2,782
edits
Changes
Jump to navigation
Jump to search
Line 5:
Line 5: − Registers from 0x54500000 to 0x54501000 are used to configure the host interface (HOST1X).+ − + − Registers from 0x54501000 to 0x54502000 are a MMIO window for communicating with the Falcon microprocessor. From this range, the subset of registers from 0x54501400 to 0x54501FE8 are specific to the TSEC and are subdivided into:+ − + − + − + − + − + + Line 21:
Line 22: + + + + Line 33:
Line 38: + + + + + + + + + + + + + + + + + + + + Line 45:
Line 70: + + + + Line 55:
Line 84: − + − + Line 75:
Line 104: − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + + + + + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + − + − + − + − + − + − + − + − + − + − | 0x54501248 − | 0x04 − |- − | FALCON_UNK_24C − | 0x5450124C − | 0x04 − |- − | FALCON_UNK_250 − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + + + + + + + + + + + + + + + + + Line 571:
Line 648: − + − + Line 583:
Line 660: − + − + − + − + − + − + − + − + − + + + + + Line 631:
Line 712: − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + Line 695:
Line 776: − + − + − + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Line 711:
Line 824: − + + + + + − + − + − + − + − + − + − + + + + + + + + + + + + + + + + + Line 817:
Line 950: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Line 973:
Line 1,144: + + + − − Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission. − + − + − + + + + + + + + + Line 998:
Line 1,178: − + Line 1,004:
Line 1,184: − + − + − + − + − + − + − + − + − + + + + − + Line 1,039:
Line 1,222: − + − + − + − + − + − + − + − + − + + + + − + Line 1,074:
Line 1,260: − + − + − + − + − + − + − + − + − + + + + − + Line 1,109:
Line 1,298: − + − + − + − + − + − + − + − + − + + + + − + Line 1,144:
Line 1,336: − + − + − + − + − + − + − + − + − + + + + − + Line 1,179:
Line 1,374: − + − + − + − + − + − + − + − + − + + + + − + Line 1,214:
Line 1,412: − + − + − + − + − + − + − + − + − + + + + − + Line 1,249:
Line 1,450: − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − Scratch register for reading/writing data to Falcon. − − === FALCON_MAILBOX1 === − Scratch register for reading/writing data to Falcon. − − === FALCON_ITFEN === Line 1,317:
Line 1,512: − + − + − + − + − + − + − | FALCON_IDLESTATE_FALCON_BUSY+ − |- − | 1-15 − − Used for detecting if Falcon is busy or not.+ − + − + − + − |- − | 16 − | FALCON_DEBUG1_CTXSW_MODE − === FALCON_DEBUGINFO ===+ − Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8. − − [6.0.0+] [[NV_services|nvservices]] sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware. − + − + − + − + − + − 0x00: Trap 0 − 0x01: Trap 1 − 0x02: Trap 2 − 0x03: Trap 3 − 0x08: Invalid opcode − 0x09: Authentication entry − 0x0A: Page fault (no hit) − 0x0B: Page fault (multi hit) − 0x0F: Breakpoint − Contains information about raised exceptions.+ − + Line 1,385:
Line 1,562: − + − + − | FALCON_CPUCTL_STARTCPU+ − |- − | 2 − | FALCON_CPUCTL_SRESET − |- − | 3 − | FALCON_CPUCTL_HRESET − |- − − | FALCON_CPUCTL_HALTED − |- − | 5 − | FALCON_CPUCTL_STOPPED − |- − | 6 − | FALCON_CPUCTL_CPUCTL_ALIAS_EN − + − − === FALCON_BOOTVEC === − Takes the Falcon's boot vector address. − + − + − + − + − + − + − + + + + + + + − + − + − + + + + + − + − + − + − + − |-+ − | 2+ − | FALCON_DMACTL_IMEM_SCRUBBING+ − |-+ − | 3-6+ − | FALCON_DMACTL_DMAQ_NUM+ − |-+ − | 7+ − | FALCON_DMACTL_SECURE_STAT+ − Used for configuring the Falcon's DMA engine.+ − + − Base address of the external memory buffer, shifted right by 8.+ + + + + + + − The current transfer address is calculated by adding [[#FALCON_DMATRFFBOFFS|FALCON_DMATRFFBOFFS]] to the base.+ + − + − For transfers to DMEM: the destination address.+ − For transfers to IMEM: the destination virtual IMEM page. − + Line 1,467:
Line 1,642: − + − + − + − + + + + − + − + − + − + + + + + + + + + − + − + − Used for configuring DMA transfers.+ − − === FALCON_DMATRFFBOFFS === − For transfers to IMEM: the destination physical IMEM page. − + − + − + − + − + − + − + − + − | FALCON_DMAPOLL_FB_CFG_W_FENCE+ − |- − | 16-23 − | FALCON_DMAPOLL_FB_WCOUNT − |- − | 24-31 − − Contains the status of a DMA transfer between the Falcon and external memory.+ − − Line 1,525:
Line 1,700: − + − + − + − + − + − + − + − + − |- − | 24-31 − | FALCON_DMAPOLL_CP_RCOUNT − Contains the status of a DMA transfer between the Falcon and the SCP.+ − + − + − | FALCON_HWCFG1_CORE_REV+ − |- − | 4-5 − | FALCON_HWCFG1_SECURITY_MODEL − |- − | 6-7 − | FALCON_HWCFG1_CORE_REV_SUBVERSION − |- − | 8-11 − | FALCON_HWCFG1_IMEM_PORTS − |- − | 12-15 − | FALCON_HWCFG1_DMEM_PORTS − |- − | 16-20 − | FALCON_HWCFG1_TAG_WIDTH − |- − | 27 − | FALCON_HWCFG1_DBG_PRIV_BUS − |- − | 28 − | FALCON_HWCFG1_CSB_SIZE_16M − |- − | 29 − | FALCON_HWCFG1_PRIV_DIRECT − |- − | 30 − | FALCON_HWCFG1_DMEM_APERTURES − |- − | 31 − − + + + + + − + − + − |-+ − | 24-26 − | Command − 0x00: NOP − 0x01: IMINV (ITLB) − 0x02: IMBLK (PTLB) − 0x03: IMTAG (VTLB) − − Controls the Falcon TLB.+ − + − === FALCON_IMSTAT === − Returns the result of the last command from [[#FALCON_IMCTL|FALCON_IMCTL]]. − + − + − + + + + + + + + + + + + + − + − + − + − + − Controls the index for tracing with [[#FALCON_TRACEPC|FALCON_TRACEPC]].+ − − === FALCON_TRACEPC === − Returns the PC of the last call or branch executed. − + − + − + − + − | 8-15+ − | IMEM block to read/write+ + + + + + − + − + − + − + − + − + − + − + − + − + − + − + − Used for configuring access to Falcon's IMEM.+ − + − Returns or takes the value for an IMEM read/write operation. − − === FALCON_IMEMT === − Returns or takes the virtual page index for an IMEM read/write operation. − − === FALCON_DMEMC0 === − + − + + + + − + − + − + − + − + − + − + + + + − Used for configuring access to Falcon's DMEM.+ − − === FALCON_DMEMD0 === − Returns or takes the value for a DMEM read/write operation. − + Line 1,692:
Line 1,840: − + − 0x00: STOP+ − 0x01: RUN (run from PC)+ − 0x02: JRUN (run from address)+ − 0x03: RUNB (run from PC) − 0x04: JRUNB (run from address) − 0x05: STEP (step from PC) − 0x06: JSTEP (step from address) − 0x07: EMASK (set exception mask) − 0x08: RREG (read register) − 0x09: WREG (write register) − 0x0A: RDM (read data memory) − 0x0B: WDM (write data memory) − 0x0C: RCM (read code memory) − 0x0D: WCM (write code memory) − 0x0E: RSTAT (read status) − 0x0F: SBU − + − 0x00: B (byte+ − 0x01: HW (half word)+ − 0x02: W (word)+ + + + − + − + − 0x00: REG0 | RSTAT0 | WB0+ − 0x01: REG1 | RSTAT1 | WB1+ − 0x02: REG2 | RSTAT2 | WB2+ − 0x03: REG3 | RSTAT3 | WB3 − 0x04: REG4 | RSTAT4 − 0x05: REG5 | RSTAT5 − 0x06: REG6 − 0x07: REG7 − 0x08: REG8 − 0x09: REG9 − 0x0A: REG10 − 0x0B: REG11 − 0x0C: REG12 − 0x0D: REG13 − 0x0E: REG14 − 0x0F: REG15 − 0x10: IV0 − 0x11: IV1 − 0x12: UNDEFINED − 0x13: EV − 0x14: SP − 0x15: PC − 0x16: IMB − 0x17: DMB − 0x18: CSW − 0x19: CCR − 0x1A: SEC − 0x1B: CTX − 0x1C: EXCI − + − + − + − + − + − + − 0x0001: EMASK_TRAP0+ − 0x0002: EMASK_TRAP1+ − 0x0004: EMASK_TRAP2+ − 0x0008: EMASK_TRAP3 − 0x0010: EMASK_EXC_UNIMP − 0x0020: EMASK_EXC_IMISS − 0x0040: EMASK_EXC_IMHIT − 0x0080: EMASK_EXC_IBREAK − 0x0100: EMASK_IV0 − 0x0200: EMASK_IV1 − 0x0400: EMASK_IV2 − 0x0800: EMASK_EXT0 − 0x1000: EMASK_EXT1 − 0x2000: EMASK_EXT2 − 0x4000: EMASK_EXT3 − 0x8000: EMASK_EXT4 − Used for sending commands to the Falcon's in-chip debugger.+ − − − Takes the target address for the Falcon's in-chip debugger. − − === FALCON_ICD_WDATA === − Takes the data for writing using the Falcon's in-chip debugger. − − === FALCON_ICD_RDATA === − Returns the data read using the Falcon's in-chip debugger. − − When reading from an internal status register (STAT), the following applies: − + − + − + − | RSTAT0_DMA_STALL+ + + + + + + + + + + + + + − + − + + + + + + + + + − + − + − + − + − + − + + + + + + + + + − + − + + + + + + + + + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + + + + + + + + + − + − + + + + + + + + + − + − + + + + + + + + + − + − + − + − + − + − + − + − + − + − | 29+ − | RSTAT0_WAITING+ − + − | 30+ − | RSTAT0_HALTED+ + + − + − + + + + + Line 1,867:
Line 2,022: − + − |-+ − | 4-7+ − | RSTAT1_WB_VALID+ − |-+ − | 8-9+ − | RSTAT1_WB0_SZ+ + + + + + + + + + + − + − + + + + − + − + − + − + − + − + − + − + − |-+ − | 20-23+ − | RSTAT1_WB1_IDX+ + + + + + + + + + + + + + + + + + + + + + + + − + − + − + − + − |} − {| class="wikitable" border="1" − ! Bits − ! Description − + − + + + + + + + + + + + + + + + + + + + + + + + + + − + − + + + + + + + + + − + − + + + + + + + + + − + − | RSTAT2_EM_BUSY+ − |- − | 20-23 − | RSTAT2_EM_ACKED − |- − | 24-27 − | RSTAT2_EM_ISWR − |- − | 28-31 − + + + + Line 1,926:
Line 2,148: − + − + − + − + − + − + − + − + − + − + − + − + − 0x00: IDLE − 0x01: SM_CHECK − 0x02: SM_SAVE − 0x03: SM_SAVE_WAIT − 0x04: SM_BLK_BIND − 0x05: SM_RESET − 0x06: SM_RESETWAIT − 0x07: SM_ACK − + − + − + − + − + − + − + − + + + + + + + + + + − + − + − + + + + + + + + + + − + − + − + − + Line 1,991:
Line 2,223: − + − + − 0x00: NORMAL − 0x01: WAIT_ISSUE_CLEAR − 0x02: WAIT_EXLDQ_CLEAR − 0x03: FULL_DBG_MODE − + − + − 0x00: SUPPRESSICD − 0x01: ENTERICD_IBRK − 0x02: ENTERICD_STEP − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + + + + + − + − + − + − + − + − + − + − + − + − + − + − + − + − | RSTAT4_ICD_EMASK_EXT3+ − |- − | 31 − Line 2,056:
Line 2,282: − + − + − + − + − === FALCON_SCTL ===+ − {| class="wikitable" border="1" − ! Bits − ! Description − + − + − 0: Non-secure − 1: Light Secure − 2: Heavy Secure − + − + − 0: Non-secure − 1: Light Secure − 2: Heavy Secure − + − + − + − + − |} − − === FALCON_SCTL_STAT === − {| class="wikitable" border="1" − ! Bits − ! Description − + − + − |} − − === FALCON_SPROT_IMEM === − {| class="wikitable" border="1" − ! Bits − ! Description − + − + − + − + − |}+ − + − Controls accesses to Falcon IMEM.+ − + − === FALCON_SPROT_DMEM ===+ − {| class="wikitable" border="1"+ − ! Bits+ − ! Description+ − + − + − + − + − |} − − Controls accesses to Falcon DMEM. − − === FALCON_SPROT_CPUCTL === − {| class="wikitable" border="1" − ! Bits − ! Description − + − + − + − + − + − + − Controls accesses to the [[#FALCON_CPUCTL|FALCON_CPUCTL]] register.+ − + − === FALCON_SPROT_MISC ===+ − {| class="wikitable" border="1"+ − ! Bits+ − ! Description+ + − + − + − + − + − − Controls accesses to the following registers: − * FALCON_PRIVSTATE − * FALCON_SFTRESET − * FALCON_ADDR − * [[#FALCON_DMACTL|FALCON_DMACTL]] − * [[#FALCON_IMCTL|FALCON_IMCTL]] − * [[#FALCON_IMSTAT|FALCON_IMSTAT]] − * FALCON_UNK_250 − * FALCON_UNK_2E0 − − === FALCON_SPROT_IRQ === − + − + + + + + − + − + − |}+ − + − Controls accesses to the following registers:+ − * [[#FALCON_IRQMODE|FALCON_IRQMODE]] − * [[#FALCON_IRQMSET|FALCON_IRQMSET]] − * [[#FALCON_IRQMCLR|FALCON_IRQMCLR]] − * [[#FALCON_IRQDEST|FALCON_IRQDEST]] − * FALCON_GPTMRINT − * FALCON_GPTMRVAL − * FALCON_GPTMRCTL − * FALCON_UNK_3C − * FALCON_UNK_E0 − − === FALCON_SPROT_MTHD === − {| class="wikitable" border="1" − ! Bits − ! Description − + − + − + − + − |} − − Controls accesses to the following registers: − * [[#FALCON_ITFEN|FALCON_ITFEN]] − * FALCON_CURCTX − * FALCON_NXTCTX − * FALCON_CTXACK − * FALCON_MTHDDATA − * FALCON_MTHDID − * FALCON_MTHDWDAT − * FALCON_MTHDCOUNT − * FALCON_MTHDPOP − * FALCON_MTHDRAMSZ − * [[#FALCON_DEBUG1|FALCON_DEBUG1]] − − === FALCON_SPROT_SCTL === − {| class="wikitable" border="1" − ! Bits − ! Description − + − + − + − + − |} − − Controls accesses to the [[#FALCON_SCTL|FALCON_SCTL]] register. − − === FALCON_SPROT_WDTMR === − {| class="wikitable" border="1" − ! Bits − ! Description − + − + − + − + − |} − − Controls accesses to the following registers: − * FALCON_WDTMRVAL − * FALCON_WDTMRCTL − − === TSEC_SCP_CTL0 === − {| class="wikitable" border="1" − ! Bits − ! Description − + − + − + − + − === TSEC_SCP_CTL1 ===+ − {| class="wikitable" border="1"+ − ! Bits+ − ! Description+ + + + + + + + + + + + + + + + − + − + − + − + − − === TSEC_SCP_CTL_STAT === − + − + − + − + − + + + + − + − | Disable reads for the TFBIF register block+ + + + − + − + − + − + − |- − | 4 − | Disable writes for the SCP and TRNG register blocks − |- − | 5 − | Disable writes for the TFBIF register block − |- − | 6 − | Disable writes for the DMA register block − |- − | 7 − | Disable writes for the TEGRA register block − Locks accesses to sub-engines and can only be cleared in Heavy Secure mode.+ − − − + − + + + + + + + − + − + + + + − + + + Line 2,315:
Line 2,470: − + − + − |- − | 8-11 − | Sequence's size − + − + Line 2,332:
Line 2,484: − + − + − + − |- − | 10-14 − | Sequence instruction's opcode − Contains information on the last crypto sequence (cs0 or cs1) created.+ − + − + − + − + − |- − | 12-15 − | Active crypto key register − Contains information on the last crypto sequence (cs0 or cs1) executed.+ + + + + + + + + − + Line 2,366:
Line 2,520: − + − + − + + + + + + + + + + + + + + + + + + + + + − + − + − 0x0: nop (fuc5 opcode 0x00) + − 0x1: cmov (fuc5 opcode 0x84)+ − 0x2: cxsin (fuc5 opcode 0x88) or xdst (with cxset)+ − 0x3: cxsout (fuc5 opcode 0x8C) or xdld (with cxset) + − 0x4: crnd (fuc5 opcode 0x90)+ − 0x5: cs0begin (fuc5 opcode 0x94)+ − 0x6: cs0exec (fuc5 opcode 0x98)+ − 0x7: cs1begin (fuc5 opcode 0x9C)+ − 0x8: cs1exec (fuc5 opcode 0xA0)+ − 0x9: invalid (fuc5 opcode 0xA4)+ − 0xA: cchmod (fuc5 opcode 0xA8)+ − 0xB: cxor (fuc5 opcode 0xAC)+ − 0xC: cadd (fuc5 opcode 0xB0)+ − 0xD: cand (fuc5 opcode 0xB4)+ − 0xE: crev (fuc5 opcode 0xB8)+ − 0xF: cprecmac (fuc5 opcode 0xBC)+ − 0x10: csecret (fuc5 opcode 0xC0)+ − 0x11: ckeyreg (fuc5 opcode 0xC4)+ − 0x12: ckexp (fuc5 opcode 0xC8)+ − 0x13: ckrexp (fuc5 opcode 0xCC) − 0x14: cenc (fuc5 opcode 0xD0) − 0x15: cdec (fuc5 opcode 0xD4) − 0x16: csigauth (fuc5 opcode 0xD8) − 0x17: csigenc (fuc5 opcode 0xDC) − 0x18: csigclr (fuc5 opcode 0xE0) − + − + − + − + − Contains information on the last crypto instruction executed.+ − + − + − + + + + − Contains information on the last authentication attempt.+ + + − + − + − + − + − + − + − + − 0: Encryption+ − 1: Decryption+ − 2: Key expansion+ − 3: Key reverse expansion+ + + − Contains information on the last AES sequence executed.+ − − Line 2,446:
Line 2,619: − + − + − + − + − |- − | 16 − | TSEC_SCP_IRQSTAT_INSN_ERROR − |- − | 20 − | TSEC_SCP_IRQSTAT_SINGLE_STEP − |- − | 24 − | Unknown − |- − | 28 − | Unknown − Used for getting the status of crypto IRQs.+ − − − + − | TSEC_SCP_IRQMASK_TRNG+ − |-+ − + − | TSEC_SCP_IRQMASK_ACL_ERROR+ − + − | 12+ − | Unknown+ − − | 16 − | TSEC_SCP_IRQMASK_INSN_ERROR − + − |- − | 24 − | Unknown − |- − | 28 − | Unknown − Used for getting the value of the mask for crypto IRQs.+ − − Line 2,504:
Line 2,652: − + − + − |- − | 8 − | Set on an invalid ACL change (cchmod) − |- − | 31 − | An ACL error occurred − Contains information on the status generated by the [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT_ACL_ERROR]] IRQ.+ − + Line 2,524:
Line 2,666: − + − + − + − + − + − | Crypto sequence is too long+ + + + − + − + − + − + − + − + + + + + − + − + − Contains information on crypto errors generated by the [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT_INSN_ERROR]] IRQ.+ − + − + − + − + − + − + − + + + + + + + + + − + − + + + − + − + − + − | TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST+ − |- − | 6 − | TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE − |- − | 7 − | TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE − |- − − | TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE − === TSEC_TFBIF_MCCIF_FIFOCTRL1 ===+ − {| class="wikitable" border="1" − ! Bits − ! Description − |- − | 0-15 − | TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT − |- − | 16-31 − | TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT − |} − + Line 2,598:
Line 2,738: − + − + − + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + − Controls accesses to external memory at the MMU level. Accessible in HS mode only.+ − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + − Controls MMU bypass mode. Accessible in HS mode only.+ − [6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.+ + − === TSEC_TFBIF_MMU_TRANSCFG === − + − − + − − + − − + − − + − − + − − + − − + − − Controls external memory transfers' configuration at the MMU level. Accessible in HS mode only.+ − − [6.0.0+] The nvhost_tsec firmware sets this register to 0x20 or 0x140 before reading memory from the GPU UCODE carveout. − − === TSEC_TFBIF_ACTMON_MAMASK === − Takes the memory access mask for the Activity Monitor. Disconnected on the TSEC, but available on NVDEC, NVENC and NVJPG. − − === TSEC_TFBIF_ACTMON_BORPS === − Takes the billions of records per second count for the Activity Monitor. Disconnected on the TSEC, but available on NVDEC, NVENC and NVJPG. − − === TSEC_TFBIF_ACTMON_CTL === − Controls the Activity Monitor. Disconnected on the TSEC, but available on NVDEC, NVENC and NVJPG. − + − {| class="wikitable" border="1"+ − ! Bits − ! Description − |- − | 0-5 − | TSEC_CG_IDLE_CG_DLY_CNT − |- − | 6 − | TSEC_CG_IDLE_CG_EN − |- − | 16-18 − | TSEC_CG_WAKEUP_DLY_CNT − |- − | 19 − | TSEC_CG_WAKEUP_DLY_EN − |} − === TSEC_BAR0_CTL === − + − − + − − + − | TSEC_BAR0_CTL_BYTE_MASK − |- − | 12-13 − − 0: Idle − 1: Busy − 2: Error − 3: Disabled − |- − | 31 − − A BAR0 DMA read/write operation requires bits TSEC_BAR0_CTL_INIT and TSEC_BAR0_CTL_READ/TSEC_BAR0_CTL_WRITE to be set in TSEC_BAR0_CTL.+ − During the transfer, TSEC_BAR0_CTL_STATUS is set to "Busy".+ + − Accessing an invalid address sets TSEC_BAR0_CTL_STATUS to "Error".+ + − + − Takes the address for DMA transfers between TSEC and HOST1X (master and clients).+ − − === TSEC_BAR0_DATA === − Takes the data for DMA transfers between TSEC and HOST1X (master and clients). − − === TSEC_BAR0_TIMEOUT === − Takes the timeout value for DMA transfers between TSEC and HOST1X (master and clients). − − === TSEC_TEGRA_CTL === − {| class="wikitable" border="1" − ! Bits − ! Description − |- − | 16 − | TSEC_TEGRA_CTL_TKFI_KFUSE − |- − | 17 − | TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE − |- − | 24 − | TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C − |- − | 25 − | TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X − |- − | 26 − | TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB − |- − | 27 − | TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C − |} − + Line 2,776:
Line 3,632: − + − + Line 2,797:
Line 3,653: − + Line 2,809:
Line 3,665: − + Line 2,833:
Line 3,689: − + − + − + − + − + − + − + − + − + − + − + − + Line 2,892:
Line 3,748: − − === cauth === − $cauth is a special purpose register in the CPU. − − {| class="wikitable" border="1" − ! Bits − ! Description − |- − | 0-7 || Start of region to authenticate (in 0x100 pages) − |- − | 8-15 || Unknown − |- − | 16 || Use secret xfers − |- − | 17 || Region is encrypted − |- − | 18 || Unknown (set in HS mode) − |- − | 19 || Block traps and interrupts (set in HS mode) − |- − | 20-23 || Unknown − |- − | 24-31 || Size of region to authenticate (in 0x100 pages) − |} − − === cxset === − cxset instruction provides a way to change behavior of a variable amount of successively executed DMA-related instructions. − − for example: <code>000000de: f4 3c 02 cxset 0x2</code> − − can be read as: <code>dma_override(type=crypto_reg, count=2)</code> − − The argument to cxset specifies the type of behavior change in the top 3 bits, and the number of DMA-related instructions the effect lasts for in the lower 5 bits. − − {| class=wikitable − ! Bits || Description − |- − | 0-4 || Number of instructions it is valid for (0x1f is a special value meaning infinitely many instructions -- until overriden by another cxset) − |- − | 5 || Crypto destination/source select (0=crypto register, 1=crypto stream) − |- − | 6 || External memory override (0=Disabled, 1=Enabled) − |- − | 7 || Internal memory select (0=DMEM, 1=IMEM) − |} − − ==== DMA-Related Instructions ==== − At least the following instructions may have changed behavior, and count against the cxset "count" argument: <code>xdwait</code>, <code>xdst</code>, <code>xdld</code>. − − For example, if override type=0b000, then the "length" argument to <code>xdst</code> is instead treated as the index of the target $cX register. − +
no edit summary
== Registers ==
== Registers ==
The TSEC's MMIO space is divided as follows:
* 0x54500000 to 0x54501000: THI (Tegra Host Interface)
* 0x54501000 to 0x54501400: [[#Falcon|FALCON (Falcon microcontroller)]]
* 0x54501400 to 0x54501500: SCP (Secure Co-Processor).
* 0x54501400 to 0x54501500: [[#SCP|SCP (Secure Co-processor)]]
* 0x54501500 to 0x54501600: TRNG (True Random Number Generator).
* 0x54501500 to 0x54501600: RND (Random Number Generator)
* 0x54501600 to 0x54501700: TFBIF (Tegra Framebuffer Interface) and CG (Clock Gate).
* 0x54501600 to 0x54501680: TFBIF (Tegra Framebuffer Interface)
* 0x54501700 to 0x54501800: BAR0.
* 0x54501680 to 0x54501700: CG (Clock Gate)
* 0x54501800 to 0x54501900: TEGRA (miscellaneous interfaces).
* 0x54501700 to 0x54501800: BAR0 (HOST1X device DMA)
* 0x54501800 to 0x54501900: TEGRA (Miscellaneous interfaces)
{| class="wikitable" border="1"
{| class="wikitable" border="1"
| TSEC_THI_INCR_SYNCPT
| TSEC_THI_INCR_SYNCPT
| 0x54500000
| 0x54500000
| 0x04
|-
| TSEC_THI_INCR_SYNCPT_CTRL
| 0x54500004
| 0x04
| 0x04
|-
|-
| TSEC_THI_CTXSW
| TSEC_THI_CTXSW
| 0x54500020
| 0x54500020
| 0x04
|-
| TSEC_THI_CTXSW_NEXT
| 0x54500024
| 0x04
| 0x04
|-
|-
| TSEC_THI_CONT_SYNCPT_EOF
| TSEC_THI_CONT_SYNCPT_EOF
| 0x54500028
| 0x54500028
| 0x04
|-
| TSEC_THI_CONT_SYNCPT_L1
| 0x5450002C
| 0x04
|-
| TSEC_THI_STREAMID0
| 0x54500030
| 0x04
|-
| TSEC_THI_STREAMID1
| 0x54500034
| 0x04
|-
| TSEC_THI_THI_SEC
| 0x54500038
| 0x04
| 0x04
|-
|-
| [[#TSEC_THI_METHOD1|TSEC_THI_METHOD1]]
| [[#TSEC_THI_METHOD1|TSEC_THI_METHOD1]]
| 0x54500044
| 0x54500044
| 0x04
|-
| TSEC_THI_CONTEXT_SWITCH
| 0x54500060
| 0x04
| 0x04
|-
|-
| 0x04
| 0x04
|-
|-
| TSEC_THI_INT_CLEAR
| TSEC_THI_CONFIG0
| 0x54500080
| 0x54500080
| 0x04
| 0x04
|-
|-
| TSEC_THI_INT_ENABLE
| TSEC_THI_DBG_MISC
| 0x54500084
| 0x54500084
| 0x04
| 0x04
| 0x04
| 0x04
|-
|-
| [[#FALCON_IRQSSET|FALCON_IRQSSET]]
| [[#TSEC_FALCON_IRQSSET|TSEC_FALCON_IRQSSET]]
| 0x54501000
| 0x54501000
| 0x04
| 0x04
|-
|-
| [[#FALCON_IRQSCLR|FALCON_IRQSCLR]]
| [[#TSEC_FALCON_IRQSCLR|TSEC_FALCON_IRQSCLR]]
| 0x54501004
| 0x54501004
| 0x04
| 0x04
|-
|-
| [[#FALCON_IRQSTAT|FALCON_IRQSTAT]]
| [[#TSEC_FALCON_IRQSTAT|TSEC_FALCON_IRQSTAT]]
| 0x54501008
| 0x54501008
| 0x04
| 0x04
|-
|-
| [[#FALCON_IRQMODE|FALCON_IRQMODE]]
| [[#TSEC_FALCON_IRQMODE|TSEC_FALCON_IRQMODE]]
| 0x5450100C
| 0x5450100C
| 0x04
| 0x04
|-
|-
| [[#FALCON_IRQMSET|FALCON_IRQMSET]]
| [[#TSEC_FALCON_IRQMSET|TSEC_FALCON_IRQMSET]]
| 0x54501010
| 0x54501010
| 0x04
| 0x04
|-
|-
| [[#FALCON_IRQMCLR|FALCON_IRQMCLR]]
| [[#TSEC_FALCON_IRQMCLR|TSEC_FALCON_IRQMCLR]]
| 0x54501014
| 0x54501014
| 0x04
| 0x04
|-
|-
| [[#FALCON_IRQMASK|FALCON_IRQMASK]]
| [[#TSEC_FALCON_IRQMASK|TSEC_FALCON_IRQMASK]]
| 0x54501018
| 0x54501018
| 0x04
| 0x04
|-
|-
| [[#FALCON_IRQDEST|FALCON_IRQDEST]]
| [[#TSEC_FALCON_IRQDEST|TSEC_FALCON_IRQDEST]]
| 0x5450101C
| 0x5450101C
| 0x04
| 0x04
|-
|-
| FALCON_GPTMRINT
| TSEC_FALCON_GPTMRINT
| 0x54501020
| 0x54501020
| 0x04
| 0x04
|-
|-
| FALCON_GPTMRVAL
| TSEC_FALCON_GPTMRVAL
| 0x54501024
| 0x54501024
| 0x04
| 0x04
|-
|-
| FALCON_GPTMRCTL
| TSEC_FALCON_GPTMRCTL
| 0x54501028
| 0x54501028
| 0x04
| 0x04
|-
|-
| FALCON_PTIMER0
| TSEC_FALCON_PTIMER0
| 0x5450102C
| 0x5450102C
| 0x04
| 0x04
|-
|-
| FALCON_PTIMER1
| TSEC_FALCON_PTIMER1
| 0x54501030
| 0x54501030
| 0x04
| 0x04
|-
|-
| FALCON_WDTMRVAL
| TSEC_FALCON_WDTMRVAL
| 0x54501034
| 0x54501034
| 0x04
| 0x04
|-
|-
| FALCON_WDTMRCTL
| TSEC_FALCON_WDTMRCTL
| 0x54501038
| 0x54501038
| 0x04
| 0x04
|-
|-
| FALCON_UNK_3C
| [[#TSEC_FALCON_IRQDEST2|TSEC_FALCON_IRQDEST2]]
| 0x5450103C
| 0x5450103C
| 0x04
| 0x04
|-
|-
| [[#FALCON_MAILBOX0|FALCON_MAILBOX0]]
| [[#TSEC_FALCON_MAILBOX0|TSEC_FALCON_MAILBOX0]]
| 0x54501040
| 0x54501040
| 0x04
| 0x04
|-
|-
| [[#FALCON_MAILBOX1|FALCON_MAILBOX1]]
| [[#TSEC_FALCON_MAILBOX1|TSEC_FALCON_MAILBOX1]]
| 0x54501044
| 0x54501044
| 0x04
| 0x04
|-
|-
| [[#FALCON_ITFEN|FALCON_ITFEN]]
| [[#TSEC_FALCON_ITFEN|TSEC_FALCON_ITFEN]]
| 0x54501048
| 0x54501048
| 0x04
| 0x04
|-
|-
| [[#FALCON_IDLESTATE|FALCON_IDLESTATE]]
| [[#TSEC_FALCON_IDLESTATE|TSEC_FALCON_IDLESTATE]]
| 0x5450104C
| 0x5450104C
| 0x04
| 0x04
|-
|-
| FALCON_CURCTX
| TSEC_FALCON_CURCTX
| 0x54501050
| 0x54501050
| 0x04
| 0x04
|-
|-
| FALCON_NXTCTX
| TSEC_FALCON_NXTCTX
| 0x54501054
| 0x54501054
| 0x04
| 0x04
|-
|-
| FALCON_CTXACK
| TSEC_FALCON_CTXACK
| 0x54501058
| 0x54501058
| 0x04
| 0x04
|-
|-
| FALCON_FHSTATE
| TSEC_FALCON_FHSTATE
| 0x5450105C
| 0x5450105C
| 0x04
| 0x04
|-
|-
| FALCON_PRIVSTATE
| TSEC_FALCON_PRIVSTATE
| 0x54501060
| 0x54501060
| 0x04
| 0x04
|-
|-
| FALCON_MTHDDATA
| TSEC_FALCON_MTHDDATA
| 0x54501064
| 0x54501064
| 0x04
| 0x04
|-
|-
| FALCON_MTHDID
| TSEC_FALCON_MTHDID
| 0x54501068
| 0x54501068
| 0x04
| 0x04
|-
|-
| FALCON_MTHDWDAT
| TSEC_FALCON_MTHDWDAT
| 0x5450106C
| 0x5450106C
| 0x04
| 0x04
|-
|-
| FALCON_MTHDCOUNT
| TSEC_FALCON_MTHDCOUNT
| 0x54501070
| 0x54501070
| 0x04
| 0x04
|-
|-
| FALCON_MTHDPOP
| TSEC_FALCON_MTHDPOP
| 0x54501074
| 0x54501074
| 0x04
| 0x04
|-
|-
| FALCON_MTHDRAMSZ
| TSEC_FALCON_MTHDRAMSZ
| 0x54501078
| 0x54501078
| 0x04
| 0x04
|-
|-
| FALCON_SFTRESET
| TSEC_FALCON_SFTRESET
| 0x5450107C
| 0x5450107C
| 0x04
| 0x04
|-
|-
| FALCON_OS
| TSEC_FALCON_OS
| 0x54501080
| 0x54501080
| 0x04
| 0x04
|-
|-
| FALCON_RM
| TSEC_FALCON_RM
| 0x54501084
| 0x54501084
| 0x04
| 0x04
|-
|-
| FALCON_SOFT_PM
| TSEC_FALCON_SOFT_PM
| 0x54501088
| 0x54501088
| 0x04
| 0x04
|-
|-
| FALCON_SOFT_MODE
| TSEC_FALCON_SOFT_MODE
| 0x5450108C
| 0x5450108C
| 0x04
| 0x04
|-
|-
| [[#FALCON_DEBUG1|FALCON_DEBUG1]]
| [[#TSEC_FALCON_DEBUG1|TSEC_FALCON_DEBUG1]]
| 0x54501090
| 0x54501090
| 0x04
| 0x04
|-
|-
| [[#FALCON_DEBUGINFO|FALCON_DEBUGINFO]]
| [[#TSEC_FALCON_DEBUGINFO|TSEC_FALCON_DEBUGINFO]]
| 0x54501094
| 0x54501094
| 0x04
| 0x04
|-
|-
| FALCON_IBRKPT1
| TSEC_FALCON_IBRKPT1
| 0x54501098
| 0x54501098
| 0x04
| 0x04
|-
|-
| FALCON_IBRKPT2
| TSEC_FALCON_IBRKPT2
| 0x5450109C
| 0x5450109C
| 0x04
| 0x04
|-
|-
| FALCON_CGCTL
| TSEC_FALCON_CGCTL
| 0x545010A0
| 0x545010A0
| 0x04
| 0x04
|-
|-
| FALCON_ENGCTL
| TSEC_FALCON_ENGCTL
| 0x545010A4
| 0x545010A4
| 0x04
| 0x04
|-
|-
| FALCON_PMM
| TSEC_FALCON_PMM
| 0x545010A8
| 0x545010A8
| 0x04
| 0x04
|-
|-
| FALCON_ADDR
| TSEC_FALCON_ADDR
| 0x545010AC
| 0x545010AC
| 0x04
| 0x04
|-
|-
| FALCON_IBRKPT3
| TSEC_FALCON_IBRKPT3
| 0x545010B0
| 0x545010B0
| 0x04
| 0x04
|-
|-
| FALCON_IBRKPT4
| TSEC_FALCON_IBRKPT4
| 0x545010B4
| 0x545010B4
| 0x04
| 0x04
|-
|-
| FALCON_IBRKPT5
| TSEC_FALCON_IBRKPT5
| 0x545010B8
| 0x545010B8
| 0x04
| 0x04
|-
|-
| [[#FALCON_EXCI|FALCON_EXCI]]
| [[#TSEC_FALCON_EXCI|TSEC_FALCON_EXCI]]
| 0x545010D0
| 0x545010D0
| 0x04
| 0x04
|-
|-
| FALCON_UNK_D4
| [[#TSEC_FALCON_SVEC_SPR|TSEC_FALCON_SVEC_SPR]]
| 0x545010D4
| 0x545010D4
| 0x04
| 0x04
|-
|-
| FALCON_UNK_D8
| [[#TSEC_FALCON_RSTAT0|TSEC_FALCON_RSTAT0]]
| 0x545010D8
| 0x545010D8
| 0x04
| 0x04
|-
|-
| FALCON_UNK_DC
| [[#TSEC_FALCON_RSTAT3|TSEC_FALCON_RSTAT3]]
| 0x545010DC
| 0x545010DC
| 0x04
| 0x04
|-
|-
| FALCON_UNK_E0
| TSEC_FALCON_UNK_E0
| 0x545010E0
| 0x545010E0
| 0x04
| 0x04
|-
|-
| [[#FALCON_CPUCTL|FALCON_CPUCTL]]
| [[#TSEC_FALCON_CPUCTL|TSEC_FALCON_CPUCTL]]
| 0x54501100
| 0x54501100
| 0x04
| 0x04
|-
|-
| [[#FALCON_BOOTVEC|FALCON_BOOTVEC]]
| [[#TSEC_FALCON_BOOTVEC|TSEC_FALCON_BOOTVEC]]
| 0x54501104
| 0x54501104
| 0x04
| 0x04
|-
|-
| [[#FALCON_HWCFG|FALCON_HWCFG]]
| [[#TSEC_FALCON_HWCFG|TSEC_FALCON_HWCFG]]
| 0x54501108
| 0x54501108
| 0x04
| 0x04
|-
|-
| [[#FALCON_DMACTL|FALCON_DMACTL]]
| [[#TSEC_FALCON_DMACTL|TSEC_FALCON_DMACTL]]
| 0x5450110C
| 0x5450110C
| 0x04
| 0x04
|-
|-
| [[#FALCON_DMATRFBASE|FALCON_DMATRFBASE]]
| [[#TSEC_FALCON_DMATRFBASE|TSEC_FALCON_DMATRFBASE]]
| 0x54501110
| 0x54501110
| 0x04
| 0x04
|-
|-
| [[#FALCON_DMATRFMOFFS|FALCON_DMATRFMOFFS]]
| [[#TSEC_FALCON_DMATRFMOFFS|TSEC_FALCON_DMATRFMOFFS]]
| 0x54501114
| 0x54501114
| 0x04
| 0x04
|-
|-
| [[#FALCON_DMATRFCMD|FALCON_DMATRFCMD]]
| [[#TSEC_FALCON_DMATRFCMD|TSEC_FALCON_DMATRFCMD]]
| 0x54501118
| 0x54501118
| 0x04
| 0x04
|-
|-
| [[#FALCON_DMATRFFBOFFS|FALCON_DMATRFFBOFFS]]
| [[#TSEC_FALCON_DMATRFFBOFFS|TSEC_FALCON_DMATRFFBOFFS]]
| 0x5450111C
| 0x5450111C
| 0x04
| 0x04
|-
|-
| [[#FALCON_DMAPOLL_FB|FALCON_DMAPOLL_FB]]
| [[#TSEC_FALCON_DMAPOLL_FB|TSEC_FALCON_DMAPOLL_FB]]
| 0x54501120
| 0x54501120
| 0x04
| 0x04
|-
|-
| [[#FALCON_DMAPOLL_CP|FALCON_DMAPOLL_CP]]
| [[#TSEC_FALCON_DMAPOLL_CP|TSEC_FALCON_DMAPOLL_CP]]
| 0x54501124
| 0x54501124
| 0x04
| 0x04
|-
|-
| FALCON_CPUSTAT
| TSEC_FALCON_DBG_STATE
| 0x54501128
| 0x54501128
| 0x04
| 0x04
|-
|-
| [[#FALCON_HWCFG1|FALCON_HWCFG1]]
| [[#TSEC_FALCON_HWCFG1|TSEC_FALCON_HWCFG1]]
| 0x5450112C
| 0x5450112C
| 0x04
| 0x04
|-
|-
| FALCON_CPUCTL_ALIAS
| TSEC_FALCON_CPUCTL_ALIAS
| 0x54501130
| 0x54501130
| 0x04
| 0x04
|-
|-
| [[#FALCON_IMCTL|FALCON_IMCTL]]
| TSEC_FALCON_STACKCFG
| 0x54501138
| 0x04
|-
| [[#TSEC_FALCON_IMCTL|TSEC_FALCON_IMCTL]]
| 0x54501140
| 0x54501140
| 0x04
| 0x04
|-
|-
| [[#FALCON_IMSTAT|FALCON_IMSTAT]]
| [[#TSEC_FALCON_IMSTAT|TSEC_FALCON_IMSTAT]]
| 0x54501144
| 0x54501144
| 0x04
| 0x04
|-
|-
| [[#FALCON_TRACEIDX|FALCON_TRACEIDX]]
| [[#TSEC_FALCON_TRACEIDX|TSEC_FALCON_TRACEIDX]]
| 0x54501148
| 0x54501148
| 0x04
| 0x04
|-
|-
| [[#FALCON_TRACEPC|FALCON_TRACEPC]]
| [[#TSEC_FALCON_TRACEPC|TSEC_FALCON_TRACEPC]]
| 0x5450114C
| 0x5450114C
| 0x04
| 0x04
|-
|-
| FALCON_IMFILLRNG0
| TSEC_FALCON_IMFILLRNG0
| 0x54501150
| 0x54501150
| 0x04
| 0x04
|-
|-
| FALCON_IMFILLRNG1
| TSEC_FALCON_IMFILLRNG1
| 0x54501154
| 0x54501154
| 0x04
| 0x04
|-
|-
| FALCON_IMFILLCTL
| TSEC_FALCON_IMFILLCTL
| 0x54501158
| 0x54501158
| 0x04
| 0x04
|-
|-
| FALCON_IMCTL_DEBUG
| TSEC_FALCON_IMCTL_DEBUG
| 0x5450115C
| 0x5450115C
| 0x04
| 0x04
|-
|-
| FALCON_CMEMBASE
| TSEC_FALCON_CMEMBASE
| 0x54501160
| 0x54501160
| 0x04
| 0x04
|-
|-
| FALCON_DMEMAPERT
| TSEC_FALCON_DMEMAPERT
| 0x54501164
| 0x54501164
| 0x04
| 0x04
|-
|-
| FALCON_EXTERRADDR
| TSEC_FALCON_EXTERRADDR
| 0x54501168
| 0x54501168
| 0x04
| 0x04
|-
|-
| FALCON_EXTERRSTAT
| TSEC_FALCON_EXTERRSTAT
| 0x5450116C
| 0x5450116C
| 0x04
| 0x04
|-
|-
| FALCON_CG1_SLCG
| TSEC_FALCON_CG2
| 0x5450117C
| 0x5450117C
| 0x04
| 0x04
|-
|-
| [[#FALCON_IMEMC|FALCON_IMEMC]]
| [[#TSEC_FALCON_IMEMC0|TSEC_FALCON_IMEMC0]]
| 0x54501180
| 0x54501180
| 0x04
| 0x04
|-
|-
| [[#FALCON_IMEMD|FALCON_IMEMD]]
| [[#TSEC_FALCON_IMEMD0|TSEC_FALCON_IMEMD0]]
| 0x54501184
| 0x54501184
| 0x04
| 0x04
|-
|-
| [[#FALCON_IMEMT|FALCON_IMEMT]]
| [[#TSEC_FALCON_IMEMT0|TSEC_FALCON_IMEMT0]]
| 0x54501188
| 0x54501188
| 0x04
| 0x04
|-
|-
| [[#FALCON_DMEMC0|FALCON_DMEMC0]]
| TSEC_FALCON_IMEMC1
| 0x545011C0
| 0x54501190
| 0x04
| 0x04
|-
|-
| [[#FALCON_DMEMD0|FALCON_DMEMD0]]
| TSEC_FALCON_IMEMD1
| 0x545011C4
| 0x54501194
| 0x04
| 0x04
|-
|-
| FALCON_DMEMC1
| TSEC_FALCON_IMEMT1
| 0x545011C8
| 0x54501198
| 0x04
| 0x04
|-
|-
| FALCON_DMEMD1
| TSEC_FALCON_IMEMC2
| 0x545011CC
| 0x545011A0
| 0x04
| 0x04
|-
|-
| FALCON_DMEMC2
| TSEC_FALCON_IMEMD2
| 0x545011D0
| 0x545011A4
| 0x04
| 0x04
|-
|-
| FALCON_DMEMD2
| TSEC_FALCON_IMEMT2
| 0x545011D4
| 0x545011A8
| 0x04
| 0x04
|-
|-
| FALCON_DMEMC3
| TSEC_FALCON_IMEMC3
| 0x545011D8
| 0x545011B0
| 0x04
| 0x04
|-
|-
| FALCON_DMEMD3
| TSEC_FALCON_IMEMD3
| 0x545011DC
| 0x545011B4
| 0x04
| 0x04
|-
|-
| FALCON_DMEMC4
| TSEC_FALCON_IMEMT3
| 0x545011E0
| 0x545011B8
| 0x04
| 0x04
|-
|-
| FALCON_DMEMD4
| [[#TSEC_FALCON_DMEMC0|TSEC_FALCON_DMEMC0]]
| 0x545011E4
| 0x545011C0
| 0x04
| 0x04
|-
|-
| FALCON_DMEMC5
| [[#TSEC_FALCON_DMEMD0|TSEC_FALCON_DMEMD0]]
| 0x545011E8
| 0x545011C4
| 0x04
| 0x04
|-
|-
| FALCON_DMEMD5
| TSEC_FALCON_DMEMC1
| 0x545011EC
| 0x545011C8
| 0x04
| 0x04
|-
|-
| FALCON_DMEMC6
| TSEC_FALCON_DMEMD1
| 0x545011F0
| 0x545011CC
| 0x04
| 0x04
|-
|-
| FALCON_DMEMD6
| TSEC_FALCON_DMEMC2
| 0x545011D0
| 0x04
|-
| TSEC_FALCON_DMEMD2
| 0x545011D4
| 0x04
|-
| TSEC_FALCON_DMEMC3
| 0x545011D8
| 0x04
|-
| TSEC_FALCON_DMEMD3
| 0x545011DC
| 0x04
|-
| TSEC_FALCON_DMEMC4
| 0x545011E0
| 0x04
|-
| TSEC_FALCON_DMEMD4
| 0x545011E4
| 0x04
|-
| TSEC_FALCON_DMEMC5
| 0x545011E8
| 0x04
|-
| TSEC_FALCON_DMEMD5
| 0x545011EC
| 0x04
|-
| TSEC_FALCON_DMEMC6
| 0x545011F0
| 0x04
|-
| TSEC_FALCON_DMEMD6
| 0x545011F4
| 0x545011F4
| 0x04
| 0x04
|-
|-
| FALCON_DMEMC7
| TSEC_FALCON_DMEMC7
| 0x545011F8
| 0x545011F8
| 0x04
| 0x04
|-
|-
| FALCON_DMEMD7
| TSEC_FALCON_DMEMD7
| 0x545011FC
| 0x545011FC
| 0x04
| 0x04
|-
|-
| [[#FALCON_ICD_CMD|FALCON_ICD_CMD]]
| [[#TSEC_FALCON_ICD_CMD|TSEC_FALCON_ICD_CMD]]
| 0x54501200
| 0x54501200
| 0x04
| 0x04
|-
|-
| [[#FALCON_ICD_ADDR|FALCON_ICD_ADDR]]
| [[#TSEC_FALCON_ICD_ADDR|TSEC_FALCON_ICD_ADDR]]
| 0x54501204
| 0x54501204
| 0x04
| 0x04
|-
|-
| [[#FALCON_ICD_WDATA|FALCON_ICD_WDATA]]
| [[#TSEC_FALCON_ICD_WDATA|TSEC_FALCON_ICD_WDATA]]
| 0x54501208
| 0x54501208
| 0x04
| 0x04
|-
|-
| [[#FALCON_ICD_RDATA|FALCON_ICD_RDATA]]
| [[#TSEC_FALCON_ICD_RDATA|TSEC_FALCON_ICD_RDATA]]
| 0x5450120C
| 0x5450120C
| 0x04
| 0x04
|-
|-
| [[#FALCON_SCTL|FALCON_SCTL]]
| [[#TSEC_FALCON_SCTL|TSEC_FALCON_SCTL]]
| 0x54501240
| 0x54501240
| 0x04
| 0x04
|-
|-
| [[#FALCON_SCTL_STAT|FALCON_SCTL_STAT]]
| [[#TSEC_FALCON_SSTAT|TSEC_FALCON_SSTAT]]
| 0x54501244
| 0x54501244
| 0x04
| 0x04
|-
|-
| FALCON_UNK_248
| TSEC_FALCON_UNK_250
| 0x54501250
| 0x54501250
| 0x04
| 0x04
|-
|-
| FALCON_UNK_260
| TSEC_FALCON_UNK_260
| 0x54501260
| 0x54501260
| 0x04
| 0x04
|-
|-
| [[#FALCON_SPROT_IMEM|FALCON_SPROT_IMEM]]
| [[#TSEC_FALCON_SPROT_IMEM|TSEC_FALCON_SPROT_IMEM]]
| 0x54501280
| 0x54501280
| 0x04
| 0x04
|-
|-
| [[#FALCON_SPROT_DMEM|FALCON_SPROT_DMEM]]
| [[#TSEC_FALCON_SPROT_DMEM|TSEC_FALCON_SPROT_DMEM]]
| 0x54501284
| 0x54501284
| 0x04
| 0x04
|-
|-
| [[#FALCON_SPROT_CPUCTL|FALCON_SPROT_CPUCTL]]
| [[#TSEC_FALCON_SPROT_CPUCTL|TSEC_FALCON_SPROT_CPUCTL]]
| 0x54501288
| 0x54501288
| 0x04
| 0x04
|-
|-
| [[#FALCON_SPROT_MISC|FALCON_SPROT_MISC]]
| [[#TSEC_FALCON_SPROT_MISC|TSEC_FALCON_SPROT_MISC]]
| 0x5450128C
| 0x5450128C
| 0x04
| 0x04
|-
|-
| [[#FALCON_SPROT_IRQ|FALCON_SPROT_IRQ]]
| [[#TSEC_FALCON_SPROT_IRQ|TSEC_FALCON_SPROT_IRQ]]
| 0x54501290
| 0x54501290
| 0x04
| 0x04
|-
|-
| [[#FALCON_SPROT_MTHD|FALCON_SPROT_MTHD]]
| [[#TSEC_FALCON_SPROT_MTHD|TSEC_FALCON_SPROT_MTHD]]
| 0x54501294
| 0x54501294
| 0x04
| 0x04
|-
|-
| [[#FALCON_SPROT_SCTL|FALCON_SPROT_SCTL]]
| [[#TSEC_FALCON_SPROT_SCTL|TSEC_FALCON_SPROT_SCTL]]
| 0x54501298
| 0x54501298
| 0x04
| 0x04
|-
|-
| [[#FALCON_SPROT_WDTMR|FALCON_SPROT_WDTMR]]
| [[#TSEC_FALCON_SPROT_WDTMR|TSEC_FALCON_SPROT_WDTMR]]
| 0x5450129C
| 0x5450129C
| 0x04
| 0x04
|-
|-
| FALCON_UNK_2C0
| TSEC_FALCON_DMAINFO_FINISHED_FBRD_LOW
| 0x545012C0
| 0x545012C0
| 0x04
| 0x04
|-
|-
| FALCON_UNK_2C4
| TSEC_FALCON_DMAINFO_FINISHED_FBRD_HIGH
| 0x545012C4
| 0x545012C4
| 0x04
| 0x04
|-
|-
| FALCON_UNK_2C8
| TSEC_FALCON_DMAINFO_FINISHED_FBWR_LOW
| 0x545012C8
| 0x545012C8
| 0x04
| 0x04
|-
|-
| FALCON_UNK_2CC
| TSEC_FALCON_DMAINFO_FINISHED_FBWR_HIGH
| 0x545012CC
| 0x545012CC
| 0x04
| 0x04
|-
|-
| FALCON_UNK_2E0
| TSEC_FALCON_DMAINFO_CURRENT_FBRD_LOW
| 0x545012E0
| 0x545012D0
| 0x04
| 0x04
|-
|-
| [[#TSEC_SCP_CTL0|TSEC_SCP_CTL0]]
| TSEC_FALCON_DMAINFO_CURRENT_FBRD_HIGH
| 0x54501400
| 0x545012D4
| 0x04
|-
| TSEC_FALCON_DMAINFO_CURRENT_FBWR_LOW
| 0x545012D8
| 0x04
|-
| TSEC_FALCON_DMAINFO_CURRENT_FBWR_HIGH
| 0x545012DC
| 0x04
|-
| TSEC_FALCON_DMAINFO_CTL
| 0x545012E0
| 0x04
|-
| [[#TSEC_SCP_CTL0|TSEC_SCP_CTL0]]
| 0x54501400
| 0x04
| 0x04
|-
|-
| 0x04
| 0x04
|-
|-
| TSEC_SCP_UNK_10
| [[#TSEC_SCP_CFG|TSEC_SCP_CFG]]
| 0x54501410
| 0x54501410
| 0x04
| 0x04
|-
|-
| TSEC_SCP_UNK_14
| TSEC_SCP_CTL_SCP
| 0x54501414
| 0x54501414
| 0x04
| 0x04
| 0x04
| 0x04
|-
|-
| TSEC_SCP_UNK_1C
| TSEC_SCP_CTL_DBG
| 0x5450141C
| 0x5450141C
| 0x04
| 0x04
|-
|-
| [[#TSEC_SCP_SEQ_CTL|TSEC_SCP_SEQ_CTL]]
| [[#TSEC_SCP_DBG0|TSEC_SCP_DBG0]]
| 0x54501420
| 0x54501420
| 0x04
| 0x04
|-
|-
| [[#TSEC_SCP_SEQ_VAL|TSEC_SCP_SEQ_VAL]]
| [[#TSEC_SCP_DBG1|TSEC_SCP_DBG1]]
| 0x54501424
| 0x54501424
| 0x04
| 0x04
|-
|-
| [[#TSEC_SCP_SEQ_STAT|TSEC_SCP_SEQ_STAT]]
| [[#TSEC_SCP_DBG2|TSEC_SCP_DBG2]]
| 0x54501428
| 0x54501428
| 0x04
| 0x04
|-
|-
| [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]]
| [[#TSEC_SCP_CMD|TSEC_SCP_CMD]]
| 0x54501430
| 0x54501430
| 0x04
| 0x04
|-
|-
| TSEC_SCP_UNK_50
| [[#TSEC_SCP_STAT0|TSEC_SCP_STAT0]]
| 0x54501450
| 0x54501450
| 0x04
| 0x04
|-
|-
| [[#TSEC_SCP_AUTH_STAT|TSEC_SCP_AUTH_STAT]]
| [[#TSEC_SCP_STAT1|TSEC_SCP_STAT1]]
| 0x54501454
| 0x54501454
| 0x04
| 0x04
|-
|-
| [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]]
| [[#TSEC_SCP_STAT2|TSEC_SCP_STAT2]]
| 0x54501458
| 0x54501458
| 0x04
| 0x04
|-
|-
| TSEC_SCP_UNK_70
| [[#TSEC_SCP_RND_STAT0|TSEC_SCP_RND_STAT0]]
| 0x54501470
| 0x54501470
| 0x04
|-
| TSEC_SCP_RND_STAT1
| 0x54501474
| 0x04
| 0x04
|-
|-
| 0x04
| 0x04
|-
|-
| TSEC_SCP_UNK_94
| TSEC_SCP_SEC_ERR
| 0x54501494
| 0x54501494
| 0x04
| 0x04
|-
|-
| [[#TSEC_SCP_INSN_ERR|TSEC_SCP_INSN_ERR]]
| [[#TSEC_SCP_CMD_ERR|TSEC_SCP_CMD_ERR]]
| 0x54501498
| 0x54501498
| 0x04
| 0x04
|-
|-
| TSEC_TRNG_CLK_LIMIT_LOW
| [[#TSEC_RND_CTL0|TSEC_RND_CTL0]]
| 0x54501500
| 0x54501500
| 0x04
| 0x04
|-
|-
| TSEC_TRNG_CLK_LIMIT_HIGH
| [[#TSEC_RND_CTL1|TSEC_RND_CTL1]]
| 0x54501504
| 0x54501504
| 0x04
| 0x04
|-
|-
| TSEC_TRNG_UNK_08
| TSEC_RND_CTL2
| 0x54501508
| 0x54501508
| 0x04
| 0x04
|-
|-
| TSEC_TRNG_TEST_CTL
| TSEC_RND_CTL3
| 0x5450150C
| 0x5450150C
| 0x04
| 0x04
|-
|-
| TSEC_TRNG_TEST_CFG0
| TSEC_RND_CTL4
| 0x54501510
| 0x54501510
| 0x04
| 0x04
|-
|-
| TSEC_TRNG_TEST_SEED0
| TSEC_RND_CTL5
| 0x54501514
| 0x54501514
| 0x04
| 0x04
|-
|-
| TSEC_TRNG_TEST_CFG1
| TSEC_RND_CTL6
| 0x54501518
| 0x54501518
| 0x04
| 0x04
|-
|-
| TSEC_TRNG_TEST_SEED1
| TSEC_RND_CTL7
| 0x5450151C
| 0x5450151C
| 0x04
| 0x04
|-
|-
| TSEC_TRNG_UNK_20
| TSEC_RND_CTL8
| 0x54501520
| 0x54501520
| 0x04
| 0x04
|-
|-
| TSEC_TRNG_UNK_24
| TSEC_RND_CTL9
| 0x54501524
| 0x54501524
| 0x04
| 0x04
|-
|-
| TSEC_TRNG_UNK_28
| TSEC_RND_CTL10
| 0x54501528
| 0x54501528
| 0x04
| 0x04
|-
|-
| TSEC_TRNG_CTL
| TSEC_RND_CTL11
| 0x5450152C
| 0x5450152C
| 0x04
| 0x04
|-
|-
| TSEC_TFBIF_CTL
| [[#TSEC_TFBIF_CTL|TSEC_TFBIF_CTL]]
| 0x54501600
| 0x54501600
| 0x04
| 0x04
| 0x04
| 0x04
|-
|-
| TSEC_TFBIF_THROTTLE
| [[#TSEC_TFBIF_THROTTLE|TSEC_TFBIF_THROTTLE]]
| 0x54501608
| 0x54501608
| 0x04
| 0x04
|-
|-
| TSEC_TFBIF_UNK_0C
| [[#TSEC_TFBIF_DBG_STAT0|TSEC_TFBIF_DBG_STAT0]]
| 0x5450160C
| 0x5450160C
| 0x04
| 0x04
|-
|-
| TSEC_TFBIF_DEBUG_STAT
| TSEC_TFBIF_DBG_STAT1
| 0x54501610
| 0x04
|-
| TSEC_TFBIF_DBG_RDCOUNT_LO
| 0x54501614
| 0x04
|-
| TSEC_TFBIF_DBG_RDCOUNT_HI
| 0x54501618
| 0x04
|-
| TSEC_TFBIF_DBG_WRCOUNT_LO
| 0x5450161C
| 0x04
|-
| TSEC_TFBIF_DBG_WRCOUNT_HI
| 0x54501620
| 0x04
|-
| TSEC_TFBIF_DBG_R32COUNT
| 0x54501624
| 0x04
|-
| TSEC_TFBIF_DBG_R64COUNT
| 0x54501628
| 0x04
|-
| TSEC_TFBIF_DBG_R128COUNT
| 0x5450162C
| 0x04
|-
| TSEC_TFBIF_UNK_30
| 0x54501630
| 0x54501630
| 0x04
| 0x04
| 0x04
| 0x04
|-
|-
| [[#TSEC_TFBIF_MMU_PROT|TSEC_TFBIF_MMU_PROT]]
| TSEC_TFBIF_WRR_RDP
| 0x54501638
| 0x04
|-
| [[#TSEC_TFBIF_SPROT_EMEM|TSEC_TFBIF_SPROT_EMEM]]
| 0x54501640
| 0x54501640
| 0x04
| 0x04
|-
|-
| [[#TSEC_TFBIF_MMU_PHYS_SEC|TSEC_TFBIF_MMU_PHYS_SEC]]
| [[#TSEC_TFBIF_TRANSCFG|TSEC_TFBIF_TRANSCFG]]
| 0x54501644
| 0x54501644
| 0x04
| 0x04
|-
|-
| [[#TSEC_TFBIF_MMU_TRANSCFG|TSEC_TFBIF_MMU_TRANSCFG]]
| [[#TSEC_TFBIF_REGIONCFG|TSEC_TFBIF_REGIONCFG]]
| 0x54501648
| 0x54501648
| 0x04
| 0x04
|-
|-
| [[#TSEC_TFBIF_ACTMON_MAMASK|TSEC_TFBIF_ACTMON_MAMASK]]
| [[#TSEC_TFBIF_ACTMON_ACTIVE_MASK|TSEC_TFBIF_ACTMON_ACTIVE_MASK]]
| 0x5450164C
| 0x5450164C
| 0x04
| 0x04
|-
|-
| [[#TSEC_TFBIF_ACTMON_BORPS|TSEC_TFBIF_ACTMON_BORPS]]
| [[#TSEC_TFBIF_ACTMON_ACTIVE_BORPS|TSEC_TFBIF_ACTMON_ACTIVE_BORPS]]
| 0x54501650
| 0x54501650
| 0x04
| 0x04
|-
|-
| [[#TSEC_TFBIF_ACTMON_CTL|TSEC_TFBIF_ACTMON_CTL]]
| [[#TSEC_TFBIF_ACTMON_ACTIVE_WEIGHT|TSEC_TFBIF_ACTMON_ACTIVE_WEIGHT]]
| 0x54501654
| 0x54501654
| 0x04
| 0x04
|-
|-
| [[#TSEC_CG|TSEC_CG]]
| TSEC_TFBIF_ACTMON_MCB_MASK
| 0x545016D0
| 0x54501660
| 0x04
|-
| TSEC_TFBIF_ACTMON_MCB_BORPS
| 0x54501664
| 0x04
|-
| TSEC_TFBIF_ACTMON_MCB_WEIGHT
| 0x54501668
| 0x04
|-
| TSEC_TFBIF_THI_TRANSPROP
| 0x54501670
| 0x04
|-
| [[#TSEC_CG|TSEC_CG]]
| 0x545016D0
| 0x04
| 0x04
|-
|-
=== TSEC_THI_METHOD0 ===
=== TSEC_THI_METHOD0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-11
| TSEC_THI_METHOD0_OFFSET
|}
Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.
The following methods are available:
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! ID
! ID
! Method
! Method
|-
| 0x100
| NOP
|-
| 0x140
| PM_TRIGGER
|-
|-
| 0x200
| 0x200
| SET_APPLICATION_ID
| SET_APPLICATION_ID
|-
| 0x204
| SET_WATCHDOG_TIMER
|-
| 0x240
| SEMAPHORE_A
|-
| 0x244
| SEMAPHORE_B
|-
| 0x248
| SEMAPHORE_C
|-
| 0x24C
|
|-
| 0x250
|
|-
|-
| 0x300
| 0x300
| EXECUTE
| EXECUTE
|-
| 0x304
| SEMAPHORE_D
|-
|-
| 0x500
| 0x500
| 0x740
| 0x740
| [6.0.0+] HDCP_GET_CURRENT_NONCE
| [6.0.0+] HDCP_GET_CURRENT_NONCE
|-
| 0x1114
| PM_TRIGGER_END
|}
|}
=== TSEC_THI_METHOD1 ===
=== TSEC_THI_METHOD1 ===
Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.
{| class="wikitable" border="1"
! Bits
=== TSEC_THI_INT_STATUS ===
! Description
|-
| 0-31
| TSEC_THI_METHOD1_DATA
|}
Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.
=== TSEC_THI_INT_STATUS ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
|}
|}
=== FALCON_IRQSSET ===
=== TSEC_FALCON_IRQSSET ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
|-
|-
| 0
| 0
| FALCON_IRQSSET_GPTMR
| TSEC_FALCON_IRQSSET_GPTMR
|-
|-
| 1
| 1
| FALCON_IRQSSET_WDTMR
| TSEC_FALCON_IRQSSET_WDTMR
|-
|-
| 2
| 2
| FALCON_IRQSSET_MTHD
| TSEC_FALCON_IRQSSET_MTHD
|-
|-
| 3
| 3
| FALCON_IRQSSET_CTXSW
| TSEC_FALCON_IRQSSET_CTXSW
|-
|-
| 4
| 4
| FALCON_IRQSSET_HALT
| TSEC_FALCON_IRQSSET_HALT
|-
|-
| 5
| 5
| FALCON_IRQSSET_EXTERR
| TSEC_FALCON_IRQSSET_EXTERR
|-
|-
| 6
| 6
| FALCON_IRQSSET_SWGEN0
| TSEC_FALCON_IRQSSET_SWGEN0
|-
|-
| 7
| 7
| FALCON_IRQSSET_SWGEN1
| TSEC_FALCON_IRQSSET_SWGEN1
|-
|-
| 8-15
| 8-15
| FALCON_IRQSSET_EXT
| TSEC_FALCON_IRQSSET_EXT
|-
| 16
| TSEC_FALCON_IRQSSET_DMA
|}
|}
Used for setting Falcon's IRQs.
Used for setting Falcon's IRQs.
=== FALCON_IRQSCLR ===
=== TSEC_FALCON_IRQSCLR ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
|-
|-
| 0
| 0
| FALCON_IRQSCLR_GPTMR
| TSEC_FALCON_IRQSCLR_GPTMR
|-
|-
| 1
| 1
| FALCON_IRQSCLR_WDTMR
| TSEC_FALCON_IRQSCLR_WDTMR
|-
|-
| 2
| 2
| FALCON_IRQSCLR_MTHD
| TSEC_FALCON_IRQSCLR_MTHD
|-
|-
| 3
| 3
| FALCON_IRQSCLR_CTXSW
| TSEC_FALCON_IRQSCLR_CTXSW
|-
|-
| 4
| 4
| FALCON_IRQSCLR_HALT
| TSEC_FALCON_IRQSCLR_HALT
|-
|-
| 5
| 5
| FALCON_IRQSCLR_EXTERR
| TSEC_FALCON_IRQSCLR_EXTERR
|-
|-
| 6
| 6
| FALCON_IRQSCLR_SWGEN0
| TSEC_FALCON_IRQSCLR_SWGEN0
|-
|-
| 7
| 7
| FALCON_IRQSCLR_SWGEN1
| TSEC_FALCON_IRQSCLR_SWGEN1
|-
|-
| 8-15
| 8-15
| FALCON_IRQSCLR_EXT
| TSEC_FALCON_IRQSCLR_EXT
|-
| 16
| TSEC_FALCON_IRQSCLR_DMA
|}
|}
Used for clearing Falcon's IRQs.
Used for clearing Falcon's IRQs.
=== FALCON_IRQSTAT ===
=== TSEC_FALCON_IRQSTAT ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
|-
|-
| 0
| 0
| FALCON_IRQSTAT_GPTMR
| TSEC_FALCON_IRQSTAT_GPTMR
|-
|-
| 1
| 1
| FALCON_IRQSTAT_WDTMR
| TSEC_FALCON_IRQSTAT_WDTMR
|-
|-
| 2
| 2
| FALCON_IRQSTAT_MTHD
| TSEC_FALCON_IRQSTAT_MTHD
|-
|-
| 3
| 3
| FALCON_IRQSTAT_CTXSW
| TSEC_FALCON_IRQSTAT_CTXSW
|-
|-
| 4
| 4
| FALCON_IRQSTAT_HALT
| TSEC_FALCON_IRQSTAT_HALT
|-
|-
| 5
| 5
| FALCON_IRQSTAT_EXTERR
| TSEC_FALCON_IRQSTAT_EXTERR
|-
|-
| 6
| 6
| FALCON_IRQSTAT_SWGEN0
| TSEC_FALCON_IRQSTAT_SWGEN0
|-
|-
| 7
| 7
| FALCON_IRQSTAT_SWGEN1
| TSEC_FALCON_IRQSTAT_SWGEN1
|-
|-
| 8-15
| 8-15
| FALCON_IRQSTAT_EXT
| TSEC_FALCON_IRQSTAT_EXT
|-
| 16
| TSEC_FALCON_IRQSTAT_DMA
|}
|}
Used for getting the status of Falcon's IRQs.
Used for getting the status of Falcon's IRQs.
=== FALCON_IRQMODE ===
=== TSEC_FALCON_IRQMODE ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
|-
|-
| 0
| 0
| FALCON_IRQMODE_LVL_GPTMR
| TSEC_FALCON_IRQMODE_LVL_GPTMR
|-
|-
| 1
| 1
| FALCON_IRQMODE_LVL_WDTMR
| TSEC_FALCON_IRQMODE_LVL_WDTMR
|-
|-
| 2
| 2
| FALCON_IRQMODE_LVL_MTHD
| TSEC_FALCON_IRQMODE_LVL_MTHD
|-
|-
| 3
| 3
| FALCON_IRQMODE_LVL_CTXSW
| TSEC_FALCON_IRQMODE_LVL_CTXSW
|-
|-
| 4
| 4
| FALCON_IRQMODE_LVL_HALT
| TSEC_FALCON_IRQMODE_LVL_HALT
|-
|-
| 5
| 5
| FALCON_IRQMODE_LVL_EXTERR
| TSEC_FALCON_IRQMODE_LVL_EXTERR
|-
|-
| 6
| 6
| FALCON_IRQMODE_LVL_SWGEN0
| TSEC_FALCON_IRQMODE_LVL_SWGEN0
|-
|-
| 7
| 7
| FALCON_IRQMODE_LVL_SWGEN1
| TSEC_FALCON_IRQMODE_LVL_SWGEN1
|-
|-
| 8-15
| 8-15
| FALCON_IRQMODE_LVL_EXT
| TSEC_FALCON_IRQMODE_LVL_EXT
|-
| 16
| TSEC_FALCON_IRQMODE_LVL_DMA
|}
|}
Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.
Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.
=== FALCON_IRQMSET ===
=== TSEC_FALCON_IRQMSET ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
|-
|-
| 0
| 0
| FALCON_IRQMSET_GPTMR
| TSEC_FALCON_IRQMSET_GPTMR
|-
|-
| 1
| 1
| FALCON_IRQMSET_WDTMR
| TSEC_FALCON_IRQMSET_WDTMR
|-
|-
| 2
| 2
| FALCON_IRQMSET_MTHD
| TSEC_FALCON_IRQMSET_MTHD
|-
|-
| 3
| 3
| FALCON_IRQMSET_CTXSW
| TSEC_FALCON_IRQMSET_CTXSW
|-
|-
| 4
| 4
| FALCON_IRQMSET_HALT
| TSEC_FALCON_IRQMSET_HALT
|-
|-
| 5
| 5
| FALCON_IRQMSET_EXTERR
| TSEC_FALCON_IRQMSET_EXTERR
|-
|-
| 6
| 6
| FALCON_IRQMSET_SWGEN0
| TSEC_FALCON_IRQMSET_SWGEN0
|-
|-
| 7
| 7
| FALCON_IRQMSET_SWGEN1
| TSEC_FALCON_IRQMSET_SWGEN1
|-
|-
| 8-15
| 8-15
| FALCON_IRQMSET_EXT
| TSEC_FALCON_IRQMSET_EXT
|-
| 16
| TSEC_FALCON_IRQMSET_DMA
|}
|}
Used for setting the mask for Falcon's IRQs.
Used for setting the mask for Falcon's IRQs.
=== FALCON_IRQMCLR ===
=== TSEC_FALCON_IRQMCLR ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
|-
|-
| 0
| 0
| FALCON_IRQMCLR_GPTMR
| TSEC_FALCON_IRQMCLR_GPTMR
|-
|-
| 1
| 1
| FALCON_IRQMCLR_WDTMR
| TSEC_FALCON_IRQMCLR_WDTMR
|-
|-
| 2
| 2
| FALCON_IRQMCLR_MTHD
| TSEC_FALCON_IRQMCLR_MTHD
|-
|-
| 3
| 3
| FALCON_IRQMCLR_CTXSW
| TSEC_FALCON_IRQMCLR_CTXSW
|-
|-
| 4
| 4
| FALCON_IRQMCLR_HALT
| TSEC_FALCON_IRQMCLR_HALT
|-
|-
| 5
| 5
| FALCON_IRQMCLR_EXTERR
| TSEC_FALCON_IRQMCLR_EXTERR
|-
|-
| 6
| 6
| FALCON_IRQMCLR_SWGEN0
| TSEC_FALCON_IRQMCLR_SWGEN0
|-
|-
| 7
| 7
| FALCON_IRQMCLR_SWGEN1
| TSEC_FALCON_IRQMCLR_SWGEN1
|-
|-
| 8-15
| 8-15
| FALCON_IRQMCLR_EXT
| TSEC_FALCON_IRQMCLR_EXT
|-
| 16
| TSEC_FALCON_IRQMCLR_DMA
|}
|}
Used for clearing the mask for Falcon's IRQs.
Used for clearing the mask for Falcon's IRQs.
=== FALCON_IRQMASK ===
=== TSEC_FALCON_IRQMASK ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
|-
|-
| 0
| 0
| FALCON_IRQMASK_GPTMR
| TSEC_FALCON_IRQMASK_GPTMR
|-
|-
| 1
| 1
| FALCON_IRQMASK_WDTMR
| TSEC_FALCON_IRQMASK_WDTMR
|-
|-
| 2
| 2
| FALCON_IRQMASK_MTHD
| TSEC_FALCON_IRQMASK_MTHD
|-
|-
| 3
| 3
| FALCON_IRQMASK_CTXSW
| TSEC_FALCON_IRQMASK_CTXSW
|-
|-
| 4
| 4
| FALCON_IRQMASK_HALT
| TSEC_FALCON_IRQMASK_HALT
|-
|-
| 5
| 5
| FALCON_IRQMASK_EXTERR
| TSEC_FALCON_IRQMASK_EXTERR
|-
|-
| 6
| 6
| FALCON_IRQMASK_SWGEN0
| TSEC_FALCON_IRQMASK_SWGEN0
|-
|-
| 7
| 7
| FALCON_IRQMASK_SWGEN1
| TSEC_FALCON_IRQMASK_SWGEN1
|-
|-
| 8-15
| 8-15
| FALCON_IRQMASK_EXT
| TSEC_FALCON_IRQMASK_EXT
|-
| 16
| TSEC_FALCON_IRQMASK_DMA
|}
|}
Used for getting the value of the mask for Falcon's IRQs.
Used for getting the value of the mask for Falcon's IRQs.
=== FALCON_IRQDEST ===
=== TSEC_FALCON_IRQDEST ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
|-
|-
| 0
| 0
| FALCON_IRQDEST_HOST_GPTMR
| TSEC_FALCON_IRQDEST_HOST_GPTMR
|-
|-
| 1
| 1
| FALCON_IRQDEST_HOST_WDTMR
| TSEC_FALCON_IRQDEST_HOST_WDTMR
|-
|-
| 2
| 2
| FALCON_IRQDEST_HOST_MTHD
| TSEC_FALCON_IRQDEST_HOST_MTHD
|-
|-
| 3
| 3
| FALCON_IRQDEST_HOST_CTXSW
| TSEC_FALCON_IRQDEST_HOST_CTXSW
|-
|-
| 4
| 4
| FALCON_IRQDEST_HOST_HALT
| TSEC_FALCON_IRQDEST_HOST_HALT
|-
|-
| 5
| 5
| FALCON_IRQDEST_HOST_EXTERR
| TSEC_FALCON_IRQDEST_HOST_EXTERR
|-
|-
| 6
| 6
| FALCON_IRQDEST_HOST_SWGEN0
| TSEC_FALCON_IRQDEST_HOST_SWGEN0
|-
|-
| 7
| 7
| FALCON_IRQDEST_HOST_SWGEN1
| TSEC_FALCON_IRQDEST_HOST_SWGEN1
|-
|-
| 8-15
| 8-15
| FALCON_IRQDEST_HOST_EXT
| TSEC_FALCON_IRQDEST_HOST_EXT
|-
|-
| 16
| 16
| FALCON_IRQDEST_TARGET_GPTMR
| TSEC_FALCON_IRQDEST_TARGET_GPTMR
|-
|-
| 17
| 17
| FALCON_IRQDEST_TARGET_WDTMR
| TSEC_FALCON_IRQDEST_TARGET_WDTMR
|-
|-
| 18
| 18
| FALCON_IRQDEST_TARGET_MTHD
| TSEC_FALCON_IRQDEST_TARGET_MTHD
|-
|-
| 19
| 19
| FALCON_IRQDEST_TARGET_CTXSW
| TSEC_FALCON_IRQDEST_TARGET_CTXSW
|-
|-
| 20
| 20
| FALCON_IRQDEST_TARGET_HALT
| TSEC_FALCON_IRQDEST_TARGET_HALT
|-
|-
| 21
| 21
| FALCON_IRQDEST_TARGET_EXTERR
| TSEC_FALCON_IRQDEST_TARGET_EXTERR
|-
|-
| 22
| 22
| FALCON_IRQDEST_TARGET_SWGEN0
| TSEC_FALCON_IRQDEST_TARGET_SWGEN0
|-
|-
| 23
| 23
| FALCON_IRQDEST_TARGET_SWGEN1
| TSEC_FALCON_IRQDEST_TARGET_SWGEN1
|-
|-
| 24-31
| 24-31
| FALCON_IRQDEST_TARGET_EXT
| TSEC_FALCON_IRQDEST_TARGET_EXT
|}
|}
Used for routing Falcon's IRQs.
Used for routing Falcon's IRQs.
=== FALCON_MAILBOX0 ===
=== TSEC_FALCON_IRQDEST2 ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
|-
|-
| 0
| 0
| FALCON_ITFEN_CTXEN
| TSEC_FALCON_IRQDEST2_HOST_DMA
|-
|-
| 1
| 16
| FALCON_ITFEN_MTHDEN
| TSEC_FALCON_IRQDEST2_TARGET_DMA
|}
|}
Used for enabling/disabling Falcon interfaces.
Used for routing Falcon's IRQs.
=== FALCON_IDLESTATE ===
=== TSEC_FALCON_MAILBOX0 ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0
| 0-31
| TSEC_FALCON_MAILBOX0_DATA
| FALCON_IDLESTATE_EXT_BUSY
|}
|}
Scratch register for reading/writing data to Falcon.
=== FALCON_DEBUG1 ===
=== TSEC_FALCON_MAILBOX1 ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0-15
| 0-31
| FALCON_DEBUG1_MTHD_DRAIN_TIME
| TSEC_FALCON_MAILBOX1_DATA
|}
|}
Scratch register for reading/writing data to Falcon.
=== FALCON_EXCI ===
=== TSEC_FALCON_ITFEN ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0-19
| 0
| PC that originated the exception
| TSEC_FALCON_ITFEN_CTXEN
|-
|-
| 20-23
| 1
| Exception type
| TSEC_FALCON_ITFEN_MTHDEN
|}
|}
Used for enabling/disabling Falcon interfaces.
=== FALCON_CPUCTL ===
=== TSEC_FALCON_IDLESTATE ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
|-
|-
| 0
| 0
| FALCON_CPUCTL_IINVAL
| TSEC_FALCON_IDLESTATE_FALCON_BUSY
|-
|-
| 1
| 1-15
| TSEC_FALCON_IDLESTATE_EXT_BUSY
| 4
|}
|}
Used for signaling the Falcon CPU.
Used for detecting if Falcon is busy or not.
=== FALCON_HWCFG ===
=== TSEC_FALCON_DEBUG1 ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0-8
| 0-15
| FALCON_HWCFG_IMEM_SIZE
| TSEC_FALCON_DEBUG1_MTHD_DRAIN_TIME
|-
|-
| 9-17
| 16
| FALCON_HWCFG_DMEM_SIZE
| TSEC_FALCON_DEBUG1_CTXSW_MODE
|-
|-
| 18-26
| 17
| FALCON_HWCFG_METHODFIFO_DEPTH
| TSEC_FALCON_DEBUG1_TRACE_FORMAT
|}
=== TSEC_FALCON_DEBUGINFO ===
{| class="wikitable" border="1"
! Bits
! Description
|-
|-
| 27-31
| 0-31
| FALCON_HWCFG_DMAQUEUE_DEPTH
| TSEC_FALCON_DEBUGINFO_DATA
|}
|}
=== FALCON_DMACTL ===
Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.
[6.0.0+] [[NV_services|nvservices]] sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.
=== TSEC_FALCON_EXCI ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0
| 0-19
| FALCON_DMACTL_REQUIRE_CTX
| TSEC_FALCON_EXCI_EXPC
|-
|-
| 1
| 20-23
| FALCON_DMACTL_DMEM_SCRUBBING
| TSEC_FALCON_EXCI_EXCAUSE
0x00: TRAP0
0x01: TRAP1
0x02: TRAP2
0x03: TRAP3
0x08: ILL_INS (invalid opcode)
0x09: INV_INS (authentication entry)
0x0A: MISS_INS (page miss)
0x0B: DHIT_INS (page multiple hit)
0x0F: BRKPT_INS (breakpoint hit)
|}
|}
Contains information about raised exceptions.
=== FALCON_DMATRFBASE ===
=== TSEC_FALCON_SVEC_SPR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 18
| TSEC_FALCON_SVEC_SPR_SIGPASS
|}
=== TSEC_FALCON_RSTAT0 ===
Mirror of the [[#TSEC_FALCON_ICD_RDATA|ICD status register 0]].
=== FALCON_DMATRFMOFFS ===
=== TSEC_FALCON_RSTAT3 ===
Mirror of the [[#TSEC_FALCON_ICD_RDATA|ICD status register 3]].
=== FALCON_DMATRFCMD ===
=== TSEC_FALCON_CPUCTL ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
|-
|-
| 0
| 0
| FALCON_DMATRFCMD_FULL
| TSEC_FALCON_CPUCTL_IINVAL
|-
|-
| 1
| 1
| FALCON_DMATRFCMD_IDLE
| TSEC_FALCON_CPUCTL_STARTCPU
|-
|-
| 2-3
| 2
| FALCON_DMATRFCMD_SEC
| TSEC_FALCON_CPUCTL_SRESET
|-
| 3
| TSEC_FALCON_CPUCTL_HRESET
|-
|-
| 4
| 4
| FALCON_DMATRFCMD_IMEM
| TSEC_FALCON_CPUCTL_HALTED
|-
|-
| 5
| 5
| FALCON_DMATRFCMD_WRITE
| TSEC_FALCON_CPUCTL_STOPPED
|-
|-
| 8-10
| 6
| FALCON_DMATRFCMD_SIZE
| TSEC_FALCON_CPUCTL_ALIAS_EN
|}
Used for signaling the Falcon CPU.
=== TSEC_FALCON_BOOTVEC ===
{| class="wikitable" border="1"
! Bits
! Description
|-
|-
| 12-14
| 0-31
| FALCON_DMATRFCMD_CTXDMA
| TSEC_FALCON_BOOTVEC_VEC
|}
|}
Takes the Falcon's boot vector address.
=== FALCON_DMAPOLL_FB ===
=== TSEC_FALCON_HWCFG ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0
| 0-8
| FALCON_DMAPOLL_FB_FENCE_ACTIVE
| TSEC_FALCON_HWCFG_IMEM_SIZE
|-
|-
| 1
| 9-17
| FALCON_DMAPOLL_FB_DMA_ACTIVE
| TSEC_FALCON_HWCFG_DMEM_SIZE
|-
|-
| 4
| 18-26
| FALCON_DMAPOLL_FB_CFG_R_FENCE
| TSEC_FALCON_HWCFG_METHODFIFO_DEPTH
|-
|-
| 5
| 27-31
| TSEC_FALCON_HWCFG_DMAQUEUE_DEPTH
| FALCON_DMAPOLL_FB_RCOUNT
|}
|}
=== TSEC_FALCON_DMACTL ===
=== FALCON_DMAPOLL_CP ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
|-
|-
| 0
| 0
| FALCON_DMAPOLL_CP_FENCE_ACTIVE
| TSEC_FALCON_DMACTL_REQUIRE_CTX
|-
|-
| 1
| 1
| FALCON_DMAPOLL_CP_DMA_ACTIVE
| TSEC_FALCON_DMACTL_DMEM_SCRUBBING
|-
|-
| 4
| 2
| FALCON_DMAPOLL_CP_CFG_R_FENCE
| TSEC_FALCON_DMACTL_IMEM_SCRUBBING
|-
|-
| 5
| 3-6
| FALCON_DMAPOLL_CP_CFG_W_FENCE
| TSEC_FALCON_DMACTL_DMAQ_NUM
|-
|-
| 16-23
| 7
| FALCON_DMAPOLL_CP_WCOUNT
| TSEC_FALCON_DMACTL_SECURE_STAT
|}
|}
Used for configuring the Falcon's DMA engine.
=== FALCON_HWCFG1 ===
=== TSEC_FALCON_DMATRFBASE ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0-3
| 0-31
| TSEC_FALCON_DMATRFBASE_BASE
| FALCON_HWCFG1_IMEM_AUTOFILL
|}
|}
=== FALCON_IMCTL ===
Base address of the external memory buffer, shifted right by 8.
The current transfer address is calculated by adding [[#TSEC_FALCON_DMATRFFBOFFS|TSEC_FALCON_DMATRFFBOFFS]] to the base.
=== TSEC_FALCON_DMATRFMOFFS ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0-23
| 0-15
| Address
| TSEC_FALCON_DMATRFMOFFS_OFFS
|}
|}
For transfers to DMEM: the destination address.
For transfers to IMEM: the destination virtual IMEM page.
=== FALCON_TRACEIDX ===
=== TSEC_FALCON_DMATRFCMD ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0-7
| 0
| Index of where to start tracing from
| TSEC_FALCON_DMATRFCMD_FULL
|-
| 1
| TSEC_FALCON_DMATRFCMD_IDLE
|-
| 2-3
| TSEC_FALCON_DMATRFCMD_SEC
|-
| 4
| TSEC_FALCON_DMATRFCMD_IMEM
|-
| 5
| TSEC_FALCON_DMATRFCMD_WRITE
|-
|-
| 16-23
| 8-10
| Maximum valid index
| TSEC_FALCON_DMATRFCMD_SIZE
|-
|-
| 24-31
| 12-14
| Number of trace reads remaining
| TSEC_FALCON_DMATRFCMD_CTXDMA
|}
|}
Used for configuring DMA transfers.
=== FALCON_IMEMC ===
=== TSEC_FALCON_DMATRFFBOFFS ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 2-7
| 0-15
| Offset in IMEM block to read/write
| TSEC_FALCON_DMATRFFBOFFS_OFFS
|-
|}
For transfers to IMEM: the destination physical IMEM page.
=== TSEC_FALCON_DMAPOLL_FB ===
{| class="wikitable" border="1"
! Bits
! Description
|-
|-
| 24
| 0
| Write auto-increment
| TSEC_FALCON_DMAPOLL_FB_FENCE_ACTIVE
|-
|-
| 25
| 1
| Read auto-increment
| TSEC_FALCON_DMAPOLL_FB_DMA_ACTIVE
|-
|-
| 28
| 4
| Mark uploaded code as secret
| TSEC_FALCON_DMAPOLL_FB_CFG_R_FENCE
|-
|-
| 29
| 5
| Secret code upload lockdown status (read-only)
| TSEC_FALCON_DMAPOLL_FB_CFG_W_FENCE
|-
|-
| 30
| 16-23
| Secret code upload failure status (read-only)
| TSEC_FALCON_DMAPOLL_FB_WCOUNT
|-
|-
| 31
| 24-31
| Secret code upload reset scrubber status (read-only)
| TSEC_FALCON_DMAPOLL_FB_RCOUNT
|}
|}
Contains the status of a DMA transfer between the Falcon and external memory.
=== FALCON_IMEMD ===
=== TSEC_FALCON_DMAPOLL_CP ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 2-7
| 0
| Offset in DMEM block to read/write
| TSEC_FALCON_DMAPOLL_CP_FENCE_ACTIVE
|-
| 1
| TSEC_FALCON_DMAPOLL_CP_DMA_ACTIVE
|-
|-
| 8-15
| 4
| DMEM block to read/write
| TSEC_FALCON_DMAPOLL_CP_CFG_R_FENCE
|-
|-
| 24
| 5
| Write auto-increment
| TSEC_FALCON_DMAPOLL_CP_CFG_W_FENCE
|-
|-
| 25
| 16-23
| Read auto-increment
| TSEC_FALCON_DMAPOLL_CP_WCOUNT
|}
|-
| 24-31
| TSEC_FALCON_DMAPOLL_CP_RCOUNT
|}
Contains the status of a DMA transfer between the Falcon and the SCP.
=== FALCON_ICD_CMD ===
=== TSEC_FALCON_HWCFG1 ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
|-
|-
| 0-3
| 0-3
| FALCON_ICD_CMD_OPC
| TSEC_FALCON_HWCFG1_CORE_REV
|-
| 4-5
| TSEC_FALCON_HWCFG1_SECURITY_MODEL
|-
|-
| 6-7
| 6-7
| FALCON_ICD_CMD_SZ
| TSEC_FALCON_HWCFG1_CORE_REV_SUBVERSION
|-
| 8-11
| TSEC_FALCON_HWCFG1_IMEM_PORTS
|-
| 12-15
| TSEC_FALCON_HWCFG1_DMEM_PORTS
|-
|-
| 8-12
| 16-20
| FALCON_ICD_CMD_IDX
| TSEC_FALCON_HWCFG1_TAG_WIDTH
|-
| 27
| TSEC_FALCON_HWCFG1_DBG_PRIV_BUS
|-
|-
| 14
| 28
| FALCON_ICD_CMD_ERROR
| TSEC_FALCON_HWCFG1_CSB_SIZE_16M
|-
|-
| 15
| 29
| FALCON_ICD_CMD_RDVLD
| TSEC_FALCON_HWCFG1_PRIV_DIRECT
|-
|-
| 16-31
| 30
| FALCON_ICD_CMD_PARM
| TSEC_FALCON_HWCFG1_DMEM_APERTURES
|-
| 31
| TSEC_FALCON_HWCFG1_IMEM_AUTOFILL
|}
|}
=== TSEC_FALCON_IMCTL ===
=== FALCON_ICD_ADDR ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0
| 0-23
| RSTAT0_MEM_STALL
| TSEC_FALCON_IMCTL_ADDR_BLK
|-
|-
| 1
| 24-26
| TSEC_FALCON_IMCTL_CMD
0x00: NOP
0x01: IMINV (ITLB)
0x02: IMBLK (PTLB)
0x03: IMTAG (VTLB)
0x04: IMTAG_SETVLD
|}
Controls the Falcon TLB.
=== TSEC_FALCON_IMSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
|-
| 2
| 0-31
| RSTAT0_FENCE_STALL
| TSEC_FALCON_IMSTAT_VAL
|}
Returns the result of the last command from [[#TSEC_FALCON_IMCTL|TSEC_FALCON_IMCTL]].
=== TSEC_FALCON_TRACEIDX ===
{| class="wikitable" border="1"
! Bits
! Description
|-
|-
| 3
| 0-7
| RSTAT0_DIV_STALL
| TSEC_FALCON_TRACEIDX_IDX
|-
|-
| 4
| 16-23
| RSTAT0_DMA_STALL_DMAQ
| TSEC_FALCON_TRACEIDX_MAXIDX
|-
|-
| 5
| 24-31
| RSTAT0_DMA_STALL_DMWAITING
| TSEC_FALCON_TRACEIDX_CNT
|}
Controls the index for tracing with [[#TSEC_FALCON_TRACEPC|TSEC_FALCON_TRACEPC]].
=== TSEC_FALCON_TRACEPC ===
{| class="wikitable" border="1"
! Bits
! Description
|-
|-
| 6
| 0-23
| RSTAT0_DMA_STALL_IMWAITING
| TSEC_FALCON_TRACEPC_PC
|}
Returns the PC of the last call or branch executed.
=== TSEC_FALCON_IMEMC0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
|-
| 7
| 2-7
| RSTAT0_ANY_STALL
| TSEC_FALCON_IMEMC_OFFS
|-
|-
| 8
| 8-15
| RSTAT0_SBFULL_STALL
| TSEC_FALCON_IMEMC_BLK
|-
|-
| 9
| 24
| RSTAT0_SBHIT_STALL
| TSEC_FALCON_IMEMC_AINCW
|-
|-
| 10
| 25
| RSTAT0_FLOW_STALL
| TSEC_FALCON_IMEMC_AINCR
|-
|-
| 11
| 28
| RSTAT0_SP_STALL
| TSEC_FALCON_IMEMC_SECURE
|-
|-
| 12
| 29
| RSTAT0_BL_STALL
| TSEC_FALCON_IMEMC_SEC_ATOMIC
|-
|-
| 13
| 30
| RSTAT0_IPND_STALL
| TSEC_FALCON_IMEMC_SEC_WR_VIO
|-
|-
| 14
| 31
| RSTAT0_LDSTQ_STALL
| TSEC_FALCON_IMEMC_SEC_LOCK
|}
Used for configuring access to Falcon's IMEM.
=== TSEC_FALCON_IMEMD0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
|-
| 16
| 0-31
| RSTAT0_NOINSTR_STALL
| TSEC_FALCON_IMEMD_DATA
|}
Returns or takes the value for an IMEM read/write operation.
=== TSEC_FALCON_IMEMT0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
|-
| 20
| 0-15
| RSTAT0_HALTSTOP_FLUSH
| TSEC_FALCON_IMEMT_TAG
|}
Returns or takes the virtual page index for an IMEM read/write operation.
=== TSEC_FALCON_DMEMC0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
|-
| 21
| 2-7
| RSTAT0_AFILL_FLUSH
| TSEC_FALCON_DMEMC_OFFS
|-
|-
| 22
| 8-15
| RSTAT0_EXC_FLUSH
| TSEC_FALCON_DMEMC_BLK
|-
|-
| 23-25
| 24
| RSTAT0_IRQ_FLUSH
| TSEC_FALCON_DMEMC_AINCW
|-
|-
| 28
| 25
| RSTAT0_VALIDRD
| TSEC_FALCON_DMEMC_AINCR
|-
|}
Used for configuring access to Falcon's DMEM.
|-
=== TSEC_FALCON_DMEMD0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
|-
| 31
| 0-31
| RSTAT0_MTHD_FULL
| TSEC_FALCON_DMEMD_DATA
|}
|}
Returns or takes the value for a DMEM read/write operation.
=== TSEC_FALCON_ICD_CMD ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
|-
|-
| 0-3
| 0-3
| RSTAT1_WB_ALLOC
| TSEC_FALCON_ICD_CMD_OPC
0x00: STOP
0x01: RUN (run from PC)
0x02: JRUN (run from address)
0x03: RUNB (run from PC)
0x04: JRUNB (run from address)
0x05: STEP (step from PC)
0x06: JSTEP (step from address)
0x07: EMASK (set exception mask)
0x08: RREG (read register)
0x09: WREG (write register)
0x0A: RDM (read data memory)
0x0B: WDM (write data memory)
0x0C: RCM (read MMIO/configuration memory)
0x0D: WCM (write MMIO/configuration memory)
0x0E: RSTAT (read status)
0x0F: SBU
|-
|-
| 10-11
| 6-7
| RSTAT1_WB1_SZ
| TSEC_FALCON_ICD_CMD_SZ
0x00: B (byte)
0x01: HW (half word)
0x02: W (word)
|-
|-
| 12-13
| 8-12
| RSTAT1_WB2_SZ
| TSEC_FALCON_ICD_CMD_IDX
|-
0x00: REG0 | RSTAT0 | WB0
| 14-15
0x01: REG1 | RSTAT1 | WB1
| RSTAT1_WB3_SZ
0x02: REG2 | RSTAT2 | WB2
|-
0x03: REG3 | RSTAT3 | WB3
| 16-19
0x04: REG4 | RSTAT4
| RSTAT1_WB0_IDX
0x05: REG5 | RSTAT5
0x06: REG6
0x07: REG7
0x08: REG8
0x09: REG9
0x0A: REG10
0x0B: REG11
0x0C: REG12
0x0D: REG13
0x0E: REG14
0x0F: REG15
0x10: IV0
0x11: IV1
0x12: UNDEFINED
0x13: EV
0x14: SP
0x15: PC
0x16: IMB
0x17: DMB
0x18: CSW
0x19: CCR
0x1A: SEC
0x1B: CTX
0x1C: EXCI
0x1D: SEC1
0x1E: IMB1
0x1F: DMB1
|-
|-
| 24-27
| 14
| RSTAT1_WB2_IDX
| TSEC_FALCON_ICD_CMD_ERROR
|-
|-
| 28-31
| 15
| RSTAT1_WB3_IDX
| TSEC_FALCON_ICD_CMD_RDVLD
|-
|-
| 0-3
| 16-31
| RSTAT2_DMAQ_NUM
| TSEC_FALCON_ICD_CMD_PARM
0x0001: EMASK_TRAP0
0x0002: EMASK_TRAP1
0x0004: EMASK_TRAP2
0x0008: EMASK_TRAP3
0x0010: EMASK_EXC_UNIMP
0x0020: EMASK_EXC_IMISS
0x0040: EMASK_EXC_IMHIT
0x0080: EMASK_EXC_IBREAK
0x0100: EMASK_IV0
0x0200: EMASK_IV1
0x0400: EMASK_IV2
0x0800: EMASK_EXT0
0x1000: EMASK_EXT1
0x2000: EMASK_EXT2
0x4000: EMASK_EXT3
0x8000: EMASK_EXT4
|}
Used for sending commands to the Falcon's in-chip debugger.
=== TSEC_FALCON_ICD_ADDR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
|-
| 4
| 0-31
| RSTAT2_DMA_ENABLE
| TSEC_FALCON_ICD_ADDR_ADDR
|}
Takes the target address for the Falcon's in-chip debugger.
=== TSEC_FALCON_ICD_WDATA ===
{| class="wikitable" border="1"
! Bits
! Description
|-
|-
| 5-7
| 0-31
| RSTAT2_LDSTQ_NUM
| TSEC_FALCON_ICD_WDATA_DATA
|}
Takes the data for writing using the Falcon's in-chip debugger.
=== TSEC_FALCON_ICD_RDATA ===
{| class="wikitable" border="1"
! Bits
! Description
|-
|-
| 16-19
| 0-31
| TSEC_FALCON_ICD_RDATA_DATA
| RSTAT2_EM_DVLD
|}
|}
Returns the data read using the Falcon's in-chip debugger.
When reading from an internal status register (STAT), the following applies:
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
|-
|-
| 0
| 0
| RSTAT3_MTHD_IDLE
| RSTAT0_MEM_STALL
|-
|-
| 1
| 1
| RSTAT3_CTXSW_IDLE
| RSTAT0_DMA_STALL
|-
|-
| 2
| 2
| RSTAT3_DMA_IDLE
| RSTAT0_FENCE_STALL
|-
|-
| 3
| 3
| RSTAT3_SCP_IDLE
| RSTAT0_DIV_STALL
|-
|-
| 4
| 4
| RSTAT3_LDST_IDLE
| RSTAT0_DMA_STALL_DMAQ
|-
|-
| 5
| 5
| RSTAT3_SBWB_EMPTY
| RSTAT0_DMA_STALL_DMWAITING
|-
|-
| 6-8
| 6
| RSTAT3_CSWIE
| RSTAT0_DMA_STALL_IMWAITING
|-
|-
| 10
| 7
| RSTAT3_CSWE
| RSTAT0_ANY_STALL
|-
|-
| 12-14
| 8
| RSTAT3_CTXSW_STATE
| RSTAT0_SBFULL_STALL
|-
|-
| 15
| 9
| RSTAT3_CTXSW_PEND
| RSTAT0_SBHIT_STALL
|-
|-
| 17
| 10
| RSTAT3_DMA_FBREQ_IDLE
| RSTAT0_FLOW_STALL
|-
|-
| 18
| 11
| RSTAT3_DMA_ACKQ_EMPTY
| RSTAT0_SP_STALL
|-
|-
| 19
| 12
| RSTAT3_DMA_RDQ_EMPTY
| RSTAT0_BL_STALL
|-
| 13
| RSTAT0_IPND_STALL
|-
| 14
| RSTAT0_LDSTQ_STALL
|-
| 16
| RSTAT0_NOINSTR_STALL
|-
|-
| 20
| 20
| RSTAT3_DMA_WR_BUSY
| RSTAT0_HALTSTOP_FLUSH
|-
|-
| 21
| 21
| RSTAT3_DMA_RD_BUSY
| RSTAT0_AFILL_FLUSH
|-
|-
| 22
| 22
| RSTAT3_LDST_XT_BUSY
| RSTAT0_EXC_FLUSH
|-
| 23-25
| RSTAT0_IRQ_FLUSH
|-
| 28
| RSTAT0_VALIDRD
|-
| 29
| RSTAT0_WAITING
|-
|-
| 23
| 30
| RSTAT3_LDST_XT_BLOCK
| RSTAT0_HALTED
|-
|-
| 24
| 31
| RSTAT3_ENG_IDLE
| RSTAT0_MTHD_FULL
|}
|}
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Description
! Description
|-
|-
| 0-1
| 0-3
| RSTAT4_ICD_STATE
| RSTAT1_WB_ALLOC
|-
|-
| 2-3
| 4-7
| RSTAT4_ICD_MODE
| RSTAT1_WB_VALID
|-
|-
| 16
| 8-9
| RSTAT4_ICD_EMASK_TRAP0
| RSTAT1_WB0_SZ
|-
|-
| 17
| 10-11
| RSTAT4_ICD_EMASK_TRAP1
| RSTAT1_WB1_SZ
|-
|-
| 18
| 12-13
| RSTAT4_ICD_EMASK_TRAP2
| RSTAT1_WB2_SZ
|-
|-
| 19
| 14-15
| RSTAT4_ICD_EMASK_TRAP3
| RSTAT1_WB3_SZ
|-
|-
| 20
| 16-19
| RSTAT4_ICD_EMASK_EXC_UNIMP
| RSTAT1_WB0_IDX
|-
|-
| 21
| 20-23
| RSTAT4_ICD_EMASK_EXC_IMISS
| RSTAT1_WB1_IDX
|-
|-
| 22
| 24-27
| RSTAT4_ICD_EMASK_EXC_IMHIT
| RSTAT1_WB2_IDX
|-
|-
| 23
| 28-31
| RSTAT4_ICD_EMASK_EXC_IBREAK
| RSTAT1_WB3_IDX
|}
{| class="wikitable" border="1"
! Bits
! Description
|-
|-
| 24
| 0-3
| RSTAT4_ICD_EMASK_IV0
| RSTAT2_DMAQ_NUM
|-
|-
| 25
| 4
| RSTAT4_ICD_EMASK_IV1
| RSTAT2_DMA_ENABLE
|-
|-
| 26
| 5-7
| RSTAT4_ICD_EMASK_IV2
| RSTAT2_LDSTQ_NUM
|-
|-
| 27
| 16-19
| RSTAT4_ICD_EMASK_EXT0
| RSTAT2_EM_BUSY
|-
|-
| 28
| 20-23
| RSTAT4_ICD_EMASK_EXT1
| RSTAT2_EM_ACKED
|-
|-
| 29
| 24-27
| RSTAT4_ICD_EMASK_EXT2
| RSTAT2_EM_ISWR
|-
|-
| 30
| 28-31
| RSTAT2_EM_DVLD
| RSTAT4_ICD_EMASK_EXT4
|}
|}
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Description
! Description
|-
|-
| 0-7
| 0
| RSTAT5_LRU_STATE
| RSTAT3_MTHD_IDLE
|}
|-
| 1
| RSTAT3_CTXSW_IDLE
|-
|-
| 0-1
| 2
| FALCON_SCTL_SEC_MODE
| RSTAT3_DMA_IDLE
|-
|-
| 4-5
| 3
| FALCON_SCTL_OLD_SEC_MODE
| RSTAT3_SCP_IDLE
|-
|-
| 12-13
| 4
| Unknown
| RSTAT3_LDST_IDLE
|-
|-
| 14
| 5
| Initialize the transition to LS mode
| RSTAT3_SBWB_EMPTY
|-
|-
| 31
| 6-8
| Set on memory protection violation
| RSTAT3_CSWIE
|-
|-
| 0-3
| 10
| Read access level
| RSTAT3_CSWE
|-
|-
| 4-7
| 12-14
| Write access level
| RSTAT3_CTXSW_STATE
0x00: IDLE
0x01: SM_CHECK
0x02: SM_SAVE
0x03: SM_SAVE_WAIT
0x04: SM_BLK_BIND
0x05: SM_RESET
0x06: SM_RESETWAIT
0x07: SM_ACK
|-
|-
| 0-3
| 15
| Read access level
| RSTAT3_CTXSW_PEND
|-
|-
| 4-7
| 17
| Write access level
| RSTAT3_DMA_FBREQ_IDLE
|-
|-
| 0-3
| 18
| Read access level
| RSTAT3_DMA_ACKQ_EMPTY
|-
|-
| 4-7
| 19
| Write access level
| RSTAT3_DMA_RDQ_EMPTY
|}
|-
| 20
| RSTAT3_DMA_WR_BUSY
|-
| 21
| RSTAT3_DMA_RD_BUSY
|-
| 22
| RSTAT3_LDST_XT_BUSY
|-
|-
| 0-3
| 23
| Read access level
| RSTAT3_LDST_XT_BLOCK
|-
|-
| 4-7
| 24
| Write access level
| RSTAT3_ENG_IDLE
|}
|}
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0-3
| 0-1
| Read access level
| RSTAT4_ICD_STATE
0x00: NORMAL
0x01: WAIT_ISSUE_CLEAR
0x02: WAIT_EXLDQ_CLEAR
0x03: FULL_DBG_MODE
|-
|-
| 4-7
| 2-3
| Write access level
| RSTAT4_ICD_MODE
0x00: SUPPRESSICD
0x01: ENTERICD_IBRK
0x02: ENTERICD_STEP
|-
|-
| 0-3
| 16
| Read access level
| RSTAT4_ICD_EMASK_TRAP0
|-
|-
| 4-7
| 17
| Write access level
| RSTAT4_ICD_EMASK_TRAP1
|-
|-
| 0-3
| 18
| Read access level
| RSTAT4_ICD_EMASK_TRAP2
|-
|-
| 4-7
| 19
| Write access level
| RSTAT4_ICD_EMASK_TRAP3
|-
|-
| 0-3
| 20
| Read access level
| RSTAT4_ICD_EMASK_EXC_UNIMP
|-
|-
| 4-7
| 21
| Write access level
| RSTAT4_ICD_EMASK_EXC_IMISS
|-
|-
| 20
| 22
| Enable TSEC_SCP_INSN_STAT register
| RSTAT4_ICD_EMASK_EXC_IMHIT
|}
|-
| 23
| RSTAT4_ICD_EMASK_EXC_IBREAK
|-
| 24
| RSTAT4_ICD_EMASK_IV0
|-
| 25
| RSTAT4_ICD_EMASK_IV1
|-
| 26
| RSTAT4_ICD_EMASK_IV2
|-
| 27
| RSTAT4_ICD_EMASK_EXT0
|-
| 28
| RSTAT4_ICD_EMASK_EXT1
|-
| 29
| RSTAT4_ICD_EMASK_EXT2
|-
|-
| 11
| 30
| Enable TRNG testing mode
| RSTAT4_ICD_EMASK_EXT3
|-
|-
| 12
| 31
| Enable the TRNG
| RSTAT4_ICD_EMASK_EXT4
|}
|}
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 20
| 0-7
| TSEC_SCP_CTL_STAT_DEBUG_MODE
| RSTAT5_LRU_STATE
|}
|}
=== TSEC_SCP_CTL_LOCK ===
=== TSEC_FALCON_SCTL ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0
| 0-1
| Disable reads for the SCP and TRNG register blocks
| TSEC_FALCON_SCTL_SEC_MODE
0: Non-secure
1: Light Secure
2: Heavy Secure
|-
|-
| 1
| 4-5
| TSEC_FALCON_SCTL_OLD_SEC_MODE
0: Non-secure
1: Light Secure
2: Heavy Secure
|-
|-
| 2
| 12-13
| Disable reads for the DMA register block
| Unknown
|-
|-
| 3
| 14
| Disable reads for the TEGRA register block
| Initialize the transition to LS mode
|}
|}
=== TSEC_FALCON_SSTAT ===
=== TSEC_SCP_CTL_PKEY ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0
| 31
| TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
| Set on memory protection violation
|}
=== TSEC_FALCON_SPROT_IMEM ===
{| class="wikitable" border="1"
! Bits
! Description
|-
|-
| 1
| 0-3
| TSEC_SCP_CTL_PKEY_LOADED
| Read access level
|-
| 4-7
| Write access level
|}
|}
=== TSEC_SCP_SEQ_CTL ===
Controls accesses to Falcon IMEM.
=== TSEC_FALCON_SPROT_DMEM ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
|-
|-
| 0-3
| 0-3
| Sequence's instruction index
| Read access level
|-
|-
| 4-7
| 4-7
| Target and control flags
| Write access level
|}
|}
Controls the last crypto sequence (cs0 or cs1) created.
Controls accesses to Falcon DMEM.
=== TSEC_SCP_SEQ_VAL ===
=== TSEC_FALCON_SPROT_CPUCTL ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
|-
|-
| 0-3
| 0-3
| Sequence instruction's first operand
| Read access level
|-
|-
| 4-9
| 4-7
| Sequence instruction's second operand
| Write access level
|}
|}
Controls accesses to the [[#TSEC_FALCON_CPUCTL|TSEC_FALCON_CPUCTL]] register.
=== TSEC_SCP_SEQ_STAT ===
=== TSEC_FALCON_SPROT_MISC ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0
| 0-3
| Set if crypto sequence recording (cs0begin/cs1begin) is active
| Read access level
|-
|-
| 4-7
| 4-7
| Number of instructions left for the crypto sequence
| Write access level
|}
|}
Controls accesses to the following registers:
* TSEC_FALCON_PRIVSTATE
* TSEC_FALCON_SFTRESET
* TSEC_FALCON_ADDR
* [[#TSEC_FALCON_DMACTL|TSEC_FALCON_DMACTL]]
* [[#TSEC_FALCON_IMCTL|TSEC_FALCON_IMCTL]]
* [[#TSEC_FALCON_IMSTAT|TSEC_FALCON_IMSTAT]]
* TSEC_FALCON_UNK_250
* TSEC_FALCON_DMAINFO_CTL
=== TSEC_SCP_INSN_STAT ===
=== TSEC_FALCON_SPROT_IRQ ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
|-
|-
| 0-3
| 0-3
| Destination register or immediate value
| Read access level
|-
|-
| 8-13
| 4-7
| Source register or immediate value
| Write access level
|}
Controls accesses to the following registers:
* [[#TSEC_FALCON_IRQMODE|TSEC_FALCON_IRQMODE]]
* [[#TSEC_FALCON_IRQMSET|TSEC_FALCON_IRQMSET]]
* [[#TSEC_FALCON_IRQMCLR|TSEC_FALCON_IRQMCLR]]
* [[#TSEC_FALCON_IRQDEST|TSEC_FALCON_IRQDEST]]
* TSEC_FALCON_GPTMRINT
* TSEC_FALCON_GPTMRVAL
* TSEC_FALCON_GPTMRCTL
* TSEC_FALCON_IRQDEST2
* TSEC_FALCON_UNK_E0
=== TSEC_FALCON_SPROT_MTHD ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Read access level
|-
|-
| 20-24
| 4-7
| Operation
| Write access level
|}
Controls accesses to the following registers:
* [[#TSEC_FALCON_ITFEN|TSEC_FALCON_ITFEN]]
* TSEC_FALCON_CURCTX
* TSEC_FALCON_NXTCTX
* TSEC_FALCON_CTXACK
* TSEC_FALCON_MTHDDATA
* TSEC_FALCON_MTHDID
* TSEC_FALCON_MTHDWDAT
* TSEC_FALCON_MTHDCOUNT
* TSEC_FALCON_MTHDPOP
* TSEC_FALCON_MTHDRAMSZ
* [[#TSEC_FALCON_DEBUG1|TSEC_FALCON_DEBUG1]]
=== TSEC_FALCON_SPROT_SCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
|-
| 28
| 0-3
| Set if the instruction is valid
| Read access level
|-
|-
| 31
| 4-7
| Set if running in HS mode
| Write access level
|}
|}
Controls accesses to the [[#TSEC_FALCON_SCTL|TSEC_FALCON_SCTL]] register.
=== TSEC_SCP_AUTH_STAT ===
=== TSEC_FALCON_SPROT_WDTMR ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0-1
| 0-3
| Signature comparison result (3=succeeded, 2=failed)
| Read access level
|-
| 4-7
| Write access level
|}
|}
Controls accesses to the following registers:
* TSEC_FALCON_WDTMRVAL
* TSEC_FALCON_WDTMRCTL
=== TSEC_SCP_AES_STAT ===
=== TSEC_SCP_CTL0 ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0-4
| 20
| First opcode
| Enable the [[#TSEC_SCP_CMD|TSEC_SCP_CMD]] register
|-
|-
| 5-9
| 16
| Second opcode
| Enable the SEQ controller
|-
|-
| 15-16
| 14
| AES operation
| Enable the CMD interface
|-
| 12
| Enable the STORE interface
|-
| 10
| Enable the LOAD interface
|}
|}
=== TSEC_SCP_CTL1 ===
=== TSEC_SCP_IRQSTAT ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
|-
|-
| 0
| 0
| TSEC_SCP_IRQSTAT_TRNG
| Flush SEQ controller
|-
|-
| 8
| 11
| TSEC_SCP_IRQSTAT_ACL_ERROR
| Enable RND test mode
|-
|-
| 12
| 12
| Unknown
| Enable the RND controller
|}
|}
=== TSEC_SCP_CFG ===
=== TSEC_SCP_IRQMASK ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0
| 16-31
| Timeout value
|}
| 8
=== TSEC_SCP_CTL_STAT ===
|-
{| class="wikitable" border="1"
! Bits
! Description
|-
|-
|-
| 20
| 20
| TSEC_SCP_IRQMASK_SINGLE_STEP
| TSEC_SCP_CTL_STAT_DEBUG_MODE
|}
|}
=== TSEC_SCP_CTL_LOCK ===
=== TSEC_SCP_ACL_ERR ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
|-
|-
| 0
| 0
| Set when writing to a crypto register without the correct ACL
| Enable lockdown mode
|-
|-
| 4
| 4
| Set when reading from a crypto register without the correct ACL
| Lock SCP and RND
|}
|}
Controls lockdown mode and can only be cleared in Heavy Secure mode.
=== TSEC_SCP_INSN_ERR ===
=== TSEC_SCP_CTL_PKEY ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
|-
|-
| 0
| 0
| Invalid instruction
| TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
|-
|-
| 4
| 1
| Empty crypto sequence
| TSEC_SCP_CTL_PKEY_LOADED
|-
|}
| 8
=== TSEC_SCP_DBG0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
|-
| 12
| 0-3
| Crypto sequence was not finished
| Index
|-
|-
| 16
| 4
| Insecure signature (csigenc, csigclr or csigauth)
| Automatic increment
|-
|-
| 20
| 5-6
| Invalid signature (csigauth in HS mode)
| Target
0: None
1: Unknown
2: Unknown
3: SEQ
|-
|-
| 24
| 8-12
| Forbidden ACL change (cchmod in NS mode)
| SEQ size
|}
|}
Used for debugging crypto controllers such as the SEQ (crypto sequence).
=== TSEC_TFBIF_MCCIF_FIFOCTRL ===
=== TSEC_SCP_DBG1 ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0
| 0-3
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
| SEQ instruction's first operand
|-
|-
| 1
| 4-9
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
| SEQ instruction's second operand
|-
|-
| 2
| 10-14
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
| SEQ instruction's opcode
|}
Used for retrieving debug data. Contains information on the last crypto sequence created when debugging the SEQ controller.
=== TSEC_SCP_DBG2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
|-
| 3
| 0-1
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
| SEQ state
0: Idle
1: Recording is active (cs0begin/cs1begin)
|-
|-
| 4
| 4-7
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
| Number of SEQ instructions left
|-
|-
| 5
| 12-15
| Active crypto key register
| 8
|}
|}
Used for retrieving additional debug data associated with the SEQ controller.
=== TSEC_TFBIF_MMU_PROT ===
=== TSEC_SCP_CMD ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
|-
|-
| 0-3
| 0-3
| Read access level
| Destination register
|-
|-
| 4-7
| 8-13
| Write access level
| Source register or immediate value
|-
| 20-24
| Command opcode
0x0: nop (fuc5 opcode 0x00)
0x1: cmov (fuc5 opcode 0x84)
0x2: cxsin (fuc5 opcode 0x88) or xdst (with cxset)
0x3: cxsout (fuc5 opcode 0x8C) or xdld (with cxset)
0x4: crnd (fuc5 opcode 0x90)
0x5: cs0begin (fuc5 opcode 0x94)
0x6: cs0exec (fuc5 opcode 0x98)
0x7: cs1begin (fuc5 opcode 0x9C)
0x8: cs1exec (fuc5 opcode 0xA0)
0x9: invalid (fuc5 opcode 0xA4)
0xA: cchmod (fuc5 opcode 0xA8)
0xB: cxor (fuc5 opcode 0xAC)
0xC: cadd (fuc5 opcode 0xB0)
0xD: cand (fuc5 opcode 0xB4)
0xE: crev (fuc5 opcode 0xB8)
0xF: cprecmac (fuc5 opcode 0xBC)
0x10: csecret (fuc5 opcode 0xC0)
0x11: ckeyreg (fuc5 opcode 0xC4)
0x12: ckexp (fuc5 opcode 0xC8)
0x13: ckrexp (fuc5 opcode 0xCC)
0x14: cenc (fuc5 opcode 0xD0)
0x15: cdec (fuc5 opcode 0xD4)
0x16: csigauth (fuc5 opcode 0xD8)
0x17: csigenc (fuc5 opcode 0xDC)
0x18: csigclr (fuc5 opcode 0xE0)
|-
| 28
| Set if the command is valid
|-
| 31
| Set if running in HS mode
|}
|}
Contains information on the last crypto command executed.
=== TSEC_TFBIF_MMU_PHYS_SEC ===
=== TSEC_SCP_STAT0 ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0
| 0
| Bypass MMU translation on CTXDMA port 0
| SCP is active
|-
|-
| 4
| 2
| Bypass MMU translation on CTXDMA port 1
| CMD interface is active
|-
|-
| 8
| 6
| Bypass MMU translation on CTXDMA port 2
| SEQ controller is active
|-
|-
| 12
| 14
| Bypass MMU translation on CTXDMA port 3
| AES controller is active
|-
|-
| 16
| 16
| Bypass MMU translation on CTXDMA port 4
| RND controller is active
|-
|}
| 20
| Bypass MMU translation on CTXDMA port 5
Contains the status of the crypto controllers and interfaces.
|-
| 24
=== TSEC_SCP_STAT1 ===
| Bypass MMU translation on CTXDMA port 6
{| class="wikitable" border="1"
|-
! Bits
| 28
! Description
| Bypass MMU translation on CTXDMA port 7
|-
| 0-1
| Signature comparison result
0: None
1: Running
2: Failed
3: Succeeded
|}
Contains the status of the last authentication attempt.
=== TSEC_SCP_STAT2 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-4
| Current SEQ opcode
|-
| 5-9
| Current CMD opcode
|-
| 10-14
| Pending CMD opcode
|-
| 15-16
| AES operation
0: Encryption
1: Decryption
2: Key expansion
3: Key reverse expansion
|-
| 25
| STORE operation is stalled
|-
| 26
| LOAD operation is stalled
|-
| 27
| RND operation is stalled
|-
| 29
| AES operation is stalled
|}
Contains the status of crypto operations.
=== TSEC_SCP_RND_STAT0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| RND is ready
|}
Contains the status of the RND controller.
=== TSEC_SCP_IRQSTAT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| RND ready
|-
| 8
| ACL error
|-
| 12
| SEC error
|-
| 16
| CMD error
|-
| 20
| Single step
|-
| 24
| RND called
|-
| 28
| Timeout
|}
Used for getting the status of crypto IRQs.
=== TSEC_SCP_IRQMASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| RND ready
|-
| 8
| ACL error
|-
| 12
| SEC error
|-
| 16
| CMD error
|-
| 20
| Single step
|-
| 24
| RND called
|-
| 28
| Timeout
|}
Used for getting the value of the mask for crypto IRQs.
=== TSEC_SCP_ACL_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Writing to a crypto register without the correct ACL
|-
| 4
| Reading from a crypto register without the correct ACL
|-
| 8
| Invalid ACL change (cchmod)
|-
| 31
| ACL error occurred
|}
Contains information on errors generated by the [[#TSEC_SCP_IRQSTAT|ACL error]] IRQ.
=== TSEC_SCP_CMD_ERR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Invalid command
|-
| 4
| Empty crypto sequence
|-
| 8
| Crypto sequence is too long
|-
| 12
| Crypto sequence was not finished
|-
| 16
| Insecure signature (csigenc, csigclr or csigauth)
|-
| 20
| Invalid signature (csigauth in HS mode)
|-
| 24
| Forbidden ACL change (cchmod in NS mode)
|}
Contains information on errors generated by the [[#TSEC_SCP_IRQSTAT|CMD error]] IRQ.
=== TSEC_RND_CTL0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| RND clock trigger lower limit
|}
=== TSEC_RND_CTL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| RND clock trigger upper limit
|-
| 16-31
| RND clock trigger mask
|}
=== TSEC_TFBIF_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_CTL_CLR_BWCOUNT
|-
| 1
| TSEC_TFBIF_CTL_ENABLE
|-
| 2
| TSEC_TFBIF_CTL_CLR_IDLEWDERR
|-
| 3
| TSEC_TFBIF_CTL_RESET
|-
| 4
| TSEC_TFBIF_CTL_IDLE
|-
| 5
| TSEC_TFBIF_CTL_IDLEWDERR
|-
| 6
| TSEC_TFBIF_CTL_SRTOUT
|-
| 7
| TSEC_TFBIF_CTL_CLR_SRTOUT
|-
| 8-11
| TSEC_TFBIF_CTL_SRTOVAL
|-
| 12
| TSEC_TFBIF_CTL_VPR
|}
=== TSEC_TFBIF_MCCIF_FIFOCTRL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
|-
| 1
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
|-
| 2
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
|-
| 3
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
|-
| 4
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
|-
| 5
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
|-
| 6
| TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
|-
| 7
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
|-
| 8
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE
|}
=== TSEC_TFBIF_MCCIF_FIFOCTRL1 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
|-
| 16-31
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT
|}
=== TSEC_TFBIF_THROTTLE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-11
| TSEC_TFBIF_THROTTLE_BUCKET_SIZE
|-
| 16-27
| TSEC_TFBIF_THROTTLE_LEAK_COUNT
|-
| 30-31
| TSEC_TFBIF_THROTTLE_LEAK_SIZE
|}
=== TSEC_TFBIF_DBG_STAT0 ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_DBG_STAT0_1K_TRANSFER
|-
| 1
| TSEC_TFBIF_DBG_STAT0_RREQ_ISSUED
|-
| 2
| TSEC_TFBIF_DBG_STAT0_WREQ_ISSUED
|-
| 3
| TSEC_TFBIF_DBG_STAT0_TAGQ_ISSUED
|-
| 4
| TSEC_TFBIF_DBG_STAT0_STALL_RDATQ
|-
| 5
| TSEC_TFBIF_DBG_STAT0_STALL_RACKQ
|-
| 6
| TSEC_TFBIF_DBG_STAT0_STALL_WREQQ
|-
| 7
| TSEC_TFBIF_DBG_STAT0_STALL_WDATQ
|-
| 8
| TSEC_TFBIF_DBG_STAT0_STALL_WACKQ
|-
| 9
| TSEC_TFBIF_DBG_STAT0_STALL_RREQ_PENDING
|-
| 10
| TSEC_TFBIF_DBG_STAT0_STALL_WREQ_PENDING
|-
| 11
| TSEC_TFBIF_DBG_STAT0_STALL_MREQ
|-
| 12
| TSEC_TFBIF_DBG_STAT0_ENGINE_IDLE
|-
| 13
| TSEC_TFBIF_DBG_STAT0_RMCCIF_IDLE
|-
| 14
| TSEC_TFBIF_DBG_STAT0_WMCCIF_IDLE
|-
| 15
| TSEC_TFBIF_DBG_STAT0_CSB_IDLE
|-
| 16
| TSEC_TFBIF_DBG_STAT0_RU_IDLE
|-
| 17
| TSEC_TFBIF_DBG_STAT0_WU_IDLE
|-
| 19
| TSEC_TFBIF_DBG_STAT0_UNWEIGHT_ACTMON_ACTIVE
|-
| 20
| TSEC_TFBIF_DBG_STAT0_UNWEIGHT_ACTMON_MCB
|}
=== TSEC_TFBIF_SPROT_EMEM ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| Read access level
|-
| 4-7
| Write access level
|}
Controls accesses to external memory regions. Accessible in HS mode only.
=== TSEC_TFBIF_TRANSCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_TRANSCFG_ATT0_SWID
|-
| 4
| TSEC_TFBIF_TRANSCFG_ATT1_SWID
|-
| 8
| TSEC_TFBIF_TRANSCFG_ATT2_SWID
|-
| 12
| TSEC_TFBIF_TRANSCFG_ATT3_SWID
|-
| 16
| TSEC_TFBIF_TRANSCFG_ATT4_SWID
|-
| 20
| TSEC_TFBIF_TRANSCFG_ATT5_SWID
|-
| 24
| TSEC_TFBIF_TRANSCFG_ATT6_SWID
|-
| 28
| TSEC_TFBIF_TRANSCFG_ATT7_SWID
|}
Configures the software ID per CTXDMA port for memory transactions. Software ID 0 (HW_SWID) forces all transactions to go through the SMMU while software ID 1 (PHY_SWID) bypasses it. Accessible in HS mode only.
[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.
=== TSEC_TFBIF_REGIONCFG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-2
| TSEC_TFBIF_REGIONCFG_T0_APERT_ID
|-
| 3
| TSEC_TFBIF_REGIONCFG_T0_VPR
|-
| 4-6
| TSEC_TFBIF_REGIONCFG_T1_APERT_ID
|-
| 7
| TSEC_TFBIF_REGIONCFG_T1_VPR
|-
| 8-10
| TSEC_TFBIF_REGIONCFG_T2_APERT_ID
|-
| 11
| TSEC_TFBIF_REGIONCFG_T2_VPR
|-
| 12-14
| TSEC_TFBIF_REGIONCFG_T3_APERT_ID
|-
| 15
| TSEC_TFBIF_REGIONCFG_T3_VPR
|-
| 16-18
| TSEC_TFBIF_REGIONCFG_T4_APERT_ID
|-
| 19
| TSEC_TFBIF_REGIONCFG_T4_VPR
|-
| 20-22
| TSEC_TFBIF_REGIONCFG_T5_APERT_ID
|-
| 23
| TSEC_TFBIF_REGIONCFG_T5_VPR
|-
| 24-26
| TSEC_TFBIF_REGIONCFG_T6_APERT_ID
|-
| 27
| TSEC_TFBIF_REGIONCFG_T6_VPR
|-
| 28-30
| TSEC_TFBIF_REGIONCFG_T7_APERT_ID
|-
| 31
| TSEC_TFBIF_REGIONCFG_T7_VPR
|}
Configures the aperture ID and VPR mode per CTXDMA port for memory region accessing. Accessible in HS mode only.
[6.0.0+] The nvhost_tsec firmware sets this register to 0x20 or 0x140 before reading memory from the GPU UCODE carveout.
=== TSEC_TFBIF_ACTMON_ACTIVE_MASK ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_ACTMON_ACTIVE_MASK_STARVED_MC
|-
| 1
| TSEC_TFBIF_ACTMON_ACTIVE_MASK_STALLED_MC
|-
| 2
| TSEC_TFBIF_ACTMON_ACTIVE_MASK_DELAYED_MC
|-
| 3
| TSEC_TFBIF_ACTMON_ACTIVE_MASK_ACTIVE
|}
Takes the memory access mask for the Activity Monitor. Disconnected on the TSEC, but available on NVDEC, NVENC and NVJPG.
=== TSEC_TFBIF_ACTMON_ACTIVE_BORPS ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_STARVED_MC_POLARITY
|-
| 1
| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_STARVED_MC_OPERATION
|-
| 2
| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_STALLED_MC_POLARITY
|-
| 3
| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_STALLED_MC_OPERATION
|-
| 4
| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_DELAYED_MC_POLARITY
|-
| 5
| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_DELAYED_MC_OPERATION
|-
| 6
| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_ACTIVE_POLARITY
|-
| 7
| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_ACTIVE_OPERATION
|}
Takes the billions of records per second count for the Activity Monitor. Disconnected on the TSEC, but available on NVDEC, NVENC and NVJPG.
=== TSEC_TFBIF_ACTMON_ACTIVE_WEIGHT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_TFBIF_ACTMON_ACTIVE_WEIGHT_VAL
|}
Controls the Activity Monitor. Disconnected on the TSEC, but available on NVDEC, NVENC and NVJPG.
=== TSEC_CG ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-5
| TSEC_CG_IDLE_CG_DLY_CNT
|-
| 6
| TSEC_CG_IDLE_CG_EN
|-
| 16-18
| TSEC_CG_WAKEUP_DLY_CNT
|-
| 19
| TSEC_CG_WAKEUP_DLY_EN
|}
=== TSEC_BAR0_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| TSEC_BAR0_CTL_READ
|-
| 1
| TSEC_BAR0_CTL_WRITE
|-
| 4-7
| TSEC_BAR0_CTL_BYTE_MASK
|-
| 12-13
| TSEC_BAR0_CTL_STATUS
0: Idle
1: Busy
2: Error
3: Disabled
|-
| 31
| TSEC_BAR0_CTL_INIT
|}
A BAR0 DMA read/write operation requires bits TSEC_BAR0_CTL_INIT and TSEC_BAR0_CTL_READ/TSEC_BAR0_CTL_WRITE to be set in TSEC_BAR0_CTL.
During the transfer, TSEC_BAR0_CTL_STATUS is set to "Busy".
Accessing an invalid address sets TSEC_BAR0_CTL_STATUS to "Error".
=== TSEC_BAR0_ADDR ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_BAR0_ADDR_VAL
|}
Takes the address for DMA transfers between TSEC and HOST1X (master and clients).
=== TSEC_BAR0_DATA ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_BAR0_DATA_VAL
|}
Takes the data for DMA transfers between TSEC and HOST1X (master and clients).
=== TSEC_BAR0_TIMEOUT ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| TSEC_BAR0_TIMEOUT_VAL
|}
Takes the timeout value for DMA transfers between TSEC and HOST1X (master and clients).
=== TSEC_TEGRA_CTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
| 16
| TSEC_TEGRA_CTL_TKFI_KFUSE
|-
| 17
| TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
|-
| 24
| TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
|-
| 25
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
|-
| 26
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
|-
| 27
| TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C
|}
== Falcon ==
"Falcon" (FAst Logic CONtroller) is a proprietary general purpose CPU which can be found inside various hardware blocks that require some sort of logic processing such as TSEC (TSECA and TSECB), NVDEC, NVENC, NVJPG, VIC, GPU PMU and XUSB.
=== Processor Registers ===
A total of 32 processor registers are available in the Falcon CPU.
==== REG0-REG15 ====
These are 16 32-bit GPRs (general purpose registers).
==== IV0 ====
This is a SPR (special purpose register) that holds the address for interrupt vector 0.
==== IV1 ====
This is a SPR (special purpose register) that holds the address for interrupt vector 1.
==== IV2 ====
This is a SPR (special purpose register) that holds the address for interrupt vector 2. This register is considered "UNDEFINED" and appears to be unused.
==== EV ====
This is a SPR (special purpose register) that holds the address for the exception vector.
Alternative name (envytools): "tv".
==== SP ====
This is a SPR (special purpose register) that holds the current stack pointer.
==== PC ====
This is a SPR (special purpose register) that holds the current program counter.
==== IMB ====
This is a SPR (special purpose register) that holds the external base address for IMEM transfers.
Alternative name (envytools): "xcbase".
==== DMB ====
This is a SPR (special purpose register) that holds the external base address for DMEM transfers.
Alternative name (envytools): "xdbase".
==== CSW ====
This is a SPR (special purpose register) that holds various flag bits.
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7 || General purpose predicates
|-
| 8 || ALU carry flag
|-
| 9 || ALU signed overflow flag
|-
| 10 || ALU sign flag
|-
| 11 || ALU zero flag
|-
| 12-15 || Unused
|-
| 16 || Interrupt 0 enable
|-
| 17 || Interrupt 1 enable
|-
| 18 || Interrupt 2 enable (undefined)
|-
| 19 || Unused
|-
| 20 || Interrupt 0 saved enable
|-
| 21 || Interrupt 1 saved enable
|-
| 22 || Interrupt 2 saved enable (undefined)
|-
| 23 || Unused
|-
| 24 || Exception active
|-
| 25 || Unused
|-
| 26 || Unknown
|-
| 27-28 || Unused
|-
| 29 || Unknown
|-
| 30-31 || Unused
|}
Alternative name (envytools): "flags".
==== CCR ====
This is a SPR (special purpose register) that holds configuration bits for the SCP DMA override functionality. The value of this register is set using the "cxset" instruction which provides a way to change the behavior of a variable amount of successively executed DMA-related instructions ("xdwait", "xdst" and "xdld").
{| class=wikitable
! Bits || Description
|-
| 0-4 || Number of instructions the override is valid for (0x1F means infinite)
|-
| 5 || Crypto destination/source select
0: Crypto register
1: Crypto stream
|-
| 6 || External memory override
0: Disabled
1: Enabled
|-
| 7 || Internal memory select
0: DMEM
1: IMEM
|-
| 8-31 || Unused
|}
Alternative name (envytools): "cx".
==== SEC ====
This is a SPR (special purpose register) that holds configuration bits for the SCP authentication process.
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7 || Start of region to authenticate (in 0x100 pages)
|-
| 8-15 || Unused
|-
| 16 || Mark all subsequent code transfers as secret
|-
| 17 || Region is encrypted
|-
| 18 || Unknown (set in HS mode)
|-
| 19 || Block traps and interrupts (set in HS mode)
|-
| 20-23 || Unused
|-
| 24-31 || Size of region to authenticate (in 0x100 pages)
|}
|}
Alternative name (envytools): "cauth".
==== CTX ====
This is a SPR (special purpose register) that holds configuration bits for the CTXDMA ports.
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0-3
| 0-2 || CTXDMA port for code loads (xcld)
| Transfer configuration for CTXDMA port 0
|-
|-
| 4-7
| 3 || Unused
| Transfer configuration for CTXDMA port 1
|-
|-
| 8-11
| 4-6 || CTXDMA port for code stores (invalid)
| Transfer configuration for CTXDMA port 2
|-
|-
| 12-15
| 7 || Unused
| Transfer configuration for CTXDMA port 3
|-
|-
| 16-19
| 8-10 || CTXDMA port for data loads (xdld)
| Transfer configuration for CTXDMA port 4
|-
|-
| 20-23
| 11 || Unused
| Transfer configuration for CTXDMA port 5
|-
|-
| 24-27
| 12-14 || CTXDMA port for data stores (xdst)
| Transfer configuration for CTXDMA port 6
|-
|-
| 28-31
| 15-31 || Unused
| Transfer configuration for CTXDMA port 7
|}
|}
Alternative name (envytools): "xtargets".
=== TSEC_CG ===
==== EXCI ====
This is a SPR (special purpose register) that holds information on raised exceptions.
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Bits
! Description
! Description
|-
|-
| 0
| 0-19 || Exception PC
| TSEC_BAR0_CTL_READ
|-
|-
| 1
| 20-23 || Exception cause
| TSEC_BAR0_CTL_WRITE
|-
|-
| 4-7
| 24-31 || Unused
| TSEC_BAR0_CTL_STATUS
| TSEC_BAR0_CTL_INIT
|}
|}
Alternative name (envytools): "tstatus".
==== SEC1 ====
Unknown. Marked as "RESERVED".
==== IMB1 ====
Unknown. Marked as "RESERVED".
=== TSEC_BAR0_ADDR ===
==== DMB1 ====
Unknown. Marked as "RESERVED".
== SCP ==
== SCP ==
Part of the information here (which hasn't made it into envytools documentation yet) was shared by [https://wiki.0x04.net/wiki/Marcin_Ko%C5%9Bcielnicki mwk] from reverse engineering falcon processors over the years.
Part of the information here (which hasn't made it into envytools documentation yet) was shared by [https://wiki.0x04.net/wiki/Marcin_Ko%C5%9Bcielnicki mwk] from reverse engineering falcon processors over the years.
=== Authenticated Mode ===
=== Heavy Secure Mode ===
==== Entry ====
==== Entry ====
From non-secure mode, upon jumping to a page marked as secret, a secret fault occurs. This causes the CPU to verify the region specified in $cauth against the MAC loaded in $c6. If the comparison is successful, the valid bit (bit0) is set on all pages in the $cauth region, and $pc is set to the base of the $cauth region. If the comparsion fails, the CPU is halted.
From non-secure mode, upon jumping to a page marked as secret, a secret fault occurs. This causes the CPU to verify the region specified in $cauth against the MAC loaded in $c6. If the comparison is successful, the valid bit (bit0) is set on all pages in the $cauth region, and $pc is set to the base of the $cauth region. If the comparsion fails, the CPU is halted.
==== Implementation ====
==== Implementation ====
Under certain circumstances, it is possible to observe [[#csigauth|csigauth]] being briefly written to [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]] as "csigauth $c4 $c6" while the opcodes in [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]] are set to "cxsin" and "csigauth", respectively.
Under certain circumstances, it is possible to observe [[#sigauth|sigauth]] being briefly written to [[#TSEC_SCP_CMD|TSEC_SCP_CMD]] as "csigauth $c4 $c6" while the opcodes in [[#TSEC_SCP_STAT2|TSEC_SCP_STAT2]] are set to "cxsin" and "csigauth", respectively.
Via [[#TSEC_SCP_SEQ_CTL|TSEC_SCP_SEQ_CTL]] it can be observed that a 3-sized macro sequence is loaded into cs0 during a secure mode transition.
Via [[#TSEC_SCP_DBG0|TSEC_SCP_DBG0]] it can be observed that a 3-sized macro sequence is loaded into cs0 during a secure mode transition.
=== Operations ===
=== Operations ===
| 3 || sout || $cX || N/A || <code>write_stream($cX);</code> || ?
| 3 || sout || $cX || N/A || <code>write_stream($cX);</code> || ?
|-
|-
| 4 || rnd || $cX || N/A || <code>$cX = read_trng(); ACL(X) = ???;</code> ||
| 4 || [[#rnd|rnd]] || $cX || N/A || <code>$cX = read_rnd(); ACL(X) = ???;</code> ||
|-
|-
| 5 || s0begin || immX || N/A || <code>record_macro_for_N_instructions(0, immX);</code> ||
| 5 || s0begin || immX || N/A || <code>record_macro_for_N_instructions(0, immX);</code> ||
| 9 || <invalid> || || || ||
| 9 || <invalid> || || || ||
|-
|-
| 0xA || chmod || $cX || immY || Complicated, see [[#ACL|ACL]]. ||
| 0xA || [[#chmod|chmod]] || $cX || immY || Complicated, see [[#ACL|ACL]]. ||
|-
|-
| 0xB || xor || $cX || $cY || <code>$cX ^= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
| 0xB || xor || $cX || $cY || <code>$cX ^= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
| 0x15 || dec || $cX || $cY || <code>$cX = aes_dec(active_key_idx, $cY); ACL(X) = ACL(active_key_idx) & ACL(Y);</code> ||
| 0x15 || dec || $cX || $cY || <code>$cX = aes_dec(active_key_idx, $cY); ACL(X) = ACL(active_key_idx) & ACL(Y);</code> ||
|-
|-
| 0x16 || csigauth || $cX || $cY || <code>if (hash_verify($cX, $cY)) { has_sig = true; current_sig = $cX; }</code> || ?
| 0x16 || [[#sigauth|sigauth]] || $cX || $cY || <code>if (hash_verify($cX, $cY)) { has_sig = true; current_sig = $cX; }</code> || ?
|-
|-
| 0x17 || csigclr || N/A || N/A || <code>has_sig = false;</code> ||
| 0x17 || [[#sigclr|sigclr]] || N/A || N/A || <code>has_sig = false;</code> ||
|-
|-
| 0x18 || csigenc || $cX || $cY || <code>if (has_sig) { $cX = aes_enc($cY, current_sig); ACL(X) = 0x13; }</code> ||
| 0x18 || sigenc || $cX || $cY || <code>if (has_sig) { $cX = aes_enc($cY, current_sig); ACL(X) = 0x13; }</code> ||
|}
|}
==== csigauth ====
==== sigauth ====
<code>00000000: f5 3c XY d8 csigauth $cY $cX</code>
<code>00000000: f5 3c XY d8 csigauth $cY $cX</code>
Takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret. This instruction does not work in secure mode.
Takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret. This instruction does not work in secure mode.
==== csigclr ====
==== sigclr ====
<code>00000000: f5 3c 00 e0 csigclr</code>
<code>00000000: f5 3c 00 e0 csigclr</code>
This instruction takes no operands and appears to clear the saved cauth signature used by the csigenc instruction.
This instruction takes no operands and clears the saved cauth signature used by the csigenc instruction.
==== cchmod ====
==== chmod ====
<code>00000000: f5 3c XY a8 cchmod $cY 0X</code> or <code>00000000: f5 3c XY a9 cchmod $cY 1X</code>
<code>00000000: f5 3c XY a8 cchmod $cY 0X</code> or <code>00000000: f5 3c XY a9 cchmod $cY 1X</code>
This instruction takes a crypto register and a 5 bit immediate value which represents the [[#ACL|ACL]] mask to set.
This instruction takes a crypto register and a 5 bit immediate value which represents the [[#ACL|ACL]] mask to set.
==== crnd ====
==== rnd ====
<code>00000000: f5 3c 0X 90 crnd $cX</code>
<code>00000000: f5 3c 0X 90 crnd $cX</code>
This instruction initializes a crypto register with random data.
This instruction initializes a crypto register with random data.
Executing this instruction only succeeds if the TRNG is enabled for the SCP, which requires taking the following steps:
Executing this instruction only succeeds if the RND interface is enabled for the SCP, which requires taking the following steps:
* Write 0x7FFF to TSEC_TRNG_CLK_LIMIT_LOW.
* Write 0x7FFF to [[#TSEC_RND_CTL0|TSEC_RND_CTL0]].
* Write 0x3FF0000 to TSEC_TRNG_CLK_LIMIT_HIGH.
* Write 0x3FF0000 to [[#TSEC_RND_CTL1|TSEC_RND_CTL1]].
* Write 0xFF00 to TSEC_TRNG_CTL.
* Write 0xFF00 to TSEC_RND_CTL11.
* Write 0x1000 to [[#TSEC_SCP_CTL1|TSEC_SCP_CTL1]].
* Write 0x1000 to [[#TSEC_SCP_CTL1|TSEC_SCP_CTL1]].
Loading a secret into $cX sets a per-secret ACL, unconditionally.
Loading a secret into $cX sets a per-secret ACL, unconditionally.
=== Secrets ===
=== Secrets ===
Falcon's Authenticated Mode has access to 64 128-bit keys which are burned at factory. These keys can be loaded by using the $csecret instruction which takes the target crypto register and the key index as arguments.
Falcon's Heavy Secure Mode has access to 64 128-bit keys which are burned at factory. These keys can be loaded using the $csecret instruction which takes the target crypto register and the key index as arguments.
Secrets are specific to each Falcon unit with the exception of secret 0x3F. This secret is effectively empty (all zeros), but is configured to be overwritten with the KFUSE private key once the KFUSE clock is enabled. The KFUSE private key is console-unique.
Secrets are specific to each Falcon unit with the exception of secret 0x3F. This secret is effectively empty (all zeros), but is configured to be overwritten with the KFUSE private key once the KFUSE clock is enabled. The KFUSE private key is console-unique.