Nintendo Switch Brew

TSEC: Difference between revisions

← Older edit
oops... thanks Tango
No edit summary
 
(63 intermediate revisions by 2 users not shown)
Line 5: Line 5:


== Registers ==
== Registers ==
Registers from 0x54500000 to 0x54501000 are used to configure the host interface (HOST1X).
The TSEC's MMIO space is divided as follows:
 
* 0x54500000 to 0x54501000: THI (Tegra Host Interface)
Registers from 0x54501000 to 0x54502000 are a MMIO window for communicating with the Falcon microprocessor. From this range, the subset of registers from 0x54501400 to 0x54501FE8 are specific to the TSEC and are subdivided into:
* 0x54501000 to 0x54501400: [[#Falcon|FALCON (Falcon microcontroller)]]
* 0x54501400 to 0x54501500: SCP (Secure Co-Processor).
* 0x54501400 to 0x54501600: [[#SCP|SCP (Secure coprocessor)]]
* 0x54501500 to 0x54501600: TRNG (True Random Number Generator).
* 0x54501600 to 0x54501680: TFBIF (Tegra Framebuffer Interface)
* 0x54501600 to 0x54501700: TFBIF (Tegra Framebuffer Interface) and CG (Clock Gate).
* 0x54501680 to 0x54501700: CG (Clock Gate)
* 0x54501700 to 0x54501800: DMA.
* 0x54501700 to 0x54501800: BAR0 (HOST1X device DMA)
* 0x54501800 to 0x54501900: TEGRA (miscellaneous interfaces).
* 0x54501800 to 0x54501900: TEGRA (Miscellaneous interfaces)


{| class="wikitable" border="1"
{| class="wikitable" border="1"
Line 19: Line 19:
!  Width
!  Width
|-
|-
| TSEC_THI_INCR_SYNCPT
| [[#TSEC_THI_INCR_SYNCPT|TSEC_THI_INCR_SYNCPT]]
| 0x54500000
| 0x54500000
| 0x04
| 0x04
|-
|-
| TSEC_THI_INCR_SYNCPT_ERR
| [[#TSEC_THI_INCR_SYNCPT_CTRL|TSEC_THI_INCR_SYNCPT_CTRL]]
| 0x54500004
| 0x04
|-
| [[#TSEC_THI_INCR_SYNCPT_ERR|TSEC_THI_INCR_SYNCPT_ERR]]
| 0x54500008
| 0x54500008
| 0x04
| 0x04
|-
|-
| TSEC_THI_CTXSW_INCR_SYNCPT
| [[#TSEC_THI_CTXSW_INCR_SYNCPT|TSEC_THI_CTXSW_INCR_SYNCPT]]
| 0x5450000C
| 0x5450000C
| 0x04
| 0x04
|-
|-
| TSEC_THI_CTXSW
| [[#TSEC_THI_CTXSW|TSEC_THI_CTXSW]]
| 0x54500020
| 0x54500020
| 0x04
| 0x04
|-
|-
| TSEC_THI_CONT_SYNCPT_EOF
| [[#TSEC_THI_CTXSW_NEXT|TSEC_THI_CTXSW_NEXT]]
| 0x54500024
| 0x04
|-
| [[#TSEC_THI_CONT_SYNCPT_EOF|TSEC_THI_CONT_SYNCPT_EOF]]
| 0x54500028
| 0x54500028
| 0x04
|-
| [[#TSEC_THI_CONT_SYNCPT_L1|TSEC_THI_CONT_SYNCPT_L1]]
| 0x5450002C
| 0x04
| 0x04
|-
|-
Line 45: Line 57:
| [[#TSEC_THI_METHOD1|TSEC_THI_METHOD1]]
| [[#TSEC_THI_METHOD1|TSEC_THI_METHOD1]]
| 0x54500044
| 0x54500044
| 0x04
|-
| [[#TSEC_THI_CONTEXT_SWITCH|TSEC_THI_CONTEXT_SWITCH]]
| 0x54500060
| 0x04
| 0x04
|-
|-
Line 55: Line 71:
| 0x04
| 0x04
|-
|-
| TSEC_THI_INT_CLEAR
| [[#TSEC_THI_CONFIG0|TSEC_THI_CONFIG0]]
| 0x54500080
| 0x54500080
| 0x04
| 0x04
|-
|-
| TSEC_THI_INT_ENABLE
| [[#TSEC_THI_DBG_MISC|TSEC_THI_DBG_MISC]]
| 0x54500084
| 0x54500084
| 0x04
| 0x04
|-
|-
| TSEC_THI_SLCG_OVERRIDE_HIGH_A
| [[#TSEC_THI_SLCG_OVERRIDE_HIGH_A|TSEC_THI_SLCG_OVERRIDE_HIGH_A]]
| 0x54500088
| 0x54500088
| 0x04
| 0x04
|-
|-
| TSEC_THI_SLCG_OVERRIDE_LOW_A
| [[#TSEC_THI_SLCG_OVERRIDE_LOW_A|TSEC_THI_SLCG_OVERRIDE_LOW_A]]
| 0x5450008C
| 0x5450008C
| 0x04
| 0x04
|-
|-
| TSEC_THI_CLK_OVERRIDE
| [[#TSEC_THI_CLK_OVERRIDE|TSEC_THI_CLK_OVERRIDE]]
| 0x54500E00
| 0x54500E00
| 0x04
| 0x04
|-
|-
| [[#FALCON_IRQSSET|FALCON_IRQSSET]]
| [[#TSEC_FALCON_IRQSSET|TSEC_FALCON_IRQSSET]]
| 0x54501000
| 0x54501000
| 0x04
| 0x04
|-
|-
| [[#FALCON_IRQSCLR|FALCON_IRQSCLR]]
| [[#TSEC_FALCON_IRQSCLR|TSEC_FALCON_IRQSCLR]]
| 0x54501004
| 0x54501004
| 0x04
| 0x04
|-
|-
| [[#FALCON_IRQSTAT|FALCON_IRQSTAT]]
| [[#TSEC_FALCON_IRQSTAT|TSEC_FALCON_IRQSTAT]]
| 0x54501008
| 0x54501008
| 0x04
| 0x04
|-
|-
| [[#FALCON_IRQMODE|FALCON_IRQMODE]]
| [[#TSEC_FALCON_IRQMODE|TSEC_FALCON_IRQMODE]]
| 0x5450100C
| 0x5450100C
| 0x04
| 0x04
|-
|-
| [[#FALCON_IRQMSET|FALCON_IRQMSET]]
| [[#TSEC_FALCON_IRQMSET|TSEC_FALCON_IRQMSET]]
| 0x54501010
| 0x54501010
| 0x04
| 0x04
|-
|-
| [[#FALCON_IRQMCLR|FALCON_IRQMCLR]]
| [[#TSEC_FALCON_IRQMCLR|TSEC_FALCON_IRQMCLR]]
| 0x54501014
| 0x54501014
| 0x04
| 0x04
|-
|-
| [[#FALCON_IRQMASK|FALCON_IRQMASK]]
| [[#TSEC_FALCON_IRQMASK|TSEC_FALCON_IRQMASK]]
| 0x54501018
| 0x54501018
| 0x04
| 0x04
|-
|-
| [[#FALCON_IRQDEST|FALCON_IRQDEST]]
| [[#TSEC_FALCON_IRQDEST|TSEC_FALCON_IRQDEST]]
| 0x5450101C
| 0x5450101C
| 0x04
| 0x04
|-
|-
| FALCON_GPTMRINT
| [[#TSEC_FALCON_GPTMRINT|TSEC_FALCON_GPTMRINT]]
| 0x54501020
| 0x54501020
| 0x04
| 0x04
|-
|-
| FALCON_GPTMRVAL
| [[#TSEC_FALCON_GPTMRVAL|TSEC_FALCON_GPTMRVAL]]
| 0x54501024
| 0x54501024
| 0x04
| 0x04
|-
|-
| FALCON_GPTMRCTL
| [[#TSEC_FALCON_GPTMRCTL|TSEC_FALCON_GPTMRCTL]]
| 0x54501028
| 0x54501028
| 0x04
| 0x04
|-
|-
| FALCON_PTIMER0
| [[#TSEC_FALCON_PTIMER0|TSEC_FALCON_PTIMER0]]
| 0x5450102C
| 0x5450102C
| 0x04
| 0x04
|-
|-
| FALCON_PTIMER1
| [[#TSEC_FALCON_PTIMER1|TSEC_FALCON_PTIMER1]]
| 0x54501030
| 0x54501030
| 0x04
| 0x04
|-
|-
| FALCON_WDTMRVAL
| [[#TSEC_FALCON_WDTMRVAL|TSEC_FALCON_WDTMRVAL]]
| 0x54501034
| 0x54501034
| 0x04
| 0x04
|-
|-
| FALCON_WDTMRCTL
| [[#TSEC_FALCON_WDTMRCTL|TSEC_FALCON_WDTMRCTL]]
| 0x54501038
| 0x54501038
| 0x04
| 0x04
|-
|-
| FALCON_UNK_3C
| [[#TSEC_FALCON_IRQDEST2|TSEC_FALCON_IRQDEST2]]
| 0x5450103C
| 0x5450103C
| 0x04
| 0x04
|-
|-
| [[#FALCON_MAILBOX0|FALCON_MAILBOX0]]
| [[#TSEC_FALCON_MAILBOX0|TSEC_FALCON_MAILBOX0]]
| 0x54501040
| 0x54501040
| 0x04
| 0x04
|-
|-
| [[#FALCON_MAILBOX1|FALCON_MAILBOX1]]
| [[#TSEC_FALCON_MAILBOX1|TSEC_FALCON_MAILBOX1]]
| 0x54501044
| 0x54501044
| 0x04
| 0x04
|-
|-
| [[#FALCON_ITFEN|FALCON_ITFEN]]
| [[#TSEC_FALCON_ITFEN|TSEC_FALCON_ITFEN]]
| 0x54501048
| 0x54501048
| 0x04
| 0x04
|-
|-
| [[#FALCON_IDLESTATE|FALCON_IDLESTATE]]
| [[#TSEC_FALCON_IDLESTATE|TSEC_FALCON_IDLESTATE]]
| 0x5450104C
| 0x5450104C
| 0x04
| 0x04
|-
|-
| FALCON_CURCTX
| [[#TSEC_FALCON_CURCTX|TSEC_FALCON_CURCTX]]
| 0x54501050
| 0x54501050
| 0x04
| 0x04
|-
|-
| FALCON_NXTCTX
| [[#TSEC_FALCON_NXTCTX|TSEC_FALCON_NXTCTX]]
| 0x54501054
| 0x54501054
| 0x04
| 0x04
|-
|-
| FALCON_CTXACK
| [[#TSEC_FALCON_CTXACK|TSEC_FALCON_CTXACK]]
| 0x54501058
| 0x54501058
| 0x04
| 0x04
|-
|-
| FALCON_FHSTATE
| [[#TSEC_FALCON_FHSTATE|TSEC_FALCON_FHSTATE]]
| 0x5450105C
| 0x5450105C
| 0x04
| 0x04
|-
|-
| FALCON_PRIVSTATE
| [[#TSEC_FALCON_PRIVSTATE|TSEC_FALCON_PRIVSTATE]]
| 0x54501060
| 0x54501060
| 0x04
| 0x04
|-
|-
| FALCON_MTHDDATA
| [[#TSEC_FALCON_MTHDDATA|TSEC_FALCON_MTHDDATA]]
| 0x54501064
| 0x54501064
| 0x04
| 0x04
|-
|-
| FALCON_MTHDID
| [[#TSEC_FALCON_MTHDID|TSEC_FALCON_MTHDID]]
| 0x54501068
| 0x54501068
| 0x04
| 0x04
|-
|-
| FALCON_MTHDWDAT
| [[#TSEC_FALCON_MTHDWDAT|TSEC_FALCON_MTHDWDAT]]
| 0x5450106C
| 0x5450106C
| 0x04
| 0x04
|-
|-
| FALCON_MTHDCOUNT
| [[#TSEC_FALCON_MTHDCOUNT|TSEC_FALCON_MTHDCOUNT]]
| 0x54501070
| 0x54501070
| 0x04
| 0x04
|-
|-
| FALCON_MTHDPOP
| [[#TSEC_FALCON_MTHDPOP|TSEC_FALCON_MTHDPOP]]
| 0x54501074
| 0x54501074
| 0x04
| 0x04
|-
|-
| FALCON_MTHDRAMSZ
| [[#TSEC_FALCON_MTHDRAMSZ|TSEC_FALCON_MTHDRAMSZ]]
| 0x54501078
| 0x54501078
| 0x04
| 0x04
|-
|-
| FALCON_SFTRESET
| [[#TSEC_FALCON_SFTRESET|TSEC_FALCON_SFTRESET]]
| 0x5450107C
| 0x5450107C
| 0x04
| 0x04
|-
|-
| FALCON_OS
| [[#TSEC_FALCON_OS|TSEC_FALCON_OS]]
| 0x54501080
| 0x54501080
| 0x04
| 0x04
|-
|-
| FALCON_RM
| [[#TSEC_FALCON_RM|TSEC_FALCON_RM]]
| 0x54501084
| 0x54501084
| 0x04
| 0x04
|-
|-
| FALCON_SOFT_PM
| [[#TSEC_FALCON_SOFT_PM|TSEC_FALCON_SOFT_PM]]
| 0x54501088
| 0x54501088
| 0x04
| 0x04
|-
|-
| FALCON_SOFT_MODE
| [[#TSEC_FALCON_SOFT_MODE|TSEC_FALCON_SOFT_MODE]]
| 0x5450108C
| 0x5450108C
| 0x04
| 0x04
|-
|-
| [[#FALCON_DEBUG1|FALCON_DEBUG1]]
| [[#TSEC_FALCON_DEBUG1|TSEC_FALCON_DEBUG1]]
| 0x54501090
| 0x54501090
| 0x04
| 0x04
|-
|-
| [[#FALCON_DEBUGINFO|FALCON_DEBUGINFO]]
| [[#TSEC_FALCON_DEBUGINFO|TSEC_FALCON_DEBUGINFO]]
| 0x54501094
| 0x54501094
| 0x04
| 0x04
|-
|-
| FALCON_IBRKPT1
| [[#TSEC_FALCON_IBRKPT1|TSEC_FALCON_IBRKPT1]]
| 0x54501098
| 0x54501098
| 0x04
| 0x04
|-
|-
| FALCON_IBRKPT2
| [[#TSEC_FALCON_IBRKPT2|TSEC_FALCON_IBRKPT2]]
| 0x5450109C
| 0x5450109C
| 0x04
| 0x04
|-
|-
| FALCON_CGCTL
| [[#TSEC_FALCON_CGCTL|TSEC_FALCON_CGCTL]]
| 0x545010A0
| 0x545010A0
| 0x04
| 0x04
|-
|-
| FALCON_ENGCTL
| [[#TSEC_FALCON_ENGCTL|TSEC_FALCON_ENGCTL]]
| 0x545010A4
| 0x545010A4
| 0x04
| 0x04
|-
|-
| FALCON_PMM
| [[#TSEC_FALCON_PMM|TSEC_FALCON_PMM]]
| 0x545010A8
| 0x545010A8
| 0x04
| 0x04
|-
|-
| FALCON_ADDR
| [[#TSEC_FALCON_ADDR|TSEC_FALCON_ADDR]]
| 0x545010AC
| 0x545010AC
| 0x04
| 0x04
|-
|-
| FALCON_IBRKPT3
| [[#TSEC_FALCON_IBRKPT3|TSEC_FALCON_IBRKPT3]]
| 0x545010B0
| 0x545010B0
| 0x04
| 0x04
|-
|-
| FALCON_IBRKPT4
| [[#TSEC_FALCON_IBRKPT4|TSEC_FALCON_IBRKPT4]]
| 0x545010B4
| 0x545010B4
| 0x04
| 0x04
|-
|-
| FALCON_IBRKPT5
| [[#TSEC_FALCON_IBRKPT5|TSEC_FALCON_IBRKPT5]]
| 0x545010B8
| 0x545010B8
| 0x04
| 0x04
|-
|-
| [[#FALCON_EXCI|FALCON_EXCI]]
| [[#TSEC_FALCON_EXCI|TSEC_FALCON_EXCI]]
| 0x545010D0
| 0x545010D0
| 0x04
| 0x04
|-
|-
| FALCON_UNK_D4
| [[#TSEC_FALCON_SVEC_SPR|TSEC_FALCON_SVEC_SPR]]
| 0x545010D4
| 0x545010D4
| 0x04
| 0x04
|-
|-
| FALCON_UNK_D8
| [[#TSEC_FALCON_RSTAT0|TSEC_FALCON_RSTAT0]]
| 0x545010D8
| 0x545010D8
| 0x04
| 0x04
|-
|-
| FALCON_UNK_DC
| [[#TSEC_FALCON_RSTAT3|TSEC_FALCON_RSTAT3]]
| 0x545010DC
| 0x545010DC
| 0x04
| 0x04
|-
|-
| FALCON_UNK_E0
| [[#TSEC_FALCON_SIRQMASK|TSEC_FALCON_SIRQMASK]]
| 0x545010E0
| 0x545010E0
| 0x04
| 0x04
|-
|-
| [[#FALCON_CPUCTL|FALCON_CPUCTL]]
| [[#TSEC_FALCON_CPUCTL|TSEC_FALCON_CPUCTL]]
| 0x54501100
| 0x54501100
| 0x04
| 0x04
|-
|-
| [[#FALCON_BOOTVEC|FALCON_BOOTVEC]]
| [[#TSEC_FALCON_BOOTVEC|TSEC_FALCON_BOOTVEC]]
| 0x54501104
| 0x54501104
| 0x04
| 0x04
|-
|-
| [[#FALCON_HWCFG|FALCON_HWCFG]]
| [[#TSEC_FALCON_HWCFG|TSEC_FALCON_HWCFG]]
| 0x54501108
| 0x54501108
| 0x04
| 0x04
|-
|-
| [[#FALCON_DMACTL|FALCON_DMACTL]]
| [[#TSEC_FALCON_DMACTL|TSEC_FALCON_DMACTL]]
| 0x5450110C
| 0x5450110C
| 0x04
| 0x04
|-
|-
| [[#FALCON_DMATRFBASE|FALCON_DMATRFBASE]]
| [[#TSEC_FALCON_DMATRFBASE|TSEC_FALCON_DMATRFBASE]]
| 0x54501110
| 0x54501110
| 0x04
| 0x04
|-
|-
| [[#FALCON_DMATRFMOFFS|FALCON_DMATRFMOFFS]]
| [[#TSEC_FALCON_DMATRFMOFFS|TSEC_FALCON_DMATRFMOFFS]]
| 0x54501114
| 0x54501114
| 0x04
| 0x04
|-
|-
| [[#FALCON_DMATRFCMD|FALCON_DMATRFCMD]]
| [[#TSEC_FALCON_DMATRFCMD|TSEC_FALCON_DMATRFCMD]]
| 0x54501118
| 0x54501118
| 0x04
| 0x04
|-
|-
| [[#FALCON_DMATRFFBOFFS|FALCON_DMATRFFBOFFS]]
| [[#TSEC_FALCON_DMATRFFBOFFS|TSEC_FALCON_DMATRFFBOFFS]]
| 0x5450111C
| 0x5450111C
| 0x04
| 0x04
|-
|-
| [[#FALCON_DMAPOLL_FB|FALCON_DMAPOLL_FB]]
| [[#TSEC_FALCON_DMAPOLL_FB|TSEC_FALCON_DMAPOLL_FB]]
| 0x54501120
| 0x54501120
| 0x04
| 0x04
|-
|-
| [[#FALCON_DMAPOLL_CP|FALCON_DMAPOLL_CP]]
| [[#TSEC_FALCON_DMAPOLL_CP|TSEC_FALCON_DMAPOLL_CP]]
| 0x54501124
| 0x54501124
| 0x04
| 0x04
|-
|-
| FALCON_CPUSTAT
| [[#TSEC_FALCON_HWCFG1|TSEC_FALCON_HWCFG1]]
| 0x54501128
| 0x5450112C
| 0x04
| 0x04
|-
|-
| [[#FALCON_HWCFG1|FALCON_HWCFG1]]
| [[#TSEC_FALCON_CPUCTL_ALIAS|TSEC_FALCON_CPUCTL_ALIAS]]
| 0x5450112C
| 0x54501130
| 0x04
| 0x04
|-
|-
| FALCON_CPUCTL_ALIAS
| [[#TSEC_FALCON_STACKCFG|TSEC_FALCON_STACKCFG]]
| 0x54501130
| 0x54501138
| 0x04
| 0x04
|-
|-
| [[#FALCON_IMCTL|FALCON_IMCTL]]
| [[#TSEC_FALCON_IMCTL|TSEC_FALCON_IMCTL]]
| 0x54501140
| 0x54501140
| 0x04
| 0x04
|-
|-
| [[#FALCON_IMSTAT|FALCON_IMSTAT]]
| [[#TSEC_FALCON_IMSTAT|TSEC_FALCON_IMSTAT]]
| 0x54501144
| 0x54501144
| 0x04
| 0x04
|-
|-
| [[#FALCON_TRACEIDX|FALCON_TRACEIDX]]
| [[#TSEC_FALCON_TRACEIDX|TSEC_FALCON_TRACEIDX]]
| 0x54501148
| 0x54501148
| 0x04
| 0x04
|-
|-
| [[#FALCON_TRACEPC|FALCON_TRACEPC]]
| [[#TSEC_FALCON_TRACEPC|TSEC_FALCON_TRACEPC]]
| 0x5450114C
| 0x5450114C
| 0x04
| 0x04
|-
|-
| FALCON_IMFILLRNG0
| [[#TSEC_FALCON_IMFILLRNG0|TSEC_FALCON_IMFILLRNG0]]
| 0x54501150
| 0x54501150
| 0x04
| 0x04
|-
|-
| FALCON_IMFILLRNG1
| [[#TSEC_FALCON_IMFILLRNG1|TSEC_FALCON_IMFILLRNG1]]
| 0x54501154
| 0x54501154
| 0x04
| 0x04
|-
|-
| FALCON_IMFILLCTL
| [[#TSEC_FALCON_IMFILLCTL|TSEC_FALCON_IMFILLCTL]]
| 0x54501158
| 0x54501158
| 0x04
| 0x04
|-
|-
| FALCON_IMCTL_DEBUG
| [[#TSEC_FALCON_IMCTL_DEBUG|TSEC_FALCON_IMCTL_DEBUG]]
| 0x5450115C
| 0x5450115C
| 0x04
| 0x04
|-
|-
| FALCON_EXTERRWIN
| [[#TSEC_FALCON_CMEMBASE|TSEC_FALCON_CMEMBASE]]
| 0x54501160
| 0x54501160
| 0x04
| 0x04
|-
|-
| FALCON_EXTERRCFG
| [[#TSEC_FALCON_DMEMAPERT|TSEC_FALCON_DMEMAPERT]]
| 0x54501164
| 0x54501164
| 0x04
| 0x04
|-
|-
| FALCON_EXTERRADDR
| [[#TSEC_FALCON_EXTERRADDR|TSEC_FALCON_EXTERRADDR]]
| 0x54501168
| 0x54501168
| 0x04
| 0x04
|-
|-
| FALCON_EXTERRSTAT
| [[#TSEC_FALCON_EXTERRSTAT|TSEC_FALCON_EXTERRSTAT]]
| 0x5450116C
| 0x5450116C
| 0x04
| 0x04
|-
|-
| FALCON_CG1_SLCG
| [[#TSEC_FALCON_CG2|TSEC_FALCON_CG2]]
| 0x5450117C
| 0x5450117C
| 0x04
| 0x04
|-
|-
| [[#FALCON_IMEMC|FALCON_IMEMC]]
| [[#TSEC_FALCON_IMEMC|TSEC_FALCON_IMEMC0]]
| 0x54501180
| 0x54501180
| 0x04
| 0x04
|-
|-
| [[#FALCON_IMEMD|FALCON_IMEMD]]
| [[#TSEC_FALCON_IMEMD|TSEC_FALCON_IMEMD0]]
| 0x54501184
| 0x54501184
| 0x04
| 0x04
|-
|-
| [[#FALCON_IMEMT|FALCON_IMEMT]]
| [[#TSEC_FALCON_IMEMT|TSEC_FALCON_IMEMT0]]
| 0x54501188
| 0x54501188
| 0x04
| 0x04
|-
|-
| [[#FALCON_DMEMC0|FALCON_DMEMC0]]
| [[#TSEC_FALCON_IMEMC|TSEC_FALCON_IMEMC1]]
| 0x54501190
| 0x04
|-
| [[#TSEC_FALCON_IMEMD|TSEC_FALCON_IMEMD1]]
| 0x54501194
| 0x04
|-
| [[#TSEC_FALCON_IMEMT|TSEC_FALCON_IMEMT1]]
| 0x54501198
| 0x04
|-
| [[#TSEC_FALCON_IMEMC|TSEC_FALCON_IMEMC2]]
| 0x545011A0
| 0x04
|-
| [[#TSEC_FALCON_IMEMD|TSEC_FALCON_IMEMD2]]
| 0x545011A4
| 0x04
|-
| [[#TSEC_FALCON_IMEMT|TSEC_FALCON_IMEMT2]]
| 0x545011A8
| 0x04
|-
| [[#TSEC_FALCON_IMEMC|TSEC_FALCON_IMEMC3]]
| 0x545011B0
| 0x04
|-
| [[#TSEC_FALCON_IMEMD|TSEC_FALCON_IMEMD3]]
| 0x545011B4
| 0x04
|-
| [[#TSEC_FALCON_IMEMT|TSEC_FALCON_IMEMT3]]
| 0x545011B8
| 0x04
|-
| [[#TSEC_FALCON_DMEMC|TSEC_FALCON_DMEMC0]]
| 0x545011C0
| 0x545011C0
| 0x04
| 0x04
|-
|-
| [[#FALCON_DMEMD0|FALCON_DMEMD0]]
| [[#TSEC_FALCON_DMEMD|TSEC_FALCON_DMEMD0]]
| 0x545011C4
| 0x545011C4
| 0x04
| 0x04
|-
|-
| FALCON_DMEMC1
| [[#TSEC_FALCON_DMEMC|TSEC_FALCON_DMEMC1]]
| 0x545011C8
| 0x545011C8
| 0x04
| 0x04
|-
|-
| FALCON_DMEMD1
| [[#TSEC_FALCON_DMEMD|TSEC_FALCON_DMEMD1]]
| 0x545011CC
| 0x545011CC
| 0x04
| 0x04
|-
|-
| FALCON_DMEMC2
| [[#TSEC_FALCON_DMEMC|TSEC_FALCON_DMEMC2]]
| 0x545011D0
| 0x545011D0
| 0x04
| 0x04
|-
|-
| FALCON_DMEMD2
| [[#TSEC_FALCON_DMEMD|TSEC_FALCON_DMEMD2]]
| 0x545011D4
| 0x545011D4
| 0x04
| 0x04
|-
|-
| FALCON_DMEMC3
| [[#TSEC_FALCON_DMEMC|TSEC_FALCON_DMEMC3]]
| 0x545011D8
| 0x545011D8
| 0x04
| 0x04
|-
|-
| FALCON_DMEMD3
| [[#TSEC_FALCON_DMEMD|TSEC_FALCON_DMEMD3]]
| 0x545011DC
| 0x545011DC
| 0x04
| 0x04
|-
|-
| FALCON_DMEMC4
| [[#TSEC_FALCON_DMEMC|TSEC_FALCON_DMEMC4]]
| 0x545011E0
| 0x545011E0
| 0x04
| 0x04
|-
|-
| FALCON_DMEMD4
| [[#TSEC_FALCON_DMEMD|TSEC_FALCON_DMEMD4]]
| 0x545011E4
| 0x545011E4
| 0x04
| 0x04
|-
|-
| FALCON_DMEMC5
| [[#TSEC_FALCON_DMEMC|TSEC_FALCON_DMEMC5]]
| 0x545011E8
| 0x545011E8
| 0x04
| 0x04
|-
|-
| FALCON_DMEMD5
| [[#TSEC_FALCON_DMEMD|TSEC_FALCON_DMEMD5]]
| 0x545011EC
| 0x545011EC
| 0x04
| 0x04
|-
|-
| FALCON_DMEMC6
| [[#TSEC_FALCON_DMEMC|TSEC_FALCON_DMEMC6]]
| 0x545011F0
| 0x545011F0
| 0x04
| 0x04
|-
|-
| FALCON_DMEMD6
| [[#TSEC_FALCON_DMEMD|TSEC_FALCON_DMEMD6]]
| 0x545011F4
| 0x545011F4
| 0x04
| 0x04
|-
|-
| FALCON_DMEMC7
| [[#TSEC_FALCON_DMEMC|TSEC_FALCON_DMEMC7]]
| 0x545011F8
| 0x545011F8
| 0x04
| 0x04
|-
|-
| FALCON_DMEMD7
| [[#TSEC_FALCON_DMEMD|TSEC_FALCON_DMEMD7]]
| 0x545011FC
| 0x545011FC
| 0x04
| 0x04
|-
|-
| [[#FALCON_ICD_CMD|FALCON_ICD_CMD]]
| [[#TSEC_FALCON_ICD_CMD|TSEC_FALCON_ICD_CMD]]
| 0x54501200
| 0x54501200
| 0x04
| 0x04
|-
|-
| [[#FALCON_ICD_ADDR|FALCON_ICD_ADDR]]
| [[#TSEC_FALCON_ICD_ADDR|TSEC_FALCON_ICD_ADDR]]
| 0x54501204
| 0x54501204
| 0x04
| 0x04
|-
|-
| [[#FALCON_ICD_WDATA|FALCON_ICD_WDATA]]
| [[#TSEC_FALCON_ICD_WDATA|TSEC_FALCON_ICD_WDATA]]
| 0x54501208
| 0x54501208
| 0x04
| 0x04
|-
|-
| [[#FALCON_ICD_RDATA|FALCON_ICD_RDATA]]
| [[#TSEC_FALCON_ICD_RDATA|TSEC_FALCON_ICD_RDATA]]
| 0x5450120C
| 0x5450120C
| 0x04
| 0x04
|-
|-
| [[#FALCON_SCTL|FALCON_SCTL]]
| [[#TSEC_FALCON_SCTL|TSEC_FALCON_SCTL]]
| 0x54501240
| 0x54501240
| 0x04
| 0x04
|-
|-
| [[#FALCON_SCTL_STAT|FALCON_SCTL_STAT]]
| [[#TSEC_FALCON_SERRSTAT|TSEC_FALCON_SERRSTAT]]
| 0x54501244
| 0x54501244
| 0x04
| 0x04
|-
|-
| FALCON_UNK_248
| [[#TSEC_FALCON_SERRVAL|TSEC_FALCON_SERRVAL]]
| 0x54501248
| 0x54501248
| 0x04
| 0x04
|-
|-
| FALCON_UNK_24C
| [[#TSEC_FALCON_SERRADDR|TSEC_FALCON_SERRADDR]]
| 0x5450124C
| 0x5450124C
| 0x04
| 0x04
|-
|-
| FALCON_UNK_250
| [[#TSEC_FALCON_SCTL1|TSEC_FALCON_SCTL1]]
| 0x54501250
| 0x54501250
| 0x04
| 0x04
|-
|-
| FALCON_UNK_260
| [[#TSEC_FALCON_STEST|TSEC_FALCON_STEST]]
| 0x54501258
| 0x04
|-
| [[#TSEC_FALCON_SICD|TSEC_FALCON_SICD]]
| 0x54501260
| 0x54501260
| 0x04
| 0x04
|-
|-
| [[#FALCON_SPROT_IMEM|FALCON_SPROT_IMEM]]
| [[#TSEC_FALCON_SPROT_IMEM|TSEC_FALCON_SPROT_IMEM]]
| 0x54501280
| 0x54501280
| 0x04
| 0x04
|-
|-
| [[#FALCON_SPROT_DMEM|FALCON_SPROT_DMEM]]
| [[#TSEC_FALCON_SPROT_DMEM|TSEC_FALCON_SPROT_DMEM]]
| 0x54501284
| 0x54501284
| 0x04
| 0x04
|-
|-
| [[#FALCON_SPROT_CPUCTL|FALCON_SPROT_CPUCTL]]
| [[#TSEC_FALCON_SPROT_CPUCTL|TSEC_FALCON_SPROT_CPUCTL]]
| 0x54501288
| 0x54501288
| 0x04
| 0x04
|-
|-
| [[#FALCON_SPROT_MISC|FALCON_SPROT_MISC]]
| [[#TSEC_FALCON_SPROT_MISC|TSEC_FALCON_SPROT_MISC]]
| 0x5450128C
| 0x5450128C
| 0x04
| 0x04
|-
|-
| [[#FALCON_SPROT_IRQ|FALCON_SPROT_IRQ]]
| [[#TSEC_FALCON_SPROT_IRQ|TSEC_FALCON_SPROT_IRQ]]
| 0x54501290
| 0x54501290
| 0x04
| 0x04
|-
|-
| [[#FALCON_SPROT_MTHD|FALCON_SPROT_MTHD]]
| [[#TSEC_FALCON_SPROT_MTHD|TSEC_FALCON_SPROT_MTHD]]
| 0x54501294
| 0x54501294
| 0x04
| 0x04
|-
|-
| [[#FALCON_SPROT_SCTL|FALCON_SPROT_SCTL]]
| [[#TSEC_FALCON_SPROT_SCTL|TSEC_FALCON_SPROT_SCTL]]
| 0x54501298
| 0x54501298
| 0x04
| 0x04
|-
|-
| [[#FALCON_SPROT_WDTMR|FALCON_SPROT_WDTMR]]
| [[#TSEC_FALCON_SPROT_WDTMR|TSEC_FALCON_SPROT_WDTMR]]
| 0x5450129C
| 0x5450129C
| 0x04
| 0x04
|-
|-
| FALCON_UNK_2C0
| [[#TSEC_FALCON_DMAINFO_FINISHED_FBRD_LOW|TSEC_FALCON_DMAINFO_FINISHED_FBRD_LOW]]
| 0x545012C0
| 0x545012C0
| 0x04
| 0x04
|-
|-
| FALCON_UNK_2C4
| [[#TSEC_FALCON_DMAINFO_FINISHED_FBRD_HIGH|TSEC_FALCON_DMAINFO_FINISHED_FBRD_HIGH]]
| 0x545012C4
| 0x545012C4
| 0x04
| 0x04
|-
|-
| FALCON_UNK_2C8
| [[#TSEC_FALCON_DMAINFO_FINISHED_FBWR_LOW|TSEC_FALCON_DMAINFO_FINISHED_FBWR_LOW]]
| 0x545012C8
| 0x545012C8
| 0x04
| 0x04
|-
|-
| FALCON_UNK_2CC
| [[#TSEC_FALCON_DMAINFO_FINISHED_FBWR_HIGH|TSEC_FALCON_DMAINFO_FINISHED_FBWR_HIGH]]
| 0x545012CC
| 0x545012CC
| 0x04
| 0x04
|-
|-
| FALCON_UNK_2E0
| [[#TSEC_FALCON_DMAINFO_CURRENT_FBRD_LOW|TSEC_FALCON_DMAINFO_CURRENT_FBRD_LOW]]
| 0x545012E0
| 0x545012D0
| 0x04
| 0x04
|-
|-
| [[#TSEC_SCP_CTL0|TSEC_SCP_CTL0]]
| [[#TSEC_FALCON_DMAINFO_CURRENT_FBRD_HIGH|TSEC_FALCON_DMAINFO_CURRENT_FBRD_HIGH]]
| 0x54501400
| 0x545012D4
| 0x04
|-
| [[#TSEC_FALCON_DMAINFO_CURRENT_FBWR_LOW|TSEC_FALCON_DMAINFO_CURRENT_FBWR_LOW]]
| 0x545012D8
| 0x04
|-
| [[#TSEC_FALCON_DMAINFO_CURRENT_FBWR_HIGH|TSEC_FALCON_DMAINFO_CURRENT_FBWR_HIGH]]
| 0x545012DC
| 0x04
|-
| [[#TSEC_FALCON_DMAINFO_CTL|TSEC_FALCON_DMAINFO_CTL]]
| 0x545012E0
| 0x04
|-
| [[#TSEC_SCP_CTL0|TSEC_SCP_CTL0]]
| 0x54501400
| 0x04
| 0x04
|-
|-
Line 571: Line 643:
| 0x04
| 0x04
|-
|-
| TSEC_SCP_UNK_10
| [[#TSEC_SCP_CFG|TSEC_SCP_CFG]]
| 0x54501410
| 0x54501410
| 0x04
| 0x04
|-
|-
| TSEC_SCP_UNK_14
| [[#TSEC_SCP_CTL_SCP|TSEC_SCP_CTL_SCP]]
| 0x54501414
| 0x54501414
| 0x04
| 0x04
Line 583: Line 655:
| 0x04
| 0x04
|-
|-
| TSEC_SCP_UNK_1C
| [[#TSEC_SCP_CTL_DBG|TSEC_SCP_CTL_DBG]]
| 0x5450141C
| 0x5450141C
| 0x04
| 0x04
|-
|-
| [[#TSEC_SCP_SEQ_CTL|TSEC_SCP_SEQ_CTL]]
| [[#TSEC_SCP_DBG0|TSEC_SCP_DBG0]]
| 0x54501420
| 0x54501420
| 0x04
| 0x04
|-
|-
| [[#TSEC_SCP_SEQ_VAL|TSEC_SCP_SEQ_VAL]]
| [[#TSEC_SCP_DBG1|TSEC_SCP_DBG1]]
| 0x54501424
| 0x54501424
| 0x04
| 0x04
|-
|-
| [[#TSEC_SCP_SEQ_STAT|TSEC_SCP_SEQ_STAT]]
| [[#TSEC_SCP_DBG2|TSEC_SCP_DBG2]]
| 0x54501428
| 0x54501428
| 0x04
| 0x04
|-
|-
| [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]]
| [[#TSEC_SCP_CMD|TSEC_SCP_CMD]]
| 0x54501430
| 0x54501430
| 0x04
| 0x04
|-
|-
| TSEC_SCP_UNK_50
| [[#TSEC_SCP_STAT0|TSEC_SCP_STAT0]]
| 0x54501450
| 0x54501450
| 0x04
| 0x04
|-
|-
| [[#TSEC_SCP_AUTH_STAT|TSEC_SCP_AUTH_STAT]]
| [[#TSEC_SCP_STAT1|TSEC_SCP_STAT1]]
| 0x54501454
| 0x54501454
| 0x04
| 0x04
|-
|-
| [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]]
| [[#TSEC_SCP_STAT2|TSEC_SCP_STAT2]]
| 0x54501458
| 0x54501458
| 0x04
| 0x04
|-
|-
| TSEC_SCP_UNK_70
| [[#TSEC_SCP_RNG_STAT0|TSEC_SCP_RNG_STAT0]]
| 0x54501470
| 0x54501470
| 0x04
|-
| [[#TSEC_SCP_RNG_STAT1|TSEC_SCP_RNG_STAT1]]
| 0x54501474
| 0x04
| 0x04
|-
|-
Line 631: Line 707:
| 0x04
| 0x04
|-
|-
| TSEC_SCP_UNK_94
| [[#TSEC_SCP_SEC_ERR|TSEC_SCP_SEC_ERR]]
| 0x54501494
| 0x54501494
| 0x04
| 0x04
|-
|-
| [[#TSEC_SCP_INSN_ERR|TSEC_SCP_INSN_ERR]]
| [[#TSEC_SCP_CMD_ERR|TSEC_SCP_CMD_ERR]]
| 0x54501498
| 0x54501498
| 0x04
| 0x04
|-
|-
| TSEC_TRNG_CLK_LIMIT_LOW
| [[#TSEC_SCP_RND_CTL0|TSEC_SCP_RND_CTL0]]
| 0x54501500
| 0x54501500
| 0x04
| 0x04
|-
|-
| TSEC_TRNG_CLK_LIMIT_HIGH
| [[#TSEC_SCP_RND_CTL1|TSEC_SCP_RND_CTL1]]
| 0x54501504
| 0x54501504
| 0x04
| 0x04
|-
|-
| TSEC_TRNG_UNK_08
| [[#TSEC_SCP_RND_CTL2|TSEC_SCP_RND_CTL2]]
| 0x54501508
| 0x54501508
| 0x04
| 0x04
|-
|-
| TSEC_TRNG_TEST_CTL
| [[#TSEC_SCP_RND_CTL3|TSEC_SCP_RND_CTL3]]
| 0x5450150C
| 0x5450150C
| 0x04
| 0x04
|-
|-
| TSEC_TRNG_TEST_CFG0
| [[#TSEC_SCP_RND_CTL4|TSEC_SCP_RND_CTL4]]
| 0x54501510
| 0x54501510
| 0x04
| 0x04
|-
|-
| TSEC_TRNG_TEST_SEED0
| [[#TSEC_SCP_RND_CTL5|TSEC_SCP_RND_CTL5]]
| 0x54501514
| 0x54501514
| 0x04
| 0x04
|-
|-
| TSEC_TRNG_TEST_CFG1
| [[#TSEC_SCP_RND_CTL6|TSEC_SCP_RND_CTL6]]
| 0x54501518
| 0x54501518
| 0x04
| 0x04
|-
|-
| TSEC_TRNG_TEST_SEED1
| [[#TSEC_SCP_RND_CTL7|TSEC_SCP_RND_CTL7]]
| 0x5450151C
| 0x5450151C
| 0x04
| 0x04
|-
|-
| TSEC_TRNG_UNK_20
| [[#TSEC_SCP_RND_CTL8|TSEC_SCP_RND_CTL8]]
| 0x54501520
| 0x54501520
| 0x04
| 0x04
|-
|-
| TSEC_TRNG_UNK_24
| [[#TSEC_SCP_RND_CTL9|TSEC_SCP_RND_CTL9]]
| 0x54501524
| 0x54501524
| 0x04
| 0x04
|-
|-
| TSEC_TRNG_UNK_28
| [[#TSEC_SCP_RND_CTL10|TSEC_SCP_RND_CTL10]]
| 0x54501528
| 0x54501528
| 0x04
| 0x04
|-
|-
| TSEC_TRNG_CTL
| [[#TSEC_SCP_RND_CTL11|TSEC_SCP_RND_CTL11]]
| 0x5450152C
| 0x5450152C
| 0x04
| 0x04
|-
|-
| TSEC_TFBIF_CTL
| [[#TSEC_TFBIF_CTL|TSEC_TFBIF_CTL]]
| 0x54501600
| 0x54501600
| 0x04
| 0x04
Line 695: Line 771:
| 0x04
| 0x04
|-
|-
| TSEC_TFBIF_THROTTLE
| [[#TSEC_TFBIF_THROTTLE|TSEC_TFBIF_THROTTLE]]
| 0x54501608
| 0x54501608
| 0x04
| 0x04
|-
|-
| TSEC_TFBIF_UNK_0C
| [[#TSEC_TFBIF_DBG_STAT0|TSEC_TFBIF_DBG_STAT0]]
| 0x5450160C
| 0x5450160C
| 0x04
| 0x04
|-
|-
| TSEC_TFBIF_DEBUG_STAT
| [[#TSEC_TFBIF_DBG_STAT1|TSEC_TFBIF_DBG_STAT1]]
| 0x54501630
| 0x54501610
| 0x04
| 0x04
|-
|-
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL1|TSEC_TFBIF_MCCIF_FIFOCTRL1]]
| [[#TSEC_TFBIF_DBG_RDCOUNT_LO|TSEC_TFBIF_DBG_RDCOUNT_LO]]
| 0x54501634
| 0x54501614
| 0x04
|-
| [[#TSEC_TFBIF_DBG_RDCOUNT_HI|TSEC_TFBIF_DBG_RDCOUNT_HI]]
| 0x54501618
| 0x04
|-
| [[#TSEC_TFBIF_DBG_WRCOUNT_LO|TSEC_TFBIF_DBG_WRCOUNT_LO]]
| 0x5450161C
| 0x04
|-
| [[#TSEC_TFBIF_DBG_WRCOUNT_HI|TSEC_TFBIF_DBG_WRCOUNT_HI]]
| 0x54501620
| 0x04
|-
| [[#TSEC_TFBIF_DBG_R32COUNT|TSEC_TFBIF_DBG_R32COUNT]]
| 0x54501624
| 0x04
| 0x04
|-
|-
| [[#TSEC_TFBIF_MMU_PROT|TSEC_TFBIF_MMU_PROT]]
| [[#TSEC_TFBIF_DBG_R64COUNT|TSEC_TFBIF_DBG_R64COUNT]]
| 0x54501640
| 0x54501628
| 0x04
| 0x04
|-
|-
| [[#TSEC_TFBIF_MMU_PHYS_SEC|TSEC_TFBIF_MMU_PHYS_SEC]]
| [[#TSEC_TFBIF_DBG_R128COUNT|TSEC_TFBIF_DBG_R128COUNT]]
| 0x54501644
| 0x5450162C
| 0x04
| 0x04
|-
|-
| [[#TSEC_TFBIF_MMU_TRANSCFG|TSEC_TFBIF_MMU_TRANSCFG]]
| [[#TSEC_TFBIF_MCCIF_FIFOCTRL1|TSEC_TFBIF_MCCIF_FIFOCTRL1]]
| 0x54501648
| 0x54501634
| 0x04
| 0x04
|-
|-
| [[#TSEC_TFBIF_ACTMON_MAMASK|TSEC_TFBIF_ACTMON_MAMASK]]
| [[#TSEC_TFBIF_SPROT_EMEM|TSEC_TFBIF_SPROT_EMEM]]
| 0x5450164C
| 0x54501640
| 0x04
| 0x04
|-
|-
| [[#TSEC_TFBIF_ACTMON_BORPS|TSEC_TFBIF_ACTMON_BORPS]]
| [[#TSEC_TFBIF_TRANSCFG|TSEC_TFBIF_TRANSCFG]]
| 0x54501650
| 0x54501644
| 0x04
| 0x04
|-
|-
| [[#TSEC_TFBIF_ACTMON_CTL|TSEC_TFBIF_ACTMON_CTL]]
| [[#TSEC_TFBIF_REGIONCFG|TSEC_TFBIF_REGIONCFG]]
| 0x54501654
| 0x54501648
| 0x04
| 0x04
|-
|-
Line 739: Line 831:
| 0x04
| 0x04
|-
|-
| [[#TSEC_DMA_CMD|TSEC_DMA_CMD]]
| [[#TSEC_BAR0_CTL|TSEC_BAR0_CTL]]
| 0x54501700
| 0x54501700
| 0x04
| 0x04
|-
|-
| [[#TSEC_DMA_ADDR|TSEC_DMA_ADDR]]
| [[#TSEC_BAR0_ADDR|TSEC_BAR0_ADDR]]
| 0x54501704
| 0x54501704
| 0x04
| 0x04
|-
|-
| [[#TSEC_DMA_DATA|TSEC_DMA_DATA]]
| [[#TSEC_BAR0_DATA|TSEC_BAR0_DATA]]
| 0x54501708
| 0x54501708
| 0x04
| 0x04
|-
|-
| [[#TSEC_DMA_TIMEOUT|TSEC_DMA_TIMEOUT]]
| [[#TSEC_BAR0_TIMEOUT|TSEC_BAR0_TIMEOUT]]
| 0x5450170C
| 0x5450170C
| 0x04
| 0x04
|-
|-
| TSEC_TEGRA_FALCON_IP_VER
| [[#TSEC_VERSION|TSEC_VERSION]]
| 0x54501800
| 0x54501800
| 0x04
| 0x04
|-
|-
| TSEC_TEGRA_UNK_04
| [[#TSEC_SCRATCH0|TSEC_SCRATCH0]]
| 0x54501804
| 0x54501804
| 0x04
| 0x04
|-
|-
| TSEC_TEGRA_UNK_08
| [[#TSEC_SCRATCH1|TSEC_SCRATCH1]]
| 0x54501808
| 0x54501808
| 0x04
| 0x04
|-
|-
| TSEC_TEGRA_UNK_0C
| [[#TSEC_SCRATCH2|TSEC_SCRATCH2]]
| 0x5450180C
| 0x5450180C
| 0x04
| 0x04
|-
|-
| TSEC_TEGRA_UNK_10
| [[#TSEC_SCRATCH3|TSEC_SCRATCH3]]
| 0x54501810
| 0x54501810
| 0x04
| 0x04
|-
|-
| TSEC_TEGRA_UNK_14
| [[#TSEC_SCRATCH4|TSEC_SCRATCH4]]
| 0x54501814
| 0x54501814
| 0x04
| 0x04
|-
|-
| TSEC_TEGRA_UNK_18
| [[#TSEC_SCRATCH5|TSEC_SCRATCH5]]
| 0x54501818
| 0x54501818
| 0x04
| 0x04
|-
|-
| TSEC_TEGRA_UNK_1C
| [[#TSEC_SCRATCH6|TSEC_SCRATCH6]]
| 0x5450181C
| 0x5450181C
| 0x04
| 0x04
|-
|-
| TSEC_TEGRA_UNK_20
| [[#TSEC_SCRATCH7|TSEC_SCRATCH7]]
| 0x54501820
| 0x54501820
| 0x04
| 0x04
|-
|-
| TSEC_TEGRA_UNK_24
| [[#TSEC_GPTMRINT|TSEC_GPTMRINT]]
| 0x54501824
| 0x54501824
| 0x04
| 0x04
|-
|-
| TSEC_TEGRA_UNK_28
| [[#TSEC_GPTMRVAL|TSEC_GPTMRVAL]]
| 0x54501828
| 0x54501828
| 0x04
| 0x04
|-
|-
| TSEC_TEGRA_UNK_2C
| [[#TSEC_GPTMRCTL|TSEC_GPTMRCTL]]
| 0x5450182C
| 0x5450182C
| 0x04
| 0x04
|-
|-
| TSEC_TEGRA_UNK_30
| [[#TSEC_ITFEN|TSEC_ITFEN]]
| 0x54501830
| 0x54501830
| 0x04
| 0x04
|-
|-
| TSEC_TEGRA_UNK_34
| [[#TSEC_ITFSTAT|TSEC_ITFSTAT]]
| 0x54501834
| 0x54501834
| 0x04
| 0x04
Line 816: Line 908:
|}
|}


=== TSEC_THI_METHOD0 ===
=== TSEC_THI_INCR_SYNCPT ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  ID
!  Bits
!  Method
!  Description
|-
|-
| 0x200
| 0-9
| SET_APPLICATION_ID
| TSEC_THI_INCR_SYNCPT_INDX
|-
|-
| 0x300
| 10-17
| EXECUTE
| TSEC_THI_INCR_SYNCPT_COND
|}
 
=== TSEC_THI_INCR_SYNCPT_CTRL ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 0x500
| 0
| HDCP_INIT
| TSEC_THI_INCR_SYNCPT_CTRL_SOFT_RESET
|-
|-
| 0x504
| 8
| HDCP_CREATE_SESSION
| TSEC_THI_INCR_SYNCPT_CTRL_NO_STALL
|-
|-
| 0x508
| 16
| HDCP_VERIFY_CERT_RX
| TSEC_THI_INCR_SYNCPT_CTRL_SOFT_RESET_0
|-
|-
| 0x50C
| 17
| HDCP_GENERATE_EKM
| TSEC_THI_INCR_SYNCPT_CTRL_NO_STALL_0
|-
|-
| 0x510
| 18
| HDCP_REVOCATION_CHECK
| TSEC_THI_INCR_SYNCPT_CTRL_SOFT_RESET_1
|-
|-
| 0x514
| 19
| HDCP_VERIFY_HPRIME
| TSEC_THI_INCR_SYNCPT_CTRL_NO_STALL_1
|-
|-
| 0x518
| 20
| HDCP_ENCRYPT_PAIRING_INFO
| TSEC_THI_INCR_SYNCPT_CTRL_SOFT_RESET_2
|-
|-
| 0x51C
| 21
| HDCP_DECRYPT_PAIRING_INFO
| TSEC_THI_INCR_SYNCPT_CTRL_NO_STALL_2
|-
|-
| 0x520
| 22
| HDCP_UPDATE_SESSION
| TSEC_THI_INCR_SYNCPT_CTRL_SOFT_RESET_3
|-
|-
| 0x524
| 23
| HDCP_GENERATE_LC_INIT
| TSEC_THI_INCR_SYNCPT_CTRL_NO_STALL_3
|-
|-
| 0x528
| 24
| HDCP_VERIFY_LPRIME
| TSEC_THI_INCR_SYNCPT_CTRL_SOFT_RESET_4
|-
|-
| 0x52C
| 25
| HDCP_GENERATE_SKE_INIT
| TSEC_THI_INCR_SYNCPT_CTRL_NO_STALL_4
|}
 
=== TSEC_THI_INCR_SYNCPT_ERR ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 0x530
| 0
| HDCP_VERIFY_VPRIME
| TSEC_THI_INCR_SYNCPT_ERR_COND_STS_IMM
|-
|-
| 0x534
| 1
| HDCP_ENCRYPTION_RUN_CTRL
| TSEC_THI_INCR_SYNCPT_ERR_COND_STS_OPDONE
|-
|-
| 0x538
| 2
| HDCP_SESSION_CTRL
| TSEC_THI_INCR_SYNCPT_ERR_COND_STS_RD_DONE
|-
|-
| 0x53C
| 3
| HDCP_COMPUTE_SPRIME
| TSEC_THI_INCR_SYNCPT_ERR_COND_STS_REG_WR_SAFE
|-
|-
| 0x540
| 4
| HDCP_GET_CERT_RX
| TSEC_THI_INCR_SYNCPT_ERR_COND_STS_ENGINE_IDLE
|}
 
=== TSEC_THI_CTXSW_INCR_SYNCPT ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 0x544
| 0-9
| HDCP_EXCHANGE_INFO
| TSEC_THI_CTXSW_INCR_SYNCPT_INDX
|-
|}
| 0x548
 
| HDCP_DECRYPT_KM
=== TSEC_THI_CTXSW ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 0x54C
| 0-9
| HDCP_GET_HPRIME
| TSEC_THI_CTXSW_CURR_CLASS
|-
|-
| 0x550
| 10
| HDCP_GENERATE_EKH_KM
| TSEC_THI_CTXSW_AUTO_ACK
|-
|-
| 0x554
| 11-20
| HDCP_VERIFY_RTT_CHALLENGE
| TSEC_THI_CTXSW_CURR_CHANNEL
|}
 
=== TSEC_THI_CTXSW_NEXT ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 0x558
| 0-9
| HDCP_GET_LPRIME
| TSEC_THI_CTXSW_NEXT_NEXT_CLASS
|-
|-
| 0x55C
| 10-19
| HDCP_DECRYPT_KS
| TSEC_THI_CTXSW_NEXT_NEXT_CHANNEL
|}
 
=== TSEC_THI_CONT_SYNCPT_EOF ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 0x560
| 0-9
| HDCP_DECRYPT
| TSEC_THI_CONT_SYNCPT_EOF_INDEX
|-
|-
| 0x564
| 10
| HDCP_GET_RRX
| TSEC_THI_CONT_SYNCPT_EOF_COND
|}
 
=== TSEC_THI_CONT_SYNCPT_L1 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 0x568
| 0-9
| HDCP_DECRYPT_REENCRYPT
| TSEC_THI_CONT_SYNCPT_L1_INDEX
|-
|-
| 0x56C
| 10
|  
| TSEC_THI_CONT_SYNCPT_L1_COND
|}
 
=== TSEC_THI_METHOD0 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-11
| TSEC_THI_METHOD0_OFFSET
|}
 
Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.
 
The following methods are available:
{| class="wikitable" border="1"
!  ID
!  Method
|-
|-
| 0x570
| 0x100
|  
| NOP
|-
|-
| 0x574
| 0x140
|  
| PM_TRIGGER
|-
|-
| 0x578
| 0x200
|  
| SET_APPLICATION_ID
|-
|-
| 0x57C
| 0x204
|  
| SET_WATCHDOG_TIMER
|-
|-
| 0x700
| 0x240
| HDCP_VALIDATE_SRM
| SEMAPHORE_A
|-
|-
| 0x704
| 0x244
| HDCP_VALIDATE_STREAM
| SEMAPHORE_B
|-
|-
| 0x708
| 0x248
| HDCP_TEST_SECURE_STATUS
| SEMAPHORE_C
|-
|-
| 0x70C
| 0x24C
| HDCP_SET_DCP_KPUB
| CTX_SAVE_AREA
|-
|-
| 0x710
| 0x250
| HDCP_SET_RX_KPUB
| CTX_SWITCH
|-
|-
| 0x714
| 0x300
| HDCP_SET_CERT_RX
| EXECUTE
|-
|-
| 0x718
| 0x304
| HDCP_SET_SCRATCH_BUFFER
| SEMAPHORE_D
|-
|-
| 0x71C
| 0x500
| HDCP_SET_SRM
| HDCP_INIT
|-
|-
| 0x720
| 0x504
| HDCP_SET_RECEIVER_ID_LIST
| HDCP_CREATE_SESSION
|-
|-
| 0x724
| 0x508
| HDCP_SET_SPRIME
| HDCP_VERIFY_CERT_RX
|-
|-
| 0x728
| 0x50C
| HDCP_SET_ENC_INPUT_BUFFER
| HDCP_GENERATE_EKM
|-
|-
| 0x72C
| 0x510
| HDCP_SET_ENC_OUTPUT_BUFFER
| HDCP_REVOCATION_CHECK
|-
|-
| 0x730
| 0x514
| HDCP_GET_RTT_CHALLENGE
| HDCP_VERIFY_HPRIME
|-
|-
| 0x734
| 0x518
| HDCP_STREAM_MANAGE
| HDCP_ENCRYPT_PAIRING_INFO
|-
|-
| 0x738
| 0x51C
| HDCP_READ_CAPS
| HDCP_DECRYPT_PAIRING_INFO
|-
| 0x520
| HDCP_UPDATE_SESSION
|-
|-
| 0x73C
| 0x524
| HDCP_ENCRYPT
| HDCP_GENERATE_LC_INIT
|-
|-
| 0x740
| 0x528
| [6.0.0+] HDCP_GET_CURRENT_NONCE
| HDCP_VERIFY_LPRIME
|}
 
Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.
 
=== TSEC_THI_METHOD1 ===
Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.
 
=== TSEC_THI_INT_STATUS ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 0
| 0x52C
| TSEC_THI_INT_STATUS_FALCON_INT
| HDCP_GENERATE_SKE_INIT
|}
 
=== TSEC_THI_INT_MASK ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 0
| 0x530
| TSEC_THI_INT_MASK_FALCON_INT
| HDCP_VERIFY_VPRIME
|}
|-
 
| 0x534
=== FALCON_IRQSSET ===
| HDCP_ENCRYPTION_RUN_CTRL
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 0
| 0x538
| FALCON_IRQSSET_GPTMR
| HDCP_SESSION_CTRL
|-
|-
| 1
| 0x53C
| FALCON_IRQSSET_WDTMR
| HDCP_COMPUTE_SPRIME
|-
|-
| 2
| 0x540
| FALCON_IRQSSET_MTHD
| HDCP_GET_CERT_RX
|-
|-
| 3
| 0x544
| FALCON_IRQSSET_CTXSW
| HDCP_EXCHANGE_INFO
|-
|-
| 4
| 0x548
| FALCON_IRQSSET_HALT
| HDCP_DECRYPT_KM
|-
|-
| 5
| 0x54C
| FALCON_IRQSSET_EXTERR
| HDCP_GET_HPRIME
|-
|-
| 6
| 0x550
| FALCON_IRQSSET_SWGEN0
| HDCP_GENERATE_EKH_KM
|-
|-
| 7
| 0x554
| FALCON_IRQSSET_SWGEN1
| HDCP_VERIFY_RTT_CHALLENGE
|-
|-
| 8-15
| 0x558
| FALCON_IRQSSET_EXT
| HDCP_GET_LPRIME
|}
 
Used for setting Falcon's IRQs.
 
=== FALCON_IRQSCLR ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 0
| 0x55C
| FALCON_IRQSCLR_GPTMR
| HDCP_DECRYPT_KS
|-
|-
| 1
| 0x560
| FALCON_IRQSCLR_WDTMR
| HDCP_DECRYPT
|-
|-
| 2
| 0x564
| FALCON_IRQSCLR_MTHD
| HDCP_GET_RRX
|-
|-
| 3
| 0x568
| FALCON_IRQSCLR_CTXSW
| HDCP_DECRYPT_REENCRYPT
|-
|-
| 4
| 0x56C
| FALCON_IRQSCLR_HALT
|  
|-
|-
| 5
| 0x570
| FALCON_IRQSCLR_EXTERR
|  
|-
|-
| 6
| 0x574
| FALCON_IRQSCLR_SWGEN0
| HDCP_DECRYPT_STORED_KM
|-
|-
| 7
| 0x578
| FALCON_IRQSCLR_SWGEN1
| HDCP_GET_CURRENT_RESOLUTION
|-
|-
| 8-15
| 0x57C
| FALCON_IRQSCLR_EXT
| HDCP_GET_CURRENT_VERSION
|}
 
Used for clearing Falcon's IRQs.
 
=== FALCON_IRQSTAT ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 0
| 0x700
| FALCON_IRQSTAT_GPTMR
| HDCP_VALIDATE_SRM
|-
|-
| 1
| 0x704
| FALCON_IRQSTAT_WDTMR
| HDCP_VALIDATE_STREAM
|-
|-
| 2
| 0x708
| FALCON_IRQSTAT_MTHD
| HDCP_TEST_SECURE_STATUS
|-
|-
| 3
| 0x70C
| FALCON_IRQSTAT_CTXSW
| HDCP_SET_DCP_KPUB
|-
|-
| 4
| 0x710
| FALCON_IRQSTAT_HALT
| HDCP_SET_RX_KPUB
|-
|-
| 5
| 0x714
| FALCON_IRQSTAT_EXTERR
| HDCP_SET_CERT_RX
|-
|-
| 6
| 0x718
| FALCON_IRQSTAT_SWGEN0
| HDCP_SET_SCRATCH_BUFFER
|-
|-
| 7
| 0x71C
| FALCON_IRQSTAT_SWGEN1
| HDCP_SET_SRM
|-
|-
| 8-15
| 0x720
| FALCON_IRQSTAT_EXT
| HDCP_SET_RECEIVER_ID_LIST
|}
 
Used for getting the status of Falcon's IRQs.
 
=== FALCON_IRQMODE ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 0
| 0x724
| FALCON_IRQMODE_GPTMR
| HDCP_SET_SPRIME
|-
|-
| 1
| 0x728
| FALCON_IRQMODE_WDTMR
| HDCP_SET_ENC_INPUT_BUFFER
|-
| 0x72C
| HDCP_SET_ENC_OUTPUT_BUFFER
|-
|-
| 2
| 0x730
| FALCON_IRQMODE_MTHD
| HDCP_GET_RTT_CHALLENGE
|-
|-
| 3
| 0x734
| FALCON_IRQMODE_CTXSW
| HDCP_STREAM_MANAGE
|-
|-
| 4
| 0x738
| FALCON_IRQMODE_HALT
| HDCP_READ_CAPS
|-
|-
| 5
| 0x73C
| FALCON_IRQMODE_EXTERR
| HDCP_ENCRYPT
|-
|-
| 6
| 0x740
| FALCON_IRQMODE_SWGEN0
| [6.0.0+] HDCP_GET_CURRENT_NONCE
|-
|-
| 7
| 0x1114
| FALCON_IRQMODE_SWGEN1
| PM_TRIGGER_END
|}
 
=== TSEC_THI_METHOD1 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 8-15
| 0-31
| FALCON_IRQMODE_EXT
| TSEC_THI_METHOD1_DATA
|}
|}


Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.
Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.


=== FALCON_IRQMSET ===
=== TSEC_THI_CONTEXT_SWITCH ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
!  Description
!  Description
|-
|-
| 0
| 0-27
| FALCON_IRQMSET_GPTMR
| TSEC_THI_CONTEXT_SWITCH_PTR
|-
|-
| 1
| 30-31
| FALCON_IRQMSET_WDTMR
| TSEC_THI_CONTEXT_SWITCH_TARGET
|-
|}
| 2
 
| FALCON_IRQMSET_MTHD
=== TSEC_THI_INT_STATUS ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 3
| 0
| FALCON_IRQMSET_CTXSW
| TSEC_THI_INT_STATUS_FALCON_INT
|}
 
=== TSEC_THI_INT_MASK ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 4
| 0
| FALCON_IRQMSET_HALT
| TSEC_THI_INT_MASK_FALCON_INT
|}
 
=== TSEC_THI_CONFIG0 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 5
| 0
| FALCON_IRQMSET_EXTERR
| TSEC_THI_CONFIG0_RETURN_SYNCPT_ON_ERR
|-
|-
| 6
| 4
| FALCON_IRQMSET_SWGEN0
| TSEC_THI_CONFIG0_IDLE_SYNCPT_INC_ENG
|-
| 7
| FALCON_IRQMSET_SWGEN1
|-
| 8-15
| FALCON_IRQMSET_EXT
|}
|}


Used for setting the mask for Falcon's IRQs.
=== TSEC_THI_DBG_MISC ===
 
=== FALCON_IRQMCLR ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
Line 1,179: Line 1,302:
|-
|-
| 0
| 0
| FALCON_IRQMCLR_GPTMR
| TSEC_THI_DBG_MISC_CLIENT_IDLE_STATUS
|-
|-
| 1
| 1
| FALCON_IRQMCLR_WDTMR
| TSEC_THI_DBG_MISC_THI_IDLE_STATUS
|-
|-
| 2
| 2
| FALCON_IRQMCLR_MTHD
| TSEC_THI_DBG_MISC_THI_SYNCPT_PENDING_STATUS
|-
|-
| 3
| 3
| FALCON_IRQMCLR_CTXSW
| TSEC_THI_DBG_MISC_THI_IDLE_EN
|}
 
=== TSEC_THI_SLCG_OVERRIDE_HIGH_A ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 4
| 0-7
| FALCON_IRQMCLR_HALT
| TSEC_THI_SLCG_OVERRIDE_HIGH_A_REG
|}
 
=== TSEC_THI_SLCG_OVERRIDE_LOW_A ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-31
| TSEC_THI_SLCG_OVERRIDE_LOW_A_REG
|}
 
=== TSEC_THI_CLK_OVERRIDE ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-31
| TSEC_THI_CLK_OVERRIDE_CYA
|}
 
=== TSEC_FALCON_IRQSSET ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0
| TSEC_FALCON_IRQSSET_GPTMR
|-
| 1
| TSEC_FALCON_IRQSSET_WDTMR
|-
| 2
| TSEC_FALCON_IRQSSET_MTHD
|-
| 3
| TSEC_FALCON_IRQSSET_CTXSW
|-
| 4
| TSEC_FALCON_IRQSSET_HALT
|-
|-
| 5
| 5
| FALCON_IRQMCLR_EXTERR
| TSEC_FALCON_IRQSSET_EXTERR
|-
|-
| 6
| 6
| FALCON_IRQMCLR_SWGEN0
| TSEC_FALCON_IRQSSET_SWGEN0
|-
|-
| 7
| 7
| FALCON_IRQMCLR_SWGEN1
| TSEC_FALCON_IRQSSET_SWGEN1
|-
|-
| 8-15
| 8-15
| FALCON_IRQMCLR_EXT
| TSEC_FALCON_IRQSSET_EXT
|-
| 16
| TSEC_FALCON_IRQSSET_DMA
|}
|}


Used for clearing the mask for Falcon's IRQs.
Used for setting Falcon's IRQs.


=== FALCON_IRQMASK ===
=== TSEC_FALCON_IRQSCLR ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
Line 1,214: Line 1,385:
|-
|-
| 0
| 0
| FALCON_IRQMASK_GPTMR
| TSEC_FALCON_IRQSCLR_GPTMR
|-
|-
| 1
| 1
| FALCON_IRQMASK_WDTMR
| TSEC_FALCON_IRQSCLR_WDTMR
|-
|-
| 2
| 2
| FALCON_IRQMASK_MTHD
| TSEC_FALCON_IRQSCLR_MTHD
|-
|-
| 3
| 3
| FALCON_IRQMASK_CTXSW
| TSEC_FALCON_IRQSCLR_CTXSW
|-
|-
| 4
| 4
| FALCON_IRQMASK_HALT
| TSEC_FALCON_IRQSCLR_HALT
|-
|-
| 5
| 5
| FALCON_IRQMASK_EXTERR
| TSEC_FALCON_IRQSCLR_EXTERR
|-
|-
| 6
| 6
| FALCON_IRQMASK_SWGEN0
| TSEC_FALCON_IRQSCLR_SWGEN0
|-
|-
| 7
| 7
| FALCON_IRQMASK_SWGEN1
| TSEC_FALCON_IRQSCLR_SWGEN1
|-
|-
| 8-15
| 8-15
| FALCON_IRQMASK_EXT
| TSEC_FALCON_IRQSCLR_EXT
|-
| 16
| TSEC_FALCON_IRQSCLR_DMA
|}
|}


Used for getting the value of the mask for Falcon's IRQs.
Used for clearing Falcon's IRQs.


=== FALCON_IRQDEST ===
=== TSEC_FALCON_IRQSTAT ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
Line 1,249: Line 1,423:
|-
|-
| 0
| 0
| FALCON_IRQDEST_HOST_GPTMR
| TSEC_FALCON_IRQSTAT_GPTMR
|-
|-
| 1
| 1
| FALCON_IRQDEST_HOST_WDTMR
| TSEC_FALCON_IRQSTAT_WDTMR
|-
|-
| 2
| 2
| FALCON_IRQDEST_HOST_MTHD
| TSEC_FALCON_IRQSTAT_MTHD
|-
|-
| 3
| 3
| FALCON_IRQDEST_HOST_CTXSW
| TSEC_FALCON_IRQSTAT_CTXSW
|-
|-
| 4
| 4
| FALCON_IRQDEST_HOST_HALT
| TSEC_FALCON_IRQSTAT_HALT
|-
|-
| 5
| 5
| FALCON_IRQDEST_HOST_EXTERR
| TSEC_FALCON_IRQSTAT_EXTERR
|-
|-
| 6
| 6
| FALCON_IRQDEST_HOST_SWGEN0
| TSEC_FALCON_IRQSTAT_SWGEN0
|-
|-
| 7
| 7
| FALCON_IRQDEST_HOST_SWGEN1
| TSEC_FALCON_IRQSTAT_SWGEN1
|-
|-
| 8-15
| 8-15
| FALCON_IRQDEST_HOST_EXT
| TSEC_FALCON_IRQSTAT_EXT
|-
|-
| 16
| 16
| FALCON_IRQDEST_TARGET_GPTMR
| TSEC_FALCON_IRQSTAT_DMA
|-
|}
| 17
 
| FALCON_IRQDEST_TARGET_WDTMR
Used for getting the status of Falcon's IRQs.
 
=== TSEC_FALCON_IRQMODE ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0
| TSEC_FALCON_IRQMODE_LVL_GPTMR
|-
| 1
| TSEC_FALCON_IRQMODE_LVL_WDTMR
|-
| 2
| TSEC_FALCON_IRQMODE_LVL_MTHD
|-
|-
| 18
| 3
| FALCON_IRQDEST_TARGET_MTHD
| TSEC_FALCON_IRQMODE_LVL_CTXSW
|-
|-
| 19
| 4
| FALCON_IRQDEST_TARGET_CTXSW
| TSEC_FALCON_IRQMODE_LVL_HALT
|-
|-
| 20
| 5
| FALCON_IRQDEST_TARGET_HALT
| TSEC_FALCON_IRQMODE_LVL_EXTERR
|-
|-
| 21
| 6
| FALCON_IRQDEST_TARGET_EXTERR
| TSEC_FALCON_IRQMODE_LVL_SWGEN0
|-
|-
| 22
| 7
| FALCON_IRQDEST_TARGET_SWGEN0
| TSEC_FALCON_IRQMODE_LVL_SWGEN1
|-
|-
| 23
| 8-15
| FALCON_IRQDEST_TARGET_SWGEN1
| TSEC_FALCON_IRQMODE_LVL_EXT
|-
|-
| 24-31
| 16
| FALCON_IRQDEST_TARGET_EXT
| TSEC_FALCON_IRQMODE_LVL_DMA
|}
|}


Used for routing Falcon's IRQs.
Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.


=== FALCON_MAILBOX0 ===
=== TSEC_FALCON_IRQMSET ===
Scratch register for reading/writing data to Falcon.
 
=== FALCON_MAILBOX1 ===
Scratch register for reading/writing data to Falcon.
 
=== FALCON_ITFEN ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
Line 1,317: Line 1,499:
|-
|-
| 0
| 0
| FALCON_ITFEN_CTXEN
| TSEC_FALCON_IRQMSET_GPTMR
|-
|-
| 1
| 1
| FALCON_ITFEN_MTHDEN
| TSEC_FALCON_IRQMSET_WDTMR
|}
|-
 
| 2
Used for enabling/disabling Falcon interfaces.
| TSEC_FALCON_IRQMSET_MTHD
 
|-
=== FALCON_IDLESTATE ===
| 3
{| class="wikitable" border="1"
| TSEC_FALCON_IRQMSET_CTXSW
!  Bits
!  Description
|-
|-
| 0
| 4
| FALCON_IDLESTATE_FALCON_BUSY
| TSEC_FALCON_IRQMSET_HALT
|-
|-
| 1-15
| 5
| FALCON_IDLESTATE_EXT_BUSY
| TSEC_FALCON_IRQMSET_EXTERR
|}
 
Used for detecting if Falcon is busy or not.
 
=== FALCON_DEBUG1 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 0-15
| 6
| FALCON_DEBUG1_MTHD_DRAIN_TIME
| TSEC_FALCON_IRQMSET_SWGEN0
|-
|-
| 16
| 7
| FALCON_DEBUG1_CTXSW_MODE
| TSEC_FALCON_IRQMSET_SWGEN1
|}
 
=== FALCON_DEBUGINFO ===
Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.
 
[6.0.0+] [[NV_services|nvservices]] sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.
 
=== FALCON_EXCI ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 0-19
| 8-15
| PC that originated the exception
| TSEC_FALCON_IRQMSET_EXT
|-
|-
| 20-23
| 16
| Exception type
| TSEC_FALCON_IRQMSET_DMA
0x00: Trap 0
0x01: Trap 1
0x02: Trap 2
0x03: Trap 3
0x08: Invalid opcode
0x09: Authentication entry
0x0A: Page fault (no hit)
0x0B: Page fault (multi hit)
0x0F: Breakpoint
|}
|}


Contains information about raised exceptions.
Used for setting the mask for Falcon's IRQs.


=== FALCON_CPUCTL ===
=== TSEC_FALCON_IRQMCLR ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
Line 1,385: Line 1,537:
|-
|-
| 0
| 0
| FALCON_CPUCTL_IINVAL
| TSEC_FALCON_IRQMCLR_GPTMR
|-
|-
| 1
| 1
| FALCON_CPUCTL_STARTCPU
| TSEC_FALCON_IRQMCLR_WDTMR
|-
|-
| 2
| 2
| FALCON_CPUCTL_SRESET
| TSEC_FALCON_IRQMCLR_MTHD
|-
|-
| 3
| 3
| FALCON_CPUCTL_HRESET
| TSEC_FALCON_IRQMCLR_CTXSW
|-
|-
| 4
| 4
| FALCON_CPUCTL_HALTED
| TSEC_FALCON_IRQMCLR_HALT
|-
|-
| 5
| 5
| FALCON_CPUCTL_STOPPED
| TSEC_FALCON_IRQMCLR_EXTERR
|-
|-
| 6
| 6
| FALCON_CPUCTL_CPUCTL_ALIAS_EN
| TSEC_FALCON_IRQMCLR_SWGEN0
|-
| 7
| TSEC_FALCON_IRQMCLR_SWGEN1
|-
| 8-15
| TSEC_FALCON_IRQMCLR_EXT
|-
| 16
| TSEC_FALCON_IRQMCLR_DMA
|}
|}


Used for signaling the Falcon CPU.
Used for clearing the mask for Falcon's IRQs.


=== FALCON_BOOTVEC ===
=== TSEC_FALCON_IRQMASK ===
Takes the Falcon's boot vector address.
 
=== FALCON_HWCFG ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
!  Description
!  Description
|-
|-
| 0-8
| 0
| FALCON_HWCFG_IMEM_SIZE
| TSEC_FALCON_IRQMASK_GPTMR
|-
| 1
| TSEC_FALCON_IRQMASK_WDTMR
|-
| 2
| TSEC_FALCON_IRQMASK_MTHD
|-
| 3
| TSEC_FALCON_IRQMASK_CTXSW
|-
| 4
| TSEC_FALCON_IRQMASK_HALT
|-
| 5
| TSEC_FALCON_IRQMASK_EXTERR
|-
| 6
| TSEC_FALCON_IRQMASK_SWGEN0
|-
|-
| 9-17
| 7
| FALCON_HWCFG_DMEM_SIZE
| TSEC_FALCON_IRQMASK_SWGEN1
|-
|-
| 18-26
| 8-15
| FALCON_HWCFG_METHODFIFO_DEPTH
| TSEC_FALCON_IRQMASK_EXT
|-
|-
| 27-31
| 16
| FALCON_HWCFG_DMAQUEUE_DEPTH
| TSEC_FALCON_IRQMASK_DMA
|}
|}


=== FALCON_DMACTL ===
Used for getting the value of the mask for Falcon's IRQs.
 
=== TSEC_FALCON_IRQDEST ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
Line 1,435: Line 1,613:
|-
|-
| 0
| 0
| FALCON_DMACTL_REQUIRE_CTX
| TSEC_FALCON_IRQDEST_HOST_GPTMR
|-
|-
| 1
| 1
| FALCON_DMACTL_DMEM_SCRUBBING
| TSEC_FALCON_IRQDEST_HOST_WDTMR
|-
|-
| 2
| 2
| FALCON_DMACTL_IMEM_SCRUBBING
| TSEC_FALCON_IRQDEST_HOST_MTHD
|-
|-
| 3-6
| 3
| FALCON_DMACTL_DMAQ_NUM
| TSEC_FALCON_IRQDEST_HOST_CTXSW
|-
| 4
| TSEC_FALCON_IRQDEST_HOST_HALT
|-
|-
| 7
| 5
| FALCON_DMACTL_SECURE_STAT
| TSEC_FALCON_IRQDEST_HOST_EXTERR
|-
| 6
| TSEC_FALCON_IRQDEST_HOST_SWGEN0
|-
| 7
| TSEC_FALCON_IRQDEST_HOST_SWGEN1
|-
| 8-15
| TSEC_FALCON_IRQDEST_HOST_EXT
|-
| 16
| TSEC_FALCON_IRQDEST_TARGET_GPTMR
|-
| 17
| TSEC_FALCON_IRQDEST_TARGET_WDTMR
|-
| 18
| TSEC_FALCON_IRQDEST_TARGET_MTHD
|-
| 19
| TSEC_FALCON_IRQDEST_TARGET_CTXSW
|-
| 20
| TSEC_FALCON_IRQDEST_TARGET_HALT
|-
| 21
| TSEC_FALCON_IRQDEST_TARGET_EXTERR
|-
| 22
| TSEC_FALCON_IRQDEST_TARGET_SWGEN0
|-
| 23
| TSEC_FALCON_IRQDEST_TARGET_SWGEN1
|-
| 24-31
| TSEC_FALCON_IRQDEST_TARGET_EXT
|}
|}


Used for configuring the Falcon's DMA engine.
Used for routing Falcon's IRQs.


=== FALCON_DMATRFBASE ===
=== TSEC_FALCON_GPTMRINT ===
Base address of the external memory buffer, shifted right by 8.
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-31
| TSEC_FALCON_GPTMRINT_VAL
|}


The current transfer address is calculated by adding [[#FALCON_DMATRFFBOFFS|FALCON_DMATRFFBOFFS]] to the base.
=== TSEC_FALCON_GPTMRVAL ===
 
=== FALCON_DMATRFMOFFS ===
For transfers to DMEM: the destination address.
For transfers to IMEM: the destination virtual IMEM page.
 
=== FALCON_DMATRFCMD ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
!  Description
!  Description
|-
|-
| 0
| 0-31
| FALCON_DMATRFCMD_FULL
| TSEC_FALCON_GPTMRVAL_VAL
|-
| 1
| FALCON_DMATRFCMD_IDLE
|-
| 2-3
| FALCON_DMATRFCMD_SEC
|-
| 4
| FALCON_DMATRFCMD_IMEM
|-
| 5
| FALCON_DMATRFCMD_WRITE
|-
| 8-10
| FALCON_DMATRFCMD_SIZE
|-
| 12-14
| FALCON_DMATRFCMD_CTXDMA
|}
|}


Used for configuring DMA transfers.
=== TSEC_FALCON_GPTMRCTL ===
 
=== FALCON_DMATRFFBOFFS ===
For transfers to IMEM: the destination physical IMEM page.
 
=== FALCON_DMAPOLL_FB ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
Line 1,499: Line 1,693:
|-
|-
| 0
| 0
| FALCON_DMAPOLL_FB_FENCE_ACTIVE
| TSEC_FALCON_GPTMRCTL_GPTMREN
|}
 
=== TSEC_FALCON_PTIMER0 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 1
| 0-31
| FALCON_DMAPOLL_FB_DMA_ACTIVE
| TSEC_FALCON_PTIMER0_VAL
|-
|}
| 4
 
| FALCON_DMAPOLL_FB_CFG_R_FENCE
=== TSEC_FALCON_PTIMER1 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 5
| 0-31
| FALCON_DMAPOLL_FB_CFG_W_FENCE
| TSEC_FALCON_PTIMER1_VAL
|-
| 16-23
| FALCON_DMAPOLL_FB_WCOUNT
|-
| 24-31
| FALCON_DMAPOLL_FB_RCOUNT
|}
|}


Contains the status of a DMA transfer between the Falcon and external memory.
=== TSEC_FALCON_WDTMRVAL ===
 
{| class="wikitable" border="1"
=== FALCON_DMAPOLL_CP ===
!  Bits
!  Description
|-
| 0-31
| TSEC_FALCON_WDTMRVAL_VAL
|}
 
=== TSEC_FALCON_WDTMRCTL ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
Line 1,525: Line 1,729:
|-
|-
| 0
| 0
| FALCON_DMAPOLL_CP_FENCE_ACTIVE
| TSEC_FALCON_WDTMRCTL_WDTMREN
|}
 
=== TSEC_FALCON_IRQDEST2 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 1
| 0
| FALCON_DMAPOLL_CP_DMA_ACTIVE
| TSEC_FALCON_IRQDEST2_HOST_DMA
|-
|-
| 4
| 16
| FALCON_DMAPOLL_CP_CFG_R_FENCE
| TSEC_FALCON_IRQDEST2_TARGET_DMA
|}
 
Used for routing Falcon's IRQs.
 
=== TSEC_FALCON_MAILBOX0 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 5
| 0-31
| FALCON_DMAPOLL_CP_CFG_W_FENCE
| TSEC_FALCON_MAILBOX0_DATA
|}
 
Scratch register for reading/writing data to Falcon.
 
=== TSEC_FALCON_MAILBOX1 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 16-23
| 0-31
| FALCON_DMAPOLL_CP_WCOUNT
| TSEC_FALCON_MAILBOX1_DATA
|-
| 24-31
| FALCON_DMAPOLL_CP_RCOUNT
|}
|}


Contains the status of a DMA transfer between the Falcon and the SCP.
Scratch register for reading/writing data to Falcon.


=== FALCON_HWCFG1 ===
=== TSEC_FALCON_ITFEN ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
!  Description
!  Description
|-
|-
| 0-3
| 0
| FALCON_HWCFG1_CORE_REV
| TSEC_FALCON_ITFEN_CTXEN
|-
|-
| 4-5
| 1
| FALCON_HWCFG1_SECURITY_MODEL
| TSEC_FALCON_ITFEN_MTHDEN
|-
| 6-7
| FALCON_HWCFG1_CORE_REV_SUBVERSION
|-
| 8-11
| FALCON_HWCFG1_IMEM_PORTS
|-
| 12-15
| FALCON_HWCFG1_DMEM_PORTS
|-
| 16-20
| FALCON_HWCFG1_TAG_WIDTH
|-
| 27
| FALCON_HWCFG1_DBG_PRIV_BUS
|-
| 28
| FALCON_HWCFG1_CSB_SIZE_16M
|-
| 29
| FALCON_HWCFG1_PRIV_DIRECT
|-
| 30
| FALCON_HWCFG1_DMEM_APERTURES
|-
| 31
| FALCON_HWCFG1_IMEM_AUTOFILL
|}
|}


=== FALCON_IMCTL ===
Used for enabling/disabling Falcon interfaces.
 
=== TSEC_FALCON_IDLESTATE ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
!  Description
!  Description
|-
|-
| 0-23
| 0
| Address
| TSEC_FALCON_IDLESTATE_FALCON_BUSY
|-
|-
| 24-26
| 1-15
| Command
| TSEC_FALCON_IDLESTATE_EXT_BUSY
0x00: NOP
0x01: IMINV (ITLB)
0x02: IMBLK (PTLB)
0x03: IMTAG (VTLB)
|}
|}


Controls the Falcon TLB.
Used for detecting if Falcon is busy or not.


=== FALCON_IMSTAT ===
=== TSEC_FALCON_CURCTX ===
Returns the result of the last command from [[#FALCON_IMCTL|FALCON_IMCTL]].
 
=== FALCON_TRACEIDX ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
!  Description
!  Description
|-
|-
| 0-7
| 0-27
| Index of where to start tracing from
| TSEC_FALCON_CURCTX_CTXPTR
|-
|-
| 16-23
| 28-29
| Maximum valid index
| TSEC_FALCON_CURCTX_CTXTGT
|-
|-
| 24-31
| 30
| Number of trace reads remaining
| TSEC_FALCON_CURCTX_CTXVLD
|}
|}


Controls the index for tracing with [[#FALCON_TRACEPC|FALCON_TRACEPC]].
=== TSEC_FALCON_NXTCTX ===
 
=== FALCON_TRACEPC ===
Returns the PC of the last call or branch executed.
 
=== FALCON_IMEMC ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
!  Description
!  Description
|-
|-
| 2-7
| 0-27
| Offset in IMEM block to read/write
| TSEC_FALCON_NXTCTX_CTXPTR
|-
| 8-15
| IMEM block to read/write
|-
|-
| 24
| 28-29
| Write auto-increment
| TSEC_FALCON_NXTCTX_CTXTGT
|-
| 25
| Read auto-increment
|-
| 28
| Mark uploaded code as secret
|-
| 29
| Secret code upload lockdown status (read-only)
|-
|-
| 30
| 30
| Secret code upload failure status (read-only)
| TSEC_FALCON_NXTCTX_CTXVLD
|-
| 31
| Secret code upload reset scrubber status (read-only)
|}
|}


Used for configuring access to Falcon's IMEM.
=== TSEC_FALCON_CTXACK ===
 
=== FALCON_IMEMD ===
Returns or takes the value for an IMEM read/write operation.
 
=== FALCON_IMEMT ===
Returns or takes the virtual page index for an IMEM read/write operation.
 
=== FALCON_DMEMC0 ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
!  Description
!  Description
|-
|-
| 2-7
| 0
| Offset in DMEM block to read/write
| TSEC_FALCON_CTXACK_SAVE_ACK
|-
|-
| 8-15
| 1
| DMEM block to read/write
| TSEC_FALCON_CTXACK_REST_ACK
|-
| 24
| Write auto-increment
|-
| 25
| Read auto-increment
|}
|}


Used for configuring access to Falcon's DMEM.
=== TSEC_FALCON_FHSTATE ===
 
=== FALCON_DMEMD0 ===
Returns or takes the value for a DMEM read/write operation.
 
=== FALCON_ICD_CMD ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
!  Description
!  Description
|-
|-
| 0-3
| 0
| FALCON_ICD_CMD_OPC
| TSEC_FALCON_FHSTATE_FALCON_HALTED
0x00: STOP
|-
0x01: RUN (run from PC)
| 1-15
0x02: JRUN (run from address)
| TSEC_FALCON_FHSTATE_EXT_HALTED
0x03: RUNB (run from PC)
|-
0x04: JRUNB (run from address)
| 16
0x05: STEP (step from PC)
| TSEC_FALCON_FHSTATE_ENGINE_FAULTED
0x06: JSTEP (step from address)
0x07: EMASK (set exception mask)
0x08: RREG (read register)
0x09: WREG (write register)
0x0A: RDM (read data memory)
0x0B: WDM (write data memory)
0x0C: RCM (read code memory)
0x0D: WCM (write code memory)
0x0E: RSTAT (read status)
0x0F: SBU
|-
|-
| 6-7
| 17
| FALCON_ICD_CMD_SZ
| TSEC_FALCON_FHSTATE_STALL_REQ
0x00: B (byte
|}
  0x01: HW (half word)
 
  0x02: W (word)
=== TSEC_FALCON_PRIVSTATE ===
{| class="wikitable" border="1"
! Bits
! Description
|-
|-
| 8-12
| 0
| FALCON_ICD_CMD_IDX
| TSEC_FALCON_PRIVSTATE_PRIV
0x00: REG0 | RSTAT0 | WB0
|}
  0x01: REG1 | RSTAT1 | WB1
 
  0x02: REG2 | RSTAT2 | WB2
=== TSEC_FALCON_MTHDDATA ===
0x03: REG3 | RSTAT3 | WB3
{| class="wikitable" border="1"
0x04: REG4 | RSTAT4
! Bits
0x05: REG5 | RSTAT5
! Description
0x06: REG6
|-
0x07: REG7
| 0-31
0x08: REG8
| TSEC_FALCON_MTHDDATA_DATA
  0x09: REG9
|}
  0x0A: REG10
 
0x0B: REG11
=== TSEC_FALCON_MTHDID ===
0x0C: REG12
{| class="wikitable" border="1"
0x0D: REG13
! Bits
0x0E: REG14
! Description
0x0F: REG15
|-
0x10: IV0
| 0-11
0x11: IV1
| TSEC_FALCON_MTHDID_ID
0x12: UNDEFINED
0x13: EV
0x14: SP
0x15: PC
0x16: IMB
0x17: DMB
0x18: CSW
0x19: CCR
0x1A: SEC
0x1B: CTX
0x1C: EXCI
|-
|-
| 14
| 12-14
| FALCON_ICD_CMD_ERROR
| TSEC_FALCON_MTHDID_SUBCH
|-
|-
| 15
| 15
| FALCON_ICD_CMD_RDVLD
| TSEC_FALCON_MTHDID_PRIV
|-
|-
| 16-31
| 16
| FALCON_ICD_CMD_PARM
| TSEC_FALCON_MTHDID_WPEND
0x0001: EMASK_TRAP0
|}
0x0002: EMASK_TRAP1
 
0x0004: EMASK_TRAP2
=== TSEC_FALCON_MTHDWDAT ===
0x0008: EMASK_TRAP3
{| class="wikitable" border="1"
  0x0010: EMASK_EXC_UNIMP
! Bits
  0x0020: EMASK_EXC_IMISS
! Description
0x0040: EMASK_EXC_IMHIT
|-
0x0080: EMASK_EXC_IBREAK
| 0-31
0x0100: EMASK_IV0
| TSEC_FALCON_MTHDWDAT_DATA
0x0200: EMASK_IV1
0x0400: EMASK_IV2
0x0800: EMASK_EXT0
0x1000: EMASK_EXT1
0x2000: EMASK_EXT2
0x4000: EMASK_EXT3
0x8000: EMASK_EXT4
|}
|}


Used for sending commands to the Falcon's in-chip debugger.
=== TSEC_FALCON_MTHDCOUNT ===
 
{| class="wikitable" border="1"
=== FALCON_ICD_ADDR ===
!  Bits
Takes the target address for the Falcon's in-chip debugger.
!  Description
 
|-
=== FALCON_ICD_WDATA ===
| 0-15
Takes the data for writing using the Falcon's in-chip debugger.
| TSEC_FALCON_MTHDCOUNT_COUNT
|}


=== FALCON_ICD_RDATA ===
=== TSEC_FALCON_MTHDPOP ===
Returns the data read using the Falcon's in-chip debugger.
 
When reading from an internal status register (STAT), the following applies:
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
Line 1,791: Line 1,916:
|-
|-
| 0
| 0
| RSTAT0_MEM_STALL
| TSEC_FALCON_MTHDPOP_POP
|-
|}
| 1
 
| RSTAT0_DMA_STALL
=== TSEC_FALCON_MTHDRAMSZ ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 2
| 0-15
| RSTAT0_FENCE_STALL
| TSEC_FALCON_MTHDRAMSZ_RAMSZ
|}
 
=== TSEC_FALCON_SFTRESET ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 3
| 0
| RSTAT0_DIV_STALL
| TSEC_FALCON_SFTRESET_EXT
|}
 
=== TSEC_FALCON_OS ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 4
| 0-31
| RSTAT0_DMA_STALL_DMAQ
| TSEC_FALCON_OS_VERSION
|}
 
=== TSEC_FALCON_RM ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 5
| 0-31
| RSTAT0_DMA_STALL_DMWAITING
| TSEC_FALCON_RM_CONFIG
|}
 
=== TSEC_FALCON_SOFT_PM ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 6
| 0-5
| RSTAT0_DMA_STALL_IMWAITING
| TSEC_FALCON_SOFT_PM_PROBE
|-
|-
| 7
| 16
| RSTAT0_ANY_STALL
| TSEC_FALCON_SOFT_PM_TRIGGER_END
|-
|-
| 8
| 17
| RSTAT0_SBFULL_STALL
| TSEC_FALCON_SOFT_PM_TRIGGER_START
|}
 
=== TSEC_FALCON_SOFT_MODE ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 9
| 0-5
| RSTAT0_SBHIT_STALL
| TSEC_FALCON_SOFT_MODE_PROBE
|}
 
=== TSEC_FALCON_DEBUG1 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 10
| 0-15
| RSTAT0_FLOW_STALL
| TSEC_FALCON_DEBUG1_MTHD_DRAIN_TIME
|-
|-
| 11
| 16
| RSTAT0_SP_STALL
| TSEC_FALCON_DEBUG1_CTXSW_MODE
|}
 
=== TSEC_FALCON_DEBUGINFO ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 12
| 0-31
| RSTAT0_BL_STALL
| TSEC_FALCON_DEBUGINFO_DATA
|-
|}
| 13
 
| RSTAT0_IPND_STALL
Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.
 
[6.0.0+] [[NV_services|nvservices]] sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.
 
=== TSEC_FALCON_IBRKPT1 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 14
| 0-23
| RSTAT0_LDSTQ_STALL
| TSEC_FALCON_IBRKPT1_PC
|-
| 16
| RSTAT0_NOINSTR_STALL
|-
| 20
| RSTAT0_HALTSTOP_FLUSH
|-
| 21
| RSTAT0_AFILL_FLUSH
|-
| 22
| RSTAT0_EXC_FLUSH
|-
| 23-25
| RSTAT0_IRQ_FLUSH
|-
| 28
| RSTAT0_VALIDRD
|-
|-
| 29
| 29
| RSTAT0_WAITING
| TSEC_FALCON_IBRKPT1_SUPPRESS
|-
|-
| 30
| 30
| RSTAT0_HALTED
| TSEC_FALCON_IBRKPT1_SKIP
|-
|-
| 31
| 31
| RSTAT0_MTHD_FULL
| TSEC_FALCON_IBRKPT1_EN
|}
|}
=== TSEC_FALCON_IBRKPT2 ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
!  Description
!  Description
|-
|-
| 0-3
| 0-23
| RSTAT1_WB_ALLOC
| TSEC_FALCON_IBRKPT2_PC
|-
|-
| 4-7
| 29
| RSTAT1_WB_VALID
| TSEC_FALCON_IBRKPT2_SUPPRESS
|-
|-
| 8-9
| 30
| RSTAT1_WB0_SZ
| TSEC_FALCON_IBRKPT2_SKIP
|-
|-
| 10-11
| 31
| RSTAT1_WB1_SZ
| TSEC_FALCON_IBRKPT2_EN
|}
 
=== TSEC_FALCON_CGCTL ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 12-13
| 0
| RSTAT1_WB2_SZ
| TSEC_FALCON_CGCTL_CG_OVERRIDE
|-
| 14-15
| RSTAT1_WB3_SZ
|-
| 16-19
| RSTAT1_WB0_IDX
|-
| 20-23
| RSTAT1_WB1_IDX
|-
| 24-27
| RSTAT1_WB2_IDX
|-
| 28-31
| RSTAT1_WB3_IDX
|}
|}
=== TSEC_FALCON_ENGCTL ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
!  Description
!  Description
|-
|-
| 0-3
| 0
| RSTAT2_DMAQ_NUM
| TSEC_FALCON_ENGCTL_INV_CONTEXT
|-
|-
| 4
| 1
| RSTAT2_DMA_ENABLE
| TSEC_FALCON_ENGCTL_SET_STALLREQ
|-
| 2
| TSEC_FALCON_ENGCTL_CLR_STALLREQ
|-
| 3
| TSEC_FALCON_ENGCTL_SWITCH_CONTEXT
|-
| 8
| TSEC_FALCON_ENGCTL_STALLREQ
|-
| 9
| TSEC_FALCON_ENGCTL_STALLACK
|}
 
=== TSEC_FALCON_PMM ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-4
| TSEC_FALCON_PMM_FALCON_STALL_SEL
0x00: ANY
0x01: CODE
0x02: DMAQ
0x03: DMFENCE
0x04: DMWAIT
0x05: IMWAIT
0x06: IPND
0x07: LDSTQ
0x08: SB
0x09: ANY_SC
0x0A: CODE_SC
0x0B: DMAQ_SC
0x0C: DMFENCE_SC
0x0D: DMWAIT_SC
0x0E: IMWAIT_SC
0x0F: IPND_SC
0x10: LDSTQ_SC
0x11: SB_SC
|-
|-
| 5-7
| 5-7
| RSTAT2_LDSTQ_NUM
| TSEC_FALCON_PMM_FALCON_IDLE_SEL
0x00: WAITING
0x01: ENG_IDLE
0x02: MTHD_FULL
0x03: WAITING_SC
0x04: ENG_IDLE_SC
0x05: MTHD_FULL_SC
|-
| 8-11
| TSEC_FALCON_PMM_FALCON_SOFTPM0_SEL
0x00: 0
0x01: 1
0x02: 2
0x03: 3
0x04: 4
0x05: 5
0x06: 0_SC
0x07: 1_SC
0x08: 2_SC
0x09: 3_SC
0x0A: 4_SC
0x0B: 5_SC
|-
| 12-15
| TSEC_FALCON_PMM_FALCON_SOFTPM1_SEL
0x00: 0
|-
|-
| 16-19
| 17-19
| RSTAT2_EM_BUSY
| TSEC_FALCON_PMM_TFBIF_DSTAT_SEL
0x00: 1KTRANSFER
0x01: RREQ
0x02: WREQ
0x03: TWREQ
0x04: 1KTRANSFER_SC
0x05: RREQ_SC
0x06: WREQ_SC
0x07: TWREQ_SC
|-
|-
| 20-23
| 20-23
| RSTAT2_EM_ACKED
| TSEC_FALCON_PMM_TFBIF_STALL0_SEL
0x00: RDATQ_FULL
0x01: RACKQ_FULL
0x02: WREQQ_FULL
0x03: WDATQ_FULL
0x04: WACKQ_FULL
0x05: MREQQ_FULL
0x06: RREQ_PEND
0x07: WREQ_PEND
0x08: RDATQ_FULL_SC
0x09: RACKQ_FULL_SC
0x0A: WREQQ_FULL_SC
0x0B: WDATQ_FULL_SC
0x0C: WACKQ_FULL_SC
0x0D: MREQQ_FULL_SC
0x0E: RREQ_PEND_SC
0x0F: WREQ_PEND_SC
|-
|-
| 24-27
| 24-27
| RSTAT2_EM_ISWR
| TSEC_FALCON_PMM_TFBIF_STALL1_SEL
0x00: RDATQ_FULL
|-
|-
| 28-31
| 28-31
| RSTAT2_EM_DVLD
| TSEC_FALCON_PMM_TFBIF_STALL2_SEL
0x00: RDATQ_FULL
|}
|}
=== TSEC_FALCON_ADDR ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
!  Description
!  Description
|-
|-
| 0
| 0-5
| RSTAT3_MTHD_IDLE
| TSEC_FALCON_ADDR_LSB
|-
|-
| 1
| 6-11
| RSTAT3_CTXSW_IDLE
| TSEC_FALCON_ADDR_MSB
|}
 
=== TSEC_FALCON_IBRKPT3 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 2
| 0-23
| RSTAT3_DMA_IDLE
| TSEC_FALCON_IBRKPT3_PC
|-
|-
| 3
| 29
| RSTAT3_SCP_IDLE
| TSEC_FALCON_IBRKPT3_SUPPRESS
|-
|-
| 4
| 30
| RSTAT3_LDST_IDLE
| TSEC_FALCON_IBRKPT3_SKIP
|-
|-
| 5
| 31
| RSTAT3_SBWB_EMPTY
| TSEC_FALCON_IBRKPT3_EN
|}
 
=== TSEC_FALCON_IBRKPT4 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 6-8
| 0-23
| RSTAT3_CSWIE
| TSEC_FALCON_IBRKPT4_PC
|-
|-
| 10
| 29
| RSTAT3_CSWE
| TSEC_FALCON_IBRKPT4_SUPPRESS
|-
|-
| 12-14
| 30
| RSTAT3_CTXSW_STATE
| TSEC_FALCON_IBRKPT4_SKIP
0x00: IDLE
0x01: SM_CHECK
0x02: SM_SAVE
0x03: SM_SAVE_WAIT
0x04: SM_BLK_BIND
0x05: SM_RESET
0x06: SM_RESETWAIT
0x07: SM_ACK
|-
|-
| 15
| 31
| RSTAT3_CTXSW_PEND
| TSEC_FALCON_IBRKPT4_EN
|}
 
=== TSEC_FALCON_IBRKPT5 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 17
| 0-23
| RSTAT3_DMA_FBREQ_IDLE
| TSEC_FALCON_IBRKPT5_PC
|-
|-
| 18
| 29
| RSTAT3_DMA_ACKQ_EMPTY
| TSEC_FALCON_IBRKPT5_SUPPRESS
|-
|-
| 19
| 30
| RSTAT3_DMA_RDQ_EMPTY
| TSEC_FALCON_IBRKPT5_SKIP
|-
|-
| 20
| 31
| RSTAT3_DMA_WR_BUSY
| TSEC_FALCON_IBRKPT5_EN
|}
 
=== TSEC_FALCON_EXCI ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 21
| 0-19
| RSTAT3_DMA_RD_BUSY
| TSEC_FALCON_EXCI_EXPC
|-
|-
| 22
| 20-23
| RSTAT3_LDST_XT_BUSY
| TSEC_FALCON_EXCI_EXCAUSE
|-
0x00: TRAP0
| 23
0x01: TRAP1
| RSTAT3_LDST_XT_BLOCK
0x02: TRAP2
|-
0x03: TRAP3
| 24
0x08: ILL_INS (invalid opcode)
| RSTAT3_ENG_IDLE
0x09: INV_INS (authentication entry)
0x0A: MISS_INS (page miss)
0x0B: DHIT_INS (page multiple hit)
0x0F: BRKPT_INS (breakpoint hit)
|}
|}
Contains information about raised exceptions.
=== TSEC_FALCON_SVEC_SPR ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
!  Description
!  Description
|-
|-
| 0-1
| 18
| RSTAT4_ICD_STATE
| TSEC_FALCON_SVEC_SPR_SIGPASS
0x00: NORMAL
|}
0x01: WAIT_ISSUE_CLEAR
 
  0x02: WAIT_EXLDQ_CLEAR
=== TSEC_FALCON_RSTAT0 ===
  0x03: FULL_DBG_MODE
Mirror of the [[#TSEC_FALCON_ICD_RDATA|ICD status register 0]].
 
=== TSEC_FALCON_RSTAT3 ===
Mirror of the [[#TSEC_FALCON_ICD_RDATA|ICD status register 3]].
 
=== TSEC_FALCON_SIRQMASK ===
Unofficial name.
 
Same as [[#TSEC_FALCON_IRQMASK|TSEC_FALCON_IRQMASK]], but for LS mode.
 
=== TSEC_FALCON_CPUCTL ===
{| class="wikitable" border="1"
! Bits
! Description
|-
|-
| 2-3
| 0
| RSTAT4_ICD_MODE
| TSEC_FALCON_CPUCTL_IINVAL
0x00: SUPPRESSICD
0x01: ENTERICD_IBRK
0x02: ENTERICD_STEP
|-
|-
| 16
| 1
| RSTAT4_ICD_EMASK_TRAP0
| TSEC_FALCON_CPUCTL_STARTCPU
|-
|-
| 17
| 2
| RSTAT4_ICD_EMASK_TRAP1
| TSEC_FALCON_CPUCTL_SRESET
|-
|-
| 18
| 3
| RSTAT4_ICD_EMASK_TRAP2
| TSEC_FALCON_CPUCTL_HRESET
|-
|-
| 19
| 4
| RSTAT4_ICD_EMASK_TRAP3
| TSEC_FALCON_CPUCTL_HALTED
|-
|-
| 20
| 5
| RSTAT4_ICD_EMASK_EXC_UNIMP
| TSEC_FALCON_CPUCTL_STOPPED
|-
|-
| 21
| 6
| RSTAT4_ICD_EMASK_EXC_IMISS
| TSEC_FALCON_CPUCTL_ALIAS_EN
|}
 
Used for signaling the Falcon CPU.
 
=== TSEC_FALCON_BOOTVEC ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 22
| 0-31
| RSTAT4_ICD_EMASK_EXC_IMHIT
| TSEC_FALCON_BOOTVEC_VEC
|}
 
Takes the Falcon's boot vector address.
 
=== TSEC_FALCON_HWCFG ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 23
| 0-8
| RSTAT4_ICD_EMASK_EXC_IBREAK
| TSEC_FALCON_HWCFG_IMEM_SIZE
|-
|-
| 24
| 9-17
| RSTAT4_ICD_EMASK_IV0
| TSEC_FALCON_HWCFG_DMEM_SIZE
|-
|-
| 25
| 18-26
| RSTAT4_ICD_EMASK_IV1
| TSEC_FALCON_HWCFG_METHODFIFO_DEPTH
|-
|-
| 26
| 27-31
| RSTAT4_ICD_EMASK_IV2
| TSEC_FALCON_HWCFG_DMAQUEUE_DEPTH
|}
 
=== TSEC_FALCON_DMACTL ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 27
| 0
| RSTAT4_ICD_EMASK_EXT0
| TSEC_FALCON_DMACTL_REQUIRE_CTX
|-
|-
| 28
| 1
| RSTAT4_ICD_EMASK_EXT1
| TSEC_FALCON_DMACTL_DMEM_SCRUBBING
|-
|-
| 29
| 2
| RSTAT4_ICD_EMASK_EXT2
| TSEC_FALCON_DMACTL_IMEM_SCRUBBING
|-
|-
| 30
| 3-6
| RSTAT4_ICD_EMASK_EXT3
| TSEC_FALCON_DMACTL_DMAQ_NUM
|-
|-
| 31
| 7
| RSTAT4_ICD_EMASK_EXT4
| TSEC_FALCON_DMACTL_SECURE_STAT
|}
|}
Used for configuring the Falcon's DMA engine.
=== TSEC_FALCON_DMATRFBASE ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
!  Description
!  Description
|-
|-
| 0-7
| 0-31
| RSTAT5_LRU_STATE
| TSEC_FALCON_DMATRFBASE_BASE
|}
|}


=== FALCON_SCTL ===
Base address of the external memory buffer, shifted right by 8.
 
The current transfer address is calculated by adding [[#TSEC_FALCON_DMATRFFBOFFS|TSEC_FALCON_DMATRFFBOFFS]] to the base.
 
=== TSEC_FALCON_DMATRFMOFFS ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
!  Description
!  Description
|-
|-
| 0-1
| 0-15
| FALCON_SCTL_SEC_MODE
| TSEC_FALCON_DMATRFMOFFS_OFFS
0: Non-secure
1: Light Secure
2: Heavy Secure
|-
| 4-5
| FALCON_SCTL_OLD_SEC_MODE
0: Non-secure
1: Light Secure
2: Heavy Secure
|-
| 12-13
| Unknown
|-
| 14
| Initialize the transition to LS mode
|}
|}


=== FALCON_SCTL_STAT ===
For transfers to DMEM: the destination address.
For transfers to IMEM: the destination virtual IMEM page.
 
=== TSEC_FALCON_DMATRFCMD ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
!  Description
!  Description
|-
|-
| 31
| 0
| Set on memory protection violation
| TSEC_FALCON_DMATRFCMD_FULL
|}
|-
 
| 1
=== FALCON_SPROT_IMEM ===
| TSEC_FALCON_DMATRFCMD_IDLE
{| class="wikitable" border="1"
|-
!  Bits
| 2-3
!  Description
| TSEC_FALCON_DMATRFCMD_SEC
|-
| 4
| TSEC_FALCON_DMATRFCMD_IMEM
|-
| 5
| TSEC_FALCON_DMATRFCMD_WRITE
|-
|-
| 0-3
| 8-10
| Read access level
| TSEC_FALCON_DMATRFCMD_SIZE
|-
|-
| 4-7
| 12-14
| Write access level
| TSEC_FALCON_DMATRFCMD_CTXDMA
|}
|}


Controls accesses to Falcon IMEM.
Used for configuring DMA transfers.


=== FALCON_SPROT_DMEM ===
=== TSEC_FALCON_DMATRFFBOFFS ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
!  Description
!  Description
|-
|-
| 0-3
| 0-31
| Read access level
| TSEC_FALCON_DMATRFFBOFFS_OFFS
|-
| 4-7
| Write access level
|}
|}


Controls accesses to Falcon DMEM.
For transfers to IMEM: the destination physical IMEM page.


=== FALCON_SPROT_CPUCTL ===
=== TSEC_FALCON_DMAPOLL_FB ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
!  Description
!  Description
|-
|-
| 0-3
| 0
| Read access level
| TSEC_FALCON_DMAPOLL_FB_FENCE_ACTIVE
|-
| 1
| TSEC_FALCON_DMAPOLL_FB_DMA_ACTIVE
|-
|-
| 4-7
| 4
| Write access level
| TSEC_FALCON_DMAPOLL_FB_CFG_R_FENCE
|-
| 5
| TSEC_FALCON_DMAPOLL_FB_CFG_W_FENCE
|-
| 16-23
| TSEC_FALCON_DMAPOLL_FB_WCOUNT
|-
| 24-31
| TSEC_FALCON_DMAPOLL_FB_RCOUNT
|}
|}


Controls accesses to the [[#FALCON_CPUCTL|FALCON_CPUCTL]] register.
Contains the status of a DMA transfer between the Falcon and external memory.


=== FALCON_SPROT_MISC ===
=== TSEC_FALCON_DMAPOLL_CP ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
!  Description
!  Description
|-
|-
| 0-3
| 0
| Read access level
| TSEC_FALCON_DMAPOLL_CP_FENCE_ACTIVE
|-
| 1
| TSEC_FALCON_DMAPOLL_CP_DMA_ACTIVE
|-
| 4
| TSEC_FALCON_DMAPOLL_CP_CFG_R_FENCE
|-
|-
| 4-7
| 5
| Write access level
| TSEC_FALCON_DMAPOLL_CP_CFG_W_FENCE
|}
 
Controls accesses to the following registers:
* FALCON_VM_SUPERVISOR
* FALCON_SUBENGINE_RESET
* FALCON_HOST_IO_INDEX
* [[#FALCON_DMACTL|FALCON_DMACTL]]
* [[#FALCON_IMCTL|FALCON_IMCTL]]
* [[#FALCON_IMSTAT|FALCON_IMSTAT]]
* FALCON_UNK_250
* FALCON_UNK_2E0
 
=== FALCON_SPROT_IRQ ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 0-3
| 16-23
| Read access level
| TSEC_FALCON_DMAPOLL_CP_WCOUNT
|-
|-
| 4-7
| 24-31
| Write access level
| TSEC_FALCON_DMAPOLL_CP_RCOUNT
|}
|}


Controls accesses to the following registers:
Contains the status of a DMA transfer between the Falcon and the SCP.
* [[#FALCON_IRQMODE|FALCON_IRQMODE]]
* [[#FALCON_IRQMSET|FALCON_IRQMSET]]
* [[#FALCON_IRQMCLR|FALCON_IRQMCLR]]
* [[#FALCON_IRQDEST|FALCON_IRQDEST]]
* FALCON_GPTMR_PERIOD
* FALCON_GPTMR_TIME
* FALCON_GPTMR_ENABLE
* FALCON_UNK_3C
* FALCON_UNK_E0


=== FALCON_SPROT_MTHD ===
=== TSEC_FALCON_HWCFG1 ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
Line 2,186: Line 2,479:
|-
|-
| 0-3
| 0-3
| Read access level
| TSEC_FALCON_HWCFG1_CORE_REV
|-
|-
| 4-7
| 4-5
| Write access level
| TSEC_FALCON_HWCFG1_SECURITY_MODEL
|-
| 6-7
| TSEC_FALCON_HWCFG1_CORE_REV_SUBVERSION
|-
| 8-11
| TSEC_FALCON_HWCFG1_IMEM_PORTS
|-
| 12-15
| TSEC_FALCON_HWCFG1_DMEM_PORTS
|-
| 16-20
| TSEC_FALCON_HWCFG1_TAG_WIDTH
|-
| 27
| TSEC_FALCON_HWCFG1_DBG_PRIV_BUS
|-
| 28
| TSEC_FALCON_HWCFG1_CSB_SIZE_16M
|-
| 29
| TSEC_FALCON_HWCFG1_PRIV_DIRECT
|-
| 30
| TSEC_FALCON_HWCFG1_DMEM_APERTURES
|-
| 31
| TSEC_FALCON_HWCFG1_IMEM_AUTOFILL
|}
|}


Controls accesses to the following registers:
=== TSEC_FALCON_CPUCTL_ALIAS ===
* [[#FALCON_ITFEN|FALCON_ITFEN]]
* FALCON_CURCTX
* FALCON_NXTCTX
* FALCON_CMDCTX
* FALCON_MTHD_DATA
* FALCON_MTHD_CMD
* FALCON_MTHD_DATA_WR
* FALCON_MTHD_OCCUPIED
* FALCON_MTHD_ACK
* FALCON_MTHD_LIMIT
* [[#FALCON_DEBUG1|FALCON_DEBUG1]]
 
=== FALCON_SPROT_SCTL ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
!  Description
!  Description
|-
|-
| 0-3
| 1
| Read access level
| TSEC_FALCON_CPUCTL_ALIAS_STARTCPU
|-
| 4-7
| Write access level
|}
|}


Controls accesses to the [[#FALCON_SCTL|FALCON_SCTL]] register.
=== TSEC_FALCON_STACKCFG ===
 
=== FALCON_SPROT_WDTMR ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
!  Description
!  Description
|-
|-
| 0-3
| 0-15
| Read access level
| TSEC_FALCON_STACKCFG_BOTTOM
|-
|-
| 4-7
| 31
| Write access level
| TSEC_FALCON_STACKCFG_SPEXC
|}
|}


Controls accesses to the following registers:
=== TSEC_FALCON_IMCTL ===
* FALCON_WDTMR_TIME
* FALCON_WDTMR_ENABLE
 
=== TSEC_SCP_CTL0 ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
!  Description
!  Description
|-
|-
| 20
| 0-23
| Enable TSEC_SCP_INSN_STAT register
| TSEC_FALCON_IMCTL_ADDR_BLK
|-
| 24-26
| TSEC_FALCON_IMCTL_CMD
0x00: NOP
0x01: IMINV (ITLB)
0x02: IMBLK (PTLB)
0x03: IMTAG (VTLB)
0x04: IMTAG_SETVLD
|}
 
Controls the Falcon TLB.
 
=== TSEC_FALCON_IMSTAT ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-31
| TSEC_FALCON_IMSTAT_VAL
|}
|}


=== TSEC_SCP_CTL1 ===
Returns the result of the last command from [[#TSEC_FALCON_IMCTL|TSEC_FALCON_IMCTL]].
 
=== TSEC_FALCON_TRACEIDX ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
!  Description
!  Description
|-
|-
| 11
| 0-7
| Enable TRNG testing mode
| TSEC_FALCON_TRACEIDX_IDX
|-
| 16-23
| TSEC_FALCON_TRACEIDX_MAXIDX
|-
|-
| 12
| 24-31
| Enable the TRNG
| TSEC_FALCON_TRACEIDX_CNT
|}
|}


=== TSEC_SCP_CTL_STAT ===
Controls the index for tracing with [[#TSEC_FALCON_TRACEPC|TSEC_FALCON_TRACEPC]].
 
=== TSEC_FALCON_TRACEPC ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
!  Description
!  Description
|-
|-
| 20
| 0-23
| TSEC_SCP_CTL_STAT_DEBUG_MODE
| TSEC_FALCON_TRACEPC_PC
|}
|}


=== TSEC_SCP_CTL_LOCK ===
Returns the PC of the last call or branch executed.
 
=== TSEC_FALCON_IMFILLRNG0 ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
!  Description
!  Description
|-
|-
| 0
| 0-15
| Disable reads for the SCP and TRNG register blocks
| TSEC_FALCON_IMFILLRNG0_TAG_LO
|-
|-
| 1
| 16-31
| Disable reads for the TFBIF register block
| TSEC_FALCON_IMFILLRNG0_TAG_HI
|}
 
=== TSEC_FALCON_IMFILLRNG1 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 2
| 0-15
| Disable reads for the DMA register block
| TSEC_FALCON_IMFILLRNG1_TAG_LO
|-
|-
| 3
| 16-31
| Disable reads for the TEGRA register block
| TSEC_FALCON_IMFILLRNG1_TAG_HI
|-
| 4
| Disable writes for the SCP and TRNG register blocks
|-
| 5
| Disable writes for the TFBIF register block
|-
| 6
| Disable writes for the DMA register block
|-
| 7
| Disable writes for the TEGRA register block
|}
|}


Locks accesses to sub-engines and can only be cleared in Heavy Secure mode.
=== TSEC_FALCON_IMFILLCTL ===
 
=== TSEC_SCP_CTL_PKEY ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
!  Description
!  Description
|-
|-
| 0
| 0-7
| TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
| TSEC_FALCON_IMFILLCTL_NBLOCKS
|-
| 1
| TSEC_SCP_CTL_PKEY_LOADED
|}
|}


=== TSEC_SCP_SEQ_CTL ===
=== TSEC_FALCON_IMCTL_DEBUG ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
!  Description
!  Description
|-
|-
| 0-3
| 0-23
| Sequence's instruction index
| TSEC_FALCON_IMCTL_DEBUG_ADDR_BLK
|-
|-
| 4-7
| 24-26
| Target and control flags
| TSEC_FALCON_IMCTL_DEBUG_CMD
|-
0x00: NOP
| 8-11
0x02: IMBLK
| Sequence's size
0x03: IMTAG
|}
|}


Controls the last crypto sequence (cs0 or cs1) created.
=== TSEC_FALCON_CMEMBASE ===
 
=== TSEC_SCP_SEQ_VAL ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
!  Description
!  Description
|-
|-
| 0-3
| 18-31
| Sequence instruction's first operand
| TSEC_FALCON_CMEMBASE_VAL
|-
| 4-9
| Sequence instruction's second operand
|-
| 10-14
| Sequence instruction's opcode
|}
|}


Contains information on the last crypto sequence (cs0 or cs1) created.
=== TSEC_FALCON_DMEMAPERT ===
 
=== TSEC_SCP_SEQ_STAT ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
!  Description
!  Description
|-
|-
| 0
| 0-7
| Set if crypto sequence recording (cs0begin/cs1begin) is active
| TSEC_FALCON_DMEMAPERT_TIME_OUT
|-
| 8-11
| TSEC_FALCON_DMEMAPERT_TIME_UNIT
|-
|-
| 4-7
| 16
| Number of instructions left for the crypto sequence
| TSEC_FALCON_DMEMAPERT_ENABLE
|-
|-
| 12-15
| 17-19
| Active crypto key register
| TSEC_FALCON_DMEMAPERT_LDSTQ_NUM
|}
|}


Contains information on the last crypto sequence (cs0 or cs1) executed.
=== TSEC_FALCON_EXTERRADDR ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-31
| TSEC_FALCON_EXTERRADDR_ADDR
|}


=== TSEC_SCP_INSN_STAT ===
=== TSEC_FALCON_EXTERRSTAT ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
!  Description
!  Description
|-
|-
| 0-3
| 0-23
| Destination register or immediate value
| TSEC_FALCON_EXTERRSTAT_PC
|-
| 24-27
| TSEC_FALCON_EXTERRSTAT_STAT
|-
| 31
| TSEC_FALCON_EXTERRSTAT_VALID
|}
 
=== TSEC_FALCON_CG2 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 8-13
| 1
| Source register or immediate value
| TSEC_FALCON_CG2_SLCG_FALCON_DMA
|-
|-
| 20-24
| 2
| Operation
| TSEC_FALCON_CG2_SLCG_FALCON_GC6_SR_FSM
0x0:  nop (fuc5 opcode 0x00)
0x1:  cmov (fuc5 opcode 0x84)
0x2:  cxsin (fuc5 opcode 0x88) or xdst (with cxset)
0x3:  cxsout (fuc5 opcode 0x8C) or xdld (with cxset)
0x4:  crnd (fuc5 opcode 0x90)
0x5:  cs0begin (fuc5 opcode 0x94)
0x6:  cs0exec (fuc5 opcode 0x98)
0x7:  cs1begin (fuc5 opcode 0x9C)
0x8:  cs1exec (fuc5 opcode 0xA0)
0x9:  invalid (fuc5 opcode 0xA4)
0xA:  cchmod (fuc5 opcode 0xA8)
0xB:  cxor (fuc5 opcode 0xAC)
0xC:  cadd (fuc5 opcode 0xB0)
0xD:  cand (fuc5 opcode 0xB4)
0xE:  crev (fuc5 opcode 0xB8)
0xF:  cprecmac (fuc5 opcode 0xBC)
0x10: csecret (fuc5 opcode 0xC0)
0x11: ckeyreg (fuc5 opcode 0xC4)
0x12: ckexp (fuc5 opcode 0xC8)
0x13: ckrexp (fuc5 opcode 0xCC)
0x14: cenc (fuc5 opcode 0xD0)
0x15: cdec (fuc5 opcode 0xD4)
0x16: csigauth (fuc5 opcode 0xD8)
0x17: csigenc (fuc5 opcode 0xDC)
0x18: csigclr (fuc5 opcode 0xE0)
|-
|-
| 28
| 3
| Set if the instruction is valid
| TSEC_FALCON_CG2_SLCG_FALCON_PIPE
|-
|-
| 31
| 4
| Set if running in HS mode
| TSEC_FALCON_CG2_SLCG_FALCON_DIV
|}
 
Contains information on the last crypto instruction executed.
 
=== TSEC_SCP_AUTH_STAT ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 0-1
| 5
| Signature comparison result (3=succeeded, 2=failed)
| TSEC_FALCON_CG2_SLCG_FALCON_ICD
|}
 
Contains information on the last authentication attempt.
 
=== TSEC_SCP_AES_STAT ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 0-4
| 6
| First opcode
| TSEC_FALCON_CG2_SLCG_FALCON_CFG
|-
|-
| 5-9
| 7
| Second opcode
| TSEC_FALCON_CG2_SLCG_FALCON_CTXSW
|-
|-
| 15-16
| 8
| AES operation
| TSEC_FALCON_CG2_SLCG_FALCON_PMB
0: Encryption
|-
1: Decryption
| 9
2: Key expansion
| TSEC_FALCON_CG2_SLCG_FALCON_RF
3: Key reverse expansion
|}
 
Contains information on the last AES sequence executed.
 
=== TSEC_SCP_IRQSTAT ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 0
| 10
| TSEC_SCP_IRQSTAT_TRNG
| TSEC_FALCON_CG2_SLCG_FALCON_MUL
|-
|-
| 8
| 11
| TSEC_SCP_IRQSTAT_ACL_ERROR
| TSEC_FALCON_CG2_SLCG_FALCON_LDST
|-
|-
| 12
| 12
| Unknown
| TSEC_FALCON_CG2_SLCG_FALCON_TSYNC
|-
| 13
| TSEC_FALCON_CG2_SLCG_FALCON_GPTMR
|-
|-
| 16
| 14
| TSEC_SCP_IRQSTAT_INSN_ERROR
| TSEC_FALCON_CG2_SLCG_FALCON_WDTMR
|-
|-
| 20
| 15
| TSEC_SCP_IRQSTAT_SINGLE_STEP
| TSEC_FALCON_CG2_SLCG_FALCON_IRQSTAT
|-
|-
| 24
| 16
| Unknown
| TSEC_FALCON_CG2_SLCG_FALCON_TOP
|-
|-
| 28
| 17
| Unknown
| TSEC_FALCON_CG2_SLCG_FBIF
|}
|}


Used for getting the status of crypto IRQs.
=== TSEC_FALCON_IMEMC ===
 
=== TSEC_SCP_IRQMASK ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
!  Description
!  Description
|-
|-
| 0
| 2-7
| TSEC_SCP_IRQMASK_TRNG
| TSEC_FALCON_IMEMC_OFFS
|-
|-
| 8
| 8-15
| TSEC_SCP_IRQMASK_ACL_ERROR
| TSEC_FALCON_IMEMC_BLK
|-
|-
| 12
| 24
| Unknown
| TSEC_FALCON_IMEMC_AINCW
|-
| 25
| TSEC_FALCON_IMEMC_AINCR
|-
|-
| 16
| 28
| TSEC_SCP_IRQMASK_INSN_ERROR
| TSEC_FALCON_IMEMC_SECURE
|-
|-
| 20
| 29
| TSEC_SCP_IRQMASK_SINGLE_STEP
| TSEC_FALCON_IMEMC_SEC_ATOMIC
|-
|-
| 24
| 30
| Unknown
| TSEC_FALCON_IMEMC_SEC_WR_VIO
|-
|-
| 28
| 31
| Unknown
| TSEC_FALCON_IMEMC_SEC_LOCK
|}
|}


Used for getting the value of the mask for crypto IRQs.
Used for configuring access to Falcon's IMEM.


=== TSEC_SCP_ACL_ERR ===
=== TSEC_FALCON_IMEMD ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
!  Description
!  Description
|-
|-
| 0
| 0-31
| Set when writing to a crypto register without the correct ACL
| TSEC_FALCON_IMEMD_DATA
|}
 
Returns or takes the value for an IMEM read/write operation.
 
=== TSEC_FALCON_IMEMT ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 4
| 0-15
| Set when reading from a crypto register without the correct ACL
| TSEC_FALCON_IMEMT_TAG
|-
| 8
| Set on an invalid ACL change (cchmod)
|-
| 31
| An ACL error occurred
|}
|}


Contains information on the status generated by the [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT_ACL_ERROR]] IRQ.
Returns or takes the virtual page index for an IMEM read/write operation.


=== TSEC_SCP_INSN_ERR ===
=== TSEC_FALCON_DMEMC ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
!  Description
!  Description
|-
|-
| 0
| 2-7
| Invalid instruction
| TSEC_FALCON_DMEMC_OFFS
|-
|-
| 4
| 8-15
| Empty crypto sequence
| TSEC_FALCON_DMEMC_BLK
|-
|-
| 8
| 24
| Crypto sequence is too long
| TSEC_FALCON_DMEMC_AINCW
|-
|-
| 12
| 25
| Crypto sequence was not finished
| TSEC_FALCON_DMEMC_AINCR
|}
 
Used for configuring access to Falcon's DMEM.
 
=== TSEC_FALCON_DMEMD ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 16
| 0-31
| Insecure signature (csigenc, csigclr or csigauth)
| TSEC_FALCON_DMEMD_DATA
|-
| 20
| Invalid signature (csigauth in HS mode)
|-
| 24
| Forbidden ACL change (cchmod in NS mode)
|}
|}


Contains information on crypto errors generated by the [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT_INSN_ERROR]] IRQ.
Returns or takes the value for a DMEM read/write operation.


=== TSEC_TFBIF_MCCIF_FIFOCTRL ===
=== TSEC_FALCON_ICD_CMD ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
!  Description
!  Description
|-
|-
| 0
| 0-3
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
| TSEC_FALCON_ICD_CMD_OPC
0x00: STOP
0x01: RUN (run from PC)
0x02: JRUN (run from address)
0x03: RUNB (run from PC)
0x04: JRUNB (run from address)
0x05: STEP (step from PC)
0x06: JSTEP (step from address)
0x07: EMASK (set exception mask)
0x08: RREG (read register)
0x09: WREG (write register)
0x0A: RDM (read data memory)
0x0B: WDM (write data memory)
0x0C: RCM (read MMIO/configuration memory)
0x0D: WCM (write MMIO/configuration memory)
0x0E: RSTAT (read status)
0x0F: SBU (store buffer update)
|-
|-
| 1
| 6-7
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
| TSEC_FALCON_ICD_CMD_SZ
0x00: B (byte)
0x01: HW (half word)
0x02: W (word)
|-
|-
| 2
| 8-12
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
| TSEC_FALCON_ICD_CMD_IDX
0x00: REG0 | RSTAT0 | WB0
0x01: REG1 | RSTAT1 | WB1
0x02: REG2 | RSTAT2 | WB2
0x03: REG3 | RSTAT3 | WB3
0x04: REG4 | RSTAT4
0x05: REG5 | RSTAT5
0x06: REG6
0x07: REG7
0x08: REG8
0x09: REG9
0x0A: REG10
0x0B: REG11
0x0C: REG12
0x0D: REG13
0x0E: REG14
0x0F: REG15
0x10: IV0
0x11: IV1
0x12: UNDEFINED
0x13: EV
0x14: SP
0x15: PC
0x16: IMB
0x17: DMB
0x18: CSW
0x19: CCR
0x1A: SEC
0x1B: CTX
0x1C: EXCI
0x1D: SEC1
0x1E: IMB1
0x1F: DMB1
|-
|-
| 3
| 14
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
| TSEC_FALCON_ICD_CMD_ERROR
|-
|-
| 4
| 15
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
| TSEC_FALCON_ICD_CMD_RDVLD
|-
|-
| 5
| 16-31
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
| TSEC_FALCON_ICD_CMD_PARM
|-
0x0001: EMASK_TRAP0
| 6
0x0002: EMASK_TRAP1
| TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
0x0004: EMASK_TRAP2
|-
0x0008: EMASK_TRAP3
| 7
0x0010: EMASK_EXC_UNIMP
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
0x0020: EMASK_EXC_IMISS
|-
0x0040: EMASK_EXC_IMHIT
| 8
0x0080: EMASK_EXC_IBREAK
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE
0x0100: EMASK_IV0
0x0200: EMASK_IV1
0x0400: EMASK_IV2
0x0800: EMASK_EXT0
0x1000: EMASK_EXT1
0x2000: EMASK_EXT2
0x4000: EMASK_EXT3
0x8000: EMASK_EXT4
|}
|}


=== TSEC_TFBIF_MCCIF_FIFOCTRL1 ===
Used for sending commands to the Falcon's in-chip debugger.
 
=== TSEC_FALCON_ICD_ADDR ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
!  Description
!  Description
|-
|-
| 0-15
| 0-31
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
| TSEC_FALCON_ICD_ADDR_ADDR
|}
 
Takes the target address for the Falcon's in-chip debugger.
 
=== TSEC_FALCON_ICD_WDATA ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 16-31
| 0-31
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT
| TSEC_FALCON_ICD_WDATA_DATA
|}
|}


=== TSEC_TFBIF_MMU_PROT ===
Takes the data for writing using the Falcon's in-chip debugger.
 
=== TSEC_FALCON_ICD_RDATA ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
!  Description
!  Description
|-
|-
| 0-3
| 0-31
| Read access level
| TSEC_FALCON_ICD_RDATA_DATA
|-
| 4-7
| Write access level
|}
|}


Controls accesses to external memory at the MMU level. Accessible in HS mode only.
Returns the data read using the Falcon's in-chip debugger.


=== TSEC_TFBIF_MMU_PHYS_SEC ===
When reading from an internal status register (STAT), the following applies:
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
Line 2,612: Line 2,964:
|-
|-
| 0
| 0
| Bypass MMU translation on CTXDMA port 0
| RSTAT0_MEM_STALL
|-
|-
| 4
| 1
| Bypass MMU translation on CTXDMA port 1
| RSTAT0_DMA_STALL
|-
|-
| 8
| 2
| Bypass MMU translation on CTXDMA port 2
| RSTAT0_FENCE_STALL
|-
|-
| 12
| 3
| Bypass MMU translation on CTXDMA port 3
| RSTAT0_DIV_STALL
|-
|-
| 16
| 4
| Bypass MMU translation on CTXDMA port 4
| RSTAT0_DMA_STALL_DMAQ
|-
|-
| 20
| 5
| Bypass MMU translation on CTXDMA port 5
| RSTAT0_DMA_STALL_DMWAITING
|-
|-
| 24
| 6
| Bypass MMU translation on CTXDMA port 6
| RSTAT0_DMA_STALL_IMWAITING
|-
|-
| 28
| 7
| Bypass MMU translation on CTXDMA port 7
| RSTAT0_ANY_STALL
|}
|-
 
| 8
Controls MMU bypass mode. Accessible in HS mode only.
| RSTAT0_SBFULL_STALL
 
[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.
 
=== TSEC_TFBIF_MMU_TRANSCFG ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 0-3
| 9
| Transfer configuration for CTXDMA port 0
| RSTAT0_SBHIT_STALL
|-
|-
| 4-7
| 10
| Transfer configuration for CTXDMA port 1
| RSTAT0_FLOW_STALL
|-
|-
| 8-11
| 11
| Transfer configuration for CTXDMA port 2
| RSTAT0_SP_STALL
|-
|-
| 12-15
| 12
| Transfer configuration for CTXDMA port 3
| RSTAT0_BL_STALL
|-
|-
| 16-19
| 13
| Transfer configuration for CTXDMA port 4
| RSTAT0_IPND_STALL
|-
|-
| 20-23
| 14
| Transfer configuration for CTXDMA port 5
| RSTAT0_LDSTQ_STALL
|-
|-
| 24-27
| 16
| Transfer configuration for CTXDMA port 6
| RSTAT0_NOINSTR_STALL
|-
|-
| 28-31
| 20
| Transfer configuration for CTXDMA port 7
| RSTAT0_HALTSTOP_FLUSH
|}
 
Controls external memory transfers' configuration at the MMU level. Accessible in HS mode only.
 
[6.0.0+] The nvhost_tsec firmware sets this register to 0x20 or 0x140 before reading memory from the GPU UCODE carveout.
 
=== TSEC_TFBIF_ACTMON_MAMASK ===
Takes the memory access mask for the Activity Monitor. Disconnected on the TSEC, but available on NVDEC, NVENC and NVJPG.
 
=== TSEC_TFBIF_ACTMON_BORPS ===
Takes the billions of records per second count for the Activity Monitor. Disconnected on the TSEC, but available on NVDEC, NVENC and NVJPG.
 
=== TSEC_TFBIF_ACTMON_CTL ===
Controls the Activity Monitor. Disconnected on the TSEC, but available on NVDEC, NVENC and NVJPG.
 
=== TSEC_CG ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 0-5
| 21
| TSEC_CG_IDLE_CG_DLY_CNT
| RSTAT0_AFILL_FLUSH
|-
|-
| 6
| 22
| TSEC_CG_IDLE_CG_EN
| RSTAT0_EXC_FLUSH
|-
|-
| 16-18
| 23-25
| TSEC_CG_WAKEUP_DLY_CNT
| RSTAT0_IRQ_FLUSH
|-
|-
| 19
| 28
| TSEC_CG_WAKEUP_DLY_EN
| RSTAT0_VALIDRD
|}
 
=== TSEC_DMA_CMD ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 0
| 29
| TSEC_DMA_CMD_READ
| RSTAT0_WAITING
|-
|-
| 1
| 30
| TSEC_DMA_CMD_WRITE
| RSTAT0_HALTED
|-
| 4-7
| TSEC_DMA_CMD_BYTE_MASK
|-
| 12-13
| TSEC_DMA_CMD_STATUS
0: Idle
1: Busy
2: Error
3: Disabled
|-
|-
| 31
| 31
| TSEC_DMA_CMD_INIT
| RSTAT0_MTHD_FULL
|}
|}
A DMA read/write operation requires bits TSEC_DMA_CMD_INIT and TSEC_DMA_CMD_READ/TSEC_DMA_CMD_WRITE to be set in TSEC_DMA_CMD.
During the transfer, TSEC_DMA_CMD_STATUS is set to "Busy".
Accessing an invalid address sets TSEC_DMA_CMD_STATUS to "Error".
=== TSEC_DMA_ADDR ===
Takes the address for DMA transfers between TSEC and HOST1X (master and clients).
=== TSEC_DMA_DATA ===
Takes the data for DMA transfers between TSEC and HOST1X (master and clients).
=== TSEC_DMA_TIMEOUT ===
Always 0xFFF.
=== TSEC_TEGRA_CTL ===
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
!  Description
!  Description
|-
|-
| 16
| 0-3
| TSEC_TEGRA_CTL_TKFI_KFUSE
| RSTAT1_WB_ALLOC
|-
|-
| 17
| 4-7
| TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
| RSTAT1_WB_VALID
|-
|-
| 24
| 8-9
| TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
| RSTAT1_WB0_SZ
|-
|-
| 25
| 10-11
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
| RSTAT1_WB1_SZ
|-
|-
| 26
| 12-13
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
| RSTAT1_WB2_SZ
|-
| 14-15
| RSTAT1_WB3_SZ
|-
| 16-19
| RSTAT1_WB0_IDX
|-
| 20-23
| RSTAT1_WB1_IDX
|-
| 24-27
| RSTAT1_WB2_IDX
|-
|-
| 27
| 28-31
| TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C
| RSTAT1_WB3_IDX
|}
|}
 
{| class="wikitable" border="1"
== SCP ==
!  Bits
Part of the information here (which hasn't made it into envytools documentation yet) was shared by [https://wiki.0x04.net/wiki/Marcin_Ko%C5%9Bcielnicki mwk] from reverse engineering falcon processors over the years.
!  Description
 
|-
=== Authenticated Mode ===
| 0-3
==== Entry ====
| RSTAT2_DMAQ_NUM
From non-secure mode, upon jumping to a page marked as secret, a secret fault occurs. This causes the CPU to verify the region specified in $cauth against the MAC loaded in $c6. If the comparison is successful, the valid bit (bit0) is set on all pages in the $cauth region, and $pc is set to the base of the $cauth region. If the comparsion fails, the CPU is halted.
|-
 
| 4
| RSTAT2_DMA_ENABLE
|-
| 5-7
| RSTAT2_LDSTQ_NUM
|-
| 16-19
| RSTAT2_EM_BUSY
|-
| 20-23
| RSTAT2_EM_ACKED
|-
| 24-27
| RSTAT2_EM_ISWR
|-
| 28-31
| RSTAT2_EM_DVLD
|}
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0
| RSTAT3_MTHD_IDLE
|-
| 1
| RSTAT3_CTXSW_IDLE
|-
| 2
| RSTAT3_DMA_IDLE
|-
| 3
| RSTAT3_SCP_IDLE
|-
| 4
| RSTAT3_LDST_IDLE
|-
| 5
| RSTAT3_SBWB_EMPTY
|-
| 6-8
| RSTAT3_CSWIE
|-
| 10
| RSTAT3_CSWE
|-
| 12-14
| RSTAT3_CTXSW_STATE
0x00: IDLE
0x01: SM_CHECK
0x02: SM_SAVE
0x03: SM_SAVE_WAIT
0x04: SM_BLK_BIND
0x05: SM_RESET
0x06: SM_RESETWAIT
0x07: SM_ACK
|-
| 15
| RSTAT3_CTXSW_PEND
|-
| 17
| RSTAT3_DMA_FBREQ_IDLE
|-
| 18
| RSTAT3_DMA_ACKQ_EMPTY
|-
| 19
| RSTAT3_DMA_RDQ_EMPTY
|-
| 20
| RSTAT3_DMA_WR_BUSY
|-
| 21
| RSTAT3_DMA_RD_BUSY
|-
| 22
| RSTAT3_LDST_XT_BUSY
|-
| 23
| RSTAT3_LDST_XT_BLOCK
|-
| 24
| RSTAT3_ENG_IDLE
|}
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-1
| RSTAT4_ICD_STATE
0x00: NORMAL
0x01: WAIT_ISSUE_CLEAR
0x02: WAIT_EXLDQ_CLEAR
0x03: FULL_DBG_MODE
|-
| 2-3
| RSTAT4_ICD_MODE
0x00: SUPPRESSICD
0x01: ENTERICD_IBRK
0x02: ENTERICD_STEP
|-
| 16
| RSTAT4_ICD_EMASK_TRAP0
|-
| 17
| RSTAT4_ICD_EMASK_TRAP1
|-
| 18
| RSTAT4_ICD_EMASK_TRAP2
|-
| 19
| RSTAT4_ICD_EMASK_TRAP3
|-
| 20
| RSTAT4_ICD_EMASK_EXC_UNIMP
|-
| 21
| RSTAT4_ICD_EMASK_EXC_IMISS
|-
| 22
| RSTAT4_ICD_EMASK_EXC_IMHIT
|-
| 23
| RSTAT4_ICD_EMASK_EXC_IBREAK
|-
| 24
| RSTAT4_ICD_EMASK_IV0
|-
| 25
| RSTAT4_ICD_EMASK_IV1
|-
| 26
| RSTAT4_ICD_EMASK_IV2
|-
| 27
| RSTAT4_ICD_EMASK_EXT0
|-
| 28
| RSTAT4_ICD_EMASK_EXT1
|-
| 29
| RSTAT4_ICD_EMASK_EXT2
|-
| 30
| RSTAT4_ICD_EMASK_EXT3
|-
| 31
| RSTAT4_ICD_EMASK_EXT4
|}
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-7
| RSTAT5_LRU_STATE
|}
 
=== TSEC_FALCON_SCTL ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0
| TSEC_FALCON_SCTL_LSMODE
|-
| 1
| TSEC_FALCON_SCTL_HSMODE
|-
| 4-5
| Current access level
|-
| 8-9
| Unknown access level
|-
| 12
| Unknown
|-
| 13
| Unknown
|-
| 14
| Initialize the transition to LS mode
|}
 
=== TSEC_FALCON_SERRSTAT ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-23
| Unknown
|-
| 30
| Unknown
|-
| 31
| Set on memory protection violation
|}
 
Unofficial name.
 
Used for detecting invalid CSB accesses in LS mode.
 
=== TSEC_FALCON_SERRVAL ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-31
| Error code
|}
 
Unofficial name.
 
=== TSEC_FALCON_SERRADDR ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-31
| Error address
|}
 
Unofficial name.
 
=== TSEC_FALCON_SCTL1 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-1
| CSB access level
|-
| 2-3
| Unknown access level
|}
 
Unofficial name.
 
=== TSEC_FALCON_STEST ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-31
| Unknown
|}
 
Unofficial name.
 
=== TSEC_FALCON_SICD ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0
| Enable access to ICD command STOP
|-
| 1
| Enable access to ICD command RUN
|-
| 2
| Enable access to ICD command RUNB
|-
| 3
| Enable access to ICD command STEP
|-
| 4
| Enable access to ICD command EMASK
|-
| 5
| Enable access to ICD command RREG (only for SPRs)
|-
| 6
| Enable access to ICD command RSTAT
|-
| 7
| Enable access to IBRKPT registers
|-
| 8
| Enable access to ICD command RREG (only for GPRs)
|-
| 9
| Enable access to ICD command RDM
|}
 
Unofficial name.
 
Controls access to the ICD in LS mode.
 
=== TSEC_FALCON_SPROT_IMEM ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-2
| Read access level
|-
| 3
| Set on memory read access violation
|-
| 4-6
| Write access level
|-
| 7
| Set on memory write access violation
|}
 
Unofficial name.
 
Controls accesses to Falcon IMEM.
 
=== TSEC_FALCON_SPROT_DMEM ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-2
| Read access level
|-
| 3
| Set on memory read access violation
|-
| 4-6
| Write access level
|-
| 7
| Set on memory write access violation
|}
 
Unofficial name.
 
Controls accesses to Falcon DMEM.
 
=== TSEC_FALCON_SPROT_CPUCTL ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-2
| Read access level
|-
| 3
| Set on memory read access violation
|-
| 4-6
| Write access level
|-
| 7
| Set on memory write access violation
|}
 
Unofficial name.
 
Controls accesses to the [[#TSEC_FALCON_CPUCTL|TSEC_FALCON_CPUCTL]] register.
 
=== TSEC_FALCON_SPROT_MISC ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-2
| Read access level
|-
| 3
| Set on memory read access violation
|-
| 4-6
| Write access level
|-
| 7
| Set on memory write access violation
|}
 
Unofficial name.
 
Controls accesses to the following registers:
* [[#TSEC_FALCON_PRIVSTATE|TSEC_FALCON_PRIVSTATE]]
* [[#TSEC_FALCON_SFTRESET|TSEC_FALCON_SFTRESET]]
* [[#TSEC_FALCON_ADDR|TSEC_FALCON_ADDR]]
* [[#TSEC_FALCON_DMACTL|TSEC_FALCON_DMACTL]]
* [[#TSEC_FALCON_IMCTL|TSEC_FALCON_IMCTL]]
* [[#TSEC_FALCON_IMSTAT|TSEC_FALCON_IMSTAT]]
* [[#TSEC_FALCON_SCTL1|TSEC_FALCON_SCTL1]]
* [[#TSEC_FALCON_DMAINFO_CTL|TSEC_FALCON_DMAINFO_CTL]]
 
=== TSEC_FALCON_SPROT_IRQ ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-2
| Read access level
|-
| 3
| Set on memory read access violation
|-
| 4-6
| Write access level
|-
| 7
| Set on memory write access violation
|}
 
Unofficial name.
 
Controls accesses to the following registers:
* [[#TSEC_FALCON_IRQMODE|TSEC_FALCON_IRQMODE]]
* [[#TSEC_FALCON_IRQMSET|TSEC_FALCON_IRQMSET]]
* [[#TSEC_FALCON_IRQMCLR|TSEC_FALCON_IRQMCLR]]
* [[#TSEC_FALCON_IRQDEST|TSEC_FALCON_IRQDEST]]
* [[#TSEC_FALCON_GPTMRINT|TSEC_FALCON_GPTMRINT]]
* [[#TSEC_FALCON_GPTMRVAL|TSEC_FALCON_GPTMRVAL]]
* [[#TSEC_FALCON_GPTMRCTL|TSEC_FALCON_GPTMRCTL]]
* [[#TSEC_FALCON_IRQDEST2|TSEC_FALCON_IRQDEST2]]
* [[#TSEC_FALCON_SIRQMASK|TSEC_FALCON_SIRQMASK]]
 
=== TSEC_FALCON_SPROT_MTHD ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-2
| Read access level
|-
| 3
| Set on memory read access violation
|-
| 4-6
| Write access level
|-
| 7
| Set on memory write access violation
|}
 
Unofficial name.
 
Controls accesses to the following registers:
* [[#TSEC_FALCON_ITFEN|TSEC_FALCON_ITFEN]]
* [[#TSEC_FALCON_CURCTX|TSEC_FALCON_CURCTX]]
* [[#TSEC_FALCON_NXTCTX|TSEC_FALCON_NXTCTX]]
* [[#TSEC_FALCON_CTXACK|TSEC_FALCON_CTXACK]]
* [[#TSEC_FALCON_MTHDDATA|TSEC_FALCON_MTHDDATA]]
* [[#TSEC_FALCON_MTHDID|TSEC_FALCON_MTHDID]]
* [[#TSEC_FALCON_MTHDWDAT|TSEC_FALCON_MTHDWDAT]]
* [[#TSEC_FALCON_MTHDCOUNT|TSEC_FALCON_MTHDCOUNT]]
* [[#TSEC_FALCON_MTHDPOP|TSEC_FALCON_MTHDPOP]]
* [[#TSEC_FALCON_MTHDRAMSZ|TSEC_FALCON_MTHDRAMSZ]]
* [[#TSEC_FALCON_DEBUG1|TSEC_FALCON_DEBUG1]]
 
=== TSEC_FALCON_SPROT_SCTL ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-2
| Read access level
|-
| 3
| Set on memory read access violation
|-
| 4-6
| Write access level
|-
| 7
| Set on memory write access violation
|}
 
Unofficial name.
 
Controls accesses to the [[#TSEC_FALCON_SCTL|TSEC_FALCON_SCTL]] register.
 
=== TSEC_FALCON_SPROT_WDTMR ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-2
| Read access level
|-
| 3
| Set on memory read access violation
|-
| 4-6
| Write access level
|-
| 7
| Set on memory write access violation
|}
 
Unofficial name.
 
Controls accesses to the following registers:
* [[#TSEC_FALCON_WDTMRVAL|TSEC_FALCON_WDTMRVAL]]
* [[#TSEC_FALCON_WDTMRCTL|TSEC_FALCON_WDTMRCTL]]
 
=== TSEC_FALCON_DMAINFO_FINISHED_FBRD_LOW ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-31
| TSEC_FALCON_DMAINFO_FINISHED_FBRD_LOW_VAL
|}
 
=== TSEC_FALCON_DMAINFO_FINISHED_FBRD_HIGH ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-30
| TSEC_FALCON_DMAINFO_FINISHED_FBRD_HIGH_VAL
|-
| 31
| TSEC_FALCON_DMAINFO_FINISHED_FBRD_HIGH_OBIT
|}
 
=== TSEC_FALCON_DMAINFO_FINISHED_FBWR_LOW ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-31
| TSEC_FALCON_DMAINFO_FINISHED_FBWR_LOW_VAL
|}
 
=== TSEC_FALCON_DMAINFO_FINISHED_FBWR_HIGH ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-30
| TSEC_FALCON_DMAINFO_FINISHED_FBWR_HIGH_VAL
|-
| 31
| TSEC_FALCON_DMAINFO_FINISHED_FBWR_HIGH_OBIT
|}
 
=== TSEC_FALCON_DMAINFO_CURRENT_FBRD_LOW ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-31
| TSEC_FALCON_DMAINFO_CURRENT_FBRD_LOW_VAL
|}
 
=== TSEC_FALCON_DMAINFO_CURRENT_FBRD_HIGH ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-30
| TSEC_FALCON_DMAINFO_CURRENT_FBRD_HIGH_VAL
|-
| 31
| TSEC_FALCON_DMAINFO_CURRENT_FBRD_HIGH_OBIT
|}
 
=== TSEC_FALCON_DMAINFO_CURRENT_FBWR_LOW ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-31
| TSEC_FALCON_DMAINFO_CURRENT_FBWR_LOW_VAL
|}
 
=== TSEC_FALCON_DMAINFO_CURRENT_FBWR_HIGH ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-30
| TSEC_FALCON_DMAINFO_CURRENT_FBWR_HIGH_VAL
|-
| 31
| TSEC_FALCON_DMAINFO_CURRENT_FBWR_HIGH_OBIT
|}
 
=== TSEC_FALCON_DMAINFO_CTL ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0
| TSEC_FALCON_DMAINFO_CTL_CLR_FBRD
|-
| 1
| TSEC_FALCON_DMAINFO_CTL_CLR_FBWR
|}
 
=== TSEC_SCP_CTL0 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 10
| Enable [[#LOAD|Falcon<->LOAD]] interface
|-
| 12
| Enable [[#STORE|Falcon<->STORE]] interface
|-
| 14
| Enable [[#CMD|Falcon<->CMD]] interface
|-
| 16
| Enable [[#SEQ|SEQ]]
|-
| 20
| Enable [[#CTL|CTL]]
|}
 
Unofficial name.
 
=== TSEC_SCP_CTL1 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0
| Clear [[#SEQ|SEQ]]
|-
| 8
| Clear [[#SCP|SCP]]'s internal pipeline
|-
| 11
| Enable [[#RNG|RNG]]'s test mode
|-
| 12
| Enable [[#RNG|RNG]]
|-
| 16
| Enable [[#LOAD|Falcon<->LOAD]] interface's dummy mode (all reads return 0)
|-
| 20
| Enable [[#LOAD|Falcon<->LOAD]] interface bypassing (all reads are dropped)
|-
| 24
| Enable [[#STORE|Falcon<->STORE]] interface bypassing (all writes are dropped)
|}
 
Unofficial name.
 
=== TSEC_SCP_CTL_STAT ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 20
| TSEC_SCP_CTL_STAT_DEBUG_MODE
|}
 
=== TSEC_SCP_CTL_LOCK ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0
| Enable lockdown mode (locks IMEM and DMEM)
|-
| 1
| Lockdown has pending exit request
|-
| 2
| Lockdown has been enabled before
|-
| 4
| Enable SCP lockdown mode (locks [[#SCP|SCP]]'s MMIO register space)
|-
| 6
| SCP lockdown has been enabled before
|}
 
Unofficial name.
 
Controls lockdown mode. Can only be cleared in HS mode.
 
=== TSEC_SCP_CFG ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0
| Endianness for ADD
0: Little
1: Big
|-
| 1
| Endianness for GFMUL
0: Little
1: Big
|-
| 2
| Endianness for [[#LOAD|LOAD]]
0: Little
1: Big
|-
| 3
| Endianness for [[#STORE|STORE]]
0: Little
1: Big
|-
| 4
| Endianness for [[#AES|AES]]
0: Little
1: Big
|-
| 8
| Flush [[#CMD|CMD]]
|-
| 12-13
| Carry chain's size
0: 32 bits
1: 64 bits
2: 96 bits
3: 128 bits
|-
| 16-31
| [[#SCP|SCP]]'s internal pipeline stall timeout value
|}
 
Unofficial name.
 
=== TSEC_SCP_CTL_SCP ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0
| Swap [[#SCP|SCP]]'s master
|-
| 1
| Current [[#SCP|SCP]]'s master
0: Falcon
1: External
|}
 
Unofficial name.
 
=== TSEC_SCP_CTL_PKEY ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0
| TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
|-
| 1
| TSEC_SCP_CTL_PKEY_LOADED
|}
 
=== TSEC_SCP_CTL_DBG ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 4
| Disable lockdown mode
|-
| 8
| Disable SCP lockdown mode
|}
 
Unofficial name.
 
Overrides lockdown mode. Can only be set in debug mode.
 
=== TSEC_SCP_DBG0 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-3
| Index
|-
| 4
| Auto-increment
|-
| 5-6
| Target
0: None
1: STORE
2: LOAD
3: SEQ
|-
| 8-12
| [[#SEQ|SEQ]]'s current sequence's size
|-
| 13-16
| [[#SEQ|SEQ]]'s current instruction's address
|-
| 17
| [[#SEQ|SEQ]]'s current instruction is valid
|-
| 18
| [[#SEQ|SEQ]] is running in HS mode
|-
| 19-22
| [[#LOAD|LOAD]]'s queue's size
|-
| 23
| [[#LOAD|LOAD]]'s current operation is valid
|-
| 24
| [[#LOAD|LOAD]] is running in HS mode
|-
| 25-26
| [[#STORE|STORE]]'s queue's size
|-
| 30
| [[#STORE|STORE]]'s current operation is valid
|-
| 31
| [[#STORE|STORE]] is running in HS mode
|}
 
Unofficial name.
 
Used for debugging the [[#LOAD|LOAD]], [[#STORE|STORE]] and [[#SEQ|SEQ]] blocks.
 
=== TSEC_SCP_DBG1 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-31
| Data
If target is SEQ:
  Bits 0-3: current instruction's first operand
  Bits 4-9: current instruction's second operand
  Bits 10-14: current instruction's opcode
|}
 
Unofficial name.
 
Used for retrieving debug data. Contains information on the last crypto sequence created when debugging the [[#SEQ|SEQ]] block.
 
=== TSEC_SCP_DBG2 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-1
| [[#SEQ|SEQ]]'s state
0: Idle
1: Recording (cs0begin/cs1begin)
2: Executing (cs0exec/cs1exec)
|-
| 4-7
| Number of cycles left for [[#SEQ|SEQ]]'s current sequence
|-
| 12-15
| Active crypto key register (ckeyreg)
|}
 
Unofficial name.
 
Used for retrieving additional debug data associated with the [[#SEQ|SEQ]] block.
 
=== TSEC_SCP_CMD ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-3
| Destination register
|-
| 8-13
| Source register or immediate value
|-
| 20-24
| Command opcode
0x0:  nop (fuc5 opcode 0x00)
0x1:  cmov (fuc5 opcode 0x84)
0x2:  cxsin (fuc5 opcode 0x88) or xdst (with cxset)
0x3:  cxsout (fuc5 opcode 0x8C) or xdld (with cxset)
0x4:  crnd (fuc5 opcode 0x90)
0x5:  cs0begin (fuc5 opcode 0x94)
0x6:  cs0exec (fuc5 opcode 0x98)
0x7:  cs1begin (fuc5 opcode 0x9C)
0x8:  cs1exec (fuc5 opcode 0xA0)
0x9:  invalid (fuc5 opcode 0xA4)
0xA:  cchmod (fuc5 opcode 0xA8)
0xB:  cxor (fuc5 opcode 0xAC)
0xC:  cadd (fuc5 opcode 0xB0)
0xD:  cand (fuc5 opcode 0xB4)
0xE:  crev (fuc5 opcode 0xB8)
0xF:  cgfmul (fuc5 opcode 0xBC)
0x10: csecret (fuc5 opcode 0xC0)
0x11: ckeyreg (fuc5 opcode 0xC4)
0x12: ckexp (fuc5 opcode 0xC8)
0x13: ckrexp (fuc5 opcode 0xCC)
0x14: cenc (fuc5 opcode 0xD0)
0x15: cdec (fuc5 opcode 0xD4)
0x16: csigcmp (fuc5 opcode 0xD8)
0x17: csigenc (fuc5 opcode 0xDC)
0x18: csigclr (fuc5 opcode 0xE0)
|-
| 28
| [[#CMD|CMD]]'s current instruction is valid
|-
| 31
| [[#CMD|CMD]] is running in HS mode
|}
 
Unofficial name.
 
Contains information on the last crypto command executed.
 
=== TSEC_SCP_STAT0 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0
| [[#SCP|SCP]] is active
|-
| 2
| [[#CMD|CMD]] is active
|-
| 4
| [[#STORE|STORE]] is active
|-
| 6
| [[#SEQ|SEQ]] is active
|-
| 8
| [[#CTL|CTL]] is active
|-
| 10
| [[#LOAD|LOAD]] is active
|-
| 14
| [[#AES|AES]] is active
|-
| 16
| [[#RNG|RNG]] is active
|}
 
Unofficial name.
 
Contains the statuses of hardware blocks.
 
=== TSEC_SCP_STAT1 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-1
| Signature comparison result
0: None
1: Running
2: Failed
3: Succeeded
|-
| 4
| [[#LOAD|Falcon<->LOAD]] interface is running in HS mode
|-
| 6
| [[#LOAD|Falcon<->LOAD]] interface is ready
|-
| 8
| [[#STORE|Falcon<->STORE]] interface is running in HS mode
|-
| 10
| [[#STORE|Falcon<->STORE]] interface received a valid operation
|-
| 12
| [[#CMD|Falcon<->CMD]] interface is running in HS mode
|-
| 14
| [[#CMD|Falcon<->CMD]] interface received a valid instruction
|}
 
Unofficial name.
 
Contains the statuses of hardware interfaces and the result of the last authentication attempt.
 
=== TSEC_SCP_STAT2 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-4
| Current opcode in [[#SEQ|SEQ]]
|-
| 5-9
| Current opcode in [[#CMD|Falcon<->CMD]] interface
|-
| 10-14
| Pending opcode in [[#CMD|CMD]]
|-
| 15-16
| Current opcode in [[#AES|AES]]
0: Encryption
1: Decryption
2: Key expansion
3: Key reverse expansion
|-
| 24
| [[#SCP|SCP]]'s internal pipeline is stalled on hazard
|-
| 25
| [[#STORE|STORE]] is stalled
|-
| 26
| [[#LOAD|LOAD]] is stalled
|-
| 27
| [[#RNG|RNG]] is stalled
|-
| 28
| [[#SCP|SCP]]'s internal pipeline is stalled on writeback
|-
| 29
| [[#AES|AES]] is stalled
|}
 
Unofficial name.
 
Contains the status of crypto operations.
 
=== TSEC_SCP_RNG_STAT0 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0
| [[#RND|RND]] is ready
|-
| 4-7
| Unknown
|-
| 8-11
| Unknown
|-
| 16
| Unknown
|-
| 20
| Unknown
|}
 
Unofficial name.
 
=== TSEC_SCP_RNG_STAT1 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-15
| Unknown
|-
| 16-31
| Unknown
|}
 
Unofficial name.
 
=== TSEC_SCP_IRQSTAT ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0
| [[#RND|RND]] ready
|-
| 8
| ACL error
|-
| 12
| SEC error
|-
| 16
| [[#CMD|CMD]] error
|-
| 20
| Single step
|-
| 24
| [[#RND|RND]] clock trigger
|-
| 28
| Stall timeout
|}
 
Unofficial name.
 
=== TSEC_SCP_IRQMASK ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0
| [[#RND|RND]] ready
|-
| 8
| ACL error
|-
| 12
| SEC error
|-
| 16
| [[#CMD|CMD]] error
|-
| 20
| Single step
|-
| 24
| [[#RND|RND]] clock trigger
|-
| 28
| Stall timeout
|}
 
Unofficial name.
 
=== TSEC_SCP_ACL_ERR ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0
| Writing to a crypto register without the correct ACL
|-
| 4
| Reading from a crypto register without the correct ACL
|-
| 8
| Invalid ACL change (cchmod)
|-
| 31
| ACL error occurred
|}
 
Unofficial name.
 
Contains information on errors generated by the [[#TSEC_SCP_IRQSTAT|ACL error]] IRQ.
 
=== TSEC_SCP_SEC_ERR ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0
| Security mode changed during sequence execution (cs0exec/cs1exec)
|-
| 1-2
| Security mode at the beginning of sequence execution
0: Non-secure
1: Heavy Secure
|-
| 4
| Security mode changed during sequence recording (cs0begin/cs1begin)
|-
| 5-6
| Security mode at the beginning of sequence recording
0: Non-secure
1: Heavy Secure
|-
| 16
| Security mode changed while reading from crypto register/stream (cxsout or xdld)
|-
| 17-18
| Security mode at the beginning of reading from crypto register/stream
0: Non-secure
1: Heavy Secure
|-
| 20
| Security mode and memory source changed while writing to crypto register/stream (cxsin or xdst)
|-
| 21-22
| Security mode when memory source changed while writing to crypto register/stream
0: Non-secure
1: Heavy Secure
|-
| 24
| Security mode changed while writing to crypto register/stream (cxsin or xdst)
|-
| 25-26
| Security mode at the beginning of writing to crypto register/stream
0: Non-secure
1: Heavy Secure
|-
| 31
| SEC error occurred
|}
 
Unofficial name.
 
Contains information on errors generated by the [[#TSEC_SCP_IRQSTAT|SEC error]] IRQ.
 
=== TSEC_SCP_CMD_ERR ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0
| [[#CMD|CMD]]'s instruction is invalid
|-
| 4
| [[#SEQ|SEQ]]'s sequence is empty
|-
| 8
| [[#SEQ|SEQ]]'s sequence is too long
|-
| 12
| [[#SEQ|SEQ]]'s sequence was not finished
|-
| 16
| Forbidden signature operation (csigcmp, csigenc or csigclr in NS mode)
|-
| 20
| Invalid signature operation (csigcmp in HS mode)
|-
| 24
| Forbidden ACL change (cchmod in NS mode)
|}
 
Unofficial name.
 
Contains information on errors generated by the [[#TSEC_SCP_IRQSTAT|CMD error]] IRQ.
 
=== TSEC_SCP_RND_CTL0 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-31
| [[#RND|RND]] clock trigger's lower limit
|}
 
Unofficial name.
 
=== TSEC_SCP_RND_CTL1 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-15
| [[#RND|RND]] clock trigger's upper limit
|-
| 16-31
| [[#RND|RND]] clock trigger's mask
|}
 
Unofficial name.
 
=== TSEC_SCP_RND_CTL2 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-15
| Unknown
|}
 
Unofficial name.
 
=== TSEC_SCP_RND_CTL3 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 12
| Trigger first LFSR
|-
| 16
| Trigger second LFSR
|}
 
Unofficial name.
 
=== TSEC_SCP_RND_CTL4 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-31
| First LFSR's polynomial for [[#RNG|RNG]]'s test mode
|}
 
Unofficial name.
 
=== TSEC_SCP_RND_CTL5 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-31
| First LFSR's initial state for [[#RNG|RNG]]'s test mode
|}
 
Unofficial name.
 
=== TSEC_SCP_RND_CTL6 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-31
| Second LFSR's polynomial for [[#RNG|RNG]]'s test mode
|}
 
Unofficial name.
 
=== TSEC_SCP_RND_CTL7 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-31
| Second LFSR's initial state for [[#RNG|RNG]]'s test mode
|}
 
Unofficial name.
 
=== TSEC_SCP_RND_CTL8 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-15
| Unknown
|-
| 16-31
| Unknown
|}
 
Unofficial name.
 
=== TSEC_SCP_RND_CTL9 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-15
| Unknown
|-
| 16-31
| Unknown
|}
 
Unofficial name.
 
=== TSEC_SCP_RND_CTL10 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-15
| Unknown
|-
| 16-31
| Unknown
|}
 
Unofficial name.
 
=== TSEC_SCP_RND_CTL11 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0
| Unknown
|-
| 1
| Unknown
|-
| 2
| Unknown
|-
| 3
| Unknown
|-
| 4-5
| First sampler's source
0: Oscillator
1: Unknown
2: LFSR
3: Dummy
|-
| 6-7
| Second sampler's source
0: Oscillator
1: Unknown
2: LFSR
3: Dummy
|-
| 8-11
| First sampler's tap value
|-
| 12-15
| Second sampler's tap value
|-
| 16-19
| Unknown
|-
| 20-23
| Unknown
|-
| 24-30
| Unknown
|-
| 31
| Unknown
|}
 
Unofficial name.
 
=== TSEC_TFBIF_CTL ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0
| TSEC_TFBIF_CTL_CLR_BWCOUNT
|-
| 1
| TSEC_TFBIF_CTL_ENABLE
|-
| 2
| TSEC_TFBIF_CTL_CLR_IDLEWDERR
|-
| 3
| TSEC_TFBIF_CTL_RESET
|-
| 4
| TSEC_TFBIF_CTL_IDLE
|-
| 5
| TSEC_TFBIF_CTL_IDLEWDERR
|-
| 6
| TSEC_TFBIF_CTL_SRTOUT
|-
| 7
| TSEC_TFBIF_CTL_CLR_SRTOUT
|-
| 8-11
| TSEC_TFBIF_CTL_SRTOVAL
|-
| 12
| TSEC_TFBIF_CTL_VPR
|}
 
=== TSEC_TFBIF_MCCIF_FIFOCTRL ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
|-
| 1
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
|-
| 2
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
|-
| 3
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
|-
| 4
| TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
|-
| 5
| TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
|-
| 6
| TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
|-
| 7
| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
|-
| 8
| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE
|}
 
=== TSEC_TFBIF_THROTTLE ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-11
| TSEC_TFBIF_THROTTLE_BUCKET_SIZE
|-
| 16-27
| TSEC_TFBIF_THROTTLE_LEAK_COUNT
|-
| 30-31
| TSEC_TFBIF_THROTTLE_LEAK_SIZE
|}
 
=== TSEC_TFBIF_DBG_STAT0 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0
| TSEC_TFBIF_DBG_STAT0_1K_TRANSFER
|-
| 1
| TSEC_TFBIF_DBG_STAT0_RREQ_ISSUED
|-
| 2
| TSEC_TFBIF_DBG_STAT0_WREQ_ISSUED
|-
| 3
| TSEC_TFBIF_DBG_STAT0_TAGQ_ISSUED
|-
| 4
| TSEC_TFBIF_DBG_STAT0_STALL_RDATQ
|-
| 5
| TSEC_TFBIF_DBG_STAT0_STALL_RACKQ
|-
| 6
| TSEC_TFBIF_DBG_STAT0_STALL_WREQQ
|-
| 7
| TSEC_TFBIF_DBG_STAT0_STALL_WDATQ
|-
| 8
| TSEC_TFBIF_DBG_STAT0_STALL_WACKQ
|-
| 9
| TSEC_TFBIF_DBG_STAT0_STALL_RREQ_PENDING
|-
| 10
| TSEC_TFBIF_DBG_STAT0_STALL_WREQ_PENDING
|-
| 11
| TSEC_TFBIF_DBG_STAT0_STALL_MREQ
|-
| 12
| TSEC_TFBIF_DBG_STAT0_ENGINE_IDLE
|-
| 13
| TSEC_TFBIF_DBG_STAT0_RMCCIF_IDLE
|-
| 14
| TSEC_TFBIF_DBG_STAT0_WMCCIF_IDLE
|-
| 15
| TSEC_TFBIF_DBG_STAT0_CSB_IDLE
|-
| 16
| TSEC_TFBIF_DBG_STAT0_RU_IDLE
|-
| 17
| TSEC_TFBIF_DBG_STAT0_WU_IDLE
|-
| 19
| TSEC_TFBIF_DBG_STAT0_UNWEIGHT_ACTMON_ACTIVE
|-
| 20
| TSEC_TFBIF_DBG_STAT0_UNWEIGHT_ACTMON_MCB
|}
 
=== TSEC_TFBIF_DBG_STAT1 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-31
| TSEC_TFBIF_DBG_STAT1_DATA
|}
 
=== TSEC_TFBIF_DBG_RDCOUNT_LO ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-31
| TSEC_TFBIF_DBG_RDCOUNT_LO_DATA
|}
 
=== TSEC_TFBIF_DBG_RDCOUNT_HI ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-31
| TSEC_TFBIF_DBG_RDCOUNT_HI_DATA
|}
 
=== TSEC_TFBIF_DBG_WRCOUNT_LO ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-31
| TSEC_TFBIF_DBG_WRCOUNT_LO_DATA
|}
 
=== TSEC_TFBIF_DBG_WRCOUNT_HI ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-31
| TSEC_TFBIF_DBG_WRCOUNT_HI_DATA
|}
 
=== TSEC_TFBIF_DBG_R32COUNT ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-31
| TSEC_TFBIF_DBG_R32COUNT_DATA
|}
 
=== TSEC_TFBIF_DBG_R64COUNT ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-31
| TSEC_TFBIF_DBG_R64COUNT_DATA
|}
 
=== TSEC_TFBIF_DBG_R128COUNT ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-31
| TSEC_TFBIF_DBG_R128COUNT_DATA
|}
 
=== TSEC_TFBIF_MCCIF_FIFOCTRL1 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-15
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
|-
| 16-31
| TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT
|}
 
=== TSEC_TFBIF_SPROT_EMEM ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-2
| Read access level
|-
| 3
| Set on memory read access violation
|-
| 4-6
| Write access level
|-
| 7
| Set on memory write access violation
|}
 
Unofficial name.
 
Controls accesses to external memory regions. Accessible in HS mode only.
 
=== TSEC_TFBIF_TRANSCFG ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0
| TSEC_TFBIF_TRANSCFG_ATT0_SWID
|-
| 4
| TSEC_TFBIF_TRANSCFG_ATT1_SWID
|-
| 8
| TSEC_TFBIF_TRANSCFG_ATT2_SWID
|-
| 12
| TSEC_TFBIF_TRANSCFG_ATT3_SWID
|-
| 16
| TSEC_TFBIF_TRANSCFG_ATT4_SWID
|-
| 20
| TSEC_TFBIF_TRANSCFG_ATT5_SWID
|-
| 24
| TSEC_TFBIF_TRANSCFG_ATT6_SWID
|-
| 28
| TSEC_TFBIF_TRANSCFG_ATT7_SWID
|}
 
Configures the software ID per CTXDMA port for memory transactions. Software ID 0 (HW_SWID) forces all transactions to go through the SMMU while software ID 1 (PHY_SWID) bypasses it. Accessible in HS mode only.
 
[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.
 
=== TSEC_TFBIF_REGIONCFG ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-2
| TSEC_TFBIF_REGIONCFG_T0_APERT_ID
|-
| 3
| TSEC_TFBIF_REGIONCFG_T0_VPR
|-
| 4-6
| TSEC_TFBIF_REGIONCFG_T1_APERT_ID
|-
| 7
| TSEC_TFBIF_REGIONCFG_T1_VPR
|-
| 8-10
| TSEC_TFBIF_REGIONCFG_T2_APERT_ID
|-
| 11
| TSEC_TFBIF_REGIONCFG_T2_VPR
|-
| 12-14
| TSEC_TFBIF_REGIONCFG_T3_APERT_ID
|-
| 15
| TSEC_TFBIF_REGIONCFG_T3_VPR
|-
| 16-18
| TSEC_TFBIF_REGIONCFG_T4_APERT_ID
|-
| 19
| TSEC_TFBIF_REGIONCFG_T4_VPR
|-
| 20-22
| TSEC_TFBIF_REGIONCFG_T5_APERT_ID
|-
| 23
| TSEC_TFBIF_REGIONCFG_T5_VPR
|-
| 24-26
| TSEC_TFBIF_REGIONCFG_T6_APERT_ID
|-
| 27
| TSEC_TFBIF_REGIONCFG_T6_VPR
|-
| 28-30
| TSEC_TFBIF_REGIONCFG_T7_APERT_ID
|-
| 31
| TSEC_TFBIF_REGIONCFG_T7_VPR
|}
 
Configures the aperture ID and VPR mode per CTXDMA port for memory region accessing. Accessible in HS mode only.
 
[6.0.0+] The nvhost_tsec firmware sets this register to 0x20 or 0x140 before reading memory from the GPU UCODE carveout.
 
=== TSEC_CG ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-5
| TSEC_CG_IDLE_CG_DLY_CNT
|-
| 6
| TSEC_CG_IDLE_CG_EN
|-
| 16-18
| TSEC_CG_WAKEUP_DLY_CNT
|-
| 19
| TSEC_CG_WAKEUP_DLY_EN
|}
 
=== TSEC_BAR0_CTL ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0
| TSEC_BAR0_CTL_READ
|-
| 1
| TSEC_BAR0_CTL_WRITE
|-
| 4-7
| TSEC_BAR0_CTL_BYTE_MASK
|-
| 12-13
| TSEC_BAR0_CTL_STATUS
0: Idle
1: Busy
2: Error
3: Disabled
|-
| 16-17
| TSEC_BAR0_CTL_SEC_MODE
0: Non-secure
1: Invalid
2: Light Secure
3: Heavy Secure
|-
| 31
| TSEC_BAR0_CTL_INIT
|}
 
Unofficial name.
 
Controls DMA transfers between TSEC and HOST1X (master and clients).
 
Starting a transfer over BAR0 automatically sets TSEC_BAR0_CTL_SEC_MODE to the current Falcon security mode. Once set, any attempts to start a transfer from a lower security level will fail.
 
=== TSEC_BAR0_ADDR ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-31
| TSEC_BAR0_ADDR_VAL
|}
 
Unofficial name.
 
Takes the address for DMA transfers between TSEC and HOST1X (master and clients).
 
=== TSEC_BAR0_DATA ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-31
| TSEC_BAR0_DATA_VAL
|}
 
Unofficial name.
 
Takes the data for DMA transfers between TSEC and HOST1X (master and clients).
 
=== TSEC_BAR0_TIMEOUT ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-31
| TSEC_BAR0_TIMEOUT_VAL
|}
 
Unofficial name.
 
Takes the timeout value for DMA transfers between TSEC and HOST1X (master and clients).
 
=== TSEC_VERSION ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-31
| Version
|}
 
Unofficial name.
 
=== TSEC_SCRATCH0 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-31
| Value
|}
 
Unofficial name.
 
=== TSEC_SCRATCH1 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-31
| Value
|}
 
Unofficial name.
 
=== TSEC_SCRATCH2 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-31
| Value
|}
 
Unofficial name.
 
=== TSEC_SCRATCH3 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-31
| Value
|}
 
Unofficial name.
 
=== TSEC_SCRATCH4 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-31
| Value
|}
 
Unofficial name.
 
=== TSEC_SCRATCH5 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-31
| Value
|}
 
Unofficial name.
 
=== TSEC_SCRATCH6 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-31
| Value
|}
 
Unofficial name.
 
=== TSEC_SCRATCH7 ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-31
| Value
|}
 
Unofficial name.
 
=== TSEC_GPTMRINT ===
Unofficial name.
 
Same as [[#TSEC_FALCON_GPTMRINT|TSEC_FALCON_GPTMRINT]], but for an unknown hardware block.
 
=== TSEC_GPTMRVAL ===
Unofficial name.
 
Same as [[#TSEC_FALCON_GPTMRVAL|TSEC_FALCON_GPTMRVAL]], but for an unknown hardware block.
 
=== TSEC_GPTMRCTL ===
Unofficial name.
 
Same as [[#TSEC_FALCON_GPTMRCTL|TSEC_FALCON_GPTMRCTL]], but for an unknown hardware block.
 
=== TSEC_ITFEN ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0
| Enable [[#TSEC_GPTMRINT|TSEC_GPTMRINT]]
|-
| 1
| Unknown
|-
| 2
| Unknown
|-
| 3
| Unknown
|}
 
Unofficial name.
 
=== TSEC_ITFSTAT ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0
| [[#TSEC_GPTMRINT|TSEC_GPTMRINT]] is enabled
|-
| 1
| Unknown
|-
| 2
| Unknown
|-
| 3
| Unknown
|}
 
Unofficial name.
 
=== TSEC_TEGRA_CTL ===
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 16
| TSEC_TEGRA_CTL_TKFI_KFUSE
|-
| 17
| TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
|-
| 24
| TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
|-
| 25
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
|-
| 26
| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
|-
| 27
| TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C
|}
 
== Falcon ==
"Falcon" (FAst Logic CONtroller) is a proprietary general purpose CPU which can be found inside various hardware blocks that require some sort of logic processing such as TSEC (TSECA and TSECB), NVDEC, NVENC, NVJPG, VIC, GPU PMU and XUSB.
 
=== Processor Registers ===
A total of 32 processor registers are available in the Falcon CPU.
 
==== REG0-REG15 ====
These are 16 32-bit GPRs (general purpose registers).
 
==== IV0 ====
This is a SPR (special purpose register) that holds the address for interrupt vector 0. Only bits 0 to 15 are used.
 
==== IV1 ====
This is a SPR (special purpose register) that holds the address for interrupt vector 1. Only bits 0 to 15 are used.
 
==== IV2 ====
This is a SPR (special purpose register) that holds the address for interrupt vector 2. This register is considered "UNDEFINED" and appears to be unused.
 
==== EV ====
This is a SPR (special purpose register) that holds the address for the exception vector. Only bits 0 to 15 are used.
 
Alternative name (envytools): "tv".
 
==== SP ====
This is a SPR (special purpose register) that holds the current stack pointer. Only bits 0 to 15 are used.
 
==== PC ====
This is a SPR (special purpose register) that holds the current program counter. Only bits 0 to 15 are used.
 
==== IMB ====
This is a SPR (special purpose register) that holds the external base address for IMEM transfers.
 
Alternative name (envytools): "xcbase".
 
==== DMB ====
This is a SPR (special purpose register) that holds the external base address for DMEM transfers.
 
Alternative name (envytools): "xdbase".
 
==== CSW ====
This is a SPR (special purpose register) that holds various flag bits.
 
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-7 || General purpose predicates
|-
| 8 || ALU carry flag
|-
| 9 || ALU signed overflow flag
|-
| 10 || ALU sign flag
|-
| 11 || ALU zero flag
|-
| 16 || Interrupt 0 enable
|-
| 17 || Interrupt 1 enable
|-
| 18 || Interrupt 2 enable (undefined)
|-
| 20 || Interrupt 0 saved enable
|-
| 21 || Interrupt 1 saved enable
|-
| 22 || Interrupt 2 saved enable (undefined)
|-
| 24 || Exception active
|-
| 26-31 || Unknown
|}
 
Alternative name (envytools): "flags".
 
==== CCR ====
This is a SPR (special purpose register) that holds configuration bits for the SCP DMA override functionality. The value of this register is set using the "cxset" instruction which provides a way to change the behavior of a variable amount of successively executed DMA-related instructions ("xdwait", "xdst" and "xdld").
 
{| class=wikitable
! Bits || Description
|-
| 0-4 || Number of instructions the override is valid for (0x1F means infinite)
|-
| 5 || Crypto source/destination select
0: Crypto register
1: Crypto stream
|-
| 6 || Bypass mode
0: Disabled
1: Enabled
|-
| 7 || Internal memory select
0: DMEM
1: IMEM
|}
 
Alternative name (envytools): "cx".
 
==== SEC ====
This is a SPR (special purpose register) that holds configuration bits for the SCP authentication process.
 
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-7 || Start of region to authenticate (in pages of 0x100 bytes)
|-
| 16 || Force secure DMA transfers
|-
| 17 || Decrypt region to authenticate
|-
| 18 || Signature check passed
|-
| 19 || Suppress interrupts and exceptions
|-
| 24-31 || Size of region to authenticate (in pages of 0x100 bytes)
|}
 
Alternative name (envytools): "cauth".
 
==== CTX ====
This is a SPR (special purpose register) that holds configuration bits for the CTXDMA ports.
 
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-2 || CTXDMA port for code loads (xcld)
|-
| 4-6 || CTXDMA port for code stores (invalid)
|-
| 8-10 || CTXDMA port for data loads (xdld)
|-
| 12-14 || CTXDMA port for data stores (xdst)
|}
 
Alternative name (envytools): "xtargets".
 
==== EXCI ====
This is a SPR (special purpose register) that holds information on raised exceptions.
 
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-19 || Exception PC
|-
| 20-23 || Exception cause
|}
 
Alternative name (envytools): "tstatus".
 
==== SEC1 ====
Only available in Falcon v6+ CPUs, marked as "RESERVED" for v5.
 
==== IMB1 ====
Only available in Falcon v6+ CPUs, marked as "RESERVED" for v5.
 
==== DMB1 ====
Only available in Falcon v6+ CPUs, marked as "RESERVED" for v5.
 
=== Secure BootROM ===
Certain Falcon CPUs may have an optional "Secure BootROM", but contrary to the common purpose of bootrom code, this doesn't execute while booting the CPU. In fact, being a microprocessor, Falcon is designed to execute user supplied code right off the bat in a clean slate state. However, Falcon can be paired with a [[#SCP|secure co-processor]] and provide a cryptosystem for any hardware block that may require it, originating what is known as a "secretful" unit.
 
Secretful Falcon CPUs have [[#TSEC_FALCON_HWCFG1|TSEC_FALCON_HWCFG1_SECURITY_MODEL]] set to 3, which means they support "Heavy Secure" mode (or "HS" for short). While in HS mode, the Falcon's DMEM and IMEM regions are protected from read and write operations, which effectively hides code and data from attackers.
 
Entering HS mode first requires uploading code marked as "secure" to Falcon, which can be done from MMIO using [[#TSEC_FALCON_IMEMC|TSEC_FALCON_IMEMC]] with the [[#TSEC_FALCON_IMEMC|TSEC_FALCON_IMEMC_SECURE]] bit set. Upon jumping to a page marked as secret, the [[#TSEC_FALCON_EXCI|INV_INS]] exception is raised which tells the Falcon to start executing the secure bootrom code.
 
The secure bootrom lives in a hidden ROM region, instead of IMEM, and is mapped as --x at address 0. On Falcon v5 CPUs its size is 0x367 bytes.
 
==== Initialization ====
The first instructions of the secure bootrom simply save each [[#REG0-REG15|GPR]] to the stack and check the contents of the [[#SEC|SEC SPR]].
 
==== Authentication ====
The main purpose of the secure bootrom is to authenticate the code pages marked as "secure". This is done by first extracting the base address and size of the region to authenticate from the [[#SEC|SEC SPR]], then calculating a signature over this region and finally comparing it to the value of the [[#SCP|SCP]] register $c6.
 
If the comparison is successful, bit 18 of [[#SEC|SEC SPR]] is set (which is mirrored in [[#TSEC_FALCON_SVEC_SPR|TSEC_FALCON_SVEC_SPR]]), the signature comparison result in [[#TSEC_SCP_STAT1|TSEC_SCP_STAT1]] is set to 3 and each page from the region to authenticate is marked as valid. Bit 19 of [[#SEC|SEC SPR]] is also automatically set, preventing any interrupts or exceptions from being raised while in HS mode, but contrary to bit 18 this one can be manually cleared by authenticated code.
 
Below is the authentication algorithm's pseudocode:
<syntaxhighlight>
...
// This runs in a loop for each 0x100 bytes page.
cs0begin 0x03
cxsin $c4
cenc $c3 $c5
cxor $c5 $c3
ckeyreg $c4
cxor $c5 $c5
cs0exec 0x11
...
// Use secret 0x01 as key and $c7 as seed.
csecret $c3 1
ckeyreg $c3
cenc $c3 $c7
ckeyreg $c3
cenc $c4 $c5
csigcmp $c4 $c6
...
</syntaxhighlight>
 
==== Decryption ====
If bit 17 is set in the [[#SEC|SEC SPR]], the secure bootrom will additionally attempt to decrypt the region to authenticate.
 
Below is the decryption algorithm's pseudocode:
<syntaxhighlight>
...
// Use secret 0x06 as key.
cs0begin 0x03
cxsin $c3
cdec $c4 $c3
cxsout $c4
csecret $c5 0x06
ckexp $c5 $c5
cs0exec 0x10
ckeyreg $c5
...
</syntaxhighlight>
 
==== Exit ====
==== Exit ====
The CPU automatically goes back to non-secure mode when returning back into non-secret pages. When this happens, the valid bit (bit0) in the TLB flags is cleared for all secret pages.
The secure bootrom finishes by restoring each [[#REG0-REG15|GPR]] from stack and returning from the exception state. This will result in the authenticated code region being executed in HS mode until the current [[#PC|PC]] points to an address outside of the authenticated region. When this happens, each page from the authenticated region is automatically marked as invalid without any involvement of the secure bootrom, meaning that the secure bootrom is only invoked when entering HS mode.
 
 
==== Implementation ====
== SCP ==
Under certain circumstances, it is possible to observe [[#csigauth|csigauth]] being briefly written to [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]] as "csigauth $c4 $c6" while the opcodes in [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]] are set to "cxsin" and "csigauth", respectively.
"SCP" (Secure Co-Processor) is a proprietary coprocessor which can be found inside every [[#Falcon|Falcon]] that supports [[#Secure BootROM|Heavy Secure Mode]]. On the Tegra X1 these are TSECA, TSECB, NVDEC and the GPU's PMU.
 
 
Via [[#TSEC_SCP_SEQ_CTL|TSEC_SCP_SEQ_CTL]] it can be observed that a 3-sized macro sequence is loaded into cs0 during a secure mode transition.
=== Hardware ===
 
SCP is subdivided into several specialized hardware blocks and interfaces.
=== Operations ===
 
{| class="wikitable" border="1"
==== LOAD ====
!  Opcode
Block for handling memory reads from SCP to Falcon. It communicates with Falcon over a dedicated interface.
!  Name
 
!  Operand0
The interface can be enabled or disabled by register [[#TSEC_SCP_CTL0|TSEC_SCP_CTL0]].
!  Operand1
 
!  Operation
==== STORE ====
!  Condition
Block for handling memory writes from Falcon to SCP. It communicates with Falcon over a dedicated interface.
 
The interface can be enabled or disabled by register [[#TSEC_SCP_CTL0|TSEC_SCP_CTL0]].
 
==== CMD ====
Block for translating Falcon crypto operands into SCP commands. It communicates with Falcon over a dedicated interface.
 
The interface can be enabled or disabled by register [[#TSEC_SCP_CTL0|TSEC_SCP_CTL0]]. The status of the current command is reported through register [[#TSEC_SCP_CMD|TSEC_SCP_CMD]].
 
==== SEQ ====
Block for recording and executing sequences of crypto operations in the form of macros.
 
Can be enabled or disabled by register [[#TSEC_SCP_CTL0|TSEC_SCP_CTL0]].
 
==== CTL ====
Overseer block for controlling certain SCP features.
 
Can be enabled or disabled by register [[#TSEC_SCP_CTL0|TSEC_SCP_CTL0]].
 
Registers [[#TSEC_SCP_CTL_STAT|TSEC_SCP_CTL_STAT]], [[#TSEC_SCP_CTL_LOCK|TSEC_SCP_CTL_LOCK]], [[#TSEC_SCP_CTL_SCP|TSEC_SCP_CTL_SCP]], [[#TSEC_SCP_CTL_PKEY|TSEC_SCP_CTL_PKEY]] and [[#TSEC_SCP_CTL_DBG|TSEC_SCP_CTL_DBG]] refer to this block.
 
==== AES ====
Block for providing AES-128-ECB functionality.
 
==== RNG ====
Block for encapsulating and controlling the internal random number generator.
 
Can be enabled or disabled by register [[#TSEC_SCP_CTL1|TSEC_SCP_CTL1]] and reports the status of the internal random number generator through registers [[#TSEC_SCP_RNG_STAT0|TSEC_SCP_RNG_STAT0]] and [[#TSEC_SCP_RNG_STAT1|TSEC_SCP_RNG_STAT1]].
 
===== RND =====
Internal random number generator.
 
Can be configured by the [[#TSEC_SCP_RND_CTL0|TSEC_SCP_RND_CTLx]] registers.
 
=== Operations ===
{| class="wikitable" border="1"
!  Opcode
!  Name
!  Operand0
!  Operand1
!  Operation
!  Precondition
!  Postcondition
|-
| 0 || nop || N/A || N/A || N/A || N/A || N/A
|-
| 1 || mov || $cX || $cY || <code><nowiki>$cX = $cY;</nowiki></code> || N/A || <code><nowiki>ACL($cX) = ACL($cY);</nowiki></code>
|-
| 2 || xsin || $cX || N/A || <code><nowiki>$cX = read_from_stream();</nowiki></code> || N/A || <code><nowiki>ACL($cX) = is_mode_hs ? 0x3 : 0x1F;</nowiki></code>
|-
| 3 || xsout || $cX || N/A || <code><nowiki>write_to_stream($cX);</nowiki></code> || <code><nowiki>((is_mode_hs && (ACL($cX) & 0x2)) || (!is_mode_hs && (ACL($cX) & 0xA)))</nowiki></code> || N/A
|-
| 4 || [[#rnd|rnd]] || $cX || N/A || <code><nowiki>$cX = read_from_rnd();</nowiki></code> || N/A || <code><nowiki>ACL($cX) = is_mode_hs ? 0x3 : 0x1F;</nowiki></code>
|-
| 5 || s0begin || immX || N/A || <code><nowiki>record_macro_for_N_instructions(0, immX);</nowiki></code>|| N/A || N/A
|-
| 6 || s0exec || immX || N/A || <code><nowiki>execute_macro_N_times(0, immX);</nowiki></code> || N/A || N/A
|-
| 7 || s1begin || immX || N/A || <code><nowiki>record_macro_for_N_instructions(1, immX);</nowiki></code> || N/A || N/A
|-
| 8 || s1exec || immX || N/A || <code><nowiki>execute_macro_N_times(1, immX);</nowiki></code> || N/A || N/A
|-
| 9 || <invalid> || N/A || N/A || N/A || N/A || N/A
|-
| 0xA || [[#chmod|chmod]] || $cX || immY || <code><nowiki>ACL($cX) = immY;</nowiki></code> || See [[#ACLs|ACLs]] || N/A
|-
| 0xB || xor || $cX || $cY || <code><nowiki>$cX ^= $cY;</nowiki></code> || <code><nowiki>((is_mode_hs && (ACL($cX) & 0x2) && (ACL($cY) & 0x2)) || (!is_mode_hs && (ACL($cX) & 0x1A) && (ACL($cY) & 0xA)))</nowiki></code> || <code><nowiki>ACL($cX) = ACL($cY);</nowiki></code>
|-
| 0xC || add || $cX || immY || <code><nowiki>$cX += immY;</nowiki></code> || <code><nowiki>((is_mode_hs && (ACL($cX) & 0x2)) || (!is_mode_hs && (ACL($cX) & 0x1A)))</nowiki></code> || N/A
|-
| 0xD || and || $cX || $cY || <code><nowiki>$cX &= $cY;</nowiki></code> || <code><nowiki>((is_mode_hs && (ACL($cX) & 0x2) && (ACL($cY) & 0x2)) || (!is_mode_hs && (ACL($cX) & 0x1A) && (ACL($cY) & 0xA)))</nowiki></code> || <code><nowiki>ACL($cX) = ACL($cY);</nowiki></code>
|-
| 0xE || rev || $cX || $cY || <code><nowiki>$cX = endian_swap128($cY);</nowiki></code> || <code><nowiki>(is_mode_hs || (!is_mode_hs && (ACL($cX) & 0x10)))</nowiki></code> || <code><nowiki>ACL($cX) = ACL($cY);</nowiki></code>
|-
| 0xF || gfmul || $cX || $cY || <code><nowiki>$cX = gfmul($cY);</nowiki></code>|| <code><nowiki>((is_mode_hs && (ACL($cX) & 0x2) && (ACL($cY) & 0x2)) || (!is_mode_hs && (ACL($cX) & 0x1A) && (ACL($cY) & 0xA)))</nowiki></code> || <code><nowiki>ACL($cX) = ACL($cY);</nowiki></code>
|-
| 0x10 || secret || $cX || immY || <code><nowiki>$cX = load_secret(immY);</nowiki></code> || N/A || <code><nowiki>ACL($cX) = load_secret_acl(immY);</nowiki></code>
|-
| 0x11 || keyreg || $cX || N/A || <code><nowiki>active_key = $cX;</nowiki></code> || N/A || N/A
|-
| 0x12 || kexp || $cX || $cY || <code><nowiki>$cX = aes_key_expand($cY);</nowiki></code> || <code><nowiki>(is_mode_hs || (!is_mode_hs && (ACL($cX) & 0x10)))</nowiki></code> || <code><nowiki>ACL($cX) = ACL($cY);</nowiki></code>
|-
| 0x13 || krexp || $cX || $cY || <code><nowiki>$cX = aes_key_reverse_expand($cY);</nowiki></code> || <code><nowiki>(is_mode_hs || (!is_mode_hs && (ACL($cX) & 0x10)))</nowiki></code> || <code><nowiki>ACL($cX) = ACL($cY);</nowiki></code>
|-
| 0x14 || enc || $cX || $cY || <code><nowiki>$cX = aes_enc(active_key, $cY);</nowiki></code> || N/A || <code><nowiki>ACL($cX) = (ACL(active_key) & ACL($cY));</nowiki></code>
|-
| 0x15 || dec || $cX || $cY || <code><nowiki>$cX = aes_dec(active_key, $cY);</nowiki></code> || N/A || <code><nowiki>ACL($cX) = (ACL(active_key) & ACL($cY));</nowiki></code>
|-
| 0x16 || [[#sigcmp|sigcmp]] || $cX || $cY || <code><nowiki>current_sig = memcmp($cX, $cY) ? NULL : $cX;</nowiki></code> || <code><nowiki>(is_mode_secure_bootrom && (ACL($cY) & 0x2))</nowiki></code> || <code><nowiki>is_mode_hs = has_sig = (current_sig != NULL);</nowiki></code>
|-
| 0x17 || sigenc || $cX || $cY || <code><nowiki>$cX = aes_enc($cY, current_sig);</nowiki></code> || <code><nowiki>(is_mode_hs && has_sig)</nowiki></code> || <code><nowiki>ACL($cX) = 0x3;</nowiki></code>
|-
| 0x18 || [[#sigclr|sigclr]] || N/A || N/A || <code><nowiki>current_sig = NULL;</nowiki></code> || <code><nowiki>(is_mode_hs && has_sig)</nowiki></code> || <code><nowiki>has_sig = false;</nowiki></code>
|}
 
==== rnd ====
<code>00000000: f5 3c 0X 90    crnd $cX</code>
 
This instruction initializes a crypto register with random data.
 
Executing this instruction only succeeds if the RNG controller is enabled for the SCP, which requires taking the following steps:
* Write 0x7FFF to [[#TSEC_SCP_RND_CTL0|TSEC_SCP_RND_CTL0]].
* Write 0x3FF0000 to [[#TSEC_SCP_RND_CTL1|TSEC_SCP_RND_CTL1]].
* Write 0xFF00 to [[#TSEC_SCP_RND_CTL11|TSEC_SCP_RND_CTL11]].
* Write 0x1000 to [[#TSEC_SCP_CTL1|TSEC_SCP_CTL1]].
 
Otherwise it hangs forever.
 
==== chmod ====
<code>00000000: f5 3c XY a8    cchmod $cY 0X</code> or <code>00000000: f5 3c XY a9    cchmod $cY 1X</code>
 
This instruction takes a crypto register and a 5 bit immediate value which represents the [[#ACLs|ACLs]] mask to set.
 
==== sigcmp ====
<code>00000000: f5 3c XY d8    csigcmp $cY $cX</code>
 
Takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret. This instruction does not work in secure mode.
 
==== sigclr ====
<code>00000000: f5 3c 00 e0    csigclr</code>
 
This instruction takes no operands and clears the saved cauth signature used by the csigenc instruction.
 
=== ACLs ===
Each crypto register has an associated access control list with the following format:
 
{| class="wikitable" border="1"
!  Bit
!  Description
|-
|-
| 0 || nop || N/A || N/A || ||
| 0 || [[#Secure Keyable|Secure Keyable]]
|-
|-
| 1 || mov || $cX || $cY || <code>$cX = $cY; ACL(X) = ACL(Y);</code> ||
| 1 || [[#Secure Readable|Secure Readable]]
|-
|-
| 2 || sin || $cX || N/A || <code>$cX = read_stream(); ACL(X) = ???;</code> ||
| 2 || [[#Insecure Keyable|Insecure Keyable]]
|-
|-
| 3 || sout || $cX || N/A || <code>write_stream($cX);</code> || ?
| 3 || [[#Insecure Readable|Insecure Readable]]
|-
|-
| 4 || rnd || $cX || N/A || <code>$cX = read_trng(); ACL(X) = ???;</code> ||
| 4 || [[#Insecure Writeable|Insecure Writeable]]
|-
| 5 || s0begin || immX || N/A || <code>record_macro_for_N_instructions(0, immX);</code> ||
|-
| 6 || s0exec || immX || N/A || <code>execute_macro_N_times(0, immX);</code> ||
|-
| 7 || s1begin || immX || N/A || <code>record_macro_for_N_instructions(1, immX);</code> ||
|-
| 8 || s1exec || immX || N/A || <code>execute_macro_N_times(1, immX);</code> ||
|-
| 9 || <invalid> || || || ||
|-
| 0xA || chmod || $cX || immY || Complicated, see [[#ACL|ACL]]. ||
|-
| 0xB || xor || $cX || $cY || <code>$cX ^= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xC || add || $cX || immY || <code>$cX += immY;</code> || <code>(ACL(X) & 2)</code>
|-
| 0xD || and || $cX || $cY || <code>$cX &= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
|-
| 0xE || rev || $cX || $cY || <code>$cX = endian_swap128($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0xF || gfmul || $cX || $cY || <code>$cX = gfmul($cY); ACL(X) = ACL(Y);</code> || <code>(ACL(Y) & 2)</code>
|-
| 0x10 || secret || $cX || immY || <code>$cX = load_secret(immY); ACL(X) = load_secret_acl(immY);</code> ||
|-
| 0x11 || keyreg || immX || N/A || <code>active_key_idx = immX;</code> ||
|-
| 0x12 || kexp || $cX || $cY || <code>$cX = aes_kexp($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0x13 || krexp || $cX || $cY || <code>$cX = aes_kexp_reverse($cY); ACL(X) = ACL(Y);</code> ||
|-
| 0x14 || enc || $cX || $cY || <code>$cX = aes_enc(active_key_idx, $cY); ACL(X) = ACL(active_key_idx) & ACL(Y);</code> ||
|-
| 0x15 || dec || $cX || $cY || <code>$cX = aes_dec(active_key_idx, $cY); ACL(X) = ACL(active_key_idx) & ACL(Y);</code> ||
|-
| 0x16 || csigauth || $cX || $cY || <code>if (hash_verify($cX, $cY)) { has_sig = true; current_sig = $cX; }</code> || ?
|-
| 0x17 || csigclr || N/A || N/A || <code>has_sig = false;</code> ||
|-
| 0x18 || csigenc || $cX || $cY || <code>if (has_sig) { $cX = aes_enc($cY, current_sig); ACL(X) = 0x13; }</code> ||
|}
|}


==== csigauth ====
On boot, every crypto register has an ACL value of 0x1F.
<code>00000000: f5 3c XY d8    csigauth $cY $cX</code>
 
Takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret. This instruction does not work in secure mode.
 
==== csigclr ====
<code>00000000: f5 3c 00 e0    csigclr</code>
 
This instruction takes no operands and appears to clear the saved cauth signature used by the csigenc instruction.
 
==== cchmod ====
<code>00000000: f5 3c XY a8    cchmod $cY 0X</code> or <code>00000000: f5 3c XY a9    cchmod $cY 1X</code>
 
This instruction takes a crypto register and a 5 bit immediate value which represents the [[#ACL|ACL]] mask to set.


==== crnd ====
In HS mode, [[#STORE|STORE]] can always write to a crypto register. In NS and LS modes, [[#STORE|STORE]] can only write to a crypto register if it has the [[#Insecure Writeable|Insecure Writeable]] access mode.
<code>00000000: f5 3c 0X 90    crnd $cX</code>


This instruction initializes a crypto register with random data.
In HS mode, [[#LOAD|LOAD]] can only retrieve a crypto register's value if it has the [[#Secure Readable|Secure Readable]] access mode. In NS and LS modes, [[#LOAD|LOAD]] can only retrieve a crypto register's value if it has the [[#Insecure Readable|Insecure Readable]] and [[#Secure Readable|Secure Readable]] access modes.


Executing this instruction only succeeds if the TRNG is enabled for the SCP, which requires taking the following steps:
Loading a secret into a crypto register sets a per-secret ACL, unconditionally.
* Write 0x7FFF to TSEC_TRNG_CLK_LIMIT_LOW.
* Write 0x3FF0000 to TSEC_TRNG_CLK_LIMIT_HIGH.
* Write 0xFF00 to TSEC_TRNG_CTL.
* Write 0x1000 to [[#TSEC_SCP_CTL1|TSEC_SCP_CTL1]].


Otherwise it hangs forever.
==== Secure Keyable ====
Controls if a crypto register can be used as key in HS mode.


=== ACL ===
Forced set if the crypto register has [[#Secure Readable|Secure Readable]] access. Once cleared, this access mode cannot be set again.
{| class="wikitable" border="1"
!  Bit
!  Meaning
|-
| 0 || Secure key. Forced set if bit1 is set. Once cleared, cannot be set again.
|-
| 1 || Secure readable. Once cleared, cannot be set again.
|-
| 2 || Insecure key. Forced set if bit3 is set. Forced clear if bit0 is clear. Can be toggled back and forth.
|-
| 3 || Insecure readable. Forced clear if bit1 is clear. Can be toggled back and forth.
|-
| 4 || Insecure overwritable. Can be toggled back and forth.
|}


==== Initial values ====
==== Secure Readable ====
On SCP boot, the ACL is 0x1F for all $cX.
Controls if a crypto register can be read in HS mode.


Loading into $cX using xdst instruction sets ACL($cX) to 0x13 and 0x1F, for secure and insecure mode respectively.
Once cleared, this access mode cannot be set again.


Spilling a $cX to DMEM using xdld instruction is allowed if (ACL($cX) & 2) or (ACL($cX) & 8), for secure and insecure mode respectively.
==== Insecure Keyable ====
Controls if a crypto register can be used as key in NS and LS modes.


Loading a secret into $cX sets a per-secret ACL, unconditionally.
Forced set if the crypto register has [[#Secure Readable|Insecure Readable]] access. This access mode cannot be set if the crypto register doesn't have [[#Secure Keyable|Secure Keyable]] access.


=== cauth ===
==== Insecure Readable ====
$cauth is a special purpose register in the CPU.
Controls if a crypto register can be read in NS and LS modes.


{| class="wikitable" border="1"
This access mode cannot be set if the crypto register doesn't have [[#Secure Keyable|Secure Readable]] access.
!  Bits
!  Description
|-
| 0-7 || Start of region to authenticate (in 0x100 pages)
|-
| 8-15 || Unknown
|-
| 16 || Use secret xfers
|-
| 17 || Region is encrypted
|-
| 18 || Unknown (set in HS mode)
|-
| 19 || Block traps and interrupts (set in HS mode)
|-
| 20-23 || Unknown
|-
| 24-31 || Size of region to authenticate (in 0x100 pages)
|}
 
=== cxset ===
cxset instruction provides a way to change behavior of a variable amount of successively executed DMA-related instructions.
 
for example: <code>000000de: f4 3c 02              cxset 0x2</code>
 
can be read as: <code>dma_override(type=crypto_reg, count=2)</code>
 
The argument to cxset specifies the type of behavior change in the top 3 bits, and the number of DMA-related instructions the effect lasts for in the lower 5 bits.
 
{| class=wikitable
! Bits || Description
|-
| 0-4 || Number of instructions it is valid for (0x1f is a special value meaning infinitely many instructions -- until overriden by another cxset)
|-
| 5 || Crypto destination/source select (0=crypto register, 1=crypto stream)
|-
| 6 || External memory override (0=Disabled, 1=Enabled)
|-
| 7 || Internal memory select (0=DMEM, 1=IMEM)
|}


==== DMA-Related Instructions ====
==== Insecure Writeable ====
At least the following instructions may have changed behavior, and count against the cxset "count" argument: <code>xdwait</code>, <code>xdst</code>, <code>xdld</code>.
Controls if a crypto register can be written to in NS and LS modes.


For example, if override type=0b000, then the "length" argument to <code>xdst</code> is instead treated as the index of the target $cX register.
This access mode has no effect in HS mode.


=== Secrets ===
=== Secrets ===
Falcon's Authenticated Mode has access to 64 128-bit keys which are burned at factory. These keys can be loaded by using the $csecret instruction which takes the target crypto register and the key index as arguments.
[[#Secure BootROM|Heavy Secure Mode]] has access to 64 128-bit keys which are burned at factory. These keys can be loaded using the $csecret instruction which takes the target crypto register and the key index as arguments.


Secrets are specific to each Falcon unit with the exception of secret 0x3F. This secret is effectively empty (all zeros), but is configured to be overwritten with the KFUSE private key once the KFUSE clock is enabled. The KFUSE private key is console-unique.
Secrets are specific to each Falcon unit with the exception of secret 0x3F. This secret is effectively empty (all zeros), but is configured to be overwritten with the KFUSE private key once the KFUSE clock is enabled. The KFUSE private key is console-unique.


{| class=wikitable
{| class=wikitable
! Index || ACL || Notes
! Index || ACL || Description
|-
|-
| 0x00 || 0x13 || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares.
| 0x00 || 0x03 || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares.
|-
|-
| 0x01 || 0x10 || Used by nvhost_nvdec_bl020_prod firmware.
| 0x01 || 0x00 || Used by Falcon's [[#Secure BootROM|Secure BootROM]] for the signature generation algorithm.
|-
|-
| 0x02 || 0x10 ||
| 0x02 || 0x00 ||
|-
|-
| 0x03 || 0x11 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
| 0x03 || 0x01 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|-
|-
| 0x04 || 0x10 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
| 0x04 || 0x00 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|-
|-
| 0x05 || 0x13 || Used by nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares.
| 0x05 || 0x03 || Used by nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares.
|-
|-
| 0x06 || 0x11 ||
| 0x06 || 0x01 || Used by Falcon's [[#Secure BootROM|Secure BootROM]] as key to decrypt data during authentication (decided by bit 17 in the [[#SEC|SEC]] register).
|-
|-
| 0x07 || 0x11 || Used by [6.0.0+] nvhost_tsec firmware.
| 0x07 || 0x01 || Used by [6.0.0+] nvhost_tsec firmware.
|-
|-
| 0x08 || 0x10 ||
| 0x08 || 0x00 ||
|-
|-
| 0x09 || 0x13 || Used by nvhost_tsec firmware.
| 0x09 || 0x03 || Used by nvhost_tsec firmware.
|-
|-
| 0x0A || 0x11 ||
| 0x0A || 0x01 ||
|-
|-
| 0x0B || 0x10 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
| 0x0B || 0x00 || Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|-
|-
| 0x0C || 0x13 ||
| 0x0C || 0x03 ||
|-
|-
| 0x0D || 0x11 ||
| 0x0D || 0x01 ||
|-
|-
| 0x0E || 0x10 ||
| 0x0E || 0x00 ||
|-
|-
| 0x0F || 0x13 || Used by nvhost_tsec firmware.
| 0x0F || 0x03 || Used by nvhost_tsec firmware.
|-
|-
| 0x10 || 0x11 || Used by [1.0.0-5.1.0] nvhost_tsec firmware.
| 0x10 || 0x01 || Used by [1.0.0-5.1.0] nvhost_tsec firmware.
|-
|-
| 0x11 || 0x10 ||
| 0x11 || 0x00 ||
|-
|-
| 0x12 || 0x13 ||
| 0x12 || 0x03 ||
|-
|-
| 0x13 || 0x11 ||
| 0x13 || 0x01 ||
|-
|-
| 0x14 || 0x10 ||
| 0x14 || 0x00 ||
|-
|-
| 0x15 || 0x13 || Used by nvhost_nvdec_bl020_prod, [5.0.0+] nvhost_nvdec020_prod, [5.0.0+] nvhost_nvdec020_ns and [6.0.0+] nvhost_tsec firmwares.
| 0x15 || 0x03 || Used by nvhost_nvdec_bl020_prod, [5.0.0+] nvhost_nvdec020_prod, [5.0.0+] nvhost_nvdec020_ns and [6.0.0+] nvhost_tsec firmwares.
|-
|-
| 0x16 || 0x11 ||
| 0x16 || 0x01 ||
|-
|-
| 0x17 || 0x10 ||
| 0x17 || 0x00 || Used by [11.0.0+] nvhost_tsec firmware.
|-
|-
| 0x18 || 0x13 ||
| 0x18 || 0x03 ||
|-
|-
| 0x19 || 0x11 ||
| 0x19 || 0x01 ||
|-
|-
| 0x1A || 0x10 ||
| 0x1A || 0x00 ||
|-
|-
| 0x1B || 0x13 ||
| 0x1B || 0x03 ||
|-
|-
| 0x1C || 0x11 ||
| 0x1C || 0x01 ||
|-
|-
| 0x1D || 0x10 ||
| 0x1D || 0x00 ||
|-
|-
| 0x1E || 0x13 ||
| 0x1E || 0x03 ||
|-
|-
| 0x1F || 0x11 ||
| 0x1F || 0x01 ||
|-
|-
| 0x20 || 0x10 ||
| 0x20 || 0x00 ||
|-
|-
| 0x21 || 0x13 ||
| 0x21 || 0x03 ||
|-
|-
| 0x22 || 0x11 ||
| 0x22 || 0x01 ||
|-
|-
| 0x23 || 0x10 ||
| 0x23 || 0x00 ||
|-
|-
| 0x24 || 0x13 ||
| 0x24 || 0x03 ||
|-
|-
| 0x25 || 0x11 ||
| 0x25 || 0x01 ||
|-
|-
| 0x26 || 0x10 || Used by [[TSEC_Firmware#KeygenLdr|KeygenLdr]] and [[TSEC_Firmware#SecureBoot|SecureBoot]]
| 0x26 || 0x00 || Used by [[TSEC_Firmware#KeygenLdr|KeygenLdr]] and [[TSEC_Firmware#SecureBoot|SecureBoot]]
|-
|-
| 0x27 || 0x13 ||
| 0x27 || 0x03 ||
|-
|-
| 0x28 || 0x11 ||
| 0x28 || 0x01 ||
|-
|-
| 0x29 || 0x10 ||
| 0x29 || 0x00 ||
|-
|-
| 0x2A || 0x13 ||
| 0x2A || 0x03 ||
|-
|-
| 0x2B || 0x11 ||
| 0x2B || 0x01 ||
|-
|-
| 0x2C || 0x10 ||
| 0x2C || 0x00 ||
|-
|-
| 0x2D || 0x13 ||
| 0x2D || 0x03 ||
|-
|-
| 0x2E || 0x11 ||
| 0x2E || 0x01 ||
|-
|-
| 0x2F || 0x10 ||
| 0x2F || 0x00 ||
|-
|-
| 0x30 || 0x13 ||
| 0x30 || 0x03 ||
|-
|-
| 0x31 || 0x11 ||
| 0x31 || 0x01 ||
|-
|-
| 0x32 || 0x10 ||
| 0x32 || 0x00 ||
|-
|-
| 0x33 || 0x13 ||
| 0x33 || 0x03 ||
|-
|-
| 0x34 || 0x11 ||
| 0x34 || 0x01 ||
|-
|-
| 0x35 || 0x10 ||
| 0x35 || 0x00 ||
|-
|-
| 0x36 || 0x13 ||
| 0x36 || 0x03 ||
|-
|-
| 0x37 || 0x11 ||
| 0x37 || 0x01 ||
|-
|-
| 0x38 || 0x10 ||
| 0x38 || 0x00 ||
|-
|-
| 0x39 || 0x13 ||
| 0x39 || 0x03 ||
|-
|-
| 0x3A || 0x11 ||
| 0x3A || 0x01 ||
|-
|-
| 0x3B || 0x10 ||
| 0x3B || 0x00 ||
|-
|-
| 0x3C || 0x13 || Used by nvhost_tsec firmware.
| 0x3C || 0x03 || Used by nvhost_tsec firmware.
|-
|-
| 0x3D || 0x11 ||
| 0x3D || 0x01 ||
|-
|-
| 0x3E || 0x10 ||
| 0x3E || 0x00 ||
|-
|-
| 0x3F || 0x10 || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
| 0x3F || 0x00 || Used by [[TSEC_Firmware#Keygen|Keygen]], nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
|}
|}
Retrieved from "https://switchbrew.org/wiki/TSEC"