Nintendo Switch Brew - User contributions [en]

TSEC

2021-02-18T18:29:43Z

Vale: Rename cprecmac occurence to cgfmul

TSEC (Tegra Security Co-processor) is a dedicated unit powered by a NVIDIA Falcon microprocessor with crypto extensions.

= Driver =
A host driver for communicating with the TSEC is mapped to physical address 0x54500000 with a total size of 0x40000 bytes and exposes several registers.

== Registers ==
The TSEC's MMIO space is divided as follows:
* 0x54500000 to 0x54501000: THI (Tegra Host Interface)
* 0x54501000 to 0x54501400: [[#Falcon|FALCON (Falcon microcontroller)]]
* 0x54501400 to 0x54501600: [[#SCP|SCP (Secure coprocessor)]]
* 0x54501600 to 0x54501680: TFBIF (Tegra Framebuffer Interface)
* 0x54501680 to 0x54501700: CG (Clock Gate)
* 0x54501700 to 0x54501800: BAR0 (HOST1X device DMA)
* 0x54501800 to 0x54501900: TEGRA (Miscellaneous interfaces)

{| class="wikitable" border="1"
! Name
! Address
! Width
|-
| [[#TSEC_THI_INCR_SYNCPT|TSEC_THI_INCR_SYNCPT]]
| 0x54500000
| 0x04
|-
| [[#TSEC_THI_INCR_SYNCPT_CTRL|TSEC_THI_INCR_SYNCPT_CTRL]]
| 0x54500004
| 0x04
|-
| [[#TSEC_THI_INCR_SYNCPT_ERR|TSEC_THI_INCR_SYNCPT_ERR]]
| 0x54500008
| 0x04
|-
| [[#TSEC_THI_CTXSW_INCR_SYNCPT|TSEC_THI_CTXSW_INCR_SYNCPT]]
| 0x5450000C
| 0x04
|-
| [[#TSEC_THI_CTXSW|TSEC_THI_CTXSW]]
| 0x54500020
| 0x04
|-
| [[#TSEC_THI_CTXSW_NEXT|TSEC_THI_CTXSW_NEXT]]
| 0x54500024
| 0x04
|-
| [[#TSEC_THI_CONT_SYNCPT_EOF|TSEC_THI_CONT_SYNCPT_EOF]]
| 0x54500028
| 0x04
|-
| [[#TSEC_THI_CONT_SYNCPT_L1|TSEC_THI_CONT_SYNCPT_L1]]
| 0x5450002C
| 0x04
|-
| [[#TSEC_THI_STREAMID0|TSEC_THI_STREAMID0]]
| 0x54500030
| 0x04
|-
| [[#TSEC_THI_STREAMID1|TSEC_THI_STREAMID1]]
| 0x54500034
| 0x04
|-
| [[#TSEC_THI_THI_SEC|TSEC_THI_THI_SEC]]
| 0x54500038
| 0x04
|-
| [[#TSEC_THI_METHOD0|TSEC_THI_METHOD0]]
| 0x54500040
| 0x04
|-
| [[#TSEC_THI_METHOD1|TSEC_THI_METHOD1]]
| 0x54500044
| 0x04
|-
| [[#TSEC_THI_CONTEXT_SWITCH|TSEC_THI_CONTEXT_SWITCH]]
| 0x54500060
| 0x04
|-
| [[#TSEC_THI_INT_STATUS|TSEC_THI_INT_STATUS]]
| 0x54500078
| 0x04
|-
| [[#TSEC_THI_INT_MASK|TSEC_THI_INT_MASK]]
| 0x5450007C
| 0x04
|-
| [[#TSEC_THI_CONFIG0|TSEC_THI_CONFIG0]]
| 0x54500080
| 0x04
|-
| [[#TSEC_THI_DBG_MISC|TSEC_THI_DBG_MISC]]
| 0x54500084
| 0x04
|-
| [[#TSEC_THI_SLCG_OVERRIDE_HIGH_A|TSEC_THI_SLCG_OVERRIDE_HIGH_A]]
| 0x54500088
| 0x04
|-
| [[#TSEC_THI_SLCG_OVERRIDE_LOW_A|TSEC_THI_SLCG_OVERRIDE_LOW_A]]
| 0x5450008C
| 0x04
|-
| [[#TSEC_THI_CLK_OVERRIDE|TSEC_THI_CLK_OVERRIDE]]
| 0x54500E00
| 0x04
|-
| [[#TSEC_FALCON_IRQSSET|TSEC_FALCON_IRQSSET]]
| 0x54501000
| 0x04
|-
| [[#TSEC_FALCON_IRQSCLR|TSEC_FALCON_IRQSCLR]]
| 0x54501004
| 0x04
|-
| [[#TSEC_FALCON_IRQSTAT|TSEC_FALCON_IRQSTAT]]
| 0x54501008
| 0x04
|-
| [[#TSEC_FALCON_IRQMODE|TSEC_FALCON_IRQMODE]]
| 0x5450100C
| 0x04
|-
| [[#TSEC_FALCON_IRQMSET|TSEC_FALCON_IRQMSET]]
| 0x54501010
| 0x04
|-
| [[#TSEC_FALCON_IRQMCLR|TSEC_FALCON_IRQMCLR]]
| 0x54501014
| 0x04
|-
| [[#TSEC_FALCON_IRQMASK|TSEC_FALCON_IRQMASK]]
| 0x54501018
| 0x04
|-
| [[#TSEC_FALCON_IRQDEST|TSEC_FALCON_IRQDEST]]
| 0x5450101C
| 0x04
|-
| [[#TSEC_FALCON_GPTMRINT|TSEC_FALCON_GPTMRINT]]
| 0x54501020
| 0x04
|-
| [[#TSEC_FALCON_GPTMRVAL|TSEC_FALCON_GPTMRVAL]]
| 0x54501024
| 0x04
|-
| [[#TSEC_FALCON_GPTMRCTL|TSEC_FALCON_GPTMRCTL]]
| 0x54501028
| 0x04
|-
| [[#TSEC_FALCON_PTIMER0|TSEC_FALCON_PTIMER0]]
| 0x5450102C
| 0x04
|-
| [[#TSEC_FALCON_PTIMER1|TSEC_FALCON_PTIMER1]]
| 0x54501030
| 0x04
|-
| [[#TSEC_FALCON_WDTMRVAL|TSEC_FALCON_WDTMRVAL]]
| 0x54501034
| 0x04
|-
| [[#TSEC_FALCON_WDTMRCTL|TSEC_FALCON_WDTMRCTL]]
| 0x54501038
| 0x04
|-
| [[#TSEC_FALCON_IRQDEST2|TSEC_FALCON_IRQDEST2]]
| 0x5450103C
| 0x04
|-
| [[#TSEC_FALCON_MAILBOX0|TSEC_FALCON_MAILBOX0]]
| 0x54501040
| 0x04
|-
| [[#TSEC_FALCON_MAILBOX1|TSEC_FALCON_MAILBOX1]]
| 0x54501044
| 0x04
|-
| [[#TSEC_FALCON_ITFEN|TSEC_FALCON_ITFEN]]
| 0x54501048
| 0x04
|-
| [[#TSEC_FALCON_IDLESTATE|TSEC_FALCON_IDLESTATE]]
| 0x5450104C
| 0x04
|-
| [[#TSEC_FALCON_CURCTX|TSEC_FALCON_CURCTX]]
| 0x54501050
| 0x04
|-
| [[#TSEC_FALCON_NXTCTX|TSEC_FALCON_NXTCTX]]
| 0x54501054
| 0x04
|-
| [[#TSEC_FALCON_CTXACK|TSEC_FALCON_CTXACK]]
| 0x54501058
| 0x04
|-
| [[#TSEC_FALCON_FHSTATE|TSEC_FALCON_FHSTATE]]
| 0x5450105C
| 0x04
|-
| [[#TSEC_FALCON_PRIVSTATE|TSEC_FALCON_PRIVSTATE]]
| 0x54501060
| 0x04
|-
| [[#TSEC_FALCON_MTHDDATA|TSEC_FALCON_MTHDDATA]]
| 0x54501064
| 0x04
|-
| [[#TSEC_FALCON_MTHDID|TSEC_FALCON_MTHDID]]
| 0x54501068
| 0x04
|-
| [[#TSEC_FALCON_MTHDWDAT|TSEC_FALCON_MTHDWDAT]]
| 0x5450106C
| 0x04
|-
| [[#TSEC_FALCON_MTHDCOUNT|TSEC_FALCON_MTHDCOUNT]]
| 0x54501070
| 0x04
|-
| [[#TSEC_FALCON_MTHDPOP|TSEC_FALCON_MTHDPOP]]
| 0x54501074
| 0x04
|-
| [[#TSEC_FALCON_MTHDRAMSZ|TSEC_FALCON_MTHDRAMSZ]]
| 0x54501078
| 0x04
|-
| [[#TSEC_FALCON_SFTRESET|TSEC_FALCON_SFTRESET]]
| 0x5450107C
| 0x04
|-
| [[#TSEC_FALCON_OS|TSEC_FALCON_OS]]
| 0x54501080
| 0x04
|-
| [[#TSEC_FALCON_RM|TSEC_FALCON_RM]]
| 0x54501084
| 0x04
|-
| [[#TSEC_FALCON_SOFT_PM|TSEC_FALCON_SOFT_PM]]
| 0x54501088
| 0x04
|-
| [[#TSEC_FALCON_SOFT_MODE|TSEC_FALCON_SOFT_MODE]]
| 0x5450108C
| 0x04
|-
| [[#TSEC_FALCON_DEBUG1|TSEC_FALCON_DEBUG1]]
| 0x54501090
| 0x04
|-
| [[#TSEC_FALCON_DEBUGINFO|TSEC_FALCON_DEBUGINFO]]
| 0x54501094
| 0x04
|-
| [[#TSEC_FALCON_IBRKPT1|TSEC_FALCON_IBRKPT1]]
| 0x54501098
| 0x04
|-
| [[#TSEC_FALCON_IBRKPT2|TSEC_FALCON_IBRKPT2]]
| 0x5450109C
| 0x04
|-
| [[#TSEC_FALCON_CGCTL|TSEC_FALCON_CGCTL]]
| 0x545010A0
| 0x04
|-
| [[#TSEC_FALCON_ENGCTL|TSEC_FALCON_ENGCTL]]
| 0x545010A4
| 0x04
|-
| [[#TSEC_FALCON_PMM|TSEC_FALCON_PMM]]
| 0x545010A8
| 0x04
|-
| [[#TSEC_FALCON_ADDR|TSEC_FALCON_ADDR]]
| 0x545010AC
| 0x04
|-
| [[#TSEC_FALCON_IBRKPT3|TSEC_FALCON_IBRKPT3]]
| 0x545010B0
| 0x04
|-
| [[#TSEC_FALCON_IBRKPT4|TSEC_FALCON_IBRKPT4]]
| 0x545010B4
| 0x04
|-
| [[#TSEC_FALCON_IBRKPT5|TSEC_FALCON_IBRKPT5]]
| 0x545010B8
| 0x04
|-
| [[#TSEC_FALCON_EXCI|TSEC_FALCON_EXCI]]
| 0x545010D0
| 0x04
|-
| [[#TSEC_FALCON_SVEC_SPR|TSEC_FALCON_SVEC_SPR]]
| 0x545010D4
| 0x04
|-
| [[#TSEC_FALCON_RSTAT0|TSEC_FALCON_RSTAT0]]
| 0x545010D8
| 0x04
|-
| [[#TSEC_FALCON_RSTAT3|TSEC_FALCON_RSTAT3]]
| 0x545010DC
| 0x04
|-
| TSEC_FALCON_UNK_E0
| 0x545010E0
| 0x04
|-
| [[#TSEC_FALCON_CPUCTL|TSEC_FALCON_CPUCTL]]
| 0x54501100
| 0x04
|-
| [[#TSEC_FALCON_BOOTVEC|TSEC_FALCON_BOOTVEC]]
| 0x54501104
| 0x04
|-
| [[#TSEC_FALCON_HWCFG|TSEC_FALCON_HWCFG]]
| 0x54501108
| 0x04
|-
| [[#TSEC_FALCON_DMACTL|TSEC_FALCON_DMACTL]]
| 0x5450110C
| 0x04
|-
| [[#TSEC_FALCON_DMATRFBASE|TSEC_FALCON_DMATRFBASE]]
| 0x54501110
| 0x04
|-
| [[#TSEC_FALCON_DMATRFMOFFS|TSEC_FALCON_DMATRFMOFFS]]
| 0x54501114
| 0x04
|-
| [[#TSEC_FALCON_DMATRFCMD|TSEC_FALCON_DMATRFCMD]]
| 0x54501118
| 0x04
|-
| [[#TSEC_FALCON_DMATRFFBOFFS|TSEC_FALCON_DMATRFFBOFFS]]
| 0x5450111C
| 0x04
|-
| [[#TSEC_FALCON_DMAPOLL_FB|TSEC_FALCON_DMAPOLL_FB]]
| 0x54501120
| 0x04
|-
| [[#TSEC_FALCON_DMAPOLL_CP|TSEC_FALCON_DMAPOLL_CP]]
| 0x54501124
| 0x04
|-
| [[#TSEC_FALCON_HWCFG1|TSEC_FALCON_HWCFG1]]
| 0x5450112C
| 0x04
|-
| [[#TSEC_FALCON_CPUCTL_ALIAS|TSEC_FALCON_CPUCTL_ALIAS]]
| 0x54501130
| 0x04
|-
| [[#TSEC_FALCON_STACKCFG|TSEC_FALCON_STACKCFG]]
| 0x54501138
| 0x04
|-
| [[#TSEC_FALCON_IMCTL|TSEC_FALCON_IMCTL]]
| 0x54501140
| 0x04
|-
| [[#TSEC_FALCON_IMSTAT|TSEC_FALCON_IMSTAT]]
| 0x54501144
| 0x04
|-
| [[#TSEC_FALCON_TRACEIDX|TSEC_FALCON_TRACEIDX]]
| 0x54501148
| 0x04
|-
| [[#TSEC_FALCON_TRACEPC|TSEC_FALCON_TRACEPC]]
| 0x5450114C
| 0x04
|-
| [[#TSEC_FALCON_IMFILLRNG0|TSEC_FALCON_IMFILLRNG0]]
| 0x54501150
| 0x04
|-
| [[#TSEC_FALCON_IMFILLRNG1|TSEC_FALCON_IMFILLRNG1]]
| 0x54501154
| 0x04
|-
| [[#TSEC_FALCON_IMFILLCTL|TSEC_FALCON_IMFILLCTL]]
| 0x54501158
| 0x04
|-
| [[#TSEC_FALCON_IMCTL_DEBUG|TSEC_FALCON_IMCTL_DEBUG]]
| 0x5450115C
| 0x04
|-
| [[#TSEC_FALCON_CMEMBASE|TSEC_FALCON_CMEMBASE]]
| 0x54501160
| 0x04
|-
| [[#TSEC_FALCON_DMEMAPERT|TSEC_FALCON_DMEMAPERT]]
| 0x54501164
| 0x04
|-
| [[#TSEC_FALCON_EXTERRADDR|TSEC_FALCON_EXTERRADDR]]
| 0x54501168
| 0x04
|-
| [[#TSEC_FALCON_EXTERRSTAT|TSEC_FALCON_EXTERRSTAT]]
| 0x5450116C
| 0x04
|-
| [[#TSEC_FALCON_CG2|TSEC_FALCON_CG2]]
| 0x5450117C
| 0x04
|-
| [[#TSEC_FALCON_IMEMC|TSEC_FALCON_IMEMC0]]
| 0x54501180
| 0x04
|-
| [[#TSEC_FALCON_IMEMD|TSEC_FALCON_IMEMD0]]
| 0x54501184
| 0x04
|-
| [[#TSEC_FALCON_IMEMT|TSEC_FALCON_IMEMT0]]
| 0x54501188
| 0x04
|-
| [[#TSEC_FALCON_IMEMC|TSEC_FALCON_IMEMC1]]
| 0x54501190
| 0x04
|-
| [[#TSEC_FALCON_IMEMD|TSEC_FALCON_IMEMD1]]
| 0x54501194
| 0x04
|-
| [[#TSEC_FALCON_IMEMT|TSEC_FALCON_IMEMT1]]
| 0x54501198
| 0x04
|-
| [[#TSEC_FALCON_IMEMC|TSEC_FALCON_IMEMC2]]
| 0x545011A0
| 0x04
|-
| [[#TSEC_FALCON_IMEMD|TSEC_FALCON_IMEMD2]]
| 0x545011A4
| 0x04
|-
| [[#TSEC_FALCON_IMEMT|TSEC_FALCON_IMEMT2]]
| 0x545011A8
| 0x04
|-
| [[#TSEC_FALCON_IMEMC|TSEC_FALCON_IMEMC3]]
| 0x545011B0
| 0x04
|-
| [[#TSEC_FALCON_IMEMD|TSEC_FALCON_IMEMD3]]
| 0x545011B4
| 0x04
|-
| [[#TSEC_FALCON_IMEMT|TSEC_FALCON_IMEMT3]]
| 0x545011B8
| 0x04
|-
| [[#TSEC_FALCON_DMEMC|TSEC_FALCON_DMEMC0]]
| 0x545011C0
| 0x04
|-
| [[#TSEC_FALCON_DMEMD|TSEC_FALCON_DMEMD0]]
| 0x545011C4
| 0x04
|-
| [[#TSEC_FALCON_DMEMC|TSEC_FALCON_DMEMC1]]
| 0x545011C8
| 0x04
|-
| [[#TSEC_FALCON_DMEMD|TSEC_FALCON_DMEMD1]]
| 0x545011CC
| 0x04
|-
| [[#TSEC_FALCON_DMEMC|TSEC_FALCON_DMEMC2]]
| 0x545011D0
| 0x04
|-
| [[#TSEC_FALCON_DMEMD|TSEC_FALCON_DMEMD2]]
| 0x545011D4
| 0x04
|-
| [[#TSEC_FALCON_DMEMC|TSEC_FALCON_DMEMC3]]
| 0x545011D8
| 0x04
|-
| [[#TSEC_FALCON_DMEMD|TSEC_FALCON_DMEMD3]]
| 0x545011DC
| 0x04
|-
| [[#TSEC_FALCON_DMEMC|TSEC_FALCON_DMEMC4]]
| 0x545011E0
| 0x04
|-
| [[#TSEC_FALCON_DMEMD|TSEC_FALCON_DMEMD4]]
| 0x545011E4
| 0x04
|-
| [[#TSEC_FALCON_DMEMC|TSEC_FALCON_DMEMC5]]
| 0x545011E8
| 0x04
|-
| [[#TSEC_FALCON_DMEMD|TSEC_FALCON_DMEMD5]]
| 0x545011EC
| 0x04
|-
| [[#TSEC_FALCON_DMEMC|TSEC_FALCON_DMEMC6]]
| 0x545011F0
| 0x04
|-
| [[#TSEC_FALCON_DMEMD|TSEC_FALCON_DMEMD6]]
| 0x545011F4
| 0x04
|-
| [[#TSEC_FALCON_DMEMC|TSEC_FALCON_DMEMC7]]
| 0x545011F8
| 0x04
|-
| [[#TSEC_FALCON_DMEMD|TSEC_FALCON_DMEMD7]]
| 0x545011FC
| 0x04
|-
| [[#TSEC_FALCON_ICD_CMD|TSEC_FALCON_ICD_CMD]]
| 0x54501200
| 0x04
|-
| [[#TSEC_FALCON_ICD_ADDR|TSEC_FALCON_ICD_ADDR]]
| 0x54501204
| 0x04
|-
| [[#TSEC_FALCON_ICD_WDATA|TSEC_FALCON_ICD_WDATA]]
| 0x54501208
| 0x04
|-
| [[#TSEC_FALCON_ICD_RDATA|TSEC_FALCON_ICD_RDATA]]
| 0x5450120C
| 0x04
|-
| [[#TSEC_FALCON_SCTL|TSEC_FALCON_SCTL]]
| 0x54501240
| 0x04
|-
| [[#TSEC_FALCON_SSTAT|TSEC_FALCON_SSTAT]]
| 0x54501244
| 0x04
|-
| TSEC_FALCON_UNK_250
| 0x54501250
| 0x04
|-
| TSEC_FALCON_UNK_260
| 0x54501260
| 0x04
|-
| [[#TSEC_FALCON_SPROT_IMEM|TSEC_FALCON_SPROT_IMEM]]
| 0x54501280
| 0x04
|-
| [[#TSEC_FALCON_SPROT_DMEM|TSEC_FALCON_SPROT_DMEM]]
| 0x54501284
| 0x04
|-
| [[#TSEC_FALCON_SPROT_CPUCTL|TSEC_FALCON_SPROT_CPUCTL]]
| 0x54501288
| 0x04
|-
| [[#TSEC_FALCON_SPROT_MISC|TSEC_FALCON_SPROT_MISC]]
| 0x5450128C
| 0x04
|-
| [[#TSEC_FALCON_SPROT_IRQ|TSEC_FALCON_SPROT_IRQ]]
| 0x54501290
| 0x04
|-
| [[#TSEC_FALCON_SPROT_MTHD|TSEC_FALCON_SPROT_MTHD]]
| 0x54501294
| 0x04
|-
| [[#TSEC_FALCON_SPROT_SCTL|TSEC_FALCON_SPROT_SCTL]]
| 0x54501298
| 0x04
|-
| [[#TSEC_FALCON_SPROT_WDTMR|TSEC_FALCON_SPROT_WDTMR]]
| 0x5450129C
| 0x04
|-
| [[#TSEC_FALCON_DMAINFO_FINISHED_FBRD_LOW|TSEC_FALCON_DMAINFO_FINISHED_FBRD_LOW]]
| 0x545012C0
| 0x04
|-
| [[#TSEC_FALCON_DMAINFO_FINISHED_FBRD_HIGH|TSEC_FALCON_DMAINFO_FINISHED_FBRD_HIGH]]
| 0x545012C4
| 0x04
|-
| [[#TSEC_FALCON_DMAINFO_FINISHED_FBWR_LOW|TSEC_FALCON_DMAINFO_FINISHED_FBWR_LOW]]
| 0x545012C8
| 0x04
|-
| [[#TSEC_FALCON_DMAINFO_FINISHED_FBWR_HIGH|TSEC_FALCON_DMAINFO_FINISHED_FBWR_HIGH]]
| 0x545012CC
| 0x04
|-
| [[#TSEC_FALCON_DMAINFO_CURRENT_FBRD_LOW|TSEC_FALCON_DMAINFO_CURRENT_FBRD_LOW]]
| 0x545012D0
| 0x04
|-
| [[#TSEC_FALCON_DMAINFO_CURRENT_FBRD_HIGH|TSEC_FALCON_DMAINFO_CURRENT_FBRD_HIGH]]
| 0x545012D4
| 0x04
|-
| [[#TSEC_FALCON_DMAINFO_CURRENT_FBWR_LOW|TSEC_FALCON_DMAINFO_CURRENT_FBWR_LOW]]
| 0x545012D8
| 0x04
|-
| [[#TSEC_FALCON_DMAINFO_CURRENT_FBWR_HIGH|TSEC_FALCON_DMAINFO_CURRENT_FBWR_HIGH]]
| 0x545012DC
| 0x04
|-
| [[#TSEC_FALCON_DMAINFO_CTL|TSEC_FALCON_DMAINFO_CTL]]
| 0x545012E0
| 0x04
|-
| [[#TSEC_SCP_CTL0|TSEC_SCP_CTL0]]
| 0x54501400
| 0x04
|-
| [[#TSEC_SCP_CTL1|TSEC_SCP_CTL1]]
| 0x54501404
| 0x04
|-
| [[#TSEC_SCP_CTL_STAT|TSEC_SCP_CTL_STAT]]
| 0x54501408
| 0x04
|-
| [[#TSEC_SCP_CTL_LOCK|TSEC_SCP_CTL_LOCK]]
| 0x5450140C
| 0x04
|-
| [[#TSEC_SCP_CFG|TSEC_SCP_CFG]]
| 0x54501410
| 0x04
|-
| [[#TSEC_SCP_CTL_SCP|TSEC_SCP_CTL_SCP]]
| 0x54501414
| 0x04
|-
| [[#TSEC_SCP_CTL_PKEY|TSEC_SCP_CTL_PKEY]]
| 0x54501418
| 0x04
|-
| [[#TSEC_SCP_CTL_DBG|TSEC_SCP_CTL_DBG]]
| 0x5450141C
| 0x04
|-
| [[#TSEC_SCP_DBG0|TSEC_SCP_DBG0]]
| 0x54501420
| 0x04
|-
| [[#TSEC_SCP_DBG1|TSEC_SCP_DBG1]]
| 0x54501424
| 0x04
|-
| [[#TSEC_SCP_DBG2|TSEC_SCP_DBG2]]
| 0x54501428
| 0x04
|-
| [[#TSEC_SCP_CMD|TSEC_SCP_CMD]]
| 0x54501430
| 0x04
|-
| [[#TSEC_SCP_STAT0|TSEC_SCP_STAT0]]
| 0x54501450
| 0x04
|-
| [[#TSEC_SCP_STAT1|TSEC_SCP_STAT1]]
| 0x54501454
| 0x04
|-
| [[#TSEC_SCP_STAT2|TSEC_SCP_STAT2]]
| 0x54501458
| 0x04
|-
| [[#TSEC_SCP_RNG_STAT0|TSEC_SCP_RNG_STAT0]]
| 0x54501470
| 0x04
|-
| [[#TSEC_SCP_RNG_STAT1|TSEC_SCP_RNG_STAT1]]
| 0x54501474
| 0x04
|-
| [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT]]
| 0x54501480
| 0x04
|-
| [[#TSEC_SCP_IRQMASK|TSEC_SCP_IRQMASK]]
| 0x54501484
| 0x04
|-
| [[#TSEC_SCP_ACL_ERR|TSEC_SCP_ACL_ERR]]
| 0x54501490
| 0x04
|-
| [[#TSEC_SCP_SEC_ERR|TSEC_SCP_SEC_ERR]]
| 0x54501494
| 0x04
|-
| [[#TSEC_SCP_CMD_ERR|TSEC_SCP_CMD_ERR]]
| 0x54501498
| 0x04
|-
| [[#TSEC_SCP_RND_CTL0|TSEC_SCP_RND_CTL0]]
| 0x54501500
| 0x04
|-
| [[#TSEC_SCP_RND_CTL1|TSEC_SCP_RND_CTL1]]
| 0x54501504
| 0x04
|-
| TSEC_SCP_RND_CTL2
| 0x54501508
| 0x04
|-
| TSEC_SCP_RND_CTL3
| 0x5450150C
| 0x04
|-
| TSEC_SCP_RND_CTL4
| 0x54501510
| 0x04
|-
| TSEC_SCP_RND_CTL5
| 0x54501514
| 0x04
|-
| TSEC_SCP_RND_CTL6
| 0x54501518
| 0x04
|-
| TSEC_SCP_RND_CTL7
| 0x5450151C
| 0x04
|-
| TSEC_SCP_RND_CTL8
| 0x54501520
| 0x04
|-
| TSEC_SCP_RND_CTL9
| 0x54501524
| 0x04
|-
| TSEC_SCP_RND_CTL10
| 0x54501528
| 0x04
|-
| TSEC_SCP_RND_CTL11
| 0x5450152C
| 0x04
|-
| [[#TSEC_TFBIF_CTL|TSEC_TFBIF_CTL]]
| 0x54501600
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL|TSEC_TFBIF_MCCIF_FIFOCTRL]]
| 0x54501604
| 0x04
|-
| [[#TSEC_TFBIF_THROTTLE|TSEC_TFBIF_THROTTLE]]
| 0x54501608
| 0x04
|-
| [[#TSEC_TFBIF_DBG_STAT0|TSEC_TFBIF_DBG_STAT0]]
| 0x5450160C
| 0x04
|-
| [[#TSEC_TFBIF_DBG_STAT1|TSEC_TFBIF_DBG_STAT1]]
| 0x54501610
| 0x04
|-
| [[#TSEC_TFBIF_DBG_RDCOUNT_LO|TSEC_TFBIF_DBG_RDCOUNT_LO]]
| 0x54501614
| 0x04
|-
| [[#TSEC_TFBIF_DBG_RDCOUNT_HI|TSEC_TFBIF_DBG_RDCOUNT_HI]]
| 0x54501618
| 0x04
|-
| [[#TSEC_TFBIF_DBG_WRCOUNT_LO|TSEC_TFBIF_DBG_WRCOUNT_LO]]
| 0x5450161C
| 0x04
|-
| [[#TSEC_TFBIF_DBG_WRCOUNT_HI|TSEC_TFBIF_DBG_WRCOUNT_HI]]
| 0x54501620
| 0x04
|-
| [[#TSEC_TFBIF_DBG_R32COUNT|TSEC_TFBIF_DBG_R32COUNT]]
| 0x54501624
| 0x04
|-
| [[#TSEC_TFBIF_DBG_R64COUNT|TSEC_TFBIF_DBG_R64COUNT]]
| 0x54501628
| 0x04
|-
| [[#TSEC_TFBIF_DBG_R128COUNT|TSEC_TFBIF_DBG_R128COUNT]]
| 0x5450162C
| 0x04
|-
| TSEC_TFBIF_UNK_30
| 0x54501630
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL1|TSEC_TFBIF_MCCIF_FIFOCTRL1]]
| 0x54501634
| 0x04
|-
| [[#TSEC_TFBIF_WRR_RDP|TSEC_TFBIF_WRR_RDP]]
| 0x54501638
| 0x04
|-
| [[#TSEC_TFBIF_SPROT_EMEM|TSEC_TFBIF_SPROT_EMEM]]
| 0x54501640
| 0x04
|-
| [[#TSEC_TFBIF_TRANSCFG|TSEC_TFBIF_TRANSCFG]]
| 0x54501644
| 0x04
|-
| [[#TSEC_TFBIF_REGIONCFG|TSEC_TFBIF_REGIONCFG]]
| 0x54501648
| 0x04
|-
| [[#TSEC_TFBIF_ACTMON_ACTIVE_MASK|TSEC_TFBIF_ACTMON_ACTIVE_MASK]]
| 0x5450164C
| 0x04
|-
| [[#TSEC_TFBIF_ACTMON_ACTIVE_BORPS|TSEC_TFBIF_ACTMON_ACTIVE_BORPS]]
| 0x54501650
| 0x04
|-
| [[#TSEC_TFBIF_ACTMON_ACTIVE_WEIGHT|TSEC_TFBIF_ACTMON_ACTIVE_WEIGHT]]
| 0x54501654
| 0x04
|-
| [[#TSEC_TFBIF_ACTMON_MCB_MASK|TSEC_TFBIF_ACTMON_MCB_MASK]]
| 0x54501660
| 0x04
|-
| [[#TSEC_TFBIF_ACTMON_MCB_BORPS|TSEC_TFBIF_ACTMON_MCB_BORPS]]
| 0x54501664
| 0x04
|-
| [[#TSEC_TFBIF_ACTMON_MCB_WEIGHT|TSEC_TFBIF_ACTMON_MCB_WEIGHT]]
| 0x54501668
| 0x04
|-
| [[#TSEC_TFBIF_THI_TRANSPROP|TSEC_TFBIF_THI_TRANSPROP]]
| 0x54501670
| 0x04
|-
| [[#TSEC_CG|TSEC_CG]]
| 0x545016D0
| 0x04
|-
| [[#TSEC_BAR0_CTL|TSEC_BAR0_CTL]]
| 0x54501700
| 0x04
|-
| [[#TSEC_BAR0_ADDR|TSEC_BAR0_ADDR]]
| 0x54501704
| 0x04
|-
| [[#TSEC_BAR0_DATA|TSEC_BAR0_DATA]]
| 0x54501708
| 0x04
|-
| [[#TSEC_BAR0_TIMEOUT|TSEC_BAR0_TIMEOUT]]
| 0x5450170C
| 0x04
|-
| TSEC_TEGRA_UNK_00
| 0x54501800
| 0x04
|-
| TSEC_TEGRA_UNK_04
| 0x54501804
| 0x04
|-
| TSEC_TEGRA_UNK_08
| 0x54501808
| 0x04
|-
| TSEC_TEGRA_UNK_0C
| 0x5450180C
| 0x04
|-
| TSEC_TEGRA_UNK_10
| 0x54501810
| 0x04
|-
| TSEC_TEGRA_UNK_14
| 0x54501814
| 0x04
|-
| TSEC_TEGRA_UNK_18
| 0x54501818
| 0x04
|-
| TSEC_TEGRA_UNK_1C
| 0x5450181C
| 0x04
|-
| TSEC_TEGRA_UNK_20
| 0x54501820
| 0x04
|-
| TSEC_TEGRA_UNK_24
| 0x54501824
| 0x04
|-
| TSEC_TEGRA_UNK_28
| 0x54501828
| 0x04
|-
| TSEC_TEGRA_UNK_2C
| 0x5450182C
| 0x04
|-
| TSEC_TEGRA_UNK_30
| 0x54501830
| 0x04
|-
| TSEC_TEGRA_UNK_34
| 0x54501834
| 0x04
|-
| [[#TSEC_TEGRA_CTL|TSEC_TEGRA_CTL]]
| 0x54501838
| 0x04
|}

=== TSEC_THI_INCR_SYNCPT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-9
| TSEC_THI_INCR_SYNCPT_INDX
|-
| 10-17
| TSEC_THI_INCR_SYNCPT_COND
|}

=== TSEC_THI_INCR_SYNCPT_CTRL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INCR_SYNCPT_CTRL_SOFT_RESET
|-
| 8
| TSEC_THI_INCR_SYNCPT_CTRL_NO_STALL
|-
| 16
| TSEC_THI_INCR_SYNCPT_CTRL_SOFT_RESET_0
|-
| 17
| TSEC_THI_INCR_SYNCPT_CTRL_NO_STALL_0
|-
| 18
| TSEC_THI_INCR_SYNCPT_CTRL_SOFT_RESET_1
|-
| 19
| TSEC_THI_INCR_SYNCPT_CTRL_NO_STALL_1
|-
| 20
| TSEC_THI_INCR_SYNCPT_CTRL_SOFT_RESET_2
|-
| 21
| TSEC_THI_INCR_SYNCPT_CTRL_NO_STALL_2
|-
| 22
| TSEC_THI_INCR_SYNCPT_CTRL_SOFT_RESET_3
|-
| 23
| TSEC_THI_INCR_SYNCPT_CTRL_NO_STALL_3
|-
| 24
| TSEC_THI_INCR_SYNCPT_CTRL_SOFT_RESET_4
|-
| 25
| TSEC_THI_INCR_SYNCPT_CTRL_NO_STALL_4
|}

=== TSEC_THI_INCR_SYNCPT_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INCR_SYNCPT_ERR_COND_STS_IMM
|-
| 1
| TSEC_THI_INCR_SYNCPT_ERR_COND_STS_OPDONE
|-
| 2
| TSEC_THI_INCR_SYNCPT_ERR_COND_STS_RD_DONE
|-
| 3
| TSEC_THI_INCR_SYNCPT_ERR_COND_STS_REG_WR_SAFE
|-
| 4
| TSEC_THI_INCR_SYNCPT_ERR_COND_STS_ENGINE_IDLE
|}

=== TSEC_THI_CTXSW_INCR_SYNCPT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-9
| TSEC_THI_CTXSW_INCR_SYNCPT_INDX
|}

=== TSEC_THI_CTXSW ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-9
| TSEC_THI_CTXSW_CURR_CLASS
|-
| 10
| TSEC_THI_CTXSW_AUTO_ACK
|-
| 11-20
| TSEC_THI_CTXSW_CURR_CHANNEL
|}

=== TSEC_THI_CTXSW_NEXT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-9
| TSEC_THI_CTXSW_NEXT_NEXT_CLASS
|-
| 10-19
| TSEC_THI_CTXSW_NEXT_NEXT_CHANNEL
|}

=== TSEC_THI_CONT_SYNCPT_EOF ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-9
| TSEC_THI_CONT_SYNCPT_EOF_INDEX
|-
| 10
| TSEC_THI_CONT_SYNCPT_EOF_COND
|}

=== TSEC_THI_CONT_SYNCPT_L1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-9
| TSEC_THI_CONT_SYNCPT_L1_INDEX
|-
| 10
| TSEC_THI_CONT_SYNCPT_L1_COND
|}

=== TSEC_THI_STREAMID0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-6
| TSEC_THI_STREAMID0_ID
|}

=== TSEC_THI_STREAMID1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-6
| TSEC_THI_STREAMID1_ID
|}

=== TSEC_THI_THI_SEC ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_THI_SEC_TZ_LOCK
|-
| 4
| TSEC_THI_THI_SEC_TZ_AUTH
|-
| 8
| TSEC_THI_THI_SEC_CH_LOCK
|}

=== TSEC_THI_METHOD0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-11
| TSEC_THI_METHOD0_OFFSET
|}

Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

The following methods are available:
{| class="wikitable" border="1"
! ID
! Method
|-
| 0x100
| NOP
|-
| 0x140
| PM_TRIGGER
|-
| 0x200
| SET_APPLICATION_ID
|-
| 0x204
| SET_WATCHDOG_TIMER
|-
| 0x240
| SEMAPHORE_A
|-
| 0x244
| SEMAPHORE_B
|-
| 0x248
| SEMAPHORE_C
|-
| 0x24C
| CTX_SAVE_AREA
|-
| 0x250
| CTX_SWITCH
|-
| 0x300
| EXECUTE
|-
| 0x304
| SEMAPHORE_D
|-
| 0x500
| HDCP_INIT
|-
| 0x504
| HDCP_CREATE_SESSION
|-
| 0x508
| HDCP_VERIFY_CERT_RX
|-
| 0x50C
| HDCP_GENERATE_EKM
|-
| 0x510
| HDCP_REVOCATION_CHECK
|-
| 0x514
| HDCP_VERIFY_HPRIME
|-
| 0x518
| HDCP_ENCRYPT_PAIRING_INFO
|-
| 0x51C
| HDCP_DECRYPT_PAIRING_INFO
|-
| 0x520
| HDCP_UPDATE_SESSION
|-
| 0x524
| HDCP_GENERATE_LC_INIT
|-
| 0x528
| HDCP_VERIFY_LPRIME
|-
| 0x52C
| HDCP_GENERATE_SKE_INIT
|-
| 0x530
| HDCP_VERIFY_VPRIME
|-
| 0x534
| HDCP_ENCRYPTION_RUN_CTRL
|-
| 0x538
| HDCP_SESSION_CTRL
|-
| 0x53C
| HDCP_COMPUTE_SPRIME
|-
| 0x540
| HDCP_GET_CERT_RX
|-
| 0x544
| HDCP_EXCHANGE_INFO
|-
| 0x548
| HDCP_DECRYPT_KM
|-
| 0x54C
| HDCP_GET_HPRIME
|-
| 0x550
| HDCP_GENERATE_EKH_KM
|-
| 0x554
| HDCP_VERIFY_RTT_CHALLENGE
|-
| 0x558
| HDCP_GET_LPRIME
|-
| 0x55C
| HDCP_DECRYPT_KS
|-
| 0x560
| HDCP_DECRYPT
|-
| 0x564
| HDCP_GET_RRX
|-
| 0x568
| HDCP_DECRYPT_REENCRYPT
|-
| 0x56C
|
|-
| 0x570
|
|-
| 0x574
| HDCP_DECRYPT_STORED_KM
|-
| 0x578
| HDCP_GET_CURRENT_RESOLUTION
|-
| 0x57C
| HDCP_GET_CURRENT_VERSION
|-
| 0x700
| HDCP_VALIDATE_SRM
|-
| 0x704
| HDCP_VALIDATE_STREAM
|-
| 0x708
| HDCP_TEST_SECURE_STATUS
|-
| 0x70C
| HDCP_SET_DCP_KPUB
|-
| 0x710
| HDCP_SET_RX_KPUB
|-
| 0x714
| HDCP_SET_CERT_RX
|-
| 0x718
| HDCP_SET_SCRATCH_BUFFER
|-
| 0x71C
| HDCP_SET_SRM
|-
| 0x720
| HDCP_SET_RECEIVER_ID_LIST
|-
| 0x724
| HDCP_SET_SPRIME
|-
| 0x728
| HDCP_SET_ENC_INPUT_BUFFER
|-
| 0x72C
| HDCP_SET_ENC_OUTPUT_BUFFER
|-
| 0x730
| HDCP_GET_RTT_CHALLENGE
|-
| 0x734
| HDCP_STREAM_MANAGE
|-
| 0x738
| HDCP_READ_CAPS
|-
| 0x73C
| HDCP_ENCRYPT
|-
| 0x740
| [6.0.0+] HDCP_GET_CURRENT_NONCE
|-
| 0x1114
| PM_TRIGGER_END
|}

=== TSEC_THI_METHOD1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_THI_METHOD1_DATA
|}

Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_CONTEXT_SWITCH ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-27
| TSEC_THI_CONTEXT_SWITCH_PTR
|-
| 30-31
| TSEC_THI_CONTEXT_SWITCH_TARGET
|}

=== TSEC_THI_INT_STATUS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_STATUS_FALCON_INT
|}

=== TSEC_THI_INT_MASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_MASK_FALCON_INT
|}

=== TSEC_THI_CONFIG0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_CONFIG0_RETURN_SYNCPT_ON_ERR
|-
| 4
| TSEC_THI_CONFIG0_IDLE_SYNCPT_INC_ENG
|}

=== TSEC_THI_DBG_MISC ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_DBG_MISC_CLIENT_IDLE_STATUS
|-
| 1
| TSEC_THI_DBG_MISC_THI_IDLE_STATUS
|-
| 2
| TSEC_THI_DBG_MISC_THI_SYNCPT_PENDING_STATUS
|-
| 3
| TSEC_THI_DBG_MISC_THI_IDLE_EN
|}

=== TSEC_THI_SLCG_OVERRIDE_HIGH_A ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| TSEC_THI_SLCG_OVERRIDE_HIGH_A_REG
|}

=== TSEC_THI_SLCG_OVERRIDE_LOW_A ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_THI_SLCG_OVERRIDE_LOW_A_REG
|}

=== TSEC_THI_CLK_OVERRIDE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_THI_CLK_OVERRIDE_CYA
|}

=== TSEC_FALCON_IRQSSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_IRQSSET_GPTMR
|-
| 1
| TSEC_FALCON_IRQSSET_WDTMR
|-
| 2
| TSEC_FALCON_IRQSSET_MTHD
|-
| 3
| TSEC_FALCON_IRQSSET_CTXSW
|-
| 4
| TSEC_FALCON_IRQSSET_HALT
|-
| 5
| TSEC_FALCON_IRQSSET_EXTERR
|-
| 6
| TSEC_FALCON_IRQSSET_SWGEN0
|-
| 7
| TSEC_FALCON_IRQSSET_SWGEN1
|-
| 8-15
| TSEC_FALCON_IRQSSET_EXT
|-
| 16
| TSEC_FALCON_IRQSSET_DMA
|}

Used for setting Falcon's IRQs.

=== TSEC_FALCON_IRQSCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_IRQSCLR_GPTMR
|-
| 1
| TSEC_FALCON_IRQSCLR_WDTMR
|-
| 2
| TSEC_FALCON_IRQSCLR_MTHD
|-
| 3
| TSEC_FALCON_IRQSCLR_CTXSW
|-
| 4
| TSEC_FALCON_IRQSCLR_HALT
|-
| 5
| TSEC_FALCON_IRQSCLR_EXTERR
|-
| 6
| TSEC_FALCON_IRQSCLR_SWGEN0
|-
| 7
| TSEC_FALCON_IRQSCLR_SWGEN1
|-
| 8-15
| TSEC_FALCON_IRQSCLR_EXT
|-
| 16
| TSEC_FALCON_IRQSCLR_DMA
|}

Used for clearing Falcon's IRQs.

=== TSEC_FALCON_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_IRQSTAT_GPTMR
|-
| 1
| TSEC_FALCON_IRQSTAT_WDTMR
|-
| 2
| TSEC_FALCON_IRQSTAT_MTHD
|-
| 3
| TSEC_FALCON_IRQSTAT_CTXSW
|-
| 4
| TSEC_FALCON_IRQSTAT_HALT
|-
| 5
| TSEC_FALCON_IRQSTAT_EXTERR
|-
| 6
| TSEC_FALCON_IRQSTAT_SWGEN0
|-
| 7
| TSEC_FALCON_IRQSTAT_SWGEN1
|-
| 8-15
| TSEC_FALCON_IRQSTAT_EXT
|-
| 16
| TSEC_FALCON_IRQSTAT_DMA
|}

Used for getting the status of Falcon's IRQs.

=== TSEC_FALCON_IRQMODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_IRQMODE_LVL_GPTMR
|-
| 1
| TSEC_FALCON_IRQMODE_LVL_WDTMR
|-
| 2
| TSEC_FALCON_IRQMODE_LVL_MTHD
|-
| 3
| TSEC_FALCON_IRQMODE_LVL_CTXSW
|-
| 4
| TSEC_FALCON_IRQMODE_LVL_HALT
|-
| 5
| TSEC_FALCON_IRQMODE_LVL_EXTERR
|-
| 6
| TSEC_FALCON_IRQMODE_LVL_SWGEN0
|-
| 7
| TSEC_FALCON_IRQMODE_LVL_SWGEN1
|-
| 8-15
| TSEC_FALCON_IRQMODE_LVL_EXT
|-
| 16
| TSEC_FALCON_IRQMODE_LVL_DMA
|}

Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.

=== TSEC_FALCON_IRQMSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_IRQMSET_GPTMR
|-
| 1
| TSEC_FALCON_IRQMSET_WDTMR
|-
| 2
| TSEC_FALCON_IRQMSET_MTHD
|-
| 3
| TSEC_FALCON_IRQMSET_CTXSW
|-
| 4
| TSEC_FALCON_IRQMSET_HALT
|-
| 5
| TSEC_FALCON_IRQMSET_EXTERR
|-
| 6
| TSEC_FALCON_IRQMSET_SWGEN0
|-
| 7
| TSEC_FALCON_IRQMSET_SWGEN1
|-
| 8-15
| TSEC_FALCON_IRQMSET_EXT
|-
| 16
| TSEC_FALCON_IRQMSET_DMA
|}

Used for setting the mask for Falcon's IRQs.

=== TSEC_FALCON_IRQMCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_IRQMCLR_GPTMR
|-
| 1
| TSEC_FALCON_IRQMCLR_WDTMR
|-
| 2
| TSEC_FALCON_IRQMCLR_MTHD
|-
| 3
| TSEC_FALCON_IRQMCLR_CTXSW
|-
| 4
| TSEC_FALCON_IRQMCLR_HALT
|-
| 5
| TSEC_FALCON_IRQMCLR_EXTERR
|-
| 6
| TSEC_FALCON_IRQMCLR_SWGEN0
|-
| 7
| TSEC_FALCON_IRQMCLR_SWGEN1
|-
| 8-15
| TSEC_FALCON_IRQMCLR_EXT
|-
| 16
| TSEC_FALCON_IRQMCLR_DMA
|}

Used for clearing the mask for Falcon's IRQs.

=== TSEC_FALCON_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_IRQMASK_GPTMR
|-
| 1
| TSEC_FALCON_IRQMASK_WDTMR
|-
| 2
| TSEC_FALCON_IRQMASK_MTHD
|-
| 3
| TSEC_FALCON_IRQMASK_CTXSW
|-
| 4
| TSEC_FALCON_IRQMASK_HALT
|-
| 5
| TSEC_FALCON_IRQMASK_EXTERR
|-
| 6
| TSEC_FALCON_IRQMASK_SWGEN0
|-
| 7
| TSEC_FALCON_IRQMASK_SWGEN1
|-
| 8-15
| TSEC_FALCON_IRQMASK_EXT
|-
| 16
| TSEC_FALCON_IRQMASK_DMA
|}

Used for getting the value of the mask for Falcon's IRQs.

=== TSEC_FALCON_IRQDEST ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_IRQDEST_HOST_GPTMR
|-
| 1
| TSEC_FALCON_IRQDEST_HOST_WDTMR
|-
| 2
| TSEC_FALCON_IRQDEST_HOST_MTHD
|-
| 3
| TSEC_FALCON_IRQDEST_HOST_CTXSW
|-
| 4
| TSEC_FALCON_IRQDEST_HOST_HALT
|-
| 5
| TSEC_FALCON_IRQDEST_HOST_EXTERR
|-
| 6
| TSEC_FALCON_IRQDEST_HOST_SWGEN0
|-
| 7
| TSEC_FALCON_IRQDEST_HOST_SWGEN1
|-
| 8-15
| TSEC_FALCON_IRQDEST_HOST_EXT
|-
| 16
| TSEC_FALCON_IRQDEST_TARGET_GPTMR
|-
| 17
| TSEC_FALCON_IRQDEST_TARGET_WDTMR
|-
| 18
| TSEC_FALCON_IRQDEST_TARGET_MTHD
|-
| 19
| TSEC_FALCON_IRQDEST_TARGET_CTXSW
|-
| 20
| TSEC_FALCON_IRQDEST_TARGET_HALT
|-
| 21
| TSEC_FALCON_IRQDEST_TARGET_EXTERR
|-
| 22
| TSEC_FALCON_IRQDEST_TARGET_SWGEN0
|-
| 23
| TSEC_FALCON_IRQDEST_TARGET_SWGEN1
|-
| 24-31
| TSEC_FALCON_IRQDEST_TARGET_EXT
|}

Used for routing Falcon's IRQs.

=== TSEC_FALCON_GPTMRINT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_GPTMRINT_VAL
|}

=== TSEC_FALCON_GPTMRVAL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_GPTMRVAL_VAL
|}

=== TSEC_FALCON_GPTMRCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_GPTMRCTL_GPTMREN
|}

=== TSEC_FALCON_PTIMER0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_PTIMER0_VAL
|}

=== TSEC_FALCON_PTIMER1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_PTIMER1_VAL
|}

=== TSEC_FALCON_WDTMRVAL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_WDTMRVAL_VAL
|}

=== TSEC_FALCON_WDTMRCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_WDTMRCTL_WDTMREN
|}

=== TSEC_FALCON_IRQDEST2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_IRQDEST2_HOST_DMA
|-
| 16
| TSEC_FALCON_IRQDEST2_TARGET_DMA
|}

Used for routing Falcon's IRQs.

=== TSEC_FALCON_MAILBOX0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_MAILBOX0_DATA
|}

Scratch register for reading/writing data to Falcon.

=== TSEC_FALCON_MAILBOX1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_MAILBOX1_DATA
|}

Scratch register for reading/writing data to Falcon.

=== TSEC_FALCON_ITFEN ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_ITFEN_CTXEN
|-
| 1
| TSEC_FALCON_ITFEN_MTHDEN
|}

Used for enabling/disabling Falcon interfaces.

=== TSEC_FALCON_IDLESTATE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_IDLESTATE_FALCON_BUSY
|-
| 1-15
| TSEC_FALCON_IDLESTATE_EXT_BUSY
|}

Used for detecting if Falcon is busy or not.

=== TSEC_FALCON_CURCTX ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-27
| TSEC_FALCON_CURCTX_CTXPTR
|-
| 28-29
| TSEC_FALCON_CURCTX_CTXTGT
|-
| 30
| TSEC_FALCON_CURCTX_CTXVLD
|}

=== TSEC_FALCON_NXTCTX ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-27
| TSEC_FALCON_NXTCTX_CTXPTR
|-
| 28-29
| TSEC_FALCON_NXTCTX_CTXTGT
|-
| 30
| TSEC_FALCON_NXTCTX_CTXVLD
|}

=== TSEC_FALCON_CTXACK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_CTXACK_SAVE_ACK
|-
| 1
| TSEC_FALCON_CTXACK_REST_ACK
|}

=== TSEC_FALCON_FHSTATE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_FHSTATE_FALCON_HALTED
|-
| 1-15
| TSEC_FALCON_FHSTATE_EXT_HALTED
|-
| 16
| TSEC_FALCON_FHSTATE_ENGINE_FAULTED
|-
| 17
| TSEC_FALCON_FHSTATE_STALL_REQ
|}

=== TSEC_FALCON_PRIVSTATE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_PRIVSTATE_PRIV
|}

=== TSEC_FALCON_MTHDDATA ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_MTHDDATA_DATA
|}

=== TSEC_FALCON_MTHDID ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-11
| TSEC_FALCON_MTHDID_ID
|-
| 12-14
| TSEC_FALCON_MTHDID_SUBCH
|-
| 15
| TSEC_FALCON_MTHDID_PRIV
|-
| 16
| TSEC_FALCON_MTHDID_WPEND
|}

=== TSEC_FALCON_MTHDWDAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_MTHDWDAT_DATA
|}

=== TSEC_FALCON_MTHDCOUNT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_FALCON_MTHDCOUNT_COUNT
|}

=== TSEC_FALCON_MTHDPOP ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_MTHDPOP_POP
|}

=== TSEC_FALCON_MTHDRAMSZ ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_FALCON_MTHDRAMSZ_RAMSZ
|}

=== TSEC_FALCON_SFTRESET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_SFTRESET_EXT
|}

=== TSEC_FALCON_OS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_OS_VERSION
|}

=== TSEC_FALCON_RM ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_RM_CONFIG
|}

=== TSEC_FALCON_SOFT_PM ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-5
| TSEC_FALCON_SOFT_PM_PROBE
|-
| 16
| TSEC_FALCON_SOFT_PM_TRIGGER_END
|-
| 17
| TSEC_FALCON_SOFT_PM_TRIGGER_START
|}

=== TSEC_FALCON_SOFT_MODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-5
| TSEC_FALCON_SOFT_MODE_PROBE
|}

=== TSEC_FALCON_DEBUG1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_FALCON_DEBUG1_MTHD_DRAIN_TIME
|-
| 16
| TSEC_FALCON_DEBUG1_CTXSW_MODE
|-
| 17
| TSEC_FALCON_DEBUG1_TRACE_FORMAT
|}

=== TSEC_FALCON_DEBUGINFO ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_DEBUGINFO_DATA
|}

Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.

[6.0.0+] [[NV_services|nvservices]] sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.

=== TSEC_FALCON_IBRKPT1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-23
| TSEC_FALCON_IBRKPT1_PC
|-
| 29
| TSEC_FALCON_IBRKPT1_SUPPRESS
|-
| 30
| TSEC_FALCON_IBRKPT1_SKIP
|-
| 31
| TSEC_FALCON_IBRKPT1_EN
|}

=== TSEC_FALCON_IBRKPT2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-23
| TSEC_FALCON_IBRKPT2_PC
|-
| 29
| TSEC_FALCON_IBRKPT2_SUPPRESS
|-
| 30
| TSEC_FALCON_IBRKPT2_SKIP
|-
| 31
| TSEC_FALCON_IBRKPT2_EN
|}

=== TSEC_FALCON_CGCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_CGCTL_CG_OVERRIDE
|}

=== TSEC_FALCON_ENGCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_ENGCTL_INV_CONTEXT
|-
| 1
| TSEC_FALCON_ENGCTL_SET_STALLREQ
|-
| 2
| TSEC_FALCON_ENGCTL_CLR_STALLREQ
|-
| 3
| TSEC_FALCON_ENGCTL_SWITCH_CONTEXT
|-
| 8
| TSEC_FALCON_ENGCTL_STALLREQ
|-
| 9
| TSEC_FALCON_ENGCTL_STALLACK
|}

=== TSEC_FALCON_PMM ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-4
| TSEC_FALCON_PMM_FALCON_STALL_SEL
0x00: ANY
0x01: CODE
0x02: DMAQ
0x03: DMFENCE
0x04: DMWAIT
0x05: IMWAIT
0x06: IPND
0x07: LDSTQ
0x08: SB
0x09: ANY_SC
0x0A: CODE_SC
0x0B: DMAQ_SC
0x0C: DMFENCE_SC
0x0D: DMWAIT_SC
0x0E: IMWAIT_SC
0x0F: IPND_SC
0x10: LDSTQ_SC
0x11: SB_SC
|-
| 5-7
| TSEC_FALCON_PMM_FALCON_IDLE_SEL
0x00: WAITING
0x01: ENG_IDLE
0x02: MTHD_FULL
0x03: WAITING_SC
0x04: ENG_IDLE_SC
0x05: MTHD_FULL_SC
|-
| 8-11
| TSEC_FALCON_PMM_FALCON_SOFTPM0_SEL
0x00: 0
0x01: 1
0x02: 2
0x03: 3
0x04: 4
0x05: 5
0x06: 0_SC
0x07: 1_SC
0x08: 2_SC
0x09: 3_SC
0x0A: 4_SC
0x0B: 5_SC
|-
| 12-15
| TSEC_FALCON_PMM_FALCON_SOFTPM1_SEL
0x00: 0
|-
| 17-19
| TSEC_FALCON_PMM_TFBIF_DSTAT_SEL
0x00: 1KTRANSFER
0x01: RREQ
0x02: WREQ
0x03: TWREQ
0x04: 1KTRANSFER_SC
0x05: RREQ_SC
0x06: WREQ_SC
0x07: TWREQ_SC
|-
| 20-23
| TSEC_FALCON_PMM_TFBIF_STALL0_SEL
0x00: RDATQ_FULL
0x01: RACKQ_FULL
0x02: WREQQ_FULL
0x03: WDATQ_FULL
0x04: WACKQ_FULL
0x05: MREQQ_FULL
0x06: RREQ_PEND
0x07: WREQ_PEND
0x08: RDATQ_FULL_SC
0x09: RACKQ_FULL_SC
0x0A: WREQQ_FULL_SC
0x0B: WDATQ_FULL_SC
0x0C: WACKQ_FULL_SC
0x0D: MREQQ_FULL_SC
0x0E: RREQ_PEND_SC
0x0F: WREQ_PEND_SC
|-
| 24-27
| TSEC_FALCON_PMM_TFBIF_STALL1_SEL
0x00: RDATQ_FULL
|-
| 28-31
| TSEC_FALCON_PMM_TFBIF_STALL2_SEL
0x00: RDATQ_FULL
|}

=== TSEC_FALCON_ADDR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-5
| TSEC_FALCON_ADDR_LSB
|-
| 6-11
| TSEC_FALCON_ADDR_MSB
|}

=== TSEC_FALCON_IBRKPT3 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-23
| TSEC_FALCON_IBRKPT3_PC
|-
| 29
| TSEC_FALCON_IBRKPT3_SUPPRESS
|-
| 30
| TSEC_FALCON_IBRKPT3_SKIP
|-
| 31
| TSEC_FALCON_IBRKPT3_EN
|}

=== TSEC_FALCON_IBRKPT4 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-23
| TSEC_FALCON_IBRKPT4_PC
|-
| 29
| TSEC_FALCON_IBRKPT4_SUPPRESS
|-
| 30
| TSEC_FALCON_IBRKPT4_SKIP
|-
| 31
| TSEC_FALCON_IBRKPT4_EN
|}

=== TSEC_FALCON_IBRKPT5 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-23
| TSEC_FALCON_IBRKPT5_PC
|-
| 29
| TSEC_FALCON_IBRKPT5_SUPPRESS
|-
| 30
| TSEC_FALCON_IBRKPT5_SKIP
|-
| 31
| TSEC_FALCON_IBRKPT5_EN
|}

=== TSEC_FALCON_EXCI ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-19
| TSEC_FALCON_EXCI_EXPC
|-
| 20-23
| TSEC_FALCON_EXCI_EXCAUSE
0x00: TRAP0
0x01: TRAP1
0x02: TRAP2
0x03: TRAP3
0x08: ILL_INS (invalid opcode)
0x09: INV_INS (authentication entry)
0x0A: MISS_INS (page miss)
0x0B: DHIT_INS (page multiple hit)
0x0F: BRKPT_INS (breakpoint hit)
|}

Contains information about raised exceptions.

=== TSEC_FALCON_SVEC_SPR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 18
| TSEC_FALCON_SVEC_SPR_SIGPASS
|}

=== TSEC_FALCON_RSTAT0 ===
Mirror of the [[#TSEC_FALCON_ICD_RDATA|ICD status register 0]].

=== TSEC_FALCON_RSTAT3 ===
Mirror of the [[#TSEC_FALCON_ICD_RDATA|ICD status register 3]].

=== TSEC_FALCON_CPUCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_CPUCTL_IINVAL
|-
| 1
| TSEC_FALCON_CPUCTL_STARTCPU
|-
| 2
| TSEC_FALCON_CPUCTL_SRESET
|-
| 3
| TSEC_FALCON_CPUCTL_HRESET
|-
| 4
| TSEC_FALCON_CPUCTL_HALTED
|-
| 5
| TSEC_FALCON_CPUCTL_STOPPED
|-
| 6
| TSEC_FALCON_CPUCTL_ALIAS_EN
|}

Used for signaling the Falcon CPU.

=== TSEC_FALCON_BOOTVEC ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_BOOTVEC_VEC
|}

Takes the Falcon's boot vector address.

=== TSEC_FALCON_HWCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-8
| TSEC_FALCON_HWCFG_IMEM_SIZE
|-
| 9-17
| TSEC_FALCON_HWCFG_DMEM_SIZE
|-
| 18-26
| TSEC_FALCON_HWCFG_METHODFIFO_DEPTH
|-
| 27-31
| TSEC_FALCON_HWCFG_DMAQUEUE_DEPTH
|}

=== TSEC_FALCON_DMACTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_DMACTL_REQUIRE_CTX
|-
| 1
| TSEC_FALCON_DMACTL_DMEM_SCRUBBING
|-
| 2
| TSEC_FALCON_DMACTL_IMEM_SCRUBBING
|-
| 3-6
| TSEC_FALCON_DMACTL_DMAQ_NUM
|-
| 7
| TSEC_FALCON_DMACTL_SECURE_STAT
|}

Used for configuring the Falcon's DMA engine.

=== TSEC_FALCON_DMATRFBASE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_DMATRFBASE_BASE
|}

Base address of the external memory buffer, shifted right by 8.

The current transfer address is calculated by adding [[#TSEC_FALCON_DMATRFFBOFFS|TSEC_FALCON_DMATRFFBOFFS]] to the base.

=== TSEC_FALCON_DMATRFMOFFS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_FALCON_DMATRFMOFFS_OFFS
|}

For transfers to DMEM: the destination address.
For transfers to IMEM: the destination virtual IMEM page.

=== TSEC_FALCON_DMATRFCMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_DMATRFCMD_FULL
|-
| 1
| TSEC_FALCON_DMATRFCMD_IDLE
|-
| 2-3
| TSEC_FALCON_DMATRFCMD_SEC
|-
| 4
| TSEC_FALCON_DMATRFCMD_IMEM
|-
| 5
| TSEC_FALCON_DMATRFCMD_WRITE
|-
| 8-10
| TSEC_FALCON_DMATRFCMD_SIZE
|-
| 12-14
| TSEC_FALCON_DMATRFCMD_CTXDMA
|}

Used for configuring DMA transfers.

=== TSEC_FALCON_DMATRFFBOFFS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_DMATRFFBOFFS_OFFS
|}

For transfers to IMEM: the destination physical IMEM page.

=== TSEC_FALCON_DMAPOLL_FB ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_DMAPOLL_FB_FENCE_ACTIVE
|-
| 1
| TSEC_FALCON_DMAPOLL_FB_DMA_ACTIVE
|-
| 4
| TSEC_FALCON_DMAPOLL_FB_CFG_R_FENCE
|-
| 5
| TSEC_FALCON_DMAPOLL_FB_CFG_W_FENCE
|-
| 16-23
| TSEC_FALCON_DMAPOLL_FB_WCOUNT
|-
| 24-31
| TSEC_FALCON_DMAPOLL_FB_RCOUNT
|}

Contains the status of a DMA transfer between the Falcon and external memory.

=== TSEC_FALCON_DMAPOLL_CP ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_DMAPOLL_CP_FENCE_ACTIVE
|-
| 1
| TSEC_FALCON_DMAPOLL_CP_DMA_ACTIVE
|-
| 4
| TSEC_FALCON_DMAPOLL_CP_CFG_R_FENCE
|-
| 5
| TSEC_FALCON_DMAPOLL_CP_CFG_W_FENCE
|-
| 16-23
| TSEC_FALCON_DMAPOLL_CP_WCOUNT
|-
| 24-31
| TSEC_FALCON_DMAPOLL_CP_RCOUNT
|}

Contains the status of a DMA transfer between the Falcon and the SCP.

=== TSEC_FALCON_HWCFG1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| TSEC_FALCON_HWCFG1_CORE_REV
|-
| 4-5
| TSEC_FALCON_HWCFG1_SECURITY_MODEL
|-
| 6-7
| TSEC_FALCON_HWCFG1_CORE_REV_SUBVERSION
|-
| 8-11
| TSEC_FALCON_HWCFG1_IMEM_PORTS
|-
| 12-15
| TSEC_FALCON_HWCFG1_DMEM_PORTS
|-
| 16-20
| TSEC_FALCON_HWCFG1_TAG_WIDTH
|-
| 27
| TSEC_FALCON_HWCFG1_DBG_PRIV_BUS
|-
| 28
| TSEC_FALCON_HWCFG1_CSB_SIZE_16M
|-
| 29
| TSEC_FALCON_HWCFG1_PRIV_DIRECT
|-
| 30
| TSEC_FALCON_HWCFG1_DMEM_APERTURES
|-
| 31
| TSEC_FALCON_HWCFG1_IMEM_AUTOFILL
|}

=== TSEC_FALCON_CPUCTL_ALIAS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_FALCON_CPUCTL_ALIAS_STARTCPU
|}

=== TSEC_FALCON_STACKCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_FALCON_STACKCFG_BOTTOM
|-
| 31
| TSEC_FALCON_STACKCFG_SPEXC
|}

=== TSEC_FALCON_IMCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-23
| TSEC_FALCON_IMCTL_ADDR_BLK
|-
| 24-26
| TSEC_FALCON_IMCTL_CMD
0x00: NOP
0x01: IMINV (ITLB)
0x02: IMBLK (PTLB)
0x03: IMTAG (VTLB)
0x04: IMTAG_SETVLD
|}

Controls the Falcon TLB.

=== TSEC_FALCON_IMSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_IMSTAT_VAL
|}

Returns the result of the last command from [[#TSEC_FALCON_IMCTL|TSEC_FALCON_IMCTL]].

=== TSEC_FALCON_TRACEIDX ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| TSEC_FALCON_TRACEIDX_IDX
|-
| 16-23
| TSEC_FALCON_TRACEIDX_MAXIDX
|-
| 24-31
| TSEC_FALCON_TRACEIDX_CNT
|}

Controls the index for tracing with [[#TSEC_FALCON_TRACEPC|TSEC_FALCON_TRACEPC]].

=== TSEC_FALCON_TRACEPC ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-23
| TSEC_FALCON_TRACEPC_PC
|}

Returns the PC of the last call or branch executed.

=== TSEC_FALCON_IMFILLRNG0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_FALCON_IMFILLRNG0_TAG_LO
|-
| 16-31
| TSEC_FALCON_IMFILLRNG0_TAG_HI
|}

=== TSEC_FALCON_IMFILLRNG1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_FALCON_IMFILLRNG1_TAG_LO
|-
| 16-31
| TSEC_FALCON_IMFILLRNG1_TAG_HI
|}

=== TSEC_FALCON_IMFILLCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| TSEC_FALCON_IMFILLCTL_NBLOCKS
|}

=== TSEC_FALCON_IMCTL_DEBUG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-23
| TSEC_FALCON_IMCTL_DEBUG_ADDR_BLK
|-
| 24-26
| TSEC_FALCON_IMCTL_DEBUG_CMD
0x00: NOP
0x02: IMBLK
0x03: IMTAG
|}

=== TSEC_FALCON_CMEMBASE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 18-31
| TSEC_FALCON_CMEMBASE_VAL
|}

=== TSEC_FALCON_DMEMAPERT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| TSEC_FALCON_DMEMAPERT_TIME_OUT
|-
| 8-11
| TSEC_FALCON_DMEMAPERT_TIME_UNIT
|-
| 16
| TSEC_FALCON_DMEMAPERT_ENABLE
|-
| 17-19
| TSEC_FALCON_DMEMAPERT_LDSTQ_NUM
|}

=== TSEC_FALCON_EXTERRADDR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_EXTERRADDR_ADDR
|}

=== TSEC_FALCON_EXTERRSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-23
| TSEC_FALCON_EXTERRSTAT_PC
|-
| 24-27
| TSEC_FALCON_EXTERRSTAT_STAT
|-
| 31
| TSEC_FALCON_EXTERRSTAT_VALID
|}

=== TSEC_FALCON_CG2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_FALCON_CG2_SLCG_FALCON_DMA
|-
| 2
| TSEC_FALCON_CG2_SLCG_FALCON_GC6_SR_FSM
|-
| 3
| TSEC_FALCON_CG2_SLCG_FALCON_PIPE
|-
| 4
| TSEC_FALCON_CG2_SLCG_FALCON_DIV
|-
| 5
| TSEC_FALCON_CG2_SLCG_FALCON_ICD
|-
| 6
| TSEC_FALCON_CG2_SLCG_FALCON_CFG
|-
| 7
| TSEC_FALCON_CG2_SLCG_FALCON_CTXSW
|-
| 8
| TSEC_FALCON_CG2_SLCG_FALCON_PMB
|-
| 9
| TSEC_FALCON_CG2_SLCG_FALCON_RF
|-
| 10
| TSEC_FALCON_CG2_SLCG_FALCON_MUL
|-
| 11
| TSEC_FALCON_CG2_SLCG_FALCON_LDST
|-
| 12
| TSEC_FALCON_CG2_SLCG_FALCON_TSYNC
|-
| 13
| TSEC_FALCON_CG2_SLCG_FALCON_GPTMR
|-
| 14
| TSEC_FALCON_CG2_SLCG_FALCON_WDTMR
|-
| 15
| TSEC_FALCON_CG2_SLCG_FALCON_IRQSTAT
|-
| 16
| TSEC_FALCON_CG2_SLCG_FALCON_TOP
|-
| 17
| TSEC_FALCON_CG2_SLCG_FBIF
|}

=== TSEC_FALCON_IMEMC ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 2-7
| TSEC_FALCON_IMEMC_OFFS
|-
| 8-15
| TSEC_FALCON_IMEMC_BLK
|-
| 24
| TSEC_FALCON_IMEMC_AINCW
|-
| 25
| TSEC_FALCON_IMEMC_AINCR
|-
| 28
| TSEC_FALCON_IMEMC_SECURE
|-
| 29
| TSEC_FALCON_IMEMC_SEC_ATOMIC
|-
| 30
| TSEC_FALCON_IMEMC_SEC_WR_VIO
|-
| 31
| TSEC_FALCON_IMEMC_SEC_LOCK
|}

Used for configuring access to Falcon's IMEM.

=== TSEC_FALCON_IMEMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_IMEMD_DATA
|}

Returns or takes the value for an IMEM read/write operation.

=== TSEC_FALCON_IMEMT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_FALCON_IMEMT_TAG
|}

Returns or takes the virtual page index for an IMEM read/write operation.

=== TSEC_FALCON_DMEMC ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 2-7
| TSEC_FALCON_DMEMC_OFFS
|-
| 8-15
| TSEC_FALCON_DMEMC_BLK
|-
| 24
| TSEC_FALCON_DMEMC_AINCW
|-
| 25
| TSEC_FALCON_DMEMC_AINCR
|}

Used for configuring access to Falcon's DMEM.

=== TSEC_FALCON_DMEMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_DMEMD_DATA
|}

Returns or takes the value for a DMEM read/write operation.

=== TSEC_FALCON_ICD_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| TSEC_FALCON_ICD_CMD_OPC
0x00: STOP
0x01: RUN (run from PC)
0x02: JRUN (run from address)
0x03: RUNB (run from PC)
0x04: JRUNB (run from address)
0x05: STEP (step from PC)
0x06: JSTEP (step from address)
0x07: EMASK (set exception mask)
0x08: RREG (read register)
0x09: WREG (write register)
0x0A: RDM (read data memory)
0x0B: WDM (write data memory)
0x0C: RCM (read MMIO/configuration memory)
0x0D: WCM (write MMIO/configuration memory)
0x0E: RSTAT (read status)
0x0F: SBU (store buffer update)
|-
| 6-7
| TSEC_FALCON_ICD_CMD_SZ
0x00: B (byte)
0x01: HW (half word)
0x02: W (word)
|-
| 8-12
| TSEC_FALCON_ICD_CMD_IDX
0x00: REG0 | RSTAT0 | WB0
0x01: REG1 | RSTAT1 | WB1
0x02: REG2 | RSTAT2 | WB2
0x03: REG3 | RSTAT3 | WB3
0x04: REG4 | RSTAT4
0x05: REG5 | RSTAT5
0x06: REG6
0x07: REG7
0x08: REG8
0x09: REG9
0x0A: REG10
0x0B: REG11
0x0C: REG12
0x0D: REG13
0x0E: REG14
0x0F: REG15
0x10: IV0
0x11: IV1
0x12: UNDEFINED
0x13: EV
0x14: SP
0x15: PC
0x16: IMB
0x17: DMB
0x18: CSW
0x19: CCR
0x1A: SEC
0x1B: CTX
0x1C: EXCI
0x1D: SEC1
0x1E: IMB1
0x1F: DMB1
|-
| 14
| TSEC_FALCON_ICD_CMD_ERROR
|-
| 15
| TSEC_FALCON_ICD_CMD_RDVLD
|-
| 16-31
| TSEC_FALCON_ICD_CMD_PARM
0x0001: EMASK_TRAP0
0x0002: EMASK_TRAP1
0x0004: EMASK_TRAP2
0x0008: EMASK_TRAP3
0x0010: EMASK_EXC_UNIMP
0x0020: EMASK_EXC_IMISS
0x0040: EMASK_EXC_IMHIT
0x0080: EMASK_EXC_IBREAK
0x0100: EMASK_IV0
0x0200: EMASK_IV1
0x0400: EMASK_IV2
0x0800: EMASK_EXT0
0x1000: EMASK_EXT1
0x2000: EMASK_EXT2
0x4000: EMASK_EXT3
0x8000: EMASK_EXT4
|}

Used for sending commands to the Falcon's in-chip debugger.

=== TSEC_FALCON_ICD_ADDR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_ICD_ADDR_ADDR
|}

Takes the target address for the Falcon's in-chip debugger.

=== TSEC_FALCON_ICD_WDATA ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_ICD_WDATA_DATA
|}

Takes the data for writing using the Falcon's in-chip debugger.

=== TSEC_FALCON_ICD_RDATA ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_ICD_RDATA_DATA
|}

Returns the data read using the Falcon's in-chip debugger.

When reading from an internal status register (STAT), the following applies:
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| RSTAT0_MEM_STALL
|-
| 1
| RSTAT0_DMA_STALL
|-
| 2
| RSTAT0_FENCE_STALL
|-
| 3
| RSTAT0_DIV_STALL
|-
| 4
| RSTAT0_DMA_STALL_DMAQ
|-
| 5
| RSTAT0_DMA_STALL_DMWAITING
|-
| 6
| RSTAT0_DMA_STALL_IMWAITING
|-
| 7
| RSTAT0_ANY_STALL
|-
| 8
| RSTAT0_SBFULL_STALL
|-
| 9
| RSTAT0_SBHIT_STALL
|-
| 10
| RSTAT0_FLOW_STALL
|-
| 11
| RSTAT0_SP_STALL
|-
| 12
| RSTAT0_BL_STALL
|-
| 13
| RSTAT0_IPND_STALL
|-
| 14
| RSTAT0_LDSTQ_STALL
|-
| 16
| RSTAT0_NOINSTR_STALL
|-
| 20
| RSTAT0_HALTSTOP_FLUSH
|-
| 21
| RSTAT0_AFILL_FLUSH
|-
| 22
| RSTAT0_EXC_FLUSH
|-
| 23-25
| RSTAT0_IRQ_FLUSH
|-
| 28
| RSTAT0_VALIDRD
|-
| 29
| RSTAT0_WAITING
|-
| 30
| RSTAT0_HALTED
|-
| 31
| RSTAT0_MTHD_FULL
|}
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| RSTAT1_WB_ALLOC
|-
| 4-7
| RSTAT1_WB_VALID
|-
| 8-9
| RSTAT1_WB0_SZ
|-
| 10-11
| RSTAT1_WB1_SZ
|-
| 12-13
| RSTAT1_WB2_SZ
|-
| 14-15
| RSTAT1_WB3_SZ
|-
| 16-19
| RSTAT1_WB0_IDX
|-
| 20-23
| RSTAT1_WB1_IDX
|-
| 24-27
| RSTAT1_WB2_IDX
|-
| 28-31
| RSTAT1_WB3_IDX
|}
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| RSTAT2_DMAQ_NUM
|-
| 4
| RSTAT2_DMA_ENABLE
|-
| 5-7
| RSTAT2_LDSTQ_NUM
|-
| 16-19
| RSTAT2_EM_BUSY
|-
| 20-23
| RSTAT2_EM_ACKED
|-
| 24-27
| RSTAT2_EM_ISWR
|-
| 28-31
| RSTAT2_EM_DVLD
|}
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| RSTAT3_MTHD_IDLE
|-
| 1
| RSTAT3_CTXSW_IDLE
|-
| 2
| RSTAT3_DMA_IDLE
|-
| 3
| RSTAT3_SCP_IDLE
|-
| 4
| RSTAT3_LDST_IDLE
|-
| 5
| RSTAT3_SBWB_EMPTY
|-
| 6-8
| RSTAT3_CSWIE
|-
| 10
| RSTAT3_CSWE
|-
| 12-14
| RSTAT3_CTXSW_STATE
0x00: IDLE
0x01: SM_CHECK
0x02: SM_SAVE
0x03: SM_SAVE_WAIT
0x04: SM_BLK_BIND
0x05: SM_RESET
0x06: SM_RESETWAIT
0x07: SM_ACK
|-
| 15
| RSTAT3_CTXSW_PEND
|-
| 17
| RSTAT3_DMA_FBREQ_IDLE
|-
| 18
| RSTAT3_DMA_ACKQ_EMPTY
|-
| 19
| RSTAT3_DMA_RDQ_EMPTY
|-
| 20
| RSTAT3_DMA_WR_BUSY
|-
| 21
| RSTAT3_DMA_RD_BUSY
|-
| 22
| RSTAT3_LDST_XT_BUSY
|-
| 23
| RSTAT3_LDST_XT_BLOCK
|-
| 24
| RSTAT3_ENG_IDLE
|}
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| RSTAT4_ICD_STATE
0x00: NORMAL
0x01: WAIT_ISSUE_CLEAR
0x02: WAIT_EXLDQ_CLEAR
0x03: FULL_DBG_MODE
|-
| 2-3
| RSTAT4_ICD_MODE
0x00: SUPPRESSICD
0x01: ENTERICD_IBRK
0x02: ENTERICD_STEP
|-
| 16
| RSTAT4_ICD_EMASK_TRAP0
|-
| 17
| RSTAT4_ICD_EMASK_TRAP1
|-
| 18
| RSTAT4_ICD_EMASK_TRAP2
|-
| 19
| RSTAT4_ICD_EMASK_TRAP3
|-
| 20
| RSTAT4_ICD_EMASK_EXC_UNIMP
|-
| 21
| RSTAT4_ICD_EMASK_EXC_IMISS
|-
| 22
| RSTAT4_ICD_EMASK_EXC_IMHIT
|-
| 23
| RSTAT4_ICD_EMASK_EXC_IBREAK
|-
| 24
| RSTAT4_ICD_EMASK_IV0
|-
| 25
| RSTAT4_ICD_EMASK_IV1
|-
| 26
| RSTAT4_ICD_EMASK_IV2
|-
| 27
| RSTAT4_ICD_EMASK_EXT0
|-
| 28
| RSTAT4_ICD_EMASK_EXT1
|-
| 29
| RSTAT4_ICD_EMASK_EXT2
|-
| 30
| RSTAT4_ICD_EMASK_EXT3
|-
| 31
| RSTAT4_ICD_EMASK_EXT4
|}
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| RSTAT5_LRU_STATE
|}

=== TSEC_FALCON_SCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_SCTL_LSMODE
|-
| 1
| TSEC_FALCON_SCTL_HSMODE
|-
| 4-5
| Unknown
|-
| 12-13
| Unknown
|-
| 14
| Initialize the transition to LS mode
|}

=== TSEC_FALCON_SSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 30
| Unknown
|-
| 31
| Set on memory protection violation
|}

=== TSEC_FALCON_SPROT_IMEM ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Read access level
|-
| 4-7
| Write access level
|}

Controls accesses to Falcon IMEM.

=== TSEC_FALCON_SPROT_DMEM ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Read access level
|-
| 4-7
| Write access level
|}

Controls accesses to Falcon DMEM.

=== TSEC_FALCON_SPROT_CPUCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Read access level
|-
| 4-7
| Write access level
|}

Controls accesses to the [[#TSEC_FALCON_CPUCTL|TSEC_FALCON_CPUCTL]] register.

=== TSEC_FALCON_SPROT_MISC ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Read access level
|-
| 4-7
| Write access level
|}

Controls accesses to the following registers:
* [[#TSEC_FALCON_PRIVSTATE|TSEC_FALCON_PRIVSTATE]]
* [[#TSEC_FALCON_SFTRESET|TSEC_FALCON_SFTRESET]]
* [[#TSEC_FALCON_ADDR|TSEC_FALCON_ADDR]]
* [[#TSEC_FALCON_DMACTL|TSEC_FALCON_DMACTL]]
* [[#TSEC_FALCON_IMCTL|TSEC_FALCON_IMCTL]]
* [[#TSEC_FALCON_IMSTAT|TSEC_FALCON_IMSTAT]]
* TSEC_FALCON_UNK_250
* [[#TSEC_FALCON_DMAINFO_CTL|TSEC_FALCON_DMAINFO_CTL]]

=== TSEC_FALCON_SPROT_IRQ ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Read access level
|-
| 4-7
| Write access level
|}

Controls accesses to the following registers:
* [[#TSEC_FALCON_IRQMODE|TSEC_FALCON_IRQMODE]]
* [[#TSEC_FALCON_IRQMSET|TSEC_FALCON_IRQMSET]]
* [[#TSEC_FALCON_IRQMCLR|TSEC_FALCON_IRQMCLR]]
* [[#TSEC_FALCON_IRQDEST|TSEC_FALCON_IRQDEST]]
* [[#TSEC_FALCON_GPTMRINT|TSEC_FALCON_GPTMRINT]]
* [[#TSEC_FALCON_GPTMRVAL|TSEC_FALCON_GPTMRVAL]]
* [[#TSEC_FALCON_GPTMRCTL|TSEC_FALCON_GPTMRCTL]]
* [[#TSEC_FALCON_IRQDEST2|TSEC_FALCON_IRQDEST2]]
* TSEC_FALCON_UNK_E0

=== TSEC_FALCON_SPROT_MTHD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Read access level
|-
| 4-7
| Write access level
|}

Controls accesses to the following registers:
* [[#TSEC_FALCON_ITFEN|TSEC_FALCON_ITFEN]]
* [[#TSEC_FALCON_CURCTX|TSEC_FALCON_CURCTX]]
* [[#TSEC_FALCON_NXTCTX|TSEC_FALCON_NXTCTX]]
* [[#TSEC_FALCON_CTXACK|TSEC_FALCON_CTXACK]]
* [[#TSEC_FALCON_MTHDDATA|TSEC_FALCON_MTHDDATA]]
* [[#TSEC_FALCON_MTHDID|TSEC_FALCON_MTHDID]]
* [[#TSEC_FALCON_MTHDWDAT|TSEC_FALCON_MTHDWDAT]]
* [[#TSEC_FALCON_MTHDCOUNT|TSEC_FALCON_MTHDCOUNT]]
* [[#TSEC_FALCON_MTHDPOP|TSEC_FALCON_MTHDPOP]]
* [[#TSEC_FALCON_MTHDRAMSZ|TSEC_FALCON_MTHDRAMSZ]]
* [[#TSEC_FALCON_DEBUG1|TSEC_FALCON_DEBUG1]]

=== TSEC_FALCON_SPROT_SCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Read access level
|-
| 4-7
| Write access level
|}

Controls accesses to the [[#TSEC_FALCON_SCTL|TSEC_FALCON_SCTL]] register.

=== TSEC_FALCON_SPROT_WDTMR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Read access level
|-
| 4-7
| Write access level
|}

Controls accesses to the following registers:
* [[#TSEC_FALCON_WDTMRVAL|TSEC_FALCON_WDTMRVAL]]
* [[#TSEC_FALCON_WDTMRCTL|TSEC_FALCON_WDTMRCTL]]

=== TSEC_FALCON_DMAINFO_FINISHED_FBRD_LOW ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_DMAINFO_FINISHED_FBRD_LOW_VAL
|}

=== TSEC_FALCON_DMAINFO_FINISHED_FBRD_HIGH ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-30
| TSEC_FALCON_DMAINFO_FINISHED_FBRD_HIGH_VAL
|-
| 31
| TSEC_FALCON_DMAINFO_FINISHED_FBRD_HIGH_OBIT
|}

=== TSEC_FALCON_DMAINFO_FINISHED_FBWR_LOW ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_DMAINFO_FINISHED_FBWR_LOW_VAL
|}

=== TSEC_FALCON_DMAINFO_FINISHED_FBWR_HIGH ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-30
| TSEC_FALCON_DMAINFO_FINISHED_FBWR_HIGH_VAL
|-
| 31
| TSEC_FALCON_DMAINFO_FINISHED_FBWR_HIGH_OBIT
|}

=== TSEC_FALCON_DMAINFO_CURRENT_FBRD_LOW ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_DMAINFO_CURRENT_FBRD_LOW_VAL
|}

=== TSEC_FALCON_DMAINFO_CURRENT_FBRD_HIGH ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-30
| TSEC_FALCON_DMAINFO_CURRENT_FBRD_HIGH_VAL
|-
| 31
| TSEC_FALCON_DMAINFO_CURRENT_FBRD_HIGH_OBIT
|}

=== TSEC_FALCON_DMAINFO_CURRENT_FBWR_LOW ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_DMAINFO_CURRENT_FBWR_LOW_VAL
|}

=== TSEC_FALCON_DMAINFO_CURRENT_FBWR_HIGH ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-30
| TSEC_FALCON_DMAINFO_CURRENT_FBWR_HIGH_VAL
|-
| 31
| TSEC_FALCON_DMAINFO_CURRENT_FBWR_HIGH_OBIT
|}

=== TSEC_FALCON_DMAINFO_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_DMAINFO_CTL_CLR_FBRD
|-
| 1
| TSEC_FALCON_DMAINFO_CTL_CLR_FBWR
|}

=== TSEC_SCP_CTL0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 10
| Enable the [[#LOAD|LOAD]] block's interface
|-
| 12
| Enable the [[#STORE|STORE]] block's interface
|-
| 14
| Enable the [[#CMD|CMD]] block's interface
|-
| 16
| Enable the [[#SEQ|SEQ]] block
|-
| 20
| Enable the [[#CTL|CTL]] block
|}

=== TSEC_SCP_CTL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Clear [[#SEQ|SEQ]] block's pipeline
|-
| 8
| Clear the main [[#SCP|SCP]] pipeline
|-
| 11
| Enable [[#RNG|RNG]] block's test mode
|-
| 12
| Enable the [[#RNG|RNG]] block
|-
| 16
| Enable [[#LOAD|LOAD]] block's interface dummy mode (all reads return 0)
|-
| 20
| Enable [[#LOAD|LOAD]] block's interface bypassing (all reads are dropped)
|-
| 24
| Enable [[#STORE|STORE]] block's interface bypassing (all writes are dropped)
|}

=== TSEC_SCP_CTL_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| TSEC_SCP_CTL_STAT_DEBUG_MODE
|}

=== TSEC_SCP_CTL_LOCK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Enable lockdown mode (locks IMEM and DMEM)
|-
| 1
| Unknown
|-
| 2
| Unknown
|-
| 3
| Unknown
|-
| 4
| Lock the [[#SCP|SCP]]
|-
| 5
| Unknown
|-
| 6
| Unknown
|-
| 7
| Unknown
|}

Controls lockdown mode and can only be cleared in Heavy Secure mode.

=== TSEC_SCP_CFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Unknown
|-
| 1
| Unknown
|-
| 2
| Unknown
|-
| 3
| Unknown
|-
| 4
| [[#AES|AES]] block's endianness
0: Little
1: Big
|-
| 8
| Flush [[#CMD|CMD]] block's pipeline
|-
| 12-13
| Carry chain size
0: 32 bits
1: 64 bits
2: 96 bits
3: 128 bits
|-
| 16-31
| Timeout value
|}

=== TSEC_SCP_CTL_SCP ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Swap [[#SCP|SCP]] master
|-
| 1
| Current [[#SCP|SCP]] master
0: Falcon
1: External
|}

=== TSEC_SCP_CTL_PKEY ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
|-
| 1
| TSEC_SCP_CTL_PKEY_LOADED
|}

=== TSEC_SCP_CTL_DBG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Unknown
|-
| 4
| Unknown
|-
| 8
| Unknown
|-
| 12
| Unknown
|}

=== TSEC_SCP_DBG0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Index
|-
| 4
| Auto-increment
|-
| 5-6
| Target
0: None
1: STORE
2: LOAD
3: SEQ
|-
| 8-12
| [[#SEQ|SEQ]] block's current sequence size
|-
| 13-16
| [[#SEQ|SEQ]] block's current instruction address
|-
| 17
| [[#SEQ|SEQ]] block's current instruction is valid
|-
| 18
| [[#SEQ|SEQ]] block is running in HS mode
|-
| 19-22
| [[#LOAD|LOAD]] block's pipeline size
|-
| 23
| [[#LOAD|LOAD]] block's current operation is valid
|-
| 24
| [[#LOAD|LOAD]] block is running in HS mode
|-
| 25-26
| [[#STORE|STORE]] block's pipeline size
|-
| 30
| [[#STORE|STORE]] block's current operation is valid
|-
| 31
| [[#STORE|STORE]] block is running in HS mode
|}

Used for debugging the [[#LOAD|LOAD]], [[#STORE|STORE]] and [[#SEQ|SEQ]] blocks.

=== TSEC_SCP_DBG1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| [[#SEQ|SEQ]] block's current instruction's first operand
|-
| 4-9
| [[#SEQ|SEQ]] block's current instruction's second operand
|-
| 10-14
| [[#SEQ|SEQ]] block's current instruction's opcode
|}

Used for retrieving debug data. Contains information on the last crypto sequence created when debugging the SEQ controller.

=== TSEC_SCP_DBG2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| [[#SEQ|SEQ]] block's state
0: Idle
1: Recording is active (cs0begin/cs1begin)
|-
| 4-7
| Number of [[#SEQ|SEQ]] block's instructions left
|-
| 12-15
| Active crypto key register
|}

Used for retrieving additional debug data associated with the [[#SEQ|SEQ]] block.

=== TSEC_SCP_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Destination register
|-
| 8-13
| Source register or immediate value
|-
| 20-24
| Command opcode
0x0: nop (fuc5 opcode 0x00)
0x1: cmov (fuc5 opcode 0x84)
0x2: cxsin (fuc5 opcode 0x88) or xdst (with cxset)
0x3: cxsout (fuc5 opcode 0x8C) or xdld (with cxset)
0x4: crnd (fuc5 opcode 0x90)
0x5: cs0begin (fuc5 opcode 0x94)
0x6: cs0exec (fuc5 opcode 0x98)
0x7: cs1begin (fuc5 opcode 0x9C)
0x8: cs1exec (fuc5 opcode 0xA0)
0x9: invalid (fuc5 opcode 0xA4)
0xA: cchmod (fuc5 opcode 0xA8)
0xB: cxor (fuc5 opcode 0xAC)
0xC: cadd (fuc5 opcode 0xB0)
0xD: cand (fuc5 opcode 0xB4)
0xE: crev (fuc5 opcode 0xB8)
0xF: cgfmul (fuc5 opcode 0xBC)
0x10: csecret (fuc5 opcode 0xC0)
0x11: ckeyreg (fuc5 opcode 0xC4)
0x12: ckexp (fuc5 opcode 0xC8)
0x13: ckrexp (fuc5 opcode 0xCC)
0x14: cenc (fuc5 opcode 0xD0)
0x15: cdec (fuc5 opcode 0xD4)
0x16: csigcmp (fuc5 opcode 0xD8)
0x17: csigenc (fuc5 opcode 0xDC)
0x18: csigclr (fuc5 opcode 0xE0)
|-
| 28
| [[#CMD|CMD]] block's current instruction is valid
|-
| 31
| [[#CMD|CMD]] block is running in HS mode
|}

Contains information on the last crypto command executed.

=== TSEC_SCP_STAT0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| [[#SCP|SCP]] is active
|-
| 2
| [[#CMD|CMD]] block's interface is active
|-
| 4
| [[#STORE|STORE]] block's interface is active
|-
| 6
| [[#SEQ|SEQ]] block is active
|-
| 8
| [[#CTL|CTL]] block is active
|-
| 10
| [[#LOAD|LOAD]] block's interface is active
|-
| 14
| [[#AES|AES]] block is active
|-
| 16
| [[#RNG|RNG]] block is active
|}

Contains the status of the hardware blocks and interfaces.

=== TSEC_SCP_STAT1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| Signature comparison result
0: None
1: Running
2: Failed
3: Succeeded
|-
| 4
| [[#LOAD|LOAD]] block's interface is running in HS mode
|-
| 6
| [[#LOAD|LOAD]] block's interface is ready
|-
| 8
| [[#STORE|STORE]] block's interface is running in HS mode
|-
| 10
| [[#STORE|STORE]] block's interface received a valid operation
|-
| 12
| [[#CMD|CMD]] block's interface is running in HS mode
|-
| 14
| [[#CMD|CMD]] block's interface received a valid instruction
|}

Contains the status of the last authentication attempt and other miscellaneous statuses.

=== TSEC_SCP_STAT2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-4
| Current [[#SEQ|SEQ]] block opcode
|-
| 5-9
| Current [[#CMD|CMD]] block's interface opcode
|-
| 10-14
| Pending [[#CMD|CMD]] block opcode
|-
| 15-16
| Current [[#AES|AES]] block operation
0: Encryption
1: Decryption
2: Key expansion
3: Key reverse expansion
|-
| 24
| Unknown
|-
| 25
| [[#STORE|STORE]] block is stalled
|-
| 26
| [[#LOAD|LOAD]] block is stalled
|-
| 27
| [[#RNG|RNG]] block is stalled
|-
| 28
| Unknown
|-
| 29
| [[#AES|AES]] block is stalled
|}

Contains the status of crypto operations.

=== TSEC_SCP_RNG_STAT0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| [[#RND|RND]] block is ready
|-
| 4-7
| Unknown
|-
| 8-11
| Unknown
|-
| 16
| Unknown
|-
| 20
| Unknown
|}

=== TSEC_SCP_RNG_STAT1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| Unknown
|-
| 16-31
| Unknown
|}

=== TSEC_SCP_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| [[#RND|RND]] ready
|-
| 8
| ACL error
|-
| 12
| SEC error
|-
| 16
| [[#CMD|CMD]] error
|-
| 20
| Single step
|-
| 24
| [[#RND|RND]] operation
|-
| 28
| Timeout
|}

Used for getting the status of crypto IRQs.

=== TSEC_SCP_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| [[#RND|RND]] ready
|-
| 8
| ACL error
|-
| 12
| SEC error
|-
| 16
| [[#CMD|CMD]] error
|-
| 20
| Single step
|-
| 24
| [[#RND|RND]] operation
|-
| 28
| Timeout
|}

Used for getting the value of the mask for crypto IRQs.

=== TSEC_SCP_ACL_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Writing to a crypto register without the correct ACL
|-
| 4
| Reading from a crypto register without the correct ACL
|-
| 8
| Invalid ACL change (cchmod)
|-
| 31
| ACL error occurred
|}

Contains information on errors generated by the [[#TSEC_SCP_IRQSTAT|ACL error]] IRQ.

=== TSEC_SCP_SEC_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Unknown
|-
| 1-2
| Unknown
|-
| 4
| Unknown
|-
| 5-6
| Unknown
|-
| 16
| Unknown
|-
| 17-18
| Unknown
|-
| 20
| Unknown
|-
| 21-22
| Unknown
|-
| 24
| Unknown
|-
| 25-26
| Unknown
|-
| 31
| SEC error occurred
|}

=== TSEC_SCP_CMD_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Invalid [[#CMD|CMD]] command
|-
| 4
| Empty [[#SEQ|SEQ]] sequence
|-
| 8
| [[#SEQ|SEQ]] sequence is too long
|-
| 12
| [[#SEQ|SEQ]] sequence was not finished
|-
| 16
| Forbidden signature operation (csigcmp, csigenc or csigclr in NS mode)
|-
| 20
| Invalid signature operation (csigcmp in HS mode)
|-
| 24
| Forbidden ACL change (cchmod in NS mode)
|}

Contains information on errors generated by the [[#TSEC_SCP_IRQSTAT|CMD error]] IRQ.

=== TSEC_SCP_RND_CTL0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| [[#RND|RND]] clock trigger lower limit
|}

=== TSEC_SCP_RND_CTL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| [[#RND|RND]] clock trigger upper limit
|-
| 16-31
| [[#RND|RND]] clock trigger mask
|}

=== TSEC_TFBIF_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_CTL_CLR_BWCOUNT
|-
| 1
| TSEC_TFBIF_CTL_ENABLE
|-
| 2
| TSEC_TFBIF_CTL_CLR_IDLEWDERR
|-
| 3
| TSEC_TFBIF_CTL_RESET
|-
| 4
| TSEC_TFBIF_CTL_IDLE
|-
| 5
| TSEC_TFBIF_CTL_IDLEWDERR
|-
| 6
| TSEC_TFBIF_CTL_SRTOUT
|-
| 7
| TSEC_TFBIF_CTL_CLR_SRTOUT
|-
| 8-11
| TSEC_TFBIF_CTL_SRTOVAL
|-
| 12
| TSEC_TFBIF_CTL_VPR
|}

=== TSEC_TFBIF_MCCIF_FIFOCTRL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
|-
| 1
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
|-
| 2
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
|-
| 3
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
|-
| 4
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
|-
| 5
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
|-
| 6
| TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
|-
| 7
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
|-
| 8
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE
|}

=== TSEC_TFBIF_THROTTLE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-11
| TSEC_TFBIF_THROTTLE_BUCKET_SIZE
|-
| 16-27
| TSEC_TFBIF_THROTTLE_LEAK_COUNT
|-
| 30-31
| TSEC_TFBIF_THROTTLE_LEAK_SIZE
|}

=== TSEC_TFBIF_DBG_STAT0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_DBG_STAT0_1K_TRANSFER
|-
| 1
| TSEC_TFBIF_DBG_STAT0_RREQ_ISSUED
|-
| 2
| TSEC_TFBIF_DBG_STAT0_WREQ_ISSUED
|-
| 3
| TSEC_TFBIF_DBG_STAT0_TAGQ_ISSUED
|-
| 4
| TSEC_TFBIF_DBG_STAT0_STALL_RDATQ
|-
| 5
| TSEC_TFBIF_DBG_STAT0_STALL_RACKQ
|-
| 6
| TSEC_TFBIF_DBG_STAT0_STALL_WREQQ
|-
| 7
| TSEC_TFBIF_DBG_STAT0_STALL_WDATQ
|-
| 8
| TSEC_TFBIF_DBG_STAT0_STALL_WACKQ
|-
| 9
| TSEC_TFBIF_DBG_STAT0_STALL_RREQ_PENDING
|-
| 10
| TSEC_TFBIF_DBG_STAT0_STALL_WREQ_PENDING
|-
| 11
| TSEC_TFBIF_DBG_STAT0_STALL_MREQ
|-
| 12
| TSEC_TFBIF_DBG_STAT0_ENGINE_IDLE
|-
| 13
| TSEC_TFBIF_DBG_STAT0_RMCCIF_IDLE
|-
| 14
| TSEC_TFBIF_DBG_STAT0_WMCCIF_IDLE
|-
| 15
| TSEC_TFBIF_DBG_STAT0_CSB_IDLE
|-
| 16
| TSEC_TFBIF_DBG_STAT0_RU_IDLE
|-
| 17
| TSEC_TFBIF_DBG_STAT0_WU_IDLE
|-
| 19
| TSEC_TFBIF_DBG_STAT0_UNWEIGHT_ACTMON_ACTIVE
|-
| 20
| TSEC_TFBIF_DBG_STAT0_UNWEIGHT_ACTMON_MCB
|}

=== TSEC_TFBIF_DBG_STAT1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_TFBIF_DBG_STAT1_DATA
|}

=== TSEC_TFBIF_DBG_RDCOUNT_LO ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_TFBIF_DBG_RDCOUNT_LO_DATA
|}

=== TSEC_TFBIF_DBG_RDCOUNT_HI ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_TFBIF_DBG_RDCOUNT_HI_DATA
|}

=== TSEC_TFBIF_DBG_WRCOUNT_LO ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_TFBIF_DBG_WRCOUNT_LO_DATA
|}

=== TSEC_TFBIF_DBG_WRCOUNT_HI ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_TFBIF_DBG_WRCOUNT_HI_DATA
|}

=== TSEC_TFBIF_DBG_R32COUNT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_TFBIF_DBG_R32COUNT_DATA
|}

=== TSEC_TFBIF_DBG_R64COUNT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_TFBIF_DBG_R64COUNT_DATA
|}

=== TSEC_TFBIF_DBG_R128COUNT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_TFBIF_DBG_R128COUNT_DATA
|}

=== TSEC_TFBIF_MCCIF_FIFOCTRL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
|-
| 16-31
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT
|}

=== TSEC_TFBIF_WRR_RDP ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_TFBIF_WRR_RDP_EXT_WEIGHT
|-
| 16-31
| TSEC_TFBIF_WRR_RDP_INT_WEIGHT
|}

=== TSEC_TFBIF_SPROT_EMEM ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Read access level
|-
| 4-7
| Write access level
|}

Controls accesses to external memory regions. Accessible in HS mode only.

=== TSEC_TFBIF_TRANSCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_TRANSCFG_ATT0_SWID
|-
| 4
| TSEC_TFBIF_TRANSCFG_ATT1_SWID
|-
| 8
| TSEC_TFBIF_TRANSCFG_ATT2_SWID
|-
| 12
| TSEC_TFBIF_TRANSCFG_ATT3_SWID
|-
| 16
| TSEC_TFBIF_TRANSCFG_ATT4_SWID
|-
| 20
| TSEC_TFBIF_TRANSCFG_ATT5_SWID
|-
| 24
| TSEC_TFBIF_TRANSCFG_ATT6_SWID
|-
| 28
| TSEC_TFBIF_TRANSCFG_ATT7_SWID
|}

Configures the software ID per CTXDMA port for memory transactions. Software ID 0 (HW_SWID) forces all transactions to go through the SMMU while software ID 1 (PHY_SWID) bypasses it. Accessible in HS mode only.

[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.

=== TSEC_TFBIF_REGIONCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-2
| TSEC_TFBIF_REGIONCFG_T0_APERT_ID
|-
| 3
| TSEC_TFBIF_REGIONCFG_T0_VPR
|-
| 4-6
| TSEC_TFBIF_REGIONCFG_T1_APERT_ID
|-
| 7
| TSEC_TFBIF_REGIONCFG_T1_VPR
|-
| 8-10
| TSEC_TFBIF_REGIONCFG_T2_APERT_ID
|-
| 11
| TSEC_TFBIF_REGIONCFG_T2_VPR
|-
| 12-14
| TSEC_TFBIF_REGIONCFG_T3_APERT_ID
|-
| 15
| TSEC_TFBIF_REGIONCFG_T3_VPR
|-
| 16-18
| TSEC_TFBIF_REGIONCFG_T4_APERT_ID
|-
| 19
| TSEC_TFBIF_REGIONCFG_T4_VPR
|-
| 20-22
| TSEC_TFBIF_REGIONCFG_T5_APERT_ID
|-
| 23
| TSEC_TFBIF_REGIONCFG_T5_VPR
|-
| 24-26
| TSEC_TFBIF_REGIONCFG_T6_APERT_ID
|-
| 27
| TSEC_TFBIF_REGIONCFG_T6_VPR
|-
| 28-30
| TSEC_TFBIF_REGIONCFG_T7_APERT_ID
|-
| 31
| TSEC_TFBIF_REGIONCFG_T7_VPR
|}

Configures the aperture ID and VPR mode per CTXDMA port for memory region accessing. Accessible in HS mode only.

[6.0.0+] The nvhost_tsec firmware sets this register to 0x20 or 0x140 before reading memory from the GPU UCODE carveout.

=== TSEC_TFBIF_ACTMON_ACTIVE_MASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_ACTMON_ACTIVE_MASK_STARVED_MC
|-
| 1
| TSEC_TFBIF_ACTMON_ACTIVE_MASK_STALLED_MC
|-
| 2
| TSEC_TFBIF_ACTMON_ACTIVE_MASK_DELAYED_MC
|-
| 3
| TSEC_TFBIF_ACTMON_ACTIVE_MASK_ACTIVE
|}

Takes the memory access mask for the Activity Monitor. Disconnected on the TSEC.

=== TSEC_TFBIF_ACTMON_ACTIVE_BORPS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_STARVED_MC_POLARITY
|-
| 1
| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_STARVED_MC_OPERATION
|-
| 2
| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_STALLED_MC_POLARITY
|-
| 3
| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_STALLED_MC_OPERATION
|-
| 4
| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_DELAYED_MC_POLARITY
|-
| 5
| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_DELAYED_MC_OPERATION
|-
| 6
| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_ACTIVE_POLARITY
|-
| 7
| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_ACTIVE_OPERATION
|}

Takes the billions of records per second count for the Activity Monitor. Disconnected on the TSEC.

=== TSEC_TFBIF_ACTMON_ACTIVE_WEIGHT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_TFBIF_ACTMON_ACTIVE_WEIGHT_VAL
|}

Controls the Activity Monitor. Disconnected on the TSEC.

=== TSEC_TFBIF_ACTMON_MCB_MASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_ACTMON_MCB_MASK_STARVED_MC
|-
| 1
| TSEC_TFBIF_ACTMON_MCB_MASK_STALLED_MC
|-
| 2
| TSEC_TFBIF_ACTMON_MCB_MASK_DELAYED_MC
|-
| 3
| TSEC_TFBIF_ACTMON_MCB_MASK_ACTIVE
|}

Disconnected on the TSEC.

=== TSEC_TFBIF_ACTMON_MCB_BORPS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_ACTMON_MCB_BORPS_STARVED_MC_POLARITY
|-
| 1
| TSEC_TFBIF_ACTMON_MCB_BORPS_STARVED_MC_OPERATION
|-
| 2
| TSEC_TFBIF_ACTMON_MCB_BORPS_STALLED_MC_POLARITY
|-
| 3
| TSEC_TFBIF_ACTMON_MCB_BORPS_STALLED_MC_OPERATION
|-
| 4
| TSEC_TFBIF_ACTMON_MCB_BORPS_DELAYED_MC_POLARITY
|-
| 5
| TSEC_TFBIF_ACTMON_MCB_BORPS_DELAYED_MC_OPERATION
|-
| 6
| TSEC_TFBIF_ACTMON_MCB_BORPS_ACTIVE_POLARITY
|-
| 7
| TSEC_TFBIF_ACTMON_MCB_BORPS_ACTIVE_OPERATION
|}

Disconnected on the TSEC.

=== TSEC_TFBIF_ACTMON_MCB_WEIGHT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_TFBIF_ACTMON_MCB_WEIGHT_VAL
|}

Disconnected on the TSEC.

=== TSEC_TFBIF_THI_TRANSPROP ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-6
| TSEC_TFBIF_THI_TRANSPROP_STREAMID0
|-
| 8-14
| TSEC_TFBIF_THI_TRANSPROP_STREAMID1
|-
| 16
| TSEC_TFBIF_THI_TRANSPROP_TZ_AUTH
|}

=== TSEC_CG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-5
| TSEC_CG_IDLE_CG_DLY_CNT
|-
| 6
| TSEC_CG_IDLE_CG_EN
|-
| 16-18
| TSEC_CG_WAKEUP_DLY_CNT
|-
| 19
| TSEC_CG_WAKEUP_DLY_EN
|}

=== TSEC_BAR0_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_BAR0_CTL_READ
|-
| 1
| TSEC_BAR0_CTL_WRITE
|-
| 4-7
| TSEC_BAR0_CTL_BYTE_MASK
|-
| 12-13
| TSEC_BAR0_CTL_STATUS
0: Idle
1: Busy
2: Error
3: Disabled
|-
| 16-17
| TSEC_BAR0_CTL_SEC_MODE
0: None
1: Invalid
2: Light Secure
3: Heavy Secure
|-
| 31
| TSEC_BAR0_CTL_INIT
|}

Controls DMA transfers between TSEC and HOST1X (master and clients).

Starting a transfer over BAR0 automatically sets TSEC_BAR0_CTL_SEC_MODE to the current Falcon security mode. Once set, any attempts to start a transfer from a lower security level will fail.

=== TSEC_BAR0_ADDR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_BAR0_ADDR_VAL
|}

Takes the address for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_BAR0_DATA ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_BAR0_DATA_VAL
|}

Takes the data for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_BAR0_TIMEOUT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_BAR0_TIMEOUT_VAL
|}

Takes the timeout value for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_TEGRA_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 16
| TSEC_TEGRA_CTL_TKFI_KFUSE
|-
| 17
| TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
|-
| 24
| TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
|-
| 25
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
|-
| 26
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
|-
| 27
| TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C
|}

== Falcon ==
"Falcon" (FAst Logic CONtroller) is a proprietary general purpose CPU which can be found inside various hardware blocks that require some sort of logic processing such as TSEC (TSECA and TSECB), NVDEC, NVENC, NVJPG, VIC, GPU PMU and XUSB.

=== Processor Registers ===
A total of 32 processor registers are available in the Falcon CPU.

==== REG0-REG15 ====
These are 16 32-bit GPRs (general purpose registers).

==== IV0 ====
This is a SPR (special purpose register) that holds the address for interrupt vector 0. Only bits 0 to 15 are used.

==== IV1 ====
This is a SPR (special purpose register) that holds the address for interrupt vector 1. Only bits 0 to 15 are used.

==== IV2 ====
This is a SPR (special purpose register) that holds the address for interrupt vector 2. This register is considered "UNDEFINED" and appears to be unused.

==== EV ====
This is a SPR (special purpose register) that holds the address for the exception vector. Only bits 0 to 15 are used.

Alternative name (envytools): "tv".

==== SP ====
This is a SPR (special purpose register) that holds the current stack pointer. Only bits 0 to 15 are used.

==== PC ====
This is a SPR (special purpose register) that holds the current program counter. Only bits 0 to 15 are used.

==== IMB ====
This is a SPR (special purpose register) that holds the external base address for IMEM transfers.

Alternative name (envytools): "xcbase".

==== DMB ====
This is a SPR (special purpose register) that holds the external base address for DMEM transfers.

Alternative name (envytools): "xdbase".

==== CSW ====
This is a SPR (special purpose register) that holds various flag bits.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7 || General purpose predicates
|-
| 8 || ALU carry flag
|-
| 9 || ALU signed overflow flag
|-
| 10 || ALU sign flag
|-
| 11 || ALU zero flag
|-
| 16 || Interrupt 0 enable
|-
| 17 || Interrupt 1 enable
|-
| 18 || Interrupt 2 enable (undefined)
|-
| 20 || Interrupt 0 saved enable
|-
| 21 || Interrupt 1 saved enable
|-
| 22 || Interrupt 2 saved enable (undefined)
|-
| 24 || Exception active
|-
| 26-31 || Unknown
|}

Alternative name (envytools): "flags".

==== CCR ====
This is a SPR (special purpose register) that holds configuration bits for the SCP DMA override functionality. The value of this register is set using the "cxset" instruction which provides a way to change the behavior of a variable amount of successively executed DMA-related instructions ("xdwait", "xdst" and "xdld").

{| class=wikitable
! Bits || Description
|-
| 0-4 || Number of instructions the override is valid for (0x1F means infinite)
|-
| 5 || Crypto source/destination select
0: Crypto register
1: Crypto stream
|-
| 6 || Bypass mode
0: Disabled
1: Enabled
|-
| 7 || Internal memory select
0: DMEM
1: IMEM
|}

Alternative name (envytools): "cx".

==== SEC ====
This is a SPR (special purpose register) that holds configuration bits for the SCP authentication process.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7 || Start of region to authenticate (in pages of 0x100 bytes)
|-
| 16 || Force secure DMA transfers
|-
| 17 || Decrypt region to authenticate
|-
| 18 || Signature check passed
|-
| 19 || Suppress interrupts and exceptions
|-
| 24-31 || Size of region to authenticate (in pages of 0x100 bytes)
|}

Alternative name (envytools): "cauth".

==== CTX ====
This is a SPR (special purpose register) that holds configuration bits for the CTXDMA ports.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-2 || CTXDMA port for code loads (xcld)
|-
| 4-6 || CTXDMA port for code stores (invalid)
|-
| 8-10 || CTXDMA port for data loads (xdld)
|-
| 12-14 || CTXDMA port for data stores (xdst)
|}

Alternative name (envytools): "xtargets".

==== EXCI ====
This is a SPR (special purpose register) that holds information on raised exceptions.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-19 || Exception PC
|-
| 20-23 || Exception cause
|}

Alternative name (envytools): "tstatus".

==== SEC1 ====
Only available in Falcon v6+ CPUs, marked as "RESERVED" for v5.

==== IMB1 ====
Only available in Falcon v6+ CPUs, marked as "RESERVED" for v5.

==== DMB1 ====
Only available in Falcon v6+ CPUs, marked as "RESERVED" for v5.

=== Secure BootROM ===
Certain Falcon CPUs may have an optional "Secure BootROM", but contrary to the common purpose of bootrom code, this doesn't execute while booting the CPU. In fact, being a microprocessor, Falcon is designed to execute user supplied code right off the bat in a clean slate state. However, Falcon can be paired with a [[#SCP|secure co-processor]] and provide a cryptosystem for any hardware block that may require it, originating what is known as a "secretful" unit.

Secretful Falcon CPUs have [[#TSEC_FALCON_HWCFG1|TSEC_FALCON_HWCFG1_SECURITY_MODEL]] set to 3, which means they support "Heavy Secure" mode (or "HS" for short). While in HS mode, the Falcon's DMEM and IMEM regions are protected from read and write operations, which effectively hides code and data from attackers.

Entering HS mode first requires uploading code marked as "secure" to Falcon, which can be done from MMIO using [[#TSEC_FALCON_IMEMC|TSEC_FALCON_IMEMC]] with the [[#TSEC_FALCON_IMEMC|TSEC_FALCON_IMEMC_SECURE]] bit set. Upon jumping to a page marked as secret, the [[#TSEC_FALCON_EXCI|INV_INS]] exception is raised which tells the Falcon to start executing the secure bootrom code.

The secure bootrom lives in a hidden ROM region, instead of IMEM, and is mapped as --x at address 0. On Falcon v5 CPUs its size is 0x367 bytes.

==== Initialization ====
The first instructions of the secure bootrom simply save each [[#REG0-REG15|GPR]] to the stack and check the contents of the [[#SEC|SEC SPR]].

==== Authentication ====
The main purpose of the secure bootrom is to authenticate the code pages marked as "secure". This is done by first extracting the base address and size of the region to authenticate from the [[#SEC|SEC SPR]], then calculating a signature over this region and finally comparing it to the value of the [[#SCP|SCP]] register $c6.

If the comparison is successful, bit 18 of [[#SEC|SEC SPR]] is set (which is mirrored in [[#TSEC_FALCON_SVEC_SPR|TSEC_FALCON_SVEC_SPR]]), the signature comparison result in [[#TSEC_SCP_STAT1|TSEC_SCP_STAT1]] is set to 3 and each page from the region to authenticate is marked as valid. Bit 19 of [[#SEC|SEC SPR]] is also automatically set, preventing any interrupts or exceptions from being raised while in HS mode, but contrary to bit 18 this one can be manually cleared by authenticated code.

Below is the authentication algorithm's pseudocode:
<syntaxhighlight>
...
// This runs in a loop for each 0x100 bytes page.
cs0begin 0x03
cxsin $c4
cenc $c3 $c5
cxor $c5 $c3
ckeyreg $c4
cxor $c5 $c5
cs0exec 0x11
...
// Use secret 0x01 as key and $c7 as seed.
csecret $c3 1
ckeyreg $c3
cenc $c3 $c7
ckeyreg $c3
cenc $c4 $c5
csigcmp $c4 $c6
...
</syntaxhighlight>

==== Decryption ====
If bit 17 is set in the [[#SEC|SEC SPR]], the secure bootrom will additionally attempt to decrypt the region to authenticate.

Below is the decryption algorithm's pseudocode:
<syntaxhighlight>
...
// Use secret 0x06 as key.
cs0begin 0x03
cxsin $c3
cdec $c4 $c3
cxsout $c4
csecret $c5 0x06
ckexp $c5 $c5
cs0exec 0x10
ckeyreg $c5
...
</syntaxhighlight>

==== Exit ====
The secure bootrom finishes by restoring each [[#REG0-REG15|GPR]] from stack and returning from the exception state. This will result in the authenticated code region being executed in HS mode until the current [[#PC|PC]] points to an address outside of the authenticated region. When this happens, each page from the authenticated region is automatically marked as invalid without any involvement of the secure bootrom, meaning that the secure bootrom is only invoked when entering HS mode.

== SCP ==
"SCP" (Secure Co-Processor) is a proprietary coprocessor which can be found inside every [[#Falcon|Falcon]] that supports [[#Secure BootROM|Heavy Secure Mode]]. On the Tegra X1 these are TSECA, TSECB, NVDEC and the GPU's PMU.

=== Hardware ===
SCP is subdivided into several specialized hardware blocks and interfaces.

==== LOAD ====
Block for handling memory reads from SCP to Falcon. It communicates with Falcon over a dedicated interface.

The interface can be enabled or disabled by register [[#TSEC_SCP_CTL0|TSEC_SCP_CTL0]].

==== STORE ====
Block for handling memory writes from Falcon to SCP. It communicates with Falcon over a dedicated interface.

The interface can be enabled or disabled by register [[#TSEC_SCP_CTL0|TSEC_SCP_CTL0]].

==== CMD ====
Block for translating Falcon crypto operands into SCP commands. It communicates with Falcon over a dedicated interface.

The interface can be enabled or disabled by register [[#TSEC_SCP_CTL0|TSEC_SCP_CTL0]]. The status of the current command is reported through register [[#TSEC_SCP_CMD|TSEC_SCP_CMD]].

==== SEQ ====
Block for recording and executing sequences of crypto operations in the form of macros.

Can be enabled or disabled by register [[#TSEC_SCP_CTL0|TSEC_SCP_CTL0]].

==== CTL ====
Overseer block for controlling certain SCP features.

Can be enabled or disabled by register [[#TSEC_SCP_CTL0|TSEC_SCP_CTL0]].

Registers [[#TSEC_SCP_CTL_STAT|TSEC_SCP_CTL_STAT]], [[#TSEC_SCP_CTL_LOCK|TSEC_SCP_CTL_LOCK]], [[#TSEC_SCP_CTL_SCP|TSEC_SCP_CTL_SCP]], [[#TSEC_SCP_CTL_PKEY|TSEC_SCP_CTL_PKEY]] and [[#TSEC_SCP_CTL_DBG|TSEC_SCP_CTL_DBG]] refer to this block.

==== AES ====
Block for providing AES-128-ECB functionality.

==== RNG ====
Block for encapsulating and controlling the internal random number generator.

Can be enabled or disabled by register [[#TSEC_SCP_CTL1|TSEC_SCP_CTL1]] and reports the status of the internal random number generator through registers [[#TSEC_SCP_RNG_STAT0|TSEC_SCP_RNG_STAT0]] and [[#TSEC_SCP_RNG_STAT1|TSEC_SCP_RNG_STAT1]].

===== RND =====
Internal random number generator.

Can be configured by the [[#TSEC_SCP_RND_CTL0|TSEC_SCP_RND_CTLx]] registers.

=== Operations ===
{| class="wikitable" border="1"
! Opcode
! Name
! Operand0
! Operand1
! Operation
! Condition
|-
| 0 || nop || N/A || N/A || ||
|-
| 1 || mov || $cX || $cY || <code>$cX = $cY; ACL(X) = ACL(Y);</code> ||
|-
| 2 || sin || $cX || N/A || <code>$cX = read_stream(); ACL(X) = ???;</code> ||
|-
| 3 || sout || $cX || N/A || <code>write_stream($cX);</code> || ?
|-
| 4 || [[#rnd|rnd]] || $cX || N/A || <code>$cX = read_rnd(); ACL(X) = ???;</code> ||
|-
| 5 || s0begin || immX || N/A || <code>record_macro_for_N_instructions(0, immX);</code> ||
|-
| 6 || s0exec || immX || N/A || <code>execute_macro_N_times(0, immX);</code> ||
|-
| 7 || s1begin || immX || N/A || <code>record_macro_for_N_instructions(1, immX);</code> ||
|-
| 8 || s1exec || immX || N/A || <code>execute_macro_N_times(1, immX);</code> ||
|-
| 9 || <invalid> || || || ||
|-
| 0xA || [[#chmod|chmod]] || $cX || immY || Complicated, see [[#ACL|ACL]]. ||
|-
| 0xB || xor || $cX || $cY || <code>$cX ^= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xC || add || $cX || immY || <code>$cX += immY;</code> || <code>(ACL(X) & 2)</code>
|-
| 0xD || and || $cX || $cY || <code>$cX &= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xE || rev || $cX || $cY || <code>$cX = endian_swap128($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0xF || gfmul || $cX || $cY || <code>$cX = gfmul($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 2)</code>
|-
| 0x10 || secret || $cX || immY || <code>$cX = load_secret(immY); ACL(X) = load_secret_acl(immY);</code> ||
|-
| 0x11 || keyreg || $cX || N/A || <code>active_key_idx = $cX;</code> ||
|-
| 0x12 || kexp || $cX || $cY || <code>$cX = aes_kexp($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0x13 || krexp || $cX || $cY || <code>$cX = aes_kexp_reverse($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0x14 || enc || $cX || $cY || <code>$cX = aes_enc(active_key_idx, $cY); ACL(X) = ACL(active_key_idx) & ACL(Y);</code> ||
|-
| 0x15 || dec || $cX || $cY || <code>$cX = aes_dec(active_key_idx, $cY); ACL(X) = ACL(active_key_idx) & ACL(Y);</code> ||
|-
| 0x16 || [[#sigcmp|sigcmp]] || $cX || $cY || <code>if (hash_verify($cX, $cY)) { has_sig = true; current_sig = $cX; }</code> || ?
|-
| 0x17 || sigenc || $cX || $cY || <code>if (has_sig) { $cX = aes_enc($cY, current_sig); ACL(X) = 0x13; }</code> ||
|-
| 0x18 || [[#sigclr|sigclr]] || N/A || N/A || <code>has_sig = false;</code> ||
|}

==== sigcmp ====
<code>00000000: f5 3c XY d8 csigcmp $cY $cX</code>

Takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret. This instruction does not work in secure mode.

==== sigclr ====
<code>00000000: f5 3c 00 e0 csigclr</code>

This instruction takes no operands and clears the saved cauth signature used by the csigenc instruction.

==== chmod ====
<code>00000000: f5 3c XY a8 cchmod $cY 0X</code> or <code>00000000: f5 3c XY a9 cchmod $cY 1X</code>

This instruction takes a crypto register and a 5 bit immediate value which represents the [[#ACL|ACL]] mask to set.

==== rnd ====
<code>00000000: f5 3c 0X 90 crnd $cX</code>

This instruction initializes a crypto register with random data.

Executing this instruction only succeeds if the RNG controller is enabled for the SCP, which requires taking the following steps:
* Write 0x7FFF to [[#TSEC_SCP_RND_CTL0|TSEC_SCP_RND_CTL0]].
* Write 0x3FF0000 to [[#TSEC_SCP_RND_CTL1|TSEC_SCP_RND_CTL1]].
* Write 0xFF00 to TSEC_SCP_RND_CTL11.
* Write 0x1000 to [[#TSEC_SCP_CTL1|TSEC_SCP_CTL1]].

Otherwise it hangs forever.

=== ACLs ===
Each crypto register has an associated access control list with the following format:

{| class="wikitable" border="1"
! Bit
! Description
|-
| 0 || Secure key. Forced set if bit1 is set. Once cleared, cannot be set again.
|-
| 1 || Secure readable. Once cleared, cannot be set again.
|-
| 2 || Insecure key. Forced set if bit3 is set. Forced clear if bit0 is clear. Can be toggled back and forth.
|-
| 3 || Insecure readable. Forced clear if bit1 is clear. Can be toggled back and forth.
|-
| 4 || Insecure overwritable. Can be toggled back and forth.
|}

On boot, the ACL is 0x1F for all $cX.

Loading into $cX using xdst instruction sets ACL($cX) to 0x13 and 0x1F, for secure and insecure mode respectively.

Spilling a $cX to DMEM using xdld instruction is allowed if (ACL($cX) & 2) or (ACL($cX) & 8), for secure and insecure mode respectively.

Loading a secret into $cX sets a per-secret ACL, unconditionally.

=== Secrets ===
[[#Secure BootROM|Heavy Secure Mode]] has access to 64 128-bit keys which are burned at factory. These keys can be loaded using the $csecret instruction which takes the target crypto register and the key index as arguments.

Secrets are specific to each Falcon unit with the exception of secret 0x3F. This secret is effectively empty (all zeros), but is configured to be overwritten with the KFUSE private key once the KFUSE clock is enabled. The KFUSE private key is console-unique.

{| class=wikitable
! Index || ACL || Description
|-
| 0x00 || 0x13 || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares.
|-
| 0x01 || 0x10 || Used by Falcon's [[#Secure BootROM|Secure BootROM]] for the signature generation algorithm.
|-
| 0x02 || 0x10 ||
|-
| 0x03 || 0x11 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|-
| 0x04 || 0x10 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|-
| 0x05 || 0x13 || Used by nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares.
|-
| 0x06 || 0x11 || Used by Falcon's [[#Secure BootROM|Secure BootROM]] as key to decrypt data during authentication (decided by bit 17 in the [[#SEC|SEC]] register).
|-
| 0x07 || 0x11 || Used by [6.0.0+] nvhost_tsec firmware.
|-
| 0x08 || 0x10 ||
|-
| 0x09 || 0x13 || Used by nvhost_tsec firmware.
|-
| 0x0A || 0x11 ||
|-
| 0x0B || 0x10 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|-
| 0x0C || 0x13 ||
|-
| 0x0D || 0x11 ||
|-
| 0x0E || 0x10 ||
|-
| 0x0F || 0x13 || Used by nvhost_tsec firmware.
|-
| 0x10 || 0x11 || Used by [1.0.0-5.1.0] nvhost_tsec firmware.
|-
| 0x11 || 0x10 ||
|-
| 0x12 || 0x13 ||
|-
| 0x13 || 0x11 ||
|-
| 0x14 || 0x10 ||
|-
| 0x15 || 0x13 || Used by nvhost_nvdec_bl020_prod, [5.0.0+] nvhost_nvdec020_prod, [5.0.0+] nvhost_nvdec020_ns and [6.0.0+] nvhost_tsec firmwares.
|-
| 0x16 || 0x11 ||
|-
| 0x17 || 0x10 || Used by [11.0.0+] nvhost_tsec firmware.
|-
| 0x18 || 0x13 ||
|-
| 0x19 || 0x11 ||
|-
| 0x1A || 0x10 ||
|-
| 0x1B || 0x13 ||
|-
| 0x1C || 0x11 ||
|-
| 0x1D || 0x10 ||
|-
| 0x1E || 0x13 ||
|-
| 0x1F || 0x11 ||
|-
| 0x20 || 0x10 ||
|-
| 0x21 || 0x13 ||
|-
| 0x22 || 0x11 ||
|-
| 0x23 || 0x10 ||
|-
| 0x24 || 0x13 ||
|-
| 0x25 || 0x11 ||
|-
| 0x26 || 0x10 || Used by [[TSEC_Firmware#KeygenLdr|KeygenLdr]] and [[TSEC_Firmware#SecureBoot|SecureBoot]]
|-
| 0x27 || 0x13 ||
|-
| 0x28 || 0x11 ||
|-
| 0x29 || 0x10 ||
|-
| 0x2A || 0x13 ||
|-
| 0x2B || 0x11 ||
|-
| 0x2C || 0x10 ||
|-
| 0x2D || 0x13 ||
|-
| 0x2E || 0x11 ||
|-
| 0x2F || 0x10 ||
|-
| 0x30 || 0x13 ||
|-
| 0x31 || 0x11 ||
|-
| 0x32 || 0x10 ||
|-
| 0x33 || 0x13 ||
|-
| 0x34 || 0x11 ||
|-
| 0x35 || 0x10 ||
|-
| 0x36 || 0x13 ||
|-
| 0x37 || 0x11 ||
|-
| 0x38 || 0x10 ||
|-
| 0x39 || 0x13 ||
|-
| 0x3A || 0x11 ||
|-
| 0x3B || 0x10 ||
|-
| 0x3C || 0x13 || Used by nvhost_tsec firmware.
|-
| 0x3D || 0x11 ||
|-
| 0x3E || 0x10 ||
|-
| 0x3F || 0x10 || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|}

TSEC Firmware

2020-09-05T17:33:14Z

Vale: Fix FALCON_HWCFG MMIO names

= Boot Process =
TSEC is configured and initialized by the first bootloader during key generation.

[6.2.0+] TSEC is now configured at the end of the first bootloader's main function.

== Initialization ==
During this stage several clocks are programmed.
<pre>
// Program the HOST1X clock and resets
// Uses RST_DEVICES_L, CLK_OUT_ENB_L, CLK_SOURCE_HOST1X and CLK_L_HOST1X
enable_host1x_clkrst();

// Program the TSEC clock and resets
// Uses RST_DEVICES_U, CLK_OUT_ENB_U, CLK_SOURCE_TSEC and CLK_U_TSEC
enable_tsec_clkrst();

// Program the SOR_SAFE clock and resets
// Uses RST_DEVICES_Y, CLK_OUT_ENB_Y and CLK_Y_SOR_SAFE
enable_sor_safe_clkrst();

// Program the SOR0 clock and resets
// Uses RST_DEVICES_X, CLK_OUT_ENB_X and CLK_X_SOR0
enable_sor0_clkrst();

// Program the SOR1 clock and resets
// Uses RST_DEVICES_X, CLK_OUT_ENB_X, CLK_SOURCE_SOR1 and CLK_X_SOR1
enable_sor1_clkrst();

// Program the KFUSE clock resets
// Uses RST_DEVICES_H, CLK_OUT_ENB_H and CLK_H_KFUSE
enable_kfuse_clkrst();
</pre>

== Configuration ==
In this stage the Falcon IRQs, interfaces and DMA engine are configured.
<pre>
// Clear the Falcon DMA control register
*(u32 *)FALCON_DMACTL = 0;

// Enable Falcon IRQs
*(u32 *)FALCON_IRQMSET = 0xFFF2;

// Enable Falcon IRQs
*(u32 *)FALCON_IRQDEST = 0xFFF0;

// Enable Falcon interfaces
*(u32 *)FALCON_ITFEN = 0x03;

// Wait for Falcon's DMA engine to be idle
wait_flcn_dma_idle();
</pre>

== Firmware loading ==
The Falcon firmware code is stored in the first bootloader's data segment in IMEM.
<pre>
// Set DMA transfer base address to 0x40011900 >> 0x08
*(u32 *)FALCON_DMATRFBASE = 0x400119;

u32 trf_mode = 0; // A value of 0 sets FALCON_DMATRFCMD_IMEM
u32 dst_offset = 0;
u32 src_offset = 0;

// Load code into Falcon (0x100 bytes at a time)
while (src_offset < 0xF00)
{
flcn_load_firm(trf_mode, src_offset, dst_offset);
src_offset += 0x100;
dst_offset += 0x100;
}
</pre>

[6.2.0+] The transfer base address and size of the Falcon firmware code changed.
<pre>
// Set DMA transfer base address to 0x40010E00 >> 0x08
*(u32 *)FALCON_DMATRFBASE = 0x40010E;

u32 trf_mode = 0; // A value of 0 sets FALCON_DMATRFCMD_IMEM
u32 dst_offset = 0;
u32 src_offset = 0;

// Load code into Falcon (0x100 bytes at a time)
while (src_offset < 0x2900)
{
flcn_load_firm(trf_mode, src_offset, dst_offset);
src_offset += 0x100;
dst_offset += 0x100;
}
</pre>

== Firmware booting ==
Falcon is booted up and the first bootloader waits for it to finish.
// Set magic value in host1x scratch space
*(u32 *)0x50003300 = 0x34C2E1DA;

// Clear Falcon scratch1 MMIO
*(u32 *)FALCON_SCRATCH1 = 0;

// Set Falcon boot key version in scratch0 MMIO
*(u32 *)FALCON_SCRATCH0 = 0x01;

// Set Falcon's boot vector address
*(u32 *)FALCON_BOOTVEC = 0;

// Signal Falcon's CPU
*(u32 *)FALCON_CPUCTL = 0x02;

// Wait for Falcon's DMA engine to be idle
wait_flcn_dma_idle();

u32 boot_res = 0;

// The bootloader allows the TSEC two seconds from this point to do its job
u32 maximum_time = read_timer() + 2000000;

while (!boot_res)
{
// Read boot result from scratch1 MMIO
boot_res = *(u32 *)FALCON_SCRATCH1;

// Read from TIMERUS_CNTR_1US (microseconds from boot)
u32 current_time = read_timer();

// Booting is taking too long
if (current_time > maximum_time)
panic();
}

// Invalid boot result was returned
if (boot_res != 0xB0B0B0B0)
panic();
</pre>

[6.2.0+] Falcon is booted up, but the first bootloader is left in an infinite loop.
<pre>
// Set magic value in host1x scratch space
*(u32 *)0x50003300 = 0x34C2E1DA;

// Clear Falcon scratch1 MMIO
*(u32 *)FALCON_SCRATCH1 = 0;

// Set Falcon boot key version in scratch0 MMIO
*(u32 *)FALCON_SCRATCH0 = 0x01;

// Set Falcon's boot vector address
*(u32 *)FALCON_BOOTVEC = 0;

// Signal Falcon's CPU
*(u32 *)FALCON_CPUCTL = 0x02;

// Infinite loop
while (1);
</pre>

== TSEC key generation ==
The TSEC key is generated by reading SOR1 registers modified by the Falcon CPU.
<pre>
// Clear magic value in host1x scratch space
*(u32 *)0x50003300 = 0;

// Read TSEC key
u32 tsec_key[4];
tsec_key[0] = *(u32 *)NV_SOR_DP_HDCP_BKSV_LSB;
tsec_key[1] = *(u32 *)NV_SOR_TMDS_HDCP_BKSV_LSB;
tsec_key[2] = *(u32 *)NV_SOR_TMDS_HDCP_CN_MSB;
tsec_key[3] = *(u32 *)NV_SOR_TMDS_HDCP_CN_LSB;

// Clear SOR1 registers
*(u32 *)NV_SOR_DP_HDCP_BKSV_LSB = 0;
*(u32 *)NV_SOR_TMDS_HDCP_BKSV_LSB = 0;
*(u32 *)NV_SOR_TMDS_HDCP_CN_MSB = 0;
*(u32 *)NV_SOR_TMDS_HDCP_CN_LSB = 0;

if (out_size < 0x10)
out_size = 0x10;

// Copy back the TSEC key
memcpy(out_buf, tsec_key, out_size);
</pre>

[6.2.0+] This is now done inside an encrypted TSEC payload.

== Cleanup ==
Clocks and resets are disabled before returning.
<pre>
// Deprogram KFUSE clock and resets
// Uses RST_DEVICES_H, CLK_OUT_ENB_H and CLK_H_KFUSE
disable_kfuse_clkrst();

// Deprogram SOR1 clock and resets
// Uses RST_DEVICES_X, CLK_OUT_ENB_X, CLK_SOURCE_SOR1 and CLK_X_SOR1
disable_sor1_clkrst();

// Deprogram SOR0 clock and resets
// Uses RST_DEVICES_X, CLK_OUT_ENB_X and CLK_X_SOR0
disable_sor0_clkrst();

// Deprogram SOR_SAFE clock and resets
// Uses RST_DEVICES_Y, CLK_OUT_ENB_Y and CLK_Y_SOR_SAFE
disable_sor_safe_clkrst();

// Deprogram TSEC clock and resets
// Uses RST_DEVICES_U, CLK_OUT_ENB_U, CLK_SOURCE_TSEC and CLK_U_TSEC
disable_tsec_clkrst();

// Deprogram HOST1X clock and resets
// Uses RST_DEVICES_L, CLK_OUT_ENB_L, CLK_SOURCE_HOST1X and CLK_L_HOST1X
disable_host1x_clkrst();
</pre>

= TSEC Firmware =
The actual code loaded into TSEC is assembled in NVIDIA's proprietary fuc5 ISA using crypto extensions.
Stored inside the first bootloader, this firmware binary is split into 4 blobs (names are unofficial): [[#Boot|Boot]] (unencrypted and unauthenticated code), [[#KeygenLdr|KeygenLdr]] (unencrypted and authenticated code), [[#Keygen|Keygen]] (encrypted and authenticated code) and [[#Key data|key data]].

[6.2.0+] There are now 2 new blobs (names are unofficial): [[#SecureBootLdr|SecureBootLdr]] (unencrypted and unauthenticated code), [[#SecureBoot|SecureBoot]] (part unencrypted and unauthenticated code, part encrypted and authenticated code).

Firmware can be disassembled with [http://envytools.readthedocs.io/en/latest/ envytools'] [https://github.com/envytools/envytools/tree/master/envydis envydis]:

<code>envydis -i tsec_fw.bin -m falcon -V fuc5 -F crypt</code>

Note that the instruction set has variable length instructions, and the disassembler is not very good at detecting locations it should start disassembling from. One needs to disassemble multiple sub-regions and join them together.

== Boot ==
During this stage, [[#Key data|key data]] is loaded and [[#KeygenLdr|KeygenLdr]] is authenticated, loaded and executed.
Before returning, this stage writes back to the host (using MMIO registers) and sets the key used by the first bootloader.

[6.2.0+] During this stage, [[#Key data|key data]] is loaded and execution jumps to [[#SecureBootLdr|SecureBootLdr]].

=== Initialization ===
The firmware initially sets up the stack pointer to the end of the available data segment.
<pre>
// Read data segment size from IO space
u32 data_seg_size = *(u32 *)FALCON_HWCFG;
data_seg_size >>= 0x09;
data_seg_size &= 0x1FF;
data_seg_size <<= 0x08;

// Set the stack pointer
*(u32 *)sp = data_seg_size;
</pre>

=== Main ===
The firmware reads the [[#Key data|key data]] blob and then loads, authenticates and executes [[#KeygenLdr|KeygenLdr]] which sets the TSEC key.
<pre>
u32 dmem_start = 0;
u8 key_data_buf[0x7C];

// Read the key data blob from code segment
u32 key_data_addr = 0x300;
u32 key_data_size = 0x7C;
memcpy_i2d(key_data_buf, key_data_addr, key_data_size);

// Read the next stage from code segment into data space
u32 blob1_addr = 0x400;
u32 blob1_size = *(u32 *)(key_data_buf + 0x74);
memcpy_i2d(dmem_start, blob1_addr, blob1_size);

// Upload the next stage into Falcon's code segment
u32 blob1_virt_addr = 0x300;
bool use_secret = true;
memcpy_d2i(blob1_virt_addr, dmem_start, blob1_size, blob1_virt_addr, use_secret);

u32 boot_res = 0;
u32 time = 0;
bool is_blob_dec = false;

while (true)
{
if (time == 4000001)
{
// Write boot failed (timeout) magic to FALCON_SCRATCH1
boot_res = 0xC0C0C0C0;
*(u32 *)FALCON_SCRATCH1 = boot_res;

break;
}

// Load key version from FALCON_SCRATCH0 (bootloader sends 0x01)
u32 key_version = *(u32 *)FALCON_SCRATCH0;

if (key_version == 0x64)
{
// Skip all next stages
boot_res = 0xB0B0B0B0;
*(u32 *)FALCON_SCRATCH1 = boot_res;

break;
}
else
{
if (key_version > 0x03)
boot_res = 0xD0D0D0D0; // Invalid key version
else if (key_version == 0)
boot_res = 0xB0B0B0B0; // No keys used
else
{
u32 key_buf[0x7C];

// Copy key data
memcpy(key_buf, key_data_buf, 0x7C);

u32 crypto_reg_flag = 0x00060000;
u32 blob1_hash_addr = key_buf + 0x20;

// Set auth_addr to 0x300 and auth_size to blob1_size
$cauth = ((blob1_size << 0x10) | 0x03);

// The next 2 xfer instructions will be overridden
// and target changes from DMA to crypto
cxset(0x02);

// Transfer data to crypto register c6
xdst(0, (blob1_hash_addr | crypto_reg_flag));

// Wait for all data loads/stores to finish
xdwait();

// Jump to KeygenLdr
u32 keygenldr_res = exec_keygenldr(key_buf, key_version, is_blob_dec);
is_blob_dec = true; // Set this to prevent decrypting again

// Set boot finish magic on success
if (keygenldr_res == 0)
boot_res = 0xB0B0B0B0
}

// Write result to FALCON_SCRATCH1
*(u32 *)FALCON_SCRATCH1 = boot_res;

if (boot_res == 0xB0B0B0B0)
break;
}

time++;
}

// Overwrite the TSEC key in SOR1 registers
// This has no effect because the KeygenLdr locks out the TSEC DMA engine
tsec_set_key(key_data_buf);

return boot_res;
</pre>

[6.2.0+] The firmware calculates the start address of [[#SecureBootLdr|SecureBootLdr]] through [[#Key data|key data]] and jumps to it.
<pre>
u8 key_data_buf[0x84];

// Read the key data blob
u32 key_data_addr = 0x300;
u32 key_data_size = 0x84;
memcpy_i2d(key_data_buf, key_data_addr, key_data_size);

// Calculate the next blob's address in Falcon code segment
u32 blob4_size = *(u32 *)(key_data_buf + 0x80);
u32 blob0_size = *(u32 *)(key_data_buf + 0x70);
u32 blob1_size = *(u32 *)(key_data_buf + 0x74);
u32 blob2_size = *(u32 *)(key_data_buf + 0x78);
u32 blob3_addr = blob0_size + blob1_size + 0x100 + blob2_size + blob4_size;

// Jump to next blob
(void *)blob3_addr();

return 0;
</pre>

==== tsec_set_key ====
This method takes '''key_data_buf''' (a 16 bytes buffer) as argument and writes its contents to SOR1 registers.
<pre>
// This is TSEC_MMIO + 0x1000 + (0x1C300 / 0x40)
*(u32 *)TSEC_DMA_TIMEOUT = 0xFFF;

// Read the key's words
u32 key0 = *(u32 *)(key_data_buf + 0x00);
u32 key1 = *(u32 *)(key_data_buf + 0x04);
u32 key2 = *(u32 *)(key_data_buf + 0x08);
u32 key3 = *(u32 *)(key_data_buf + 0x0C);

u32 result = 0;

// Write key0 to SOR1 and check for errors
result = tsec_dma_write(NV_SOR_DP_HDCP_BKSV_LSB, key0);
if (result)
return result;

// Write key1 to SOR1 and check for errors
result = tsec_dma_write(NV_SOR_TMDS_HDCP_BKSV_LSB, key1);
if (result)
return result;

// Write key2 to SOR1 and check for errors
result = tsec_dma_write(NV_SOR_TMDS_HDCP_CN_MSB, key2);
if (result)
return result;

// Write key3 to SOR1 and check for errors
result = tsec_dma_write(NV_SOR_TMDS_HDCP_CN_LSB, key3);
if (result)
return result;

return result;
</pre>

===== tsec_dma_write =====
This method takes '''addr''' and '''value''' as arguments and performs a DMA write using TSEC MMIO.
<pre>
u32 result = 0;

// Wait for TSEC DMA engine
// This waits for bit 0x0C in TSEC_DMA_CMD to be 0
result = wait_tsec_dma();

// Wait failed
if (result)
return 1;

// Set the destination address
// This is TSEC_MMIO + 0x1000 + (0x1C100 / 0x40)
*(u32 *)TSEC_DMA_ADDR = addr;

// Set the value
// This is TSEC_MMIO + 0x1000 + (0x1C200 / 0x40)
*(u32 *)TSEC_DMA_VAL = value;

// Start transfer
// This is TSEC_MMIO + 0x1000 + (0x1C000 / 0x40)
*(u32 *)TSEC_DMA_CMD = 0x800000F2;

// Wait for TSEC DMA engine
// This waits for bit 0x0C in TSEC_DMA_CMD to be 0
result = wait_tsec_dma();

// Wait failed
if (result)
return 1;

return 0;
</pre>

== KeygenLdr ==
This stage is responsible for reconfiguring the Falcon's crypto co-processor and loading, decrypting, authenticating and executing [[#Keygen|Keygen]].

=== Main ===
<pre>
// Clear interrupt flags
$flags.ie0 = 0;
$flags.ie1 = 0;
$flags.ie2 = 0;

// Clear overrides
cxset(0x80);

// Clear bit 0x13 in cauth
$cauth = ($cauth & ~(1 << 0x13));

// Set the target port for memory transfers
$xtargets = 0;

// Wait for all data loads/stores to finish
xdwait();

// Wait for all code loads to finish
xcwait();

// The next 2 xfer instructions will be overridden
// and target changes from DMA to crypto
cxset(0x02);

// Transfer data to crypto register c0
// This should clear any leftover data
xdst(0, 0);

// Wait for all data loads/stores to finish
xdwait();

// Clear all crypto registers, except c6 which is used for auth
cxor($c0, $c0);
cmov($c1, $c0);
cmov($c2, $c0);
cmov($c3, $c0);
cmov($c4, $c0);
cmov($c5, $c0);
cmov($c7, $c0);

// Clear TSEC_TEGRA_CTL_TKFI_KFUSE
// This is TSEC_MMIO + 0x1000 + (0x20E00 / 0x40)
*(u32 *)TSEC_TEGRA_CTL &= 0xFFFEFFFF;

// Set TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
// This is TSEC_MMIO + 0x1000 + (0x10600 / 0x40)
*(u32 *)TSEC_SCP_CTL_PKEY |= 0x01;

u32 is_pkey_loaded = 0;

// Wait for TSEC_SCP_CTL_PKEY_LOADED
while (!is_pkey_loaded)
is_pkey_loaded = (*(u32 *)TSEC_SCP_CTL_PKEY & 0x02);

// Read data segment size from IO space
u32 data_seg_size = *(u32 *)FALCON_HWCFG;
data_seg_size >>= 0x09;
data_seg_size &= 0x1FF;
data_seg_size <<= 0x08;

// Check stack bounds
if (($sp >= data_seg_size) || ($sp < 0x800))
exit();

// Load and execute the Keygen stage
load_keygen(key_buf, key_version, is_blob_dec);

// Clear the cauth signature
csigclr();

// Clear all crypto registers
cxor($c0, $c0);
cxor($c1, $c1);
cxor($c2, $c2);
cxor($c3, $c3);
cxor($c4, $c4);
cxor($c5, $c5);
cxor($c6, $c6);
cxor($c7, $c7);

// Take SCP out of lockdown
// This is TSEC_MMIO + 0x1000 + (0x10300 / 0x40)
*(u32 *)TSEC_SCP_CTL_LOCK = 0;

return;
</pre>

==== load_keygen ====
This method takes '''key_buf''', '''key_version''' and '''is_blob_dec''' as arguments and is responsible for loading, decrypting, authenticating and executing [[#Keygen|Keygen]].
Notably, it also does AES-CMAC over the unauthorized [[#Boot|Boot]] blob to make sure it hasn't been tampered with.
<pre>
u32 res = 0;

u32 dmem_start = 0;
u32 blob0_addr = 0;
u32 blob0_size = *(u32 *)(key_buf + 0x70);

// Load blob0 code to the start of the data segment
memcpy_i2d(dmem_start, blob0_addr, blob0_size);

// Generate "CODE_SIG_01" key into c4 crypto register
gen_usr_key(0, 0);

// Encrypt buffer with c4
u8 sig_key[0x10];
enc_buf(sig_key, blob0_size);

u32 src_addr = dmem_start;
u32 src_size = blob0_size;
u32 iv_addr = sig_key;
u32 dst_addr = sig_key;
u32 mode = 0x02; // AES-CMAC
u32 use_imem = 0;

// Do AES-CMAC over blob0 code
do_crypto(src_addr, src_size, iv_addr, dst_addr, mode, use_imem);

// Compare the resulting hash with the one from the key buffer
if (memcmp(dst_addr, key_buf + 0x10, 0x10))
{
res = 0xDEADBEEF;
return res;
}

u32 blob1_size = *(u32 *)(key_buf + 0x74);

// Decrypt Keygen blob if needed
if (!is_blob_dec)
{
// Read Stage2's size from key buffer
u32 blob2_size = *(u32 *)(key_buf + 0x78);

// Check stack bounds
if ($sp > blob2_size)
{
u32 blob2_virt_addr = blob0_size + blob1_size;
u32 blob2_phys_addr = blob2_virt_addr + 0x100;

// Read the encrypted Keygen blob
memcpy_i2d(dmem_start, blob2_phys_addr, blob2_size);

// Generate "CODE_ENC_01" key into c4 crypto register
gen_usr_key(0x01, 0x01);

u32 src_addr = dmem_start;
u32 src_size = blob2_size;
u32 iv_addr = key_buf + 0x40;
u32 dst_addr = dmem_start;
u32 mode = 0; // AES-128-CBC
u32 use_imem = 0;

// Decrypt Keygen blob with AES-128-CBC
do_crypto(src_addr, src_size, iv_addr, dst_addr, mode, use_imem);

// Upload decrypted Keygen into Falcon's code segment
bool use_secret = true;
memcpy_d2i(blob2_virt_addr, dmem_start, blob2_size, blob2_virt_addr, use_secret);

// Clear out the decrypted blob
memset(dmem_start, 0, blob2_size);
}
}

// The next 2 xfer instructions will be overridden
// and target changes from DMA to crypto
cxset(0x02);

u32 crypto_reg_flag = 0x00060000;
u32 blob2_hash_addr = key_buf + 0x30;

// Transfer the Keygen auth hash to crypto register c6
xdst(0, (blob2_hash_addr | crypto_reg_flag));

// Wait for all data loads/stores to finish
xdwait();

// Save previous cauth value
u32 cauth_old = $cauth;

// Set auth_addr to blob2_virt_addr and auth_size to blob2_size
$cauth = ((blob2_virt_addr >> 0x08) | (blob2_size << 0x10));

u32 hovi_key_addr = 0;

// Select next stage key
if (key_version == 0x01) // Use HOVI_EKS_01
hovi_key_addr = key_buf + 0x50;
else if (key_version == 0x02) // Use HOVI_COMMON_01
hovi_key_addr = key_buf + 0x60;
else if (key_version == 0x03) // Use debug key (empty)
hovi_key_addr = key_buf + 0x00;
else
res = 0xD0D0D0D0

// Jump to Keygen
if (hovi_key_addr)
res = exec_keygen(hovi_key_addr, key_version);

// Clear out key data
memset(key_buf, 0, 0x7C);

// Restore previous cauth value
$cauth = cauth_old;

return res;
</pre>

===== gen_usr_key =====
This method takes '''type''' and '''mode''' as arguments and generates a key.
<pre>
u8 seed_buf[0x10];

// Read a 16 bytes seed based on supplied type
/*
type == 0: "CODE_SIG_01" + null padding
type == 1: "CODE_ENC_01" + null padding
*/
get_seed(seed_buf, type);

// This will write the seed into crypto register c0
crypto_store(0, seed_buf);

// Load selected secret into crypto register c1
csecret($c1, 0x26);

// Bind c1 register as the key for enc/dec operations
ckeyreg($c1);

// Encrypt seed_buf in c0 using keyreg value as key into c1
cenc($c1, $c0);

// Encrypt the auth signature (stored in c6) with c1 and store in c1
csigenc($c1, $c1);

// Copy the result to c4 (will be used as key)
cmov($c4, $c1);

// Do key expansion for decryption if necessary
if (mode != 0)
ckexp($c4, $c4);

return;
</pre>

===== enc_buf =====
This method takes '''buf''' (a 16 bytes buffer) and '''size''' as arguments and encrypts the supplied buffer.
<pre>
// Set first 3 words to null
*(u32 *)(buf + 0x00) = 0;
*(u32 *)(buf + 0x04) = 0;
*(u32 *)(buf + 0x08) = 0;

// Swap halves (b16, b32 and b16 again) and store it as the last word
*(u32 *)(buf + 0x0C) = (
((size & 0x000000FF) << 0x08
| (size & 0x0000FF00) >> 0x08) << 0x10
| ((size & 0x00FF0000) >> 0x10) << 0x08
| (size & 0xFF000000) >> 0x18
);

// This will write buf into crypto register c3
crypto_store(0x03, buf);

// Bind c4 register as the key for enc/dec operations
ckeyreg($c4);

// Encrypt buf in c3 using keyreg value as key and store in c5
cenc($c5, $c3);

// This will read into buf from crypto register c5
crypto_load(0x05, buf);

return;
</pre>

===== crypto_store =====
This method takes '''reg''' (a crypto register) and '''buf''' (a 16 bytes buffer) as arguments and loads the supplied buffer into the crypto register.
<pre>
// The next two xfer instructions will be overridden
// and target changes from DMA to crypto
cxset(0x02);

// Encode the source buffer and the destination register for the xfer
u32 crypto_xfer_flag = (u32)buf | reg << 0x10;

// Transfer the supplied buffer to the supplied crypto register
xdst(crypto_xfer_flag, crypto_xfer_flag);

// Wait for all data loads/stores to finish
xdwait();

return;
</pre>

===== crypto_load =====
This method takes '''reg''' (a crypto register) and '''buf''' (a 16 bytes buffer) as arguments and loads the contents of the supplied register into the supplied buffer.
<pre>
// The next two xfer instructions will be overridden
// and target changes from DMA to crypto
cxset(0x02);

// Encode the destination buffer and the source register for the xfer
u32 crypto_xfer_flag = (u32)buf | reg << 0x10;

// Transfer the contents of the supplied crypto register into the supplied buffer
xdld(crypto_xfer_flag, crypto_xfer_flag);

// Wait for all data loads/stores to finish
xdwait();

return;
</pre>

===== do_crypto =====
This is the method responsible for all crypto operations performed during [[#KeygenLdr|KeygenLdr]]. It takes '''src_addr''', '''src_size''', '''iv_addr''', '''dst_addr''', '''mode''' and '''use_imem''' as arguments.
<pre>
// Check for invalid source data size
if (!src_size || (src_size & 0x0F))
exit();

// Check for invalid source data address
if (src_addr & 0x0F)
exit();

// Check for invalid destination data address
if (dst_addr & 0x0F)
exit();

// Use IV if available
if (iv_addr)
{
// This will write the iv_addr into crypto register c5
crypto_store(0x05, iv_addr);
}
else
{
// Clear c5 register (use null IV)
cxor($c5, $c5);
}

// Bind c4 register as the key for enc/dec operations
ckeyreg(c4);

if (mode == 0x00) // AES-128-CBC decrypt
{
// Create crypto script with 5 instructions
cs0begin(0x05);

cxsin($c3); // Read 0x10 bytes from crypto stream into c3
cdec($c2, $c3); // Decrypt from c3 into c2
cxor($c5, $c2); // XOR c2 with c5 and store in c5
cxsout($c5); // Write 0x10 bytes into crypto stream from c5
cmov($c5, $c3); // Move c3 into c5
}
else if (mode == 0x01) // AES-128-CBC encrypt
{
// Create crypto script with 4 instructions
cs0begin(0x04);

cxsin($c3); // Read 0x10 bytes from crypto stream into c3
cxor($c3, $c5); // XOR c5 with c3 and store in c3
cenc($c5, $c3); // Encrypt from c3 into c5
cxsout($c5); // Write 0x10 bytes into crypto stream from c5
}
else if (mode == 0x02) // AES-CMAC
{
// Create crypto script with 3 instructions
cs0begin(0x03);

cxsin($c3); // Read 0x10 bytes from crypto stream into c3
cxor($c5, $c3); // XOR c5 with c3 and store in c5
cenc($c5, $c5); // Encrypt from c5 into c5
}
else if (mode == 0x03) // AES-128-ECB decrypt
{
// Create crypto script with 3 instructions
cs0begin(0x03);

cxsin($c3); // Read 0x10 bytes from crypto stream into c3
cdec($c5, $c3); // Decrypt from c3 into c5
cxsout($c5); // Write 0x10 bytes into crypto stream from c5
}
else if (mode == 0x04) // AES-128-ECB encrypt
{
// Create crypto script with 3 instructions
cs0begin(0x03);

cxsin($c3); // Read 0x10 bytes from crypto stream into c3
cenc($c5, $c3); // Encrypt from c3 into c5
cxsout($c5); // Write 0x10 bytes into crypto stream from c5
}
else
return;

// Main loop
while (src_size > 0)
{
u32 blk_count = (src_size >> 0x04);

if (blk_count > 0x10)
blk_count = 0x10;

// Check size align
if (blk_count & (blk_count - 0x01))
blk_count = 0x01;

u32 blk_size = (blk_count << 0x04);

u32 crypto_xfer_src = 0;
u32 crypto_xfer_dst = 0;

if (block_size == 0x20)
{
crypto_xfer_src = (0x00030000 | src_addr);
crypto_xfer_dst = (0x00030000 | dst_addr);

// Execute crypto script 2 times (1 for each block)
cs0exec(0x02);
}
else if (block_size == 0x40)
{
crypto_xfer_src = (0x00040000 | src_addr);
crypto_xfer_dst = (0x00040000 | dst_addr);

// Execute crypto script 4 times (1 for each block)
cs0exec(0x04);
}
else if (block_size == 0x80)
{
crypto_xfer_src = (0x00050000 | src_addr);
crypto_xfer_dst = (0x00050000 | dst_addr);

// Execute crypto script 8 times (1 for each block)
cs0exec(0x08);
}
else if (block_size == 0x100)
{
crypto_xfer_src = (0x00060000 | src_addr);
crypto_xfer_dst = (0x00060000 | dst_addr);

// Execute crypto script 16 times (1 for each block)
cs0exec(0x10);
}
else
{
crypto_xfer_src = (0x00020000 | src_addr);
crypto_xfer_dst = (0x00020000 | dst_addr);

// Execute crypto script 1 time (1 for each block)
cs0exec(0x01);

// Ensure proper block size
block_size = 0x10;
}

// The next xfer instruction will be overridden
// and target changes from DMA to crypto input/output stream
if (use_imem)
cxset(0xA1); // Flag 0xA0 is falcon imem <-> crypto input/output stream
else
cxset(0x21); // Flag 0x20 is external mem <-> crypto input/output stream

// Transfer data into the crypto input/output stream
xdst(crypto_xfer_src, crypto_xfer_src);

// AES-CMAC only needs one more xfer instruction
if (mode == 0x02)
{
// The next xfer instruction will be overridden
// and target changes from DMA to crypto input/output stream
if (use_imem)
cxset(0xA1); // Flag 0xA0 is falcon imem <-> crypto input/output stream
else
cxset(0x21); // Flag 0x20 is external mem <-> crypto input/output stream

// Wait for all data loads/stores to finish
xdwait();
}
else // AES enc/dec needs 2 more xfer instructions
{
// The next 2 xfer instructions will be overridden
// and target changes from DMA to crypto input/output stream
if (use_imem)
cxset(0xA2); // Flag 0xA0 is falcon imem <-> crypto input/output stream
else
cxset(0x22); // Flag 0x20 is external mem <-> crypto input/output stream

// Transfer data from the crypto input/output stream
xdld(crypto_xfer_dst, crypto_xfer_dst);

// Wait for all data loads/stores to finish
xdwait();

// Increase the destination address by block size
dst_addr += block_size;
}

// Increase the source address by block size
src_addr += block_size;

// Decrease the source size by block size
src_size -= block_size;
}

// AES-CMAC result is in c5
if (mode == 0x02)
{
// This will read into dst_addr from crypto register c5
crypto_load(0x05, dst_addr);
}

return;
</pre>

== Keygen ==
This stage is decrypted by [[#KeygenLdr|KeygenLdr]] using a key generated by encrypting the KeygenLdr auth signature with a seed encrypted with a csecret. It will generate the final TSEC key.

=== Main ===
The main function takes '''key_addr''' and '''key_type''' as arguments from [[#KeygenLdr|KeygenLdr]].
<pre>
u32 falcon_rev = *(u32 *)FALCON_HWCFG2 & 0x0F;

// Falcon hardware revision must be 5
if (falcon_rev != 0x05)
exit();

// Clear interrupt flags
$flags.ie0 = 0;
$flags.ie1 = 0;
$flags.ie2 = 0;

// Set the target port for memory transfers
$xtargets = 0;

// Generate the TSEC key
gen_tsec_key(key_addr, key_type);

// Clear the cauth signature
csigclr();

// Clear all crypto registers
cxor($c0, $c0);
cxor($c1, $c1);
cxor($c2, $c2);
cxor($c3, $c3);
cxor($c4, $c4);
cxor($c5, $c5);
cxor($c6, $c6);
cxor($c7, $c7);

return;
</pre>

==== gen_tsec_key ====
This method is responsible for generating the final TSEC key. It takes '''key_addr''' and '''key_type''' as arguments.
<pre>
// This will use TSEC DMA to look for 0x34C2E1DA in host1x scratch space
u32 host1x_res = check_host1x_magic();

// Failed to find magic word
if (host1x_res != 0)
return;

u32 crypto_reg_flag = 0x00000000;

// The next 0x02 xfer instructions will be overridden
// and target changes from DMA to crypto register
cxset(0x02);

// Transfer the seed in key_addr to crypto register c0
xdst(0, (key_addr | crypto_reg_flag));

// Wait for all data loads/stores to finish
xdwait();

crypto_reg_flag = 0x00020000;

if (key_type == 0x01) // HOVI_EKS_01
{
// Load selected secret into crypto register c1
csecret($c1, 0x3F);

// Encrypt the auth signature with c1 and store in c1
csigenc($c1, $c1);

// Load selected secret into crypto register c2
csecret($c2, 0x00);

// Bind c2 register as the key for enc/dec operations
ckeyreg($c2);

// Encrypt the seed from key_addr and store in c2
cenc($c2, $c0);

// Bind c2 register as the key for enc/dec operations
ckeyreg($c2);

// Encrypt the auth signature with c2 and store in c2
csigenc($c2, $c2);

// Bind c2 register as the key for enc/dec operations
ckeyreg($c2);

// Encrypt c1 and store in c2
cenc($c2, $c1);

// The next 0x02 xfer instructions will be overridden
// and target changes from DMA to crypto register
cxset(0x02);

// Transfer the resulting key from crypto register c2 to key_addr
xdld(0, (key_addr | crypto_reg_flag));

// Wait for all data loads/stores to finish
xdwait();
}
else if (key == 0x02) // HOVI_COMMON_01
{
// Load selected secret into crypto register c2
csecret($c2, 0x00);

// Bind c2 register as the key for enc/dec operations
ckeyreg($c2);

// Encrypt the seed from key_addr and store in c2
cenc($c2, $c0);

// Bind c2 register as the key for enc/dec operations
ckeyreg($c2);

// Encrypt the auth signature with c2 and store in c2
csigenc($c2, $c2);

// The next 0x02 xfer instructions will be overridden
// and target changes from DMA to crypto register
cxset(0x02);

// Transfer the resulting key from crypto register c2 to key_addr
xdld(0, (key_addr | crypto_reg_flag));

// Wait for all data loads/stores to finish
xdwait();
}

// Use TSEC DMA to write the key in SOR1 registers
sor1_set_key(key_addr);

return;
</pre>

==== sor1_set_key ====
This method takes '''key_addr''' (start address of a 16 bytes buffer) as argument and transfers its contents to SOR1 registers.

The implementation is equivalent to [[#tsec_set_key|tsec_set_key]].

== SecureBootLdr ==
[6.2.0+] This was introduced to try to recover the secure boot from the RCM vulnerability.

This stage starts by authenticating and executing [[#KeygenLdr|KeygenLdr]] which in turn authenticates, decrypts and executes [[#Keygen|Keygen]] (both blobs remain unchanged from previous firmware versions).
After the TSEC key has been generated, execution returns to this stage which then parses and executes [[#SecureBoot|SecureBoot]].

=== Main ===
<pre>
u8 key_data_buf[0x84];
u8 tmp_key_data_buf[0x84];

// Read the key data from memory
u32 key_data_addr = 0x300;
u32 key_data_size = 0x84;
memcpy_i2d(key_data_buf, key_data_addr, key_data_size);

// Read the KeygenLdr blob from memory
u32 boot_base_addr = 0;
u32 blob1_addr = 0x400;
u32 blob1_size = *(u32 *)(key_data_buf + 0x74);
memcpy_i2d(boot_base_addr, blob1_addr, blob1_size);

// Upload the next code segment into Falcon's CODE region
u32 blob1_virt_addr = 0x300;
bool use_secret = true;
memcpy_d2i(blob1_virt_addr, boot_base_addr, blob1_size, blob1_virt_addr, use_secret);

// Backup the key data
memcpy(tmp_key_data_buf, key_data_buf, 0x84);

// Save previous cauth value
u32 cauth_old = $cauth;

// Set auth_addr to 0x300 and auth_size to blob1_size
$cauth = ((blob1_size << 0x10) | (0x300 >> 0x08));

// The next 2 xfer instructions will be overridden
// and target changes from DMA to crypto
cxset(0x02);

u32 crypto_reg_flag = 0x00060000;
u32 blob1_hash_addr = tmp_key_data_buf + 0x20;

// Transfer data to crypto register c6
xdst(0, (blob1_hash_addr | crypto_reg_flag));

// Wait for all data loads/stores to finish
xdwait();

u32 key_version = 0x01;
bool is_blob_dec = false;

// Jump to KeygenLdr
u32 keygenldr_res = exec_keygenldr(tmp_key_data_buf, key_version, is_blob_dec);

// Set boot finish magic on success
if (keygenldr_res == 0)
keygenldr_res = 0xB0B0B0B0

// Write result to FALCON_SCRATCH1
*(u32 *)FALCON_SCRATCH1 = keygenldr_res;

if (keygenldr_res != 0xB0B0B0B0)
return keygenldr_res;

// Restore previous cauth value
$cauth = cauth_old;

u8 flcn_hdr_buf[0x18];
u8 flcn_os_hdr_buf[0x10];

blob1_size = *(u32 *)(key_data_buf + 0x74);
u32 blob2_size = *(u32 *)(key_data_buf + 0x78);
u32 blob0_size = *(u32 *)(key_data_buf + 0x70);

// Read the SecureBoot blob's Falcon header from memory
u32 blob4_flcn_hdr_addr = (((blob0_size + blob1_size) + 0x100) + blob2_size);
memcpy_i2d(flcn_hdr_buf, blob4_flcn_hdr_addr, 0x18);

blob1_size = *(u32 *)(key_data_buf + 0x74);
blob2_size = *(u32 *)(key_data_buf + 0x78);
blob0_size = *(u32 *)(key_data_buf + 0x70);
u32 flcn_hdr_size = *(u32 *)(flcn_hdr_buf + 0x0C);

// Read the SecureBoot blob's Falcon OS header from memory
u32 blob4_flcn_os_hdr_addr = ((((blob0_size + blob1_size) + 0x100) + blob2_size) + flcn_hdr_size);
memcpy_i2d(flcn_os_hdr_buf, blob4_flcn_os_hdr_addr, 0x10);

blob1_size = *(u32 *)(key_data_buf + 0x74);
blob2_size = *(u32 *)(key_data_buf + 0x78);
blob0_size = *(u32 *)(key_data_buf + 0x70);
u32 flcn_code_hdr_size = *(u32 *)(flcn_hdr_buf + 0x10);
u32 flcn_os_size = *(u32 *)(flcn_os_hdr_buf + 0x04);

// Read the SecureBoot blob's Falcon OS image from memory
u32 blob4_flcn_os_addr = ((((blob0_size + blob1_size) + 0x100) + blob2_size) + flcn_code_hdr_size);
memcpy_i2d(boot_base_addr, blob4_flcn_os_hdr_addr, flcn_os_size);

// Upload the SecureBoot's Falcon OS image boot stub code segment into Falcon's CODE region
u32 blob4_flcn_os_boot_virt_addr = 0;
u32 blob4_flcn_os_boot_size = 0x100;
use_secret = false;
memcpy_d2i(blob4_flcn_os_boot_virt_addr, boot_base_addr, blob4_flcn_os_boot_size, blob4_flcn_os_boot_virt_addr, use_secret);

flcn_os_size = *(u32 *)(flcn_os_hdr_buf + 0x04);

// Upload the SecureBoot blob's Falcon OS encrypted image code segment into Falcon's CODE region
u32 blob4_flcn_os_img_virt_addr = 0x100;
u32 blob4_flcn_os_img_size = (flcn_os_size - 0x100);
use_secret = true;
memcpy_d2i(blob4_flcn_os_img_virt_addr, boot_base_addr + 0x100, blob4_flcn_os_img_size, blob4_flcn_os_img_virt_addr, use_secret);

// Wait for all code loads to finish
xcwait();

blob1_size = *(u32 *)(key_data_buf + 0x74);
blob2_size = *(u32 *)(key_data_buf + 0x78);
blob0_size = *(u32 *)(key_data_buf + 0x70);
flcn_code_hdr_size = *(u32 *)(flcn_hdr_buf + 0x10);
u32 flcn_os_code_size = *(u32 *)(flcn_os_hdr_buf + 0x08);

// Read the SecureBoot blob's falcon OS image's hash from memory
u32 blob4_flcn_os_img_hash_addr = (((((blob0_size + blob1_size) + 0x100) + blob2_size) + flcn_code_hdr_size) + flcn_os_code_size);
memcpy_i2d(0, blob4_flcn_os_img_hash_addr, 0x10);

// Read data segment size from IO space
u32 data_seg_size = *(u32 *)FALCON_HWCFG;
data_seg_size >>= 0x03;
data_seg_size &= 0x3FC0;

u32 data_addr = 0x10;

// Clear all data except the first 0x10 bytes (SecureBoot blob's Falcon OS image's hash)
for (int data_word_count = 0x04; data_word_count < data_seg_size; data_word_count++)
{
*(u32 *)(data_addr) = 0;
data_addr += 0x04;
}

// Clear all crypto registers
cxor($c0, $c0);
cxor($c1, $c1);
cxor($c2, $c2);
cxor($c3, $c3);
cxor($c4, $c4);
cxor($c5, $c5);
cxor($c6, $c6);
cxor($c7, $c7);

// Clear the cauth signature
csigclr();

// Jump to SecureBoot
load_secboot();

return 0xB0B0B0B0;
</pre>

== SecureBoot ==
[6.2.0+] This was introduced to try to recover the secure boot from the RCM vulnerability.

This stage prepares the stack then authenticates, decrypts and executes the SecureBoot blob's Falcon OS image.

=== Main ===
<pre>
// Read data segment size from IO space
u32 data_seg_size = *(u32 *)FALCON_HWCFG;
data_seg_size >>= 0x01;
data_seg_size &= 0xFF00;

// Set the stack pointer
$sp = data_seg_size;

// Jump to the SecureBoot blob's Falcon OS image boot stub
init_secboot();

// Halt execution
exit();

return;
</pre>

==== init_secboot ====
This method takes no arguments and is responsible for loading, authenticating and executing [[#SecureBoot|SecureBoot]].
<pre>
// Read the transfer base address from IO space
u32 xfer_ext_base_addr = *(u32 *)FALCON_DMATRFBASE;

// Copy transfer base address to data memory
u32 scratch_data_addr = 0x300;
*(u32 *)scratch_data_addr = xfer_ext_base_addr;

// Set the transfer base address
xcbase(xfer_ext_base_addr);

// The next xfer instruction will be overridden
// and target changes from DMA to crypto
cxset(0x01);

u32 crypto_reg_flag = 0x00060000;
u32 blob4_flcn_os_img_hash_addr = 0;

// Transfer data to crypto register c6
xdst(0, (blob4_flcn_os_img_hash_addr | crypto_reg_flag));

// The next xfer instruction will be overridden
// and target changes from DMA to crypto
cxset(0x01);

// Wait for all data loads/stores to finish
xdwait();

cmov($c7, $c6);
cxor($c7, $c7);

// Set auth_addr to 0x100, auth_size to 0x1300,
// bit 16 (use_secret) and bit 17 (is_encrypted)
$cauth = ((0x02 << 0x10) | (0x01 << 0x10) | (0x1300 << 0x10) | (0x100 >> 0x08));

// Clear interrupt flags
$flags.ie0 = 0;
$flags.ie1 = 0;
$flags.ie2 = 0;

// Jump to the SecureBoot blob's Falcon OS image
exec_secboot();

return 0x0F0F0F0F;
</pre>

[8.1.0+] Removed transfer base address setting and added IMEM protection.
<pre>
// The next xfer instruction will be overridden
// and target changes from DMA to crypto
cxset(0x01);

u32 crypto_reg_flag = 0x00060000;
u32 blob4_flcn_os_img_hash_addr = 0;

// Transfer data to crypto register c6
xdst(0, (blob4_flcn_os_img_hash_addr | crypto_reg_flag));

// The next xfer instruction will be overridden
// and target changes from DMA to crypto
cxset(0x01);

// Wait for all data loads/stores to finish
xdwait();

cmov($c7, $c6);
cxor($c7, $c7);

// Set auth_addr to 0x100, auth_size to 0x1D00,
// bit 16 (use_secret) and bit 17 (is_encrypted)
$cauth = ((0x02 << 0x10) | (0x01 << 0x10) | (0x1D00 << 0x10) | (0x100 >> 0x08));

// Clear interrupt flags
$flags.ie0 = 0;
$flags.ie1 = 0;
$flags.ie2 = 0;

// Fill remaining IMEM with secret pages
bool use_secret = true;
memcpy_d2i(0x1E00, 0, 0x2200, 0x1E00, use_secret);
memcpy_d2i(0x4000, 0, 0x4000, 0x4000, use_secret);

// Wait for all code loads to finish
xcwait();

// Jump to the SecureBoot blob's Falcon OS image
exec_secboot();

return 0x0F0F0F0F;
</pre>

==== exec_secboot ====
This is the signed and encrypted portion of the [[#SecureBoot|SecureBoot]] payload.
<pre>
// Recover the transfer base address from the stack
u32 xfer_ext_base_addr = *(u32 *)scratch_data_addr;

// Return the TLB entry that covers the virtual address
u32 tlb_entry = vtlb(xfer_ext_base_addr);

// Clear Falcon CPU control
*(u32 *)FALCON_CPUCTL = 0;

// Halt if the external page is marked as secret
if ((tlb_entry & 0x4000000) != 0)
exit();

// Read data segment size from IO space
u32 data_seg_size = *(u32 *)FALCON_HWCFG;
data_seg_size >>= 0x01;
data_seg_size &= 0xFF00;

// Set the stack pointer
$sp = data_seg_size;

// Fill all DMEM with a pointer to a trap function (just exits 3 times)
for (int i = 0; i < data_seg_size; i += 0x04) {
*(u32 *)i = (u32)trap_func();
}

// Initialize the TRNG and generate random data in DMEM
init_rnd();

// Issue a randomized delay and return a random value
u32 rnd_val = rnd_delay(0xFF);

// Load the TSEC key from SOR1 registers into DMEM
sor1_get_key();

// Initialize CAR registers
car_init();

// Check certain CAR, PMC and FUSE registers
test_car_pmc_fuse();

// Ensure CLK_RST_CONTROLLER_CLK_SOURCE_TSEC_0 is 0x02
test_clk_source_tsec();

// Set FLOW_MODE_WAITEVENT in FLOW_CTLR_HALT_COP_EVENTS_0
halt_bpmp();

// Initialize the CCPLEX
ccplex_init();

// Check certain CAR, PMC and FUSE registers
test_car_pmc_fuse();

bool is_se_ready = false;

// Wait for SE to be ready
while (!is_se_ready)
is_se_ready = check_se_status();

// Test MC_IRAM_BOM and MC_IRAM_TOM
u32 mc_iram_aperture_res = test_mc_iram_aperture();

if (mc_iram_aperture_res != 0xAAAAAAAA)
{
// Clear the entire DMEM region
clear_dmem();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Ensure FUSE_SKU_INFO is 0x83
test_fuse_sku_info();

// Write TSEC key to SE keyslot 0x0C
se_set_keyslot_12();

// Write TSEC root key to SE keyslot 0x0D
se_set_keyslot_13();

// Decrypt Package1
decrypt_pk11();

// Check certain CAR, PMC and FUSE registers
test_car_pmc_fuse();

// Parse Package1 header and return entry address
u32 entry_addr = parse_pk11();

// Set the exception vectors
set_excp_vec(entry_addr);

// Fill the top 0x500 bytes in DMEM with a pointer to trap function (just exits 3 times)
for (int i = 0; i < 0x500; i += 0x04) {
*(u32 *)i = (u32)trap_func();
}

// Clear all crypto registers
cxor($c0, $c0);
cxor($c1, $c1);
cxor($c2, $c2);
cxor($c3, $c3);
cxor($c4, $c4);
cxor($c5, $c5);
cxor($c6, $c6);
cxor($c7, $c7);

// Take SCP out of lockdown
unlock_scp();

// Clear FLOW_CTLR_HALT_COP_EVENTS_0
resume_bpmp();

// Clear the entire DMEM region
clear_dmem();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();

return;
</pre>

[7.0.0+] Many changes were introduced to mitigate and prevent attacks.
<pre>
// Recover the transfer base address from the stack
u32 xfer_ext_base_addr = *(u32 *)scratch_data_addr;

// Return the TLB entry that covers the virtual address
u32 tlb_entry = vtlb(xfer_ext_base_addr);

// Clear Falcon CPU control
*(u32 *)FALCON_CPUCTL = 0;

// Halt if the external page is marked as secret
if ((tlb_entry & 0x4000000) != 0)
exit();

// Read data segment size from IO space
u32 data_seg_size = *(u32 *)FALCON_HWCFG;
data_seg_size >>= 0x01;
data_seg_size &= 0xFF00;

// Set the stack pointer
$sp = data_seg_size;

// Fill all DMEM with a pointer to a trap function (just exits 3 times)
for (int i = 0; i < data_seg_size; i += 0x04) {
*(u32 *)i = (u32)trap_func();
}

// Initialize the TRNG and generate random data in DMEM
init_rnd();

// Issue a randomized delay and return a random value
u32 rnd_val = rnd_delay(0xFF);

// Enable and test SMMU bypassing in the TFBIF
tfbif_smmu_cfg(0x01);

// Issue a randomized delay and return a random value
rnd_val = rnd_delay(0xFF);

// Test SMMU bypassing in the TFBIF
tfbif_smmu_cfg(0x00);

// Issue a randomized delay and return a random value
rnd_val = rnd_delay(0xFF);

// Test SMMU bypassing in the TFBIF
tfbif_smmu_cfg(0x00);

// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Test randomized offsets for read/write integrity in MC, FUSE, IRAM and TZRAM
u32 test_res = test_mc_fuse_iram_tzram();

if (test_res != 0xAAAAAAAA)
{
// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Try to detect virtualization by enabling and disabling random CAR devices
test_res = test_car();

if (test_res != 0xAAAAAAAA)
{
// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Test memory transfer integrity
test_res = test_mem_xfer();

if (test_res != 0xAAAAAAAA)
{
// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Set FLOW_MODE_WAITEVENT in FLOW_CTLR_HALT_COP_EVENTS_0
halt_bpmp();

// Initialize the CCPLEX
ccplex_init();

// Check if SE is ready
u32 se_status = check_se_status();

if (se_status != 0)
{
// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Load the TSEC key from SOR1 registers into DMEM
sor1_get_key();

// Initialize CAR registers
car_init();

// Check certain CAR, PMC and FUSE registers
test_car_pmc_fuse();

// Try to detect virtualization by enabling and disabling random CAR devices
test_res = test_car();

if (test_res != 0xAAAAAAAA)
{
// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Ensure FUSE_SKU_INFO is 0x83
test_fuse_sku_info();

// Try to detect virtualization using MC_SMMU_AVPC_ASID and FUSE_ECO_RESERVE_0
test_smmu_fuse();

// Test MC_IRAM_BOM and MC_IRAM_TOM
test_res = test_mc_iram_aperture();

if (test_res != 0xAAAAAAAA)
{
// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Check certain CAR, PMC and FUSE registers
test_car_pmc_fuse();

// Test memory transfer integrity
test_res = test_mem_xfer();

if (test_res != 0xAAAAAAAA)
{
// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Try to detect virtualization using MC_SMMU_AVPC_ASID and FUSE_ECO_RESERVE_0
test_smmu_fuse();

// Test MC_IRAM_BOM and MC_IRAM_TOM
test_res = test_mc_iram_aperture();

if (test_res != 0xAAAAAAAA)
{
// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Test SMMU bypassing in the TFBIF
tfbif_smmu_cfg(0x00);

// Decrypt Package1
decrypt_pk11();

// Write TSEC root key to SE keyslot 0x0D
se_set_keyslot_13();

// Write TSEC key to SE keyslot 0x0C
se_set_keyslot_12();

// Clear the cauth signature
csigclr();

// Check certain CAR, PMC and FUSE registers
test_car_pmc_fuse();

// Test memory transfer integrity
test_res = test_mem_xfer();

if (test_res != 0xAAAAAAAA)
{
// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Try to detect virtualization using MC_SMMU_AVPC_ASID and FUSE_ECO_RESERVE_0
test_smmu_fuse();

// Test randomized offsets for read/write integrity in MC, FUSE, IRAM and TZRAM
test_res = test_mc_fuse_iram_tzram();

if (test_res != 0xAAAAAAAA)
{
// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Test MC_IRAM_BOM and MC_IRAM_TOM
test_res = test_mc_iram_aperture();

if (test_res != 0xAAAAAAAA)
{
// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Test SMMU bypassing in the TFBIF
tfbif_smmu_cfg(0x00);

// Parse Package1 header and return entry address
u32 entry_addr = parse_pk11();

// Set the exception vectors
set_excp_vec(entry_addr);

// Fill the top 0x500 bytes in DMEM with a pointer to trap function (just exits)
for (int i = 0; i < 0x500; i += 0x04) {
*(u32 *)i = (u32)trap_func();
}

// Clear all crypto registers
cxor($c0, $c0);
cxor($c1, $c1);
cxor($c2, $c2);
cxor($c3, $c3);
cxor($c4, $c4);
cxor($c5, $c5);
cxor($c6, $c6);
cxor($c7, $c7);

// Take SCP out of lockdown
unlock_scp();

// Test memory transfer integrity
test_res = test_mem_xfer();

if (test_res != 0xAAAAAAAA)
{
// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Try to detect virtualization using MC_SMMU_AVPC_ASID and FUSE_ECO_RESERVE_0
test_smmu_fuse();

// Test MC_IRAM_BOM and MC_IRAM_TOM
test_res = test_mc_iram_aperture();

if (test_res != 0xAAAAAAAA)
{
// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Test SMMU bypassing in the TFBIF
tfbif_smmu_cfg(0x00);

// Clear FLOW_CTLR_HALT_COP_EVENTS_0
resume_bpmp();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();

return;
</pre>

[8.1.0+] Key derivation algorithm was changed. Very minor changes were introduced to mitigate and prevent attacks.

== Key data ==
Small buffer stored after the [[#Boot|Boot]] blob and used across all stages.

{| class="wikitable" border="1"
! Offset
! Size
! Description
|-
| 0x00
| 0x10
| Debug key (empty)
|-
| 0x10
| 0x10
| blob0 ([[#Boot|Boot]]) auth hash
|-
| 0x20
| 0x10
| blob1 ([[#KeygenLdr|KeygenLdr]]) auth hash
|-
| 0x30
| 0x10
| blob2 ([[#Keygen|Keygen]]) auth hash
|-
| 0x40
| 0x10
| blob2 ([[#Keygen|Keygen]]) AES IV
|-
| 0x50
| 0x10
| HOVI EKS seed
|-
| 0x60
| 0x10
| HOVI COMMON seed
|-
| 0x70
| 0x04
| blob0 ([[#Boot|Boot]]) size
|-
| 0x74
| 0x04
| blob1 ([[#KeygenLdr|KeygenLdr]]) size
|-
| 0x78
| 0x04
| blob2 ([[#Keygen|Keygen]]) size
|-
| 0x7C
| 0x04
| [6.2.0+] blob3 ([[#SecureBootLdr|SecureBootLdr]]) size
|-
| 0x80
| 0x04
| [6.2.0+] blob4 ([[#SecureBoot|SecureBoot]]) size
|}

TSEC

2020-09-05T16:12:56Z

Vale: Change the keyreg operand to crypto register

TSEC (Tegra Security Co-processor) is a dedicated unit powered by a NVIDIA Falcon microprocessor with crypto extensions.

= Driver =
A host driver for communicating with the TSEC is mapped to physical address 0x54500000 with a total size of 0x40000 bytes and exposes several registers.

== Registers ==
The TSEC's MMIO space is divided as follows:
* 0x54500000 to 0x54501000: THI (Tegra Host Interface)
* 0x54501000 to 0x54501400: [[#Falcon|FALCON (Falcon microcontroller)]]
* 0x54501400 to 0x54501600: [[#SCP|SCP (Secure coprocessor)]]
* 0x54501600 to 0x54501680: TFBIF (Tegra Framebuffer Interface)
* 0x54501680 to 0x54501700: CG (Clock Gate)
* 0x54501700 to 0x54501800: BAR0 (HOST1X device DMA)
* 0x54501800 to 0x54501900: TEGRA (Miscellaneous interfaces)

{| class="wikitable" border="1"
! Name
! Address
! Width
|-
| [[#TSEC_THI_INCR_SYNCPT|TSEC_THI_INCR_SYNCPT]]
| 0x54500000
| 0x04
|-
| [[#TSEC_THI_INCR_SYNCPT_CTRL|TSEC_THI_INCR_SYNCPT_CTRL]]
| 0x54500004
| 0x04
|-
| [[#TSEC_THI_INCR_SYNCPT_ERR|TSEC_THI_INCR_SYNCPT_ERR]]
| 0x54500008
| 0x04
|-
| [[#TSEC_THI_CTXSW_INCR_SYNCPT|TSEC_THI_CTXSW_INCR_SYNCPT]]
| 0x5450000C
| 0x04
|-
| [[#TSEC_THI_CTXSW|TSEC_THI_CTXSW]]
| 0x54500020
| 0x04
|-
| [[#TSEC_THI_CTXSW_NEXT|TSEC_THI_CTXSW_NEXT]]
| 0x54500024
| 0x04
|-
| [[#TSEC_THI_CONT_SYNCPT_EOF|TSEC_THI_CONT_SYNCPT_EOF]]
| 0x54500028
| 0x04
|-
| [[#TSEC_THI_CONT_SYNCPT_L1|TSEC_THI_CONT_SYNCPT_L1]]
| 0x5450002C
| 0x04
|-
| [[#TSEC_THI_STREAMID0|TSEC_THI_STREAMID0]]
| 0x54500030
| 0x04
|-
| [[#TSEC_THI_STREAMID1|TSEC_THI_STREAMID1]]
| 0x54500034
| 0x04
|-
| [[#TSEC_THI_THI_SEC|TSEC_THI_THI_SEC]]
| 0x54500038
| 0x04
|-
| [[#TSEC_THI_METHOD0|TSEC_THI_METHOD0]]
| 0x54500040
| 0x04
|-
| [[#TSEC_THI_METHOD1|TSEC_THI_METHOD1]]
| 0x54500044
| 0x04
|-
| [[#TSEC_THI_CONTEXT_SWITCH|TSEC_THI_CONTEXT_SWITCH]]
| 0x54500060
| 0x04
|-
| [[#TSEC_THI_INT_STATUS|TSEC_THI_INT_STATUS]]
| 0x54500078
| 0x04
|-
| [[#TSEC_THI_INT_MASK|TSEC_THI_INT_MASK]]
| 0x5450007C
| 0x04
|-
| [[#TSEC_THI_CONFIG0|TSEC_THI_CONFIG0]]
| 0x54500080
| 0x04
|-
| [[#TSEC_THI_DBG_MISC|TSEC_THI_DBG_MISC]]
| 0x54500084
| 0x04
|-
| [[#TSEC_THI_SLCG_OVERRIDE_HIGH_A|TSEC_THI_SLCG_OVERRIDE_HIGH_A]]
| 0x54500088
| 0x04
|-
| [[#TSEC_THI_SLCG_OVERRIDE_LOW_A|TSEC_THI_SLCG_OVERRIDE_LOW_A]]
| 0x5450008C
| 0x04
|-
| [[#TSEC_THI_CLK_OVERRIDE|TSEC_THI_CLK_OVERRIDE]]
| 0x54500E00
| 0x04
|-
| [[#TSEC_FALCON_IRQSSET|TSEC_FALCON_IRQSSET]]
| 0x54501000
| 0x04
|-
| [[#TSEC_FALCON_IRQSCLR|TSEC_FALCON_IRQSCLR]]
| 0x54501004
| 0x04
|-
| [[#TSEC_FALCON_IRQSTAT|TSEC_FALCON_IRQSTAT]]
| 0x54501008
| 0x04
|-
| [[#TSEC_FALCON_IRQMODE|TSEC_FALCON_IRQMODE]]
| 0x5450100C
| 0x04
|-
| [[#TSEC_FALCON_IRQMSET|TSEC_FALCON_IRQMSET]]
| 0x54501010
| 0x04
|-
| [[#TSEC_FALCON_IRQMCLR|TSEC_FALCON_IRQMCLR]]
| 0x54501014
| 0x04
|-
| [[#TSEC_FALCON_IRQMASK|TSEC_FALCON_IRQMASK]]
| 0x54501018
| 0x04
|-
| [[#TSEC_FALCON_IRQDEST|TSEC_FALCON_IRQDEST]]
| 0x5450101C
| 0x04
|-
| [[#TSEC_FALCON_GPTMRINT|TSEC_FALCON_GPTMRINT]]
| 0x54501020
| 0x04
|-
| [[#TSEC_FALCON_GPTMRVAL|TSEC_FALCON_GPTMRVAL]]
| 0x54501024
| 0x04
|-
| [[#TSEC_FALCON_GPTMRCTL|TSEC_FALCON_GPTMRCTL]]
| 0x54501028
| 0x04
|-
| [[#TSEC_FALCON_PTIMER0|TSEC_FALCON_PTIMER0]]
| 0x5450102C
| 0x04
|-
| [[#TSEC_FALCON_PTIMER1|TSEC_FALCON_PTIMER1]]
| 0x54501030
| 0x04
|-
| [[#TSEC_FALCON_WDTMRVAL|TSEC_FALCON_WDTMRVAL]]
| 0x54501034
| 0x04
|-
| [[#TSEC_FALCON_WDTMRCTL|TSEC_FALCON_WDTMRCTL]]
| 0x54501038
| 0x04
|-
| [[#TSEC_FALCON_IRQDEST2|TSEC_FALCON_IRQDEST2]]
| 0x5450103C
| 0x04
|-
| [[#TSEC_FALCON_MAILBOX0|TSEC_FALCON_MAILBOX0]]
| 0x54501040
| 0x04
|-
| [[#TSEC_FALCON_MAILBOX1|TSEC_FALCON_MAILBOX1]]
| 0x54501044
| 0x04
|-
| [[#TSEC_FALCON_ITFEN|TSEC_FALCON_ITFEN]]
| 0x54501048
| 0x04
|-
| [[#TSEC_FALCON_IDLESTATE|TSEC_FALCON_IDLESTATE]]
| 0x5450104C
| 0x04
|-
| [[#TSEC_FALCON_CURCTX|TSEC_FALCON_CURCTX]]
| 0x54501050
| 0x04
|-
| [[#TSEC_FALCON_NXTCTX|TSEC_FALCON_NXTCTX]]
| 0x54501054
| 0x04
|-
| [[#TSEC_FALCON_CTXACK|TSEC_FALCON_CTXACK]]
| 0x54501058
| 0x04
|-
| [[#TSEC_FALCON_FHSTATE|TSEC_FALCON_FHSTATE]]
| 0x5450105C
| 0x04
|-
| [[#TSEC_FALCON_PRIVSTATE|TSEC_FALCON_PRIVSTATE]]
| 0x54501060
| 0x04
|-
| [[#TSEC_FALCON_MTHDDATA|TSEC_FALCON_MTHDDATA]]
| 0x54501064
| 0x04
|-
| [[#TSEC_FALCON_MTHDID|TSEC_FALCON_MTHDID]]
| 0x54501068
| 0x04
|-
| [[#TSEC_FALCON_MTHDWDAT|TSEC_FALCON_MTHDWDAT]]
| 0x5450106C
| 0x04
|-
| [[#TSEC_FALCON_MTHDCOUNT|TSEC_FALCON_MTHDCOUNT]]
| 0x54501070
| 0x04
|-
| [[#TSEC_FALCON_MTHDPOP|TSEC_FALCON_MTHDPOP]]
| 0x54501074
| 0x04
|-
| [[#TSEC_FALCON_MTHDRAMSZ|TSEC_FALCON_MTHDRAMSZ]]
| 0x54501078
| 0x04
|-
| [[#TSEC_FALCON_SFTRESET|TSEC_FALCON_SFTRESET]]
| 0x5450107C
| 0x04
|-
| [[#TSEC_FALCON_OS|TSEC_FALCON_OS]]
| 0x54501080
| 0x04
|-
| [[#TSEC_FALCON_RM|TSEC_FALCON_RM]]
| 0x54501084
| 0x04
|-
| [[#TSEC_FALCON_SOFT_PM|TSEC_FALCON_SOFT_PM]]
| 0x54501088
| 0x04
|-
| [[#TSEC_FALCON_SOFT_MODE|TSEC_FALCON_SOFT_MODE]]
| 0x5450108C
| 0x04
|-
| [[#TSEC_FALCON_DEBUG1|TSEC_FALCON_DEBUG1]]
| 0x54501090
| 0x04
|-
| [[#TSEC_FALCON_DEBUGINFO|TSEC_FALCON_DEBUGINFO]]
| 0x54501094
| 0x04
|-
| [[#TSEC_FALCON_IBRKPT1|TSEC_FALCON_IBRKPT1]]
| 0x54501098
| 0x04
|-
| [[#TSEC_FALCON_IBRKPT2|TSEC_FALCON_IBRKPT2]]
| 0x5450109C
| 0x04
|-
| [[#TSEC_FALCON_CGCTL|TSEC_FALCON_CGCTL]]
| 0x545010A0
| 0x04
|-
| [[#TSEC_FALCON_ENGCTL|TSEC_FALCON_ENGCTL]]
| 0x545010A4
| 0x04
|-
| [[#TSEC_FALCON_PMM|TSEC_FALCON_PMM]]
| 0x545010A8
| 0x04
|-
| [[#TSEC_FALCON_ADDR|TSEC_FALCON_ADDR]]
| 0x545010AC
| 0x04
|-
| [[#TSEC_FALCON_IBRKPT3|TSEC_FALCON_IBRKPT3]]
| 0x545010B0
| 0x04
|-
| [[#TSEC_FALCON_IBRKPT4|TSEC_FALCON_IBRKPT4]]
| 0x545010B4
| 0x04
|-
| [[#TSEC_FALCON_IBRKPT5|TSEC_FALCON_IBRKPT5]]
| 0x545010B8
| 0x04
|-
| [[#TSEC_FALCON_EXCI|TSEC_FALCON_EXCI]]
| 0x545010D0
| 0x04
|-
| [[#TSEC_FALCON_SVEC_SPR|TSEC_FALCON_SVEC_SPR]]
| 0x545010D4
| 0x04
|-
| [[#TSEC_FALCON_RSTAT0|TSEC_FALCON_RSTAT0]]
| 0x545010D8
| 0x04
|-
| [[#TSEC_FALCON_RSTAT3|TSEC_FALCON_RSTAT3]]
| 0x545010DC
| 0x04
|-
| TSEC_FALCON_UNK_E0
| 0x545010E0
| 0x04
|-
| [[#TSEC_FALCON_CPUCTL|TSEC_FALCON_CPUCTL]]
| 0x54501100
| 0x04
|-
| [[#TSEC_FALCON_BOOTVEC|TSEC_FALCON_BOOTVEC]]
| 0x54501104
| 0x04
|-
| [[#TSEC_FALCON_HWCFG|TSEC_FALCON_HWCFG]]
| 0x54501108
| 0x04
|-
| [[#TSEC_FALCON_DMACTL|TSEC_FALCON_DMACTL]]
| 0x5450110C
| 0x04
|-
| [[#TSEC_FALCON_DMATRFBASE|TSEC_FALCON_DMATRFBASE]]
| 0x54501110
| 0x04
|-
| [[#TSEC_FALCON_DMATRFMOFFS|TSEC_FALCON_DMATRFMOFFS]]
| 0x54501114
| 0x04
|-
| [[#TSEC_FALCON_DMATRFCMD|TSEC_FALCON_DMATRFCMD]]
| 0x54501118
| 0x04
|-
| [[#TSEC_FALCON_DMATRFFBOFFS|TSEC_FALCON_DMATRFFBOFFS]]
| 0x5450111C
| 0x04
|-
| [[#TSEC_FALCON_DMAPOLL_FB|TSEC_FALCON_DMAPOLL_FB]]
| 0x54501120
| 0x04
|-
| [[#TSEC_FALCON_DMAPOLL_CP|TSEC_FALCON_DMAPOLL_CP]]
| 0x54501124
| 0x04
|-
| [[#TSEC_FALCON_HWCFG1|TSEC_FALCON_HWCFG1]]
| 0x5450112C
| 0x04
|-
| [[#TSEC_FALCON_CPUCTL_ALIAS|TSEC_FALCON_CPUCTL_ALIAS]]
| 0x54501130
| 0x04
|-
| [[#TSEC_FALCON_STACKCFG|TSEC_FALCON_STACKCFG]]
| 0x54501138
| 0x04
|-
| [[#TSEC_FALCON_IMCTL|TSEC_FALCON_IMCTL]]
| 0x54501140
| 0x04
|-
| [[#TSEC_FALCON_IMSTAT|TSEC_FALCON_IMSTAT]]
| 0x54501144
| 0x04
|-
| [[#TSEC_FALCON_TRACEIDX|TSEC_FALCON_TRACEIDX]]
| 0x54501148
| 0x04
|-
| [[#TSEC_FALCON_TRACEPC|TSEC_FALCON_TRACEPC]]
| 0x5450114C
| 0x04
|-
| [[#TSEC_FALCON_IMFILLRNG0|TSEC_FALCON_IMFILLRNG0]]
| 0x54501150
| 0x04
|-
| [[#TSEC_FALCON_IMFILLRNG1|TSEC_FALCON_IMFILLRNG1]]
| 0x54501154
| 0x04
|-
| [[#TSEC_FALCON_IMFILLCTL|TSEC_FALCON_IMFILLCTL]]
| 0x54501158
| 0x04
|-
| [[#TSEC_FALCON_IMCTL_DEBUG|TSEC_FALCON_IMCTL_DEBUG]]
| 0x5450115C
| 0x04
|-
| [[#TSEC_FALCON_CMEMBASE|TSEC_FALCON_CMEMBASE]]
| 0x54501160
| 0x04
|-
| [[#TSEC_FALCON_DMEMAPERT|TSEC_FALCON_DMEMAPERT]]
| 0x54501164
| 0x04
|-
| [[#TSEC_FALCON_EXTERRADDR|TSEC_FALCON_EXTERRADDR]]
| 0x54501168
| 0x04
|-
| [[#TSEC_FALCON_EXTERRSTAT|TSEC_FALCON_EXTERRSTAT]]
| 0x5450116C
| 0x04
|-
| [[#TSEC_FALCON_CG2|TSEC_FALCON_CG2]]
| 0x5450117C
| 0x04
|-
| [[#TSEC_FALCON_IMEMC|TSEC_FALCON_IMEMC0]]
| 0x54501180
| 0x04
|-
| [[#TSEC_FALCON_IMEMD|TSEC_FALCON_IMEMD0]]
| 0x54501184
| 0x04
|-
| [[#TSEC_FALCON_IMEMT|TSEC_FALCON_IMEMT0]]
| 0x54501188
| 0x04
|-
| [[#TSEC_FALCON_IMEMC|TSEC_FALCON_IMEMC1]]
| 0x54501190
| 0x04
|-
| [[#TSEC_FALCON_IMEMD|TSEC_FALCON_IMEMD1]]
| 0x54501194
| 0x04
|-
| [[#TSEC_FALCON_IMEMT|TSEC_FALCON_IMEMT1]]
| 0x54501198
| 0x04
|-
| [[#TSEC_FALCON_IMEMC|TSEC_FALCON_IMEMC2]]
| 0x545011A0
| 0x04
|-
| [[#TSEC_FALCON_IMEMD|TSEC_FALCON_IMEMD2]]
| 0x545011A4
| 0x04
|-
| [[#TSEC_FALCON_IMEMT|TSEC_FALCON_IMEMT2]]
| 0x545011A8
| 0x04
|-
| [[#TSEC_FALCON_IMEMC|TSEC_FALCON_IMEMC3]]
| 0x545011B0
| 0x04
|-
| [[#TSEC_FALCON_IMEMD|TSEC_FALCON_IMEMD3]]
| 0x545011B4
| 0x04
|-
| [[#TSEC_FALCON_IMEMT|TSEC_FALCON_IMEMT3]]
| 0x545011B8
| 0x04
|-
| [[#TSEC_FALCON_DMEMC|TSEC_FALCON_DMEMC0]]
| 0x545011C0
| 0x04
|-
| [[#TSEC_FALCON_DMEMD|TSEC_FALCON_DMEMD0]]
| 0x545011C4
| 0x04
|-
| [[#TSEC_FALCON_DMEMC|TSEC_FALCON_DMEMC1]]
| 0x545011C8
| 0x04
|-
| [[#TSEC_FALCON_DMEMD|TSEC_FALCON_DMEMD1]]
| 0x545011CC
| 0x04
|-
| [[#TSEC_FALCON_DMEMC|TSEC_FALCON_DMEMC2]]
| 0x545011D0
| 0x04
|-
| [[#TSEC_FALCON_DMEMD|TSEC_FALCON_DMEMD2]]
| 0x545011D4
| 0x04
|-
| [[#TSEC_FALCON_DMEMC|TSEC_FALCON_DMEMC3]]
| 0x545011D8
| 0x04
|-
| [[#TSEC_FALCON_DMEMD|TSEC_FALCON_DMEMD3]]
| 0x545011DC
| 0x04
|-
| [[#TSEC_FALCON_DMEMC|TSEC_FALCON_DMEMC4]]
| 0x545011E0
| 0x04
|-
| [[#TSEC_FALCON_DMEMD|TSEC_FALCON_DMEMD4]]
| 0x545011E4
| 0x04
|-
| [[#TSEC_FALCON_DMEMC|TSEC_FALCON_DMEMC5]]
| 0x545011E8
| 0x04
|-
| [[#TSEC_FALCON_DMEMD|TSEC_FALCON_DMEMD5]]
| 0x545011EC
| 0x04
|-
| [[#TSEC_FALCON_DMEMC|TSEC_FALCON_DMEMC6]]
| 0x545011F0
| 0x04
|-
| [[#TSEC_FALCON_DMEMD|TSEC_FALCON_DMEMD6]]
| 0x545011F4
| 0x04
|-
| [[#TSEC_FALCON_DMEMC|TSEC_FALCON_DMEMC7]]
| 0x545011F8
| 0x04
|-
| [[#TSEC_FALCON_DMEMD|TSEC_FALCON_DMEMD7]]
| 0x545011FC
| 0x04
|-
| [[#TSEC_FALCON_ICD_CMD|TSEC_FALCON_ICD_CMD]]
| 0x54501200
| 0x04
|-
| [[#TSEC_FALCON_ICD_ADDR|TSEC_FALCON_ICD_ADDR]]
| 0x54501204
| 0x04
|-
| [[#TSEC_FALCON_ICD_WDATA|TSEC_FALCON_ICD_WDATA]]
| 0x54501208
| 0x04
|-
| [[#TSEC_FALCON_ICD_RDATA|TSEC_FALCON_ICD_RDATA]]
| 0x5450120C
| 0x04
|-
| [[#TSEC_FALCON_SCTL|TSEC_FALCON_SCTL]]
| 0x54501240
| 0x04
|-
| [[#TSEC_FALCON_SSTAT|TSEC_FALCON_SSTAT]]
| 0x54501244
| 0x04
|-
| TSEC_FALCON_UNK_250
| 0x54501250
| 0x04
|-
| TSEC_FALCON_UNK_260
| 0x54501260
| 0x04
|-
| [[#TSEC_FALCON_SPROT_IMEM|TSEC_FALCON_SPROT_IMEM]]
| 0x54501280
| 0x04
|-
| [[#TSEC_FALCON_SPROT_DMEM|TSEC_FALCON_SPROT_DMEM]]
| 0x54501284
| 0x04
|-
| [[#TSEC_FALCON_SPROT_CPUCTL|TSEC_FALCON_SPROT_CPUCTL]]
| 0x54501288
| 0x04
|-
| [[#TSEC_FALCON_SPROT_MISC|TSEC_FALCON_SPROT_MISC]]
| 0x5450128C
| 0x04
|-
| [[#TSEC_FALCON_SPROT_IRQ|TSEC_FALCON_SPROT_IRQ]]
| 0x54501290
| 0x04
|-
| [[#TSEC_FALCON_SPROT_MTHD|TSEC_FALCON_SPROT_MTHD]]
| 0x54501294
| 0x04
|-
| [[#TSEC_FALCON_SPROT_SCTL|TSEC_FALCON_SPROT_SCTL]]
| 0x54501298
| 0x04
|-
| [[#TSEC_FALCON_SPROT_WDTMR|TSEC_FALCON_SPROT_WDTMR]]
| 0x5450129C
| 0x04
|-
| [[#TSEC_FALCON_DMAINFO_FINISHED_FBRD_LOW|TSEC_FALCON_DMAINFO_FINISHED_FBRD_LOW]]
| 0x545012C0
| 0x04
|-
| [[#TSEC_FALCON_DMAINFO_FINISHED_FBRD_HIGH|TSEC_FALCON_DMAINFO_FINISHED_FBRD_HIGH]]
| 0x545012C4
| 0x04
|-
| [[#TSEC_FALCON_DMAINFO_FINISHED_FBWR_LOW|TSEC_FALCON_DMAINFO_FINISHED_FBWR_LOW]]
| 0x545012C8
| 0x04
|-
| [[#TSEC_FALCON_DMAINFO_FINISHED_FBWR_HIGH|TSEC_FALCON_DMAINFO_FINISHED_FBWR_HIGH]]
| 0x545012CC
| 0x04
|-
| [[#TSEC_FALCON_DMAINFO_CURRENT_FBRD_LOW|TSEC_FALCON_DMAINFO_CURRENT_FBRD_LOW]]
| 0x545012D0
| 0x04
|-
| [[#TSEC_FALCON_DMAINFO_CURRENT_FBRD_HIGH|TSEC_FALCON_DMAINFO_CURRENT_FBRD_HIGH]]
| 0x545012D4
| 0x04
|-
| [[#TSEC_FALCON_DMAINFO_CURRENT_FBWR_LOW|TSEC_FALCON_DMAINFO_CURRENT_FBWR_LOW]]
| 0x545012D8
| 0x04
|-
| [[#TSEC_FALCON_DMAINFO_CURRENT_FBWR_HIGH|TSEC_FALCON_DMAINFO_CURRENT_FBWR_HIGH]]
| 0x545012DC
| 0x04
|-
| [[#TSEC_FALCON_DMAINFO_CTL|TSEC_FALCON_DMAINFO_CTL]]
| 0x545012E0
| 0x04
|-
| [[#TSEC_SCP_CTL0|TSEC_SCP_CTL0]]
| 0x54501400
| 0x04
|-
| [[#TSEC_SCP_CTL1|TSEC_SCP_CTL1]]
| 0x54501404
| 0x04
|-
| [[#TSEC_SCP_CTL_STAT|TSEC_SCP_CTL_STAT]]
| 0x54501408
| 0x04
|-
| [[#TSEC_SCP_CTL_LOCK|TSEC_SCP_CTL_LOCK]]
| 0x5450140C
| 0x04
|-
| [[#TSEC_SCP_CFG|TSEC_SCP_CFG]]
| 0x54501410
| 0x04
|-
| [[#TSEC_SCP_CTL_SCP|TSEC_SCP_CTL_SCP]]
| 0x54501414
| 0x04
|-
| [[#TSEC_SCP_CTL_PKEY|TSEC_SCP_CTL_PKEY]]
| 0x54501418
| 0x04
|-
| [[#TSEC_SCP_CTL_DBG|TSEC_SCP_CTL_DBG]]
| 0x5450141C
| 0x04
|-
| [[#TSEC_SCP_DBG0|TSEC_SCP_DBG0]]
| 0x54501420
| 0x04
|-
| [[#TSEC_SCP_DBG1|TSEC_SCP_DBG1]]
| 0x54501424
| 0x04
|-
| [[#TSEC_SCP_DBG2|TSEC_SCP_DBG2]]
| 0x54501428
| 0x04
|-
| [[#TSEC_SCP_CMD|TSEC_SCP_CMD]]
| 0x54501430
| 0x04
|-
| [[#TSEC_SCP_STAT0|TSEC_SCP_STAT0]]
| 0x54501450
| 0x04
|-
| [[#TSEC_SCP_STAT1|TSEC_SCP_STAT1]]
| 0x54501454
| 0x04
|-
| [[#TSEC_SCP_STAT2|TSEC_SCP_STAT2]]
| 0x54501458
| 0x04
|-
| [[#TSEC_SCP_RNG_STAT0|TSEC_SCP_RNG_STAT0]]
| 0x54501470
| 0x04
|-
| [[#TSEC_SCP_RNG_STAT1|TSEC_SCP_RNG_STAT1]]
| 0x54501474
| 0x04
|-
| [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT]]
| 0x54501480
| 0x04
|-
| [[#TSEC_SCP_IRQMASK|TSEC_SCP_IRQMASK]]
| 0x54501484
| 0x04
|-
| [[#TSEC_SCP_ACL_ERR|TSEC_SCP_ACL_ERR]]
| 0x54501490
| 0x04
|-
| [[#TSEC_SCP_SEC_ERR|TSEC_SCP_SEC_ERR]]
| 0x54501494
| 0x04
|-
| [[#TSEC_SCP_CMD_ERR|TSEC_SCP_CMD_ERR]]
| 0x54501498
| 0x04
|-
| [[#TSEC_SCP_RND_CTL0|TSEC_SCP_RND_CTL0]]
| 0x54501500
| 0x04
|-
| [[#TSEC_SCP_RND_CTL1|TSEC_SCP_RND_CTL1]]
| 0x54501504
| 0x04
|-
| TSEC_SCP_RND_CTL2
| 0x54501508
| 0x04
|-
| TSEC_SCP_RND_CTL3
| 0x5450150C
| 0x04
|-
| TSEC_SCP_RND_CTL4
| 0x54501510
| 0x04
|-
| TSEC_SCP_RND_CTL5
| 0x54501514
| 0x04
|-
| TSEC_SCP_RND_CTL6
| 0x54501518
| 0x04
|-
| TSEC_SCP_RND_CTL7
| 0x5450151C
| 0x04
|-
| TSEC_SCP_RND_CTL8
| 0x54501520
| 0x04
|-
| TSEC_SCP_RND_CTL9
| 0x54501524
| 0x04
|-
| TSEC_SCP_RND_CTL10
| 0x54501528
| 0x04
|-
| TSEC_SCP_RND_CTL11
| 0x5450152C
| 0x04
|-
| [[#TSEC_TFBIF_CTL|TSEC_TFBIF_CTL]]
| 0x54501600
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL|TSEC_TFBIF_MCCIF_FIFOCTRL]]
| 0x54501604
| 0x04
|-
| [[#TSEC_TFBIF_THROTTLE|TSEC_TFBIF_THROTTLE]]
| 0x54501608
| 0x04
|-
| [[#TSEC_TFBIF_DBG_STAT0|TSEC_TFBIF_DBG_STAT0]]
| 0x5450160C
| 0x04
|-
| [[#TSEC_TFBIF_DBG_STAT1|TSEC_TFBIF_DBG_STAT1]]
| 0x54501610
| 0x04
|-
| [[#TSEC_TFBIF_DBG_RDCOUNT_LO|TSEC_TFBIF_DBG_RDCOUNT_LO]]
| 0x54501614
| 0x04
|-
| [[#TSEC_TFBIF_DBG_RDCOUNT_HI|TSEC_TFBIF_DBG_RDCOUNT_HI]]
| 0x54501618
| 0x04
|-
| [[#TSEC_TFBIF_DBG_WRCOUNT_LO|TSEC_TFBIF_DBG_WRCOUNT_LO]]
| 0x5450161C
| 0x04
|-
| [[#TSEC_TFBIF_DBG_WRCOUNT_HI|TSEC_TFBIF_DBG_WRCOUNT_HI]]
| 0x54501620
| 0x04
|-
| [[#TSEC_TFBIF_DBG_R32COUNT|TSEC_TFBIF_DBG_R32COUNT]]
| 0x54501624
| 0x04
|-
| [[#TSEC_TFBIF_DBG_R64COUNT|TSEC_TFBIF_DBG_R64COUNT]]
| 0x54501628
| 0x04
|-
| [[#TSEC_TFBIF_DBG_R128COUNT|TSEC_TFBIF_DBG_R128COUNT]]
| 0x5450162C
| 0x04
|-
| TSEC_TFBIF_UNK_30
| 0x54501630
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL1|TSEC_TFBIF_MCCIF_FIFOCTRL1]]
| 0x54501634
| 0x04
|-
| [[#TSEC_TFBIF_WRR_RDP|TSEC_TFBIF_WRR_RDP]]
| 0x54501638
| 0x04
|-
| [[#TSEC_TFBIF_SPROT_EMEM|TSEC_TFBIF_SPROT_EMEM]]
| 0x54501640
| 0x04
|-
| [[#TSEC_TFBIF_TRANSCFG|TSEC_TFBIF_TRANSCFG]]
| 0x54501644
| 0x04
|-
| [[#TSEC_TFBIF_REGIONCFG|TSEC_TFBIF_REGIONCFG]]
| 0x54501648
| 0x04
|-
| [[#TSEC_TFBIF_ACTMON_ACTIVE_MASK|TSEC_TFBIF_ACTMON_ACTIVE_MASK]]
| 0x5450164C
| 0x04
|-
| [[#TSEC_TFBIF_ACTMON_ACTIVE_BORPS|TSEC_TFBIF_ACTMON_ACTIVE_BORPS]]
| 0x54501650
| 0x04
|-
| [[#TSEC_TFBIF_ACTMON_ACTIVE_WEIGHT|TSEC_TFBIF_ACTMON_ACTIVE_WEIGHT]]
| 0x54501654
| 0x04
|-
| [[#TSEC_TFBIF_ACTMON_MCB_MASK|TSEC_TFBIF_ACTMON_MCB_MASK]]
| 0x54501660
| 0x04
|-
| [[#TSEC_TFBIF_ACTMON_MCB_BORPS|TSEC_TFBIF_ACTMON_MCB_BORPS]]
| 0x54501664
| 0x04
|-
| [[#TSEC_TFBIF_ACTMON_MCB_WEIGHT|TSEC_TFBIF_ACTMON_MCB_WEIGHT]]
| 0x54501668
| 0x04
|-
| [[#TSEC_TFBIF_THI_TRANSPROP|TSEC_TFBIF_THI_TRANSPROP]]
| 0x54501670
| 0x04
|-
| [[#TSEC_CG|TSEC_CG]]
| 0x545016D0
| 0x04
|-
| [[#TSEC_BAR0_CTL|TSEC_BAR0_CTL]]
| 0x54501700
| 0x04
|-
| [[#TSEC_BAR0_ADDR|TSEC_BAR0_ADDR]]
| 0x54501704
| 0x04
|-
| [[#TSEC_BAR0_DATA|TSEC_BAR0_DATA]]
| 0x54501708
| 0x04
|-
| [[#TSEC_BAR0_TIMEOUT|TSEC_BAR0_TIMEOUT]]
| 0x5450170C
| 0x04
|-
| TSEC_TEGRA_UNK_00
| 0x54501800
| 0x04
|-
| TSEC_TEGRA_UNK_04
| 0x54501804
| 0x04
|-
| TSEC_TEGRA_UNK_08
| 0x54501808
| 0x04
|-
| TSEC_TEGRA_UNK_0C
| 0x5450180C
| 0x04
|-
| TSEC_TEGRA_UNK_10
| 0x54501810
| 0x04
|-
| TSEC_TEGRA_UNK_14
| 0x54501814
| 0x04
|-
| TSEC_TEGRA_UNK_18
| 0x54501818
| 0x04
|-
| TSEC_TEGRA_UNK_1C
| 0x5450181C
| 0x04
|-
| TSEC_TEGRA_UNK_20
| 0x54501820
| 0x04
|-
| TSEC_TEGRA_UNK_24
| 0x54501824
| 0x04
|-
| TSEC_TEGRA_UNK_28
| 0x54501828
| 0x04
|-
| TSEC_TEGRA_UNK_2C
| 0x5450182C
| 0x04
|-
| TSEC_TEGRA_UNK_30
| 0x54501830
| 0x04
|-
| TSEC_TEGRA_UNK_34
| 0x54501834
| 0x04
|-
| [[#TSEC_TEGRA_CTL|TSEC_TEGRA_CTL]]
| 0x54501838
| 0x04
|}

=== TSEC_THI_INCR_SYNCPT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-9
| TSEC_THI_INCR_SYNCPT_INDX
|-
| 10-17
| TSEC_THI_INCR_SYNCPT_COND
|}

=== TSEC_THI_INCR_SYNCPT_CTRL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INCR_SYNCPT_CTRL_SOFT_RESET
|-
| 8
| TSEC_THI_INCR_SYNCPT_CTRL_NO_STALL
|-
| 16
| TSEC_THI_INCR_SYNCPT_CTRL_SOFT_RESET_0
|-
| 17
| TSEC_THI_INCR_SYNCPT_CTRL_NO_STALL_0
|-
| 18
| TSEC_THI_INCR_SYNCPT_CTRL_SOFT_RESET_1
|-
| 19
| TSEC_THI_INCR_SYNCPT_CTRL_NO_STALL_1
|-
| 20
| TSEC_THI_INCR_SYNCPT_CTRL_SOFT_RESET_2
|-
| 21
| TSEC_THI_INCR_SYNCPT_CTRL_NO_STALL_2
|-
| 22
| TSEC_THI_INCR_SYNCPT_CTRL_SOFT_RESET_3
|-
| 23
| TSEC_THI_INCR_SYNCPT_CTRL_NO_STALL_3
|-
| 24
| TSEC_THI_INCR_SYNCPT_CTRL_SOFT_RESET_4
|-
| 25
| TSEC_THI_INCR_SYNCPT_CTRL_NO_STALL_4
|}

=== TSEC_THI_INCR_SYNCPT_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INCR_SYNCPT_ERR_COND_STS_IMM
|-
| 1
| TSEC_THI_INCR_SYNCPT_ERR_COND_STS_OPDONE
|-
| 2
| TSEC_THI_INCR_SYNCPT_ERR_COND_STS_RD_DONE
|-
| 3
| TSEC_THI_INCR_SYNCPT_ERR_COND_STS_REG_WR_SAFE
|-
| 4
| TSEC_THI_INCR_SYNCPT_ERR_COND_STS_ENGINE_IDLE
|}

=== TSEC_THI_CTXSW_INCR_SYNCPT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-9
| TSEC_THI_CTXSW_INCR_SYNCPT_INDX
|}

=== TSEC_THI_CTXSW ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-9
| TSEC_THI_CTXSW_CURR_CLASS
|-
| 10
| TSEC_THI_CTXSW_AUTO_ACK
|-
| 11-20
| TSEC_THI_CTXSW_CURR_CHANNEL
|}

=== TSEC_THI_CTXSW_NEXT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-9
| TSEC_THI_CTXSW_NEXT_NEXT_CLASS
|-
| 10-19
| TSEC_THI_CTXSW_NEXT_NEXT_CHANNEL
|}

=== TSEC_THI_CONT_SYNCPT_EOF ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-9
| TSEC_THI_CONT_SYNCPT_EOF_INDEX
|-
| 10
| TSEC_THI_CONT_SYNCPT_EOF_COND
|}

=== TSEC_THI_CONT_SYNCPT_L1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-9
| TSEC_THI_CONT_SYNCPT_L1_INDEX
|-
| 10
| TSEC_THI_CONT_SYNCPT_L1_COND
|}

=== TSEC_THI_STREAMID0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-6
| TSEC_THI_STREAMID0_ID
|}

=== TSEC_THI_STREAMID1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-6
| TSEC_THI_STREAMID1_ID
|}

=== TSEC_THI_THI_SEC ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_THI_SEC_TZ_LOCK
|-
| 4
| TSEC_THI_THI_SEC_TZ_AUTH
|-
| 8
| TSEC_THI_THI_SEC_CH_LOCK
|}

=== TSEC_THI_METHOD0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-11
| TSEC_THI_METHOD0_OFFSET
|}

Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

The following methods are available:
{| class="wikitable" border="1"
! ID
! Method
|-
| 0x100
| NOP
|-
| 0x140
| PM_TRIGGER
|-
| 0x200
| SET_APPLICATION_ID
|-
| 0x204
| SET_WATCHDOG_TIMER
|-
| 0x240
| SEMAPHORE_A
|-
| 0x244
| SEMAPHORE_B
|-
| 0x248
| SEMAPHORE_C
|-
| 0x24C
|
|-
| 0x250
|
|-
| 0x300
| EXECUTE
|-
| 0x304
| SEMAPHORE_D
|-
| 0x500
| HDCP_INIT
|-
| 0x504
| HDCP_CREATE_SESSION
|-
| 0x508
| HDCP_VERIFY_CERT_RX
|-
| 0x50C
| HDCP_GENERATE_EKM
|-
| 0x510
| HDCP_REVOCATION_CHECK
|-
| 0x514
| HDCP_VERIFY_HPRIME
|-
| 0x518
| HDCP_ENCRYPT_PAIRING_INFO
|-
| 0x51C
| HDCP_DECRYPT_PAIRING_INFO
|-
| 0x520
| HDCP_UPDATE_SESSION
|-
| 0x524
| HDCP_GENERATE_LC_INIT
|-
| 0x528
| HDCP_VERIFY_LPRIME
|-
| 0x52C
| HDCP_GENERATE_SKE_INIT
|-
| 0x530
| HDCP_VERIFY_VPRIME
|-
| 0x534
| HDCP_ENCRYPTION_RUN_CTRL
|-
| 0x538
| HDCP_SESSION_CTRL
|-
| 0x53C
| HDCP_COMPUTE_SPRIME
|-
| 0x540
| HDCP_GET_CERT_RX
|-
| 0x544
| HDCP_EXCHANGE_INFO
|-
| 0x548
| HDCP_DECRYPT_KM
|-
| 0x54C
| HDCP_GET_HPRIME
|-
| 0x550
| HDCP_GENERATE_EKH_KM
|-
| 0x554
| HDCP_VERIFY_RTT_CHALLENGE
|-
| 0x558
| HDCP_GET_LPRIME
|-
| 0x55C
| HDCP_DECRYPT_KS
|-
| 0x560
| HDCP_DECRYPT
|-
| 0x564
| HDCP_GET_RRX
|-
| 0x568
| HDCP_DECRYPT_REENCRYPT
|-
| 0x56C
|
|-
| 0x570
|
|-
| 0x574
| HDCP_DECRYPT_STORED_KM
|-
| 0x578
|
|-
| 0x57C
|
|-
| 0x700
| HDCP_VALIDATE_SRM
|-
| 0x704
| HDCP_VALIDATE_STREAM
|-
| 0x708
| HDCP_TEST_SECURE_STATUS
|-
| 0x70C
| HDCP_SET_DCP_KPUB
|-
| 0x710
| HDCP_SET_RX_KPUB
|-
| 0x714
| HDCP_SET_CERT_RX
|-
| 0x718
| HDCP_SET_SCRATCH_BUFFER
|-
| 0x71C
| HDCP_SET_SRM
|-
| 0x720
| HDCP_SET_RECEIVER_ID_LIST
|-
| 0x724
| HDCP_SET_SPRIME
|-
| 0x728
| HDCP_SET_ENC_INPUT_BUFFER
|-
| 0x72C
| HDCP_SET_ENC_OUTPUT_BUFFER
|-
| 0x730
| HDCP_GET_RTT_CHALLENGE
|-
| 0x734
| HDCP_STREAM_MANAGE
|-
| 0x738
| HDCP_READ_CAPS
|-
| 0x73C
| HDCP_ENCRYPT
|-
| 0x740
| [6.0.0+] HDCP_GET_CURRENT_NONCE
|-
| 0x1114
| PM_TRIGGER_END
|}

=== TSEC_THI_METHOD1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_THI_METHOD1_DATA
|}

Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_CONTEXT_SWITCH ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-27
| TSEC_THI_CONTEXT_SWITCH_PTR
|-
| 30-31
| TSEC_THI_CONTEXT_SWITCH_TARGET
|}

=== TSEC_THI_INT_STATUS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_STATUS_FALCON_INT
|}

=== TSEC_THI_INT_MASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_MASK_FALCON_INT
|}

=== TSEC_THI_CONFIG0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_CONFIG0_RETURN_SYNCPT_ON_ERR
|-
| 4
| TSEC_THI_CONFIG0_IDLE_SYNCPT_INC_ENG
|}

=== TSEC_THI_DBG_MISC ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_DBG_MISC_CLIENT_IDLE_STATUS
|-
| 1
| TSEC_THI_DBG_MISC_THI_IDLE_STATUS
|-
| 2
| TSEC_THI_DBG_MISC_THI_SYNCPT_PENDING_STATUS
|-
| 3
| TSEC_THI_DBG_MISC_THI_IDLE_EN
|}

=== TSEC_THI_SLCG_OVERRIDE_HIGH_A ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| TSEC_THI_SLCG_OVERRIDE_HIGH_A_REG
|}

=== TSEC_THI_SLCG_OVERRIDE_LOW_A ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_THI_SLCG_OVERRIDE_LOW_A_REG
|}

=== TSEC_THI_CLK_OVERRIDE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_THI_CLK_OVERRIDE_CYA
|}

=== TSEC_FALCON_IRQSSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_IRQSSET_GPTMR
|-
| 1
| TSEC_FALCON_IRQSSET_WDTMR
|-
| 2
| TSEC_FALCON_IRQSSET_MTHD
|-
| 3
| TSEC_FALCON_IRQSSET_CTXSW
|-
| 4
| TSEC_FALCON_IRQSSET_HALT
|-
| 5
| TSEC_FALCON_IRQSSET_EXTERR
|-
| 6
| TSEC_FALCON_IRQSSET_SWGEN0
|-
| 7
| TSEC_FALCON_IRQSSET_SWGEN1
|-
| 8-15
| TSEC_FALCON_IRQSSET_EXT
|-
| 16
| TSEC_FALCON_IRQSSET_DMA
|}

Used for setting Falcon's IRQs.

=== TSEC_FALCON_IRQSCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_IRQSCLR_GPTMR
|-
| 1
| TSEC_FALCON_IRQSCLR_WDTMR
|-
| 2
| TSEC_FALCON_IRQSCLR_MTHD
|-
| 3
| TSEC_FALCON_IRQSCLR_CTXSW
|-
| 4
| TSEC_FALCON_IRQSCLR_HALT
|-
| 5
| TSEC_FALCON_IRQSCLR_EXTERR
|-
| 6
| TSEC_FALCON_IRQSCLR_SWGEN0
|-
| 7
| TSEC_FALCON_IRQSCLR_SWGEN1
|-
| 8-15
| TSEC_FALCON_IRQSCLR_EXT
|-
| 16
| TSEC_FALCON_IRQSCLR_DMA
|}

Used for clearing Falcon's IRQs.

=== TSEC_FALCON_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_IRQSTAT_GPTMR
|-
| 1
| TSEC_FALCON_IRQSTAT_WDTMR
|-
| 2
| TSEC_FALCON_IRQSTAT_MTHD
|-
| 3
| TSEC_FALCON_IRQSTAT_CTXSW
|-
| 4
| TSEC_FALCON_IRQSTAT_HALT
|-
| 5
| TSEC_FALCON_IRQSTAT_EXTERR
|-
| 6
| TSEC_FALCON_IRQSTAT_SWGEN0
|-
| 7
| TSEC_FALCON_IRQSTAT_SWGEN1
|-
| 8-15
| TSEC_FALCON_IRQSTAT_EXT
|-
| 16
| TSEC_FALCON_IRQSTAT_DMA
|}

Used for getting the status of Falcon's IRQs.

=== TSEC_FALCON_IRQMODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_IRQMODE_LVL_GPTMR
|-
| 1
| TSEC_FALCON_IRQMODE_LVL_WDTMR
|-
| 2
| TSEC_FALCON_IRQMODE_LVL_MTHD
|-
| 3
| TSEC_FALCON_IRQMODE_LVL_CTXSW
|-
| 4
| TSEC_FALCON_IRQMODE_LVL_HALT
|-
| 5
| TSEC_FALCON_IRQMODE_LVL_EXTERR
|-
| 6
| TSEC_FALCON_IRQMODE_LVL_SWGEN0
|-
| 7
| TSEC_FALCON_IRQMODE_LVL_SWGEN1
|-
| 8-15
| TSEC_FALCON_IRQMODE_LVL_EXT
|-
| 16
| TSEC_FALCON_IRQMODE_LVL_DMA
|}

Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.

=== TSEC_FALCON_IRQMSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_IRQMSET_GPTMR
|-
| 1
| TSEC_FALCON_IRQMSET_WDTMR
|-
| 2
| TSEC_FALCON_IRQMSET_MTHD
|-
| 3
| TSEC_FALCON_IRQMSET_CTXSW
|-
| 4
| TSEC_FALCON_IRQMSET_HALT
|-
| 5
| TSEC_FALCON_IRQMSET_EXTERR
|-
| 6
| TSEC_FALCON_IRQMSET_SWGEN0
|-
| 7
| TSEC_FALCON_IRQMSET_SWGEN1
|-
| 8-15
| TSEC_FALCON_IRQMSET_EXT
|-
| 16
| TSEC_FALCON_IRQMSET_DMA
|}

Used for setting the mask for Falcon's IRQs.

=== TSEC_FALCON_IRQMCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_IRQMCLR_GPTMR
|-
| 1
| TSEC_FALCON_IRQMCLR_WDTMR
|-
| 2
| TSEC_FALCON_IRQMCLR_MTHD
|-
| 3
| TSEC_FALCON_IRQMCLR_CTXSW
|-
| 4
| TSEC_FALCON_IRQMCLR_HALT
|-
| 5
| TSEC_FALCON_IRQMCLR_EXTERR
|-
| 6
| TSEC_FALCON_IRQMCLR_SWGEN0
|-
| 7
| TSEC_FALCON_IRQMCLR_SWGEN1
|-
| 8-15
| TSEC_FALCON_IRQMCLR_EXT
|-
| 16
| TSEC_FALCON_IRQMCLR_DMA
|}

Used for clearing the mask for Falcon's IRQs.

=== TSEC_FALCON_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_IRQMASK_GPTMR
|-
| 1
| TSEC_FALCON_IRQMASK_WDTMR
|-
| 2
| TSEC_FALCON_IRQMASK_MTHD
|-
| 3
| TSEC_FALCON_IRQMASK_CTXSW
|-
| 4
| TSEC_FALCON_IRQMASK_HALT
|-
| 5
| TSEC_FALCON_IRQMASK_EXTERR
|-
| 6
| TSEC_FALCON_IRQMASK_SWGEN0
|-
| 7
| TSEC_FALCON_IRQMASK_SWGEN1
|-
| 8-15
| TSEC_FALCON_IRQMASK_EXT
|-
| 16
| TSEC_FALCON_IRQMASK_DMA
|}

Used for getting the value of the mask for Falcon's IRQs.

=== TSEC_FALCON_IRQDEST ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_IRQDEST_HOST_GPTMR
|-
| 1
| TSEC_FALCON_IRQDEST_HOST_WDTMR
|-
| 2
| TSEC_FALCON_IRQDEST_HOST_MTHD
|-
| 3
| TSEC_FALCON_IRQDEST_HOST_CTXSW
|-
| 4
| TSEC_FALCON_IRQDEST_HOST_HALT
|-
| 5
| TSEC_FALCON_IRQDEST_HOST_EXTERR
|-
| 6
| TSEC_FALCON_IRQDEST_HOST_SWGEN0
|-
| 7
| TSEC_FALCON_IRQDEST_HOST_SWGEN1
|-
| 8-15
| TSEC_FALCON_IRQDEST_HOST_EXT
|-
| 16
| TSEC_FALCON_IRQDEST_TARGET_GPTMR
|-
| 17
| TSEC_FALCON_IRQDEST_TARGET_WDTMR
|-
| 18
| TSEC_FALCON_IRQDEST_TARGET_MTHD
|-
| 19
| TSEC_FALCON_IRQDEST_TARGET_CTXSW
|-
| 20
| TSEC_FALCON_IRQDEST_TARGET_HALT
|-
| 21
| TSEC_FALCON_IRQDEST_TARGET_EXTERR
|-
| 22
| TSEC_FALCON_IRQDEST_TARGET_SWGEN0
|-
| 23
| TSEC_FALCON_IRQDEST_TARGET_SWGEN1
|-
| 24-31
| TSEC_FALCON_IRQDEST_TARGET_EXT
|}

Used for routing Falcon's IRQs.

=== TSEC_FALCON_GPTMRINT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_GPTMRINT_VAL
|}

=== TSEC_FALCON_GPTMRVAL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_GPTMRVAL_VAL
|}

=== TSEC_FALCON_GPTMRCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_GPTMRCTL_GPTMREN
|}

=== TSEC_FALCON_PTIMER0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_PTIMER0_VAL
|}

=== TSEC_FALCON_PTIMER1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_PTIMER1_VAL
|}

=== TSEC_FALCON_WDTMRVAL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_WDTMRVAL_VAL
|}

=== TSEC_FALCON_WDTMRCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_WDTMRCTL_WDTMREN
|}

=== TSEC_FALCON_IRQDEST2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_IRQDEST2_HOST_DMA
|-
| 16
| TSEC_FALCON_IRQDEST2_TARGET_DMA
|}

Used for routing Falcon's IRQs.

=== TSEC_FALCON_MAILBOX0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_MAILBOX0_DATA
|}

Scratch register for reading/writing data to Falcon.

=== TSEC_FALCON_MAILBOX1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_MAILBOX1_DATA
|}

Scratch register for reading/writing data to Falcon.

=== TSEC_FALCON_ITFEN ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_ITFEN_CTXEN
|-
| 1
| TSEC_FALCON_ITFEN_MTHDEN
|}

Used for enabling/disabling Falcon interfaces.

=== TSEC_FALCON_IDLESTATE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_IDLESTATE_FALCON_BUSY
|-
| 1-15
| TSEC_FALCON_IDLESTATE_EXT_BUSY
|}

Used for detecting if Falcon is busy or not.

=== TSEC_FALCON_CURCTX ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-27
| TSEC_FALCON_CURCTX_CTXPTR
|-
| 28-29
| TSEC_FALCON_CURCTX_CTXTGT
|-
| 30
| TSEC_FALCON_CURCTX_CTXVLD
|}

=== TSEC_FALCON_NXTCTX ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-27
| TSEC_FALCON_NXTCTX_CTXPTR
|-
| 28-29
| TSEC_FALCON_NXTCTX_CTXTGT
|-
| 30
| TSEC_FALCON_NXTCTX_CTXVLD
|}

=== TSEC_FALCON_CTXACK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_CTXACK_SAVE_ACK
|-
| 1
| TSEC_FALCON_CTXACK_REST_ACK
|}

=== TSEC_FALCON_FHSTATE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_FHSTATE_FALCON_HALTED
|-
| 1-15
| TSEC_FALCON_FHSTATE_EXT_HALTED
|-
| 16
| TSEC_FALCON_FHSTATE_ENGINE_FAULTED
|-
| 17
| TSEC_FALCON_FHSTATE_STALL_REQ
|}

=== TSEC_FALCON_PRIVSTATE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_PRIVSTATE_PRIV
|}

=== TSEC_FALCON_MTHDDATA ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_MTHDDATA_DATA
|}

=== TSEC_FALCON_MTHDID ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-11
| TSEC_FALCON_MTHDID_ID
|-
| 12-14
| TSEC_FALCON_MTHDID_SUBCH
|-
| 15
| TSEC_FALCON_MTHDID_PRIV
|-
| 16
| TSEC_FALCON_MTHDID_WPEND
|}

=== TSEC_FALCON_MTHDWDAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_MTHDWDAT_DATA
|}

=== TSEC_FALCON_MTHDCOUNT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_FALCON_MTHDCOUNT_COUNT
|}

=== TSEC_FALCON_MTHDPOP ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_MTHDPOP_POP
|}

=== TSEC_FALCON_MTHDRAMSZ ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_FALCON_MTHDRAMSZ_RAMSZ
|}

=== TSEC_FALCON_SFTRESET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_SFTRESET_EXT
|}

=== TSEC_FALCON_OS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_OS_VERSION
|}

=== TSEC_FALCON_RM ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_RM_CONFIG
|}

=== TSEC_FALCON_SOFT_PM ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-5
| TSEC_FALCON_SOFT_PM_PROBE
|-
| 16
| TSEC_FALCON_SOFT_PM_TRIGGER_END
|-
| 17
| TSEC_FALCON_SOFT_PM_TRIGGER_START
|}

=== TSEC_FALCON_SOFT_MODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-5
| TSEC_FALCON_SOFT_MODE_PROBE
|}

=== TSEC_FALCON_DEBUG1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_FALCON_DEBUG1_MTHD_DRAIN_TIME
|-
| 16
| TSEC_FALCON_DEBUG1_CTXSW_MODE
|-
| 17
| TSEC_FALCON_DEBUG1_TRACE_FORMAT
|}

=== TSEC_FALCON_DEBUGINFO ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_DEBUGINFO_DATA
|}

Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.

[6.0.0+] [[NV_services|nvservices]] sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.

=== TSEC_FALCON_IBRKPT1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-23
| TSEC_FALCON_IBRKPT1_PC
|-
| 29
| TSEC_FALCON_IBRKPT1_SUPPRESS
|-
| 30
| TSEC_FALCON_IBRKPT1_SKIP
|-
| 31
| TSEC_FALCON_IBRKPT1_EN
|}

=== TSEC_FALCON_IBRKPT2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-23
| TSEC_FALCON_IBRKPT2_PC
|-
| 29
| TSEC_FALCON_IBRKPT2_SUPPRESS
|-
| 30
| TSEC_FALCON_IBRKPT2_SKIP
|-
| 31
| TSEC_FALCON_IBRKPT2_EN
|}

=== TSEC_FALCON_CGCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_CGCTL_CG_OVERRIDE
|}

=== TSEC_FALCON_ENGCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_ENGCTL_INV_CONTEXT
|-
| 1
| TSEC_FALCON_ENGCTL_SET_STALLREQ
|-
| 2
| TSEC_FALCON_ENGCTL_CLR_STALLREQ
|-
| 3
| TSEC_FALCON_ENGCTL_SWITCH_CONTEXT
|-
| 8
| TSEC_FALCON_ENGCTL_STALLREQ
|-
| 9
| TSEC_FALCON_ENGCTL_STALLACK
|}

=== TSEC_FALCON_PMM ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-4
| TSEC_FALCON_PMM_FALCON_STALL_SEL
0x00: ANY
0x01: CODE
0x02: DMAQ
0x03: DMFENCE
0x04: DMWAIT
0x05: IMWAIT
0x06: IPND
0x07: LDSTQ
0x08: SB
0x09: ANY_SC
0x0A: CODE_SC
0x0B: DMAQ_SC
0x0C: DMFENCE_SC
0x0D: DMWAIT_SC
0x0E: IMWAIT_SC
0x0F: IPND_SC
0x10: LDSTQ_SC
0x11: SB_SC
|-
| 5-7
| TSEC_FALCON_PMM_FALCON_IDLE_SEL
0x00: WAITING
0x01: ENG_IDLE
0x02: MTHD_FULL
0x03: WAITING_SC
0x04: ENG_IDLE_SC
0x05: MTHD_FULL_SC
|-
| 8-11
| TSEC_FALCON_PMM_FALCON_SOFTPM0_SEL
0x00: 0
0x01: 1
0x02: 2
0x03: 3
0x04: 4
0x05: 5
0x06: 0_SC
0x07: 1_SC
0x08: 2_SC
0x09: 3_SC
0x0A: 4_SC
0x0B: 5_SC
|-
| 12-15
| TSEC_FALCON_PMM_FALCON_SOFTPM1_SEL
0x00: 0
|-
| 17-19
| TSEC_FALCON_PMM_TFBIF_DSTAT_SEL
0x00: 1KTRANSFER
0x01: RREQ
0x02: WREQ
0x03: TWREQ
0x04: 1KTRANSFER_SC
0x05: RREQ_SC
0x06: WREQ_SC
0x07: TWREQ_SC
|-
| 20-23
| TSEC_FALCON_PMM_TFBIF_STALL0_SEL
0x00: RDATQ_FULL
0x01: RACKQ_FULL
0x02: WREQQ_FULL
0x03: WDATQ_FULL
0x04: WACKQ_FULL
0x05: MREQQ_FULL
0x06: RREQ_PEND
0x07: WREQ_PEND
0x08: RDATQ_FULL_SC
0x09: RACKQ_FULL_SC
0x0A: WREQQ_FULL_SC
0x0B: WDATQ_FULL_SC
0x0C: WACKQ_FULL_SC
0x0D: MREQQ_FULL_SC
0x0E: RREQ_PEND_SC
0x0F: WREQ_PEND_SC
|-
| 24-27
| TSEC_FALCON_PMM_TFBIF_STALL1_SEL
0x00: RDATQ_FULL
|-
| 28-31
| TSEC_FALCON_PMM_TFBIF_STALL2_SEL
0x00: RDATQ_FULL
|}

=== TSEC_FALCON_ADDR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-5
| TSEC_FALCON_ADDR_LSB
|-
| 6-11
| TSEC_FALCON_ADDR_MSB
|}

=== TSEC_FALCON_IBRKPT3 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-23
| TSEC_FALCON_IBRKPT3_PC
|-
| 29
| TSEC_FALCON_IBRKPT3_SUPPRESS
|-
| 30
| TSEC_FALCON_IBRKPT3_SKIP
|-
| 31
| TSEC_FALCON_IBRKPT3_EN
|}

=== TSEC_FALCON_IBRKPT4 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-23
| TSEC_FALCON_IBRKPT4_PC
|-
| 29
| TSEC_FALCON_IBRKPT4_SUPPRESS
|-
| 30
| TSEC_FALCON_IBRKPT4_SKIP
|-
| 31
| TSEC_FALCON_IBRKPT4_EN
|}

=== TSEC_FALCON_IBRKPT5 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-23
| TSEC_FALCON_IBRKPT5_PC
|-
| 29
| TSEC_FALCON_IBRKPT5_SUPPRESS
|-
| 30
| TSEC_FALCON_IBRKPT5_SKIP
|-
| 31
| TSEC_FALCON_IBRKPT5_EN
|}

=== TSEC_FALCON_EXCI ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-19
| TSEC_FALCON_EXCI_EXPC
|-
| 20-23
| TSEC_FALCON_EXCI_EXCAUSE
0x00: TRAP0
0x01: TRAP1
0x02: TRAP2
0x03: TRAP3
0x08: ILL_INS (invalid opcode)
0x09: INV_INS (authentication entry)
0x0A: MISS_INS (page miss)
0x0B: DHIT_INS (page multiple hit)
0x0F: BRKPT_INS (breakpoint hit)
|}

Contains information about raised exceptions.

=== TSEC_FALCON_SVEC_SPR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 18
| TSEC_FALCON_SVEC_SPR_SIGPASS
|}

=== TSEC_FALCON_RSTAT0 ===
Mirror of the [[#TSEC_FALCON_ICD_RDATA|ICD status register 0]].

=== TSEC_FALCON_RSTAT3 ===
Mirror of the [[#TSEC_FALCON_ICD_RDATA|ICD status register 3]].

=== TSEC_FALCON_CPUCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_CPUCTL_IINVAL
|-
| 1
| TSEC_FALCON_CPUCTL_STARTCPU
|-
| 2
| TSEC_FALCON_CPUCTL_SRESET
|-
| 3
| TSEC_FALCON_CPUCTL_HRESET
|-
| 4
| TSEC_FALCON_CPUCTL_HALTED
|-
| 5
| TSEC_FALCON_CPUCTL_STOPPED
|-
| 6
| TSEC_FALCON_CPUCTL_ALIAS_EN
|}

Used for signaling the Falcon CPU.

=== TSEC_FALCON_BOOTVEC ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_BOOTVEC_VEC
|}

Takes the Falcon's boot vector address.

=== TSEC_FALCON_HWCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-8
| TSEC_FALCON_HWCFG_IMEM_SIZE
|-
| 9-17
| TSEC_FALCON_HWCFG_DMEM_SIZE
|-
| 18-26
| TSEC_FALCON_HWCFG_METHODFIFO_DEPTH
|-
| 27-31
| TSEC_FALCON_HWCFG_DMAQUEUE_DEPTH
|}

=== TSEC_FALCON_DMACTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_DMACTL_REQUIRE_CTX
|-
| 1
| TSEC_FALCON_DMACTL_DMEM_SCRUBBING
|-
| 2
| TSEC_FALCON_DMACTL_IMEM_SCRUBBING
|-
| 3-6
| TSEC_FALCON_DMACTL_DMAQ_NUM
|-
| 7
| TSEC_FALCON_DMACTL_SECURE_STAT
|}

Used for configuring the Falcon's DMA engine.

=== TSEC_FALCON_DMATRFBASE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_DMATRFBASE_BASE
|}

Base address of the external memory buffer, shifted right by 8.

The current transfer address is calculated by adding [[#TSEC_FALCON_DMATRFFBOFFS|TSEC_FALCON_DMATRFFBOFFS]] to the base.

=== TSEC_FALCON_DMATRFMOFFS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_FALCON_DMATRFMOFFS_OFFS
|}

For transfers to DMEM: the destination address.
For transfers to IMEM: the destination virtual IMEM page.

=== TSEC_FALCON_DMATRFCMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_DMATRFCMD_FULL
|-
| 1
| TSEC_FALCON_DMATRFCMD_IDLE
|-
| 2-3
| TSEC_FALCON_DMATRFCMD_SEC
|-
| 4
| TSEC_FALCON_DMATRFCMD_IMEM
|-
| 5
| TSEC_FALCON_DMATRFCMD_WRITE
|-
| 8-10
| TSEC_FALCON_DMATRFCMD_SIZE
|-
| 12-14
| TSEC_FALCON_DMATRFCMD_CTXDMA
|}

Used for configuring DMA transfers.

=== TSEC_FALCON_DMATRFFBOFFS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_DMATRFFBOFFS_OFFS
|}

For transfers to IMEM: the destination physical IMEM page.

=== TSEC_FALCON_DMAPOLL_FB ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_DMAPOLL_FB_FENCE_ACTIVE
|-
| 1
| TSEC_FALCON_DMAPOLL_FB_DMA_ACTIVE
|-
| 4
| TSEC_FALCON_DMAPOLL_FB_CFG_R_FENCE
|-
| 5
| TSEC_FALCON_DMAPOLL_FB_CFG_W_FENCE
|-
| 16-23
| TSEC_FALCON_DMAPOLL_FB_WCOUNT
|-
| 24-31
| TSEC_FALCON_DMAPOLL_FB_RCOUNT
|}

Contains the status of a DMA transfer between the Falcon and external memory.

=== TSEC_FALCON_DMAPOLL_CP ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_DMAPOLL_CP_FENCE_ACTIVE
|-
| 1
| TSEC_FALCON_DMAPOLL_CP_DMA_ACTIVE
|-
| 4
| TSEC_FALCON_DMAPOLL_CP_CFG_R_FENCE
|-
| 5
| TSEC_FALCON_DMAPOLL_CP_CFG_W_FENCE
|-
| 16-23
| TSEC_FALCON_DMAPOLL_CP_WCOUNT
|-
| 24-31
| TSEC_FALCON_DMAPOLL_CP_RCOUNT
|}

Contains the status of a DMA transfer between the Falcon and the SCP.

=== TSEC_FALCON_HWCFG1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| TSEC_FALCON_HWCFG1_CORE_REV
|-
| 4-5
| TSEC_FALCON_HWCFG1_SECURITY_MODEL
|-
| 6-7
| TSEC_FALCON_HWCFG1_CORE_REV_SUBVERSION
|-
| 8-11
| TSEC_FALCON_HWCFG1_IMEM_PORTS
|-
| 12-15
| TSEC_FALCON_HWCFG1_DMEM_PORTS
|-
| 16-20
| TSEC_FALCON_HWCFG1_TAG_WIDTH
|-
| 27
| TSEC_FALCON_HWCFG1_DBG_PRIV_BUS
|-
| 28
| TSEC_FALCON_HWCFG1_CSB_SIZE_16M
|-
| 29
| TSEC_FALCON_HWCFG1_PRIV_DIRECT
|-
| 30
| TSEC_FALCON_HWCFG1_DMEM_APERTURES
|-
| 31
| TSEC_FALCON_HWCFG1_IMEM_AUTOFILL
|}

=== TSEC_FALCON_CPUCTL_ALIAS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_FALCON_CPUCTL_ALIAS_STARTCPU
|}

=== TSEC_FALCON_STACKCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_FALCON_STACKCFG_BOTTOM
|-
| 31
| TSEC_FALCON_STACKCFG_SPEXC
|}

=== TSEC_FALCON_IMCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-23
| TSEC_FALCON_IMCTL_ADDR_BLK
|-
| 24-26
| TSEC_FALCON_IMCTL_CMD
0x00: NOP
0x01: IMINV (ITLB)
0x02: IMBLK (PTLB)
0x03: IMTAG (VTLB)
0x04: IMTAG_SETVLD
|}

Controls the Falcon TLB.

=== TSEC_FALCON_IMSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_IMSTAT_VAL
|}

Returns the result of the last command from [[#TSEC_FALCON_IMCTL|TSEC_FALCON_IMCTL]].

=== TSEC_FALCON_TRACEIDX ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| TSEC_FALCON_TRACEIDX_IDX
|-
| 16-23
| TSEC_FALCON_TRACEIDX_MAXIDX
|-
| 24-31
| TSEC_FALCON_TRACEIDX_CNT
|}

Controls the index for tracing with [[#TSEC_FALCON_TRACEPC|TSEC_FALCON_TRACEPC]].

=== TSEC_FALCON_TRACEPC ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-23
| TSEC_FALCON_TRACEPC_PC
|}

Returns the PC of the last call or branch executed.

=== TSEC_FALCON_IMFILLRNG0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_FALCON_IMFILLRNG0_TAG_LO
|-
| 16-31
| TSEC_FALCON_IMFILLRNG0_TAG_HI
|}

=== TSEC_FALCON_IMFILLRNG1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_FALCON_IMFILLRNG1_TAG_LO
|-
| 16-31
| TSEC_FALCON_IMFILLRNG1_TAG_HI
|}

=== TSEC_FALCON_IMFILLCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| TSEC_FALCON_IMFILLCTL_NBLOCKS
|}

=== TSEC_FALCON_IMCTL_DEBUG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-23
| TSEC_FALCON_IMCTL_DEBUG_ADDR_BLK
|-
| 24-26
| TSEC_FALCON_IMCTL_DEBUG_CMD
0x00: NOP
0x02: IMBLK
0x03: IMTAG
|}

=== TSEC_FALCON_CMEMBASE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 18-31
| TSEC_FALCON_CMEMBASE_VAL
|}

=== TSEC_FALCON_DMEMAPERT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| TSEC_FALCON_DMEMAPERT_TIME_OUT
|-
| 8-11
| TSEC_FALCON_DMEMAPERT_TIME_UNIT
|-
| 16
| TSEC_FALCON_DMEMAPERT_ENABLE
|-
| 17-19
| TSEC_FALCON_DMEMAPERT_LDSTQ_NUM
|}

=== TSEC_FALCON_EXTERRADDR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_EXTERRADDR_ADDR
|}

=== TSEC_FALCON_EXTERRSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-23
| TSEC_FALCON_EXTERRSTAT_PC
|-
| 24-27
| TSEC_FALCON_EXTERRSTAT_STAT
|-
| 31
| TSEC_FALCON_EXTERRSTAT_VALID
|}

=== TSEC_FALCON_CG2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_FALCON_CG2_SLCG_FALCON_DMA
|-
| 2
| TSEC_FALCON_CG2_SLCG_FALCON_GC6_SR_FSM
|-
| 3
| TSEC_FALCON_CG2_SLCG_FALCON_PIPE
|-
| 4
| TSEC_FALCON_CG2_SLCG_FALCON_DIV
|-
| 5
| TSEC_FALCON_CG2_SLCG_FALCON_ICD
|-
| 6
| TSEC_FALCON_CG2_SLCG_FALCON_CFG
|-
| 7
| TSEC_FALCON_CG2_SLCG_FALCON_CTXSW
|-
| 8
| TSEC_FALCON_CG2_SLCG_FALCON_PMB
|-
| 9
| TSEC_FALCON_CG2_SLCG_FALCON_RF
|-
| 10
| TSEC_FALCON_CG2_SLCG_FALCON_MUL
|-
| 11
| TSEC_FALCON_CG2_SLCG_FALCON_LDST
|-
| 12
| TSEC_FALCON_CG2_SLCG_FALCON_TSYNC
|-
| 13
| TSEC_FALCON_CG2_SLCG_FALCON_GPTMR
|-
| 14
| TSEC_FALCON_CG2_SLCG_FALCON_WDTMR
|-
| 15
| TSEC_FALCON_CG2_SLCG_FALCON_IRQSTAT
|-
| 16
| TSEC_FALCON_CG2_SLCG_FALCON_TOP
|-
| 17
| TSEC_FALCON_CG2_SLCG_FBIF
|}

=== TSEC_FALCON_IMEMC ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 2-7
| TSEC_FALCON_IMEMC_OFFS
|-
| 8-15
| TSEC_FALCON_IMEMC_BLK
|-
| 24
| TSEC_FALCON_IMEMC_AINCW
|-
| 25
| TSEC_FALCON_IMEMC_AINCR
|-
| 28
| TSEC_FALCON_IMEMC_SECURE
|-
| 29
| TSEC_FALCON_IMEMC_SEC_ATOMIC
|-
| 30
| TSEC_FALCON_IMEMC_SEC_WR_VIO
|-
| 31
| TSEC_FALCON_IMEMC_SEC_LOCK
|}

Used for configuring access to Falcon's IMEM.

=== TSEC_FALCON_IMEMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_IMEMD_DATA
|}

Returns or takes the value for an IMEM read/write operation.

=== TSEC_FALCON_IMEMT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_FALCON_IMEMT_TAG
|}

Returns or takes the virtual page index for an IMEM read/write operation.

=== TSEC_FALCON_DMEMC ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 2-7
| TSEC_FALCON_DMEMC_OFFS
|-
| 8-15
| TSEC_FALCON_DMEMC_BLK
|-
| 24
| TSEC_FALCON_DMEMC_AINCW
|-
| 25
| TSEC_FALCON_DMEMC_AINCR
|}

Used for configuring access to Falcon's DMEM.

=== TSEC_FALCON_DMEMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_DMEMD_DATA
|}

Returns or takes the value for a DMEM read/write operation.

=== TSEC_FALCON_ICD_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| TSEC_FALCON_ICD_CMD_OPC
0x00: STOP
0x01: RUN (run from PC)
0x02: JRUN (run from address)
0x03: RUNB (run from PC)
0x04: JRUNB (run from address)
0x05: STEP (step from PC)
0x06: JSTEP (step from address)
0x07: EMASK (set exception mask)
0x08: RREG (read register)
0x09: WREG (write register)
0x0A: RDM (read data memory)
0x0B: WDM (write data memory)
0x0C: RCM (read MMIO/configuration memory)
0x0D: WCM (write MMIO/configuration memory)
0x0E: RSTAT (read status)
0x0F: SBU (store buffer update)
|-
| 6-7
| TSEC_FALCON_ICD_CMD_SZ
0x00: B (byte)
0x01: HW (half word)
0x02: W (word)
|-
| 8-12
| TSEC_FALCON_ICD_CMD_IDX
0x00: REG0 | RSTAT0 | WB0
0x01: REG1 | RSTAT1 | WB1
0x02: REG2 | RSTAT2 | WB2
0x03: REG3 | RSTAT3 | WB3
0x04: REG4 | RSTAT4
0x05: REG5 | RSTAT5
0x06: REG6
0x07: REG7
0x08: REG8
0x09: REG9
0x0A: REG10
0x0B: REG11
0x0C: REG12
0x0D: REG13
0x0E: REG14
0x0F: REG15
0x10: IV0
0x11: IV1
0x12: UNDEFINED
0x13: EV
0x14: SP
0x15: PC
0x16: IMB
0x17: DMB
0x18: CSW
0x19: CCR
0x1A: SEC
0x1B: CTX
0x1C: EXCI
0x1D: SEC1
0x1E: IMB1
0x1F: DMB1
|-
| 14
| TSEC_FALCON_ICD_CMD_ERROR
|-
| 15
| TSEC_FALCON_ICD_CMD_RDVLD
|-
| 16-31
| TSEC_FALCON_ICD_CMD_PARM
0x0001: EMASK_TRAP0
0x0002: EMASK_TRAP1
0x0004: EMASK_TRAP2
0x0008: EMASK_TRAP3
0x0010: EMASK_EXC_UNIMP
0x0020: EMASK_EXC_IMISS
0x0040: EMASK_EXC_IMHIT
0x0080: EMASK_EXC_IBREAK
0x0100: EMASK_IV0
0x0200: EMASK_IV1
0x0400: EMASK_IV2
0x0800: EMASK_EXT0
0x1000: EMASK_EXT1
0x2000: EMASK_EXT2
0x4000: EMASK_EXT3
0x8000: EMASK_EXT4
|}

Used for sending commands to the Falcon's in-chip debugger.

=== TSEC_FALCON_ICD_ADDR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_ICD_ADDR_ADDR
|}

Takes the target address for the Falcon's in-chip debugger.

=== TSEC_FALCON_ICD_WDATA ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_ICD_WDATA_DATA
|}

Takes the data for writing using the Falcon's in-chip debugger.

=== TSEC_FALCON_ICD_RDATA ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_ICD_RDATA_DATA
|}

Returns the data read using the Falcon's in-chip debugger.

When reading from an internal status register (STAT), the following applies:
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| RSTAT0_MEM_STALL
|-
| 1
| RSTAT0_DMA_STALL
|-
| 2
| RSTAT0_FENCE_STALL
|-
| 3
| RSTAT0_DIV_STALL
|-
| 4
| RSTAT0_DMA_STALL_DMAQ
|-
| 5
| RSTAT0_DMA_STALL_DMWAITING
|-
| 6
| RSTAT0_DMA_STALL_IMWAITING
|-
| 7
| RSTAT0_ANY_STALL
|-
| 8
| RSTAT0_SBFULL_STALL
|-
| 9
| RSTAT0_SBHIT_STALL
|-
| 10
| RSTAT0_FLOW_STALL
|-
| 11
| RSTAT0_SP_STALL
|-
| 12
| RSTAT0_BL_STALL
|-
| 13
| RSTAT0_IPND_STALL
|-
| 14
| RSTAT0_LDSTQ_STALL
|-
| 16
| RSTAT0_NOINSTR_STALL
|-
| 20
| RSTAT0_HALTSTOP_FLUSH
|-
| 21
| RSTAT0_AFILL_FLUSH
|-
| 22
| RSTAT0_EXC_FLUSH
|-
| 23-25
| RSTAT0_IRQ_FLUSH
|-
| 28
| RSTAT0_VALIDRD
|-
| 29
| RSTAT0_WAITING
|-
| 30
| RSTAT0_HALTED
|-
| 31
| RSTAT0_MTHD_FULL
|}
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| RSTAT1_WB_ALLOC
|-
| 4-7
| RSTAT1_WB_VALID
|-
| 8-9
| RSTAT1_WB0_SZ
|-
| 10-11
| RSTAT1_WB1_SZ
|-
| 12-13
| RSTAT1_WB2_SZ
|-
| 14-15
| RSTAT1_WB3_SZ
|-
| 16-19
| RSTAT1_WB0_IDX
|-
| 20-23
| RSTAT1_WB1_IDX
|-
| 24-27
| RSTAT1_WB2_IDX
|-
| 28-31
| RSTAT1_WB3_IDX
|}
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| RSTAT2_DMAQ_NUM
|-
| 4
| RSTAT2_DMA_ENABLE
|-
| 5-7
| RSTAT2_LDSTQ_NUM
|-
| 16-19
| RSTAT2_EM_BUSY
|-
| 20-23
| RSTAT2_EM_ACKED
|-
| 24-27
| RSTAT2_EM_ISWR
|-
| 28-31
| RSTAT2_EM_DVLD
|}
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| RSTAT3_MTHD_IDLE
|-
| 1
| RSTAT3_CTXSW_IDLE
|-
| 2
| RSTAT3_DMA_IDLE
|-
| 3
| RSTAT3_SCP_IDLE
|-
| 4
| RSTAT3_LDST_IDLE
|-
| 5
| RSTAT3_SBWB_EMPTY
|-
| 6-8
| RSTAT3_CSWIE
|-
| 10
| RSTAT3_CSWE
|-
| 12-14
| RSTAT3_CTXSW_STATE
0x00: IDLE
0x01: SM_CHECK
0x02: SM_SAVE
0x03: SM_SAVE_WAIT
0x04: SM_BLK_BIND
0x05: SM_RESET
0x06: SM_RESETWAIT
0x07: SM_ACK
|-
| 15
| RSTAT3_CTXSW_PEND
|-
| 17
| RSTAT3_DMA_FBREQ_IDLE
|-
| 18
| RSTAT3_DMA_ACKQ_EMPTY
|-
| 19
| RSTAT3_DMA_RDQ_EMPTY
|-
| 20
| RSTAT3_DMA_WR_BUSY
|-
| 21
| RSTAT3_DMA_RD_BUSY
|-
| 22
| RSTAT3_LDST_XT_BUSY
|-
| 23
| RSTAT3_LDST_XT_BLOCK
|-
| 24
| RSTAT3_ENG_IDLE
|}
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| RSTAT4_ICD_STATE
0x00: NORMAL
0x01: WAIT_ISSUE_CLEAR
0x02: WAIT_EXLDQ_CLEAR
0x03: FULL_DBG_MODE
|-
| 2-3
| RSTAT4_ICD_MODE
0x00: SUPPRESSICD
0x01: ENTERICD_IBRK
0x02: ENTERICD_STEP
|-
| 16
| RSTAT4_ICD_EMASK_TRAP0
|-
| 17
| RSTAT4_ICD_EMASK_TRAP1
|-
| 18
| RSTAT4_ICD_EMASK_TRAP2
|-
| 19
| RSTAT4_ICD_EMASK_TRAP3
|-
| 20
| RSTAT4_ICD_EMASK_EXC_UNIMP
|-
| 21
| RSTAT4_ICD_EMASK_EXC_IMISS
|-
| 22
| RSTAT4_ICD_EMASK_EXC_IMHIT
|-
| 23
| RSTAT4_ICD_EMASK_EXC_IBREAK
|-
| 24
| RSTAT4_ICD_EMASK_IV0
|-
| 25
| RSTAT4_ICD_EMASK_IV1
|-
| 26
| RSTAT4_ICD_EMASK_IV2
|-
| 27
| RSTAT4_ICD_EMASK_EXT0
|-
| 28
| RSTAT4_ICD_EMASK_EXT1
|-
| 29
| RSTAT4_ICD_EMASK_EXT2
|-
| 30
| RSTAT4_ICD_EMASK_EXT3
|-
| 31
| RSTAT4_ICD_EMASK_EXT4
|}
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| RSTAT5_LRU_STATE
|}

=== TSEC_FALCON_SCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_SCTL_LSMODE
|-
| 1
| TSEC_FALCON_SCTL_HSMODE
|-
| 4-5
| Unknown
|-
| 12-13
| Unknown
|-
| 14
| Initialize the transition to LS mode
|}

=== TSEC_FALCON_SSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 30
| Unknown
|-
| 31
| Set on memory protection violation
|}

=== TSEC_FALCON_SPROT_IMEM ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Read access level
|-
| 4-7
| Write access level
|}

Controls accesses to Falcon IMEM.

=== TSEC_FALCON_SPROT_DMEM ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Read access level
|-
| 4-7
| Write access level
|}

Controls accesses to Falcon DMEM.

=== TSEC_FALCON_SPROT_CPUCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Read access level
|-
| 4-7
| Write access level
|}

Controls accesses to the [[#TSEC_FALCON_CPUCTL|TSEC_FALCON_CPUCTL]] register.

=== TSEC_FALCON_SPROT_MISC ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Read access level
|-
| 4-7
| Write access level
|}

Controls accesses to the following registers:
* [[#TSEC_FALCON_PRIVSTATE|TSEC_FALCON_PRIVSTATE]]
* [[#TSEC_FALCON_SFTRESET|TSEC_FALCON_SFTRESET]]
* [[#TSEC_FALCON_ADDR|TSEC_FALCON_ADDR]]
* [[#TSEC_FALCON_DMACTL|TSEC_FALCON_DMACTL]]
* [[#TSEC_FALCON_IMCTL|TSEC_FALCON_IMCTL]]
* [[#TSEC_FALCON_IMSTAT|TSEC_FALCON_IMSTAT]]
* TSEC_FALCON_UNK_250
* [[#TSEC_FALCON_DMAINFO_CTL|TSEC_FALCON_DMAINFO_CTL]]

=== TSEC_FALCON_SPROT_IRQ ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Read access level
|-
| 4-7
| Write access level
|}

Controls accesses to the following registers:
* [[#TSEC_FALCON_IRQMODE|TSEC_FALCON_IRQMODE]]
* [[#TSEC_FALCON_IRQMSET|TSEC_FALCON_IRQMSET]]
* [[#TSEC_FALCON_IRQMCLR|TSEC_FALCON_IRQMCLR]]
* [[#TSEC_FALCON_IRQDEST|TSEC_FALCON_IRQDEST]]
* [[#TSEC_FALCON_GPTMRINT|TSEC_FALCON_GPTMRINT]]
* [[#TSEC_FALCON_GPTMRVAL|TSEC_FALCON_GPTMRVAL]]
* [[#TSEC_FALCON_GPTMRCTL|TSEC_FALCON_GPTMRCTL]]
* [[#TSEC_FALCON_IRQDEST2|TSEC_FALCON_IRQDEST2]]
* TSEC_FALCON_UNK_E0

=== TSEC_FALCON_SPROT_MTHD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Read access level
|-
| 4-7
| Write access level
|}

Controls accesses to the following registers:
* [[#TSEC_FALCON_ITFEN|TSEC_FALCON_ITFEN]]
* [[#TSEC_FALCON_CURCTX|TSEC_FALCON_CURCTX]]
* [[#TSEC_FALCON_NXTCTX|TSEC_FALCON_NXTCTX]]
* [[#TSEC_FALCON_CTXACK|TSEC_FALCON_CTXACK]]
* [[#TSEC_FALCON_MTHDDATA|TSEC_FALCON_MTHDDATA]]
* [[#TSEC_FALCON_MTHDID|TSEC_FALCON_MTHDID]]
* [[#TSEC_FALCON_MTHDWDAT|TSEC_FALCON_MTHDWDAT]]
* [[#TSEC_FALCON_MTHDCOUNT|TSEC_FALCON_MTHDCOUNT]]
* [[#TSEC_FALCON_MTHDPOP|TSEC_FALCON_MTHDPOP]]
* [[#TSEC_FALCON_MTHDRAMSZ|TSEC_FALCON_MTHDRAMSZ]]
* [[#TSEC_FALCON_DEBUG1|TSEC_FALCON_DEBUG1]]

=== TSEC_FALCON_SPROT_SCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Read access level
|-
| 4-7
| Write access level
|}

Controls accesses to the [[#TSEC_FALCON_SCTL|TSEC_FALCON_SCTL]] register.

=== TSEC_FALCON_SPROT_WDTMR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Read access level
|-
| 4-7
| Write access level
|}

Controls accesses to the following registers:
* [[#TSEC_FALCON_WDTMRVAL|TSEC_FALCON_WDTMRVAL]]
* [[#TSEC_FALCON_WDTMRCTL|TSEC_FALCON_WDTMRCTL]]

=== TSEC_FALCON_DMAINFO_FINISHED_FBRD_LOW ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_DMAINFO_FINISHED_FBRD_LOW_VAL
|}

=== TSEC_FALCON_DMAINFO_FINISHED_FBRD_HIGH ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-30
| TSEC_FALCON_DMAINFO_FINISHED_FBRD_HIGH_VAL
|-
| 31
| TSEC_FALCON_DMAINFO_FINISHED_FBRD_HIGH_OBIT
|}

=== TSEC_FALCON_DMAINFO_FINISHED_FBWR_LOW ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_DMAINFO_FINISHED_FBWR_LOW_VAL
|}

=== TSEC_FALCON_DMAINFO_FINISHED_FBWR_HIGH ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-30
| TSEC_FALCON_DMAINFO_FINISHED_FBWR_HIGH_VAL
|-
| 31
| TSEC_FALCON_DMAINFO_FINISHED_FBWR_HIGH_OBIT
|}

=== TSEC_FALCON_DMAINFO_CURRENT_FBRD_LOW ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_DMAINFO_CURRENT_FBRD_LOW_VAL
|}

=== TSEC_FALCON_DMAINFO_CURRENT_FBRD_HIGH ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-30
| TSEC_FALCON_DMAINFO_CURRENT_FBRD_HIGH_VAL
|-
| 31
| TSEC_FALCON_DMAINFO_CURRENT_FBRD_HIGH_OBIT
|}

=== TSEC_FALCON_DMAINFO_CURRENT_FBWR_LOW ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_DMAINFO_CURRENT_FBWR_LOW_VAL
|}

=== TSEC_FALCON_DMAINFO_CURRENT_FBWR_HIGH ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-30
| TSEC_FALCON_DMAINFO_CURRENT_FBWR_HIGH_VAL
|-
| 31
| TSEC_FALCON_DMAINFO_CURRENT_FBWR_HIGH_OBIT
|}

=== TSEC_FALCON_DMAINFO_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_DMAINFO_CTL_CLR_FBRD
|-
| 1
| TSEC_FALCON_DMAINFO_CTL_CLR_FBWR
|}

=== TSEC_SCP_CTL0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 10
| Enable the [[#LOAD|LOAD]] block's interface
|-
| 12
| Enable the [[#STORE|STORE]] block's interface
|-
| 14
| Enable the [[#CMD|CMD]] block's interface
|-
| 16
| Enable the [[#SEQ|SEQ]] block
|-
| 20
| Enable the [[#CTL|CTL]] block
|}

=== TSEC_SCP_CTL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Clear [[#SEQ|SEQ]] block's pipeline
|-
| 8
| Clear the main [[#SCP|SCP]] pipeline
|-
| 11
| Enable [[#RNG|RNG]] block's test mode
|-
| 12
| Enable the [[#RNG|RNG]] block
|-
| 16
| Enable [[#LOAD|LOAD]] block's interface dummy mode (all reads return 0)
|-
| 20
| Enable [[#LOAD|LOAD]] block's interface bypassing (all reads are dropped)
|-
| 24
| Enable [[#STORE|STORE]] block's interface bypassing (all writes are dropped)
|}

=== TSEC_SCP_CTL_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| TSEC_SCP_CTL_STAT_DEBUG_MODE
|}

=== TSEC_SCP_CTL_LOCK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Enable lockdown mode (locks IMEM and DMEM)
|-
| 1
| Unknown
|-
| 2
| Unknown
|-
| 3
| Unknown
|-
| 4
| Lock the [[#SCP|SCP]]
|-
| 5
| Unknown
|-
| 6
| Unknown
|-
| 7
| Unknown
|}

Controls lockdown mode and can only be cleared in Heavy Secure mode.

=== TSEC_SCP_CFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Unknown
|-
| 1
| Unknown
|-
| 2
| Unknown
|-
| 3
| Unknown
|-
| 4
| [[#AES|AES]] block's endianness
0: Little
1: Big
|-
| 8
| Flush [[#CMD|CMD]] block's pipeline
|-
| 12-13
| Carry chain size
0: 32 bits
1: 64 bits
2: 96 bits
3: 128 bits
|-
| 16-31
| Timeout value
|}

=== TSEC_SCP_CTL_SCP ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Swap [[#SCP|SCP]] master
|-
| 1
| Current [[#SCP|SCP]] master
0: Falcon
1: External
|}

=== TSEC_SCP_CTL_PKEY ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
|-
| 1
| TSEC_SCP_CTL_PKEY_LOADED
|}

=== TSEC_SCP_CTL_DBG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Unknown
|-
| 4
| Unknown
|-
| 8
| Unknown
|-
| 12
| Unknown
|}

=== TSEC_SCP_DBG0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Index
|-
| 4
| Auto-increment
|-
| 5-6
| Target
0: None
1: STORE
2: LOAD
3: SEQ
|-
| 8-12
| [[#SEQ|SEQ]] block's current sequence size
|-
| 13-16
| [[#SEQ|SEQ]] block's current instruction address
|-
| 17
| [[#SEQ|SEQ]] block's current instruction is valid
|-
| 18
| [[#SEQ|SEQ]] block is running in HS mode
|-
| 19-22
| [[#LOAD|LOAD]] block's pipeline size
|-
| 23
| [[#LOAD|LOAD]] block's current operation is valid
|-
| 24
| [[#LOAD|LOAD]] block is running in HS mode
|-
| 25-26
| [[#STORE|STORE]] block's pipeline size
|-
| 30
| [[#STORE|STORE]] block's current operation is valid
|-
| 31
| [[#STORE|STORE]] block is running in HS mode
|}

Used for debugging the [[#LOAD|LOAD]], [[#STORE|STORE]] and [[#SEQ|SEQ]] blocks.

=== TSEC_SCP_DBG1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| [[#SEQ|SEQ]] block's current instruction's first operand
|-
| 4-9
| [[#SEQ|SEQ]] block's current instruction's second operand
|-
| 10-14
| [[#SEQ|SEQ]] block's current instruction's opcode
|}

Used for retrieving debug data. Contains information on the last crypto sequence created when debugging the SEQ controller.

=== TSEC_SCP_DBG2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| [[#SEQ|SEQ]] block's state
0: Idle
1: Recording is active (cs0begin/cs1begin)
|-
| 4-7
| Number of [[#SEQ|SEQ]] block's instructions left
|-
| 12-15
| Active crypto key register
|}

Used for retrieving additional debug data associated with the [[#SEQ|SEQ]] block.

=== TSEC_SCP_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Destination register
|-
| 8-13
| Source register or immediate value
|-
| 20-24
| Command opcode
0x0: nop (fuc5 opcode 0x00)
0x1: cmov (fuc5 opcode 0x84)
0x2: cxsin (fuc5 opcode 0x88) or xdst (with cxset)
0x3: cxsout (fuc5 opcode 0x8C) or xdld (with cxset)
0x4: crnd (fuc5 opcode 0x90)
0x5: cs0begin (fuc5 opcode 0x94)
0x6: cs0exec (fuc5 opcode 0x98)
0x7: cs1begin (fuc5 opcode 0x9C)
0x8: cs1exec (fuc5 opcode 0xA0)
0x9: invalid (fuc5 opcode 0xA4)
0xA: cchmod (fuc5 opcode 0xA8)
0xB: cxor (fuc5 opcode 0xAC)
0xC: cadd (fuc5 opcode 0xB0)
0xD: cand (fuc5 opcode 0xB4)
0xE: crev (fuc5 opcode 0xB8)
0xF: cprecmac (fuc5 opcode 0xBC)
0x10: csecret (fuc5 opcode 0xC0)
0x11: ckeyreg (fuc5 opcode 0xC4)
0x12: ckexp (fuc5 opcode 0xC8)
0x13: ckrexp (fuc5 opcode 0xCC)
0x14: cenc (fuc5 opcode 0xD0)
0x15: cdec (fuc5 opcode 0xD4)
0x16: csigcmp (fuc5 opcode 0xD8)
0x17: csigenc (fuc5 opcode 0xDC)
0x18: csigclr (fuc5 opcode 0xE0)
|-
| 28
| [[#CMD|CMD]] block's current instruction is valid
|-
| 31
| [[#CMD|CMD]] block is running in HS mode
|}

Contains information on the last crypto command executed.

=== TSEC_SCP_STAT0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| [[#SCP|SCP]] is active
|-
| 2
| [[#CMD|CMD]] block's interface is active
|-
| 4
| [[#STORE|STORE]] block's interface is active
|-
| 6
| [[#SEQ|SEQ]] block is active
|-
| 8
| [[#CTL|CTL]] block is active
|-
| 10
| [[#LOAD|LOAD]] block's interface is active
|-
| 14
| [[#AES|AES]] block is active
|-
| 16
| [[#RNG|RNG]] block is active
|}

Contains the status of the hardware blocks and interfaces.

=== TSEC_SCP_STAT1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| Signature comparison result
0: None
1: Running
2: Failed
3: Succeeded
|-
| 4
| [[#LOAD|LOAD]] block's interface is running in HS mode
|-
| 6
| [[#LOAD|LOAD]] block's interface is ready
|-
| 8
| [[#STORE|STORE]] block's interface is running in HS mode
|-
| 10
| [[#STORE|STORE]] block's interface received a valid operation
|-
| 12
| [[#CMD|CMD]] block's interface is running in HS mode
|-
| 14
| [[#CMD|CMD]] block's interface received a valid instruction
|}

Contains the status of the last authentication attempt and other miscellaneous statuses.

=== TSEC_SCP_STAT2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-4
| Current [[#SEQ|SEQ]] block opcode
|-
| 5-9
| Current [[#CMD|CMD]] block's interface opcode
|-
| 10-14
| Pending [[#CMD|CMD]] block opcode
|-
| 15-16
| Current [[#AES|AES]] block operation
0: Encryption
1: Decryption
2: Key expansion
3: Key reverse expansion
|-
| 24
| Unknown
|-
| 25
| [[#STORE|STORE]] block is stalled
|-
| 26
| [[#LOAD|LOAD]] block is stalled
|-
| 27
| [[#RNG|RNG]] block is stalled
|-
| 28
| Unknown
|-
| 29
| [[#AES|AES]] block is stalled
|}

Contains the status of crypto operations.

=== TSEC_SCP_RNG_STAT0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| [[#RND|RND]] block is ready
|-
| 4-7
| Unknown
|-
| 8-11
| Unknown
|-
| 16
| Unknown
|-
| 20
| Unknown
|}

=== TSEC_SCP_RNG_STAT1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| Unknown
|-
| 16-31
| Unknown
|}

=== TSEC_SCP_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| [[#RND|RND]] ready
|-
| 8
| ACL error
|-
| 12
| SEC error
|-
| 16
| [[#CMD|CMD]] error
|-
| 20
| Single step
|-
| 24
| [[#RND|RND]] operation
|-
| 28
| Timeout
|}

Used for getting the status of crypto IRQs.

=== TSEC_SCP_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| [[#RND|RND]] ready
|-
| 8
| ACL error
|-
| 12
| SEC error
|-
| 16
| [[#CMD|CMD]] error
|-
| 20
| Single step
|-
| 24
| [[#RND|RND]] operation
|-
| 28
| Timeout
|}

Used for getting the value of the mask for crypto IRQs.

=== TSEC_SCP_ACL_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Writing to a crypto register without the correct ACL
|-
| 4
| Reading from a crypto register without the correct ACL
|-
| 8
| Invalid ACL change (cchmod)
|-
| 31
| ACL error occurred
|}

Contains information on errors generated by the [[#TSEC_SCP_IRQSTAT|ACL error]] IRQ.

=== TSEC_SCP_SEC_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Unknown
|-
| 1-2
| Unknown
|-
| 4
| Unknown
|-
| 5-6
| Unknown
|-
| 16
| Unknown
|-
| 17-18
| Unknown
|-
| 20
| Unknown
|-
| 21-22
| Unknown
|-
| 24
| Unknown
|-
| 25-26
| Unknown
|-
| 31
| SEC error occurred
|}

=== TSEC_SCP_CMD_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Invalid [[#CMD|CMD]] command
|-
| 4
| Empty [[#SEQ|SEQ]] sequence
|-
| 8
| [[#SEQ|SEQ]] sequence is too long
|-
| 12
| [[#SEQ|SEQ]] sequence was not finished
|-
| 16
| Forbidden signature operation (csigcmp, csigenc or csigclr in NS mode)
|-
| 20
| Invalid signature operation (csigcmp in HS mode)
|-
| 24
| Forbidden ACL change (cchmod in NS mode)
|}

Contains information on errors generated by the [[#TSEC_SCP_IRQSTAT|CMD error]] IRQ.

=== TSEC_SCP_RND_CTL0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| [[#RND|RND]] clock trigger lower limit
|}

=== TSEC_SCP_RND_CTL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| [[#RND|RND]] clock trigger upper limit
|-
| 16-31
| [[#RND|RND]] clock trigger mask
|}

=== TSEC_TFBIF_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_CTL_CLR_BWCOUNT
|-
| 1
| TSEC_TFBIF_CTL_ENABLE
|-
| 2
| TSEC_TFBIF_CTL_CLR_IDLEWDERR
|-
| 3
| TSEC_TFBIF_CTL_RESET
|-
| 4
| TSEC_TFBIF_CTL_IDLE
|-
| 5
| TSEC_TFBIF_CTL_IDLEWDERR
|-
| 6
| TSEC_TFBIF_CTL_SRTOUT
|-
| 7
| TSEC_TFBIF_CTL_CLR_SRTOUT
|-
| 8-11
| TSEC_TFBIF_CTL_SRTOVAL
|-
| 12
| TSEC_TFBIF_CTL_VPR
|}

=== TSEC_TFBIF_MCCIF_FIFOCTRL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
|-
| 1
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
|-
| 2
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
|-
| 3
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
|-
| 4
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
|-
| 5
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
|-
| 6
| TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
|-
| 7
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
|-
| 8
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE
|}

=== TSEC_TFBIF_THROTTLE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-11
| TSEC_TFBIF_THROTTLE_BUCKET_SIZE
|-
| 16-27
| TSEC_TFBIF_THROTTLE_LEAK_COUNT
|-
| 30-31
| TSEC_TFBIF_THROTTLE_LEAK_SIZE
|}

=== TSEC_TFBIF_DBG_STAT0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_DBG_STAT0_1K_TRANSFER
|-
| 1
| TSEC_TFBIF_DBG_STAT0_RREQ_ISSUED
|-
| 2
| TSEC_TFBIF_DBG_STAT0_WREQ_ISSUED
|-
| 3
| TSEC_TFBIF_DBG_STAT0_TAGQ_ISSUED
|-
| 4
| TSEC_TFBIF_DBG_STAT0_STALL_RDATQ
|-
| 5
| TSEC_TFBIF_DBG_STAT0_STALL_RACKQ
|-
| 6
| TSEC_TFBIF_DBG_STAT0_STALL_WREQQ
|-
| 7
| TSEC_TFBIF_DBG_STAT0_STALL_WDATQ
|-
| 8
| TSEC_TFBIF_DBG_STAT0_STALL_WACKQ
|-
| 9
| TSEC_TFBIF_DBG_STAT0_STALL_RREQ_PENDING
|-
| 10
| TSEC_TFBIF_DBG_STAT0_STALL_WREQ_PENDING
|-
| 11
| TSEC_TFBIF_DBG_STAT0_STALL_MREQ
|-
| 12
| TSEC_TFBIF_DBG_STAT0_ENGINE_IDLE
|-
| 13
| TSEC_TFBIF_DBG_STAT0_RMCCIF_IDLE
|-
| 14
| TSEC_TFBIF_DBG_STAT0_WMCCIF_IDLE
|-
| 15
| TSEC_TFBIF_DBG_STAT0_CSB_IDLE
|-
| 16
| TSEC_TFBIF_DBG_STAT0_RU_IDLE
|-
| 17
| TSEC_TFBIF_DBG_STAT0_WU_IDLE
|-
| 19
| TSEC_TFBIF_DBG_STAT0_UNWEIGHT_ACTMON_ACTIVE
|-
| 20
| TSEC_TFBIF_DBG_STAT0_UNWEIGHT_ACTMON_MCB
|}

=== TSEC_TFBIF_DBG_STAT1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_TFBIF_DBG_STAT1_DATA
|}

=== TSEC_TFBIF_DBG_RDCOUNT_LO ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_TFBIF_DBG_RDCOUNT_LO_DATA
|}

=== TSEC_TFBIF_DBG_RDCOUNT_HI ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_TFBIF_DBG_RDCOUNT_HI_DATA
|}

=== TSEC_TFBIF_DBG_WRCOUNT_LO ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_TFBIF_DBG_WRCOUNT_LO_DATA
|}

=== TSEC_TFBIF_DBG_WRCOUNT_HI ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_TFBIF_DBG_WRCOUNT_HI_DATA
|}

=== TSEC_TFBIF_DBG_R32COUNT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_TFBIF_DBG_R32COUNT_DATA
|}

=== TSEC_TFBIF_DBG_R64COUNT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_TFBIF_DBG_R64COUNT_DATA
|}

=== TSEC_TFBIF_DBG_R128COUNT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_TFBIF_DBG_R128COUNT_DATA
|}

=== TSEC_TFBIF_MCCIF_FIFOCTRL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
|-
| 16-31
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT
|}

=== TSEC_TFBIF_WRR_RDP ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_TFBIF_WRR_RDP_EXT_WEIGHT
|-
| 16-31
| TSEC_TFBIF_WRR_RDP_INT_WEIGHT
|}

=== TSEC_TFBIF_SPROT_EMEM ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Read access level
|-
| 4-7
| Write access level
|}

Controls accesses to external memory regions. Accessible in HS mode only.

=== TSEC_TFBIF_TRANSCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_TRANSCFG_ATT0_SWID
|-
| 4
| TSEC_TFBIF_TRANSCFG_ATT1_SWID
|-
| 8
| TSEC_TFBIF_TRANSCFG_ATT2_SWID
|-
| 12
| TSEC_TFBIF_TRANSCFG_ATT3_SWID
|-
| 16
| TSEC_TFBIF_TRANSCFG_ATT4_SWID
|-
| 20
| TSEC_TFBIF_TRANSCFG_ATT5_SWID
|-
| 24
| TSEC_TFBIF_TRANSCFG_ATT6_SWID
|-
| 28
| TSEC_TFBIF_TRANSCFG_ATT7_SWID
|}

Configures the software ID per CTXDMA port for memory transactions. Software ID 0 (HW_SWID) forces all transactions to go through the SMMU while software ID 1 (PHY_SWID) bypasses it. Accessible in HS mode only.

[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.

=== TSEC_TFBIF_REGIONCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-2
| TSEC_TFBIF_REGIONCFG_T0_APERT_ID
|-
| 3
| TSEC_TFBIF_REGIONCFG_T0_VPR
|-
| 4-6
| TSEC_TFBIF_REGIONCFG_T1_APERT_ID
|-
| 7
| TSEC_TFBIF_REGIONCFG_T1_VPR
|-
| 8-10
| TSEC_TFBIF_REGIONCFG_T2_APERT_ID
|-
| 11
| TSEC_TFBIF_REGIONCFG_T2_VPR
|-
| 12-14
| TSEC_TFBIF_REGIONCFG_T3_APERT_ID
|-
| 15
| TSEC_TFBIF_REGIONCFG_T3_VPR
|-
| 16-18
| TSEC_TFBIF_REGIONCFG_T4_APERT_ID
|-
| 19
| TSEC_TFBIF_REGIONCFG_T4_VPR
|-
| 20-22
| TSEC_TFBIF_REGIONCFG_T5_APERT_ID
|-
| 23
| TSEC_TFBIF_REGIONCFG_T5_VPR
|-
| 24-26
| TSEC_TFBIF_REGIONCFG_T6_APERT_ID
|-
| 27
| TSEC_TFBIF_REGIONCFG_T6_VPR
|-
| 28-30
| TSEC_TFBIF_REGIONCFG_T7_APERT_ID
|-
| 31
| TSEC_TFBIF_REGIONCFG_T7_VPR
|}

Configures the aperture ID and VPR mode per CTXDMA port for memory region accessing. Accessible in HS mode only.

[6.0.0+] The nvhost_tsec firmware sets this register to 0x20 or 0x140 before reading memory from the GPU UCODE carveout.

=== TSEC_TFBIF_ACTMON_ACTIVE_MASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_ACTMON_ACTIVE_MASK_STARVED_MC
|-
| 1
| TSEC_TFBIF_ACTMON_ACTIVE_MASK_STALLED_MC
|-
| 2
| TSEC_TFBIF_ACTMON_ACTIVE_MASK_DELAYED_MC
|-
| 3
| TSEC_TFBIF_ACTMON_ACTIVE_MASK_ACTIVE
|}

Takes the memory access mask for the Activity Monitor. Disconnected on the TSEC.

=== TSEC_TFBIF_ACTMON_ACTIVE_BORPS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_STARVED_MC_POLARITY
|-
| 1
| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_STARVED_MC_OPERATION
|-
| 2
| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_STALLED_MC_POLARITY
|-
| 3
| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_STALLED_MC_OPERATION
|-
| 4
| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_DELAYED_MC_POLARITY
|-
| 5
| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_DELAYED_MC_OPERATION
|-
| 6
| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_ACTIVE_POLARITY
|-
| 7
| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_ACTIVE_OPERATION
|}

Takes the billions of records per second count for the Activity Monitor. Disconnected on the TSEC.

=== TSEC_TFBIF_ACTMON_ACTIVE_WEIGHT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_TFBIF_ACTMON_ACTIVE_WEIGHT_VAL
|}

Controls the Activity Monitor. Disconnected on the TSEC.

=== TSEC_TFBIF_ACTMON_MCB_MASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_ACTMON_MCB_MASK_STARVED_MC
|-
| 1
| TSEC_TFBIF_ACTMON_MCB_MASK_STALLED_MC
|-
| 2
| TSEC_TFBIF_ACTMON_MCB_MASK_DELAYED_MC
|-
| 3
| TSEC_TFBIF_ACTMON_MCB_MASK_ACTIVE
|}

Disconnected on the TSEC.

=== TSEC_TFBIF_ACTMON_MCB_BORPS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_ACTMON_MCB_BORPS_STARVED_MC_POLARITY
|-
| 1
| TSEC_TFBIF_ACTMON_MCB_BORPS_STARVED_MC_OPERATION
|-
| 2
| TSEC_TFBIF_ACTMON_MCB_BORPS_STALLED_MC_POLARITY
|-
| 3
| TSEC_TFBIF_ACTMON_MCB_BORPS_STALLED_MC_OPERATION
|-
| 4
| TSEC_TFBIF_ACTMON_MCB_BORPS_DELAYED_MC_POLARITY
|-
| 5
| TSEC_TFBIF_ACTMON_MCB_BORPS_DELAYED_MC_OPERATION
|-
| 6
| TSEC_TFBIF_ACTMON_MCB_BORPS_ACTIVE_POLARITY
|-
| 7
| TSEC_TFBIF_ACTMON_MCB_BORPS_ACTIVE_OPERATION
|}

Disconnected on the TSEC.

=== TSEC_TFBIF_ACTMON_MCB_WEIGHT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_TFBIF_ACTMON_MCB_WEIGHT_VAL
|}

Disconnected on the TSEC.

=== TSEC_TFBIF_THI_TRANSPROP ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-6
| TSEC_TFBIF_THI_TRANSPROP_STREAMID0
|-
| 8-14
| TSEC_TFBIF_THI_TRANSPROP_STREAMID1
|-
| 16
| TSEC_TFBIF_THI_TRANSPROP_TZ_AUTH
|}

=== TSEC_CG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-5
| TSEC_CG_IDLE_CG_DLY_CNT
|-
| 6
| TSEC_CG_IDLE_CG_EN
|-
| 16-18
| TSEC_CG_WAKEUP_DLY_CNT
|-
| 19
| TSEC_CG_WAKEUP_DLY_EN
|}

=== TSEC_BAR0_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_BAR0_CTL_READ
|-
| 1
| TSEC_BAR0_CTL_WRITE
|-
| 4-7
| TSEC_BAR0_CTL_BYTE_MASK
|-
| 12-13
| TSEC_BAR0_CTL_STATUS
0: Idle
1: Busy
2: Error
3: Disabled
|-
| 16-17
| TSEC_BAR0_CTL_SEC_MODE
0: None
1: Invalid
2: Light Secure
3: Heavy Secure
|-
| 31
| TSEC_BAR0_CTL_INIT
|}

Controls DMA transfers between TSEC and HOST1X (master and clients).

Starting a transfer over BAR0 automatically sets TSEC_BAR0_CTL_SEC_MODE to the current Falcon security mode. Once set, any attempts to start a transfer from a lower security level will fail.

=== TSEC_BAR0_ADDR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_BAR0_ADDR_VAL
|}

Takes the address for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_BAR0_DATA ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_BAR0_DATA_VAL
|}

Takes the data for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_BAR0_TIMEOUT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_BAR0_TIMEOUT_VAL
|}

Takes the timeout value for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_TEGRA_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 16
| TSEC_TEGRA_CTL_TKFI_KFUSE
|-
| 17
| TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
|-
| 24
| TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
|-
| 25
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
|-
| 26
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
|-
| 27
| TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C
|}

== Falcon ==
"Falcon" (FAst Logic CONtroller) is a proprietary general purpose CPU which can be found inside various hardware blocks that require some sort of logic processing such as TSEC (TSECA and TSECB), NVDEC, NVENC, NVJPG, VIC, GPU PMU and XUSB.

=== Processor Registers ===
A total of 32 processor registers are available in the Falcon CPU.

==== REG0-REG15 ====
These are 16 32-bit GPRs (general purpose registers).

==== IV0 ====
This is a SPR (special purpose register) that holds the address for interrupt vector 0. Only bits 0 to 15 are used.

==== IV1 ====
This is a SPR (special purpose register) that holds the address for interrupt vector 1. Only bits 0 to 15 are used.

==== IV2 ====
This is a SPR (special purpose register) that holds the address for interrupt vector 2. This register is considered "UNDEFINED" and appears to be unused.

==== EV ====
This is a SPR (special purpose register) that holds the address for the exception vector. Only bits 0 to 15 are used.

Alternative name (envytools): "tv".

==== SP ====
This is a SPR (special purpose register) that holds the current stack pointer. Only bits 0 to 15 are used.

==== PC ====
This is a SPR (special purpose register) that holds the current program counter. Only bits 0 to 15 are used.

==== IMB ====
This is a SPR (special purpose register) that holds the external base address for IMEM transfers.

Alternative name (envytools): "xcbase".

==== DMB ====
This is a SPR (special purpose register) that holds the external base address for DMEM transfers.

Alternative name (envytools): "xdbase".

==== CSW ====
This is a SPR (special purpose register) that holds various flag bits.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7 || General purpose predicates
|-
| 8 || ALU carry flag
|-
| 9 || ALU signed overflow flag
|-
| 10 || ALU sign flag
|-
| 11 || ALU zero flag
|-
| 16 || Interrupt 0 enable
|-
| 17 || Interrupt 1 enable
|-
| 18 || Interrupt 2 enable (undefined)
|-
| 20 || Interrupt 0 saved enable
|-
| 21 || Interrupt 1 saved enable
|-
| 22 || Interrupt 2 saved enable (undefined)
|-
| 24 || Exception active
|-
| 26-31 || Unknown
|}

Alternative name (envytools): "flags".

==== CCR ====
This is a SPR (special purpose register) that holds configuration bits for the SCP DMA override functionality. The value of this register is set using the "cxset" instruction which provides a way to change the behavior of a variable amount of successively executed DMA-related instructions ("xdwait", "xdst" and "xdld").

{| class=wikitable
! Bits || Description
|-
| 0-4 || Number of instructions the override is valid for (0x1F means infinite)
|-
| 5 || Crypto source/destination select
0: Crypto register
1: Crypto stream
|-
| 6 || Bypass mode
0: Disabled
1: Enabled
|-
| 7 || Internal memory select
0: DMEM
1: IMEM
|}

Alternative name (envytools): "cx".

==== SEC ====
This is a SPR (special purpose register) that holds configuration bits for the SCP authentication process.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7 || Start of region to authenticate (in pages of 0x100 bytes)
|-
| 16 || Force secure DMA transfers
|-
| 17 || Decrypt region to authenticate
|-
| 18 || Signature check passed
|-
| 19 || Suppress interrupts and exceptions
|-
| 24-31 || Size of region to authenticate (in pages of 0x100 bytes)
|}

Alternative name (envytools): "cauth".

==== CTX ====
This is a SPR (special purpose register) that holds configuration bits for the CTXDMA ports.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-2 || CTXDMA port for code loads (xcld)
|-
| 4-6 || CTXDMA port for code stores (invalid)
|-
| 8-10 || CTXDMA port for data loads (xdld)
|-
| 12-14 || CTXDMA port for data stores (xdst)
|}

Alternative name (envytools): "xtargets".

==== EXCI ====
This is a SPR (special purpose register) that holds information on raised exceptions.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-19 || Exception PC
|-
| 20-23 || Exception cause
|}

Alternative name (envytools): "tstatus".

==== SEC1 ====
Unknown. Marked as "RESERVED".

==== IMB1 ====
Unknown. Marked as "RESERVED".

==== DMB1 ====
Unknown. Marked as "RESERVED".

=== Heavy Secure Mode ===
==== Entry ====
From non-secure mode, upon jumping to a page marked as secret, a secret fault occurs. This causes the CPU to verify the region specified in $cauth against the MAC loaded in $c6. If the comparison is successful, the valid bit (bit0) is set on all pages in the $cauth region, and $pc is set to the base of the $cauth region. If the comparsion fails, the CPU is halted.

==== Exit ====
The CPU automatically goes back to non-secure mode when returning back into non-secret pages. When this happens, the valid bit (bit0) in the TLB flags is cleared for all secret pages.

==== Implementation ====
Under certain circumstances, it is possible to observe [[#sigcmp|sigcmp]] being briefly written to [[#TSEC_SCP_CMD|TSEC_SCP_CMD]] as "csigcmp $c4 $c6" while the opcodes in [[#TSEC_SCP_STAT2|TSEC_SCP_STAT2]] are set to "cxsin" and "csigcmp", respectively.

Via [[#TSEC_SCP_DBG0|TSEC_SCP_DBG0]] it can be observed that a 3-sized macro sequence is loaded into cs0 during a secure mode transition.

== SCP ==
"SCP" (Secure Co-Processor) is a proprietary coprocessor which can be found inside every [[#Falcon|Falcon]] that supports [[#Heavy_Secure_Mode|Heavy Secure Mode]]. On the Tegra X1 these are TSECA, TSECB, NVDEC and the GPU's PMU.

=== Hardware ===
SCP is subdivided into several specialized hardware blocks and interfaces.

==== LOAD ====
Block for handling memory reads from SCP to Falcon. It communicates with Falcon over a dedicated interface.

The interface can be enabled or disabled by register [[#TSEC_SCP_CTL0|TSEC_SCP_CTL0]].

==== STORE ====
Block for handling memory writes from Falcon to SCP. It communicates with Falcon over a dedicated interface.

The interface can be enabled or disabled by register [[#TSEC_SCP_CTL0|TSEC_SCP_CTL0]].

==== CMD ====
Block for translating Falcon crypto operands into SCP commands. It communicates with Falcon over a dedicated interface.

The interface can be enabled or disabled by register [[#TSEC_SCP_CTL0|TSEC_SCP_CTL0]]. The status of the current command is reported through register [[#TSEC_SCP_CMD|TSEC_SCP_CMD]].

==== SEQ ====
Block for recording and executing sequences of crypto operations in the form of macros.

Can be enabled or disabled by register [[#TSEC_SCP_CTL0|TSEC_SCP_CTL0]].

==== CTL ====
Overseer block for controlling certain SCP features.

Can be enabled or disabled by register [[#TSEC_SCP_CTL0|TSEC_SCP_CTL0]].

Registers [[#TSEC_SCP_CTL_STAT|TSEC_SCP_CTL_STAT]], [[#TSEC_SCP_CTL_LOCK|TSEC_SCP_CTL_LOCK]], [[#TSEC_SCP_CTL_SCP|TSEC_SCP_CTL_SCP]], [[#TSEC_SCP_CTL_PKEY|TSEC_SCP_CTL_PKEY]] and [[#TSEC_SCP_CTL_DBG|TSEC_SCP_CTL_DBG]] refer to this block.

==== AES ====
Block for providing AES-128-ECB functionality.

==== RNG ====
Block for encapsulating and controlling the internal random number generator.

Can be enabled or disabled by register [[#TSEC_SCP_CTL1|TSEC_SCP_CTL1]] and reports the status of the internal random number generator through registers [[#TSEC_SCP_RNG_STAT0|TSEC_SCP_RNG_STAT0]] and [[#TSEC_SCP_RNG_STAT1|TSEC_SCP_RNG_STAT1]].

===== RND =====
Internal random number generator.

Can be configured by the [[#TSEC_SCP_RND_CTL0|TSEC_SCP_RND_CTLx]] registers.

=== Operations ===
{| class="wikitable" border="1"
! Opcode
! Name
! Operand0
! Operand1
! Operation
! Condition
|-
| 0 || nop || N/A || N/A || ||
|-
| 1 || mov || $cX || $cY || <code>$cX = $cY; ACL(X) = ACL(Y);</code> ||
|-
| 2 || sin || $cX || N/A || <code>$cX = read_stream(); ACL(X) = ???;</code> ||
|-
| 3 || sout || $cX || N/A || <code>write_stream($cX);</code> || ?
|-
| 4 || [[#rnd|rnd]] || $cX || N/A || <code>$cX = read_rnd(); ACL(X) = ???;</code> ||
|-
| 5 || s0begin || immX || N/A || <code>record_macro_for_N_instructions(0, immX);</code> ||
|-
| 6 || s0exec || immX || N/A || <code>execute_macro_N_times(0, immX);</code> ||
|-
| 7 || s1begin || immX || N/A || <code>record_macro_for_N_instructions(1, immX);</code> ||
|-
| 8 || s1exec || immX || N/A || <code>execute_macro_N_times(1, immX);</code> ||
|-
| 9 || <invalid> || || || ||
|-
| 0xA || [[#chmod|chmod]] || $cX || immY || Complicated, see [[#ACL|ACL]]. ||
|-
| 0xB || xor || $cX || $cY || <code>$cX ^= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xC || add || $cX || immY || <code>$cX += immY;</code> || <code>(ACL(X) & 2)</code>
|-
| 0xD || and || $cX || $cY || <code>$cX &= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xE || rev || $cX || $cY || <code>$cX = endian_swap128($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0xF || gfmul || $cX || $cY || <code>$cX = gfmul($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 2)</code>
|-
| 0x10 || secret || $cX || immY || <code>$cX = load_secret(immY); ACL(X) = load_secret_acl(immY);</code> ||
|-
| 0x11 || keyreg || $cX || N/A || <code>active_key_idx = $cX;</code> ||
|-
| 0x12 || kexp || $cX || $cY || <code>$cX = aes_kexp($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0x13 || krexp || $cX || $cY || <code>$cX = aes_kexp_reverse($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0x14 || enc || $cX || $cY || <code>$cX = aes_enc(active_key_idx, $cY); ACL(X) = ACL(active_key_idx) & ACL(Y);</code> ||
|-
| 0x15 || dec || $cX || $cY || <code>$cX = aes_dec(active_key_idx, $cY); ACL(X) = ACL(active_key_idx) & ACL(Y);</code> ||
|-
| 0x16 || [[#sigcmp|sigcmp]] || $cX || $cY || <code>if (hash_verify($cX, $cY)) { has_sig = true; current_sig = $cX; }</code> || ?
|-
| 0x17 || sigenc || $cX || $cY || <code>if (has_sig) { $cX = aes_enc($cY, current_sig); ACL(X) = 0x13; }</code> ||
|-
| 0x18 || [[#sigclr|sigclr]] || N/A || N/A || <code>has_sig = false;</code> ||
|}

==== sigcmp ====
<code>00000000: f5 3c XY d8 csigcmp $cY $cX</code>

Takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret. This instruction does not work in secure mode.

==== sigclr ====
<code>00000000: f5 3c 00 e0 csigclr</code>

This instruction takes no operands and clears the saved cauth signature used by the csigenc instruction.

==== chmod ====
<code>00000000: f5 3c XY a8 cchmod $cY 0X</code> or <code>00000000: f5 3c XY a9 cchmod $cY 1X</code>

This instruction takes a crypto register and a 5 bit immediate value which represents the [[#ACL|ACL]] mask to set.

==== rnd ====
<code>00000000: f5 3c 0X 90 crnd $cX</code>

This instruction initializes a crypto register with random data.

Executing this instruction only succeeds if the RNG controller is enabled for the SCP, which requires taking the following steps:
* Write 0x7FFF to [[#TSEC_SCP_RND_CTL0|TSEC_SCP_RND_CTL0]].
* Write 0x3FF0000 to [[#TSEC_SCP_RND_CTL1|TSEC_SCP_RND_CTL1]].
* Write 0xFF00 to TSEC_SCP_RND_CTL11.
* Write 0x1000 to [[#TSEC_SCP_CTL1|TSEC_SCP_CTL1]].

Otherwise it hangs forever.

=== ACLs ===
Each crypto register has an associated access control list with the following format:

{| class="wikitable" border="1"
! Bit
! Description
|-
| 0 || Secure key. Forced set if bit1 is set. Once cleared, cannot be set again.
|-
| 1 || Secure readable. Once cleared, cannot be set again.
|-
| 2 || Insecure key. Forced set if bit3 is set. Forced clear if bit0 is clear. Can be toggled back and forth.
|-
| 3 || Insecure readable. Forced clear if bit1 is clear. Can be toggled back and forth.
|-
| 4 || Insecure overwritable. Can be toggled back and forth.
|}

On boot, the ACL is 0x1F for all $cX.

Loading into $cX using xdst instruction sets ACL($cX) to 0x13 and 0x1F, for secure and insecure mode respectively.

Spilling a $cX to DMEM using xdld instruction is allowed if (ACL($cX) & 2) or (ACL($cX) & 8), for secure and insecure mode respectively.

Loading a secret into $cX sets a per-secret ACL, unconditionally.

=== Secrets ===
[[#Heavy_Secure_Mode|Heavy Secure Mode]] has access to 64 128-bit keys which are burned at factory. These keys can be loaded using the $csecret instruction which takes the target crypto register and the key index as arguments.

Secrets are specific to each Falcon unit with the exception of secret 0x3F. This secret is effectively empty (all zeros), but is configured to be overwritten with the KFUSE private key once the KFUSE clock is enabled. The KFUSE private key is console-unique.

{| class=wikitable
! Index || ACL || Description
|-
| 0x00 || 0x13 || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares.
|-
| 0x01 || 0x10 || Used by Falcon's Secure Boot ROM for the signature generation algorithm.
|-
| 0x02 || 0x10 ||
|-
| 0x03 || 0x11 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|-
| 0x04 || 0x10 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|-
| 0x05 || 0x13 || Used by nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares.
|-
| 0x06 || 0x11 || Used by Falcon's Secure Boot ROM as key to decrypt data during authentication (decided by bit 17 in the [[#SEC|SEC]] register).
|-
| 0x07 || 0x11 || Used by [6.0.0+] nvhost_tsec firmware.
|-
| 0x08 || 0x10 ||
|-
| 0x09 || 0x13 || Used by nvhost_tsec firmware.
|-
| 0x0A || 0x11 ||
|-
| 0x0B || 0x10 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|-
| 0x0C || 0x13 ||
|-
| 0x0D || 0x11 ||
|-
| 0x0E || 0x10 ||
|-
| 0x0F || 0x13 || Used by nvhost_tsec firmware.
|-
| 0x10 || 0x11 || Used by [1.0.0-5.1.0] nvhost_tsec firmware.
|-
| 0x11 || 0x10 ||
|-
| 0x12 || 0x13 ||
|-
| 0x13 || 0x11 ||
|-
| 0x14 || 0x10 ||
|-
| 0x15 || 0x13 || Used by nvhost_nvdec_bl020_prod, [5.0.0+] nvhost_nvdec020_prod, [5.0.0+] nvhost_nvdec020_ns and [6.0.0+] nvhost_tsec firmwares.
|-
| 0x16 || 0x11 ||
|-
| 0x17 || 0x10 ||
|-
| 0x18 || 0x13 ||
|-
| 0x19 || 0x11 ||
|-
| 0x1A || 0x10 ||
|-
| 0x1B || 0x13 ||
|-
| 0x1C || 0x11 ||
|-
| 0x1D || 0x10 ||
|-
| 0x1E || 0x13 ||
|-
| 0x1F || 0x11 ||
|-
| 0x20 || 0x10 ||
|-
| 0x21 || 0x13 ||
|-
| 0x22 || 0x11 ||
|-
| 0x23 || 0x10 ||
|-
| 0x24 || 0x13 ||
|-
| 0x25 || 0x11 ||
|-
| 0x26 || 0x10 || Used by [[TSEC_Firmware#KeygenLdr|KeygenLdr]] and [[TSEC_Firmware#SecureBoot|SecureBoot]]
|-
| 0x27 || 0x13 ||
|-
| 0x28 || 0x11 ||
|-
| 0x29 || 0x10 ||
|-
| 0x2A || 0x13 ||
|-
| 0x2B || 0x11 ||
|-
| 0x2C || 0x10 ||
|-
| 0x2D || 0x13 ||
|-
| 0x2E || 0x11 ||
|-
| 0x2F || 0x10 ||
|-
| 0x30 || 0x13 ||
|-
| 0x31 || 0x11 ||
|-
| 0x32 || 0x10 ||
|-
| 0x33 || 0x13 ||
|-
| 0x34 || 0x11 ||
|-
| 0x35 || 0x10 ||
|-
| 0x36 || 0x13 ||
|-
| 0x37 || 0x11 ||
|-
| 0x38 || 0x10 ||
|-
| 0x39 || 0x13 ||
|-
| 0x3A || 0x11 ||
|-
| 0x3B || 0x10 ||
|-
| 0x3C || 0x13 || Used by nvhost_tsec firmware.
|-
| 0x3D || 0x11 ||
|-
| 0x3E || 0x10 ||
|-
| 0x3F || 0x10 || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|}

TSEC

2020-09-05T15:13:05Z

Vale: Correct the crypto opcodes for sigenc and sigclr

TSEC (Tegra Security Co-processor) is a dedicated unit powered by a NVIDIA Falcon microprocessor with crypto extensions.

= Driver =
A host driver for communicating with the TSEC is mapped to physical address 0x54500000 with a total size of 0x40000 bytes and exposes several registers.

== Registers ==
The TSEC's MMIO space is divided as follows:
* 0x54500000 to 0x54501000: THI (Tegra Host Interface)
* 0x54501000 to 0x54501400: [[#Falcon|FALCON (Falcon microcontroller)]]
* 0x54501400 to 0x54501600: [[#SCP|SCP (Secure coprocessor)]]
* 0x54501600 to 0x54501680: TFBIF (Tegra Framebuffer Interface)
* 0x54501680 to 0x54501700: CG (Clock Gate)
* 0x54501700 to 0x54501800: BAR0 (HOST1X device DMA)
* 0x54501800 to 0x54501900: TEGRA (Miscellaneous interfaces)

{| class="wikitable" border="1"
! Name
! Address
! Width
|-
| [[#TSEC_THI_INCR_SYNCPT|TSEC_THI_INCR_SYNCPT]]
| 0x54500000
| 0x04
|-
| [[#TSEC_THI_INCR_SYNCPT_CTRL|TSEC_THI_INCR_SYNCPT_CTRL]]
| 0x54500004
| 0x04
|-
| [[#TSEC_THI_INCR_SYNCPT_ERR|TSEC_THI_INCR_SYNCPT_ERR]]
| 0x54500008
| 0x04
|-
| [[#TSEC_THI_CTXSW_INCR_SYNCPT|TSEC_THI_CTXSW_INCR_SYNCPT]]
| 0x5450000C
| 0x04
|-
| [[#TSEC_THI_CTXSW|TSEC_THI_CTXSW]]
| 0x54500020
| 0x04
|-
| [[#TSEC_THI_CTXSW_NEXT|TSEC_THI_CTXSW_NEXT]]
| 0x54500024
| 0x04
|-
| [[#TSEC_THI_CONT_SYNCPT_EOF|TSEC_THI_CONT_SYNCPT_EOF]]
| 0x54500028
| 0x04
|-
| [[#TSEC_THI_CONT_SYNCPT_L1|TSEC_THI_CONT_SYNCPT_L1]]
| 0x5450002C
| 0x04
|-
| [[#TSEC_THI_STREAMID0|TSEC_THI_STREAMID0]]
| 0x54500030
| 0x04
|-
| [[#TSEC_THI_STREAMID1|TSEC_THI_STREAMID1]]
| 0x54500034
| 0x04
|-
| [[#TSEC_THI_THI_SEC|TSEC_THI_THI_SEC]]
| 0x54500038
| 0x04
|-
| [[#TSEC_THI_METHOD0|TSEC_THI_METHOD0]]
| 0x54500040
| 0x04
|-
| [[#TSEC_THI_METHOD1|TSEC_THI_METHOD1]]
| 0x54500044
| 0x04
|-
| [[#TSEC_THI_CONTEXT_SWITCH|TSEC_THI_CONTEXT_SWITCH]]
| 0x54500060
| 0x04
|-
| [[#TSEC_THI_INT_STATUS|TSEC_THI_INT_STATUS]]
| 0x54500078
| 0x04
|-
| [[#TSEC_THI_INT_MASK|TSEC_THI_INT_MASK]]
| 0x5450007C
| 0x04
|-
| [[#TSEC_THI_CONFIG0|TSEC_THI_CONFIG0]]
| 0x54500080
| 0x04
|-
| [[#TSEC_THI_DBG_MISC|TSEC_THI_DBG_MISC]]
| 0x54500084
| 0x04
|-
| [[#TSEC_THI_SLCG_OVERRIDE_HIGH_A|TSEC_THI_SLCG_OVERRIDE_HIGH_A]]
| 0x54500088
| 0x04
|-
| [[#TSEC_THI_SLCG_OVERRIDE_LOW_A|TSEC_THI_SLCG_OVERRIDE_LOW_A]]
| 0x5450008C
| 0x04
|-
| [[#TSEC_THI_CLK_OVERRIDE|TSEC_THI_CLK_OVERRIDE]]
| 0x54500E00
| 0x04
|-
| [[#TSEC_FALCON_IRQSSET|TSEC_FALCON_IRQSSET]]
| 0x54501000
| 0x04
|-
| [[#TSEC_FALCON_IRQSCLR|TSEC_FALCON_IRQSCLR]]
| 0x54501004
| 0x04
|-
| [[#TSEC_FALCON_IRQSTAT|TSEC_FALCON_IRQSTAT]]
| 0x54501008
| 0x04
|-
| [[#TSEC_FALCON_IRQMODE|TSEC_FALCON_IRQMODE]]
| 0x5450100C
| 0x04
|-
| [[#TSEC_FALCON_IRQMSET|TSEC_FALCON_IRQMSET]]
| 0x54501010
| 0x04
|-
| [[#TSEC_FALCON_IRQMCLR|TSEC_FALCON_IRQMCLR]]
| 0x54501014
| 0x04
|-
| [[#TSEC_FALCON_IRQMASK|TSEC_FALCON_IRQMASK]]
| 0x54501018
| 0x04
|-
| [[#TSEC_FALCON_IRQDEST|TSEC_FALCON_IRQDEST]]
| 0x5450101C
| 0x04
|-
| [[#TSEC_FALCON_GPTMRINT|TSEC_FALCON_GPTMRINT]]
| 0x54501020
| 0x04
|-
| [[#TSEC_FALCON_GPTMRVAL|TSEC_FALCON_GPTMRVAL]]
| 0x54501024
| 0x04
|-
| [[#TSEC_FALCON_GPTMRCTL|TSEC_FALCON_GPTMRCTL]]
| 0x54501028
| 0x04
|-
| [[#TSEC_FALCON_PTIMER0|TSEC_FALCON_PTIMER0]]
| 0x5450102C
| 0x04
|-
| [[#TSEC_FALCON_PTIMER1|TSEC_FALCON_PTIMER1]]
| 0x54501030
| 0x04
|-
| [[#TSEC_FALCON_WDTMRVAL|TSEC_FALCON_WDTMRVAL]]
| 0x54501034
| 0x04
|-
| [[#TSEC_FALCON_WDTMRCTL|TSEC_FALCON_WDTMRCTL]]
| 0x54501038
| 0x04
|-
| [[#TSEC_FALCON_IRQDEST2|TSEC_FALCON_IRQDEST2]]
| 0x5450103C
| 0x04
|-
| [[#TSEC_FALCON_MAILBOX0|TSEC_FALCON_MAILBOX0]]
| 0x54501040
| 0x04
|-
| [[#TSEC_FALCON_MAILBOX1|TSEC_FALCON_MAILBOX1]]
| 0x54501044
| 0x04
|-
| [[#TSEC_FALCON_ITFEN|TSEC_FALCON_ITFEN]]
| 0x54501048
| 0x04
|-
| [[#TSEC_FALCON_IDLESTATE|TSEC_FALCON_IDLESTATE]]
| 0x5450104C
| 0x04
|-
| [[#TSEC_FALCON_CURCTX|TSEC_FALCON_CURCTX]]
| 0x54501050
| 0x04
|-
| [[#TSEC_FALCON_NXTCTX|TSEC_FALCON_NXTCTX]]
| 0x54501054
| 0x04
|-
| [[#TSEC_FALCON_CTXACK|TSEC_FALCON_CTXACK]]
| 0x54501058
| 0x04
|-
| [[#TSEC_FALCON_FHSTATE|TSEC_FALCON_FHSTATE]]
| 0x5450105C
| 0x04
|-
| [[#TSEC_FALCON_PRIVSTATE|TSEC_FALCON_PRIVSTATE]]
| 0x54501060
| 0x04
|-
| [[#TSEC_FALCON_MTHDDATA|TSEC_FALCON_MTHDDATA]]
| 0x54501064
| 0x04
|-
| [[#TSEC_FALCON_MTHDID|TSEC_FALCON_MTHDID]]
| 0x54501068
| 0x04
|-
| [[#TSEC_FALCON_MTHDWDAT|TSEC_FALCON_MTHDWDAT]]
| 0x5450106C
| 0x04
|-
| [[#TSEC_FALCON_MTHDCOUNT|TSEC_FALCON_MTHDCOUNT]]
| 0x54501070
| 0x04
|-
| [[#TSEC_FALCON_MTHDPOP|TSEC_FALCON_MTHDPOP]]
| 0x54501074
| 0x04
|-
| [[#TSEC_FALCON_MTHDRAMSZ|TSEC_FALCON_MTHDRAMSZ]]
| 0x54501078
| 0x04
|-
| [[#TSEC_FALCON_SFTRESET|TSEC_FALCON_SFTRESET]]
| 0x5450107C
| 0x04
|-
| [[#TSEC_FALCON_OS|TSEC_FALCON_OS]]
| 0x54501080
| 0x04
|-
| [[#TSEC_FALCON_RM|TSEC_FALCON_RM]]
| 0x54501084
| 0x04
|-
| [[#TSEC_FALCON_SOFT_PM|TSEC_FALCON_SOFT_PM]]
| 0x54501088
| 0x04
|-
| [[#TSEC_FALCON_SOFT_MODE|TSEC_FALCON_SOFT_MODE]]
| 0x5450108C
| 0x04
|-
| [[#TSEC_FALCON_DEBUG1|TSEC_FALCON_DEBUG1]]
| 0x54501090
| 0x04
|-
| [[#TSEC_FALCON_DEBUGINFO|TSEC_FALCON_DEBUGINFO]]
| 0x54501094
| 0x04
|-
| [[#TSEC_FALCON_IBRKPT1|TSEC_FALCON_IBRKPT1]]
| 0x54501098
| 0x04
|-
| [[#TSEC_FALCON_IBRKPT2|TSEC_FALCON_IBRKPT2]]
| 0x5450109C
| 0x04
|-
| [[#TSEC_FALCON_CGCTL|TSEC_FALCON_CGCTL]]
| 0x545010A0
| 0x04
|-
| [[#TSEC_FALCON_ENGCTL|TSEC_FALCON_ENGCTL]]
| 0x545010A4
| 0x04
|-
| [[#TSEC_FALCON_PMM|TSEC_FALCON_PMM]]
| 0x545010A8
| 0x04
|-
| [[#TSEC_FALCON_ADDR|TSEC_FALCON_ADDR]]
| 0x545010AC
| 0x04
|-
| [[#TSEC_FALCON_IBRKPT3|TSEC_FALCON_IBRKPT3]]
| 0x545010B0
| 0x04
|-
| [[#TSEC_FALCON_IBRKPT4|TSEC_FALCON_IBRKPT4]]
| 0x545010B4
| 0x04
|-
| [[#TSEC_FALCON_IBRKPT5|TSEC_FALCON_IBRKPT5]]
| 0x545010B8
| 0x04
|-
| [[#TSEC_FALCON_EXCI|TSEC_FALCON_EXCI]]
| 0x545010D0
| 0x04
|-
| [[#TSEC_FALCON_SVEC_SPR|TSEC_FALCON_SVEC_SPR]]
| 0x545010D4
| 0x04
|-
| [[#TSEC_FALCON_RSTAT0|TSEC_FALCON_RSTAT0]]
| 0x545010D8
| 0x04
|-
| [[#TSEC_FALCON_RSTAT3|TSEC_FALCON_RSTAT3]]
| 0x545010DC
| 0x04
|-
| TSEC_FALCON_UNK_E0
| 0x545010E0
| 0x04
|-
| [[#TSEC_FALCON_CPUCTL|TSEC_FALCON_CPUCTL]]
| 0x54501100
| 0x04
|-
| [[#TSEC_FALCON_BOOTVEC|TSEC_FALCON_BOOTVEC]]
| 0x54501104
| 0x04
|-
| [[#TSEC_FALCON_HWCFG|TSEC_FALCON_HWCFG]]
| 0x54501108
| 0x04
|-
| [[#TSEC_FALCON_DMACTL|TSEC_FALCON_DMACTL]]
| 0x5450110C
| 0x04
|-
| [[#TSEC_FALCON_DMATRFBASE|TSEC_FALCON_DMATRFBASE]]
| 0x54501110
| 0x04
|-
| [[#TSEC_FALCON_DMATRFMOFFS|TSEC_FALCON_DMATRFMOFFS]]
| 0x54501114
| 0x04
|-
| [[#TSEC_FALCON_DMATRFCMD|TSEC_FALCON_DMATRFCMD]]
| 0x54501118
| 0x04
|-
| [[#TSEC_FALCON_DMATRFFBOFFS|TSEC_FALCON_DMATRFFBOFFS]]
| 0x5450111C
| 0x04
|-
| [[#TSEC_FALCON_DMAPOLL_FB|TSEC_FALCON_DMAPOLL_FB]]
| 0x54501120
| 0x04
|-
| [[#TSEC_FALCON_DMAPOLL_CP|TSEC_FALCON_DMAPOLL_CP]]
| 0x54501124
| 0x04
|-
| [[#TSEC_FALCON_HWCFG1|TSEC_FALCON_HWCFG1]]
| 0x5450112C
| 0x04
|-
| [[#TSEC_FALCON_CPUCTL_ALIAS|TSEC_FALCON_CPUCTL_ALIAS]]
| 0x54501130
| 0x04
|-
| [[#TSEC_FALCON_STACKCFG|TSEC_FALCON_STACKCFG]]
| 0x54501138
| 0x04
|-
| [[#TSEC_FALCON_IMCTL|TSEC_FALCON_IMCTL]]
| 0x54501140
| 0x04
|-
| [[#TSEC_FALCON_IMSTAT|TSEC_FALCON_IMSTAT]]
| 0x54501144
| 0x04
|-
| [[#TSEC_FALCON_TRACEIDX|TSEC_FALCON_TRACEIDX]]
| 0x54501148
| 0x04
|-
| [[#TSEC_FALCON_TRACEPC|TSEC_FALCON_TRACEPC]]
| 0x5450114C
| 0x04
|-
| [[#TSEC_FALCON_IMFILLRNG0|TSEC_FALCON_IMFILLRNG0]]
| 0x54501150
| 0x04
|-
| [[#TSEC_FALCON_IMFILLRNG1|TSEC_FALCON_IMFILLRNG1]]
| 0x54501154
| 0x04
|-
| [[#TSEC_FALCON_IMFILLCTL|TSEC_FALCON_IMFILLCTL]]
| 0x54501158
| 0x04
|-
| [[#TSEC_FALCON_IMCTL_DEBUG|TSEC_FALCON_IMCTL_DEBUG]]
| 0x5450115C
| 0x04
|-
| [[#TSEC_FALCON_CMEMBASE|TSEC_FALCON_CMEMBASE]]
| 0x54501160
| 0x04
|-
| [[#TSEC_FALCON_DMEMAPERT|TSEC_FALCON_DMEMAPERT]]
| 0x54501164
| 0x04
|-
| [[#TSEC_FALCON_EXTERRADDR|TSEC_FALCON_EXTERRADDR]]
| 0x54501168
| 0x04
|-
| [[#TSEC_FALCON_EXTERRSTAT|TSEC_FALCON_EXTERRSTAT]]
| 0x5450116C
| 0x04
|-
| [[#TSEC_FALCON_CG2|TSEC_FALCON_CG2]]
| 0x5450117C
| 0x04
|-
| [[#TSEC_FALCON_IMEMC|TSEC_FALCON_IMEMC0]]
| 0x54501180
| 0x04
|-
| [[#TSEC_FALCON_IMEMD|TSEC_FALCON_IMEMD0]]
| 0x54501184
| 0x04
|-
| [[#TSEC_FALCON_IMEMT|TSEC_FALCON_IMEMT0]]
| 0x54501188
| 0x04
|-
| [[#TSEC_FALCON_IMEMC|TSEC_FALCON_IMEMC1]]
| 0x54501190
| 0x04
|-
| [[#TSEC_FALCON_IMEMD|TSEC_FALCON_IMEMD1]]
| 0x54501194
| 0x04
|-
| [[#TSEC_FALCON_IMEMT|TSEC_FALCON_IMEMT1]]
| 0x54501198
| 0x04
|-
| [[#TSEC_FALCON_IMEMC|TSEC_FALCON_IMEMC2]]
| 0x545011A0
| 0x04
|-
| [[#TSEC_FALCON_IMEMD|TSEC_FALCON_IMEMD2]]
| 0x545011A4
| 0x04
|-
| [[#TSEC_FALCON_IMEMT|TSEC_FALCON_IMEMT2]]
| 0x545011A8
| 0x04
|-
| [[#TSEC_FALCON_IMEMC|TSEC_FALCON_IMEMC3]]
| 0x545011B0
| 0x04
|-
| [[#TSEC_FALCON_IMEMD|TSEC_FALCON_IMEMD3]]
| 0x545011B4
| 0x04
|-
| [[#TSEC_FALCON_IMEMT|TSEC_FALCON_IMEMT3]]
| 0x545011B8
| 0x04
|-
| [[#TSEC_FALCON_DMEMC|TSEC_FALCON_DMEMC0]]
| 0x545011C0
| 0x04
|-
| [[#TSEC_FALCON_DMEMD|TSEC_FALCON_DMEMD0]]
| 0x545011C4
| 0x04
|-
| [[#TSEC_FALCON_DMEMC|TSEC_FALCON_DMEMC1]]
| 0x545011C8
| 0x04
|-
| [[#TSEC_FALCON_DMEMD|TSEC_FALCON_DMEMD1]]
| 0x545011CC
| 0x04
|-
| [[#TSEC_FALCON_DMEMC|TSEC_FALCON_DMEMC2]]
| 0x545011D0
| 0x04
|-
| [[#TSEC_FALCON_DMEMD|TSEC_FALCON_DMEMD2]]
| 0x545011D4
| 0x04
|-
| [[#TSEC_FALCON_DMEMC|TSEC_FALCON_DMEMC3]]
| 0x545011D8
| 0x04
|-
| [[#TSEC_FALCON_DMEMD|TSEC_FALCON_DMEMD3]]
| 0x545011DC
| 0x04
|-
| [[#TSEC_FALCON_DMEMC|TSEC_FALCON_DMEMC4]]
| 0x545011E0
| 0x04
|-
| [[#TSEC_FALCON_DMEMD|TSEC_FALCON_DMEMD4]]
| 0x545011E4
| 0x04
|-
| [[#TSEC_FALCON_DMEMC|TSEC_FALCON_DMEMC5]]
| 0x545011E8
| 0x04
|-
| [[#TSEC_FALCON_DMEMD|TSEC_FALCON_DMEMD5]]
| 0x545011EC
| 0x04
|-
| [[#TSEC_FALCON_DMEMC|TSEC_FALCON_DMEMC6]]
| 0x545011F0
| 0x04
|-
| [[#TSEC_FALCON_DMEMD|TSEC_FALCON_DMEMD6]]
| 0x545011F4
| 0x04
|-
| [[#TSEC_FALCON_DMEMC|TSEC_FALCON_DMEMC7]]
| 0x545011F8
| 0x04
|-
| [[#TSEC_FALCON_DMEMD|TSEC_FALCON_DMEMD7]]
| 0x545011FC
| 0x04
|-
| [[#TSEC_FALCON_ICD_CMD|TSEC_FALCON_ICD_CMD]]
| 0x54501200
| 0x04
|-
| [[#TSEC_FALCON_ICD_ADDR|TSEC_FALCON_ICD_ADDR]]
| 0x54501204
| 0x04
|-
| [[#TSEC_FALCON_ICD_WDATA|TSEC_FALCON_ICD_WDATA]]
| 0x54501208
| 0x04
|-
| [[#TSEC_FALCON_ICD_RDATA|TSEC_FALCON_ICD_RDATA]]
| 0x5450120C
| 0x04
|-
| [[#TSEC_FALCON_SCTL|TSEC_FALCON_SCTL]]
| 0x54501240
| 0x04
|-
| [[#TSEC_FALCON_SSTAT|TSEC_FALCON_SSTAT]]
| 0x54501244
| 0x04
|-
| TSEC_FALCON_UNK_250
| 0x54501250
| 0x04
|-
| TSEC_FALCON_UNK_260
| 0x54501260
| 0x04
|-
| [[#TSEC_FALCON_SPROT_IMEM|TSEC_FALCON_SPROT_IMEM]]
| 0x54501280
| 0x04
|-
| [[#TSEC_FALCON_SPROT_DMEM|TSEC_FALCON_SPROT_DMEM]]
| 0x54501284
| 0x04
|-
| [[#TSEC_FALCON_SPROT_CPUCTL|TSEC_FALCON_SPROT_CPUCTL]]
| 0x54501288
| 0x04
|-
| [[#TSEC_FALCON_SPROT_MISC|TSEC_FALCON_SPROT_MISC]]
| 0x5450128C
| 0x04
|-
| [[#TSEC_FALCON_SPROT_IRQ|TSEC_FALCON_SPROT_IRQ]]
| 0x54501290
| 0x04
|-
| [[#TSEC_FALCON_SPROT_MTHD|TSEC_FALCON_SPROT_MTHD]]
| 0x54501294
| 0x04
|-
| [[#TSEC_FALCON_SPROT_SCTL|TSEC_FALCON_SPROT_SCTL]]
| 0x54501298
| 0x04
|-
| [[#TSEC_FALCON_SPROT_WDTMR|TSEC_FALCON_SPROT_WDTMR]]
| 0x5450129C
| 0x04
|-
| [[#TSEC_FALCON_DMAINFO_FINISHED_FBRD_LOW|TSEC_FALCON_DMAINFO_FINISHED_FBRD_LOW]]
| 0x545012C0
| 0x04
|-
| [[#TSEC_FALCON_DMAINFO_FINISHED_FBRD_HIGH|TSEC_FALCON_DMAINFO_FINISHED_FBRD_HIGH]]
| 0x545012C4
| 0x04
|-
| [[#TSEC_FALCON_DMAINFO_FINISHED_FBWR_LOW|TSEC_FALCON_DMAINFO_FINISHED_FBWR_LOW]]
| 0x545012C8
| 0x04
|-
| [[#TSEC_FALCON_DMAINFO_FINISHED_FBWR_HIGH|TSEC_FALCON_DMAINFO_FINISHED_FBWR_HIGH]]
| 0x545012CC
| 0x04
|-
| [[#TSEC_FALCON_DMAINFO_CURRENT_FBRD_LOW|TSEC_FALCON_DMAINFO_CURRENT_FBRD_LOW]]
| 0x545012D0
| 0x04
|-
| [[#TSEC_FALCON_DMAINFO_CURRENT_FBRD_HIGH|TSEC_FALCON_DMAINFO_CURRENT_FBRD_HIGH]]
| 0x545012D4
| 0x04
|-
| [[#TSEC_FALCON_DMAINFO_CURRENT_FBWR_LOW|TSEC_FALCON_DMAINFO_CURRENT_FBWR_LOW]]
| 0x545012D8
| 0x04
|-
| [[#TSEC_FALCON_DMAINFO_CURRENT_FBWR_HIGH|TSEC_FALCON_DMAINFO_CURRENT_FBWR_HIGH]]
| 0x545012DC
| 0x04
|-
| [[#TSEC_FALCON_DMAINFO_CTL|TSEC_FALCON_DMAINFO_CTL]]
| 0x545012E0
| 0x04
|-
| [[#TSEC_SCP_CTL0|TSEC_SCP_CTL0]]
| 0x54501400
| 0x04
|-
| [[#TSEC_SCP_CTL1|TSEC_SCP_CTL1]]
| 0x54501404
| 0x04
|-
| [[#TSEC_SCP_CTL_STAT|TSEC_SCP_CTL_STAT]]
| 0x54501408
| 0x04
|-
| [[#TSEC_SCP_CTL_LOCK|TSEC_SCP_CTL_LOCK]]
| 0x5450140C
| 0x04
|-
| [[#TSEC_SCP_CFG|TSEC_SCP_CFG]]
| 0x54501410
| 0x04
|-
| [[#TSEC_SCP_CTL_SCP|TSEC_SCP_CTL_SCP]]
| 0x54501414
| 0x04
|-
| [[#TSEC_SCP_CTL_PKEY|TSEC_SCP_CTL_PKEY]]
| 0x54501418
| 0x04
|-
| [[#TSEC_SCP_CTL_DBG|TSEC_SCP_CTL_DBG]]
| 0x5450141C
| 0x04
|-
| [[#TSEC_SCP_DBG0|TSEC_SCP_DBG0]]
| 0x54501420
| 0x04
|-
| [[#TSEC_SCP_DBG1|TSEC_SCP_DBG1]]
| 0x54501424
| 0x04
|-
| [[#TSEC_SCP_DBG2|TSEC_SCP_DBG2]]
| 0x54501428
| 0x04
|-
| [[#TSEC_SCP_CMD|TSEC_SCP_CMD]]
| 0x54501430
| 0x04
|-
| [[#TSEC_SCP_STAT0|TSEC_SCP_STAT0]]
| 0x54501450
| 0x04
|-
| [[#TSEC_SCP_STAT1|TSEC_SCP_STAT1]]
| 0x54501454
| 0x04
|-
| [[#TSEC_SCP_STAT2|TSEC_SCP_STAT2]]
| 0x54501458
| 0x04
|-
| [[#TSEC_SCP_RNG_STAT0|TSEC_SCP_RNG_STAT0]]
| 0x54501470
| 0x04
|-
| [[#TSEC_SCP_RNG_STAT1|TSEC_SCP_RNG_STAT1]]
| 0x54501474
| 0x04
|-
| [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT]]
| 0x54501480
| 0x04
|-
| [[#TSEC_SCP_IRQMASK|TSEC_SCP_IRQMASK]]
| 0x54501484
| 0x04
|-
| [[#TSEC_SCP_ACL_ERR|TSEC_SCP_ACL_ERR]]
| 0x54501490
| 0x04
|-
| [[#TSEC_SCP_SEC_ERR|TSEC_SCP_SEC_ERR]]
| 0x54501494
| 0x04
|-
| [[#TSEC_SCP_CMD_ERR|TSEC_SCP_CMD_ERR]]
| 0x54501498
| 0x04
|-
| [[#TSEC_SCP_RND_CTL0|TSEC_SCP_RND_CTL0]]
| 0x54501500
| 0x04
|-
| [[#TSEC_SCP_RND_CTL1|TSEC_SCP_RND_CTL1]]
| 0x54501504
| 0x04
|-
| TSEC_SCP_RND_CTL2
| 0x54501508
| 0x04
|-
| TSEC_SCP_RND_CTL3
| 0x5450150C
| 0x04
|-
| TSEC_SCP_RND_CTL4
| 0x54501510
| 0x04
|-
| TSEC_SCP_RND_CTL5
| 0x54501514
| 0x04
|-
| TSEC_SCP_RND_CTL6
| 0x54501518
| 0x04
|-
| TSEC_SCP_RND_CTL7
| 0x5450151C
| 0x04
|-
| TSEC_SCP_RND_CTL8
| 0x54501520
| 0x04
|-
| TSEC_SCP_RND_CTL9
| 0x54501524
| 0x04
|-
| TSEC_SCP_RND_CTL10
| 0x54501528
| 0x04
|-
| TSEC_SCP_RND_CTL11
| 0x5450152C
| 0x04
|-
| [[#TSEC_TFBIF_CTL|TSEC_TFBIF_CTL]]
| 0x54501600
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL|TSEC_TFBIF_MCCIF_FIFOCTRL]]
| 0x54501604
| 0x04
|-
| [[#TSEC_TFBIF_THROTTLE|TSEC_TFBIF_THROTTLE]]
| 0x54501608
| 0x04
|-
| [[#TSEC_TFBIF_DBG_STAT0|TSEC_TFBIF_DBG_STAT0]]
| 0x5450160C
| 0x04
|-
| [[#TSEC_TFBIF_DBG_STAT1|TSEC_TFBIF_DBG_STAT1]]
| 0x54501610
| 0x04
|-
| [[#TSEC_TFBIF_DBG_RDCOUNT_LO|TSEC_TFBIF_DBG_RDCOUNT_LO]]
| 0x54501614
| 0x04
|-
| [[#TSEC_TFBIF_DBG_RDCOUNT_HI|TSEC_TFBIF_DBG_RDCOUNT_HI]]
| 0x54501618
| 0x04
|-
| [[#TSEC_TFBIF_DBG_WRCOUNT_LO|TSEC_TFBIF_DBG_WRCOUNT_LO]]
| 0x5450161C
| 0x04
|-
| [[#TSEC_TFBIF_DBG_WRCOUNT_HI|TSEC_TFBIF_DBG_WRCOUNT_HI]]
| 0x54501620
| 0x04
|-
| [[#TSEC_TFBIF_DBG_R32COUNT|TSEC_TFBIF_DBG_R32COUNT]]
| 0x54501624
| 0x04
|-
| [[#TSEC_TFBIF_DBG_R64COUNT|TSEC_TFBIF_DBG_R64COUNT]]
| 0x54501628
| 0x04
|-
| [[#TSEC_TFBIF_DBG_R128COUNT|TSEC_TFBIF_DBG_R128COUNT]]
| 0x5450162C
| 0x04
|-
| TSEC_TFBIF_UNK_30
| 0x54501630
| 0x04
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL1|TSEC_TFBIF_MCCIF_FIFOCTRL1]]
| 0x54501634
| 0x04
|-
| [[#TSEC_TFBIF_WRR_RDP|TSEC_TFBIF_WRR_RDP]]
| 0x54501638
| 0x04
|-
| [[#TSEC_TFBIF_SPROT_EMEM|TSEC_TFBIF_SPROT_EMEM]]
| 0x54501640
| 0x04
|-
| [[#TSEC_TFBIF_TRANSCFG|TSEC_TFBIF_TRANSCFG]]
| 0x54501644
| 0x04
|-
| [[#TSEC_TFBIF_REGIONCFG|TSEC_TFBIF_REGIONCFG]]
| 0x54501648
| 0x04
|-
| [[#TSEC_TFBIF_ACTMON_ACTIVE_MASK|TSEC_TFBIF_ACTMON_ACTIVE_MASK]]
| 0x5450164C
| 0x04
|-
| [[#TSEC_TFBIF_ACTMON_ACTIVE_BORPS|TSEC_TFBIF_ACTMON_ACTIVE_BORPS]]
| 0x54501650
| 0x04
|-
| [[#TSEC_TFBIF_ACTMON_ACTIVE_WEIGHT|TSEC_TFBIF_ACTMON_ACTIVE_WEIGHT]]
| 0x54501654
| 0x04
|-
| [[#TSEC_TFBIF_ACTMON_MCB_MASK|TSEC_TFBIF_ACTMON_MCB_MASK]]
| 0x54501660
| 0x04
|-
| [[#TSEC_TFBIF_ACTMON_MCB_BORPS|TSEC_TFBIF_ACTMON_MCB_BORPS]]
| 0x54501664
| 0x04
|-
| [[#TSEC_TFBIF_ACTMON_MCB_WEIGHT|TSEC_TFBIF_ACTMON_MCB_WEIGHT]]
| 0x54501668
| 0x04
|-
| [[#TSEC_TFBIF_THI_TRANSPROP|TSEC_TFBIF_THI_TRANSPROP]]
| 0x54501670
| 0x04
|-
| [[#TSEC_CG|TSEC_CG]]
| 0x545016D0
| 0x04
|-
| [[#TSEC_BAR0_CTL|TSEC_BAR0_CTL]]
| 0x54501700
| 0x04
|-
| [[#TSEC_BAR0_ADDR|TSEC_BAR0_ADDR]]
| 0x54501704
| 0x04
|-
| [[#TSEC_BAR0_DATA|TSEC_BAR0_DATA]]
| 0x54501708
| 0x04
|-
| [[#TSEC_BAR0_TIMEOUT|TSEC_BAR0_TIMEOUT]]
| 0x5450170C
| 0x04
|-
| TSEC_TEGRA_UNK_00
| 0x54501800
| 0x04
|-
| TSEC_TEGRA_UNK_04
| 0x54501804
| 0x04
|-
| TSEC_TEGRA_UNK_08
| 0x54501808
| 0x04
|-
| TSEC_TEGRA_UNK_0C
| 0x5450180C
| 0x04
|-
| TSEC_TEGRA_UNK_10
| 0x54501810
| 0x04
|-
| TSEC_TEGRA_UNK_14
| 0x54501814
| 0x04
|-
| TSEC_TEGRA_UNK_18
| 0x54501818
| 0x04
|-
| TSEC_TEGRA_UNK_1C
| 0x5450181C
| 0x04
|-
| TSEC_TEGRA_UNK_20
| 0x54501820
| 0x04
|-
| TSEC_TEGRA_UNK_24
| 0x54501824
| 0x04
|-
| TSEC_TEGRA_UNK_28
| 0x54501828
| 0x04
|-
| TSEC_TEGRA_UNK_2C
| 0x5450182C
| 0x04
|-
| TSEC_TEGRA_UNK_30
| 0x54501830
| 0x04
|-
| TSEC_TEGRA_UNK_34
| 0x54501834
| 0x04
|-
| [[#TSEC_TEGRA_CTL|TSEC_TEGRA_CTL]]
| 0x54501838
| 0x04
|}

=== TSEC_THI_INCR_SYNCPT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-9
| TSEC_THI_INCR_SYNCPT_INDX
|-
| 10-17
| TSEC_THI_INCR_SYNCPT_COND
|}

=== TSEC_THI_INCR_SYNCPT_CTRL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INCR_SYNCPT_CTRL_SOFT_RESET
|-
| 8
| TSEC_THI_INCR_SYNCPT_CTRL_NO_STALL
|-
| 16
| TSEC_THI_INCR_SYNCPT_CTRL_SOFT_RESET_0
|-
| 17
| TSEC_THI_INCR_SYNCPT_CTRL_NO_STALL_0
|-
| 18
| TSEC_THI_INCR_SYNCPT_CTRL_SOFT_RESET_1
|-
| 19
| TSEC_THI_INCR_SYNCPT_CTRL_NO_STALL_1
|-
| 20
| TSEC_THI_INCR_SYNCPT_CTRL_SOFT_RESET_2
|-
| 21
| TSEC_THI_INCR_SYNCPT_CTRL_NO_STALL_2
|-
| 22
| TSEC_THI_INCR_SYNCPT_CTRL_SOFT_RESET_3
|-
| 23
| TSEC_THI_INCR_SYNCPT_CTRL_NO_STALL_3
|-
| 24
| TSEC_THI_INCR_SYNCPT_CTRL_SOFT_RESET_4
|-
| 25
| TSEC_THI_INCR_SYNCPT_CTRL_NO_STALL_4
|}

=== TSEC_THI_INCR_SYNCPT_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INCR_SYNCPT_ERR_COND_STS_IMM
|-
| 1
| TSEC_THI_INCR_SYNCPT_ERR_COND_STS_OPDONE
|-
| 2
| TSEC_THI_INCR_SYNCPT_ERR_COND_STS_RD_DONE
|-
| 3
| TSEC_THI_INCR_SYNCPT_ERR_COND_STS_REG_WR_SAFE
|-
| 4
| TSEC_THI_INCR_SYNCPT_ERR_COND_STS_ENGINE_IDLE
|}

=== TSEC_THI_CTXSW_INCR_SYNCPT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-9
| TSEC_THI_CTXSW_INCR_SYNCPT_INDX
|}

=== TSEC_THI_CTXSW ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-9
| TSEC_THI_CTXSW_CURR_CLASS
|-
| 10
| TSEC_THI_CTXSW_AUTO_ACK
|-
| 11-20
| TSEC_THI_CTXSW_CURR_CHANNEL
|}

=== TSEC_THI_CTXSW_NEXT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-9
| TSEC_THI_CTXSW_NEXT_NEXT_CLASS
|-
| 10-19
| TSEC_THI_CTXSW_NEXT_NEXT_CHANNEL
|}

=== TSEC_THI_CONT_SYNCPT_EOF ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-9
| TSEC_THI_CONT_SYNCPT_EOF_INDEX
|-
| 10
| TSEC_THI_CONT_SYNCPT_EOF_COND
|}

=== TSEC_THI_CONT_SYNCPT_L1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-9
| TSEC_THI_CONT_SYNCPT_L1_INDEX
|-
| 10
| TSEC_THI_CONT_SYNCPT_L1_COND
|}

=== TSEC_THI_STREAMID0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-6
| TSEC_THI_STREAMID0_ID
|}

=== TSEC_THI_STREAMID1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-6
| TSEC_THI_STREAMID1_ID
|}

=== TSEC_THI_THI_SEC ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_THI_SEC_TZ_LOCK
|-
| 4
| TSEC_THI_THI_SEC_TZ_AUTH
|-
| 8
| TSEC_THI_THI_SEC_CH_LOCK
|}

=== TSEC_THI_METHOD0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-11
| TSEC_THI_METHOD0_OFFSET
|}

Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

The following methods are available:
{| class="wikitable" border="1"
! ID
! Method
|-
| 0x100
| NOP
|-
| 0x140
| PM_TRIGGER
|-
| 0x200
| SET_APPLICATION_ID
|-
| 0x204
| SET_WATCHDOG_TIMER
|-
| 0x240
| SEMAPHORE_A
|-
| 0x244
| SEMAPHORE_B
|-
| 0x248
| SEMAPHORE_C
|-
| 0x24C
|
|-
| 0x250
|
|-
| 0x300
| EXECUTE
|-
| 0x304
| SEMAPHORE_D
|-
| 0x500
| HDCP_INIT
|-
| 0x504
| HDCP_CREATE_SESSION
|-
| 0x508
| HDCP_VERIFY_CERT_RX
|-
| 0x50C
| HDCP_GENERATE_EKM
|-
| 0x510
| HDCP_REVOCATION_CHECK
|-
| 0x514
| HDCP_VERIFY_HPRIME
|-
| 0x518
| HDCP_ENCRYPT_PAIRING_INFO
|-
| 0x51C
| HDCP_DECRYPT_PAIRING_INFO
|-
| 0x520
| HDCP_UPDATE_SESSION
|-
| 0x524
| HDCP_GENERATE_LC_INIT
|-
| 0x528
| HDCP_VERIFY_LPRIME
|-
| 0x52C
| HDCP_GENERATE_SKE_INIT
|-
| 0x530
| HDCP_VERIFY_VPRIME
|-
| 0x534
| HDCP_ENCRYPTION_RUN_CTRL
|-
| 0x538
| HDCP_SESSION_CTRL
|-
| 0x53C
| HDCP_COMPUTE_SPRIME
|-
| 0x540
| HDCP_GET_CERT_RX
|-
| 0x544
| HDCP_EXCHANGE_INFO
|-
| 0x548
| HDCP_DECRYPT_KM
|-
| 0x54C
| HDCP_GET_HPRIME
|-
| 0x550
| HDCP_GENERATE_EKH_KM
|-
| 0x554
| HDCP_VERIFY_RTT_CHALLENGE
|-
| 0x558
| HDCP_GET_LPRIME
|-
| 0x55C
| HDCP_DECRYPT_KS
|-
| 0x560
| HDCP_DECRYPT
|-
| 0x564
| HDCP_GET_RRX
|-
| 0x568
| HDCP_DECRYPT_REENCRYPT
|-
| 0x56C
|
|-
| 0x570
|
|-
| 0x574
| HDCP_DECRYPT_STORED_KM
|-
| 0x578
|
|-
| 0x57C
|
|-
| 0x700
| HDCP_VALIDATE_SRM
|-
| 0x704
| HDCP_VALIDATE_STREAM
|-
| 0x708
| HDCP_TEST_SECURE_STATUS
|-
| 0x70C
| HDCP_SET_DCP_KPUB
|-
| 0x710
| HDCP_SET_RX_KPUB
|-
| 0x714
| HDCP_SET_CERT_RX
|-
| 0x718
| HDCP_SET_SCRATCH_BUFFER
|-
| 0x71C
| HDCP_SET_SRM
|-
| 0x720
| HDCP_SET_RECEIVER_ID_LIST
|-
| 0x724
| HDCP_SET_SPRIME
|-
| 0x728
| HDCP_SET_ENC_INPUT_BUFFER
|-
| 0x72C
| HDCP_SET_ENC_OUTPUT_BUFFER
|-
| 0x730
| HDCP_GET_RTT_CHALLENGE
|-
| 0x734
| HDCP_STREAM_MANAGE
|-
| 0x738
| HDCP_READ_CAPS
|-
| 0x73C
| HDCP_ENCRYPT
|-
| 0x740
| [6.0.0+] HDCP_GET_CURRENT_NONCE
|-
| 0x1114
| PM_TRIGGER_END
|}

=== TSEC_THI_METHOD1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_THI_METHOD1_DATA
|}

Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

=== TSEC_THI_CONTEXT_SWITCH ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-27
| TSEC_THI_CONTEXT_SWITCH_PTR
|-
| 30-31
| TSEC_THI_CONTEXT_SWITCH_TARGET
|}

=== TSEC_THI_INT_STATUS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_STATUS_FALCON_INT
|}

=== TSEC_THI_INT_MASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_MASK_FALCON_INT
|}

=== TSEC_THI_CONFIG0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_CONFIG0_RETURN_SYNCPT_ON_ERR
|-
| 4
| TSEC_THI_CONFIG0_IDLE_SYNCPT_INC_ENG
|}

=== TSEC_THI_DBG_MISC ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_DBG_MISC_CLIENT_IDLE_STATUS
|-
| 1
| TSEC_THI_DBG_MISC_THI_IDLE_STATUS
|-
| 2
| TSEC_THI_DBG_MISC_THI_SYNCPT_PENDING_STATUS
|-
| 3
| TSEC_THI_DBG_MISC_THI_IDLE_EN
|}

=== TSEC_THI_SLCG_OVERRIDE_HIGH_A ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| TSEC_THI_SLCG_OVERRIDE_HIGH_A_REG
|}

=== TSEC_THI_SLCG_OVERRIDE_LOW_A ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_THI_SLCG_OVERRIDE_LOW_A_REG
|}

=== TSEC_THI_CLK_OVERRIDE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_THI_CLK_OVERRIDE_CYA
|}

=== TSEC_FALCON_IRQSSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_IRQSSET_GPTMR
|-
| 1
| TSEC_FALCON_IRQSSET_WDTMR
|-
| 2
| TSEC_FALCON_IRQSSET_MTHD
|-
| 3
| TSEC_FALCON_IRQSSET_CTXSW
|-
| 4
| TSEC_FALCON_IRQSSET_HALT
|-
| 5
| TSEC_FALCON_IRQSSET_EXTERR
|-
| 6
| TSEC_FALCON_IRQSSET_SWGEN0
|-
| 7
| TSEC_FALCON_IRQSSET_SWGEN1
|-
| 8-15
| TSEC_FALCON_IRQSSET_EXT
|-
| 16
| TSEC_FALCON_IRQSSET_DMA
|}

Used for setting Falcon's IRQs.

=== TSEC_FALCON_IRQSCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_IRQSCLR_GPTMR
|-
| 1
| TSEC_FALCON_IRQSCLR_WDTMR
|-
| 2
| TSEC_FALCON_IRQSCLR_MTHD
|-
| 3
| TSEC_FALCON_IRQSCLR_CTXSW
|-
| 4
| TSEC_FALCON_IRQSCLR_HALT
|-
| 5
| TSEC_FALCON_IRQSCLR_EXTERR
|-
| 6
| TSEC_FALCON_IRQSCLR_SWGEN0
|-
| 7
| TSEC_FALCON_IRQSCLR_SWGEN1
|-
| 8-15
| TSEC_FALCON_IRQSCLR_EXT
|-
| 16
| TSEC_FALCON_IRQSCLR_DMA
|}

Used for clearing Falcon's IRQs.

=== TSEC_FALCON_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_IRQSTAT_GPTMR
|-
| 1
| TSEC_FALCON_IRQSTAT_WDTMR
|-
| 2
| TSEC_FALCON_IRQSTAT_MTHD
|-
| 3
| TSEC_FALCON_IRQSTAT_CTXSW
|-
| 4
| TSEC_FALCON_IRQSTAT_HALT
|-
| 5
| TSEC_FALCON_IRQSTAT_EXTERR
|-
| 6
| TSEC_FALCON_IRQSTAT_SWGEN0
|-
| 7
| TSEC_FALCON_IRQSTAT_SWGEN1
|-
| 8-15
| TSEC_FALCON_IRQSTAT_EXT
|-
| 16
| TSEC_FALCON_IRQSTAT_DMA
|}

Used for getting the status of Falcon's IRQs.

=== TSEC_FALCON_IRQMODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_IRQMODE_LVL_GPTMR
|-
| 1
| TSEC_FALCON_IRQMODE_LVL_WDTMR
|-
| 2
| TSEC_FALCON_IRQMODE_LVL_MTHD
|-
| 3
| TSEC_FALCON_IRQMODE_LVL_CTXSW
|-
| 4
| TSEC_FALCON_IRQMODE_LVL_HALT
|-
| 5
| TSEC_FALCON_IRQMODE_LVL_EXTERR
|-
| 6
| TSEC_FALCON_IRQMODE_LVL_SWGEN0
|-
| 7
| TSEC_FALCON_IRQMODE_LVL_SWGEN1
|-
| 8-15
| TSEC_FALCON_IRQMODE_LVL_EXT
|-
| 16
| TSEC_FALCON_IRQMODE_LVL_DMA
|}

Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.

=== TSEC_FALCON_IRQMSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_IRQMSET_GPTMR
|-
| 1
| TSEC_FALCON_IRQMSET_WDTMR
|-
| 2
| TSEC_FALCON_IRQMSET_MTHD
|-
| 3
| TSEC_FALCON_IRQMSET_CTXSW
|-
| 4
| TSEC_FALCON_IRQMSET_HALT
|-
| 5
| TSEC_FALCON_IRQMSET_EXTERR
|-
| 6
| TSEC_FALCON_IRQMSET_SWGEN0
|-
| 7
| TSEC_FALCON_IRQMSET_SWGEN1
|-
| 8-15
| TSEC_FALCON_IRQMSET_EXT
|-
| 16
| TSEC_FALCON_IRQMSET_DMA
|}

Used for setting the mask for Falcon's IRQs.

=== TSEC_FALCON_IRQMCLR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_IRQMCLR_GPTMR
|-
| 1
| TSEC_FALCON_IRQMCLR_WDTMR
|-
| 2
| TSEC_FALCON_IRQMCLR_MTHD
|-
| 3
| TSEC_FALCON_IRQMCLR_CTXSW
|-
| 4
| TSEC_FALCON_IRQMCLR_HALT
|-
| 5
| TSEC_FALCON_IRQMCLR_EXTERR
|-
| 6
| TSEC_FALCON_IRQMCLR_SWGEN0
|-
| 7
| TSEC_FALCON_IRQMCLR_SWGEN1
|-
| 8-15
| TSEC_FALCON_IRQMCLR_EXT
|-
| 16
| TSEC_FALCON_IRQMCLR_DMA
|}

Used for clearing the mask for Falcon's IRQs.

=== TSEC_FALCON_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_IRQMASK_GPTMR
|-
| 1
| TSEC_FALCON_IRQMASK_WDTMR
|-
| 2
| TSEC_FALCON_IRQMASK_MTHD
|-
| 3
| TSEC_FALCON_IRQMASK_CTXSW
|-
| 4
| TSEC_FALCON_IRQMASK_HALT
|-
| 5
| TSEC_FALCON_IRQMASK_EXTERR
|-
| 6
| TSEC_FALCON_IRQMASK_SWGEN0
|-
| 7
| TSEC_FALCON_IRQMASK_SWGEN1
|-
| 8-15
| TSEC_FALCON_IRQMASK_EXT
|-
| 16
| TSEC_FALCON_IRQMASK_DMA
|}

Used for getting the value of the mask for Falcon's IRQs.

=== TSEC_FALCON_IRQDEST ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_IRQDEST_HOST_GPTMR
|-
| 1
| TSEC_FALCON_IRQDEST_HOST_WDTMR
|-
| 2
| TSEC_FALCON_IRQDEST_HOST_MTHD
|-
| 3
| TSEC_FALCON_IRQDEST_HOST_CTXSW
|-
| 4
| TSEC_FALCON_IRQDEST_HOST_HALT
|-
| 5
| TSEC_FALCON_IRQDEST_HOST_EXTERR
|-
| 6
| TSEC_FALCON_IRQDEST_HOST_SWGEN0
|-
| 7
| TSEC_FALCON_IRQDEST_HOST_SWGEN1
|-
| 8-15
| TSEC_FALCON_IRQDEST_HOST_EXT
|-
| 16
| TSEC_FALCON_IRQDEST_TARGET_GPTMR
|-
| 17
| TSEC_FALCON_IRQDEST_TARGET_WDTMR
|-
| 18
| TSEC_FALCON_IRQDEST_TARGET_MTHD
|-
| 19
| TSEC_FALCON_IRQDEST_TARGET_CTXSW
|-
| 20
| TSEC_FALCON_IRQDEST_TARGET_HALT
|-
| 21
| TSEC_FALCON_IRQDEST_TARGET_EXTERR
|-
| 22
| TSEC_FALCON_IRQDEST_TARGET_SWGEN0
|-
| 23
| TSEC_FALCON_IRQDEST_TARGET_SWGEN1
|-
| 24-31
| TSEC_FALCON_IRQDEST_TARGET_EXT
|}

Used for routing Falcon's IRQs.

=== TSEC_FALCON_GPTMRINT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_GPTMRINT_VAL
|}

=== TSEC_FALCON_GPTMRVAL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_GPTMRVAL_VAL
|}

=== TSEC_FALCON_GPTMRCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_GPTMRCTL_GPTMREN
|}

=== TSEC_FALCON_PTIMER0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_PTIMER0_VAL
|}

=== TSEC_FALCON_PTIMER1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_PTIMER1_VAL
|}

=== TSEC_FALCON_WDTMRVAL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_WDTMRVAL_VAL
|}

=== TSEC_FALCON_WDTMRCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_WDTMRCTL_WDTMREN
|}

=== TSEC_FALCON_IRQDEST2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_IRQDEST2_HOST_DMA
|-
| 16
| TSEC_FALCON_IRQDEST2_TARGET_DMA
|}

Used for routing Falcon's IRQs.

=== TSEC_FALCON_MAILBOX0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_MAILBOX0_DATA
|}

Scratch register for reading/writing data to Falcon.

=== TSEC_FALCON_MAILBOX1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_MAILBOX1_DATA
|}

Scratch register for reading/writing data to Falcon.

=== TSEC_FALCON_ITFEN ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_ITFEN_CTXEN
|-
| 1
| TSEC_FALCON_ITFEN_MTHDEN
|}

Used for enabling/disabling Falcon interfaces.

=== TSEC_FALCON_IDLESTATE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_IDLESTATE_FALCON_BUSY
|-
| 1-15
| TSEC_FALCON_IDLESTATE_EXT_BUSY
|}

Used for detecting if Falcon is busy or not.

=== TSEC_FALCON_CURCTX ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-27
| TSEC_FALCON_CURCTX_CTXPTR
|-
| 28-29
| TSEC_FALCON_CURCTX_CTXTGT
|-
| 30
| TSEC_FALCON_CURCTX_CTXVLD
|}

=== TSEC_FALCON_NXTCTX ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-27
| TSEC_FALCON_NXTCTX_CTXPTR
|-
| 28-29
| TSEC_FALCON_NXTCTX_CTXTGT
|-
| 30
| TSEC_FALCON_NXTCTX_CTXVLD
|}

=== TSEC_FALCON_CTXACK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_CTXACK_SAVE_ACK
|-
| 1
| TSEC_FALCON_CTXACK_REST_ACK
|}

=== TSEC_FALCON_FHSTATE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_FHSTATE_FALCON_HALTED
|-
| 1-15
| TSEC_FALCON_FHSTATE_EXT_HALTED
|-
| 16
| TSEC_FALCON_FHSTATE_ENGINE_FAULTED
|-
| 17
| TSEC_FALCON_FHSTATE_STALL_REQ
|}

=== TSEC_FALCON_PRIVSTATE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_PRIVSTATE_PRIV
|}

=== TSEC_FALCON_MTHDDATA ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_MTHDDATA_DATA
|}

=== TSEC_FALCON_MTHDID ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-11
| TSEC_FALCON_MTHDID_ID
|-
| 12-14
| TSEC_FALCON_MTHDID_SUBCH
|-
| 15
| TSEC_FALCON_MTHDID_PRIV
|-
| 16
| TSEC_FALCON_MTHDID_WPEND
|}

=== TSEC_FALCON_MTHDWDAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_MTHDWDAT_DATA
|}

=== TSEC_FALCON_MTHDCOUNT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_FALCON_MTHDCOUNT_COUNT
|}

=== TSEC_FALCON_MTHDPOP ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_MTHDPOP_POP
|}

=== TSEC_FALCON_MTHDRAMSZ ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_FALCON_MTHDRAMSZ_RAMSZ
|}

=== TSEC_FALCON_SFTRESET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_SFTRESET_EXT
|}

=== TSEC_FALCON_OS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_OS_VERSION
|}

=== TSEC_FALCON_RM ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_RM_CONFIG
|}

=== TSEC_FALCON_SOFT_PM ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-5
| TSEC_FALCON_SOFT_PM_PROBE
|-
| 16
| TSEC_FALCON_SOFT_PM_TRIGGER_END
|-
| 17
| TSEC_FALCON_SOFT_PM_TRIGGER_START
|}

=== TSEC_FALCON_SOFT_MODE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-5
| TSEC_FALCON_SOFT_MODE_PROBE
|}

=== TSEC_FALCON_DEBUG1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_FALCON_DEBUG1_MTHD_DRAIN_TIME
|-
| 16
| TSEC_FALCON_DEBUG1_CTXSW_MODE
|-
| 17
| TSEC_FALCON_DEBUG1_TRACE_FORMAT
|}

=== TSEC_FALCON_DEBUGINFO ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_DEBUGINFO_DATA
|}

Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.

[6.0.0+] [[NV_services|nvservices]] sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.

=== TSEC_FALCON_IBRKPT1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-23
| TSEC_FALCON_IBRKPT1_PC
|-
| 29
| TSEC_FALCON_IBRKPT1_SUPPRESS
|-
| 30
| TSEC_FALCON_IBRKPT1_SKIP
|-
| 31
| TSEC_FALCON_IBRKPT1_EN
|}

=== TSEC_FALCON_IBRKPT2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-23
| TSEC_FALCON_IBRKPT2_PC
|-
| 29
| TSEC_FALCON_IBRKPT2_SUPPRESS
|-
| 30
| TSEC_FALCON_IBRKPT2_SKIP
|-
| 31
| TSEC_FALCON_IBRKPT2_EN
|}

=== TSEC_FALCON_CGCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_CGCTL_CG_OVERRIDE
|}

=== TSEC_FALCON_ENGCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_ENGCTL_INV_CONTEXT
|-
| 1
| TSEC_FALCON_ENGCTL_SET_STALLREQ
|-
| 2
| TSEC_FALCON_ENGCTL_CLR_STALLREQ
|-
| 3
| TSEC_FALCON_ENGCTL_SWITCH_CONTEXT
|-
| 8
| TSEC_FALCON_ENGCTL_STALLREQ
|-
| 9
| TSEC_FALCON_ENGCTL_STALLACK
|}

=== TSEC_FALCON_PMM ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-4
| TSEC_FALCON_PMM_FALCON_STALL_SEL
0x00: ANY
0x01: CODE
0x02: DMAQ
0x03: DMFENCE
0x04: DMWAIT
0x05: IMWAIT
0x06: IPND
0x07: LDSTQ
0x08: SB
0x09: ANY_SC
0x0A: CODE_SC
0x0B: DMAQ_SC
0x0C: DMFENCE_SC
0x0D: DMWAIT_SC
0x0E: IMWAIT_SC
0x0F: IPND_SC
0x10: LDSTQ_SC
0x11: SB_SC
|-
| 5-7
| TSEC_FALCON_PMM_FALCON_IDLE_SEL
0x00: WAITING
0x01: ENG_IDLE
0x02: MTHD_FULL
0x03: WAITING_SC
0x04: ENG_IDLE_SC
0x05: MTHD_FULL_SC
|-
| 8-11
| TSEC_FALCON_PMM_FALCON_SOFTPM0_SEL
0x00: 0
0x01: 1
0x02: 2
0x03: 3
0x04: 4
0x05: 5
0x06: 0_SC
0x07: 1_SC
0x08: 2_SC
0x09: 3_SC
0x0A: 4_SC
0x0B: 5_SC
|-
| 12-15
| TSEC_FALCON_PMM_FALCON_SOFTPM1_SEL
0x00: 0
|-
| 17-19
| TSEC_FALCON_PMM_TFBIF_DSTAT_SEL
0x00: 1KTRANSFER
0x01: RREQ
0x02: WREQ
0x03: TWREQ
0x04: 1KTRANSFER_SC
0x05: RREQ_SC
0x06: WREQ_SC
0x07: TWREQ_SC
|-
| 20-23
| TSEC_FALCON_PMM_TFBIF_STALL0_SEL
0x00: RDATQ_FULL
0x01: RACKQ_FULL
0x02: WREQQ_FULL
0x03: WDATQ_FULL
0x04: WACKQ_FULL
0x05: MREQQ_FULL
0x06: RREQ_PEND
0x07: WREQ_PEND
0x08: RDATQ_FULL_SC
0x09: RACKQ_FULL_SC
0x0A: WREQQ_FULL_SC
0x0B: WDATQ_FULL_SC
0x0C: WACKQ_FULL_SC
0x0D: MREQQ_FULL_SC
0x0E: RREQ_PEND_SC
0x0F: WREQ_PEND_SC
|-
| 24-27
| TSEC_FALCON_PMM_TFBIF_STALL1_SEL
0x00: RDATQ_FULL
|-
| 28-31
| TSEC_FALCON_PMM_TFBIF_STALL2_SEL
0x00: RDATQ_FULL
|}

=== TSEC_FALCON_ADDR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-5
| TSEC_FALCON_ADDR_LSB
|-
| 6-11
| TSEC_FALCON_ADDR_MSB
|}

=== TSEC_FALCON_IBRKPT3 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-23
| TSEC_FALCON_IBRKPT3_PC
|-
| 29
| TSEC_FALCON_IBRKPT3_SUPPRESS
|-
| 30
| TSEC_FALCON_IBRKPT3_SKIP
|-
| 31
| TSEC_FALCON_IBRKPT3_EN
|}

=== TSEC_FALCON_IBRKPT4 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-23
| TSEC_FALCON_IBRKPT4_PC
|-
| 29
| TSEC_FALCON_IBRKPT4_SUPPRESS
|-
| 30
| TSEC_FALCON_IBRKPT4_SKIP
|-
| 31
| TSEC_FALCON_IBRKPT4_EN
|}

=== TSEC_FALCON_IBRKPT5 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-23
| TSEC_FALCON_IBRKPT5_PC
|-
| 29
| TSEC_FALCON_IBRKPT5_SUPPRESS
|-
| 30
| TSEC_FALCON_IBRKPT5_SKIP
|-
| 31
| TSEC_FALCON_IBRKPT5_EN
|}

=== TSEC_FALCON_EXCI ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-19
| TSEC_FALCON_EXCI_EXPC
|-
| 20-23
| TSEC_FALCON_EXCI_EXCAUSE
0x00: TRAP0
0x01: TRAP1
0x02: TRAP2
0x03: TRAP3
0x08: ILL_INS (invalid opcode)
0x09: INV_INS (authentication entry)
0x0A: MISS_INS (page miss)
0x0B: DHIT_INS (page multiple hit)
0x0F: BRKPT_INS (breakpoint hit)
|}

Contains information about raised exceptions.

=== TSEC_FALCON_SVEC_SPR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 18
| TSEC_FALCON_SVEC_SPR_SIGPASS
|}

=== TSEC_FALCON_RSTAT0 ===
Mirror of the [[#TSEC_FALCON_ICD_RDATA|ICD status register 0]].

=== TSEC_FALCON_RSTAT3 ===
Mirror of the [[#TSEC_FALCON_ICD_RDATA|ICD status register 3]].

=== TSEC_FALCON_CPUCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_CPUCTL_IINVAL
|-
| 1
| TSEC_FALCON_CPUCTL_STARTCPU
|-
| 2
| TSEC_FALCON_CPUCTL_SRESET
|-
| 3
| TSEC_FALCON_CPUCTL_HRESET
|-
| 4
| TSEC_FALCON_CPUCTL_HALTED
|-
| 5
| TSEC_FALCON_CPUCTL_STOPPED
|-
| 6
| TSEC_FALCON_CPUCTL_ALIAS_EN
|}

Used for signaling the Falcon CPU.

=== TSEC_FALCON_BOOTVEC ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_BOOTVEC_VEC
|}

Takes the Falcon's boot vector address.

=== TSEC_FALCON_HWCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-8
| TSEC_FALCON_HWCFG_IMEM_SIZE
|-
| 9-17
| TSEC_FALCON_HWCFG_DMEM_SIZE
|-
| 18-26
| TSEC_FALCON_HWCFG_METHODFIFO_DEPTH
|-
| 27-31
| TSEC_FALCON_HWCFG_DMAQUEUE_DEPTH
|}

=== TSEC_FALCON_DMACTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_DMACTL_REQUIRE_CTX
|-
| 1
| TSEC_FALCON_DMACTL_DMEM_SCRUBBING
|-
| 2
| TSEC_FALCON_DMACTL_IMEM_SCRUBBING
|-
| 3-6
| TSEC_FALCON_DMACTL_DMAQ_NUM
|-
| 7
| TSEC_FALCON_DMACTL_SECURE_STAT
|}

Used for configuring the Falcon's DMA engine.

=== TSEC_FALCON_DMATRFBASE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_DMATRFBASE_BASE
|}

Base address of the external memory buffer, shifted right by 8.

The current transfer address is calculated by adding [[#TSEC_FALCON_DMATRFFBOFFS|TSEC_FALCON_DMATRFFBOFFS]] to the base.

=== TSEC_FALCON_DMATRFMOFFS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_FALCON_DMATRFMOFFS_OFFS
|}

For transfers to DMEM: the destination address.
For transfers to IMEM: the destination virtual IMEM page.

=== TSEC_FALCON_DMATRFCMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_DMATRFCMD_FULL
|-
| 1
| TSEC_FALCON_DMATRFCMD_IDLE
|-
| 2-3
| TSEC_FALCON_DMATRFCMD_SEC
|-
| 4
| TSEC_FALCON_DMATRFCMD_IMEM
|-
| 5
| TSEC_FALCON_DMATRFCMD_WRITE
|-
| 8-10
| TSEC_FALCON_DMATRFCMD_SIZE
|-
| 12-14
| TSEC_FALCON_DMATRFCMD_CTXDMA
|}

Used for configuring DMA transfers.

=== TSEC_FALCON_DMATRFFBOFFS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_DMATRFFBOFFS_OFFS
|}

For transfers to IMEM: the destination physical IMEM page.

=== TSEC_FALCON_DMAPOLL_FB ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_DMAPOLL_FB_FENCE_ACTIVE
|-
| 1
| TSEC_FALCON_DMAPOLL_FB_DMA_ACTIVE
|-
| 4
| TSEC_FALCON_DMAPOLL_FB_CFG_R_FENCE
|-
| 5
| TSEC_FALCON_DMAPOLL_FB_CFG_W_FENCE
|-
| 16-23
| TSEC_FALCON_DMAPOLL_FB_WCOUNT
|-
| 24-31
| TSEC_FALCON_DMAPOLL_FB_RCOUNT
|}

Contains the status of a DMA transfer between the Falcon and external memory.

=== TSEC_FALCON_DMAPOLL_CP ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_DMAPOLL_CP_FENCE_ACTIVE
|-
| 1
| TSEC_FALCON_DMAPOLL_CP_DMA_ACTIVE
|-
| 4
| TSEC_FALCON_DMAPOLL_CP_CFG_R_FENCE
|-
| 5
| TSEC_FALCON_DMAPOLL_CP_CFG_W_FENCE
|-
| 16-23
| TSEC_FALCON_DMAPOLL_CP_WCOUNT
|-
| 24-31
| TSEC_FALCON_DMAPOLL_CP_RCOUNT
|}

Contains the status of a DMA transfer between the Falcon and the SCP.

=== TSEC_FALCON_HWCFG1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| TSEC_FALCON_HWCFG1_CORE_REV
|-
| 4-5
| TSEC_FALCON_HWCFG1_SECURITY_MODEL
|-
| 6-7
| TSEC_FALCON_HWCFG1_CORE_REV_SUBVERSION
|-
| 8-11
| TSEC_FALCON_HWCFG1_IMEM_PORTS
|-
| 12-15
| TSEC_FALCON_HWCFG1_DMEM_PORTS
|-
| 16-20
| TSEC_FALCON_HWCFG1_TAG_WIDTH
|-
| 27
| TSEC_FALCON_HWCFG1_DBG_PRIV_BUS
|-
| 28
| TSEC_FALCON_HWCFG1_CSB_SIZE_16M
|-
| 29
| TSEC_FALCON_HWCFG1_PRIV_DIRECT
|-
| 30
| TSEC_FALCON_HWCFG1_DMEM_APERTURES
|-
| 31
| TSEC_FALCON_HWCFG1_IMEM_AUTOFILL
|}

=== TSEC_FALCON_CPUCTL_ALIAS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_FALCON_CPUCTL_ALIAS_STARTCPU
|}

=== TSEC_FALCON_STACKCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_FALCON_STACKCFG_BOTTOM
|-
| 31
| TSEC_FALCON_STACKCFG_SPEXC
|}

=== TSEC_FALCON_IMCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-23
| TSEC_FALCON_IMCTL_ADDR_BLK
|-
| 24-26
| TSEC_FALCON_IMCTL_CMD
0x00: NOP
0x01: IMINV (ITLB)
0x02: IMBLK (PTLB)
0x03: IMTAG (VTLB)
0x04: IMTAG_SETVLD
|}

Controls the Falcon TLB.

=== TSEC_FALCON_IMSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_IMSTAT_VAL
|}

Returns the result of the last command from [[#TSEC_FALCON_IMCTL|TSEC_FALCON_IMCTL]].

=== TSEC_FALCON_TRACEIDX ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| TSEC_FALCON_TRACEIDX_IDX
|-
| 16-23
| TSEC_FALCON_TRACEIDX_MAXIDX
|-
| 24-31
| TSEC_FALCON_TRACEIDX_CNT
|}

Controls the index for tracing with [[#TSEC_FALCON_TRACEPC|TSEC_FALCON_TRACEPC]].

=== TSEC_FALCON_TRACEPC ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-23
| TSEC_FALCON_TRACEPC_PC
|}

Returns the PC of the last call or branch executed.

=== TSEC_FALCON_IMFILLRNG0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_FALCON_IMFILLRNG0_TAG_LO
|-
| 16-31
| TSEC_FALCON_IMFILLRNG0_TAG_HI
|}

=== TSEC_FALCON_IMFILLRNG1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_FALCON_IMFILLRNG1_TAG_LO
|-
| 16-31
| TSEC_FALCON_IMFILLRNG1_TAG_HI
|}

=== TSEC_FALCON_IMFILLCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| TSEC_FALCON_IMFILLCTL_NBLOCKS
|}

=== TSEC_FALCON_IMCTL_DEBUG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-23
| TSEC_FALCON_IMCTL_DEBUG_ADDR_BLK
|-
| 24-26
| TSEC_FALCON_IMCTL_DEBUG_CMD
0x00: NOP
0x02: IMBLK
0x03: IMTAG
|}

=== TSEC_FALCON_CMEMBASE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 18-31
| TSEC_FALCON_CMEMBASE_VAL
|}

=== TSEC_FALCON_DMEMAPERT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| TSEC_FALCON_DMEMAPERT_TIME_OUT
|-
| 8-11
| TSEC_FALCON_DMEMAPERT_TIME_UNIT
|-
| 16
| TSEC_FALCON_DMEMAPERT_ENABLE
|-
| 17-19
| TSEC_FALCON_DMEMAPERT_LDSTQ_NUM
|}

=== TSEC_FALCON_EXTERRADDR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_EXTERRADDR_ADDR
|}

=== TSEC_FALCON_EXTERRSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-23
| TSEC_FALCON_EXTERRSTAT_PC
|-
| 24-27
| TSEC_FALCON_EXTERRSTAT_STAT
|-
| 31
| TSEC_FALCON_EXTERRSTAT_VALID
|}

=== TSEC_FALCON_CG2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| TSEC_FALCON_CG2_SLCG_FALCON_DMA
|-
| 2
| TSEC_FALCON_CG2_SLCG_FALCON_GC6_SR_FSM
|-
| 3
| TSEC_FALCON_CG2_SLCG_FALCON_PIPE
|-
| 4
| TSEC_FALCON_CG2_SLCG_FALCON_DIV
|-
| 5
| TSEC_FALCON_CG2_SLCG_FALCON_ICD
|-
| 6
| TSEC_FALCON_CG2_SLCG_FALCON_CFG
|-
| 7
| TSEC_FALCON_CG2_SLCG_FALCON_CTXSW
|-
| 8
| TSEC_FALCON_CG2_SLCG_FALCON_PMB
|-
| 9
| TSEC_FALCON_CG2_SLCG_FALCON_RF
|-
| 10
| TSEC_FALCON_CG2_SLCG_FALCON_MUL
|-
| 11
| TSEC_FALCON_CG2_SLCG_FALCON_LDST
|-
| 12
| TSEC_FALCON_CG2_SLCG_FALCON_TSYNC
|-
| 13
| TSEC_FALCON_CG2_SLCG_FALCON_GPTMR
|-
| 14
| TSEC_FALCON_CG2_SLCG_FALCON_WDTMR
|-
| 15
| TSEC_FALCON_CG2_SLCG_FALCON_IRQSTAT
|-
| 16
| TSEC_FALCON_CG2_SLCG_FALCON_TOP
|-
| 17
| TSEC_FALCON_CG2_SLCG_FBIF
|}

=== TSEC_FALCON_IMEMC ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 2-7
| TSEC_FALCON_IMEMC_OFFS
|-
| 8-15
| TSEC_FALCON_IMEMC_BLK
|-
| 24
| TSEC_FALCON_IMEMC_AINCW
|-
| 25
| TSEC_FALCON_IMEMC_AINCR
|-
| 28
| TSEC_FALCON_IMEMC_SECURE
|-
| 29
| TSEC_FALCON_IMEMC_SEC_ATOMIC
|-
| 30
| TSEC_FALCON_IMEMC_SEC_WR_VIO
|-
| 31
| TSEC_FALCON_IMEMC_SEC_LOCK
|}

Used for configuring access to Falcon's IMEM.

=== TSEC_FALCON_IMEMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_IMEMD_DATA
|}

Returns or takes the value for an IMEM read/write operation.

=== TSEC_FALCON_IMEMT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_FALCON_IMEMT_TAG
|}

Returns or takes the virtual page index for an IMEM read/write operation.

=== TSEC_FALCON_DMEMC ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 2-7
| TSEC_FALCON_DMEMC_OFFS
|-
| 8-15
| TSEC_FALCON_DMEMC_BLK
|-
| 24
| TSEC_FALCON_DMEMC_AINCW
|-
| 25
| TSEC_FALCON_DMEMC_AINCR
|}

Used for configuring access to Falcon's DMEM.

=== TSEC_FALCON_DMEMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_DMEMD_DATA
|}

Returns or takes the value for a DMEM read/write operation.

=== TSEC_FALCON_ICD_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| TSEC_FALCON_ICD_CMD_OPC
0x00: STOP
0x01: RUN (run from PC)
0x02: JRUN (run from address)
0x03: RUNB (run from PC)
0x04: JRUNB (run from address)
0x05: STEP (step from PC)
0x06: JSTEP (step from address)
0x07: EMASK (set exception mask)
0x08: RREG (read register)
0x09: WREG (write register)
0x0A: RDM (read data memory)
0x0B: WDM (write data memory)
0x0C: RCM (read MMIO/configuration memory)
0x0D: WCM (write MMIO/configuration memory)
0x0E: RSTAT (read status)
0x0F: SBU (store buffer update)
|-
| 6-7
| TSEC_FALCON_ICD_CMD_SZ
0x00: B (byte)
0x01: HW (half word)
0x02: W (word)
|-
| 8-12
| TSEC_FALCON_ICD_CMD_IDX
0x00: REG0 | RSTAT0 | WB0
0x01: REG1 | RSTAT1 | WB1
0x02: REG2 | RSTAT2 | WB2
0x03: REG3 | RSTAT3 | WB3
0x04: REG4 | RSTAT4
0x05: REG5 | RSTAT5
0x06: REG6
0x07: REG7
0x08: REG8
0x09: REG9
0x0A: REG10
0x0B: REG11
0x0C: REG12
0x0D: REG13
0x0E: REG14
0x0F: REG15
0x10: IV0
0x11: IV1
0x12: UNDEFINED
0x13: EV
0x14: SP
0x15: PC
0x16: IMB
0x17: DMB
0x18: CSW
0x19: CCR
0x1A: SEC
0x1B: CTX
0x1C: EXCI
0x1D: SEC1
0x1E: IMB1
0x1F: DMB1
|-
| 14
| TSEC_FALCON_ICD_CMD_ERROR
|-
| 15
| TSEC_FALCON_ICD_CMD_RDVLD
|-
| 16-31
| TSEC_FALCON_ICD_CMD_PARM
0x0001: EMASK_TRAP0
0x0002: EMASK_TRAP1
0x0004: EMASK_TRAP2
0x0008: EMASK_TRAP3
0x0010: EMASK_EXC_UNIMP
0x0020: EMASK_EXC_IMISS
0x0040: EMASK_EXC_IMHIT
0x0080: EMASK_EXC_IBREAK
0x0100: EMASK_IV0
0x0200: EMASK_IV1
0x0400: EMASK_IV2
0x0800: EMASK_EXT0
0x1000: EMASK_EXT1
0x2000: EMASK_EXT2
0x4000: EMASK_EXT3
0x8000: EMASK_EXT4
|}

Used for sending commands to the Falcon's in-chip debugger.

=== TSEC_FALCON_ICD_ADDR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_ICD_ADDR_ADDR
|}

Takes the target address for the Falcon's in-chip debugger.

=== TSEC_FALCON_ICD_WDATA ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_ICD_WDATA_DATA
|}

Takes the data for writing using the Falcon's in-chip debugger.

=== TSEC_FALCON_ICD_RDATA ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_ICD_RDATA_DATA
|}

Returns the data read using the Falcon's in-chip debugger.

When reading from an internal status register (STAT), the following applies:
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| RSTAT0_MEM_STALL
|-
| 1
| RSTAT0_DMA_STALL
|-
| 2
| RSTAT0_FENCE_STALL
|-
| 3
| RSTAT0_DIV_STALL
|-
| 4
| RSTAT0_DMA_STALL_DMAQ
|-
| 5
| RSTAT0_DMA_STALL_DMWAITING
|-
| 6
| RSTAT0_DMA_STALL_IMWAITING
|-
| 7
| RSTAT0_ANY_STALL
|-
| 8
| RSTAT0_SBFULL_STALL
|-
| 9
| RSTAT0_SBHIT_STALL
|-
| 10
| RSTAT0_FLOW_STALL
|-
| 11
| RSTAT0_SP_STALL
|-
| 12
| RSTAT0_BL_STALL
|-
| 13
| RSTAT0_IPND_STALL
|-
| 14
| RSTAT0_LDSTQ_STALL
|-
| 16
| RSTAT0_NOINSTR_STALL
|-
| 20
| RSTAT0_HALTSTOP_FLUSH
|-
| 21
| RSTAT0_AFILL_FLUSH
|-
| 22
| RSTAT0_EXC_FLUSH
|-
| 23-25
| RSTAT0_IRQ_FLUSH
|-
| 28
| RSTAT0_VALIDRD
|-
| 29
| RSTAT0_WAITING
|-
| 30
| RSTAT0_HALTED
|-
| 31
| RSTAT0_MTHD_FULL
|}
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| RSTAT1_WB_ALLOC
|-
| 4-7
| RSTAT1_WB_VALID
|-
| 8-9
| RSTAT1_WB0_SZ
|-
| 10-11
| RSTAT1_WB1_SZ
|-
| 12-13
| RSTAT1_WB2_SZ
|-
| 14-15
| RSTAT1_WB3_SZ
|-
| 16-19
| RSTAT1_WB0_IDX
|-
| 20-23
| RSTAT1_WB1_IDX
|-
| 24-27
| RSTAT1_WB2_IDX
|-
| 28-31
| RSTAT1_WB3_IDX
|}
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| RSTAT2_DMAQ_NUM
|-
| 4
| RSTAT2_DMA_ENABLE
|-
| 5-7
| RSTAT2_LDSTQ_NUM
|-
| 16-19
| RSTAT2_EM_BUSY
|-
| 20-23
| RSTAT2_EM_ACKED
|-
| 24-27
| RSTAT2_EM_ISWR
|-
| 28-31
| RSTAT2_EM_DVLD
|}
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| RSTAT3_MTHD_IDLE
|-
| 1
| RSTAT3_CTXSW_IDLE
|-
| 2
| RSTAT3_DMA_IDLE
|-
| 3
| RSTAT3_SCP_IDLE
|-
| 4
| RSTAT3_LDST_IDLE
|-
| 5
| RSTAT3_SBWB_EMPTY
|-
| 6-8
| RSTAT3_CSWIE
|-
| 10
| RSTAT3_CSWE
|-
| 12-14
| RSTAT3_CTXSW_STATE
0x00: IDLE
0x01: SM_CHECK
0x02: SM_SAVE
0x03: SM_SAVE_WAIT
0x04: SM_BLK_BIND
0x05: SM_RESET
0x06: SM_RESETWAIT
0x07: SM_ACK
|-
| 15
| RSTAT3_CTXSW_PEND
|-
| 17
| RSTAT3_DMA_FBREQ_IDLE
|-
| 18
| RSTAT3_DMA_ACKQ_EMPTY
|-
| 19
| RSTAT3_DMA_RDQ_EMPTY
|-
| 20
| RSTAT3_DMA_WR_BUSY
|-
| 21
| RSTAT3_DMA_RD_BUSY
|-
| 22
| RSTAT3_LDST_XT_BUSY
|-
| 23
| RSTAT3_LDST_XT_BLOCK
|-
| 24
| RSTAT3_ENG_IDLE
|}
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| RSTAT4_ICD_STATE
0x00: NORMAL
0x01: WAIT_ISSUE_CLEAR
0x02: WAIT_EXLDQ_CLEAR
0x03: FULL_DBG_MODE
|-
| 2-3
| RSTAT4_ICD_MODE
0x00: SUPPRESSICD
0x01: ENTERICD_IBRK
0x02: ENTERICD_STEP
|-
| 16
| RSTAT4_ICD_EMASK_TRAP0
|-
| 17
| RSTAT4_ICD_EMASK_TRAP1
|-
| 18
| RSTAT4_ICD_EMASK_TRAP2
|-
| 19
| RSTAT4_ICD_EMASK_TRAP3
|-
| 20
| RSTAT4_ICD_EMASK_EXC_UNIMP
|-
| 21
| RSTAT4_ICD_EMASK_EXC_IMISS
|-
| 22
| RSTAT4_ICD_EMASK_EXC_IMHIT
|-
| 23
| RSTAT4_ICD_EMASK_EXC_IBREAK
|-
| 24
| RSTAT4_ICD_EMASK_IV0
|-
| 25
| RSTAT4_ICD_EMASK_IV1
|-
| 26
| RSTAT4_ICD_EMASK_IV2
|-
| 27
| RSTAT4_ICD_EMASK_EXT0
|-
| 28
| RSTAT4_ICD_EMASK_EXT1
|-
| 29
| RSTAT4_ICD_EMASK_EXT2
|-
| 30
| RSTAT4_ICD_EMASK_EXT3
|-
| 31
| RSTAT4_ICD_EMASK_EXT4
|}
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| RSTAT5_LRU_STATE
|}

=== TSEC_FALCON_SCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_SCTL_LSMODE
|-
| 1
| TSEC_FALCON_SCTL_HSMODE
|-
| 4-5
| Unknown
|-
| 12-13
| Unknown
|-
| 14
| Initialize the transition to LS mode
|}

=== TSEC_FALCON_SSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 30
| Unknown
|-
| 31
| Set on memory protection violation
|}

=== TSEC_FALCON_SPROT_IMEM ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Read access level
|-
| 4-7
| Write access level
|}

Controls accesses to Falcon IMEM.

=== TSEC_FALCON_SPROT_DMEM ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Read access level
|-
| 4-7
| Write access level
|}

Controls accesses to Falcon DMEM.

=== TSEC_FALCON_SPROT_CPUCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Read access level
|-
| 4-7
| Write access level
|}

Controls accesses to the [[#TSEC_FALCON_CPUCTL|TSEC_FALCON_CPUCTL]] register.

=== TSEC_FALCON_SPROT_MISC ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Read access level
|-
| 4-7
| Write access level
|}

Controls accesses to the following registers:
* [[#TSEC_FALCON_PRIVSTATE|TSEC_FALCON_PRIVSTATE]]
* [[#TSEC_FALCON_SFTRESET|TSEC_FALCON_SFTRESET]]
* [[#TSEC_FALCON_ADDR|TSEC_FALCON_ADDR]]
* [[#TSEC_FALCON_DMACTL|TSEC_FALCON_DMACTL]]
* [[#TSEC_FALCON_IMCTL|TSEC_FALCON_IMCTL]]
* [[#TSEC_FALCON_IMSTAT|TSEC_FALCON_IMSTAT]]
* TSEC_FALCON_UNK_250
* [[#TSEC_FALCON_DMAINFO_CTL|TSEC_FALCON_DMAINFO_CTL]]

=== TSEC_FALCON_SPROT_IRQ ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Read access level
|-
| 4-7
| Write access level
|}

Controls accesses to the following registers:
* [[#TSEC_FALCON_IRQMODE|TSEC_FALCON_IRQMODE]]
* [[#TSEC_FALCON_IRQMSET|TSEC_FALCON_IRQMSET]]
* [[#TSEC_FALCON_IRQMCLR|TSEC_FALCON_IRQMCLR]]
* [[#TSEC_FALCON_IRQDEST|TSEC_FALCON_IRQDEST]]
* [[#TSEC_FALCON_GPTMRINT|TSEC_FALCON_GPTMRINT]]
* [[#TSEC_FALCON_GPTMRVAL|TSEC_FALCON_GPTMRVAL]]
* [[#TSEC_FALCON_GPTMRCTL|TSEC_FALCON_GPTMRCTL]]
* [[#TSEC_FALCON_IRQDEST2|TSEC_FALCON_IRQDEST2]]
* TSEC_FALCON_UNK_E0

=== TSEC_FALCON_SPROT_MTHD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Read access level
|-
| 4-7
| Write access level
|}

Controls accesses to the following registers:
* [[#TSEC_FALCON_ITFEN|TSEC_FALCON_ITFEN]]
* [[#TSEC_FALCON_CURCTX|TSEC_FALCON_CURCTX]]
* [[#TSEC_FALCON_NXTCTX|TSEC_FALCON_NXTCTX]]
* [[#TSEC_FALCON_CTXACK|TSEC_FALCON_CTXACK]]
* [[#TSEC_FALCON_MTHDDATA|TSEC_FALCON_MTHDDATA]]
* [[#TSEC_FALCON_MTHDID|TSEC_FALCON_MTHDID]]
* [[#TSEC_FALCON_MTHDWDAT|TSEC_FALCON_MTHDWDAT]]
* [[#TSEC_FALCON_MTHDCOUNT|TSEC_FALCON_MTHDCOUNT]]
* [[#TSEC_FALCON_MTHDPOP|TSEC_FALCON_MTHDPOP]]
* [[#TSEC_FALCON_MTHDRAMSZ|TSEC_FALCON_MTHDRAMSZ]]
* [[#TSEC_FALCON_DEBUG1|TSEC_FALCON_DEBUG1]]

=== TSEC_FALCON_SPROT_SCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Read access level
|-
| 4-7
| Write access level
|}

Controls accesses to the [[#TSEC_FALCON_SCTL|TSEC_FALCON_SCTL]] register.

=== TSEC_FALCON_SPROT_WDTMR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Read access level
|-
| 4-7
| Write access level
|}

Controls accesses to the following registers:
* [[#TSEC_FALCON_WDTMRVAL|TSEC_FALCON_WDTMRVAL]]
* [[#TSEC_FALCON_WDTMRCTL|TSEC_FALCON_WDTMRCTL]]

=== TSEC_FALCON_DMAINFO_FINISHED_FBRD_LOW ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_DMAINFO_FINISHED_FBRD_LOW_VAL
|}

=== TSEC_FALCON_DMAINFO_FINISHED_FBRD_HIGH ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-30
| TSEC_FALCON_DMAINFO_FINISHED_FBRD_HIGH_VAL
|-
| 31
| TSEC_FALCON_DMAINFO_FINISHED_FBRD_HIGH_OBIT
|}

=== TSEC_FALCON_DMAINFO_FINISHED_FBWR_LOW ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_DMAINFO_FINISHED_FBWR_LOW_VAL
|}

=== TSEC_FALCON_DMAINFO_FINISHED_FBWR_HIGH ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-30
| TSEC_FALCON_DMAINFO_FINISHED_FBWR_HIGH_VAL
|-
| 31
| TSEC_FALCON_DMAINFO_FINISHED_FBWR_HIGH_OBIT
|}

=== TSEC_FALCON_DMAINFO_CURRENT_FBRD_LOW ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_DMAINFO_CURRENT_FBRD_LOW_VAL
|}

=== TSEC_FALCON_DMAINFO_CURRENT_FBRD_HIGH ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-30
| TSEC_FALCON_DMAINFO_CURRENT_FBRD_HIGH_VAL
|-
| 31
| TSEC_FALCON_DMAINFO_CURRENT_FBRD_HIGH_OBIT
|}

=== TSEC_FALCON_DMAINFO_CURRENT_FBWR_LOW ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_FALCON_DMAINFO_CURRENT_FBWR_LOW_VAL
|}

=== TSEC_FALCON_DMAINFO_CURRENT_FBWR_HIGH ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-30
| TSEC_FALCON_DMAINFO_CURRENT_FBWR_HIGH_VAL
|-
| 31
| TSEC_FALCON_DMAINFO_CURRENT_FBWR_HIGH_OBIT
|}

=== TSEC_FALCON_DMAINFO_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_DMAINFO_CTL_CLR_FBRD
|-
| 1
| TSEC_FALCON_DMAINFO_CTL_CLR_FBWR
|}

=== TSEC_SCP_CTL0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 10
| Enable the [[#LOAD|LOAD]] block's interface
|-
| 12
| Enable the [[#STORE|STORE]] block's interface
|-
| 14
| Enable the [[#CMD|CMD]] block's interface
|-
| 16
| Enable the [[#SEQ|SEQ]] block
|-
| 20
| Enable the [[#CTL|CTL]] block
|}

=== TSEC_SCP_CTL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Clear [[#SEQ|SEQ]] block's pipeline
|-
| 8
| Clear the main [[#SCP|SCP]] pipeline
|-
| 11
| Enable [[#RNG|RNG]] block's test mode
|-
| 12
| Enable the [[#RNG|RNG]] block
|-
| 16
| Enable [[#LOAD|LOAD]] block's interface dummy mode (all reads return 0)
|-
| 20
| Enable [[#LOAD|LOAD]] block's interface bypassing (all reads are dropped)
|-
| 24
| Enable [[#STORE|STORE]] block's interface bypassing (all writes are dropped)
|}

=== TSEC_SCP_CTL_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| TSEC_SCP_CTL_STAT_DEBUG_MODE
|}

=== TSEC_SCP_CTL_LOCK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Enable lockdown mode (locks IMEM and DMEM)
|-
| 1
| Unknown
|-
| 2
| Unknown
|-
| 3
| Unknown
|-
| 4
| Lock the [[#SCP|SCP]]
|-
| 5
| Unknown
|-
| 6
| Unknown
|-
| 7
| Unknown
|}

Controls lockdown mode and can only be cleared in Heavy Secure mode.

=== TSEC_SCP_CFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Unknown
|-
| 1
| Unknown
|-
| 2
| Unknown
|-
| 3
| Unknown
|-
| 4
| [[#AES|AES]] block's endianness
0: Little
1: Big
|-
| 8
| Flush [[#CMD|CMD]] block's pipeline
|-
| 12-13
| Carry chain size
0: 32 bits
1: 64 bits
2: 96 bits
3: 128 bits
|-
| 16-31
| Timeout value
|}

=== TSEC_SCP_CTL_SCP ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Swap [[#SCP|SCP]] master
|-
| 1
| Current [[#SCP|SCP]] master
0: Falcon
1: External
|}

=== TSEC_SCP_CTL_PKEY ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
|-
| 1
| TSEC_SCP_CTL_PKEY_LOADED
|}

=== TSEC_SCP_CTL_DBG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Unknown
|-
| 4
| Unknown
|-
| 8
| Unknown
|-
| 12
| Unknown
|}

=== TSEC_SCP_DBG0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Index
|-
| 4
| Auto-increment
|-
| 5-6
| Target
0: None
1: STORE
2: LOAD
3: SEQ
|-
| 8-12
| [[#SEQ|SEQ]] block's current sequence size
|-
| 13-16
| [[#SEQ|SEQ]] block's current instruction address
|-
| 17
| [[#SEQ|SEQ]] block's current instruction is valid
|-
| 18
| [[#SEQ|SEQ]] block is running in HS mode
|-
| 19-22
| [[#LOAD|LOAD]] block's pipeline size
|-
| 23
| [[#LOAD|LOAD]] block's current operation is valid
|-
| 24
| [[#LOAD|LOAD]] block is running in HS mode
|-
| 25-26
| [[#STORE|STORE]] block's pipeline size
|-
| 30
| [[#STORE|STORE]] block's current operation is valid
|-
| 31
| [[#STORE|STORE]] block is running in HS mode
|}

Used for debugging the [[#LOAD|LOAD]], [[#STORE|STORE]] and [[#SEQ|SEQ]] blocks.

=== TSEC_SCP_DBG1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| [[#SEQ|SEQ]] block's current instruction's first operand
|-
| 4-9
| [[#SEQ|SEQ]] block's current instruction's second operand
|-
| 10-14
| [[#SEQ|SEQ]] block's current instruction's opcode
|}

Used for retrieving debug data. Contains information on the last crypto sequence created when debugging the SEQ controller.

=== TSEC_SCP_DBG2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| [[#SEQ|SEQ]] block's state
0: Idle
1: Recording is active (cs0begin/cs1begin)
|-
| 4-7
| Number of [[#SEQ|SEQ]] block's instructions left
|-
| 12-15
| Active crypto key register
|}

Used for retrieving additional debug data associated with the [[#SEQ|SEQ]] block.

=== TSEC_SCP_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Destination register
|-
| 8-13
| Source register or immediate value
|-
| 20-24
| Command opcode
0x0: nop (fuc5 opcode 0x00)
0x1: cmov (fuc5 opcode 0x84)
0x2: cxsin (fuc5 opcode 0x88) or xdst (with cxset)
0x3: cxsout (fuc5 opcode 0x8C) or xdld (with cxset)
0x4: crnd (fuc5 opcode 0x90)
0x5: cs0begin (fuc5 opcode 0x94)
0x6: cs0exec (fuc5 opcode 0x98)
0x7: cs1begin (fuc5 opcode 0x9C)
0x8: cs1exec (fuc5 opcode 0xA0)
0x9: invalid (fuc5 opcode 0xA4)
0xA: cchmod (fuc5 opcode 0xA8)
0xB: cxor (fuc5 opcode 0xAC)
0xC: cadd (fuc5 opcode 0xB0)
0xD: cand (fuc5 opcode 0xB4)
0xE: crev (fuc5 opcode 0xB8)
0xF: cprecmac (fuc5 opcode 0xBC)
0x10: csecret (fuc5 opcode 0xC0)
0x11: ckeyreg (fuc5 opcode 0xC4)
0x12: ckexp (fuc5 opcode 0xC8)
0x13: ckrexp (fuc5 opcode 0xCC)
0x14: cenc (fuc5 opcode 0xD0)
0x15: cdec (fuc5 opcode 0xD4)
0x16: csigcmp (fuc5 opcode 0xD8)
0x17: csigenc (fuc5 opcode 0xDC)
0x18: csigclr (fuc5 opcode 0xE0)
|-
| 28
| [[#CMD|CMD]] block's current instruction is valid
|-
| 31
| [[#CMD|CMD]] block is running in HS mode
|}

Contains information on the last crypto command executed.

=== TSEC_SCP_STAT0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| [[#SCP|SCP]] is active
|-
| 2
| [[#CMD|CMD]] block's interface is active
|-
| 4
| [[#STORE|STORE]] block's interface is active
|-
| 6
| [[#SEQ|SEQ]] block is active
|-
| 8
| [[#CTL|CTL]] block is active
|-
| 10
| [[#LOAD|LOAD]] block's interface is active
|-
| 14
| [[#AES|AES]] block is active
|-
| 16
| [[#RNG|RNG]] block is active
|}

Contains the status of the hardware blocks and interfaces.

=== TSEC_SCP_STAT1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| Signature comparison result
0: None
1: Running
2: Failed
3: Succeeded
|-
| 4
| [[#LOAD|LOAD]] block's interface is running in HS mode
|-
| 6
| [[#LOAD|LOAD]] block's interface is ready
|-
| 8
| [[#STORE|STORE]] block's interface is running in HS mode
|-
| 10
| [[#STORE|STORE]] block's interface received a valid operation
|-
| 12
| [[#CMD|CMD]] block's interface is running in HS mode
|-
| 14
| [[#CMD|CMD]] block's interface received a valid instruction
|}

Contains the status of the last authentication attempt and other miscellaneous statuses.

=== TSEC_SCP_STAT2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-4
| Current [[#SEQ|SEQ]] block opcode
|-
| 5-9
| Current [[#CMD|CMD]] block's interface opcode
|-
| 10-14
| Pending [[#CMD|CMD]] block opcode
|-
| 15-16
| Current [[#AES|AES]] block operation
0: Encryption
1: Decryption
2: Key expansion
3: Key reverse expansion
|-
| 24
| Unknown
|-
| 25
| [[#STORE|STORE]] block is stalled
|-
| 26
| [[#LOAD|LOAD]] block is stalled
|-
| 27
| [[#RNG|RNG]] block is stalled
|-
| 28
| Unknown
|-
| 29
| [[#AES|AES]] block is stalled
|}

Contains the status of crypto operations.

=== TSEC_SCP_RNG_STAT0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| [[#RND|RND]] block is ready
|-
| 4-7
| Unknown
|-
| 8-11
| Unknown
|-
| 16
| Unknown
|-
| 20
| Unknown
|}

=== TSEC_SCP_RNG_STAT1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| Unknown
|-
| 16-31
| Unknown
|}

=== TSEC_SCP_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| [[#RND|RND]] ready
|-
| 8
| ACL error
|-
| 12
| SEC error
|-
| 16
| [[#CMD|CMD]] error
|-
| 20
| Single step
|-
| 24
| [[#RND|RND]] operation
|-
| 28
| Timeout
|}

Used for getting the status of crypto IRQs.

=== TSEC_SCP_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| [[#RND|RND]] ready
|-
| 8
| ACL error
|-
| 12
| SEC error
|-
| 16
| [[#CMD|CMD]] error
|-
| 20
| Single step
|-
| 24
| [[#RND|RND]] operation
|-
| 28
| Timeout
|}

Used for getting the value of the mask for crypto IRQs.

=== TSEC_SCP_ACL_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Writing to a crypto register without the correct ACL
|-
| 4
| Reading from a crypto register without the correct ACL
|-
| 8
| Invalid ACL change (cchmod)
|-
| 31
| ACL error occurred
|}

Contains information on errors generated by the [[#TSEC_SCP_IRQSTAT|ACL error]] IRQ.

=== TSEC_SCP_SEC_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Unknown
|-
| 1-2
| Unknown
|-
| 4
| Unknown
|-
| 5-6
| Unknown
|-
| 16
| Unknown
|-
| 17-18
| Unknown
|-
| 20
| Unknown
|-
| 21-22
| Unknown
|-
| 24
| Unknown
|-
| 25-26
| Unknown
|-
| 31
| SEC error occurred
|}

=== TSEC_SCP_CMD_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Invalid [[#CMD|CMD]] command
|-
| 4
| Empty [[#SEQ|SEQ]] sequence
|-
| 8
| [[#SEQ|SEQ]] sequence is too long
|-
| 12
| [[#SEQ|SEQ]] sequence was not finished
|-
| 16
| Forbidden signature operation (csigcmp, csigenc or csigclr in NS mode)
|-
| 20
| Invalid signature operation (csigcmp in HS mode)
|-
| 24
| Forbidden ACL change (cchmod in NS mode)
|}

Contains information on errors generated by the [[#TSEC_SCP_IRQSTAT|CMD error]] IRQ.

=== TSEC_SCP_RND_CTL0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| [[#RND|RND]] clock trigger lower limit
|}

=== TSEC_SCP_RND_CTL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| [[#RND|RND]] clock trigger upper limit
|-
| 16-31
| [[#RND|RND]] clock trigger mask
|}

=== TSEC_TFBIF_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_CTL_CLR_BWCOUNT
|-
| 1
| TSEC_TFBIF_CTL_ENABLE
|-
| 2
| TSEC_TFBIF_CTL_CLR_IDLEWDERR
|-
| 3
| TSEC_TFBIF_CTL_RESET
|-
| 4
| TSEC_TFBIF_CTL_IDLE
|-
| 5
| TSEC_TFBIF_CTL_IDLEWDERR
|-
| 6
| TSEC_TFBIF_CTL_SRTOUT
|-
| 7
| TSEC_TFBIF_CTL_CLR_SRTOUT
|-
| 8-11
| TSEC_TFBIF_CTL_SRTOVAL
|-
| 12
| TSEC_TFBIF_CTL_VPR
|}

=== TSEC_TFBIF_MCCIF_FIFOCTRL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
|-
| 1
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
|-
| 2
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
|-
| 3
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
|-
| 4
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
|-
| 5
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
|-
| 6
| TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
|-
| 7
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
|-
| 8
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE
|}

=== TSEC_TFBIF_THROTTLE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-11
| TSEC_TFBIF_THROTTLE_BUCKET_SIZE
|-
| 16-27
| TSEC_TFBIF_THROTTLE_LEAK_COUNT
|-
| 30-31
| TSEC_TFBIF_THROTTLE_LEAK_SIZE
|}

=== TSEC_TFBIF_DBG_STAT0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_DBG_STAT0_1K_TRANSFER
|-
| 1
| TSEC_TFBIF_DBG_STAT0_RREQ_ISSUED
|-
| 2
| TSEC_TFBIF_DBG_STAT0_WREQ_ISSUED
|-
| 3
| TSEC_TFBIF_DBG_STAT0_TAGQ_ISSUED
|-
| 4
| TSEC_TFBIF_DBG_STAT0_STALL_RDATQ
|-
| 5
| TSEC_TFBIF_DBG_STAT0_STALL_RACKQ
|-
| 6
| TSEC_TFBIF_DBG_STAT0_STALL_WREQQ
|-
| 7
| TSEC_TFBIF_DBG_STAT0_STALL_WDATQ
|-
| 8
| TSEC_TFBIF_DBG_STAT0_STALL_WACKQ
|-
| 9
| TSEC_TFBIF_DBG_STAT0_STALL_RREQ_PENDING
|-
| 10
| TSEC_TFBIF_DBG_STAT0_STALL_WREQ_PENDING
|-
| 11
| TSEC_TFBIF_DBG_STAT0_STALL_MREQ
|-
| 12
| TSEC_TFBIF_DBG_STAT0_ENGINE_IDLE
|-
| 13
| TSEC_TFBIF_DBG_STAT0_RMCCIF_IDLE
|-
| 14
| TSEC_TFBIF_DBG_STAT0_WMCCIF_IDLE
|-
| 15
| TSEC_TFBIF_DBG_STAT0_CSB_IDLE
|-
| 16
| TSEC_TFBIF_DBG_STAT0_RU_IDLE
|-
| 17
| TSEC_TFBIF_DBG_STAT0_WU_IDLE
|-
| 19
| TSEC_TFBIF_DBG_STAT0_UNWEIGHT_ACTMON_ACTIVE
|-
| 20
| TSEC_TFBIF_DBG_STAT0_UNWEIGHT_ACTMON_MCB
|}

=== TSEC_TFBIF_DBG_STAT1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_TFBIF_DBG_STAT1_DATA
|}

=== TSEC_TFBIF_DBG_RDCOUNT_LO ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_TFBIF_DBG_RDCOUNT_LO_DATA
|}

=== TSEC_TFBIF_DBG_RDCOUNT_HI ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_TFBIF_DBG_RDCOUNT_HI_DATA
|}

=== TSEC_TFBIF_DBG_WRCOUNT_LO ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_TFBIF_DBG_WRCOUNT_LO_DATA
|}

=== TSEC_TFBIF_DBG_WRCOUNT_HI ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_TFBIF_DBG_WRCOUNT_HI_DATA
|}

=== TSEC_TFBIF_DBG_R32COUNT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_TFBIF_DBG_R32COUNT_DATA
|}

=== TSEC_TFBIF_DBG_R64COUNT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_TFBIF_DBG_R64COUNT_DATA
|}

=== TSEC_TFBIF_DBG_R128COUNT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_TFBIF_DBG_R128COUNT_DATA
|}

=== TSEC_TFBIF_MCCIF_FIFOCTRL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
|-
| 16-31
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT
|}

=== TSEC_TFBIF_WRR_RDP ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_TFBIF_WRR_RDP_EXT_WEIGHT
|-
| 16-31
| TSEC_TFBIF_WRR_RDP_INT_WEIGHT
|}

=== TSEC_TFBIF_SPROT_EMEM ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Read access level
|-
| 4-7
| Write access level
|}

Controls accesses to external memory regions. Accessible in HS mode only.

=== TSEC_TFBIF_TRANSCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_TRANSCFG_ATT0_SWID
|-
| 4
| TSEC_TFBIF_TRANSCFG_ATT1_SWID
|-
| 8
| TSEC_TFBIF_TRANSCFG_ATT2_SWID
|-
| 12
| TSEC_TFBIF_TRANSCFG_ATT3_SWID
|-
| 16
| TSEC_TFBIF_TRANSCFG_ATT4_SWID
|-
| 20
| TSEC_TFBIF_TRANSCFG_ATT5_SWID
|-
| 24
| TSEC_TFBIF_TRANSCFG_ATT6_SWID
|-
| 28
| TSEC_TFBIF_TRANSCFG_ATT7_SWID
|}

Configures the software ID per CTXDMA port for memory transactions. Software ID 0 (HW_SWID) forces all transactions to go through the SMMU while software ID 1 (PHY_SWID) bypasses it. Accessible in HS mode only.

[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.

=== TSEC_TFBIF_REGIONCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-2
| TSEC_TFBIF_REGIONCFG_T0_APERT_ID
|-
| 3
| TSEC_TFBIF_REGIONCFG_T0_VPR
|-
| 4-6
| TSEC_TFBIF_REGIONCFG_T1_APERT_ID
|-
| 7
| TSEC_TFBIF_REGIONCFG_T1_VPR
|-
| 8-10
| TSEC_TFBIF_REGIONCFG_T2_APERT_ID
|-
| 11
| TSEC_TFBIF_REGIONCFG_T2_VPR
|-
| 12-14
| TSEC_TFBIF_REGIONCFG_T3_APERT_ID
|-
| 15
| TSEC_TFBIF_REGIONCFG_T3_VPR
|-
| 16-18
| TSEC_TFBIF_REGIONCFG_T4_APERT_ID
|-
| 19
| TSEC_TFBIF_REGIONCFG_T4_VPR
|-
| 20-22
| TSEC_TFBIF_REGIONCFG_T5_APERT_ID
|-
| 23
| TSEC_TFBIF_REGIONCFG_T5_VPR
|-
| 24-26
| TSEC_TFBIF_REGIONCFG_T6_APERT_ID
|-
| 27
| TSEC_TFBIF_REGIONCFG_T6_VPR
|-
| 28-30
| TSEC_TFBIF_REGIONCFG_T7_APERT_ID
|-
| 31
| TSEC_TFBIF_REGIONCFG_T7_VPR
|}

Configures the aperture ID and VPR mode per CTXDMA port for memory region accessing. Accessible in HS mode only.

[6.0.0+] The nvhost_tsec firmware sets this register to 0x20 or 0x140 before reading memory from the GPU UCODE carveout.

=== TSEC_TFBIF_ACTMON_ACTIVE_MASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_ACTMON_ACTIVE_MASK_STARVED_MC
|-
| 1
| TSEC_TFBIF_ACTMON_ACTIVE_MASK_STALLED_MC
|-
| 2
| TSEC_TFBIF_ACTMON_ACTIVE_MASK_DELAYED_MC
|-
| 3
| TSEC_TFBIF_ACTMON_ACTIVE_MASK_ACTIVE
|}

Takes the memory access mask for the Activity Monitor. Disconnected on the TSEC.

=== TSEC_TFBIF_ACTMON_ACTIVE_BORPS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_STARVED_MC_POLARITY
|-
| 1
| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_STARVED_MC_OPERATION
|-
| 2
| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_STALLED_MC_POLARITY
|-
| 3
| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_STALLED_MC_OPERATION
|-
| 4
| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_DELAYED_MC_POLARITY
|-
| 5
| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_DELAYED_MC_OPERATION
|-
| 6
| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_ACTIVE_POLARITY
|-
| 7
| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_ACTIVE_OPERATION
|}

Takes the billions of records per second count for the Activity Monitor. Disconnected on the TSEC.

=== TSEC_TFBIF_ACTMON_ACTIVE_WEIGHT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_TFBIF_ACTMON_ACTIVE_WEIGHT_VAL
|}

Controls the Activity Monitor. Disconnected on the TSEC.

=== TSEC_TFBIF_ACTMON_MCB_MASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_ACTMON_MCB_MASK_STARVED_MC
|-
| 1
| TSEC_TFBIF_ACTMON_MCB_MASK_STALLED_MC
|-
| 2
| TSEC_TFBIF_ACTMON_MCB_MASK_DELAYED_MC
|-
| 3
| TSEC_TFBIF_ACTMON_MCB_MASK_ACTIVE
|}

Disconnected on the TSEC.

=== TSEC_TFBIF_ACTMON_MCB_BORPS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_ACTMON_MCB_BORPS_STARVED_MC_POLARITY
|-
| 1
| TSEC_TFBIF_ACTMON_MCB_BORPS_STARVED_MC_OPERATION
|-
| 2
| TSEC_TFBIF_ACTMON_MCB_BORPS_STALLED_MC_POLARITY
|-
| 3
| TSEC_TFBIF_ACTMON_MCB_BORPS_STALLED_MC_OPERATION
|-
| 4
| TSEC_TFBIF_ACTMON_MCB_BORPS_DELAYED_MC_POLARITY
|-
| 5
| TSEC_TFBIF_ACTMON_MCB_BORPS_DELAYED_MC_OPERATION
|-
| 6
| TSEC_TFBIF_ACTMON_MCB_BORPS_ACTIVE_POLARITY
|-
| 7
| TSEC_TFBIF_ACTMON_MCB_BORPS_ACTIVE_OPERATION
|}

Disconnected on the TSEC.

=== TSEC_TFBIF_ACTMON_MCB_WEIGHT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_TFBIF_ACTMON_MCB_WEIGHT_VAL
|}

Disconnected on the TSEC.

=== TSEC_TFBIF_THI_TRANSPROP ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-6
| TSEC_TFBIF_THI_TRANSPROP_STREAMID0
|-
| 8-14
| TSEC_TFBIF_THI_TRANSPROP_STREAMID1
|-
| 16
| TSEC_TFBIF_THI_TRANSPROP_TZ_AUTH
|}

=== TSEC_CG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-5
| TSEC_CG_IDLE_CG_DLY_CNT
|-
| 6
| TSEC_CG_IDLE_CG_EN
|-
| 16-18
| TSEC_CG_WAKEUP_DLY_CNT
|-
| 19
| TSEC_CG_WAKEUP_DLY_EN
|}

=== TSEC_BAR0_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_BAR0_CTL_READ
|-
| 1
| TSEC_BAR0_CTL_WRITE
|-
| 4-7
| TSEC_BAR0_CTL_BYTE_MASK
|-
| 12-13
| TSEC_BAR0_CTL_STATUS
0: Idle
1: Busy
2: Error
3: Disabled
|-
| 16-17
| TSEC_BAR0_CTL_SEC_MODE
0: None
1: Invalid
2: Light Secure
3: Heavy Secure
|-
| 31
| TSEC_BAR0_CTL_INIT
|}

Controls DMA transfers between TSEC and HOST1X (master and clients).

Starting a transfer over BAR0 automatically sets TSEC_BAR0_CTL_SEC_MODE to the current Falcon security mode. Once set, any attempts to start a transfer from a lower security level will fail.

=== TSEC_BAR0_ADDR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_BAR0_ADDR_VAL
|}

Takes the address for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_BAR0_DATA ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_BAR0_DATA_VAL
|}

Takes the data for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_BAR0_TIMEOUT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_BAR0_TIMEOUT_VAL
|}

Takes the timeout value for DMA transfers between TSEC and HOST1X (master and clients).

=== TSEC_TEGRA_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 16
| TSEC_TEGRA_CTL_TKFI_KFUSE
|-
| 17
| TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
|-
| 24
| TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
|-
| 25
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
|-
| 26
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
|-
| 27
| TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C
|}

== Falcon ==
"Falcon" (FAst Logic CONtroller) is a proprietary general purpose CPU which can be found inside various hardware blocks that require some sort of logic processing such as TSEC (TSECA and TSECB), NVDEC, NVENC, NVJPG, VIC, GPU PMU and XUSB.

=== Processor Registers ===
A total of 32 processor registers are available in the Falcon CPU.

==== REG0-REG15 ====
These are 16 32-bit GPRs (general purpose registers).

==== IV0 ====
This is a SPR (special purpose register) that holds the address for interrupt vector 0. Only bits 0 to 15 are used.

==== IV1 ====
This is a SPR (special purpose register) that holds the address for interrupt vector 1. Only bits 0 to 15 are used.

==== IV2 ====
This is a SPR (special purpose register) that holds the address for interrupt vector 2. This register is considered "UNDEFINED" and appears to be unused.

==== EV ====
This is a SPR (special purpose register) that holds the address for the exception vector. Only bits 0 to 15 are used.

Alternative name (envytools): "tv".

==== SP ====
This is a SPR (special purpose register) that holds the current stack pointer. Only bits 0 to 15 are used.

==== PC ====
This is a SPR (special purpose register) that holds the current program counter. Only bits 0 to 15 are used.

==== IMB ====
This is a SPR (special purpose register) that holds the external base address for IMEM transfers.

Alternative name (envytools): "xcbase".

==== DMB ====
This is a SPR (special purpose register) that holds the external base address for DMEM transfers.

Alternative name (envytools): "xdbase".

==== CSW ====
This is a SPR (special purpose register) that holds various flag bits.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7 || General purpose predicates
|-
| 8 || ALU carry flag
|-
| 9 || ALU signed overflow flag
|-
| 10 || ALU sign flag
|-
| 11 || ALU zero flag
|-
| 16 || Interrupt 0 enable
|-
| 17 || Interrupt 1 enable
|-
| 18 || Interrupt 2 enable (undefined)
|-
| 20 || Interrupt 0 saved enable
|-
| 21 || Interrupt 1 saved enable
|-
| 22 || Interrupt 2 saved enable (undefined)
|-
| 24 || Exception active
|-
| 26-31 || Unknown
|}

Alternative name (envytools): "flags".

==== CCR ====
This is a SPR (special purpose register) that holds configuration bits for the SCP DMA override functionality. The value of this register is set using the "cxset" instruction which provides a way to change the behavior of a variable amount of successively executed DMA-related instructions ("xdwait", "xdst" and "xdld").

{| class=wikitable
! Bits || Description
|-
| 0-4 || Number of instructions the override is valid for (0x1F means infinite)
|-
| 5 || Crypto source/destination select
0: Crypto register
1: Crypto stream
|-
| 6 || Bypass mode
0: Disabled
1: Enabled
|-
| 7 || Internal memory select
0: DMEM
1: IMEM
|}

Alternative name (envytools): "cx".

==== SEC ====
This is a SPR (special purpose register) that holds configuration bits for the SCP authentication process.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7 || Start of region to authenticate (in pages of 0x100 bytes)
|-
| 16 || Force secure DMA transfers
|-
| 17 || Decrypt region to authenticate
|-
| 18 || Signature check passed
|-
| 19 || Suppress interrupts and exceptions
|-
| 24-31 || Size of region to authenticate (in pages of 0x100 bytes)
|}

Alternative name (envytools): "cauth".

==== CTX ====
This is a SPR (special purpose register) that holds configuration bits for the CTXDMA ports.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-2 || CTXDMA port for code loads (xcld)
|-
| 4-6 || CTXDMA port for code stores (invalid)
|-
| 8-10 || CTXDMA port for data loads (xdld)
|-
| 12-14 || CTXDMA port for data stores (xdst)
|}

Alternative name (envytools): "xtargets".

==== EXCI ====
This is a SPR (special purpose register) that holds information on raised exceptions.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-19 || Exception PC
|-
| 20-23 || Exception cause
|}

Alternative name (envytools): "tstatus".

==== SEC1 ====
Unknown. Marked as "RESERVED".

==== IMB1 ====
Unknown. Marked as "RESERVED".

==== DMB1 ====
Unknown. Marked as "RESERVED".

=== Heavy Secure Mode ===
==== Entry ====
From non-secure mode, upon jumping to a page marked as secret, a secret fault occurs. This causes the CPU to verify the region specified in $cauth against the MAC loaded in $c6. If the comparison is successful, the valid bit (bit0) is set on all pages in the $cauth region, and $pc is set to the base of the $cauth region. If the comparsion fails, the CPU is halted.

==== Exit ====
The CPU automatically goes back to non-secure mode when returning back into non-secret pages. When this happens, the valid bit (bit0) in the TLB flags is cleared for all secret pages.

==== Implementation ====
Under certain circumstances, it is possible to observe [[#sigcmp|sigcmp]] being briefly written to [[#TSEC_SCP_CMD|TSEC_SCP_CMD]] as "csigcmp $c4 $c6" while the opcodes in [[#TSEC_SCP_STAT2|TSEC_SCP_STAT2]] are set to "cxsin" and "csigcmp", respectively.

Via [[#TSEC_SCP_DBG0|TSEC_SCP_DBG0]] it can be observed that a 3-sized macro sequence is loaded into cs0 during a secure mode transition.

== SCP ==
"SCP" (Secure Co-Processor) is a proprietary coprocessor which can be found inside every [[#Falcon|Falcon]] that supports [[#Heavy_Secure_Mode|Heavy Secure Mode]]. On the Tegra X1 these are TSECA, TSECB, NVDEC and the GPU's PMU.

=== Hardware ===
SCP is subdivided into several specialized hardware blocks and interfaces.

==== LOAD ====
Block for handling memory reads from SCP to Falcon. It communicates with Falcon over a dedicated interface.

The interface can be enabled or disabled by register [[#TSEC_SCP_CTL0|TSEC_SCP_CTL0]].

==== STORE ====
Block for handling memory writes from Falcon to SCP. It communicates with Falcon over a dedicated interface.

The interface can be enabled or disabled by register [[#TSEC_SCP_CTL0|TSEC_SCP_CTL0]].

==== CMD ====
Block for translating Falcon crypto operands into SCP commands. It communicates with Falcon over a dedicated interface.

The interface can be enabled or disabled by register [[#TSEC_SCP_CTL0|TSEC_SCP_CTL0]]. The status of the current command is reported through register [[#TSEC_SCP_CMD|TSEC_SCP_CMD]].

==== SEQ ====
Block for recording and executing sequences of crypto operations in the form of macros.

Can be enabled or disabled by register [[#TSEC_SCP_CTL0|TSEC_SCP_CTL0]].

==== CTL ====
Overseer block for controlling certain SCP features.

Can be enabled or disabled by register [[#TSEC_SCP_CTL0|TSEC_SCP_CTL0]].

Registers [[#TSEC_SCP_CTL_STAT|TSEC_SCP_CTL_STAT]], [[#TSEC_SCP_CTL_LOCK|TSEC_SCP_CTL_LOCK]], [[#TSEC_SCP_CTL_SCP|TSEC_SCP_CTL_SCP]], [[#TSEC_SCP_CTL_PKEY|TSEC_SCP_CTL_PKEY]] and [[#TSEC_SCP_CTL_DBG|TSEC_SCP_CTL_DBG]] refer to this block.

==== AES ====
Block for providing AES-128-ECB functionality.

==== RNG ====
Block for encapsulating and controlling the internal random number generator.

Can be enabled or disabled by register [[#TSEC_SCP_CTL1|TSEC_SCP_CTL1]] and reports the status of the internal random number generator through registers [[#TSEC_SCP_RNG_STAT0|TSEC_SCP_RNG_STAT0]] and [[#TSEC_SCP_RNG_STAT1|TSEC_SCP_RNG_STAT1]].

===== RND =====
Internal random number generator.

Can be configured by the [[#TSEC_SCP_RND_CTL0|TSEC_SCP_RND_CTLx]] registers.

=== Operations ===
{| class="wikitable" border="1"
! Opcode
! Name
! Operand0
! Operand1
! Operation
! Condition
|-
| 0 || nop || N/A || N/A || ||
|-
| 1 || mov || $cX || $cY || <code>$cX = $cY; ACL(X) = ACL(Y);</code> ||
|-
| 2 || sin || $cX || N/A || <code>$cX = read_stream(); ACL(X) = ???;</code> ||
|-
| 3 || sout || $cX || N/A || <code>write_stream($cX);</code> || ?
|-
| 4 || [[#rnd|rnd]] || $cX || N/A || <code>$cX = read_rnd(); ACL(X) = ???;</code> ||
|-
| 5 || s0begin || immX || N/A || <code>record_macro_for_N_instructions(0, immX);</code> ||
|-
| 6 || s0exec || immX || N/A || <code>execute_macro_N_times(0, immX);</code> ||
|-
| 7 || s1begin || immX || N/A || <code>record_macro_for_N_instructions(1, immX);</code> ||
|-
| 8 || s1exec || immX || N/A || <code>execute_macro_N_times(1, immX);</code> ||
|-
| 9 || <invalid> || || || ||
|-
| 0xA || [[#chmod|chmod]] || $cX || immY || Complicated, see [[#ACL|ACL]]. ||
|-
| 0xB || xor || $cX || $cY || <code>$cX ^= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xC || add || $cX || immY || <code>$cX += immY;</code> || <code>(ACL(X) & 2)</code>
|-
| 0xD || and || $cX || $cY || <code>$cX &= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xE || rev || $cX || $cY || <code>$cX = endian_swap128($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0xF || gfmul || $cX || $cY || <code>$cX = gfmul($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 2)</code>
|-
| 0x10 || secret || $cX || immY || <code>$cX = load_secret(immY); ACL(X) = load_secret_acl(immY);</code> ||
|-
| 0x11 || keyreg || immX || N/A || <code>active_key_idx = immX;</code> ||
|-
| 0x12 || kexp || $cX || $cY || <code>$cX = aes_kexp($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0x13 || krexp || $cX || $cY || <code>$cX = aes_kexp_reverse($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0x14 || enc || $cX || $cY || <code>$cX = aes_enc(active_key_idx, $cY); ACL(X) = ACL(active_key_idx) & ACL(Y);</code> ||
|-
| 0x15 || dec || $cX || $cY || <code>$cX = aes_dec(active_key_idx, $cY); ACL(X) = ACL(active_key_idx) & ACL(Y);</code> ||
|-
| 0x16 || [[#sigcmp|sigcmp]] || $cX || $cY || <code>if (hash_verify($cX, $cY)) { has_sig = true; current_sig = $cX; }</code> || ?
|-
| 0x17 || sigenc || $cX || $cY || <code>if (has_sig) { $cX = aes_enc($cY, current_sig); ACL(X) = 0x13; }</code> ||
|-
| 0x18 || [[#sigclr|sigclr]] || N/A || N/A || <code>has_sig = false;</code> ||
|}

==== sigcmp ====
<code>00000000: f5 3c XY d8 csigcmp $cY $cX</code>

Takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret. This instruction does not work in secure mode.

==== sigclr ====
<code>00000000: f5 3c 00 e0 csigclr</code>

This instruction takes no operands and clears the saved cauth signature used by the csigenc instruction.

==== chmod ====
<code>00000000: f5 3c XY a8 cchmod $cY 0X</code> or <code>00000000: f5 3c XY a9 cchmod $cY 1X</code>

This instruction takes a crypto register and a 5 bit immediate value which represents the [[#ACL|ACL]] mask to set.

==== rnd ====
<code>00000000: f5 3c 0X 90 crnd $cX</code>

This instruction initializes a crypto register with random data.

Executing this instruction only succeeds if the RNG controller is enabled for the SCP, which requires taking the following steps:
* Write 0x7FFF to [[#TSEC_SCP_RND_CTL0|TSEC_SCP_RND_CTL0]].
* Write 0x3FF0000 to [[#TSEC_SCP_RND_CTL1|TSEC_SCP_RND_CTL1]].
* Write 0xFF00 to TSEC_SCP_RND_CTL11.
* Write 0x1000 to [[#TSEC_SCP_CTL1|TSEC_SCP_CTL1]].

Otherwise it hangs forever.

=== ACLs ===
Each crypto register has an associated access control list with the following format:

{| class="wikitable" border="1"
! Bit
! Description
|-
| 0 || Secure key. Forced set if bit1 is set. Once cleared, cannot be set again.
|-
| 1 || Secure readable. Once cleared, cannot be set again.
|-
| 2 || Insecure key. Forced set if bit3 is set. Forced clear if bit0 is clear. Can be toggled back and forth.
|-
| 3 || Insecure readable. Forced clear if bit1 is clear. Can be toggled back and forth.
|-
| 4 || Insecure overwritable. Can be toggled back and forth.
|}

On boot, the ACL is 0x1F for all $cX.

Loading into $cX using xdst instruction sets ACL($cX) to 0x13 and 0x1F, for secure and insecure mode respectively.

Spilling a $cX to DMEM using xdld instruction is allowed if (ACL($cX) & 2) or (ACL($cX) & 8), for secure and insecure mode respectively.

Loading a secret into $cX sets a per-secret ACL, unconditionally.

=== Secrets ===
[[#Heavy_Secure_Mode|Heavy Secure Mode]] has access to 64 128-bit keys which are burned at factory. These keys can be loaded using the $csecret instruction which takes the target crypto register and the key index as arguments.

Secrets are specific to each Falcon unit with the exception of secret 0x3F. This secret is effectively empty (all zeros), but is configured to be overwritten with the KFUSE private key once the KFUSE clock is enabled. The KFUSE private key is console-unique.

{| class=wikitable
! Index || ACL || Description
|-
| 0x00 || 0x13 || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares.
|-
| 0x01 || 0x10 || Used by Falcon's Secure Boot ROM for the signature generation algorithm.
|-
| 0x02 || 0x10 ||
|-
| 0x03 || 0x11 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|-
| 0x04 || 0x10 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|-
| 0x05 || 0x13 || Used by nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares.
|-
| 0x06 || 0x11 || Used by Falcon's Secure Boot ROM as key to decrypt data during authentication (decided by bit 17 in the [[#SEC|SEC]] register).
|-
| 0x07 || 0x11 || Used by [6.0.0+] nvhost_tsec firmware.
|-
| 0x08 || 0x10 ||
|-
| 0x09 || 0x13 || Used by nvhost_tsec firmware.
|-
| 0x0A || 0x11 ||
|-
| 0x0B || 0x10 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|-
| 0x0C || 0x13 ||
|-
| 0x0D || 0x11 ||
|-
| 0x0E || 0x10 ||
|-
| 0x0F || 0x13 || Used by nvhost_tsec firmware.
|-
| 0x10 || 0x11 || Used by [1.0.0-5.1.0] nvhost_tsec firmware.
|-
| 0x11 || 0x10 ||
|-
| 0x12 || 0x13 ||
|-
| 0x13 || 0x11 ||
|-
| 0x14 || 0x10 ||
|-
| 0x15 || 0x13 || Used by nvhost_nvdec_bl020_prod, [5.0.0+] nvhost_nvdec020_prod, [5.0.0+] nvhost_nvdec020_ns and [6.0.0+] nvhost_tsec firmwares.
|-
| 0x16 || 0x11 ||
|-
| 0x17 || 0x10 ||
|-
| 0x18 || 0x13 ||
|-
| 0x19 || 0x11 ||
|-
| 0x1A || 0x10 ||
|-
| 0x1B || 0x13 ||
|-
| 0x1C || 0x11 ||
|-
| 0x1D || 0x10 ||
|-
| 0x1E || 0x13 ||
|-
| 0x1F || 0x11 ||
|-
| 0x20 || 0x10 ||
|-
| 0x21 || 0x13 ||
|-
| 0x22 || 0x11 ||
|-
| 0x23 || 0x10 ||
|-
| 0x24 || 0x13 ||
|-
| 0x25 || 0x11 ||
|-
| 0x26 || 0x10 || Used by [[TSEC_Firmware#KeygenLdr|KeygenLdr]] and [[TSEC_Firmware#SecureBoot|SecureBoot]]
|-
| 0x27 || 0x13 ||
|-
| 0x28 || 0x11 ||
|-
| 0x29 || 0x10 ||
|-
| 0x2A || 0x13 ||
|-
| 0x2B || 0x11 ||
|-
| 0x2C || 0x10 ||
|-
| 0x2D || 0x13 ||
|-
| 0x2E || 0x11 ||
|-
| 0x2F || 0x10 ||
|-
| 0x30 || 0x13 ||
|-
| 0x31 || 0x11 ||
|-
| 0x32 || 0x10 ||
|-
| 0x33 || 0x13 ||
|-
| 0x34 || 0x11 ||
|-
| 0x35 || 0x10 ||
|-
| 0x36 || 0x13 ||
|-
| 0x37 || 0x11 ||
|-
| 0x38 || 0x10 ||
|-
| 0x39 || 0x13 ||
|-
| 0x3A || 0x11 ||
|-
| 0x3B || 0x10 ||
|-
| 0x3C || 0x13 || Used by nvhost_tsec firmware.
|-
| 0x3D || 0x11 ||
|-
| 0x3E || 0x10 ||
|-
| 0x3F || 0x10 || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|}

TSEC Firmware

2020-08-19T19:08:14Z

Vale:

= Boot Process =
TSEC is configured and initialized by the first bootloader during key generation.

[6.2.0+] TSEC is now configured at the end of the first bootloader's main function.

== Initialization ==
During this stage several clocks are programmed.
<pre>
// Program the HOST1X clock and resets
// Uses RST_DEVICES_L, CLK_OUT_ENB_L, CLK_SOURCE_HOST1X and CLK_L_HOST1X
enable_host1x_clkrst();

// Program the TSEC clock and resets
// Uses RST_DEVICES_U, CLK_OUT_ENB_U, CLK_SOURCE_TSEC and CLK_U_TSEC
enable_tsec_clkrst();

// Program the SOR_SAFE clock and resets
// Uses RST_DEVICES_Y, CLK_OUT_ENB_Y and CLK_Y_SOR_SAFE
enable_sor_safe_clkrst();

// Program the SOR0 clock and resets
// Uses RST_DEVICES_X, CLK_OUT_ENB_X and CLK_X_SOR0
enable_sor0_clkrst();

// Program the SOR1 clock and resets
// Uses RST_DEVICES_X, CLK_OUT_ENB_X, CLK_SOURCE_SOR1 and CLK_X_SOR1
enable_sor1_clkrst();

// Program the KFUSE clock resets
// Uses RST_DEVICES_H, CLK_OUT_ENB_H and CLK_H_KFUSE
enable_kfuse_clkrst();
</pre>

== Configuration ==
In this stage the Falcon IRQs, interfaces and DMA engine are configured.
<pre>
// Clear the Falcon DMA control register
*(u32 *)FALCON_DMACTL = 0;

// Enable Falcon IRQs
*(u32 *)FALCON_IRQMSET = 0xFFF2;

// Enable Falcon IRQs
*(u32 *)FALCON_IRQDEST = 0xFFF0;

// Enable Falcon interfaces
*(u32 *)FALCON_ITFEN = 0x03;

// Wait for Falcon's DMA engine to be idle
wait_flcn_dma_idle();
</pre>

== Firmware loading ==
The Falcon firmware code is stored in the first bootloader's data segment in IMEM.
<pre>
// Set DMA transfer base address to 0x40011900 >> 0x08
*(u32 *)FALCON_DMATRFBASE = 0x400119;

u32 trf_mode = 0; // A value of 0 sets FALCON_DMATRFCMD_IMEM
u32 dst_offset = 0;
u32 src_offset = 0;

// Load code into Falcon (0x100 bytes at a time)
while (src_offset < 0xF00)
{
flcn_load_firm(trf_mode, src_offset, dst_offset);
src_offset += 0x100;
dst_offset += 0x100;
}
</pre>

[6.2.0+] The transfer base address and size of the Falcon firmware code changed.
<pre>
// Set DMA transfer base address to 0x40010E00 >> 0x08
*(u32 *)FALCON_DMATRFBASE = 0x40010E;

u32 trf_mode = 0; // A value of 0 sets FALCON_DMATRFCMD_IMEM
u32 dst_offset = 0;
u32 src_offset = 0;

// Load code into Falcon (0x100 bytes at a time)
while (src_offset < 0x2900)
{
flcn_load_firm(trf_mode, src_offset, dst_offset);
src_offset += 0x100;
dst_offset += 0x100;
}
</pre>

== Firmware booting ==
Falcon is booted up and the first bootloader waits for it to finish.
// Set magic value in host1x scratch space
*(u32 *)0x50003300 = 0x34C2E1DA;

// Clear Falcon scratch1 MMIO
*(u32 *)FALCON_SCRATCH1 = 0;

// Set Falcon boot key version in scratch0 MMIO
*(u32 *)FALCON_SCRATCH0 = 0x01;

// Set Falcon's boot vector address
*(u32 *)FALCON_BOOTVEC = 0;

// Signal Falcon's CPU
*(u32 *)FALCON_CPUCTL = 0x02;

// Wait for Falcon's DMA engine to be idle
wait_flcn_dma_idle();

u32 boot_res = 0;

// The bootloader allows the TSEC two seconds from this point to do its job
u32 maximum_time = read_timer() + 2000000;

while (!boot_res)
{
// Read boot result from scratch1 MMIO
boot_res = *(u32 *)FALCON_SCRATCH1;

// Read from TIMERUS_CNTR_1US (microseconds from boot)
u32 current_time = read_timer();

// Booting is taking too long
if (current_time > maximum_time)
panic();
}

// Invalid boot result was returned
if (boot_res != 0xB0B0B0B0)
panic();
</pre>

[6.2.0+] Falcon is booted up, but the first bootloader is left in an infinite loop.
<pre>
// Set magic value in host1x scratch space
*(u32 *)0x50003300 = 0x34C2E1DA;

// Clear Falcon scratch1 MMIO
*(u32 *)FALCON_SCRATCH1 = 0;

// Set Falcon boot key version in scratch0 MMIO
*(u32 *)FALCON_SCRATCH0 = 0x01;

// Set Falcon's boot vector address
*(u32 *)FALCON_BOOTVEC = 0;

// Signal Falcon's CPU
*(u32 *)FALCON_CPUCTL = 0x02;

// Infinite loop
while (1);
</pre>

== TSEC key generation ==
The TSEC key is generated by reading SOR1 registers modified by the Falcon CPU.
<pre>
// Clear magic value in host1x scratch space
*(u32 *)0x50003300 = 0;

// Read TSEC key
u32 tsec_key[4];
tsec_key[0] = *(u32 *)NV_SOR_DP_HDCP_BKSV_LSB;
tsec_key[1] = *(u32 *)NV_SOR_TMDS_HDCP_BKSV_LSB;
tsec_key[2] = *(u32 *)NV_SOR_TMDS_HDCP_CN_MSB;
tsec_key[3] = *(u32 *)NV_SOR_TMDS_HDCP_CN_LSB;

// Clear SOR1 registers
*(u32 *)NV_SOR_DP_HDCP_BKSV_LSB = 0;
*(u32 *)NV_SOR_TMDS_HDCP_BKSV_LSB = 0;
*(u32 *)NV_SOR_TMDS_HDCP_CN_MSB = 0;
*(u32 *)NV_SOR_TMDS_HDCP_CN_LSB = 0;

if (out_size < 0x10)
out_size = 0x10;

// Copy back the TSEC key
memcpy(out_buf, tsec_key, out_size);
</pre>

[6.2.0+] This is now done inside an encrypted TSEC payload.

== Cleanup ==
Clocks and resets are disabled before returning.
<pre>
// Deprogram KFUSE clock and resets
// Uses RST_DEVICES_H, CLK_OUT_ENB_H and CLK_H_KFUSE
disable_kfuse_clkrst();

// Deprogram SOR1 clock and resets
// Uses RST_DEVICES_X, CLK_OUT_ENB_X, CLK_SOURCE_SOR1 and CLK_X_SOR1
disable_sor1_clkrst();

// Deprogram SOR0 clock and resets
// Uses RST_DEVICES_X, CLK_OUT_ENB_X and CLK_X_SOR0
disable_sor0_clkrst();

// Deprogram SOR_SAFE clock and resets
// Uses RST_DEVICES_Y, CLK_OUT_ENB_Y and CLK_Y_SOR_SAFE
disable_sor_safe_clkrst();

// Deprogram TSEC clock and resets
// Uses RST_DEVICES_U, CLK_OUT_ENB_U, CLK_SOURCE_TSEC and CLK_U_TSEC
disable_tsec_clkrst();

// Deprogram HOST1X clock and resets
// Uses RST_DEVICES_L, CLK_OUT_ENB_L, CLK_SOURCE_HOST1X and CLK_L_HOST1X
disable_host1x_clkrst();
</pre>

= TSEC Firmware =
The actual code loaded into TSEC is assembled in NVIDIA's proprietary fuc5 ISA using crypto extensions.
Stored inside the first bootloader, this firmware binary is split into 4 blobs (names are unofficial): [[#Boot|Boot]] (unencrypted and unauthenticated code), [[#KeygenLdr|KeygenLdr]] (unencrypted and authenticated code), [[#Keygen|Keygen]] (encrypted and authenticated code) and [[#Key data|key data]].

[6.2.0+] There are now 2 new blobs (names are unofficial): [[#SecureBootLdr|SecureBootLdr]] (unencrypted and unauthenticated code), [[#SecureBoot|SecureBoot]] (part unencrypted and unauthenticated code, part encrypted and authenticated code).

Firmware can be disassembled with [http://envytools.readthedocs.io/en/latest/ envytools'] [https://github.com/envytools/envytools/tree/master/envydis envydis]:

<code>envydis -i tsec_fw.bin -m falcon -V fuc5 -F crypt</code>

Note that the instruction set has variable length instructions, and the disassembler is not very good at detecting locations it should start disassembling from. One needs to disassemble multiple sub-regions and join them together.

== Boot ==
During this stage, [[#Key data|key data]] is loaded and [[#KeygenLdr|KeygenLdr]] is authenticated, loaded and executed.
Before returning, this stage writes back to the host (using MMIO registers) and sets the key used by the first bootloader.

[6.2.0+] During this stage, [[#Key data|key data]] is loaded and execution jumps to [[#SecureBootLdr|SecureBootLdr]].

=== Initialization ===
The firmware initially sets up the stack pointer to the end of the available data segment.
<pre>
// Read data segment size from IO space
u32 data_seg_size = *(u32 *)UC_CAPS;
data_seg_size >>= 0x09;
data_seg_size &= 0x1FF;
data_seg_size <<= 0x08;

// Set the stack pointer
*(u32 *)sp = data_seg_size;
</pre>

=== Main ===
The firmware reads the [[#Key data|key data]] blob and then loads, authenticates and executes [[#KeygenLdr|KeygenLdr]] which sets the TSEC key.
<pre>
u32 dmem_start = 0;
u8 key_data_buf[0x7C];

// Read the key data blob from code segment
u32 key_data_addr = 0x300;
u32 key_data_size = 0x7C;
memcpy_i2d(key_data_buf, key_data_addr, key_data_size);

// Read the next stage from code segment into data space
u32 blob1_addr = 0x400;
u32 blob1_size = *(u32 *)(key_data_buf + 0x74);
memcpy_i2d(dmem_start, blob1_addr, blob1_size);

// Upload the next stage into Falcon's code segment
u32 blob1_virt_addr = 0x300;
bool use_secret = true;
memcpy_d2i(blob1_virt_addr, dmem_start, blob1_size, blob1_virt_addr, use_secret);

u32 boot_res = 0;
u32 time = 0;
bool is_blob_dec = false;

while (true)
{
if (time == 4000001)
{
// Write boot failed (timeout) magic to FALCON_SCRATCH1
boot_res = 0xC0C0C0C0;
*(u32 *)FALCON_SCRATCH1 = boot_res;

break;
}

// Load key version from FALCON_SCRATCH0 (bootloader sends 0x01)
u32 key_version = *(u32 *)FALCON_SCRATCH0;

if (key_version == 0x64)
{
// Skip all next stages
boot_res = 0xB0B0B0B0;
*(u32 *)FALCON_SCRATCH1 = boot_res;

break;
}
else
{
if (key_version > 0x03)
boot_res = 0xD0D0D0D0; // Invalid key version
else if (key_version == 0)
boot_res = 0xB0B0B0B0; // No keys used
else
{
u32 key_buf[0x7C];

// Copy key data
memcpy(key_buf, key_data_buf, 0x7C);

u32 crypto_reg_flag = 0x00060000;
u32 blob1_hash_addr = key_buf + 0x20;

// Set auth_addr to 0x300 and auth_size to blob1_size
$cauth = ((blob1_size << 0x10) | 0x03);

// The next 2 xfer instructions will be overridden
// and target changes from DMA to crypto
cxset(0x02);

// Transfer data to crypto register c6
xdst(0, (blob1_hash_addr | crypto_reg_flag));

// Wait for all data loads/stores to finish
xdwait();

// Jump to KeygenLdr
u32 keygenldr_res = exec_keygenldr(key_buf, key_version, is_blob_dec);
is_blob_dec = true; // Set this to prevent decrypting again

// Set boot finish magic on success
if (keygenldr_res == 0)
boot_res = 0xB0B0B0B0
}

// Write result to FALCON_SCRATCH1
*(u32 *)FALCON_SCRATCH1 = boot_res;

if (boot_res == 0xB0B0B0B0)
break;
}

time++;
}

// Overwrite the TSEC key in SOR1 registers
// This has no effect because the KeygenLdr locks out the TSEC DMA engine
tsec_set_key(key_data_buf);

return boot_res;
</pre>

[6.2.0+] The firmware calculates the start address of [[#SecureBootLdr|SecureBootLdr]] through [[#Key data|key data]] and jumps to it.
<pre>
u8 key_data_buf[0x84];

// Read the key data blob
u32 key_data_addr = 0x300;
u32 key_data_size = 0x84;
memcpy_i2d(key_data_buf, key_data_addr, key_data_size);

// Calculate the next blob's address in Falcon code segment
u32 blob4_size = *(u32 *)(key_data_buf + 0x80);
u32 blob0_size = *(u32 *)(key_data_buf + 0x70);
u32 blob1_size = *(u32 *)(key_data_buf + 0x74);
u32 blob2_size = *(u32 *)(key_data_buf + 0x78);
u32 blob3_addr = blob0_size + blob1_size + 0x100 + blob2_size + blob4_size;

// Jump to next blob
(void *)blob3_addr();

return 0;
</pre>

==== tsec_set_key ====
This method takes '''key_data_buf''' (a 16 bytes buffer) as argument and writes its contents to SOR1 registers.
<pre>
// This is TSEC_MMIO + 0x1000 + (0x1C300 / 0x40)
*(u32 *)TSEC_DMA_TIMEOUT = 0xFFF;

// Read the key's words
u32 key0 = *(u32 *)(key_data_buf + 0x00);
u32 key1 = *(u32 *)(key_data_buf + 0x04);
u32 key2 = *(u32 *)(key_data_buf + 0x08);
u32 key3 = *(u32 *)(key_data_buf + 0x0C);

u32 result = 0;

// Write key0 to SOR1 and check for errors
result = tsec_dma_write(NV_SOR_DP_HDCP_BKSV_LSB, key0);
if (result)
return result;

// Write key1 to SOR1 and check for errors
result = tsec_dma_write(NV_SOR_TMDS_HDCP_BKSV_LSB, key1);
if (result)
return result;

// Write key2 to SOR1 and check for errors
result = tsec_dma_write(NV_SOR_TMDS_HDCP_CN_MSB, key2);
if (result)
return result;

// Write key3 to SOR1 and check for errors
result = tsec_dma_write(NV_SOR_TMDS_HDCP_CN_LSB, key3);
if (result)
return result;

return result;
</pre>

===== tsec_dma_write =====
This method takes '''addr''' and '''value''' as arguments and performs a DMA write using TSEC MMIO.
<pre>
u32 result = 0;

// Wait for TSEC DMA engine
// This waits for bit 0x0C in TSEC_DMA_CMD to be 0
result = wait_tsec_dma();

// Wait failed
if (result)
return 1;

// Set the destination address
// This is TSEC_MMIO + 0x1000 + (0x1C100 / 0x40)
*(u32 *)TSEC_DMA_ADDR = addr;

// Set the value
// This is TSEC_MMIO + 0x1000 + (0x1C200 / 0x40)
*(u32 *)TSEC_DMA_VAL = value;

// Start transfer
// This is TSEC_MMIO + 0x1000 + (0x1C000 / 0x40)
*(u32 *)TSEC_DMA_CMD = 0x800000F2;

// Wait for TSEC DMA engine
// This waits for bit 0x0C in TSEC_DMA_CMD to be 0
result = wait_tsec_dma();

// Wait failed
if (result)
return 1;

return 0;
</pre>

== KeygenLdr ==
This stage is responsible for reconfiguring the Falcon's crypto co-processor and loading, decrypting, authenticating and executing [[#Keygen|Keygen]].

=== Main ===
<pre>
// Clear interrupt flags
$flags.ie0 = 0;
$flags.ie1 = 0;
$flags.ie2 = 0;

// Clear overrides
cxset(0x80);

// Clear bit 0x13 in cauth
$cauth = ($cauth & ~(1 << 0x13));

// Set the target port for memory transfers
$xtargets = 0;

// Wait for all data loads/stores to finish
xdwait();

// Wait for all code loads to finish
xcwait();

// The next 2 xfer instructions will be overridden
// and target changes from DMA to crypto
cxset(0x02);

// Transfer data to crypto register c0
// This should clear any leftover data
xdst(0, 0);

// Wait for all data loads/stores to finish
xdwait();

// Clear all crypto registers, except c6 which is used for auth
cxor($c0, $c0);
cmov($c1, $c0);
cmov($c2, $c0);
cmov($c3, $c0);
cmov($c4, $c0);
cmov($c5, $c0);
cmov($c7, $c0);

// Clear TSEC_TEGRA_CTL_TKFI_KFUSE
// This is TSEC_MMIO + 0x1000 + (0x20E00 / 0x40)
*(u32 *)TSEC_TEGRA_CTL &= 0xFFFEFFFF;

// Set TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
// This is TSEC_MMIO + 0x1000 + (0x10600 / 0x40)
*(u32 *)TSEC_SCP_CTL_PKEY |= 0x01;

u32 is_pkey_loaded = 0;

// Wait for TSEC_SCP_CTL_PKEY_LOADED
while (!is_pkey_loaded)
is_pkey_loaded = (*(u32 *)TSEC_SCP_CTL_PKEY & 0x02);

// Read data segment size from IO space
u32 data_seg_size = *(u32 *)UC_CAPS;
data_seg_size >>= 0x09;
data_seg_size &= 0x1FF;
data_seg_size <<= 0x08;

// Check stack bounds
if (($sp >= data_seg_size) || ($sp < 0x800))
exit();

// Load and execute the Keygen stage
load_keygen(key_buf, key_version, is_blob_dec);

// Clear the cauth signature
csigclr();

// Clear all crypto registers
cxor($c0, $c0);
cxor($c1, $c1);
cxor($c2, $c2);
cxor($c3, $c3);
cxor($c4, $c4);
cxor($c5, $c5);
cxor($c6, $c6);
cxor($c7, $c7);

// Take SCP out of lockdown
// This is TSEC_MMIO + 0x1000 + (0x10300 / 0x40)
*(u32 *)TSEC_SCP_CTL_LOCK = 0;

return;
</pre>

==== load_keygen ====
This method takes '''key_buf''', '''key_version''' and '''is_blob_dec''' as arguments and is responsible for loading, decrypting, authenticating and executing [[#Keygen|Keygen]].
Notably, it also does AES-CMAC over the unauthorized [[#Boot|Boot]] blob to make sure it hasn't been tampered with.
<pre>
u32 res = 0;

u32 dmem_start = 0;
u32 blob0_addr = 0;
u32 blob0_size = *(u32 *)(key_buf + 0x70);

// Load blob0 code to the start of the data segment
memcpy_i2d(dmem_start, blob0_addr, blob0_size);

// Generate "CODE_SIG_01" key into c4 crypto register
gen_usr_key(0, 0);

// Encrypt buffer with c4
u8 sig_key[0x10];
enc_buf(sig_key, blob0_size);

u32 src_addr = dmem_start;
u32 src_size = blob0_size;
u32 iv_addr = sig_key;
u32 dst_addr = sig_key;
u32 mode = 0x02; // AES-CMAC
u32 use_imem = 0;

// Do AES-CMAC over blob0 code
do_crypto(src_addr, src_size, iv_addr, dst_addr, mode, use_imem);

// Compare the resulting hash with the one from the key buffer
if (memcmp(dst_addr, key_buf + 0x10, 0x10))
{
res = 0xDEADBEEF;
return res;
}

u32 blob1_size = *(u32 *)(key_buf + 0x74);

// Decrypt Keygen blob if needed
if (!is_blob_dec)
{
// Read Stage2's size from key buffer
u32 blob2_size = *(u32 *)(key_buf + 0x78);

// Check stack bounds
if ($sp > blob2_size)
{
u32 blob2_virt_addr = blob0_size + blob1_size;
u32 blob2_phys_addr = blob2_virt_addr + 0x100;

// Read the encrypted Keygen blob
memcpy_i2d(dmem_start, blob2_phys_addr, blob2_size);

// Generate "CODE_ENC_01" key into c4 crypto register
gen_usr_key(0x01, 0x01);

u32 src_addr = dmem_start;
u32 src_size = blob2_size;
u32 iv_addr = key_buf + 0x40;
u32 dst_addr = dmem_start;
u32 mode = 0; // AES-128-CBC
u32 use_imem = 0;

// Decrypt Keygen blob with AES-128-CBC
do_crypto(src_addr, src_size, iv_addr, dst_addr, mode, use_imem);

// Upload decrypted Keygen into Falcon's code segment
bool use_secret = true;
memcpy_d2i(blob2_virt_addr, dmem_start, blob2_size, blob2_virt_addr, use_secret);

// Clear out the decrypted blob
memset(dmem_start, 0, blob2_size);
}
}

// The next 2 xfer instructions will be overridden
// and target changes from DMA to crypto
cxset(0x02);

u32 crypto_reg_flag = 0x00060000;
u32 blob2_hash_addr = key_buf + 0x30;

// Transfer the Keygen auth hash to crypto register c6
xdst(0, (blob2_hash_addr | crypto_reg_flag));

// Wait for all data loads/stores to finish
xdwait();

// Save previous cauth value
u32 cauth_old = $cauth;

// Set auth_addr to blob2_virt_addr and auth_size to blob2_size
$cauth = ((blob2_virt_addr >> 0x08) | (blob2_size << 0x10));

u32 hovi_key_addr = 0;

// Select next stage key
if (key_version == 0x01) // Use HOVI_EKS_01
hovi_key_addr = key_buf + 0x50;
else if (key_version == 0x02) // Use HOVI_COMMON_01
hovi_key_addr = key_buf + 0x60;
else if (key_version == 0x03) // Use debug key (empty)
hovi_key_addr = key_buf + 0x00;
else
res = 0xD0D0D0D0

// Jump to Keygen
if (hovi_key_addr)
res = exec_keygen(hovi_key_addr, key_version);

// Clear out key data
memset(key_buf, 0, 0x7C);

// Restore previous cauth value
$cauth = cauth_old;

return res;
</pre>

===== gen_usr_key =====
This method takes '''type''' and '''mode''' as arguments and generates a key.
<pre>
u8 seed_buf[0x10];

// Read a 16 bytes seed based on supplied type
/*
type == 0: "CODE_SIG_01" + null padding
type == 1: "CODE_ENC_01" + null padding
*/
get_seed(seed_buf, type);

// This will write the seed into crypto register c0
crypto_store(0, seed_buf);

// Load selected secret into crypto register c1
csecret($c1, 0x26);

// Bind c1 register as the key for enc/dec operations
ckeyreg($c1);

// Encrypt seed_buf in c0 using keyreg value as key into c1
cenc($c1, $c0);

// Encrypt the auth signature (stored in c6) with c1 and store in c1
csigenc($c1, $c1);

// Copy the result to c4 (will be used as key)
cmov($c4, $c1);

// Do key expansion for decryption if necessary
if (mode != 0)
ckexp($c4, $c4);

return;
</pre>

===== enc_buf =====
This method takes '''buf''' (a 16 bytes buffer) and '''size''' as arguments and encrypts the supplied buffer.
<pre>
// Set first 3 words to null
*(u32 *)(buf + 0x00) = 0;
*(u32 *)(buf + 0x04) = 0;
*(u32 *)(buf + 0x08) = 0;

// Swap halves (b16, b32 and b16 again) and store it as the last word
*(u32 *)(buf + 0x0C) = (
((size & 0x000000FF) << 0x08 | (size & 0x0000FF00) >> 0x08) << 0x10
| ((size & 0x00FF0000) >> 0x10) << 0x08
| (size & 0xFF000000) >> 0x18
);

// This will write buf into crypto register c3
crypto_store(0x03, buf);

// Bind c4 register as the key for enc/dec operations
ckeyreg($c4);

// Encrypt buf in c3 using keyreg value as key and store in c5
cenc($c5, $c3);

// This will read into buf from crypto register c5
crypto_load(0x05, buf);

return;
</pre>

===== crypto_store =====
This method takes '''reg''' (a crypto register) and '''buf''' (a 16 bytes buffer) as arguments and loads the supplied buffer into the crypto register.
<pre>
// The next two xfer instructions will be overridden
// and target changes from DMA to crypto
cxset(0x02);

// Encode the source buffer and the destination register for the xfer
u32 crypto_xfer_flag = (u32)buf | reg << 0x10;

// Transfer the supplied buffer to the supplied crypto register
xdst(crypto_xfer_flag, crypto_xfer_flag);

// Wait for all data loads/stores to finish
xdwait();

return;
</pre>

===== crypto_load =====
This method takes '''reg''' (a crypto register) and '''buf''' (a 16 bytes buffer) as arguments and loads the contents of the supplied register into the supplied buffer.
<pre>
// The next two xfer instructions will be overridden
// and target changes from DMA to crypto
cxset(0x02);

// Encode the destination buffer and the source register for the xfer
u32 crypto_xfer_flag = (u32)buf | reg << 0x10;

// Transfer the contents of the supplied crypto register into the supplied buffer
xdld(crypto_xfer_flag, crypto_xfer_flag);

// Wait for all data loads/stores to finish
xdwait();

return;
</pre>

===== do_crypto =====
This is the method responsible for all crypto operations performed during [[#KeygenLdr|KeygenLdr]]. It takes '''src_addr''', '''src_size''', '''iv_addr''', '''dst_addr''', '''mode''' and '''use_imem''' as arguments.
<pre>
// Check for invalid source data size
if (!src_size || (src_size & 0x0F))
exit();

// Check for invalid source data address
if (src_addr & 0x0F)
exit();

// Check for invalid destination data address
if (dst_addr & 0x0F)
exit();

// Use IV if available
if (iv_addr)
{
// This will write the iv_addr into crypto register c5
crypto_store(0x05, iv_addr);
}
else
{
// Clear c5 register (use null IV)
cxor($c5, $c5);
}

// Bind c4 register as the key for enc/dec operations
ckeyreg(c4);

if (mode == 0x00) // AES-128-CBC decrypt
{
// Create crypto script with 5 instructions
cs0begin(0x05);

cxsin($c3); // Read 0x10 bytes from crypto stream into c3
cdec($c2, $c3); // Decrypt from c3 into c2
cxor($c5, $c2); // XOR c2 with c5 and store in c5
cxsout($c5); // Write 0x10 bytes into crypto stream from c5
cmov($c5, $c3); // Move c3 into c5
}
else if (mode == 0x01) // AES-128-CBC encrypt
{
// Create crypto script with 4 instructions
cs0begin(0x04);

cxsin($c3); // Read 0x10 bytes from crypto stream into c3
cxor($c3, $c5); // XOR c5 with c3 and store in c3
cenc($c5, $c3); // Encrypt from c3 into c5
cxsout($c5); // Write 0x10 bytes into crypto stream from c5
}
else if (mode == 0x02) // AES-CMAC
{
// Create crypto script with 3 instructions
cs0begin(0x03);

cxsin($c3); // Read 0x10 bytes from crypto stream into c3
cxor($c5, $c3); // XOR c5 with c3 and store in c5
cenc($c5, $c5); // Encrypt from c5 into c5
}
else if (mode == 0x03) // AES-128-ECB decrypt
{
// Create crypto script with 3 instructions
cs0begin(0x03);

cxsin($c3); // Read 0x10 bytes from crypto stream into c3
cdec($c5, $c3); // Decrypt from c3 into c5
cxsout($c5); // Write 0x10 bytes into crypto stream from c5
}
else if (mode == 0x04) // AES-128-ECB encrypt
{
// Create crypto script with 3 instructions
cs0begin(0x03);

cxsin($c3); // Read 0x10 bytes from crypto stream into c3
cenc($c5, $c3); // Encrypt from c3 into c5
cxsout($c5); // Write 0x10 bytes into crypto stream from c5
}
else
return;

// Main loop
while (src_size > 0)
{
u32 blk_count = (src_size >> 0x04);

if (blk_count > 0x10)
blk_count = 0x10;

// Check size align
if (blk_count & (blk_count - 0x01))
blk_count = 0x01;

u32 blk_size = (blk_count << 0x04);

u32 crypto_xfer_src = 0;
u32 crypto_xfer_dst = 0;

if (block_size == 0x20)
{
crypto_xfer_src = (0x00030000 | src_addr);
crypto_xfer_dst = (0x00030000 | dst_addr);

// Execute crypto script 2 times (1 for each block)
cs0exec(0x02);
}
else if (block_size == 0x40)
{
crypto_xfer_src = (0x00040000 | src_addr);
crypto_xfer_dst = (0x00040000 | dst_addr);

// Execute crypto script 4 times (1 for each block)
cs0exec(0x04);
}
else if (block_size == 0x80)
{
crypto_xfer_src = (0x00050000 | src_addr);
crypto_xfer_dst = (0x00050000 | dst_addr);

// Execute crypto script 8 times (1 for each block)
cs0exec(0x08);
}
else if (block_size == 0x100)
{
crypto_xfer_src = (0x00060000 | src_addr);
crypto_xfer_dst = (0x00060000 | dst_addr);

// Execute crypto script 16 times (1 for each block)
cs0exec(0x10);
}
else
{
crypto_xfer_src = (0x00020000 | src_addr);
crypto_xfer_dst = (0x00020000 | dst_addr);

// Execute crypto script 1 time (1 for each block)
cs0exec(0x01);

// Ensure proper block size
block_size = 0x10;
}

// The next xfer instruction will be overridden
// and target changes from DMA to crypto input/output stream
if (use_imem)
cxset(0xA1); // Flag 0xA0 is falcon imem <-> crypto input/output stream
else
cxset(0x21); // Flag 0x20 is external mem <-> crypto input/output stream

// Transfer data into the crypto input/output stream
xdst(crypto_xfer_src, crypto_xfer_src);

// AES-CMAC only needs one more xfer instruction
if (mode == 0x02)
{
// The next xfer instruction will be overridden
// and target changes from DMA to crypto input/output stream
if (use_imem)
cxset(0xA1); // Flag 0xA0 is falcon imem <-> crypto input/output stream
else
cxset(0x21); // Flag 0x20 is external mem <-> crypto input/output stream

// Wait for all data loads/stores to finish
xdwait();
}
else // AES enc/dec needs 2 more xfer instructions
{
// The next 2 xfer instructions will be overridden
// and target changes from DMA to crypto input/output stream
if (use_imem)
cxset(0xA2); // Flag 0xA0 is falcon imem <-> crypto input/output stream
else
cxset(0x22); // Flag 0x20 is external mem <-> crypto input/output stream

// Transfer data from the crypto input/output stream
xdld(crypto_xfer_dst, crypto_xfer_dst);

// Wait for all data loads/stores to finish
xdwait();

// Increase the destination address by block size
dst_addr += block_size;
}

// Increase the source address by block size
src_addr += block_size;

// Decrease the source size by block size
src_size -= block_size;
}

// AES-CMAC result is in c5
if (mode == 0x02)
{
// This will read into dst_addr from crypto register c5
crypto_load(0x05, dst_addr);
}

return;
</pre>

== Keygen ==
This stage is decrypted by [[#KeygenLdr|KeygenLdr]] using a key generated by encrypting the KeygenLdr auth signature with a seed encrypted with a csecret. It will generate the final TSEC key.

=== Main ===
The main function takes '''key_addr''' and '''key_type''' as arguments from [[#KeygenLdr|KeygenLdr]].
<pre>
u32 falcon_rev = *(u32 *)UC_CAPS2 & 0x0F;

// Falcon hardware revision must be 5
if (falcon_rev != 0x05)
exit();

// Clear interrupt flags
$flags.ie0 = 0;
$flags.ie1 = 0;
$flags.ie2 = 0;

// Set the target port for memory transfers
$xtargets = 0;

// Generate the TSEC key
gen_tsec_key(key_addr, key_type);

// Clear the cauth signature
csigclr();

// Clear all crypto registers
cxor($c0, $c0);
cxor($c1, $c1);
cxor($c2, $c2);
cxor($c3, $c3);
cxor($c4, $c4);
cxor($c5, $c5);
cxor($c6, $c6);
cxor($c7, $c7);

return;
</pre>

==== gen_tsec_key ====
This method is responsible for generating the final TSEC key. It takes '''key_addr''' and '''key_type''' as arguments.
<pre>
// This will use TSEC DMA to look for 0x34C2E1DA in host1x scratch space
u32 host1x_res = check_host1x_magic();

// Failed to find magic word
if (host1x_res != 0)
return;

u32 crypto_reg_flag = 0x00000000;

// The next 0x02 xfer instructions will be overridden
// and target changes from DMA to crypto register
cxset(0x02);

// Transfer the seed in key_addr to crypto register c0
xdst(0, (key_addr | crypto_reg_flag));

// Wait for all data loads/stores to finish
xdwait();

crypto_reg_flag = 0x00020000;

if (key_type == 0x01) // HOVI_EKS_01
{
// Load selected secret into crypto register c1
csecret($c1, 0x3F);

// Encrypt the auth signature with c1 and store in c1
csigenc($c1, $c1);

// Load selected secret into crypto register c2
csecret($c2, 0x00);

// Bind c2 register as the key for enc/dec operations
ckeyreg($c2);

// Encrypt the seed from key_addr and store in c2
cenc($c2, $c0);

// Bind c2 register as the key for enc/dec operations
ckeyreg($c2);

// Encrypt the auth signature with c2 and store in c2
csigenc($c2, $c2);

// Bind c2 register as the key for enc/dec operations
ckeyreg($c2);

// Encrypt c1 and store in c2
cenc($c2, $c1);

// The next 0x02 xfer instructions will be overridden
// and target changes from DMA to crypto register
cxset(0x02);

// Transfer the resulting key from crypto register c2 to key_addr
xdld(0, (key_addr | crypto_reg_flag));

// Wait for all data loads/stores to finish
xdwait();
}
else if (key == 0x02) // HOVI_COMMON_01
{
// Load selected secret into crypto register c2
csecret($c2, 0x00);

// Bind c2 register as the key for enc/dec operations
ckeyreg($c2);

// Encrypt the seed from key_addr and store in c2
cenc($c2, $c0);

// Bind c2 register as the key for enc/dec operations
ckeyreg($c2);

// Encrypt the auth signature with c2 and store in c2
csigenc($c2, $c2);

// The next 0x02 xfer instructions will be overridden
// and target changes from DMA to crypto register
cxset(0x02);

// Transfer the resulting key from crypto register c2 to key_addr
xdld(0, (key_addr | crypto_reg_flag));

// Wait for all data loads/stores to finish
xdwait();
}

// Use TSEC DMA to write the key in SOR1 registers
sor1_set_key(key_addr);

return;
</pre>

==== sor1_set_key ====
This method takes '''key_addr''' (start address of a 16 bytes buffer) as argument and transfers its contents to SOR1 registers.

The implementation is equivalent to [[#tsec_set_key|tsec_set_key]].

== SecureBootLdr ==
[6.2.0+] This was introduced to try to recover the secure boot from the RCM vulnerability.

This stage starts by authenticating and executing [[#KeygenLdr|KeygenLdr]] which in turn authenticates, decrypts and executes [[#Keygen|Keygen]] (both blobs remain unchanged from previous firmware versions).
After the TSEC key has been generated, execution returns to this stage which then parses and executes [[#SecureBoot|SecureBoot]].

=== Main ===
<pre>
u8 key_data_buf[0x84];
u8 tmp_key_data_buf[0x84];

// Read the key data from memory
u32 key_data_addr = 0x300;
u32 key_data_size = 0x84;
memcpy_i2d(key_data_buf, key_data_addr, key_data_size);

// Read the KeygenLdr blob from memory
u32 boot_base_addr = 0;
u32 blob1_addr = 0x400;
u32 blob1_size = *(u32 *)(key_data_buf + 0x74);
memcpy_i2d(boot_base_addr, blob1_addr, blob1_size);

// Upload the next code segment into Falcon's CODE region
u32 blob1_virt_addr = 0x300;
bool use_secret = true;
memcpy_d2i(blob1_virt_addr, boot_base_addr, blob1_size, blob1_virt_addr, use_secret);

// Backup the key data
memcpy(tmp_key_data_buf, key_data_buf, 0x84);

// Save previous cauth value
u32 cauth_old = $cauth;

// Set auth_addr to 0x300 and auth_size to blob1_size
$cauth = ((blob1_size << 0x10) | (0x300 >> 0x08));

// The next 2 xfer instructions will be overridden
// and target changes from DMA to crypto
cxset(0x02);

u32 crypto_reg_flag = 0x00060000;
u32 blob1_hash_addr = tmp_key_data_buf + 0x20;

// Transfer data to crypto register c6
xdst(0, (blob1_hash_addr | crypto_reg_flag));

// Wait for all data loads/stores to finish
xdwait();

u32 key_version = 0x01;
bool is_blob_dec = false;

// Jump to KeygenLdr
u32 keygenldr_res = exec_keygenldr(tmp_key_data_buf, key_version, is_blob_dec);

// Set boot finish magic on success
if (keygenldr_res == 0)
keygenldr_res = 0xB0B0B0B0

// Write result to FALCON_SCRATCH1
*(u32 *)FALCON_SCRATCH1 = keygenldr_res;

if (keygenldr_res != 0xB0B0B0B0)
return keygenldr_res;

// Restore previous cauth value
$cauth = cauth_old;

u8 flcn_hdr_buf[0x18];
u8 flcn_os_hdr_buf[0x10];

blob1_size = *(u32 *)(key_data_buf + 0x74);
u32 blob2_size = *(u32 *)(key_data_buf + 0x78);
u32 blob0_size = *(u32 *)(key_data_buf + 0x70);

// Read the SecureBoot blob's Falcon header from memory
u32 blob4_flcn_hdr_addr = (((blob0_size + blob1_size) + 0x100) + blob2_size);
memcpy_i2d(flcn_hdr_buf, blob4_flcn_hdr_addr, 0x18);

blob1_size = *(u32 *)(key_data_buf + 0x74);
blob2_size = *(u32 *)(key_data_buf + 0x78);
blob0_size = *(u32 *)(key_data_buf + 0x70);
u32 flcn_hdr_size = *(u32 *)(flcn_hdr_buf + 0x0C);

// Read the SecureBoot blob's Falcon OS header from memory
u32 blob4_flcn_os_hdr_addr = ((((blob0_size + blob1_size) + 0x100) + blob2_size) + flcn_hdr_size);
memcpy_i2d(flcn_os_hdr_buf, blob4_flcn_os_hdr_addr, 0x10);

blob1_size = *(u32 *)(key_data_buf + 0x74);
blob2_size = *(u32 *)(key_data_buf + 0x78);
blob0_size = *(u32 *)(key_data_buf + 0x70);
u32 flcn_code_hdr_size = *(u32 *)(flcn_hdr_buf + 0x10);
u32 flcn_os_size = *(u32 *)(flcn_os_hdr_buf + 0x04);

// Read the SecureBoot blob's Falcon OS image from memory
u32 blob4_flcn_os_addr = ((((blob0_size + blob1_size) + 0x100) + blob2_size) + flcn_code_hdr_size);
memcpy_i2d(boot_base_addr, blob4_flcn_os_hdr_addr, flcn_os_size);

// Upload the SecureBoot's Falcon OS image boot stub code segment into Falcon's CODE region
u32 blob4_flcn_os_boot_virt_addr = 0;
u32 blob4_flcn_os_boot_size = 0x100;
use_secret = false;
memcpy_d2i(blob4_flcn_os_boot_virt_addr, boot_base_addr, blob4_flcn_os_boot_size, blob4_flcn_os_boot_virt_addr, use_secret);

flcn_os_size = *(u32 *)(flcn_os_hdr_buf + 0x04);

// Upload the SecureBoot blob's Falcon OS encrypted image code segment into Falcon's CODE region
u32 blob4_flcn_os_img_virt_addr = 0x100;
u32 blob4_flcn_os_img_size = (flcn_os_size - 0x100);
use_secret = true;
memcpy_d2i(blob4_flcn_os_img_virt_addr, boot_base_addr + 0x100, blob4_flcn_os_img_size, blob4_flcn_os_img_virt_addr, use_secret);

// Wait for all code loads to finish
xcwait();

blob1_size = *(u32 *)(key_data_buf + 0x74);
blob2_size = *(u32 *)(key_data_buf + 0x78);
blob0_size = *(u32 *)(key_data_buf + 0x70);
flcn_code_hdr_size = *(u32 *)(flcn_hdr_buf + 0x10);
u32 flcn_os_code_size = *(u32 *)(flcn_os_hdr_buf + 0x08);

// Read the SecureBoot blob's falcon OS image's hash from memory
u32 blob4_flcn_os_img_hash_addr = (((((blob0_size + blob1_size) + 0x100) + blob2_size) + flcn_code_hdr_size) + flcn_os_code_size);
memcpy_i2d(0, blob4_flcn_os_img_hash_addr, 0x10);

// Read data segment size from IO space
u32 data_seg_size = *(u32 *)FALCON_HWCFG;
data_seg_size >>= 0x03;
data_seg_size &= 0x3FC0;

u32 data_addr = 0x10;

// Clear all data except the first 0x10 bytes (SecureBoot blob's Falcon OS image's hash)
for (int data_word_count = 0x04; data_word_count < data_seg_size; data_word_count++)
{
*(u32 *)(data_addr) = 0;
data_addr += 0x04;
}

// Clear all crypto registers
cxor($c0, $c0);
cxor($c1, $c1);
cxor($c2, $c2);
cxor($c3, $c3);
cxor($c4, $c4);
cxor($c5, $c5);
cxor($c6, $c6);
cxor($c7, $c7);

// Clear the cauth signature
csigclr();

// Jump to SecureBoot
load_secboot();

return 0xB0B0B0B0;
</pre>

== SecureBoot ==
[6.2.0+] This was introduced to try to recover the secure boot from the RCM vulnerability.

This stage prepares the stack then authenticates, decrypts and executes the SecureBoot blob's Falcon OS image.

=== Main ===
<pre>
// Read data segment size from IO space
u32 data_seg_size = *(u32 *)UC_CAPS;
data_seg_size >>= 0x01;
data_seg_size &= 0xFF00;

// Set the stack pointer
$sp = data_seg_size;

// Jump to the SecureBoot blob's Falcon OS image boot stub
init_secboot();

// Halt execution
exit();

return;
</pre>

==== init_secboot ====
This method takes no arguments and is responsible for loading, authenticating and executing [[#SecureBoot|SecureBoot]].
<pre>
// Read the transfer base address from IO space
u32 xfer_ext_base_addr = *(u32 *)FALCON_DMATRFBASE;

// Copy transfer base address to data memory
u32 scratch_data_addr = 0x300;
*(u32 *)scratch_data_addr = xfer_ext_base_addr;

// Set the transfer base address
xcbase(xfer_ext_base_addr);

// The next xfer instruction will be overridden
// and target changes from DMA to crypto
cxset(0x01);

u32 crypto_reg_flag = 0x00060000;
u32 blob4_flcn_os_img_hash_addr = 0;

// Transfer data to crypto register c6
xdst(0, (blob4_flcn_os_img_hash_addr | crypto_reg_flag));

// The next xfer instruction will be overridden
// and target changes from DMA to crypto
cxset(0x01);

// Wait for all data loads/stores to finish
xdwait();

cmov($c7, $c6);
cxor($c7, $c7);

// Set auth_addr to 0x100, auth_size to 0x1300,
// bit 16 (use_secret) and bit 17 (is_encrypted)
$cauth = ((0x02 << 0x10) | (0x01 << 0x10) | (0x1300 << 0x10) | (0x100 >> 0x08));

// Clear interrupt flags
$flags.ie0 = 0;
$flags.ie1 = 0;
$flags.ie2 = 0;

// Jump to the SecureBoot blob's Falcon OS image
exec_secboot();

return 0x0F0F0F0F;
</pre>

[8.1.0+] Removed transfer base address setting and added IMEM protection.
<pre>
// The next xfer instruction will be overridden
// and target changes from DMA to crypto
cxset(0x01);

u32 crypto_reg_flag = 0x00060000;
u32 blob4_flcn_os_img_hash_addr = 0;

// Transfer data to crypto register c6
xdst(0, (blob4_flcn_os_img_hash_addr | crypto_reg_flag));

// The next xfer instruction will be overridden
// and target changes from DMA to crypto
cxset(0x01);

// Wait for all data loads/stores to finish
xdwait();

cmov($c7, $c6);
cxor($c7, $c7);

// Set auth_addr to 0x100, auth_size to 0x1D00,
// bit 16 (use_secret) and bit 17 (is_encrypted)
$cauth = ((0x02 << 0x10) | (0x01 << 0x10) | (0x1D00 << 0x10) | (0x100 >> 0x08));

// Clear interrupt flags
$flags.ie0 = 0;
$flags.ie1 = 0;
$flags.ie2 = 0;

// Fill remaining IMEM with secret pages
bool use_secret = true;
memcpy_d2i(0x1E00, 0, 0x2200, 0x1E00, use_secret);
memcpy_d2i(0x4000, 0, 0x4000, 0x4000, use_secret);

// Wait for all code loads to finish
xcwait();

// Jump to the SecureBoot blob's Falcon OS image
exec_secboot();

return 0x0F0F0F0F;
</pre>

==== exec_secboot ====
This is the signed and encrypted portion of the [[#SecureBoot|SecureBoot]] payload.
<pre>
// Recover the transfer base address from the stack
u32 xfer_ext_base_addr = *(u32 *)scratch_data_addr;

// Return the TLB entry that covers the virtual address
u32 tlb_entry = vtlb(xfer_ext_base_addr);

// Clear Falcon CPU control
*(u32 *)FALCON_CPUCTL = 0;

// Halt if the external page is marked as secret
if ((tlb_entry & 0x4000000) != 0)
exit();

// Read data segment size from IO space
u32 data_seg_size = *(u32 *)UC_CAPS;
data_seg_size >>= 0x01;
data_seg_size &= 0xFF00;

// Set the stack pointer
$sp = data_seg_size;

// Fill all DMEM with a pointer to a trap function (just exits 3 times)
for (int i = 0; i < data_seg_size; i += 0x04) {
*(u32 *)i = (u32)trap_func();
}

// Initialize the TRNG and generate random data in DMEM
init_rnd();

// Issue a randomized delay and return a random value
u32 rnd_val = rnd_delay(0xFF);

// Load the TSEC key from SOR1 registers into DMEM
sor1_get_key();

// Initialize CAR registers
car_init();

// Check certain CAR, PMC and FUSE registers
test_car_pmc_fuse();

// Ensure CLK_RST_CONTROLLER_CLK_SOURCE_TSEC_0 is 0x02
test_clk_source_tsec();

// Set FLOW_MODE_WAITEVENT in FLOW_CTLR_HALT_COP_EVENTS_0
halt_bpmp();

// Initialize the CCPLEX
ccplex_init();

// Check certain CAR, PMC and FUSE registers
test_car_pmc_fuse();

bool is_se_ready = false;

// Wait for SE to be ready
while (!is_se_ready)
is_se_ready = check_se_status();

// Test MC_IRAM_BOM and MC_IRAM_TOM
u32 mc_iram_aperture_res = test_mc_iram_aperture();

if (mc_iram_aperture_res != 0xAAAAAAAA)
{
// Clear the entire DMEM region
clear_dmem();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Ensure FUSE_SKU_INFO is 0x83
test_fuse_sku_info();

// Write TSEC key to SE keyslot 0x0C
se_set_keyslot_12();

// Write TSEC root key to SE keyslot 0x0D
se_set_keyslot_13();

// Decrypt Package1
decrypt_pk11();

// Check certain CAR, PMC and FUSE registers
test_car_pmc_fuse();

// Parse Package1 header and return entry address
u32 entry_addr = parse_pk11();

// Set the exception vectors
set_excp_vec(entry_addr);

// Fill the top 0x500 bytes in DMEM with a pointer to trap function (just exits 3 times)
for (int i = 0; i < 0x500; i += 0x04) {
*(u32 *)i = (u32)trap_func();
}

// Clear all crypto registers
cxor($c0, $c0);
cxor($c1, $c1);
cxor($c2, $c2);
cxor($c3, $c3);
cxor($c4, $c4);
cxor($c5, $c5);
cxor($c6, $c6);
cxor($c7, $c7);

// Take SCP out of lockdown
unlock_scp();

// Clear FLOW_CTLR_HALT_COP_EVENTS_0
resume_bpmp();

// Clear the entire DMEM region
clear_dmem();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();

return;
</pre>

[7.0.0+] Many changes were introduced to mitigate and prevent attacks.
<pre>
// Recover the transfer base address from the stack
u32 xfer_ext_base_addr = *(u32 *)scratch_data_addr;

// Return the TLB entry that covers the virtual address
u32 tlb_entry = vtlb(xfer_ext_base_addr);

// Clear Falcon CPU control
*(u32 *)FALCON_CPUCTL = 0;

// Halt if the external page is marked as secret
if ((tlb_entry & 0x4000000) != 0)
exit();

// Read data segment size from IO space
u32 data_seg_size = *(u32 *)UC_CAPS;
data_seg_size >>= 0x01;
data_seg_size &= 0xFF00;

// Set the stack pointer
$sp = data_seg_size;

// Fill all DMEM with a pointer to a trap function (just exits 3 times)
for (int i = 0; i < data_seg_size; i += 0x04) {
*(u32 *)i = (u32)trap_func();
}

// Initialize the TRNG and generate random data in DMEM
init_rnd();

// Issue a randomized delay and return a random value
u32 rnd_val = rnd_delay(0xFF);

// Enable and test SMMU bypassing in the TFBIF
tfbif_smmu_cfg(0x01);

// Issue a randomized delay and return a random value
rnd_val = rnd_delay(0xFF);

// Test SMMU bypassing in the TFBIF
tfbif_smmu_cfg(0x00);

// Issue a randomized delay and return a random value
rnd_val = rnd_delay(0xFF);

// Test SMMU bypassing in the TFBIF
tfbif_smmu_cfg(0x00);

// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Test randomized offsets for read/write integrity in MC, FUSE, IRAM and TZRAM
u32 test_res = test_mc_fuse_iram_tzram();

if (test_res != 0xAAAAAAAA)
{
// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Try to detect virtualization by enabling and disabling random CAR devices
test_res = test_car();

if (test_res != 0xAAAAAAAA)
{
// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Test memory transfer integrity
test_res = test_mem_xfer();

if (test_res != 0xAAAAAAAA)
{
// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Set FLOW_MODE_WAITEVENT in FLOW_CTLR_HALT_COP_EVENTS_0
halt_bpmp();

// Initialize the CCPLEX
ccplex_init();

// Check if SE is ready
u32 se_status = check_se_status();

if (se_status != 0)
{
// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Load the TSEC key from SOR1 registers into DMEM
sor1_get_key();

// Initialize CAR registers
car_init();

// Check certain CAR, PMC and FUSE registers
test_car_pmc_fuse();

// Try to detect virtualization by enabling and disabling random CAR devices
test_res = test_car();

if (test_res != 0xAAAAAAAA)
{
// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Ensure FUSE_SKU_INFO is 0x83
test_fuse_sku_info();

// Try to detect virtualization using MC_SMMU_AVPC_ASID and FUSE_ECO_RESERVE_0
test_smmu_fuse();

// Test MC_IRAM_BOM and MC_IRAM_TOM
test_res = test_mc_iram_aperture();

if (test_res != 0xAAAAAAAA)
{
// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Check certain CAR, PMC and FUSE registers
test_car_pmc_fuse();

// Test memory transfer integrity
test_res = test_mem_xfer();

if (test_res != 0xAAAAAAAA)
{
// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Try to detect virtualization using MC_SMMU_AVPC_ASID and FUSE_ECO_RESERVE_0
test_smmu_fuse();

// Test MC_IRAM_BOM and MC_IRAM_TOM
test_res = test_mc_iram_aperture();

if (test_res != 0xAAAAAAAA)
{
// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Test SMMU bypassing in the TFBIF
tfbif_smmu_cfg(0x00);

// Decrypt Package1
decrypt_pk11();

// Write TSEC root key to SE keyslot 0x0D
se_set_keyslot_13();

// Write TSEC key to SE keyslot 0x0C
se_set_keyslot_12();

// Clear the cauth signature
csigclr();

// Check certain CAR, PMC and FUSE registers
test_car_pmc_fuse();

// Test memory transfer integrity
test_res = test_mem_xfer();

if (test_res != 0xAAAAAAAA)
{
// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Try to detect virtualization using MC_SMMU_AVPC_ASID and FUSE_ECO_RESERVE_0
test_smmu_fuse();

// Test randomized offsets for read/write integrity in MC, FUSE, IRAM and TZRAM
test_res = test_mc_fuse_iram_tzram();

if (test_res != 0xAAAAAAAA)
{
// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Test MC_IRAM_BOM and MC_IRAM_TOM
test_res = test_mc_iram_aperture();

if (test_res != 0xAAAAAAAA)
{
// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Test SMMU bypassing in the TFBIF
tfbif_smmu_cfg(0x00);

// Parse Package1 header and return entry address
u32 entry_addr = parse_pk11();

// Set the exception vectors
set_excp_vec(entry_addr);

// Fill the top 0x500 bytes in DMEM with a pointer to trap function (just exits)
for (int i = 0; i < 0x500; i += 0x04) {
*(u32 *)i = (u32)trap_func();
}

// Clear all crypto registers
cxor($c0, $c0);
cxor($c1, $c1);
cxor($c2, $c2);
cxor($c3, $c3);
cxor($c4, $c4);
cxor($c5, $c5);
cxor($c6, $c6);
cxor($c7, $c7);

// Take SCP out of lockdown
unlock_scp();

// Test memory transfer integrity
test_res = test_mem_xfer();

if (test_res != 0xAAAAAAAA)
{
// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Try to detect virtualization using MC_SMMU_AVPC_ASID and FUSE_ECO_RESERVE_0
test_smmu_fuse();

// Test MC_IRAM_BOM and MC_IRAM_TOM
test_res = test_mc_iram_aperture();

if (test_res != 0xAAAAAAAA)
{
// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Test SMMU bypassing in the TFBIF
tfbif_smmu_cfg(0x00);

// Clear FLOW_CTLR_HALT_COP_EVENTS_0
resume_bpmp();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();

return;
</pre>

[8.1.0+] Key derivation algorithm was changed. Very minor changes were introduced to mitigate and prevent attacks.

== Key data ==
Small buffer stored after the [[#Boot|Boot]] blob and used across all stages.

{| class="wikitable" border="1"
! Offset
! Size
! Description
|-
| 0x00
| 0x10
| Debug key (empty)
|-
| 0x10
| 0x10
| blob0 ([[#Boot|Boot]]) auth hash
|-
| 0x20
| 0x10
| blob1 ([[#KeygenLdr|KeygenLdr]]) auth hash
|-
| 0x30
| 0x10
| blob2 ([[#Keygen|Keygen]]) auth hash
|-
| 0x40
| 0x10
| blob2 ([[#Keygen|Keygen]]) AES IV
|-
| 0x50
| 0x10
| HOVI EKS seed
|-
| 0x60
| 0x10
| HOVI COMMON seed
|-
| 0x70
| 0x04
| blob0 ([[#Boot|Boot]]) size
|-
| 0x74
| 0x04
| blob1 ([[#KeygenLdr|KeygenLdr]]) size
|-
| 0x78
| 0x04
| blob2 ([[#Keygen|Keygen]]) size
|-
| 0x7C
| 0x04
| [6.2.0+] blob3 ([[#SecureBootLdr|SecureBootLdr]]) size
|-
| 0x80
| 0x04
| [6.2.0+] blob4 ([[#SecureBoot|SecureBoot]]) size
|}

TSEC Firmware

2020-08-19T18:11:55Z

Vale:

= Boot Process =
TSEC is configured and initialized by the first bootloader during key generation.

[6.2.0+] TSEC is now configured at the end of the first bootloader's main function.

== Initialization ==
During this stage several clocks are programmed.
<pre>
// Program the HOST1X clock and resets
// Uses RST_DEVICES_L, CLK_OUT_ENB_L, CLK_SOURCE_HOST1X and CLK_L_HOST1X
enable_host1x_clkrst();

// Program the TSEC clock and resets
// Uses RST_DEVICES_U, CLK_OUT_ENB_U, CLK_SOURCE_TSEC and CLK_U_TSEC
enable_tsec_clkrst();

// Program the SOR_SAFE clock and resets
// Uses RST_DEVICES_Y, CLK_OUT_ENB_Y and CLK_Y_SOR_SAFE
enable_sor_safe_clkrst();

// Program the SOR0 clock and resets
// Uses RST_DEVICES_X, CLK_OUT_ENB_X and CLK_X_SOR0
enable_sor0_clkrst();

// Program the SOR1 clock and resets
// Uses RST_DEVICES_X, CLK_OUT_ENB_X, CLK_SOURCE_SOR1 and CLK_X_SOR1
enable_sor1_clkrst();

// Program the KFUSE clock resets
// Uses RST_DEVICES_H, CLK_OUT_ENB_H and CLK_H_KFUSE
enable_kfuse_clkrst();
</pre>

== Configuration ==
In this stage the Falcon IRQs, interfaces and DMA engine are configured.
<pre>
// Clear the Falcon DMA control register
*(u32 *)FALCON_DMACTL = 0;

// Enable Falcon IRQs
*(u32 *)FALCON_IRQMSET = 0xFFF2;

// Enable Falcon IRQs
*(u32 *)FALCON_IRQDEST = 0xFFF0;

// Enable Falcon interfaces
*(u32 *)FALCON_ITFEN = 0x03;

// Wait for Falcon's DMA engine to be idle
wait_flcn_dma_idle();
</pre>

== Firmware loading ==
The Falcon firmware code is stored in the first bootloader's data segment in IMEM.
<pre>
// Set DMA transfer base address to 0x40011900 >> 0x08
*(u32 *)FALCON_DMATRFBASE = 0x400119;

u32 trf_mode = 0; // A value of 0 sets FALCON_DMATRFCMD_IMEM
u32 dst_offset = 0;
u32 src_offset = 0;

// Load code into Falcon (0x100 bytes at a time)
while (src_offset < 0xF00)
{
flcn_load_firm(trf_mode, src_offset, dst_offset);
src_offset += 0x100;
dst_offset += 0x100;
}
</pre>

[6.2.0+] The transfer base address and size of the Falcon firmware code changed.
<pre>
// Set DMA transfer base address to 0x40010E00 >> 0x08
*(u32 *)FALCON_DMATRFBASE = 0x40010E;

u32 trf_mode = 0; // A value of 0 sets FALCON_DMATRFCMD_IMEM
u32 dst_offset = 0;
u32 src_offset = 0;

// Load code into Falcon (0x100 bytes at a time)
while (src_offset < 0x2900)
{
flcn_load_firm(trf_mode, src_offset, dst_offset);
src_offset += 0x100;
dst_offset += 0x100;
}
</pre>

== Firmware booting ==
Falcon is booted up and the first bootloader waits for it to finish.
// Set magic value in host1x scratch space
*(u32 *)0x50003300 = 0x34C2E1DA;

// Clear Falcon scratch1 MMIO
*(u32 *)FALCON_SCRATCH1 = 0;

// Set Falcon boot key version in scratch0 MMIO
*(u32 *)FALCON_SCRATCH0 = 0x01;

// Set Falcon's boot vector address
*(u32 *)FALCON_BOOTVEC = 0;

// Signal Falcon's CPU
*(u32 *)FALCON_CPUCTL = 0x02;

// Wait for Falcon's DMA engine to be idle
wait_flcn_dma_idle();

u32 boot_res = 0;

// The bootloader allows the TSEC two seconds from this point to do its job
u32 maximum_time = read_timer() + 2000000;

while (!boot_res)
{
// Read boot result from scratch1 MMIO
boot_res = *(u32 *)FALCON_SCRATCH1;

// Read from TIMERUS_CNTR_1US (microseconds from boot)
u32 current_time = read_timer();

// Booting is taking too long
if (current_time > maximum_time)
panic();
}

// Invalid boot result was returned
if (boot_res != 0xB0B0B0B0)
panic();
</pre>

[6.2.0+] Falcon is booted up, but the first bootloader is left in an infinite loop.
<pre>
// Set magic value in host1x scratch space
*(u32 *)0x50003300 = 0x34C2E1DA;

// Clear Falcon scratch1 MMIO
*(u32 *)FALCON_SCRATCH1 = 0;

// Set Falcon boot key version in scratch0 MMIO
*(u32 *)FALCON_SCRATCH0 = 0x01;

// Set Falcon's boot vector address
*(u32 *)FALCON_BOOTVEC = 0;

// Signal Falcon's CPU
*(u32 *)FALCON_CPUCTL = 0x02;

// Infinite loop
while (1);
</pre>

== TSEC key generation ==
The TSEC key is generated by reading SOR1 registers modified by the Falcon CPU.
<pre>
// Clear magic value in host1x scratch space
*(u32 *)0x50003300 = 0;

// Read TSEC key
u32 tsec_key[4];
tsec_key[0] = *(u32 *)NV_SOR_DP_HDCP_BKSV_LSB;
tsec_key[1] = *(u32 *)NV_SOR_TMDS_HDCP_BKSV_LSB;
tsec_key[2] = *(u32 *)NV_SOR_TMDS_HDCP_CN_MSB;
tsec_key[3] = *(u32 *)NV_SOR_TMDS_HDCP_CN_LSB;

// Clear SOR1 registers
*(u32 *)NV_SOR_DP_HDCP_BKSV_LSB = 0;
*(u32 *)NV_SOR_TMDS_HDCP_BKSV_LSB = 0;
*(u32 *)NV_SOR_TMDS_HDCP_CN_MSB = 0;
*(u32 *)NV_SOR_TMDS_HDCP_CN_LSB = 0;

if (out_size < 0x10)
out_size = 0x10;

// Copy back the TSEC key
memcpy(out_buf, tsec_key, out_size);
</pre>

[6.2.0+] This is now done inside an encrypted TSEC payload.

== Cleanup ==
Clocks and resets are disabled before returning.
<pre>
// Deprogram KFUSE clock and resets
// Uses RST_DEVICES_H, CLK_OUT_ENB_H and CLK_H_KFUSE
disable_kfuse_clkrst();

// Deprogram SOR1 clock and resets
// Uses RST_DEVICES_X, CLK_OUT_ENB_X, CLK_SOURCE_SOR1 and CLK_X_SOR1
disable_sor1_clkrst();

// Deprogram SOR0 clock and resets
// Uses RST_DEVICES_X, CLK_OUT_ENB_X and CLK_X_SOR0
disable_sor0_clkrst();

// Deprogram SOR_SAFE clock and resets
// Uses RST_DEVICES_Y, CLK_OUT_ENB_Y and CLK_Y_SOR_SAFE
disable_sor_safe_clkrst();

// Deprogram TSEC clock and resets
// Uses RST_DEVICES_U, CLK_OUT_ENB_U, CLK_SOURCE_TSEC and CLK_U_TSEC
disable_tsec_clkrst();

// Deprogram HOST1X clock and resets
// Uses RST_DEVICES_L, CLK_OUT_ENB_L, CLK_SOURCE_HOST1X and CLK_L_HOST1X
disable_host1x_clkrst();
</pre>

= TSEC Firmware =
The actual code loaded into TSEC is assembled in NVIDIA's proprietary fuc5 ISA using crypto extensions.
Stored inside the first bootloader, this firmware binary is split into 4 blobs (names are unofficial): [[#Boot|Boot]] (unencrypted and unauthenticated code), [[#KeygenLdr|KeygenLdr]] (unencrypted and authenticated code), [[#Keygen|Keygen]] (encrypted and authenticated code) and [[#Key data|key data]].

[6.2.0+] There are now 2 new blobs (names are unofficial): [[#SecureBootLdr|SecureBootLdr]] (unencrypted and unauthenticated code), [[#SecureBoot|SecureBoot]] (part unencrypted and unauthenticated code, part encrypted and authenticated code).

Firmware can be disassembled with [http://envytools.readthedocs.io/en/latest/ envytools'] [https://github.com/envytools/envytools/tree/master/envydis envydis]:

<code>envydis -i tsec_fw.bin -m falcon -V fuc5 -F crypt</code>

Note that the instruction set has variable length instructions, and the disassembler is not very good at detecting locations it should start disassembling from. One needs to disassemble multiple sub-regions and join them together.

== Boot ==
During this stage, [[#Key data|key data]] is loaded and [[#KeygenLdr|KeygenLdr]] is authenticated, loaded and executed.
Before returning, this stage writes back to the host (using MMIO registers) and sets the key used by the first bootloader.

[6.2.0+] During this stage, [[#Key data|key data]] is loaded and execution jumps to [[#SecureBootLdr|SecureBootLdr]].

=== Initialization ===
The firmware initially sets up the stack pointer to the end of the available data segment.
<pre>
// Read data segment size from IO space
u32 data_seg_size = *(u32 *)UC_CAPS;
data_seg_size >>= 0x09;
data_seg_size &= 0x1FF;
data_seg_size <<= 0x08;

// Set the stack pointer
*(u32 *)sp = data_seg_size;
</pre>

=== Main ===
The firmware reads the [[#Key data|key data]] blob and then loads, authenticates and executes [[#KeygenLdr|KeygenLdr]] which sets the TSEC key.
<pre>
u32 dmem_start = 0;
u8 key_data_buf[0x7C];

// Read the key data blob from code segment
u32 key_data_addr = 0x300;
u32 key_data_size = 0x7C;
memcpy_i2d(key_data_buf, key_data_addr, key_data_size);

// Read the next stage from code segment into data space
u32 blob1_addr = 0x400;
u32 blob1_size = *(u32 *)(key_data_buf + 0x74);
memcpy_i2d(dmem_start, blob1_addr, blob1_size);

// Upload the next stage into Falcon's code segment
u32 blob1_virt_addr = 0x300;
bool use_secret = true;
memcpy_d2i(blob1_virt_addr, dmem_start, blob1_size, blob1_virt_addr, use_secret);

u32 boot_res = 0;
u32 time = 0;
bool is_blob_dec = false;

while (true)
{
if (time == 4000001)
{
// Write boot failed (timeout) magic to FALCON_SCRATCH1
boot_res = 0xC0C0C0C0;
*(u32 *)FALCON_SCRATCH1 = boot_res;

break;
}

// Load key version from FALCON_SCRATCH0 (bootloader sends 0x01)
u32 key_version = *(u32 *)FALCON_SCRATCH0;

if (key_version == 0x64)
{
// Skip all next stages
boot_res = 0xB0B0B0B0;
*(u32 *)FALCON_SCRATCH1 = boot_res;

break;
}
else
{
if (key_version > 0x03)
boot_res = 0xD0D0D0D0; // Invalid key version
else if (key_version == 0)
boot_res = 0xB0B0B0B0; // No keys used
else
{
u32 key_buf[0x7C];

// Copy key data
memcpy(key_buf, key_data_buf, 0x7C);

u32 crypto_reg_flag = 0x00060000;
u32 blob1_hash_addr = key_buf + 0x20;

// Set auth_addr to 0x300 and auth_size to blob1_size
$cauth = ((blob1_size << 0x10) | 0x03);

// The next 2 xfer instructions will be overridden
// and target changes from DMA to crypto
cxset(0x02);

// Transfer data to crypto register c6
xdst(0, (blob1_hash_addr | crypto_reg_flag));

// Wait for all data loads/stores to finish
xdwait();

// Jump to KeygenLdr
u32 keygenldr_res = exec_keygenldr(key_buf, key_version, is_blob_dec);
is_blob_dec = true; // Set this to prevent decrypting again

// Set boot finish magic on success
if (keygenldr_res == 0)
boot_res = 0xB0B0B0B0
}

// Write result to FALCON_SCRATCH1
*(u32 *)FALCON_SCRATCH1 = boot_res;

if (boot_res == 0xB0B0B0B0)
break;
}

time++;
}

// Overwrite the TSEC key in SOR1 registers
// This has no effect because the KeygenLdr locks out the TSEC DMA engine
tsec_set_key(key_data_buf);

return boot_res;
</pre>

[6.2.0+] The firmware calculates the start address of [[#SecureBootLdr|SecureBootLdr]] through [[#Key data|key data]] and jumps to it.
<pre>
u8 key_data_buf[0x84];

// Read the key data blob
u32 key_data_addr = 0x300;
u32 key_data_size = 0x84;
memcpy_i2d(key_data_buf, key_data_addr, key_data_size);

// Calculate the next blob's address in Falcon code segment
u32 blob4_size = *(u32 *)(key_data_buf + 0x80);
u32 blob0_size = *(u32 *)(key_data_buf + 0x70);
u32 blob1_size = *(u32 *)(key_data_buf + 0x74);
u32 blob2_size = *(u32 *)(key_data_buf + 0x78);
u32 blob3_addr = blob0_size + blob1_size + 0x100 + blob2_size + blob4_size;

// Jump to next blob
(void *)blob3_addr();

return 0;
</pre>

==== tsec_set_key ====
This method takes '''key_data_buf''' (a 16 bytes buffer) as argument and writes its contents to SOR1 registers.
<pre>
// This is TSEC_MMIO + 0x1000 + (0x1C300 / 0x40)
*(u32 *)TSEC_DMA_TIMEOUT = 0xFFF;

// Read the key's words
u32 key0 = *(u32 *)(key_data_buf + 0x00);
u32 key1 = *(u32 *)(key_data_buf + 0x04);
u32 key2 = *(u32 *)(key_data_buf + 0x08);
u32 key3 = *(u32 *)(key_data_buf + 0x0C);

u32 result = 0;

// Write key0 to SOR1 and check for errors
result = tsec_dma_write(NV_SOR_DP_HDCP_BKSV_LSB, key0);
if (result)
return result;

// Write key1 to SOR1 and check for errors
result = tsec_dma_write(NV_SOR_TMDS_HDCP_BKSV_LSB, key1);
if (result)
return result;

// Write key2 to SOR1 and check for errors
result = tsec_dma_write(NV_SOR_TMDS_HDCP_CN_MSB, key2);
if (result)
return result;

// Write key3 to SOR1 and check for errors
result = tsec_dma_write(NV_SOR_TMDS_HDCP_CN_LSB, key3);
if (result)
return result;

return result;
</pre>

===== tsec_dma_write =====
This method takes '''addr''' and '''value''' as arguments and performs a DMA write using TSEC MMIO.
<pre>
u32 result = 0;

// Wait for TSEC DMA engine
// This waits for bit 0x0C in TSEC_DMA_CMD to be 0
result = wait_tsec_dma();

// Wait failed
if (result)
return 1;

// Set the destination address
// This is TSEC_MMIO + 0x1000 + (0x1C100 / 0x40)
*(u32 *)TSEC_DMA_ADDR = addr;

// Set the value
// This is TSEC_MMIO + 0x1000 + (0x1C200 / 0x40)
*(u32 *)TSEC_DMA_VAL = value;

// Start transfer
// This is TSEC_MMIO + 0x1000 + (0x1C000 / 0x40)
*(u32 *)TSEC_DMA_CMD = 0x800000F2;

// Wait for TSEC DMA engine
// This waits for bit 0x0C in TSEC_DMA_CMD to be 0
result = wait_tsec_dma();

// Wait failed
if (result)
return 1;

return 0;
</pre>

== KeygenLdr ==
This stage is responsible for reconfiguring the Falcon's crypto co-processor and loading, decrypting, authenticating and executing [[#Keygen|Keygen]].

=== Main ===
<pre>
// Clear interrupt flags
$flags.ie0 = 0;
$flags.ie1 = 0;
$flags.ie2 = 0;

// Clear overrides
cxset(0x80);

// Clear bit 0x13 in cauth
$cauth = ($cauth & ~(1 << 0x13));

// Set the target port for memory transfers
$xtargets = 0;

// Wait for all data loads/stores to finish
xdwait();

// Wait for all code loads to finish
xcwait();

// The next 2 xfer instructions will be overridden
// and target changes from DMA to crypto
cxset(0x02);

// Transfer data to crypto register c0
// This should clear any leftover data
xdst(0, 0);

// Wait for all data loads/stores to finish
xdwait();

// Clear all crypto registers, except c6 which is used for auth
cxor($c0, $c0);
cmov($c1, $c0);
cmov($c2, $c0);
cmov($c3, $c0);
cmov($c4, $c0);
cmov($c5, $c0);
cmov($c7, $c0);

// Clear TSEC_TEGRA_CTL_TKFI_KFUSE
// This is TSEC_MMIO + 0x1000 + (0x20E00 / 0x40)
*(u32 *)TSEC_TEGRA_CTL &= 0xFFFEFFFF;

// Set TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
// This is TSEC_MMIO + 0x1000 + (0x10600 / 0x40)
*(u32 *)TSEC_SCP_CTL_PKEY |= 0x01;

u32 is_pkey_loaded = 0;

// Wait for TSEC_SCP_CTL_PKEY_LOADED
while (!is_pkey_loaded)
is_pkey_loaded = (*(u32 *)TSEC_SCP_CTL_PKEY & 0x02);

// Read data segment size from IO space
u32 data_seg_size = *(u32 *)UC_CAPS;
data_seg_size >>= 0x09;
data_seg_size &= 0x1FF;
data_seg_size <<= 0x08;

// Check stack bounds
if (($sp >= data_seg_size) || ($sp < 0x800))
exit();

// Load and execute the Keygen stage
load_keygen(key_buf, key_version, is_blob_dec);

// Clear the cauth signature
csigclr();

// Clear all crypto registers
cxor($c0, $c0);
cxor($c1, $c1);
cxor($c2, $c2);
cxor($c3, $c3);
cxor($c4, $c4);
cxor($c5, $c5);
cxor($c6, $c6);
cxor($c7, $c7);

// Take SCP out of lockdown
// This is TSEC_MMIO + 0x1000 + (0x10300 / 0x40)
*(u32 *)TSEC_SCP_CTL_LOCK = 0;

return;
</pre>

==== load_keygen ====
This method takes '''key_buf''', '''key_version''' and '''is_blob_dec''' as arguments and is responsible for loading, decrypting, authenticating and executing [[#Keygen|Keygen]].
Notably, it also does AES-CMAC over the unauthorized [[#Boot|Boot]] blob to make sure it hasn't been tampered with.
<pre>
u32 res = 0;

u32 dmem_start = 0;
u32 blob0_addr = 0;
u32 blob0_size = *(u32 *)(key_buf + 0x70);

// Load blob0 code to the start of the data segment
memcpy_i2d(dmem_start, blob0_addr, blob0_size);

// Generate "CODE_SIG_01" key into c4 crypto register
gen_usr_key(0, 0);

// Encrypt buffer with c4
u8 sig_key[0x10];
enc_buf(sig_key, blob0_size);

u32 src_addr = dmem_start;
u32 src_size = blob0_size;
u32 iv_addr = sig_key;
u32 dst_addr = sig_key;
u32 mode = 0x02; // AES-CMAC
u32 use_imem = 0;

// Do AES-CMAC over blob0 code
do_crypto(src_addr, src_size, iv_addr, dst_addr, mode, use_imem);

// Compare the resulting hash with the one from the key buffer
if (memcmp(dst_addr, key_buf + 0x10, 0x10))
{
res = 0xDEADBEEF;
return res;
}

u32 blob1_size = *(u32 *)(key_buf + 0x74);

// Decrypt Keygen blob if needed
if (!is_blob_dec)
{
// Read Stage2's size from key buffer
u32 blob2_size = *(u32 *)(key_buf + 0x78);

// Check stack bounds
if ($sp > blob2_size)
{
u32 blob2_virt_addr = blob0_size + blob1_size;
u32 blob2_phys_addr = blob2_virt_addr + 0x100;

// Read the encrypted Keygen blob
memcpy_i2d(dmem_start, blob2_phys_addr, blob2_size);

// Generate "CODE_ENC_01" key into c4 crypto register
gen_usr_key(0x01, 0x01);

u32 src_addr = dmem_start;
u32 src_size = blob2_size;
u32 iv_addr = key_buf + 0x40;
u32 dst_addr = dmem_start;
u32 mode = 0; // AES-128-CBC
u32 use_imem = 0;

// Decrypt Keygen blob with AES-128-CBC
do_crypto(src_addr, src_size, iv_addr, dst_addr, mode, use_imem);

// Upload decrypted Keygen into Falcon's code segment
bool use_secret = true;
memcpy_d2i(blob2_virt_addr, dmem_start, blob2_size, blob2_virt_addr, use_secret);

// Clear out the decrypted blob
memset(dmem_start, 0, blob2_size);
}
}

// The next 2 xfer instructions will be overridden
// and target changes from DMA to crypto
cxset(0x02);

u32 crypto_reg_flag = 0x00060000;
u32 blob2_hash_addr = key_buf + 0x30;

// Transfer the Keygen auth hash to crypto register c6
xdst(0, (blob2_hash_addr | crypto_reg_flag));

// Wait for all data loads/stores to finish
xdwait();

// Save previous cauth value
u32 cauth_old = $cauth;

// Set auth_addr to blob2_virt_addr and auth_size to blob2_size
$cauth = ((blob2_virt_addr >> 0x08) | (blob2_size << 0x10));

u32 hovi_key_addr = 0;

// Select next stage key
if (key_version == 0x01) // Use HOVI_EKS_01
hovi_key_addr = key_buf + 0x50;
else if (key_version == 0x02) // Use HOVI_COMMON_01
hovi_key_addr = key_buf + 0x60;
else if (key_version == 0x03) // Use debug key (empty)
hovi_key_addr = key_buf + 0x00;
else
res = 0xD0D0D0D0

// Jump to Keygen
if (hovi_key_addr)
res = exec_keygen(hovi_key_addr, key_version);

// Clear out key data
memset(key_buf, 0, 0x7C);

// Restore previous cauth value
$cauth = cauth_old;

return res;
</pre>

===== gen_usr_key =====
This method takes '''type''' and '''mode''' as arguments and generates a key.
<pre>
u8 seed_buf[0x10];

// Read a 16 bytes seed based on supplied type
/*
type == 0: "CODE_SIG_01" + null padding
type == 1: "CODE_ENC_01" + null padding
*/
get_seed(seed_buf, type);

// This will write the seed into crypto register c0
crypto_store(0, seed_buf);

// Load selected secret into crypto register c1
csecret($c1, 0x26);

// Bind c1 register as the key for enc/dec operations
ckeyreg($c1);

// Encrypt seed_buf in c0 using keyreg value as key into c1
cenc($c1, $c0);

// Encrypt the auth signature (stored in c6) with c1 and store in c1
csigenc($c1, $c1);

// Copy the result to c4 (will be used as key)
cmov($c4, $c1);

// Do key expansion for decryption if necessary
if (mode != 0)
ckexp($c4, $c4);

return;
</pre>

===== enc_buf =====
This method takes '''buf''' (a 16 bytes buffer) and '''size''' as arguments and encrypts the supplied buffer.
<pre>
// Set first 3 words to null
*(u32 *)(buf + 0x00) = 0;
*(u32 *)(buf + 0x04) = 0;
*(u32 *)(buf + 0x08) = 0;

// Swap halves (b16, b32 and b16 again) and store it as the last word
*(u32 *)(buf + 0x0C) = (
((size & 0x000000FF) << 0x08 | (size & 0x0000FF00) >> 0x08) << 0x10
| ((size & 0x00FF0000) >> 0x10) << 0x08
| (size & 0xFF000000) >> 0x18
);

// This will write buf into crypto register c3
crypto_store(0x03, buf);

// Bind c4 register as the key for enc/dec operations
ckeyreg($c4);

// Encrypt buf in c3 using keyreg value as key and store in c5
cenc($c5, $c3);

// This will read into buf from crypto register c5
crypto_load(0x05, buf);

return;
</pre>

===== crypto_store =====
This method takes '''reg''' (a crypto register) and '''buf''' (a 16 bytes buffer) as arguments and loads the supplied buffer into the crypto register.
<pre>
// The next two xfer instructions will be overridden
// and target changes from DMA to crypto
cxset(0x02);

// Encode the source buffer and the destination register for the xfer
u32 crypto_xfer_flag = (u32)buf | reg << 0x10;

// Transfer the supplied buffer to the supplied crypto register
xdst(crypto_xfer_flag, crypto_xfer_flag);

// Wait for all data loads/stores to finish
xdwait();

return;
</pre>

===== crypto_load =====
This method takes '''reg''' (a crypto register) and '''buf''' (a 16 bytes buffer) as arguments and loads the supplied buffer into the crypto register.
<pre>
// The next two xfer instructions will be overridden
// and target changes from DMA to crypto
cxset(0x02);

// Encode the destination buffer and the source register for the xfer
u32 crypto_xfer_flag = (u32)buf | reg << 0x10;

// Transfer the contents of the supplied crypto register into the supplied buffer
xdld(crypto_xfer_flag, crypto_xfer_flag);

// Wait for all data loads/stores to finish
xdwait();

return;
</pre>

===== do_crypto =====
This is the method responsible for all crypto operations performed during [[#KeygenLdr|KeygenLdr]]. It takes '''src_addr''', '''src_size''', '''iv_addr''', '''dst_addr''', '''mode''' and '''use_imem''' as arguments.
<pre>
// Check for invalid source data size
if (!src_size || (src_size & 0x0F))
exit();

// Check for invalid source data address
if (src_addr & 0x0F)
exit();

// Check for invalid destination data address
if (dst_addr & 0x0F)
exit();

// Use IV if available
if (iv_addr)
{
// This will write the iv_addr into crypto register c5
crypto_store(0x05, iv_addr);
}
else
{
// Clear c5 register (use null IV)
cxor($c5, $c5);
}

// Bind c4 register as the key for enc/dec operations
ckeyreg(c4);

if (mode == 0x00) // AES-128-CBC decrypt
{
// Create crypto script with 5 instructions
cs0begin(0x05);

cxsin($c3); // Read 0x10 bytes from crypto stream into c3
cdec($c2, $c3); // Decrypt from c3 into c2
cxor($c5, $c2); // XOR c2 with c5 and store in c5
cxsout($c5); // Write 0x10 bytes into crypto stream from c5
cmov($c5, $c3); // Move c3 into c5
}
else if (mode == 0x01) // AES-128-CBC encrypt
{
// Create crypto script with 4 instructions
cs0begin(0x04);

cxsin($c3); // Read 0x10 bytes from crypto stream into c3
cxor($c3, $c5); // XOR c5 with c3 and store in c3
cenc($c5, $c3); // Encrypt from c3 into c5
cxsout($c5); // Write 0x10 bytes into crypto stream from c5
}
else if (mode == 0x02) // AES-CMAC
{
// Create crypto script with 3 instructions
cs0begin(0x03);

cxsin($c3); // Read 0x10 bytes from crypto stream into c3
cxor($c5, $c3); // XOR c5 with c3 and store in c5
cenc($c5, $c5); // Encrypt from c5 into c5
}
else if (mode == 0x03) // AES-128-ECB decrypt
{
// Create crypto script with 3 instructions
cs0begin(0x03);

cxsin($c3); // Read 0x10 bytes from crypto stream into c3
cdec($c5, $c3); // Decrypt from c3 into c5
cxsout($c5); // Write 0x10 bytes into crypto stream from c5
}
else if (mode == 0x04) // AES-128-ECB encrypt
{
// Create crypto script with 3 instructions
cs0begin(0x03);

cxsin($c3); // Read 0x10 bytes from crypto stream into c3
cenc($c5, $c3); // Encrypt from c3 into c5
cxsout($c5); // Write 0x10 bytes into crypto stream from c5
}
else
return;

// Main loop
while (src_size > 0)
{
u32 blk_count = (src_size >> 0x04);

if (blk_count > 0x10)
blk_count = 0x10;

// Check size align
if (blk_count & (blk_count - 0x01))
blk_count = 0x01;

u32 blk_size = (blk_count << 0x04);

u32 crypto_xfer_src = 0;
u32 crypto_xfer_dst = 0;

if (block_size == 0x20)
{
crypto_xfer_src = (0x00030000 | src_addr);
crypto_xfer_dst = (0x00030000 | dst_addr);

// Execute crypto script 2 times (1 for each block)
cs0exec(0x02);
}
else if (block_size == 0x40)
{
crypto_xfer_src = (0x00040000 | src_addr);
crypto_xfer_dst = (0x00040000 | dst_addr);

// Execute crypto script 4 times (1 for each block)
cs0exec(0x04);
}
else if (block_size == 0x80)
{
crypto_xfer_src = (0x00050000 | src_addr);
crypto_xfer_dst = (0x00050000 | dst_addr);

// Execute crypto script 8 times (1 for each block)
cs0exec(0x08);
}
else if (block_size == 0x100)
{
crypto_xfer_src = (0x00060000 | src_addr);
crypto_xfer_dst = (0x00060000 | dst_addr);

// Execute crypto script 16 times (1 for each block)
cs0exec(0x10);
}
else
{
crypto_xfer_src = (0x00020000 | src_addr);
crypto_xfer_dst = (0x00020000 | dst_addr);

// Execute crypto script 1 time (1 for each block)
cs0exec(0x01);

// Ensure proper block size
block_size = 0x10;
}

// The next xfer instruction will be overridden
// and target changes from DMA to crypto input/output stream
if (use_imem)
cxset(0xA1); // Flag 0xA0 is falcon imem <-> crypto input/output stream
else
cxset(0x21); // Flag 0x20 is external mem <-> crypto input/output stream

// Transfer data into the crypto input/output stream
xdst(crypto_xfer_src, crypto_xfer_src);

// AES-CMAC only needs one more xfer instruction
if (mode == 0x02)
{
// The next xfer instruction will be overridden
// and target changes from DMA to crypto input/output stream
if (use_imem)
cxset(0xA1); // Flag 0xA0 is falcon imem <-> crypto input/output stream
else
cxset(0x21); // Flag 0x20 is external mem <-> crypto input/output stream

// Wait for all data loads/stores to finish
xdwait();
}
else // AES enc/dec needs 2 more xfer instructions
{
// The next 2 xfer instructions will be overridden
// and target changes from DMA to crypto input/output stream
if (use_imem)
cxset(0xA2); // Flag 0xA0 is falcon imem <-> crypto input/output stream
else
cxset(0x22); // Flag 0x20 is external mem <-> crypto input/output stream

// Transfer data from the crypto input/output stream
xdld(crypto_xfer_dst, crypto_xfer_dst);

// Wait for all data loads/stores to finish
xdwait();

// Increase the destination address by block size
dst_addr += block_size;
}

// Increase the source address by block size
src_addr += block_size;

// Decrease the source size by block size
src_size -= block_size;
}

// AES-CMAC result is in c5
if (mode == 0x02)
{
// This will read into dst_addr from crypto register c5
crypto_load(0x05, dst_addr);
}

return;
</pre>

== Keygen ==
This stage is decrypted by [[#KeygenLdr|KeygenLdr]] using a key generated by encrypting the KeygenLdr auth signature with a seed encrypted with a csecret. It will generate the final TSEC key.

=== Main ===
The main function takes '''key_addr''' and '''key_type''' as arguments from [[#KeygenLdr|KeygenLdr]].
<pre>
u32 falcon_rev = *(u32 *)UC_CAPS2 & 0x0F;

// Falcon hardware revision must be 5
if (falcon_rev != 0x05)
exit();

// Clear interrupt flags
$flags.ie0 = 0;
$flags.ie1 = 0;
$flags.ie2 = 0;

// Set the target port for memory transfers
$xtargets = 0;

// Generate the TSEC key
gen_tsec_key(key_addr, key_type);

// Clear the cauth signature
csigclr();

// Clear all crypto registers
cxor($c0, $c0);
cxor($c1, $c1);
cxor($c2, $c2);
cxor($c3, $c3);
cxor($c4, $c4);
cxor($c5, $c5);
cxor($c6, $c6);
cxor($c7, $c7);

return;
</pre>

==== gen_tsec_key ====
This method is responsible for generating the final TSEC key. It takes '''key_addr''' and '''key_type''' as arguments.
<pre>
// This will use TSEC DMA to look for 0x34C2E1DA in host1x scratch space
u32 host1x_res = check_host1x_magic();

// Failed to find magic word
if (host1x_res != 0)
return;

u32 crypto_reg_flag = 0x00000000;

// The next 0x02 xfer instructions will be overridden
// and target changes from DMA to crypto register
cxset(0x02);

// Transfer the seed in key_addr to crypto register c0
xdst(0, (key_addr | crypto_reg_flag));

// Wait for all data loads/stores to finish
xdwait();

crypto_reg_flag = 0x00020000;

if (key_type == 0x01) // HOVI_EKS_01
{
// Load selected secret into crypto register c1
csecret($c1, 0x3F);

// Encrypt the auth signature with c1 and store in c1
csigenc($c1, $c1);

// Load selected secret into crypto register c2
csecret($c2, 0x00);

// Bind c2 register as the key for enc/dec operations
ckeyreg($c2);

// Encrypt the seed from key_addr and store in c2
cenc($c2, $c0);

// Bind c2 register as the key for enc/dec operations
ckeyreg($c2);

// Encrypt the auth signature with c2 and store in c2
csigenc($c2, $c2);

// Bind c2 register as the key for enc/dec operations
ckeyreg($c2);

// Encrypt c1 and store in c2
cenc($c2, $c1);

// The next 0x02 xfer instructions will be overridden
// and target changes from DMA to crypto register
cxset(0x02);

// Transfer the resulting key from crypto register c2 to key_addr
xdld(0, (key_addr | crypto_reg_flag));

// Wait for all data loads/stores to finish
xdwait();
}
else if (key == 0x02) // HOVI_COMMON_01
{
// Load selected secret into crypto register c2
csecret($c2, 0x00);

// Bind c2 register as the key for enc/dec operations
ckeyreg($c2);

// Encrypt the seed from key_addr and store in c2
cenc($c2, $c0);

// Bind c2 register as the key for enc/dec operations
ckeyreg($c2);

// Encrypt the auth signature with c2 and store in c2
csigenc($c2, $c2);

// The next 0x02 xfer instructions will be overridden
// and target changes from DMA to crypto register
cxset(0x02);

// Transfer the resulting key from crypto register c2 to key_addr
xdld(0, (key_addr | crypto_reg_flag));

// Wait for all data loads/stores to finish
xdwait();
}

// Use TSEC DMA to write the key in SOR1 registers
sor1_set_key(key_addr);

return;
</pre>

==== sor1_set_key ====
This method takes '''key_addr''' (start address of a 16 bytes buffer) as argument and transfers its contents to SOR1 registers.

The implementation is equivalent to [[#tsec_set_key|tsec_set_key]].

== SecureBootLdr ==
[6.2.0+] This was introduced to try to recover the secure boot from the RCM vulnerability.

This stage starts by authenticating and executing [[#KeygenLdr|KeygenLdr]] which in turn authenticates, decrypts and executes [[#Keygen|Keygen]] (both blobs remain unchanged from previous firmware versions).
After the TSEC key has been generated, execution returns to this stage which then parses and executes [[#SecureBoot|SecureBoot]].

=== Main ===
<pre>
u8 key_data_buf[0x84];
u8 tmp_key_data_buf[0x84];

// Read the key data from memory
u32 key_data_addr = 0x300;
u32 key_data_size = 0x84;
memcpy_i2d(key_data_buf, key_data_addr, key_data_size);

// Read the KeygenLdr blob from memory
u32 boot_base_addr = 0;
u32 blob1_addr = 0x400;
u32 blob1_size = *(u32 *)(key_data_buf + 0x74);
memcpy_i2d(boot_base_addr, blob1_addr, blob1_size);

// Upload the next code segment into Falcon's CODE region
u32 blob1_virt_addr = 0x300;
bool use_secret = true;
memcpy_d2i(blob1_virt_addr, boot_base_addr, blob1_size, blob1_virt_addr, use_secret);

// Backup the key data
memcpy(tmp_key_data_buf, key_data_buf, 0x84);

// Save previous cauth value
u32 cauth_old = $cauth;

// Set auth_addr to 0x300 and auth_size to blob1_size
$cauth = ((blob1_size << 0x10) | (0x300 >> 0x08));

// The next 2 xfer instructions will be overridden
// and target changes from DMA to crypto
cxset(0x02);

u32 crypto_reg_flag = 0x00060000;
u32 blob1_hash_addr = tmp_key_data_buf + 0x20;

// Transfer data to crypto register c6
xdst(0, (blob1_hash_addr | crypto_reg_flag));

// Wait for all data loads/stores to finish
xdwait();

u32 key_version = 0x01;
bool is_blob_dec = false;

// Jump to KeygenLdr
u32 keygenldr_res = exec_keygenldr(tmp_key_data_buf, key_version, is_blob_dec);

// Set boot finish magic on success
if (keygenldr_res == 0)
keygenldr_res = 0xB0B0B0B0

// Write result to FALCON_SCRATCH1
*(u32 *)FALCON_SCRATCH1 = keygenldr_res;

if (keygenldr_res != 0xB0B0B0B0)
return keygenldr_res;

// Restore previous cauth value
$cauth = cauth_old;

u8 flcn_hdr_buf[0x18];
u8 flcn_os_hdr_buf[0x10];

blob1_size = *(u32 *)(key_data_buf + 0x74);
u32 blob2_size = *(u32 *)(key_data_buf + 0x78);
u32 blob0_size = *(u32 *)(key_data_buf + 0x70);

// Read the SecureBoot blob's Falcon header from memory
u32 blob4_flcn_hdr_addr = (((blob0_size + blob1_size) + 0x100) + blob2_size);
memcpy_i2d(flcn_hdr_buf, blob4_flcn_hdr_addr, 0x18);

blob1_size = *(u32 *)(key_data_buf + 0x74);
blob2_size = *(u32 *)(key_data_buf + 0x78);
blob0_size = *(u32 *)(key_data_buf + 0x70);
u32 flcn_hdr_size = *(u32 *)(flcn_hdr_buf + 0x0C);

// Read the SecureBoot blob's Falcon OS header from memory
u32 blob4_flcn_os_hdr_addr = ((((blob0_size + blob1_size) + 0x100) + blob2_size) + flcn_hdr_size);
memcpy_i2d(flcn_os_hdr_buf, blob4_flcn_os_hdr_addr, 0x10);

blob1_size = *(u32 *)(key_data_buf + 0x74);
blob2_size = *(u32 *)(key_data_buf + 0x78);
blob0_size = *(u32 *)(key_data_buf + 0x70);
u32 flcn_code_hdr_size = *(u32 *)(flcn_hdr_buf + 0x10);
u32 flcn_os_size = *(u32 *)(flcn_os_hdr_buf + 0x04);

// Read the SecureBoot blob's Falcon OS image from memory
u32 blob4_flcn_os_addr = ((((blob0_size + blob1_size) + 0x100) + blob2_size) + flcn_code_hdr_size);
memcpy_i2d(boot_base_addr, blob4_flcn_os_hdr_addr, flcn_os_size);

// Upload the SecureBoot's Falcon OS image boot stub code segment into Falcon's CODE region
u32 blob4_flcn_os_boot_virt_addr = 0;
u32 blob4_flcn_os_boot_size = 0x100;
use_secret = false;
memcpy_d2i(blob4_flcn_os_boot_virt_addr, boot_base_addr, blob4_flcn_os_boot_size, blob4_flcn_os_boot_virt_addr, use_secret);

flcn_os_size = *(u32 *)(flcn_os_hdr_buf + 0x04);

// Upload the SecureBoot blob's Falcon OS encrypted image code segment into Falcon's CODE region
u32 blob4_flcn_os_img_virt_addr = 0x100;
u32 blob4_flcn_os_img_size = (flcn_os_size - 0x100);
use_secret = true;
memcpy_d2i(blob4_flcn_os_img_virt_addr, boot_base_addr + 0x100, blob4_flcn_os_img_size, blob4_flcn_os_img_virt_addr, use_secret);

// Wait for all code loads to finish
xcwait();

blob1_size = *(u32 *)(key_data_buf + 0x74);
blob2_size = *(u32 *)(key_data_buf + 0x78);
blob0_size = *(u32 *)(key_data_buf + 0x70);
flcn_code_hdr_size = *(u32 *)(flcn_hdr_buf + 0x10);
u32 flcn_os_code_size = *(u32 *)(flcn_os_hdr_buf + 0x08);

// Read the SecureBoot blob's falcon OS image's hash from memory
u32 blob4_flcn_os_img_hash_addr = (((((blob0_size + blob1_size) + 0x100) + blob2_size) + flcn_code_hdr_size) + flcn_os_code_size);
memcpy_i2d(0, blob4_flcn_os_img_hash_addr, 0x10);

// Read data segment size from IO space
u32 data_seg_size = *(u32 *)FALCON_HWCFG;
data_seg_size >>= 0x03;
data_seg_size &= 0x3FC0;

u32 data_addr = 0x10;

// Clear all data except the first 0x10 bytes (SecureBoot blob's Falcon OS image's hash)
for (int data_word_count = 0x04; data_word_count < data_seg_size; data_word_count++)
{
*(u32 *)(data_addr) = 0;
data_addr += 0x04;
}

// Clear all crypto registers
cxor($c0, $c0);
cxor($c1, $c1);
cxor($c2, $c2);
cxor($c3, $c3);
cxor($c4, $c4);
cxor($c5, $c5);
cxor($c6, $c6);
cxor($c7, $c7);

// Clear the cauth signature
csigclr();

// Jump to SecureBoot
load_secboot();

return 0xB0B0B0B0;
</pre>

== SecureBoot ==
[6.2.0+] This was introduced to try to recover the secure boot from the RCM vulnerability.

This stage prepares the stack then authenticates, decrypts and executes the SecureBoot blob's Falcon OS image.

=== Main ===
<pre>
// Read data segment size from IO space
u32 data_seg_size = *(u32 *)UC_CAPS;
data_seg_size >>= 0x01;
data_seg_size &= 0xFF00;

// Set the stack pointer
$sp = data_seg_size;

// Jump to the SecureBoot blob's Falcon OS image boot stub
init_secboot();

// Halt execution
exit();

return;
</pre>

==== init_secboot ====
This method takes no arguments and is responsible for loading, authenticating and executing [[#SecureBoot|SecureBoot]].
<pre>
// Read the transfer base address from IO space
u32 xfer_ext_base_addr = *(u32 *)FALCON_DMATRFBASE;

// Copy transfer base address to data memory
u32 scratch_data_addr = 0x300;
*(u32 *)scratch_data_addr = xfer_ext_base_addr;

// Set the transfer base address
xcbase(xfer_ext_base_addr);

// The next xfer instruction will be overridden
// and target changes from DMA to crypto
cxset(0x01);

u32 crypto_reg_flag = 0x00060000;
u32 blob4_flcn_os_img_hash_addr = 0;

// Transfer data to crypto register c6
xdst(0, (blob4_flcn_os_img_hash_addr | crypto_reg_flag));

// The next xfer instruction will be overridden
// and target changes from DMA to crypto
cxset(0x01);

// Wait for all data loads/stores to finish
xdwait();

cmov($c7, $c6);
cxor($c7, $c7);

// Set auth_addr to 0x100, auth_size to 0x1300,
// bit 16 (use_secret) and bit 17 (is_encrypted)
$cauth = ((0x02 << 0x10) | (0x01 << 0x10) | (0x1300 << 0x10) | (0x100 >> 0x08));

// Clear interrupt flags
$flags.ie0 = 0;
$flags.ie1 = 0;
$flags.ie2 = 0;

// Jump to the SecureBoot blob's Falcon OS image
exec_secboot();

return 0x0F0F0F0F;
</pre>

[8.1.0+] Removed transfer base address setting and added IMEM protection.
<pre>
// The next xfer instruction will be overridden
// and target changes from DMA to crypto
cxset(0x01);

u32 crypto_reg_flag = 0x00060000;
u32 blob4_flcn_os_img_hash_addr = 0;

// Transfer data to crypto register c6
xdst(0, (blob4_flcn_os_img_hash_addr | crypto_reg_flag));

// The next xfer instruction will be overridden
// and target changes from DMA to crypto
cxset(0x01);

// Wait for all data loads/stores to finish
xdwait();

cmov($c7, $c6);
cxor($c7, $c7);

// Set auth_addr to 0x100, auth_size to 0x1D00,
// bit 16 (use_secret) and bit 17 (is_encrypted)
$cauth = ((0x02 << 0x10) | (0x01 << 0x10) | (0x1D00 << 0x10) | (0x100 >> 0x08));

// Clear interrupt flags
$flags.ie0 = 0;
$flags.ie1 = 0;
$flags.ie2 = 0;

// Fill remaining IMEM with secret pages
bool use_secret = true;
memcpy_d2i(0x1E00, 0, 0x2200, 0x1E00, use_secret);
memcpy_d2i(0x4000, 0, 0x4000, 0x4000, use_secret);

// Wait for all code loads to finish
xcwait();

// Jump to the SecureBoot blob's Falcon OS image
exec_secboot();

return 0x0F0F0F0F;
</pre>

==== exec_secboot ====
This is the signed and encrypted portion of the [[#SecureBoot|SecureBoot]] payload.
<pre>
// Recover the transfer base address from the stack
u32 xfer_ext_base_addr = *(u32 *)scratch_data_addr;

// Return the TLB entry that covers the virtual address
u32 tlb_entry = vtlb(xfer_ext_base_addr);

// Clear Falcon CPU control
*(u32 *)FALCON_CPUCTL = 0;

// Halt if the external page is marked as secret
if ((tlb_entry & 0x4000000) != 0)
exit();

// Read data segment size from IO space
u32 data_seg_size = *(u32 *)UC_CAPS;
data_seg_size >>= 0x01;
data_seg_size &= 0xFF00;

// Set the stack pointer
$sp = data_seg_size;

// Fill all DMEM with a pointer to a trap function (just exits 3 times)
for (int i = 0; i < data_seg_size; i += 0x04) {
*(u32 *)i = (u32)trap_func();
}

// Initialize the TRNG and generate random data in DMEM
init_rnd();

// Issue a randomized delay and return a random value
u32 rnd_val = rnd_delay(0xFF);

// Load the TSEC key from SOR1 registers into DMEM
sor1_get_key();

// Initialize CAR registers
car_init();

// Check certain CAR, PMC and FUSE registers
test_car_pmc_fuse();

// Ensure CLK_RST_CONTROLLER_CLK_SOURCE_TSEC_0 is 0x02
test_clk_source_tsec();

// Set FLOW_MODE_WAITEVENT in FLOW_CTLR_HALT_COP_EVENTS_0
halt_bpmp();

// Initialize the CCPLEX
ccplex_init();

// Check certain CAR, PMC and FUSE registers
test_car_pmc_fuse();

bool is_se_ready = false;

// Wait for SE to be ready
while (!is_se_ready)
is_se_ready = check_se_status();

// Test MC_IRAM_BOM and MC_IRAM_TOM
u32 mc_iram_aperture_res = test_mc_iram_aperture();

if (mc_iram_aperture_res != 0xAAAAAAAA)
{
// Clear the entire DMEM region
clear_dmem();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Ensure FUSE_SKU_INFO is 0x83
test_fuse_sku_info();

// Write TSEC key to SE keyslot 0x0C
se_set_keyslot_12();

// Write TSEC root key to SE keyslot 0x0D
se_set_keyslot_13();

// Decrypt Package1
decrypt_pk11();

// Check certain CAR, PMC and FUSE registers
test_car_pmc_fuse();

// Parse Package1 header and return entry address
u32 entry_addr = parse_pk11();

// Set the exception vectors
set_excp_vec(entry_addr);

// Fill the top 0x500 bytes in DMEM with a pointer to trap function (just exits 3 times)
for (int i = 0; i < 0x500; i += 0x04) {
*(u32 *)i = (u32)trap_func();
}

// Clear all crypto registers
cxor($c0, $c0);
cxor($c1, $c1);
cxor($c2, $c2);
cxor($c3, $c3);
cxor($c4, $c4);
cxor($c5, $c5);
cxor($c6, $c6);
cxor($c7, $c7);

// Take SCP out of lockdown
unlock_scp();

// Clear FLOW_CTLR_HALT_COP_EVENTS_0
resume_bpmp();

// Clear the entire DMEM region
clear_dmem();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();

return;
</pre>

[7.0.0+] Many changes were introduced to mitigate and prevent attacks.
<pre>
// Recover the transfer base address from the stack
u32 xfer_ext_base_addr = *(u32 *)scratch_data_addr;

// Return the TLB entry that covers the virtual address
u32 tlb_entry = vtlb(xfer_ext_base_addr);

// Clear Falcon CPU control
*(u32 *)FALCON_CPUCTL = 0;

// Halt if the external page is marked as secret
if ((tlb_entry & 0x4000000) != 0)
exit();

// Read data segment size from IO space
u32 data_seg_size = *(u32 *)UC_CAPS;
data_seg_size >>= 0x01;
data_seg_size &= 0xFF00;

// Set the stack pointer
$sp = data_seg_size;

// Fill all DMEM with a pointer to a trap function (just exits 3 times)
for (int i = 0; i < data_seg_size; i += 0x04) {
*(u32 *)i = (u32)trap_func();
}

// Initialize the TRNG and generate random data in DMEM
init_rnd();

// Issue a randomized delay and return a random value
u32 rnd_val = rnd_delay(0xFF);

// Enable and test SMMU bypassing in the TFBIF
tfbif_smmu_cfg(0x01);

// Issue a randomized delay and return a random value
rnd_val = rnd_delay(0xFF);

// Test SMMU bypassing in the TFBIF
tfbif_smmu_cfg(0x00);

// Issue a randomized delay and return a random value
rnd_val = rnd_delay(0xFF);

// Test SMMU bypassing in the TFBIF
tfbif_smmu_cfg(0x00);

// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Test randomized offsets for read/write integrity in MC, FUSE, IRAM and TZRAM
u32 test_res = test_mc_fuse_iram_tzram();

if (test_res != 0xAAAAAAAA)
{
// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Try to detect virtualization by enabling and disabling random CAR devices
test_res = test_car();

if (test_res != 0xAAAAAAAA)
{
// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Test memory transfer integrity
test_res = test_mem_xfer();

if (test_res != 0xAAAAAAAA)
{
// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Set FLOW_MODE_WAITEVENT in FLOW_CTLR_HALT_COP_EVENTS_0
halt_bpmp();

// Initialize the CCPLEX
ccplex_init();

// Check if SE is ready
u32 se_status = check_se_status();

if (se_status != 0)
{
// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Load the TSEC key from SOR1 registers into DMEM
sor1_get_key();

// Initialize CAR registers
car_init();

// Check certain CAR, PMC and FUSE registers
test_car_pmc_fuse();

// Try to detect virtualization by enabling and disabling random CAR devices
test_res = test_car();

if (test_res != 0xAAAAAAAA)
{
// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Ensure FUSE_SKU_INFO is 0x83
test_fuse_sku_info();

// Try to detect virtualization using MC_SMMU_AVPC_ASID and FUSE_ECO_RESERVE_0
test_smmu_fuse();

// Test MC_IRAM_BOM and MC_IRAM_TOM
test_res = test_mc_iram_aperture();

if (test_res != 0xAAAAAAAA)
{
// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Check certain CAR, PMC and FUSE registers
test_car_pmc_fuse();

// Test memory transfer integrity
test_res = test_mem_xfer();

if (test_res != 0xAAAAAAAA)
{
// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Try to detect virtualization using MC_SMMU_AVPC_ASID and FUSE_ECO_RESERVE_0
test_smmu_fuse();

// Test MC_IRAM_BOM and MC_IRAM_TOM
test_res = test_mc_iram_aperture();

if (test_res != 0xAAAAAAAA)
{
// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Test SMMU bypassing in the TFBIF
tfbif_smmu_cfg(0x00);

// Decrypt Package1
decrypt_pk11();

// Write TSEC root key to SE keyslot 0x0D
se_set_keyslot_13();

// Write TSEC key to SE keyslot 0x0C
se_set_keyslot_12();

// Clear the cauth signature
csigclr();

// Check certain CAR, PMC and FUSE registers
test_car_pmc_fuse();

// Test memory transfer integrity
test_res = test_mem_xfer();

if (test_res != 0xAAAAAAAA)
{
// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Try to detect virtualization using MC_SMMU_AVPC_ASID and FUSE_ECO_RESERVE_0
test_smmu_fuse();

// Test randomized offsets for read/write integrity in MC, FUSE, IRAM and TZRAM
test_res = test_mc_fuse_iram_tzram();

if (test_res != 0xAAAAAAAA)
{
// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Test MC_IRAM_BOM and MC_IRAM_TOM
test_res = test_mc_iram_aperture();

if (test_res != 0xAAAAAAAA)
{
// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Test SMMU bypassing in the TFBIF
tfbif_smmu_cfg(0x00);

// Parse Package1 header and return entry address
u32 entry_addr = parse_pk11();

// Set the exception vectors
set_excp_vec(entry_addr);

// Fill the top 0x500 bytes in DMEM with a pointer to trap function (just exits)
for (int i = 0; i < 0x500; i += 0x04) {
*(u32 *)i = (u32)trap_func();
}

// Clear all crypto registers
cxor($c0, $c0);
cxor($c1, $c1);
cxor($c2, $c2);
cxor($c3, $c3);
cxor($c4, $c4);
cxor($c5, $c5);
cxor($c6, $c6);
cxor($c7, $c7);

// Take SCP out of lockdown
unlock_scp();

// Test memory transfer integrity
test_res = test_mem_xfer();

if (test_res != 0xAAAAAAAA)
{
// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Try to detect virtualization using MC_SMMU_AVPC_ASID and FUSE_ECO_RESERVE_0
test_smmu_fuse();

// Test MC_IRAM_BOM and MC_IRAM_TOM
test_res = test_mc_iram_aperture();

if (test_res != 0xAAAAAAAA)
{
// Fill SE keyslots 12 and 13 with random data
se_set_keyslot_rnd();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();
}

// Test SMMU bypassing in the TFBIF
tfbif_smmu_cfg(0x00);

// Clear FLOW_CTLR_HALT_COP_EVENTS_0
resume_bpmp();

// Clear the entire DMEM region and every crypto register
clear_dmem_and_crypto();

// Halt 5 times for no good reason
exit();
exit();
exit();
exit();
exit();

return;
</pre>

[8.1.0+] Key derivation algorithm was changed. Very minor changes were introduced to mitigate and prevent attacks.

== Key data ==
Small buffer stored after the [[#Boot|Boot]] blob and used across all stages.

{| class="wikitable" border="1"
! Offset
! Size
! Description
|-
| 0x00
| 0x10
| Debug key (empty)
|-
| 0x10
| 0x10
| blob0 ([[#Boot|Boot]]) auth hash
|-
| 0x20
| 0x10
| blob1 ([[#KeygenLdr|KeygenLdr]]) auth hash
|-
| 0x30
| 0x10
| blob2 ([[#Keygen|Keygen]]) auth hash
|-
| 0x40
| 0x10
| blob2 ([[#Keygen|Keygen]]) AES IV
|-
| 0x50
| 0x10
| HOVI EKS seed
|-
| 0x60
| 0x10
| HOVI COMMON seed
|-
| 0x70
| 0x04
| blob0 ([[#Boot|Boot]]) size
|-
| 0x74
| 0x04
| blob1 ([[#KeygenLdr|KeygenLdr]]) size
|-
| 0x78
| 0x04
| blob2 ([[#Keygen|Keygen]]) size
|-
| 0x7C
| 0x04
| [6.2.0+] blob3 ([[#SecureBootLdr|SecureBootLdr]]) size
|-
| 0x80
| 0x04
| [6.2.0+] blob4 ([[#SecureBoot|SecureBoot]]) size
|}