Access_Control|kernel capabilities]].
CapabilitiesNum is a number of capabilities in the CapabilitiesPtr array (number of element, not number of bytes).

=== Result codes ===

'''0x0:''' Success.

'''0xCA01:''' Attempted to map more code pages than available in address space.

'''0xCC01:''' Provided CodeAddr is invalid (make sure it's in range?)

'''0xE401:''' The resource handle passed is invalid.

'''0xE601:''' Attempt to copy procinfo from user-supplied pointer failed. Attempt to copy capabilities_num from user-supplied pointer failed.

'''0xE801:''' Attempted to create a 32-bit process with a 36-bit address space.

'''0xF001:''' Unused bits are set in mmuflags. Unknown address space type used.

== svcGetProcessInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || [[#ProcessState]] || State
|}
</div>

Returns an enum with value 0-7.

== Debugging ==
[2.0.0+] Exactly 6 debug SVCs require that [[SPL_services#GetConfig|IsDebugMode]] is non-zero. Error 0x4201 is returned otherwise.
* svcBreakDebugProcess
* svcContinueDebugEvent
* svcWriteDebugProcessMemory
* svcSetDebugThreadContext
* svcTerminateDebugProcess
* svcSetHardwareBreakPoint

svcDebugActiveProcess stops execution of the target process, the normal method for resuming it requires svcContinueDebugEvent(see above). Closing the debug handle also results in execution being resumed.

== svcSetHardwareBreakPoint ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || u32 || hardware_breakpoint_id
|-
| (In) W1 || u64 || flags
|-
| (In) W2 || u64 || value
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Sets one of the AArch64 hardware breakpoints. The nintendo switch has 6 hardware breakpoints, and 4 hardware watchpoints. The syscall has two behaviors depending on the value of hardware_breakpoint_id:

If hardware_breakpoint_id < 0x10, then it sets one of the AArch64 hardware breakpoints. Flags will go to DBGBCRn_EL1, and value to DBGBVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0x7F01E1. Furthermore, the kernel will or it with 0x4004, in order to set various security flags to guarantee the watchpoints only triggers for code in EL0. If the user asks for a Breakpoint Type of ContextIDR match, the kernel shall use the given debug_handle to set DBGBVRn_EL1 to the ContextID of the debugged process.

If hardware_breakpoint_id is between 0x10 and 0x20 (exclusive), then it sets one of the AArch64 hardware watchpoints. Flags will go to DBGWCRn_EL1, and the value to DBGWVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0xFF0F1FF9. Furthermore, the kernel will or it with 0x104004. This will set various security flags, and set the watchpoint type to be a Linked Watchpoint. This means that you need to link it to a Linked ContextIDR breakpoint. Check the ARM documentation for more information.

Note that hardware_breakpoint_id 0 to 4 match only to Virtual Address, while hardware_breakpoint_id 5 and 6 match against either Virtual Address, ContextID, or VMID. As such, if you are configuring a breakpoint to link for a watchpoint, make sure you use hardware_breakpoint_id 5 or 6.

For more documentation for hardware breakpoints, check out the AArch64 documentation for the [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0488h/way1382455558968.html DBGBCRn_EL1 register] and the [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0488h/way1382455560629.html DBGWCRn_EL1 register]

= Enum/Structures =
== ThreadContextRequestFlags ==
Bitfield of one of more of these:

{| class=wikitable
! Bit || Bitmask || Name
|-
| 0 || 1 || NormalContext
|-
| 1 || 2 ||
|-
| 2 || 4 ||
|-
| 3 || 8 ||
|}

== DeviceName ==
{| class=wikitable
! Value || Name
|-
| 0 || DeviceName_AFI
|-
| 1 || DeviceName_AVPC
|-
| 2 || DeviceName_DC
|-
| 3 || DeviceName_DCB
|-
| 4 || DeviceName_HC
|-
| 5 || DeviceName_HDA
|-
| 6 || DeviceName_ISP2
|-
| 7 || DeviceName_MSENCNVENC
|-
| 8 || DeviceName_NV
|-
| 9 || DeviceName_NV2
|-
| 10 || DeviceName_PPCS
|-
| 11 || DeviceName_SATA
|-
| 12 || DeviceName_VI
|-
| 13 || DeviceName_VIC
|-
| 14 || DeviceName_XUSB_HOST
|-
| 15 || DeviceName_XUSB_DEV
|-
| 16 || DeviceName_TSEC
|-
| 17 || DeviceName_PPCS1
|-
| 18 || DeviceName_DC1
|-
| 19 || DeviceName_SDMMC1A
|-
| 20 || DeviceName_SDMMC2A
|-
| 21 || DeviceName_SDMMC3A
|-
| 22 || DeviceName_SDMMC4A
|-
| 23 || DeviceName_ISP2B
|-
| 24 || DeviceName_GPU
|-
| 25 || DeviceName_GPUB
|-
| 26 || DeviceName_PPCS2
|-
| 27 || DeviceName_NVDEC
|-
| 28 || DeviceName_APE
|-
| 29 || DeviceName_SE
|-
| 30 || DeviceName_NVJPG
|-
| 31 || DeviceName_HC1
|-
| 32 || DeviceName_SE1
|-
| 33 || DeviceName_AXIAP
|-
| 34 || DeviceName_ETR
|-
| 35 || DeviceName_TSECB
|-
| 36 || DeviceName_TSEC1
|-
| 37 || DeviceName_TSECB1
|-
| 38 || DeviceName_NVDEC1
|}

== CodeMemoryOperation ==
{| class=wikitable
! Value || Name
|-
| 0 || CodeMemoryOperation_MapOwner
|-
| 1 || CodeMemoryOperation_MapSlave
|-
| 2 || CodeMemoryOperation_UnmapOwner
|-
| 3 || CodeMemoryOperation_UnmapSlave
|}

== LimitableResource ==
{| class=wikitable
! Value || Name
|-
| 0 || LimitableResource_Memory
|-
| 1 || LimitableResource_Threads
|-
| 2 || LimitableResource_Events
|-
| 3 || LimitableResource_TransferMemories
|-
| 4 || LimitableResource_Sessions
|}

== ProcessInfoType ==

{| class=wikitable
! Value || Name
|-
| 0 || [[#ProcessState|ProcessInfoType_ProcessState]]
|-
|}

== ProcessState ==
{| class=wikitable
! Value || Name || Notes
|-
| 0 || ProcessState_Created ||
|-
| 1 || ProcessState_CreatedAttached ||
|-
| 2 || ProcessState_Started ||
|-
| 3 || ProcessState_Crashed || Processes will not enter this state unless they were created with [[#CreateProcessInfo|EnableDebug]].
|-
| 4 || ProcessState_StartedAttached ||
|-
| 5 || ProcessState_Exiting ||
|-
| 6 || ProcessState_Exited ||
|-
| 7 || ProcessState_DebugSuspended ||
|}

== DebugThreadParam ==
{| class=wikitable
! Value || Name
|-
| 0 || DebugThreadParam_DynamicPriority
|-
| 1 || DebugThreadParam_SchedulingStatus
|-
| 2 || DebugThreadParam_PreferredCpuCore
|-
| 3 || DebugThreadParam_CurrentCpuCore
|-
| 4 || DebugThreadParam_AffinityMask
|}

Dynamic priority: output in out2

Scheduling status: out1 contains bit0: is debug-suspended, bit1: is user-suspended (svcSetThreadActivity 1 or svcSetProcessActivity 1).
Out2 contains {suspended, idle, running, terminating} => {5, 0, 1, 4}

DebugThreadParam_PreferredCpuCore: output in out2

DebugThreadParam_CurrentCpuCore: output in out2

DebugThreadParam_AffinityMask: output in out1

== CreateProcessInfo ==
{| class=wikitable
! Offset || Length || Bits || Description
|-
| 0 || 12 || || ProcessName (doesn't have to be null-terminated)
|-
| 0x0C || 4 || || ProcessCategory (0: regular title, 1: kernel built-in)
|-
| 0x10 || 8 || || TitleId
|-
| 0x18 || 8 || || CodeAddr
|-
| 0x20 || 4 || || CodeNumPages
|-
| 0x24 || 4 || || MmuFlags
|-
| || || Bit0 || IsAarch64
|-
| || || Bit3-1 || [[#AddressSpaceType]]
|-
| || || Bit4 || [2.0.0+] EnableDebug
|-
| || || Bit5 || EnableAslr
|-
| || || Bit6 || UseSystemMemBlocks
|-
| || || Bit7 || [4.0.0] ?
|-
| || || Bit10-7 || [5.0.0+] PoolPartition (0=Application, 1=Applet, 2=Sysmodule, 3=Nvservices)
|-
| || || Bit11 || [7.0.0+] Only allowed in combination with bit6.
|-
| 0x28 || 4 || || ResourceLimitHandle or zero
|-
| 0x2C || 4 || || [3.0.0+] PersonalMmHeapNumPages
|}

On [1.0.0] there's only one pool.

On [2.0.0-4.0.0] PoolPartition is 1 for built-ins and 0 for rest.

On [5.0.0] PoolPartition is specified in CreateProcessArgs. There are now 4 pool partitions.

On [5.0.0] (maybe lower?) a zero ResourceLimitHandle defaults to sysmodule limits and 0x12300000 bytes of memory.

=== AddressSpaceType ===
{| class=wikitable
! Type || Name || Width || Description
|-
| 0 || Normal_32Bit || 32 ||
|-
| 1 || Normal_36Bit || 36 ||
|-
| 2 || WithoutMap_32Bit || 32 || Appears to be missing map region [?]
|-
| 3 || [2.0.0+] Normal_39Bit || 39 ||
|}

== MemoryInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || 8 || BaseAddress
|-
| 8 || 8 || Size
|-
| 0x10 || 4 || MemoryType: lower 8 bits of [[#MemoryState]]
|-
| 0x14 || 4 || [[#MemoryAttribute]]
|-
| 0x18 || 4 || Permission (bit0: R, bit1: W, bit2: X)
|-
| 0x1C || 4 || IpcRefCount
|-
| 0x20 || 4 || DeviceRefCount
|-
| 0x24 || 4 || Padding: always zero
|}

== MemoryAttribute ==
{| class=wikitable
! Bits || Description
|-
| 0 || IsBorrowed
|-
| 1 || IsIpcMapped: when IpcRefCount > 0.
|-
| 2 || IsDeviceMapped: when DeviceRefCount > 0.
|-
| 3 || IsUncached
|}

== MemoryState ==
{| class=wikitable
! Bits || Description
|-
| 7-0 || Type
|-
| 8 || [[#svcSetMemoryPermission|PermissionChangeAllowed]]
|-
| 9 || ForceReadWritableByDebugSyscalls
|-
| 10 || IpcSendAllowed_Type0
|-
| 11 || IpcSendAllowed_Type3
|-
| 12 || IpcSendAllowed_Type1
|-
| 14 || [[#svcSetProcessMemoryPermission|ProcessPermissionChangeAllowed]]
|-
| 15 || [[#svcMapMemory|MapAllowed]]
|-
| 16 || [[#svcUnmapProcessCodeMemory|UnmapProcessCodeMemoryAllowed]]
|-
| 17 || [[#svcCreateTransferMemory|TransferMemoryAllowed]]
|-
| 18 || [[#svcQueryPhysicalAddress|QueryPhysicalAddressAllowed]]
|-
| 19 || MapDeviceAllowed ([[#svcMapDeviceAddressSpace]] and [[#svcMapDeviceAddressSpaceByForce]])
|-
| 20 || [[#svcMapDeviceAddressSpaceAligned|MapDeviceAlignedAllowed]]
|-
| 21 || [[#svcSendSyncRequestWithUserBuffer|IpcBufferAllowed]]
|-
| 22 || IsPoolAllocated/IsReferenceCounted
|-
| 23 || [[#svcMapProcessMemory|MapProcessAllowed]]
|-
| 24 || [[#svcSetMemoryAttribute|AttributeChangeAllowed]]
|-
| 25 || [4.0.0+] CodeMemoryAllowed
|}

{| class=wikitable
! Value || Type || Meaning
|-
| 0x00000000 || MemoryType_Unmapped ||
|-
| 0x00002001 || MemoryType_Io || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00042002 || MemoryType_Normal || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00DC7E03 || MemoryType_CodeStatic || Mapped during [[#svcCreateProcess]].
|-
| [1.0.0+]

0x01FEBD04

[4.0.0+]

0x03FEBD04
|| MemoryType_CodeMutable || Transition from 0xDC7E03 performed by [[#svcSetProcessMemoryPermission]].
|-
| [1.0.0+]
0x017EBD05

[4.0.0+]

0x037EBD05
|| MemoryType_Heap || Mapped using [[#svcSetHeapSize]].
|-
| 0x00402006 || MemoryType_SharedMemory || Mapped using [[#svcMapSharedMemory]].
|-
| 0x00482907 || [1.0.0] MemoryType_Alias || Mapped using [[#svcMapMemory]].
|-
| 0x00DD7E08 || MemoryType_ModuleCodeStatic || Mapped using [[#svcMapProcessCodeMemory]].
|-
| [1.0.0+]

0x01FFBD09

[4.0.0+]

0x03FFBD09
|| MemoryType_ModuleCodeMutable || Transition from 0xDD7E08 performed by [[#svcSetProcessMemoryPermission]].
|-
| 0x005C3C0A || [[IPC_Marshalling|MemoryType_IpcBuffer0]] || IPC buffers with descriptor flags=0.
|-
| 0x005C3C0B || MemoryType_Stack || Mapped using [[#svcMapMemory]].
|-
| 0x0040200C || [[Thread Local Storage|MemoryType_ThreadLocal]] || Mapped during [[#svcCreateThread]].
|-
| 0x015C3C0D || MemoryType_TransferMemoryIsolated || Mapped using [[#svcMapTransferMemory]] when the owning process has perm=0.
|-
| 0x005C380E || MemoryType_TransferMemory || Mapped using [[#svcMapTransferMemory]] when the owning process has perm!=0.
|-
| 0x0040380F || MemoryType_ProcessMemory || Mapped using [[#svcMapProcessMemory]].
|-
| 0x00000010 || MemoryType_Reserved ||
|-
| 0x005C3811 || [[IPC_Marshalling|MemoryType_IpcBuffer1]] || IPC buffers with descriptor flags=1.
|-
| 0x004C2812 || [[IPC_Marshalling|MemoryType_IpcBuffer3]] || IPC buffers with descriptor flags=3.
|-
| 0x00002013 || MemoryType_KernelStack || Mapped in kernel during [[#svcCreateThread]].
|-
| 0x00402214 || [4.0.0+] MemoryType_CodeReadOnly || Mapped in kernel during [[#svcControlCodeMemory]].
|-
| 0x00402015 || [4.0.0+] MemoryType_CodeWritable || Mapped in kernel during [[#svcControlCodeMemory]].
|}

== ArbitrationType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || WaitIfLessThan
|-
| 0x1 || DecrementAndWaitIfLessThan
|-
| 0x2 || WaitIfEqual
|-
|}

== SignalType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || Signal
|-
| 0x1 || SignalAndIncrementIfEqual
|-
| 0x2 || SignalAndModifyBasedOnWaitingThreadCountIfEqual
|-
|}

== ContinueDebugFlagsOld ==
[1.0.0-2.3.0]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: ResumeAllThreads or debug-suspended-thread-id needed)
|-
| 1 || 2 || SwallowException
|-
| 2 || 4 || ResumeAllThreads
|}

== ContinueDebugFlags ==
[3.0.0+]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: doesn't need to be set in the same call than Resume)
|-
| 1 || 2 || DontCatchExceptions
|-
| 2 || 4 || Resume
|-
| 3 || 8 || IgnoreOtherThreadsExceptions
|}

IgnoreExceptionsOfOthers is like IgnoreException but acts on all threads that aren't in the input list. The affected threads are resumed.

Only one of of Resume and IgnoreOtherThreadsExceptions can be set at a time.

If the input number of threads is 0, this means "all threads".

== DebugEventInfo ==

The below table is for the Aarch64 version of the system call. For A32, all u64 fields but title/process/thread id are actually u32, making the structure 0x28-byte-big (0x40 for a64).

Size: 0x40

{| class=wikitable
! Offset || Length || Description
|-
| 0 || u32 || EventType
|-
| 4 || u32 || Flags (bit0: NeedsContinue)
|-
| 8 || u64 || ThreadId
|-
| 0x10 || || PerTypeSpecifics
|}

AttachProcess specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || TitleId
|-
| 0x18 || u64 || ProcessId
|-
| 0x20 || char[12] || ProcessName
|-
| 0x2C || u32 || MmuFlags
|-
| 0x30 || u64 || [5.0.0+] UserExceptionContextAddr
|}

AttachThread specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ThreadId
|-
| 0x18 || u64 || TlsPtr
|-
| 0x20 || u64 || Entrypoint
|}

Exit specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32|| Type (0=PausedThread, 1=RunningThread, 2=ExitedProcess, 3=TerminatedProcess)
|}

Exception specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32 || ExceptionType
|-
| 0x18 || u64 || FaultRegister
|-
| 0x20 || || PerExceptionSpecifics
|}

=== DebugEventType ===
{| class=wikitable
! Value || Name
|-
| 0 || DebugEvent_AttachProcess
|-
| 1 || DebugEvent_AttachThread
|-
| 2 || DebugEvent_ExitProcess
|-
| 3 || DebugEvent_ExitThread
|-
| 4 || DebugEvent_Exception
|}

=== DebugExceptionType ===
{| class=wikitable
! Value || Name
|-
| 0 || Exception_Trap (*)
|-
| 1 || Exception_InstructionAbort
|-
| 2 || Exception_DataAbortMisc (**)
|-
| 3 || Exception_PcSpAlignmentFault
|-
| 4 || Exception_DebuggerAttached
|-
| 5 || Exception_BreakPoint
|-
| 6 || Exception_UserBreak
|-
| 7 || Exception_DebuggerBreak
|-
| 8 || Exception_BadSvcId
|-
| 9 || Exception_SError [not in 1.0.0]
|}

<nowiki>*</nowiki> Undefined instructions, software breakpoints, some other traps.

<nowiki>**</nowiki> Data aborts, FP traps, and everything else that doesn't belong to any of the above.

Trap specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Opcode
|}

BreakPoint specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || IsWatchpoint
|}

UserBreak specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Info0
|-
| 0x28 || u64 || Info1
|-
| 0x30 || u64 || Info2
|}

BadSvcId specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || SvcId
|}

= Exception handling =
First of all, a function that might be called by synchronous exception handler and that is called by the SError handler fetches the exception info, adjusts PC, panics on exceptions taken from EL1, then dispatches the exception.

The dispatcher has two mutually exclusive exception reporting methods:
* by storing information at the start of the process's TLS memregion (TPIDRRO_EL0) and jumping back to the crt0
* by using KDebug

KDebug dispatching is used when at least one of the following conditions are met:
* SMC ConfigItem KernelMemConfig bit 1 is NOT set (it isn't on retail), unless: this is a software or hardware breakpoint, or a watchpoint, or [4.0.0+?] the process is attached and this is a Google PNaCl trap instruction (see LLVM source)
* FAR doesn't point to a valid address in mapped-readable CodeStatic memory (i.e. this is the case for NRO and JIT memory) or this is one of the following exceptions (it particular, that doesn't include FP exceptions occurring in CodeStatic memory):
** Uncategorized
** IllegalState
** SupervisorCallA32
** SupervisorCallA64
** PCAlignment
** SPAlignment
** SError
** BreakpointLowerEl
** SoftwareStepLowerEl (note: no way set single-step flag; not parsed)
** WatchpointLowerEl
** SoftwareBreakpointA32 (note: not parsed)
** SoftwareBreakpointA64 (note: not parsed)

In all other cases the userland-handled exception path is taken.

KDebug path:

If the process is attached, the exception is reported to the KDebug. If the thread was continued using flag IgnoreExceptions, it returns from the exception as if nothing happened.

If the latter is not the case, or if the process isn't attached, proceed to [2.0.0+] crash reporting (or in [1.0.0] just terminate the process):
if EnableDebug is set, and depending on the process state (more than one crash per process isn't permitted) it may signal itself with ProcessState_Crashed so that PM asks NS to start creport so that creport attaches to it and reports the crashes. Otherwise, just terminate.

Userland reporting path and svcReturnFromException:

TLS region start (A64):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x148 || Exception stack
|-
| 0x148 || 0x78 || ExceptionFrameA64
|}

ExceptionFrameA64:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x48 (8*9) || GPRs 0..8.
|-
| 0x48 || 0x8 || lr
|-
| 0x50 || 0x8 || sp
|-
| 0x58 || 0x8 || pc (elr_el1)
|-
| 0x60 || 0x4 || pstate & 0xFF0FFE20
|-
| 0x64 || 0x4 || afsr0
|-
| 0x68 || 0x4 || afsr1
|-
| 0x6C || 0x4 || esr
|-
| 0x70 || 0x8 || far
|}

TLS region start (A32):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x178 || Exception stack
|-
| 0x148 || 0x44 || ExceptionFrameA32
|}

ExceptionFrameA32:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x20 (8*4) || GPRs 0..7.
|-
| 0x20 || 0x4 || sp
|-
| 0x24 || 0x4 || lr
|-
| 0x28 || 0x4 || pc (elr_el1)
|-
| 0x2C || 0x4 || tpidr_el0 = 1
|-
| 0x30 || 0x4 || cpsr & 0xFF0FFE20
|-
| 0x34 || 0x4 || afsr0
|-
| 0x38 || 0x4 || afsr1
|-
| 0x3C || 0x4 || esr
|-
| 0x40 || 0x4 || far
|}

In that case, after storing the regs in the TLS, the exception handler returns to the application's crt0 (entrypoint), with X0=<error description code> (see below) and X1=SP=frame=<stack top> (see above)

{| class=wikitable
! Desc. code || Meaning
|-
| 0x100 || Instruction abort
|-
| 0x102 || Misaligned PC
|-
| 0x103 || Misaligned SP
|-
| 0x106 || SError [not in 1.0.0?]
|-
| 0x301 || Bad SVC
|-
| 0x104 || Uncategorized, CP15RTTrap, CP15RRTTrap, CP14RTTrap, CP14RRTTrap, IllegalState, SystemRegisterTrap
|-
| 0x101 || None of the above, EC <= 0x34 and not a breakpoint
|-
|}

(During normal app boot the process is invoked with X0=0 and X1=main_thread_handle. The crt0 of retail apps determines whether to boot normally or handle an exception if X0 is set to 0 or not)

The application is supposed to promptly update the contents of elr_el1 to a user handler (and any other regs it sees fit) and call svcReturnFromException (error code) to call that handler. The latter is then expected to promptly abort the program.

svcReturnFromException updates the contents of the kernel stack frame with what the user provided in the TLS structure, sets TPIDR_EL0 to 1, then:
* if the provided error code is 0, gracefully pivots and returns from exception
* if it is not, replays the exception and pass it to the KDebug (see above). One can pass 0x10001 to prevent process termination. If the process is attached, this also prevents crash-collection/termination (different from the exception handler behavior)

If an exception occurs from the above user handler, the entire exception handling process will repeat with the new exception.

Note that if a thread that wasn't faulting calls svcReturnFromException, it signals an "invalid syscall" exception

Note that [[SMC|IsDebugMode]] is not used during exception-handling, except for enabling printing a message to UART-A. This UART code causes a system-hang on retail (likely due to a loop that doesn't exit). This printing doesn't seem to run when the process is attached for debugging?

NPDM

2019-01-31T00:04:37Z

Qlutoo: /* META */

This is the Switch equivalent of 3DS [https://www.3dbrew.org/wiki/NCCH/Extended_Header exheader]. This is the file with extension ".npdm" in {Switch ExeFS}. The size of this file varies.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x80
| META
|-
| 0x80
| <Varies>
| ACID
|-
| <See META>
| <See META>
| ACI0
|}

= META =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Magic "META".
|-
| 0x4
| 0x8
| Reserved (Padding / Unused)
|-
| 0xC
| 0x1
| MmuFlags, bit0: 64-bit instructions, bits1-3: address space width (1=64-bit, 2=32-bit). Needs to be <= 0xF
|-
| 0xD
| 0x1
| Reserved (Padding / Unused)
|-
| 0xE
| 0x1
| Main thread priority (0-63)
|-
| 0xF
| 0x1
| DefaultCpuId
|-
| 0x10
| 0x4
| Reserved
|-
| 0x14
| 0x4
| [3.0.0+] System resource size (max size as of 5.x: 534773760). The size of PersonalMmHeap.
|-
| 0x18
| 0x4
| ProcessCategory (0: regular title, 1: kernel built-in). Should be 0 here.
|-
| 0x1C
| 0x4
| Main entrypoint stack size (Should(?) be page-aligned. In non-nspwn scenarios, values of 0 can also rarely break in Horizon. This might be something auto-adapting or a security feature of some sort?)
|-
| 0x20
| 0x10
| Title name
|-
| 0x30
| 0x10
| Product code
|-
| 0x40
| 0x30
| Reserved (Padding / Unused)
|-
| 0x70
| 0x4
| [[#ACI0]] offset
|-
| 0x74
| 0x4
| [[#ACI0]] size
|-
| 0x78
| 0x4
| [[#ACID]] offset
|-
| 0x7C
| 0x4
| [[#ACID]] size
|}

= ACID =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x100
| RSA-2048 signature, seems to verify the data starting at 0x100 with the size field from 0x204.
|-
| 0x100
| 0x100
| RSA-2048 public key, seems to be used for the second [[NCA_Format|NCA]] signature.
|-
| 0x200
| 0x4
| Magic "ACID".
|-
| 0x204
| 0x4
| s32 Size field used with the above signature(?).
|-
| 0x208
| 0x4
| Zeroes
|-
| 0x20C
| 0x4
| Flags. Bit0 must be 1 on retail, on devunit 0 is also allowed. Bit1 is unknown, set to 1 for ARMS? [5.0.0+] Bit3-2: PoolPartition? For applets set to 0b01, for sysmodules set to 0b10. Exceptions: "starter" is set to 0, "nvservices" is set to 3.
|-
| 0x210
| 0x8
| TitleIdRange_Min
|-
| 0x218
| 0x8
| TitleIdRange_Max
|-
| 0x220
| 0x4
| [[#FS Access Control]] offset
|-
| 0x224
| 0x4
| [[#FS Access Control]] size
|-
| 0x228
| 0x4
| [[#Service Access Control]] offset
|-
| 0x22C
| 0x4
| [[#Service Access Control]] size
|-
| 0x230
| 0x4
| [[#Kernel Access Control]] offset
|-
| 0x234
| 0x4
| [[#Kernel Access Control]] size
|-
| 0x238
| 0x8
| Padding
|}

= ACI0 =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Magic "ACI0".
|-
| 0x4
| 0xC
| Zeroes
|-
| 0x10
| 0x8
| Title id
|-
| 0x18
| 0x8
| Reserved (Not currently used, potentially to be used for lowest title ID in future.)
|-
| 0x20
| 0x4
| [[#FS Access Header]] offset
|-
| 0x24
| 0x4
| [[#FS Access Header]] size
|-
| 0x28
| 0x4
| [[#Service Access Control]] offset
|-
| 0x2C
| 0x4
| [[#Service Access Control]] size
|-
| 0x30
| 0x4
| [[#Kernel Access Control]] offset
|-
| 0x34
| 0x4
| [[#Kernel Access Control]] size
|-
| 0x38
| 0x8
| Padding
|}

= FS Access Header =

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Version? Always 1. Must be non-zero.
|-
| 0x1
| 0x3
| Padding
|-
| 0x4
| 0x8
| Permissions bitmask
|-
| 0xC
| 0x4
| Data Size (Always 0x1C)
|-
| 0x10
| 0x4
| Size of Content Owner ID section.
|-
| 0x14
| 0x4
| Data size (0x1C) plus Content Owner size
|-
| 0x18
| 0x4
| Size of Save Data owners section (for applications that wish to share save data?)
|-
| 0x1C
| 0x4
| (OPTIONAL) Amount of content owner id's
|-
| 0x1C
| 0x8 * Content Owner ID's
| Content owner ID's as uint64's.
|-
| VARIABLE
| 0x4
| Amount of save owner id's
|-
| VARIABLE
| 0x1 * Save data owner accessibilities (?)
| Sets flags for what save data owners can do with other applications save data (?)
|-
| VARIABLE (Pad to nearest 4 bytes)
| 0x8 * Amount of save owner ID's
| Save data owner ID's
|}

= FS Access Control =

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Version? Always 1. Must be non-zero.
|-
| 0x1
| 0x3
| Padding
|-
| 0x4
| 0x8
| Permissions bitmask
|-
| 0xC
| 0x20
| Usually all zeroes for applications
|}

[[Filesystem_services#Permissions|Permissions]] bitmask:
{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| 0
| MountContent* is accessible when set.
|-
| 34
| Enables access to [[Filesystem_services|Bis]] partitionID 27 and 28?
|-
| 63
| Enables access to everything: all [[Filesystem_services#Permissions|permission-types]] which check a bitmask have this bit set.
|}

For bit62 in permissions, see [[SPL_services#GetConfig|here]].

Web-applets permissions:
* "LibAppletWeb" and "LibAppletOff" have same access control: bit0 and bit3 set, and bit62 set.
* Rest of the web-applets: Same as above except bit0 isn't set.

= Service Access Control =
This is a list of [[Services_API|service]]-name strings which the title has access to, with the following structure:
+0: control_byte
+1: {service-name without nul-terminator}

Bitmask 0x07 in control_byte is the {length of the service-name without nul-terminator} - 1.

Bitmask 0x80 in control_byte means service is allowed to be registered.

The service string can contain a wildcard <code>*</code> character.

= Kernel Access Control =
On Switch, descriptors are identified by pattern 01..11 in low bits.

{| class="wikitable" border="1"
|-
! Pattern of lower bits
! Lowest clear bitmask/bit
! Type
! Fields
|-
| <code>0bxxxxxxxxxxxx0111</code>
| Bit3
| KernelFlags
| Bit31-24: Highest allowed cpu id, bit23-16: Lowest allowed cpu id, bit15-10: Highest allowed thread prio, bit9-4: Lowest allowed thread prio
|-
| <code>0bxxxxxxxxxxx01111</code>
| Bit4
| SyscallMask
| Bits 29-31: Syscall mask table index; Bits 5-28: Mask
|-
| <code>0bxxxxxxxxx0111111</code>
| Bit6
| MapIoOrNormalRange
| Bits 7-30: Alternating start page and number of pages, bit31: Alternating read-only flag then MemoryAttribute 0x2001/0x42002 selector flag
|-
| <code>0bxxxxxxxx01111111</code>
| Bit7
| MapNormalPage (RW)
| Bits 8-31: Page
|-
| <code>0bxxxx011111111111</code>
| Bit11
| InterruptPair
| Bits 12-21: Irq0, bits 22-31: Irq1, 0x3FF means empty.
|-
| <code>0bxx01111111111111</code>
| Bit13
| ApplicationType
| Bit16-14: ApplicationType (0=sysmodule, 1=application, 2=applet), bit16 ignored. Parsed by [[Process Manager services]]. Defaults to 0 if descriptor doesn't exist. Can only run 1 application at a time.
|-
| <code>0bx011111111111111</code>
| Bit14
| KernelReleaseVersion
| Bits 15-X: Version. The raw descriptor is compared with 0x80000, when less than an error is returned. This is equivalent to comparing the bits starting at bit15 with 0x10. This enforces a minimum required version, not a maximum.
|-
| <code>0b0111111111111111</code>
| Bit15
| HandleTableSize
| Bit25-16: Number of handles the table shall fit.
|-
| <code>0b1111111111111111</code>
| Bit16
| DebugFlags
| Bit17: can be debugged, bit18: can debug others
|-
| All ones
|
| Ignored
|
|}

== Mapping restrictions ==
The physaddr range 0x80060000-0x2000000000 is not allowed to be mapped as IO.
The physaddr range 0x80000000-0x2000000000 is not allowed to be mapped as Normal.

[2.0.0-4.1.0] The range for IO was changed into 0x80060000-0x81D3FFFF.

[2.0.0-4.1.0] A blacklist was added for IO and Normal mappings:
* 0x50040000-0x50060000 (ARM, Interrupt Controller)
* 0x6000F000 (Exception Vectors)
* 0x6001DC00-0x6001E000 (IPATCH)
* 0x7000E000 (RTC/PMC)
* 0x70019000 (MC)
* 0x7001C000 (MC0)
* 0x7001D000 (MC1)

[5.0.0+] For IO, this blacklist was abandoned and instead two range checks were added. For Normal mappings it is still applied

== Kernel versions ==
{| class="wikitable" border="1"
|-
! Firmware || Kernel Version || Minimum Allowed
|-
| 1.0.0 || 5.0.0 || 3.0.0
|-
| 2.0.0 || 6.1.0 || 3.0.0
|-
| 3.0.0 || 7.4.0 || 3.0.0
|-
| 3.0.2 || 7.4.0 || 3.0.0
|-
| 5.0.0 || 9.3.0 || 3.0.0
|}

Bit31-19: Major version
Bit18-15: Minor version
Bit14-0: Zeroes

SVC

2019-01-29T18:39:04Z

Qlutoo: /* svcGetInfo */

__NOTOC__

= System calls =
{| class=wikitable
! Id || Name || In || Out
|-
| 0x1 || [[#svcSetHeapSize]] || W1=size || W0=result, X1=outaddr
|-
| 0x2 || [[#svcSetMemoryPermission]] || X0=addr, X1=size, W2=prot || W0=result
|-
| 0x3 || [[#svcSetMemoryAttribute]] || X0=addr, X1=size, W2=state0, W3=state1 || W0=result
|-
| 0x4 || [[#svcMapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x5 || [[#svcUnmapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x6 || [[#svcQueryMemory]] || X0=MemoryInfo*, X2=addr || W0=result, W1=PageInfo
|-
| 0x7 || [[#svcExitProcess]] || None ||
|-
| 0x8 || [[#svcCreateThread]] || X1=entry, X2=thread_context, X3=stacktop, W4=prio, W5=processor_id || W0=result, W1=handle
|-
| 0x9 || [[#svcStartThread]] || W0=thread_handle || W0=result
|-
| 0xA || [[#svcExitThread]] || None ||
|-
| 0xB || [[#svcSleepThread]] || X0=nano ||
|-
| 0xC || [[#svcGetThreadPriority]] || W1=thread_handle || W0=result, W1=prio
|-
| 0xD || [[#svcSetThreadPriority]] || W0=thread_handle, W1=prio || W0=result
|-
| 0xE || [[#svcGetThreadCoreMask]] || W2=thread_handle || W0=result, W1=out, X2=out
|-
| 0xF || [[#svcSetThreadCoreMask]] || W0=thread_handle, W1=in, X2=in2 || W0=result
|-
| 0x10 || [[#svcGetCurrentProcessorNumber]] || None || W0/X0=cpuid
|-
| 0x11 || svcSignalEvent || W0=wevent_handle || W0=result
|-
| 0x12 || svcClearEvent || W0=wevent_or_revent_handle || W0=result
|-
| 0x13 || [[#svcMapSharedMemory]] || W0=shmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x14 || svcUnmapSharedMemory || W0=shmem_handle, X1=addr, X2=size || W0=result
|-
| 0x15 || [[#svcCreateTransferMemory]] || X1=addr, X2=size, W3=perm || W0=result, W1=tmem_handle
|-
| 0x16 || svcCloseHandle || W0=handle || W0=result
|-
| 0x17 || svcResetSignal || W0=revent_or_process_handle || W0=result
|-
| 0x18 || [[#svcWaitSynchronization]] || X1=handles_ptr, W2=num_handles. X3=timeout || W0=result, W1=handle_idx
|-
| 0x19 || [[#svcCancelSynchronization]] || W0=thread_handle || W0=result
|-
| 0x1A || svcArbitrateLock || W0=cur_thread_handle, X1=ptr, W2=req_thread_handle ||
|-
| 0x1B || svcArbitrateUnlock || X0=ptr ||
|-
| 0x1C || svcWaitProcessWideKeyAtomic || X0=ptr0, X1=ptr, W2=thread_handle, X3=timeout || W0=result
|-
| 0x1D || svcSignalProcessWideKey || X0=ptr, W1=value || W0=result
|-
| 0x1E || [[#svcGetSystemTick]] || None || X0={value of cntpct_el0}
|-
| 0x1F || svcConnectToNamedPort || X1=port_name_str || W0=result, W1=handle
|-
| 0x20 || svcSendSyncRequestLight || W0=light_session_handle, X1=? || W0=result
|-
| 0x21 || svcSendSyncRequest || X0=normal_session_handle || W0=result
|-
| 0x22 || [[#svcSendSyncRequestWithUserBuffer]] || X0=cmdbufptr, X1=size, X2=handle || W0=result
|-
| 0x23 || svcSendAsyncRequestWithUserBuffer || X1=cmdbufptr, X2=size, X3=handle || W0=result, W1=revent_handle
|-
| 0x24 || svcGetProcessId || W1=thread_or_process_or_debug_handle || W0=result, X1=pid
|-
| 0x25 || svcGetThreadId || W1=thread_handle || W0=result, X1=out
|-
| 0x26 || [[#svcBreak]] || X0=break_reason,X1,X2=info || W0=result = 0
|-
| 0x27 || svcOutputDebugString || X0=str, X1=size || W0=result
|-
| 0x28 || svcReturnFromException || X0=result ||
|-
| 0x29 || [[#svcGetInfo]] || X1=info_id, X2=handle, X3=info_sub_id || W0=result, X1=out
|-
| 0x2A || svcFlushEntireDataCache || None || None
|-
| 0x2B || svcFlushDataCache || X0=addr, X1=size || W0=result
|-
| 0x2C || [3.0.0+] [[#svcMapPhysicalMemory]] || X0=addr, X1=size || W0=result
|-
| 0x2D || [3.0.0+] svcUnmapPhysicalMemory || X0=addr, X1=size || W0=result
|-
| 0x2E || [5.0.0+] svcGetFutureThreadInfo || X3=timeout || W0=result, bunch of crap
|-
| 0x2F || svcGetLastThreadInfo || None || W0=result, W1,W2,W3,W4=unk, W5=truncated_u64, W6=bool
|-
| 0x30 || svcGetResourceLimitLimitValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
|-
| 0x31 || svcGetResourceLimitCurrentValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
|-
| 0x32 || svcSetThreadActivity || W0=thread_handle, W1=bool || W0=result
|-
| 0x33 || svcGetThreadContext3 || X0=[[#ThreadContext]]*, W1=thread_handle || W0=result
|-
| 0x34 || [4.0.0+] svcWaitForAddress || X0=ptr, W1=[[#ArbitrationType]], X2=value X3=timeout ||
|-
| 0x35 || [4.0.0+] svcSignalToAddress || X0=ptr, W1=[[#SignalType]], X2=value W3=num_to_signal ||
|- style="border-top: double"
| 0x3C || [[#svcDumpInfo]] || ||
|-
| 0x3D || [4.0.0+] svcDumpInfoNew || ||
|- style="border-top: double"
| 0x40 || svcCreateSession || W2=is_light, X3=? || W0=result, W1=server_handle, W2=client_handle
|-
| 0x41 || [[#svcAcceptSession]] || W1=port_handle || W0=result, W1=session_handle
|-
| 0x42 || svcReplyAndReceiveLight || W0=light_session_handle || W0=result, W1,W2,W3,W4,W5,W6,W7=out
|-
| 0x43 || [[#svcReplyAndReceive]] || X1=ptr_handles, W2=num_handles, X3=replytarget_handle(0=none), X4=timeout || W0=result, W1=handle_idx
|-
| 0x44 || svcReplyAndReceiveWithUserBuffer|| X1=buf, X2=sz, X3=ptr_handles, W4=num_handles, X5=replytarget_handle(0=none), X6=timeout || W0=result, W1=handle_idx
|-
| 0x45 || svcCreateEvent || None || W0=result, W1=wevent_handle, W2=revent_handle
|- style="border-top: double"
| 0x48 || [5.0.0+] [[#svcMapPhysicalMemoryUnsafe]] || X0=addr, X1=size || W0=result
|-
| 0x49 || [5.0.0+] svcUnmapPhysicalMemoryUnsafe || X0=addr, X1=size || W0=result
|-
| 0x4A || [5.0.0+] svcSetUnsafeLimit || X0=size || W0=result
|-
| 0x4B || [4.0.0+] [[#svcCreateCodeMemory]] || X1=addr, X2=size || W0=result, W1=code_memory_handle
|-
| 0x4C || [4.0.0+] [[#svcControlCodeMemory]] || W0=code_memory_handle, W1=[[#CodeMemoryOperation]], X2=dstaddr, X3=size, W4=perm || W0=result
|-
| 0x4D || svcSleepSystem || None || None
|-
| 0x4E || [[#svcReadWriteRegister]] || X1=reg_addr, W2=rw_mask, W3=in_val || W0=result, W1=out_val
|-
| 0x4F || svcSetProcessActivity || W0=process_handle, W1=bool || W0=result
|-
| 0x50 || [[#svcCreateSharedMemory]] || W1=size, W2=myperm, W3=otherperm || W0=result, W1=shmem_handle
|-
| 0x51 || [[#svcMapTransferMemory]] || X0=tmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x52 || [[#svcUnmapTransferMemory]] || W0=tmemhandle, X1=addr, X2=size || W0=result
|-
| 0x53 || [[#svcCreateInterruptEvent]] || X1=irq_num, W2=flag || W0=result, W1=handle
|-
| 0x54 || [[#svcQueryPhysicalAddress]] || X1=addr || W0=result, X1=physaddr, X2=kerneladdr, X3=size
|-
| 0x55 || [[#svcQueryIoMapping]] || X1=physaddr, X2=size || W0=result, X1=virtaddr
|-
| 0x56 || [[#svcCreateDeviceAddressSpace]] || X1=dev_as_start_addr, X2=dev_as_end_addr || W0=result, W1=dev_as_handle
|-
| 0x57 || [[#svcAttachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x58 || [[#svcDetachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x59 || [[#svcMapDeviceAddressSpaceByForce]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm || W0=result
|-
| 0x5A || [[#svcMapDeviceAddressSpaceAligned]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm || W0=result
|-
| 0x5B || svcMapDeviceAddressSpace || ||
|-
| 0x5C || [[#svcUnmapDeviceAddressSpace]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr || W0=result
|-
| 0x5D || svcInvalidateProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x5E || svcStoreProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x5F || svcFlushProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x60 || svcDebugActiveProcess || X1=pid || W0=result, W1=debug_handle
|-
| 0x61 || svcBreakDebugProcess || W0=debug_handle || W0=result
|-
| 0x62 || svcTerminateDebugProcess || W0=debug_handle || W0=result
|-
| 0x63 || svcGetDebugEvent || X0=[[#DebugEventInfo]]*, W1=debug_handle || W0=result
|-
| 0x64 || [[#svcContinueDebugEvent]] || [1.0.0-2.3.0] W0=debug_handle, W1=[[#ContinueDebugFlagsOld]], X2=thread_id
[3.0.0+] W0=debug_handle, W1=[[#ContinueDebugFlags]], X2=thread_id_list(u64 *), W3=num_tids (max 64, 0 means "all threads")
|| W0=result
|-
| 0x65 || svcGetProcessList || X1=pids_out_ptr, W2=max_out || W0=result, W1=num_out
|-
| 0x66 || svcGetThreadList || X1=tids_out_ptr, W2=max_out, W3=debug_handle_or_zero || W0=result, X1=num_out
|-
| 0x67 || svcGetDebugThreadContext || X0=ThreadContext*, X1=debug_handle, X2=thread_id, W3=[[#ThreadContextFlags]] || W0=result
|-
| 0x68 || svcSetDebugThreadContext || W0=debug_handle, X1=thread_id, X2=ThreadContext*, W3=[[#ThreadContextFlags]] || W0=result
|-
| 0x69 || svcQueryDebugProcessMemory || X0=[[#MemoryInfo]]*, X2=debug_handle, X3=addr || W0=result, W1=PageInfo
|-
| 0x6A || svcReadDebugProcessMemory || X0=buffer*, X1=debug_handle, X2=src_addr, X3=size || W0=result
|-
| 0x6B || svcWriteDebugProcessMemory || X0=debug_handle, X1=buffer*, X2=dst_addr, X3=size || W0=result
|-
| 0x6C || [[#svcSetHardwareBreakPoint]] || W0=HardwareBreakpointId, X1=watchpoint_flags/breakpoint_flags, X2=watchpoint_value/debug_handle ||
|-
| 0x6D || svcGetDebugThreadParam || X2=debug_handle, X3=thread_id, W4=[[#DebugThreadParam]] || W0=result, X1=out0, W2=out1
|- style="border-top: double"
| 0x6F || [5.0.0+] [[#svcGetSystemInfo]] || X1=info_id, X2=handle, X3=info_sub_id || W0=result, X1=out
|-
| 0x70 || svcCreatePort || W2=max_sessions, W3=is_light, X4=name_ptr || W0=result, W1=clientport_handle, W2=serverport_handle
|-
| 0x71 || svcManageNamedPort || X1=name_ptr, W2=max_sessions || W0=result, W1=serverport_handle
|-
| 0x72 || svcConnectToPort || W1=clientport_handle || W0=result, W1=session_handle
|-
| 0x73 || [[#svcSetProcessMemoryPermission]] || W0=process_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x74 || [[#svcMapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size || W0=result
|-
| 0x75 || [[#svcUnmapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size || W0=result
|-
| 0x76 || [[#svcQueryProcessMemory]] || X0=meminfo_ptr, W2=process_handle, X3=addr || W0=result, W1=pageinfo
|-
| 0x77 || [[#svcMapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x78 || [[#svcUnmapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x79 || [[#svcCreateProcess]] || X1=procinfo_ptr, X2=caps_ptr, W3=cap_num || W0=result, W1=process_handle
|-
| 0x7A || svcStartProcess || W0=process_handle, W1=main_thread_prio, W2=default_cpuid, W3=main_thread_stacksz || W0=result
|-
| 0x7B || svcTerminateProcess || W0=process_handle || W0=result
|-
| 0x7C || [[#svcGetProcessInfo]] || W0=process_handle, W1=[[#ProcessInfoType]] || W0=result, X1=[[#ProcessState]]
|-
| 0x7D || svcCreateResourceLimit || None || W0=result, W1=reslimit_handle
|-
| 0x7E || svcSetResourceLimitLimitValue || W0=reslimit_handle, W1=[[#LimitableResource]], X2=value || W0=result
|-
| 0x7F || svcCallSecureMonitor || X0=smc_sub_id, X1,X2,X3,X4,X5,X6,X7=smc_args || X0,X1,X2,X3,X4,X5,X6,X7=result
|}

== svcSetHeapSize ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || OutAddr
|}
</div>

'''Description:''' Set the process heap to a given Size. It can both extend and shrink the heap.

Size must be a multiple of 0x200000 (2MB).

On success, the heap base-address (which is fixed by kernel, aslr'd) is written to OutAddr.

Uses current process pool partition.

[2.0.0+] Size must be less than or equal to 4GB.

== svcSetMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || Prot
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change permission of page-aligned memory region.

Bit2 of permission (exec) is not allowed. Setting write-only is not allowed either (bit1).

This can be used to move back and forth between ---, r-- and rw-.

== svcSetMemoryAttribute ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || u32 || State0
|-
| (In) W3 || u32 || State1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change attribute of page-aligned memory region.

This is used to turn on/off caching for a given memory area. Useful when talking to devices such as the GPU.

What happens "under the hood" is the "Memory Attribute Indirection Register" index is changed from 2 to 3 in the MMU descriptor.

{| class=wikitable
! State0 || State1 || Action
|-
| 0 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 8 || Set bit3 in [[#MemoryAttribute]].
|}

== svcMapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps a memory range into a different range.

Mainly used for adding guard pages around stack.

Source range gets reprotected to --- (it can no longer be accessed), and bit0 is set in the source [[#MemoryAttribute]].

[1.0.0] This could be used to map into either the Alias Region or the Stack region.

[2.0.0+] This can only be used to map into the Stack region.

Code can get the range of the Alias region from [[#svcGetInfo]] id0=2,3, and on 2.0.0+ the range of the Stack region via [[#svcGetInfo]] id0=14, 15 (on 1.0.0, the Stack region had hardcoded limits).

When mapped into the Alias region, the mapped memory will have state 0x482907.

When mapped into the Stack region, the mapped memory will have state 0x5C3C0B.

== svcUnmapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps a region that was previously mapped with [[#svcMapMemory]].

It's possible to unmap ranges partially, you don't need to unmap the entire range "in one go".

The srcaddr/dstaddr must match what was given when the pages were originally mapped.

== svcQueryMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfo
|-
| (In) X2 || void* || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

'''Description:''' Query information about an address. Will always fetch the lowest page-aligned mapping that contains the provided address.

Outputs a [[#MemoryInfo]] struct.

== svcExitProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current process.

== svcCreateThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void(*)(void*) || Entry
|-
| (In) X2 || void* || ThreadContext
|-
| (In) X3 || void* || StackTop
|-
| (In) W4 || u32 || Priority
|-
| (In) W5 || u32 || ProcessorId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Thread> || Handle
|}
</div>

'''Description:''' Create a thread in the current process.

Processor_id must be 0,1,2,3 or -2, where -2 uses the default cpuid for process.

== svcStartThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) None || ||
|}
</div>

'''Description:''' Starts the thread for the provided handle.

== svcExitThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current thread.

== svcSleepThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || s64 || Nanoseconds
|-
|}
</div>

'''Description:''' Sleep for a specified amount of time, or yield thread.

Setting nanoseconds to 0, -1, or -2 indicates a yielding type.

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Value || Type
|-
| 0 || Yielding without core migration
|-
| -1 || Yielding with core migration
|-
| -2 || Yielding to any other thread
|-
|}
</div>

== svcGetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1|| Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || Priority
|}
</div>

'''Description:''' Get priority of provided thread handle.

== svcSetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0|| Handle<Thread> || Handle
|-
| (In) W1|| u32 || Priority
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set priority of provided thread handle.

Priority is a number 0-0x3F. Lower value means higher priority.

== svcGetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W2 || Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u32 || Out0
|-
| (Out) X2 || u64 || Out1
|}
</div>

'''Description:''' Get affinity mask of provided thread handle.

== svcSetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (In) W1 || u32 || In0
|-
| (In) X2 || u64 || In1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set affinity mask of provided thread handle.

== svcGetCurrentProcessorNumber ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0/X0 || u64 || CpuId
|}
</div>

'''Description:''' Get which cpu is executing the current thread.

Cpu-id is an integer in the range 0-3.

== svcMapSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<SharedMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the block supplied by the handle. The required permissions are different for the process that created the handle and all other processes.

Increases reference count for the KSharedMemory object. Thus in order to release the memory associated with the object, all handles to it must be closed and all mappings must be unmapped.

== svcCreateTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<TransferMemory> || Handle
|}
</div>

This one reprotects the src block with perms you give it. It also sets bit0 into [[#MemoryAttribute]].

Executable bit perm not allowed.

Closing all handles automatically causes the bit0 in [[#MemoryAttribute]] to clear, and the permission to reset.

== svcWaitSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || Handle* || HandlesPtr
|-
| (In) W2 || u64 || HandlesNum
|-
| (In) X3 || u64 || Timeout
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || HandleIndex
|}
</div>

Works with num_handles <= 0x40.

When zero handles are passed, this will wait forever until either timeout or cancellation occurs.

Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.

=== Object types ===

'''KDebug:''' signals when there is a new [[#DebugEventInfo|DebugEvent]] (retrievable via [[#svcGetDebugEvent]]).

'''KClientPort:''' signals when the number of sessions is less than the maximum allowed.

'''KProcess:''' signals when the process undergoes a state change (retrievable via [[#svcGetProcessInfo]]).

'''KReadableEvent:''' signals when the event's corresponding KWritableEvent has been signaled via svcSignalEvent.

'''KServerPort:''' signals when there is an incoming connection waiting to be [[#svcAcceptSession|accepted]].

'''KServerSession:''' signals when there is an incoming message waiting to be [[#svcReplyAndReceive|received]] or the pipe is closed.

'''KThread:''' signals when the thread has exited.

=== Result codes ===

'''0x0:''' Success. One of the objects was signaled before the timeout expired, or one of the objects is a Session with a closed remote. Handle index is updated to indicate which object signaled.

'''0x7601:''' Thread termination requested. Handle index is not updated.

'''0xe401:''' Invalid handle. Returned when one of the handles passed is invalid. Handle index is not updated.

'''0xe601:''' Invalid address. Returned when the handles pointer is not a readable address. Handle index is not updated.

'''0xea01:''' Timeout. Returned when no objects have been signaled within the timeout. Handle index is not updated.

'''0xec01:''' Interrupted. Returned when another thread uses [[#svcCancelSynchronization]] to cancel this thread. Handle index is not updated.

'''0xee01:''' Too many handles. Returned when the number of handles passed is > 0x40.

== svcCancelSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

If the referenced thread is currently in a synchronization call ([[#svcWaitSynchronization]], [[#svcReplyAndReceive]] or [[#svcReplyAndReceiveLight]]), that call will be interrupted and return 0xec01.
If that thread is not currently executing such a synchronization call, the next call to a synchronization call will return 0xec01.

This doesn't take force-pause (activity/debug pause) into account.

=== Result codes ===

'''0x0:''' Success. The thread was either interrupted or has had its flag set.

'''0xe401:''' Invalid handle. The handle given was either invalid or not a thread handle.

== svcGetSystemTick ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (Out) X0 || u64 || Ticks
|}
</div>

Returns the value of cntpct_el0.

The frequency is 19200000 Hz (constant from official sw).

Official sw reads cntpct_el0 directly from usermode without using this SVC. [[ExeFS|sdk-nso]] has this SVC, but it's not known to be called anywhere.

== svcSendSyncRequestWithUserBuffer ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || CmdPtr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || Handle<Session> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size and CmdPtr must be 0x1000-aligned.

=== Result codes ===

'''0x0:''' Success.

'''0xcc01:''' CmdPtr is not 0x1000-aligned.

'''0xca01:''' Size is not 0x1000-aligned.

'''0xce01:''' KSessionRequest allocation failed (unlikely) or pointer buffer size exceeded.

'''0xe401:''' Handles does not exist, or handle is not an instance of KClientSession.

== svcBreak ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || Break Reason
|-
| (In) X1 || u64 ||
|-
| (In) X2 || u64 || Info
|-
| (Out) W0 || Result || 0 (Success)
|}
</div>

If the process is attached, report the Break event. Then, if svcContinueDebugEvent didn't apply IgnoreException on the thread: if TPIDR_EL0 is 0, adjust ELR_EL1 to retry to svc instruction (and set TPIDR_EL0 to 1).

Otherwise, if bit31 in reason isn't set, perform crash reporting (see Exception Handling section below), if it doesn't terminate the process adjust ELR_EL1 as well.

Otherwise just return 0.

== svcGetInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Process || 0 || 0 || AllowedCpuIdBitmask
|-
| Process || 1 || 0 || AllowedThreadPrioBitmask
|-
| Process || 2 || 0 || AliasRegionBaseAddr
|-
| Process || 3 || 0 || AliasRegionSize
|-
| Process || 4 || 0 || HeapRegionBaseAddr
|-
| Process || 5 || 0 || HeapRegionSize
|-
| Process || 6 || 0 || TotalMemoryAvailable. Total memory available(free+used).
|-
| Process || 7 || 0 || TotalMemoryUsage. Total used size of codebin memory + main-thread stack + allocated heap.
|-
| Zero || 8 || 0 || IsCurrentProcessBeingDebugged
|-
| Zero || 9 || 0 || Returns ResourceLimit handle for current process. Used by [[Process_Manager_services|PM]].
|-
| Zero || 10 || -1, {current coreid} || IdleTickCount
|-
| Zero || 11 || 0-3 || RandomEntropy from current process. TRNG. Used to seed usermode PRNGs.
|-
| Process || 12 || 0 || [2.0.0+] AddressSpaceBaseAddr
|-
| Process || 13 || 0 || [2.0.0+] AddressSpaceSize
|-
| Process || 14 || 0 || [2.0.0+] StackRegionBaseAddr
|-
| Process || 15 || 0 || [2.0.0+] StackRegionSize
|-
| Process || 16 || 0 || [3.0.0+] PersonalMmHeapSize
|-
| Process || 17 || 0 || [3.0.0+] PersonalMmHeapUsage
|-
| Process || 18 || 0 || [3.0.0+] TitleId
|-
| Zero || 19 || 0 || [4.0.0-4.1.0] PrivilegedProcessId_LowerBound
|-
| Zero || 19 || 1 || [4.0.0-4.1.0] PrivilegedProcessId_UpperBound
|-
| Process || 20 || 0 || [5.0.0+] UserExceptionContextAddr
|-
| Process || 21 || 0 || [6.0.0+] MemoryUsageSomething0
|-
| Process || 22 || 0 || [6.0.0+] MemoryUsageSomething1
|-
| Thread || 0xF0000002 || 0 || Performance counter related.
|}

== svcMapPhysicalMemory ==
This is like svcSetHeapSize except you can allocate heap at any address you'd like.

Uses current process pool partition.

== svcDumpInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

Does nothing, just returns with registers set to all-zero.

== svcAcceptSession ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || Handle<Port> || Port
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ServerSession> || Session
|}
</div>

=== Result codes ===

'''0xf201:''' No session waiting to be accepted

== svcReplyAndReceive ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || *Handle<Port or ServerSession> || Handles
|-
| (In) W2 || u32 || NumHandles
|-
| (In) W3 || Handle<ServerSession> || ReplyTarget
|-
| (In) X4 || u64 (nanoseconds) || Timeout
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || u32 || HandleIndex
|}
</div>

If ReplyTarget is not zero, a reply from the TLS will be sent to that session.
Then it will wait until either of the passed sessions has an incoming message, is closed, a passed port has an incoming connection, or the timeout expires.
If there is an incoming message, it is copied to the TLS.

If ReplyTarget is zero, the TLS should contain a blank message. If this message has a C descriptor, the buffer it points to will be used as the pointer buffer. See [[IPC_Marshalling#IPC_buffers]]. Note that a pointer buffer cannot be specified if ReplyTarget is not zero.

After being validated, passed handles will be enumerated in order; even if a session has been closed, if one that appears earlier in the list has an incoming message, it will take priority and a result code of 0x0 will be returned.

=== Result codes ===

'''0x0:''' Success. Either a session has an incoming message or a port has an incoming connection. HandleIndex is set appropriately.

'''0xea01:''' Timeout. No handles were signalled before the timeout expired. HandleIndex is not updated.

'''0xf601:''' Port remote dead. One of the sessions has been closed. HandleIndex is set appropriately.

== svcMapPhysicalMemoryUnsafe ==
Same as [[#svcMapPhysicalMemory]] except it always uses pool partition 0.

== svcCreateCodeMemory ==
Takes an address range with backing memory to create the code memory object.

The memory is initially memset to 0xFF after being locked.

== svcControlCodeMemory ==
Maps the backing memory for a Code memory object into the current process.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapOwner]], memory permission must be RW-.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapSlave]], memory permission must be R-- or R-X.

Operations [[#CodeMemoryOperation|CodeMemoryOperation_UnmapOwner/CodeMemoryOperation_UnmapSlave]] unmap memory that was previously mapped this way.

This allows one "secure JIT" process to map the code memory as RW-, and the other "slave" process to map it R-X.

[5.0.0+] Error 0xE401 is now returned when the process owner of the Code memory object is the same as the current process.

== svcReadWriteRegister ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || RegAddr
|-
| (In) W2 || u64 || RwMask
|-
| (In) W3 || u64 || InValue
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1|| u64 || OutValue
|}
</div>

Read/write IO registers with a hardcoded whitelist. Input address is physical-address and must be aligned to 4.

rw_mask is 0 for reading and 0xffffffff for writing. You can also write individual bits by using a mask value.

You can only write to registers inside physical pages 0x70019000 (MC), 0x7001C000 (MC0), 0x7001D000 (MC1), and they all share the same whitelist.

The whitelist is same for writing as for reading.

The whitelist is:

0x054, 0x090, 0x094, 0x098, 0x09c, 0x0a0, 0x0a4, 0x0a8, 0x0ac, 0x0b0, 0x0b4, 0x0b8, 0x0bc, 0x0c0, 0x0c4, 0x0c8, 0x0d0, 0x0d4, 0x0d8, 0x0dc, 0x0e0, 0x100, 0x108, 0x10c, 0x118, 0x11c, 0x124, 0x128, 0x12c, 0x130, 0x134, 0x138, 0x13c, 0x158, 0x15c, 0x164, 0x168, 0x16c, 0x170, 0x174, 0x178, 0x17c, 0x200, 0x204, 0x2e4, 0x2e8, 0x2ec, 0x2f4, 0x2f8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37c, 0x380, 0x390, 0x394, 0x398, 0x3ac, 0x3b8, 0x3bc, 0x3c0, 0x3c4, 0x3d8, 0x3e8, 0x41c, 0x420, 0x424, 0x428, 0x42c, 0x430, 0x44c, 0x47c, 0x480, 0x484, 0x50c, 0x554, 0x558, 0x55c, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69c, 0x6a0, 0x6a4, 0x6c0, 0x6c4, 0x6f0, 0x6f4, 0x960, 0x970, 0x974, 0xa20, 0xa24, 0xb88, 0xb8c, 0xbc4, 0xbc8, 0xbcc, 0xbd0, 0xbd4, 0xbd8, 0xbdc, 0xbe0, 0xbe4, 0xbe8, 0xbec, 0xc00, 0xc5c, 0xcac

[2.0.0+] Whitelist was extended with 0x4c4, 0x4c8, 0x4cc, 0x584, 0x588, 0x58c.

[2.0.0+] The IO registers in range 0x7000E400 (PMC) size 0xC00 skip the whitelist, and do a TrustZone call using [[SMC]] Id1 0xC3000008(ReadWriteRegister).

[4.0.0+] Access to the Memory Controller (0x70019000) also uses smcReadWriteRegister.

Here is the whitelist imposed by that SMC, relative to the start of the PMC registers:

0x000, 0x00c, 0x010, 0x014, 0x01c, 0x020, 0x02c, 0x030, 0x034, 0x038, 0x03c, 0x040, 0x044, 0x048, 0x0dc, 0x0e0, 0x0e4, 0x160, 0x164, 0x168, 0x170, 0x1a8, 0x1b8, 0x1bc, 0x1c0, 0x1c4, 0x1c8, 0x2b4, 0x2d4, 0x440, 0x4d8

Here is the whitelist imposed by smcReadWriteRegister (checked in addition to the whitelist in svcReadWriteRegister), relative to the start of the MC registers:

0x000, 0x004, 0x008, 0x00C, 0x010, 0x01C, 0x020, 0x030, 0x034, 0x050, 0x054, 0x090, 0x094, 0x098, 0x09C, 0x0A0, 0x0A4, 0x0A8, 0x0AC, 0x0B0, 0x0B4, 0x0B8, 0x0BC, 0x0C0, 0x0C4, 0x0C8, 0x0D0, 0x0D4, 0x0D8, 0x0DC, 0x0E0, 0x100, 0x108, 0x10C, 0x118, 0x11C, 0x124, 0x128, 0x12C, 0x130, 0x134, 0x138, 0x13C, 0x158, 0x15C, 0x164, 0x168, 0x16C, 0x170, 0x174, 0x178, 0x17C, 0x200, 0x204, 0x238, 0x240, 0x244, 0x250, 0x254, 0x258, 0x264, 0x268, 0x26C, 0x270, 0x274, 0x280, 0x284, 0x288, 0x28C, 0x294, 0x2E4, 0x2E8, 0x2EC, 0x2F4, 0x2F8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37C, 0x380, 0x390, 0x394, 0x398, 0x3AC, 0x3B8, 0x3BC, 0x3C0, 0x3C4, 0x3D8, 0x3E8, 0x41C, 0x420, 0x424, 0x428, 0x42C, 0x430, 0x44C, 0x47C, 0x480, 0x484, 0x4C4, 0x4C8, 0x4CC, 0x50C, 0x554, 0x558, 0x55C, 0x584, 0x588, 0x58C, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69C, 0x6A0, 0x6A4, 0x6C0, 0x6C4, 0x6F0, 0x6F4, 0x960, 0x970, 0x974, 0x9B8, 0xA20, 0xA24, 0xA88, 0xA94, 0xA98, 0xA9C, 0xAA0, 0xAA4, 0xAA8, 0xAAC, 0xAB0, 0xAB4, 0xAB8, 0xABC, 0xAC0, 0xAC4, 0xAC8, 0xACC, 0xAD0, 0xAD4, 0xAD8, 0xADC, 0xAE0, 0xB88, 0xB8C, 0xBC4, 0xBC8, 0xBCC, 0xBD0, 0xBD4, 0xBD8, 0xBDC, 0xBE0, 0xBE4, 0xBE8, 0xBEC, 0xC00, 0xC5C, 0xCAC

== svcCreateSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || LocalPerm
|-
| (In) W3 || [[#Permission]] || RemotePerm
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<SharedMemory> || MemHandle
|}
</div>

Other perm can be used to enforce permission 1, 3, or 0x10000000 if don't care.

Allocates memory from the current process' pool partition.

== svcMapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

The newly mapped pages will have [[#MemoryState]] type 0xE.

You must pass same size and permissions as given in svcCreateMemoryMirror, otherwise error.

== svcUnmapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must match size given in map syscall, otherwise there's an invalid-size error.

== svcCreateInterruptEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || IrqNum
|-
| (In) W2 || bool || Flags
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<ReadableEvent> || ReadableEventHandle
|}
</div>

Create an event handle for the given IRQ number. Waiting on this handle will wait until the IRQ is triggered. The flags argument configures the triggering. If it is false, the IRQ is active HIGH level sensitive, if it is true it is rising-edge sensitive.

=== Result codes ===

'''0x0:''' Success.

'''0xF001:''' Flags was > 1

'''0xF201:''' IRQ above 0x3FF or outside the [[NPDM#Kernel_Access_Control|IRQ access mask]] was given.

'''0xCE01:''' A SlabHeap was exhausted (too many interrupts created).

'''0xF401:''' IRQ already has an event registered.

'''0xD201:''' The handle table is full. Try closing some handles.

== svcQueryPhysicalAddress ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || Addr
|-
| (Out) W0 || [[#Result]]|| Ret
|-
| (Out) X1 || u64 || PhysAddr
|-
| (Out) X2 || u64 || KernelAddr
|-
| (Out) X3 || u64 || Size
|}
</div>

== svcQueryIoMapping ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || PhysAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || void* || VirtAddr
|}
</div>

'''Description:''' Returns a virtual address mapped to a given IO range.

== svcCreateDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || StartAddr
|-
| (In) X2 || u64 || EndAddr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<DeviceAddressSpace> || AddressSpaceHandle
|}
</div>

'''Description:''' Creates a virtual address space for binding device address spaces and returns a handle.

dev_as_start_addr is normally set to 0 and dev_as_end_addr is normally set to 0xFFFFFFFF.

== svcAttachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Attaches a device address space to a [[#DeviceName|device]].

== svcDetachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Detaches a device address space from a [[#DeviceName|device]].

== svcMapDeviceAddressSpaceByForce ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (In) W5 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

dev_map_addr is the userspace destination address, while dev_as_addr is the source address between dev_as_start_addr and dev_as_end_addr (passed to [[#svcCreateDeviceAddressSpace]]).

The userspace destination address must have the [[SVC#MemoryState|MapDeviceAllowed]] bit set. Bit [[SVC#MemoryAttribute|IsDeviceMapped]] will be set after mapping.

== svcMapDeviceAddressSpaceAligned ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (In) W5 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

Same as [[#svcMapDeviceAddressSpaceByForce]], but the userspace destination address must have the [[SVC#MemoryState|MapDeviceAlignedAllowed]] bit set instead.

== svcUnmapDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps an attached device address space from an userspace address.

== svcContinueDebugEvent ==

=== Result codes ===

'''0x0:''' Success. The process has been resumed.

'''0xe401:''' Invalid debug handle.

'''0xf401:''' Process has debug events queued.

== svcGetSystemInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Zero || 0 || 0 || TotalMemorySize_Application
|-
| Zero || 0 || 1 || TotalMemorySize_Applet
|-
| Zero || 0 || 2 || TotalMemorySize_System
|-
| Zero || 0 || 3 || TotalMemorySize_SystemUnsafe
|-
| Zero || 1 || 0 || CurrentMemorySize_Application
|-
| Zero || 1 || 1 || CurrentMemorySize_Applet
|-
| Zero || 1 || 2 || CurrentMemorySize_System
|-
| Zero || 1 || 3 || CurrentMemorySize_SystemUnsafe
|-
| Zero || 2 || 0 || PrivilegedProcessId_LowerBound
|-
| Zero || 2 || 1 || PrivilegedProcessId_UpperBound
|-
|}

== svcSetProcessMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || void* || Perm
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

This sets the memory permissions for the specified memory with the supplied process handle.

This throws an error(0xD801) when the input perm is >0x5, hence -WX and RWX are not allowed.

== svcMapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || DstAddr
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the src address from the supplied process handle into the current process.

This allows mapping code and rodata with RW- permission.

== svcUnmapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessMemory]].

== svcQueryProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfoPtr
|-
| (In) W2 || Handle<Process> || ProcessHandle
|-
| (In) X3 || u64 || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

Equivalent to [[#svcQueryMemory]] except takes a process handle.

== svcMapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Takes a process handle, and maps normal heap in that process as executable code in that process. Used when loading NROs. This does not support using the current-process handle alias.

== svcUnmapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessCodeMemory]].

== svcCreateProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#CreateProcessInfo]]* || InfoPtr
|-
| (In) X2 || u32* || CapabilitiesPtr
|-
| (In) X3 || u64 || CapabilitiesNum
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Process> || ProcessHandle
|}
</div>

Takes a [[#CreateProcessInfo]] as input.
CapabilitiesPtr points to an array of [[NPDM#Kernel_Access_Control|kernel capabilities]].
CapabilitiesNum is a number of capabilities in the CapabilitiesPtr array (number of element, not number of bytes).

=== Result codes ===

'''0x0:''' Success.

'''0xCA01:''' Attempted to map more code pages than available in address space.

'''0xCC01:''' Provided CodeAddr is invalid (make sure it's in range?)

'''0xE401:''' The resource handle passed is invalid.

'''0xE601:''' Attempt to copy procinfo from user-supplied pointer failed. Attempt to copy capabilities_num from user-supplied pointer failed.

'''0xE801:''' Attempted to create a 32-bit process with a 36-bit address space.

'''0xF001:''' Unused bits are set in mmuflags. Unknown address space type used.

== svcGetProcessInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || [[#ProcessState]] || State
|}
</div>

Returns an enum with value 0-7.

== Debugging ==
[2.0.0+] Exactly 6 debug SVCs require that [[SPL_services#GetConfig|IsDebugMode]] is non-zero. Error 0x4201 is returned otherwise.
* svcBreakDebugProcess
* svcContinueDebugEvent
* svcWriteDebugProcessMemory
* svcSetDebugThreadContext
* svcTerminateDebugProcess
* svcSetHardwareBreakPoint

svcDebugActiveProcess stops execution of the target process, the normal method for resuming it requires svcContinueDebugEvent(see above). Closing the debug handle also results in execution being resumed.

== svcSetHardwareBreakPoint ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || u32 || hardware_breakpoint_id
|-
| (In) W1 || u64 || flags
|-
| (In) W2 || u64 || value
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Sets one of the AArch64 hardware breakpoints. The nintendo switch has 6 hardware breakpoints, and 4 hardware watchpoints. The syscall has two behaviors depending on the value of hardware_breakpoint_id:

If hardware_breakpoint_id < 0x10, then it sets one of the AArch64 hardware breakpoints. Flags will go to DBGBCRn_EL1, and value to DBGBVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0x7F01E1. Furthermore, the kernel will or it with 0x4004, in order to set various security flags to guarantee the watchpoints only triggers for code in EL0. If the user asks for a Breakpoint Type of ContextIDR match, the kernel shall use the given debug_handle to set DBGBVRn_EL1 to the ContextID of the debugged process.

If hardware_breakpoint_id is between 0x10 and 0x20 (exclusive), then it sets one of the AArch64 hardware watchpoints. Flags will go to DBGWCRn_EL1, and the value to DBGWVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0xFF0F1FF9. Furthermore, the kernel will or it with 0x104004. This will set various security flags, and set the watchpoint type to be a Linked Watchpoint. This means that you need to link it to a Linked ContextIDR breakpoint. Check the ARM documentation for more information.

Note that hardware_breakpoint_id 0 to 4 match only to Virtual Address, while hardware_breakpoint_id 5 and 6 match against either Virtual Address, ContextID, or VMID. As such, if you are configuring a breakpoint to link for a watchpoint, make sure you use hardware_breakpoint_id 5 or 6.

For more documentation for hardware breakpoints, check out the AArch64 documentation for the [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0488h/way1382455558968.html DBGBCRn_EL1 register] and the [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0488h/way1382455560629.html DBGWCRn_EL1 register]

= Enum/Structures =
== ThreadContextRequestFlags ==
Bitfield of one of more of these:

{| class=wikitable
! Bit || Bitmask || Name
|-
| 0 || 1 || NormalContext
|-
| 1 || 2 ||
|-
| 2 || 4 ||
|-
| 3 || 8 ||
|}

== DeviceName ==
{| class=wikitable
! Value || Name
|-
| 0 || DeviceName_AFI
|-
| 1 || DeviceName_AVPC
|-
| 2 || DeviceName_DC
|-
| 3 || DeviceName_DCB
|-
| 4 || DeviceName_HC
|-
| 5 || DeviceName_HDA
|-
| 6 || DeviceName_ISP2
|-
| 7 || DeviceName_MSENCNVENC
|-
| 8 || DeviceName_NV
|-
| 9 || DeviceName_NV2
|-
| 10 || DeviceName_PPCS
|-
| 11 || DeviceName_SATA
|-
| 12 || DeviceName_VI
|-
| 13 || DeviceName_VIC
|-
| 14 || DeviceName_XUSB_HOST
|-
| 15 || DeviceName_XUSB_DEV
|-
| 16 || DeviceName_TSEC
|-
| 17 || DeviceName_PPCS1
|-
| 18 || DeviceName_DC1
|-
| 19 || DeviceName_SDMMC1A
|-
| 20 || DeviceName_SDMMC2A
|-
| 21 || DeviceName_SDMMC3A
|-
| 22 || DeviceName_SDMMC4A
|-
| 23 || DeviceName_ISP2B
|-
| 24 || DeviceName_GPU
|-
| 25 || DeviceName_GPUB
|-
| 26 || DeviceName_PPCS2
|-
| 27 || DeviceName_NVDEC
|-
| 28 || DeviceName_APE
|-
| 29 || DeviceName_SE
|-
| 30 || DeviceName_NVJPG
|-
| 31 || DeviceName_HC1
|-
| 32 || DeviceName_SE1
|-
| 33 || DeviceName_AXIAP
|-
| 34 || DeviceName_ETR
|-
| 35 || DeviceName_TSECB
|-
| 36 || DeviceName_TSEC1
|-
| 37 || DeviceName_TSECB1
|-
| 38 || DeviceName_NVDEC1
|}

== CodeMemoryOperation ==
{| class=wikitable
! Value || Name
|-
| 0 || CodeMemoryOperation_MapOwner
|-
| 1 || CodeMemoryOperation_MapSlave
|-
| 2 || CodeMemoryOperation_UnmapOwner
|-
| 3 || CodeMemoryOperation_UnmapSlave
|}

== LimitableResource ==
{| class=wikitable
! Value || Name
|-
| 0 || LimitableResource_Memory
|-
| 1 || LimitableResource_Threads
|-
| 2 || LimitableResource_Events
|-
| 3 || LimitableResource_TransferMemories
|-
| 4 || LimitableResource_Sessions
|}

== ProcessInfoType ==

{| class=wikitable
! Value || Name
|-
| 0 || [[#ProcessState|ProcessInfoType_ProcessState]]
|-
|}

== ProcessState ==
{| class=wikitable
! Value || Name || Notes
|-
| 0 || ProcessState_Created ||
|-
| 1 || ProcessState_CreatedAttached ||
|-
| 2 || ProcessState_Started ||
|-
| 3 || ProcessState_Crashed || Processes will not enter this state unless they were created with [[#CreateProcessInfo|EnableDebug]].
|-
| 4 || ProcessState_StartedAttached ||
|-
| 5 || ProcessState_Exiting ||
|-
| 6 || ProcessState_Exited ||
|-
| 7 || ProcessState_DebugSuspended ||
|}

== DebugThreadParam ==
{| class=wikitable
! Value || Name
|-
| 0 || DebugThreadParam_DynamicPriority
|-
| 1 || DebugThreadParam_SchedulingStatus
|-
| 2 || DebugThreadParam_PreferredCpuCore
|-
| 3 || DebugThreadParam_CurrentCpuCore
|-
| 4 || DebugThreadParam_AffinityMask
|}

Dynamic priority: output in out2

Scheduling status: out1 contains bit0: is debug-suspended, bit1: is user-suspended (svcSetThreadActivity 1 or svcSetProcessActivity 1).
Out2 contains {suspended, idle, running, terminating} => {5, 0, 1, 4}

DebugThreadParam_PreferredCpuCore: output in out2

DebugThreadParam_CurrentCpuCore: output in out2

DebugThreadParam_AffinityMask: output in out1

== CreateProcessInfo ==
{| class=wikitable
! Offset || Length || Bits || Description
|-
| 0 || 12 || || ProcessName (doesn't have to be null-terminated)
|-
| 0x0C || 4 || || ProcessCategory (0: regular title, 1: kernel built-in)
|-
| 0x10 || 8 || || TitleId
|-
| 0x18 || 8 || || CodeAddr
|-
| 0x20 || 4 || || CodeNumPages
|-
| 0x24 || 4 || || MmuFlags
|-
| || || Bit0 || IsAarch64
|-
| || || Bit3-1 || [[#AddressSpaceType]]
|-
| || || Bit4 || [2.0.0+] EnableDebug
|-
| || || Bit5 || EnableAslr
|-
| || || Bit6 || UseSystemMemBlocks
|-
| || || Bit7 || [4.0.0] ?
|-
| || || Bit10-7 || [5.0.0+] PoolPartition (0=Application, 1=Applet, 2=Sysmodule, 3=Nvservices)
|-
| || || Bit11 || [7.0.0+] Not used? Only allowed in combination with bit6.
|-
| || || Bit12 || [7.0.0+] Not used?
|-
| 0x28 || 4 || || ResourceLimitHandle or zero
|-
| 0x2C || 4 || || [3.0.0+] PersonalMmHeapNumPages
|}

On [1.0.0] there's only one pool.

On [2.0.0-4.0.0] PoolPartition is 1 for built-ins and 0 for rest.

On [5.0.0] PoolPartition is specified in CreateProcessArgs. There are now 4 pool partitions.

On [6.0.0] (maybe lower?) a zero ResourceLimitHandle defaults to sysmodule limits and 0x12300000 bytes of memory.

=== AddressSpaceType ===
{| class=wikitable
! Type || Name || Width || Description
|-
| 0 || Normal_32Bit || 32 ||
|-
| 1 || Normal_36Bit || 36 ||
|-
| 2 || WithoutMap_32Bit || 32 || Appears to be missing map region [?]
|-
| 3 || [2.0.0+] Normal_39Bit || 39 ||
|}

== MemoryInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || 8 || BaseAddress
|-
| 8 || 8 || Size
|-
| 0x10 || 4 || MemoryType: lower 8 bits of [[#MemoryState]]
|-
| 0x14 || 4 || [[#MemoryAttribute]]
|-
| 0x18 || 4 || Permission (bit0: R, bit1: W, bit2: X)
|-
| 0x1C || 4 || IpcRefCount
|-
| 0x20 || 4 || DeviceRefCount
|-
| 0x24 || 4 || Padding: always zero
|}

== MemoryAttribute ==
{| class=wikitable
! Bits || Description
|-
| 0 || IsBorrowed
|-
| 1 || IsIpcMapped: when IpcRefCount > 0.
|-
| 2 || IsDeviceMapped: when DeviceRefCount > 0.
|-
| 3 || IsUncached
|}

== MemoryState ==
{| class=wikitable
! Bits || Description
|-
| 7-0 || Type
|-
| 8 || [[#svcSetMemoryPermission|PermissionChangeAllowed]]
|-
| 9 || ForceReadWritableByDebugSyscalls
|-
| 10 || IpcSendAllowed_Type0
|-
| 11 || IpcSendAllowed_Type3
|-
| 12 || IpcSendAllowed_Type1
|-
| 14 || [[#svcSetProcessMemoryPermission|ProcessPermissionChangeAllowed]]
|-
| 15 || [[#svcMapMemory|MapAllowed]]
|-
| 16 || [[#svcUnmapProcessCodeMemory|UnmapProcessCodeMemoryAllowed]]
|-
| 17 || [[#svcCreateTransferMemory|TransferMemoryAllowed]]
|-
| 18 || [[#svcQueryPhysicalAddress|QueryPhysicalAddressAllowed]]
|-
| 19 || MapDeviceAllowed ([[#svcMapDeviceAddressSpace]] and [[#svcMapDeviceAddressSpaceByForce]])
|-
| 20 || [[#svcMapDeviceAddressSpaceAligned|MapDeviceAlignedAllowed]]
|-
| 21 || [[#svcSendSyncRequestWithUserBuffer|IpcBufferAllowed]]
|-
| 22 || IsPoolAllocated/IsReferenceCounted
|-
| 23 || [[#svcMapProcessMemory|MapProcessAllowed]]
|-
| 24 || [[#svcSetMemoryAttribute|AttributeChangeAllowed]]
|-
| 25 || [4.0.0+] CodeMemoryAllowed
|}

{| class=wikitable
! Value || Type || Meaning
|-
| 0x00000000 || MemoryType_Unmapped ||
|-
| 0x00002001 || MemoryType_Io || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00042002 || MemoryType_Normal || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00DC7E03 || MemoryType_CodeStatic || Mapped during [[#svcCreateProcess]].
|-
| [1.0.0+]

0x01FEBD04

[4.0.0+]

0x03FEBD04
|| MemoryType_CodeMutable || Transition from 0xDC7E03 performed by [[#svcSetProcessMemoryPermission]].
|-
| [1.0.0+]
0x017EBD05

[4.0.0+]

0x037EBD05
|| MemoryType_Heap || Mapped using [[#svcSetHeapSize]].
|-
| 0x00402006 || MemoryType_SharedMemory || Mapped using [[#svcMapSharedMemory]].
|-
| 0x00482907 || [1.0.0] MemoryType_Alias || Mapped using [[#svcMapMemory]].
|-
| 0x00DD7E08 || MemoryType_ModuleCodeStatic || Mapped using [[#svcMapProcessCodeMemory]].
|-
| [1.0.0+]

0x01FFBD09

[4.0.0+]

0x03FFBD09
|| MemoryType_ModuleCodeMutable || Transition from 0xDD7E08 performed by [[#svcSetProcessMemoryPermission]].
|-
| 0x005C3C0A || [[IPC_Marshalling|MemoryType_IpcBuffer0]] || IPC buffers with descriptor flags=0.
|-
| 0x005C3C0B || MemoryType_Stack || Mapped using [[#svcMapMemory]].
|-
| 0x0040200C || [[Thread Local Storage|MemoryType_ThreadLocal]] || Mapped during [[#svcCreateThread]].
|-
| 0x015C3C0D || MemoryType_TransferMemoryIsolated || Mapped using [[#svcMapTransferMemory]] when the owning process has perm=0.
|-
| 0x005C380E || MemoryType_TransferMemory || Mapped using [[#svcMapTransferMemory]] when the owning process has perm!=0.
|-
| 0x0040380F || MemoryType_ProcessMemory || Mapped using [[#svcMapProcessMemory]].
|-
| 0x00000010 || MemoryType_Reserved ||
|-
| 0x005C3811 || [[IPC_Marshalling|MemoryType_IpcBuffer1]] || IPC buffers with descriptor flags=1.
|-
| 0x004C2812 || [[IPC_Marshalling|MemoryType_IpcBuffer3]] || IPC buffers with descriptor flags=3.
|-
| 0x00002013 || MemoryType_KernelStack || Mapped in kernel during [[#svcCreateThread]].
|-
| 0x00402214 || [4.0.0+] MemoryType_CodeReadOnly || Mapped in kernel during [[#svcControlCodeMemory]].
|-
| 0x00402015 || [4.0.0+] MemoryType_CodeWritable || Mapped in kernel during [[#svcControlCodeMemory]].
|}

== ArbitrationType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || WaitIfLessThan
|-
| 0x1 || DecrementAndWaitIfLessThan
|-
| 0x2 || WaitIfEqual
|-
|}

== SignalType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || Signal
|-
| 0x1 || SignalAndIncrementIfEqual
|-
| 0x2 || SignalAndModifyBasedOnWaitingThreadCountIfEqual
|-
|}

== ContinueDebugFlagsOld ==
[1.0.0-2.3.0]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: ResumeAllThreads or debug-suspended-thread-id needed)
|-
| 1 || 2 || SwallowException
|-
| 2 || 4 || ResumeAllThreads
|}

== ContinueDebugFlags ==
[3.0.0+]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: doesn't need to be set in the same call than Resume)
|-
| 1 || 2 || DontCatchExceptions
|-
| 2 || 4 || Resume
|-
| 3 || 8 || IgnoreOtherThreadsExceptions
|}

IgnoreExceptionsOfOthers is like IgnoreException but acts on all threads that aren't in the input list. The affected threads are resumed.

Only one of of Resume and IgnoreOtherThreadsExceptions can be set at a time.

If the input number of threads is 0, this means "all threads".

== DebugEventInfo ==

The below table is for the Aarch64 version of the system call. For A32, all u64 fields but title/process/thread id are actually u32, making the structure 0x28-byte-big (0x40 for a64).

Size: 0x40

{| class=wikitable
! Offset || Length || Description
|-
| 0 || u32 || EventType
|-
| 4 || u32 || Flags (bit0: NeedsContinue)
|-
| 8 || u64 || ThreadId
|-
| 0x10 || || PerTypeSpecifics
|}

AttachProcess specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || TitleId
|-
| 0x18 || u64 || ProcessId
|-
| 0x20 || char[12] || ProcessName
|-
| 0x2C || u32 || MmuFlags
|-
| 0x30 || u64 || [5.0.0+] UserExceptionContextAddr
|}

AttachThread specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ThreadId
|-
| 0x18 || u64 || TlsPtr
|-
| 0x20 || u64 || Entrypoint
|}

Exit specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32|| Type (0=PausedThread, 1=RunningThread, 2=ExitedProcess, 3=TerminatedProcess)
|}

Exception specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32 || ExceptionType
|-
| 0x18 || u64 || FaultRegister
|-
| 0x20 || || PerExceptionSpecifics
|}

=== DebugEventType ===
{| class=wikitable
! Value || Name
|-
| 0 || DebugEvent_AttachProcess
|-
| 1 || DebugEvent_AttachThread
|-
| 2 || DebugEvent_ExitProcess
|-
| 3 || DebugEvent_ExitThread
|-
| 4 || DebugEvent_Exception
|}

=== DebugExceptionType ===
{| class=wikitable
! Value || Name
|-
| 0 || Exception_Trap (*)
|-
| 1 || Exception_InstructionAbort
|-
| 2 || Exception_DataAbortMisc (**)
|-
| 3 || Exception_PcSpAlignmentFault
|-
| 4 || Exception_DebuggerAttached
|-
| 5 || Exception_BreakPoint
|-
| 6 || Exception_UserBreak
|-
| 7 || Exception_DebuggerBreak
|-
| 8 || Exception_BadSvcId
|-
| 9 || Exception_SError [not in 1.0.0]
|}

<nowiki>*</nowiki> Undefined instructions, software breakpoints, some other traps.

<nowiki>**</nowiki> Data aborts, FP traps, and everything else that doesn't belong to any of the above.

Trap specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Opcode
|}

BreakPoint specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || IsWatchpoint
|}

UserBreak specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Info0
|-
| 0x28 || u64 || Info1
|-
| 0x30 || u64 || Info2
|}

BadSvcId specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || SvcId
|}

= Exception handling =
First of all, a function that might be called by synchronous exception handler and that is called by the SError handler fetches the exception info, adjusts PC, panics on exceptions taken from EL1, then dispatches the exception.

The dispatcher has two mutually exclusive exception reporting methods:
* by storing information at the start of the process's TLS memregion (TPIDRRO_EL0) and jumping back to the crt0
* by using KDebug

KDebug dispatching is used when at least one of the following conditions are met:
* SMC ConfigItem KernelMemConfig bit 1 is NOT set (it isn't on retail), unless: this is a software or hardware breakpoint, or a watchpoint, or [4.0.0+?] the process is attached and this is a Google PNaCl trap instruction (see LLVM source)
* FAR doesn't point to a valid address in mapped-readable CodeStatic memory (i.e. this is the case for NRO and JIT memory) or this is one of the following exceptions (it particular, that doesn't include FP exceptions occurring in CodeStatic memory):
** Uncategorized
** IllegalState
** SupervisorCallA32
** SupervisorCallA64
** PCAlignment
** SPAlignment
** SError
** BreakpointLowerEl
** SoftwareStepLowerEl (note: no way set single-step flag; not parsed)
** WatchpointLowerEl
** SoftwareBreakpointA32 (note: not parsed)
** SoftwareBreakpointA64 (note: not parsed)

In all other cases the userland-handled exception path is taken.

KDebug path:

If the process is attached, the exception is reported to the KDebug. If the thread was continued using flag IgnoreExceptions, it returns from the exception as if nothing happened.

If the latter is not the case, or if the process isn't attached, proceed to [2.0.0+] crash reporting (or in [1.0.0] just terminate the process):
if EnableDebug is set, and depending on the process state (more than one crash per process isn't permitted) it may signal itself with ProcessState_Crashed so that PM asks NS to start creport so that creport attaches to it and reports the crashes. Otherwise, just terminate.

Userland reporting path and svcReturnFromException:

TLS region start (A64):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x148 || Exception stack
|-
| 0x148 || 0x78 || ExceptionFrameA64
|}

ExceptionFrameA64:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x48 (8*9) || GPRs 0..8.
|-
| 0x48 || 0x8 || lr
|-
| 0x50 || 0x8 || sp
|-
| 0x58 || 0x8 || pc (elr_el1)
|-
| 0x60 || 0x4 || pstate & 0xFF0FFE20
|-
| 0x64 || 0x4 || afsr0
|-
| 0x68 || 0x4 || afsr1
|-
| 0x6C || 0x4 || esr
|-
| 0x70 || 0x8 || far
|}

TLS region start (A32):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x178 || Exception stack
|-
| 0x148 || 0x44 || ExceptionFrameA32
|}

ExceptionFrameA32:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x20 (8*4) || GPRs 0..7.
|-
| 0x20 || 0x4 || sp
|-
| 0x24 || 0x4 || lr
|-
| 0x28 || 0x4 || pc (elr_el1)
|-
| 0x2C || 0x4 || tpidr_el0 = 1
|-
| 0x30 || 0x4 || cpsr & 0xFF0FFE20
|-
| 0x34 || 0x4 || afsr0
|-
| 0x38 || 0x4 || afsr1
|-
| 0x3C || 0x4 || esr
|-
| 0x40 || 0x4 || far
|}

In that case, after storing the regs in the TLS, the exception handler returns to the application's crt0 (entrypoint), with X0=<error description code> (see below) and X1=SP=frame=<stack top> (see above)

{| class=wikitable
! Desc. code || Meaning
|-
| 0x100 || Instruction abort
|-
| 0x102 || Misaligned PC
|-
| 0x103 || Misaligned SP
|-
| 0x106 || SError [not in 1.0.0?]
|-
| 0x301 || Bad SVC
|-
| 0x104 || Uncategorized, CP15RTTrap, CP15RRTTrap, CP14RTTrap, CP14RRTTrap, IllegalState, SystemRegisterTrap
|-
| 0x101 || None of the above, EC <= 0x34 and not a breakpoint
|-
|}

(During normal app boot the process is invoked with X0=0 and X1=main_thread_handle. The crt0 of retail apps determines whether to boot normally or handle an exception if X0 is set to 0 or not)

The application is supposed to promptly update the contents of elr_el1 to a user handler (and any other regs it sees fit) and call svcReturnFromException (error code) to call that handler. The latter is then expected to promptly abort the program.

svcReturnFromException updates the contents of the kernel stack frame with what the user provided in the TLS structure, sets TPIDR_EL0 to 1, then:
* if the provided error code is 0, gracefully pivots and returns from exception
* if it is not, replays the exception and pass it to the KDebug (see above). One can pass 0x10001 to prevent process termination. If the process is attached, this also prevents crash-collection/termination (different from the exception handler behavior)

If an exception occurs from the above user handler, the entire exception handling process will repeat with the new exception.

Note that if a thread that wasn't faulting calls svcReturnFromException, it signals an "invalid syscall" exception

Note that [[SMC|IsDebugMode]] is not used during exception-handling, except for enabling printing a message to UART-A. This UART code causes a system-hang on retail (likely due to a loop that doesn't exit). This printing doesn't seem to run when the process is attached for debugging?

SVC

2019-01-29T02:50:31Z

Qlutoo:

__NOTOC__

= System calls =
{| class=wikitable
! Id || Name || In || Out
|-
| 0x1 || [[#svcSetHeapSize]] || W1=size || W0=result, X1=outaddr
|-
| 0x2 || [[#svcSetMemoryPermission]] || X0=addr, X1=size, W2=prot || W0=result
|-
| 0x3 || [[#svcSetMemoryAttribute]] || X0=addr, X1=size, W2=state0, W3=state1 || W0=result
|-
| 0x4 || [[#svcMapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x5 || [[#svcUnmapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x6 || [[#svcQueryMemory]] || X0=MemoryInfo*, X2=addr || W0=result, W1=PageInfo
|-
| 0x7 || [[#svcExitProcess]] || None ||
|-
| 0x8 || [[#svcCreateThread]] || X1=entry, X2=thread_context, X3=stacktop, W4=prio, W5=processor_id || W0=result, W1=handle
|-
| 0x9 || [[#svcStartThread]] || W0=thread_handle || W0=result
|-
| 0xA || [[#svcExitThread]] || None ||
|-
| 0xB || [[#svcSleepThread]] || X0=nano ||
|-
| 0xC || [[#svcGetThreadPriority]] || W1=thread_handle || W0=result, W1=prio
|-
| 0xD || [[#svcSetThreadPriority]] || W0=thread_handle, W1=prio || W0=result
|-
| 0xE || [[#svcGetThreadCoreMask]] || W2=thread_handle || W0=result, W1=out, X2=out
|-
| 0xF || [[#svcSetThreadCoreMask]] || W0=thread_handle, W1=in, X2=in2 || W0=result
|-
| 0x10 || [[#svcGetCurrentProcessorNumber]] || None || W0/X0=cpuid
|-
| 0x11 || svcSignalEvent || W0=wevent_handle || W0=result
|-
| 0x12 || svcClearEvent || W0=wevent_or_revent_handle || W0=result
|-
| 0x13 || [[#svcMapSharedMemory]] || W0=shmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x14 || svcUnmapSharedMemory || W0=shmem_handle, X1=addr, X2=size || W0=result
|-
| 0x15 || [[#svcCreateTransferMemory]] || X1=addr, X2=size, W3=perm || W0=result, W1=tmem_handle
|-
| 0x16 || svcCloseHandle || W0=handle || W0=result
|-
| 0x17 || svcResetSignal || W0=revent_or_process_handle || W0=result
|-
| 0x18 || [[#svcWaitSynchronization]] || X1=handles_ptr, W2=num_handles. X3=timeout || W0=result, W1=handle_idx
|-
| 0x19 || [[#svcCancelSynchronization]] || W0=thread_handle || W0=result
|-
| 0x1A || svcArbitrateLock || W0=cur_thread_handle, X1=ptr, W2=req_thread_handle ||
|-
| 0x1B || svcArbitrateUnlock || X0=ptr ||
|-
| 0x1C || svcWaitProcessWideKeyAtomic || X0=ptr0, X1=ptr, W2=thread_handle, X3=timeout || W0=result
|-
| 0x1D || svcSignalProcessWideKey || X0=ptr, W1=value || W0=result
|-
| 0x1E || [[#svcGetSystemTick]] || None || X0={value of cntpct_el0}
|-
| 0x1F || svcConnectToNamedPort || X1=port_name_str || W0=result, W1=handle
|-
| 0x20 || svcSendSyncRequestLight || W0=light_session_handle, X1=? || W0=result
|-
| 0x21 || svcSendSyncRequest || X0=normal_session_handle || W0=result
|-
| 0x22 || [[#svcSendSyncRequestWithUserBuffer]] || X0=cmdbufptr, X1=size, X2=handle || W0=result
|-
| 0x23 || svcSendAsyncRequestWithUserBuffer || X1=cmdbufptr, X2=size, X3=handle || W0=result, W1=revent_handle
|-
| 0x24 || svcGetProcessId || W1=thread_or_process_or_debug_handle || W0=result, X1=pid
|-
| 0x25 || svcGetThreadId || W1=thread_handle || W0=result, X1=out
|-
| 0x26 || [[#svcBreak]] || X0=break_reason,X1,X2=info || W0=result = 0
|-
| 0x27 || svcOutputDebugString || X0=str, X1=size || W0=result
|-
| 0x28 || svcReturnFromException || X0=result ||
|-
| 0x29 || [[#svcGetInfo]] || X1=info_id, X2=handle, X3=info_sub_id || W0=result, X1=out
|-
| 0x2A || svcFlushEntireDataCache || None || None
|-
| 0x2B || svcFlushDataCache || X0=addr, X1=size || W0=result
|-
| 0x2C || [3.0.0+] [[#svcMapPhysicalMemory]] || X0=addr, X1=size || W0=result
|-
| 0x2D || [3.0.0+] svcUnmapPhysicalMemory || X0=addr, X1=size || W0=result
|-
| 0x2E || [5.0.0+] svcGetFutureThreadInfo || X3=timeout || W0=result, bunch of crap
|-
| 0x2F || svcGetLastThreadInfo || None || W0=result, W1,W2,W3,W4=unk, W5=truncated_u64, W6=bool
|-
| 0x30 || svcGetResourceLimitLimitValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
|-
| 0x31 || svcGetResourceLimitCurrentValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
|-
| 0x32 || svcSetThreadActivity || W0=thread_handle, W1=bool || W0=result
|-
| 0x33 || svcGetThreadContext3 || X0=[[#ThreadContext]]*, W1=thread_handle || W0=result
|-
| 0x34 || [4.0.0+] svcWaitForAddress || X0=ptr, W1=[[#ArbitrationType]], X2=value X3=timeout ||
|-
| 0x35 || [4.0.0+] svcSignalToAddress || X0=ptr, W1=[[#SignalType]], X2=value W3=num_to_signal ||
|- style="border-top: double"
| 0x3C || [[#svcDumpInfo]] || ||
|-
| 0x3D || [4.0.0+] svcDumpInfoNew || ||
|- style="border-top: double"
| 0x40 || svcCreateSession || W2=is_light, X3=? || W0=result, W1=server_handle, W2=client_handle
|-
| 0x41 || [[#svcAcceptSession]] || W1=port_handle || W0=result, W1=session_handle
|-
| 0x42 || svcReplyAndReceiveLight || W0=light_session_handle || W0=result, W1,W2,W3,W4,W5,W6,W7=out
|-
| 0x43 || [[#svcReplyAndReceive]] || X1=ptr_handles, W2=num_handles, X3=replytarget_handle(0=none), X4=timeout || W0=result, W1=handle_idx
|-
| 0x44 || svcReplyAndReceiveWithUserBuffer|| X1=buf, X2=sz, X3=ptr_handles, W4=num_handles, X5=replytarget_handle(0=none), X6=timeout || W0=result, W1=handle_idx
|-
| 0x45 || svcCreateEvent || None || W0=result, W1=wevent_handle, W2=revent_handle
|- style="border-top: double"
| 0x48 || [5.0.0+] [[#svcMapPhysicalMemoryUnsafe]] || X0=addr, X1=size || W0=result
|-
| 0x49 || [5.0.0+] svcUnmapPhysicalMemoryUnsafe || X0=addr, X1=size || W0=result
|-
| 0x4A || [5.0.0+] svcSetUnsafeLimit || X0=size || W0=result
|-
| 0x4B || [4.0.0+] [[#svcCreateCodeMemory]] || X1=addr, X2=size || W0=result, W1=code_memory_handle
|-
| 0x4C || [4.0.0+] [[#svcControlCodeMemory]] || W0=code_memory_handle, W1=[[#CodeMemoryOperation]], X2=dstaddr, X3=size, W4=perm || W0=result
|-
| 0x4D || svcSleepSystem || None || None
|-
| 0x4E || [[#svcReadWriteRegister]] || X1=reg_addr, W2=rw_mask, W3=in_val || W0=result, W1=out_val
|-
| 0x4F || svcSetProcessActivity || W0=process_handle, W1=bool || W0=result
|-
| 0x50 || [[#svcCreateSharedMemory]] || W1=size, W2=myperm, W3=otherperm || W0=result, W1=shmem_handle
|-
| 0x51 || [[#svcMapTransferMemory]] || X0=tmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x52 || [[#svcUnmapTransferMemory]] || W0=tmemhandle, X1=addr, X2=size || W0=result
|-
| 0x53 || [[#svcCreateInterruptEvent]] || X1=irq_num, W2=flag || W0=result, W1=handle
|-
| 0x54 || [[#svcQueryPhysicalAddress]] || X1=addr || W0=result, X1=physaddr, X2=kerneladdr, X3=size
|-
| 0x55 || [[#svcQueryIoMapping]] || X1=physaddr, X2=size || W0=result, X1=virtaddr
|-
| 0x56 || [[#svcCreateDeviceAddressSpace]] || X1=dev_as_start_addr, X2=dev_as_end_addr || W0=result, W1=dev_as_handle
|-
| 0x57 || [[#svcAttachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x58 || [[#svcDetachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x59 || [[#svcMapDeviceAddressSpaceByForce]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm || W0=result
|-
| 0x5A || [[#svcMapDeviceAddressSpaceAligned]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm || W0=result
|-
| 0x5B || svcMapDeviceAddressSpace || ||
|-
| 0x5C || [[#svcUnmapDeviceAddressSpace]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr || W0=result
|-
| 0x5D || svcInvalidateProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x5E || svcStoreProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x5F || svcFlushProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x60 || svcDebugActiveProcess || X1=pid || W0=result, W1=debug_handle
|-
| 0x61 || svcBreakDebugProcess || W0=debug_handle || W0=result
|-
| 0x62 || svcTerminateDebugProcess || W0=debug_handle || W0=result
|-
| 0x63 || svcGetDebugEvent || X0=[[#DebugEventInfo]]*, W1=debug_handle || W0=result
|-
| 0x64 || [[#svcContinueDebugEvent]] || [1.0.0-2.3.0] W0=debug_handle, W1=[[#ContinueDebugFlagsOld]], X2=thread_id
[3.0.0+] W0=debug_handle, W1=[[#ContinueDebugFlags]], X2=thread_id_list(u64 *), W3=num_tids (max 64, 0 means "all threads")
|| W0=result
|-
| 0x65 || svcGetProcessList || X1=pids_out_ptr, W2=max_out || W0=result, W1=num_out
|-
| 0x66 || svcGetThreadList || X1=tids_out_ptr, W2=max_out, W3=debug_handle_or_zero || W0=result, X1=num_out
|-
| 0x67 || svcGetDebugThreadContext || X0=ThreadContext*, X1=debug_handle, X2=thread_id, W3=[[#ThreadContextFlags]] || W0=result
|-
| 0x68 || svcSetDebugThreadContext || W0=debug_handle, X1=thread_id, X2=ThreadContext*, W3=[[#ThreadContextFlags]] || W0=result
|-
| 0x69 || svcQueryDebugProcessMemory || X0=[[#MemoryInfo]]*, X2=debug_handle, X3=addr || W0=result, W1=PageInfo
|-
| 0x6A || svcReadDebugProcessMemory || X0=buffer*, X1=debug_handle, X2=src_addr, X3=size || W0=result
|-
| 0x6B || svcWriteDebugProcessMemory || X0=debug_handle, X1=buffer*, X2=dst_addr, X3=size || W0=result
|-
| 0x6C || [[#svcSetHardwareBreakPoint]] || W0=HardwareBreakpointId, X1=watchpoint_flags/breakpoint_flags, X2=watchpoint_value/debug_handle ||
|-
| 0x6D || svcGetDebugThreadParam || X2=debug_handle, X3=thread_id, W4=[[#DebugThreadParam]] || W0=result, X1=out0, W2=out1
|- style="border-top: double"
| 0x6F || [5.0.0+] [[#svcGetSystemInfo]] || X1=info_id, X2=handle, X3=info_sub_id || W0=result, X1=out
|-
| 0x70 || svcCreatePort || W2=max_sessions, W3=is_light, X4=name_ptr || W0=result, W1=clientport_handle, W2=serverport_handle
|-
| 0x71 || svcManageNamedPort || X1=name_ptr, W2=max_sessions || W0=result, W1=serverport_handle
|-
| 0x72 || svcConnectToPort || W1=clientport_handle || W0=result, W1=session_handle
|-
| 0x73 || [[#svcSetProcessMemoryPermission]] || W0=process_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x74 || [[#svcMapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size || W0=result
|-
| 0x75 || [[#svcUnmapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size || W0=result
|-
| 0x76 || [[#svcQueryProcessMemory]] || X0=meminfo_ptr, W2=process_handle, X3=addr || W0=result, W1=pageinfo
|-
| 0x77 || [[#svcMapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x78 || [[#svcUnmapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x79 || [[#svcCreateProcess]] || X1=procinfo_ptr, X2=caps_ptr, W3=cap_num || W0=result, W1=process_handle
|-
| 0x7A || svcStartProcess || W0=process_handle, W1=main_thread_prio, W2=default_cpuid, W3=main_thread_stacksz || W0=result
|-
| 0x7B || svcTerminateProcess || W0=process_handle || W0=result
|-
| 0x7C || [[#svcGetProcessInfo]] || W0=process_handle, W1=[[#ProcessInfoType]] || W0=result, X1=[[#ProcessState]]
|-
| 0x7D || svcCreateResourceLimit || None || W0=result, W1=reslimit_handle
|-
| 0x7E || svcSetResourceLimitLimitValue || W0=reslimit_handle, W1=[[#LimitableResource]], X2=value || W0=result
|-
| 0x7F || svcCallSecureMonitor || X0=smc_sub_id, X1,X2,X3,X4,X5,X6,X7=smc_args || X0,X1,X2,X3,X4,X5,X6,X7=result
|}

== svcSetHeapSize ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || OutAddr
|}
</div>

'''Description:''' Set the process heap to a given Size. It can both extend and shrink the heap.

Size must be a multiple of 0x200000 (2MB).

On success, the heap base-address (which is fixed by kernel, aslr'd) is written to OutAddr.

Uses current process pool partition.

[2.0.0+] Size must be less than or equal to 4GB.

== svcSetMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || Prot
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change permission of page-aligned memory region.

Bit2 of permission (exec) is not allowed. Setting write-only is not allowed either (bit1).

This can be used to move back and forth between ---, r-- and rw-.

== svcSetMemoryAttribute ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || u32 || State0
|-
| (In) W3 || u32 || State1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change attribute of page-aligned memory region.

This is used to turn on/off caching for a given memory area. Useful when talking to devices such as the GPU.

What happens "under the hood" is the "Memory Attribute Indirection Register" index is changed from 2 to 3 in the MMU descriptor.

{| class=wikitable
! State0 || State1 || Action
|-
| 0 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 8 || Set bit3 in [[#MemoryAttribute]].
|}

== svcMapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps a memory range into a different range.

Mainly used for adding guard pages around stack.

Source range gets reprotected to --- (it can no longer be accessed), and bit0 is set in the source [[#MemoryAttribute]].

[1.0.0] This could be used to map into either the Alias Region or the Stack region.

[2.0.0+] This can only be used to map into the Stack region.

Code can get the range of the Alias region from [[#svcGetInfo]] id0=2,3, and on 2.0.0+ the range of the Stack region via [[#svcGetInfo]] id0=14, 15 (on 1.0.0, the Stack region had hardcoded limits).

When mapped into the Alias region, the mapped memory will have state 0x482907.

When mapped into the Stack region, the mapped memory will have state 0x5C3C0B.

== svcUnmapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps a region that was previously mapped with [[#svcMapMemory]].

It's possible to unmap ranges partially, you don't need to unmap the entire range "in one go".

The srcaddr/dstaddr must match what was given when the pages were originally mapped.

== svcQueryMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfo
|-
| (In) X2 || void* || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

'''Description:''' Query information about an address. Will always fetch the lowest page-aligned mapping that contains the provided address.

Outputs a [[#MemoryInfo]] struct.

== svcExitProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current process.

== svcCreateThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void(*)(void*) || Entry
|-
| (In) X2 || void* || ThreadContext
|-
| (In) X3 || void* || StackTop
|-
| (In) W4 || u32 || Priority
|-
| (In) W5 || u32 || ProcessorId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Thread> || Handle
|}
</div>

'''Description:''' Create a thread in the current process.

Processor_id must be 0,1,2,3 or -2, where -2 uses the default cpuid for process.

== svcStartThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) None || ||
|}
</div>

'''Description:''' Starts the thread for the provided handle.

== svcExitThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current thread.

== svcSleepThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || s64 || Nanoseconds
|-
|}
</div>

'''Description:''' Sleep for a specified amount of time, or yield thread.

Setting nanoseconds to 0, -1, or -2 indicates a yielding type.

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Value || Type
|-
| 0 || Yielding without core migration
|-
| -1 || Yielding with core migration
|-
| -2 || Yielding to any other thread
|-
|}
</div>

== svcGetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1|| Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || Priority
|}
</div>

'''Description:''' Get priority of provided thread handle.

== svcSetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0|| Handle<Thread> || Handle
|-
| (In) W1|| u32 || Priority
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set priority of provided thread handle.

Priority is a number 0-0x3F. Lower value means higher priority.

== svcGetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W2 || Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u32 || Out0
|-
| (Out) X2 || u64 || Out1
|}
</div>

'''Description:''' Get affinity mask of provided thread handle.

== svcSetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (In) W1 || u32 || In0
|-
| (In) X2 || u64 || In1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set affinity mask of provided thread handle.

== svcGetCurrentProcessorNumber ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0/X0 || u64 || CpuId
|}
</div>

'''Description:''' Get which cpu is executing the current thread.

Cpu-id is an integer in the range 0-3.

== svcMapSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<SharedMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the block supplied by the handle. The required permissions are different for the process that created the handle and all other processes.

Increases reference count for the KSharedMemory object. Thus in order to release the memory associated with the object, all handles to it must be closed and all mappings must be unmapped.

== svcCreateTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<TransferMemory> || Handle
|}
</div>

This one reprotects the src block with perms you give it. It also sets bit0 into [[#MemoryAttribute]].

Executable bit perm not allowed.

Closing all handles automatically causes the bit0 in [[#MemoryAttribute]] to clear, and the permission to reset.

== svcWaitSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || Handle* || HandlesPtr
|-
| (In) W2 || u64 || HandlesNum
|-
| (In) X3 || u64 || Timeout
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || HandleIndex
|}
</div>

Works with num_handles <= 0x40.

When zero handles are passed, this will wait forever until either timeout or cancellation occurs.

Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.

=== Object types ===

'''KDebug:''' signals when there is a new [[#DebugEventInfo|DebugEvent]] (retrievable via [[#svcGetDebugEvent]]).

'''KClientPort:''' signals when the number of sessions is less than the maximum allowed.

'''KProcess:''' signals when the process undergoes a state change (retrievable via [[#svcGetProcessInfo]]).

'''KReadableEvent:''' signals when the event's corresponding KWritableEvent has been signaled via svcSignalEvent.

'''KServerPort:''' signals when there is an incoming connection waiting to be [[#svcAcceptSession|accepted]].

'''KServerSession:''' signals when there is an incoming message waiting to be [[#svcReplyAndReceive|received]] or the pipe is closed.

'''KThread:''' signals when the thread has exited.

=== Result codes ===

'''0x0:''' Success. One of the objects was signaled before the timeout expired, or one of the objects is a Session with a closed remote. Handle index is updated to indicate which object signaled.

'''0x7601:''' Thread termination requested. Handle index is not updated.

'''0xe401:''' Invalid handle. Returned when one of the handles passed is invalid. Handle index is not updated.

'''0xe601:''' Invalid address. Returned when the handles pointer is not a readable address. Handle index is not updated.

'''0xea01:''' Timeout. Returned when no objects have been signaled within the timeout. Handle index is not updated.

'''0xec01:''' Interrupted. Returned when another thread uses [[#svcCancelSynchronization]] to cancel this thread. Handle index is not updated.

'''0xee01:''' Too many handles. Returned when the number of handles passed is > 0x40.

== svcCancelSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

If the referenced thread is currently in a synchronization call ([[#svcWaitSynchronization]], [[#svcReplyAndReceive]] or [[#svcReplyAndReceiveLight]]), that call will be interrupted and return 0xec01.
If that thread is not currently executing such a synchronization call, the next call to a synchronization call will return 0xec01.

This doesn't take force-pause (activity/debug pause) into account.

=== Result codes ===

'''0x0:''' Success. The thread was either interrupted or has had its flag set.

'''0xe401:''' Invalid handle. The handle given was either invalid or not a thread handle.

== svcGetSystemTick ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (Out) X0 || u64 || Ticks
|}
</div>

Returns the value of cntpct_el0.

The frequency is 19200000 Hz (constant from official sw).

Official sw reads cntpct_el0 directly from usermode without using this SVC. [[ExeFS|sdk-nso]] has this SVC, but it's not known to be called anywhere.

== svcSendSyncRequestWithUserBuffer ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || CmdPtr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || Handle<Session> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size and CmdPtr must be 0x1000-aligned.

=== Result codes ===

'''0x0:''' Success.

'''0xcc01:''' CmdPtr is not 0x1000-aligned.

'''0xca01:''' Size is not 0x1000-aligned.

'''0xce01:''' KSessionRequest allocation failed (unlikely) or pointer buffer size exceeded.

'''0xe401:''' Handles does not exist, or handle is not an instance of KClientSession.

== svcBreak ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || Break Reason
|-
| (In) X1 || u64 ||
|-
| (In) X2 || u64 || Info
|-
| (Out) W0 || Result || 0 (Success)
|}
</div>

If the process is attached, report the Break event. Then, if svcContinueDebugEvent didn't apply IgnoreException on the thread: if TPIDR_EL0 is 0, adjust ELR_EL1 to retry to svc instruction (and set TPIDR_EL0 to 1).

Otherwise, if bit31 in reason isn't set, perform crash reporting (see Exception Handling section below), if it doesn't terminate the process adjust ELR_EL1 as well.

Otherwise just return 0.

== svcGetInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Process || 0 || 0 || AllowedCpuIdBitmask
|-
| Process || 1 || 0 || AllowedThreadPrioBitmask
|-
| Process || 2 || 0 || AliasRegionBaseAddr
|-
| Process || 3 || 0 || AliasRegionSize
|-
| Process || 4 || 0 || HeapRegionBaseAddr
|-
| Process || 5 || 0 || HeapRegionSize
|-
| Process || 6 || 0 || TotalMemoryAvailable. Total memory available(free+used).
|-
| Process || 7 || 0 || TotalMemoryUsage. Total used size of codebin memory + main-thread stack + allocated heap.
|-
| Zero || 8 || 0 || IsCurrentProcessBeingDebugged
|-
| Zero || 9 || 0 || Returns ResourceLimit handle for current process. Used by [[Process_Manager_services|PM]].
|-
| Zero || 10 || -1, {current coreid} || IdleTickCount
|-
| Zero || 11 || 0-3 || RandomEntropy from current process. TRNG. Used to seed usermode PRNGs.
|-
| Process || 12 || 0 || [2.0.0+] AddressSpaceBaseAddr
|-
| Process || 13 || 0 || [2.0.0+] AddressSpaceSize
|-
| Process || 14 || 0 || [2.0.0+] StackRegionBaseAddr
|-
| Process || 15 || 0 || [2.0.0+] StackRegionSize
|-
| Process || 16 || 0 || [3.0.0+] PersonalMmHeapSize
|-
| Process || 17 || 0 || [3.0.0+] PersonalMmHeapUsage
|-
| Process || 18 || 0 || [3.0.0+] TitleId
|-
| Zero || 19 || 0 || [4.0.0-4.1.0] PrivilegedProcessId_LowerBound
|-
| Zero || 19 || 1 || [4.0.0-4.1.0] PrivilegedProcessId_UpperBound
|-
| Process || 20 || 0 || [5.0.0+] UserExceptionContextAddr
|-
| Process || 21 || 0 || [7.0.0+] MemoryUsageSomething0
|-
| Process || 22 || 0 || [7.0.0+] MemoryUsageSomething1
|-
| Thread || 0xF0000002 || 0 || Performance counter related.
|}

== svcMapPhysicalMemory ==
This is like svcSetHeapSize except you can allocate heap at any address you'd like.

Uses current process pool partition.

== svcDumpInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

Does nothing, just returns with registers set to all-zero.

== svcAcceptSession ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || Handle<Port> || Port
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ServerSession> || Session
|}
</div>

=== Result codes ===

'''0xf201:''' No session waiting to be accepted

== svcReplyAndReceive ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || *Handle<Port or ServerSession> || Handles
|-
| (In) W2 || u32 || NumHandles
|-
| (In) W3 || Handle<ServerSession> || ReplyTarget
|-
| (In) X4 || u64 (nanoseconds) || Timeout
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || u32 || HandleIndex
|}
</div>

If ReplyTarget is not zero, a reply from the TLS will be sent to that session.
Then it will wait until either of the passed sessions has an incoming message, is closed, a passed port has an incoming connection, or the timeout expires.
If there is an incoming message, it is copied to the TLS.

If ReplyTarget is zero, the TLS should contain a blank message. If this message has a C descriptor, the buffer it points to will be used as the pointer buffer. See [[IPC_Marshalling#IPC_buffers]]. Note that a pointer buffer cannot be specified if ReplyTarget is not zero.

After being validated, passed handles will be enumerated in order; even if a session has been closed, if one that appears earlier in the list has an incoming message, it will take priority and a result code of 0x0 will be returned.

=== Result codes ===

'''0x0:''' Success. Either a session has an incoming message or a port has an incoming connection. HandleIndex is set appropriately.

'''0xea01:''' Timeout. No handles were signalled before the timeout expired. HandleIndex is not updated.

'''0xf601:''' Port remote dead. One of the sessions has been closed. HandleIndex is set appropriately.

== svcMapPhysicalMemoryUnsafe ==
Same as [[#svcMapPhysicalMemory]] except it always uses pool partition 0.

== svcCreateCodeMemory ==
Takes an address range with backing memory to create the code memory object.

The memory is initially memset to 0xFF after being locked.

== svcControlCodeMemory ==
Maps the backing memory for a Code memory object into the current process.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapOwner]], memory permission must be RW-.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapSlave]], memory permission must be R-- or R-X.

Operations [[#CodeMemoryOperation|CodeMemoryOperation_UnmapOwner/CodeMemoryOperation_UnmapSlave]] unmap memory that was previously mapped this way.

This allows one "secure JIT" process to map the code memory as RW-, and the other "slave" process to map it R-X.

[5.0.0+] Error 0xE401 is now returned when the process owner of the Code memory object is the same as the current process.

== svcReadWriteRegister ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || RegAddr
|-
| (In) W2 || u64 || RwMask
|-
| (In) W3 || u64 || InValue
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1|| u64 || OutValue
|}
</div>

Read/write IO registers with a hardcoded whitelist. Input address is physical-address and must be aligned to 4.

rw_mask is 0 for reading and 0xffffffff for writing. You can also write individual bits by using a mask value.

You can only write to registers inside physical pages 0x70019000 (MC), 0x7001C000 (MC0), 0x7001D000 (MC1), and they all share the same whitelist.

The whitelist is same for writing as for reading.

The whitelist is:

0x054, 0x090, 0x094, 0x098, 0x09c, 0x0a0, 0x0a4, 0x0a8, 0x0ac, 0x0b0, 0x0b4, 0x0b8, 0x0bc, 0x0c0, 0x0c4, 0x0c8, 0x0d0, 0x0d4, 0x0d8, 0x0dc, 0x0e0, 0x100, 0x108, 0x10c, 0x118, 0x11c, 0x124, 0x128, 0x12c, 0x130, 0x134, 0x138, 0x13c, 0x158, 0x15c, 0x164, 0x168, 0x16c, 0x170, 0x174, 0x178, 0x17c, 0x200, 0x204, 0x2e4, 0x2e8, 0x2ec, 0x2f4, 0x2f8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37c, 0x380, 0x390, 0x394, 0x398, 0x3ac, 0x3b8, 0x3bc, 0x3c0, 0x3c4, 0x3d8, 0x3e8, 0x41c, 0x420, 0x424, 0x428, 0x42c, 0x430, 0x44c, 0x47c, 0x480, 0x484, 0x50c, 0x554, 0x558, 0x55c, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69c, 0x6a0, 0x6a4, 0x6c0, 0x6c4, 0x6f0, 0x6f4, 0x960, 0x970, 0x974, 0xa20, 0xa24, 0xb88, 0xb8c, 0xbc4, 0xbc8, 0xbcc, 0xbd0, 0xbd4, 0xbd8, 0xbdc, 0xbe0, 0xbe4, 0xbe8, 0xbec, 0xc00, 0xc5c, 0xcac

[2.0.0+] Whitelist was extended with 0x4c4, 0x4c8, 0x4cc, 0x584, 0x588, 0x58c.

[2.0.0+] The IO registers in range 0x7000E400 (PMC) size 0xC00 skip the whitelist, and do a TrustZone call using [[SMC]] Id1 0xC3000008(ReadWriteRegister).

[4.0.0+] Access to the Memory Controller (0x70019000) also uses smcReadWriteRegister.

Here is the whitelist imposed by that SMC, relative to the start of the PMC registers:

0x000, 0x00c, 0x010, 0x014, 0x01c, 0x020, 0x02c, 0x030, 0x034, 0x038, 0x03c, 0x040, 0x044, 0x048, 0x0dc, 0x0e0, 0x0e4, 0x160, 0x164, 0x168, 0x170, 0x1a8, 0x1b8, 0x1bc, 0x1c0, 0x1c4, 0x1c8, 0x2b4, 0x2d4, 0x440, 0x4d8

Here is the whitelist imposed by smcReadWriteRegister (checked in addition to the whitelist in svcReadWriteRegister), relative to the start of the MC registers:

0x000, 0x004, 0x008, 0x00C, 0x010, 0x01C, 0x020, 0x030, 0x034, 0x050, 0x054, 0x090, 0x094, 0x098, 0x09C, 0x0A0, 0x0A4, 0x0A8, 0x0AC, 0x0B0, 0x0B4, 0x0B8, 0x0BC, 0x0C0, 0x0C4, 0x0C8, 0x0D0, 0x0D4, 0x0D8, 0x0DC, 0x0E0, 0x100, 0x108, 0x10C, 0x118, 0x11C, 0x124, 0x128, 0x12C, 0x130, 0x134, 0x138, 0x13C, 0x158, 0x15C, 0x164, 0x168, 0x16C, 0x170, 0x174, 0x178, 0x17C, 0x200, 0x204, 0x238, 0x240, 0x244, 0x250, 0x254, 0x258, 0x264, 0x268, 0x26C, 0x270, 0x274, 0x280, 0x284, 0x288, 0x28C, 0x294, 0x2E4, 0x2E8, 0x2EC, 0x2F4, 0x2F8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37C, 0x380, 0x390, 0x394, 0x398, 0x3AC, 0x3B8, 0x3BC, 0x3C0, 0x3C4, 0x3D8, 0x3E8, 0x41C, 0x420, 0x424, 0x428, 0x42C, 0x430, 0x44C, 0x47C, 0x480, 0x484, 0x4C4, 0x4C8, 0x4CC, 0x50C, 0x554, 0x558, 0x55C, 0x584, 0x588, 0x58C, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69C, 0x6A0, 0x6A4, 0x6C0, 0x6C4, 0x6F0, 0x6F4, 0x960, 0x970, 0x974, 0x9B8, 0xA20, 0xA24, 0xA88, 0xA94, 0xA98, 0xA9C, 0xAA0, 0xAA4, 0xAA8, 0xAAC, 0xAB0, 0xAB4, 0xAB8, 0xABC, 0xAC0, 0xAC4, 0xAC8, 0xACC, 0xAD0, 0xAD4, 0xAD8, 0xADC, 0xAE0, 0xB88, 0xB8C, 0xBC4, 0xBC8, 0xBCC, 0xBD0, 0xBD4, 0xBD8, 0xBDC, 0xBE0, 0xBE4, 0xBE8, 0xBEC, 0xC00, 0xC5C, 0xCAC

== svcCreateSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || LocalPerm
|-
| (In) W3 || [[#Permission]] || RemotePerm
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<SharedMemory> || MemHandle
|}
</div>

Other perm can be used to enforce permission 1, 3, or 0x10000000 if don't care.

Allocates memory from the current process' pool partition.

== svcMapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

The newly mapped pages will have [[#MemoryState]] type 0xE.

You must pass same size and permissions as given in svcCreateMemoryMirror, otherwise error.

== svcUnmapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must match size given in map syscall, otherwise there's an invalid-size error.

== svcCreateInterruptEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || IrqNum
|-
| (In) W2 || bool || Flags
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<ReadableEvent> || ReadableEventHandle
|}
</div>

Create an event handle for the given IRQ number. Waiting on this handle will wait until the IRQ is triggered. The flags argument configures the triggering. If it is false, the IRQ is active HIGH level sensitive, if it is true it is rising-edge sensitive.

=== Result codes ===

'''0x0:''' Success.

'''0xF001:''' Flags was > 1

'''0xF201:''' IRQ above 0x3FF or outside the [[NPDM#Kernel_Access_Control|IRQ access mask]] was given.

'''0xCE01:''' A SlabHeap was exhausted (too many interrupts created).

'''0xF401:''' IRQ already has an event registered.

'''0xD201:''' The handle table is full. Try closing some handles.

== svcQueryPhysicalAddress ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || Addr
|-
| (Out) W0 || [[#Result]]|| Ret
|-
| (Out) X1 || u64 || PhysAddr
|-
| (Out) X2 || u64 || KernelAddr
|-
| (Out) X3 || u64 || Size
|}
</div>

== svcQueryIoMapping ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || PhysAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || void* || VirtAddr
|}
</div>

'''Description:''' Returns a virtual address mapped to a given IO range.

== svcCreateDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || StartAddr
|-
| (In) X2 || u64 || EndAddr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<DeviceAddressSpace> || AddressSpaceHandle
|}
</div>

'''Description:''' Creates a virtual address space for binding device address spaces and returns a handle.

dev_as_start_addr is normally set to 0 and dev_as_end_addr is normally set to 0xFFFFFFFF.

== svcAttachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Attaches a device address space to a [[#DeviceName|device]].

== svcDetachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Detaches a device address space from a [[#DeviceName|device]].

== svcMapDeviceAddressSpaceByForce ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (In) W5 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

dev_map_addr is the userspace destination address, while dev_as_addr is the source address between dev_as_start_addr and dev_as_end_addr (passed to [[#svcCreateDeviceAddressSpace]]).

The userspace destination address must have the [[SVC#MemoryState|MapDeviceAllowed]] bit set. Bit [[SVC#MemoryAttribute|IsDeviceMapped]] will be set after mapping.

== svcMapDeviceAddressSpaceAligned ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (In) W5 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

Same as [[#svcMapDeviceAddressSpaceByForce]], but the userspace destination address must have the [[SVC#MemoryState|MapDeviceAlignedAllowed]] bit set instead.

== svcUnmapDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps an attached device address space from an userspace address.

== svcContinueDebugEvent ==

=== Result codes ===

'''0x0:''' Success. The process has been resumed.

'''0xe401:''' Invalid debug handle.

'''0xf401:''' Process has debug events queued.

== svcGetSystemInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Zero || 0 || 0 || TotalMemorySize_Application
|-
| Zero || 0 || 1 || TotalMemorySize_Applet
|-
| Zero || 0 || 2 || TotalMemorySize_System
|-
| Zero || 0 || 3 || TotalMemorySize_SystemUnsafe
|-
| Zero || 1 || 0 || CurrentMemorySize_Application
|-
| Zero || 1 || 1 || CurrentMemorySize_Applet
|-
| Zero || 1 || 2 || CurrentMemorySize_System
|-
| Zero || 1 || 3 || CurrentMemorySize_SystemUnsafe
|-
| Zero || 2 || 0 || PrivilegedProcessId_LowerBound
|-
| Zero || 2 || 1 || PrivilegedProcessId_UpperBound
|-
|}

== svcSetProcessMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || void* || Perm
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

This sets the memory permissions for the specified memory with the supplied process handle.

This throws an error(0xD801) when the input perm is >0x5, hence -WX and RWX are not allowed.

== svcMapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || DstAddr
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the src address from the supplied process handle into the current process.

This allows mapping code and rodata with RW- permission.

== svcUnmapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessMemory]].

== svcQueryProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfoPtr
|-
| (In) W2 || Handle<Process> || ProcessHandle
|-
| (In) X3 || u64 || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

Equivalent to [[#svcQueryMemory]] except takes a process handle.

== svcMapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Takes a process handle, and maps normal heap in that process as executable code in that process. Used when loading NROs. This does not support using the current-process handle alias.

== svcUnmapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessCodeMemory]].

== svcCreateProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#CreateProcessInfo]]* || InfoPtr
|-
| (In) X2 || u32* || CapabilitiesPtr
|-
| (In) X3 || u64 || CapabilitiesNum
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Process> || ProcessHandle
|}
</div>

Takes a [[#CreateProcessInfo]] as input.
CapabilitiesPtr points to an array of [[NPDM#Kernel_Access_Control|kernel capabilities]].
CapabilitiesNum is a number of capabilities in the CapabilitiesPtr array (number of element, not number of bytes).

=== Result codes ===

'''0x0:''' Success.

'''0xCA01:''' Attempted to map more code pages than available in address space.

'''0xCC01:''' Provided CodeAddr is invalid (make sure it's in range?)

'''0xE401:''' The resource handle passed is invalid.

'''0xE601:''' Attempt to copy procinfo from user-supplied pointer failed. Attempt to copy capabilities_num from user-supplied pointer failed.

'''0xE801:''' Attempted to create a 32-bit process with a 36-bit address space.

'''0xF001:''' Unused bits are set in mmuflags. Unknown address space type used.

== svcGetProcessInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || [[#ProcessState]] || State
|}
</div>

Returns an enum with value 0-7.

== Debugging ==
[2.0.0+] Exactly 6 debug SVCs require that [[SPL_services#GetConfig|IsDebugMode]] is non-zero. Error 0x4201 is returned otherwise.
* svcBreakDebugProcess
* svcContinueDebugEvent
* svcWriteDebugProcessMemory
* svcSetDebugThreadContext
* svcTerminateDebugProcess
* svcSetHardwareBreakPoint

svcDebugActiveProcess stops execution of the target process, the normal method for resuming it requires svcContinueDebugEvent(see above). Closing the debug handle also results in execution being resumed.

== svcSetHardwareBreakPoint ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || u32 || hardware_breakpoint_id
|-
| (In) W1 || u64 || flags
|-
| (In) W2 || u64 || value
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Sets one of the AArch64 hardware breakpoints. The nintendo switch has 6 hardware breakpoints, and 4 hardware watchpoints. The syscall has two behaviors depending on the value of hardware_breakpoint_id:

If hardware_breakpoint_id < 0x10, then it sets one of the AArch64 hardware breakpoints. Flags will go to DBGBCRn_EL1, and value to DBGBVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0x7F01E1. Furthermore, the kernel will or it with 0x4004, in order to set various security flags to guarantee the watchpoints only triggers for code in EL0. If the user asks for a Breakpoint Type of ContextIDR match, the kernel shall use the given debug_handle to set DBGBVRn_EL1 to the ContextID of the debugged process.

If hardware_breakpoint_id is between 0x10 and 0x20 (exclusive), then it sets one of the AArch64 hardware watchpoints. Flags will go to DBGWCRn_EL1, and the value to DBGWVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0xFF0F1FF9. Furthermore, the kernel will or it with 0x104004. This will set various security flags, and set the watchpoint type to be a Linked Watchpoint. This means that you need to link it to a Linked ContextIDR breakpoint. Check the ARM documentation for more information.

Note that hardware_breakpoint_id 0 to 4 match only to Virtual Address, while hardware_breakpoint_id 5 and 6 match against either Virtual Address, ContextID, or VMID. As such, if you are configuring a breakpoint to link for a watchpoint, make sure you use hardware_breakpoint_id 5 or 6.

For more documentation for hardware breakpoints, check out the AArch64 documentation for the [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0488h/way1382455558968.html DBGBCRn_EL1 register] and the [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0488h/way1382455560629.html DBGWCRn_EL1 register]

= Enum/Structures =
== ThreadContextRequestFlags ==
Bitfield of one of more of these:

{| class=wikitable
! Bit || Bitmask || Name
|-
| 0 || 1 || NormalContext
|-
| 1 || 2 ||
|-
| 2 || 4 ||
|-
| 3 || 8 ||
|}

== DeviceName ==
{| class=wikitable
! Value || Name
|-
| 0 || DeviceName_AFI
|-
| 1 || DeviceName_AVPC
|-
| 2 || DeviceName_DC
|-
| 3 || DeviceName_DCB
|-
| 4 || DeviceName_HC
|-
| 5 || DeviceName_HDA
|-
| 6 || DeviceName_ISP2
|-
| 7 || DeviceName_MSENCNVENC
|-
| 8 || DeviceName_NV
|-
| 9 || DeviceName_NV2
|-
| 10 || DeviceName_PPCS
|-
| 11 || DeviceName_SATA
|-
| 12 || DeviceName_VI
|-
| 13 || DeviceName_VIC
|-
| 14 || DeviceName_XUSB_HOST
|-
| 15 || DeviceName_XUSB_DEV
|-
| 16 || DeviceName_TSEC
|-
| 17 || DeviceName_PPCS1
|-
| 18 || DeviceName_DC1
|-
| 19 || DeviceName_SDMMC1A
|-
| 20 || DeviceName_SDMMC2A
|-
| 21 || DeviceName_SDMMC3A
|-
| 22 || DeviceName_SDMMC4A
|-
| 23 || DeviceName_ISP2B
|-
| 24 || DeviceName_GPU
|-
| 25 || DeviceName_GPUB
|-
| 26 || DeviceName_PPCS2
|-
| 27 || DeviceName_NVDEC
|-
| 28 || DeviceName_APE
|-
| 29 || DeviceName_SE
|-
| 30 || DeviceName_NVJPG
|-
| 31 || DeviceName_HC1
|-
| 32 || DeviceName_SE1
|-
| 33 || DeviceName_AXIAP
|-
| 34 || DeviceName_ETR
|-
| 35 || DeviceName_TSECB
|-
| 36 || DeviceName_TSEC1
|-
| 37 || DeviceName_TSECB1
|-
| 38 || DeviceName_NVDEC1
|}

== CodeMemoryOperation ==
{| class=wikitable
! Value || Name
|-
| 0 || CodeMemoryOperation_MapOwner
|-
| 1 || CodeMemoryOperation_MapSlave
|-
| 2 || CodeMemoryOperation_UnmapOwner
|-
| 3 || CodeMemoryOperation_UnmapSlave
|}

== LimitableResource ==
{| class=wikitable
! Value || Name
|-
| 0 || LimitableResource_Memory
|-
| 1 || LimitableResource_Threads
|-
| 2 || LimitableResource_Events
|-
| 3 || LimitableResource_TransferMemories
|-
| 4 || LimitableResource_Sessions
|}

== ProcessInfoType ==

{| class=wikitable
! Value || Name
|-
| 0 || [[#ProcessState|ProcessInfoType_ProcessState]]
|-
|}

== ProcessState ==
{| class=wikitable
! Value || Name || Notes
|-
| 0 || ProcessState_Created ||
|-
| 1 || ProcessState_CreatedAttached ||
|-
| 2 || ProcessState_Started ||
|-
| 3 || ProcessState_Crashed || Processes will not enter this state unless they were created with [[#CreateProcessInfo|EnableDebug]].
|-
| 4 || ProcessState_StartedAttached ||
|-
| 5 || ProcessState_Exiting ||
|-
| 6 || ProcessState_Exited ||
|-
| 7 || ProcessState_DebugSuspended ||
|}

== DebugThreadParam ==
{| class=wikitable
! Value || Name
|-
| 0 || DebugThreadParam_DynamicPriority
|-
| 1 || DebugThreadParam_SchedulingStatus
|-
| 2 || DebugThreadParam_PreferredCpuCore
|-
| 3 || DebugThreadParam_CurrentCpuCore
|-
| 4 || DebugThreadParam_AffinityMask
|}

Dynamic priority: output in out2

Scheduling status: out1 contains bit0: is debug-suspended, bit1: is user-suspended (svcSetThreadActivity 1 or svcSetProcessActivity 1).
Out2 contains {suspended, idle, running, terminating} => {5, 0, 1, 4}

DebugThreadParam_PreferredCpuCore: output in out2

DebugThreadParam_CurrentCpuCore: output in out2

DebugThreadParam_AffinityMask: output in out1

== CreateProcessInfo ==
{| class=wikitable
! Offset || Length || Bits || Description
|-
| 0 || 12 || || ProcessName (doesn't have to be null-terminated)
|-
| 0x0C || 4 || || ProcessCategory (0: regular title, 1: kernel built-in)
|-
| 0x10 || 8 || || TitleId
|-
| 0x18 || 8 || || CodeAddr
|-
| 0x20 || 4 || || CodeNumPages
|-
| 0x24 || 4 || || MmuFlags
|-
| || || Bit0 || IsAarch64
|-
| || || Bit3-1 || [[#AddressSpaceType]]
|-
| || || Bit4 || [2.0.0+] EnableDebug
|-
| || || Bit5 || EnableAslr
|-
| || || Bit6 || UseSystemMemBlocks
|-
| || || Bit7 || [4.0.0] ?
|-
| || || Bit10-7 || [5.0.0+] PoolPartition (0=Application, 1=Applet, 2=Sysmodule, 3=Nvservices)
|-
| || || Bit11 || [7.0.0+] Not used? Only allowed in combination with bit6.
|-
| || || Bit12 || [7.0.0+] Not used?
|-
| 0x28 || 4 || || ResourceLimitHandle or zero
|-
| 0x2C || 4 || || [3.0.0+] PersonalMmHeapNumPages
|}

On [1.0.0] there's only one pool.

On [2.0.0-4.0.0] PoolPartition is 1 for built-ins and 0 for rest.

On [5.0.0] PoolPartition is specified in CreateProcessArgs. There are now 4 pool partitions.

On [6.0.0] (maybe lower?) a zero ResourceLimitHandle defaults to sysmodule limits and 0x12300000 bytes of memory.

=== AddressSpaceType ===
{| class=wikitable
! Type || Name || Width || Description
|-
| 0 || Normal_32Bit || 32 ||
|-
| 1 || Normal_36Bit || 36 ||
|-
| 2 || WithoutMap_32Bit || 32 || Appears to be missing map region [?]
|-
| 3 || [2.0.0+] Normal_39Bit || 39 ||
|}

== MemoryInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || 8 || BaseAddress
|-
| 8 || 8 || Size
|-
| 0x10 || 4 || MemoryType: lower 8 bits of [[#MemoryState]]
|-
| 0x14 || 4 || [[#MemoryAttribute]]
|-
| 0x18 || 4 || Permission (bit0: R, bit1: W, bit2: X)
|-
| 0x1C || 4 || IpcRefCount
|-
| 0x20 || 4 || DeviceRefCount
|-
| 0x24 || 4 || Padding: always zero
|}

== MemoryAttribute ==
{| class=wikitable
! Bits || Description
|-
| 0 || IsBorrowed
|-
| 1 || IsIpcMapped: when IpcRefCount > 0.
|-
| 2 || IsDeviceMapped: when DeviceRefCount > 0.
|-
| 3 || IsUncached
|}

== MemoryState ==
{| class=wikitable
! Bits || Description
|-
| 7-0 || Type
|-
| 8 || [[#svcSetMemoryPermission|PermissionChangeAllowed]]
|-
| 9 || ForceReadWritableByDebugSyscalls
|-
| 10 || IpcSendAllowed_Type0
|-
| 11 || IpcSendAllowed_Type3
|-
| 12 || IpcSendAllowed_Type1
|-
| 14 || [[#svcSetProcessMemoryPermission|ProcessPermissionChangeAllowed]]
|-
| 15 || [[#svcMapMemory|MapAllowed]]
|-
| 16 || [[#svcUnmapProcessCodeMemory|UnmapProcessCodeMemoryAllowed]]
|-
| 17 || [[#svcCreateTransferMemory|TransferMemoryAllowed]]
|-
| 18 || [[#svcQueryPhysicalAddress|QueryPhysicalAddressAllowed]]
|-
| 19 || MapDeviceAllowed ([[#svcMapDeviceAddressSpace]] and [[#svcMapDeviceAddressSpaceByForce]])
|-
| 20 || [[#svcMapDeviceAddressSpaceAligned|MapDeviceAlignedAllowed]]
|-
| 21 || [[#svcSendSyncRequestWithUserBuffer|IpcBufferAllowed]]
|-
| 22 || IsPoolAllocated/IsReferenceCounted
|-
| 23 || [[#svcMapProcessMemory|MapProcessAllowed]]
|-
| 24 || [[#svcSetMemoryAttribute|AttributeChangeAllowed]]
|-
| 25 || [4.0.0+] CodeMemoryAllowed
|}

{| class=wikitable
! Value || Type || Meaning
|-
| 0x00000000 || MemoryType_Unmapped ||
|-
| 0x00002001 || MemoryType_Io || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00042002 || MemoryType_Normal || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00DC7E03 || MemoryType_CodeStatic || Mapped during [[#svcCreateProcess]].
|-
| [1.0.0+]

0x01FEBD04

[4.0.0+]

0x03FEBD04
|| MemoryType_CodeMutable || Transition from 0xDC7E03 performed by [[#svcSetProcessMemoryPermission]].
|-
| [1.0.0+]
0x017EBD05

[4.0.0+]

0x037EBD05
|| MemoryType_Heap || Mapped using [[#svcSetHeapSize]].
|-
| 0x00402006 || MemoryType_SharedMemory || Mapped using [[#svcMapSharedMemory]].
|-
| 0x00482907 || [1.0.0] MemoryType_Alias || Mapped using [[#svcMapMemory]].
|-
| 0x00DD7E08 || MemoryType_ModuleCodeStatic || Mapped using [[#svcMapProcessCodeMemory]].
|-
| [1.0.0+]

0x01FFBD09

[4.0.0+]

0x03FFBD09
|| MemoryType_ModuleCodeMutable || Transition from 0xDD7E08 performed by [[#svcSetProcessMemoryPermission]].
|-
| 0x005C3C0A || [[IPC_Marshalling|MemoryType_IpcBuffer0]] || IPC buffers with descriptor flags=0.
|-
| 0x005C3C0B || MemoryType_Stack || Mapped using [[#svcMapMemory]].
|-
| 0x0040200C || [[Thread Local Storage|MemoryType_ThreadLocal]] || Mapped during [[#svcCreateThread]].
|-
| 0x015C3C0D || MemoryType_TransferMemoryIsolated || Mapped using [[#svcMapTransferMemory]] when the owning process has perm=0.
|-
| 0x005C380E || MemoryType_TransferMemory || Mapped using [[#svcMapTransferMemory]] when the owning process has perm!=0.
|-
| 0x0040380F || MemoryType_ProcessMemory || Mapped using [[#svcMapProcessMemory]].
|-
| 0x00000010 || MemoryType_Reserved ||
|-
| 0x005C3811 || [[IPC_Marshalling|MemoryType_IpcBuffer1]] || IPC buffers with descriptor flags=1.
|-
| 0x004C2812 || [[IPC_Marshalling|MemoryType_IpcBuffer3]] || IPC buffers with descriptor flags=3.
|-
| 0x00002013 || MemoryType_KernelStack || Mapped in kernel during [[#svcCreateThread]].
|-
| 0x00402214 || [4.0.0+] MemoryType_CodeReadOnly || Mapped in kernel during [[#svcControlCodeMemory]].
|-
| 0x00402015 || [4.0.0+] MemoryType_CodeWritable || Mapped in kernel during [[#svcControlCodeMemory]].
|}

== ArbitrationType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || WaitIfLessThan
|-
| 0x1 || DecrementAndWaitIfLessThan
|-
| 0x2 || WaitIfEqual
|-
|}

== SignalType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || Signal
|-
| 0x1 || SignalAndIncrementIfEqual
|-
| 0x2 || SignalAndModifyBasedOnWaitingThreadCountIfEqual
|-
|}

== ContinueDebugFlagsOld ==
[1.0.0-2.3.0]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: ResumeAllThreads or debug-suspended-thread-id needed)
|-
| 1 || 2 || SwallowException
|-
| 2 || 4 || ResumeAllThreads
|}

== ContinueDebugFlags ==
[3.0.0+]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: doesn't need to be set in the same call than Resume)
|-
| 1 || 2 || DontCatchExceptions
|-
| 2 || 4 || Resume
|-
| 3 || 8 || IgnoreOtherThreadsExceptions
|}

IgnoreExceptionsOfOthers is like IgnoreException but acts on all threads that aren't in the input list. The affected threads are resumed.

Only one of of Resume and IgnoreOtherThreadsExceptions can be set at a time.

If the input number of threads is 0, this means "all threads".

== DebugEventInfo ==

The below table is for the Aarch64 version of the system call. For A32, all u64 fields but title/process/thread id are actually u32, making the structure 0x28-byte-big (0x40 for a64).

Size: 0x40

{| class=wikitable
! Offset || Length || Description
|-
| 0 || u32 || EventType
|-
| 4 || u32 || Flags (bit0: NeedsContinue)
|-
| 8 || u64 || ThreadId
|-
| 0x10 || || PerTypeSpecifics
|}

AttachProcess specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || TitleId
|-
| 0x18 || u64 || ProcessId
|-
| 0x20 || char[12] || ProcessName
|-
| 0x2C || u32 || MmuFlags
|-
| 0x30 || u64 || [5.0.0+] UserExceptionContextAddr
|}

AttachThread specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ThreadId
|-
| 0x18 || u64 || TlsPtr
|-
| 0x20 || u64 || Entrypoint
|}

Exit specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32|| Type (0=PausedThread, 1=RunningThread, 2=ExitedProcess, 3=TerminatedProcess)
|}

Exception specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32 || ExceptionType
|-
| 0x18 || u64 || FaultRegister
|-
| 0x20 || || PerExceptionSpecifics
|}

=== DebugEventType ===
{| class=wikitable
! Value || Name
|-
| 0 || DebugEvent_AttachProcess
|-
| 1 || DebugEvent_AttachThread
|-
| 2 || DebugEvent_ExitProcess
|-
| 3 || DebugEvent_ExitThread
|-
| 4 || DebugEvent_Exception
|}

=== DebugExceptionType ===
{| class=wikitable
! Value || Name
|-
| 0 || Exception_Trap (*)
|-
| 1 || Exception_InstructionAbort
|-
| 2 || Exception_DataAbortMisc (**)
|-
| 3 || Exception_PcSpAlignmentFault
|-
| 4 || Exception_DebuggerAttached
|-
| 5 || Exception_BreakPoint
|-
| 6 || Exception_UserBreak
|-
| 7 || Exception_DebuggerBreak
|-
| 8 || Exception_BadSvcId
|-
| 9 || Exception_SError [not in 1.0.0]
|}

<nowiki>*</nowiki> Undefined instructions, software breakpoints, some other traps.

<nowiki>**</nowiki> Data aborts, FP traps, and everything else that doesn't belong to any of the above.

Trap specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Opcode
|}

BreakPoint specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || IsWatchpoint
|}

UserBreak specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Info0
|-
| 0x28 || u64 || Info1
|-
| 0x30 || u64 || Info2
|}

BadSvcId specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || SvcId
|}

= Exception handling =
First of all, a function that might be called by synchronous exception handler and that is called by the SError handler fetches the exception info, adjusts PC, panics on exceptions taken from EL1, then dispatches the exception.

The dispatcher has two mutually exclusive exception reporting methods:
* by storing information at the start of the process's TLS memregion (TPIDRRO_EL0) and jumping back to the crt0
* by using KDebug

KDebug dispatching is used when at least one of the following conditions are met:
* SMC ConfigItem KernelMemConfig bit 1 is NOT set (it isn't on retail), unless: this is a software or hardware breakpoint, or a watchpoint, or [4.0.0+?] the process is attached and this is a Google PNaCl trap instruction (see LLVM source)
* FAR doesn't point to a valid address in mapped-readable CodeStatic memory (i.e. this is the case for NRO and JIT memory) or this is one of the following exceptions (it particular, that doesn't include FP exceptions occurring in CodeStatic memory):
** Uncategorized
** IllegalState
** SupervisorCallA32
** SupervisorCallA64
** PCAlignment
** SPAlignment
** SError
** BreakpointLowerEl
** SoftwareStepLowerEl (note: no way set single-step flag; not parsed)
** WatchpointLowerEl
** SoftwareBreakpointA32 (note: not parsed)
** SoftwareBreakpointA64 (note: not parsed)

In all other cases the userland-handled exception path is taken.

KDebug path:

If the process is attached, the exception is reported to the KDebug. If the thread was continued using flag IgnoreExceptions, it returns from the exception as if nothing happened.

If the latter is not the case, or if the process isn't attached, proceed to [2.0.0+] crash reporting (or in [1.0.0] just terminate the process):
if EnableDebug is set, and depending on the process state (more than one crash per process isn't permitted) it may signal itself with ProcessState_Crashed so that PM asks NS to start creport so that creport attaches to it and reports the crashes. Otherwise, just terminate.

Userland reporting path and svcReturnFromException:

TLS region start (A64):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x148 || Exception stack
|-
| 0x148 || 0x78 || ExceptionFrameA64
|}

ExceptionFrameA64:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x48 (8*9) || GPRs 0..8.
|-
| 0x48 || 0x8 || lr
|-
| 0x50 || 0x8 || sp
|-
| 0x58 || 0x8 || pc (elr_el1)
|-
| 0x60 || 0x4 || pstate & 0xFF0FFE20
|-
| 0x64 || 0x4 || afsr0
|-
| 0x68 || 0x4 || afsr1
|-
| 0x6C || 0x4 || esr
|-
| 0x70 || 0x8 || far
|}

TLS region start (A32):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x178 || Exception stack
|-
| 0x148 || 0x44 || ExceptionFrameA32
|}

ExceptionFrameA32:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x20 (8*4) || GPRs 0..7.
|-
| 0x20 || 0x4 || sp
|-
| 0x24 || 0x4 || lr
|-
| 0x28 || 0x4 || pc (elr_el1)
|-
| 0x2C || 0x4 || tpidr_el0 = 1
|-
| 0x30 || 0x4 || cpsr & 0xFF0FFE20
|-
| 0x34 || 0x4 || afsr0
|-
| 0x38 || 0x4 || afsr1
|-
| 0x3C || 0x4 || esr
|-
| 0x40 || 0x4 || far
|}

In that case, after storing the regs in the TLS, the exception handler returns to the application's crt0 (entrypoint), with X0=<error description code> (see below) and X1=SP=frame=<stack top> (see above)

{| class=wikitable
! Desc. code || Meaning
|-
| 0x100 || Instruction abort
|-
| 0x102 || Misaligned PC
|-
| 0x103 || Misaligned SP
|-
| 0x106 || SError [not in 1.0.0?]
|-
| 0x301 || Bad SVC
|-
| 0x104 || Uncategorized, CP15RTTrap, CP15RRTTrap, CP14RTTrap, CP14RRTTrap, IllegalState, SystemRegisterTrap
|-
| 0x101 || None of the above, EC <= 0x34 and not a breakpoint
|-
|}

(During normal app boot the process is invoked with X0=0 and X1=main_thread_handle. The crt0 of retail apps determines whether to boot normally or handle an exception if X0 is set to 0 or not)

The application is supposed to promptly update the contents of elr_el1 to a user handler (and any other regs it sees fit) and call svcReturnFromException (error code) to call that handler. The latter is then expected to promptly abort the program.

svcReturnFromException updates the contents of the kernel stack frame with what the user provided in the TLS structure, sets TPIDR_EL0 to 1, then:
* if the provided error code is 0, gracefully pivots and returns from exception
* if it is not, replays the exception and pass it to the KDebug (see above). One can pass 0x10001 to prevent process termination. If the process is attached, this also prevents crash-collection/termination (different from the exception handler behavior)

If an exception occurs from the above user handler, the entire exception handling process will repeat with the new exception.

Note that if a thread that wasn't faulting calls svcReturnFromException, it signals an "invalid syscall" exception

Note that [[SMC|IsDebugMode]] is not used during exception-handling, except for enabling printing a message to UART-A. This UART code causes a system-hang on retail (likely due to a loop that doesn't exit). This printing doesn't seem to run when the process is attached for debugging?

TSEC

2019-01-13T20:50:43Z

Qlutoo: /* Operations */

TSEC (Tegra Security Co-processor) is a dedicated unit powered by a NVIDIA Falcon microprocessor with crypto extensions.

= Driver =
A host driver for communicating with the TSEC is mapped to physical address 0x54500000 with a total size of 0x40000 bytes and exposes several registers.

== Registers ==
Registers from 0x54500000 to 0x54501000 are used to configure the host interface (HOST1X).

Registers from 0x54501000 to 0x54502000 are a MMIO window for communicating with the Falcon microprocessor. From this range, the subset of registers from 0x54501400 to 0x54501FE8 are specific to the TSEC and are subdivided into:
* 0x54501400 to 0x54501500: SCP (Secure Crypto Processor?).
* 0x54501500 to 0x54501600: TRNG (True Random Number Generator).
* 0x54501600 to 0x54501700: TFBIF (Tegra Framebuffer Interface).
* 0x54501700 to 0x54501800: DMA.
* 0x54501800 to 0x54501900: TEGRA (miscellaneous interfaces).

{| class="wikitable" border="1"
! Name
! Address
! Width
|-
| TSEC_THI_INCR_SYNCPT
| 0x54500000
| 0x04
|-
| TSEC_THI_INCR_SYNCPT_ERR
| 0x54500008
| 0x04
|-
| TSEC_THI_CTXSW_INCR_SYNCPT
| 0x5450000C
| 0x04
|-
| TSEC_THI_CTXSW
| 0x54500020
| 0x04
|-
| TSEC_THI_CONT_SYNCPT_EOF
| 0x54500028
| 0x04
|-
| [[#TSEC_THI_METHOD0|TSEC_THI_METHOD0]]
| 0x54500040
| 0x04
|-
| [[#TSEC_THI_METHOD1|TSEC_THI_METHOD1]]
| 0x54500044
| 0x04
|-
| [[#TSEC_THI_INT_STATUS|TSEC_THI_INT_STATUS]]
| 0x54500078
| 0x04
|-
| [[#TSEC_THI_INT_MASK|TSEC_THI_INT_MASK]]
| 0x5450007C
| 0x04
|-
| TSEC_THI_SLCG_STATUS
| 0x54500084
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_HIGH_A
| 0x54500088
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_LOW_A
| 0x5450008C
| 0x04
|-
| TSEC_THI_CLK_OVERRIDE
| 0x54500E00
| 0x04
|-
| [[#FALCON_IRQSSET|FALCON_IRQSSET]]
| 0x54501000
| 0x04
|-
| [[#FALCON_IRQSCLR|FALCON_IRQSCLR]]
| 0x54501004
| 0x04
|-
| [[#FALCON_IRQSTAT|FALCON_IRQSTAT]]
| 0x54501008
| 0x04
|-
| [[#FALCON_IRQMODE|FALCON_IRQMODE]]
| 0x5450100C
| 0x04
|-
| [[#FALCON_IRQMSET|FALCON_IRQMSET]]
| 0x54501010
| 0x04
|-
| [[#FALCON_IRQMCLR|FALCON_IRQMCLR]]
| 0x54501014
| 0x04
|-
| [[#FALCON_IRQMASK|FALCON_IRQMASK]]
| 0x54501018
| 0x04
|-
| [[#FALCON_IRQDEST|FALCON_IRQDEST]]
| 0x5450101C
| 0x04
|-
| FALCON_GPTMR_PERIOD
| 0x54501020
| 0x04
|-
| FALCON_GPTMR_TIME
| 0x54501024
| 0x04
|-
| FALCON_GPTMR_ENABLE
| 0x54501028
| 0x04
|-
| FALCON_TIME_LOW
| 0x5450102C
| 0x04
|-
| FALCON_TIME_HIGH
| 0x54501030
| 0x04
|-
| FALCON_WDTMR_TIME
| 0x54501034
| 0x04
|-
| FALCON_WDTMR_ENABLE
| 0x54501038
| 0x04
|-
| FALCON_UNK_3C
| 0x5450103C
| 0x04
|-
| [[#FALCON_SCRATCH0|FALCON_SCRATCH0]]
| 0x54501040
| 0x04
|-
| [[#FALCON_SCRATCH1|FALCON_SCRATCH1]]
| 0x54501044
| 0x04
|-
| [[#FALCON_ITFEN|FALCON_ITFEN]]
| 0x54501048
| 0x04
|-
| [[#FALCON_IDLESTATE|FALCON_IDLESTATE]]
| 0x5450104C
| 0x04
|-
| FALCON_CURCTX
| 0x54501050
| 0x04
|-
| FALCON_NXTCTX
| 0x54501054
| 0x04
|-
| FALCON_CMDCTX
| 0x54501058
| 0x04
|-
| FALCON_STATUS_MASK
| 0x5450105C
| 0x04
|-
| FALCON_VM_SUPERVISOR
| 0x54501060
| 0x04
|-
| FALCON_MTHD_DATA
| 0x54501064
| 0x04
|-
| FALCON_MTHD_CMD
| 0x54501068
| 0x04
|-
| FALCON_MTHD_DATA_WR
| 0x5450106C
| 0x04
|-
| FALCON_MTHD_OCCUPIED
| 0x54501070
| 0x04
|-
| FALCON_MTHD_ACK
| 0x54501074
| 0x04
|-
| FALCON_MTHD_LIMIT
| 0x54501078
| 0x04
|-
| FALCON_SUBENGINE_RESET
| 0x5450107C
| 0x04
|-
| FALCON_SCRATCH2
| 0x54501080
| 0x04
|-
| FALCON_SCRATCH3
| 0x54501084
| 0x04
|-
| FALCON_PM_TRIGGER
| 0x54501088
| 0x04
|-
| FALCON_PM_MODE
| 0x5450108C
| 0x04
|-
| FALCON_DEBUG1
| 0x54501090
| 0x04
|-
| [[#FALCON_DEBUGINFO|FALCON_DEBUGINFO]]
| 0x54501094
| 0x04
|-
| FALCON_BREAKPOINT0
| 0x54501098
| 0x04
|-
| FALCON_BREAKPOINT1
| 0x5450109C
| 0x04
|-
| FALCON_CGCTL
| 0x545010A0
| 0x04
|-
| FALCON_ENGCTL
| 0x545010A4
| 0x04
|-
| FALCON_PM_SEL
| 0x545010A8
| 0x04
|-
| FALCON_HOST_IO_INDEX
| 0x545010AC
| 0x04
|-
| [[#FALCON_EXCI|FALCON_EXCI]]
| 0x545010D0
| 0x04
|-
| FALCON_UNK_D4
| 0x545010D4
| 0x04
|-
| FALCON_UNK_D8
| 0x545010D8
| 0x04
|-
| FALCON_UNK_DC
| 0x545010DC
| 0x04
|-
| FALCON_UNK_E0
| 0x545010E0
| 0x04
|-
| [[#FALCON_CPUCTL|FALCON_CPUCTL]]
| 0x54501100
| 0x04
|-
| [[#FALCON_BOOTVEC|FALCON_BOOTVEC]]
| 0x54501104
| 0x04
|-
| [[#FALCON_HWCFG|FALCON_HWCFG]]
| 0x54501108
| 0x04
|-
| [[#FALCON_DMACTL|FALCON_DMACTL]]
| 0x5450110C
| 0x04
|-
| [[#FALCON_DMATRF_EXTBASE|FALCON_DMATRF_EXTBASE]]
| 0x54501110
| 0x04
|-
| [[#FALCON_DMATRF_VOFF|FALCON_DMATRF_VOFF]]
| 0x54501114
| 0x04
|-
| [[#FALCON_DMATRFCMD|FALCON_DMATRFCMD]]
| 0x54501118
| 0x04
|-
| [[#FALCON_DMATRF_POFF|FALCON_DMATRF_POFF]]
| 0x5450111C
| 0x04
|-
| [[#FALCON_DMATRFSTAT|FALCON_DMATRFSTAT]]
| 0x54501120
| 0x04
|-
| [[#FALCON_CRYPTTRFSTAT|FALCON_CRYPTTRFSTAT]]
| 0x54501124
| 0x04
|-
| FALCON_CPUSTAT
| 0x54501128
| 0x04
|-
| [[#FALCON_HWCFG2|FALCON_HWCFG2]]
| 0x5450112C
| 0x04
|-
| FALCON_CPUCTL_ALIAS
| 0x54501130
| 0x04
|-
| FALCON_TLB_CMD
| 0x54501140
| 0x04
|-
| FALCON_TLB_CMD_RES
| 0x54501144
| 0x04
|-
| FALCON_BRANCH_HISTORY_CTRL
| 0x54501148
| 0x04
|-
| FALCON_BRANCH_HISTORY_PC
| 0x5450114C
| 0x04
|-
| FALCON_IMFILLRNG0
| 0x54501150
| 0x04
|-
| FALCON_IMFILLRNG1
| 0x54501154
| 0x04
|-
| FALCON_IMFILLCTL
| 0x54501158
| 0x04
|-
| FALCON_EXTERRWIN
| 0x54501160
| 0x04
|-
| FALCON_EXTERRCFG
| 0x54501164
| 0x04
|-
| FALCON_EXTERRADDR
| 0x54501168
| 0x04
|-
| FALCON_EXTERRSTAT
| 0x5450116C
| 0x04
|-
| FALCON_CG2
| 0x5450117C
| 0x04
|-
| FALCON_CODE_INDEX
| 0x54501180
| 0x04
|-
| FALCON_CODE
| 0x54501184
| 0x04
|-
| FALCON_CODE_VIRT_ADDR
| 0x54501188
| 0x04
|-
| FALCON_DATA_INDEX0
| 0x545011C0
| 0x04
|-
| FALCON_DATA0
| 0x545011C4
| 0x04
|-
| FALCON_DATA_INDEX1
| 0x545011C8
| 0x04
|-
| FALCON_DATA1
| 0x545011CC
| 0x04
|-
| FALCON_DATA_INDEX2
| 0x545011D0
| 0x04
|-
| FALCON_DATA2
| 0x545011D4
| 0x04
|-
| FALCON_DATA_INDEX3
| 0x545011D8
| 0x04
|-
| FALCON_DATA3
| 0x545011DC
| 0x04
|-
| FALCON_DATA_INDEX4
| 0x545011E0
| 0x04
|-
| FALCON_DATA4
| 0x545011E4
| 0x04
|-
| FALCON_DATA_INDEX5
| 0x545011E8
| 0x04
|-
| FALCON_DATA5
| 0x545011EC
| 0x04
|-
| FALCON_DATA_INDEX6
| 0x545011F0
| 0x04
|-
| FALCON_DATA6
| 0x545011F4
| 0x04
|-
| FALCON_DATA_INDEX7
| 0x545011F8
| 0x04
|-
| FALCON_DATA7
| 0x545011FC
| 0x04
|-
| [[#FALCON_ICD_CMD|FALCON_ICD_CMD]]
| 0x54501200
| 0x04
|-
| FALCON_ICD_ADDR
| 0x54501204
| 0x04
|-
| FALCON_ICD_WDATA
| 0x54501208
| 0x04
|-
| FALCON_ICD_RDATA
| 0x5450120C
| 0x04
|-
| [[#FALCON_SCTL|FALCON_SCTL]]
| 0x54501240
| 0x04
|-
| [[#FALCON_SCTL_STAT|FALCON_SCTL_STAT]]
| 0x54501244
| 0x04
|-
| FALCON_UNK_248
| 0x54501248
| 0x04
|-
| FALCON_UNK_24C
| 0x5450124C
| 0x04
|-
| FALCON_UNK_250
| 0x54501250
| 0x04
|-
| [[#FALCON_SPROT_IMEM|FALCON_SPROT_IMEM]]
| 0x54501280
| 0x04
|-
| [[#FALCON_SPROT_DMEM|FALCON_SPROT_DMEM]]
| 0x54501284
| 0x04
|-
| [[#FALCON_SPROT_CPUCTL|FALCON_SPROT_CPUCTL]]
| 0x54501288
| 0x04
|-
| [[#FALCON_SPROT_MISC|FALCON_SPROT_MISC]]
| 0x5450128C
| 0x04
|-
| [[#FALCON_SPROT_IRQ|FALCON_SPROT_IRQ]]
| 0x54501290
| 0x04
|-
| [[#FALCON_SPROT_MTHD|FALCON_SPROT_MTHD]]
| 0x54501294
| 0x04
|-
| [[#FALCON_SPROT_SCTL|FALCON_SPROT_SCTL]]
| 0x54501298
| 0x04
|-
| [[#FALCON_SPROT_WDTMR|FALCON_SPROT_WDTMR]]
| 0x5450129C
| 0x04
|-
| FALCON_UNK_2E0
| 0x545012E0
| 0x04
|-
| [[#TSEC_SCP_CTL0|TSEC_SCP_CTL0]]
| 0x54501400
| 0x04
|-
| [[#TSEC_SCP_CTL1|TSEC_SCP_CTL1]]
| 0x54501404
| 0x04
|-
| [[#TSEC_SCP_CTL_STAT|TSEC_SCP_CTL_STAT]]
| 0x54501408
| 0x04
|-
| [[#TSEC_SCP_CTL_LOCK|TSEC_SCP_CTL_LOCK]]
| 0x5450140C
| 0x04
|-
| TSEC_SCP_UNK_10
| 0x54501410
| 0x04
|-
| [[#TSEC_SCP_CTL_PKEY|TSEC_SCP_CTL_PKEY]]
| 0x54501418
| 0x04
|-
| [[#TSEC_SCP_SEQ_CTL|TSEC_SCP_SEQ_CTL]]
| 0x54501420
| 0x04
|-
| [[#TSEC_SCP_SEQ_VAL|TSEC_SCP_SEQ_VAL]]
| 0x54501424
| 0x04
|-
| [[#TSEC_SCP_SEQ_STAT|TSEC_SCP_SEQ_STAT]]
| 0x54501428
| 0x04
|-
| [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]]
| 0x54501430
| 0x04
|-
| [[#TSEC_SCP_AUTH_STAT|TSEC_SCP_AUTH_STAT]]
| 0x54501454
| 0x04
|-
| [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]]
| 0x54501458
| 0x04
|-
| TSEC_SCP_UNK_70
| 0x54501470
| 0x04
|-
| [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT]]
| 0x54501480
| 0x04
|-
| [[#TSEC_SCP_IRQMASK|TSEC_SCP_IRQMASK]]
| 0x54501484
| 0x04
|-
| TSEC_SCP_RES
| 0x54501490
| 0x04
|-
| [[#TSEC_SCP_ERR|TSEC_SCP_ERR]]
| 0x54501498
| 0x04
|-
| TSEC_TRNG_CLKDIV
| 0x54501500
| 0x04
|-
| TSEC_TRNG_04
| 0x54501504
| 0x04
|-
| TSEC_TRNG_TEST_CTL
| 0x5450150C
| 0x04
|-
| TSEC_TRNG_TEST_CFG0
| 0x54501510
| 0x04
|-
| TSEC_TRNG_TEST_SEED0
| 0x54501514
| 0x04
|-
| TSEC_TRNG_TEST_CFG1
| 0x54501518
| 0x04
|-
| TSEC_TRNG_TEST_SEED1
| 0x5450151C
| 0x04
|-
| TSEC_TRNG_28
| 0x54501528
| 0x04
|-
| TSEC_TRNG_2C
| 0x5450152C
| 0x04
|-
| TSEC_TFBIF_00
| 0x54501600
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL|TSEC_TFBIF_MCCIF_FIFOCTRL]]
| 0x54501604
| 0x04
|-
| TSEC_TFBIF_08
| 0x54501608
| 0x04
|-
| TSEC_TFBIF_0C
| 0x5450160C
| 0x04
|-
| TSEC_TFBIF_30
| 0x54501630
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL1|TSEC_TFBIF_MCCIF_FIFOCTRL1]]
| 0x54501634
| 0x04
|-
| TSEC_TFBIF_40
| 0x54501640
| 0x04
|-
| [[#TSEC_TFBIF_44|TSEC_TFBIF_44]]
| 0x54501644
| 0x04
|-
| [[#TSEC_TFBIF_48|TSEC_TFBIF_48]]
| 0x54501648
| 0x04
|-
| [[#TSEC_DMA_CMD|TSEC_DMA_CMD]]
| 0x54501700
| 0x04
|-
| [[#TSEC_DMA_ADDR|TSEC_DMA_ADDR]]
| 0x54501704
| 0x04
|-
| [[#TSEC_DMA_VAL|TSEC_DMA_VAL]]
| 0x54501708
| 0x04
|-
| [[#TSEC_DMA_CFG|TSEC_DMA_CFG]]
| 0x5450170C
| 0x04
|-
| TSEC_TEGRA_FALCON_IP_VER
| 0x54501800
| 0x04
|-
| TSEC_TEGRA_24
| 0x54501824
| 0x04
|-
| TSEC_TEGRA_28
| 0x54501828
| 0x04
|-
| TSEC_TEGRA_2C
| 0x5450182C
| 0x04
|-
| [[#TSEC_TEGRA_CTL|TSEC_TEGRA_CTL]]
| 0x54501838
| 0x04
|}

=== TSEC_THI_METHOD0 ===
{| class="wikitable" border="1"
! ID
! Method
|-
| 0x200
| SET_APPLICATION_ID
|-
| 0x300
| EXECUTE
|-
| 0x500
| HDCP_INIT
|-
| 0x504
| HDCP_CREATE_SESSION
|-
| 0x508
| HDCP_VERIFY_CERT_RX
|-
| 0x50C
| HDCP_GENERATE_EKM
|-
| 0x510
| HDCP_REVOCATION_CHECK
|-
| 0x514
| HDCP_VERIFY_HPRIME
|-
| 0x518
| HDCP_ENCRYPT_PAIRING_INFO
|-
| 0x51C
| HDCP_DECRYPT_PAIRING_INFO
|-
| 0x520
| HDCP_UPDATE_SESSION
|-
| 0x524
| HDCP_GENERATE_LC_INIT
|-
| 0x528
| HDCP_VERIFY_LPRIME
|-
| 0x52C
| HDCP_GENERATE_SKE_INIT
|-
| 0x530
| HDCP_VERIFY_VPRIME
|-
| 0x534
| HDCP_ENCRYPTION_RUN_CTRL
|-
| 0x538
| HDCP_SESSION_CTRL
|-
| 0x53C
| HDCP_COMPUTE_SPRIME
|-
| 0x540
| HDCP_GET_CERT_RX
|-
| 0x544
| HDCP_EXCHANGE_INFO
|-
| 0x548
| HDCP_DECRYPT_KM
|-
| 0x54C
| HDCP_GET_HPRIME
|-
| 0x550
| HDCP_GENERATE_EKH_KM
|-
| 0x554
| HDCP_VERIFY_RTT_CHALLENGE
|-
| 0x558
| HDCP_GET_LPRIME
|-
| 0x55C
| HDCP_DECRYPT_KS
|-
| 0x560
| HDCP_DECRYPT
|-
| 0x564
| HDCP_GET_RRX
|-
| 0x568
| HDCP_DECRYPT_REENCRYPT
|-
| 0x56C
|
|-
| 0x570
|
|-
| 0x574
|
|-
| 0x578
|
|-
| 0x57C
|
|-
| 0x700
| HDCP_VALIDATE_SRM
|-
| 0x704
| HDCP_VALIDATE_STREAM
|-
| 0x708
| HDCP_TEST_SECURE_STATUS
|-
| 0x70C
| HDCP_SET_DCP_KPUB
|-
| 0x710
| HDCP_SET_RX_KPUB
|-
| 0x714
| HDCP_SET_CERT_RX
|-
| 0x718
| HDCP_SET_SCRATCH_BUFFER
|-
| 0x71C
| HDCP_SET_SRM
|-
| 0x720
| HDCP_SET_RECEIVER_ID_LIST
|-
| 0x724
| HDCP_SET_SPRIME
|-
| 0x728
| HDCP_SET_ENC_INPUT_BUFFER
|-
| 0x72C
| HDCP_SET_ENC_OUTPUT_BUFFER
|-
| 0x730
| HDCP_GET_RTT_CHALLENGE
|-
| 0x734
| HDCP_STREAM_MANAGE
|-
| 0x738
| HDCP_READ_CAPS
|-
| 0x73C
| HDCP_ENCRYPT
|-
| 0x740
| [6.0.0+] HDCP_GET_CURRENT_NONCE
|}

Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_METHOD1 ===
Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_INT_STATUS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_STATUS_FALCON_INT
|}

=== TSEC_THI_INT_MASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_MASK_FALCON_INT
|}

=== FALCON_IRQSSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSSET_GPTMR
|-
| 1
| FALCON_IRQSSET_WDTMR
|-
| 2
| FALCON_IRQSSET_MTHD
|-
| 3
| FALCON_IRQSSET_CTXSW
|-
| 4
| FALCON_IRQSSET_HALT
|-
| 5
| FALCON_IRQSSET_EXTERR
|-
| 6
| FALCON_IRQSSET_SWGEN0
|-
| 7
| FALCON_IRQSSET_SWGEN1
|-
| 8-15
| FALCON_IRQSSET_EXT
|}

Used for setting Falcon's IRQs.

=== FALCON_IRQSCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSCLR_GPTMR
|-
| 1
| FALCON_IRQSCLR_WDTMR
|-
| 2
| FALCON_IRQSCLR_MTHD
|-
| 3
| FALCON_IRQSCLR_CTXSW
|-
| 4
| FALCON_IRQSCLR_HALT
|-
| 5
| FALCON_IRQSCLR_EXTERR
|-
| 6
| FALCON_IRQSCLR_SWGEN0
|-
| 7
| FALCON_IRQSCLR_SWGEN1
|-
| 8-15
| FALCON_IRQSCLR_EXT
|}

Used for clearing Falcon's IRQs.

=== FALCON_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSTAT_GPTMR
|-
| 1
| FALCON_IRQSTAT_WDTMR
|-
| 2
| FALCON_IRQSTAT_MTHD
|-
| 3
| FALCON_IRQSTAT_CTXSW
|-
| 4
| FALCON_IRQSTAT_HALT
|-
| 5
| FALCON_IRQSTAT_EXTERR
|-
| 6
| FALCON_IRQSTAT_SWGEN0
|-
| 7
| FALCON_IRQSTAT_SWGEN1
|-
| 8-15
| FALCON_IRQSTAT_EXT
|}

Used for getting the status of Falcon's IRQs.

=== FALCON_IRQMODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMODE_GPTMR
|-
| 1
| FALCON_IRQMODE_WDTMR
|-
| 2
| FALCON_IRQMODE_MTHD
|-
| 3
| FALCON_IRQMODE_CTXSW
|-
| 4
| FALCON_IRQMODE_HALT
|-
| 5
| FALCON_IRQMODE_EXTERR
|-
| 6
| FALCON_IRQMODE_SWGEN0
|-
| 7
| FALCON_IRQMODE_SWGEN1
|-
| 8-15
| FALCON_IRQMODE_EXT
|}

Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.

=== FALCON_IRQMSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMSET_GPTMR
|-
| 1
| FALCON_IRQMSET_WDTMR
|-
| 2
| FALCON_IRQMSET_MTHD
|-
| 3
| FALCON_IRQMSET_CTXSW
|-
| 4
| FALCON_IRQMSET_HALT
|-
| 5
| FALCON_IRQMSET_EXTERR
|-
| 6
| FALCON_IRQMSET_SWGEN0
|-
| 7
| FALCON_IRQMSET_SWGEN1
|-
| 8-15
| FALCON_IRQMSET_EXT
|}

Used for setting the mask for Falcon's IRQs.

=== FALCON_IRQMCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMCLR_GPTMR
|-
| 1
| FALCON_IRQMCLR_WDTMR
|-
| 2
| FALCON_IRQMCLR_MTHD
|-
| 3
| FALCON_IRQMCLR_CTXSW
|-
| 4
| FALCON_IRQMCLR_HALT
|-
| 5
| FALCON_IRQMCLR_EXTERR
|-
| 6
| FALCON_IRQMCLR_SWGEN0
|-
| 7
| FALCON_IRQMCLR_SWGEN1
|-
| 8-15
| FALCON_IRQMCLR_EXT
|}

Used for clearing the mask for Falcon's IRQs.

=== FALCON_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMASK_GPTMR
|-
| 1
| FALCON_IRQMASK_WDTMR
|-
| 2
| FALCON_IRQMASK_MTHD
|-
| 3
| FALCON_IRQMASK_CTXSW
|-
| 4
| FALCON_IRQMASK_HALT
|-
| 5
| FALCON_IRQMASK_EXTERR
|-
| 6
| FALCON_IRQMASK_SWGEN0
|-
| 7
| FALCON_IRQMASK_SWGEN1
|-
| 8-15
| FALCON_IRQMASK_EXT
|}

Used for getting the value of the mask for Falcon's IRQs.

=== FALCON_IRQDEST ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQDEST_HOST_GPTMR
|-
| 1
| FALCON_IRQDEST_HOST_WDTMR
|-
| 2
| FALCON_IRQDEST_HOST_MTHD
|-
| 3
| FALCON_IRQDEST_HOST_CTXSW
|-
| 4
| FALCON_IRQDEST_HOST_HALT
|-
| 5
| FALCON_IRQDEST_HOST_EXTERR
|-
| 6
| FALCON_IRQDEST_HOST_SWGEN0
|-
| 7
| FALCON_IRQDEST_HOST_SWGEN1
|-
| 8-15
| FALCON_IRQDEST_HOST_EXT
|-
| 16
| FALCON_IRQDEST_TARGET_GPTMR
|-
| 17
| FALCON_IRQDEST_TARGET_WDTMR
|-
| 18
| FALCON_IRQDEST_TARGET_MTHD
|-
| 19
| FALCON_IRQDEST_TARGET_CTXSW
|-
| 20
| FALCON_IRQDEST_TARGET_HALT
|-
| 21
| FALCON_IRQDEST_TARGET_EXTERR
|-
| 22
| FALCON_IRQDEST_TARGET_SWGEN0
|-
| 23
| FALCON_IRQDEST_TARGET_SWGEN1
|-
| 24-31
| FALCON_IRQDEST_TARGET_EXT
|}

Used for routing Falcon's IRQs.

=== FALCON_SCRATCH0 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_SCRATCH1 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_ITFEN ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_ITFEN_CTXEN
|-
| 1
| FALCON_ITFEN_MTHDEN
|}

Used for enabling/disabling Falcon interfaces.

=== FALCON_IDLESTATE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IDLESTATE_FALCON_BUSY
|-
| 1-15
| FALCON_IDLESTATE_EXT_BUSY
|}

Used for detecting if Falcon is busy or not.

=== FALCON_DEBUGINFO ===
Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.

[6.0.0+] [[NV_services|nvservices]] sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.

=== FALCON_EXCI ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-19
| PC that originated the exception
|-
| 20-23
| Exception type
0x00: Trap 0
0x01: Trap 1
0x02: Trap 2
0x03: Trap 3
0x08: Invalid opcode
0x09: Authentication failure
0x0A: Page fault (no hit)
0x0B: Page fault (multi hit)
0x0F: Breakpoint
|}

Contains information about raised exceptions.

=== FALCON_CPUCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_CPUCTL_IINVAL
|-
| 1
| FALCON_CPUCTL_STARTCPU
|-
| 2
| FALCON_CPUCTL_SRESET
|-
| 3
| FALCON_CPUCTL_HRESET
|-
| 4
| FALCON_CPUCTL_HALTED
|-
| 5
| FALCON_CPUCTL_STOPPED
|-
| 6
| FALCON_CPUCTL_STARTCPU_SECURE
|}

Used for signaling the Falcon CPU.

=== FALCON_BOOTVEC ===
Takes the Falcon's boot vector address.

=== FALCON_HWCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-8
| FALCON_HWCFG_IMEM_SIZE
|-
| 9-17
| FALCON_HWCFG_DMEM_SIZE
|-
| 18-25
| FALCON_HWCFG_MTHD_SIZE
|-
| 26-31
| FALCON_HWCFG_DMATRF_SLOTS
|}

=== FALCON_DMACTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMACTL_REQUIRE_CTX
|-
| 1
| FALCON_DMACTL_DMEM_SCRUBBING
|-
| 2
| FALCON_DMACTL_IMEM_SCRUBBING
|-
| 3-6
| FALCON_DMACTL_DMAQ_NUM
|-
| 7
| FALCON_DMACTL_SECURE_STAT
|}

Used for configuring the Falcon's DMA engine.

=== FALCON_DMATRF_EXTBASE ===
Base of the external memory buffer.

The base of the transfer is calculated by adding [[#FALCON_DMATRF_POFF]] to the base.

=== FALCON_DMATRF_VOFF ===
For transfers to DMEM: the destination address.
For transfers to IMEM: the destination virtual IMEM page.

=== FALCON_DMATRF_POFF ===
For transfers to IMEM: the destination physical IMEM page.

=== FALCON_DMATRFCMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFCMD_FULL
|-
| 1
| FALCON_DMATRFCMD_IDLE
|-
| 2-3
| FALCON_DMATRFCMD_SEC
|-
| 4
| FALCON_DMATRFCMD_IMEM
|-
| 5
| FALCON_DMATRFCMD_WRITE
|-
| 8-10
| FALCON_DMATRFCMD_SIZE
|-
| 12-14
| FALCON_DMATRFCMD_CTXDMA
|}

Used for configuring DMA transfers.

=== FALCON_DMATRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFSTAT_PENDING
|-
| 16-18
| FALCON_DMATRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_DMATRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_CRYPTTRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| FALCON_CRYPTTRFSTAT_PENDING
|-
| 5
| FALCON_CRYPTTRFSTAT_ENABLED
|-
| 16-18
| FALCON_CRYPTTRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_CRYPTTRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_HWCFG2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_HWCFG2_VERSION
|-
| 4-5
| FALCON_HWCFG2_SCP_MODE
|-
| 6-7
| FALCON_HWCFG2_SUBVERSION
|-
| 8-11
| FALCON_HWCFG2_IMEM_PORTS
|-
| 12-15
| FALCON_HWCFG2_DMEM_PORTS
|-
| 16-19
| FALCON_HWCFG2_VM_PAGES_LOG2
|}

=== FALCON_ICD_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_ICD_CMD_OPC
0x0: BREAK
0x1: CONTINUE_FROM_PC
0x2: CONTINUE_FROM_ADDR
0x3: CONTINUE_UNK1_FROM_PC
0x4: CONTINUE_UNK1_FROM_ADDR
0x5: SINGLE_STEP_FROM_PC
0x6: SINGLE_STEP_FROM_ADDR
0x7: SET_BREAK_MASK
0x8: REG_READ
0x9: REG_WRITE
0xA: DATA_READ
0xB: DATA_WRITE
0xC: IO_READ
0xD: IO_WRITE
0xE: STATUS_READ
|-
| 6-7
| FALCON_ICD_CMD_DATA_SIZE
|-
| 8-12
| FALCON_ICD_CMD_IDX
|-
| 14
| FALCON_ICD_CMD_ERROR
|-
| 15
| FALCON_ICD_CMD_DONE
|-
| 16-31
| FALCON_ICD_CMD_BREAK_MASK
|}

=== FALCON_SCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| FALCON_SCTL_SEC_MODE
0: Non-secure
1: Light Secure
2: Heavy Secure
|-
| 4-5
| FALCON_SCTL_OLD_SEC_MODE
0: Non-secure
1: Light Secure
2: Heavy Secure
|-
| 12-13
| Unknown
|-
| 14
| Initialize the transition to LS mode
|}

=== FALCON_SCTL_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 31
| Set on memory protection violation
|}

=== FALCON_SPROT_IMEM ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Read access level
|-
| 4-7
| Write access level
|}

Controls accesses to Falcon IMEM.

=== FALCON_SPROT_DMEM ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Read access level
|-
| 4-7
| Write access level
|}

Controls accesses to Falcon DMEM.

=== FALCON_SPROT_CPUCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Read access level
|-
| 4-7
| Write access level
|}

Controls accesses to the [[#FALCON_CPUCTL|FALCON_CPUCTL]] register.

=== FALCON_SPROT_MISC ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Read access level
|-
| 4-7
| Write access level
|}

Controls accesses to the following registers:
* FALCON_VM_SUPERVISOR
* FALCON_SUBENGINE_RESET
* FALCON_HOST_IO_INDEX
* [[#FALCON_DMACTL|FALCON_DMACTL]]
* FALCON_TLB_CMD
* FALCON_TLB_CMD_RES
* FALCON_UNK_250
* FALCON_UNK_2E0

=== FALCON_SPROT_IRQ ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Read access level
|-
| 4-7
| Write access level
|}

Controls accesses to the following registers:
* [[#FALCON_IRQMODE|FALCON_IRQMODE]]
* [[#FALCON_IRQMSET|FALCON_IRQMSET]]
* [[#FALCON_IRQMCLR|FALCON_IRQMCLR]]
* [[#FALCON_IRQDEST|FALCON_IRQDEST]]
* FALCON_GPTMR_PERIOD
* FALCON_GPTMR_TIME
* FALCON_GPTMR_ENABLE
* FALCON_UNK_3C
* FALCON_UNK_E0

=== FALCON_SPROT_MTHD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Read access level
|-
| 4-7
| Write access level
|}

Controls accesses to the following registers:
* [[#FALCON_ITFEN|FALCON_ITFEN]]
* FALCON_CURCTX
* FALCON_NXTCTX
* FALCON_CMDCTX
* FALCON_MTHD_DATA
* FALCON_MTHD_CMD
* FALCON_MTHD_DATA_WR
* FALCON_MTHD_OCCUPIED
* FALCON_MTHD_ACK
* FALCON_MTHD_LIMIT
* FALCON_DEBUG1

=== FALCON_SPROT_SCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Read access level
|-
| 4-7
| Write access level
|}

Controls accesses to the [[#FALCON_SCTL|FALCON_SCTL]] register.

=== FALCON_SPROT_WDTMR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Read access level
|-
| 4-7
| Write access level
|}

Controls accesses to the following registers:
* FALCON_WDTMR_TIME
* FALCON_WDTMR_ENABLE

=== TSEC_SCP_CTL0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| Enable TSEC_SCP_INSN_STAT register
|}

=== TSEC_SCP_CTL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 11
| Enable TRNG testing mode
|-
| 12
| Enable the TRNG
|}

=== TSEC_SCP_CTL_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| TSEC_SCP_CTL_STAT_DEBUG_MODE
|}

=== TSEC_SCP_CTL_LOCK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Disable reads for the TRNG register block
|-
| 1
| Disable reads for the TFBIF register block
|-
| 2
| Disable reads for the DMA register block
|-
| 3
| Disable reads for the TEGRA register block
|-
| 4
| Disable writes for the TRNG register block
|-
| 5
| Disable writes for the TFBIF register block
|-
| 6
| Disable writes for the DMA register block
|-
| 7
| Disable writes for the TEGRA register block
|}

Locks accesses to the other sub-engines and can only be cleared in Heavy Secure mode.

=== TSEC_SCP_CTL_PKEY ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
|-
| 1
| TSEC_SCP_CTL_PKEY_LOADED
|}

=== TSEC_SCP_SEQ_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Sequence's instruction index
|-
| 4-7
| Target and control flags
|-
| 8-11
| Sequence's size
|}

Controls the last crypto sequence (cs0 or cs1) created.

=== TSEC_SCP_SEQ_VAL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Sequence instruction's first operand
|-
| 4-9
| Sequence instruction's second operand
|-
| 10-14
| Sequence instruction's opcode
|}

Contains information on the last crypto sequence (cs0 or cs1) created.

=== TSEC_SCP_SEQ_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Set if crypto sequence recording (cs0begin/cs1begin) is active
|-
| 4-7
| Number of instructions left for the crypto sequence
|-
| 12-15
| Active crypto key register
|}

Contains information on the last crypto sequence (cs0 or cs1) executed.

=== TSEC_SCP_INSN_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Destination register or immediate value
|-
| 8-13
| Source register or immediate value
|-
| 20-24
| Operation
0x0: nop (fuc5 opcode 0x00)
0x1: cmov (fuc5 opcode 0x84)
0x2: cxsin (fuc5 opcode 0x88) or xdst (with cxset)
0x3: cxsout (fuc5 opcode 0x8C) or xdld (with cxset)
0x4: crnd (fuc5 opcode 0x90)
0x5: cs0begin (fuc5 opcode 0x94)
0x6: cs0exec (fuc5 opcode 0x98)
0x7: cs1begin (fuc5 opcode 0x9C)
0x8: cs1exec (fuc5 opcode 0xA0)
0x9: invalid (fuc5 opcode 0xA4)
0xA: cchmod (fuc5 opcode 0xA8)
0xB: cxor (fuc5 opcode 0xAC)
0xC: cadd (fuc5 opcode 0xB0)
0xD: cand (fuc5 opcode 0xB4)
0xE: crev (fuc5 opcode 0xB8)
0xF: cprecmac (fuc5 opcode 0xBC)
0x10: csecret (fuc5 opcode 0xC0)
0x11: ckeyreg (fuc5 opcode 0xC4)
0x12: ckexp (fuc5 opcode 0xC8)
0x13: ckrexp (fuc5 opcode 0xCC)
0x14: cenc (fuc5 opcode 0xD0)
0x15: cdec (fuc5 opcode 0xD4)
0x16: csigauth (fuc5 opcode 0xD8)
0x17: csigenc (fuc5 opcode 0xDC)
0x18: csigclr (fuc5 opcode 0xE0)
|-
| 28
| Unknown
|-
| 31
| Set if running in secure mode (cauth)
|}

Contains information on the last crypto instruction executed.

=== TSEC_SCP_AUTH_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| Signature comparison result (3=succeeded, 2=failed)
|}

Contains information on the last authentication attempt.

=== TSEC_SCP_AES_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-4
| First opcode
|-
| 5-9
| Second opcode
|-
| 15-16
| AES operation
0: Encryption
1: Decryption
2: Key expansion
3: Key reverse expansion
|}

Contains information on the last AES sequence executed.

=== TSEC_SCP_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQSTAT_TRNG
|-
| 8
| TSEC_SCP_IRQSTAT_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQSTAT_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQSTAT_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the status of crypto IRQs.

=== TSEC_SCP_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQMASK_TRNG
|-
| 8
| TSEC_SCP_IRQMASK_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQMASK_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQMASK_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the value of the mask for crypto IRQs.

=== TSEC_SCP_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Invalid instruction
|-
| 4
| Empty crypto sequence
|-
| 8
| Crypto sequence is too long
|-
| 12
| Crypto sequence was not finished
|-
| 16
| Invalid cauth signature (during csigenc, csigclr or csigauth)
|-
| 20
| Wrong access level (during csigauth)
|-
| 24
| Forbidden instruction
|}

Contains information on crypto errors generated by the [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT_INSN_ERROR]] IRQ.

=== TSEC_TFBIF_MCCIF_FIFOCTRL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
|-
| 1
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
|-
| 2
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
|-
| 3
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
|-
| 4
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
|-
| 5
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
|-
| 6
| TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
|-
| 7
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
|-
| 8
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE
|}

=== TSEC_TFBIF_MCCIF_FIFOCTRL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
|-
| 16-31
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT
|}

=== TSEC_TFBIF_UNK_44 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.

=== TSEC_TFBIF_UNK_48 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to 0x20 or 0x140 before reading memory from the GPU UCODE carveout.

=== TSEC_DMA_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_DMA_CMD_READ
|-
| 1
| TSEC_DMA_CMD_WRITE
|-
| 4-7
| TSEC_DMA_CMD_UNK
|-
| 12
| TSEC_DMA_CMD_BUSY
|-
| 13
| TSEC_DMA_CMD_ERROR
|-
| 31
| TSEC_DMA_CMD_INIT
|}

A DMA read/write operation requires bits TSEC_DMA_CMD_INIT and TSEC_DMA_CMD_READ/TSEC_DMA_CMD_WRITE to be set in TSEC_DMA_CMD.

During the transfer, the TSEC_DMA_CMD_BUSY bit is set.

Accessing an invalid address causes bit TSEC_DMA_CMD_ERROR to be set.

=== TSEC_DMA_ADDR ===
Takes the address for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_VAL ===
Takes the value for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_CFG ===
Always 0xFFF.

=== TSEC_TEGRA_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 16
| TSEC_TEGRA_CTL_TKFI_KFUSE
|-
| 17
| TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
|-
| 24
| TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
|-
| 25
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
|-
| 26
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
|-
| 27
| TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C
|}

== SCP ==
Part of the information here (which hasn't made it into envytools documentation yet) was shared by [https://wiki.0x04.net/wiki/Marcin_Ko%C5%9Bcielnicki mwk] from reverse engineering falcon processors over the years.

=== Authenticated Mode ===
==== Entry ====
From non-secure mode, upon jumping to a page marked as secret, a secret fault occurs. This causes the CPU to verify the region specified in $cauth against the MAC loaded in $c6. If the comparison is successful, the valid bit (bit0) is set on all pages in the $cauth region, and $pc is set to the base of the $cauth region. If the comparsion fails, the CPU is halted.

==== Exit ====
The CPU automatically goes back to non-secure mode when returning back into non-secret pages. When this happens, the valid bit (bit0) in the TLB flags is cleared for all secret pages.

==== Implementation ====
Under certain circumstances, it is possible to observe [[#csigauth|csigauth]] being briefly written to [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]] as "csigauth $c4 $c6" while the opcodes in [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]] are set to "cxsin" and "csigauth", respectively.

Via [[#TSEC_SCP_SEQ_CTL|TSEC_SCP_SEQ_CTL]] it can be observed that a 3-sized macro sequence is loaded into cs0 during a secure mode transition.

=== Operations ===
{| class="wikitable" border="1"
! Opcode
! Name
! Operand0
! Operand1
! Operation
! Condition
|-
| 0 || nop || N/A || N/A || ||
|-
| 1 || mov || $cX || $cY || <code>$cX = $cY; ACL(X) = ACL(Y);</code> ||
|-
| 2 || sin || $cX || N/A || <code>$cX = read_stream(); ACL(X) = ???;</code> ||
|-
| 3 || sout || $cX || N/A || <code>write_stream($cX);</code> || ?
|-
| 4 || rnd || $cX || N/A || <code>$cX = read_trng(); ACL(X) = ???;</code> ||
|-
| 5 || s0begin || immX || N/A || <code>record_macro_for_N_instructions(0, immX);</code> ||
|-
| 6 || s0exec || immX || N/A || <code>execute_macro_N_times(0, immX);</code> ||
|-
| 7 || s1begin || immX || N/A || <code>record_macro_for_N_instructions(1, immX);</code> ||
|-
| 8 || s1exec || immX || N/A || <code>execute_macro_N_times(1, immX);</code> ||
|-
| 9 || <invalid> || || || ||
|-
| 0xA || chmod || $cX || immY || Complicated, see [[#ACL|ACL]]. ||
|-
| 0xB || xor || $cX || $cY || <code>$cX ^= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xC || add || $cX || immY || <code>$cX += immY;</code> || <code>(ACL(X) & 2)</code>
|-
| 0xD || and || $cX || $cY || <code>$cX &= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xE || rev || $cX || $cY || <code>$cX = endian_swap128($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0xF || gfmul || $cX || $cY || <code>$cX = gfmul($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 2)</code>
|-
| 0x10 || secret || $cX || immY || <code>$cX = load_secret(immY); ACL(X) = load_secret_acl(immY);</code> ||
|-
| 0x11 || keyreg || immX || N/A || <code>active_key_idx = immX;</code> ||
|-
| 0x12 || kexp || $cX || $cY || <code>$cX = aes_kexp($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0x13 || krexp || $cX || $cY || <code>$cX = aes_kexp_reverse($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0x14 || enc || $cX || $cY || <code>$cX = aes_enc(active_key_idx, $cY); ACL(X) = ACL(active_key_idx) & ACL(Y);</code> ||
|-
| 0x15 || dec || $cX || $cY || <code>$cX = aes_dec(active_key_idx, $cY); ACL(X) = ACL(active_key_idx) & ACL(Y);</code> ||
|-
| 0x16 || csigauth || $cX || $cY || <code>if (hash_verify($cX, $cY)) { has_sig = true; current_sig = $cX; }</code> || ?
|-
| 0x17 || csigclr || N/A || N/A || <code>has_sig = false;</code> ||
|-
| 0x18 || csigenc || $cX || $cY || <code>if (has_sig) { $cX = aes_enc($cY, current_sig); ACL(X) = 0x13; }</code> ||
|}

==== csigauth ====
<code>00000000: f5 3c XY d8 csigauth $cY $cX</code>

Takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret. This instruction does not work in secure mode.

==== csigclr ====
<code>00000000: f5 3c 00 e0 csigclr</code>

This instruction takes no operands and appears to clear the saved cauth signature used by the csigenc instruction.

==== cchmod ====
<code>00000000: f5 3c XY a8 cchmod $cY 0X</code> or <code>00000000: f5 3c XY a9 cchmod $cY 1X</code>

This instruction takes a crypto register and a 5 bit immediate value which represents the [[#ACL|ACL]] mask to set.

==== crnd ====
<code>00000000: f5 3c 0X 90 crnd $cX</code>

This instruction initializes a crypto register with random data.

Executing this instruction only succeeds if the TRNG is enabled for the SCP, which requires taking the following steps:
* Write 0x7FFF to TSEC_TRNG_CLKDIV.
* Write 0x3FF0000 to TSEC_TRNG_UNK_00.
* Write 0xFF00 to TSEC_TRNG_UNK_2C.
* Write 0x1000 to [[#TSEC_SCP_CTL1|TSEC_SCP_CTL1]].

Otherwise it hangs forever.

=== ACL ===
{| class="wikitable" border="1"
! Bit
! Meaning
|-
| 0 || Secure key. Forced set if bit1 is set. Once cleared, cannot be set again.
|-
| 1 || Secure readable. Once cleared, cannot be set again.
|-
| 2 || Insecure key. Forced set if bit3 is set. Forced clear if bit0 is clear. Can be toggled back and forth.
|-
| 3 || Insecure readable. Forced clear if bit1 is clear. Can be toggled back and forth.
|-
| 4 || Insecure overwritable. Can be toggled back and forth.
|}

==== Initial values ====
On SCP boot, the ACL is 0x1F for all $cX.

Loading into $cX using xdst instruction sets ACL($cX) to 0x13 and 0x1F, for secure and insecure mode respectively.

Spilling a $cX to DMEM using xdld instruction is allowed if (ACL($cX) & 2) or (ACL($cX) & 8), for secure and insecure mode respectively.

Loading a secret into $cX sets a per-secret ACL, unconditionally.

=== cauth ===
$cauth is a special purpose register in the CPU.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7 || Start of region to authenticate (in 0x100 pages)
|-
| 8-15 || Unknown
|-
| 16 || Use secret xfers
|-
| 17 || Region is encrypted
|-
| 18 || Unknown
|-
| 19 || Unknown
|-
| 20-23 || Unknown
|-
| 24-31 || Size of region to authenticate (in 0x100 pages)
|}

=== cxset ===
cxset instruction provides a way to change behavior of a variable amount of successively executed DMA-related instructions.

for example: <code>000000de: f4 3c 02 cxset 0x2</code>

can be read as: <code>dma_override(type=crypto_reg, count=2)</code>

The argument to cxset specifies the type of behavior change in the top 3 bits, and the number of DMA-related instructions the effect lasts for in the lower 5 bits.

{| class=wikitable
! Bits || Description
|-
| 0-4 || Number of instructions it is valid for (0x1f is a special value meaning infinitely many instructions -- until overriden by another cxset)
|-
| 5 || Crypto destination/source select (0=crypto register, 1=crypto stream)
|-
| 6 || External memory override (0=Disabled, 1=Enabled)
|-
| 7 || Internal memory select (0=DMEM, 1=IMEM)
|}

==== DMA-Related Instructions ====
At least the following instructions may have changed behavior, and count against the cxset "count" argument: <code>xdwait</code>, <code>xdst</code>, <code>xdld</code>.

For example, if override type=0b000, then the "length" argument to <code>xdst</code> is instead treated as the index of the target $cX register.

=== Secrets ===
Falcon's Authenticated Mode has access to 64 128-bit keys which are burned at factory. These keys can be loaded by using the $csecret instruction which takes the target crypto register and the key index as arguments.

All secrets appear to be common across Falcon units of the same version, with the exception of secret 0x3F. This secret is effectively empty (all zeros), but is configured to be overwritten with the KFUSE private key once the KFUSE clock is enabled. The KFUSE private key is console-unique.

{| class=wikitable
! Index || ACL || Notes
|-
| 0x00 || 0x13 || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares.
|-
| 0x01 || 0x10 || Used by nvhost_nvdec_bl020_prod firmware.
|-
| 0x02 || 0x10 ||
|-
| 0x03 || 0x11 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|-
| 0x04 || 0x10 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|-
| 0x05 || 0x13 || Used by nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares.
|-
| 0x06 || 0x11 ||
|-
| 0x07 || 0x11 || Used by [6.0.0+] nvhost_tsec firmware.
|-
| 0x08 || 0x10 ||
|-
| 0x09 || 0x13 || Used by nvhost_tsec firmware.
|-
| 0x0A || 0x11 ||
|-
| 0x0B || 0x10 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|-
| 0x0C || 0x13 ||
|-
| 0x0D || 0x11 ||
|-
| 0x0E || 0x10 ||
|-
| 0x0F || 0x13 || Used by nvhost_tsec firmware.
|-
| 0x10 || 0x11 || Used by [1.0.0-5.1.0] nvhost_tsec firmware.
|-
| 0x11 || 0x10 ||
|-
| 0x12 || 0x13 ||
|-
| 0x13 || 0x11 ||
|-
| 0x14 || 0x10 ||
|-
| 0x15 || 0x13 || Used by nvhost_nvdec_bl020_prod, [5.0.0+] nvhost_nvdec020_prod, [5.0.0+] nvhost_nvdec020_ns and [6.0.0+] nvhost_tsec firmwares.
|-
| 0x16 || 0x11 ||
|-
| 0x17 || 0x10 ||
|-
| 0x18 || 0x13 ||
|-
| 0x19 || 0x11 ||
|-
| 0x1A || 0x10 ||
|-
| 0x1B || 0x13 ||
|-
| 0x1C || 0x11 ||
|-
| 0x1D || 0x10 ||
|-
| 0x1E || 0x13 ||
|-
| 0x1F || 0x11 ||
|-
| 0x20 || 0x10 ||
|-
| 0x21 || 0x13 ||
|-
| 0x22 || 0x11 ||
|-
| 0x23 || 0x10 ||
|-
| 0x24 || 0x13 ||
|-
| 0x25 || 0x11 ||
|-
| 0x26 || 0x10 || Used by [[TSEC_Firmware#KeygenLdr|KeygenLdr]] and [[TSEC_Firmware#SecureBoot|SecureBoot]]
|-
| 0x27 || 0x13 ||
|-
| 0x28 || 0x11 ||
|-
| 0x29 || 0x10 ||
|-
| 0x2A || 0x13 ||
|-
| 0x2B || 0x11 ||
|-
| 0x2C || 0x10 ||
|-
| 0x2D || 0x13 ||
|-
| 0x2E || 0x11 ||
|-
| 0x2F || 0x10 ||
|-
| 0x30 || 0x13 ||
|-
| 0x31 || 0x11 ||
|-
| 0x32 || 0x10 ||
|-
| 0x33 || 0x13 ||
|-
| 0x34 || 0x11 ||
|-
| 0x35 || 0x10 ||
|-
| 0x36 || 0x13 ||
|-
| 0x37 || 0x11 ||
|-
| 0x38 || 0x10 ||
|-
| 0x39 || 0x13 ||
|-
| 0x3A || 0x11 ||
|-
| 0x3B || 0x10 ||
|-
| 0x3C || 0x13 || Used by nvhost_tsec firmware.
|-
| 0x3D || 0x11 ||
|-
| 0x3E || 0x10 ||
|-
| 0x3F || 0x10 || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|}

TSEC

2019-01-09T22:20:07Z

Qlutoo: /* cauth */

TSEC (Tegra Security Co-processor) is a dedicated unit powered by a NVIDIA Falcon microprocessor with crypto extensions.

= Driver =
A host driver for communicating with the TSEC is mapped to physical address 0x54500000 with a total size of 0x40000 bytes and exposes several registers.

== Registers ==
Registers from 0x54500000 to 0x54501000 are used to configure the host interface (HOST1X).

Registers from 0x54501000 to 0x54502000 are a MMIO window for communicating with the Falcon microprocessor. From this range, the subset of registers from 0x54501400 to 0x54501FE8 are specific to the TSEC and are subdivided into:
* 0x54501400 to 0x54501500: SCP (Secure Crypto Processor?).
* 0x54501500 to 0x54501600: TRNG (True Random Number Generator).
* 0x54501600 to 0x54501700: TFBIF (Tegra Framebuffer Interface).
* 0x54501700 to 0x54501800: DMA.
* 0x54501800 to 0x54501900: TEGRA (miscellaneous interfaces).

{| class="wikitable" border="1"
! Name
! Address
! Width
|-
| TSEC_THI_INCR_SYNCPT
| 0x54500000
| 0x04
|-
| TSEC_THI_INCR_SYNCPT_ERR
| 0x54500008
| 0x04
|-
| TSEC_THI_CTXSW_INCR_SYNCPT
| 0x5450000C
| 0x04
|-
| TSEC_THI_CTXSW
| 0x54500020
| 0x04
|-
| TSEC_THI_CONT_SYNCPT_EOF
| 0x54500028
| 0x04
|-
| [[#TSEC_THI_METHOD0|TSEC_THI_METHOD0]]
| 0x54500040
| 0x04
|-
| [[#TSEC_THI_METHOD1|TSEC_THI_METHOD1]]
| 0x54500044
| 0x04
|-
| [[#TSEC_THI_INT_STATUS|TSEC_THI_INT_STATUS]]
| 0x54500078
| 0x04
|-
| [[#TSEC_THI_INT_MASK|TSEC_THI_INT_MASK]]
| 0x5450007C
| 0x04
|-
| TSEC_THI_SLCG_STATUS
| 0x54500084
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_HIGH_A
| 0x54500088
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_LOW_A
| 0x5450008C
| 0x04
|-
| TSEC_THI_CLK_OVERRIDE
| 0x54500E00
| 0x04
|-
| [[#FALCON_IRQSSET|FALCON_IRQSSET]]
| 0x54501000
| 0x04
|-
| [[#FALCON_IRQSCLR|FALCON_IRQSCLR]]
| 0x54501004
| 0x04
|-
| [[#FALCON_IRQSTAT|FALCON_IRQSTAT]]
| 0x54501008
| 0x04
|-
| [[#FALCON_IRQMODE|FALCON_IRQMODE]]
| 0x5450100C
| 0x04
|-
| [[#FALCON_IRQMSET|FALCON_IRQMSET]]
| 0x54501010
| 0x04
|-
| [[#FALCON_IRQMCLR|FALCON_IRQMCLR]]
| 0x54501014
| 0x04
|-
| [[#FALCON_IRQMASK|FALCON_IRQMASK]]
| 0x54501018
| 0x04
|-
| [[#FALCON_IRQDEST|FALCON_IRQDEST]]
| 0x5450101C
| 0x04
|-
| FALCON_GPTMR_PERIOD
| 0x54501020
| 0x04
|-
| FALCON_GPTMR_TIME
| 0x54501024
| 0x04
|-
| FALCON_GPTMR_ENABLE
| 0x54501028
| 0x04
|-
| FALCON_TIME_LOW
| 0x5450102C
| 0x04
|-
| FALCON_TIME_HIGH
| 0x54501030
| 0x04
|-
| FALCON_WDTMR_TIME
| 0x54501034
| 0x04
|-
| FALCON_WDTMR_ENABLE
| 0x54501038
| 0x04
|-
| [[#FALCON_SCRATCH0|FALCON_SCRATCH0]]
| 0x54501040
| 0x04
|-
| [[#FALCON_SCRATCH1|FALCON_SCRATCH1]]
| 0x54501044
| 0x04
|-
| [[#FALCON_ITFEN|FALCON_ITFEN]]
| 0x54501048
| 0x04
|-
| [[#FALCON_IDLESTATE|FALCON_IDLESTATE]]
| 0x5450104C
| 0x04
|-
| FALCON_CURCTX
| 0x54501050
| 0x04
|-
| FALCON_NXTCTX
| 0x54501054
| 0x04
|-
| FALCON_CMDCTX
| 0x54501058
| 0x04
|-
| FALCON_STATUS_MASK
| 0x5450105C
| 0x04
|-
| FALCON_VM_SUPERVISOR
| 0x54501060
| 0x04
|-
| FALCON_MTHD_DATA
| 0x54501064
| 0x04
|-
| FALCON_MTHD_CMD
| 0x54501068
| 0x04
|-
| FALCON_MTHD_DATA_WR
| 0x5450106C
| 0x04
|-
| FALCON_MTHD_OCCUPIED
| 0x54501070
| 0x04
|-
| FALCON_MTHD_ACK
| 0x54501074
| 0x04
|-
| FALCON_MTHD_LIMIT
| 0x54501078
| 0x04
|-
| FALCON_SUBENGINE_RESET
| 0x5450107C
| 0x04
|-
| FALCON_SCRATCH2
| 0x54501080
| 0x04
|-
| FALCON_SCRATCH3
| 0x54501084
| 0x04
|-
| FALCON_PM_TRIGGER
| 0x54501088
| 0x04
|-
| FALCON_PM_MODE
| 0x5450108C
| 0x04
|-
| FALCON_DEBUG1
| 0x54501090
| 0x04
|-
| [[#FALCON_DEBUGINFO|FALCON_DEBUGINFO]]
| 0x54501094
| 0x04
|-
| FALCON_BREAKPOINT0
| 0x54501098
| 0x04
|-
| FALCON_BREAKPOINT1
| 0x5450109C
| 0x04
|-
| FALCON_CGCTL
| 0x545010A0
| 0x04
|-
| FALCON_ENGCTL
| 0x545010A4
| 0x04
|-
| FALCON_PM_SEL
| 0x545010A8
| 0x04
|-
| FALCON_HOST_IO_INDEX
| 0x545010AC
| 0x04
|-
| [[#FALCON_EXCI|FALCON_EXCI]]
| 0x545010D0
| 0x04
|-
| [[#FALCON_CPUCTL|FALCON_CPUCTL]]
| 0x54501100
| 0x04
|-
| [[#FALCON_BOOTVEC|FALCON_BOOTVEC]]
| 0x54501104
| 0x04
|-
| [[#FALCON_HWCFG|FALCON_HWCFG]]
| 0x54501108
| 0x04
|-
| [[#FALCON_DMACTL|FALCON_DMACTL]]
| 0x5450110C
| 0x04
|-
| [[#FALCON_DMATRF_EXTBASE|FALCON_DMATRF_EXTBASE]]
| 0x54501110
| 0x04
|-
| [[#FALCON_DMATRF_VOFF|FALCON_DMATRF_VOFF]]
| 0x54501114
| 0x04
|-
| [[#FALCON_DMATRFCMD|FALCON_DMATRFCMD]]
| 0x54501118
| 0x04
|-
| [[#FALCON_DMATRF_POFF|FALCON_DMATRF_POFF]]
| 0x5450111C
| 0x04
|-
| [[#FALCON_DMATRFSTAT|FALCON_DMATRFSTAT]]
| 0x54501120
| 0x04
|-
| [[#FALCON_CRYPTTRFSTAT|FALCON_CRYPTTRFSTAT]]
| 0x54501124
| 0x04
|-
| FALCON_CPUSTAT
| 0x54501128
| 0x04
|-
| [[#FALCON_HWCFG2|FALCON_HWCFG2]]
| 0x5450112C
| 0x04
|-
| FALCON_CPUCTL_ALIAS
| 0x54501130
| 0x04
|-
| FALCON_TLB_CMD
| 0x54501140
| 0x04
|-
| FALCON_TLB_CMD_RES
| 0x54501144
| 0x04
|-
| FALCON_BRANCH_HISTORY_CTRL
| 0x54501148
| 0x04
|-
| FALCON_BRANCH_HISTORY_PC
| 0x5450114C
| 0x04
|-
| FALCON_IMFILLRNG0
| 0x54501150
| 0x04
|-
| FALCON_IMFILLRNG1
| 0x54501154
| 0x04
|-
| FALCON_IMFILLCTL
| 0x54501158
| 0x04
|-
| FALCON_EXTERRWIN
| 0x54501160
| 0x04
|-
| FALCON_EXTERRCFG
| 0x54501164
| 0x04
|-
| FALCON_EXTERRADDR
| 0x54501168
| 0x04
|-
| FALCON_EXTERRSTAT
| 0x5450116C
| 0x04
|-
| FALCON_CG2
| 0x5450117C
| 0x04
|-
| FALCON_CODE_INDEX
| 0x54501180
| 0x04
|-
| FALCON_CODE
| 0x54501184
| 0x04
|-
| FALCON_CODE_VIRT_ADDR
| 0x54501188
| 0x04
|-
| FALCON_DATA_INDEX0
| 0x545011C0
| 0x04
|-
| FALCON_DATA0
| 0x545011C4
| 0x04
|-
| FALCON_DATA_INDEX1
| 0x545011C8
| 0x04
|-
| FALCON_DATA1
| 0x545011CC
| 0x04
|-
| FALCON_DATA_INDEX2
| 0x545011D0
| 0x04
|-
| FALCON_DATA2
| 0x545011D4
| 0x04
|-
| FALCON_DATA_INDEX3
| 0x545011D8
| 0x04
|-
| FALCON_DATA3
| 0x545011DC
| 0x04
|-
| FALCON_DATA_INDEX4
| 0x545011E0
| 0x04
|-
| FALCON_DATA4
| 0x545011E4
| 0x04
|-
| FALCON_DATA_INDEX5
| 0x545011E8
| 0x04
|-
| FALCON_DATA5
| 0x545011EC
| 0x04
|-
| FALCON_DATA_INDEX6
| 0x545011F0
| 0x04
|-
| FALCON_DATA6
| 0x545011F4
| 0x04
|-
| FALCON_DATA_INDEX7
| 0x545011F8
| 0x04
|-
| FALCON_DATA7
| 0x545011FC
| 0x04
|-
| [[#FALCON_ICD_CMD|FALCON_ICD_CMD]]
| 0x54501200
| 0x04
|-
| FALCON_ICD_ADDR
| 0x54501204
| 0x04
|-
| FALCON_ICD_WDATA
| 0x54501208
| 0x04
|-
| FALCON_ICD_RDATA
| 0x5450120C
| 0x04
|-
| [[#FALCON_SCTL|FALCON_SCTL]]
| 0x54501240
| 0x04
|-
| [[#TSEC_SCP_CTL_ACCESS|TSEC_SCP_CTL_ACCESS]]
| 0x54501400
| 0x04
|-
| [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]]
| 0x54501404
| 0x04
|-
| [[#TSEC_SCP_CTL_STAT|TSEC_SCP_CTL_STAT]]
| 0x54501408
| 0x04
|-
| [[#TSEC_SCP_CTL_MODE|TSEC_SCP_CTL_MODE]]
| 0x5450140C
| 0x04
|-
| TSEC_SCP_UNK0
| 0x54501410
| 0x04
|-
| [[#TSEC_SCP_CTL_PKEY|TSEC_SCP_CTL_PKEY]]
| 0x54501418
| 0x04
|-
| [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]]
| 0x54501420
| 0x04
|-
| [[#TSEC_SCP_SEQ_STAT|TSEC_SCP_SEQ_STAT]]
| 0x54501428
| 0x04
|-
| [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]]
| 0x54501430
| 0x04
|-
| TSEC_SCP_UNK2
| 0x54501454
| 0x04
|-
| [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]]
| 0x54501458
| 0x04
|-
| TSEC_SCP_UNK3
| 0x54501470
| 0x04
|-
| [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT]]
| 0x54501480
| 0x04
|-
| [[#TSEC_SCP_IRQMASK|TSEC_SCP_IRQMASK]]
| 0x54501484
| 0x04
|-
| TSEC_SCP_UNK4
| 0x54501490
| 0x04
|-
| [[#TSEC_SCP_ERR|TSEC_SCP_ERR]]
| 0x54501498
| 0x04
|-
| TSEC_TRNG_CLKDIV
| 0x54501500
| 0x04
|-
| TSEC_TRNG_UNK0
| 0x54501504
| 0x04
|-
| TSEC_TRNG_UNK1
| 0x5450150C
| 0x04
|-
| TSEC_TRNG_UNK2
| 0x54501510
| 0x04
|-
| TSEC_TRNG_UNK3
| 0x54501514
| 0x04
|-
| TSEC_TRNG_UNK4
| 0x54501518
| 0x04
|-
| TSEC_TRNG_UNK5
| 0x5450151C
| 0x04
|-
| TSEC_TRNG_UNK6
| 0x54501528
| 0x04
|-
| TSEC_TRNG_UNK7
| 0x5450152C
| 0x04
|-
| TSEC_TFBIF_UNK0
| 0x54501600
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL|TSEC_TFBIF_MCCIF_FIFOCTRL]]
| 0x54501604
| 0x04
|-
| TSEC_TFBIF_UNK1
| 0x54501608
| 0x04
|-
| TSEC_TFBIF_UNK2
| 0x5450160C
| 0x04
|-
| TSEC_TFBIF_UNK3
| 0x54501630
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL1|TSEC_TFBIF_MCCIF_FIFOCTRL1]]
| 0x54501634
| 0x04
|-
| TSEC_TFBIF_UNK4
| 0x54501640
| 0x04
|-
| [[#TSEC_TFBIF_UNK5|TSEC_TFBIF_UNK5]]
| 0x54501644
| 0x04
|-
| [[#TSEC_TFBIF_UNK6|TSEC_TFBIF_UNK6]]
| 0x54501648
| 0x04
|-
| [[#TSEC_DMA_CMD|TSEC_DMA_CMD]]
| 0x54501700
| 0x04
|-
| [[#TSEC_DMA_ADDR|TSEC_DMA_ADDR]]
| 0x54501704
| 0x04
|-
| [[#TSEC_DMA_VAL|TSEC_DMA_VAL]]
| 0x54501708
| 0x04
|-
| [[#TSEC_DMA_UNK|TSEC_DMA_UNK]]
| 0x5450170C
| 0x04
|-
| TSEC_TEGRA_FALCON_IP_VER
| 0x54501800
| 0x04
|-
| TSEC_TEGRA_UNK0
| 0x54501824
| 0x04
|-
| TSEC_TEGRA_UNK1
| 0x54501828
| 0x04
|-
| TSEC_TEGRA_UNK2
| 0x5450182C
| 0x04
|-
| [[#TSEC_TEGRA_CTL|TSEC_TEGRA_CTL]]
| 0x54501838
| 0x04
|}

=== TSEC_THI_METHOD0 ===
{| class="wikitable" border="1"
! ID
! Method
|-
| 0x200
| SET_APPLICATION_ID
|-
| 0x300
| EXECUTE
|-
| 0x500
| HDCP_INIT
|-
| 0x504
| HDCP_CREATE_SESSION
|-
| 0x508
| HDCP_VERIFY_CERT_RX
|-
| 0x50C
| HDCP_GENERATE_EKM
|-
| 0x510
| HDCP_REVOCATION_CHECK
|-
| 0x514
| HDCP_VERIFY_HPRIME
|-
| 0x518
| HDCP_ENCRYPT_PAIRING_INFO
|-
| 0x51C
| HDCP_DECRYPT_PAIRING_INFO
|-
| 0x520
| HDCP_UPDATE_SESSION
|-
| 0x524
| HDCP_GENERATE_LC_INIT
|-
| 0x528
| HDCP_VERIFY_LPRIME
|-
| 0x52C
| HDCP_GENERATE_SKE_INIT
|-
| 0x530
| HDCP_VERIFY_VPRIME
|-
| 0x534
| HDCP_ENCRYPTION_RUN_CTRL
|-
| 0x538
| HDCP_SESSION_CTRL
|-
| 0x53C
| HDCP_COMPUTE_SPRIME
|-
| 0x540
| HDCP_GET_CERT_RX
|-
| 0x544
| HDCP_EXCHANGE_INFO
|-
| 0x548
| HDCP_DECRYPT_KM
|-
| 0x54C
| HDCP_GET_HPRIME
|-
| 0x550
| HDCP_GENERATE_EKH_KM
|-
| 0x554
| HDCP_VERIFY_RTT_CHALLENGE
|-
| 0x558
| HDCP_GET_LPRIME
|-
| 0x55C
| HDCP_DECRYPT_KS
|-
| 0x560
| HDCP_DECRYPT
|-
| 0x564
| HDCP_GET_RRX
|-
| 0x568
| HDCP_DECRYPT_REENCRYPT
|-
| 0x56C
|
|-
| 0x570
|
|-
| 0x574
|
|-
| 0x578
|
|-
| 0x57C
|
|-
| 0x700
| HDCP_VALIDATE_SRM
|-
| 0x704
| HDCP_VALIDATE_STREAM
|-
| 0x708
| HDCP_TEST_SECURE_STATUS
|-
| 0x70C
| HDCP_SET_DCP_KPUB
|-
| 0x710
| HDCP_SET_RX_KPUB
|-
| 0x714
| HDCP_SET_CERT_RX
|-
| 0x718
| HDCP_SET_SCRATCH_BUFFER
|-
| 0x71C
| HDCP_SET_SRM
|-
| 0x720
| HDCP_SET_RECEIVER_ID_LIST
|-
| 0x724
| HDCP_SET_SPRIME
|-
| 0x728
| HDCP_SET_ENC_INPUT_BUFFER
|-
| 0x72C
| HDCP_SET_ENC_OUTPUT_BUFFER
|-
| 0x730
| HDCP_GET_RTT_CHALLENGE
|-
| 0x734
| HDCP_STREAM_MANAGE
|-
| 0x738
| HDCP_READ_CAPS
|-
| 0x73C
| HDCP_ENCRYPT
|-
| 0x740
| [6.0.0+] HDCP_GET_CURRENT_NONCE
|}

Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_METHOD1 ===
Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_INT_STATUS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_STATUS_FALCON_INT
|}

=== TSEC_THI_INT_MASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_MASK_FALCON_INT
|}

=== FALCON_IRQSSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSSET_GPTMR
|-
| 1
| FALCON_IRQSSET_WDTMR
|-
| 2
| FALCON_IRQSSET_MTHD
|-
| 3
| FALCON_IRQSSET_CTXSW
|-
| 4
| FALCON_IRQSSET_HALT
|-
| 5
| FALCON_IRQSSET_EXTERR
|-
| 6
| FALCON_IRQSSET_SWGEN0
|-
| 7
| FALCON_IRQSSET_SWGEN1
|-
| 8-15
| FALCON_IRQSSET_EXT
|}

Used for setting Falcon's IRQs.

=== FALCON_IRQSCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSCLR_GPTMR
|-
| 1
| FALCON_IRQSCLR_WDTMR
|-
| 2
| FALCON_IRQSCLR_MTHD
|-
| 3
| FALCON_IRQSCLR_CTXSW
|-
| 4
| FALCON_IRQSCLR_HALT
|-
| 5
| FALCON_IRQSCLR_EXTERR
|-
| 6
| FALCON_IRQSCLR_SWGEN0
|-
| 7
| FALCON_IRQSCLR_SWGEN1
|-
| 8-15
| FALCON_IRQSCLR_EXT
|}

Used for clearing Falcon's IRQs.

=== FALCON_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSTAT_GPTMR
|-
| 1
| FALCON_IRQSTAT_WDTMR
|-
| 2
| FALCON_IRQSTAT_MTHD
|-
| 3
| FALCON_IRQSTAT_CTXSW
|-
| 4
| FALCON_IRQSTAT_HALT
|-
| 5
| FALCON_IRQSTAT_EXTERR
|-
| 6
| FALCON_IRQSTAT_SWGEN0
|-
| 7
| FALCON_IRQSTAT_SWGEN1
|-
| 8-15
| FALCON_IRQSTAT_EXT
|}

Used for getting the status of Falcon's IRQs.

=== FALCON_IRQMODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMODE_GPTMR
|-
| 1
| FALCON_IRQMODE_WDTMR
|-
| 2
| FALCON_IRQMODE_MTHD
|-
| 3
| FALCON_IRQMODE_CTXSW
|-
| 4
| FALCON_IRQMODE_HALT
|-
| 5
| FALCON_IRQMODE_EXTERR
|-
| 6
| FALCON_IRQMODE_SWGEN0
|-
| 7
| FALCON_IRQMODE_SWGEN1
|-
| 8-15
| FALCON_IRQMODE_EXT
|}

Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.

=== FALCON_IRQMSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMSET_GPTMR
|-
| 1
| FALCON_IRQMSET_WDTMR
|-
| 2
| FALCON_IRQMSET_MTHD
|-
| 3
| FALCON_IRQMSET_CTXSW
|-
| 4
| FALCON_IRQMSET_HALT
|-
| 5
| FALCON_IRQMSET_EXTERR
|-
| 6
| FALCON_IRQMSET_SWGEN0
|-
| 7
| FALCON_IRQMSET_SWGEN1
|-
| 8-15
| FALCON_IRQMSET_EXT
|}

Used for setting the mask for Falcon's IRQs.

=== FALCON_IRQMCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMCLR_GPTMR
|-
| 1
| FALCON_IRQMCLR_WDTMR
|-
| 2
| FALCON_IRQMCLR_MTHD
|-
| 3
| FALCON_IRQMCLR_CTXSW
|-
| 4
| FALCON_IRQMCLR_HALT
|-
| 5
| FALCON_IRQMCLR_EXTERR
|-
| 6
| FALCON_IRQMCLR_SWGEN0
|-
| 7
| FALCON_IRQMCLR_SWGEN1
|-
| 8-15
| FALCON_IRQMCLR_EXT
|}

Used for clearing the mask for Falcon's IRQs.

=== FALCON_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMASK_GPTMR
|-
| 1
| FALCON_IRQMASK_WDTMR
|-
| 2
| FALCON_IRQMASK_MTHD
|-
| 3
| FALCON_IRQMASK_CTXSW
|-
| 4
| FALCON_IRQMASK_HALT
|-
| 5
| FALCON_IRQMASK_EXTERR
|-
| 6
| FALCON_IRQMASK_SWGEN0
|-
| 7
| FALCON_IRQMASK_SWGEN1
|-
| 8-15
| FALCON_IRQMASK_EXT
|}

Used for getting the value of the mask for Falcon's IRQs.

=== FALCON_IRQDEST ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQDEST_HOST_GPTMR
|-
| 1
| FALCON_IRQDEST_HOST_WDTMR
|-
| 2
| FALCON_IRQDEST_HOST_MTHD
|-
| 3
| FALCON_IRQDEST_HOST_CTXSW
|-
| 4
| FALCON_IRQDEST_HOST_HALT
|-
| 5
| FALCON_IRQDEST_HOST_EXTERR
|-
| 6
| FALCON_IRQDEST_HOST_SWGEN0
|-
| 7
| FALCON_IRQDEST_HOST_SWGEN1
|-
| 8-15
| FALCON_IRQDEST_HOST_EXT
|-
| 16
| FALCON_IRQDEST_TARGET_GPTMR
|-
| 17
| FALCON_IRQDEST_TARGET_WDTMR
|-
| 18
| FALCON_IRQDEST_TARGET_MTHD
|-
| 19
| FALCON_IRQDEST_TARGET_CTXSW
|-
| 20
| FALCON_IRQDEST_TARGET_HALT
|-
| 21
| FALCON_IRQDEST_TARGET_EXTERR
|-
| 22
| FALCON_IRQDEST_TARGET_SWGEN0
|-
| 23
| FALCON_IRQDEST_TARGET_SWGEN1
|-
| 24-31
| FALCON_IRQDEST_TARGET_EXT
|}

Used for routing Falcon's IRQs.

=== FALCON_SCRATCH0 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_SCRATCH1 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_ITFEN ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_ITFEN_CTXEN
|-
| 1
| FALCON_ITFEN_MTHDEN
|}

Used for enabling/disabling Falcon interfaces.

=== FALCON_IDLESTATE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IDLESTATE_FALCON_BUSY
|-
| 1-15
| FALCON_IDLESTATE_EXT_BUSY
|}

Used for detecting if Falcon is busy or not.

=== FALCON_DEBUGINFO ===
Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.

[6.0.0+] [[NV_services|nvservices]] sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.

=== FALCON_EXCI ===
Contains information about raised exceptions.

=== FALCON_CPUCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_CPUCTL_IINVAL
|-
| 1
| FALCON_CPUCTL_STARTCPU
|-
| 2
| FALCON_CPUCTL_SRESET
|-
| 3
| FALCON_CPUCTL_HRESET
|-
| 4
| FALCON_CPUCTL_HALTED
|-
| 5
| FALCON_CPUCTL_STOPPED
|-
| 6
| FALCON_CPUCTL_START_SCP_LS
|}

Used for signaling the Falcon CPU.

=== FALCON_BOOTVEC ===
Takes the Falcon's boot vector address.

=== FALCON_HWCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-8
| FALCON_HWCFG_IMEM_SIZE
|-
| 9-17
| FALCON_HWCFG_DMEM_SIZE
|-
| 18-25
| FALCON_HWCFG_MTHD_SIZE
|-
| 26-31
| FALCON_HWCFG_DMATRF_SLOTS
|}

=== FALCON_DMACTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMACTL_REQUIRE_CTX
|-
| 1
| FALCON_DMACTL_DMEM_SCRUBBING
|-
| 2
| FALCON_DMACTL_IMEM_SCRUBBING
|-
| 3-6
| FALCON_DMACTL_DMAQ_NUM
|-
| 7
| FALCON_DMACTL_SECURE_STAT
|}

Used for configuring the Falcon's DMA engine.

=== FALCON_DMATRF_EXTBASE ===
Base of the external memory buffer.

The base of the transfer is calculated by adding [[#FALCON_DMATRF_POFF]] to the base.

=== FALCON_DMATRF_VOFF ===
For transfers to DMEM: the destination address.
For transfers to IMEM: the destination virtual IMEM page.

=== FALCON_DMATRF_POFF ===
For transfers to IMEM: the destination physical IMEM page.

=== FALCON_DMATRFCMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFCMD_FULL
|-
| 1
| FALCON_DMATRFCMD_IDLE
|-
| 2-3
| FALCON_DMATRFCMD_SEC
|-
| 4
| FALCON_DMATRFCMD_IMEM
|-
| 5
| FALCON_DMATRFCMD_WRITE
|-
| 8-10
| FALCON_DMATRFCMD_SIZE
|-
| 12-14
| FALCON_DMATRFCMD_CTXDMA
|}

Used for configuring DMA transfers.

=== FALCON_DMATRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFSTAT_PENDING
|-
| 16-18
| FALCON_DMATRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_DMATRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_CRYPTTRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| FALCON_CRYPTTRFSTAT_PENDING
|-
| 5
| FALCON_CRYPTTRFSTAT_ENABLED
|-
| 16-18
| FALCON_CRYPTTRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_CRYPTTRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_HWCFG2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_HWCFG2_VERSION
|-
| 4-5
| FALCON_HWCFG2_SCP_MODE
|-
| 6-7
| FALCON_HWCFG2_SUBVERSION
|-
| 8-11
| FALCON_HWCFG2_IMEM_PORTS
|-
| 12-15
| FALCON_HWCFG2_DMEM_PORTS
|-
| 16-19
| FALCON_HWCFG2_VM_PAGES_LOG2
|}

=== FALCON_ICD_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_ICD_CMD_OPC
0x0: BREAK
0x1: CONTINUE_FROM_PC
0x2: CONTINUE_FROM_ADDR
0x3: CONTINUE_UNK1_FROM_PC
0x4: CONTINUE_UNK1_FROM_ADDR
0x5: SINGLE_STEP_FROM_PC
0x6: SINGLE_STEP_FROM_ADDR
0x7: SET_BREAK_MASK
0x8: REG_READ
0x9: REG_WRITE
0xA: DATA_READ
0xB: DATA_WRITE
0xC: IO_READ
0xD: IO_WRITE
0xE: STATUS_READ
|-
| 6-7
| FALCON_ICD_CMD_DATA_SIZE
|-
| 8-12
| FALCON_ICD_CMD_IDX
|-
| 14
| FALCON_ICD_CMD_ERROR
|-
| 15
| FALCON_ICD_CMD_DONE
|-
| 16-31
| FALCON_ICD_CMD_BREAK_MASK
|}

=== FALCON_SCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| FALCON_SCTL_SEC_MODE
0: Non-secure
1: Light Secure
2: Heavy Secure
|-
| 4-5
| FALCON_SCTL_OLD_SEC_MODE
0: Non-secure
1: Light Secure
2: Heavy Secure
|-
| 12-13
| Unknown
|-
| 14
| Initialize the transition to LS mode
|}

=== TSEC_SCP_CTL_ACCESS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| Enable TSEC_SCP_INSN_STAT register
|}

=== TSEC_SCP_CTL_TRNG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 11
| Unknown
|-
| 12
| Enable the TRNG
|}

=== TSEC_SCP_CTL_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| TSEC_SCP_CTL_STAT_DEBUG_MODE
|}

=== TSEC_SCP_CTL_MODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Disable reads for the TRNG register block
|-
| 1
| Disable reads for the TFBIF register block
|-
| 2
| Disable reads for the DMA register block
|-
| 3
| Disable reads for the TEGRA register block
|-
| 4
| Disable writes for the TRNG register block
|-
| 5
| Disable writes for the TFBIF register block
|-
| 6
| Disable writes for the DMA register block
|-
| 7
| Disable writes for the TEGRA register block
|}

Controls accesses to the other sub-engines and can only be cleared in Heavy Secure mode.

=== TSEC_SCP_CTL_PKEY ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
|-
| 1
| TSEC_SCP_CTL_PKEY_LOADED
|}

=== TSEC_SCP_SEQ0_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 8-11
| Size of current cs0begin macro
|-
|}

=== TSEC_SCP_SEQ_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Set if crypto sequence recording (cs0begin/cs1begin) is active
|-
| 4-7
| Number of instructions left for the crypto sequence
|-
| 12-15
| Active crypto key register
|}

Contains information on the last crypto sequence (cs0 or cs1) executed.

=== TSEC_SCP_INSN_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Crypto fuc5 destination register or immediate value
|-
| 8-13
| Crypto fuc5 source register or immediate value
|-
| 20-24
| Crypto fuc5 operation
0x0: nop (fuc5 opcode 0x00)
0x1: cmov (fuc5 opcode 0x84)
0x2: cxsin (fuc5 opcode 0x88) or xdst (with cxset)
0x3: cxsout (fuc5 opcode 0x8C) or xdld (with cxset)
0x4: crnd (fuc5 opcode 0x90)
0x5: cs0begin (fuc5 opcode 0x94)
0x6: cs0exec (fuc5 opcode 0x98)
0x7: cs1begin (fuc5 opcode 0x9C)
0x8: cs1exec (fuc5 opcode 0xA0)
0x9: invalid (fuc5 opcode 0xA4)
0xA: cchmod (fuc5 opcode 0xA8)
0xB: cxor (fuc5 opcode 0xAC)
0xC: cadd (fuc5 opcode 0xB0)
0xD: cand (fuc5 opcode 0xB4)
0xE: crev (fuc5 opcode 0xB8)
0xF: cprecmac (fuc5 opcode 0xBC)
0x10: csecret (fuc5 opcode 0xC0)
0x11: ckeyreg (fuc5 opcode 0xC4)
0x12: ckexp (fuc5 opcode 0xC8)
0x13: ckrexp (fuc5 opcode 0xCC)
0x14: cenc (fuc5 opcode 0xD0)
0x15: cdec (fuc5 opcode 0xD4)
0x16: csigauth (fuc5 opcode 0xD8)
0x17: csigenc (fuc5 opcode 0xDC)
0x18: csigclr (fuc5 opcode 0xE0)
|-
| 28
| Unknown
|-
| 31
| Set if running in secure mode (cauth)
|}

Contains information on the last crypto instruction executed.

=== TSEC_SCP_AES_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-4
| First opcode
|-
| 5-9
| Second opcode
|-
| 15-16
| AES operation
0: Encryption
1: Decryption
2: Key expansion
3: Key reverse expansion
|}

Contains information on the last AES sequence executed.

=== TSEC_SCP_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQSTAT_TRNG
|-
| 8
| TSEC_SCP_IRQSTAT_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQSTAT_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQSTAT_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the status of crypto IRQs.

=== TSEC_SCP_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQMASK_TRNG
|-
| 8
| TSEC_SCP_IRQMASK_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQMASK_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQMASK_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the value of the mask for crypto IRQs.

=== TSEC_SCP_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Invalid instruction
|-
| 4
| Empty crypto sequence
|-
| 8
| Crypto sequence is too long
|-
| 12
| Crypto sequence was not finished
|-
| 16
| Invalid cauth signature (during csigenc, csigclr or csigunk)
|-
| 24
| Forbidden instruction
|}

Contains information on crypto errors generated by the [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT_INSN_ERROR]] IRQ.

=== TSEC_TFBIF_MCCIF_FIFOCTRL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
|-
| 1
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
|-
| 2
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
|-
| 3
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
|-
| 4
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
|-
| 5
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
|-
| 6
| TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
|-
| 7
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
|-
| 8
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE
|}

=== TSEC_MCCIF_FIFOCTRL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
|-
| 16-31
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT
|}

=== TSEC_TFBIF_UNK5 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.

=== TSEC_TFBIF_UNK6 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to (data_size << 4) before reading memory from the GPU UCODE carveout.

=== TSEC_DMA_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_DMA_CMD_READ
|-
| 1
| TSEC_DMA_CMD_WRITE
|-
| 4-7
| TSEC_DMA_CMD_UNK
|-
| 12
| TSEC_DMA_CMD_BUSY
|-
| 13
| TSEC_DMA_CMD_ERROR
|-
| 31
| TSEC_DMA_CMD_INIT
|}

A DMA read/write operation requires bits TSEC_DMA_CMD_INIT and TSEC_DMA_CMD_READ/TSEC_DMA_CMD_WRITE to be set in TSEC_DMA_CMD.

During the transfer, the TSEC_DMA_CMD_BUSY bit is set.

Accessing an invalid address causes bit TSEC_DMA_CMD_ERROR to be set.

=== TSEC_DMA_ADDR ===
Takes the address for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_VAL ===
Takes the value for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_UNK ===
Always 0xFFF.

=== TSEC_TEGRA_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 16
| TSEC_TEGRA_CTL_TKFI_KFUSE
|-
| 17
| TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
|-
| 24
| TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
|-
| 25
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
|-
| 26
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
|-
| 27
| TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C
|}

== SCP ==
Part of the information here (which hasn't made it into envytools documentation yet) was shared by [https://wiki.0x04.net/wiki/Marcin_Ko%C5%9Bcielnicki mwk] from reverse engineering falcon processors over the years.

=== Authenticated Mode ===
==== Entry ====
From non-secure mode, upon jumping to a page marked as secret, a secret fault occurs. This causes the CPU to verify the region specified in $cauth against the MAC loaded in $c6. If the comparison is successful, the valid bit (bit0) is set on all pages in the $cauth region, and $pc is set to the base of the $cauth region. If the comparsion fails, the CPU is halted.

==== Exit ====
The CPU automatically goes back to non-secure mode when returning back into non-secret pages. When this happens, the valid bit (bit0) in the TLB flags is cleared for all secret pages.

==== Implementation ====
Under certain circumstances, it is possible to observe [[#csigauth|csigauth]] being briefly written to [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]] as "csigauth $c4 $c6" while the opcodes in [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]] are set to "cxsin" and "csigauth", respectively.

Via [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]] it can be observed that a 3-sized macro sequence is loaded into cs0 during a secure mode transition.

=== Operations ===
{| class="wikitable" border="1"
! Opcode
! Name
! Operand0
! Operand1
! Operation
! Condition
|-
| 0 || nop || N/A || N/A || ||
|-
| 1 || mov || $cX || $cY || <code>$cX = $cY; ACL(X) = ACL(Y);</code> ||
|-
| 2 || sin || $cX || N/A || <code>$cX = read_stream(); ACL(X) = ???;</code> ||
|-
| 3 || sout || $cX || N/A || <code>write_stream($cX);</code> || ?
|-
| 4 || rnd || $cX || N/A || <code>$cX = read_trng(); ACL(X) = ???;</code> ||
|-
| 5 || s0begin || immX || N/A || <code>record_macro_for_N_instructions(0, immX);</code> ||
|-
| 6 || s0exec || immX || N/A || <code>execute_macro_N_times(0, immX);</code> ||
|-
| 7 || s1begin || immX || N/A || <code>record_macro_for_N_instructions(1, immX);</code> ||
|-
| 8 || s1exec || immX || N/A || <code>execute_macro_N_times(1, immX);</code> ||
|-
| 9 || <invalid> || || || ||
|-
| 0xA || chmod || $cX || immY || Complicated, see [[#ACL|ACL]]. ||
|-
| 0xB || xor || $cX || $cY || <code>$cX ^= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xC || add || $cX || immY || <code>$cX += immY;</code> || <code>(ACL(X) & 2)</code>
|-
| 0xD || and || $cX || $cY || <code>$cX &= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xE || rev || $cX || $cY || <code>$cX = endian_swap128($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0xF || gfmul || $cX || $cY || <code>$cX = gfmul($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 2)</code>
|-
| 0x10 || secret || $cX || immY || <code>$cX = load_secret(immY); ACL(X) = load_secret_acl(immY);</code> ||
|-
| 0x11 || keyreg || immX || N/A || <code>active_key_idx = immX;</code> ||
|-
| 0x12 || kexp || $cX || $cY || <code>$cX = aes_kexp($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0x13 || krexp || $cX || $cY || <code>$cX = aes_kexp_reverse($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0x14 || enc || $cX || $cY || <code>$cX = aes_enc(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 1) && (ACL(Y) & 2)</code>
|-
| 0x15 || dec || $cX || $cY || <code>$cX = aes_dec(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 1) && (ACL(Y) & 2)</code>
|-
| 0x16 || csigauth || $cX || $cY || <code>if (hash_verify($cX, $cY)) { has_sig = true; current_sig = $cX; }</code> || ?
|-
| 0x17 || csigclr || N/A || N/A || <code>has_sig = false;</code> ||
|-
| 0x18 || csigenc || $cX || $cY || <code>if (has_sig) $cX = aes_enc(current_sig, $cY);</code> || ?
|}

==== csigauth ====
<code>00000000: f5 3c XY d8 csigauth $cY $cX</code>

Takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret. This instruction does not work in secure mode.

==== csigclr ====
<code>00000000: f5 3c 00 e0 csigclr</code>

This instruction takes no operands and appears to clear the saved cauth signature used by the csigenc instruction.

==== cchmod ====
<code>00000000: f5 3c XY a8 cchmod $cY 0X</code> or <code>00000000: f5 3c XY a9 cchmod $cY 1X</code>

This instruction takes a crypto register and a 5 bit immediate value which represents the [[#ACL|ACL]] mask to set.

==== crnd ====
<code>00000000: f5 3c 0X 90 crnd $cX</code>

This instruction initializes a crypto register with random data.

Executing this instruction only succeeds if the TRNG is enabled for the SCP, which requires taking the following steps:
* Write 0x7FFF to TSEC_TRNG_CLKDIV.
* Write 0x3FF0000 to TSEC_TRNG_UNK0.
* Write 0xFF00 to TSEC_TRNG_UNK7.
* Write 0x1000 to [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]].

Otherwise it hangs forever.

=== ACL ===
{| class="wikitable" border="1"
! Bit
! Meaning
|-
| 0 || Secure key. Forced set if bit1 is set. Once cleared, cannot be set again.
|-
| 1 || Secure readable. Once cleared, cannot be set again.
|-
| 2 || Insecure key. Forced set if bit3 is set. Forced clear if bit0 is clear. Can be toggled back and forth.
|-
| 3 || Insecure readable. Forced clear if bit1 is clear. Can be toggled back and forth.
|-
| 4 || Insecure overwritable. Can be toggled back and forth.
|}

==== Initial values ====
On SCP boot, the ACL is 0x1F for all $cX.

Loading into $cX using xdst instruction sets ACL($cX) to 0x13 and 0x1F, for secure and insecure mode respectively.

Spilling a $cX to DMEM using xdld instruction is allowed if (ACL($cX) & 2) or (ACL($cX) & 8), for secure and insecure mode respectively.

Loading a secret into $cX sets a per-secret ACL, unconditionally.

=== cauth ===
$cauth is a special purpose register in the CPU.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7 || Start of region to authenticate (in 0x100 pages)
|-
| 8-15 || Unknown
|-
| 16 || Use secret xfers (?)
|-
| 17 || Region is encrypted (?)
|-
| 18 || Unknown
|-
| 19 || Unknown
|-
| 20-23 || Unknown
|-
| 24-31 || Size of region to authenticate (in 0x100 pages)
|}

=== cxset ===
cxset instruction provides a way to change behavior of a variable amount of successively executed DMA-related instructions.

for example: <code>000000de: f4 3c 02 cxset 0x2</code>

can be read as: <code>dma_override(type=crypto_reg, count=2)</code>

The argument to cxset specifies the type of behavior change in the top 3 bits, and the number of DMA-related instructions the effect lasts for in the lower 5 bits.

{| class=wikitable
! Bits || Description
|-
| 0-4 || Number of instructions it is valid for (0x1f is a special value meaning infinitely many instructions -- until overriden by another cxset)
|-
| 5 || Crypto destination/source select (0=crypto register, 1=crypto stream)
|-
| 6 || External memory override (0=Disabled, 1=Enabled)
|-
| 7 || Internal memory select (0=DMEM, 1=IMEM)
|}

==== DMA-Related Instructions ====
At least the following instructions may have changed behavior, and count against the cxset "count" argument: <code>xdwait</code>, <code>xdst</code>, <code>xdld</code>.

For example, if override type=0b000, then the "length" argument to <code>xdst</code> is instead treated as the index of the target $cX register.

=== Secrets ===
Falcon's Authenticated Mode has access to 64 128-bit keys which are burned at factory. These keys can be loaded by using the $csecret instruction which takes the target crypto register and the key index as arguments.

{| class=wikitable
! Index || ACL || Console-unique || Notes
|-
| 0x00 || 0x13 || No || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares.
|-
| 0x01 || 0x10 || No || Used by nvhost_nvdec_bl020_prod firmware.
|-
| 0x02 || 0x10 || No ||
|-
| 0x03 || 0x11 || No || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|-
| 0x04 || 0x10 || No || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|-
| 0x05 || 0x13 || No || Used by nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares.
|-
| 0x06 || 0x11 || No ||
|-
| 0x07 || 0x11 || No || Used by [6.0.0+] nvhost_tsec firmware.
|-
| 0x08 || 0x10 || No ||
|-
| 0x09 || 0x13 || No || Used by nvhost_tsec firmware.
|-
| 0x0A || 0x11 || No ||
|-
| 0x0B || 0x10 || No || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|-
| 0x0C || 0x13 || No ||
|-
| 0x0D || 0x11 || No ||
|-
| 0x0E || 0x10 || No ||
|-
| 0x0F || 0x13 || No || Used by nvhost_tsec firmware.
|-
| 0x10 || 0x11 || No || Used by [1.0.0-5.1.0] nvhost_tsec firmware.
|-
| 0x11 || 0x10 || No ||
|-
| 0x12 || 0x13 || No ||
|-
| 0x13 || 0x11 || No ||
|-
| 0x14 || 0x10 || No ||
|-
| 0x15 || 0x13 || No || Used by nvhost_nvdec_bl020_prod, [5.0.0+] nvhost_nvdec020_prod, [5.0.0+] nvhost_nvdec020_ns and [6.0.0+] nvhost_tsec firmwares.
|-
| 0x16 || 0x11 || No ||
|-
| 0x17 || 0x10 || No ||
|-
| 0x18 || 0x13 || No ||
|-
| 0x19 || 0x11 || No ||
|-
| 0x1A || 0x10 || No ||
|-
| 0x1B || 0x13 || No ||
|-
| 0x1C || 0x11 || No ||
|-
| 0x1D || 0x10 || No ||
|-
| 0x1E || 0x13 || No ||
|-
| 0x1F || 0x11 || No ||
|-
| 0x20 || 0x10 || No ||
|-
| 0x21 || 0x13 || No ||
|-
| 0x22 || 0x11 || No ||
|-
| 0x23 || 0x10 || No ||
|-
| 0x24 || 0x13 || No ||
|-
| 0x25 || 0x11 || No ||
|-
| 0x26 || 0x10 || No || Used by [[TSEC_Firmware#KeygenLdr|KeygenLdr]].
|-
| 0x27 || 0x13 || No ||
|-
| 0x28 || 0x11 || No ||
|-
| 0x29 || 0x10 || No ||
|-
| 0x2A || 0x13 || No ||
|-
| 0x2B || 0x11 || No ||
|-
| 0x2C || 0x10 || No ||
|-
| 0x2D || 0x13 || No ||
|-
| 0x2E || 0x11 || No ||
|-
| 0x2F || 0x10 || No ||
|-
| 0x30 || 0x13 || No ||
|-
| 0x31 || 0x11 || No ||
|-
| 0x32 || 0x10 || No ||
|-
| 0x33 || 0x13 || No ||
|-
| 0x34 || 0x11 || No ||
|-
| 0x35 || 0x10 || No ||
|-
| 0x36 || 0x13 || No ||
|-
| 0x37 || 0x11 || No ||
|-
| 0x38 || 0x10 || No ||
|-
| 0x39 || 0x13 || No ||
|-
| 0x3A || 0x11 || No ||
|-
| 0x3B || 0x10 || No ||
|-
| 0x3C || 0x13 || No || Used by nvhost_tsec firmware.
|-
| 0x3D || 0x11 || No ||
|-
| 0x3E || 0x10 || No ||
|-
| 0x3F || 0x10 || Yes || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|}

TSEC

2019-01-09T21:36:27Z

Qlutoo: /* cauth */

TSEC (Tegra Security Co-processor) is a dedicated unit powered by a NVIDIA Falcon microprocessor with crypto extensions.

= Driver =
A host driver for communicating with the TSEC is mapped to physical address 0x54500000 with a total size of 0x40000 bytes and exposes several registers.

== Registers ==
Registers from 0x54500000 to 0x54501000 are used to configure the host interface (HOST1X).

Registers from 0x54501000 to 0x54502000 are a MMIO window for communicating with the Falcon microprocessor. From this range, the subset of registers from 0x54501400 to 0x54501FE8 are specific to the TSEC and are subdivided into:
* 0x54501400 to 0x54501500: SCP (Secure Crypto Processor?).
* 0x54501500 to 0x54501600: TRNG (True Random Number Generator).
* 0x54501600 to 0x54501700: TFBIF (Tegra Framebuffer Interface).
* 0x54501700 to 0x54501800: DMA.
* 0x54501800 to 0x54501900: TEGRA (miscellaneous interfaces).

{| class="wikitable" border="1"
! Name
! Address
! Width
|-
| TSEC_THI_INCR_SYNCPT
| 0x54500000
| 0x04
|-
| TSEC_THI_INCR_SYNCPT_ERR
| 0x54500008
| 0x04
|-
| TSEC_THI_CTXSW_INCR_SYNCPT
| 0x5450000C
| 0x04
|-
| TSEC_THI_CTXSW
| 0x54500020
| 0x04
|-
| TSEC_THI_CONT_SYNCPT_EOF
| 0x54500028
| 0x04
|-
| [[#TSEC_THI_METHOD0|TSEC_THI_METHOD0]]
| 0x54500040
| 0x04
|-
| [[#TSEC_THI_METHOD1|TSEC_THI_METHOD1]]
| 0x54500044
| 0x04
|-
| [[#TSEC_THI_INT_STATUS|TSEC_THI_INT_STATUS]]
| 0x54500078
| 0x04
|-
| [[#TSEC_THI_INT_MASK|TSEC_THI_INT_MASK]]
| 0x5450007C
| 0x04
|-
| TSEC_THI_SLCG_STATUS
| 0x54500084
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_HIGH_A
| 0x54500088
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_LOW_A
| 0x5450008C
| 0x04
|-
| TSEC_THI_CLK_OVERRIDE
| 0x54500E00
| 0x04
|-
| [[#FALCON_IRQSSET|FALCON_IRQSSET]]
| 0x54501000
| 0x04
|-
| [[#FALCON_IRQSCLR|FALCON_IRQSCLR]]
| 0x54501004
| 0x04
|-
| [[#FALCON_IRQSTAT|FALCON_IRQSTAT]]
| 0x54501008
| 0x04
|-
| [[#FALCON_IRQMODE|FALCON_IRQMODE]]
| 0x5450100C
| 0x04
|-
| [[#FALCON_IRQMSET|FALCON_IRQMSET]]
| 0x54501010
| 0x04
|-
| [[#FALCON_IRQMCLR|FALCON_IRQMCLR]]
| 0x54501014
| 0x04
|-
| [[#FALCON_IRQMASK|FALCON_IRQMASK]]
| 0x54501018
| 0x04
|-
| [[#FALCON_IRQDEST|FALCON_IRQDEST]]
| 0x5450101C
| 0x04
|-
| FALCON_GPTMR_PERIOD
| 0x54501020
| 0x04
|-
| FALCON_GPTMR_TIME
| 0x54501024
| 0x04
|-
| FALCON_GPTMR_ENABLE
| 0x54501028
| 0x04
|-
| FALCON_TIME_LOW
| 0x5450102C
| 0x04
|-
| FALCON_TIME_HIGH
| 0x54501030
| 0x04
|-
| FALCON_WDTMR_TIME
| 0x54501034
| 0x04
|-
| FALCON_WDTMR_ENABLE
| 0x54501038
| 0x04
|-
| [[#FALCON_SCRATCH0|FALCON_SCRATCH0]]
| 0x54501040
| 0x04
|-
| [[#FALCON_SCRATCH1|FALCON_SCRATCH1]]
| 0x54501044
| 0x04
|-
| [[#FALCON_ITFEN|FALCON_ITFEN]]
| 0x54501048
| 0x04
|-
| [[#FALCON_IDLESTATE|FALCON_IDLESTATE]]
| 0x5450104C
| 0x04
|-
| FALCON_CURCTX
| 0x54501050
| 0x04
|-
| FALCON_NXTCTX
| 0x54501054
| 0x04
|-
| FALCON_CMDCTX
| 0x54501058
| 0x04
|-
| FALCON_STATUS_MASK
| 0x5450105C
| 0x04
|-
| FALCON_VM_SUPERVISOR
| 0x54501060
| 0x04
|-
| FALCON_MTHD_DATA
| 0x54501064
| 0x04
|-
| FALCON_MTHD_CMD
| 0x54501068
| 0x04
|-
| FALCON_MTHD_DATA_WR
| 0x5450106C
| 0x04
|-
| FALCON_MTHD_OCCUPIED
| 0x54501070
| 0x04
|-
| FALCON_MTHD_ACK
| 0x54501074
| 0x04
|-
| FALCON_MTHD_LIMIT
| 0x54501078
| 0x04
|-
| FALCON_SUBENGINE_RESET
| 0x5450107C
| 0x04
|-
| FALCON_SCRATCH2
| 0x54501080
| 0x04
|-
| FALCON_SCRATCH3
| 0x54501084
| 0x04
|-
| FALCON_PM_TRIGGER
| 0x54501088
| 0x04
|-
| FALCON_PM_MODE
| 0x5450108C
| 0x04
|-
| FALCON_DEBUG1
| 0x54501090
| 0x04
|-
| [[#FALCON_DEBUGINFO|FALCON_DEBUGINFO]]
| 0x54501094
| 0x04
|-
| FALCON_BREAKPOINT0
| 0x54501098
| 0x04
|-
| FALCON_BREAKPOINT1
| 0x5450109C
| 0x04
|-
| FALCON_CGCTL
| 0x545010A0
| 0x04
|-
| FALCON_ENGCTL
| 0x545010A4
| 0x04
|-
| FALCON_PM_SEL
| 0x545010A8
| 0x04
|-
| FALCON_HOST_IO_INDEX
| 0x545010AC
| 0x04
|-
| [[#FALCON_EXCI|FALCON_EXCI]]
| 0x545010D0
| 0x04
|-
| [[#FALCON_CPUCTL|FALCON_CPUCTL]]
| 0x54501100
| 0x04
|-
| [[#FALCON_BOOTVEC|FALCON_BOOTVEC]]
| 0x54501104
| 0x04
|-
| [[#FALCON_HWCFG|FALCON_HWCFG]]
| 0x54501108
| 0x04
|-
| [[#FALCON_DMACTL|FALCON_DMACTL]]
| 0x5450110C
| 0x04
|-
| [[#FALCON_DMATRF_EXTBASE|FALCON_DMATRF_EXTBASE]]
| 0x54501110
| 0x04
|-
| [[#FALCON_DMATRF_VOFF|FALCON_DMATRF_VOFF]]
| 0x54501114
| 0x04
|-
| [[#FALCON_DMATRFCMD|FALCON_DMATRFCMD]]
| 0x54501118
| 0x04
|-
| [[#FALCON_DMATRF_POFF|FALCON_DMATRF_POFF]]
| 0x5450111C
| 0x04
|-
| [[#FALCON_DMATRFSTAT|FALCON_DMATRFSTAT]]
| 0x54501120
| 0x04
|-
| [[#FALCON_CRYPTTRFSTAT|FALCON_CRYPTTRFSTAT]]
| 0x54501124
| 0x04
|-
| FALCON_CPUSTAT
| 0x54501128
| 0x04
|-
| [[#FALCON_HWCFG2|FALCON_HWCFG2]]
| 0x5450112C
| 0x04
|-
| FALCON_CPUCTL_ALIAS
| 0x54501130
| 0x04
|-
| FALCON_TLB_CMD
| 0x54501140
| 0x04
|-
| FALCON_TLB_CMD_RES
| 0x54501144
| 0x04
|-
| FALCON_BRANCH_HISTORY_CTRL
| 0x54501148
| 0x04
|-
| FALCON_BRANCH_HISTORY_PC
| 0x5450114C
| 0x04
|-
| FALCON_IMFILLRNG0
| 0x54501150
| 0x04
|-
| FALCON_IMFILLRNG1
| 0x54501154
| 0x04
|-
| FALCON_IMFILLCTL
| 0x54501158
| 0x04
|-
| FALCON_EXTERRWIN
| 0x54501160
| 0x04
|-
| FALCON_EXTERRCFG
| 0x54501164
| 0x04
|-
| FALCON_EXTERRADDR
| 0x54501168
| 0x04
|-
| FALCON_EXTERRSTAT
| 0x5450116C
| 0x04
|-
| FALCON_CG2
| 0x5450117C
| 0x04
|-
| FALCON_CODE_INDEX
| 0x54501180
| 0x04
|-
| FALCON_CODE
| 0x54501184
| 0x04
|-
| FALCON_CODE_VIRT_ADDR
| 0x54501188
| 0x04
|-
| FALCON_DATA_INDEX0
| 0x545011C0
| 0x04
|-
| FALCON_DATA0
| 0x545011C4
| 0x04
|-
| FALCON_DATA_INDEX1
| 0x545011C8
| 0x04
|-
| FALCON_DATA1
| 0x545011CC
| 0x04
|-
| FALCON_DATA_INDEX2
| 0x545011D0
| 0x04
|-
| FALCON_DATA2
| 0x545011D4
| 0x04
|-
| FALCON_DATA_INDEX3
| 0x545011D8
| 0x04
|-
| FALCON_DATA3
| 0x545011DC
| 0x04
|-
| FALCON_DATA_INDEX4
| 0x545011E0
| 0x04
|-
| FALCON_DATA4
| 0x545011E4
| 0x04
|-
| FALCON_DATA_INDEX5
| 0x545011E8
| 0x04
|-
| FALCON_DATA5
| 0x545011EC
| 0x04
|-
| FALCON_DATA_INDEX6
| 0x545011F0
| 0x04
|-
| FALCON_DATA6
| 0x545011F4
| 0x04
|-
| FALCON_DATA_INDEX7
| 0x545011F8
| 0x04
|-
| FALCON_DATA7
| 0x545011FC
| 0x04
|-
| [[#FALCON_ICD_CMD|FALCON_ICD_CMD]]
| 0x54501200
| 0x04
|-
| FALCON_ICD_ADDR
| 0x54501204
| 0x04
|-
| FALCON_ICD_WDATA
| 0x54501208
| 0x04
|-
| FALCON_ICD_RDATA
| 0x5450120C
| 0x04
|-
| [[#FALCON_SCTL|FALCON_SCTL]]
| 0x54501240
| 0x04
|-
| [[#TSEC_SCP_CTL_ACCESS|TSEC_SCP_CTL_ACCESS]]
| 0x54501400
| 0x04
|-
| [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]]
| 0x54501404
| 0x04
|-
| [[#TSEC_SCP_CTL_STAT|TSEC_SCP_CTL_STAT]]
| 0x54501408
| 0x04
|-
| [[#TSEC_SCP_CTL_MODE|TSEC_SCP_CTL_MODE]]
| 0x5450140C
| 0x04
|-
| TSEC_SCP_UNK0
| 0x54501410
| 0x04
|-
| [[#TSEC_SCP_CTL_PKEY|TSEC_SCP_CTL_PKEY]]
| 0x54501418
| 0x04
|-
| [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]]
| 0x54501420
| 0x04
|-
| [[#TSEC_SCP_SEQ_STAT|TSEC_SCP_SEQ_STAT]]
| 0x54501428
| 0x04
|-
| [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]]
| 0x54501430
| 0x04
|-
| TSEC_SCP_UNK2
| 0x54501454
| 0x04
|-
| [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]]
| 0x54501458
| 0x04
|-
| TSEC_SCP_UNK3
| 0x54501470
| 0x04
|-
| [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT]]
| 0x54501480
| 0x04
|-
| [[#TSEC_SCP_IRQMASK|TSEC_SCP_IRQMASK]]
| 0x54501484
| 0x04
|-
| TSEC_SCP_UNK4
| 0x54501490
| 0x04
|-
| [[#TSEC_SCP_ERR|TSEC_SCP_ERR]]
| 0x54501498
| 0x04
|-
| TSEC_TRNG_CLKDIV
| 0x54501500
| 0x04
|-
| TSEC_TRNG_UNK0
| 0x54501504
| 0x04
|-
| TSEC_TRNG_UNK1
| 0x5450150C
| 0x04
|-
| TSEC_TRNG_UNK2
| 0x54501510
| 0x04
|-
| TSEC_TRNG_UNK3
| 0x54501514
| 0x04
|-
| TSEC_TRNG_UNK4
| 0x54501518
| 0x04
|-
| TSEC_TRNG_UNK5
| 0x5450151C
| 0x04
|-
| TSEC_TRNG_UNK6
| 0x54501528
| 0x04
|-
| TSEC_TRNG_UNK7
| 0x5450152C
| 0x04
|-
| TSEC_TFBIF_UNK0
| 0x54501600
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL|TSEC_TFBIF_MCCIF_FIFOCTRL]]
| 0x54501604
| 0x04
|-
| TSEC_TFBIF_UNK1
| 0x54501608
| 0x04
|-
| TSEC_TFBIF_UNK2
| 0x5450160C
| 0x04
|-
| TSEC_TFBIF_UNK3
| 0x54501630
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL1|TSEC_TFBIF_MCCIF_FIFOCTRL1]]
| 0x54501634
| 0x04
|-
| TSEC_TFBIF_UNK4
| 0x54501640
| 0x04
|-
| [[#TSEC_TFBIF_UNK5|TSEC_TFBIF_UNK5]]
| 0x54501644
| 0x04
|-
| [[#TSEC_TFBIF_UNK6|TSEC_TFBIF_UNK6]]
| 0x54501648
| 0x04
|-
| [[#TSEC_DMA_CMD|TSEC_DMA_CMD]]
| 0x54501700
| 0x04
|-
| [[#TSEC_DMA_ADDR|TSEC_DMA_ADDR]]
| 0x54501704
| 0x04
|-
| [[#TSEC_DMA_VAL|TSEC_DMA_VAL]]
| 0x54501708
| 0x04
|-
| [[#TSEC_DMA_UNK|TSEC_DMA_UNK]]
| 0x5450170C
| 0x04
|-
| TSEC_TEGRA_FALCON_IP_VER
| 0x54501800
| 0x04
|-
| TSEC_TEGRA_UNK0
| 0x54501824
| 0x04
|-
| TSEC_TEGRA_UNK1
| 0x54501828
| 0x04
|-
| TSEC_TEGRA_UNK2
| 0x5450182C
| 0x04
|-
| [[#TSEC_TEGRA_CTL|TSEC_TEGRA_CTL]]
| 0x54501838
| 0x04
|}

=== TSEC_THI_METHOD0 ===
{| class="wikitable" border="1"
! ID
! Method
|-
| 0x200
| SET_APPLICATION_ID
|-
| 0x300
| EXECUTE
|-
| 0x500
| HDCP_INIT
|-
| 0x504
| HDCP_CREATE_SESSION
|-
| 0x508
| HDCP_VERIFY_CERT_RX
|-
| 0x50C
| HDCP_GENERATE_EKM
|-
| 0x510
| HDCP_REVOCATION_CHECK
|-
| 0x514
| HDCP_VERIFY_HPRIME
|-
| 0x518
| HDCP_ENCRYPT_PAIRING_INFO
|-
| 0x51C
| HDCP_DECRYPT_PAIRING_INFO
|-
| 0x520
| HDCP_UPDATE_SESSION
|-
| 0x524
| HDCP_GENERATE_LC_INIT
|-
| 0x528
| HDCP_VERIFY_LPRIME
|-
| 0x52C
| HDCP_GENERATE_SKE_INIT
|-
| 0x530
| HDCP_VERIFY_VPRIME
|-
| 0x534
| HDCP_ENCRYPTION_RUN_CTRL
|-
| 0x538
| HDCP_SESSION_CTRL
|-
| 0x53C
| HDCP_COMPUTE_SPRIME
|-
| 0x540
| HDCP_GET_CERT_RX
|-
| 0x544
| HDCP_EXCHANGE_INFO
|-
| 0x548
| HDCP_DECRYPT_KM
|-
| 0x54C
| HDCP_GET_HPRIME
|-
| 0x550
| HDCP_GENERATE_EKH_KM
|-
| 0x554
| HDCP_VERIFY_RTT_CHALLENGE
|-
| 0x558
| HDCP_GET_LPRIME
|-
| 0x55C
| HDCP_DECRYPT_KS
|-
| 0x560
| HDCP_DECRYPT
|-
| 0x564
| HDCP_GET_RRX
|-
| 0x568
| HDCP_DECRYPT_REENCRYPT
|-
| 0x56C
|
|-
| 0x570
|
|-
| 0x574
|
|-
| 0x578
|
|-
| 0x57C
|
|-
| 0x700
| HDCP_VALIDATE_SRM
|-
| 0x704
| HDCP_VALIDATE_STREAM
|-
| 0x708
| HDCP_TEST_SECURE_STATUS
|-
| 0x70C
| HDCP_SET_DCP_KPUB
|-
| 0x710
| HDCP_SET_RX_KPUB
|-
| 0x714
| HDCP_SET_CERT_RX
|-
| 0x718
| HDCP_SET_SCRATCH_BUFFER
|-
| 0x71C
| HDCP_SET_SRM
|-
| 0x720
| HDCP_SET_RECEIVER_ID_LIST
|-
| 0x724
| HDCP_SET_SPRIME
|-
| 0x728
| HDCP_SET_ENC_INPUT_BUFFER
|-
| 0x72C
| HDCP_SET_ENC_OUTPUT_BUFFER
|-
| 0x730
| HDCP_GET_RTT_CHALLENGE
|-
| 0x734
| HDCP_STREAM_MANAGE
|-
| 0x738
| HDCP_READ_CAPS
|-
| 0x73C
| HDCP_ENCRYPT
|-
| 0x740
| [6.0.0+] HDCP_GET_CURRENT_NONCE
|}

Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_METHOD1 ===
Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_INT_STATUS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_STATUS_FALCON_INT
|}

=== TSEC_THI_INT_MASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_MASK_FALCON_INT
|}

=== FALCON_IRQSSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSSET_GPTMR
|-
| 1
| FALCON_IRQSSET_WDTMR
|-
| 2
| FALCON_IRQSSET_MTHD
|-
| 3
| FALCON_IRQSSET_CTXSW
|-
| 4
| FALCON_IRQSSET_HALT
|-
| 5
| FALCON_IRQSSET_EXTERR
|-
| 6
| FALCON_IRQSSET_SWGEN0
|-
| 7
| FALCON_IRQSSET_SWGEN1
|-
| 8-15
| FALCON_IRQSSET_EXT
|}

Used for setting Falcon's IRQs.

=== FALCON_IRQSCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSCLR_GPTMR
|-
| 1
| FALCON_IRQSCLR_WDTMR
|-
| 2
| FALCON_IRQSCLR_MTHD
|-
| 3
| FALCON_IRQSCLR_CTXSW
|-
| 4
| FALCON_IRQSCLR_HALT
|-
| 5
| FALCON_IRQSCLR_EXTERR
|-
| 6
| FALCON_IRQSCLR_SWGEN0
|-
| 7
| FALCON_IRQSCLR_SWGEN1
|-
| 8-15
| FALCON_IRQSCLR_EXT
|}

Used for clearing Falcon's IRQs.

=== FALCON_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSTAT_GPTMR
|-
| 1
| FALCON_IRQSTAT_WDTMR
|-
| 2
| FALCON_IRQSTAT_MTHD
|-
| 3
| FALCON_IRQSTAT_CTXSW
|-
| 4
| FALCON_IRQSTAT_HALT
|-
| 5
| FALCON_IRQSTAT_EXTERR
|-
| 6
| FALCON_IRQSTAT_SWGEN0
|-
| 7
| FALCON_IRQSTAT_SWGEN1
|-
| 8-15
| FALCON_IRQSTAT_EXT
|}

Used for getting the status of Falcon's IRQs.

=== FALCON_IRQMODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMODE_GPTMR
|-
| 1
| FALCON_IRQMODE_WDTMR
|-
| 2
| FALCON_IRQMODE_MTHD
|-
| 3
| FALCON_IRQMODE_CTXSW
|-
| 4
| FALCON_IRQMODE_HALT
|-
| 5
| FALCON_IRQMODE_EXTERR
|-
| 6
| FALCON_IRQMODE_SWGEN0
|-
| 7
| FALCON_IRQMODE_SWGEN1
|-
| 8-15
| FALCON_IRQMODE_EXT
|}

Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.

=== FALCON_IRQMSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMSET_GPTMR
|-
| 1
| FALCON_IRQMSET_WDTMR
|-
| 2
| FALCON_IRQMSET_MTHD
|-
| 3
| FALCON_IRQMSET_CTXSW
|-
| 4
| FALCON_IRQMSET_HALT
|-
| 5
| FALCON_IRQMSET_EXTERR
|-
| 6
| FALCON_IRQMSET_SWGEN0
|-
| 7
| FALCON_IRQMSET_SWGEN1
|-
| 8-15
| FALCON_IRQMSET_EXT
|}

Used for setting the mask for Falcon's IRQs.

=== FALCON_IRQMCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMCLR_GPTMR
|-
| 1
| FALCON_IRQMCLR_WDTMR
|-
| 2
| FALCON_IRQMCLR_MTHD
|-
| 3
| FALCON_IRQMCLR_CTXSW
|-
| 4
| FALCON_IRQMCLR_HALT
|-
| 5
| FALCON_IRQMCLR_EXTERR
|-
| 6
| FALCON_IRQMCLR_SWGEN0
|-
| 7
| FALCON_IRQMCLR_SWGEN1
|-
| 8-15
| FALCON_IRQMCLR_EXT
|}

Used for clearing the mask for Falcon's IRQs.

=== FALCON_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMASK_GPTMR
|-
| 1
| FALCON_IRQMASK_WDTMR
|-
| 2
| FALCON_IRQMASK_MTHD
|-
| 3
| FALCON_IRQMASK_CTXSW
|-
| 4
| FALCON_IRQMASK_HALT
|-
| 5
| FALCON_IRQMASK_EXTERR
|-
| 6
| FALCON_IRQMASK_SWGEN0
|-
| 7
| FALCON_IRQMASK_SWGEN1
|-
| 8-15
| FALCON_IRQMASK_EXT
|}

Used for getting the value of the mask for Falcon's IRQs.

=== FALCON_IRQDEST ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQDEST_HOST_GPTMR
|-
| 1
| FALCON_IRQDEST_HOST_WDTMR
|-
| 2
| FALCON_IRQDEST_HOST_MTHD
|-
| 3
| FALCON_IRQDEST_HOST_CTXSW
|-
| 4
| FALCON_IRQDEST_HOST_HALT
|-
| 5
| FALCON_IRQDEST_HOST_EXTERR
|-
| 6
| FALCON_IRQDEST_HOST_SWGEN0
|-
| 7
| FALCON_IRQDEST_HOST_SWGEN1
|-
| 8-15
| FALCON_IRQDEST_HOST_EXT
|-
| 16
| FALCON_IRQDEST_TARGET_GPTMR
|-
| 17
| FALCON_IRQDEST_TARGET_WDTMR
|-
| 18
| FALCON_IRQDEST_TARGET_MTHD
|-
| 19
| FALCON_IRQDEST_TARGET_CTXSW
|-
| 20
| FALCON_IRQDEST_TARGET_HALT
|-
| 21
| FALCON_IRQDEST_TARGET_EXTERR
|-
| 22
| FALCON_IRQDEST_TARGET_SWGEN0
|-
| 23
| FALCON_IRQDEST_TARGET_SWGEN1
|-
| 24-31
| FALCON_IRQDEST_TARGET_EXT
|}

Used for routing Falcon's IRQs.

=== FALCON_SCRATCH0 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_SCRATCH1 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_ITFEN ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_ITFEN_CTXEN
|-
| 1
| FALCON_ITFEN_MTHDEN
|}

Used for enabling/disabling Falcon interfaces.

=== FALCON_IDLESTATE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IDLESTATE_FALCON_BUSY
|-
| 1-15
| FALCON_IDLESTATE_EXT_BUSY
|}

Used for detecting if Falcon is busy or not.

=== FALCON_DEBUGINFO ===
Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.

[6.0.0+] [[NV_services|nvservices]] sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.

=== FALCON_EXCI ===
Contains information about raised exceptions.

=== FALCON_CPUCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_CPUCTL_IINVAL
|-
| 1
| FALCON_CPUCTL_STARTCPU
|-
| 2
| FALCON_CPUCTL_SRESET
|-
| 3
| FALCON_CPUCTL_HRESET
|-
| 4
| FALCON_CPUCTL_HALTED
|-
| 5
| FALCON_CPUCTL_STOPPED
|-
| 6
| FALCON_CPUCTL_START_SCP_LS
|}

Used for signaling the Falcon CPU.

=== FALCON_BOOTVEC ===
Takes the Falcon's boot vector address.

=== FALCON_HWCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-8
| FALCON_HWCFG_IMEM_SIZE
|-
| 9-17
| FALCON_HWCFG_DMEM_SIZE
|-
| 18-25
| FALCON_HWCFG_MTHD_SIZE
|-
| 26-31
| FALCON_HWCFG_DMATRF_SLOTS
|}

=== FALCON_DMACTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMACTL_REQUIRE_CTX
|-
| 1
| FALCON_DMACTL_DMEM_SCRUBBING
|-
| 2
| FALCON_DMACTL_IMEM_SCRUBBING
|-
| 3-6
| FALCON_DMACTL_DMAQ_NUM
|-
| 7
| FALCON_DMACTL_SECURE_STAT
|}

Used for configuring the Falcon's DMA engine.

=== FALCON_DMATRF_EXTBASE ===
Base of the external memory buffer.

The base of the transfer is calculated by adding [[#FALCON_DMATRF_POFF]] to the base.

=== FALCON_DMATRF_VOFF ===
For transfers to DMEM: the destination address.
For transfers to IMEM: the destination virtual IMEM page.

=== FALCON_DMATRF_POFF ===
For transfers to IMEM: the destination physical IMEM page.

=== FALCON_DMATRFCMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFCMD_FULL
|-
| 1
| FALCON_DMATRFCMD_IDLE
|-
| 2-3
| FALCON_DMATRFCMD_SEC
|-
| 4
| FALCON_DMATRFCMD_IMEM
|-
| 5
| FALCON_DMATRFCMD_WRITE
|-
| 8-10
| FALCON_DMATRFCMD_SIZE
|-
| 12-14
| FALCON_DMATRFCMD_CTXDMA
|}

Used for configuring DMA transfers.

=== FALCON_DMATRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFSTAT_PENDING
|-
| 16-18
| FALCON_DMATRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_DMATRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_CRYPTTRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| FALCON_CRYPTTRFSTAT_PENDING
|-
| 5
| FALCON_CRYPTTRFSTAT_ENABLED
|-
| 16-18
| FALCON_CRYPTTRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_CRYPTTRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_HWCFG2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_HWCFG2_VERSION
|-
| 4-5
| FALCON_HWCFG2_SCP_MODE
|-
| 6-7
| FALCON_HWCFG2_SUBVERSION
|-
| 8-11
| FALCON_HWCFG2_IMEM_PORTS
|-
| 12-15
| FALCON_HWCFG2_DMEM_PORTS
|-
| 16-19
| FALCON_HWCFG2_VM_PAGES_LOG2
|}

=== FALCON_ICD_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_ICD_CMD_OPC
0x0: BREAK
0x1: CONTINUE_FROM_PC
0x2: CONTINUE_FROM_ADDR
0x3: CONTINUE_UNK1_FROM_PC
0x4: CONTINUE_UNK1_FROM_ADDR
0x5: SINGLE_STEP_FROM_PC
0x6: SINGLE_STEP_FROM_ADDR
0x7: SET_BREAK_MASK
0x8: REG_READ
0x9: REG_WRITE
0xA: DATA_READ
0xB: DATA_WRITE
0xC: IO_READ
0xD: IO_WRITE
0xE: STATUS_READ
|-
| 6-7
| FALCON_ICD_CMD_DATA_SIZE
|-
| 8-12
| FALCON_ICD_CMD_IDX
|-
| 14
| FALCON_ICD_CMD_ERROR
|-
| 15
| FALCON_ICD_CMD_DONE
|-
| 16-31
| FALCON_ICD_CMD_BREAK_MASK
|}

=== FALCON_SCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| FALCON_SCTL_SEC_MODE
0: Non-secure
1: Light Secure
2: Heavy Secure
|-
| 4-5
| FALCON_SCTL_OLD_SEC_MODE
0: Non-secure
1: Light Secure
2: Heavy Secure
|-
| 12-13
| Unknown
|-
| 14
| Initialize the transition to LS mode
|}

=== TSEC_SCP_CTL_ACCESS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| Enable TSEC_SCP_INSN_STAT register
|}

=== TSEC_SCP_CTL_TRNG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 11
| Unknown
|-
| 12
| Enable the TRNG
|}

=== TSEC_SCP_CTL_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| TSEC_SCP_CTL_STAT_DEBUG_MODE
|}

=== TSEC_SCP_CTL_MODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Disable reads for the TRNG register block
|-
| 1
| Disable reads for the TFBIF register block
|-
| 2
| Disable reads for the DMA register block
|-
| 3
| Disable reads for the TEGRA register block
|-
| 4
| Disable writes for the TRNG register block
|-
| 5
| Disable writes for the TFBIF register block
|-
| 6
| Disable writes for the DMA register block
|-
| 7
| Disable writes for the TEGRA register block
|}

Controls accesses to the other sub-engines and can only be cleared in Heavy Secure mode.

=== TSEC_SCP_CTL_PKEY ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
|-
| 1
| TSEC_SCP_CTL_PKEY_LOADED
|}

=== TSEC_SCP_SEQ0_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 8-11
| Size of current cs0begin macro
|-
|}

=== TSEC_SCP_SEQ_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Set if crypto sequence recording (cs0begin/cs1begin) is active
|-
| 4-7
| Number of instructions left for the crypto sequence
|-
| 12-15
| Active crypto key register
|}

Contains information on the last crypto sequence (cs0 or cs1) executed.

=== TSEC_SCP_INSN_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Crypto fuc5 destination register or immediate value
|-
| 8-13
| Crypto fuc5 source register or immediate value
|-
| 20-24
| Crypto fuc5 operation
0x0: nop (fuc5 opcode 0x00)
0x1: cmov (fuc5 opcode 0x84)
0x2: cxsin (fuc5 opcode 0x88) or xdst (with cxset)
0x3: cxsout (fuc5 opcode 0x8C) or xdld (with cxset)
0x4: crnd (fuc5 opcode 0x90)
0x5: cs0begin (fuc5 opcode 0x94)
0x6: cs0exec (fuc5 opcode 0x98)
0x7: cs1begin (fuc5 opcode 0x9C)
0x8: cs1exec (fuc5 opcode 0xA0)
0x9: invalid (fuc5 opcode 0xA4)
0xA: cchmod (fuc5 opcode 0xA8)
0xB: cxor (fuc5 opcode 0xAC)
0xC: cadd (fuc5 opcode 0xB0)
0xD: cand (fuc5 opcode 0xB4)
0xE: crev (fuc5 opcode 0xB8)
0xF: cprecmac (fuc5 opcode 0xBC)
0x10: csecret (fuc5 opcode 0xC0)
0x11: ckeyreg (fuc5 opcode 0xC4)
0x12: ckexp (fuc5 opcode 0xC8)
0x13: ckrexp (fuc5 opcode 0xCC)
0x14: cenc (fuc5 opcode 0xD0)
0x15: cdec (fuc5 opcode 0xD4)
0x16: csigauth (fuc5 opcode 0xD8)
0x17: csigenc (fuc5 opcode 0xDC)
0x18: csigclr (fuc5 opcode 0xE0)
|-
| 28
| Unknown
|-
| 31
| Set if running in secure mode (cauth)
|}

Contains information on the last crypto instruction executed.

=== TSEC_SCP_AES_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-4
| First opcode
|-
| 5-9
| Second opcode
|-
| 15-16
| AES operation
0: Encryption
1: Decryption
2: Key expansion
3: Key reverse expansion
|}

Contains information on the last AES sequence executed.

=== TSEC_SCP_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQSTAT_TRNG
|-
| 8
| TSEC_SCP_IRQSTAT_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQSTAT_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQSTAT_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the status of crypto IRQs.

=== TSEC_SCP_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQMASK_TRNG
|-
| 8
| TSEC_SCP_IRQMASK_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQMASK_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQMASK_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the value of the mask for crypto IRQs.

=== TSEC_SCP_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Invalid instruction
|-
| 4
| Empty crypto sequence
|-
| 8
| Crypto sequence is too long
|-
| 12
| Crypto sequence was not finished
|-
| 16
| Invalid cauth signature (during csigenc, csigclr or csigunk)
|-
| 24
| Forbidden instruction
|}

Contains information on crypto errors generated by the [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT_INSN_ERROR]] IRQ.

=== TSEC_TFBIF_MCCIF_FIFOCTRL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
|-
| 1
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
|-
| 2
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
|-
| 3
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
|-
| 4
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
|-
| 5
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
|-
| 6
| TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
|-
| 7
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
|-
| 8
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE
|}

=== TSEC_MCCIF_FIFOCTRL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
|-
| 16-31
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT
|}

=== TSEC_TFBIF_UNK5 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.

=== TSEC_TFBIF_UNK6 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to (data_size << 4) before reading memory from the GPU UCODE carveout.

=== TSEC_DMA_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_DMA_CMD_READ
|-
| 1
| TSEC_DMA_CMD_WRITE
|-
| 4-7
| TSEC_DMA_CMD_UNK
|-
| 12
| TSEC_DMA_CMD_BUSY
|-
| 13
| TSEC_DMA_CMD_ERROR
|-
| 31
| TSEC_DMA_CMD_INIT
|}

A DMA read/write operation requires bits TSEC_DMA_CMD_INIT and TSEC_DMA_CMD_READ/TSEC_DMA_CMD_WRITE to be set in TSEC_DMA_CMD.

During the transfer, the TSEC_DMA_CMD_BUSY bit is set.

Accessing an invalid address causes bit TSEC_DMA_CMD_ERROR to be set.

=== TSEC_DMA_ADDR ===
Takes the address for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_VAL ===
Takes the value for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_UNK ===
Always 0xFFF.

=== TSEC_TEGRA_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 16
| TSEC_TEGRA_CTL_TKFI_KFUSE
|-
| 17
| TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
|-
| 24
| TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
|-
| 25
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
|-
| 26
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
|-
| 27
| TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C
|}

== SCP ==
Part of the information here (which hasn't made it into envytools documentation yet) was shared by [https://wiki.0x04.net/wiki/Marcin_Ko%C5%9Bcielnicki mwk] from reverse engineering falcon processors over the years.

=== Authenticated Mode ===
==== Entry ====
From non-secure mode, upon jumping to a page marked as secret, a secret fault occurs. This causes the CPU to verify the region specified in $cauth against the MAC loaded in $c6. If the comparison is successful, the valid bit (bit0) is set on all pages in the $cauth region, and $pc is set to the base of the $cauth region. If the comparsion fails, the CPU is halted.

==== Exit ====
The CPU automatically goes back to non-secure mode when returning back into non-secret pages. When this happens, the valid bit (bit0) in the TLB flags is cleared for all secret pages.

==== Implementation ====
Under certain circumstances, it is possible to observe [[#csigauth|csigauth]] being briefly written to [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]] as "csigauth $c4 $c6" while the opcodes in [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]] are set to "cxsin" and "csigauth", respectively.

Via [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]] it can be observed that a 3-sized macro sequence is loaded into cs0 during a secure mode transition.

=== Operations ===
{| class="wikitable" border="1"
! Opcode
! Name
! Operand0
! Operand1
! Operation
! Condition
|-
| 0 || nop || N/A || N/A || ||
|-
| 1 || mov || $cX || $cY || <code>$cX = $cY; ACL(X) = ACL(Y);</code> ||
|-
| 2 || sin || $cX || N/A || <code>$cX = read_stream(); ACL(X) = ???;</code> ||
|-
| 3 || sout || $cX || N/A || <code>write_stream($cX);</code> || ?
|-
| 4 || rnd || $cX || N/A || <code>$cX = read_trng(); ACL(X) = ???;</code> ||
|-
| 5 || s0begin || immX || N/A || <code>record_macro_for_N_instructions(0, immX);</code> ||
|-
| 6 || s0exec || immX || N/A || <code>execute_macro_N_times(0, immX);</code> ||
|-
| 7 || s1begin || immX || N/A || <code>record_macro_for_N_instructions(1, immX);</code> ||
|-
| 8 || s1exec || immX || N/A || <code>execute_macro_N_times(1, immX);</code> ||
|-
| 9 || <invalid> || || || ||
|-
| 0xA || chmod || $cX || immY || Complicated, see [[#ACL|ACL]]. ||
|-
| 0xB || xor || $cX || $cY || <code>$cX ^= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xC || add || $cX || immY || <code>$cX += immY;</code> || <code>(ACL(X) & 2)</code>
|-
| 0xD || and || $cX || $cY || <code>$cX &= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xE || rev || $cX || $cY || <code>$cX = endian_swap128($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0xF || gfmul || $cX || $cY || <code>$cX = gfmul($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 2)</code>
|-
| 0x10 || secret || $cX || immY || <code>$cX = load_secret(immY); ACL(X) = load_secret_acl(immY);</code> ||
|-
| 0x11 || keyreg || immX || N/A || <code>active_key_idx = immX;</code> ||
|-
| 0x12 || kexp || $cX || $cY || <code>$cX = aes_kexp($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0x13 || krexp || $cX || $cY || <code>$cX = aes_kexp_reverse($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0x14 || enc || $cX || $cY || <code>$cX = aes_enc(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 1) && (ACL(Y) & 2)</code>
|-
| 0x15 || dec || $cX || $cY || <code>$cX = aes_dec(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 1) && (ACL(Y) & 2)</code>
|-
| 0x16 || csigauth || $cX || $cY || <code>if (hash_verify($cX, $cY)) { has_sig = true; current_sig = $cX; }</code> || ?
|-
| 0x17 || csigclr || N/A || N/A || <code>has_sig = false;</code> ||
|-
| 0x18 || csigenc || $cX || $cY || <code>if (has_sig) $cX = aes_enc(current_sig, $cY);</code> || ?
|}

==== csigauth ====
<code>00000000: f5 3c XY d8 csigauth $cY $cX</code>

Takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret. This instruction does not work in secure mode.

==== csigclr ====
<code>00000000: f5 3c 00 e0 csigclr</code>

This instruction takes no operands and appears to clear the saved cauth signature used by the csigenc instruction.

==== cchmod ====
<code>00000000: f5 3c XY a8 cchmod $cY 0X</code> or <code>00000000: f5 3c XY a9 cchmod $cY 1X</code>

This instruction takes a crypto register and a 5 bit immediate value which represents the [[#ACL|ACL]] mask to set.

==== crnd ====
<code>00000000: f5 3c 0X 90 crnd $cX</code>

This instruction initializes a crypto register with random data.

Executing this instruction only succeeds if the TRNG is enabled for the SCP, which requires taking the following steps:
* Write 0x7FFF to TSEC_TRNG_CLKDIV.
* Write 0x3FF0000 to TSEC_TRNG_UNK0.
* Write 0xFF00 to TSEC_TRNG_UNK7.
* Write 0x1000 to [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]].

Otherwise it hangs forever.

=== ACL ===
{| class="wikitable" border="1"
! Bit
! Meaning
|-
| 0 || Secure key. Forced set if bit1 is set. Once cleared, cannot be set again.
|-
| 1 || Secure readable. Once cleared, cannot be set again.
|-
| 2 || Insecure key. Forced set if bit3 is set. Forced clear if bit0 is clear. Can be toggled back and forth.
|-
| 3 || Insecure readable. Forced clear if bit1 is clear. Can be toggled back and forth.
|-
| 4 || Insecure overwritable. Can be toggled back and forth.
|}

==== Initial values ====
On SCP boot, the ACL is 0x1F for all $cX.

Loading into $cX using xdst instruction sets ACL($cX) to 0x13 and 0x1F, for secure and insecure mode respectively.

Spilling a $cX to DMEM using xdld instruction is allowed if (ACL($cX) & 2) or (ACL($cX) & 8), for secure and insecure mode respectively.

Loading a secret into $cX sets a per-secret ACL, unconditionally.

=== cauth ===
$cauth is a special purpose register in the CPU.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7 || Start of region to authenticate (in 0x100 pages)
|-
| 8-15 || Unknown
|-
| 16 || Use secret xfers (?)
|-
| 17 || Region is encrypted (?)
|-
| 18 || Unknown
|-
| 19 || Unknown
|-
| 20-23 || Unknown
|-
| 24-31 || Size of region to authenticate (in 0x100 pages), must be >= 4
|}

=== cxset ===
cxset instruction provides a way to change behavior of a variable amount of successively executed DMA-related instructions.

for example: <code>000000de: f4 3c 02 cxset 0x2</code>

can be read as: <code>dma_override(type=crypto_reg, count=2)</code>

The argument to cxset specifies the type of behavior change in the top 3 bits, and the number of DMA-related instructions the effect lasts for in the lower 5 bits.

{| class=wikitable
! Bits || Description
|-
| 0-4 || Number of instructions it is valid for (0x1f is a special value meaning infinitely many instructions -- until overriden by another cxset)
|-
| 5 || Crypto destination/source select (0=crypto register, 1=crypto stream)
|-
| 6 || External memory override (0=Disabled, 1=Enabled)
|-
| 7 || Internal memory select (0=DMEM, 1=IMEM)
|}

==== DMA-Related Instructions ====
At least the following instructions may have changed behavior, and count against the cxset "count" argument: <code>xdwait</code>, <code>xdst</code>, <code>xdld</code>.

For example, if override type=0b000, then the "length" argument to <code>xdst</code> is instead treated as the index of the target $cX register.

=== Secrets ===
Falcon's Authenticated Mode has access to 64 128-bit keys which are burned at factory. These keys can be loaded by using the $csecret instruction which takes the target crypto register and the key index as arguments.

{| class=wikitable
! Index || ACL || Console-unique || Notes
|-
| 0x00 || 0x13 || No || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares.
|-
| 0x01 || 0x10 || No || Used by nvhost_nvdec_bl020_prod firmware.
|-
| 0x02 || 0x10 || No ||
|-
| 0x03 || 0x11 || No || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|-
| 0x04 || 0x10 || No || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|-
| 0x05 || 0x13 || No || Used by nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares.
|-
| 0x06 || 0x11 || No ||
|-
| 0x07 || 0x11 || No || Used by [6.0.0+] nvhost_tsec firmware.
|-
| 0x08 || 0x10 || No ||
|-
| 0x09 || 0x13 || No || Used by nvhost_tsec firmware.
|-
| 0x0A || 0x11 || No ||
|-
| 0x0B || 0x10 || No || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|-
| 0x0C || 0x13 || No ||
|-
| 0x0D || 0x11 || No ||
|-
| 0x0E || 0x10 || No ||
|-
| 0x0F || 0x13 || No || Used by nvhost_tsec firmware.
|-
| 0x10 || 0x11 || No || Used by [1.0.0-5.1.0] nvhost_tsec firmware.
|-
| 0x11 || 0x10 || No ||
|-
| 0x12 || 0x13 || No ||
|-
| 0x13 || 0x11 || No ||
|-
| 0x14 || 0x10 || No ||
|-
| 0x15 || 0x13 || No || Used by nvhost_nvdec_bl020_prod, [5.0.0+] nvhost_nvdec020_prod, [5.0.0+] nvhost_nvdec020_ns and [6.0.0+] nvhost_tsec firmwares.
|-
| 0x16 || 0x11 || No ||
|-
| 0x17 || 0x10 || No ||
|-
| 0x18 || 0x13 || No ||
|-
| 0x19 || 0x11 || No ||
|-
| 0x1A || 0x10 || No ||
|-
| 0x1B || 0x13 || No ||
|-
| 0x1C || 0x11 || No ||
|-
| 0x1D || 0x10 || No ||
|-
| 0x1E || 0x13 || No ||
|-
| 0x1F || 0x11 || No ||
|-
| 0x20 || 0x10 || No ||
|-
| 0x21 || 0x13 || No ||
|-
| 0x22 || 0x11 || No ||
|-
| 0x23 || 0x10 || No ||
|-
| 0x24 || 0x13 || No ||
|-
| 0x25 || 0x11 || No ||
|-
| 0x26 || 0x10 || No || Used by [[TSEC_Firmware#KeygenLdr|KeygenLdr]].
|-
| 0x27 || 0x13 || No ||
|-
| 0x28 || 0x11 || No ||
|-
| 0x29 || 0x10 || No ||
|-
| 0x2A || 0x13 || No ||
|-
| 0x2B || 0x11 || No ||
|-
| 0x2C || 0x10 || No ||
|-
| 0x2D || 0x13 || No ||
|-
| 0x2E || 0x11 || No ||
|-
| 0x2F || 0x10 || No ||
|-
| 0x30 || 0x13 || No ||
|-
| 0x31 || 0x11 || No ||
|-
| 0x32 || 0x10 || No ||
|-
| 0x33 || 0x13 || No ||
|-
| 0x34 || 0x11 || No ||
|-
| 0x35 || 0x10 || No ||
|-
| 0x36 || 0x13 || No ||
|-
| 0x37 || 0x11 || No ||
|-
| 0x38 || 0x10 || No ||
|-
| 0x39 || 0x13 || No ||
|-
| 0x3A || 0x11 || No ||
|-
| 0x3B || 0x10 || No ||
|-
| 0x3C || 0x13 || No || Used by nvhost_tsec firmware.
|-
| 0x3D || 0x11 || No ||
|-
| 0x3E || 0x10 || No ||
|-
| 0x3F || 0x10 || Yes || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|}

TSEC

2019-01-09T21:05:13Z

Qlutoo: /* Secrets */

TSEC (Tegra Security Co-processor) is a dedicated unit powered by a NVIDIA Falcon microprocessor with crypto extensions.

= Driver =
A host driver for communicating with the TSEC is mapped to physical address 0x54500000 with a total size of 0x40000 bytes and exposes several registers.

== Registers ==
Registers from 0x54500000 to 0x54501000 are used to configure the host interface (HOST1X).

Registers from 0x54501000 to 0x54502000 are a MMIO window for communicating with the Falcon microprocessor. From this range, the subset of registers from 0x54501400 to 0x54501FE8 are specific to the TSEC and are subdivided into:
* 0x54501400 to 0x54501500: SCP (Secure Crypto Processor?).
* 0x54501500 to 0x54501600: TRNG (True Random Number Generator).
* 0x54501600 to 0x54501700: TFBIF (Tegra Framebuffer Interface).
* 0x54501700 to 0x54501800: DMA.
* 0x54501800 to 0x54501900: TEGRA (miscellaneous interfaces).

{| class="wikitable" border="1"
! Name
! Address
! Width
|-
| TSEC_THI_INCR_SYNCPT
| 0x54500000
| 0x04
|-
| TSEC_THI_INCR_SYNCPT_ERR
| 0x54500008
| 0x04
|-
| TSEC_THI_CTXSW_INCR_SYNCPT
| 0x5450000C
| 0x04
|-
| TSEC_THI_CTXSW
| 0x54500020
| 0x04
|-
| TSEC_THI_CONT_SYNCPT_EOF
| 0x54500028
| 0x04
|-
| [[#TSEC_THI_METHOD0|TSEC_THI_METHOD0]]
| 0x54500040
| 0x04
|-
| [[#TSEC_THI_METHOD1|TSEC_THI_METHOD1]]
| 0x54500044
| 0x04
|-
| [[#TSEC_THI_INT_STATUS|TSEC_THI_INT_STATUS]]
| 0x54500078
| 0x04
|-
| [[#TSEC_THI_INT_MASK|TSEC_THI_INT_MASK]]
| 0x5450007C
| 0x04
|-
| TSEC_THI_SLCG_STATUS
| 0x54500084
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_HIGH_A
| 0x54500088
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_LOW_A
| 0x5450008C
| 0x04
|-
| TSEC_THI_CLK_OVERRIDE
| 0x54500E00
| 0x04
|-
| [[#FALCON_IRQSSET|FALCON_IRQSSET]]
| 0x54501000
| 0x04
|-
| [[#FALCON_IRQSCLR|FALCON_IRQSCLR]]
| 0x54501004
| 0x04
|-
| [[#FALCON_IRQSTAT|FALCON_IRQSTAT]]
| 0x54501008
| 0x04
|-
| [[#FALCON_IRQMODE|FALCON_IRQMODE]]
| 0x5450100C
| 0x04
|-
| [[#FALCON_IRQMSET|FALCON_IRQMSET]]
| 0x54501010
| 0x04
|-
| [[#FALCON_IRQMCLR|FALCON_IRQMCLR]]
| 0x54501014
| 0x04
|-
| [[#FALCON_IRQMASK|FALCON_IRQMASK]]
| 0x54501018
| 0x04
|-
| [[#FALCON_IRQDEST|FALCON_IRQDEST]]
| 0x5450101C
| 0x04
|-
| FALCON_GPTMR_PERIOD
| 0x54501020
| 0x04
|-
| FALCON_GPTMR_TIME
| 0x54501024
| 0x04
|-
| FALCON_GPTMR_ENABLE
| 0x54501028
| 0x04
|-
| FALCON_TIME_LOW
| 0x5450102C
| 0x04
|-
| FALCON_TIME_HIGH
| 0x54501030
| 0x04
|-
| FALCON_WDTMR_TIME
| 0x54501034
| 0x04
|-
| FALCON_WDTMR_ENABLE
| 0x54501038
| 0x04
|-
| [[#FALCON_SCRATCH0|FALCON_SCRATCH0]]
| 0x54501040
| 0x04
|-
| [[#FALCON_SCRATCH1|FALCON_SCRATCH1]]
| 0x54501044
| 0x04
|-
| [[#FALCON_ITFEN|FALCON_ITFEN]]
| 0x54501048
| 0x04
|-
| [[#FALCON_IDLESTATE|FALCON_IDLESTATE]]
| 0x5450104C
| 0x04
|-
| FALCON_CURCTX
| 0x54501050
| 0x04
|-
| FALCON_NXTCTX
| 0x54501054
| 0x04
|-
| FALCON_CMDCTX
| 0x54501058
| 0x04
|-
| FALCON_STATUS_MASK
| 0x5450105C
| 0x04
|-
| FALCON_VM_SUPERVISOR
| 0x54501060
| 0x04
|-
| FALCON_MTHD_DATA
| 0x54501064
| 0x04
|-
| FALCON_MTHD_CMD
| 0x54501068
| 0x04
|-
| FALCON_MTHD_DATA_WR
| 0x5450106C
| 0x04
|-
| FALCON_MTHD_OCCUPIED
| 0x54501070
| 0x04
|-
| FALCON_MTHD_ACK
| 0x54501074
| 0x04
|-
| FALCON_MTHD_LIMIT
| 0x54501078
| 0x04
|-
| FALCON_SUBENGINE_RESET
| 0x5450107C
| 0x04
|-
| FALCON_SCRATCH2
| 0x54501080
| 0x04
|-
| FALCON_SCRATCH3
| 0x54501084
| 0x04
|-
| FALCON_PM_TRIGGER
| 0x54501088
| 0x04
|-
| FALCON_PM_MODE
| 0x5450108C
| 0x04
|-
| FALCON_DEBUG1
| 0x54501090
| 0x04
|-
| [[#FALCON_DEBUGINFO|FALCON_DEBUGINFO]]
| 0x54501094
| 0x04
|-
| FALCON_BREAKPOINT0
| 0x54501098
| 0x04
|-
| FALCON_BREAKPOINT1
| 0x5450109C
| 0x04
|-
| FALCON_CGCTL
| 0x545010A0
| 0x04
|-
| FALCON_ENGCTL
| 0x545010A4
| 0x04
|-
| FALCON_PM_SEL
| 0x545010A8
| 0x04
|-
| FALCON_HOST_IO_INDEX
| 0x545010AC
| 0x04
|-
| [[#FALCON_EXCI|FALCON_EXCI]]
| 0x545010D0
| 0x04
|-
| [[#FALCON_CPUCTL|FALCON_CPUCTL]]
| 0x54501100
| 0x04
|-
| [[#FALCON_BOOTVEC|FALCON_BOOTVEC]]
| 0x54501104
| 0x04
|-
| [[#FALCON_HWCFG|FALCON_HWCFG]]
| 0x54501108
| 0x04
|-
| [[#FALCON_DMACTL|FALCON_DMACTL]]
| 0x5450110C
| 0x04
|-
| [[#FALCON_DMATRF_EXTBASE|FALCON_DMATRF_EXTBASE]]
| 0x54501110
| 0x04
|-
| [[#FALCON_DMATRF_VOFF|FALCON_DMATRF_VOFF]]
| 0x54501114
| 0x04
|-
| [[#FALCON_DMATRFCMD|FALCON_DMATRFCMD]]
| 0x54501118
| 0x04
|-
| [[#FALCON_DMATRF_POFF|FALCON_DMATRF_POFF]]
| 0x5450111C
| 0x04
|-
| [[#FALCON_DMATRFSTAT|FALCON_DMATRFSTAT]]
| 0x54501120
| 0x04
|-
| [[#FALCON_CRYPTTRFSTAT|FALCON_CRYPTTRFSTAT]]
| 0x54501124
| 0x04
|-
| FALCON_CPUSTAT
| 0x54501128
| 0x04
|-
| [[#FALCON_HWCFG2|FALCON_HWCFG2]]
| 0x5450112C
| 0x04
|-
| FALCON_CPUCTL_ALIAS
| 0x54501130
| 0x04
|-
| FALCON_TLB_CMD
| 0x54501140
| 0x04
|-
| FALCON_TLB_CMD_RES
| 0x54501144
| 0x04
|-
| FALCON_BRANCH_HISTORY_CTRL
| 0x54501148
| 0x04
|-
| FALCON_BRANCH_HISTORY_PC
| 0x5450114C
| 0x04
|-
| FALCON_IMFILLRNG0
| 0x54501150
| 0x04
|-
| FALCON_IMFILLRNG1
| 0x54501154
| 0x04
|-
| FALCON_IMFILLCTL
| 0x54501158
| 0x04
|-
| FALCON_EXTERRWIN
| 0x54501160
| 0x04
|-
| FALCON_EXTERRCFG
| 0x54501164
| 0x04
|-
| FALCON_EXTERRADDR
| 0x54501168
| 0x04
|-
| FALCON_EXTERRSTAT
| 0x5450116C
| 0x04
|-
| FALCON_CG2
| 0x5450117C
| 0x04
|-
| FALCON_CODE_INDEX
| 0x54501180
| 0x04
|-
| FALCON_CODE
| 0x54501184
| 0x04
|-
| FALCON_CODE_VIRT_ADDR
| 0x54501188
| 0x04
|-
| FALCON_DATA_INDEX0
| 0x545011C0
| 0x04
|-
| FALCON_DATA0
| 0x545011C4
| 0x04
|-
| FALCON_DATA_INDEX1
| 0x545011C8
| 0x04
|-
| FALCON_DATA1
| 0x545011CC
| 0x04
|-
| FALCON_DATA_INDEX2
| 0x545011D0
| 0x04
|-
| FALCON_DATA2
| 0x545011D4
| 0x04
|-
| FALCON_DATA_INDEX3
| 0x545011D8
| 0x04
|-
| FALCON_DATA3
| 0x545011DC
| 0x04
|-
| FALCON_DATA_INDEX4
| 0x545011E0
| 0x04
|-
| FALCON_DATA4
| 0x545011E4
| 0x04
|-
| FALCON_DATA_INDEX5
| 0x545011E8
| 0x04
|-
| FALCON_DATA5
| 0x545011EC
| 0x04
|-
| FALCON_DATA_INDEX6
| 0x545011F0
| 0x04
|-
| FALCON_DATA6
| 0x545011F4
| 0x04
|-
| FALCON_DATA_INDEX7
| 0x545011F8
| 0x04
|-
| FALCON_DATA7
| 0x545011FC
| 0x04
|-
| [[#FALCON_ICD_CMD|FALCON_ICD_CMD]]
| 0x54501200
| 0x04
|-
| FALCON_ICD_ADDR
| 0x54501204
| 0x04
|-
| FALCON_ICD_WDATA
| 0x54501208
| 0x04
|-
| FALCON_ICD_RDATA
| 0x5450120C
| 0x04
|-
| [[#FALCON_SCTL|FALCON_SCTL]]
| 0x54501240
| 0x04
|-
| [[#TSEC_SCP_CTL_ACCESS|TSEC_SCP_CTL_ACCESS]]
| 0x54501400
| 0x04
|-
| [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]]
| 0x54501404
| 0x04
|-
| [[#TSEC_SCP_CTL_STAT|TSEC_SCP_CTL_STAT]]
| 0x54501408
| 0x04
|-
| [[#TSEC_SCP_CTL_MODE|TSEC_SCP_CTL_MODE]]
| 0x5450140C
| 0x04
|-
| TSEC_SCP_UNK0
| 0x54501410
| 0x04
|-
| [[#TSEC_SCP_CTL_PKEY|TSEC_SCP_CTL_PKEY]]
| 0x54501418
| 0x04
|-
| [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]]
| 0x54501420
| 0x04
|-
| [[#TSEC_SCP_SEQ_STAT|TSEC_SCP_SEQ_STAT]]
| 0x54501428
| 0x04
|-
| [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]]
| 0x54501430
| 0x04
|-
| TSEC_SCP_UNK2
| 0x54501454
| 0x04
|-
| [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]]
| 0x54501458
| 0x04
|-
| TSEC_SCP_UNK3
| 0x54501470
| 0x04
|-
| [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT]]
| 0x54501480
| 0x04
|-
| [[#TSEC_SCP_IRQMASK|TSEC_SCP_IRQMASK]]
| 0x54501484
| 0x04
|-
| TSEC_SCP_UNK4
| 0x54501490
| 0x04
|-
| [[#TSEC_SCP_ERR|TSEC_SCP_ERR]]
| 0x54501498
| 0x04
|-
| TSEC_TRNG_CLKDIV
| 0x54501500
| 0x04
|-
| TSEC_TRNG_UNK0
| 0x54501504
| 0x04
|-
| TSEC_TRNG_UNK1
| 0x5450150C
| 0x04
|-
| TSEC_TRNG_UNK2
| 0x54501510
| 0x04
|-
| TSEC_TRNG_UNK3
| 0x54501514
| 0x04
|-
| TSEC_TRNG_UNK4
| 0x54501518
| 0x04
|-
| TSEC_TRNG_UNK5
| 0x5450151C
| 0x04
|-
| TSEC_TRNG_UNK6
| 0x54501528
| 0x04
|-
| TSEC_TRNG_UNK7
| 0x5450152C
| 0x04
|-
| TSEC_TFBIF_UNK0
| 0x54501600
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL|TSEC_TFBIF_MCCIF_FIFOCTRL]]
| 0x54501604
| 0x04
|-
| TSEC_TFBIF_UNK1
| 0x54501608
| 0x04
|-
| TSEC_TFBIF_UNK2
| 0x5450160C
| 0x04
|-
| TSEC_TFBIF_UNK3
| 0x54501630
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL1|TSEC_TFBIF_MCCIF_FIFOCTRL1]]
| 0x54501634
| 0x04
|-
| TSEC_TFBIF_UNK4
| 0x54501640
| 0x04
|-
| [[#TSEC_TFBIF_UNK5|TSEC_TFBIF_UNK5]]
| 0x54501644
| 0x04
|-
| [[#TSEC_TFBIF_UNK6|TSEC_TFBIF_UNK6]]
| 0x54501648
| 0x04
|-
| [[#TSEC_DMA_CMD|TSEC_DMA_CMD]]
| 0x54501700
| 0x04
|-
| [[#TSEC_DMA_ADDR|TSEC_DMA_ADDR]]
| 0x54501704
| 0x04
|-
| [[#TSEC_DMA_VAL|TSEC_DMA_VAL]]
| 0x54501708
| 0x04
|-
| [[#TSEC_DMA_UNK|TSEC_DMA_UNK]]
| 0x5450170C
| 0x04
|-
| TSEC_TEGRA_FALCON_IP_VER
| 0x54501800
| 0x04
|-
| TSEC_TEGRA_UNK0
| 0x54501824
| 0x04
|-
| TSEC_TEGRA_UNK1
| 0x54501828
| 0x04
|-
| TSEC_TEGRA_UNK2
| 0x5450182C
| 0x04
|-
| [[#TSEC_TEGRA_CTL|TSEC_TEGRA_CTL]]
| 0x54501838
| 0x04
|}

=== TSEC_THI_METHOD0 ===
{| class="wikitable" border="1"
! ID
! Method
|-
| 0x200
| SET_APPLICATION_ID
|-
| 0x300
| EXECUTE
|-
| 0x500
| HDCP_INIT
|-
| 0x504
| HDCP_CREATE_SESSION
|-
| 0x508
| HDCP_VERIFY_CERT_RX
|-
| 0x50C
| HDCP_GENERATE_EKM
|-
| 0x510
| HDCP_REVOCATION_CHECK
|-
| 0x514
| HDCP_VERIFY_HPRIME
|-
| 0x518
| HDCP_ENCRYPT_PAIRING_INFO
|-
| 0x51C
| HDCP_DECRYPT_PAIRING_INFO
|-
| 0x520
| HDCP_UPDATE_SESSION
|-
| 0x524
| HDCP_GENERATE_LC_INIT
|-
| 0x528
| HDCP_VERIFY_LPRIME
|-
| 0x52C
| HDCP_GENERATE_SKE_INIT
|-
| 0x530
| HDCP_VERIFY_VPRIME
|-
| 0x534
| HDCP_ENCRYPTION_RUN_CTRL
|-
| 0x538
| HDCP_SESSION_CTRL
|-
| 0x53C
| HDCP_COMPUTE_SPRIME
|-
| 0x540
| HDCP_GET_CERT_RX
|-
| 0x544
| HDCP_EXCHANGE_INFO
|-
| 0x548
| HDCP_DECRYPT_KM
|-
| 0x54C
| HDCP_GET_HPRIME
|-
| 0x550
| HDCP_GENERATE_EKH_KM
|-
| 0x554
| HDCP_VERIFY_RTT_CHALLENGE
|-
| 0x558
| HDCP_GET_LPRIME
|-
| 0x55C
| HDCP_DECRYPT_KS
|-
| 0x560
| HDCP_DECRYPT
|-
| 0x564
| HDCP_GET_RRX
|-
| 0x568
| HDCP_DECRYPT_REENCRYPT
|-
| 0x56C
|
|-
| 0x570
|
|-
| 0x574
|
|-
| 0x578
|
|-
| 0x57C
|
|-
| 0x700
| HDCP_VALIDATE_SRM
|-
| 0x704
| HDCP_VALIDATE_STREAM
|-
| 0x708
| HDCP_TEST_SECURE_STATUS
|-
| 0x70C
| HDCP_SET_DCP_KPUB
|-
| 0x710
| HDCP_SET_RX_KPUB
|-
| 0x714
| HDCP_SET_CERT_RX
|-
| 0x718
| HDCP_SET_SCRATCH_BUFFER
|-
| 0x71C
| HDCP_SET_SRM
|-
| 0x720
| HDCP_SET_RECEIVER_ID_LIST
|-
| 0x724
| HDCP_SET_SPRIME
|-
| 0x728
| HDCP_SET_ENC_INPUT_BUFFER
|-
| 0x72C
| HDCP_SET_ENC_OUTPUT_BUFFER
|-
| 0x730
| HDCP_GET_RTT_CHALLENGE
|-
| 0x734
| HDCP_STREAM_MANAGE
|-
| 0x738
| HDCP_READ_CAPS
|-
| 0x73C
| HDCP_ENCRYPT
|-
| 0x740
| [6.0.0+] HDCP_GET_CURRENT_NONCE
|}

Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_METHOD1 ===
Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_INT_STATUS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_STATUS_FALCON_INT
|}

=== TSEC_THI_INT_MASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_MASK_FALCON_INT
|}

=== FALCON_IRQSSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSSET_GPTMR
|-
| 1
| FALCON_IRQSSET_WDTMR
|-
| 2
| FALCON_IRQSSET_MTHD
|-
| 3
| FALCON_IRQSSET_CTXSW
|-
| 4
| FALCON_IRQSSET_HALT
|-
| 5
| FALCON_IRQSSET_EXTERR
|-
| 6
| FALCON_IRQSSET_SWGEN0
|-
| 7
| FALCON_IRQSSET_SWGEN1
|-
| 8-15
| FALCON_IRQSSET_EXT
|}

Used for setting Falcon's IRQs.

=== FALCON_IRQSCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSCLR_GPTMR
|-
| 1
| FALCON_IRQSCLR_WDTMR
|-
| 2
| FALCON_IRQSCLR_MTHD
|-
| 3
| FALCON_IRQSCLR_CTXSW
|-
| 4
| FALCON_IRQSCLR_HALT
|-
| 5
| FALCON_IRQSCLR_EXTERR
|-
| 6
| FALCON_IRQSCLR_SWGEN0
|-
| 7
| FALCON_IRQSCLR_SWGEN1
|-
| 8-15
| FALCON_IRQSCLR_EXT
|}

Used for clearing Falcon's IRQs.

=== FALCON_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSTAT_GPTMR
|-
| 1
| FALCON_IRQSTAT_WDTMR
|-
| 2
| FALCON_IRQSTAT_MTHD
|-
| 3
| FALCON_IRQSTAT_CTXSW
|-
| 4
| FALCON_IRQSTAT_HALT
|-
| 5
| FALCON_IRQSTAT_EXTERR
|-
| 6
| FALCON_IRQSTAT_SWGEN0
|-
| 7
| FALCON_IRQSTAT_SWGEN1
|-
| 8-15
| FALCON_IRQSTAT_EXT
|}

Used for getting the status of Falcon's IRQs.

=== FALCON_IRQMODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMODE_GPTMR
|-
| 1
| FALCON_IRQMODE_WDTMR
|-
| 2
| FALCON_IRQMODE_MTHD
|-
| 3
| FALCON_IRQMODE_CTXSW
|-
| 4
| FALCON_IRQMODE_HALT
|-
| 5
| FALCON_IRQMODE_EXTERR
|-
| 6
| FALCON_IRQMODE_SWGEN0
|-
| 7
| FALCON_IRQMODE_SWGEN1
|-
| 8-15
| FALCON_IRQMODE_EXT
|}

Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.

=== FALCON_IRQMSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMSET_GPTMR
|-
| 1
| FALCON_IRQMSET_WDTMR
|-
| 2
| FALCON_IRQMSET_MTHD
|-
| 3
| FALCON_IRQMSET_CTXSW
|-
| 4
| FALCON_IRQMSET_HALT
|-
| 5
| FALCON_IRQMSET_EXTERR
|-
| 6
| FALCON_IRQMSET_SWGEN0
|-
| 7
| FALCON_IRQMSET_SWGEN1
|-
| 8-15
| FALCON_IRQMSET_EXT
|}

Used for setting the mask for Falcon's IRQs.

=== FALCON_IRQMCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMCLR_GPTMR
|-
| 1
| FALCON_IRQMCLR_WDTMR
|-
| 2
| FALCON_IRQMCLR_MTHD
|-
| 3
| FALCON_IRQMCLR_CTXSW
|-
| 4
| FALCON_IRQMCLR_HALT
|-
| 5
| FALCON_IRQMCLR_EXTERR
|-
| 6
| FALCON_IRQMCLR_SWGEN0
|-
| 7
| FALCON_IRQMCLR_SWGEN1
|-
| 8-15
| FALCON_IRQMCLR_EXT
|}

Used for clearing the mask for Falcon's IRQs.

=== FALCON_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMASK_GPTMR
|-
| 1
| FALCON_IRQMASK_WDTMR
|-
| 2
| FALCON_IRQMASK_MTHD
|-
| 3
| FALCON_IRQMASK_CTXSW
|-
| 4
| FALCON_IRQMASK_HALT
|-
| 5
| FALCON_IRQMASK_EXTERR
|-
| 6
| FALCON_IRQMASK_SWGEN0
|-
| 7
| FALCON_IRQMASK_SWGEN1
|-
| 8-15
| FALCON_IRQMASK_EXT
|}

Used for getting the value of the mask for Falcon's IRQs.

=== FALCON_IRQDEST ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQDEST_HOST_GPTMR
|-
| 1
| FALCON_IRQDEST_HOST_WDTMR
|-
| 2
| FALCON_IRQDEST_HOST_MTHD
|-
| 3
| FALCON_IRQDEST_HOST_CTXSW
|-
| 4
| FALCON_IRQDEST_HOST_HALT
|-
| 5
| FALCON_IRQDEST_HOST_EXTERR
|-
| 6
| FALCON_IRQDEST_HOST_SWGEN0
|-
| 7
| FALCON_IRQDEST_HOST_SWGEN1
|-
| 8-15
| FALCON_IRQDEST_HOST_EXT
|-
| 16
| FALCON_IRQDEST_TARGET_GPTMR
|-
| 17
| FALCON_IRQDEST_TARGET_WDTMR
|-
| 18
| FALCON_IRQDEST_TARGET_MTHD
|-
| 19
| FALCON_IRQDEST_TARGET_CTXSW
|-
| 20
| FALCON_IRQDEST_TARGET_HALT
|-
| 21
| FALCON_IRQDEST_TARGET_EXTERR
|-
| 22
| FALCON_IRQDEST_TARGET_SWGEN0
|-
| 23
| FALCON_IRQDEST_TARGET_SWGEN1
|-
| 24-31
| FALCON_IRQDEST_TARGET_EXT
|}

Used for routing Falcon's IRQs.

=== FALCON_SCRATCH0 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_SCRATCH1 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_ITFEN ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_ITFEN_CTXEN
|-
| 1
| FALCON_ITFEN_MTHDEN
|}

Used for enabling/disabling Falcon interfaces.

=== FALCON_IDLESTATE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IDLESTATE_FALCON_BUSY
|-
| 1-15
| FALCON_IDLESTATE_EXT_BUSY
|}

Used for detecting if Falcon is busy or not.

=== FALCON_DEBUGINFO ===
Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.

[6.0.0+] [[NV_services|nvservices]] sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.

=== FALCON_EXCI ===
Contains information about raised exceptions.

=== FALCON_CPUCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_CPUCTL_IINVAL
|-
| 1
| FALCON_CPUCTL_STARTCPU
|-
| 2
| FALCON_CPUCTL_SRESET
|-
| 3
| FALCON_CPUCTL_HRESET
|-
| 4
| FALCON_CPUCTL_HALTED
|-
| 5
| FALCON_CPUCTL_STOPPED
|-
| 6
| FALCON_CPUCTL_START_SCP_LS
|}

Used for signaling the Falcon CPU.

=== FALCON_BOOTVEC ===
Takes the Falcon's boot vector address.

=== FALCON_HWCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-8
| FALCON_HWCFG_IMEM_SIZE
|-
| 9-17
| FALCON_HWCFG_DMEM_SIZE
|-
| 18-25
| FALCON_HWCFG_MTHD_SIZE
|-
| 26-31
| FALCON_HWCFG_DMATRF_SLOTS
|}

=== FALCON_DMACTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMACTL_REQUIRE_CTX
|-
| 1
| FALCON_DMACTL_DMEM_SCRUBBING
|-
| 2
| FALCON_DMACTL_IMEM_SCRUBBING
|-
| 3-6
| FALCON_DMACTL_DMAQ_NUM
|-
| 7
| FALCON_DMACTL_SECURE_STAT
|}

Used for configuring the Falcon's DMA engine.

=== FALCON_DMATRF_EXTBASE ===
Base of the external memory buffer.

The base of the transfer is calculated by adding [[#FALCON_DMATRF_POFF]] to the base.

=== FALCON_DMATRF_VOFF ===
For transfers to DMEM: the destination address.
For transfers to IMEM: the destination virtual IMEM page.

=== FALCON_DMATRF_POFF ===
For transfers to IMEM: the destination physical IMEM page.

=== FALCON_DMATRFCMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFCMD_FULL
|-
| 1
| FALCON_DMATRFCMD_IDLE
|-
| 2-3
| FALCON_DMATRFCMD_SEC
|-
| 4
| FALCON_DMATRFCMD_IMEM
|-
| 5
| FALCON_DMATRFCMD_WRITE
|-
| 8-10
| FALCON_DMATRFCMD_SIZE
|-
| 12-14
| FALCON_DMATRFCMD_CTXDMA
|}

Used for configuring DMA transfers.

=== FALCON_DMATRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFSTAT_PENDING
|-
| 16-18
| FALCON_DMATRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_DMATRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_CRYPTTRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| FALCON_CRYPTTRFSTAT_PENDING
|-
| 5
| FALCON_CRYPTTRFSTAT_ENABLED
|-
| 16-18
| FALCON_CRYPTTRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_CRYPTTRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_HWCFG2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_HWCFG2_VERSION
|-
| 4-5
| FALCON_HWCFG2_SCP_MODE
|-
| 6-7
| FALCON_HWCFG2_SUBVERSION
|-
| 8-11
| FALCON_HWCFG2_IMEM_PORTS
|-
| 12-15
| FALCON_HWCFG2_DMEM_PORTS
|-
| 16-19
| FALCON_HWCFG2_VM_PAGES_LOG2
|}

=== FALCON_ICD_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_ICD_CMD_OPC
0x0: BREAK
0x1: CONTINUE_FROM_PC
0x2: CONTINUE_FROM_ADDR
0x3: CONTINUE_UNK1_FROM_PC
0x4: CONTINUE_UNK1_FROM_ADDR
0x5: SINGLE_STEP_FROM_PC
0x6: SINGLE_STEP_FROM_ADDR
0x7: SET_BREAK_MASK
0x8: REG_READ
0x9: REG_WRITE
0xA: DATA_READ
0xB: DATA_WRITE
0xC: IO_READ
0xD: IO_WRITE
0xE: STATUS_READ
|-
| 6-7
| FALCON_ICD_CMD_DATA_SIZE
|-
| 8-12
| FALCON_ICD_CMD_IDX
|-
| 14
| FALCON_ICD_CMD_ERROR
|-
| 15
| FALCON_ICD_CMD_DONE
|-
| 16-31
| FALCON_ICD_CMD_BREAK_MASK
|}

=== FALCON_SCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| FALCON_SCTL_SEC_MODE
0: Non-secure
1: Light Secure
2: Heavy Secure
|-
| 4-5
| FALCON_SCTL_OLD_SEC_MODE
0: Non-secure
1: Light Secure
2: Heavy Secure
|-
| 12-13
| Unknown
|-
| 14
| Initialize the transition to LS mode
|}

=== TSEC_SCP_CTL_ACCESS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| Enable TSEC_SCP_INSN_STAT register
|}

=== TSEC_SCP_CTL_TRNG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 11
| Unknown
|-
| 12
| Enable the TRNG
|}

=== TSEC_SCP_CTL_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| TSEC_SCP_CTL_STAT_DEBUG_MODE
|}

=== TSEC_SCP_CTL_MODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Disable reads for the TRNG register block
|-
| 1
| Disable reads for the TFBIF register block
|-
| 2
| Disable reads for the DMA register block
|-
| 3
| Disable reads for the TEGRA register block
|-
| 4
| Disable writes for the TRNG register block
|-
| 5
| Disable writes for the TFBIF register block
|-
| 6
| Disable writes for the DMA register block
|-
| 7
| Disable writes for the TEGRA register block
|}

Controls accesses to the other sub-engines and can only be cleared in Heavy Secure mode.

=== TSEC_SCP_CTL_PKEY ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
|-
| 1
| TSEC_SCP_CTL_PKEY_LOADED
|}

=== TSEC_SCP_SEQ0_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 8-11
| Size of current cs0begin macro
|-
|}

=== TSEC_SCP_SEQ_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Set if crypto sequence recording (cs0begin/cs1begin) is active
|-
| 4-7
| Number of instructions left for the crypto sequence
|-
| 12-15
| Active crypto key register
|}

Contains information on the last crypto sequence (cs0 or cs1) executed.

=== TSEC_SCP_INSN_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Crypto fuc5 destination register or immediate value
|-
| 8-13
| Crypto fuc5 source register or immediate value
|-
| 20-24
| Crypto fuc5 operation
0x0: nop (fuc5 opcode 0x00)
0x1: cmov (fuc5 opcode 0x84)
0x2: cxsin (fuc5 opcode 0x88) or xdst (with cxset)
0x3: cxsout (fuc5 opcode 0x8C) or xdld (with cxset)
0x4: crnd (fuc5 opcode 0x90)
0x5: cs0begin (fuc5 opcode 0x94)
0x6: cs0exec (fuc5 opcode 0x98)
0x7: cs1begin (fuc5 opcode 0x9C)
0x8: cs1exec (fuc5 opcode 0xA0)
0x9: invalid (fuc5 opcode 0xA4)
0xA: cchmod (fuc5 opcode 0xA8)
0xB: cxor (fuc5 opcode 0xAC)
0xC: cadd (fuc5 opcode 0xB0)
0xD: cand (fuc5 opcode 0xB4)
0xE: crev (fuc5 opcode 0xB8)
0xF: cprecmac (fuc5 opcode 0xBC)
0x10: csecret (fuc5 opcode 0xC0)
0x11: ckeyreg (fuc5 opcode 0xC4)
0x12: ckexp (fuc5 opcode 0xC8)
0x13: ckrexp (fuc5 opcode 0xCC)
0x14: cenc (fuc5 opcode 0xD0)
0x15: cdec (fuc5 opcode 0xD4)
0x16: csigauth (fuc5 opcode 0xD8)
0x17: csigenc (fuc5 opcode 0xDC)
0x18: csigclr (fuc5 opcode 0xE0)
|-
| 28
| Unknown
|-
| 31
| Set if running in secure mode (cauth)
|}

Contains information on the last crypto instruction executed.

=== TSEC_SCP_AES_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-4
| First opcode
|-
| 5-9
| Second opcode
|-
| 15-16
| AES operation
0: Encryption
1: Decryption
2: Key expansion
3: Key reverse expansion
|}

Contains information on the last AES sequence executed.

=== TSEC_SCP_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQSTAT_TRNG
|-
| 8
| TSEC_SCP_IRQSTAT_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQSTAT_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQSTAT_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the status of crypto IRQs.

=== TSEC_SCP_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQMASK_TRNG
|-
| 8
| TSEC_SCP_IRQMASK_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQMASK_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQMASK_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the value of the mask for crypto IRQs.

=== TSEC_SCP_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Invalid instruction
|-
| 4
| Empty crypto sequence
|-
| 8
| Crypto sequence is too long
|-
| 12
| Crypto sequence was not finished
|-
| 16
| Invalid cauth signature (during csigenc, csigclr or csigunk)
|-
| 24
| Forbidden instruction
|}

Contains information on crypto errors generated by the [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT_INSN_ERROR]] IRQ.

=== TSEC_TFBIF_MCCIF_FIFOCTRL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
|-
| 1
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
|-
| 2
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
|-
| 3
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
|-
| 4
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
|-
| 5
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
|-
| 6
| TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
|-
| 7
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
|-
| 8
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE
|}

=== TSEC_MCCIF_FIFOCTRL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
|-
| 16-31
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT
|}

=== TSEC_TFBIF_UNK5 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.

=== TSEC_TFBIF_UNK6 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to (data_size << 4) before reading memory from the GPU UCODE carveout.

=== TSEC_DMA_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_DMA_CMD_READ
|-
| 1
| TSEC_DMA_CMD_WRITE
|-
| 4-7
| TSEC_DMA_CMD_UNK
|-
| 12
| TSEC_DMA_CMD_BUSY
|-
| 13
| TSEC_DMA_CMD_ERROR
|-
| 31
| TSEC_DMA_CMD_INIT
|}

A DMA read/write operation requires bits TSEC_DMA_CMD_INIT and TSEC_DMA_CMD_READ/TSEC_DMA_CMD_WRITE to be set in TSEC_DMA_CMD.

During the transfer, the TSEC_DMA_CMD_BUSY bit is set.

Accessing an invalid address causes bit TSEC_DMA_CMD_ERROR to be set.

=== TSEC_DMA_ADDR ===
Takes the address for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_VAL ===
Takes the value for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_UNK ===
Always 0xFFF.

=== TSEC_TEGRA_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 16
| TSEC_TEGRA_CTL_TKFI_KFUSE
|-
| 17
| TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
|-
| 24
| TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
|-
| 25
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
|-
| 26
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
|-
| 27
| TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C
|}

== SCP ==
Part of the information here (which hasn't made it into envytools documentation yet) was shared by [https://wiki.0x04.net/wiki/Marcin_Ko%C5%9Bcielnicki mwk] from reverse engineering falcon processors over the years.

=== Authenticated Mode ===
==== Entry ====
From non-secure mode, upon jumping to a page marked as secret, a secret fault occurs. This causes the CPU to verify the region specified in $cauth against the MAC loaded in $c6. If the comparison is successful, the valid bit (bit0) is set on all pages in the $cauth region, and $pc is set to the base of the $cauth region. If the comparsion fails, the CPU is halted.

==== Exit ====
The CPU automatically goes back to non-secure mode when returning back into non-secret pages. When this happens, the valid bit (bit0) in the TLB flags is cleared for all secret pages.

==== Implementation ====
Under certain circumstances, it is possible to observe [[#csigauth|csigauth]] being briefly written to [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]] as "csigauth $c4 $c6" while the opcodes in [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]] are set to "cxsin" and "csigauth", respectively.

Via [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]] it can be observed that a 3-sized macro sequence is loaded into cs0 during a secure mode transition.

=== Operations ===
{| class="wikitable" border="1"
! Opcode
! Name
! Operand0
! Operand1
! Operation
! Condition
|-
| 0 || nop || N/A || N/A || ||
|-
| 1 || mov || $cX || $cY || <code>$cX = $cY; ACL(X) = ACL(Y);</code> ||
|-
| 2 || sin || $cX || N/A || <code>$cX = read_stream(); ACL(X) = ???;</code> ||
|-
| 3 || sout || $cX || N/A || <code>write_stream($cX);</code> || ?
|-
| 4 || rnd || $cX || N/A || <code>$cX = read_trng(); ACL(X) = ???;</code> ||
|-
| 5 || s0begin || immX || N/A || <code>record_macro_for_N_instructions(0, immX);</code> ||
|-
| 6 || s0exec || immX || N/A || <code>execute_macro_N_times(0, immX);</code> ||
|-
| 7 || s1begin || immX || N/A || <code>record_macro_for_N_instructions(1, immX);</code> ||
|-
| 8 || s1exec || immX || N/A || <code>execute_macro_N_times(1, immX);</code> ||
|-
| 9 || <invalid> || || || ||
|-
| 0xA || chmod || $cX || immY || Complicated, see [[#ACL|ACL]]. ||
|-
| 0xB || xor || $cX || $cY || <code>$cX ^= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xC || add || $cX || immY || <code>$cX += immY;</code> || <code>(ACL(X) & 2)</code>
|-
| 0xD || and || $cX || $cY || <code>$cX &= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xE || rev || $cX || $cY || <code>$cX = endian_swap128($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0xF || gfmul || $cX || $cY || <code>$cX = gfmul($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 2)</code>
|-
| 0x10 || secret || $cX || immY || <code>$cX = load_secret(immY); ACL(X) = load_secret_acl(immY);</code> ||
|-
| 0x11 || keyreg || immX || N/A || <code>active_key_idx = immX;</code> ||
|-
| 0x12 || kexp || $cX || $cY || <code>$cX = aes_kexp($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0x13 || krexp || $cX || $cY || <code>$cX = aes_kexp_reverse($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0x14 || enc || $cX || $cY || <code>$cX = aes_enc(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 1) && (ACL(Y) & 2)</code>
|-
| 0x15 || dec || $cX || $cY || <code>$cX = aes_dec(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 1) && (ACL(Y) & 2)</code>
|-
| 0x16 || csigauth || $cX || $cY || <code>if (hash_verify($cX, $cY)) { has_sig = true; current_sig = $cX; }</code> || ?
|-
| 0x17 || csigclr || N/A || N/A || <code>has_sig = false;</code> ||
|-
| 0x18 || csigenc || $cX || $cY || <code>if (has_sig) $cX = aes_enc(current_sig, $cY);</code> || ?
|}

==== csigauth ====
<code>00000000: f5 3c XY d8 csigauth $cY $cX</code>

Takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret. This instruction does not work in secure mode.

==== csigclr ====
<code>00000000: f5 3c 00 e0 csigclr</code>

This instruction takes no operands and appears to clear the saved cauth signature used by the csigenc instruction.

==== cchmod ====
<code>00000000: f5 3c XY a8 cchmod $cY 0X</code> or <code>00000000: f5 3c XY a9 cchmod $cY 1X</code>

This instruction takes a crypto register and a 5 bit immediate value which represents the [[#ACL|ACL]] mask to set.

==== crnd ====
<code>00000000: f5 3c 0X 90 crnd $cX</code>

This instruction initializes a crypto register with random data.

Executing this instruction only succeeds if the TRNG is enabled for the SCP, which requires taking the following steps:
* Write 0x7FFF to TSEC_TRNG_CLKDIV.
* Write 0x3FF0000 to TSEC_TRNG_UNK0.
* Write 0xFF00 to TSEC_TRNG_UNK7.
* Write 0x1000 to [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]].

Otherwise it hangs forever.

=== ACL ===
{| class="wikitable" border="1"
! Bit
! Meaning
|-
| 0 || Secure key. Forced set if bit1 is set. Once cleared, cannot be set again.
|-
| 1 || Secure readable. Once cleared, cannot be set again.
|-
| 2 || Insecure key. Forced set if bit3 is set. Forced clear if bit0 is clear. Can be toggled back and forth.
|-
| 3 || Insecure readable. Forced clear if bit1 is clear. Can be toggled back and forth.
|-
| 4 || Insecure overwritable. Can be toggled back and forth.
|}

==== Initial values ====
On SCP boot, the ACL is 0x1F for all $cX.

Loading into $cX using xdst instruction sets ACL($cX) to 0x13 and 0x1F, for secure and insecure mode respectively.

Spilling a $cX to DMEM using xdld instruction is allowed if (ACL($cX) & 2) or (ACL($cX) & 8), for secure and insecure mode respectively.

Loading a secret into $cX sets a per-secret ACL, unconditionally.

=== cauth ===
$cauth is a special purpose register in the CPU.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7 || Start of region to authenticate (in 0x100 pages)
|-
| 8-15 || Unknown
|-
| 16 || Use secret xfers (?)
|-
| 17 || Region is encrypted (?)
|-
| 18 || Unknown
|-
| 19 || Unknown
|-
| 20-23 || Unknown
|-
| 24-31 || Size of region to authenticate (in 0x100 pages)
|}

=== cxset ===
cxset instruction provides a way to change behavior of a variable amount of successively executed DMA-related instructions.

for example: <code>000000de: f4 3c 02 cxset 0x2</code>

can be read as: <code>dma_override(type=crypto_reg, count=2)</code>

The argument to cxset specifies the type of behavior change in the top 3 bits, and the number of DMA-related instructions the effect lasts for in the lower 5 bits.

{| class=wikitable
! Bits || Description
|-
| 0-4 || Number of instructions it is valid for (0x1f is a special value meaning infinitely many instructions -- until overriden by another cxset)
|-
| 5 || Crypto destination/source select (0=crypto register, 1=crypto stream)
|-
| 6 || External memory override (0=Disabled, 1=Enabled)
|-
| 7 || Internal memory select (0=DMEM, 1=IMEM)
|}

==== DMA-Related Instructions ====
At least the following instructions may have changed behavior, and count against the cxset "count" argument: <code>xdwait</code>, <code>xdst</code>, <code>xdld</code>.

For example, if override type=0b000, then the "length" argument to <code>xdst</code> is instead treated as the index of the target $cX register.

=== Secrets ===
Falcon's Authenticated Mode has access to 64 128-bit keys which are burned at factory. These keys can be loaded by using the $csecret instruction which takes the target crypto register and the key index as arguments.

{| class=wikitable
! Index || ACL || Console-unique || Notes
|-
| 0x00 || 0x13 || No || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares.
|-
| 0x01 || 0x10 || No || Used by nvhost_nvdec_bl020_prod firmware.
|-
| 0x02 || 0x10 || No ||
|-
| 0x03 || 0x11 || No || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|-
| 0x04 || 0x10 || No || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|-
| 0x05 || 0x13 || No || Used by nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares.
|-
| 0x06 || 0x11 || No ||
|-
| 0x07 || 0x11 || No || Used by [6.0.0+] nvhost_tsec firmware.
|-
| 0x08 || 0x10 || No ||
|-
| 0x09 || 0x13 || No || Used by nvhost_tsec firmware.
|-
| 0x0A || 0x11 || No ||
|-
| 0x0B || 0x10 || No || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|-
| 0x0C || 0x13 || No ||
|-
| 0x0D || 0x11 || No ||
|-
| 0x0E || 0x10 || No ||
|-
| 0x0F || 0x13 || No || Used by nvhost_tsec firmware.
|-
| 0x10 || 0x11 || No || Used by [1.0.0-5.1.0] nvhost_tsec firmware.
|-
| 0x11 || 0x10 || No ||
|-
| 0x12 || 0x13 || No ||
|-
| 0x13 || 0x11 || No ||
|-
| 0x14 || 0x10 || No ||
|-
| 0x15 || 0x13 || No || Used by nvhost_nvdec_bl020_prod, [5.0.0+] nvhost_nvdec020_prod, [5.0.0+] nvhost_nvdec020_ns and [6.0.0+] nvhost_tsec firmwares.
|-
| 0x16 || 0x11 || No ||
|-
| 0x17 || 0x10 || No ||
|-
| 0x18 || 0x13 || No ||
|-
| 0x19 || 0x11 || No ||
|-
| 0x1A || 0x10 || No ||
|-
| 0x1B || 0x13 || No ||
|-
| 0x1C || 0x11 || No ||
|-
| 0x1D || 0x10 || No ||
|-
| 0x1E || 0x13 || No ||
|-
| 0x1F || 0x11 || No ||
|-
| 0x20 || 0x10 || No ||
|-
| 0x21 || 0x13 || No ||
|-
| 0x22 || 0x11 || No ||
|-
| 0x23 || 0x10 || No ||
|-
| 0x24 || 0x13 || No ||
|-
| 0x25 || 0x11 || No ||
|-
| 0x26 || 0x10 || No || Used by [[TSEC_Firmware#KeygenLdr|KeygenLdr]].
|-
| 0x27 || 0x13 || No ||
|-
| 0x28 || 0x11 || No ||
|-
| 0x29 || 0x10 || No ||
|-
| 0x2A || 0x13 || No ||
|-
| 0x2B || 0x11 || No ||
|-
| 0x2C || 0x10 || No ||
|-
| 0x2D || 0x13 || No ||
|-
| 0x2E || 0x11 || No ||
|-
| 0x2F || 0x10 || No ||
|-
| 0x30 || 0x13 || No ||
|-
| 0x31 || 0x11 || No ||
|-
| 0x32 || 0x10 || No ||
|-
| 0x33 || 0x13 || No ||
|-
| 0x34 || 0x11 || No ||
|-
| 0x35 || 0x10 || No ||
|-
| 0x36 || 0x13 || No ||
|-
| 0x37 || 0x11 || No ||
|-
| 0x38 || 0x10 || No ||
|-
| 0x39 || 0x13 || No ||
|-
| 0x3A || 0x11 || No ||
|-
| 0x3B || 0x10 || No ||
|-
| 0x3C || 0x13 || No || Used by nvhost_tsec firmware.
|-
| 0x3D || 0x11 || No ||
|-
| 0x3E || 0x10 || No ||
|-
| 0x3F || 0x10 || Yes || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|}

TSEC

2019-01-09T20:52:02Z

Qlutoo: /* Secrets */

TSEC (Tegra Security Co-processor) is a dedicated unit powered by a NVIDIA Falcon microprocessor with crypto extensions.

= Driver =
A host driver for communicating with the TSEC is mapped to physical address 0x54500000 with a total size of 0x40000 bytes and exposes several registers.

== Registers ==
Registers from 0x54500000 to 0x54501000 are used to configure the host interface (HOST1X).

Registers from 0x54501000 to 0x54502000 are a MMIO window for communicating with the Falcon microprocessor. From this range, the subset of registers from 0x54501400 to 0x54501FE8 are specific to the TSEC and are subdivided into:
* 0x54501400 to 0x54501500: SCP (Secure Crypto Processor?).
* 0x54501500 to 0x54501600: TRNG (True Random Number Generator).
* 0x54501600 to 0x54501700: TFBIF (Tegra Framebuffer Interface).
* 0x54501700 to 0x54501800: DMA.
* 0x54501800 to 0x54501900: TEGRA (miscellaneous interfaces).

{| class="wikitable" border="1"
! Name
! Address
! Width
|-
| TSEC_THI_INCR_SYNCPT
| 0x54500000
| 0x04
|-
| TSEC_THI_INCR_SYNCPT_ERR
| 0x54500008
| 0x04
|-
| TSEC_THI_CTXSW_INCR_SYNCPT
| 0x5450000C
| 0x04
|-
| TSEC_THI_CTXSW
| 0x54500020
| 0x04
|-
| TSEC_THI_CONT_SYNCPT_EOF
| 0x54500028
| 0x04
|-
| [[#TSEC_THI_METHOD0|TSEC_THI_METHOD0]]
| 0x54500040
| 0x04
|-
| [[#TSEC_THI_METHOD1|TSEC_THI_METHOD1]]
| 0x54500044
| 0x04
|-
| [[#TSEC_THI_INT_STATUS|TSEC_THI_INT_STATUS]]
| 0x54500078
| 0x04
|-
| [[#TSEC_THI_INT_MASK|TSEC_THI_INT_MASK]]
| 0x5450007C
| 0x04
|-
| TSEC_THI_SLCG_STATUS
| 0x54500084
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_HIGH_A
| 0x54500088
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_LOW_A
| 0x5450008C
| 0x04
|-
| TSEC_THI_CLK_OVERRIDE
| 0x54500E00
| 0x04
|-
| [[#FALCON_IRQSSET|FALCON_IRQSSET]]
| 0x54501000
| 0x04
|-
| [[#FALCON_IRQSCLR|FALCON_IRQSCLR]]
| 0x54501004
| 0x04
|-
| [[#FALCON_IRQSTAT|FALCON_IRQSTAT]]
| 0x54501008
| 0x04
|-
| [[#FALCON_IRQMODE|FALCON_IRQMODE]]
| 0x5450100C
| 0x04
|-
| [[#FALCON_IRQMSET|FALCON_IRQMSET]]
| 0x54501010
| 0x04
|-
| [[#FALCON_IRQMCLR|FALCON_IRQMCLR]]
| 0x54501014
| 0x04
|-
| [[#FALCON_IRQMASK|FALCON_IRQMASK]]
| 0x54501018
| 0x04
|-
| [[#FALCON_IRQDEST|FALCON_IRQDEST]]
| 0x5450101C
| 0x04
|-
| FALCON_GPTMR_PERIOD
| 0x54501020
| 0x04
|-
| FALCON_GPTMR_TIME
| 0x54501024
| 0x04
|-
| FALCON_GPTMR_ENABLE
| 0x54501028
| 0x04
|-
| FALCON_TIME_LOW
| 0x5450102C
| 0x04
|-
| FALCON_TIME_HIGH
| 0x54501030
| 0x04
|-
| FALCON_WDTMR_TIME
| 0x54501034
| 0x04
|-
| FALCON_WDTMR_ENABLE
| 0x54501038
| 0x04
|-
| [[#FALCON_SCRATCH0|FALCON_SCRATCH0]]
| 0x54501040
| 0x04
|-
| [[#FALCON_SCRATCH1|FALCON_SCRATCH1]]
| 0x54501044
| 0x04
|-
| [[#FALCON_ITFEN|FALCON_ITFEN]]
| 0x54501048
| 0x04
|-
| [[#FALCON_IDLESTATE|FALCON_IDLESTATE]]
| 0x5450104C
| 0x04
|-
| FALCON_CURCTX
| 0x54501050
| 0x04
|-
| FALCON_NXTCTX
| 0x54501054
| 0x04
|-
| FALCON_CMDCTX
| 0x54501058
| 0x04
|-
| FALCON_STATUS_MASK
| 0x5450105C
| 0x04
|-
| FALCON_VM_SUPERVISOR
| 0x54501060
| 0x04
|-
| FALCON_MTHD_DATA
| 0x54501064
| 0x04
|-
| FALCON_MTHD_CMD
| 0x54501068
| 0x04
|-
| FALCON_MTHD_DATA_WR
| 0x5450106C
| 0x04
|-
| FALCON_MTHD_OCCUPIED
| 0x54501070
| 0x04
|-
| FALCON_MTHD_ACK
| 0x54501074
| 0x04
|-
| FALCON_MTHD_LIMIT
| 0x54501078
| 0x04
|-
| FALCON_SUBENGINE_RESET
| 0x5450107C
| 0x04
|-
| FALCON_SCRATCH2
| 0x54501080
| 0x04
|-
| FALCON_SCRATCH3
| 0x54501084
| 0x04
|-
| FALCON_PM_TRIGGER
| 0x54501088
| 0x04
|-
| FALCON_PM_MODE
| 0x5450108C
| 0x04
|-
| FALCON_DEBUG1
| 0x54501090
| 0x04
|-
| [[#FALCON_DEBUGINFO|FALCON_DEBUGINFO]]
| 0x54501094
| 0x04
|-
| FALCON_BREAKPOINT0
| 0x54501098
| 0x04
|-
| FALCON_BREAKPOINT1
| 0x5450109C
| 0x04
|-
| FALCON_CGCTL
| 0x545010A0
| 0x04
|-
| FALCON_ENGCTL
| 0x545010A4
| 0x04
|-
| FALCON_PM_SEL
| 0x545010A8
| 0x04
|-
| FALCON_HOST_IO_INDEX
| 0x545010AC
| 0x04
|-
| [[#FALCON_EXCI|FALCON_EXCI]]
| 0x545010D0
| 0x04
|-
| [[#FALCON_CPUCTL|FALCON_CPUCTL]]
| 0x54501100
| 0x04
|-
| [[#FALCON_BOOTVEC|FALCON_BOOTVEC]]
| 0x54501104
| 0x04
|-
| [[#FALCON_HWCFG|FALCON_HWCFG]]
| 0x54501108
| 0x04
|-
| [[#FALCON_DMACTL|FALCON_DMACTL]]
| 0x5450110C
| 0x04
|-
| [[#FALCON_DMATRF_EXTBASE|FALCON_DMATRF_EXTBASE]]
| 0x54501110
| 0x04
|-
| [[#FALCON_DMATRF_VOFF|FALCON_DMATRF_VOFF]]
| 0x54501114
| 0x04
|-
| [[#FALCON_DMATRFCMD|FALCON_DMATRFCMD]]
| 0x54501118
| 0x04
|-
| [[#FALCON_DMATRF_POFF|FALCON_DMATRF_POFF]]
| 0x5450111C
| 0x04
|-
| [[#FALCON_DMATRFSTAT|FALCON_DMATRFSTAT]]
| 0x54501120
| 0x04
|-
| [[#FALCON_CRYPTTRFSTAT|FALCON_CRYPTTRFSTAT]]
| 0x54501124
| 0x04
|-
| FALCON_CPUSTAT
| 0x54501128
| 0x04
|-
| [[#FALCON_HWCFG2|FALCON_HWCFG2]]
| 0x5450112C
| 0x04
|-
| FALCON_CPUCTL_ALIAS
| 0x54501130
| 0x04
|-
| FALCON_TLB_CMD
| 0x54501140
| 0x04
|-
| FALCON_TLB_CMD_RES
| 0x54501144
| 0x04
|-
| FALCON_BRANCH_HISTORY_CTRL
| 0x54501148
| 0x04
|-
| FALCON_BRANCH_HISTORY_PC
| 0x5450114C
| 0x04
|-
| FALCON_IMFILLRNG0
| 0x54501150
| 0x04
|-
| FALCON_IMFILLRNG1
| 0x54501154
| 0x04
|-
| FALCON_IMFILLCTL
| 0x54501158
| 0x04
|-
| FALCON_EXTERRWIN
| 0x54501160
| 0x04
|-
| FALCON_EXTERRCFG
| 0x54501164
| 0x04
|-
| FALCON_EXTERRADDR
| 0x54501168
| 0x04
|-
| FALCON_EXTERRSTAT
| 0x5450116C
| 0x04
|-
| FALCON_CG2
| 0x5450117C
| 0x04
|-
| FALCON_CODE_INDEX
| 0x54501180
| 0x04
|-
| FALCON_CODE
| 0x54501184
| 0x04
|-
| FALCON_CODE_VIRT_ADDR
| 0x54501188
| 0x04
|-
| FALCON_DATA_INDEX0
| 0x545011C0
| 0x04
|-
| FALCON_DATA0
| 0x545011C4
| 0x04
|-
| FALCON_DATA_INDEX1
| 0x545011C8
| 0x04
|-
| FALCON_DATA1
| 0x545011CC
| 0x04
|-
| FALCON_DATA_INDEX2
| 0x545011D0
| 0x04
|-
| FALCON_DATA2
| 0x545011D4
| 0x04
|-
| FALCON_DATA_INDEX3
| 0x545011D8
| 0x04
|-
| FALCON_DATA3
| 0x545011DC
| 0x04
|-
| FALCON_DATA_INDEX4
| 0x545011E0
| 0x04
|-
| FALCON_DATA4
| 0x545011E4
| 0x04
|-
| FALCON_DATA_INDEX5
| 0x545011E8
| 0x04
|-
| FALCON_DATA5
| 0x545011EC
| 0x04
|-
| FALCON_DATA_INDEX6
| 0x545011F0
| 0x04
|-
| FALCON_DATA6
| 0x545011F4
| 0x04
|-
| FALCON_DATA_INDEX7
| 0x545011F8
| 0x04
|-
| FALCON_DATA7
| 0x545011FC
| 0x04
|-
| [[#FALCON_ICD_CMD|FALCON_ICD_CMD]]
| 0x54501200
| 0x04
|-
| FALCON_ICD_ADDR
| 0x54501204
| 0x04
|-
| FALCON_ICD_WDATA
| 0x54501208
| 0x04
|-
| FALCON_ICD_RDATA
| 0x5450120C
| 0x04
|-
| [[#FALCON_SCTL|FALCON_SCTL]]
| 0x54501240
| 0x04
|-
| [[#TSEC_SCP_CTL_ACCESS|TSEC_SCP_CTL_ACCESS]]
| 0x54501400
| 0x04
|-
| [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]]
| 0x54501404
| 0x04
|-
| [[#TSEC_SCP_CTL_STAT|TSEC_SCP_CTL_STAT]]
| 0x54501408
| 0x04
|-
| [[#TSEC_SCP_CTL_MODE|TSEC_SCP_CTL_MODE]]
| 0x5450140C
| 0x04
|-
| TSEC_SCP_UNK0
| 0x54501410
| 0x04
|-
| [[#TSEC_SCP_CTL_PKEY|TSEC_SCP_CTL_PKEY]]
| 0x54501418
| 0x04
|-
| [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]]
| 0x54501420
| 0x04
|-
| [[#TSEC_SCP_SEQ_STAT|TSEC_SCP_SEQ_STAT]]
| 0x54501428
| 0x04
|-
| [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]]
| 0x54501430
| 0x04
|-
| TSEC_SCP_UNK2
| 0x54501454
| 0x04
|-
| [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]]
| 0x54501458
| 0x04
|-
| TSEC_SCP_UNK3
| 0x54501470
| 0x04
|-
| [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT]]
| 0x54501480
| 0x04
|-
| [[#TSEC_SCP_IRQMASK|TSEC_SCP_IRQMASK]]
| 0x54501484
| 0x04
|-
| TSEC_SCP_UNK4
| 0x54501490
| 0x04
|-
| [[#TSEC_SCP_ERR|TSEC_SCP_ERR]]
| 0x54501498
| 0x04
|-
| TSEC_TRNG_CLKDIV
| 0x54501500
| 0x04
|-
| TSEC_TRNG_UNK0
| 0x54501504
| 0x04
|-
| TSEC_TRNG_UNK1
| 0x5450150C
| 0x04
|-
| TSEC_TRNG_UNK2
| 0x54501510
| 0x04
|-
| TSEC_TRNG_UNK3
| 0x54501514
| 0x04
|-
| TSEC_TRNG_UNK4
| 0x54501518
| 0x04
|-
| TSEC_TRNG_UNK5
| 0x5450151C
| 0x04
|-
| TSEC_TRNG_UNK6
| 0x54501528
| 0x04
|-
| TSEC_TRNG_UNK7
| 0x5450152C
| 0x04
|-
| TSEC_TFBIF_UNK0
| 0x54501600
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL|TSEC_TFBIF_MCCIF_FIFOCTRL]]
| 0x54501604
| 0x04
|-
| TSEC_TFBIF_UNK1
| 0x54501608
| 0x04
|-
| TSEC_TFBIF_UNK2
| 0x5450160C
| 0x04
|-
| TSEC_TFBIF_UNK3
| 0x54501630
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL1|TSEC_TFBIF_MCCIF_FIFOCTRL1]]
| 0x54501634
| 0x04
|-
| TSEC_TFBIF_UNK4
| 0x54501640
| 0x04
|-
| [[#TSEC_TFBIF_UNK5|TSEC_TFBIF_UNK5]]
| 0x54501644
| 0x04
|-
| [[#TSEC_TFBIF_UNK6|TSEC_TFBIF_UNK6]]
| 0x54501648
| 0x04
|-
| [[#TSEC_DMA_CMD|TSEC_DMA_CMD]]
| 0x54501700
| 0x04
|-
| [[#TSEC_DMA_ADDR|TSEC_DMA_ADDR]]
| 0x54501704
| 0x04
|-
| [[#TSEC_DMA_VAL|TSEC_DMA_VAL]]
| 0x54501708
| 0x04
|-
| [[#TSEC_DMA_UNK|TSEC_DMA_UNK]]
| 0x5450170C
| 0x04
|-
| TSEC_TEGRA_FALCON_IP_VER
| 0x54501800
| 0x04
|-
| TSEC_TEGRA_UNK0
| 0x54501824
| 0x04
|-
| TSEC_TEGRA_UNK1
| 0x54501828
| 0x04
|-
| TSEC_TEGRA_UNK2
| 0x5450182C
| 0x04
|-
| [[#TSEC_TEGRA_CTL|TSEC_TEGRA_CTL]]
| 0x54501838
| 0x04
|}

=== TSEC_THI_METHOD0 ===
{| class="wikitable" border="1"
! ID
! Method
|-
| 0x200
| SET_APPLICATION_ID
|-
| 0x300
| EXECUTE
|-
| 0x500
| HDCP_INIT
|-
| 0x504
| HDCP_CREATE_SESSION
|-
| 0x508
| HDCP_VERIFY_CERT_RX
|-
| 0x50C
| HDCP_GENERATE_EKM
|-
| 0x510
| HDCP_REVOCATION_CHECK
|-
| 0x514
| HDCP_VERIFY_HPRIME
|-
| 0x518
| HDCP_ENCRYPT_PAIRING_INFO
|-
| 0x51C
| HDCP_DECRYPT_PAIRING_INFO
|-
| 0x520
| HDCP_UPDATE_SESSION
|-
| 0x524
| HDCP_GENERATE_LC_INIT
|-
| 0x528
| HDCP_VERIFY_LPRIME
|-
| 0x52C
| HDCP_GENERATE_SKE_INIT
|-
| 0x530
| HDCP_VERIFY_VPRIME
|-
| 0x534
| HDCP_ENCRYPTION_RUN_CTRL
|-
| 0x538
| HDCP_SESSION_CTRL
|-
| 0x53C
| HDCP_COMPUTE_SPRIME
|-
| 0x540
| HDCP_GET_CERT_RX
|-
| 0x544
| HDCP_EXCHANGE_INFO
|-
| 0x548
| HDCP_DECRYPT_KM
|-
| 0x54C
| HDCP_GET_HPRIME
|-
| 0x550
| HDCP_GENERATE_EKH_KM
|-
| 0x554
| HDCP_VERIFY_RTT_CHALLENGE
|-
| 0x558
| HDCP_GET_LPRIME
|-
| 0x55C
| HDCP_DECRYPT_KS
|-
| 0x560
| HDCP_DECRYPT
|-
| 0x564
| HDCP_GET_RRX
|-
| 0x568
| HDCP_DECRYPT_REENCRYPT
|-
| 0x56C
|
|-
| 0x570
|
|-
| 0x574
|
|-
| 0x578
|
|-
| 0x57C
|
|-
| 0x700
| HDCP_VALIDATE_SRM
|-
| 0x704
| HDCP_VALIDATE_STREAM
|-
| 0x708
| HDCP_TEST_SECURE_STATUS
|-
| 0x70C
| HDCP_SET_DCP_KPUB
|-
| 0x710
| HDCP_SET_RX_KPUB
|-
| 0x714
| HDCP_SET_CERT_RX
|-
| 0x718
| HDCP_SET_SCRATCH_BUFFER
|-
| 0x71C
| HDCP_SET_SRM
|-
| 0x720
| HDCP_SET_RECEIVER_ID_LIST
|-
| 0x724
| HDCP_SET_SPRIME
|-
| 0x728
| HDCP_SET_ENC_INPUT_BUFFER
|-
| 0x72C
| HDCP_SET_ENC_OUTPUT_BUFFER
|-
| 0x730
| HDCP_GET_RTT_CHALLENGE
|-
| 0x734
| HDCP_STREAM_MANAGE
|-
| 0x738
| HDCP_READ_CAPS
|-
| 0x73C
| HDCP_ENCRYPT
|-
| 0x740
| [6.0.0+] HDCP_GET_CURRENT_NONCE
|}

Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_METHOD1 ===
Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_INT_STATUS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_STATUS_FALCON_INT
|}

=== TSEC_THI_INT_MASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_MASK_FALCON_INT
|}

=== FALCON_IRQSSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSSET_GPTMR
|-
| 1
| FALCON_IRQSSET_WDTMR
|-
| 2
| FALCON_IRQSSET_MTHD
|-
| 3
| FALCON_IRQSSET_CTXSW
|-
| 4
| FALCON_IRQSSET_HALT
|-
| 5
| FALCON_IRQSSET_EXTERR
|-
| 6
| FALCON_IRQSSET_SWGEN0
|-
| 7
| FALCON_IRQSSET_SWGEN1
|-
| 8-15
| FALCON_IRQSSET_EXT
|}

Used for setting Falcon's IRQs.

=== FALCON_IRQSCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSCLR_GPTMR
|-
| 1
| FALCON_IRQSCLR_WDTMR
|-
| 2
| FALCON_IRQSCLR_MTHD
|-
| 3
| FALCON_IRQSCLR_CTXSW
|-
| 4
| FALCON_IRQSCLR_HALT
|-
| 5
| FALCON_IRQSCLR_EXTERR
|-
| 6
| FALCON_IRQSCLR_SWGEN0
|-
| 7
| FALCON_IRQSCLR_SWGEN1
|-
| 8-15
| FALCON_IRQSCLR_EXT
|}

Used for clearing Falcon's IRQs.

=== FALCON_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSTAT_GPTMR
|-
| 1
| FALCON_IRQSTAT_WDTMR
|-
| 2
| FALCON_IRQSTAT_MTHD
|-
| 3
| FALCON_IRQSTAT_CTXSW
|-
| 4
| FALCON_IRQSTAT_HALT
|-
| 5
| FALCON_IRQSTAT_EXTERR
|-
| 6
| FALCON_IRQSTAT_SWGEN0
|-
| 7
| FALCON_IRQSTAT_SWGEN1
|-
| 8-15
| FALCON_IRQSTAT_EXT
|}

Used for getting the status of Falcon's IRQs.

=== FALCON_IRQMODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMODE_GPTMR
|-
| 1
| FALCON_IRQMODE_WDTMR
|-
| 2
| FALCON_IRQMODE_MTHD
|-
| 3
| FALCON_IRQMODE_CTXSW
|-
| 4
| FALCON_IRQMODE_HALT
|-
| 5
| FALCON_IRQMODE_EXTERR
|-
| 6
| FALCON_IRQMODE_SWGEN0
|-
| 7
| FALCON_IRQMODE_SWGEN1
|-
| 8-15
| FALCON_IRQMODE_EXT
|}

Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.

=== FALCON_IRQMSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMSET_GPTMR
|-
| 1
| FALCON_IRQMSET_WDTMR
|-
| 2
| FALCON_IRQMSET_MTHD
|-
| 3
| FALCON_IRQMSET_CTXSW
|-
| 4
| FALCON_IRQMSET_HALT
|-
| 5
| FALCON_IRQMSET_EXTERR
|-
| 6
| FALCON_IRQMSET_SWGEN0
|-
| 7
| FALCON_IRQMSET_SWGEN1
|-
| 8-15
| FALCON_IRQMSET_EXT
|}

Used for setting the mask for Falcon's IRQs.

=== FALCON_IRQMCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMCLR_GPTMR
|-
| 1
| FALCON_IRQMCLR_WDTMR
|-
| 2
| FALCON_IRQMCLR_MTHD
|-
| 3
| FALCON_IRQMCLR_CTXSW
|-
| 4
| FALCON_IRQMCLR_HALT
|-
| 5
| FALCON_IRQMCLR_EXTERR
|-
| 6
| FALCON_IRQMCLR_SWGEN0
|-
| 7
| FALCON_IRQMCLR_SWGEN1
|-
| 8-15
| FALCON_IRQMCLR_EXT
|}

Used for clearing the mask for Falcon's IRQs.

=== FALCON_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMASK_GPTMR
|-
| 1
| FALCON_IRQMASK_WDTMR
|-
| 2
| FALCON_IRQMASK_MTHD
|-
| 3
| FALCON_IRQMASK_CTXSW
|-
| 4
| FALCON_IRQMASK_HALT
|-
| 5
| FALCON_IRQMASK_EXTERR
|-
| 6
| FALCON_IRQMASK_SWGEN0
|-
| 7
| FALCON_IRQMASK_SWGEN1
|-
| 8-15
| FALCON_IRQMASK_EXT
|}

Used for getting the value of the mask for Falcon's IRQs.

=== FALCON_IRQDEST ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQDEST_HOST_GPTMR
|-
| 1
| FALCON_IRQDEST_HOST_WDTMR
|-
| 2
| FALCON_IRQDEST_HOST_MTHD
|-
| 3
| FALCON_IRQDEST_HOST_CTXSW
|-
| 4
| FALCON_IRQDEST_HOST_HALT
|-
| 5
| FALCON_IRQDEST_HOST_EXTERR
|-
| 6
| FALCON_IRQDEST_HOST_SWGEN0
|-
| 7
| FALCON_IRQDEST_HOST_SWGEN1
|-
| 8-15
| FALCON_IRQDEST_HOST_EXT
|-
| 16
| FALCON_IRQDEST_TARGET_GPTMR
|-
| 17
| FALCON_IRQDEST_TARGET_WDTMR
|-
| 18
| FALCON_IRQDEST_TARGET_MTHD
|-
| 19
| FALCON_IRQDEST_TARGET_CTXSW
|-
| 20
| FALCON_IRQDEST_TARGET_HALT
|-
| 21
| FALCON_IRQDEST_TARGET_EXTERR
|-
| 22
| FALCON_IRQDEST_TARGET_SWGEN0
|-
| 23
| FALCON_IRQDEST_TARGET_SWGEN1
|-
| 24-31
| FALCON_IRQDEST_TARGET_EXT
|}

Used for routing Falcon's IRQs.

=== FALCON_SCRATCH0 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_SCRATCH1 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_ITFEN ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_ITFEN_CTXEN
|-
| 1
| FALCON_ITFEN_MTHDEN
|}

Used for enabling/disabling Falcon interfaces.

=== FALCON_IDLESTATE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IDLESTATE_FALCON_BUSY
|-
| 1-15
| FALCON_IDLESTATE_EXT_BUSY
|}

Used for detecting if Falcon is busy or not.

=== FALCON_DEBUGINFO ===
Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.

[6.0.0+] [[NV_services|nvservices]] sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.

=== FALCON_EXCI ===
Contains information about raised exceptions.

=== FALCON_CPUCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_CPUCTL_IINVAL
|-
| 1
| FALCON_CPUCTL_STARTCPU
|-
| 2
| FALCON_CPUCTL_SRESET
|-
| 3
| FALCON_CPUCTL_HRESET
|-
| 4
| FALCON_CPUCTL_HALTED
|-
| 5
| FALCON_CPUCTL_STOPPED
|-
| 6
| FALCON_CPUCTL_START_SCP_LS
|}

Used for signaling the Falcon CPU.

=== FALCON_BOOTVEC ===
Takes the Falcon's boot vector address.

=== FALCON_HWCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-8
| FALCON_HWCFG_IMEM_SIZE
|-
| 9-17
| FALCON_HWCFG_DMEM_SIZE
|-
| 18-25
| FALCON_HWCFG_MTHD_SIZE
|-
| 26-31
| FALCON_HWCFG_DMATRF_SLOTS
|}

=== FALCON_DMACTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMACTL_REQUIRE_CTX
|-
| 1
| FALCON_DMACTL_DMEM_SCRUBBING
|-
| 2
| FALCON_DMACTL_IMEM_SCRUBBING
|-
| 3-6
| FALCON_DMACTL_DMAQ_NUM
|-
| 7
| FALCON_DMACTL_SECURE_STAT
|}

Used for configuring the Falcon's DMA engine.

=== FALCON_DMATRF_EXTBASE ===
Base of the external memory buffer.

The base of the transfer is calculated by adding [[#FALCON_DMATRF_POFF]] to the base.

=== FALCON_DMATRF_VOFF ===
For transfers to DMEM: the destination address.
For transfers to IMEM: the destination virtual IMEM page.

=== FALCON_DMATRF_POFF ===
For transfers to IMEM: the destination physical IMEM page.

=== FALCON_DMATRFCMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFCMD_FULL
|-
| 1
| FALCON_DMATRFCMD_IDLE
|-
| 2-3
| FALCON_DMATRFCMD_SEC
|-
| 4
| FALCON_DMATRFCMD_IMEM
|-
| 5
| FALCON_DMATRFCMD_WRITE
|-
| 8-10
| FALCON_DMATRFCMD_SIZE
|-
| 12-14
| FALCON_DMATRFCMD_CTXDMA
|}

Used for configuring DMA transfers.

=== FALCON_DMATRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFSTAT_PENDING
|-
| 16-18
| FALCON_DMATRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_DMATRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_CRYPTTRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| FALCON_CRYPTTRFSTAT_PENDING
|-
| 5
| FALCON_CRYPTTRFSTAT_ENABLED
|-
| 16-18
| FALCON_CRYPTTRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_CRYPTTRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_HWCFG2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_HWCFG2_VERSION
|-
| 4-5
| FALCON_HWCFG2_SCP_MODE
|-
| 6-7
| FALCON_HWCFG2_SUBVERSION
|-
| 8-11
| FALCON_HWCFG2_IMEM_PORTS
|-
| 12-15
| FALCON_HWCFG2_DMEM_PORTS
|-
| 16-19
| FALCON_HWCFG2_VM_PAGES_LOG2
|}

=== FALCON_ICD_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_ICD_CMD_OPC
0x0: BREAK
0x1: CONTINUE_FROM_PC
0x2: CONTINUE_FROM_ADDR
0x3: CONTINUE_UNK1_FROM_PC
0x4: CONTINUE_UNK1_FROM_ADDR
0x5: SINGLE_STEP_FROM_PC
0x6: SINGLE_STEP_FROM_ADDR
0x7: SET_BREAK_MASK
0x8: REG_READ
0x9: REG_WRITE
0xA: DATA_READ
0xB: DATA_WRITE
0xC: IO_READ
0xD: IO_WRITE
0xE: STATUS_READ
|-
| 6-7
| FALCON_ICD_CMD_DATA_SIZE
|-
| 8-12
| FALCON_ICD_CMD_IDX
|-
| 14
| FALCON_ICD_CMD_ERROR
|-
| 15
| FALCON_ICD_CMD_DONE
|-
| 16-31
| FALCON_ICD_CMD_BREAK_MASK
|}

=== FALCON_SCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| FALCON_SCTL_SEC_MODE
0: Non-secure
1: Light Secure
2: Heavy Secure
|-
| 4-5
| FALCON_SCTL_OLD_SEC_MODE
0: Non-secure
1: Light Secure
2: Heavy Secure
|-
| 12-13
| Unknown
|-
| 14
| Initialize the transition to LS mode
|}

=== TSEC_SCP_CTL_ACCESS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| Enable TSEC_SCP_INSN_STAT register
|}

=== TSEC_SCP_CTL_TRNG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 11
| Unknown
|-
| 12
| Enable the TRNG
|}

=== TSEC_SCP_CTL_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| TSEC_SCP_CTL_STAT_DEBUG_MODE
|}

=== TSEC_SCP_CTL_MODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Disable reads for the TRNG register block
|-
| 1
| Disable reads for the TFBIF register block
|-
| 2
| Disable reads for the DMA register block
|-
| 3
| Disable reads for the TEGRA register block
|-
| 4
| Disable writes for the TRNG register block
|-
| 5
| Disable writes for the TFBIF register block
|-
| 6
| Disable writes for the DMA register block
|-
| 7
| Disable writes for the TEGRA register block
|}

Controls accesses to the other sub-engines and can only be cleared in Heavy Secure mode.

=== TSEC_SCP_CTL_PKEY ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
|-
| 1
| TSEC_SCP_CTL_PKEY_LOADED
|}

=== TSEC_SCP_SEQ0_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 8-11
| Size of current cs0begin macro
|-
|}

=== TSEC_SCP_SEQ_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Set if crypto sequence recording (cs0begin/cs1begin) is active
|-
| 4-7
| Number of instructions left for the crypto sequence
|-
| 12-15
| Active crypto key register
|}

Contains information on the last crypto sequence (cs0 or cs1) executed.

=== TSEC_SCP_INSN_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Crypto fuc5 destination register or immediate value
|-
| 8-13
| Crypto fuc5 source register or immediate value
|-
| 20-24
| Crypto fuc5 operation
0x0: nop (fuc5 opcode 0x00)
0x1: cmov (fuc5 opcode 0x84)
0x2: cxsin (fuc5 opcode 0x88) or xdst (with cxset)
0x3: cxsout (fuc5 opcode 0x8C) or xdld (with cxset)
0x4: crnd (fuc5 opcode 0x90)
0x5: cs0begin (fuc5 opcode 0x94)
0x6: cs0exec (fuc5 opcode 0x98)
0x7: cs1begin (fuc5 opcode 0x9C)
0x8: cs1exec (fuc5 opcode 0xA0)
0x9: invalid (fuc5 opcode 0xA4)
0xA: cchmod (fuc5 opcode 0xA8)
0xB: cxor (fuc5 opcode 0xAC)
0xC: cadd (fuc5 opcode 0xB0)
0xD: cand (fuc5 opcode 0xB4)
0xE: crev (fuc5 opcode 0xB8)
0xF: cprecmac (fuc5 opcode 0xBC)
0x10: csecret (fuc5 opcode 0xC0)
0x11: ckeyreg (fuc5 opcode 0xC4)
0x12: ckexp (fuc5 opcode 0xC8)
0x13: ckrexp (fuc5 opcode 0xCC)
0x14: cenc (fuc5 opcode 0xD0)
0x15: cdec (fuc5 opcode 0xD4)
0x16: csigauth (fuc5 opcode 0xD8)
0x17: csigenc (fuc5 opcode 0xDC)
0x18: csigclr (fuc5 opcode 0xE0)
|-
| 28
| Unknown
|-
| 31
| Set if running in secure mode (cauth)
|}

Contains information on the last crypto instruction executed.

=== TSEC_SCP_AES_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-4
| First opcode
|-
| 5-9
| Second opcode
|-
| 15-16
| AES operation
0: Encryption
1: Decryption
2: Key expansion
3: Key reverse expansion
|}

Contains information on the last AES sequence executed.

=== TSEC_SCP_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQSTAT_TRNG
|-
| 8
| TSEC_SCP_IRQSTAT_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQSTAT_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQSTAT_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the status of crypto IRQs.

=== TSEC_SCP_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQMASK_TRNG
|-
| 8
| TSEC_SCP_IRQMASK_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQMASK_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQMASK_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the value of the mask for crypto IRQs.

=== TSEC_SCP_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Invalid instruction
|-
| 4
| Empty crypto sequence
|-
| 8
| Crypto sequence is too long
|-
| 12
| Crypto sequence was not finished
|-
| 16
| Invalid cauth signature (during csigenc, csigclr or csigunk)
|-
| 24
| Forbidden instruction
|}

Contains information on crypto errors generated by the [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT_INSN_ERROR]] IRQ.

=== TSEC_TFBIF_MCCIF_FIFOCTRL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
|-
| 1
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
|-
| 2
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
|-
| 3
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
|-
| 4
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
|-
| 5
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
|-
| 6
| TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
|-
| 7
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
|-
| 8
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE
|}

=== TSEC_MCCIF_FIFOCTRL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
|-
| 16-31
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT
|}

=== TSEC_TFBIF_UNK5 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.

=== TSEC_TFBIF_UNK6 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to (data_size << 4) before reading memory from the GPU UCODE carveout.

=== TSEC_DMA_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_DMA_CMD_READ
|-
| 1
| TSEC_DMA_CMD_WRITE
|-
| 4-7
| TSEC_DMA_CMD_UNK
|-
| 12
| TSEC_DMA_CMD_BUSY
|-
| 13
| TSEC_DMA_CMD_ERROR
|-
| 31
| TSEC_DMA_CMD_INIT
|}

A DMA read/write operation requires bits TSEC_DMA_CMD_INIT and TSEC_DMA_CMD_READ/TSEC_DMA_CMD_WRITE to be set in TSEC_DMA_CMD.

During the transfer, the TSEC_DMA_CMD_BUSY bit is set.

Accessing an invalid address causes bit TSEC_DMA_CMD_ERROR to be set.

=== TSEC_DMA_ADDR ===
Takes the address for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_VAL ===
Takes the value for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_UNK ===
Always 0xFFF.

=== TSEC_TEGRA_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 16
| TSEC_TEGRA_CTL_TKFI_KFUSE
|-
| 17
| TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
|-
| 24
| TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
|-
| 25
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
|-
| 26
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
|-
| 27
| TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C
|}

== SCP ==
Part of the information here (which hasn't made it into envytools documentation yet) was shared by [https://wiki.0x04.net/wiki/Marcin_Ko%C5%9Bcielnicki mwk] from reverse engineering falcon processors over the years.

=== Authenticated Mode ===
==== Entry ====
From non-secure mode, upon jumping to a page marked as secret, a secret fault occurs. This causes the CPU to verify the region specified in $cauth against the MAC loaded in $c6. If the comparison is successful, the valid bit (bit0) is set on all pages in the $cauth region, and $pc is set to the base of the $cauth region. If the comparsion fails, the CPU is halted.

==== Exit ====
The CPU automatically goes back to non-secure mode when returning back into non-secret pages. When this happens, the valid bit (bit0) in the TLB flags is cleared for all secret pages.

==== Implementation ====
Under certain circumstances, it is possible to observe [[#csigauth|csigauth]] being briefly written to [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]] as "csigauth $c4 $c6" while the opcodes in [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]] are set to "cxsin" and "csigauth", respectively.

Via [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]] it can be observed that a 3-sized macro sequence is loaded into cs0 during a secure mode transition.

=== Operations ===
{| class="wikitable" border="1"
! Opcode
! Name
! Operand0
! Operand1
! Operation
! Condition
|-
| 0 || nop || N/A || N/A || ||
|-
| 1 || mov || $cX || $cY || <code>$cX = $cY; ACL(X) = ACL(Y);</code> ||
|-
| 2 || sin || $cX || N/A || <code>$cX = read_stream(); ACL(X) = ???;</code> ||
|-
| 3 || sout || $cX || N/A || <code>write_stream($cX);</code> || ?
|-
| 4 || rnd || $cX || N/A || <code>$cX = read_trng(); ACL(X) = ???;</code> ||
|-
| 5 || s0begin || immX || N/A || <code>record_macro_for_N_instructions(0, immX);</code> ||
|-
| 6 || s0exec || immX || N/A || <code>execute_macro_N_times(0, immX);</code> ||
|-
| 7 || s1begin || immX || N/A || <code>record_macro_for_N_instructions(1, immX);</code> ||
|-
| 8 || s1exec || immX || N/A || <code>execute_macro_N_times(1, immX);</code> ||
|-
| 9 || <invalid> || || || ||
|-
| 0xA || chmod || $cX || immY || Complicated, see [[#ACL|ACL]]. ||
|-
| 0xB || xor || $cX || $cY || <code>$cX ^= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xC || add || $cX || immY || <code>$cX += immY;</code> || <code>(ACL(X) & 2)</code>
|-
| 0xD || and || $cX || $cY || <code>$cX &= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xE || rev || $cX || $cY || <code>$cX = endian_swap128($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0xF || gfmul || $cX || $cY || <code>$cX = gfmul($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 2)</code>
|-
| 0x10 || secret || $cX || immY || <code>$cX = load_secret(immY); ACL(X) = load_secret_acl(immY);</code> ||
|-
| 0x11 || keyreg || immX || N/A || <code>active_key_idx = immX;</code> ||
|-
| 0x12 || kexp || $cX || $cY || <code>$cX = aes_kexp($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0x13 || krexp || $cX || $cY || <code>$cX = aes_kexp_reverse($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0x14 || enc || $cX || $cY || <code>$cX = aes_enc(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 1) && (ACL(Y) & 2)</code>
|-
| 0x15 || dec || $cX || $cY || <code>$cX = aes_dec(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 1) && (ACL(Y) & 2)</code>
|-
| 0x16 || csigauth || $cX || $cY || <code>if (hash_verify($cX, $cY)) { has_sig = true; current_sig = $cX; }</code> || ?
|-
| 0x17 || csigclr || N/A || N/A || <code>has_sig = false;</code> ||
|-
| 0x18 || csigenc || $cX || $cY || <code>if (has_sig) $cX = aes_enc(current_sig, $cY);</code> || ?
|}

==== csigauth ====
<code>00000000: f5 3c XY d8 csigauth $cY $cX</code>

Takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret. This instruction does not work in secure mode.

==== csigclr ====
<code>00000000: f5 3c 00 e0 csigclr</code>

This instruction takes no operands and appears to clear the saved cauth signature used by the csigenc instruction.

==== cchmod ====
<code>00000000: f5 3c XY a8 cchmod $cY 0X</code> or <code>00000000: f5 3c XY a9 cchmod $cY 1X</code>

This instruction takes a crypto register and a 5 bit immediate value which represents the [[#ACL|ACL]] mask to set.

==== crnd ====
<code>00000000: f5 3c 0X 90 crnd $cX</code>

This instruction initializes a crypto register with random data.

Executing this instruction only succeeds if the TRNG is enabled for the SCP, which requires taking the following steps:
* Write 0x7FFF to TSEC_TRNG_CLKDIV.
* Write 0x3FF0000 to TSEC_TRNG_UNK0.
* Write 0xFF00 to TSEC_TRNG_UNK7.
* Write 0x1000 to [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]].

Otherwise it hangs forever.

=== ACL ===
{| class="wikitable" border="1"
! Bit
! Meaning
|-
| 0 || Secure key. Forced set if bit1 is set. Once cleared, cannot be set again.
|-
| 1 || Secure readable. Once cleared, cannot be set again.
|-
| 2 || Insecure key. Forced set if bit3 is set. Forced clear if bit0 is clear. Can be toggled back and forth.
|-
| 3 || Insecure readable. Forced clear if bit1 is clear. Can be toggled back and forth.
|-
| 4 || Insecure overwritable. Can be toggled back and forth.
|}

==== Initial values ====
On SCP boot, the ACL is 0x1F for all $cX.

Loading into $cX using xdst instruction sets ACL($cX) to 0x13 and 0x1F, for secure and insecure mode respectively.

Spilling a $cX to DMEM using xdld instruction is allowed if (ACL($cX) & 2) or (ACL($cX) & 8), for secure and insecure mode respectively.

Loading a secret into $cX sets a per-secret ACL, unconditionally.

=== cauth ===
$cauth is a special purpose register in the CPU.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7 || Start of region to authenticate (in 0x100 pages)
|-
| 8-15 || Unknown
|-
| 16 || Use secret xfers (?)
|-
| 17 || Region is encrypted (?)
|-
| 18 || Unknown
|-
| 19 || Unknown
|-
| 20-23 || Unknown
|-
| 24-31 || Size of region to authenticate (in 0x100 pages)
|}

=== cxset ===
cxset instruction provides a way to change behavior of a variable amount of successively executed DMA-related instructions.

for example: <code>000000de: f4 3c 02 cxset 0x2</code>

can be read as: <code>dma_override(type=crypto_reg, count=2)</code>

The argument to cxset specifies the type of behavior change in the top 3 bits, and the number of DMA-related instructions the effect lasts for in the lower 5 bits.

{| class=wikitable
! Bits || Description
|-
| 0-4 || Number of instructions it is valid for (0x1f is a special value meaning infinitely many instructions -- until overriden by another cxset)
|-
| 5 || Crypto destination/source select (0=crypto register, 1=crypto stream)
|-
| 6 || External memory override (0=Disabled, 1=Enabled)
|-
| 7 || Internal memory select (0=DMEM, 1=IMEM)
|}

==== DMA-Related Instructions ====
At least the following instructions may have changed behavior, and count against the cxset "count" argument: <code>xdwait</code>, <code>xdst</code>, <code>xdld</code>.

For example, if override type=0b000, then the "length" argument to <code>xdst</code> is instead treated as the index of the target $cX register.

=== Secrets ===
Falcon's Authenticated Mode has access to 64 128-bit keys which are burned at factory. These keys can be loaded by using the $csecret instruction which takes the target crypto register and the key index as arguments.

{| class=wikitable
! Index || ACL || Console-unique || Notes
|-
| 0x00 || 0x13 || No || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares.
|-
| 0x10 || 0x10 || No || Used by nvhost_nvdec_bl020_prod firmware.
|-
| 0x02 || 0x10 || No ||
|-
| 0x03 || 0x11 || No || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|-
| 0x04 || 0x10 || No || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|-
| 0x11 || 0x13 || No || Used by nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares.
|-
| 0x06 || 0x11 || No ||
|-
| 0x13 || 0x11 || No || Used by [6.0.0+] nvhost_tsec firmware.
|-
| 0x08 || 0x10 || No ||
|-
| 0x09 || 0x13 || No || Used by nvhost_tsec firmware.
|-
| 0x0A || 0x11 || No ||
|-
| 0x0B || 0x10 || No || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|-
| 0x0C || 0x13 || No ||
|-
| 0x0D || 0x11 || No ||
|-
| 0x0E || 0x10 || No ||
|-
| 0x0F || 0x13 || No || Used by nvhost_tsec firmware.
|-
| 0x10 || 0x11 || No || Used by [1.0.0-5.1.0] nvhost_tsec firmware.
|-
| 0x11 || 0x10 || No ||
|-
| 0x12 || 0x13 || No ||
|-
| 0x13 || 0x11 || No ||
|-
| 0x14 || 0x10 || No ||
|-
| 0x15 || 0x13 || No || Used by nvhost_nvdec_bl020_prod, [5.0.0+] nvhost_nvdec020_prod, [5.0.0+] nvhost_nvdec020_ns and [6.0.0+] nvhost_tsec firmwares.
|-
| 0x16 || 0x11 || No ||
|-
| 0x17 || 0x10 || No ||
|-
| 0x18 || 0x13 || No ||
|-
| 0x19 || 0x11 || No ||
|-
| 0x1A || 0x10 || No ||
|-
| 0x1B || 0x13 || No ||
|-
| 0x1C || 0x11 || No ||
|-
| 0x1D || 0x10 || No ||
|-
| 0x1E || 0x13 || No ||
|-
| 0x1F || 0x11 || No ||
|-
| 0x20 || 0x10 || No ||
|-
| 0x21 || 0x13 || No ||
|-
| 0x22 || 0x11 || No ||
|-
| 0x23 || 0x10 || No ||
|-
| 0x24 || 0x13 || No ||
|-
| 0x25 || 0x11 || No ||
|-
| 0x26 || 0x10 || No || Used by [[TSEC_Firmware#KeygenLdr|KeygenLdr]].
|-
| 0x27 || 0x13 || No ||
|-
| 0x28 || 0x11 || No ||
|-
| 0x29 || 0x10 || No ||
|-
| 0x2A || 0x13 || No ||
|-
| 0x2B || 0x11 || No ||
|-
| 0x2C || 0x10 || No ||
|-
| 0x2D || 0x13 || No ||
|-
| 0x2E || 0x11 || No ||
|-
| 0x2F || 0x10 || No ||
|-
| 0x30 || 0x13 || No ||
|-
| 0x31 || 0x11 || No ||
|-
| 0x32 || 0x10 || No ||
|-
| 0x33 || 0x13 || No ||
|-
| 0x34 || 0x11 || No ||
|-
| 0x35 || 0x10 || No ||
|-
| 0x36 || 0x13 || No ||
|-
| 0x37 || 0x11 || No ||
|-
| 0x38 || 0x10 || No ||
|-
| 0x39 || 0x13 || No ||
|-
| 0x3A || 0x11 || No ||
|-
| 0x3B || 0x10 || No ||
|-
| 0x3C || 0x13 || No || Used by nvhost_tsec firmware.
|-
| 0x3D || 0x11 || No ||
|-
| 0x3E || 0x10 || No ||
|-
| 0x3F || 0x10 || Yes || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|}

TSEC

2019-01-09T20:51:42Z

Qlutoo: /* Secrets */

TSEC (Tegra Security Co-processor) is a dedicated unit powered by a NVIDIA Falcon microprocessor with crypto extensions.

= Driver =
A host driver for communicating with the TSEC is mapped to physical address 0x54500000 with a total size of 0x40000 bytes and exposes several registers.

== Registers ==
Registers from 0x54500000 to 0x54501000 are used to configure the host interface (HOST1X).

Registers from 0x54501000 to 0x54502000 are a MMIO window for communicating with the Falcon microprocessor. From this range, the subset of registers from 0x54501400 to 0x54501FE8 are specific to the TSEC and are subdivided into:
* 0x54501400 to 0x54501500: SCP (Secure Crypto Processor?).
* 0x54501500 to 0x54501600: TRNG (True Random Number Generator).
* 0x54501600 to 0x54501700: TFBIF (Tegra Framebuffer Interface).
* 0x54501700 to 0x54501800: DMA.
* 0x54501800 to 0x54501900: TEGRA (miscellaneous interfaces).

{| class="wikitable" border="1"
! Name
! Address
! Width
|-
| TSEC_THI_INCR_SYNCPT
| 0x54500000
| 0x04
|-
| TSEC_THI_INCR_SYNCPT_ERR
| 0x54500008
| 0x04
|-
| TSEC_THI_CTXSW_INCR_SYNCPT
| 0x5450000C
| 0x04
|-
| TSEC_THI_CTXSW
| 0x54500020
| 0x04
|-
| TSEC_THI_CONT_SYNCPT_EOF
| 0x54500028
| 0x04
|-
| [[#TSEC_THI_METHOD0|TSEC_THI_METHOD0]]
| 0x54500040
| 0x04
|-
| [[#TSEC_THI_METHOD1|TSEC_THI_METHOD1]]
| 0x54500044
| 0x04
|-
| [[#TSEC_THI_INT_STATUS|TSEC_THI_INT_STATUS]]
| 0x54500078
| 0x04
|-
| [[#TSEC_THI_INT_MASK|TSEC_THI_INT_MASK]]
| 0x5450007C
| 0x04
|-
| TSEC_THI_SLCG_STATUS
| 0x54500084
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_HIGH_A
| 0x54500088
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_LOW_A
| 0x5450008C
| 0x04
|-
| TSEC_THI_CLK_OVERRIDE
| 0x54500E00
| 0x04
|-
| [[#FALCON_IRQSSET|FALCON_IRQSSET]]
| 0x54501000
| 0x04
|-
| [[#FALCON_IRQSCLR|FALCON_IRQSCLR]]
| 0x54501004
| 0x04
|-
| [[#FALCON_IRQSTAT|FALCON_IRQSTAT]]
| 0x54501008
| 0x04
|-
| [[#FALCON_IRQMODE|FALCON_IRQMODE]]
| 0x5450100C
| 0x04
|-
| [[#FALCON_IRQMSET|FALCON_IRQMSET]]
| 0x54501010
| 0x04
|-
| [[#FALCON_IRQMCLR|FALCON_IRQMCLR]]
| 0x54501014
| 0x04
|-
| [[#FALCON_IRQMASK|FALCON_IRQMASK]]
| 0x54501018
| 0x04
|-
| [[#FALCON_IRQDEST|FALCON_IRQDEST]]
| 0x5450101C
| 0x04
|-
| FALCON_GPTMR_PERIOD
| 0x54501020
| 0x04
|-
| FALCON_GPTMR_TIME
| 0x54501024
| 0x04
|-
| FALCON_GPTMR_ENABLE
| 0x54501028
| 0x04
|-
| FALCON_TIME_LOW
| 0x5450102C
| 0x04
|-
| FALCON_TIME_HIGH
| 0x54501030
| 0x04
|-
| FALCON_WDTMR_TIME
| 0x54501034
| 0x04
|-
| FALCON_WDTMR_ENABLE
| 0x54501038
| 0x04
|-
| [[#FALCON_SCRATCH0|FALCON_SCRATCH0]]
| 0x54501040
| 0x04
|-
| [[#FALCON_SCRATCH1|FALCON_SCRATCH1]]
| 0x54501044
| 0x04
|-
| [[#FALCON_ITFEN|FALCON_ITFEN]]
| 0x54501048
| 0x04
|-
| [[#FALCON_IDLESTATE|FALCON_IDLESTATE]]
| 0x5450104C
| 0x04
|-
| FALCON_CURCTX
| 0x54501050
| 0x04
|-
| FALCON_NXTCTX
| 0x54501054
| 0x04
|-
| FALCON_CMDCTX
| 0x54501058
| 0x04
|-
| FALCON_STATUS_MASK
| 0x5450105C
| 0x04
|-
| FALCON_VM_SUPERVISOR
| 0x54501060
| 0x04
|-
| FALCON_MTHD_DATA
| 0x54501064
| 0x04
|-
| FALCON_MTHD_CMD
| 0x54501068
| 0x04
|-
| FALCON_MTHD_DATA_WR
| 0x5450106C
| 0x04
|-
| FALCON_MTHD_OCCUPIED
| 0x54501070
| 0x04
|-
| FALCON_MTHD_ACK
| 0x54501074
| 0x04
|-
| FALCON_MTHD_LIMIT
| 0x54501078
| 0x04
|-
| FALCON_SUBENGINE_RESET
| 0x5450107C
| 0x04
|-
| FALCON_SCRATCH2
| 0x54501080
| 0x04
|-
| FALCON_SCRATCH3
| 0x54501084
| 0x04
|-
| FALCON_PM_TRIGGER
| 0x54501088
| 0x04
|-
| FALCON_PM_MODE
| 0x5450108C
| 0x04
|-
| FALCON_DEBUG1
| 0x54501090
| 0x04
|-
| [[#FALCON_DEBUGINFO|FALCON_DEBUGINFO]]
| 0x54501094
| 0x04
|-
| FALCON_BREAKPOINT0
| 0x54501098
| 0x04
|-
| FALCON_BREAKPOINT1
| 0x5450109C
| 0x04
|-
| FALCON_CGCTL
| 0x545010A0
| 0x04
|-
| FALCON_ENGCTL
| 0x545010A4
| 0x04
|-
| FALCON_PM_SEL
| 0x545010A8
| 0x04
|-
| FALCON_HOST_IO_INDEX
| 0x545010AC
| 0x04
|-
| [[#FALCON_EXCI|FALCON_EXCI]]
| 0x545010D0
| 0x04
|-
| [[#FALCON_CPUCTL|FALCON_CPUCTL]]
| 0x54501100
| 0x04
|-
| [[#FALCON_BOOTVEC|FALCON_BOOTVEC]]
| 0x54501104
| 0x04
|-
| [[#FALCON_HWCFG|FALCON_HWCFG]]
| 0x54501108
| 0x04
|-
| [[#FALCON_DMACTL|FALCON_DMACTL]]
| 0x5450110C
| 0x04
|-
| [[#FALCON_DMATRF_EXTBASE|FALCON_DMATRF_EXTBASE]]
| 0x54501110
| 0x04
|-
| [[#FALCON_DMATRF_VOFF|FALCON_DMATRF_VOFF]]
| 0x54501114
| 0x04
|-
| [[#FALCON_DMATRFCMD|FALCON_DMATRFCMD]]
| 0x54501118
| 0x04
|-
| [[#FALCON_DMATRF_POFF|FALCON_DMATRF_POFF]]
| 0x5450111C
| 0x04
|-
| [[#FALCON_DMATRFSTAT|FALCON_DMATRFSTAT]]
| 0x54501120
| 0x04
|-
| [[#FALCON_CRYPTTRFSTAT|FALCON_CRYPTTRFSTAT]]
| 0x54501124
| 0x04
|-
| FALCON_CPUSTAT
| 0x54501128
| 0x04
|-
| [[#FALCON_HWCFG2|FALCON_HWCFG2]]
| 0x5450112C
| 0x04
|-
| FALCON_CPUCTL_ALIAS
| 0x54501130
| 0x04
|-
| FALCON_TLB_CMD
| 0x54501140
| 0x04
|-
| FALCON_TLB_CMD_RES
| 0x54501144
| 0x04
|-
| FALCON_BRANCH_HISTORY_CTRL
| 0x54501148
| 0x04
|-
| FALCON_BRANCH_HISTORY_PC
| 0x5450114C
| 0x04
|-
| FALCON_IMFILLRNG0
| 0x54501150
| 0x04
|-
| FALCON_IMFILLRNG1
| 0x54501154
| 0x04
|-
| FALCON_IMFILLCTL
| 0x54501158
| 0x04
|-
| FALCON_EXTERRWIN
| 0x54501160
| 0x04
|-
| FALCON_EXTERRCFG
| 0x54501164
| 0x04
|-
| FALCON_EXTERRADDR
| 0x54501168
| 0x04
|-
| FALCON_EXTERRSTAT
| 0x5450116C
| 0x04
|-
| FALCON_CG2
| 0x5450117C
| 0x04
|-
| FALCON_CODE_INDEX
| 0x54501180
| 0x04
|-
| FALCON_CODE
| 0x54501184
| 0x04
|-
| FALCON_CODE_VIRT_ADDR
| 0x54501188
| 0x04
|-
| FALCON_DATA_INDEX0
| 0x545011C0
| 0x04
|-
| FALCON_DATA0
| 0x545011C4
| 0x04
|-
| FALCON_DATA_INDEX1
| 0x545011C8
| 0x04
|-
| FALCON_DATA1
| 0x545011CC
| 0x04
|-
| FALCON_DATA_INDEX2
| 0x545011D0
| 0x04
|-
| FALCON_DATA2
| 0x545011D4
| 0x04
|-
| FALCON_DATA_INDEX3
| 0x545011D8
| 0x04
|-
| FALCON_DATA3
| 0x545011DC
| 0x04
|-
| FALCON_DATA_INDEX4
| 0x545011E0
| 0x04
|-
| FALCON_DATA4
| 0x545011E4
| 0x04
|-
| FALCON_DATA_INDEX5
| 0x545011E8
| 0x04
|-
| FALCON_DATA5
| 0x545011EC
| 0x04
|-
| FALCON_DATA_INDEX6
| 0x545011F0
| 0x04
|-
| FALCON_DATA6
| 0x545011F4
| 0x04
|-
| FALCON_DATA_INDEX7
| 0x545011F8
| 0x04
|-
| FALCON_DATA7
| 0x545011FC
| 0x04
|-
| [[#FALCON_ICD_CMD|FALCON_ICD_CMD]]
| 0x54501200
| 0x04
|-
| FALCON_ICD_ADDR
| 0x54501204
| 0x04
|-
| FALCON_ICD_WDATA
| 0x54501208
| 0x04
|-
| FALCON_ICD_RDATA
| 0x5450120C
| 0x04
|-
| [[#FALCON_SCTL|FALCON_SCTL]]
| 0x54501240
| 0x04
|-
| [[#TSEC_SCP_CTL_ACCESS|TSEC_SCP_CTL_ACCESS]]
| 0x54501400
| 0x04
|-
| [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]]
| 0x54501404
| 0x04
|-
| [[#TSEC_SCP_CTL_STAT|TSEC_SCP_CTL_STAT]]
| 0x54501408
| 0x04
|-
| [[#TSEC_SCP_CTL_MODE|TSEC_SCP_CTL_MODE]]
| 0x5450140C
| 0x04
|-
| TSEC_SCP_UNK0
| 0x54501410
| 0x04
|-
| [[#TSEC_SCP_CTL_PKEY|TSEC_SCP_CTL_PKEY]]
| 0x54501418
| 0x04
|-
| [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]]
| 0x54501420
| 0x04
|-
| [[#TSEC_SCP_SEQ_STAT|TSEC_SCP_SEQ_STAT]]
| 0x54501428
| 0x04
|-
| [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]]
| 0x54501430
| 0x04
|-
| TSEC_SCP_UNK2
| 0x54501454
| 0x04
|-
| [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]]
| 0x54501458
| 0x04
|-
| TSEC_SCP_UNK3
| 0x54501470
| 0x04
|-
| [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT]]
| 0x54501480
| 0x04
|-
| [[#TSEC_SCP_IRQMASK|TSEC_SCP_IRQMASK]]
| 0x54501484
| 0x04
|-
| TSEC_SCP_UNK4
| 0x54501490
| 0x04
|-
| [[#TSEC_SCP_ERR|TSEC_SCP_ERR]]
| 0x54501498
| 0x04
|-
| TSEC_TRNG_CLKDIV
| 0x54501500
| 0x04
|-
| TSEC_TRNG_UNK0
| 0x54501504
| 0x04
|-
| TSEC_TRNG_UNK1
| 0x5450150C
| 0x04
|-
| TSEC_TRNG_UNK2
| 0x54501510
| 0x04
|-
| TSEC_TRNG_UNK3
| 0x54501514
| 0x04
|-
| TSEC_TRNG_UNK4
| 0x54501518
| 0x04
|-
| TSEC_TRNG_UNK5
| 0x5450151C
| 0x04
|-
| TSEC_TRNG_UNK6
| 0x54501528
| 0x04
|-
| TSEC_TRNG_UNK7
| 0x5450152C
| 0x04
|-
| TSEC_TFBIF_UNK0
| 0x54501600
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL|TSEC_TFBIF_MCCIF_FIFOCTRL]]
| 0x54501604
| 0x04
|-
| TSEC_TFBIF_UNK1
| 0x54501608
| 0x04
|-
| TSEC_TFBIF_UNK2
| 0x5450160C
| 0x04
|-
| TSEC_TFBIF_UNK3
| 0x54501630
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL1|TSEC_TFBIF_MCCIF_FIFOCTRL1]]
| 0x54501634
| 0x04
|-
| TSEC_TFBIF_UNK4
| 0x54501640
| 0x04
|-
| [[#TSEC_TFBIF_UNK5|TSEC_TFBIF_UNK5]]
| 0x54501644
| 0x04
|-
| [[#TSEC_TFBIF_UNK6|TSEC_TFBIF_UNK6]]
| 0x54501648
| 0x04
|-
| [[#TSEC_DMA_CMD|TSEC_DMA_CMD]]
| 0x54501700
| 0x04
|-
| [[#TSEC_DMA_ADDR|TSEC_DMA_ADDR]]
| 0x54501704
| 0x04
|-
| [[#TSEC_DMA_VAL|TSEC_DMA_VAL]]
| 0x54501708
| 0x04
|-
| [[#TSEC_DMA_UNK|TSEC_DMA_UNK]]
| 0x5450170C
| 0x04
|-
| TSEC_TEGRA_FALCON_IP_VER
| 0x54501800
| 0x04
|-
| TSEC_TEGRA_UNK0
| 0x54501824
| 0x04
|-
| TSEC_TEGRA_UNK1
| 0x54501828
| 0x04
|-
| TSEC_TEGRA_UNK2
| 0x5450182C
| 0x04
|-
| [[#TSEC_TEGRA_CTL|TSEC_TEGRA_CTL]]
| 0x54501838
| 0x04
|}

=== TSEC_THI_METHOD0 ===
{| class="wikitable" border="1"
! ID
! Method
|-
| 0x200
| SET_APPLICATION_ID
|-
| 0x300
| EXECUTE
|-
| 0x500
| HDCP_INIT
|-
| 0x504
| HDCP_CREATE_SESSION
|-
| 0x508
| HDCP_VERIFY_CERT_RX
|-
| 0x50C
| HDCP_GENERATE_EKM
|-
| 0x510
| HDCP_REVOCATION_CHECK
|-
| 0x514
| HDCP_VERIFY_HPRIME
|-
| 0x518
| HDCP_ENCRYPT_PAIRING_INFO
|-
| 0x51C
| HDCP_DECRYPT_PAIRING_INFO
|-
| 0x520
| HDCP_UPDATE_SESSION
|-
| 0x524
| HDCP_GENERATE_LC_INIT
|-
| 0x528
| HDCP_VERIFY_LPRIME
|-
| 0x52C
| HDCP_GENERATE_SKE_INIT
|-
| 0x530
| HDCP_VERIFY_VPRIME
|-
| 0x534
| HDCP_ENCRYPTION_RUN_CTRL
|-
| 0x538
| HDCP_SESSION_CTRL
|-
| 0x53C
| HDCP_COMPUTE_SPRIME
|-
| 0x540
| HDCP_GET_CERT_RX
|-
| 0x544
| HDCP_EXCHANGE_INFO
|-
| 0x548
| HDCP_DECRYPT_KM
|-
| 0x54C
| HDCP_GET_HPRIME
|-
| 0x550
| HDCP_GENERATE_EKH_KM
|-
| 0x554
| HDCP_VERIFY_RTT_CHALLENGE
|-
| 0x558
| HDCP_GET_LPRIME
|-
| 0x55C
| HDCP_DECRYPT_KS
|-
| 0x560
| HDCP_DECRYPT
|-
| 0x564
| HDCP_GET_RRX
|-
| 0x568
| HDCP_DECRYPT_REENCRYPT
|-
| 0x56C
|
|-
| 0x570
|
|-
| 0x574
|
|-
| 0x578
|
|-
| 0x57C
|
|-
| 0x700
| HDCP_VALIDATE_SRM
|-
| 0x704
| HDCP_VALIDATE_STREAM
|-
| 0x708
| HDCP_TEST_SECURE_STATUS
|-
| 0x70C
| HDCP_SET_DCP_KPUB
|-
| 0x710
| HDCP_SET_RX_KPUB
|-
| 0x714
| HDCP_SET_CERT_RX
|-
| 0x718
| HDCP_SET_SCRATCH_BUFFER
|-
| 0x71C
| HDCP_SET_SRM
|-
| 0x720
| HDCP_SET_RECEIVER_ID_LIST
|-
| 0x724
| HDCP_SET_SPRIME
|-
| 0x728
| HDCP_SET_ENC_INPUT_BUFFER
|-
| 0x72C
| HDCP_SET_ENC_OUTPUT_BUFFER
|-
| 0x730
| HDCP_GET_RTT_CHALLENGE
|-
| 0x734
| HDCP_STREAM_MANAGE
|-
| 0x738
| HDCP_READ_CAPS
|-
| 0x73C
| HDCP_ENCRYPT
|-
| 0x740
| [6.0.0+] HDCP_GET_CURRENT_NONCE
|}

Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_METHOD1 ===
Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_INT_STATUS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_STATUS_FALCON_INT
|}

=== TSEC_THI_INT_MASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_MASK_FALCON_INT
|}

=== FALCON_IRQSSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSSET_GPTMR
|-
| 1
| FALCON_IRQSSET_WDTMR
|-
| 2
| FALCON_IRQSSET_MTHD
|-
| 3
| FALCON_IRQSSET_CTXSW
|-
| 4
| FALCON_IRQSSET_HALT
|-
| 5
| FALCON_IRQSSET_EXTERR
|-
| 6
| FALCON_IRQSSET_SWGEN0
|-
| 7
| FALCON_IRQSSET_SWGEN1
|-
| 8-15
| FALCON_IRQSSET_EXT
|}

Used for setting Falcon's IRQs.

=== FALCON_IRQSCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSCLR_GPTMR
|-
| 1
| FALCON_IRQSCLR_WDTMR
|-
| 2
| FALCON_IRQSCLR_MTHD
|-
| 3
| FALCON_IRQSCLR_CTXSW
|-
| 4
| FALCON_IRQSCLR_HALT
|-
| 5
| FALCON_IRQSCLR_EXTERR
|-
| 6
| FALCON_IRQSCLR_SWGEN0
|-
| 7
| FALCON_IRQSCLR_SWGEN1
|-
| 8-15
| FALCON_IRQSCLR_EXT
|}

Used for clearing Falcon's IRQs.

=== FALCON_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSTAT_GPTMR
|-
| 1
| FALCON_IRQSTAT_WDTMR
|-
| 2
| FALCON_IRQSTAT_MTHD
|-
| 3
| FALCON_IRQSTAT_CTXSW
|-
| 4
| FALCON_IRQSTAT_HALT
|-
| 5
| FALCON_IRQSTAT_EXTERR
|-
| 6
| FALCON_IRQSTAT_SWGEN0
|-
| 7
| FALCON_IRQSTAT_SWGEN1
|-
| 8-15
| FALCON_IRQSTAT_EXT
|}

Used for getting the status of Falcon's IRQs.

=== FALCON_IRQMODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMODE_GPTMR
|-
| 1
| FALCON_IRQMODE_WDTMR
|-
| 2
| FALCON_IRQMODE_MTHD
|-
| 3
| FALCON_IRQMODE_CTXSW
|-
| 4
| FALCON_IRQMODE_HALT
|-
| 5
| FALCON_IRQMODE_EXTERR
|-
| 6
| FALCON_IRQMODE_SWGEN0
|-
| 7
| FALCON_IRQMODE_SWGEN1
|-
| 8-15
| FALCON_IRQMODE_EXT
|}

Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.

=== FALCON_IRQMSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMSET_GPTMR
|-
| 1
| FALCON_IRQMSET_WDTMR
|-
| 2
| FALCON_IRQMSET_MTHD
|-
| 3
| FALCON_IRQMSET_CTXSW
|-
| 4
| FALCON_IRQMSET_HALT
|-
| 5
| FALCON_IRQMSET_EXTERR
|-
| 6
| FALCON_IRQMSET_SWGEN0
|-
| 7
| FALCON_IRQMSET_SWGEN1
|-
| 8-15
| FALCON_IRQMSET_EXT
|}

Used for setting the mask for Falcon's IRQs.

=== FALCON_IRQMCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMCLR_GPTMR
|-
| 1
| FALCON_IRQMCLR_WDTMR
|-
| 2
| FALCON_IRQMCLR_MTHD
|-
| 3
| FALCON_IRQMCLR_CTXSW
|-
| 4
| FALCON_IRQMCLR_HALT
|-
| 5
| FALCON_IRQMCLR_EXTERR
|-
| 6
| FALCON_IRQMCLR_SWGEN0
|-
| 7
| FALCON_IRQMCLR_SWGEN1
|-
| 8-15
| FALCON_IRQMCLR_EXT
|}

Used for clearing the mask for Falcon's IRQs.

=== FALCON_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMASK_GPTMR
|-
| 1
| FALCON_IRQMASK_WDTMR
|-
| 2
| FALCON_IRQMASK_MTHD
|-
| 3
| FALCON_IRQMASK_CTXSW
|-
| 4
| FALCON_IRQMASK_HALT
|-
| 5
| FALCON_IRQMASK_EXTERR
|-
| 6
| FALCON_IRQMASK_SWGEN0
|-
| 7
| FALCON_IRQMASK_SWGEN1
|-
| 8-15
| FALCON_IRQMASK_EXT
|}

Used for getting the value of the mask for Falcon's IRQs.

=== FALCON_IRQDEST ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQDEST_HOST_GPTMR
|-
| 1
| FALCON_IRQDEST_HOST_WDTMR
|-
| 2
| FALCON_IRQDEST_HOST_MTHD
|-
| 3
| FALCON_IRQDEST_HOST_CTXSW
|-
| 4
| FALCON_IRQDEST_HOST_HALT
|-
| 5
| FALCON_IRQDEST_HOST_EXTERR
|-
| 6
| FALCON_IRQDEST_HOST_SWGEN0
|-
| 7
| FALCON_IRQDEST_HOST_SWGEN1
|-
| 8-15
| FALCON_IRQDEST_HOST_EXT
|-
| 16
| FALCON_IRQDEST_TARGET_GPTMR
|-
| 17
| FALCON_IRQDEST_TARGET_WDTMR
|-
| 18
| FALCON_IRQDEST_TARGET_MTHD
|-
| 19
| FALCON_IRQDEST_TARGET_CTXSW
|-
| 20
| FALCON_IRQDEST_TARGET_HALT
|-
| 21
| FALCON_IRQDEST_TARGET_EXTERR
|-
| 22
| FALCON_IRQDEST_TARGET_SWGEN0
|-
| 23
| FALCON_IRQDEST_TARGET_SWGEN1
|-
| 24-31
| FALCON_IRQDEST_TARGET_EXT
|}

Used for routing Falcon's IRQs.

=== FALCON_SCRATCH0 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_SCRATCH1 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_ITFEN ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_ITFEN_CTXEN
|-
| 1
| FALCON_ITFEN_MTHDEN
|}

Used for enabling/disabling Falcon interfaces.

=== FALCON_IDLESTATE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IDLESTATE_FALCON_BUSY
|-
| 1-15
| FALCON_IDLESTATE_EXT_BUSY
|}

Used for detecting if Falcon is busy or not.

=== FALCON_DEBUGINFO ===
Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.

[6.0.0+] [[NV_services|nvservices]] sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.

=== FALCON_EXCI ===
Contains information about raised exceptions.

=== FALCON_CPUCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_CPUCTL_IINVAL
|-
| 1
| FALCON_CPUCTL_STARTCPU
|-
| 2
| FALCON_CPUCTL_SRESET
|-
| 3
| FALCON_CPUCTL_HRESET
|-
| 4
| FALCON_CPUCTL_HALTED
|-
| 5
| FALCON_CPUCTL_STOPPED
|-
| 6
| FALCON_CPUCTL_START_SCP_LS
|}

Used for signaling the Falcon CPU.

=== FALCON_BOOTVEC ===
Takes the Falcon's boot vector address.

=== FALCON_HWCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-8
| FALCON_HWCFG_IMEM_SIZE
|-
| 9-17
| FALCON_HWCFG_DMEM_SIZE
|-
| 18-25
| FALCON_HWCFG_MTHD_SIZE
|-
| 26-31
| FALCON_HWCFG_DMATRF_SLOTS
|}

=== FALCON_DMACTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMACTL_REQUIRE_CTX
|-
| 1
| FALCON_DMACTL_DMEM_SCRUBBING
|-
| 2
| FALCON_DMACTL_IMEM_SCRUBBING
|-
| 3-6
| FALCON_DMACTL_DMAQ_NUM
|-
| 7
| FALCON_DMACTL_SECURE_STAT
|}

Used for configuring the Falcon's DMA engine.

=== FALCON_DMATRF_EXTBASE ===
Base of the external memory buffer.

The base of the transfer is calculated by adding [[#FALCON_DMATRF_POFF]] to the base.

=== FALCON_DMATRF_VOFF ===
For transfers to DMEM: the destination address.
For transfers to IMEM: the destination virtual IMEM page.

=== FALCON_DMATRF_POFF ===
For transfers to IMEM: the destination physical IMEM page.

=== FALCON_DMATRFCMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFCMD_FULL
|-
| 1
| FALCON_DMATRFCMD_IDLE
|-
| 2-3
| FALCON_DMATRFCMD_SEC
|-
| 4
| FALCON_DMATRFCMD_IMEM
|-
| 5
| FALCON_DMATRFCMD_WRITE
|-
| 8-10
| FALCON_DMATRFCMD_SIZE
|-
| 12-14
| FALCON_DMATRFCMD_CTXDMA
|}

Used for configuring DMA transfers.

=== FALCON_DMATRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFSTAT_PENDING
|-
| 16-18
| FALCON_DMATRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_DMATRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_CRYPTTRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| FALCON_CRYPTTRFSTAT_PENDING
|-
| 5
| FALCON_CRYPTTRFSTAT_ENABLED
|-
| 16-18
| FALCON_CRYPTTRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_CRYPTTRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_HWCFG2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_HWCFG2_VERSION
|-
| 4-5
| FALCON_HWCFG2_SCP_MODE
|-
| 6-7
| FALCON_HWCFG2_SUBVERSION
|-
| 8-11
| FALCON_HWCFG2_IMEM_PORTS
|-
| 12-15
| FALCON_HWCFG2_DMEM_PORTS
|-
| 16-19
| FALCON_HWCFG2_VM_PAGES_LOG2
|}

=== FALCON_ICD_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_ICD_CMD_OPC
0x0: BREAK
0x1: CONTINUE_FROM_PC
0x2: CONTINUE_FROM_ADDR
0x3: CONTINUE_UNK1_FROM_PC
0x4: CONTINUE_UNK1_FROM_ADDR
0x5: SINGLE_STEP_FROM_PC
0x6: SINGLE_STEP_FROM_ADDR
0x7: SET_BREAK_MASK
0x8: REG_READ
0x9: REG_WRITE
0xA: DATA_READ
0xB: DATA_WRITE
0xC: IO_READ
0xD: IO_WRITE
0xE: STATUS_READ
|-
| 6-7
| FALCON_ICD_CMD_DATA_SIZE
|-
| 8-12
| FALCON_ICD_CMD_IDX
|-
| 14
| FALCON_ICD_CMD_ERROR
|-
| 15
| FALCON_ICD_CMD_DONE
|-
| 16-31
| FALCON_ICD_CMD_BREAK_MASK
|}

=== FALCON_SCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| FALCON_SCTL_SEC_MODE
0: Non-secure
1: Light Secure
2: Heavy Secure
|-
| 4-5
| FALCON_SCTL_OLD_SEC_MODE
0: Non-secure
1: Light Secure
2: Heavy Secure
|-
| 12-13
| Unknown
|-
| 14
| Initialize the transition to LS mode
|}

=== TSEC_SCP_CTL_ACCESS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| Enable TSEC_SCP_INSN_STAT register
|}

=== TSEC_SCP_CTL_TRNG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 11
| Unknown
|-
| 12
| Enable the TRNG
|}

=== TSEC_SCP_CTL_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| TSEC_SCP_CTL_STAT_DEBUG_MODE
|}

=== TSEC_SCP_CTL_MODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Disable reads for the TRNG register block
|-
| 1
| Disable reads for the TFBIF register block
|-
| 2
| Disable reads for the DMA register block
|-
| 3
| Disable reads for the TEGRA register block
|-
| 4
| Disable writes for the TRNG register block
|-
| 5
| Disable writes for the TFBIF register block
|-
| 6
| Disable writes for the DMA register block
|-
| 7
| Disable writes for the TEGRA register block
|}

Controls accesses to the other sub-engines and can only be cleared in Heavy Secure mode.

=== TSEC_SCP_CTL_PKEY ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
|-
| 1
| TSEC_SCP_CTL_PKEY_LOADED
|}

=== TSEC_SCP_SEQ0_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 8-11
| Size of current cs0begin macro
|-
|}

=== TSEC_SCP_SEQ_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Set if crypto sequence recording (cs0begin/cs1begin) is active
|-
| 4-7
| Number of instructions left for the crypto sequence
|-
| 12-15
| Active crypto key register
|}

Contains information on the last crypto sequence (cs0 or cs1) executed.

=== TSEC_SCP_INSN_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Crypto fuc5 destination register or immediate value
|-
| 8-13
| Crypto fuc5 source register or immediate value
|-
| 20-24
| Crypto fuc5 operation
0x0: nop (fuc5 opcode 0x00)
0x1: cmov (fuc5 opcode 0x84)
0x2: cxsin (fuc5 opcode 0x88) or xdst (with cxset)
0x3: cxsout (fuc5 opcode 0x8C) or xdld (with cxset)
0x4: crnd (fuc5 opcode 0x90)
0x5: cs0begin (fuc5 opcode 0x94)
0x6: cs0exec (fuc5 opcode 0x98)
0x7: cs1begin (fuc5 opcode 0x9C)
0x8: cs1exec (fuc5 opcode 0xA0)
0x9: invalid (fuc5 opcode 0xA4)
0xA: cchmod (fuc5 opcode 0xA8)
0xB: cxor (fuc5 opcode 0xAC)
0xC: cadd (fuc5 opcode 0xB0)
0xD: cand (fuc5 opcode 0xB4)
0xE: crev (fuc5 opcode 0xB8)
0xF: cprecmac (fuc5 opcode 0xBC)
0x10: csecret (fuc5 opcode 0xC0)
0x11: ckeyreg (fuc5 opcode 0xC4)
0x12: ckexp (fuc5 opcode 0xC8)
0x13: ckrexp (fuc5 opcode 0xCC)
0x14: cenc (fuc5 opcode 0xD0)
0x15: cdec (fuc5 opcode 0xD4)
0x16: csigauth (fuc5 opcode 0xD8)
0x17: csigenc (fuc5 opcode 0xDC)
0x18: csigclr (fuc5 opcode 0xE0)
|-
| 28
| Unknown
|-
| 31
| Set if running in secure mode (cauth)
|}

Contains information on the last crypto instruction executed.

=== TSEC_SCP_AES_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-4
| First opcode
|-
| 5-9
| Second opcode
|-
| 15-16
| AES operation
0: Encryption
1: Decryption
2: Key expansion
3: Key reverse expansion
|}

Contains information on the last AES sequence executed.

=== TSEC_SCP_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQSTAT_TRNG
|-
| 8
| TSEC_SCP_IRQSTAT_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQSTAT_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQSTAT_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the status of crypto IRQs.

=== TSEC_SCP_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQMASK_TRNG
|-
| 8
| TSEC_SCP_IRQMASK_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQMASK_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQMASK_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the value of the mask for crypto IRQs.

=== TSEC_SCP_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Invalid instruction
|-
| 4
| Empty crypto sequence
|-
| 8
| Crypto sequence is too long
|-
| 12
| Crypto sequence was not finished
|-
| 16
| Invalid cauth signature (during csigenc, csigclr or csigunk)
|-
| 24
| Forbidden instruction
|}

Contains information on crypto errors generated by the [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT_INSN_ERROR]] IRQ.

=== TSEC_TFBIF_MCCIF_FIFOCTRL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
|-
| 1
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
|-
| 2
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
|-
| 3
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
|-
| 4
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
|-
| 5
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
|-
| 6
| TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
|-
| 7
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
|-
| 8
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE
|}

=== TSEC_MCCIF_FIFOCTRL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
|-
| 16-31
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT
|}

=== TSEC_TFBIF_UNK5 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.

=== TSEC_TFBIF_UNK6 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to (data_size << 4) before reading memory from the GPU UCODE carveout.

=== TSEC_DMA_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_DMA_CMD_READ
|-
| 1
| TSEC_DMA_CMD_WRITE
|-
| 4-7
| TSEC_DMA_CMD_UNK
|-
| 12
| TSEC_DMA_CMD_BUSY
|-
| 13
| TSEC_DMA_CMD_ERROR
|-
| 31
| TSEC_DMA_CMD_INIT
|}

A DMA read/write operation requires bits TSEC_DMA_CMD_INIT and TSEC_DMA_CMD_READ/TSEC_DMA_CMD_WRITE to be set in TSEC_DMA_CMD.

During the transfer, the TSEC_DMA_CMD_BUSY bit is set.

Accessing an invalid address causes bit TSEC_DMA_CMD_ERROR to be set.

=== TSEC_DMA_ADDR ===
Takes the address for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_VAL ===
Takes the value for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_UNK ===
Always 0xFFF.

=== TSEC_TEGRA_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 16
| TSEC_TEGRA_CTL_TKFI_KFUSE
|-
| 17
| TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
|-
| 24
| TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
|-
| 25
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
|-
| 26
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
|-
| 27
| TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C
|}

== SCP ==
Part of the information here (which hasn't made it into envytools documentation yet) was shared by [https://wiki.0x04.net/wiki/Marcin_Ko%C5%9Bcielnicki mwk] from reverse engineering falcon processors over the years.

=== Authenticated Mode ===
==== Entry ====
From non-secure mode, upon jumping to a page marked as secret, a secret fault occurs. This causes the CPU to verify the region specified in $cauth against the MAC loaded in $c6. If the comparison is successful, the valid bit (bit0) is set on all pages in the $cauth region, and $pc is set to the base of the $cauth region. If the comparsion fails, the CPU is halted.

==== Exit ====
The CPU automatically goes back to non-secure mode when returning back into non-secret pages. When this happens, the valid bit (bit0) in the TLB flags is cleared for all secret pages.

==== Implementation ====
Under certain circumstances, it is possible to observe [[#csigauth|csigauth]] being briefly written to [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]] as "csigauth $c4 $c6" while the opcodes in [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]] are set to "cxsin" and "csigauth", respectively.

Via [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]] it can be observed that a 3-sized macro sequence is loaded into cs0 during a secure mode transition.

=== Operations ===
{| class="wikitable" border="1"
! Opcode
! Name
! Operand0
! Operand1
! Operation
! Condition
|-
| 0 || nop || N/A || N/A || ||
|-
| 1 || mov || $cX || $cY || <code>$cX = $cY; ACL(X) = ACL(Y);</code> ||
|-
| 2 || sin || $cX || N/A || <code>$cX = read_stream(); ACL(X) = ???;</code> ||
|-
| 3 || sout || $cX || N/A || <code>write_stream($cX);</code> || ?
|-
| 4 || rnd || $cX || N/A || <code>$cX = read_trng(); ACL(X) = ???;</code> ||
|-
| 5 || s0begin || immX || N/A || <code>record_macro_for_N_instructions(0, immX);</code> ||
|-
| 6 || s0exec || immX || N/A || <code>execute_macro_N_times(0, immX);</code> ||
|-
| 7 || s1begin || immX || N/A || <code>record_macro_for_N_instructions(1, immX);</code> ||
|-
| 8 || s1exec || immX || N/A || <code>execute_macro_N_times(1, immX);</code> ||
|-
| 9 || <invalid> || || || ||
|-
| 0xA || chmod || $cX || immY || Complicated, see [[#ACL|ACL]]. ||
|-
| 0xB || xor || $cX || $cY || <code>$cX ^= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xC || add || $cX || immY || <code>$cX += immY;</code> || <code>(ACL(X) & 2)</code>
|-
| 0xD || and || $cX || $cY || <code>$cX &= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xE || rev || $cX || $cY || <code>$cX = endian_swap128($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0xF || gfmul || $cX || $cY || <code>$cX = gfmul($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 2)</code>
|-
| 0x10 || secret || $cX || immY || <code>$cX = load_secret(immY); ACL(X) = load_secret_acl(immY);</code> ||
|-
| 0x11 || keyreg || immX || N/A || <code>active_key_idx = immX;</code> ||
|-
| 0x12 || kexp || $cX || $cY || <code>$cX = aes_kexp($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0x13 || krexp || $cX || $cY || <code>$cX = aes_kexp_reverse($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0x14 || enc || $cX || $cY || <code>$cX = aes_enc(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 1) && (ACL(Y) & 2)</code>
|-
| 0x15 || dec || $cX || $cY || <code>$cX = aes_dec(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 1) && (ACL(Y) & 2)</code>
|-
| 0x16 || csigauth || $cX || $cY || <code>if (hash_verify($cX, $cY)) { has_sig = true; current_sig = $cX; }</code> || ?
|-
| 0x17 || csigclr || N/A || N/A || <code>has_sig = false;</code> ||
|-
| 0x18 || csigenc || $cX || $cY || <code>if (has_sig) $cX = aes_enc(current_sig, $cY);</code> || ?
|}

==== csigauth ====
<code>00000000: f5 3c XY d8 csigauth $cY $cX</code>

Takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret. This instruction does not work in secure mode.

==== csigclr ====
<code>00000000: f5 3c 00 e0 csigclr</code>

This instruction takes no operands and appears to clear the saved cauth signature used by the csigenc instruction.

==== cchmod ====
<code>00000000: f5 3c XY a8 cchmod $cY 0X</code> or <code>00000000: f5 3c XY a9 cchmod $cY 1X</code>

This instruction takes a crypto register and a 5 bit immediate value which represents the [[#ACL|ACL]] mask to set.

==== crnd ====
<code>00000000: f5 3c 0X 90 crnd $cX</code>

This instruction initializes a crypto register with random data.

Executing this instruction only succeeds if the TRNG is enabled for the SCP, which requires taking the following steps:
* Write 0x7FFF to TSEC_TRNG_CLKDIV.
* Write 0x3FF0000 to TSEC_TRNG_UNK0.
* Write 0xFF00 to TSEC_TRNG_UNK7.
* Write 0x1000 to [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]].

Otherwise it hangs forever.

=== ACL ===
{| class="wikitable" border="1"
! Bit
! Meaning
|-
| 0 || Secure key. Forced set if bit1 is set. Once cleared, cannot be set again.
|-
| 1 || Secure readable. Once cleared, cannot be set again.
|-
| 2 || Insecure key. Forced set if bit3 is set. Forced clear if bit0 is clear. Can be toggled back and forth.
|-
| 3 || Insecure readable. Forced clear if bit1 is clear. Can be toggled back and forth.
|-
| 4 || Insecure overwritable. Can be toggled back and forth.
|}

==== Initial values ====
On SCP boot, the ACL is 0x1F for all $cX.

Loading into $cX using xdst instruction sets ACL($cX) to 0x13 and 0x1F, for secure and insecure mode respectively.

Spilling a $cX to DMEM using xdld instruction is allowed if (ACL($cX) & 2) or (ACL($cX) & 8), for secure and insecure mode respectively.

Loading a secret into $cX sets a per-secret ACL, unconditionally.

=== cauth ===
$cauth is a special purpose register in the CPU.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7 || Start of region to authenticate (in 0x100 pages)
|-
| 8-15 || Unknown
|-
| 16 || Use secret xfers (?)
|-
| 17 || Region is encrypted (?)
|-
| 18 || Unknown
|-
| 19 || Unknown
|-
| 20-23 || Unknown
|-
| 24-31 || Size of region to authenticate (in 0x100 pages)
|}

=== cxset ===
cxset instruction provides a way to change behavior of a variable amount of successively executed DMA-related instructions.

for example: <code>000000de: f4 3c 02 cxset 0x2</code>

can be read as: <code>dma_override(type=crypto_reg, count=2)</code>

The argument to cxset specifies the type of behavior change in the top 3 bits, and the number of DMA-related instructions the effect lasts for in the lower 5 bits.

{| class=wikitable
! Bits || Description
|-
| 0-4 || Number of instructions it is valid for (0x1f is a special value meaning infinitely many instructions -- until overriden by another cxset)
|-
| 5 || Crypto destination/source select (0=crypto register, 1=crypto stream)
|-
| 6 || External memory override (0=Disabled, 1=Enabled)
|-
| 7 || Internal memory select (0=DMEM, 1=IMEM)
|}

==== DMA-Related Instructions ====
At least the following instructions may have changed behavior, and count against the cxset "count" argument: <code>xdwait</code>, <code>xdst</code>, <code>xdld</code>.

For example, if override type=0b000, then the "length" argument to <code>xdst</code> is instead treated as the index of the target $cX register.

=== Secrets ===
Falcon's Authenticated Mode has access to 64 128-bit keys which are burned at factory. These keys can be loaded by using the $csecret instruction which takes the target crypto register and the key index as arguments.

{| class=wikitable
! Index || ACL || Console-unique || Notes
|-
| 0x00 || 0x07 || No || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares.
|-
| 0x10 || 0x10 || No || Used by nvhost_nvdec_bl020_prod firmware.
|-
| 0x02 || 0x10 || No ||
|-
| 0x03 || 0x11 || No || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|-
| 0x04 || 0x10 || No || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|-
| 0x11 || 0x13 || No || Used by nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares.
|-
| 0x06 || 0x11 || No ||
|-
| 0x13 || 0x11 || No || Used by [6.0.0+] nvhost_tsec firmware.
|-
| 0x08 || 0x10 || No ||
|-
| 0x09 || 0x13 || No || Used by nvhost_tsec firmware.
|-
| 0x0A || 0x11 || No ||
|-
| 0x0B || 0x10 || No || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|-
| 0x0C || 0x13 || No ||
|-
| 0x0D || 0x11 || No ||
|-
| 0x0E || 0x10 || No ||
|-
| 0x0F || 0x13 || No || Used by nvhost_tsec firmware.
|-
| 0x10 || 0x11 || No || Used by [1.0.0-5.1.0] nvhost_tsec firmware.
|-
| 0x11 || 0x10 || No ||
|-
| 0x12 || 0x13 || No ||
|-
| 0x13 || 0x11 || No ||
|-
| 0x14 || 0x10 || No ||
|-
| 0x15 || 0x13 || No || Used by nvhost_nvdec_bl020_prod, [5.0.0+] nvhost_nvdec020_prod, [5.0.0+] nvhost_nvdec020_ns and [6.0.0+] nvhost_tsec firmwares.
|-
| 0x16 || 0x11 || No ||
|-
| 0x17 || 0x10 || No ||
|-
| 0x18 || 0x13 || No ||
|-
| 0x19 || 0x11 || No ||
|-
| 0x1A || 0x10 || No ||
|-
| 0x1B || 0x13 || No ||
|-
| 0x1C || 0x11 || No ||
|-
| 0x1D || 0x10 || No ||
|-
| 0x1E || 0x13 || No ||
|-
| 0x1F || 0x11 || No ||
|-
| 0x20 || 0x10 || No ||
|-
| 0x21 || 0x13 || No ||
|-
| 0x22 || 0x11 || No ||
|-
| 0x23 || 0x10 || No ||
|-
| 0x24 || 0x13 || No ||
|-
| 0x25 || 0x11 || No ||
|-
| 0x26 || 0x10 || No || Used by [[TSEC_Firmware#KeygenLdr|KeygenLdr]].
|-
| 0x27 || 0x13 || No ||
|-
| 0x28 || 0x11 || No ||
|-
| 0x29 || 0x10 || No ||
|-
| 0x2A || 0x13 || No ||
|-
| 0x2B || 0x11 || No ||
|-
| 0x2C || 0x10 || No ||
|-
| 0x2D || 0x13 || No ||
|-
| 0x2E || 0x11 || No ||
|-
| 0x2F || 0x10 || No ||
|-
| 0x30 || 0x13 || No ||
|-
| 0x31 || 0x11 || No ||
|-
| 0x32 || 0x10 || No ||
|-
| 0x33 || 0x13 || No ||
|-
| 0x34 || 0x11 || No ||
|-
| 0x35 || 0x10 || No ||
|-
| 0x36 || 0x13 || No ||
|-
| 0x37 || 0x11 || No ||
|-
| 0x38 || 0x10 || No ||
|-
| 0x39 || 0x13 || No ||
|-
| 0x3A || 0x11 || No ||
|-
| 0x3B || 0x10 || No ||
|-
| 0x3C || 0x13 || No || Used by nvhost_tsec firmware.
|-
| 0x3D || 0x11 || No ||
|-
| 0x3E || 0x10 || No ||
|-
| 0x3F || 0x10 || Yes || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|}

TSEC

2019-01-09T20:45:14Z

Qlutoo:

TSEC (Tegra Security Co-processor) is a dedicated unit powered by a NVIDIA Falcon microprocessor with crypto extensions.

= Driver =
A host driver for communicating with the TSEC is mapped to physical address 0x54500000 with a total size of 0x40000 bytes and exposes several registers.

== Registers ==
Registers from 0x54500000 to 0x54501000 are used to configure the host interface (HOST1X).

Registers from 0x54501000 to 0x54502000 are a MMIO window for communicating with the Falcon microprocessor. From this range, the subset of registers from 0x54501400 to 0x54501FE8 are specific to the TSEC and are subdivided into:
* 0x54501400 to 0x54501500: SCP (Secure Crypto Processor?).
* 0x54501500 to 0x54501600: TRNG (True Random Number Generator).
* 0x54501600 to 0x54501700: TFBIF (Tegra Framebuffer Interface).
* 0x54501700 to 0x54501800: DMA.
* 0x54501800 to 0x54501900: TEGRA (miscellaneous interfaces).

{| class="wikitable" border="1"
! Name
! Address
! Width
|-
| TSEC_THI_INCR_SYNCPT
| 0x54500000
| 0x04
|-
| TSEC_THI_INCR_SYNCPT_ERR
| 0x54500008
| 0x04
|-
| TSEC_THI_CTXSW_INCR_SYNCPT
| 0x5450000C
| 0x04
|-
| TSEC_THI_CTXSW
| 0x54500020
| 0x04
|-
| TSEC_THI_CONT_SYNCPT_EOF
| 0x54500028
| 0x04
|-
| [[#TSEC_THI_METHOD0|TSEC_THI_METHOD0]]
| 0x54500040
| 0x04
|-
| [[#TSEC_THI_METHOD1|TSEC_THI_METHOD1]]
| 0x54500044
| 0x04
|-
| [[#TSEC_THI_INT_STATUS|TSEC_THI_INT_STATUS]]
| 0x54500078
| 0x04
|-
| [[#TSEC_THI_INT_MASK|TSEC_THI_INT_MASK]]
| 0x5450007C
| 0x04
|-
| TSEC_THI_SLCG_STATUS
| 0x54500084
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_HIGH_A
| 0x54500088
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_LOW_A
| 0x5450008C
| 0x04
|-
| TSEC_THI_CLK_OVERRIDE
| 0x54500E00
| 0x04
|-
| [[#FALCON_IRQSSET|FALCON_IRQSSET]]
| 0x54501000
| 0x04
|-
| [[#FALCON_IRQSCLR|FALCON_IRQSCLR]]
| 0x54501004
| 0x04
|-
| [[#FALCON_IRQSTAT|FALCON_IRQSTAT]]
| 0x54501008
| 0x04
|-
| [[#FALCON_IRQMODE|FALCON_IRQMODE]]
| 0x5450100C
| 0x04
|-
| [[#FALCON_IRQMSET|FALCON_IRQMSET]]
| 0x54501010
| 0x04
|-
| [[#FALCON_IRQMCLR|FALCON_IRQMCLR]]
| 0x54501014
| 0x04
|-
| [[#FALCON_IRQMASK|FALCON_IRQMASK]]
| 0x54501018
| 0x04
|-
| [[#FALCON_IRQDEST|FALCON_IRQDEST]]
| 0x5450101C
| 0x04
|-
| FALCON_GPTMR_PERIOD
| 0x54501020
| 0x04
|-
| FALCON_GPTMR_TIME
| 0x54501024
| 0x04
|-
| FALCON_GPTMR_ENABLE
| 0x54501028
| 0x04
|-
| FALCON_TIME_LOW
| 0x5450102C
| 0x04
|-
| FALCON_TIME_HIGH
| 0x54501030
| 0x04
|-
| FALCON_WDTMR_TIME
| 0x54501034
| 0x04
|-
| FALCON_WDTMR_ENABLE
| 0x54501038
| 0x04
|-
| [[#FALCON_SCRATCH0|FALCON_SCRATCH0]]
| 0x54501040
| 0x04
|-
| [[#FALCON_SCRATCH1|FALCON_SCRATCH1]]
| 0x54501044
| 0x04
|-
| [[#FALCON_ITFEN|FALCON_ITFEN]]
| 0x54501048
| 0x04
|-
| [[#FALCON_IDLESTATE|FALCON_IDLESTATE]]
| 0x5450104C
| 0x04
|-
| FALCON_CURCTX
| 0x54501050
| 0x04
|-
| FALCON_NXTCTX
| 0x54501054
| 0x04
|-
| FALCON_CMDCTX
| 0x54501058
| 0x04
|-
| FALCON_STATUS_MASK
| 0x5450105C
| 0x04
|-
| FALCON_VM_SUPERVISOR
| 0x54501060
| 0x04
|-
| FALCON_MTHD_DATA
| 0x54501064
| 0x04
|-
| FALCON_MTHD_CMD
| 0x54501068
| 0x04
|-
| FALCON_MTHD_DATA_WR
| 0x5450106C
| 0x04
|-
| FALCON_MTHD_OCCUPIED
| 0x54501070
| 0x04
|-
| FALCON_MTHD_ACK
| 0x54501074
| 0x04
|-
| FALCON_MTHD_LIMIT
| 0x54501078
| 0x04
|-
| FALCON_SUBENGINE_RESET
| 0x5450107C
| 0x04
|-
| FALCON_SCRATCH2
| 0x54501080
| 0x04
|-
| FALCON_SCRATCH3
| 0x54501084
| 0x04
|-
| FALCON_PM_TRIGGER
| 0x54501088
| 0x04
|-
| FALCON_PM_MODE
| 0x5450108C
| 0x04
|-
| FALCON_DEBUG1
| 0x54501090
| 0x04
|-
| [[#FALCON_DEBUGINFO|FALCON_DEBUGINFO]]
| 0x54501094
| 0x04
|-
| FALCON_BREAKPOINT0
| 0x54501098
| 0x04
|-
| FALCON_BREAKPOINT1
| 0x5450109C
| 0x04
|-
| FALCON_CGCTL
| 0x545010A0
| 0x04
|-
| FALCON_ENGCTL
| 0x545010A4
| 0x04
|-
| FALCON_PM_SEL
| 0x545010A8
| 0x04
|-
| FALCON_HOST_IO_INDEX
| 0x545010AC
| 0x04
|-
| [[#FALCON_EXCI|FALCON_EXCI]]
| 0x545010D0
| 0x04
|-
| [[#FALCON_CPUCTL|FALCON_CPUCTL]]
| 0x54501100
| 0x04
|-
| [[#FALCON_BOOTVEC|FALCON_BOOTVEC]]
| 0x54501104
| 0x04
|-
| [[#FALCON_HWCFG|FALCON_HWCFG]]
| 0x54501108
| 0x04
|-
| [[#FALCON_DMACTL|FALCON_DMACTL]]
| 0x5450110C
| 0x04
|-
| [[#FALCON_DMATRF_EXTBASE|FALCON_DMATRF_EXTBASE]]
| 0x54501110
| 0x04
|-
| [[#FALCON_DMATRF_VOFF|FALCON_DMATRF_VOFF]]
| 0x54501114
| 0x04
|-
| [[#FALCON_DMATRFCMD|FALCON_DMATRFCMD]]
| 0x54501118
| 0x04
|-
| [[#FALCON_DMATRF_POFF|FALCON_DMATRF_POFF]]
| 0x5450111C
| 0x04
|-
| [[#FALCON_DMATRFSTAT|FALCON_DMATRFSTAT]]
| 0x54501120
| 0x04
|-
| [[#FALCON_CRYPTTRFSTAT|FALCON_CRYPTTRFSTAT]]
| 0x54501124
| 0x04
|-
| FALCON_CPUSTAT
| 0x54501128
| 0x04
|-
| [[#FALCON_HWCFG2|FALCON_HWCFG2]]
| 0x5450112C
| 0x04
|-
| FALCON_CPUCTL_ALIAS
| 0x54501130
| 0x04
|-
| FALCON_TLB_CMD
| 0x54501140
| 0x04
|-
| FALCON_TLB_CMD_RES
| 0x54501144
| 0x04
|-
| FALCON_BRANCH_HISTORY_CTRL
| 0x54501148
| 0x04
|-
| FALCON_BRANCH_HISTORY_PC
| 0x5450114C
| 0x04
|-
| FALCON_IMFILLRNG0
| 0x54501150
| 0x04
|-
| FALCON_IMFILLRNG1
| 0x54501154
| 0x04
|-
| FALCON_IMFILLCTL
| 0x54501158
| 0x04
|-
| FALCON_EXTERRWIN
| 0x54501160
| 0x04
|-
| FALCON_EXTERRCFG
| 0x54501164
| 0x04
|-
| FALCON_EXTERRADDR
| 0x54501168
| 0x04
|-
| FALCON_EXTERRSTAT
| 0x5450116C
| 0x04
|-
| FALCON_CG2
| 0x5450117C
| 0x04
|-
| FALCON_CODE_INDEX
| 0x54501180
| 0x04
|-
| FALCON_CODE
| 0x54501184
| 0x04
|-
| FALCON_CODE_VIRT_ADDR
| 0x54501188
| 0x04
|-
| FALCON_DATA_INDEX0
| 0x545011C0
| 0x04
|-
| FALCON_DATA0
| 0x545011C4
| 0x04
|-
| FALCON_DATA_INDEX1
| 0x545011C8
| 0x04
|-
| FALCON_DATA1
| 0x545011CC
| 0x04
|-
| FALCON_DATA_INDEX2
| 0x545011D0
| 0x04
|-
| FALCON_DATA2
| 0x545011D4
| 0x04
|-
| FALCON_DATA_INDEX3
| 0x545011D8
| 0x04
|-
| FALCON_DATA3
| 0x545011DC
| 0x04
|-
| FALCON_DATA_INDEX4
| 0x545011E0
| 0x04
|-
| FALCON_DATA4
| 0x545011E4
| 0x04
|-
| FALCON_DATA_INDEX5
| 0x545011E8
| 0x04
|-
| FALCON_DATA5
| 0x545011EC
| 0x04
|-
| FALCON_DATA_INDEX6
| 0x545011F0
| 0x04
|-
| FALCON_DATA6
| 0x545011F4
| 0x04
|-
| FALCON_DATA_INDEX7
| 0x545011F8
| 0x04
|-
| FALCON_DATA7
| 0x545011FC
| 0x04
|-
| [[#FALCON_ICD_CMD|FALCON_ICD_CMD]]
| 0x54501200
| 0x04
|-
| FALCON_ICD_ADDR
| 0x54501204
| 0x04
|-
| FALCON_ICD_WDATA
| 0x54501208
| 0x04
|-
| FALCON_ICD_RDATA
| 0x5450120C
| 0x04
|-
| [[#FALCON_SCTL|FALCON_SCTL]]
| 0x54501240
| 0x04
|-
| [[#TSEC_SCP_CTL_ACCESS|TSEC_SCP_CTL_ACCESS]]
| 0x54501400
| 0x04
|-
| [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]]
| 0x54501404
| 0x04
|-
| [[#TSEC_SCP_CTL_STAT|TSEC_SCP_CTL_STAT]]
| 0x54501408
| 0x04
|-
| [[#TSEC_SCP_CTL_MODE|TSEC_SCP_CTL_MODE]]
| 0x5450140C
| 0x04
|-
| TSEC_SCP_UNK0
| 0x54501410
| 0x04
|-
| [[#TSEC_SCP_CTL_PKEY|TSEC_SCP_CTL_PKEY]]
| 0x54501418
| 0x04
|-
| [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]]
| 0x54501420
| 0x04
|-
| [[#TSEC_SCP_SEQ_STAT|TSEC_SCP_SEQ_STAT]]
| 0x54501428
| 0x04
|-
| [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]]
| 0x54501430
| 0x04
|-
| TSEC_SCP_UNK2
| 0x54501454
| 0x04
|-
| [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]]
| 0x54501458
| 0x04
|-
| TSEC_SCP_UNK3
| 0x54501470
| 0x04
|-
| [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT]]
| 0x54501480
| 0x04
|-
| [[#TSEC_SCP_IRQMASK|TSEC_SCP_IRQMASK]]
| 0x54501484
| 0x04
|-
| TSEC_SCP_UNK4
| 0x54501490
| 0x04
|-
| [[#TSEC_SCP_ERR|TSEC_SCP_ERR]]
| 0x54501498
| 0x04
|-
| TSEC_TRNG_CLKDIV
| 0x54501500
| 0x04
|-
| TSEC_TRNG_UNK0
| 0x54501504
| 0x04
|-
| TSEC_TRNG_UNK1
| 0x5450150C
| 0x04
|-
| TSEC_TRNG_UNK2
| 0x54501510
| 0x04
|-
| TSEC_TRNG_UNK3
| 0x54501514
| 0x04
|-
| TSEC_TRNG_UNK4
| 0x54501518
| 0x04
|-
| TSEC_TRNG_UNK5
| 0x5450151C
| 0x04
|-
| TSEC_TRNG_UNK6
| 0x54501528
| 0x04
|-
| TSEC_TRNG_UNK7
| 0x5450152C
| 0x04
|-
| TSEC_TFBIF_UNK0
| 0x54501600
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL|TSEC_TFBIF_MCCIF_FIFOCTRL]]
| 0x54501604
| 0x04
|-
| TSEC_TFBIF_UNK1
| 0x54501608
| 0x04
|-
| TSEC_TFBIF_UNK2
| 0x5450160C
| 0x04
|-
| TSEC_TFBIF_UNK3
| 0x54501630
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL1|TSEC_TFBIF_MCCIF_FIFOCTRL1]]
| 0x54501634
| 0x04
|-
| TSEC_TFBIF_UNK4
| 0x54501640
| 0x04
|-
| [[#TSEC_TFBIF_UNK5|TSEC_TFBIF_UNK5]]
| 0x54501644
| 0x04
|-
| [[#TSEC_TFBIF_UNK6|TSEC_TFBIF_UNK6]]
| 0x54501648
| 0x04
|-
| [[#TSEC_DMA_CMD|TSEC_DMA_CMD]]
| 0x54501700
| 0x04
|-
| [[#TSEC_DMA_ADDR|TSEC_DMA_ADDR]]
| 0x54501704
| 0x04
|-
| [[#TSEC_DMA_VAL|TSEC_DMA_VAL]]
| 0x54501708
| 0x04
|-
| [[#TSEC_DMA_UNK|TSEC_DMA_UNK]]
| 0x5450170C
| 0x04
|-
| TSEC_TEGRA_FALCON_IP_VER
| 0x54501800
| 0x04
|-
| TSEC_TEGRA_UNK0
| 0x54501824
| 0x04
|-
| TSEC_TEGRA_UNK1
| 0x54501828
| 0x04
|-
| TSEC_TEGRA_UNK2
| 0x5450182C
| 0x04
|-
| [[#TSEC_TEGRA_CTL|TSEC_TEGRA_CTL]]
| 0x54501838
| 0x04
|}

=== TSEC_THI_METHOD0 ===
{| class="wikitable" border="1"
! ID
! Method
|-
| 0x200
| SET_APPLICATION_ID
|-
| 0x300
| EXECUTE
|-
| 0x500
| HDCP_INIT
|-
| 0x504
| HDCP_CREATE_SESSION
|-
| 0x508
| HDCP_VERIFY_CERT_RX
|-
| 0x50C
| HDCP_GENERATE_EKM
|-
| 0x510
| HDCP_REVOCATION_CHECK
|-
| 0x514
| HDCP_VERIFY_HPRIME
|-
| 0x518
| HDCP_ENCRYPT_PAIRING_INFO
|-
| 0x51C
| HDCP_DECRYPT_PAIRING_INFO
|-
| 0x520
| HDCP_UPDATE_SESSION
|-
| 0x524
| HDCP_GENERATE_LC_INIT
|-
| 0x528
| HDCP_VERIFY_LPRIME
|-
| 0x52C
| HDCP_GENERATE_SKE_INIT
|-
| 0x530
| HDCP_VERIFY_VPRIME
|-
| 0x534
| HDCP_ENCRYPTION_RUN_CTRL
|-
| 0x538
| HDCP_SESSION_CTRL
|-
| 0x53C
| HDCP_COMPUTE_SPRIME
|-
| 0x540
| HDCP_GET_CERT_RX
|-
| 0x544
| HDCP_EXCHANGE_INFO
|-
| 0x548
| HDCP_DECRYPT_KM
|-
| 0x54C
| HDCP_GET_HPRIME
|-
| 0x550
| HDCP_GENERATE_EKH_KM
|-
| 0x554
| HDCP_VERIFY_RTT_CHALLENGE
|-
| 0x558
| HDCP_GET_LPRIME
|-
| 0x55C
| HDCP_DECRYPT_KS
|-
| 0x560
| HDCP_DECRYPT
|-
| 0x564
| HDCP_GET_RRX
|-
| 0x568
| HDCP_DECRYPT_REENCRYPT
|-
| 0x56C
|
|-
| 0x570
|
|-
| 0x574
|
|-
| 0x578
|
|-
| 0x57C
|
|-
| 0x700
| HDCP_VALIDATE_SRM
|-
| 0x704
| HDCP_VALIDATE_STREAM
|-
| 0x708
| HDCP_TEST_SECURE_STATUS
|-
| 0x70C
| HDCP_SET_DCP_KPUB
|-
| 0x710
| HDCP_SET_RX_KPUB
|-
| 0x714
| HDCP_SET_CERT_RX
|-
| 0x718
| HDCP_SET_SCRATCH_BUFFER
|-
| 0x71C
| HDCP_SET_SRM
|-
| 0x720
| HDCP_SET_RECEIVER_ID_LIST
|-
| 0x724
| HDCP_SET_SPRIME
|-
| 0x728
| HDCP_SET_ENC_INPUT_BUFFER
|-
| 0x72C
| HDCP_SET_ENC_OUTPUT_BUFFER
|-
| 0x730
| HDCP_GET_RTT_CHALLENGE
|-
| 0x734
| HDCP_STREAM_MANAGE
|-
| 0x738
| HDCP_READ_CAPS
|-
| 0x73C
| HDCP_ENCRYPT
|-
| 0x740
| [6.0.0+] HDCP_GET_CURRENT_NONCE
|}

Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_METHOD1 ===
Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_INT_STATUS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_STATUS_FALCON_INT
|}

=== TSEC_THI_INT_MASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_MASK_FALCON_INT
|}

=== FALCON_IRQSSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSSET_GPTMR
|-
| 1
| FALCON_IRQSSET_WDTMR
|-
| 2
| FALCON_IRQSSET_MTHD
|-
| 3
| FALCON_IRQSSET_CTXSW
|-
| 4
| FALCON_IRQSSET_HALT
|-
| 5
| FALCON_IRQSSET_EXTERR
|-
| 6
| FALCON_IRQSSET_SWGEN0
|-
| 7
| FALCON_IRQSSET_SWGEN1
|-
| 8-15
| FALCON_IRQSSET_EXT
|}

Used for setting Falcon's IRQs.

=== FALCON_IRQSCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSCLR_GPTMR
|-
| 1
| FALCON_IRQSCLR_WDTMR
|-
| 2
| FALCON_IRQSCLR_MTHD
|-
| 3
| FALCON_IRQSCLR_CTXSW
|-
| 4
| FALCON_IRQSCLR_HALT
|-
| 5
| FALCON_IRQSCLR_EXTERR
|-
| 6
| FALCON_IRQSCLR_SWGEN0
|-
| 7
| FALCON_IRQSCLR_SWGEN1
|-
| 8-15
| FALCON_IRQSCLR_EXT
|}

Used for clearing Falcon's IRQs.

=== FALCON_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSTAT_GPTMR
|-
| 1
| FALCON_IRQSTAT_WDTMR
|-
| 2
| FALCON_IRQSTAT_MTHD
|-
| 3
| FALCON_IRQSTAT_CTXSW
|-
| 4
| FALCON_IRQSTAT_HALT
|-
| 5
| FALCON_IRQSTAT_EXTERR
|-
| 6
| FALCON_IRQSTAT_SWGEN0
|-
| 7
| FALCON_IRQSTAT_SWGEN1
|-
| 8-15
| FALCON_IRQSTAT_EXT
|}

Used for getting the status of Falcon's IRQs.

=== FALCON_IRQMODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMODE_GPTMR
|-
| 1
| FALCON_IRQMODE_WDTMR
|-
| 2
| FALCON_IRQMODE_MTHD
|-
| 3
| FALCON_IRQMODE_CTXSW
|-
| 4
| FALCON_IRQMODE_HALT
|-
| 5
| FALCON_IRQMODE_EXTERR
|-
| 6
| FALCON_IRQMODE_SWGEN0
|-
| 7
| FALCON_IRQMODE_SWGEN1
|-
| 8-15
| FALCON_IRQMODE_EXT
|}

Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.

=== FALCON_IRQMSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMSET_GPTMR
|-
| 1
| FALCON_IRQMSET_WDTMR
|-
| 2
| FALCON_IRQMSET_MTHD
|-
| 3
| FALCON_IRQMSET_CTXSW
|-
| 4
| FALCON_IRQMSET_HALT
|-
| 5
| FALCON_IRQMSET_EXTERR
|-
| 6
| FALCON_IRQMSET_SWGEN0
|-
| 7
| FALCON_IRQMSET_SWGEN1
|-
| 8-15
| FALCON_IRQMSET_EXT
|}

Used for setting the mask for Falcon's IRQs.

=== FALCON_IRQMCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMCLR_GPTMR
|-
| 1
| FALCON_IRQMCLR_WDTMR
|-
| 2
| FALCON_IRQMCLR_MTHD
|-
| 3
| FALCON_IRQMCLR_CTXSW
|-
| 4
| FALCON_IRQMCLR_HALT
|-
| 5
| FALCON_IRQMCLR_EXTERR
|-
| 6
| FALCON_IRQMCLR_SWGEN0
|-
| 7
| FALCON_IRQMCLR_SWGEN1
|-
| 8-15
| FALCON_IRQMCLR_EXT
|}

Used for clearing the mask for Falcon's IRQs.

=== FALCON_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMASK_GPTMR
|-
| 1
| FALCON_IRQMASK_WDTMR
|-
| 2
| FALCON_IRQMASK_MTHD
|-
| 3
| FALCON_IRQMASK_CTXSW
|-
| 4
| FALCON_IRQMASK_HALT
|-
| 5
| FALCON_IRQMASK_EXTERR
|-
| 6
| FALCON_IRQMASK_SWGEN0
|-
| 7
| FALCON_IRQMASK_SWGEN1
|-
| 8-15
| FALCON_IRQMASK_EXT
|}

Used for getting the value of the mask for Falcon's IRQs.

=== FALCON_IRQDEST ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQDEST_HOST_GPTMR
|-
| 1
| FALCON_IRQDEST_HOST_WDTMR
|-
| 2
| FALCON_IRQDEST_HOST_MTHD
|-
| 3
| FALCON_IRQDEST_HOST_CTXSW
|-
| 4
| FALCON_IRQDEST_HOST_HALT
|-
| 5
| FALCON_IRQDEST_HOST_EXTERR
|-
| 6
| FALCON_IRQDEST_HOST_SWGEN0
|-
| 7
| FALCON_IRQDEST_HOST_SWGEN1
|-
| 8-15
| FALCON_IRQDEST_HOST_EXT
|-
| 16
| FALCON_IRQDEST_TARGET_GPTMR
|-
| 17
| FALCON_IRQDEST_TARGET_WDTMR
|-
| 18
| FALCON_IRQDEST_TARGET_MTHD
|-
| 19
| FALCON_IRQDEST_TARGET_CTXSW
|-
| 20
| FALCON_IRQDEST_TARGET_HALT
|-
| 21
| FALCON_IRQDEST_TARGET_EXTERR
|-
| 22
| FALCON_IRQDEST_TARGET_SWGEN0
|-
| 23
| FALCON_IRQDEST_TARGET_SWGEN1
|-
| 24-31
| FALCON_IRQDEST_TARGET_EXT
|}

Used for routing Falcon's IRQs.

=== FALCON_SCRATCH0 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_SCRATCH1 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_ITFEN ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_ITFEN_CTXEN
|-
| 1
| FALCON_ITFEN_MTHDEN
|}

Used for enabling/disabling Falcon interfaces.

=== FALCON_IDLESTATE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IDLESTATE_FALCON_BUSY
|-
| 1-15
| FALCON_IDLESTATE_EXT_BUSY
|}

Used for detecting if Falcon is busy or not.

=== FALCON_DEBUGINFO ===
Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.

[6.0.0+] [[NV_services|nvservices]] sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.

=== FALCON_EXCI ===
Contains information about raised exceptions.

=== FALCON_CPUCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_CPUCTL_IINVAL
|-
| 1
| FALCON_CPUCTL_STARTCPU
|-
| 2
| FALCON_CPUCTL_SRESET
|-
| 3
| FALCON_CPUCTL_HRESET
|-
| 4
| FALCON_CPUCTL_HALTED
|-
| 5
| FALCON_CPUCTL_STOPPED
|-
| 6
| FALCON_CPUCTL_START_SCP_LS
|}

Used for signaling the Falcon CPU.

=== FALCON_BOOTVEC ===
Takes the Falcon's boot vector address.

=== FALCON_HWCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-8
| FALCON_HWCFG_IMEM_SIZE
|-
| 9-17
| FALCON_HWCFG_DMEM_SIZE
|-
| 18-25
| FALCON_HWCFG_MTHD_SIZE
|-
| 26-31
| FALCON_HWCFG_DMATRF_SLOTS
|}

=== FALCON_DMACTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMACTL_REQUIRE_CTX
|-
| 1
| FALCON_DMACTL_DMEM_SCRUBBING
|-
| 2
| FALCON_DMACTL_IMEM_SCRUBBING
|-
| 3-6
| FALCON_DMACTL_DMAQ_NUM
|-
| 7
| FALCON_DMACTL_SECURE_STAT
|}

Used for configuring the Falcon's DMA engine.

=== FALCON_DMATRF_EXTBASE ===
Base of the external memory buffer.

The base of the transfer is calculated by adding [[#FALCON_DMATRF_POFF]] to the base.

=== FALCON_DMATRF_VOFF ===
For transfers to DMEM: the destination address.
For transfers to IMEM: the destination virtual IMEM page.

=== FALCON_DMATRF_POFF ===
For transfers to IMEM: the destination physical IMEM page.

=== FALCON_DMATRFCMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFCMD_FULL
|-
| 1
| FALCON_DMATRFCMD_IDLE
|-
| 2-3
| FALCON_DMATRFCMD_SEC
|-
| 4
| FALCON_DMATRFCMD_IMEM
|-
| 5
| FALCON_DMATRFCMD_WRITE
|-
| 8-10
| FALCON_DMATRFCMD_SIZE
|-
| 12-14
| FALCON_DMATRFCMD_CTXDMA
|}

Used for configuring DMA transfers.

=== FALCON_DMATRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFSTAT_PENDING
|-
| 16-18
| FALCON_DMATRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_DMATRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_CRYPTTRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| FALCON_CRYPTTRFSTAT_PENDING
|-
| 5
| FALCON_CRYPTTRFSTAT_ENABLED
|-
| 16-18
| FALCON_CRYPTTRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_CRYPTTRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_HWCFG2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_HWCFG2_VERSION
|-
| 4-5
| FALCON_HWCFG2_SCP_MODE
|-
| 6-7
| FALCON_HWCFG2_SUBVERSION
|-
| 8-11
| FALCON_HWCFG2_IMEM_PORTS
|-
| 12-15
| FALCON_HWCFG2_DMEM_PORTS
|-
| 16-19
| FALCON_HWCFG2_VM_PAGES_LOG2
|}

=== FALCON_ICD_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_ICD_CMD_OPC
0x0: BREAK
0x1: CONTINUE_FROM_PC
0x2: CONTINUE_FROM_ADDR
0x3: CONTINUE_UNK1_FROM_PC
0x4: CONTINUE_UNK1_FROM_ADDR
0x5: SINGLE_STEP_FROM_PC
0x6: SINGLE_STEP_FROM_ADDR
0x7: SET_BREAK_MASK
0x8: REG_READ
0x9: REG_WRITE
0xA: DATA_READ
0xB: DATA_WRITE
0xC: IO_READ
0xD: IO_WRITE
0xE: STATUS_READ
|-
| 6-7
| FALCON_ICD_CMD_DATA_SIZE
|-
| 8-12
| FALCON_ICD_CMD_IDX
|-
| 14
| FALCON_ICD_CMD_ERROR
|-
| 15
| FALCON_ICD_CMD_DONE
|-
| 16-31
| FALCON_ICD_CMD_BREAK_MASK
|}

=== FALCON_SCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| FALCON_SCTL_SEC_MODE
0: Non-secure
1: Light Secure
2: Heavy Secure
|-
| 4-5
| FALCON_SCTL_OLD_SEC_MODE
0: Non-secure
1: Light Secure
2: Heavy Secure
|-
| 12-13
| Unknown
|-
| 14
| Initialize the transition to LS mode
|}

=== TSEC_SCP_CTL_ACCESS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| Enable TSEC_SCP_INSN_STAT register
|}

=== TSEC_SCP_CTL_TRNG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 11
| Unknown
|-
| 12
| Enable the TRNG
|}

=== TSEC_SCP_CTL_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| TSEC_SCP_CTL_STAT_DEBUG_MODE
|}

=== TSEC_SCP_CTL_MODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Disable reads for the TRNG register block
|-
| 1
| Disable reads for the TFBIF register block
|-
| 2
| Disable reads for the DMA register block
|-
| 3
| Disable reads for the TEGRA register block
|-
| 4
| Disable writes for the TRNG register block
|-
| 5
| Disable writes for the TFBIF register block
|-
| 6
| Disable writes for the DMA register block
|-
| 7
| Disable writes for the TEGRA register block
|}

Controls accesses to the other sub-engines and can only be cleared in Heavy Secure mode.

=== TSEC_SCP_CTL_PKEY ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
|-
| 1
| TSEC_SCP_CTL_PKEY_LOADED
|}

=== TSEC_SCP_SEQ0_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 8-11
| Size of current cs0begin macro
|-
|}

=== TSEC_SCP_SEQ_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Set if crypto sequence recording (cs0begin/cs1begin) is active
|-
| 4-7
| Number of instructions left for the crypto sequence
|-
| 12-15
| Active crypto key register
|}

Contains information on the last crypto sequence (cs0 or cs1) executed.

=== TSEC_SCP_INSN_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Crypto fuc5 destination register or immediate value
|-
| 8-13
| Crypto fuc5 source register or immediate value
|-
| 20-24
| Crypto fuc5 operation
0x0: nop (fuc5 opcode 0x00)
0x1: cmov (fuc5 opcode 0x84)
0x2: cxsin (fuc5 opcode 0x88) or xdst (with cxset)
0x3: cxsout (fuc5 opcode 0x8C) or xdld (with cxset)
0x4: crnd (fuc5 opcode 0x90)
0x5: cs0begin (fuc5 opcode 0x94)
0x6: cs0exec (fuc5 opcode 0x98)
0x7: cs1begin (fuc5 opcode 0x9C)
0x8: cs1exec (fuc5 opcode 0xA0)
0x9: invalid (fuc5 opcode 0xA4)
0xA: cchmod (fuc5 opcode 0xA8)
0xB: cxor (fuc5 opcode 0xAC)
0xC: cadd (fuc5 opcode 0xB0)
0xD: cand (fuc5 opcode 0xB4)
0xE: crev (fuc5 opcode 0xB8)
0xF: cprecmac (fuc5 opcode 0xBC)
0x10: csecret (fuc5 opcode 0xC0)
0x11: ckeyreg (fuc5 opcode 0xC4)
0x12: ckexp (fuc5 opcode 0xC8)
0x13: ckrexp (fuc5 opcode 0xCC)
0x14: cenc (fuc5 opcode 0xD0)
0x15: cdec (fuc5 opcode 0xD4)
0x16: csigauth (fuc5 opcode 0xD8)
0x17: csigenc (fuc5 opcode 0xDC)
0x18: csigclr (fuc5 opcode 0xE0)
|-
| 28
| Unknown
|-
| 31
| Set if running in secure mode (cauth)
|}

Contains information on the last crypto instruction executed.

=== TSEC_SCP_AES_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-4
| First opcode
|-
| 5-9
| Second opcode
|-
| 15-16
| AES operation
0: Encryption
1: Decryption
2: Key expansion
3: Key reverse expansion
|}

Contains information on the last AES sequence executed.

=== TSEC_SCP_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQSTAT_TRNG
|-
| 8
| TSEC_SCP_IRQSTAT_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQSTAT_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQSTAT_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the status of crypto IRQs.

=== TSEC_SCP_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQMASK_TRNG
|-
| 8
| TSEC_SCP_IRQMASK_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQMASK_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQMASK_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the value of the mask for crypto IRQs.

=== TSEC_SCP_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Invalid instruction
|-
| 4
| Empty crypto sequence
|-
| 8
| Crypto sequence is too long
|-
| 12
| Crypto sequence was not finished
|-
| 16
| Invalid cauth signature (during csigenc, csigclr or csigunk)
|-
| 24
| Forbidden instruction
|}

Contains information on crypto errors generated by the [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT_INSN_ERROR]] IRQ.

=== TSEC_TFBIF_MCCIF_FIFOCTRL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
|-
| 1
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
|-
| 2
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
|-
| 3
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
|-
| 4
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
|-
| 5
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
|-
| 6
| TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
|-
| 7
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
|-
| 8
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE
|}

=== TSEC_MCCIF_FIFOCTRL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
|-
| 16-31
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT
|}

=== TSEC_TFBIF_UNK5 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.

=== TSEC_TFBIF_UNK6 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to (data_size << 4) before reading memory from the GPU UCODE carveout.

=== TSEC_DMA_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_DMA_CMD_READ
|-
| 1
| TSEC_DMA_CMD_WRITE
|-
| 4-7
| TSEC_DMA_CMD_UNK
|-
| 12
| TSEC_DMA_CMD_BUSY
|-
| 13
| TSEC_DMA_CMD_ERROR
|-
| 31
| TSEC_DMA_CMD_INIT
|}

A DMA read/write operation requires bits TSEC_DMA_CMD_INIT and TSEC_DMA_CMD_READ/TSEC_DMA_CMD_WRITE to be set in TSEC_DMA_CMD.

During the transfer, the TSEC_DMA_CMD_BUSY bit is set.

Accessing an invalid address causes bit TSEC_DMA_CMD_ERROR to be set.

=== TSEC_DMA_ADDR ===
Takes the address for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_VAL ===
Takes the value for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_UNK ===
Always 0xFFF.

=== TSEC_TEGRA_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 16
| TSEC_TEGRA_CTL_TKFI_KFUSE
|-
| 17
| TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
|-
| 24
| TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
|-
| 25
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
|-
| 26
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
|-
| 27
| TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C
|}

== SCP ==
Part of the information here (which hasn't made it into envytools documentation yet) was shared by [https://wiki.0x04.net/wiki/Marcin_Ko%C5%9Bcielnicki mwk] from reverse engineering falcon processors over the years.

=== Authenticated Mode ===
==== Entry ====
From non-secure mode, upon jumping to a page marked as secret, a secret fault occurs. This causes the CPU to verify the region specified in $cauth against the MAC loaded in $c6. If the comparison is successful, the valid bit (bit0) is set on all pages in the $cauth region, and $pc is set to the base of the $cauth region. If the comparsion fails, the CPU is halted.

==== Exit ====
The CPU automatically goes back to non-secure mode when returning back into non-secret pages. When this happens, the valid bit (bit0) in the TLB flags is cleared for all secret pages.

==== Implementation ====
Under certain circumstances, it is possible to observe [[#csigauth|csigauth]] being briefly written to [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]] as "csigauth $c4 $c6" while the opcodes in [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]] are set to "cxsin" and "csigauth", respectively.

Via [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]] it can be observed that a 3-sized macro sequence is loaded into cs0 during a secure mode transition.

=== Operations ===
{| class="wikitable" border="1"
! Opcode
! Name
! Operand0
! Operand1
! Operation
! Condition
|-
| 0 || nop || N/A || N/A || ||
|-
| 1 || mov || $cX || $cY || <code>$cX = $cY; ACL(X) = ACL(Y);</code> ||
|-
| 2 || sin || $cX || N/A || <code>$cX = read_stream(); ACL(X) = ???;</code> ||
|-
| 3 || sout || $cX || N/A || <code>write_stream($cX);</code> || ?
|-
| 4 || rnd || $cX || N/A || <code>$cX = read_trng(); ACL(X) = ???;</code> ||
|-
| 5 || s0begin || immX || N/A || <code>record_macro_for_N_instructions(0, immX);</code> ||
|-
| 6 || s0exec || immX || N/A || <code>execute_macro_N_times(0, immX);</code> ||
|-
| 7 || s1begin || immX || N/A || <code>record_macro_for_N_instructions(1, immX);</code> ||
|-
| 8 || s1exec || immX || N/A || <code>execute_macro_N_times(1, immX);</code> ||
|-
| 9 || <invalid> || || || ||
|-
| 0xA || chmod || $cX || immY || Complicated, see [[#ACL|ACL]]. ||
|-
| 0xB || xor || $cX || $cY || <code>$cX ^= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xC || add || $cX || immY || <code>$cX += immY;</code> || <code>(ACL(X) & 2)</code>
|-
| 0xD || and || $cX || $cY || <code>$cX &= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xE || rev || $cX || $cY || <code>$cX = endian_swap128($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0xF || gfmul || $cX || $cY || <code>$cX = gfmul($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 2)</code>
|-
| 0x10 || secret || $cX || immY || <code>$cX = load_secret(immY); ACL(X) = load_secret_acl(immY);</code> ||
|-
| 0x11 || keyreg || immX || N/A || <code>active_key_idx = immX;</code> ||
|-
| 0x12 || kexp || $cX || $cY || <code>$cX = aes_kexp($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0x13 || krexp || $cX || $cY || <code>$cX = aes_kexp_reverse($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0x14 || enc || $cX || $cY || <code>$cX = aes_enc(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 1) && (ACL(Y) & 2)</code>
|-
| 0x15 || dec || $cX || $cY || <code>$cX = aes_dec(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 1) && (ACL(Y) & 2)</code>
|-
| 0x16 || csigauth || $cX || $cY || <code>if (hash_verify($cX, $cY)) { has_sig = true; current_sig = $cX; }</code> || ?
|-
| 0x17 || csigclr || N/A || N/A || <code>has_sig = false;</code> ||
|-
| 0x18 || csigenc || $cX || $cY || <code>if (has_sig) $cX = aes_enc(current_sig, $cY);</code> || ?
|}

==== csigauth ====
<code>00000000: f5 3c XY d8 csigauth $cY $cX</code>

Takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret. This instruction does not work in secure mode.

==== csigclr ====
<code>00000000: f5 3c 00 e0 csigclr</code>

This instruction takes no operands and appears to clear the saved cauth signature used by the csigenc instruction.

==== cchmod ====
<code>00000000: f5 3c XY a8 cchmod $cY 0X</code> or <code>00000000: f5 3c XY a9 cchmod $cY 1X</code>

This instruction takes a crypto register and a 5 bit immediate value which represents the [[#ACL|ACL]] mask to set.

==== crnd ====
<code>00000000: f5 3c 0X 90 crnd $cX</code>

This instruction initializes a crypto register with random data.

Executing this instruction only succeeds if the TRNG is enabled for the SCP, which requires taking the following steps:
* Write 0x7FFF to TSEC_TRNG_CLKDIV.
* Write 0x3FF0000 to TSEC_TRNG_UNK0.
* Write 0xFF00 to TSEC_TRNG_UNK7.
* Write 0x1000 to [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]].

Otherwise it hangs forever.

=== ACL ===
{| class="wikitable" border="1"
! Bit
! Meaning
|-
| 0 || Secure key. Forced set if bit1 is set. Once cleared, cannot be set again.
|-
| 1 || Secure readable. Once cleared, cannot be set again.
|-
| 2 || Insecure key. Forced set if bit3 is set. Forced clear if bit0 is clear. Can be toggled back and forth.
|-
| 3 || Insecure readable. Forced clear if bit1 is clear. Can be toggled back and forth.
|-
| 4 || Insecure overwritable. Can be toggled back and forth.
|}

==== Initial values ====
On SCP boot, the ACL is 0x1F for all $cX.

Loading into $cX using xdst instruction sets ACL($cX) to 0x13 and 0x1F, for secure and insecure mode respectively.

Spilling a $cX to DMEM using xdld instruction is allowed if (ACL($cX) & 2) or (ACL($cX) & 8), for secure and insecure mode respectively.

Loading a secret into $cX sets a per-secret ACL, unconditionally.

=== cauth ===
$cauth is a special purpose register in the CPU.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7 || Start of region to authenticate (in 0x100 pages)
|-
| 8-15 || Unknown
|-
| 16 || Use secret xfers (?)
|-
| 17 || Region is encrypted (?)
|-
| 18 || Unknown
|-
| 19 || Unknown
|-
| 20-23 || Unknown
|-
| 24-31 || Size of region to authenticate (in 0x100 pages)
|}

=== cxset ===
cxset instruction provides a way to change behavior of a variable amount of successively executed DMA-related instructions.

for example: <code>000000de: f4 3c 02 cxset 0x2</code>

can be read as: <code>dma_override(type=crypto_reg, count=2)</code>

The argument to cxset specifies the type of behavior change in the top 3 bits, and the number of DMA-related instructions the effect lasts for in the lower 5 bits.

{| class=wikitable
! Bits || Description
|-
| 0-4 || Number of instructions it is valid for (0x1f is a special value meaning infinitely many instructions -- until overriden by another cxset)
|-
| 5 || Crypto destination/source select (0=crypto register, 1=crypto stream)
|-
| 6 || External memory override (0=Disabled, 1=Enabled)
|-
| 7 || Internal memory select (0=DMEM, 1=IMEM)
|}

==== DMA-Related Instructions ====
At least the following instructions may have changed behavior, and count against the cxset "count" argument: <code>xdwait</code>, <code>xdst</code>, <code>xdld</code>.

For example, if override type=0b000, then the "length" argument to <code>xdst</code> is instead treated as the index of the target $cX register.

=== Secrets ===
Falcon's Authenticated Mode has access to 64 128-bit keys which are burned at factory. These keys can be loaded by using the $csecret instruction which takes the target crypto register and the key index as arguments.

{| class=wikitable
! Index || ACL || Console-unique || Notes
|-
| 0x00 || 0x07 || No || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares.
|-
| 0x01 || 0x01 || No || Used by nvhost_nvdec_bl020_prod firmware.
|-
| 0x02 || 0x01 || No ||
|-
| 0x03 || 0x05 || No || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|-
| 0x04 || 0x01 || No || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|-
| 0x05 || 0x07 || No || Used by nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares.
|-
| 0x06 || 0x05 || No ||
|-
| 0x07 || 0x05 || No || Used by [6.0.0+] nvhost_tsec firmware.
|-
| 0x08 || 0x01 || No ||
|-
| 0x09 || 0x07 || No || Used by nvhost_tsec firmware.
|-
| 0x0A || 0x05 || No ||
|-
| 0x0B || 0x01 || No || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|-
| 0x0C || 0x07 || No ||
|-
| 0x0D || 0x05 || No ||
|-
| 0x0E || 0x01 || No ||
|-
| 0x0F || 0x07 || No || Used by nvhost_tsec firmware.
|-
| 0x10 || 0x05 || No || Used by [1.0.0-5.1.0] nvhost_tsec firmware.
|-
| 0x11 || 0x01 || No ||
|-
| 0x12 || 0x07 || No ||
|-
| 0x13 || 0x05 || No ||
|-
| 0x14 || 0x01 || No ||
|-
| 0x15 || 0x07 || No || Used by nvhost_nvdec_bl020_prod, [5.0.0+] nvhost_nvdec020_prod, [5.0.0+] nvhost_nvdec020_ns and [6.0.0+] nvhost_tsec firmwares.
|-
| 0x16 || 0x05 || No ||
|-
| 0x17 || 0x01 || No ||
|-
| 0x18 || 0x07 || No ||
|-
| 0x19 || 0x05 || No ||
|-
| 0x1A || 0x01 || No ||
|-
| 0x1B || 0x07 || No ||
|-
| 0x1C || 0x05 || No ||
|-
| 0x1D || 0x01 || No ||
|-
| 0x1E || 0x07 || No ||
|-
| 0x1F || 0x05 || No ||
|-
| 0x20 || 0x01 || No ||
|-
| 0x21 || 0x07 || No ||
|-
| 0x22 || 0x05 || No ||
|-
| 0x23 || 0x01 || No ||
|-
| 0x24 || 0x07 || No ||
|-
| 0x25 || 0x05 || No ||
|-
| 0x26 || 0x01 || No || Used by [[TSEC_Firmware#KeygenLdr|KeygenLdr]].
|-
| 0x27 || 0x07 || No ||
|-
| 0x28 || 0x05 || No ||
|-
| 0x29 || 0x01 || No ||
|-
| 0x2A || 0x07 || No ||
|-
| 0x2B || 0x05 || No ||
|-
| 0x2C || 0x01 || No ||
|-
| 0x2D || 0x07 || No ||
|-
| 0x2E || 0x05 || No ||
|-
| 0x2F || 0x01 || No ||
|-
| 0x30 || 0x07 || No ||
|-
| 0x31 || 0x05 || No ||
|-
| 0x32 || 0x01 || No ||
|-
| 0x33 || 0x07 || No ||
|-
| 0x34 || 0x05 || No ||
|-
| 0x35 || 0x01 || No ||
|-
| 0x36 || 0x07 || No ||
|-
| 0x37 || 0x05 || No ||
|-
| 0x38 || 0x01 || No ||
|-
| 0x39 || 0x07 || No ||
|-
| 0x3A || 0x05 || No ||
|-
| 0x3B || 0x01 || No ||
|-
| 0x3C || 0x07 || No || Used by nvhost_tsec firmware.
|-
| 0x3D || 0x05 || No ||
|-
| 0x3E || 0x01 || No ||
|-
| 0x3F || 0x01 || Yes || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|}

TSEC

2019-01-08T21:36:23Z

Qlutoo: /* Initial values */

TSEC (Tegra Security Co-processor) is a dedicated unit powered by a NVIDIA Falcon microprocessor with crypto extensions.

= Driver =
A host driver for communicating with the TSEC is mapped to physical address 0x54500000 with a total size of 0x40000 bytes and exposes several registers.

== Registers ==
Registers from 0x54500000 to 0x54501000 are used to configure the host interface (HOST1X).

Registers from 0x54501000 to 0x54502000 are a MMIO window for communicating with the Falcon microprocessor. From this range, the subset of registers from 0x54501400 to 0x54501FE8 are specific to the TSEC and are subdivided into:
* 0x54501400 to 0x54501500: SCP (Secure Crypto Processor?).
* 0x54501500 to 0x54501600: TRNG (True Random Number Generator).
* 0x54501600 to 0x54501700: TFBIF (Tegra Framebuffer Interface).
* 0x54501700 to 0x54501800: DMA.
* 0x54501800 to 0x54501900: TEGRA (miscellaneous interfaces).

{| class="wikitable" border="1"
! Name
! Address
! Width
|-
| TSEC_THI_INCR_SYNCPT
| 0x54500000
| 0x04
|-
| TSEC_THI_INCR_SYNCPT_ERR
| 0x54500008
| 0x04
|-
| TSEC_THI_CTXSW_INCR_SYNCPT
| 0x5450000C
| 0x04
|-
| TSEC_THI_CTXSW
| 0x54500020
| 0x04
|-
| TSEC_THI_CONT_SYNCPT_EOF
| 0x54500028
| 0x04
|-
| [[#TSEC_THI_METHOD0|TSEC_THI_METHOD0]]
| 0x54500040
| 0x04
|-
| [[#TSEC_THI_METHOD1|TSEC_THI_METHOD1]]
| 0x54500044
| 0x04
|-
| [[#TSEC_THI_INT_STATUS|TSEC_THI_INT_STATUS]]
| 0x54500078
| 0x04
|-
| [[#TSEC_THI_INT_MASK|TSEC_THI_INT_MASK]]
| 0x5450007C
| 0x04
|-
| TSEC_THI_SLCG_STATUS
| 0x54500084
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_HIGH_A
| 0x54500088
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_LOW_A
| 0x5450008C
| 0x04
|-
| TSEC_THI_CLK_OVERRIDE
| 0x54500E00
| 0x04
|-
| [[#FALCON_IRQSSET|FALCON_IRQSSET]]
| 0x54501000
| 0x04
|-
| [[#FALCON_IRQSCLR|FALCON_IRQSCLR]]
| 0x54501004
| 0x04
|-
| [[#FALCON_IRQSTAT|FALCON_IRQSTAT]]
| 0x54501008
| 0x04
|-
| [[#FALCON_IRQMODE|FALCON_IRQMODE]]
| 0x5450100C
| 0x04
|-
| [[#FALCON_IRQMSET|FALCON_IRQMSET]]
| 0x54501010
| 0x04
|-
| [[#FALCON_IRQMCLR|FALCON_IRQMCLR]]
| 0x54501014
| 0x04
|-
| [[#FALCON_IRQMASK|FALCON_IRQMASK]]
| 0x54501018
| 0x04
|-
| [[#FALCON_IRQDEST|FALCON_IRQDEST]]
| 0x5450101C
| 0x04
|-
| FALCON_GPTMR_PERIOD
| 0x54501020
| 0x04
|-
| FALCON_GPTMR_TIME
| 0x54501024
| 0x04
|-
| FALCON_GPTMR_ENABLE
| 0x54501028
| 0x04
|-
| FALCON_TIME_LOW
| 0x5450102C
| 0x04
|-
| FALCON_TIME_HIGH
| 0x54501030
| 0x04
|-
| FALCON_WDTMR_TIME
| 0x54501034
| 0x04
|-
| FALCON_WDTMR_ENABLE
| 0x54501038
| 0x04
|-
| [[#FALCON_SCRATCH0|FALCON_SCRATCH0]]
| 0x54501040
| 0x04
|-
| [[#FALCON_SCRATCH1|FALCON_SCRATCH1]]
| 0x54501044
| 0x04
|-
| [[#FALCON_ITFEN|FALCON_ITFEN]]
| 0x54501048
| 0x04
|-
| [[#FALCON_IDLESTATE|FALCON_IDLESTATE]]
| 0x5450104C
| 0x04
|-
| FALCON_CURCTX
| 0x54501050
| 0x04
|-
| FALCON_NXTCTX
| 0x54501054
| 0x04
|-
| FALCON_CMDCTX
| 0x54501058
| 0x04
|-
| FALCON_STATUS_MASK
| 0x5450105C
| 0x04
|-
| FALCON_VM_SUPERVISOR
| 0x54501060
| 0x04
|-
| FALCON_MTHD_DATA
| 0x54501064
| 0x04
|-
| FALCON_MTHD_CMD
| 0x54501068
| 0x04
|-
| FALCON_MTHD_DATA_WR
| 0x5450106C
| 0x04
|-
| FALCON_MTHD_OCCUPIED
| 0x54501070
| 0x04
|-
| FALCON_MTHD_ACK
| 0x54501074
| 0x04
|-
| FALCON_MTHD_LIMIT
| 0x54501078
| 0x04
|-
| FALCON_SUBENGINE_RESET
| 0x5450107C
| 0x04
|-
| FALCON_SCRATCH2
| 0x54501080
| 0x04
|-
| FALCON_SCRATCH3
| 0x54501084
| 0x04
|-
| FALCON_PM_TRIGGER
| 0x54501088
| 0x04
|-
| FALCON_PM_MODE
| 0x5450108C
| 0x04
|-
| FALCON_DEBUG1
| 0x54501090
| 0x04
|-
| [[#FALCON_DEBUGINFO|FALCON_DEBUGINFO]]
| 0x54501094
| 0x04
|-
| FALCON_BREAKPOINT0
| 0x54501098
| 0x04
|-
| FALCON_BREAKPOINT1
| 0x5450109C
| 0x04
|-
| FALCON_CGCTL
| 0x545010A0
| 0x04
|-
| FALCON_ENGCTL
| 0x545010A4
| 0x04
|-
| FALCON_PM_SEL
| 0x545010A8
| 0x04
|-
| FALCON_HOST_IO_INDEX
| 0x545010AC
| 0x04
|-
| [[#FALCON_EXCI|FALCON_EXCI]]
| 0x545010D0
| 0x04
|-
| [[#FALCON_CPUCTL|FALCON_CPUCTL]]
| 0x54501100
| 0x04
|-
| [[#FALCON_BOOTVEC|FALCON_BOOTVEC]]
| 0x54501104
| 0x04
|-
| [[#FALCON_HWCFG|FALCON_HWCFG]]
| 0x54501108
| 0x04
|-
| [[#FALCON_DMACTL|FALCON_DMACTL]]
| 0x5450110C
| 0x04
|-
| [[#FALCON_DMATRF_EXTBASE|FALCON_DMATRF_EXTBASE]]
| 0x54501110
| 0x04
|-
| [[#FALCON_DMATRF_VOFF|FALCON_DMATRF_VOFF]]
| 0x54501114
| 0x04
|-
| [[#FALCON_DMATRFCMD|FALCON_DMATRFCMD]]
| 0x54501118
| 0x04
|-
| [[#FALCON_DMATRF_POFF|FALCON_DMATRF_POFF]]
| 0x5450111C
| 0x04
|-
| [[#FALCON_DMATRFSTAT|FALCON_DMATRFSTAT]]
| 0x54501120
| 0x04
|-
| [[#FALCON_CRYPTTRFSTAT|FALCON_CRYPTTRFSTAT]]
| 0x54501124
| 0x04
|-
| FALCON_CPUSTAT
| 0x54501128
| 0x04
|-
| [[#FALCON_HWCFG2|FALCON_HWCFG2]]
| 0x5450112C
| 0x04
|-
| FALCON_CPUCTL_ALIAS
| 0x54501130
| 0x04
|-
| FALCON_TLB_CMD
| 0x54501140
| 0x04
|-
| FALCON_TLB_CMD_RES
| 0x54501144
| 0x04
|-
| FALCON_BRANCH_HISTORY_CTRL
| 0x54501148
| 0x04
|-
| FALCON_BRANCH_HISTORY_PC
| 0x5450114C
| 0x04
|-
| FALCON_IMFILLRNG0
| 0x54501150
| 0x04
|-
| FALCON_IMFILLRNG1
| 0x54501154
| 0x04
|-
| FALCON_IMFILLCTL
| 0x54501158
| 0x04
|-
| FALCON_EXTERRWIN
| 0x54501160
| 0x04
|-
| FALCON_EXTERRCFG
| 0x54501164
| 0x04
|-
| FALCON_EXTERRADDR
| 0x54501168
| 0x04
|-
| FALCON_EXTERRSTAT
| 0x5450116C
| 0x04
|-
| FALCON_CG2
| 0x5450117C
| 0x04
|-
| FALCON_CODE_INDEX
| 0x54501180
| 0x04
|-
| FALCON_CODE
| 0x54501184
| 0x04
|-
| FALCON_CODE_VIRT_ADDR
| 0x54501188
| 0x04
|-
| FALCON_DATA_INDEX0
| 0x545011C0
| 0x04
|-
| FALCON_DATA0
| 0x545011C4
| 0x04
|-
| FALCON_DATA_INDEX1
| 0x545011C8
| 0x04
|-
| FALCON_DATA1
| 0x545011CC
| 0x04
|-
| FALCON_DATA_INDEX2
| 0x545011D0
| 0x04
|-
| FALCON_DATA2
| 0x545011D4
| 0x04
|-
| FALCON_DATA_INDEX3
| 0x545011D8
| 0x04
|-
| FALCON_DATA3
| 0x545011DC
| 0x04
|-
| FALCON_DATA_INDEX4
| 0x545011E0
| 0x04
|-
| FALCON_DATA4
| 0x545011E4
| 0x04
|-
| FALCON_DATA_INDEX5
| 0x545011E8
| 0x04
|-
| FALCON_DATA5
| 0x545011EC
| 0x04
|-
| FALCON_DATA_INDEX6
| 0x545011F0
| 0x04
|-
| FALCON_DATA6
| 0x545011F4
| 0x04
|-
| FALCON_DATA_INDEX7
| 0x545011F8
| 0x04
|-
| FALCON_DATA7
| 0x545011FC
| 0x04
|-
| [[#FALCON_ICD_CMD|FALCON_ICD_CMD]]
| 0x54501200
| 0x04
|-
| FALCON_ICD_ADDR
| 0x54501204
| 0x04
|-
| FALCON_ICD_WDATA
| 0x54501208
| 0x04
|-
| FALCON_ICD_RDATA
| 0x5450120C
| 0x04
|-
| [[#FALCON_SCTL|FALCON_SCTL]]
| 0x54501240
| 0x04
|-
| [[#TSEC_SCP_CTL_ACCESS|TSEC_SCP_CTL_ACCESS]]
| 0x54501400
| 0x04
|-
| [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]]
| 0x54501404
| 0x04
|-
| [[#TSEC_SCP_CTL_STAT|TSEC_SCP_CTL_STAT]]
| 0x54501408
| 0x04
|-
| [[#TSEC_SCP_CTL_MODE|TSEC_SCP_CTL_MODE]]
| 0x5450140C
| 0x04
|-
| TSEC_SCP_UNK0
| 0x54501410
| 0x04
|-
| [[#TSEC_SCP_CTL_PKEY|TSEC_SCP_CTL_PKEY]]
| 0x54501418
| 0x04
|-
| [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]]
| 0x54501420
| 0x04
|-
| [[#TSEC_SCP_SEQ_STAT|TSEC_SCP_SEQ_STAT]]
| 0x54501428
| 0x04
|-
| [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]]
| 0x54501430
| 0x04
|-
| TSEC_SCP_UNK2
| 0x54501454
| 0x04
|-
| [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]]
| 0x54501458
| 0x04
|-
| TSEC_SCP_UNK3
| 0x54501470
| 0x04
|-
| [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT]]
| 0x54501480
| 0x04
|-
| [[#TSEC_SCP_IRQMASK|TSEC_SCP_IRQMASK]]
| 0x54501484
| 0x04
|-
| TSEC_SCP_UNK4
| 0x54501490
| 0x04
|-
| [[#TSEC_SCP_ERR|TSEC_SCP_ERR]]
| 0x54501498
| 0x04
|-
| TSEC_TRNG_CLKDIV
| 0x54501500
| 0x04
|-
| TSEC_TRNG_UNK0
| 0x54501504
| 0x04
|-
| TSEC_TRNG_UNK1
| 0x5450150C
| 0x04
|-
| TSEC_TRNG_UNK2
| 0x54501510
| 0x04
|-
| TSEC_TRNG_UNK3
| 0x54501514
| 0x04
|-
| TSEC_TRNG_UNK4
| 0x54501518
| 0x04
|-
| TSEC_TRNG_UNK5
| 0x5450151C
| 0x04
|-
| TSEC_TRNG_UNK6
| 0x54501528
| 0x04
|-
| TSEC_TRNG_UNK7
| 0x5450152C
| 0x04
|-
| TSEC_TFBIF_UNK0
| 0x54501600
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL|TSEC_TFBIF_MCCIF_FIFOCTRL]]
| 0x54501604
| 0x04
|-
| TSEC_TFBIF_UNK1
| 0x54501608
| 0x04
|-
| TSEC_TFBIF_UNK2
| 0x5450160C
| 0x04
|-
| TSEC_TFBIF_UNK3
| 0x54501630
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL1|TSEC_TFBIF_MCCIF_FIFOCTRL1]]
| 0x54501634
| 0x04
|-
| TSEC_TFBIF_UNK4
| 0x54501640
| 0x04
|-
| [[#TSEC_TFBIF_UNK5|TSEC_TFBIF_UNK5]]
| 0x54501644
| 0x04
|-
| [[#TSEC_TFBIF_UNK6|TSEC_TFBIF_UNK6]]
| 0x54501648
| 0x04
|-
| [[#TSEC_DMA_CMD|TSEC_DMA_CMD]]
| 0x54501700
| 0x04
|-
| [[#TSEC_DMA_ADDR|TSEC_DMA_ADDR]]
| 0x54501704
| 0x04
|-
| [[#TSEC_DMA_VAL|TSEC_DMA_VAL]]
| 0x54501708
| 0x04
|-
| [[#TSEC_DMA_UNK|TSEC_DMA_UNK]]
| 0x5450170C
| 0x04
|-
| TSEC_TEGRA_FALCON_IP_VER
| 0x54501800
| 0x04
|-
| TSEC_TEGRA_UNK0
| 0x54501824
| 0x04
|-
| TSEC_TEGRA_UNK1
| 0x54501828
| 0x04
|-
| TSEC_TEGRA_UNK2
| 0x5450182C
| 0x04
|-
| [[#TSEC_TEGRA_CTL|TSEC_TEGRA_CTL]]
| 0x54501838
| 0x04
|}

=== TSEC_THI_METHOD0 ===
{| class="wikitable" border="1"
! ID
! Method
|-
| 0x200
| SET_APPLICATION_ID
|-
| 0x300
| EXECUTE
|-
| 0x500
| HDCP_INIT
|-
| 0x504
| HDCP_CREATE_SESSION
|-
| 0x508
| HDCP_VERIFY_CERT_RX
|-
| 0x50C
| HDCP_GENERATE_EKM
|-
| 0x510
| HDCP_REVOCATION_CHECK
|-
| 0x514
| HDCP_VERIFY_HPRIME
|-
| 0x518
| HDCP_ENCRYPT_PAIRING_INFO
|-
| 0x51C
| HDCP_DECRYPT_PAIRING_INFO
|-
| 0x520
| HDCP_UPDATE_SESSION
|-
| 0x524
| HDCP_GENERATE_LC_INIT
|-
| 0x528
| HDCP_VERIFY_LPRIME
|-
| 0x52C
| HDCP_GENERATE_SKE_INIT
|-
| 0x530
| HDCP_VERIFY_VPRIME
|-
| 0x534
| HDCP_ENCRYPTION_RUN_CTRL
|-
| 0x538
| HDCP_SESSION_CTRL
|-
| 0x53C
| HDCP_COMPUTE_SPRIME
|-
| 0x540
| HDCP_GET_CERT_RX
|-
| 0x544
| HDCP_EXCHANGE_INFO
|-
| 0x548
| HDCP_DECRYPT_KM
|-
| 0x54C
| HDCP_GET_HPRIME
|-
| 0x550
| HDCP_GENERATE_EKH_KM
|-
| 0x554
| HDCP_VERIFY_RTT_CHALLENGE
|-
| 0x558
| HDCP_GET_LPRIME
|-
| 0x55C
| HDCP_DECRYPT_KS
|-
| 0x560
| HDCP_DECRYPT
|-
| 0x564
| HDCP_GET_RRX
|-
| 0x568
| HDCP_DECRYPT_REENCRYPT
|-
| 0x56C
|
|-
| 0x570
|
|-
| 0x574
|
|-
| 0x578
|
|-
| 0x57C
|
|-
| 0x700
| HDCP_VALIDATE_SRM
|-
| 0x704
| HDCP_VALIDATE_STREAM
|-
| 0x708
| HDCP_TEST_SECURE_STATUS
|-
| 0x70C
| HDCP_SET_DCP_KPUB
|-
| 0x710
| HDCP_SET_RX_KPUB
|-
| 0x714
| HDCP_SET_CERT_RX
|-
| 0x718
| HDCP_SET_SCRATCH_BUFFER
|-
| 0x71C
| HDCP_SET_SRM
|-
| 0x720
| HDCP_SET_RECEIVER_ID_LIST
|-
| 0x724
| HDCP_SET_SPRIME
|-
| 0x728
| HDCP_SET_ENC_INPUT_BUFFER
|-
| 0x72C
| HDCP_SET_ENC_OUTPUT_BUFFER
|-
| 0x730
| HDCP_GET_RTT_CHALLENGE
|-
| 0x734
| HDCP_STREAM_MANAGE
|-
| 0x738
| HDCP_READ_CAPS
|-
| 0x73C
| HDCP_ENCRYPT
|-
| 0x740
| [6.0.0+] HDCP_GET_CURRENT_NONCE
|}

Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_METHOD1 ===
Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_INT_STATUS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_STATUS_FALCON_INT
|}

=== TSEC_THI_INT_MASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_MASK_FALCON_INT
|}

=== FALCON_IRQSSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSSET_GPTMR
|-
| 1
| FALCON_IRQSSET_WDTMR
|-
| 2
| FALCON_IRQSSET_MTHD
|-
| 3
| FALCON_IRQSSET_CTXSW
|-
| 4
| FALCON_IRQSSET_HALT
|-
| 5
| FALCON_IRQSSET_EXTERR
|-
| 6
| FALCON_IRQSSET_SWGEN0
|-
| 7
| FALCON_IRQSSET_SWGEN1
|-
| 8-15
| FALCON_IRQSSET_EXT
|}

Used for setting Falcon's IRQs.

=== FALCON_IRQSCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSCLR_GPTMR
|-
| 1
| FALCON_IRQSCLR_WDTMR
|-
| 2
| FALCON_IRQSCLR_MTHD
|-
| 3
| FALCON_IRQSCLR_CTXSW
|-
| 4
| FALCON_IRQSCLR_HALT
|-
| 5
| FALCON_IRQSCLR_EXTERR
|-
| 6
| FALCON_IRQSCLR_SWGEN0
|-
| 7
| FALCON_IRQSCLR_SWGEN1
|-
| 8-15
| FALCON_IRQSCLR_EXT
|}

Used for clearing Falcon's IRQs.

=== FALCON_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSTAT_GPTMR
|-
| 1
| FALCON_IRQSTAT_WDTMR
|-
| 2
| FALCON_IRQSTAT_MTHD
|-
| 3
| FALCON_IRQSTAT_CTXSW
|-
| 4
| FALCON_IRQSTAT_HALT
|-
| 5
| FALCON_IRQSTAT_EXTERR
|-
| 6
| FALCON_IRQSTAT_SWGEN0
|-
| 7
| FALCON_IRQSTAT_SWGEN1
|-
| 8-15
| FALCON_IRQSTAT_EXT
|}

Used for getting the status of Falcon's IRQs.

=== FALCON_IRQMODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMODE_GPTMR
|-
| 1
| FALCON_IRQMODE_WDTMR
|-
| 2
| FALCON_IRQMODE_MTHD
|-
| 3
| FALCON_IRQMODE_CTXSW
|-
| 4
| FALCON_IRQMODE_HALT
|-
| 5
| FALCON_IRQMODE_EXTERR
|-
| 6
| FALCON_IRQMODE_SWGEN0
|-
| 7
| FALCON_IRQMODE_SWGEN1
|-
| 8-15
| FALCON_IRQMODE_EXT
|}

Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.

=== FALCON_IRQMSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMSET_GPTMR
|-
| 1
| FALCON_IRQMSET_WDTMR
|-
| 2
| FALCON_IRQMSET_MTHD
|-
| 3
| FALCON_IRQMSET_CTXSW
|-
| 4
| FALCON_IRQMSET_HALT
|-
| 5
| FALCON_IRQMSET_EXTERR
|-
| 6
| FALCON_IRQMSET_SWGEN0
|-
| 7
| FALCON_IRQMSET_SWGEN1
|-
| 8-15
| FALCON_IRQMSET_EXT
|}

Used for setting the mask for Falcon's IRQs.

=== FALCON_IRQMCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMCLR_GPTMR
|-
| 1
| FALCON_IRQMCLR_WDTMR
|-
| 2
| FALCON_IRQMCLR_MTHD
|-
| 3
| FALCON_IRQMCLR_CTXSW
|-
| 4
| FALCON_IRQMCLR_HALT
|-
| 5
| FALCON_IRQMCLR_EXTERR
|-
| 6
| FALCON_IRQMCLR_SWGEN0
|-
| 7
| FALCON_IRQMCLR_SWGEN1
|-
| 8-15
| FALCON_IRQMCLR_EXT
|}

Used for clearing the mask for Falcon's IRQs.

=== FALCON_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMASK_GPTMR
|-
| 1
| FALCON_IRQMASK_WDTMR
|-
| 2
| FALCON_IRQMASK_MTHD
|-
| 3
| FALCON_IRQMASK_CTXSW
|-
| 4
| FALCON_IRQMASK_HALT
|-
| 5
| FALCON_IRQMASK_EXTERR
|-
| 6
| FALCON_IRQMASK_SWGEN0
|-
| 7
| FALCON_IRQMASK_SWGEN1
|-
| 8-15
| FALCON_IRQMASK_EXT
|}

Used for getting the value of the mask for Falcon's IRQs.

=== FALCON_IRQDEST ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQDEST_HOST_GPTMR
|-
| 1
| FALCON_IRQDEST_HOST_WDTMR
|-
| 2
| FALCON_IRQDEST_HOST_MTHD
|-
| 3
| FALCON_IRQDEST_HOST_CTXSW
|-
| 4
| FALCON_IRQDEST_HOST_HALT
|-
| 5
| FALCON_IRQDEST_HOST_EXTERR
|-
| 6
| FALCON_IRQDEST_HOST_SWGEN0
|-
| 7
| FALCON_IRQDEST_HOST_SWGEN1
|-
| 8-15
| FALCON_IRQDEST_HOST_EXT
|-
| 16
| FALCON_IRQDEST_TARGET_GPTMR
|-
| 17
| FALCON_IRQDEST_TARGET_WDTMR
|-
| 18
| FALCON_IRQDEST_TARGET_MTHD
|-
| 19
| FALCON_IRQDEST_TARGET_CTXSW
|-
| 20
| FALCON_IRQDEST_TARGET_HALT
|-
| 21
| FALCON_IRQDEST_TARGET_EXTERR
|-
| 22
| FALCON_IRQDEST_TARGET_SWGEN0
|-
| 23
| FALCON_IRQDEST_TARGET_SWGEN1
|-
| 24-31
| FALCON_IRQDEST_TARGET_EXT
|}

Used for routing Falcon's IRQs.

=== FALCON_SCRATCH0 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_SCRATCH1 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_ITFEN ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_ITFEN_CTXEN
|-
| 1
| FALCON_ITFEN_MTHDEN
|}

Used for enabling/disabling Falcon interfaces.

=== FALCON_IDLESTATE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IDLESTATE_FALCON_BUSY
|-
| 1-15
| FALCON_IDLESTATE_EXT_BUSY
|}

Used for detecting if Falcon is busy or not.

=== FALCON_DEBUGINFO ===
Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.

[6.0.0+] [[NV_services|nvservices]] sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.

=== FALCON_EXCI ===
Contains information about raised exceptions.

=== FALCON_CPUCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_CPUCTL_IINVAL
|-
| 1
| FALCON_CPUCTL_STARTCPU
|-
| 2
| FALCON_CPUCTL_SRESET
|-
| 3
| FALCON_CPUCTL_HRESET
|-
| 4
| FALCON_CPUCTL_HALTED
|-
| 5
| FALCON_CPUCTL_STOPPED
|-
| 6
| FALCON_CPUCTL_SCP_UNK
|}

Used for signaling the Falcon CPU.

=== FALCON_BOOTVEC ===
Takes the Falcon's boot vector address.

=== FALCON_HWCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-8
| FALCON_HWCFG_IMEM_SIZE
|-
| 9-17
| FALCON_HWCFG_DMEM_SIZE
|-
| 18-25
| FALCON_HWCFG_MTHD_SIZE
|-
| 26-31
| FALCON_HWCFG_DMATRF_SLOTS
|}

=== FALCON_DMACTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMACTL_REQUIRE_CTX
|-
| 1
| FALCON_DMACTL_DMEM_SCRUBBING
|-
| 2
| FALCON_DMACTL_IMEM_SCRUBBING
|-
| 3-6
| FALCON_DMACTL_DMAQ_NUM
|-
| 7
| FALCON_DMACTL_SECURE_STAT
|}

Used for configuring the Falcon's DMA engine.

=== FALCON_DMATRF_EXTBASE ===
Base of the external memory buffer.

The base of the transfer is calculated by adding [[#FALCON_DMATRF_POFF]] to the base.

=== FALCON_DMATRF_VOFF ===
For transfers to DMEM: the destination address.
For transfers to IMEM: the destination virtual IMEM page.

=== FALCON_DMATRF_POFF ===
For transfers to IMEM: the destination physical IMEM page.

=== FALCON_DMATRFCMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFCMD_FULL
|-
| 1
| FALCON_DMATRFCMD_IDLE
|-
| 2-3
| FALCON_DMATRFCMD_SEC
|-
| 4
| FALCON_DMATRFCMD_IMEM
|-
| 5
| FALCON_DMATRFCMD_WRITE
|-
| 8-10
| FALCON_DMATRFCMD_SIZE
|-
| 12-14
| FALCON_DMATRFCMD_CTXDMA
|}

Used for configuring DMA transfers.

=== FALCON_DMATRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFSTAT_PENDING
|-
| 16-18
| FALCON_DMATRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_DMATRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_CRYPTTRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| FALCON_CRYPTTRFSTAT_PENDING
|-
| 5
| FALCON_CRYPTTRFSTAT_ENABLED
|-
| 16-18
| FALCON_CRYPTTRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_CRYPTTRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_HWCFG2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_HWCFG2_VERSION
|-
| 4-5
| FALCON_HWCFG2_SCP_MODE
|-
| 6-7
| FALCON_HWCFG2_SUBVERSION
|-
| 8-11
| FALCON_HWCFG2_IMEM_PORTS
|-
| 12-15
| FALCON_HWCFG2_DMEM_PORTS
|-
| 16-19
| FALCON_HWCFG2_VM_PAGES_LOG2
|}

=== FALCON_ICD_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_ICD_CMD_OPC
0x0: BREAK
0x1: CONTINUE_FROM_PC
0x2: CONTINUE_FROM_ADDR
0x3: CONTINUE_UNK1_FROM_PC
0x4: CONTINUE_UNK1_FROM_ADDR
0x5: SINGLE_STEP_FROM_PC
0x6: SINGLE_STEP_FROM_ADDR
0x7: SET_BREAK_MASK
0x8: REG_READ
0x9: REG_WRITE
0xA: DATA_READ
0xB: DATA_WRITE
0xC: IO_READ
0xD: IO_WRITE
0xE: STATUS_READ
|-
| 6-7
| FALCON_ICD_CMD_DATA_SIZE
|-
| 8-12
| FALCON_ICD_CMD_IDX
|-
| 14
| FALCON_ICD_CMD_ERROR
|-
| 15
| FALCON_ICD_CMD_DONE
|-
| 16-31
| FALCON_ICD_CMD_BREAK_MASK
|}

=== FALCON_SCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| FALCON_SCTL_SEC_MODE
0: Non-secure
1: Light Secure
2: Heavy Secure
|}

=== TSEC_SCP_CTL_ACCESS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| Enable TSEC_SCP_INSN_STAT register
|}

=== TSEC_SCP_CTL_TRNG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 11
| Unknown
|-
| 12
| Enable the TRNG
|}

=== TSEC_SCP_CTL_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| TSEC_SCP_CTL_STAT_DEBUG_MODE
|}

=== TSEC_SCP_CTL_MODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Disable reads for the TRNG register block
|-
| 1
| Disable reads for the TFBIF register block
|-
| 2
| Disable reads for the DMA register block
|-
| 3
| Disable reads for the TEGRA register block
|-
| 4
| Disable writes for the TRNG register block
|-
| 5
| Disable writes for the TFBIF register block
|-
| 6
| Disable writes for the DMA register block
|-
| 7
| Disable writes for the TEGRA register block
|}

Controls accesses to the other sub-engines and can only be cleared in Heavy Secure mode.

=== TSEC_SCP_CTL_PKEY ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
|-
| 1
| TSEC_SCP_CTL_PKEY_LOADED
|}

=== TSEC_SCP_SEQ0_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 8-11
| Size of current cs0begin macro
|-
|}

=== TSEC_SCP_SEQ_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Set if crypto sequence recording (cs0begin/cs1begin) is active
|-
| 4-7
| Number of instructions left for the crypto sequence
|-
| 12-15
| Active crypto key register
|}

Contains information on the last crypto sequence (cs0 or cs1) executed.

=== TSEC_SCP_INSN_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| Crypto fuc5 destination register or immediate value
|-
| 8-15
| Crypto fuc5 source register or immediate value
|-
| 20-24
| Crypto fuc5 operation
0x0: none (fuc5 opcode 0x00)
0x1: cmov (fuc5 opcode 0x84)
0x2: cxsin (fuc5 opcode 0x88) or xdst (with cxset)
0x3: cxsout (fuc5 opcode 0x8C) or xdld (with cxset)
0x4: crng (fuc5 opcode 0x90)
0x5: cs0begin (fuc5 opcode 0x94)
0x6: cs0exec (fuc5 opcode 0x98)
0x7: cs1begin (fuc5 opcode 0x9C)
0x8: cs1exec (fuc5 opcode 0xA0)
0x9: invalid (fuc5 opcode 0xA4)
0xA: cchmod (fuc5 opcode 0xA8)
0xB: cxor (fuc5 opcode 0xAC)
0xC: cadd (fuc5 opcode 0xB0)
0xD: cand (fuc5 opcode 0xB4)
0xE: crev (fuc5 opcode 0xB8)
0xF: cprecmac (fuc5 opcode 0xBC)
0x10: csecret (fuc5 opcode 0xC0)
0x11: ckeyreg (fuc5 opcode 0xC4)
0x12: ckexp (fuc5 opcode 0xC8)
0x13: ckrexp (fuc5 opcode 0xCC)
0x14: cenc (fuc5 opcode 0xD0)
0x15: cdec (fuc5 opcode 0xD4)
0x16: csigauth (fuc5 opcode 0xD8)
0x17: csigenc (fuc5 opcode 0xDC)
0x18: csigclr (fuc5 opcode 0xE0)
|-
| 31
| Set if running in secure mode (cauth)
|}

Contains information on the last crypto instruction executed.

=== TSEC_SCP_AES_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-4
| First opcode
|-
| 5-9
| Second opcode
|-
| 15-16
| AES operation
0: Encryption
1: Decryption
2: Key expansion
3: Key reverse expansion
|}

Contains information on the last AES sequence executed.

=== TSEC_SCP_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQSTAT_TRNG
|-
| 8
| TSEC_SCP_IRQSTAT_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQSTAT_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQSTAT_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the status of crypto IRQs.

=== TSEC_SCP_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQMASK_TRNG
|-
| 8
| TSEC_SCP_IRQMASK_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQMASK_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQMASK_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the value of the mask for crypto IRQs.

=== TSEC_SCP_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Invalid instruction
|-
| 4
| Empty crypto sequence
|-
| 8
| Crypto sequence is too long
|-
| 12
| Crypto sequence was not finished
|-
| 16
| Invalid cauth signature (during csigenc, csigclr or csigunk)
|-
| 24
| Forbidden instruction
|}

Contains information on crypto errors generated by the [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT_INSN_ERROR]] IRQ.

=== TSEC_TFBIF_MCCIF_FIFOCTRL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
|-
| 1
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
|-
| 2
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
|-
| 3
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
|-
| 4
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
|-
| 5
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
|-
| 6
| TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
|-
| 7
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
|-
| 8
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE
|}

=== TSEC_MCCIF_FIFOCTRL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
|-
| 16-31
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT
|}

=== TSEC_TFBIF_UNK5 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.

=== TSEC_TFBIF_UNK6 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to (data_size << 4) before reading memory from the GPU UCODE carveout.

=== TSEC_DMA_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_DMA_CMD_READ
|-
| 1
| TSEC_DMA_CMD_WRITE
|-
| 4-7
| TSEC_DMA_CMD_UNK
|-
| 12
| TSEC_DMA_CMD_BUSY
|-
| 13
| TSEC_DMA_CMD_ERROR
|-
| 31
| TSEC_DMA_CMD_INIT
|}

A DMA read/write operation requires bits TSEC_DMA_CMD_INIT and TSEC_DMA_CMD_READ/TSEC_DMA_CMD_WRITE to be set in TSEC_DMA_CMD.

During the transfer, the TSEC_DMA_CMD_BUSY bit is set.

Accessing an invalid address causes bit TSEC_DMA_CMD_ERROR to be set.

=== TSEC_DMA_ADDR ===
Takes the address for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_VAL ===
Takes the value for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_UNK ===
Always 0xFFF.

=== TSEC_TEGRA_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 16
| TSEC_TEGRA_CTL_TKFI_KFUSE
|-
| 17
| TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
|-
| 24
| TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
|-
| 25
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
|-
| 26
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
|-
| 27
| TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C
|}

== Authenticated Mode ==
===== Entry =====
From non-secure mode, upon jumping to a page marked as secret, a secret fault occurs. This causes the CPU to verify the region specified in $cauth against the MAC loaded in $c6. If the comparison is successful, the valid bit (bit0) is set on all pages in the $cauth region, and $pc is set to the base of the $cauth region. If the comparsion fails, the CPU is halted.

===== Exit =====
The CPU automatically goes back to non-secure mode when returning back into non-secret pages. When this happens, the valid bit (bit0) in the TLB flags is cleared for all secret pages.

===== Implementation =====
Under certain circumstances, it is possible to observe [[#csigauth|csigauth]] being briefly written to [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]] as "csigauth $c4 $c6" while the opcodes in [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]] are set to "cxsin" and "csigauth", respectively.

Via [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]] it can be observed that a 3-sized macro sequence is loaded into cs0 during a secure mode transition.

== Crypto processing ==
Part of the information here (which hasn't made it into envytools documentation yet) was shared by [https://wiki.0x04.net/wiki/Marcin_Ko%C5%9Bcielnicki mwk] from reverse engineering falcon processors over the years.

=== cauth ===
$cauth is a special purpose register in the CPU.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7 || Start of region to authenticate (in 0x100 pages)
|-
| 8-15 || Unused
|-
| 16 || Use secret xfers (?)
|-
| 17 || Region is signed and encrypted and double the size (?)
|-
| 18 ||
|-
| 19 ||
|-
| 20-23 || Unused
|-
| 31-24 || Size of region to authenticate (in 0x100 pages)
|}

== SCP operations ==

{| class="wikitable" border="1"
! Opcode
! Name
! Operand0
! Operand1
! Operation
! Condition
|-
| 0 || nop || || || ||
|-
| 1 || mov || $cX || $cY || <code>$cX = $cY; ACL(X) = ACL(Y);</code> ||
|-
| 2 || sin || $cX || N/A || <code>$cX = read_stream(); ACL(X) = ???;</code> ||
|-
| 3 || sout || $cX || N/A || <code>write_stream($cX);</code> || ?
|-
| 4 || rnd || $cX || N/A || <code>$cX = read_trng(); ACL(X) = ???;</code> ||
|-
| 5 || s0begin || immX || N/A || <code>record_macro_for_N_instructions(0, immX);</code> ||
|-
| 6 || s0exec || immX || N/A || <code>execute_macro_N_times(0, immX);</code> ||
|-
| 7 || s1begin || immX || N/A || <code>record_macro_for_N_instructions(1, immX);</code> ||
|-
| 8 || s1exec || immX || N/A || <code>execute_macro_N_times(1, immX);</code> ||
|-
| 9 || <invalid> || || || ||
|-
| 0xA || chmod || $cX || immY || Complicated, see [[#ACL|ACL]]. ||
|-
| 0xB || xor || $cX || $cY || <code>$cX ^= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xC || add || $cX || immY || <code>$cX += immY;</code> || <code>(ACL(X) & 2)</code>
|-
| 0xD || and || $cX || $cY || <code>$cX &= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xE || rev || $cX || $cY || <code>$cX = endian_swap128($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0xF || gfmul || $cX || $cY || <code>$cX = gfmul($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 2)</code>
|-
| 0x10 || secret || $cX || immY || <code>$cX = load_secret(immY); ACL(X) = load_secret_acl(immY);</code> ||
|-
| 0x11 || keyreg || immX || || <code>active_key_idx = immX;</code> ||
|-
| 0x12 || kexp || $cX || $cY || <code>$cX = aes_kexp($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0x13 || krexp || $cX || $cY || <code>$cX = aes_kexp_reverse($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0x14 || enc || $cX || $cY || <code>$cX = aes_enc(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 1) && (ACL(Y) & 2)</code>
|-
| 0x15 || dec || $cX || $cY || <code>$cX = aes_dec(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 1) && (ACL(Y) & 2)</code>
|-
| 0x16 || csigauth || $cX || $cY || <code>if (hash_verify($cX, $cY)) { has_sig = true; current_sig = $cX; }</code> || ?
|-
| 0x17 || csigclr || || || <code>has_sig = false;</code> ||
|-
| 0x18 || csigenc || $cX || $cY || <code>if (has_sig) $cX = aes_enc(current_sig, $cY);</code> || ?
|}

=== ACL ===
{| class="wikitable" border="1"
! Bit
! Meaning
|-
| 0 || Secure key. Forced set if bit1 is set. Once cleared, cannot be set again.
|-
| 1 || Secure readable. Once cleared, cannot be set again.
|-
| 2 || Insecure key. Forced set if bit3 is set. Forced clear if bit0 is clear. Can be toggled back and forth.
|-
| 3 || Insecure readable. Forced clear if bit1 is clear. Can be toggled back and forth.
|-
| 4 || Insecure overwritable. Can be toggled back and forth.
|}

==== Initial values ====
On SCP boot, the ACL is 0x1F for all $cX.

Loading into $cX using xdst instruction sets ACL($cX) to 0x13 and 0x1F, for secure and insecure mode respectively.

Spilling a $cX to DMEM using xdld instruction is allowed if (ACL($cX) & 2) or (ACL($cX) & 8), for secure and insecure mode respectively.

=== csigauth ===
<code>00000000: f5 3c XY d8 csigauth $cY $cX</code>

Takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret. This instruction does not work in secure mode.

=== csigclr ===
<code>00000000: f5 3c 00 e0 csigclr</code>

This instruction takes no operands and appears to clear the saved cauth signature used by the csigenc instruction.

=== cchmod ===
<code>00000000: f5 3c XY a8 cchmod $cY 0X</code> or <code>00000000: f5 3c XY a9 cchmod $cY 1X</code>

This instruction takes a crypto register and a 5 bit immediate value.

=== crng ===
<code>00000000: f5 3c 0X 90 crng $cX</code>

This instruction initializes a crypto register with random data.

Executing this instruction only succeeds if the TRNG is enabled for the SCP, which requires taking the following steps:
* Write 0x7FFF to TSEC_TRNG_CLKDIV.
* Write 0x3FF0000 to TSEC_TRNG_UNK0.
* Write 0xFF00 to TSEC_TRNG_UNK7.
* Write 0x1000 to [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]].

Otherwise it hangs forever.

=== cxset ===
cxset instruction provides a way to change behavior of a variable amount of successively executed DMA-related instructions.

for example: <code>000000de: f4 3c 02 cxset 0x2</code>

can be read as: <code>dma_override(type=crypto_reg, count=2)</code>

The argument to cxset specifies the type of behavior change in the top 3 bits, and the number of DMA-related instructions the effect lasts for in the lower 5 bits.

{| class=wikitable
! Bits || Description
|-
| 0-4 || Number of instructions it is valid for (0x1f is a special value meaning infinitely many instructions -- until overriden by another cxset)
|-
| 5 || Crypto destination/source select (0=crypto register, 1=crypto stream)
|-
| 6 || External memory override (0=Disabled, 1=Enabled)
|-
| 7 || Internal memory select (0=DMEM, 1=IMEM)
|}

==== DMA-Related Instructions ====
At least the following instructions may have changed behavior, and count against the cxset "count" argument: <code>xdwait</code>, <code>xdst</code>, <code>xdld</code>.

For example, if override type=0b000, then the "length" argument to <code>xdst</code> is instead treated as the index of the target $cX register.

=== Secrets ===
Falcon's Authenticated Mode has access to 64 128-bit keys which are burned at factory. These keys can be loaded by using the $csecret instruction which takes the target crypto register and the key index as arguments.

{| class=wikitable
! Index || Notes || Console-unique
|-
| 0x00 || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares. || No
|-
| 0x01 || Used by nvhost_nvdec_bl020_prod firmware. ||
|-
| 0x03 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x04 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x05 || Used by nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares. ||
|-
| 0x07 || Used by [6.0.0+] nvhost_tsec firmware. ||
|-
| 0x09 || Used by nvhost_tsec firmware. ||
|-
| 0x0B || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x0F || Used by nvhost_tsec firmware. ||
|-
| 0x10 || Used by [1.0.0-5.1.0] nvhost_tsec firmware. ||
|-
| 0x15 || Used by nvhost_nvdec_bl020_prod, [5.0.0+] nvhost_nvdec020_prod, [5.0.0+] nvhost_nvdec020_ns and [6.0.0+] nvhost_tsec firmwares. ||
|-
| 0x26 || Used by [[TSEC_Firmware#KeygenLdr|KeygenLdr]]. || No
|-
| 0x3C || Used by nvhost_tsec firmware. ||
|-
| 0x3F || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. || Yes
|}

TSEC

2019-01-08T20:29:07Z

Qlutoo: /* csigauth */

TSEC (Tegra Security Co-processor) is a dedicated unit powered by a NVIDIA Falcon microprocessor with crypto extensions.

= Driver =
A host driver for communicating with the TSEC is mapped to physical address 0x54500000 with a total size of 0x40000 bytes and exposes several registers.

== Registers ==
Registers from 0x54500000 to 0x54501000 are used to configure the host interface (HOST1X).

Registers from 0x54501000 to 0x54502000 are a MMIO window for communicating with the Falcon microprocessor. From this range, the subset of registers from 0x54501400 to 0x54501FE8 are specific to the TSEC and are subdivided into:
* 0x54501400 to 0x54501500: SCP (Secure Crypto Processor?).
* 0x54501500 to 0x54501600: TRNG (True Random Number Generator).
* 0x54501600 to 0x54501700: TFBIF (Tegra Framebuffer Interface).
* 0x54501700 to 0x54501800: DMA.
* 0x54501800 to 0x54501900: TEGRA (miscellaneous interfaces).

{| class="wikitable" border="1"
! Name
! Address
! Width
|-
| TSEC_THI_INCR_SYNCPT
| 0x54500000
| 0x04
|-
| TSEC_THI_INCR_SYNCPT_ERR
| 0x54500008
| 0x04
|-
| TSEC_THI_CTXSW_INCR_SYNCPT
| 0x5450000C
| 0x04
|-
| TSEC_THI_CTXSW
| 0x54500020
| 0x04
|-
| TSEC_THI_CONT_SYNCPT_EOF
| 0x54500028
| 0x04
|-
| [[#TSEC_THI_METHOD0|TSEC_THI_METHOD0]]
| 0x54500040
| 0x04
|-
| [[#TSEC_THI_METHOD1|TSEC_THI_METHOD1]]
| 0x54500044
| 0x04
|-
| [[#TSEC_THI_INT_STATUS|TSEC_THI_INT_STATUS]]
| 0x54500078
| 0x04
|-
| [[#TSEC_THI_INT_MASK|TSEC_THI_INT_MASK]]
| 0x5450007C
| 0x04
|-
| TSEC_THI_SLCG_STATUS
| 0x54500084
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_HIGH_A
| 0x54500088
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_LOW_A
| 0x5450008C
| 0x04
|-
| TSEC_THI_CLK_OVERRIDE
| 0x54500E00
| 0x04
|-
| [[#FALCON_IRQSSET|FALCON_IRQSSET]]
| 0x54501000
| 0x04
|-
| [[#FALCON_IRQSCLR|FALCON_IRQSCLR]]
| 0x54501004
| 0x04
|-
| [[#FALCON_IRQSTAT|FALCON_IRQSTAT]]
| 0x54501008
| 0x04
|-
| [[#FALCON_IRQMODE|FALCON_IRQMODE]]
| 0x5450100C
| 0x04
|-
| [[#FALCON_IRQMSET|FALCON_IRQMSET]]
| 0x54501010
| 0x04
|-
| [[#FALCON_IRQMCLR|FALCON_IRQMCLR]]
| 0x54501014
| 0x04
|-
| [[#FALCON_IRQMASK|FALCON_IRQMASK]]
| 0x54501018
| 0x04
|-
| [[#FALCON_IRQDEST|FALCON_IRQDEST]]
| 0x5450101C
| 0x04
|-
| FALCON_GPTMR_PERIOD
| 0x54501020
| 0x04
|-
| FALCON_GPTMR_TIME
| 0x54501024
| 0x04
|-
| FALCON_GPTMR_ENABLE
| 0x54501028
| 0x04
|-
| FALCON_TIME_LOW
| 0x5450102C
| 0x04
|-
| FALCON_TIME_HIGH
| 0x54501030
| 0x04
|-
| FALCON_WDTMR_TIME
| 0x54501034
| 0x04
|-
| FALCON_WDTMR_ENABLE
| 0x54501038
| 0x04
|-
| [[#FALCON_SCRATCH0|FALCON_SCRATCH0]]
| 0x54501040
| 0x04
|-
| [[#FALCON_SCRATCH1|FALCON_SCRATCH1]]
| 0x54501044
| 0x04
|-
| [[#FALCON_ITFEN|FALCON_ITFEN]]
| 0x54501048
| 0x04
|-
| [[#FALCON_IDLESTATE|FALCON_IDLESTATE]]
| 0x5450104C
| 0x04
|-
| FALCON_CURCTX
| 0x54501050
| 0x04
|-
| FALCON_NXTCTX
| 0x54501054
| 0x04
|-
| FALCON_CMDCTX
| 0x54501058
| 0x04
|-
| FALCON_STATUS_MASK
| 0x5450105C
| 0x04
|-
| FALCON_VM_SUPERVISOR
| 0x54501060
| 0x04
|-
| FALCON_MTHD_DATA
| 0x54501064
| 0x04
|-
| FALCON_MTHD_CMD
| 0x54501068
| 0x04
|-
| FALCON_MTHD_DATA_WR
| 0x5450106C
| 0x04
|-
| FALCON_MTHD_OCCUPIED
| 0x54501070
| 0x04
|-
| FALCON_MTHD_ACK
| 0x54501074
| 0x04
|-
| FALCON_MTHD_LIMIT
| 0x54501078
| 0x04
|-
| FALCON_SUBENGINE_RESET
| 0x5450107C
| 0x04
|-
| FALCON_SCRATCH2
| 0x54501080
| 0x04
|-
| FALCON_SCRATCH3
| 0x54501084
| 0x04
|-
| FALCON_PM_TRIGGER
| 0x54501088
| 0x04
|-
| FALCON_PM_MODE
| 0x5450108C
| 0x04
|-
| FALCON_DEBUG1
| 0x54501090
| 0x04
|-
| [[#FALCON_DEBUGINFO|FALCON_DEBUGINFO]]
| 0x54501094
| 0x04
|-
| FALCON_BREAKPOINT0
| 0x54501098
| 0x04
|-
| FALCON_BREAKPOINT1
| 0x5450109C
| 0x04
|-
| FALCON_CGCTL
| 0x545010A0
| 0x04
|-
| FALCON_ENGCTL
| 0x545010A4
| 0x04
|-
| FALCON_PM_SEL
| 0x545010A8
| 0x04
|-
| FALCON_HOST_IO_INDEX
| 0x545010AC
| 0x04
|-
| [[#FALCON_EXCI|FALCON_EXCI]]
| 0x545010D0
| 0x04
|-
| [[#FALCON_CPUCTL|FALCON_CPUCTL]]
| 0x54501100
| 0x04
|-
| [[#FALCON_BOOTVEC|FALCON_BOOTVEC]]
| 0x54501104
| 0x04
|-
| [[#FALCON_HWCFG|FALCON_HWCFG]]
| 0x54501108
| 0x04
|-
| [[#FALCON_DMACTL|FALCON_DMACTL]]
| 0x5450110C
| 0x04
|-
| [[#FALCON_DMATRF_EXTBASE|FALCON_DMATRF_EXTBASE]]
| 0x54501110
| 0x04
|-
| [[#FALCON_DMATRF_VOFF|FALCON_DMATRF_VOFF]]
| 0x54501114
| 0x04
|-
| [[#FALCON_DMATRFCMD|FALCON_DMATRFCMD]]
| 0x54501118
| 0x04
|-
| [[#FALCON_DMATRF_POFF|FALCON_DMATRF_POFF]]
| 0x5450111C
| 0x04
|-
| [[#FALCON_DMATRFSTAT|FALCON_DMATRFSTAT]]
| 0x54501120
| 0x04
|-
| [[#FALCON_CRYPTTRFSTAT|FALCON_CRYPTTRFSTAT]]
| 0x54501124
| 0x04
|-
| FALCON_CPUSTAT
| 0x54501128
| 0x04
|-
| [[#FALCON_HWCFG2|FALCON_HWCFG2]]
| 0x5450112C
| 0x04
|-
| FALCON_CPUCTL_ALIAS
| 0x54501130
| 0x04
|-
| FALCON_TLB_CMD
| 0x54501140
| 0x04
|-
| FALCON_TLB_CMD_RES
| 0x54501144
| 0x04
|-
| FALCON_BRANCH_HISTORY_CTRL
| 0x54501148
| 0x04
|-
| FALCON_BRANCH_HISTORY_PC
| 0x5450114C
| 0x04
|-
| FALCON_IMFILLRNG0
| 0x54501150
| 0x04
|-
| FALCON_IMFILLRNG1
| 0x54501154
| 0x04
|-
| FALCON_IMFILLCTL
| 0x54501158
| 0x04
|-
| FALCON_EXTERRWIN
| 0x54501160
| 0x04
|-
| FALCON_EXTERRCFG
| 0x54501164
| 0x04
|-
| FALCON_EXTERRADDR
| 0x54501168
| 0x04
|-
| FALCON_EXTERRSTAT
| 0x5450116C
| 0x04
|-
| FALCON_CG2
| 0x5450117C
| 0x04
|-
| FALCON_CODE_INDEX
| 0x54501180
| 0x04
|-
| FALCON_CODE
| 0x54501184
| 0x04
|-
| FALCON_CODE_VIRT_ADDR
| 0x54501188
| 0x04
|-
| FALCON_DATA_INDEX0
| 0x545011C0
| 0x04
|-
| FALCON_DATA0
| 0x545011C4
| 0x04
|-
| FALCON_DATA_INDEX1
| 0x545011C8
| 0x04
|-
| FALCON_DATA1
| 0x545011CC
| 0x04
|-
| FALCON_DATA_INDEX2
| 0x545011D0
| 0x04
|-
| FALCON_DATA2
| 0x545011D4
| 0x04
|-
| FALCON_DATA_INDEX3
| 0x545011D8
| 0x04
|-
| FALCON_DATA3
| 0x545011DC
| 0x04
|-
| FALCON_DATA_INDEX4
| 0x545011E0
| 0x04
|-
| FALCON_DATA4
| 0x545011E4
| 0x04
|-
| FALCON_DATA_INDEX5
| 0x545011E8
| 0x04
|-
| FALCON_DATA5
| 0x545011EC
| 0x04
|-
| FALCON_DATA_INDEX6
| 0x545011F0
| 0x04
|-
| FALCON_DATA6
| 0x545011F4
| 0x04
|-
| FALCON_DATA_INDEX7
| 0x545011F8
| 0x04
|-
| FALCON_DATA7
| 0x545011FC
| 0x04
|-
| [[#FALCON_ICD_CMD|FALCON_ICD_CMD]]
| 0x54501200
| 0x04
|-
| FALCON_ICD_ADDR
| 0x54501204
| 0x04
|-
| FALCON_ICD_WDATA
| 0x54501208
| 0x04
|-
| FALCON_ICD_RDATA
| 0x5450120C
| 0x04
|-
| [[#FALCON_SCTL|FALCON_SCTL]]
| 0x54501240
| 0x04
|-
| [[#TSEC_SCP_CTL_ACCESS|TSEC_SCP_CTL_ACCESS]]
| 0x54501400
| 0x04
|-
| [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]]
| 0x54501404
| 0x04
|-
| [[#TSEC_SCP_CTL_STAT|TSEC_SCP_CTL_STAT]]
| 0x54501408
| 0x04
|-
| [[#TSEC_SCP_CTL_MODE|TSEC_SCP_CTL_MODE]]
| 0x5450140C
| 0x04
|-
| TSEC_SCP_UNK0
| 0x54501410
| 0x04
|-
| [[#TSEC_SCP_CTL_PKEY|TSEC_SCP_CTL_PKEY]]
| 0x54501418
| 0x04
|-
| [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]]
| 0x54501420
| 0x04
|-
| [[#TSEC_SCP_SEQ_STAT|TSEC_SCP_SEQ_STAT]]
| 0x54501428
| 0x04
|-
| [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]]
| 0x54501430
| 0x04
|-
| TSEC_SCP_UNK2
| 0x54501454
| 0x04
|-
| [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]]
| 0x54501458
| 0x04
|-
| TSEC_SCP_UNK3
| 0x54501470
| 0x04
|-
| [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT]]
| 0x54501480
| 0x04
|-
| [[#TSEC_SCP_IRQMASK|TSEC_SCP_IRQMASK]]
| 0x54501484
| 0x04
|-
| TSEC_SCP_UNK4
| 0x54501490
| 0x04
|-
| [[#TSEC_SCP_ERR|TSEC_SCP_ERR]]
| 0x54501498
| 0x04
|-
| TSEC_TRNG_CLKDIV
| 0x54501500
| 0x04
|-
| TSEC_TRNG_UNK0
| 0x54501504
| 0x04
|-
| TSEC_TRNG_UNK1
| 0x5450150C
| 0x04
|-
| TSEC_TRNG_UNK2
| 0x54501510
| 0x04
|-
| TSEC_TRNG_UNK3
| 0x54501514
| 0x04
|-
| TSEC_TRNG_UNK4
| 0x54501518
| 0x04
|-
| TSEC_TRNG_UNK5
| 0x5450151C
| 0x04
|-
| TSEC_TRNG_UNK6
| 0x54501528
| 0x04
|-
| TSEC_TRNG_UNK7
| 0x5450152C
| 0x04
|-
| TSEC_TFBIF_UNK0
| 0x54501600
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL|TSEC_TFBIF_MCCIF_FIFOCTRL]]
| 0x54501604
| 0x04
|-
| TSEC_TFBIF_UNK1
| 0x54501608
| 0x04
|-
| TSEC_TFBIF_UNK2
| 0x5450160C
| 0x04
|-
| TSEC_TFBIF_UNK3
| 0x54501630
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL1|TSEC_TFBIF_MCCIF_FIFOCTRL1]]
| 0x54501634
| 0x04
|-
| TSEC_TFBIF_UNK4
| 0x54501640
| 0x04
|-
| [[#TSEC_TFBIF_UNK5|TSEC_TFBIF_UNK5]]
| 0x54501644
| 0x04
|-
| [[#TSEC_TFBIF_UNK6|TSEC_TFBIF_UNK6]]
| 0x54501648
| 0x04
|-
| [[#TSEC_DMA_CMD|TSEC_DMA_CMD]]
| 0x54501700
| 0x04
|-
| [[#TSEC_DMA_ADDR|TSEC_DMA_ADDR]]
| 0x54501704
| 0x04
|-
| [[#TSEC_DMA_VAL|TSEC_DMA_VAL]]
| 0x54501708
| 0x04
|-
| [[#TSEC_DMA_UNK|TSEC_DMA_UNK]]
| 0x5450170C
| 0x04
|-
| TSEC_TEGRA_FALCON_IP_VER
| 0x54501800
| 0x04
|-
| TSEC_TEGRA_UNK0
| 0x54501824
| 0x04
|-
| TSEC_TEGRA_UNK1
| 0x54501828
| 0x04
|-
| TSEC_TEGRA_UNK2
| 0x5450182C
| 0x04
|-
| [[#TSEC_TEGRA_CTL|TSEC_TEGRA_CTL]]
| 0x54501838
| 0x04
|}

=== TSEC_THI_METHOD0 ===
{| class="wikitable" border="1"
! ID
! Method
|-
| 0x200
| SET_APPLICATION_ID
|-
| 0x300
| EXECUTE
|-
| 0x500
| HDCP_INIT
|-
| 0x504
| HDCP_CREATE_SESSION
|-
| 0x508
| HDCP_VERIFY_CERT_RX
|-
| 0x50C
| HDCP_GENERATE_EKM
|-
| 0x510
| HDCP_REVOCATION_CHECK
|-
| 0x514
| HDCP_VERIFY_HPRIME
|-
| 0x518
| HDCP_ENCRYPT_PAIRING_INFO
|-
| 0x51C
| HDCP_DECRYPT_PAIRING_INFO
|-
| 0x520
| HDCP_UPDATE_SESSION
|-
| 0x524
| HDCP_GENERATE_LC_INIT
|-
| 0x528
| HDCP_VERIFY_LPRIME
|-
| 0x52C
| HDCP_GENERATE_SKE_INIT
|-
| 0x530
| HDCP_VERIFY_VPRIME
|-
| 0x534
| HDCP_ENCRYPTION_RUN_CTRL
|-
| 0x538
| HDCP_SESSION_CTRL
|-
| 0x53C
| HDCP_COMPUTE_SPRIME
|-
| 0x540
| HDCP_GET_CERT_RX
|-
| 0x544
| HDCP_EXCHANGE_INFO
|-
| 0x548
| HDCP_DECRYPT_KM
|-
| 0x54C
| HDCP_GET_HPRIME
|-
| 0x550
| HDCP_GENERATE_EKH_KM
|-
| 0x554
| HDCP_VERIFY_RTT_CHALLENGE
|-
| 0x558
| HDCP_GET_LPRIME
|-
| 0x55C
| HDCP_DECRYPT_KS
|-
| 0x560
| HDCP_DECRYPT
|-
| 0x564
| HDCP_GET_RRX
|-
| 0x568
| HDCP_DECRYPT_REENCRYPT
|-
| 0x56C
|
|-
| 0x570
|
|-
| 0x574
|
|-
| 0x578
|
|-
| 0x57C
|
|-
| 0x700
| HDCP_VALIDATE_SRM
|-
| 0x704
| HDCP_VALIDATE_STREAM
|-
| 0x708
| HDCP_TEST_SECURE_STATUS
|-
| 0x70C
| HDCP_SET_DCP_KPUB
|-
| 0x710
| HDCP_SET_RX_KPUB
|-
| 0x714
| HDCP_SET_CERT_RX
|-
| 0x718
| HDCP_SET_SCRATCH_BUFFER
|-
| 0x71C
| HDCP_SET_SRM
|-
| 0x720
| HDCP_SET_RECEIVER_ID_LIST
|-
| 0x724
| HDCP_SET_SPRIME
|-
| 0x728
| HDCP_SET_ENC_INPUT_BUFFER
|-
| 0x72C
| HDCP_SET_ENC_OUTPUT_BUFFER
|-
| 0x730
| HDCP_GET_RTT_CHALLENGE
|-
| 0x734
| HDCP_STREAM_MANAGE
|-
| 0x738
| HDCP_READ_CAPS
|-
| 0x73C
| HDCP_ENCRYPT
|-
| 0x740
| [6.0.0+] HDCP_GET_CURRENT_NONCE
|}

Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_METHOD1 ===
Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_INT_STATUS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_STATUS_FALCON_INT
|}

=== TSEC_THI_INT_MASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_MASK_FALCON_INT
|}

=== FALCON_IRQSSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSSET_GPTMR
|-
| 1
| FALCON_IRQSSET_WDTMR
|-
| 2
| FALCON_IRQSSET_MTHD
|-
| 3
| FALCON_IRQSSET_CTXSW
|-
| 4
| FALCON_IRQSSET_HALT
|-
| 5
| FALCON_IRQSSET_EXTERR
|-
| 6
| FALCON_IRQSSET_SWGEN0
|-
| 7
| FALCON_IRQSSET_SWGEN1
|-
| 8-15
| FALCON_IRQSSET_EXT
|}

Used for setting Falcon's IRQs.

=== FALCON_IRQSCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSCLR_GPTMR
|-
| 1
| FALCON_IRQSCLR_WDTMR
|-
| 2
| FALCON_IRQSCLR_MTHD
|-
| 3
| FALCON_IRQSCLR_CTXSW
|-
| 4
| FALCON_IRQSCLR_HALT
|-
| 5
| FALCON_IRQSCLR_EXTERR
|-
| 6
| FALCON_IRQSCLR_SWGEN0
|-
| 7
| FALCON_IRQSCLR_SWGEN1
|-
| 8-15
| FALCON_IRQSCLR_EXT
|}

Used for clearing Falcon's IRQs.

=== FALCON_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSTAT_GPTMR
|-
| 1
| FALCON_IRQSTAT_WDTMR
|-
| 2
| FALCON_IRQSTAT_MTHD
|-
| 3
| FALCON_IRQSTAT_CTXSW
|-
| 4
| FALCON_IRQSTAT_HALT
|-
| 5
| FALCON_IRQSTAT_EXTERR
|-
| 6
| FALCON_IRQSTAT_SWGEN0
|-
| 7
| FALCON_IRQSTAT_SWGEN1
|-
| 8-15
| FALCON_IRQSTAT_EXT
|}

Used for getting the status of Falcon's IRQs.

=== FALCON_IRQMODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMODE_GPTMR
|-
| 1
| FALCON_IRQMODE_WDTMR
|-
| 2
| FALCON_IRQMODE_MTHD
|-
| 3
| FALCON_IRQMODE_CTXSW
|-
| 4
| FALCON_IRQMODE_HALT
|-
| 5
| FALCON_IRQMODE_EXTERR
|-
| 6
| FALCON_IRQMODE_SWGEN0
|-
| 7
| FALCON_IRQMODE_SWGEN1
|-
| 8-15
| FALCON_IRQMODE_EXT
|}

Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.

=== FALCON_IRQMSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMSET_GPTMR
|-
| 1
| FALCON_IRQMSET_WDTMR
|-
| 2
| FALCON_IRQMSET_MTHD
|-
| 3
| FALCON_IRQMSET_CTXSW
|-
| 4
| FALCON_IRQMSET_HALT
|-
| 5
| FALCON_IRQMSET_EXTERR
|-
| 6
| FALCON_IRQMSET_SWGEN0
|-
| 7
| FALCON_IRQMSET_SWGEN1
|-
| 8-15
| FALCON_IRQMSET_EXT
|}

Used for setting the mask for Falcon's IRQs.

=== FALCON_IRQMCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMCLR_GPTMR
|-
| 1
| FALCON_IRQMCLR_WDTMR
|-
| 2
| FALCON_IRQMCLR_MTHD
|-
| 3
| FALCON_IRQMCLR_CTXSW
|-
| 4
| FALCON_IRQMCLR_HALT
|-
| 5
| FALCON_IRQMCLR_EXTERR
|-
| 6
| FALCON_IRQMCLR_SWGEN0
|-
| 7
| FALCON_IRQMCLR_SWGEN1
|-
| 8-15
| FALCON_IRQMCLR_EXT
|}

Used for clearing the mask for Falcon's IRQs.

=== FALCON_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMASK_GPTMR
|-
| 1
| FALCON_IRQMASK_WDTMR
|-
| 2
| FALCON_IRQMASK_MTHD
|-
| 3
| FALCON_IRQMASK_CTXSW
|-
| 4
| FALCON_IRQMASK_HALT
|-
| 5
| FALCON_IRQMASK_EXTERR
|-
| 6
| FALCON_IRQMASK_SWGEN0
|-
| 7
| FALCON_IRQMASK_SWGEN1
|-
| 8-15
| FALCON_IRQMASK_EXT
|}

Used for getting the value of the mask for Falcon's IRQs.

=== FALCON_IRQDEST ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQDEST_HOST_GPTMR
|-
| 1
| FALCON_IRQDEST_HOST_WDTMR
|-
| 2
| FALCON_IRQDEST_HOST_MTHD
|-
| 3
| FALCON_IRQDEST_HOST_CTXSW
|-
| 4
| FALCON_IRQDEST_HOST_HALT
|-
| 5
| FALCON_IRQDEST_HOST_EXTERR
|-
| 6
| FALCON_IRQDEST_HOST_SWGEN0
|-
| 7
| FALCON_IRQDEST_HOST_SWGEN1
|-
| 8-15
| FALCON_IRQDEST_HOST_EXT
|-
| 16
| FALCON_IRQDEST_TARGET_GPTMR
|-
| 17
| FALCON_IRQDEST_TARGET_WDTMR
|-
| 18
| FALCON_IRQDEST_TARGET_MTHD
|-
| 19
| FALCON_IRQDEST_TARGET_CTXSW
|-
| 20
| FALCON_IRQDEST_TARGET_HALT
|-
| 21
| FALCON_IRQDEST_TARGET_EXTERR
|-
| 22
| FALCON_IRQDEST_TARGET_SWGEN0
|-
| 23
| FALCON_IRQDEST_TARGET_SWGEN1
|-
| 24-31
| FALCON_IRQDEST_TARGET_EXT
|}

Used for routing Falcon's IRQs.

=== FALCON_SCRATCH0 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_SCRATCH1 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_ITFEN ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_ITFEN_CTXEN
|-
| 1
| FALCON_ITFEN_MTHDEN
|}

Used for enabling/disabling Falcon interfaces.

=== FALCON_IDLESTATE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IDLESTATE_FALCON_BUSY
|-
| 1-15
| FALCON_IDLESTATE_EXT_BUSY
|}

Used for detecting if Falcon is busy or not.

=== FALCON_DEBUGINFO ===
Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.

[6.0.0+] [[NV_services|nvservices]] sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.

=== FALCON_EXCI ===
Contains information about raised exceptions.

=== FALCON_CPUCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_CPUCTL_IINVAL
|-
| 1
| FALCON_CPUCTL_STARTCPU
|-
| 2
| FALCON_CPUCTL_SRESET
|-
| 3
| FALCON_CPUCTL_HRESET
|-
| 4
| FALCON_CPUCTL_HALTED
|-
| 5
| FALCON_CPUCTL_STOPPED
|-
| 6
| FALCON_CPUCTL_SCP_UNK
|}

Used for signaling the Falcon CPU.

=== FALCON_BOOTVEC ===
Takes the Falcon's boot vector address.

=== FALCON_HWCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-8
| FALCON_HWCFG_IMEM_SIZE
|-
| 9-17
| FALCON_HWCFG_DMEM_SIZE
|-
| 18-25
| FALCON_HWCFG_MTHD_SIZE
|-
| 26-31
| FALCON_HWCFG_DMATRF_SLOTS
|}

=== FALCON_DMACTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMACTL_REQUIRE_CTX
|-
| 1
| FALCON_DMACTL_DMEM_SCRUBBING
|-
| 2
| FALCON_DMACTL_IMEM_SCRUBBING
|-
| 3-6
| FALCON_DMACTL_DMAQ_NUM
|-
| 7
| FALCON_DMACTL_SECURE_STAT
|}

Used for configuring the Falcon's DMA engine.

=== FALCON_DMATRF_EXTBASE ===
Base of the external memory buffer.

The base of the transfer is calculated by adding [[#FALCON_DMATRF_POFF]] to the base.

=== FALCON_DMATRF_VOFF ===
For transfers to DMEM: the destination address.
For transfers to IMEM: the destination virtual IMEM page.

=== FALCON_DMATRF_POFF ===
For transfers to IMEM: the destination physical IMEM page.

=== FALCON_DMATRFCMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFCMD_FULL
|-
| 1
| FALCON_DMATRFCMD_IDLE
|-
| 2-3
| FALCON_DMATRFCMD_SEC
|-
| 4
| FALCON_DMATRFCMD_IMEM
|-
| 5
| FALCON_DMATRFCMD_WRITE
|-
| 8-10
| FALCON_DMATRFCMD_SIZE
|-
| 12-14
| FALCON_DMATRFCMD_CTXDMA
|}

Used for configuring DMA transfers.

=== FALCON_DMATRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFSTAT_PENDING
|-
| 16-18
| FALCON_DMATRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_DMATRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_CRYPTTRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| FALCON_CRYPTTRFSTAT_PENDING
|-
| 5
| FALCON_CRYPTTRFSTAT_ENABLED
|-
| 16-18
| FALCON_CRYPTTRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_CRYPTTRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_HWCFG2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_HWCFG2_VERSION
|-
| 4-5
| FALCON_HWCFG2_SCP_MODE
|-
| 6-7
| FALCON_HWCFG2_SUBVERSION
|-
| 8-11
| FALCON_HWCFG2_IMEM_PORTS
|-
| 12-15
| FALCON_HWCFG2_DMEM_PORTS
|-
| 16-19
| FALCON_HWCFG2_VM_PAGES_LOG2
|}

=== FALCON_ICD_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_ICD_CMD_OPC
0x0: BREAK
0x1: CONTINUE_FROM_PC
0x2: CONTINUE_FROM_ADDR
0x3: CONTINUE_UNK1_FROM_PC
0x4: CONTINUE_UNK1_FROM_ADDR
0x5: SINGLE_STEP_FROM_PC
0x6: SINGLE_STEP_FROM_ADDR
0x7: SET_BREAK_MASK
0x8: REG_READ
0x9: REG_WRITE
0xA: DATA_READ
0xB: DATA_WRITE
0xC: IO_READ
0xD: IO_WRITE
0xE: STATUS_READ
|-
| 6-7
| FALCON_ICD_CMD_DATA_SIZE
|-
| 8-12
| FALCON_ICD_CMD_IDX
|-
| 14
| FALCON_ICD_CMD_ERROR
|-
| 15
| FALCON_ICD_CMD_DONE
|-
| 16-31
| FALCON_ICD_CMD_BREAK_MASK
|}

=== FALCON_SCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| FALCON_SCTL_SEC_MODE
0: Non-secure
1: Light Secure
2: Heavy Secure
|}

=== TSEC_SCP_CTL_ACCESS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| Enable TSEC_SCP_INSN_STAT register
|}

=== TSEC_SCP_CTL_TRNG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 11
| Unknown
|-
| 12
| Enable the TRNG
|}

=== TSEC_SCP_CTL_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| TSEC_SCP_CTL_STAT_DEBUG_MODE
|}

=== TSEC_SCP_CTL_MODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Disable reads for the TRNG register block
|-
| 1
| Disable reads for the TFBIF register block
|-
| 2
| Disable reads for the DMA register block
|-
| 3
| Disable reads for the TEGRA register block
|-
| 4
| Disable writes for the TRNG register block
|-
| 5
| Disable writes for the TFBIF register block
|-
| 6
| Disable writes for the DMA register block
|-
| 7
| Disable writes for the TEGRA register block
|}

Controls accesses to the other sub-engines and can only be cleared in Heavy Secure mode.

=== TSEC_SCP_CTL_PKEY ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
|-
| 1
| TSEC_SCP_CTL_PKEY_LOADED
|}

=== TSEC_SCP_SEQ0_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 8-11
| Size of current cs0begin macro
|-
|}

=== TSEC_SCP_SEQ_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Set if crypto sequence recording (cs0begin/cs1begin) is active
|-
| 4-7
| Number of instructions left for the crypto sequence
|-
| 12-15
| Active crypto key register
|}

Contains information on the last crypto sequence (cs0 or cs1) executed.

=== TSEC_SCP_INSN_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| Crypto fuc5 destination register or immediate value
|-
| 8-15
| Crypto fuc5 source register or immediate value
|-
| 20-24
| Crypto fuc5 operation
0x0: none (fuc5 opcode 0x00)
0x1: cmov (fuc5 opcode 0x84)
0x2: cxsin (fuc5 opcode 0x88) or xdst (with cxset)
0x3: cxsout (fuc5 opcode 0x8C) or xdld (with cxset)
0x4: crng (fuc5 opcode 0x90)
0x5: cs0begin (fuc5 opcode 0x94)
0x6: cs0exec (fuc5 opcode 0x98)
0x7: cs1begin (fuc5 opcode 0x9C)
0x8: cs1exec (fuc5 opcode 0xA0)
0x9: invalid (fuc5 opcode 0xA4)
0xA: cchmod (fuc5 opcode 0xA8)
0xB: cxor (fuc5 opcode 0xAC)
0xC: cadd (fuc5 opcode 0xB0)
0xD: cand (fuc5 opcode 0xB4)
0xE: crev (fuc5 opcode 0xB8)
0xF: cprecmac (fuc5 opcode 0xBC)
0x10: csecret (fuc5 opcode 0xC0)
0x11: ckeyreg (fuc5 opcode 0xC4)
0x12: ckexp (fuc5 opcode 0xC8)
0x13: ckrexp (fuc5 opcode 0xCC)
0x14: cenc (fuc5 opcode 0xD0)
0x15: cdec (fuc5 opcode 0xD4)
0x16: csigauth (fuc5 opcode 0xD8)
0x17: csigenc (fuc5 opcode 0xDC)
0x18: csigclr (fuc5 opcode 0xE0)
|-
| 31
| Set if running in secure mode (cauth)
|}

Contains information on the last crypto instruction executed.

=== TSEC_SCP_AES_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-4
| First opcode
|-
| 5-9
| Second opcode
|-
| 15-16
| AES operation
0: Encryption
1: Decryption
2: Key expansion
3: Key reverse expansion
|}

Contains information on the last AES sequence executed.

=== TSEC_SCP_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQSTAT_TRNG
|-
| 8
| TSEC_SCP_IRQSTAT_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQSTAT_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQSTAT_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the status of crypto IRQs.

=== TSEC_SCP_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQMASK_TRNG
|-
| 8
| TSEC_SCP_IRQMASK_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQMASK_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQMASK_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the value of the mask for crypto IRQs.

=== TSEC_SCP_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Invalid instruction
|-
| 4
| Empty crypto sequence
|-
| 8
| Crypto sequence is too long
|-
| 12
| Crypto sequence was not finished
|-
| 16
| Invalid cauth signature (during csigenc, csigclr or csigunk)
|-
| 24
| Forbidden instruction
|}

Contains information on crypto errors generated by the [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT_INSN_ERROR]] IRQ.

=== TSEC_TFBIF_MCCIF_FIFOCTRL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
|-
| 1
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
|-
| 2
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
|-
| 3
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
|-
| 4
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
|-
| 5
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
|-
| 6
| TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
|-
| 7
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
|-
| 8
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE
|}

=== TSEC_MCCIF_FIFOCTRL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
|-
| 16-31
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT
|}

=== TSEC_TFBIF_UNK5 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.

=== TSEC_TFBIF_UNK6 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to (data_size << 4) before reading memory from the GPU UCODE carveout.

=== TSEC_DMA_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_DMA_CMD_READ
|-
| 1
| TSEC_DMA_CMD_WRITE
|-
| 4-7
| TSEC_DMA_CMD_UNK
|-
| 12
| TSEC_DMA_CMD_BUSY
|-
| 13
| TSEC_DMA_CMD_ERROR
|-
| 31
| TSEC_DMA_CMD_INIT
|}

A DMA read/write operation requires bits TSEC_DMA_CMD_INIT and TSEC_DMA_CMD_READ/TSEC_DMA_CMD_WRITE to be set in TSEC_DMA_CMD.

During the transfer, the TSEC_DMA_CMD_BUSY bit is set.

Accessing an invalid address causes bit TSEC_DMA_CMD_ERROR to be set.

=== TSEC_DMA_ADDR ===
Takes the address for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_VAL ===
Takes the value for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_UNK ===
Always 0xFFF.

=== TSEC_TEGRA_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 16
| TSEC_TEGRA_CTL_TKFI_KFUSE
|-
| 17
| TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
|-
| 24
| TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
|-
| 25
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
|-
| 26
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
|-
| 27
| TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C
|}

== Authenticated Mode ==
===== Entry =====
From non-secure mode, upon jumping to a page marked as secret, a secret fault occurs. This causes the CPU to verify the region specified in $cauth against the MAC loaded in $c6. If the comparison is successful, the valid bit (bit0) is set on all pages in the $cauth region, and $pc is set to the base of the $cauth region. If the comparsion fails, the CPU is halted.

===== Exit =====
The CPU automatically goes back to non-secure mode when returning back into non-secret pages. When this happens, the valid bit (bit0) in the TLB flags is cleared for all secret pages.

===== Implementation =====
Under certain circumstances, it is possible to observe [[#csigauth|csigauth]] being briefly written to [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]] as "csigauth $c4 $c6" while the opcodes in [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]] are set to "cxsin" and "csigauth", respectively.

Via [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]] it can be observed that a 3-sized macro sequence is loaded into cs0 during a secure mode transition.

== Crypto processing ==
Part of the information here (which hasn't made it into envytools documentation yet) was shared by [https://wiki.0x04.net/wiki/Marcin_Ko%C5%9Bcielnicki mwk] from reverse engineering falcon processors over the years.

=== cauth ===
$cauth is a special purpose register in the CPU.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7 || Start of region to authenticate (in 0x100 pages)
|-
| 8-15 || Unused
|-
| 16 || Use secret xfers (?)
|-
| 17 || Region is signed and encrypted and double the size (?)
|-
| 18 ||
|-
| 19 ||
|-
| 20-23 || Unused
|-
| 31-24 || Size of region to authenticate (in 0x100 pages)
|}

== SCP operations ==

{| class="wikitable" border="1"
! Opcode
! Name
! Operand0
! Operand1
! Operation
! Condition
|-
| 0 || nop || || || ||
|-
| 1 || mov || $cX || $cY || <code>$cX = $cY; ACL(X) = ACL(Y);</code> ||
|-
| 2 || sin || $cX || N/A || <code>$cX = read_stream(); ACL(X) = ???;</code> ||
|-
| 3 || sout || $cX || N/A || <code>write_stream($cX);</code> || ?
|-
| 4 || rnd || $cX || N/A || <code>$cX = read_trng(); ACL(X) = ???;</code> ||
|-
| 5 || s0begin || immX || N/A || <code>record_macro_for_N_instructions(0, immX);</code> ||
|-
| 6 || s0exec || immX || N/A || <code>execute_macro_N_times(0, immX);</code> ||
|-
| 7 || s1begin || immX || N/A || <code>record_macro_for_N_instructions(1, immX);</code> ||
|-
| 8 || s1exec || immX || N/A || <code>execute_macro_N_times(1, immX);</code> ||
|-
| 9 || <invalid> || || || ||
|-
| 0xA || chmod || $cX || immY || Complicated, see [[#ACL|ACL]]. ||
|-
| 0xB || xor || $cX || $cY || <code>$cX ^= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xC || add || $cX || immY || <code>$cX += immY;</code> || <code>(ACL(X) & 2)</code>
|-
| 0xD || and || $cX || $cY || <code>$cX &= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xE || rev || $cX || $cY || <code>$cX = endian_swap128($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0xF || gfmul || $cX || $cY || <code>$cX = gfmul($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 2)</code>
|-
| 0x10 || secret || $cX || immY || <code>$cX = load_secret(immY); ACL(X) = load_secret_acl(immY);</code> ||
|-
| 0x11 || keyreg || immX || || <code>active_key_idx = immX;</code> ||
|-
| 0x12 || kexp || $cX || $cY || <code>$cX = aes_kexp($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0x13 || krexp || $cX || $cY || <code>$cX = aes_kexp_reverse($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0x14 || enc || $cX || $cY || <code>$cX = aes_enc(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 1) && (ACL(Y) & 2)</code>
|-
| 0x15 || dec || $cX || $cY || <code>$cX = aes_dec(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 1) && (ACL(Y) & 2)</code>
|-
| 0x16 || csigauth || $cX || $cY || <code>if (hash_verify($cX, $cY)) { has_sig = true; current_sig = $cX; }</code> || ?
|-
| 0x17 || csigclr || || || <code>has_sig = false;</code> ||
|-
| 0x18 || csigenc || $cX || $cY || <code>if (has_sig) $cX = aes_enc(current_sig, $cY);</code> || ?
|}

=== ACL ===
{| class="wikitable" border="1"
! Bit
! Meaning
|-
| 0 || Secure key. Forced set if bit1 is set. Once cleared, cannot be set again.
|-
| 1 || Secure readable. Once cleared, cannot be set again.
|-
| 2 || Insecure key. Forced set if bit3 is set. Forced clear if bit0 is clear. Can be toggled back and forth.
|-
| 3 || Insecure readable. Forced clear if bit1 is clear. Can be toggled back and forth.
|-
| 4 || Insecure overwritable. Can be toggled back and forth.
|}

==== Initial values ====
On SCP boot, the ACL is 0x1F for all $cX.

Loading into $cX using xdst instruction sets ACL($cX) to 0x3 and 0x1F, for secure and insecure mode respectively.

Spilling a $cX to DMEM using xdld instruction is allowed if (ACL($cX) & 2) or (ACL($cX) & 8), for secure and insecure mode respectively.

=== csigauth ===
<code>00000000: f5 3c XY d8 csigauth $cY $cX</code>

Takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret. This instruction does not work in secure mode.

=== csigclr ===
<code>00000000: f5 3c 00 e0 csigclr</code>

This instruction takes no operands and appears to clear the saved cauth signature used by the csigenc instruction.

=== cchmod ===
<code>00000000: f5 3c XY a8 cchmod $cY 0X</code> or <code>00000000: f5 3c XY a9 cchmod $cY 1X</code>

This instruction takes a crypto register and a 5 bit immediate value.

=== crng ===
<code>00000000: f5 3c 0X 90 crng $cX</code>

This instruction initializes a crypto register with random data.

Executing this instruction only succeeds if the TRNG is enabled for the SCP, which requires taking the following steps:
* Write 0x7FFF to TSEC_TRNG_CLKDIV.
* Write 0x3FF0000 to TSEC_TRNG_UNK0.
* Write 0xFF00 to TSEC_TRNG_UNK7.
* Write 0x1000 to [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]].

Otherwise it hangs forever.

=== cxset ===
cxset instruction provides a way to change behavior of a variable amount of successively executed DMA-related instructions.

for example: <code>000000de: f4 3c 02 cxset 0x2</code>

can be read as: <code>dma_override(type=crypto_reg, count=2)</code>

The argument to cxset specifies the type of behavior change in the top 3 bits, and the number of DMA-related instructions the effect lasts for in the lower 5 bits.

{| class=wikitable
! Bits || Description
|-
| 0-4 || Number of instructions it is valid for (0x1f is a special value meaning infinitely many instructions -- until overriden by another cxset)
|-
| 5 || Crypto destination/source select (0=crypto register, 1=crypto stream)
|-
| 6 || External memory override (0=Disabled, 1=Enabled)
|-
| 7 || Internal memory select (0=DMEM, 1=IMEM)
|}

==== DMA-Related Instructions ====
At least the following instructions may have changed behavior, and count against the cxset "count" argument: <code>xdwait</code>, <code>xdst</code>, <code>xdld</code>.

For example, if override type=0b000, then the "length" argument to <code>xdst</code> is instead treated as the index of the target $cX register.

=== Secrets ===
Falcon's Authenticated Mode has access to 64 128-bit keys which are burned at factory. These keys can be loaded by using the $csecret instruction which takes the target crypto register and the key index as arguments.

{| class=wikitable
! Index || Notes || Console-unique
|-
| 0x00 || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares. || No
|-
| 0x01 || Used by nvhost_nvdec_bl020_prod firmware. ||
|-
| 0x03 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x04 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x05 || Used by nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares. ||
|-
| 0x07 || Used by [6.0.0+] nvhost_tsec firmware. ||
|-
| 0x09 || Used by nvhost_tsec firmware. ||
|-
| 0x0B || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x0F || Used by nvhost_tsec firmware. ||
|-
| 0x10 || Used by [1.0.0-5.1.0] nvhost_tsec firmware. ||
|-
| 0x15 || Used by nvhost_nvdec_bl020_prod, [5.0.0+] nvhost_nvdec020_prod, [5.0.0+] nvhost_nvdec020_ns and [6.0.0+] nvhost_tsec firmwares. ||
|-
| 0x26 || Used by [[TSEC_Firmware#KeygenLdr|KeygenLdr]]. || No
|-
| 0x3C || Used by nvhost_tsec firmware. ||
|-
| 0x3F || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. || Yes
|}

TSEC

2019-01-08T20:28:35Z

Qlutoo: /* cchmod */

TSEC (Tegra Security Co-processor) is a dedicated unit powered by a NVIDIA Falcon microprocessor with crypto extensions.

= Driver =
A host driver for communicating with the TSEC is mapped to physical address 0x54500000 with a total size of 0x40000 bytes and exposes several registers.

== Registers ==
Registers from 0x54500000 to 0x54501000 are used to configure the host interface (HOST1X).

Registers from 0x54501000 to 0x54502000 are a MMIO window for communicating with the Falcon microprocessor. From this range, the subset of registers from 0x54501400 to 0x54501FE8 are specific to the TSEC and are subdivided into:
* 0x54501400 to 0x54501500: SCP (Secure Crypto Processor?).
* 0x54501500 to 0x54501600: TRNG (True Random Number Generator).
* 0x54501600 to 0x54501700: TFBIF (Tegra Framebuffer Interface).
* 0x54501700 to 0x54501800: DMA.
* 0x54501800 to 0x54501900: TEGRA (miscellaneous interfaces).

{| class="wikitable" border="1"
! Name
! Address
! Width
|-
| TSEC_THI_INCR_SYNCPT
| 0x54500000
| 0x04
|-
| TSEC_THI_INCR_SYNCPT_ERR
| 0x54500008
| 0x04
|-
| TSEC_THI_CTXSW_INCR_SYNCPT
| 0x5450000C
| 0x04
|-
| TSEC_THI_CTXSW
| 0x54500020
| 0x04
|-
| TSEC_THI_CONT_SYNCPT_EOF
| 0x54500028
| 0x04
|-
| [[#TSEC_THI_METHOD0|TSEC_THI_METHOD0]]
| 0x54500040
| 0x04
|-
| [[#TSEC_THI_METHOD1|TSEC_THI_METHOD1]]
| 0x54500044
| 0x04
|-
| [[#TSEC_THI_INT_STATUS|TSEC_THI_INT_STATUS]]
| 0x54500078
| 0x04
|-
| [[#TSEC_THI_INT_MASK|TSEC_THI_INT_MASK]]
| 0x5450007C
| 0x04
|-
| TSEC_THI_SLCG_STATUS
| 0x54500084
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_HIGH_A
| 0x54500088
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_LOW_A
| 0x5450008C
| 0x04
|-
| TSEC_THI_CLK_OVERRIDE
| 0x54500E00
| 0x04
|-
| [[#FALCON_IRQSSET|FALCON_IRQSSET]]
| 0x54501000
| 0x04
|-
| [[#FALCON_IRQSCLR|FALCON_IRQSCLR]]
| 0x54501004
| 0x04
|-
| [[#FALCON_IRQSTAT|FALCON_IRQSTAT]]
| 0x54501008
| 0x04
|-
| [[#FALCON_IRQMODE|FALCON_IRQMODE]]
| 0x5450100C
| 0x04
|-
| [[#FALCON_IRQMSET|FALCON_IRQMSET]]
| 0x54501010
| 0x04
|-
| [[#FALCON_IRQMCLR|FALCON_IRQMCLR]]
| 0x54501014
| 0x04
|-
| [[#FALCON_IRQMASK|FALCON_IRQMASK]]
| 0x54501018
| 0x04
|-
| [[#FALCON_IRQDEST|FALCON_IRQDEST]]
| 0x5450101C
| 0x04
|-
| FALCON_GPTMR_PERIOD
| 0x54501020
| 0x04
|-
| FALCON_GPTMR_TIME
| 0x54501024
| 0x04
|-
| FALCON_GPTMR_ENABLE
| 0x54501028
| 0x04
|-
| FALCON_TIME_LOW
| 0x5450102C
| 0x04
|-
| FALCON_TIME_HIGH
| 0x54501030
| 0x04
|-
| FALCON_WDTMR_TIME
| 0x54501034
| 0x04
|-
| FALCON_WDTMR_ENABLE
| 0x54501038
| 0x04
|-
| [[#FALCON_SCRATCH0|FALCON_SCRATCH0]]
| 0x54501040
| 0x04
|-
| [[#FALCON_SCRATCH1|FALCON_SCRATCH1]]
| 0x54501044
| 0x04
|-
| [[#FALCON_ITFEN|FALCON_ITFEN]]
| 0x54501048
| 0x04
|-
| [[#FALCON_IDLESTATE|FALCON_IDLESTATE]]
| 0x5450104C
| 0x04
|-
| FALCON_CURCTX
| 0x54501050
| 0x04
|-
| FALCON_NXTCTX
| 0x54501054
| 0x04
|-
| FALCON_CMDCTX
| 0x54501058
| 0x04
|-
| FALCON_STATUS_MASK
| 0x5450105C
| 0x04
|-
| FALCON_VM_SUPERVISOR
| 0x54501060
| 0x04
|-
| FALCON_MTHD_DATA
| 0x54501064
| 0x04
|-
| FALCON_MTHD_CMD
| 0x54501068
| 0x04
|-
| FALCON_MTHD_DATA_WR
| 0x5450106C
| 0x04
|-
| FALCON_MTHD_OCCUPIED
| 0x54501070
| 0x04
|-
| FALCON_MTHD_ACK
| 0x54501074
| 0x04
|-
| FALCON_MTHD_LIMIT
| 0x54501078
| 0x04
|-
| FALCON_SUBENGINE_RESET
| 0x5450107C
| 0x04
|-
| FALCON_SCRATCH2
| 0x54501080
| 0x04
|-
| FALCON_SCRATCH3
| 0x54501084
| 0x04
|-
| FALCON_PM_TRIGGER
| 0x54501088
| 0x04
|-
| FALCON_PM_MODE
| 0x5450108C
| 0x04
|-
| FALCON_DEBUG1
| 0x54501090
| 0x04
|-
| [[#FALCON_DEBUGINFO|FALCON_DEBUGINFO]]
| 0x54501094
| 0x04
|-
| FALCON_BREAKPOINT0
| 0x54501098
| 0x04
|-
| FALCON_BREAKPOINT1
| 0x5450109C
| 0x04
|-
| FALCON_CGCTL
| 0x545010A0
| 0x04
|-
| FALCON_ENGCTL
| 0x545010A4
| 0x04
|-
| FALCON_PM_SEL
| 0x545010A8
| 0x04
|-
| FALCON_HOST_IO_INDEX
| 0x545010AC
| 0x04
|-
| [[#FALCON_EXCI|FALCON_EXCI]]
| 0x545010D0
| 0x04
|-
| [[#FALCON_CPUCTL|FALCON_CPUCTL]]
| 0x54501100
| 0x04
|-
| [[#FALCON_BOOTVEC|FALCON_BOOTVEC]]
| 0x54501104
| 0x04
|-
| [[#FALCON_HWCFG|FALCON_HWCFG]]
| 0x54501108
| 0x04
|-
| [[#FALCON_DMACTL|FALCON_DMACTL]]
| 0x5450110C
| 0x04
|-
| [[#FALCON_DMATRF_EXTBASE|FALCON_DMATRF_EXTBASE]]
| 0x54501110
| 0x04
|-
| [[#FALCON_DMATRF_VOFF|FALCON_DMATRF_VOFF]]
| 0x54501114
| 0x04
|-
| [[#FALCON_DMATRFCMD|FALCON_DMATRFCMD]]
| 0x54501118
| 0x04
|-
| [[#FALCON_DMATRF_POFF|FALCON_DMATRF_POFF]]
| 0x5450111C
| 0x04
|-
| [[#FALCON_DMATRFSTAT|FALCON_DMATRFSTAT]]
| 0x54501120
| 0x04
|-
| [[#FALCON_CRYPTTRFSTAT|FALCON_CRYPTTRFSTAT]]
| 0x54501124
| 0x04
|-
| FALCON_CPUSTAT
| 0x54501128
| 0x04
|-
| [[#FALCON_HWCFG2|FALCON_HWCFG2]]
| 0x5450112C
| 0x04
|-
| FALCON_CPUCTL_ALIAS
| 0x54501130
| 0x04
|-
| FALCON_TLB_CMD
| 0x54501140
| 0x04
|-
| FALCON_TLB_CMD_RES
| 0x54501144
| 0x04
|-
| FALCON_BRANCH_HISTORY_CTRL
| 0x54501148
| 0x04
|-
| FALCON_BRANCH_HISTORY_PC
| 0x5450114C
| 0x04
|-
| FALCON_IMFILLRNG0
| 0x54501150
| 0x04
|-
| FALCON_IMFILLRNG1
| 0x54501154
| 0x04
|-
| FALCON_IMFILLCTL
| 0x54501158
| 0x04
|-
| FALCON_EXTERRWIN
| 0x54501160
| 0x04
|-
| FALCON_EXTERRCFG
| 0x54501164
| 0x04
|-
| FALCON_EXTERRADDR
| 0x54501168
| 0x04
|-
| FALCON_EXTERRSTAT
| 0x5450116C
| 0x04
|-
| FALCON_CG2
| 0x5450117C
| 0x04
|-
| FALCON_CODE_INDEX
| 0x54501180
| 0x04
|-
| FALCON_CODE
| 0x54501184
| 0x04
|-
| FALCON_CODE_VIRT_ADDR
| 0x54501188
| 0x04
|-
| FALCON_DATA_INDEX0
| 0x545011C0
| 0x04
|-
| FALCON_DATA0
| 0x545011C4
| 0x04
|-
| FALCON_DATA_INDEX1
| 0x545011C8
| 0x04
|-
| FALCON_DATA1
| 0x545011CC
| 0x04
|-
| FALCON_DATA_INDEX2
| 0x545011D0
| 0x04
|-
| FALCON_DATA2
| 0x545011D4
| 0x04
|-
| FALCON_DATA_INDEX3
| 0x545011D8
| 0x04
|-
| FALCON_DATA3
| 0x545011DC
| 0x04
|-
| FALCON_DATA_INDEX4
| 0x545011E0
| 0x04
|-
| FALCON_DATA4
| 0x545011E4
| 0x04
|-
| FALCON_DATA_INDEX5
| 0x545011E8
| 0x04
|-
| FALCON_DATA5
| 0x545011EC
| 0x04
|-
| FALCON_DATA_INDEX6
| 0x545011F0
| 0x04
|-
| FALCON_DATA6
| 0x545011F4
| 0x04
|-
| FALCON_DATA_INDEX7
| 0x545011F8
| 0x04
|-
| FALCON_DATA7
| 0x545011FC
| 0x04
|-
| [[#FALCON_ICD_CMD|FALCON_ICD_CMD]]
| 0x54501200
| 0x04
|-
| FALCON_ICD_ADDR
| 0x54501204
| 0x04
|-
| FALCON_ICD_WDATA
| 0x54501208
| 0x04
|-
| FALCON_ICD_RDATA
| 0x5450120C
| 0x04
|-
| [[#FALCON_SCTL|FALCON_SCTL]]
| 0x54501240
| 0x04
|-
| [[#TSEC_SCP_CTL_ACCESS|TSEC_SCP_CTL_ACCESS]]
| 0x54501400
| 0x04
|-
| [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]]
| 0x54501404
| 0x04
|-
| [[#TSEC_SCP_CTL_STAT|TSEC_SCP_CTL_STAT]]
| 0x54501408
| 0x04
|-
| [[#TSEC_SCP_CTL_MODE|TSEC_SCP_CTL_MODE]]
| 0x5450140C
| 0x04
|-
| TSEC_SCP_UNK0
| 0x54501410
| 0x04
|-
| [[#TSEC_SCP_CTL_PKEY|TSEC_SCP_CTL_PKEY]]
| 0x54501418
| 0x04
|-
| [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]]
| 0x54501420
| 0x04
|-
| [[#TSEC_SCP_SEQ_STAT|TSEC_SCP_SEQ_STAT]]
| 0x54501428
| 0x04
|-
| [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]]
| 0x54501430
| 0x04
|-
| TSEC_SCP_UNK2
| 0x54501454
| 0x04
|-
| [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]]
| 0x54501458
| 0x04
|-
| TSEC_SCP_UNK3
| 0x54501470
| 0x04
|-
| [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT]]
| 0x54501480
| 0x04
|-
| [[#TSEC_SCP_IRQMASK|TSEC_SCP_IRQMASK]]
| 0x54501484
| 0x04
|-
| TSEC_SCP_UNK4
| 0x54501490
| 0x04
|-
| [[#TSEC_SCP_ERR|TSEC_SCP_ERR]]
| 0x54501498
| 0x04
|-
| TSEC_TRNG_CLKDIV
| 0x54501500
| 0x04
|-
| TSEC_TRNG_UNK0
| 0x54501504
| 0x04
|-
| TSEC_TRNG_UNK1
| 0x5450150C
| 0x04
|-
| TSEC_TRNG_UNK2
| 0x54501510
| 0x04
|-
| TSEC_TRNG_UNK3
| 0x54501514
| 0x04
|-
| TSEC_TRNG_UNK4
| 0x54501518
| 0x04
|-
| TSEC_TRNG_UNK5
| 0x5450151C
| 0x04
|-
| TSEC_TRNG_UNK6
| 0x54501528
| 0x04
|-
| TSEC_TRNG_UNK7
| 0x5450152C
| 0x04
|-
| TSEC_TFBIF_UNK0
| 0x54501600
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL|TSEC_TFBIF_MCCIF_FIFOCTRL]]
| 0x54501604
| 0x04
|-
| TSEC_TFBIF_UNK1
| 0x54501608
| 0x04
|-
| TSEC_TFBIF_UNK2
| 0x5450160C
| 0x04
|-
| TSEC_TFBIF_UNK3
| 0x54501630
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL1|TSEC_TFBIF_MCCIF_FIFOCTRL1]]
| 0x54501634
| 0x04
|-
| TSEC_TFBIF_UNK4
| 0x54501640
| 0x04
|-
| [[#TSEC_TFBIF_UNK5|TSEC_TFBIF_UNK5]]
| 0x54501644
| 0x04
|-
| [[#TSEC_TFBIF_UNK6|TSEC_TFBIF_UNK6]]
| 0x54501648
| 0x04
|-
| [[#TSEC_DMA_CMD|TSEC_DMA_CMD]]
| 0x54501700
| 0x04
|-
| [[#TSEC_DMA_ADDR|TSEC_DMA_ADDR]]
| 0x54501704
| 0x04
|-
| [[#TSEC_DMA_VAL|TSEC_DMA_VAL]]
| 0x54501708
| 0x04
|-
| [[#TSEC_DMA_UNK|TSEC_DMA_UNK]]
| 0x5450170C
| 0x04
|-
| TSEC_TEGRA_FALCON_IP_VER
| 0x54501800
| 0x04
|-
| TSEC_TEGRA_UNK0
| 0x54501824
| 0x04
|-
| TSEC_TEGRA_UNK1
| 0x54501828
| 0x04
|-
| TSEC_TEGRA_UNK2
| 0x5450182C
| 0x04
|-
| [[#TSEC_TEGRA_CTL|TSEC_TEGRA_CTL]]
| 0x54501838
| 0x04
|}

=== TSEC_THI_METHOD0 ===
{| class="wikitable" border="1"
! ID
! Method
|-
| 0x200
| SET_APPLICATION_ID
|-
| 0x300
| EXECUTE
|-
| 0x500
| HDCP_INIT
|-
| 0x504
| HDCP_CREATE_SESSION
|-
| 0x508
| HDCP_VERIFY_CERT_RX
|-
| 0x50C
| HDCP_GENERATE_EKM
|-
| 0x510
| HDCP_REVOCATION_CHECK
|-
| 0x514
| HDCP_VERIFY_HPRIME
|-
| 0x518
| HDCP_ENCRYPT_PAIRING_INFO
|-
| 0x51C
| HDCP_DECRYPT_PAIRING_INFO
|-
| 0x520
| HDCP_UPDATE_SESSION
|-
| 0x524
| HDCP_GENERATE_LC_INIT
|-
| 0x528
| HDCP_VERIFY_LPRIME
|-
| 0x52C
| HDCP_GENERATE_SKE_INIT
|-
| 0x530
| HDCP_VERIFY_VPRIME
|-
| 0x534
| HDCP_ENCRYPTION_RUN_CTRL
|-
| 0x538
| HDCP_SESSION_CTRL
|-
| 0x53C
| HDCP_COMPUTE_SPRIME
|-
| 0x540
| HDCP_GET_CERT_RX
|-
| 0x544
| HDCP_EXCHANGE_INFO
|-
| 0x548
| HDCP_DECRYPT_KM
|-
| 0x54C
| HDCP_GET_HPRIME
|-
| 0x550
| HDCP_GENERATE_EKH_KM
|-
| 0x554
| HDCP_VERIFY_RTT_CHALLENGE
|-
| 0x558
| HDCP_GET_LPRIME
|-
| 0x55C
| HDCP_DECRYPT_KS
|-
| 0x560
| HDCP_DECRYPT
|-
| 0x564
| HDCP_GET_RRX
|-
| 0x568
| HDCP_DECRYPT_REENCRYPT
|-
| 0x56C
|
|-
| 0x570
|
|-
| 0x574
|
|-
| 0x578
|
|-
| 0x57C
|
|-
| 0x700
| HDCP_VALIDATE_SRM
|-
| 0x704
| HDCP_VALIDATE_STREAM
|-
| 0x708
| HDCP_TEST_SECURE_STATUS
|-
| 0x70C
| HDCP_SET_DCP_KPUB
|-
| 0x710
| HDCP_SET_RX_KPUB
|-
| 0x714
| HDCP_SET_CERT_RX
|-
| 0x718
| HDCP_SET_SCRATCH_BUFFER
|-
| 0x71C
| HDCP_SET_SRM
|-
| 0x720
| HDCP_SET_RECEIVER_ID_LIST
|-
| 0x724
| HDCP_SET_SPRIME
|-
| 0x728
| HDCP_SET_ENC_INPUT_BUFFER
|-
| 0x72C
| HDCP_SET_ENC_OUTPUT_BUFFER
|-
| 0x730
| HDCP_GET_RTT_CHALLENGE
|-
| 0x734
| HDCP_STREAM_MANAGE
|-
| 0x738
| HDCP_READ_CAPS
|-
| 0x73C
| HDCP_ENCRYPT
|-
| 0x740
| [6.0.0+] HDCP_GET_CURRENT_NONCE
|}

Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_METHOD1 ===
Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_INT_STATUS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_STATUS_FALCON_INT
|}

=== TSEC_THI_INT_MASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_MASK_FALCON_INT
|}

=== FALCON_IRQSSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSSET_GPTMR
|-
| 1
| FALCON_IRQSSET_WDTMR
|-
| 2
| FALCON_IRQSSET_MTHD
|-
| 3
| FALCON_IRQSSET_CTXSW
|-
| 4
| FALCON_IRQSSET_HALT
|-
| 5
| FALCON_IRQSSET_EXTERR
|-
| 6
| FALCON_IRQSSET_SWGEN0
|-
| 7
| FALCON_IRQSSET_SWGEN1
|-
| 8-15
| FALCON_IRQSSET_EXT
|}

Used for setting Falcon's IRQs.

=== FALCON_IRQSCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSCLR_GPTMR
|-
| 1
| FALCON_IRQSCLR_WDTMR
|-
| 2
| FALCON_IRQSCLR_MTHD
|-
| 3
| FALCON_IRQSCLR_CTXSW
|-
| 4
| FALCON_IRQSCLR_HALT
|-
| 5
| FALCON_IRQSCLR_EXTERR
|-
| 6
| FALCON_IRQSCLR_SWGEN0
|-
| 7
| FALCON_IRQSCLR_SWGEN1
|-
| 8-15
| FALCON_IRQSCLR_EXT
|}

Used for clearing Falcon's IRQs.

=== FALCON_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSTAT_GPTMR
|-
| 1
| FALCON_IRQSTAT_WDTMR
|-
| 2
| FALCON_IRQSTAT_MTHD
|-
| 3
| FALCON_IRQSTAT_CTXSW
|-
| 4
| FALCON_IRQSTAT_HALT
|-
| 5
| FALCON_IRQSTAT_EXTERR
|-
| 6
| FALCON_IRQSTAT_SWGEN0
|-
| 7
| FALCON_IRQSTAT_SWGEN1
|-
| 8-15
| FALCON_IRQSTAT_EXT
|}

Used for getting the status of Falcon's IRQs.

=== FALCON_IRQMODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMODE_GPTMR
|-
| 1
| FALCON_IRQMODE_WDTMR
|-
| 2
| FALCON_IRQMODE_MTHD
|-
| 3
| FALCON_IRQMODE_CTXSW
|-
| 4
| FALCON_IRQMODE_HALT
|-
| 5
| FALCON_IRQMODE_EXTERR
|-
| 6
| FALCON_IRQMODE_SWGEN0
|-
| 7
| FALCON_IRQMODE_SWGEN1
|-
| 8-15
| FALCON_IRQMODE_EXT
|}

Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.

=== FALCON_IRQMSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMSET_GPTMR
|-
| 1
| FALCON_IRQMSET_WDTMR
|-
| 2
| FALCON_IRQMSET_MTHD
|-
| 3
| FALCON_IRQMSET_CTXSW
|-
| 4
| FALCON_IRQMSET_HALT
|-
| 5
| FALCON_IRQMSET_EXTERR
|-
| 6
| FALCON_IRQMSET_SWGEN0
|-
| 7
| FALCON_IRQMSET_SWGEN1
|-
| 8-15
| FALCON_IRQMSET_EXT
|}

Used for setting the mask for Falcon's IRQs.

=== FALCON_IRQMCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMCLR_GPTMR
|-
| 1
| FALCON_IRQMCLR_WDTMR
|-
| 2
| FALCON_IRQMCLR_MTHD
|-
| 3
| FALCON_IRQMCLR_CTXSW
|-
| 4
| FALCON_IRQMCLR_HALT
|-
| 5
| FALCON_IRQMCLR_EXTERR
|-
| 6
| FALCON_IRQMCLR_SWGEN0
|-
| 7
| FALCON_IRQMCLR_SWGEN1
|-
| 8-15
| FALCON_IRQMCLR_EXT
|}

Used for clearing the mask for Falcon's IRQs.

=== FALCON_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMASK_GPTMR
|-
| 1
| FALCON_IRQMASK_WDTMR
|-
| 2
| FALCON_IRQMASK_MTHD
|-
| 3
| FALCON_IRQMASK_CTXSW
|-
| 4
| FALCON_IRQMASK_HALT
|-
| 5
| FALCON_IRQMASK_EXTERR
|-
| 6
| FALCON_IRQMASK_SWGEN0
|-
| 7
| FALCON_IRQMASK_SWGEN1
|-
| 8-15
| FALCON_IRQMASK_EXT
|}

Used for getting the value of the mask for Falcon's IRQs.

=== FALCON_IRQDEST ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQDEST_HOST_GPTMR
|-
| 1
| FALCON_IRQDEST_HOST_WDTMR
|-
| 2
| FALCON_IRQDEST_HOST_MTHD
|-
| 3
| FALCON_IRQDEST_HOST_CTXSW
|-
| 4
| FALCON_IRQDEST_HOST_HALT
|-
| 5
| FALCON_IRQDEST_HOST_EXTERR
|-
| 6
| FALCON_IRQDEST_HOST_SWGEN0
|-
| 7
| FALCON_IRQDEST_HOST_SWGEN1
|-
| 8-15
| FALCON_IRQDEST_HOST_EXT
|-
| 16
| FALCON_IRQDEST_TARGET_GPTMR
|-
| 17
| FALCON_IRQDEST_TARGET_WDTMR
|-
| 18
| FALCON_IRQDEST_TARGET_MTHD
|-
| 19
| FALCON_IRQDEST_TARGET_CTXSW
|-
| 20
| FALCON_IRQDEST_TARGET_HALT
|-
| 21
| FALCON_IRQDEST_TARGET_EXTERR
|-
| 22
| FALCON_IRQDEST_TARGET_SWGEN0
|-
| 23
| FALCON_IRQDEST_TARGET_SWGEN1
|-
| 24-31
| FALCON_IRQDEST_TARGET_EXT
|}

Used for routing Falcon's IRQs.

=== FALCON_SCRATCH0 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_SCRATCH1 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_ITFEN ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_ITFEN_CTXEN
|-
| 1
| FALCON_ITFEN_MTHDEN
|}

Used for enabling/disabling Falcon interfaces.

=== FALCON_IDLESTATE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IDLESTATE_FALCON_BUSY
|-
| 1-15
| FALCON_IDLESTATE_EXT_BUSY
|}

Used for detecting if Falcon is busy or not.

=== FALCON_DEBUGINFO ===
Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.

[6.0.0+] [[NV_services|nvservices]] sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.

=== FALCON_EXCI ===
Contains information about raised exceptions.

=== FALCON_CPUCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_CPUCTL_IINVAL
|-
| 1
| FALCON_CPUCTL_STARTCPU
|-
| 2
| FALCON_CPUCTL_SRESET
|-
| 3
| FALCON_CPUCTL_HRESET
|-
| 4
| FALCON_CPUCTL_HALTED
|-
| 5
| FALCON_CPUCTL_STOPPED
|-
| 6
| FALCON_CPUCTL_SCP_UNK
|}

Used for signaling the Falcon CPU.

=== FALCON_BOOTVEC ===
Takes the Falcon's boot vector address.

=== FALCON_HWCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-8
| FALCON_HWCFG_IMEM_SIZE
|-
| 9-17
| FALCON_HWCFG_DMEM_SIZE
|-
| 18-25
| FALCON_HWCFG_MTHD_SIZE
|-
| 26-31
| FALCON_HWCFG_DMATRF_SLOTS
|}

=== FALCON_DMACTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMACTL_REQUIRE_CTX
|-
| 1
| FALCON_DMACTL_DMEM_SCRUBBING
|-
| 2
| FALCON_DMACTL_IMEM_SCRUBBING
|-
| 3-6
| FALCON_DMACTL_DMAQ_NUM
|-
| 7
| FALCON_DMACTL_SECURE_STAT
|}

Used for configuring the Falcon's DMA engine.

=== FALCON_DMATRF_EXTBASE ===
Base of the external memory buffer.

The base of the transfer is calculated by adding [[#FALCON_DMATRF_POFF]] to the base.

=== FALCON_DMATRF_VOFF ===
For transfers to DMEM: the destination address.
For transfers to IMEM: the destination virtual IMEM page.

=== FALCON_DMATRF_POFF ===
For transfers to IMEM: the destination physical IMEM page.

=== FALCON_DMATRFCMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFCMD_FULL
|-
| 1
| FALCON_DMATRFCMD_IDLE
|-
| 2-3
| FALCON_DMATRFCMD_SEC
|-
| 4
| FALCON_DMATRFCMD_IMEM
|-
| 5
| FALCON_DMATRFCMD_WRITE
|-
| 8-10
| FALCON_DMATRFCMD_SIZE
|-
| 12-14
| FALCON_DMATRFCMD_CTXDMA
|}

Used for configuring DMA transfers.

=== FALCON_DMATRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFSTAT_PENDING
|-
| 16-18
| FALCON_DMATRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_DMATRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_CRYPTTRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| FALCON_CRYPTTRFSTAT_PENDING
|-
| 5
| FALCON_CRYPTTRFSTAT_ENABLED
|-
| 16-18
| FALCON_CRYPTTRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_CRYPTTRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_HWCFG2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_HWCFG2_VERSION
|-
| 4-5
| FALCON_HWCFG2_SCP_MODE
|-
| 6-7
| FALCON_HWCFG2_SUBVERSION
|-
| 8-11
| FALCON_HWCFG2_IMEM_PORTS
|-
| 12-15
| FALCON_HWCFG2_DMEM_PORTS
|-
| 16-19
| FALCON_HWCFG2_VM_PAGES_LOG2
|}

=== FALCON_ICD_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_ICD_CMD_OPC
0x0: BREAK
0x1: CONTINUE_FROM_PC
0x2: CONTINUE_FROM_ADDR
0x3: CONTINUE_UNK1_FROM_PC
0x4: CONTINUE_UNK1_FROM_ADDR
0x5: SINGLE_STEP_FROM_PC
0x6: SINGLE_STEP_FROM_ADDR
0x7: SET_BREAK_MASK
0x8: REG_READ
0x9: REG_WRITE
0xA: DATA_READ
0xB: DATA_WRITE
0xC: IO_READ
0xD: IO_WRITE
0xE: STATUS_READ
|-
| 6-7
| FALCON_ICD_CMD_DATA_SIZE
|-
| 8-12
| FALCON_ICD_CMD_IDX
|-
| 14
| FALCON_ICD_CMD_ERROR
|-
| 15
| FALCON_ICD_CMD_DONE
|-
| 16-31
| FALCON_ICD_CMD_BREAK_MASK
|}

=== FALCON_SCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| FALCON_SCTL_SEC_MODE
0: Non-secure
1: Light Secure
2: Heavy Secure
|}

=== TSEC_SCP_CTL_ACCESS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| Enable TSEC_SCP_INSN_STAT register
|}

=== TSEC_SCP_CTL_TRNG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 11
| Unknown
|-
| 12
| Enable the TRNG
|}

=== TSEC_SCP_CTL_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| TSEC_SCP_CTL_STAT_DEBUG_MODE
|}

=== TSEC_SCP_CTL_MODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Disable reads for the TRNG register block
|-
| 1
| Disable reads for the TFBIF register block
|-
| 2
| Disable reads for the DMA register block
|-
| 3
| Disable reads for the TEGRA register block
|-
| 4
| Disable writes for the TRNG register block
|-
| 5
| Disable writes for the TFBIF register block
|-
| 6
| Disable writes for the DMA register block
|-
| 7
| Disable writes for the TEGRA register block
|}

Controls accesses to the other sub-engines and can only be cleared in Heavy Secure mode.

=== TSEC_SCP_CTL_PKEY ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
|-
| 1
| TSEC_SCP_CTL_PKEY_LOADED
|}

=== TSEC_SCP_SEQ0_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 8-11
| Size of current cs0begin macro
|-
|}

=== TSEC_SCP_SEQ_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Set if crypto sequence recording (cs0begin/cs1begin) is active
|-
| 4-7
| Number of instructions left for the crypto sequence
|-
| 12-15
| Active crypto key register
|}

Contains information on the last crypto sequence (cs0 or cs1) executed.

=== TSEC_SCP_INSN_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| Crypto fuc5 destination register or immediate value
|-
| 8-15
| Crypto fuc5 source register or immediate value
|-
| 20-24
| Crypto fuc5 operation
0x0: none (fuc5 opcode 0x00)
0x1: cmov (fuc5 opcode 0x84)
0x2: cxsin (fuc5 opcode 0x88) or xdst (with cxset)
0x3: cxsout (fuc5 opcode 0x8C) or xdld (with cxset)
0x4: crng (fuc5 opcode 0x90)
0x5: cs0begin (fuc5 opcode 0x94)
0x6: cs0exec (fuc5 opcode 0x98)
0x7: cs1begin (fuc5 opcode 0x9C)
0x8: cs1exec (fuc5 opcode 0xA0)
0x9: invalid (fuc5 opcode 0xA4)
0xA: cchmod (fuc5 opcode 0xA8)
0xB: cxor (fuc5 opcode 0xAC)
0xC: cadd (fuc5 opcode 0xB0)
0xD: cand (fuc5 opcode 0xB4)
0xE: crev (fuc5 opcode 0xB8)
0xF: cprecmac (fuc5 opcode 0xBC)
0x10: csecret (fuc5 opcode 0xC0)
0x11: ckeyreg (fuc5 opcode 0xC4)
0x12: ckexp (fuc5 opcode 0xC8)
0x13: ckrexp (fuc5 opcode 0xCC)
0x14: cenc (fuc5 opcode 0xD0)
0x15: cdec (fuc5 opcode 0xD4)
0x16: csigauth (fuc5 opcode 0xD8)
0x17: csigenc (fuc5 opcode 0xDC)
0x18: csigclr (fuc5 opcode 0xE0)
|-
| 31
| Set if running in secure mode (cauth)
|}

Contains information on the last crypto instruction executed.

=== TSEC_SCP_AES_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-4
| First opcode
|-
| 5-9
| Second opcode
|-
| 15-16
| AES operation
0: Encryption
1: Decryption
2: Key expansion
3: Key reverse expansion
|}

Contains information on the last AES sequence executed.

=== TSEC_SCP_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQSTAT_TRNG
|-
| 8
| TSEC_SCP_IRQSTAT_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQSTAT_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQSTAT_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the status of crypto IRQs.

=== TSEC_SCP_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQMASK_TRNG
|-
| 8
| TSEC_SCP_IRQMASK_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQMASK_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQMASK_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the value of the mask for crypto IRQs.

=== TSEC_SCP_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Invalid instruction
|-
| 4
| Empty crypto sequence
|-
| 8
| Crypto sequence is too long
|-
| 12
| Crypto sequence was not finished
|-
| 16
| Invalid cauth signature (during csigenc, csigclr or csigunk)
|-
| 24
| Forbidden instruction
|}

Contains information on crypto errors generated by the [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT_INSN_ERROR]] IRQ.

=== TSEC_TFBIF_MCCIF_FIFOCTRL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
|-
| 1
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
|-
| 2
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
|-
| 3
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
|-
| 4
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
|-
| 5
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
|-
| 6
| TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
|-
| 7
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
|-
| 8
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE
|}

=== TSEC_MCCIF_FIFOCTRL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
|-
| 16-31
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT
|}

=== TSEC_TFBIF_UNK5 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.

=== TSEC_TFBIF_UNK6 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to (data_size << 4) before reading memory from the GPU UCODE carveout.

=== TSEC_DMA_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_DMA_CMD_READ
|-
| 1
| TSEC_DMA_CMD_WRITE
|-
| 4-7
| TSEC_DMA_CMD_UNK
|-
| 12
| TSEC_DMA_CMD_BUSY
|-
| 13
| TSEC_DMA_CMD_ERROR
|-
| 31
| TSEC_DMA_CMD_INIT
|}

A DMA read/write operation requires bits TSEC_DMA_CMD_INIT and TSEC_DMA_CMD_READ/TSEC_DMA_CMD_WRITE to be set in TSEC_DMA_CMD.

During the transfer, the TSEC_DMA_CMD_BUSY bit is set.

Accessing an invalid address causes bit TSEC_DMA_CMD_ERROR to be set.

=== TSEC_DMA_ADDR ===
Takes the address for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_VAL ===
Takes the value for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_UNK ===
Always 0xFFF.

=== TSEC_TEGRA_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 16
| TSEC_TEGRA_CTL_TKFI_KFUSE
|-
| 17
| TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
|-
| 24
| TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
|-
| 25
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
|-
| 26
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
|-
| 27
| TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C
|}

== Authenticated Mode ==
===== Entry =====
From non-secure mode, upon jumping to a page marked as secret, a secret fault occurs. This causes the CPU to verify the region specified in $cauth against the MAC loaded in $c6. If the comparison is successful, the valid bit (bit0) is set on all pages in the $cauth region, and $pc is set to the base of the $cauth region. If the comparsion fails, the CPU is halted.

===== Exit =====
The CPU automatically goes back to non-secure mode when returning back into non-secret pages. When this happens, the valid bit (bit0) in the TLB flags is cleared for all secret pages.

===== Implementation =====
Under certain circumstances, it is possible to observe [[#csigauth|csigauth]] being briefly written to [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]] as "csigauth $c4 $c6" while the opcodes in [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]] are set to "cxsin" and "csigauth", respectively.

Via [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]] it can be observed that a 3-sized macro sequence is loaded into cs0 during a secure mode transition.

== Crypto processing ==
Part of the information here (which hasn't made it into envytools documentation yet) was shared by [https://wiki.0x04.net/wiki/Marcin_Ko%C5%9Bcielnicki mwk] from reverse engineering falcon processors over the years.

=== cauth ===
$cauth is a special purpose register in the CPU.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7 || Start of region to authenticate (in 0x100 pages)
|-
| 8-15 || Unused
|-
| 16 || Use secret xfers (?)
|-
| 17 || Region is signed and encrypted and double the size (?)
|-
| 18 ||
|-
| 19 ||
|-
| 20-23 || Unused
|-
| 31-24 || Size of region to authenticate (in 0x100 pages)
|}

== SCP operations ==

{| class="wikitable" border="1"
! Opcode
! Name
! Operand0
! Operand1
! Operation
! Condition
|-
| 0 || nop || || || ||
|-
| 1 || mov || $cX || $cY || <code>$cX = $cY; ACL(X) = ACL(Y);</code> ||
|-
| 2 || sin || $cX || N/A || <code>$cX = read_stream(); ACL(X) = ???;</code> ||
|-
| 3 || sout || $cX || N/A || <code>write_stream($cX);</code> || ?
|-
| 4 || rnd || $cX || N/A || <code>$cX = read_trng(); ACL(X) = ???;</code> ||
|-
| 5 || s0begin || immX || N/A || <code>record_macro_for_N_instructions(0, immX);</code> ||
|-
| 6 || s0exec || immX || N/A || <code>execute_macro_N_times(0, immX);</code> ||
|-
| 7 || s1begin || immX || N/A || <code>record_macro_for_N_instructions(1, immX);</code> ||
|-
| 8 || s1exec || immX || N/A || <code>execute_macro_N_times(1, immX);</code> ||
|-
| 9 || <invalid> || || || ||
|-
| 0xA || chmod || $cX || immY || Complicated, see [[#ACL|ACL]]. ||
|-
| 0xB || xor || $cX || $cY || <code>$cX ^= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xC || add || $cX || immY || <code>$cX += immY;</code> || <code>(ACL(X) & 2)</code>
|-
| 0xD || and || $cX || $cY || <code>$cX &= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xE || rev || $cX || $cY || <code>$cX = endian_swap128($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0xF || gfmul || $cX || $cY || <code>$cX = gfmul($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 2)</code>
|-
| 0x10 || secret || $cX || immY || <code>$cX = load_secret(immY); ACL(X) = load_secret_acl(immY);</code> ||
|-
| 0x11 || keyreg || immX || || <code>active_key_idx = immX;</code> ||
|-
| 0x12 || kexp || $cX || $cY || <code>$cX = aes_kexp($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0x13 || krexp || $cX || $cY || <code>$cX = aes_kexp_reverse($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0x14 || enc || $cX || $cY || <code>$cX = aes_enc(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 1) && (ACL(Y) & 2)</code>
|-
| 0x15 || dec || $cX || $cY || <code>$cX = aes_dec(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 1) && (ACL(Y) & 2)</code>
|-
| 0x16 || csigauth || $cX || $cY || <code>if (hash_verify($cX, $cY)) { has_sig = true; current_sig = $cX; }</code> || ?
|-
| 0x17 || csigclr || || || <code>has_sig = false;</code> ||
|-
| 0x18 || csigenc || $cX || $cY || <code>if (has_sig) $cX = aes_enc(current_sig, $cY);</code> || ?
|}

=== ACL ===
{| class="wikitable" border="1"
! Bit
! Meaning
|-
| 0 || Secure key. Forced set if bit1 is set. Once cleared, cannot be set again.
|-
| 1 || Secure readable. Once cleared, cannot be set again.
|-
| 2 || Insecure key. Forced set if bit3 is set. Forced clear if bit0 is clear. Can be toggled back and forth.
|-
| 3 || Insecure readable. Forced clear if bit1 is clear. Can be toggled back and forth.
|-
| 4 || Insecure overwritable. Can be toggled back and forth.
|}

==== Initial values ====
On SCP boot, the ACL is 0x1F for all $cX.

Loading into $cX using xdst instruction sets ACL($cX) to 0x3 and 0x1F, for secure and insecure mode respectively.

Spilling a $cX to DMEM using xdld instruction is allowed if (ACL($cX) & 2) or (ACL($cX) & 8), for secure and insecure mode respectively.

=== csigauth ===
<code>00000000: f5 3c XY d8 csigauth $cY $cX</code>

This instruction takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret.

=== csigclr ===
<code>00000000: f5 3c 00 e0 csigclr</code>

This instruction takes no operands and appears to clear the saved cauth signature used by the csigenc instruction.

=== cchmod ===
<code>00000000: f5 3c XY a8 cchmod $cY 0X</code> or <code>00000000: f5 3c XY a9 cchmod $cY 1X</code>

This instruction takes a crypto register and a 5 bit immediate value.

=== crng ===
<code>00000000: f5 3c 0X 90 crng $cX</code>

This instruction initializes a crypto register with random data.

Executing this instruction only succeeds if the TRNG is enabled for the SCP, which requires taking the following steps:
* Write 0x7FFF to TSEC_TRNG_CLKDIV.
* Write 0x3FF0000 to TSEC_TRNG_UNK0.
* Write 0xFF00 to TSEC_TRNG_UNK7.
* Write 0x1000 to [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]].

Otherwise it hangs forever.

=== cxset ===
cxset instruction provides a way to change behavior of a variable amount of successively executed DMA-related instructions.

for example: <code>000000de: f4 3c 02 cxset 0x2</code>

can be read as: <code>dma_override(type=crypto_reg, count=2)</code>

The argument to cxset specifies the type of behavior change in the top 3 bits, and the number of DMA-related instructions the effect lasts for in the lower 5 bits.

{| class=wikitable
! Bits || Description
|-
| 0-4 || Number of instructions it is valid for (0x1f is a special value meaning infinitely many instructions -- until overriden by another cxset)
|-
| 5 || Crypto destination/source select (0=crypto register, 1=crypto stream)
|-
| 6 || External memory override (0=Disabled, 1=Enabled)
|-
| 7 || Internal memory select (0=DMEM, 1=IMEM)
|}

==== DMA-Related Instructions ====
At least the following instructions may have changed behavior, and count against the cxset "count" argument: <code>xdwait</code>, <code>xdst</code>, <code>xdld</code>.

For example, if override type=0b000, then the "length" argument to <code>xdst</code> is instead treated as the index of the target $cX register.

=== Secrets ===
Falcon's Authenticated Mode has access to 64 128-bit keys which are burned at factory. These keys can be loaded by using the $csecret instruction which takes the target crypto register and the key index as arguments.

{| class=wikitable
! Index || Notes || Console-unique
|-
| 0x00 || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares. || No
|-
| 0x01 || Used by nvhost_nvdec_bl020_prod firmware. ||
|-
| 0x03 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x04 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x05 || Used by nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares. ||
|-
| 0x07 || Used by [6.0.0+] nvhost_tsec firmware. ||
|-
| 0x09 || Used by nvhost_tsec firmware. ||
|-
| 0x0B || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x0F || Used by nvhost_tsec firmware. ||
|-
| 0x10 || Used by [1.0.0-5.1.0] nvhost_tsec firmware. ||
|-
| 0x15 || Used by nvhost_nvdec_bl020_prod, [5.0.0+] nvhost_nvdec020_prod, [5.0.0+] nvhost_nvdec020_ns and [6.0.0+] nvhost_tsec firmwares. ||
|-
| 0x26 || Used by [[TSEC_Firmware#KeygenLdr|KeygenLdr]]. || No
|-
| 0x3C || Used by nvhost_tsec firmware. ||
|-
| 0x3F || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. || Yes
|}

TSEC

2019-01-08T20:25:51Z

Qlutoo: /* ACL */

TSEC (Tegra Security Co-processor) is a dedicated unit powered by a NVIDIA Falcon microprocessor with crypto extensions.

= Driver =
A host driver for communicating with the TSEC is mapped to physical address 0x54500000 with a total size of 0x40000 bytes and exposes several registers.

== Registers ==
Registers from 0x54500000 to 0x54501000 are used to configure the host interface (HOST1X).

Registers from 0x54501000 to 0x54502000 are a MMIO window for communicating with the Falcon microprocessor. From this range, the subset of registers from 0x54501400 to 0x54501FE8 are specific to the TSEC and are subdivided into:
* 0x54501400 to 0x54501500: SCP (Secure Crypto Processor?).
* 0x54501500 to 0x54501600: TRNG (True Random Number Generator).
* 0x54501600 to 0x54501700: TFBIF (Tegra Framebuffer Interface).
* 0x54501700 to 0x54501800: DMA.
* 0x54501800 to 0x54501900: TEGRA (miscellaneous interfaces).

{| class="wikitable" border="1"
! Name
! Address
! Width
|-
| TSEC_THI_INCR_SYNCPT
| 0x54500000
| 0x04
|-
| TSEC_THI_INCR_SYNCPT_ERR
| 0x54500008
| 0x04
|-
| TSEC_THI_CTXSW_INCR_SYNCPT
| 0x5450000C
| 0x04
|-
| TSEC_THI_CTXSW
| 0x54500020
| 0x04
|-
| TSEC_THI_CONT_SYNCPT_EOF
| 0x54500028
| 0x04
|-
| [[#TSEC_THI_METHOD0|TSEC_THI_METHOD0]]
| 0x54500040
| 0x04
|-
| [[#TSEC_THI_METHOD1|TSEC_THI_METHOD1]]
| 0x54500044
| 0x04
|-
| [[#TSEC_THI_INT_STATUS|TSEC_THI_INT_STATUS]]
| 0x54500078
| 0x04
|-
| [[#TSEC_THI_INT_MASK|TSEC_THI_INT_MASK]]
| 0x5450007C
| 0x04
|-
| TSEC_THI_SLCG_STATUS
| 0x54500084
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_HIGH_A
| 0x54500088
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_LOW_A
| 0x5450008C
| 0x04
|-
| TSEC_THI_CLK_OVERRIDE
| 0x54500E00
| 0x04
|-
| [[#FALCON_IRQSSET|FALCON_IRQSSET]]
| 0x54501000
| 0x04
|-
| [[#FALCON_IRQSCLR|FALCON_IRQSCLR]]
| 0x54501004
| 0x04
|-
| [[#FALCON_IRQSTAT|FALCON_IRQSTAT]]
| 0x54501008
| 0x04
|-
| [[#FALCON_IRQMODE|FALCON_IRQMODE]]
| 0x5450100C
| 0x04
|-
| [[#FALCON_IRQMSET|FALCON_IRQMSET]]
| 0x54501010
| 0x04
|-
| [[#FALCON_IRQMCLR|FALCON_IRQMCLR]]
| 0x54501014
| 0x04
|-
| [[#FALCON_IRQMASK|FALCON_IRQMASK]]
| 0x54501018
| 0x04
|-
| [[#FALCON_IRQDEST|FALCON_IRQDEST]]
| 0x5450101C
| 0x04
|-
| FALCON_GPTMR_PERIOD
| 0x54501020
| 0x04
|-
| FALCON_GPTMR_TIME
| 0x54501024
| 0x04
|-
| FALCON_GPTMR_ENABLE
| 0x54501028
| 0x04
|-
| FALCON_TIME_LOW
| 0x5450102C
| 0x04
|-
| FALCON_TIME_HIGH
| 0x54501030
| 0x04
|-
| FALCON_WDTMR_TIME
| 0x54501034
| 0x04
|-
| FALCON_WDTMR_ENABLE
| 0x54501038
| 0x04
|-
| [[#FALCON_SCRATCH0|FALCON_SCRATCH0]]
| 0x54501040
| 0x04
|-
| [[#FALCON_SCRATCH1|FALCON_SCRATCH1]]
| 0x54501044
| 0x04
|-
| [[#FALCON_ITFEN|FALCON_ITFEN]]
| 0x54501048
| 0x04
|-
| [[#FALCON_IDLESTATE|FALCON_IDLESTATE]]
| 0x5450104C
| 0x04
|-
| FALCON_CURCTX
| 0x54501050
| 0x04
|-
| FALCON_NXTCTX
| 0x54501054
| 0x04
|-
| FALCON_CMDCTX
| 0x54501058
| 0x04
|-
| FALCON_STATUS_MASK
| 0x5450105C
| 0x04
|-
| FALCON_VM_SUPERVISOR
| 0x54501060
| 0x04
|-
| FALCON_MTHD_DATA
| 0x54501064
| 0x04
|-
| FALCON_MTHD_CMD
| 0x54501068
| 0x04
|-
| FALCON_MTHD_DATA_WR
| 0x5450106C
| 0x04
|-
| FALCON_MTHD_OCCUPIED
| 0x54501070
| 0x04
|-
| FALCON_MTHD_ACK
| 0x54501074
| 0x04
|-
| FALCON_MTHD_LIMIT
| 0x54501078
| 0x04
|-
| FALCON_SUBENGINE_RESET
| 0x5450107C
| 0x04
|-
| FALCON_SCRATCH2
| 0x54501080
| 0x04
|-
| FALCON_SCRATCH3
| 0x54501084
| 0x04
|-
| FALCON_PM_TRIGGER
| 0x54501088
| 0x04
|-
| FALCON_PM_MODE
| 0x5450108C
| 0x04
|-
| FALCON_DEBUG1
| 0x54501090
| 0x04
|-
| [[#FALCON_DEBUGINFO|FALCON_DEBUGINFO]]
| 0x54501094
| 0x04
|-
| FALCON_BREAKPOINT0
| 0x54501098
| 0x04
|-
| FALCON_BREAKPOINT1
| 0x5450109C
| 0x04
|-
| FALCON_CGCTL
| 0x545010A0
| 0x04
|-
| FALCON_ENGCTL
| 0x545010A4
| 0x04
|-
| FALCON_PM_SEL
| 0x545010A8
| 0x04
|-
| FALCON_HOST_IO_INDEX
| 0x545010AC
| 0x04
|-
| [[#FALCON_EXCI|FALCON_EXCI]]
| 0x545010D0
| 0x04
|-
| [[#FALCON_CPUCTL|FALCON_CPUCTL]]
| 0x54501100
| 0x04
|-
| [[#FALCON_BOOTVEC|FALCON_BOOTVEC]]
| 0x54501104
| 0x04
|-
| [[#FALCON_HWCFG|FALCON_HWCFG]]
| 0x54501108
| 0x04
|-
| [[#FALCON_DMACTL|FALCON_DMACTL]]
| 0x5450110C
| 0x04
|-
| [[#FALCON_DMATRF_EXTBASE|FALCON_DMATRF_EXTBASE]]
| 0x54501110
| 0x04
|-
| [[#FALCON_DMATRF_VOFF|FALCON_DMATRF_VOFF]]
| 0x54501114
| 0x04
|-
| [[#FALCON_DMATRFCMD|FALCON_DMATRFCMD]]
| 0x54501118
| 0x04
|-
| [[#FALCON_DMATRF_POFF|FALCON_DMATRF_POFF]]
| 0x5450111C
| 0x04
|-
| [[#FALCON_DMATRFSTAT|FALCON_DMATRFSTAT]]
| 0x54501120
| 0x04
|-
| [[#FALCON_CRYPTTRFSTAT|FALCON_CRYPTTRFSTAT]]
| 0x54501124
| 0x04
|-
| FALCON_CPUSTAT
| 0x54501128
| 0x04
|-
| [[#FALCON_HWCFG2|FALCON_HWCFG2]]
| 0x5450112C
| 0x04
|-
| FALCON_CPUCTL_ALIAS
| 0x54501130
| 0x04
|-
| FALCON_TLB_CMD
| 0x54501140
| 0x04
|-
| FALCON_TLB_CMD_RES
| 0x54501144
| 0x04
|-
| FALCON_BRANCH_HISTORY_CTRL
| 0x54501148
| 0x04
|-
| FALCON_BRANCH_HISTORY_PC
| 0x5450114C
| 0x04
|-
| FALCON_IMFILLRNG0
| 0x54501150
| 0x04
|-
| FALCON_IMFILLRNG1
| 0x54501154
| 0x04
|-
| FALCON_IMFILLCTL
| 0x54501158
| 0x04
|-
| FALCON_EXTERRWIN
| 0x54501160
| 0x04
|-
| FALCON_EXTERRCFG
| 0x54501164
| 0x04
|-
| FALCON_EXTERRADDR
| 0x54501168
| 0x04
|-
| FALCON_EXTERRSTAT
| 0x5450116C
| 0x04
|-
| FALCON_CG2
| 0x5450117C
| 0x04
|-
| FALCON_CODE_INDEX
| 0x54501180
| 0x04
|-
| FALCON_CODE
| 0x54501184
| 0x04
|-
| FALCON_CODE_VIRT_ADDR
| 0x54501188
| 0x04
|-
| FALCON_DATA_INDEX0
| 0x545011C0
| 0x04
|-
| FALCON_DATA0
| 0x545011C4
| 0x04
|-
| FALCON_DATA_INDEX1
| 0x545011C8
| 0x04
|-
| FALCON_DATA1
| 0x545011CC
| 0x04
|-
| FALCON_DATA_INDEX2
| 0x545011D0
| 0x04
|-
| FALCON_DATA2
| 0x545011D4
| 0x04
|-
| FALCON_DATA_INDEX3
| 0x545011D8
| 0x04
|-
| FALCON_DATA3
| 0x545011DC
| 0x04
|-
| FALCON_DATA_INDEX4
| 0x545011E0
| 0x04
|-
| FALCON_DATA4
| 0x545011E4
| 0x04
|-
| FALCON_DATA_INDEX5
| 0x545011E8
| 0x04
|-
| FALCON_DATA5
| 0x545011EC
| 0x04
|-
| FALCON_DATA_INDEX6
| 0x545011F0
| 0x04
|-
| FALCON_DATA6
| 0x545011F4
| 0x04
|-
| FALCON_DATA_INDEX7
| 0x545011F8
| 0x04
|-
| FALCON_DATA7
| 0x545011FC
| 0x04
|-
| [[#FALCON_ICD_CMD|FALCON_ICD_CMD]]
| 0x54501200
| 0x04
|-
| FALCON_ICD_ADDR
| 0x54501204
| 0x04
|-
| FALCON_ICD_WDATA
| 0x54501208
| 0x04
|-
| FALCON_ICD_RDATA
| 0x5450120C
| 0x04
|-
| [[#FALCON_SCTL|FALCON_SCTL]]
| 0x54501240
| 0x04
|-
| [[#TSEC_SCP_CTL_ACCESS|TSEC_SCP_CTL_ACCESS]]
| 0x54501400
| 0x04
|-
| [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]]
| 0x54501404
| 0x04
|-
| [[#TSEC_SCP_CTL_STAT|TSEC_SCP_CTL_STAT]]
| 0x54501408
| 0x04
|-
| [[#TSEC_SCP_CTL_MODE|TSEC_SCP_CTL_MODE]]
| 0x5450140C
| 0x04
|-
| TSEC_SCP_UNK0
| 0x54501410
| 0x04
|-
| [[#TSEC_SCP_CTL_PKEY|TSEC_SCP_CTL_PKEY]]
| 0x54501418
| 0x04
|-
| [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]]
| 0x54501420
| 0x04
|-
| [[#TSEC_SCP_SEQ_STAT|TSEC_SCP_SEQ_STAT]]
| 0x54501428
| 0x04
|-
| [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]]
| 0x54501430
| 0x04
|-
| TSEC_SCP_UNK2
| 0x54501454
| 0x04
|-
| [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]]
| 0x54501458
| 0x04
|-
| TSEC_SCP_UNK3
| 0x54501470
| 0x04
|-
| [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT]]
| 0x54501480
| 0x04
|-
| [[#TSEC_SCP_IRQMASK|TSEC_SCP_IRQMASK]]
| 0x54501484
| 0x04
|-
| TSEC_SCP_UNK4
| 0x54501490
| 0x04
|-
| [[#TSEC_SCP_ERR|TSEC_SCP_ERR]]
| 0x54501498
| 0x04
|-
| TSEC_TRNG_CLKDIV
| 0x54501500
| 0x04
|-
| TSEC_TRNG_UNK0
| 0x54501504
| 0x04
|-
| TSEC_TRNG_UNK1
| 0x5450150C
| 0x04
|-
| TSEC_TRNG_UNK2
| 0x54501510
| 0x04
|-
| TSEC_TRNG_UNK3
| 0x54501514
| 0x04
|-
| TSEC_TRNG_UNK4
| 0x54501518
| 0x04
|-
| TSEC_TRNG_UNK5
| 0x5450151C
| 0x04
|-
| TSEC_TRNG_UNK6
| 0x54501528
| 0x04
|-
| TSEC_TRNG_UNK7
| 0x5450152C
| 0x04
|-
| TSEC_TFBIF_UNK0
| 0x54501600
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL|TSEC_TFBIF_MCCIF_FIFOCTRL]]
| 0x54501604
| 0x04
|-
| TSEC_TFBIF_UNK1
| 0x54501608
| 0x04
|-
| TSEC_TFBIF_UNK2
| 0x5450160C
| 0x04
|-
| TSEC_TFBIF_UNK3
| 0x54501630
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL1|TSEC_TFBIF_MCCIF_FIFOCTRL1]]
| 0x54501634
| 0x04
|-
| TSEC_TFBIF_UNK4
| 0x54501640
| 0x04
|-
| [[#TSEC_TFBIF_UNK5|TSEC_TFBIF_UNK5]]
| 0x54501644
| 0x04
|-
| [[#TSEC_TFBIF_UNK6|TSEC_TFBIF_UNK6]]
| 0x54501648
| 0x04
|-
| [[#TSEC_DMA_CMD|TSEC_DMA_CMD]]
| 0x54501700
| 0x04
|-
| [[#TSEC_DMA_ADDR|TSEC_DMA_ADDR]]
| 0x54501704
| 0x04
|-
| [[#TSEC_DMA_VAL|TSEC_DMA_VAL]]
| 0x54501708
| 0x04
|-
| [[#TSEC_DMA_UNK|TSEC_DMA_UNK]]
| 0x5450170C
| 0x04
|-
| TSEC_TEGRA_FALCON_IP_VER
| 0x54501800
| 0x04
|-
| TSEC_TEGRA_UNK0
| 0x54501824
| 0x04
|-
| TSEC_TEGRA_UNK1
| 0x54501828
| 0x04
|-
| TSEC_TEGRA_UNK2
| 0x5450182C
| 0x04
|-
| [[#TSEC_TEGRA_CTL|TSEC_TEGRA_CTL]]
| 0x54501838
| 0x04
|}

=== TSEC_THI_METHOD0 ===
{| class="wikitable" border="1"
! ID
! Method
|-
| 0x200
| SET_APPLICATION_ID
|-
| 0x300
| EXECUTE
|-
| 0x500
| HDCP_INIT
|-
| 0x504
| HDCP_CREATE_SESSION
|-
| 0x508
| HDCP_VERIFY_CERT_RX
|-
| 0x50C
| HDCP_GENERATE_EKM
|-
| 0x510
| HDCP_REVOCATION_CHECK
|-
| 0x514
| HDCP_VERIFY_HPRIME
|-
| 0x518
| HDCP_ENCRYPT_PAIRING_INFO
|-
| 0x51C
| HDCP_DECRYPT_PAIRING_INFO
|-
| 0x520
| HDCP_UPDATE_SESSION
|-
| 0x524
| HDCP_GENERATE_LC_INIT
|-
| 0x528
| HDCP_VERIFY_LPRIME
|-
| 0x52C
| HDCP_GENERATE_SKE_INIT
|-
| 0x530
| HDCP_VERIFY_VPRIME
|-
| 0x534
| HDCP_ENCRYPTION_RUN_CTRL
|-
| 0x538
| HDCP_SESSION_CTRL
|-
| 0x53C
| HDCP_COMPUTE_SPRIME
|-
| 0x540
| HDCP_GET_CERT_RX
|-
| 0x544
| HDCP_EXCHANGE_INFO
|-
| 0x548
| HDCP_DECRYPT_KM
|-
| 0x54C
| HDCP_GET_HPRIME
|-
| 0x550
| HDCP_GENERATE_EKH_KM
|-
| 0x554
| HDCP_VERIFY_RTT_CHALLENGE
|-
| 0x558
| HDCP_GET_LPRIME
|-
| 0x55C
| HDCP_DECRYPT_KS
|-
| 0x560
| HDCP_DECRYPT
|-
| 0x564
| HDCP_GET_RRX
|-
| 0x568
| HDCP_DECRYPT_REENCRYPT
|-
| 0x56C
|
|-
| 0x570
|
|-
| 0x574
|
|-
| 0x578
|
|-
| 0x57C
|
|-
| 0x700
| HDCP_VALIDATE_SRM
|-
| 0x704
| HDCP_VALIDATE_STREAM
|-
| 0x708
| HDCP_TEST_SECURE_STATUS
|-
| 0x70C
| HDCP_SET_DCP_KPUB
|-
| 0x710
| HDCP_SET_RX_KPUB
|-
| 0x714
| HDCP_SET_CERT_RX
|-
| 0x718
| HDCP_SET_SCRATCH_BUFFER
|-
| 0x71C
| HDCP_SET_SRM
|-
| 0x720
| HDCP_SET_RECEIVER_ID_LIST
|-
| 0x724
| HDCP_SET_SPRIME
|-
| 0x728
| HDCP_SET_ENC_INPUT_BUFFER
|-
| 0x72C
| HDCP_SET_ENC_OUTPUT_BUFFER
|-
| 0x730
| HDCP_GET_RTT_CHALLENGE
|-
| 0x734
| HDCP_STREAM_MANAGE
|-
| 0x738
| HDCP_READ_CAPS
|-
| 0x73C
| HDCP_ENCRYPT
|-
| 0x740
| [6.0.0+] HDCP_GET_CURRENT_NONCE
|}

Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_METHOD1 ===
Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_INT_STATUS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_STATUS_FALCON_INT
|}

=== TSEC_THI_INT_MASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_MASK_FALCON_INT
|}

=== FALCON_IRQSSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSSET_GPTMR
|-
| 1
| FALCON_IRQSSET_WDTMR
|-
| 2
| FALCON_IRQSSET_MTHD
|-
| 3
| FALCON_IRQSSET_CTXSW
|-
| 4
| FALCON_IRQSSET_HALT
|-
| 5
| FALCON_IRQSSET_EXTERR
|-
| 6
| FALCON_IRQSSET_SWGEN0
|-
| 7
| FALCON_IRQSSET_SWGEN1
|-
| 8-15
| FALCON_IRQSSET_EXT
|}

Used for setting Falcon's IRQs.

=== FALCON_IRQSCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSCLR_GPTMR
|-
| 1
| FALCON_IRQSCLR_WDTMR
|-
| 2
| FALCON_IRQSCLR_MTHD
|-
| 3
| FALCON_IRQSCLR_CTXSW
|-
| 4
| FALCON_IRQSCLR_HALT
|-
| 5
| FALCON_IRQSCLR_EXTERR
|-
| 6
| FALCON_IRQSCLR_SWGEN0
|-
| 7
| FALCON_IRQSCLR_SWGEN1
|-
| 8-15
| FALCON_IRQSCLR_EXT
|}

Used for clearing Falcon's IRQs.

=== FALCON_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSTAT_GPTMR
|-
| 1
| FALCON_IRQSTAT_WDTMR
|-
| 2
| FALCON_IRQSTAT_MTHD
|-
| 3
| FALCON_IRQSTAT_CTXSW
|-
| 4
| FALCON_IRQSTAT_HALT
|-
| 5
| FALCON_IRQSTAT_EXTERR
|-
| 6
| FALCON_IRQSTAT_SWGEN0
|-
| 7
| FALCON_IRQSTAT_SWGEN1
|-
| 8-15
| FALCON_IRQSTAT_EXT
|}

Used for getting the status of Falcon's IRQs.

=== FALCON_IRQMODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMODE_GPTMR
|-
| 1
| FALCON_IRQMODE_WDTMR
|-
| 2
| FALCON_IRQMODE_MTHD
|-
| 3
| FALCON_IRQMODE_CTXSW
|-
| 4
| FALCON_IRQMODE_HALT
|-
| 5
| FALCON_IRQMODE_EXTERR
|-
| 6
| FALCON_IRQMODE_SWGEN0
|-
| 7
| FALCON_IRQMODE_SWGEN1
|-
| 8-15
| FALCON_IRQMODE_EXT
|}

Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.

=== FALCON_IRQMSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMSET_GPTMR
|-
| 1
| FALCON_IRQMSET_WDTMR
|-
| 2
| FALCON_IRQMSET_MTHD
|-
| 3
| FALCON_IRQMSET_CTXSW
|-
| 4
| FALCON_IRQMSET_HALT
|-
| 5
| FALCON_IRQMSET_EXTERR
|-
| 6
| FALCON_IRQMSET_SWGEN0
|-
| 7
| FALCON_IRQMSET_SWGEN1
|-
| 8-15
| FALCON_IRQMSET_EXT
|}

Used for setting the mask for Falcon's IRQs.

=== FALCON_IRQMCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMCLR_GPTMR
|-
| 1
| FALCON_IRQMCLR_WDTMR
|-
| 2
| FALCON_IRQMCLR_MTHD
|-
| 3
| FALCON_IRQMCLR_CTXSW
|-
| 4
| FALCON_IRQMCLR_HALT
|-
| 5
| FALCON_IRQMCLR_EXTERR
|-
| 6
| FALCON_IRQMCLR_SWGEN0
|-
| 7
| FALCON_IRQMCLR_SWGEN1
|-
| 8-15
| FALCON_IRQMCLR_EXT
|}

Used for clearing the mask for Falcon's IRQs.

=== FALCON_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMASK_GPTMR
|-
| 1
| FALCON_IRQMASK_WDTMR
|-
| 2
| FALCON_IRQMASK_MTHD
|-
| 3
| FALCON_IRQMASK_CTXSW
|-
| 4
| FALCON_IRQMASK_HALT
|-
| 5
| FALCON_IRQMASK_EXTERR
|-
| 6
| FALCON_IRQMASK_SWGEN0
|-
| 7
| FALCON_IRQMASK_SWGEN1
|-
| 8-15
| FALCON_IRQMASK_EXT
|}

Used for getting the value of the mask for Falcon's IRQs.

=== FALCON_IRQDEST ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQDEST_HOST_GPTMR
|-
| 1
| FALCON_IRQDEST_HOST_WDTMR
|-
| 2
| FALCON_IRQDEST_HOST_MTHD
|-
| 3
| FALCON_IRQDEST_HOST_CTXSW
|-
| 4
| FALCON_IRQDEST_HOST_HALT
|-
| 5
| FALCON_IRQDEST_HOST_EXTERR
|-
| 6
| FALCON_IRQDEST_HOST_SWGEN0
|-
| 7
| FALCON_IRQDEST_HOST_SWGEN1
|-
| 8-15
| FALCON_IRQDEST_HOST_EXT
|-
| 16
| FALCON_IRQDEST_TARGET_GPTMR
|-
| 17
| FALCON_IRQDEST_TARGET_WDTMR
|-
| 18
| FALCON_IRQDEST_TARGET_MTHD
|-
| 19
| FALCON_IRQDEST_TARGET_CTXSW
|-
| 20
| FALCON_IRQDEST_TARGET_HALT
|-
| 21
| FALCON_IRQDEST_TARGET_EXTERR
|-
| 22
| FALCON_IRQDEST_TARGET_SWGEN0
|-
| 23
| FALCON_IRQDEST_TARGET_SWGEN1
|-
| 24-31
| FALCON_IRQDEST_TARGET_EXT
|}

Used for routing Falcon's IRQs.

=== FALCON_SCRATCH0 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_SCRATCH1 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_ITFEN ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_ITFEN_CTXEN
|-
| 1
| FALCON_ITFEN_MTHDEN
|}

Used for enabling/disabling Falcon interfaces.

=== FALCON_IDLESTATE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IDLESTATE_FALCON_BUSY
|-
| 1-15
| FALCON_IDLESTATE_EXT_BUSY
|}

Used for detecting if Falcon is busy or not.

=== FALCON_DEBUGINFO ===
Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.

[6.0.0+] [[NV_services|nvservices]] sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.

=== FALCON_EXCI ===
Contains information about raised exceptions.

=== FALCON_CPUCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_CPUCTL_IINVAL
|-
| 1
| FALCON_CPUCTL_STARTCPU
|-
| 2
| FALCON_CPUCTL_SRESET
|-
| 3
| FALCON_CPUCTL_HRESET
|-
| 4
| FALCON_CPUCTL_HALTED
|-
| 5
| FALCON_CPUCTL_STOPPED
|-
| 6
| FALCON_CPUCTL_SCP_UNK
|}

Used for signaling the Falcon CPU.

=== FALCON_BOOTVEC ===
Takes the Falcon's boot vector address.

=== FALCON_HWCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-8
| FALCON_HWCFG_IMEM_SIZE
|-
| 9-17
| FALCON_HWCFG_DMEM_SIZE
|-
| 18-25
| FALCON_HWCFG_MTHD_SIZE
|-
| 26-31
| FALCON_HWCFG_DMATRF_SLOTS
|}

=== FALCON_DMACTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMACTL_REQUIRE_CTX
|-
| 1
| FALCON_DMACTL_DMEM_SCRUBBING
|-
| 2
| FALCON_DMACTL_IMEM_SCRUBBING
|-
| 3-6
| FALCON_DMACTL_DMAQ_NUM
|-
| 7
| FALCON_DMACTL_SECURE_STAT
|}

Used for configuring the Falcon's DMA engine.

=== FALCON_DMATRF_EXTBASE ===
Base of the external memory buffer.

The base of the transfer is calculated by adding [[#FALCON_DMATRF_POFF]] to the base.

=== FALCON_DMATRF_VOFF ===
For transfers to DMEM: the destination address.
For transfers to IMEM: the destination virtual IMEM page.

=== FALCON_DMATRF_POFF ===
For transfers to IMEM: the destination physical IMEM page.

=== FALCON_DMATRFCMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFCMD_FULL
|-
| 1
| FALCON_DMATRFCMD_IDLE
|-
| 2-3
| FALCON_DMATRFCMD_SEC
|-
| 4
| FALCON_DMATRFCMD_IMEM
|-
| 5
| FALCON_DMATRFCMD_WRITE
|-
| 8-10
| FALCON_DMATRFCMD_SIZE
|-
| 12-14
| FALCON_DMATRFCMD_CTXDMA
|}

Used for configuring DMA transfers.

=== FALCON_DMATRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFSTAT_PENDING
|-
| 16-18
| FALCON_DMATRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_DMATRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_CRYPTTRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| FALCON_CRYPTTRFSTAT_PENDING
|-
| 5
| FALCON_CRYPTTRFSTAT_ENABLED
|-
| 16-18
| FALCON_CRYPTTRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_CRYPTTRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_HWCFG2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_HWCFG2_VERSION
|-
| 4-5
| FALCON_HWCFG2_SCP_MODE
|-
| 6-7
| FALCON_HWCFG2_SUBVERSION
|-
| 8-11
| FALCON_HWCFG2_IMEM_PORTS
|-
| 12-15
| FALCON_HWCFG2_DMEM_PORTS
|-
| 16-19
| FALCON_HWCFG2_VM_PAGES_LOG2
|}

=== FALCON_ICD_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_ICD_CMD_OPC
0x0: BREAK
0x1: CONTINUE_FROM_PC
0x2: CONTINUE_FROM_ADDR
0x3: CONTINUE_UNK1_FROM_PC
0x4: CONTINUE_UNK1_FROM_ADDR
0x5: SINGLE_STEP_FROM_PC
0x6: SINGLE_STEP_FROM_ADDR
0x7: SET_BREAK_MASK
0x8: REG_READ
0x9: REG_WRITE
0xA: DATA_READ
0xB: DATA_WRITE
0xC: IO_READ
0xD: IO_WRITE
0xE: STATUS_READ
|-
| 6-7
| FALCON_ICD_CMD_DATA_SIZE
|-
| 8-12
| FALCON_ICD_CMD_IDX
|-
| 14
| FALCON_ICD_CMD_ERROR
|-
| 15
| FALCON_ICD_CMD_DONE
|-
| 16-31
| FALCON_ICD_CMD_BREAK_MASK
|}

=== FALCON_SCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| FALCON_SCTL_SEC_MODE
0: Non-secure
1: Light Secure
2: Heavy Secure
|}

=== TSEC_SCP_CTL_ACCESS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| Enable TSEC_SCP_INSN_STAT register
|}

=== TSEC_SCP_CTL_TRNG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 11
| Unknown
|-
| 12
| Enable the TRNG
|}

=== TSEC_SCP_CTL_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| TSEC_SCP_CTL_STAT_DEBUG_MODE
|}

=== TSEC_SCP_CTL_MODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Disable reads for the TRNG register block
|-
| 1
| Disable reads for the TFBIF register block
|-
| 2
| Disable reads for the DMA register block
|-
| 3
| Disable reads for the TEGRA register block
|-
| 4
| Disable writes for the TRNG register block
|-
| 5
| Disable writes for the TFBIF register block
|-
| 6
| Disable writes for the DMA register block
|-
| 7
| Disable writes for the TEGRA register block
|}

Controls accesses to the other sub-engines and can only be cleared in Heavy Secure mode.

=== TSEC_SCP_CTL_PKEY ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
|-
| 1
| TSEC_SCP_CTL_PKEY_LOADED
|}

=== TSEC_SCP_SEQ0_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 8-11
| Size of current cs0begin macro
|-
|}

=== TSEC_SCP_SEQ_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Set if crypto sequence recording (cs0begin/cs1begin) is active
|-
| 4-7
| Number of instructions left for the crypto sequence
|-
| 12-15
| Active crypto key register
|}

Contains information on the last crypto sequence (cs0 or cs1) executed.

=== TSEC_SCP_INSN_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| Crypto fuc5 destination register or immediate value
|-
| 8-15
| Crypto fuc5 source register or immediate value
|-
| 20-24
| Crypto fuc5 operation
0x0: none (fuc5 opcode 0x00)
0x1: cmov (fuc5 opcode 0x84)
0x2: cxsin (fuc5 opcode 0x88) or xdst (with cxset)
0x3: cxsout (fuc5 opcode 0x8C) or xdld (with cxset)
0x4: crng (fuc5 opcode 0x90)
0x5: cs0begin (fuc5 opcode 0x94)
0x6: cs0exec (fuc5 opcode 0x98)
0x7: cs1begin (fuc5 opcode 0x9C)
0x8: cs1exec (fuc5 opcode 0xA0)
0x9: invalid (fuc5 opcode 0xA4)
0xA: cchmod (fuc5 opcode 0xA8)
0xB: cxor (fuc5 opcode 0xAC)
0xC: cadd (fuc5 opcode 0xB0)
0xD: cand (fuc5 opcode 0xB4)
0xE: crev (fuc5 opcode 0xB8)
0xF: cprecmac (fuc5 opcode 0xBC)
0x10: csecret (fuc5 opcode 0xC0)
0x11: ckeyreg (fuc5 opcode 0xC4)
0x12: ckexp (fuc5 opcode 0xC8)
0x13: ckrexp (fuc5 opcode 0xCC)
0x14: cenc (fuc5 opcode 0xD0)
0x15: cdec (fuc5 opcode 0xD4)
0x16: csigauth (fuc5 opcode 0xD8)
0x17: csigenc (fuc5 opcode 0xDC)
0x18: csigclr (fuc5 opcode 0xE0)
|-
| 31
| Set if running in secure mode (cauth)
|}

Contains information on the last crypto instruction executed.

=== TSEC_SCP_AES_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-4
| First opcode
|-
| 5-9
| Second opcode
|-
| 15-16
| AES operation
0: Encryption
1: Decryption
2: Key expansion
3: Key reverse expansion
|}

Contains information on the last AES sequence executed.

=== TSEC_SCP_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQSTAT_TRNG
|-
| 8
| TSEC_SCP_IRQSTAT_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQSTAT_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQSTAT_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the status of crypto IRQs.

=== TSEC_SCP_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQMASK_TRNG
|-
| 8
| TSEC_SCP_IRQMASK_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQMASK_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQMASK_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the value of the mask for crypto IRQs.

=== TSEC_SCP_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Invalid instruction
|-
| 4
| Empty crypto sequence
|-
| 8
| Crypto sequence is too long
|-
| 12
| Crypto sequence was not finished
|-
| 16
| Invalid cauth signature (during csigenc, csigclr or csigunk)
|-
| 24
| Forbidden instruction
|}

Contains information on crypto errors generated by the [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT_INSN_ERROR]] IRQ.

=== TSEC_TFBIF_MCCIF_FIFOCTRL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
|-
| 1
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
|-
| 2
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
|-
| 3
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
|-
| 4
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
|-
| 5
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
|-
| 6
| TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
|-
| 7
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
|-
| 8
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE
|}

=== TSEC_MCCIF_FIFOCTRL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
|-
| 16-31
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT
|}

=== TSEC_TFBIF_UNK5 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.

=== TSEC_TFBIF_UNK6 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to (data_size << 4) before reading memory from the GPU UCODE carveout.

=== TSEC_DMA_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_DMA_CMD_READ
|-
| 1
| TSEC_DMA_CMD_WRITE
|-
| 4-7
| TSEC_DMA_CMD_UNK
|-
| 12
| TSEC_DMA_CMD_BUSY
|-
| 13
| TSEC_DMA_CMD_ERROR
|-
| 31
| TSEC_DMA_CMD_INIT
|}

A DMA read/write operation requires bits TSEC_DMA_CMD_INIT and TSEC_DMA_CMD_READ/TSEC_DMA_CMD_WRITE to be set in TSEC_DMA_CMD.

During the transfer, the TSEC_DMA_CMD_BUSY bit is set.

Accessing an invalid address causes bit TSEC_DMA_CMD_ERROR to be set.

=== TSEC_DMA_ADDR ===
Takes the address for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_VAL ===
Takes the value for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_UNK ===
Always 0xFFF.

=== TSEC_TEGRA_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 16
| TSEC_TEGRA_CTL_TKFI_KFUSE
|-
| 17
| TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
|-
| 24
| TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
|-
| 25
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
|-
| 26
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
|-
| 27
| TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C
|}

== Authenticated Mode ==
===== Entry =====
From non-secure mode, upon jumping to a page marked as secret, a secret fault occurs. This causes the CPU to verify the region specified in $cauth against the MAC loaded in $c6. If the comparison is successful, the valid bit (bit0) is set on all pages in the $cauth region, and $pc is set to the base of the $cauth region. If the comparsion fails, the CPU is halted.

===== Exit =====
The CPU automatically goes back to non-secure mode when returning back into non-secret pages. When this happens, the valid bit (bit0) in the TLB flags is cleared for all secret pages.

===== Implementation =====
Under certain circumstances, it is possible to observe [[#csigauth|csigauth]] being briefly written to [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]] as "csigauth $c4 $c6" while the opcodes in [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]] are set to "cxsin" and "csigauth", respectively.

Via [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]] it can be observed that a 3-sized macro sequence is loaded into cs0 during a secure mode transition.

== Crypto processing ==
Part of the information here (which hasn't made it into envytools documentation yet) was shared by [https://wiki.0x04.net/wiki/Marcin_Ko%C5%9Bcielnicki mwk] from reverse engineering falcon processors over the years.

=== cauth ===
$cauth is a special purpose register in the CPU.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7 || Start of region to authenticate (in 0x100 pages)
|-
| 8-15 || Unused
|-
| 16 || Use secret xfers (?)
|-
| 17 || Region is signed and encrypted and double the size (?)
|-
| 18 ||
|-
| 19 ||
|-
| 20-23 || Unused
|-
| 31-24 || Size of region to authenticate (in 0x100 pages)
|}

== SCP operations ==

{| class="wikitable" border="1"
! Opcode
! Name
! Operand0
! Operand1
! Operation
! Condition
|-
| 0 || nop || || || ||
|-
| 1 || mov || $cX || $cY || <code>$cX = $cY; ACL(X) = ACL(Y);</code> ||
|-
| 2 || sin || $cX || N/A || <code>$cX = read_stream(); ACL(X) = ???;</code> ||
|-
| 3 || sout || $cX || N/A || <code>write_stream($cX);</code> || ?
|-
| 4 || rnd || $cX || N/A || <code>$cX = read_trng(); ACL(X) = ???;</code> ||
|-
| 5 || s0begin || immX || N/A || <code>record_macro_for_N_instructions(0, immX);</code> ||
|-
| 6 || s0exec || immX || N/A || <code>execute_macro_N_times(0, immX);</code> ||
|-
| 7 || s1begin || immX || N/A || <code>record_macro_for_N_instructions(1, immX);</code> ||
|-
| 8 || s1exec || immX || N/A || <code>execute_macro_N_times(1, immX);</code> ||
|-
| 9 || <invalid> || || || ||
|-
| 0xA || chmod || $cX || immY || Complicated, see [[#ACL|ACL]]. ||
|-
| 0xB || xor || $cX || $cY || <code>$cX ^= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xC || add || $cX || immY || <code>$cX += immY;</code> || <code>(ACL(X) & 2)</code>
|-
| 0xD || and || $cX || $cY || <code>$cX &= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xE || rev || $cX || $cY || <code>$cX = endian_swap128($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0xF || gfmul || $cX || $cY || <code>$cX = gfmul($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 2)</code>
|-
| 0x10 || secret || $cX || immY || <code>$cX = load_secret(immY); ACL(X) = load_secret_acl(immY);</code> ||
|-
| 0x11 || keyreg || immX || || <code>active_key_idx = immX;</code> ||
|-
| 0x12 || kexp || $cX || $cY || <code>$cX = aes_kexp($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0x13 || krexp || $cX || $cY || <code>$cX = aes_kexp_reverse($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0x14 || enc || $cX || $cY || <code>$cX = aes_enc(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 1) && (ACL(Y) & 2)</code>
|-
| 0x15 || dec || $cX || $cY || <code>$cX = aes_dec(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 1) && (ACL(Y) & 2)</code>
|-
| 0x16 || csigauth || $cX || $cY || <code>if (hash_verify($cX, $cY)) { has_sig = true; current_sig = $cX; }</code> || ?
|-
| 0x17 || csigclr || || || <code>has_sig = false;</code> ||
|-
| 0x18 || csigenc || $cX || $cY || <code>if (has_sig) $cX = aes_enc(current_sig, $cY);</code> || ?
|}

=== ACL ===
{| class="wikitable" border="1"
! Bit
! Meaning
|-
| 0 || Secure key. Forced set if bit1 is set. Once cleared, cannot be set again.
|-
| 1 || Secure readable. Once cleared, cannot be set again.
|-
| 2 || Insecure key. Forced set if bit3 is set. Forced clear if bit0 is clear. Can be toggled back and forth.
|-
| 3 || Insecure readable. Forced clear if bit1 is clear. Can be toggled back and forth.
|-
| 4 || Insecure overwritable. Can be toggled back and forth.
|}

==== Initial values ====
On SCP boot, the ACL is 0x1F for all $cX.

Loading into $cX using xdst instruction sets ACL($cX) to 0x3 and 0x1F, for secure and insecure mode respectively.

Spilling a $cX to DMEM using xdld instruction is allowed if (ACL($cX) & 2) or (ACL($cX) & 8), for secure and insecure mode respectively.

=== csigauth ===
<code>00000000: f5 3c XY d8 csigauth $cY $cX</code>

This instruction takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret.

=== csigclr ===
<code>00000000: f5 3c 00 e0 csigclr</code>

This instruction takes no operands and appears to clear the saved cauth signature used by the csigenc instruction.

=== cchmod ===
<code>00000000: f5 3c XY a8 cchmod $cY 0X</code> or <code>00000000: f5 3c XY a9 cchmod $cY 1X</code>

This instruction takes a crypto register and a 5 bit immediate value. It appears to set the [[#Register ACLs|crypto registers' ACL]] bits as follows:
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Allow register to be used as key in NS or LS mode
|-
| 1
| Allow register to be used as key in HS mode
|-
| 2
| Set register as readable in NS or LS mode
|-
| 3
| Set register as readable in HS mode
|-
| 4
| Set register as writable in NS or LS mode
|}

=== crng ===
<code>00000000: f5 3c 0X 90 crng $cX</code>

This instruction initializes a crypto register with random data.

Executing this instruction only succeeds if the TRNG is enabled for the SCP, which requires taking the following steps:
* Write 0x7FFF to TSEC_TRNG_CLKDIV.
* Write 0x3FF0000 to TSEC_TRNG_UNK0.
* Write 0xFF00 to TSEC_TRNG_UNK7.
* Write 0x1000 to [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]].

Otherwise it hangs forever.

=== cxset ===
cxset instruction provides a way to change behavior of a variable amount of successively executed DMA-related instructions.

for example: <code>000000de: f4 3c 02 cxset 0x2</code>

can be read as: <code>dma_override(type=crypto_reg, count=2)</code>

The argument to cxset specifies the type of behavior change in the top 3 bits, and the number of DMA-related instructions the effect lasts for in the lower 5 bits.

{| class=wikitable
! Bits || Description
|-
| 0-4 || Number of instructions it is valid for (0x1f is a special value meaning infinitely many instructions -- until overriden by another cxset)
|-
| 5 || Crypto destination/source select (0=crypto register, 1=crypto stream)
|-
| 6 || External memory override (0=Disabled, 1=Enabled)
|-
| 7 || Internal memory select (0=DMEM, 1=IMEM)
|}

==== DMA-Related Instructions ====
At least the following instructions may have changed behavior, and count against the cxset "count" argument: <code>xdwait</code>, <code>xdst</code>, <code>xdld</code>.

For example, if override type=0b000, then the "length" argument to <code>xdst</code> is instead treated as the index of the target $cX register.

=== Secrets ===
Falcon's Authenticated Mode has access to 64 128-bit keys which are burned at factory. These keys can be loaded by using the $csecret instruction which takes the target crypto register and the key index as arguments.

{| class=wikitable
! Index || Notes || Console-unique
|-
| 0x00 || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares. || No
|-
| 0x01 || Used by nvhost_nvdec_bl020_prod firmware. ||
|-
| 0x03 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x04 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x05 || Used by nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares. ||
|-
| 0x07 || Used by [6.0.0+] nvhost_tsec firmware. ||
|-
| 0x09 || Used by nvhost_tsec firmware. ||
|-
| 0x0B || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x0F || Used by nvhost_tsec firmware. ||
|-
| 0x10 || Used by [1.0.0-5.1.0] nvhost_tsec firmware. ||
|-
| 0x15 || Used by nvhost_nvdec_bl020_prod, [5.0.0+] nvhost_nvdec020_prod, [5.0.0+] nvhost_nvdec020_ns and [6.0.0+] nvhost_tsec firmwares. ||
|-
| 0x26 || Used by [[TSEC_Firmware#KeygenLdr|KeygenLdr]]. || No
|-
| 0x3C || Used by nvhost_tsec firmware. ||
|-
| 0x3F || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. || Yes
|}

TSEC

2019-01-08T20:18:47Z

Qlutoo: /* Initial values */

TSEC (Tegra Security Co-processor) is a dedicated unit powered by a NVIDIA Falcon microprocessor with crypto extensions.

= Driver =
A host driver for communicating with the TSEC is mapped to physical address 0x54500000 with a total size of 0x40000 bytes and exposes several registers.

== Registers ==
Registers from 0x54500000 to 0x54501000 are used to configure the host interface (HOST1X).

Registers from 0x54501000 to 0x54502000 are a MMIO window for communicating with the Falcon microprocessor. From this range, the subset of registers from 0x54501400 to 0x54501FE8 are specific to the TSEC and are subdivided into:
* 0x54501400 to 0x54501500: SCP (Secure Crypto Processor?).
* 0x54501500 to 0x54501600: TRNG (True Random Number Generator).
* 0x54501600 to 0x54501700: TFBIF (Tegra Framebuffer Interface).
* 0x54501700 to 0x54501800: DMA.
* 0x54501800 to 0x54501900: TEGRA (miscellaneous interfaces).

{| class="wikitable" border="1"
! Name
! Address
! Width
|-
| TSEC_THI_INCR_SYNCPT
| 0x54500000
| 0x04
|-
| TSEC_THI_INCR_SYNCPT_ERR
| 0x54500008
| 0x04
|-
| TSEC_THI_CTXSW_INCR_SYNCPT
| 0x5450000C
| 0x04
|-
| TSEC_THI_CTXSW
| 0x54500020
| 0x04
|-
| TSEC_THI_CONT_SYNCPT_EOF
| 0x54500028
| 0x04
|-
| [[#TSEC_THI_METHOD0|TSEC_THI_METHOD0]]
| 0x54500040
| 0x04
|-
| [[#TSEC_THI_METHOD1|TSEC_THI_METHOD1]]
| 0x54500044
| 0x04
|-
| [[#TSEC_THI_INT_STATUS|TSEC_THI_INT_STATUS]]
| 0x54500078
| 0x04
|-
| [[#TSEC_THI_INT_MASK|TSEC_THI_INT_MASK]]
| 0x5450007C
| 0x04
|-
| TSEC_THI_SLCG_STATUS
| 0x54500084
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_HIGH_A
| 0x54500088
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_LOW_A
| 0x5450008C
| 0x04
|-
| TSEC_THI_CLK_OVERRIDE
| 0x54500E00
| 0x04
|-
| [[#FALCON_IRQSSET|FALCON_IRQSSET]]
| 0x54501000
| 0x04
|-
| [[#FALCON_IRQSCLR|FALCON_IRQSCLR]]
| 0x54501004
| 0x04
|-
| [[#FALCON_IRQSTAT|FALCON_IRQSTAT]]
| 0x54501008
| 0x04
|-
| [[#FALCON_IRQMODE|FALCON_IRQMODE]]
| 0x5450100C
| 0x04
|-
| [[#FALCON_IRQMSET|FALCON_IRQMSET]]
| 0x54501010
| 0x04
|-
| [[#FALCON_IRQMCLR|FALCON_IRQMCLR]]
| 0x54501014
| 0x04
|-
| [[#FALCON_IRQMASK|FALCON_IRQMASK]]
| 0x54501018
| 0x04
|-
| [[#FALCON_IRQDEST|FALCON_IRQDEST]]
| 0x5450101C
| 0x04
|-
| FALCON_GPTMR_PERIOD
| 0x54501020
| 0x04
|-
| FALCON_GPTMR_TIME
| 0x54501024
| 0x04
|-
| FALCON_GPTMR_ENABLE
| 0x54501028
| 0x04
|-
| FALCON_TIME_LOW
| 0x5450102C
| 0x04
|-
| FALCON_TIME_HIGH
| 0x54501030
| 0x04
|-
| FALCON_WDTMR_TIME
| 0x54501034
| 0x04
|-
| FALCON_WDTMR_ENABLE
| 0x54501038
| 0x04
|-
| [[#FALCON_SCRATCH0|FALCON_SCRATCH0]]
| 0x54501040
| 0x04
|-
| [[#FALCON_SCRATCH1|FALCON_SCRATCH1]]
| 0x54501044
| 0x04
|-
| [[#FALCON_ITFEN|FALCON_ITFEN]]
| 0x54501048
| 0x04
|-
| [[#FALCON_IDLESTATE|FALCON_IDLESTATE]]
| 0x5450104C
| 0x04
|-
| FALCON_CURCTX
| 0x54501050
| 0x04
|-
| FALCON_NXTCTX
| 0x54501054
| 0x04
|-
| FALCON_CMDCTX
| 0x54501058
| 0x04
|-
| FALCON_STATUS_MASK
| 0x5450105C
| 0x04
|-
| FALCON_VM_SUPERVISOR
| 0x54501060
| 0x04
|-
| FALCON_MTHD_DATA
| 0x54501064
| 0x04
|-
| FALCON_MTHD_CMD
| 0x54501068
| 0x04
|-
| FALCON_MTHD_DATA_WR
| 0x5450106C
| 0x04
|-
| FALCON_MTHD_OCCUPIED
| 0x54501070
| 0x04
|-
| FALCON_MTHD_ACK
| 0x54501074
| 0x04
|-
| FALCON_MTHD_LIMIT
| 0x54501078
| 0x04
|-
| FALCON_SUBENGINE_RESET
| 0x5450107C
| 0x04
|-
| FALCON_SCRATCH2
| 0x54501080
| 0x04
|-
| FALCON_SCRATCH3
| 0x54501084
| 0x04
|-
| FALCON_PM_TRIGGER
| 0x54501088
| 0x04
|-
| FALCON_PM_MODE
| 0x5450108C
| 0x04
|-
| FALCON_DEBUG1
| 0x54501090
| 0x04
|-
| [[#FALCON_DEBUGINFO|FALCON_DEBUGINFO]]
| 0x54501094
| 0x04
|-
| FALCON_BREAKPOINT0
| 0x54501098
| 0x04
|-
| FALCON_BREAKPOINT1
| 0x5450109C
| 0x04
|-
| FALCON_CGCTL
| 0x545010A0
| 0x04
|-
| FALCON_ENGCTL
| 0x545010A4
| 0x04
|-
| FALCON_PM_SEL
| 0x545010A8
| 0x04
|-
| FALCON_HOST_IO_INDEX
| 0x545010AC
| 0x04
|-
| [[#FALCON_EXCI|FALCON_EXCI]]
| 0x545010D0
| 0x04
|-
| [[#FALCON_CPUCTL|FALCON_CPUCTL]]
| 0x54501100
| 0x04
|-
| [[#FALCON_BOOTVEC|FALCON_BOOTVEC]]
| 0x54501104
| 0x04
|-
| [[#FALCON_HWCFG|FALCON_HWCFG]]
| 0x54501108
| 0x04
|-
| [[#FALCON_DMACTL|FALCON_DMACTL]]
| 0x5450110C
| 0x04
|-
| [[#FALCON_DMATRF_EXTBASE|FALCON_DMATRF_EXTBASE]]
| 0x54501110
| 0x04
|-
| [[#FALCON_DMATRF_VOFF|FALCON_DMATRF_VOFF]]
| 0x54501114
| 0x04
|-
| [[#FALCON_DMATRFCMD|FALCON_DMATRFCMD]]
| 0x54501118
| 0x04
|-
| [[#FALCON_DMATRF_POFF|FALCON_DMATRF_POFF]]
| 0x5450111C
| 0x04
|-
| [[#FALCON_DMATRFSTAT|FALCON_DMATRFSTAT]]
| 0x54501120
| 0x04
|-
| [[#FALCON_CRYPTTRFSTAT|FALCON_CRYPTTRFSTAT]]
| 0x54501124
| 0x04
|-
| FALCON_CPUSTAT
| 0x54501128
| 0x04
|-
| [[#FALCON_HWCFG2|FALCON_HWCFG2]]
| 0x5450112C
| 0x04
|-
| FALCON_CPUCTL_ALIAS
| 0x54501130
| 0x04
|-
| FALCON_TLB_CMD
| 0x54501140
| 0x04
|-
| FALCON_TLB_CMD_RES
| 0x54501144
| 0x04
|-
| FALCON_BRANCH_HISTORY_CTRL
| 0x54501148
| 0x04
|-
| FALCON_BRANCH_HISTORY_PC
| 0x5450114C
| 0x04
|-
| FALCON_IMFILLRNG0
| 0x54501150
| 0x04
|-
| FALCON_IMFILLRNG1
| 0x54501154
| 0x04
|-
| FALCON_IMFILLCTL
| 0x54501158
| 0x04
|-
| FALCON_EXTERRWIN
| 0x54501160
| 0x04
|-
| FALCON_EXTERRCFG
| 0x54501164
| 0x04
|-
| FALCON_EXTERRADDR
| 0x54501168
| 0x04
|-
| FALCON_EXTERRSTAT
| 0x5450116C
| 0x04
|-
| FALCON_CG2
| 0x5450117C
| 0x04
|-
| FALCON_CODE_INDEX
| 0x54501180
| 0x04
|-
| FALCON_CODE
| 0x54501184
| 0x04
|-
| FALCON_CODE_VIRT_ADDR
| 0x54501188
| 0x04
|-
| FALCON_DATA_INDEX0
| 0x545011C0
| 0x04
|-
| FALCON_DATA0
| 0x545011C4
| 0x04
|-
| FALCON_DATA_INDEX1
| 0x545011C8
| 0x04
|-
| FALCON_DATA1
| 0x545011CC
| 0x04
|-
| FALCON_DATA_INDEX2
| 0x545011D0
| 0x04
|-
| FALCON_DATA2
| 0x545011D4
| 0x04
|-
| FALCON_DATA_INDEX3
| 0x545011D8
| 0x04
|-
| FALCON_DATA3
| 0x545011DC
| 0x04
|-
| FALCON_DATA_INDEX4
| 0x545011E0
| 0x04
|-
| FALCON_DATA4
| 0x545011E4
| 0x04
|-
| FALCON_DATA_INDEX5
| 0x545011E8
| 0x04
|-
| FALCON_DATA5
| 0x545011EC
| 0x04
|-
| FALCON_DATA_INDEX6
| 0x545011F0
| 0x04
|-
| FALCON_DATA6
| 0x545011F4
| 0x04
|-
| FALCON_DATA_INDEX7
| 0x545011F8
| 0x04
|-
| FALCON_DATA7
| 0x545011FC
| 0x04
|-
| [[#FALCON_ICD_CMD|FALCON_ICD_CMD]]
| 0x54501200
| 0x04
|-
| FALCON_ICD_ADDR
| 0x54501204
| 0x04
|-
| FALCON_ICD_WDATA
| 0x54501208
| 0x04
|-
| FALCON_ICD_RDATA
| 0x5450120C
| 0x04
|-
| [[#FALCON_SCTL|FALCON_SCTL]]
| 0x54501240
| 0x04
|-
| [[#TSEC_SCP_CTL_ACCESS|TSEC_SCP_CTL_ACCESS]]
| 0x54501400
| 0x04
|-
| [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]]
| 0x54501404
| 0x04
|-
| [[#TSEC_SCP_CTL_STAT|TSEC_SCP_CTL_STAT]]
| 0x54501408
| 0x04
|-
| [[#TSEC_SCP_CTL_MODE|TSEC_SCP_CTL_MODE]]
| 0x5450140C
| 0x04
|-
| TSEC_SCP_UNK0
| 0x54501410
| 0x04
|-
| [[#TSEC_SCP_CTL_PKEY|TSEC_SCP_CTL_PKEY]]
| 0x54501418
| 0x04
|-
| [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]]
| 0x54501420
| 0x04
|-
| [[#TSEC_SCP_SEQ_STAT|TSEC_SCP_SEQ_STAT]]
| 0x54501428
| 0x04
|-
| [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]]
| 0x54501430
| 0x04
|-
| TSEC_SCP_UNK2
| 0x54501454
| 0x04
|-
| [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]]
| 0x54501458
| 0x04
|-
| TSEC_SCP_UNK3
| 0x54501470
| 0x04
|-
| [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT]]
| 0x54501480
| 0x04
|-
| [[#TSEC_SCP_IRQMASK|TSEC_SCP_IRQMASK]]
| 0x54501484
| 0x04
|-
| TSEC_SCP_UNK4
| 0x54501490
| 0x04
|-
| [[#TSEC_SCP_ERR|TSEC_SCP_ERR]]
| 0x54501498
| 0x04
|-
| TSEC_TRNG_CLKDIV
| 0x54501500
| 0x04
|-
| TSEC_TRNG_UNK0
| 0x54501504
| 0x04
|-
| TSEC_TRNG_UNK1
| 0x5450150C
| 0x04
|-
| TSEC_TRNG_UNK2
| 0x54501510
| 0x04
|-
| TSEC_TRNG_UNK3
| 0x54501514
| 0x04
|-
| TSEC_TRNG_UNK4
| 0x54501518
| 0x04
|-
| TSEC_TRNG_UNK5
| 0x5450151C
| 0x04
|-
| TSEC_TRNG_UNK6
| 0x54501528
| 0x04
|-
| TSEC_TRNG_UNK7
| 0x5450152C
| 0x04
|-
| TSEC_TFBIF_UNK0
| 0x54501600
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL|TSEC_TFBIF_MCCIF_FIFOCTRL]]
| 0x54501604
| 0x04
|-
| TSEC_TFBIF_UNK1
| 0x54501608
| 0x04
|-
| TSEC_TFBIF_UNK2
| 0x5450160C
| 0x04
|-
| TSEC_TFBIF_UNK3
| 0x54501630
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL1|TSEC_TFBIF_MCCIF_FIFOCTRL1]]
| 0x54501634
| 0x04
|-
| TSEC_TFBIF_UNK4
| 0x54501640
| 0x04
|-
| [[#TSEC_TFBIF_UNK5|TSEC_TFBIF_UNK5]]
| 0x54501644
| 0x04
|-
| [[#TSEC_TFBIF_UNK6|TSEC_TFBIF_UNK6]]
| 0x54501648
| 0x04
|-
| [[#TSEC_DMA_CMD|TSEC_DMA_CMD]]
| 0x54501700
| 0x04
|-
| [[#TSEC_DMA_ADDR|TSEC_DMA_ADDR]]
| 0x54501704
| 0x04
|-
| [[#TSEC_DMA_VAL|TSEC_DMA_VAL]]
| 0x54501708
| 0x04
|-
| [[#TSEC_DMA_UNK|TSEC_DMA_UNK]]
| 0x5450170C
| 0x04
|-
| TSEC_TEGRA_FALCON_IP_VER
| 0x54501800
| 0x04
|-
| TSEC_TEGRA_UNK0
| 0x54501824
| 0x04
|-
| TSEC_TEGRA_UNK1
| 0x54501828
| 0x04
|-
| TSEC_TEGRA_UNK2
| 0x5450182C
| 0x04
|-
| [[#TSEC_TEGRA_CTL|TSEC_TEGRA_CTL]]
| 0x54501838
| 0x04
|}

=== TSEC_THI_METHOD0 ===
{| class="wikitable" border="1"
! ID
! Method
|-
| 0x200
| SET_APPLICATION_ID
|-
| 0x300
| EXECUTE
|-
| 0x500
| HDCP_INIT
|-
| 0x504
| HDCP_CREATE_SESSION
|-
| 0x508
| HDCP_VERIFY_CERT_RX
|-
| 0x50C
| HDCP_GENERATE_EKM
|-
| 0x510
| HDCP_REVOCATION_CHECK
|-
| 0x514
| HDCP_VERIFY_HPRIME
|-
| 0x518
| HDCP_ENCRYPT_PAIRING_INFO
|-
| 0x51C
| HDCP_DECRYPT_PAIRING_INFO
|-
| 0x520
| HDCP_UPDATE_SESSION
|-
| 0x524
| HDCP_GENERATE_LC_INIT
|-
| 0x528
| HDCP_VERIFY_LPRIME
|-
| 0x52C
| HDCP_GENERATE_SKE_INIT
|-
| 0x530
| HDCP_VERIFY_VPRIME
|-
| 0x534
| HDCP_ENCRYPTION_RUN_CTRL
|-
| 0x538
| HDCP_SESSION_CTRL
|-
| 0x53C
| HDCP_COMPUTE_SPRIME
|-
| 0x540
| HDCP_GET_CERT_RX
|-
| 0x544
| HDCP_EXCHANGE_INFO
|-
| 0x548
| HDCP_DECRYPT_KM
|-
| 0x54C
| HDCP_GET_HPRIME
|-
| 0x550
| HDCP_GENERATE_EKH_KM
|-
| 0x554
| HDCP_VERIFY_RTT_CHALLENGE
|-
| 0x558
| HDCP_GET_LPRIME
|-
| 0x55C
| HDCP_DECRYPT_KS
|-
| 0x560
| HDCP_DECRYPT
|-
| 0x564
| HDCP_GET_RRX
|-
| 0x568
| HDCP_DECRYPT_REENCRYPT
|-
| 0x56C
|
|-
| 0x570
|
|-
| 0x574
|
|-
| 0x578
|
|-
| 0x57C
|
|-
| 0x700
| HDCP_VALIDATE_SRM
|-
| 0x704
| HDCP_VALIDATE_STREAM
|-
| 0x708
| HDCP_TEST_SECURE_STATUS
|-
| 0x70C
| HDCP_SET_DCP_KPUB
|-
| 0x710
| HDCP_SET_RX_KPUB
|-
| 0x714
| HDCP_SET_CERT_RX
|-
| 0x718
| HDCP_SET_SCRATCH_BUFFER
|-
| 0x71C
| HDCP_SET_SRM
|-
| 0x720
| HDCP_SET_RECEIVER_ID_LIST
|-
| 0x724
| HDCP_SET_SPRIME
|-
| 0x728
| HDCP_SET_ENC_INPUT_BUFFER
|-
| 0x72C
| HDCP_SET_ENC_OUTPUT_BUFFER
|-
| 0x730
| HDCP_GET_RTT_CHALLENGE
|-
| 0x734
| HDCP_STREAM_MANAGE
|-
| 0x738
| HDCP_READ_CAPS
|-
| 0x73C
| HDCP_ENCRYPT
|-
| 0x740
| [6.0.0+] HDCP_GET_CURRENT_NONCE
|}

Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_METHOD1 ===
Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_INT_STATUS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_STATUS_FALCON_INT
|}

=== TSEC_THI_INT_MASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_MASK_FALCON_INT
|}

=== FALCON_IRQSSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSSET_GPTMR
|-
| 1
| FALCON_IRQSSET_WDTMR
|-
| 2
| FALCON_IRQSSET_MTHD
|-
| 3
| FALCON_IRQSSET_CTXSW
|-
| 4
| FALCON_IRQSSET_HALT
|-
| 5
| FALCON_IRQSSET_EXTERR
|-
| 6
| FALCON_IRQSSET_SWGEN0
|-
| 7
| FALCON_IRQSSET_SWGEN1
|-
| 8-15
| FALCON_IRQSSET_EXT
|}

Used for setting Falcon's IRQs.

=== FALCON_IRQSCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSCLR_GPTMR
|-
| 1
| FALCON_IRQSCLR_WDTMR
|-
| 2
| FALCON_IRQSCLR_MTHD
|-
| 3
| FALCON_IRQSCLR_CTXSW
|-
| 4
| FALCON_IRQSCLR_HALT
|-
| 5
| FALCON_IRQSCLR_EXTERR
|-
| 6
| FALCON_IRQSCLR_SWGEN0
|-
| 7
| FALCON_IRQSCLR_SWGEN1
|-
| 8-15
| FALCON_IRQSCLR_EXT
|}

Used for clearing Falcon's IRQs.

=== FALCON_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSTAT_GPTMR
|-
| 1
| FALCON_IRQSTAT_WDTMR
|-
| 2
| FALCON_IRQSTAT_MTHD
|-
| 3
| FALCON_IRQSTAT_CTXSW
|-
| 4
| FALCON_IRQSTAT_HALT
|-
| 5
| FALCON_IRQSTAT_EXTERR
|-
| 6
| FALCON_IRQSTAT_SWGEN0
|-
| 7
| FALCON_IRQSTAT_SWGEN1
|-
| 8-15
| FALCON_IRQSTAT_EXT
|}

Used for getting the status of Falcon's IRQs.

=== FALCON_IRQMODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMODE_GPTMR
|-
| 1
| FALCON_IRQMODE_WDTMR
|-
| 2
| FALCON_IRQMODE_MTHD
|-
| 3
| FALCON_IRQMODE_CTXSW
|-
| 4
| FALCON_IRQMODE_HALT
|-
| 5
| FALCON_IRQMODE_EXTERR
|-
| 6
| FALCON_IRQMODE_SWGEN0
|-
| 7
| FALCON_IRQMODE_SWGEN1
|-
| 8-15
| FALCON_IRQMODE_EXT
|}

Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.

=== FALCON_IRQMSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMSET_GPTMR
|-
| 1
| FALCON_IRQMSET_WDTMR
|-
| 2
| FALCON_IRQMSET_MTHD
|-
| 3
| FALCON_IRQMSET_CTXSW
|-
| 4
| FALCON_IRQMSET_HALT
|-
| 5
| FALCON_IRQMSET_EXTERR
|-
| 6
| FALCON_IRQMSET_SWGEN0
|-
| 7
| FALCON_IRQMSET_SWGEN1
|-
| 8-15
| FALCON_IRQMSET_EXT
|}

Used for setting the mask for Falcon's IRQs.

=== FALCON_IRQMCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMCLR_GPTMR
|-
| 1
| FALCON_IRQMCLR_WDTMR
|-
| 2
| FALCON_IRQMCLR_MTHD
|-
| 3
| FALCON_IRQMCLR_CTXSW
|-
| 4
| FALCON_IRQMCLR_HALT
|-
| 5
| FALCON_IRQMCLR_EXTERR
|-
| 6
| FALCON_IRQMCLR_SWGEN0
|-
| 7
| FALCON_IRQMCLR_SWGEN1
|-
| 8-15
| FALCON_IRQMCLR_EXT
|}

Used for clearing the mask for Falcon's IRQs.

=== FALCON_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMASK_GPTMR
|-
| 1
| FALCON_IRQMASK_WDTMR
|-
| 2
| FALCON_IRQMASK_MTHD
|-
| 3
| FALCON_IRQMASK_CTXSW
|-
| 4
| FALCON_IRQMASK_HALT
|-
| 5
| FALCON_IRQMASK_EXTERR
|-
| 6
| FALCON_IRQMASK_SWGEN0
|-
| 7
| FALCON_IRQMASK_SWGEN1
|-
| 8-15
| FALCON_IRQMASK_EXT
|}

Used for getting the value of the mask for Falcon's IRQs.

=== FALCON_IRQDEST ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQDEST_HOST_GPTMR
|-
| 1
| FALCON_IRQDEST_HOST_WDTMR
|-
| 2
| FALCON_IRQDEST_HOST_MTHD
|-
| 3
| FALCON_IRQDEST_HOST_CTXSW
|-
| 4
| FALCON_IRQDEST_HOST_HALT
|-
| 5
| FALCON_IRQDEST_HOST_EXTERR
|-
| 6
| FALCON_IRQDEST_HOST_SWGEN0
|-
| 7
| FALCON_IRQDEST_HOST_SWGEN1
|-
| 8-15
| FALCON_IRQDEST_HOST_EXT
|-
| 16
| FALCON_IRQDEST_TARGET_GPTMR
|-
| 17
| FALCON_IRQDEST_TARGET_WDTMR
|-
| 18
| FALCON_IRQDEST_TARGET_MTHD
|-
| 19
| FALCON_IRQDEST_TARGET_CTXSW
|-
| 20
| FALCON_IRQDEST_TARGET_HALT
|-
| 21
| FALCON_IRQDEST_TARGET_EXTERR
|-
| 22
| FALCON_IRQDEST_TARGET_SWGEN0
|-
| 23
| FALCON_IRQDEST_TARGET_SWGEN1
|-
| 24-31
| FALCON_IRQDEST_TARGET_EXT
|}

Used for routing Falcon's IRQs.

=== FALCON_SCRATCH0 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_SCRATCH1 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_ITFEN ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_ITFEN_CTXEN
|-
| 1
| FALCON_ITFEN_MTHDEN
|}

Used for enabling/disabling Falcon interfaces.

=== FALCON_IDLESTATE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IDLESTATE_FALCON_BUSY
|-
| 1-15
| FALCON_IDLESTATE_EXT_BUSY
|}

Used for detecting if Falcon is busy or not.

=== FALCON_DEBUGINFO ===
Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.

[6.0.0+] [[NV_services|nvservices]] sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.

=== FALCON_EXCI ===
Contains information about raised exceptions.

=== FALCON_CPUCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_CPUCTL_IINVAL
|-
| 1
| FALCON_CPUCTL_STARTCPU
|-
| 2
| FALCON_CPUCTL_SRESET
|-
| 3
| FALCON_CPUCTL_HRESET
|-
| 4
| FALCON_CPUCTL_HALTED
|-
| 5
| FALCON_CPUCTL_STOPPED
|-
| 6
| FALCON_CPUCTL_SCP_UNK
|}

Used for signaling the Falcon CPU.

=== FALCON_BOOTVEC ===
Takes the Falcon's boot vector address.

=== FALCON_HWCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-8
| FALCON_HWCFG_IMEM_SIZE
|-
| 9-17
| FALCON_HWCFG_DMEM_SIZE
|-
| 18-25
| FALCON_HWCFG_MTHD_SIZE
|-
| 26-31
| FALCON_HWCFG_DMATRF_SLOTS
|}

=== FALCON_DMACTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMACTL_REQUIRE_CTX
|-
| 1
| FALCON_DMACTL_DMEM_SCRUBBING
|-
| 2
| FALCON_DMACTL_IMEM_SCRUBBING
|-
| 3-6
| FALCON_DMACTL_DMAQ_NUM
|-
| 7
| FALCON_DMACTL_SECURE_STAT
|}

Used for configuring the Falcon's DMA engine.

=== FALCON_DMATRF_EXTBASE ===
Base of the external memory buffer.

The base of the transfer is calculated by adding [[#FALCON_DMATRF_POFF]] to the base.

=== FALCON_DMATRF_VOFF ===
For transfers to DMEM: the destination address.
For transfers to IMEM: the destination virtual IMEM page.

=== FALCON_DMATRF_POFF ===
For transfers to IMEM: the destination physical IMEM page.

=== FALCON_DMATRFCMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFCMD_FULL
|-
| 1
| FALCON_DMATRFCMD_IDLE
|-
| 2-3
| FALCON_DMATRFCMD_SEC
|-
| 4
| FALCON_DMATRFCMD_IMEM
|-
| 5
| FALCON_DMATRFCMD_WRITE
|-
| 8-10
| FALCON_DMATRFCMD_SIZE
|-
| 12-14
| FALCON_DMATRFCMD_CTXDMA
|}

Used for configuring DMA transfers.

=== FALCON_DMATRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFSTAT_PENDING
|-
| 16-18
| FALCON_DMATRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_DMATRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_CRYPTTRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| FALCON_CRYPTTRFSTAT_PENDING
|-
| 5
| FALCON_CRYPTTRFSTAT_ENABLED
|-
| 16-18
| FALCON_CRYPTTRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_CRYPTTRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_HWCFG2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_HWCFG2_VERSION
|-
| 4-5
| FALCON_HWCFG2_SCP_MODE
|-
| 6-7
| FALCON_HWCFG2_SUBVERSION
|-
| 8-11
| FALCON_HWCFG2_IMEM_PORTS
|-
| 12-15
| FALCON_HWCFG2_DMEM_PORTS
|-
| 16-19
| FALCON_HWCFG2_VM_PAGES_LOG2
|}

=== FALCON_ICD_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_ICD_CMD_OPC
0x0: BREAK
0x1: CONTINUE_FROM_PC
0x2: CONTINUE_FROM_ADDR
0x3: CONTINUE_UNK1_FROM_PC
0x4: CONTINUE_UNK1_FROM_ADDR
0x5: SINGLE_STEP_FROM_PC
0x6: SINGLE_STEP_FROM_ADDR
0x7: SET_BREAK_MASK
0x8: REG_READ
0x9: REG_WRITE
0xA: DATA_READ
0xB: DATA_WRITE
0xC: IO_READ
0xD: IO_WRITE
0xE: STATUS_READ
|-
| 6-7
| FALCON_ICD_CMD_DATA_SIZE
|-
| 8-12
| FALCON_ICD_CMD_IDX
|-
| 14
| FALCON_ICD_CMD_ERROR
|-
| 15
| FALCON_ICD_CMD_DONE
|-
| 16-31
| FALCON_ICD_CMD_BREAK_MASK
|}

=== FALCON_SCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| FALCON_SCTL_SEC_MODE
0: Non-secure
1: Light Secure
2: Heavy Secure
|}

=== TSEC_SCP_CTL_ACCESS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| Enable TSEC_SCP_INSN_STAT register
|}

=== TSEC_SCP_CTL_TRNG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 11
| Unknown
|-
| 12
| Enable the TRNG
|}

=== TSEC_SCP_CTL_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| TSEC_SCP_CTL_STAT_DEBUG_MODE
|}

=== TSEC_SCP_CTL_MODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Disable reads for the TRNG register block
|-
| 1
| Disable reads for the TFBIF register block
|-
| 2
| Disable reads for the DMA register block
|-
| 3
| Disable reads for the TEGRA register block
|-
| 4
| Disable writes for the TRNG register block
|-
| 5
| Disable writes for the TFBIF register block
|-
| 6
| Disable writes for the DMA register block
|-
| 7
| Disable writes for the TEGRA register block
|}

Controls accesses to the other sub-engines and can only be cleared in Heavy Secure mode.

=== TSEC_SCP_CTL_PKEY ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
|-
| 1
| TSEC_SCP_CTL_PKEY_LOADED
|}

=== TSEC_SCP_SEQ0_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 8-11
| Size of current cs0begin macro
|-
|}

=== TSEC_SCP_SEQ_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Set if crypto sequence recording (cs0begin/cs1begin) is active
|-
| 4-7
| Number of instructions left for the crypto sequence
|-
| 12-15
| Active crypto key register
|}

Contains information on the last crypto sequence (cs0 or cs1) executed.

=== TSEC_SCP_INSN_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| Crypto fuc5 destination register or immediate value
|-
| 8-15
| Crypto fuc5 source register or immediate value
|-
| 20-24
| Crypto fuc5 operation
0x0: none (fuc5 opcode 0x00)
0x1: cmov (fuc5 opcode 0x84)
0x2: cxsin (fuc5 opcode 0x88) or xdst (with cxset)
0x3: cxsout (fuc5 opcode 0x8C) or xdld (with cxset)
0x4: crng (fuc5 opcode 0x90)
0x5: cs0begin (fuc5 opcode 0x94)
0x6: cs0exec (fuc5 opcode 0x98)
0x7: cs1begin (fuc5 opcode 0x9C)
0x8: cs1exec (fuc5 opcode 0xA0)
0x9: invalid (fuc5 opcode 0xA4)
0xA: cchmod (fuc5 opcode 0xA8)
0xB: cxor (fuc5 opcode 0xAC)
0xC: cadd (fuc5 opcode 0xB0)
0xD: cand (fuc5 opcode 0xB4)
0xE: crev (fuc5 opcode 0xB8)
0xF: cprecmac (fuc5 opcode 0xBC)
0x10: csecret (fuc5 opcode 0xC0)
0x11: ckeyreg (fuc5 opcode 0xC4)
0x12: ckexp (fuc5 opcode 0xC8)
0x13: ckrexp (fuc5 opcode 0xCC)
0x14: cenc (fuc5 opcode 0xD0)
0x15: cdec (fuc5 opcode 0xD4)
0x16: csigauth (fuc5 opcode 0xD8)
0x17: csigenc (fuc5 opcode 0xDC)
0x18: csigclr (fuc5 opcode 0xE0)
|-
| 31
| Set if running in secure mode (cauth)
|}

Contains information on the last crypto instruction executed.

=== TSEC_SCP_AES_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-4
| First opcode
|-
| 5-9
| Second opcode
|-
| 15-16
| AES operation
0: Encryption
1: Decryption
2: Key expansion
3: Key reverse expansion
|}

Contains information on the last AES sequence executed.

=== TSEC_SCP_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQSTAT_TRNG
|-
| 8
| TSEC_SCP_IRQSTAT_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQSTAT_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQSTAT_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the status of crypto IRQs.

=== TSEC_SCP_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQMASK_TRNG
|-
| 8
| TSEC_SCP_IRQMASK_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQMASK_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQMASK_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the value of the mask for crypto IRQs.

=== TSEC_SCP_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Invalid instruction
|-
| 4
| Empty crypto sequence
|-
| 8
| Crypto sequence is too long
|-
| 12
| Crypto sequence was not finished
|-
| 16
| Invalid cauth signature (during csigenc, csigclr or csigunk)
|-
| 24
| Forbidden instruction
|}

Contains information on crypto errors generated by the [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT_INSN_ERROR]] IRQ.

=== TSEC_TFBIF_MCCIF_FIFOCTRL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
|-
| 1
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
|-
| 2
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
|-
| 3
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
|-
| 4
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
|-
| 5
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
|-
| 6
| TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
|-
| 7
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
|-
| 8
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE
|}

=== TSEC_MCCIF_FIFOCTRL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
|-
| 16-31
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT
|}

=== TSEC_TFBIF_UNK5 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.

=== TSEC_TFBIF_UNK6 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to (data_size << 4) before reading memory from the GPU UCODE carveout.

=== TSEC_DMA_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_DMA_CMD_READ
|-
| 1
| TSEC_DMA_CMD_WRITE
|-
| 4-7
| TSEC_DMA_CMD_UNK
|-
| 12
| TSEC_DMA_CMD_BUSY
|-
| 13
| TSEC_DMA_CMD_ERROR
|-
| 31
| TSEC_DMA_CMD_INIT
|}

A DMA read/write operation requires bits TSEC_DMA_CMD_INIT and TSEC_DMA_CMD_READ/TSEC_DMA_CMD_WRITE to be set in TSEC_DMA_CMD.

During the transfer, the TSEC_DMA_CMD_BUSY bit is set.

Accessing an invalid address causes bit TSEC_DMA_CMD_ERROR to be set.

=== TSEC_DMA_ADDR ===
Takes the address for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_VAL ===
Takes the value for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_UNK ===
Always 0xFFF.

=== TSEC_TEGRA_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 16
| TSEC_TEGRA_CTL_TKFI_KFUSE
|-
| 17
| TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
|-
| 24
| TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
|-
| 25
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
|-
| 26
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
|-
| 27
| TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C
|}

== Authenticated Mode ==
===== Entry =====
From non-secure mode, upon jumping to a page marked as secret, a secret fault occurs. This causes the CPU to verify the region specified in $cauth against the MAC loaded in $c6. If the comparison is successful, the valid bit (bit0) is set on all pages in the $cauth region, and $pc is set to the base of the $cauth region. If the comparsion fails, the CPU is halted.

===== Exit =====
The CPU automatically goes back to non-secure mode when returning back into non-secret pages. When this happens, the valid bit (bit0) in the TLB flags is cleared for all secret pages.

===== Implementation =====
Under certain circumstances, it is possible to observe [[#csigauth|csigauth]] being briefly written to [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]] as "csigauth $c4 $c6" while the opcodes in [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]] are set to "cxsin" and "csigauth", respectively.

Via [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]] it can be observed that a 3-sized macro sequence is loaded into cs0 during a secure mode transition.

== Crypto processing ==
Part of the information here (which hasn't made it into envytools documentation yet) was shared by [https://wiki.0x04.net/wiki/Marcin_Ko%C5%9Bcielnicki mwk] from reverse engineering falcon processors over the years.

=== cauth ===
$cauth is a special purpose register in the CPU.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7 || Start of region to authenticate (in 0x100 pages)
|-
| 8-15 || Unused
|-
| 16 || Use secret xfers (?)
|-
| 17 || Region is signed and encrypted and double the size (?)
|-
| 18 ||
|-
| 19 ||
|-
| 20-23 || Unused
|-
| 31-24 || Size of region to authenticate (in 0x100 pages)
|}

== SCP operations ==

{| class="wikitable" border="1"
! Opcode
! Name
! Operand0
! Operand1
! Operation
! Condition
|-
| 0 || nop || || || ||
|-
| 1 || mov || $cX || $cY || <code>$cX = $cY; ACL(X) = ACL(Y);</code> ||
|-
| 2 || sin || $cX || N/A || <code>$cX = read_stream(); ACL(X) = ???;</code> ||
|-
| 3 || sout || $cX || N/A || <code>write_stream($cX);</code> || ?
|-
| 4 || rnd || $cX || N/A || <code>$cX = read_trng(); ACL(X) = ???;</code> ||
|-
| 5 || s0begin || immX || N/A || <code>record_macro_for_N_instructions(0, immX);</code> ||
|-
| 6 || s0exec || immX || N/A || <code>execute_macro_N_times(0, immX);</code> ||
|-
| 7 || s1begin || immX || N/A || <code>record_macro_for_N_instructions(1, immX);</code> ||
|-
| 8 || s1exec || immX || N/A || <code>execute_macro_N_times(1, immX);</code> ||
|-
| 9 || <invalid> || || || ||
|-
| 0xA || chmod || $cX || immY || Complicated, see [[#ACL|ACL]]. ||
|-
| 0xB || xor || $cX || $cY || <code>$cX ^= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xC || add || $cX || immY || <code>$cX += immY;</code> || <code>(ACL(X) & 2)</code>
|-
| 0xD || and || $cX || $cY || <code>$cX &= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xE || rev || $cX || $cY || <code>$cX = endian_swap128($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0xF || gfmul || $cX || $cY || <code>$cX = gfmul($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 2)</code>
|-
| 0x10 || secret || $cX || immY || <code>$cX = load_secret(immY); ACL(X) = load_secret_acl(immY);</code> ||
|-
| 0x11 || keyreg || immX || || <code>active_key_idx = immX;</code> ||
|-
| 0x12 || kexp || $cX || $cY || <code>$cX = aes_kexp($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0x13 || krexp || $cX || $cY || <code>$cX = aes_kexp_reverse($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0x14 || enc || $cX || $cY || <code>$cX = aes_enc(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 1) && (ACL(Y) & 2)</code>
|-
| 0x15 || dec || $cX || $cY || <code>$cX = aes_dec(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 1) && (ACL(Y) & 2)</code>
|-
| 0x16 || csigauth || $cX || $cY || <code>if (hash_verify($cX, $cY)) { has_sig = true; current_sig = $cX; }</code> || ?
|-
| 0x17 || csigclr || || || <code>has_sig = false;</code> ||
|-
| 0x18 || csigenc || $cX || $cY || <code>if (has_sig) $cX = aes_enc(current_sig, $cY);</code> || ?
|}

=== ACL ===
{| class="wikitable" border="1"
! Bit
! Meaning
|-
| 0 || Secure key. Forced set if bit1 is set.
|-
| 1 || Secure readable. Once cleared, cannot be set again.
|-
| 2 || Insecure key. Forced set if bit3 is set. Forced clear if bit0 is clear. Can be toggled back and forth.
|-
| 3 || Insecure readable. Forced clear if bit1 is clear. Can be toggled back and forth.
|-
| 4 || Insecure overwritable.
|}

==== Initial values ====
On SCP boot, the ACL is 0x1F for all $cX.

Loading into $cX using xdst instruction sets ACL($cX) to 0x3 and 0x1F, for secure and insecure mode respectively.

Spilling a $cX to DMEM using xdld instruction is allowed if (ACL($cX) & 2) or (ACL($cX) & 8), for secure and insecure mode respectively.

=== csigauth ===
<code>00000000: f5 3c XY d8 csigauth $cY $cX</code>

This instruction takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret.

=== csigclr ===
<code>00000000: f5 3c 00 e0 csigclr</code>

This instruction takes no operands and appears to clear the saved cauth signature used by the csigenc instruction.

=== cchmod ===
<code>00000000: f5 3c XY a8 cchmod $cY 0X</code> or <code>00000000: f5 3c XY a9 cchmod $cY 1X</code>

This instruction takes a crypto register and a 5 bit immediate value. It appears to set the [[#Register ACLs|crypto registers' ACL]] bits as follows:
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Allow register to be used as key in NS or LS mode
|-
| 1
| Allow register to be used as key in HS mode
|-
| 2
| Set register as readable in NS or LS mode
|-
| 3
| Set register as readable in HS mode
|-
| 4
| Set register as writable in NS or LS mode
|}

=== crng ===
<code>00000000: f5 3c 0X 90 crng $cX</code>

This instruction initializes a crypto register with random data.

Executing this instruction only succeeds if the TRNG is enabled for the SCP, which requires taking the following steps:
* Write 0x7FFF to TSEC_TRNG_CLKDIV.
* Write 0x3FF0000 to TSEC_TRNG_UNK0.
* Write 0xFF00 to TSEC_TRNG_UNK7.
* Write 0x1000 to [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]].

Otherwise it hangs forever.

=== cxset ===
cxset instruction provides a way to change behavior of a variable amount of successively executed DMA-related instructions.

for example: <code>000000de: f4 3c 02 cxset 0x2</code>

can be read as: <code>dma_override(type=crypto_reg, count=2)</code>

The argument to cxset specifies the type of behavior change in the top 3 bits, and the number of DMA-related instructions the effect lasts for in the lower 5 bits.

{| class=wikitable
! Bits || Description
|-
| 0-4 || Number of instructions it is valid for (0x1f is a special value meaning infinitely many instructions -- until overriden by another cxset)
|-
| 5 || Crypto destination/source select (0=crypto register, 1=crypto stream)
|-
| 6 || External memory override (0=Disabled, 1=Enabled)
|-
| 7 || Internal memory select (0=DMEM, 1=IMEM)
|}

==== DMA-Related Instructions ====
At least the following instructions may have changed behavior, and count against the cxset "count" argument: <code>xdwait</code>, <code>xdst</code>, <code>xdld</code>.

For example, if override type=0b000, then the "length" argument to <code>xdst</code> is instead treated as the index of the target $cX register.

=== Secrets ===
Falcon's Authenticated Mode has access to 64 128-bit keys which are burned at factory. These keys can be loaded by using the $csecret instruction which takes the target crypto register and the key index as arguments.

{| class=wikitable
! Index || Notes || Console-unique
|-
| 0x00 || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares. || No
|-
| 0x01 || Used by nvhost_nvdec_bl020_prod firmware. ||
|-
| 0x03 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x04 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x05 || Used by nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares. ||
|-
| 0x07 || Used by [6.0.0+] nvhost_tsec firmware. ||
|-
| 0x09 || Used by nvhost_tsec firmware. ||
|-
| 0x0B || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x0F || Used by nvhost_tsec firmware. ||
|-
| 0x10 || Used by [1.0.0-5.1.0] nvhost_tsec firmware. ||
|-
| 0x15 || Used by nvhost_nvdec_bl020_prod, [5.0.0+] nvhost_nvdec020_prod, [5.0.0+] nvhost_nvdec020_ns and [6.0.0+] nvhost_tsec firmwares. ||
|-
| 0x26 || Used by [[TSEC_Firmware#KeygenLdr|KeygenLdr]]. || No
|-
| 0x3C || Used by nvhost_tsec firmware. ||
|-
| 0x3F || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. || Yes
|}

TSEC

2019-01-08T20:09:17Z

Qlutoo: /* SCP operations */

TSEC (Tegra Security Co-processor) is a dedicated unit powered by a NVIDIA Falcon microprocessor with crypto extensions.

= Driver =
A host driver for communicating with the TSEC is mapped to physical address 0x54500000 with a total size of 0x40000 bytes and exposes several registers.

== Registers ==
Registers from 0x54500000 to 0x54501000 are used to configure the host interface (HOST1X).

Registers from 0x54501000 to 0x54502000 are a MMIO window for communicating with the Falcon microprocessor. From this range, the subset of registers from 0x54501400 to 0x54501FE8 are specific to the TSEC and are subdivided into:
* 0x54501400 to 0x54501500: SCP (Secure Crypto Processor?).
* 0x54501500 to 0x54501600: TRNG (True Random Number Generator).
* 0x54501600 to 0x54501700: TFBIF (Tegra Framebuffer Interface).
* 0x54501700 to 0x54501800: DMA.
* 0x54501800 to 0x54501900: TEGRA (miscellaneous interfaces).

{| class="wikitable" border="1"
! Name
! Address
! Width
|-
| TSEC_THI_INCR_SYNCPT
| 0x54500000
| 0x04
|-
| TSEC_THI_INCR_SYNCPT_ERR
| 0x54500008
| 0x04
|-
| TSEC_THI_CTXSW_INCR_SYNCPT
| 0x5450000C
| 0x04
|-
| TSEC_THI_CTXSW
| 0x54500020
| 0x04
|-
| TSEC_THI_CONT_SYNCPT_EOF
| 0x54500028
| 0x04
|-
| [[#TSEC_THI_METHOD0|TSEC_THI_METHOD0]]
| 0x54500040
| 0x04
|-
| [[#TSEC_THI_METHOD1|TSEC_THI_METHOD1]]
| 0x54500044
| 0x04
|-
| [[#TSEC_THI_INT_STATUS|TSEC_THI_INT_STATUS]]
| 0x54500078
| 0x04
|-
| [[#TSEC_THI_INT_MASK|TSEC_THI_INT_MASK]]
| 0x5450007C
| 0x04
|-
| TSEC_THI_SLCG_STATUS
| 0x54500084
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_HIGH_A
| 0x54500088
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_LOW_A
| 0x5450008C
| 0x04
|-
| TSEC_THI_CLK_OVERRIDE
| 0x54500E00
| 0x04
|-
| [[#FALCON_IRQSSET|FALCON_IRQSSET]]
| 0x54501000
| 0x04
|-
| [[#FALCON_IRQSCLR|FALCON_IRQSCLR]]
| 0x54501004
| 0x04
|-
| [[#FALCON_IRQSTAT|FALCON_IRQSTAT]]
| 0x54501008
| 0x04
|-
| [[#FALCON_IRQMODE|FALCON_IRQMODE]]
| 0x5450100C
| 0x04
|-
| [[#FALCON_IRQMSET|FALCON_IRQMSET]]
| 0x54501010
| 0x04
|-
| [[#FALCON_IRQMCLR|FALCON_IRQMCLR]]
| 0x54501014
| 0x04
|-
| [[#FALCON_IRQMASK|FALCON_IRQMASK]]
| 0x54501018
| 0x04
|-
| [[#FALCON_IRQDEST|FALCON_IRQDEST]]
| 0x5450101C
| 0x04
|-
| FALCON_GPTMR_PERIOD
| 0x54501020
| 0x04
|-
| FALCON_GPTMR_TIME
| 0x54501024
| 0x04
|-
| FALCON_GPTMR_ENABLE
| 0x54501028
| 0x04
|-
| FALCON_TIME_LOW
| 0x5450102C
| 0x04
|-
| FALCON_TIME_HIGH
| 0x54501030
| 0x04
|-
| FALCON_WDTMR_TIME
| 0x54501034
| 0x04
|-
| FALCON_WDTMR_ENABLE
| 0x54501038
| 0x04
|-
| [[#FALCON_SCRATCH0|FALCON_SCRATCH0]]
| 0x54501040
| 0x04
|-
| [[#FALCON_SCRATCH1|FALCON_SCRATCH1]]
| 0x54501044
| 0x04
|-
| [[#FALCON_ITFEN|FALCON_ITFEN]]
| 0x54501048
| 0x04
|-
| [[#FALCON_IDLESTATE|FALCON_IDLESTATE]]
| 0x5450104C
| 0x04
|-
| FALCON_CURCTX
| 0x54501050
| 0x04
|-
| FALCON_NXTCTX
| 0x54501054
| 0x04
|-
| FALCON_CMDCTX
| 0x54501058
| 0x04
|-
| FALCON_STATUS_MASK
| 0x5450105C
| 0x04
|-
| FALCON_VM_SUPERVISOR
| 0x54501060
| 0x04
|-
| FALCON_MTHD_DATA
| 0x54501064
| 0x04
|-
| FALCON_MTHD_CMD
| 0x54501068
| 0x04
|-
| FALCON_MTHD_DATA_WR
| 0x5450106C
| 0x04
|-
| FALCON_MTHD_OCCUPIED
| 0x54501070
| 0x04
|-
| FALCON_MTHD_ACK
| 0x54501074
| 0x04
|-
| FALCON_MTHD_LIMIT
| 0x54501078
| 0x04
|-
| FALCON_SUBENGINE_RESET
| 0x5450107C
| 0x04
|-
| FALCON_SCRATCH2
| 0x54501080
| 0x04
|-
| FALCON_SCRATCH3
| 0x54501084
| 0x04
|-
| FALCON_PM_TRIGGER
| 0x54501088
| 0x04
|-
| FALCON_PM_MODE
| 0x5450108C
| 0x04
|-
| FALCON_DEBUG1
| 0x54501090
| 0x04
|-
| [[#FALCON_DEBUGINFO|FALCON_DEBUGINFO]]
| 0x54501094
| 0x04
|-
| FALCON_BREAKPOINT0
| 0x54501098
| 0x04
|-
| FALCON_BREAKPOINT1
| 0x5450109C
| 0x04
|-
| FALCON_CGCTL
| 0x545010A0
| 0x04
|-
| FALCON_ENGCTL
| 0x545010A4
| 0x04
|-
| FALCON_PM_SEL
| 0x545010A8
| 0x04
|-
| FALCON_HOST_IO_INDEX
| 0x545010AC
| 0x04
|-
| [[#FALCON_EXCI|FALCON_EXCI]]
| 0x545010D0
| 0x04
|-
| [[#FALCON_CPUCTL|FALCON_CPUCTL]]
| 0x54501100
| 0x04
|-
| [[#FALCON_BOOTVEC|FALCON_BOOTVEC]]
| 0x54501104
| 0x04
|-
| [[#FALCON_HWCFG|FALCON_HWCFG]]
| 0x54501108
| 0x04
|-
| [[#FALCON_DMACTL|FALCON_DMACTL]]
| 0x5450110C
| 0x04
|-
| [[#FALCON_DMATRF_EXTBASE|FALCON_DMATRF_EXTBASE]]
| 0x54501110
| 0x04
|-
| [[#FALCON_DMATRF_VOFF|FALCON_DMATRF_VOFF]]
| 0x54501114
| 0x04
|-
| [[#FALCON_DMATRFCMD|FALCON_DMATRFCMD]]
| 0x54501118
| 0x04
|-
| [[#FALCON_DMATRF_POFF|FALCON_DMATRF_POFF]]
| 0x5450111C
| 0x04
|-
| [[#FALCON_DMATRFSTAT|FALCON_DMATRFSTAT]]
| 0x54501120
| 0x04
|-
| [[#FALCON_CRYPTTRFSTAT|FALCON_CRYPTTRFSTAT]]
| 0x54501124
| 0x04
|-
| FALCON_CPUSTAT
| 0x54501128
| 0x04
|-
| [[#FALCON_HWCFG2|FALCON_HWCFG2]]
| 0x5450112C
| 0x04
|-
| FALCON_CPUCTL_ALIAS
| 0x54501130
| 0x04
|-
| FALCON_TLB_CMD
| 0x54501140
| 0x04
|-
| FALCON_TLB_CMD_RES
| 0x54501144
| 0x04
|-
| FALCON_BRANCH_HISTORY_CTRL
| 0x54501148
| 0x04
|-
| FALCON_BRANCH_HISTORY_PC
| 0x5450114C
| 0x04
|-
| FALCON_IMFILLRNG0
| 0x54501150
| 0x04
|-
| FALCON_IMFILLRNG1
| 0x54501154
| 0x04
|-
| FALCON_IMFILLCTL
| 0x54501158
| 0x04
|-
| FALCON_EXTERRWIN
| 0x54501160
| 0x04
|-
| FALCON_EXTERRCFG
| 0x54501164
| 0x04
|-
| FALCON_EXTERRADDR
| 0x54501168
| 0x04
|-
| FALCON_EXTERRSTAT
| 0x5450116C
| 0x04
|-
| FALCON_CG2
| 0x5450117C
| 0x04
|-
| FALCON_CODE_INDEX
| 0x54501180
| 0x04
|-
| FALCON_CODE
| 0x54501184
| 0x04
|-
| FALCON_CODE_VIRT_ADDR
| 0x54501188
| 0x04
|-
| FALCON_DATA_INDEX0
| 0x545011C0
| 0x04
|-
| FALCON_DATA0
| 0x545011C4
| 0x04
|-
| FALCON_DATA_INDEX1
| 0x545011C8
| 0x04
|-
| FALCON_DATA1
| 0x545011CC
| 0x04
|-
| FALCON_DATA_INDEX2
| 0x545011D0
| 0x04
|-
| FALCON_DATA2
| 0x545011D4
| 0x04
|-
| FALCON_DATA_INDEX3
| 0x545011D8
| 0x04
|-
| FALCON_DATA3
| 0x545011DC
| 0x04
|-
| FALCON_DATA_INDEX4
| 0x545011E0
| 0x04
|-
| FALCON_DATA4
| 0x545011E4
| 0x04
|-
| FALCON_DATA_INDEX5
| 0x545011E8
| 0x04
|-
| FALCON_DATA5
| 0x545011EC
| 0x04
|-
| FALCON_DATA_INDEX6
| 0x545011F0
| 0x04
|-
| FALCON_DATA6
| 0x545011F4
| 0x04
|-
| FALCON_DATA_INDEX7
| 0x545011F8
| 0x04
|-
| FALCON_DATA7
| 0x545011FC
| 0x04
|-
| [[#FALCON_ICD_CMD|FALCON_ICD_CMD]]
| 0x54501200
| 0x04
|-
| FALCON_ICD_ADDR
| 0x54501204
| 0x04
|-
| FALCON_ICD_WDATA
| 0x54501208
| 0x04
|-
| FALCON_ICD_RDATA
| 0x5450120C
| 0x04
|-
| [[#FALCON_SCTL|FALCON_SCTL]]
| 0x54501240
| 0x04
|-
| [[#TSEC_SCP_CTL_ACCESS|TSEC_SCP_CTL_ACCESS]]
| 0x54501400
| 0x04
|-
| [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]]
| 0x54501404
| 0x04
|-
| [[#TSEC_SCP_CTL_STAT|TSEC_SCP_CTL_STAT]]
| 0x54501408
| 0x04
|-
| [[#TSEC_SCP_CTL_MODE|TSEC_SCP_CTL_MODE]]
| 0x5450140C
| 0x04
|-
| TSEC_SCP_UNK0
| 0x54501410
| 0x04
|-
| [[#TSEC_SCP_CTL_PKEY|TSEC_SCP_CTL_PKEY]]
| 0x54501418
| 0x04
|-
| [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]]
| 0x54501420
| 0x04
|-
| [[#TSEC_SCP_SEQ_STAT|TSEC_SCP_SEQ_STAT]]
| 0x54501428
| 0x04
|-
| [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]]
| 0x54501430
| 0x04
|-
| TSEC_SCP_UNK2
| 0x54501454
| 0x04
|-
| [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]]
| 0x54501458
| 0x04
|-
| TSEC_SCP_UNK3
| 0x54501470
| 0x04
|-
| [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT]]
| 0x54501480
| 0x04
|-
| [[#TSEC_SCP_IRQMASK|TSEC_SCP_IRQMASK]]
| 0x54501484
| 0x04
|-
| TSEC_SCP_UNK4
| 0x54501490
| 0x04
|-
| [[#TSEC_SCP_ERR|TSEC_SCP_ERR]]
| 0x54501498
| 0x04
|-
| TSEC_TRNG_CLKDIV
| 0x54501500
| 0x04
|-
| TSEC_TRNG_UNK0
| 0x54501504
| 0x04
|-
| TSEC_TRNG_UNK1
| 0x5450150C
| 0x04
|-
| TSEC_TRNG_UNK2
| 0x54501510
| 0x04
|-
| TSEC_TRNG_UNK3
| 0x54501514
| 0x04
|-
| TSEC_TRNG_UNK4
| 0x54501518
| 0x04
|-
| TSEC_TRNG_UNK5
| 0x5450151C
| 0x04
|-
| TSEC_TRNG_UNK6
| 0x54501528
| 0x04
|-
| TSEC_TRNG_UNK7
| 0x5450152C
| 0x04
|-
| TSEC_TFBIF_UNK0
| 0x54501600
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL|TSEC_TFBIF_MCCIF_FIFOCTRL]]
| 0x54501604
| 0x04
|-
| TSEC_TFBIF_UNK1
| 0x54501608
| 0x04
|-
| TSEC_TFBIF_UNK2
| 0x5450160C
| 0x04
|-
| TSEC_TFBIF_UNK3
| 0x54501630
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL1|TSEC_TFBIF_MCCIF_FIFOCTRL1]]
| 0x54501634
| 0x04
|-
| TSEC_TFBIF_UNK4
| 0x54501640
| 0x04
|-
| [[#TSEC_TFBIF_UNK5|TSEC_TFBIF_UNK5]]
| 0x54501644
| 0x04
|-
| [[#TSEC_TFBIF_UNK6|TSEC_TFBIF_UNK6]]
| 0x54501648
| 0x04
|-
| [[#TSEC_DMA_CMD|TSEC_DMA_CMD]]
| 0x54501700
| 0x04
|-
| [[#TSEC_DMA_ADDR|TSEC_DMA_ADDR]]
| 0x54501704
| 0x04
|-
| [[#TSEC_DMA_VAL|TSEC_DMA_VAL]]
| 0x54501708
| 0x04
|-
| [[#TSEC_DMA_UNK|TSEC_DMA_UNK]]
| 0x5450170C
| 0x04
|-
| TSEC_TEGRA_FALCON_IP_VER
| 0x54501800
| 0x04
|-
| TSEC_TEGRA_UNK0
| 0x54501824
| 0x04
|-
| TSEC_TEGRA_UNK1
| 0x54501828
| 0x04
|-
| TSEC_TEGRA_UNK2
| 0x5450182C
| 0x04
|-
| [[#TSEC_TEGRA_CTL|TSEC_TEGRA_CTL]]
| 0x54501838
| 0x04
|}

=== TSEC_THI_METHOD0 ===
{| class="wikitable" border="1"
! ID
! Method
|-
| 0x200
| SET_APPLICATION_ID
|-
| 0x300
| EXECUTE
|-
| 0x500
| HDCP_INIT
|-
| 0x504
| HDCP_CREATE_SESSION
|-
| 0x508
| HDCP_VERIFY_CERT_RX
|-
| 0x50C
| HDCP_GENERATE_EKM
|-
| 0x510
| HDCP_REVOCATION_CHECK
|-
| 0x514
| HDCP_VERIFY_HPRIME
|-
| 0x518
| HDCP_ENCRYPT_PAIRING_INFO
|-
| 0x51C
| HDCP_DECRYPT_PAIRING_INFO
|-
| 0x520
| HDCP_UPDATE_SESSION
|-
| 0x524
| HDCP_GENERATE_LC_INIT
|-
| 0x528
| HDCP_VERIFY_LPRIME
|-
| 0x52C
| HDCP_GENERATE_SKE_INIT
|-
| 0x530
| HDCP_VERIFY_VPRIME
|-
| 0x534
| HDCP_ENCRYPTION_RUN_CTRL
|-
| 0x538
| HDCP_SESSION_CTRL
|-
| 0x53C
| HDCP_COMPUTE_SPRIME
|-
| 0x540
| HDCP_GET_CERT_RX
|-
| 0x544
| HDCP_EXCHANGE_INFO
|-
| 0x548
| HDCP_DECRYPT_KM
|-
| 0x54C
| HDCP_GET_HPRIME
|-
| 0x550
| HDCP_GENERATE_EKH_KM
|-
| 0x554
| HDCP_VERIFY_RTT_CHALLENGE
|-
| 0x558
| HDCP_GET_LPRIME
|-
| 0x55C
| HDCP_DECRYPT_KS
|-
| 0x560
| HDCP_DECRYPT
|-
| 0x564
| HDCP_GET_RRX
|-
| 0x568
| HDCP_DECRYPT_REENCRYPT
|-
| 0x56C
|
|-
| 0x570
|
|-
| 0x574
|
|-
| 0x578
|
|-
| 0x57C
|
|-
| 0x700
| HDCP_VALIDATE_SRM
|-
| 0x704
| HDCP_VALIDATE_STREAM
|-
| 0x708
| HDCP_TEST_SECURE_STATUS
|-
| 0x70C
| HDCP_SET_DCP_KPUB
|-
| 0x710
| HDCP_SET_RX_KPUB
|-
| 0x714
| HDCP_SET_CERT_RX
|-
| 0x718
| HDCP_SET_SCRATCH_BUFFER
|-
| 0x71C
| HDCP_SET_SRM
|-
| 0x720
| HDCP_SET_RECEIVER_ID_LIST
|-
| 0x724
| HDCP_SET_SPRIME
|-
| 0x728
| HDCP_SET_ENC_INPUT_BUFFER
|-
| 0x72C
| HDCP_SET_ENC_OUTPUT_BUFFER
|-
| 0x730
| HDCP_GET_RTT_CHALLENGE
|-
| 0x734
| HDCP_STREAM_MANAGE
|-
| 0x738
| HDCP_READ_CAPS
|-
| 0x73C
| HDCP_ENCRYPT
|-
| 0x740
| [6.0.0+] HDCP_GET_CURRENT_NONCE
|}

Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_METHOD1 ===
Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_INT_STATUS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_STATUS_FALCON_INT
|}

=== TSEC_THI_INT_MASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_MASK_FALCON_INT
|}

=== FALCON_IRQSSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSSET_GPTMR
|-
| 1
| FALCON_IRQSSET_WDTMR
|-
| 2
| FALCON_IRQSSET_MTHD
|-
| 3
| FALCON_IRQSSET_CTXSW
|-
| 4
| FALCON_IRQSSET_HALT
|-
| 5
| FALCON_IRQSSET_EXTERR
|-
| 6
| FALCON_IRQSSET_SWGEN0
|-
| 7
| FALCON_IRQSSET_SWGEN1
|-
| 8-15
| FALCON_IRQSSET_EXT
|}

Used for setting Falcon's IRQs.

=== FALCON_IRQSCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSCLR_GPTMR
|-
| 1
| FALCON_IRQSCLR_WDTMR
|-
| 2
| FALCON_IRQSCLR_MTHD
|-
| 3
| FALCON_IRQSCLR_CTXSW
|-
| 4
| FALCON_IRQSCLR_HALT
|-
| 5
| FALCON_IRQSCLR_EXTERR
|-
| 6
| FALCON_IRQSCLR_SWGEN0
|-
| 7
| FALCON_IRQSCLR_SWGEN1
|-
| 8-15
| FALCON_IRQSCLR_EXT
|}

Used for clearing Falcon's IRQs.

=== FALCON_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSTAT_GPTMR
|-
| 1
| FALCON_IRQSTAT_WDTMR
|-
| 2
| FALCON_IRQSTAT_MTHD
|-
| 3
| FALCON_IRQSTAT_CTXSW
|-
| 4
| FALCON_IRQSTAT_HALT
|-
| 5
| FALCON_IRQSTAT_EXTERR
|-
| 6
| FALCON_IRQSTAT_SWGEN0
|-
| 7
| FALCON_IRQSTAT_SWGEN1
|-
| 8-15
| FALCON_IRQSTAT_EXT
|}

Used for getting the status of Falcon's IRQs.

=== FALCON_IRQMODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMODE_GPTMR
|-
| 1
| FALCON_IRQMODE_WDTMR
|-
| 2
| FALCON_IRQMODE_MTHD
|-
| 3
| FALCON_IRQMODE_CTXSW
|-
| 4
| FALCON_IRQMODE_HALT
|-
| 5
| FALCON_IRQMODE_EXTERR
|-
| 6
| FALCON_IRQMODE_SWGEN0
|-
| 7
| FALCON_IRQMODE_SWGEN1
|-
| 8-15
| FALCON_IRQMODE_EXT
|}

Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.

=== FALCON_IRQMSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMSET_GPTMR
|-
| 1
| FALCON_IRQMSET_WDTMR
|-
| 2
| FALCON_IRQMSET_MTHD
|-
| 3
| FALCON_IRQMSET_CTXSW
|-
| 4
| FALCON_IRQMSET_HALT
|-
| 5
| FALCON_IRQMSET_EXTERR
|-
| 6
| FALCON_IRQMSET_SWGEN0
|-
| 7
| FALCON_IRQMSET_SWGEN1
|-
| 8-15
| FALCON_IRQMSET_EXT
|}

Used for setting the mask for Falcon's IRQs.

=== FALCON_IRQMCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMCLR_GPTMR
|-
| 1
| FALCON_IRQMCLR_WDTMR
|-
| 2
| FALCON_IRQMCLR_MTHD
|-
| 3
| FALCON_IRQMCLR_CTXSW
|-
| 4
| FALCON_IRQMCLR_HALT
|-
| 5
| FALCON_IRQMCLR_EXTERR
|-
| 6
| FALCON_IRQMCLR_SWGEN0
|-
| 7
| FALCON_IRQMCLR_SWGEN1
|-
| 8-15
| FALCON_IRQMCLR_EXT
|}

Used for clearing the mask for Falcon's IRQs.

=== FALCON_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMASK_GPTMR
|-
| 1
| FALCON_IRQMASK_WDTMR
|-
| 2
| FALCON_IRQMASK_MTHD
|-
| 3
| FALCON_IRQMASK_CTXSW
|-
| 4
| FALCON_IRQMASK_HALT
|-
| 5
| FALCON_IRQMASK_EXTERR
|-
| 6
| FALCON_IRQMASK_SWGEN0
|-
| 7
| FALCON_IRQMASK_SWGEN1
|-
| 8-15
| FALCON_IRQMASK_EXT
|}

Used for getting the value of the mask for Falcon's IRQs.

=== FALCON_IRQDEST ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQDEST_HOST_GPTMR
|-
| 1
| FALCON_IRQDEST_HOST_WDTMR
|-
| 2
| FALCON_IRQDEST_HOST_MTHD
|-
| 3
| FALCON_IRQDEST_HOST_CTXSW
|-
| 4
| FALCON_IRQDEST_HOST_HALT
|-
| 5
| FALCON_IRQDEST_HOST_EXTERR
|-
| 6
| FALCON_IRQDEST_HOST_SWGEN0
|-
| 7
| FALCON_IRQDEST_HOST_SWGEN1
|-
| 8-15
| FALCON_IRQDEST_HOST_EXT
|-
| 16
| FALCON_IRQDEST_TARGET_GPTMR
|-
| 17
| FALCON_IRQDEST_TARGET_WDTMR
|-
| 18
| FALCON_IRQDEST_TARGET_MTHD
|-
| 19
| FALCON_IRQDEST_TARGET_CTXSW
|-
| 20
| FALCON_IRQDEST_TARGET_HALT
|-
| 21
| FALCON_IRQDEST_TARGET_EXTERR
|-
| 22
| FALCON_IRQDEST_TARGET_SWGEN0
|-
| 23
| FALCON_IRQDEST_TARGET_SWGEN1
|-
| 24-31
| FALCON_IRQDEST_TARGET_EXT
|}

Used for routing Falcon's IRQs.

=== FALCON_SCRATCH0 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_SCRATCH1 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_ITFEN ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_ITFEN_CTXEN
|-
| 1
| FALCON_ITFEN_MTHDEN
|}

Used for enabling/disabling Falcon interfaces.

=== FALCON_IDLESTATE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IDLESTATE_FALCON_BUSY
|-
| 1-15
| FALCON_IDLESTATE_EXT_BUSY
|}

Used for detecting if Falcon is busy or not.

=== FALCON_DEBUGINFO ===
Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.

[6.0.0+] [[NV_services|nvservices]] sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.

=== FALCON_EXCI ===
Contains information about raised exceptions.

=== FALCON_CPUCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_CPUCTL_IINVAL
|-
| 1
| FALCON_CPUCTL_STARTCPU
|-
| 2
| FALCON_CPUCTL_SRESET
|-
| 3
| FALCON_CPUCTL_HRESET
|-
| 4
| FALCON_CPUCTL_HALTED
|-
| 5
| FALCON_CPUCTL_STOPPED
|-
| 6
| FALCON_CPUCTL_SCP_UNK
|}

Used for signaling the Falcon CPU.

=== FALCON_BOOTVEC ===
Takes the Falcon's boot vector address.

=== FALCON_HWCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-8
| FALCON_HWCFG_IMEM_SIZE
|-
| 9-17
| FALCON_HWCFG_DMEM_SIZE
|-
| 18-25
| FALCON_HWCFG_MTHD_SIZE
|-
| 26-31
| FALCON_HWCFG_DMATRF_SLOTS
|}

=== FALCON_DMACTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMACTL_REQUIRE_CTX
|-
| 1
| FALCON_DMACTL_DMEM_SCRUBBING
|-
| 2
| FALCON_DMACTL_IMEM_SCRUBBING
|-
| 3-6
| FALCON_DMACTL_DMAQ_NUM
|-
| 7
| FALCON_DMACTL_SECURE_STAT
|}

Used for configuring the Falcon's DMA engine.

=== FALCON_DMATRF_EXTBASE ===
Base of the external memory buffer.

The base of the transfer is calculated by adding [[#FALCON_DMATRF_POFF]] to the base.

=== FALCON_DMATRF_VOFF ===
For transfers to DMEM: the destination address.
For transfers to IMEM: the destination virtual IMEM page.

=== FALCON_DMATRF_POFF ===
For transfers to IMEM: the destination physical IMEM page.

=== FALCON_DMATRFCMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFCMD_FULL
|-
| 1
| FALCON_DMATRFCMD_IDLE
|-
| 2-3
| FALCON_DMATRFCMD_SEC
|-
| 4
| FALCON_DMATRFCMD_IMEM
|-
| 5
| FALCON_DMATRFCMD_WRITE
|-
| 8-10
| FALCON_DMATRFCMD_SIZE
|-
| 12-14
| FALCON_DMATRFCMD_CTXDMA
|}

Used for configuring DMA transfers.

=== FALCON_DMATRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFSTAT_PENDING
|-
| 16-18
| FALCON_DMATRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_DMATRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_CRYPTTRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| FALCON_CRYPTTRFSTAT_PENDING
|-
| 5
| FALCON_CRYPTTRFSTAT_ENABLED
|-
| 16-18
| FALCON_CRYPTTRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_CRYPTTRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_HWCFG2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_HWCFG2_VERSION
|-
| 4-5
| FALCON_HWCFG2_SCP_MODE
|-
| 6-7
| FALCON_HWCFG2_SUBVERSION
|-
| 8-11
| FALCON_HWCFG2_IMEM_PORTS
|-
| 12-15
| FALCON_HWCFG2_DMEM_PORTS
|-
| 16-19
| FALCON_HWCFG2_VM_PAGES_LOG2
|}

=== FALCON_ICD_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_ICD_CMD_OPC
0x0: BREAK
0x1: CONTINUE_FROM_PC
0x2: CONTINUE_FROM_ADDR
0x3: CONTINUE_UNK1_FROM_PC
0x4: CONTINUE_UNK1_FROM_ADDR
0x5: SINGLE_STEP_FROM_PC
0x6: SINGLE_STEP_FROM_ADDR
0x7: SET_BREAK_MASK
0x8: REG_READ
0x9: REG_WRITE
0xA: DATA_READ
0xB: DATA_WRITE
0xC: IO_READ
0xD: IO_WRITE
0xE: STATUS_READ
|-
| 6-7
| FALCON_ICD_CMD_DATA_SIZE
|-
| 8-12
| FALCON_ICD_CMD_IDX
|-
| 14
| FALCON_ICD_CMD_ERROR
|-
| 15
| FALCON_ICD_CMD_DONE
|-
| 16-31
| FALCON_ICD_CMD_BREAK_MASK
|}

=== FALCON_SCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| FALCON_SCTL_SEC_MODE
0: Non-secure
1: Light Secure
2: Heavy Secure
|}

=== TSEC_SCP_CTL_ACCESS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| Enable TSEC_SCP_INSN_STAT register
|}

=== TSEC_SCP_CTL_TRNG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 11
| Unknown
|-
| 12
| Enable the TRNG
|}

=== TSEC_SCP_CTL_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| TSEC_SCP_CTL_STAT_DEBUG_MODE
|}

=== TSEC_SCP_CTL_MODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Disable reads for the TRNG register block
|-
| 1
| Disable reads for the TFBIF register block
|-
| 2
| Disable reads for the DMA register block
|-
| 3
| Disable reads for the TEGRA register block
|-
| 4
| Disable writes for the TRNG register block
|-
| 5
| Disable writes for the TFBIF register block
|-
| 6
| Disable writes for the DMA register block
|-
| 7
| Disable writes for the TEGRA register block
|}

Controls accesses to the other sub-engines and can only be cleared in Heavy Secure mode.

=== TSEC_SCP_CTL_PKEY ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
|-
| 1
| TSEC_SCP_CTL_PKEY_LOADED
|}

=== TSEC_SCP_SEQ0_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 8-11
| Size of current cs0begin macro
|-
|}

=== TSEC_SCP_SEQ_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Set if crypto sequence recording (cs0begin/cs1begin) is active
|-
| 4-7
| Number of instructions left for the crypto sequence
|-
| 12-15
| Active crypto key register
|}

Contains information on the last crypto sequence (cs0 or cs1) executed.

=== TSEC_SCP_INSN_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| Crypto fuc5 destination register or immediate value
|-
| 8-15
| Crypto fuc5 source register or immediate value
|-
| 20-24
| Crypto fuc5 operation
0x0: none (fuc5 opcode 0x00)
0x1: cmov (fuc5 opcode 0x84)
0x2: cxsin (fuc5 opcode 0x88) or xdst (with cxset)
0x3: cxsout (fuc5 opcode 0x8C) or xdld (with cxset)
0x4: crng (fuc5 opcode 0x90)
0x5: cs0begin (fuc5 opcode 0x94)
0x6: cs0exec (fuc5 opcode 0x98)
0x7: cs1begin (fuc5 opcode 0x9C)
0x8: cs1exec (fuc5 opcode 0xA0)
0x9: invalid (fuc5 opcode 0xA4)
0xA: cchmod (fuc5 opcode 0xA8)
0xB: cxor (fuc5 opcode 0xAC)
0xC: cadd (fuc5 opcode 0xB0)
0xD: cand (fuc5 opcode 0xB4)
0xE: crev (fuc5 opcode 0xB8)
0xF: cprecmac (fuc5 opcode 0xBC)
0x10: csecret (fuc5 opcode 0xC0)
0x11: ckeyreg (fuc5 opcode 0xC4)
0x12: ckexp (fuc5 opcode 0xC8)
0x13: ckrexp (fuc5 opcode 0xCC)
0x14: cenc (fuc5 opcode 0xD0)
0x15: cdec (fuc5 opcode 0xD4)
0x16: csigauth (fuc5 opcode 0xD8)
0x17: csigenc (fuc5 opcode 0xDC)
0x18: csigclr (fuc5 opcode 0xE0)
|-
| 31
| Set if running in secure mode (cauth)
|}

Contains information on the last crypto instruction executed.

=== TSEC_SCP_AES_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-4
| First opcode
|-
| 5-9
| Second opcode
|-
| 15-16
| AES operation
0: Encryption
1: Decryption
2: Key expansion
3: Key reverse expansion
|}

Contains information on the last AES sequence executed.

=== TSEC_SCP_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQSTAT_TRNG
|-
| 8
| TSEC_SCP_IRQSTAT_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQSTAT_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQSTAT_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the status of crypto IRQs.

=== TSEC_SCP_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQMASK_TRNG
|-
| 8
| TSEC_SCP_IRQMASK_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQMASK_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQMASK_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the value of the mask for crypto IRQs.

=== TSEC_SCP_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Invalid instruction
|-
| 4
| Empty crypto sequence
|-
| 8
| Crypto sequence is too long
|-
| 12
| Crypto sequence was not finished
|-
| 16
| Invalid cauth signature (during csigenc, csigclr or csigunk)
|-
| 24
| Forbidden instruction
|}

Contains information on crypto errors generated by the [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT_INSN_ERROR]] IRQ.

=== TSEC_TFBIF_MCCIF_FIFOCTRL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
|-
| 1
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
|-
| 2
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
|-
| 3
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
|-
| 4
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
|-
| 5
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
|-
| 6
| TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
|-
| 7
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
|-
| 8
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE
|}

=== TSEC_MCCIF_FIFOCTRL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
|-
| 16-31
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT
|}

=== TSEC_TFBIF_UNK5 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.

=== TSEC_TFBIF_UNK6 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to (data_size << 4) before reading memory from the GPU UCODE carveout.

=== TSEC_DMA_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_DMA_CMD_READ
|-
| 1
| TSEC_DMA_CMD_WRITE
|-
| 4-7
| TSEC_DMA_CMD_UNK
|-
| 12
| TSEC_DMA_CMD_BUSY
|-
| 13
| TSEC_DMA_CMD_ERROR
|-
| 31
| TSEC_DMA_CMD_INIT
|}

A DMA read/write operation requires bits TSEC_DMA_CMD_INIT and TSEC_DMA_CMD_READ/TSEC_DMA_CMD_WRITE to be set in TSEC_DMA_CMD.

During the transfer, the TSEC_DMA_CMD_BUSY bit is set.

Accessing an invalid address causes bit TSEC_DMA_CMD_ERROR to be set.

=== TSEC_DMA_ADDR ===
Takes the address for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_VAL ===
Takes the value for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_UNK ===
Always 0xFFF.

=== TSEC_TEGRA_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 16
| TSEC_TEGRA_CTL_TKFI_KFUSE
|-
| 17
| TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
|-
| 24
| TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
|-
| 25
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
|-
| 26
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
|-
| 27
| TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C
|}

== Authenticated Mode ==
===== Entry =====
From non-secure mode, upon jumping to a page marked as secret, a secret fault occurs. This causes the CPU to verify the region specified in $cauth against the MAC loaded in $c6. If the comparison is successful, the valid bit (bit0) is set on all pages in the $cauth region, and $pc is set to the base of the $cauth region. If the comparsion fails, the CPU is halted.

===== Exit =====
The CPU automatically goes back to non-secure mode when returning back into non-secret pages. When this happens, the valid bit (bit0) in the TLB flags is cleared for all secret pages.

===== Implementation =====
Under certain circumstances, it is possible to observe [[#csigauth|csigauth]] being briefly written to [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]] as "csigauth $c4 $c6" while the opcodes in [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]] are set to "cxsin" and "csigauth", respectively.

Via [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]] it can be observed that a 3-sized macro sequence is loaded into cs0 during a secure mode transition.

== Crypto processing ==
Part of the information here (which hasn't made it into envytools documentation yet) was shared by [https://wiki.0x04.net/wiki/Marcin_Ko%C5%9Bcielnicki mwk] from reverse engineering falcon processors over the years.

=== cauth ===
$cauth is a special purpose register in the CPU.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7 || Start of region to authenticate (in 0x100 pages)
|-
| 8-15 || Unused
|-
| 16 || Use secret xfers (?)
|-
| 17 || Region is signed and encrypted and double the size (?)
|-
| 18 ||
|-
| 19 ||
|-
| 20-23 || Unused
|-
| 31-24 || Size of region to authenticate (in 0x100 pages)
|}

== SCP operations ==

{| class="wikitable" border="1"
! Opcode
! Name
! Operand0
! Operand1
! Operation
! Condition
|-
| 0 || nop || || || ||
|-
| 1 || mov || $cX || $cY || <code>$cX = $cY; ACL(X) = ACL(Y);</code> ||
|-
| 2 || sin || $cX || N/A || <code>$cX = read_stream(); ACL(X) = ???;</code> ||
|-
| 3 || sout || $cX || N/A || <code>write_stream($cX);</code> || ?
|-
| 4 || rnd || $cX || N/A || <code>$cX = read_trng(); ACL(X) = ???;</code> ||
|-
| 5 || s0begin || immX || N/A || <code>record_macro_for_N_instructions(0, immX);</code> ||
|-
| 6 || s0exec || immX || N/A || <code>execute_macro_N_times(0, immX);</code> ||
|-
| 7 || s1begin || immX || N/A || <code>record_macro_for_N_instructions(1, immX);</code> ||
|-
| 8 || s1exec || immX || N/A || <code>execute_macro_N_times(1, immX);</code> ||
|-
| 9 || <invalid> || || || ||
|-
| 0xA || chmod || $cX || immY || Complicated, see [[#ACL|ACL]]. ||
|-
| 0xB || xor || $cX || $cY || <code>$cX ^= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xC || add || $cX || immY || <code>$cX += immY;</code> || <code>(ACL(X) & 2)</code>
|-
| 0xD || and || $cX || $cY || <code>$cX &= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xE || rev || $cX || $cY || <code>$cX = endian_swap128($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0xF || gfmul || $cX || $cY || <code>$cX = gfmul($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 2)</code>
|-
| 0x10 || secret || $cX || immY || <code>$cX = load_secret(immY); ACL(X) = load_secret_acl(immY);</code> ||
|-
| 0x11 || keyreg || immX || || <code>active_key_idx = immX;</code> ||
|-
| 0x12 || kexp || $cX || $cY || <code>$cX = aes_kexp($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0x13 || krexp || $cX || $cY || <code>$cX = aes_kexp_reverse($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0x14 || enc || $cX || $cY || <code>$cX = aes_enc(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 1) && (ACL(Y) & 2)</code>
|-
| 0x15 || dec || $cX || $cY || <code>$cX = aes_dec(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 1) && (ACL(Y) & 2)</code>
|-
| 0x16 || csigauth || $cX || $cY || <code>if (hash_verify($cX, $cY)) { has_sig = true; current_sig = $cX; }</code> || ?
|-
| 0x17 || csigclr || || || <code>has_sig = false;</code> ||
|-
| 0x18 || csigenc || $cX || $cY || <code>if (has_sig) $cX = aes_enc(current_sig, $cY);</code> || ?
|}

=== ACL ===
{| class="wikitable" border="1"
! Bit
! Meaning
|-
| 0 || Secure key. Forced set if bit1 is set.
|-
| 1 || Secure readable. Once cleared, cannot be set again.
|-
| 2 || Insecure key. Forced set if bit3 is set. Forced clear if bit0 is clear. Can be toggled back and forth.
|-
| 3 || Insecure readable. Forced clear if bit1 is clear. Can be toggled back and forth.
|-
| 4 || Insecure overwritable.
|}

==== Initial values ====
On SCP boot, the ACL is 0x1F for all $cX.

Loading into $cX using xdst instruction sets ACL($cX) to 0x1F.

Spilling a $cX to DMEM using xdld instruction is allowed if (ACL($cX) & 2).

=== csigauth ===
<code>00000000: f5 3c XY d8 csigauth $cY $cX</code>

This instruction takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret.

=== csigclr ===
<code>00000000: f5 3c 00 e0 csigclr</code>

This instruction takes no operands and appears to clear the saved cauth signature used by the csigenc instruction.

=== cchmod ===
<code>00000000: f5 3c XY a8 cchmod $cY 0X</code> or <code>00000000: f5 3c XY a9 cchmod $cY 1X</code>

This instruction takes a crypto register and a 5 bit immediate value. It appears to set the [[#Register ACLs|crypto registers' ACL]] bits as follows:
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Allow register to be used as key in NS or LS mode
|-
| 1
| Allow register to be used as key in HS mode
|-
| 2
| Set register as readable in NS or LS mode
|-
| 3
| Set register as readable in HS mode
|-
| 4
| Set register as writable in NS or LS mode
|}

=== crng ===
<code>00000000: f5 3c 0X 90 crng $cX</code>

This instruction initializes a crypto register with random data.

Executing this instruction only succeeds if the TRNG is enabled for the SCP, which requires taking the following steps:
* Write 0x7FFF to TSEC_TRNG_CLKDIV.
* Write 0x3FF0000 to TSEC_TRNG_UNK0.
* Write 0xFF00 to TSEC_TRNG_UNK7.
* Write 0x1000 to [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]].

Otherwise it hangs forever.

=== cxset ===
cxset instruction provides a way to change behavior of a variable amount of successively executed DMA-related instructions.

for example: <code>000000de: f4 3c 02 cxset 0x2</code>

can be read as: <code>dma_override(type=crypto_reg, count=2)</code>

The argument to cxset specifies the type of behavior change in the top 3 bits, and the number of DMA-related instructions the effect lasts for in the lower 5 bits.

{| class=wikitable
! Bits || Description
|-
| 0-4 || Number of instructions it is valid for (0x1f is a special value meaning infinitely many instructions -- until overriden by another cxset)
|-
| 5 || Crypto destination/source select (0=crypto register, 1=crypto stream)
|-
| 6 || External memory override (0=Disabled, 1=Enabled)
|-
| 7 || Internal memory select (0=DMEM, 1=IMEM)
|}

==== DMA-Related Instructions ====
At least the following instructions may have changed behavior, and count against the cxset "count" argument: <code>xdwait</code>, <code>xdst</code>, <code>xdld</code>.

For example, if override type=0b000, then the "length" argument to <code>xdst</code> is instead treated as the index of the target $cX register.

=== Secrets ===
Falcon's Authenticated Mode has access to 64 128-bit keys which are burned at factory. These keys can be loaded by using the $csecret instruction which takes the target crypto register and the key index as arguments.

{| class=wikitable
! Index || Notes || Console-unique
|-
| 0x00 || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares. || No
|-
| 0x01 || Used by nvhost_nvdec_bl020_prod firmware. ||
|-
| 0x03 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x04 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x05 || Used by nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares. ||
|-
| 0x07 || Used by [6.0.0+] nvhost_tsec firmware. ||
|-
| 0x09 || Used by nvhost_tsec firmware. ||
|-
| 0x0B || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x0F || Used by nvhost_tsec firmware. ||
|-
| 0x10 || Used by [1.0.0-5.1.0] nvhost_tsec firmware. ||
|-
| 0x15 || Used by nvhost_nvdec_bl020_prod, [5.0.0+] nvhost_nvdec020_prod, [5.0.0+] nvhost_nvdec020_ns and [6.0.0+] nvhost_tsec firmwares. ||
|-
| 0x26 || Used by [[TSEC_Firmware#KeygenLdr|KeygenLdr]]. || No
|-
| 0x3C || Used by nvhost_tsec firmware. ||
|-
| 0x3F || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. || Yes
|}

TSEC

2019-01-08T16:59:58Z

Qlutoo: /* SCP operations */

TSEC (Tegra Security Co-processor) is a dedicated unit powered by a NVIDIA Falcon microprocessor with crypto extensions.

= Driver =
A host driver for communicating with the TSEC is mapped to physical address 0x54500000 with a total size of 0x40000 bytes and exposes several registers.

== Registers ==
Registers from 0x54500000 to 0x54501000 are used to configure the host interface (HOST1X).

Registers from 0x54501000 to 0x54502000 are a MMIO window for communicating with the Falcon microprocessor. From this range, the subset of registers from 0x54501400 to 0x54501FE8 are specific to the TSEC and are subdivided into:
* 0x54501400 to 0x54501500: SCP (Secure Crypto Processor?).
* 0x54501500 to 0x54501600: TRNG (True Random Number Generator).
* 0x54501600 to 0x54501700: TFBIF (Tegra Framebuffer Interface).
* 0x54501700 to 0x54501800: DMA.
* 0x54501800 to 0x54501900: TEGRA (miscellaneous interfaces).

{| class="wikitable" border="1"
! Name
! Address
! Width
|-
| TSEC_THI_INCR_SYNCPT
| 0x54500000
| 0x04
|-
| TSEC_THI_INCR_SYNCPT_ERR
| 0x54500008
| 0x04
|-
| TSEC_THI_CTXSW_INCR_SYNCPT
| 0x5450000C
| 0x04
|-
| TSEC_THI_CTXSW
| 0x54500020
| 0x04
|-
| TSEC_THI_CONT_SYNCPT_EOF
| 0x54500028
| 0x04
|-
| [[#TSEC_THI_METHOD0|TSEC_THI_METHOD0]]
| 0x54500040
| 0x04
|-
| [[#TSEC_THI_METHOD1|TSEC_THI_METHOD1]]
| 0x54500044
| 0x04
|-
| [[#TSEC_THI_INT_STATUS|TSEC_THI_INT_STATUS]]
| 0x54500078
| 0x04
|-
| [[#TSEC_THI_INT_MASK|TSEC_THI_INT_MASK]]
| 0x5450007C
| 0x04
|-
| TSEC_THI_SLCG_STATUS
| 0x54500084
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_HIGH_A
| 0x54500088
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_LOW_A
| 0x5450008C
| 0x04
|-
| TSEC_THI_CLK_OVERRIDE
| 0x54500E00
| 0x04
|-
| [[#FALCON_IRQSSET|FALCON_IRQSSET]]
| 0x54501000
| 0x04
|-
| [[#FALCON_IRQSCLR|FALCON_IRQSCLR]]
| 0x54501004
| 0x04
|-
| [[#FALCON_IRQSTAT|FALCON_IRQSTAT]]
| 0x54501008
| 0x04
|-
| [[#FALCON_IRQMODE|FALCON_IRQMODE]]
| 0x5450100C
| 0x04
|-
| [[#FALCON_IRQMSET|FALCON_IRQMSET]]
| 0x54501010
| 0x04
|-
| [[#FALCON_IRQMCLR|FALCON_IRQMCLR]]
| 0x54501014
| 0x04
|-
| [[#FALCON_IRQMASK|FALCON_IRQMASK]]
| 0x54501018
| 0x04
|-
| [[#FALCON_IRQDEST|FALCON_IRQDEST]]
| 0x5450101C
| 0x04
|-
| FALCON_GPTMR_PERIOD
| 0x54501020
| 0x04
|-
| FALCON_GPTMR_TIME
| 0x54501024
| 0x04
|-
| FALCON_GPTMR_ENABLE
| 0x54501028
| 0x04
|-
| FALCON_TIME_LOW
| 0x5450102C
| 0x04
|-
| FALCON_TIME_HIGH
| 0x54501030
| 0x04
|-
| FALCON_WDTMR_TIME
| 0x54501034
| 0x04
|-
| FALCON_WDTMR_ENABLE
| 0x54501038
| 0x04
|-
| [[#FALCON_SCRATCH0|FALCON_SCRATCH0]]
| 0x54501040
| 0x04
|-
| [[#FALCON_SCRATCH1|FALCON_SCRATCH1]]
| 0x54501044
| 0x04
|-
| [[#FALCON_ITFEN|FALCON_ITFEN]]
| 0x54501048
| 0x04
|-
| [[#FALCON_IDLESTATE|FALCON_IDLESTATE]]
| 0x5450104C
| 0x04
|-
| FALCON_CURCTX
| 0x54501050
| 0x04
|-
| FALCON_NXTCTX
| 0x54501054
| 0x04
|-
| FALCON_CMDCTX
| 0x54501058
| 0x04
|-
| FALCON_STATUS_MASK
| 0x5450105C
| 0x04
|-
| FALCON_VM_SUPERVISOR
| 0x54501060
| 0x04
|-
| FALCON_MTHD_DATA
| 0x54501064
| 0x04
|-
| FALCON_MTHD_CMD
| 0x54501068
| 0x04
|-
| FALCON_MTHD_DATA_WR
| 0x5450106C
| 0x04
|-
| FALCON_MTHD_OCCUPIED
| 0x54501070
| 0x04
|-
| FALCON_MTHD_ACK
| 0x54501074
| 0x04
|-
| FALCON_MTHD_LIMIT
| 0x54501078
| 0x04
|-
| FALCON_SUBENGINE_RESET
| 0x5450107C
| 0x04
|-
| FALCON_SCRATCH2
| 0x54501080
| 0x04
|-
| FALCON_SCRATCH3
| 0x54501084
| 0x04
|-
| FALCON_PM_TRIGGER
| 0x54501088
| 0x04
|-
| FALCON_PM_MODE
| 0x5450108C
| 0x04
|-
| FALCON_DEBUG1
| 0x54501090
| 0x04
|-
| [[#FALCON_DEBUGINFO|FALCON_DEBUGINFO]]
| 0x54501094
| 0x04
|-
| FALCON_BREAKPOINT0
| 0x54501098
| 0x04
|-
| FALCON_BREAKPOINT1
| 0x5450109C
| 0x04
|-
| FALCON_CGCTL
| 0x545010A0
| 0x04
|-
| FALCON_ENGCTL
| 0x545010A4
| 0x04
|-
| FALCON_PM_SEL
| 0x545010A8
| 0x04
|-
| FALCON_HOST_IO_INDEX
| 0x545010AC
| 0x04
|-
| [[#FALCON_EXCI|FALCON_EXCI]]
| 0x545010D0
| 0x04
|-
| [[#FALCON_CPUCTL|FALCON_CPUCTL]]
| 0x54501100
| 0x04
|-
| [[#FALCON_BOOTVEC|FALCON_BOOTVEC]]
| 0x54501104
| 0x04
|-
| [[#FALCON_HWCFG|FALCON_HWCFG]]
| 0x54501108
| 0x04
|-
| [[#FALCON_DMACTL|FALCON_DMACTL]]
| 0x5450110C
| 0x04
|-
| [[#FALCON_DMATRF_EXTBASE|FALCON_DMATRF_EXTBASE]]
| 0x54501110
| 0x04
|-
| [[#FALCON_DMATRF_VOFF|FALCON_DMATRF_VOFF]]
| 0x54501114
| 0x04
|-
| [[#FALCON_DMATRFCMD|FALCON_DMATRFCMD]]
| 0x54501118
| 0x04
|-
| [[#FALCON_DMATRF_POFF|FALCON_DMATRF_POFF]]
| 0x5450111C
| 0x04
|-
| [[#FALCON_DMATRFSTAT|FALCON_DMATRFSTAT]]
| 0x54501120
| 0x04
|-
| [[#FALCON_CRYPTTRFSTAT|FALCON_CRYPTTRFSTAT]]
| 0x54501124
| 0x04
|-
| FALCON_CPUSTAT
| 0x54501128
| 0x04
|-
| [[#FALCON_HWCFG2|FALCON_HWCFG2]]
| 0x5450112C
| 0x04
|-
| FALCON_CPUCTL_ALIAS
| 0x54501130
| 0x04
|-
| FALCON_TLB_CMD
| 0x54501140
| 0x04
|-
| FALCON_TLB_CMD_RES
| 0x54501144
| 0x04
|-
| FALCON_BRANCH_HISTORY_CTRL
| 0x54501148
| 0x04
|-
| FALCON_BRANCH_HISTORY_PC
| 0x5450114C
| 0x04
|-
| FALCON_IMFILLRNG0
| 0x54501150
| 0x04
|-
| FALCON_IMFILLRNG1
| 0x54501154
| 0x04
|-
| FALCON_IMFILLCTL
| 0x54501158
| 0x04
|-
| FALCON_EXTERRWIN
| 0x54501160
| 0x04
|-
| FALCON_EXTERRCFG
| 0x54501164
| 0x04
|-
| FALCON_EXTERRADDR
| 0x54501168
| 0x04
|-
| FALCON_EXTERRSTAT
| 0x5450116C
| 0x04
|-
| FALCON_CG2
| 0x5450117C
| 0x04
|-
| FALCON_CODE_INDEX
| 0x54501180
| 0x04
|-
| FALCON_CODE
| 0x54501184
| 0x04
|-
| FALCON_CODE_VIRT_ADDR
| 0x54501188
| 0x04
|-
| FALCON_DATA_INDEX0
| 0x545011C0
| 0x04
|-
| FALCON_DATA0
| 0x545011C4
| 0x04
|-
| FALCON_DATA_INDEX1
| 0x545011C8
| 0x04
|-
| FALCON_DATA1
| 0x545011CC
| 0x04
|-
| FALCON_DATA_INDEX2
| 0x545011D0
| 0x04
|-
| FALCON_DATA2
| 0x545011D4
| 0x04
|-
| FALCON_DATA_INDEX3
| 0x545011D8
| 0x04
|-
| FALCON_DATA3
| 0x545011DC
| 0x04
|-
| FALCON_DATA_INDEX4
| 0x545011E0
| 0x04
|-
| FALCON_DATA4
| 0x545011E4
| 0x04
|-
| FALCON_DATA_INDEX5
| 0x545011E8
| 0x04
|-
| FALCON_DATA5
| 0x545011EC
| 0x04
|-
| FALCON_DATA_INDEX6
| 0x545011F0
| 0x04
|-
| FALCON_DATA6
| 0x545011F4
| 0x04
|-
| FALCON_DATA_INDEX7
| 0x545011F8
| 0x04
|-
| FALCON_DATA7
| 0x545011FC
| 0x04
|-
| [[#FALCON_ICD_CMD|FALCON_ICD_CMD]]
| 0x54501200
| 0x04
|-
| FALCON_ICD_ADDR
| 0x54501204
| 0x04
|-
| FALCON_ICD_WDATA
| 0x54501208
| 0x04
|-
| FALCON_ICD_RDATA
| 0x5450120C
| 0x04
|-
| [[#FALCON_SCTL|FALCON_SCTL]]
| 0x54501240
| 0x04
|-
| [[#TSEC_SCP_CTL_ACCESS|TSEC_SCP_CTL_ACCESS]]
| 0x54501400
| 0x04
|-
| [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]]
| 0x54501404
| 0x04
|-
| [[#TSEC_SCP_CTL_STAT|TSEC_SCP_CTL_STAT]]
| 0x54501408
| 0x04
|-
| [[#TSEC_SCP_CTL_MODE|TSEC_SCP_CTL_MODE]]
| 0x5450140C
| 0x04
|-
| TSEC_SCP_UNK0
| 0x54501410
| 0x04
|-
| [[#TSEC_SCP_CTL_PKEY|TSEC_SCP_CTL_PKEY]]
| 0x54501418
| 0x04
|-
| [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]]
| 0x54501420
| 0x04
|-
| [[#TSEC_SCP_SEQ_STAT|TSEC_SCP_SEQ_STAT]]
| 0x54501428
| 0x04
|-
| [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]]
| 0x54501430
| 0x04
|-
| TSEC_SCP_UNK2
| 0x54501454
| 0x04
|-
| [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]]
| 0x54501458
| 0x04
|-
| TSEC_SCP_UNK3
| 0x54501470
| 0x04
|-
| [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT]]
| 0x54501480
| 0x04
|-
| [[#TSEC_SCP_IRQMASK|TSEC_SCP_IRQMASK]]
| 0x54501484
| 0x04
|-
| TSEC_SCP_UNK4
| 0x54501490
| 0x04
|-
| [[#TSEC_SCP_ERR|TSEC_SCP_ERR]]
| 0x54501498
| 0x04
|-
| TSEC_TRNG_CLKDIV
| 0x54501500
| 0x04
|-
| TSEC_TRNG_UNK0
| 0x54501504
| 0x04
|-
| TSEC_TRNG_UNK1
| 0x5450150C
| 0x04
|-
| TSEC_TRNG_UNK2
| 0x54501510
| 0x04
|-
| TSEC_TRNG_UNK3
| 0x54501514
| 0x04
|-
| TSEC_TRNG_UNK4
| 0x54501518
| 0x04
|-
| TSEC_TRNG_UNK5
| 0x5450151C
| 0x04
|-
| TSEC_TRNG_UNK6
| 0x54501528
| 0x04
|-
| TSEC_TRNG_UNK7
| 0x5450152C
| 0x04
|-
| TSEC_TFBIF_UNK0
| 0x54501600
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL|TSEC_TFBIF_MCCIF_FIFOCTRL]]
| 0x54501604
| 0x04
|-
| TSEC_TFBIF_UNK1
| 0x54501608
| 0x04
|-
| TSEC_TFBIF_UNK2
| 0x5450160C
| 0x04
|-
| TSEC_TFBIF_UNK3
| 0x54501630
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL1|TSEC_TFBIF_MCCIF_FIFOCTRL1]]
| 0x54501634
| 0x04
|-
| TSEC_TFBIF_UNK4
| 0x54501640
| 0x04
|-
| [[#TSEC_TFBIF_UNK5|TSEC_TFBIF_UNK5]]
| 0x54501644
| 0x04
|-
| [[#TSEC_TFBIF_UNK6|TSEC_TFBIF_UNK6]]
| 0x54501648
| 0x04
|-
| [[#TSEC_DMA_CMD|TSEC_DMA_CMD]]
| 0x54501700
| 0x04
|-
| [[#TSEC_DMA_ADDR|TSEC_DMA_ADDR]]
| 0x54501704
| 0x04
|-
| [[#TSEC_DMA_VAL|TSEC_DMA_VAL]]
| 0x54501708
| 0x04
|-
| [[#TSEC_DMA_UNK|TSEC_DMA_UNK]]
| 0x5450170C
| 0x04
|-
| TSEC_TEGRA_FALCON_IP_VER
| 0x54501800
| 0x04
|-
| TSEC_TEGRA_UNK0
| 0x54501824
| 0x04
|-
| TSEC_TEGRA_UNK1
| 0x54501828
| 0x04
|-
| TSEC_TEGRA_UNK2
| 0x5450182C
| 0x04
|-
| [[#TSEC_TEGRA_CTL|TSEC_TEGRA_CTL]]
| 0x54501838
| 0x04
|}

=== TSEC_THI_METHOD0 ===
{| class="wikitable" border="1"
! ID
! Method
|-
| 0x200
| SET_APPLICATION_ID
|-
| 0x300
| EXECUTE
|-
| 0x500
| HDCP_INIT
|-
| 0x504
| HDCP_CREATE_SESSION
|-
| 0x508
| HDCP_VERIFY_CERT_RX
|-
| 0x50C
| HDCP_GENERATE_EKM
|-
| 0x510
| HDCP_REVOCATION_CHECK
|-
| 0x514
| HDCP_VERIFY_HPRIME
|-
| 0x518
| HDCP_ENCRYPT_PAIRING_INFO
|-
| 0x51C
| HDCP_DECRYPT_PAIRING_INFO
|-
| 0x520
| HDCP_UPDATE_SESSION
|-
| 0x524
| HDCP_GENERATE_LC_INIT
|-
| 0x528
| HDCP_VERIFY_LPRIME
|-
| 0x52C
| HDCP_GENERATE_SKE_INIT
|-
| 0x530
| HDCP_VERIFY_VPRIME
|-
| 0x534
| HDCP_ENCRYPTION_RUN_CTRL
|-
| 0x538
| HDCP_SESSION_CTRL
|-
| 0x53C
| HDCP_COMPUTE_SPRIME
|-
| 0x540
| HDCP_GET_CERT_RX
|-
| 0x544
| HDCP_EXCHANGE_INFO
|-
| 0x548
| HDCP_DECRYPT_KM
|-
| 0x54C
| HDCP_GET_HPRIME
|-
| 0x550
| HDCP_GENERATE_EKH_KM
|-
| 0x554
| HDCP_VERIFY_RTT_CHALLENGE
|-
| 0x558
| HDCP_GET_LPRIME
|-
| 0x55C
| HDCP_DECRYPT_KS
|-
| 0x560
| HDCP_DECRYPT
|-
| 0x564
| HDCP_GET_RRX
|-
| 0x568
| HDCP_DECRYPT_REENCRYPT
|-
| 0x56C
|
|-
| 0x570
|
|-
| 0x574
|
|-
| 0x578
|
|-
| 0x57C
|
|-
| 0x700
| HDCP_VALIDATE_SRM
|-
| 0x704
| HDCP_VALIDATE_STREAM
|-
| 0x708
| HDCP_TEST_SECURE_STATUS
|-
| 0x70C
| HDCP_SET_DCP_KPUB
|-
| 0x710
| HDCP_SET_RX_KPUB
|-
| 0x714
| HDCP_SET_CERT_RX
|-
| 0x718
| HDCP_SET_SCRATCH_BUFFER
|-
| 0x71C
| HDCP_SET_SRM
|-
| 0x720
| HDCP_SET_RECEIVER_ID_LIST
|-
| 0x724
| HDCP_SET_SPRIME
|-
| 0x728
| HDCP_SET_ENC_INPUT_BUFFER
|-
| 0x72C
| HDCP_SET_ENC_OUTPUT_BUFFER
|-
| 0x730
| HDCP_GET_RTT_CHALLENGE
|-
| 0x734
| HDCP_STREAM_MANAGE
|-
| 0x738
| HDCP_READ_CAPS
|-
| 0x73C
| HDCP_ENCRYPT
|-
| 0x740
| [6.0.0+] HDCP_GET_CURRENT_NONCE
|}

Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_METHOD1 ===
Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_INT_STATUS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_STATUS_FALCON_INT
|}

=== TSEC_THI_INT_MASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_MASK_FALCON_INT
|}

=== FALCON_IRQSSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSSET_GPTMR
|-
| 1
| FALCON_IRQSSET_WDTMR
|-
| 2
| FALCON_IRQSSET_MTHD
|-
| 3
| FALCON_IRQSSET_CTXSW
|-
| 4
| FALCON_IRQSSET_HALT
|-
| 5
| FALCON_IRQSSET_EXTERR
|-
| 6
| FALCON_IRQSSET_SWGEN0
|-
| 7
| FALCON_IRQSSET_SWGEN1
|-
| 8-15
| FALCON_IRQSSET_EXT
|}

Used for setting Falcon's IRQs.

=== FALCON_IRQSCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSCLR_GPTMR
|-
| 1
| FALCON_IRQSCLR_WDTMR
|-
| 2
| FALCON_IRQSCLR_MTHD
|-
| 3
| FALCON_IRQSCLR_CTXSW
|-
| 4
| FALCON_IRQSCLR_HALT
|-
| 5
| FALCON_IRQSCLR_EXTERR
|-
| 6
| FALCON_IRQSCLR_SWGEN0
|-
| 7
| FALCON_IRQSCLR_SWGEN1
|-
| 8-15
| FALCON_IRQSCLR_EXT
|}

Used for clearing Falcon's IRQs.

=== FALCON_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSTAT_GPTMR
|-
| 1
| FALCON_IRQSTAT_WDTMR
|-
| 2
| FALCON_IRQSTAT_MTHD
|-
| 3
| FALCON_IRQSTAT_CTXSW
|-
| 4
| FALCON_IRQSTAT_HALT
|-
| 5
| FALCON_IRQSTAT_EXTERR
|-
| 6
| FALCON_IRQSTAT_SWGEN0
|-
| 7
| FALCON_IRQSTAT_SWGEN1
|-
| 8-15
| FALCON_IRQSTAT_EXT
|}

Used for getting the status of Falcon's IRQs.

=== FALCON_IRQMODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMODE_GPTMR
|-
| 1
| FALCON_IRQMODE_WDTMR
|-
| 2
| FALCON_IRQMODE_MTHD
|-
| 3
| FALCON_IRQMODE_CTXSW
|-
| 4
| FALCON_IRQMODE_HALT
|-
| 5
| FALCON_IRQMODE_EXTERR
|-
| 6
| FALCON_IRQMODE_SWGEN0
|-
| 7
| FALCON_IRQMODE_SWGEN1
|-
| 8-15
| FALCON_IRQMODE_EXT
|}

Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.

=== FALCON_IRQMSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMSET_GPTMR
|-
| 1
| FALCON_IRQMSET_WDTMR
|-
| 2
| FALCON_IRQMSET_MTHD
|-
| 3
| FALCON_IRQMSET_CTXSW
|-
| 4
| FALCON_IRQMSET_HALT
|-
| 5
| FALCON_IRQMSET_EXTERR
|-
| 6
| FALCON_IRQMSET_SWGEN0
|-
| 7
| FALCON_IRQMSET_SWGEN1
|-
| 8-15
| FALCON_IRQMSET_EXT
|}

Used for setting the mask for Falcon's IRQs.

=== FALCON_IRQMCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMCLR_GPTMR
|-
| 1
| FALCON_IRQMCLR_WDTMR
|-
| 2
| FALCON_IRQMCLR_MTHD
|-
| 3
| FALCON_IRQMCLR_CTXSW
|-
| 4
| FALCON_IRQMCLR_HALT
|-
| 5
| FALCON_IRQMCLR_EXTERR
|-
| 6
| FALCON_IRQMCLR_SWGEN0
|-
| 7
| FALCON_IRQMCLR_SWGEN1
|-
| 8-15
| FALCON_IRQMCLR_EXT
|}

Used for clearing the mask for Falcon's IRQs.

=== FALCON_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMASK_GPTMR
|-
| 1
| FALCON_IRQMASK_WDTMR
|-
| 2
| FALCON_IRQMASK_MTHD
|-
| 3
| FALCON_IRQMASK_CTXSW
|-
| 4
| FALCON_IRQMASK_HALT
|-
| 5
| FALCON_IRQMASK_EXTERR
|-
| 6
| FALCON_IRQMASK_SWGEN0
|-
| 7
| FALCON_IRQMASK_SWGEN1
|-
| 8-15
| FALCON_IRQMASK_EXT
|}

Used for getting the value of the mask for Falcon's IRQs.

=== FALCON_IRQDEST ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQDEST_HOST_GPTMR
|-
| 1
| FALCON_IRQDEST_HOST_WDTMR
|-
| 2
| FALCON_IRQDEST_HOST_MTHD
|-
| 3
| FALCON_IRQDEST_HOST_CTXSW
|-
| 4
| FALCON_IRQDEST_HOST_HALT
|-
| 5
| FALCON_IRQDEST_HOST_EXTERR
|-
| 6
| FALCON_IRQDEST_HOST_SWGEN0
|-
| 7
| FALCON_IRQDEST_HOST_SWGEN1
|-
| 8-15
| FALCON_IRQDEST_HOST_EXT
|-
| 16
| FALCON_IRQDEST_TARGET_GPTMR
|-
| 17
| FALCON_IRQDEST_TARGET_WDTMR
|-
| 18
| FALCON_IRQDEST_TARGET_MTHD
|-
| 19
| FALCON_IRQDEST_TARGET_CTXSW
|-
| 20
| FALCON_IRQDEST_TARGET_HALT
|-
| 21
| FALCON_IRQDEST_TARGET_EXTERR
|-
| 22
| FALCON_IRQDEST_TARGET_SWGEN0
|-
| 23
| FALCON_IRQDEST_TARGET_SWGEN1
|-
| 24-31
| FALCON_IRQDEST_TARGET_EXT
|}

Used for routing Falcon's IRQs.

=== FALCON_SCRATCH0 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_SCRATCH1 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_ITFEN ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_ITFEN_CTXEN
|-
| 1
| FALCON_ITFEN_MTHDEN
|}

Used for enabling/disabling Falcon interfaces.

=== FALCON_IDLESTATE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IDLESTATE_FALCON_BUSY
|-
| 1-15
| FALCON_IDLESTATE_EXT_BUSY
|}

Used for detecting if Falcon is busy or not.

=== FALCON_DEBUGINFO ===
Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.

[6.0.0+] [[NV_services|nvservices]] sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.

=== FALCON_EXCI ===
Contains information about raised exceptions.

=== FALCON_CPUCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_CPUCTL_IINVAL
|-
| 1
| FALCON_CPUCTL_STARTCPU
|-
| 2
| FALCON_CPUCTL_SRESET
|-
| 3
| FALCON_CPUCTL_HRESET
|-
| 4
| FALCON_CPUCTL_HALTED
|-
| 5
| FALCON_CPUCTL_STOPPED
|-
| 6
| FALCON_CPUCTL_SCP_UNK
|}

Used for signaling the Falcon CPU.

=== FALCON_BOOTVEC ===
Takes the Falcon's boot vector address.

=== FALCON_HWCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-8
| FALCON_HWCFG_IMEM_SIZE
|-
| 9-17
| FALCON_HWCFG_DMEM_SIZE
|-
| 18-25
| FALCON_HWCFG_MTHD_SIZE
|-
| 26-31
| FALCON_HWCFG_DMATRF_SLOTS
|}

=== FALCON_DMACTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMACTL_REQUIRE_CTX
|-
| 1
| FALCON_DMACTL_DMEM_SCRUBBING
|-
| 2
| FALCON_DMACTL_IMEM_SCRUBBING
|-
| 3-6
| FALCON_DMACTL_DMAQ_NUM
|-
| 7
| FALCON_DMACTL_SECURE_STAT
|}

Used for configuring the Falcon's DMA engine.

=== FALCON_DMATRF_EXTBASE ===
Base of the external memory buffer.

The base of the transfer is calculated by adding [[#FALCON_DMATRF_POFF]] to the base.

=== FALCON_DMATRF_VOFF ===
For transfers to DMEM: the destination address.
For transfers to IMEM: the destination virtual IMEM page.

=== FALCON_DMATRF_POFF ===
For transfers to IMEM: the destination physical IMEM page.

=== FALCON_DMATRFCMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFCMD_FULL
|-
| 1
| FALCON_DMATRFCMD_IDLE
|-
| 2-3
| FALCON_DMATRFCMD_SEC
|-
| 4
| FALCON_DMATRFCMD_IMEM
|-
| 5
| FALCON_DMATRFCMD_WRITE
|-
| 8-10
| FALCON_DMATRFCMD_SIZE
|-
| 12-14
| FALCON_DMATRFCMD_CTXDMA
|}

Used for configuring DMA transfers.

=== FALCON_DMATRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFSTAT_PENDING
|-
| 16-18
| FALCON_DMATRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_DMATRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_CRYPTTRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| FALCON_CRYPTTRFSTAT_PENDING
|-
| 5
| FALCON_CRYPTTRFSTAT_ENABLED
|-
| 16-18
| FALCON_CRYPTTRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_CRYPTTRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_HWCFG2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_HWCFG2_VERSION
|-
| 4-5
| FALCON_HWCFG2_SCP_MODE
|-
| 6-7
| FALCON_HWCFG2_SUBVERSION
|-
| 8-11
| FALCON_HWCFG2_IMEM_PORTS
|-
| 12-15
| FALCON_HWCFG2_DMEM_PORTS
|-
| 16-19
| FALCON_HWCFG2_VM_PAGES_LOG2
|}

=== FALCON_ICD_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_ICD_CMD_OPC
0x0: BREAK
0x1: CONTINUE_FROM_PC
0x2: CONTINUE_FROM_ADDR
0x3: CONTINUE_UNK1_FROM_PC
0x4: CONTINUE_UNK1_FROM_ADDR
0x5: SINGLE_STEP_FROM_PC
0x6: SINGLE_STEP_FROM_ADDR
0x7: SET_BREAK_MASK
0x8: REG_READ
0x9: REG_WRITE
0xA: DATA_READ
0xB: DATA_WRITE
0xC: IO_READ
0xD: IO_WRITE
0xE: STATUS_READ
|-
| 6-7
| FALCON_ICD_CMD_DATA_SIZE
|-
| 8-12
| FALCON_ICD_CMD_IDX
|-
| 14
| FALCON_ICD_CMD_ERROR
|-
| 15
| FALCON_ICD_CMD_DONE
|-
| 16-31
| FALCON_ICD_CMD_BREAK_MASK
|}

=== FALCON_SCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| FALCON_SCTL_SEC_MODE
0: Non-secure
1: Light Secure
2: Heavy Secure
|}

=== TSEC_SCP_CTL_ACCESS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| Enable TSEC_SCP_INSN_STAT register
|}

=== TSEC_SCP_CTL_TRNG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 11
| Unknown
|-
| 12
| Enable the TRNG
|}

=== TSEC_SCP_CTL_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| TSEC_SCP_CTL_STAT_DEBUG_MODE
|}

=== TSEC_SCP_CTL_MODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Disable reads for the TRNG register block
|-
| 1
| Disable reads for the TFBIF register block
|-
| 2
| Disable reads for the DMA register block
|-
| 3
| Disable reads for the TEGRA register block
|-
| 4
| Disable writes for the TRNG register block
|-
| 5
| Disable writes for the TFBIF register block
|-
| 6
| Disable writes for the DMA register block
|-
| 7
| Disable writes for the TEGRA register block
|}

Controls accesses to the other sub-engines and can only be cleared in Heavy Secure mode.

=== TSEC_SCP_CTL_PKEY ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
|-
| 1
| TSEC_SCP_CTL_PKEY_LOADED
|}

=== TSEC_SCP_SEQ0_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 8-11
| Size of current cs0begin macro
|-
|}

=== TSEC_SCP_SEQ_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Set if crypto sequence recording (cs0begin/cs1begin) is active
|-
| 4-7
| Number of instructions left for the crypto sequence
|-
| 12-15
| Active crypto key register
|}

Contains information on the last crypto sequence (cs0 or cs1) executed.

=== TSEC_SCP_INSN_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| Crypto fuc5 destination register or immediate value
|-
| 8-15
| Crypto fuc5 source register or immediate value
|-
| 20-24
| Crypto fuc5 operation
0x0: none (fuc5 opcode 0x00)
0x1: cmov (fuc5 opcode 0x84)
0x2: cxsin (fuc5 opcode 0x88) or xdst (with cxset)
0x3: cxsout (fuc5 opcode 0x8C) or xdld (with cxset)
0x4: crng (fuc5 opcode 0x90)
0x5: cs0begin (fuc5 opcode 0x94)
0x6: cs0exec (fuc5 opcode 0x98)
0x7: cs1begin (fuc5 opcode 0x9C)
0x8: cs1exec (fuc5 opcode 0xA0)
0x9: invalid (fuc5 opcode 0xA4)
0xA: cchmod (fuc5 opcode 0xA8)
0xB: cxor (fuc5 opcode 0xAC)
0xC: cadd (fuc5 opcode 0xB0)
0xD: cand (fuc5 opcode 0xB4)
0xE: crev (fuc5 opcode 0xB8)
0xF: cprecmac (fuc5 opcode 0xBC)
0x10: csecret (fuc5 opcode 0xC0)
0x11: ckeyreg (fuc5 opcode 0xC4)
0x12: ckexp (fuc5 opcode 0xC8)
0x13: ckrexp (fuc5 opcode 0xCC)
0x14: cenc (fuc5 opcode 0xD0)
0x15: cdec (fuc5 opcode 0xD4)
0x16: csigauth (fuc5 opcode 0xD8)
0x17: csigenc (fuc5 opcode 0xDC)
0x18: csigclr (fuc5 opcode 0xE0)
|-
| 31
| Set if running in secure mode (cauth)
|}

Contains information on the last crypto instruction executed.

=== TSEC_SCP_AES_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-4
| First opcode
|-
| 5-9
| Second opcode
|-
| 15-16
| AES operation
0: Encryption
1: Decryption
2: Key expansion
3: Key reverse expansion
|}

Contains information on the last AES sequence executed.

=== TSEC_SCP_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQSTAT_TRNG
|-
| 8
| TSEC_SCP_IRQSTAT_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQSTAT_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQSTAT_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the status of crypto IRQs.

=== TSEC_SCP_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQMASK_TRNG
|-
| 8
| TSEC_SCP_IRQMASK_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQMASK_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQMASK_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the value of the mask for crypto IRQs.

=== TSEC_SCP_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Invalid instruction
|-
| 4
| Empty crypto sequence
|-
| 8
| Crypto sequence is too long
|-
| 12
| Crypto sequence was not finished
|-
| 16
| Invalid cauth signature (during csigenc, csigclr or csigunk)
|-
| 24
| Forbidden instruction
|}

Contains information on crypto errors generated by the [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT_INSN_ERROR]] IRQ.

=== TSEC_TFBIF_MCCIF_FIFOCTRL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
|-
| 1
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
|-
| 2
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
|-
| 3
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
|-
| 4
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
|-
| 5
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
|-
| 6
| TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
|-
| 7
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
|-
| 8
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE
|}

=== TSEC_MCCIF_FIFOCTRL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
|-
| 16-31
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT
|}

=== TSEC_TFBIF_UNK5 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.

=== TSEC_TFBIF_UNK6 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to (data_size << 4) before reading memory from the GPU UCODE carveout.

=== TSEC_DMA_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_DMA_CMD_READ
|-
| 1
| TSEC_DMA_CMD_WRITE
|-
| 4-7
| TSEC_DMA_CMD_UNK
|-
| 12
| TSEC_DMA_CMD_BUSY
|-
| 13
| TSEC_DMA_CMD_ERROR
|-
| 31
| TSEC_DMA_CMD_INIT
|}

A DMA read/write operation requires bits TSEC_DMA_CMD_INIT and TSEC_DMA_CMD_READ/TSEC_DMA_CMD_WRITE to be set in TSEC_DMA_CMD.

During the transfer, the TSEC_DMA_CMD_BUSY bit is set.

Accessing an invalid address causes bit TSEC_DMA_CMD_ERROR to be set.

=== TSEC_DMA_ADDR ===
Takes the address for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_VAL ===
Takes the value for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_UNK ===
Always 0xFFF.

=== TSEC_TEGRA_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 16
| TSEC_TEGRA_CTL_TKFI_KFUSE
|-
| 17
| TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
|-
| 24
| TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
|-
| 25
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
|-
| 26
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
|-
| 27
| TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C
|}

== Authenticated Mode ==
===== Entry =====
From non-secure mode, upon jumping to a page marked as secret, a secret fault occurs. This causes the CPU to verify the region specified in $cauth against the MAC loaded in $c6. If the comparison is successful, the valid bit (bit0) is set on all pages in the $cauth region, and $pc is set to the base of the $cauth region. If the comparsion fails, the CPU is halted.

===== Exit =====
The CPU automatically goes back to non-secure mode when returning back into non-secret pages. When this happens, the valid bit (bit0) in the TLB flags is cleared for all secret pages.

===== Implementation =====
Under certain circumstances, it is possible to observe [[#csigauth|csigauth]] being briefly written to [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]] as "csigauth $c4 $c6" while the opcodes in [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]] are set to "cxsin" and "csigauth", respectively.

Via [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]] it can be observed that a 3-sized macro sequence is loaded into cs0 during a secure mode transition.

== Crypto processing ==
Part of the information here (which hasn't made it into envytools documentation yet) was shared by [https://wiki.0x04.net/wiki/Marcin_Ko%C5%9Bcielnicki mwk] from reverse engineering falcon processors over the years.

=== cauth ===
$cauth is a special purpose register in the CPU.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7 || Start of region to authenticate (in 0x100 pages)
|-
| 8-15 || Unused
|-
| 16 || Use secret xfers (?)
|-
| 17 || Region is signed and encrypted and double the size (?)
|-
| 18 ||
|-
| 19 ||
|-
| 20-23 || Unused
|-
| 31-24 || Size of region to authenticate (in 0x100 pages)
|}

== SCP operations ==

{| class="wikitable" border="1"
! Opcode
! Name
! Operand0
! Operand1
! Operation
! Condition
|-
| 0 || nop || || || ||
|-
| 1 || mov || $cX || $cY || <code>$cX = $cY; ACL(X) = ACL(Y);</code> ||
|-
| 2 || sin || $cX || N/A || <code>$cX = read_stream(); ACL(X) = ???;</code> ||
|-
| 3 || sout || $cX || N/A || <code>write_stream($cX);</code> || ?
|-
| 4 || rnd || $cX || N/A || <code>$cX = read_trng(); ACL(X) = ???;</code> ||
|-
| 5 || s0begin || immX || N/A || <code>record_macro_for_N_instructions(0, immX);</code> ||
|-
| 6 || s0exec || immX || N/A || <code>execute_macro_N_times(0, immX);</code> ||
|-
| 7 || s1begin || immX || N/A || <code>record_macro_for_N_instructions(1, immX);</code> ||
|-
| 8 || s1exec || immX || N/A || <code>execute_macro_N_times(1, immX);</code> ||
|-
| 9 || <invalid> || || || ||
|-
| 0xA || chmod || $cX || immY || <code>if (immY & 3) ACL(X) = (ACL(X) & immY) | 1; else ACL(X) = 0;</code> ||
|-
| 0xB || xor || $cX || $cY || <code>$cX ^= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xC || add || $cX || immY || <code>$cX += immY;</code> || <code>(ACL(X) & 2)</code>
|-
| 0xD || and || $cX || $cY || <code>$cX &= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xE || rev || $cX || $cY || <code>$cX = endian_swap128($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0xF || gfmul || $cX || $cY || <code>$cX = gfmul($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 2)</code>
|-
| 0x10 || secret || $cX || immY || <code>$cX = load_secret(immY); ACL(X) = load_secret_acl(immY);</code> ||
|-
| 0x11 || keyreg || immX || || <code>active_key_idx = immX;</code> ||
|-
| 0x12 || kexp || $cX || $cY || <code>$cX = aes_kexp($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0x13 || krexp || $cX || $cY || <code>$cX = aes_kexp_reverse($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0x14 || enc || $cX || $cY || <code>$cX = aes_enc(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 1) && (ACL(Y) & 2)</code>
|-
| 0x15 || dec || $cX || $cY || <code>$cX = aes_dec(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 1) && (ACL(Y) & 2)</code>
|-
| 0x16 || csigauth || $cX || $cY || <code>if (hash_verify($cX, $cY)) { has_sig = true; current_sig = $cX; }</code> || ?
|-
| 0x17 || csigclr || || || <code>has_sig = false;</code> ||
|-
| 0x18 || csigenc || $cX || $cY || <code>if (has_sig) $cX = aes_enc(current_sig, $cY);</code> || ?
|}

=== ACL ===
{| class="wikitable" border="1"
! Bit
! Meaning
|-
| 0 || Readable as key. This is forced set if bit1 is set, the only way to clear it is to clear *both* bit0 and bit1.
|-
| 1 || Readable
|}

==== Initial values ====
On SCP boot, the ACL is 0x1F for all $cX.

Loading into $cX using xdst instruction sets ACL($cX) to 0x1F.

Spilling a $cX to DMEM using xdld instruction is allowed if (ACL($cX) & 2).

=== csigauth ===
<code>00000000: f5 3c XY d8 csigauth $cY $cX</code>

This instruction takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret.

=== csigclr ===
<code>00000000: f5 3c 00 e0 csigclr</code>

This instruction takes no operands and appears to clear the saved cauth signature used by the csigenc instruction.

=== cchmod ===
<code>00000000: f5 3c XY a8 cchmod $cY 0X</code> or <code>00000000: f5 3c XY a9 cchmod $cY 1X</code>

This instruction takes a crypto register and a 5 bit immediate value. It appears to set the [[#Register ACLs|crypto registers' ACL]] bits as follows:
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Allow register to be used as key in NS or LS mode
|-
| 1
| Allow register to be used as key in HS mode
|-
| 2
| Set register as readable in NS or LS mode
|-
| 3
| Set register as readable in HS mode
|-
| 4
| Set register as writable in NS or LS mode
|}

=== crng ===
<code>00000000: f5 3c 0X 90 crng $cX</code>

This instruction initializes a crypto register with random data.

Executing this instruction only succeeds if the TRNG is enabled for the SCP, which requires taking the following steps:
* Write 0x7FFF to TSEC_TRNG_CLKDIV.
* Write 0x3FF0000 to TSEC_TRNG_UNK0.
* Write 0xFF00 to TSEC_TRNG_UNK7.
* Write 0x1000 to [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]].

Otherwise it hangs forever.

=== cxset ===
cxset instruction provides a way to change behavior of a variable amount of successively executed DMA-related instructions.

for example: <code>000000de: f4 3c 02 cxset 0x2</code>

can be read as: <code>dma_override(type=crypto_reg, count=2)</code>

The argument to cxset specifies the type of behavior change in the top 3 bits, and the number of DMA-related instructions the effect lasts for in the lower 5 bits.

{| class=wikitable
! Bits || Description
|-
| 0-4 || Number of instructions it is valid for (0x1f is a special value meaning infinitely many instructions -- until overriden by another cxset)
|-
| 5 || Crypto destination/source select (0=crypto register, 1=crypto stream)
|-
| 6 || External memory override (0=Disabled, 1=Enabled)
|-
| 7 || Internal memory select (0=DMEM, 1=IMEM)
|}

==== DMA-Related Instructions ====
At least the following instructions may have changed behavior, and count against the cxset "count" argument: <code>xdwait</code>, <code>xdst</code>, <code>xdld</code>.

For example, if override type=0b000, then the "length" argument to <code>xdst</code> is instead treated as the index of the target $cX register.

=== Secrets ===
Falcon's Authenticated Mode has access to 64 128-bit keys which are burned at factory. These keys can be loaded by using the $csecret instruction which takes the target crypto register and the key index as arguments.

{| class=wikitable
! Index || Notes || Console-unique
|-
| 0x00 || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares. || No
|-
| 0x01 || Used by nvhost_nvdec_bl020_prod firmware. ||
|-
| 0x03 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x04 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x05 || Used by nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares. ||
|-
| 0x07 || Used by [6.0.0+] nvhost_tsec firmware. ||
|-
| 0x09 || Used by nvhost_tsec firmware. ||
|-
| 0x0B || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x0F || Used by nvhost_tsec firmware. ||
|-
| 0x10 || Used by [1.0.0-5.1.0] nvhost_tsec firmware. ||
|-
| 0x15 || Used by nvhost_nvdec_bl020_prod, [5.0.0+] nvhost_nvdec020_prod, [5.0.0+] nvhost_nvdec020_ns and [6.0.0+] nvhost_tsec firmwares. ||
|-
| 0x26 || Used by [[TSEC_Firmware#KeygenLdr|KeygenLdr]]. || No
|-
| 0x3C || Used by nvhost_tsec firmware. ||
|-
| 0x3F || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. || Yes
|}

TSEC

2019-01-08T16:59:23Z

Qlutoo:

TSEC (Tegra Security Co-processor) is a dedicated unit powered by a NVIDIA Falcon microprocessor with crypto extensions.

= Driver =
A host driver for communicating with the TSEC is mapped to physical address 0x54500000 with a total size of 0x40000 bytes and exposes several registers.

== Registers ==
Registers from 0x54500000 to 0x54501000 are used to configure the host interface (HOST1X).

Registers from 0x54501000 to 0x54502000 are a MMIO window for communicating with the Falcon microprocessor. From this range, the subset of registers from 0x54501400 to 0x54501FE8 are specific to the TSEC and are subdivided into:
* 0x54501400 to 0x54501500: SCP (Secure Crypto Processor?).
* 0x54501500 to 0x54501600: TRNG (True Random Number Generator).
* 0x54501600 to 0x54501700: TFBIF (Tegra Framebuffer Interface).
* 0x54501700 to 0x54501800: DMA.
* 0x54501800 to 0x54501900: TEGRA (miscellaneous interfaces).

{| class="wikitable" border="1"
! Name
! Address
! Width
|-
| TSEC_THI_INCR_SYNCPT
| 0x54500000
| 0x04
|-
| TSEC_THI_INCR_SYNCPT_ERR
| 0x54500008
| 0x04
|-
| TSEC_THI_CTXSW_INCR_SYNCPT
| 0x5450000C
| 0x04
|-
| TSEC_THI_CTXSW
| 0x54500020
| 0x04
|-
| TSEC_THI_CONT_SYNCPT_EOF
| 0x54500028
| 0x04
|-
| [[#TSEC_THI_METHOD0|TSEC_THI_METHOD0]]
| 0x54500040
| 0x04
|-
| [[#TSEC_THI_METHOD1|TSEC_THI_METHOD1]]
| 0x54500044
| 0x04
|-
| [[#TSEC_THI_INT_STATUS|TSEC_THI_INT_STATUS]]
| 0x54500078
| 0x04
|-
| [[#TSEC_THI_INT_MASK|TSEC_THI_INT_MASK]]
| 0x5450007C
| 0x04
|-
| TSEC_THI_SLCG_STATUS
| 0x54500084
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_HIGH_A
| 0x54500088
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_LOW_A
| 0x5450008C
| 0x04
|-
| TSEC_THI_CLK_OVERRIDE
| 0x54500E00
| 0x04
|-
| [[#FALCON_IRQSSET|FALCON_IRQSSET]]
| 0x54501000
| 0x04
|-
| [[#FALCON_IRQSCLR|FALCON_IRQSCLR]]
| 0x54501004
| 0x04
|-
| [[#FALCON_IRQSTAT|FALCON_IRQSTAT]]
| 0x54501008
| 0x04
|-
| [[#FALCON_IRQMODE|FALCON_IRQMODE]]
| 0x5450100C
| 0x04
|-
| [[#FALCON_IRQMSET|FALCON_IRQMSET]]
| 0x54501010
| 0x04
|-
| [[#FALCON_IRQMCLR|FALCON_IRQMCLR]]
| 0x54501014
| 0x04
|-
| [[#FALCON_IRQMASK|FALCON_IRQMASK]]
| 0x54501018
| 0x04
|-
| [[#FALCON_IRQDEST|FALCON_IRQDEST]]
| 0x5450101C
| 0x04
|-
| FALCON_GPTMR_PERIOD
| 0x54501020
| 0x04
|-
| FALCON_GPTMR_TIME
| 0x54501024
| 0x04
|-
| FALCON_GPTMR_ENABLE
| 0x54501028
| 0x04
|-
| FALCON_TIME_LOW
| 0x5450102C
| 0x04
|-
| FALCON_TIME_HIGH
| 0x54501030
| 0x04
|-
| FALCON_WDTMR_TIME
| 0x54501034
| 0x04
|-
| FALCON_WDTMR_ENABLE
| 0x54501038
| 0x04
|-
| [[#FALCON_SCRATCH0|FALCON_SCRATCH0]]
| 0x54501040
| 0x04
|-
| [[#FALCON_SCRATCH1|FALCON_SCRATCH1]]
| 0x54501044
| 0x04
|-
| [[#FALCON_ITFEN|FALCON_ITFEN]]
| 0x54501048
| 0x04
|-
| [[#FALCON_IDLESTATE|FALCON_IDLESTATE]]
| 0x5450104C
| 0x04
|-
| FALCON_CURCTX
| 0x54501050
| 0x04
|-
| FALCON_NXTCTX
| 0x54501054
| 0x04
|-
| FALCON_CMDCTX
| 0x54501058
| 0x04
|-
| FALCON_STATUS_MASK
| 0x5450105C
| 0x04
|-
| FALCON_VM_SUPERVISOR
| 0x54501060
| 0x04
|-
| FALCON_MTHD_DATA
| 0x54501064
| 0x04
|-
| FALCON_MTHD_CMD
| 0x54501068
| 0x04
|-
| FALCON_MTHD_DATA_WR
| 0x5450106C
| 0x04
|-
| FALCON_MTHD_OCCUPIED
| 0x54501070
| 0x04
|-
| FALCON_MTHD_ACK
| 0x54501074
| 0x04
|-
| FALCON_MTHD_LIMIT
| 0x54501078
| 0x04
|-
| FALCON_SUBENGINE_RESET
| 0x5450107C
| 0x04
|-
| FALCON_SCRATCH2
| 0x54501080
| 0x04
|-
| FALCON_SCRATCH3
| 0x54501084
| 0x04
|-
| FALCON_PM_TRIGGER
| 0x54501088
| 0x04
|-
| FALCON_PM_MODE
| 0x5450108C
| 0x04
|-
| FALCON_DEBUG1
| 0x54501090
| 0x04
|-
| [[#FALCON_DEBUGINFO|FALCON_DEBUGINFO]]
| 0x54501094
| 0x04
|-
| FALCON_BREAKPOINT0
| 0x54501098
| 0x04
|-
| FALCON_BREAKPOINT1
| 0x5450109C
| 0x04
|-
| FALCON_CGCTL
| 0x545010A0
| 0x04
|-
| FALCON_ENGCTL
| 0x545010A4
| 0x04
|-
| FALCON_PM_SEL
| 0x545010A8
| 0x04
|-
| FALCON_HOST_IO_INDEX
| 0x545010AC
| 0x04
|-
| [[#FALCON_EXCI|FALCON_EXCI]]
| 0x545010D0
| 0x04
|-
| [[#FALCON_CPUCTL|FALCON_CPUCTL]]
| 0x54501100
| 0x04
|-
| [[#FALCON_BOOTVEC|FALCON_BOOTVEC]]
| 0x54501104
| 0x04
|-
| [[#FALCON_HWCFG|FALCON_HWCFG]]
| 0x54501108
| 0x04
|-
| [[#FALCON_DMACTL|FALCON_DMACTL]]
| 0x5450110C
| 0x04
|-
| [[#FALCON_DMATRF_EXTBASE|FALCON_DMATRF_EXTBASE]]
| 0x54501110
| 0x04
|-
| [[#FALCON_DMATRF_VOFF|FALCON_DMATRF_VOFF]]
| 0x54501114
| 0x04
|-
| [[#FALCON_DMATRFCMD|FALCON_DMATRFCMD]]
| 0x54501118
| 0x04
|-
| [[#FALCON_DMATRF_POFF|FALCON_DMATRF_POFF]]
| 0x5450111C
| 0x04
|-
| [[#FALCON_DMATRFSTAT|FALCON_DMATRFSTAT]]
| 0x54501120
| 0x04
|-
| [[#FALCON_CRYPTTRFSTAT|FALCON_CRYPTTRFSTAT]]
| 0x54501124
| 0x04
|-
| FALCON_CPUSTAT
| 0x54501128
| 0x04
|-
| [[#FALCON_HWCFG2|FALCON_HWCFG2]]
| 0x5450112C
| 0x04
|-
| FALCON_CPUCTL_ALIAS
| 0x54501130
| 0x04
|-
| FALCON_TLB_CMD
| 0x54501140
| 0x04
|-
| FALCON_TLB_CMD_RES
| 0x54501144
| 0x04
|-
| FALCON_BRANCH_HISTORY_CTRL
| 0x54501148
| 0x04
|-
| FALCON_BRANCH_HISTORY_PC
| 0x5450114C
| 0x04
|-
| FALCON_IMFILLRNG0
| 0x54501150
| 0x04
|-
| FALCON_IMFILLRNG1
| 0x54501154
| 0x04
|-
| FALCON_IMFILLCTL
| 0x54501158
| 0x04
|-
| FALCON_EXTERRWIN
| 0x54501160
| 0x04
|-
| FALCON_EXTERRCFG
| 0x54501164
| 0x04
|-
| FALCON_EXTERRADDR
| 0x54501168
| 0x04
|-
| FALCON_EXTERRSTAT
| 0x5450116C
| 0x04
|-
| FALCON_CG2
| 0x5450117C
| 0x04
|-
| FALCON_CODE_INDEX
| 0x54501180
| 0x04
|-
| FALCON_CODE
| 0x54501184
| 0x04
|-
| FALCON_CODE_VIRT_ADDR
| 0x54501188
| 0x04
|-
| FALCON_DATA_INDEX0
| 0x545011C0
| 0x04
|-
| FALCON_DATA0
| 0x545011C4
| 0x04
|-
| FALCON_DATA_INDEX1
| 0x545011C8
| 0x04
|-
| FALCON_DATA1
| 0x545011CC
| 0x04
|-
| FALCON_DATA_INDEX2
| 0x545011D0
| 0x04
|-
| FALCON_DATA2
| 0x545011D4
| 0x04
|-
| FALCON_DATA_INDEX3
| 0x545011D8
| 0x04
|-
| FALCON_DATA3
| 0x545011DC
| 0x04
|-
| FALCON_DATA_INDEX4
| 0x545011E0
| 0x04
|-
| FALCON_DATA4
| 0x545011E4
| 0x04
|-
| FALCON_DATA_INDEX5
| 0x545011E8
| 0x04
|-
| FALCON_DATA5
| 0x545011EC
| 0x04
|-
| FALCON_DATA_INDEX6
| 0x545011F0
| 0x04
|-
| FALCON_DATA6
| 0x545011F4
| 0x04
|-
| FALCON_DATA_INDEX7
| 0x545011F8
| 0x04
|-
| FALCON_DATA7
| 0x545011FC
| 0x04
|-
| [[#FALCON_ICD_CMD|FALCON_ICD_CMD]]
| 0x54501200
| 0x04
|-
| FALCON_ICD_ADDR
| 0x54501204
| 0x04
|-
| FALCON_ICD_WDATA
| 0x54501208
| 0x04
|-
| FALCON_ICD_RDATA
| 0x5450120C
| 0x04
|-
| [[#FALCON_SCTL|FALCON_SCTL]]
| 0x54501240
| 0x04
|-
| [[#TSEC_SCP_CTL_ACCESS|TSEC_SCP_CTL_ACCESS]]
| 0x54501400
| 0x04
|-
| [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]]
| 0x54501404
| 0x04
|-
| [[#TSEC_SCP_CTL_STAT|TSEC_SCP_CTL_STAT]]
| 0x54501408
| 0x04
|-
| [[#TSEC_SCP_CTL_MODE|TSEC_SCP_CTL_MODE]]
| 0x5450140C
| 0x04
|-
| TSEC_SCP_UNK0
| 0x54501410
| 0x04
|-
| [[#TSEC_SCP_CTL_PKEY|TSEC_SCP_CTL_PKEY]]
| 0x54501418
| 0x04
|-
| [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]]
| 0x54501420
| 0x04
|-
| [[#TSEC_SCP_SEQ_STAT|TSEC_SCP_SEQ_STAT]]
| 0x54501428
| 0x04
|-
| [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]]
| 0x54501430
| 0x04
|-
| TSEC_SCP_UNK2
| 0x54501454
| 0x04
|-
| [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]]
| 0x54501458
| 0x04
|-
| TSEC_SCP_UNK3
| 0x54501470
| 0x04
|-
| [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT]]
| 0x54501480
| 0x04
|-
| [[#TSEC_SCP_IRQMASK|TSEC_SCP_IRQMASK]]
| 0x54501484
| 0x04
|-
| TSEC_SCP_UNK4
| 0x54501490
| 0x04
|-
| [[#TSEC_SCP_ERR|TSEC_SCP_ERR]]
| 0x54501498
| 0x04
|-
| TSEC_TRNG_CLKDIV
| 0x54501500
| 0x04
|-
| TSEC_TRNG_UNK0
| 0x54501504
| 0x04
|-
| TSEC_TRNG_UNK1
| 0x5450150C
| 0x04
|-
| TSEC_TRNG_UNK2
| 0x54501510
| 0x04
|-
| TSEC_TRNG_UNK3
| 0x54501514
| 0x04
|-
| TSEC_TRNG_UNK4
| 0x54501518
| 0x04
|-
| TSEC_TRNG_UNK5
| 0x5450151C
| 0x04
|-
| TSEC_TRNG_UNK6
| 0x54501528
| 0x04
|-
| TSEC_TRNG_UNK7
| 0x5450152C
| 0x04
|-
| TSEC_TFBIF_UNK0
| 0x54501600
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL|TSEC_TFBIF_MCCIF_FIFOCTRL]]
| 0x54501604
| 0x04
|-
| TSEC_TFBIF_UNK1
| 0x54501608
| 0x04
|-
| TSEC_TFBIF_UNK2
| 0x5450160C
| 0x04
|-
| TSEC_TFBIF_UNK3
| 0x54501630
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL1|TSEC_TFBIF_MCCIF_FIFOCTRL1]]
| 0x54501634
| 0x04
|-
| TSEC_TFBIF_UNK4
| 0x54501640
| 0x04
|-
| [[#TSEC_TFBIF_UNK5|TSEC_TFBIF_UNK5]]
| 0x54501644
| 0x04
|-
| [[#TSEC_TFBIF_UNK6|TSEC_TFBIF_UNK6]]
| 0x54501648
| 0x04
|-
| [[#TSEC_DMA_CMD|TSEC_DMA_CMD]]
| 0x54501700
| 0x04
|-
| [[#TSEC_DMA_ADDR|TSEC_DMA_ADDR]]
| 0x54501704
| 0x04
|-
| [[#TSEC_DMA_VAL|TSEC_DMA_VAL]]
| 0x54501708
| 0x04
|-
| [[#TSEC_DMA_UNK|TSEC_DMA_UNK]]
| 0x5450170C
| 0x04
|-
| TSEC_TEGRA_FALCON_IP_VER
| 0x54501800
| 0x04
|-
| TSEC_TEGRA_UNK0
| 0x54501824
| 0x04
|-
| TSEC_TEGRA_UNK1
| 0x54501828
| 0x04
|-
| TSEC_TEGRA_UNK2
| 0x5450182C
| 0x04
|-
| [[#TSEC_TEGRA_CTL|TSEC_TEGRA_CTL]]
| 0x54501838
| 0x04
|}

=== TSEC_THI_METHOD0 ===
{| class="wikitable" border="1"
! ID
! Method
|-
| 0x200
| SET_APPLICATION_ID
|-
| 0x300
| EXECUTE
|-
| 0x500
| HDCP_INIT
|-
| 0x504
| HDCP_CREATE_SESSION
|-
| 0x508
| HDCP_VERIFY_CERT_RX
|-
| 0x50C
| HDCP_GENERATE_EKM
|-
| 0x510
| HDCP_REVOCATION_CHECK
|-
| 0x514
| HDCP_VERIFY_HPRIME
|-
| 0x518
| HDCP_ENCRYPT_PAIRING_INFO
|-
| 0x51C
| HDCP_DECRYPT_PAIRING_INFO
|-
| 0x520
| HDCP_UPDATE_SESSION
|-
| 0x524
| HDCP_GENERATE_LC_INIT
|-
| 0x528
| HDCP_VERIFY_LPRIME
|-
| 0x52C
| HDCP_GENERATE_SKE_INIT
|-
| 0x530
| HDCP_VERIFY_VPRIME
|-
| 0x534
| HDCP_ENCRYPTION_RUN_CTRL
|-
| 0x538
| HDCP_SESSION_CTRL
|-
| 0x53C
| HDCP_COMPUTE_SPRIME
|-
| 0x540
| HDCP_GET_CERT_RX
|-
| 0x544
| HDCP_EXCHANGE_INFO
|-
| 0x548
| HDCP_DECRYPT_KM
|-
| 0x54C
| HDCP_GET_HPRIME
|-
| 0x550
| HDCP_GENERATE_EKH_KM
|-
| 0x554
| HDCP_VERIFY_RTT_CHALLENGE
|-
| 0x558
| HDCP_GET_LPRIME
|-
| 0x55C
| HDCP_DECRYPT_KS
|-
| 0x560
| HDCP_DECRYPT
|-
| 0x564
| HDCP_GET_RRX
|-
| 0x568
| HDCP_DECRYPT_REENCRYPT
|-
| 0x56C
|
|-
| 0x570
|
|-
| 0x574
|
|-
| 0x578
|
|-
| 0x57C
|
|-
| 0x700
| HDCP_VALIDATE_SRM
|-
| 0x704
| HDCP_VALIDATE_STREAM
|-
| 0x708
| HDCP_TEST_SECURE_STATUS
|-
| 0x70C
| HDCP_SET_DCP_KPUB
|-
| 0x710
| HDCP_SET_RX_KPUB
|-
| 0x714
| HDCP_SET_CERT_RX
|-
| 0x718
| HDCP_SET_SCRATCH_BUFFER
|-
| 0x71C
| HDCP_SET_SRM
|-
| 0x720
| HDCP_SET_RECEIVER_ID_LIST
|-
| 0x724
| HDCP_SET_SPRIME
|-
| 0x728
| HDCP_SET_ENC_INPUT_BUFFER
|-
| 0x72C
| HDCP_SET_ENC_OUTPUT_BUFFER
|-
| 0x730
| HDCP_GET_RTT_CHALLENGE
|-
| 0x734
| HDCP_STREAM_MANAGE
|-
| 0x738
| HDCP_READ_CAPS
|-
| 0x73C
| HDCP_ENCRYPT
|-
| 0x740
| [6.0.0+] HDCP_GET_CURRENT_NONCE
|}

Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_METHOD1 ===
Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_INT_STATUS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_STATUS_FALCON_INT
|}

=== TSEC_THI_INT_MASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_MASK_FALCON_INT
|}

=== FALCON_IRQSSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSSET_GPTMR
|-
| 1
| FALCON_IRQSSET_WDTMR
|-
| 2
| FALCON_IRQSSET_MTHD
|-
| 3
| FALCON_IRQSSET_CTXSW
|-
| 4
| FALCON_IRQSSET_HALT
|-
| 5
| FALCON_IRQSSET_EXTERR
|-
| 6
| FALCON_IRQSSET_SWGEN0
|-
| 7
| FALCON_IRQSSET_SWGEN1
|-
| 8-15
| FALCON_IRQSSET_EXT
|}

Used for setting Falcon's IRQs.

=== FALCON_IRQSCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSCLR_GPTMR
|-
| 1
| FALCON_IRQSCLR_WDTMR
|-
| 2
| FALCON_IRQSCLR_MTHD
|-
| 3
| FALCON_IRQSCLR_CTXSW
|-
| 4
| FALCON_IRQSCLR_HALT
|-
| 5
| FALCON_IRQSCLR_EXTERR
|-
| 6
| FALCON_IRQSCLR_SWGEN0
|-
| 7
| FALCON_IRQSCLR_SWGEN1
|-
| 8-15
| FALCON_IRQSCLR_EXT
|}

Used for clearing Falcon's IRQs.

=== FALCON_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSTAT_GPTMR
|-
| 1
| FALCON_IRQSTAT_WDTMR
|-
| 2
| FALCON_IRQSTAT_MTHD
|-
| 3
| FALCON_IRQSTAT_CTXSW
|-
| 4
| FALCON_IRQSTAT_HALT
|-
| 5
| FALCON_IRQSTAT_EXTERR
|-
| 6
| FALCON_IRQSTAT_SWGEN0
|-
| 7
| FALCON_IRQSTAT_SWGEN1
|-
| 8-15
| FALCON_IRQSTAT_EXT
|}

Used for getting the status of Falcon's IRQs.

=== FALCON_IRQMODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMODE_GPTMR
|-
| 1
| FALCON_IRQMODE_WDTMR
|-
| 2
| FALCON_IRQMODE_MTHD
|-
| 3
| FALCON_IRQMODE_CTXSW
|-
| 4
| FALCON_IRQMODE_HALT
|-
| 5
| FALCON_IRQMODE_EXTERR
|-
| 6
| FALCON_IRQMODE_SWGEN0
|-
| 7
| FALCON_IRQMODE_SWGEN1
|-
| 8-15
| FALCON_IRQMODE_EXT
|}

Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.

=== FALCON_IRQMSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMSET_GPTMR
|-
| 1
| FALCON_IRQMSET_WDTMR
|-
| 2
| FALCON_IRQMSET_MTHD
|-
| 3
| FALCON_IRQMSET_CTXSW
|-
| 4
| FALCON_IRQMSET_HALT
|-
| 5
| FALCON_IRQMSET_EXTERR
|-
| 6
| FALCON_IRQMSET_SWGEN0
|-
| 7
| FALCON_IRQMSET_SWGEN1
|-
| 8-15
| FALCON_IRQMSET_EXT
|}

Used for setting the mask for Falcon's IRQs.

=== FALCON_IRQMCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMCLR_GPTMR
|-
| 1
| FALCON_IRQMCLR_WDTMR
|-
| 2
| FALCON_IRQMCLR_MTHD
|-
| 3
| FALCON_IRQMCLR_CTXSW
|-
| 4
| FALCON_IRQMCLR_HALT
|-
| 5
| FALCON_IRQMCLR_EXTERR
|-
| 6
| FALCON_IRQMCLR_SWGEN0
|-
| 7
| FALCON_IRQMCLR_SWGEN1
|-
| 8-15
| FALCON_IRQMCLR_EXT
|}

Used for clearing the mask for Falcon's IRQs.

=== FALCON_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMASK_GPTMR
|-
| 1
| FALCON_IRQMASK_WDTMR
|-
| 2
| FALCON_IRQMASK_MTHD
|-
| 3
| FALCON_IRQMASK_CTXSW
|-
| 4
| FALCON_IRQMASK_HALT
|-
| 5
| FALCON_IRQMASK_EXTERR
|-
| 6
| FALCON_IRQMASK_SWGEN0
|-
| 7
| FALCON_IRQMASK_SWGEN1
|-
| 8-15
| FALCON_IRQMASK_EXT
|}

Used for getting the value of the mask for Falcon's IRQs.

=== FALCON_IRQDEST ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQDEST_HOST_GPTMR
|-
| 1
| FALCON_IRQDEST_HOST_WDTMR
|-
| 2
| FALCON_IRQDEST_HOST_MTHD
|-
| 3
| FALCON_IRQDEST_HOST_CTXSW
|-
| 4
| FALCON_IRQDEST_HOST_HALT
|-
| 5
| FALCON_IRQDEST_HOST_EXTERR
|-
| 6
| FALCON_IRQDEST_HOST_SWGEN0
|-
| 7
| FALCON_IRQDEST_HOST_SWGEN1
|-
| 8-15
| FALCON_IRQDEST_HOST_EXT
|-
| 16
| FALCON_IRQDEST_TARGET_GPTMR
|-
| 17
| FALCON_IRQDEST_TARGET_WDTMR
|-
| 18
| FALCON_IRQDEST_TARGET_MTHD
|-
| 19
| FALCON_IRQDEST_TARGET_CTXSW
|-
| 20
| FALCON_IRQDEST_TARGET_HALT
|-
| 21
| FALCON_IRQDEST_TARGET_EXTERR
|-
| 22
| FALCON_IRQDEST_TARGET_SWGEN0
|-
| 23
| FALCON_IRQDEST_TARGET_SWGEN1
|-
| 24-31
| FALCON_IRQDEST_TARGET_EXT
|}

Used for routing Falcon's IRQs.

=== FALCON_SCRATCH0 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_SCRATCH1 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_ITFEN ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_ITFEN_CTXEN
|-
| 1
| FALCON_ITFEN_MTHDEN
|}

Used for enabling/disabling Falcon interfaces.

=== FALCON_IDLESTATE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IDLESTATE_FALCON_BUSY
|-
| 1-15
| FALCON_IDLESTATE_EXT_BUSY
|}

Used for detecting if Falcon is busy or not.

=== FALCON_DEBUGINFO ===
Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.

[6.0.0+] [[NV_services|nvservices]] sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.

=== FALCON_EXCI ===
Contains information about raised exceptions.

=== FALCON_CPUCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_CPUCTL_IINVAL
|-
| 1
| FALCON_CPUCTL_STARTCPU
|-
| 2
| FALCON_CPUCTL_SRESET
|-
| 3
| FALCON_CPUCTL_HRESET
|-
| 4
| FALCON_CPUCTL_HALTED
|-
| 5
| FALCON_CPUCTL_STOPPED
|-
| 6
| FALCON_CPUCTL_SCP_UNK
|}

Used for signaling the Falcon CPU.

=== FALCON_BOOTVEC ===
Takes the Falcon's boot vector address.

=== FALCON_HWCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-8
| FALCON_HWCFG_IMEM_SIZE
|-
| 9-17
| FALCON_HWCFG_DMEM_SIZE
|-
| 18-25
| FALCON_HWCFG_MTHD_SIZE
|-
| 26-31
| FALCON_HWCFG_DMATRF_SLOTS
|}

=== FALCON_DMACTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMACTL_REQUIRE_CTX
|-
| 1
| FALCON_DMACTL_DMEM_SCRUBBING
|-
| 2
| FALCON_DMACTL_IMEM_SCRUBBING
|-
| 3-6
| FALCON_DMACTL_DMAQ_NUM
|-
| 7
| FALCON_DMACTL_SECURE_STAT
|}

Used for configuring the Falcon's DMA engine.

=== FALCON_DMATRF_EXTBASE ===
Base of the external memory buffer.

The base of the transfer is calculated by adding [[#FALCON_DMATRF_POFF]] to the base.

=== FALCON_DMATRF_VOFF ===
For transfers to DMEM: the destination address.
For transfers to IMEM: the destination virtual IMEM page.

=== FALCON_DMATRF_POFF ===
For transfers to IMEM: the destination physical IMEM page.

=== FALCON_DMATRFCMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFCMD_FULL
|-
| 1
| FALCON_DMATRFCMD_IDLE
|-
| 2-3
| FALCON_DMATRFCMD_SEC
|-
| 4
| FALCON_DMATRFCMD_IMEM
|-
| 5
| FALCON_DMATRFCMD_WRITE
|-
| 8-10
| FALCON_DMATRFCMD_SIZE
|-
| 12-14
| FALCON_DMATRFCMD_CTXDMA
|}

Used for configuring DMA transfers.

=== FALCON_DMATRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFSTAT_PENDING
|-
| 16-18
| FALCON_DMATRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_DMATRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_CRYPTTRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| FALCON_CRYPTTRFSTAT_PENDING
|-
| 5
| FALCON_CRYPTTRFSTAT_ENABLED
|-
| 16-18
| FALCON_CRYPTTRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_CRYPTTRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_HWCFG2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_HWCFG2_VERSION
|-
| 4-5
| FALCON_HWCFG2_SCP_MODE
|-
| 6-7
| FALCON_HWCFG2_SUBVERSION
|-
| 8-11
| FALCON_HWCFG2_IMEM_PORTS
|-
| 12-15
| FALCON_HWCFG2_DMEM_PORTS
|-
| 16-19
| FALCON_HWCFG2_VM_PAGES_LOG2
|}

=== FALCON_ICD_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_ICD_CMD_OPC
0x0: BREAK
0x1: CONTINUE_FROM_PC
0x2: CONTINUE_FROM_ADDR
0x3: CONTINUE_UNK1_FROM_PC
0x4: CONTINUE_UNK1_FROM_ADDR
0x5: SINGLE_STEP_FROM_PC
0x6: SINGLE_STEP_FROM_ADDR
0x7: SET_BREAK_MASK
0x8: REG_READ
0x9: REG_WRITE
0xA: DATA_READ
0xB: DATA_WRITE
0xC: IO_READ
0xD: IO_WRITE
0xE: STATUS_READ
|-
| 6-7
| FALCON_ICD_CMD_DATA_SIZE
|-
| 8-12
| FALCON_ICD_CMD_IDX
|-
| 14
| FALCON_ICD_CMD_ERROR
|-
| 15
| FALCON_ICD_CMD_DONE
|-
| 16-31
| FALCON_ICD_CMD_BREAK_MASK
|}

=== FALCON_SCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| FALCON_SCTL_SEC_MODE
0: Non-secure
1: Light Secure
2: Heavy Secure
|}

=== TSEC_SCP_CTL_ACCESS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| Enable TSEC_SCP_INSN_STAT register
|}

=== TSEC_SCP_CTL_TRNG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 11
| Unknown
|-
| 12
| Enable the TRNG
|}

=== TSEC_SCP_CTL_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| TSEC_SCP_CTL_STAT_DEBUG_MODE
|}

=== TSEC_SCP_CTL_MODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Disable reads for the TRNG register block
|-
| 1
| Disable reads for the TFBIF register block
|-
| 2
| Disable reads for the DMA register block
|-
| 3
| Disable reads for the TEGRA register block
|-
| 4
| Disable writes for the TRNG register block
|-
| 5
| Disable writes for the TFBIF register block
|-
| 6
| Disable writes for the DMA register block
|-
| 7
| Disable writes for the TEGRA register block
|}

Controls accesses to the other sub-engines and can only be cleared in Heavy Secure mode.

=== TSEC_SCP_CTL_PKEY ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
|-
| 1
| TSEC_SCP_CTL_PKEY_LOADED
|}

=== TSEC_SCP_SEQ0_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 8-11
| Size of current cs0begin macro
|-
|}

=== TSEC_SCP_SEQ_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Set if crypto sequence recording (cs0begin/cs1begin) is active
|-
| 4-7
| Number of instructions left for the crypto sequence
|-
| 12-15
| Active crypto key register
|}

Contains information on the last crypto sequence (cs0 or cs1) executed.

=== TSEC_SCP_INSN_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| Crypto fuc5 destination register or immediate value
|-
| 8-15
| Crypto fuc5 source register or immediate value
|-
| 20-24
| Crypto fuc5 operation
0x0: none (fuc5 opcode 0x00)
0x1: cmov (fuc5 opcode 0x84)
0x2: cxsin (fuc5 opcode 0x88) or xdst (with cxset)
0x3: cxsout (fuc5 opcode 0x8C) or xdld (with cxset)
0x4: crng (fuc5 opcode 0x90)
0x5: cs0begin (fuc5 opcode 0x94)
0x6: cs0exec (fuc5 opcode 0x98)
0x7: cs1begin (fuc5 opcode 0x9C)
0x8: cs1exec (fuc5 opcode 0xA0)
0x9: invalid (fuc5 opcode 0xA4)
0xA: cchmod (fuc5 opcode 0xA8)
0xB: cxor (fuc5 opcode 0xAC)
0xC: cadd (fuc5 opcode 0xB0)
0xD: cand (fuc5 opcode 0xB4)
0xE: crev (fuc5 opcode 0xB8)
0xF: cprecmac (fuc5 opcode 0xBC)
0x10: csecret (fuc5 opcode 0xC0)
0x11: ckeyreg (fuc5 opcode 0xC4)
0x12: ckexp (fuc5 opcode 0xC8)
0x13: ckrexp (fuc5 opcode 0xCC)
0x14: cenc (fuc5 opcode 0xD0)
0x15: cdec (fuc5 opcode 0xD4)
0x16: csigauth (fuc5 opcode 0xD8)
0x17: csigenc (fuc5 opcode 0xDC)
0x18: csigclr (fuc5 opcode 0xE0)
|-
| 31
| Set if running in secure mode (cauth)
|}

Contains information on the last crypto instruction executed.

=== TSEC_SCP_AES_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-4
| First opcode
|-
| 5-9
| Second opcode
|-
| 15-16
| AES operation
0: Encryption
1: Decryption
2: Key expansion
3: Key reverse expansion
|}

Contains information on the last AES sequence executed.

=== TSEC_SCP_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQSTAT_TRNG
|-
| 8
| TSEC_SCP_IRQSTAT_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQSTAT_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQSTAT_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the status of crypto IRQs.

=== TSEC_SCP_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQMASK_TRNG
|-
| 8
| TSEC_SCP_IRQMASK_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQMASK_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQMASK_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the value of the mask for crypto IRQs.

=== TSEC_SCP_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Invalid instruction
|-
| 4
| Empty crypto sequence
|-
| 8
| Crypto sequence is too long
|-
| 12
| Crypto sequence was not finished
|-
| 16
| Invalid cauth signature (during csigenc, csigclr or csigunk)
|-
| 24
| Forbidden instruction
|}

Contains information on crypto errors generated by the [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT_INSN_ERROR]] IRQ.

=== TSEC_TFBIF_MCCIF_FIFOCTRL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
|-
| 1
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
|-
| 2
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
|-
| 3
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
|-
| 4
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
|-
| 5
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
|-
| 6
| TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
|-
| 7
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
|-
| 8
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE
|}

=== TSEC_MCCIF_FIFOCTRL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
|-
| 16-31
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT
|}

=== TSEC_TFBIF_UNK5 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.

=== TSEC_TFBIF_UNK6 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to (data_size << 4) before reading memory from the GPU UCODE carveout.

=== TSEC_DMA_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_DMA_CMD_READ
|-
| 1
| TSEC_DMA_CMD_WRITE
|-
| 4-7
| TSEC_DMA_CMD_UNK
|-
| 12
| TSEC_DMA_CMD_BUSY
|-
| 13
| TSEC_DMA_CMD_ERROR
|-
| 31
| TSEC_DMA_CMD_INIT
|}

A DMA read/write operation requires bits TSEC_DMA_CMD_INIT and TSEC_DMA_CMD_READ/TSEC_DMA_CMD_WRITE to be set in TSEC_DMA_CMD.

During the transfer, the TSEC_DMA_CMD_BUSY bit is set.

Accessing an invalid address causes bit TSEC_DMA_CMD_ERROR to be set.

=== TSEC_DMA_ADDR ===
Takes the address for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_VAL ===
Takes the value for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_UNK ===
Always 0xFFF.

=== TSEC_TEGRA_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 16
| TSEC_TEGRA_CTL_TKFI_KFUSE
|-
| 17
| TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
|-
| 24
| TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
|-
| 25
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
|-
| 26
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
|-
| 27
| TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C
|}

== Authenticated Mode ==
===== Entry =====
From non-secure mode, upon jumping to a page marked as secret, a secret fault occurs. This causes the CPU to verify the region specified in $cauth against the MAC loaded in $c6. If the comparison is successful, the valid bit (bit0) is set on all pages in the $cauth region, and $pc is set to the base of the $cauth region. If the comparsion fails, the CPU is halted.

===== Exit =====
The CPU automatically goes back to non-secure mode when returning back into non-secret pages. When this happens, the valid bit (bit0) in the TLB flags is cleared for all secret pages.

===== Implementation =====
Under certain circumstances, it is possible to observe [[#csigauth|csigauth]] being briefly written to [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]] as "csigauth $c4 $c6" while the opcodes in [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]] are set to "cxsin" and "csigauth", respectively.

Via [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]] it can be observed that a 3-sized macro sequence is loaded into cs0 during a secure mode transition.

== Crypto processing ==
Part of the information here (which hasn't made it into envytools documentation yet) was shared by [https://wiki.0x04.net/wiki/Marcin_Ko%C5%9Bcielnicki mwk] from reverse engineering falcon processors over the years.

=== cauth ===
$cauth is a special purpose register in the CPU.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7 || Start of region to authenticate (in 0x100 pages)
|-
| 8-15 || Unused
|-
| 16 || Use secret xfers (?)
|-
| 17 || Region is signed and encrypted and double the size (?)
|-
| 18 ||
|-
| 19 ||
|-
| 20-23 || Unused
|-
| 31-24 || Size of region to authenticate (in 0x100 pages)
|}

== SCP operations ==

{| class="wikitable" border="1"
! Opcode
! Name
! Operand0
! Operand1
! Operation
! Condition
|-
| 0 || nop || || || ||
|-
| 1 || mov || $cX || $cY || <code>$cX = $cY; ACL(X) = ACL(Y);</code> ||
|-
| 2 || sin || $cX || N/A || <code>$cX = read_stream(); ACL(X) = ???;</code> ||
|-
| 3 || sout || $cX || N/A || <code>write_stream($cX);</code> || ?
|-
| 4 || rnd || $cX || N/A || <code>$cX = read_trng(); ACL(X) = ???;</code> ||
|-
| 5 || s0begin || immX || N/A || <code>record_macro_for_N_instructions(0, immX);</code> ||
|-
| 6 || s0exec || immX || N/A || <code>execute_macro_N_times(0, immX);</code> ||
|-
| 7 || s1begin || immX || N/A || <code>record_macro_for_N_instructions(1, immX);</code> ||
|-
| 8 || s1exec || immX || N/A || <code>execute_macro_N_times(1, immX);</code> ||
|-
| 9 || <invalid> || || || ||
|-
| 0xA || chmod || $cX || immY || <code>if (immY & 3) ACL(X) = (ACL(X) & immY) | 1; else ACL(X) = 0;</code> ||
|-
| 0xB || xor || $cX || $cY || <code>$cX ^= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xC || add || $cX || immY || <code>$cX += immY;</code> || <code>(ACL(X) & 2)</code>
|-
| 0xD || and || $cX || $cY || <code>$cX &= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xE || rev || $cX || $cY || <code>$cX = endian_swap128($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 1)</code>
|-
| 0xF || gfmul || $cX || $cY || <code>$cX = gfmul($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 2)</code>
|-
| 0x10 || secret || $cX || immY || <code>$cX = load_secret(immY); ACL(X) = load_secret_acl(immY);</code> ||
|-
| 0x11 || keyreg || immX || || <code>active_key_idx = immX;</code> ||
|-
| 0x12 || kexp || $cX || $cY || <code>$cX = aes_kexp($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0x13 || krexp || $cX || $cY || <code>$cX = aes_kexp_reverse($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0x14 || enc || $cX || $cY || <code>$cX = aes_enc(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 1) && (ACL(Y) & 2)</code>
|-
| 0x15 || dec || $cX || $cY || <code>$cX = aes_dec(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 1) && (ACL(Y) & 2)</code>
|-
| 0x16 || csigauth || $cX || $cY || <code>if (hash_verify($cX, $cY)) { has_sig = true; current_sig = $cX; }</code> || ?
|-
| 0x17 || csigclr || || || <code>has_sig = false;</code> ||
|-
| 0x18 || csigenc || $cX || $cY || <code>if (has_sig) $cX = aes_enc(current_sig, $cY);</code> || ?
|}

=== ACL ===
{| class="wikitable" border="1"
! Bit
! Meaning
|-
| 0 || Readable as key. This is forced set if bit1 is set, the only way to clear it is to clear *both* bit0 and bit1.
|-
| 1 || Readable
|}

==== Initial values ====
On SCP boot, the ACL is 0x1F for all $cX.

Loading into $cX using xdst instruction sets ACL($cX) to 0x1F.

Spilling a $cX to DMEM using xdld instruction is allowed if (ACL($cX) & 2).

=== csigauth ===
<code>00000000: f5 3c XY d8 csigauth $cY $cX</code>

This instruction takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret.

=== csigclr ===
<code>00000000: f5 3c 00 e0 csigclr</code>

This instruction takes no operands and appears to clear the saved cauth signature used by the csigenc instruction.

=== cchmod ===
<code>00000000: f5 3c XY a8 cchmod $cY 0X</code> or <code>00000000: f5 3c XY a9 cchmod $cY 1X</code>

This instruction takes a crypto register and a 5 bit immediate value. It appears to set the [[#Register ACLs|crypto registers' ACL]] bits as follows:
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Allow register to be used as key in NS or LS mode
|-
| 1
| Allow register to be used as key in HS mode
|-
| 2
| Set register as readable in NS or LS mode
|-
| 3
| Set register as readable in HS mode
|-
| 4
| Set register as writable in NS or LS mode
|}

=== crng ===
<code>00000000: f5 3c 0X 90 crng $cX</code>

This instruction initializes a crypto register with random data.

Executing this instruction only succeeds if the TRNG is enabled for the SCP, which requires taking the following steps:
* Write 0x7FFF to TSEC_TRNG_CLKDIV.
* Write 0x3FF0000 to TSEC_TRNG_UNK0.
* Write 0xFF00 to TSEC_TRNG_UNK7.
* Write 0x1000 to [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]].

Otherwise it hangs forever.

=== cxset ===
cxset instruction provides a way to change behavior of a variable amount of successively executed DMA-related instructions.

for example: <code>000000de: f4 3c 02 cxset 0x2</code>

can be read as: <code>dma_override(type=crypto_reg, count=2)</code>

The argument to cxset specifies the type of behavior change in the top 3 bits, and the number of DMA-related instructions the effect lasts for in the lower 5 bits.

{| class=wikitable
! Bits || Description
|-
| 0-4 || Number of instructions it is valid for (0x1f is a special value meaning infinitely many instructions -- until overriden by another cxset)
|-
| 5 || Crypto destination/source select (0=crypto register, 1=crypto stream)
|-
| 6 || External memory override (0=Disabled, 1=Enabled)
|-
| 7 || Internal memory select (0=DMEM, 1=IMEM)
|}

==== DMA-Related Instructions ====
At least the following instructions may have changed behavior, and count against the cxset "count" argument: <code>xdwait</code>, <code>xdst</code>, <code>xdld</code>.

For example, if override type=0b000, then the "length" argument to <code>xdst</code> is instead treated as the index of the target $cX register.

=== Secrets ===
Falcon's Authenticated Mode has access to 64 128-bit keys which are burned at factory. These keys can be loaded by using the $csecret instruction which takes the target crypto register and the key index as arguments.

{| class=wikitable
! Index || Notes || Console-unique
|-
| 0x00 || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares. || No
|-
| 0x01 || Used by nvhost_nvdec_bl020_prod firmware. ||
|-
| 0x03 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x04 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x05 || Used by nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares. ||
|-
| 0x07 || Used by [6.0.0+] nvhost_tsec firmware. ||
|-
| 0x09 || Used by nvhost_tsec firmware. ||
|-
| 0x0B || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x0F || Used by nvhost_tsec firmware. ||
|-
| 0x10 || Used by [1.0.0-5.1.0] nvhost_tsec firmware. ||
|-
| 0x15 || Used by nvhost_nvdec_bl020_prod, [5.0.0+] nvhost_nvdec020_prod, [5.0.0+] nvhost_nvdec020_ns and [6.0.0+] nvhost_tsec firmwares. ||
|-
| 0x26 || Used by [[TSEC_Firmware#KeygenLdr|KeygenLdr]]. || No
|-
| 0x3C || Used by nvhost_tsec firmware. ||
|-
| 0x3F || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. || Yes
|}

TSEC

2019-01-07T22:40:48Z

Qlutoo: /* SCP operations */

TSEC (Tegra Security Co-processor) is a dedicated unit powered by a NVIDIA Falcon microprocessor with crypto extensions.

= Driver =
A host driver for communicating with the TSEC is mapped to physical address 0x54500000 with a total size of 0x40000 bytes and exposes several registers.

== Registers ==
Registers from 0x54500000 to 0x54501000 are used to configure the host interface (HOST1X).

Registers from 0x54501000 to 0x54502000 are a MMIO window for communicating with the Falcon microprocessor. From this range, the subset of registers from 0x54501400 to 0x54501FE8 are specific to the TSEC and are subdivided into:
* 0x54501400 to 0x54501500: SCP (Secure Crypto Processor?).
* 0x54501500 to 0x54501600: TRNG (True Random Number Generator).
* 0x54501600 to 0x54501700: TFBIF (Tegra Framebuffer Interface).
* 0x54501700 to 0x54501800: DMA.
* 0x54501800 to 0x54501900: TEGRA (miscellaneous interfaces).

{| class="wikitable" border="1"
! Name
! Address
! Width
|-
| TSEC_THI_INCR_SYNCPT
| 0x54500000
| 0x04
|-
| TSEC_THI_INCR_SYNCPT_ERR
| 0x54500008
| 0x04
|-
| TSEC_THI_CTXSW_INCR_SYNCPT
| 0x5450000C
| 0x04
|-
| TSEC_THI_CTXSW
| 0x54500020
| 0x04
|-
| TSEC_THI_CONT_SYNCPT_EOF
| 0x54500028
| 0x04
|-
| [[#TSEC_THI_METHOD0|TSEC_THI_METHOD0]]
| 0x54500040
| 0x04
|-
| [[#TSEC_THI_METHOD1|TSEC_THI_METHOD1]]
| 0x54500044
| 0x04
|-
| [[#TSEC_THI_INT_STATUS|TSEC_THI_INT_STATUS]]
| 0x54500078
| 0x04
|-
| [[#TSEC_THI_INT_MASK|TSEC_THI_INT_MASK]]
| 0x5450007C
| 0x04
|-
| TSEC_THI_SLCG_STATUS
| 0x54500084
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_HIGH_A
| 0x54500088
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_LOW_A
| 0x5450008C
| 0x04
|-
| TSEC_THI_CLK_OVERRIDE
| 0x54500E00
| 0x04
|-
| [[#FALCON_IRQSSET|FALCON_IRQSSET]]
| 0x54501000
| 0x04
|-
| [[#FALCON_IRQSCLR|FALCON_IRQSCLR]]
| 0x54501004
| 0x04
|-
| [[#FALCON_IRQSTAT|FALCON_IRQSTAT]]
| 0x54501008
| 0x04
|-
| [[#FALCON_IRQMODE|FALCON_IRQMODE]]
| 0x5450100C
| 0x04
|-
| [[#FALCON_IRQMSET|FALCON_IRQMSET]]
| 0x54501010
| 0x04
|-
| [[#FALCON_IRQMCLR|FALCON_IRQMCLR]]
| 0x54501014
| 0x04
|-
| [[#FALCON_IRQMASK|FALCON_IRQMASK]]
| 0x54501018
| 0x04
|-
| [[#FALCON_IRQDEST|FALCON_IRQDEST]]
| 0x5450101C
| 0x04
|-
| FALCON_GPTMR_PERIOD
| 0x54501020
| 0x04
|-
| FALCON_GPTMR_TIME
| 0x54501024
| 0x04
|-
| FALCON_GPTMR_ENABLE
| 0x54501028
| 0x04
|-
| FALCON_TIME_LOW
| 0x5450102C
| 0x04
|-
| FALCON_TIME_HIGH
| 0x54501030
| 0x04
|-
| FALCON_WDTMR_TIME
| 0x54501034
| 0x04
|-
| FALCON_WDTMR_ENABLE
| 0x54501038
| 0x04
|-
| [[#FALCON_SCRATCH0|FALCON_SCRATCH0]]
| 0x54501040
| 0x04
|-
| [[#FALCON_SCRATCH1|FALCON_SCRATCH1]]
| 0x54501044
| 0x04
|-
| [[#FALCON_ITFEN|FALCON_ITFEN]]
| 0x54501048
| 0x04
|-
| [[#FALCON_IDLESTATE|FALCON_IDLESTATE]]
| 0x5450104C
| 0x04
|-
| FALCON_CURCTX
| 0x54501050
| 0x04
|-
| FALCON_NXTCTX
| 0x54501054
| 0x04
|-
| FALCON_CMDCTX
| 0x54501058
| 0x04
|-
| FALCON_STATUS_MASK
| 0x5450105C
| 0x04
|-
| FALCON_VM_SUPERVISOR
| 0x54501060
| 0x04
|-
| FALCON_MTHD_DATA
| 0x54501064
| 0x04
|-
| FALCON_MTHD_CMD
| 0x54501068
| 0x04
|-
| FALCON_MTHD_DATA_WR
| 0x5450106C
| 0x04
|-
| FALCON_MTHD_OCCUPIED
| 0x54501070
| 0x04
|-
| FALCON_MTHD_ACK
| 0x54501074
| 0x04
|-
| FALCON_MTHD_LIMIT
| 0x54501078
| 0x04
|-
| FALCON_SUBENGINE_RESET
| 0x5450107C
| 0x04
|-
| FALCON_SCRATCH2
| 0x54501080
| 0x04
|-
| FALCON_SCRATCH3
| 0x54501084
| 0x04
|-
| FALCON_PM_TRIGGER
| 0x54501088
| 0x04
|-
| FALCON_PM_MODE
| 0x5450108C
| 0x04
|-
| FALCON_DEBUG1
| 0x54501090
| 0x04
|-
| [[#FALCON_DEBUGINFO|FALCON_DEBUGINFO]]
| 0x54501094
| 0x04
|-
| FALCON_BREAKPOINT0
| 0x54501098
| 0x04
|-
| FALCON_BREAKPOINT1
| 0x5450109C
| 0x04
|-
| FALCON_CGCTL
| 0x545010A0
| 0x04
|-
| FALCON_ENGCTL
| 0x545010A4
| 0x04
|-
| FALCON_PM_SEL
| 0x545010A8
| 0x04
|-
| FALCON_HOST_IO_INDEX
| 0x545010AC
| 0x04
|-
| [[#FALCON_EXCI|FALCON_EXCI]]
| 0x545010D0
| 0x04
|-
| [[#FALCON_CPUCTL|FALCON_CPUCTL]]
| 0x54501100
| 0x04
|-
| [[#FALCON_BOOTVEC|FALCON_BOOTVEC]]
| 0x54501104
| 0x04
|-
| [[#FALCON_HWCFG|FALCON_HWCFG]]
| 0x54501108
| 0x04
|-
| [[#FALCON_DMACTL|FALCON_DMACTL]]
| 0x5450110C
| 0x04
|-
| [[#FALCON_DMATRF_EXTBASE|FALCON_DMATRF_EXTBASE]]
| 0x54501110
| 0x04
|-
| [[#FALCON_DMATRF_VOFF|FALCON_DMATRF_VOFF]]
| 0x54501114
| 0x04
|-
| [[#FALCON_DMATRFCMD|FALCON_DMATRFCMD]]
| 0x54501118
| 0x04
|-
| [[#FALCON_DMATRF_POFF|FALCON_DMATRF_POFF]]
| 0x5450111C
| 0x04
|-
| [[#FALCON_DMATRFSTAT|FALCON_DMATRFSTAT]]
| 0x54501120
| 0x04
|-
| [[#FALCON_CRYPTTRFSTAT|FALCON_CRYPTTRFSTAT]]
| 0x54501124
| 0x04
|-
| FALCON_CPUSTAT
| 0x54501128
| 0x04
|-
| [[#FALCON_HWCFG2|FALCON_HWCFG2]]
| 0x5450112C
| 0x04
|-
| FALCON_CPUCTL_ALIAS
| 0x54501130
| 0x04
|-
| FALCON_TLB_CMD
| 0x54501140
| 0x04
|-
| FALCON_TLB_CMD_RES
| 0x54501144
| 0x04
|-
| FALCON_BRANCH_HISTORY_CTRL
| 0x54501148
| 0x04
|-
| FALCON_BRANCH_HISTORY_PC
| 0x5450114C
| 0x04
|-
| FALCON_IMFILLRNG0
| 0x54501150
| 0x04
|-
| FALCON_IMFILLRNG1
| 0x54501154
| 0x04
|-
| FALCON_IMFILLCTL
| 0x54501158
| 0x04
|-
| FALCON_EXTERRWIN
| 0x54501160
| 0x04
|-
| FALCON_EXTERRCFG
| 0x54501164
| 0x04
|-
| FALCON_EXTERRADDR
| 0x54501168
| 0x04
|-
| FALCON_EXTERRSTAT
| 0x5450116C
| 0x04
|-
| FALCON_CG2
| 0x5450117C
| 0x04
|-
| FALCON_CODE_INDEX
| 0x54501180
| 0x04
|-
| FALCON_CODE
| 0x54501184
| 0x04
|-
| FALCON_CODE_VIRT_ADDR
| 0x54501188
| 0x04
|-
| FALCON_DATA_INDEX0
| 0x545011C0
| 0x04
|-
| FALCON_DATA0
| 0x545011C4
| 0x04
|-
| FALCON_DATA_INDEX1
| 0x545011C8
| 0x04
|-
| FALCON_DATA1
| 0x545011CC
| 0x04
|-
| FALCON_DATA_INDEX2
| 0x545011D0
| 0x04
|-
| FALCON_DATA2
| 0x545011D4
| 0x04
|-
| FALCON_DATA_INDEX3
| 0x545011D8
| 0x04
|-
| FALCON_DATA3
| 0x545011DC
| 0x04
|-
| FALCON_DATA_INDEX4
| 0x545011E0
| 0x04
|-
| FALCON_DATA4
| 0x545011E4
| 0x04
|-
| FALCON_DATA_INDEX5
| 0x545011E8
| 0x04
|-
| FALCON_DATA5
| 0x545011EC
| 0x04
|-
| FALCON_DATA_INDEX6
| 0x545011F0
| 0x04
|-
| FALCON_DATA6
| 0x545011F4
| 0x04
|-
| FALCON_DATA_INDEX7
| 0x545011F8
| 0x04
|-
| FALCON_DATA7
| 0x545011FC
| 0x04
|-
| [[#FALCON_ICD_CMD|FALCON_ICD_CMD]]
| 0x54501200
| 0x04
|-
| FALCON_ICD_ADDR
| 0x54501204
| 0x04
|-
| FALCON_ICD_WDATA
| 0x54501208
| 0x04
|-
| FALCON_ICD_RDATA
| 0x5450120C
| 0x04
|-
| [[#FALCON_SCTL|FALCON_SCTL]]
| 0x54501240
| 0x04
|-
| [[#TSEC_SCP_CTL_ACCESS|TSEC_SCP_CTL_ACCESS]]
| 0x54501400
| 0x04
|-
| [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]]
| 0x54501404
| 0x04
|-
| [[#TSEC_SCP_CTL_STAT|TSEC_SCP_CTL_STAT]]
| 0x54501408
| 0x04
|-
| [[#TSEC_SCP_CTL_MODE|TSEC_SCP_CTL_MODE]]
| 0x5450140C
| 0x04
|-
| TSEC_SCP_UNK0
| 0x54501410
| 0x04
|-
| [[#TSEC_SCP_CTL_PKEY|TSEC_SCP_CTL_PKEY]]
| 0x54501418
| 0x04
|-
| [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]]
| 0x54501420
| 0x04
|-
| [[#TSEC_SCP_SEQ_STAT|TSEC_SCP_SEQ_STAT]]
| 0x54501428
| 0x04
|-
| [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]]
| 0x54501430
| 0x04
|-
| TSEC_SCP_UNK2
| 0x54501454
| 0x04
|-
| [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]]
| 0x54501458
| 0x04
|-
| TSEC_SCP_UNK3
| 0x54501470
| 0x04
|-
| [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT]]
| 0x54501480
| 0x04
|-
| [[#TSEC_SCP_IRQMASK|TSEC_SCP_IRQMASK]]
| 0x54501484
| 0x04
|-
| TSEC_SCP_UNK4
| 0x54501490
| 0x04
|-
| [[#TSEC_SCP_ERR|TSEC_SCP_ERR]]
| 0x54501498
| 0x04
|-
| TSEC_TRNG_CLKDIV
| 0x54501500
| 0x04
|-
| TSEC_TRNG_UNK0
| 0x54501504
| 0x04
|-
| TSEC_TRNG_UNK1
| 0x5450150C
| 0x04
|-
| TSEC_TRNG_UNK2
| 0x54501510
| 0x04
|-
| TSEC_TRNG_UNK3
| 0x54501514
| 0x04
|-
| TSEC_TRNG_UNK4
| 0x54501518
| 0x04
|-
| TSEC_TRNG_UNK5
| 0x5450151C
| 0x04
|-
| TSEC_TRNG_UNK6
| 0x54501528
| 0x04
|-
| TSEC_TRNG_UNK7
| 0x5450152C
| 0x04
|-
| TSEC_TFBIF_UNK0
| 0x54501600
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL|TSEC_TFBIF_MCCIF_FIFOCTRL]]
| 0x54501604
| 0x04
|-
| TSEC_TFBIF_UNK1
| 0x54501608
| 0x04
|-
| TSEC_TFBIF_UNK2
| 0x5450160C
| 0x04
|-
| TSEC_TFBIF_UNK3
| 0x54501630
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL1|TSEC_TFBIF_MCCIF_FIFOCTRL1]]
| 0x54501634
| 0x04
|-
| TSEC_TFBIF_UNK4
| 0x54501640
| 0x04
|-
| [[#TSEC_TFBIF_UNK5|TSEC_TFBIF_UNK5]]
| 0x54501644
| 0x04
|-
| [[#TSEC_TFBIF_UNK6|TSEC_TFBIF_UNK6]]
| 0x54501648
| 0x04
|-
| [[#TSEC_DMA_CMD|TSEC_DMA_CMD]]
| 0x54501700
| 0x04
|-
| [[#TSEC_DMA_ADDR|TSEC_DMA_ADDR]]
| 0x54501704
| 0x04
|-
| [[#TSEC_DMA_VAL|TSEC_DMA_VAL]]
| 0x54501708
| 0x04
|-
| [[#TSEC_DMA_UNK|TSEC_DMA_UNK]]
| 0x5450170C
| 0x04
|-
| TSEC_TEGRA_FALCON_IP_VER
| 0x54501800
| 0x04
|-
| TSEC_TEGRA_UNK0
| 0x54501824
| 0x04
|-
| TSEC_TEGRA_UNK1
| 0x54501828
| 0x04
|-
| TSEC_TEGRA_UNK2
| 0x5450182C
| 0x04
|-
| [[#TSEC_TEGRA_CTL|TSEC_TEGRA_CTL]]
| 0x54501838
| 0x04
|}

=== TSEC_THI_METHOD0 ===
{| class="wikitable" border="1"
! ID
! Method
|-
| 0x200
| SET_APPLICATION_ID
|-
| 0x300
| EXECUTE
|-
| 0x500
| HDCP_INIT
|-
| 0x504
| HDCP_CREATE_SESSION
|-
| 0x508
| HDCP_VERIFY_CERT_RX
|-
| 0x50C
| HDCP_GENERATE_EKM
|-
| 0x510
| HDCP_REVOCATION_CHECK
|-
| 0x514
| HDCP_VERIFY_HPRIME
|-
| 0x518
| HDCP_ENCRYPT_PAIRING_INFO
|-
| 0x51C
| HDCP_DECRYPT_PAIRING_INFO
|-
| 0x520
| HDCP_UPDATE_SESSION
|-
| 0x524
| HDCP_GENERATE_LC_INIT
|-
| 0x528
| HDCP_VERIFY_LPRIME
|-
| 0x52C
| HDCP_GENERATE_SKE_INIT
|-
| 0x530
| HDCP_VERIFY_VPRIME
|-
| 0x534
| HDCP_ENCRYPTION_RUN_CTRL
|-
| 0x538
| HDCP_SESSION_CTRL
|-
| 0x53C
| HDCP_COMPUTE_SPRIME
|-
| 0x540
| HDCP_GET_CERT_RX
|-
| 0x544
| HDCP_EXCHANGE_INFO
|-
| 0x548
| HDCP_DECRYPT_KM
|-
| 0x54C
| HDCP_GET_HPRIME
|-
| 0x550
| HDCP_GENERATE_EKH_KM
|-
| 0x554
| HDCP_VERIFY_RTT_CHALLENGE
|-
| 0x558
| HDCP_GET_LPRIME
|-
| 0x55C
| HDCP_DECRYPT_KS
|-
| 0x560
| HDCP_DECRYPT
|-
| 0x564
| HDCP_GET_RRX
|-
| 0x568
| HDCP_DECRYPT_REENCRYPT
|-
| 0x56C
|
|-
| 0x570
|
|-
| 0x574
|
|-
| 0x578
|
|-
| 0x57C
|
|-
| 0x700
| HDCP_VALIDATE_SRM
|-
| 0x704
| HDCP_VALIDATE_STREAM
|-
| 0x708
| HDCP_TEST_SECURE_STATUS
|-
| 0x70C
| HDCP_SET_DCP_KPUB
|-
| 0x710
| HDCP_SET_RX_KPUB
|-
| 0x714
| HDCP_SET_CERT_RX
|-
| 0x718
| HDCP_SET_SCRATCH_BUFFER
|-
| 0x71C
| HDCP_SET_SRM
|-
| 0x720
| HDCP_SET_RECEIVER_ID_LIST
|-
| 0x724
| HDCP_SET_SPRIME
|-
| 0x728
| HDCP_SET_ENC_INPUT_BUFFER
|-
| 0x72C
| HDCP_SET_ENC_OUTPUT_BUFFER
|-
| 0x730
| HDCP_GET_RTT_CHALLENGE
|-
| 0x734
| HDCP_STREAM_MANAGE
|-
| 0x738
| HDCP_READ_CAPS
|-
| 0x73C
| HDCP_ENCRYPT
|-
| 0x740
| [6.0.0+] HDCP_GET_CURRENT_NONCE
|}

Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_METHOD1 ===
Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_INT_STATUS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_STATUS_FALCON_INT
|}

=== TSEC_THI_INT_MASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_MASK_FALCON_INT
|}

=== FALCON_IRQSSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSSET_GPTMR
|-
| 1
| FALCON_IRQSSET_WDTMR
|-
| 2
| FALCON_IRQSSET_MTHD
|-
| 3
| FALCON_IRQSSET_CTXSW
|-
| 4
| FALCON_IRQSSET_HALT
|-
| 5
| FALCON_IRQSSET_EXTERR
|-
| 6
| FALCON_IRQSSET_SWGEN0
|-
| 7
| FALCON_IRQSSET_SWGEN1
|-
| 8-15
| FALCON_IRQSSET_EXT
|}

Used for setting Falcon's IRQs.

=== FALCON_IRQSCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSCLR_GPTMR
|-
| 1
| FALCON_IRQSCLR_WDTMR
|-
| 2
| FALCON_IRQSCLR_MTHD
|-
| 3
| FALCON_IRQSCLR_CTXSW
|-
| 4
| FALCON_IRQSCLR_HALT
|-
| 5
| FALCON_IRQSCLR_EXTERR
|-
| 6
| FALCON_IRQSCLR_SWGEN0
|-
| 7
| FALCON_IRQSCLR_SWGEN1
|-
| 8-15
| FALCON_IRQSCLR_EXT
|}

Used for clearing Falcon's IRQs.

=== FALCON_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSTAT_GPTMR
|-
| 1
| FALCON_IRQSTAT_WDTMR
|-
| 2
| FALCON_IRQSTAT_MTHD
|-
| 3
| FALCON_IRQSTAT_CTXSW
|-
| 4
| FALCON_IRQSTAT_HALT
|-
| 5
| FALCON_IRQSTAT_EXTERR
|-
| 6
| FALCON_IRQSTAT_SWGEN0
|-
| 7
| FALCON_IRQSTAT_SWGEN1
|-
| 8-15
| FALCON_IRQSTAT_EXT
|}

Used for getting the status of Falcon's IRQs.

=== FALCON_IRQMODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMODE_GPTMR
|-
| 1
| FALCON_IRQMODE_WDTMR
|-
| 2
| FALCON_IRQMODE_MTHD
|-
| 3
| FALCON_IRQMODE_CTXSW
|-
| 4
| FALCON_IRQMODE_HALT
|-
| 5
| FALCON_IRQMODE_EXTERR
|-
| 6
| FALCON_IRQMODE_SWGEN0
|-
| 7
| FALCON_IRQMODE_SWGEN1
|-
| 8-15
| FALCON_IRQMODE_EXT
|}

Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.

=== FALCON_IRQMSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMSET_GPTMR
|-
| 1
| FALCON_IRQMSET_WDTMR
|-
| 2
| FALCON_IRQMSET_MTHD
|-
| 3
| FALCON_IRQMSET_CTXSW
|-
| 4
| FALCON_IRQMSET_HALT
|-
| 5
| FALCON_IRQMSET_EXTERR
|-
| 6
| FALCON_IRQMSET_SWGEN0
|-
| 7
| FALCON_IRQMSET_SWGEN1
|-
| 8-15
| FALCON_IRQMSET_EXT
|}

Used for setting the mask for Falcon's IRQs.

=== FALCON_IRQMCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMCLR_GPTMR
|-
| 1
| FALCON_IRQMCLR_WDTMR
|-
| 2
| FALCON_IRQMCLR_MTHD
|-
| 3
| FALCON_IRQMCLR_CTXSW
|-
| 4
| FALCON_IRQMCLR_HALT
|-
| 5
| FALCON_IRQMCLR_EXTERR
|-
| 6
| FALCON_IRQMCLR_SWGEN0
|-
| 7
| FALCON_IRQMCLR_SWGEN1
|-
| 8-15
| FALCON_IRQMCLR_EXT
|}

Used for clearing the mask for Falcon's IRQs.

=== FALCON_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMASK_GPTMR
|-
| 1
| FALCON_IRQMASK_WDTMR
|-
| 2
| FALCON_IRQMASK_MTHD
|-
| 3
| FALCON_IRQMASK_CTXSW
|-
| 4
| FALCON_IRQMASK_HALT
|-
| 5
| FALCON_IRQMASK_EXTERR
|-
| 6
| FALCON_IRQMASK_SWGEN0
|-
| 7
| FALCON_IRQMASK_SWGEN1
|-
| 8-15
| FALCON_IRQMASK_EXT
|}

Used for getting the value of the mask for Falcon's IRQs.

=== FALCON_IRQDEST ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQDEST_HOST_GPTMR
|-
| 1
| FALCON_IRQDEST_HOST_WDTMR
|-
| 2
| FALCON_IRQDEST_HOST_MTHD
|-
| 3
| FALCON_IRQDEST_HOST_CTXSW
|-
| 4
| FALCON_IRQDEST_HOST_HALT
|-
| 5
| FALCON_IRQDEST_HOST_EXTERR
|-
| 6
| FALCON_IRQDEST_HOST_SWGEN0
|-
| 7
| FALCON_IRQDEST_HOST_SWGEN1
|-
| 8-15
| FALCON_IRQDEST_HOST_EXT
|-
| 16
| FALCON_IRQDEST_TARGET_GPTMR
|-
| 17
| FALCON_IRQDEST_TARGET_WDTMR
|-
| 18
| FALCON_IRQDEST_TARGET_MTHD
|-
| 19
| FALCON_IRQDEST_TARGET_CTXSW
|-
| 20
| FALCON_IRQDEST_TARGET_HALT
|-
| 21
| FALCON_IRQDEST_TARGET_EXTERR
|-
| 22
| FALCON_IRQDEST_TARGET_SWGEN0
|-
| 23
| FALCON_IRQDEST_TARGET_SWGEN1
|-
| 24-31
| FALCON_IRQDEST_TARGET_EXT
|}

Used for routing Falcon's IRQs.

=== FALCON_SCRATCH0 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_SCRATCH1 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_ITFEN ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_ITFEN_CTXEN
|-
| 1
| FALCON_ITFEN_MTHDEN
|}

Used for enabling/disabling Falcon interfaces.

=== FALCON_IDLESTATE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IDLESTATE_FALCON_BUSY
|-
| 1-15
| FALCON_IDLESTATE_EXT_BUSY
|}

Used for detecting if Falcon is busy or not.

=== FALCON_DEBUGINFO ===
Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.

[6.0.0+] [[NV_services|nvservices]] sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.

=== FALCON_EXCI ===
Contains information about raised exceptions.

=== FALCON_CPUCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_CPUCTL_IINVAL
|-
| 1
| FALCON_CPUCTL_STARTCPU
|-
| 2
| FALCON_CPUCTL_SRESET
|-
| 3
| FALCON_CPUCTL_HRESET
|-
| 4
| FALCON_CPUCTL_HALTED
|-
| 5
| FALCON_CPUCTL_STOPPED
|-
| 6
| FALCON_CPUCTL_SCP_UNK
|}

Used for signaling the Falcon CPU.

=== FALCON_BOOTVEC ===
Takes the Falcon's boot vector address.

=== FALCON_HWCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-8
| FALCON_HWCFG_IMEM_SIZE
|-
| 9-17
| FALCON_HWCFG_DMEM_SIZE
|-
| 18-25
| FALCON_HWCFG_MTHD_SIZE
|-
| 26-31
| FALCON_HWCFG_DMATRF_SLOTS
|}

=== FALCON_DMACTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMACTL_REQUIRE_CTX
|-
| 1
| FALCON_DMACTL_DMEM_SCRUBBING
|-
| 2
| FALCON_DMACTL_IMEM_SCRUBBING
|-
| 3-6
| FALCON_DMACTL_DMAQ_NUM
|-
| 7
| FALCON_DMACTL_SECURE_STAT
|}

Used for configuring the Falcon's DMA engine.

=== FALCON_DMATRF_EXTBASE ===
Base of the external memory buffer.

The base of the transfer is calculated by adding [[#FALCON_DMATRF_POFF]] to the base.

=== FALCON_DMATRF_VOFF ===
For transfers to DMEM: the destination address.
For transfers to IMEM: the destination virtual IMEM page.

=== FALCON_DMATRF_POFF ===
For transfers to IMEM: the destination physical IMEM page.

=== FALCON_DMATRFCMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFCMD_FULL
|-
| 1
| FALCON_DMATRFCMD_IDLE
|-
| 2-3
| FALCON_DMATRFCMD_SEC
|-
| 4
| FALCON_DMATRFCMD_IMEM
|-
| 5
| FALCON_DMATRFCMD_WRITE
|-
| 8-10
| FALCON_DMATRFCMD_SIZE
|-
| 12-14
| FALCON_DMATRFCMD_CTXDMA
|}

Used for configuring DMA transfers.

=== FALCON_DMATRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFSTAT_PENDING
|-
| 16-18
| FALCON_DMATRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_DMATRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_CRYPTTRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| FALCON_CRYPTTRFSTAT_PENDING
|-
| 5
| FALCON_CRYPTTRFSTAT_ENABLED
|-
| 16-18
| FALCON_CRYPTTRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_CRYPTTRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_HWCFG2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_HWCFG2_VERSION
|-
| 4-5
| FALCON_HWCFG2_SCP_MODE
|-
| 6-7
| FALCON_HWCFG2_SUBVERSION
|-
| 8-11
| FALCON_HWCFG2_IMEM_PORTS
|-
| 12-15
| FALCON_HWCFG2_DMEM_PORTS
|-
| 16-19
| FALCON_HWCFG2_VM_PAGES_LOG2
|}

=== FALCON_ICD_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_ICD_CMD_OPC
0x0: BREAK
0x1: CONTINUE_FROM_PC
0x2: CONTINUE_FROM_ADDR
0x3: CONTINUE_UNK1_FROM_PC
0x4: CONTINUE_UNK1_FROM_ADDR
0x5: SINGLE_STEP_FROM_PC
0x6: SINGLE_STEP_FROM_ADDR
0x7: SET_BREAK_MASK
0x8: REG_READ
0x9: REG_WRITE
0xA: DATA_READ
0xB: DATA_WRITE
0xC: IO_READ
0xD: IO_WRITE
0xE: STATUS_READ
|-
| 6-7
| FALCON_ICD_CMD_DATA_SIZE
|-
| 8-12
| FALCON_ICD_CMD_IDX
|-
| 14
| FALCON_ICD_CMD_ERROR
|-
| 15
| FALCON_ICD_CMD_DONE
|-
| 16-31
| FALCON_ICD_CMD_BREAK_MASK
|}

=== FALCON_SCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| FALCON_SCTL_SEC_MODE
0: Non-secure
1: Light Secure
2: Heavy Secure
|}

=== TSEC_SCP_CTL_ACCESS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| Enable TSEC_SCP_INSN_STAT register
|}

=== TSEC_SCP_CTL_TRNG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 11
| Unknown
|-
| 12
| Enable the TRNG
|}

=== TSEC_SCP_CTL_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| TSEC_SCP_CTL_STAT_DEBUG_MODE
|}

=== TSEC_SCP_CTL_MODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Disable reads for the TRNG register block
|-
| 1
| Disable reads for the TFBIF register block
|-
| 2
| Disable reads for the DMA register block
|-
| 3
| Disable reads for the TEGRA register block
|-
| 4
| Disable writes for the TRNG register block
|-
| 5
| Disable writes for the TFBIF register block
|-
| 6
| Disable writes for the DMA register block
|-
| 7
| Disable writes for the TEGRA register block
|}

Controls accesses to the other sub-engines and can only be cleared in Heavy Secure mode.

=== TSEC_SCP_CTL_PKEY ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
|-
| 1
| TSEC_SCP_CTL_PKEY_LOADED
|}

=== TSEC_SCP_SEQ0_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 8-11
| Size of current cs0begin macro
|-
|}

=== TSEC_SCP_SEQ_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Set if crypto sequence recording (cs0begin/cs1begin) is active
|-
| 4-7
| Number of instructions left for the crypto sequence
|-
| 12-15
| Active crypto key register
|}

Contains information on the last crypto sequence (cs0 or cs1) executed.

=== TSEC_SCP_INSN_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| Crypto fuc5 destination register or immediate value
|-
| 8-15
| Crypto fuc5 source register or immediate value
|-
| 20-24
| Crypto fuc5 operation
0x0: none (fuc5 opcode 0x00)
0x1: cmov (fuc5 opcode 0x84)
0x2: cxsin (fuc5 opcode 0x88) or xdst (with cxset)
0x3: cxsout (fuc5 opcode 0x8C) or xdld (with cxset)
0x4: crng (fuc5 opcode 0x90)
0x5: cs0begin (fuc5 opcode 0x94)
0x6: cs0exec (fuc5 opcode 0x98)
0x7: cs1begin (fuc5 opcode 0x9C)
0x8: cs1exec (fuc5 opcode 0xA0)
0x9: invalid (fuc5 opcode 0xA4)
0xA: cchmod (fuc5 opcode 0xA8)
0xB: cxor (fuc5 opcode 0xAC)
0xC: cadd (fuc5 opcode 0xB0)
0xD: cand (fuc5 opcode 0xB4)
0xE: crev (fuc5 opcode 0xB8)
0xF: cprecmac (fuc5 opcode 0xBC)
0x10: csecret (fuc5 opcode 0xC0)
0x11: ckeyreg (fuc5 opcode 0xC4)
0x12: ckexp (fuc5 opcode 0xC8)
0x13: ckrexp (fuc5 opcode 0xCC)
0x14: cenc (fuc5 opcode 0xD0)
0x15: cdec (fuc5 opcode 0xD4)
0x16: csigauth (fuc5 opcode 0xD8)
0x17: csigenc (fuc5 opcode 0xDC)
0x18: csigclr (fuc5 opcode 0xE0)
|-
| 31
| Set if running in secure mode (cauth)
|}

Contains information on the last crypto instruction executed.

=== TSEC_SCP_AES_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-4
| First opcode
|-
| 5-9
| Second opcode
|-
| 15-16
| AES operation
0: Encryption
1: Decryption
2: Key expansion
3: Key reverse expansion
|}

Contains information on the last AES sequence executed.

=== TSEC_SCP_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQSTAT_TRNG
|-
| 8
| TSEC_SCP_IRQSTAT_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQSTAT_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQSTAT_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the status of crypto IRQs.

=== TSEC_SCP_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQMASK_TRNG
|-
| 8
| TSEC_SCP_IRQMASK_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQMASK_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQMASK_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the value of the mask for crypto IRQs.

=== TSEC_SCP_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Invalid instruction
|-
| 4
| Empty crypto sequence
|-
| 8
| Crypto sequence is too long
|-
| 12
| Crypto sequence was not finished
|-
| 16
| Invalid cauth signature (during csigenc, csigclr or csigunk)
|-
| 24
| Forbidden instruction
|}

Contains information on crypto errors generated by the [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT_INSN_ERROR]] IRQ.

=== TSEC_TFBIF_MCCIF_FIFOCTRL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
|-
| 1
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
|-
| 2
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
|-
| 3
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
|-
| 4
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
|-
| 5
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
|-
| 6
| TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
|-
| 7
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
|-
| 8
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE
|}

=== TSEC_MCCIF_FIFOCTRL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
|-
| 16-31
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT
|}

=== TSEC_TFBIF_UNK5 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.

=== TSEC_TFBIF_UNK6 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to (data_size << 4) before reading memory from the GPU UCODE carveout.

=== TSEC_DMA_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_DMA_CMD_READ
|-
| 1
| TSEC_DMA_CMD_WRITE
|-
| 4-7
| TSEC_DMA_CMD_UNK
|-
| 12
| TSEC_DMA_CMD_BUSY
|-
| 13
| TSEC_DMA_CMD_ERROR
|-
| 31
| TSEC_DMA_CMD_INIT
|}

A DMA read/write operation requires bits TSEC_DMA_CMD_INIT and TSEC_DMA_CMD_READ/TSEC_DMA_CMD_WRITE to be set in TSEC_DMA_CMD.

During the transfer, the TSEC_DMA_CMD_BUSY bit is set.

Accessing an invalid address causes bit TSEC_DMA_CMD_ERROR to be set.

=== TSEC_DMA_ADDR ===
Takes the address for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_VAL ===
Takes the value for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_UNK ===
Always 0xFFF.

=== TSEC_TEGRA_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 16
| TSEC_TEGRA_CTL_TKFI_KFUSE
|-
| 17
| TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
|-
| 24
| TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
|-
| 25
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
|-
| 26
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
|-
| 27
| TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C
|}

== Authenticated Mode ==
===== Entry =====
From non-secure mode, upon jumping to a page marked as secret, a secret fault occurs. This causes the CPU to verify the region specified in $cauth against the MAC loaded in $c6. If the comparison is successful, the valid bit (bit0) is set on all pages in the $cauth region, and $pc is set to the base of the $cauth region. If the comparsion fails, the CPU is halted.

===== Exit =====
The CPU automatically goes back to non-secure mode when returning back into non-secret pages. When this happens, the valid bit (bit0) in the TLB flags is cleared for all secret pages.

===== Implementation =====
Under certain circumstances, it is possible to observe [[#csigauth|csigauth]] being briefly written to [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]] as "csigauth $c4 $c6" while the opcodes in [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]] are set to "cxsin" and "csigauth", respectively.

Via [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]] it can be observed that a 3-sized macro sequence is loaded into cs0 during a secure mode transition.

== Crypto processing ==
Part of the information here (which hasn't made it into envytools documentation yet) was shared by [https://wiki.0x04.net/wiki/Marcin_Ko%C5%9Bcielnicki mwk] from reverse engineering falcon processors over the years.

=== cauth ===
$cauth is a special purpose register in the CPU.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7 || Start of region to authenticate (in 0x100 pages)
|-
| 8-15 || Unused
|-
| 16 || Use secret xfers (?)
|-
| 17 || Region is signed and encrypted and double the size (?)
|-
| 18 ||
|-
| 19 ||
|-
| 20-23 || Unused
|-
| 31-24 || Size of region to authenticate (in 0x100 pages)
|}

== SCP operations ==

{| class="wikitable" border="1"
! Opcode
! Name
! Operand0
! Operand1
! Operation
! Condition
|-
| 0 || nop || || || ||
|-
| 1 || mov || $cX || $cY || <code>$cX = $cY; ACL(X) = ACL(Y);</code> ||
|-
| 2 || sin || $cX || N/A || <code>$cX = read_stream(); ACL(X) = ???;</code> ||
|-
| 3 || sout || $cX || N/A || <code>write_stream($cX);</code> ||
|-
| 4 || rnd || $cX || N/A || <code>$cX = read_trng(); ACL(X) = ???;</code> ||
|-
| 5 || s0begin || immX || N/A || <code>record_macro_for_N_instructions(0, immX);</code> ||
|-
| 6 || s0exec || immX || N/A || <code>execute_macro_N_times(0, immX);</code> ||
|-
| 7 || s1begin || immX || N/A || <code>record_macro_for_N_instructions(1, immX);</code> ||
|-
| 8 || s1exec || immX || N/A || <code>execute_macro_N_times(1, immX);</code> ||
|-
| 9 || <invalid> || || || ||
|-
| 0xA || chmod || $cX || immY || <code>if (immY & 3) ACL(X) = (ACL(X) & immY) | 1; else ACL(X) = 0;</code> ||
|-
| 0xB || xor || $cX || $cY || <code>$cX ^= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xC || add || $cX || immY || <code>$cX += immY;</code> || <code>(ACL(X) & 2)</code>
|-
| 0xD || and || $cX || $cY || <code>$cX &= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xE || rev || $cX || $cY || <code>$cX = endian_swap128($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 1)</code>
|-
| 0xF || gfmul || $cX || $cY || <code>$cX = gfmul($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 2)</code>
|-
| 0x10 || secret || $cX || immY || <code>$cX = load_secret(immY); ACL(X) = load_secret_acl(immY);</code> ||
|-
| 0x11 || keyreg || immX || || <code>active_key_idx = immX;</code> ||
|-
| 0x12 || kexp || $cX || $cY || <code>$cX = aes_kexp($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 1)</code>
|-
| 0x13 || krexp || $cX || $cY || <code>$cX = aes_kexp_reverse($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 1)</code>
|-
| 0x14 || enc || $cX || $cY || <code>$cX = aes_enc(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 1) && (ACL(Y) & 2)</code>
|-
| 0x15 || dec || $cX || $cY || <code>$cX = aes_dec(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 1) && (ACL(Y) & 2)</code>
|-
| 0x16 || csigauth || $cX || $cY || <code>if (hash_verify($cX, $cY)) { has_sig = true; current_sig = $cX; }</code> || ?
|-
| 0x17 || csigclr || || || <code>has_sig = false;</code> ||
|-
| 0x18 || csigenc || $cX || $cY || <code>if (has_sig) $cX = aes_enc(current_sig, $cY);</code> || ?
|}

=== ACL ===
{| class="wikitable" border="1"
! Bit
! Meaning
|-
| 0 || Readable as key. This is forced set if bit1 is set, the only way to clear it is to clear *both* bit0 and bit1.
|-
| 1 || Readable
|}

==== Initial values ====
On SCP boot, the ACL is 0x1F for all $cX.

Loading into $cX using xdst instruction sets ACL($cX) to 0x1F.

Spilling a $cX to DMEM using xdld instruction is allowed if (ACL($cX) & 2).

=== csigauth ===
<code>00000000: f5 3c XY d8 csigauth $cY $cX</code>

This instruction takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret.

=== csigclr ===
<code>00000000: f5 3c 00 e0 csigclr</code>

This instruction takes no operands and appears to clear the saved cauth signature used by the csigenc instruction.

=== cchmod ===
<code>00000000: f5 3c XY a8 cchmod $cY 0X</code> or <code>00000000: f5 3c XY a9 cchmod $cY 1X</code>

This instruction takes a crypto register and a 5 bit immediate value. It appears to set the [[#Register ACLs|crypto registers' ACL]] bits as follows:
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Allow register to be used as key in NS or LS mode
|-
| 1
| Allow register to be used as key in HS mode
|-
| 2
| Set register as readable in NS or LS mode
|-
| 3
| Set register as readable in HS mode
|-
| 4
| Set register as writable in NS or LS mode
|}

=== crng ===
<code>00000000: f5 3c 0X 90 crng $cX</code>

This instruction initializes a crypto register with random data.

Executing this instruction only succeeds if the TRNG is enabled for the SCP, which requires taking the following steps:
* Write 0x7FFF to TSEC_TRNG_CLKDIV.
* Write 0x3FF0000 to TSEC_TRNG_UNK0.
* Write 0xFF00 to TSEC_TRNG_UNK7.
* Write 0x1000 to [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]].

Otherwise it hangs forever.

=== cxset ===
cxset instruction provides a way to change behavior of a variable amount of successively executed DMA-related instructions.

for example: <code>000000de: f4 3c 02 cxset 0x2</code>

can be read as: <code>dma_override(type=crypto_reg, count=2)</code>

The argument to cxset specifies the type of behavior change in the top 3 bits, and the number of DMA-related instructions the effect lasts for in the lower 5 bits.

{| class=wikitable
! Bits || Description
|-
| 0-4 || Number of instructions it is valid for (0x1f is a special value meaning infinitely many instructions -- until overriden by another cxset)
|-
| 5 || Crypto destination/source select (0=crypto register, 1=crypto stream)
|-
| 6 || External memory override (0=Disabled, 1=Enabled)
|-
| 7 || Internal memory select (0=DMEM, 1=IMEM)
|}

==== DMA-Related Instructions ====
At least the following instructions may have changed behavior, and count against the cxset "count" argument: <code>xdwait</code>, <code>xdst</code>, <code>xdld</code>.

For example, if override type=0b000, then the "length" argument to <code>xdst</code> is instead treated as the index of the target $cX register.

=== Secrets ===
Falcon's Authenticated Mode has access to 64 128-bit keys which are burned at factory. These keys can be loaded by using the $csecret instruction which takes the target crypto register and the key index as arguments.

{| class=wikitable
! Index || Notes || Console-unique
|-
| 0x00 || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares. || No
|-
| 0x01 || Used by nvhost_nvdec_bl020_prod firmware. ||
|-
| 0x03 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x04 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x05 || Used by nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares. ||
|-
| 0x07 || Used by [6.0.0+] nvhost_tsec firmware. ||
|-
| 0x09 || Used by nvhost_tsec firmware. ||
|-
| 0x0B || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x0F || Used by nvhost_tsec firmware. ||
|-
| 0x10 || Used by [1.0.0-5.1.0] nvhost_tsec firmware. ||
|-
| 0x15 || Used by nvhost_nvdec_bl020_prod, [5.0.0+] nvhost_nvdec020_prod, [5.0.0+] nvhost_nvdec020_ns and [6.0.0+] nvhost_tsec firmwares. ||
|-
| 0x26 || Used by [[TSEC_Firmware#KeygenLdr|KeygenLdr]]. || No
|-
| 0x3C || Used by nvhost_tsec firmware. ||
|-
| 0x3F || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. || Yes
|}

TSEC

2019-01-07T22:38:13Z

Qlutoo: /* SCP operations */

TSEC (Tegra Security Co-processor) is a dedicated unit powered by a NVIDIA Falcon microprocessor with crypto extensions.

= Driver =
A host driver for communicating with the TSEC is mapped to physical address 0x54500000 with a total size of 0x40000 bytes and exposes several registers.

== Registers ==
Registers from 0x54500000 to 0x54501000 are used to configure the host interface (HOST1X).

Registers from 0x54501000 to 0x54502000 are a MMIO window for communicating with the Falcon microprocessor. From this range, the subset of registers from 0x54501400 to 0x54501FE8 are specific to the TSEC and are subdivided into:
* 0x54501400 to 0x54501500: SCP (Secure Crypto Processor?).
* 0x54501500 to 0x54501600: TRNG (True Random Number Generator).
* 0x54501600 to 0x54501700: TFBIF (Tegra Framebuffer Interface).
* 0x54501700 to 0x54501800: DMA.
* 0x54501800 to 0x54501900: TEGRA (miscellaneous interfaces).

{| class="wikitable" border="1"
! Name
! Address
! Width
|-
| TSEC_THI_INCR_SYNCPT
| 0x54500000
| 0x04
|-
| TSEC_THI_INCR_SYNCPT_ERR
| 0x54500008
| 0x04
|-
| TSEC_THI_CTXSW_INCR_SYNCPT
| 0x5450000C
| 0x04
|-
| TSEC_THI_CTXSW
| 0x54500020
| 0x04
|-
| TSEC_THI_CONT_SYNCPT_EOF
| 0x54500028
| 0x04
|-
| [[#TSEC_THI_METHOD0|TSEC_THI_METHOD0]]
| 0x54500040
| 0x04
|-
| [[#TSEC_THI_METHOD1|TSEC_THI_METHOD1]]
| 0x54500044
| 0x04
|-
| [[#TSEC_THI_INT_STATUS|TSEC_THI_INT_STATUS]]
| 0x54500078
| 0x04
|-
| [[#TSEC_THI_INT_MASK|TSEC_THI_INT_MASK]]
| 0x5450007C
| 0x04
|-
| TSEC_THI_SLCG_STATUS
| 0x54500084
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_HIGH_A
| 0x54500088
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_LOW_A
| 0x5450008C
| 0x04
|-
| TSEC_THI_CLK_OVERRIDE
| 0x54500E00
| 0x04
|-
| [[#FALCON_IRQSSET|FALCON_IRQSSET]]
| 0x54501000
| 0x04
|-
| [[#FALCON_IRQSCLR|FALCON_IRQSCLR]]
| 0x54501004
| 0x04
|-
| [[#FALCON_IRQSTAT|FALCON_IRQSTAT]]
| 0x54501008
| 0x04
|-
| [[#FALCON_IRQMODE|FALCON_IRQMODE]]
| 0x5450100C
| 0x04
|-
| [[#FALCON_IRQMSET|FALCON_IRQMSET]]
| 0x54501010
| 0x04
|-
| [[#FALCON_IRQMCLR|FALCON_IRQMCLR]]
| 0x54501014
| 0x04
|-
| [[#FALCON_IRQMASK|FALCON_IRQMASK]]
| 0x54501018
| 0x04
|-
| [[#FALCON_IRQDEST|FALCON_IRQDEST]]
| 0x5450101C
| 0x04
|-
| FALCON_GPTMR_PERIOD
| 0x54501020
| 0x04
|-
| FALCON_GPTMR_TIME
| 0x54501024
| 0x04
|-
| FALCON_GPTMR_ENABLE
| 0x54501028
| 0x04
|-
| FALCON_TIME_LOW
| 0x5450102C
| 0x04
|-
| FALCON_TIME_HIGH
| 0x54501030
| 0x04
|-
| FALCON_WDTMR_TIME
| 0x54501034
| 0x04
|-
| FALCON_WDTMR_ENABLE
| 0x54501038
| 0x04
|-
| [[#FALCON_SCRATCH0|FALCON_SCRATCH0]]
| 0x54501040
| 0x04
|-
| [[#FALCON_SCRATCH1|FALCON_SCRATCH1]]
| 0x54501044
| 0x04
|-
| [[#FALCON_ITFEN|FALCON_ITFEN]]
| 0x54501048
| 0x04
|-
| [[#FALCON_IDLESTATE|FALCON_IDLESTATE]]
| 0x5450104C
| 0x04
|-
| FALCON_CURCTX
| 0x54501050
| 0x04
|-
| FALCON_NXTCTX
| 0x54501054
| 0x04
|-
| FALCON_CMDCTX
| 0x54501058
| 0x04
|-
| FALCON_STATUS_MASK
| 0x5450105C
| 0x04
|-
| FALCON_VM_SUPERVISOR
| 0x54501060
| 0x04
|-
| FALCON_MTHD_DATA
| 0x54501064
| 0x04
|-
| FALCON_MTHD_CMD
| 0x54501068
| 0x04
|-
| FALCON_MTHD_DATA_WR
| 0x5450106C
| 0x04
|-
| FALCON_MTHD_OCCUPIED
| 0x54501070
| 0x04
|-
| FALCON_MTHD_ACK
| 0x54501074
| 0x04
|-
| FALCON_MTHD_LIMIT
| 0x54501078
| 0x04
|-
| FALCON_SUBENGINE_RESET
| 0x5450107C
| 0x04
|-
| FALCON_SCRATCH2
| 0x54501080
| 0x04
|-
| FALCON_SCRATCH3
| 0x54501084
| 0x04
|-
| FALCON_PM_TRIGGER
| 0x54501088
| 0x04
|-
| FALCON_PM_MODE
| 0x5450108C
| 0x04
|-
| FALCON_DEBUG1
| 0x54501090
| 0x04
|-
| [[#FALCON_DEBUGINFO|FALCON_DEBUGINFO]]
| 0x54501094
| 0x04
|-
| FALCON_BREAKPOINT0
| 0x54501098
| 0x04
|-
| FALCON_BREAKPOINT1
| 0x5450109C
| 0x04
|-
| FALCON_CGCTL
| 0x545010A0
| 0x04
|-
| FALCON_ENGCTL
| 0x545010A4
| 0x04
|-
| FALCON_PM_SEL
| 0x545010A8
| 0x04
|-
| FALCON_HOST_IO_INDEX
| 0x545010AC
| 0x04
|-
| [[#FALCON_EXCI|FALCON_EXCI]]
| 0x545010D0
| 0x04
|-
| [[#FALCON_CPUCTL|FALCON_CPUCTL]]
| 0x54501100
| 0x04
|-
| [[#FALCON_BOOTVEC|FALCON_BOOTVEC]]
| 0x54501104
| 0x04
|-
| [[#FALCON_HWCFG|FALCON_HWCFG]]
| 0x54501108
| 0x04
|-
| [[#FALCON_DMACTL|FALCON_DMACTL]]
| 0x5450110C
| 0x04
|-
| [[#FALCON_DMATRF_EXTBASE|FALCON_DMATRF_EXTBASE]]
| 0x54501110
| 0x04
|-
| [[#FALCON_DMATRF_VOFF|FALCON_DMATRF_VOFF]]
| 0x54501114
| 0x04
|-
| [[#FALCON_DMATRFCMD|FALCON_DMATRFCMD]]
| 0x54501118
| 0x04
|-
| [[#FALCON_DMATRF_POFF|FALCON_DMATRF_POFF]]
| 0x5450111C
| 0x04
|-
| [[#FALCON_DMATRFSTAT|FALCON_DMATRFSTAT]]
| 0x54501120
| 0x04
|-
| [[#FALCON_CRYPTTRFSTAT|FALCON_CRYPTTRFSTAT]]
| 0x54501124
| 0x04
|-
| FALCON_CPUSTAT
| 0x54501128
| 0x04
|-
| [[#FALCON_HWCFG2|FALCON_HWCFG2]]
| 0x5450112C
| 0x04
|-
| FALCON_CPUCTL_ALIAS
| 0x54501130
| 0x04
|-
| FALCON_TLB_CMD
| 0x54501140
| 0x04
|-
| FALCON_TLB_CMD_RES
| 0x54501144
| 0x04
|-
| FALCON_BRANCH_HISTORY_CTRL
| 0x54501148
| 0x04
|-
| FALCON_BRANCH_HISTORY_PC
| 0x5450114C
| 0x04
|-
| FALCON_IMFILLRNG0
| 0x54501150
| 0x04
|-
| FALCON_IMFILLRNG1
| 0x54501154
| 0x04
|-
| FALCON_IMFILLCTL
| 0x54501158
| 0x04
|-
| FALCON_EXTERRWIN
| 0x54501160
| 0x04
|-
| FALCON_EXTERRCFG
| 0x54501164
| 0x04
|-
| FALCON_EXTERRADDR
| 0x54501168
| 0x04
|-
| FALCON_EXTERRSTAT
| 0x5450116C
| 0x04
|-
| FALCON_CG2
| 0x5450117C
| 0x04
|-
| FALCON_CODE_INDEX
| 0x54501180
| 0x04
|-
| FALCON_CODE
| 0x54501184
| 0x04
|-
| FALCON_CODE_VIRT_ADDR
| 0x54501188
| 0x04
|-
| FALCON_DATA_INDEX0
| 0x545011C0
| 0x04
|-
| FALCON_DATA0
| 0x545011C4
| 0x04
|-
| FALCON_DATA_INDEX1
| 0x545011C8
| 0x04
|-
| FALCON_DATA1
| 0x545011CC
| 0x04
|-
| FALCON_DATA_INDEX2
| 0x545011D0
| 0x04
|-
| FALCON_DATA2
| 0x545011D4
| 0x04
|-
| FALCON_DATA_INDEX3
| 0x545011D8
| 0x04
|-
| FALCON_DATA3
| 0x545011DC
| 0x04
|-
| FALCON_DATA_INDEX4
| 0x545011E0
| 0x04
|-
| FALCON_DATA4
| 0x545011E4
| 0x04
|-
| FALCON_DATA_INDEX5
| 0x545011E8
| 0x04
|-
| FALCON_DATA5
| 0x545011EC
| 0x04
|-
| FALCON_DATA_INDEX6
| 0x545011F0
| 0x04
|-
| FALCON_DATA6
| 0x545011F4
| 0x04
|-
| FALCON_DATA_INDEX7
| 0x545011F8
| 0x04
|-
| FALCON_DATA7
| 0x545011FC
| 0x04
|-
| [[#FALCON_ICD_CMD|FALCON_ICD_CMD]]
| 0x54501200
| 0x04
|-
| FALCON_ICD_ADDR
| 0x54501204
| 0x04
|-
| FALCON_ICD_WDATA
| 0x54501208
| 0x04
|-
| FALCON_ICD_RDATA
| 0x5450120C
| 0x04
|-
| [[#FALCON_SCTL|FALCON_SCTL]]
| 0x54501240
| 0x04
|-
| [[#TSEC_SCP_CTL_ACCESS|TSEC_SCP_CTL_ACCESS]]
| 0x54501400
| 0x04
|-
| [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]]
| 0x54501404
| 0x04
|-
| [[#TSEC_SCP_CTL_STAT|TSEC_SCP_CTL_STAT]]
| 0x54501408
| 0x04
|-
| [[#TSEC_SCP_CTL_MODE|TSEC_SCP_CTL_MODE]]
| 0x5450140C
| 0x04
|-
| TSEC_SCP_UNK0
| 0x54501410
| 0x04
|-
| [[#TSEC_SCP_CTL_PKEY|TSEC_SCP_CTL_PKEY]]
| 0x54501418
| 0x04
|-
| [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]]
| 0x54501420
| 0x04
|-
| [[#TSEC_SCP_SEQ_STAT|TSEC_SCP_SEQ_STAT]]
| 0x54501428
| 0x04
|-
| [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]]
| 0x54501430
| 0x04
|-
| TSEC_SCP_UNK2
| 0x54501454
| 0x04
|-
| [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]]
| 0x54501458
| 0x04
|-
| TSEC_SCP_UNK3
| 0x54501470
| 0x04
|-
| [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT]]
| 0x54501480
| 0x04
|-
| [[#TSEC_SCP_IRQMASK|TSEC_SCP_IRQMASK]]
| 0x54501484
| 0x04
|-
| TSEC_SCP_UNK4
| 0x54501490
| 0x04
|-
| [[#TSEC_SCP_ERR|TSEC_SCP_ERR]]
| 0x54501498
| 0x04
|-
| TSEC_TRNG_CLKDIV
| 0x54501500
| 0x04
|-
| TSEC_TRNG_UNK0
| 0x54501504
| 0x04
|-
| TSEC_TRNG_UNK1
| 0x5450150C
| 0x04
|-
| TSEC_TRNG_UNK2
| 0x54501510
| 0x04
|-
| TSEC_TRNG_UNK3
| 0x54501514
| 0x04
|-
| TSEC_TRNG_UNK4
| 0x54501518
| 0x04
|-
| TSEC_TRNG_UNK5
| 0x5450151C
| 0x04
|-
| TSEC_TRNG_UNK6
| 0x54501528
| 0x04
|-
| TSEC_TRNG_UNK7
| 0x5450152C
| 0x04
|-
| TSEC_TFBIF_UNK0
| 0x54501600
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL|TSEC_TFBIF_MCCIF_FIFOCTRL]]
| 0x54501604
| 0x04
|-
| TSEC_TFBIF_UNK1
| 0x54501608
| 0x04
|-
| TSEC_TFBIF_UNK2
| 0x5450160C
| 0x04
|-
| TSEC_TFBIF_UNK3
| 0x54501630
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL1|TSEC_TFBIF_MCCIF_FIFOCTRL1]]
| 0x54501634
| 0x04
|-
| TSEC_TFBIF_UNK4
| 0x54501640
| 0x04
|-
| [[#TSEC_TFBIF_UNK5|TSEC_TFBIF_UNK5]]
| 0x54501644
| 0x04
|-
| [[#TSEC_TFBIF_UNK6|TSEC_TFBIF_UNK6]]
| 0x54501648
| 0x04
|-
| [[#TSEC_DMA_CMD|TSEC_DMA_CMD]]
| 0x54501700
| 0x04
|-
| [[#TSEC_DMA_ADDR|TSEC_DMA_ADDR]]
| 0x54501704
| 0x04
|-
| [[#TSEC_DMA_VAL|TSEC_DMA_VAL]]
| 0x54501708
| 0x04
|-
| [[#TSEC_DMA_UNK|TSEC_DMA_UNK]]
| 0x5450170C
| 0x04
|-
| TSEC_TEGRA_FALCON_IP_VER
| 0x54501800
| 0x04
|-
| TSEC_TEGRA_UNK0
| 0x54501824
| 0x04
|-
| TSEC_TEGRA_UNK1
| 0x54501828
| 0x04
|-
| TSEC_TEGRA_UNK2
| 0x5450182C
| 0x04
|-
| [[#TSEC_TEGRA_CTL|TSEC_TEGRA_CTL]]
| 0x54501838
| 0x04
|}

=== TSEC_THI_METHOD0 ===
{| class="wikitable" border="1"
! ID
! Method
|-
| 0x200
| SET_APPLICATION_ID
|-
| 0x300
| EXECUTE
|-
| 0x500
| HDCP_INIT
|-
| 0x504
| HDCP_CREATE_SESSION
|-
| 0x508
| HDCP_VERIFY_CERT_RX
|-
| 0x50C
| HDCP_GENERATE_EKM
|-
| 0x510
| HDCP_REVOCATION_CHECK
|-
| 0x514
| HDCP_VERIFY_HPRIME
|-
| 0x518
| HDCP_ENCRYPT_PAIRING_INFO
|-
| 0x51C
| HDCP_DECRYPT_PAIRING_INFO
|-
| 0x520
| HDCP_UPDATE_SESSION
|-
| 0x524
| HDCP_GENERATE_LC_INIT
|-
| 0x528
| HDCP_VERIFY_LPRIME
|-
| 0x52C
| HDCP_GENERATE_SKE_INIT
|-
| 0x530
| HDCP_VERIFY_VPRIME
|-
| 0x534
| HDCP_ENCRYPTION_RUN_CTRL
|-
| 0x538
| HDCP_SESSION_CTRL
|-
| 0x53C
| HDCP_COMPUTE_SPRIME
|-
| 0x540
| HDCP_GET_CERT_RX
|-
| 0x544
| HDCP_EXCHANGE_INFO
|-
| 0x548
| HDCP_DECRYPT_KM
|-
| 0x54C
| HDCP_GET_HPRIME
|-
| 0x550
| HDCP_GENERATE_EKH_KM
|-
| 0x554
| HDCP_VERIFY_RTT_CHALLENGE
|-
| 0x558
| HDCP_GET_LPRIME
|-
| 0x55C
| HDCP_DECRYPT_KS
|-
| 0x560
| HDCP_DECRYPT
|-
| 0x564
| HDCP_GET_RRX
|-
| 0x568
| HDCP_DECRYPT_REENCRYPT
|-
| 0x56C
|
|-
| 0x570
|
|-
| 0x574
|
|-
| 0x578
|
|-
| 0x57C
|
|-
| 0x700
| HDCP_VALIDATE_SRM
|-
| 0x704
| HDCP_VALIDATE_STREAM
|-
| 0x708
| HDCP_TEST_SECURE_STATUS
|-
| 0x70C
| HDCP_SET_DCP_KPUB
|-
| 0x710
| HDCP_SET_RX_KPUB
|-
| 0x714
| HDCP_SET_CERT_RX
|-
| 0x718
| HDCP_SET_SCRATCH_BUFFER
|-
| 0x71C
| HDCP_SET_SRM
|-
| 0x720
| HDCP_SET_RECEIVER_ID_LIST
|-
| 0x724
| HDCP_SET_SPRIME
|-
| 0x728
| HDCP_SET_ENC_INPUT_BUFFER
|-
| 0x72C
| HDCP_SET_ENC_OUTPUT_BUFFER
|-
| 0x730
| HDCP_GET_RTT_CHALLENGE
|-
| 0x734
| HDCP_STREAM_MANAGE
|-
| 0x738
| HDCP_READ_CAPS
|-
| 0x73C
| HDCP_ENCRYPT
|-
| 0x740
| [6.0.0+] HDCP_GET_CURRENT_NONCE
|}

Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_METHOD1 ===
Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_INT_STATUS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_STATUS_FALCON_INT
|}

=== TSEC_THI_INT_MASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_MASK_FALCON_INT
|}

=== FALCON_IRQSSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSSET_GPTMR
|-
| 1
| FALCON_IRQSSET_WDTMR
|-
| 2
| FALCON_IRQSSET_MTHD
|-
| 3
| FALCON_IRQSSET_CTXSW
|-
| 4
| FALCON_IRQSSET_HALT
|-
| 5
| FALCON_IRQSSET_EXTERR
|-
| 6
| FALCON_IRQSSET_SWGEN0
|-
| 7
| FALCON_IRQSSET_SWGEN1
|-
| 8-15
| FALCON_IRQSSET_EXT
|}

Used for setting Falcon's IRQs.

=== FALCON_IRQSCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSCLR_GPTMR
|-
| 1
| FALCON_IRQSCLR_WDTMR
|-
| 2
| FALCON_IRQSCLR_MTHD
|-
| 3
| FALCON_IRQSCLR_CTXSW
|-
| 4
| FALCON_IRQSCLR_HALT
|-
| 5
| FALCON_IRQSCLR_EXTERR
|-
| 6
| FALCON_IRQSCLR_SWGEN0
|-
| 7
| FALCON_IRQSCLR_SWGEN1
|-
| 8-15
| FALCON_IRQSCLR_EXT
|}

Used for clearing Falcon's IRQs.

=== FALCON_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSTAT_GPTMR
|-
| 1
| FALCON_IRQSTAT_WDTMR
|-
| 2
| FALCON_IRQSTAT_MTHD
|-
| 3
| FALCON_IRQSTAT_CTXSW
|-
| 4
| FALCON_IRQSTAT_HALT
|-
| 5
| FALCON_IRQSTAT_EXTERR
|-
| 6
| FALCON_IRQSTAT_SWGEN0
|-
| 7
| FALCON_IRQSTAT_SWGEN1
|-
| 8-15
| FALCON_IRQSTAT_EXT
|}

Used for getting the status of Falcon's IRQs.

=== FALCON_IRQMODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMODE_GPTMR
|-
| 1
| FALCON_IRQMODE_WDTMR
|-
| 2
| FALCON_IRQMODE_MTHD
|-
| 3
| FALCON_IRQMODE_CTXSW
|-
| 4
| FALCON_IRQMODE_HALT
|-
| 5
| FALCON_IRQMODE_EXTERR
|-
| 6
| FALCON_IRQMODE_SWGEN0
|-
| 7
| FALCON_IRQMODE_SWGEN1
|-
| 8-15
| FALCON_IRQMODE_EXT
|}

Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.

=== FALCON_IRQMSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMSET_GPTMR
|-
| 1
| FALCON_IRQMSET_WDTMR
|-
| 2
| FALCON_IRQMSET_MTHD
|-
| 3
| FALCON_IRQMSET_CTXSW
|-
| 4
| FALCON_IRQMSET_HALT
|-
| 5
| FALCON_IRQMSET_EXTERR
|-
| 6
| FALCON_IRQMSET_SWGEN0
|-
| 7
| FALCON_IRQMSET_SWGEN1
|-
| 8-15
| FALCON_IRQMSET_EXT
|}

Used for setting the mask for Falcon's IRQs.

=== FALCON_IRQMCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMCLR_GPTMR
|-
| 1
| FALCON_IRQMCLR_WDTMR
|-
| 2
| FALCON_IRQMCLR_MTHD
|-
| 3
| FALCON_IRQMCLR_CTXSW
|-
| 4
| FALCON_IRQMCLR_HALT
|-
| 5
| FALCON_IRQMCLR_EXTERR
|-
| 6
| FALCON_IRQMCLR_SWGEN0
|-
| 7
| FALCON_IRQMCLR_SWGEN1
|-
| 8-15
| FALCON_IRQMCLR_EXT
|}

Used for clearing the mask for Falcon's IRQs.

=== FALCON_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMASK_GPTMR
|-
| 1
| FALCON_IRQMASK_WDTMR
|-
| 2
| FALCON_IRQMASK_MTHD
|-
| 3
| FALCON_IRQMASK_CTXSW
|-
| 4
| FALCON_IRQMASK_HALT
|-
| 5
| FALCON_IRQMASK_EXTERR
|-
| 6
| FALCON_IRQMASK_SWGEN0
|-
| 7
| FALCON_IRQMASK_SWGEN1
|-
| 8-15
| FALCON_IRQMASK_EXT
|}

Used for getting the value of the mask for Falcon's IRQs.

=== FALCON_IRQDEST ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQDEST_HOST_GPTMR
|-
| 1
| FALCON_IRQDEST_HOST_WDTMR
|-
| 2
| FALCON_IRQDEST_HOST_MTHD
|-
| 3
| FALCON_IRQDEST_HOST_CTXSW
|-
| 4
| FALCON_IRQDEST_HOST_HALT
|-
| 5
| FALCON_IRQDEST_HOST_EXTERR
|-
| 6
| FALCON_IRQDEST_HOST_SWGEN0
|-
| 7
| FALCON_IRQDEST_HOST_SWGEN1
|-
| 8-15
| FALCON_IRQDEST_HOST_EXT
|-
| 16
| FALCON_IRQDEST_TARGET_GPTMR
|-
| 17
| FALCON_IRQDEST_TARGET_WDTMR
|-
| 18
| FALCON_IRQDEST_TARGET_MTHD
|-
| 19
| FALCON_IRQDEST_TARGET_CTXSW
|-
| 20
| FALCON_IRQDEST_TARGET_HALT
|-
| 21
| FALCON_IRQDEST_TARGET_EXTERR
|-
| 22
| FALCON_IRQDEST_TARGET_SWGEN0
|-
| 23
| FALCON_IRQDEST_TARGET_SWGEN1
|-
| 24-31
| FALCON_IRQDEST_TARGET_EXT
|}

Used for routing Falcon's IRQs.

=== FALCON_SCRATCH0 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_SCRATCH1 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_ITFEN ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_ITFEN_CTXEN
|-
| 1
| FALCON_ITFEN_MTHDEN
|}

Used for enabling/disabling Falcon interfaces.

=== FALCON_IDLESTATE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IDLESTATE_FALCON_BUSY
|-
| 1-15
| FALCON_IDLESTATE_EXT_BUSY
|}

Used for detecting if Falcon is busy or not.

=== FALCON_DEBUGINFO ===
Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.

[6.0.0+] [[NV_services|nvservices]] sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.

=== FALCON_EXCI ===
Contains information about raised exceptions.

=== FALCON_CPUCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_CPUCTL_IINVAL
|-
| 1
| FALCON_CPUCTL_STARTCPU
|-
| 2
| FALCON_CPUCTL_SRESET
|-
| 3
| FALCON_CPUCTL_HRESET
|-
| 4
| FALCON_CPUCTL_HALTED
|-
| 5
| FALCON_CPUCTL_STOPPED
|-
| 6
| FALCON_CPUCTL_SCP_UNK
|}

Used for signaling the Falcon CPU.

=== FALCON_BOOTVEC ===
Takes the Falcon's boot vector address.

=== FALCON_HWCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-8
| FALCON_HWCFG_IMEM_SIZE
|-
| 9-17
| FALCON_HWCFG_DMEM_SIZE
|-
| 18-25
| FALCON_HWCFG_MTHD_SIZE
|-
| 26-31
| FALCON_HWCFG_DMATRF_SLOTS
|}

=== FALCON_DMACTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMACTL_REQUIRE_CTX
|-
| 1
| FALCON_DMACTL_DMEM_SCRUBBING
|-
| 2
| FALCON_DMACTL_IMEM_SCRUBBING
|-
| 3-6
| FALCON_DMACTL_DMAQ_NUM
|-
| 7
| FALCON_DMACTL_SECURE_STAT
|}

Used for configuring the Falcon's DMA engine.

=== FALCON_DMATRF_EXTBASE ===
Base of the external memory buffer.

The base of the transfer is calculated by adding [[#FALCON_DMATRF_POFF]] to the base.

=== FALCON_DMATRF_VOFF ===
For transfers to DMEM: the destination address.
For transfers to IMEM: the destination virtual IMEM page.

=== FALCON_DMATRF_POFF ===
For transfers to IMEM: the destination physical IMEM page.

=== FALCON_DMATRFCMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFCMD_FULL
|-
| 1
| FALCON_DMATRFCMD_IDLE
|-
| 2-3
| FALCON_DMATRFCMD_SEC
|-
| 4
| FALCON_DMATRFCMD_IMEM
|-
| 5
| FALCON_DMATRFCMD_WRITE
|-
| 8-10
| FALCON_DMATRFCMD_SIZE
|-
| 12-14
| FALCON_DMATRFCMD_CTXDMA
|}

Used for configuring DMA transfers.

=== FALCON_DMATRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFSTAT_PENDING
|-
| 16-18
| FALCON_DMATRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_DMATRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_CRYPTTRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| FALCON_CRYPTTRFSTAT_PENDING
|-
| 5
| FALCON_CRYPTTRFSTAT_ENABLED
|-
| 16-18
| FALCON_CRYPTTRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_CRYPTTRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_HWCFG2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_HWCFG2_VERSION
|-
| 4-5
| FALCON_HWCFG2_SCP_MODE
|-
| 6-7
| FALCON_HWCFG2_SUBVERSION
|-
| 8-11
| FALCON_HWCFG2_IMEM_PORTS
|-
| 12-15
| FALCON_HWCFG2_DMEM_PORTS
|-
| 16-19
| FALCON_HWCFG2_VM_PAGES_LOG2
|}

=== FALCON_ICD_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_ICD_CMD_OPC
0x0: BREAK
0x1: CONTINUE_FROM_PC
0x2: CONTINUE_FROM_ADDR
0x3: CONTINUE_UNK1_FROM_PC
0x4: CONTINUE_UNK1_FROM_ADDR
0x5: SINGLE_STEP_FROM_PC
0x6: SINGLE_STEP_FROM_ADDR
0x7: SET_BREAK_MASK
0x8: REG_READ
0x9: REG_WRITE
0xA: DATA_READ
0xB: DATA_WRITE
0xC: IO_READ
0xD: IO_WRITE
0xE: STATUS_READ
|-
| 6-7
| FALCON_ICD_CMD_DATA_SIZE
|-
| 8-12
| FALCON_ICD_CMD_IDX
|-
| 14
| FALCON_ICD_CMD_ERROR
|-
| 15
| FALCON_ICD_CMD_DONE
|-
| 16-31
| FALCON_ICD_CMD_BREAK_MASK
|}

=== FALCON_SCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| FALCON_SCTL_SEC_MODE
0: Non-secure
1: Light Secure
2: Heavy Secure
|}

=== TSEC_SCP_CTL_ACCESS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| Enable TSEC_SCP_INSN_STAT register
|}

=== TSEC_SCP_CTL_TRNG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 11
| Unknown
|-
| 12
| Enable the TRNG
|}

=== TSEC_SCP_CTL_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| TSEC_SCP_CTL_STAT_DEBUG_MODE
|}

=== TSEC_SCP_CTL_MODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Disable reads for the TRNG register block
|-
| 1
| Disable reads for the TFBIF register block
|-
| 2
| Disable reads for the DMA register block
|-
| 3
| Disable reads for the TEGRA register block
|-
| 4
| Disable writes for the TRNG register block
|-
| 5
| Disable writes for the TFBIF register block
|-
| 6
| Disable writes for the DMA register block
|-
| 7
| Disable writes for the TEGRA register block
|}

Controls accesses to the other sub-engines and can only be cleared in Heavy Secure mode.

=== TSEC_SCP_CTL_PKEY ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
|-
| 1
| TSEC_SCP_CTL_PKEY_LOADED
|}

=== TSEC_SCP_SEQ0_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 8-11
| Size of current cs0begin macro
|-
|}

=== TSEC_SCP_SEQ_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Set if crypto sequence recording (cs0begin/cs1begin) is active
|-
| 4-7
| Number of instructions left for the crypto sequence
|-
| 12-15
| Active crypto key register
|}

Contains information on the last crypto sequence (cs0 or cs1) executed.

=== TSEC_SCP_INSN_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| Crypto fuc5 destination register or immediate value
|-
| 8-15
| Crypto fuc5 source register or immediate value
|-
| 20-24
| Crypto fuc5 operation
0x0: none (fuc5 opcode 0x00)
0x1: cmov (fuc5 opcode 0x84)
0x2: cxsin (fuc5 opcode 0x88) or xdst (with cxset)
0x3: cxsout (fuc5 opcode 0x8C) or xdld (with cxset)
0x4: crng (fuc5 opcode 0x90)
0x5: cs0begin (fuc5 opcode 0x94)
0x6: cs0exec (fuc5 opcode 0x98)
0x7: cs1begin (fuc5 opcode 0x9C)
0x8: cs1exec (fuc5 opcode 0xA0)
0x9: invalid (fuc5 opcode 0xA4)
0xA: cchmod (fuc5 opcode 0xA8)
0xB: cxor (fuc5 opcode 0xAC)
0xC: cadd (fuc5 opcode 0xB0)
0xD: cand (fuc5 opcode 0xB4)
0xE: crev (fuc5 opcode 0xB8)
0xF: cprecmac (fuc5 opcode 0xBC)
0x10: csecret (fuc5 opcode 0xC0)
0x11: ckeyreg (fuc5 opcode 0xC4)
0x12: ckexp (fuc5 opcode 0xC8)
0x13: ckrexp (fuc5 opcode 0xCC)
0x14: cenc (fuc5 opcode 0xD0)
0x15: cdec (fuc5 opcode 0xD4)
0x16: csigauth (fuc5 opcode 0xD8)
0x17: csigenc (fuc5 opcode 0xDC)
0x18: csigclr (fuc5 opcode 0xE0)
|-
| 31
| Set if running in secure mode (cauth)
|}

Contains information on the last crypto instruction executed.

=== TSEC_SCP_AES_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-4
| First opcode
|-
| 5-9
| Second opcode
|-
| 15-16
| AES operation
0: Encryption
1: Decryption
2: Key expansion
3: Key reverse expansion
|}

Contains information on the last AES sequence executed.

=== TSEC_SCP_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQSTAT_TRNG
|-
| 8
| TSEC_SCP_IRQSTAT_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQSTAT_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQSTAT_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the status of crypto IRQs.

=== TSEC_SCP_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQMASK_TRNG
|-
| 8
| TSEC_SCP_IRQMASK_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQMASK_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQMASK_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the value of the mask for crypto IRQs.

=== TSEC_SCP_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Invalid instruction
|-
| 4
| Empty crypto sequence
|-
| 8
| Crypto sequence is too long
|-
| 12
| Crypto sequence was not finished
|-
| 16
| Invalid cauth signature (during csigenc, csigclr or csigunk)
|-
| 24
| Forbidden instruction
|}

Contains information on crypto errors generated by the [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT_INSN_ERROR]] IRQ.

=== TSEC_TFBIF_MCCIF_FIFOCTRL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
|-
| 1
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
|-
| 2
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
|-
| 3
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
|-
| 4
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
|-
| 5
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
|-
| 6
| TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
|-
| 7
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
|-
| 8
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE
|}

=== TSEC_MCCIF_FIFOCTRL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
|-
| 16-31
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT
|}

=== TSEC_TFBIF_UNK5 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.

=== TSEC_TFBIF_UNK6 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to (data_size << 4) before reading memory from the GPU UCODE carveout.

=== TSEC_DMA_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_DMA_CMD_READ
|-
| 1
| TSEC_DMA_CMD_WRITE
|-
| 4-7
| TSEC_DMA_CMD_UNK
|-
| 12
| TSEC_DMA_CMD_BUSY
|-
| 13
| TSEC_DMA_CMD_ERROR
|-
| 31
| TSEC_DMA_CMD_INIT
|}

A DMA read/write operation requires bits TSEC_DMA_CMD_INIT and TSEC_DMA_CMD_READ/TSEC_DMA_CMD_WRITE to be set in TSEC_DMA_CMD.

During the transfer, the TSEC_DMA_CMD_BUSY bit is set.

Accessing an invalid address causes bit TSEC_DMA_CMD_ERROR to be set.

=== TSEC_DMA_ADDR ===
Takes the address for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_VAL ===
Takes the value for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_UNK ===
Always 0xFFF.

=== TSEC_TEGRA_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 16
| TSEC_TEGRA_CTL_TKFI_KFUSE
|-
| 17
| TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
|-
| 24
| TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
|-
| 25
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
|-
| 26
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
|-
| 27
| TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C
|}

== Authenticated Mode ==
===== Entry =====
From non-secure mode, upon jumping to a page marked as secret, a secret fault occurs. This causes the CPU to verify the region specified in $cauth against the MAC loaded in $c6. If the comparison is successful, the valid bit (bit0) is set on all pages in the $cauth region, and $pc is set to the base of the $cauth region. If the comparsion fails, the CPU is halted.

===== Exit =====
The CPU automatically goes back to non-secure mode when returning back into non-secret pages. When this happens, the valid bit (bit0) in the TLB flags is cleared for all secret pages.

===== Implementation =====
Under certain circumstances, it is possible to observe [[#csigauth|csigauth]] being briefly written to [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]] as "csigauth $c4 $c6" while the opcodes in [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]] are set to "cxsin" and "csigauth", respectively.

Via [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]] it can be observed that a 3-sized macro sequence is loaded into cs0 during a secure mode transition.

== Crypto processing ==
Part of the information here (which hasn't made it into envytools documentation yet) was shared by [https://wiki.0x04.net/wiki/Marcin_Ko%C5%9Bcielnicki mwk] from reverse engineering falcon processors over the years.

=== cauth ===
$cauth is a special purpose register in the CPU.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7 || Start of region to authenticate (in 0x100 pages)
|-
| 8-15 || Unused
|-
| 16 || Use secret xfers (?)
|-
| 17 || Region is signed and encrypted and double the size (?)
|-
| 18 ||
|-
| 19 ||
|-
| 20-23 || Unused
|-
| 31-24 || Size of region to authenticate (in 0x100 pages)
|}

== SCP operations ==

{| class="wikitable" border="1"
! Opcode
! Name
! Operand0
! Operand1
! Operation
! Condition
|-
| 0 || || || || ||
|-
| 1 || mov || $cX || $cY || <code>$cX = $cY; ACL(X) = ACL(Y);</code> ||
|-
| 2 || sin || $cX || N/A || <code>$cX = read_stream(); ACL(X) = ???;</code> ||
|-
| 3 || sout || $cX || N/A || <code>write_stream($cX);</code> ||
|-
| 4 || rnd || $cX || N/A || <code>$cX = read_trng(); ACL(X) = ???;</code> ||
|-
| 5 || s0begin || immX || N/A || <code>record_macro_for_N_instructions(0, immX);</code> ||
|-
| 6 || s0exec || immX || N/A || <code>execute_macro_N_times(0, immX);</code> ||
|-
| 7 || s1begin || immX || N/A || <code>record_macro_for_N_instructions(1, immX);</code> ||
|-
| 8 || s1exec || immX || N/A || <code>execute_macro_N_times(1, immX);</code> ||
|-
| 9 || ? || || || ||
|-
| 0xA || chmod || $cX || immY || <code>if (immY & 3) ACL(X) = (ACL(X) & immY) | 1; else ACL(X) = 0;</code> ||
|-
| 0xB || xor || $cX || $cY || <code>$cX ^= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xC || add || $cX || immY || <code>$cX += immY;</code> || <code>(ACL(X) & 2)</code>
|-
| 0xD || and || $cX || $cY || <code>$cX &= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xE || rev || $cX || $cY || <code>$cX = endian_swap128($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 1)</code>
|-
| 0xF || gfmul || $cX || $cY || <code>$cX = gfmul($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 2)</code>
|-
| 0x10 || secret || $cX || immY || <code>$cX = load_secret(immY); ACL(X) = load_secret_acl(immY);</code> ||
|-
| 0x11 || keyreg || immX || || <code>active_key_idx = immX;</code> ||
|-
| 0x12 || kexp || $cX || $cY || <code>$cX = aes_kexp($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 1)</code>
|-
| 0x13 || krexp || $cX || $cY || <code>$cX = aes_kexp_reverse($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 1)</code>
|-
| 0x14 || enc || $cX || $cY || <code>$cX = aes_enc(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 1) && (ACL(Y) & 2)</code>
|-
| 0x15 || dec || $cX || $cY || <code>$cX = aes_dec(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 1) && (ACL(Y) & 2)</code>
|-
| 0x16 || csigauth || $cX || $cY || <code>if (hash_verify($cX, $cY)) { has_sig = true; current_sig = $cX; }</code> || ?
|-
| 0x17 || csigclr || || || <code>has_sig = false;</code> ||
|-
| 0x18 || csigenc || $cX || $cY || <code>if (has_sig) $cX = aes_enc(current_sig, $cY);</code> || ?
|}

=== ACL ===
{| class="wikitable" border="1"
! Bit
! Meaning
|-
| 0 || Readable as key. This is forced set if bit1 is set, the only way to clear it is to clear *both* bit0 and bit1.
|-
| 1 || Readable
|}

==== Initial values ====
On SCP boot, the ACL is 0x1F for all $cX.

Loading into $cX using xdst instruction sets ACL($cX) to 0x1F.

Spilling a $cX to DMEM using xdld instruction is allowed if (ACL($cX) & 2).

=== csigauth ===
<code>00000000: f5 3c XY d8 csigauth $cY $cX</code>

This instruction takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret.

=== csigclr ===
<code>00000000: f5 3c 00 e0 csigclr</code>

This instruction takes no operands and appears to clear the saved cauth signature used by the csigenc instruction.

=== cchmod ===
<code>00000000: f5 3c XY a8 cchmod $cY 0X</code> or <code>00000000: f5 3c XY a9 cchmod $cY 1X</code>

This instruction takes a crypto register and a 5 bit immediate value. It appears to set the [[#Register ACLs|crypto registers' ACL]] bits as follows:
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Allow register to be used as key in NS or LS mode
|-
| 1
| Allow register to be used as key in HS mode
|-
| 2
| Set register as readable in NS or LS mode
|-
| 3
| Set register as readable in HS mode
|-
| 4
| Set register as writable in NS or LS mode
|}

=== crng ===
<code>00000000: f5 3c 0X 90 crng $cX</code>

This instruction initializes a crypto register with random data.

Executing this instruction only succeeds if the TRNG is enabled for the SCP, which requires taking the following steps:
* Write 0x7FFF to TSEC_TRNG_CLKDIV.
* Write 0x3FF0000 to TSEC_TRNG_UNK0.
* Write 0xFF00 to TSEC_TRNG_UNK7.
* Write 0x1000 to [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]].

Otherwise it hangs forever.

=== cxset ===
cxset instruction provides a way to change behavior of a variable amount of successively executed DMA-related instructions.

for example: <code>000000de: f4 3c 02 cxset 0x2</code>

can be read as: <code>dma_override(type=crypto_reg, count=2)</code>

The argument to cxset specifies the type of behavior change in the top 3 bits, and the number of DMA-related instructions the effect lasts for in the lower 5 bits.

{| class=wikitable
! Bits || Description
|-
| 0-4 || Number of instructions it is valid for (0x1f is a special value meaning infinitely many instructions -- until overriden by another cxset)
|-
| 5 || Crypto destination/source select (0=crypto register, 1=crypto stream)
|-
| 6 || External memory override (0=Disabled, 1=Enabled)
|-
| 7 || Internal memory select (0=DMEM, 1=IMEM)
|}

==== DMA-Related Instructions ====
At least the following instructions may have changed behavior, and count against the cxset "count" argument: <code>xdwait</code>, <code>xdst</code>, <code>xdld</code>.

For example, if override type=0b000, then the "length" argument to <code>xdst</code> is instead treated as the index of the target $cX register.

=== Secrets ===
Falcon's Authenticated Mode has access to 64 128-bit keys which are burned at factory. These keys can be loaded by using the $csecret instruction which takes the target crypto register and the key index as arguments.

{| class=wikitable
! Index || Notes || Console-unique
|-
| 0x00 || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares. || No
|-
| 0x01 || Used by nvhost_nvdec_bl020_prod firmware. ||
|-
| 0x03 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x04 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x05 || Used by nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares. ||
|-
| 0x07 || Used by [6.0.0+] nvhost_tsec firmware. ||
|-
| 0x09 || Used by nvhost_tsec firmware. ||
|-
| 0x0B || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x0F || Used by nvhost_tsec firmware. ||
|-
| 0x10 || Used by [1.0.0-5.1.0] nvhost_tsec firmware. ||
|-
| 0x15 || Used by nvhost_nvdec_bl020_prod, [5.0.0+] nvhost_nvdec020_prod, [5.0.0+] nvhost_nvdec020_ns and [6.0.0+] nvhost_tsec firmwares. ||
|-
| 0x26 || Used by [[TSEC_Firmware#KeygenLdr|KeygenLdr]]. || No
|-
| 0x3C || Used by nvhost_tsec firmware. ||
|-
| 0x3F || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. || Yes
|}

TSEC

2019-01-06T12:36:23Z

Qlutoo: /* SCP operations */

TSEC (Tegra Security Co-processor) is a dedicated unit powered by a NVIDIA Falcon microprocessor with crypto extensions.

= Driver =
A host driver for communicating with the TSEC is mapped to physical address 0x54500000 with a total size of 0x40000 bytes and exposes several registers.

== Registers ==
Registers from 0x54500000 to 0x54501000 are used to configure the host interface (HOST1X).

Registers from 0x54501000 to 0x54502000 are a MMIO window for communicating with the Falcon microprocessor. From this range, the subset of registers from 0x54501400 to 0x54501FE8 are specific to the TSEC and are subdivided into:
* 0x54501400 to 0x54501500: SCP (Secure Crypto Processor?).
* 0x54501500 to 0x54501600: TRNG (True Random Number Generator).
* 0x54501600 to 0x54501700: TFBIF (Tegra Framebuffer Interface).
* 0x54501700 to 0x54501800: DMA.
* 0x54501800 to 0x54501900: TEGRA (miscellaneous interfaces).

{| class="wikitable" border="1"
! Name
! Address
! Width
|-
| TSEC_THI_INCR_SYNCPT
| 0x54500000
| 0x04
|-
| TSEC_THI_INCR_SYNCPT_ERR
| 0x54500008
| 0x04
|-
| TSEC_THI_CTXSW_INCR_SYNCPT
| 0x5450000C
| 0x04
|-
| TSEC_THI_CTXSW
| 0x54500020
| 0x04
|-
| TSEC_THI_CONT_SYNCPT_EOF
| 0x54500028
| 0x04
|-
| [[#TSEC_THI_METHOD0|TSEC_THI_METHOD0]]
| 0x54500040
| 0x04
|-
| [[#TSEC_THI_METHOD1|TSEC_THI_METHOD1]]
| 0x54500044
| 0x04
|-
| [[#TSEC_THI_INT_STATUS|TSEC_THI_INT_STATUS]]
| 0x54500078
| 0x04
|-
| [[#TSEC_THI_INT_MASK|TSEC_THI_INT_MASK]]
| 0x5450007C
| 0x04
|-
| TSEC_THI_SLCG_STATUS
| 0x54500084
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_HIGH_A
| 0x54500088
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_LOW_A
| 0x5450008C
| 0x04
|-
| TSEC_THI_CLK_OVERRIDE
| 0x54500E00
| 0x04
|-
| [[#FALCON_IRQSSET|FALCON_IRQSSET]]
| 0x54501000
| 0x04
|-
| [[#FALCON_IRQSCLR|FALCON_IRQSCLR]]
| 0x54501004
| 0x04
|-
| [[#FALCON_IRQSTAT|FALCON_IRQSTAT]]
| 0x54501008
| 0x04
|-
| [[#FALCON_IRQMODE|FALCON_IRQMODE]]
| 0x5450100C
| 0x04
|-
| [[#FALCON_IRQMSET|FALCON_IRQMSET]]
| 0x54501010
| 0x04
|-
| [[#FALCON_IRQMCLR|FALCON_IRQMCLR]]
| 0x54501014
| 0x04
|-
| [[#FALCON_IRQMASK|FALCON_IRQMASK]]
| 0x54501018
| 0x04
|-
| [[#FALCON_IRQDEST|FALCON_IRQDEST]]
| 0x5450101C
| 0x04
|-
| FALCON_GPTMR_PERIOD
| 0x54501020
| 0x04
|-
| FALCON_GPTMR_TIME
| 0x54501024
| 0x04
|-
| FALCON_GPTMR_ENABLE
| 0x54501028
| 0x04
|-
| FALCON_TIME_LOW
| 0x5450102C
| 0x04
|-
| FALCON_TIME_HIGH
| 0x54501030
| 0x04
|-
| FALCON_WDTMR_TIME
| 0x54501034
| 0x04
|-
| FALCON_WDTMR_ENABLE
| 0x54501038
| 0x04
|-
| [[#FALCON_SCRATCH0|FALCON_SCRATCH0]]
| 0x54501040
| 0x04
|-
| [[#FALCON_SCRATCH1|FALCON_SCRATCH1]]
| 0x54501044
| 0x04
|-
| [[#FALCON_ITFEN|FALCON_ITFEN]]
| 0x54501048
| 0x04
|-
| [[#FALCON_IDLESTATE|FALCON_IDLESTATE]]
| 0x5450104C
| 0x04
|-
| FALCON_CURCTX
| 0x54501050
| 0x04
|-
| FALCON_NXTCTX
| 0x54501054
| 0x04
|-
| FALCON_CMDCTX
| 0x54501058
| 0x04
|-
| FALCON_STATUS_MASK
| 0x5450105C
| 0x04
|-
| FALCON_VM_SUPERVISOR
| 0x54501060
| 0x04
|-
| FALCON_MTHD_DATA
| 0x54501064
| 0x04
|-
| FALCON_MTHD_CMD
| 0x54501068
| 0x04
|-
| FALCON_MTHD_DATA_WR
| 0x5450106C
| 0x04
|-
| FALCON_MTHD_OCCUPIED
| 0x54501070
| 0x04
|-
| FALCON_MTHD_ACK
| 0x54501074
| 0x04
|-
| FALCON_MTHD_LIMIT
| 0x54501078
| 0x04
|-
| FALCON_SUBENGINE_RESET
| 0x5450107C
| 0x04
|-
| FALCON_SCRATCH2
| 0x54501080
| 0x04
|-
| FALCON_SCRATCH3
| 0x54501084
| 0x04
|-
| FALCON_PM_TRIGGER
| 0x54501088
| 0x04
|-
| FALCON_PM_MODE
| 0x5450108C
| 0x04
|-
| FALCON_DEBUG1
| 0x54501090
| 0x04
|-
| [[#FALCON_DEBUGINFO|FALCON_DEBUGINFO]]
| 0x54501094
| 0x04
|-
| FALCON_BREAKPOINT0
| 0x54501098
| 0x04
|-
| FALCON_BREAKPOINT1
| 0x5450109C
| 0x04
|-
| FALCON_CGCTL
| 0x545010A0
| 0x04
|-
| FALCON_ENGCTL
| 0x545010A4
| 0x04
|-
| FALCON_PM_SEL
| 0x545010A8
| 0x04
|-
| FALCON_HOST_IO_INDEX
| 0x545010AC
| 0x04
|-
| [[#FALCON_EXCI|FALCON_EXCI]]
| 0x545010D0
| 0x04
|-
| [[#FALCON_CPUCTL|FALCON_CPUCTL]]
| 0x54501100
| 0x04
|-
| [[#FALCON_BOOTVEC|FALCON_BOOTVEC]]
| 0x54501104
| 0x04
|-
| [[#FALCON_HWCFG|FALCON_HWCFG]]
| 0x54501108
| 0x04
|-
| [[#FALCON_DMACTL|FALCON_DMACTL]]
| 0x5450110C
| 0x04
|-
| [[#FALCON_DMATRF_EXTBASE|FALCON_DMATRF_EXTBASE]]
| 0x54501110
| 0x04
|-
| [[#FALCON_DMATRF_VOFF|FALCON_DMATRF_VOFF]]
| 0x54501114
| 0x04
|-
| [[#FALCON_DMATRFCMD|FALCON_DMATRFCMD]]
| 0x54501118
| 0x04
|-
| [[#FALCON_DMATRF_POFF|FALCON_DMATRF_POFF]]
| 0x5450111C
| 0x04
|-
| [[#FALCON_DMATRFSTAT|FALCON_DMATRFSTAT]]
| 0x54501120
| 0x04
|-
| [[#FALCON_CRYPTTRFSTAT|FALCON_CRYPTTRFSTAT]]
| 0x54501124
| 0x04
|-
| FALCON_CPUSTAT
| 0x54501128
| 0x04
|-
| [[#FALCON_HWCFG2|FALCON_HWCFG2]]
| 0x5450112C
| 0x04
|-
| FALCON_CPUCTL_ALIAS
| 0x54501130
| 0x04
|-
| FALCON_TLB_CMD
| 0x54501140
| 0x04
|-
| FALCON_TLB_CMD_RES
| 0x54501144
| 0x04
|-
| FALCON_BRANCH_HISTORY_CTRL
| 0x54501148
| 0x04
|-
| FALCON_BRANCH_HISTORY_PC
| 0x5450114C
| 0x04
|-
| FALCON_IMFILLRNG0
| 0x54501150
| 0x04
|-
| FALCON_IMFILLRNG1
| 0x54501154
| 0x04
|-
| FALCON_IMFILLCTL
| 0x54501158
| 0x04
|-
| FALCON_EXTERRWIN
| 0x54501160
| 0x04
|-
| FALCON_EXTERRCFG
| 0x54501164
| 0x04
|-
| FALCON_EXTERRADDR
| 0x54501168
| 0x04
|-
| FALCON_EXTERRSTAT
| 0x5450116C
| 0x04
|-
| FALCON_CG2
| 0x5450117C
| 0x04
|-
| FALCON_CODE_INDEX
| 0x54501180
| 0x04
|-
| FALCON_CODE
| 0x54501184
| 0x04
|-
| FALCON_CODE_VIRT_ADDR
| 0x54501188
| 0x04
|-
| FALCON_DATA_INDEX0
| 0x545011C0
| 0x04
|-
| FALCON_DATA0
| 0x545011C4
| 0x04
|-
| FALCON_DATA_INDEX1
| 0x545011C8
| 0x04
|-
| FALCON_DATA1
| 0x545011CC
| 0x04
|-
| FALCON_DATA_INDEX2
| 0x545011D0
| 0x04
|-
| FALCON_DATA2
| 0x545011D4
| 0x04
|-
| FALCON_DATA_INDEX3
| 0x545011D8
| 0x04
|-
| FALCON_DATA3
| 0x545011DC
| 0x04
|-
| FALCON_DATA_INDEX4
| 0x545011E0
| 0x04
|-
| FALCON_DATA4
| 0x545011E4
| 0x04
|-
| FALCON_DATA_INDEX5
| 0x545011E8
| 0x04
|-
| FALCON_DATA5
| 0x545011EC
| 0x04
|-
| FALCON_DATA_INDEX6
| 0x545011F0
| 0x04
|-
| FALCON_DATA6
| 0x545011F4
| 0x04
|-
| FALCON_DATA_INDEX7
| 0x545011F8
| 0x04
|-
| FALCON_DATA7
| 0x545011FC
| 0x04
|-
| [[#FALCON_ICD_CMD|FALCON_ICD_CMD]]
| 0x54501200
| 0x04
|-
| FALCON_ICD_ADDR
| 0x54501204
| 0x04
|-
| FALCON_ICD_WDATA
| 0x54501208
| 0x04
|-
| FALCON_ICD_RDATA
| 0x5450120C
| 0x04
|-
| [[#FALCON_SCTL|FALCON_SCTL]]
| 0x54501240
| 0x04
|-
| [[#TSEC_SCP_CTL_ACCESS|TSEC_SCP_CTL_ACCESS]]
| 0x54501400
| 0x04
|-
| [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]]
| 0x54501404
| 0x04
|-
| [[#TSEC_SCP_CTL_STAT|TSEC_SCP_CTL_STAT]]
| 0x54501408
| 0x04
|-
| [[#TSEC_SCP_CTL_MODE|TSEC_SCP_CTL_MODE]]
| 0x5450140C
| 0x04
|-
| TSEC_SCP_UNK0
| 0x54501410
| 0x04
|-
| [[#TSEC_SCP_CTL_PKEY|TSEC_SCP_CTL_PKEY]]
| 0x54501418
| 0x04
|-
| [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]]
| 0x54501420
| 0x04
|-
| [[#TSEC_SCP_SEQ_STAT|TSEC_SCP_SEQ_STAT]]
| 0x54501428
| 0x04
|-
| [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]]
| 0x54501430
| 0x04
|-
| TSEC_SCP_UNK2
| 0x54501454
| 0x04
|-
| [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]]
| 0x54501458
| 0x04
|-
| TSEC_SCP_UNK3
| 0x54501470
| 0x04
|-
| [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT]]
| 0x54501480
| 0x04
|-
| [[#TSEC_SCP_IRQMASK|TSEC_SCP_IRQMASK]]
| 0x54501484
| 0x04
|-
| TSEC_SCP_UNK4
| 0x54501490
| 0x04
|-
| [[#TSEC_SCP_ERR|TSEC_SCP_ERR]]
| 0x54501498
| 0x04
|-
| TSEC_TRNG_CLKDIV
| 0x54501500
| 0x04
|-
| TSEC_TRNG_UNK0
| 0x54501504
| 0x04
|-
| TSEC_TRNG_UNK1
| 0x5450150C
| 0x04
|-
| TSEC_TRNG_UNK2
| 0x54501510
| 0x04
|-
| TSEC_TRNG_UNK3
| 0x54501514
| 0x04
|-
| TSEC_TRNG_UNK4
| 0x54501518
| 0x04
|-
| TSEC_TRNG_UNK5
| 0x5450151C
| 0x04
|-
| TSEC_TRNG_UNK6
| 0x54501528
| 0x04
|-
| TSEC_TRNG_UNK7
| 0x5450152C
| 0x04
|-
| TSEC_TFBIF_UNK0
| 0x54501600
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL|TSEC_TFBIF_MCCIF_FIFOCTRL]]
| 0x54501604
| 0x04
|-
| TSEC_TFBIF_UNK1
| 0x54501608
| 0x04
|-
| TSEC_TFBIF_UNK2
| 0x5450160C
| 0x04
|-
| TSEC_TFBIF_UNK3
| 0x54501630
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL1|TSEC_TFBIF_MCCIF_FIFOCTRL1]]
| 0x54501634
| 0x04
|-
| TSEC_TFBIF_UNK4
| 0x54501640
| 0x04
|-
| [[#TSEC_TFBIF_UNK5|TSEC_TFBIF_UNK5]]
| 0x54501644
| 0x04
|-
| [[#TSEC_TFBIF_UNK6|TSEC_TFBIF_UNK6]]
| 0x54501648
| 0x04
|-
| [[#TSEC_DMA_CMD|TSEC_DMA_CMD]]
| 0x54501700
| 0x04
|-
| [[#TSEC_DMA_ADDR|TSEC_DMA_ADDR]]
| 0x54501704
| 0x04
|-
| [[#TSEC_DMA_VAL|TSEC_DMA_VAL]]
| 0x54501708
| 0x04
|-
| [[#TSEC_DMA_UNK|TSEC_DMA_UNK]]
| 0x5450170C
| 0x04
|-
| TSEC_TEGRA_FALCON_IP_VER
| 0x54501800
| 0x04
|-
| TSEC_TEGRA_UNK0
| 0x54501824
| 0x04
|-
| TSEC_TEGRA_UNK1
| 0x54501828
| 0x04
|-
| TSEC_TEGRA_UNK2
| 0x5450182C
| 0x04
|-
| [[#TSEC_TEGRA_CTL|TSEC_TEGRA_CTL]]
| 0x54501838
| 0x04
|}

=== TSEC_THI_METHOD0 ===
{| class="wikitable" border="1"
! ID
! Method
|-
| 0x200
| SET_APPLICATION_ID
|-
| 0x300
| EXECUTE
|-
| 0x500
| HDCP_INIT
|-
| 0x504
| HDCP_CREATE_SESSION
|-
| 0x508
| HDCP_VERIFY_CERT_RX
|-
| 0x50C
| HDCP_GENERATE_EKM
|-
| 0x510
| HDCP_REVOCATION_CHECK
|-
| 0x514
| HDCP_VERIFY_HPRIME
|-
| 0x518
| HDCP_ENCRYPT_PAIRING_INFO
|-
| 0x51C
| HDCP_DECRYPT_PAIRING_INFO
|-
| 0x520
| HDCP_UPDATE_SESSION
|-
| 0x524
| HDCP_GENERATE_LC_INIT
|-
| 0x528
| HDCP_VERIFY_LPRIME
|-
| 0x52C
| HDCP_GENERATE_SKE_INIT
|-
| 0x530
| HDCP_VERIFY_VPRIME
|-
| 0x534
| HDCP_ENCRYPTION_RUN_CTRL
|-
| 0x538
| HDCP_SESSION_CTRL
|-
| 0x53C
| HDCP_COMPUTE_SPRIME
|-
| 0x540
| HDCP_GET_CERT_RX
|-
| 0x544
| HDCP_EXCHANGE_INFO
|-
| 0x548
| HDCP_DECRYPT_KM
|-
| 0x54C
| HDCP_GET_HPRIME
|-
| 0x550
| HDCP_GENERATE_EKH_KM
|-
| 0x554
| HDCP_VERIFY_RTT_CHALLENGE
|-
| 0x558
| HDCP_GET_LPRIME
|-
| 0x55C
| HDCP_DECRYPT_KS
|-
| 0x560
| HDCP_DECRYPT
|-
| 0x564
| HDCP_GET_RRX
|-
| 0x568
| HDCP_DECRYPT_REENCRYPT
|-
| 0x56C
|
|-
| 0x570
|
|-
| 0x574
|
|-
| 0x578
|
|-
| 0x57C
|
|-
| 0x700
| HDCP_VALIDATE_SRM
|-
| 0x704
| HDCP_VALIDATE_STREAM
|-
| 0x708
| HDCP_TEST_SECURE_STATUS
|-
| 0x70C
| HDCP_SET_DCP_KPUB
|-
| 0x710
| HDCP_SET_RX_KPUB
|-
| 0x714
| HDCP_SET_CERT_RX
|-
| 0x718
| HDCP_SET_SCRATCH_BUFFER
|-
| 0x71C
| HDCP_SET_SRM
|-
| 0x720
| HDCP_SET_RECEIVER_ID_LIST
|-
| 0x724
| HDCP_SET_SPRIME
|-
| 0x728
| HDCP_SET_ENC_INPUT_BUFFER
|-
| 0x72C
| HDCP_SET_ENC_OUTPUT_BUFFER
|-
| 0x730
| HDCP_GET_RTT_CHALLENGE
|-
| 0x734
| HDCP_STREAM_MANAGE
|-
| 0x738
| HDCP_READ_CAPS
|-
| 0x73C
| HDCP_ENCRYPT
|-
| 0x740
| [6.0.0+] HDCP_GET_CURRENT_NONCE
|}

Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_METHOD1 ===
Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_INT_STATUS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_STATUS_FALCON_INT
|}

=== TSEC_THI_INT_MASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_MASK_FALCON_INT
|}

=== FALCON_IRQSSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSSET_GPTMR
|-
| 1
| FALCON_IRQSSET_WDTMR
|-
| 2
| FALCON_IRQSSET_MTHD
|-
| 3
| FALCON_IRQSSET_CTXSW
|-
| 4
| FALCON_IRQSSET_HALT
|-
| 5
| FALCON_IRQSSET_EXTERR
|-
| 6
| FALCON_IRQSSET_SWGEN0
|-
| 7
| FALCON_IRQSSET_SWGEN1
|-
| 8-15
| FALCON_IRQSSET_EXT
|}

Used for setting Falcon's IRQs.

=== FALCON_IRQSCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSCLR_GPTMR
|-
| 1
| FALCON_IRQSCLR_WDTMR
|-
| 2
| FALCON_IRQSCLR_MTHD
|-
| 3
| FALCON_IRQSCLR_CTXSW
|-
| 4
| FALCON_IRQSCLR_HALT
|-
| 5
| FALCON_IRQSCLR_EXTERR
|-
| 6
| FALCON_IRQSCLR_SWGEN0
|-
| 7
| FALCON_IRQSCLR_SWGEN1
|-
| 8-15
| FALCON_IRQSCLR_EXT
|}

Used for clearing Falcon's IRQs.

=== FALCON_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSTAT_GPTMR
|-
| 1
| FALCON_IRQSTAT_WDTMR
|-
| 2
| FALCON_IRQSTAT_MTHD
|-
| 3
| FALCON_IRQSTAT_CTXSW
|-
| 4
| FALCON_IRQSTAT_HALT
|-
| 5
| FALCON_IRQSTAT_EXTERR
|-
| 6
| FALCON_IRQSTAT_SWGEN0
|-
| 7
| FALCON_IRQSTAT_SWGEN1
|-
| 8-15
| FALCON_IRQSTAT_EXT
|}

Used for getting the status of Falcon's IRQs.

=== FALCON_IRQMODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMODE_GPTMR
|-
| 1
| FALCON_IRQMODE_WDTMR
|-
| 2
| FALCON_IRQMODE_MTHD
|-
| 3
| FALCON_IRQMODE_CTXSW
|-
| 4
| FALCON_IRQMODE_HALT
|-
| 5
| FALCON_IRQMODE_EXTERR
|-
| 6
| FALCON_IRQMODE_SWGEN0
|-
| 7
| FALCON_IRQMODE_SWGEN1
|-
| 8-15
| FALCON_IRQMODE_EXT
|}

Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.

=== FALCON_IRQMSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMSET_GPTMR
|-
| 1
| FALCON_IRQMSET_WDTMR
|-
| 2
| FALCON_IRQMSET_MTHD
|-
| 3
| FALCON_IRQMSET_CTXSW
|-
| 4
| FALCON_IRQMSET_HALT
|-
| 5
| FALCON_IRQMSET_EXTERR
|-
| 6
| FALCON_IRQMSET_SWGEN0
|-
| 7
| FALCON_IRQMSET_SWGEN1
|-
| 8-15
| FALCON_IRQMSET_EXT
|}

Used for setting the mask for Falcon's IRQs.

=== FALCON_IRQMCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMCLR_GPTMR
|-
| 1
| FALCON_IRQMCLR_WDTMR
|-
| 2
| FALCON_IRQMCLR_MTHD
|-
| 3
| FALCON_IRQMCLR_CTXSW
|-
| 4
| FALCON_IRQMCLR_HALT
|-
| 5
| FALCON_IRQMCLR_EXTERR
|-
| 6
| FALCON_IRQMCLR_SWGEN0
|-
| 7
| FALCON_IRQMCLR_SWGEN1
|-
| 8-15
| FALCON_IRQMCLR_EXT
|}

Used for clearing the mask for Falcon's IRQs.

=== FALCON_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMASK_GPTMR
|-
| 1
| FALCON_IRQMASK_WDTMR
|-
| 2
| FALCON_IRQMASK_MTHD
|-
| 3
| FALCON_IRQMASK_CTXSW
|-
| 4
| FALCON_IRQMASK_HALT
|-
| 5
| FALCON_IRQMASK_EXTERR
|-
| 6
| FALCON_IRQMASK_SWGEN0
|-
| 7
| FALCON_IRQMASK_SWGEN1
|-
| 8-15
| FALCON_IRQMASK_EXT
|}

Used for getting the value of the mask for Falcon's IRQs.

=== FALCON_IRQDEST ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQDEST_HOST_GPTMR
|-
| 1
| FALCON_IRQDEST_HOST_WDTMR
|-
| 2
| FALCON_IRQDEST_HOST_MTHD
|-
| 3
| FALCON_IRQDEST_HOST_CTXSW
|-
| 4
| FALCON_IRQDEST_HOST_HALT
|-
| 5
| FALCON_IRQDEST_HOST_EXTERR
|-
| 6
| FALCON_IRQDEST_HOST_SWGEN0
|-
| 7
| FALCON_IRQDEST_HOST_SWGEN1
|-
| 8-15
| FALCON_IRQDEST_HOST_EXT
|-
| 16
| FALCON_IRQDEST_TARGET_GPTMR
|-
| 17
| FALCON_IRQDEST_TARGET_WDTMR
|-
| 18
| FALCON_IRQDEST_TARGET_MTHD
|-
| 19
| FALCON_IRQDEST_TARGET_CTXSW
|-
| 20
| FALCON_IRQDEST_TARGET_HALT
|-
| 21
| FALCON_IRQDEST_TARGET_EXTERR
|-
| 22
| FALCON_IRQDEST_TARGET_SWGEN0
|-
| 23
| FALCON_IRQDEST_TARGET_SWGEN1
|-
| 24-31
| FALCON_IRQDEST_TARGET_EXT
|}

Used for routing Falcon's IRQs.

=== FALCON_SCRATCH0 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_SCRATCH1 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_ITFEN ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_ITFEN_CTXEN
|-
| 1
| FALCON_ITFEN_MTHDEN
|}

Used for enabling/disabling Falcon interfaces.

=== FALCON_IDLESTATE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IDLESTATE_FALCON_BUSY
|-
| 1-15
| FALCON_IDLESTATE_EXT_BUSY
|}

Used for detecting if Falcon is busy or not.

=== FALCON_DEBUGINFO ===
Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.

[6.0.0+] [[NV_services|nvservices]] sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.

=== FALCON_EXCI ===
Contains information about raised exceptions.

=== FALCON_CPUCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_CPUCTL_IINVAL
|-
| 1
| FALCON_CPUCTL_STARTCPU
|-
| 2
| FALCON_CPUCTL_SRESET
|-
| 3
| FALCON_CPUCTL_HRESET
|-
| 4
| FALCON_CPUCTL_HALTED
|-
| 5
| FALCON_CPUCTL_STOPPED
|-
| 6
| FALCON_CPUCTL_SCP_UNK
|}

Used for signaling the Falcon CPU.

=== FALCON_BOOTVEC ===
Takes the Falcon's boot vector address.

=== FALCON_HWCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-8
| FALCON_HWCFG_IMEM_SIZE
|-
| 9-17
| FALCON_HWCFG_DMEM_SIZE
|-
| 18-25
| FALCON_HWCFG_MTHD_SIZE
|-
| 26-31
| FALCON_HWCFG_DMATRF_SLOTS
|}

=== FALCON_DMACTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMACTL_REQUIRE_CTX
|-
| 1
| FALCON_DMACTL_DMEM_SCRUBBING
|-
| 2
| FALCON_DMACTL_IMEM_SCRUBBING
|-
| 3-6
| FALCON_DMACTL_DMAQ_NUM
|-
| 7
| FALCON_DMACTL_SECURE_STAT
|}

Used for configuring the Falcon's DMA engine.

=== FALCON_DMATRF_EXTBASE ===
Base of the external memory buffer.

The base of the transfer is calculated by adding [[#FALCON_DMATRF_POFF]] to the base.

=== FALCON_DMATRF_VOFF ===
For transfers to DMEM: the destination address.
For transfers to IMEM: the destination virtual IMEM page.

=== FALCON_DMATRF_POFF ===
For transfers to IMEM: the destination physical IMEM page.

=== FALCON_DMATRFCMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFCMD_FULL
|-
| 1
| FALCON_DMATRFCMD_IDLE
|-
| 2-3
| FALCON_DMATRFCMD_SEC
|-
| 4
| FALCON_DMATRFCMD_IMEM
|-
| 5
| FALCON_DMATRFCMD_WRITE
|-
| 8-10
| FALCON_DMATRFCMD_SIZE
|-
| 12-14
| FALCON_DMATRFCMD_CTXDMA
|}

Used for configuring DMA transfers.

=== FALCON_DMATRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFSTAT_PENDING
|-
| 16-18
| FALCON_DMATRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_DMATRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_CRYPTTRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| FALCON_CRYPTTRFSTAT_PENDING
|-
| 5
| FALCON_CRYPTTRFSTAT_ENABLED
|-
| 16-18
| FALCON_CRYPTTRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_CRYPTTRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_HWCFG2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_HWCFG2_VERSION
|-
| 4-5
| FALCON_HWCFG2_SCP_MODE
|-
| 6-7
| FALCON_HWCFG2_SUBVERSION
|-
| 8-11
| FALCON_HWCFG2_IMEM_PORTS
|-
| 12-15
| FALCON_HWCFG2_DMEM_PORTS
|-
| 16-19
| FALCON_HWCFG2_VM_PAGES_LOG2
|}

=== FALCON_ICD_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_ICD_CMD_OPC
0x0: BREAK
0x1: CONTINUE_FROM_PC
0x2: CONTINUE_FROM_ADDR
0x3: CONTINUE_UNK1_FROM_PC
0x4: CONTINUE_UNK1_FROM_ADDR
0x5: SINGLE_STEP_FROM_PC
0x6: SINGLE_STEP_FROM_ADDR
0x7: SET_BREAK_MASK
0x8: REG_READ
0x9: REG_WRITE
0xA: DATA_READ
0xB: DATA_WRITE
0xC: IO_READ
0xD: IO_WRITE
0xE: STATUS_READ
|-
| 6-7
| FALCON_ICD_CMD_DATA_SIZE
|-
| 8-12
| FALCON_ICD_CMD_IDX
|-
| 14
| FALCON_ICD_CMD_ERROR
|-
| 15
| FALCON_ICD_CMD_DONE
|-
| 16-31
| FALCON_ICD_CMD_BREAK_MASK
|}

=== FALCON_SCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| FALCON_SCTL_SEC_MODE
0: Non-secure
1: Light Secure
2: Heavy Secure
|}

=== TSEC_SCP_CTL_ACCESS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| Enable TSEC_SCP_INSN_STAT register
|}

=== TSEC_SCP_CTL_TRNG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 11
| Unknown
|-
| 12
| Enable the TRNG
|}

=== TSEC_SCP_CTL_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| TSEC_SCP_CTL_STAT_DEBUG_MODE
|}

=== TSEC_SCP_CTL_MODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Disable reads for the TRNG register block
|-
| 1
| Disable reads for the TFBIF register block
|-
| 2
| Disable reads for the DMA register block
|-
| 3
| Disable reads for the TEGRA register block
|-
| 4
| Disable writes for the TRNG register block
|-
| 5
| Disable writes for the TFBIF register block
|-
| 6
| Disable writes for the DMA register block
|-
| 7
| Disable writes for the TEGRA register block
|}

Controls accesses to the other sub-engines and can only be cleared in Heavy Secure mode.

=== TSEC_SCP_CTL_PKEY ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
|-
| 1
| TSEC_SCP_CTL_PKEY_LOADED
|}

=== TSEC_SCP_SEQ0_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 8-11
| Size of current cs0begin macro
|-
|}

=== TSEC_SCP_SEQ_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Set if crypto sequence recording (cs0begin/cs1begin) is active
|-
| 4-7
| Number of instructions left for the crypto sequence
|-
| 12-15
| Active crypto key register
|}

Contains information on the last crypto sequence (cs0 or cs1) executed.

=== TSEC_SCP_INSN_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| Crypto fuc5 destination register or immediate value
|-
| 8-15
| Crypto fuc5 source register or immediate value
|-
| 20-24
| Crypto fuc5 operation
0x0: none (fuc5 opcode 0x00)
0x1: cmov (fuc5 opcode 0x84)
0x2: cxsin (fuc5 opcode 0x88) or xdst (with cxset)
0x3: cxsout (fuc5 opcode 0x8C) or xdld (with cxset)
0x4: crng (fuc5 opcode 0x90)
0x5: cs0begin (fuc5 opcode 0x94)
0x6: cs0exec (fuc5 opcode 0x98)
0x7: cs1begin (fuc5 opcode 0x9C)
0x8: cs1exec (fuc5 opcode 0xA0)
0x9: invalid (fuc5 opcode 0xA4)
0xA: cchmod (fuc5 opcode 0xA8)
0xB: cxor (fuc5 opcode 0xAC)
0xC: cadd (fuc5 opcode 0xB0)
0xD: cand (fuc5 opcode 0xB4)
0xE: crev (fuc5 opcode 0xB8)
0xF: cprecmac (fuc5 opcode 0xBC)
0x10: csecret (fuc5 opcode 0xC0)
0x11: ckeyreg (fuc5 opcode 0xC4)
0x12: ckexp (fuc5 opcode 0xC8)
0x13: ckrexp (fuc5 opcode 0xCC)
0x14: cenc (fuc5 opcode 0xD0)
0x15: cdec (fuc5 opcode 0xD4)
0x16: csigauth (fuc5 opcode 0xD8)
0x17: csigenc (fuc5 opcode 0xDC)
0x18: csigclr (fuc5 opcode 0xE0)
|-
| 31
| Set if running in secure mode (cauth)
|}

Contains information on the last crypto instruction executed.

=== TSEC_SCP_AES_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-4
| First opcode
|-
| 5-9
| Second opcode
|-
| 15-16
| AES operation
0: Encryption
1: Decryption
2: Key expansion
3: Key reverse expansion
|}

Contains information on the last AES sequence executed.

=== TSEC_SCP_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQSTAT_TRNG
|-
| 8
| TSEC_SCP_IRQSTAT_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQSTAT_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQSTAT_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the status of crypto IRQs.

=== TSEC_SCP_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQMASK_TRNG
|-
| 8
| TSEC_SCP_IRQMASK_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQMASK_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQMASK_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the value of the mask for crypto IRQs.

=== TSEC_SCP_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Invalid instruction
|-
| 4
| Empty crypto sequence
|-
| 8
| Crypto sequence is too long
|-
| 12
| Crypto sequence was not finished
|-
| 16
| Invalid cauth signature (during csigenc, csigclr or csigunk)
|-
| 24
| Forbidden instruction
|}

Contains information on crypto errors generated by the [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT_INSN_ERROR]] IRQ.

=== TSEC_TFBIF_MCCIF_FIFOCTRL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
|-
| 1
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
|-
| 2
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
|-
| 3
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
|-
| 4
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
|-
| 5
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
|-
| 6
| TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
|-
| 7
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
|-
| 8
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE
|}

=== TSEC_MCCIF_FIFOCTRL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
|-
| 16-31
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT
|}

=== TSEC_TFBIF_UNK5 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.

=== TSEC_TFBIF_UNK6 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to (data_size << 4) before reading memory from the GPU UCODE carveout.

=== TSEC_DMA_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_DMA_CMD_READ
|-
| 1
| TSEC_DMA_CMD_WRITE
|-
| 4-7
| TSEC_DMA_CMD_UNK
|-
| 12
| TSEC_DMA_CMD_BUSY
|-
| 13
| TSEC_DMA_CMD_ERROR
|-
| 31
| TSEC_DMA_CMD_INIT
|}

A DMA read/write operation requires bits TSEC_DMA_CMD_INIT and TSEC_DMA_CMD_READ/TSEC_DMA_CMD_WRITE to be set in TSEC_DMA_CMD.

During the transfer, the TSEC_DMA_CMD_BUSY bit is set.

Accessing an invalid address causes bit TSEC_DMA_CMD_ERROR to be set.

=== TSEC_DMA_ADDR ===
Takes the address for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_VAL ===
Takes the value for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_UNK ===
Always 0xFFF.

=== TSEC_TEGRA_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 16
| TSEC_TEGRA_CTL_TKFI_KFUSE
|-
| 17
| TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
|-
| 24
| TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
|-
| 25
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
|-
| 26
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
|-
| 27
| TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C
|}

== Authenticated Mode ==
===== Entry =====
From non-secure mode, upon jumping to a page marked as secret, a secret fault occurs. This causes the CPU to verify the region specified in $cauth against the MAC loaded in $c6. If the comparison is successful, the valid bit (bit0) is set on all pages in the $cauth region, and $pc is set to the base of the $cauth region. If the comparsion fails, the CPU is halted.

===== Exit =====
The CPU automatically goes back to non-secure mode when returning back into non-secret pages. When this happens, the valid bit (bit0) in the TLB flags is cleared for all secret pages.

===== Implementation =====
Under certain circumstances, it is possible to observe [[#csigauth|csigauth]] being briefly written to [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]] as "csigauth $c4 $c6" while the opcodes in [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]] are set to "cxsin" and "csigauth", respectively.

Via [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]] it can be observed that a 3-sized macro sequence is loaded into cs0 during a secure mode transition.

== Crypto processing ==
Part of the information here (which hasn't made it into envytools documentation yet) was shared by [https://wiki.0x04.net/wiki/Marcin_Ko%C5%9Bcielnicki mwk] from reverse engineering falcon processors over the years.

=== cauth ===
$cauth is a special purpose register in the CPU.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7 || Start of region to authenticate (in 0x100 pages)
|-
| 8-15 || Unused
|-
| 16 || Use secret xfers (?)
|-
| 17 || Region is signed and encrypted and double the size (?)
|-
| 18 ||
|-
| 19 ||
|-
| 20-23 || Unused
|-
| 31-24 || Size of region to authenticate (in 0x100 pages)
|}

== SCP operations ==

{| class="wikitable" border="1"
! Opcode
! Name
! Operand0
! Operand1
! Operation
! Condition
|-
| 0 || || || || ||
|-
| 1 || mov || $cX || $cY || <code>$cX = $cY; ACL(X) = ACL(Y);</code> ||
|-
| 2 || sin || $cX || N/A || <code>$cX = read_stream(); ACL(X) = ???;</code> ||
|-
| 3 || sout || $cX || N/A || <code>write_stream($cX);</code> ||
|-
| 4 || rnd || $cX || N/A || <code>$cX = read_trng(); ACL(X) = ???;</code> ||
|-
| 5 || s0begin || immX || N/A || <code>record_macro_for_N_instructions(0, immX);</code> ||
|-
| 6 || s0exec || immX || N/A || <code>execute_macro_N_times(0, immX);</code> ||
|-
| 7 || s1begin || immX || N/A || <code>record_macro_for_N_instructions(1, immX);</code> ||
|-
| 8 || s1exec || immX || N/A || <code>execute_macro_N_times(1, immX);</code> ||
|-
| 9 || ? || || || ||
|-
| 0xA || chmod || $cX || immY || <code>if (immY & 3) ACL(X) = (ACL(X) & immY) | 1; else ACL(X) = 0;</code> ||
|-
| 0xB || xor || $cX || $cY || <code>$cX ^= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xC || add || $cX || immY || <code>$cX += immY;</code> || <code>(ACL(X) & 2)</code>
|-
| 0xD || and || $cX || $cY || <code>$cX &= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xE || rev || $cX || $cY || <code>$cX = endian_swap128($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 1)</code>
|-
| 0xF || gfmul || $cX || $cY || <code>$cX = gfmul($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 2)</code>
|-
| 0x10 || secret || $cX || immY || <code>$cX = load_secret(immY); ACL(X) = load_secret_acl(immY);</code> ||
|-
| 0x11 || keyreg || immX || || <code>active_key_idx = immX;</code> ||
|-
| 0x12 || kexp || $cX || $cY || <code>$cX = aes_kexp($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 1)</code>
|-
| 0x13 || krexp || $cX || $cY || <code>$cX = aes_kexp_reverse($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 1)</code>
|-
| 0x14 || enc || $cX || $cY || <code>$cX = aes_enc(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 1) && (ACL(Y) & 2)</code>
|-
| 0x15 || dec || $cX || $cY || <code>$cX = aes_dec(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 1) && (ACL(Y) & 2)</code>
|-
| ...
|}

=== ACL ===
{| class="wikitable" border="1"
! Bit
! Meaning
|-
| 0 || Readable as key. This is forced set if bit1 is set, the only way to clear it is to clear *both* bit0 and bit1.
|-
| 1 || Readable
|}

==== Initial values ====
On SCP boot, the ACL is 0x1F for all $cX.

Loading into $cX using xdst instruction sets ACL($cX) to 0x1F.

Spilling a $cX to DMEM using xdld instruction is allowed if (ACL($cX) & 2).

=== csigauth ===
<code>00000000: f5 3c XY d8 csigauth $cY $cX</code>

This instruction takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret.

=== csigclr ===
<code>00000000: f5 3c 00 e0 csigclr</code>

This instruction takes no operands and appears to clear the saved cauth signature used by the csigenc instruction.

=== cchmod ===
<code>00000000: f5 3c XY a8 cchmod $cY 0X</code> or <code>00000000: f5 3c XY a9 cchmod $cY 1X</code>

This instruction takes a crypto register and a 5 bit immediate value. It appears to set the [[#Register ACLs|crypto registers' ACL]] bits as follows:
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Allow register to be used as key in NS or LS mode
|-
| 1
| Allow register to be used as key in HS mode
|-
| 2
| Set register as readable in NS or LS mode
|-
| 3
| Set register as readable in HS mode
|-
| 4
| Set register as writable in NS or LS mode
|}

=== crng ===
<code>00000000: f5 3c 0X 90 crng $cX</code>

This instruction initializes a crypto register with random data.

Executing this instruction only succeeds if the TRNG is enabled for the SCP, which requires taking the following steps:
* Write 0x7FFF to TSEC_TRNG_CLKDIV.
* Write 0x3FF0000 to TSEC_TRNG_UNK0.
* Write 0xFF00 to TSEC_TRNG_UNK7.
* Write 0x1000 to [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]].

Otherwise it hangs forever.

=== cxset ===
cxset instruction provides a way to change behavior of a variable amount of successively executed DMA-related instructions.

for example: <code>000000de: f4 3c 02 cxset 0x2</code>

can be read as: <code>dma_override(type=crypto_reg, count=2)</code>

The argument to cxset specifies the type of behavior change in the top 3 bits, and the number of DMA-related instructions the effect lasts for in the lower 5 bits.

{| class=wikitable
! Bits || Description
|-
| 0-4 || Number of instructions it is valid for (0x1f is a special value meaning infinitely many instructions -- until overriden by another cxset)
|-
| 5 || Crypto destination/source select (0=crypto register, 1=crypto stream)
|-
| 6 || External memory override (0=Disabled, 1=Enabled)
|-
| 7 || Internal memory select (0=DMEM, 1=IMEM)
|}

==== DMA-Related Instructions ====
At least the following instructions may have changed behavior, and count against the cxset "count" argument: <code>xdwait</code>, <code>xdst</code>, <code>xdld</code>.

For example, if override type=0b000, then the "length" argument to <code>xdst</code> is instead treated as the index of the target $cX register.

=== Secrets ===
Falcon's Authenticated Mode has access to 64 128-bit keys which are burned at factory. These keys can be loaded by using the $csecret instruction which takes the target crypto register and the key index as arguments.

{| class=wikitable
! Index || Notes || Console-unique
|-
| 0x00 || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares. || No
|-
| 0x01 || Used by nvhost_nvdec_bl020_prod firmware. ||
|-
| 0x03 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x04 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x05 || Used by nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares. ||
|-
| 0x07 || Used by [6.0.0+] nvhost_tsec firmware. ||
|-
| 0x09 || Used by nvhost_tsec firmware. ||
|-
| 0x0B || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x0F || Used by nvhost_tsec firmware. ||
|-
| 0x10 || Used by [1.0.0-5.1.0] nvhost_tsec firmware. ||
|-
| 0x15 || Used by nvhost_nvdec_bl020_prod, [5.0.0+] nvhost_nvdec020_prod, [5.0.0+] nvhost_nvdec020_ns and [6.0.0+] nvhost_tsec firmwares. ||
|-
| 0x26 || Used by [[TSEC_Firmware#KeygenLdr|KeygenLdr]]. || No
|-
| 0x3C || Used by nvhost_tsec firmware. ||
|-
| 0x3F || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. || Yes
|}

TSEC

2019-01-06T12:32:34Z

Qlutoo: /* ACL */

TSEC (Tegra Security Co-processor) is a dedicated unit powered by a NVIDIA Falcon microprocessor with crypto extensions.

= Driver =
A host driver for communicating with the TSEC is mapped to physical address 0x54500000 with a total size of 0x40000 bytes and exposes several registers.

== Registers ==
Registers from 0x54500000 to 0x54501000 are used to configure the host interface (HOST1X).

Registers from 0x54501000 to 0x54502000 are a MMIO window for communicating with the Falcon microprocessor. From this range, the subset of registers from 0x54501400 to 0x54501FE8 are specific to the TSEC and are subdivided into:
* 0x54501400 to 0x54501500: SCP (Secure Crypto Processor?).
* 0x54501500 to 0x54501600: TRNG (True Random Number Generator).
* 0x54501600 to 0x54501700: TFBIF (Tegra Framebuffer Interface).
* 0x54501700 to 0x54501800: DMA.
* 0x54501800 to 0x54501900: TEGRA (miscellaneous interfaces).

{| class="wikitable" border="1"
! Name
! Address
! Width
|-
| TSEC_THI_INCR_SYNCPT
| 0x54500000
| 0x04
|-
| TSEC_THI_INCR_SYNCPT_ERR
| 0x54500008
| 0x04
|-
| TSEC_THI_CTXSW_INCR_SYNCPT
| 0x5450000C
| 0x04
|-
| TSEC_THI_CTXSW
| 0x54500020
| 0x04
|-
| TSEC_THI_CONT_SYNCPT_EOF
| 0x54500028
| 0x04
|-
| [[#TSEC_THI_METHOD0|TSEC_THI_METHOD0]]
| 0x54500040
| 0x04
|-
| [[#TSEC_THI_METHOD1|TSEC_THI_METHOD1]]
| 0x54500044
| 0x04
|-
| [[#TSEC_THI_INT_STATUS|TSEC_THI_INT_STATUS]]
| 0x54500078
| 0x04
|-
| [[#TSEC_THI_INT_MASK|TSEC_THI_INT_MASK]]
| 0x5450007C
| 0x04
|-
| TSEC_THI_SLCG_STATUS
| 0x54500084
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_HIGH_A
| 0x54500088
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_LOW_A
| 0x5450008C
| 0x04
|-
| TSEC_THI_CLK_OVERRIDE
| 0x54500E00
| 0x04
|-
| [[#FALCON_IRQSSET|FALCON_IRQSSET]]
| 0x54501000
| 0x04
|-
| [[#FALCON_IRQSCLR|FALCON_IRQSCLR]]
| 0x54501004
| 0x04
|-
| [[#FALCON_IRQSTAT|FALCON_IRQSTAT]]
| 0x54501008
| 0x04
|-
| [[#FALCON_IRQMODE|FALCON_IRQMODE]]
| 0x5450100C
| 0x04
|-
| [[#FALCON_IRQMSET|FALCON_IRQMSET]]
| 0x54501010
| 0x04
|-
| [[#FALCON_IRQMCLR|FALCON_IRQMCLR]]
| 0x54501014
| 0x04
|-
| [[#FALCON_IRQMASK|FALCON_IRQMASK]]
| 0x54501018
| 0x04
|-
| [[#FALCON_IRQDEST|FALCON_IRQDEST]]
| 0x5450101C
| 0x04
|-
| FALCON_GPTMR_PERIOD
| 0x54501020
| 0x04
|-
| FALCON_GPTMR_TIME
| 0x54501024
| 0x04
|-
| FALCON_GPTMR_ENABLE
| 0x54501028
| 0x04
|-
| FALCON_TIME_LOW
| 0x5450102C
| 0x04
|-
| FALCON_TIME_HIGH
| 0x54501030
| 0x04
|-
| FALCON_WDTMR_TIME
| 0x54501034
| 0x04
|-
| FALCON_WDTMR_ENABLE
| 0x54501038
| 0x04
|-
| [[#FALCON_SCRATCH0|FALCON_SCRATCH0]]
| 0x54501040
| 0x04
|-
| [[#FALCON_SCRATCH1|FALCON_SCRATCH1]]
| 0x54501044
| 0x04
|-
| [[#FALCON_ITFEN|FALCON_ITFEN]]
| 0x54501048
| 0x04
|-
| [[#FALCON_IDLESTATE|FALCON_IDLESTATE]]
| 0x5450104C
| 0x04
|-
| FALCON_CURCTX
| 0x54501050
| 0x04
|-
| FALCON_NXTCTX
| 0x54501054
| 0x04
|-
| FALCON_CMDCTX
| 0x54501058
| 0x04
|-
| FALCON_STATUS_MASK
| 0x5450105C
| 0x04
|-
| FALCON_VM_SUPERVISOR
| 0x54501060
| 0x04
|-
| FALCON_MTHD_DATA
| 0x54501064
| 0x04
|-
| FALCON_MTHD_CMD
| 0x54501068
| 0x04
|-
| FALCON_MTHD_DATA_WR
| 0x5450106C
| 0x04
|-
| FALCON_MTHD_OCCUPIED
| 0x54501070
| 0x04
|-
| FALCON_MTHD_ACK
| 0x54501074
| 0x04
|-
| FALCON_MTHD_LIMIT
| 0x54501078
| 0x04
|-
| FALCON_SUBENGINE_RESET
| 0x5450107C
| 0x04
|-
| FALCON_SCRATCH2
| 0x54501080
| 0x04
|-
| FALCON_SCRATCH3
| 0x54501084
| 0x04
|-
| FALCON_PM_TRIGGER
| 0x54501088
| 0x04
|-
| FALCON_PM_MODE
| 0x5450108C
| 0x04
|-
| FALCON_DEBUG1
| 0x54501090
| 0x04
|-
| [[#FALCON_DEBUGINFO|FALCON_DEBUGINFO]]
| 0x54501094
| 0x04
|-
| FALCON_BREAKPOINT0
| 0x54501098
| 0x04
|-
| FALCON_BREAKPOINT1
| 0x5450109C
| 0x04
|-
| FALCON_CGCTL
| 0x545010A0
| 0x04
|-
| FALCON_ENGCTL
| 0x545010A4
| 0x04
|-
| FALCON_PM_SEL
| 0x545010A8
| 0x04
|-
| FALCON_HOST_IO_INDEX
| 0x545010AC
| 0x04
|-
| [[#FALCON_EXCI|FALCON_EXCI]]
| 0x545010D0
| 0x04
|-
| [[#FALCON_CPUCTL|FALCON_CPUCTL]]
| 0x54501100
| 0x04
|-
| [[#FALCON_BOOTVEC|FALCON_BOOTVEC]]
| 0x54501104
| 0x04
|-
| [[#FALCON_HWCFG|FALCON_HWCFG]]
| 0x54501108
| 0x04
|-
| [[#FALCON_DMACTL|FALCON_DMACTL]]
| 0x5450110C
| 0x04
|-
| [[#FALCON_DMATRF_EXTBASE|FALCON_DMATRF_EXTBASE]]
| 0x54501110
| 0x04
|-
| [[#FALCON_DMATRF_VOFF|FALCON_DMATRF_VOFF]]
| 0x54501114
| 0x04
|-
| [[#FALCON_DMATRFCMD|FALCON_DMATRFCMD]]
| 0x54501118
| 0x04
|-
| [[#FALCON_DMATRF_POFF|FALCON_DMATRF_POFF]]
| 0x5450111C
| 0x04
|-
| [[#FALCON_DMATRFSTAT|FALCON_DMATRFSTAT]]
| 0x54501120
| 0x04
|-
| [[#FALCON_CRYPTTRFSTAT|FALCON_CRYPTTRFSTAT]]
| 0x54501124
| 0x04
|-
| FALCON_CPUSTAT
| 0x54501128
| 0x04
|-
| [[#FALCON_HWCFG2|FALCON_HWCFG2]]
| 0x5450112C
| 0x04
|-
| FALCON_CPUCTL_ALIAS
| 0x54501130
| 0x04
|-
| FALCON_TLB_CMD
| 0x54501140
| 0x04
|-
| FALCON_TLB_CMD_RES
| 0x54501144
| 0x04
|-
| FALCON_BRANCH_HISTORY_CTRL
| 0x54501148
| 0x04
|-
| FALCON_BRANCH_HISTORY_PC
| 0x5450114C
| 0x04
|-
| FALCON_IMFILLRNG0
| 0x54501150
| 0x04
|-
| FALCON_IMFILLRNG1
| 0x54501154
| 0x04
|-
| FALCON_IMFILLCTL
| 0x54501158
| 0x04
|-
| FALCON_EXTERRWIN
| 0x54501160
| 0x04
|-
| FALCON_EXTERRCFG
| 0x54501164
| 0x04
|-
| FALCON_EXTERRADDR
| 0x54501168
| 0x04
|-
| FALCON_EXTERRSTAT
| 0x5450116C
| 0x04
|-
| FALCON_CG2
| 0x5450117C
| 0x04
|-
| FALCON_CODE_INDEX
| 0x54501180
| 0x04
|-
| FALCON_CODE
| 0x54501184
| 0x04
|-
| FALCON_CODE_VIRT_ADDR
| 0x54501188
| 0x04
|-
| FALCON_DATA_INDEX0
| 0x545011C0
| 0x04
|-
| FALCON_DATA0
| 0x545011C4
| 0x04
|-
| FALCON_DATA_INDEX1
| 0x545011C8
| 0x04
|-
| FALCON_DATA1
| 0x545011CC
| 0x04
|-
| FALCON_DATA_INDEX2
| 0x545011D0
| 0x04
|-
| FALCON_DATA2
| 0x545011D4
| 0x04
|-
| FALCON_DATA_INDEX3
| 0x545011D8
| 0x04
|-
| FALCON_DATA3
| 0x545011DC
| 0x04
|-
| FALCON_DATA_INDEX4
| 0x545011E0
| 0x04
|-
| FALCON_DATA4
| 0x545011E4
| 0x04
|-
| FALCON_DATA_INDEX5
| 0x545011E8
| 0x04
|-
| FALCON_DATA5
| 0x545011EC
| 0x04
|-
| FALCON_DATA_INDEX6
| 0x545011F0
| 0x04
|-
| FALCON_DATA6
| 0x545011F4
| 0x04
|-
| FALCON_DATA_INDEX7
| 0x545011F8
| 0x04
|-
| FALCON_DATA7
| 0x545011FC
| 0x04
|-
| [[#FALCON_ICD_CMD|FALCON_ICD_CMD]]
| 0x54501200
| 0x04
|-
| FALCON_ICD_ADDR
| 0x54501204
| 0x04
|-
| FALCON_ICD_WDATA
| 0x54501208
| 0x04
|-
| FALCON_ICD_RDATA
| 0x5450120C
| 0x04
|-
| [[#FALCON_SCTL|FALCON_SCTL]]
| 0x54501240
| 0x04
|-
| [[#TSEC_SCP_CTL_ACCESS|TSEC_SCP_CTL_ACCESS]]
| 0x54501400
| 0x04
|-
| [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]]
| 0x54501404
| 0x04
|-
| [[#TSEC_SCP_CTL_STAT|TSEC_SCP_CTL_STAT]]
| 0x54501408
| 0x04
|-
| [[#TSEC_SCP_CTL_MODE|TSEC_SCP_CTL_MODE]]
| 0x5450140C
| 0x04
|-
| TSEC_SCP_UNK0
| 0x54501410
| 0x04
|-
| [[#TSEC_SCP_CTL_PKEY|TSEC_SCP_CTL_PKEY]]
| 0x54501418
| 0x04
|-
| [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]]
| 0x54501420
| 0x04
|-
| [[#TSEC_SCP_SEQ_STAT|TSEC_SCP_SEQ_STAT]]
| 0x54501428
| 0x04
|-
| [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]]
| 0x54501430
| 0x04
|-
| TSEC_SCP_UNK2
| 0x54501454
| 0x04
|-
| [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]]
| 0x54501458
| 0x04
|-
| TSEC_SCP_UNK3
| 0x54501470
| 0x04
|-
| [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT]]
| 0x54501480
| 0x04
|-
| [[#TSEC_SCP_IRQMASK|TSEC_SCP_IRQMASK]]
| 0x54501484
| 0x04
|-
| TSEC_SCP_UNK4
| 0x54501490
| 0x04
|-
| [[#TSEC_SCP_ERR|TSEC_SCP_ERR]]
| 0x54501498
| 0x04
|-
| TSEC_TRNG_CLKDIV
| 0x54501500
| 0x04
|-
| TSEC_TRNG_UNK0
| 0x54501504
| 0x04
|-
| TSEC_TRNG_UNK1
| 0x5450150C
| 0x04
|-
| TSEC_TRNG_UNK2
| 0x54501510
| 0x04
|-
| TSEC_TRNG_UNK3
| 0x54501514
| 0x04
|-
| TSEC_TRNG_UNK4
| 0x54501518
| 0x04
|-
| TSEC_TRNG_UNK5
| 0x5450151C
| 0x04
|-
| TSEC_TRNG_UNK6
| 0x54501528
| 0x04
|-
| TSEC_TRNG_UNK7
| 0x5450152C
| 0x04
|-
| TSEC_TFBIF_UNK0
| 0x54501600
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL|TSEC_TFBIF_MCCIF_FIFOCTRL]]
| 0x54501604
| 0x04
|-
| TSEC_TFBIF_UNK1
| 0x54501608
| 0x04
|-
| TSEC_TFBIF_UNK2
| 0x5450160C
| 0x04
|-
| TSEC_TFBIF_UNK3
| 0x54501630
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL1|TSEC_TFBIF_MCCIF_FIFOCTRL1]]
| 0x54501634
| 0x04
|-
| TSEC_TFBIF_UNK4
| 0x54501640
| 0x04
|-
| [[#TSEC_TFBIF_UNK5|TSEC_TFBIF_UNK5]]
| 0x54501644
| 0x04
|-
| [[#TSEC_TFBIF_UNK6|TSEC_TFBIF_UNK6]]
| 0x54501648
| 0x04
|-
| [[#TSEC_DMA_CMD|TSEC_DMA_CMD]]
| 0x54501700
| 0x04
|-
| [[#TSEC_DMA_ADDR|TSEC_DMA_ADDR]]
| 0x54501704
| 0x04
|-
| [[#TSEC_DMA_VAL|TSEC_DMA_VAL]]
| 0x54501708
| 0x04
|-
| [[#TSEC_DMA_UNK|TSEC_DMA_UNK]]
| 0x5450170C
| 0x04
|-
| TSEC_TEGRA_FALCON_IP_VER
| 0x54501800
| 0x04
|-
| TSEC_TEGRA_UNK0
| 0x54501824
| 0x04
|-
| TSEC_TEGRA_UNK1
| 0x54501828
| 0x04
|-
| TSEC_TEGRA_UNK2
| 0x5450182C
| 0x04
|-
| [[#TSEC_TEGRA_CTL|TSEC_TEGRA_CTL]]
| 0x54501838
| 0x04
|}

=== TSEC_THI_METHOD0 ===
{| class="wikitable" border="1"
! ID
! Method
|-
| 0x200
| SET_APPLICATION_ID
|-
| 0x300
| EXECUTE
|-
| 0x500
| HDCP_INIT
|-
| 0x504
| HDCP_CREATE_SESSION
|-
| 0x508
| HDCP_VERIFY_CERT_RX
|-
| 0x50C
| HDCP_GENERATE_EKM
|-
| 0x510
| HDCP_REVOCATION_CHECK
|-
| 0x514
| HDCP_VERIFY_HPRIME
|-
| 0x518
| HDCP_ENCRYPT_PAIRING_INFO
|-
| 0x51C
| HDCP_DECRYPT_PAIRING_INFO
|-
| 0x520
| HDCP_UPDATE_SESSION
|-
| 0x524
| HDCP_GENERATE_LC_INIT
|-
| 0x528
| HDCP_VERIFY_LPRIME
|-
| 0x52C
| HDCP_GENERATE_SKE_INIT
|-
| 0x530
| HDCP_VERIFY_VPRIME
|-
| 0x534
| HDCP_ENCRYPTION_RUN_CTRL
|-
| 0x538
| HDCP_SESSION_CTRL
|-
| 0x53C
| HDCP_COMPUTE_SPRIME
|-
| 0x540
| HDCP_GET_CERT_RX
|-
| 0x544
| HDCP_EXCHANGE_INFO
|-
| 0x548
| HDCP_DECRYPT_KM
|-
| 0x54C
| HDCP_GET_HPRIME
|-
| 0x550
| HDCP_GENERATE_EKH_KM
|-
| 0x554
| HDCP_VERIFY_RTT_CHALLENGE
|-
| 0x558
| HDCP_GET_LPRIME
|-
| 0x55C
| HDCP_DECRYPT_KS
|-
| 0x560
| HDCP_DECRYPT
|-
| 0x564
| HDCP_GET_RRX
|-
| 0x568
| HDCP_DECRYPT_REENCRYPT
|-
| 0x56C
|
|-
| 0x570
|
|-
| 0x574
|
|-
| 0x578
|
|-
| 0x57C
|
|-
| 0x700
| HDCP_VALIDATE_SRM
|-
| 0x704
| HDCP_VALIDATE_STREAM
|-
| 0x708
| HDCP_TEST_SECURE_STATUS
|-
| 0x70C
| HDCP_SET_DCP_KPUB
|-
| 0x710
| HDCP_SET_RX_KPUB
|-
| 0x714
| HDCP_SET_CERT_RX
|-
| 0x718
| HDCP_SET_SCRATCH_BUFFER
|-
| 0x71C
| HDCP_SET_SRM
|-
| 0x720
| HDCP_SET_RECEIVER_ID_LIST
|-
| 0x724
| HDCP_SET_SPRIME
|-
| 0x728
| HDCP_SET_ENC_INPUT_BUFFER
|-
| 0x72C
| HDCP_SET_ENC_OUTPUT_BUFFER
|-
| 0x730
| HDCP_GET_RTT_CHALLENGE
|-
| 0x734
| HDCP_STREAM_MANAGE
|-
| 0x738
| HDCP_READ_CAPS
|-
| 0x73C
| HDCP_ENCRYPT
|-
| 0x740
| [6.0.0+] HDCP_GET_CURRENT_NONCE
|}

Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_METHOD1 ===
Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_INT_STATUS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_STATUS_FALCON_INT
|}

=== TSEC_THI_INT_MASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_MASK_FALCON_INT
|}

=== FALCON_IRQSSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSSET_GPTMR
|-
| 1
| FALCON_IRQSSET_WDTMR
|-
| 2
| FALCON_IRQSSET_MTHD
|-
| 3
| FALCON_IRQSSET_CTXSW
|-
| 4
| FALCON_IRQSSET_HALT
|-
| 5
| FALCON_IRQSSET_EXTERR
|-
| 6
| FALCON_IRQSSET_SWGEN0
|-
| 7
| FALCON_IRQSSET_SWGEN1
|-
| 8-15
| FALCON_IRQSSET_EXT
|}

Used for setting Falcon's IRQs.

=== FALCON_IRQSCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSCLR_GPTMR
|-
| 1
| FALCON_IRQSCLR_WDTMR
|-
| 2
| FALCON_IRQSCLR_MTHD
|-
| 3
| FALCON_IRQSCLR_CTXSW
|-
| 4
| FALCON_IRQSCLR_HALT
|-
| 5
| FALCON_IRQSCLR_EXTERR
|-
| 6
| FALCON_IRQSCLR_SWGEN0
|-
| 7
| FALCON_IRQSCLR_SWGEN1
|-
| 8-15
| FALCON_IRQSCLR_EXT
|}

Used for clearing Falcon's IRQs.

=== FALCON_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSTAT_GPTMR
|-
| 1
| FALCON_IRQSTAT_WDTMR
|-
| 2
| FALCON_IRQSTAT_MTHD
|-
| 3
| FALCON_IRQSTAT_CTXSW
|-
| 4
| FALCON_IRQSTAT_HALT
|-
| 5
| FALCON_IRQSTAT_EXTERR
|-
| 6
| FALCON_IRQSTAT_SWGEN0
|-
| 7
| FALCON_IRQSTAT_SWGEN1
|-
| 8-15
| FALCON_IRQSTAT_EXT
|}

Used for getting the status of Falcon's IRQs.

=== FALCON_IRQMODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMODE_GPTMR
|-
| 1
| FALCON_IRQMODE_WDTMR
|-
| 2
| FALCON_IRQMODE_MTHD
|-
| 3
| FALCON_IRQMODE_CTXSW
|-
| 4
| FALCON_IRQMODE_HALT
|-
| 5
| FALCON_IRQMODE_EXTERR
|-
| 6
| FALCON_IRQMODE_SWGEN0
|-
| 7
| FALCON_IRQMODE_SWGEN1
|-
| 8-15
| FALCON_IRQMODE_EXT
|}

Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.

=== FALCON_IRQMSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMSET_GPTMR
|-
| 1
| FALCON_IRQMSET_WDTMR
|-
| 2
| FALCON_IRQMSET_MTHD
|-
| 3
| FALCON_IRQMSET_CTXSW
|-
| 4
| FALCON_IRQMSET_HALT
|-
| 5
| FALCON_IRQMSET_EXTERR
|-
| 6
| FALCON_IRQMSET_SWGEN0
|-
| 7
| FALCON_IRQMSET_SWGEN1
|-
| 8-15
| FALCON_IRQMSET_EXT
|}

Used for setting the mask for Falcon's IRQs.

=== FALCON_IRQMCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMCLR_GPTMR
|-
| 1
| FALCON_IRQMCLR_WDTMR
|-
| 2
| FALCON_IRQMCLR_MTHD
|-
| 3
| FALCON_IRQMCLR_CTXSW
|-
| 4
| FALCON_IRQMCLR_HALT
|-
| 5
| FALCON_IRQMCLR_EXTERR
|-
| 6
| FALCON_IRQMCLR_SWGEN0
|-
| 7
| FALCON_IRQMCLR_SWGEN1
|-
| 8-15
| FALCON_IRQMCLR_EXT
|}

Used for clearing the mask for Falcon's IRQs.

=== FALCON_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMASK_GPTMR
|-
| 1
| FALCON_IRQMASK_WDTMR
|-
| 2
| FALCON_IRQMASK_MTHD
|-
| 3
| FALCON_IRQMASK_CTXSW
|-
| 4
| FALCON_IRQMASK_HALT
|-
| 5
| FALCON_IRQMASK_EXTERR
|-
| 6
| FALCON_IRQMASK_SWGEN0
|-
| 7
| FALCON_IRQMASK_SWGEN1
|-
| 8-15
| FALCON_IRQMASK_EXT
|}

Used for getting the value of the mask for Falcon's IRQs.

=== FALCON_IRQDEST ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQDEST_HOST_GPTMR
|-
| 1
| FALCON_IRQDEST_HOST_WDTMR
|-
| 2
| FALCON_IRQDEST_HOST_MTHD
|-
| 3
| FALCON_IRQDEST_HOST_CTXSW
|-
| 4
| FALCON_IRQDEST_HOST_HALT
|-
| 5
| FALCON_IRQDEST_HOST_EXTERR
|-
| 6
| FALCON_IRQDEST_HOST_SWGEN0
|-
| 7
| FALCON_IRQDEST_HOST_SWGEN1
|-
| 8-15
| FALCON_IRQDEST_HOST_EXT
|-
| 16
| FALCON_IRQDEST_TARGET_GPTMR
|-
| 17
| FALCON_IRQDEST_TARGET_WDTMR
|-
| 18
| FALCON_IRQDEST_TARGET_MTHD
|-
| 19
| FALCON_IRQDEST_TARGET_CTXSW
|-
| 20
| FALCON_IRQDEST_TARGET_HALT
|-
| 21
| FALCON_IRQDEST_TARGET_EXTERR
|-
| 22
| FALCON_IRQDEST_TARGET_SWGEN0
|-
| 23
| FALCON_IRQDEST_TARGET_SWGEN1
|-
| 24-31
| FALCON_IRQDEST_TARGET_EXT
|}

Used for routing Falcon's IRQs.

=== FALCON_SCRATCH0 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_SCRATCH1 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_ITFEN ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_ITFEN_CTXEN
|-
| 1
| FALCON_ITFEN_MTHDEN
|}

Used for enabling/disabling Falcon interfaces.

=== FALCON_IDLESTATE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IDLESTATE_FALCON_BUSY
|-
| 1-15
| FALCON_IDLESTATE_EXT_BUSY
|}

Used for detecting if Falcon is busy or not.

=== FALCON_DEBUGINFO ===
Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.

[6.0.0+] [[NV_services|nvservices]] sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.

=== FALCON_EXCI ===
Contains information about raised exceptions.

=== FALCON_CPUCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_CPUCTL_IINVAL
|-
| 1
| FALCON_CPUCTL_STARTCPU
|-
| 2
| FALCON_CPUCTL_SRESET
|-
| 3
| FALCON_CPUCTL_HRESET
|-
| 4
| FALCON_CPUCTL_HALTED
|-
| 5
| FALCON_CPUCTL_STOPPED
|-
| 6
| FALCON_CPUCTL_SCP_UNK
|}

Used for signaling the Falcon CPU.

=== FALCON_BOOTVEC ===
Takes the Falcon's boot vector address.

=== FALCON_HWCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-8
| FALCON_HWCFG_IMEM_SIZE
|-
| 9-17
| FALCON_HWCFG_DMEM_SIZE
|-
| 18-25
| FALCON_HWCFG_MTHD_SIZE
|-
| 26-31
| FALCON_HWCFG_DMATRF_SLOTS
|}

=== FALCON_DMACTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMACTL_REQUIRE_CTX
|-
| 1
| FALCON_DMACTL_DMEM_SCRUBBING
|-
| 2
| FALCON_DMACTL_IMEM_SCRUBBING
|-
| 3-6
| FALCON_DMACTL_DMAQ_NUM
|-
| 7
| FALCON_DMACTL_SECURE_STAT
|}

Used for configuring the Falcon's DMA engine.

=== FALCON_DMATRF_EXTBASE ===
Base of the external memory buffer.

The base of the transfer is calculated by adding [[#FALCON_DMATRF_POFF]] to the base.

=== FALCON_DMATRF_VOFF ===
For transfers to DMEM: the destination address.
For transfers to IMEM: the destination virtual IMEM page.

=== FALCON_DMATRF_POFF ===
For transfers to IMEM: the destination physical IMEM page.

=== FALCON_DMATRFCMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFCMD_FULL
|-
| 1
| FALCON_DMATRFCMD_IDLE
|-
| 2-3
| FALCON_DMATRFCMD_SEC
|-
| 4
| FALCON_DMATRFCMD_IMEM
|-
| 5
| FALCON_DMATRFCMD_WRITE
|-
| 8-10
| FALCON_DMATRFCMD_SIZE
|-
| 12-14
| FALCON_DMATRFCMD_CTXDMA
|}

Used for configuring DMA transfers.

=== FALCON_DMATRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFSTAT_PENDING
|-
| 16-18
| FALCON_DMATRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_DMATRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_CRYPTTRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| FALCON_CRYPTTRFSTAT_PENDING
|-
| 5
| FALCON_CRYPTTRFSTAT_ENABLED
|-
| 16-18
| FALCON_CRYPTTRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_CRYPTTRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_HWCFG2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_HWCFG2_VERSION
|-
| 4-5
| FALCON_HWCFG2_SCP_MODE
|-
| 6-7
| FALCON_HWCFG2_SUBVERSION
|-
| 8-11
| FALCON_HWCFG2_IMEM_PORTS
|-
| 12-15
| FALCON_HWCFG2_DMEM_PORTS
|-
| 16-19
| FALCON_HWCFG2_VM_PAGES_LOG2
|}

=== FALCON_ICD_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_ICD_CMD_OPC
0x0: BREAK
0x1: CONTINUE_FROM_PC
0x2: CONTINUE_FROM_ADDR
0x3: CONTINUE_UNK1_FROM_PC
0x4: CONTINUE_UNK1_FROM_ADDR
0x5: SINGLE_STEP_FROM_PC
0x6: SINGLE_STEP_FROM_ADDR
0x7: SET_BREAK_MASK
0x8: REG_READ
0x9: REG_WRITE
0xA: DATA_READ
0xB: DATA_WRITE
0xC: IO_READ
0xD: IO_WRITE
0xE: STATUS_READ
|-
| 6-7
| FALCON_ICD_CMD_DATA_SIZE
|-
| 8-12
| FALCON_ICD_CMD_IDX
|-
| 14
| FALCON_ICD_CMD_ERROR
|-
| 15
| FALCON_ICD_CMD_DONE
|-
| 16-31
| FALCON_ICD_CMD_BREAK_MASK
|}

=== FALCON_SCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| FALCON_SCTL_SEC_MODE
0: Non-secure
1: Light Secure
2: Heavy Secure
|}

=== TSEC_SCP_CTL_ACCESS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| Enable TSEC_SCP_INSN_STAT register
|}

=== TSEC_SCP_CTL_TRNG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 11
| Unknown
|-
| 12
| Enable the TRNG
|}

=== TSEC_SCP_CTL_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| TSEC_SCP_CTL_STAT_DEBUG_MODE
|}

=== TSEC_SCP_CTL_MODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Disable reads for the TRNG register block
|-
| 1
| Disable reads for the TFBIF register block
|-
| 2
| Disable reads for the DMA register block
|-
| 3
| Disable reads for the TEGRA register block
|-
| 4
| Disable writes for the TRNG register block
|-
| 5
| Disable writes for the TFBIF register block
|-
| 6
| Disable writes for the DMA register block
|-
| 7
| Disable writes for the TEGRA register block
|}

Controls accesses to the other sub-engines and can only be cleared in Heavy Secure mode.

=== TSEC_SCP_CTL_PKEY ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
|-
| 1
| TSEC_SCP_CTL_PKEY_LOADED
|}

=== TSEC_SCP_SEQ0_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 8-11
| Size of current cs0begin macro
|-
|}

=== TSEC_SCP_SEQ_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Set if crypto sequence recording (cs0begin/cs1begin) is active
|-
| 4-7
| Number of instructions left for the crypto sequence
|-
| 12-15
| Active crypto key register
|}

Contains information on the last crypto sequence (cs0 or cs1) executed.

=== TSEC_SCP_INSN_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| Crypto fuc5 destination register or immediate value
|-
| 8-15
| Crypto fuc5 source register or immediate value
|-
| 20-24
| Crypto fuc5 operation
0x0: none (fuc5 opcode 0x00)
0x1: cmov (fuc5 opcode 0x84)
0x2: cxsin (fuc5 opcode 0x88) or xdst (with cxset)
0x3: cxsout (fuc5 opcode 0x8C) or xdld (with cxset)
0x4: crng (fuc5 opcode 0x90)
0x5: cs0begin (fuc5 opcode 0x94)
0x6: cs0exec (fuc5 opcode 0x98)
0x7: cs1begin (fuc5 opcode 0x9C)
0x8: cs1exec (fuc5 opcode 0xA0)
0x9: invalid (fuc5 opcode 0xA4)
0xA: cchmod (fuc5 opcode 0xA8)
0xB: cxor (fuc5 opcode 0xAC)
0xC: cadd (fuc5 opcode 0xB0)
0xD: cand (fuc5 opcode 0xB4)
0xE: crev (fuc5 opcode 0xB8)
0xF: cprecmac (fuc5 opcode 0xBC)
0x10: csecret (fuc5 opcode 0xC0)
0x11: ckeyreg (fuc5 opcode 0xC4)
0x12: ckexp (fuc5 opcode 0xC8)
0x13: ckrexp (fuc5 opcode 0xCC)
0x14: cenc (fuc5 opcode 0xD0)
0x15: cdec (fuc5 opcode 0xD4)
0x16: csigauth (fuc5 opcode 0xD8)
0x17: csigenc (fuc5 opcode 0xDC)
0x18: csigclr (fuc5 opcode 0xE0)
|-
| 31
| Set if running in secure mode (cauth)
|}

Contains information on the last crypto instruction executed.

=== TSEC_SCP_AES_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-4
| First opcode
|-
| 5-9
| Second opcode
|-
| 15-16
| AES operation
0: Encryption
1: Decryption
2: Key expansion
3: Key reverse expansion
|}

Contains information on the last AES sequence executed.

=== TSEC_SCP_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQSTAT_TRNG
|-
| 8
| TSEC_SCP_IRQSTAT_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQSTAT_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQSTAT_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the status of crypto IRQs.

=== TSEC_SCP_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQMASK_TRNG
|-
| 8
| TSEC_SCP_IRQMASK_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQMASK_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQMASK_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the value of the mask for crypto IRQs.

=== TSEC_SCP_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Invalid instruction
|-
| 4
| Empty crypto sequence
|-
| 8
| Crypto sequence is too long
|-
| 12
| Crypto sequence was not finished
|-
| 16
| Invalid cauth signature (during csigenc, csigclr or csigunk)
|-
| 24
| Forbidden instruction
|}

Contains information on crypto errors generated by the [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT_INSN_ERROR]] IRQ.

=== TSEC_TFBIF_MCCIF_FIFOCTRL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
|-
| 1
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
|-
| 2
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
|-
| 3
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
|-
| 4
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
|-
| 5
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
|-
| 6
| TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
|-
| 7
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
|-
| 8
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE
|}

=== TSEC_MCCIF_FIFOCTRL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
|-
| 16-31
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT
|}

=== TSEC_TFBIF_UNK5 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.

=== TSEC_TFBIF_UNK6 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to (data_size << 4) before reading memory from the GPU UCODE carveout.

=== TSEC_DMA_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_DMA_CMD_READ
|-
| 1
| TSEC_DMA_CMD_WRITE
|-
| 4-7
| TSEC_DMA_CMD_UNK
|-
| 12
| TSEC_DMA_CMD_BUSY
|-
| 13
| TSEC_DMA_CMD_ERROR
|-
| 31
| TSEC_DMA_CMD_INIT
|}

A DMA read/write operation requires bits TSEC_DMA_CMD_INIT and TSEC_DMA_CMD_READ/TSEC_DMA_CMD_WRITE to be set in TSEC_DMA_CMD.

During the transfer, the TSEC_DMA_CMD_BUSY bit is set.

Accessing an invalid address causes bit TSEC_DMA_CMD_ERROR to be set.

=== TSEC_DMA_ADDR ===
Takes the address for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_VAL ===
Takes the value for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_UNK ===
Always 0xFFF.

=== TSEC_TEGRA_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 16
| TSEC_TEGRA_CTL_TKFI_KFUSE
|-
| 17
| TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
|-
| 24
| TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
|-
| 25
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
|-
| 26
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
|-
| 27
| TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C
|}

== Authenticated Mode ==
===== Entry =====
From non-secure mode, upon jumping to a page marked as secret, a secret fault occurs. This causes the CPU to verify the region specified in $cauth against the MAC loaded in $c6. If the comparison is successful, the valid bit (bit0) is set on all pages in the $cauth region, and $pc is set to the base of the $cauth region. If the comparsion fails, the CPU is halted.

===== Exit =====
The CPU automatically goes back to non-secure mode when returning back into non-secret pages. When this happens, the valid bit (bit0) in the TLB flags is cleared for all secret pages.

===== Implementation =====
Under certain circumstances, it is possible to observe [[#csigauth|csigauth]] being briefly written to [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]] as "csigauth $c4 $c6" while the opcodes in [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]] are set to "cxsin" and "csigauth", respectively.

Via [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]] it can be observed that a 3-sized macro sequence is loaded into cs0 during a secure mode transition.

== Crypto processing ==
Part of the information here (which hasn't made it into envytools documentation yet) was shared by [https://wiki.0x04.net/wiki/Marcin_Ko%C5%9Bcielnicki mwk] from reverse engineering falcon processors over the years.

=== cauth ===
$cauth is a special purpose register in the CPU.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7 || Start of region to authenticate (in 0x100 pages)
|-
| 8-15 || Unused
|-
| 16 || Use secret xfers (?)
|-
| 17 || Region is signed and encrypted and double the size (?)
|-
| 18 ||
|-
| 19 ||
|-
| 20-23 || Unused
|-
| 31-24 || Size of region to authenticate (in 0x100 pages)
|}

== SCP operations ==

{| class="wikitable" border="1"
! Opcode
! Name
! Operand0
! Operand1
! Operation
! Condition
|-
| 0 || || || || ||
|-
| 1 || mov || $cX || $cY || <code>$cX = $cY; ACL(X) = ACL(Y);</code> ||
|-
| 2 || sin || $cX || N/A || <code>$cX = read_stream(); ACL(X) = ???;</code> ||
|-
| 3 || sout || $cX || N/A || <code>write_stream($cX);</code> ||
|-
| 4 || rnd || $cX || N/A || <code>$cX = read_trng(); ACL(X) = ???;</code> ||
|-
| 5 || s0begin || immX || N/A || <code>record_macro_for_N_instructions(0, immX);</code> ||
|-
| 6 || s0exec || immX || N/A || <code>execute_macro_N_times(0, immX);</code> ||
|-
| 7 || s1begin || immX || N/A || <code>record_macro_for_N_instructions(1, immX);</code> ||
|-
| 8 || s1exec || immX || N/A || <code>execute_macro_N_times(1, immX);</code> ||
|-
| 9 || ? || || || ||
|-
| 0xA || chmod || $cX || immY || <code>if (immY & 3) ACL(X) = (ACL(X) & immY) | 1; else ACL(X) = 0;</code> ||
|-
| 0xB || xor || $cX || $cY || <code>$cX ^= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xC || add || $cX || immY || <code>$cX += immY;</code> || <code>(ACL(X) & 2)</code>
|-
| 0xD || and || $cX || $cY || <code>$cX &= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xE || rev || $cX || $cY || <code>$cX = reverse($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 1)</code>
|-
| 0xF || gfmul || $cX || $cY || <code>$cX = gfmul($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 2)</code>
|-
| 0x10 || secret || $cX || immY || <code>$cX = load_secret(immY); ACL(X) = load_secret_acl(immY);</code> ||
|-
| 0x11 || keyreg || immX || || <code>active_key_idx = immX;</code> ||
|-
| 0x12 || kexp || $cX || $cY || <code>$cX = aes_kexp($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 1)</code>
|-
| 0x13 || krexp || $cX || $cY || <code>$cX = aes_kexp_reverse($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 1)</code>
|-
| 0x14 || enc || $cX || $cY || <code>$cX = aes_enc(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 1) && (ACL(Y) & 2)</code>
|-
| 0x15 || dec || $cX || $cY || <code>$cX = aes_dec(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 1) && (ACL(Y) & 2)</code>
|-
| ...
|}

=== ACL ===
{| class="wikitable" border="1"
! Bit
! Meaning
|-
| 0 || Readable as key. This is forced set if bit1 is set, the only way to clear it is to clear *both* bit0 and bit1.
|-
| 1 || Readable
|}

==== Initial values ====
On SCP boot, the ACL is 0x1F for all $cX.

Loading into $cX using xdst instruction sets ACL($cX) to 0x1F.

Spilling a $cX to DMEM using xdld instruction is allowed if (ACL($cX) & 2).

=== csigauth ===
<code>00000000: f5 3c XY d8 csigauth $cY $cX</code>

This instruction takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret.

=== csigclr ===
<code>00000000: f5 3c 00 e0 csigclr</code>

This instruction takes no operands and appears to clear the saved cauth signature used by the csigenc instruction.

=== cchmod ===
<code>00000000: f5 3c XY a8 cchmod $cY 0X</code> or <code>00000000: f5 3c XY a9 cchmod $cY 1X</code>

This instruction takes a crypto register and a 5 bit immediate value. It appears to set the [[#Register ACLs|crypto registers' ACL]] bits as follows:
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Allow register to be used as key in NS or LS mode
|-
| 1
| Allow register to be used as key in HS mode
|-
| 2
| Set register as readable in NS or LS mode
|-
| 3
| Set register as readable in HS mode
|-
| 4
| Set register as writable in NS or LS mode
|}

=== crng ===
<code>00000000: f5 3c 0X 90 crng $cX</code>

This instruction initializes a crypto register with random data.

Executing this instruction only succeeds if the TRNG is enabled for the SCP, which requires taking the following steps:
* Write 0x7FFF to TSEC_TRNG_CLKDIV.
* Write 0x3FF0000 to TSEC_TRNG_UNK0.
* Write 0xFF00 to TSEC_TRNG_UNK7.
* Write 0x1000 to [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]].

Otherwise it hangs forever.

=== cxset ===
cxset instruction provides a way to change behavior of a variable amount of successively executed DMA-related instructions.

for example: <code>000000de: f4 3c 02 cxset 0x2</code>

can be read as: <code>dma_override(type=crypto_reg, count=2)</code>

The argument to cxset specifies the type of behavior change in the top 3 bits, and the number of DMA-related instructions the effect lasts for in the lower 5 bits.

{| class=wikitable
! Bits || Description
|-
| 0-4 || Number of instructions it is valid for (0x1f is a special value meaning infinitely many instructions -- until overriden by another cxset)
|-
| 5 || Crypto destination/source select (0=crypto register, 1=crypto stream)
|-
| 6 || External memory override (0=Disabled, 1=Enabled)
|-
| 7 || Internal memory select (0=DMEM, 1=IMEM)
|}

==== DMA-Related Instructions ====
At least the following instructions may have changed behavior, and count against the cxset "count" argument: <code>xdwait</code>, <code>xdst</code>, <code>xdld</code>.

For example, if override type=0b000, then the "length" argument to <code>xdst</code> is instead treated as the index of the target $cX register.

=== Secrets ===
Falcon's Authenticated Mode has access to 64 128-bit keys which are burned at factory. These keys can be loaded by using the $csecret instruction which takes the target crypto register and the key index as arguments.

{| class=wikitable
! Index || Notes || Console-unique
|-
| 0x00 || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares. || No
|-
| 0x01 || Used by nvhost_nvdec_bl020_prod firmware. ||
|-
| 0x03 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x04 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x05 || Used by nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares. ||
|-
| 0x07 || Used by [6.0.0+] nvhost_tsec firmware. ||
|-
| 0x09 || Used by nvhost_tsec firmware. ||
|-
| 0x0B || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x0F || Used by nvhost_tsec firmware. ||
|-
| 0x10 || Used by [1.0.0-5.1.0] nvhost_tsec firmware. ||
|-
| 0x15 || Used by nvhost_nvdec_bl020_prod, [5.0.0+] nvhost_nvdec020_prod, [5.0.0+] nvhost_nvdec020_ns and [6.0.0+] nvhost_tsec firmwares. ||
|-
| 0x26 || Used by [[TSEC_Firmware#KeygenLdr|KeygenLdr]]. || No
|-
| 0x3C || Used by nvhost_tsec firmware. ||
|-
| 0x3F || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. || Yes
|}

TSEC

2019-01-06T12:26:02Z

Qlutoo: /* SCP operations */

TSEC (Tegra Security Co-processor) is a dedicated unit powered by a NVIDIA Falcon microprocessor with crypto extensions.

= Driver =
A host driver for communicating with the TSEC is mapped to physical address 0x54500000 with a total size of 0x40000 bytes and exposes several registers.

== Registers ==
Registers from 0x54500000 to 0x54501000 are used to configure the host interface (HOST1X).

Registers from 0x54501000 to 0x54502000 are a MMIO window for communicating with the Falcon microprocessor. From this range, the subset of registers from 0x54501400 to 0x54501FE8 are specific to the TSEC and are subdivided into:
* 0x54501400 to 0x54501500: SCP (Secure Crypto Processor?).
* 0x54501500 to 0x54501600: TRNG (True Random Number Generator).
* 0x54501600 to 0x54501700: TFBIF (Tegra Framebuffer Interface).
* 0x54501700 to 0x54501800: DMA.
* 0x54501800 to 0x54501900: TEGRA (miscellaneous interfaces).

{| class="wikitable" border="1"
! Name
! Address
! Width
|-
| TSEC_THI_INCR_SYNCPT
| 0x54500000
| 0x04
|-
| TSEC_THI_INCR_SYNCPT_ERR
| 0x54500008
| 0x04
|-
| TSEC_THI_CTXSW_INCR_SYNCPT
| 0x5450000C
| 0x04
|-
| TSEC_THI_CTXSW
| 0x54500020
| 0x04
|-
| TSEC_THI_CONT_SYNCPT_EOF
| 0x54500028
| 0x04
|-
| [[#TSEC_THI_METHOD0|TSEC_THI_METHOD0]]
| 0x54500040
| 0x04
|-
| [[#TSEC_THI_METHOD1|TSEC_THI_METHOD1]]
| 0x54500044
| 0x04
|-
| [[#TSEC_THI_INT_STATUS|TSEC_THI_INT_STATUS]]
| 0x54500078
| 0x04
|-
| [[#TSEC_THI_INT_MASK|TSEC_THI_INT_MASK]]
| 0x5450007C
| 0x04
|-
| TSEC_THI_SLCG_STATUS
| 0x54500084
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_HIGH_A
| 0x54500088
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_LOW_A
| 0x5450008C
| 0x04
|-
| TSEC_THI_CLK_OVERRIDE
| 0x54500E00
| 0x04
|-
| [[#FALCON_IRQSSET|FALCON_IRQSSET]]
| 0x54501000
| 0x04
|-
| [[#FALCON_IRQSCLR|FALCON_IRQSCLR]]
| 0x54501004
| 0x04
|-
| [[#FALCON_IRQSTAT|FALCON_IRQSTAT]]
| 0x54501008
| 0x04
|-
| [[#FALCON_IRQMODE|FALCON_IRQMODE]]
| 0x5450100C
| 0x04
|-
| [[#FALCON_IRQMSET|FALCON_IRQMSET]]
| 0x54501010
| 0x04
|-
| [[#FALCON_IRQMCLR|FALCON_IRQMCLR]]
| 0x54501014
| 0x04
|-
| [[#FALCON_IRQMASK|FALCON_IRQMASK]]
| 0x54501018
| 0x04
|-
| [[#FALCON_IRQDEST|FALCON_IRQDEST]]
| 0x5450101C
| 0x04
|-
| FALCON_GPTMR_PERIOD
| 0x54501020
| 0x04
|-
| FALCON_GPTMR_TIME
| 0x54501024
| 0x04
|-
| FALCON_GPTMR_ENABLE
| 0x54501028
| 0x04
|-
| FALCON_TIME_LOW
| 0x5450102C
| 0x04
|-
| FALCON_TIME_HIGH
| 0x54501030
| 0x04
|-
| FALCON_WDTMR_TIME
| 0x54501034
| 0x04
|-
| FALCON_WDTMR_ENABLE
| 0x54501038
| 0x04
|-
| [[#FALCON_SCRATCH0|FALCON_SCRATCH0]]
| 0x54501040
| 0x04
|-
| [[#FALCON_SCRATCH1|FALCON_SCRATCH1]]
| 0x54501044
| 0x04
|-
| [[#FALCON_ITFEN|FALCON_ITFEN]]
| 0x54501048
| 0x04
|-
| [[#FALCON_IDLESTATE|FALCON_IDLESTATE]]
| 0x5450104C
| 0x04
|-
| FALCON_CURCTX
| 0x54501050
| 0x04
|-
| FALCON_NXTCTX
| 0x54501054
| 0x04
|-
| FALCON_CMDCTX
| 0x54501058
| 0x04
|-
| FALCON_STATUS_MASK
| 0x5450105C
| 0x04
|-
| FALCON_VM_SUPERVISOR
| 0x54501060
| 0x04
|-
| FALCON_MTHD_DATA
| 0x54501064
| 0x04
|-
| FALCON_MTHD_CMD
| 0x54501068
| 0x04
|-
| FALCON_MTHD_DATA_WR
| 0x5450106C
| 0x04
|-
| FALCON_MTHD_OCCUPIED
| 0x54501070
| 0x04
|-
| FALCON_MTHD_ACK
| 0x54501074
| 0x04
|-
| FALCON_MTHD_LIMIT
| 0x54501078
| 0x04
|-
| FALCON_SUBENGINE_RESET
| 0x5450107C
| 0x04
|-
| FALCON_SCRATCH2
| 0x54501080
| 0x04
|-
| FALCON_SCRATCH3
| 0x54501084
| 0x04
|-
| FALCON_PM_TRIGGER
| 0x54501088
| 0x04
|-
| FALCON_PM_MODE
| 0x5450108C
| 0x04
|-
| FALCON_DEBUG1
| 0x54501090
| 0x04
|-
| [[#FALCON_DEBUGINFO|FALCON_DEBUGINFO]]
| 0x54501094
| 0x04
|-
| FALCON_BREAKPOINT0
| 0x54501098
| 0x04
|-
| FALCON_BREAKPOINT1
| 0x5450109C
| 0x04
|-
| FALCON_CGCTL
| 0x545010A0
| 0x04
|-
| FALCON_ENGCTL
| 0x545010A4
| 0x04
|-
| FALCON_PM_SEL
| 0x545010A8
| 0x04
|-
| FALCON_HOST_IO_INDEX
| 0x545010AC
| 0x04
|-
| [[#FALCON_EXCI|FALCON_EXCI]]
| 0x545010D0
| 0x04
|-
| [[#FALCON_CPUCTL|FALCON_CPUCTL]]
| 0x54501100
| 0x04
|-
| [[#FALCON_BOOTVEC|FALCON_BOOTVEC]]
| 0x54501104
| 0x04
|-
| [[#FALCON_HWCFG|FALCON_HWCFG]]
| 0x54501108
| 0x04
|-
| [[#FALCON_DMACTL|FALCON_DMACTL]]
| 0x5450110C
| 0x04
|-
| [[#FALCON_DMATRF_EXTBASE|FALCON_DMATRF_EXTBASE]]
| 0x54501110
| 0x04
|-
| [[#FALCON_DMATRF_VOFF|FALCON_DMATRF_VOFF]]
| 0x54501114
| 0x04
|-
| [[#FALCON_DMATRFCMD|FALCON_DMATRFCMD]]
| 0x54501118
| 0x04
|-
| [[#FALCON_DMATRF_POFF|FALCON_DMATRF_POFF]]
| 0x5450111C
| 0x04
|-
| [[#FALCON_DMATRFSTAT|FALCON_DMATRFSTAT]]
| 0x54501120
| 0x04
|-
| [[#FALCON_CRYPTTRFSTAT|FALCON_CRYPTTRFSTAT]]
| 0x54501124
| 0x04
|-
| FALCON_CPUSTAT
| 0x54501128
| 0x04
|-
| [[#FALCON_HWCFG2|FALCON_HWCFG2]]
| 0x5450112C
| 0x04
|-
| FALCON_CPUCTL_ALIAS
| 0x54501130
| 0x04
|-
| FALCON_TLB_CMD
| 0x54501140
| 0x04
|-
| FALCON_TLB_CMD_RES
| 0x54501144
| 0x04
|-
| FALCON_BRANCH_HISTORY_CTRL
| 0x54501148
| 0x04
|-
| FALCON_BRANCH_HISTORY_PC
| 0x5450114C
| 0x04
|-
| FALCON_IMFILLRNG0
| 0x54501150
| 0x04
|-
| FALCON_IMFILLRNG1
| 0x54501154
| 0x04
|-
| FALCON_IMFILLCTL
| 0x54501158
| 0x04
|-
| FALCON_EXTERRWIN
| 0x54501160
| 0x04
|-
| FALCON_EXTERRCFG
| 0x54501164
| 0x04
|-
| FALCON_EXTERRADDR
| 0x54501168
| 0x04
|-
| FALCON_EXTERRSTAT
| 0x5450116C
| 0x04
|-
| FALCON_CG2
| 0x5450117C
| 0x04
|-
| FALCON_CODE_INDEX
| 0x54501180
| 0x04
|-
| FALCON_CODE
| 0x54501184
| 0x04
|-
| FALCON_CODE_VIRT_ADDR
| 0x54501188
| 0x04
|-
| FALCON_DATA_INDEX0
| 0x545011C0
| 0x04
|-
| FALCON_DATA0
| 0x545011C4
| 0x04
|-
| FALCON_DATA_INDEX1
| 0x545011C8
| 0x04
|-
| FALCON_DATA1
| 0x545011CC
| 0x04
|-
| FALCON_DATA_INDEX2
| 0x545011D0
| 0x04
|-
| FALCON_DATA2
| 0x545011D4
| 0x04
|-
| FALCON_DATA_INDEX3
| 0x545011D8
| 0x04
|-
| FALCON_DATA3
| 0x545011DC
| 0x04
|-
| FALCON_DATA_INDEX4
| 0x545011E0
| 0x04
|-
| FALCON_DATA4
| 0x545011E4
| 0x04
|-
| FALCON_DATA_INDEX5
| 0x545011E8
| 0x04
|-
| FALCON_DATA5
| 0x545011EC
| 0x04
|-
| FALCON_DATA_INDEX6
| 0x545011F0
| 0x04
|-
| FALCON_DATA6
| 0x545011F4
| 0x04
|-
| FALCON_DATA_INDEX7
| 0x545011F8
| 0x04
|-
| FALCON_DATA7
| 0x545011FC
| 0x04
|-
| [[#FALCON_ICD_CMD|FALCON_ICD_CMD]]
| 0x54501200
| 0x04
|-
| FALCON_ICD_ADDR
| 0x54501204
| 0x04
|-
| FALCON_ICD_WDATA
| 0x54501208
| 0x04
|-
| FALCON_ICD_RDATA
| 0x5450120C
| 0x04
|-
| [[#FALCON_SCTL|FALCON_SCTL]]
| 0x54501240
| 0x04
|-
| [[#TSEC_SCP_CTL_ACCESS|TSEC_SCP_CTL_ACCESS]]
| 0x54501400
| 0x04
|-
| [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]]
| 0x54501404
| 0x04
|-
| [[#TSEC_SCP_CTL_STAT|TSEC_SCP_CTL_STAT]]
| 0x54501408
| 0x04
|-
| [[#TSEC_SCP_CTL_MODE|TSEC_SCP_CTL_MODE]]
| 0x5450140C
| 0x04
|-
| TSEC_SCP_UNK0
| 0x54501410
| 0x04
|-
| [[#TSEC_SCP_CTL_PKEY|TSEC_SCP_CTL_PKEY]]
| 0x54501418
| 0x04
|-
| [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]]
| 0x54501420
| 0x04
|-
| [[#TSEC_SCP_SEQ_STAT|TSEC_SCP_SEQ_STAT]]
| 0x54501428
| 0x04
|-
| [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]]
| 0x54501430
| 0x04
|-
| TSEC_SCP_UNK2
| 0x54501454
| 0x04
|-
| [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]]
| 0x54501458
| 0x04
|-
| TSEC_SCP_UNK3
| 0x54501470
| 0x04
|-
| [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT]]
| 0x54501480
| 0x04
|-
| [[#TSEC_SCP_IRQMASK|TSEC_SCP_IRQMASK]]
| 0x54501484
| 0x04
|-
| TSEC_SCP_UNK4
| 0x54501490
| 0x04
|-
| [[#TSEC_SCP_ERR|TSEC_SCP_ERR]]
| 0x54501498
| 0x04
|-
| TSEC_TRNG_CLKDIV
| 0x54501500
| 0x04
|-
| TSEC_TRNG_UNK0
| 0x54501504
| 0x04
|-
| TSEC_TRNG_UNK1
| 0x5450150C
| 0x04
|-
| TSEC_TRNG_UNK2
| 0x54501510
| 0x04
|-
| TSEC_TRNG_UNK3
| 0x54501514
| 0x04
|-
| TSEC_TRNG_UNK4
| 0x54501518
| 0x04
|-
| TSEC_TRNG_UNK5
| 0x5450151C
| 0x04
|-
| TSEC_TRNG_UNK6
| 0x54501528
| 0x04
|-
| TSEC_TRNG_UNK7
| 0x5450152C
| 0x04
|-
| TSEC_TFBIF_UNK0
| 0x54501600
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL|TSEC_TFBIF_MCCIF_FIFOCTRL]]
| 0x54501604
| 0x04
|-
| TSEC_TFBIF_UNK1
| 0x54501608
| 0x04
|-
| TSEC_TFBIF_UNK2
| 0x5450160C
| 0x04
|-
| TSEC_TFBIF_UNK3
| 0x54501630
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL1|TSEC_TFBIF_MCCIF_FIFOCTRL1]]
| 0x54501634
| 0x04
|-
| TSEC_TFBIF_UNK4
| 0x54501640
| 0x04
|-
| [[#TSEC_TFBIF_UNK5|TSEC_TFBIF_UNK5]]
| 0x54501644
| 0x04
|-
| [[#TSEC_TFBIF_UNK6|TSEC_TFBIF_UNK6]]
| 0x54501648
| 0x04
|-
| [[#TSEC_DMA_CMD|TSEC_DMA_CMD]]
| 0x54501700
| 0x04
|-
| [[#TSEC_DMA_ADDR|TSEC_DMA_ADDR]]
| 0x54501704
| 0x04
|-
| [[#TSEC_DMA_VAL|TSEC_DMA_VAL]]
| 0x54501708
| 0x04
|-
| [[#TSEC_DMA_UNK|TSEC_DMA_UNK]]
| 0x5450170C
| 0x04
|-
| TSEC_TEGRA_FALCON_IP_VER
| 0x54501800
| 0x04
|-
| TSEC_TEGRA_UNK0
| 0x54501824
| 0x04
|-
| TSEC_TEGRA_UNK1
| 0x54501828
| 0x04
|-
| TSEC_TEGRA_UNK2
| 0x5450182C
| 0x04
|-
| [[#TSEC_TEGRA_CTL|TSEC_TEGRA_CTL]]
| 0x54501838
| 0x04
|}

=== TSEC_THI_METHOD0 ===
{| class="wikitable" border="1"
! ID
! Method
|-
| 0x200
| SET_APPLICATION_ID
|-
| 0x300
| EXECUTE
|-
| 0x500
| HDCP_INIT
|-
| 0x504
| HDCP_CREATE_SESSION
|-
| 0x508
| HDCP_VERIFY_CERT_RX
|-
| 0x50C
| HDCP_GENERATE_EKM
|-
| 0x510
| HDCP_REVOCATION_CHECK
|-
| 0x514
| HDCP_VERIFY_HPRIME
|-
| 0x518
| HDCP_ENCRYPT_PAIRING_INFO
|-
| 0x51C
| HDCP_DECRYPT_PAIRING_INFO
|-
| 0x520
| HDCP_UPDATE_SESSION
|-
| 0x524
| HDCP_GENERATE_LC_INIT
|-
| 0x528
| HDCP_VERIFY_LPRIME
|-
| 0x52C
| HDCP_GENERATE_SKE_INIT
|-
| 0x530
| HDCP_VERIFY_VPRIME
|-
| 0x534
| HDCP_ENCRYPTION_RUN_CTRL
|-
| 0x538
| HDCP_SESSION_CTRL
|-
| 0x53C
| HDCP_COMPUTE_SPRIME
|-
| 0x540
| HDCP_GET_CERT_RX
|-
| 0x544
| HDCP_EXCHANGE_INFO
|-
| 0x548
| HDCP_DECRYPT_KM
|-
| 0x54C
| HDCP_GET_HPRIME
|-
| 0x550
| HDCP_GENERATE_EKH_KM
|-
| 0x554
| HDCP_VERIFY_RTT_CHALLENGE
|-
| 0x558
| HDCP_GET_LPRIME
|-
| 0x55C
| HDCP_DECRYPT_KS
|-
| 0x560
| HDCP_DECRYPT
|-
| 0x564
| HDCP_GET_RRX
|-
| 0x568
| HDCP_DECRYPT_REENCRYPT
|-
| 0x56C
|
|-
| 0x570
|
|-
| 0x574
|
|-
| 0x578
|
|-
| 0x57C
|
|-
| 0x700
| HDCP_VALIDATE_SRM
|-
| 0x704
| HDCP_VALIDATE_STREAM
|-
| 0x708
| HDCP_TEST_SECURE_STATUS
|-
| 0x70C
| HDCP_SET_DCP_KPUB
|-
| 0x710
| HDCP_SET_RX_KPUB
|-
| 0x714
| HDCP_SET_CERT_RX
|-
| 0x718
| HDCP_SET_SCRATCH_BUFFER
|-
| 0x71C
| HDCP_SET_SRM
|-
| 0x720
| HDCP_SET_RECEIVER_ID_LIST
|-
| 0x724
| HDCP_SET_SPRIME
|-
| 0x728
| HDCP_SET_ENC_INPUT_BUFFER
|-
| 0x72C
| HDCP_SET_ENC_OUTPUT_BUFFER
|-
| 0x730
| HDCP_GET_RTT_CHALLENGE
|-
| 0x734
| HDCP_STREAM_MANAGE
|-
| 0x738
| HDCP_READ_CAPS
|-
| 0x73C
| HDCP_ENCRYPT
|-
| 0x740
| [6.0.0+] HDCP_GET_CURRENT_NONCE
|}

Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_METHOD1 ===
Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_INT_STATUS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_STATUS_FALCON_INT
|}

=== TSEC_THI_INT_MASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_MASK_FALCON_INT
|}

=== FALCON_IRQSSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSSET_GPTMR
|-
| 1
| FALCON_IRQSSET_WDTMR
|-
| 2
| FALCON_IRQSSET_MTHD
|-
| 3
| FALCON_IRQSSET_CTXSW
|-
| 4
| FALCON_IRQSSET_HALT
|-
| 5
| FALCON_IRQSSET_EXTERR
|-
| 6
| FALCON_IRQSSET_SWGEN0
|-
| 7
| FALCON_IRQSSET_SWGEN1
|-
| 8-15
| FALCON_IRQSSET_EXT
|}

Used for setting Falcon's IRQs.

=== FALCON_IRQSCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSCLR_GPTMR
|-
| 1
| FALCON_IRQSCLR_WDTMR
|-
| 2
| FALCON_IRQSCLR_MTHD
|-
| 3
| FALCON_IRQSCLR_CTXSW
|-
| 4
| FALCON_IRQSCLR_HALT
|-
| 5
| FALCON_IRQSCLR_EXTERR
|-
| 6
| FALCON_IRQSCLR_SWGEN0
|-
| 7
| FALCON_IRQSCLR_SWGEN1
|-
| 8-15
| FALCON_IRQSCLR_EXT
|}

Used for clearing Falcon's IRQs.

=== FALCON_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSTAT_GPTMR
|-
| 1
| FALCON_IRQSTAT_WDTMR
|-
| 2
| FALCON_IRQSTAT_MTHD
|-
| 3
| FALCON_IRQSTAT_CTXSW
|-
| 4
| FALCON_IRQSTAT_HALT
|-
| 5
| FALCON_IRQSTAT_EXTERR
|-
| 6
| FALCON_IRQSTAT_SWGEN0
|-
| 7
| FALCON_IRQSTAT_SWGEN1
|-
| 8-15
| FALCON_IRQSTAT_EXT
|}

Used for getting the status of Falcon's IRQs.

=== FALCON_IRQMODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMODE_GPTMR
|-
| 1
| FALCON_IRQMODE_WDTMR
|-
| 2
| FALCON_IRQMODE_MTHD
|-
| 3
| FALCON_IRQMODE_CTXSW
|-
| 4
| FALCON_IRQMODE_HALT
|-
| 5
| FALCON_IRQMODE_EXTERR
|-
| 6
| FALCON_IRQMODE_SWGEN0
|-
| 7
| FALCON_IRQMODE_SWGEN1
|-
| 8-15
| FALCON_IRQMODE_EXT
|}

Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.

=== FALCON_IRQMSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMSET_GPTMR
|-
| 1
| FALCON_IRQMSET_WDTMR
|-
| 2
| FALCON_IRQMSET_MTHD
|-
| 3
| FALCON_IRQMSET_CTXSW
|-
| 4
| FALCON_IRQMSET_HALT
|-
| 5
| FALCON_IRQMSET_EXTERR
|-
| 6
| FALCON_IRQMSET_SWGEN0
|-
| 7
| FALCON_IRQMSET_SWGEN1
|-
| 8-15
| FALCON_IRQMSET_EXT
|}

Used for setting the mask for Falcon's IRQs.

=== FALCON_IRQMCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMCLR_GPTMR
|-
| 1
| FALCON_IRQMCLR_WDTMR
|-
| 2
| FALCON_IRQMCLR_MTHD
|-
| 3
| FALCON_IRQMCLR_CTXSW
|-
| 4
| FALCON_IRQMCLR_HALT
|-
| 5
| FALCON_IRQMCLR_EXTERR
|-
| 6
| FALCON_IRQMCLR_SWGEN0
|-
| 7
| FALCON_IRQMCLR_SWGEN1
|-
| 8-15
| FALCON_IRQMCLR_EXT
|}

Used for clearing the mask for Falcon's IRQs.

=== FALCON_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMASK_GPTMR
|-
| 1
| FALCON_IRQMASK_WDTMR
|-
| 2
| FALCON_IRQMASK_MTHD
|-
| 3
| FALCON_IRQMASK_CTXSW
|-
| 4
| FALCON_IRQMASK_HALT
|-
| 5
| FALCON_IRQMASK_EXTERR
|-
| 6
| FALCON_IRQMASK_SWGEN0
|-
| 7
| FALCON_IRQMASK_SWGEN1
|-
| 8-15
| FALCON_IRQMASK_EXT
|}

Used for getting the value of the mask for Falcon's IRQs.

=== FALCON_IRQDEST ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQDEST_HOST_GPTMR
|-
| 1
| FALCON_IRQDEST_HOST_WDTMR
|-
| 2
| FALCON_IRQDEST_HOST_MTHD
|-
| 3
| FALCON_IRQDEST_HOST_CTXSW
|-
| 4
| FALCON_IRQDEST_HOST_HALT
|-
| 5
| FALCON_IRQDEST_HOST_EXTERR
|-
| 6
| FALCON_IRQDEST_HOST_SWGEN0
|-
| 7
| FALCON_IRQDEST_HOST_SWGEN1
|-
| 8-15
| FALCON_IRQDEST_HOST_EXT
|-
| 16
| FALCON_IRQDEST_TARGET_GPTMR
|-
| 17
| FALCON_IRQDEST_TARGET_WDTMR
|-
| 18
| FALCON_IRQDEST_TARGET_MTHD
|-
| 19
| FALCON_IRQDEST_TARGET_CTXSW
|-
| 20
| FALCON_IRQDEST_TARGET_HALT
|-
| 21
| FALCON_IRQDEST_TARGET_EXTERR
|-
| 22
| FALCON_IRQDEST_TARGET_SWGEN0
|-
| 23
| FALCON_IRQDEST_TARGET_SWGEN1
|-
| 24-31
| FALCON_IRQDEST_TARGET_EXT
|}

Used for routing Falcon's IRQs.

=== FALCON_SCRATCH0 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_SCRATCH1 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_ITFEN ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_ITFEN_CTXEN
|-
| 1
| FALCON_ITFEN_MTHDEN
|}

Used for enabling/disabling Falcon interfaces.

=== FALCON_IDLESTATE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IDLESTATE_FALCON_BUSY
|-
| 1-15
| FALCON_IDLESTATE_EXT_BUSY
|}

Used for detecting if Falcon is busy or not.

=== FALCON_DEBUGINFO ===
Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.

[6.0.0+] [[NV_services|nvservices]] sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.

=== FALCON_EXCI ===
Contains information about raised exceptions.

=== FALCON_CPUCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_CPUCTL_IINVAL
|-
| 1
| FALCON_CPUCTL_STARTCPU
|-
| 2
| FALCON_CPUCTL_SRESET
|-
| 3
| FALCON_CPUCTL_HRESET
|-
| 4
| FALCON_CPUCTL_HALTED
|-
| 5
| FALCON_CPUCTL_STOPPED
|-
| 6
| FALCON_CPUCTL_SCP_UNK
|}

Used for signaling the Falcon CPU.

=== FALCON_BOOTVEC ===
Takes the Falcon's boot vector address.

=== FALCON_HWCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-8
| FALCON_HWCFG_IMEM_SIZE
|-
| 9-17
| FALCON_HWCFG_DMEM_SIZE
|-
| 18-25
| FALCON_HWCFG_MTHD_SIZE
|-
| 26-31
| FALCON_HWCFG_DMATRF_SLOTS
|}

=== FALCON_DMACTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMACTL_REQUIRE_CTX
|-
| 1
| FALCON_DMACTL_DMEM_SCRUBBING
|-
| 2
| FALCON_DMACTL_IMEM_SCRUBBING
|-
| 3-6
| FALCON_DMACTL_DMAQ_NUM
|-
| 7
| FALCON_DMACTL_SECURE_STAT
|}

Used for configuring the Falcon's DMA engine.

=== FALCON_DMATRF_EXTBASE ===
Base of the external memory buffer.

The base of the transfer is calculated by adding [[#FALCON_DMATRF_POFF]] to the base.

=== FALCON_DMATRF_VOFF ===
For transfers to DMEM: the destination address.
For transfers to IMEM: the destination virtual IMEM page.

=== FALCON_DMATRF_POFF ===
For transfers to IMEM: the destination physical IMEM page.

=== FALCON_DMATRFCMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFCMD_FULL
|-
| 1
| FALCON_DMATRFCMD_IDLE
|-
| 2-3
| FALCON_DMATRFCMD_SEC
|-
| 4
| FALCON_DMATRFCMD_IMEM
|-
| 5
| FALCON_DMATRFCMD_WRITE
|-
| 8-10
| FALCON_DMATRFCMD_SIZE
|-
| 12-14
| FALCON_DMATRFCMD_CTXDMA
|}

Used for configuring DMA transfers.

=== FALCON_DMATRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFSTAT_PENDING
|-
| 16-18
| FALCON_DMATRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_DMATRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_CRYPTTRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| FALCON_CRYPTTRFSTAT_PENDING
|-
| 5
| FALCON_CRYPTTRFSTAT_ENABLED
|-
| 16-18
| FALCON_CRYPTTRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_CRYPTTRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_HWCFG2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_HWCFG2_VERSION
|-
| 4-5
| FALCON_HWCFG2_SCP_MODE
|-
| 6-7
| FALCON_HWCFG2_SUBVERSION
|-
| 8-11
| FALCON_HWCFG2_IMEM_PORTS
|-
| 12-15
| FALCON_HWCFG2_DMEM_PORTS
|-
| 16-19
| FALCON_HWCFG2_VM_PAGES_LOG2
|}

=== FALCON_ICD_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_ICD_CMD_OPC
0x0: BREAK
0x1: CONTINUE_FROM_PC
0x2: CONTINUE_FROM_ADDR
0x3: CONTINUE_UNK1_FROM_PC
0x4: CONTINUE_UNK1_FROM_ADDR
0x5: SINGLE_STEP_FROM_PC
0x6: SINGLE_STEP_FROM_ADDR
0x7: SET_BREAK_MASK
0x8: REG_READ
0x9: REG_WRITE
0xA: DATA_READ
0xB: DATA_WRITE
0xC: IO_READ
0xD: IO_WRITE
0xE: STATUS_READ
|-
| 6-7
| FALCON_ICD_CMD_DATA_SIZE
|-
| 8-12
| FALCON_ICD_CMD_IDX
|-
| 14
| FALCON_ICD_CMD_ERROR
|-
| 15
| FALCON_ICD_CMD_DONE
|-
| 16-31
| FALCON_ICD_CMD_BREAK_MASK
|}

=== FALCON_SCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| FALCON_SCTL_SEC_MODE
0: Non-secure
1: Light Secure
2: Heavy Secure
|}

=== TSEC_SCP_CTL_ACCESS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| Enable TSEC_SCP_INSN_STAT register
|}

=== TSEC_SCP_CTL_TRNG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 11
| Unknown
|-
| 12
| Enable the TRNG
|}

=== TSEC_SCP_CTL_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| TSEC_SCP_CTL_STAT_DEBUG_MODE
|}

=== TSEC_SCP_CTL_MODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Disable reads for the TRNG register block
|-
| 1
| Disable reads for the TFBIF register block
|-
| 2
| Disable reads for the DMA register block
|-
| 3
| Disable reads for the TEGRA register block
|-
| 4
| Disable writes for the TRNG register block
|-
| 5
| Disable writes for the TFBIF register block
|-
| 6
| Disable writes for the DMA register block
|-
| 7
| Disable writes for the TEGRA register block
|}

Controls accesses to the other sub-engines and can only be cleared in Heavy Secure mode.

=== TSEC_SCP_CTL_PKEY ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
|-
| 1
| TSEC_SCP_CTL_PKEY_LOADED
|}

=== TSEC_SCP_SEQ0_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 8-11
| Size of current cs0begin macro
|-
|}

=== TSEC_SCP_SEQ_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Set if crypto sequence recording (cs0begin/cs1begin) is active
|-
| 4-7
| Number of instructions left for the crypto sequence
|-
| 12-15
| Active crypto key register
|}

Contains information on the last crypto sequence (cs0 or cs1) executed.

=== TSEC_SCP_INSN_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| Crypto fuc5 destination register or immediate value
|-
| 8-15
| Crypto fuc5 source register or immediate value
|-
| 20-24
| Crypto fuc5 operation
0x0: none (fuc5 opcode 0x00)
0x1: cmov (fuc5 opcode 0x84)
0x2: cxsin (fuc5 opcode 0x88) or xdst (with cxset)
0x3: cxsout (fuc5 opcode 0x8C) or xdld (with cxset)
0x4: crng (fuc5 opcode 0x90)
0x5: cs0begin (fuc5 opcode 0x94)
0x6: cs0exec (fuc5 opcode 0x98)
0x7: cs1begin (fuc5 opcode 0x9C)
0x8: cs1exec (fuc5 opcode 0xA0)
0x9: invalid (fuc5 opcode 0xA4)
0xA: cchmod (fuc5 opcode 0xA8)
0xB: cxor (fuc5 opcode 0xAC)
0xC: cadd (fuc5 opcode 0xB0)
0xD: cand (fuc5 opcode 0xB4)
0xE: crev (fuc5 opcode 0xB8)
0xF: cprecmac (fuc5 opcode 0xBC)
0x10: csecret (fuc5 opcode 0xC0)
0x11: ckeyreg (fuc5 opcode 0xC4)
0x12: ckexp (fuc5 opcode 0xC8)
0x13: ckrexp (fuc5 opcode 0xCC)
0x14: cenc (fuc5 opcode 0xD0)
0x15: cdec (fuc5 opcode 0xD4)
0x16: csigauth (fuc5 opcode 0xD8)
0x17: csigenc (fuc5 opcode 0xDC)
0x18: csigclr (fuc5 opcode 0xE0)
|-
| 31
| Set if running in secure mode (cauth)
|}

Contains information on the last crypto instruction executed.

=== TSEC_SCP_AES_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-4
| First opcode
|-
| 5-9
| Second opcode
|-
| 15-16
| AES operation
0: Encryption
1: Decryption
2: Key expansion
3: Key reverse expansion
|}

Contains information on the last AES sequence executed.

=== TSEC_SCP_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQSTAT_TRNG
|-
| 8
| TSEC_SCP_IRQSTAT_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQSTAT_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQSTAT_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the status of crypto IRQs.

=== TSEC_SCP_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQMASK_TRNG
|-
| 8
| TSEC_SCP_IRQMASK_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQMASK_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQMASK_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the value of the mask for crypto IRQs.

=== TSEC_SCP_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Invalid instruction
|-
| 4
| Empty crypto sequence
|-
| 8
| Crypto sequence is too long
|-
| 12
| Crypto sequence was not finished
|-
| 16
| Invalid cauth signature (during csigenc, csigclr or csigunk)
|-
| 24
| Forbidden instruction
|}

Contains information on crypto errors generated by the [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT_INSN_ERROR]] IRQ.

=== TSEC_TFBIF_MCCIF_FIFOCTRL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
|-
| 1
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
|-
| 2
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
|-
| 3
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
|-
| 4
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
|-
| 5
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
|-
| 6
| TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
|-
| 7
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
|-
| 8
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE
|}

=== TSEC_MCCIF_FIFOCTRL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
|-
| 16-31
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT
|}

=== TSEC_TFBIF_UNK5 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.

=== TSEC_TFBIF_UNK6 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to (data_size << 4) before reading memory from the GPU UCODE carveout.

=== TSEC_DMA_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_DMA_CMD_READ
|-
| 1
| TSEC_DMA_CMD_WRITE
|-
| 4-7
| TSEC_DMA_CMD_UNK
|-
| 12
| TSEC_DMA_CMD_BUSY
|-
| 13
| TSEC_DMA_CMD_ERROR
|-
| 31
| TSEC_DMA_CMD_INIT
|}

A DMA read/write operation requires bits TSEC_DMA_CMD_INIT and TSEC_DMA_CMD_READ/TSEC_DMA_CMD_WRITE to be set in TSEC_DMA_CMD.

During the transfer, the TSEC_DMA_CMD_BUSY bit is set.

Accessing an invalid address causes bit TSEC_DMA_CMD_ERROR to be set.

=== TSEC_DMA_ADDR ===
Takes the address for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_VAL ===
Takes the value for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_UNK ===
Always 0xFFF.

=== TSEC_TEGRA_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 16
| TSEC_TEGRA_CTL_TKFI_KFUSE
|-
| 17
| TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
|-
| 24
| TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
|-
| 25
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
|-
| 26
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
|-
| 27
| TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C
|}

== Authenticated Mode ==
===== Entry =====
From non-secure mode, upon jumping to a page marked as secret, a secret fault occurs. This causes the CPU to verify the region specified in $cauth against the MAC loaded in $c6. If the comparison is successful, the valid bit (bit0) is set on all pages in the $cauth region, and $pc is set to the base of the $cauth region. If the comparsion fails, the CPU is halted.

===== Exit =====
The CPU automatically goes back to non-secure mode when returning back into non-secret pages. When this happens, the valid bit (bit0) in the TLB flags is cleared for all secret pages.

===== Implementation =====
Under certain circumstances, it is possible to observe [[#csigauth|csigauth]] being briefly written to [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]] as "csigauth $c4 $c6" while the opcodes in [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]] are set to "cxsin" and "csigauth", respectively.

Via [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]] it can be observed that a 3-sized macro sequence is loaded into cs0 during a secure mode transition.

== Crypto processing ==
Part of the information here (which hasn't made it into envytools documentation yet) was shared by [https://wiki.0x04.net/wiki/Marcin_Ko%C5%9Bcielnicki mwk] from reverse engineering falcon processors over the years.

=== cauth ===
$cauth is a special purpose register in the CPU.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7 || Start of region to authenticate (in 0x100 pages)
|-
| 8-15 || Unused
|-
| 16 || Use secret xfers (?)
|-
| 17 || Region is signed and encrypted and double the size (?)
|-
| 18 ||
|-
| 19 ||
|-
| 20-23 || Unused
|-
| 31-24 || Size of region to authenticate (in 0x100 pages)
|}

== SCP operations ==

{| class="wikitable" border="1"
! Opcode
! Name
! Operand0
! Operand1
! Operation
! Condition
|-
| 0 || || || || ||
|-
| 1 || mov || $cX || $cY || <code>$cX = $cY; ACL(X) = ACL(Y);</code> ||
|-
| 2 || sin || $cX || N/A || <code>$cX = read_stream(); ACL(X) = ???;</code> ||
|-
| 3 || sout || $cX || N/A || <code>write_stream($cX);</code> ||
|-
| 4 || rnd || $cX || N/A || <code>$cX = read_trng(); ACL(X) = ???;</code> ||
|-
| 5 || s0begin || immX || N/A || <code>record_macro_for_N_instructions(0, immX);</code> ||
|-
| 6 || s0exec || immX || N/A || <code>execute_macro_N_times(0, immX);</code> ||
|-
| 7 || s1begin || immX || N/A || <code>record_macro_for_N_instructions(1, immX);</code> ||
|-
| 8 || s1exec || immX || N/A || <code>execute_macro_N_times(1, immX);</code> ||
|-
| 9 || ? || || || ||
|-
| 0xA || chmod || $cX || immY || <code>if (immY & 3) ACL(X) = (ACL(X) & immY) | 1; else ACL(X) = 0;</code> ||
|-
| 0xB || xor || $cX || $cY || <code>$cX ^= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xC || add || $cX || immY || <code>$cX += immY;</code> || <code>(ACL(X) & 2)</code>
|-
| 0xD || and || $cX || $cY || <code>$cX &= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xE || rev || $cX || $cY || <code>$cX = reverse($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 1)</code>
|-
| 0xF || gfmul || $cX || $cY || <code>$cX = gfmul($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 2)</code>
|-
| 0x10 || secret || $cX || immY || <code>$cX = load_secret(immY); ACL(X) = load_secret_acl(immY);</code> ||
|-
| 0x11 || keyreg || immX || || <code>active_key_idx = immX;</code> ||
|-
| 0x12 || kexp || $cX || $cY || <code>$cX = aes_kexp($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 1)</code>
|-
| 0x13 || krexp || $cX || $cY || <code>$cX = aes_kexp_reverse($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 1)</code>
|-
| 0x14 || enc || $cX || $cY || <code>$cX = aes_enc(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 1) && (ACL(Y) & 2)</code>
|-
| 0x15 || dec || $cX || $cY || <code>$cX = aes_dec(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 1) && (ACL(Y) & 2)</code>
|-
| ...
|}

=== ACL ===
{| class="wikitable" border="1"
! Bit
! Meaning
|-
| 0 || Present. This is forced set if bit1 is set, the only way to clear it is to clear *both* bit0 and bit1.
|-
| 1 || Allowed as input
|}

==== Initial values ====
On SCP boot, the ACL is 0x1F for all $cX.

Loading into $cX using xdst instruction sets ACL($cX) to 0x1F.

Spilling a $cX to DMEM using xdld instruction is allowed if (ACL($cX) & 2).

=== csigauth ===
<code>00000000: f5 3c XY d8 csigauth $cY $cX</code>

This instruction takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret.

=== csigclr ===
<code>00000000: f5 3c 00 e0 csigclr</code>

This instruction takes no operands and appears to clear the saved cauth signature used by the csigenc instruction.

=== cchmod ===
<code>00000000: f5 3c XY a8 cchmod $cY 0X</code> or <code>00000000: f5 3c XY a9 cchmod $cY 1X</code>

This instruction takes a crypto register and a 5 bit immediate value. It appears to set the [[#Register ACLs|crypto registers' ACL]] bits as follows:
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Allow register to be used as key in NS or LS mode
|-
| 1
| Allow register to be used as key in HS mode
|-
| 2
| Set register as readable in NS or LS mode
|-
| 3
| Set register as readable in HS mode
|-
| 4
| Set register as writable in NS or LS mode
|}

=== crng ===
<code>00000000: f5 3c 0X 90 crng $cX</code>

This instruction initializes a crypto register with random data.

Executing this instruction only succeeds if the TRNG is enabled for the SCP, which requires taking the following steps:
* Write 0x7FFF to TSEC_TRNG_CLKDIV.
* Write 0x3FF0000 to TSEC_TRNG_UNK0.
* Write 0xFF00 to TSEC_TRNG_UNK7.
* Write 0x1000 to [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]].

Otherwise it hangs forever.

=== cxset ===
cxset instruction provides a way to change behavior of a variable amount of successively executed DMA-related instructions.

for example: <code>000000de: f4 3c 02 cxset 0x2</code>

can be read as: <code>dma_override(type=crypto_reg, count=2)</code>

The argument to cxset specifies the type of behavior change in the top 3 bits, and the number of DMA-related instructions the effect lasts for in the lower 5 bits.

{| class=wikitable
! Bits || Description
|-
| 0-4 || Number of instructions it is valid for (0x1f is a special value meaning infinitely many instructions -- until overriden by another cxset)
|-
| 5 || Crypto destination/source select (0=crypto register, 1=crypto stream)
|-
| 6 || External memory override (0=Disabled, 1=Enabled)
|-
| 7 || Internal memory select (0=DMEM, 1=IMEM)
|}

==== DMA-Related Instructions ====
At least the following instructions may have changed behavior, and count against the cxset "count" argument: <code>xdwait</code>, <code>xdst</code>, <code>xdld</code>.

For example, if override type=0b000, then the "length" argument to <code>xdst</code> is instead treated as the index of the target $cX register.

=== Secrets ===
Falcon's Authenticated Mode has access to 64 128-bit keys which are burned at factory. These keys can be loaded by using the $csecret instruction which takes the target crypto register and the key index as arguments.

{| class=wikitable
! Index || Notes || Console-unique
|-
| 0x00 || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares. || No
|-
| 0x01 || Used by nvhost_nvdec_bl020_prod firmware. ||
|-
| 0x03 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x04 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x05 || Used by nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares. ||
|-
| 0x07 || Used by [6.0.0+] nvhost_tsec firmware. ||
|-
| 0x09 || Used by nvhost_tsec firmware. ||
|-
| 0x0B || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x0F || Used by nvhost_tsec firmware. ||
|-
| 0x10 || Used by [1.0.0-5.1.0] nvhost_tsec firmware. ||
|-
| 0x15 || Used by nvhost_nvdec_bl020_prod, [5.0.0+] nvhost_nvdec020_prod, [5.0.0+] nvhost_nvdec020_ns and [6.0.0+] nvhost_tsec firmwares. ||
|-
| 0x26 || Used by [[TSEC_Firmware#KeygenLdr|KeygenLdr]]. || No
|-
| 0x3C || Used by nvhost_tsec firmware. ||
|-
| 0x3F || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. || Yes
|}

TSEC

2019-01-06T09:50:57Z

Qlutoo: /* ACL */

TSEC (Tegra Security Co-processor) is a dedicated unit powered by a NVIDIA Falcon microprocessor with crypto extensions.

= Driver =
A host driver for communicating with the TSEC is mapped to physical address 0x54500000 with a total size of 0x40000 bytes and exposes several registers.

== Registers ==
Registers from 0x54500000 to 0x54501000 are used to configure the host interface (HOST1X).

Registers from 0x54501000 to 0x54502000 are a MMIO window for communicating with the Falcon microprocessor. From this range, the subset of registers from 0x54501400 to 0x54501FE8 are specific to the TSEC and are subdivided into:
* 0x54501400 to 0x54501500: SCP (Secure Crypto Processor?).
* 0x54501500 to 0x54501600: TRNG (True Random Number Generator).
* 0x54501600 to 0x54501700: TFBIF (Tegra Framebuffer Interface).
* 0x54501700 to 0x54501800: DMA.
* 0x54501800 to 0x54501900: TEGRA (miscellaneous interfaces).

{| class="wikitable" border="1"
! Name
! Address
! Width
|-
| TSEC_THI_INCR_SYNCPT
| 0x54500000
| 0x04
|-
| TSEC_THI_INCR_SYNCPT_ERR
| 0x54500008
| 0x04
|-
| TSEC_THI_CTXSW_INCR_SYNCPT
| 0x5450000C
| 0x04
|-
| TSEC_THI_CTXSW
| 0x54500020
| 0x04
|-
| TSEC_THI_CONT_SYNCPT_EOF
| 0x54500028
| 0x04
|-
| [[#TSEC_THI_METHOD0|TSEC_THI_METHOD0]]
| 0x54500040
| 0x04
|-
| [[#TSEC_THI_METHOD1|TSEC_THI_METHOD1]]
| 0x54500044
| 0x04
|-
| [[#TSEC_THI_INT_STATUS|TSEC_THI_INT_STATUS]]
| 0x54500078
| 0x04
|-
| [[#TSEC_THI_INT_MASK|TSEC_THI_INT_MASK]]
| 0x5450007C
| 0x04
|-
| TSEC_THI_SLCG_STATUS
| 0x54500084
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_HIGH_A
| 0x54500088
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_LOW_A
| 0x5450008C
| 0x04
|-
| TSEC_THI_CLK_OVERRIDE
| 0x54500E00
| 0x04
|-
| [[#FALCON_IRQSSET|FALCON_IRQSSET]]
| 0x54501000
| 0x04
|-
| [[#FALCON_IRQSCLR|FALCON_IRQSCLR]]
| 0x54501004
| 0x04
|-
| [[#FALCON_IRQSTAT|FALCON_IRQSTAT]]
| 0x54501008
| 0x04
|-
| [[#FALCON_IRQMODE|FALCON_IRQMODE]]
| 0x5450100C
| 0x04
|-
| [[#FALCON_IRQMSET|FALCON_IRQMSET]]
| 0x54501010
| 0x04
|-
| [[#FALCON_IRQMCLR|FALCON_IRQMCLR]]
| 0x54501014
| 0x04
|-
| [[#FALCON_IRQMASK|FALCON_IRQMASK]]
| 0x54501018
| 0x04
|-
| [[#FALCON_IRQDEST|FALCON_IRQDEST]]
| 0x5450101C
| 0x04
|-
| FALCON_GPTMR_PERIOD
| 0x54501020
| 0x04
|-
| FALCON_GPTMR_TIME
| 0x54501024
| 0x04
|-
| FALCON_GPTMR_ENABLE
| 0x54501028
| 0x04
|-
| FALCON_TIME_LOW
| 0x5450102C
| 0x04
|-
| FALCON_TIME_HIGH
| 0x54501030
| 0x04
|-
| FALCON_WDTMR_TIME
| 0x54501034
| 0x04
|-
| FALCON_WDTMR_ENABLE
| 0x54501038
| 0x04
|-
| [[#FALCON_SCRATCH0|FALCON_SCRATCH0]]
| 0x54501040
| 0x04
|-
| [[#FALCON_SCRATCH1|FALCON_SCRATCH1]]
| 0x54501044
| 0x04
|-
| [[#FALCON_ITFEN|FALCON_ITFEN]]
| 0x54501048
| 0x04
|-
| [[#FALCON_IDLESTATE|FALCON_IDLESTATE]]
| 0x5450104C
| 0x04
|-
| FALCON_CURCTX
| 0x54501050
| 0x04
|-
| FALCON_NXTCTX
| 0x54501054
| 0x04
|-
| FALCON_CMDCTX
| 0x54501058
| 0x04
|-
| FALCON_STATUS_MASK
| 0x5450105C
| 0x04
|-
| FALCON_VM_SUPERVISOR
| 0x54501060
| 0x04
|-
| FALCON_MTHD_DATA
| 0x54501064
| 0x04
|-
| FALCON_MTHD_CMD
| 0x54501068
| 0x04
|-
| FALCON_MTHD_DATA_WR
| 0x5450106C
| 0x04
|-
| FALCON_MTHD_OCCUPIED
| 0x54501070
| 0x04
|-
| FALCON_MTHD_ACK
| 0x54501074
| 0x04
|-
| FALCON_MTHD_LIMIT
| 0x54501078
| 0x04
|-
| FALCON_SUBENGINE_RESET
| 0x5450107C
| 0x04
|-
| FALCON_SCRATCH2
| 0x54501080
| 0x04
|-
| FALCON_SCRATCH3
| 0x54501084
| 0x04
|-
| FALCON_PM_TRIGGER
| 0x54501088
| 0x04
|-
| FALCON_PM_MODE
| 0x5450108C
| 0x04
|-
| FALCON_DEBUG1
| 0x54501090
| 0x04
|-
| [[#FALCON_DEBUGINFO|FALCON_DEBUGINFO]]
| 0x54501094
| 0x04
|-
| FALCON_BREAKPOINT0
| 0x54501098
| 0x04
|-
| FALCON_BREAKPOINT1
| 0x5450109C
| 0x04
|-
| FALCON_CGCTL
| 0x545010A0
| 0x04
|-
| FALCON_ENGCTL
| 0x545010A4
| 0x04
|-
| FALCON_PM_SEL
| 0x545010A8
| 0x04
|-
| FALCON_HOST_IO_INDEX
| 0x545010AC
| 0x04
|-
| [[#FALCON_EXCI|FALCON_EXCI]]
| 0x545010D0
| 0x04
|-
| [[#FALCON_CPUCTL|FALCON_CPUCTL]]
| 0x54501100
| 0x04
|-
| [[#FALCON_BOOTVEC|FALCON_BOOTVEC]]
| 0x54501104
| 0x04
|-
| [[#FALCON_HWCFG|FALCON_HWCFG]]
| 0x54501108
| 0x04
|-
| [[#FALCON_DMACTL|FALCON_DMACTL]]
| 0x5450110C
| 0x04
|-
| [[#FALCON_DMATRF_EXTBASE|FALCON_DMATRF_EXTBASE]]
| 0x54501110
| 0x04
|-
| [[#FALCON_DMATRF_VOFF|FALCON_DMATRF_VOFF]]
| 0x54501114
| 0x04
|-
| [[#FALCON_DMATRFCMD|FALCON_DMATRFCMD]]
| 0x54501118
| 0x04
|-
| [[#FALCON_DMATRF_POFF|FALCON_DMATRF_POFF]]
| 0x5450111C
| 0x04
|-
| [[#FALCON_DMATRFSTAT|FALCON_DMATRFSTAT]]
| 0x54501120
| 0x04
|-
| [[#FALCON_CRYPTTRFSTAT|FALCON_CRYPTTRFSTAT]]
| 0x54501124
| 0x04
|-
| FALCON_CPUSTAT
| 0x54501128
| 0x04
|-
| [[#FALCON_HWCFG2|FALCON_HWCFG2]]
| 0x5450112C
| 0x04
|-
| FALCON_CPUCTL_ALIAS
| 0x54501130
| 0x04
|-
| FALCON_TLB_CMD
| 0x54501140
| 0x04
|-
| FALCON_TLB_CMD_RES
| 0x54501144
| 0x04
|-
| FALCON_BRANCH_HISTORY_CTRL
| 0x54501148
| 0x04
|-
| FALCON_BRANCH_HISTORY_PC
| 0x5450114C
| 0x04
|-
| FALCON_IMFILLRNG0
| 0x54501150
| 0x04
|-
| FALCON_IMFILLRNG1
| 0x54501154
| 0x04
|-
| FALCON_IMFILLCTL
| 0x54501158
| 0x04
|-
| FALCON_EXTERRWIN
| 0x54501160
| 0x04
|-
| FALCON_EXTERRCFG
| 0x54501164
| 0x04
|-
| FALCON_EXTERRADDR
| 0x54501168
| 0x04
|-
| FALCON_EXTERRSTAT
| 0x5450116C
| 0x04
|-
| FALCON_CG2
| 0x5450117C
| 0x04
|-
| FALCON_CODE_INDEX
| 0x54501180
| 0x04
|-
| FALCON_CODE
| 0x54501184
| 0x04
|-
| FALCON_CODE_VIRT_ADDR
| 0x54501188
| 0x04
|-
| FALCON_DATA_INDEX0
| 0x545011C0
| 0x04
|-
| FALCON_DATA0
| 0x545011C4
| 0x04
|-
| FALCON_DATA_INDEX1
| 0x545011C8
| 0x04
|-
| FALCON_DATA1
| 0x545011CC
| 0x04
|-
| FALCON_DATA_INDEX2
| 0x545011D0
| 0x04
|-
| FALCON_DATA2
| 0x545011D4
| 0x04
|-
| FALCON_DATA_INDEX3
| 0x545011D8
| 0x04
|-
| FALCON_DATA3
| 0x545011DC
| 0x04
|-
| FALCON_DATA_INDEX4
| 0x545011E0
| 0x04
|-
| FALCON_DATA4
| 0x545011E4
| 0x04
|-
| FALCON_DATA_INDEX5
| 0x545011E8
| 0x04
|-
| FALCON_DATA5
| 0x545011EC
| 0x04
|-
| FALCON_DATA_INDEX6
| 0x545011F0
| 0x04
|-
| FALCON_DATA6
| 0x545011F4
| 0x04
|-
| FALCON_DATA_INDEX7
| 0x545011F8
| 0x04
|-
| FALCON_DATA7
| 0x545011FC
| 0x04
|-
| [[#FALCON_ICD_CMD|FALCON_ICD_CMD]]
| 0x54501200
| 0x04
|-
| FALCON_ICD_ADDR
| 0x54501204
| 0x04
|-
| FALCON_ICD_WDATA
| 0x54501208
| 0x04
|-
| FALCON_ICD_RDATA
| 0x5450120C
| 0x04
|-
| [[#FALCON_SCTL|FALCON_SCTL]]
| 0x54501240
| 0x04
|-
| [[#TSEC_SCP_CTL_ACCESS|TSEC_SCP_CTL_ACCESS]]
| 0x54501400
| 0x04
|-
| [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]]
| 0x54501404
| 0x04
|-
| [[#TSEC_SCP_CTL_STAT|TSEC_SCP_CTL_STAT]]
| 0x54501408
| 0x04
|-
| [[#TSEC_SCP_CTL_MODE|TSEC_SCP_CTL_MODE]]
| 0x5450140C
| 0x04
|-
| TSEC_SCP_UNK0
| 0x54501410
| 0x04
|-
| [[#TSEC_SCP_CTL_PKEY|TSEC_SCP_CTL_PKEY]]
| 0x54501418
| 0x04
|-
| [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]]
| 0x54501420
| 0x04
|-
| [[#TSEC_SCP_SEQ_STAT|TSEC_SCP_SEQ_STAT]]
| 0x54501428
| 0x04
|-
| [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]]
| 0x54501430
| 0x04
|-
| TSEC_SCP_UNK2
| 0x54501454
| 0x04
|-
| [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]]
| 0x54501458
| 0x04
|-
| TSEC_SCP_UNK3
| 0x54501470
| 0x04
|-
| [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT]]
| 0x54501480
| 0x04
|-
| [[#TSEC_SCP_IRQMASK|TSEC_SCP_IRQMASK]]
| 0x54501484
| 0x04
|-
| TSEC_SCP_UNK4
| 0x54501490
| 0x04
|-
| [[#TSEC_SCP_ERR|TSEC_SCP_ERR]]
| 0x54501498
| 0x04
|-
| TSEC_TRNG_CLKDIV
| 0x54501500
| 0x04
|-
| TSEC_TRNG_UNK0
| 0x54501504
| 0x04
|-
| TSEC_TRNG_UNK1
| 0x5450150C
| 0x04
|-
| TSEC_TRNG_UNK2
| 0x54501510
| 0x04
|-
| TSEC_TRNG_UNK3
| 0x54501514
| 0x04
|-
| TSEC_TRNG_UNK4
| 0x54501518
| 0x04
|-
| TSEC_TRNG_UNK5
| 0x5450151C
| 0x04
|-
| TSEC_TRNG_UNK6
| 0x54501528
| 0x04
|-
| TSEC_TRNG_UNK7
| 0x5450152C
| 0x04
|-
| TSEC_TFBIF_UNK0
| 0x54501600
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL|TSEC_TFBIF_MCCIF_FIFOCTRL]]
| 0x54501604
| 0x04
|-
| TSEC_TFBIF_UNK1
| 0x54501608
| 0x04
|-
| TSEC_TFBIF_UNK2
| 0x5450160C
| 0x04
|-
| TSEC_TFBIF_UNK3
| 0x54501630
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL1|TSEC_TFBIF_MCCIF_FIFOCTRL1]]
| 0x54501634
| 0x04
|-
| TSEC_TFBIF_UNK4
| 0x54501640
| 0x04
|-
| [[#TSEC_TFBIF_UNK5|TSEC_TFBIF_UNK5]]
| 0x54501644
| 0x04
|-
| [[#TSEC_TFBIF_UNK6|TSEC_TFBIF_UNK6]]
| 0x54501648
| 0x04
|-
| [[#TSEC_DMA_CMD|TSEC_DMA_CMD]]
| 0x54501700
| 0x04
|-
| [[#TSEC_DMA_ADDR|TSEC_DMA_ADDR]]
| 0x54501704
| 0x04
|-
| [[#TSEC_DMA_VAL|TSEC_DMA_VAL]]
| 0x54501708
| 0x04
|-
| [[#TSEC_DMA_UNK|TSEC_DMA_UNK]]
| 0x5450170C
| 0x04
|-
| TSEC_TEGRA_FALCON_IP_VER
| 0x54501800
| 0x04
|-
| TSEC_TEGRA_UNK0
| 0x54501824
| 0x04
|-
| TSEC_TEGRA_UNK1
| 0x54501828
| 0x04
|-
| TSEC_TEGRA_UNK2
| 0x5450182C
| 0x04
|-
| [[#TSEC_TEGRA_CTL|TSEC_TEGRA_CTL]]
| 0x54501838
| 0x04
|}

=== TSEC_THI_METHOD0 ===
{| class="wikitable" border="1"
! ID
! Method
|-
| 0x200
| SET_APPLICATION_ID
|-
| 0x300
| EXECUTE
|-
| 0x500
| HDCP_INIT
|-
| 0x504
| HDCP_CREATE_SESSION
|-
| 0x508
| HDCP_VERIFY_CERT_RX
|-
| 0x50C
| HDCP_GENERATE_EKM
|-
| 0x510
| HDCP_REVOCATION_CHECK
|-
| 0x514
| HDCP_VERIFY_HPRIME
|-
| 0x518
| HDCP_ENCRYPT_PAIRING_INFO
|-
| 0x51C
| HDCP_DECRYPT_PAIRING_INFO
|-
| 0x520
| HDCP_UPDATE_SESSION
|-
| 0x524
| HDCP_GENERATE_LC_INIT
|-
| 0x528
| HDCP_VERIFY_LPRIME
|-
| 0x52C
| HDCP_GENERATE_SKE_INIT
|-
| 0x530
| HDCP_VERIFY_VPRIME
|-
| 0x534
| HDCP_ENCRYPTION_RUN_CTRL
|-
| 0x538
| HDCP_SESSION_CTRL
|-
| 0x53C
| HDCP_COMPUTE_SPRIME
|-
| 0x540
| HDCP_GET_CERT_RX
|-
| 0x544
| HDCP_EXCHANGE_INFO
|-
| 0x548
| HDCP_DECRYPT_KM
|-
| 0x54C
| HDCP_GET_HPRIME
|-
| 0x550
| HDCP_GENERATE_EKH_KM
|-
| 0x554
| HDCP_VERIFY_RTT_CHALLENGE
|-
| 0x558
| HDCP_GET_LPRIME
|-
| 0x55C
| HDCP_DECRYPT_KS
|-
| 0x560
| HDCP_DECRYPT
|-
| 0x564
| HDCP_GET_RRX
|-
| 0x568
| HDCP_DECRYPT_REENCRYPT
|-
| 0x56C
|
|-
| 0x570
|
|-
| 0x574
|
|-
| 0x578
|
|-
| 0x57C
|
|-
| 0x700
| HDCP_VALIDATE_SRM
|-
| 0x704
| HDCP_VALIDATE_STREAM
|-
| 0x708
| HDCP_TEST_SECURE_STATUS
|-
| 0x70C
| HDCP_SET_DCP_KPUB
|-
| 0x710
| HDCP_SET_RX_KPUB
|-
| 0x714
| HDCP_SET_CERT_RX
|-
| 0x718
| HDCP_SET_SCRATCH_BUFFER
|-
| 0x71C
| HDCP_SET_SRM
|-
| 0x720
| HDCP_SET_RECEIVER_ID_LIST
|-
| 0x724
| HDCP_SET_SPRIME
|-
| 0x728
| HDCP_SET_ENC_INPUT_BUFFER
|-
| 0x72C
| HDCP_SET_ENC_OUTPUT_BUFFER
|-
| 0x730
| HDCP_GET_RTT_CHALLENGE
|-
| 0x734
| HDCP_STREAM_MANAGE
|-
| 0x738
| HDCP_READ_CAPS
|-
| 0x73C
| HDCP_ENCRYPT
|-
| 0x740
| [6.0.0+] HDCP_GET_CURRENT_NONCE
|}

Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_METHOD1 ===
Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_INT_STATUS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_STATUS_FALCON_INT
|}

=== TSEC_THI_INT_MASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_MASK_FALCON_INT
|}

=== FALCON_IRQSSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSSET_GPTMR
|-
| 1
| FALCON_IRQSSET_WDTMR
|-
| 2
| FALCON_IRQSSET_MTHD
|-
| 3
| FALCON_IRQSSET_CTXSW
|-
| 4
| FALCON_IRQSSET_HALT
|-
| 5
| FALCON_IRQSSET_EXTERR
|-
| 6
| FALCON_IRQSSET_SWGEN0
|-
| 7
| FALCON_IRQSSET_SWGEN1
|-
| 8-15
| FALCON_IRQSSET_EXT
|}

Used for setting Falcon's IRQs.

=== FALCON_IRQSCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSCLR_GPTMR
|-
| 1
| FALCON_IRQSCLR_WDTMR
|-
| 2
| FALCON_IRQSCLR_MTHD
|-
| 3
| FALCON_IRQSCLR_CTXSW
|-
| 4
| FALCON_IRQSCLR_HALT
|-
| 5
| FALCON_IRQSCLR_EXTERR
|-
| 6
| FALCON_IRQSCLR_SWGEN0
|-
| 7
| FALCON_IRQSCLR_SWGEN1
|-
| 8-15
| FALCON_IRQSCLR_EXT
|}

Used for clearing Falcon's IRQs.

=== FALCON_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSTAT_GPTMR
|-
| 1
| FALCON_IRQSTAT_WDTMR
|-
| 2
| FALCON_IRQSTAT_MTHD
|-
| 3
| FALCON_IRQSTAT_CTXSW
|-
| 4
| FALCON_IRQSTAT_HALT
|-
| 5
| FALCON_IRQSTAT_EXTERR
|-
| 6
| FALCON_IRQSTAT_SWGEN0
|-
| 7
| FALCON_IRQSTAT_SWGEN1
|-
| 8-15
| FALCON_IRQSTAT_EXT
|}

Used for getting the status of Falcon's IRQs.

=== FALCON_IRQMODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMODE_GPTMR
|-
| 1
| FALCON_IRQMODE_WDTMR
|-
| 2
| FALCON_IRQMODE_MTHD
|-
| 3
| FALCON_IRQMODE_CTXSW
|-
| 4
| FALCON_IRQMODE_HALT
|-
| 5
| FALCON_IRQMODE_EXTERR
|-
| 6
| FALCON_IRQMODE_SWGEN0
|-
| 7
| FALCON_IRQMODE_SWGEN1
|-
| 8-15
| FALCON_IRQMODE_EXT
|}

Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.

=== FALCON_IRQMSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMSET_GPTMR
|-
| 1
| FALCON_IRQMSET_WDTMR
|-
| 2
| FALCON_IRQMSET_MTHD
|-
| 3
| FALCON_IRQMSET_CTXSW
|-
| 4
| FALCON_IRQMSET_HALT
|-
| 5
| FALCON_IRQMSET_EXTERR
|-
| 6
| FALCON_IRQMSET_SWGEN0
|-
| 7
| FALCON_IRQMSET_SWGEN1
|-
| 8-15
| FALCON_IRQMSET_EXT
|}

Used for setting the mask for Falcon's IRQs.

=== FALCON_IRQMCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMCLR_GPTMR
|-
| 1
| FALCON_IRQMCLR_WDTMR
|-
| 2
| FALCON_IRQMCLR_MTHD
|-
| 3
| FALCON_IRQMCLR_CTXSW
|-
| 4
| FALCON_IRQMCLR_HALT
|-
| 5
| FALCON_IRQMCLR_EXTERR
|-
| 6
| FALCON_IRQMCLR_SWGEN0
|-
| 7
| FALCON_IRQMCLR_SWGEN1
|-
| 8-15
| FALCON_IRQMCLR_EXT
|}

Used for clearing the mask for Falcon's IRQs.

=== FALCON_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMASK_GPTMR
|-
| 1
| FALCON_IRQMASK_WDTMR
|-
| 2
| FALCON_IRQMASK_MTHD
|-
| 3
| FALCON_IRQMASK_CTXSW
|-
| 4
| FALCON_IRQMASK_HALT
|-
| 5
| FALCON_IRQMASK_EXTERR
|-
| 6
| FALCON_IRQMASK_SWGEN0
|-
| 7
| FALCON_IRQMASK_SWGEN1
|-
| 8-15
| FALCON_IRQMASK_EXT
|}

Used for getting the value of the mask for Falcon's IRQs.

=== FALCON_IRQDEST ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQDEST_HOST_GPTMR
|-
| 1
| FALCON_IRQDEST_HOST_WDTMR
|-
| 2
| FALCON_IRQDEST_HOST_MTHD
|-
| 3
| FALCON_IRQDEST_HOST_CTXSW
|-
| 4
| FALCON_IRQDEST_HOST_HALT
|-
| 5
| FALCON_IRQDEST_HOST_EXTERR
|-
| 6
| FALCON_IRQDEST_HOST_SWGEN0
|-
| 7
| FALCON_IRQDEST_HOST_SWGEN1
|-
| 8-15
| FALCON_IRQDEST_HOST_EXT
|-
| 16
| FALCON_IRQDEST_TARGET_GPTMR
|-
| 17
| FALCON_IRQDEST_TARGET_WDTMR
|-
| 18
| FALCON_IRQDEST_TARGET_MTHD
|-
| 19
| FALCON_IRQDEST_TARGET_CTXSW
|-
| 20
| FALCON_IRQDEST_TARGET_HALT
|-
| 21
| FALCON_IRQDEST_TARGET_EXTERR
|-
| 22
| FALCON_IRQDEST_TARGET_SWGEN0
|-
| 23
| FALCON_IRQDEST_TARGET_SWGEN1
|-
| 24-31
| FALCON_IRQDEST_TARGET_EXT
|}

Used for routing Falcon's IRQs.

=== FALCON_SCRATCH0 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_SCRATCH1 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_ITFEN ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_ITFEN_CTXEN
|-
| 1
| FALCON_ITFEN_MTHDEN
|}

Used for enabling/disabling Falcon interfaces.

=== FALCON_IDLESTATE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IDLESTATE_FALCON_BUSY
|-
| 1-15
| FALCON_IDLESTATE_EXT_BUSY
|}

Used for detecting if Falcon is busy or not.

=== FALCON_DEBUGINFO ===
Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.

[6.0.0+] [[NV_services|nvservices]] sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.

=== FALCON_EXCI ===
Contains information about raised exceptions.

=== FALCON_CPUCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_CPUCTL_IINVAL
|-
| 1
| FALCON_CPUCTL_STARTCPU
|-
| 2
| FALCON_CPUCTL_SRESET
|-
| 3
| FALCON_CPUCTL_HRESET
|-
| 4
| FALCON_CPUCTL_HALTED
|-
| 5
| FALCON_CPUCTL_STOPPED
|-
| 6
| FALCON_CPUCTL_SCP_UNK
|}

Used for signaling the Falcon CPU.

=== FALCON_BOOTVEC ===
Takes the Falcon's boot vector address.

=== FALCON_HWCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-8
| FALCON_HWCFG_IMEM_SIZE
|-
| 9-17
| FALCON_HWCFG_DMEM_SIZE
|-
| 18-25
| FALCON_HWCFG_MTHD_SIZE
|-
| 26-31
| FALCON_HWCFG_DMATRF_SLOTS
|}

=== FALCON_DMACTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMACTL_REQUIRE_CTX
|-
| 1
| FALCON_DMACTL_DMEM_SCRUBBING
|-
| 2
| FALCON_DMACTL_IMEM_SCRUBBING
|-
| 3-6
| FALCON_DMACTL_DMAQ_NUM
|-
| 7
| FALCON_DMACTL_SECURE_STAT
|}

Used for configuring the Falcon's DMA engine.

=== FALCON_DMATRF_EXTBASE ===
Base of the external memory buffer.

The base of the transfer is calculated by adding [[#FALCON_DMATRF_POFF]] to the base.

=== FALCON_DMATRF_VOFF ===
For transfers to DMEM: the destination address.
For transfers to IMEM: the destination virtual IMEM page.

=== FALCON_DMATRF_POFF ===
For transfers to IMEM: the destination physical IMEM page.

=== FALCON_DMATRFCMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFCMD_FULL
|-
| 1
| FALCON_DMATRFCMD_IDLE
|-
| 2-3
| FALCON_DMATRFCMD_SEC
|-
| 4
| FALCON_DMATRFCMD_IMEM
|-
| 5
| FALCON_DMATRFCMD_WRITE
|-
| 8-10
| FALCON_DMATRFCMD_SIZE
|-
| 12-14
| FALCON_DMATRFCMD_CTXDMA
|}

Used for configuring DMA transfers.

=== FALCON_DMATRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFSTAT_PENDING
|-
| 16-18
| FALCON_DMATRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_DMATRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_CRYPTTRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| FALCON_CRYPTTRFSTAT_PENDING
|-
| 5
| FALCON_CRYPTTRFSTAT_ENABLED
|-
| 16-18
| FALCON_CRYPTTRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_CRYPTTRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_HWCFG2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_HWCFG2_VERSION
|-
| 4-5
| FALCON_HWCFG2_SCP_MODE
|-
| 6-7
| FALCON_HWCFG2_SUBVERSION
|-
| 8-11
| FALCON_HWCFG2_IMEM_PORTS
|-
| 12-15
| FALCON_HWCFG2_DMEM_PORTS
|-
| 16-19
| FALCON_HWCFG2_VM_PAGES_LOG2
|}

=== FALCON_ICD_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_ICD_CMD_OPC
0x0: BREAK
0x1: CONTINUE_FROM_PC
0x2: CONTINUE_FROM_ADDR
0x3: CONTINUE_UNK1_FROM_PC
0x4: CONTINUE_UNK1_FROM_ADDR
0x5: SINGLE_STEP_FROM_PC
0x6: SINGLE_STEP_FROM_ADDR
0x7: SET_BREAK_MASK
0x8: REG_READ
0x9: REG_WRITE
0xA: DATA_READ
0xB: DATA_WRITE
0xC: IO_READ
0xD: IO_WRITE
0xE: STATUS_READ
|-
| 6-7
| FALCON_ICD_CMD_DATA_SIZE
|-
| 8-12
| FALCON_ICD_CMD_IDX
|-
| 14
| FALCON_ICD_CMD_ERROR
|-
| 15
| FALCON_ICD_CMD_DONE
|-
| 16-31
| FALCON_ICD_CMD_BREAK_MASK
|}

=== FALCON_SCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| FALCON_SCTL_SEC_MODE
0: Non-secure
1: Light Secure
2: Heavy Secure
|}

=== TSEC_SCP_CTL_ACCESS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| Enable TSEC_SCP_INSN_STAT register
|}

=== TSEC_SCP_CTL_TRNG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 11
| Unknown
|-
| 12
| Enable the TRNG
|}

=== TSEC_SCP_CTL_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| TSEC_SCP_CTL_STAT_DEBUG_MODE
|}

=== TSEC_SCP_CTL_MODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Disable reads for the TRNG register block
|-
| 1
| Disable reads for the TFBIF register block
|-
| 2
| Disable reads for the DMA register block
|-
| 3
| Disable reads for the TEGRA register block
|-
| 4
| Disable writes for the TRNG register block
|-
| 5
| Disable writes for the TFBIF register block
|-
| 6
| Disable writes for the DMA register block
|-
| 7
| Disable writes for the TEGRA register block
|}

Controls accesses to the other sub-engines and can only be cleared in Heavy Secure mode.

=== TSEC_SCP_CTL_PKEY ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
|-
| 1
| TSEC_SCP_CTL_PKEY_LOADED
|}

=== TSEC_SCP_SEQ0_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 8-11
| Size of current cs0begin macro
|-
|}

=== TSEC_SCP_SEQ_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Set if crypto sequence recording (cs0begin/cs1begin) is active
|-
| 4-7
| Number of instructions left for the crypto sequence
|-
| 12-15
| Active crypto key register
|}

Contains information on the last crypto sequence (cs0 or cs1) executed.

=== TSEC_SCP_INSN_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| Crypto fuc5 destination register or immediate value
|-
| 8-15
| Crypto fuc5 source register or immediate value
|-
| 20-24
| Crypto fuc5 operation
0x0: none (fuc5 opcode 0x00)
0x1: cmov (fuc5 opcode 0x84)
0x2: cxsin (fuc5 opcode 0x88) or xdst (with cxset)
0x3: cxsout (fuc5 opcode 0x8C) or xdld (with cxset)
0x4: crng (fuc5 opcode 0x90)
0x5: cs0begin (fuc5 opcode 0x94)
0x6: cs0exec (fuc5 opcode 0x98)
0x7: cs1begin (fuc5 opcode 0x9C)
0x8: cs1exec (fuc5 opcode 0xA0)
0x9: invalid (fuc5 opcode 0xA4)
0xA: cchmod (fuc5 opcode 0xA8)
0xB: cxor (fuc5 opcode 0xAC)
0xC: cadd (fuc5 opcode 0xB0)
0xD: cand (fuc5 opcode 0xB4)
0xE: crev (fuc5 opcode 0xB8)
0xF: cprecmac (fuc5 opcode 0xBC)
0x10: csecret (fuc5 opcode 0xC0)
0x11: ckeyreg (fuc5 opcode 0xC4)
0x12: ckexp (fuc5 opcode 0xC8)
0x13: ckrexp (fuc5 opcode 0xCC)
0x14: cenc (fuc5 opcode 0xD0)
0x15: cdec (fuc5 opcode 0xD4)
0x16: csigauth (fuc5 opcode 0xD8)
0x17: csigenc (fuc5 opcode 0xDC)
0x18: csigclr (fuc5 opcode 0xE0)
|-
| 31
| Set if running in secure mode (cauth)
|}

Contains information on the last crypto instruction executed.

=== TSEC_SCP_AES_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-4
| First opcode
|-
| 5-9
| Second opcode
|-
| 15-16
| AES operation
0: Encryption
1: Decryption
2: Key expansion
3: Key reverse expansion
|}

Contains information on the last AES sequence executed.

=== TSEC_SCP_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQSTAT_TRNG
|-
| 8
| TSEC_SCP_IRQSTAT_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQSTAT_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQSTAT_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the status of crypto IRQs.

=== TSEC_SCP_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQMASK_TRNG
|-
| 8
| TSEC_SCP_IRQMASK_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQMASK_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQMASK_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the value of the mask for crypto IRQs.

=== TSEC_SCP_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Invalid instruction
|-
| 4
| Empty crypto sequence
|-
| 8
| Crypto sequence is too long
|-
| 12
| Crypto sequence was not finished
|-
| 16
| Invalid cauth signature (during csigenc, csigclr or csigunk)
|-
| 24
| Forbidden instruction
|}

Contains information on crypto errors generated by the [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT_INSN_ERROR]] IRQ.

=== TSEC_TFBIF_MCCIF_FIFOCTRL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
|-
| 1
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
|-
| 2
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
|-
| 3
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
|-
| 4
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
|-
| 5
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
|-
| 6
| TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
|-
| 7
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
|-
| 8
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE
|}

=== TSEC_MCCIF_FIFOCTRL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
|-
| 16-31
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT
|}

=== TSEC_TFBIF_UNK5 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.

=== TSEC_TFBIF_UNK6 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to (data_size << 4) before reading memory from the GPU UCODE carveout.

=== TSEC_DMA_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_DMA_CMD_READ
|-
| 1
| TSEC_DMA_CMD_WRITE
|-
| 4-7
| TSEC_DMA_CMD_UNK
|-
| 12
| TSEC_DMA_CMD_BUSY
|-
| 13
| TSEC_DMA_CMD_ERROR
|-
| 31
| TSEC_DMA_CMD_INIT
|}

A DMA read/write operation requires bits TSEC_DMA_CMD_INIT and TSEC_DMA_CMD_READ/TSEC_DMA_CMD_WRITE to be set in TSEC_DMA_CMD.

During the transfer, the TSEC_DMA_CMD_BUSY bit is set.

Accessing an invalid address causes bit TSEC_DMA_CMD_ERROR to be set.

=== TSEC_DMA_ADDR ===
Takes the address for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_VAL ===
Takes the value for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_UNK ===
Always 0xFFF.

=== TSEC_TEGRA_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 16
| TSEC_TEGRA_CTL_TKFI_KFUSE
|-
| 17
| TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
|-
| 24
| TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
|-
| 25
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
|-
| 26
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
|-
| 27
| TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C
|}

== Authenticated Mode ==
===== Entry =====
From non-secure mode, upon jumping to a page marked as secret, a secret fault occurs. This causes the CPU to verify the region specified in $cauth against the MAC loaded in $c6. If the comparison is successful, the valid bit (bit0) is set on all pages in the $cauth region, and $pc is set to the base of the $cauth region. If the comparsion fails, the CPU is halted.

===== Exit =====
The CPU automatically goes back to non-secure mode when returning back into non-secret pages. When this happens, the valid bit (bit0) in the TLB flags is cleared for all secret pages.

===== Implementation =====
Under certain circumstances, it is possible to observe [[#csigauth|csigauth]] being briefly written to [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]] as "csigauth $c4 $c6" while the opcodes in [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]] are set to "cxsin" and "csigauth", respectively.

Via [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]] it can be observed that a 3-sized macro sequence is loaded into cs0 during a secure mode transition.

== Crypto processing ==
Part of the information here (which hasn't made it into envytools documentation yet) was shared by [https://wiki.0x04.net/wiki/Marcin_Ko%C5%9Bcielnicki mwk] from reverse engineering falcon processors over the years.

=== cauth ===
$cauth is a special purpose register in the CPU.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7 || Start of region to authenticate (in 0x100 pages)
|-
| 8-15 || Unused
|-
| 16 || Use secret xfers (?)
|-
| 17 || Region is signed and encrypted and double the size (?)
|-
| 18 ||
|-
| 19 ||
|-
| 20-23 || Unused
|-
| 31-24 || Size of region to authenticate (in 0x100 pages)
|}

== SCP operations ==

{| class="wikitable" border="1"
! Opcode
! Name
! Operand0
! Operand1
! Operation
! Condition
|-
| 0 || || || || ||
|-
| 1 || mov || $cX || $cY || <code>$cX = $cY; ACL(X) = ACL(Y);</code> ||
|-
| 2 || sin || $cX || N/A || <code>$cX = read_stream(); ACL(X) = ???;</code> ||
|-
| 3 || sout || $cX || N/A || <code>write_stream($cX);</code> ||
|-
| 4 || rnd || $cX || N/A || <code>$cX = read_trng(); ACL(X) = ???;</code> ||
|-
| 5 || s0begin || immX || N/A || <code>record_macro_for_N_instructions(0, immX);</code> ||
|-
| 6 || s0exec || immX || N/A || <code>execute_macro_N_times(0, immX);</code> ||
|-
| 7 || s1begin || immX || N/A || <code>record_macro_for_N_instructions(1, immX);</code> ||
|-
| 8 || s1exec || immX || N/A || <code>execute_macro_N_times(1, immX);</code> ||
|-
| 9 || ? || || || ||
|-
| 0xA || chmod || $cX || immY || <code>ACL(X) &= immY;</code> ||
|-
| 0xB || xor || $cX || $cY || <code>$cX ^= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xC || add || $cX || immY || <code>$cX += immY;</code> || <code>(ACL(X) & 2)</code>
|-
| 0xD || and || $cX || $cY || <code>$cX &= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xE || rev || $cX || $cY || <code>$cX = reverse($cY); ACL(X) = ACL(Y) | 1;</code> || <code>(ACL(Y) & 2)</code>
|-
| 0xF || gfmul || $cX || $cY || <code>$cX = gfmul($cY); ACL(X) = ACL(Y) | 1;</code> || <code>(ACL(Y) & 2)</code>
|-
| 0x10 || secret || $cX || immY || <code>$cX = load_secret(immY); ACL(X) = load_secret_acl(immY);</code> ||
|-
| 0x11 || keyreg || immX || || <code>active_key_idx = immX;</code> ||
|-
| 0x12 || kexp || $cX || $cY || <code>$cX = aes_kexp($cY);</code> || <code>(ACL(Y) & 2)</code>
|-
| 0x13 || krexp || $cX || $cY || <code>$cX = aes_kexp_reverse($cY);</code> || <code>(ACL(Y) & 2)</code>
|-
| 0x14 || enc || $cX || $cY || <code>$cX = aes_enc(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 3) && (ACL(Y) & 2)</code>
|-
| 0x15 || dec || $cX || $cY || <code>$cX = aes_dec(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 3) && (ACL(Y) & 2)</code>
|-
| ...
|}

=== ACL ===
{| class="wikitable" border="1"
! Bit
! Meaning
|-
| 0 || Allowed key
|-
| 1 || Allowed input (also key)
|}

==== Initial values ====
On SCP boot, the ACL is 0x1F for all $cX.

Loading into $cX using xdst instruction sets ACL($cX) to 0x1F.

Spilling a $cX to DMEM using xdld instruction is allowed if (ACL($cX) & 2).

=== csigauth ===
<code>00000000: f5 3c XY d8 csigauth $cY $cX</code>

This instruction takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret.

=== csigclr ===
<code>00000000: f5 3c 00 e0 csigclr</code>

This instruction takes no operands and appears to clear the saved cauth signature used by the csigenc instruction.

=== cchmod ===
<code>00000000: f5 3c XY a8 cchmod $cY 0X</code> or <code>00000000: f5 3c XY a9 cchmod $cY 1X</code>

This instruction takes a crypto register and a 5 bit immediate value. It appears to set the [[#Register ACLs|crypto registers' ACL]] bits as follows:
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Allow register to be used as key in NS or LS mode
|-
| 1
| Allow register to be used as key in HS mode
|-
| 2
| Set register as readable in NS or LS mode
|-
| 3
| Set register as readable in HS mode
|-
| 4
| Set register as writable in NS or LS mode
|}

=== crng ===
<code>00000000: f5 3c 0X 90 crng $cX</code>

This instruction initializes a crypto register with random data.

Executing this instruction only succeeds if the TRNG is enabled for the SCP, which requires taking the following steps:
* Write 0x7FFF to TSEC_TRNG_CLKDIV.
* Write 0x3FF0000 to TSEC_TRNG_UNK0.
* Write 0xFF00 to TSEC_TRNG_UNK7.
* Write 0x1000 to [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]].

Otherwise it hangs forever.

=== cxset ===
cxset instruction provides a way to change behavior of a variable amount of successively executed DMA-related instructions.

for example: <code>000000de: f4 3c 02 cxset 0x2</code>

can be read as: <code>dma_override(type=crypto_reg, count=2)</code>

The argument to cxset specifies the type of behavior change in the top 3 bits, and the number of DMA-related instructions the effect lasts for in the lower 5 bits.

{| class=wikitable
! Bits || Description
|-
| 0-4 || Number of instructions it is valid for (0x1f is a special value meaning infinitely many instructions -- until overriden by another cxset)
|-
| 5 || Crypto destination/source select (0=crypto register, 1=crypto stream)
|-
| 6 || External memory override (0=Disabled, 1=Enabled)
|-
| 7 || Internal memory select (0=DMEM, 1=IMEM)
|}

==== DMA-Related Instructions ====
At least the following instructions may have changed behavior, and count against the cxset "count" argument: <code>xdwait</code>, <code>xdst</code>, <code>xdld</code>.

For example, if override type=0b000, then the "length" argument to <code>xdst</code> is instead treated as the index of the target $cX register.

=== Secrets ===
Falcon's Authenticated Mode has access to 64 128-bit keys which are burned at factory. These keys can be loaded by using the $csecret instruction which takes the target crypto register and the key index as arguments.

{| class=wikitable
! Index || Notes || Console-unique
|-
| 0x00 || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares. || No
|-
| 0x01 || Used by nvhost_nvdec_bl020_prod firmware. ||
|-
| 0x03 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x04 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x05 || Used by nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares. ||
|-
| 0x07 || Used by [6.0.0+] nvhost_tsec firmware. ||
|-
| 0x09 || Used by nvhost_tsec firmware. ||
|-
| 0x0B || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x0F || Used by nvhost_tsec firmware. ||
|-
| 0x10 || Used by [1.0.0-5.1.0] nvhost_tsec firmware. ||
|-
| 0x15 || Used by nvhost_nvdec_bl020_prod, [5.0.0+] nvhost_nvdec020_prod, [5.0.0+] nvhost_nvdec020_ns and [6.0.0+] nvhost_tsec firmwares. ||
|-
| 0x26 || Used by [[TSEC_Firmware#KeygenLdr|KeygenLdr]]. || No
|-
| 0x3C || Used by nvhost_tsec firmware. ||
|-
| 0x3F || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. || Yes
|}

TSEC

2019-01-06T09:49:35Z

Qlutoo: /* SCP operations */

TSEC (Tegra Security Co-processor) is a dedicated unit powered by a NVIDIA Falcon microprocessor with crypto extensions.

= Driver =
A host driver for communicating with the TSEC is mapped to physical address 0x54500000 with a total size of 0x40000 bytes and exposes several registers.

== Registers ==
Registers from 0x54500000 to 0x54501000 are used to configure the host interface (HOST1X).

Registers from 0x54501000 to 0x54502000 are a MMIO window for communicating with the Falcon microprocessor. From this range, the subset of registers from 0x54501400 to 0x54501FE8 are specific to the TSEC and are subdivided into:
* 0x54501400 to 0x54501500: SCP (Secure Crypto Processor?).
* 0x54501500 to 0x54501600: TRNG (True Random Number Generator).
* 0x54501600 to 0x54501700: TFBIF (Tegra Framebuffer Interface).
* 0x54501700 to 0x54501800: DMA.
* 0x54501800 to 0x54501900: TEGRA (miscellaneous interfaces).

{| class="wikitable" border="1"
! Name
! Address
! Width
|-
| TSEC_THI_INCR_SYNCPT
| 0x54500000
| 0x04
|-
| TSEC_THI_INCR_SYNCPT_ERR
| 0x54500008
| 0x04
|-
| TSEC_THI_CTXSW_INCR_SYNCPT
| 0x5450000C
| 0x04
|-
| TSEC_THI_CTXSW
| 0x54500020
| 0x04
|-
| TSEC_THI_CONT_SYNCPT_EOF
| 0x54500028
| 0x04
|-
| [[#TSEC_THI_METHOD0|TSEC_THI_METHOD0]]
| 0x54500040
| 0x04
|-
| [[#TSEC_THI_METHOD1|TSEC_THI_METHOD1]]
| 0x54500044
| 0x04
|-
| [[#TSEC_THI_INT_STATUS|TSEC_THI_INT_STATUS]]
| 0x54500078
| 0x04
|-
| [[#TSEC_THI_INT_MASK|TSEC_THI_INT_MASK]]
| 0x5450007C
| 0x04
|-
| TSEC_THI_SLCG_STATUS
| 0x54500084
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_HIGH_A
| 0x54500088
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_LOW_A
| 0x5450008C
| 0x04
|-
| TSEC_THI_CLK_OVERRIDE
| 0x54500E00
| 0x04
|-
| [[#FALCON_IRQSSET|FALCON_IRQSSET]]
| 0x54501000
| 0x04
|-
| [[#FALCON_IRQSCLR|FALCON_IRQSCLR]]
| 0x54501004
| 0x04
|-
| [[#FALCON_IRQSTAT|FALCON_IRQSTAT]]
| 0x54501008
| 0x04
|-
| [[#FALCON_IRQMODE|FALCON_IRQMODE]]
| 0x5450100C
| 0x04
|-
| [[#FALCON_IRQMSET|FALCON_IRQMSET]]
| 0x54501010
| 0x04
|-
| [[#FALCON_IRQMCLR|FALCON_IRQMCLR]]
| 0x54501014
| 0x04
|-
| [[#FALCON_IRQMASK|FALCON_IRQMASK]]
| 0x54501018
| 0x04
|-
| [[#FALCON_IRQDEST|FALCON_IRQDEST]]
| 0x5450101C
| 0x04
|-
| FALCON_GPTMR_PERIOD
| 0x54501020
| 0x04
|-
| FALCON_GPTMR_TIME
| 0x54501024
| 0x04
|-
| FALCON_GPTMR_ENABLE
| 0x54501028
| 0x04
|-
| FALCON_TIME_LOW
| 0x5450102C
| 0x04
|-
| FALCON_TIME_HIGH
| 0x54501030
| 0x04
|-
| FALCON_WDTMR_TIME
| 0x54501034
| 0x04
|-
| FALCON_WDTMR_ENABLE
| 0x54501038
| 0x04
|-
| [[#FALCON_SCRATCH0|FALCON_SCRATCH0]]
| 0x54501040
| 0x04
|-
| [[#FALCON_SCRATCH1|FALCON_SCRATCH1]]
| 0x54501044
| 0x04
|-
| [[#FALCON_ITFEN|FALCON_ITFEN]]
| 0x54501048
| 0x04
|-
| [[#FALCON_IDLESTATE|FALCON_IDLESTATE]]
| 0x5450104C
| 0x04
|-
| FALCON_CURCTX
| 0x54501050
| 0x04
|-
| FALCON_NXTCTX
| 0x54501054
| 0x04
|-
| FALCON_CMDCTX
| 0x54501058
| 0x04
|-
| FALCON_STATUS_MASK
| 0x5450105C
| 0x04
|-
| FALCON_VM_SUPERVISOR
| 0x54501060
| 0x04
|-
| FALCON_MTHD_DATA
| 0x54501064
| 0x04
|-
| FALCON_MTHD_CMD
| 0x54501068
| 0x04
|-
| FALCON_MTHD_DATA_WR
| 0x5450106C
| 0x04
|-
| FALCON_MTHD_OCCUPIED
| 0x54501070
| 0x04
|-
| FALCON_MTHD_ACK
| 0x54501074
| 0x04
|-
| FALCON_MTHD_LIMIT
| 0x54501078
| 0x04
|-
| FALCON_SUBENGINE_RESET
| 0x5450107C
| 0x04
|-
| FALCON_SCRATCH2
| 0x54501080
| 0x04
|-
| FALCON_SCRATCH3
| 0x54501084
| 0x04
|-
| FALCON_PM_TRIGGER
| 0x54501088
| 0x04
|-
| FALCON_PM_MODE
| 0x5450108C
| 0x04
|-
| FALCON_DEBUG1
| 0x54501090
| 0x04
|-
| [[#FALCON_DEBUGINFO|FALCON_DEBUGINFO]]
| 0x54501094
| 0x04
|-
| FALCON_BREAKPOINT0
| 0x54501098
| 0x04
|-
| FALCON_BREAKPOINT1
| 0x5450109C
| 0x04
|-
| FALCON_CGCTL
| 0x545010A0
| 0x04
|-
| FALCON_ENGCTL
| 0x545010A4
| 0x04
|-
| FALCON_PM_SEL
| 0x545010A8
| 0x04
|-
| FALCON_HOST_IO_INDEX
| 0x545010AC
| 0x04
|-
| [[#FALCON_EXCI|FALCON_EXCI]]
| 0x545010D0
| 0x04
|-
| [[#FALCON_CPUCTL|FALCON_CPUCTL]]
| 0x54501100
| 0x04
|-
| [[#FALCON_BOOTVEC|FALCON_BOOTVEC]]
| 0x54501104
| 0x04
|-
| [[#FALCON_HWCFG|FALCON_HWCFG]]
| 0x54501108
| 0x04
|-
| [[#FALCON_DMACTL|FALCON_DMACTL]]
| 0x5450110C
| 0x04
|-
| [[#FALCON_DMATRF_EXTBASE|FALCON_DMATRF_EXTBASE]]
| 0x54501110
| 0x04
|-
| [[#FALCON_DMATRF_VOFF|FALCON_DMATRF_VOFF]]
| 0x54501114
| 0x04
|-
| [[#FALCON_DMATRFCMD|FALCON_DMATRFCMD]]
| 0x54501118
| 0x04
|-
| [[#FALCON_DMATRF_POFF|FALCON_DMATRF_POFF]]
| 0x5450111C
| 0x04
|-
| [[#FALCON_DMATRFSTAT|FALCON_DMATRFSTAT]]
| 0x54501120
| 0x04
|-
| [[#FALCON_CRYPTTRFSTAT|FALCON_CRYPTTRFSTAT]]
| 0x54501124
| 0x04
|-
| FALCON_CPUSTAT
| 0x54501128
| 0x04
|-
| [[#FALCON_HWCFG2|FALCON_HWCFG2]]
| 0x5450112C
| 0x04
|-
| FALCON_CPUCTL_ALIAS
| 0x54501130
| 0x04
|-
| FALCON_TLB_CMD
| 0x54501140
| 0x04
|-
| FALCON_TLB_CMD_RES
| 0x54501144
| 0x04
|-
| FALCON_BRANCH_HISTORY_CTRL
| 0x54501148
| 0x04
|-
| FALCON_BRANCH_HISTORY_PC
| 0x5450114C
| 0x04
|-
| FALCON_IMFILLRNG0
| 0x54501150
| 0x04
|-
| FALCON_IMFILLRNG1
| 0x54501154
| 0x04
|-
| FALCON_IMFILLCTL
| 0x54501158
| 0x04
|-
| FALCON_EXTERRWIN
| 0x54501160
| 0x04
|-
| FALCON_EXTERRCFG
| 0x54501164
| 0x04
|-
| FALCON_EXTERRADDR
| 0x54501168
| 0x04
|-
| FALCON_EXTERRSTAT
| 0x5450116C
| 0x04
|-
| FALCON_CG2
| 0x5450117C
| 0x04
|-
| FALCON_CODE_INDEX
| 0x54501180
| 0x04
|-
| FALCON_CODE
| 0x54501184
| 0x04
|-
| FALCON_CODE_VIRT_ADDR
| 0x54501188
| 0x04
|-
| FALCON_DATA_INDEX0
| 0x545011C0
| 0x04
|-
| FALCON_DATA0
| 0x545011C4
| 0x04
|-
| FALCON_DATA_INDEX1
| 0x545011C8
| 0x04
|-
| FALCON_DATA1
| 0x545011CC
| 0x04
|-
| FALCON_DATA_INDEX2
| 0x545011D0
| 0x04
|-
| FALCON_DATA2
| 0x545011D4
| 0x04
|-
| FALCON_DATA_INDEX3
| 0x545011D8
| 0x04
|-
| FALCON_DATA3
| 0x545011DC
| 0x04
|-
| FALCON_DATA_INDEX4
| 0x545011E0
| 0x04
|-
| FALCON_DATA4
| 0x545011E4
| 0x04
|-
| FALCON_DATA_INDEX5
| 0x545011E8
| 0x04
|-
| FALCON_DATA5
| 0x545011EC
| 0x04
|-
| FALCON_DATA_INDEX6
| 0x545011F0
| 0x04
|-
| FALCON_DATA6
| 0x545011F4
| 0x04
|-
| FALCON_DATA_INDEX7
| 0x545011F8
| 0x04
|-
| FALCON_DATA7
| 0x545011FC
| 0x04
|-
| [[#FALCON_ICD_CMD|FALCON_ICD_CMD]]
| 0x54501200
| 0x04
|-
| FALCON_ICD_ADDR
| 0x54501204
| 0x04
|-
| FALCON_ICD_WDATA
| 0x54501208
| 0x04
|-
| FALCON_ICD_RDATA
| 0x5450120C
| 0x04
|-
| [[#FALCON_SCTL|FALCON_SCTL]]
| 0x54501240
| 0x04
|-
| [[#TSEC_SCP_CTL_ACCESS|TSEC_SCP_CTL_ACCESS]]
| 0x54501400
| 0x04
|-
| [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]]
| 0x54501404
| 0x04
|-
| [[#TSEC_SCP_CTL_STAT|TSEC_SCP_CTL_STAT]]
| 0x54501408
| 0x04
|-
| [[#TSEC_SCP_CTL_MODE|TSEC_SCP_CTL_MODE]]
| 0x5450140C
| 0x04
|-
| TSEC_SCP_UNK0
| 0x54501410
| 0x04
|-
| [[#TSEC_SCP_CTL_PKEY|TSEC_SCP_CTL_PKEY]]
| 0x54501418
| 0x04
|-
| [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]]
| 0x54501420
| 0x04
|-
| [[#TSEC_SCP_SEQ_STAT|TSEC_SCP_SEQ_STAT]]
| 0x54501428
| 0x04
|-
| [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]]
| 0x54501430
| 0x04
|-
| TSEC_SCP_UNK2
| 0x54501454
| 0x04
|-
| [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]]
| 0x54501458
| 0x04
|-
| TSEC_SCP_UNK3
| 0x54501470
| 0x04
|-
| [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT]]
| 0x54501480
| 0x04
|-
| [[#TSEC_SCP_IRQMASK|TSEC_SCP_IRQMASK]]
| 0x54501484
| 0x04
|-
| TSEC_SCP_UNK4
| 0x54501490
| 0x04
|-
| [[#TSEC_SCP_ERR|TSEC_SCP_ERR]]
| 0x54501498
| 0x04
|-
| TSEC_TRNG_CLKDIV
| 0x54501500
| 0x04
|-
| TSEC_TRNG_UNK0
| 0x54501504
| 0x04
|-
| TSEC_TRNG_UNK1
| 0x5450150C
| 0x04
|-
| TSEC_TRNG_UNK2
| 0x54501510
| 0x04
|-
| TSEC_TRNG_UNK3
| 0x54501514
| 0x04
|-
| TSEC_TRNG_UNK4
| 0x54501518
| 0x04
|-
| TSEC_TRNG_UNK5
| 0x5450151C
| 0x04
|-
| TSEC_TRNG_UNK6
| 0x54501528
| 0x04
|-
| TSEC_TRNG_UNK7
| 0x5450152C
| 0x04
|-
| TSEC_TFBIF_UNK0
| 0x54501600
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL|TSEC_TFBIF_MCCIF_FIFOCTRL]]
| 0x54501604
| 0x04
|-
| TSEC_TFBIF_UNK1
| 0x54501608
| 0x04
|-
| TSEC_TFBIF_UNK2
| 0x5450160C
| 0x04
|-
| TSEC_TFBIF_UNK3
| 0x54501630
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL1|TSEC_TFBIF_MCCIF_FIFOCTRL1]]
| 0x54501634
| 0x04
|-
| TSEC_TFBIF_UNK4
| 0x54501640
| 0x04
|-
| [[#TSEC_TFBIF_UNK5|TSEC_TFBIF_UNK5]]
| 0x54501644
| 0x04
|-
| [[#TSEC_TFBIF_UNK6|TSEC_TFBIF_UNK6]]
| 0x54501648
| 0x04
|-
| [[#TSEC_DMA_CMD|TSEC_DMA_CMD]]
| 0x54501700
| 0x04
|-
| [[#TSEC_DMA_ADDR|TSEC_DMA_ADDR]]
| 0x54501704
| 0x04
|-
| [[#TSEC_DMA_VAL|TSEC_DMA_VAL]]
| 0x54501708
| 0x04
|-
| [[#TSEC_DMA_UNK|TSEC_DMA_UNK]]
| 0x5450170C
| 0x04
|-
| TSEC_TEGRA_FALCON_IP_VER
| 0x54501800
| 0x04
|-
| TSEC_TEGRA_UNK0
| 0x54501824
| 0x04
|-
| TSEC_TEGRA_UNK1
| 0x54501828
| 0x04
|-
| TSEC_TEGRA_UNK2
| 0x5450182C
| 0x04
|-
| [[#TSEC_TEGRA_CTL|TSEC_TEGRA_CTL]]
| 0x54501838
| 0x04
|}

=== TSEC_THI_METHOD0 ===
{| class="wikitable" border="1"
! ID
! Method
|-
| 0x200
| SET_APPLICATION_ID
|-
| 0x300
| EXECUTE
|-
| 0x500
| HDCP_INIT
|-
| 0x504
| HDCP_CREATE_SESSION
|-
| 0x508
| HDCP_VERIFY_CERT_RX
|-
| 0x50C
| HDCP_GENERATE_EKM
|-
| 0x510
| HDCP_REVOCATION_CHECK
|-
| 0x514
| HDCP_VERIFY_HPRIME
|-
| 0x518
| HDCP_ENCRYPT_PAIRING_INFO
|-
| 0x51C
| HDCP_DECRYPT_PAIRING_INFO
|-
| 0x520
| HDCP_UPDATE_SESSION
|-
| 0x524
| HDCP_GENERATE_LC_INIT
|-
| 0x528
| HDCP_VERIFY_LPRIME
|-
| 0x52C
| HDCP_GENERATE_SKE_INIT
|-
| 0x530
| HDCP_VERIFY_VPRIME
|-
| 0x534
| HDCP_ENCRYPTION_RUN_CTRL
|-
| 0x538
| HDCP_SESSION_CTRL
|-
| 0x53C
| HDCP_COMPUTE_SPRIME
|-
| 0x540
| HDCP_GET_CERT_RX
|-
| 0x544
| HDCP_EXCHANGE_INFO
|-
| 0x548
| HDCP_DECRYPT_KM
|-
| 0x54C
| HDCP_GET_HPRIME
|-
| 0x550
| HDCP_GENERATE_EKH_KM
|-
| 0x554
| HDCP_VERIFY_RTT_CHALLENGE
|-
| 0x558
| HDCP_GET_LPRIME
|-
| 0x55C
| HDCP_DECRYPT_KS
|-
| 0x560
| HDCP_DECRYPT
|-
| 0x564
| HDCP_GET_RRX
|-
| 0x568
| HDCP_DECRYPT_REENCRYPT
|-
| 0x56C
|
|-
| 0x570
|
|-
| 0x574
|
|-
| 0x578
|
|-
| 0x57C
|
|-
| 0x700
| HDCP_VALIDATE_SRM
|-
| 0x704
| HDCP_VALIDATE_STREAM
|-
| 0x708
| HDCP_TEST_SECURE_STATUS
|-
| 0x70C
| HDCP_SET_DCP_KPUB
|-
| 0x710
| HDCP_SET_RX_KPUB
|-
| 0x714
| HDCP_SET_CERT_RX
|-
| 0x718
| HDCP_SET_SCRATCH_BUFFER
|-
| 0x71C
| HDCP_SET_SRM
|-
| 0x720
| HDCP_SET_RECEIVER_ID_LIST
|-
| 0x724
| HDCP_SET_SPRIME
|-
| 0x728
| HDCP_SET_ENC_INPUT_BUFFER
|-
| 0x72C
| HDCP_SET_ENC_OUTPUT_BUFFER
|-
| 0x730
| HDCP_GET_RTT_CHALLENGE
|-
| 0x734
| HDCP_STREAM_MANAGE
|-
| 0x738
| HDCP_READ_CAPS
|-
| 0x73C
| HDCP_ENCRYPT
|-
| 0x740
| [6.0.0+] HDCP_GET_CURRENT_NONCE
|}

Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_METHOD1 ===
Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_INT_STATUS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_STATUS_FALCON_INT
|}

=== TSEC_THI_INT_MASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_MASK_FALCON_INT
|}

=== FALCON_IRQSSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSSET_GPTMR
|-
| 1
| FALCON_IRQSSET_WDTMR
|-
| 2
| FALCON_IRQSSET_MTHD
|-
| 3
| FALCON_IRQSSET_CTXSW
|-
| 4
| FALCON_IRQSSET_HALT
|-
| 5
| FALCON_IRQSSET_EXTERR
|-
| 6
| FALCON_IRQSSET_SWGEN0
|-
| 7
| FALCON_IRQSSET_SWGEN1
|-
| 8-15
| FALCON_IRQSSET_EXT
|}

Used for setting Falcon's IRQs.

=== FALCON_IRQSCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSCLR_GPTMR
|-
| 1
| FALCON_IRQSCLR_WDTMR
|-
| 2
| FALCON_IRQSCLR_MTHD
|-
| 3
| FALCON_IRQSCLR_CTXSW
|-
| 4
| FALCON_IRQSCLR_HALT
|-
| 5
| FALCON_IRQSCLR_EXTERR
|-
| 6
| FALCON_IRQSCLR_SWGEN0
|-
| 7
| FALCON_IRQSCLR_SWGEN1
|-
| 8-15
| FALCON_IRQSCLR_EXT
|}

Used for clearing Falcon's IRQs.

=== FALCON_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSTAT_GPTMR
|-
| 1
| FALCON_IRQSTAT_WDTMR
|-
| 2
| FALCON_IRQSTAT_MTHD
|-
| 3
| FALCON_IRQSTAT_CTXSW
|-
| 4
| FALCON_IRQSTAT_HALT
|-
| 5
| FALCON_IRQSTAT_EXTERR
|-
| 6
| FALCON_IRQSTAT_SWGEN0
|-
| 7
| FALCON_IRQSTAT_SWGEN1
|-
| 8-15
| FALCON_IRQSTAT_EXT
|}

Used for getting the status of Falcon's IRQs.

=== FALCON_IRQMODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMODE_GPTMR
|-
| 1
| FALCON_IRQMODE_WDTMR
|-
| 2
| FALCON_IRQMODE_MTHD
|-
| 3
| FALCON_IRQMODE_CTXSW
|-
| 4
| FALCON_IRQMODE_HALT
|-
| 5
| FALCON_IRQMODE_EXTERR
|-
| 6
| FALCON_IRQMODE_SWGEN0
|-
| 7
| FALCON_IRQMODE_SWGEN1
|-
| 8-15
| FALCON_IRQMODE_EXT
|}

Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.

=== FALCON_IRQMSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMSET_GPTMR
|-
| 1
| FALCON_IRQMSET_WDTMR
|-
| 2
| FALCON_IRQMSET_MTHD
|-
| 3
| FALCON_IRQMSET_CTXSW
|-
| 4
| FALCON_IRQMSET_HALT
|-
| 5
| FALCON_IRQMSET_EXTERR
|-
| 6
| FALCON_IRQMSET_SWGEN0
|-
| 7
| FALCON_IRQMSET_SWGEN1
|-
| 8-15
| FALCON_IRQMSET_EXT
|}

Used for setting the mask for Falcon's IRQs.

=== FALCON_IRQMCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMCLR_GPTMR
|-
| 1
| FALCON_IRQMCLR_WDTMR
|-
| 2
| FALCON_IRQMCLR_MTHD
|-
| 3
| FALCON_IRQMCLR_CTXSW
|-
| 4
| FALCON_IRQMCLR_HALT
|-
| 5
| FALCON_IRQMCLR_EXTERR
|-
| 6
| FALCON_IRQMCLR_SWGEN0
|-
| 7
| FALCON_IRQMCLR_SWGEN1
|-
| 8-15
| FALCON_IRQMCLR_EXT
|}

Used for clearing the mask for Falcon's IRQs.

=== FALCON_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMASK_GPTMR
|-
| 1
| FALCON_IRQMASK_WDTMR
|-
| 2
| FALCON_IRQMASK_MTHD
|-
| 3
| FALCON_IRQMASK_CTXSW
|-
| 4
| FALCON_IRQMASK_HALT
|-
| 5
| FALCON_IRQMASK_EXTERR
|-
| 6
| FALCON_IRQMASK_SWGEN0
|-
| 7
| FALCON_IRQMASK_SWGEN1
|-
| 8-15
| FALCON_IRQMASK_EXT
|}

Used for getting the value of the mask for Falcon's IRQs.

=== FALCON_IRQDEST ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQDEST_HOST_GPTMR
|-
| 1
| FALCON_IRQDEST_HOST_WDTMR
|-
| 2
| FALCON_IRQDEST_HOST_MTHD
|-
| 3
| FALCON_IRQDEST_HOST_CTXSW
|-
| 4
| FALCON_IRQDEST_HOST_HALT
|-
| 5
| FALCON_IRQDEST_HOST_EXTERR
|-
| 6
| FALCON_IRQDEST_HOST_SWGEN0
|-
| 7
| FALCON_IRQDEST_HOST_SWGEN1
|-
| 8-15
| FALCON_IRQDEST_HOST_EXT
|-
| 16
| FALCON_IRQDEST_TARGET_GPTMR
|-
| 17
| FALCON_IRQDEST_TARGET_WDTMR
|-
| 18
| FALCON_IRQDEST_TARGET_MTHD
|-
| 19
| FALCON_IRQDEST_TARGET_CTXSW
|-
| 20
| FALCON_IRQDEST_TARGET_HALT
|-
| 21
| FALCON_IRQDEST_TARGET_EXTERR
|-
| 22
| FALCON_IRQDEST_TARGET_SWGEN0
|-
| 23
| FALCON_IRQDEST_TARGET_SWGEN1
|-
| 24-31
| FALCON_IRQDEST_TARGET_EXT
|}

Used for routing Falcon's IRQs.

=== FALCON_SCRATCH0 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_SCRATCH1 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_ITFEN ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_ITFEN_CTXEN
|-
| 1
| FALCON_ITFEN_MTHDEN
|}

Used for enabling/disabling Falcon interfaces.

=== FALCON_IDLESTATE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IDLESTATE_FALCON_BUSY
|-
| 1-15
| FALCON_IDLESTATE_EXT_BUSY
|}

Used for detecting if Falcon is busy or not.

=== FALCON_DEBUGINFO ===
Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.

[6.0.0+] [[NV_services|nvservices]] sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.

=== FALCON_EXCI ===
Contains information about raised exceptions.

=== FALCON_CPUCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_CPUCTL_IINVAL
|-
| 1
| FALCON_CPUCTL_STARTCPU
|-
| 2
| FALCON_CPUCTL_SRESET
|-
| 3
| FALCON_CPUCTL_HRESET
|-
| 4
| FALCON_CPUCTL_HALTED
|-
| 5
| FALCON_CPUCTL_STOPPED
|-
| 6
| FALCON_CPUCTL_SCP_UNK
|}

Used for signaling the Falcon CPU.

=== FALCON_BOOTVEC ===
Takes the Falcon's boot vector address.

=== FALCON_HWCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-8
| FALCON_HWCFG_IMEM_SIZE
|-
| 9-17
| FALCON_HWCFG_DMEM_SIZE
|-
| 18-25
| FALCON_HWCFG_MTHD_SIZE
|-
| 26-31
| FALCON_HWCFG_DMATRF_SLOTS
|}

=== FALCON_DMACTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMACTL_REQUIRE_CTX
|-
| 1
| FALCON_DMACTL_DMEM_SCRUBBING
|-
| 2
| FALCON_DMACTL_IMEM_SCRUBBING
|-
| 3-6
| FALCON_DMACTL_DMAQ_NUM
|-
| 7
| FALCON_DMACTL_SECURE_STAT
|}

Used for configuring the Falcon's DMA engine.

=== FALCON_DMATRF_EXTBASE ===
Base of the external memory buffer.

The base of the transfer is calculated by adding [[#FALCON_DMATRF_POFF]] to the base.

=== FALCON_DMATRF_VOFF ===
For transfers to DMEM: the destination address.
For transfers to IMEM: the destination virtual IMEM page.

=== FALCON_DMATRF_POFF ===
For transfers to IMEM: the destination physical IMEM page.

=== FALCON_DMATRFCMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFCMD_FULL
|-
| 1
| FALCON_DMATRFCMD_IDLE
|-
| 2-3
| FALCON_DMATRFCMD_SEC
|-
| 4
| FALCON_DMATRFCMD_IMEM
|-
| 5
| FALCON_DMATRFCMD_WRITE
|-
| 8-10
| FALCON_DMATRFCMD_SIZE
|-
| 12-14
| FALCON_DMATRFCMD_CTXDMA
|}

Used for configuring DMA transfers.

=== FALCON_DMATRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFSTAT_PENDING
|-
| 16-18
| FALCON_DMATRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_DMATRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_CRYPTTRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| FALCON_CRYPTTRFSTAT_PENDING
|-
| 5
| FALCON_CRYPTTRFSTAT_ENABLED
|-
| 16-18
| FALCON_CRYPTTRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_CRYPTTRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_HWCFG2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_HWCFG2_VERSION
|-
| 4-5
| FALCON_HWCFG2_SCP_MODE
|-
| 6-7
| FALCON_HWCFG2_SUBVERSION
|-
| 8-11
| FALCON_HWCFG2_IMEM_PORTS
|-
| 12-15
| FALCON_HWCFG2_DMEM_PORTS
|-
| 16-19
| FALCON_HWCFG2_VM_PAGES_LOG2
|}

=== FALCON_ICD_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_ICD_CMD_OPC
0x0: BREAK
0x1: CONTINUE_FROM_PC
0x2: CONTINUE_FROM_ADDR
0x3: CONTINUE_UNK1_FROM_PC
0x4: CONTINUE_UNK1_FROM_ADDR
0x5: SINGLE_STEP_FROM_PC
0x6: SINGLE_STEP_FROM_ADDR
0x7: SET_BREAK_MASK
0x8: REG_READ
0x9: REG_WRITE
0xA: DATA_READ
0xB: DATA_WRITE
0xC: IO_READ
0xD: IO_WRITE
0xE: STATUS_READ
|-
| 6-7
| FALCON_ICD_CMD_DATA_SIZE
|-
| 8-12
| FALCON_ICD_CMD_IDX
|-
| 14
| FALCON_ICD_CMD_ERROR
|-
| 15
| FALCON_ICD_CMD_DONE
|-
| 16-31
| FALCON_ICD_CMD_BREAK_MASK
|}

=== FALCON_SCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| FALCON_SCTL_SEC_MODE
0: Non-secure
1: Light Secure
2: Heavy Secure
|}

=== TSEC_SCP_CTL_ACCESS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| Enable TSEC_SCP_INSN_STAT register
|}

=== TSEC_SCP_CTL_TRNG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 11
| Unknown
|-
| 12
| Enable the TRNG
|}

=== TSEC_SCP_CTL_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| TSEC_SCP_CTL_STAT_DEBUG_MODE
|}

=== TSEC_SCP_CTL_MODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Disable reads for the TRNG register block
|-
| 1
| Disable reads for the TFBIF register block
|-
| 2
| Disable reads for the DMA register block
|-
| 3
| Disable reads for the TEGRA register block
|-
| 4
| Disable writes for the TRNG register block
|-
| 5
| Disable writes for the TFBIF register block
|-
| 6
| Disable writes for the DMA register block
|-
| 7
| Disable writes for the TEGRA register block
|}

Controls accesses to the other sub-engines and can only be cleared in Heavy Secure mode.

=== TSEC_SCP_CTL_PKEY ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
|-
| 1
| TSEC_SCP_CTL_PKEY_LOADED
|}

=== TSEC_SCP_SEQ0_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 8-11
| Size of current cs0begin macro
|-
|}

=== TSEC_SCP_SEQ_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Set if crypto sequence recording (cs0begin/cs1begin) is active
|-
| 4-7
| Number of instructions left for the crypto sequence
|-
| 12-15
| Active crypto key register
|}

Contains information on the last crypto sequence (cs0 or cs1) executed.

=== TSEC_SCP_INSN_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| Crypto fuc5 destination register or immediate value
|-
| 8-15
| Crypto fuc5 source register or immediate value
|-
| 20-24
| Crypto fuc5 operation
0x0: none (fuc5 opcode 0x00)
0x1: cmov (fuc5 opcode 0x84)
0x2: cxsin (fuc5 opcode 0x88) or xdst (with cxset)
0x3: cxsout (fuc5 opcode 0x8C) or xdld (with cxset)
0x4: crng (fuc5 opcode 0x90)
0x5: cs0begin (fuc5 opcode 0x94)
0x6: cs0exec (fuc5 opcode 0x98)
0x7: cs1begin (fuc5 opcode 0x9C)
0x8: cs1exec (fuc5 opcode 0xA0)
0x9: invalid (fuc5 opcode 0xA4)
0xA: cchmod (fuc5 opcode 0xA8)
0xB: cxor (fuc5 opcode 0xAC)
0xC: cadd (fuc5 opcode 0xB0)
0xD: cand (fuc5 opcode 0xB4)
0xE: crev (fuc5 opcode 0xB8)
0xF: cprecmac (fuc5 opcode 0xBC)
0x10: csecret (fuc5 opcode 0xC0)
0x11: ckeyreg (fuc5 opcode 0xC4)
0x12: ckexp (fuc5 opcode 0xC8)
0x13: ckrexp (fuc5 opcode 0xCC)
0x14: cenc (fuc5 opcode 0xD0)
0x15: cdec (fuc5 opcode 0xD4)
0x16: csigauth (fuc5 opcode 0xD8)
0x17: csigenc (fuc5 opcode 0xDC)
0x18: csigclr (fuc5 opcode 0xE0)
|-
| 31
| Set if running in secure mode (cauth)
|}

Contains information on the last crypto instruction executed.

=== TSEC_SCP_AES_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-4
| First opcode
|-
| 5-9
| Second opcode
|-
| 15-16
| AES operation
0: Encryption
1: Decryption
2: Key expansion
3: Key reverse expansion
|}

Contains information on the last AES sequence executed.

=== TSEC_SCP_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQSTAT_TRNG
|-
| 8
| TSEC_SCP_IRQSTAT_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQSTAT_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQSTAT_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the status of crypto IRQs.

=== TSEC_SCP_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQMASK_TRNG
|-
| 8
| TSEC_SCP_IRQMASK_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQMASK_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQMASK_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the value of the mask for crypto IRQs.

=== TSEC_SCP_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Invalid instruction
|-
| 4
| Empty crypto sequence
|-
| 8
| Crypto sequence is too long
|-
| 12
| Crypto sequence was not finished
|-
| 16
| Invalid cauth signature (during csigenc, csigclr or csigunk)
|-
| 24
| Forbidden instruction
|}

Contains information on crypto errors generated by the [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT_INSN_ERROR]] IRQ.

=== TSEC_TFBIF_MCCIF_FIFOCTRL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
|-
| 1
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
|-
| 2
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
|-
| 3
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
|-
| 4
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
|-
| 5
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
|-
| 6
| TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
|-
| 7
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
|-
| 8
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE
|}

=== TSEC_MCCIF_FIFOCTRL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
|-
| 16-31
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT
|}

=== TSEC_TFBIF_UNK5 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.

=== TSEC_TFBIF_UNK6 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to (data_size << 4) before reading memory from the GPU UCODE carveout.

=== TSEC_DMA_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_DMA_CMD_READ
|-
| 1
| TSEC_DMA_CMD_WRITE
|-
| 4-7
| TSEC_DMA_CMD_UNK
|-
| 12
| TSEC_DMA_CMD_BUSY
|-
| 13
| TSEC_DMA_CMD_ERROR
|-
| 31
| TSEC_DMA_CMD_INIT
|}

A DMA read/write operation requires bits TSEC_DMA_CMD_INIT and TSEC_DMA_CMD_READ/TSEC_DMA_CMD_WRITE to be set in TSEC_DMA_CMD.

During the transfer, the TSEC_DMA_CMD_BUSY bit is set.

Accessing an invalid address causes bit TSEC_DMA_CMD_ERROR to be set.

=== TSEC_DMA_ADDR ===
Takes the address for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_VAL ===
Takes the value for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_UNK ===
Always 0xFFF.

=== TSEC_TEGRA_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 16
| TSEC_TEGRA_CTL_TKFI_KFUSE
|-
| 17
| TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
|-
| 24
| TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
|-
| 25
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
|-
| 26
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
|-
| 27
| TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C
|}

== Authenticated Mode ==
===== Entry =====
From non-secure mode, upon jumping to a page marked as secret, a secret fault occurs. This causes the CPU to verify the region specified in $cauth against the MAC loaded in $c6. If the comparison is successful, the valid bit (bit0) is set on all pages in the $cauth region, and $pc is set to the base of the $cauth region. If the comparsion fails, the CPU is halted.

===== Exit =====
The CPU automatically goes back to non-secure mode when returning back into non-secret pages. When this happens, the valid bit (bit0) in the TLB flags is cleared for all secret pages.

===== Implementation =====
Under certain circumstances, it is possible to observe [[#csigauth|csigauth]] being briefly written to [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]] as "csigauth $c4 $c6" while the opcodes in [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]] are set to "cxsin" and "csigauth", respectively.

Via [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]] it can be observed that a 3-sized macro sequence is loaded into cs0 during a secure mode transition.

== Crypto processing ==
Part of the information here (which hasn't made it into envytools documentation yet) was shared by [https://wiki.0x04.net/wiki/Marcin_Ko%C5%9Bcielnicki mwk] from reverse engineering falcon processors over the years.

=== cauth ===
$cauth is a special purpose register in the CPU.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7 || Start of region to authenticate (in 0x100 pages)
|-
| 8-15 || Unused
|-
| 16 || Use secret xfers (?)
|-
| 17 || Region is signed and encrypted and double the size (?)
|-
| 18 ||
|-
| 19 ||
|-
| 20-23 || Unused
|-
| 31-24 || Size of region to authenticate (in 0x100 pages)
|}

== SCP operations ==

{| class="wikitable" border="1"
! Opcode
! Name
! Operand0
! Operand1
! Operation
! Condition
|-
| 0 || || || || ||
|-
| 1 || mov || $cX || $cY || <code>$cX = $cY; ACL(X) = ACL(Y);</code> ||
|-
| 2 || sin || $cX || N/A || <code>$cX = read_stream(); ACL(X) = ???;</code> ||
|-
| 3 || sout || $cX || N/A || <code>write_stream($cX);</code> ||
|-
| 4 || rnd || $cX || N/A || <code>$cX = read_trng(); ACL(X) = ???;</code> ||
|-
| 5 || s0begin || immX || N/A || <code>record_macro_for_N_instructions(0, immX);</code> ||
|-
| 6 || s0exec || immX || N/A || <code>execute_macro_N_times(0, immX);</code> ||
|-
| 7 || s1begin || immX || N/A || <code>record_macro_for_N_instructions(1, immX);</code> ||
|-
| 8 || s1exec || immX || N/A || <code>execute_macro_N_times(1, immX);</code> ||
|-
| 9 || ? || || || ||
|-
| 0xA || chmod || $cX || immY || <code>ACL(X) &= immY;</code> ||
|-
| 0xB || xor || $cX || $cY || <code>$cX ^= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xC || add || $cX || immY || <code>$cX += immY;</code> || <code>(ACL(X) & 2)</code>
|-
| 0xD || and || $cX || $cY || <code>$cX &= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xE || rev || $cX || $cY || <code>$cX = reverse($cY); ACL(X) = ACL(Y) | 1;</code> || <code>(ACL(Y) & 2)</code>
|-
| 0xF || gfmul || $cX || $cY || <code>$cX = gfmul($cY); ACL(X) = ACL(Y) | 1;</code> || <code>(ACL(Y) & 2)</code>
|-
| 0x10 || secret || $cX || immY || <code>$cX = load_secret(immY); ACL(X) = load_secret_acl(immY);</code> ||
|-
| 0x11 || keyreg || immX || || <code>active_key_idx = immX;</code> ||
|-
| 0x12 || kexp || $cX || $cY || <code>$cX = aes_kexp($cY);</code> || <code>(ACL(Y) & 2)</code>
|-
| 0x13 || krexp || $cX || $cY || <code>$cX = aes_kexp_reverse($cY);</code> || <code>(ACL(Y) & 2)</code>
|-
| 0x14 || enc || $cX || $cY || <code>$cX = aes_enc(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 3) && (ACL(Y) & 2)</code>
|-
| 0x15 || dec || $cX || $cY || <code>$cX = aes_dec(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 3) && (ACL(Y) & 2)</code>
|-
| ...
|}

=== ACL ===
{| class="wikitable" border="1"
! Bit
! Meaning
|-
| 0 || Valid key
|-
| 1 || Valid data
|}

==== Initial values ====
On SCP boot, the ACL is 0x1F for all $cX.

Loading into $cX using xdst instruction sets ACL($cX) to 0x1F.

Spilling a $cX to DMEM using xdld instruction is allowed if (ACL($cX) & 2).

=== csigauth ===
<code>00000000: f5 3c XY d8 csigauth $cY $cX</code>

This instruction takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret.

=== csigclr ===
<code>00000000: f5 3c 00 e0 csigclr</code>

This instruction takes no operands and appears to clear the saved cauth signature used by the csigenc instruction.

=== cchmod ===
<code>00000000: f5 3c XY a8 cchmod $cY 0X</code> or <code>00000000: f5 3c XY a9 cchmod $cY 1X</code>

This instruction takes a crypto register and a 5 bit immediate value. It appears to set the [[#Register ACLs|crypto registers' ACL]] bits as follows:
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Allow register to be used as key in NS or LS mode
|-
| 1
| Allow register to be used as key in HS mode
|-
| 2
| Set register as readable in NS or LS mode
|-
| 3
| Set register as readable in HS mode
|-
| 4
| Set register as writable in NS or LS mode
|}

=== crng ===
<code>00000000: f5 3c 0X 90 crng $cX</code>

This instruction initializes a crypto register with random data.

Executing this instruction only succeeds if the TRNG is enabled for the SCP, which requires taking the following steps:
* Write 0x7FFF to TSEC_TRNG_CLKDIV.
* Write 0x3FF0000 to TSEC_TRNG_UNK0.
* Write 0xFF00 to TSEC_TRNG_UNK7.
* Write 0x1000 to [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]].

Otherwise it hangs forever.

=== cxset ===
cxset instruction provides a way to change behavior of a variable amount of successively executed DMA-related instructions.

for example: <code>000000de: f4 3c 02 cxset 0x2</code>

can be read as: <code>dma_override(type=crypto_reg, count=2)</code>

The argument to cxset specifies the type of behavior change in the top 3 bits, and the number of DMA-related instructions the effect lasts for in the lower 5 bits.

{| class=wikitable
! Bits || Description
|-
| 0-4 || Number of instructions it is valid for (0x1f is a special value meaning infinitely many instructions -- until overriden by another cxset)
|-
| 5 || Crypto destination/source select (0=crypto register, 1=crypto stream)
|-
| 6 || External memory override (0=Disabled, 1=Enabled)
|-
| 7 || Internal memory select (0=DMEM, 1=IMEM)
|}

==== DMA-Related Instructions ====
At least the following instructions may have changed behavior, and count against the cxset "count" argument: <code>xdwait</code>, <code>xdst</code>, <code>xdld</code>.

For example, if override type=0b000, then the "length" argument to <code>xdst</code> is instead treated as the index of the target $cX register.

=== Secrets ===
Falcon's Authenticated Mode has access to 64 128-bit keys which are burned at factory. These keys can be loaded by using the $csecret instruction which takes the target crypto register and the key index as arguments.

{| class=wikitable
! Index || Notes || Console-unique
|-
| 0x00 || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares. || No
|-
| 0x01 || Used by nvhost_nvdec_bl020_prod firmware. ||
|-
| 0x03 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x04 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x05 || Used by nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares. ||
|-
| 0x07 || Used by [6.0.0+] nvhost_tsec firmware. ||
|-
| 0x09 || Used by nvhost_tsec firmware. ||
|-
| 0x0B || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x0F || Used by nvhost_tsec firmware. ||
|-
| 0x10 || Used by [1.0.0-5.1.0] nvhost_tsec firmware. ||
|-
| 0x15 || Used by nvhost_nvdec_bl020_prod, [5.0.0+] nvhost_nvdec020_prod, [5.0.0+] nvhost_nvdec020_ns and [6.0.0+] nvhost_tsec firmwares. ||
|-
| 0x26 || Used by [[TSEC_Firmware#KeygenLdr|KeygenLdr]]. || No
|-
| 0x3C || Used by nvhost_tsec firmware. ||
|-
| 0x3F || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. || Yes
|}

TSEC

2019-01-06T09:47:49Z

Qlutoo: /* SCP operations */

TSEC (Tegra Security Co-processor) is a dedicated unit powered by a NVIDIA Falcon microprocessor with crypto extensions.

= Driver =
A host driver for communicating with the TSEC is mapped to physical address 0x54500000 with a total size of 0x40000 bytes and exposes several registers.

== Registers ==
Registers from 0x54500000 to 0x54501000 are used to configure the host interface (HOST1X).

Registers from 0x54501000 to 0x54502000 are a MMIO window for communicating with the Falcon microprocessor. From this range, the subset of registers from 0x54501400 to 0x54501FE8 are specific to the TSEC and are subdivided into:
* 0x54501400 to 0x54501500: SCP (Secure Crypto Processor?).
* 0x54501500 to 0x54501600: TRNG (True Random Number Generator).
* 0x54501600 to 0x54501700: TFBIF (Tegra Framebuffer Interface).
* 0x54501700 to 0x54501800: DMA.
* 0x54501800 to 0x54501900: TEGRA (miscellaneous interfaces).

{| class="wikitable" border="1"
! Name
! Address
! Width
|-
| TSEC_THI_INCR_SYNCPT
| 0x54500000
| 0x04
|-
| TSEC_THI_INCR_SYNCPT_ERR
| 0x54500008
| 0x04
|-
| TSEC_THI_CTXSW_INCR_SYNCPT
| 0x5450000C
| 0x04
|-
| TSEC_THI_CTXSW
| 0x54500020
| 0x04
|-
| TSEC_THI_CONT_SYNCPT_EOF
| 0x54500028
| 0x04
|-
| [[#TSEC_THI_METHOD0|TSEC_THI_METHOD0]]
| 0x54500040
| 0x04
|-
| [[#TSEC_THI_METHOD1|TSEC_THI_METHOD1]]
| 0x54500044
| 0x04
|-
| [[#TSEC_THI_INT_STATUS|TSEC_THI_INT_STATUS]]
| 0x54500078
| 0x04
|-
| [[#TSEC_THI_INT_MASK|TSEC_THI_INT_MASK]]
| 0x5450007C
| 0x04
|-
| TSEC_THI_SLCG_STATUS
| 0x54500084
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_HIGH_A
| 0x54500088
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_LOW_A
| 0x5450008C
| 0x04
|-
| TSEC_THI_CLK_OVERRIDE
| 0x54500E00
| 0x04
|-
| [[#FALCON_IRQSSET|FALCON_IRQSSET]]
| 0x54501000
| 0x04
|-
| [[#FALCON_IRQSCLR|FALCON_IRQSCLR]]
| 0x54501004
| 0x04
|-
| [[#FALCON_IRQSTAT|FALCON_IRQSTAT]]
| 0x54501008
| 0x04
|-
| [[#FALCON_IRQMODE|FALCON_IRQMODE]]
| 0x5450100C
| 0x04
|-
| [[#FALCON_IRQMSET|FALCON_IRQMSET]]
| 0x54501010
| 0x04
|-
| [[#FALCON_IRQMCLR|FALCON_IRQMCLR]]
| 0x54501014
| 0x04
|-
| [[#FALCON_IRQMASK|FALCON_IRQMASK]]
| 0x54501018
| 0x04
|-
| [[#FALCON_IRQDEST|FALCON_IRQDEST]]
| 0x5450101C
| 0x04
|-
| FALCON_GPTMR_PERIOD
| 0x54501020
| 0x04
|-
| FALCON_GPTMR_TIME
| 0x54501024
| 0x04
|-
| FALCON_GPTMR_ENABLE
| 0x54501028
| 0x04
|-
| FALCON_TIME_LOW
| 0x5450102C
| 0x04
|-
| FALCON_TIME_HIGH
| 0x54501030
| 0x04
|-
| FALCON_WDTMR_TIME
| 0x54501034
| 0x04
|-
| FALCON_WDTMR_ENABLE
| 0x54501038
| 0x04
|-
| [[#FALCON_SCRATCH0|FALCON_SCRATCH0]]
| 0x54501040
| 0x04
|-
| [[#FALCON_SCRATCH1|FALCON_SCRATCH1]]
| 0x54501044
| 0x04
|-
| [[#FALCON_ITFEN|FALCON_ITFEN]]
| 0x54501048
| 0x04
|-
| [[#FALCON_IDLESTATE|FALCON_IDLESTATE]]
| 0x5450104C
| 0x04
|-
| FALCON_CURCTX
| 0x54501050
| 0x04
|-
| FALCON_NXTCTX
| 0x54501054
| 0x04
|-
| FALCON_CMDCTX
| 0x54501058
| 0x04
|-
| FALCON_STATUS_MASK
| 0x5450105C
| 0x04
|-
| FALCON_VM_SUPERVISOR
| 0x54501060
| 0x04
|-
| FALCON_MTHD_DATA
| 0x54501064
| 0x04
|-
| FALCON_MTHD_CMD
| 0x54501068
| 0x04
|-
| FALCON_MTHD_DATA_WR
| 0x5450106C
| 0x04
|-
| FALCON_MTHD_OCCUPIED
| 0x54501070
| 0x04
|-
| FALCON_MTHD_ACK
| 0x54501074
| 0x04
|-
| FALCON_MTHD_LIMIT
| 0x54501078
| 0x04
|-
| FALCON_SUBENGINE_RESET
| 0x5450107C
| 0x04
|-
| FALCON_SCRATCH2
| 0x54501080
| 0x04
|-
| FALCON_SCRATCH3
| 0x54501084
| 0x04
|-
| FALCON_PM_TRIGGER
| 0x54501088
| 0x04
|-
| FALCON_PM_MODE
| 0x5450108C
| 0x04
|-
| FALCON_DEBUG1
| 0x54501090
| 0x04
|-
| [[#FALCON_DEBUGINFO|FALCON_DEBUGINFO]]
| 0x54501094
| 0x04
|-
| FALCON_BREAKPOINT0
| 0x54501098
| 0x04
|-
| FALCON_BREAKPOINT1
| 0x5450109C
| 0x04
|-
| FALCON_CGCTL
| 0x545010A0
| 0x04
|-
| FALCON_ENGCTL
| 0x545010A4
| 0x04
|-
| FALCON_PM_SEL
| 0x545010A8
| 0x04
|-
| FALCON_HOST_IO_INDEX
| 0x545010AC
| 0x04
|-
| [[#FALCON_EXCI|FALCON_EXCI]]
| 0x545010D0
| 0x04
|-
| [[#FALCON_CPUCTL|FALCON_CPUCTL]]
| 0x54501100
| 0x04
|-
| [[#FALCON_BOOTVEC|FALCON_BOOTVEC]]
| 0x54501104
| 0x04
|-
| [[#FALCON_HWCFG|FALCON_HWCFG]]
| 0x54501108
| 0x04
|-
| [[#FALCON_DMACTL|FALCON_DMACTL]]
| 0x5450110C
| 0x04
|-
| [[#FALCON_DMATRF_EXTBASE|FALCON_DMATRF_EXTBASE]]
| 0x54501110
| 0x04
|-
| [[#FALCON_DMATRF_VOFF|FALCON_DMATRF_VOFF]]
| 0x54501114
| 0x04
|-
| [[#FALCON_DMATRFCMD|FALCON_DMATRFCMD]]
| 0x54501118
| 0x04
|-
| [[#FALCON_DMATRF_POFF|FALCON_DMATRF_POFF]]
| 0x5450111C
| 0x04
|-
| [[#FALCON_DMATRFSTAT|FALCON_DMATRFSTAT]]
| 0x54501120
| 0x04
|-
| [[#FALCON_CRYPTTRFSTAT|FALCON_CRYPTTRFSTAT]]
| 0x54501124
| 0x04
|-
| FALCON_CPUSTAT
| 0x54501128
| 0x04
|-
| [[#FALCON_HWCFG2|FALCON_HWCFG2]]
| 0x5450112C
| 0x04
|-
| FALCON_CPUCTL_ALIAS
| 0x54501130
| 0x04
|-
| FALCON_TLB_CMD
| 0x54501140
| 0x04
|-
| FALCON_TLB_CMD_RES
| 0x54501144
| 0x04
|-
| FALCON_BRANCH_HISTORY_CTRL
| 0x54501148
| 0x04
|-
| FALCON_BRANCH_HISTORY_PC
| 0x5450114C
| 0x04
|-
| FALCON_IMFILLRNG0
| 0x54501150
| 0x04
|-
| FALCON_IMFILLRNG1
| 0x54501154
| 0x04
|-
| FALCON_IMFILLCTL
| 0x54501158
| 0x04
|-
| FALCON_EXTERRWIN
| 0x54501160
| 0x04
|-
| FALCON_EXTERRCFG
| 0x54501164
| 0x04
|-
| FALCON_EXTERRADDR
| 0x54501168
| 0x04
|-
| FALCON_EXTERRSTAT
| 0x5450116C
| 0x04
|-
| FALCON_CG2
| 0x5450117C
| 0x04
|-
| FALCON_CODE_INDEX
| 0x54501180
| 0x04
|-
| FALCON_CODE
| 0x54501184
| 0x04
|-
| FALCON_CODE_VIRT_ADDR
| 0x54501188
| 0x04
|-
| FALCON_DATA_INDEX0
| 0x545011C0
| 0x04
|-
| FALCON_DATA0
| 0x545011C4
| 0x04
|-
| FALCON_DATA_INDEX1
| 0x545011C8
| 0x04
|-
| FALCON_DATA1
| 0x545011CC
| 0x04
|-
| FALCON_DATA_INDEX2
| 0x545011D0
| 0x04
|-
| FALCON_DATA2
| 0x545011D4
| 0x04
|-
| FALCON_DATA_INDEX3
| 0x545011D8
| 0x04
|-
| FALCON_DATA3
| 0x545011DC
| 0x04
|-
| FALCON_DATA_INDEX4
| 0x545011E0
| 0x04
|-
| FALCON_DATA4
| 0x545011E4
| 0x04
|-
| FALCON_DATA_INDEX5
| 0x545011E8
| 0x04
|-
| FALCON_DATA5
| 0x545011EC
| 0x04
|-
| FALCON_DATA_INDEX6
| 0x545011F0
| 0x04
|-
| FALCON_DATA6
| 0x545011F4
| 0x04
|-
| FALCON_DATA_INDEX7
| 0x545011F8
| 0x04
|-
| FALCON_DATA7
| 0x545011FC
| 0x04
|-
| [[#FALCON_ICD_CMD|FALCON_ICD_CMD]]
| 0x54501200
| 0x04
|-
| FALCON_ICD_ADDR
| 0x54501204
| 0x04
|-
| FALCON_ICD_WDATA
| 0x54501208
| 0x04
|-
| FALCON_ICD_RDATA
| 0x5450120C
| 0x04
|-
| [[#FALCON_SCTL|FALCON_SCTL]]
| 0x54501240
| 0x04
|-
| [[#TSEC_SCP_CTL_ACCESS|TSEC_SCP_CTL_ACCESS]]
| 0x54501400
| 0x04
|-
| [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]]
| 0x54501404
| 0x04
|-
| [[#TSEC_SCP_CTL_STAT|TSEC_SCP_CTL_STAT]]
| 0x54501408
| 0x04
|-
| [[#TSEC_SCP_CTL_MODE|TSEC_SCP_CTL_MODE]]
| 0x5450140C
| 0x04
|-
| TSEC_SCP_UNK0
| 0x54501410
| 0x04
|-
| [[#TSEC_SCP_CTL_PKEY|TSEC_SCP_CTL_PKEY]]
| 0x54501418
| 0x04
|-
| [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]]
| 0x54501420
| 0x04
|-
| [[#TSEC_SCP_SEQ_STAT|TSEC_SCP_SEQ_STAT]]
| 0x54501428
| 0x04
|-
| [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]]
| 0x54501430
| 0x04
|-
| TSEC_SCP_UNK2
| 0x54501454
| 0x04
|-
| [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]]
| 0x54501458
| 0x04
|-
| TSEC_SCP_UNK3
| 0x54501470
| 0x04
|-
| [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT]]
| 0x54501480
| 0x04
|-
| [[#TSEC_SCP_IRQMASK|TSEC_SCP_IRQMASK]]
| 0x54501484
| 0x04
|-
| TSEC_SCP_UNK4
| 0x54501490
| 0x04
|-
| [[#TSEC_SCP_ERR|TSEC_SCP_ERR]]
| 0x54501498
| 0x04
|-
| TSEC_TRNG_CLKDIV
| 0x54501500
| 0x04
|-
| TSEC_TRNG_UNK0
| 0x54501504
| 0x04
|-
| TSEC_TRNG_UNK1
| 0x5450150C
| 0x04
|-
| TSEC_TRNG_UNK2
| 0x54501510
| 0x04
|-
| TSEC_TRNG_UNK3
| 0x54501514
| 0x04
|-
| TSEC_TRNG_UNK4
| 0x54501518
| 0x04
|-
| TSEC_TRNG_UNK5
| 0x5450151C
| 0x04
|-
| TSEC_TRNG_UNK6
| 0x54501528
| 0x04
|-
| TSEC_TRNG_UNK7
| 0x5450152C
| 0x04
|-
| TSEC_TFBIF_UNK0
| 0x54501600
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL|TSEC_TFBIF_MCCIF_FIFOCTRL]]
| 0x54501604
| 0x04
|-
| TSEC_TFBIF_UNK1
| 0x54501608
| 0x04
|-
| TSEC_TFBIF_UNK2
| 0x5450160C
| 0x04
|-
| TSEC_TFBIF_UNK3
| 0x54501630
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL1|TSEC_TFBIF_MCCIF_FIFOCTRL1]]
| 0x54501634
| 0x04
|-
| TSEC_TFBIF_UNK4
| 0x54501640
| 0x04
|-
| [[#TSEC_TFBIF_UNK5|TSEC_TFBIF_UNK5]]
| 0x54501644
| 0x04
|-
| [[#TSEC_TFBIF_UNK6|TSEC_TFBIF_UNK6]]
| 0x54501648
| 0x04
|-
| [[#TSEC_DMA_CMD|TSEC_DMA_CMD]]
| 0x54501700
| 0x04
|-
| [[#TSEC_DMA_ADDR|TSEC_DMA_ADDR]]
| 0x54501704
| 0x04
|-
| [[#TSEC_DMA_VAL|TSEC_DMA_VAL]]
| 0x54501708
| 0x04
|-
| [[#TSEC_DMA_UNK|TSEC_DMA_UNK]]
| 0x5450170C
| 0x04
|-
| TSEC_TEGRA_FALCON_IP_VER
| 0x54501800
| 0x04
|-
| TSEC_TEGRA_UNK0
| 0x54501824
| 0x04
|-
| TSEC_TEGRA_UNK1
| 0x54501828
| 0x04
|-
| TSEC_TEGRA_UNK2
| 0x5450182C
| 0x04
|-
| [[#TSEC_TEGRA_CTL|TSEC_TEGRA_CTL]]
| 0x54501838
| 0x04
|}

=== TSEC_THI_METHOD0 ===
{| class="wikitable" border="1"
! ID
! Method
|-
| 0x200
| SET_APPLICATION_ID
|-
| 0x300
| EXECUTE
|-
| 0x500
| HDCP_INIT
|-
| 0x504
| HDCP_CREATE_SESSION
|-
| 0x508
| HDCP_VERIFY_CERT_RX
|-
| 0x50C
| HDCP_GENERATE_EKM
|-
| 0x510
| HDCP_REVOCATION_CHECK
|-
| 0x514
| HDCP_VERIFY_HPRIME
|-
| 0x518
| HDCP_ENCRYPT_PAIRING_INFO
|-
| 0x51C
| HDCP_DECRYPT_PAIRING_INFO
|-
| 0x520
| HDCP_UPDATE_SESSION
|-
| 0x524
| HDCP_GENERATE_LC_INIT
|-
| 0x528
| HDCP_VERIFY_LPRIME
|-
| 0x52C
| HDCP_GENERATE_SKE_INIT
|-
| 0x530
| HDCP_VERIFY_VPRIME
|-
| 0x534
| HDCP_ENCRYPTION_RUN_CTRL
|-
| 0x538
| HDCP_SESSION_CTRL
|-
| 0x53C
| HDCP_COMPUTE_SPRIME
|-
| 0x540
| HDCP_GET_CERT_RX
|-
| 0x544
| HDCP_EXCHANGE_INFO
|-
| 0x548
| HDCP_DECRYPT_KM
|-
| 0x54C
| HDCP_GET_HPRIME
|-
| 0x550
| HDCP_GENERATE_EKH_KM
|-
| 0x554
| HDCP_VERIFY_RTT_CHALLENGE
|-
| 0x558
| HDCP_GET_LPRIME
|-
| 0x55C
| HDCP_DECRYPT_KS
|-
| 0x560
| HDCP_DECRYPT
|-
| 0x564
| HDCP_GET_RRX
|-
| 0x568
| HDCP_DECRYPT_REENCRYPT
|-
| 0x56C
|
|-
| 0x570
|
|-
| 0x574
|
|-
| 0x578
|
|-
| 0x57C
|
|-
| 0x700
| HDCP_VALIDATE_SRM
|-
| 0x704
| HDCP_VALIDATE_STREAM
|-
| 0x708
| HDCP_TEST_SECURE_STATUS
|-
| 0x70C
| HDCP_SET_DCP_KPUB
|-
| 0x710
| HDCP_SET_RX_KPUB
|-
| 0x714
| HDCP_SET_CERT_RX
|-
| 0x718
| HDCP_SET_SCRATCH_BUFFER
|-
| 0x71C
| HDCP_SET_SRM
|-
| 0x720
| HDCP_SET_RECEIVER_ID_LIST
|-
| 0x724
| HDCP_SET_SPRIME
|-
| 0x728
| HDCP_SET_ENC_INPUT_BUFFER
|-
| 0x72C
| HDCP_SET_ENC_OUTPUT_BUFFER
|-
| 0x730
| HDCP_GET_RTT_CHALLENGE
|-
| 0x734
| HDCP_STREAM_MANAGE
|-
| 0x738
| HDCP_READ_CAPS
|-
| 0x73C
| HDCP_ENCRYPT
|-
| 0x740
| [6.0.0+] HDCP_GET_CURRENT_NONCE
|}

Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_METHOD1 ===
Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_INT_STATUS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_STATUS_FALCON_INT
|}

=== TSEC_THI_INT_MASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_MASK_FALCON_INT
|}

=== FALCON_IRQSSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSSET_GPTMR
|-
| 1
| FALCON_IRQSSET_WDTMR
|-
| 2
| FALCON_IRQSSET_MTHD
|-
| 3
| FALCON_IRQSSET_CTXSW
|-
| 4
| FALCON_IRQSSET_HALT
|-
| 5
| FALCON_IRQSSET_EXTERR
|-
| 6
| FALCON_IRQSSET_SWGEN0
|-
| 7
| FALCON_IRQSSET_SWGEN1
|-
| 8-15
| FALCON_IRQSSET_EXT
|}

Used for setting Falcon's IRQs.

=== FALCON_IRQSCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSCLR_GPTMR
|-
| 1
| FALCON_IRQSCLR_WDTMR
|-
| 2
| FALCON_IRQSCLR_MTHD
|-
| 3
| FALCON_IRQSCLR_CTXSW
|-
| 4
| FALCON_IRQSCLR_HALT
|-
| 5
| FALCON_IRQSCLR_EXTERR
|-
| 6
| FALCON_IRQSCLR_SWGEN0
|-
| 7
| FALCON_IRQSCLR_SWGEN1
|-
| 8-15
| FALCON_IRQSCLR_EXT
|}

Used for clearing Falcon's IRQs.

=== FALCON_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSTAT_GPTMR
|-
| 1
| FALCON_IRQSTAT_WDTMR
|-
| 2
| FALCON_IRQSTAT_MTHD
|-
| 3
| FALCON_IRQSTAT_CTXSW
|-
| 4
| FALCON_IRQSTAT_HALT
|-
| 5
| FALCON_IRQSTAT_EXTERR
|-
| 6
| FALCON_IRQSTAT_SWGEN0
|-
| 7
| FALCON_IRQSTAT_SWGEN1
|-
| 8-15
| FALCON_IRQSTAT_EXT
|}

Used for getting the status of Falcon's IRQs.

=== FALCON_IRQMODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMODE_GPTMR
|-
| 1
| FALCON_IRQMODE_WDTMR
|-
| 2
| FALCON_IRQMODE_MTHD
|-
| 3
| FALCON_IRQMODE_CTXSW
|-
| 4
| FALCON_IRQMODE_HALT
|-
| 5
| FALCON_IRQMODE_EXTERR
|-
| 6
| FALCON_IRQMODE_SWGEN0
|-
| 7
| FALCON_IRQMODE_SWGEN1
|-
| 8-15
| FALCON_IRQMODE_EXT
|}

Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.

=== FALCON_IRQMSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMSET_GPTMR
|-
| 1
| FALCON_IRQMSET_WDTMR
|-
| 2
| FALCON_IRQMSET_MTHD
|-
| 3
| FALCON_IRQMSET_CTXSW
|-
| 4
| FALCON_IRQMSET_HALT
|-
| 5
| FALCON_IRQMSET_EXTERR
|-
| 6
| FALCON_IRQMSET_SWGEN0
|-
| 7
| FALCON_IRQMSET_SWGEN1
|-
| 8-15
| FALCON_IRQMSET_EXT
|}

Used for setting the mask for Falcon's IRQs.

=== FALCON_IRQMCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMCLR_GPTMR
|-
| 1
| FALCON_IRQMCLR_WDTMR
|-
| 2
| FALCON_IRQMCLR_MTHD
|-
| 3
| FALCON_IRQMCLR_CTXSW
|-
| 4
| FALCON_IRQMCLR_HALT
|-
| 5
| FALCON_IRQMCLR_EXTERR
|-
| 6
| FALCON_IRQMCLR_SWGEN0
|-
| 7
| FALCON_IRQMCLR_SWGEN1
|-
| 8-15
| FALCON_IRQMCLR_EXT
|}

Used for clearing the mask for Falcon's IRQs.

=== FALCON_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMASK_GPTMR
|-
| 1
| FALCON_IRQMASK_WDTMR
|-
| 2
| FALCON_IRQMASK_MTHD
|-
| 3
| FALCON_IRQMASK_CTXSW
|-
| 4
| FALCON_IRQMASK_HALT
|-
| 5
| FALCON_IRQMASK_EXTERR
|-
| 6
| FALCON_IRQMASK_SWGEN0
|-
| 7
| FALCON_IRQMASK_SWGEN1
|-
| 8-15
| FALCON_IRQMASK_EXT
|}

Used for getting the value of the mask for Falcon's IRQs.

=== FALCON_IRQDEST ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQDEST_HOST_GPTMR
|-
| 1
| FALCON_IRQDEST_HOST_WDTMR
|-
| 2
| FALCON_IRQDEST_HOST_MTHD
|-
| 3
| FALCON_IRQDEST_HOST_CTXSW
|-
| 4
| FALCON_IRQDEST_HOST_HALT
|-
| 5
| FALCON_IRQDEST_HOST_EXTERR
|-
| 6
| FALCON_IRQDEST_HOST_SWGEN0
|-
| 7
| FALCON_IRQDEST_HOST_SWGEN1
|-
| 8-15
| FALCON_IRQDEST_HOST_EXT
|-
| 16
| FALCON_IRQDEST_TARGET_GPTMR
|-
| 17
| FALCON_IRQDEST_TARGET_WDTMR
|-
| 18
| FALCON_IRQDEST_TARGET_MTHD
|-
| 19
| FALCON_IRQDEST_TARGET_CTXSW
|-
| 20
| FALCON_IRQDEST_TARGET_HALT
|-
| 21
| FALCON_IRQDEST_TARGET_EXTERR
|-
| 22
| FALCON_IRQDEST_TARGET_SWGEN0
|-
| 23
| FALCON_IRQDEST_TARGET_SWGEN1
|-
| 24-31
| FALCON_IRQDEST_TARGET_EXT
|}

Used for routing Falcon's IRQs.

=== FALCON_SCRATCH0 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_SCRATCH1 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_ITFEN ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_ITFEN_CTXEN
|-
| 1
| FALCON_ITFEN_MTHDEN
|}

Used for enabling/disabling Falcon interfaces.

=== FALCON_IDLESTATE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IDLESTATE_FALCON_BUSY
|-
| 1-15
| FALCON_IDLESTATE_EXT_BUSY
|}

Used for detecting if Falcon is busy or not.

=== FALCON_DEBUGINFO ===
Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.

[6.0.0+] [[NV_services|nvservices]] sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.

=== FALCON_EXCI ===
Contains information about raised exceptions.

=== FALCON_CPUCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_CPUCTL_IINVAL
|-
| 1
| FALCON_CPUCTL_STARTCPU
|-
| 2
| FALCON_CPUCTL_SRESET
|-
| 3
| FALCON_CPUCTL_HRESET
|-
| 4
| FALCON_CPUCTL_HALTED
|-
| 5
| FALCON_CPUCTL_STOPPED
|-
| 6
| FALCON_CPUCTL_SCP_UNK
|}

Used for signaling the Falcon CPU.

=== FALCON_BOOTVEC ===
Takes the Falcon's boot vector address.

=== FALCON_HWCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-8
| FALCON_HWCFG_IMEM_SIZE
|-
| 9-17
| FALCON_HWCFG_DMEM_SIZE
|-
| 18-25
| FALCON_HWCFG_MTHD_SIZE
|-
| 26-31
| FALCON_HWCFG_DMATRF_SLOTS
|}

=== FALCON_DMACTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMACTL_REQUIRE_CTX
|-
| 1
| FALCON_DMACTL_DMEM_SCRUBBING
|-
| 2
| FALCON_DMACTL_IMEM_SCRUBBING
|-
| 3-6
| FALCON_DMACTL_DMAQ_NUM
|-
| 7
| FALCON_DMACTL_SECURE_STAT
|}

Used for configuring the Falcon's DMA engine.

=== FALCON_DMATRF_EXTBASE ===
Base of the external memory buffer.

The base of the transfer is calculated by adding [[#FALCON_DMATRF_POFF]] to the base.

=== FALCON_DMATRF_VOFF ===
For transfers to DMEM: the destination address.
For transfers to IMEM: the destination virtual IMEM page.

=== FALCON_DMATRF_POFF ===
For transfers to IMEM: the destination physical IMEM page.

=== FALCON_DMATRFCMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFCMD_FULL
|-
| 1
| FALCON_DMATRFCMD_IDLE
|-
| 2-3
| FALCON_DMATRFCMD_SEC
|-
| 4
| FALCON_DMATRFCMD_IMEM
|-
| 5
| FALCON_DMATRFCMD_WRITE
|-
| 8-10
| FALCON_DMATRFCMD_SIZE
|-
| 12-14
| FALCON_DMATRFCMD_CTXDMA
|}

Used for configuring DMA transfers.

=== FALCON_DMATRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFSTAT_PENDING
|-
| 16-18
| FALCON_DMATRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_DMATRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_CRYPTTRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| FALCON_CRYPTTRFSTAT_PENDING
|-
| 5
| FALCON_CRYPTTRFSTAT_ENABLED
|-
| 16-18
| FALCON_CRYPTTRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_CRYPTTRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_HWCFG2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_HWCFG2_VERSION
|-
| 4-5
| FALCON_HWCFG2_SCP_MODE
|-
| 6-7
| FALCON_HWCFG2_SUBVERSION
|-
| 8-11
| FALCON_HWCFG2_IMEM_PORTS
|-
| 12-15
| FALCON_HWCFG2_DMEM_PORTS
|-
| 16-19
| FALCON_HWCFG2_VM_PAGES_LOG2
|}

=== FALCON_ICD_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_ICD_CMD_OPC
0x0: BREAK
0x1: CONTINUE_FROM_PC
0x2: CONTINUE_FROM_ADDR
0x3: CONTINUE_UNK1_FROM_PC
0x4: CONTINUE_UNK1_FROM_ADDR
0x5: SINGLE_STEP_FROM_PC
0x6: SINGLE_STEP_FROM_ADDR
0x7: SET_BREAK_MASK
0x8: REG_READ
0x9: REG_WRITE
0xA: DATA_READ
0xB: DATA_WRITE
0xC: IO_READ
0xD: IO_WRITE
0xE: STATUS_READ
|-
| 6-7
| FALCON_ICD_CMD_DATA_SIZE
|-
| 8-12
| FALCON_ICD_CMD_IDX
|-
| 14
| FALCON_ICD_CMD_ERROR
|-
| 15
| FALCON_ICD_CMD_DONE
|-
| 16-31
| FALCON_ICD_CMD_BREAK_MASK
|}

=== FALCON_SCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| FALCON_SCTL_SEC_MODE
0: Non-secure
1: Light Secure
2: Heavy Secure
|}

=== TSEC_SCP_CTL_ACCESS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| Enable TSEC_SCP_INSN_STAT register
|}

=== TSEC_SCP_CTL_TRNG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 11
| Unknown
|-
| 12
| Enable the TRNG
|}

=== TSEC_SCP_CTL_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| TSEC_SCP_CTL_STAT_DEBUG_MODE
|}

=== TSEC_SCP_CTL_MODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Disable reads for the TRNG register block
|-
| 1
| Disable reads for the TFBIF register block
|-
| 2
| Disable reads for the DMA register block
|-
| 3
| Disable reads for the TEGRA register block
|-
| 4
| Disable writes for the TRNG register block
|-
| 5
| Disable writes for the TFBIF register block
|-
| 6
| Disable writes for the DMA register block
|-
| 7
| Disable writes for the TEGRA register block
|}

Controls accesses to the other sub-engines and can only be cleared in Heavy Secure mode.

=== TSEC_SCP_CTL_PKEY ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
|-
| 1
| TSEC_SCP_CTL_PKEY_LOADED
|}

=== TSEC_SCP_SEQ0_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 8-11
| Size of current cs0begin macro
|-
|}

=== TSEC_SCP_SEQ_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Set if crypto sequence recording (cs0begin/cs1begin) is active
|-
| 4-7
| Number of instructions left for the crypto sequence
|-
| 12-15
| Active crypto key register
|}

Contains information on the last crypto sequence (cs0 or cs1) executed.

=== TSEC_SCP_INSN_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| Crypto fuc5 destination register or immediate value
|-
| 8-15
| Crypto fuc5 source register or immediate value
|-
| 20-24
| Crypto fuc5 operation
0x0: none (fuc5 opcode 0x00)
0x1: cmov (fuc5 opcode 0x84)
0x2: cxsin (fuc5 opcode 0x88) or xdst (with cxset)
0x3: cxsout (fuc5 opcode 0x8C) or xdld (with cxset)
0x4: crng (fuc5 opcode 0x90)
0x5: cs0begin (fuc5 opcode 0x94)
0x6: cs0exec (fuc5 opcode 0x98)
0x7: cs1begin (fuc5 opcode 0x9C)
0x8: cs1exec (fuc5 opcode 0xA0)
0x9: invalid (fuc5 opcode 0xA4)
0xA: cchmod (fuc5 opcode 0xA8)
0xB: cxor (fuc5 opcode 0xAC)
0xC: cadd (fuc5 opcode 0xB0)
0xD: cand (fuc5 opcode 0xB4)
0xE: crev (fuc5 opcode 0xB8)
0xF: cprecmac (fuc5 opcode 0xBC)
0x10: csecret (fuc5 opcode 0xC0)
0x11: ckeyreg (fuc5 opcode 0xC4)
0x12: ckexp (fuc5 opcode 0xC8)
0x13: ckrexp (fuc5 opcode 0xCC)
0x14: cenc (fuc5 opcode 0xD0)
0x15: cdec (fuc5 opcode 0xD4)
0x16: csigauth (fuc5 opcode 0xD8)
0x17: csigenc (fuc5 opcode 0xDC)
0x18: csigclr (fuc5 opcode 0xE0)
|-
| 31
| Set if running in secure mode (cauth)
|}

Contains information on the last crypto instruction executed.

=== TSEC_SCP_AES_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-4
| First opcode
|-
| 5-9
| Second opcode
|-
| 15-16
| AES operation
0: Encryption
1: Decryption
2: Key expansion
3: Key reverse expansion
|}

Contains information on the last AES sequence executed.

=== TSEC_SCP_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQSTAT_TRNG
|-
| 8
| TSEC_SCP_IRQSTAT_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQSTAT_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQSTAT_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the status of crypto IRQs.

=== TSEC_SCP_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQMASK_TRNG
|-
| 8
| TSEC_SCP_IRQMASK_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQMASK_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQMASK_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the value of the mask for crypto IRQs.

=== TSEC_SCP_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Invalid instruction
|-
| 4
| Empty crypto sequence
|-
| 8
| Crypto sequence is too long
|-
| 12
| Crypto sequence was not finished
|-
| 16
| Invalid cauth signature (during csigenc, csigclr or csigunk)
|-
| 24
| Forbidden instruction
|}

Contains information on crypto errors generated by the [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT_INSN_ERROR]] IRQ.

=== TSEC_TFBIF_MCCIF_FIFOCTRL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
|-
| 1
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
|-
| 2
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
|-
| 3
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
|-
| 4
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
|-
| 5
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
|-
| 6
| TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
|-
| 7
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
|-
| 8
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE
|}

=== TSEC_MCCIF_FIFOCTRL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
|-
| 16-31
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT
|}

=== TSEC_TFBIF_UNK5 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.

=== TSEC_TFBIF_UNK6 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to (data_size << 4) before reading memory from the GPU UCODE carveout.

=== TSEC_DMA_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_DMA_CMD_READ
|-
| 1
| TSEC_DMA_CMD_WRITE
|-
| 4-7
| TSEC_DMA_CMD_UNK
|-
| 12
| TSEC_DMA_CMD_BUSY
|-
| 13
| TSEC_DMA_CMD_ERROR
|-
| 31
| TSEC_DMA_CMD_INIT
|}

A DMA read/write operation requires bits TSEC_DMA_CMD_INIT and TSEC_DMA_CMD_READ/TSEC_DMA_CMD_WRITE to be set in TSEC_DMA_CMD.

During the transfer, the TSEC_DMA_CMD_BUSY bit is set.

Accessing an invalid address causes bit TSEC_DMA_CMD_ERROR to be set.

=== TSEC_DMA_ADDR ===
Takes the address for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_VAL ===
Takes the value for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_UNK ===
Always 0xFFF.

=== TSEC_TEGRA_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 16
| TSEC_TEGRA_CTL_TKFI_KFUSE
|-
| 17
| TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
|-
| 24
| TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
|-
| 25
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
|-
| 26
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
|-
| 27
| TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C
|}

== Authenticated Mode ==
===== Entry =====
From non-secure mode, upon jumping to a page marked as secret, a secret fault occurs. This causes the CPU to verify the region specified in $cauth against the MAC loaded in $c6. If the comparison is successful, the valid bit (bit0) is set on all pages in the $cauth region, and $pc is set to the base of the $cauth region. If the comparsion fails, the CPU is halted.

===== Exit =====
The CPU automatically goes back to non-secure mode when returning back into non-secret pages. When this happens, the valid bit (bit0) in the TLB flags is cleared for all secret pages.

===== Implementation =====
Under certain circumstances, it is possible to observe [[#csigauth|csigauth]] being briefly written to [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]] as "csigauth $c4 $c6" while the opcodes in [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]] are set to "cxsin" and "csigauth", respectively.

Via [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]] it can be observed that a 3-sized macro sequence is loaded into cs0 during a secure mode transition.

== Crypto processing ==
Part of the information here (which hasn't made it into envytools documentation yet) was shared by [https://wiki.0x04.net/wiki/Marcin_Ko%C5%9Bcielnicki mwk] from reverse engineering falcon processors over the years.

=== cauth ===
$cauth is a special purpose register in the CPU.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7 || Start of region to authenticate (in 0x100 pages)
|-
| 8-15 || Unused
|-
| 16 || Use secret xfers (?)
|-
| 17 || Region is signed and encrypted and double the size (?)
|-
| 18 ||
|-
| 19 ||
|-
| 20-23 || Unused
|-
| 31-24 || Size of region to authenticate (in 0x100 pages)
|}

== SCP operations ==

{| class="wikitable" border="1"
! Opcode
! Name
! Operand0
! Operand1
! Operation
! Condition
|-
| 0 || || || || ||
|-
| 1 || mov || $cX || $cY || <code>$cX = $cY; ACL(X) = ACL(Y);</code> ||
|-
| 2 || sin || $cX || N/A || <code>$cX = read_stream(); ACL(X) = ???;</code> ||
|-
| 3 || sout || $cX || N/A || <code>write_stream($cX);</code> ||
|-
| 4 || rnd || $cX || N/A || <code>$cX = read_trng(); ACL(X) = ???;</code> ||
|-
| 5 || s0begin || immX || N/A || <code>record_macro_for_N_instructions(0, immX);</code> ||
|-
| 6 || s0exec || immX || N/A || <code>execute_macro_N_times(0, immX);</code> ||
|-
| 7 || s1begin || immX || N/A || <code>record_macro_for_N_instructions(1, immX);</code> ||
|-
| 8 || s1exec || immX || N/A || <code>execute_macro_N_times(1, immX);</code> ||
|-
| 9 || ? || || || ||
|-
| 0xA || chmod || $cX || immY || <code>ACL(X) &= immY;</code> ||
|-
| 0xB || xor || $cX || $cY || <code>$cX ^= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xC || add || $cX || immY || <code>$cX += immY;</code> || <code>(ACL(X) & 2)</code>
|-
| 0xD || and || $cX || $cY || <code>$cX &= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xE || rev || $cX || $cY || <code>$cX = reverse($cY); ACL(X) = ACL(Y) | 1;</code> || <code>(ACL(Y) & 2)</code>
|-
| 0xF || gfmul || $cX || $cY || <code>$cX = gfmul($cY); ACL(X) = ACL(Y) | 1;</code> || <code>(ACL(Y) & 2)</code>
|-
| 0x10 || secret || $cX || immY || <code>$cX = load_secret(immY); ACL(X) = load_secret_acl(immY);</code> ||
|-
| 0x11 || keyreg || immX || || <code>active_key_idx = immX;</code> ||
|-
| 0x12 || kexp || $cX || $cY || <code>$cX = aes_kexp($cY);</code> || <code>(ACL(Y) & 2)</code>
|-
| 0x13 || krexp || $cX || $cY || <code>$cX = aes_kexp_reverse($cY);</code> || <code>(ACL(Y) & 2)</code>
|-
| 0x14 || enc || $cX || $cY || <code>$cX = aes_enc(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 3) && (ACL(Y) & 2)</code>
|-
| 0x15 || dec || $cX || $cY || <code>$cX = aes_dec(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 3) && (ACL(Y) & 2)</code>
|-
| ...
|}

=== ACL ===
{| class="wikitable" border="1"
! Bit
! Meaning
|-
| 0 || Valid key
|-
| 1 || Valid data
|}

==== Initial values ====
On SCP boot, the ACL is 0x1F for all $cX.

Loading into $cX using xdst instruction sets ACL($cX) to 0x1F.

Spilling a $cX to DMEM using xdld instruction is allowed if (ACL($cX) & 2).

=== csigauth ===
<code>00000000: f5 3c XY d8 csigauth $cY $cX</code>

This instruction takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret.

=== csigclr ===
<code>00000000: f5 3c 00 e0 csigclr</code>

This instruction takes no operands and appears to clear the saved cauth signature used by the csigenc instruction.

=== cchmod ===
<code>00000000: f5 3c XY a8 cchmod $cY 0X</code> or <code>00000000: f5 3c XY a9 cchmod $cY 1X</code>

This instruction takes a crypto register and a 5 bit immediate value. It appears to set the [[#Register ACLs|crypto registers' ACL]] bits as follows:
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Allow register to be used as key in NS or LS mode
|-
| 1
| Allow register to be used as key in HS mode
|-
| 2
| Set register as readable in NS or LS mode
|-
| 3
| Set register as readable in HS mode
|-
| 4
| Set register as writable in NS or LS mode
|}

=== crng ===
<code>00000000: f5 3c 0X 90 crng $cX</code>

This instruction initializes a crypto register with random data.

Executing this instruction only succeeds if the TRNG is enabled for the SCP, which requires taking the following steps:
* Write 0x7FFF to TSEC_TRNG_CLKDIV.
* Write 0x3FF0000 to TSEC_TRNG_UNK0.
* Write 0xFF00 to TSEC_TRNG_UNK7.
* Write 0x1000 to [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]].

Otherwise it hangs forever.

=== cxset ===
cxset instruction provides a way to change behavior of a variable amount of successively executed DMA-related instructions.

for example: <code>000000de: f4 3c 02 cxset 0x2</code>

can be read as: <code>dma_override(type=crypto_reg, count=2)</code>

The argument to cxset specifies the type of behavior change in the top 3 bits, and the number of DMA-related instructions the effect lasts for in the lower 5 bits.

{| class=wikitable
! Bits || Description
|-
| 0-4 || Number of instructions it is valid for (0x1f is a special value meaning infinitely many instructions -- until overriden by another cxset)
|-
| 5 || Crypto destination/source select (0=crypto register, 1=crypto stream)
|-
| 6 || External memory override (0=Disabled, 1=Enabled)
|-
| 7 || Internal memory select (0=DMEM, 1=IMEM)
|}

==== DMA-Related Instructions ====
At least the following instructions may have changed behavior, and count against the cxset "count" argument: <code>xdwait</code>, <code>xdst</code>, <code>xdld</code>.

For example, if override type=0b000, then the "length" argument to <code>xdst</code> is instead treated as the index of the target $cX register.

=== Secrets ===
Falcon's Authenticated Mode has access to 64 128-bit keys which are burned at factory. These keys can be loaded by using the $csecret instruction which takes the target crypto register and the key index as arguments.

{| class=wikitable
! Index || Notes || Console-unique
|-
| 0x00 || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares. || No
|-
| 0x01 || Used by nvhost_nvdec_bl020_prod firmware. ||
|-
| 0x03 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x04 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x05 || Used by nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares. ||
|-
| 0x07 || Used by [6.0.0+] nvhost_tsec firmware. ||
|-
| 0x09 || Used by nvhost_tsec firmware. ||
|-
| 0x0B || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x0F || Used by nvhost_tsec firmware. ||
|-
| 0x10 || Used by [1.0.0-5.1.0] nvhost_tsec firmware. ||
|-
| 0x15 || Used by nvhost_nvdec_bl020_prod, [5.0.0+] nvhost_nvdec020_prod, [5.0.0+] nvhost_nvdec020_ns and [6.0.0+] nvhost_tsec firmwares. ||
|-
| 0x26 || Used by [[TSEC_Firmware#KeygenLdr|KeygenLdr]]. || No
|-
| 0x3C || Used by nvhost_tsec firmware. ||
|-
| 0x3F || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. || Yes
|}

TSEC

2019-01-06T09:28:50Z

Qlutoo: /* SCP operations */

TSEC (Tegra Security Co-processor) is a dedicated unit powered by a NVIDIA Falcon microprocessor with crypto extensions.

= Driver =
A host driver for communicating with the TSEC is mapped to physical address 0x54500000 with a total size of 0x40000 bytes and exposes several registers.

== Registers ==
Registers from 0x54500000 to 0x54501000 are used to configure the host interface (HOST1X).

Registers from 0x54501000 to 0x54502000 are a MMIO window for communicating with the Falcon microprocessor. From this range, the subset of registers from 0x54501400 to 0x54501FE8 are specific to the TSEC and are subdivided into:
* 0x54501400 to 0x54501500: SCP (Secure Crypto Processor?).
* 0x54501500 to 0x54501600: TRNG (True Random Number Generator).
* 0x54501600 to 0x54501700: TFBIF (Tegra Framebuffer Interface).
* 0x54501700 to 0x54501800: DMA.
* 0x54501800 to 0x54501900: TEGRA (miscellaneous interfaces).

{| class="wikitable" border="1"
! Name
! Address
! Width
|-
| TSEC_THI_INCR_SYNCPT
| 0x54500000
| 0x04
|-
| TSEC_THI_INCR_SYNCPT_ERR
| 0x54500008
| 0x04
|-
| TSEC_THI_CTXSW_INCR_SYNCPT
| 0x5450000C
| 0x04
|-
| TSEC_THI_CTXSW
| 0x54500020
| 0x04
|-
| TSEC_THI_CONT_SYNCPT_EOF
| 0x54500028
| 0x04
|-
| [[#TSEC_THI_METHOD0|TSEC_THI_METHOD0]]
| 0x54500040
| 0x04
|-
| [[#TSEC_THI_METHOD1|TSEC_THI_METHOD1]]
| 0x54500044
| 0x04
|-
| [[#TSEC_THI_INT_STATUS|TSEC_THI_INT_STATUS]]
| 0x54500078
| 0x04
|-
| [[#TSEC_THI_INT_MASK|TSEC_THI_INT_MASK]]
| 0x5450007C
| 0x04
|-
| TSEC_THI_SLCG_STATUS
| 0x54500084
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_HIGH_A
| 0x54500088
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_LOW_A
| 0x5450008C
| 0x04
|-
| TSEC_THI_CLK_OVERRIDE
| 0x54500E00
| 0x04
|-
| [[#FALCON_IRQSSET|FALCON_IRQSSET]]
| 0x54501000
| 0x04
|-
| [[#FALCON_IRQSCLR|FALCON_IRQSCLR]]
| 0x54501004
| 0x04
|-
| [[#FALCON_IRQSTAT|FALCON_IRQSTAT]]
| 0x54501008
| 0x04
|-
| [[#FALCON_IRQMODE|FALCON_IRQMODE]]
| 0x5450100C
| 0x04
|-
| [[#FALCON_IRQMSET|FALCON_IRQMSET]]
| 0x54501010
| 0x04
|-
| [[#FALCON_IRQMCLR|FALCON_IRQMCLR]]
| 0x54501014
| 0x04
|-
| [[#FALCON_IRQMASK|FALCON_IRQMASK]]
| 0x54501018
| 0x04
|-
| [[#FALCON_IRQDEST|FALCON_IRQDEST]]
| 0x5450101C
| 0x04
|-
| FALCON_GPTMR_PERIOD
| 0x54501020
| 0x04
|-
| FALCON_GPTMR_TIME
| 0x54501024
| 0x04
|-
| FALCON_GPTMR_ENABLE
| 0x54501028
| 0x04
|-
| FALCON_TIME_LOW
| 0x5450102C
| 0x04
|-
| FALCON_TIME_HIGH
| 0x54501030
| 0x04
|-
| FALCON_WDTMR_TIME
| 0x54501034
| 0x04
|-
| FALCON_WDTMR_ENABLE
| 0x54501038
| 0x04
|-
| [[#FALCON_SCRATCH0|FALCON_SCRATCH0]]
| 0x54501040
| 0x04
|-
| [[#FALCON_SCRATCH1|FALCON_SCRATCH1]]
| 0x54501044
| 0x04
|-
| [[#FALCON_ITFEN|FALCON_ITFEN]]
| 0x54501048
| 0x04
|-
| [[#FALCON_IDLESTATE|FALCON_IDLESTATE]]
| 0x5450104C
| 0x04
|-
| FALCON_CURCTX
| 0x54501050
| 0x04
|-
| FALCON_NXTCTX
| 0x54501054
| 0x04
|-
| FALCON_CMDCTX
| 0x54501058
| 0x04
|-
| FALCON_STATUS_MASK
| 0x5450105C
| 0x04
|-
| FALCON_VM_SUPERVISOR
| 0x54501060
| 0x04
|-
| FALCON_MTHD_DATA
| 0x54501064
| 0x04
|-
| FALCON_MTHD_CMD
| 0x54501068
| 0x04
|-
| FALCON_MTHD_DATA_WR
| 0x5450106C
| 0x04
|-
| FALCON_MTHD_OCCUPIED
| 0x54501070
| 0x04
|-
| FALCON_MTHD_ACK
| 0x54501074
| 0x04
|-
| FALCON_MTHD_LIMIT
| 0x54501078
| 0x04
|-
| FALCON_SUBENGINE_RESET
| 0x5450107C
| 0x04
|-
| FALCON_SCRATCH2
| 0x54501080
| 0x04
|-
| FALCON_SCRATCH3
| 0x54501084
| 0x04
|-
| FALCON_PM_TRIGGER
| 0x54501088
| 0x04
|-
| FALCON_PM_MODE
| 0x5450108C
| 0x04
|-
| FALCON_DEBUG1
| 0x54501090
| 0x04
|-
| [[#FALCON_DEBUGINFO|FALCON_DEBUGINFO]]
| 0x54501094
| 0x04
|-
| FALCON_BREAKPOINT0
| 0x54501098
| 0x04
|-
| FALCON_BREAKPOINT1
| 0x5450109C
| 0x04
|-
| FALCON_CGCTL
| 0x545010A0
| 0x04
|-
| FALCON_ENGCTL
| 0x545010A4
| 0x04
|-
| FALCON_PM_SEL
| 0x545010A8
| 0x04
|-
| FALCON_HOST_IO_INDEX
| 0x545010AC
| 0x04
|-
| [[#FALCON_EXCI|FALCON_EXCI]]
| 0x545010D0
| 0x04
|-
| [[#FALCON_CPUCTL|FALCON_CPUCTL]]
| 0x54501100
| 0x04
|-
| [[#FALCON_BOOTVEC|FALCON_BOOTVEC]]
| 0x54501104
| 0x04
|-
| [[#FALCON_HWCFG|FALCON_HWCFG]]
| 0x54501108
| 0x04
|-
| [[#FALCON_DMACTL|FALCON_DMACTL]]
| 0x5450110C
| 0x04
|-
| [[#FALCON_DMATRF_EXTBASE|FALCON_DMATRF_EXTBASE]]
| 0x54501110
| 0x04
|-
| [[#FALCON_DMATRF_VOFF|FALCON_DMATRF_VOFF]]
| 0x54501114
| 0x04
|-
| [[#FALCON_DMATRFCMD|FALCON_DMATRFCMD]]
| 0x54501118
| 0x04
|-
| [[#FALCON_DMATRF_POFF|FALCON_DMATRF_POFF]]
| 0x5450111C
| 0x04
|-
| [[#FALCON_DMATRFSTAT|FALCON_DMATRFSTAT]]
| 0x54501120
| 0x04
|-
| [[#FALCON_CRYPTTRFSTAT|FALCON_CRYPTTRFSTAT]]
| 0x54501124
| 0x04
|-
| FALCON_CPUSTAT
| 0x54501128
| 0x04
|-
| [[#FALCON_HWCFG2|FALCON_HWCFG2]]
| 0x5450112C
| 0x04
|-
| FALCON_CPUCTL_ALIAS
| 0x54501130
| 0x04
|-
| FALCON_TLB_CMD
| 0x54501140
| 0x04
|-
| FALCON_TLB_CMD_RES
| 0x54501144
| 0x04
|-
| FALCON_BRANCH_HISTORY_CTRL
| 0x54501148
| 0x04
|-
| FALCON_BRANCH_HISTORY_PC
| 0x5450114C
| 0x04
|-
| FALCON_IMFILLRNG0
| 0x54501150
| 0x04
|-
| FALCON_IMFILLRNG1
| 0x54501154
| 0x04
|-
| FALCON_IMFILLCTL
| 0x54501158
| 0x04
|-
| FALCON_EXTERRWIN
| 0x54501160
| 0x04
|-
| FALCON_EXTERRCFG
| 0x54501164
| 0x04
|-
| FALCON_EXTERRADDR
| 0x54501168
| 0x04
|-
| FALCON_EXTERRSTAT
| 0x5450116C
| 0x04
|-
| FALCON_CG2
| 0x5450117C
| 0x04
|-
| FALCON_CODE_INDEX
| 0x54501180
| 0x04
|-
| FALCON_CODE
| 0x54501184
| 0x04
|-
| FALCON_CODE_VIRT_ADDR
| 0x54501188
| 0x04
|-
| FALCON_DATA_INDEX0
| 0x545011C0
| 0x04
|-
| FALCON_DATA0
| 0x545011C4
| 0x04
|-
| FALCON_DATA_INDEX1
| 0x545011C8
| 0x04
|-
| FALCON_DATA1
| 0x545011CC
| 0x04
|-
| FALCON_DATA_INDEX2
| 0x545011D0
| 0x04
|-
| FALCON_DATA2
| 0x545011D4
| 0x04
|-
| FALCON_DATA_INDEX3
| 0x545011D8
| 0x04
|-
| FALCON_DATA3
| 0x545011DC
| 0x04
|-
| FALCON_DATA_INDEX4
| 0x545011E0
| 0x04
|-
| FALCON_DATA4
| 0x545011E4
| 0x04
|-
| FALCON_DATA_INDEX5
| 0x545011E8
| 0x04
|-
| FALCON_DATA5
| 0x545011EC
| 0x04
|-
| FALCON_DATA_INDEX6
| 0x545011F0
| 0x04
|-
| FALCON_DATA6
| 0x545011F4
| 0x04
|-
| FALCON_DATA_INDEX7
| 0x545011F8
| 0x04
|-
| FALCON_DATA7
| 0x545011FC
| 0x04
|-
| [[#FALCON_ICD_CMD|FALCON_ICD_CMD]]
| 0x54501200
| 0x04
|-
| FALCON_ICD_ADDR
| 0x54501204
| 0x04
|-
| FALCON_ICD_WDATA
| 0x54501208
| 0x04
|-
| FALCON_ICD_RDATA
| 0x5450120C
| 0x04
|-
| [[#FALCON_SCTL|FALCON_SCTL]]
| 0x54501240
| 0x04
|-
| [[#TSEC_SCP_CTL_ACCESS|TSEC_SCP_CTL_ACCESS]]
| 0x54501400
| 0x04
|-
| [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]]
| 0x54501404
| 0x04
|-
| [[#TSEC_SCP_CTL_STAT|TSEC_SCP_CTL_STAT]]
| 0x54501408
| 0x04
|-
| [[#TSEC_SCP_CTL_MODE|TSEC_SCP_CTL_MODE]]
| 0x5450140C
| 0x04
|-
| TSEC_SCP_UNK0
| 0x54501410
| 0x04
|-
| [[#TSEC_SCP_CTL_PKEY|TSEC_SCP_CTL_PKEY]]
| 0x54501418
| 0x04
|-
| [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]]
| 0x54501420
| 0x04
|-
| [[#TSEC_SCP_SEQ_STAT|TSEC_SCP_SEQ_STAT]]
| 0x54501428
| 0x04
|-
| [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]]
| 0x54501430
| 0x04
|-
| TSEC_SCP_UNK2
| 0x54501454
| 0x04
|-
| [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]]
| 0x54501458
| 0x04
|-
| TSEC_SCP_UNK3
| 0x54501470
| 0x04
|-
| [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT]]
| 0x54501480
| 0x04
|-
| [[#TSEC_SCP_IRQMASK|TSEC_SCP_IRQMASK]]
| 0x54501484
| 0x04
|-
| TSEC_SCP_UNK4
| 0x54501490
| 0x04
|-
| [[#TSEC_SCP_ERR|TSEC_SCP_ERR]]
| 0x54501498
| 0x04
|-
| TSEC_TRNG_CLKDIV
| 0x54501500
| 0x04
|-
| TSEC_TRNG_UNK0
| 0x54501504
| 0x04
|-
| TSEC_TRNG_UNK1
| 0x5450150C
| 0x04
|-
| TSEC_TRNG_UNK2
| 0x54501510
| 0x04
|-
| TSEC_TRNG_UNK3
| 0x54501514
| 0x04
|-
| TSEC_TRNG_UNK4
| 0x54501518
| 0x04
|-
| TSEC_TRNG_UNK5
| 0x5450151C
| 0x04
|-
| TSEC_TRNG_UNK6
| 0x54501528
| 0x04
|-
| TSEC_TRNG_UNK7
| 0x5450152C
| 0x04
|-
| TSEC_TFBIF_UNK0
| 0x54501600
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL|TSEC_TFBIF_MCCIF_FIFOCTRL]]
| 0x54501604
| 0x04
|-
| TSEC_TFBIF_UNK1
| 0x54501608
| 0x04
|-
| TSEC_TFBIF_UNK2
| 0x5450160C
| 0x04
|-
| TSEC_TFBIF_UNK3
| 0x54501630
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL1|TSEC_TFBIF_MCCIF_FIFOCTRL1]]
| 0x54501634
| 0x04
|-
| TSEC_TFBIF_UNK4
| 0x54501640
| 0x04
|-
| [[#TSEC_TFBIF_UNK5|TSEC_TFBIF_UNK5]]
| 0x54501644
| 0x04
|-
| [[#TSEC_TFBIF_UNK6|TSEC_TFBIF_UNK6]]
| 0x54501648
| 0x04
|-
| [[#TSEC_DMA_CMD|TSEC_DMA_CMD]]
| 0x54501700
| 0x04
|-
| [[#TSEC_DMA_ADDR|TSEC_DMA_ADDR]]
| 0x54501704
| 0x04
|-
| [[#TSEC_DMA_VAL|TSEC_DMA_VAL]]
| 0x54501708
| 0x04
|-
| [[#TSEC_DMA_UNK|TSEC_DMA_UNK]]
| 0x5450170C
| 0x04
|-
| TSEC_TEGRA_FALCON_IP_VER
| 0x54501800
| 0x04
|-
| TSEC_TEGRA_UNK0
| 0x54501824
| 0x04
|-
| TSEC_TEGRA_UNK1
| 0x54501828
| 0x04
|-
| TSEC_TEGRA_UNK2
| 0x5450182C
| 0x04
|-
| [[#TSEC_TEGRA_CTL|TSEC_TEGRA_CTL]]
| 0x54501838
| 0x04
|}

=== TSEC_THI_METHOD0 ===
{| class="wikitable" border="1"
! ID
! Method
|-
| 0x200
| SET_APPLICATION_ID
|-
| 0x300
| EXECUTE
|-
| 0x500
| HDCP_INIT
|-
| 0x504
| HDCP_CREATE_SESSION
|-
| 0x508
| HDCP_VERIFY_CERT_RX
|-
| 0x50C
| HDCP_GENERATE_EKM
|-
| 0x510
| HDCP_REVOCATION_CHECK
|-
| 0x514
| HDCP_VERIFY_HPRIME
|-
| 0x518
| HDCP_ENCRYPT_PAIRING_INFO
|-
| 0x51C
| HDCP_DECRYPT_PAIRING_INFO
|-
| 0x520
| HDCP_UPDATE_SESSION
|-
| 0x524
| HDCP_GENERATE_LC_INIT
|-
| 0x528
| HDCP_VERIFY_LPRIME
|-
| 0x52C
| HDCP_GENERATE_SKE_INIT
|-
| 0x530
| HDCP_VERIFY_VPRIME
|-
| 0x534
| HDCP_ENCRYPTION_RUN_CTRL
|-
| 0x538
| HDCP_SESSION_CTRL
|-
| 0x53C
| HDCP_COMPUTE_SPRIME
|-
| 0x540
| HDCP_GET_CERT_RX
|-
| 0x544
| HDCP_EXCHANGE_INFO
|-
| 0x548
| HDCP_DECRYPT_KM
|-
| 0x54C
| HDCP_GET_HPRIME
|-
| 0x550
| HDCP_GENERATE_EKH_KM
|-
| 0x554
| HDCP_VERIFY_RTT_CHALLENGE
|-
| 0x558
| HDCP_GET_LPRIME
|-
| 0x55C
| HDCP_DECRYPT_KS
|-
| 0x560
| HDCP_DECRYPT
|-
| 0x564
| HDCP_GET_RRX
|-
| 0x568
| HDCP_DECRYPT_REENCRYPT
|-
| 0x56C
|
|-
| 0x570
|
|-
| 0x574
|
|-
| 0x578
|
|-
| 0x57C
|
|-
| 0x700
| HDCP_VALIDATE_SRM
|-
| 0x704
| HDCP_VALIDATE_STREAM
|-
| 0x708
| HDCP_TEST_SECURE_STATUS
|-
| 0x70C
| HDCP_SET_DCP_KPUB
|-
| 0x710
| HDCP_SET_RX_KPUB
|-
| 0x714
| HDCP_SET_CERT_RX
|-
| 0x718
| HDCP_SET_SCRATCH_BUFFER
|-
| 0x71C
| HDCP_SET_SRM
|-
| 0x720
| HDCP_SET_RECEIVER_ID_LIST
|-
| 0x724
| HDCP_SET_SPRIME
|-
| 0x728
| HDCP_SET_ENC_INPUT_BUFFER
|-
| 0x72C
| HDCP_SET_ENC_OUTPUT_BUFFER
|-
| 0x730
| HDCP_GET_RTT_CHALLENGE
|-
| 0x734
| HDCP_STREAM_MANAGE
|-
| 0x738
| HDCP_READ_CAPS
|-
| 0x73C
| HDCP_ENCRYPT
|-
| 0x740
| [6.0.0+] HDCP_GET_CURRENT_NONCE
|}

Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_METHOD1 ===
Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_INT_STATUS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_STATUS_FALCON_INT
|}

=== TSEC_THI_INT_MASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_MASK_FALCON_INT
|}

=== FALCON_IRQSSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSSET_GPTMR
|-
| 1
| FALCON_IRQSSET_WDTMR
|-
| 2
| FALCON_IRQSSET_MTHD
|-
| 3
| FALCON_IRQSSET_CTXSW
|-
| 4
| FALCON_IRQSSET_HALT
|-
| 5
| FALCON_IRQSSET_EXTERR
|-
| 6
| FALCON_IRQSSET_SWGEN0
|-
| 7
| FALCON_IRQSSET_SWGEN1
|-
| 8-15
| FALCON_IRQSSET_EXT
|}

Used for setting Falcon's IRQs.

=== FALCON_IRQSCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSCLR_GPTMR
|-
| 1
| FALCON_IRQSCLR_WDTMR
|-
| 2
| FALCON_IRQSCLR_MTHD
|-
| 3
| FALCON_IRQSCLR_CTXSW
|-
| 4
| FALCON_IRQSCLR_HALT
|-
| 5
| FALCON_IRQSCLR_EXTERR
|-
| 6
| FALCON_IRQSCLR_SWGEN0
|-
| 7
| FALCON_IRQSCLR_SWGEN1
|-
| 8-15
| FALCON_IRQSCLR_EXT
|}

Used for clearing Falcon's IRQs.

=== FALCON_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSTAT_GPTMR
|-
| 1
| FALCON_IRQSTAT_WDTMR
|-
| 2
| FALCON_IRQSTAT_MTHD
|-
| 3
| FALCON_IRQSTAT_CTXSW
|-
| 4
| FALCON_IRQSTAT_HALT
|-
| 5
| FALCON_IRQSTAT_EXTERR
|-
| 6
| FALCON_IRQSTAT_SWGEN0
|-
| 7
| FALCON_IRQSTAT_SWGEN1
|-
| 8-15
| FALCON_IRQSTAT_EXT
|}

Used for getting the status of Falcon's IRQs.

=== FALCON_IRQMODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMODE_GPTMR
|-
| 1
| FALCON_IRQMODE_WDTMR
|-
| 2
| FALCON_IRQMODE_MTHD
|-
| 3
| FALCON_IRQMODE_CTXSW
|-
| 4
| FALCON_IRQMODE_HALT
|-
| 5
| FALCON_IRQMODE_EXTERR
|-
| 6
| FALCON_IRQMODE_SWGEN0
|-
| 7
| FALCON_IRQMODE_SWGEN1
|-
| 8-15
| FALCON_IRQMODE_EXT
|}

Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.

=== FALCON_IRQMSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMSET_GPTMR
|-
| 1
| FALCON_IRQMSET_WDTMR
|-
| 2
| FALCON_IRQMSET_MTHD
|-
| 3
| FALCON_IRQMSET_CTXSW
|-
| 4
| FALCON_IRQMSET_HALT
|-
| 5
| FALCON_IRQMSET_EXTERR
|-
| 6
| FALCON_IRQMSET_SWGEN0
|-
| 7
| FALCON_IRQMSET_SWGEN1
|-
| 8-15
| FALCON_IRQMSET_EXT
|}

Used for setting the mask for Falcon's IRQs.

=== FALCON_IRQMCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMCLR_GPTMR
|-
| 1
| FALCON_IRQMCLR_WDTMR
|-
| 2
| FALCON_IRQMCLR_MTHD
|-
| 3
| FALCON_IRQMCLR_CTXSW
|-
| 4
| FALCON_IRQMCLR_HALT
|-
| 5
| FALCON_IRQMCLR_EXTERR
|-
| 6
| FALCON_IRQMCLR_SWGEN0
|-
| 7
| FALCON_IRQMCLR_SWGEN1
|-
| 8-15
| FALCON_IRQMCLR_EXT
|}

Used for clearing the mask for Falcon's IRQs.

=== FALCON_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMASK_GPTMR
|-
| 1
| FALCON_IRQMASK_WDTMR
|-
| 2
| FALCON_IRQMASK_MTHD
|-
| 3
| FALCON_IRQMASK_CTXSW
|-
| 4
| FALCON_IRQMASK_HALT
|-
| 5
| FALCON_IRQMASK_EXTERR
|-
| 6
| FALCON_IRQMASK_SWGEN0
|-
| 7
| FALCON_IRQMASK_SWGEN1
|-
| 8-15
| FALCON_IRQMASK_EXT
|}

Used for getting the value of the mask for Falcon's IRQs.

=== FALCON_IRQDEST ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQDEST_HOST_GPTMR
|-
| 1
| FALCON_IRQDEST_HOST_WDTMR
|-
| 2
| FALCON_IRQDEST_HOST_MTHD
|-
| 3
| FALCON_IRQDEST_HOST_CTXSW
|-
| 4
| FALCON_IRQDEST_HOST_HALT
|-
| 5
| FALCON_IRQDEST_HOST_EXTERR
|-
| 6
| FALCON_IRQDEST_HOST_SWGEN0
|-
| 7
| FALCON_IRQDEST_HOST_SWGEN1
|-
| 8-15
| FALCON_IRQDEST_HOST_EXT
|-
| 16
| FALCON_IRQDEST_TARGET_GPTMR
|-
| 17
| FALCON_IRQDEST_TARGET_WDTMR
|-
| 18
| FALCON_IRQDEST_TARGET_MTHD
|-
| 19
| FALCON_IRQDEST_TARGET_CTXSW
|-
| 20
| FALCON_IRQDEST_TARGET_HALT
|-
| 21
| FALCON_IRQDEST_TARGET_EXTERR
|-
| 22
| FALCON_IRQDEST_TARGET_SWGEN0
|-
| 23
| FALCON_IRQDEST_TARGET_SWGEN1
|-
| 24-31
| FALCON_IRQDEST_TARGET_EXT
|}

Used for routing Falcon's IRQs.

=== FALCON_SCRATCH0 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_SCRATCH1 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_ITFEN ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_ITFEN_CTXEN
|-
| 1
| FALCON_ITFEN_MTHDEN
|}

Used for enabling/disabling Falcon interfaces.

=== FALCON_IDLESTATE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IDLESTATE_FALCON_BUSY
|-
| 1-15
| FALCON_IDLESTATE_EXT_BUSY
|}

Used for detecting if Falcon is busy or not.

=== FALCON_DEBUGINFO ===
Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.

[6.0.0+] [[NV_services|nvservices]] sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.

=== FALCON_EXCI ===
Contains information about raised exceptions.

=== FALCON_CPUCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_CPUCTL_IINVAL
|-
| 1
| FALCON_CPUCTL_STARTCPU
|-
| 2
| FALCON_CPUCTL_SRESET
|-
| 3
| FALCON_CPUCTL_HRESET
|-
| 4
| FALCON_CPUCTL_HALTED
|-
| 5
| FALCON_CPUCTL_STOPPED
|-
| 6
| FALCON_CPUCTL_SCP_UNK
|}

Used for signaling the Falcon CPU.

=== FALCON_BOOTVEC ===
Takes the Falcon's boot vector address.

=== FALCON_HWCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-8
| FALCON_HWCFG_IMEM_SIZE
|-
| 9-17
| FALCON_HWCFG_DMEM_SIZE
|-
| 18-25
| FALCON_HWCFG_MTHD_SIZE
|-
| 26-31
| FALCON_HWCFG_DMATRF_SLOTS
|}

=== FALCON_DMACTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMACTL_REQUIRE_CTX
|-
| 1
| FALCON_DMACTL_DMEM_SCRUBBING
|-
| 2
| FALCON_DMACTL_IMEM_SCRUBBING
|-
| 3-6
| FALCON_DMACTL_DMAQ_NUM
|-
| 7
| FALCON_DMACTL_SECURE_STAT
|}

Used for configuring the Falcon's DMA engine.

=== FALCON_DMATRF_EXTBASE ===
Base of the external memory buffer.

The base of the transfer is calculated by adding [[#FALCON_DMATRF_POFF]] to the base.

=== FALCON_DMATRF_VOFF ===
For transfers to DMEM: the destination address.
For transfers to IMEM: the destination virtual IMEM page.

=== FALCON_DMATRF_POFF ===
For transfers to IMEM: the destination physical IMEM page.

=== FALCON_DMATRFCMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFCMD_FULL
|-
| 1
| FALCON_DMATRFCMD_IDLE
|-
| 2-3
| FALCON_DMATRFCMD_SEC
|-
| 4
| FALCON_DMATRFCMD_IMEM
|-
| 5
| FALCON_DMATRFCMD_WRITE
|-
| 8-10
| FALCON_DMATRFCMD_SIZE
|-
| 12-14
| FALCON_DMATRFCMD_CTXDMA
|}

Used for configuring DMA transfers.

=== FALCON_DMATRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFSTAT_PENDING
|-
| 16-18
| FALCON_DMATRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_DMATRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_CRYPTTRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| FALCON_CRYPTTRFSTAT_PENDING
|-
| 5
| FALCON_CRYPTTRFSTAT_ENABLED
|-
| 16-18
| FALCON_CRYPTTRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_CRYPTTRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_HWCFG2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_HWCFG2_VERSION
|-
| 4-5
| FALCON_HWCFG2_SCP_MODE
|-
| 6-7
| FALCON_HWCFG2_SUBVERSION
|-
| 8-11
| FALCON_HWCFG2_IMEM_PORTS
|-
| 12-15
| FALCON_HWCFG2_DMEM_PORTS
|-
| 16-19
| FALCON_HWCFG2_VM_PAGES_LOG2
|}

=== FALCON_ICD_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_ICD_CMD_OPC
0x0: BREAK
0x1: CONTINUE_FROM_PC
0x2: CONTINUE_FROM_ADDR
0x3: CONTINUE_UNK1_FROM_PC
0x4: CONTINUE_UNK1_FROM_ADDR
0x5: SINGLE_STEP_FROM_PC
0x6: SINGLE_STEP_FROM_ADDR
0x7: SET_BREAK_MASK
0x8: REG_READ
0x9: REG_WRITE
0xA: DATA_READ
0xB: DATA_WRITE
0xC: IO_READ
0xD: IO_WRITE
0xE: STATUS_READ
|-
| 6-7
| FALCON_ICD_CMD_DATA_SIZE
|-
| 8-12
| FALCON_ICD_CMD_IDX
|-
| 14
| FALCON_ICD_CMD_ERROR
|-
| 15
| FALCON_ICD_CMD_DONE
|-
| 16-31
| FALCON_ICD_CMD_BREAK_MASK
|}

=== FALCON_SCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| FALCON_SCTL_SEC_MODE
0: Non-secure
1: Light Secure
2: Heavy Secure
|}

=== TSEC_SCP_CTL_ACCESS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| Enable TSEC_SCP_INSN_STAT register
|}

=== TSEC_SCP_CTL_TRNG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 11
| Unknown
|-
| 12
| Enable the TRNG
|}

=== TSEC_SCP_CTL_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| TSEC_SCP_CTL_STAT_DEBUG_MODE
|}

=== TSEC_SCP_CTL_MODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Disable reads for the TRNG register block
|-
| 1
| Disable reads for the TFBIF register block
|-
| 2
| Disable reads for the DMA register block
|-
| 3
| Disable reads for the TEGRA register block
|-
| 4
| Disable writes for the TRNG register block
|-
| 5
| Disable writes for the TFBIF register block
|-
| 6
| Disable writes for the DMA register block
|-
| 7
| Disable writes for the TEGRA register block
|}

Controls accesses to the other sub-engines and can only be cleared in Heavy Secure mode.

=== TSEC_SCP_CTL_PKEY ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
|-
| 1
| TSEC_SCP_CTL_PKEY_LOADED
|}

=== TSEC_SCP_SEQ0_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 8-11
| Size of current cs0begin macro
|-
|}

=== TSEC_SCP_SEQ_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Set if crypto sequence recording (cs0begin/cs1begin) is active
|-
| 4-7
| Number of instructions left for the crypto sequence
|-
| 12-15
| Active crypto key register
|}

Contains information on the last crypto sequence (cs0 or cs1) executed.

=== TSEC_SCP_INSN_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| Crypto fuc5 destination register or immediate value
|-
| 8-15
| Crypto fuc5 source register or immediate value
|-
| 20-24
| Crypto fuc5 operation
0x0: none (fuc5 opcode 0x00)
0x1: cmov (fuc5 opcode 0x84)
0x2: cxsin (fuc5 opcode 0x88) or xdst (with cxset)
0x3: cxsout (fuc5 opcode 0x8C) or xdld (with cxset)
0x4: crng (fuc5 opcode 0x90)
0x5: cs0begin (fuc5 opcode 0x94)
0x6: cs0exec (fuc5 opcode 0x98)
0x7: cs1begin (fuc5 opcode 0x9C)
0x8: cs1exec (fuc5 opcode 0xA0)
0x9: invalid (fuc5 opcode 0xA4)
0xA: cchmod (fuc5 opcode 0xA8)
0xB: cxor (fuc5 opcode 0xAC)
0xC: cadd (fuc5 opcode 0xB0)
0xD: cand (fuc5 opcode 0xB4)
0xE: crev (fuc5 opcode 0xB8)
0xF: cprecmac (fuc5 opcode 0xBC)
0x10: csecret (fuc5 opcode 0xC0)
0x11: ckeyreg (fuc5 opcode 0xC4)
0x12: ckexp (fuc5 opcode 0xC8)
0x13: ckrexp (fuc5 opcode 0xCC)
0x14: cenc (fuc5 opcode 0xD0)
0x15: cdec (fuc5 opcode 0xD4)
0x16: csigauth (fuc5 opcode 0xD8)
0x17: csigenc (fuc5 opcode 0xDC)
0x18: csigclr (fuc5 opcode 0xE0)
|-
| 31
| Set if running in secure mode (cauth)
|}

Contains information on the last crypto instruction executed.

=== TSEC_SCP_AES_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-4
| First opcode
|-
| 5-9
| Second opcode
|-
| 15-16
| AES operation
0: Encryption
1: Decryption
2: Key expansion
3: Key reverse expansion
|}

Contains information on the last AES sequence executed.

=== TSEC_SCP_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQSTAT_TRNG
|-
| 8
| TSEC_SCP_IRQSTAT_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQSTAT_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQSTAT_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the status of crypto IRQs.

=== TSEC_SCP_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQMASK_TRNG
|-
| 8
| TSEC_SCP_IRQMASK_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQMASK_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQMASK_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the value of the mask for crypto IRQs.

=== TSEC_SCP_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Invalid instruction
|-
| 4
| Empty crypto sequence
|-
| 8
| Crypto sequence is too long
|-
| 12
| Crypto sequence was not finished
|-
| 16
| Invalid cauth signature (during csigenc, csigclr or csigunk)
|-
| 24
| Forbidden instruction
|}

Contains information on crypto errors generated by the [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT_INSN_ERROR]] IRQ.

=== TSEC_TFBIF_MCCIF_FIFOCTRL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
|-
| 1
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
|-
| 2
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
|-
| 3
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
|-
| 4
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
|-
| 5
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
|-
| 6
| TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
|-
| 7
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
|-
| 8
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE
|}

=== TSEC_MCCIF_FIFOCTRL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
|-
| 16-31
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT
|}

=== TSEC_TFBIF_UNK5 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.

=== TSEC_TFBIF_UNK6 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to (data_size << 4) before reading memory from the GPU UCODE carveout.

=== TSEC_DMA_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_DMA_CMD_READ
|-
| 1
| TSEC_DMA_CMD_WRITE
|-
| 4-7
| TSEC_DMA_CMD_UNK
|-
| 12
| TSEC_DMA_CMD_BUSY
|-
| 13
| TSEC_DMA_CMD_ERROR
|-
| 31
| TSEC_DMA_CMD_INIT
|}

A DMA read/write operation requires bits TSEC_DMA_CMD_INIT and TSEC_DMA_CMD_READ/TSEC_DMA_CMD_WRITE to be set in TSEC_DMA_CMD.

During the transfer, the TSEC_DMA_CMD_BUSY bit is set.

Accessing an invalid address causes bit TSEC_DMA_CMD_ERROR to be set.

=== TSEC_DMA_ADDR ===
Takes the address for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_VAL ===
Takes the value for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_UNK ===
Always 0xFFF.

=== TSEC_TEGRA_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 16
| TSEC_TEGRA_CTL_TKFI_KFUSE
|-
| 17
| TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
|-
| 24
| TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
|-
| 25
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
|-
| 26
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
|-
| 27
| TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C
|}

== Authenticated Mode ==
===== Entry =====
From non-secure mode, upon jumping to a page marked as secret, a secret fault occurs. This causes the CPU to verify the region specified in $cauth against the MAC loaded in $c6. If the comparison is successful, the valid bit (bit0) is set on all pages in the $cauth region, and $pc is set to the base of the $cauth region. If the comparsion fails, the CPU is halted.

===== Exit =====
The CPU automatically goes back to non-secure mode when returning back into non-secret pages. When this happens, the valid bit (bit0) in the TLB flags is cleared for all secret pages.

===== Implementation =====
Under certain circumstances, it is possible to observe [[#csigauth|csigauth]] being briefly written to [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]] as "csigauth $c4 $c6" while the opcodes in [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]] are set to "cxsin" and "csigauth", respectively.

Via [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]] it can be observed that a 3-sized macro sequence is loaded into cs0 during a secure mode transition.

== Crypto processing ==
Part of the information here (which hasn't made it into envytools documentation yet) was shared by [https://wiki.0x04.net/wiki/Marcin_Ko%C5%9Bcielnicki mwk] from reverse engineering falcon processors over the years.

=== cauth ===
$cauth is a special purpose register in the CPU.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7 || Start of region to authenticate (in 0x100 pages)
|-
| 8-15 || Unused
|-
| 16 || Use secret xfers (?)
|-
| 17 || Region is signed and encrypted and double the size (?)
|-
| 18 ||
|-
| 19 ||
|-
| 20-23 || Unused
|-
| 31-24 || Size of region to authenticate (in 0x100 pages)
|}

== SCP operations ==

{| class="wikitable" border="1"
! Opcode
! Name
! Operand0
! Operand1
! Operation
! Condition
|-
| 0 || || || || ||
|-
| 1 || mov || $cX || $cY || <code>$cX = $cY; ACL(X) = ACL(Y);</code> ||
|-
| 2 || sin || $cX || N/A || <code>$cX = read_stream(); ACL(X) = ???;</code> ||
|-
| 3 || sout || $cX || N/A || <code>write_stream($cX);</code> ||
|-
| 4 || rnd || $cX || N/A || <code>$cX = read_trng(); ACL(X) = ???;</code> ||
|-
| 5 || s0begin || immX || N/A || <code>record_macro_for_N_instructions(0, immX);</code> ||
|-
| 6 || s0exec || immX || N/A || <code>execute_macro_N_times(0, immX);</code> ||
|-
| 7 || s1begin || immX || N/A || <code>record_macro_for_N_instructions(1, immX);</code> ||
|-
| 8 || s1exec || immX || N/A || <code>execute_macro_N_times(1, immX);</code> ||
|-
| 9 || ? || || || ||
|-
| 0xA || chmod || $cX || immY || <code>ACL(X) &= immY;</code> ||
|-
| 0xB || xor || $cX || $cY || <code>$cX ^= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xC || add || $cX || immY || <code>$cX += immY;</code> || <code>(ACL(X) & 2)</code>
|-
| 0xD || and || $cX || $cY || <code>$cX &= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xE || rev || $cX || $cY || <code>$cX = reverse($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0xF || pre_cmac || || || ? ||
|-
| 0x10 || secret || $cX || immY || <code>$cX = load_secret(immY); ACL(X) = load_secret_acl(immY);</code> ||
|-
| 0x11 || keyreg || immX || || <code>active_key_idx = immX;</code> ||
|-
| 0x12 || kexp || $cX || $cY || <code>$cX = aes_kexp($cY);</code> || <code>(ACL(Y) & 2)</code>
|-
| 0x13 || krexp || $cX || $cY || <code>$cX = aes_kexp_reverse($cY);</code> || <code>(ACL(Y) & 2)</code>
|-
| 0x14 || enc || $cX || $cY || <code>$cX = aes_enc(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 3) && (ACL(Y) & 2)</code>
|-
| 0x15 || dec || $cX || $cY || <code>$cX = aes_dec(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 3) && (ACL(Y) & 2)</code>
|-
| ...
|}

=== ACL ===
{| class="wikitable" border="1"
! Bit
! Meaning
|-
| 0 || Valid key
|-
| 1 || Valid data
|}

==== Initial values ====
On SCP boot, the ACL is 0x1F for all $cX.

Loading into $cX using xdst instruction sets ACL($cX) to 0x1F.

Spilling a $cX to DMEM using xdld instruction is allowed if (ACL($cX) & 2).

=== csigauth ===
<code>00000000: f5 3c XY d8 csigauth $cY $cX</code>

This instruction takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret.

=== csigclr ===
<code>00000000: f5 3c 00 e0 csigclr</code>

This instruction takes no operands and appears to clear the saved cauth signature used by the csigenc instruction.

=== cchmod ===
<code>00000000: f5 3c XY a8 cchmod $cY 0X</code> or <code>00000000: f5 3c XY a9 cchmod $cY 1X</code>

This instruction takes a crypto register and a 5 bit immediate value. It appears to set the [[#Register ACLs|crypto registers' ACL]] bits as follows:
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Allow register to be used as key in NS or LS mode
|-
| 1
| Allow register to be used as key in HS mode
|-
| 2
| Set register as readable in NS or LS mode
|-
| 3
| Set register as readable in HS mode
|-
| 4
| Set register as writable in NS or LS mode
|}

=== crng ===
<code>00000000: f5 3c 0X 90 crng $cX</code>

This instruction initializes a crypto register with random data.

Executing this instruction only succeeds if the TRNG is enabled for the SCP, which requires taking the following steps:
* Write 0x7FFF to TSEC_TRNG_CLKDIV.
* Write 0x3FF0000 to TSEC_TRNG_UNK0.
* Write 0xFF00 to TSEC_TRNG_UNK7.
* Write 0x1000 to [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]].

Otherwise it hangs forever.

=== cxset ===
cxset instruction provides a way to change behavior of a variable amount of successively executed DMA-related instructions.

for example: <code>000000de: f4 3c 02 cxset 0x2</code>

can be read as: <code>dma_override(type=crypto_reg, count=2)</code>

The argument to cxset specifies the type of behavior change in the top 3 bits, and the number of DMA-related instructions the effect lasts for in the lower 5 bits.

{| class=wikitable
! Bits || Description
|-
| 0-4 || Number of instructions it is valid for (0x1f is a special value meaning infinitely many instructions -- until overriden by another cxset)
|-
| 5 || Crypto destination/source select (0=crypto register, 1=crypto stream)
|-
| 6 || External memory override (0=Disabled, 1=Enabled)
|-
| 7 || Internal memory select (0=DMEM, 1=IMEM)
|}

==== DMA-Related Instructions ====
At least the following instructions may have changed behavior, and count against the cxset "count" argument: <code>xdwait</code>, <code>xdst</code>, <code>xdld</code>.

For example, if override type=0b000, then the "length" argument to <code>xdst</code> is instead treated as the index of the target $cX register.

=== Secrets ===
Falcon's Authenticated Mode has access to 64 128-bit keys which are burned at factory. These keys can be loaded by using the $csecret instruction which takes the target crypto register and the key index as arguments.

{| class=wikitable
! Index || Notes || Console-unique
|-
| 0x00 || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares. || No
|-
| 0x01 || Used by nvhost_nvdec_bl020_prod firmware. ||
|-
| 0x03 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x04 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x05 || Used by nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares. ||
|-
| 0x07 || Used by [6.0.0+] nvhost_tsec firmware. ||
|-
| 0x09 || Used by nvhost_tsec firmware. ||
|-
| 0x0B || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x0F || Used by nvhost_tsec firmware. ||
|-
| 0x10 || Used by [1.0.0-5.1.0] nvhost_tsec firmware. ||
|-
| 0x15 || Used by nvhost_nvdec_bl020_prod, [5.0.0+] nvhost_nvdec020_prod, [5.0.0+] nvhost_nvdec020_ns and [6.0.0+] nvhost_tsec firmwares. ||
|-
| 0x26 || Used by [[TSEC_Firmware#KeygenLdr|KeygenLdr]]. || No
|-
| 0x3C || Used by nvhost_tsec firmware. ||
|-
| 0x3F || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. || Yes
|}

TSEC

2019-01-06T09:27:07Z

Qlutoo: /* SCP operations */

TSEC (Tegra Security Co-processor) is a dedicated unit powered by a NVIDIA Falcon microprocessor with crypto extensions.

= Driver =
A host driver for communicating with the TSEC is mapped to physical address 0x54500000 with a total size of 0x40000 bytes and exposes several registers.

== Registers ==
Registers from 0x54500000 to 0x54501000 are used to configure the host interface (HOST1X).

Registers from 0x54501000 to 0x54502000 are a MMIO window for communicating with the Falcon microprocessor. From this range, the subset of registers from 0x54501400 to 0x54501FE8 are specific to the TSEC and are subdivided into:
* 0x54501400 to 0x54501500: SCP (Secure Crypto Processor?).
* 0x54501500 to 0x54501600: TRNG (True Random Number Generator).
* 0x54501600 to 0x54501700: TFBIF (Tegra Framebuffer Interface).
* 0x54501700 to 0x54501800: DMA.
* 0x54501800 to 0x54501900: TEGRA (miscellaneous interfaces).

{| class="wikitable" border="1"
! Name
! Address
! Width
|-
| TSEC_THI_INCR_SYNCPT
| 0x54500000
| 0x04
|-
| TSEC_THI_INCR_SYNCPT_ERR
| 0x54500008
| 0x04
|-
| TSEC_THI_CTXSW_INCR_SYNCPT
| 0x5450000C
| 0x04
|-
| TSEC_THI_CTXSW
| 0x54500020
| 0x04
|-
| TSEC_THI_CONT_SYNCPT_EOF
| 0x54500028
| 0x04
|-
| [[#TSEC_THI_METHOD0|TSEC_THI_METHOD0]]
| 0x54500040
| 0x04
|-
| [[#TSEC_THI_METHOD1|TSEC_THI_METHOD1]]
| 0x54500044
| 0x04
|-
| [[#TSEC_THI_INT_STATUS|TSEC_THI_INT_STATUS]]
| 0x54500078
| 0x04
|-
| [[#TSEC_THI_INT_MASK|TSEC_THI_INT_MASK]]
| 0x5450007C
| 0x04
|-
| TSEC_THI_SLCG_STATUS
| 0x54500084
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_HIGH_A
| 0x54500088
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_LOW_A
| 0x5450008C
| 0x04
|-
| TSEC_THI_CLK_OVERRIDE
| 0x54500E00
| 0x04
|-
| [[#FALCON_IRQSSET|FALCON_IRQSSET]]
| 0x54501000
| 0x04
|-
| [[#FALCON_IRQSCLR|FALCON_IRQSCLR]]
| 0x54501004
| 0x04
|-
| [[#FALCON_IRQSTAT|FALCON_IRQSTAT]]
| 0x54501008
| 0x04
|-
| [[#FALCON_IRQMODE|FALCON_IRQMODE]]
| 0x5450100C
| 0x04
|-
| [[#FALCON_IRQMSET|FALCON_IRQMSET]]
| 0x54501010
| 0x04
|-
| [[#FALCON_IRQMCLR|FALCON_IRQMCLR]]
| 0x54501014
| 0x04
|-
| [[#FALCON_IRQMASK|FALCON_IRQMASK]]
| 0x54501018
| 0x04
|-
| [[#FALCON_IRQDEST|FALCON_IRQDEST]]
| 0x5450101C
| 0x04
|-
| FALCON_GPTMR_PERIOD
| 0x54501020
| 0x04
|-
| FALCON_GPTMR_TIME
| 0x54501024
| 0x04
|-
| FALCON_GPTMR_ENABLE
| 0x54501028
| 0x04
|-
| FALCON_TIME_LOW
| 0x5450102C
| 0x04
|-
| FALCON_TIME_HIGH
| 0x54501030
| 0x04
|-
| FALCON_WDTMR_TIME
| 0x54501034
| 0x04
|-
| FALCON_WDTMR_ENABLE
| 0x54501038
| 0x04
|-
| [[#FALCON_SCRATCH0|FALCON_SCRATCH0]]
| 0x54501040
| 0x04
|-
| [[#FALCON_SCRATCH1|FALCON_SCRATCH1]]
| 0x54501044
| 0x04
|-
| [[#FALCON_ITFEN|FALCON_ITFEN]]
| 0x54501048
| 0x04
|-
| [[#FALCON_IDLESTATE|FALCON_IDLESTATE]]
| 0x5450104C
| 0x04
|-
| FALCON_CURCTX
| 0x54501050
| 0x04
|-
| FALCON_NXTCTX
| 0x54501054
| 0x04
|-
| FALCON_CMDCTX
| 0x54501058
| 0x04
|-
| FALCON_STATUS_MASK
| 0x5450105C
| 0x04
|-
| FALCON_VM_SUPERVISOR
| 0x54501060
| 0x04
|-
| FALCON_MTHD_DATA
| 0x54501064
| 0x04
|-
| FALCON_MTHD_CMD
| 0x54501068
| 0x04
|-
| FALCON_MTHD_DATA_WR
| 0x5450106C
| 0x04
|-
| FALCON_MTHD_OCCUPIED
| 0x54501070
| 0x04
|-
| FALCON_MTHD_ACK
| 0x54501074
| 0x04
|-
| FALCON_MTHD_LIMIT
| 0x54501078
| 0x04
|-
| FALCON_SUBENGINE_RESET
| 0x5450107C
| 0x04
|-
| FALCON_SCRATCH2
| 0x54501080
| 0x04
|-
| FALCON_SCRATCH3
| 0x54501084
| 0x04
|-
| FALCON_PM_TRIGGER
| 0x54501088
| 0x04
|-
| FALCON_PM_MODE
| 0x5450108C
| 0x04
|-
| FALCON_DEBUG1
| 0x54501090
| 0x04
|-
| [[#FALCON_DEBUGINFO|FALCON_DEBUGINFO]]
| 0x54501094
| 0x04
|-
| FALCON_BREAKPOINT0
| 0x54501098
| 0x04
|-
| FALCON_BREAKPOINT1
| 0x5450109C
| 0x04
|-
| FALCON_CGCTL
| 0x545010A0
| 0x04
|-
| FALCON_ENGCTL
| 0x545010A4
| 0x04
|-
| FALCON_PM_SEL
| 0x545010A8
| 0x04
|-
| FALCON_HOST_IO_INDEX
| 0x545010AC
| 0x04
|-
| [[#FALCON_EXCI|FALCON_EXCI]]
| 0x545010D0
| 0x04
|-
| [[#FALCON_CPUCTL|FALCON_CPUCTL]]
| 0x54501100
| 0x04
|-
| [[#FALCON_BOOTVEC|FALCON_BOOTVEC]]
| 0x54501104
| 0x04
|-
| [[#FALCON_HWCFG|FALCON_HWCFG]]
| 0x54501108
| 0x04
|-
| [[#FALCON_DMACTL|FALCON_DMACTL]]
| 0x5450110C
| 0x04
|-
| [[#FALCON_DMATRF_EXTBASE|FALCON_DMATRF_EXTBASE]]
| 0x54501110
| 0x04
|-
| [[#FALCON_DMATRF_VOFF|FALCON_DMATRF_VOFF]]
| 0x54501114
| 0x04
|-
| [[#FALCON_DMATRFCMD|FALCON_DMATRFCMD]]
| 0x54501118
| 0x04
|-
| [[#FALCON_DMATRF_POFF|FALCON_DMATRF_POFF]]
| 0x5450111C
| 0x04
|-
| [[#FALCON_DMATRFSTAT|FALCON_DMATRFSTAT]]
| 0x54501120
| 0x04
|-
| [[#FALCON_CRYPTTRFSTAT|FALCON_CRYPTTRFSTAT]]
| 0x54501124
| 0x04
|-
| FALCON_CPUSTAT
| 0x54501128
| 0x04
|-
| [[#FALCON_HWCFG2|FALCON_HWCFG2]]
| 0x5450112C
| 0x04
|-
| FALCON_CPUCTL_ALIAS
| 0x54501130
| 0x04
|-
| FALCON_TLB_CMD
| 0x54501140
| 0x04
|-
| FALCON_TLB_CMD_RES
| 0x54501144
| 0x04
|-
| FALCON_BRANCH_HISTORY_CTRL
| 0x54501148
| 0x04
|-
| FALCON_BRANCH_HISTORY_PC
| 0x5450114C
| 0x04
|-
| FALCON_IMFILLRNG0
| 0x54501150
| 0x04
|-
| FALCON_IMFILLRNG1
| 0x54501154
| 0x04
|-
| FALCON_IMFILLCTL
| 0x54501158
| 0x04
|-
| FALCON_EXTERRWIN
| 0x54501160
| 0x04
|-
| FALCON_EXTERRCFG
| 0x54501164
| 0x04
|-
| FALCON_EXTERRADDR
| 0x54501168
| 0x04
|-
| FALCON_EXTERRSTAT
| 0x5450116C
| 0x04
|-
| FALCON_CG2
| 0x5450117C
| 0x04
|-
| FALCON_CODE_INDEX
| 0x54501180
| 0x04
|-
| FALCON_CODE
| 0x54501184
| 0x04
|-
| FALCON_CODE_VIRT_ADDR
| 0x54501188
| 0x04
|-
| FALCON_DATA_INDEX0
| 0x545011C0
| 0x04
|-
| FALCON_DATA0
| 0x545011C4
| 0x04
|-
| FALCON_DATA_INDEX1
| 0x545011C8
| 0x04
|-
| FALCON_DATA1
| 0x545011CC
| 0x04
|-
| FALCON_DATA_INDEX2
| 0x545011D0
| 0x04
|-
| FALCON_DATA2
| 0x545011D4
| 0x04
|-
| FALCON_DATA_INDEX3
| 0x545011D8
| 0x04
|-
| FALCON_DATA3
| 0x545011DC
| 0x04
|-
| FALCON_DATA_INDEX4
| 0x545011E0
| 0x04
|-
| FALCON_DATA4
| 0x545011E4
| 0x04
|-
| FALCON_DATA_INDEX5
| 0x545011E8
| 0x04
|-
| FALCON_DATA5
| 0x545011EC
| 0x04
|-
| FALCON_DATA_INDEX6
| 0x545011F0
| 0x04
|-
| FALCON_DATA6
| 0x545011F4
| 0x04
|-
| FALCON_DATA_INDEX7
| 0x545011F8
| 0x04
|-
| FALCON_DATA7
| 0x545011FC
| 0x04
|-
| [[#FALCON_ICD_CMD|FALCON_ICD_CMD]]
| 0x54501200
| 0x04
|-
| FALCON_ICD_ADDR
| 0x54501204
| 0x04
|-
| FALCON_ICD_WDATA
| 0x54501208
| 0x04
|-
| FALCON_ICD_RDATA
| 0x5450120C
| 0x04
|-
| [[#FALCON_SCTL|FALCON_SCTL]]
| 0x54501240
| 0x04
|-
| [[#TSEC_SCP_CTL_ACCESS|TSEC_SCP_CTL_ACCESS]]
| 0x54501400
| 0x04
|-
| [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]]
| 0x54501404
| 0x04
|-
| [[#TSEC_SCP_CTL_STAT|TSEC_SCP_CTL_STAT]]
| 0x54501408
| 0x04
|-
| [[#TSEC_SCP_CTL_MODE|TSEC_SCP_CTL_MODE]]
| 0x5450140C
| 0x04
|-
| TSEC_SCP_UNK0
| 0x54501410
| 0x04
|-
| [[#TSEC_SCP_CTL_PKEY|TSEC_SCP_CTL_PKEY]]
| 0x54501418
| 0x04
|-
| [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]]
| 0x54501420
| 0x04
|-
| [[#TSEC_SCP_SEQ_STAT|TSEC_SCP_SEQ_STAT]]
| 0x54501428
| 0x04
|-
| [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]]
| 0x54501430
| 0x04
|-
| TSEC_SCP_UNK2
| 0x54501454
| 0x04
|-
| [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]]
| 0x54501458
| 0x04
|-
| TSEC_SCP_UNK3
| 0x54501470
| 0x04
|-
| [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT]]
| 0x54501480
| 0x04
|-
| [[#TSEC_SCP_IRQMASK|TSEC_SCP_IRQMASK]]
| 0x54501484
| 0x04
|-
| TSEC_SCP_UNK4
| 0x54501490
| 0x04
|-
| [[#TSEC_SCP_ERR|TSEC_SCP_ERR]]
| 0x54501498
| 0x04
|-
| TSEC_TRNG_CLKDIV
| 0x54501500
| 0x04
|-
| TSEC_TRNG_UNK0
| 0x54501504
| 0x04
|-
| TSEC_TRNG_UNK1
| 0x5450150C
| 0x04
|-
| TSEC_TRNG_UNK2
| 0x54501510
| 0x04
|-
| TSEC_TRNG_UNK3
| 0x54501514
| 0x04
|-
| TSEC_TRNG_UNK4
| 0x54501518
| 0x04
|-
| TSEC_TRNG_UNK5
| 0x5450151C
| 0x04
|-
| TSEC_TRNG_UNK6
| 0x54501528
| 0x04
|-
| TSEC_TRNG_UNK7
| 0x5450152C
| 0x04
|-
| TSEC_TFBIF_UNK0
| 0x54501600
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL|TSEC_TFBIF_MCCIF_FIFOCTRL]]
| 0x54501604
| 0x04
|-
| TSEC_TFBIF_UNK1
| 0x54501608
| 0x04
|-
| TSEC_TFBIF_UNK2
| 0x5450160C
| 0x04
|-
| TSEC_TFBIF_UNK3
| 0x54501630
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL1|TSEC_TFBIF_MCCIF_FIFOCTRL1]]
| 0x54501634
| 0x04
|-
| TSEC_TFBIF_UNK4
| 0x54501640
| 0x04
|-
| [[#TSEC_TFBIF_UNK5|TSEC_TFBIF_UNK5]]
| 0x54501644
| 0x04
|-
| [[#TSEC_TFBIF_UNK6|TSEC_TFBIF_UNK6]]
| 0x54501648
| 0x04
|-
| [[#TSEC_DMA_CMD|TSEC_DMA_CMD]]
| 0x54501700
| 0x04
|-
| [[#TSEC_DMA_ADDR|TSEC_DMA_ADDR]]
| 0x54501704
| 0x04
|-
| [[#TSEC_DMA_VAL|TSEC_DMA_VAL]]
| 0x54501708
| 0x04
|-
| [[#TSEC_DMA_UNK|TSEC_DMA_UNK]]
| 0x5450170C
| 0x04
|-
| TSEC_TEGRA_FALCON_IP_VER
| 0x54501800
| 0x04
|-
| TSEC_TEGRA_UNK0
| 0x54501824
| 0x04
|-
| TSEC_TEGRA_UNK1
| 0x54501828
| 0x04
|-
| TSEC_TEGRA_UNK2
| 0x5450182C
| 0x04
|-
| [[#TSEC_TEGRA_CTL|TSEC_TEGRA_CTL]]
| 0x54501838
| 0x04
|}

=== TSEC_THI_METHOD0 ===
{| class="wikitable" border="1"
! ID
! Method
|-
| 0x200
| SET_APPLICATION_ID
|-
| 0x300
| EXECUTE
|-
| 0x500
| HDCP_INIT
|-
| 0x504
| HDCP_CREATE_SESSION
|-
| 0x508
| HDCP_VERIFY_CERT_RX
|-
| 0x50C
| HDCP_GENERATE_EKM
|-
| 0x510
| HDCP_REVOCATION_CHECK
|-
| 0x514
| HDCP_VERIFY_HPRIME
|-
| 0x518
| HDCP_ENCRYPT_PAIRING_INFO
|-
| 0x51C
| HDCP_DECRYPT_PAIRING_INFO
|-
| 0x520
| HDCP_UPDATE_SESSION
|-
| 0x524
| HDCP_GENERATE_LC_INIT
|-
| 0x528
| HDCP_VERIFY_LPRIME
|-
| 0x52C
| HDCP_GENERATE_SKE_INIT
|-
| 0x530
| HDCP_VERIFY_VPRIME
|-
| 0x534
| HDCP_ENCRYPTION_RUN_CTRL
|-
| 0x538
| HDCP_SESSION_CTRL
|-
| 0x53C
| HDCP_COMPUTE_SPRIME
|-
| 0x540
| HDCP_GET_CERT_RX
|-
| 0x544
| HDCP_EXCHANGE_INFO
|-
| 0x548
| HDCP_DECRYPT_KM
|-
| 0x54C
| HDCP_GET_HPRIME
|-
| 0x550
| HDCP_GENERATE_EKH_KM
|-
| 0x554
| HDCP_VERIFY_RTT_CHALLENGE
|-
| 0x558
| HDCP_GET_LPRIME
|-
| 0x55C
| HDCP_DECRYPT_KS
|-
| 0x560
| HDCP_DECRYPT
|-
| 0x564
| HDCP_GET_RRX
|-
| 0x568
| HDCP_DECRYPT_REENCRYPT
|-
| 0x56C
|
|-
| 0x570
|
|-
| 0x574
|
|-
| 0x578
|
|-
| 0x57C
|
|-
| 0x700
| HDCP_VALIDATE_SRM
|-
| 0x704
| HDCP_VALIDATE_STREAM
|-
| 0x708
| HDCP_TEST_SECURE_STATUS
|-
| 0x70C
| HDCP_SET_DCP_KPUB
|-
| 0x710
| HDCP_SET_RX_KPUB
|-
| 0x714
| HDCP_SET_CERT_RX
|-
| 0x718
| HDCP_SET_SCRATCH_BUFFER
|-
| 0x71C
| HDCP_SET_SRM
|-
| 0x720
| HDCP_SET_RECEIVER_ID_LIST
|-
| 0x724
| HDCP_SET_SPRIME
|-
| 0x728
| HDCP_SET_ENC_INPUT_BUFFER
|-
| 0x72C
| HDCP_SET_ENC_OUTPUT_BUFFER
|-
| 0x730
| HDCP_GET_RTT_CHALLENGE
|-
| 0x734
| HDCP_STREAM_MANAGE
|-
| 0x738
| HDCP_READ_CAPS
|-
| 0x73C
| HDCP_ENCRYPT
|-
| 0x740
| [6.0.0+] HDCP_GET_CURRENT_NONCE
|}

Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_METHOD1 ===
Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_INT_STATUS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_STATUS_FALCON_INT
|}

=== TSEC_THI_INT_MASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_MASK_FALCON_INT
|}

=== FALCON_IRQSSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSSET_GPTMR
|-
| 1
| FALCON_IRQSSET_WDTMR
|-
| 2
| FALCON_IRQSSET_MTHD
|-
| 3
| FALCON_IRQSSET_CTXSW
|-
| 4
| FALCON_IRQSSET_HALT
|-
| 5
| FALCON_IRQSSET_EXTERR
|-
| 6
| FALCON_IRQSSET_SWGEN0
|-
| 7
| FALCON_IRQSSET_SWGEN1
|-
| 8-15
| FALCON_IRQSSET_EXT
|}

Used for setting Falcon's IRQs.

=== FALCON_IRQSCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSCLR_GPTMR
|-
| 1
| FALCON_IRQSCLR_WDTMR
|-
| 2
| FALCON_IRQSCLR_MTHD
|-
| 3
| FALCON_IRQSCLR_CTXSW
|-
| 4
| FALCON_IRQSCLR_HALT
|-
| 5
| FALCON_IRQSCLR_EXTERR
|-
| 6
| FALCON_IRQSCLR_SWGEN0
|-
| 7
| FALCON_IRQSCLR_SWGEN1
|-
| 8-15
| FALCON_IRQSCLR_EXT
|}

Used for clearing Falcon's IRQs.

=== FALCON_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSTAT_GPTMR
|-
| 1
| FALCON_IRQSTAT_WDTMR
|-
| 2
| FALCON_IRQSTAT_MTHD
|-
| 3
| FALCON_IRQSTAT_CTXSW
|-
| 4
| FALCON_IRQSTAT_HALT
|-
| 5
| FALCON_IRQSTAT_EXTERR
|-
| 6
| FALCON_IRQSTAT_SWGEN0
|-
| 7
| FALCON_IRQSTAT_SWGEN1
|-
| 8-15
| FALCON_IRQSTAT_EXT
|}

Used for getting the status of Falcon's IRQs.

=== FALCON_IRQMODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMODE_GPTMR
|-
| 1
| FALCON_IRQMODE_WDTMR
|-
| 2
| FALCON_IRQMODE_MTHD
|-
| 3
| FALCON_IRQMODE_CTXSW
|-
| 4
| FALCON_IRQMODE_HALT
|-
| 5
| FALCON_IRQMODE_EXTERR
|-
| 6
| FALCON_IRQMODE_SWGEN0
|-
| 7
| FALCON_IRQMODE_SWGEN1
|-
| 8-15
| FALCON_IRQMODE_EXT
|}

Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.

=== FALCON_IRQMSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMSET_GPTMR
|-
| 1
| FALCON_IRQMSET_WDTMR
|-
| 2
| FALCON_IRQMSET_MTHD
|-
| 3
| FALCON_IRQMSET_CTXSW
|-
| 4
| FALCON_IRQMSET_HALT
|-
| 5
| FALCON_IRQMSET_EXTERR
|-
| 6
| FALCON_IRQMSET_SWGEN0
|-
| 7
| FALCON_IRQMSET_SWGEN1
|-
| 8-15
| FALCON_IRQMSET_EXT
|}

Used for setting the mask for Falcon's IRQs.

=== FALCON_IRQMCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMCLR_GPTMR
|-
| 1
| FALCON_IRQMCLR_WDTMR
|-
| 2
| FALCON_IRQMCLR_MTHD
|-
| 3
| FALCON_IRQMCLR_CTXSW
|-
| 4
| FALCON_IRQMCLR_HALT
|-
| 5
| FALCON_IRQMCLR_EXTERR
|-
| 6
| FALCON_IRQMCLR_SWGEN0
|-
| 7
| FALCON_IRQMCLR_SWGEN1
|-
| 8-15
| FALCON_IRQMCLR_EXT
|}

Used for clearing the mask for Falcon's IRQs.

=== FALCON_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMASK_GPTMR
|-
| 1
| FALCON_IRQMASK_WDTMR
|-
| 2
| FALCON_IRQMASK_MTHD
|-
| 3
| FALCON_IRQMASK_CTXSW
|-
| 4
| FALCON_IRQMASK_HALT
|-
| 5
| FALCON_IRQMASK_EXTERR
|-
| 6
| FALCON_IRQMASK_SWGEN0
|-
| 7
| FALCON_IRQMASK_SWGEN1
|-
| 8-15
| FALCON_IRQMASK_EXT
|}

Used for getting the value of the mask for Falcon's IRQs.

=== FALCON_IRQDEST ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQDEST_HOST_GPTMR
|-
| 1
| FALCON_IRQDEST_HOST_WDTMR
|-
| 2
| FALCON_IRQDEST_HOST_MTHD
|-
| 3
| FALCON_IRQDEST_HOST_CTXSW
|-
| 4
| FALCON_IRQDEST_HOST_HALT
|-
| 5
| FALCON_IRQDEST_HOST_EXTERR
|-
| 6
| FALCON_IRQDEST_HOST_SWGEN0
|-
| 7
| FALCON_IRQDEST_HOST_SWGEN1
|-
| 8-15
| FALCON_IRQDEST_HOST_EXT
|-
| 16
| FALCON_IRQDEST_TARGET_GPTMR
|-
| 17
| FALCON_IRQDEST_TARGET_WDTMR
|-
| 18
| FALCON_IRQDEST_TARGET_MTHD
|-
| 19
| FALCON_IRQDEST_TARGET_CTXSW
|-
| 20
| FALCON_IRQDEST_TARGET_HALT
|-
| 21
| FALCON_IRQDEST_TARGET_EXTERR
|-
| 22
| FALCON_IRQDEST_TARGET_SWGEN0
|-
| 23
| FALCON_IRQDEST_TARGET_SWGEN1
|-
| 24-31
| FALCON_IRQDEST_TARGET_EXT
|}

Used for routing Falcon's IRQs.

=== FALCON_SCRATCH0 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_SCRATCH1 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_ITFEN ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_ITFEN_CTXEN
|-
| 1
| FALCON_ITFEN_MTHDEN
|}

Used for enabling/disabling Falcon interfaces.

=== FALCON_IDLESTATE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IDLESTATE_FALCON_BUSY
|-
| 1-15
| FALCON_IDLESTATE_EXT_BUSY
|}

Used for detecting if Falcon is busy or not.

=== FALCON_DEBUGINFO ===
Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.

[6.0.0+] [[NV_services|nvservices]] sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.

=== FALCON_EXCI ===
Contains information about raised exceptions.

=== FALCON_CPUCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_CPUCTL_IINVAL
|-
| 1
| FALCON_CPUCTL_STARTCPU
|-
| 2
| FALCON_CPUCTL_SRESET
|-
| 3
| FALCON_CPUCTL_HRESET
|-
| 4
| FALCON_CPUCTL_HALTED
|-
| 5
| FALCON_CPUCTL_STOPPED
|-
| 6
| FALCON_CPUCTL_SCP_UNK
|}

Used for signaling the Falcon CPU.

=== FALCON_BOOTVEC ===
Takes the Falcon's boot vector address.

=== FALCON_HWCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-8
| FALCON_HWCFG_IMEM_SIZE
|-
| 9-17
| FALCON_HWCFG_DMEM_SIZE
|-
| 18-25
| FALCON_HWCFG_MTHD_SIZE
|-
| 26-31
| FALCON_HWCFG_DMATRF_SLOTS
|}

=== FALCON_DMACTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMACTL_REQUIRE_CTX
|-
| 1
| FALCON_DMACTL_DMEM_SCRUBBING
|-
| 2
| FALCON_DMACTL_IMEM_SCRUBBING
|-
| 3-6
| FALCON_DMACTL_DMAQ_NUM
|-
| 7
| FALCON_DMACTL_SECURE_STAT
|}

Used for configuring the Falcon's DMA engine.

=== FALCON_DMATRF_EXTBASE ===
Base of the external memory buffer.

The base of the transfer is calculated by adding [[#FALCON_DMATRF_POFF]] to the base.

=== FALCON_DMATRF_VOFF ===
For transfers to DMEM: the destination address.
For transfers to IMEM: the destination virtual IMEM page.

=== FALCON_DMATRF_POFF ===
For transfers to IMEM: the destination physical IMEM page.

=== FALCON_DMATRFCMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFCMD_FULL
|-
| 1
| FALCON_DMATRFCMD_IDLE
|-
| 2-3
| FALCON_DMATRFCMD_SEC
|-
| 4
| FALCON_DMATRFCMD_IMEM
|-
| 5
| FALCON_DMATRFCMD_WRITE
|-
| 8-10
| FALCON_DMATRFCMD_SIZE
|-
| 12-14
| FALCON_DMATRFCMD_CTXDMA
|}

Used for configuring DMA transfers.

=== FALCON_DMATRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFSTAT_PENDING
|-
| 16-18
| FALCON_DMATRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_DMATRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_CRYPTTRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| FALCON_CRYPTTRFSTAT_PENDING
|-
| 5
| FALCON_CRYPTTRFSTAT_ENABLED
|-
| 16-18
| FALCON_CRYPTTRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_CRYPTTRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_HWCFG2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_HWCFG2_VERSION
|-
| 4-5
| FALCON_HWCFG2_SCP_MODE
|-
| 6-7
| FALCON_HWCFG2_SUBVERSION
|-
| 8-11
| FALCON_HWCFG2_IMEM_PORTS
|-
| 12-15
| FALCON_HWCFG2_DMEM_PORTS
|-
| 16-19
| FALCON_HWCFG2_VM_PAGES_LOG2
|}

=== FALCON_ICD_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_ICD_CMD_OPC
0x0: BREAK
0x1: CONTINUE_FROM_PC
0x2: CONTINUE_FROM_ADDR
0x3: CONTINUE_UNK1_FROM_PC
0x4: CONTINUE_UNK1_FROM_ADDR
0x5: SINGLE_STEP_FROM_PC
0x6: SINGLE_STEP_FROM_ADDR
0x7: SET_BREAK_MASK
0x8: REG_READ
0x9: REG_WRITE
0xA: DATA_READ
0xB: DATA_WRITE
0xC: IO_READ
0xD: IO_WRITE
0xE: STATUS_READ
|-
| 6-7
| FALCON_ICD_CMD_DATA_SIZE
|-
| 8-12
| FALCON_ICD_CMD_IDX
|-
| 14
| FALCON_ICD_CMD_ERROR
|-
| 15
| FALCON_ICD_CMD_DONE
|-
| 16-31
| FALCON_ICD_CMD_BREAK_MASK
|}

=== FALCON_SCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| FALCON_SCTL_SEC_MODE
0: Non-secure
1: Light Secure
2: Heavy Secure
|}

=== TSEC_SCP_CTL_ACCESS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| Enable TSEC_SCP_INSN_STAT register
|}

=== TSEC_SCP_CTL_TRNG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 11
| Unknown
|-
| 12
| Enable the TRNG
|}

=== TSEC_SCP_CTL_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| TSEC_SCP_CTL_STAT_DEBUG_MODE
|}

=== TSEC_SCP_CTL_MODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Disable reads for the TRNG register block
|-
| 1
| Disable reads for the TFBIF register block
|-
| 2
| Disable reads for the DMA register block
|-
| 3
| Disable reads for the TEGRA register block
|-
| 4
| Disable writes for the TRNG register block
|-
| 5
| Disable writes for the TFBIF register block
|-
| 6
| Disable writes for the DMA register block
|-
| 7
| Disable writes for the TEGRA register block
|}

Controls accesses to the other sub-engines and can only be cleared in Heavy Secure mode.

=== TSEC_SCP_CTL_PKEY ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
|-
| 1
| TSEC_SCP_CTL_PKEY_LOADED
|}

=== TSEC_SCP_SEQ0_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 8-11
| Size of current cs0begin macro
|-
|}

=== TSEC_SCP_SEQ_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Set if crypto sequence recording (cs0begin/cs1begin) is active
|-
| 4-7
| Number of instructions left for the crypto sequence
|-
| 12-15
| Active crypto key register
|}

Contains information on the last crypto sequence (cs0 or cs1) executed.

=== TSEC_SCP_INSN_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| Crypto fuc5 destination register or immediate value
|-
| 8-15
| Crypto fuc5 source register or immediate value
|-
| 20-24
| Crypto fuc5 operation
0x0: none (fuc5 opcode 0x00)
0x1: cmov (fuc5 opcode 0x84)
0x2: cxsin (fuc5 opcode 0x88) or xdst (with cxset)
0x3: cxsout (fuc5 opcode 0x8C) or xdld (with cxset)
0x4: crng (fuc5 opcode 0x90)
0x5: cs0begin (fuc5 opcode 0x94)
0x6: cs0exec (fuc5 opcode 0x98)
0x7: cs1begin (fuc5 opcode 0x9C)
0x8: cs1exec (fuc5 opcode 0xA0)
0x9: invalid (fuc5 opcode 0xA4)
0xA: cchmod (fuc5 opcode 0xA8)
0xB: cxor (fuc5 opcode 0xAC)
0xC: cadd (fuc5 opcode 0xB0)
0xD: cand (fuc5 opcode 0xB4)
0xE: crev (fuc5 opcode 0xB8)
0xF: cprecmac (fuc5 opcode 0xBC)
0x10: csecret (fuc5 opcode 0xC0)
0x11: ckeyreg (fuc5 opcode 0xC4)
0x12: ckexp (fuc5 opcode 0xC8)
0x13: ckrexp (fuc5 opcode 0xCC)
0x14: cenc (fuc5 opcode 0xD0)
0x15: cdec (fuc5 opcode 0xD4)
0x16: csigauth (fuc5 opcode 0xD8)
0x17: csigenc (fuc5 opcode 0xDC)
0x18: csigclr (fuc5 opcode 0xE0)
|-
| 31
| Set if running in secure mode (cauth)
|}

Contains information on the last crypto instruction executed.

=== TSEC_SCP_AES_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-4
| First opcode
|-
| 5-9
| Second opcode
|-
| 15-16
| AES operation
0: Encryption
1: Decryption
2: Key expansion
3: Key reverse expansion
|}

Contains information on the last AES sequence executed.

=== TSEC_SCP_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQSTAT_TRNG
|-
| 8
| TSEC_SCP_IRQSTAT_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQSTAT_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQSTAT_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the status of crypto IRQs.

=== TSEC_SCP_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQMASK_TRNG
|-
| 8
| TSEC_SCP_IRQMASK_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQMASK_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQMASK_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the value of the mask for crypto IRQs.

=== TSEC_SCP_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Invalid instruction
|-
| 4
| Empty crypto sequence
|-
| 8
| Crypto sequence is too long
|-
| 12
| Crypto sequence was not finished
|-
| 16
| Invalid cauth signature (during csigenc, csigclr or csigunk)
|-
| 24
| Forbidden instruction
|}

Contains information on crypto errors generated by the [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT_INSN_ERROR]] IRQ.

=== TSEC_TFBIF_MCCIF_FIFOCTRL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
|-
| 1
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
|-
| 2
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
|-
| 3
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
|-
| 4
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
|-
| 5
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
|-
| 6
| TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
|-
| 7
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
|-
| 8
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE
|}

=== TSEC_MCCIF_FIFOCTRL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
|-
| 16-31
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT
|}

=== TSEC_TFBIF_UNK5 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.

=== TSEC_TFBIF_UNK6 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to (data_size << 4) before reading memory from the GPU UCODE carveout.

=== TSEC_DMA_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_DMA_CMD_READ
|-
| 1
| TSEC_DMA_CMD_WRITE
|-
| 4-7
| TSEC_DMA_CMD_UNK
|-
| 12
| TSEC_DMA_CMD_BUSY
|-
| 13
| TSEC_DMA_CMD_ERROR
|-
| 31
| TSEC_DMA_CMD_INIT
|}

A DMA read/write operation requires bits TSEC_DMA_CMD_INIT and TSEC_DMA_CMD_READ/TSEC_DMA_CMD_WRITE to be set in TSEC_DMA_CMD.

During the transfer, the TSEC_DMA_CMD_BUSY bit is set.

Accessing an invalid address causes bit TSEC_DMA_CMD_ERROR to be set.

=== TSEC_DMA_ADDR ===
Takes the address for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_VAL ===
Takes the value for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_UNK ===
Always 0xFFF.

=== TSEC_TEGRA_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 16
| TSEC_TEGRA_CTL_TKFI_KFUSE
|-
| 17
| TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
|-
| 24
| TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
|-
| 25
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
|-
| 26
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
|-
| 27
| TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C
|}

== Authenticated Mode ==
===== Entry =====
From non-secure mode, upon jumping to a page marked as secret, a secret fault occurs. This causes the CPU to verify the region specified in $cauth against the MAC loaded in $c6. If the comparison is successful, the valid bit (bit0) is set on all pages in the $cauth region, and $pc is set to the base of the $cauth region. If the comparsion fails, the CPU is halted.

===== Exit =====
The CPU automatically goes back to non-secure mode when returning back into non-secret pages. When this happens, the valid bit (bit0) in the TLB flags is cleared for all secret pages.

===== Implementation =====
Under certain circumstances, it is possible to observe [[#csigauth|csigauth]] being briefly written to [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]] as "csigauth $c4 $c6" while the opcodes in [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]] are set to "cxsin" and "csigauth", respectively.

Via [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]] it can be observed that a 3-sized macro sequence is loaded into cs0 during a secure mode transition.

== Crypto processing ==
Part of the information here (which hasn't made it into envytools documentation yet) was shared by [https://wiki.0x04.net/wiki/Marcin_Ko%C5%9Bcielnicki mwk] from reverse engineering falcon processors over the years.

=== cauth ===
$cauth is a special purpose register in the CPU.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7 || Start of region to authenticate (in 0x100 pages)
|-
| 8-15 || Unused
|-
| 16 || Use secret xfers (?)
|-
| 17 || Region is signed and encrypted and double the size (?)
|-
| 18 ||
|-
| 19 ||
|-
| 20-23 || Unused
|-
| 31-24 || Size of region to authenticate (in 0x100 pages)
|}

== SCP operations ==

{| class="wikitable" border="1"
! Opcode
! Name
! Operand0
! Operand1
! Operation
! Condition
|-
| 0 || || || || ||
|-
| 1 || mov || $cX || $cY || <code>$cX = $cY; ACL($cX) = ACL($cY);</code> ||
|-
| 2 || sin || $cX || N/A || <code>$cX = read_stream(); ACL($cX) = ???;</code> ||
|-
| 3 || sout || $cX || N/A || <code>write_stream($cX);</code> ||
|-
| 4 || rnd || $cX || N/A || <code>$cX = read_trng(); ACL($cX) = ???;</code> ||
|-
| 5 || s0begin || immX || N/A || <code>record_macro_for_N_instructions(0, immX);</code> ||
|-
| 6 || s0exec || immX || N/A || <code>execute_macro_N_times(0, immX);</code> ||
|-
| 7 || s1begin || immX || N/A || <code>record_macro_for_N_instructions(1, immX);</code> ||
|-
| 8 || s1exec || immX || N/A || <code>execute_macro_N_times(1, immX);</code> ||
|-
| 9 || ? || || || ||
|-
| 0xA || chmod || $cX || immY || <code>ACL($cX) &= immY;</code> ||
|-
| 0xB || xor || $cX || $cY || <code>$cX ^= $cY;</code> || <code>(ACL($cX) & 2) && (ACL($cY) & 2)</code>
|-
| 0xC || add || $cX || immY || <code>$cX += immY;</code> || <code>(ACL($cX) & 2)</code>
|-
| 0xD || and || $cX || $cY || <code>$cX &= $cY;</code> || <code>(ACL($cX) & 2) && (ACL($cY) & 2)</code>
|-
| 0xE || rev || $cX || $cY || <code>$cX = reverse($cY); ACL($cX) = ACL($cY);</code> ||
|-
| 0xF || pre_cmac || || || ? ||
|-
| 0x10 || secret || $cX || immY || <code>$cX = load_secret(immY); ACL($cX) = load_secret_acl(immY);</code> ||
|-
| 0x11 || keyreg || immX || || <code>active_key_idx = immX;</code> ||
|-
| 0x12 || kexp || $cX || $cY || <code>$cX = aes_kexp($Y);</code> || <code>(ACL($cY) & 2)</code>
|-
| 0x13 || krexp || $cX || $cY || <code>$cX = aes_kexp_reverse($Y);</code> || <code>(ACL($cY) & 2)</code>
|-
| 0x14 || enc || $cX || $cY || <code>$cX = aes_enc(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 3) && (ACL($cY) & 2)</code>
|-
| 0x15 || dec || $cX || $cY || <code>$cX = aes_dec(active_key_idx, $cY);</code> || <code>(ACL(active_key_idx) & 3) && (ACL($cY) & 2)</code>
|-
| ...
|}

=== ACL ===
{| class="wikitable" border="1"
! Bit
! Meaning
|-
| 0 || Valid key
|-
| 1 || Valid data
|}

==== Initial values ====
On SCP boot, the ACL is 0x1F for all $cX.

Loading into $cX using xdst instruction sets ACL($cX) to 0x1F.

Spilling a $cX to DMEM using xdld instruction is allowed if (ACL($cX) & 2).

=== csigauth ===
<code>00000000: f5 3c XY d8 csigauth $cY $cX</code>

This instruction takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret.

=== csigclr ===
<code>00000000: f5 3c 00 e0 csigclr</code>

This instruction takes no operands and appears to clear the saved cauth signature used by the csigenc instruction.

=== cchmod ===
<code>00000000: f5 3c XY a8 cchmod $cY 0X</code> or <code>00000000: f5 3c XY a9 cchmod $cY 1X</code>

This instruction takes a crypto register and a 5 bit immediate value. It appears to set the [[#Register ACLs|crypto registers' ACL]] bits as follows:
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Allow register to be used as key in NS or LS mode
|-
| 1
| Allow register to be used as key in HS mode
|-
| 2
| Set register as readable in NS or LS mode
|-
| 3
| Set register as readable in HS mode
|-
| 4
| Set register as writable in NS or LS mode
|}

=== crng ===
<code>00000000: f5 3c 0X 90 crng $cX</code>

This instruction initializes a crypto register with random data.

Executing this instruction only succeeds if the TRNG is enabled for the SCP, which requires taking the following steps:
* Write 0x7FFF to TSEC_TRNG_CLKDIV.
* Write 0x3FF0000 to TSEC_TRNG_UNK0.
* Write 0xFF00 to TSEC_TRNG_UNK7.
* Write 0x1000 to [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]].

Otherwise it hangs forever.

=== cxset ===
cxset instruction provides a way to change behavior of a variable amount of successively executed DMA-related instructions.

for example: <code>000000de: f4 3c 02 cxset 0x2</code>

can be read as: <code>dma_override(type=crypto_reg, count=2)</code>

The argument to cxset specifies the type of behavior change in the top 3 bits, and the number of DMA-related instructions the effect lasts for in the lower 5 bits.

{| class=wikitable
! Bits || Description
|-
| 0-4 || Number of instructions it is valid for (0x1f is a special value meaning infinitely many instructions -- until overriden by another cxset)
|-
| 5 || Crypto destination/source select (0=crypto register, 1=crypto stream)
|-
| 6 || External memory override (0=Disabled, 1=Enabled)
|-
| 7 || Internal memory select (0=DMEM, 1=IMEM)
|}

==== DMA-Related Instructions ====
At least the following instructions may have changed behavior, and count against the cxset "count" argument: <code>xdwait</code>, <code>xdst</code>, <code>xdld</code>.

For example, if override type=0b000, then the "length" argument to <code>xdst</code> is instead treated as the index of the target $cX register.

=== Secrets ===
Falcon's Authenticated Mode has access to 64 128-bit keys which are burned at factory. These keys can be loaded by using the $csecret instruction which takes the target crypto register and the key index as arguments.

{| class=wikitable
! Index || Notes || Console-unique
|-
| 0x00 || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares. || No
|-
| 0x01 || Used by nvhost_nvdec_bl020_prod firmware. ||
|-
| 0x03 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x04 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x05 || Used by nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares. ||
|-
| 0x07 || Used by [6.0.0+] nvhost_tsec firmware. ||
|-
| 0x09 || Used by nvhost_tsec firmware. ||
|-
| 0x0B || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x0F || Used by nvhost_tsec firmware. ||
|-
| 0x10 || Used by [1.0.0-5.1.0] nvhost_tsec firmware. ||
|-
| 0x15 || Used by nvhost_nvdec_bl020_prod, [5.0.0+] nvhost_nvdec020_prod, [5.0.0+] nvhost_nvdec020_ns and [6.0.0+] nvhost_tsec firmwares. ||
|-
| 0x26 || Used by [[TSEC_Firmware#KeygenLdr|KeygenLdr]]. || No
|-
| 0x3C || Used by nvhost_tsec firmware. ||
|-
| 0x3F || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. || Yes
|}

TSEC

2019-01-06T09:16:23Z

Qlutoo: /* Authenticated Mode */

TSEC (Tegra Security Co-processor) is a dedicated unit powered by a NVIDIA Falcon microprocessor with crypto extensions.

= Driver =
A host driver for communicating with the TSEC is mapped to physical address 0x54500000 with a total size of 0x40000 bytes and exposes several registers.

== Registers ==
Registers from 0x54500000 to 0x54501000 are used to configure the host interface (HOST1X).

Registers from 0x54501000 to 0x54502000 are a MMIO window for communicating with the Falcon microprocessor. From this range, the subset of registers from 0x54501400 to 0x54501FE8 are specific to the TSEC and are subdivided into:
* 0x54501400 to 0x54501500: SCP (Secure Crypto Processor?).
* 0x54501500 to 0x54501600: TRNG (True Random Number Generator).
* 0x54501600 to 0x54501700: TFBIF (Tegra Framebuffer Interface).
* 0x54501700 to 0x54501800: DMA.
* 0x54501800 to 0x54501900: TEGRA (miscellaneous interfaces).

{| class="wikitable" border="1"
! Name
! Address
! Width
|-
| TSEC_THI_INCR_SYNCPT
| 0x54500000
| 0x04
|-
| TSEC_THI_INCR_SYNCPT_ERR
| 0x54500008
| 0x04
|-
| TSEC_THI_CTXSW_INCR_SYNCPT
| 0x5450000C
| 0x04
|-
| TSEC_THI_CTXSW
| 0x54500020
| 0x04
|-
| TSEC_THI_CONT_SYNCPT_EOF
| 0x54500028
| 0x04
|-
| [[#TSEC_THI_METHOD0|TSEC_THI_METHOD0]]
| 0x54500040
| 0x04
|-
| [[#TSEC_THI_METHOD1|TSEC_THI_METHOD1]]
| 0x54500044
| 0x04
|-
| [[#TSEC_THI_INT_STATUS|TSEC_THI_INT_STATUS]]
| 0x54500078
| 0x04
|-
| [[#TSEC_THI_INT_MASK|TSEC_THI_INT_MASK]]
| 0x5450007C
| 0x04
|-
| TSEC_THI_SLCG_STATUS
| 0x54500084
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_HIGH_A
| 0x54500088
| 0x04
|-
| TSEC_THI_SLCG_OVERRIDE_LOW_A
| 0x5450008C
| 0x04
|-
| TSEC_THI_CLK_OVERRIDE
| 0x54500E00
| 0x04
|-
| [[#FALCON_IRQSSET|FALCON_IRQSSET]]
| 0x54501000
| 0x04
|-
| [[#FALCON_IRQSCLR|FALCON_IRQSCLR]]
| 0x54501004
| 0x04
|-
| [[#FALCON_IRQSTAT|FALCON_IRQSTAT]]
| 0x54501008
| 0x04
|-
| [[#FALCON_IRQMODE|FALCON_IRQMODE]]
| 0x5450100C
| 0x04
|-
| [[#FALCON_IRQMSET|FALCON_IRQMSET]]
| 0x54501010
| 0x04
|-
| [[#FALCON_IRQMCLR|FALCON_IRQMCLR]]
| 0x54501014
| 0x04
|-
| [[#FALCON_IRQMASK|FALCON_IRQMASK]]
| 0x54501018
| 0x04
|-
| [[#FALCON_IRQDEST|FALCON_IRQDEST]]
| 0x5450101C
| 0x04
|-
| FALCON_GPTMR_PERIOD
| 0x54501020
| 0x04
|-
| FALCON_GPTMR_TIME
| 0x54501024
| 0x04
|-
| FALCON_GPTMR_ENABLE
| 0x54501028
| 0x04
|-
| FALCON_TIME_LOW
| 0x5450102C
| 0x04
|-
| FALCON_TIME_HIGH
| 0x54501030
| 0x04
|-
| FALCON_WDTMR_TIME
| 0x54501034
| 0x04
|-
| FALCON_WDTMR_ENABLE
| 0x54501038
| 0x04
|-
| [[#FALCON_SCRATCH0|FALCON_SCRATCH0]]
| 0x54501040
| 0x04
|-
| [[#FALCON_SCRATCH1|FALCON_SCRATCH1]]
| 0x54501044
| 0x04
|-
| [[#FALCON_ITFEN|FALCON_ITFEN]]
| 0x54501048
| 0x04
|-
| [[#FALCON_IDLESTATE|FALCON_IDLESTATE]]
| 0x5450104C
| 0x04
|-
| FALCON_CURCTX
| 0x54501050
| 0x04
|-
| FALCON_NXTCTX
| 0x54501054
| 0x04
|-
| FALCON_CMDCTX
| 0x54501058
| 0x04
|-
| FALCON_STATUS_MASK
| 0x5450105C
| 0x04
|-
| FALCON_VM_SUPERVISOR
| 0x54501060
| 0x04
|-
| FALCON_MTHD_DATA
| 0x54501064
| 0x04
|-
| FALCON_MTHD_CMD
| 0x54501068
| 0x04
|-
| FALCON_MTHD_DATA_WR
| 0x5450106C
| 0x04
|-
| FALCON_MTHD_OCCUPIED
| 0x54501070
| 0x04
|-
| FALCON_MTHD_ACK
| 0x54501074
| 0x04
|-
| FALCON_MTHD_LIMIT
| 0x54501078
| 0x04
|-
| FALCON_SUBENGINE_RESET
| 0x5450107C
| 0x04
|-
| FALCON_SCRATCH2
| 0x54501080
| 0x04
|-
| FALCON_SCRATCH3
| 0x54501084
| 0x04
|-
| FALCON_PM_TRIGGER
| 0x54501088
| 0x04
|-
| FALCON_PM_MODE
| 0x5450108C
| 0x04
|-
| FALCON_DEBUG1
| 0x54501090
| 0x04
|-
| [[#FALCON_DEBUGINFO|FALCON_DEBUGINFO]]
| 0x54501094
| 0x04
|-
| FALCON_BREAKPOINT0
| 0x54501098
| 0x04
|-
| FALCON_BREAKPOINT1
| 0x5450109C
| 0x04
|-
| FALCON_CGCTL
| 0x545010A0
| 0x04
|-
| FALCON_ENGCTL
| 0x545010A4
| 0x04
|-
| FALCON_PM_SEL
| 0x545010A8
| 0x04
|-
| FALCON_HOST_IO_INDEX
| 0x545010AC
| 0x04
|-
| [[#FALCON_EXCI|FALCON_EXCI]]
| 0x545010D0
| 0x04
|-
| [[#FALCON_CPUCTL|FALCON_CPUCTL]]
| 0x54501100
| 0x04
|-
| [[#FALCON_BOOTVEC|FALCON_BOOTVEC]]
| 0x54501104
| 0x04
|-
| [[#FALCON_HWCFG|FALCON_HWCFG]]
| 0x54501108
| 0x04
|-
| [[#FALCON_DMACTL|FALCON_DMACTL]]
| 0x5450110C
| 0x04
|-
| [[#FALCON_DMATRF_EXTBASE|FALCON_DMATRF_EXTBASE]]
| 0x54501110
| 0x04
|-
| [[#FALCON_DMATRF_VOFF|FALCON_DMATRF_VOFF]]
| 0x54501114
| 0x04
|-
| [[#FALCON_DMATRFCMD|FALCON_DMATRFCMD]]
| 0x54501118
| 0x04
|-
| [[#FALCON_DMATRF_POFF|FALCON_DMATRF_POFF]]
| 0x5450111C
| 0x04
|-
| [[#FALCON_DMATRFSTAT|FALCON_DMATRFSTAT]]
| 0x54501120
| 0x04
|-
| [[#FALCON_CRYPTTRFSTAT|FALCON_CRYPTTRFSTAT]]
| 0x54501124
| 0x04
|-
| FALCON_CPUSTAT
| 0x54501128
| 0x04
|-
| [[#FALCON_HWCFG2|FALCON_HWCFG2]]
| 0x5450112C
| 0x04
|-
| FALCON_CPUCTL_ALIAS
| 0x54501130
| 0x04
|-
| FALCON_TLB_CMD
| 0x54501140
| 0x04
|-
| FALCON_TLB_CMD_RES
| 0x54501144
| 0x04
|-
| FALCON_BRANCH_HISTORY_CTRL
| 0x54501148
| 0x04
|-
| FALCON_BRANCH_HISTORY_PC
| 0x5450114C
| 0x04
|-
| FALCON_IMFILLRNG0
| 0x54501150
| 0x04
|-
| FALCON_IMFILLRNG1
| 0x54501154
| 0x04
|-
| FALCON_IMFILLCTL
| 0x54501158
| 0x04
|-
| FALCON_EXTERRWIN
| 0x54501160
| 0x04
|-
| FALCON_EXTERRCFG
| 0x54501164
| 0x04
|-
| FALCON_EXTERRADDR
| 0x54501168
| 0x04
|-
| FALCON_EXTERRSTAT
| 0x5450116C
| 0x04
|-
| FALCON_CG2
| 0x5450117C
| 0x04
|-
| FALCON_CODE_INDEX
| 0x54501180
| 0x04
|-
| FALCON_CODE
| 0x54501184
| 0x04
|-
| FALCON_CODE_VIRT_ADDR
| 0x54501188
| 0x04
|-
| FALCON_DATA_INDEX0
| 0x545011C0
| 0x04
|-
| FALCON_DATA0
| 0x545011C4
| 0x04
|-
| FALCON_DATA_INDEX1
| 0x545011C8
| 0x04
|-
| FALCON_DATA1
| 0x545011CC
| 0x04
|-
| FALCON_DATA_INDEX2
| 0x545011D0
| 0x04
|-
| FALCON_DATA2
| 0x545011D4
| 0x04
|-
| FALCON_DATA_INDEX3
| 0x545011D8
| 0x04
|-
| FALCON_DATA3
| 0x545011DC
| 0x04
|-
| FALCON_DATA_INDEX4
| 0x545011E0
| 0x04
|-
| FALCON_DATA4
| 0x545011E4
| 0x04
|-
| FALCON_DATA_INDEX5
| 0x545011E8
| 0x04
|-
| FALCON_DATA5
| 0x545011EC
| 0x04
|-
| FALCON_DATA_INDEX6
| 0x545011F0
| 0x04
|-
| FALCON_DATA6
| 0x545011F4
| 0x04
|-
| FALCON_DATA_INDEX7
| 0x545011F8
| 0x04
|-
| FALCON_DATA7
| 0x545011FC
| 0x04
|-
| [[#FALCON_ICD_CMD|FALCON_ICD_CMD]]
| 0x54501200
| 0x04
|-
| FALCON_ICD_ADDR
| 0x54501204
| 0x04
|-
| FALCON_ICD_WDATA
| 0x54501208
| 0x04
|-
| FALCON_ICD_RDATA
| 0x5450120C
| 0x04
|-
| [[#FALCON_SCTL|FALCON_SCTL]]
| 0x54501240
| 0x04
|-
| [[#TSEC_SCP_CTL_ACCESS|TSEC_SCP_CTL_ACCESS]]
| 0x54501400
| 0x04
|-
| [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]]
| 0x54501404
| 0x04
|-
| [[#TSEC_SCP_CTL_STAT|TSEC_SCP_CTL_STAT]]
| 0x54501408
| 0x04
|-
| [[#TSEC_SCP_CTL_MODE|TSEC_SCP_CTL_MODE]]
| 0x5450140C
| 0x04
|-
| TSEC_SCP_UNK0
| 0x54501410
| 0x04
|-
| [[#TSEC_SCP_CTL_PKEY|TSEC_SCP_CTL_PKEY]]
| 0x54501418
| 0x04
|-
| [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]]
| 0x54501420
| 0x04
|-
| [[#TSEC_SCP_SEQ_STAT|TSEC_SCP_SEQ_STAT]]
| 0x54501428
| 0x04
|-
| [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]]
| 0x54501430
| 0x04
|-
| TSEC_SCP_UNK2
| 0x54501454
| 0x04
|-
| [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]]
| 0x54501458
| 0x04
|-
| TSEC_SCP_UNK3
| 0x54501470
| 0x04
|-
| [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT]]
| 0x54501480
| 0x04
|-
| [[#TSEC_SCP_IRQMASK|TSEC_SCP_IRQMASK]]
| 0x54501484
| 0x04
|-
| TSEC_SCP_UNK4
| 0x54501490
| 0x04
|-
| [[#TSEC_SCP_ERR|TSEC_SCP_ERR]]
| 0x54501498
| 0x04
|-
| TSEC_TRNG_CLKDIV
| 0x54501500
| 0x04
|-
| TSEC_TRNG_UNK0
| 0x54501504
| 0x04
|-
| TSEC_TRNG_UNK1
| 0x5450150C
| 0x04
|-
| TSEC_TRNG_UNK2
| 0x54501510
| 0x04
|-
| TSEC_TRNG_UNK3
| 0x54501514
| 0x04
|-
| TSEC_TRNG_UNK4
| 0x54501518
| 0x04
|-
| TSEC_TRNG_UNK5
| 0x5450151C
| 0x04
|-
| TSEC_TRNG_UNK6
| 0x54501528
| 0x04
|-
| TSEC_TRNG_UNK7
| 0x5450152C
| 0x04
|-
| TSEC_TFBIF_UNK0
| 0x54501600
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL|TSEC_TFBIF_MCCIF_FIFOCTRL]]
| 0x54501604
| 0x04
|-
| TSEC_TFBIF_UNK1
| 0x54501608
| 0x04
|-
| TSEC_TFBIF_UNK2
| 0x5450160C
| 0x04
|-
| TSEC_TFBIF_UNK3
| 0x54501630
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL1|TSEC_TFBIF_MCCIF_FIFOCTRL1]]
| 0x54501634
| 0x04
|-
| TSEC_TFBIF_UNK4
| 0x54501640
| 0x04
|-
| [[#TSEC_TFBIF_UNK5|TSEC_TFBIF_UNK5]]
| 0x54501644
| 0x04
|-
| [[#TSEC_TFBIF_UNK6|TSEC_TFBIF_UNK6]]
| 0x54501648
| 0x04
|-
| [[#TSEC_DMA_CMD|TSEC_DMA_CMD]]
| 0x54501700
| 0x04
|-
| [[#TSEC_DMA_ADDR|TSEC_DMA_ADDR]]
| 0x54501704
| 0x04
|-
| [[#TSEC_DMA_VAL|TSEC_DMA_VAL]]
| 0x54501708
| 0x04
|-
| [[#TSEC_DMA_UNK|TSEC_DMA_UNK]]
| 0x5450170C
| 0x04
|-
| TSEC_TEGRA_FALCON_IP_VER
| 0x54501800
| 0x04
|-
| TSEC_TEGRA_UNK0
| 0x54501824
| 0x04
|-
| TSEC_TEGRA_UNK1
| 0x54501828
| 0x04
|-
| TSEC_TEGRA_UNK2
| 0x5450182C
| 0x04
|-
| [[#TSEC_TEGRA_CTL|TSEC_TEGRA_CTL]]
| 0x54501838
| 0x04
|}

=== TSEC_THI_METHOD0 ===
{| class="wikitable" border="1"
! ID
! Method
|-
| 0x200
| SET_APPLICATION_ID
|-
| 0x300
| EXECUTE
|-
| 0x500
| HDCP_INIT
|-
| 0x504
| HDCP_CREATE_SESSION
|-
| 0x508
| HDCP_VERIFY_CERT_RX
|-
| 0x50C
| HDCP_GENERATE_EKM
|-
| 0x510
| HDCP_REVOCATION_CHECK
|-
| 0x514
| HDCP_VERIFY_HPRIME
|-
| 0x518
| HDCP_ENCRYPT_PAIRING_INFO
|-
| 0x51C
| HDCP_DECRYPT_PAIRING_INFO
|-
| 0x520
| HDCP_UPDATE_SESSION
|-
| 0x524
| HDCP_GENERATE_LC_INIT
|-
| 0x528
| HDCP_VERIFY_LPRIME
|-
| 0x52C
| HDCP_GENERATE_SKE_INIT
|-
| 0x530
| HDCP_VERIFY_VPRIME
|-
| 0x534
| HDCP_ENCRYPTION_RUN_CTRL
|-
| 0x538
| HDCP_SESSION_CTRL
|-
| 0x53C
| HDCP_COMPUTE_SPRIME
|-
| 0x540
| HDCP_GET_CERT_RX
|-
| 0x544
| HDCP_EXCHANGE_INFO
|-
| 0x548
| HDCP_DECRYPT_KM
|-
| 0x54C
| HDCP_GET_HPRIME
|-
| 0x550
| HDCP_GENERATE_EKH_KM
|-
| 0x554
| HDCP_VERIFY_RTT_CHALLENGE
|-
| 0x558
| HDCP_GET_LPRIME
|-
| 0x55C
| HDCP_DECRYPT_KS
|-
| 0x560
| HDCP_DECRYPT
|-
| 0x564
| HDCP_GET_RRX
|-
| 0x568
| HDCP_DECRYPT_REENCRYPT
|-
| 0x56C
|
|-
| 0x570
|
|-
| 0x574
|
|-
| 0x578
|
|-
| 0x57C
|
|-
| 0x700
| HDCP_VALIDATE_SRM
|-
| 0x704
| HDCP_VALIDATE_STREAM
|-
| 0x708
| HDCP_TEST_SECURE_STATUS
|-
| 0x70C
| HDCP_SET_DCP_KPUB
|-
| 0x710
| HDCP_SET_RX_KPUB
|-
| 0x714
| HDCP_SET_CERT_RX
|-
| 0x718
| HDCP_SET_SCRATCH_BUFFER
|-
| 0x71C
| HDCP_SET_SRM
|-
| 0x720
| HDCP_SET_RECEIVER_ID_LIST
|-
| 0x724
| HDCP_SET_SPRIME
|-
| 0x728
| HDCP_SET_ENC_INPUT_BUFFER
|-
| 0x72C
| HDCP_SET_ENC_OUTPUT_BUFFER
|-
| 0x730
| HDCP_GET_RTT_CHALLENGE
|-
| 0x734
| HDCP_STREAM_MANAGE
|-
| 0x738
| HDCP_READ_CAPS
|-
| 0x73C
| HDCP_ENCRYPT
|-
| 0x740
| [6.0.0+] HDCP_GET_CURRENT_NONCE
|}

Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_METHOD1 ===
Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_INT_STATUS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_STATUS_FALCON_INT
|}

=== TSEC_THI_INT_MASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_MASK_FALCON_INT
|}

=== FALCON_IRQSSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSSET_GPTMR
|-
| 1
| FALCON_IRQSSET_WDTMR
|-
| 2
| FALCON_IRQSSET_MTHD
|-
| 3
| FALCON_IRQSSET_CTXSW
|-
| 4
| FALCON_IRQSSET_HALT
|-
| 5
| FALCON_IRQSSET_EXTERR
|-
| 6
| FALCON_IRQSSET_SWGEN0
|-
| 7
| FALCON_IRQSSET_SWGEN1
|-
| 8-15
| FALCON_IRQSSET_EXT
|}

Used for setting Falcon's IRQs.

=== FALCON_IRQSCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSCLR_GPTMR
|-
| 1
| FALCON_IRQSCLR_WDTMR
|-
| 2
| FALCON_IRQSCLR_MTHD
|-
| 3
| FALCON_IRQSCLR_CTXSW
|-
| 4
| FALCON_IRQSCLR_HALT
|-
| 5
| FALCON_IRQSCLR_EXTERR
|-
| 6
| FALCON_IRQSCLR_SWGEN0
|-
| 7
| FALCON_IRQSCLR_SWGEN1
|-
| 8-15
| FALCON_IRQSCLR_EXT
|}

Used for clearing Falcon's IRQs.

=== FALCON_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQSTAT_GPTMR
|-
| 1
| FALCON_IRQSTAT_WDTMR
|-
| 2
| FALCON_IRQSTAT_MTHD
|-
| 3
| FALCON_IRQSTAT_CTXSW
|-
| 4
| FALCON_IRQSTAT_HALT
|-
| 5
| FALCON_IRQSTAT_EXTERR
|-
| 6
| FALCON_IRQSTAT_SWGEN0
|-
| 7
| FALCON_IRQSTAT_SWGEN1
|-
| 8-15
| FALCON_IRQSTAT_EXT
|}

Used for getting the status of Falcon's IRQs.

=== FALCON_IRQMODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMODE_GPTMR
|-
| 1
| FALCON_IRQMODE_WDTMR
|-
| 2
| FALCON_IRQMODE_MTHD
|-
| 3
| FALCON_IRQMODE_CTXSW
|-
| 4
| FALCON_IRQMODE_HALT
|-
| 5
| FALCON_IRQMODE_EXTERR
|-
| 6
| FALCON_IRQMODE_SWGEN0
|-
| 7
| FALCON_IRQMODE_SWGEN1
|-
| 8-15
| FALCON_IRQMODE_EXT
|}

Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.

=== FALCON_IRQMSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMSET_GPTMR
|-
| 1
| FALCON_IRQMSET_WDTMR
|-
| 2
| FALCON_IRQMSET_MTHD
|-
| 3
| FALCON_IRQMSET_CTXSW
|-
| 4
| FALCON_IRQMSET_HALT
|-
| 5
| FALCON_IRQMSET_EXTERR
|-
| 6
| FALCON_IRQMSET_SWGEN0
|-
| 7
| FALCON_IRQMSET_SWGEN1
|-
| 8-15
| FALCON_IRQMSET_EXT
|}

Used for setting the mask for Falcon's IRQs.

=== FALCON_IRQMCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMCLR_GPTMR
|-
| 1
| FALCON_IRQMCLR_WDTMR
|-
| 2
| FALCON_IRQMCLR_MTHD
|-
| 3
| FALCON_IRQMCLR_CTXSW
|-
| 4
| FALCON_IRQMCLR_HALT
|-
| 5
| FALCON_IRQMCLR_EXTERR
|-
| 6
| FALCON_IRQMCLR_SWGEN0
|-
| 7
| FALCON_IRQMCLR_SWGEN1
|-
| 8-15
| FALCON_IRQMCLR_EXT
|}

Used for clearing the mask for Falcon's IRQs.

=== FALCON_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQMASK_GPTMR
|-
| 1
| FALCON_IRQMASK_WDTMR
|-
| 2
| FALCON_IRQMASK_MTHD
|-
| 3
| FALCON_IRQMASK_CTXSW
|-
| 4
| FALCON_IRQMASK_HALT
|-
| 5
| FALCON_IRQMASK_EXTERR
|-
| 6
| FALCON_IRQMASK_SWGEN0
|-
| 7
| FALCON_IRQMASK_SWGEN1
|-
| 8-15
| FALCON_IRQMASK_EXT
|}

Used for getting the value of the mask for Falcon's IRQs.

=== FALCON_IRQDEST ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IRQDEST_HOST_GPTMR
|-
| 1
| FALCON_IRQDEST_HOST_WDTMR
|-
| 2
| FALCON_IRQDEST_HOST_MTHD
|-
| 3
| FALCON_IRQDEST_HOST_CTXSW
|-
| 4
| FALCON_IRQDEST_HOST_HALT
|-
| 5
| FALCON_IRQDEST_HOST_EXTERR
|-
| 6
| FALCON_IRQDEST_HOST_SWGEN0
|-
| 7
| FALCON_IRQDEST_HOST_SWGEN1
|-
| 8-15
| FALCON_IRQDEST_HOST_EXT
|-
| 16
| FALCON_IRQDEST_TARGET_GPTMR
|-
| 17
| FALCON_IRQDEST_TARGET_WDTMR
|-
| 18
| FALCON_IRQDEST_TARGET_MTHD
|-
| 19
| FALCON_IRQDEST_TARGET_CTXSW
|-
| 20
| FALCON_IRQDEST_TARGET_HALT
|-
| 21
| FALCON_IRQDEST_TARGET_EXTERR
|-
| 22
| FALCON_IRQDEST_TARGET_SWGEN0
|-
| 23
| FALCON_IRQDEST_TARGET_SWGEN1
|-
| 24-31
| FALCON_IRQDEST_TARGET_EXT
|}

Used for routing Falcon's IRQs.

=== FALCON_SCRATCH0 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_SCRATCH1 ===
Scratch register for reading/writing data to Falcon.

=== FALCON_ITFEN ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_ITFEN_CTXEN
|-
| 1
| FALCON_ITFEN_MTHDEN
|}

Used for enabling/disabling Falcon interfaces.

=== FALCON_IDLESTATE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_IDLESTATE_FALCON_BUSY
|-
| 1-15
| FALCON_IDLESTATE_EXT_BUSY
|}

Used for detecting if Falcon is busy or not.

=== FALCON_DEBUGINFO ===
Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.

[6.0.0+] [[NV_services|nvservices]] sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.

=== FALCON_EXCI ===
Contains information about raised exceptions.

=== FALCON_CPUCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_CPUCTL_IINVAL
|-
| 1
| FALCON_CPUCTL_STARTCPU
|-
| 2
| FALCON_CPUCTL_SRESET
|-
| 3
| FALCON_CPUCTL_HRESET
|-
| 4
| FALCON_CPUCTL_HALTED
|-
| 5
| FALCON_CPUCTL_STOPPED
|-
| 6
| FALCON_CPUCTL_SCP_UNK
|}

Used for signaling the Falcon CPU.

=== FALCON_BOOTVEC ===
Takes the Falcon's boot vector address.

=== FALCON_HWCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-8
| FALCON_HWCFG_IMEM_SIZE
|-
| 9-17
| FALCON_HWCFG_DMEM_SIZE
|-
| 18-25
| FALCON_HWCFG_MTHD_SIZE
|-
| 26-31
| FALCON_HWCFG_DMATRF_SLOTS
|}

=== FALCON_DMACTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMACTL_REQUIRE_CTX
|-
| 1
| FALCON_DMACTL_DMEM_SCRUBBING
|-
| 2
| FALCON_DMACTL_IMEM_SCRUBBING
|-
| 3-6
| FALCON_DMACTL_DMAQ_NUM
|-
| 7
| FALCON_DMACTL_SECURE_STAT
|}

Used for configuring the Falcon's DMA engine.

=== FALCON_DMATRF_EXTBASE ===
Base of the external memory buffer.

The base of the transfer is calculated by adding [[#FALCON_DMATRF_POFF]] to the base.

=== FALCON_DMATRF_VOFF ===
For transfers to DMEM: the destination address.
For transfers to IMEM: the destination virtual IMEM page.

=== FALCON_DMATRF_POFF ===
For transfers to IMEM: the destination physical IMEM page.

=== FALCON_DMATRFCMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFCMD_FULL
|-
| 1
| FALCON_DMATRFCMD_IDLE
|-
| 2-3
| FALCON_DMATRFCMD_SEC
|-
| 4
| FALCON_DMATRFCMD_IMEM
|-
| 5
| FALCON_DMATRFCMD_WRITE
|-
| 8-10
| FALCON_DMATRFCMD_SIZE
|-
| 12-14
| FALCON_DMATRFCMD_CTXDMA
|}

Used for configuring DMA transfers.

=== FALCON_DMATRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FALCON_DMATRFSTAT_PENDING
|-
| 16-18
| FALCON_DMATRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_DMATRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_CRYPTTRFSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| FALCON_CRYPTTRFSTAT_PENDING
|-
| 5
| FALCON_CRYPTTRFSTAT_ENABLED
|-
| 16-18
| FALCON_CRYPTTRFSTAT_NUM_STORES_PENDING
|-
| 24-26
| FALCON_CRYPTTRFSTAT_NUM_LOADS_PENDING
|}

=== FALCON_HWCFG2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_HWCFG2_VERSION
|-
| 4-5
| FALCON_HWCFG2_SCP_MODE
|-
| 6-7
| FALCON_HWCFG2_SUBVERSION
|-
| 8-11
| FALCON_HWCFG2_IMEM_PORTS
|-
| 12-15
| FALCON_HWCFG2_DMEM_PORTS
|-
| 16-19
| FALCON_HWCFG2_VM_PAGES_LOG2
|}

=== FALCON_ICD_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| FALCON_ICD_CMD_OPC
0x0: BREAK
0x1: CONTINUE_FROM_PC
0x2: CONTINUE_FROM_ADDR
0x3: CONTINUE_UNK1_FROM_PC
0x4: CONTINUE_UNK1_FROM_ADDR
0x5: SINGLE_STEP_FROM_PC
0x6: SINGLE_STEP_FROM_ADDR
0x7: SET_BREAK_MASK
0x8: REG_READ
0x9: REG_WRITE
0xA: DATA_READ
0xB: DATA_WRITE
0xC: IO_READ
0xD: IO_WRITE
0xE: STATUS_READ
|-
| 6-7
| FALCON_ICD_CMD_DATA_SIZE
|-
| 8-12
| FALCON_ICD_CMD_IDX
|-
| 14
| FALCON_ICD_CMD_ERROR
|-
| 15
| FALCON_ICD_CMD_DONE
|-
| 16-31
| FALCON_ICD_CMD_BREAK_MASK
|}

=== FALCON_SCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| FALCON_SCTL_SEC_MODE
0: Non-secure
1: Light Secure
2: Heavy Secure
|}

=== TSEC_SCP_CTL_ACCESS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| Enable TSEC_SCP_INSN_STAT register
|}

=== TSEC_SCP_CTL_TRNG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 11
| Unknown
|-
| 12
| Enable the TRNG
|}

=== TSEC_SCP_CTL_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| TSEC_SCP_CTL_STAT_DEBUG_MODE
|}

=== TSEC_SCP_CTL_MODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Disable reads for the TRNG register block
|-
| 1
| Disable reads for the TFBIF register block
|-
| 2
| Disable reads for the DMA register block
|-
| 3
| Disable reads for the TEGRA register block
|-
| 4
| Disable writes for the TRNG register block
|-
| 5
| Disable writes for the TFBIF register block
|-
| 6
| Disable writes for the DMA register block
|-
| 7
| Disable writes for the TEGRA register block
|}

Controls accesses to the other sub-engines and can only be cleared in Heavy Secure mode.

=== TSEC_SCP_CTL_PKEY ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
|-
| 1
| TSEC_SCP_CTL_PKEY_LOADED
|}

=== TSEC_SCP_SEQ0_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 8-11
| Size of current cs0begin macro
|-
|}

=== TSEC_SCP_SEQ_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Set if crypto sequence recording (cs0begin/cs1begin) is active
|-
| 4-7
| Number of instructions left for the crypto sequence
|-
| 12-15
| Active crypto key register
|}

Contains information on the last crypto sequence (cs0 or cs1) executed.

=== TSEC_SCP_INSN_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| Crypto fuc5 destination register or immediate value
|-
| 8-15
| Crypto fuc5 source register or immediate value
|-
| 20-24
| Crypto fuc5 operation
0x0: none (fuc5 opcode 0x00)
0x1: cmov (fuc5 opcode 0x84)
0x2: cxsin (fuc5 opcode 0x88) or xdst (with cxset)
0x3: cxsout (fuc5 opcode 0x8C) or xdld (with cxset)
0x4: crng (fuc5 opcode 0x90)
0x5: cs0begin (fuc5 opcode 0x94)
0x6: cs0exec (fuc5 opcode 0x98)
0x7: cs1begin (fuc5 opcode 0x9C)
0x8: cs1exec (fuc5 opcode 0xA0)
0x9: invalid (fuc5 opcode 0xA4)
0xA: cchmod (fuc5 opcode 0xA8)
0xB: cxor (fuc5 opcode 0xAC)
0xC: cadd (fuc5 opcode 0xB0)
0xD: cand (fuc5 opcode 0xB4)
0xE: crev (fuc5 opcode 0xB8)
0xF: cprecmac (fuc5 opcode 0xBC)
0x10: csecret (fuc5 opcode 0xC0)
0x11: ckeyreg (fuc5 opcode 0xC4)
0x12: ckexp (fuc5 opcode 0xC8)
0x13: ckrexp (fuc5 opcode 0xCC)
0x14: cenc (fuc5 opcode 0xD0)
0x15: cdec (fuc5 opcode 0xD4)
0x16: csigauth (fuc5 opcode 0xD8)
0x17: csigenc (fuc5 opcode 0xDC)
0x18: csigclr (fuc5 opcode 0xE0)
|-
| 31
| Set if running in secure mode (cauth)
|}

Contains information on the last crypto instruction executed.

=== TSEC_SCP_AES_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-4
| First opcode
|-
| 5-9
| Second opcode
|-
| 15-16
| AES operation
0: Encryption
1: Decryption
2: Key expansion
3: Key reverse expansion
|}

Contains information on the last AES sequence executed.

=== TSEC_SCP_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQSTAT_TRNG
|-
| 8
| TSEC_SCP_IRQSTAT_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQSTAT_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQSTAT_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the status of crypto IRQs.

=== TSEC_SCP_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_SCP_IRQMASK_TRNG
|-
| 8
| TSEC_SCP_IRQMASK_HALT
|-
| 12
| Unknown
|-
| 16
| TSEC_SCP_IRQMASK_INSN_ERROR
|-
| 20
| TSEC_SCP_IRQMASK_SINGLE_STEP
|-
| 24
| Unknown
|-
| 28
| Unknown
|}

Used for getting the value of the mask for crypto IRQs.

=== TSEC_SCP_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Invalid instruction
|-
| 4
| Empty crypto sequence
|-
| 8
| Crypto sequence is too long
|-
| 12
| Crypto sequence was not finished
|-
| 16
| Invalid cauth signature (during csigenc, csigclr or csigunk)
|-
| 24
| Forbidden instruction
|}

Contains information on crypto errors generated by the [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT_INSN_ERROR]] IRQ.

=== TSEC_TFBIF_MCCIF_FIFOCTRL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
|-
| 1
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
|-
| 2
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
|-
| 3
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
|-
| 4
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
|-
| 5
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
|-
| 6
| TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
|-
| 7
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
|-
| 8
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE
|}

=== TSEC_MCCIF_FIFOCTRL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
|-
| 16-31
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT
|}

=== TSEC_TFBIF_UNK5 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.

=== TSEC_TFBIF_UNK6 ===
Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to (data_size << 4) before reading memory from the GPU UCODE carveout.

=== TSEC_DMA_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_DMA_CMD_READ
|-
| 1
| TSEC_DMA_CMD_WRITE
|-
| 4-7
| TSEC_DMA_CMD_UNK
|-
| 12
| TSEC_DMA_CMD_BUSY
|-
| 13
| TSEC_DMA_CMD_ERROR
|-
| 31
| TSEC_DMA_CMD_INIT
|}

A DMA read/write operation requires bits TSEC_DMA_CMD_INIT and TSEC_DMA_CMD_READ/TSEC_DMA_CMD_WRITE to be set in TSEC_DMA_CMD.

During the transfer, the TSEC_DMA_CMD_BUSY bit is set.

Accessing an invalid address causes bit TSEC_DMA_CMD_ERROR to be set.

=== TSEC_DMA_ADDR ===
Takes the address for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_VAL ===
Takes the value for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_DMA_UNK ===
Always 0xFFF.

=== TSEC_TEGRA_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 16
| TSEC_TEGRA_CTL_TKFI_KFUSE
|-
| 17
| TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
|-
| 24
| TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
|-
| 25
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
|-
| 26
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
|-
| 27
| TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C
|}

== Authenticated Mode ==
===== Entry =====
From non-secure mode, upon jumping to a page marked as secret, a secret fault occurs. This causes the CPU to verify the region specified in $cauth against the MAC loaded in $c6. If the comparison is successful, the valid bit (bit0) is set on all pages in the $cauth region, and $pc is set to the base of the $cauth region. If the comparsion fails, the CPU is halted.

===== Exit =====
The CPU automatically goes back to non-secure mode when returning back into non-secret pages. When this happens, the valid bit (bit0) in the TLB flags is cleared for all secret pages.

===== Implementation =====
Under certain circumstances, it is possible to observe [[#csigauth|csigauth]] being briefly written to [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]] as "csigauth $c4 $c6" while the opcodes in [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]] are set to "cxsin" and "csigauth", respectively.

Via [[#TSEC_SCP_SEQ0_STAT|TSEC_SCP_SEQ0_STAT]] it can be observed that a 3-sized macro sequence is loaded into cs0 during a secure mode transition.

== Crypto processing ==
Part of the information here (which hasn't made it into envytools documentation yet) was shared by [https://wiki.0x04.net/wiki/Marcin_Ko%C5%9Bcielnicki mwk] from reverse engineering falcon processors over the years.

=== cauth ===
$cauth is a special purpose register in the CPU.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7 || Start of region to authenticate (in 0x100 pages)
|-
| 8-15 || Unused
|-
| 16 || Use secret xfers (?)
|-
| 17 || Region is signed and encrypted and double the size (?)
|-
| 18 ||
|-
| 19 ||
|-
| 20-23 || Unused
|-
| 31-24 || Size of region to authenticate (in 0x100 pages)
|}

== SCP operations ==

{| class="wikitable" border="1"
! Opcode
! Name
! Operand0
! Operand1
! Operation
! Condition
|-
| 0 || || || || ||
|-
| 1 || mov || $cX || $cY || <code>$cX = $cY; ACL($cX) = ACL($cY);</code> ||
|-
| 2 || sin || $cX || N/A || <code>$cX = read_stream(); ACL($cX) = ???;</code> ||
|-
| 3 || sout || $cX || N/A || <code>write_stream($cX);</code> ||
|-
| 4 || rnd || $cX || N/A || <code>$cX = read_trng(); ACL($cX) = ???;</code> ||
|-
| 5 || s0begin || immX || N/A || <code>record_macro_for_N_instructions(0, immX);</code> ||
|-
| 6 || s0exec || immX || N/A || <code>execute_macro_N_times(0, immX);</code> ||
|-
| 7 || s1begin || immX || N/A || <code>record_macro_for_N_instructions(1, immX);</code> ||
|-
| 8 || s1exec || immX || N/A || <code>execute_macro_N_times(1, immX);</code> ||
|-
| 9 || ? || || || ||
|-
| 0xA || chmod || $cX || immY || <code>ACL($cX) &= immY;</code> ||
|-
| 0xB || xor || $cX || $cY || <code>$cX ^= $cY;</code> || <code>(ACL($cX) & 2) && (ACL($cY) & 2)</code>
|-
| 0xC || add || $cX || immY || <code>$cX += immY;</code> || <code>(ACL($cX) & 2)</code>
|-
| 0xD || and || $cX || $cY || <code>$cX &= $cY;</code> || <code>(ACL($cX) & 2) && (ACL($cY) & 2)</code>
|-
| 0xE || rev || $cX || $cY || <code>$cX = reverse($cY); ACL($cX) = ACL($cY);</code> ||
|-
| 0xF || pre_cmac || || || ? ||
|-
| 0x10 || secret || $cX || immY || <code>$cX = load_secret(immY); ACL($cX) = load_secret_acl(immY);</code> ||
|-
| 0x11 || keyreg || immX || || <code>active_key_idx = immX;</code> ||
|-
| 0x12 || kexp || $cX || $cY || <code>$cX = aes_kexp($Y);</code> || <code>(ACL($cY) & 2)</code>
|-
| 0x13 || krexp || $cX || $cY || <code>$cX = aes_kexp_reverse($Y);</code> || <code>(ACL($cY) & 2)</code>
|-
| 0x14 || enc || $cX || $cY || <code>$cX = aes_enc(active_key_idx, $cY);</code> || <code>(ACL($cX) & 3) && (ACL($cY) & 2)</code>
|-
| 0x15 || dec || $cX || $cY || <code>$cX = aes_dec(active_key_idx, $cY);</code> || <code>(ACL($cX) & 3) && (ACL($cY) & 2)</code>
|-
| ...
|}

=== ACL ===
{| class="wikitable" border="1"
! Bit
! Meaning
|-
| 0 || Valid key
|-
| 1 || Valid data
|}

==== Initial values ====
On SCP boot, the ACL is 0x1F for all $cX.

Loading into $cX using xdst instruction sets ACL($cX) to 0x1F.

Spilling a $cX to DMEM using xdld instruction is allowed if (ACL($cX) & 2).

=== csigauth ===
<code>00000000: f5 3c XY d8 csigauth $cY $cX</code>

This instruction takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret.

=== csigclr ===
<code>00000000: f5 3c 00 e0 csigclr</code>

This instruction takes no operands and appears to clear the saved cauth signature used by the csigenc instruction.

=== cchmod ===
<code>00000000: f5 3c XY a8 cchmod $cY 0X</code> or <code>00000000: f5 3c XY a9 cchmod $cY 1X</code>

This instruction takes a crypto register and a 5 bit immediate value. It appears to set the [[#Register ACLs|crypto registers' ACL]] bits as follows:
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Allow register to be used as key in NS or LS mode
|-
| 1
| Allow register to be used as key in HS mode
|-
| 2
| Set register as readable in NS or LS mode
|-
| 3
| Set register as readable in HS mode
|-
| 4
| Set register as writable in NS or LS mode
|}

=== crng ===
<code>00000000: f5 3c 0X 90 crng $cX</code>

This instruction initializes a crypto register with random data.

Executing this instruction only succeeds if the TRNG is enabled for the SCP, which requires taking the following steps:
* Write 0x7FFF to TSEC_TRNG_CLKDIV.
* Write 0x3FF0000 to TSEC_TRNG_UNK0.
* Write 0xFF00 to TSEC_TRNG_UNK7.
* Write 0x1000 to [[#TSEC_SCP_CTL_TRNG|TSEC_SCP_CTL_TRNG]].

Otherwise it hangs forever.

=== cxset ===
cxset instruction provides a way to change behavior of a variable amount of successively executed DMA-related instructions.

for example: <code>000000de: f4 3c 02 cxset 0x2</code>

can be read as: <code>dma_override(type=crypto_reg, count=2)</code>

The argument to cxset specifies the type of behavior change in the top 3 bits, and the number of DMA-related instructions the effect lasts for in the lower 5 bits.

{| class=wikitable
! Bits || Description
|-
| 0-4 || Number of instructions it is valid for (0x1f is a special value meaning infinitely many instructions -- until overriden by another cxset)
|-
| 5 || Crypto destination/source select (0=crypto register, 1=crypto stream)
|-
| 6 || External memory override (0=Disabled, 1=Enabled)
|-
| 7 || Internal memory select (0=DMEM, 1=IMEM)
|}

==== DMA-Related Instructions ====
At least the following instructions may have changed behavior, and count against the cxset "count" argument: <code>xdwait</code>, <code>xdst</code>, <code>xdld</code>.

For example, if override type=0b000, then the "length" argument to <code>xdst</code> is instead treated as the index of the target $cX register.

=== Secrets ===
Falcon's Authenticated Mode has access to 64 128-bit keys which are burned at factory. These keys can be loaded by using the $csecret instruction which takes the target crypto register and the key index as arguments.

{| class=wikitable
! Index || Notes || Console-unique
|-
| 0x00 || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares. || No
|-
| 0x01 || Used by nvhost_nvdec_bl020_prod firmware. ||
|-
| 0x03 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x04 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x05 || Used by nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares. ||
|-
| 0x07 || Used by [6.0.0+] nvhost_tsec firmware. ||
|-
| 0x09 || Used by nvhost_tsec firmware. ||
|-
| 0x0B || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. ||
|-
| 0x0F || Used by nvhost_tsec firmware. ||
|-
| 0x10 || Used by [1.0.0-5.1.0] nvhost_tsec firmware. ||
|-
| 0x15 || Used by nvhost_nvdec_bl020_prod, [5.0.0+] nvhost_nvdec020_prod, [5.0.0+] nvhost_nvdec020_ns and [6.0.0+] nvhost_tsec firmwares. ||
|-
| 0x26 || Used by [[TSEC_Firmware#KeygenLdr|KeygenLdr]]. || No
|-
| 0x3C || Used by nvhost_tsec firmware. ||
|-
| 0x3F || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares. || Yes
|}