TSEC

TSEC (Tegra Security Co-processor) is a dedicated unit powered by a NVIDIA Falcon microprocessor with crypto extensions.

Driver

A host driver for communicating with the TSEC is mapped to physical address 0x54500000 with a total size of 0x40000 bytes and exposes several registers.

Registers

Registers from 0x54500000 to 0x54501000 are used to configure the host interface (HOST1X).

Registers from 0x54501000 to 0x54502000 are a MMIO window for communicating with the Falcon microprocessor. From this range, the subset of registers from 0x54501400 to 0x54501FE8 are specific to the TSEC and are subdivided into:

• 0x54501400 to 0x54501500: SCP (Secure Crypto Processor?).
• 0x54501500 to 0x54501600: TRNG (True Random Number Generator).
• 0x54501600 to 0x54501700: TFBIF (Tegra Framebuffer Interface).
• 0x54501700 to 0x54501800: DMA.
• 0x54501800 to 0x54501900: TEGRA (miscellaneous interfaces).

Name	Address	Width
TSEC_THI_INCR_SYNCPT	0x54500000	0x04
TSEC_THI_INCR_SYNCPT_ERR	0x54500008	0x04
TSEC_THI_CTXSW_INCR_SYNCPT	0x5450000C	0x04
TSEC_THI_CTXSW	0x54500020	0x04
TSEC_THI_CONT_SYNCPT_EOF	0x54500028	0x04
TSEC_THI_METHOD0	0x54500040	0x04
TSEC_THI_METHOD1	0x54500044	0x04
TSEC_THI_INT_STATUS	0x54500078	0x04
TSEC_THI_INT_MASK	0x5450007C	0x04
TSEC_THI_SLCG_STATUS	0x54500084	0x04
TSEC_THI_SLCG_OVERRIDE_HIGH_A	0x54500088	0x04
TSEC_THI_SLCG_OVERRIDE_LOW_A	0x5450008C	0x04
TSEC_THI_CLK_OVERRIDE	0x54500E00	0x04
FALCON_IRQSSET	0x54501000	0x04
FALCON_IRQSCLR	0x54501004	0x04
FALCON_IRQSTAT	0x54501008	0x04
FALCON_IRQMODE	0x5450100C	0x04
FALCON_IRQMSET	0x54501010	0x04
FALCON_IRQMCLR	0x54501014	0x04
FALCON_IRQMASK	0x54501018	0x04
FALCON_IRQDEST	0x5450101C	0x04
FALCON_GPTMR_PERIOD	0x54501020	0x04
FALCON_GPTMR_TIME	0x54501024	0x04
FALCON_GPTMR_ENABLE	0x54501028	0x04
FALCON_TIME_LOW	0x5450102C	0x04
FALCON_TIME_HIGH	0x54501030	0x04
FALCON_WDTMR_TIME	0x54501034	0x04
FALCON_WDTMR_ENABLE	0x54501038	0x04
FALCON_UNK_3C	0x5450103C	0x04
FALCON_MAILBOX0	0x54501040	0x04
FALCON_MAILBOX1	0x54501044	0x04
FALCON_ITFEN	0x54501048	0x04
FALCON_IDLESTATE	0x5450104C	0x04
FALCON_CURCTX	0x54501050	0x04
FALCON_NXTCTX	0x54501054	0x04
FALCON_CMDCTX	0x54501058	0x04
FALCON_STATUS_MASK	0x5450105C	0x04
FALCON_VM_SUPERVISOR	0x54501060	0x04
FALCON_MTHD_DATA	0x54501064	0x04
FALCON_MTHD_CMD	0x54501068	0x04
FALCON_MTHD_DATA_WR	0x5450106C	0x04
FALCON_MTHD_OCCUPIED	0x54501070	0x04
FALCON_MTHD_ACK	0x54501074	0x04
FALCON_MTHD_LIMIT	0x54501078	0x04
FALCON_SUBENGINE_RESET	0x5450107C	0x04
FALCON_OS	0x54501080	0x04
FALCON_DEBUG0	0x54501084	0x04
FALCON_PM_SIGNAL	0x54501088	0x04
FALCON_PM_MODE	0x5450108C	0x04
FALCON_DEBUG1	0x54501090	0x04
FALCON_DEBUGINFO	0x54501094	0x04
FALCON_BREAKPOINT0	0x54501098	0x04
FALCON_BREAKPOINT1	0x5450109C	0x04
FALCON_CGCTL	0x545010A0	0x04
FALCON_ENGCTL	0x545010A4	0x04
FALCON_PM_SEL	0x545010A8	0x04
FALCON_HOST_IO_INDEX	0x545010AC	0x04
FALCON_BREAKPOINT2	0x545010B0	0x04
FALCON_BREAKPOINT3	0x545010B4	0x04
FALCON_BREAKPOINT4	0x545010B8	0x04
FALCON_EXCI	0x545010D0	0x04
FALCON_UNK_D4	0x545010D4	0x04
FALCON_UNK_D8	0x545010D8	0x04
FALCON_UNK_DC	0x545010DC	0x04
FALCON_UNK_E0	0x545010E0	0x04
FALCON_CPUCTL	0x54501100	0x04
FALCON_BOOTVEC	0x54501104	0x04
FALCON_HWCFG	0x54501108	0x04
FALCON_DMACTL	0x5450110C	0x04
FALCON_DMATRFBASE	0x54501110	0x04
FALCON_DMATRFMOFFS	0x54501114	0x04
FALCON_DMATRFCMD	0x54501118	0x04
FALCON_DMATRFFBOFFS	0x5450111C	0x04
FALCON_DMATRFSTAT	0x54501120	0x04
FALCON_CRYPTTRFSTAT	0x54501124	0x04
FALCON_CPUSTAT	0x54501128	0x04
FALCON_HWCFG2	0x5450112C	0x04
FALCON_CPUCTL_ALIAS	0x54501130	0x04
FALCON_IMCTL	0x54501140	0x04
FALCON_IMSTAT	0x54501144	0x04
FALCON_TRACEIDX	0x54501148	0x04
FALCON_TRACEPC	0x5450114C	0x04
FALCON_IMFILLRNG0	0x54501150	0x04
FALCON_IMFILLRNG1	0x54501154	0x04
FALCON_IMFILLCTL	0x54501158	0x04
FALCON_IMCTL_DEBUG	0x5450115C	0x04
FALCON_EXTERRWIN	0x54501160	0x04
FALCON_EXTERRCFG	0x54501164	0x04
FALCON_EXTERRADDR	0x54501168	0x04
FALCON_EXTERRSTAT	0x5450116C	0x04
FALCON_CG2	0x5450117C	0x04
FALCON_IMEMC	0x54501180	0x04
FALCON_IMEMD	0x54501184	0x04
FALCON_IMEMT	0x54501188	0x04
FALCON_DMEMC0	0x545011C0	0x04
FALCON_DMEMD0	0x545011C4	0x04
FALCON_DMEMC1	0x545011C8	0x04
FALCON_DMEMD1	0x545011CC	0x04
FALCON_DMEMC2	0x545011D0	0x04
FALCON_DMEMD2	0x545011D4	0x04
FALCON_DMEMC3	0x545011D8	0x04
FALCON_DMEMD3	0x545011DC	0x04
FALCON_DMEMC4	0x545011E0	0x04
FALCON_DMEMD4	0x545011E4	0x04
FALCON_DMEMC5	0x545011E8	0x04
FALCON_DMEMD5	0x545011EC	0x04
FALCON_DMEMC6	0x545011F0	0x04
FALCON_DMEMD6	0x545011F4	0x04
FALCON_DMEMC7	0x545011F8	0x04
FALCON_DMEMD7	0x545011FC	0x04
FALCON_ICD_CMD	0x54501200	0x04
FALCON_ICD_ADDR	0x54501204	0x04
FALCON_ICD_WDATA	0x54501208	0x04
FALCON_ICD_RDATA	0x5450120C	0x04
FALCON_SCTL	0x54501240	0x04
FALCON_SCTL_STAT	0x54501244	0x04
FALCON_UNK_248	0x54501248	0x04
FALCON_UNK_24C	0x5450124C	0x04
FALCON_UNK_250	0x54501250	0x04
FALCON_UNK_260	0x54501260	0x04
FALCON_SPROT_IMEM	0x54501280	0x04
FALCON_SPROT_DMEM	0x54501284	0x04
FALCON_SPROT_CPUCTL	0x54501288	0x04
FALCON_SPROT_MISC	0x5450128C	0x04
FALCON_SPROT_IRQ	0x54501290	0x04
FALCON_SPROT_MTHD	0x54501294	0x04
FALCON_SPROT_SCTL	0x54501298	0x04
FALCON_SPROT_WDTMR	0x5450129C	0x04
FALCON_UNK_2C0	0x545012C0	0x04
FALCON_UNK_2C4	0x545012C4	0x04
FALCON_UNK_2C8	0x545012C8	0x04
FALCON_UNK_2CC	0x545012CC	0x04
FALCON_UNK_2E0	0x545012E0	0x04
TSEC_SCP_CTL0	0x54501400	0x04
TSEC_SCP_CTL1	0x54501404	0x04
TSEC_SCP_CTL_STAT	0x54501408	0x04
TSEC_SCP_CTL_LOCK	0x5450140C	0x04
TSEC_SCP_UNK_10	0x54501410	0x04
TSEC_SCP_UNK_14	0x54501414	0x04
TSEC_SCP_CTL_PKEY	0x54501418	0x04
TSEC_SCP_UNK_1C	0x5450141C	0x04
TSEC_SCP_SEQ_CTL	0x54501420	0x04
TSEC_SCP_SEQ_VAL	0x54501424	0x04
TSEC_SCP_SEQ_STAT	0x54501428	0x04
TSEC_SCP_INSN_STAT	0x54501430	0x04
TSEC_SCP_UNK_50	0x54501450	0x04
TSEC_SCP_AUTH_STAT	0x54501454	0x04
TSEC_SCP_AES_STAT	0x54501458	0x04
TSEC_SCP_UNK_70	0x54501470	0x04
TSEC_SCP_IRQSTAT	0x54501480	0x04
TSEC_SCP_IRQMASK	0x54501484	0x04
TSEC_SCP_RES	0x54501490	0x04
TSEC_SCP_UNK_94	0x54501494	0x04
TSEC_SCP_ERR	0x54501498	0x04
TSEC_TRNG_CLKDIV	0x54501500	0x04
TSEC_TRNG_UNK_04	0x54501504	0x04
TSEC_TRNG_UNK_08	0x54501508	0x04
TSEC_TRNG_TEST_CTL	0x5450150C	0x04
TSEC_TRNG_TEST_CFG0	0x54501510	0x04
TSEC_TRNG_TEST_SEED0	0x54501514	0x04
TSEC_TRNG_TEST_CFG1	0x54501518	0x04
TSEC_TRNG_TEST_SEED1	0x5450151C	0x04
TSEC_TRNG_UNK_28	0x54501528	0x04
TSEC_TRNG_UNK_2C	0x5450152C	0x04
TSEC_TFBIF_UNK_00	0x54501600	0x04
TSEC_TFBIF_MCCIF_FIFOCTRL	0x54501604	0x04
TSEC_TFBIF_UNK_08	0x54501608	0x04
TSEC_TFBIF_UNK_0C	0x5450160C	0x04
TSEC_TFBIF_UNK_30	0x54501630	0x04
TSEC_TFBIF_MCCIF_FIFOCTRL1	0x54501634	0x04
TSEC_TFBIF_UNK_40	0x54501640	0x04
TSEC_TFBIF_UNK_44	0x54501644	0x04
TSEC_TFBIF_UNK_48	0x54501648	0x04
TSEC_DMA_CMD	0x54501700	0x04
TSEC_DMA_ADDR	0x54501704	0x04
TSEC_DMA_VAL	0x54501708	0x04
TSEC_DMA_CFG	0x5450170C	0x04
TSEC_TEGRA_FALCON_IP_VER	0x54501800	0x04
TSEC_TEGRA_UNK_04	0x54501804	0x04
TSEC_TEGRA_UNK_08	0x54501808	0x04
TSEC_TEGRA_UNK_0C	0x5450180C	0x04
TSEC_TEGRA_UNK_10	0x54501810	0x04
TSEC_TEGRA_UNK_14	0x54501814	0x04
TSEC_TEGRA_UNK_18	0x54501818	0x04
TSEC_TEGRA_UNK_1C	0x5450181C	0x04
TSEC_TEGRA_UNK_20	0x54501820	0x04
TSEC_TEGRA_UNK_24	0x54501824	0x04
TSEC_TEGRA_UNK_28	0x54501828	0x04
TSEC_TEGRA_UNK_2C	0x5450182C	0x04
TSEC_TEGRA_UNK_30	0x54501830	0x04
TSEC_TEGRA_UNK_34	0x54501834	0x04
TSEC_TEGRA_CTL	0x54501838	0x04

TSEC_THI_METHOD0

ID	Method
0x200	SET_APPLICATION_ID
0x300	EXECUTE
0x500	HDCP_INIT
0x504	HDCP_CREATE_SESSION
0x508	HDCP_VERIFY_CERT_RX
0x50C	HDCP_GENERATE_EKM
0x510	HDCP_REVOCATION_CHECK
0x514	HDCP_VERIFY_HPRIME
0x518	HDCP_ENCRYPT_PAIRING_INFO
0x51C	HDCP_DECRYPT_PAIRING_INFO
0x520	HDCP_UPDATE_SESSION
0x524	HDCP_GENERATE_LC_INIT
0x528	HDCP_VERIFY_LPRIME
0x52C	HDCP_GENERATE_SKE_INIT
0x530	HDCP_VERIFY_VPRIME
0x534	HDCP_ENCRYPTION_RUN_CTRL
0x538	HDCP_SESSION_CTRL
0x53C	HDCP_COMPUTE_SPRIME
0x540	HDCP_GET_CERT_RX
0x544	HDCP_EXCHANGE_INFO
0x548	HDCP_DECRYPT_KM
0x54C	HDCP_GET_HPRIME
0x550	HDCP_GENERATE_EKH_KM
0x554	HDCP_VERIFY_RTT_CHALLENGE
0x558	HDCP_GET_LPRIME
0x55C	HDCP_DECRYPT_KS
0x560	HDCP_DECRYPT
0x564	HDCP_GET_RRX
0x568	HDCP_DECRYPT_REENCRYPT
0x56C
0x570
0x574
0x578
0x57C
0x700	HDCP_VALIDATE_SRM
0x704	HDCP_VALIDATE_STREAM
0x708	HDCP_TEST_SECURE_STATUS
0x70C	HDCP_SET_DCP_KPUB
0x710	HDCP_SET_RX_KPUB
0x714	HDCP_SET_CERT_RX
0x718	HDCP_SET_SCRATCH_BUFFER
0x71C	HDCP_SET_SRM
0x720	HDCP_SET_RECEIVER_ID_LIST
0x724	HDCP_SET_SPRIME
0x728	HDCP_SET_ENC_INPUT_BUFFER
0x72C	HDCP_SET_ENC_OUTPUT_BUFFER
0x730	HDCP_GET_RTT_CHALLENGE
0x734	HDCP_STREAM_MANAGE
0x738	HDCP_READ_CAPS
0x73C	HDCP_ENCRYPT
0x740	[6.0.0+] HDCP_GET_CURRENT_NONCE

Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

TSEC_THI_METHOD1

Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

TSEC_THI_INT_STATUS

Bits	Description
0	TSEC_THI_INT_STATUS_FALCON_INT

TSEC_THI_INT_MASK

Bits	Description
0	TSEC_THI_INT_MASK_FALCON_INT

FALCON_IRQSSET

Bits	Description
0	FALCON_IRQSSET_GPTMR
1	FALCON_IRQSSET_WDTMR
2	FALCON_IRQSSET_MTHD
3	FALCON_IRQSSET_CTXSW
4	FALCON_IRQSSET_HALT
5	FALCON_IRQSSET_EXTERR
6	FALCON_IRQSSET_SWGEN0
7	FALCON_IRQSSET_SWGEN1
8-15	FALCON_IRQSSET_EXT

Used for setting Falcon's IRQs.

FALCON_IRQSCLR

Bits	Description
0	FALCON_IRQSCLR_GPTMR
1	FALCON_IRQSCLR_WDTMR
2	FALCON_IRQSCLR_MTHD
3	FALCON_IRQSCLR_CTXSW
4	FALCON_IRQSCLR_HALT
5	FALCON_IRQSCLR_EXTERR
6	FALCON_IRQSCLR_SWGEN0
7	FALCON_IRQSCLR_SWGEN1
8-15	FALCON_IRQSCLR_EXT

Used for clearing Falcon's IRQs.

FALCON_IRQSTAT

Bits	Description
0	FALCON_IRQSTAT_GPTMR
1	FALCON_IRQSTAT_WDTMR
2	FALCON_IRQSTAT_MTHD
3	FALCON_IRQSTAT_CTXSW
4	FALCON_IRQSTAT_HALT
5	FALCON_IRQSTAT_EXTERR
6	FALCON_IRQSTAT_SWGEN0
7	FALCON_IRQSTAT_SWGEN1
8-15	FALCON_IRQSTAT_EXT

Used for getting the status of Falcon's IRQs.

FALCON_IRQMODE

Bits	Description
0	FALCON_IRQMODE_GPTMR
1	FALCON_IRQMODE_WDTMR
2	FALCON_IRQMODE_MTHD
3	FALCON_IRQMODE_CTXSW
4	FALCON_IRQMODE_HALT
5	FALCON_IRQMODE_EXTERR
6	FALCON_IRQMODE_SWGEN0
7	FALCON_IRQMODE_SWGEN1
8-15	FALCON_IRQMODE_EXT

Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.

FALCON_IRQMSET

Bits	Description
0	FALCON_IRQMSET_GPTMR
1	FALCON_IRQMSET_WDTMR
2	FALCON_IRQMSET_MTHD
3	FALCON_IRQMSET_CTXSW
4	FALCON_IRQMSET_HALT
5	FALCON_IRQMSET_EXTERR
6	FALCON_IRQMSET_SWGEN0
7	FALCON_IRQMSET_SWGEN1
8-15	FALCON_IRQMSET_EXT

Used for setting the mask for Falcon's IRQs.

FALCON_IRQMCLR

Bits	Description
0	FALCON_IRQMCLR_GPTMR
1	FALCON_IRQMCLR_WDTMR
2	FALCON_IRQMCLR_MTHD
3	FALCON_IRQMCLR_CTXSW
4	FALCON_IRQMCLR_HALT
5	FALCON_IRQMCLR_EXTERR
6	FALCON_IRQMCLR_SWGEN0
7	FALCON_IRQMCLR_SWGEN1
8-15	FALCON_IRQMCLR_EXT

Used for clearing the mask for Falcon's IRQs.

FALCON_IRQMASK

Bits	Description
0	FALCON_IRQMASK_GPTMR
1	FALCON_IRQMASK_WDTMR
2	FALCON_IRQMASK_MTHD
3	FALCON_IRQMASK_CTXSW
4	FALCON_IRQMASK_HALT
5	FALCON_IRQMASK_EXTERR
6	FALCON_IRQMASK_SWGEN0
7	FALCON_IRQMASK_SWGEN1
8-15	FALCON_IRQMASK_EXT

Used for getting the value of the mask for Falcon's IRQs.

FALCON_IRQDEST

Bits	Description
0	FALCON_IRQDEST_HOST_GPTMR
1	FALCON_IRQDEST_HOST_WDTMR
2	FALCON_IRQDEST_HOST_MTHD
3	FALCON_IRQDEST_HOST_CTXSW
4	FALCON_IRQDEST_HOST_HALT
5	FALCON_IRQDEST_HOST_EXTERR
6	FALCON_IRQDEST_HOST_SWGEN0
7	FALCON_IRQDEST_HOST_SWGEN1
8-15	FALCON_IRQDEST_HOST_EXT
16	FALCON_IRQDEST_TARGET_GPTMR
17	FALCON_IRQDEST_TARGET_WDTMR
18	FALCON_IRQDEST_TARGET_MTHD
19	FALCON_IRQDEST_TARGET_CTXSW
20	FALCON_IRQDEST_TARGET_HALT
21	FALCON_IRQDEST_TARGET_EXTERR
22	FALCON_IRQDEST_TARGET_SWGEN0
23	FALCON_IRQDEST_TARGET_SWGEN1
24-31	FALCON_IRQDEST_TARGET_EXT

Used for routing Falcon's IRQs.

FALCON_MAILBOX0

Scratch register for reading/writing data to Falcon.

FALCON_MAILBOX1

Scratch register for reading/writing data to Falcon.

FALCON_ITFEN

Bits	Description
0	FALCON_ITFEN_CTXEN
1	FALCON_ITFEN_MTHDEN

Used for enabling/disabling Falcon interfaces.

FALCON_IDLESTATE

Bits	Description
0	FALCON_IDLESTATE_FALCON_BUSY
1-15	FALCON_IDLESTATE_EXT_BUSY

Used for detecting if Falcon is busy or not.

FALCON_DEBUG1

Bits	Description
16	FALCON_DEBUG1_CTXSW_MODE

FALCON_DEBUGINFO

Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.

[6.0.0+] nvservices sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.

FALCON_EXCI

Bits	Description
0-19	PC that originated the exception
20-23	Exception type 0x00: Trap 0 0x01: Trap 1 0x02: Trap 2 0x03: Trap 3 0x08: Invalid opcode 0x09: Authentication entry 0x0A: Page fault (no hit) 0x0B: Page fault (multi hit) 0x0F: Breakpoint

Contains information about raised exceptions.

FALCON_CPUCTL

Bits	Description
0	FALCON_CPUCTL_IINVAL
1	FALCON_CPUCTL_STARTCPU
2	FALCON_CPUCTL_SRESET
3	FALCON_CPUCTL_HRESET
4	FALCON_CPUCTL_HALTED
5	FALCON_CPUCTL_STOPPED
6	FALCON_CPUCTL_CPUCTL_ALIAS_EN

Used for signaling the Falcon CPU.

FALCON_BOOTVEC

Takes the Falcon's boot vector address.

FALCON_HWCFG

Bits	Description
0-8	FALCON_HWCFG_IMEM_SIZE
9-17	FALCON_HWCFG_DMEM_SIZE
18-25	FALCON_HWCFG_MTHD_SIZE
26-31	FALCON_HWCFG_DMATRF_SLOTS

FALCON_DMACTL

Bits	Description
0	FALCON_DMACTL_REQUIRE_CTX
1	FALCON_DMACTL_DMEM_SCRUBBING
2	FALCON_DMACTL_IMEM_SCRUBBING
3-6	FALCON_DMACTL_DMAQ_NUM
7	FALCON_DMACTL_SECURE_STAT

Used for configuring the Falcon's DMA engine.

FALCON_DMATRFBASE

Base address of the external memory buffer, shifted right by 8.

The current transfer address is calculated by adding FALCON_DMATRFFBOFFS to the base.

FALCON_DMATRFMOFFS

For transfers to DMEM: the destination address. For transfers to IMEM: the destination virtual IMEM page.

FALCON_DMATRFCMD

Bits	Description
0	FALCON_DMATRFCMD_FULL
1	FALCON_DMATRFCMD_IDLE
2-3	FALCON_DMATRFCMD_SEC
4	FALCON_DMATRFCMD_IMEM
5	FALCON_DMATRFCMD_WRITE
8-10	FALCON_DMATRFCMD_SIZE
12-14	FALCON_DMATRFCMD_CTXDMA

Used for configuring DMA transfers.

FALCON_DMATRFFBOFFS

For transfers to IMEM: the destination physical IMEM page.

FALCON_DMATRFSTAT

Bits	Description
0	FALCON_DMATRFSTAT_PENDING
16-18	FALCON_DMATRFSTAT_NUM_STORES_PENDING
24-26	FALCON_DMATRFSTAT_NUM_LOADS_PENDING

FALCON_CRYPTTRFSTAT

Bits	Description
1	FALCON_CRYPTTRFSTAT_PENDING
5	FALCON_CRYPTTRFSTAT_ENABLED
16-18	FALCON_CRYPTTRFSTAT_NUM_STORES_PENDING
24-26	FALCON_CRYPTTRFSTAT_NUM_LOADS_PENDING

FALCON_HWCFG2

Bits	Description
0-3	FALCON_HWCFG2_VERSION
4-5	FALCON_HWCFG2_SCP_MODE
6-7	FALCON_HWCFG2_SUBVERSION
8-11	FALCON_HWCFG2_IMEM_PORTS
12-15	FALCON_HWCFG2_DMEM_PORTS
16-19	FALCON_HWCFG2_VM_PAGES_LOG2
27	FALCON_HWCFG2_HAS_IMCTL_DEBUG
28-29	FALCON_HWCFG2_IO_ADDR_TYPE
30	FALCON_HWCFG2_HAS_EXTERR
31	FALCON_HWCFG2_HAS_IMFILL

FALCON_IMCTL

Bits	Description
0-23	Address
24-26	Command 1: ITLB 2: PTLB 3: VTLB

Controls the Falcon TLB.

FALCON_IMSTAT

Returns the result of the last command from FALCON_IMCTL.

FALCON_TRACEIDX

Bits	Description
0-7	Index of where to start tracing from
16-23	Maximum valid index
24-31	Number of trace reads remaining

Controls the index for tracing with FALCON_TRACEPC.

FALCON_TRACEPC

Returns the PC of the last call or branch executed.

FALCON_IMEMC

Bits	Description
2-7	Offset in IMEM block to read/write
8-15	IMEM block to read/write
24	Write auto-increment
25	Read auto-increment
28	Mark uploaded code as secret
29	Secret code upload lockdown status (read-only)
30	Secret code upload failure status (read-only)
31	Secret code upload reset scrubber status (read-only)

Used for configuring access to Falcon's IMEM.

FALCON_IMEMD

Returns or takes the value for an IMEM read/write operation.

FALCON_IMEMT

Returns or takes the virtual page index for an IMEM read/write operation.

FALCON_DMEMC0

Bits	Description
2-7	Offset in DMEM block to read/write
8-15	DMEM block to read/write
24	Write auto-increment
25	Read auto-increment

Used for configuring access to Falcon's DMEM.

FALCON_DMEMD0

Returns or takes the value for a DMEM read/write operation.

FALCON_ICD_CMD

Bits	Description
0-3	FALCON_ICD_CMD_OPC 0x0: BREAK 0x1: CONTINUE_FROM_PC 0x2: CONTINUE_FROM_ADDR 0x3: CONTINUE_UNK1_FROM_PC 0x4: CONTINUE_UNK1_FROM_ADDR 0x5: SINGLE_STEP_FROM_PC 0x6: SINGLE_STEP_FROM_ADDR 0x7: SET_BREAK_MASK 0x8: REG_READ 0x9: REG_WRITE 0xA: DATA_READ 0xB: DATA_WRITE 0xC: IO_READ 0xD: IO_WRITE 0xE: STATUS_READ
6-7	FALCON_ICD_CMD_DATA_SIZE
8-12	FALCON_ICD_CMD_IDX
14	FALCON_ICD_CMD_ERROR
15	FALCON_ICD_CMD_DONE
16-31	FALCON_ICD_CMD_BREAK_MASK

FALCON_SCTL

Bits	Description
0-1	FALCON_SCTL_SEC_MODE 0: Non-secure 1: Light Secure 2: Heavy Secure
4-5	FALCON_SCTL_OLD_SEC_MODE 0: Non-secure 1: Light Secure 2: Heavy Secure
12-13	Unknown
14	Initialize the transition to LS mode

FALCON_SCTL_STAT

Bits	Description
31	Set on memory protection violation

FALCON_SPROT_IMEM

Bits	Description
0-3	Read access level
4-7	Write access level

Controls accesses to Falcon IMEM.

FALCON_SPROT_DMEM

Bits	Description
0-3	Read access level
4-7	Write access level

Controls accesses to Falcon DMEM.

FALCON_SPROT_CPUCTL

Bits	Description
0-3	Read access level
4-7	Write access level

Controls accesses to the FALCON_CPUCTL register.

FALCON_SPROT_MISC

Bits	Description
0-3	Read access level
4-7	Write access level

Controls accesses to the following registers:

• FALCON_VM_SUPERVISOR
• FALCON_SUBENGINE_RESET
• FALCON_HOST_IO_INDEX
• FALCON_DMACTL
• FALCON_TLB_CMD
• FALCON_TLB_CMD_RES
• FALCON_UNK_250
• FALCON_UNK_2E0

FALCON_SPROT_IRQ

Bits	Description
0-3	Read access level
4-7	Write access level

Controls accesses to the following registers:

• FALCON_IRQMODE
• FALCON_IRQMSET
• FALCON_IRQMCLR
• FALCON_IRQDEST
• FALCON_GPTMR_PERIOD
• FALCON_GPTMR_TIME
• FALCON_GPTMR_ENABLE
• FALCON_UNK_3C
• FALCON_UNK_E0

FALCON_SPROT_MTHD

Bits	Description
0-3	Read access level
4-7	Write access level

Controls accesses to the following registers:

• FALCON_ITFEN
• FALCON_CURCTX
• FALCON_NXTCTX
• FALCON_CMDCTX
• FALCON_MTHD_DATA
• FALCON_MTHD_CMD
• FALCON_MTHD_DATA_WR
• FALCON_MTHD_OCCUPIED
• FALCON_MTHD_ACK
• FALCON_MTHD_LIMIT
• FALCON_DEBUG1

FALCON_SPROT_SCTL

Bits	Description
0-3	Read access level
4-7	Write access level

Controls accesses to the FALCON_SCTL register.

FALCON_SPROT_WDTMR

Bits	Description
0-3	Read access level
4-7	Write access level

Controls accesses to the following registers:

• FALCON_WDTMR_TIME
• FALCON_WDTMR_ENABLE

TSEC_SCP_CTL0

Bits	Description
20	Enable TSEC_SCP_INSN_STAT register

TSEC_SCP_CTL1

Bits	Description
11	Enable TRNG testing mode
12	Enable the TRNG

TSEC_SCP_CTL_STAT

Bits	Description
20	TSEC_SCP_CTL_STAT_DEBUG_MODE

TSEC_SCP_CTL_LOCK

Bits	Description
0	Disable reads for the TRNG register block
1	Disable reads for the TFBIF register block
2	Disable reads for the DMA register block
3	Disable reads for the TEGRA register block
4	Disable writes for the TRNG register block
5	Disable writes for the TFBIF register block
6	Disable writes for the DMA register block
7	Disable writes for the TEGRA register block

Locks accesses to the other sub-engines and can only be cleared in Heavy Secure mode.

TSEC_SCP_CTL_PKEY

Bits	Description
0	TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
1	TSEC_SCP_CTL_PKEY_LOADED

TSEC_SCP_SEQ_CTL

Bits	Description
0-3	Sequence's instruction index
4-7	Target and control flags
8-11	Sequence's size

Controls the last crypto sequence (cs0 or cs1) created.

TSEC_SCP_SEQ_VAL

Bits	Description
0-3	Sequence instruction's first operand
4-9	Sequence instruction's second operand
10-14	Sequence instruction's opcode

Contains information on the last crypto sequence (cs0 or cs1) created.

TSEC_SCP_SEQ_STAT

Bits	Description
0	Set if crypto sequence recording (cs0begin/cs1begin) is active
4-7	Number of instructions left for the crypto sequence
12-15	Active crypto key register

Contains information on the last crypto sequence (cs0 or cs1) executed.

TSEC_SCP_INSN_STAT

Bits	Description
0-3	Destination register or immediate value
8-13	Source register or immediate value
20-24	Operation 0x0: nop (fuc5 opcode 0x00) 0x1: cmov (fuc5 opcode 0x84) 0x2: cxsin (fuc5 opcode 0x88) or xdst (with cxset) 0x3: cxsout (fuc5 opcode 0x8C) or xdld (with cxset) 0x4: crnd (fuc5 opcode 0x90) 0x5: cs0begin (fuc5 opcode 0x94) 0x6: cs0exec (fuc5 opcode 0x98) 0x7: cs1begin (fuc5 opcode 0x9C) 0x8: cs1exec (fuc5 opcode 0xA0) 0x9: invalid (fuc5 opcode 0xA4) 0xA: cchmod (fuc5 opcode 0xA8) 0xB: cxor (fuc5 opcode 0xAC) 0xC: cadd (fuc5 opcode 0xB0) 0xD: cand (fuc5 opcode 0xB4) 0xE: crev (fuc5 opcode 0xB8) 0xF: cprecmac (fuc5 opcode 0xBC) 0x10: csecret (fuc5 opcode 0xC0) 0x11: ckeyreg (fuc5 opcode 0xC4) 0x12: ckexp (fuc5 opcode 0xC8) 0x13: ckrexp (fuc5 opcode 0xCC) 0x14: cenc (fuc5 opcode 0xD0) 0x15: cdec (fuc5 opcode 0xD4) 0x16: csigauth (fuc5 opcode 0xD8) 0x17: csigenc (fuc5 opcode 0xDC) 0x18: csigclr (fuc5 opcode 0xE0)
28	Unknown
31	Set if running in secure mode (cauth)

Contains information on the last crypto instruction executed.

TSEC_SCP_AUTH_STAT

Bits	Description
0-1	Signature comparison result (3=succeeded, 2=failed)

Contains information on the last authentication attempt.

TSEC_SCP_AES_STAT

Bits	Description
0-4	First opcode
5-9	Second opcode
15-16	AES operation 0: Encryption 1: Decryption 2: Key expansion 3: Key reverse expansion

Contains information on the last AES sequence executed.

TSEC_SCP_IRQSTAT

Bits	Description
0	TSEC_SCP_IRQSTAT_TRNG
8	TSEC_SCP_IRQSTAT_HALT
12	Unknown
16	TSEC_SCP_IRQSTAT_INSN_ERROR
20	TSEC_SCP_IRQSTAT_SINGLE_STEP
24	Unknown
28	Unknown

Used for getting the status of crypto IRQs.

TSEC_SCP_IRQMASK

Bits	Description
0	TSEC_SCP_IRQMASK_TRNG
8	TSEC_SCP_IRQMASK_HALT
12	Unknown
16	TSEC_SCP_IRQMASK_INSN_ERROR
20	TSEC_SCP_IRQMASK_SINGLE_STEP
24	Unknown
28	Unknown

Used for getting the value of the mask for crypto IRQs.

TSEC_SCP_RES

Bits	Description
31	SCP is halted

Contains information on the status generated by the TSEC_SCP_IRQSTAT_HALT IRQ.

TSEC_SCP_ERR

Bits	Description
0	Invalid instruction
4	Empty crypto sequence
8	Crypto sequence is too long
12	Crypto sequence was not finished
16	Invalid cauth signature (during csigenc, csigclr or csigauth)
20	Wrong access level (during csigauth in HS mode)
24	Forbidden instruction (during cchmod in NS mode)

Contains information on crypto errors generated by the TSEC_SCP_IRQSTAT_INSN_ERROR IRQ.

TSEC_TFBIF_MCCIF_FIFOCTRL

Bits	Description
0	TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
1	TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
2	TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
3	TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
4	TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
5	TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
6	TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
7	TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
8	TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE

TSEC_TFBIF_MCCIF_FIFOCTRL1

Bits	Description
0-15	TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
16-31	TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT

TSEC_TFBIF_UNK_44

Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.

TSEC_TFBIF_UNK_48

Used to control accesses to DRAM.

[6.0.0+] The nvhost_tsec firmware sets this register to 0x20 or 0x140 before reading memory from the GPU UCODE carveout.

TSEC_DMA_CMD

Bits	Description
0	TSEC_DMA_CMD_READ
1	TSEC_DMA_CMD_WRITE
4-7	TSEC_DMA_CMD_UNK
12	TSEC_DMA_CMD_BUSY
13	TSEC_DMA_CMD_ERROR
31	TSEC_DMA_CMD_INIT

A DMA read/write operation requires bits TSEC_DMA_CMD_INIT and TSEC_DMA_CMD_READ/TSEC_DMA_CMD_WRITE to be set in TSEC_DMA_CMD.

During the transfer, the TSEC_DMA_CMD_BUSY bit is set.

Accessing an invalid address causes bit TSEC_DMA_CMD_ERROR to be set.

TSEC_DMA_ADDR

Takes the address for DMA transfers between TSEC and HOST1X (master and clients).

TSEC_DMA_VAL

Takes the value for DMA transfers between TSEC and HOST1X (master and clients).

TSEC_DMA_CFG

Always 0xFFF.

TSEC_TEGRA_CTL

Bits	Description
16	TSEC_TEGRA_CTL_TKFI_KFUSE
17	TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
24	TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
25	TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
26	TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
27	TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C

SCP

Part of the information here (which hasn't made it into envytools documentation yet) was shared by mwk from reverse engineering falcon processors over the years.

Authenticated Mode

Entry

From non-secure mode, upon jumping to a page marked as secret, a secret fault occurs. This causes the CPU to verify the region specified in $cauth against the MAC loaded in $c6. If the comparison is successful, the valid bit (bit0) is set on all pages in the $cauth region, and $pc is set to the base of the $cauth region. If the comparsion fails, the CPU is halted.

Exit

The CPU automatically goes back to non-secure mode when returning back into non-secret pages. When this happens, the valid bit (bit0) in the TLB flags is cleared for all secret pages.

Implementation

Under certain circumstances, it is possible to observe csigauth being briefly written to TSEC_SCP_INSN_STAT as "csigauth $c4 $c6" while the opcodes in TSEC_SCP_AES_STAT are set to "cxsin" and "csigauth", respectively.

Via TSEC_SCP_SEQ_CTL it can be observed that a 3-sized macro sequence is loaded into cs0 during a secure mode transition.

Operations

Opcode	Name	Operand0	Operand1	Operation	Condition
0	nop	N/A	N/A
1	mov	$cX	$cY	$cX = $cY; ACL(X) = ACL(Y);
2	sin	$cX	N/A	$cX = read_stream(); ACL(X) = ???;
3	sout	$cX	N/A	write_stream($cX);	?
4	rnd	$cX	N/A	$cX = read_trng(); ACL(X) = ???;
5	s0begin	immX	N/A	record_macro_for_N_instructions(0, immX);
6	s0exec	immX	N/A	execute_macro_N_times(0, immX);
7	s1begin	immX	N/A	record_macro_for_N_instructions(1, immX);
8	s1exec	immX	N/A	execute_macro_N_times(1, immX);
9	<invalid>
0xA	chmod	$cX	immY	Complicated, see ACL.
0xB	xor	$cX	$cY	$cX ^= $cY;	(ACL(X) & 2) && (ACL(Y) & 2)
0xC	add	$cX	immY	$cX += immY;	(ACL(X) & 2)
0xD	and	$cX	$cY	$cX &= $cY;	(ACL(X) & 2) && (ACL(Y) & 2)
0xE	rev	$cX	$cY	$cX = endian_swap128($cY); ACL(X) = ACL(Y);
0xF	gfmul	$cX	$cY	$cX = gfmul($cY); ACL(X) = ACL(Y);	(ACL(Y) & 2)
0x10	secret	$cX	immY	$cX = load_secret(immY); ACL(X) = load_secret_acl(immY);
0x11	keyreg	immX	N/A	active_key_idx = immX;
0x12	kexp	$cX	$cY	$cX = aes_kexp($cY); ACL(X) = ACL(Y);
0x13	krexp	$cX	$cY	$cX = aes_kexp_reverse($cY); ACL(X) = ACL(Y);
0x14	enc	$cX	$cY	$cX = aes_enc(active_key_idx, $cY); ACL(X) = ACL(active_key_idx) & ACL(Y);
0x15	dec	$cX	$cY	$cX = aes_dec(active_key_idx, $cY); ACL(X) = ACL(active_key_idx) & ACL(Y);
0x16	csigauth	$cX	$cY	if (hash_verify($cX, $cY)) { has_sig = true; current_sig = $cX; }	?
0x17	csigclr	N/A	N/A	has_sig = false;
0x18	csigenc	$cX	$cY	if (has_sig) { $cX = aes_enc($cY, current_sig); ACL(X) = 0x13; }

csigauth

00000000: f5 3c XY d8 csigauth $cY $cX

Takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret. This instruction does not work in secure mode.

csigclr

00000000: f5 3c 00 e0 csigclr

This instruction takes no operands and appears to clear the saved cauth signature used by the csigenc instruction.

cchmod

00000000: f5 3c XY a8 cchmod $cY 0X or 00000000: f5 3c XY a9 cchmod $cY 1X

This instruction takes a crypto register and a 5 bit immediate value which represents the ACL mask to set.

crnd

00000000: f5 3c 0X 90 crnd $cX

This instruction initializes a crypto register with random data.

Executing this instruction only succeeds if the TRNG is enabled for the SCP, which requires taking the following steps:

• Write 0x7FFF to TSEC_TRNG_CLKDIV.
• Write 0x3FF0000 to TSEC_TRNG_UNK_00.
• Write 0xFF00 to TSEC_TRNG_UNK_2C.
• Write 0x1000 to TSEC_SCP_CTL1.

Otherwise it hangs forever.

ACL

Bit	Meaning
0	Secure key. Forced set if bit1 is set. Once cleared, cannot be set again.
1	Secure readable. Once cleared, cannot be set again.
2	Insecure key. Forced set if bit3 is set. Forced clear if bit0 is clear. Can be toggled back and forth.
3	Insecure readable. Forced clear if bit1 is clear. Can be toggled back and forth.
4	Insecure overwritable. Can be toggled back and forth.

Initial values

On SCP boot, the ACL is 0x1F for all $cX.

Loading into $cX using xdst instruction sets ACL($cX) to 0x13 and 0x1F, for secure and insecure mode respectively.

Spilling a $cX to DMEM using xdld instruction is allowed if (ACL($cX) & 2) or (ACL($cX) & 8), for secure and insecure mode respectively.

Loading a secret into $cX sets a per-secret ACL, unconditionally.

cauth

$cauth is a special purpose register in the CPU.

Bits	Description
0-7	Start of region to authenticate (in 0x100 pages)
8-15	Unknown
16	Use secret xfers
17	Region is encrypted
18	Unknown (set in HS mode)
19	Block traps and interrupts (set in HS mode)
20-23	Unknown
24-31	Size of region to authenticate (in 0x100 pages)

cxset

cxset instruction provides a way to change behavior of a variable amount of successively executed DMA-related instructions.

for example: 000000de: f4 3c 02 cxset 0x2

can be read as: dma_override(type=crypto_reg, count=2)

The argument to cxset specifies the type of behavior change in the top 3 bits, and the number of DMA-related instructions the effect lasts for in the lower 5 bits.

Bits	Description
0-4	Number of instructions it is valid for (0x1f is a special value meaning infinitely many instructions -- until overriden by another cxset)
5	Crypto destination/source select (0=crypto register, 1=crypto stream)
6	External memory override (0=Disabled, 1=Enabled)
7	Internal memory select (0=DMEM, 1=IMEM)

DMA-Related Instructions

At least the following instructions may have changed behavior, and count against the cxset "count" argument: xdwait, xdst, xdld.

For example, if override type=0b000, then the "length" argument to xdst is instead treated as the index of the target $cX register.

Secrets

Falcon's Authenticated Mode has access to 64 128-bit keys which are burned at factory. These keys can be loaded by using the $csecret instruction which takes the target crypto register and the key index as arguments.

All secrets appear to be common across Falcon units of the same version, with the exception of secret 0x3F. This secret is effectively empty (all zeros), but is configured to be overwritten with the KFUSE private key once the KFUSE clock is enabled. The KFUSE private key is console-unique.

Index	ACL	Notes
0x00	0x13	Used by Keygen, nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares.
0x01	0x10	Used by nvhost_nvdec_bl020_prod firmware.
0x02	0x10
0x03	0x11	Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
0x04	0x10	Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
0x05	0x13	Used by nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares.
0x06	0x11
0x07	0x11	Used by [6.0.0+] nvhost_tsec firmware.
0x08	0x10
0x09	0x13	Used by nvhost_tsec firmware.
0x0A	0x11
0x0B	0x10	Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
0x0C	0x13
0x0D	0x11
0x0E	0x10
0x0F	0x13	Used by nvhost_tsec firmware.
0x10	0x11	Used by [1.0.0-5.1.0] nvhost_tsec firmware.
0x11	0x10
0x12	0x13
0x13	0x11
0x14	0x10
0x15	0x13	Used by nvhost_nvdec_bl020_prod, [5.0.0+] nvhost_nvdec020_prod, [5.0.0+] nvhost_nvdec020_ns and [6.0.0+] nvhost_tsec firmwares.
0x16	0x11
0x17	0x10
0x18	0x13
0x19	0x11
0x1A	0x10
0x1B	0x13
0x1C	0x11
0x1D	0x10
0x1E	0x13
0x1F	0x11
0x20	0x10
0x21	0x13
0x22	0x11
0x23	0x10
0x24	0x13
0x25	0x11
0x26	0x10	Used by KeygenLdr and SecureBoot
0x27	0x13
0x28	0x11
0x29	0x10
0x2A	0x13
0x2B	0x11
0x2C	0x10
0x2D	0x13
0x2E	0x11
0x2F	0x10
0x30	0x13
0x31	0x11
0x32	0x10
0x33	0x13
0x34	0x11
0x35	0x10
0x36	0x13
0x37	0x11
0x38	0x10
0x39	0x13
0x3A	0x11
0x3B	0x10
0x3C	0x13	Used by nvhost_tsec firmware.
0x3D	0x11
0x3E	0x10
0x3F	0x10	Used by Keygen, nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.