Difference between revisions of "TSEC"

From Nintendo Switch Brew
Jump to navigation Jump to search
 
(170 intermediate revisions by 5 users not shown)
Line 5: Line 5:
  
 
== Registers ==
 
== Registers ==
−
Registers from 0x54500000 to 0x54501000 are used to configure the host interface (HOST1X).
+
The TSEC's MMIO space is divided as follows:
−
 
+
* 0x54500000 to 0x54501000: THI (Tegra Host Interface)
−
Registers from 0x54501000 to 0x54502000 are a MMIO window for communicating with the Falcon microprocessor. From this range, the subset of registers from 0x54501400 to 0x54501FE8 are specific to the TSEC and are subdivided into:
+
* 0x54501000 to 0x54501400: [[#Falcon|FALCON (Falcon microcontroller)]]
−
* 0x54501400 to 0x54501500: SCP (secure crypto processor?).
+
* 0x54501400 to 0x54501600: [[#SCP|SCP (Secure coprocessor)]]
−
* 0x54501500 to 0x54501600: Unknown.
+
* 0x54501600 to 0x54501680: TFBIF (Tegra Framebuffer Interface)
−
* 0x54501600 to 0x54501700: TFBIF (Tegra Framebuffer Interface).
+
* 0x54501680 to 0x54501700: CG (Clock Gate)
−
* 0x54501700 to 0x54501800: DMA.
+
* 0x54501700 to 0x54501800: BAR0 (HOST1X device DMA)
−
* 0x54501800 to 0x54501900: TEGRA (miscellaneous interfaces).
+
* 0x54501800 to 0x54501900: TEGRA (Miscellaneous interfaces)
  
 
{| class="wikitable" border="1"
 
{| class="wikitable" border="1"
Line 19: Line 19:
 
!  Width
 
!  Width
 
|-
 
|-
−
| TSEC_THI_CTXSW
+
| [[#TSEC_THI_INCR_SYNCPT|TSEC_THI_INCR_SYNCPT]]
 +
| 0x54500000
 +
| 0x04
 +
|-
 +
| [[#TSEC_THI_INCR_SYNCPT_CTRL|TSEC_THI_INCR_SYNCPT_CTRL]]
 +
| 0x54500004
 +
| 0x04
 +
|-
 +
| [[#TSEC_THI_INCR_SYNCPT_ERR|TSEC_THI_INCR_SYNCPT_ERR]]
 +
| 0x54500008
 +
| 0x04
 +
|-
 +
| [[#TSEC_THI_CTXSW_INCR_SYNCPT|TSEC_THI_CTXSW_INCR_SYNCPT]]
 +
| 0x5450000C
 +
| 0x04
 +
|-
 +
| [[#TSEC_THI_CTXSW|TSEC_THI_CTXSW]]
 
| 0x54500020
 
| 0x54500020
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| TSEC_THI_METHOD0
+
| [[#TSEC_THI_CTXSW_NEXT|TSEC_THI_CTXSW_NEXT]]
 +
| 0x54500024
 +
| 0x04
 +
|-
 +
| [[#TSEC_THI_CONT_SYNCPT_EOF|TSEC_THI_CONT_SYNCPT_EOF]]
 +
| 0x54500028
 +
| 0x04
 +
|-
 +
| [[#TSEC_THI_CONT_SYNCPT_L1|TSEC_THI_CONT_SYNCPT_L1]]
 +
| 0x5450002C
 +
| 0x04
 +
|-
 +
| [[#TSEC_THI_METHOD0|TSEC_THI_METHOD0]]
 
| 0x54500040
 
| 0x54500040
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| TSEC_THI_METHOD1
+
| [[#TSEC_THI_METHOD1|TSEC_THI_METHOD1]]
 
| 0x54500044
 
| 0x54500044
 +
| 0x04
 +
|-
 +
| [[#TSEC_THI_CONTEXT_SWITCH|TSEC_THI_CONTEXT_SWITCH]]
 +
| 0x54500060
 
| 0x04
 
| 0x04
 
|-
 
|-
Line 35: Line 67:
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| TSEC_THI_INT_MASK
+
| [[#TSEC_THI_INT_MASK|TSEC_THI_INT_MASK]]
 
| 0x5450007C
 
| 0x5450007C
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| TSEC_THI_UNK0
+
| [[#TSEC_THI_CONFIG0|TSEC_THI_CONFIG0]]
 +
| 0x54500080
 +
| 0x04
 +
|-
 +
| [[#TSEC_THI_DBG_MISC|TSEC_THI_DBG_MISC]]
 
| 0x54500084
 
| 0x54500084
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| TSEC_THI_SLCG_OVERRIDE_HIGH_A
+
| [[#TSEC_THI_SLCG_OVERRIDE_HIGH_A|TSEC_THI_SLCG_OVERRIDE_HIGH_A]]
 
| 0x54500088
 
| 0x54500088
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| TSEC_THI_SLCG_OVERRIDE_LOW_A
+
| [[#TSEC_THI_SLCG_OVERRIDE_LOW_A|TSEC_THI_SLCG_OVERRIDE_LOW_A]]
 
| 0x5450008C
 
| 0x5450008C
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| TSEC_THI_CLK_OVERRIDE
+
| [[#TSEC_THI_CLK_OVERRIDE|TSEC_THI_CLK_OVERRIDE]]
 
| 0x54500E00
 
| 0x54500E00
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| [[#FALCON_IRQSSET|FALCON_IRQSSET]]
+
| [[#TSEC_FALCON_IRQSSET|TSEC_FALCON_IRQSSET]]
 
| 0x54501000
 
| 0x54501000
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| [[#FALCON_IRQSCLR|FALCON_IRQSCLR]]
+
| [[#TSEC_FALCON_IRQSCLR|TSEC_FALCON_IRQSCLR]]
 
| 0x54501004
 
| 0x54501004
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| [[#FALCON_IRQSTAT|FALCON_IRQSTAT]]
+
| [[#TSEC_FALCON_IRQSTAT|TSEC_FALCON_IRQSTAT]]
 
| 0x54501008
 
| 0x54501008
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| [[#FALCON_IRQMODE|FALCON_IRQMODE]]
+
| [[#TSEC_FALCON_IRQMODE|TSEC_FALCON_IRQMODE]]
 
| 0x5450100C
 
| 0x5450100C
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| [[#FALCON_IRQMSET|FALCON_IRQMSET]]
+
| [[#TSEC_FALCON_IRQMSET|TSEC_FALCON_IRQMSET]]
 
| 0x54501010
 
| 0x54501010
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| [[#FALCON_IRQMCLR|FALCON_IRQMCLR]]
+
| [[#TSEC_FALCON_IRQMCLR|TSEC_FALCON_IRQMCLR]]
 
| 0x54501014
 
| 0x54501014
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| [[#FALCON_IRQMASK|FALCON_IRQMASK]]
+
| [[#TSEC_FALCON_IRQMASK|TSEC_FALCON_IRQMASK]]
 
| 0x54501018
 
| 0x54501018
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| [[#FALCON_IRQDEST|FALCON_IRQDEST]]
+
| [[#TSEC_FALCON_IRQDEST|TSEC_FALCON_IRQDEST]]
 
| 0x5450101C
 
| 0x5450101C
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_PERIODIC_PERIOD
+
| [[#TSEC_FALCON_GPTMRINT|TSEC_FALCON_GPTMRINT]]
 
| 0x54501020
 
| 0x54501020
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_PERIODIC_TIME
+
| [[#TSEC_FALCON_GPTMRVAL|TSEC_FALCON_GPTMRVAL]]
 
| 0x54501024
 
| 0x54501024
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_PERIODIC_ENABLE
+
| [[#TSEC_FALCON_GPTMRCTL|TSEC_FALCON_GPTMRCTL]]
 
| 0x54501028
 
| 0x54501028
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_TIME_LOW
+
| [[#TSEC_FALCON_PTIMER0|TSEC_FALCON_PTIMER0]]
 
| 0x5450102C
 
| 0x5450102C
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_TIME_HIGH
+
| [[#TSEC_FALCON_PTIMER1|TSEC_FALCON_PTIMER1]]
 
| 0x54501030
 
| 0x54501030
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_WATCHDOG_TIME
+
| [[#TSEC_FALCON_WDTMRVAL|TSEC_FALCON_WDTMRVAL]]
 
| 0x54501034
 
| 0x54501034
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_WATCHDOG_ENABLE
+
| [[#TSEC_FALCON_WDTMRCTL|TSEC_FALCON_WDTMRCTL]]
 
| 0x54501038
 
| 0x54501038
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| [[#FALCON_SCRATCH0|FALCON_SCRATCH0]]
+
| [[#TSEC_FALCON_IRQDEST2|TSEC_FALCON_IRQDEST2]]
 +
| 0x5450103C
 +
| 0x04
 +
|-
 +
| [[#TSEC_FALCON_MAILBOX0|TSEC_FALCON_MAILBOX0]]
 
| 0x54501040
 
| 0x54501040
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| [[#FALCON_SCRATCH1|FALCON_SCRATCH1]]
+
| [[#TSEC_FALCON_MAILBOX1|TSEC_FALCON_MAILBOX1]]
 
| 0x54501044
 
| 0x54501044
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| [[#FALCON_ITFEN|FALCON_ITFEN]]
+
| [[#TSEC_FALCON_ITFEN|TSEC_FALCON_ITFEN]]
 
| 0x54501048
 
| 0x54501048
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| [[#FALCON_IDLESTATE|FALCON_IDLESTATE]]
+
| [[#TSEC_FALCON_IDLESTATE|TSEC_FALCON_IDLESTATE]]
 
| 0x5450104C
 
| 0x5450104C
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_CURCTX
+
| [[#TSEC_FALCON_CURCTX|TSEC_FALCON_CURCTX]]
 
| 0x54501050
 
| 0x54501050
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_NXTCTX
+
| [[#TSEC_FALCON_NXTCTX|TSEC_FALCON_NXTCTX]]
 
| 0x54501054
 
| 0x54501054
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_CMDCTX
+
| [[#TSEC_FALCON_CTXACK|TSEC_FALCON_CTXACK]]
 
| 0x54501058
 
| 0x54501058
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_STATUS_MASK
+
| [[#TSEC_FALCON_FHSTATE|TSEC_FALCON_FHSTATE]]
 
| 0x5450105C
 
| 0x5450105C
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_VM_SUPERVISOR
+
| [[#TSEC_FALCON_PRIVSTATE|TSEC_FALCON_PRIVSTATE]]
 
| 0x54501060
 
| 0x54501060
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_FIFO_DATA
+
| [[#TSEC_FALCON_MTHDDATA|TSEC_FALCON_MTHDDATA]]
 
| 0x54501064
 
| 0x54501064
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_FIFO_CMD
+
| [[#TSEC_FALCON_MTHDID|TSEC_FALCON_MTHDID]]
 
| 0x54501068
 
| 0x54501068
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_FIFO_DATA_WR
+
| [[#TSEC_FALCON_MTHDWDAT|TSEC_FALCON_MTHDWDAT]]
 
| 0x5450106C
 
| 0x5450106C
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_FIFO_OCCUPIED
+
| [[#TSEC_FALCON_MTHDCOUNT|TSEC_FALCON_MTHDCOUNT]]
 
| 0x54501070
 
| 0x54501070
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_FIFO_ACK
+
| [[#TSEC_FALCON_MTHDPOP|TSEC_FALCON_MTHDPOP]]
 
| 0x54501074
 
| 0x54501074
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_FIFO_LIMIT
+
| [[#TSEC_FALCON_MTHDRAMSZ|TSEC_FALCON_MTHDRAMSZ]]
 
| 0x54501078
 
| 0x54501078
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_SUBENGINE_RESET
+
| [[#TSEC_FALCON_SFTRESET|TSEC_FALCON_SFTRESET]]
 
| 0x5450107C
 
| 0x5450107C
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_SCRATCH2
+
| [[#TSEC_FALCON_OS|TSEC_FALCON_OS]]
 
| 0x54501080
 
| 0x54501080
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_SCRATCH3
+
| [[#TSEC_FALCON_RM|TSEC_FALCON_RM]]
 
| 0x54501084
 
| 0x54501084
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_PM_TRIGGER
+
| [[#TSEC_FALCON_SOFT_PM|TSEC_FALCON_SOFT_PM]]
 
| 0x54501088
 
| 0x54501088
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_PM_MODE
+
| [[#TSEC_FALCON_SOFT_MODE|TSEC_FALCON_SOFT_MODE]]
 
| 0x5450108C
 
| 0x5450108C
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_DEBUG1
+
| [[#TSEC_FALCON_DEBUG1|TSEC_FALCON_DEBUG1]]
 
| 0x54501090
 
| 0x54501090
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| [[#FALCON_DEBUGINFO|FALCON_DEBUGINFO]]
+
| [[#TSEC_FALCON_DEBUGINFO|TSEC_FALCON_DEBUGINFO]]
 
| 0x54501094
 
| 0x54501094
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_BREAKPOINT0
+
| [[#TSEC_FALCON_IBRKPT1|TSEC_FALCON_IBRKPT1]]
 
| 0x54501098
 
| 0x54501098
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_BREAKPOINT1
+
| [[#TSEC_FALCON_IBRKPT2|TSEC_FALCON_IBRKPT2]]
 
| 0x5450109C
 
| 0x5450109C
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_CGCTL
+
| [[#TSEC_FALCON_CGCTL|TSEC_FALCON_CGCTL]]
 
| 0x545010A0
 
| 0x545010A0
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_ENGCTL
+
| [[#TSEC_FALCON_ENGCTL|TSEC_FALCON_ENGCTL]]
 
| 0x545010A4
 
| 0x545010A4
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_PM_SEL
+
| [[#TSEC_FALCON_PMM|TSEC_FALCON_PMM]]
 
| 0x545010A8
 
| 0x545010A8
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_HOST_IO_INDEX
+
| [[#TSEC_FALCON_ADDR|TSEC_FALCON_ADDR]]
 
| 0x545010AC
 
| 0x545010AC
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| [[#FALCON_EXCI|FALCON_EXCI]]
+
| [[#TSEC_FALCON_IBRKPT3|TSEC_FALCON_IBRKPT3]]
−
| 0x545010D0
+
| 0x545010B0
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| [[#FALCON_CPUCTL|FALCON_CPUCTL]]
+
| [[#TSEC_FALCON_IBRKPT4|TSEC_FALCON_IBRKPT4]]
−
| 0x54501100
+
| 0x545010B4
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| [[#FALCON_BOOTVEC|FALCON_BOOTVEC]]
+
| [[#TSEC_FALCON_IBRKPT5|TSEC_FALCON_IBRKPT5]]
−
| 0x54501104
+
| 0x545010B8
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_HWCFG
+
| [[#TSEC_FALCON_EXCI|TSEC_FALCON_EXCI]]
−
| 0x54501108
+
| 0x545010D0
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| [[#FALCON_DMACTL|FALCON_DMACTL]]
+
| [[#TSEC_FALCON_SVEC_SPR|TSEC_FALCON_SVEC_SPR]]
−
| 0x5450110C
+
| 0x545010D4
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| [[#FALCON_DMATRFBASE|FALCON_DMATRFBASE]]
+
| [[#TSEC_FALCON_RSTAT0|TSEC_FALCON_RSTAT0]]
−
| 0x54501110
+
| 0x545010D8
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| [[#FALCON_DMATRFMOFFS|FALCON_DMATRFMOFFS]]
+
| [[#TSEC_FALCON_RSTAT3|TSEC_FALCON_RSTAT3]]
−
| 0x54501114
+
| 0x545010DC
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| [[#FALCON_DMATRFCMD|FALCON_DMATRFCMD]]
+
| [[#TSEC_FALCON_SIRQMASK|TSEC_FALCON_SIRQMASK]]
−
| 0x54501118
+
| 0x545010E0
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| [[#FALCON_DMATRFFBOFFS|FALCON_DMATRFFBOFFS]]
+
| [[#TSEC_FALCON_CPUCTL|TSEC_FALCON_CPUCTL]]
 +
| 0x54501100
 +
| 0x04
 +
|-
 +
| [[#TSEC_FALCON_BOOTVEC|TSEC_FALCON_BOOTVEC]]
 +
| 0x54501104
 +
| 0x04
 +
|-
 +
| [[#TSEC_FALCON_HWCFG|TSEC_FALCON_HWCFG]]
 +
| 0x54501108
 +
| 0x04
 +
|-
 +
| [[#TSEC_FALCON_DMACTL|TSEC_FALCON_DMACTL]]
 +
| 0x5450110C
 +
| 0x04
 +
|-
 +
| [[#TSEC_FALCON_DMATRFBASE|TSEC_FALCON_DMATRFBASE]]
 +
| 0x54501110
 +
| 0x04
 +
|-
 +
| [[#TSEC_FALCON_DMATRFMOFFS|TSEC_FALCON_DMATRFMOFFS]]
 +
| 0x54501114
 +
| 0x04
 +
|-
 +
| [[#TSEC_FALCON_DMATRFCMD|TSEC_FALCON_DMATRFCMD]]
 +
| 0x54501118
 +
| 0x04
 +
|-
 +
| [[#TSEC_FALCON_DMATRFFBOFFS|TSEC_FALCON_DMATRFFBOFFS]]
 
| 0x5450111C
 
| 0x5450111C
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_DMATRFSTAT
+
| [[#TSEC_FALCON_DMAPOLL_FB|TSEC_FALCON_DMAPOLL_FB]]
 
| 0x54501120
 
| 0x54501120
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_CRYPTTRFSTAT
+
| [[#TSEC_FALCON_DMAPOLL_CP|TSEC_FALCON_DMAPOLL_CP]]
 
| 0x54501124
 
| 0x54501124
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_CPUSTAT
+
| [[#TSEC_FALCON_HWCFG1|TSEC_FALCON_HWCFG1]]
−
| 0x54501128
+
| 0x5450112C
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_HWCFG_ALIAS
+
| [[#TSEC_FALCON_CPUCTL_ALIAS|TSEC_FALCON_CPUCTL_ALIAS]]
−
| 0x5450112C
+
| 0x54501130
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_CPUCTL_ALIAS
+
| [[#TSEC_FALCON_STACKCFG|TSEC_FALCON_STACKCFG]]
−
| 0x54501130
+
| 0x54501138
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_TLB_CMD
+
| [[#TSEC_FALCON_IMCTL|TSEC_FALCON_IMCTL]]
 
| 0x54501140
 
| 0x54501140
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_TLB_CMD_RES
+
| [[#TSEC_FALCON_IMSTAT|TSEC_FALCON_IMSTAT]]
 
| 0x54501144
 
| 0x54501144
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_BRANCH_HISTORY_CTRL
+
| [[#TSEC_FALCON_TRACEIDX|TSEC_FALCON_TRACEIDX]]
 
| 0x54501148
 
| 0x54501148
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_BRANCH_HISTORY_PC
+
| [[#TSEC_FALCON_TRACEPC|TSEC_FALCON_TRACEPC]]
 
| 0x5450114C
 
| 0x5450114C
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_IMFILLRNG0
+
| [[#TSEC_FALCON_IMFILLRNG0|TSEC_FALCON_IMFILLRNG0]]
 
| 0x54501150
 
| 0x54501150
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_IMFILLRNG1
+
| [[#TSEC_FALCON_IMFILLRNG1|TSEC_FALCON_IMFILLRNG1]]
 
| 0x54501154
 
| 0x54501154
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_IMFILLCTL
+
| [[#TSEC_FALCON_IMFILLCTL|TSEC_FALCON_IMFILLCTL]]
 
| 0x54501158
 
| 0x54501158
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_EXTERRWIN
+
| [[#TSEC_FALCON_IMCTL_DEBUG|TSEC_FALCON_IMCTL_DEBUG]]
 +
| 0x5450115C
 +
| 0x04
 +
|-
 +
| [[#TSEC_FALCON_CMEMBASE|TSEC_FALCON_CMEMBASE]]
 
| 0x54501160
 
| 0x54501160
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_EXTERRCFG
+
| [[#TSEC_FALCON_DMEMAPERT|TSEC_FALCON_DMEMAPERT]]
 
| 0x54501164
 
| 0x54501164
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_EXTERRADDR
+
| [[#TSEC_FALCON_EXTERRADDR|TSEC_FALCON_EXTERRADDR]]
 
| 0x54501168
 
| 0x54501168
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_EXTERRSTAT
+
| [[#TSEC_FALCON_EXTERRSTAT|TSEC_FALCON_EXTERRSTAT]]
 
| 0x5450116C
 
| 0x5450116C
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_CG2
+
| [[#TSEC_FALCON_CG2|TSEC_FALCON_CG2]]
 
| 0x5450117C
 
| 0x5450117C
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_CODE_INDEX
+
| [[#TSEC_FALCON_IMEMC|TSEC_FALCON_IMEMC0]]
 
| 0x54501180
 
| 0x54501180
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_CODE
+
| [[#TSEC_FALCON_IMEMD|TSEC_FALCON_IMEMD0]]
 
| 0x54501184
 
| 0x54501184
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_CODE_VIRT_ADDR
+
| [[#TSEC_FALCON_IMEMT|TSEC_FALCON_IMEMT0]]
 
| 0x54501188
 
| 0x54501188
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_DATA_INDEX0
+
| [[#TSEC_FALCON_IMEMC|TSEC_FALCON_IMEMC1]]
−
| 0x545011C0
+
| 0x54501190
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_DATA0
+
| [[#TSEC_FALCON_IMEMD|TSEC_FALCON_IMEMD1]]
−
| 0x545011C4
+
| 0x54501194
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_DATA_INDEX1
+
| [[#TSEC_FALCON_IMEMT|TSEC_FALCON_IMEMT1]]
−
| 0x545011C8
+
| 0x54501198
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_DATA1
+
| [[#TSEC_FALCON_IMEMC|TSEC_FALCON_IMEMC2]]
−
| 0x545011CC
+
| 0x545011A0
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_DATA_INDEX2
+
| [[#TSEC_FALCON_IMEMD|TSEC_FALCON_IMEMD2]]
−
| 0x545011D0
+
| 0x545011A4
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_DATA2
+
| [[#TSEC_FALCON_IMEMT|TSEC_FALCON_IMEMT2]]
 +
| 0x545011A8
 +
| 0x04
 +
|-
 +
| [[#TSEC_FALCON_IMEMC|TSEC_FALCON_IMEMC3]]
 +
| 0x545011B0
 +
| 0x04
 +
|-
 +
| [[#TSEC_FALCON_IMEMD|TSEC_FALCON_IMEMD3]]
 +
| 0x545011B4
 +
| 0x04
 +
|-
 +
| [[#TSEC_FALCON_IMEMT|TSEC_FALCON_IMEMT3]]
 +
| 0x545011B8
 +
| 0x04
 +
|-
 +
| [[#TSEC_FALCON_DMEMC|TSEC_FALCON_DMEMC0]]
 +
| 0x545011C0
 +
| 0x04
 +
|-
 +
| [[#TSEC_FALCON_DMEMD|TSEC_FALCON_DMEMD0]]
 +
| 0x545011C4
 +
| 0x04
 +
|-
 +
| [[#TSEC_FALCON_DMEMC|TSEC_FALCON_DMEMC1]]
 +
| 0x545011C8
 +
| 0x04
 +
|-
 +
| [[#TSEC_FALCON_DMEMD|TSEC_FALCON_DMEMD1]]
 +
| 0x545011CC
 +
| 0x04
 +
|-
 +
| [[#TSEC_FALCON_DMEMC|TSEC_FALCON_DMEMC2]]
 +
| 0x545011D0
 +
| 0x04
 +
|-
 +
| [[#TSEC_FALCON_DMEMD|TSEC_FALCON_DMEMD2]]
 
| 0x545011D4
 
| 0x545011D4
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_DATA_INDEX3
+
| [[#TSEC_FALCON_DMEMC|TSEC_FALCON_DMEMC3]]
 
| 0x545011D8
 
| 0x545011D8
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_DATA3
+
| [[#TSEC_FALCON_DMEMD|TSEC_FALCON_DMEMD3]]
 
| 0x545011DC
 
| 0x545011DC
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_DATA_INDEX4
+
| [[#TSEC_FALCON_DMEMC|TSEC_FALCON_DMEMC4]]
 
| 0x545011E0
 
| 0x545011E0
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_DATA4
+
| [[#TSEC_FALCON_DMEMD|TSEC_FALCON_DMEMD4]]
 
| 0x545011E4
 
| 0x545011E4
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_DATA_INDEX5
+
| [[#TSEC_FALCON_DMEMC|TSEC_FALCON_DMEMC5]]
 
| 0x545011E8
 
| 0x545011E8
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_DATA5
+
| [[#TSEC_FALCON_DMEMD|TSEC_FALCON_DMEMD5]]
 
| 0x545011EC
 
| 0x545011EC
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_DATA_INDEX6
+
| [[#TSEC_FALCON_DMEMC|TSEC_FALCON_DMEMC6]]
 
| 0x545011F0
 
| 0x545011F0
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_DATA6
+
| [[#TSEC_FALCON_DMEMD|TSEC_FALCON_DMEMD6]]
 
| 0x545011F4
 
| 0x545011F4
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_DATA_INDEX7
+
| [[#TSEC_FALCON_DMEMC|TSEC_FALCON_DMEMC7]]
 
| 0x545011F8
 
| 0x545011F8
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_DATA7
+
| [[#TSEC_FALCON_DMEMD|TSEC_FALCON_DMEMD7]]
 
| 0x545011FC
 
| 0x545011FC
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_ICD_CMD
+
| [[#TSEC_FALCON_ICD_CMD|TSEC_FALCON_ICD_CMD]]
 
| 0x54501200
 
| 0x54501200
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_ICD_ADDR
+
| [[#TSEC_FALCON_ICD_ADDR|TSEC_FALCON_ICD_ADDR]]
 
| 0x54501204
 
| 0x54501204
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_ICD_WDATA
+
| [[#TSEC_FALCON_ICD_WDATA|TSEC_FALCON_ICD_WDATA]]
 
| 0x54501208
 
| 0x54501208
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_ICD_RDATA
+
| [[#TSEC_FALCON_ICD_RDATA|TSEC_FALCON_ICD_RDATA]]
 
| 0x5450120C
 
| 0x5450120C
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| FALCON_SCTL
+
| [[#TSEC_FALCON_SCTL|TSEC_FALCON_SCTL]]
 
| 0x54501240
 
| 0x54501240
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| TSEC_SCP_UNK0
+
| [[#TSEC_FALCON_SERRSTAT|TSEC_FALCON_SERRSTAT]]
−
| 0x54501400
+
| 0x54501244
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| TSEC_SCP_UNK1
+
| [[#TSEC_FALCON_SERRVAL|TSEC_FALCON_SERRVAL]]
−
| 0x54501404
+
| 0x54501248
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| [[#TSEC_SCP_CTL_STAT|TSEC_SCP_CTL_STAT]]
+
| [[#TSEC_FALCON_SERRADDR|TSEC_FALCON_SERRADDR]]
−
| 0x54501408
+
| 0x5450124C
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| TSEC_SCP_CTL_AUTH_MODE
+
| [[#TSEC_FALCON_SCTL1|TSEC_FALCON_SCTL1]]
−
| 0x5450140C
+
| 0x54501250
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| TSEC_SCP_UNK2
+
| [[#TSEC_FALCON_STEST|TSEC_FALCON_STEST]]
−
| 0x54501410
+
| 0x54501258
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| [[#TSEC_SCP_CTL_PKEY|TSEC_SCP_CTL_PKEY]]
+
| [[#TSEC_FALCON_SICD|TSEC_FALCON_SICD]]
−
| 0x54501418
+
| 0x54501260
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| TSEC_SCP_UNK3
+
| [[#TSEC_FALCON_SPROT_IMEM|TSEC_FALCON_SPROT_IMEM]]
−
| 0x54501420
+
| 0x54501280
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| TSEC_SCP_UNK4
+
| [[#TSEC_FALCON_SPROT_DMEM|TSEC_FALCON_SPROT_DMEM]]
−
| 0x54501428
+
| 0x54501284
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| TSEC_SCP_UNK5
+
| [[#TSEC_FALCON_SPROT_CPUCTL|TSEC_FALCON_SPROT_CPUCTL]]
−
| 0x54501430
+
| 0x54501288
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| TSEC_SCP_UNK6
+
| [[#TSEC_FALCON_SPROT_MISC|TSEC_FALCON_SPROT_MISC]]
−
| 0x54501454
+
| 0x5450128C
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| TSEC_SCP_UNK7
+
| [[#TSEC_FALCON_SPROT_IRQ|TSEC_FALCON_SPROT_IRQ]]
−
| 0x54501458
+
| 0x54501290
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| TSEC_SCP_UNK8
+
| [[#TSEC_FALCON_SPROT_MTHD|TSEC_FALCON_SPROT_MTHD]]
−
| 0x54501470
+
| 0x54501294
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| TSEC_SCP_UNK9
+
| [[#TSEC_FALCON_SPROT_SCTL|TSEC_FALCON_SPROT_SCTL]]
−
| 0x54501480
+
| 0x54501298
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| TSEC_SCP_UNK10
+
| [[#TSEC_FALCON_SPROT_WDTMR|TSEC_FALCON_SPROT_WDTMR]]
−
| 0x54501490
+
| 0x5450129C
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| TSEC_UNK0
+
| [[#TSEC_FALCON_DMAINFO_FINISHED_FBRD_LOW|TSEC_FALCON_DMAINFO_FINISHED_FBRD_LOW]]
−
| 0x54501500
+
| 0x545012C0
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| TSEC_UNK1
+
| [[#TSEC_FALCON_DMAINFO_FINISHED_FBRD_HIGH|TSEC_FALCON_DMAINFO_FINISHED_FBRD_HIGH]]
−
| 0x54501504
+
| 0x545012C4
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| TSEC_UNK2
+
| [[#TSEC_FALCON_DMAINFO_FINISHED_FBWR_LOW|TSEC_FALCON_DMAINFO_FINISHED_FBWR_LOW]]
−
| 0x5450150C
+
| 0x545012C8
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| TSEC_UNK3
+
| [[#TSEC_FALCON_DMAINFO_FINISHED_FBWR_HIGH|TSEC_FALCON_DMAINFO_FINISHED_FBWR_HIGH]]
−
| 0x54501510
+
| 0x545012CC
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| TSEC_UNK4
+
| [[#TSEC_FALCON_DMAINFO_CURRENT_FBRD_LOW|TSEC_FALCON_DMAINFO_CURRENT_FBRD_LOW]]
−
| 0x54501514
+
| 0x545012D0
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| TSEC_UNK5
+
| [[#TSEC_FALCON_DMAINFO_CURRENT_FBRD_HIGH|TSEC_FALCON_DMAINFO_CURRENT_FBRD_HIGH]]
−
| 0x54501518
+
| 0x545012D4
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| TSEC_UNK6
+
| [[#TSEC_FALCON_DMAINFO_CURRENT_FBWR_LOW|TSEC_FALCON_DMAINFO_CURRENT_FBWR_LOW]]
−
| 0x5450151C
+
| 0x545012D8
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| TSEC_UNK7
+
| [[#TSEC_FALCON_DMAINFO_CURRENT_FBWR_HIGH|TSEC_FALCON_DMAINFO_CURRENT_FBWR_HIGH]]
−
| 0x54501528
+
| 0x545012DC
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| TSEC_UNK8
+
| [[#TSEC_FALCON_DMAINFO_CTL|TSEC_FALCON_DMAINFO_CTL]]
−
| 0x5450152C
+
| 0x545012E0
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| TSEC_TFBIF_UNK0
+
| [[#TSEC_SCP_CTL0|TSEC_SCP_CTL0]]
−
| 0x54501600
+
| 0x54501400
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL|TSEC_TFBIF_MCCIF_FIFOCTRL]]
+
| [[#TSEC_SCP_CTL1|TSEC_SCP_CTL1]]
−
| 0x54501604
+
| 0x54501404
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| TSEC_TFBIF_UNK1
+
| [[#TSEC_SCP_CTL_STAT|TSEC_SCP_CTL_STAT]]
−
| 0x54501608
+
| 0x54501408
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| TSEC_TFBIF_UNK2
+
| [[#TSEC_SCP_CTL_LOCK|TSEC_SCP_CTL_LOCK]]
−
| 0x5450160C
+
| 0x5450140C
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| TSEC_TFBIF_UNK3
+
| [[#TSEC_SCP_CFG|TSEC_SCP_CFG]]
−
| 0x54501630
+
| 0x54501410
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL1|TSEC_TFBIF_MCCIF_FIFOCTRL1]]
+
| [[#TSEC_SCP_CTL_SCP|TSEC_SCP_CTL_SCP]]
−
| 0x54501634
+
| 0x54501414
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| TSEC_TFBIF_UNK4
+
| [[#TSEC_SCP_CTL_PKEY|TSEC_SCP_CTL_PKEY]]
−
| 0x54501640
+
| 0x54501418
 +
| 0x04
 +
|-
 +
| [[#TSEC_SCP_CTL_DBG|TSEC_SCP_CTL_DBG]]
 +
| 0x5450141C
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| [[#TSEC_TFBIF_UNK5|TSEC_TFBIF_UNK5]]
+
| [[#TSEC_SCP_DBG0|TSEC_SCP_DBG0]]
−
| 0x54501644
+
| 0x54501420
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| [[#TSEC_TFBIF_UNK6|TSEC_TFBIF_UNK6]]
+
| [[#TSEC_SCP_DBG1|TSEC_SCP_DBG1]]
−
| 0x54501648
+
| 0x54501424
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| [[#TSEC_DMA_CMD|TSEC_DMA_CMD]]
+
| [[#TSEC_SCP_DBG2|TSEC_SCP_DBG2]]
−
| 0x54501700
+
| 0x54501428
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| [[#TSEC_DMA_ADDR|TSEC_DMA_ADDR]]
+
| [[#TSEC_SCP_CMD|TSEC_SCP_CMD]]
−
| 0x54501704
+
| 0x54501430
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| [[#TSEC_DMA_VAL|TSEC_DMA_VAL]]
+
| [[#TSEC_SCP_STAT0|TSEC_SCP_STAT0]]
−
| 0x54501708
+
| 0x54501450
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| [[#TSEC_DMA_UNK|TSEC_DMA_UNK]]
+
| [[#TSEC_SCP_STAT1|TSEC_SCP_STAT1]]
−
| 0x5450170C
+
| 0x54501454
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| TSEC_TEGRA_UNK0
+
| [[#TSEC_SCP_STAT2|TSEC_SCP_STAT2]]
−
| 0x54501800
+
| 0x54501458
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| TSEC_TEGRA_UNK1
+
| [[#TSEC_SCP_RNG_STAT0|TSEC_SCP_RNG_STAT0]]
−
| 0x54501824
+
| 0x54501470
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| TSEC_TEGRA_UNK2
+
| [[#TSEC_SCP_RNG_STAT1|TSEC_SCP_RNG_STAT1]]
−
| 0x54501828
+
| 0x54501474
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| TSEC_TEGRA_UNK3
+
| [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT]]
−
| 0x5450182C
+
| 0x54501480
 
| 0x04
 
| 0x04
 
|-
 
|-
−
| [[#TSEC_TEGRA_CTL|TSEC_TEGRA_CTL]]
+
| [[#TSEC_SCP_IRQMASK|TSEC_SCP_IRQMASK]]
−
| 0x54501838
+
| 0x54501484
 
| 0x04
 
| 0x04
−
|}
 
−
 
−
=== TSEC_THI_INT_STATUS ===
 
−
{| class="wikitable" border="1"
 
−
!  Bits
 
−
!  Description
 
 
|-
 
|-
−
| 0
+
| [[#TSEC_SCP_ACL_ERR|TSEC_SCP_ACL_ERR]]
−
| TSEC_THI_INT_STATUS_FALCON_INT
+
| 0x54501490
−
|}
+
| 0x04
−
 
 
−
=== FALCON_IRQSSET ===
 
−
{| class="wikitable" border="1"
 
−
!  Bits
 
−
!  Description
 
 
|-
 
|-
−
| 0
+
| [[#TSEC_SCP_SEC_ERR|TSEC_SCP_SEC_ERR]]
−
| FALCON_IRQSSET_GPTMR
+
| 0x54501494
 +
| 0x04
 
|-
 
|-
−
| 1
+
| [[#TSEC_SCP_CMD_ERR|TSEC_SCP_CMD_ERR]]
−
| FALCON_IRQSSET_WDTMR
+
| 0x54501498
 +
| 0x04
 
|-
 
|-
−
| 2
+
| [[#TSEC_SCP_RND_CTL0|TSEC_SCP_RND_CTL0]]
−
| FALCON_IRQSSET_MTHD
+
| 0x54501500
 +
| 0x04
 
|-
 
|-
−
| 3
+
| [[#TSEC_SCP_RND_CTL1|TSEC_SCP_RND_CTL1]]
−
| FALCON_IRQSSET_CTXSW
+
| 0x54501504
 +
| 0x04
 
|-
 
|-
−
| 4
+
| [[#TSEC_SCP_RND_CTL2|TSEC_SCP_RND_CTL2]]
−
| FALCON_IRQSSET_HALT
+
| 0x54501508
 +
| 0x04
 
|-
 
|-
−
| 5
+
| [[#TSEC_SCP_RND_CTL3|TSEC_SCP_RND_CTL3]]
−
| FALCON_IRQSSET_EXTERR
+
| 0x5450150C
 +
| 0x04
 
|-
 
|-
−
| 6
+
| [[#TSEC_SCP_RND_CTL4|TSEC_SCP_RND_CTL4]]
−
| FALCON_IRQSSET_SWGEN0
+
| 0x54501510
 +
| 0x04
 
|-
 
|-
−
| 7
+
| [[#TSEC_SCP_RND_CTL5|TSEC_SCP_RND_CTL5]]
−
| FALCON_IRQSSET_SWGEN1
+
| 0x54501514
 +
| 0x04
 
|-
 
|-
−
| 8-15
+
| [[#TSEC_SCP_RND_CTL6|TSEC_SCP_RND_CTL6]]
−
| FALCON_IRQSSET_EXT
+
| 0x54501518
−
|}
+
| 0x04
−
 
 
−
Used for setting Falcon's IRQs.
 
−
 
 
−
=== FALCON_IRQSCLR ===
 
−
{| class="wikitable" border="1"
 
−
!  Bits
 
−
!  Description
 
 
|-
 
|-
−
| 0
+
| [[#TSEC_SCP_RND_CTL7|TSEC_SCP_RND_CTL7]]
−
| FALCON_IRQSCLR_GPTMR
+
| 0x5450151C
 +
| 0x04
 
|-
 
|-
−
| 1
+
| [[#TSEC_SCP_RND_CTL8|TSEC_SCP_RND_CTL8]]
−
| FALCON_IRQSCLR_WDTMR
+
| 0x54501520
 +
| 0x04
 
|-
 
|-
−
| 2
+
| [[#TSEC_SCP_RND_CTL9|TSEC_SCP_RND_CTL9]]
−
| FALCON_IRQSCLR_MTHD
+
| 0x54501524
 +
| 0x04
 
|-
 
|-
−
| 3
+
| [[#TSEC_SCP_RND_CTL10|TSEC_SCP_RND_CTL10]]
−
| FALCON_IRQSCLR_CTXSW
+
| 0x54501528
 +
| 0x04
 
|-
 
|-
−
| 4
+
| [[#TSEC_SCP_RND_CTL11|TSEC_SCP_RND_CTL11]]
−
| FALCON_IRQSCLR_HALT
+
| 0x5450152C
 +
| 0x04
 
|-
 
|-
−
| 5
+
| [[#TSEC_TFBIF_CTL|TSEC_TFBIF_CTL]]
−
| FALCON_IRQSCLR_EXTERR
+
| 0x54501600
 +
| 0x04
 
|-
 
|-
−
| 6
+
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL|TSEC_TFBIF_MCCIF_FIFOCTRL]]
−
| FALCON_IRQSCLR_SWGEN0
+
| 0x54501604
 +
| 0x04
 
|-
 
|-
−
| 7
+
| [[#TSEC_TFBIF_THROTTLE|TSEC_TFBIF_THROTTLE]]
−
| FALCON_IRQSCLR_SWGEN1
+
| 0x54501608
 +
| 0x04
 
|-
 
|-
−
| 8-15
+
| [[#TSEC_TFBIF_DBG_STAT0|TSEC_TFBIF_DBG_STAT0]]
−
| FALCON_IRQSCLR_EXT
+
| 0x5450160C
−
|}
+
| 0x04
−
 
 
−
Used for clearing Falcon's IRQs.
 
−
 
 
−
=== FALCON_IRQSTAT ===
 
−
{| class="wikitable" border="1"
 
−
!  Bits
 
−
!  Description
 
 
|-
 
|-
−
| 0
+
| [[#TSEC_TFBIF_DBG_STAT1|TSEC_TFBIF_DBG_STAT1]]
−
| FALCON_IRQSTAT_GPTMR
+
| 0x54501610
 +
| 0x04
 
|-
 
|-
−
| 1
+
| [[#TSEC_TFBIF_DBG_RDCOUNT_LO|TSEC_TFBIF_DBG_RDCOUNT_LO]]
−
| FALCON_IRQSTAT_WDTMR
+
| 0x54501614
 +
| 0x04
 
|-
 
|-
−
| 2
+
| [[#TSEC_TFBIF_DBG_RDCOUNT_HI|TSEC_TFBIF_DBG_RDCOUNT_HI]]
−
| FALCON_IRQSTAT_MTHD
+
| 0x54501618
 +
| 0x04
 
|-
 
|-
−
| 3
+
| [[#TSEC_TFBIF_DBG_WRCOUNT_LO|TSEC_TFBIF_DBG_WRCOUNT_LO]]
−
| FALCON_IRQSTAT_CTXSW
+
| 0x5450161C
 +
| 0x04
 
|-
 
|-
−
| 4
+
| [[#TSEC_TFBIF_DBG_WRCOUNT_HI|TSEC_TFBIF_DBG_WRCOUNT_HI]]
−
| FALCON_IRQSTAT_HALT
+
| 0x54501620
 +
| 0x04
 
|-
 
|-
−
| 5
+
| [[#TSEC_TFBIF_DBG_R32COUNT|TSEC_TFBIF_DBG_R32COUNT]]
−
| FALCON_IRQSTAT_EXTERR
+
| 0x54501624
 +
| 0x04
 
|-
 
|-
−
| 6
+
| [[#TSEC_TFBIF_DBG_R64COUNT|TSEC_TFBIF_DBG_R64COUNT]]
−
| FALCON_IRQSTAT_SWGEN0
+
| 0x54501628
 +
| 0x04
 
|-
 
|-
−
| 7
+
| [[#TSEC_TFBIF_DBG_R128COUNT|TSEC_TFBIF_DBG_R128COUNT]]
−
| FALCON_IRQSTAT_SWGEN1
+
| 0x5450162C
 +
| 0x04
 
|-
 
|-
−
| 8-15
+
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL1|TSEC_TFBIF_MCCIF_FIFOCTRL1]]
−
| FALCON_IRQSTAT_EXT
+
| 0x54501634
−
|}
+
| 0x04
−
 
 
−
Used for getting the status of Falcon's IRQs.
 
−
 
 
−
=== FALCON_IRQMODE ===
 
−
{| class="wikitable" border="1"
 
−
!  Bits
 
−
!  Description
 
 
|-
 
|-
−
| 0
+
| [[#TSEC_TFBIF_SPROT_EMEM|TSEC_TFBIF_SPROT_EMEM]]
−
| FALCON_IRQMODE_GPTMR
+
| 0x54501640
 +
| 0x04
 
|-
 
|-
−
| 1
+
| [[#TSEC_TFBIF_TRANSCFG|TSEC_TFBIF_TRANSCFG]]
−
| FALCON_IRQMODE_WDTMR
+
| 0x54501644
 +
| 0x04
 
|-
 
|-
−
| 2
+
| [[#TSEC_TFBIF_REGIONCFG|TSEC_TFBIF_REGIONCFG]]
−
| FALCON_IRQMODE_MTHD
+
| 0x54501648
 +
| 0x04
 
|-
 
|-
−
| 3
+
| [[#TSEC_CG|TSEC_CG]]
−
| FALCON_IRQMODE_CTXSW
+
| 0x545016D0
 +
| 0x04
 
|-
 
|-
−
| 4
+
| [[#TSEC_BAR0_CTL|TSEC_BAR0_CTL]]
−
| FALCON_IRQMODE_HALT
+
| 0x54501700
 +
| 0x04
 
|-
 
|-
−
| 5
+
| [[#TSEC_BAR0_ADDR|TSEC_BAR0_ADDR]]
−
| FALCON_IRQMODE_EXTERR
+
| 0x54501704
 +
| 0x04
 
|-
 
|-
−
| 6
+
| [[#TSEC_BAR0_DATA|TSEC_BAR0_DATA]]
−
| FALCON_IRQMODE_SWGEN0
+
| 0x54501708
 +
| 0x04
 
|-
 
|-
−
| 7
+
| [[#TSEC_BAR0_TIMEOUT|TSEC_BAR0_TIMEOUT]]
−
| FALCON_IRQMODE_SWGEN1
+
| 0x5450170C
 +
| 0x04
 
|-
 
|-
−
| 8-15
+
| [[#TSEC_VERSION|TSEC_VERSION]]
−
| FALCON_IRQMODE_EXT
+
| 0x54501800
−
|}
+
| 0x04
−
 
+
|-
−
Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.
+
| [[#TSEC_SCRATCH0|TSEC_SCRATCH0]]
−
 
+
| 0x54501804
−
=== FALCON_IRQMSET ===
+
| 0x04
−
{| class="wikitable" border="1"
 
−
!  Bits
 
−
!  Description
 
 
|-
 
|-
−
| 0
+
| [[#TSEC_SCRATCH1|TSEC_SCRATCH1]]
−
| FALCON_IRQMSET_GPTMR
+
| 0x54501808
 +
| 0x04
 
|-
 
|-
−
| 1
+
| [[#TSEC_SCRATCH2|TSEC_SCRATCH2]]
−
| FALCON_IRQMSET_WDTMR
+
| 0x5450180C
 +
| 0x04
 
|-
 
|-
−
| 2
+
| [[#TSEC_SCRATCH3|TSEC_SCRATCH3]]
−
| FALCON_IRQMSET_MTHD
+
| 0x54501810
 +
| 0x04
 
|-
 
|-
−
| 3
+
| [[#TSEC_SCRATCH4|TSEC_SCRATCH4]]
−
| FALCON_IRQMSET_CTXSW
+
| 0x54501814
 +
| 0x04
 
|-
 
|-
−
| 4
+
| [[#TSEC_SCRATCH5|TSEC_SCRATCH5]]
−
| FALCON_IRQMSET_HALT
+
| 0x54501818
 +
| 0x04
 
|-
 
|-
−
| 5
+
| [[#TSEC_SCRATCH6|TSEC_SCRATCH6]]
−
| FALCON_IRQMSET_EXTERR
+
| 0x5450181C
 +
| 0x04
 
|-
 
|-
−
| 6
+
| [[#TSEC_SCRATCH7|TSEC_SCRATCH7]]
−
| FALCON_IRQMSET_SWGEN0
+
| 0x54501820
 +
| 0x04
 
|-
 
|-
−
| 7
+
| [[#TSEC_GPTMRINT|TSEC_GPTMRINT]]
−
| FALCON_IRQMSET_SWGEN1
+
| 0x54501824
 +
| 0x04
 
|-
 
|-
−
| 8-15
+
| [[#TSEC_GPTMRVAL|TSEC_GPTMRVAL]]
−
| FALCON_IRQMSET_EXT
+
| 0x54501828
−
|}
+
| 0x04
−
 
+
|-
−
Used for setting the mask for Falcon's IRQs.
+
| [[#TSEC_GPTMRCTL|TSEC_GPTMRCTL]]
 +
| 0x5450182C
 +
| 0x04
 +
|-
 +
| [[#TSEC_ITFEN|TSEC_ITFEN]]
 +
| 0x54501830
 +
| 0x04
 +
|-
 +
| [[#TSEC_ITFSTAT|TSEC_ITFSTAT]]
 +
| 0x54501834
 +
| 0x04
 +
|-
 +
| [[#TSEC_TEGRA_CTL|TSEC_TEGRA_CTL]]
 +
| 0x54501838
 +
| 0x04
 +
|}
  
−
=== FALCON_IRQMCLR ===
+
=== TSEC_THI_INCR_SYNCPT ===
 
{| class="wikitable" border="1"
 
{| class="wikitable" border="1"
 
!  Bits
 
!  Bits
 
!  Description
 
!  Description
 
|-
 
|-
−
| 0
+
| 0-9
−
| FALCON_IRQMCLR_GPTMR
+
| TSEC_THI_INCR_SYNCPT_INDX
−
|-
 
−
| 1
 
−
| FALCON_IRQMCLR_WDTMR
 
 
|-
 
|-
−
| 2
+
| 10-17
−
| FALCON_IRQMCLR_MTHD
+
| TSEC_THI_INCR_SYNCPT_COND
−
|-
 
−
| 3
 
−
| FALCON_IRQMCLR_CTXSW
 
−
|-
 
−
| 4
 
−
| FALCON_IRQMCLR_HALT
 
−
|-
 
−
| 5
 
−
| FALCON_IRQMCLR_EXTERR
 
−
|-
 
−
| 6
 
−
| FALCON_IRQMCLR_SWGEN0
 
−
|-
 
−
| 7
 
−
| FALCON_IRQMCLR_SWGEN1
 
−
|-
 
−
| 8-15
 
−
| FALCON_IRQMCLR_EXT
 
 
|}
 
|}
  
−
Used for clearing the mask for Falcon's IRQs.
+
=== TSEC_THI_INCR_SYNCPT_CTRL ===
−
 
 
−
=== FALCON_IRQMASK ===
 
 
{| class="wikitable" border="1"
 
{| class="wikitable" border="1"
 
!  Bits
 
!  Bits
Line 817: Line 926:
 
|-
 
|-
 
| 0
 
| 0
−
| FALCON_IRQMASK_GPTMR
+
| TSEC_THI_INCR_SYNCPT_CTRL_SOFT_RESET
 
|-
 
|-
−
| 1
+
| 8
−
| FALCON_IRQMASK_WDTMR
+
| TSEC_THI_INCR_SYNCPT_CTRL_NO_STALL
 +
|-
 +
| 16
 +
| TSEC_THI_INCR_SYNCPT_CTRL_SOFT_RESET_0
 +
|-
 +
| 17
 +
| TSEC_THI_INCR_SYNCPT_CTRL_NO_STALL_0
 +
|-
 +
| 18
 +
| TSEC_THI_INCR_SYNCPT_CTRL_SOFT_RESET_1
 
|-
 
|-
−
| 2
+
| 19
−
| FALCON_IRQMASK_MTHD
+
| TSEC_THI_INCR_SYNCPT_CTRL_NO_STALL_1
 
|-
 
|-
−
| 3
+
| 20
−
| FALCON_IRQMASK_CTXSW
+
| TSEC_THI_INCR_SYNCPT_CTRL_SOFT_RESET_2
 
|-
 
|-
−
| 4
+
| 21
−
| FALCON_IRQMASK_HALT
+
| TSEC_THI_INCR_SYNCPT_CTRL_NO_STALL_2
 
|-
 
|-
−
| 5
+
| 22
−
| FALCON_IRQMASK_EXTERR
+
| TSEC_THI_INCR_SYNCPT_CTRL_SOFT_RESET_3
 
|-
 
|-
−
| 6
+
| 23
−
| FALCON_IRQMASK_SWGEN0
+
| TSEC_THI_INCR_SYNCPT_CTRL_NO_STALL_3
 
|-
 
|-
−
| 7
+
| 24
−
| FALCON_IRQMASK_SWGEN1
+
| TSEC_THI_INCR_SYNCPT_CTRL_SOFT_RESET_4
 
|-
 
|-
−
| 8-15
+
| 25
−
| FALCON_IRQMASK_EXT
+
| TSEC_THI_INCR_SYNCPT_CTRL_NO_STALL_4
 
|}
 
|}
  
−
Used for getting the value of the mask for Falcon's IRQs.
+
=== TSEC_THI_INCR_SYNCPT_ERR ===
−
 
 
−
=== FALCON_IRQDEST ===
 
 
{| class="wikitable" border="1"
 
{| class="wikitable" border="1"
 
!  Bits
 
!  Bits
Line 852: Line 968:
 
|-
 
|-
 
| 0
 
| 0
−
| FALCON_IRQDEST_GPTMR
+
| TSEC_THI_INCR_SYNCPT_ERR_COND_STS_IMM
 
|-
 
|-
 
| 1
 
| 1
−
| FALCON_IRQDEST_WDTMR
+
| TSEC_THI_INCR_SYNCPT_ERR_COND_STS_OPDONE
 
|-
 
|-
 
| 2
 
| 2
−
| FALCON_IRQDEST_MTHD
+
| TSEC_THI_INCR_SYNCPT_ERR_COND_STS_RD_DONE
 
|-
 
|-
 
| 3
 
| 3
−
| FALCON_IRQDEST_CTXSW
+
| TSEC_THI_INCR_SYNCPT_ERR_COND_STS_REG_WR_SAFE
 
|-
 
|-
 
| 4
 
| 4
−
| FALCON_IRQDEST_HALT
+
| TSEC_THI_INCR_SYNCPT_ERR_COND_STS_ENGINE_IDLE
 +
|}
 +
 
 +
=== TSEC_THI_CTXSW_INCR_SYNCPT ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 
|-
 
|-
−
| 5
+
| 0-9
−
| FALCON_IRQDEST_EXTERR
+
| TSEC_THI_CTXSW_INCR_SYNCPT_INDX
 +
|}
 +
 
 +
=== TSEC_THI_CTXSW ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 
|-
 
|-
−
| 6
+
| 0-9
−
| FALCON_IRQDEST_SWGEN0
+
| TSEC_THI_CTXSW_CURR_CLASS
 
|-
 
|-
−
| 7
+
| 10
−
| FALCON_IRQDEST_SWGEN1
+
| TSEC_THI_CTXSW_AUTO_ACK
 
|-
 
|-
−
| 8-15
+
| 11-20
−
| FALCON_IRQDEST_EXT
+
| TSEC_THI_CTXSW_CURR_CHANNEL
 +
|}
 +
 
 +
=== TSEC_THI_CTXSW_NEXT ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 
|-
 
|-
−
| 16
+
| 0-9
−
| FALCON_IRQDEST_TARGET_GPTMR
+
| TSEC_THI_CTXSW_NEXT_NEXT_CLASS
 
|-
 
|-
−
| 17
+
| 10-19
−
| FALCON_IRQDEST_TARGET_WDTMR
+
| TSEC_THI_CTXSW_NEXT_NEXT_CHANNEL
 +
|}
 +
 
 +
=== TSEC_THI_CONT_SYNCPT_EOF ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 
|-
 
|-
−
| 18
+
| 0-9
−
| FALCON_IRQDEST_TARGET_MTHD
+
| TSEC_THI_CONT_SYNCPT_EOF_INDEX
 
|-
 
|-
−
| 19
+
| 10
−
| FALCON_IRQDEST_TARGET_CTXSW
+
| TSEC_THI_CONT_SYNCPT_EOF_COND
 +
|}
 +
 
 +
=== TSEC_THI_CONT_SYNCPT_L1 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 
|-
 
|-
−
| 20
+
| 0-9
−
| FALCON_IRQDEST_TARGET_HALT
+
| TSEC_THI_CONT_SYNCPT_L1_INDEX
 
|-
 
|-
−
| 21
+
| 10
−
| FALCON_IRQDEST_TARGET_EXTERR
+
| TSEC_THI_CONT_SYNCPT_L1_COND
−
|-
+
|}
−
| 22
 
−
| FALCON_IRQDEST_TARGET_SWGEN0
 
−
|-
 
−
| 23
 
−
| FALCON_IRQDEST_TARGET_SWGEN1
 
−
|-
 
−
| 24-31
 
−
| FALCON_IRQDEST_TARGET_EXT
 
−
|}
 
−
 
 
−
Used for routing Falcon's IRQs.
 
−
 
 
−
=== FALCON_SCRATCH0 ===
 
−
Scratch register for reading/writing data to Falcon.
 
−
 
 
−
=== FALCON_SCRATCH1 ===
 
−
Scratch register for reading/writing data to Falcon.
 
  
−
=== FALCON_ITFEN ===
+
=== TSEC_THI_METHOD0 ===
 
{| class="wikitable" border="1"
 
{| class="wikitable" border="1"
 
!  Bits
 
!  Bits
 
!  Description
 
!  Description
 
|-
 
|-
−
| 0
+
| 0-11
−
| FALCON_ITFEN_CTXEN
+
| TSEC_THI_METHOD0_OFFSET
−
|-
 
−
| 1
 
−
| FALCON_ITFEN_MTHDEN
 
 
|}
 
|}
  
−
Used for enabling/disabling Falcon interfaces.
+
Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.
  
−
=== FALCON_IDLESTATE ===
+
The following methods are available:
 
{| class="wikitable" border="1"
 
{| class="wikitable" border="1"
−
!  Bits
+
!  ID
−
!  Description
+
!  Method
 +
|-
 +
| 0x100
 +
| NOP
 +
|-
 +
| 0x140
 +
| PM_TRIGGER
 +
|-
 +
| 0x200
 +
| SET_APPLICATION_ID
 +
|-
 +
| 0x204
 +
| SET_WATCHDOG_TIMER
 +
|-
 +
| 0x240
 +
| SEMAPHORE_A
 +
|-
 +
| 0x244
 +
| SEMAPHORE_B
 +
|-
 +
| 0x248
 +
| SEMAPHORE_C
 
|-
 
|-
−
| 0
+
| 0x24C
−
| FALCON_IDLESTATE_FALCON_BUSY
+
| CTX_SAVE_AREA
 
|-
 
|-
−
| 1-15
+
| 0x250
−
| FALCON_IDLESTATE_EXT_BUSY
+
| CTX_SWITCH
−
|}
+
|-
−
 
+
| 0x300
−
Used for detecting if Falcon is busy or not.
+
| EXECUTE
−
 
+
|-
−
=== FALCON_DEBUGINFO ===
+
| 0x304
−
Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.
+
| SEMAPHORE_D
−
 
 
−
[6.0.0+] [[NV_services|nvservices]] sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.
 
−
 
 
−
=== FALCON_EXCI ===
 
−
Contains information about raised exceptions.
 
−
 
 
−
=== FALCON_CPUCTL ===
 
−
{| class="wikitable" border="1"
 
−
!  Bits
 
−
!  Description
 
 
|-
 
|-
−
| 0
+
| 0x500
−
| FALCON_CPUCTL_IINVAL
+
| HDCP_INIT
 
|-
 
|-
−
| 1
+
| 0x504
−
| FALCON_CPUCTL_STARTCPU
+
| HDCP_CREATE_SESSION
 
|-
 
|-
−
| 2
+
| 0x508
−
| FALCON_CPUCTL_SRESET
+
| HDCP_VERIFY_CERT_RX
 
|-
 
|-
−
| 3
+
| 0x50C
−
| FALCON_CPUCTL_HRESET
+
| HDCP_GENERATE_EKM
 
|-
 
|-
−
| 4
+
| 0x510
−
| FALCON_CPUCTL_HALTED
+
| HDCP_REVOCATION_CHECK
 
|-
 
|-
−
| 5
+
| 0x514
−
| FALCON_CPUCTL_STOPPED
+
| HDCP_VERIFY_HPRIME
−
|}
 
−
 
 
−
Used for signaling the Falcon CPU.
 
−
 
 
−
=== FALCON_BOOTVEC ===
 
−
Takes the Falcon's boot vector address.
 
−
 
 
−
=== FALCON_DMACTL ===
 
−
{| class="wikitable" border="1"
 
−
!  Bits
 
−
!  Description
 
 
|-
 
|-
−
| 0
+
| 0x518
−
| FALCON_DMACTL_REQUIRE_CTX
+
| HDCP_ENCRYPT_PAIRING_INFO
 
|-
 
|-
−
| 1
+
| 0x51C
−
| FALCON_DMACTL_DMEM_SCRUBBING
+
| HDCP_DECRYPT_PAIRING_INFO
 
|-
 
|-
−
| 2
+
| 0x520
−
| FALCON_DMACTL_IMEM_SCRUBBING
+
| HDCP_UPDATE_SESSION
 
|-
 
|-
−
| 3-6
+
| 0x524
−
| FALCON_DMACTL_DMAQ_NUM
+
| HDCP_GENERATE_LC_INIT
 
|-
 
|-
−
| 7
+
| 0x528
−
| FALCON_DMACTL_SECURE_STAT
+
| HDCP_VERIFY_LPRIME
−
|}
+
|-
−
 
+
| 0x52C
−
Used for configuring the Falcon's DMA engine.
+
| HDCP_GENERATE_SKE_INIT
−
 
+
|-
−
=== FALCON_DMATRFBASE ===
+
| 0x530
−
Takes the host's base address for transferring data to/from the Falcon (DMA).
+
| HDCP_VERIFY_VPRIME
−
 
+
|-
−
=== FALCON_DMATRFMOFFS ===
+
| 0x534
−
Takes the offset for the host's source memory being transferred.
+
| HDCP_ENCRYPTION_RUN_CTRL
−
 
+
|-
−
=== FALCON_DMATRFCMD ===
+
| 0x538
−
{| class="wikitable" border="1"
+
| HDCP_SESSION_CTRL
−
!  Bits
 
−
!  Description
 
 
|-
 
|-
−
| 0
+
| 0x53C
−
| FALCON_DMATRFCMD_FULL
+
| HDCP_COMPUTE_SPRIME
 
|-
 
|-
−
| 1
+
| 0x540
−
| FALCON_DMATRFCMD_IDLE
+
| HDCP_GET_CERT_RX
 
|-
 
|-
−
| 2-3
+
| 0x544
−
| FALCON_DMATRFCMD_SEC
+
| HDCP_EXCHANGE_INFO
 
|-
 
|-
−
| 4
+
| 0x548
−
| FALCON_DMATRFCMD_IMEM
+
| HDCP_DECRYPT_KM
 
|-
 
|-
−
| 5
+
| 0x54C
−
| FALCON_DMATRFCMD_WRITE
+
| HDCP_GET_HPRIME
 
|-
 
|-
−
| 8-10
+
| 0x550
−
| FALCON_DMATRFCMD_SIZE
+
| HDCP_GENERATE_EKH_KM
 
|-
 
|-
−
| 12-14
+
| 0x554
−
| FALCON_DMATRFCMD_CTXDMA
+
| HDCP_VERIFY_RTT_CHALLENGE
−
|}
 
−
 
 
−
Used for configuring DMA transfers.
 
−
 
 
−
=== FALCON_DMATRFFBOFFS ===
 
−
Takes the offset for Falcon's target memory being transferred.
 
−
 
 
−
=== TSEC_SCP_CTL_STAT ===
 
−
{| class="wikitable" border="1"
 
−
!  Bits
 
−
!  Description
 
 
|-
 
|-
−
| 20
+
| 0x558
−
| TSEC_SCP_CTL_STAT_DEBUG_MODE
+
| HDCP_GET_LPRIME
−
|}
 
−
 
 
−
=== TSEC_SCP_CTL_PKEY ===
 
−
{| class="wikitable" border="1"
 
−
!  Bits
 
−
!  Description
 
 
|-
 
|-
−
| 0
+
| 0x55C
−
| TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
+
| HDCP_DECRYPT_KS
 
|-
 
|-
−
| 1
+
| 0x560
−
| TSEC_SCP_CTL_PKEY_LOADED
+
| HDCP_DECRYPT
−
|}
 
−
 
 
−
=== TSEC_TFBIF_MCCIF_FIFOCTRL ===
 
−
{| class="wikitable" border="1"
 
−
!  Bits
 
−
!  Description
 
 
|-
 
|-
−
| 0
+
| 0x564
−
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
+
| HDCP_GET_RRX
 
|-
 
|-
−
| 1
+
| 0x568
−
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
+
| HDCP_DECRYPT_REENCRYPT
 
|-
 
|-
−
| 2
+
| 0x56C
−
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
+
|  
 
|-
 
|-
−
| 3
+
| 0x570
−
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
+
|  
 
|-
 
|-
−
| 4
+
| 0x574
−
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
+
| HDCP_DECRYPT_STORED_KM
 
|-
 
|-
−
| 5
+
| 0x578
−
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
+
| HDCP_GET_CURRENT_RESOLUTION
 
|-
 
|-
−
| 6
+
| 0x57C
−
| TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
+
| HDCP_GET_CURRENT_VERSION
 
|-
 
|-
−
| 7
+
| 0x700
−
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
+
| HDCP_VALIDATE_SRM
 
|-
 
|-
−
| 8
+
| 0x704
−
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE
+
| HDCP_VALIDATE_STREAM
 +
|-
 +
| 0x708
 +
| HDCP_TEST_SECURE_STATUS
 +
|-
 +
| 0x70C
 +
| HDCP_SET_DCP_KPUB
 +
|-
 +
| 0x710
 +
| HDCP_SET_RX_KPUB
 +
|-
 +
| 0x714
 +
| HDCP_SET_CERT_RX
 +
|-
 +
| 0x718
 +
| HDCP_SET_SCRATCH_BUFFER
 +
|-
 +
| 0x71C
 +
| HDCP_SET_SRM
 +
|-
 +
| 0x720
 +
| HDCP_SET_RECEIVER_ID_LIST
 +
|-
 +
| 0x724
 +
| HDCP_SET_SPRIME
 +
|-
 +
| 0x728
 +
| HDCP_SET_ENC_INPUT_BUFFER
 +
|-
 +
| 0x72C
 +
| HDCP_SET_ENC_OUTPUT_BUFFER
 +
|-
 +
| 0x730
 +
| HDCP_GET_RTT_CHALLENGE
 +
|-
 +
| 0x734
 +
| HDCP_STREAM_MANAGE
 +
|-
 +
| 0x738
 +
| HDCP_READ_CAPS
 +
|-
 +
| 0x73C
 +
| HDCP_ENCRYPT
 +
|-
 +
| 0x740
 +
| [6.0.0+] HDCP_GET_CURRENT_NONCE
 +
|-
 +
| 0x1114
 +
| PM_TRIGGER_END
 
|}
 
|}
  
−
=== TSEC_MCCIF_FIFOCTRL1 ===
+
=== TSEC_THI_METHOD1 ===
 
{| class="wikitable" border="1"
 
{| class="wikitable" border="1"
 
!  Bits
 
!  Bits
 
!  Description
 
!  Description
 
|-
 
|-
−
| 0-15
+
| 0-31
−
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
+
| TSEC_THI_METHOD1_DATA
−
|-
 
−
| 16-31
 
−
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT
 
 
|}
 
|}
  
−
=== TSEC_TFBIF_UNK5 ===
+
Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.
−
Used to control accesses to DRAM.
 
  
−
[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.
+
=== TSEC_THI_CONTEXT_SWITCH ===
−
 
 
−
=== TSEC_TFBIF_UNK6 ===
 
−
Used to control accesses to DRAM.
 
−
 
 
−
[6.0.0+] The nvhost_tsec firmware sets this register to (data_size << 4) before reading memory from the GPU UCODE carveout.
 
−
 
 
−
=== TSEC_DMA_CMD ===
 
 
{| class="wikitable" border="1"
 
{| class="wikitable" border="1"
 
!  Bits
 
!  Bits
 
!  Description
 
!  Description
 
|-
 
|-
−
| 0
+
| 0-27
−
| TSEC_DMA_CMD_READ
+
| TSEC_THI_CONTEXT_SWITCH_PTR
 
|-
 
|-
−
| 1
+
| 30-31
−
| TSEC_DMA_CMD_WRITE
+
| TSEC_THI_CONTEXT_SWITCH_TARGET
 +
|}
 +
 
 +
=== TSEC_THI_INT_STATUS ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 
|-
 
|-
−
| 4-7
+
| 0
−
| TSEC_DMA_CMD_UNK
+
| TSEC_THI_INT_STATUS_FALCON_INT
 +
|}
 +
 
 +
=== TSEC_THI_INT_MASK ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 
|-
 
|-
−
| 12
+
| 0
−
| TSEC_DMA_CMD_BUSY
+
| TSEC_THI_INT_MASK_FALCON_INT
 +
|}
 +
 
 +
=== TSEC_THI_CONFIG0 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 
|-
 
|-
−
| 13
+
| 0
−
| TSEC_DMA_CMD_ERROR
+
| TSEC_THI_CONFIG0_RETURN_SYNCPT_ON_ERR
 
|-
 
|-
−
| 31
+
| 4
−
| TSEC_DMA_CMD_INIT
+
| TSEC_THI_CONFIG0_IDLE_SYNCPT_INC_ENG
 
|}
 
|}
  
−
A DMA read/write operation requires bits TSEC_DMA_CMD_INIT and TSEC_DMA_CMD_READ/TSEC_DMA_CMD_WRITE to be set in TSEC_DMA_CMD.
+
=== TSEC_THI_DBG_MISC ===
−
 
 
−
During the transfer, the TSEC_DMA_CMD_BUSY bit is set.
 
−
 
 
−
Accessing an invalid address causes bit TSEC_DMA_CMD_ERROR to be set.
 
−
 
 
−
=== TSEC_DMA_ADDR ===
 
−
Takes the address for DMA transfers between TSEC and HOST1X (master and clients).
 
−
 
 
−
=== TSEC_DMA_VAL ===
 
−
Takes the value for DMA transfers between TSEC and HOST1X (master and clients).
 
−
 
 
−
=== TSEC_DMA_UNK ===
 
−
Always 0xFFF.
 
−
 
 
−
=== TSEC_TEGRA_CTL ===
 
 
{| class="wikitable" border="1"
 
{| class="wikitable" border="1"
 
!  Bits
 
!  Bits
 
!  Description
 
!  Description
 
|-
 
|-
−
| 16
+
| 0
−
| TSEC_TEGRA_CTL_TKFI_KFUSE
+
| TSEC_THI_DBG_MISC_CLIENT_IDLE_STATUS
 
|-
 
|-
−
| 17
+
| 1
−
| TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
+
| TSEC_THI_DBG_MISC_THI_IDLE_STATUS
 
|-
 
|-
−
| 24
+
| 2
−
| TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
+
| TSEC_THI_DBG_MISC_THI_SYNCPT_PENDING_STATUS
 
|-
 
|-
−
| 25
+
| 3
−
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
+
| TSEC_THI_DBG_MISC_THI_IDLE_EN
 +
|}
 +
 
 +
=== TSEC_THI_SLCG_OVERRIDE_HIGH_A ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 
|-
 
|-
−
| 26
+
| 0-7
−
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
+
| TSEC_THI_SLCG_OVERRIDE_HIGH_A_REG
 +
|}
 +
 
 +
=== TSEC_THI_SLCG_OVERRIDE_LOW_A ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 
|-
 
|-
−
| 27
+
| 0-31
−
| TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C
+
| TSEC_THI_SLCG_OVERRIDE_LOW_A_REG
 
|}
 
|}
  
−
= Boot Process =
+
=== TSEC_THI_CLK_OVERRIDE ===
−
TSEC is configured and initialized by the first bootloader during key generation.
+
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| TSEC_THI_CLK_OVERRIDE_CYA
 +
|}
  
−
[6.2.0+] TSEC is now configured at the end of the first bootloader's main function.
+
=== TSEC_FALCON_IRQSSET ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| TSEC_FALCON_IRQSSET_GPTMR
 +
|-
 +
| 1
 +
| TSEC_FALCON_IRQSSET_WDTMR
 +
|-
 +
| 2
 +
| TSEC_FALCON_IRQSSET_MTHD
 +
|-
 +
| 3
 +
| TSEC_FALCON_IRQSSET_CTXSW
 +
|-
 +
| 4
 +
| TSEC_FALCON_IRQSSET_HALT
 +
|-
 +
| 5
 +
| TSEC_FALCON_IRQSSET_EXTERR
 +
|-
 +
| 6
 +
| TSEC_FALCON_IRQSSET_SWGEN0
 +
|-
 +
| 7
 +
| TSEC_FALCON_IRQSSET_SWGEN1
 +
|-
 +
| 8-15
 +
| TSEC_FALCON_IRQSSET_EXT
 +
|-
 +
| 16
 +
| TSEC_FALCON_IRQSSET_DMA
 +
|}
  
−
== Initialization ==
+
Used for setting Falcon's IRQs.
−
During this stage several clocks are programmed.
 
−
// Program the HOST1X clock and resets
 
−
// Uses RST_DEVICES_L, CLK_OUT_ENB_L, CLK_SOURCE_HOST1X and CLK_L_HOST1X
 
−
enable_host1x_clkrst();
 
−
 
−
// Program the TSEC clock and resets
 
−
// Uses RST_DEVICES_U, CLK_OUT_ENB_U, CLK_SOURCE_TSEC and CLK_U_TSEC
 
−
enable_tsec_clkrst();
 
−
 
−
// Program the SOR_SAFE clock and resets
 
−
// Uses RST_DEVICES_Y, CLK_OUT_ENB_Y and CLK_Y_SOR_SAFE
 
−
enable_sor_safe_clkrst();
 
−
 
−
// Program the SOR0 clock and resets
 
−
// Uses RST_DEVICES_X, CLK_OUT_ENB_X and CLK_X_SOR0
 
−
enable_sor0_clkrst();
 
−
 
−
// Program the SOR1 clock and resets
 
−
// Uses RST_DEVICES_X, CLK_OUT_ENB_X, CLK_SOURCE_SOR1 and CLK_X_SOR1
 
−
enable_sor1_clkrst();
 
−
 
−
// Program the KFUSE clock resets
 
−
// Uses RST_DEVICES_H, CLK_OUT_ENB_H and CLK_H_KFUSE
 
−
enable_kfuse_clkrst();
 
  
−
== Configuration ==
+
=== TSEC_FALCON_IRQSCLR ===
−
In this stage the Falcon IRQs, interfaces and DMA engine are configured.
+
{| class="wikitable" border="1"
−
// Clear the Falcon DMA control register
+
! Bits
−
*(u32 *)FALCON_DMACTL = 0;
+
! Description
−
+
|-
−
// Enable Falcon IRQs
+
| 0
−
*(u32 *)FALCON_IRQMSET = 0xFFF2;
+
| TSEC_FALCON_IRQSCLR_GPTMR
−
+
|-
−
// Enable Falcon IRQs
+
| 1
−
*(u32 *)FALCON_IRQDEST = 0xFFF0;
+
| TSEC_FALCON_IRQSCLR_WDTMR
−
+
|-
−
// Enable Falcon interfaces
+
| 2
−
*(u32 *)FALCON_ITFEN = 0x03;
+
| TSEC_FALCON_IRQSCLR_MTHD
−
+
|-
−
// Wait for Falcon's DMA engine to be idle
+
| 3
−
wait_flcn_dma_idle();
+
| TSEC_FALCON_IRQSCLR_CTXSW
−
 
+
|-
−
== Firmware loading ==
+
| 4
−
The Falcon firmware code is stored in the first bootloader's data segment in IMEM.
+
| TSEC_FALCON_IRQSCLR_HALT
−
  // Set DMA transfer base address to 0x40011900 >> 0x08
+
|-
−
  *(u32 *)FALCON_DMATRFBASE = 0x400119;
+
| 5
−
+
| TSEC_FALCON_IRQSCLR_EXTERR
−
u32 trf_mode = 0;    // A value of 0 sets FALCON_DMATRFCMD_IMEM
+
|-
−
u32 dst_offset = 0;
+
| 6
−
u32 src_offset = 0;
+
| TSEC_FALCON_IRQSCLR_SWGEN0
−
+
|-
−
// Load code into Falcon (0x100 bytes at a time)
+
| 7
−
while (src_offset < 0xF00)
+
| TSEC_FALCON_IRQSCLR_SWGEN1
−
{
+
|-
−
    flcn_load_firm(trf_mode, src_offset, dst_offset);
+
| 8-15
−
    src_offset += 0x100;
+
| TSEC_FALCON_IRQSCLR_EXT
−
    dst_offset += 0x100;
+
|-
−
}
+
| 16
−
 
+
| TSEC_FALCON_IRQSCLR_DMA
−
[6.2.0+] The transfer base address and size of the Falcon firmware code changed.
+
|}
−
// Set DMA transfer base address to 0x40010E00 >> 0x08
 
−
*(u32 *)FALCON_DMATRFBASE = 0x40010E;
 
−
 
−
u32 trf_mode = 0;    // A value of 0 sets FALCON_DMATRFCMD_IMEM
 
−
u32 dst_offset = 0;
 
−
u32 src_offset = 0;
 
−
 
−
// Load code into Falcon (0x100 bytes at a time)
 
−
while (src_offset < 0x2900)
 
−
{
 
−
    flcn_load_firm(trf_mode, src_offset, dst_offset);
 
−
    src_offset += 0x100;
 
−
    dst_offset += 0x100;
 
−
}
 
−
 
 
−
== Firmware booting ==
 
−
Falcon is booted up and the first bootloader waits for it to finish.
 
−
// Set magic value in host1x scratch space
 
−
*(u32 *)0x50003300 = 0x34C2E1DA;
 
−
 
−
// Clear Falcon scratch1 MMIO
 
−
*(u32 *)FALCON_SCRATCH1 = 0;
 
−
 
−
// Set Falcon boot key version in scratch0 MMIO
 
−
*(u32 *)FALCON_SCRATCH0 = 0x01;
 
−
 
−
// Set Falcon's boot vector address
 
−
*(u32 *)FALCON_BOOTVEC = 0;
 
−
 
−
// Signal Falcon's CPU
 
−
*(u32 *)FALCON_CPUCTL = 0x02;
 
−
 
−
// Wait for Falcon's DMA engine to be idle
 
−
wait_flcn_dma_idle();
 
−
 
−
u32 boot_res = 0;
 
−
 
−
// The bootloader allows the TSEC two seconds from this point to do its job
 
−
u32 maximum_time = read_timer() + 2000000;
 
−
 
−
while (!boot_res)
 
−
{
 
−
    // Read boot result from scratch1 MMIO
 
−
    boot_res = *(u32 *)FALCON_SCRATCH1;
 
−
   
 
−
    // Read from TIMERUS_CNTR_1US (microseconds from boot)
 
−
    u32 current_time = read_timer();
 
−
   
 
−
    // Booting is taking too long
 
−
    if (current_time > maximum_time)
 
−
      panic();
 
−
}
 
−
 
−
// Invalid boot result was returned
 
−
if (boot_res != 0xB0B0B0B0)
 
−
    panic();
 
  
−
[6.2.0+] Falcon is booted up, but the first bootloader is left in an infinite loop.
+
Used for clearing Falcon's IRQs.
−
// Set magic value in host1x scratch space
 
−
*(u32 *)0x50003300 = 0x34C2E1DA;
 
−
 
−
// Clear Falcon scratch1 MMIO
 
−
*(u32 *)FALCON_SCRATCH1 = 0;
 
−
 
−
// Set Falcon boot key version in scratch0 MMIO
 
−
*(u32 *)FALCON_SCRATCH0 = 0x01;
 
−
 
−
// Set Falcon's boot vector address
 
−
*(u32 *)FALCON_BOOTVEC = 0;
 
−
 
−
// Signal Falcon's CPU
 
−
*(u32 *)FALCON_CPUCTL = 0x02;
 
−
 
−
// Infinite loop
 
−
deadlock();
 
  
−
== TSEC key generation ==
+
=== TSEC_FALCON_IRQSTAT ===
−
The TSEC key is generated by reading SOR1 registers modified by the Falcon CPU.
+
{| class="wikitable" border="1"
−
// Clear magic value in host1x scratch space
+
! Bits
−
*(u32 *)0x50003300 = 0;
+
! Description
−
+
|-
−
// Read TSEC key
+
| 0
−
u32 tsec_key[4];
+
| TSEC_FALCON_IRQSTAT_GPTMR
−
tsec_key[0] = *(u32 *)NV_SOR_DP_HDCP_BKSV_LSB;
+
|-
−
tsec_key[1] = *(u32 *)NV_SOR_TMDS_HDCP_BKSV_LSB;
+
| 1
−
tsec_key[2] = *(u32 *)NV_SOR_TMDS_HDCP_CN_MSB;
+
| TSEC_FALCON_IRQSTAT_WDTMR
−
  tsec_key[3] = *(u32 *)NV_SOR_TMDS_HDCP_CN_LSB;
+
|-
−
   
+
| 2
−
// Clear SOR1 registers
+
| TSEC_FALCON_IRQSTAT_MTHD
−
*(u32 *)NV_SOR_DP_HDCP_BKSV_LSB = 0;
+
|-
−
*(u32 *)NV_SOR_TMDS_HDCP_BKSV_LSB = 0;
+
| 3
−
*(u32 *)NV_SOR_TMDS_HDCP_CN_MSB = 0;
+
| TSEC_FALCON_IRQSTAT_CTXSW
−
*(u32 *)NV_SOR_TMDS_HDCP_CN_LSB = 0;
+
|-
−
+
| 4
−
if (out_size < 0x10)
+
| TSEC_FALCON_IRQSTAT_HALT
−
    out_size = 0x10;
+
|-
−
+
| 5
−
// Copy back the TSEC key
+
| TSEC_FALCON_IRQSTAT_EXTERR
−
memcpy(out_buf, tsec_key, out_size);
+
|-
−
 
+
| 6
−
[6.2.0+] This is now done inside an encrypted TSEC payload.
+
| TSEC_FALCON_IRQSTAT_SWGEN0
−
 
+
|-
−
== Cleanup ==
+
| 7
−
Clocks and resets are disabled before returning.
+
| TSEC_FALCON_IRQSTAT_SWGEN1
−
// Deprogram KFUSE clock and resets
+
|-
−
// Uses RST_DEVICES_H, CLK_OUT_ENB_H and CLK_H_KFUSE
+
| 8-15
−
disable_kfuse_clkrst();
+
| TSEC_FALCON_IRQSTAT_EXT
−
+
|-
−
// Deprogram SOR1 clock and resets
+
| 16
−
// Uses RST_DEVICES_X, CLK_OUT_ENB_X, CLK_SOURCE_SOR1 and CLK_X_SOR1
+
| TSEC_FALCON_IRQSTAT_DMA
−
disable_sor1_clkrst();
+
|}
−
 
−
// Deprogram SOR0 clock and resets
 
−
// Uses RST_DEVICES_X, CLK_OUT_ENB_X and CLK_X_SOR0
 
−
disable_sor0_clkrst();
 
−
 
−
// Deprogram SOR_SAFE clock and resets
 
−
// Uses RST_DEVICES_Y, CLK_OUT_ENB_Y and CLK_Y_SOR_SAFE
 
−
disable_sor_safe_clkrst();
 
−
 
−
// Deprogram TSEC clock and resets
 
−
// Uses RST_DEVICES_U, CLK_OUT_ENB_U, CLK_SOURCE_TSEC and CLK_U_TSEC
 
−
disable_tsec_clkrst();
 
−
 
−
// Deprogram HOST1X clock and resets
 
−
// Uses RST_DEVICES_L, CLK_OUT_ENB_L, CLK_SOURCE_HOST1X and CLK_L_HOST1X
 
−
disable_host1x_clkrst();
 
−
 
−
return;
 
−
 
 
−
= TSEC Firmware =
 
−
The actual code loaded into TSEC is assembled in NVIDIA's proprietary fuc5 ISA using crypto extensions.
 
−
Stored inside the first bootloader, this firmware binary is split into 4 blobs (names are unofficial): [[#Boot|Boot]] (unencrypted and unauthenticated code), [[#KeygenLdr|KeygenLdr]] (unencrypted and authenticated code), [[#Keygen|Keygen]] (encrypted and authenticated code) and [[#Key data|key data]].
 
−
 
 
−
[6.2.0+] There are now 6 blobs (names are unofficial): [[#Boot|Boot]] (unencrypted and unauthenticated code), [[#Loader|Loader]] (unencrypted and unauthenticated code), [[#KeygenLdr|KeygenLdr]] (unencrypted and authenticated code), [[#Keygen|Keygen]] (encrypted and authenticated code), [[#Payload|Payload]] (part unencrypted and unauthenticated code, part encrypted and authenticated code) and [[#Key data|key data]].
 
  
−
Firmware can be disassembled with [http://envytools.readthedocs.io/en/latest/ envytools'] [https://github.com/envytools/envytools/tree/master/envydis envydis]:
+
Used for getting the status of Falcon's IRQs.
  
−
<code>envydis -i tsec_fw.bin -m falcon -V fuc5 -F crypt</code>
+
=== TSEC_FALCON_IRQMODE ===
−
 
+
{| class="wikitable" border="1"
−
Note that the instruction set has variable length instructions, and the disassembler is not very good at detecting locations it should start disassembling from. One needs to disassemble multiple sub-regions and join them together.
+
! Bits
−
 
+
!  Description
−
== Boot ==
+
|-
−
During this stage, [[#Key data|key data]] is loaded and [[#KeygenLdr|KeygenLdr]] is authenticated, loaded and executed.
+
| 0
−
Before returning, this stage writes back to the host (using MMIO registers) and sets the key used by the first bootloader.
+
| TSEC_FALCON_IRQMODE_LVL_GPTMR
−
 
+
|-
−
[6.2.0+] During this stage, [[#Key data|key data]] is loaded and execution jumps to [[#Loader|Loader]].
+
| 1
−
 
+
| TSEC_FALCON_IRQMODE_LVL_WDTMR
−
=== Initialization ===
+
|-
−
Falcon sets up it's own stack pointer.
+
| 2
−
// Read data segment size from IO space
+
| TSEC_FALCON_IRQMODE_LVL_MTHD
−
u32 data_seg_size = *(u32 *)UC_CAPS;
+
|-
−
data_seg_size >>= 0x09;
+
| 3
−
data_seg_size &= 0x1FF;
+
| TSEC_FALCON_IRQMODE_LVL_CTXSW
−
data_seg_size <<= 0x08;
+
|-
−
+
| 4
−
// Set the stack pointer
+
| TSEC_FALCON_IRQMODE_LVL_HALT
−
*(u32 *)sp = data_seg_size;
+
|-
−
 
+
| 5
−
=== Main ===
+
| TSEC_FALCON_IRQMODE_LVL_EXTERR
−
Falcon reads the [[#Key data|key data]] and then authenticates, loads and executes [[#KeygenLdr|KeygenLdr]] which sets the TSEC key.
+
|-
−
u32 boot_base_addr = 0;
+
| 6
−
u8 key_data_buf[0x7C];
+
| TSEC_FALCON_IRQMODE_LVL_SWGEN0
−
+
|-
−
// Read the key data from memory
+
| 7
−
u32 key_data_addr = 0x300;
+
| TSEC_FALCON_IRQMODE_LVL_SWGEN1
−
u32 key_data_size = 0x7C;
+
|-
−
read_code(key_data_buf, key_data_addr, key_data_size);
+
| 8-15
−
+
| TSEC_FALCON_IRQMODE_LVL_EXT
−
// Read the next code segment into boot base
+
|-
−
u32 blob1_addr = 0x400;
+
| 16
−
u32 blob1_size = *(u32 *)(key_data_buf + 0x74);
+
| TSEC_FALCON_IRQMODE_LVL_DMA
−
read_code(boot_base_addr, blob1_addr, blob1_size);
+
|}
−
 
−
// Upload the next code segment into Falcon's CODE region
 
−
u32 blob1_virt_addr = 0x300;
 
−
bool use_secret = true;
 
−
upload_code(blob1_virt_addr, boot_base_addr, blob1_size, blob1_virt_addr, use_secret);
 
−
 
−
u32 boot_res = 0;
 
−
bool is_done = false;
 
−
  u32 time = 0;
 
−
bool is_blob_dec = false;
 
−
 
−
while (!is_done)
 
−
  {
 
−
    if (time > 4000000)
 
−
    {
 
−
      // Write boot failed (timeout) magic to FALCON_SCRATCH1
 
−
      boot_res = 0xC0C0C0C0;
 
−
      *(u32 *)FALCON_SCRATCH1 = boot_res;
 
−
     
 
−
      break;
 
−
    }
 
−
   
 
−
    // Load key version from FALCON_SCRATCH0 (bootloader sends 0x01)
 
−
    u32 key_version = *(u32 *)FALCON_SCRATCH0;
 
−
 
−
    if (key_version == 0x64)
 
−
    {
 
−
      // Skip all next stages
 
−
      boot_res = 0xB0B0B0B0;
 
−
      *(u32 *)FALCON_SCRATCH1 = boot_res;
 
−
     
 
−
      break;
 
−
    }
 
−
    else
 
−
    {
 
−
      if (key_version > 0x03)
 
−
          boot_res = 0xD0D0D0D0;    // Invalid key version
 
−
      else if (key_version == 0)
 
−
          boot_res = 0xB0B0B0B0;    // No keys used
 
−
      else
 
−
      {
 
−
          u32 key_buf[0x7C];
 
−
         
 
−
          // Copy key data
 
−
          memcpy(key_buf, key_data_buf, 0x7C);
 
−
 
−
          u32 crypt_reg_flag = 0x00060000;
 
−
          u32 blob1_hash_addr = key_buf + 0x20;
 
−
 
−
          // fuc5 crypt cauth instruction
 
−
          // Set auth_addr to 0x300 and auth_size to blob1_size
 
−
          cauth((blob1_size << 0x10) | (0x300 >> 0x08));
 
−
 
−
          // fuc5 crypt cxset instruction
 
−
          // The next 2 xfer instructions will be overridden
 
−
          // and target changes from DMA to crypto
 
−
          cxset(0x02);
 
−
         
 
−
          // Transfer data to crypto register c6
 
−
  xdst(0, (blob1_hash_addr | crypt_reg_flag));
 
−
 
 
−
  // Wait for all data loads/stores to finish
 
−
  xdwait();
 
−
         
 
−
          // Jump to KeygenLdr
 
−
          u32 keygenldr_res = exec_keygenldr(key_buf, key_version, is_blob_dec);
 
−
          is_blob_dec = true;  // Set this to prevent decrypting again
 
−
 
−
          // Set boot finish magic on success
 
−
  if (keygenldr_res == 0)
 
−
            boot_res = 0xB0B0B0B0
 
−
      }
 
−
     
 
−
      // Write result to FALCON_SCRATCH1
 
−
      *(u32 *)FALCON_SCRATCH1 = boot_res;
 
−
 
−
      if (boot_res == 0xB0B0B0B0)
 
−
          is_done = true;
 
−
    }
 
−
 
−
    time++;
 
−
}
 
−
 
−
// Overwrite the TSEC key in SOR1 registers
 
−
// This has no effect because the KeygenLdr locks out the TSEC DMA engine
 
−
tsec_set_key(key_data_buf);
 
−
 
−
return boot_res;
 
  
−
[6.2.0+] Falcon reads the [[#Key data|key data]] and jumps to [[#Loader|Loader]].
+
Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.
−
u8 key_data_buf[0x84];
 
−
 
−
// Read the key data from memory
 
−
u32 key_data_addr = 0x300;
 
−
u32 key_data_size = 0x84;
 
−
read_code(key_data_buf, key_data_addr, key_data_size);
 
−
 
−
// Calculate the next blob's address
 
−
u32 blob4_size = *(u32 *)(key_data_buf + 0x80);
 
−
u32 blob0_size = *(u32 *)(key_data_buf + 0x70);
 
−
u32 blob1_size = *(u32 *)(key_data_buf + 0x74);
 
−
u32 blob2_size = *(u32 *)(key_data_buf + 0x78);
 
−
u32 blob3_addr = ((((blob0_size + blob1_size) + 0x100) + blob2_size) + blob4_size);
 
−
 
−
// Jump to next blob
 
−
(void *)blob3_addr();
 
−
 
 
−
return 0;
 
  
−
==== tsec_set_key ====
+
=== TSEC_FALCON_IRQMSET ===
−
This method takes '''key_data_buf''' (a 16 bytes buffer) as argument and writes its contents to SOR1 registers.
+
{| class="wikitable" border="1"
−
// This is TSEC_MMIO + 0x1000 + (0x1C300 / 0x40)
+
! Bits
−
*(u32 *)TSEC_DMA_UNK = 0xFFF;
+
! Description
−
+
|-
−
// Read the key's words
+
| 0
−
u32 key0 = *(u32 *)(key_data_buf + 0x00);
+
| TSEC_FALCON_IRQMSET_GPTMR
−
u32 key1 = *(u32 *)(key_data_buf + 0x04);
+
|-
−
u32 key2 = *(u32 *)(key_data_buf + 0x08);
+
| 1
−
u32 key3 = *(u32 *)(key_data_buf + 0x0C);
+
| TSEC_FALCON_IRQMSET_WDTMR
−
+
|-
−
u32 result = 0;
+
| 2
−
+
| TSEC_FALCON_IRQMSET_MTHD
−
// Write to SOR1 register
+
|-
−
result = tsec_dma_write(NV_SOR_DP_HDCP_BKSV_LSB, key0);
+
| 3
−
+
| TSEC_FALCON_IRQMSET_CTXSW
−
// Failed to write
+
|-
−
if (result)
+
| 4
−
    return result;
+
| TSEC_FALCON_IRQMSET_HALT
−
+
|-
−
// Write to SOR1 register
+
| 5
−
result = tsec_dma_write(NV_SOR_TMDS_HDCP_BKSV_LSB, key1);
+
| TSEC_FALCON_IRQMSET_EXTERR
−
+
|-
−
// Failed to write
+
| 6
−
if (result)
+
| TSEC_FALCON_IRQMSET_SWGEN0
−
    return result;
+
|-
−
+
| 7
−
// Write to SOR1 register
+
| TSEC_FALCON_IRQMSET_SWGEN1
−
result = tsec_dma_write(NV_SOR_TMDS_HDCP_CN_MSB, key2);
+
|-
−
+
| 8-15
−
// Failed to write
+
| TSEC_FALCON_IRQMSET_EXT
−
if (result)
+
|-
−
    return result;
+
| 16
−
+
| TSEC_FALCON_IRQMSET_DMA
−
// Write to SOR1 register
+
|}
−
result = tsec_dma_write(NV_SOR_TMDS_HDCP_CN_LSB, key3);
 
−
 
−
// Failed to write
 
−
if (result)
 
−
    return result;
 
−
 
−
return result;
 
−
 
 
−
===== tsec_dma_write =====
 
−
This method takes '''addr''' and '''value''' as arguments and performs a DMA write using TSEC MMIO.
 
−
u32 result = 0;
 
−
 
−
// Wait for TSEC DMA engine
 
−
// This waits for bit 0x0C in TSEC_DMA_CMD to be 0
 
−
result = wait_tsec_dma();
 
−
 
−
// Wait failed
 
−
if (result)
 
−
    return 1;
 
−
   
 
−
  // Set the destination address
 
−
// This is TSEC_MMIO + 0x1000 + (0x1C100 / 0x40)
 
−
*(u32 *)TSEC_DMA_ADDR = addr;
 
−
 
−
// Set the value
 
−
// This is TSEC_MMIO + 0x1000 + (0x1C200 / 0x40)
 
−
*(u32 *)TSEC_DMA_VAL = value;
 
−
 
−
// Start transfer?
 
−
// This is TSEC_MMIO + 0x1000 + (0x1C000 / 0x40)
 
−
*(u32 *)TSEC_DMA_CMD = 0x800000F2;
 
−
 
−
// Wait for TSEC DMA engine
 
−
// This waits for bit 0x0C in TSEC_DMA_CMD to be 0
 
−
result = wait_tsec_dma();
 
−
 
−
// Wait failed
 
−
if (result)
 
−
    return 1;
 
−
 
−
return 0;
 
−
 
 
−
== KeygenLdr ==
 
−
This stage is responsible for reconfiguring the Falcon's crypto co-processor and loading, decrypting, authenticating and executing [[#Keygen|Keygen]].
 
−
 
 
−
=== Main ===
 
−
// Clear interrupt flags
 
−
*(u8 *)flags_ie0 = 0;
 
−
*(u8 *)flags_ie1 = 0;
 
−
*(u8 *)flags_ie2 = 0;
 
−
 
−
// fuc5 crypt cxset instruction
 
−
// Clear overrides?
 
−
cxset(0x80);
 
−
 
−
// fuc5 crypt cauth instruction
 
−
// Clear bit 0x13 in cauth
 
−
cauth(cauth_old & ~(1 << 0x13));
 
−
 
−
// Set the target port for memory transfers
 
−
xtargets(0);
 
−
 
−
// Wait for all data loads/stores to finish
 
−
xdwait();
 
−
 
−
// Wait for all code loads to finish
 
−
xcwait();
 
−
 
−
// fuc5 crypt cxset instruction
 
−
// The next 2 xfer instructions will be overridden
 
−
// and target changes from DMA to crypto
 
−
cxset(0x02);
 
−
 
−
// Transfer data to crypto register c0
 
−
// This should clear any leftover data
 
−
xdst(0, 0);
 
−
 
−
// Wait for all data loads/stores to finish
 
−
xdwait();
 
−
 
−
// Clear all crypto registers, except c6 which is used for auth
 
−
cxor(c0, c0);
 
−
cmov(c1, c0);
 
−
cmov(c2, c0);
 
−
cmov(c3, c0);
 
−
cmov(c4, c0);
 
−
cmov(c5, c0);
 
−
cmov(c7, c0);
 
−
 
−
// Clear TSEC_TEGRA_CTL_TKFI_KFUSE
 
−
// This is TSEC_MMIO + 0x1000 + (0x20E00 / 0x40)
 
−
*(u32 *)TSEC_TEGRA_CTL &= 0xEFFFF;
 
−
 
−
// Set TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
 
−
// This is TSEC_MMIO + 0x1000 + (0x10600 / 0x40)
 
−
*(u32 *)TSEC_SCP_CTL_PKEY |= 0x01;
 
−
 
−
u32 is_pkey_loaded = 0;
 
−
 
−
// Wait for TSEC_SCP_CTL_PKEY_LOADED
 
−
while (!is_pkey_loaded)
 
−
    is_pkey_loaded = (*(u32 *)TSEC_SCP_CTL_PKEY & 0x02);
 
−
 
−
// Read data segment size from IO space
 
−
u32 data_seg_size = *(u32 *)UC_CAPS;
 
−
data_seg_size >>= 0x09;
 
−
data_seg_size &= 0x1FF;
 
−
data_seg_size <<= 0x08;
 
−
 
−
// Check stack bounds
 
−
if ((*(u32 *)sp >= data_seg_size) || (*(u32 *)sp < 0x800))
 
−
  exit();
 
−
 
−
// Decrypt and load Keygen stage
 
−
load_keygen(key_buf, key_version, is_blob_dec);
 
−
 
−
// Partially unknown fuc5 instruction
 
−
// Likely forces a change of permissions
 
−
cchmod(c0, c0);
 
−
 
−
// Clear all crypto registers and propagate permissions
 
−
cxor(c0, c0);
 
−
cxor(c1, c1);
 
−
cxor(c2, c2);
 
−
cxor(c3, c3);
 
−
cxor(c4, c4);
 
−
cxor(c5, c5);
 
−
cxor(c6, c6);
 
−
cxor(c7, c7);
 
−
 
−
// Exit Authenticated Mode
 
−
// This is TSEC_MMIO + 0x1000 + (0x10300 / 0x40)
 
−
*(u32 *)TSEC_SCP_CTL_AUTH_MODE = 0;
 
−
 
−
return;
 
−
 
 
−
==== load_keygen ====
 
−
u32 res = 0;
 
−
 
−
u32 boot_base_addr = 0;
 
−
u32 blob0_addr = 0;
 
−
u32 blob0_size = *(u32 *)(key_buf + 0x70);
 
−
 
−
// Load blob0 code again
 
−
read_code(boot_base_addr, blob0_addr, blob0_size);
 
−
 
−
// Generate "CODE_SIG_01" key into c4 crypto register
 
−
gen_usr_key(0, 0);
 
−
 
−
// Encrypt buffer with c4
 
−
u8 sig_key[0x10];
 
−
enc_buf(sig_key, blob0_size);
 
−
 
−
u32 src_addr = boot_base_addr;
 
−
u32 src_size = blob0_size;
 
−
u32 iv_addr = sig_key;
 
−
u32 dst_addr = sig_key;
 
−
u32 mode = 0x02;  // AES-CMAC
 
−
u32 version = 0;
 
−
 
−
// Do AES-CMAC over blob0 code
 
−
do_crypto(src_addr, src_size, iv_addr, dst_addr, mode, version);
 
−
 
−
// Compare the hashes
 
−
if (memcmp(dst_addr, key_buf + 0x10, 0x10))
 
−
{
 
−
  res = 0xDEADBEEF;
 
−
  return res;
 
−
}
 
−
 
−
u32 blob1_size = *(u32 *)(key_buf + 0x74);
 
−
 
−
// Decrypt Keygen blob if needed
 
−
if (!is_blob_dec)
 
−
{
 
−
    // Read Stage2's size from key buffer
 
−
    u32 blob2_size = *(u32 *)(key_buf + 0x78);
 
−
 
−
    // Check stack bounds
 
−
    if (*(u32 *)sp > blob2_size)
 
−
    {
 
−
      u32 boot_base_addr = 0;
 
−
      u32 blob2_virt_addr = blob0_size + blob1_size;
 
−
      u32 blob2_addr = blob2_virt_addr + 0x100;
 
−
     
 
−
      // Read Keygen encrypted blob
 
−
      read_code(boot_base_addr, blob2_addr, blob2_size);
 
−
 
−
      // Generate "CODE_ENC_01" key into c4 crypt register
 
−
      gen_usr_key(0x01, 0x01);
 
−
     
 
−
      u32 src_addr = boot_base_addr;
 
−
      u32 src_size = blob2_size;
 
−
      u32 iv_addr = key_buf + 0x40;
 
−
      u32 dst_addr = boot_base_addr;
 
−
      u32 mode = 0;  // AES-128-ECB
 
−
      u32 version = 0;
 
−
     
 
−
      // Decrypt Keygen blob
 
−
      do_crypto(src_addr, src_size, iv_addr, dst_addr, mode, version);
 
−
     
 
−
      // Upload the next code segment into Falcon's CODE region
 
−
      bool use_secret = true;
 
−
      upload_code(blob2_virt_addr, boot_base_addr, blob2_size, blob2_virt_addr, use_secret);
 
−
 
−
      // Clear out the decrypted blob
 
−
      memset(boot_base_addr, 0, blob2_size);
 
−
    }
 
−
}
 
−
 
−
// fuc5 crypt cxset instruction
 
−
// The next 2 xfer instructions will be overridden
 
−
// and target changes from DMA to crypto
 
−
cxset(0x02);
 
−
 
−
u32 crypt_reg_flag = 0x00060000;
 
−
u32 blob2_hash_addr = key_buf + 0x30;
 
−
 
−
// Transfer data to crypto register c6
 
−
xdst(0, (blob2_hash_addr | crypt_reg_flag));
 
−
 
−
// Wait for all data loads/stores to finish
 
−
xdwait();
 
−
 
−
// Save previous cauth value
 
−
u32 c_old = cauth_old;
 
−
 
−
// fuc5 crypt cauth instruction
 
−
// Set auth_addr to blob2_virt_addr and auth_size to blob2_size
 
−
cauth((blob2_virt_addr >> 0x08) | (blob2_size << 0x10));
 
−
 
−
u32 hovi_key_addr = 0;
 
−
 
−
// Select next stage key
 
−
if (key_version == 0x01) // Use HOVI_EKS_01
 
−
  hovi_key_addr = key_buf + 0x50;
 
−
else if (key_version == 0x02)         // Use HOVI_COMMON_01
 
−
  hovi_key_addr = key_buf + 0x60;
 
−
else if (key_version == 0x03)         // Use debug key (empty)
 
−
  hovi_key_addr = key_buf + 0x00;
 
−
else
 
−
  res = 0xD0D0D0D0
 
−
 
−
// Jump to Keygen
 
−
if (hovi_key_addr)
 
−
  res = exec_keygen(hovi_key_addr, key_version);
 
−
         
 
−
// Clear out key data
 
−
memset(key_buf, 0, 0x7C);
 
−
 
−
// fuc5 crypt cauth instruction
 
−
// Restore previous cauth value
 
−
cauth(c_old);
 
−
 
−
return res;
 
−
 
 
−
===== gen_usr_key =====
 
−
This method takes '''type''' and '''mode''' as arguments and generates a key.
 
−
u8 seed_buf[0x10];
 
−
 
−
// Read a 16 bytes seed based on supplied type
 
−
/*
 
−
    Type 0: "CODE_SIG_01" + null padding
 
−
    Type 1: "CODE_ENC_01" + null padding
 
−
*/
 
−
get_seed(seed_buf, type);
 
−
 
−
// This will write the seed into crypto register c0
 
−
crypt_store(0, seed_buf);
 
−
 
−
// fuc5 csecret instruction
 
−
// Load selected secret into crypto register c1
 
−
csecret(c1, 0x26);
 
−
 
−
// fuc5 ckeyreg instruction
 
−
// Bind c1 register as the key for enc/dec operations
 
−
ckeyreg(c1);
 
−
 
−
// fuc5 cenc instruction
 
−
// Encrypt seed_buf (in c0) using keyreg value as key into c1
 
−
cenc(c1, c0);
 
−
 
−
// fuc5 csigenc instruction
 
−
// Encrypt c1 register with the auth signature stored in c6
 
−
csigenc(c1, c1);
 
−
 
−
// Copy the result into c4 (will be used as key)
 
−
cmov(c4, c1);
 
−
 
−
// Do key expansion (for decryption)
 
−
if (mode != 0)
 
−
    ckexp(c4, c4); // fuc5 ckexp instruction
 
−
 
−
return;
 
−
 
 
−
===== enc_buffer =====
 
−
This method takes '''buf''' (a 16 bytes buffer) and '''size''' as arguments and encrypts the supplied buffer.
 
−
// Set first 3 words to null
 
−
*(u32 *)(buf + 0x00) = 0;
 
−
*(u32 *)(buf + 0x04) = 0;
 
−
*(u32 *)(buf + 0x08) = 0;
 
−
 
−
// Swap halves (b16, b32 and b16 again)
 
−
hswap(size);
 
−
 
−
// Store the size as the last word
 
−
*(u32 *)(buf + 0x0C) = size;
 
−
 
−
// This will write buf into crypto register c3
 
−
crypt_store(0x03, buf);
 
−
 
−
// fuc5 ckeyreg instruction
 
−
// Bind c4 register (from keygen) as the key for enc/dec operations
 
−
ckeyreg(c4);
 
−
 
−
// fuc5 cenc instruction
 
−
// Encrypt buf (in c3) using keyreg value as key into c5
 
−
cenc(c5, c3);
 
−
 
−
// This will read into buf from crypto register c5
 
−
crypt_load(0x05, buf);
 
−
 
−
return;
 
  
−
===== do_crypto =====
+
Used for setting the mask for Falcon's IRQs.
−
This is the method responsible for all crypto operations performed during [[#KeygenLdr|KeygenLdr]]. It takes '''src_addr''', '''src_size''', '''iv_addr''', '''dst_addr''', '''mode''' and '''crypt_ver''' as arguments.
 
−
// Check for invalid source data size
 
−
if (!src_size || (src_size & 0x0F))
 
−
  exit();
 
−
 
−
// Check for invalid source data address
 
−
if (src_addr & 0x0F)
 
−
  exit();
 
−
 
−
// Check for invalid destination data address
 
−
if (dst_addr & 0x0F)
 
−
  exit();
 
−
 
−
// Use IV if available
 
−
if (iv_addr)
 
−
{
 
−
  // This will write the iv_addr into crypto register c5
 
−
  crypt_store(0x05, iv_addr);
 
−
}
 
−
else
 
−
{
 
−
  // Clear c5 register (use null IV)
 
−
  cxor(c5, c5);
 
−
}
 
−
 
−
// Use key in c4
 
−
ckeyreg(c4);
 
−
 
−
// AES-128-CBC decrypt
 
−
if (mode == 0x00)
 
−
{
 
−
  // Create crypto script with 5 instructions
 
−
  cs0begin(0x05);
 
−
 
−
  cxsin(c3);                  // Read 0x10 bytes from crypto stream into c3
 
−
  cdec(c2, c3);                // Decrypt from c3 into c2
 
−
  cxor(c5, c2);                // XOR c2 with c5 and store in c5
 
−
  cxsout(c5);                  // Write 0x10 bytes into crypto stream from c5
 
−
  cmov(c5, c3);                // Move c3 into c5
 
−
}
 
−
else if (mode == 0x01) // AES-128-CBC encrypt
 
−
{
 
−
  // Create crypto script with 4 instructions
 
−
  cs0begin(0x04);
 
−
 
−
  cxsin(c3);                  // Read 0x10 bytes from crypto stream into c3
 
−
  cxor(c3, c5);                // XOR c5 with c3 and store in c3
 
−
  cenc(c5, c3);                // Encrypt from c3 into c5
 
−
  cxsout(c5);                  // Write 0x10 bytes into crypto stream from c5
 
−
}
 
−
else if (mode == 0x02) // AES-CMAC
 
−
{
 
−
  // Create crypto script with 3 instructions
 
−
  cs0begin(0x03);
 
−
 
−
  cxsin(c3);                  // Read 0x10 bytes from crypto stream into c3
 
−
  cxor(c5, c3);                // XOR c5 with c3 and store in c3
 
−
  cenc(c5, c5);                // Encrypt from c5 into c5
 
−
}
 
−
else if (mode == 0x03) // AES-128-ECB decrypt
 
−
{
 
−
  // Create crypto script with 3 instructions
 
−
  cs0begin(0x03);
 
−
 
−
  cxsin(c3);                  // Read 0x10 bytes from crypto stream into c3
 
−
  cdec(c5, c3);                // Decrypt from c3 into c5
 
−
  cxsout(c5);                  // Write 0x10 bytes into crypto stream from c5
 
−
}
 
−
else if (mode == 0x04) // AES-128-ECB encrypt
 
−
{
 
−
  // Create crypto script with 3 instructions
 
−
  cs0begin(0x03);
 
−
 
−
  cxsin(c3);                  // Read 0x10 bytes from crypto stream into c3
 
−
  cenc(c5, c3);                // Encrypt from c3 into c5
 
−
  cxsout(c5);                  // Write 0x10 bytes into crypto stream from c5
 
−
}
 
−
else
 
−
  return;
 
−
 
−
// Main loop
 
−
while (src_size > 0)
 
−
{
 
−
  u32 blk_count = (src_size >> 0x04);
 
−
 
−
  if (blk_count > 0x10)
 
−
    blk_count = 0x10;
 
−
 
 
−
  // Check size align
 
−
  if (blk_count & (blk_count - 0x01))
 
−
    blk_count = 0x01;
 
−
 
−
  u32 blk_size = (blk_count << 0x04);
 
−
 
 
−
  u32 crypt_xfer_src = 0;
 
−
  u32 crypt_xfer_dst = 0;
 
−
 
 
−
  if (block_size == 0x20)
 
−
  {
 
−
      crypt_xfer_src = (0x00030000 | src_addr);
 
−
      crypt_xfer_dst = (0x00030000 | dst_addr);
 
−
     
 
−
      // Execute crypto script 2 times (1 for each block)
 
−
      cs0exec(0x02);
 
−
  }
 
−
  if (block_size == 0x40)
 
−
  {
 
−
      crypt_xfer_src = (0x00040000 | src_addr);
 
−
      crypt_xfer_dst = (0x00040000 | dst_addr);
 
−
     
 
−
      // Execute crypto script 4 times (1 for each block)
 
−
      cs0exec(0x04);
 
−
  }
 
−
  if (block_size == 0x80)
 
−
  {
 
−
      crypt_xfer_src = (0x00050000 | src_addr);
 
−
      crypt_xfer_dst = (0x00050000 | dst_addr);
 
−
     
 
−
      // Execute crypto script 8 times (1 for each block)
 
−
      cs0exec(0x08);
 
−
  }
 
−
  if (block_size == 0x100)
 
−
  {
 
−
      crypt_xfer_src = (0x00060000 | src_addr);
 
−
      crypt_xfer_dst = (0x00060000 | dst_addr);
 
−
     
 
−
      // Execute crypto script 16 times (1 for each block)
 
−
      cs0exec(0x10);
 
−
  }
 
−
  else
 
−
  {
 
−
      crypt_xfer_src = (0x00020000 | src_addr);
 
−
      crypt_xfer_dst = (0x00020000 | dst_addr);
 
−
     
 
−
      // Execute crypto script 1 time (1 for each block)
 
−
      cs0exec(0x01);
 
−
 
−
      // Ensure proper block size
 
−
      block_size = 0x10;
 
−
  }
 
−
 
−
  // fuc5 crypt cxset instruction
 
−
  // The next xfer instruction will be overridden
 
−
  // and target changes from DMA to crypto input/output stream
 
−
  if (crypt_ver == 0x01)
 
−
    cxset(0xA1);        // Flag 0xA0 is (0x80 | 0x20)
 
−
  else
 
−
    cxset(0x21);        // Flag 0x20 is external mem <-> crypto input/output stream
 
−
 
−
  // Transfer data into the crypto input/output stream
 
−
  xdst(crypt_xfer_src, crypt_xfer_src);
 
−
 
 
−
  // AES-CMAC only needs one more xfer instruction
 
−
  if (mode == 0x02)
 
−
  {
 
−
      // fuc5 crypt cxset instruction
 
−
      // The next xfer instruction will be overridden
 
−
      // and target changes from DMA to crypto input/output stream
 
−
      if (crypt_ver == 0x01)
 
−
        cxset(0xA1);    // Flag 0xA0 is (0x80 | 0x20)
 
−
      else
 
−
        cxset(0x21);    // Flag 0x20 is external mem <-> crypto input/output stream
 
−
 
−
      // Wait for all data loads/stores to finish
 
−
      xdwait();
 
−
  }
 
−
  else  // AES enc/dec needs 2 more xfer instructions
 
−
  {
 
−
      // fuc5 crypt cxset instruction
 
−
      // The next 2 xfer instructions will be overridden
 
−
      // and target changes from DMA to crypto input/output stream
 
−
      if (crypt_ver == 0x01)
 
−
        cxset(0xA2);            // Flag 0xA0 is (0x80 | 0x20)
 
−
      else
 
−
        cxset(0x22);            // Flag 0x20 is external mem <-> crypto input/output stream
 
−
 
−
      // Transfer data from the crypto input/output stream
 
−
      xdld(crypt_xfer_dst, crypt_xfer_dst);
 
−
 
−
      // Wait for all data loads/stores to finish
 
−
      xdwait();
 
−
 
−
      // Increase the destination address by block size
 
−
      dst_addr += block_size;
 
−
  }
 
−
 
 
−
  // Increase the source address by block size
 
−
  src_addr += block_size;
 
−
 
−
  // Decrease the source size by block size
 
−
  src_size -= block_size;
 
−
}
 
−
 
−
// AES-CMAC result is in c5
 
−
if (mode == 0x02)
 
−
{
 
−
    // This will read into dst_addr from crypto register c5
 
−
    crypt_load(0x05, dst_addr);
 
−
}
 
−
 
−
return;
 
  
−
== Keygen ==
+
=== TSEC_FALCON_IRQMCLR ===
−
This stage is decrypted by [[#KeygenLdr|KeygenLdr]] using a key generated by encrypting a seed with an hardware secret. It will generate the final TSEC key.
+
{| class="wikitable" border="1"
−
 
+
! Bits
−
== Loader ==
+
! Description
−
This stage starts by authenticating and executing [[#KeygenLdr|KeygenLdr]] which in turn authenticates, decrypts and executes [[#Keygen|Keygen]] (both blobs remain unchanged from previous firmware versions).
+
|-
−
After the TSEC key has been generated, execution returns to this stage which then parses and executes [[#Payload|Payload]].
+
| 0
−
 
+
| TSEC_FALCON_IRQMCLR_GPTMR
−
=== Main ===
+
|-
−
  u8 key_data_buf[0x84];
+
| 1
−
  u8 tmp_key_data_buf[0x84];
+
| TSEC_FALCON_IRQMCLR_WDTMR
−
+
|-
−
// Read the key data from memory
+
| 2
−
u32 key_data_addr = 0x300;
+
| TSEC_FALCON_IRQMCLR_MTHD
−
u32 key_data_size = 0x84;
+
|-
−
read_code(key_data_buf, key_data_addr, key_data_size);
+
| 3
−
+
| TSEC_FALCON_IRQMCLR_CTXSW
−
// Read the KeygenLdr blob from memory
+
|-
−
u32 boot_base_addr = 0;
+
| 4
−
u32 blob1_addr = 0x400;
+
| TSEC_FALCON_IRQMCLR_HALT
−
u32 blob1_size = *(u32 *)(key_data_buf + 0x74);
+
|-
−
read_code(boot_base_addr, blob1_addr, blob1_size);
+
| 5
−
 
+
| TSEC_FALCON_IRQMCLR_EXTERR
−
// Upload the next code segment into Falcon's CODE region
+
|-
−
u32 blob1_virt_addr = 0x300;
+
| 6
−
bool use_secret = true;
+
| TSEC_FALCON_IRQMCLR_SWGEN0
−
upload_code(blob1_virt_addr, boot_base_addr, blob1_size, blob1_virt_addr, use_secret);
+
|-
−
+
| 7
−
// Backup the key data
+
| TSEC_FALCON_IRQMCLR_SWGEN1
−
memcpy(tmp_key_data_buf, key_data_buf, 0x84);
+
|-
−
+
| 8-15
−
// Save previous cauth value
+
| TSEC_FALCON_IRQMCLR_EXT
−
u32 c_old = cauth_old;
+
|-
−
+
| 16
−
// fuc5 crypt cauth instruction
+
| TSEC_FALCON_IRQMCLR_DMA
−
// Set auth_addr to 0x300 and auth_size to blob1_size
+
|}
−
cauth((blob1_size << 0x10) | (0x300 >> 0x08));
 
−
 
−
// fuc5 crypt cxset instruction
 
−
// The next 2 xfer instructions will be overridden
 
−
// and target changes from DMA to crypto
 
−
cxset(0x02);
 
−
 
−
u32 crypt_reg_flag = 0x00060000;
 
−
u32 blob1_hash_addr = tmp_key_data_buf + 0x20;
 
−
 
−
// Transfer data to crypto register c6
 
−
xdst(0, (blob1_hash_addr | crypt_reg_flag));
 
−
 
−
// Wait for all data loads/stores to finish
 
−
xdwait();
 
−
 
−
u32 key_version = 0x01;
 
−
bool is_blob_dec = false;
 
−
 
−
// Jump to KeygenLdr
 
−
u32 keygenldr_res = exec_keygenldr(tmp_key_data_buf, key_version, is_blob_dec);
 
−
 
−
// Set boot finish magic on success
 
−
if (keygenldr_res == 0)
 
−
  keygenldr_res = 0xB0B0B0B0
 
−
     
 
−
// Write result to FALCON_SCRATCH1
 
−
*(u32 *)FALCON_SCRATCH1 = keygenldr_res;
 
−
 
−
if (keygenldr_res != 0xB0B0B0B0)
 
−
  return keygenldr_res;
 
−
 
−
// fuc5 crypt cauth instruction
 
−
// Restore previous cauth value
 
−
cauth(c_old);
 
−
 
−
u8 flcn_hdr_buf[0x18];
 
−
u8 flcn_os_hdr_buf[0x10];
 
−
 
−
blob1_size = *(u32 *)(key_data_buf + 0x74);
 
−
u32 blob2_size = *(u32 *)(key_data_buf + 0x78);
 
−
u32 blob0_size = *(u32 *)(key_data_buf + 0x70);
 
−
 
−
// Read the Payload blob's Falcon header from memory
 
−
u32 blob4_flcn_hdr_addr = (((blob0_size + blob1_size) + 0x100) + blob2_size);
 
−
read_code(flcn_hdr_buf, blob4_flcn_hdr_addr, 0x18);
 
−
 
−
blob1_size = *(u32 *)(key_data_buf + 0x74);
 
−
blob2_size = *(u32 *)(key_data_buf + 0x78);
 
−
blob0_size = *(u32 *)(key_data_buf + 0x70);
 
−
u32 flcn_hdr_size = *(u32 *)(flcn_hdr_buf + 0x0C);
 
−
 
−
// Read the Payload blob's Falcon OS header from memory
 
−
u32 blob4_flcn_os_hdr_addr = ((((blob0_size + blob1_size) + 0x100) + blob2_size) + flcn_hdr_size);
 
−
read_code(flcn_os_hdr_buf, blob4_flcn_os_hdr_addr, 0x10);
 
−
 
−
blob1_size = *(u32 *)(key_data_buf + 0x74);
 
−
blob2_size = *(u32 *)(key_data_buf + 0x78);
 
−
blob0_size = *(u32 *)(key_data_buf + 0x70);
 
−
u32 flcn_code_hdr_size = *(u32 *)(flcn_hdr_buf + 0x10);
 
−
u32 flcn_os_size = *(u32 *)(flcn_os_hdr_buf + 0x04);
 
−
 
−
// Read the Payload blob's Falcon OS image from memory
 
−
u32 blob4_flcn_os_addr = ((((blob0_size + blob1_size) + 0x100) + blob2_size) + flcn_code_hdr_size);
 
−
read_code(boot_base_addr, blob4_flcn_os_hdr_addr, flcn_os_size);
 
−
 
−
// Upload the Payload's Falcon OS image boot stub code segment into Falcon's CODE region
 
−
u32 blob4_flcn_os_boot_virt_addr = 0;
 
−
u32 blob4_flcn_os_boot_size = 0x100;
 
−
use_secret = false;
 
−
upload_code(blob4_flcn_os_boot_virt_addr, boot_base_addr, blob4_flcn_os_boot_size, blob4_flcn_os_boot_virt_addr, use_secret);
 
−
 
−
flcn_os_size = *(u32 *)(flcn_os_hdr_buf + 0x04);
 
−
 
−
// Upload the Payload blob's Falcon OS encrypted image code segment into Falcon's CODE region
 
−
u32 blob4_flcn_os_img_virt_addr = 0x100;
 
−
u32 blob4_flcn_os_img_size = (flcn_os_size - 0x100);
 
−
use_secret = true;
 
−
upload_code(blob4_flcn_os_img_virt_addr, boot_base_addr + 0x100, blob4_flcn_os_img_size, blob4_flcn_os_img_virt_addr, use_secret);
 
−
 
−
// Wait for all code loads to finish
 
−
xcwait();
 
−
 
−
blob1_size = *(u32 *)(key_data_buf + 0x74);
 
−
blob2_size = *(u32 *)(key_data_buf + 0x78);
 
−
blob0_size = *(u32 *)(key_data_buf + 0x70);
 
−
flcn_code_hdr_size = *(u32 *)(flcn_hdr_buf + 0x10);
 
−
u32 flcn_os_code_size = *(u32 *)(flcn_os_hdr_buf + 0x08);
 
−
 
−
// Read the Payload blob's falcon OS image's hash from memory
 
−
u32 blob4_flcn_os_img_hash_addr = (((((blob0_size + blob1_size) + 0x100) + blob2_size) + flcn_code_hdr_size) + flcn_os_code_size);
 
−
read_code(0, blob4_flcn_os_img_hash_addr, 0x10);
 
−
 
−
// Read data segment size from IO space
 
−
u32 data_seg_size = *(u32 *)UC_CAPS;
 
−
data_seg_size >>= 0x03;
 
−
data_seg_size &= 0x3FC0;
 
−
 
−
u32 data_addr = 0x10;
 
−
 
−
// Clear all data except the first 0x10 bytes (Payload blob's Falcon OS image's hash)
 
−
for (int data_word_count = 0x04; data_word_count < data_seg_size; data_word_count++)
 
−
{
 
−
  *(u32 *)(data_addr) = 0;
 
−
  data_addr += 0x04;
 
−
}
 
−
 
−
// Clear all crypto registers
 
−
cxor(c0, c0);
 
−
cxor(c1, c1);
 
−
cxor(c2, c2);
 
−
cxor(c3, c3);
 
−
cxor(c4, c4);
 
−
cxor(c5, c5);
 
−
cxor(c6, c6);
 
−
cxor(c7, c7);
 
−
 
−
// Partially unknown fuc5 instruction
 
−
// Likely forces a change of permissions
 
−
cchmod(c0, c0);
 
−
 
−
// Jump to Payload
 
−
exec_payload();
 
−
 
−
return 0xB0B0B0B0;
 
−
 
 
−
== Payload ==
 
−
This stage prepares the stack then authenticates, decrypts and executes the Payload blob's Falcon OS image.
 
  
−
=== Main ===
+
Used for clearing the mask for Falcon's IRQs.
−
// Read data segment size from IO space
 
−
u32 data_seg_size = *(u32 *)UC_CAPS;
 
−
data_seg_size >>= 0x01;
 
−
data_seg_size &= 0xFF00;
 
−
 
−
// Set the stack pointer
 
−
*(u32 *)sp = data_seg_size;
 
−
 
−
// Jump to the Payload blob's Falcon OS image boot stub
 
−
exec_flcn_os_boot();
 
−
 
−
// Halt execution
 
−
exit();
 
−
 
−
return;
 
  
−
==== exec_flcn_os_boot ====
+
=== TSEC_FALCON_IRQMASK ===
−
  // Read the transfer base address from IO space
+
{| class="wikitable" border="1"
−
  u32 xfer_ext_base_addr = *(u32 *)XFER_EXT_BASE;
+
! Bits
−
+
! Description
−
// Copy transfer base address to data memory
+
|-
−
u32 scratch_data_addr = 0x300;
+
| 0
−
*(u32 *)scratch_data_addr = xfer_ext_base_addr;
+
| TSEC_FALCON_IRQMASK_GPTMR
−
+
|-
−
// Set the transfer base address
+
| 1
−
xcbase(xfer_ext_base_addr);
+
| TSEC_FALCON_IRQMASK_WDTMR
−
+
|-
−
// fuc5 crypt cxset instruction
+
| 2
−
// The next xfer instruction will be overridden
+
| TSEC_FALCON_IRQMASK_MTHD
−
// and target changes from DMA to crypto
+
|-
−
cxset(0x01);
+
| 3
−
+
| TSEC_FALCON_IRQMASK_CTXSW
−
u32 crypt_reg_flag = 0x00060000;
+
|-
−
u32 blob4_flcn_os_img_hash_addr = 0;
+
| 4
−
+
| TSEC_FALCON_IRQMASK_HALT
−
// Transfer data to crypto register c6
+
|-
−
xdst(0, (blob4_flcn_os_img_hash_addr | crypt_reg_flag));
+
| 5
−
+
| TSEC_FALCON_IRQMASK_EXTERR
−
// fuc5 crypt cxset instruction
+
|-
−
// The next xfer instruction will be overridden
+
| 6
−
// and target changes from DMA to crypto
+
| TSEC_FALCON_IRQMASK_SWGEN0
−
cxset(0x01);
+
|-
−
+
| 7
−
// Wait for all data loads/stores to finish
+
| TSEC_FALCON_IRQMASK_SWGEN1
−
xdwait();
+
|-
−
+
| 8-15
−
cmov(c7, c6);
+
| TSEC_FALCON_IRQMASK_EXT
−
cxor(c7, c7);
+
|-
−
+
| 16
−
// fuc5 crypt cauth instruction
+
| TSEC_FALCON_IRQMASK_DMA
−
// Set auth_addr to 0x100, auth_size to 0x1300,
+
|}
−
// bit 16 (is_secret) and bit 17 (is_encrypted)
+
 
−
cauth((0x02 << 0x10) | (0x01 << 0x10) | (0x1300 << 0x10) | (0x100 >> 0x08));
+
Used for getting the value of the mask for Falcon's IRQs.
−
 
−
// Clear interrupt flags
 
−
*(u8 *)flags_ie0 = 0;
 
−
*(u8 *)flags_ie1 = 0;
 
−
 
−
// Jump to the Payload blob's Falcon OS image
 
−
exec_flcn_os_img();
 
−
 
−
return 0x0F0F0F0F;
 
  
−
== Key data ==
+
=== TSEC_FALCON_IRQDEST ===
−
Small buffer stored after the [[#Boot|Boot]] blob and used across all stages.
+
{| class="wikitable" border="1"
−
 
+
!  Bits
−
{| class="wikitable" border="1"
+
!  Description
−
!  Offset
+
|-
−
!  Size
+
| 0
−
!  Description
+
| TSEC_FALCON_IRQDEST_HOST_GPTMR
 +
|-
 +
| 1
 +
| TSEC_FALCON_IRQDEST_HOST_WDTMR
 +
|-
 +
| 2
 +
| TSEC_FALCON_IRQDEST_HOST_MTHD
 +
|-
 +
| 3
 +
| TSEC_FALCON_IRQDEST_HOST_CTXSW
 +
|-
 +
| 4
 +
| TSEC_FALCON_IRQDEST_HOST_HALT
 +
|-
 +
| 5
 +
| TSEC_FALCON_IRQDEST_HOST_EXTERR
 +
|-
 +
| 6
 +
| TSEC_FALCON_IRQDEST_HOST_SWGEN0
 +
|-
 +
| 7
 +
| TSEC_FALCON_IRQDEST_HOST_SWGEN1
 +
|-
 +
| 8-15
 +
| TSEC_FALCON_IRQDEST_HOST_EXT
 +
|-
 +
| 16
 +
| TSEC_FALCON_IRQDEST_TARGET_GPTMR
 +
|-
 +
| 17
 +
| TSEC_FALCON_IRQDEST_TARGET_WDTMR
 +
|-
 +
| 18
 +
| TSEC_FALCON_IRQDEST_TARGET_MTHD
 +
|-
 +
| 19
 +
| TSEC_FALCON_IRQDEST_TARGET_CTXSW
 +
|-
 +
| 20
 +
| TSEC_FALCON_IRQDEST_TARGET_HALT
 +
|-
 +
| 21
 +
| TSEC_FALCON_IRQDEST_TARGET_EXTERR
 +
|-
 +
| 22
 +
| TSEC_FALCON_IRQDEST_TARGET_SWGEN0
 +
|-
 +
| 23
 +
| TSEC_FALCON_IRQDEST_TARGET_SWGEN1
 +
|-
 +
| 24-31
 +
| TSEC_FALCON_IRQDEST_TARGET_EXT
 +
|}
 +
 
 +
Used for routing Falcon's IRQs.
 +
 
 +
=== TSEC_FALCON_GPTMRINT ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| TSEC_FALCON_GPTMRINT_VAL
 +
|}
 +
 
 +
=== TSEC_FALCON_GPTMRVAL ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| TSEC_FALCON_GPTMRVAL_VAL
 +
|}
 +
 
 +
=== TSEC_FALCON_GPTMRCTL ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| TSEC_FALCON_GPTMRCTL_GPTMREN
 +
|}
 +
 
 +
=== TSEC_FALCON_PTIMER0 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| TSEC_FALCON_PTIMER0_VAL
 +
|}
 +
 
 +
=== TSEC_FALCON_PTIMER1 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| TSEC_FALCON_PTIMER1_VAL
 +
|}
 +
 
 +
=== TSEC_FALCON_WDTMRVAL ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| TSEC_FALCON_WDTMRVAL_VAL
 +
|}
 +
 
 +
=== TSEC_FALCON_WDTMRCTL ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| TSEC_FALCON_WDTMRCTL_WDTMREN
 +
|}
 +
 
 +
=== TSEC_FALCON_IRQDEST2 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| TSEC_FALCON_IRQDEST2_HOST_DMA
 +
|-
 +
| 16
 +
| TSEC_FALCON_IRQDEST2_TARGET_DMA
 +
|}
 +
 
 +
Used for routing Falcon's IRQs.
 +
 
 +
=== TSEC_FALCON_MAILBOX0 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| TSEC_FALCON_MAILBOX0_DATA
 +
|}
 +
 
 +
Scratch register for reading/writing data to Falcon.
 +
 
 +
=== TSEC_FALCON_MAILBOX1 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| TSEC_FALCON_MAILBOX1_DATA
 +
|}
 +
 
 +
Scratch register for reading/writing data to Falcon.
 +
 
 +
=== TSEC_FALCON_ITFEN ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| TSEC_FALCON_ITFEN_CTXEN
 +
|-
 +
| 1
 +
| TSEC_FALCON_ITFEN_MTHDEN
 +
|}
 +
 
 +
Used for enabling/disabling Falcon interfaces.
 +
 
 +
=== TSEC_FALCON_IDLESTATE ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| TSEC_FALCON_IDLESTATE_FALCON_BUSY
 +
|-
 +
| 1-15
 +
| TSEC_FALCON_IDLESTATE_EXT_BUSY
 +
|}
 +
 
 +
Used for detecting if Falcon is busy or not.
 +
 
 +
=== TSEC_FALCON_CURCTX ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-27
 +
| TSEC_FALCON_CURCTX_CTXPTR
 +
|-
 +
| 28-29
 +
| TSEC_FALCON_CURCTX_CTXTGT
 +
|-
 +
| 30
 +
| TSEC_FALCON_CURCTX_CTXVLD
 +
|}
 +
 
 +
=== TSEC_FALCON_NXTCTX ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-27
 +
| TSEC_FALCON_NXTCTX_CTXPTR
 +
|-
 +
| 28-29
 +
| TSEC_FALCON_NXTCTX_CTXTGT
 +
|-
 +
| 30
 +
| TSEC_FALCON_NXTCTX_CTXVLD
 +
|}
 +
 
 +
=== TSEC_FALCON_CTXACK ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| TSEC_FALCON_CTXACK_SAVE_ACK
 +
|-
 +
| 1
 +
| TSEC_FALCON_CTXACK_REST_ACK
 +
|}
 +
 
 +
=== TSEC_FALCON_FHSTATE ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| TSEC_FALCON_FHSTATE_FALCON_HALTED
 +
|-
 +
| 1-15
 +
| TSEC_FALCON_FHSTATE_EXT_HALTED
 +
|-
 +
| 16
 +
| TSEC_FALCON_FHSTATE_ENGINE_FAULTED
 +
|-
 +
| 17
 +
| TSEC_FALCON_FHSTATE_STALL_REQ
 +
|}
 +
 
 +
=== TSEC_FALCON_PRIVSTATE ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| TSEC_FALCON_PRIVSTATE_PRIV
 +
|}
 +
 
 +
=== TSEC_FALCON_MTHDDATA ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| TSEC_FALCON_MTHDDATA_DATA
 +
|}
 +
 
 +
=== TSEC_FALCON_MTHDID ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-11
 +
| TSEC_FALCON_MTHDID_ID
 +
|-
 +
| 12-14
 +
| TSEC_FALCON_MTHDID_SUBCH
 +
|-
 +
| 15
 +
| TSEC_FALCON_MTHDID_PRIV
 +
|-
 +
| 16
 +
| TSEC_FALCON_MTHDID_WPEND
 +
|}
 +
 
 +
=== TSEC_FALCON_MTHDWDAT ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| TSEC_FALCON_MTHDWDAT_DATA
 +
|}
 +
 
 +
=== TSEC_FALCON_MTHDCOUNT ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-15
 +
| TSEC_FALCON_MTHDCOUNT_COUNT
 +
|}
 +
 
 +
=== TSEC_FALCON_MTHDPOP ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| TSEC_FALCON_MTHDPOP_POP
 +
|}
 +
 
 +
=== TSEC_FALCON_MTHDRAMSZ ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-15
 +
| TSEC_FALCON_MTHDRAMSZ_RAMSZ
 +
|}
 +
 
 +
=== TSEC_FALCON_SFTRESET ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| TSEC_FALCON_SFTRESET_EXT
 +
|}
 +
 
 +
=== TSEC_FALCON_OS ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| TSEC_FALCON_OS_VERSION
 +
|}
 +
 
 +
=== TSEC_FALCON_RM ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| TSEC_FALCON_RM_CONFIG
 +
|}
 +
 
 +
=== TSEC_FALCON_SOFT_PM ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-5
 +
| TSEC_FALCON_SOFT_PM_PROBE
 +
|-
 +
| 16
 +
| TSEC_FALCON_SOFT_PM_TRIGGER_END
 +
|-
 +
| 17
 +
| TSEC_FALCON_SOFT_PM_TRIGGER_START
 +
|}
 +
 
 +
=== TSEC_FALCON_SOFT_MODE ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-5
 +
| TSEC_FALCON_SOFT_MODE_PROBE
 +
|}
 +
 
 +
=== TSEC_FALCON_DEBUG1 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-15
 +
| TSEC_FALCON_DEBUG1_MTHD_DRAIN_TIME
 +
|-
 +
| 16
 +
| TSEC_FALCON_DEBUG1_CTXSW_MODE
 +
|}
 +
 
 +
=== TSEC_FALCON_DEBUGINFO ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| TSEC_FALCON_DEBUGINFO_DATA
 +
|}
 +
 
 +
Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.
 +
 
 +
[6.0.0+] [[NV_services|nvservices]] sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.
 +
 
 +
=== TSEC_FALCON_IBRKPT1 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-23
 +
| TSEC_FALCON_IBRKPT1_PC
 +
|-
 +
| 29
 +
| TSEC_FALCON_IBRKPT1_SUPPRESS
 +
|-
 +
| 30
 +
| TSEC_FALCON_IBRKPT1_SKIP
 +
|-
 +
| 31
 +
| TSEC_FALCON_IBRKPT1_EN
 +
|}
 +
 
 +
=== TSEC_FALCON_IBRKPT2 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-23
 +
| TSEC_FALCON_IBRKPT2_PC
 +
|-
 +
| 29
 +
| TSEC_FALCON_IBRKPT2_SUPPRESS
 +
|-
 +
| 30
 +
| TSEC_FALCON_IBRKPT2_SKIP
 +
|-
 +
| 31
 +
| TSEC_FALCON_IBRKPT2_EN
 +
|}
 +
 
 +
=== TSEC_FALCON_CGCTL ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| TSEC_FALCON_CGCTL_CG_OVERRIDE
 +
|}
 +
 
 +
=== TSEC_FALCON_ENGCTL ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| TSEC_FALCON_ENGCTL_INV_CONTEXT
 +
|-
 +
| 1
 +
| TSEC_FALCON_ENGCTL_SET_STALLREQ
 +
|-
 +
| 2
 +
| TSEC_FALCON_ENGCTL_CLR_STALLREQ
 +
|-
 +
| 3
 +
| TSEC_FALCON_ENGCTL_SWITCH_CONTEXT
 +
|-
 +
| 8
 +
| TSEC_FALCON_ENGCTL_STALLREQ
 +
|-
 +
| 9
 +
| TSEC_FALCON_ENGCTL_STALLACK
 +
|}
 +
 
 +
=== TSEC_FALCON_PMM ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-4
 +
| TSEC_FALCON_PMM_FALCON_STALL_SEL
 +
0x00: ANY
 +
0x01: CODE
 +
0x02: DMAQ
 +
0x03: DMFENCE
 +
0x04: DMWAIT
 +
0x05: IMWAIT
 +
0x06: IPND
 +
0x07: LDSTQ
 +
0x08: SB
 +
0x09: ANY_SC
 +
0x0A: CODE_SC
 +
0x0B: DMAQ_SC
 +
0x0C: DMFENCE_SC
 +
0x0D: DMWAIT_SC
 +
0x0E: IMWAIT_SC
 +
0x0F: IPND_SC
 +
0x10: LDSTQ_SC
 +
0x11: SB_SC
 +
|-
 +
| 5-7
 +
| TSEC_FALCON_PMM_FALCON_IDLE_SEL
 +
0x00: WAITING
 +
0x01: ENG_IDLE
 +
0x02: MTHD_FULL
 +
0x03: WAITING_SC
 +
0x04: ENG_IDLE_SC
 +
0x05: MTHD_FULL_SC
 +
|-
 +
| 8-11
 +
| TSEC_FALCON_PMM_FALCON_SOFTPM0_SEL
 +
0x00: 0
 +
0x01: 1
 +
0x02: 2
 +
0x03: 3
 +
0x04: 4
 +
0x05: 5
 +
0x06: 0_SC
 +
0x07: 1_SC
 +
0x08: 2_SC
 +
0x09: 3_SC
 +
0x0A: 4_SC
 +
0x0B: 5_SC
 +
|-
 +
| 12-15
 +
| TSEC_FALCON_PMM_FALCON_SOFTPM1_SEL
 +
0x00: 0
 +
|-
 +
| 17-19
 +
| TSEC_FALCON_PMM_TFBIF_DSTAT_SEL
 +
0x00: 1KTRANSFER
 +
0x01: RREQ
 +
0x02: WREQ
 +
0x03: TWREQ
 +
0x04: 1KTRANSFER_SC
 +
0x05: RREQ_SC
 +
0x06: WREQ_SC
 +
0x07: TWREQ_SC
 +
|-
 +
| 20-23
 +
| TSEC_FALCON_PMM_TFBIF_STALL0_SEL
 +
0x00: RDATQ_FULL
 +
0x01: RACKQ_FULL
 +
0x02: WREQQ_FULL
 +
0x03: WDATQ_FULL
 +
0x04: WACKQ_FULL
 +
0x05: MREQQ_FULL
 +
0x06: RREQ_PEND
 +
0x07: WREQ_PEND
 +
0x08: RDATQ_FULL_SC
 +
0x09: RACKQ_FULL_SC
 +
0x0A: WREQQ_FULL_SC
 +
0x0B: WDATQ_FULL_SC
 +
0x0C: WACKQ_FULL_SC
 +
0x0D: MREQQ_FULL_SC
 +
0x0E: RREQ_PEND_SC
 +
0x0F: WREQ_PEND_SC
 +
|-
 +
| 24-27
 +
| TSEC_FALCON_PMM_TFBIF_STALL1_SEL
 +
0x00: RDATQ_FULL
 +
|-
 +
| 28-31
 +
| TSEC_FALCON_PMM_TFBIF_STALL2_SEL
 +
0x00: RDATQ_FULL
 +
|}
 +
 
 +
=== TSEC_FALCON_ADDR ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-5
 +
| TSEC_FALCON_ADDR_LSB
 +
|-
 +
| 6-11
 +
| TSEC_FALCON_ADDR_MSB
 +
|}
 +
 
 +
=== TSEC_FALCON_IBRKPT3 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-23
 +
| TSEC_FALCON_IBRKPT3_PC
 +
|-
 +
| 29
 +
| TSEC_FALCON_IBRKPT3_SUPPRESS
 +
|-
 +
| 30
 +
| TSEC_FALCON_IBRKPT3_SKIP
 +
|-
 +
| 31
 +
| TSEC_FALCON_IBRKPT3_EN
 +
|}
 +
 
 +
=== TSEC_FALCON_IBRKPT4 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-23
 +
| TSEC_FALCON_IBRKPT4_PC
 +
|-
 +
| 29
 +
| TSEC_FALCON_IBRKPT4_SUPPRESS
 +
|-
 +
| 30
 +
| TSEC_FALCON_IBRKPT4_SKIP
 +
|-
 +
| 31
 +
| TSEC_FALCON_IBRKPT4_EN
 +
|}
 +
 
 +
=== TSEC_FALCON_IBRKPT5 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-23
 +
| TSEC_FALCON_IBRKPT5_PC
 +
|-
 +
| 29
 +
| TSEC_FALCON_IBRKPT5_SUPPRESS
 +
|-
 +
| 30
 +
| TSEC_FALCON_IBRKPT5_SKIP
 +
|-
 +
| 31
 +
| TSEC_FALCON_IBRKPT5_EN
 +
|}
 +
 
 +
=== TSEC_FALCON_EXCI ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-19
 +
| TSEC_FALCON_EXCI_EXPC
 +
|-
 +
| 20-23
 +
| TSEC_FALCON_EXCI_EXCAUSE
 +
0x00: TRAP0
 +
0x01: TRAP1
 +
0x02: TRAP2
 +
0x03: TRAP3
 +
0x08: ILL_INS (invalid opcode)
 +
0x09: INV_INS (authentication entry)
 +
0x0A: MISS_INS (page miss)
 +
0x0B: DHIT_INS (page multiple hit)
 +
0x0F: BRKPT_INS (breakpoint hit)
 +
|}
 +
 
 +
Contains information about raised exceptions.
 +
 
 +
=== TSEC_FALCON_SVEC_SPR ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 18
 +
| TSEC_FALCON_SVEC_SPR_SIGPASS
 +
|}
 +
 
 +
=== TSEC_FALCON_RSTAT0 ===
 +
Mirror of the [[#TSEC_FALCON_ICD_RDATA|ICD status register 0]].
 +
 
 +
=== TSEC_FALCON_RSTAT3 ===
 +
Mirror of the [[#TSEC_FALCON_ICD_RDATA|ICD status register 3]].
 +
 
 +
=== TSEC_FALCON_SIRQMASK ===
 +
Unofficial name.
 +
 
 +
Same as [[#TSEC_FALCON_IRQMASK|TSEC_FALCON_IRQMASK]], but for LS mode.
 +
 
 +
=== TSEC_FALCON_CPUCTL ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| TSEC_FALCON_CPUCTL_IINVAL
 +
|-
 +
| 1
 +
| TSEC_FALCON_CPUCTL_STARTCPU
 +
|-
 +
| 2
 +
| TSEC_FALCON_CPUCTL_SRESET
 +
|-
 +
| 3
 +
| TSEC_FALCON_CPUCTL_HRESET
 +
|-
 +
| 4
 +
| TSEC_FALCON_CPUCTL_HALTED
 +
|-
 +
| 5
 +
| TSEC_FALCON_CPUCTL_STOPPED
 +
|-
 +
| 6
 +
| TSEC_FALCON_CPUCTL_ALIAS_EN
 +
|}
 +
 
 +
Used for signaling the Falcon CPU.
 +
 
 +
=== TSEC_FALCON_BOOTVEC ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| TSEC_FALCON_BOOTVEC_VEC
 +
|}
 +
 
 +
Takes the Falcon's boot vector address.
 +
 
 +
=== TSEC_FALCON_HWCFG ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-8
 +
| TSEC_FALCON_HWCFG_IMEM_SIZE
 +
|-
 +
| 9-17
 +
| TSEC_FALCON_HWCFG_DMEM_SIZE
 +
|-
 +
| 18-26
 +
| TSEC_FALCON_HWCFG_METHODFIFO_DEPTH
 +
|-
 +
| 27-31
 +
| TSEC_FALCON_HWCFG_DMAQUEUE_DEPTH
 +
|}
 +
 
 +
=== TSEC_FALCON_DMACTL ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| TSEC_FALCON_DMACTL_REQUIRE_CTX
 +
|-
 +
| 1
 +
| TSEC_FALCON_DMACTL_DMEM_SCRUBBING
 +
|-
 +
| 2
 +
| TSEC_FALCON_DMACTL_IMEM_SCRUBBING
 +
|-
 +
| 3-6
 +
| TSEC_FALCON_DMACTL_DMAQ_NUM
 +
|-
 +
| 7
 +
| TSEC_FALCON_DMACTL_SECURE_STAT
 +
|}
 +
 
 +
Used for configuring the Falcon's DMA engine.
 +
 
 +
=== TSEC_FALCON_DMATRFBASE ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| TSEC_FALCON_DMATRFBASE_BASE
 +
|}
 +
 
 +
Base address of the external memory buffer, shifted right by 8.
 +
 
 +
The current transfer address is calculated by adding [[#TSEC_FALCON_DMATRFFBOFFS|TSEC_FALCON_DMATRFFBOFFS]] to the base.
 +
 
 +
=== TSEC_FALCON_DMATRFMOFFS ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-15
 +
| TSEC_FALCON_DMATRFMOFFS_OFFS
 +
|}
 +
 
 +
For transfers to DMEM: the destination address.
 +
For transfers to IMEM: the destination virtual IMEM page.
 +
 
 +
=== TSEC_FALCON_DMATRFCMD ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| TSEC_FALCON_DMATRFCMD_FULL
 +
|-
 +
| 1
 +
| TSEC_FALCON_DMATRFCMD_IDLE
 +
|-
 +
| 2-3
 +
| TSEC_FALCON_DMATRFCMD_SEC
 +
|-
 +
| 4
 +
| TSEC_FALCON_DMATRFCMD_IMEM
 +
|-
 +
| 5
 +
| TSEC_FALCON_DMATRFCMD_WRITE
 +
|-
 +
| 8-10
 +
| TSEC_FALCON_DMATRFCMD_SIZE
 +
|-
 +
| 12-14
 +
| TSEC_FALCON_DMATRFCMD_CTXDMA
 +
|}
 +
 
 +
Used for configuring DMA transfers.
 +
 
 +
=== TSEC_FALCON_DMATRFFBOFFS ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| TSEC_FALCON_DMATRFFBOFFS_OFFS
 +
|}
 +
 
 +
For transfers to IMEM: the destination physical IMEM page.
 +
 
 +
=== TSEC_FALCON_DMAPOLL_FB ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| TSEC_FALCON_DMAPOLL_FB_FENCE_ACTIVE
 +
|-
 +
| 1
 +
| TSEC_FALCON_DMAPOLL_FB_DMA_ACTIVE
 +
|-
 +
| 4
 +
| TSEC_FALCON_DMAPOLL_FB_CFG_R_FENCE
 +
|-
 +
| 5
 +
| TSEC_FALCON_DMAPOLL_FB_CFG_W_FENCE
 +
|-
 +
| 16-23
 +
| TSEC_FALCON_DMAPOLL_FB_WCOUNT
 +
|-
 +
| 24-31
 +
| TSEC_FALCON_DMAPOLL_FB_RCOUNT
 +
|}
 +
 
 +
Contains the status of a DMA transfer between the Falcon and external memory.
 +
 
 +
=== TSEC_FALCON_DMAPOLL_CP ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| TSEC_FALCON_DMAPOLL_CP_FENCE_ACTIVE
 +
|-
 +
| 1
 +
| TSEC_FALCON_DMAPOLL_CP_DMA_ACTIVE
 +
|-
 +
| 4
 +
| TSEC_FALCON_DMAPOLL_CP_CFG_R_FENCE
 +
|-
 +
| 5
 +
| TSEC_FALCON_DMAPOLL_CP_CFG_W_FENCE
 +
|-
 +
| 16-23
 +
| TSEC_FALCON_DMAPOLL_CP_WCOUNT
 +
|-
 +
| 24-31
 +
| TSEC_FALCON_DMAPOLL_CP_RCOUNT
 +
|}
 +
 
 +
Contains the status of a DMA transfer between the Falcon and the SCP.
 +
 
 +
=== TSEC_FALCON_HWCFG1 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-3
 +
| TSEC_FALCON_HWCFG1_CORE_REV
 +
|-
 +
| 4-5
 +
| TSEC_FALCON_HWCFG1_SECURITY_MODEL
 +
|-
 +
| 6-7
 +
| TSEC_FALCON_HWCFG1_CORE_REV_SUBVERSION
 +
|-
 +
| 8-11
 +
| TSEC_FALCON_HWCFG1_IMEM_PORTS
 +
|-
 +
| 12-15
 +
| TSEC_FALCON_HWCFG1_DMEM_PORTS
 +
|-
 +
| 16-20
 +
| TSEC_FALCON_HWCFG1_TAG_WIDTH
 +
|-
 +
| 27
 +
| TSEC_FALCON_HWCFG1_DBG_PRIV_BUS
 +
|-
 +
| 28
 +
| TSEC_FALCON_HWCFG1_CSB_SIZE_16M
 +
|-
 +
| 29
 +
| TSEC_FALCON_HWCFG1_PRIV_DIRECT
 +
|-
 +
| 30
 +
| TSEC_FALCON_HWCFG1_DMEM_APERTURES
 +
|-
 +
| 31
 +
| TSEC_FALCON_HWCFG1_IMEM_AUTOFILL
 +
|}
 +
 
 +
=== TSEC_FALCON_CPUCTL_ALIAS ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 1
 +
| TSEC_FALCON_CPUCTL_ALIAS_STARTCPU
 +
|}
 +
 
 +
=== TSEC_FALCON_STACKCFG ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-15
 +
| TSEC_FALCON_STACKCFG_BOTTOM
 +
|-
 +
| 31
 +
| TSEC_FALCON_STACKCFG_SPEXC
 +
|}
 +
 
 +
=== TSEC_FALCON_IMCTL ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-23
 +
| TSEC_FALCON_IMCTL_ADDR_BLK
 +
|-
 +
| 24-26
 +
| TSEC_FALCON_IMCTL_CMD
 +
0x00: NOP
 +
0x01: IMINV (ITLB)
 +
0x02: IMBLK (PTLB)
 +
0x03: IMTAG (VTLB)
 +
0x04: IMTAG_SETVLD
 +
|}
 +
 
 +
Controls the Falcon TLB.
 +
 
 +
=== TSEC_FALCON_IMSTAT ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| TSEC_FALCON_IMSTAT_VAL
 +
|}
 +
 
 +
Returns the result of the last command from [[#TSEC_FALCON_IMCTL|TSEC_FALCON_IMCTL]].
 +
 
 +
=== TSEC_FALCON_TRACEIDX ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-7
 +
| TSEC_FALCON_TRACEIDX_IDX
 +
|-
 +
| 16-23
 +
| TSEC_FALCON_TRACEIDX_MAXIDX
 +
|-
 +
| 24-31
 +
| TSEC_FALCON_TRACEIDX_CNT
 +
|}
 +
 
 +
Controls the index for tracing with [[#TSEC_FALCON_TRACEPC|TSEC_FALCON_TRACEPC]].
 +
 
 +
=== TSEC_FALCON_TRACEPC ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-23
 +
| TSEC_FALCON_TRACEPC_PC
 +
|}
 +
 
 +
Returns the PC of the last call or branch executed.
 +
 
 +
=== TSEC_FALCON_IMFILLRNG0 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-15
 +
| TSEC_FALCON_IMFILLRNG0_TAG_LO
 +
|-
 +
| 16-31
 +
| TSEC_FALCON_IMFILLRNG0_TAG_HI
 +
|}
 +
 
 +
=== TSEC_FALCON_IMFILLRNG1 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-15
 +
| TSEC_FALCON_IMFILLRNG1_TAG_LO
 +
|-
 +
| 16-31
 +
| TSEC_FALCON_IMFILLRNG1_TAG_HI
 +
|}
 +
 
 +
=== TSEC_FALCON_IMFILLCTL ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-7
 +
| TSEC_FALCON_IMFILLCTL_NBLOCKS
 +
|}
 +
 
 +
=== TSEC_FALCON_IMCTL_DEBUG ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-23
 +
| TSEC_FALCON_IMCTL_DEBUG_ADDR_BLK
 +
|-
 +
| 24-26
 +
| TSEC_FALCON_IMCTL_DEBUG_CMD
 +
0x00: NOP
 +
0x02: IMBLK
 +
0x03: IMTAG
 +
|}
 +
 
 +
=== TSEC_FALCON_CMEMBASE ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 18-31
 +
| TSEC_FALCON_CMEMBASE_VAL
 +
|}
 +
 
 +
=== TSEC_FALCON_DMEMAPERT ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-7
 +
| TSEC_FALCON_DMEMAPERT_TIME_OUT
 +
|-
 +
| 8-11
 +
| TSEC_FALCON_DMEMAPERT_TIME_UNIT
 +
|-
 +
| 16
 +
| TSEC_FALCON_DMEMAPERT_ENABLE
 +
|-
 +
| 17-19
 +
| TSEC_FALCON_DMEMAPERT_LDSTQ_NUM
 +
|}
 +
 
 +
=== TSEC_FALCON_EXTERRADDR ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| TSEC_FALCON_EXTERRADDR_ADDR
 +
|}
 +
 
 +
=== TSEC_FALCON_EXTERRSTAT ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-23
 +
| TSEC_FALCON_EXTERRSTAT_PC
 +
|-
 +
| 24-27
 +
| TSEC_FALCON_EXTERRSTAT_STAT
 +
|-
 +
| 31
 +
| TSEC_FALCON_EXTERRSTAT_VALID
 +
|}
 +
 
 +
=== TSEC_FALCON_CG2 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 1
 +
| TSEC_FALCON_CG2_SLCG_FALCON_DMA
 +
|-
 +
| 2
 +
| TSEC_FALCON_CG2_SLCG_FALCON_GC6_SR_FSM
 +
|-
 +
| 3
 +
| TSEC_FALCON_CG2_SLCG_FALCON_PIPE
 +
|-
 +
| 4
 +
| TSEC_FALCON_CG2_SLCG_FALCON_DIV
 +
|-
 +
| 5
 +
| TSEC_FALCON_CG2_SLCG_FALCON_ICD
 +
|-
 +
| 6
 +
| TSEC_FALCON_CG2_SLCG_FALCON_CFG
 +
|-
 +
| 7
 +
| TSEC_FALCON_CG2_SLCG_FALCON_CTXSW
 +
|-
 +
| 8
 +
| TSEC_FALCON_CG2_SLCG_FALCON_PMB
 +
|-
 +
| 9
 +
| TSEC_FALCON_CG2_SLCG_FALCON_RF
 +
|-
 +
| 10
 +
| TSEC_FALCON_CG2_SLCG_FALCON_MUL
 +
|-
 +
| 11
 +
| TSEC_FALCON_CG2_SLCG_FALCON_LDST
 +
|-
 +
| 12
 +
| TSEC_FALCON_CG2_SLCG_FALCON_TSYNC
 +
|-
 +
| 13
 +
| TSEC_FALCON_CG2_SLCG_FALCON_GPTMR
 +
|-
 +
| 14
 +
| TSEC_FALCON_CG2_SLCG_FALCON_WDTMR
 +
|-
 +
| 15
 +
| TSEC_FALCON_CG2_SLCG_FALCON_IRQSTAT
 +
|-
 +
| 16
 +
| TSEC_FALCON_CG2_SLCG_FALCON_TOP
 +
|-
 +
| 17
 +
| TSEC_FALCON_CG2_SLCG_FBIF
 +
|}
 +
 
 +
=== TSEC_FALCON_IMEMC ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 2-7
 +
| TSEC_FALCON_IMEMC_OFFS
 +
|-
 +
| 8-15
 +
| TSEC_FALCON_IMEMC_BLK
 +
|-
 +
| 24
 +
| TSEC_FALCON_IMEMC_AINCW
 +
|-
 +
| 25
 +
| TSEC_FALCON_IMEMC_AINCR
 +
|-
 +
| 28
 +
| TSEC_FALCON_IMEMC_SECURE
 +
|-
 +
| 29
 +
| TSEC_FALCON_IMEMC_SEC_ATOMIC
 +
|-
 +
| 30
 +
| TSEC_FALCON_IMEMC_SEC_WR_VIO
 +
|-
 +
| 31
 +
| TSEC_FALCON_IMEMC_SEC_LOCK
 +
|}
 +
 
 +
Used for configuring access to Falcon's IMEM.
 +
 
 +
=== TSEC_FALCON_IMEMD ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| TSEC_FALCON_IMEMD_DATA
 +
|}
 +
 
 +
Returns or takes the value for an IMEM read/write operation.
 +
 
 +
=== TSEC_FALCON_IMEMT ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-15
 +
| TSEC_FALCON_IMEMT_TAG
 +
|}
 +
 
 +
Returns or takes the virtual page index for an IMEM read/write operation.
 +
 
 +
=== TSEC_FALCON_DMEMC ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 2-7
 +
| TSEC_FALCON_DMEMC_OFFS
 +
|-
 +
| 8-15
 +
| TSEC_FALCON_DMEMC_BLK
 +
|-
 +
| 24
 +
| TSEC_FALCON_DMEMC_AINCW
 +
|-
 +
| 25
 +
| TSEC_FALCON_DMEMC_AINCR
 +
|}
 +
 
 +
Used for configuring access to Falcon's DMEM.
 +
 
 +
=== TSEC_FALCON_DMEMD ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| TSEC_FALCON_DMEMD_DATA
 +
|}
 +
 
 +
Returns or takes the value for a DMEM read/write operation.
 +
 
 +
=== TSEC_FALCON_ICD_CMD ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-3
 +
| TSEC_FALCON_ICD_CMD_OPC
 +
0x00: STOP
 +
0x01: RUN (run from PC)
 +
0x02: JRUN (run from address)
 +
0x03: RUNB (run from PC)
 +
0x04: JRUNB (run from address)
 +
0x05: STEP (step from PC)
 +
0x06: JSTEP (step from address)
 +
0x07: EMASK (set exception mask)
 +
0x08: RREG (read register)
 +
0x09: WREG (write register)
 +
0x0A: RDM (read data memory)
 +
0x0B: WDM (write data memory)
 +
0x0C: RCM (read MMIO/configuration memory)
 +
0x0D: WCM (write MMIO/configuration memory)
 +
0x0E: RSTAT (read status)
 +
0x0F: SBU (store buffer update)
 +
|-
 +
| 6-7
 +
| TSEC_FALCON_ICD_CMD_SZ
 +
0x00: B (byte)
 +
0x01: HW (half word)
 +
0x02: W (word)
 +
|-
 +
| 8-12
 +
| TSEC_FALCON_ICD_CMD_IDX
 +
0x00: REG0 | RSTAT0 | WB0
 +
0x01: REG1 | RSTAT1 | WB1
 +
0x02: REG2 | RSTAT2 | WB2
 +
0x03: REG3 | RSTAT3 | WB3
 +
0x04: REG4 | RSTAT4
 +
0x05: REG5 | RSTAT5
 +
0x06: REG6
 +
0x07: REG7
 +
0x08: REG8
 +
0x09: REG9
 +
0x0A: REG10
 +
0x0B: REG11
 +
0x0C: REG12
 +
0x0D: REG13
 +
0x0E: REG14
 +
0x0F: REG15
 +
0x10: IV0
 +
0x11: IV1
 +
0x12: UNDEFINED
 +
0x13: EV
 +
0x14: SP
 +
0x15: PC
 +
0x16: IMB
 +
0x17: DMB
 +
0x18: CSW
 +
0x19: CCR
 +
0x1A: SEC
 +
0x1B: CTX
 +
0x1C: EXCI
 +
0x1D: SEC1
 +
0x1E: IMB1
 +
0x1F: DMB1
 +
|-
 +
| 14
 +
| TSEC_FALCON_ICD_CMD_ERROR
 +
|-
 +
| 15
 +
| TSEC_FALCON_ICD_CMD_RDVLD
 +
|-
 +
| 16-31
 +
| TSEC_FALCON_ICD_CMD_PARM
 +
0x0001: EMASK_TRAP0
 +
0x0002: EMASK_TRAP1
 +
0x0004: EMASK_TRAP2
 +
0x0008: EMASK_TRAP3
 +
0x0010: EMASK_EXC_UNIMP
 +
0x0020: EMASK_EXC_IMISS
 +
0x0040: EMASK_EXC_IMHIT
 +
0x0080: EMASK_EXC_IBREAK
 +
0x0100: EMASK_IV0
 +
0x0200: EMASK_IV1
 +
0x0400: EMASK_IV2
 +
0x0800: EMASK_EXT0
 +
0x1000: EMASK_EXT1
 +
0x2000: EMASK_EXT2
 +
0x4000: EMASK_EXT3
 +
0x8000: EMASK_EXT4
 +
|}
 +
 
 +
Used for sending commands to the Falcon's in-chip debugger.
 +
 
 +
=== TSEC_FALCON_ICD_ADDR ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| TSEC_FALCON_ICD_ADDR_ADDR
 +
|}
 +
 
 +
Takes the target address for the Falcon's in-chip debugger.
 +
 
 +
=== TSEC_FALCON_ICD_WDATA ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| TSEC_FALCON_ICD_WDATA_DATA
 +
|}
 +
 
 +
Takes the data for writing using the Falcon's in-chip debugger.
 +
 
 +
=== TSEC_FALCON_ICD_RDATA ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| TSEC_FALCON_ICD_RDATA_DATA
 +
|}
 +
 
 +
Returns the data read using the Falcon's in-chip debugger.
 +
 
 +
When reading from an internal status register (STAT), the following applies:
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| RSTAT0_MEM_STALL
 +
|-
 +
| 1
 +
| RSTAT0_DMA_STALL
 +
|-
 +
| 2
 +
| RSTAT0_FENCE_STALL
 +
|-
 +
| 3
 +
| RSTAT0_DIV_STALL
 +
|-
 +
| 4
 +
| RSTAT0_DMA_STALL_DMAQ
 +
|-
 +
| 5
 +
| RSTAT0_DMA_STALL_DMWAITING
 +
|-
 +
| 6
 +
| RSTAT0_DMA_STALL_IMWAITING
 +
|-
 +
| 7
 +
| RSTAT0_ANY_STALL
 +
|-
 +
| 8
 +
| RSTAT0_SBFULL_STALL
 +
|-
 +
| 9
 +
| RSTAT0_SBHIT_STALL
 +
|-
 +
| 10
 +
| RSTAT0_FLOW_STALL
 +
|-
 +
| 11
 +
| RSTAT0_SP_STALL
 +
|-
 +
| 12
 +
| RSTAT0_BL_STALL
 +
|-
 +
| 13
 +
| RSTAT0_IPND_STALL
 +
|-
 +
| 14
 +
| RSTAT0_LDSTQ_STALL
 +
|-
 +
| 16
 +
| RSTAT0_NOINSTR_STALL
 +
|-
 +
| 20
 +
| RSTAT0_HALTSTOP_FLUSH
 +
|-
 +
| 21
 +
| RSTAT0_AFILL_FLUSH
 +
|-
 +
| 22
 +
| RSTAT0_EXC_FLUSH
 +
|-
 +
| 23-25
 +
| RSTAT0_IRQ_FLUSH
 +
|-
 +
| 28
 +
| RSTAT0_VALIDRD
 +
|-
 +
| 29
 +
| RSTAT0_WAITING
 +
|-
 +
| 30
 +
| RSTAT0_HALTED
 +
|-
 +
| 31
 +
| RSTAT0_MTHD_FULL
 +
|}
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-3
 +
| RSTAT1_WB_ALLOC
 +
|-
 +
| 4-7
 +
| RSTAT1_WB_VALID
 +
|-
 +
| 8-9
 +
| RSTAT1_WB0_SZ
 +
|-
 +
| 10-11
 +
| RSTAT1_WB1_SZ
 +
|-
 +
| 12-13
 +
| RSTAT1_WB2_SZ
 +
|-
 +
| 14-15
 +
| RSTAT1_WB3_SZ
 +
|-
 +
| 16-19
 +
| RSTAT1_WB0_IDX
 +
|-
 +
| 20-23
 +
| RSTAT1_WB1_IDX
 +
|-
 +
| 24-27
 +
| RSTAT1_WB2_IDX
 +
|-
 +
| 28-31
 +
| RSTAT1_WB3_IDX
 +
|}
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-3
 +
| RSTAT2_DMAQ_NUM
 +
|-
 +
| 4
 +
| RSTAT2_DMA_ENABLE
 +
|-
 +
| 5-7
 +
| RSTAT2_LDSTQ_NUM
 +
|-
 +
| 16-19
 +
| RSTAT2_EM_BUSY
 +
|-
 +
| 20-23
 +
| RSTAT2_EM_ACKED
 +
|-
 +
| 24-27
 +
| RSTAT2_EM_ISWR
 +
|-
 +
| 28-31
 +
| RSTAT2_EM_DVLD
 +
|}
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| RSTAT3_MTHD_IDLE
 +
|-
 +
| 1
 +
| RSTAT3_CTXSW_IDLE
 +
|-
 +
| 2
 +
| RSTAT3_DMA_IDLE
 +
|-
 +
| 3
 +
| RSTAT3_SCP_IDLE
 +
|-
 +
| 4
 +
| RSTAT3_LDST_IDLE
 +
|-
 +
| 5
 +
| RSTAT3_SBWB_EMPTY
 +
|-
 +
| 6-8
 +
| RSTAT3_CSWIE
 +
|-
 +
| 10
 +
| RSTAT3_CSWE
 +
|-
 +
| 12-14
 +
| RSTAT3_CTXSW_STATE
 +
0x00: IDLE
 +
0x01: SM_CHECK
 +
0x02: SM_SAVE
 +
0x03: SM_SAVE_WAIT
 +
0x04: SM_BLK_BIND
 +
0x05: SM_RESET
 +
0x06: SM_RESETWAIT
 +
0x07: SM_ACK
 +
|-
 +
| 15
 +
| RSTAT3_CTXSW_PEND
 +
|-
 +
| 17
 +
| RSTAT3_DMA_FBREQ_IDLE
 +
|-
 +
| 18
 +
| RSTAT3_DMA_ACKQ_EMPTY
 +
|-
 +
| 19
 +
| RSTAT3_DMA_RDQ_EMPTY
 +
|-
 +
| 20
 +
| RSTAT3_DMA_WR_BUSY
 +
|-
 +
| 21
 +
| RSTAT3_DMA_RD_BUSY
 +
|-
 +
| 22
 +
| RSTAT3_LDST_XT_BUSY
 +
|-
 +
| 23
 +
| RSTAT3_LDST_XT_BLOCK
 +
|-
 +
| 24
 +
| RSTAT3_ENG_IDLE
 +
|}
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-1
 +
| RSTAT4_ICD_STATE
 +
0x00: NORMAL
 +
0x01: WAIT_ISSUE_CLEAR
 +
0x02: WAIT_EXLDQ_CLEAR
 +
0x03: FULL_DBG_MODE
 +
|-
 +
| 2-3
 +
| RSTAT4_ICD_MODE
 +
0x00: SUPPRESSICD
 +
0x01: ENTERICD_IBRK
 +
0x02: ENTERICD_STEP
 +
|-
 +
| 16
 +
| RSTAT4_ICD_EMASK_TRAP0
 +
|-
 +
| 17
 +
| RSTAT4_ICD_EMASK_TRAP1
 +
|-
 +
| 18
 +
| RSTAT4_ICD_EMASK_TRAP2
 +
|-
 +
| 19
 +
| RSTAT4_ICD_EMASK_TRAP3
 +
|-
 +
| 20
 +
| RSTAT4_ICD_EMASK_EXC_UNIMP
 +
|-
 +
| 21
 +
| RSTAT4_ICD_EMASK_EXC_IMISS
 +
|-
 +
| 22
 +
| RSTAT4_ICD_EMASK_EXC_IMHIT
 +
|-
 +
| 23
 +
| RSTAT4_ICD_EMASK_EXC_IBREAK
 +
|-
 +
| 24
 +
| RSTAT4_ICD_EMASK_IV0
 +
|-
 +
| 25
 +
| RSTAT4_ICD_EMASK_IV1
 +
|-
 +
| 26
 +
| RSTAT4_ICD_EMASK_IV2
 +
|-
 +
| 27
 +
| RSTAT4_ICD_EMASK_EXT0
 +
|-
 +
| 28
 +
| RSTAT4_ICD_EMASK_EXT1
 +
|-
 +
| 29
 +
| RSTAT4_ICD_EMASK_EXT2
 +
|-
 +
| 30
 +
| RSTAT4_ICD_EMASK_EXT3
 +
|-
 +
| 31
 +
| RSTAT4_ICD_EMASK_EXT4
 +
|}
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-7
 +
| RSTAT5_LRU_STATE
 +
|}
 +
 
 +
=== TSEC_FALCON_SCTL ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| TSEC_FALCON_SCTL_LSMODE
 +
|-
 +
| 1
 +
| TSEC_FALCON_SCTL_HSMODE
 +
|-
 +
| 4-5
 +
| Current access level
 +
|-
 +
| 8-9
 +
| Unknown access level
 +
|-
 +
| 12
 +
| Unknown
 +
|-
 +
| 13
 +
| Unknown
 +
|-
 +
| 14
 +
| Initialize the transition to LS mode
 +
|}
 +
 
 +
=== TSEC_FALCON_SERRSTAT ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-23
 +
| Unknown
 +
|-
 +
| 30
 +
| Unknown
 +
|-
 +
| 31
 +
| Set on memory protection violation
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
Used for detecting invalid CSB accesses in LS mode.
 +
 
 +
=== TSEC_FALCON_SERRVAL ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| Error code
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
=== TSEC_FALCON_SERRADDR ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| Error address
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
=== TSEC_FALCON_SCTL1 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-1
 +
| CSB access level
 +
|-
 +
| 2-3
 +
| Unknown access level
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
=== TSEC_FALCON_STEST ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| Unknown
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
=== TSEC_FALCON_SICD ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| Enable access to ICD command STOP
 +
|-
 +
| 1
 +
| Enable access to ICD command RUN
 +
|-
 +
| 2
 +
| Enable access to ICD command RUNB
 +
|-
 +
| 3
 +
| Enable access to ICD command STEP
 +
|-
 +
| 4
 +
| Enable access to ICD command EMASK
 +
|-
 +
| 5
 +
| Enable access to ICD command RREG (only for SPRs)
 +
|-
 +
| 6
 +
| Enable access to ICD command RSTAT
 +
|-
 +
| 7
 +
| Enable access to IBRKPT registers
 +
|-
 +
| 8
 +
| Enable access to ICD command RREG (only for GPRs)
 +
|-
 +
| 9
 +
| Enable access to ICD command RDM
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
Controls access to the ICD in LS mode.
 +
 
 +
=== TSEC_FALCON_SPROT_IMEM ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-2
 +
| Read access level
 +
|-
 +
| 3
 +
| Set on memory read access violation
 +
|-
 +
| 4-6
 +
| Write access level
 +
|-
 +
| 7
 +
| Set on memory write access violation
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
Controls accesses to Falcon IMEM.
 +
 
 +
=== TSEC_FALCON_SPROT_DMEM ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-2
 +
| Read access level
 +
|-
 +
| 3
 +
| Set on memory read access violation
 +
|-
 +
| 4-6
 +
| Write access level
 +
|-
 +
| 7
 +
| Set on memory write access violation
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
Controls accesses to Falcon DMEM.
 +
 
 +
=== TSEC_FALCON_SPROT_CPUCTL ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-2
 +
| Read access level
 +
|-
 +
| 3
 +
| Set on memory read access violation
 +
|-
 +
| 4-6
 +
| Write access level
 +
|-
 +
| 7
 +
| Set on memory write access violation
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
Controls accesses to the [[#TSEC_FALCON_CPUCTL|TSEC_FALCON_CPUCTL]] register.
 +
 
 +
=== TSEC_FALCON_SPROT_MISC ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-2
 +
| Read access level
 +
|-
 +
| 3
 +
| Set on memory read access violation
 +
|-
 +
| 4-6
 +
| Write access level
 +
|-
 +
| 7
 +
| Set on memory write access violation
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
Controls accesses to the following registers:
 +
* [[#TSEC_FALCON_PRIVSTATE|TSEC_FALCON_PRIVSTATE]]
 +
* [[#TSEC_FALCON_SFTRESET|TSEC_FALCON_SFTRESET]]
 +
* [[#TSEC_FALCON_ADDR|TSEC_FALCON_ADDR]]
 +
* [[#TSEC_FALCON_DMACTL|TSEC_FALCON_DMACTL]]
 +
* [[#TSEC_FALCON_IMCTL|TSEC_FALCON_IMCTL]]
 +
* [[#TSEC_FALCON_IMSTAT|TSEC_FALCON_IMSTAT]]
 +
* [[#TSEC_FALCON_SCTL1|TSEC_FALCON_SCTL1]]
 +
* [[#TSEC_FALCON_DMAINFO_CTL|TSEC_FALCON_DMAINFO_CTL]]
 +
 
 +
=== TSEC_FALCON_SPROT_IRQ ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-2
 +
| Read access level
 +
|-
 +
| 3
 +
| Set on memory read access violation
 +
|-
 +
| 4-6
 +
| Write access level
 +
|-
 +
| 7
 +
| Set on memory write access violation
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
Controls accesses to the following registers:
 +
* [[#TSEC_FALCON_IRQMODE|TSEC_FALCON_IRQMODE]]
 +
* [[#TSEC_FALCON_IRQMSET|TSEC_FALCON_IRQMSET]]
 +
* [[#TSEC_FALCON_IRQMCLR|TSEC_FALCON_IRQMCLR]]
 +
* [[#TSEC_FALCON_IRQDEST|TSEC_FALCON_IRQDEST]]
 +
* [[#TSEC_FALCON_GPTMRINT|TSEC_FALCON_GPTMRINT]]
 +
* [[#TSEC_FALCON_GPTMRVAL|TSEC_FALCON_GPTMRVAL]]
 +
* [[#TSEC_FALCON_GPTMRCTL|TSEC_FALCON_GPTMRCTL]]
 +
* [[#TSEC_FALCON_IRQDEST2|TSEC_FALCON_IRQDEST2]]
 +
* [[#TSEC_FALCON_SIRQMASK|TSEC_FALCON_SIRQMASK]]
 +
 
 +
=== TSEC_FALCON_SPROT_MTHD ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-2
 +
| Read access level
 +
|-
 +
| 3
 +
| Set on memory read access violation
 +
|-
 +
| 4-6
 +
| Write access level
 +
|-
 +
| 7
 +
| Set on memory write access violation
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
Controls accesses to the following registers:
 +
* [[#TSEC_FALCON_ITFEN|TSEC_FALCON_ITFEN]]
 +
* [[#TSEC_FALCON_CURCTX|TSEC_FALCON_CURCTX]]
 +
* [[#TSEC_FALCON_NXTCTX|TSEC_FALCON_NXTCTX]]
 +
* [[#TSEC_FALCON_CTXACK|TSEC_FALCON_CTXACK]]
 +
* [[#TSEC_FALCON_MTHDDATA|TSEC_FALCON_MTHDDATA]]
 +
* [[#TSEC_FALCON_MTHDID|TSEC_FALCON_MTHDID]]
 +
* [[#TSEC_FALCON_MTHDWDAT|TSEC_FALCON_MTHDWDAT]]
 +
* [[#TSEC_FALCON_MTHDCOUNT|TSEC_FALCON_MTHDCOUNT]]
 +
* [[#TSEC_FALCON_MTHDPOP|TSEC_FALCON_MTHDPOP]]
 +
* [[#TSEC_FALCON_MTHDRAMSZ|TSEC_FALCON_MTHDRAMSZ]]
 +
* [[#TSEC_FALCON_DEBUG1|TSEC_FALCON_DEBUG1]]
 +
 
 +
=== TSEC_FALCON_SPROT_SCTL ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-2
 +
| Read access level
 +
|-
 +
| 3
 +
| Set on memory read access violation
 +
|-
 +
| 4-6
 +
| Write access level
 +
|-
 +
| 7
 +
| Set on memory write access violation
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
Controls accesses to the [[#TSEC_FALCON_SCTL|TSEC_FALCON_SCTL]] register.
 +
 
 +
=== TSEC_FALCON_SPROT_WDTMR ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-2
 +
| Read access level
 +
|-
 +
| 3
 +
| Set on memory read access violation
 +
|-
 +
| 4-6
 +
| Write access level
 +
|-
 +
| 7
 +
| Set on memory write access violation
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
Controls accesses to the following registers:
 +
* [[#TSEC_FALCON_WDTMRVAL|TSEC_FALCON_WDTMRVAL]]
 +
* [[#TSEC_FALCON_WDTMRCTL|TSEC_FALCON_WDTMRCTL]]
 +
 
 +
=== TSEC_FALCON_DMAINFO_FINISHED_FBRD_LOW ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| TSEC_FALCON_DMAINFO_FINISHED_FBRD_LOW_VAL
 +
|}
 +
 
 +
=== TSEC_FALCON_DMAINFO_FINISHED_FBRD_HIGH ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-30
 +
| TSEC_FALCON_DMAINFO_FINISHED_FBRD_HIGH_VAL
 +
|-
 +
| 31
 +
| TSEC_FALCON_DMAINFO_FINISHED_FBRD_HIGH_OBIT
 +
|}
 +
 
 +
=== TSEC_FALCON_DMAINFO_FINISHED_FBWR_LOW ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| TSEC_FALCON_DMAINFO_FINISHED_FBWR_LOW_VAL
 +
|}
 +
 
 +
=== TSEC_FALCON_DMAINFO_FINISHED_FBWR_HIGH ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-30
 +
| TSEC_FALCON_DMAINFO_FINISHED_FBWR_HIGH_VAL
 +
|-
 +
| 31
 +
| TSEC_FALCON_DMAINFO_FINISHED_FBWR_HIGH_OBIT
 +
|}
 +
 
 +
=== TSEC_FALCON_DMAINFO_CURRENT_FBRD_LOW ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| TSEC_FALCON_DMAINFO_CURRENT_FBRD_LOW_VAL
 +
|}
 +
 
 +
=== TSEC_FALCON_DMAINFO_CURRENT_FBRD_HIGH ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-30
 +
| TSEC_FALCON_DMAINFO_CURRENT_FBRD_HIGH_VAL
 +
|-
 +
| 31
 +
| TSEC_FALCON_DMAINFO_CURRENT_FBRD_HIGH_OBIT
 +
|}
 +
 
 +
=== TSEC_FALCON_DMAINFO_CURRENT_FBWR_LOW ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| TSEC_FALCON_DMAINFO_CURRENT_FBWR_LOW_VAL
 +
|}
 +
 
 +
=== TSEC_FALCON_DMAINFO_CURRENT_FBWR_HIGH ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-30
 +
| TSEC_FALCON_DMAINFO_CURRENT_FBWR_HIGH_VAL
 +
|-
 +
| 31
 +
| TSEC_FALCON_DMAINFO_CURRENT_FBWR_HIGH_OBIT
 +
|}
 +
 
 +
=== TSEC_FALCON_DMAINFO_CTL ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| TSEC_FALCON_DMAINFO_CTL_CLR_FBRD
 +
|-
 +
| 1
 +
| TSEC_FALCON_DMAINFO_CTL_CLR_FBWR
 +
|}
 +
 
 +
=== TSEC_SCP_CTL0 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 10
 +
| Enable [[#LOAD|Falcon<->LOAD]] interface
 +
|-
 +
| 12
 +
| Enable [[#STORE|Falcon<->STORE]] interface
 +
|-
 +
| 14
 +
| Enable [[#CMD|Falcon<->CMD]] interface
 +
|-
 +
| 16
 +
| Enable [[#SEQ|SEQ]]
 +
|-
 +
| 20
 +
| Enable [[#CTL|CTL]]
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
=== TSEC_SCP_CTL1 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| Clear [[#SEQ|SEQ]]
 +
|-
 +
| 8
 +
| Clear [[#SCP|SCP]]'s internal pipeline
 +
|-
 +
| 11
 +
| Enable [[#RNG|RNG]]'s test mode
 +
|-
 +
| 12
 +
| Enable [[#RNG|RNG]]
 +
|-
 +
| 16
 +
| Enable [[#LOAD|Falcon<->LOAD]] interface's dummy mode (all reads return 0)
 +
|-
 +
| 20
 +
| Enable [[#LOAD|Falcon<->LOAD]] interface bypassing (all reads are dropped)
 +
|-
 +
| 24
 +
| Enable [[#STORE|Falcon<->STORE]] interface bypassing (all writes are dropped)
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
=== TSEC_SCP_CTL_STAT ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 20
 +
| TSEC_SCP_CTL_STAT_DEBUG_MODE
 +
|}
 +
 
 +
=== TSEC_SCP_CTL_LOCK ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| Enable lockdown mode (locks IMEM and DMEM)
 +
|-
 +
| 1
 +
| Lockdown has pending exit request
 +
|-
 +
| 2
 +
| Lockdown has been enabled before
 +
|-
 +
| 4
 +
| Enable SCP lockdown mode (locks [[#SCP|SCP]]'s MMIO register space)
 +
|-
 +
| 6
 +
| SCP lockdown has been enabled before
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
Controls lockdown mode. Can only be cleared in HS mode.
 +
 
 +
=== TSEC_SCP_CFG ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| Endianness for ADD
 +
0: Little
 +
1: Big
 +
|-
 +
| 1
 +
| Endianness for GFMUL
 +
0: Little
 +
1: Big
 +
|-
 +
| 2
 +
| Endianness for [[#LOAD|LOAD]]
 +
0: Little
 +
1: Big
 +
|-
 +
| 3
 +
| Endianness for [[#STORE|STORE]]
 +
0: Little
 +
1: Big
 +
|-
 +
| 4
 +
| Endianness for [[#AES|AES]]
 +
0: Little
 +
1: Big
 +
|-
 +
| 8
 +
| Flush [[#CMD|CMD]]
 +
|-
 +
| 12-13
 +
| Carry chain's size
 +
0: 32 bits
 +
1: 64 bits
 +
2: 96 bits
 +
3: 128 bits
 +
|-
 +
| 16-31
 +
| [[#SCP|SCP]]'s internal pipeline stall timeout value
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
=== TSEC_SCP_CTL_SCP ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| Swap [[#SCP|SCP]]'s master
 +
|-
 +
| 1
 +
| Current [[#SCP|SCP]]'s master
 +
0: Falcon
 +
1: External
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
=== TSEC_SCP_CTL_PKEY ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
 +
|-
 +
| 1
 +
| TSEC_SCP_CTL_PKEY_LOADED
 +
|}
 +
 
 +
=== TSEC_SCP_CTL_DBG ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 4
 +
| Disable lockdown mode
 +
|-
 +
| 8
 +
| Disable SCP lockdown mode
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
Overrides lockdown mode. Can only be set in debug mode.
 +
 
 +
=== TSEC_SCP_DBG0 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-3
 +
| Index
 +
|-
 +
| 4
 +
| Auto-increment
 +
|-
 +
| 5-6
 +
| Target
 +
0: None
 +
1: STORE
 +
2: LOAD
 +
3: SEQ
 +
|-
 +
| 8-12
 +
| [[#SEQ|SEQ]]'s current sequence's size
 +
|-
 +
| 13-16
 +
| [[#SEQ|SEQ]]'s current instruction's address
 +
|-
 +
| 17
 +
| [[#SEQ|SEQ]]'s current instruction is valid
 +
|-
 +
| 18
 +
| [[#SEQ|SEQ]] is running in HS mode
 +
|-
 +
| 19-22
 +
| [[#LOAD|LOAD]]'s queue's size
 +
|-
 +
| 23
 +
| [[#LOAD|LOAD]]'s current operation is valid
 +
|-
 +
| 24
 +
| [[#LOAD|LOAD]] is running in HS mode
 +
|-
 +
| 25-26
 +
| [[#STORE|STORE]]'s queue's size
 +
|-
 +
| 30
 +
| [[#STORE|STORE]]'s current operation is valid
 +
|-
 +
| 31
 +
| [[#STORE|STORE]] is running in HS mode
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
Used for debugging the [[#LOAD|LOAD]], [[#STORE|STORE]] and [[#SEQ|SEQ]] blocks.
 +
 
 +
=== TSEC_SCP_DBG1 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| Data
 +
If target is SEQ:
 +
  Bits 0-3: current instruction's first operand
 +
  Bits 4-9: current instruction's second operand
 +
  Bits 10-14: current instruction's opcode
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
Used for retrieving debug data. Contains information on the last crypto sequence created when debugging the [[#SEQ|SEQ]] block.
 +
 
 +
=== TSEC_SCP_DBG2 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-1
 +
| [[#SEQ|SEQ]]'s state
 +
0: Idle
 +
1: Recording (cs0begin/cs1begin)
 +
2: Executing (cs0exec/cs1exec)
 +
|-
 +
| 4-7
 +
| Number of cycles left for [[#SEQ|SEQ]]'s current sequence
 +
|-
 +
| 12-15
 +
| Active crypto key register (ckeyreg)
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
Used for retrieving additional debug data associated with the [[#SEQ|SEQ]] block.
 +
 
 +
=== TSEC_SCP_CMD ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-3
 +
| Destination register
 +
|-
 +
| 8-13
 +
| Source register or immediate value
 +
|-
 +
| 20-24
 +
| Command opcode
 +
0x0:  nop (fuc5 opcode 0x00)
 +
0x1:  cmov (fuc5 opcode 0x84)
 +
0x2:  cxsin (fuc5 opcode 0x88) or xdst (with cxset)
 +
0x3:  cxsout (fuc5 opcode 0x8C) or xdld (with cxset)
 +
0x4:  crnd (fuc5 opcode 0x90)
 +
0x5:  cs0begin (fuc5 opcode 0x94)
 +
0x6:  cs0exec (fuc5 opcode 0x98)
 +
0x7:  cs1begin (fuc5 opcode 0x9C)
 +
0x8:  cs1exec (fuc5 opcode 0xA0)
 +
0x9:  invalid (fuc5 opcode 0xA4)
 +
0xA:  cchmod (fuc5 opcode 0xA8)
 +
0xB:  cxor (fuc5 opcode 0xAC)
 +
0xC:  cadd (fuc5 opcode 0xB0)
 +
0xD:  cand (fuc5 opcode 0xB4)
 +
0xE:  crev (fuc5 opcode 0xB8)
 +
0xF:  cgfmul (fuc5 opcode 0xBC)
 +
0x10: csecret (fuc5 opcode 0xC0)
 +
0x11: ckeyreg (fuc5 opcode 0xC4)
 +
0x12: ckexp (fuc5 opcode 0xC8)
 +
0x13: ckrexp (fuc5 opcode 0xCC)
 +
0x14: cenc (fuc5 opcode 0xD0)
 +
0x15: cdec (fuc5 opcode 0xD4)
 +
0x16: csigcmp (fuc5 opcode 0xD8)
 +
0x17: csigenc (fuc5 opcode 0xDC)
 +
0x18: csigclr (fuc5 opcode 0xE0)
 +
|-
 +
| 28
 +
| [[#CMD|CMD]]'s current instruction is valid
 +
|-
 +
| 31
 +
| [[#CMD|CMD]] is running in HS mode
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
Contains information on the last crypto command executed.
 +
 
 +
=== TSEC_SCP_STAT0 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| [[#SCP|SCP]] is active
 +
|-
 +
| 2
 +
| [[#CMD|CMD]] is active
 +
|-
 +
| 4
 +
| [[#STORE|STORE]] is active
 +
|-
 +
| 6
 +
| [[#SEQ|SEQ]] is active
 +
|-
 +
| 8
 +
| [[#CTL|CTL]] is active
 +
|-
 +
| 10
 +
| [[#LOAD|LOAD]] is active
 +
|-
 +
| 14
 +
| [[#AES|AES]] is active
 +
|-
 +
| 16
 +
| [[#RNG|RNG]] is active
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
Contains the statuses of hardware blocks.
 +
 
 +
=== TSEC_SCP_STAT1 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-1
 +
| Signature comparison result
 +
0: None
 +
1: Running
 +
2: Failed
 +
3: Succeeded
 +
|-
 +
| 4
 +
| [[#LOAD|Falcon<->LOAD]] interface is running in HS mode
 +
|-
 +
| 6
 +
| [[#LOAD|Falcon<->LOAD]] interface is ready
 +
|-
 +
| 8
 +
| [[#STORE|Falcon<->STORE]] interface is running in HS mode
 +
|-
 +
| 10
 +
| [[#STORE|Falcon<->STORE]] interface received a valid operation
 +
|-
 +
| 12
 +
| [[#CMD|Falcon<->CMD]] interface is running in HS mode
 +
|-
 +
| 14
 +
| [[#CMD|Falcon<->CMD]] interface received a valid instruction
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
Contains the statuses of hardware interfaces and the result of the last authentication attempt.
 +
 
 +
=== TSEC_SCP_STAT2 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-4
 +
| Current opcode in [[#SEQ|SEQ]]
 +
|-
 +
| 5-9
 +
| Current opcode in [[#CMD|Falcon<->CMD]] interface
 +
|-
 +
| 10-14
 +
| Pending opcode in [[#CMD|CMD]]
 +
|-
 +
| 15-16
 +
| Current opcode in [[#AES|AES]]
 +
0: Encryption
 +
1: Decryption
 +
2: Key expansion
 +
3: Key reverse expansion
 +
|-
 +
| 24
 +
| [[#SCP|SCP]]'s internal pipeline is stalled on hazard
 +
|-
 +
| 25
 +
| [[#STORE|STORE]] is stalled
 +
|-
 +
| 26
 +
| [[#LOAD|LOAD]] is stalled
 +
|-
 +
| 27
 +
| [[#RNG|RNG]] is stalled
 +
|-
 +
| 28
 +
| [[#SCP|SCP]]'s internal pipeline is stalled on writeback
 +
|-
 +
| 29
 +
| [[#AES|AES]] is stalled
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
Contains the status of crypto operations.
 +
 
 +
=== TSEC_SCP_RNG_STAT0 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| [[#RND|RND]] is ready
 +
|-
 +
| 4-7
 +
| Unknown
 +
|-
 +
| 8-11
 +
| Unknown
 +
|-
 +
| 16
 +
| Unknown
 +
|-
 +
| 20
 +
| Unknown
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
=== TSEC_SCP_RNG_STAT1 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-15
 +
| Unknown
 +
|-
 +
| 16-31
 +
| Unknown
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
=== TSEC_SCP_IRQSTAT ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| [[#RND|RND]] ready
 +
|-
 +
| 8
 +
| ACL error
 +
|-
 +
| 12
 +
| SEC error
 +
|-
 +
| 16
 +
| [[#CMD|CMD]] error
 +
|-
 +
| 20
 +
| Single step
 +
|-
 +
| 24
 +
| [[#RND|RND]] clock trigger
 +
|-
 +
| 28
 +
| Stall timeout
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
=== TSEC_SCP_IRQMASK ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| [[#RND|RND]] ready
 +
|-
 +
| 8
 +
| ACL error
 +
|-
 +
| 12
 +
| SEC error
 +
|-
 +
| 16
 +
| [[#CMD|CMD]] error
 +
|-
 +
| 20
 +
| Single step
 +
|-
 +
| 24
 +
| [[#RND|RND]] clock trigger
 +
|-
 +
| 28
 +
| Stall timeout
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
=== TSEC_SCP_ACL_ERR ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| Writing to a crypto register without the correct ACL
 +
|-
 +
| 4
 +
| Reading from a crypto register without the correct ACL
 +
|-
 +
| 8
 +
| Invalid ACL change (cchmod)
 +
|-
 +
| 31
 +
| ACL error occurred
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
Contains information on errors generated by the [[#TSEC_SCP_IRQSTAT|ACL error]] IRQ.
 +
 
 +
=== TSEC_SCP_SEC_ERR ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| Security mode changed during sequence execution (cs0exec/cs1exec)
 +
|-
 +
| 1-2
 +
| Security mode at the beginning of sequence execution
 +
0: Non-secure
 +
1: Heavy Secure
 +
|-
 +
| 4
 +
| Security mode changed during sequence recording (cs0begin/cs1begin)
 +
|-
 +
| 5-6
 +
| Security mode at the beginning of sequence recording
 +
0: Non-secure
 +
1: Heavy Secure
 +
|-
 +
| 16
 +
| Security mode changed while reading from crypto register/stream (cxsout or xdld)
 +
|-
 +
| 17-18
 +
| Security mode at the beginning of reading from crypto register/stream
 +
0: Non-secure
 +
1: Heavy Secure
 +
|-
 +
| 20
 +
| Security mode and memory source changed while writing to crypto register/stream (cxsin or xdst)
 +
|-
 +
| 21-22
 +
| Security mode when memory source changed while writing to crypto register/stream
 +
0: Non-secure
 +
1: Heavy Secure
 +
|-
 +
| 24
 +
| Security mode changed while writing to crypto register/stream (cxsin or xdst)
 +
|-
 +
| 25-26
 +
| Security mode at the beginning of writing to crypto register/stream
 +
0: Non-secure
 +
1: Heavy Secure
 +
|-
 +
| 31
 +
| SEC error occurred
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
Contains information on errors generated by the [[#TSEC_SCP_IRQSTAT|SEC error]] IRQ.
 +
 
 +
=== TSEC_SCP_CMD_ERR ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| [[#CMD|CMD]]'s instruction is invalid
 +
|-
 +
| 4
 +
| [[#SEQ|SEQ]]'s sequence is empty
 +
|-
 +
| 8
 +
| [[#SEQ|SEQ]]'s sequence is too long
 +
|-
 +
| 12
 +
| [[#SEQ|SEQ]]'s sequence was not finished
 +
|-
 +
| 16
 +
| Forbidden signature operation (csigcmp, csigenc or csigclr in NS mode)
 +
|-
 +
| 20
 +
| Invalid signature operation (csigcmp in HS mode)
 +
|-
 +
| 24
 +
| Forbidden ACL change (cchmod in NS mode)
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
Contains information on errors generated by the [[#TSEC_SCP_IRQSTAT|CMD error]] IRQ.
 +
 
 +
=== TSEC_SCP_RND_CTL0 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| [[#RND|RND]] clock trigger's lower limit
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
=== TSEC_SCP_RND_CTL1 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-15
 +
| [[#RND|RND]] clock trigger's upper limit
 +
|-
 +
| 16-31
 +
| [[#RND|RND]] clock trigger's mask
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
=== TSEC_SCP_RND_CTL2 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-15
 +
| Unknown
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
=== TSEC_SCP_RND_CTL3 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 12
 +
| Trigger first LFSR
 +
|-
 +
| 16
 +
| Trigger second LFSR
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
=== TSEC_SCP_RND_CTL4 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| First LFSR's polynomial for [[#RNG|RNG]]'s test mode
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
=== TSEC_SCP_RND_CTL5 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| First LFSR's initial state for [[#RNG|RNG]]'s test mode
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
=== TSEC_SCP_RND_CTL6 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| Second LFSR's polynomial for [[#RNG|RNG]]'s test mode
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
=== TSEC_SCP_RND_CTL7 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| Second LFSR's initial state for [[#RNG|RNG]]'s test mode
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
=== TSEC_SCP_RND_CTL8 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-15
 +
| Unknown
 +
|-
 +
| 16-31
 +
| Unknown
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
=== TSEC_SCP_RND_CTL9 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-15
 +
| Unknown
 +
|-
 +
| 16-31
 +
| Unknown
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
=== TSEC_SCP_RND_CTL10 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-15
 +
| Unknown
 +
|-
 +
| 16-31
 +
| Unknown
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
=== TSEC_SCP_RND_CTL11 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| Unknown
 +
|-
 +
| 1
 +
| Unknown
 +
|-
 +
| 2
 +
| Unknown
 +
|-
 +
| 3
 +
| Unknown
 +
|-
 +
| 4-5
 +
| First sampler's source
 +
0: Oscillator
 +
1: Unknown
 +
2: LFSR
 +
3: Dummy
 +
|-
 +
| 6-7
 +
| Second sampler's source
 +
0: Oscillator
 +
1: Unknown
 +
2: LFSR
 +
3: Dummy
 +
|-
 +
| 8-11
 +
| First sampler's tap value
 +
|-
 +
| 12-15
 +
| Second sampler's tap value
 +
|-
 +
| 16-19
 +
| Unknown
 +
|-
 +
| 20-23
 +
| Unknown
 +
|-
 +
| 24-30
 +
| Unknown
 +
|-
 +
| 31
 +
| Unknown
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
=== TSEC_TFBIF_CTL ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| TSEC_TFBIF_CTL_CLR_BWCOUNT
 +
|-
 +
| 1
 +
| TSEC_TFBIF_CTL_ENABLE
 +
|-
 +
| 2
 +
| TSEC_TFBIF_CTL_CLR_IDLEWDERR
 +
|-
 +
| 3
 +
| TSEC_TFBIF_CTL_RESET
 +
|-
 +
| 4
 +
| TSEC_TFBIF_CTL_IDLE
 +
|-
 +
| 5
 +
| TSEC_TFBIF_CTL_IDLEWDERR
 +
|-
 +
| 6
 +
| TSEC_TFBIF_CTL_SRTOUT
 +
|-
 +
| 7
 +
| TSEC_TFBIF_CTL_CLR_SRTOUT
 +
|-
 +
| 8-11
 +
| TSEC_TFBIF_CTL_SRTOVAL
 +
|-
 +
| 12
 +
| TSEC_TFBIF_CTL_VPR
 +
|}
 +
 
 +
=== TSEC_TFBIF_MCCIF_FIFOCTRL ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
 +
|-
 +
| 1
 +
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
 +
|-
 +
| 2
 +
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
 +
|-
 +
| 3
 +
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
 +
|-
 +
| 4
 +
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
 +
|-
 +
| 5
 +
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
 +
|-
 +
| 6
 +
| TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
 +
|-
 +
| 7
 +
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
 +
|-
 +
| 8
 +
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE
 +
|}
 +
 
 +
=== TSEC_TFBIF_THROTTLE ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-11
 +
| TSEC_TFBIF_THROTTLE_BUCKET_SIZE
 +
|-
 +
| 16-27
 +
| TSEC_TFBIF_THROTTLE_LEAK_COUNT
 +
|-
 +
| 30-31
 +
| TSEC_TFBIF_THROTTLE_LEAK_SIZE
 +
|}
 +
 
 +
=== TSEC_TFBIF_DBG_STAT0 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| TSEC_TFBIF_DBG_STAT0_1K_TRANSFER
 +
|-
 +
| 1
 +
| TSEC_TFBIF_DBG_STAT0_RREQ_ISSUED
 +
|-
 +
| 2
 +
| TSEC_TFBIF_DBG_STAT0_WREQ_ISSUED
 +
|-
 +
| 3
 +
| TSEC_TFBIF_DBG_STAT0_TAGQ_ISSUED
 +
|-
 +
| 4
 +
| TSEC_TFBIF_DBG_STAT0_STALL_RDATQ
 +
|-
 +
| 5
 +
| TSEC_TFBIF_DBG_STAT0_STALL_RACKQ
 +
|-
 +
| 6
 +
| TSEC_TFBIF_DBG_STAT0_STALL_WREQQ
 +
|-
 +
| 7
 +
| TSEC_TFBIF_DBG_STAT0_STALL_WDATQ
 +
|-
 +
| 8
 +
| TSEC_TFBIF_DBG_STAT0_STALL_WACKQ
 +
|-
 +
| 9
 +
| TSEC_TFBIF_DBG_STAT0_STALL_RREQ_PENDING
 +
|-
 +
| 10
 +
| TSEC_TFBIF_DBG_STAT0_STALL_WREQ_PENDING
 +
|-
 +
| 11
 +
| TSEC_TFBIF_DBG_STAT0_STALL_MREQ
 +
|-
 +
| 12
 +
| TSEC_TFBIF_DBG_STAT0_ENGINE_IDLE
 +
|-
 +
| 13
 +
| TSEC_TFBIF_DBG_STAT0_RMCCIF_IDLE
 +
|-
 +
| 14
 +
| TSEC_TFBIF_DBG_STAT0_WMCCIF_IDLE
 +
|-
 +
| 15
 +
| TSEC_TFBIF_DBG_STAT0_CSB_IDLE
 +
|-
 +
| 16
 +
| TSEC_TFBIF_DBG_STAT0_RU_IDLE
 +
|-
 +
| 17
 +
| TSEC_TFBIF_DBG_STAT0_WU_IDLE
 +
|-
 +
| 19
 +
| TSEC_TFBIF_DBG_STAT0_UNWEIGHT_ACTMON_ACTIVE
 +
|-
 +
| 20
 +
| TSEC_TFBIF_DBG_STAT0_UNWEIGHT_ACTMON_MCB
 +
|}
 +
 
 +
=== TSEC_TFBIF_DBG_STAT1 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| TSEC_TFBIF_DBG_STAT1_DATA
 +
|}
 +
 
 +
=== TSEC_TFBIF_DBG_RDCOUNT_LO ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| TSEC_TFBIF_DBG_RDCOUNT_LO_DATA
 +
|}
 +
 
 +
=== TSEC_TFBIF_DBG_RDCOUNT_HI ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| TSEC_TFBIF_DBG_RDCOUNT_HI_DATA
 +
|}
 +
 
 +
=== TSEC_TFBIF_DBG_WRCOUNT_LO ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| TSEC_TFBIF_DBG_WRCOUNT_LO_DATA
 +
|}
 +
 
 +
=== TSEC_TFBIF_DBG_WRCOUNT_HI ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| TSEC_TFBIF_DBG_WRCOUNT_HI_DATA
 +
|}
 +
 
 +
=== TSEC_TFBIF_DBG_R32COUNT ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| TSEC_TFBIF_DBG_R32COUNT_DATA
 +
|}
 +
 
 +
=== TSEC_TFBIF_DBG_R64COUNT ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| TSEC_TFBIF_DBG_R64COUNT_DATA
 +
|}
 +
 
 +
=== TSEC_TFBIF_DBG_R128COUNT ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| TSEC_TFBIF_DBG_R128COUNT_DATA
 +
|}
 +
 
 +
=== TSEC_TFBIF_MCCIF_FIFOCTRL1 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-15
 +
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
 +
|-
 +
| 16-31
 +
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT
 +
|}
 +
 
 +
=== TSEC_TFBIF_SPROT_EMEM ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-2
 +
| Read access level
 +
|-
 +
| 3
 +
| Set on memory read access violation
 +
|-
 +
| 4-6
 +
| Write access level
 +
|-
 +
| 7
 +
| Set on memory write access violation
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
Controls accesses to external memory regions. Accessible in HS mode only.
 +
 
 +
=== TSEC_TFBIF_TRANSCFG ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| TSEC_TFBIF_TRANSCFG_ATT0_SWID
 +
|-
 +
| 4
 +
| TSEC_TFBIF_TRANSCFG_ATT1_SWID
 +
|-
 +
| 8
 +
| TSEC_TFBIF_TRANSCFG_ATT2_SWID
 +
|-
 +
| 12
 +
| TSEC_TFBIF_TRANSCFG_ATT3_SWID
 +
|-
 +
| 16
 +
| TSEC_TFBIF_TRANSCFG_ATT4_SWID
 +
|-
 +
| 20
 +
| TSEC_TFBIF_TRANSCFG_ATT5_SWID
 +
|-
 +
| 24
 +
| TSEC_TFBIF_TRANSCFG_ATT6_SWID
 +
|-
 +
| 28
 +
| TSEC_TFBIF_TRANSCFG_ATT7_SWID
 +
|}
 +
 
 +
Configures the software ID per CTXDMA port for memory transactions. Software ID 0 (HW_SWID) forces all transactions to go through the SMMU while software ID 1 (PHY_SWID) bypasses it. Accessible in HS mode only.
 +
 
 +
[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.
 +
 
 +
=== TSEC_TFBIF_REGIONCFG ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-2
 +
| TSEC_TFBIF_REGIONCFG_T0_APERT_ID
 +
|-
 +
| 3
 +
| TSEC_TFBIF_REGIONCFG_T0_VPR
 +
|-
 +
| 4-6
 +
| TSEC_TFBIF_REGIONCFG_T1_APERT_ID
 +
|-
 +
| 7
 +
| TSEC_TFBIF_REGIONCFG_T1_VPR
 +
|-
 +
| 8-10
 +
| TSEC_TFBIF_REGIONCFG_T2_APERT_ID
 +
|-
 +
| 11
 +
| TSEC_TFBIF_REGIONCFG_T2_VPR
 +
|-
 +
| 12-14
 +
| TSEC_TFBIF_REGIONCFG_T3_APERT_ID
 +
|-
 +
| 15
 +
| TSEC_TFBIF_REGIONCFG_T3_VPR
 +
|-
 +
| 16-18
 +
| TSEC_TFBIF_REGIONCFG_T4_APERT_ID
 +
|-
 +
| 19
 +
| TSEC_TFBIF_REGIONCFG_T4_VPR
 +
|-
 +
| 20-22
 +
| TSEC_TFBIF_REGIONCFG_T5_APERT_ID
 +
|-
 +
| 23
 +
| TSEC_TFBIF_REGIONCFG_T5_VPR
 +
|-
 +
| 24-26
 +
| TSEC_TFBIF_REGIONCFG_T6_APERT_ID
 +
|-
 +
| 27
 +
| TSEC_TFBIF_REGIONCFG_T6_VPR
 +
|-
 +
| 28-30
 +
| TSEC_TFBIF_REGIONCFG_T7_APERT_ID
 +
|-
 +
| 31
 +
| TSEC_TFBIF_REGIONCFG_T7_VPR
 +
|}
 +
 
 +
Configures the aperture ID and VPR mode per CTXDMA port for memory region accessing. Accessible in HS mode only.
 +
 
 +
[6.0.0+] The nvhost_tsec firmware sets this register to 0x20 or 0x140 before reading memory from the GPU UCODE carveout.
 +
 
 +
=== TSEC_CG ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-5
 +
| TSEC_CG_IDLE_CG_DLY_CNT
 +
|-
 +
| 6
 +
| TSEC_CG_IDLE_CG_EN
 +
|-
 +
| 16-18
 +
| TSEC_CG_WAKEUP_DLY_CNT
 +
|-
 +
| 19
 +
| TSEC_CG_WAKEUP_DLY_EN
 +
|}
 +
 
 +
=== TSEC_BAR0_CTL ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| TSEC_BAR0_CTL_READ
 +
|-
 +
| 1
 +
| TSEC_BAR0_CTL_WRITE
 +
|-
 +
| 4-7
 +
| TSEC_BAR0_CTL_BYTE_MASK
 +
|-
 +
| 12-13
 +
| TSEC_BAR0_CTL_STATUS
 +
0: Idle
 +
1: Busy
 +
2: Error
 +
3: Disabled
 +
|-
 +
| 16-17
 +
| TSEC_BAR0_CTL_SEC_MODE
 +
0: Non-secure
 +
1: Invalid
 +
2: Light Secure
 +
3: Heavy Secure
 +
|-
 +
| 31
 +
| TSEC_BAR0_CTL_INIT
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
Controls DMA transfers between TSEC and HOST1X (master and clients).
 +
 
 +
Starting a transfer over BAR0 automatically sets TSEC_BAR0_CTL_SEC_MODE to the current Falcon security mode. Once set, any attempts to start a transfer from a lower security level will fail.
 +
 
 +
=== TSEC_BAR0_ADDR ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| TSEC_BAR0_ADDR_VAL
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
Takes the address for DMA transfers between TSEC and HOST1X (master and clients).
 +
 
 +
=== TSEC_BAR0_DATA ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| TSEC_BAR0_DATA_VAL
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
Takes the data for DMA transfers between TSEC and HOST1X (master and clients).
 +
 
 +
=== TSEC_BAR0_TIMEOUT ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| TSEC_BAR0_TIMEOUT_VAL
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
Takes the timeout value for DMA transfers between TSEC and HOST1X (master and clients).
 +
 
 +
=== TSEC_VERSION ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| Version
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
=== TSEC_SCRATCH0 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| Value
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
=== TSEC_SCRATCH1 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| Value
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
=== TSEC_SCRATCH2 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| Value
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
=== TSEC_SCRATCH3 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| Value
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
=== TSEC_SCRATCH4 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| Value
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
=== TSEC_SCRATCH5 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| Value
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
=== TSEC_SCRATCH6 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| Value
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
=== TSEC_SCRATCH7 ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-31
 +
| Value
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
=== TSEC_GPTMRINT ===
 +
Unofficial name.
 +
 
 +
Same as [[#TSEC_FALCON_GPTMRINT|TSEC_FALCON_GPTMRINT]], but for an unknown hardware block.
 +
 
 +
=== TSEC_GPTMRVAL ===
 +
Unofficial name.
 +
 
 +
Same as [[#TSEC_FALCON_GPTMRVAL|TSEC_FALCON_GPTMRVAL]], but for an unknown hardware block.
 +
 
 +
=== TSEC_GPTMRCTL ===
 +
Unofficial name.
 +
 
 +
Same as [[#TSEC_FALCON_GPTMRCTL|TSEC_FALCON_GPTMRCTL]], but for an unknown hardware block.
 +
 
 +
=== TSEC_ITFEN ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| Enable [[#TSEC_GPTMRINT|TSEC_GPTMRINT]]
 +
|-
 +
| 1
 +
| Unknown
 +
|-
 +
| 2
 +
| Unknown
 +
|-
 +
| 3
 +
| Unknown
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
=== TSEC_ITFSTAT ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| [[#TSEC_GPTMRINT|TSEC_GPTMRINT]] is enabled
 +
|-
 +
| 1
 +
| Unknown
 +
|-
 +
| 2
 +
| Unknown
 +
|-
 +
| 3
 +
| Unknown
 +
|}
 +
 
 +
Unofficial name.
 +
 
 +
=== TSEC_TEGRA_CTL ===
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 16
 +
| TSEC_TEGRA_CTL_TKFI_KFUSE
 +
|-
 +
| 17
 +
| TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
 +
|-
 +
| 24
 +
| TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
 +
|-
 +
| 25
 +
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
 +
|-
 +
| 26
 +
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
 +
|-
 +
| 27
 +
| TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C
 +
|}
 +
 
 +
== Falcon ==
 +
"Falcon" (FAst Logic CONtroller) is a proprietary general purpose CPU which can be found inside various hardware blocks that require some sort of logic processing such as TSEC (TSECA and TSECB), NVDEC, NVENC, NVJPG, VIC, GPU PMU and XUSB.
 +
 
 +
=== Processor Registers ===
 +
A total of 32 processor registers are available in the Falcon CPU.
 +
 
 +
==== REG0-REG15 ====
 +
These are 16 32-bit GPRs (general purpose registers).
 +
 
 +
==== IV0 ====
 +
This is a SPR (special purpose register) that holds the address for interrupt vector 0. Only bits 0 to 15 are used.
 +
 
 +
==== IV1 ====
 +
This is a SPR (special purpose register) that holds the address for interrupt vector 1. Only bits 0 to 15 are used.
 +
 
 +
==== IV2 ====
 +
This is a SPR (special purpose register) that holds the address for interrupt vector 2. This register is considered "UNDEFINED" and appears to be unused.
 +
 
 +
==== EV ====
 +
This is a SPR (special purpose register) that holds the address for the exception vector. Only bits 0 to 15 are used.
 +
 
 +
Alternative name (envytools): "tv".
 +
 
 +
==== SP ====
 +
This is a SPR (special purpose register) that holds the current stack pointer. Only bits 0 to 15 are used.
 +
 
 +
==== PC ====
 +
This is a SPR (special purpose register) that holds the current program counter. Only bits 0 to 15 are used.
 +
 
 +
==== IMB ====
 +
This is a SPR (special purpose register) that holds the external base address for IMEM transfers.
 +
 
 +
Alternative name (envytools): "xcbase".
 +
 
 +
==== DMB ====
 +
This is a SPR (special purpose register) that holds the external base address for DMEM transfers.
 +
 
 +
Alternative name (envytools): "xdbase".
 +
 
 +
==== CSW ====
 +
This is a SPR (special purpose register) that holds various flag bits.
 +
 
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-7 || General purpose predicates
 +
|-
 +
| 8 || ALU carry flag
 +
|-
 +
| 9 || ALU signed overflow flag
 +
|-
 +
| 10 || ALU sign flag
 +
|-
 +
| 11 || ALU zero flag
 +
|-
 +
| 16 || Interrupt 0 enable
 +
|-
 +
| 17 || Interrupt 1 enable
 +
|-
 +
| 18 || Interrupt 2 enable (undefined)
 +
|-
 +
| 20 || Interrupt 0 saved enable
 +
|-
 +
| 21 || Interrupt 1 saved enable
 +
|-
 +
| 22 || Interrupt 2 saved enable (undefined)
 +
|-
 +
| 24 || Exception active
 +
|-
 +
| 26-31 || Unknown
 +
|}
 +
 
 +
Alternative name (envytools): "flags".
 +
 
 +
==== CCR ====
 +
This is a SPR (special purpose register) that holds configuration bits for the SCP DMA override functionality. The value of this register is set using the "cxset" instruction which provides a way to change the behavior of a variable amount of successively executed DMA-related instructions ("xdwait", "xdst" and "xdld").
 +
 
 +
{| class=wikitable
 +
! Bits || Description
 +
|-
 +
| 0-4 || Number of instructions the override is valid for (0x1F means infinite)
 +
|-
 +
| 5 || Crypto source/destination select
 +
0: Crypto register
 +
1: Crypto stream
 +
|-
 +
| 6 || Bypass mode
 +
0: Disabled
 +
1: Enabled
 +
|-
 +
| 7 || Internal memory select
 +
0: DMEM
 +
1: IMEM
 +
|}
 +
 
 +
Alternative name (envytools): "cx".
 +
 
 +
==== SEC ====
 +
This is a SPR (special purpose register) that holds configuration bits for the SCP authentication process.
 +
 
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-7 || Start of region to authenticate (in pages of 0x100 bytes)
 +
|-
 +
| 16 || Force secure DMA transfers
 +
|-
 +
| 17 || Decrypt region to authenticate
 +
|-
 +
| 18 || Signature check passed
 +
|-
 +
| 19 || Suppress interrupts and exceptions
 +
|-
 +
| 24-31 || Size of region to authenticate (in pages of 0x100 bytes)
 +
|}
 +
 
 +
Alternative name (envytools): "cauth".
 +
 
 +
==== CTX ====
 +
This is a SPR (special purpose register) that holds configuration bits for the CTXDMA ports.
 +
 
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-2 || CTXDMA port for code loads (xcld)
 +
|-
 +
| 4-6 || CTXDMA port for code stores (invalid)
 +
|-
 +
| 8-10 || CTXDMA port for data loads (xdld)
 +
|-
 +
| 12-14 || CTXDMA port for data stores (xdst)
 +
|}
 +
 
 +
Alternative name (envytools): "xtargets".
 +
 
 +
==== EXCI ====
 +
This is a SPR (special purpose register) that holds information on raised exceptions.
 +
 
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0-19 || Exception PC
 +
|-
 +
| 20-23 || Exception cause
 +
|}
 +
 
 +
Alternative name (envytools): "tstatus".
 +
 
 +
==== SEC1 ====
 +
Only available in Falcon v6+ CPUs, marked as "RESERVED" for v5.
 +
 
 +
==== IMB1 ====
 +
Only available in Falcon v6+ CPUs, marked as "RESERVED" for v5.
 +
 
 +
==== DMB1 ====
 +
Only available in Falcon v6+ CPUs, marked as "RESERVED" for v5.
 +
 
 +
=== Secure BootROM ===
 +
Certain Falcon CPUs may have an optional "Secure BootROM", but contrary to the common purpose of bootrom code, this doesn't execute while booting the CPU. In fact, being a microprocessor, Falcon is designed to execute user supplied code right off the bat in a clean slate state. However, Falcon can be paired with a [[#SCP|secure co-processor]] and provide a cryptosystem for any hardware block that may require it, originating what is known as a "secretful" unit.
 +
 
 +
Secretful Falcon CPUs have [[#TSEC_FALCON_HWCFG1|TSEC_FALCON_HWCFG1_SECURITY_MODEL]] set to 3, which means they support "Heavy Secure" mode (or "HS" for short). While in HS mode, the Falcon's DMEM and IMEM regions are protected from read and write operations, which effectively hides code and data from attackers.
 +
 
 +
Entering HS mode first requires uploading code marked as "secure" to Falcon, which can be done from MMIO using [[#TSEC_FALCON_IMEMC|TSEC_FALCON_IMEMC]] with the [[#TSEC_FALCON_IMEMC|TSEC_FALCON_IMEMC_SECURE]] bit set. Upon jumping to a page marked as secret, the [[#TSEC_FALCON_EXCI|INV_INS]] exception is raised which tells the Falcon to start executing the secure bootrom code.
 +
 
 +
The secure bootrom lives in a hidden ROM region, instead of IMEM, and is mapped as --x at address 0. On Falcon v5 CPUs its size is 0x367 bytes.
 +
 
 +
==== Initialization ====
 +
The first instructions of the secure bootrom simply save each [[#REG0-REG15|GPR]] to the stack and check the contents of the [[#SEC|SEC SPR]].
 +
 
 +
==== Authentication ====
 +
The main purpose of the secure bootrom is to authenticate the code pages marked as "secure". This is done by first extracting the base address and size of the region to authenticate from the [[#SEC|SEC SPR]], then calculating a signature over this region and finally comparing it to the value of the [[#SCP|SCP]] register $c6.
 +
 
 +
If the comparison is successful, bit 18 of [[#SEC|SEC SPR]] is set (which is mirrored in [[#TSEC_FALCON_SVEC_SPR|TSEC_FALCON_SVEC_SPR]]), the signature comparison result in [[#TSEC_SCP_STAT1|TSEC_SCP_STAT1]] is set to 3 and each page from the region to authenticate is marked as valid. Bit 19 of [[#SEC|SEC SPR]] is also automatically set, preventing any interrupts or exceptions from being raised while in HS mode, but contrary to bit 18 this one can be manually cleared by authenticated code.
 +
 
 +
Below is the authentication algorithm's pseudocode:
 +
<syntaxhighlight>
 +
...
 +
// This runs in a loop for each 0x100 bytes page.
 +
cs0begin 0x03
 +
cxsin $c4
 +
cenc $c3 $c5
 +
cxor $c5 $c3
 +
ckeyreg $c4
 +
cxor $c5 $c5
 +
cs0exec 0x11
 +
...
 +
// Use secret 0x01 as key and $c7 as seed.
 +
csecret $c3 1
 +
ckeyreg $c3
 +
cenc $c3 $c7
 +
ckeyreg $c3
 +
cenc $c4 $c5
 +
csigcmp $c4 $c6
 +
...
 +
</syntaxhighlight>
 +
 
 +
==== Decryption ====
 +
If bit 17 is set in the [[#SEC|SEC SPR]], the secure bootrom will additionally attempt to decrypt the region to authenticate.
 +
 
 +
Below is the decryption algorithm's pseudocode:
 +
<syntaxhighlight>
 +
...
 +
// Use secret 0x06 as key.
 +
cs0begin 0x03
 +
cxsin $c3
 +
cdec $c4 $c3
 +
cxsout $c4
 +
csecret $c5 0x06
 +
ckexp $c5 $c5
 +
cs0exec 0x10
 +
ckeyreg $c5
 +
...
 +
</syntaxhighlight>
 +
 
 +
==== Exit ====
 +
The secure bootrom finishes by restoring each [[#REG0-REG15|GPR]] from stack and returning from the exception state. This will result in the authenticated code region being executed in HS mode until the current [[#PC|PC]] points to an address outside of the authenticated region. When this happens, each page from the authenticated region is automatically marked as invalid without any involvement of the secure bootrom, meaning that the secure bootrom is only invoked when entering HS mode.
 +
 
 +
== SCP ==
 +
"SCP" (Secure Co-Processor) is a proprietary coprocessor which can be found inside every [[#Falcon|Falcon]] that supports [[#Secure BootROM|Heavy Secure Mode]]. On the Tegra X1 these are TSECA, TSECB, NVDEC and the GPU's PMU.
 +
 
 +
=== Hardware ===
 +
SCP is subdivided into several specialized hardware blocks and interfaces.
 +
 
 +
==== LOAD ====
 +
Block for handling memory reads from SCP to Falcon. It communicates with Falcon over a dedicated interface.
 +
 
 +
The interface can be enabled or disabled by register [[#TSEC_SCP_CTL0|TSEC_SCP_CTL0]].
 +
 
 +
==== STORE ====
 +
Block for handling memory writes from Falcon to SCP. It communicates with Falcon over a dedicated interface.
 +
 
 +
The interface can be enabled or disabled by register [[#TSEC_SCP_CTL0|TSEC_SCP_CTL0]].
 +
 
 +
==== CMD ====
 +
Block for translating Falcon crypto operands into SCP commands. It communicates with Falcon over a dedicated interface.
 +
 
 +
The interface can be enabled or disabled by register [[#TSEC_SCP_CTL0|TSEC_SCP_CTL0]]. The status of the current command is reported through register [[#TSEC_SCP_CMD|TSEC_SCP_CMD]].
 +
 
 +
==== SEQ ====
 +
Block for recording and executing sequences of crypto operations in the form of macros.
 +
 
 +
Can be enabled or disabled by register [[#TSEC_SCP_CTL0|TSEC_SCP_CTL0]].
 +
 
 +
==== CTL ====
 +
Overseer block for controlling certain SCP features.
 +
 
 +
Can be enabled or disabled by register [[#TSEC_SCP_CTL0|TSEC_SCP_CTL0]].
 +
 
 +
Registers [[#TSEC_SCP_CTL_STAT|TSEC_SCP_CTL_STAT]], [[#TSEC_SCP_CTL_LOCK|TSEC_SCP_CTL_LOCK]], [[#TSEC_SCP_CTL_SCP|TSEC_SCP_CTL_SCP]], [[#TSEC_SCP_CTL_PKEY|TSEC_SCP_CTL_PKEY]] and [[#TSEC_SCP_CTL_DBG|TSEC_SCP_CTL_DBG]] refer to this block.
 +
 
 +
==== AES ====
 +
Block for providing AES-128-ECB functionality.
 +
 
 +
==== RNG ====
 +
Block for encapsulating and controlling the internal random number generator.
 +
 
 +
Can be enabled or disabled by register [[#TSEC_SCP_CTL1|TSEC_SCP_CTL1]] and reports the status of the internal random number generator through registers [[#TSEC_SCP_RNG_STAT0|TSEC_SCP_RNG_STAT0]] and [[#TSEC_SCP_RNG_STAT1|TSEC_SCP_RNG_STAT1]].
 +
 
 +
===== RND =====
 +
Internal random number generator.
 +
 
 +
Can be configured by the [[#TSEC_SCP_RND_CTL0|TSEC_SCP_RND_CTLx]] registers.
 +
 
 +
=== Operations ===
 +
{| class="wikitable" border="1"
 +
!  Opcode
 +
!  Name
 +
!  Operand0
 +
!  Operand1
 +
!  Operation
 +
!  Precondition
 +
!  Postcondition
 +
|-
 +
| 0 || nop || N/A || N/A || N/A || N/A || N/A
 +
|-
 +
| 1 || mov || $cX || $cY || <code><nowiki>$cX = $cY;</nowiki></code> || N/A || <code><nowiki>ACL($cX) = ACL($cY);</nowiki></code>
 +
|-
 +
| 2 || xsin || $cX || N/A || <code><nowiki>$cX = read_from_stream();</nowiki></code> || N/A || <code><nowiki>ACL($cX) = is_mode_hs ? 0x3 : 0x1F;</nowiki></code>
 +
|-
 +
| 3 || xsout || $cX || N/A || <code><nowiki>write_to_stream($cX);</nowiki></code> || <code><nowiki>((is_mode_hs && (ACL($cX) & 0x2)) || (!is_mode_hs && (ACL($cX) & 0xA)))</nowiki></code> || N/A
 +
|-
 +
| 4 || [[#rnd|rnd]] || $cX || N/A || <code><nowiki>$cX = read_from_rnd();</nowiki></code> || N/A || <code><nowiki>ACL($cX) = is_mode_hs ? 0x3 : 0x1F;</nowiki></code>
 +
|-
 +
| 5 || s0begin || immX || N/A || <code><nowiki>record_macro_for_N_instructions(0, immX);</nowiki></code>|| N/A || N/A
 +
|-
 +
| 6 || s0exec || immX || N/A || <code><nowiki>execute_macro_N_times(0, immX);</nowiki></code> || N/A || N/A
 +
|-
 +
| 7 || s1begin || immX || N/A || <code><nowiki>record_macro_for_N_instructions(1, immX);</nowiki></code> || N/A || N/A
 +
|-
 +
| 8 || s1exec || immX || N/A || <code><nowiki>execute_macro_N_times(1, immX);</nowiki></code> || N/A || N/A
 +
|-
 +
| 9 || <invalid> || N/A || N/A || N/A || N/A || N/A
 +
|-
 +
| 0xA || [[#chmod|chmod]] || $cX || immY || <code><nowiki>ACL($cX) = immY;</nowiki></code> || See [[#ACLs|ACLs]] || N/A
 +
|-
 +
| 0xB || xor || $cX || $cY || <code><nowiki>$cX ^= $cY;</nowiki></code> || <code><nowiki>((is_mode_hs && (ACL($cX) & 0x2) && (ACL($cY) & 0x2)) || (!is_mode_hs && (ACL($cX) & 0x1A) && (ACL($cY) & 0xA)))</nowiki></code> || <code><nowiki>ACL($cX) = ACL($cY);</nowiki></code>
 +
|-
 +
| 0xC || add || $cX || immY || <code><nowiki>$cX += immY;</nowiki></code> || <code><nowiki>((is_mode_hs && (ACL($cX) & 0x2)) || (!is_mode_hs && (ACL($cX) & 0x1A)))</nowiki></code> || N/A
 +
|-
 +
| 0xD || and || $cX || $cY || <code><nowiki>$cX &= $cY;</nowiki></code> || <code><nowiki>((is_mode_hs && (ACL($cX) & 0x2) && (ACL($cY) & 0x2)) || (!is_mode_hs && (ACL($cX) & 0x1A) && (ACL($cY) & 0xA)))</nowiki></code> || <code><nowiki>ACL($cX) = ACL($cY);</nowiki></code>
 +
|-
 +
| 0xE || rev || $cX || $cY || <code><nowiki>$cX = endian_swap128($cY);</nowiki></code> || <code><nowiki>(is_mode_hs || (!is_mode_hs && (ACL($cX) & 0x10)))</nowiki></code> || <code><nowiki>ACL($cX) = ACL($cY);</nowiki></code>
 +
|-
 +
| 0xF || gfmul || $cX || $cY || <code><nowiki>$cX = gfmul($cY);</nowiki></code>|| <code><nowiki>((is_mode_hs && (ACL($cX) & 0x2) && (ACL($cY) & 0x2)) || (!is_mode_hs && (ACL($cX) & 0x1A) && (ACL($cY) & 0xA)))</nowiki></code> || <code><nowiki>ACL($cX) = ACL($cY);</nowiki></code>
 +
|-
 +
| 0x10 || secret || $cX || immY || <code><nowiki>$cX = load_secret(immY);</nowiki></code> || N/A || <code><nowiki>ACL($cX) = load_secret_acl(immY);</nowiki></code>
 +
|-
 +
| 0x11 || keyreg || $cX || N/A || <code><nowiki>active_key = $cX;</nowiki></code> || N/A || N/A
 +
|-
 +
| 0x12 || kexp || $cX || $cY || <code><nowiki>$cX = aes_key_expand($cY);</nowiki></code> || <code><nowiki>(is_mode_hs || (!is_mode_hs && (ACL($cX) & 0x10)))</nowiki></code> || <code><nowiki>ACL($cX) = ACL($cY);</nowiki></code>
 +
|-
 +
| 0x13 || krexp || $cX || $cY || <code><nowiki>$cX = aes_key_reverse_expand($cY);</nowiki></code> || <code><nowiki>(is_mode_hs || (!is_mode_hs && (ACL($cX) & 0x10)))</nowiki></code> || <code><nowiki>ACL($cX) = ACL($cY);</nowiki></code>
 +
|-
 +
| 0x14 || enc || $cX || $cY || <code><nowiki>$cX = aes_enc(active_key, $cY);</nowiki></code> || N/A || <code><nowiki>ACL($cX) = (ACL(active_key) & ACL($cY));</nowiki></code>
 +
|-
 +
| 0x15 || dec || $cX || $cY || <code><nowiki>$cX = aes_dec(active_key, $cY);</nowiki></code> || N/A || <code><nowiki>ACL($cX) = (ACL(active_key) & ACL($cY));</nowiki></code>
 +
|-
 +
| 0x16 || [[#sigcmp|sigcmp]] || $cX || $cY || <code><nowiki>current_sig = memcmp($cX, $cY) ? NULL : $cX;</nowiki></code> || <code><nowiki>(is_mode_secure_bootrom && (ACL($cY) & 0x2))</nowiki></code> || <code><nowiki>is_mode_hs = has_sig = (current_sig != NULL);</nowiki></code>
 +
|-
 +
| 0x17 || sigenc || $cX || $cY || <code><nowiki>$cX = aes_enc($cY, current_sig);</nowiki></code> || <code><nowiki>(is_mode_hs && has_sig)</nowiki></code> || <code><nowiki>ACL($cX) = 0x3;</nowiki></code>
 +
|-
 +
| 0x18 || [[#sigclr|sigclr]] || N/A || N/A || <code><nowiki>current_sig = NULL;</nowiki></code> || <code><nowiki>(is_mode_hs && has_sig)</nowiki></code> || <code><nowiki>has_sig = false;</nowiki></code>
 +
|}
 +
 
 +
==== rnd ====
 +
<code>00000000: f5 3c 0X 90    crnd $cX</code>
 +
 
 +
This instruction initializes a crypto register with random data.
 +
 
 +
Executing this instruction only succeeds if the RNG controller is enabled for the SCP, which requires taking the following steps:
 +
* Write 0x7FFF to [[#TSEC_SCP_RND_CTL0|TSEC_SCP_RND_CTL0]].
 +
* Write 0x3FF0000 to [[#TSEC_SCP_RND_CTL1|TSEC_SCP_RND_CTL1]].
 +
* Write 0xFF00 to [[#TSEC_SCP_RND_CTL11|TSEC_SCP_RND_CTL11]].
 +
* Write 0x1000 to [[#TSEC_SCP_CTL1|TSEC_SCP_CTL1]].
 +
 
 +
Otherwise it hangs forever.
 +
 
 +
==== chmod ====
 +
<code>00000000: f5 3c XY a8    cchmod $cY 0X</code> or <code>00000000: f5 3c XY a9    cchmod $cY 1X</code>
 +
 
 +
This instruction takes a crypto register and a 5 bit immediate value which represents the [[#ACLs|ACLs]] mask to set.
 +
 
 +
==== sigcmp ====
 +
<code>00000000: f5 3c XY d8    csigcmp $cY $cX</code>
 +
 
 +
Takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret. This instruction does not work in secure mode.
 +
 
 +
==== sigclr ====
 +
<code>00000000: f5 3c 00 e0    csigclr</code>
 +
 
 +
This instruction takes no operands and clears the saved cauth signature used by the csigenc instruction.
 +
 
 +
=== ACLs ===
 +
Each crypto register has an associated access control list with the following format:
 +
 
 +
{| class="wikitable" border="1"
 +
!  Bit
 +
!  Description
 +
|-
 +
| 0 || [[#Secure Keyable|Secure Keyable]]
 +
|-
 +
| 1 || [[#Secure Readable|Secure Readable]]
 +
|-
 +
| 2 || [[#Insecure Keyable|Insecure Keyable]]
 +
|-
 +
| 3 || [[#Insecure Readable|Insecure Readable]]
 +
|-
 +
| 4 || [[#Insecure Writeable|Insecure Writeable]]
 +
|}
 +
 
 +
On boot, every crypto register has an ACL value of 0x1F.
 +
 
 +
In HS mode, [[#STORE|STORE]] can always write to a crypto register. In NS and LS modes, [[#STORE|STORE]] can only write to a crypto register if it has the [[#Insecure Writeable|Insecure Writeable]] access mode.
 +
 
 +
In HS mode, [[#LOAD|LOAD]] can only retrieve a crypto register's value if it has the [[#Secure Readable|Secure Readable]] access mode. In NS and LS modes, [[#LOAD|LOAD]] can only retrieve a crypto register's value if it has the [[#Insecure Readable|Insecure Readable]] and [[#Secure Readable|Secure Readable]] access modes.
 +
 
 +
Loading a secret into a crypto register sets a per-secret ACL, unconditionally.
 +
 
 +
==== Secure Keyable ====
 +
Controls if a crypto register can be used as key in HS mode.
 +
 
 +
Forced set if the crypto register has [[#Secure Readable|Secure Readable]] access. Once cleared, this access mode cannot be set again.
 +
 
 +
==== Secure Readable ====
 +
Controls if a crypto register can be read in HS mode.
 +
 
 +
Once cleared, this access mode cannot be set again.
 +
 
 +
==== Insecure Keyable ====
 +
Controls if a crypto register can be used as key in NS and LS modes.
 +
 
 +
Forced set if the crypto register has [[#Secure Readable|Insecure Readable]] access. This access mode cannot be set if the crypto register doesn't have [[#Secure Keyable|Secure Keyable]] access.
 +
 
 +
==== Insecure Readable ====
 +
Controls if a crypto register can be read in NS and LS modes.
 +
 
 +
This access mode cannot be set if the crypto register doesn't have [[#Secure Keyable|Secure Readable]] access.
 +
 
 +
==== Insecure Writeable ====
 +
Controls if a crypto register can be written to in NS and LS modes.
 +
 
 +
This access mode has no effect in HS mode.
 +
 
 +
=== Secrets ===
 +
[[#Secure BootROM|Heavy Secure Mode]] has access to 64 128-bit keys which are burned at factory. These keys can be loaded using the $csecret instruction which takes the target crypto register and the key index as arguments.
 +
 
 +
Secrets are specific to each Falcon unit with the exception of secret 0x3F. This secret is effectively empty (all zeros), but is configured to be overwritten with the KFUSE private key once the KFUSE clock is enabled. The KFUSE private key is console-unique.
 +
 
 +
{| class=wikitable
 +
! Index || ACL || Description
 +
|-
 +
| 0x00 || 0x03 || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares.
 +
|-
 +
| 0x01 || 0x00 || Used by Falcon's [[#Secure BootROM|Secure BootROM]] for the signature generation algorithm.
 +
|-
 +
| 0x02 || 0x00 ||
 +
|-
 +
| 0x03 || 0x01 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
 +
|-
 +
| 0x04 || 0x00 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
 +
|-
 +
| 0x05 || 0x03 || Used by nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares.
 +
|-
 +
| 0x06 || 0x01 || Used by Falcon's [[#Secure BootROM|Secure BootROM]] as key to decrypt data during authentication (decided by bit 17 in the [[#SEC|SEC]] register).
 +
|-
 +
| 0x07 || 0x01 || Used by [6.0.0+] nvhost_tsec firmware.
 +
|-
 +
| 0x08 || 0x00 ||
 +
|-
 +
| 0x09 || 0x03 || Used by nvhost_tsec firmware.
 +
|-
 +
| 0x0A || 0x01 ||
 +
|-
 +
| 0x0B || 0x00 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
 +
|-
 +
| 0x0C || 0x03 ||
 +
|-
 +
| 0x0D || 0x01 ||
 +
|-
 +
| 0x0E || 0x00 ||
 +
|-
 +
| 0x0F || 0x03 || Used by nvhost_tsec firmware.
 +
|-
 +
| 0x10 || 0x01 || Used by [1.0.0-5.1.0] nvhost_tsec firmware.
 +
|-
 +
| 0x11 || 0x00 ||
 +
|-
 +
| 0x12 || 0x03 ||
 +
|-
 +
| 0x13 || 0x01 ||
 +
|-
 +
| 0x14 || 0x00 ||
 +
|-
 +
| 0x15 || 0x03 || Used by nvhost_nvdec_bl020_prod, [5.0.0+] nvhost_nvdec020_prod, [5.0.0+] nvhost_nvdec020_ns and [6.0.0+] nvhost_tsec firmwares.
 +
|-
 +
| 0x16 || 0x01 ||
 +
|-
 +
| 0x17 || 0x00 || Used by [11.0.0+] nvhost_tsec firmware.
 +
|-
 +
| 0x18 || 0x03 ||
 +
|-
 +
| 0x19 || 0x01 ||
 +
|-
 +
| 0x1A || 0x00 ||
 +
|-
 +
| 0x1B || 0x03 ||
 +
|-
 +
| 0x1C || 0x01 ||
 +
|-
 +
| 0x1D || 0x00 ||
 +
|-
 +
| 0x1E || 0x03 ||
 +
|-
 +
| 0x1F || 0x01 ||
 +
|-
 +
| 0x20 || 0x00 ||
 +
|-
 +
| 0x21 || 0x03 ||
 +
|-
 +
| 0x22 || 0x01 ||
 +
|-
 +
| 0x23 || 0x00 ||
 
|-
 
|-
−
| 0x00
+
| 0x24 || 0x03 ||
−
| 0x10
 
−
| Debug key (empty)
 
 
|-
 
|-
−
| 0x10
+
| 0x25 || 0x01 ||
−
| 0x10
 
−
| blob0 ([[#Boot|Boot]]) auth hash
 
 
|-
 
|-
−
| 0x20
+
| 0x26 || 0x00 || Used by [[TSEC_Firmware#KeygenLdr|KeygenLdr]] and [[TSEC_Firmware#SecureBoot|SecureBoot]]
−
| 0x10
 
−
| blob1 ([[#KeygenLdr|KeygenLdr]]) auth hash
 
 
|-
 
|-
−
| 0x30
+
| 0x27 || 0x03 ||
−
| 0x10
 
−
| blob2 ([[#Keygen|Keygen]]) auth hash
 
 
|-
 
|-
−
| 0x40
+
| 0x28 || 0x01 ||
−
| 0x10
 
−
| blob2 ([[#Keygen|Keygen]]) AES IV
 
 
|-
 
|-
−
| 0x50
+
| 0x29 || 0x00 ||
−
| 0x10
 
−
| HOVI EKS seed
 
 
|-
 
|-
−
| 0x60
+
| 0x2A || 0x03 ||
−
| 0x10
 
−
| HOVI COMMON seed
 
 
|-
 
|-
−
| 0x70
+
| 0x2B || 0x01 ||
−
| 0x04
 
−
| blob0 ([[#Boot|Boot]]) size
 
 
|-
 
|-
−
| 0x74
+
| 0x2C || 0x00 ||
−
| 0x04
 
−
| blob1 ([[#KeygenLdr|KeygenLdr]]) size
 
 
|-
 
|-
−
| 0x78
+
| 0x2D || 0x03 ||
−
| 0x04
 
−
| blob2 ([[#Keygen|Keygen]]) size
 
 
|-
 
|-
−
| 0x7C
+
| 0x2E || 0x01 ||
−
| 0x04
 
−
| [6.2.0+] blob3 ([[#Loader|Loader]]) size
 
 
|-
 
|-
−
| 0x80
+
| 0x2F || 0x00 ||
−
| 0x04
 
−
| [6.2.0+] blob4 ([[#Payload|Payload]]) size
 
−
|}
 
−
 
 
−
== Notes ==
 
−
[https://wiki.0x04.net/wiki/Marcin_Ko%C5%9Bcielnicki mwk] shared additional info learned from RE of falcon processors over the years, which hasn't made it into envytools documentation yet:
 
−
 
 
−
=== cxset ===
 
−
cxset instruction provides a way to change behavior of a variable amount of successively executed DMA-related instructions.
 
−
 
 
−
for example: <code>000000de: f4 3c 02              cxset 0x2</code>
 
−
 
 
−
can be read as: <code>dma_override(type=crypto_reg, count=2)</code>
 
−
 
 
−
The argument to cxset specifies the type of behavior change in the top 3 bits, and the number of DMA-related instructions the effect lasts for in the lower 5 bits.
 
−
 
 
−
==== Override Types ====
 
−
Unlisted values are unknown, but probably do something.
 
−
 
 
−
{| class=wikitable
 
−
! Value || Effect
 
 
|-
 
|-
−
| 0b000 || falcon data mem <-> falcon $cX register
+
| 0x30 || 0x03 ||
 
|-
 
|-
−
| 0b001 || external mem <-> crypto input/output stream
+
| 0x31 || 0x01 ||
 
|-
 
|-
−
| 0b011 || falcon data mem <-> crypto input/output stream
+
| 0x32 || 0x00 ||
 
|-
 
|-
−
| 0b100 || unknown, but can be combined with other types
+
| 0x33 || 0x03 ||
−
|}
 
−
 
 
−
==== DMA-Related Instructions ====
 
−
At least the following instructions may have changed behavior, and count against the cxset "count" argument: <code>xdwait</code>, <code>xdst</code>, <code>xdld</code>.
 
−
 
 
−
For example, if override type=0b000, then the "length" argument to <code>xdst</code> is instead treated as the index of the target $cX register.
 
−
 
 
−
=== Register ACLs ===
 
−
Falcon tracks permission metadata about each crypto reg. Permissions include read/write ability per execution mode, as well as ability to use the reg for encrypt/decrypt, among other permissions. Permissions are propagated when registers are referenced by instructions (e.g. moving a value from read-protected $cX to $cY will result in $cY also being read-protected).
 
−
 
 
−
=== Authenticated Mode Entry/Exit ===
 
−
Entry to Authenticated Mode always sets $pc to the address supplied in $cauth (ie the base of the signature-checked region). This takes effect when trying to branch to any address within the range covered by $cauth. Entry to Authenticated Mode (also called "Secure Mode") computes a MAC over the $cauth region and compares it to $c6 in order to perform the signature check.
 
−
 
 
−
Exit from Authenticated Mode must poke a special register before leaving authenticated code pages and a failure to do this would result in the Falcon core halting. Every Falcon based unit (TSEC, NVDEC, VIC) must map this register in their engine-specific subset of registers. In TSEC's case, the register is TSEC_SCP_CTL_AUTH_MODE.
 
−
 
 
−
=== Unknown Instructions ===
 
−
<code>00000000: f5 3c XY e0    cchmod $cY $cX</code> - likely forces a change of permissions.
 
−
 
 
−
<code>00000000: f5 3c XY a8    c_unk0 $cY $cX</code> - unknown crypto operation.
 
−
 
 
−
<code>00000000: f5 3c XY a9    c_unk1 $cY $cX</code> - unknown crypto operation.
 
−
 
 
−
<code>00000000: f5 3c 0X 90    crng $cX</code> - seems to initialize a crypto register with random data.
 
−
 
 
−
=== Secrets ===
 
−
Falcon's Authenticated Mode has access to 64 128-bit keys which are burned at factory. These keys can be loaded by using the $csecret instruction which takes the target crypto register and the key index as arguments.
 
−
 
 
−
{| class=wikitable
 
−
! Index || Notes
 
 
|-
 
|-
−
| 0x00 || Used by the nvhost_tsec firmware. Debug mode only.
+
| 0x34 || 0x01 ||
 
|-
 
|-
−
| 0x03 || Used by the nvhost_tsec firmware.
+
| 0x35 || 0x00 ||
 
|-
 
|-
−
| 0x04 || Used by the nvhost_tsec firmware.
+
| 0x36 || 0x03 ||
 
|-
 
|-
−
| 0x05 || Used by the nvhost_tsec firmware.
+
| 0x37 || 0x01 ||
 
|-
 
|-
−
| 0x07 || Used by the nvhost_tsec firmware.
+
| 0x38 || 0x00 ||
 
|-
 
|-
−
| 0x09 || Used by the nvhost_tsec firmware.
+
| 0x39 || 0x03 ||
 
|-
 
|-
−
| 0x0B || Used by the nvhost_tsec firmware.
+
| 0x3A || 0x01 ||
 
|-
 
|-
−
| 0x0F || Used by the nvhost_tsec firmware.
+
| 0x3B || 0x00 ||
 
|-
 
|-
−
| 0x15 || Used by the nvhost_tsec firmware.
+
| 0x3C || 0x03 || Used by nvhost_tsec firmware.
 
|-
 
|-
−
| 0x26 || Used by [[#KeygenLdr|KeygenLdr]].
+
| 0x3D || 0x01 ||
 
|-
 
|-
−
| 0x3C || Used by the nvhost_tsec firmware.
+
| 0x3E || 0x00 ||
 
|-
 
|-
−
| 0x3F || Used by the nvhost_tsec firmware. Potentially per-console.
+
| 0x3F || 0x00 || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
 
|}
 
|}

Latest revision as of 21:34, 24 September 2022

TSEC (Tegra Security Co-processor) is a dedicated unit powered by a NVIDIA Falcon microprocessor with crypto extensions.

Driver

A host driver for communicating with the TSEC is mapped to physical address 0x54500000 with a total size of 0x40000 bytes and exposes several registers.

Registers

The TSEC's MMIO space is divided as follows:

  • 0x54500000 to 0x54501000: THI (Tegra Host Interface)
  • 0x54501000 to 0x54501400: FALCON (Falcon microcontroller)
  • 0x54501400 to 0x54501600: SCP (Secure coprocessor)
  • 0x54501600 to 0x54501680: TFBIF (Tegra Framebuffer Interface)
  • 0x54501680 to 0x54501700: CG (Clock Gate)
  • 0x54501700 to 0x54501800: BAR0 (HOST1X device DMA)
  • 0x54501800 to 0x54501900: TEGRA (Miscellaneous interfaces)
Name Address Width
TSEC_THI_INCR_SYNCPT 0x54500000 0x04
TSEC_THI_INCR_SYNCPT_CTRL 0x54500004 0x04
TSEC_THI_INCR_SYNCPT_ERR 0x54500008 0x04
TSEC_THI_CTXSW_INCR_SYNCPT 0x5450000C 0x04
TSEC_THI_CTXSW 0x54500020 0x04
TSEC_THI_CTXSW_NEXT 0x54500024 0x04
TSEC_THI_CONT_SYNCPT_EOF 0x54500028 0x04
TSEC_THI_CONT_SYNCPT_L1 0x5450002C 0x04
TSEC_THI_METHOD0 0x54500040 0x04
TSEC_THI_METHOD1 0x54500044 0x04
TSEC_THI_CONTEXT_SWITCH 0x54500060 0x04
TSEC_THI_INT_STATUS 0x54500078 0x04
TSEC_THI_INT_MASK 0x5450007C 0x04
TSEC_THI_CONFIG0 0x54500080 0x04
TSEC_THI_DBG_MISC 0x54500084 0x04
TSEC_THI_SLCG_OVERRIDE_HIGH_A 0x54500088 0x04
TSEC_THI_SLCG_OVERRIDE_LOW_A 0x5450008C 0x04
TSEC_THI_CLK_OVERRIDE 0x54500E00 0x04
TSEC_FALCON_IRQSSET 0x54501000 0x04
TSEC_FALCON_IRQSCLR 0x54501004 0x04
TSEC_FALCON_IRQSTAT 0x54501008 0x04
TSEC_FALCON_IRQMODE 0x5450100C 0x04
TSEC_FALCON_IRQMSET 0x54501010 0x04
TSEC_FALCON_IRQMCLR 0x54501014 0x04
TSEC_FALCON_IRQMASK 0x54501018 0x04
TSEC_FALCON_IRQDEST 0x5450101C 0x04
TSEC_FALCON_GPTMRINT 0x54501020 0x04
TSEC_FALCON_GPTMRVAL 0x54501024 0x04
TSEC_FALCON_GPTMRCTL 0x54501028 0x04
TSEC_FALCON_PTIMER0 0x5450102C 0x04
TSEC_FALCON_PTIMER1 0x54501030 0x04
TSEC_FALCON_WDTMRVAL 0x54501034 0x04
TSEC_FALCON_WDTMRCTL 0x54501038 0x04
TSEC_FALCON_IRQDEST2 0x5450103C 0x04
TSEC_FALCON_MAILBOX0 0x54501040 0x04
TSEC_FALCON_MAILBOX1 0x54501044 0x04
TSEC_FALCON_ITFEN 0x54501048 0x04
TSEC_FALCON_IDLESTATE 0x5450104C 0x04
TSEC_FALCON_CURCTX 0x54501050 0x04
TSEC_FALCON_NXTCTX 0x54501054 0x04
TSEC_FALCON_CTXACK 0x54501058 0x04
TSEC_FALCON_FHSTATE 0x5450105C 0x04
TSEC_FALCON_PRIVSTATE 0x54501060 0x04
TSEC_FALCON_MTHDDATA 0x54501064 0x04
TSEC_FALCON_MTHDID 0x54501068 0x04
TSEC_FALCON_MTHDWDAT 0x5450106C 0x04
TSEC_FALCON_MTHDCOUNT 0x54501070 0x04
TSEC_FALCON_MTHDPOP 0x54501074 0x04
TSEC_FALCON_MTHDRAMSZ 0x54501078 0x04
TSEC_FALCON_SFTRESET 0x5450107C 0x04
TSEC_FALCON_OS 0x54501080 0x04
TSEC_FALCON_RM 0x54501084 0x04
TSEC_FALCON_SOFT_PM 0x54501088 0x04
TSEC_FALCON_SOFT_MODE 0x5450108C 0x04
TSEC_FALCON_DEBUG1 0x54501090 0x04
TSEC_FALCON_DEBUGINFO 0x54501094 0x04
TSEC_FALCON_IBRKPT1 0x54501098 0x04
TSEC_FALCON_IBRKPT2 0x5450109C 0x04
TSEC_FALCON_CGCTL 0x545010A0 0x04
TSEC_FALCON_ENGCTL 0x545010A4 0x04
TSEC_FALCON_PMM 0x545010A8 0x04
TSEC_FALCON_ADDR 0x545010AC 0x04
TSEC_FALCON_IBRKPT3 0x545010B0 0x04
TSEC_FALCON_IBRKPT4 0x545010B4 0x04
TSEC_FALCON_IBRKPT5 0x545010B8 0x04
TSEC_FALCON_EXCI 0x545010D0 0x04
TSEC_FALCON_SVEC_SPR 0x545010D4 0x04
TSEC_FALCON_RSTAT0 0x545010D8 0x04
TSEC_FALCON_RSTAT3 0x545010DC 0x04
TSEC_FALCON_SIRQMASK 0x545010E0 0x04
TSEC_FALCON_CPUCTL 0x54501100 0x04
TSEC_FALCON_BOOTVEC 0x54501104 0x04
TSEC_FALCON_HWCFG 0x54501108 0x04
TSEC_FALCON_DMACTL 0x5450110C 0x04
TSEC_FALCON_DMATRFBASE 0x54501110 0x04
TSEC_FALCON_DMATRFMOFFS 0x54501114 0x04
TSEC_FALCON_DMATRFCMD 0x54501118 0x04
TSEC_FALCON_DMATRFFBOFFS 0x5450111C 0x04
TSEC_FALCON_DMAPOLL_FB 0x54501120 0x04
TSEC_FALCON_DMAPOLL_CP 0x54501124 0x04
TSEC_FALCON_HWCFG1 0x5450112C 0x04
TSEC_FALCON_CPUCTL_ALIAS 0x54501130 0x04
TSEC_FALCON_STACKCFG 0x54501138 0x04
TSEC_FALCON_IMCTL 0x54501140 0x04
TSEC_FALCON_IMSTAT 0x54501144 0x04
TSEC_FALCON_TRACEIDX 0x54501148 0x04
TSEC_FALCON_TRACEPC 0x5450114C 0x04
TSEC_FALCON_IMFILLRNG0 0x54501150 0x04
TSEC_FALCON_IMFILLRNG1 0x54501154 0x04
TSEC_FALCON_IMFILLCTL 0x54501158 0x04
TSEC_FALCON_IMCTL_DEBUG 0x5450115C 0x04
TSEC_FALCON_CMEMBASE 0x54501160 0x04
TSEC_FALCON_DMEMAPERT 0x54501164 0x04
TSEC_FALCON_EXTERRADDR 0x54501168 0x04
TSEC_FALCON_EXTERRSTAT 0x5450116C 0x04
TSEC_FALCON_CG2 0x5450117C 0x04
TSEC_FALCON_IMEMC0 0x54501180 0x04
TSEC_FALCON_IMEMD0 0x54501184 0x04
TSEC_FALCON_IMEMT0 0x54501188 0x04
TSEC_FALCON_IMEMC1 0x54501190 0x04
TSEC_FALCON_IMEMD1 0x54501194 0x04
TSEC_FALCON_IMEMT1 0x54501198 0x04
TSEC_FALCON_IMEMC2 0x545011A0 0x04
TSEC_FALCON_IMEMD2 0x545011A4 0x04
TSEC_FALCON_IMEMT2 0x545011A8 0x04
TSEC_FALCON_IMEMC3 0x545011B0 0x04
TSEC_FALCON_IMEMD3 0x545011B4 0x04
TSEC_FALCON_IMEMT3 0x545011B8 0x04
TSEC_FALCON_DMEMC0 0x545011C0 0x04
TSEC_FALCON_DMEMD0 0x545011C4 0x04
TSEC_FALCON_DMEMC1 0x545011C8 0x04
TSEC_FALCON_DMEMD1 0x545011CC 0x04
TSEC_FALCON_DMEMC2 0x545011D0 0x04
TSEC_FALCON_DMEMD2 0x545011D4 0x04
TSEC_FALCON_DMEMC3 0x545011D8 0x04
TSEC_FALCON_DMEMD3 0x545011DC 0x04
TSEC_FALCON_DMEMC4 0x545011E0 0x04
TSEC_FALCON_DMEMD4 0x545011E4 0x04
TSEC_FALCON_DMEMC5 0x545011E8 0x04
TSEC_FALCON_DMEMD5 0x545011EC 0x04
TSEC_FALCON_DMEMC6 0x545011F0 0x04
TSEC_FALCON_DMEMD6 0x545011F4 0x04
TSEC_FALCON_DMEMC7 0x545011F8 0x04
TSEC_FALCON_DMEMD7 0x545011FC 0x04
TSEC_FALCON_ICD_CMD 0x54501200 0x04
TSEC_FALCON_ICD_ADDR 0x54501204 0x04
TSEC_FALCON_ICD_WDATA 0x54501208 0x04
TSEC_FALCON_ICD_RDATA 0x5450120C 0x04
TSEC_FALCON_SCTL 0x54501240 0x04
TSEC_FALCON_SERRSTAT 0x54501244 0x04
TSEC_FALCON_SERRVAL 0x54501248 0x04
TSEC_FALCON_SERRADDR 0x5450124C 0x04
TSEC_FALCON_SCTL1 0x54501250 0x04
TSEC_FALCON_STEST 0x54501258 0x04
TSEC_FALCON_SICD 0x54501260 0x04
TSEC_FALCON_SPROT_IMEM 0x54501280 0x04
TSEC_FALCON_SPROT_DMEM 0x54501284 0x04
TSEC_FALCON_SPROT_CPUCTL 0x54501288 0x04
TSEC_FALCON_SPROT_MISC 0x5450128C 0x04
TSEC_FALCON_SPROT_IRQ 0x54501290 0x04
TSEC_FALCON_SPROT_MTHD 0x54501294 0x04
TSEC_FALCON_SPROT_SCTL 0x54501298 0x04
TSEC_FALCON_SPROT_WDTMR 0x5450129C 0x04
TSEC_FALCON_DMAINFO_FINISHED_FBRD_LOW 0x545012C0 0x04
TSEC_FALCON_DMAINFO_FINISHED_FBRD_HIGH 0x545012C4 0x04
TSEC_FALCON_DMAINFO_FINISHED_FBWR_LOW 0x545012C8 0x04
TSEC_FALCON_DMAINFO_FINISHED_FBWR_HIGH 0x545012CC 0x04
TSEC_FALCON_DMAINFO_CURRENT_FBRD_LOW 0x545012D0 0x04
TSEC_FALCON_DMAINFO_CURRENT_FBRD_HIGH 0x545012D4 0x04
TSEC_FALCON_DMAINFO_CURRENT_FBWR_LOW 0x545012D8 0x04
TSEC_FALCON_DMAINFO_CURRENT_FBWR_HIGH 0x545012DC 0x04
TSEC_FALCON_DMAINFO_CTL 0x545012E0 0x04
TSEC_SCP_CTL0 0x54501400 0x04
TSEC_SCP_CTL1 0x54501404 0x04
TSEC_SCP_CTL_STAT 0x54501408 0x04
TSEC_SCP_CTL_LOCK 0x5450140C 0x04
TSEC_SCP_CFG 0x54501410 0x04
TSEC_SCP_CTL_SCP 0x54501414 0x04
TSEC_SCP_CTL_PKEY 0x54501418 0x04
TSEC_SCP_CTL_DBG 0x5450141C 0x04
TSEC_SCP_DBG0 0x54501420 0x04
TSEC_SCP_DBG1 0x54501424 0x04
TSEC_SCP_DBG2 0x54501428 0x04
TSEC_SCP_CMD 0x54501430 0x04
TSEC_SCP_STAT0 0x54501450 0x04
TSEC_SCP_STAT1 0x54501454 0x04
TSEC_SCP_STAT2 0x54501458 0x04
TSEC_SCP_RNG_STAT0 0x54501470 0x04
TSEC_SCP_RNG_STAT1 0x54501474 0x04
TSEC_SCP_IRQSTAT 0x54501480 0x04
TSEC_SCP_IRQMASK 0x54501484 0x04
TSEC_SCP_ACL_ERR 0x54501490 0x04
TSEC_SCP_SEC_ERR 0x54501494 0x04
TSEC_SCP_CMD_ERR 0x54501498 0x04
TSEC_SCP_RND_CTL0 0x54501500 0x04
TSEC_SCP_RND_CTL1 0x54501504 0x04
TSEC_SCP_RND_CTL2 0x54501508 0x04
TSEC_SCP_RND_CTL3 0x5450150C 0x04
TSEC_SCP_RND_CTL4 0x54501510 0x04
TSEC_SCP_RND_CTL5 0x54501514 0x04
TSEC_SCP_RND_CTL6 0x54501518 0x04
TSEC_SCP_RND_CTL7 0x5450151C 0x04
TSEC_SCP_RND_CTL8 0x54501520 0x04
TSEC_SCP_RND_CTL9 0x54501524 0x04
TSEC_SCP_RND_CTL10 0x54501528 0x04
TSEC_SCP_RND_CTL11 0x5450152C 0x04
TSEC_TFBIF_CTL 0x54501600 0x04
TSEC_TFBIF_MCCIF_FIFOCTRL 0x54501604 0x04
TSEC_TFBIF_THROTTLE 0x54501608 0x04
TSEC_TFBIF_DBG_STAT0 0x5450160C 0x04
TSEC_TFBIF_DBG_STAT1 0x54501610 0x04
TSEC_TFBIF_DBG_RDCOUNT_LO 0x54501614 0x04
TSEC_TFBIF_DBG_RDCOUNT_HI 0x54501618 0x04
TSEC_TFBIF_DBG_WRCOUNT_LO 0x5450161C 0x04
TSEC_TFBIF_DBG_WRCOUNT_HI 0x54501620 0x04
TSEC_TFBIF_DBG_R32COUNT 0x54501624 0x04
TSEC_TFBIF_DBG_R64COUNT 0x54501628 0x04
TSEC_TFBIF_DBG_R128COUNT 0x5450162C 0x04
TSEC_TFBIF_MCCIF_FIFOCTRL1 0x54501634 0x04
TSEC_TFBIF_SPROT_EMEM 0x54501640 0x04
TSEC_TFBIF_TRANSCFG 0x54501644 0x04
TSEC_TFBIF_REGIONCFG 0x54501648 0x04
TSEC_CG 0x545016D0 0x04
TSEC_BAR0_CTL 0x54501700 0x04
TSEC_BAR0_ADDR 0x54501704 0x04
TSEC_BAR0_DATA 0x54501708 0x04
TSEC_BAR0_TIMEOUT 0x5450170C 0x04
TSEC_VERSION 0x54501800 0x04
TSEC_SCRATCH0 0x54501804 0x04
TSEC_SCRATCH1 0x54501808 0x04
TSEC_SCRATCH2 0x5450180C 0x04
TSEC_SCRATCH3 0x54501810 0x04
TSEC_SCRATCH4 0x54501814 0x04
TSEC_SCRATCH5 0x54501818 0x04
TSEC_SCRATCH6 0x5450181C 0x04
TSEC_SCRATCH7 0x54501820 0x04
TSEC_GPTMRINT 0x54501824 0x04
TSEC_GPTMRVAL 0x54501828 0x04
TSEC_GPTMRCTL 0x5450182C 0x04
TSEC_ITFEN 0x54501830 0x04
TSEC_ITFSTAT 0x54501834 0x04
TSEC_TEGRA_CTL 0x54501838 0x04

TSEC_THI_INCR_SYNCPT

Bits Description
0-9 TSEC_THI_INCR_SYNCPT_INDX
10-17 TSEC_THI_INCR_SYNCPT_COND

TSEC_THI_INCR_SYNCPT_CTRL

Bits Description
0 TSEC_THI_INCR_SYNCPT_CTRL_SOFT_RESET
8 TSEC_THI_INCR_SYNCPT_CTRL_NO_STALL
16 TSEC_THI_INCR_SYNCPT_CTRL_SOFT_RESET_0
17 TSEC_THI_INCR_SYNCPT_CTRL_NO_STALL_0
18 TSEC_THI_INCR_SYNCPT_CTRL_SOFT_RESET_1
19 TSEC_THI_INCR_SYNCPT_CTRL_NO_STALL_1
20 TSEC_THI_INCR_SYNCPT_CTRL_SOFT_RESET_2
21 TSEC_THI_INCR_SYNCPT_CTRL_NO_STALL_2
22 TSEC_THI_INCR_SYNCPT_CTRL_SOFT_RESET_3
23 TSEC_THI_INCR_SYNCPT_CTRL_NO_STALL_3
24 TSEC_THI_INCR_SYNCPT_CTRL_SOFT_RESET_4
25 TSEC_THI_INCR_SYNCPT_CTRL_NO_STALL_4

TSEC_THI_INCR_SYNCPT_ERR

Bits Description
0 TSEC_THI_INCR_SYNCPT_ERR_COND_STS_IMM
1 TSEC_THI_INCR_SYNCPT_ERR_COND_STS_OPDONE
2 TSEC_THI_INCR_SYNCPT_ERR_COND_STS_RD_DONE
3 TSEC_THI_INCR_SYNCPT_ERR_COND_STS_REG_WR_SAFE
4 TSEC_THI_INCR_SYNCPT_ERR_COND_STS_ENGINE_IDLE

TSEC_THI_CTXSW_INCR_SYNCPT

Bits Description
0-9 TSEC_THI_CTXSW_INCR_SYNCPT_INDX

TSEC_THI_CTXSW

Bits Description
0-9 TSEC_THI_CTXSW_CURR_CLASS
10 TSEC_THI_CTXSW_AUTO_ACK
11-20 TSEC_THI_CTXSW_CURR_CHANNEL

TSEC_THI_CTXSW_NEXT

Bits Description
0-9 TSEC_THI_CTXSW_NEXT_NEXT_CLASS
10-19 TSEC_THI_CTXSW_NEXT_NEXT_CHANNEL

TSEC_THI_CONT_SYNCPT_EOF

Bits Description
0-9 TSEC_THI_CONT_SYNCPT_EOF_INDEX
10 TSEC_THI_CONT_SYNCPT_EOF_COND

TSEC_THI_CONT_SYNCPT_L1

Bits Description
0-9 TSEC_THI_CONT_SYNCPT_L1_INDEX
10 TSEC_THI_CONT_SYNCPT_L1_COND

TSEC_THI_METHOD0

Bits Description
0-11 TSEC_THI_METHOD0_OFFSET

Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

The following methods are available:

ID Method
0x100 NOP
0x140 PM_TRIGGER
0x200 SET_APPLICATION_ID
0x204 SET_WATCHDOG_TIMER
0x240 SEMAPHORE_A
0x244 SEMAPHORE_B
0x248 SEMAPHORE_C
0x24C CTX_SAVE_AREA
0x250 CTX_SWITCH
0x300 EXECUTE
0x304 SEMAPHORE_D
0x500 HDCP_INIT
0x504 HDCP_CREATE_SESSION
0x508 HDCP_VERIFY_CERT_RX
0x50C HDCP_GENERATE_EKM
0x510 HDCP_REVOCATION_CHECK
0x514 HDCP_VERIFY_HPRIME
0x518 HDCP_ENCRYPT_PAIRING_INFO
0x51C HDCP_DECRYPT_PAIRING_INFO
0x520 HDCP_UPDATE_SESSION
0x524 HDCP_GENERATE_LC_INIT
0x528 HDCP_VERIFY_LPRIME
0x52C HDCP_GENERATE_SKE_INIT
0x530 HDCP_VERIFY_VPRIME
0x534 HDCP_ENCRYPTION_RUN_CTRL
0x538 HDCP_SESSION_CTRL
0x53C HDCP_COMPUTE_SPRIME
0x540 HDCP_GET_CERT_RX
0x544 HDCP_EXCHANGE_INFO
0x548 HDCP_DECRYPT_KM
0x54C HDCP_GET_HPRIME
0x550 HDCP_GENERATE_EKH_KM
0x554 HDCP_VERIFY_RTT_CHALLENGE
0x558 HDCP_GET_LPRIME
0x55C HDCP_DECRYPT_KS
0x560 HDCP_DECRYPT
0x564 HDCP_GET_RRX
0x568 HDCP_DECRYPT_REENCRYPT
0x56C
0x570
0x574 HDCP_DECRYPT_STORED_KM
0x578 HDCP_GET_CURRENT_RESOLUTION
0x57C HDCP_GET_CURRENT_VERSION
0x700 HDCP_VALIDATE_SRM
0x704 HDCP_VALIDATE_STREAM
0x708 HDCP_TEST_SECURE_STATUS
0x70C HDCP_SET_DCP_KPUB
0x710 HDCP_SET_RX_KPUB
0x714 HDCP_SET_CERT_RX
0x718 HDCP_SET_SCRATCH_BUFFER
0x71C HDCP_SET_SRM
0x720 HDCP_SET_RECEIVER_ID_LIST
0x724 HDCP_SET_SPRIME
0x728 HDCP_SET_ENC_INPUT_BUFFER
0x72C HDCP_SET_ENC_OUTPUT_BUFFER
0x730 HDCP_GET_RTT_CHALLENGE
0x734 HDCP_STREAM_MANAGE
0x738 HDCP_READ_CAPS
0x73C HDCP_ENCRYPT
0x740 [6.0.0+] HDCP_GET_CURRENT_NONCE
0x1114 PM_TRIGGER_END

TSEC_THI_METHOD1

Bits Description
0-31 TSEC_THI_METHOD1_DATA

Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

TSEC_THI_CONTEXT_SWITCH

Bits Description
0-27 TSEC_THI_CONTEXT_SWITCH_PTR
30-31 TSEC_THI_CONTEXT_SWITCH_TARGET

TSEC_THI_INT_STATUS

Bits Description
0 TSEC_THI_INT_STATUS_FALCON_INT

TSEC_THI_INT_MASK

Bits Description
0 TSEC_THI_INT_MASK_FALCON_INT

TSEC_THI_CONFIG0

Bits Description
0 TSEC_THI_CONFIG0_RETURN_SYNCPT_ON_ERR
4 TSEC_THI_CONFIG0_IDLE_SYNCPT_INC_ENG

TSEC_THI_DBG_MISC

Bits Description
0 TSEC_THI_DBG_MISC_CLIENT_IDLE_STATUS
1 TSEC_THI_DBG_MISC_THI_IDLE_STATUS
2 TSEC_THI_DBG_MISC_THI_SYNCPT_PENDING_STATUS
3 TSEC_THI_DBG_MISC_THI_IDLE_EN

TSEC_THI_SLCG_OVERRIDE_HIGH_A

Bits Description
0-7 TSEC_THI_SLCG_OVERRIDE_HIGH_A_REG

TSEC_THI_SLCG_OVERRIDE_LOW_A

Bits Description
0-31 TSEC_THI_SLCG_OVERRIDE_LOW_A_REG

TSEC_THI_CLK_OVERRIDE

Bits Description
0-31 TSEC_THI_CLK_OVERRIDE_CYA

TSEC_FALCON_IRQSSET

Bits Description
0 TSEC_FALCON_IRQSSET_GPTMR
1 TSEC_FALCON_IRQSSET_WDTMR
2 TSEC_FALCON_IRQSSET_MTHD
3 TSEC_FALCON_IRQSSET_CTXSW
4 TSEC_FALCON_IRQSSET_HALT
5 TSEC_FALCON_IRQSSET_EXTERR
6 TSEC_FALCON_IRQSSET_SWGEN0
7 TSEC_FALCON_IRQSSET_SWGEN1
8-15 TSEC_FALCON_IRQSSET_EXT
16 TSEC_FALCON_IRQSSET_DMA

Used for setting Falcon's IRQs.

TSEC_FALCON_IRQSCLR

Bits Description
0 TSEC_FALCON_IRQSCLR_GPTMR
1 TSEC_FALCON_IRQSCLR_WDTMR
2 TSEC_FALCON_IRQSCLR_MTHD
3 TSEC_FALCON_IRQSCLR_CTXSW
4 TSEC_FALCON_IRQSCLR_HALT
5 TSEC_FALCON_IRQSCLR_EXTERR
6 TSEC_FALCON_IRQSCLR_SWGEN0
7 TSEC_FALCON_IRQSCLR_SWGEN1
8-15 TSEC_FALCON_IRQSCLR_EXT
16 TSEC_FALCON_IRQSCLR_DMA

Used for clearing Falcon's IRQs.

TSEC_FALCON_IRQSTAT

Bits Description
0 TSEC_FALCON_IRQSTAT_GPTMR
1 TSEC_FALCON_IRQSTAT_WDTMR
2 TSEC_FALCON_IRQSTAT_MTHD
3 TSEC_FALCON_IRQSTAT_CTXSW
4 TSEC_FALCON_IRQSTAT_HALT
5 TSEC_FALCON_IRQSTAT_EXTERR
6 TSEC_FALCON_IRQSTAT_SWGEN0
7 TSEC_FALCON_IRQSTAT_SWGEN1
8-15 TSEC_FALCON_IRQSTAT_EXT
16 TSEC_FALCON_IRQSTAT_DMA

Used for getting the status of Falcon's IRQs.

TSEC_FALCON_IRQMODE

Bits Description
0 TSEC_FALCON_IRQMODE_LVL_GPTMR
1 TSEC_FALCON_IRQMODE_LVL_WDTMR
2 TSEC_FALCON_IRQMODE_LVL_MTHD
3 TSEC_FALCON_IRQMODE_LVL_CTXSW
4 TSEC_FALCON_IRQMODE_LVL_HALT
5 TSEC_FALCON_IRQMODE_LVL_EXTERR
6 TSEC_FALCON_IRQMODE_LVL_SWGEN0
7 TSEC_FALCON_IRQMODE_LVL_SWGEN1
8-15 TSEC_FALCON_IRQMODE_LVL_EXT
16 TSEC_FALCON_IRQMODE_LVL_DMA

Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.

TSEC_FALCON_IRQMSET

Bits Description
0 TSEC_FALCON_IRQMSET_GPTMR
1 TSEC_FALCON_IRQMSET_WDTMR
2 TSEC_FALCON_IRQMSET_MTHD
3 TSEC_FALCON_IRQMSET_CTXSW
4 TSEC_FALCON_IRQMSET_HALT
5 TSEC_FALCON_IRQMSET_EXTERR
6 TSEC_FALCON_IRQMSET_SWGEN0
7 TSEC_FALCON_IRQMSET_SWGEN1
8-15 TSEC_FALCON_IRQMSET_EXT
16 TSEC_FALCON_IRQMSET_DMA

Used for setting the mask for Falcon's IRQs.

TSEC_FALCON_IRQMCLR

Bits Description
0 TSEC_FALCON_IRQMCLR_GPTMR
1 TSEC_FALCON_IRQMCLR_WDTMR
2 TSEC_FALCON_IRQMCLR_MTHD
3 TSEC_FALCON_IRQMCLR_CTXSW
4 TSEC_FALCON_IRQMCLR_HALT
5 TSEC_FALCON_IRQMCLR_EXTERR
6 TSEC_FALCON_IRQMCLR_SWGEN0
7 TSEC_FALCON_IRQMCLR_SWGEN1
8-15 TSEC_FALCON_IRQMCLR_EXT
16 TSEC_FALCON_IRQMCLR_DMA

Used for clearing the mask for Falcon's IRQs.

TSEC_FALCON_IRQMASK

Bits Description
0 TSEC_FALCON_IRQMASK_GPTMR
1 TSEC_FALCON_IRQMASK_WDTMR
2 TSEC_FALCON_IRQMASK_MTHD
3 TSEC_FALCON_IRQMASK_CTXSW
4 TSEC_FALCON_IRQMASK_HALT
5 TSEC_FALCON_IRQMASK_EXTERR
6 TSEC_FALCON_IRQMASK_SWGEN0
7 TSEC_FALCON_IRQMASK_SWGEN1
8-15 TSEC_FALCON_IRQMASK_EXT
16 TSEC_FALCON_IRQMASK_DMA

Used for getting the value of the mask for Falcon's IRQs.

TSEC_FALCON_IRQDEST

Bits Description
0 TSEC_FALCON_IRQDEST_HOST_GPTMR
1 TSEC_FALCON_IRQDEST_HOST_WDTMR
2 TSEC_FALCON_IRQDEST_HOST_MTHD
3 TSEC_FALCON_IRQDEST_HOST_CTXSW
4 TSEC_FALCON_IRQDEST_HOST_HALT
5 TSEC_FALCON_IRQDEST_HOST_EXTERR
6 TSEC_FALCON_IRQDEST_HOST_SWGEN0
7 TSEC_FALCON_IRQDEST_HOST_SWGEN1
8-15 TSEC_FALCON_IRQDEST_HOST_EXT
16 TSEC_FALCON_IRQDEST_TARGET_GPTMR
17 TSEC_FALCON_IRQDEST_TARGET_WDTMR
18 TSEC_FALCON_IRQDEST_TARGET_MTHD
19 TSEC_FALCON_IRQDEST_TARGET_CTXSW
20 TSEC_FALCON_IRQDEST_TARGET_HALT
21 TSEC_FALCON_IRQDEST_TARGET_EXTERR
22 TSEC_FALCON_IRQDEST_TARGET_SWGEN0
23 TSEC_FALCON_IRQDEST_TARGET_SWGEN1
24-31 TSEC_FALCON_IRQDEST_TARGET_EXT

Used for routing Falcon's IRQs.

TSEC_FALCON_GPTMRINT

Bits Description
0-31 TSEC_FALCON_GPTMRINT_VAL

TSEC_FALCON_GPTMRVAL

Bits Description
0-31 TSEC_FALCON_GPTMRVAL_VAL

TSEC_FALCON_GPTMRCTL

Bits Description
0 TSEC_FALCON_GPTMRCTL_GPTMREN

TSEC_FALCON_PTIMER0

Bits Description
0-31 TSEC_FALCON_PTIMER0_VAL

TSEC_FALCON_PTIMER1

Bits Description
0-31 TSEC_FALCON_PTIMER1_VAL

TSEC_FALCON_WDTMRVAL

Bits Description
0-31 TSEC_FALCON_WDTMRVAL_VAL

TSEC_FALCON_WDTMRCTL

Bits Description
0 TSEC_FALCON_WDTMRCTL_WDTMREN

TSEC_FALCON_IRQDEST2

Bits Description
0 TSEC_FALCON_IRQDEST2_HOST_DMA
16 TSEC_FALCON_IRQDEST2_TARGET_DMA

Used for routing Falcon's IRQs.

TSEC_FALCON_MAILBOX0

Bits Description
0-31 TSEC_FALCON_MAILBOX0_DATA

Scratch register for reading/writing data to Falcon.

TSEC_FALCON_MAILBOX1

Bits Description
0-31 TSEC_FALCON_MAILBOX1_DATA

Scratch register for reading/writing data to Falcon.

TSEC_FALCON_ITFEN

Bits Description
0 TSEC_FALCON_ITFEN_CTXEN
1 TSEC_FALCON_ITFEN_MTHDEN

Used for enabling/disabling Falcon interfaces.

TSEC_FALCON_IDLESTATE

Bits Description
0 TSEC_FALCON_IDLESTATE_FALCON_BUSY
1-15 TSEC_FALCON_IDLESTATE_EXT_BUSY

Used for detecting if Falcon is busy or not.

TSEC_FALCON_CURCTX

Bits Description
0-27 TSEC_FALCON_CURCTX_CTXPTR
28-29 TSEC_FALCON_CURCTX_CTXTGT
30 TSEC_FALCON_CURCTX_CTXVLD

TSEC_FALCON_NXTCTX

Bits Description
0-27 TSEC_FALCON_NXTCTX_CTXPTR
28-29 TSEC_FALCON_NXTCTX_CTXTGT
30 TSEC_FALCON_NXTCTX_CTXVLD

TSEC_FALCON_CTXACK

Bits Description
0 TSEC_FALCON_CTXACK_SAVE_ACK
1 TSEC_FALCON_CTXACK_REST_ACK

TSEC_FALCON_FHSTATE

Bits Description
0 TSEC_FALCON_FHSTATE_FALCON_HALTED
1-15 TSEC_FALCON_FHSTATE_EXT_HALTED
16 TSEC_FALCON_FHSTATE_ENGINE_FAULTED
17 TSEC_FALCON_FHSTATE_STALL_REQ

TSEC_FALCON_PRIVSTATE

Bits Description
0 TSEC_FALCON_PRIVSTATE_PRIV

TSEC_FALCON_MTHDDATA

Bits Description
0-31 TSEC_FALCON_MTHDDATA_DATA

TSEC_FALCON_MTHDID

Bits Description
0-11 TSEC_FALCON_MTHDID_ID
12-14 TSEC_FALCON_MTHDID_SUBCH
15 TSEC_FALCON_MTHDID_PRIV
16 TSEC_FALCON_MTHDID_WPEND

TSEC_FALCON_MTHDWDAT

Bits Description
0-31 TSEC_FALCON_MTHDWDAT_DATA

TSEC_FALCON_MTHDCOUNT

Bits Description
0-15 TSEC_FALCON_MTHDCOUNT_COUNT

TSEC_FALCON_MTHDPOP

Bits Description
0 TSEC_FALCON_MTHDPOP_POP

TSEC_FALCON_MTHDRAMSZ

Bits Description
0-15 TSEC_FALCON_MTHDRAMSZ_RAMSZ

TSEC_FALCON_SFTRESET

Bits Description
0 TSEC_FALCON_SFTRESET_EXT

TSEC_FALCON_OS

Bits Description
0-31 TSEC_FALCON_OS_VERSION

TSEC_FALCON_RM

Bits Description
0-31 TSEC_FALCON_RM_CONFIG

TSEC_FALCON_SOFT_PM

Bits Description
0-5 TSEC_FALCON_SOFT_PM_PROBE
16 TSEC_FALCON_SOFT_PM_TRIGGER_END
17 TSEC_FALCON_SOFT_PM_TRIGGER_START

TSEC_FALCON_SOFT_MODE

Bits Description
0-5 TSEC_FALCON_SOFT_MODE_PROBE

TSEC_FALCON_DEBUG1

Bits Description
0-15 TSEC_FALCON_DEBUG1_MTHD_DRAIN_TIME
16 TSEC_FALCON_DEBUG1_CTXSW_MODE

TSEC_FALCON_DEBUGINFO

Bits Description
0-31 TSEC_FALCON_DEBUGINFO_DATA

Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.

[6.0.0+] nvservices sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.

TSEC_FALCON_IBRKPT1

Bits Description
0-23 TSEC_FALCON_IBRKPT1_PC
29 TSEC_FALCON_IBRKPT1_SUPPRESS
30 TSEC_FALCON_IBRKPT1_SKIP
31 TSEC_FALCON_IBRKPT1_EN

TSEC_FALCON_IBRKPT2

Bits Description
0-23 TSEC_FALCON_IBRKPT2_PC
29 TSEC_FALCON_IBRKPT2_SUPPRESS
30 TSEC_FALCON_IBRKPT2_SKIP
31 TSEC_FALCON_IBRKPT2_EN

TSEC_FALCON_CGCTL

Bits Description
0 TSEC_FALCON_CGCTL_CG_OVERRIDE

TSEC_FALCON_ENGCTL

Bits Description
0 TSEC_FALCON_ENGCTL_INV_CONTEXT
1 TSEC_FALCON_ENGCTL_SET_STALLREQ
2 TSEC_FALCON_ENGCTL_CLR_STALLREQ
3 TSEC_FALCON_ENGCTL_SWITCH_CONTEXT
8 TSEC_FALCON_ENGCTL_STALLREQ
9 TSEC_FALCON_ENGCTL_STALLACK

TSEC_FALCON_PMM

Bits Description
0-4 TSEC_FALCON_PMM_FALCON_STALL_SEL 
0x00: ANY
0x01: CODE
0x02: DMAQ
0x03: DMFENCE
0x04: DMWAIT
0x05: IMWAIT
0x06: IPND
0x07: LDSTQ
0x08: SB
0x09: ANY_SC
0x0A: CODE_SC
0x0B: DMAQ_SC
0x0C: DMFENCE_SC
0x0D: DMWAIT_SC
0x0E: IMWAIT_SC
0x0F: IPND_SC
0x10: LDSTQ_SC
0x11: SB_SC
5-7 TSEC_FALCON_PMM_FALCON_IDLE_SEL 
0x00: WAITING
0x01: ENG_IDLE
0x02: MTHD_FULL
0x03: WAITING_SC
0x04: ENG_IDLE_SC
0x05: MTHD_FULL_SC
8-11 TSEC_FALCON_PMM_FALCON_SOFTPM0_SEL 
0x00: 0
0x01: 1
0x02: 2
0x03: 3
0x04: 4
0x05: 5
0x06: 0_SC
0x07: 1_SC
0x08: 2_SC
0x09: 3_SC
0x0A: 4_SC
0x0B: 5_SC
12-15 TSEC_FALCON_PMM_FALCON_SOFTPM1_SEL 
0x00: 0
17-19 TSEC_FALCON_PMM_TFBIF_DSTAT_SEL 
0x00: 1KTRANSFER
0x01: RREQ
0x02: WREQ
0x03: TWREQ
0x04: 1KTRANSFER_SC
0x05: RREQ_SC
0x06: WREQ_SC
0x07: TWREQ_SC
20-23 TSEC_FALCON_PMM_TFBIF_STALL0_SEL 
0x00: RDATQ_FULL
0x01: RACKQ_FULL
0x02: WREQQ_FULL
0x03: WDATQ_FULL
0x04: WACKQ_FULL
0x05: MREQQ_FULL
0x06: RREQ_PEND
0x07: WREQ_PEND
0x08: RDATQ_FULL_SC
0x09: RACKQ_FULL_SC
0x0A: WREQQ_FULL_SC
0x0B: WDATQ_FULL_SC
0x0C: WACKQ_FULL_SC
0x0D: MREQQ_FULL_SC
0x0E: RREQ_PEND_SC
0x0F: WREQ_PEND_SC
24-27 TSEC_FALCON_PMM_TFBIF_STALL1_SEL 
0x00: RDATQ_FULL
28-31 TSEC_FALCON_PMM_TFBIF_STALL2_SEL 
0x00: RDATQ_FULL

TSEC_FALCON_ADDR

Bits Description
0-5 TSEC_FALCON_ADDR_LSB
6-11 TSEC_FALCON_ADDR_MSB

TSEC_FALCON_IBRKPT3

Bits Description
0-23 TSEC_FALCON_IBRKPT3_PC
29 TSEC_FALCON_IBRKPT3_SUPPRESS
30 TSEC_FALCON_IBRKPT3_SKIP
31 TSEC_FALCON_IBRKPT3_EN

TSEC_FALCON_IBRKPT4

Bits Description
0-23 TSEC_FALCON_IBRKPT4_PC
29 TSEC_FALCON_IBRKPT4_SUPPRESS
30 TSEC_FALCON_IBRKPT4_SKIP
31 TSEC_FALCON_IBRKPT4_EN

TSEC_FALCON_IBRKPT5

Bits Description
0-23 TSEC_FALCON_IBRKPT5_PC
29 TSEC_FALCON_IBRKPT5_SUPPRESS
30 TSEC_FALCON_IBRKPT5_SKIP
31 TSEC_FALCON_IBRKPT5_EN

TSEC_FALCON_EXCI

Bits Description
0-19 TSEC_FALCON_EXCI_EXPC
20-23 TSEC_FALCON_EXCI_EXCAUSE 
0x00: TRAP0
0x01: TRAP1
0x02: TRAP2
0x03: TRAP3
0x08: ILL_INS (invalid opcode)
0x09: INV_INS (authentication entry)
0x0A: MISS_INS (page miss)
0x0B: DHIT_INS (page multiple hit)
0x0F: BRKPT_INS (breakpoint hit)

Contains information about raised exceptions.

TSEC_FALCON_SVEC_SPR

Bits Description
18 TSEC_FALCON_SVEC_SPR_SIGPASS

TSEC_FALCON_RSTAT0

Mirror of the ICD status register 0.

TSEC_FALCON_RSTAT3

Mirror of the ICD status register 3.

TSEC_FALCON_SIRQMASK

Unofficial name.

Same as TSEC_FALCON_IRQMASK, but for LS mode.

TSEC_FALCON_CPUCTL

Bits Description
0 TSEC_FALCON_CPUCTL_IINVAL
1 TSEC_FALCON_CPUCTL_STARTCPU
2 TSEC_FALCON_CPUCTL_SRESET
3 TSEC_FALCON_CPUCTL_HRESET
4 TSEC_FALCON_CPUCTL_HALTED
5 TSEC_FALCON_CPUCTL_STOPPED
6 TSEC_FALCON_CPUCTL_ALIAS_EN

Used for signaling the Falcon CPU.

TSEC_FALCON_BOOTVEC

Bits Description
0-31 TSEC_FALCON_BOOTVEC_VEC

Takes the Falcon's boot vector address.

TSEC_FALCON_HWCFG

Bits Description
0-8 TSEC_FALCON_HWCFG_IMEM_SIZE
9-17 TSEC_FALCON_HWCFG_DMEM_SIZE
18-26 TSEC_FALCON_HWCFG_METHODFIFO_DEPTH
27-31 TSEC_FALCON_HWCFG_DMAQUEUE_DEPTH

TSEC_FALCON_DMACTL

Bits Description
0 TSEC_FALCON_DMACTL_REQUIRE_CTX
1 TSEC_FALCON_DMACTL_DMEM_SCRUBBING
2 TSEC_FALCON_DMACTL_IMEM_SCRUBBING
3-6 TSEC_FALCON_DMACTL_DMAQ_NUM
7 TSEC_FALCON_DMACTL_SECURE_STAT

Used for configuring the Falcon's DMA engine.

TSEC_FALCON_DMATRFBASE

Bits Description
0-31 TSEC_FALCON_DMATRFBASE_BASE

Base address of the external memory buffer, shifted right by 8.

The current transfer address is calculated by adding TSEC_FALCON_DMATRFFBOFFS to the base.

TSEC_FALCON_DMATRFMOFFS

Bits Description
0-15 TSEC_FALCON_DMATRFMOFFS_OFFS

For transfers to DMEM: the destination address. For transfers to IMEM: the destination virtual IMEM page.

TSEC_FALCON_DMATRFCMD

Bits Description
0 TSEC_FALCON_DMATRFCMD_FULL
1 TSEC_FALCON_DMATRFCMD_IDLE
2-3 TSEC_FALCON_DMATRFCMD_SEC
4 TSEC_FALCON_DMATRFCMD_IMEM
5 TSEC_FALCON_DMATRFCMD_WRITE
8-10 TSEC_FALCON_DMATRFCMD_SIZE
12-14 TSEC_FALCON_DMATRFCMD_CTXDMA

Used for configuring DMA transfers.

TSEC_FALCON_DMATRFFBOFFS

Bits Description
0-31 TSEC_FALCON_DMATRFFBOFFS_OFFS

For transfers to IMEM: the destination physical IMEM page.

TSEC_FALCON_DMAPOLL_FB

Bits Description
0 TSEC_FALCON_DMAPOLL_FB_FENCE_ACTIVE
1 TSEC_FALCON_DMAPOLL_FB_DMA_ACTIVE
4 TSEC_FALCON_DMAPOLL_FB_CFG_R_FENCE
5 TSEC_FALCON_DMAPOLL_FB_CFG_W_FENCE
16-23 TSEC_FALCON_DMAPOLL_FB_WCOUNT
24-31 TSEC_FALCON_DMAPOLL_FB_RCOUNT

Contains the status of a DMA transfer between the Falcon and external memory.

TSEC_FALCON_DMAPOLL_CP

Bits Description
0 TSEC_FALCON_DMAPOLL_CP_FENCE_ACTIVE
1 TSEC_FALCON_DMAPOLL_CP_DMA_ACTIVE
4 TSEC_FALCON_DMAPOLL_CP_CFG_R_FENCE
5 TSEC_FALCON_DMAPOLL_CP_CFG_W_FENCE
16-23 TSEC_FALCON_DMAPOLL_CP_WCOUNT
24-31 TSEC_FALCON_DMAPOLL_CP_RCOUNT

Contains the status of a DMA transfer between the Falcon and the SCP.

TSEC_FALCON_HWCFG1

Bits Description
0-3 TSEC_FALCON_HWCFG1_CORE_REV
4-5 TSEC_FALCON_HWCFG1_SECURITY_MODEL
6-7 TSEC_FALCON_HWCFG1_CORE_REV_SUBVERSION
8-11 TSEC_FALCON_HWCFG1_IMEM_PORTS
12-15 TSEC_FALCON_HWCFG1_DMEM_PORTS
16-20 TSEC_FALCON_HWCFG1_TAG_WIDTH
27 TSEC_FALCON_HWCFG1_DBG_PRIV_BUS
28 TSEC_FALCON_HWCFG1_CSB_SIZE_16M
29 TSEC_FALCON_HWCFG1_PRIV_DIRECT
30 TSEC_FALCON_HWCFG1_DMEM_APERTURES
31 TSEC_FALCON_HWCFG1_IMEM_AUTOFILL

TSEC_FALCON_CPUCTL_ALIAS

Bits Description
1 TSEC_FALCON_CPUCTL_ALIAS_STARTCPU

TSEC_FALCON_STACKCFG

Bits Description
0-15 TSEC_FALCON_STACKCFG_BOTTOM
31 TSEC_FALCON_STACKCFG_SPEXC

TSEC_FALCON_IMCTL

Bits Description
0-23 TSEC_FALCON_IMCTL_ADDR_BLK
24-26 TSEC_FALCON_IMCTL_CMD 
0x00: NOP
0x01: IMINV (ITLB)
0x02: IMBLK (PTLB)
0x03: IMTAG (VTLB)
0x04: IMTAG_SETVLD

Controls the Falcon TLB.

TSEC_FALCON_IMSTAT

Bits Description
0-31 TSEC_FALCON_IMSTAT_VAL

Returns the result of the last command from TSEC_FALCON_IMCTL.

TSEC_FALCON_TRACEIDX

Bits Description
0-7 TSEC_FALCON_TRACEIDX_IDX
16-23 TSEC_FALCON_TRACEIDX_MAXIDX
24-31 TSEC_FALCON_TRACEIDX_CNT

Controls the index for tracing with TSEC_FALCON_TRACEPC.

TSEC_FALCON_TRACEPC

Bits Description
0-23 TSEC_FALCON_TRACEPC_PC

Returns the PC of the last call or branch executed.

TSEC_FALCON_IMFILLRNG0

Bits Description
0-15 TSEC_FALCON_IMFILLRNG0_TAG_LO
16-31 TSEC_FALCON_IMFILLRNG0_TAG_HI

TSEC_FALCON_IMFILLRNG1

Bits Description
0-15 TSEC_FALCON_IMFILLRNG1_TAG_LO
16-31 TSEC_FALCON_IMFILLRNG1_TAG_HI

TSEC_FALCON_IMFILLCTL

Bits Description
0-7 TSEC_FALCON_IMFILLCTL_NBLOCKS

TSEC_FALCON_IMCTL_DEBUG

Bits Description
0-23 TSEC_FALCON_IMCTL_DEBUG_ADDR_BLK
24-26 TSEC_FALCON_IMCTL_DEBUG_CMD 
0x00: NOP
0x02: IMBLK
0x03: IMTAG

TSEC_FALCON_CMEMBASE

Bits Description
18-31 TSEC_FALCON_CMEMBASE_VAL

TSEC_FALCON_DMEMAPERT

Bits Description
0-7 TSEC_FALCON_DMEMAPERT_TIME_OUT
8-11 TSEC_FALCON_DMEMAPERT_TIME_UNIT
16 TSEC_FALCON_DMEMAPERT_ENABLE
17-19 TSEC_FALCON_DMEMAPERT_LDSTQ_NUM

TSEC_FALCON_EXTERRADDR

Bits Description
0-31 TSEC_FALCON_EXTERRADDR_ADDR

TSEC_FALCON_EXTERRSTAT

Bits Description
0-23 TSEC_FALCON_EXTERRSTAT_PC
24-27 TSEC_FALCON_EXTERRSTAT_STAT
31 TSEC_FALCON_EXTERRSTAT_VALID

TSEC_FALCON_CG2

Bits Description
1 TSEC_FALCON_CG2_SLCG_FALCON_DMA
2 TSEC_FALCON_CG2_SLCG_FALCON_GC6_SR_FSM
3 TSEC_FALCON_CG2_SLCG_FALCON_PIPE
4 TSEC_FALCON_CG2_SLCG_FALCON_DIV
5 TSEC_FALCON_CG2_SLCG_FALCON_ICD
6 TSEC_FALCON_CG2_SLCG_FALCON_CFG
7 TSEC_FALCON_CG2_SLCG_FALCON_CTXSW
8 TSEC_FALCON_CG2_SLCG_FALCON_PMB
9 TSEC_FALCON_CG2_SLCG_FALCON_RF
10 TSEC_FALCON_CG2_SLCG_FALCON_MUL
11 TSEC_FALCON_CG2_SLCG_FALCON_LDST
12 TSEC_FALCON_CG2_SLCG_FALCON_TSYNC
13 TSEC_FALCON_CG2_SLCG_FALCON_GPTMR
14 TSEC_FALCON_CG2_SLCG_FALCON_WDTMR
15 TSEC_FALCON_CG2_SLCG_FALCON_IRQSTAT
16 TSEC_FALCON_CG2_SLCG_FALCON_TOP
17 TSEC_FALCON_CG2_SLCG_FBIF

TSEC_FALCON_IMEMC

Bits Description
2-7 TSEC_FALCON_IMEMC_OFFS
8-15 TSEC_FALCON_IMEMC_BLK
24 TSEC_FALCON_IMEMC_AINCW
25 TSEC_FALCON_IMEMC_AINCR
28 TSEC_FALCON_IMEMC_SECURE
29 TSEC_FALCON_IMEMC_SEC_ATOMIC
30 TSEC_FALCON_IMEMC_SEC_WR_VIO
31 TSEC_FALCON_IMEMC_SEC_LOCK

Used for configuring access to Falcon's IMEM.

TSEC_FALCON_IMEMD

Bits Description
0-31 TSEC_FALCON_IMEMD_DATA

Returns or takes the value for an IMEM read/write operation.

TSEC_FALCON_IMEMT

Bits Description
0-15 TSEC_FALCON_IMEMT_TAG

Returns or takes the virtual page index for an IMEM read/write operation.

TSEC_FALCON_DMEMC

Bits Description
2-7 TSEC_FALCON_DMEMC_OFFS
8-15 TSEC_FALCON_DMEMC_BLK
24 TSEC_FALCON_DMEMC_AINCW
25 TSEC_FALCON_DMEMC_AINCR

Used for configuring access to Falcon's DMEM.

TSEC_FALCON_DMEMD

Bits Description
0-31 TSEC_FALCON_DMEMD_DATA

Returns or takes the value for a DMEM read/write operation.

TSEC_FALCON_ICD_CMD

Bits Description
0-3 TSEC_FALCON_ICD_CMD_OPC 
0x00: STOP
0x01: RUN (run from PC)
0x02: JRUN (run from address)
0x03: RUNB (run from PC)
0x04: JRUNB (run from address)
0x05: STEP (step from PC)
0x06: JSTEP (step from address)
0x07: EMASK (set exception mask)
0x08: RREG (read register)
0x09: WREG (write register)
0x0A: RDM (read data memory)
0x0B: WDM (write data memory)
0x0C: RCM (read MMIO/configuration memory)
0x0D: WCM (write MMIO/configuration memory)
0x0E: RSTAT (read status)
0x0F: SBU (store buffer update)
6-7 TSEC_FALCON_ICD_CMD_SZ 
0x00: B (byte)
0x01: HW (half word)
0x02: W (word)
8-12 TSEC_FALCON_ICD_CMD_IDX 
0x00: REG0 | RSTAT0 | WB0
0x01: REG1 | RSTAT1 | WB1
0x02: REG2 | RSTAT2 | WB2
0x03: REG3 | RSTAT3 | WB3
0x04: REG4 | RSTAT4
0x05: REG5 | RSTAT5
0x06: REG6
0x07: REG7
0x08: REG8
0x09: REG9
0x0A: REG10
0x0B: REG11
0x0C: REG12
0x0D: REG13
0x0E: REG14
0x0F: REG15
0x10: IV0
0x11: IV1
0x12: UNDEFINED
0x13: EV
0x14: SP
0x15: PC
0x16: IMB
0x17: DMB
0x18: CSW
0x19: CCR
0x1A: SEC
0x1B: CTX
0x1C: EXCI
0x1D: SEC1
0x1E: IMB1
0x1F: DMB1
14 TSEC_FALCON_ICD_CMD_ERROR
15 TSEC_FALCON_ICD_CMD_RDVLD
16-31 TSEC_FALCON_ICD_CMD_PARM 
0x0001: EMASK_TRAP0
0x0002: EMASK_TRAP1
0x0004: EMASK_TRAP2
0x0008: EMASK_TRAP3
0x0010: EMASK_EXC_UNIMP
0x0020: EMASK_EXC_IMISS
0x0040: EMASK_EXC_IMHIT
0x0080: EMASK_EXC_IBREAK
0x0100: EMASK_IV0
0x0200: EMASK_IV1
0x0400: EMASK_IV2
0x0800: EMASK_EXT0
0x1000: EMASK_EXT1
0x2000: EMASK_EXT2
0x4000: EMASK_EXT3
0x8000: EMASK_EXT4

Used for sending commands to the Falcon's in-chip debugger.

TSEC_FALCON_ICD_ADDR

Bits Description
0-31 TSEC_FALCON_ICD_ADDR_ADDR

Takes the target address for the Falcon's in-chip debugger.

TSEC_FALCON_ICD_WDATA

Bits Description
0-31 TSEC_FALCON_ICD_WDATA_DATA

Takes the data for writing using the Falcon's in-chip debugger.

TSEC_FALCON_ICD_RDATA

Bits Description
0-31 TSEC_FALCON_ICD_RDATA_DATA

Returns the data read using the Falcon's in-chip debugger.

When reading from an internal status register (STAT), the following applies:

Bits Description
0 RSTAT0_MEM_STALL
1 RSTAT0_DMA_STALL
2 RSTAT0_FENCE_STALL
3 RSTAT0_DIV_STALL
4 RSTAT0_DMA_STALL_DMAQ
5 RSTAT0_DMA_STALL_DMWAITING
6 RSTAT0_DMA_STALL_IMWAITING
7 RSTAT0_ANY_STALL
8 RSTAT0_SBFULL_STALL
9 RSTAT0_SBHIT_STALL
10 RSTAT0_FLOW_STALL
11 RSTAT0_SP_STALL
12 RSTAT0_BL_STALL
13 RSTAT0_IPND_STALL
14 RSTAT0_LDSTQ_STALL
16 RSTAT0_NOINSTR_STALL
20 RSTAT0_HALTSTOP_FLUSH
21 RSTAT0_AFILL_FLUSH
22 RSTAT0_EXC_FLUSH
23-25 RSTAT0_IRQ_FLUSH
28 RSTAT0_VALIDRD
29 RSTAT0_WAITING
30 RSTAT0_HALTED
31 RSTAT0_MTHD_FULL
Bits Description
0-3 RSTAT1_WB_ALLOC
4-7 RSTAT1_WB_VALID
8-9 RSTAT1_WB0_SZ
10-11 RSTAT1_WB1_SZ
12-13 RSTAT1_WB2_SZ
14-15 RSTAT1_WB3_SZ
16-19 RSTAT1_WB0_IDX
20-23 RSTAT1_WB1_IDX
24-27 RSTAT1_WB2_IDX
28-31 RSTAT1_WB3_IDX
Bits Description
0-3 RSTAT2_DMAQ_NUM
4 RSTAT2_DMA_ENABLE
5-7 RSTAT2_LDSTQ_NUM
16-19 RSTAT2_EM_BUSY
20-23 RSTAT2_EM_ACKED
24-27 RSTAT2_EM_ISWR
28-31 RSTAT2_EM_DVLD
Bits Description
0 RSTAT3_MTHD_IDLE
1 RSTAT3_CTXSW_IDLE
2 RSTAT3_DMA_IDLE
3 RSTAT3_SCP_IDLE
4 RSTAT3_LDST_IDLE
5 RSTAT3_SBWB_EMPTY
6-8 RSTAT3_CSWIE
10 RSTAT3_CSWE
12-14 RSTAT3_CTXSW_STATE 
0x00: IDLE
0x01: SM_CHECK
0x02: SM_SAVE
0x03: SM_SAVE_WAIT
0x04: SM_BLK_BIND
0x05: SM_RESET
0x06: SM_RESETWAIT
0x07: SM_ACK
15 RSTAT3_CTXSW_PEND
17 RSTAT3_DMA_FBREQ_IDLE
18 RSTAT3_DMA_ACKQ_EMPTY
19 RSTAT3_DMA_RDQ_EMPTY
20 RSTAT3_DMA_WR_BUSY
21 RSTAT3_DMA_RD_BUSY
22 RSTAT3_LDST_XT_BUSY
23 RSTAT3_LDST_XT_BLOCK
24 RSTAT3_ENG_IDLE
Bits Description
0-1 RSTAT4_ICD_STATE 
0x00: NORMAL
0x01: WAIT_ISSUE_CLEAR
0x02: WAIT_EXLDQ_CLEAR
0x03: FULL_DBG_MODE
2-3 RSTAT4_ICD_MODE 
0x00: SUPPRESSICD
0x01: ENTERICD_IBRK
0x02: ENTERICD_STEP
16 RSTAT4_ICD_EMASK_TRAP0
17 RSTAT4_ICD_EMASK_TRAP1
18 RSTAT4_ICD_EMASK_TRAP2
19 RSTAT4_ICD_EMASK_TRAP3
20 RSTAT4_ICD_EMASK_EXC_UNIMP
21 RSTAT4_ICD_EMASK_EXC_IMISS
22 RSTAT4_ICD_EMASK_EXC_IMHIT
23 RSTAT4_ICD_EMASK_EXC_IBREAK
24 RSTAT4_ICD_EMASK_IV0
25 RSTAT4_ICD_EMASK_IV1
26 RSTAT4_ICD_EMASK_IV2
27 RSTAT4_ICD_EMASK_EXT0
28 RSTAT4_ICD_EMASK_EXT1
29 RSTAT4_ICD_EMASK_EXT2
30 RSTAT4_ICD_EMASK_EXT3
31 RSTAT4_ICD_EMASK_EXT4
Bits Description
0-7 RSTAT5_LRU_STATE

TSEC_FALCON_SCTL

Bits Description
0 TSEC_FALCON_SCTL_LSMODE
1 TSEC_FALCON_SCTL_HSMODE
4-5 Current access level
8-9 Unknown access level
12 Unknown
13 Unknown
14 Initialize the transition to LS mode

TSEC_FALCON_SERRSTAT

Bits Description
0-23 Unknown
30 Unknown
31 Set on memory protection violation

Unofficial name.

Used for detecting invalid CSB accesses in LS mode.

TSEC_FALCON_SERRVAL

Bits Description
0-31 Error code

Unofficial name.

TSEC_FALCON_SERRADDR

Bits Description
0-31 Error address

Unofficial name.

TSEC_FALCON_SCTL1

Bits Description
0-1 CSB access level
2-3 Unknown access level

Unofficial name.

TSEC_FALCON_STEST

Bits Description
0-31 Unknown

Unofficial name.

TSEC_FALCON_SICD

Bits Description
0 Enable access to ICD command STOP
1 Enable access to ICD command RUN
2 Enable access to ICD command RUNB
3 Enable access to ICD command STEP
4 Enable access to ICD command EMASK
5 Enable access to ICD command RREG (only for SPRs)
6 Enable access to ICD command RSTAT
7 Enable access to IBRKPT registers
8 Enable access to ICD command RREG (only for GPRs)
9 Enable access to ICD command RDM

Unofficial name.

Controls access to the ICD in LS mode.

TSEC_FALCON_SPROT_IMEM

Bits Description
0-2 Read access level
3 Set on memory read access violation
4-6 Write access level
7 Set on memory write access violation

Unofficial name.

Controls accesses to Falcon IMEM.

TSEC_FALCON_SPROT_DMEM

Bits Description
0-2 Read access level
3 Set on memory read access violation
4-6 Write access level
7 Set on memory write access violation

Unofficial name.

Controls accesses to Falcon DMEM.

TSEC_FALCON_SPROT_CPUCTL

Bits Description
0-2 Read access level
3 Set on memory read access violation
4-6 Write access level
7 Set on memory write access violation

Unofficial name.

Controls accesses to the TSEC_FALCON_CPUCTL register.

TSEC_FALCON_SPROT_MISC

Bits Description
0-2 Read access level
3 Set on memory read access violation
4-6 Write access level
7 Set on memory write access violation

Unofficial name.

Controls accesses to the following registers:

TSEC_FALCON_SPROT_IRQ

Bits Description
0-2 Read access level
3 Set on memory read access violation
4-6 Write access level
7 Set on memory write access violation

Unofficial name.

Controls accesses to the following registers:

TSEC_FALCON_SPROT_MTHD

Bits Description
0-2 Read access level
3 Set on memory read access violation
4-6 Write access level
7 Set on memory write access violation

Unofficial name.

Controls accesses to the following registers:

TSEC_FALCON_SPROT_SCTL

Bits Description
0-2 Read access level
3 Set on memory read access violation
4-6 Write access level
7 Set on memory write access violation

Unofficial name.

Controls accesses to the TSEC_FALCON_SCTL register.

TSEC_FALCON_SPROT_WDTMR

Bits Description
0-2 Read access level
3 Set on memory read access violation
4-6 Write access level
7 Set on memory write access violation

Unofficial name.

Controls accesses to the following registers:

TSEC_FALCON_DMAINFO_FINISHED_FBRD_LOW

Bits Description
0-31 TSEC_FALCON_DMAINFO_FINISHED_FBRD_LOW_VAL

TSEC_FALCON_DMAINFO_FINISHED_FBRD_HIGH

Bits Description
0-30 TSEC_FALCON_DMAINFO_FINISHED_FBRD_HIGH_VAL
31 TSEC_FALCON_DMAINFO_FINISHED_FBRD_HIGH_OBIT

TSEC_FALCON_DMAINFO_FINISHED_FBWR_LOW

Bits Description
0-31 TSEC_FALCON_DMAINFO_FINISHED_FBWR_LOW_VAL

TSEC_FALCON_DMAINFO_FINISHED_FBWR_HIGH

Bits Description
0-30 TSEC_FALCON_DMAINFO_FINISHED_FBWR_HIGH_VAL
31 TSEC_FALCON_DMAINFO_FINISHED_FBWR_HIGH_OBIT

TSEC_FALCON_DMAINFO_CURRENT_FBRD_LOW

Bits Description
0-31 TSEC_FALCON_DMAINFO_CURRENT_FBRD_LOW_VAL

TSEC_FALCON_DMAINFO_CURRENT_FBRD_HIGH

Bits Description
0-30 TSEC_FALCON_DMAINFO_CURRENT_FBRD_HIGH_VAL
31 TSEC_FALCON_DMAINFO_CURRENT_FBRD_HIGH_OBIT

TSEC_FALCON_DMAINFO_CURRENT_FBWR_LOW

Bits Description
0-31 TSEC_FALCON_DMAINFO_CURRENT_FBWR_LOW_VAL

TSEC_FALCON_DMAINFO_CURRENT_FBWR_HIGH

Bits Description
0-30 TSEC_FALCON_DMAINFO_CURRENT_FBWR_HIGH_VAL
31 TSEC_FALCON_DMAINFO_CURRENT_FBWR_HIGH_OBIT

TSEC_FALCON_DMAINFO_CTL

Bits Description
0 TSEC_FALCON_DMAINFO_CTL_CLR_FBRD
1 TSEC_FALCON_DMAINFO_CTL_CLR_FBWR

TSEC_SCP_CTL0

Bits Description
10 Enable Falcon<->LOAD interface
12 Enable Falcon<->STORE interface
14 Enable Falcon<->CMD interface
16 Enable SEQ
20 Enable CTL

Unofficial name.

TSEC_SCP_CTL1

Bits Description
0 Clear SEQ
8 Clear SCP's internal pipeline
11 Enable RNG's test mode
12 Enable RNG
16 Enable Falcon<->LOAD interface's dummy mode (all reads return 0)
20 Enable Falcon<->LOAD interface bypassing (all reads are dropped)
24 Enable Falcon<->STORE interface bypassing (all writes are dropped)

Unofficial name.

TSEC_SCP_CTL_STAT

Bits Description
20 TSEC_SCP_CTL_STAT_DEBUG_MODE

TSEC_SCP_CTL_LOCK

Bits Description
0 Enable lockdown mode (locks IMEM and DMEM)
1 Lockdown has pending exit request
2 Lockdown has been enabled before
4 Enable SCP lockdown mode (locks SCP's MMIO register space)
6 SCP lockdown has been enabled before

Unofficial name.

Controls lockdown mode. Can only be cleared in HS mode.

TSEC_SCP_CFG

Bits Description
0 Endianness for ADD 
0: Little
1: Big
1 Endianness for GFMUL 
0: Little
1: Big
2 Endianness for LOAD 
0: Little
1: Big
3 Endianness for STORE 
0: Little
1: Big
4 Endianness for AES 
0: Little
1: Big
8 Flush CMD
12-13 Carry chain's size 
0: 32 bits
1: 64 bits
2: 96 bits
3: 128 bits
16-31 SCP's internal pipeline stall timeout value

Unofficial name.

TSEC_SCP_CTL_SCP

Bits Description
0 Swap SCP's master
1 Current SCP's master 
0: Falcon
1: External

Unofficial name.

TSEC_SCP_CTL_PKEY

Bits Description
0 TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
1 TSEC_SCP_CTL_PKEY_LOADED

TSEC_SCP_CTL_DBG

Bits Description
4 Disable lockdown mode
8 Disable SCP lockdown mode

Unofficial name.

Overrides lockdown mode. Can only be set in debug mode.

TSEC_SCP_DBG0

Bits Description
0-3 Index
4 Auto-increment
5-6 Target 
0: None
1: STORE
2: LOAD
3: SEQ
8-12 SEQ's current sequence's size
13-16 SEQ's current instruction's address
17 SEQ's current instruction is valid
18 SEQ is running in HS mode
19-22 LOAD's queue's size
23 LOAD's current operation is valid
24 LOAD is running in HS mode
25-26 STORE's queue's size
30 STORE's current operation is valid
31 STORE is running in HS mode

Unofficial name.

Used for debugging the LOAD, STORE and SEQ blocks.

TSEC_SCP_DBG1

Bits Description
0-31 Data 
If target is SEQ:
  Bits 0-3: current instruction's first operand
  Bits 4-9: current instruction's second operand
  Bits 10-14: current instruction's opcode

Unofficial name.

Used for retrieving debug data. Contains information on the last crypto sequence created when debugging the SEQ block.

TSEC_SCP_DBG2

Bits Description
0-1 SEQ's state 
0: Idle
1: Recording (cs0begin/cs1begin)
2: Executing (cs0exec/cs1exec)
4-7 Number of cycles left for SEQ's current sequence
12-15 Active crypto key register (ckeyreg)

Unofficial name.

Used for retrieving additional debug data associated with the SEQ block.

TSEC_SCP_CMD

Bits Description
0-3 Destination register
8-13 Source register or immediate value
20-24 Command opcode 
0x0:  nop (fuc5 opcode 0x00) 
0x1:  cmov (fuc5 opcode 0x84)
0x2:  cxsin (fuc5 opcode 0x88) or xdst (with cxset)
0x3:  cxsout (fuc5 opcode 0x8C) or xdld (with cxset) 
0x4:  crnd (fuc5 opcode 0x90)
0x5:  cs0begin (fuc5 opcode 0x94)
0x6:  cs0exec (fuc5 opcode 0x98)
0x7:  cs1begin (fuc5 opcode 0x9C)
0x8:  cs1exec (fuc5 opcode 0xA0)
0x9:  invalid (fuc5 opcode 0xA4)
0xA:  cchmod (fuc5 opcode 0xA8)
0xB:  cxor (fuc5 opcode 0xAC)
0xC:  cadd (fuc5 opcode 0xB0)
0xD:  cand (fuc5 opcode 0xB4)
0xE:  crev (fuc5 opcode 0xB8)
0xF:  cgfmul (fuc5 opcode 0xBC)
0x10: csecret (fuc5 opcode 0xC0)
0x11: ckeyreg (fuc5 opcode 0xC4)
0x12: ckexp (fuc5 opcode 0xC8)
0x13: ckrexp (fuc5 opcode 0xCC)
0x14: cenc (fuc5 opcode 0xD0)
0x15: cdec (fuc5 opcode 0xD4)
0x16: csigcmp (fuc5 opcode 0xD8)
0x17: csigenc (fuc5 opcode 0xDC)
0x18: csigclr (fuc5 opcode 0xE0)
28 CMD's current instruction is valid
31 CMD is running in HS mode

Unofficial name.

Contains information on the last crypto command executed.

TSEC_SCP_STAT0

Bits Description
0 SCP is active
2 CMD is active
4 STORE is active
6 SEQ is active
8 CTL is active
10 LOAD is active
14 AES is active
16 RNG is active

Unofficial name.

Contains the statuses of hardware blocks.

TSEC_SCP_STAT1

Bits Description
0-1 Signature comparison result 
0: None
1: Running
2: Failed
3: Succeeded
4 Falcon<->LOAD interface is running in HS mode
6 Falcon<->LOAD interface is ready
8 Falcon<->STORE interface is running in HS mode
10 Falcon<->STORE interface received a valid operation
12 Falcon<->CMD interface is running in HS mode
14 Falcon<->CMD interface received a valid instruction

Unofficial name.

Contains the statuses of hardware interfaces and the result of the last authentication attempt.

TSEC_SCP_STAT2

Bits Description
0-4 Current opcode in SEQ
5-9 Current opcode in Falcon<->CMD interface
10-14 Pending opcode in CMD
15-16 Current opcode in AES 
0: Encryption
1: Decryption
2: Key expansion
3: Key reverse expansion
24 SCP's internal pipeline is stalled on hazard
25 STORE is stalled
26 LOAD is stalled
27 RNG is stalled
28 SCP's internal pipeline is stalled on writeback
29 AES is stalled

Unofficial name.

Contains the status of crypto operations.

TSEC_SCP_RNG_STAT0

Bits Description
0 RND is ready
4-7 Unknown
8-11 Unknown
16 Unknown
20 Unknown

Unofficial name.

TSEC_SCP_RNG_STAT1

Bits Description
0-15 Unknown
16-31 Unknown

Unofficial name.

TSEC_SCP_IRQSTAT

Bits Description
0 RND ready
8 ACL error
12 SEC error
16 CMD error
20 Single step
24 RND clock trigger
28 Stall timeout

Unofficial name.

TSEC_SCP_IRQMASK

Bits Description
0 RND ready
8 ACL error
12 SEC error
16 CMD error
20 Single step
24 RND clock trigger
28 Stall timeout

Unofficial name.

TSEC_SCP_ACL_ERR

Bits Description
0 Writing to a crypto register without the correct ACL
4 Reading from a crypto register without the correct ACL
8 Invalid ACL change (cchmod)
31 ACL error occurred

Unofficial name.

Contains information on errors generated by the ACL error IRQ.

TSEC_SCP_SEC_ERR

Bits Description
0 Security mode changed during sequence execution (cs0exec/cs1exec)
1-2 Security mode at the beginning of sequence execution 
0: Non-secure
1: Heavy Secure
4 Security mode changed during sequence recording (cs0begin/cs1begin)
5-6 Security mode at the beginning of sequence recording 
0: Non-secure
1: Heavy Secure
16 Security mode changed while reading from crypto register/stream (cxsout or xdld)
17-18 Security mode at the beginning of reading from crypto register/stream 
0: Non-secure
1: Heavy Secure
20 Security mode and memory source changed while writing to crypto register/stream (cxsin or xdst)
21-22 Security mode when memory source changed while writing to crypto register/stream 
0: Non-secure
1: Heavy Secure
24 Security mode changed while writing to crypto register/stream (cxsin or xdst)
25-26 Security mode at the beginning of writing to crypto register/stream 
0: Non-secure
1: Heavy Secure
31 SEC error occurred

Unofficial name.

Contains information on errors generated by the SEC error IRQ.

TSEC_SCP_CMD_ERR

Bits Description
0 CMD's instruction is invalid
4 SEQ's sequence is empty
8 SEQ's sequence is too long
12 SEQ's sequence was not finished
16 Forbidden signature operation (csigcmp, csigenc or csigclr in NS mode)
20 Invalid signature operation (csigcmp in HS mode)
24 Forbidden ACL change (cchmod in NS mode)

Unofficial name.

Contains information on errors generated by the CMD error IRQ.

TSEC_SCP_RND_CTL0

Bits Description
0-31 RND clock trigger's lower limit

Unofficial name.

TSEC_SCP_RND_CTL1

Bits Description
0-15 RND clock trigger's upper limit
16-31 RND clock trigger's mask

Unofficial name.

TSEC_SCP_RND_CTL2

Bits Description
0-15 Unknown

Unofficial name.

TSEC_SCP_RND_CTL3

Bits Description
12 Trigger first LFSR
16 Trigger second LFSR

Unofficial name.

TSEC_SCP_RND_CTL4

Bits Description
0-31 First LFSR's polynomial for RNG's test mode

Unofficial name.

TSEC_SCP_RND_CTL5

Bits Description
0-31 First LFSR's initial state for RNG's test mode

Unofficial name.

TSEC_SCP_RND_CTL6

Bits Description
0-31 Second LFSR's polynomial for RNG's test mode

Unofficial name.

TSEC_SCP_RND_CTL7

Bits Description
0-31 Second LFSR's initial state for RNG's test mode

Unofficial name.

TSEC_SCP_RND_CTL8

Bits Description
0-15 Unknown
16-31 Unknown

Unofficial name.

TSEC_SCP_RND_CTL9

Bits Description
0-15 Unknown
16-31 Unknown

Unofficial name.

TSEC_SCP_RND_CTL10

Bits Description
0-15 Unknown
16-31 Unknown

Unofficial name.

TSEC_SCP_RND_CTL11

Bits Description
0 Unknown
1 Unknown
2 Unknown
3 Unknown
4-5 First sampler's source 
0: Oscillator
1: Unknown
2: LFSR
3: Dummy
6-7 Second sampler's source 
0: Oscillator
1: Unknown
2: LFSR
3: Dummy
8-11 First sampler's tap value
12-15 Second sampler's tap value
16-19 Unknown
20-23 Unknown
24-30 Unknown
31 Unknown

Unofficial name.

TSEC_TFBIF_CTL

Bits Description
0 TSEC_TFBIF_CTL_CLR_BWCOUNT
1 TSEC_TFBIF_CTL_ENABLE
2 TSEC_TFBIF_CTL_CLR_IDLEWDERR
3 TSEC_TFBIF_CTL_RESET
4 TSEC_TFBIF_CTL_IDLE
5 TSEC_TFBIF_CTL_IDLEWDERR
6 TSEC_TFBIF_CTL_SRTOUT
7 TSEC_TFBIF_CTL_CLR_SRTOUT
8-11 TSEC_TFBIF_CTL_SRTOVAL
12 TSEC_TFBIF_CTL_VPR

TSEC_TFBIF_MCCIF_FIFOCTRL

Bits Description
0 TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
1 TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
2 TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
3 TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
4 TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
5 TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
6 TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
7 TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
8 TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE

TSEC_TFBIF_THROTTLE

Bits Description
0-11 TSEC_TFBIF_THROTTLE_BUCKET_SIZE
16-27 TSEC_TFBIF_THROTTLE_LEAK_COUNT
30-31 TSEC_TFBIF_THROTTLE_LEAK_SIZE

TSEC_TFBIF_DBG_STAT0

Bits Description
0 TSEC_TFBIF_DBG_STAT0_1K_TRANSFER
1 TSEC_TFBIF_DBG_STAT0_RREQ_ISSUED
2 TSEC_TFBIF_DBG_STAT0_WREQ_ISSUED
3 TSEC_TFBIF_DBG_STAT0_TAGQ_ISSUED
4 TSEC_TFBIF_DBG_STAT0_STALL_RDATQ
5 TSEC_TFBIF_DBG_STAT0_STALL_RACKQ
6 TSEC_TFBIF_DBG_STAT0_STALL_WREQQ
7 TSEC_TFBIF_DBG_STAT0_STALL_WDATQ
8 TSEC_TFBIF_DBG_STAT0_STALL_WACKQ
9 TSEC_TFBIF_DBG_STAT0_STALL_RREQ_PENDING
10 TSEC_TFBIF_DBG_STAT0_STALL_WREQ_PENDING
11 TSEC_TFBIF_DBG_STAT0_STALL_MREQ
12 TSEC_TFBIF_DBG_STAT0_ENGINE_IDLE
13 TSEC_TFBIF_DBG_STAT0_RMCCIF_IDLE
14 TSEC_TFBIF_DBG_STAT0_WMCCIF_IDLE
15 TSEC_TFBIF_DBG_STAT0_CSB_IDLE
16 TSEC_TFBIF_DBG_STAT0_RU_IDLE
17 TSEC_TFBIF_DBG_STAT0_WU_IDLE
19 TSEC_TFBIF_DBG_STAT0_UNWEIGHT_ACTMON_ACTIVE
20 TSEC_TFBIF_DBG_STAT0_UNWEIGHT_ACTMON_MCB

TSEC_TFBIF_DBG_STAT1

Bits Description
0-31 TSEC_TFBIF_DBG_STAT1_DATA

TSEC_TFBIF_DBG_RDCOUNT_LO

Bits Description
0-31 TSEC_TFBIF_DBG_RDCOUNT_LO_DATA

TSEC_TFBIF_DBG_RDCOUNT_HI

Bits Description
0-31 TSEC_TFBIF_DBG_RDCOUNT_HI_DATA

TSEC_TFBIF_DBG_WRCOUNT_LO

Bits Description
0-31 TSEC_TFBIF_DBG_WRCOUNT_LO_DATA

TSEC_TFBIF_DBG_WRCOUNT_HI

Bits Description
0-31 TSEC_TFBIF_DBG_WRCOUNT_HI_DATA

TSEC_TFBIF_DBG_R32COUNT

Bits Description
0-31 TSEC_TFBIF_DBG_R32COUNT_DATA

TSEC_TFBIF_DBG_R64COUNT

Bits Description
0-31 TSEC_TFBIF_DBG_R64COUNT_DATA

TSEC_TFBIF_DBG_R128COUNT

Bits Description
0-31 TSEC_TFBIF_DBG_R128COUNT_DATA

TSEC_TFBIF_MCCIF_FIFOCTRL1

Bits Description
0-15 TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
16-31 TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT

TSEC_TFBIF_SPROT_EMEM

Bits Description
0-2 Read access level
3 Set on memory read access violation
4-6 Write access level
7 Set on memory write access violation

Unofficial name.

Controls accesses to external memory regions. Accessible in HS mode only.

TSEC_TFBIF_TRANSCFG

Bits Description
0 TSEC_TFBIF_TRANSCFG_ATT0_SWID
4 TSEC_TFBIF_TRANSCFG_ATT1_SWID
8 TSEC_TFBIF_TRANSCFG_ATT2_SWID
12 TSEC_TFBIF_TRANSCFG_ATT3_SWID
16 TSEC_TFBIF_TRANSCFG_ATT4_SWID
20 TSEC_TFBIF_TRANSCFG_ATT5_SWID
24 TSEC_TFBIF_TRANSCFG_ATT6_SWID
28 TSEC_TFBIF_TRANSCFG_ATT7_SWID

Configures the software ID per CTXDMA port for memory transactions. Software ID 0 (HW_SWID) forces all transactions to go through the SMMU while software ID 1 (PHY_SWID) bypasses it. Accessible in HS mode only.

[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.

TSEC_TFBIF_REGIONCFG

Bits Description
0-2 TSEC_TFBIF_REGIONCFG_T0_APERT_ID
3 TSEC_TFBIF_REGIONCFG_T0_VPR
4-6 TSEC_TFBIF_REGIONCFG_T1_APERT_ID
7 TSEC_TFBIF_REGIONCFG_T1_VPR
8-10 TSEC_TFBIF_REGIONCFG_T2_APERT_ID
11 TSEC_TFBIF_REGIONCFG_T2_VPR
12-14 TSEC_TFBIF_REGIONCFG_T3_APERT_ID
15 TSEC_TFBIF_REGIONCFG_T3_VPR
16-18 TSEC_TFBIF_REGIONCFG_T4_APERT_ID
19 TSEC_TFBIF_REGIONCFG_T4_VPR
20-22 TSEC_TFBIF_REGIONCFG_T5_APERT_ID
23 TSEC_TFBIF_REGIONCFG_T5_VPR
24-26 TSEC_TFBIF_REGIONCFG_T6_APERT_ID
27 TSEC_TFBIF_REGIONCFG_T6_VPR
28-30 TSEC_TFBIF_REGIONCFG_T7_APERT_ID
31 TSEC_TFBIF_REGIONCFG_T7_VPR

Configures the aperture ID and VPR mode per CTXDMA port for memory region accessing. Accessible in HS mode only.

[6.0.0+] The nvhost_tsec firmware sets this register to 0x20 or 0x140 before reading memory from the GPU UCODE carveout.

TSEC_CG

Bits Description
0-5 TSEC_CG_IDLE_CG_DLY_CNT
6 TSEC_CG_IDLE_CG_EN
16-18 TSEC_CG_WAKEUP_DLY_CNT
19 TSEC_CG_WAKEUP_DLY_EN

TSEC_BAR0_CTL

Bits Description
0 TSEC_BAR0_CTL_READ
1 TSEC_BAR0_CTL_WRITE
4-7 TSEC_BAR0_CTL_BYTE_MASK
12-13 TSEC_BAR0_CTL_STATUS 
0: Idle
1: Busy
2: Error
3: Disabled
16-17 TSEC_BAR0_CTL_SEC_MODE 
0: Non-secure
1: Invalid
2: Light Secure
3: Heavy Secure
31 TSEC_BAR0_CTL_INIT

Unofficial name.

Controls DMA transfers between TSEC and HOST1X (master and clients).

Starting a transfer over BAR0 automatically sets TSEC_BAR0_CTL_SEC_MODE to the current Falcon security mode. Once set, any attempts to start a transfer from a lower security level will fail.

TSEC_BAR0_ADDR

Bits Description
0-31 TSEC_BAR0_ADDR_VAL

Unofficial name.

Takes the address for DMA transfers between TSEC and HOST1X (master and clients).

TSEC_BAR0_DATA

Bits Description
0-31 TSEC_BAR0_DATA_VAL

Unofficial name.

Takes the data for DMA transfers between TSEC and HOST1X (master and clients).

TSEC_BAR0_TIMEOUT

Bits Description
0-31 TSEC_BAR0_TIMEOUT_VAL

Unofficial name.

Takes the timeout value for DMA transfers between TSEC and HOST1X (master and clients).

TSEC_VERSION

Bits Description
0-31 Version

Unofficial name.

TSEC_SCRATCH0

Bits Description
0-31 Value

Unofficial name.

TSEC_SCRATCH1

Bits Description
0-31 Value

Unofficial name.

TSEC_SCRATCH2

Bits Description
0-31 Value

Unofficial name.

TSEC_SCRATCH3

Bits Description
0-31 Value

Unofficial name.

TSEC_SCRATCH4

Bits Description
0-31 Value

Unofficial name.

TSEC_SCRATCH5

Bits Description
0-31 Value

Unofficial name.

TSEC_SCRATCH6

Bits Description
0-31 Value

Unofficial name.

TSEC_SCRATCH7

Bits Description
0-31 Value

Unofficial name.

TSEC_GPTMRINT

Unofficial name.

Same as TSEC_FALCON_GPTMRINT, but for an unknown hardware block.

TSEC_GPTMRVAL

Unofficial name.

Same as TSEC_FALCON_GPTMRVAL, but for an unknown hardware block.

TSEC_GPTMRCTL

Unofficial name.

Same as TSEC_FALCON_GPTMRCTL, but for an unknown hardware block.

TSEC_ITFEN

Bits Description
0 Enable TSEC_GPTMRINT
1 Unknown
2 Unknown
3 Unknown

Unofficial name.

TSEC_ITFSTAT

Bits Description
0 TSEC_GPTMRINT is enabled
1 Unknown
2 Unknown
3 Unknown

Unofficial name.

TSEC_TEGRA_CTL

Bits Description
16 TSEC_TEGRA_CTL_TKFI_KFUSE
17 TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
24 TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
25 TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
26 TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
27 TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C

Falcon

"Falcon" (FAst Logic CONtroller) is a proprietary general purpose CPU which can be found inside various hardware blocks that require some sort of logic processing such as TSEC (TSECA and TSECB), NVDEC, NVENC, NVJPG, VIC, GPU PMU and XUSB.

Processor Registers

A total of 32 processor registers are available in the Falcon CPU.

REG0-REG15

These are 16 32-bit GPRs (general purpose registers).

IV0

This is a SPR (special purpose register) that holds the address for interrupt vector 0. Only bits 0 to 15 are used.

IV1

This is a SPR (special purpose register) that holds the address for interrupt vector 1. Only bits 0 to 15 are used.

IV2

This is a SPR (special purpose register) that holds the address for interrupt vector 2. This register is considered "UNDEFINED" and appears to be unused.

EV

This is a SPR (special purpose register) that holds the address for the exception vector. Only bits 0 to 15 are used.

Alternative name (envytools): "tv".

SP

This is a SPR (special purpose register) that holds the current stack pointer. Only bits 0 to 15 are used.

PC

This is a SPR (special purpose register) that holds the current program counter. Only bits 0 to 15 are used.

IMB

This is a SPR (special purpose register) that holds the external base address for IMEM transfers.

Alternative name (envytools): "xcbase".

DMB

This is a SPR (special purpose register) that holds the external base address for DMEM transfers.

Alternative name (envytools): "xdbase".

CSW

This is a SPR (special purpose register) that holds various flag bits.

Bits Description
0-7 General purpose predicates
8 ALU carry flag
9 ALU signed overflow flag
10 ALU sign flag
11 ALU zero flag
16 Interrupt 0 enable
17 Interrupt 1 enable
18 Interrupt 2 enable (undefined)
20 Interrupt 0 saved enable
21 Interrupt 1 saved enable
22 Interrupt 2 saved enable (undefined)
24 Exception active
26-31 Unknown

Alternative name (envytools): "flags".

CCR

This is a SPR (special purpose register) that holds configuration bits for the SCP DMA override functionality. The value of this register is set using the "cxset" instruction which provides a way to change the behavior of a variable amount of successively executed DMA-related instructions ("xdwait", "xdst" and "xdld").

Bits Description
0-4 Number of instructions the override is valid for (0x1F means infinite)
5 Crypto source/destination select 
0: Crypto register
1: Crypto stream
6 Bypass mode 
0: Disabled
1: Enabled
7 Internal memory select 
0: DMEM
1: IMEM

Alternative name (envytools): "cx".

SEC

This is a SPR (special purpose register) that holds configuration bits for the SCP authentication process.

Bits Description
0-7 Start of region to authenticate (in pages of 0x100 bytes)
16 Force secure DMA transfers
17 Decrypt region to authenticate
18 Signature check passed
19 Suppress interrupts and exceptions
24-31 Size of region to authenticate (in pages of 0x100 bytes)

Alternative name (envytools): "cauth".

CTX

This is a SPR (special purpose register) that holds configuration bits for the CTXDMA ports.

Bits Description
0-2 CTXDMA port for code loads (xcld)
4-6 CTXDMA port for code stores (invalid)
8-10 CTXDMA port for data loads (xdld)
12-14 CTXDMA port for data stores (xdst)

Alternative name (envytools): "xtargets".

EXCI

This is a SPR (special purpose register) that holds information on raised exceptions.

Bits Description
0-19 Exception PC
20-23 Exception cause

Alternative name (envytools): "tstatus".

SEC1

Only available in Falcon v6+ CPUs, marked as "RESERVED" for v5.

IMB1

Only available in Falcon v6+ CPUs, marked as "RESERVED" for v5.

DMB1

Only available in Falcon v6+ CPUs, marked as "RESERVED" for v5.

Secure BootROM

Certain Falcon CPUs may have an optional "Secure BootROM", but contrary to the common purpose of bootrom code, this doesn't execute while booting the CPU. In fact, being a microprocessor, Falcon is designed to execute user supplied code right off the bat in a clean slate state. However, Falcon can be paired with a secure co-processor and provide a cryptosystem for any hardware block that may require it, originating what is known as a "secretful" unit.

Secretful Falcon CPUs have TSEC_FALCON_HWCFG1_SECURITY_MODEL set to 3, which means they support "Heavy Secure" mode (or "HS" for short). While in HS mode, the Falcon's DMEM and IMEM regions are protected from read and write operations, which effectively hides code and data from attackers.

Entering HS mode first requires uploading code marked as "secure" to Falcon, which can be done from MMIO using TSEC_FALCON_IMEMC with the TSEC_FALCON_IMEMC_SECURE bit set. Upon jumping to a page marked as secret, the INV_INS exception is raised which tells the Falcon to start executing the secure bootrom code.

The secure bootrom lives in a hidden ROM region, instead of IMEM, and is mapped as --x at address 0. On Falcon v5 CPUs its size is 0x367 bytes.

Initialization

The first instructions of the secure bootrom simply save each GPR to the stack and check the contents of the SEC SPR.

Authentication

The main purpose of the secure bootrom is to authenticate the code pages marked as "secure". This is done by first extracting the base address and size of the region to authenticate from the SEC SPR, then calculating a signature over this region and finally comparing it to the value of the SCP register $c6.

If the comparison is successful, bit 18 of SEC SPR is set (which is mirrored in TSEC_FALCON_SVEC_SPR), the signature comparison result in TSEC_SCP_STAT1 is set to 3 and each page from the region to authenticate is marked as valid. Bit 19 of SEC SPR is also automatically set, preventing any interrupts or exceptions from being raised while in HS mode, but contrary to bit 18 this one can be manually cleared by authenticated code.

Below is the authentication algorithm's pseudocode: 

...
// This runs in a loop for each 0x100 bytes page.
cs0begin 0x03
cxsin $c4
cenc $c3 $c5
cxor $c5 $c3
ckeyreg $c4
cxor $c5 $c5
cs0exec 0x11
...
// Use secret 0x01 as key and $c7 as seed.
csecret $c3 1
ckeyreg $c3
cenc $c3 $c7
ckeyreg $c3
cenc $c4 $c5
csigcmp $c4 $c6
...

Decryption

If bit 17 is set in the SEC SPR, the secure bootrom will additionally attempt to decrypt the region to authenticate.

Below is the decryption algorithm's pseudocode: 

...
// Use secret 0x06 as key.
cs0begin 0x03
cxsin $c3
cdec $c4 $c3
cxsout $c4
csecret $c5 0x06
ckexp $c5 $c5
cs0exec 0x10
ckeyreg $c5
...

Exit

The secure bootrom finishes by restoring each GPR from stack and returning from the exception state. This will result in the authenticated code region being executed in HS mode until the current PC points to an address outside of the authenticated region. When this happens, each page from the authenticated region is automatically marked as invalid without any involvement of the secure bootrom, meaning that the secure bootrom is only invoked when entering HS mode.

SCP

"SCP" (Secure Co-Processor) is a proprietary coprocessor which can be found inside every Falcon that supports Heavy Secure Mode. On the Tegra X1 these are TSECA, TSECB, NVDEC and the GPU's PMU.

Hardware

SCP is subdivided into several specialized hardware blocks and interfaces.

LOAD

Block for handling memory reads from SCP to Falcon. It communicates with Falcon over a dedicated interface.

The interface can be enabled or disabled by register TSEC_SCP_CTL0.

STORE

Block for handling memory writes from Falcon to SCP. It communicates with Falcon over a dedicated interface.

The interface can be enabled or disabled by register TSEC_SCP_CTL0.

CMD

Block for translating Falcon crypto operands into SCP commands. It communicates with Falcon over a dedicated interface.

The interface can be enabled or disabled by register TSEC_SCP_CTL0. The status of the current command is reported through register TSEC_SCP_CMD.

SEQ

Block for recording and executing sequences of crypto operations in the form of macros.

Can be enabled or disabled by register TSEC_SCP_CTL0.

CTL

Overseer block for controlling certain SCP features.

Can be enabled or disabled by register TSEC_SCP_CTL0.

Registers TSEC_SCP_CTL_STAT, TSEC_SCP_CTL_LOCK, TSEC_SCP_CTL_SCP, TSEC_SCP_CTL_PKEY and TSEC_SCP_CTL_DBG refer to this block.

AES

Block for providing AES-128-ECB functionality.

RNG

Block for encapsulating and controlling the internal random number generator.

Can be enabled or disabled by register TSEC_SCP_CTL1 and reports the status of the internal random number generator through registers TSEC_SCP_RNG_STAT0 and TSEC_SCP_RNG_STAT1.

RND

Internal random number generator.

Can be configured by the TSEC_SCP_RND_CTLx registers.

Operations

Opcode Name Operand0 Operand1 Operation Precondition Postcondition
0 nop N/A N/A N/A N/A N/A
1 mov $cX $cY $cX = $cY; N/A ACL($cX) = ACL($cY);
2 xsin $cX N/A $cX = read_from_stream(); N/A ACL($cX) = is_mode_hs ? 0x3 : 0x1F;
3 xsout $cX N/A write_to_stream($cX); ((is_mode_hs && (ACL($cX) & 0x2)) || (!is_mode_hs && (ACL($cX) & 0xA))) N/A
4 rnd $cX N/A $cX = read_from_rnd(); N/A ACL($cX) = is_mode_hs ? 0x3 : 0x1F;
5 s0begin immX N/A record_macro_for_N_instructions(0, immX); N/A N/A
6 s0exec immX N/A execute_macro_N_times(0, immX); N/A N/A
7 s1begin immX N/A record_macro_for_N_instructions(1, immX); N/A N/A
8 s1exec immX N/A execute_macro_N_times(1, immX); N/A N/A
9 <invalid> N/A N/A N/A N/A N/A
0xA chmod $cX immY ACL($cX) = immY; See ACLs N/A
0xB xor $cX $cY $cX ^= $cY; ((is_mode_hs && (ACL($cX) & 0x2) && (ACL($cY) & 0x2)) || (!is_mode_hs && (ACL($cX) & 0x1A) && (ACL($cY) & 0xA))) ACL($cX) = ACL($cY);
0xC add $cX immY $cX += immY; ((is_mode_hs && (ACL($cX) & 0x2)) || (!is_mode_hs && (ACL($cX) & 0x1A))) N/A
0xD and $cX $cY $cX &= $cY; ((is_mode_hs && (ACL($cX) & 0x2) && (ACL($cY) & 0x2)) || (!is_mode_hs && (ACL($cX) & 0x1A) && (ACL($cY) & 0xA))) ACL($cX) = ACL($cY);
0xE rev $cX $cY $cX = endian_swap128($cY); (is_mode_hs || (!is_mode_hs && (ACL($cX) & 0x10))) ACL($cX) = ACL($cY);
0xF gfmul $cX $cY $cX = gfmul($cY); ((is_mode_hs && (ACL($cX) & 0x2) && (ACL($cY) & 0x2)) || (!is_mode_hs && (ACL($cX) & 0x1A) && (ACL($cY) & 0xA))) ACL($cX) = ACL($cY);
0x10 secret $cX immY $cX = load_secret(immY); N/A ACL($cX) = load_secret_acl(immY);
0x11 keyreg $cX N/A active_key = $cX; N/A N/A
0x12 kexp $cX $cY $cX = aes_key_expand($cY); (is_mode_hs || (!is_mode_hs && (ACL($cX) & 0x10))) ACL($cX) = ACL($cY);
0x13 krexp $cX $cY $cX = aes_key_reverse_expand($cY); (is_mode_hs || (!is_mode_hs && (ACL($cX) & 0x10))) ACL($cX) = ACL($cY);
0x14 enc $cX $cY $cX = aes_enc(active_key, $cY); N/A ACL($cX) = (ACL(active_key) & ACL($cY));
0x15 dec $cX $cY $cX = aes_dec(active_key, $cY); N/A ACL($cX) = (ACL(active_key) & ACL($cY));
0x16 sigcmp $cX $cY current_sig = memcmp($cX, $cY) ? NULL : $cX; (is_mode_secure_bootrom && (ACL($cY) & 0x2)) is_mode_hs = has_sig = (current_sig != NULL);
0x17 sigenc $cX $cY $cX = aes_enc($cY, current_sig); (is_mode_hs && has_sig) ACL($cX) = 0x3;
0x18 sigclr N/A N/A current_sig = NULL; (is_mode_hs && has_sig) has_sig = false;

rnd

00000000: f5 3c 0X 90 crnd $cX

This instruction initializes a crypto register with random data.

Executing this instruction only succeeds if the RNG controller is enabled for the SCP, which requires taking the following steps:

Otherwise it hangs forever.

chmod

00000000: f5 3c XY a8 cchmod $cY 0X or 00000000: f5 3c XY a9 cchmod $cY 1X

This instruction takes a crypto register and a 5 bit immediate value which represents the ACLs mask to set.

sigcmp

00000000: f5 3c XY d8 csigcmp $cY $cX

Takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret. This instruction does not work in secure mode.

sigclr

00000000: f5 3c 00 e0 csigclr

This instruction takes no operands and clears the saved cauth signature used by the csigenc instruction.

ACLs

Each crypto register has an associated access control list with the following format:

Bit Description
0 Secure Keyable
1 Secure Readable
2 Insecure Keyable
3 Insecure Readable
4 Insecure Writeable

On boot, every crypto register has an ACL value of 0x1F.

In HS mode, STORE can always write to a crypto register. In NS and LS modes, STORE can only write to a crypto register if it has the Insecure Writeable access mode.

In HS mode, LOAD can only retrieve a crypto register's value if it has the Secure Readable access mode. In NS and LS modes, LOAD can only retrieve a crypto register's value if it has the Insecure Readable and Secure Readable access modes.

Loading a secret into a crypto register sets a per-secret ACL, unconditionally.

Secure Keyable

Controls if a crypto register can be used as key in HS mode.

Forced set if the crypto register has Secure Readable access. Once cleared, this access mode cannot be set again.

Secure Readable

Controls if a crypto register can be read in HS mode.

Once cleared, this access mode cannot be set again.

Insecure Keyable

Controls if a crypto register can be used as key in NS and LS modes.

Forced set if the crypto register has Insecure Readable access. This access mode cannot be set if the crypto register doesn't have Secure Keyable access.

Insecure Readable

Controls if a crypto register can be read in NS and LS modes.

This access mode cannot be set if the crypto register doesn't have Secure Readable access.

Insecure Writeable

Controls if a crypto register can be written to in NS and LS modes.

This access mode has no effect in HS mode.

Secrets

Heavy Secure Mode has access to 64 128-bit keys which are burned at factory. These keys can be loaded using the $csecret instruction which takes the target crypto register and the key index as arguments.

Secrets are specific to each Falcon unit with the exception of secret 0x3F. This secret is effectively empty (all zeros), but is configured to be overwritten with the KFUSE private key once the KFUSE clock is enabled. The KFUSE private key is console-unique.

Index ACL Description
0x00 0x03 Used by Keygen, nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares.
0x01 0x00 Used by Falcon's Secure BootROM for the signature generation algorithm.
0x02 0x00
0x03 0x01 Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
0x04 0x00 Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
0x05 0x03 Used by nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares.
0x06 0x01 Used by Falcon's Secure BootROM as key to decrypt data during authentication (decided by bit 17 in the SEC register).
0x07 0x01 Used by [6.0.0+] nvhost_tsec firmware.
0x08 0x00
0x09 0x03 Used by nvhost_tsec firmware.
0x0A 0x01
0x0B 0x00 Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
0x0C 0x03
0x0D 0x01
0x0E 0x00
0x0F 0x03 Used by nvhost_tsec firmware.
0x10 0x01 Used by [1.0.0-5.1.0] nvhost_tsec firmware.
0x11 0x00
0x12 0x03
0x13 0x01
0x14 0x00
0x15 0x03 Used by nvhost_nvdec_bl020_prod, [5.0.0+] nvhost_nvdec020_prod, [5.0.0+] nvhost_nvdec020_ns and [6.0.0+] nvhost_tsec firmwares.
0x16 0x01
0x17 0x00 Used by [11.0.0+] nvhost_tsec firmware.
0x18 0x03
0x19 0x01
0x1A 0x00
0x1B 0x03
0x1C 0x01
0x1D 0x00
0x1E 0x03
0x1F 0x01
0x20 0x00
0x21 0x03
0x22 0x01
0x23 0x00
0x24 0x03
0x25 0x01
0x26 0x00 Used by KeygenLdr and SecureBoot
0x27 0x03
0x28 0x01
0x29 0x00
0x2A 0x03
0x2B 0x01
0x2C 0x00
0x2D 0x03
0x2E 0x01
0x2F 0x00
0x30 0x03
0x31 0x01
0x32 0x00
0x33 0x03
0x34 0x01
0x35 0x00
0x36 0x03
0x37 0x01
0x38 0x00
0x39 0x03
0x3A 0x01
0x3B 0x00
0x3C 0x03 Used by nvhost_tsec firmware.
0x3D 0x01
0x3E 0x00
0x3F 0x00 Used by Keygen, nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
Retrieved from "https://switchbrew.org/w/index.php?title=TSEC&oldid=11886"