2,781
edits
Changes
Jump to navigation
Jump to search
Line 5:
Line 5: − Registers from 0x54500000 to 0x54501000 are used to configure the host interface (HOST1X).+ − + − Registers from 0x54501000 to 0x54502000 are a MMIO window for communicating with the Falcon microprocessor. From this range, the subset of registers from 0x54501400 to 0x54501FE8 are specific to the TSEC and are subdivided into:+ − + − + − + − + − + + Line 21:
Line 22: + + + + Line 33:
Line 38: + + + + + + + + + + + + + + + + + + + + Line 45:
Line 70: + + + + Line 55:
Line 84: − + + + + + Line 71:
Line 104: − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + + + + + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + − + − + − + − + − + − + − + − + − + − + − + − | 0x54501248 − | 0x04 − |- − | FALCON_UNK_24C − | 0x5450124C − | 0x04 − |- − | FALCON_UNK_250 − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + + + + + + + + + + + + + + + + + Line 567:
Line 648: − + − + Line 579:
Line 660: − + − + − + − + − + − + − + − + − + + + + + Line 627:
Line 712: − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + Line 691:
Line 776: − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − |} − − === TSEC_THI_METHOD0 === − {| class="wikitable" border="1" − ! ID − ! Method − + − + + − + − + + − + − + + − + − + + − + − + + − + − + + − + − + + − + − + + − + − + + − + − + + − + − + + − + − + + − + − + + − + − + + − + − + + − + − + + + + + + + + − + − + + + + + + + + + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + + + + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − |} − − Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission. − − === TSEC_THI_METHOD1 === − Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission. − − === TSEC_THI_INT_STATUS === − {| class="wikitable" border="1" − ! Bits − ! Description − + − + − |} − − === TSEC_THI_INT_MASK === − {| class="wikitable" border="1" − ! Bits − ! Description − + − + − |} − − === FALCON_IRQSSET === − {| class="wikitable" border="1" − ! Bits − ! Description − + − + + + + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − |} − − Used for setting Falcon's IRQs. − − === FALCON_IRQSCLR === − {| class="wikitable" border="1" − ! Bits − ! Description − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − |} − − Used for clearing Falcon's IRQs. − − === FALCON_IRQSTAT === − {| class="wikitable" border="1" − ! Bits − ! Description − + − + − + − + − + − + − + − | FALCON_IRQSTAT_CTXSW+ − |- − | 4 − | FALCON_IRQSTAT_HALT − |- − | 5 − | FALCON_IRQSTAT_EXTERR − |- − − | FALCON_IRQSTAT_SWGEN0 − |- − | 7 − | FALCON_IRQSTAT_SWGEN1 − + − + − Used for getting the status of Falcon's IRQs.+ − − − + − + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + − + − + − + − + − + − + − + − + + + + − + − + Line 1,128:
Line 1,222: − + − + − + − + − + − + − + − + − + + + + − + − + Line 1,163:
Line 1,260: − + − + − + − + − + − + − + − + − + + + + − + − + Line 1,198:
Line 1,298: − + − + − + − + − + − + − + − + − + + + + − + − + Line 1,233:
Line 1,336: − + − + − + − + − + − + − + − + − + − + − |- − | 17 − | FALCON_IRQDEST_TARGET_WDTMR − |- − | 18 − | FALCON_IRQDEST_TARGET_MTHD − |- − | 19 − | FALCON_IRQDEST_TARGET_CTXSW − |- − | 20 − | FALCON_IRQDEST_TARGET_HALT − |- − | 21 − | FALCON_IRQDEST_TARGET_EXTERR − |- − | 22 − | FALCON_IRQDEST_TARGET_SWGEN0 − |- − | 23 − | FALCON_IRQDEST_TARGET_SWGEN1 − |- − | 24-31 − | FALCON_IRQDEST_TARGET_EXT − + − − === FALCON_MAILBOX0 === − Scratch register for reading/writing data to Falcon. − − === FALCON_MAILBOX1 === − Scratch register for reading/writing data to Falcon. − + Line 1,301:
Line 1,374: − + − + − + − + − Used for enabling/disabling Falcon interfaces.+ − + − === FALCON_IDLESTATE ===+ − {| class="wikitable" border="1"+ − ! Bits+ − ! Description+ + + + + + + + − + − + − + − + − |} − − Used for detecting if Falcon is busy or not. − − === FALCON_DEBUG1 === − {| class="wikitable" border="1" − ! Bits − ! Description − + − === FALCON_DEBUGINFO ===+ − − − [6.0.0+] [[NV_services|nvservices]] sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware. − + − {| class="wikitable" border="1" − ! Bits − ! Description − |- − | 0-19 − | PC that originated the exception − |- − | 20-23 − | Exception type − 0x00: Trap 0 − 0x01: Trap 1 − 0x02: Trap 2 − 0x03: Trap 3 − 0x08: Invalid opcode − 0x09: Authentication entry − 0x0A: Page fault (no hit) − 0x0B: Page fault (multi hit) − 0x0F: Breakpoint − |} − − Contains information about raised exceptions. − − === FALCON_CPUCTL === Line 1,366:
Line 1,412: − + − + − + − + − + − + − + − |} − − Used for signaling the Falcon CPU. − − === FALCON_BOOTVEC === − Takes the Falcon's boot vector address. − − === FALCON_HWCFG === − {| class="wikitable" border="1" − ! Bits − ! Description − + − + − + − + − + − + − |- − | 26-31 − | FALCON_HWCFG_DMATRF_SLOTS − + + + Line 1,416:
Line 1,450: − + − + − + − + − + − + − + − + − + − Used for configuring the Falcon's DMA engine.+ − + − === FALCON_DMATRFBASE ===+ − Base address of the external memory buffer, shifted right by 8.+ − − The current transfer address is calculated by adding [[#FALCON_DMATRFFBOFFS|FALCON_DMATRFFBOFFS]] to the base. − − === FALCON_DMATRFMOFFS === − For transfers to DMEM: the destination address. − For transfers to IMEM: the destination virtual IMEM page. − − === FALCON_DMATRFCMD === − {| class="wikitable" border="1" − ! Bits − ! Description − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − Used for configuring DMA transfers.+ + + + + + + + + + + − === FALCON_DMATRFFBOFFS ===+ − For transfers to IMEM: the destination physical IMEM page. − + Line 1,480:
Line 1,512: − + − + − + − |- − | 24-26 − | FALCON_DMATRFSTAT_NUM_LOADS_PENDING − + + + − + − | FALCON_CRYPTTRFSTAT_PENDING+ − |- − | 5 − | FALCON_CRYPTTRFSTAT_ENABLED − |- − | 16-18 − | FALCON_CRYPTTRFSTAT_NUM_STORES_PENDING − |- − | 24-26 − − + + + − + − + − + − + − | FALCON_HWCFG2_SCP_MODE+ + + + + + − + − + − + − + − |- − | 12-15 − | FALCON_HWCFG2_DMEM_PORTS − |- − | 16-19 − | FALCON_HWCFG2_VM_PAGES_LOG2 − |- − | 27 − | FALCON_HWCFG2_HAS_IMCTL_DEBUG − |- − | 28-29 − | FALCON_HWCFG2_IO_ADDR_TYPE − |- − | 30 − | FALCON_HWCFG2_HAS_EXTERR − |- − | 31 − | FALCON_HWCFG2_HAS_IMFILL − + + + − + − + − + − + − 1: ITLB − 2: PTLB − 3: VTLB − Controls the Falcon TLB.+ − − === FALCON_IMSTAT === − Returns the result of the last command from [[#FALCON_IMCTL|FALCON_IMCTL]]. − + − + − + − + − + − + − + − Controls the index for tracing with [[#FALCON_TRACEPC|FALCON_TRACEPC]].+ − − − Returns the PC of the last call or branch executed. − − === FALCON_IMEMC === − + − | Offset in IMEM block to read/write+ − |- − | 8-15 − | IMEM block to read/write − |- − | 24 − | Write auto-increment − |- − | 25 − | Read auto-increment − |- − | 28 − | Mark uploaded code as secret − |- − | 29 − | Secret code upload lockdown status (read-only) − |- − | 30 − | Secret code upload failure status (read-only) − |- − | 31 − − + − === FALCON_IMEMD ===+ − Returns or takes the value for an IMEM read/write operation. − − === FALCON_IMEMT === − Returns or takes the virtual page index for an IMEM read/write operation. − + − + − + − + − + + + + + + + + + + + + + + + + + + − + − + − |- − | 25 − | Read auto-increment − Used for configuring access to Falcon's DMEM.+ + − + − Returns or takes the value for a DMEM read/write operation.+ − + − + − + − 0x0: BREAK+ − 0x1: CONTINUE_FROM_PC+ − 0x2: CONTINUE_FROM_ADDR+ − 0x3: CONTINUE_UNK1_FROM_PC − 0x4: CONTINUE_UNK1_FROM_ADDR − 0x5: SINGLE_STEP_FROM_PC − 0x6: SINGLE_STEP_FROM_ADDR − 0x7: SET_BREAK_MASK − 0x8: REG_READ − 0x9: REG_WRITE − 0xA: DATA_READ − 0xB: DATA_WRITE − 0xC: IO_READ − 0xD: IO_WRITE − 0xE: STATUS_READ − + − + − + − + − + − + − + − + − + − + − + + + − + − + − 0: Non-secure+ − 1: Light Secure+ − 2: Heavy Secure+ + + + + + + + + − + − + − 0: Non-secure − 1: Light Secure − 2: Heavy Secure − + − + − + − + − + − + − + + + + + + + + + + + + + − + + + − + − + − |- − | 4-7 − | Write access level − Controls accesses to Falcon IMEM.+ + + − + − + − + − |- − | 4-7 − | Write access level − Controls accesses to Falcon DMEM.+ + − + − + − + − + − | Write access level+ − − − Controls accesses to the [[#FALCON_CPUCTL|FALCON_CPUCTL]] register. − − === FALCON_SPROT_MISC === − {| class="wikitable" border="1" − ! Bits − ! Description − + − + − + − + − + − + − Controls accesses to the following registers:+ − * FALCON_VM_SUPERVISOR − * FALCON_SUBENGINE_RESET − * FALCON_HOST_IO_INDEX − * [[#FALCON_DMACTL|FALCON_DMACTL]] − * [[#FALCON_IMCTL|FALCON_IMCTL]] − * [[#FALCON_IMSTAT|FALCON_IMSTAT]] − * FALCON_UNK_250 − * FALCON_UNK_2E0 − − === FALCON_SPROT_IRQ === − {| class="wikitable" border="1" − ! Bits − ! Description − + − + − + − + − Controls accesses to the following registers:+ − * [[#FALCON_IRQMODE|FALCON_IRQMODE]] − * [[#FALCON_IRQMSET|FALCON_IRQMSET]] − * [[#FALCON_IRQMCLR|FALCON_IRQMCLR]] − * [[#FALCON_IRQDEST|FALCON_IRQDEST]] − * FALCON_GPTMR_PERIOD − * FALCON_GPTMR_TIME − * FALCON_GPTMR_ENABLE − * FALCON_UNK_3C − * FALCON_UNK_E0 − + − + − + − |- − | 4-7 − | Write access level − Controls accesses to the following registers:+ − * [[#FALCON_ITFEN|FALCON_ITFEN]] − * FALCON_CURCTX − * FALCON_NXTCTX − * FALCON_CMDCTX − * FALCON_MTHD_DATA − * FALCON_MTHD_CMD − * FALCON_MTHD_DATA_WR − * FALCON_MTHD_OCCUPIED − * FALCON_MTHD_ACK − * FALCON_MTHD_LIMIT − * [[#FALCON_DEBUG1|FALCON_DEBUG1]] − + − + − + − + − + + + + + + + + + + + + + − Controls accesses to the [[#FALCON_SCTL|FALCON_SCTL]] register.+ − + − + − + + + + + + + + + + + + + − + − + − Controls accesses to the following registers:+ − * FALCON_WDTMR_TIME − * FALCON_WDTMR_ENABLE − + − + − + − + − + − + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + − + − + − + − + + + + + + − + + + − + − + − + + + − + − + − + − + − + − | Disable reads for the DMA register block+ − |- − | 3 − | Disable reads for the TEGRA register block − |- − | 4 − | Disable writes for the SCP and TRNG register blocks − |- − − | Disable writes for the TFBIF register block − |- − | 6 − | Disable writes for the DMA register block − |- − | 7 − | Disable writes for the TEGRA register block − Locks accesses to sub-engines and can only be cleared in Heavy Secure mode.+ − + − + − | TSEC_SCP_CTL_PKEY_REQUEST_RELOAD+ − |- − − | TSEC_SCP_CTL_PKEY_LOADED − + + + − + − + + + + − + − + − + − + − + + + + + + + + + + + + + − Controls the last crypto sequence (cs0 or cs1) created.+ − + − + − + − |- − | 4-9 − | Sequence instruction's second operand − |- − | 10-14 − | Sequence instruction's opcode − Contains information on the last crypto sequence (cs0 or cs1) created.+ − + − + − | Set if crypto sequence recording (cs0begin/cs1begin) is active+ − |- − | 4-7 − | Number of instructions left for the crypto sequence − |- − | 12-15 − − Contains information on the last crypto sequence (cs0 or cs1) executed.+ − + − + − + − + − + − + − + − 0x0: nop (fuc5 opcode 0x00) − 0x1: cmov (fuc5 opcode 0x84) − 0x2: cxsin (fuc5 opcode 0x88) or xdst (with cxset) − 0x3: cxsout (fuc5 opcode 0x8C) or xdld (with cxset) − 0x4: crnd (fuc5 opcode 0x90) − 0x5: cs0begin (fuc5 opcode 0x94) − 0x6: cs0exec (fuc5 opcode 0x98) − 0x7: cs1begin (fuc5 opcode 0x9C) − 0x8: cs1exec (fuc5 opcode 0xA0) − 0x9: invalid (fuc5 opcode 0xA4) − 0xA: cchmod (fuc5 opcode 0xA8) − 0xB: cxor (fuc5 opcode 0xAC) − 0xC: cadd (fuc5 opcode 0xB0) − 0xD: cand (fuc5 opcode 0xB4) − 0xE: crev (fuc5 opcode 0xB8) − 0xF: cprecmac (fuc5 opcode 0xBC) − 0x10: csecret (fuc5 opcode 0xC0) − 0x11: ckeyreg (fuc5 opcode 0xC4) − 0x12: ckexp (fuc5 opcode 0xC8) − 0x13: ckrexp (fuc5 opcode 0xCC) − 0x14: cenc (fuc5 opcode 0xD0) − 0x15: cdec (fuc5 opcode 0xD4) − 0x16: csigauth (fuc5 opcode 0xD8) − 0x17: csigenc (fuc5 opcode 0xDC) − 0x18: csigclr (fuc5 opcode 0xE0) − + − + − |- − | 31 − | Set if running in HS mode − Contains information on the last crypto instruction executed.+ − + − + − + − Contains information on the last authentication attempt.+ − + − + − + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + − + − + − + − + − 0: Encryption + − 1: Decryption + − 2: Key expansion + − 3: Key reverse expansion + + + + + + + + + + + + + − Contains information on the last AES sequence executed.+ − + − + − + + + + + + + + + − + − | TSEC_SCP_IRQSTAT_ACL_ERROR+ − |-+ − + − | Unknown+ − |-+ − + − | TSEC_SCP_IRQSTAT_INSN_ERROR+ − |-+ − | 20+ − | TSEC_SCP_IRQSTAT_SINGLE_STEP − − | 24 − | Unknown − + − + − Used for getting the status of crypto IRQs.+ − === TSEC_SCP_IRQMASK ===+ Line 2,098:
Line 2,148: − + + + + − + − + − + − + − + − + − + − + − + − + − + − + − |} − − Used for getting the value of the mask for crypto IRQs. − − === TSEC_SCP_ACL_ERR === − {| class="wikitable" border="1" − ! Bits − ! Description − + − + − + − + − + − + − + − + − |} − − Contains information on the status generated by the [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT_ACL_ERROR]] IRQ. − − === TSEC_SCP_INSN_ERR === − {| class="wikitable" border="1" − ! Bits − ! Description − + − + − |- − | 4 − | Empty crypto sequence − + − + − + − + − + − + − + − + + + + + + + + + + + + + + + + + + + − − Contains information on crypto errors generated by the [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT_INSN_ERROR]] IRQ. − − === TSEC_TFBIF_MCCIF_FIFOCTRL === − + − + − + − + − + − + − + − + − + − + − + − + − + − + + + + − + − + − + − + − − === TSEC_TFBIF_MCCIF_FIFOCTRL1 === − + − + + + + + + + + + + + + + + + + − + − + − − === TSEC_TFBIF_UNK_44 === − Used to control accesses to DRAM. − − [6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout. − − === TSEC_TFBIF_UNK_48 === − Used to control accesses to DRAM. − − [6.0.0+] The nvhost_tsec firmware sets this register to 0x20 or 0x140 before reading memory from the GPU UCODE carveout. − − === TSEC_CG === − + − + + + + − + − + − + − + − + − + − |} − − === TSEC_DMA_CMD === − {| class="wikitable" border="1" − ! Bits − ! Description − + − + − + − + − + − + − + − + − 0: Idle + − 1: Busy + − 2: Error + − 3: Disabled + + + + + − + − + − + − + − A DMA read/write operation requires bits TSEC_DMA_CMD_INIT and TSEC_DMA_CMD_READ/TSEC_DMA_CMD_WRITE to be set in TSEC_DMA_CMD.+ − + − During the transfer, TSEC_DMA_CMD_STATUS is set to "Busy".+ − + − Accessing an invalid address sets TSEC_DMA_CMD_STATUS to "Error".+ − + − === TSEC_DMA_ADDR ===+ − Takes the address for DMA transfers between TSEC and HOST1X (master and clients).+ − + − === TSEC_DMA_DATA ===+ − Takes the data for DMA transfers between TSEC and HOST1X (master and clients).+ − + − === TSEC_DMA_TIMEOUT ===+ − Always 0xFFF.+ − + − === TSEC_TEGRA_CTL ===+ + + + + + + + + + + + + + + + + + + + + − + − + + + + + + + + + + + + + + + + + + + − + − + − + − + + + + + + + + + + + + + + + + + + + + − + − Part of the information here (which hasn't made it into envytools documentation yet) was shared by [https://wiki.0x04.net/wiki/Marcin_Ko%C5%9Bcielnicki mwk] from reverse engineering falcon processors over the years.+ − + − === Authenticated Mode ===+ − ==== Entry ==== − From non-secure mode, upon jumping to a page marked as secret, a secret fault occurs. This causes the CPU to verify the region specified in $cauth against the MAC loaded in $c6. If the comparison is successful, the valid bit (bit0) is set on all pages in the $cauth region, and $pc is set to the base of the $cauth region. If the comparsion fails, the CPU is halted. − − ==== Exit ==== − The CPU automatically goes back to non-secure mode when returning back into non-secret pages. When this happens, the valid bit (bit0) in the TLB flags is cleared for all secret pages. − − ==== Implementation ==== − Under certain circumstances, it is possible to observe [[#csigauth|csigauth]] being briefly written to [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]] as "csigauth $c4 $c6" while the opcodes in [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]] are set to "cxsin" and "csigauth", respectively. − − Via [[#TSEC_SCP_SEQ_CTL|TSEC_SCP_SEQ_CTL]] it can be observed that a 3-sized macro sequence is loaded into cs0 during a secure mode transition. − − === Operations === − − − ! Name − ! Operand0 − ! Operand1 − ! Operation − − + + + + + − + + + + + − + + − + + + + + + + + − + + + + + + + + − + + − + + + + + + + + + + − + + − + + + + + + + + + + − + + − + + + + + + + + + + − + + − + − |-+ − | 0xD || and || $cX || $cY || <code>$cX &= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>+ + + + + + + + + + + + + + + + − + + − + − |-+ − | 0x10 || secret || $cX || immY || <code>$cX = load_secret(immY); ACL(X) = load_secret_acl(immY);</code> || − |- − | 0x11 || keyreg || immX || N/A || <code>active_key_idx = immX;</code> || − |- − | 0x12 || kexp || $cX || $cY || <code>$cX = aes_kexp($cY); ACL(X) = ACL(Y);</code> || − |- − | 0x13 || krexp || $cX || $cY || <code>$cX = aes_kexp_reverse($cY); ACL(X) = ACL(Y);</code> || − |- − | 0x14 || enc || $cX || $cY || <code>$cX = aes_enc(active_key_idx, $cY); ACL(X) = ACL(active_key_idx) & ACL(Y);</code> || − |- − | 0x15 || dec || $cX || $cY || <code>$cX = aes_dec(active_key_idx, $cY); ACL(X) = ACL(active_key_idx) & ACL(Y);</code> || − |- − − |- − | 0x17 || csigclr || N/A || N/A || <code>has_sig = false;</code> || − |- − | 0x18 || csigenc || $cX || $cY || <code>if (has_sig) { $cX = aes_enc($cY, current_sig); ACL(X) = 0x13; }</code> || − ==== csigauth ====+ − <code>00000000: f5 3c XY d8 csigauth $cY $cX</code>+ + + + + + + + + − Takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret. This instruction does not work in secure mode.+ + + + + + + + + + + − ==== csigclr ====+ − <code>00000000: f5 3c 00 e0 csigclr</code>+ + + + + + + + + + + − This instruction takes no operands and appears to clear the saved cauth signature used by the csigenc instruction.+ − + − ==== cchmod ====+ − <code>00000000: f5 3c XY a8 cchmod $cY 0X</code> or <code>00000000: f5 3c XY a9 cchmod $cY 1X</code>+ − + − This instruction takes a crypto register and a 5 bit immediate value which represents the [[#ACL|ACL]] mask to set.+ − + − ==== crnd ====+ − <code>00000000: f5 3c 0X 90 crnd $cX</code>+ − + − This instruction initializes a crypto register with random data.+ − − Executing this instruction only succeeds if the TRNG is enabled for the SCP, which requires taking the following steps: − * Write 0x7FFF to TSEC_TRNG_CLK_LIMIT_LOW. − * Write 0x3FF0000 to TSEC_TRNG_CLK_LIMIT_HIGH. − * Write 0xFF00 to TSEC_TRNG_CTL. − * Write 0x1000 to [[#TSEC_SCP_CTL1|TSEC_SCP_CTL1]]. − Otherwise it hangs forever.+ − + − + − + − + + − + − |-+ − | 2 || Insecure key. Forced set if bit3 is set. Forced clear if bit0 is clear. Can be toggled back and forth. − |- − − |- − | 4 || Insecure overwritable. Can be toggled back and forth. − ==== Initial values ====+ − On SCP boot, the ACL is 0x1F for all $cX.+ − + − Loading into $cX using xdst instruction sets ACL($cX) to 0x13 and 0x1F, for secure and insecure mode respectively. − − Spilling a $cX to DMEM using xdld instruction is allowed if (ACL($cX) & 2) or (ACL($cX) & 8), for secure and insecure mode respectively. − − Loading a secret into $cX sets a per-secret ACL, unconditionally. − − === cauth === − $cauth is a special purpose register in the CPU. + − + + − + + − + + − + + − + + + + + + + + − + + − + + − + + − + − cxset instruction provides a way to change behavior of a variable amount of successively executed DMA-related instructions.+ − + − for example: <code>000000de: f4 3c 02 cxset 0x2</code>+ − − can be read as: <code>dma_override(type=crypto_reg, count=2)</code> − − The argument to cxset specifies the type of behavior change in the top 3 bits, and the number of DMA-related instructions the effect lasts for in the lower 5 bits. − − − − + − |-+ − | 5 || Crypto destination/source select (0=crypto register, 1=crypto stream) − |- − | 6 || External memory override (0=Disabled, 1=Enabled) − |- − | 7 || Internal memory select (0=DMEM, 1=IMEM) − + − At least the following instructions may have changed behavior, and count against the cxset "count" argument: <code>xdwait</code>, <code>xdst</code>, <code>xdld</code>.+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + − For example, if override type=0b000, then the "length" argument to <code>xdst</code> is instead treated as the index of the target $cX register.+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + − + − All secrets appear to be common across Falcon units of the same version, with the exception of secret 0x3F. This secret is effectively empty (all zeros), but is configured to be overwritten with the KFUSE private key once the KFUSE clock is enabled. The KFUSE private key is console-unique.+
no edit summary
== Registers ==
== Registers ==
The TSEC's MMIO space is divided as follows:
* 0x54500000 to 0x54501000: THI (Tegra Host Interface)
* 0x54501000 to 0x54501400: [[#Falcon|FALCON (Falcon microcontroller)]]
* 0x54501400 to 0x54501500: SCP (Secure Crypto Processor?).
* 0x54501400 to 0x54501500: [[#SCP|SCP (Secure Co-processor)]]
* 0x54501500 to 0x54501600: TRNG (True Random Number Generator).
* 0x54501500 to 0x54501600: RND (Random Number Generator)
* 0x54501600 to 0x54501700: TFBIF (Tegra Framebuffer Interface) and CG (Clock Gate).
* 0x54501600 to 0x54501680: TFBIF (Tegra Framebuffer Interface)
* 0x54501700 to 0x54501800: DMA.
* 0x54501680 to 0x54501700: CG (Clock Gate)
* 0x54501800 to 0x54501900: TEGRA (miscellaneous interfaces).
* 0x54501700 to 0x54501800: BAR0 (HOST1X device DMA)
* 0x54501800 to 0x54501900: TEGRA (Miscellaneous interfaces)
{| class="wikitable" border="1"
{| class="wikitable" border="1"
| TSEC_THI_INCR_SYNCPT
| TSEC_THI_INCR_SYNCPT
| 0x54500000
| 0x54500000
| 0x04
|-
| TSEC_THI_INCR_SYNCPT_CTRL
| 0x54500004
| 0x04
| 0x04
|-
|-
| TSEC_THI_CTXSW
| TSEC_THI_CTXSW
| 0x54500020
| 0x54500020
| 0x04
|-
| TSEC_THI_CTXSW_NEXT
| 0x54500024
| 0x04
| 0x04
|-
|-
| TSEC_THI_CONT_SYNCPT_EOF
| TSEC_THI_CONT_SYNCPT_EOF
| 0x54500028
| 0x54500028
| 0x04
|-
| TSEC_THI_CONT_SYNCPT_L1
| 0x5450002C
| 0x04
|-
| TSEC_THI_STREAMID0
| 0x54500030
| 0x04
|-
| TSEC_THI_STREAMID1
| 0x54500034
| 0x04
|-
| TSEC_THI_THI_SEC
| 0x54500038
| 0x04
| 0x04
|-
|-
| [[#TSEC_THI_METHOD1|TSEC_THI_METHOD1]]
| [[#TSEC_THI_METHOD1|TSEC_THI_METHOD1]]
| 0x54500044
| 0x54500044
| 0x04
|-
| TSEC_THI_CONTEXT_SWITCH
| 0x54500060
| 0x04
| 0x04
|-
|-
| 0x04
| 0x04
|-
|-
| TSEC_THI_SLCG_STATUS
| TSEC_THI_CONFIG0
| 0x54500080
| 0x04
|-
| TSEC_THI_DBG_MISC
| 0x54500084
| 0x54500084
| 0x04
| 0x04
| 0x04
| 0x04
|-
|-
| [[#FALCON_IRQSSET|FALCON_IRQSSET]]
| [[#TSEC_FALCON_IRQSSET|TSEC_FALCON_IRQSSET]]
| 0x54501000
| 0x54501000
| 0x04
| 0x04
|-
|-
| [[#FALCON_IRQSCLR|FALCON_IRQSCLR]]
| [[#TSEC_FALCON_IRQSCLR|TSEC_FALCON_IRQSCLR]]
| 0x54501004
| 0x54501004
| 0x04
| 0x04
|-
|-
| [[#FALCON_IRQSTAT|FALCON_IRQSTAT]]
| [[#TSEC_FALCON_IRQSTAT|TSEC_FALCON_IRQSTAT]]
| 0x54501008
| 0x54501008
| 0x04
| 0x04
|-
|-
| [[#FALCON_IRQMODE|FALCON_IRQMODE]]
| [[#TSEC_FALCON_IRQMODE|TSEC_FALCON_IRQMODE]]
| 0x5450100C
| 0x5450100C
| 0x04
| 0x04
|-
|-
| [[#FALCON_IRQMSET|FALCON_IRQMSET]]
| [[#TSEC_FALCON_IRQMSET|TSEC_FALCON_IRQMSET]]
| 0x54501010
| 0x54501010
| 0x04
| 0x04
|-
|-
| [[#FALCON_IRQMCLR|FALCON_IRQMCLR]]
| [[#TSEC_FALCON_IRQMCLR|TSEC_FALCON_IRQMCLR]]
| 0x54501014
| 0x54501014
| 0x04
| 0x04
|-
|-
| [[#FALCON_IRQMASK|FALCON_IRQMASK]]
| [[#TSEC_FALCON_IRQMASK|TSEC_FALCON_IRQMASK]]
| 0x54501018
| 0x54501018
| 0x04
| 0x04
|-
|-
| [[#FALCON_IRQDEST|FALCON_IRQDEST]]
| [[#TSEC_FALCON_IRQDEST|TSEC_FALCON_IRQDEST]]
| 0x5450101C
| 0x5450101C
| 0x04
| 0x04
|-
|-
| FALCON_GPTMR_PERIOD
| TSEC_FALCON_GPTMRINT
| 0x54501020
| 0x54501020
| 0x04
| 0x04
|-
|-
| FALCON_GPTMR_TIME
| TSEC_FALCON_GPTMRVAL
| 0x54501024
| 0x54501024
| 0x04
| 0x04
|-
|-
| FALCON_GPTMR_ENABLE
| TSEC_FALCON_GPTMRCTL
| 0x54501028
| 0x54501028
| 0x04
| 0x04
|-
|-
| FALCON_TIME_LOW
| TSEC_FALCON_PTIMER0
| 0x5450102C
| 0x5450102C
| 0x04
| 0x04
|-
|-
| FALCON_TIME_HIGH
| TSEC_FALCON_PTIMER1
| 0x54501030
| 0x54501030
| 0x04
| 0x04
|-
|-
| FALCON_WDTMR_TIME
| TSEC_FALCON_WDTMRVAL
| 0x54501034
| 0x54501034
| 0x04
| 0x04
|-
|-
| FALCON_WDTMR_ENABLE
| TSEC_FALCON_WDTMRCTL
| 0x54501038
| 0x54501038
| 0x04
| 0x04
|-
|-
| FALCON_UNK_3C
| [[#TSEC_FALCON_IRQDEST2|TSEC_FALCON_IRQDEST2]]
| 0x5450103C
| 0x5450103C
| 0x04
| 0x04
|-
|-
| [[#FALCON_MAILBOX0|FALCON_MAILBOX0]]
| [[#TSEC_FALCON_MAILBOX0|TSEC_FALCON_MAILBOX0]]
| 0x54501040
| 0x54501040
| 0x04
| 0x04
|-
|-
| [[#FALCON_MAILBOX1|FALCON_MAILBOX1]]
| [[#TSEC_FALCON_MAILBOX1|TSEC_FALCON_MAILBOX1]]
| 0x54501044
| 0x54501044
| 0x04
| 0x04
|-
|-
| [[#FALCON_ITFEN|FALCON_ITFEN]]
| [[#TSEC_FALCON_ITFEN|TSEC_FALCON_ITFEN]]
| 0x54501048
| 0x54501048
| 0x04
| 0x04
|-
|-
| [[#FALCON_IDLESTATE|FALCON_IDLESTATE]]
| [[#TSEC_FALCON_IDLESTATE|TSEC_FALCON_IDLESTATE]]
| 0x5450104C
| 0x5450104C
| 0x04
| 0x04
|-
|-
| FALCON_CURCTX
| TSEC_FALCON_CURCTX
| 0x54501050
| 0x54501050
| 0x04
| 0x04
|-
|-
| FALCON_NXTCTX
| TSEC_FALCON_NXTCTX
| 0x54501054
| 0x54501054
| 0x04
| 0x04
|-
|-
| FALCON_CMDCTX
| TSEC_FALCON_CTXACK
| 0x54501058
| 0x54501058
| 0x04
| 0x04
|-
|-
| FALCON_STATUS_MASK
| TSEC_FALCON_FHSTATE
| 0x5450105C
| 0x5450105C
| 0x04
| 0x04
|-
|-
| FALCON_VM_SUPERVISOR
| TSEC_FALCON_PRIVSTATE
| 0x54501060
| 0x54501060
| 0x04
| 0x04
|-
|-
| FALCON_MTHD_DATA
| TSEC_FALCON_MTHDDATA
| 0x54501064
| 0x54501064
| 0x04
| 0x04
|-
|-
| FALCON_MTHD_CMD
| TSEC_FALCON_MTHDID
| 0x54501068
| 0x54501068
| 0x04
| 0x04
|-
|-
| FALCON_MTHD_DATA_WR
| TSEC_FALCON_MTHDWDAT
| 0x5450106C
| 0x5450106C
| 0x04
| 0x04
|-
|-
| FALCON_MTHD_OCCUPIED
| TSEC_FALCON_MTHDCOUNT
| 0x54501070
| 0x54501070
| 0x04
| 0x04
|-
|-
| FALCON_MTHD_ACK
| TSEC_FALCON_MTHDPOP
| 0x54501074
| 0x54501074
| 0x04
| 0x04
|-
|-
| FALCON_MTHD_LIMIT
| TSEC_FALCON_MTHDRAMSZ
| 0x54501078
| 0x54501078
| 0x04
| 0x04
|-
|-
| FALCON_SUBENGINE_RESET
| TSEC_FALCON_SFTRESET
| 0x5450107C
| 0x5450107C
| 0x04
| 0x04
|-
|-
| FALCON_OS
| TSEC_FALCON_OS
| 0x54501080
| 0x54501080
| 0x04
| 0x04
|-
|-
| FALCON_RM
| TSEC_FALCON_RM
| 0x54501084
| 0x54501084
| 0x04
| 0x04
|-
|-
| FALCON_PM_SIGNAL
| TSEC_FALCON_SOFT_PM
| 0x54501088
| 0x54501088
| 0x04
| 0x04
|-
|-
| FALCON_PM_MODE
| TSEC_FALCON_SOFT_MODE
| 0x5450108C
| 0x5450108C
| 0x04
| 0x04
|-
|-
| [[#FALCON_DEBUG1|FALCON_DEBUG1]]
| [[#TSEC_FALCON_DEBUG1|TSEC_FALCON_DEBUG1]]
| 0x54501090
| 0x54501090
| 0x04
| 0x04
|-
|-
| [[#FALCON_DEBUGINFO|FALCON_DEBUGINFO]]
| [[#TSEC_FALCON_DEBUGINFO|TSEC_FALCON_DEBUGINFO]]
| 0x54501094
| 0x54501094
| 0x04
| 0x04
|-
|-
| FALCON_BREAKPOINT0
| TSEC_FALCON_IBRKPT1
| 0x54501098
| 0x54501098
| 0x04
| 0x04
|-
|-
| FALCON_BREAKPOINT1
| TSEC_FALCON_IBRKPT2
| 0x5450109C
| 0x5450109C
| 0x04
| 0x04
|-
|-
| FALCON_CGCTL
| TSEC_FALCON_CGCTL
| 0x545010A0
| 0x545010A0
| 0x04
| 0x04
|-
|-
| FALCON_ENGCTL
| TSEC_FALCON_ENGCTL
| 0x545010A4
| 0x545010A4
| 0x04
| 0x04
|-
|-
| FALCON_PM_SEL
| TSEC_FALCON_PMM
| 0x545010A8
| 0x545010A8
| 0x04
| 0x04
|-
|-
| FALCON_HOST_IO_INDEX
| TSEC_FALCON_ADDR
| 0x545010AC
| 0x545010AC
| 0x04
| 0x04
|-
|-
| FALCON_BREAKPOINT2
| TSEC_FALCON_IBRKPT3
| 0x545010B0
| 0x545010B0
| 0x04
| 0x04
|-
|-
| FALCON_BREAKPOINT3
| TSEC_FALCON_IBRKPT4
| 0x545010B4
| 0x545010B4
| 0x04
| 0x04
|-
|-
| FALCON_BREAKPOINT4
| TSEC_FALCON_IBRKPT5
| 0x545010B8
| 0x545010B8
| 0x04
| 0x04
|-
|-
| [[#FALCON_EXCI|FALCON_EXCI]]
| [[#TSEC_FALCON_EXCI|TSEC_FALCON_EXCI]]
| 0x545010D0
| 0x545010D0
| 0x04
| 0x04
|-
|-
| FALCON_UNK_D4
| [[#TSEC_FALCON_SVEC_SPR|TSEC_FALCON_SVEC_SPR]]
| 0x545010D4
| 0x545010D4
| 0x04
| 0x04
|-
|-
| FALCON_UNK_D8
| [[#TSEC_FALCON_RSTAT0|TSEC_FALCON_RSTAT0]]
| 0x545010D8
| 0x545010D8
| 0x04
| 0x04
|-
|-
| FALCON_UNK_DC
| [[#TSEC_FALCON_RSTAT3|TSEC_FALCON_RSTAT3]]
| 0x545010DC
| 0x545010DC
| 0x04
| 0x04
|-
|-
| FALCON_UNK_E0
| TSEC_FALCON_UNK_E0
| 0x545010E0
| 0x545010E0
| 0x04
| 0x04
|-
|-
| [[#FALCON_CPUCTL|FALCON_CPUCTL]]
| [[#TSEC_FALCON_CPUCTL|TSEC_FALCON_CPUCTL]]
| 0x54501100
| 0x54501100
| 0x04
| 0x04
|-
|-
| [[#FALCON_BOOTVEC|FALCON_BOOTVEC]]
| [[#TSEC_FALCON_BOOTVEC|TSEC_FALCON_BOOTVEC]]
| 0x54501104
| 0x54501104
| 0x04
| 0x04
|-
|-
| [[#FALCON_HWCFG|FALCON_HWCFG]]
| [[#TSEC_FALCON_HWCFG|TSEC_FALCON_HWCFG]]
| 0x54501108
| 0x54501108
| 0x04
| 0x04
|-
|-
| [[#FALCON_DMACTL|FALCON_DMACTL]]
| [[#TSEC_FALCON_DMACTL|TSEC_FALCON_DMACTL]]
| 0x5450110C
| 0x5450110C
| 0x04
| 0x04
|-
|-
| [[#FALCON_DMATRFBASE|FALCON_DMATRFBASE]]
| [[#TSEC_FALCON_DMATRFBASE|TSEC_FALCON_DMATRFBASE]]
| 0x54501110
| 0x54501110
| 0x04
| 0x04
|-
|-
| [[#FALCON_DMATRFMOFFS|FALCON_DMATRFMOFFS]]
| [[#TSEC_FALCON_DMATRFMOFFS|TSEC_FALCON_DMATRFMOFFS]]
| 0x54501114
| 0x54501114
| 0x04
| 0x04
|-
|-
| [[#FALCON_DMATRFCMD|FALCON_DMATRFCMD]]
| [[#TSEC_FALCON_DMATRFCMD|TSEC_FALCON_DMATRFCMD]]
| 0x54501118
| 0x54501118
| 0x04
| 0x04
|-
|-
| [[#FALCON_DMATRFFBOFFS|FALCON_DMATRFFBOFFS]]
| [[#TSEC_FALCON_DMATRFFBOFFS|TSEC_FALCON_DMATRFFBOFFS]]
| 0x5450111C
| 0x5450111C
| 0x04
| 0x04
|-
|-
| [[#FALCON_DMATRFSTAT|FALCON_DMATRFSTAT]]
| [[#TSEC_FALCON_DMAPOLL_FB|TSEC_FALCON_DMAPOLL_FB]]
| 0x54501120
| 0x54501120
| 0x04
| 0x04
|-
|-
| [[#FALCON_CRYPTTRFSTAT|FALCON_CRYPTTRFSTAT]]
| [[#TSEC_FALCON_DMAPOLL_CP|TSEC_FALCON_DMAPOLL_CP]]
| 0x54501124
| 0x54501124
| 0x04
| 0x04
|-
|-
| FALCON_CPUSTAT
| TSEC_FALCON_DBG_STATE
| 0x54501128
| 0x54501128
| 0x04
| 0x04
|-
|-
| [[#FALCON_HWCFG2|FALCON_HWCFG2]]
| [[#TSEC_FALCON_HWCFG1|TSEC_FALCON_HWCFG1]]
| 0x5450112C
| 0x5450112C
| 0x04
| 0x04
|-
|-
| FALCON_CPUCTL_ALIAS
| TSEC_FALCON_CPUCTL_ALIAS
| 0x54501130
| 0x54501130
| 0x04
| 0x04
|-
|-
| [[#FALCON_IMCTL|FALCON_IMCTL]]
| TSEC_FALCON_STACKCFG
| 0x54501138
| 0x04
|-
| [[#TSEC_FALCON_IMCTL|TSEC_FALCON_IMCTL]]
| 0x54501140
| 0x54501140
| 0x04
| 0x04
|-
|-
| [[#FALCON_IMSTAT|FALCON_IMSTAT]]
| [[#TSEC_FALCON_IMSTAT|TSEC_FALCON_IMSTAT]]
| 0x54501144
| 0x54501144
| 0x04
| 0x04
|-
|-
| [[#FALCON_TRACEIDX|FALCON_TRACEIDX]]
| [[#TSEC_FALCON_TRACEIDX|TSEC_FALCON_TRACEIDX]]
| 0x54501148
| 0x54501148
| 0x04
| 0x04
|-
|-
| [[#FALCON_TRACEPC|FALCON_TRACEPC]]
| [[#TSEC_FALCON_TRACEPC|TSEC_FALCON_TRACEPC]]
| 0x5450114C
| 0x5450114C
| 0x04
| 0x04
|-
|-
| FALCON_IMFILLRNG0
| TSEC_FALCON_IMFILLRNG0
| 0x54501150
| 0x54501150
| 0x04
| 0x04
|-
|-
| FALCON_IMFILLRNG1
| TSEC_FALCON_IMFILLRNG1
| 0x54501154
| 0x54501154
| 0x04
| 0x04
|-
|-
| FALCON_IMFILLCTL
| TSEC_FALCON_IMFILLCTL
| 0x54501158
| 0x54501158
| 0x04
| 0x04
|-
|-
| FALCON_IMCTL_DEBUG
| TSEC_FALCON_IMCTL_DEBUG
| 0x5450115C
| 0x5450115C
| 0x04
| 0x04
|-
|-
| FALCON_EXTERRWIN
| TSEC_FALCON_CMEMBASE
| 0x54501160
| 0x54501160
| 0x04
| 0x04
|-
|-
| FALCON_EXTERRCFG
| TSEC_FALCON_DMEMAPERT
| 0x54501164
| 0x54501164
| 0x04
| 0x04
|-
|-
| FALCON_EXTERRADDR
| TSEC_FALCON_EXTERRADDR
| 0x54501168
| 0x54501168
| 0x04
| 0x04
|-
|-
| FALCON_EXTERRSTAT
| TSEC_FALCON_EXTERRSTAT
| 0x5450116C
| 0x5450116C
| 0x04
| 0x04
|-
|-
| FALCON_CG2
| TSEC_FALCON_CG2
| 0x5450117C
| 0x5450117C
| 0x04
| 0x04
|-
|-
| [[#FALCON_IMEMC|FALCON_IMEMC]]
| [[#TSEC_FALCON_IMEMC0|TSEC_FALCON_IMEMC0]]
| 0x54501180
| 0x54501180
| 0x04
| 0x04
|-
|-
| [[#FALCON_IMEMD|FALCON_IMEMD]]
| [[#TSEC_FALCON_IMEMD0|TSEC_FALCON_IMEMD0]]
| 0x54501184
| 0x54501184
| 0x04
| 0x04
|-
|-
| [[#FALCON_IMEMT|FALCON_IMEMT]]
| [[#TSEC_FALCON_IMEMT0|TSEC_FALCON_IMEMT0]]
| 0x54501188
| 0x54501188
| 0x04
| 0x04
|-
|-
| [[#FALCON_DMEMC0|FALCON_DMEMC0]]
| TSEC_FALCON_IMEMC1
| 0x545011C0
| 0x54501190
| 0x04
| 0x04
|-
|-
| [[#FALCON_DMEMD0|FALCON_DMEMD0]]
| TSEC_FALCON_IMEMD1
| 0x545011C4
| 0x54501194
| 0x04
| 0x04
|-
|-
| FALCON_DMEMC1
| TSEC_FALCON_IMEMT1
| 0x545011C8
| 0x54501198
| 0x04
| 0x04
|-
|-
| FALCON_DMEMD1
| TSEC_FALCON_IMEMC2
| 0x545011CC
| 0x545011A0
| 0x04
| 0x04
|-
|-
| FALCON_DMEMC2
| TSEC_FALCON_IMEMD2
| 0x545011D0
| 0x545011A4
| 0x04
| 0x04
|-
|-
| FALCON_DMEMD2
| TSEC_FALCON_IMEMT2
| 0x545011D4
| 0x545011A8
| 0x04
| 0x04
|-
|-
| FALCON_DMEMC3
| TSEC_FALCON_IMEMC3
| 0x545011D8
| 0x545011B0
| 0x04
| 0x04
|-
|-
| FALCON_DMEMD3
| TSEC_FALCON_IMEMD3
| 0x545011DC
| 0x545011B4
| 0x04
| 0x04
|-
|-
| FALCON_DMEMC4
| TSEC_FALCON_IMEMT3
| 0x545011E0
| 0x545011B8
| 0x04
| 0x04
|-
|-
| FALCON_DMEMD4
| [[#TSEC_FALCON_DMEMC0|TSEC_FALCON_DMEMC0]]
| 0x545011E4
| 0x545011C0
| 0x04
| 0x04
|-
|-
| FALCON_DMEMC5
| [[#TSEC_FALCON_DMEMD0|TSEC_FALCON_DMEMD0]]
| 0x545011E8
| 0x545011C4
| 0x04
| 0x04
|-
|-
| FALCON_DMEMD5
| TSEC_FALCON_DMEMC1
| 0x545011C8
| 0x04
|-
| TSEC_FALCON_DMEMD1
| 0x545011CC
| 0x04
|-
| TSEC_FALCON_DMEMC2
| 0x545011D0
| 0x04
|-
| TSEC_FALCON_DMEMD2
| 0x545011D4
| 0x04
|-
| TSEC_FALCON_DMEMC3
| 0x545011D8
| 0x04
|-
| TSEC_FALCON_DMEMD3
| 0x545011DC
| 0x04
|-
| TSEC_FALCON_DMEMC4
| 0x545011E0
| 0x04
|-
| TSEC_FALCON_DMEMD4
| 0x545011E4
| 0x04
|-
| TSEC_FALCON_DMEMC5
| 0x545011E8
| 0x04
|-
| TSEC_FALCON_DMEMD5
| 0x545011EC
| 0x545011EC
| 0x04
| 0x04
|-
|-
| FALCON_DMEMC6
| TSEC_FALCON_DMEMC6
| 0x545011F0
| 0x545011F0
| 0x04
| 0x04
|-
|-
| FALCON_DMEMD6
| TSEC_FALCON_DMEMD6
| 0x545011F4
| 0x545011F4
| 0x04
| 0x04
|-
|-
| FALCON_DMEMC7
| TSEC_FALCON_DMEMC7
| 0x545011F8
| 0x545011F8
| 0x04
| 0x04
|-
|-
| FALCON_DMEMD7
| TSEC_FALCON_DMEMD7
| 0x545011FC
| 0x545011FC
| 0x04
| 0x04
|-
|-
| [[#FALCON_ICD_CMD|FALCON_ICD_CMD]]
| [[#TSEC_FALCON_ICD_CMD|TSEC_FALCON_ICD_CMD]]
| 0x54501200
| 0x54501200
| 0x04
| 0x04
|-
|-
| FALCON_ICD_ADDR
| [[#TSEC_FALCON_ICD_ADDR|TSEC_FALCON_ICD_ADDR]]
| 0x54501204
| 0x54501204
| 0x04
| 0x04
|-
|-
| FALCON_ICD_WDATA
| [[#TSEC_FALCON_ICD_WDATA|TSEC_FALCON_ICD_WDATA]]
| 0x54501208
| 0x54501208
| 0x04
| 0x04
|-
|-
| FALCON_ICD_RDATA
| [[#TSEC_FALCON_ICD_RDATA|TSEC_FALCON_ICD_RDATA]]
| 0x5450120C
| 0x5450120C
| 0x04
| 0x04
|-
|-
| [[#FALCON_SCTL|FALCON_SCTL]]
| [[#TSEC_FALCON_SCTL|TSEC_FALCON_SCTL]]
| 0x54501240
| 0x54501240
| 0x04
| 0x04
|-
|-
| [[#FALCON_SCTL_STAT|FALCON_SCTL_STAT]]
| [[#TSEC_FALCON_SSTAT|TSEC_FALCON_SSTAT]]
| 0x54501244
| 0x54501244
| 0x04
| 0x04
|-
|-
| FALCON_UNK_248
| TSEC_FALCON_UNK_250
| 0x54501250
| 0x54501250
| 0x04
| 0x04
|-
|-
| FALCON_UNK_260
| TSEC_FALCON_UNK_260
| 0x54501260
| 0x54501260
| 0x04
| 0x04
|-
|-
| [[#FALCON_SPROT_IMEM|FALCON_SPROT_IMEM]]
| [[#TSEC_FALCON_SPROT_IMEM|TSEC_FALCON_SPROT_IMEM]]
| 0x54501280
| 0x54501280
| 0x04
| 0x04
|-
|-
| [[#FALCON_SPROT_DMEM|FALCON_SPROT_DMEM]]
| [[#TSEC_FALCON_SPROT_DMEM|TSEC_FALCON_SPROT_DMEM]]
| 0x54501284
| 0x54501284
| 0x04
| 0x04
|-
|-
| [[#FALCON_SPROT_CPUCTL|FALCON_SPROT_CPUCTL]]
| [[#TSEC_FALCON_SPROT_CPUCTL|TSEC_FALCON_SPROT_CPUCTL]]
| 0x54501288
| 0x54501288
| 0x04
| 0x04
|-
|-
| [[#FALCON_SPROT_MISC|FALCON_SPROT_MISC]]
| [[#TSEC_FALCON_SPROT_MISC|TSEC_FALCON_SPROT_MISC]]
| 0x5450128C
| 0x5450128C
| 0x04
| 0x04
|-
|-
| [[#FALCON_SPROT_IRQ|FALCON_SPROT_IRQ]]
| [[#TSEC_FALCON_SPROT_IRQ|TSEC_FALCON_SPROT_IRQ]]
| 0x54501290
| 0x54501290
| 0x04
| 0x04
|-
|-
| [[#FALCON_SPROT_MTHD|FALCON_SPROT_MTHD]]
| [[#TSEC_FALCON_SPROT_MTHD|TSEC_FALCON_SPROT_MTHD]]
| 0x54501294
| 0x54501294
| 0x04
| 0x04
|-
|-
| [[#FALCON_SPROT_SCTL|FALCON_SPROT_SCTL]]
| [[#TSEC_FALCON_SPROT_SCTL|TSEC_FALCON_SPROT_SCTL]]
| 0x54501298
| 0x54501298
| 0x04
| 0x04
|-
|-
| [[#FALCON_SPROT_WDTMR|FALCON_SPROT_WDTMR]]
| [[#TSEC_FALCON_SPROT_WDTMR|TSEC_FALCON_SPROT_WDTMR]]
| 0x5450129C
| 0x5450129C
| 0x04
| 0x04
|-
|-
| FALCON_UNK_2C0
| TSEC_FALCON_DMAINFO_FINISHED_FBRD_LOW
| 0x545012C0
| 0x545012C0
| 0x04
| 0x04
|-
|-
| FALCON_UNK_2C4
| TSEC_FALCON_DMAINFO_FINISHED_FBRD_HIGH
| 0x545012C4
| 0x545012C4
| 0x04
| 0x04
|-
|-
| FALCON_UNK_2C8
| TSEC_FALCON_DMAINFO_FINISHED_FBWR_LOW
| 0x545012C8
| 0x545012C8
| 0x04
| 0x04
|-
|-
| FALCON_UNK_2CC
| TSEC_FALCON_DMAINFO_FINISHED_FBWR_HIGH
| 0x545012CC
| 0x545012CC
| 0x04
| 0x04
|-
|-
| FALCON_UNK_2E0
| TSEC_FALCON_DMAINFO_CURRENT_FBRD_LOW
| 0x545012E0
| 0x545012D0
| 0x04
|-
| TSEC_FALCON_DMAINFO_CURRENT_FBRD_HIGH
| 0x545012D4
| 0x04
|-
| TSEC_FALCON_DMAINFO_CURRENT_FBWR_LOW
| 0x545012D8
| 0x04
|-
| TSEC_FALCON_DMAINFO_CURRENT_FBWR_HIGH
| 0x545012DC
| 0x04
|-
| TSEC_FALCON_DMAINFO_CTL
| 0x545012E0
| 0x04
| 0x04
|-
|-
| 0x04
| 0x04
|-
|-
| TSEC_SCP_UNK_10
| [[#TSEC_SCP_CFG|TSEC_SCP_CFG]]
| 0x54501410
| 0x54501410
| 0x04
| 0x04
|-
|-
| TSEC_SCP_UNK_14
| TSEC_SCP_CTL_SCP
| 0x54501414
| 0x54501414
| 0x04
| 0x04
| 0x04
| 0x04
|-
|-
| TSEC_SCP_UNK_1C
| TSEC_SCP_CTL_DBG
| 0x5450141C
| 0x5450141C
| 0x04
| 0x04
|-
|-
| [[#TSEC_SCP_SEQ_CTL|TSEC_SCP_SEQ_CTL]]
| [[#TSEC_SCP_DBG0|TSEC_SCP_DBG0]]
| 0x54501420
| 0x54501420
| 0x04
| 0x04
|-
|-
| [[#TSEC_SCP_SEQ_VAL|TSEC_SCP_SEQ_VAL]]
| [[#TSEC_SCP_DBG1|TSEC_SCP_DBG1]]
| 0x54501424
| 0x54501424
| 0x04
| 0x04
|-
|-
| [[#TSEC_SCP_SEQ_STAT|TSEC_SCP_SEQ_STAT]]
| [[#TSEC_SCP_DBG2|TSEC_SCP_DBG2]]
| 0x54501428
| 0x54501428
| 0x04
| 0x04
|-
|-
| [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]]
| [[#TSEC_SCP_CMD|TSEC_SCP_CMD]]
| 0x54501430
| 0x54501430
| 0x04
| 0x04
|-
|-
| TSEC_SCP_UNK_50
| [[#TSEC_SCP_STAT0|TSEC_SCP_STAT0]]
| 0x54501450
| 0x54501450
| 0x04
| 0x04
|-
|-
| [[#TSEC_SCP_AUTH_STAT|TSEC_SCP_AUTH_STAT]]
| [[#TSEC_SCP_STAT1|TSEC_SCP_STAT1]]
| 0x54501454
| 0x54501454
| 0x04
| 0x04
|-
|-
| [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]]
| [[#TSEC_SCP_STAT2|TSEC_SCP_STAT2]]
| 0x54501458
| 0x54501458
| 0x04
| 0x04
|-
|-
| TSEC_SCP_UNK_70
| [[#TSEC_SCP_RND_STAT0|TSEC_SCP_RND_STAT0]]
| 0x54501470
| 0x54501470
| 0x04
|-
| TSEC_SCP_RND_STAT1
| 0x54501474
| 0x04
| 0x04
|-
|-
| 0x04
| 0x04
|-
|-
| TSEC_SCP_UNK_94
| TSEC_SCP_SEC_ERR
| 0x54501494
| 0x54501494
| 0x04
| 0x04
|-
|-
| [[#TSEC_SCP_INSN_ERR|TSEC_SCP_INSN_ERR]]
| [[#TSEC_SCP_CMD_ERR|TSEC_SCP_CMD_ERR]]
| 0x54501498
| 0x54501498
| 0x04
| 0x04
|-
|-
| TSEC_TRNG_CLK_LIMIT_LOW
| [[#TSEC_RND_CTL0|TSEC_RND_CTL0]]
| 0x54501500
| 0x54501500
| 0x04
| 0x04
|-
|-
| TSEC_TRNG_CLK_LIMIT_HIGH
| [[#TSEC_RND_CTL1|TSEC_RND_CTL1]]
| 0x54501504
| 0x54501504
| 0x04
| 0x04
|-
|-
| TSEC_TRNG_UNK_08
| TSEC_RND_CTL2
| 0x54501508
| 0x54501508
| 0x04
| 0x04
|-
|-
| TSEC_TRNG_TEST_CTL
| TSEC_RND_CTL3
| 0x5450150C
| 0x5450150C
| 0x04
| 0x04
|-
|-
| TSEC_TRNG_TEST_CFG0
| TSEC_RND_CTL4
| 0x54501510
| 0x54501510
| 0x04
| 0x04
|-
|-
| TSEC_TRNG_TEST_SEED0
| TSEC_RND_CTL5
| 0x54501514
| 0x54501514
| 0x04
| 0x04
|-
|-
| TSEC_TRNG_TEST_CFG1
| TSEC_RND_CTL6
| 0x54501518
| 0x54501518
| 0x04
| 0x04
|-
|-
| TSEC_TRNG_TEST_SEED1
| TSEC_RND_CTL7
| 0x5450151C
| 0x5450151C
| 0x04
| 0x04
|-
|-
| TSEC_TRNG_UNK_20
| TSEC_RND_CTL8
| 0x54501520
| 0x54501520
| 0x04
| 0x04
|-
|-
| TSEC_TRNG_UNK_24
| TSEC_RND_CTL9
| 0x54501524
| 0x54501524
| 0x04
| 0x04
|-
|-
| TSEC_TRNG_UNK_28
| TSEC_RND_CTL10
| 0x54501528
| 0x54501528
| 0x04
| 0x04
|-
|-
| TSEC_TRNG_CTL
| TSEC_RND_CTL11
| 0x5450152C
| 0x5450152C
| 0x04
| 0x04
|-
|-
| TSEC_TFBIF_UNK_00
| [[#TSEC_TFBIF_CTL|TSEC_TFBIF_CTL]]
| 0x54501600
| 0x54501600
| 0x04
| 0x04
| 0x04
| 0x04
|-
|-
| TSEC_TFBIF_THROTTLE
| [[#TSEC_TFBIF_THROTTLE|TSEC_TFBIF_THROTTLE]]
| 0x54501608
| 0x54501608
| 0x04
| 0x04
|-
|-
| TSEC_TFBIF_UNK_0C
| [[#TSEC_TFBIF_DBG_STAT0|TSEC_TFBIF_DBG_STAT0]]
| 0x5450160C
| 0x5450160C
| 0x04
| 0x04
|-
|-
| TSEC_TFBIF_UNK_30
| TSEC_TFBIF_DBG_STAT1
| 0x54501630
| 0x54501610
| 0x04
| 0x04
|-
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL1|TSEC_TFBIF_MCCIF_FIFOCTRL1]]
| TSEC_TFBIF_DBG_RDCOUNT_LO
| 0x54501634
| 0x54501614
| 0x04
| 0x04
|-
|-
| TSEC_TFBIF_UNK_40
| TSEC_TFBIF_DBG_RDCOUNT_HI
| 0x54501640
| 0x54501618
| 0x04
| 0x04
|-
|-
| [[#TSEC_TFBIF_UNK_44|TSEC_TFBIF_UNK_44]]
| TSEC_TFBIF_DBG_WRCOUNT_LO
| 0x54501644
| 0x5450161C
| 0x04
| 0x04
|-
|-
| [[#TSEC_TFBIF_UNK_48|TSEC_TFBIF_UNK_48]]
| TSEC_TFBIF_DBG_WRCOUNT_HI
| 0x54501648
| 0x54501620
| 0x04
| 0x04
|-
|-
| [[#TSEC_CG|TSEC_CG]]
| TSEC_TFBIF_DBG_R32COUNT
| 0x545016D0
| 0x54501624
| 0x04
| 0x04
|-
|-
| [[#TSEC_DMA_CMD|TSEC_DMA_CMD]]
| TSEC_TFBIF_DBG_R64COUNT
| 0x54501700
| 0x54501628
| 0x04
| 0x04
|-
|-
| [[#TSEC_DMA_ADDR|TSEC_DMA_ADDR]]
| TSEC_TFBIF_DBG_R128COUNT
| 0x54501704
| 0x5450162C
| 0x04
| 0x04
|-
|-
| [[#TSEC_DMA_DATA|TSEC_DMA_DATA]]
| TSEC_TFBIF_UNK_30
| 0x54501708
| 0x54501630
| 0x04
| 0x04
|-
|-
| [[#TSEC_DMA_TIMEOUT|TSEC_DMA_TIMEOUT]]
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL1|TSEC_TFBIF_MCCIF_FIFOCTRL1]]
| 0x5450170C
| 0x54501634
| 0x04
| 0x04
|-
|-
| TSEC_TEGRA_FALCON_IP_VER
| TSEC_TFBIF_WRR_RDP
| 0x54501800
| 0x54501638
| 0x04
| 0x04
|-
|-
| TSEC_TEGRA_UNK_04
| [[#TSEC_TFBIF_SPROT_EMEM|TSEC_TFBIF_SPROT_EMEM]]
| 0x54501804
| 0x54501640
| 0x04
| 0x04
|-
|-
| TSEC_TEGRA_UNK_08
| [[#TSEC_TFBIF_TRANSCFG|TSEC_TFBIF_TRANSCFG]]
| 0x54501808
| 0x54501644
| 0x04
| 0x04
|-
|-
| TSEC_TEGRA_UNK_0C
| [[#TSEC_TFBIF_REGIONCFG|TSEC_TFBIF_REGIONCFG]]
| 0x5450180C
| 0x54501648
| 0x04
| 0x04
|-
|-
| TSEC_TEGRA_UNK_10
| [[#TSEC_TFBIF_ACTMON_ACTIVE_MASK|TSEC_TFBIF_ACTMON_ACTIVE_MASK]]
| 0x54501810
| 0x5450164C
| 0x04
| 0x04
|-
|-
| TSEC_TEGRA_UNK_14
| [[#TSEC_TFBIF_ACTMON_ACTIVE_BORPS|TSEC_TFBIF_ACTMON_ACTIVE_BORPS]]
| 0x54501814
| 0x54501650
| 0x04
| 0x04
|-
|-
| TSEC_TEGRA_UNK_18
| [[#TSEC_TFBIF_ACTMON_ACTIVE_WEIGHT|TSEC_TFBIF_ACTMON_ACTIVE_WEIGHT]]
| 0x54501818
| 0x54501654
| 0x04
| 0x04
|-
|-
| TSEC_TEGRA_UNK_1C
| TSEC_TFBIF_ACTMON_MCB_MASK
| 0x5450181C
| 0x54501660
| 0x04
| 0x04
|-
|-
| TSEC_TEGRA_UNK_20
| TSEC_TFBIF_ACTMON_MCB_BORPS
| 0x54501820
| 0x54501664
| 0x04
| 0x04
|-
|-
| TSEC_TEGRA_UNK_24
| TSEC_TFBIF_ACTMON_MCB_WEIGHT
| 0x54501824
| 0x54501668
| 0x04
| 0x04
|-
|-
| TSEC_TEGRA_UNK_28
| TSEC_TFBIF_THI_TRANSPROP
| 0x54501828
| 0x54501670
| 0x04
| 0x04
|-
|-
| TSEC_TEGRA_UNK_2C
| [[#TSEC_CG|TSEC_CG]]
| 0x5450182C
| 0x545016D0
| 0x04
| 0x04
|-
|-
| TSEC_TEGRA_UNK_30
| [[#TSEC_BAR0_CTL|TSEC_BAR0_CTL]]
| 0x54501830
| 0x54501700
| 0x04
| 0x04
|-
|-
| TSEC_TEGRA_UNK_34
| [[#TSEC_BAR0_ADDR|TSEC_BAR0_ADDR]]
| 0x54501834
| 0x54501704
| 0x04
| 0x04
|-
|-
| [[#TSEC_TEGRA_CTL|TSEC_TEGRA_CTL]]
| [[#TSEC_BAR0_DATA|TSEC_BAR0_DATA]]
| 0x54501838
| 0x54501708
| 0x04
| 0x04
|-
|-
| 0x200
| [[#TSEC_BAR0_TIMEOUT|TSEC_BAR0_TIMEOUT]]
| SET_APPLICATION_ID
| 0x5450170C
| 0x04
|-
|-
| 0x300
| TSEC_TEGRA_FALCON_IP_VER
| EXECUTE
| 0x54501800
| 0x04
|-
|-
| 0x500
| TSEC_TEGRA_UNK_04
| HDCP_INIT
| 0x54501804
| 0x04
|-
|-
| 0x504
| TSEC_TEGRA_UNK_08
| HDCP_CREATE_SESSION
| 0x54501808
| 0x04
|-
|-
| 0x508
| TSEC_TEGRA_UNK_0C
| HDCP_VERIFY_CERT_RX
| 0x5450180C
| 0x04
|-
|-
| 0x50C
| TSEC_TEGRA_UNK_10
| HDCP_GENERATE_EKM
| 0x54501810
| 0x04
|-
|-
| 0x510
| TSEC_TEGRA_UNK_14
| HDCP_REVOCATION_CHECK
| 0x54501814
| 0x04
|-
|-
| 0x514
| TSEC_TEGRA_UNK_18
| HDCP_VERIFY_HPRIME
| 0x54501818
| 0x04
|-
|-
| 0x518
| TSEC_TEGRA_UNK_1C
| HDCP_ENCRYPT_PAIRING_INFO
| 0x5450181C
| 0x04
|-
|-
| 0x51C
| TSEC_TEGRA_UNK_20
| HDCP_DECRYPT_PAIRING_INFO
| 0x54501820
| 0x04
|-
|-
| 0x520
| TSEC_TEGRA_UNK_24
| HDCP_UPDATE_SESSION
| 0x54501824
| 0x04
|-
|-
| 0x524
| TSEC_TEGRA_UNK_28
| HDCP_GENERATE_LC_INIT
| 0x54501828
| 0x04
|-
|-
| 0x528
| TSEC_TEGRA_UNK_2C
| HDCP_VERIFY_LPRIME
| 0x5450182C
| 0x04
|-
|-
| 0x52C
| TSEC_TEGRA_UNK_30
| HDCP_GENERATE_SKE_INIT
| 0x54501830
| 0x04
|-
|-
| 0x530
| TSEC_TEGRA_UNK_34
| HDCP_VERIFY_VPRIME
| 0x54501834
| 0x04
|-
|-
| 0x534
| [[#TSEC_TEGRA_CTL|TSEC_TEGRA_CTL]]
| HDCP_ENCRYPTION_RUN_CTRL
| 0x54501838
| 0x04
|}
=== TSEC_THI_METHOD0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
|-
| 0x538
| 0-11
| HDCP_SESSION_CTRL
| TSEC_THI_METHOD0_OFFSET
|}
Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.
The following methods are available:
{| class="wikitable" border="1"
! ID
! Method
|-
|-
| 0x53C
| 0x100
| HDCP_COMPUTE_SPRIME
| NOP
|-
|-
| 0x540
| 0x140
| HDCP_GET_CERT_RX
| PM_TRIGGER
|-
|-
| 0x544
| 0x200
| HDCP_EXCHANGE_INFO
| SET_APPLICATION_ID
|-
|-
| 0x548
| 0x204
| HDCP_DECRYPT_KM
| SET_WATCHDOG_TIMER
|-
|-
| 0x54C
| 0x240
| HDCP_GET_HPRIME
| SEMAPHORE_A
|-
|-
| 0x550
| 0x244
| HDCP_GENERATE_EKH_KM
| SEMAPHORE_B
|-
|-
| 0x554
| 0x248
| HDCP_VERIFY_RTT_CHALLENGE
| SEMAPHORE_C
|-
|-
| 0x558
| 0x24C
| HDCP_GET_LPRIME
|
|-
|-
| 0x55C
| 0x250
| HDCP_DECRYPT_KS
|
|-
|-
| 0x560
| 0x300
| HDCP_DECRYPT
| EXECUTE
|-
|-
| 0x564
| 0x304
| HDCP_GET_RRX
| SEMAPHORE_D
|-
|-
| 0x568
| 0x500
| HDCP_DECRYPT_REENCRYPT
| HDCP_INIT
|-
|-
| 0x56C
| 0x504
|
| HDCP_CREATE_SESSION
|-
|-
| 0x570
| 0x508
|
| HDCP_VERIFY_CERT_RX
|-
|-
| 0x574
| 0x50C
|
| HDCP_GENERATE_EKM
|-
|-
| 0x578
| 0x510
|
| HDCP_REVOCATION_CHECK
|-
|-
| 0x57C
| 0x514
|
| HDCP_VERIFY_HPRIME
|-
|-
| 0x700
| 0x518
| HDCP_VALIDATE_SRM
| HDCP_ENCRYPT_PAIRING_INFO
|-
|-
| 0x704
| 0x51C
| HDCP_VALIDATE_STREAM
| HDCP_DECRYPT_PAIRING_INFO
|-
|-
| 0x708
| 0x520
| HDCP_TEST_SECURE_STATUS
| HDCP_UPDATE_SESSION
|-
|-
| 0x70C
| 0x524
| HDCP_SET_DCP_KPUB
| HDCP_GENERATE_LC_INIT
|-
|-
| 0x710
| 0x528
| HDCP_SET_RX_KPUB
| HDCP_VERIFY_LPRIME
|-
|-
| 0x714
| 0x52C
| HDCP_SET_CERT_RX
| HDCP_GENERATE_SKE_INIT
|-
|-
| 0x718
| 0x530
| HDCP_SET_SCRATCH_BUFFER
| HDCP_VERIFY_VPRIME
|-
|-
| 0x71C
| 0x534
| HDCP_SET_SRM
| HDCP_ENCRYPTION_RUN_CTRL
|-
|-
| 0x720
| 0x538
| HDCP_SET_RECEIVER_ID_LIST
| HDCP_SESSION_CTRL
|-
|-
| 0x724
| 0x53C
| HDCP_SET_SPRIME
| HDCP_COMPUTE_SPRIME
|-
| 0x540
| HDCP_GET_CERT_RX
|-
|-
| 0x728
| 0x544
| HDCP_SET_ENC_INPUT_BUFFER
| HDCP_EXCHANGE_INFO
|-
|-
| 0x72C
| 0x548
| HDCP_SET_ENC_OUTPUT_BUFFER
| HDCP_DECRYPT_KM
|-
|-
| 0x730
| 0x54C
| HDCP_GET_RTT_CHALLENGE
| HDCP_GET_HPRIME
|-
|-
| 0x734
| 0x550
| HDCP_STREAM_MANAGE
| HDCP_GENERATE_EKH_KM
|-
|-
| 0x738
| 0x554
| HDCP_READ_CAPS
| HDCP_VERIFY_RTT_CHALLENGE
|-
|-
| 0x73C
| 0x558
| HDCP_ENCRYPT
| HDCP_GET_LPRIME
|-
|-
| 0x740
| 0x55C
| [6.0.0+] HDCP_GET_CURRENT_NONCE
| HDCP_DECRYPT_KS
|-
|-
| 0
| 0x560
| TSEC_THI_INT_STATUS_FALCON_INT
| HDCP_DECRYPT
|-
|-
| 0
| 0x564
| TSEC_THI_INT_MASK_FALCON_INT
| HDCP_GET_RRX
|-
|-
| 0
| 0x568
| FALCON_IRQSSET_GPTMR
| HDCP_DECRYPT_REENCRYPT
|-
| 0x56C
|
|-
|-
| 1
| 0x570
| FALCON_IRQSSET_WDTMR
|
|-
|-
| 2
| 0x574
| FALCON_IRQSSET_MTHD
|
|-
|-
| 3
| 0x578
| FALCON_IRQSSET_CTXSW
|
|-
|-
| 4
| 0x57C
| FALCON_IRQSSET_HALT
|
|-
|-
| 5
| 0x700
| FALCON_IRQSSET_EXTERR
| HDCP_VALIDATE_SRM
|-
|-
| 6
| 0x704
| FALCON_IRQSSET_SWGEN0
| HDCP_VALIDATE_STREAM
|-
|-
| 7
| 0x708
| FALCON_IRQSSET_SWGEN1
| HDCP_TEST_SECURE_STATUS
|-
|-
| 8-15
| 0x70C
| FALCON_IRQSSET_EXT
| HDCP_SET_DCP_KPUB
|-
|-
| 0
| 0x710
| FALCON_IRQSCLR_GPTMR
| HDCP_SET_RX_KPUB
|-
|-
| 1
| 0x714
| FALCON_IRQSCLR_WDTMR
| HDCP_SET_CERT_RX
|-
|-
| 2
| 0x718
| FALCON_IRQSCLR_MTHD
| HDCP_SET_SCRATCH_BUFFER
|-
|-
| 3
| 0x71C
| FALCON_IRQSCLR_CTXSW
| HDCP_SET_SRM
|-
|-
| 4
| 0x720
| FALCON_IRQSCLR_HALT
| HDCP_SET_RECEIVER_ID_LIST
|-
|-
| 5
| 0x724
| FALCON_IRQSCLR_EXTERR
| HDCP_SET_SPRIME
|-
|-
| 6
| 0x728
| FALCON_IRQSCLR_SWGEN0
| HDCP_SET_ENC_INPUT_BUFFER
|-
|-
| 7
| 0x72C
| FALCON_IRQSCLR_SWGEN1
| HDCP_SET_ENC_OUTPUT_BUFFER
|-
|-
| 8-15
| 0x730
| FALCON_IRQSCLR_EXT
| HDCP_GET_RTT_CHALLENGE
|-
|-
| 0
| 0x734
| FALCON_IRQSTAT_GPTMR
| HDCP_STREAM_MANAGE
|-
|-
| 1
| 0x738
| FALCON_IRQSTAT_WDTMR
| HDCP_READ_CAPS
|-
|-
| 2
| 0x73C
| FALCON_IRQSTAT_MTHD
| HDCP_ENCRYPT
|-
|-
| 3
| 0x740
| [6.0.0+] HDCP_GET_CURRENT_NONCE
| 6
|-
|-
| 8-15
| 0x1114
| FALCON_IRQSTAT_EXT
| PM_TRIGGER_END
|}
|}
=== TSEC_THI_METHOD1 ===
=== FALCON_IRQMODE ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0
| 0-31
| FALCON_IRQMODE_GPTMR
| TSEC_THI_METHOD1_DATA
|}
Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.
=== TSEC_THI_INT_STATUS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_STATUS_FALCON_INT
|}
=== TSEC_THI_INT_MASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_THI_INT_MASK_FALCON_INT
|}
=== TSEC_FALCON_IRQSSET ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_FALCON_IRQSSET_GPTMR
|-
|-
| 1
| 1
| FALCON_IRQMODE_WDTMR
| TSEC_FALCON_IRQSSET_WDTMR
|-
|-
| 2
| 2
| FALCON_IRQMODE_MTHD
| TSEC_FALCON_IRQSSET_MTHD
|-
|-
| 3
| 3
| FALCON_IRQMODE_CTXSW
| TSEC_FALCON_IRQSSET_CTXSW
|-
|-
| 4
| 4
| FALCON_IRQMODE_HALT
| TSEC_FALCON_IRQSSET_HALT
|-
|-
| 5
| 5
| FALCON_IRQMODE_EXTERR
| TSEC_FALCON_IRQSSET_EXTERR
|-
|-
| 6
| 6
| FALCON_IRQMODE_SWGEN0
| TSEC_FALCON_IRQSSET_SWGEN0
|-
|-
| 7
| 7
| FALCON_IRQMODE_SWGEN1
| TSEC_FALCON_IRQSSET_SWGEN1
|-
|-
| 8-15
| 8-15
| FALCON_IRQMODE_EXT
| TSEC_FALCON_IRQSSET_EXT
|-
| 16
| TSEC_FALCON_IRQSSET_DMA
|}
|}
Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.
Used for setting Falcon's IRQs.
=== FALCON_IRQMSET ===
=== TSEC_FALCON_IRQSCLR ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
|-
|-
| 0
| 0
| FALCON_IRQMSET_GPTMR
| TSEC_FALCON_IRQSCLR_GPTMR
|-
|-
| 1
| 1
| FALCON_IRQMSET_WDTMR
| TSEC_FALCON_IRQSCLR_WDTMR
|-
|-
| 2
| 2
| FALCON_IRQMSET_MTHD
| TSEC_FALCON_IRQSCLR_MTHD
|-
|-
| 3
| 3
| FALCON_IRQMSET_CTXSW
| TSEC_FALCON_IRQSCLR_CTXSW
|-
|-
| 4
| 4
| FALCON_IRQMSET_HALT
| TSEC_FALCON_IRQSCLR_HALT
|-
|-
| 5
| 5
| FALCON_IRQMSET_EXTERR
| TSEC_FALCON_IRQSCLR_EXTERR
|-
|-
| 6
| 6
| FALCON_IRQMSET_SWGEN0
| TSEC_FALCON_IRQSCLR_SWGEN0
|-
|-
| 7
| 7
| FALCON_IRQMSET_SWGEN1
| TSEC_FALCON_IRQSCLR_SWGEN1
|-
|-
| 8-15
| 8-15
| FALCON_IRQMSET_EXT
| TSEC_FALCON_IRQSCLR_EXT
|-
| 16
| TSEC_FALCON_IRQSCLR_DMA
|}
|}
Used for setting the mask for Falcon's IRQs.
Used for clearing Falcon's IRQs.
=== FALCON_IRQMCLR ===
=== TSEC_FALCON_IRQSTAT ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
|-
|-
| 0
| 0
| FALCON_IRQMCLR_GPTMR
| TSEC_FALCON_IRQSTAT_GPTMR
|-
|-
| 1
| 1
| FALCON_IRQMCLR_WDTMR
| TSEC_FALCON_IRQSTAT_WDTMR
|-
|-
| 2
| 2
| FALCON_IRQMCLR_MTHD
| TSEC_FALCON_IRQSTAT_MTHD
|-
|-
| 3
| 3
| FALCON_IRQMCLR_CTXSW
| TSEC_FALCON_IRQSTAT_CTXSW
|-
|-
| 4
| 4
| FALCON_IRQMCLR_HALT
| TSEC_FALCON_IRQSTAT_HALT
|-
|-
| 5
| 5
| FALCON_IRQMCLR_EXTERR
| TSEC_FALCON_IRQSTAT_EXTERR
|-
|-
| 6
| 6
| FALCON_IRQMCLR_SWGEN0
| TSEC_FALCON_IRQSTAT_SWGEN0
|-
|-
| 7
| 7
| FALCON_IRQMCLR_SWGEN1
| TSEC_FALCON_IRQSTAT_SWGEN1
|-
|-
| 8-15
| 8-15
| FALCON_IRQMCLR_EXT
| TSEC_FALCON_IRQSTAT_EXT
|-
| 16
| TSEC_FALCON_IRQSTAT_DMA
|}
|}
Used for clearing the mask for Falcon's IRQs.
Used for getting the status of Falcon's IRQs.
=== FALCON_IRQMASK ===
=== TSEC_FALCON_IRQMODE ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
|-
|-
| 0
| 0
| FALCON_IRQMASK_GPTMR
| TSEC_FALCON_IRQMODE_LVL_GPTMR
|-
|-
| 1
| 1
| FALCON_IRQMASK_WDTMR
| TSEC_FALCON_IRQMODE_LVL_WDTMR
|-
|-
| 2
| 2
| FALCON_IRQMASK_MTHD
| TSEC_FALCON_IRQMODE_LVL_MTHD
|-
|-
| 3
| 3
| FALCON_IRQMASK_CTXSW
| TSEC_FALCON_IRQMODE_LVL_CTXSW
|-
|-
| 4
| 4
| FALCON_IRQMASK_HALT
| TSEC_FALCON_IRQMODE_LVL_HALT
|-
|-
| 5
| 5
| FALCON_IRQMASK_EXTERR
| TSEC_FALCON_IRQMODE_LVL_EXTERR
|-
|-
| 6
| 6
| FALCON_IRQMASK_SWGEN0
| TSEC_FALCON_IRQMODE_LVL_SWGEN0
|-
|-
| 7
| 7
| FALCON_IRQMASK_SWGEN1
| TSEC_FALCON_IRQMODE_LVL_SWGEN1
|-
|-
| 8-15
| 8-15
| FALCON_IRQMASK_EXT
| TSEC_FALCON_IRQMODE_LVL_EXT
|-
| 16
| TSEC_FALCON_IRQMODE_LVL_DMA
|}
|}
Used for getting the value of the mask for Falcon's IRQs.
Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.
=== FALCON_IRQDEST ===
=== TSEC_FALCON_IRQMSET ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
|-
|-
| 0
| 0
| FALCON_IRQDEST_HOST_GPTMR
| TSEC_FALCON_IRQMSET_GPTMR
|-
|-
| 1
| 1
| FALCON_IRQDEST_HOST_WDTMR
| TSEC_FALCON_IRQMSET_WDTMR
|-
|-
| 2
| 2
| FALCON_IRQDEST_HOST_MTHD
| TSEC_FALCON_IRQMSET_MTHD
|-
|-
| 3
| 3
| FALCON_IRQDEST_HOST_CTXSW
| TSEC_FALCON_IRQMSET_CTXSW
|-
|-
| 4
| 4
| FALCON_IRQDEST_HOST_HALT
| TSEC_FALCON_IRQMSET_HALT
|-
|-
| 5
| 5
| FALCON_IRQDEST_HOST_EXTERR
| TSEC_FALCON_IRQMSET_EXTERR
|-
|-
| 6
| 6
| FALCON_IRQDEST_HOST_SWGEN0
| TSEC_FALCON_IRQMSET_SWGEN0
|-
|-
| 7
| 7
| FALCON_IRQDEST_HOST_SWGEN1
| TSEC_FALCON_IRQMSET_SWGEN1
|-
|-
| 8-15
| 8-15
| FALCON_IRQDEST_HOST_EXT
| TSEC_FALCON_IRQMSET_EXT
|-
|-
| 16
| 16
| FALCON_IRQDEST_TARGET_GPTMR
| TSEC_FALCON_IRQMSET_DMA
|}
|}
Used for routing Falcon's IRQs.
Used for setting the mask for Falcon's IRQs.
=== FALCON_ITFEN ===
=== TSEC_FALCON_IRQMCLR ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
|-
|-
| 0
| 0
| FALCON_ITFEN_CTXEN
| TSEC_FALCON_IRQMCLR_GPTMR
|-
|-
| 1
| 1
| FALCON_ITFEN_MTHDEN
| TSEC_FALCON_IRQMCLR_WDTMR
|}
|-
| 2
| TSEC_FALCON_IRQMCLR_MTHD
|-
| 3
| TSEC_FALCON_IRQMCLR_CTXSW
|-
| 4
| TSEC_FALCON_IRQMCLR_HALT
|-
| 5
| TSEC_FALCON_IRQMCLR_EXTERR
|-
| 6
| TSEC_FALCON_IRQMCLR_SWGEN0
|-
|-
| 0
| 7
| FALCON_IDLESTATE_FALCON_BUSY
| TSEC_FALCON_IRQMCLR_SWGEN1
|-
|-
| 1-15
| 8-15
| FALCON_IDLESTATE_EXT_BUSY
| TSEC_FALCON_IRQMCLR_EXT
|-
|-
| 16
| 16
| FALCON_DEBUG1_CTXSW_MODE
| TSEC_FALCON_IRQMCLR_DMA
|}
|}
Used for clearing the mask for Falcon's IRQs.
Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.
=== FALCON_EXCI ===
=== TSEC_FALCON_IRQMASK ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
|-
|-
| 0
| 0
| FALCON_CPUCTL_IINVAL
| TSEC_FALCON_IRQMASK_GPTMR
|-
|-
| 1
| 1
| FALCON_CPUCTL_STARTCPU
| TSEC_FALCON_IRQMASK_WDTMR
|-
|-
| 2
| 2
| FALCON_CPUCTL_SRESET
| TSEC_FALCON_IRQMASK_MTHD
|-
|-
| 3
| 3
| FALCON_CPUCTL_HRESET
| TSEC_FALCON_IRQMASK_CTXSW
|-
|-
| 4
| 4
| FALCON_CPUCTL_HALTED
| TSEC_FALCON_IRQMASK_HALT
|-
|-
| 5
| 5
| FALCON_CPUCTL_STOPPED
| TSEC_FALCON_IRQMASK_EXTERR
|-
|-
| 6
| 6
| FALCON_CPUCTL_CPUCTL_ALIAS_EN
| TSEC_FALCON_IRQMASK_SWGEN0
|-
|-
| 0-8
| 7
| FALCON_HWCFG_IMEM_SIZE
| TSEC_FALCON_IRQMASK_SWGEN1
|-
|-
| 9-17
| 8-15
| FALCON_HWCFG_DMEM_SIZE
| TSEC_FALCON_IRQMASK_EXT
|-
|-
| 18-25
| 16
| FALCON_HWCFG_MTHD_SIZE
| TSEC_FALCON_IRQMASK_DMA
|}
|}
=== FALCON_DMACTL ===
Used for getting the value of the mask for Falcon's IRQs.
=== TSEC_FALCON_IRQDEST ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
|-
|-
| 0
| 0
| FALCON_DMACTL_REQUIRE_CTX
| TSEC_FALCON_IRQDEST_HOST_GPTMR
|-
|-
| 1
| 1
| FALCON_DMACTL_DMEM_SCRUBBING
| TSEC_FALCON_IRQDEST_HOST_WDTMR
|-
|-
| 2
| 2
| FALCON_DMACTL_IMEM_SCRUBBING
| TSEC_FALCON_IRQDEST_HOST_MTHD
|-
|-
| 3-6
| 3
| FALCON_DMACTL_DMAQ_NUM
| TSEC_FALCON_IRQDEST_HOST_CTXSW
|-
|-
| 7
| 4
| FALCON_DMACTL_SECURE_STAT
| TSEC_FALCON_IRQDEST_HOST_HALT
|}
|-
| 5
| TSEC_FALCON_IRQDEST_HOST_EXTERR
|-
| 6
| TSEC_FALCON_IRQDEST_HOST_SWGEN0
|-
|-
| 0
| 7
| FALCON_DMATRFCMD_FULL
| TSEC_FALCON_IRQDEST_HOST_SWGEN1
|-
|-
| 1
| 8-15
| FALCON_DMATRFCMD_IDLE
| TSEC_FALCON_IRQDEST_HOST_EXT
|-
|-
| 2-3
| 16
| FALCON_DMATRFCMD_SEC
| TSEC_FALCON_IRQDEST_TARGET_GPTMR
|-
|-
| 4
| 17
| FALCON_DMATRFCMD_IMEM
| TSEC_FALCON_IRQDEST_TARGET_WDTMR
|-
|-
| 5
| 18
| FALCON_DMATRFCMD_WRITE
| TSEC_FALCON_IRQDEST_TARGET_MTHD
|-
|-
| 8-10
| 19
| FALCON_DMATRFCMD_SIZE
| TSEC_FALCON_IRQDEST_TARGET_CTXSW
|-
|-
| 12-14
| 20
| FALCON_DMATRFCMD_CTXDMA
| TSEC_FALCON_IRQDEST_TARGET_HALT
|}
|-
| 21
| TSEC_FALCON_IRQDEST_TARGET_EXTERR
|-
| 22
| TSEC_FALCON_IRQDEST_TARGET_SWGEN0
|-
| 23
| TSEC_FALCON_IRQDEST_TARGET_SWGEN1
|-
| 24-31
| TSEC_FALCON_IRQDEST_TARGET_EXT
|}
Used for routing Falcon's IRQs.
=== FALCON_DMATRFSTAT ===
=== TSEC_FALCON_IRQDEST2 ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
|-
|-
| 0
| 0
| FALCON_DMATRFSTAT_PENDING
| TSEC_FALCON_IRQDEST2_HOST_DMA
|-
|-
| 16-18
| 16
| FALCON_DMATRFSTAT_NUM_STORES_PENDING
| TSEC_FALCON_IRQDEST2_TARGET_DMA
|}
|}
=== FALCON_CRYPTTRFSTAT ===
Used for routing Falcon's IRQs.
=== TSEC_FALCON_MAILBOX0 ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 1
| 0-31
| TSEC_FALCON_MAILBOX0_DATA
| FALCON_CRYPTTRFSTAT_NUM_LOADS_PENDING
|}
|}
=== FALCON_HWCFG2 ===
Scratch register for reading/writing data to Falcon.
=== TSEC_FALCON_MAILBOX1 ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0-3
| 0-31
| FALCON_HWCFG2_VERSION
| TSEC_FALCON_MAILBOX1_DATA
|-
|}
| 4-5
Scratch register for reading/writing data to Falcon.
=== TSEC_FALCON_ITFEN ===
{| class="wikitable" border="1"
! Bits
! Description
|-
|-
| 6-7
| 0
| FALCON_HWCFG2_SUBVERSION
| TSEC_FALCON_ITFEN_CTXEN
|-
|-
| 8-11
| 1
| FALCON_HWCFG2_IMEM_PORTS
| TSEC_FALCON_ITFEN_MTHDEN
|}
|}
=== FALCON_IMCTL ===
Used for enabling/disabling Falcon interfaces.
=== TSEC_FALCON_IDLESTATE ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0-23
| 0
| Address
| TSEC_FALCON_IDLESTATE_FALCON_BUSY
|-
|-
| 24-26
| 1-15
| Command
| TSEC_FALCON_IDLESTATE_EXT_BUSY
|}
|}
Used for detecting if Falcon is busy or not.
=== FALCON_TRACEIDX ===
=== TSEC_FALCON_DEBUG1 ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0-7
| 0-15
| Index of where to start tracing from
| TSEC_FALCON_DEBUG1_MTHD_DRAIN_TIME
|-
|-
| 16-23
| 16
| Maximum valid index
| TSEC_FALCON_DEBUG1_CTXSW_MODE
|-
|-
| 24-31
| 17
| Number of trace reads remaining
| TSEC_FALCON_DEBUG1_TRACE_FORMAT
|}
|}
=== TSEC_FALCON_DEBUGINFO ===
=== FALCON_TRACEPC ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 2-7
| 0-31
| TSEC_FALCON_DEBUGINFO_DATA
| Secret code upload reset scrubber status (read-only)
|}
|}
Used for configuring access to Falcon's IMEM.
Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.
[6.0.0+] [[NV_services|nvservices]] sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.
=== FALCON_DMEMC0 ===
=== TSEC_FALCON_EXCI ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 2-7
| 0-19
| Offset in DMEM block to read/write
| TSEC_FALCON_EXCI_EXPC
|-
|-
| 8-15
| 20-23
| DMEM block to read/write
| TSEC_FALCON_EXCI_EXCAUSE
0x00: TRAP0
0x01: TRAP1
0x02: TRAP2
0x03: TRAP3
0x08: ILL_INS (invalid opcode)
0x09: INV_INS (authentication entry)
0x0A: MISS_INS (page miss)
0x0B: DHIT_INS (page multiple hit)
0x0F: BRKPT_INS (breakpoint hit)
|}
Contains information about raised exceptions.
=== TSEC_FALCON_SVEC_SPR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
|-
| 24
| 18
| Write auto-increment
| TSEC_FALCON_SVEC_SPR_SIGPASS
|}
|}
=== TSEC_FALCON_RSTAT0 ===
Mirror of the [[#TSEC_FALCON_ICD_RDATA|ICD status register 0]].
=== FALCON_DMEMD0 ===
=== TSEC_FALCON_RSTAT3 ===
Mirror of the [[#TSEC_FALCON_ICD_RDATA|ICD status register 3]].
=== FALCON_ICD_CMD ===
=== TSEC_FALCON_CPUCTL ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0-3
| 0
| FALCON_ICD_CMD_OPC
| TSEC_FALCON_CPUCTL_IINVAL
|-
| 1
| TSEC_FALCON_CPUCTL_STARTCPU
|-
|-
| 6-7
| 2
| FALCON_ICD_CMD_DATA_SIZE
| TSEC_FALCON_CPUCTL_SRESET
|-
|-
| 8-12
| 3
| FALCON_ICD_CMD_IDX
| TSEC_FALCON_CPUCTL_HRESET
|-
|-
| 14
| 4
| FALCON_ICD_CMD_ERROR
| TSEC_FALCON_CPUCTL_HALTED
|-
|-
| 15
| 5
| FALCON_ICD_CMD_DONE
| TSEC_FALCON_CPUCTL_STOPPED
|-
|-
| 16-31
| 6
| FALCON_ICD_CMD_BREAK_MASK
| TSEC_FALCON_CPUCTL_ALIAS_EN
|}
|}
=== FALCON_SCTL ===
Used for signaling the Falcon CPU.
=== TSEC_FALCON_BOOTVEC ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0-1
| 0-31
| FALCON_SCTL_SEC_MODE
| TSEC_FALCON_BOOTVEC_VEC
|}
Takes the Falcon's boot vector address.
=== TSEC_FALCON_HWCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-8
| TSEC_FALCON_HWCFG_IMEM_SIZE
|-
|-
| 4-5
| 9-17
| FALCON_SCTL_OLD_SEC_MODE
| TSEC_FALCON_HWCFG_DMEM_SIZE
|-
|-
| 12-13
| 18-26
| Unknown
| TSEC_FALCON_HWCFG_METHODFIFO_DEPTH
|-
|-
| 14
| 27-31
| Initialize the transition to LS mode
| TSEC_FALCON_HWCFG_DMAQUEUE_DEPTH
|}
|}
=== FALCON_SCTL_STAT ===
=== TSEC_FALCON_DMACTL ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 31
| 0
| Set on memory protection violation
| TSEC_FALCON_DMACTL_REQUIRE_CTX
|-
| 1
| TSEC_FALCON_DMACTL_DMEM_SCRUBBING
|-
| 2
| TSEC_FALCON_DMACTL_IMEM_SCRUBBING
|-
| 3-6
| TSEC_FALCON_DMACTL_DMAQ_NUM
|-
| 7
| TSEC_FALCON_DMACTL_SECURE_STAT
|}
|}
=== FALCON_SPROT_IMEM ===
Used for configuring the Falcon's DMA engine.
=== TSEC_FALCON_DMATRFBASE ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0-3
| 0-31
| Read access level
| TSEC_FALCON_DMATRFBASE_BASE
|}
|}
Base address of the external memory buffer, shifted right by 8.
The current transfer address is calculated by adding [[#TSEC_FALCON_DMATRFFBOFFS|TSEC_FALCON_DMATRFFBOFFS]] to the base.
=== FALCON_SPROT_DMEM ===
=== TSEC_FALCON_DMATRFMOFFS ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0-3
| 0-15
| Read access level
| TSEC_FALCON_DMATRFMOFFS_OFFS
|}
|}
For transfers to DMEM: the destination address.
For transfers to IMEM: the destination virtual IMEM page.
=== FALCON_SPROT_CPUCTL ===
=== TSEC_FALCON_DMATRFCMD ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0-3
| 0
| Read access level
| TSEC_FALCON_DMATRFCMD_FULL
|-
|-
| 4-7
| 1
| TSEC_FALCON_DMATRFCMD_IDLE
|}
|-
|-
| 0-3
| 2-3
| Read access level
| TSEC_FALCON_DMATRFCMD_SEC
|-
|-
| 4-7
| 4
| Write access level
| TSEC_FALCON_DMATRFCMD_IMEM
|}
|-
| 5
| TSEC_FALCON_DMATRFCMD_WRITE
|-
|-
| 0-3
| 8-10
| Read access level
| TSEC_FALCON_DMATRFCMD_SIZE
|-
|-
| 4-7
| 12-14
| Write access level
| TSEC_FALCON_DMATRFCMD_CTXDMA
|}
|}
Used for configuring DMA transfers.
=== FALCON_SPROT_MTHD ===
=== TSEC_FALCON_DMATRFFBOFFS ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0-3
| 0-15
| Read access level
| TSEC_FALCON_DMATRFFBOFFS_OFFS
|}
|}
For transfers to IMEM: the destination physical IMEM page.
=== FALCON_SPROT_SCTL ===
=== TSEC_FALCON_DMAPOLL_FB ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0-3
| 0
| Read access level
| TSEC_FALCON_DMAPOLL_FB_FENCE_ACTIVE
|-
|-
| 4-7
| 1
| Write access level
| TSEC_FALCON_DMAPOLL_FB_DMA_ACTIVE
|-
| 4
| TSEC_FALCON_DMAPOLL_FB_CFG_R_FENCE
|-
| 5
| TSEC_FALCON_DMAPOLL_FB_CFG_W_FENCE
|-
| 16-23
| TSEC_FALCON_DMAPOLL_FB_WCOUNT
|-
| 24-31
| TSEC_FALCON_DMAPOLL_FB_RCOUNT
|}
|}
Contains the status of a DMA transfer between the Falcon and external memory.
=== FALCON_SPROT_WDTMR ===
=== TSEC_FALCON_DMAPOLL_CP ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0-3
| 0
| Read access level
| TSEC_FALCON_DMAPOLL_CP_FENCE_ACTIVE
|-
| 1
| TSEC_FALCON_DMAPOLL_CP_DMA_ACTIVE
|-
| 4
| TSEC_FALCON_DMAPOLL_CP_CFG_R_FENCE
|-
| 5
| TSEC_FALCON_DMAPOLL_CP_CFG_W_FENCE
|-
| 16-23
| TSEC_FALCON_DMAPOLL_CP_WCOUNT
|-
|-
| 4-7
| 24-31
| Write access level
| TSEC_FALCON_DMAPOLL_CP_RCOUNT
|}
|}
Contains the status of a DMA transfer between the Falcon and the SCP.
=== TSEC_SCP_CTL0 ===
=== TSEC_FALCON_HWCFG1 ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 20
| 0-3
| Enable TSEC_SCP_INSN_STAT register
| TSEC_FALCON_HWCFG1_CORE_REV
|}
|-
| 4-5
=== TSEC_SCP_CTL1 ===
| TSEC_FALCON_HWCFG1_SECURITY_MODEL
|-
| 6-7
| TSEC_FALCON_HWCFG1_CORE_REV_SUBVERSION
|-
| 8-11
| TSEC_FALCON_HWCFG1_IMEM_PORTS
|-
| 12-15
| TSEC_FALCON_HWCFG1_DMEM_PORTS
|-
| 16-20
| TSEC_FALCON_HWCFG1_TAG_WIDTH
|-
| 27
| TSEC_FALCON_HWCFG1_DBG_PRIV_BUS
|-
| 28
| TSEC_FALCON_HWCFG1_CSB_SIZE_16M
|-
| 29
| TSEC_FALCON_HWCFG1_PRIV_DIRECT
|-
| 30
| TSEC_FALCON_HWCFG1_DMEM_APERTURES
|-
| 31
| TSEC_FALCON_HWCFG1_IMEM_AUTOFILL
|}
=== TSEC_FALCON_IMCTL ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 11
| 0-23
| Enable TRNG testing mode
| TSEC_FALCON_IMCTL_ADDR_BLK
|-
|-
| 12
| 24-26
| Enable the TRNG
| TSEC_FALCON_IMCTL_CMD
0x00: NOP
0x01: IMINV (ITLB)
0x02: IMBLK (PTLB)
0x03: IMTAG (VTLB)
0x04: IMTAG_SETVLD
|}
|}
=== TSEC_SCP_CTL_STAT ===
Controls the Falcon TLB.
=== TSEC_FALCON_IMSTAT ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 20
| 0-31
| TSEC_SCP_CTL_STAT_DEBUG_MODE
| TSEC_FALCON_IMSTAT_VAL
|}
|}
=== TSEC_SCP_CTL_LOCK ===
Returns the result of the last command from [[#TSEC_FALCON_IMCTL|TSEC_FALCON_IMCTL]].
=== TSEC_FALCON_TRACEIDX ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0
| 0-7
| Disable reads for the SCP and TRNG register blocks
| TSEC_FALCON_TRACEIDX_IDX
|-
|-
| 1
| 16-23
| Disable reads for the TFBIF register block
| TSEC_FALCON_TRACEIDX_MAXIDX
|-
|-
| 2
| 24-31
| TSEC_FALCON_TRACEIDX_CNT
| 5
|}
|}
Controls the index for tracing with [[#TSEC_FALCON_TRACEPC|TSEC_FALCON_TRACEPC]].
=== TSEC_SCP_CTL_PKEY ===
=== TSEC_FALCON_TRACEPC ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0
| 0-23
| TSEC_FALCON_TRACEPC_PC
| 1
|}
|}
=== TSEC_SCP_SEQ_CTL ===
Returns the PC of the last call or branch executed.
=== TSEC_FALCON_IMEMC0 ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0-3
| 2-7
| Sequence's instruction index
| TSEC_FALCON_IMEMC_OFFS
|-
| 8-15
| TSEC_FALCON_IMEMC_BLK
|-
|-
| 4-7
| 24
| Target and control flags
| TSEC_FALCON_IMEMC_AINCW
|-
|-
| 8-11
| 25
| Sequence's size
| TSEC_FALCON_IMEMC_AINCR
|}
|-
| 28
| TSEC_FALCON_IMEMC_SECURE
|-
| 29
| TSEC_FALCON_IMEMC_SEC_ATOMIC
|-
| 30
| TSEC_FALCON_IMEMC_SEC_WR_VIO
|-
| 31
| TSEC_FALCON_IMEMC_SEC_LOCK
|}
Used for configuring access to Falcon's IMEM.
=== TSEC_SCP_SEQ_VAL ===
=== TSEC_FALCON_IMEMD0 ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0-3
| 0-31
| Sequence instruction's first operand
| TSEC_FALCON_IMEMD_DATA
|}
|}
Returns or takes the value for an IMEM read/write operation.
=== TSEC_SCP_SEQ_STAT ===
=== TSEC_FALCON_IMEMT0 ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0
| 0-15
| TSEC_FALCON_IMEMT_TAG
| Active crypto key register
|}
|}
Returns or takes the virtual page index for an IMEM read/write operation.
=== TSEC_SCP_INSN_STAT ===
=== TSEC_FALCON_DMEMC0 ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0-3
| 2-7
| Destination register or immediate value
| TSEC_FALCON_DMEMC_OFFS
|-
|-
| 8-13
| 8-15
| Source register or immediate value
| TSEC_FALCON_DMEMC_BLK
|-
|-
| 20-24
| 24
| Operation
| TSEC_FALCON_DMEMC_AINCW
|-
|-
| 28
| 25
| Set if the instruction is valid
| TSEC_FALCON_DMEMC_AINCR
|}
|}
Used for configuring access to Falcon's DMEM.
=== TSEC_SCP_AUTH_STAT ===
=== TSEC_FALCON_DMEMD0 ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0-1
| 0-31
| Signature comparison result (3=succeeded, 2=failed)
| TSEC_FALCON_DMEMD_DATA
|}
|}
Returns or takes the value for a DMEM read/write operation.
=== TSEC_SCP_AES_STAT ===
=== TSEC_FALCON_ICD_CMD ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0-4
| 0-3
| First opcode
| TSEC_FALCON_ICD_CMD_OPC
0x00: STOP
0x01: RUN (run from PC)
0x02: JRUN (run from address)
0x03: RUNB (run from PC)
0x04: JRUNB (run from address)
0x05: STEP (step from PC)
0x06: JSTEP (step from address)
0x07: EMASK (set exception mask)
0x08: RREG (read register)
0x09: WREG (write register)
0x0A: RDM (read data memory)
0x0B: WDM (write data memory)
0x0C: RCM (read MMIO/configuration memory)
0x0D: WCM (write MMIO/configuration memory)
0x0E: RSTAT (read status)
0x0F: SBU
|-
| 6-7
| TSEC_FALCON_ICD_CMD_SZ
0x00: B (byte)
0x01: HW (half word)
0x02: W (word)
|-
| 8-12
| TSEC_FALCON_ICD_CMD_IDX
0x00: REG0 | RSTAT0 | WB0
0x01: REG1 | RSTAT1 | WB1
0x02: REG2 | RSTAT2 | WB2
0x03: REG3 | RSTAT3 | WB3
0x04: REG4 | RSTAT4
0x05: REG5 | RSTAT5
0x06: REG6
0x07: REG7
0x08: REG8
0x09: REG9
0x0A: REG10
0x0B: REG11
0x0C: REG12
0x0D: REG13
0x0E: REG14
0x0F: REG15
0x10: IV0
0x11: IV1
0x12: UNDEFINED
0x13: EV
0x14: SP
0x15: PC
0x16: IMB
0x17: DMB
0x18: CSW
0x19: CCR
0x1A: SEC
0x1B: CTX
0x1C: EXCI
0x1D: SEC1
0x1E: IMB1
0x1F: DMB1
|-
| 14
| TSEC_FALCON_ICD_CMD_ERROR
|-
|-
| 5-9
| 15
| Second opcode
| TSEC_FALCON_ICD_CMD_RDVLD
|-
|-
| 15-16
| 16-31
| AES operation
| TSEC_FALCON_ICD_CMD_PARM
0x0001: EMASK_TRAP0
0x0002: EMASK_TRAP1
0x0004: EMASK_TRAP2
0x0008: EMASK_TRAP3
0x0010: EMASK_EXC_UNIMP
0x0020: EMASK_EXC_IMISS
0x0040: EMASK_EXC_IMHIT
0x0080: EMASK_EXC_IBREAK
0x0100: EMASK_IV0
0x0200: EMASK_IV1
0x0400: EMASK_IV2
0x0800: EMASK_EXT0
0x1000: EMASK_EXT1
0x2000: EMASK_EXT2
0x4000: EMASK_EXT3
0x8000: EMASK_EXT4
|}
|}
Used for sending commands to the Falcon's in-chip debugger.
=== TSEC_SCP_IRQSTAT ===
=== TSEC_FALCON_ICD_ADDR ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0
| 0-31
| TSEC_SCP_IRQSTAT_TRNG
| TSEC_FALCON_ICD_ADDR_ADDR
|}
Takes the target address for the Falcon's in-chip debugger.
=== TSEC_FALCON_ICD_WDATA ===
{| class="wikitable" border="1"
! Bits
! Description
|-
|-
| 8
| 0-31
| TSEC_FALCON_ICD_WDATA_DATA
|}
| 12
Takes the data for writing using the Falcon's in-chip debugger.
| 16
=== TSEC_FALCON_ICD_RDATA ===
{| class="wikitable" border="1"
! Bits
! Description
|-
|-
|-
| 28
| 0-31
| Unknown
| TSEC_FALCON_ICD_RDATA_DATA
|}
|}
Returns the data read using the Falcon's in-chip debugger.
When reading from an internal status register (STAT), the following applies:
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
|-
|-
| 0
| 0
| TSEC_SCP_IRQMASK_TRNG
| RSTAT0_MEM_STALL
|-
| 1
| RSTAT0_DMA_STALL
|-
|-
| 8
| 2
| TSEC_SCP_IRQMASK_ACL_ERROR
| RSTAT0_FENCE_STALL
|-
|-
| 12
| 3
| Unknown
| RSTAT0_DIV_STALL
|-
|-
| 16
| 4
| TSEC_SCP_IRQMASK_INSN_ERROR
| RSTAT0_DMA_STALL_DMAQ
|-
|-
| 20
| 5
| TSEC_SCP_IRQMASK_SINGLE_STEP
| RSTAT0_DMA_STALL_DMWAITING
|-
|-
| 24
| 6
| Unknown
| RSTAT0_DMA_STALL_IMWAITING
|-
|-
| 28
| 7
| Unknown
| RSTAT0_ANY_STALL
|-
|-
| 0
| 8
| Set when writing to a crypto register without the correct ACL
| RSTAT0_SBFULL_STALL
|-
|-
| 4
| 9
| Set when reading from a crypto register without the correct ACL
| RSTAT0_SBHIT_STALL
|-
|-
| 8
| 10
| Set on an invalid ACL change (cchmod)
| RSTAT0_FLOW_STALL
|-
|-
| 31
| 11
| An ACL error occurred
| RSTAT0_SP_STALL
|-
|-
| 0
| 12
| Invalid instruction
| RSTAT0_BL_STALL
|-
|-
| 8
| 13
| Crypto sequence is too long
| RSTAT0_IPND_STALL
|-
|-
| 12
| 14
| Crypto sequence was not finished
| RSTAT0_LDSTQ_STALL
|-
|-
| 16
| 16
| Insecure signature (csigenc, csigclr or csigauth)
| RSTAT0_NOINSTR_STALL
|-
|-
| 20
| 20
| Invalid signature (csigauth in HS mode)
| RSTAT0_HALTSTOP_FLUSH
|-
|-
| 24
| 21
| Forbidden ACL change (cchmod in NS mode)
| RSTAT0_AFILL_FLUSH
|-
| 22
| RSTAT0_EXC_FLUSH
|-
| 23-25
| RSTAT0_IRQ_FLUSH
|-
| 28
| RSTAT0_VALIDRD
|-
| 29
| RSTAT0_WAITING
|-
| 30
| RSTAT0_HALTED
|-
| 31
| RSTAT0_MTHD_FULL
|}
|}
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0
| 0-3
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
| RSTAT1_WB_ALLOC
|-
|-
| 1
| 4-7
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
| RSTAT1_WB_VALID
|-
|-
| 2
| 8-9
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
| RSTAT1_WB0_SZ
|-
|-
| 3
| 10-11
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
| RSTAT1_WB1_SZ
|-
|-
| 4
| 12-13
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
| RSTAT1_WB2_SZ
|-
|-
| 5
| 14-15
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
| RSTAT1_WB3_SZ
|-
|-
| 6
| 16-19
| TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
| RSTAT1_WB0_IDX
|-
| 20-23
| RSTAT1_WB1_IDX
|-
|-
| 7
| 24-27
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
| RSTAT1_WB2_IDX
|-
|-
| 8
| 28-31
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE
| RSTAT1_WB3_IDX
|}
|}
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0-15
| 0-3
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
| RSTAT2_DMAQ_NUM
|-
| 4
| RSTAT2_DMA_ENABLE
|-
| 5-7
| RSTAT2_LDSTQ_NUM
|-
| 16-19
| RSTAT2_EM_BUSY
|-
| 20-23
| RSTAT2_EM_ACKED
|-
| 24-27
| RSTAT2_EM_ISWR
|-
|-
| 16-31
| 28-31
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT
| RSTAT2_EM_DVLD
|}
|}
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0-5
| 0
| TSEC_CG_IDLE_CG_DLY_CNT
| RSTAT3_MTHD_IDLE
|-
| 1
| RSTAT3_CTXSW_IDLE
|-
|-
| 6
| 2
| TSEC_CG_IDLE_CG_EN
| RSTAT3_DMA_IDLE
|-
|-
| 16-18
| 3
| TSEC_CG_WAKEUP_DLY_CNT
| RSTAT3_SCP_IDLE
|-
|-
| 19
| 4
| TSEC_CG_WAKEUP_DLY_EN
| RSTAT3_LDST_IDLE
|-
|-
| 0
| 5
| TSEC_DMA_CMD_READ
| RSTAT3_SBWB_EMPTY
|-
|-
| 1
| 6-8
| TSEC_DMA_CMD_WRITE
| RSTAT3_CSWIE
|-
|-
| 4-7
| 10
| TSEC_DMA_CMD_BYTE_MASK
| RSTAT3_CSWE
|-
|-
| 12-13
| 12-14
| TSEC_DMA_CMD_STATUS
| RSTAT3_CTXSW_STATE
0x00: IDLE
0x01: SM_CHECK
0x02: SM_SAVE
0x03: SM_SAVE_WAIT
0x04: SM_BLK_BIND
0x05: SM_RESET
0x06: SM_RESETWAIT
0x07: SM_ACK
|-
|-
| 31
| 15
| TSEC_DMA_CMD_INIT
| RSTAT3_CTXSW_PEND
|}
|-
| 17
| RSTAT3_DMA_FBREQ_IDLE
|-
| 18
| RSTAT3_DMA_ACKQ_EMPTY
|-
| 19
| RSTAT3_DMA_RDQ_EMPTY
|-
| 20
| RSTAT3_DMA_WR_BUSY
|-
| 21
| RSTAT3_DMA_RD_BUSY
|-
| 22
| RSTAT3_LDST_XT_BUSY
|-
| 23
| RSTAT3_LDST_XT_BLOCK
|-
| 24
| RSTAT3_ENG_IDLE
|}
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
| 0-1
| RSTAT4_ICD_STATE
0x00: NORMAL
0x01: WAIT_ISSUE_CLEAR
0x02: WAIT_EXLDQ_CLEAR
0x03: FULL_DBG_MODE
|-
| 2-3
| RSTAT4_ICD_MODE
0x00: SUPPRESSICD
0x01: ENTERICD_IBRK
0x02: ENTERICD_STEP
|-
|-
| 16
| 16
| TSEC_TEGRA_CTL_TKFI_KFUSE
| RSTAT4_ICD_EMASK_TRAP0
|-
|-
| 17
| 17
| TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
| RSTAT4_ICD_EMASK_TRAP1
|-
| 18
| RSTAT4_ICD_EMASK_TRAP2
|-
| 19
| RSTAT4_ICD_EMASK_TRAP3
|-
| 20
| RSTAT4_ICD_EMASK_EXC_UNIMP
|-
| 21
| RSTAT4_ICD_EMASK_EXC_IMISS
|-
| 22
| RSTAT4_ICD_EMASK_EXC_IMHIT
|-
| 23
| RSTAT4_ICD_EMASK_EXC_IBREAK
|-
|-
| 24
| 24
| TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
| RSTAT4_ICD_EMASK_IV0
|-
|-
| 25
| 25
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
| RSTAT4_ICD_EMASK_IV1
|-
|-
| 26
| 26
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
| RSTAT4_ICD_EMASK_IV2
|-
|-
| 27
| 27
| TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C
| RSTAT4_ICD_EMASK_EXT0
|-
| 28
| RSTAT4_ICD_EMASK_EXT1
|-
| 29
| RSTAT4_ICD_EMASK_EXT2
|-
| 30
| RSTAT4_ICD_EMASK_EXT3
|-
| 31
| RSTAT4_ICD_EMASK_EXT4
|}
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| RSTAT5_LRU_STATE
|}
|}
== SCP ==
=== TSEC_FALCON_SCTL ===
{| class="wikitable" border="1"
! Bits
! Description
{| class="wikitable" border="1"
! Opcode
! Condition
|-
|-
| 0 || nop || N/A || N/A || ||
| 0-1
| TSEC_FALCON_SCTL_SEC_MODE
0: Non-secure
1: Light Secure
2: Heavy Secure
|-
|-
| 1 || mov || $cX || $cY || <code>$cX = $cY; ACL(X) = ACL(Y);</code> ||
| 4-5
| TSEC_FALCON_SCTL_OLD_SEC_MODE
0: Non-secure
1: Light Secure
2: Heavy Secure
|-
|-
| 2 || sin || $cX || N/A || <code>$cX = read_stream(); ACL(X) = ???;</code> ||
| 12-13
| Unknown
|-
|-
| 3 || sout || $cX || N/A || <code>write_stream($cX);</code> || ?
| 14
| Initialize the transition to LS mode
|}
=== TSEC_FALCON_SSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
|-
| 4 || rnd || $cX || N/A || <code>$cX = read_trng(); ACL(X) = ???;</code> ||
| 31
| Set on memory protection violation
|}
=== TSEC_FALCON_SPROT_IMEM ===
{| class="wikitable" border="1"
! Bits
! Description
|-
|-
| 5 || s0begin || immX || N/A || <code>record_macro_for_N_instructions(0, immX);</code> ||
| 0-3
| Read access level
|-
|-
| 6 || s0exec || immX || N/A || <code>execute_macro_N_times(0, immX);</code> ||
| 4-7
| Write access level
|}
Controls accesses to Falcon IMEM.
=== TSEC_FALCON_SPROT_DMEM ===
{| class="wikitable" border="1"
! Bits
! Description
|-
|-
| 7 || s1begin || immX || N/A || <code>record_macro_for_N_instructions(1, immX);</code> ||
| 0-3
| Read access level
|-
|-
| 8 || s1exec || immX || N/A || <code>execute_macro_N_times(1, immX);</code> ||
| 4-7
| Write access level
|}
Controls accesses to Falcon DMEM.
=== TSEC_FALCON_SPROT_CPUCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
|-
| 9 || <invalid> || || || ||
| 0-3
| Read access level
|-
|-
| 0xA || chmod || $cX || immY || Complicated, see [[#ACL|ACL]]. ||
| 4-7
| Write access level
|}
Controls accesses to the [[#TSEC_FALCON_CPUCTL|TSEC_FALCON_CPUCTL]] register.
=== TSEC_FALCON_SPROT_MISC ===
{| class="wikitable" border="1"
! Bits
! Description
|-
|-
| 0xB || xor || $cX || $cY || <code>$cX ^= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
| 0-3
| Read access level
|-
|-
| 0xC || add || $cX || immY || <code>$cX += immY;</code> || <code>(ACL(X) & 2)</code>
| 4-7
| Write access level
|}
Controls accesses to the following registers:
* TSEC_FALCON_PRIVSTATE
* TSEC_FALCON_SFTRESET
* TSEC_FALCON_ADDR
* [[#TSEC_FALCON_DMACTL|TSEC_FALCON_DMACTL]]
* [[#TSEC_FALCON_IMCTL|TSEC_FALCON_IMCTL]]
* [[#TSEC_FALCON_IMSTAT|TSEC_FALCON_IMSTAT]]
* TSEC_FALCON_UNK_250
* TSEC_FALCON_DMAINFO_CTL
=== TSEC_FALCON_SPROT_IRQ ===
{| class="wikitable" border="1"
! Bits
! Description
|-
|-
| 0xE || rev || $cX || $cY || <code>$cX = endian_swap128($cY); ACL(X) = ACL(Y);</code> ||
| 0-3
| Read access level
|-
|-
| 0xF || gfmul || $cX || $cY || <code>$cX = gfmul($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 2)</code>
| 4-7
| Write access level
| 0x16 || csigauth || $cX || $cY || <code>if (hash_verify($cX, $cY)) { has_sig = true; current_sig = $cX; }</code> || ?
|}
|}
Controls accesses to the following registers:
* [[#TSEC_FALCON_IRQMODE|TSEC_FALCON_IRQMODE]]
* [[#TSEC_FALCON_IRQMSET|TSEC_FALCON_IRQMSET]]
* [[#TSEC_FALCON_IRQMCLR|TSEC_FALCON_IRQMCLR]]
* [[#TSEC_FALCON_IRQDEST|TSEC_FALCON_IRQDEST]]
* TSEC_FALCON_GPTMRINT
* TSEC_FALCON_GPTMRVAL
* TSEC_FALCON_GPTMRCTL
* TSEC_FALCON_IRQDEST2
* TSEC_FALCON_UNK_E0
=== TSEC_FALCON_SPROT_MTHD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Read access level
|-
| 4-7
| Write access level
|}
Controls accesses to the following registers:
* [[#TSEC_FALCON_ITFEN|TSEC_FALCON_ITFEN]]
* TSEC_FALCON_CURCTX
* TSEC_FALCON_NXTCTX
* TSEC_FALCON_CTXACK
* TSEC_FALCON_MTHDDATA
* TSEC_FALCON_MTHDID
* TSEC_FALCON_MTHDWDAT
* TSEC_FALCON_MTHDCOUNT
* TSEC_FALCON_MTHDPOP
* TSEC_FALCON_MTHDRAMSZ
* [[#TSEC_FALCON_DEBUG1|TSEC_FALCON_DEBUG1]]
=== TSEC_FALCON_SPROT_SCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Read access level
|-
| 4-7
| Write access level
|}
Controls accesses to the [[#TSEC_FALCON_SCTL|TSEC_FALCON_SCTL]] register.
=== ACL ===
=== TSEC_FALCON_SPROT_WDTMR ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bit
! Bits
! Meaning
! Description
|-
|-
| 0 || Secure key. Forced set if bit1 is set. Once cleared, cannot be set again.
| 0-3
| Read access level
|-
|-
| 1 || Secure readable. Once cleared, cannot be set again.
| 4-7
| Write access level
| 3 || Insecure readable. Forced clear if bit1 is clear. Can be toggled back and forth.
|}
|}
Controls accesses to the following registers:
* TSEC_FALCON_WDTMRVAL
* TSEC_FALCON_WDTMRCTL
=== TSEC_SCP_CTL0 ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0-7 || Start of region to authenticate (in 0x100 pages)
| 20
| Enable the [[#TSEC_SCP_CMD|TSEC_SCP_CMD]] register
|-
|-
| 8-15 || Unknown
| 16
| Enable the SEQ controller
|-
|-
| 16 || Use secret xfers
| 14
| Enable the CMD interface
|-
|-
| 17 || Region is encrypted
| 12
| Enable the STORE interface
|-
|-
| 18 || Unknown (set in HS mode)
| 10
| Enable the LOAD interface
|}
=== TSEC_SCP_CTL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
|-
| 19 || Block traps and interrupts (set in HS mode)
| 0
| Flush SEQ controller
|-
|-
| 20-23 || Unknown
| 11
| Enable RND test mode
|-
|-
| 24-31 || Size of region to authenticate (in 0x100 pages)
| 12
| Enable the RND controller
|}
|}
=== cxset ===
=== TSEC_SCP_CFG ===
{| class="wikitable" border="1"
! Bits
! Description
{| class=wikitable
! Bits || Description
|-
|-
| 0-4 || Number of instructions it is valid for (0x1f is a special value meaning infinitely many instructions -- until overriden by another cxset)
| 16-31
| Timeout value
|}
|}
==== DMA-Related Instructions ====
=== TSEC_SCP_CTL_STAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 20
| TSEC_SCP_CTL_STAT_DEBUG_MODE
|}
=== TSEC_SCP_CTL_LOCK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Enable lockdown mode
|-
| 4
| Lock SCP and RND
|}
Controls lockdown mode and can only be cleared in Heavy Secure mode.
=== TSEC_SCP_CTL_PKEY ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
|-
| 1
| TSEC_SCP_CTL_PKEY_LOADED
|}
=== TSEC_SCP_DBG0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Index
|-
| 4
| Automatic increment
|-
| 5-6
| Target
0: None
1: Unknown
2: Unknown
3: SEQ
|-
| 8-12
| SEQ size
|}
Used for debugging crypto controllers such as the SEQ (crypto sequence).
=== TSEC_SCP_DBG1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| SEQ instruction's first operand
|-
| 4-9
| SEQ instruction's second operand
|-
| 10-14
| SEQ instruction's opcode
|}
Used for retrieving debug data. Contains information on the last crypto sequence created when debugging the SEQ controller.
=== TSEC_SCP_DBG2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| SEQ state
0: Idle
1: Recording is active (cs0begin/cs1begin)
|-
| 4-7
| Number of SEQ instructions left
|-
| 12-15
| Active crypto key register
|}
Used for retrieving additional debug data associated with the SEQ controller.
=== TSEC_SCP_CMD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Destination register
|-
| 8-13
| Source register or immediate value
|-
| 20-24
| Command opcode
0x0: nop (fuc5 opcode 0x00)
0x1: cmov (fuc5 opcode 0x84)
0x2: cxsin (fuc5 opcode 0x88) or xdst (with cxset)
0x3: cxsout (fuc5 opcode 0x8C) or xdld (with cxset)
0x4: crnd (fuc5 opcode 0x90)
0x5: cs0begin (fuc5 opcode 0x94)
0x6: cs0exec (fuc5 opcode 0x98)
0x7: cs1begin (fuc5 opcode 0x9C)
0x8: cs1exec (fuc5 opcode 0xA0)
0x9: invalid (fuc5 opcode 0xA4)
0xA: cchmod (fuc5 opcode 0xA8)
0xB: cxor (fuc5 opcode 0xAC)
0xC: cadd (fuc5 opcode 0xB0)
0xD: cand (fuc5 opcode 0xB4)
0xE: crev (fuc5 opcode 0xB8)
0xF: cprecmac (fuc5 opcode 0xBC)
0x10: csecret (fuc5 opcode 0xC0)
0x11: ckeyreg (fuc5 opcode 0xC4)
0x12: ckexp (fuc5 opcode 0xC8)
0x13: ckrexp (fuc5 opcode 0xCC)
0x14: cenc (fuc5 opcode 0xD0)
0x15: cdec (fuc5 opcode 0xD4)
0x16: csigauth (fuc5 opcode 0xD8)
0x17: csigenc (fuc5 opcode 0xDC)
0x18: csigclr (fuc5 opcode 0xE0)
|-
| 28
| Set if the command is valid
|-
| 31
| Set if running in HS mode
|}
Contains information on the last crypto command executed.
=== TSEC_SCP_STAT0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| SCP is active
|-
| 2
| CMD interface is active
|-
| 6
| SEQ controller is active
|-
| 14
| AES controller is active
|-
| 16
| RND controller is active
|}
Contains the status of the crypto controllers and interfaces.
=== TSEC_SCP_STAT1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| Signature comparison result
0: None
1: Running
2: Failed
3: Succeeded
|}
Contains the status of the last authentication attempt.
=== TSEC_SCP_STAT2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-4
| Current SEQ opcode
|-
| 5-9
| Current CMD opcode
|-
| 10-14
| Pending CMD opcode
|-
| 15-16
| AES operation
0: Encryption
1: Decryption
2: Key expansion
3: Key reverse expansion
|-
| 25
| STORE operation is stalled
|-
| 26
| LOAD operation is stalled
|-
| 27
| RND operation is stalled
|-
| 29
| AES operation is stalled
|}
Contains the status of crypto operations.
=== TSEC_SCP_RND_STAT0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| RND is ready
|}
Contains the status of the RND controller.
=== TSEC_SCP_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| RND ready
|-
| 8
| ACL error
|-
| 12
| SEC error
|-
| 16
| CMD error
|-
| 20
| Single step
|-
| 24
| RND called
|-
| 28
| Timeout
|}
Used for getting the status of crypto IRQs.
=== TSEC_SCP_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| RND ready
|-
| 8
| ACL error
|-
| 12
| SEC error
|-
| 16
| CMD error
|-
| 20
| Single step
|-
| 24
| RND called
|-
| 28
| Timeout
|}
Used for getting the value of the mask for crypto IRQs.
=== TSEC_SCP_ACL_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Writing to a crypto register without the correct ACL
|-
| 4
| Reading from a crypto register without the correct ACL
|-
| 8
| Invalid ACL change (cchmod)
|-
| 31
| ACL error occurred
|}
Contains information on errors generated by the [[#TSEC_SCP_IRQSTAT|ACL error]] IRQ.
=== TSEC_SCP_CMD_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Invalid command
|-
| 4
| Empty crypto sequence
|-
| 8
| Crypto sequence is too long
|-
| 12
| Crypto sequence was not finished
|-
| 16
| Insecure signature (csigenc, csigclr or csigauth)
|-
| 20
| Invalid signature (csigauth in HS mode)
|-
| 24
| Forbidden ACL change (cchmod in NS mode)
|}
Contains information on errors generated by the [[#TSEC_SCP_IRQSTAT|CMD error]] IRQ.
=== TSEC_RND_CTL0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| RND clock trigger lower limit
|}
=== TSEC_RND_CTL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| RND clock trigger upper limit
|-
| 16-31
| RND clock trigger mask
|}
=== TSEC_TFBIF_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_CTL_CLR_BWCOUNT
|-
| 1
| TSEC_TFBIF_CTL_ENABLE
|-
| 2
| TSEC_TFBIF_CTL_CLR_IDLEWDERR
|-
| 3
| TSEC_TFBIF_CTL_RESET
|-
| 4
| TSEC_TFBIF_CTL_IDLE
|-
| 5
| TSEC_TFBIF_CTL_IDLEWDERR
|-
| 6
| TSEC_TFBIF_CTL_SRTOUT
|-
| 7
| TSEC_TFBIF_CTL_CLR_SRTOUT
|-
| 8-11
| TSEC_TFBIF_CTL_SRTOVAL
|-
| 12
| TSEC_TFBIF_CTL_VPR
|}
=== TSEC_TFBIF_MCCIF_FIFOCTRL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
|-
| 1
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
|-
| 2
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
|-
| 3
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
|-
| 4
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
|-
| 5
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
|-
| 6
| TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
|-
| 7
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
|-
| 8
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE
|}
=== TSEC_TFBIF_MCCIF_FIFOCTRL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
|-
| 16-31
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT
|}
=== TSEC_TFBIF_THROTTLE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-11
| TSEC_TFBIF_THROTTLE_BUCKET_SIZE
|-
| 16-27
| TSEC_TFBIF_THROTTLE_LEAK_COUNT
|-
| 30-31
| TSEC_TFBIF_THROTTLE_LEAK_SIZE
|}
=== TSEC_TFBIF_DBG_STAT0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_DBG_STAT0_1K_TRANSFER
|-
| 1
| TSEC_TFBIF_DBG_STAT0_RREQ_ISSUED
|-
| 2
| TSEC_TFBIF_DBG_STAT0_WREQ_ISSUED
|-
| 3
| TSEC_TFBIF_DBG_STAT0_TAGQ_ISSUED
|-
| 4
| TSEC_TFBIF_DBG_STAT0_STALL_RDATQ
|-
| 5
| TSEC_TFBIF_DBG_STAT0_STALL_RACKQ
|-
| 6
| TSEC_TFBIF_DBG_STAT0_STALL_WREQQ
|-
| 7
| TSEC_TFBIF_DBG_STAT0_STALL_WDATQ
|-
| 8
| TSEC_TFBIF_DBG_STAT0_STALL_WACKQ
|-
| 9
| TSEC_TFBIF_DBG_STAT0_STALL_RREQ_PENDING
|-
| 10
| TSEC_TFBIF_DBG_STAT0_STALL_WREQ_PENDING
|-
| 11
| TSEC_TFBIF_DBG_STAT0_STALL_MREQ
|-
| 12
| TSEC_TFBIF_DBG_STAT0_ENGINE_IDLE
|-
| 13
| TSEC_TFBIF_DBG_STAT0_RMCCIF_IDLE
|-
| 14
| TSEC_TFBIF_DBG_STAT0_WMCCIF_IDLE
|-
| 15
| TSEC_TFBIF_DBG_STAT0_CSB_IDLE
|-
| 16
| TSEC_TFBIF_DBG_STAT0_RU_IDLE
|-
| 17
| TSEC_TFBIF_DBG_STAT0_WU_IDLE
|-
| 19
| TSEC_TFBIF_DBG_STAT0_UNWEIGHT_ACTMON_ACTIVE
|-
| 20
| TSEC_TFBIF_DBG_STAT0_UNWEIGHT_ACTMON_MCB
|}
=== TSEC_TFBIF_SPROT_EMEM ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Read access level
|-
| 4-7
| Write access level
|}
Controls accesses to external memory regions. Accessible in HS mode only.
=== TSEC_TFBIF_TRANSCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_TRANSCFG_ATT0_SWID
|-
| 4
| TSEC_TFBIF_TRANSCFG_ATT1_SWID
|-
| 8
| TSEC_TFBIF_TRANSCFG_ATT2_SWID
|-
| 12
| TSEC_TFBIF_TRANSCFG_ATT3_SWID
|-
| 16
| TSEC_TFBIF_TRANSCFG_ATT4_SWID
|-
| 20
| TSEC_TFBIF_TRANSCFG_ATT5_SWID
|-
| 24
| TSEC_TFBIF_TRANSCFG_ATT6_SWID
|-
| 28
| TSEC_TFBIF_TRANSCFG_ATT7_SWID
|}
Configures the software ID per CTXDMA port for memory transactions. Software ID 0 (HW_SWID) forces all transactions to go through the SMMU while software ID 1 (PHY_SWID) bypasses it. Accessible in HS mode only.
[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.
=== TSEC_TFBIF_REGIONCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-2
| TSEC_TFBIF_REGIONCFG_T0_APERT_ID
|-
| 3
| TSEC_TFBIF_REGIONCFG_T0_VPR
|-
| 4-6
| TSEC_TFBIF_REGIONCFG_T1_APERT_ID
|-
| 7
| TSEC_TFBIF_REGIONCFG_T1_VPR
|-
| 8-10
| TSEC_TFBIF_REGIONCFG_T2_APERT_ID
|-
| 11
| TSEC_TFBIF_REGIONCFG_T2_VPR
|-
| 12-14
| TSEC_TFBIF_REGIONCFG_T3_APERT_ID
|-
| 15
| TSEC_TFBIF_REGIONCFG_T3_VPR
|-
| 16-18
| TSEC_TFBIF_REGIONCFG_T4_APERT_ID
|-
| 19
| TSEC_TFBIF_REGIONCFG_T4_VPR
|-
| 20-22
| TSEC_TFBIF_REGIONCFG_T5_APERT_ID
|-
| 23
| TSEC_TFBIF_REGIONCFG_T5_VPR
|-
| 24-26
| TSEC_TFBIF_REGIONCFG_T6_APERT_ID
|-
| 27
| TSEC_TFBIF_REGIONCFG_T6_VPR
|-
| 28-30
| TSEC_TFBIF_REGIONCFG_T7_APERT_ID
|-
| 31
| TSEC_TFBIF_REGIONCFG_T7_VPR
|}
Configures the aperture ID and VPR mode per CTXDMA port for memory region accessing. Accessible in HS mode only.
[6.0.0+] The nvhost_tsec firmware sets this register to 0x20 or 0x140 before reading memory from the GPU UCODE carveout.
=== TSEC_TFBIF_ACTMON_ACTIVE_MASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_ACTMON_ACTIVE_MASK_STARVED_MC
|-
| 1
| TSEC_TFBIF_ACTMON_ACTIVE_MASK_STALLED_MC
|-
| 2
| TSEC_TFBIF_ACTMON_ACTIVE_MASK_DELAYED_MC
|-
| 3
| TSEC_TFBIF_ACTMON_ACTIVE_MASK_ACTIVE
|}
Takes the memory access mask for the Activity Monitor. Disconnected on the TSEC, but available on NVDEC, NVENC and NVJPG.
=== TSEC_TFBIF_ACTMON_ACTIVE_BORPS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_STARVED_MC_POLARITY
|-
| 1
| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_STARVED_MC_OPERATION
|-
| 2
| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_STALLED_MC_POLARITY
|-
| 3
| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_STALLED_MC_OPERATION
|-
| 4
| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_DELAYED_MC_POLARITY
|-
| 5
| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_DELAYED_MC_OPERATION
|-
| 6
| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_ACTIVE_POLARITY
|-
| 7
| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_ACTIVE_OPERATION
|}
Takes the billions of records per second count for the Activity Monitor. Disconnected on the TSEC, but available on NVDEC, NVENC and NVJPG.
=== TSEC_TFBIF_ACTMON_ACTIVE_WEIGHT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_TFBIF_ACTMON_ACTIVE_WEIGHT_VAL
|}
Controls the Activity Monitor. Disconnected on the TSEC, but available on NVDEC, NVENC and NVJPG.
=== TSEC_CG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-5
| TSEC_CG_IDLE_CG_DLY_CNT
|-
| 6
| TSEC_CG_IDLE_CG_EN
|-
| 16-18
| TSEC_CG_WAKEUP_DLY_CNT
|-
| 19
| TSEC_CG_WAKEUP_DLY_EN
|}
=== TSEC_BAR0_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_BAR0_CTL_READ
|-
| 1
| TSEC_BAR0_CTL_WRITE
|-
| 4-7
| TSEC_BAR0_CTL_BYTE_MASK
|-
| 12-13
| TSEC_BAR0_CTL_STATUS
0: Idle
1: Busy
2: Error
3: Disabled
|-
| 31
| TSEC_BAR0_CTL_INIT
|}
A BAR0 DMA read/write operation requires bits TSEC_BAR0_CTL_INIT and TSEC_BAR0_CTL_READ/TSEC_BAR0_CTL_WRITE to be set in TSEC_BAR0_CTL.
During the transfer, TSEC_BAR0_CTL_STATUS is set to "Busy".
Accessing an invalid address sets TSEC_BAR0_CTL_STATUS to "Error".
=== TSEC_BAR0_ADDR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_BAR0_ADDR_VAL
|}
Takes the address for DMA transfers between TSEC and HOST1X (master and clients).
=== TSEC_BAR0_DATA ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_BAR0_DATA_VAL
|}
Takes the data for DMA transfers between TSEC and HOST1X (master and clients).
=== TSEC_BAR0_TIMEOUT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_BAR0_TIMEOUT_VAL
|}
Takes the timeout value for DMA transfers between TSEC and HOST1X (master and clients).
=== TSEC_TEGRA_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 16
| TSEC_TEGRA_CTL_TKFI_KFUSE
|-
| 17
| TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
|-
| 24
| TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
|-
| 25
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
|-
| 26
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
|-
| 27
| TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C
|}
== Falcon ==
"Falcon" (FAst Logic CONtroller) is a proprietary general purpose CPU which can be found inside various hardware blocks that require some sort of logic processing such as TSEC (TSECA and TSECB), NVDEC, NVENC, NVJPG, VIC, GPU PMU and XUSB.
=== Processor Registers ===
A total of 32 processor registers are available in the Falcon CPU.
==== REG0-REG15 ====
These are 16 32-bit GPRs (general purpose registers).
==== IV0 ====
This is a SPR (special purpose register) that holds the address for interrupt vector 0.
==== IV1 ====
This is a SPR (special purpose register) that holds the address for interrupt vector 1.
==== IV2 ====
This is a SPR (special purpose register) that holds the address for interrupt vector 2. This register is considered "UNDEFINED" and appears to be unused.
==== EV ====
This is a SPR (special purpose register) that holds the address for the exception vector.
Alternative name (envytools): "tv".
==== SP ====
This is a SPR (special purpose register) that holds the current stack pointer.
==== PC ====
This is a SPR (special purpose register) that holds the current program counter.
==== IMB ====
This is a SPR (special purpose register) that holds the external base address for IMEM transfers.
Alternative name (envytools): "xcbase".
==== DMB ====
This is a SPR (special purpose register) that holds the external base address for DMEM transfers.
Alternative name (envytools): "xdbase".
==== CSW ====
This is a SPR (special purpose register) that holds various flag bits.
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7 || General purpose predicates
|-
| 8 || ALU carry flag
|-
| 9 || ALU signed overflow flag
|-
| 10 || ALU sign flag
|-
| 11 || ALU zero flag
|-
| 12-15 || Unused
|-
| 16 || Interrupt 0 enable
|-
| 17 || Interrupt 1 enable
|-
| 18 || Interrupt 2 enable (undefined)
|-
| 19 || Unused
|-
| 20 || Interrupt 0 saved enable
|-
| 21 || Interrupt 1 saved enable
|-
| 22 || Interrupt 2 saved enable (undefined)
|-
| 23 || Unused
|-
| 24 || Exception active
|-
| 25 || Unused
|-
| 26 || Unknown
|-
| 27-28 || Unused
|-
| 29 || Unknown
|-
| 30-31 || Unused
|}
Alternative name (envytools): "flags".
==== CCR ====
This is a SPR (special purpose register) that holds configuration bits for the SCP DMA override functionality. The value of this register is set using the "cxset" instruction which provides a way to change the behavior of a variable amount of successively executed DMA-related instructions ("xdwait", "xdst" and "xdld").
{| class=wikitable
! Bits || Description
|-
| 0-4 || Number of instructions the override is valid for (0x1F means infinite)
|-
| 5 || Crypto destination/source select
0: Crypto register
1: Crypto stream
|-
| 6 || External memory override
0: Disabled
1: Enabled
|-
| 7 || Internal memory select
0: DMEM
1: IMEM
|-
| 8-31 || Unused
|}
Alternative name (envytools): "cx".
==== SEC ====
This is a SPR (special purpose register) that holds configuration bits for the SCP authentication process.
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7 || Start of region to authenticate (in 0x100 pages)
|-
| 8-15 || Unused
|-
| 16 || Mark all subsequent code transfers as secret
|-
| 17 || Region is encrypted
|-
| 18 || Unknown (set in HS mode)
|-
| 19 || Block traps and interrupts (set in HS mode)
|-
| 20-23 || Unused
|-
| 24-31 || Size of region to authenticate (in 0x100 pages)
|}
Alternative name (envytools): "cauth".
==== CTX ====
This is a SPR (special purpose register) that holds configuration bits for the CTXDMA ports.
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-2 || CTXDMA port for code loads (xcld)
|-
| 3 || Unused
|-
| 4-6 || CTXDMA port for code stores (invalid)
|-
| 7 || Unused
|-
| 8-10 || CTXDMA port for data loads (xdld)
|-
| 11 || Unused
|-
| 12-14 || CTXDMA port for data stores (xdst)
|-
| 15-31 || Unused
|}
Alternative name (envytools): "xtargets".
==== EXCI ====
This is a SPR (special purpose register) that holds information on raised exceptions.
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-19 || Exception PC
|-
| 20-23 || Exception cause
|-
| 24-31 || Unused
|}
Alternative name (envytools): "tstatus".
==== SEC1 ====
Unknown. Marked as "RESERVED".
==== IMB1 ====
Unknown. Marked as "RESERVED".
==== DMB1 ====
Unknown. Marked as "RESERVED".
== SCP ==
Part of the information here (which hasn't made it into envytools documentation yet) was shared by [https://wiki.0x04.net/wiki/Marcin_Ko%C5%9Bcielnicki mwk] from reverse engineering falcon processors over the years.
=== Heavy Secure Mode ===
==== Entry ====
From non-secure mode, upon jumping to a page marked as secret, a secret fault occurs. This causes the CPU to verify the region specified in $cauth against the MAC loaded in $c6. If the comparison is successful, the valid bit (bit0) is set on all pages in the $cauth region, and $pc is set to the base of the $cauth region. If the comparsion fails, the CPU is halted.
==== Exit ====
The CPU automatically goes back to non-secure mode when returning back into non-secret pages. When this happens, the valid bit (bit0) in the TLB flags is cleared for all secret pages.
==== Implementation ====
Under certain circumstances, it is possible to observe [[#sigauth|sigauth]] being briefly written to [[#TSEC_SCP_CMD|TSEC_SCP_CMD]] as "csigauth $c4 $c6" while the opcodes in [[#TSEC_SCP_STAT2|TSEC_SCP_STAT2]] are set to "cxsin" and "csigauth", respectively.
Via [[#TSEC_SCP_DBG0|TSEC_SCP_DBG0]] it can be observed that a 3-sized macro sequence is loaded into cs0 during a secure mode transition.
=== Operations ===
{| class="wikitable" border="1"
! Opcode
! Name
! Operand0
! Operand1
! Operation
! Condition
|-
| 0 || nop || N/A || N/A || ||
|-
| 1 || mov || $cX || $cY || <code>$cX = $cY; ACL(X) = ACL(Y);</code> ||
|-
| 2 || sin || $cX || N/A || <code>$cX = read_stream(); ACL(X) = ???;</code> ||
|-
| 3 || sout || $cX || N/A || <code>write_stream($cX);</code> || ?
|-
| 4 || [[#rnd|rnd]] || $cX || N/A || <code>$cX = read_rnd(); ACL(X) = ???;</code> ||
|-
| 5 || s0begin || immX || N/A || <code>record_macro_for_N_instructions(0, immX);</code> ||
|-
| 6 || s0exec || immX || N/A || <code>execute_macro_N_times(0, immX);</code> ||
|-
| 7 || s1begin || immX || N/A || <code>record_macro_for_N_instructions(1, immX);</code> ||
|-
| 8 || s1exec || immX || N/A || <code>execute_macro_N_times(1, immX);</code> ||
|-
| 9 || <invalid> || || || ||
|-
| 0xA || [[#chmod|chmod]] || $cX || immY || Complicated, see [[#ACL|ACL]]. ||
|-
| 0xB || xor || $cX || $cY || <code>$cX ^= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xC || add || $cX || immY || <code>$cX += immY;</code> || <code>(ACL(X) & 2)</code>
|-
| 0xD || and || $cX || $cY || <code>$cX &= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xE || rev || $cX || $cY || <code>$cX = endian_swap128($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0xF || gfmul || $cX || $cY || <code>$cX = gfmul($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 2)</code>
|-
| 0x10 || secret || $cX || immY || <code>$cX = load_secret(immY); ACL(X) = load_secret_acl(immY);</code> ||
|-
| 0x11 || keyreg || immX || N/A || <code>active_key_idx = immX;</code> ||
|-
| 0x12 || kexp || $cX || $cY || <code>$cX = aes_kexp($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0x13 || krexp || $cX || $cY || <code>$cX = aes_kexp_reverse($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0x14 || enc || $cX || $cY || <code>$cX = aes_enc(active_key_idx, $cY); ACL(X) = ACL(active_key_idx) & ACL(Y);</code> ||
|-
| 0x15 || dec || $cX || $cY || <code>$cX = aes_dec(active_key_idx, $cY); ACL(X) = ACL(active_key_idx) & ACL(Y);</code> ||
|-
| 0x16 || [[#sigauth|sigauth]] || $cX || $cY || <code>if (hash_verify($cX, $cY)) { has_sig = true; current_sig = $cX; }</code> || ?
|-
| 0x17 || [[#sigclr|sigclr]] || N/A || N/A || <code>has_sig = false;</code> ||
|-
| 0x18 || sigenc || $cX || $cY || <code>if (has_sig) { $cX = aes_enc($cY, current_sig); ACL(X) = 0x13; }</code> ||
|}
==== sigauth ====
<code>00000000: f5 3c XY d8 csigauth $cY $cX</code>
Takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret. This instruction does not work in secure mode.
==== sigclr ====
<code>00000000: f5 3c 00 e0 csigclr</code>
This instruction takes no operands and clears the saved cauth signature used by the csigenc instruction.
==== chmod ====
<code>00000000: f5 3c XY a8 cchmod $cY 0X</code> or <code>00000000: f5 3c XY a9 cchmod $cY 1X</code>
This instruction takes a crypto register and a 5 bit immediate value which represents the [[#ACL|ACL]] mask to set.
==== rnd ====
<code>00000000: f5 3c 0X 90 crnd $cX</code>
This instruction initializes a crypto register with random data.
Executing this instruction only succeeds if the RND interface is enabled for the SCP, which requires taking the following steps:
* Write 0x7FFF to [[#TSEC_RND_CTL0|TSEC_RND_CTL0]].
* Write 0x3FF0000 to [[#TSEC_RND_CTL1|TSEC_RND_CTL1]].
* Write 0xFF00 to TSEC_RND_CTL11.
* Write 0x1000 to [[#TSEC_SCP_CTL1|TSEC_SCP_CTL1]].
Otherwise it hangs forever.
=== ACL ===
{| class="wikitable" border="1"
! Bit
! Meaning
|-
| 0 || Secure key. Forced set if bit1 is set. Once cleared, cannot be set again.
|-
| 1 || Secure readable. Once cleared, cannot be set again.
|-
| 2 || Insecure key. Forced set if bit3 is set. Forced clear if bit0 is clear. Can be toggled back and forth.
|-
| 3 || Insecure readable. Forced clear if bit1 is clear. Can be toggled back and forth.
|-
| 4 || Insecure overwritable. Can be toggled back and forth.
|}
==== Initial values ====
On SCP boot, the ACL is 0x1F for all $cX.
Loading into $cX using xdst instruction sets ACL($cX) to 0x13 and 0x1F, for secure and insecure mode respectively.
Spilling a $cX to DMEM using xdld instruction is allowed if (ACL($cX) & 2) or (ACL($cX) & 8), for secure and insecure mode respectively.
Loading a secret into $cX sets a per-secret ACL, unconditionally.
=== Secrets ===
=== Secrets ===
Falcon's Authenticated Mode has access to 64 128-bit keys which are burned at factory. These keys can be loaded by using the $csecret instruction which takes the target crypto register and the key index as arguments.
Falcon's Heavy Secure Mode has access to 64 128-bit keys which are burned at factory. These keys can be loaded using the $csecret instruction which takes the target crypto register and the key index as arguments.
Secrets are specific to each Falcon unit with the exception of secret 0x3F. This secret is effectively empty (all zeros), but is configured to be overwritten with the KFUSE private key once the KFUSE clock is enabled. The KFUSE private key is console-unique.
{| class=wikitable
{| class=wikitable