Latest revision as of 19:25, 12 June 2020

TSEC (Tegra Security Co-processor) is a dedicated unit powered by a NVIDIA Falcon microprocessor with crypto extensions.

Driver

A host driver for communicating with the TSEC is mapped to physical address 0x54500000 with a total size of 0x40000 bytes and exposes several registers.

Registers

The TSEC's MMIO space is divided as follows:

0x54500000 to 0x54501000: THI (Tegra Host Interface)
0x54501000 to 0x54501400: FALCON (Falcon microcontroller)
0x54501400 to 0x54501600: SCP (Secure Co-processor)
0x54501600 to 0x54501680: TFBIF (Tegra Framebuffer Interface)
0x54501680 to 0x54501700: CG (Clock Gate)
0x54501700 to 0x54501800: BAR0 (HOST1X device DMA)
0x54501800 to 0x54501900: TEGRA (Miscellaneous interfaces)

Name	Address	Width
TSEC_THI_INCR_SYNCPT	0x54500000	0x04
TSEC_THI_INCR_SYNCPT_CTRL	0x54500004	0x04
TSEC_THI_INCR_SYNCPT_ERR	0x54500008	0x04
TSEC_THI_CTXSW_INCR_SYNCPT	0x5450000C	0x04
TSEC_THI_CTXSW	0x54500020	0x04
TSEC_THI_CTXSW_NEXT	0x54500024	0x04
TSEC_THI_CONT_SYNCPT_EOF	0x54500028	0x04
TSEC_THI_CONT_SYNCPT_L1	0x5450002C	0x04
TSEC_THI_STREAMID0	0x54500030	0x04
TSEC_THI_STREAMID1	0x54500034	0x04
TSEC_THI_THI_SEC	0x54500038	0x04
TSEC_THI_METHOD0	0x54500040	0x04
TSEC_THI_METHOD1	0x54500044	0x04
TSEC_THI_CONTEXT_SWITCH	0x54500060	0x04
TSEC_THI_INT_STATUS	0x54500078	0x04
TSEC_THI_INT_MASK	0x5450007C	0x04
TSEC_THI_CONFIG0	0x54500080	0x04
TSEC_THI_DBG_MISC	0x54500084	0x04
TSEC_THI_SLCG_OVERRIDE_HIGH_A	0x54500088	0x04
TSEC_THI_SLCG_OVERRIDE_LOW_A	0x5450008C	0x04
TSEC_THI_CLK_OVERRIDE	0x54500E00	0x04
TSEC_FALCON_IRQSSET	0x54501000	0x04
TSEC_FALCON_IRQSCLR	0x54501004	0x04
TSEC_FALCON_IRQSTAT	0x54501008	0x04
TSEC_FALCON_IRQMODE	0x5450100C	0x04
TSEC_FALCON_IRQMSET	0x54501010	0x04
TSEC_FALCON_IRQMCLR	0x54501014	0x04
TSEC_FALCON_IRQMASK	0x54501018	0x04
TSEC_FALCON_IRQDEST	0x5450101C	0x04
TSEC_FALCON_GPTMRINT	0x54501020	0x04
TSEC_FALCON_GPTMRVAL	0x54501024	0x04
TSEC_FALCON_GPTMRCTL	0x54501028	0x04
TSEC_FALCON_PTIMER0	0x5450102C	0x04
TSEC_FALCON_PTIMER1	0x54501030	0x04
TSEC_FALCON_WDTMRVAL	0x54501034	0x04
TSEC_FALCON_WDTMRCTL	0x54501038	0x04
TSEC_FALCON_IRQDEST2	0x5450103C	0x04
TSEC_FALCON_MAILBOX0	0x54501040	0x04
TSEC_FALCON_MAILBOX1	0x54501044	0x04
TSEC_FALCON_ITFEN	0x54501048	0x04
TSEC_FALCON_IDLESTATE	0x5450104C	0x04
TSEC_FALCON_CURCTX	0x54501050	0x04
TSEC_FALCON_NXTCTX	0x54501054	0x04
TSEC_FALCON_CTXACK	0x54501058	0x04
TSEC_FALCON_FHSTATE	0x5450105C	0x04
TSEC_FALCON_PRIVSTATE	0x54501060	0x04
TSEC_FALCON_MTHDDATA	0x54501064	0x04
TSEC_FALCON_MTHDID	0x54501068	0x04
TSEC_FALCON_MTHDWDAT	0x5450106C	0x04
TSEC_FALCON_MTHDCOUNT	0x54501070	0x04
TSEC_FALCON_MTHDPOP	0x54501074	0x04
TSEC_FALCON_MTHDRAMSZ	0x54501078	0x04
TSEC_FALCON_SFTRESET	0x5450107C	0x04
TSEC_FALCON_OS	0x54501080	0x04
TSEC_FALCON_RM	0x54501084	0x04
TSEC_FALCON_SOFT_PM	0x54501088	0x04
TSEC_FALCON_SOFT_MODE	0x5450108C	0x04
TSEC_FALCON_DEBUG1	0x54501090	0x04
TSEC_FALCON_DEBUGINFO	0x54501094	0x04
TSEC_FALCON_IBRKPT1	0x54501098	0x04
TSEC_FALCON_IBRKPT2	0x5450109C	0x04
TSEC_FALCON_CGCTL	0x545010A0	0x04
TSEC_FALCON_ENGCTL	0x545010A4	0x04
TSEC_FALCON_PMM	0x545010A8	0x04
TSEC_FALCON_ADDR	0x545010AC	0x04
TSEC_FALCON_IBRKPT3	0x545010B0	0x04
TSEC_FALCON_IBRKPT4	0x545010B4	0x04
TSEC_FALCON_IBRKPT5	0x545010B8	0x04
TSEC_FALCON_EXCI	0x545010D0	0x04
TSEC_FALCON_SVEC_SPR	0x545010D4	0x04
TSEC_FALCON_RSTAT0	0x545010D8	0x04
TSEC_FALCON_RSTAT3	0x545010DC	0x04
TSEC_FALCON_UNK_E0	0x545010E0	0x04
TSEC_FALCON_CPUCTL	0x54501100	0x04
TSEC_FALCON_BOOTVEC	0x54501104	0x04
TSEC_FALCON_HWCFG	0x54501108	0x04
TSEC_FALCON_DMACTL	0x5450110C	0x04
TSEC_FALCON_DMATRFBASE	0x54501110	0x04
TSEC_FALCON_DMATRFMOFFS	0x54501114	0x04
TSEC_FALCON_DMATRFCMD	0x54501118	0x04
TSEC_FALCON_DMATRFFBOFFS	0x5450111C	0x04
TSEC_FALCON_DMAPOLL_FB	0x54501120	0x04
TSEC_FALCON_DMAPOLL_CP	0x54501124	0x04
TSEC_FALCON_DBG_STATE	0x54501128	0x04
TSEC_FALCON_HWCFG1	0x5450112C	0x04
TSEC_FALCON_CPUCTL_ALIAS	0x54501130	0x04
TSEC_FALCON_STACKCFG	0x54501138	0x04
TSEC_FALCON_IMCTL	0x54501140	0x04
TSEC_FALCON_IMSTAT	0x54501144	0x04
TSEC_FALCON_TRACEIDX	0x54501148	0x04
TSEC_FALCON_TRACEPC	0x5450114C	0x04
TSEC_FALCON_IMFILLRNG0	0x54501150	0x04
TSEC_FALCON_IMFILLRNG1	0x54501154	0x04
TSEC_FALCON_IMFILLCTL	0x54501158	0x04
TSEC_FALCON_IMCTL_DEBUG	0x5450115C	0x04
TSEC_FALCON_CMEMBASE	0x54501160	0x04
TSEC_FALCON_DMEMAPERT	0x54501164	0x04
TSEC_FALCON_EXTERRADDR	0x54501168	0x04
TSEC_FALCON_EXTERRSTAT	0x5450116C	0x04
TSEC_FALCON_CG2	0x5450117C	0x04
TSEC_FALCON_IMEMC0	0x54501180	0x04
TSEC_FALCON_IMEMD0	0x54501184	0x04
TSEC_FALCON_IMEMT0	0x54501188	0x04
TSEC_FALCON_IMEMC1	0x54501190	0x04
TSEC_FALCON_IMEMD1	0x54501194	0x04
TSEC_FALCON_IMEMT1	0x54501198	0x04
TSEC_FALCON_IMEMC2	0x545011A0	0x04
TSEC_FALCON_IMEMD2	0x545011A4	0x04
TSEC_FALCON_IMEMT2	0x545011A8	0x04
TSEC_FALCON_IMEMC3	0x545011B0	0x04
TSEC_FALCON_IMEMD3	0x545011B4	0x04
TSEC_FALCON_IMEMT3	0x545011B8	0x04
TSEC_FALCON_DMEMC0	0x545011C0	0x04
TSEC_FALCON_DMEMD0	0x545011C4	0x04
TSEC_FALCON_DMEMC1	0x545011C8	0x04
TSEC_FALCON_DMEMD1	0x545011CC	0x04
TSEC_FALCON_DMEMC2	0x545011D0	0x04
TSEC_FALCON_DMEMD2	0x545011D4	0x04
TSEC_FALCON_DMEMC3	0x545011D8	0x04
TSEC_FALCON_DMEMD3	0x545011DC	0x04
TSEC_FALCON_DMEMC4	0x545011E0	0x04
TSEC_FALCON_DMEMD4	0x545011E4	0x04
TSEC_FALCON_DMEMC5	0x545011E8	0x04
TSEC_FALCON_DMEMD5	0x545011EC	0x04
TSEC_FALCON_DMEMC6	0x545011F0	0x04
TSEC_FALCON_DMEMD6	0x545011F4	0x04
TSEC_FALCON_DMEMC7	0x545011F8	0x04
TSEC_FALCON_DMEMD7	0x545011FC	0x04
TSEC_FALCON_ICD_CMD	0x54501200	0x04
TSEC_FALCON_ICD_ADDR	0x54501204	0x04
TSEC_FALCON_ICD_WDATA	0x54501208	0x04
TSEC_FALCON_ICD_RDATA	0x5450120C	0x04
TSEC_FALCON_SCTL	0x54501240	0x04
TSEC_FALCON_SSTAT	0x54501244	0x04
TSEC_FALCON_UNK_250	0x54501250	0x04
TSEC_FALCON_UNK_260	0x54501260	0x04
TSEC_FALCON_SPROT_IMEM	0x54501280	0x04
TSEC_FALCON_SPROT_DMEM	0x54501284	0x04
TSEC_FALCON_SPROT_CPUCTL	0x54501288	0x04
TSEC_FALCON_SPROT_MISC	0x5450128C	0x04
TSEC_FALCON_SPROT_IRQ	0x54501290	0x04
TSEC_FALCON_SPROT_MTHD	0x54501294	0x04
TSEC_FALCON_SPROT_SCTL	0x54501298	0x04
TSEC_FALCON_SPROT_WDTMR	0x5450129C	0x04
TSEC_FALCON_DMAINFO_FINISHED_FBRD_LOW	0x545012C0	0x04
TSEC_FALCON_DMAINFO_FINISHED_FBRD_HIGH	0x545012C4	0x04
TSEC_FALCON_DMAINFO_FINISHED_FBWR_LOW	0x545012C8	0x04
TSEC_FALCON_DMAINFO_FINISHED_FBWR_HIGH	0x545012CC	0x04
TSEC_FALCON_DMAINFO_CURRENT_FBRD_LOW	0x545012D0	0x04
TSEC_FALCON_DMAINFO_CURRENT_FBRD_HIGH	0x545012D4	0x04
TSEC_FALCON_DMAINFO_CURRENT_FBWR_LOW	0x545012D8	0x04
TSEC_FALCON_DMAINFO_CURRENT_FBWR_HIGH	0x545012DC	0x04
TSEC_FALCON_DMAINFO_CTL	0x545012E0	0x04
TSEC_SCP_CTL0	0x54501400	0x04
TSEC_SCP_CTL1	0x54501404	0x04
TSEC_SCP_CTL_STAT	0x54501408	0x04
TSEC_SCP_CTL_LOCK	0x5450140C	0x04
TSEC_SCP_CFG	0x54501410	0x04
TSEC_SCP_CTL_SCP	0x54501414	0x04
TSEC_SCP_CTL_PKEY	0x54501418	0x04
TSEC_SCP_CTL_DBG	0x5450141C	0x04
TSEC_SCP_DBG0	0x54501420	0x04
TSEC_SCP_DBG1	0x54501424	0x04
TSEC_SCP_DBG2	0x54501428	0x04
TSEC_SCP_CMD	0x54501430	0x04
TSEC_SCP_STAT0	0x54501450	0x04
TSEC_SCP_STAT1	0x54501454	0x04
TSEC_SCP_STAT2	0x54501458	0x04
TSEC_SCP_RNG_STAT0	0x54501470	0x04
TSEC_SCP_RNG_STAT1	0x54501474	0x04
TSEC_SCP_IRQSTAT	0x54501480	0x04
TSEC_SCP_IRQMASK	0x54501484	0x04
TSEC_SCP_ACL_ERR	0x54501490	0x04
TSEC_SCP_SEC_ERR	0x54501494	0x04
TSEC_SCP_CMD_ERR	0x54501498	0x04
TSEC_SCP_RND_CTL0	0x54501500	0x04
TSEC_RND_SCP_CTL1	0x54501504	0x04
TSEC_SCP_RND_CTL2	0x54501508	0x04
TSEC_SCP_RND_CTL3	0x5450150C	0x04
TSEC_SCP_RND_CTL4	0x54501510	0x04
TSEC_SCP_RND_CTL5	0x54501514	0x04
TSEC_SCP_RND_CTL6	0x54501518	0x04
TSEC_SCP_RND_CTL7	0x5450151C	0x04
TSEC_SCP_RND_CTL8	0x54501520	0x04
TSEC_SCP_RND_CTL9	0x54501524	0x04
TSEC_SCP_RND_CTL10	0x54501528	0x04
TSEC_SCP_RND_CTL11	0x5450152C	0x04
TSEC_TFBIF_CTL	0x54501600	0x04
TSEC_TFBIF_MCCIF_FIFOCTRL	0x54501604	0x04
TSEC_TFBIF_THROTTLE	0x54501608	0x04
TSEC_TFBIF_DBG_STAT0	0x5450160C	0x04
TSEC_TFBIF_DBG_STAT1	0x54501610	0x04
TSEC_TFBIF_DBG_RDCOUNT_LO	0x54501614	0x04
TSEC_TFBIF_DBG_RDCOUNT_HI	0x54501618	0x04
TSEC_TFBIF_DBG_WRCOUNT_LO	0x5450161C	0x04
TSEC_TFBIF_DBG_WRCOUNT_HI	0x54501620	0x04
TSEC_TFBIF_DBG_R32COUNT	0x54501624	0x04
TSEC_TFBIF_DBG_R64COUNT	0x54501628	0x04
TSEC_TFBIF_DBG_R128COUNT	0x5450162C	0x04
TSEC_TFBIF_UNK_30	0x54501630	0x04
TSEC_TFBIF_MCCIF_FIFOCTRL1	0x54501634	0x04
TSEC_TFBIF_WRR_RDP	0x54501638	0x04
TSEC_TFBIF_SPROT_EMEM	0x54501640	0x04
TSEC_TFBIF_TRANSCFG	0x54501644	0x04
TSEC_TFBIF_REGIONCFG	0x54501648	0x04
TSEC_TFBIF_ACTMON_ACTIVE_MASK	0x5450164C	0x04
TSEC_TFBIF_ACTMON_ACTIVE_BORPS	0x54501650	0x04
TSEC_TFBIF_ACTMON_ACTIVE_WEIGHT	0x54501654	0x04
TSEC_TFBIF_ACTMON_MCB_MASK	0x54501660	0x04
TSEC_TFBIF_ACTMON_MCB_BORPS	0x54501664	0x04
TSEC_TFBIF_ACTMON_MCB_WEIGHT	0x54501668	0x04
TSEC_TFBIF_THI_TRANSPROP	0x54501670	0x04
TSEC_CG	0x545016D0	0x04
TSEC_BAR0_CTL	0x54501700	0x04
TSEC_BAR0_ADDR	0x54501704	0x04
TSEC_BAR0_DATA	0x54501708	0x04
TSEC_BAR0_TIMEOUT	0x5450170C	0x04
TSEC_TEGRA_FALCON_IP_VER	0x54501800	0x04
TSEC_TEGRA_UNK_04	0x54501804	0x04
TSEC_TEGRA_UNK_08	0x54501808	0x04
TSEC_TEGRA_UNK_0C	0x5450180C	0x04
TSEC_TEGRA_UNK_10	0x54501810	0x04
TSEC_TEGRA_UNK_14	0x54501814	0x04
TSEC_TEGRA_UNK_18	0x54501818	0x04
TSEC_TEGRA_UNK_1C	0x5450181C	0x04
TSEC_TEGRA_UNK_20	0x54501820	0x04
TSEC_TEGRA_UNK_24	0x54501824	0x04
TSEC_TEGRA_UNK_28	0x54501828	0x04
TSEC_TEGRA_UNK_2C	0x5450182C	0x04
TSEC_TEGRA_UNK_30	0x54501830	0x04
TSEC_TEGRA_UNK_34	0x54501834	0x04
TSEC_TEGRA_CTL	0x54501838	0x04

TSEC_THI_METHOD0

Bits	Description
0-11	TSEC_THI_METHOD0_OFFSET

Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

The following methods are available:

ID	Method
0x100	NOP
0x140	PM_TRIGGER
0x200	SET_APPLICATION_ID
0x204	SET_WATCHDOG_TIMER
0x240	SEMAPHORE_A
0x244	SEMAPHORE_B
0x248	SEMAPHORE_C
0x24C
0x250
0x300	EXECUTE
0x304	SEMAPHORE_D
0x500	HDCP_INIT
0x504	HDCP_CREATE_SESSION
0x508	HDCP_VERIFY_CERT_RX
0x50C	HDCP_GENERATE_EKM
0x510	HDCP_REVOCATION_CHECK
0x514	HDCP_VERIFY_HPRIME
0x518	HDCP_ENCRYPT_PAIRING_INFO
0x51C	HDCP_DECRYPT_PAIRING_INFO
0x520	HDCP_UPDATE_SESSION
0x524	HDCP_GENERATE_LC_INIT
0x528	HDCP_VERIFY_LPRIME
0x52C	HDCP_GENERATE_SKE_INIT
0x530	HDCP_VERIFY_VPRIME
0x534	HDCP_ENCRYPTION_RUN_CTRL
0x538	HDCP_SESSION_CTRL
0x53C	HDCP_COMPUTE_SPRIME
0x540	HDCP_GET_CERT_RX
0x544	HDCP_EXCHANGE_INFO
0x548	HDCP_DECRYPT_KM
0x54C	HDCP_GET_HPRIME
0x550	HDCP_GENERATE_EKH_KM
0x554	HDCP_VERIFY_RTT_CHALLENGE
0x558	HDCP_GET_LPRIME
0x55C	HDCP_DECRYPT_KS
0x560	HDCP_DECRYPT
0x564	HDCP_GET_RRX
0x568	HDCP_DECRYPT_REENCRYPT
0x56C
0x570
0x574	HDCP_DECRYPT_STORED_KM
0x578
0x57C
0x700	HDCP_VALIDATE_SRM
0x704	HDCP_VALIDATE_STREAM
0x708	HDCP_TEST_SECURE_STATUS
0x70C	HDCP_SET_DCP_KPUB
0x710	HDCP_SET_RX_KPUB
0x714	HDCP_SET_CERT_RX
0x718	HDCP_SET_SCRATCH_BUFFER
0x71C	HDCP_SET_SRM
0x720	HDCP_SET_RECEIVER_ID_LIST
0x724	HDCP_SET_SPRIME
0x728	HDCP_SET_ENC_INPUT_BUFFER
0x72C	HDCP_SET_ENC_OUTPUT_BUFFER
0x730	HDCP_GET_RTT_CHALLENGE
0x734	HDCP_STREAM_MANAGE
0x738	HDCP_READ_CAPS
0x73C	HDCP_ENCRYPT
0x740	[6.0.0+] HDCP_GET_CURRENT_NONCE
0x1114	PM_TRIGGER_END

TSEC_THI_METHOD1

Bits	Description
0-31	TSEC_THI_METHOD1_DATA

Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.

TSEC_THI_INT_STATUS

Bits	Description
0	TSEC_THI_INT_STATUS_FALCON_INT

TSEC_THI_INT_MASK

Bits	Description
0	TSEC_THI_INT_MASK_FALCON_INT

TSEC_FALCON_IRQSSET

Bits	Description
0	TSEC_FALCON_IRQSSET_GPTMR
1	TSEC_FALCON_IRQSSET_WDTMR
2	TSEC_FALCON_IRQSSET_MTHD
3	TSEC_FALCON_IRQSSET_CTXSW
4	TSEC_FALCON_IRQSSET_HALT
5	TSEC_FALCON_IRQSSET_EXTERR
6	TSEC_FALCON_IRQSSET_SWGEN0
7	TSEC_FALCON_IRQSSET_SWGEN1
8-15	TSEC_FALCON_IRQSSET_EXT
16	TSEC_FALCON_IRQSSET_DMA

Used for setting Falcon's IRQs.

TSEC_FALCON_IRQSCLR

Bits	Description
0	TSEC_FALCON_IRQSCLR_GPTMR
1	TSEC_FALCON_IRQSCLR_WDTMR
2	TSEC_FALCON_IRQSCLR_MTHD
3	TSEC_FALCON_IRQSCLR_CTXSW
4	TSEC_FALCON_IRQSCLR_HALT
5	TSEC_FALCON_IRQSCLR_EXTERR
6	TSEC_FALCON_IRQSCLR_SWGEN0
7	TSEC_FALCON_IRQSCLR_SWGEN1
8-15	TSEC_FALCON_IRQSCLR_EXT
16	TSEC_FALCON_IRQSCLR_DMA

Used for clearing Falcon's IRQs.

TSEC_FALCON_IRQSTAT

Bits	Description
0	TSEC_FALCON_IRQSTAT_GPTMR
1	TSEC_FALCON_IRQSTAT_WDTMR
2	TSEC_FALCON_IRQSTAT_MTHD
3	TSEC_FALCON_IRQSTAT_CTXSW
4	TSEC_FALCON_IRQSTAT_HALT
5	TSEC_FALCON_IRQSTAT_EXTERR
6	TSEC_FALCON_IRQSTAT_SWGEN0
7	TSEC_FALCON_IRQSTAT_SWGEN1
8-15	TSEC_FALCON_IRQSTAT_EXT
16	TSEC_FALCON_IRQSTAT_DMA

Used for getting the status of Falcon's IRQs.

TSEC_FALCON_IRQMODE

Bits	Description
0	TSEC_FALCON_IRQMODE_LVL_GPTMR
1	TSEC_FALCON_IRQMODE_LVL_WDTMR
2	TSEC_FALCON_IRQMODE_LVL_MTHD
3	TSEC_FALCON_IRQMODE_LVL_CTXSW
4	TSEC_FALCON_IRQMODE_LVL_HALT
5	TSEC_FALCON_IRQMODE_LVL_EXTERR
6	TSEC_FALCON_IRQMODE_LVL_SWGEN0
7	TSEC_FALCON_IRQMODE_LVL_SWGEN1
8-15	TSEC_FALCON_IRQMODE_LVL_EXT
16	TSEC_FALCON_IRQMODE_LVL_DMA

Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.

TSEC_FALCON_IRQMSET

Bits	Description
0	TSEC_FALCON_IRQMSET_GPTMR
1	TSEC_FALCON_IRQMSET_WDTMR
2	TSEC_FALCON_IRQMSET_MTHD
3	TSEC_FALCON_IRQMSET_CTXSW
4	TSEC_FALCON_IRQMSET_HALT
5	TSEC_FALCON_IRQMSET_EXTERR
6	TSEC_FALCON_IRQMSET_SWGEN0
7	TSEC_FALCON_IRQMSET_SWGEN1
8-15	TSEC_FALCON_IRQMSET_EXT
16	TSEC_FALCON_IRQMSET_DMA

Used for setting the mask for Falcon's IRQs.

TSEC_FALCON_IRQMCLR

Bits	Description
0	TSEC_FALCON_IRQMCLR_GPTMR
1	TSEC_FALCON_IRQMCLR_WDTMR
2	TSEC_FALCON_IRQMCLR_MTHD
3	TSEC_FALCON_IRQMCLR_CTXSW
4	TSEC_FALCON_IRQMCLR_HALT
5	TSEC_FALCON_IRQMCLR_EXTERR
6	TSEC_FALCON_IRQMCLR_SWGEN0
7	TSEC_FALCON_IRQMCLR_SWGEN1
8-15	TSEC_FALCON_IRQMCLR_EXT
16	TSEC_FALCON_IRQMCLR_DMA

Used for clearing the mask for Falcon's IRQs.

TSEC_FALCON_IRQMASK

Bits	Description
0	TSEC_FALCON_IRQMASK_GPTMR
1	TSEC_FALCON_IRQMASK_WDTMR
2	TSEC_FALCON_IRQMASK_MTHD
3	TSEC_FALCON_IRQMASK_CTXSW
4	TSEC_FALCON_IRQMASK_HALT
5	TSEC_FALCON_IRQMASK_EXTERR
6	TSEC_FALCON_IRQMASK_SWGEN0
7	TSEC_FALCON_IRQMASK_SWGEN1
8-15	TSEC_FALCON_IRQMASK_EXT
16	TSEC_FALCON_IRQMASK_DMA

Used for getting the value of the mask for Falcon's IRQs.

TSEC_FALCON_IRQDEST

Bits	Description
0	TSEC_FALCON_IRQDEST_HOST_GPTMR
1	TSEC_FALCON_IRQDEST_HOST_WDTMR
2	TSEC_FALCON_IRQDEST_HOST_MTHD
3	TSEC_FALCON_IRQDEST_HOST_CTXSW
4	TSEC_FALCON_IRQDEST_HOST_HALT
5	TSEC_FALCON_IRQDEST_HOST_EXTERR
6	TSEC_FALCON_IRQDEST_HOST_SWGEN0
7	TSEC_FALCON_IRQDEST_HOST_SWGEN1
8-15	TSEC_FALCON_IRQDEST_HOST_EXT
16	TSEC_FALCON_IRQDEST_TARGET_GPTMR
17	TSEC_FALCON_IRQDEST_TARGET_WDTMR
18	TSEC_FALCON_IRQDEST_TARGET_MTHD
19	TSEC_FALCON_IRQDEST_TARGET_CTXSW
20	TSEC_FALCON_IRQDEST_TARGET_HALT
21	TSEC_FALCON_IRQDEST_TARGET_EXTERR
22	TSEC_FALCON_IRQDEST_TARGET_SWGEN0
23	TSEC_FALCON_IRQDEST_TARGET_SWGEN1
24-31	TSEC_FALCON_IRQDEST_TARGET_EXT

Used for routing Falcon's IRQs.

TSEC_FALCON_IRQDEST2

Bits	Description
0	TSEC_FALCON_IRQDEST2_HOST_DMA
16	TSEC_FALCON_IRQDEST2_TARGET_DMA

Used for routing Falcon's IRQs.

TSEC_FALCON_MAILBOX0

Bits	Description
0-31	TSEC_FALCON_MAILBOX0_DATA

Scratch register for reading/writing data to Falcon.

TSEC_FALCON_MAILBOX1

Bits	Description
0-31	TSEC_FALCON_MAILBOX1_DATA

Scratch register for reading/writing data to Falcon.

TSEC_FALCON_ITFEN

Bits	Description
0	TSEC_FALCON_ITFEN_CTXEN
1	TSEC_FALCON_ITFEN_MTHDEN

Used for enabling/disabling Falcon interfaces.

TSEC_FALCON_IDLESTATE

Bits	Description
0	TSEC_FALCON_IDLESTATE_FALCON_BUSY
1-15	TSEC_FALCON_IDLESTATE_EXT_BUSY

Used for detecting if Falcon is busy or not.

TSEC_FALCON_DEBUG1

Bits	Description
0-15	TSEC_FALCON_DEBUG1_MTHD_DRAIN_TIME
16	TSEC_FALCON_DEBUG1_CTXSW_MODE
17	TSEC_FALCON_DEBUG1_TRACE_FORMAT

TSEC_FALCON_DEBUGINFO

Bits	Description
0-31	TSEC_FALCON_DEBUGINFO_DATA

Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.

[6.0.0+] nvservices sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.

TSEC_FALCON_EXCI

Bits

Description

0-19

TSEC_FALCON_EXCI_EXPC

20-23

TSEC_FALCON_EXCI_EXCAUSE

0x00: TRAP0
0x01: TRAP1
0x02: TRAP2
0x03: TRAP3
0x08: ILL_INS (invalid opcode)
0x09: INV_INS (authentication entry)
0x0A: MISS_INS (page miss)
0x0B: DHIT_INS (page multiple hit)
0x0F: BRKPT_INS (breakpoint hit)

Contains information about raised exceptions.

TSEC_FALCON_SVEC_SPR

Bits	Description
18	TSEC_FALCON_SVEC_SPR_SIGPASS

TSEC_FALCON_RSTAT0

Mirror of the ICD status register 0.

TSEC_FALCON_RSTAT3

Mirror of the ICD status register 3.

TSEC_FALCON_CPUCTL

Bits	Description
0	TSEC_FALCON_CPUCTL_IINVAL
1	TSEC_FALCON_CPUCTL_STARTCPU
2	TSEC_FALCON_CPUCTL_SRESET
3	TSEC_FALCON_CPUCTL_HRESET
4	TSEC_FALCON_CPUCTL_HALTED
5	TSEC_FALCON_CPUCTL_STOPPED
6	TSEC_FALCON_CPUCTL_ALIAS_EN

Used for signaling the Falcon CPU.

TSEC_FALCON_BOOTVEC

Bits	Description
0-31	TSEC_FALCON_BOOTVEC_VEC

Takes the Falcon's boot vector address.

TSEC_FALCON_HWCFG

Bits	Description
0-8	TSEC_FALCON_HWCFG_IMEM_SIZE
9-17	TSEC_FALCON_HWCFG_DMEM_SIZE
18-26	TSEC_FALCON_HWCFG_METHODFIFO_DEPTH
27-31	TSEC_FALCON_HWCFG_DMAQUEUE_DEPTH

TSEC_FALCON_DMACTL

Bits	Description
0	TSEC_FALCON_DMACTL_REQUIRE_CTX
1	TSEC_FALCON_DMACTL_DMEM_SCRUBBING
2	TSEC_FALCON_DMACTL_IMEM_SCRUBBING
3-6	TSEC_FALCON_DMACTL_DMAQ_NUM
7	TSEC_FALCON_DMACTL_SECURE_STAT

Used for configuring the Falcon's DMA engine.

TSEC_FALCON_DMATRFBASE

Bits	Description
0-31	TSEC_FALCON_DMATRFBASE_BASE

Base address of the external memory buffer, shifted right by 8.

The current transfer address is calculated by adding TSEC_FALCON_DMATRFFBOFFS to the base.

TSEC_FALCON_DMATRFMOFFS

Bits	Description
0-15	TSEC_FALCON_DMATRFMOFFS_OFFS

For transfers to DMEM: the destination address. For transfers to IMEM: the destination virtual IMEM page.

TSEC_FALCON_DMATRFCMD

Bits	Description
0	TSEC_FALCON_DMATRFCMD_FULL
1	TSEC_FALCON_DMATRFCMD_IDLE
2-3	TSEC_FALCON_DMATRFCMD_SEC
4	TSEC_FALCON_DMATRFCMD_IMEM
5	TSEC_FALCON_DMATRFCMD_WRITE
8-10	TSEC_FALCON_DMATRFCMD_SIZE
12-14	TSEC_FALCON_DMATRFCMD_CTXDMA

Used for configuring DMA transfers.

TSEC_FALCON_DMATRFFBOFFS

Bits	Description
0-15	TSEC_FALCON_DMATRFFBOFFS_OFFS

For transfers to IMEM: the destination physical IMEM page.

TSEC_FALCON_DMAPOLL_FB

Bits	Description
0	TSEC_FALCON_DMAPOLL_FB_FENCE_ACTIVE
1	TSEC_FALCON_DMAPOLL_FB_DMA_ACTIVE
4	TSEC_FALCON_DMAPOLL_FB_CFG_R_FENCE
5	TSEC_FALCON_DMAPOLL_FB_CFG_W_FENCE
16-23	TSEC_FALCON_DMAPOLL_FB_WCOUNT
24-31	TSEC_FALCON_DMAPOLL_FB_RCOUNT

Contains the status of a DMA transfer between the Falcon and external memory.

TSEC_FALCON_DMAPOLL_CP

Bits	Description
0	TSEC_FALCON_DMAPOLL_CP_FENCE_ACTIVE
1	TSEC_FALCON_DMAPOLL_CP_DMA_ACTIVE
4	TSEC_FALCON_DMAPOLL_CP_CFG_R_FENCE
5	TSEC_FALCON_DMAPOLL_CP_CFG_W_FENCE
16-23	TSEC_FALCON_DMAPOLL_CP_WCOUNT
24-31	TSEC_FALCON_DMAPOLL_CP_RCOUNT

Contains the status of a DMA transfer between the Falcon and the SCP.

TSEC_FALCON_HWCFG1

Bits	Description
0-3	TSEC_FALCON_HWCFG1_CORE_REV
4-5	TSEC_FALCON_HWCFG1_SECURITY_MODEL
6-7	TSEC_FALCON_HWCFG1_CORE_REV_SUBVERSION
8-11	TSEC_FALCON_HWCFG1_IMEM_PORTS
12-15	TSEC_FALCON_HWCFG1_DMEM_PORTS
16-20	TSEC_FALCON_HWCFG1_TAG_WIDTH
27	TSEC_FALCON_HWCFG1_DBG_PRIV_BUS
28	TSEC_FALCON_HWCFG1_CSB_SIZE_16M
29	TSEC_FALCON_HWCFG1_PRIV_DIRECT
30	TSEC_FALCON_HWCFG1_DMEM_APERTURES
31	TSEC_FALCON_HWCFG1_IMEM_AUTOFILL

TSEC_FALCON_IMCTL

Bits	Description
0-23	TSEC_FALCON_IMCTL_ADDR_BLK
24-26	TSEC_FALCON_IMCTL_CMD 0x00: NOP 0x01: IMINV (ITLB) 0x02: IMBLK (PTLB) 0x03: IMTAG (VTLB) 0x04: IMTAG_SETVLD

Controls the Falcon TLB.

TSEC_FALCON_IMSTAT

Bits	Description
0-31	TSEC_FALCON_IMSTAT_VAL

Returns the result of the last command from TSEC_FALCON_IMCTL.

TSEC_FALCON_TRACEIDX

Bits	Description
0-7	TSEC_FALCON_TRACEIDX_IDX
16-23	TSEC_FALCON_TRACEIDX_MAXIDX
24-31	TSEC_FALCON_TRACEIDX_CNT

Controls the index for tracing with TSEC_FALCON_TRACEPC.

TSEC_FALCON_TRACEPC

Bits	Description
0-23	TSEC_FALCON_TRACEPC_PC

Returns the PC of the last call or branch executed.

TSEC_FALCON_IMEMC0

Bits	Description
2-7	TSEC_FALCON_IMEMC_OFFS
8-15	TSEC_FALCON_IMEMC_BLK
24	TSEC_FALCON_IMEMC_AINCW
25	TSEC_FALCON_IMEMC_AINCR
28	TSEC_FALCON_IMEMC_SECURE
29	TSEC_FALCON_IMEMC_SEC_ATOMIC
30	TSEC_FALCON_IMEMC_SEC_WR_VIO
31	TSEC_FALCON_IMEMC_SEC_LOCK

Used for configuring access to Falcon's IMEM.

TSEC_FALCON_IMEMD0

Bits	Description
0-31	TSEC_FALCON_IMEMD_DATA

Returns or takes the value for an IMEM read/write operation.

TSEC_FALCON_IMEMT0

Bits	Description
0-15	TSEC_FALCON_IMEMT_TAG

Returns or takes the virtual page index for an IMEM read/write operation.

TSEC_FALCON_DMEMC0

Bits	Description
2-7	TSEC_FALCON_DMEMC_OFFS
8-15	TSEC_FALCON_DMEMC_BLK
24	TSEC_FALCON_DMEMC_AINCW
25	TSEC_FALCON_DMEMC_AINCR

Used for configuring access to Falcon's DMEM.

TSEC_FALCON_DMEMD0

Bits	Description
0-31	TSEC_FALCON_DMEMD_DATA

Returns or takes the value for a DMEM read/write operation.

TSEC_FALCON_ICD_CMD

Bits	Description
0-3	TSEC_FALCON_ICD_CMD_OPC 0x00: STOP 0x01: RUN (run from PC) 0x02: JRUN (run from address) 0x03: RUNB (run from PC) 0x04: JRUNB (run from address) 0x05: STEP (step from PC) 0x06: JSTEP (step from address) 0x07: EMASK (set exception mask) 0x08: RREG (read register) 0x09: WREG (write register) 0x0A: RDM (read data memory) 0x0B: WDM (write data memory) 0x0C: RCM (read MMIO/configuration memory) 0x0D: WCM (write MMIO/configuration memory) 0x0E: RSTAT (read status) 0x0F: SBU
6-7	TSEC_FALCON_ICD_CMD_SZ 0x00: B (byte) 0x01: HW (half word) 0x02: W (word)
8-12	TSEC_FALCON_ICD_CMD_IDX 0x00: REG0 \| RSTAT0 \| WB0 0x01: REG1 \| RSTAT1 \| WB1 0x02: REG2 \| RSTAT2 \| WB2 0x03: REG3 \| RSTAT3 \| WB3 0x04: REG4 \| RSTAT4 0x05: REG5 \| RSTAT5 0x06: REG6 0x07: REG7 0x08: REG8 0x09: REG9 0x0A: REG10 0x0B: REG11 0x0C: REG12 0x0D: REG13 0x0E: REG14 0x0F: REG15 0x10: IV0 0x11: IV1 0x12: UNDEFINED 0x13: EV 0x14: SP 0x15: PC 0x16: IMB 0x17: DMB 0x18: CSW 0x19: CCR 0x1A: SEC 0x1B: CTX 0x1C: EXCI 0x1D: SEC1 0x1E: IMB1 0x1F: DMB1
14	TSEC_FALCON_ICD_CMD_ERROR
15	TSEC_FALCON_ICD_CMD_RDVLD
16-31	TSEC_FALCON_ICD_CMD_PARM 0x0001: EMASK_TRAP0 0x0002: EMASK_TRAP1 0x0004: EMASK_TRAP2 0x0008: EMASK_TRAP3 0x0010: EMASK_EXC_UNIMP 0x0020: EMASK_EXC_IMISS 0x0040: EMASK_EXC_IMHIT 0x0080: EMASK_EXC_IBREAK 0x0100: EMASK_IV0 0x0200: EMASK_IV1 0x0400: EMASK_IV2 0x0800: EMASK_EXT0 0x1000: EMASK_EXT1 0x2000: EMASK_EXT2 0x4000: EMASK_EXT3 0x8000: EMASK_EXT4

Used for sending commands to the Falcon's in-chip debugger.

TSEC_FALCON_ICD_ADDR

Bits	Description
0-31	TSEC_FALCON_ICD_ADDR_ADDR

Takes the target address for the Falcon's in-chip debugger.

TSEC_FALCON_ICD_WDATA

Bits	Description
0-31	TSEC_FALCON_ICD_WDATA_DATA

Takes the data for writing using the Falcon's in-chip debugger.

TSEC_FALCON_ICD_RDATA

Bits	Description
0-31	TSEC_FALCON_ICD_RDATA_DATA

Returns the data read using the Falcon's in-chip debugger.

When reading from an internal status register (STAT), the following applies:

Bits	Description
0	RSTAT0_MEM_STALL
1	RSTAT0_DMA_STALL
2	RSTAT0_FENCE_STALL
3	RSTAT0_DIV_STALL
4	RSTAT0_DMA_STALL_DMAQ
5	RSTAT0_DMA_STALL_DMWAITING
6	RSTAT0_DMA_STALL_IMWAITING
7	RSTAT0_ANY_STALL
8	RSTAT0_SBFULL_STALL
9	RSTAT0_SBHIT_STALL
10	RSTAT0_FLOW_STALL
11	RSTAT0_SP_STALL
12	RSTAT0_BL_STALL
13	RSTAT0_IPND_STALL
14	RSTAT0_LDSTQ_STALL
16	RSTAT0_NOINSTR_STALL
20	RSTAT0_HALTSTOP_FLUSH
21	RSTAT0_AFILL_FLUSH
22	RSTAT0_EXC_FLUSH
23-25	RSTAT0_IRQ_FLUSH
28	RSTAT0_VALIDRD
29	RSTAT0_WAITING
30	RSTAT0_HALTED
31	RSTAT0_MTHD_FULL

Bits	Description
0-3	RSTAT1_WB_ALLOC
4-7	RSTAT1_WB_VALID
8-9	RSTAT1_WB0_SZ
10-11	RSTAT1_WB1_SZ
12-13	RSTAT1_WB2_SZ
14-15	RSTAT1_WB3_SZ
16-19	RSTAT1_WB0_IDX
20-23	RSTAT1_WB1_IDX
24-27	RSTAT1_WB2_IDX
28-31	RSTAT1_WB3_IDX

Bits	Description
0-3	RSTAT2_DMAQ_NUM
4	RSTAT2_DMA_ENABLE
5-7	RSTAT2_LDSTQ_NUM
16-19	RSTAT2_EM_BUSY
20-23	RSTAT2_EM_ACKED
24-27	RSTAT2_EM_ISWR
28-31	RSTAT2_EM_DVLD

Bits	Description
0	RSTAT3_MTHD_IDLE
1	RSTAT3_CTXSW_IDLE
2	RSTAT3_DMA_IDLE
3	RSTAT3_SCP_IDLE
4	RSTAT3_LDST_IDLE
5	RSTAT3_SBWB_EMPTY
6-8	RSTAT3_CSWIE
10	RSTAT3_CSWE
12-14	RSTAT3_CTXSW_STATE 0x00: IDLE 0x01: SM_CHECK 0x02: SM_SAVE 0x03: SM_SAVE_WAIT 0x04: SM_BLK_BIND 0x05: SM_RESET 0x06: SM_RESETWAIT 0x07: SM_ACK
15	RSTAT3_CTXSW_PEND
17	RSTAT3_DMA_FBREQ_IDLE
18	RSTAT3_DMA_ACKQ_EMPTY
19	RSTAT3_DMA_RDQ_EMPTY
20	RSTAT3_DMA_WR_BUSY
21	RSTAT3_DMA_RD_BUSY
22	RSTAT3_LDST_XT_BUSY
23	RSTAT3_LDST_XT_BLOCK
24	RSTAT3_ENG_IDLE

Bits	Description
0-1	RSTAT4_ICD_STATE 0x00: NORMAL 0x01: WAIT_ISSUE_CLEAR 0x02: WAIT_EXLDQ_CLEAR 0x03: FULL_DBG_MODE
2-3	RSTAT4_ICD_MODE 0x00: SUPPRESSICD 0x01: ENTERICD_IBRK 0x02: ENTERICD_STEP
16	RSTAT4_ICD_EMASK_TRAP0
17	RSTAT4_ICD_EMASK_TRAP1
18	RSTAT4_ICD_EMASK_TRAP2
19	RSTAT4_ICD_EMASK_TRAP3
20	RSTAT4_ICD_EMASK_EXC_UNIMP
21	RSTAT4_ICD_EMASK_EXC_IMISS
22	RSTAT4_ICD_EMASK_EXC_IMHIT
23	RSTAT4_ICD_EMASK_EXC_IBREAK
24	RSTAT4_ICD_EMASK_IV0
25	RSTAT4_ICD_EMASK_IV1
26	RSTAT4_ICD_EMASK_IV2
27	RSTAT4_ICD_EMASK_EXT0
28	RSTAT4_ICD_EMASK_EXT1
29	RSTAT4_ICD_EMASK_EXT2
30	RSTAT4_ICD_EMASK_EXT3
31	RSTAT4_ICD_EMASK_EXT4

Bits	Description
0-7	RSTAT5_LRU_STATE

TSEC_FALCON_SCTL

Bits	Description
0-1	TSEC_FALCON_SCTL_SEC_MODE 0: Non-secure 1: Light Secure 2: Heavy Secure
4-5	Previous security mode 0: Non-secure 1: Light Secure 2: Heavy Secure
12-13	Unknown
14	Initialize the transition to LS mode

TSEC_FALCON_SSTAT

Bits	Description
31	Set on memory protection violation

TSEC_FALCON_SPROT_IMEM

Bits	Description
0-3	Read access level
4-7	Write access level

Controls accesses to Falcon IMEM.

TSEC_FALCON_SPROT_DMEM

Bits	Description
0-3	Read access level
4-7	Write access level

Controls accesses to Falcon DMEM.

TSEC_FALCON_SPROT_CPUCTL

Bits	Description
0-3	Read access level
4-7	Write access level

Controls accesses to the TSEC_FALCON_CPUCTL register.

TSEC_FALCON_SPROT_MISC

Bits	Description
0-3	Read access level
4-7	Write access level

Controls accesses to the following registers:

TSEC_FALCON_PRIVSTATE
TSEC_FALCON_SFTRESET
TSEC_FALCON_ADDR
TSEC_FALCON_DMACTL
TSEC_FALCON_IMCTL
TSEC_FALCON_IMSTAT
TSEC_FALCON_UNK_250
TSEC_FALCON_DMAINFO_CTL

TSEC_FALCON_SPROT_IRQ

Bits	Description
0-3	Read access level
4-7	Write access level

Controls accesses to the following registers:

TSEC_FALCON_IRQMODE
TSEC_FALCON_IRQMSET
TSEC_FALCON_IRQMCLR
TSEC_FALCON_IRQDEST
TSEC_FALCON_GPTMRINT
TSEC_FALCON_GPTMRVAL
TSEC_FALCON_GPTMRCTL
TSEC_FALCON_IRQDEST2
TSEC_FALCON_UNK_E0

TSEC_FALCON_SPROT_MTHD

Bits	Description
0-3	Read access level
4-7	Write access level

Controls accesses to the following registers:

TSEC_FALCON_ITFEN
TSEC_FALCON_CURCTX
TSEC_FALCON_NXTCTX
TSEC_FALCON_CTXACK
TSEC_FALCON_MTHDDATA
TSEC_FALCON_MTHDID
TSEC_FALCON_MTHDWDAT
TSEC_FALCON_MTHDCOUNT
TSEC_FALCON_MTHDPOP
TSEC_FALCON_MTHDRAMSZ
TSEC_FALCON_DEBUG1

TSEC_FALCON_SPROT_SCTL

Bits	Description
0-3	Read access level
4-7	Write access level

Controls accesses to the TSEC_FALCON_SCTL register.

TSEC_FALCON_SPROT_WDTMR

Bits	Description
0-3	Read access level
4-7	Write access level

Controls accesses to the following registers:

TSEC_FALCON_WDTMRVAL
TSEC_FALCON_WDTMRCTL

TSEC_SCP_CTL0

Bits	Description
10	Enable the LOAD interface
12	Enable the STORE interface
14	Enable the CMD interface
16	Enable the SEQ controller
20	Enable the TSEC_SCP_CMD register

TSEC_SCP_CTL1

Bits	Description
0	Flush the SEQ controller
8	Unknown
11	Enable RNG test mode
12	Enable the RNG controller
16	Enable LOAD interface dummy mode (all reads return 0)
20	Enable LOAD interface bypassing (all reads are dropped)
24	Enable STORE interface bypassing (all writes are dropped)

TSEC_SCP_CTL_STAT

Bits	Description
20	TSEC_SCP_CTL_STAT_DEBUG_MODE

TSEC_SCP_CTL_LOCK

Bits	Description
0	Enable lockdown mode
1	Unknown
2	Unknown
3	Unknown
4	Lock the SCP
5	Unknown
6	Unknown
7	Unknown

Controls lockdown mode and can only be cleared in Heavy Secure mode.

TSEC_SCP_CFG

Bits	Description
0	Unknown
1	Unknown
2	Unknown
3	Unknown
4	Unknown
8	Flush the CMD interface
12-13	Carry chain size 0: 32 bits 1: 64 bits 2: 96 bits 3: 128 bits
16-31	Timeout value

TSEC_SCP_CTL_SCP

Bits	Description
0	Swap SCP master
1	Current SCP master 0: Falcon 1: External

TSEC_SCP_CTL_PKEY

Bits	Description
0	TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
1	TSEC_SCP_CTL_PKEY_LOADED

TSEC_SCP_CTL_DBG

Bits	Description
0	Unknown
4	Unknown
8	Unknown
12	Unknown

TSEC_SCP_DBG0

Bits	Description
0-3	Index
4	Automatic increment
5-6	Target 0: None 1: STORE 2: LOAD 3: SEQ
8-12	SEQ size
13-16	Unknown
17	SEQ instruction is valid
18	SEQ controller is running in HS mode
19-22	LOAD size
23	LOAD instruction is valid
24	LOAD interface is running in HS mode
25-26	STORE size
30	STORE instruction is valid
31	STORE interface is running in HS mode

Used for debugging crypto controllers such as the SEQ (crypto sequence).

TSEC_SCP_DBG1

Bits	Description
0-3	SEQ instruction's first operand
4-9	SEQ instruction's second operand
10-14	SEQ instruction's opcode

Used for retrieving debug data. Contains information on the last crypto sequence created when debugging the SEQ controller.

TSEC_SCP_DBG2

Bits	Description
0-1	SEQ controller's state 0: Idle 1: Recording is active (cs0begin/cs1begin)
4-7	Number of SEQ instructions left
12-15	Active crypto key register

Used for retrieving additional debug data associated with the SEQ controller.

TSEC_SCP_CMD

Bits	Description
0-3	Destination register
8-13	Source register or immediate value
20-24	Command opcode 0x0: nop (fuc5 opcode 0x00) 0x1: cmov (fuc5 opcode 0x84) 0x2: cxsin (fuc5 opcode 0x88) or xdst (with cxset) 0x3: cxsout (fuc5 opcode 0x8C) or xdld (with cxset) 0x4: crnd (fuc5 opcode 0x90) 0x5: cs0begin (fuc5 opcode 0x94) 0x6: cs0exec (fuc5 opcode 0x98) 0x7: cs1begin (fuc5 opcode 0x9C) 0x8: cs1exec (fuc5 opcode 0xA0) 0x9: invalid (fuc5 opcode 0xA4) 0xA: cchmod (fuc5 opcode 0xA8) 0xB: cxor (fuc5 opcode 0xAC) 0xC: cadd (fuc5 opcode 0xB0) 0xD: cand (fuc5 opcode 0xB4) 0xE: crev (fuc5 opcode 0xB8) 0xF: cprecmac (fuc5 opcode 0xBC) 0x10: csecret (fuc5 opcode 0xC0) 0x11: ckeyreg (fuc5 opcode 0xC4) 0x12: ckexp (fuc5 opcode 0xC8) 0x13: ckrexp (fuc5 opcode 0xCC) 0x14: cenc (fuc5 opcode 0xD0) 0x15: cdec (fuc5 opcode 0xD4) 0x16: csigauth (fuc5 opcode 0xD8) 0x17: csigenc (fuc5 opcode 0xDC) 0x18: csigclr (fuc5 opcode 0xE0)
28	CMD instruction is valid
31	CMD interface is running in HS mode

Contains information on the last crypto command executed.

TSEC_SCP_STAT0

Bits	Description
0	SCP is active
2	CMD interface is active
4	STORE interface is active
6	SEQ controller is active
8	TSEC_SCP_CMD register is enabled
10	LOAD interface is active
14	AES controller is active
16	RNG controller is active

Contains the status of the crypto controllers and interfaces.

TSEC_SCP_STAT1

Bits	Description
0-1	Signature comparison result 0: None 1: Running 2: Failed 3: Succeeded
4	LOAD interface is running in HS mode
6	LOAD interface is ready
8	STORE interface is running in HS mode
10	STORE interface received a valid instruction
12	CMD interface is running in HS mode
14	CMD interface received a valid instruction

Contains the status of the last authentication attempt and other miscellaneous statuses.

TSEC_SCP_STAT2

Bits	Description
0-4	Current SEQ opcode
5-9	Current CMD opcode
10-14	Pending CMD opcode
15-16	AES operation 0: Encryption 1: Decryption 2: Key expansion 3: Key reverse expansion
24	Unknown
25	STORE operation is stalled
26	LOAD operation is stalled
27	RNG operation is stalled
28	Unknown
29	AES operation is stalled

Contains the status of crypto operations.

TSEC_SCP_RNG_STAT0

Bits	Description
0	Internal RND controller is ready
4-7	Unknown
8-11	Unknown
16	Unknown
20	Unknown

TSEC_SCP_RNG_STAT1

Bits	Description
0-15	Unknown
16-31	Unknown

TSEC_SCP_IRQSTAT

Bits	Description
0	RND ready
8	ACL error
12	SEC error
16	CMD error
20	Single step
24	RND operation
28	Timeout

Used for getting the status of crypto IRQs.

TSEC_SCP_IRQMASK

Bits	Description
0	RND ready
8	ACL error
12	SEC error
16	CMD error
20	Single step
24	RND operation
28	Timeout

Used for getting the value of the mask for crypto IRQs.

TSEC_SCP_ACL_ERR

Bits	Description
0	Writing to a crypto register without the correct ACL
4	Reading from a crypto register without the correct ACL
8	Invalid ACL change (cchmod)
31	ACL error occurred

Contains information on errors generated by the ACL error IRQ.

TSEC_SCP_SEC_ERR

Bits	Description
0	Unknown
1-2	Unknown
4	Unknown
5-6	Unknown
16	Unknown
17-18	Unknown
20	Unknown
21-22	Unknown
24	Unknown
25-26	Unknown
31	SEC error occurred

TSEC_SCP_CMD_ERR

Bits	Description
0	Invalid command
4	Empty crypto sequence
8	Crypto sequence is too long
12	Crypto sequence was not finished
16	Forbidden signature operation (csigenc, csigclr or csigauth in NS mode)
20	Invalid signature operation (csigauth in HS mode)
24	Forbidden ACL change (cchmod in NS mode)

Contains information on errors generated by the CMD error IRQ.

TSEC_SCP_RND_CTL0

Bits	Description
0-31	RND clock trigger lower limit

TSEC_SCP_RND_CTL1

Bits	Description
0-15	RND clock trigger upper limit
16-31	RND clock trigger mask

TSEC_TFBIF_CTL

Bits	Description
0	TSEC_TFBIF_CTL_CLR_BWCOUNT
1	TSEC_TFBIF_CTL_ENABLE
2	TSEC_TFBIF_CTL_CLR_IDLEWDERR
3	TSEC_TFBIF_CTL_RESET
4	TSEC_TFBIF_CTL_IDLE
5	TSEC_TFBIF_CTL_IDLEWDERR
6	TSEC_TFBIF_CTL_SRTOUT
7	TSEC_TFBIF_CTL_CLR_SRTOUT
8-11	TSEC_TFBIF_CTL_SRTOVAL
12	TSEC_TFBIF_CTL_VPR

TSEC_TFBIF_MCCIF_FIFOCTRL

Bits	Description
0	TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
1	TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
2	TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
3	TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
4	TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
5	TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
6	TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
7	TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
8	TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE

TSEC_TFBIF_MCCIF_FIFOCTRL1

Bits	Description
0-15	TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
16-31	TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT

TSEC_TFBIF_THROTTLE

Bits	Description
0-11	TSEC_TFBIF_THROTTLE_BUCKET_SIZE
16-27	TSEC_TFBIF_THROTTLE_LEAK_COUNT
30-31	TSEC_TFBIF_THROTTLE_LEAK_SIZE

TSEC_TFBIF_DBG_STAT0

Bits	Description
0	TSEC_TFBIF_DBG_STAT0_1K_TRANSFER
1	TSEC_TFBIF_DBG_STAT0_RREQ_ISSUED
2	TSEC_TFBIF_DBG_STAT0_WREQ_ISSUED
3	TSEC_TFBIF_DBG_STAT0_TAGQ_ISSUED
4	TSEC_TFBIF_DBG_STAT0_STALL_RDATQ
5	TSEC_TFBIF_DBG_STAT0_STALL_RACKQ
6	TSEC_TFBIF_DBG_STAT0_STALL_WREQQ
7	TSEC_TFBIF_DBG_STAT0_STALL_WDATQ
8	TSEC_TFBIF_DBG_STAT0_STALL_WACKQ
9	TSEC_TFBIF_DBG_STAT0_STALL_RREQ_PENDING
10	TSEC_TFBIF_DBG_STAT0_STALL_WREQ_PENDING
11	TSEC_TFBIF_DBG_STAT0_STALL_MREQ
12	TSEC_TFBIF_DBG_STAT0_ENGINE_IDLE
13	TSEC_TFBIF_DBG_STAT0_RMCCIF_IDLE
14	TSEC_TFBIF_DBG_STAT0_WMCCIF_IDLE
15	TSEC_TFBIF_DBG_STAT0_CSB_IDLE
16	TSEC_TFBIF_DBG_STAT0_RU_IDLE
17	TSEC_TFBIF_DBG_STAT0_WU_IDLE
19	TSEC_TFBIF_DBG_STAT0_UNWEIGHT_ACTMON_ACTIVE
20	TSEC_TFBIF_DBG_STAT0_UNWEIGHT_ACTMON_MCB

TSEC_TFBIF_SPROT_EMEM

Bits	Description
0-3	Read access level
4-7	Write access level

Controls accesses to external memory regions. Accessible in HS mode only.

TSEC_TFBIF_TRANSCFG

Bits	Description
0	TSEC_TFBIF_TRANSCFG_ATT0_SWID
4	TSEC_TFBIF_TRANSCFG_ATT1_SWID
8	TSEC_TFBIF_TRANSCFG_ATT2_SWID
12	TSEC_TFBIF_TRANSCFG_ATT3_SWID
16	TSEC_TFBIF_TRANSCFG_ATT4_SWID
20	TSEC_TFBIF_TRANSCFG_ATT5_SWID
24	TSEC_TFBIF_TRANSCFG_ATT6_SWID
28	TSEC_TFBIF_TRANSCFG_ATT7_SWID

Configures the software ID per CTXDMA port for memory transactions. Software ID 0 (HW_SWID) forces all transactions to go through the SMMU while software ID 1 (PHY_SWID) bypasses it. Accessible in HS mode only.

[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.

TSEC_TFBIF_REGIONCFG

Bits	Description
0-2	TSEC_TFBIF_REGIONCFG_T0_APERT_ID
3	TSEC_TFBIF_REGIONCFG_T0_VPR
4-6	TSEC_TFBIF_REGIONCFG_T1_APERT_ID
7	TSEC_TFBIF_REGIONCFG_T1_VPR
8-10	TSEC_TFBIF_REGIONCFG_T2_APERT_ID
11	TSEC_TFBIF_REGIONCFG_T2_VPR
12-14	TSEC_TFBIF_REGIONCFG_T3_APERT_ID
15	TSEC_TFBIF_REGIONCFG_T3_VPR
16-18	TSEC_TFBIF_REGIONCFG_T4_APERT_ID
19	TSEC_TFBIF_REGIONCFG_T4_VPR
20-22	TSEC_TFBIF_REGIONCFG_T5_APERT_ID
23	TSEC_TFBIF_REGIONCFG_T5_VPR
24-26	TSEC_TFBIF_REGIONCFG_T6_APERT_ID
27	TSEC_TFBIF_REGIONCFG_T6_VPR
28-30	TSEC_TFBIF_REGIONCFG_T7_APERT_ID
31	TSEC_TFBIF_REGIONCFG_T7_VPR

Configures the aperture ID and VPR mode per CTXDMA port for memory region accessing. Accessible in HS mode only.

[6.0.0+] The nvhost_tsec firmware sets this register to 0x20 or 0x140 before reading memory from the GPU UCODE carveout.

TSEC_TFBIF_ACTMON_ACTIVE_MASK

Bits	Description
0	TSEC_TFBIF_ACTMON_ACTIVE_MASK_STARVED_MC
1	TSEC_TFBIF_ACTMON_ACTIVE_MASK_STALLED_MC
2	TSEC_TFBIF_ACTMON_ACTIVE_MASK_DELAYED_MC
3	TSEC_TFBIF_ACTMON_ACTIVE_MASK_ACTIVE

Takes the memory access mask for the Activity Monitor. Disconnected on the TSEC, but available on NVDEC, NVENC and NVJPG.

TSEC_TFBIF_ACTMON_ACTIVE_BORPS

Bits	Description
0	TSEC_TFBIF_ACTMON_ACTIVE_BORPS_STARVED_MC_POLARITY
1	TSEC_TFBIF_ACTMON_ACTIVE_BORPS_STARVED_MC_OPERATION
2	TSEC_TFBIF_ACTMON_ACTIVE_BORPS_STALLED_MC_POLARITY
3	TSEC_TFBIF_ACTMON_ACTIVE_BORPS_STALLED_MC_OPERATION
4	TSEC_TFBIF_ACTMON_ACTIVE_BORPS_DELAYED_MC_POLARITY
5	TSEC_TFBIF_ACTMON_ACTIVE_BORPS_DELAYED_MC_OPERATION
6	TSEC_TFBIF_ACTMON_ACTIVE_BORPS_ACTIVE_POLARITY
7	TSEC_TFBIF_ACTMON_ACTIVE_BORPS_ACTIVE_OPERATION

Takes the billions of records per second count for the Activity Monitor. Disconnected on the TSEC, but available on NVDEC, NVENC and NVJPG.

TSEC_TFBIF_ACTMON_ACTIVE_WEIGHT

Bits	Description
0-31	TSEC_TFBIF_ACTMON_ACTIVE_WEIGHT_VAL

Controls the Activity Monitor. Disconnected on the TSEC, but available on NVDEC, NVENC and NVJPG.

TSEC_CG

Bits	Description
0-5	TSEC_CG_IDLE_CG_DLY_CNT
6	TSEC_CG_IDLE_CG_EN
16-18	TSEC_CG_WAKEUP_DLY_CNT
19	TSEC_CG_WAKEUP_DLY_EN

TSEC_BAR0_CTL

Bits	Description
0	TSEC_BAR0_CTL_READ
1	TSEC_BAR0_CTL_WRITE
4-7	TSEC_BAR0_CTL_BYTE_MASK
12-13	TSEC_BAR0_CTL_STATUS 0: Idle 1: Busy 2: Error 3: Disabled
31	TSEC_BAR0_CTL_INIT

A BAR0 DMA read/write operation requires bits TSEC_BAR0_CTL_INIT and TSEC_BAR0_CTL_READ/TSEC_BAR0_CTL_WRITE to be set in TSEC_BAR0_CTL.

During the transfer, TSEC_BAR0_CTL_STATUS is set to "Busy".

Accessing an invalid address sets TSEC_BAR0_CTL_STATUS to "Error".

TSEC_BAR0_ADDR

Bits	Description
0-31	TSEC_BAR0_ADDR_VAL

Takes the address for DMA transfers between TSEC and HOST1X (master and clients).

TSEC_BAR0_DATA

Bits	Description
0-31	TSEC_BAR0_DATA_VAL

Takes the data for DMA transfers between TSEC and HOST1X (master and clients).

TSEC_BAR0_TIMEOUT

Bits	Description
0-31	TSEC_BAR0_TIMEOUT_VAL

Takes the timeout value for DMA transfers between TSEC and HOST1X (master and clients).

TSEC_TEGRA_CTL

Bits	Description
16	TSEC_TEGRA_CTL_TKFI_KFUSE
17	TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
24	TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
25	TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
26	TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
27	TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C

Falcon

"Falcon" (FAst Logic CONtroller) is a proprietary general purpose CPU which can be found inside various hardware blocks that require some sort of logic processing such as TSEC (TSECA and TSECB), NVDEC, NVENC, NVJPG, VIC, GPU PMU and XUSB.

Processor Registers

A total of 32 processor registers are available in the Falcon CPU.

REG0-REG15

These are 16 32-bit GPRs (general purpose registers).

IV0

This is a SPR (special purpose register) that holds the address for interrupt vector 0.

IV1

This is a SPR (special purpose register) that holds the address for interrupt vector 1.

IV2

This is a SPR (special purpose register) that holds the address for interrupt vector 2. This register is considered "UNDEFINED" and appears to be unused.

EV

This is a SPR (special purpose register) that holds the address for the exception vector.

Alternative name (envytools): "tv".

SP

This is a SPR (special purpose register) that holds the current stack pointer.

PC

This is a SPR (special purpose register) that holds the current program counter.

IMB

This is a SPR (special purpose register) that holds the external base address for IMEM transfers.

Alternative name (envytools): "xcbase".

DMB

This is a SPR (special purpose register) that holds the external base address for DMEM transfers.

Alternative name (envytools): "xdbase".

CSW

This is a SPR (special purpose register) that holds various flag bits.

Bits	Description
0-7	General purpose predicates
8	ALU carry flag
9	ALU signed overflow flag
10	ALU sign flag
11	ALU zero flag
12-15	Unused
16	Interrupt 0 enable
17	Interrupt 1 enable
18	Interrupt 2 enable (undefined)
19	Unused
20	Interrupt 0 saved enable
21	Interrupt 1 saved enable
22	Interrupt 2 saved enable (undefined)
23	Unused
24	Exception active
25	Unused
26	Unknown
27-28	Unused
29	Unknown
30-31	Unused

Alternative name (envytools): "flags".

CCR

This is a SPR (special purpose register) that holds configuration bits for the SCP DMA override functionality. The value of this register is set using the "cxset" instruction which provides a way to change the behavior of a variable amount of successively executed DMA-related instructions ("xdwait", "xdst" and "xdld").

Bits	Description
0-4	Number of instructions the override is valid for (0x1F means infinite)
5	Crypto destination/source select 0: Crypto register 1: Crypto stream
6	External memory override 0: Disabled 1: Enabled
7	Internal memory select 0: DMEM 1: IMEM
8-31	Unused

Alternative name (envytools): "cx".

SEC

This is a SPR (special purpose register) that holds configuration bits for the SCP authentication process.

Bits	Description
0-7	Start of region to authenticate (in 0x100 pages)
8-15	Unused
16	Mark all subsequent code transfers as secret
17	Region is encrypted
18	Unknown (set in HS mode)
19	Block traps and interrupts (set in HS mode)
20-23	Unused
24-31	Size of region to authenticate (in 0x100 pages)

Alternative name (envytools): "cauth".

CTX

This is a SPR (special purpose register) that holds configuration bits for the CTXDMA ports.

Bits	Description
0-2	CTXDMA port for code loads (xcld)
3	Unused
4-6	CTXDMA port for code stores (invalid)
7	Unused
8-10	CTXDMA port for data loads (xdld)
11	Unused
12-14	CTXDMA port for data stores (xdst)
15-31	Unused

Alternative name (envytools): "xtargets".

EXCI

This is a SPR (special purpose register) that holds information on raised exceptions.

Bits	Description
0-19	Exception PC
20-23	Exception cause
24-31	Unused

Alternative name (envytools): "tstatus".

SEC1

Unknown. Marked as "RESERVED".

IMB1

Unknown. Marked as "RESERVED".

DMB1

Unknown. Marked as "RESERVED".

SCP

Part of the information here (which hasn't made it into envytools documentation yet) was shared by mwk from reverse engineering falcon processors over the years.

Heavy Secure Mode

Entry

From non-secure mode, upon jumping to a page marked as secret, a secret fault occurs. This causes the CPU to verify the region specified in $cauth against the MAC loaded in $c6. If the comparison is successful, the valid bit (bit0) is set on all pages in the $cauth region, and $pc is set to the base of the $cauth region. If the comparsion fails, the CPU is halted.

Exit

The CPU automatically goes back to non-secure mode when returning back into non-secret pages. When this happens, the valid bit (bit0) in the TLB flags is cleared for all secret pages.

Implementation

Under certain circumstances, it is possible to observe sigauth being briefly written to TSEC_SCP_CMD as "csigauth $c4 $c6" while the opcodes in TSEC_SCP_STAT2 are set to "cxsin" and "csigauth", respectively.

Via TSEC_SCP_DBG0 it can be observed that a 3-sized macro sequence is loaded into cs0 during a secure mode transition.

Operations

Opcode	Name	Operand0	Operand1	Operation	Condition
0	nop	N/A	N/A
1	mov	$cX	$cY	`$cX = $cY; ACL(X) = ACL(Y);`
2	sin	$cX	N/A	`$cX = read_stream(); ACL(X) = ???;`
3	sout	$cX	N/A	`write_stream($cX);`	?
4	rnd	$cX	N/A	`$cX = read_rnd(); ACL(X) = ???;`
5	s0begin	immX	N/A	`record_macro_for_N_instructions(0, immX);`
6	s0exec	immX	N/A	`execute_macro_N_times(0, immX);`
7	s1begin	immX	N/A	`record_macro_for_N_instructions(1, immX);`
8	s1exec	immX	N/A	`execute_macro_N_times(1, immX);`
9	<invalid>
0xA	chmod	$cX	immY	Complicated, see ACL.
0xB	xor	$cX	$cY	`$cX ^= $cY;`	`(ACL(X) & 2) && (ACL(Y) & 2)`
0xC	add	$cX	immY	`$cX += immY;`	`(ACL(X) & 2)`
0xD	and	$cX	$cY	`$cX &= $cY;`	`(ACL(X) & 2) && (ACL(Y) & 2)`
0xE	rev	$cX	$cY	`$cX = endian_swap128($cY); ACL(X) = ACL(Y);`
0xF	gfmul	$cX	$cY	`$cX = gfmul($cY); ACL(X) = ACL(Y);`	`(ACL(Y) & 2)`
0x10	secret	$cX	immY	`$cX = load_secret(immY); ACL(X) = load_secret_acl(immY);`
0x11	keyreg	immX	N/A	`active_key_idx = immX;`
0x12	kexp	$cX	$cY	`$cX = aes_kexp($cY); ACL(X) = ACL(Y);`
0x13	krexp	$cX	$cY	`$cX = aes_kexp_reverse($cY); ACL(X) = ACL(Y);`
0x14	enc	$cX	$cY	`$cX = aes_enc(active_key_idx, $cY); ACL(X) = ACL(active_key_idx) & ACL(Y);`
0x15	dec	$cX	$cY	`$cX = aes_dec(active_key_idx, $cY); ACL(X) = ACL(active_key_idx) & ACL(Y);`
0x16	sigauth	$cX	$cY	`if (hash_verify($cX, $cY)) { has_sig = true; current_sig = $cX; }`	?
0x17	sigclr	N/A	N/A	`has_sig = false;`
0x18	sigenc	$cX	$cY	`if (has_sig) { $cX = aes_enc($cY, current_sig); ACL(X) = 0x13; }`

sigauth

00000000: f5 3c XY d8 csigauth $cY $cX

Takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret. This instruction does not work in secure mode.

sigclr

00000000: f5 3c 00 e0 csigclr

This instruction takes no operands and clears the saved cauth signature used by the csigenc instruction.

chmod

00000000: f5 3c XY a8 cchmod $cY 0X or 00000000: f5 3c XY a9 cchmod $cY 1X

This instruction takes a crypto register and a 5 bit immediate value which represents the ACL mask to set.

rnd

00000000: f5 3c 0X 90 crnd $cX

This instruction initializes a crypto register with random data.

Executing this instruction only succeeds if the RNG controller is enabled for the SCP, which requires taking the following steps:

Write 0x7FFF to TSEC_SCP_RND_CTL0.
Write 0x3FF0000 to TSEC_SCP_RND_CTL1.
Write 0xFF00 to TSEC_SCP_RND_CTL11.
Write 0x1000 to TSEC_SCP_CTL1.

Otherwise it hangs forever.

ACL

Bit	Meaning
0	Secure key. Forced set if bit1 is set. Once cleared, cannot be set again.
1	Secure readable. Once cleared, cannot be set again.
2	Insecure key. Forced set if bit3 is set. Forced clear if bit0 is clear. Can be toggled back and forth.
3	Insecure readable. Forced clear if bit1 is clear. Can be toggled back and forth.
4	Insecure overwritable. Can be toggled back and forth.

Initial values

On SCP boot, the ACL is 0x1F for all $cX.

Loading into $cX using xdst instruction sets ACL($cX) to 0x13 and 0x1F, for secure and insecure mode respectively.

Spilling a $cX to DMEM using xdld instruction is allowed if (ACL($cX) & 2) or (ACL($cX) & 8), for secure and insecure mode respectively.

Loading a secret into $cX sets a per-secret ACL, unconditionally.

Secrets

Falcon's Heavy Secure Mode has access to 64 128-bit keys which are burned at factory. These keys can be loaded using the $csecret instruction which takes the target crypto register and the key index as arguments.

Secrets are specific to each Falcon unit with the exception of secret 0x3F. This secret is effectively empty (all zeros), but is configured to be overwritten with the KFUSE private key once the KFUSE clock is enabled. The KFUSE private key is console-unique.

Index	ACL	Notes
0x00	0x13	Used by Keygen, nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares.
0x01	0x10	Used by nvhost_nvdec_bl020_prod firmware.
0x02	0x10
0x03	0x11	Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
0x04	0x10	Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
0x05	0x13	Used by nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares.
0x06	0x11	Used by the SCP as key to encrypt/decrypt data during authentication (decided by bit 17 from the SEC/cauth register).
0x07	0x11	Used by [6.0.0+] nvhost_tsec firmware.
0x08	0x10
0x09	0x13	Used by nvhost_tsec firmware.
0x0A	0x11
0x0B	0x10	Used by nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.
0x0C	0x13
0x0D	0x11
0x0E	0x10
0x0F	0x13	Used by nvhost_tsec firmware.
0x10	0x11	Used by [1.0.0-5.1.0] nvhost_tsec firmware.
0x11	0x10
0x12	0x13
0x13	0x11
0x14	0x10
0x15	0x13	Used by nvhost_nvdec_bl020_prod, [5.0.0+] nvhost_nvdec020_prod, [5.0.0+] nvhost_nvdec020_ns and [6.0.0+] nvhost_tsec firmwares.
0x16	0x11
0x17	0x10
0x18	0x13
0x19	0x11
0x1A	0x10
0x1B	0x13
0x1C	0x11
0x1D	0x10
0x1E	0x13
0x1F	0x11
0x20	0x10
0x21	0x13
0x22	0x11
0x23	0x10
0x24	0x13
0x25	0x11
0x26	0x10	Used by KeygenLdr and SecureBoot
0x27	0x13
0x28	0x11
0x29	0x10
0x2A	0x13
0x2B	0x11
0x2C	0x10
0x2D	0x13
0x2E	0x11
0x2F	0x10
0x30	0x13
0x31	0x11
0x32	0x10
0x33	0x13
0x34	0x11
0x35	0x10
0x36	0x13
0x37	0x11
0x38	0x10
0x39	0x13
0x3A	0x11
0x3B	0x10
0x3C	0x13	Used by nvhost_tsec firmware.
0x3D	0x11
0x3E	0x10
0x3F	0x10	Used by Keygen, nvhost_tsec, nvhost_nvdec020_prod and nvhost_nvdec020_ns firmwares.

@@ Line 5: / Line 5: @@
 == Registers ==
-Registers from 0x54500000 to 0x54501000 are used to configure the host interface (HOST1X).
+The TSEC's MMIO space is divided as follows:
+* 0x54500000 to 0x54501000: THI (Tegra Host Interface)
-Registers from 0x54501000 to 0x54502000 are a MMIO window for communicating with the Falcon microprocessor. From this range, the subset of registers from 0x54501400 to 0x54501FE8 are specific to the TSEC and are subdivided into:
+* 0x54501000 to 0x54501400: [[#Falcon|FALCON (Falcon microcontroller)]]
-* 0x54501400 to 0x54501500: SCP (Secure Co-Processor).
+* 0x54501400 to 0x54501600: [[#SCP|SCP (Secure Co-processor)]]
-* 0x54501500 to 0x54501600: TRNG (True Random Number Generator).
+* 0x54501600 to 0x54501680: TFBIF (Tegra Framebuffer Interface)
-* 0x54501600 to 0x54501700: TFBIF (Tegra Framebuffer Interface) and CG (Clock Gate).
+* 0x54501680 to 0x54501700: CG (Clock Gate)
-* 0x54501700 to 0x54501800: DMA.
+* 0x54501700 to 0x54501800: BAR0 (HOST1X device DMA)
-* 0x54501800 to 0x54501900: TEGRA (miscellaneous interfaces).
+* 0x54501800 to 0x54501900: TEGRA (Miscellaneous interfaces)
 {| class="wikitable" border="1"
@@ Line 21: / Line 21: @@
 | TSEC_THI_INCR_SYNCPT
 | 0x54500000
+| 0x04
+|-
+| TSEC_THI_INCR_SYNCPT_CTRL
+| 0x54500004
 | 0x04
 |-
@@ Line 33: / Line 37: @@
 | TSEC_THI_CTXSW
 | 0x54500020
+| 0x04
+|-
+| TSEC_THI_CTXSW_NEXT
+| 0x54500024
 | 0x04
 |-
 | TSEC_THI_CONT_SYNCPT_EOF
 | 0x54500028
+| 0x04
+|-
+| TSEC_THI_CONT_SYNCPT_L1
+| 0x5450002C
+| 0x04
+|-
+| TSEC_THI_STREAMID0
+| 0x54500030
+| 0x04
+|-
+| TSEC_THI_STREAMID1
+| 0x54500034
+| 0x04
+|-
+| TSEC_THI_THI_SEC
+| 0x54500038
 | 0x04
 |-
@@ Line 45: / Line 69: @@
 | [[#TSEC_THI_METHOD1|TSEC_THI_METHOD1]]
 | 0x54500044
+| 0x04
+|-
+| TSEC_THI_CONTEXT_SWITCH
+| 0x54500060
 | 0x04
 |-
@@ Line 55: / Line 83: @@
 | 0x04
 |-
-| TSEC_THI_INT_CLEAR
+| TSEC_THI_CONFIG0
 | 0x54500080
 | 0x04
 |-
-| TSEC_THI_INT_ENABLE
+| TSEC_THI_DBG_MISC
 | 0x54500084
 | 0x04
@@ Line 75: / Line 103: @@
 | 0x04
 |-
-| [[#FALCON_IRQSSET|FALCON_IRQSSET]]
+| [[#TSEC_FALCON_IRQSSET|TSEC_FALCON_IRQSSET]]
 | 0x54501000
 | 0x04
 |-
-| [[#FALCON_IRQSCLR|FALCON_IRQSCLR]]
+| [[#TSEC_FALCON_IRQSCLR|TSEC_FALCON_IRQSCLR]]
 | 0x54501004
 | 0x04
 |-
-| [[#FALCON_IRQSTAT|FALCON_IRQSTAT]]
+| [[#TSEC_FALCON_IRQSTAT|TSEC_FALCON_IRQSTAT]]
 | 0x54501008
 | 0x04
 |-
-| [[#FALCON_IRQMODE|FALCON_IRQMODE]]
+| [[#TSEC_FALCON_IRQMODE|TSEC_FALCON_IRQMODE]]
 | 0x5450100C
 | 0x04
 |-
-| [[#FALCON_IRQMSET|FALCON_IRQMSET]]
+| [[#TSEC_FALCON_IRQMSET|TSEC_FALCON_IRQMSET]]
 | 0x54501010
 | 0x04
 |-
-| [[#FALCON_IRQMCLR|FALCON_IRQMCLR]]
+| [[#TSEC_FALCON_IRQMCLR|TSEC_FALCON_IRQMCLR]]
 | 0x54501014
 | 0x04
 |-
-| [[#FALCON_IRQMASK|FALCON_IRQMASK]]
+| [[#TSEC_FALCON_IRQMASK|TSEC_FALCON_IRQMASK]]
 | 0x54501018
 | 0x04
 |-
-| [[#FALCON_IRQDEST|FALCON_IRQDEST]]
+| [[#TSEC_FALCON_IRQDEST|TSEC_FALCON_IRQDEST]]
 | 0x5450101C
 | 0x04
 |-
-| FALCON_GPTMRINT
+| TSEC_FALCON_GPTMRINT
 | 0x54501020
 | 0x04
 |-
-| FALCON_GPTMRVAL
+| TSEC_FALCON_GPTMRVAL
 | 0x54501024
 | 0x04
 |-
-| FALCON_GPTMRCTL
+| TSEC_FALCON_GPTMRCTL
 | 0x54501028
 | 0x04
 |-
-| FALCON_PTIMER0
+| TSEC_FALCON_PTIMER0
 | 0x5450102C
 | 0x04
 |-
-| FALCON_PTIMER1
+| TSEC_FALCON_PTIMER1
 | 0x54501030
 | 0x04
 |-
-| FALCON_WDTMRVAL
+| TSEC_FALCON_WDTMRVAL
 | 0x54501034
 | 0x04
 |-
-| FALCON_WDTMRCTL
+| TSEC_FALCON_WDTMRCTL
 | 0x54501038
 | 0x04
 |-
-| FALCON_UNK_3C
+| [[#TSEC_FALCON_IRQDEST2|TSEC_FALCON_IRQDEST2]]
 | 0x5450103C
 | 0x04
 |-
-| [[#FALCON_MAILBOX0|FALCON_MAILBOX0]]
+| [[#TSEC_FALCON_MAILBOX0|TSEC_FALCON_MAILBOX0]]
 | 0x54501040
 | 0x04
 |-
-| [[#FALCON_MAILBOX1|FALCON_MAILBOX1]]
+| [[#TSEC_FALCON_MAILBOX1|TSEC_FALCON_MAILBOX1]]
 | 0x54501044
 | 0x04
 |-
-| [[#FALCON_ITFEN|FALCON_ITFEN]]
+| [[#TSEC_FALCON_ITFEN|TSEC_FALCON_ITFEN]]
 | 0x54501048
 | 0x04
 |-
-| [[#FALCON_IDLESTATE|FALCON_IDLESTATE]]
+| [[#TSEC_FALCON_IDLESTATE|TSEC_FALCON_IDLESTATE]]
 | 0x5450104C
 | 0x04
 |-
-| FALCON_CURCTX
+| TSEC_FALCON_CURCTX
 | 0x54501050
 | 0x04
 |-
-| FALCON_NXTCTX
+| TSEC_FALCON_NXTCTX
 | 0x54501054
 | 0x04
 |-
-| FALCON_CTXACK
+| TSEC_FALCON_CTXACK
 | 0x54501058
 | 0x04
 |-
-| FALCON_FHSTATE
+| TSEC_FALCON_FHSTATE
 | 0x5450105C
 | 0x04
 |-
-| FALCON_PRIVSTATE
+| TSEC_FALCON_PRIVSTATE
 | 0x54501060
 | 0x04
 |-
-| FALCON_MTHDDATA
+| TSEC_FALCON_MTHDDATA
 | 0x54501064
 | 0x04
 |-
-| FALCON_MTHDID
+| TSEC_FALCON_MTHDID
 | 0x54501068
 | 0x04
 |-
-| FALCON_MTHDWDAT
+| TSEC_FALCON_MTHDWDAT
 | 0x5450106C
 | 0x04
 |-
-| FALCON_MTHDCOUNT
+| TSEC_FALCON_MTHDCOUNT
 | 0x54501070
 | 0x04
 |-
-| FALCON_MTHDPOP
+| TSEC_FALCON_MTHDPOP
 | 0x54501074
 | 0x04
 |-
-| FALCON_MTHDRAMSZ
+| TSEC_FALCON_MTHDRAMSZ
 | 0x54501078
 | 0x04
 |-
-| FALCON_SFTRESET
+| TSEC_FALCON_SFTRESET
 | 0x5450107C
 | 0x04
 |-
-| FALCON_OS
+| TSEC_FALCON_OS
 | 0x54501080
 | 0x04
 |-
-| FALCON_RM
+| TSEC_FALCON_RM
 | 0x54501084
 | 0x04
 |-
-| FALCON_SOFT_PM
+| TSEC_FALCON_SOFT_PM
 | 0x54501088
 | 0x04
 |-
-| FALCON_SOFT_MODE
+| TSEC_FALCON_SOFT_MODE
 | 0x5450108C
 | 0x04
 |-
-| [[#FALCON_DEBUG1|FALCON_DEBUG1]]
+| [[#TSEC_FALCON_DEBUG1|TSEC_FALCON_DEBUG1]]
 | 0x54501090
 | 0x04
 |-
-| [[#FALCON_DEBUGINFO|FALCON_DEBUGINFO]]
+| [[#TSEC_FALCON_DEBUGINFO|TSEC_FALCON_DEBUGINFO]]
 | 0x54501094
 | 0x04
 |-
-| FALCON_IBRKPT1
+| TSEC_FALCON_IBRKPT1
 | 0x54501098
 | 0x04
 |-
-| FALCON_IBRKPT2
+| TSEC_FALCON_IBRKPT2
 | 0x5450109C
 | 0x04
 |-
-| FALCON_CGCTL
+| TSEC_FALCON_CGCTL
 | 0x545010A0
 | 0x04
 |-
-| FALCON_ENGCTL
+| TSEC_FALCON_ENGCTL
 | 0x545010A4
 | 0x04
 |-
-| FALCON_PMM
+| TSEC_FALCON_PMM
 | 0x545010A8
 | 0x04
 |-
-| FALCON_ADDR
+| TSEC_FALCON_ADDR
 | 0x545010AC
 | 0x04
 |-
-| FALCON_IBRKPT3
+| TSEC_FALCON_IBRKPT3
 | 0x545010B0
 | 0x04
 |-
-| FALCON_IBRKPT4
+| TSEC_FALCON_IBRKPT4
 | 0x545010B4
 | 0x04
 |-
-| FALCON_IBRKPT5
+| TSEC_FALCON_IBRKPT5
 | 0x545010B8
 | 0x04
 |-
-| [[#FALCON_EXCI|FALCON_EXCI]]
+| [[#TSEC_FALCON_EXCI|TSEC_FALCON_EXCI]]
 | 0x545010D0
 | 0x04
 |-
-| FALCON_UNK_D4
+| [[#TSEC_FALCON_SVEC_SPR|TSEC_FALCON_SVEC_SPR]]
 | 0x545010D4
 | 0x04
 |-
-| FALCON_UNK_D8
+| [[#TSEC_FALCON_RSTAT0|TSEC_FALCON_RSTAT0]]
 | 0x545010D8
 | 0x04
 |-
-| FALCON_UNK_DC
+| [[#TSEC_FALCON_RSTAT3|TSEC_FALCON_RSTAT3]]
 | 0x545010DC
 | 0x04
 |-
-| FALCON_UNK_E0
+| TSEC_FALCON_UNK_E0
 | 0x545010E0
 | 0x04
 |-
-| [[#FALCON_CPUCTL|FALCON_CPUCTL]]
+| [[#TSEC_FALCON_CPUCTL|TSEC_FALCON_CPUCTL]]
 | 0x54501100
 | 0x04
 |-
-| [[#FALCON_BOOTVEC|FALCON_BOOTVEC]]
+| [[#TSEC_FALCON_BOOTVEC|TSEC_FALCON_BOOTVEC]]
 | 0x54501104
 | 0x04
 |-
-| [[#FALCON_HWCFG|FALCON_HWCFG]]
+| [[#TSEC_FALCON_HWCFG|TSEC_FALCON_HWCFG]]
 | 0x54501108
 | 0x04
 |-
-| [[#FALCON_DMACTL|FALCON_DMACTL]]
+| [[#TSEC_FALCON_DMACTL|TSEC_FALCON_DMACTL]]
 | 0x5450110C
 | 0x04
 |-
-| [[#FALCON_DMATRFBASE|FALCON_DMATRFBASE]]
+| [[#TSEC_FALCON_DMATRFBASE|TSEC_FALCON_DMATRFBASE]]
 | 0x54501110
 | 0x04
 |-
-| [[#FALCON_DMATRFMOFFS|FALCON_DMATRFMOFFS]]
+| [[#TSEC_FALCON_DMATRFMOFFS|TSEC_FALCON_DMATRFMOFFS]]
 | 0x54501114
 | 0x04
 |-
-| [[#FALCON_DMATRFCMD|FALCON_DMATRFCMD]]
+| [[#TSEC_FALCON_DMATRFCMD|TSEC_FALCON_DMATRFCMD]]
 | 0x54501118
 | 0x04
 |-
-| [[#FALCON_DMATRFFBOFFS|FALCON_DMATRFFBOFFS]]
+| [[#TSEC_FALCON_DMATRFFBOFFS|TSEC_FALCON_DMATRFFBOFFS]]
 | 0x5450111C
 | 0x04
 |-
-| [[#FALCON_DMAPOLL_FB|FALCON_DMAPOLL_FB]]
+| [[#TSEC_FALCON_DMAPOLL_FB|TSEC_FALCON_DMAPOLL_FB]]
 | 0x54501120
 | 0x04
 |-
-| [[#FALCON_DMAPOLL_CP|FALCON_DMAPOLL_CP]]
+| [[#TSEC_FALCON_DMAPOLL_CP|TSEC_FALCON_DMAPOLL_CP]]
 | 0x54501124
 | 0x04
 |-
-| FALCON_CPUSTAT
+| TSEC_FALCON_DBG_STATE
 | 0x54501128
 | 0x04
 |-
-| [[#FALCON_HWCFG1|FALCON_HWCFG1]]
+| [[#TSEC_FALCON_HWCFG1|TSEC_FALCON_HWCFG1]]
 | 0x5450112C
 | 0x04
 |-
-| FALCON_CPUCTL_ALIAS
+| TSEC_FALCON_CPUCTL_ALIAS
 | 0x54501130
 | 0x04
 |-
-| [[#FALCON_IMCTL|FALCON_IMCTL]]
+| TSEC_FALCON_STACKCFG
+| 0x54501138
+| 0x04
+|-
+| [[#TSEC_FALCON_IMCTL|TSEC_FALCON_IMCTL]]
 | 0x54501140
 | 0x04
 |-
-| [[#FALCON_IMSTAT|FALCON_IMSTAT]]
+| [[#TSEC_FALCON_IMSTAT|TSEC_FALCON_IMSTAT]]
 | 0x54501144
 | 0x04
 |-
-| [[#FALCON_TRACEIDX|FALCON_TRACEIDX]]
+| [[#TSEC_FALCON_TRACEIDX|TSEC_FALCON_TRACEIDX]]
 | 0x54501148
 | 0x04
 |-
-| [[#FALCON_TRACEPC|FALCON_TRACEPC]]
+| [[#TSEC_FALCON_TRACEPC|TSEC_FALCON_TRACEPC]]
 | 0x5450114C
 | 0x04
 |-
-| FALCON_IMFILLRNG0
+| TSEC_FALCON_IMFILLRNG0
 | 0x54501150
 | 0x04
 |-
-| FALCON_IMFILLRNG1
+| TSEC_FALCON_IMFILLRNG1
 | 0x54501154
 | 0x04
 |-
-| FALCON_IMFILLCTL
+| TSEC_FALCON_IMFILLCTL
 | 0x54501158
 | 0x04
 |-
-| FALCON_IMCTL_DEBUG
+| TSEC_FALCON_IMCTL_DEBUG
 | 0x5450115C
 | 0x04
 |-
-| FALCON_EXTERRWIN
+| TSEC_FALCON_CMEMBASE
 | 0x54501160
 | 0x04
 |-
-| FALCON_EXTERRCFG
+| TSEC_FALCON_DMEMAPERT
 | 0x54501164
 | 0x04
 |-
-| FALCON_EXTERRADDR
+| TSEC_FALCON_EXTERRADDR
 | 0x54501168
 | 0x04
 |-
-| FALCON_EXTERRSTAT
+| TSEC_FALCON_EXTERRSTAT
 | 0x5450116C
 | 0x04
 |-
-| FALCON_CG1_SLCG
+| TSEC_FALCON_CG2
 | 0x5450117C
 | 0x04
 |-
-| [[#FALCON_IMEMC|FALCON_IMEMC]]
+| [[#TSEC_FALCON_IMEMC0|TSEC_FALCON_IMEMC0]]
 | 0x54501180
 | 0x04
 |-
-| [[#FALCON_IMEMD|FALCON_IMEMD]]
+| [[#TSEC_FALCON_IMEMD0|TSEC_FALCON_IMEMD0]]
 | 0x54501184
 | 0x04
 |-
-| [[#FALCON_IMEMT|FALCON_IMEMT]]
+| [[#TSEC_FALCON_IMEMT0|TSEC_FALCON_IMEMT0]]
 | 0x54501188
 | 0x04
 |-
-| [[#FALCON_DMEMC0|FALCON_DMEMC0]]
+| TSEC_FALCON_IMEMC1
+| 0x54501190
+| 0x04
+|-
+| TSEC_FALCON_IMEMD1
+| 0x54501194
+| 0x04
+|-
+| TSEC_FALCON_IMEMT1
+| 0x54501198
+| 0x04
+|-
+| TSEC_FALCON_IMEMC2
+| 0x545011A0
+| 0x04
+|-
+| TSEC_FALCON_IMEMD2
+| 0x545011A4
+| 0x04
+|-
+| TSEC_FALCON_IMEMT2
+| 0x545011A8
+| 0x04
+|-
+| TSEC_FALCON_IMEMC3
+| 0x545011B0
+| 0x04
+|-
+| TSEC_FALCON_IMEMD3
+| 0x545011B4
+| 0x04
+|-
+| TSEC_FALCON_IMEMT3
+| 0x545011B8
+| 0x04
+|-
+| [[#TSEC_FALCON_DMEMC0|TSEC_FALCON_DMEMC0]]
 | 0x545011C0
 | 0x04
 |-
-| [[#FALCON_DMEMD0|FALCON_DMEMD0]]
+| [[#TSEC_FALCON_DMEMD0|TSEC_FALCON_DMEMD0]]
 | 0x545011C4
 | 0x04
 |-
-| FALCON_DMEMC1
+| TSEC_FALCON_DMEMC1
 | 0x545011C8
 | 0x04
 |-
-| FALCON_DMEMD1
+| TSEC_FALCON_DMEMD1
 | 0x545011CC
 | 0x04
 |-
-| FALCON_DMEMC2
+| TSEC_FALCON_DMEMC2
 | 0x545011D0
 | 0x04
 |-
-| FALCON_DMEMD2
+| TSEC_FALCON_DMEMD2
 | 0x545011D4
 | 0x04
 |-
-| FALCON_DMEMC3
+| TSEC_FALCON_DMEMC3
 | 0x545011D8
 | 0x04
 |-
-| FALCON_DMEMD3
+| TSEC_FALCON_DMEMD3
 | 0x545011DC
 | 0x04
 |-
-| FALCON_DMEMC4
+| TSEC_FALCON_DMEMC4
 | 0x545011E0
 | 0x04
 |-
-| FALCON_DMEMD4
+| TSEC_FALCON_DMEMD4
 | 0x545011E4
 | 0x04
 |-
-| FALCON_DMEMC5
+| TSEC_FALCON_DMEMC5
 | 0x545011E8
 | 0x04
 |-
-| FALCON_DMEMD5
+| TSEC_FALCON_DMEMD5
 | 0x545011EC
 | 0x04
 |-
-| FALCON_DMEMC6
+| TSEC_FALCON_DMEMC6
 | 0x545011F0
 | 0x04
 |-
-| FALCON_DMEMD6
+| TSEC_FALCON_DMEMD6
 | 0x545011F4
 | 0x04
 |-
-| FALCON_DMEMC7
+| TSEC_FALCON_DMEMC7
 | 0x545011F8
 | 0x04
 |-
-| FALCON_DMEMD7
+| TSEC_FALCON_DMEMD7
 | 0x545011FC
 | 0x04
 |-
-| [[#FALCON_ICD_CMD|FALCON_ICD_CMD]]
+| [[#TSEC_FALCON_ICD_CMD|TSEC_FALCON_ICD_CMD]]
 | 0x54501200
 | 0x04
 |-
-| [[#FALCON_ICD_ADDR|FALCON_ICD_ADDR]]
+| [[#TSEC_FALCON_ICD_ADDR|TSEC_FALCON_ICD_ADDR]]
 | 0x54501204
 | 0x04
 |-
-| [[#FALCON_ICD_WDATA|FALCON_ICD_WDATA]]
+| [[#TSEC_FALCON_ICD_WDATA|TSEC_FALCON_ICD_WDATA]]
 | 0x54501208
 | 0x04
 |-
-| [[#FALCON_ICD_RDATA|FALCON_ICD_RDATA]]
+| [[#TSEC_FALCON_ICD_RDATA|TSEC_FALCON_ICD_RDATA]]
 | 0x5450120C
 | 0x04
 |-
-| [[#FALCON_SCTL|FALCON_SCTL]]
+| [[#TSEC_FALCON_SCTL|TSEC_FALCON_SCTL]]
 | 0x54501240
 | 0x04
 |-
-| [[#FALCON_SCTL_STAT|FALCON_SCTL_STAT]]
+| [[#TSEC_FALCON_SSTAT|TSEC_FALCON_SSTAT]]
 | 0x54501244
 | 0x04
 |-
-| FALCON_UNK_248
+| TSEC_FALCON_UNK_250
-| 0x54501248
-| 0x04
-|-
-| FALCON_UNK_24C
-| 0x5450124C
-| 0x04
-|-
-| FALCON_UNK_250
 | 0x54501250
 | 0x04
 |-
-| FALCON_UNK_260
+| TSEC_FALCON_UNK_260
 | 0x54501260
 | 0x04
 |-
-| [[#FALCON_SPROT_IMEM|FALCON_SPROT_IMEM]]
+| [[#TSEC_FALCON_SPROT_IMEM|TSEC_FALCON_SPROT_IMEM]]
 | 0x54501280
 | 0x04
 |-
-| [[#FALCON_SPROT_DMEM|FALCON_SPROT_DMEM]]
+| [[#TSEC_FALCON_SPROT_DMEM|TSEC_FALCON_SPROT_DMEM]]
 | 0x54501284
 | 0x04
 |-
-| [[#FALCON_SPROT_CPUCTL|FALCON_SPROT_CPUCTL]]
+| [[#TSEC_FALCON_SPROT_CPUCTL|TSEC_FALCON_SPROT_CPUCTL]]
 | 0x54501288
 | 0x04
 |-
-| [[#FALCON_SPROT_MISC|FALCON_SPROT_MISC]]
+| [[#TSEC_FALCON_SPROT_MISC|TSEC_FALCON_SPROT_MISC]]
 | 0x5450128C
 | 0x04
 |-
-| [[#FALCON_SPROT_IRQ|FALCON_SPROT_IRQ]]
+| [[#TSEC_FALCON_SPROT_IRQ|TSEC_FALCON_SPROT_IRQ]]
 | 0x54501290
 | 0x04
 |-
-| [[#FALCON_SPROT_MTHD|FALCON_SPROT_MTHD]]
+| [[#TSEC_FALCON_SPROT_MTHD|TSEC_FALCON_SPROT_MTHD]]
 | 0x54501294
 | 0x04
 |-
-| [[#FALCON_SPROT_SCTL|FALCON_SPROT_SCTL]]
+| [[#TSEC_FALCON_SPROT_SCTL|TSEC_FALCON_SPROT_SCTL]]
 | 0x54501298
 | 0x04
 |-
-| [[#FALCON_SPROT_WDTMR|FALCON_SPROT_WDTMR]]
+| [[#TSEC_FALCON_SPROT_WDTMR|TSEC_FALCON_SPROT_WDTMR]]
 | 0x5450129C
 | 0x04
 |-
-| FALCON_UNK_2C0
+| TSEC_FALCON_DMAINFO_FINISHED_FBRD_LOW
 | 0x545012C0
 | 0x04
 |-
-| FALCON_UNK_2C4
+| TSEC_FALCON_DMAINFO_FINISHED_FBRD_HIGH
 | 0x545012C4
 | 0x04
 |-
-| FALCON_UNK_2C8
+| TSEC_FALCON_DMAINFO_FINISHED_FBWR_LOW
 | 0x545012C8
 | 0x04
 |-
-| FALCON_UNK_2CC
+| TSEC_FALCON_DMAINFO_FINISHED_FBWR_HIGH
 | 0x545012CC
 | 0x04
 |-
-| FALCON_UNK_2E0
+| TSEC_FALCON_DMAINFO_CURRENT_FBRD_LOW
+| 0x545012D0
+| 0x04
+|-
+| TSEC_FALCON_DMAINFO_CURRENT_FBRD_HIGH
+| 0x545012D4
+| 0x04
+|-
+| TSEC_FALCON_DMAINFO_CURRENT_FBWR_LOW
+| 0x545012D8
+| 0x04
+|-
+| TSEC_FALCON_DMAINFO_CURRENT_FBWR_HIGH
+| 0x545012DC
+| 0x04
+|-
+| TSEC_FALCON_DMAINFO_CTL
 | 0x545012E0
 | 0x04
@@ Line 571: / Line 647: @@
 | 0x04
 |-
-| TSEC_SCP_UNK_10
+| [[#TSEC_SCP_CFG|TSEC_SCP_CFG]]
 | 0x54501410
 | 0x04
 |-
-| TSEC_SCP_UNK_14
+| [[#TSEC_SCP_CTL_SCP|TSEC_SCP_CTL_SCP]]
 | 0x54501414
 | 0x04
@@ Line 583: / Line 659: @@
 | 0x04
 |-
-| TSEC_SCP_UNK_1C
+| [[#TSEC_SCP_CTL_DBG|TSEC_SCP_CTL_DBG]]
 | 0x5450141C
 | 0x04
 |-
-| [[#TSEC_SCP_SEQ_CTL|TSEC_SCP_SEQ_CTL]]
+| [[#TSEC_SCP_DBG0|TSEC_SCP_DBG0]]
 | 0x54501420
 | 0x04
 |-
-| [[#TSEC_SCP_SEQ_VAL|TSEC_SCP_SEQ_VAL]]
+| [[#TSEC_SCP_DBG1|TSEC_SCP_DBG1]]
 | 0x54501424
 | 0x04
 |-
-| [[#TSEC_SCP_SEQ_STAT|TSEC_SCP_SEQ_STAT]]
+| [[#TSEC_SCP_DBG2|TSEC_SCP_DBG2]]
 | 0x54501428
 | 0x04
 |-
-| [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]]
+| [[#TSEC_SCP_CMD|TSEC_SCP_CMD]]
 | 0x54501430
 | 0x04
 |-
-| TSEC_SCP_UNK_50
+| [[#TSEC_SCP_STAT0|TSEC_SCP_STAT0]]
 | 0x54501450
 | 0x04
 |-
-| [[#TSEC_SCP_AUTH_STAT|TSEC_SCP_AUTH_STAT]]
+| [[#TSEC_SCP_STAT1|TSEC_SCP_STAT1]]
 | 0x54501454
 | 0x04
 |-
-| [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]]
+| [[#TSEC_SCP_STAT2|TSEC_SCP_STAT2]]
 | 0x54501458
 | 0x04
 |-
-| TSEC_SCP_UNK_70
+| [[#TSEC_SCP_RNG_STAT0|TSEC_SCP_RNG_STAT0]]
 | 0x54501470
+| 0x04
+|-
+| [[#TSEC_SCP_RNG_STAT1|TSEC_SCP_RNG_STAT1]]
+| 0x54501474
 | 0x04
 |-
@@ Line 631: / Line 711: @@
 | 0x04
 |-
-| TSEC_SCP_UNK_94
+| [[#TSEC_SCP_SEC_ERR|TSEC_SCP_SEC_ERR]]
 | 0x54501494
 | 0x04
 |-
-| [[#TSEC_SCP_INSN_ERR|TSEC_SCP_INSN_ERR]]
+| [[#TSEC_SCP_CMD_ERR|TSEC_SCP_CMD_ERR]]
 | 0x54501498
 | 0x04
 |-
-| TSEC_TRNG_CLK_LIMIT_LOW
+| [[#TSEC_SCP_RND_CTL0|TSEC_SCP_RND_CTL0]]
 | 0x54501500
 | 0x04
 |-
-| TSEC_TRNG_CLK_LIMIT_HIGH
+| [[#TSEC_SCP_RND_CTL1|TSEC_RND_SCP_CTL1]]
 | 0x54501504
 | 0x04
 |-
-| TSEC_TRNG_UNK_08
+| TSEC_SCP_RND_CTL2
 | 0x54501508
 | 0x04
 |-
-| TSEC_TRNG_TEST_CTL
+| TSEC_SCP_RND_CTL3
 | 0x5450150C
 | 0x04
 |-
-| TSEC_TRNG_TEST_CFG0
+| TSEC_SCP_RND_CTL4
 | 0x54501510
 | 0x04
 |-
-| TSEC_TRNG_TEST_SEED0
+| TSEC_SCP_RND_CTL5
 | 0x54501514
 | 0x04
 |-
-| TSEC_TRNG_TEST_CFG1
+| TSEC_SCP_RND_CTL6
 | 0x54501518
 | 0x04
 |-
-| TSEC_TRNG_TEST_SEED1
+| TSEC_SCP_RND_CTL7
 | 0x5450151C
 | 0x04
 |-
-| TSEC_TRNG_UNK_20
+| TSEC_SCP_RND_CTL8
 | 0x54501520
 | 0x04
 |-
-| TSEC_TRNG_UNK_24
+| TSEC_SCP_RND_CTL9
 | 0x54501524
 | 0x04
 |-
-| TSEC_TRNG_UNK_28
+| TSEC_SCP_RND_CTL10
 | 0x54501528
 | 0x04
 |-
-| TSEC_TRNG_CTL
+| TSEC_SCP_RND_CTL11
 | 0x5450152C
 | 0x04
 |-
-| TSEC_TFBIF_CTL
+| [[#TSEC_TFBIF_CTL|TSEC_TFBIF_CTL]]
 | 0x54501600
 | 0x04
@@ Line 695: / Line 775: @@
 | 0x04
 |-
-| TSEC_TFBIF_THROTTLE
+| [[#TSEC_TFBIF_THROTTLE|TSEC_TFBIF_THROTTLE]]
 | 0x54501608
 | 0x04
 |-
-| TSEC_TFBIF_UNK_0C
+| [[#TSEC_TFBIF_DBG_STAT0|TSEC_TFBIF_DBG_STAT0]]
 | 0x5450160C
 | 0x04
 |-
-| TSEC_TFBIF_DEBUG_STAT
+| TSEC_TFBIF_DBG_STAT1
+| 0x54501610
+| 0x04
+|-
+| TSEC_TFBIF_DBG_RDCOUNT_LO
+| 0x54501614
+| 0x04
+|-
+| TSEC_TFBIF_DBG_RDCOUNT_HI
+| 0x54501618
+| 0x04
+|-
+| TSEC_TFBIF_DBG_WRCOUNT_LO
+| 0x5450161C
+| 0x04
+|-
+| TSEC_TFBIF_DBG_WRCOUNT_HI
+| 0x54501620
+| 0x04
+|-
+| TSEC_TFBIF_DBG_R32COUNT
+| 0x54501624
+| 0x04
+|-
+| TSEC_TFBIF_DBG_R64COUNT
+| 0x54501628
+| 0x04
+|-
+| TSEC_TFBIF_DBG_R128COUNT
+| 0x5450162C
+| 0x04
+|-
+| TSEC_TFBIF_UNK_30
 | 0x54501630
 | 0x04
@@ Line 711: / Line 823: @@
 | 0x04
 |-
-| [[#TSEC_TFBIF_MMU_PROT|TSEC_TFBIF_MMU_PROT]]
+| TSEC_TFBIF_WRR_RDP
+| 0x54501638
+| 0x04
+|-
+| [[#TSEC_TFBIF_SPROT_EMEM|TSEC_TFBIF_SPROT_EMEM]]
 | 0x54501640
 | 0x04
 |-
-| [[#TSEC_TFBIF_MMU_PHYS_SEC|TSEC_TFBIF_MMU_PHYS_SEC]]
+| [[#TSEC_TFBIF_TRANSCFG|TSEC_TFBIF_TRANSCFG]]
 | 0x54501644
 | 0x04
 |-
-| [[#TSEC_TFBIF_MMU_TRANSCFG|TSEC_TFBIF_MMU_TRANSCFG]]
+| [[#TSEC_TFBIF_REGIONCFG|TSEC_TFBIF_REGIONCFG]]
 | 0x54501648
 | 0x04
 |-
-| [[#TSEC_TFBIF_ACTMON_MAMASK|TSEC_TFBIF_ACTMON_MAMASK]]
+| [[#TSEC_TFBIF_ACTMON_ACTIVE_MASK|TSEC_TFBIF_ACTMON_ACTIVE_MASK]]
 | 0x5450164C
 | 0x04
 |-
-| [[#TSEC_TFBIF_ACTMON_BORPS|TSEC_TFBIF_ACTMON_BORPS]]
+| [[#TSEC_TFBIF_ACTMON_ACTIVE_BORPS|TSEC_TFBIF_ACTMON_ACTIVE_BORPS]]
 | 0x54501650
 | 0x04
 |-
-| [[#TSEC_TFBIF_ACTMON_CTL|TSEC_TFBIF_ACTMON_CTL]]
+| [[#TSEC_TFBIF_ACTMON_ACTIVE_WEIGHT|TSEC_TFBIF_ACTMON_ACTIVE_WEIGHT]]
 | 0x54501654
 | 0x04
 |-
-| [[#TSEC_CG|TSEC_CG]]
+| TSEC_TFBIF_ACTMON_MCB_MASK
-| 0x545016D0
+| 0x54501660
 | 0x04
 |-
-| [[#TSEC_DMA_CMD|TSEC_DMA_CMD]]
+| TSEC_TFBIF_ACTMON_MCB_BORPS
-| 0x54501700
+| 0x54501664
 | 0x04
 |-
-| [[#TSEC_DMA_ADDR|TSEC_DMA_ADDR]]
+| TSEC_TFBIF_ACTMON_MCB_WEIGHT
+| 0x54501668
+| 0x04
+|-
+| TSEC_TFBIF_THI_TRANSPROP
+| 0x54501670
+| 0x04
+|-
+| [[#TSEC_CG|TSEC_CG]]
+| 0x545016D0
+| 0x04
+|-
+| [[#TSEC_BAR0_CTL|TSEC_BAR0_CTL]]
+| 0x54501700
+| 0x04
+|-
+| [[#TSEC_BAR0_ADDR|TSEC_BAR0_ADDR]]
 | 0x54501704
 | 0x04
 |-
-| [[#TSEC_DMA_DATA|TSEC_DMA_DATA]]
+| [[#TSEC_BAR0_DATA|TSEC_BAR0_DATA]]
 | 0x54501708
 | 0x04
 |-
-| [[#TSEC_DMA_TIMEOUT|TSEC_DMA_TIMEOUT]]
+| [[#TSEC_BAR0_TIMEOUT|TSEC_BAR0_TIMEOUT]]
 | 0x5450170C
 | 0x04
@@ Line 817: / Line 949: @@
 === TSEC_THI_METHOD0 ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0-11
+| TSEC_THI_METHOD0_OFFSET
+|}
+Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.
+The following methods are available:
 {| class="wikitable" border="1"
 !  ID
 !  Method
+|-
+| 0x100
+| NOP
+|-
+| 0x140
+| PM_TRIGGER
 |-
 | 0x200
 | SET_APPLICATION_ID
+|-
+| 0x204
+| SET_WATCHDOG_TIMER
+|-
+| 0x240
+| SEMAPHORE_A
+|-
+| 0x244
+| SEMAPHORE_B
+|-
+| 0x248
+| SEMAPHORE_C
+|-
+| 0x24C
+|
+|-
+| 0x250
+|
 |-
 | 0x300
 | EXECUTE
+|-
+| 0x304
+| SEMAPHORE_D
 |-
 | 0x500
@@ Line 915: / Line 1,085: @@
 |-
 | 0x574
-|
+| HDCP_DECRYPT_STORED_KM
 |-
 | 0x578
@@ Line 973: / Line 1,143: @@
 | 0x740
 | [6.0.0+] HDCP_GET_CURRENT_NONCE
+|-
+| 0x1114
+| PM_TRIGGER_END
 |}
-Used to encode and send a method's ID over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.
 === TSEC_THI_METHOD1 ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0-31
+| TSEC_THI_METHOD1_DATA
+|}
 Used to encode and send a method's data over HOST1X to TSEC. This register mirrors the functionality of HOST1X's channel opcode submission.
@@ Line 998: / Line 1,177: @@
 |}
-=== FALCON_IRQSSET ===
+=== TSEC_FALCON_IRQSSET ===
 {| class="wikitable" border="1"
 !  Bits
@@ Line 1,004: / Line 1,183: @@
 |-
 | 0
-| FALCON_IRQSSET_GPTMR
+| TSEC_FALCON_IRQSSET_GPTMR
 |-
 | 1
-| FALCON_IRQSSET_WDTMR
+| TSEC_FALCON_IRQSSET_WDTMR
 |-
 | 2
-| FALCON_IRQSSET_MTHD
+| TSEC_FALCON_IRQSSET_MTHD
 |-
 | 3
-| FALCON_IRQSSET_CTXSW
+| TSEC_FALCON_IRQSSET_CTXSW
 |-
 | 4
-| FALCON_IRQSSET_HALT
+| TSEC_FALCON_IRQSSET_HALT
 |-
 | 5
-| FALCON_IRQSSET_EXTERR
+| TSEC_FALCON_IRQSSET_EXTERR
 |-
 | 6
-| FALCON_IRQSSET_SWGEN0
+| TSEC_FALCON_IRQSSET_SWGEN0
 |-
 | 7
-| FALCON_IRQSSET_SWGEN1
+| TSEC_FALCON_IRQSSET_SWGEN1
 |-
 | 8-15
-| FALCON_IRQSSET_EXT
+| TSEC_FALCON_IRQSSET_EXT
+|-
+| 16
+| TSEC_FALCON_IRQSSET_DMA
 |}
 Used for setting Falcon's IRQs.
-=== FALCON_IRQSCLR ===
+=== TSEC_FALCON_IRQSCLR ===
 {| class="wikitable" border="1"
 !  Bits
@@ Line 1,039: / Line 1,221: @@
 |-
 | 0
-| FALCON_IRQSCLR_GPTMR
+| TSEC_FALCON_IRQSCLR_GPTMR
 |-
 | 1
-| FALCON_IRQSCLR_WDTMR
+| TSEC_FALCON_IRQSCLR_WDTMR
 |-
 | 2
-| FALCON_IRQSCLR_MTHD
+| TSEC_FALCON_IRQSCLR_MTHD
 |-
 | 3
-| FALCON_IRQSCLR_CTXSW
+| TSEC_FALCON_IRQSCLR_CTXSW
 |-
 | 4
-| FALCON_IRQSCLR_HALT
+| TSEC_FALCON_IRQSCLR_HALT
 |-
 | 5
-| FALCON_IRQSCLR_EXTERR
+| TSEC_FALCON_IRQSCLR_EXTERR
 |-
 | 6
-| FALCON_IRQSCLR_SWGEN0
+| TSEC_FALCON_IRQSCLR_SWGEN0
 |-
 | 7
-| FALCON_IRQSCLR_SWGEN1
+| TSEC_FALCON_IRQSCLR_SWGEN1
 |-
 | 8-15
-| FALCON_IRQSCLR_EXT
+| TSEC_FALCON_IRQSCLR_EXT
+|-
+| 16
+| TSEC_FALCON_IRQSCLR_DMA
 |}
 Used for clearing Falcon's IRQs.
-=== FALCON_IRQSTAT ===
+=== TSEC_FALCON_IRQSTAT ===
 {| class="wikitable" border="1"
 !  Bits
@@ Line 1,074: / Line 1,259: @@
 |-
 | 0
-| FALCON_IRQSTAT_GPTMR
+| TSEC_FALCON_IRQSTAT_GPTMR
 |-
 | 1
-| FALCON_IRQSTAT_WDTMR
+| TSEC_FALCON_IRQSTAT_WDTMR
 |-
 | 2
-| FALCON_IRQSTAT_MTHD
+| TSEC_FALCON_IRQSTAT_MTHD
 |-
 | 3
-| FALCON_IRQSTAT_CTXSW
+| TSEC_FALCON_IRQSTAT_CTXSW
 |-
 | 4
-| FALCON_IRQSTAT_HALT
+| TSEC_FALCON_IRQSTAT_HALT
 |-
 | 5
-| FALCON_IRQSTAT_EXTERR
+| TSEC_FALCON_IRQSTAT_EXTERR
 |-
 | 6
-| FALCON_IRQSTAT_SWGEN0
+| TSEC_FALCON_IRQSTAT_SWGEN0
 |-
 | 7
-| FALCON_IRQSTAT_SWGEN1
+| TSEC_FALCON_IRQSTAT_SWGEN1
 |-
 | 8-15
-| FALCON_IRQSTAT_EXT
+| TSEC_FALCON_IRQSTAT_EXT
+|-
+| 16
+| TSEC_FALCON_IRQSTAT_DMA
 |}
 Used for getting the status of Falcon's IRQs.
-=== FALCON_IRQMODE ===
+=== TSEC_FALCON_IRQMODE ===
 {| class="wikitable" border="1"
 !  Bits
@@ Line 1,109: / Line 1,297: @@
 |-
 | 0
-| FALCON_IRQMODE_GPTMR
+| TSEC_FALCON_IRQMODE_LVL_GPTMR
 |-
 | 1
-| FALCON_IRQMODE_WDTMR
+| TSEC_FALCON_IRQMODE_LVL_WDTMR
 |-
 | 2
-| FALCON_IRQMODE_MTHD
+| TSEC_FALCON_IRQMODE_LVL_MTHD
 |-
 | 3
-| FALCON_IRQMODE_CTXSW
+| TSEC_FALCON_IRQMODE_LVL_CTXSW
 |-
 | 4
-| FALCON_IRQMODE_HALT
+| TSEC_FALCON_IRQMODE_LVL_HALT
 |-
 | 5
-| FALCON_IRQMODE_EXTERR
+| TSEC_FALCON_IRQMODE_LVL_EXTERR
 |-
 | 6
-| FALCON_IRQMODE_SWGEN0
+| TSEC_FALCON_IRQMODE_LVL_SWGEN0
 |-
 | 7
-| FALCON_IRQMODE_SWGEN1
+| TSEC_FALCON_IRQMODE_LVL_SWGEN1
 |-
 | 8-15
-| FALCON_IRQMODE_EXT
+| TSEC_FALCON_IRQMODE_LVL_EXT
+|-
+| 16
+| TSEC_FALCON_IRQMODE_LVL_DMA
 |}
 Used for changing the mode Falcon's IRQs. A value of 1 means level triggered while a value of 0 means edge triggered.
-=== FALCON_IRQMSET ===
+=== TSEC_FALCON_IRQMSET ===
 {| class="wikitable" border="1"
 !  Bits
@@ Line 1,144: / Line 1,335: @@
 |-
 | 0
-| FALCON_IRQMSET_GPTMR
+| TSEC_FALCON_IRQMSET_GPTMR
 |-
 | 1
-| FALCON_IRQMSET_WDTMR
+| TSEC_FALCON_IRQMSET_WDTMR
 |-
 | 2
-| FALCON_IRQMSET_MTHD
+| TSEC_FALCON_IRQMSET_MTHD
 |-
 | 3
-| FALCON_IRQMSET_CTXSW
+| TSEC_FALCON_IRQMSET_CTXSW
 |-
 | 4
-| FALCON_IRQMSET_HALT
+| TSEC_FALCON_IRQMSET_HALT
 |-
 | 5
-| FALCON_IRQMSET_EXTERR
+| TSEC_FALCON_IRQMSET_EXTERR
 |-
 | 6
-| FALCON_IRQMSET_SWGEN0
+| TSEC_FALCON_IRQMSET_SWGEN0
 |-
 | 7
-| FALCON_IRQMSET_SWGEN1
+| TSEC_FALCON_IRQMSET_SWGEN1
 |-
 | 8-15
-| FALCON_IRQMSET_EXT
+| TSEC_FALCON_IRQMSET_EXT
+|-
+| 16
+| TSEC_FALCON_IRQMSET_DMA
 |}
 Used for setting the mask for Falcon's IRQs.
-=== FALCON_IRQMCLR ===
+=== TSEC_FALCON_IRQMCLR ===
 {| class="wikitable" border="1"
 !  Bits
@@ Line 1,179: / Line 1,373: @@
 |-
 | 0
-| FALCON_IRQMCLR_GPTMR
+| TSEC_FALCON_IRQMCLR_GPTMR
 |-
 | 1
-| FALCON_IRQMCLR_WDTMR
+| TSEC_FALCON_IRQMCLR_WDTMR
 |-
 | 2
-| FALCON_IRQMCLR_MTHD
+| TSEC_FALCON_IRQMCLR_MTHD
 |-
 | 3
-| FALCON_IRQMCLR_CTXSW
+| TSEC_FALCON_IRQMCLR_CTXSW
 |-
 | 4
-| FALCON_IRQMCLR_HALT
+| TSEC_FALCON_IRQMCLR_HALT
 |-
 | 5
-| FALCON_IRQMCLR_EXTERR
+| TSEC_FALCON_IRQMCLR_EXTERR
 |-
 | 6
-| FALCON_IRQMCLR_SWGEN0
+| TSEC_FALCON_IRQMCLR_SWGEN0
 |-
 | 7
-| FALCON_IRQMCLR_SWGEN1
+| TSEC_FALCON_IRQMCLR_SWGEN1
 |-
 | 8-15
-| FALCON_IRQMCLR_EXT
+| TSEC_FALCON_IRQMCLR_EXT
+|-
+| 16
+| TSEC_FALCON_IRQMCLR_DMA
 |}
 Used for clearing the mask for Falcon's IRQs.
-=== FALCON_IRQMASK ===
+=== TSEC_FALCON_IRQMASK ===
 {| class="wikitable" border="1"
 !  Bits
@@ Line 1,214: / Line 1,411: @@
 |-
 | 0
-| FALCON_IRQMASK_GPTMR
+| TSEC_FALCON_IRQMASK_GPTMR
 |-
 | 1
-| FALCON_IRQMASK_WDTMR
+| TSEC_FALCON_IRQMASK_WDTMR
 |-
 | 2
-| FALCON_IRQMASK_MTHD
+| TSEC_FALCON_IRQMASK_MTHD
 |-
 | 3
-| FALCON_IRQMASK_CTXSW
+| TSEC_FALCON_IRQMASK_CTXSW
 |-
 | 4
-| FALCON_IRQMASK_HALT
+| TSEC_FALCON_IRQMASK_HALT
 |-
 | 5
-| FALCON_IRQMASK_EXTERR
+| TSEC_FALCON_IRQMASK_EXTERR
 |-
 | 6
-| FALCON_IRQMASK_SWGEN0
+| TSEC_FALCON_IRQMASK_SWGEN0
 |-
 | 7
-| FALCON_IRQMASK_SWGEN1
+| TSEC_FALCON_IRQMASK_SWGEN1
 |-
 | 8-15
-| FALCON_IRQMASK_EXT
+| TSEC_FALCON_IRQMASK_EXT
+|-
+| 16
+| TSEC_FALCON_IRQMASK_DMA
 |}
 Used for getting the value of the mask for Falcon's IRQs.
-=== FALCON_IRQDEST ===
+=== TSEC_FALCON_IRQDEST ===
 {| class="wikitable" border="1"
 !  Bits
@@ Line 1,249: / Line 1,449: @@
 |-
 | 0
-| FALCON_IRQDEST_HOST_GPTMR
+| TSEC_FALCON_IRQDEST_HOST_GPTMR
 |-
 | 1
-| FALCON_IRQDEST_HOST_WDTMR
+| TSEC_FALCON_IRQDEST_HOST_WDTMR
 |-
 | 2
-| FALCON_IRQDEST_HOST_MTHD
+| TSEC_FALCON_IRQDEST_HOST_MTHD
 |-
 | 3
-| FALCON_IRQDEST_HOST_CTXSW
+| TSEC_FALCON_IRQDEST_HOST_CTXSW
 |-
 | 4
-| FALCON_IRQDEST_HOST_HALT
+| TSEC_FALCON_IRQDEST_HOST_HALT
 |-
 | 5
-| FALCON_IRQDEST_HOST_EXTERR
+| TSEC_FALCON_IRQDEST_HOST_EXTERR
 |-
 | 6
-| FALCON_IRQDEST_HOST_SWGEN0
+| TSEC_FALCON_IRQDEST_HOST_SWGEN0
 |-
 | 7
-| FALCON_IRQDEST_HOST_SWGEN1
+| TSEC_FALCON_IRQDEST_HOST_SWGEN1
 |-
 | 8-15
-| FALCON_IRQDEST_HOST_EXT
+| TSEC_FALCON_IRQDEST_HOST_EXT
 |-
 | 16
-| FALCON_IRQDEST_TARGET_GPTMR
+| TSEC_FALCON_IRQDEST_TARGET_GPTMR
 |-
 | 17
-| FALCON_IRQDEST_TARGET_WDTMR
+| TSEC_FALCON_IRQDEST_TARGET_WDTMR
 |-
 | 18
-| FALCON_IRQDEST_TARGET_MTHD
+| TSEC_FALCON_IRQDEST_TARGET_MTHD
 |-
 | 19
-| FALCON_IRQDEST_TARGET_CTXSW
+| TSEC_FALCON_IRQDEST_TARGET_CTXSW
 |-
 | 20
-| FALCON_IRQDEST_TARGET_HALT
+| TSEC_FALCON_IRQDEST_TARGET_HALT
 |-
 | 21
-| FALCON_IRQDEST_TARGET_EXTERR
+| TSEC_FALCON_IRQDEST_TARGET_EXTERR
 |-
 | 22
-| FALCON_IRQDEST_TARGET_SWGEN0
+| TSEC_FALCON_IRQDEST_TARGET_SWGEN0
 |-
 | 23
-| FALCON_IRQDEST_TARGET_SWGEN1
+| TSEC_FALCON_IRQDEST_TARGET_SWGEN1
 |-
 | 24-31
-| FALCON_IRQDEST_TARGET_EXT
+| TSEC_FALCON_IRQDEST_TARGET_EXT
 |}
 Used for routing Falcon's IRQs.
-=== FALCON_MAILBOX0 ===
+=== TSEC_FALCON_IRQDEST2 ===
-Scratch register for reading/writing data to Falcon.
-=== FALCON_MAILBOX1 ===
-Scratch register for reading/writing data to Falcon.
-=== FALCON_ITFEN ===
 {| class="wikitable" border="1"
 !  Bits
@@ Line 1,317: / Line 1,511: @@
 |-
 | 0
-| FALCON_ITFEN_CTXEN
+| TSEC_FALCON_IRQDEST2_HOST_DMA
 |-
-| 1
+| 16
-| FALCON_ITFEN_MTHDEN
+| TSEC_FALCON_IRQDEST2_TARGET_DMA
 |}
-Used for enabling/disabling Falcon interfaces.
+Used for routing Falcon's IRQs.
-=== FALCON_IDLESTATE ===
+=== TSEC_FALCON_MAILBOX0 ===
 {| class="wikitable" border="1"
 !  Bits
 !  Description
 |-
-| 0
+| 0-31
-| FALCON_IDLESTATE_FALCON_BUSY
+| TSEC_FALCON_MAILBOX0_DATA
-|-
-| 1-15
-| FALCON_IDLESTATE_EXT_BUSY
 |}
-Used for detecting if Falcon is busy or not.
+Scratch register for reading/writing data to Falcon.
-=== FALCON_DEBUG1 ===
+=== TSEC_FALCON_MAILBOX1 ===
 {| class="wikitable" border="1"
 !  Bits
 !  Description
 |-
-| 0-15
+| 0-31
-| FALCON_DEBUG1_MTHD_DRAIN_TIME
+| TSEC_FALCON_MAILBOX1_DATA
-|-
-| 16
-| FALCON_DEBUG1_CTXSW_MODE
 |}
-=== FALCON_DEBUGINFO ===
+Scratch register for reading/writing data to Falcon.
-Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.
-[6.0.0+] [[NV_services|nvservices]] sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.
+=== TSEC_FALCON_ITFEN ===
-=== FALCON_EXCI ===
 {| class="wikitable" border="1"
 !  Bits
 !  Description
 |-
-| 0-19
+| 0
-| PC that originated the exception
+| TSEC_FALCON_ITFEN_CTXEN
 |-
-| 20-23
+| 1
-| Exception type
+| TSEC_FALCON_ITFEN_MTHDEN
-x00: Trap 0
-x01: Trap 1
-x02: Trap 2
-x03: Trap 3
-x08: Invalid opcode
-x09: Authentication entry
-x0A: Page fault (no hit)
-x0B: Page fault (multi hit)
-x0F: Breakpoint
 |}
-Contains information about raised exceptions.
+Used for enabling/disabling Falcon interfaces.
-=== FALCON_CPUCTL ===
+=== TSEC_FALCON_IDLESTATE ===
 {| class="wikitable" border="1"
 !  Bits
@@ Line 1,385: / Line 1,561: @@
 |-
 | 0
-| FALCON_CPUCTL_IINVAL
+| TSEC_FALCON_IDLESTATE_FALCON_BUSY
 |-
-| 1
+| 1-15
-| FALCON_CPUCTL_STARTCPU
+| TSEC_FALCON_IDLESTATE_EXT_BUSY
-|-
-| 2
-| FALCON_CPUCTL_SRESET
-|-
-| 3
-| FALCON_CPUCTL_HRESET
-|-
-| 4
-| FALCON_CPUCTL_HALTED
-|-
-| 5
-| FALCON_CPUCTL_STOPPED
-|-
-| 6
-| FALCON_CPUCTL_CPUCTL_ALIAS_EN
 |}
-Used for signaling the Falcon CPU.
+Used for detecting if Falcon is busy or not.
-=== FALCON_BOOTVEC ===
-Takes the Falcon's boot vector address.
-=== FALCON_HWCFG ===
+=== TSEC_FALCON_DEBUG1 ===
 {| class="wikitable" border="1"
 !  Bits
 !  Description
 |-
-| 0-8
+| 0-15
-| FALCON_HWCFG_IMEM_SIZE
+| TSEC_FALCON_DEBUG1_MTHD_DRAIN_TIME
 |-
-| 9-17
+| 16
-| FALCON_HWCFG_DMEM_SIZE
+| TSEC_FALCON_DEBUG1_CTXSW_MODE
 |-
-| 18-26
+| 17
-| FALCON_HWCFG_METHODFIFO_DEPTH
+| TSEC_FALCON_DEBUG1_TRACE_FORMAT
-|-
-| 27-31
-| FALCON_HWCFG_DMAQUEUE_DEPTH
 |}
-=== FALCON_DMACTL ===
+=== TSEC_FALCON_DEBUGINFO ===
 {| class="wikitable" border="1"
 !  Bits
 !  Description
 |-
-| 0
+| 0-31
-| FALCON_DMACTL_REQUIRE_CTX
+| TSEC_FALCON_DEBUGINFO_DATA
+|}
+Used for UCODE self revocation. This register takes the base address of the GSC carveout shifted right by 8.
+[6.0.0+] [[NV_services|nvservices]] sets this to 0x8005FF00 >> 8 (physical DRAM address inside the GPU UCODE carveout) before starting the nvhost_tsec firmware.
+=== TSEC_FALCON_EXCI ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
 |-
-| 1
+| 0-19
-| FALCON_DMACTL_DMEM_SCRUBBING
+| TSEC_FALCON_EXCI_EXPC
 |-
-| 2
+| 20-23
-| FALCON_DMACTL_IMEM_SCRUBBING
+| TSEC_FALCON_EXCI_EXCAUSE
-|-
+x00: TRAP0
-| 3-6
+x01: TRAP1
-| FALCON_DMACTL_DMAQ_NUM
+x02: TRAP2
-|-
+x03: TRAP3
-| 7
+x08: ILL_INS (invalid opcode)
-| FALCON_DMACTL_SECURE_STAT
+x09: INV_INS (authentication entry)
+x0A: MISS_INS (page miss)
+x0B: DHIT_INS (page multiple hit)
+x0F: BRKPT_INS (breakpoint hit)
 |}
-Used for configuring the Falcon's DMA engine.
+Contains information about raised exceptions.
-=== FALCON_DMATRFBASE ===
+=== TSEC_FALCON_SVEC_SPR ===
-Base address of the external memory buffer, shifted right by 8.
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 18
+| TSEC_FALCON_SVEC_SPR_SIGPASS
+|}
-The current transfer address is calculated by adding [[#FALCON_DMATRFFBOFFS|FALCON_DMATRFFBOFFS]] to the base.
+=== TSEC_FALCON_RSTAT0 ===
+Mirror of the [[#TSEC_FALCON_ICD_RDATA|ICD status register 0]].
-=== FALCON_DMATRFMOFFS ===
+=== TSEC_FALCON_RSTAT3 ===
-For transfers to DMEM: the destination address.
+Mirror of the [[#TSEC_FALCON_ICD_RDATA|ICD status register 3]].
-For transfers to IMEM: the destination virtual IMEM page.
-=== FALCON_DMATRFCMD ===
+=== TSEC_FALCON_CPUCTL ===
 {| class="wikitable" border="1"
 !  Bits
@@ Line 1,467: / Line 1,641: @@
 |-
 | 0
-| FALCON_DMATRFCMD_FULL
+| TSEC_FALCON_CPUCTL_IINVAL
 |-
 | 1
-| FALCON_DMATRFCMD_IDLE
+| TSEC_FALCON_CPUCTL_STARTCPU
+|-
+| 2
+| TSEC_FALCON_CPUCTL_SRESET
 |-
-| 2-3
+| 3
-| FALCON_DMATRFCMD_SEC
+| TSEC_FALCON_CPUCTL_HRESET
 |-
 | 4
-| FALCON_DMATRFCMD_IMEM
+| TSEC_FALCON_CPUCTL_HALTED
 |-
 | 5
-| FALCON_DMATRFCMD_WRITE
+| TSEC_FALCON_CPUCTL_STOPPED
 |-
-| 8-10
+| 6
-| FALCON_DMATRFCMD_SIZE
+| TSEC_FALCON_CPUCTL_ALIAS_EN
+|}
+Used for signaling the Falcon CPU.
+=== TSEC_FALCON_BOOTVEC ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
 |-
-| 12-14
+| 0-31
-| FALCON_DMATRFCMD_CTXDMA
+| TSEC_FALCON_BOOTVEC_VEC
 |}
-Used for configuring DMA transfers.
+Takes the Falcon's boot vector address.
-=== FALCON_DMATRFFBOFFS ===
-For transfers to IMEM: the destination physical IMEM page.
-=== FALCON_DMAPOLL_FB ===
+=== TSEC_FALCON_HWCFG ===
 {| class="wikitable" border="1"
 !  Bits
 !  Description
 |-
-| 0
+| 0-8
-| FALCON_DMAPOLL_FB_FENCE_ACTIVE
+| TSEC_FALCON_HWCFG_IMEM_SIZE
 |-
-| 1
+| 9-17
-| FALCON_DMAPOLL_FB_DMA_ACTIVE
+| TSEC_FALCON_HWCFG_DMEM_SIZE
 |-
-| 4
+| 18-26
-| FALCON_DMAPOLL_FB_CFG_R_FENCE
+| TSEC_FALCON_HWCFG_METHODFIFO_DEPTH
 |-
-| 5
+| 27-31
-| FALCON_DMAPOLL_FB_CFG_W_FENCE
+| TSEC_FALCON_HWCFG_DMAQUEUE_DEPTH
-|-
-| 16-23
-| FALCON_DMAPOLL_FB_WCOUNT
-|-
-| 24-31
-| FALCON_DMAPOLL_FB_RCOUNT
 |}
-Contains the status of a DMA transfer between the Falcon and external memory.
+=== TSEC_FALCON_DMACTL ===
-=== FALCON_DMAPOLL_CP ===
 {| class="wikitable" border="1"
 !  Bits
@@ Line 1,525: / Line 1,699: @@
 |-
 | 0
-| FALCON_DMAPOLL_CP_FENCE_ACTIVE
+| TSEC_FALCON_DMACTL_REQUIRE_CTX
 |-
 | 1
-| FALCON_DMAPOLL_CP_DMA_ACTIVE
+| TSEC_FALCON_DMACTL_DMEM_SCRUBBING
 |-
-| 4
+| 2
-| FALCON_DMAPOLL_CP_CFG_R_FENCE
+| TSEC_FALCON_DMACTL_IMEM_SCRUBBING
 |-
-| 5
+| 3-6
-| FALCON_DMAPOLL_CP_CFG_W_FENCE
+| TSEC_FALCON_DMACTL_DMAQ_NUM
 |-
-| 16-23
+| 7
-| FALCON_DMAPOLL_CP_WCOUNT
+| TSEC_FALCON_DMACTL_SECURE_STAT
-|-
-| 24-31
-| FALCON_DMAPOLL_CP_RCOUNT
 |}
-Contains the status of a DMA transfer between the Falcon and the SCP.
+Used for configuring the Falcon's DMA engine.
-=== FALCON_HWCFG1 ===
+=== TSEC_FALCON_DMATRFBASE ===
 {| class="wikitable" border="1"
 !  Bits
 !  Description
 |-
-| 0-3
+| 0-31
-| FALCON_HWCFG1_CORE_REV
+| TSEC_FALCON_DMATRFBASE_BASE
-|-
-| 4-5
-| FALCON_HWCFG1_SECURITY_MODEL
-|-
-| 6-7
-| FALCON_HWCFG1_CORE_REV_SUBVERSION
-|-
-| 8-11
-| FALCON_HWCFG1_IMEM_PORTS
-|-
-| 12-15
-| FALCON_HWCFG1_DMEM_PORTS
-|-
-| 16-20
-| FALCON_HWCFG1_TAG_WIDTH
-|-
-| 27
-| FALCON_HWCFG1_DBG_PRIV_BUS
-|-
-| 28
-| FALCON_HWCFG1_CSB_SIZE_16M
-|-
-| 29
-| FALCON_HWCFG1_PRIV_DIRECT
-|-
-| 30
-| FALCON_HWCFG1_DMEM_APERTURES
-|-
-| 31
-| FALCON_HWCFG1_IMEM_AUTOFILL
 |}
-=== FALCON_IMCTL ===
+Base address of the external memory buffer, shifted right by 8.
+The current transfer address is calculated by adding [[#TSEC_FALCON_DMATRFFBOFFS|TSEC_FALCON_DMATRFFBOFFS]] to the base.
+=== TSEC_FALCON_DMATRFMOFFS ===
 {| class="wikitable" border="1"
 !  Bits
 !  Description
 |-
-| 0-23
+| 0-15
-| Address
+| TSEC_FALCON_DMATRFMOFFS_OFFS
-|-
-| 24-26
-| Command
-x00: NOP
-x01: IMINV (ITLB)
-x02: IMBLK (PTLB)
-x03: IMTAG (VTLB)
 |}
-Controls the Falcon TLB.
+For transfers to DMEM: the destination address.
+For transfers to IMEM: the destination virtual IMEM page.
-=== FALCON_IMSTAT ===
+=== TSEC_FALCON_DMATRFCMD ===
-Returns the result of the last command from [[#FALCON_IMCTL|FALCON_IMCTL]].
-=== FALCON_TRACEIDX ===
 {| class="wikitable" border="1"
 !  Bits
 !  Description
 |-
-| 0-7
+| 0
-| Index of where to start tracing from
+| TSEC_FALCON_DMATRFCMD_FULL
+|-
+| 1
+| TSEC_FALCON_DMATRFCMD_IDLE
+|-
+| 2-3
+| TSEC_FALCON_DMATRFCMD_SEC
+|-
+| 4
+| TSEC_FALCON_DMATRFCMD_IMEM
+|-
+| 5
+| TSEC_FALCON_DMATRFCMD_WRITE
 |-
-| 16-23
+| 8-10
-| Maximum valid index
+| TSEC_FALCON_DMATRFCMD_SIZE
 |-
-| 24-31
+| 12-14
-| Number of trace reads remaining
+| TSEC_FALCON_DMATRFCMD_CTXDMA
 |}
-Controls the index for tracing with [[#FALCON_TRACEPC|FALCON_TRACEPC]].
+Used for configuring DMA transfers.
-=== FALCON_TRACEPC ===
+=== TSEC_FALCON_DMATRFFBOFFS ===
-Returns the PC of the last call or branch executed.
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0-15
+| TSEC_FALCON_DMATRFFBOFFS_OFFS
+|}
+For transfers to IMEM: the destination physical IMEM page.
-=== FALCON_IMEMC ===
+=== TSEC_FALCON_DMAPOLL_FB ===
 {| class="wikitable" border="1"
 !  Bits
 !  Description
 |-
-| 2-7
+| 0
-| Offset in IMEM block to read/write
+| TSEC_FALCON_DMAPOLL_FB_FENCE_ACTIVE
 |-
-| 8-15
+| 1
-| IMEM block to read/write
+| TSEC_FALCON_DMAPOLL_FB_DMA_ACTIVE
 |-
-| 24
+| 4
-| Write auto-increment
+| TSEC_FALCON_DMAPOLL_FB_CFG_R_FENCE
 |-
-| 25
+| 5
-| Read auto-increment
+| TSEC_FALCON_DMAPOLL_FB_CFG_W_FENCE
 |-
-| 28
+| 16-23
-| Mark uploaded code as secret
+| TSEC_FALCON_DMAPOLL_FB_WCOUNT
 |-
-| 29
+| 24-31
-| Secret code upload lockdown status (read-only)
+| TSEC_FALCON_DMAPOLL_FB_RCOUNT
-|-
-| 30
-| Secret code upload failure status (read-only)
-|-
-| 31
-| Secret code upload reset scrubber status (read-only)
 |}
-Used for configuring access to Falcon's IMEM.
+Contains the status of a DMA transfer between the Falcon and external memory.
-=== FALCON_IMEMD ===
-Returns or takes the value for an IMEM read/write operation.
-=== FALCON_IMEMT ===
+=== TSEC_FALCON_DMAPOLL_CP ===
-Returns or takes the virtual page index for an IMEM read/write operation.
-=== FALCON_DMEMC0 ===
 {| class="wikitable" border="1"
 !  Bits
 !  Description
 |-
-| 2-7
+| 0
-| Offset in DMEM block to read/write
+| TSEC_FALCON_DMAPOLL_CP_FENCE_ACTIVE
+|-
+| 1
+| TSEC_FALCON_DMAPOLL_CP_DMA_ACTIVE
+|-
+| 4
+| TSEC_FALCON_DMAPOLL_CP_CFG_R_FENCE
 |-
-| 8-15
+| 5
-| DMEM block to read/write
+| TSEC_FALCON_DMAPOLL_CP_CFG_W_FENCE
 |-
-| 24
+| 16-23
-| Write auto-increment
+| TSEC_FALCON_DMAPOLL_CP_WCOUNT
 |-
-| 25
+| 24-31
-| Read auto-increment
+| TSEC_FALCON_DMAPOLL_CP_RCOUNT
 |}
-Used for configuring access to Falcon's DMEM.
+Contains the status of a DMA transfer between the Falcon and the SCP.
-=== FALCON_DMEMD0 ===
+=== TSEC_FALCON_HWCFG1 ===
-Returns or takes the value for a DMEM read/write operation.
-=== FALCON_ICD_CMD ===
 {| class="wikitable" border="1"
 !  Bits
@@ Line 1,692: / Line 1,839: @@
 |-
 | 0-3
-| FALCON_ICD_CMD_OPC
+| TSEC_FALCON_HWCFG1_CORE_REV
-x00: STOP
+|-
-x01: RUN (run from PC)
+| 4-5
-x02: JRUN (run from address)
+| TSEC_FALCON_HWCFG1_SECURITY_MODEL
-x03: RUNB (run from PC)
+|-
-x04: JRUNB (run from address)
+| 6-7
-x05: STEP (step from PC)
+| TSEC_FALCON_HWCFG1_CORE_REV_SUBVERSION
-x06: JSTEP (step from address)
+|-
-x07: EMASK (set exception mask)
+| 8-11
-x08: RREG (read register)
+| TSEC_FALCON_HWCFG1_IMEM_PORTS
-x09: WREG (write register)
+|-
-x0A: RDM (read data memory)
+| 12-15
-x0B: WDM (write data memory)
+| TSEC_FALCON_HWCFG1_DMEM_PORTS
-x0C: RCM (read code memory)
+|-
-x0D: WCM (write code memory)
+| 16-20
-x0E: RSTAT (read status)
+| TSEC_FALCON_HWCFG1_TAG_WIDTH
-x0F: SBU
+|-
+| 27
+| TSEC_FALCON_HWCFG1_DBG_PRIV_BUS
+|-
+| 28
+| TSEC_FALCON_HWCFG1_CSB_SIZE_16M
 |-
-| 6-7
+| 29
-| FALCON_ICD_CMD_SZ
+| TSEC_FALCON_HWCFG1_PRIV_DIRECT
-x00: B (byte
-x01: HW (half word)
-x02: W (word)
 |-
-| 8-12
+| 30
-| FALCON_ICD_CMD_IDX
+| TSEC_FALCON_HWCFG1_DMEM_APERTURES
-x00: REG0 | RSTAT0 | WB0
-x01: REG1 | RSTAT1 | WB1
-x02: REG2 | RSTAT2 | WB2
-x03: REG3 | RSTAT3 | WB3
-x04: REG4 | RSTAT4
-x05: REG5 | RSTAT5
-x06: REG6
-x07: REG7
-x08: REG8
-x09: REG9
-x0A: REG10
-x0B: REG11
-x0C: REG12
-x0D: REG13
-x0E: REG14
-x0F: REG15
-x10: IV0
-x11: IV1
-x12: UNDEFINED
-x13: EV
-x14: SP
-x15: PC
-x16: IMB
-x17: DMB
-x18: CSW
-x19: CCR
-x1A: SEC
-x1B: CTX
-x1C: EXCI
 |-
-| 14
+| 31
-| FALCON_ICD_CMD_ERROR
+| TSEC_FALCON_HWCFG1_IMEM_AUTOFILL
+|}
+=== TSEC_FALCON_IMCTL ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
 |-
-| 15
+| 0-23
-| FALCON_ICD_CMD_RDVLD
+| TSEC_FALCON_IMCTL_ADDR_BLK
 |-
-| 16-31
+| 24-26
-| FALCON_ICD_CMD_PARM
+| TSEC_FALCON_IMCTL_CMD
-x0001: EMASK_TRAP0
+x00: NOP
-x0002: EMASK_TRAP1
+x01: IMINV (ITLB)
-x0004: EMASK_TRAP2
+x02: IMBLK (PTLB)
-x0008: EMASK_TRAP3
+x03: IMTAG (VTLB)
-x0010: EMASK_EXC_UNIMP
+x04: IMTAG_SETVLD
-x0020: EMASK_EXC_IMISS
-x0040: EMASK_EXC_IMHIT
-x0080: EMASK_EXC_IBREAK
-x0100: EMASK_IV0
-x0200: EMASK_IV1
-x0400: EMASK_IV2
-x0800: EMASK_EXT0
-x1000: EMASK_EXT1
-x2000: EMASK_EXT2
-x4000: EMASK_EXT3
-x8000: EMASK_EXT4
 |}
-Used for sending commands to the Falcon's in-chip debugger.
+Controls the Falcon TLB.
-=== FALCON_ICD_ADDR ===
+=== TSEC_FALCON_IMSTAT ===
-Takes the target address for the Falcon's in-chip debugger.
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0-31
+| TSEC_FALCON_IMSTAT_VAL
+|}
-=== FALCON_ICD_WDATA ===
+Returns the result of the last command from [[#TSEC_FALCON_IMCTL|TSEC_FALCON_IMCTL]].
-Takes the data for writing using the Falcon's in-chip debugger.
-=== FALCON_ICD_RDATA ===
+=== TSEC_FALCON_TRACEIDX ===
-Returns the data read using the Falcon's in-chip debugger.
-When reading from an internal status register (STAT), the following applies:
 {| class="wikitable" border="1"
 !  Bits
 !  Description
 |-
-| 0
+| 0-7
-| RSTAT0_MEM_STALL
+| TSEC_FALCON_TRACEIDX_IDX
 |-
-| 1
+| 16-23
-| RSTAT0_DMA_STALL
+| TSEC_FALCON_TRACEIDX_MAXIDX
 |-
-| 2
+| 24-31
-| RSTAT0_FENCE_STALL
+| TSEC_FALCON_TRACEIDX_CNT
+|}
+Controls the index for tracing with [[#TSEC_FALCON_TRACEPC|TSEC_FALCON_TRACEPC]].
+=== TSEC_FALCON_TRACEPC ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
 |-
-| 3
+| 0-23
-| RSTAT0_DIV_STALL
+| TSEC_FALCON_TRACEPC_PC
+|}
+Returns the PC of the last call or branch executed.
+=== TSEC_FALCON_IMEMC0 ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
 |-
-| 4
+| 2-7
-| RSTAT0_DMA_STALL_DMAQ
+| TSEC_FALCON_IMEMC_OFFS
 |-
-| 5
+| 8-15
-| RSTAT0_DMA_STALL_DMWAITING
+| TSEC_FALCON_IMEMC_BLK
 |-
-| 6
+| 24
-| RSTAT0_DMA_STALL_IMWAITING
+| TSEC_FALCON_IMEMC_AINCW
 |-
-| 7
+| 25
-| RSTAT0_ANY_STALL
+| TSEC_FALCON_IMEMC_AINCR
 |-
-| 8
+| 28
-| RSTAT0_SBFULL_STALL
+| TSEC_FALCON_IMEMC_SECURE
 |-
-| 9
+| 29
-| RSTAT0_SBHIT_STALL
+| TSEC_FALCON_IMEMC_SEC_ATOMIC
 |-
-| 10
+| 30
-| RSTAT0_FLOW_STALL
+| TSEC_FALCON_IMEMC_SEC_WR_VIO
 |-
-| 11
+| 31
-| RSTAT0_SP_STALL
+| TSEC_FALCON_IMEMC_SEC_LOCK
+|}
+Used for configuring access to Falcon's IMEM.
+=== TSEC_FALCON_IMEMD0 ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
 |-
-| 12
+| 0-31
-| RSTAT0_BL_STALL
+| TSEC_FALCON_IMEMD_DATA
+|}
+Returns or takes the value for an IMEM read/write operation.
+=== TSEC_FALCON_IMEMT0 ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
 |-
-| 13
+| 0-15
-| RSTAT0_IPND_STALL
+| TSEC_FALCON_IMEMT_TAG
+|}
+Returns or takes the virtual page index for an IMEM read/write operation.
+=== TSEC_FALCON_DMEMC0 ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
 |-
-| 14
+| 2-7
-| RSTAT0_LDSTQ_STALL
+| TSEC_FALCON_DMEMC_OFFS
 |-
-| 16
+| 8-15
-| RSTAT0_NOINSTR_STALL
+| TSEC_FALCON_DMEMC_BLK
 |-
-| 20
+| 24
-| RSTAT0_HALTSTOP_FLUSH
+| TSEC_FALCON_DMEMC_AINCW
 |-
-| 21
+| 25
-| RSTAT0_AFILL_FLUSH
+| TSEC_FALCON_DMEMC_AINCR
-|-
-| 22
-| RSTAT0_EXC_FLUSH
-|-
-| 23-25
-| RSTAT0_IRQ_FLUSH
-|-
-| 28
-| RSTAT0_VALIDRD
-|-
-| 29
-| RSTAT0_WAITING
-|-
-| 30
-| RSTAT0_HALTED
-|-
-| 31
-| RSTAT0_MTHD_FULL
 |}
+Used for configuring access to Falcon's DMEM.
+=== TSEC_FALCON_DMEMD0 ===
 {| class="wikitable" border="1"
 !  Bits
 !  Description
 |-
-| 0-3
+| 0-31
-| RSTAT1_WB_ALLOC
+| TSEC_FALCON_DMEMD_DATA
-|-
+|}
-| 4-7
-| RSTAT1_WB_VALID
+Returns or takes the value for a DMEM read/write operation.
-|-
-| 8-9
+=== TSEC_FALCON_ICD_CMD ===
-| RSTAT1_WB0_SZ
-|-
-| 10-11
-| RSTAT1_WB1_SZ
-|-
-| 12-13
-| RSTAT1_WB2_SZ
-|-
-| 14-15
-| RSTAT1_WB3_SZ
-|-
-| 16-19
-| RSTAT1_WB0_IDX
-|-
-| 20-23
-| RSTAT1_WB1_IDX
-|-
-| 24-27
-| RSTAT1_WB2_IDX
-|-
-| 28-31
-| RSTAT1_WB3_IDX
-|}
 {| class="wikitable" border="1"
 !  Bits
@@ Line 1,901: / Line 2,021: @@
 |-
 | 0-3
-| RSTAT2_DMAQ_NUM
+| TSEC_FALCON_ICD_CMD_OPC
-|-
+x00: STOP
-| 4
+x01: RUN (run from PC)
-| RSTAT2_DMA_ENABLE
+x02: JRUN (run from address)
+x03: RUNB (run from PC)
+x04: JRUNB (run from address)
+x05: STEP (step from PC)
+x06: JSTEP (step from address)
+x07: EMASK (set exception mask)
+x08: RREG (read register)
+x09: WREG (write register)
+x0A: RDM (read data memory)
+x0B: WDM (write data memory)
+x0C: RCM (read MMIO/configuration memory)
+x0D: WCM (write MMIO/configuration memory)
+x0E: RSTAT (read status)
+x0F: SBU
 |-
-| 5-7
+| 6-7
-| RSTAT2_LDSTQ_NUM
+| TSEC_FALCON_ICD_CMD_SZ
+x00: B (byte)
+x01: HW (half word)
+x02: W (word)
 |-
-| 16-19
+| 8-12
-| RSTAT2_EM_BUSY
+| TSEC_FALCON_ICD_CMD_IDX
-|-
+x00: REG0 | RSTAT0 | WB0
-| 20-23
+x01: REG1 | RSTAT1 | WB1
-| RSTAT2_EM_ACKED
+x02: REG2 | RSTAT2 | WB2
-|-
+x03: REG3 | RSTAT3 | WB3
-| 24-27
+x04: REG4 | RSTAT4
-| RSTAT2_EM_ISWR
+x05: REG5 | RSTAT5
+x06: REG6
+x07: REG7
+x08: REG8
+x09: REG9
+x0A: REG10
+x0B: REG11
+x0C: REG12
+x0D: REG13
+x0E: REG14
+x0F: REG15
+x10: IV0
+x11: IV1
+x12: UNDEFINED
+x13: EV
+x14: SP
+x15: PC
+x16: IMB
+x17: DMB
+x18: CSW
+x19: CCR
+x1A: SEC
+x1B: CTX
+x1C: EXCI
+x1D: SEC1
+x1E: IMB1
+x1F: DMB1
 |-
-| 28-31
+| 14
-| RSTAT2_EM_DVLD
+| TSEC_FALCON_ICD_CMD_ERROR
-|}
-{| class="wikitable" border="1"
-!  Bits
-!  Description
 |-
-| 0
+| 15
-| RSTAT3_MTHD_IDLE
+| TSEC_FALCON_ICD_CMD_RDVLD
 |-
-| 1
+| 16-31
-| RSTAT3_CTXSW_IDLE
+| TSEC_FALCON_ICD_CMD_PARM
+x0001: EMASK_TRAP0
+x0002: EMASK_TRAP1
+x0004: EMASK_TRAP2
+x0008: EMASK_TRAP3
+x0010: EMASK_EXC_UNIMP
+x0020: EMASK_EXC_IMISS
+x0040: EMASK_EXC_IMHIT
+x0080: EMASK_EXC_IBREAK
+x0100: EMASK_IV0
+x0200: EMASK_IV1
+x0400: EMASK_IV2
+x0800: EMASK_EXT0
+x1000: EMASK_EXT1
+x2000: EMASK_EXT2
+x4000: EMASK_EXT3
+x8000: EMASK_EXT4
+|}
+Used for sending commands to the Falcon's in-chip debugger.
+=== TSEC_FALCON_ICD_ADDR ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
 |-
-| 2
+| 0-31
-| RSTAT3_DMA_IDLE
+| TSEC_FALCON_ICD_ADDR_ADDR
+|}
+Takes the target address for the Falcon's in-chip debugger.
+=== TSEC_FALCON_ICD_WDATA ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
 |-
-| 3
+| 0-31
-| RSTAT3_SCP_IDLE
+| TSEC_FALCON_ICD_WDATA_DATA
+|}
+Takes the data for writing using the Falcon's in-chip debugger.
+=== TSEC_FALCON_ICD_RDATA ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0-31
+| TSEC_FALCON_ICD_RDATA_DATA
+|}
+Returns the data read using the Falcon's in-chip debugger.
+When reading from an internal status register (STAT), the following applies:
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0
+| RSTAT0_MEM_STALL
+|-
+| 1
+| RSTAT0_DMA_STALL
+|-
+| 2
+| RSTAT0_FENCE_STALL
+|-
+| 3
+| RSTAT0_DIV_STALL
 |-
 | 4
-| RSTAT3_LDST_IDLE
+| RSTAT0_DMA_STALL_DMAQ
 |-
 | 5
-| RSTAT3_SBWB_EMPTY
+| RSTAT0_DMA_STALL_DMWAITING
 |-
-| 6-8
+| 6
-| RSTAT3_CSWIE
+| RSTAT0_DMA_STALL_IMWAITING
 |-
-| 10
+| 7
-| RSTAT3_CSWE
+| RSTAT0_ANY_STALL
 |-
-| 12-14
+| 8
-| RSTAT3_CTXSW_STATE
+| RSTAT0_SBFULL_STALL
-x00: IDLE
-x01: SM_CHECK
-x02: SM_SAVE
-x03: SM_SAVE_WAIT
-x04: SM_BLK_BIND
-x05: SM_RESET
-x06: SM_RESETWAIT
-x07: SM_ACK
 |-
-| 15
+| 9
-| RSTAT3_CTXSW_PEND
+| RSTAT0_SBHIT_STALL
 |-
-| 17
+| 10
-| RSTAT3_DMA_FBREQ_IDLE
+| RSTAT0_FLOW_STALL
 |-
-| 18
+| 11
-| RSTAT3_DMA_ACKQ_EMPTY
+| RSTAT0_SP_STALL
 |-
-| 19
+| 12
-| RSTAT3_DMA_RDQ_EMPTY
+| RSTAT0_BL_STALL
 |-
-| 20
+| 13
-| RSTAT3_DMA_WR_BUSY
+| RSTAT0_IPND_STALL
+|-
+| 14
+| RSTAT0_LDSTQ_STALL
+|-
+| 16
+| RSTAT0_NOINSTR_STALL
+|-
+| 20
+| RSTAT0_HALTSTOP_FLUSH
 |-
 | 21
-| RSTAT3_DMA_RD_BUSY
+| RSTAT0_AFILL_FLUSH
 |-
 | 22
-| RSTAT3_LDST_XT_BUSY
+| RSTAT0_EXC_FLUSH
+|-
+| 23-25
+| RSTAT0_IRQ_FLUSH
+|-
+| 28
+| RSTAT0_VALIDRD
+|-
+| 29
+| RSTAT0_WAITING
 |-
-| 23
+| 30
-| RSTAT3_LDST_XT_BLOCK
+| RSTAT0_HALTED
 |-
-| 24
+| 31
-| RSTAT3_ENG_IDLE
+| RSTAT0_MTHD_FULL
 |}
 {| class="wikitable" border="1"
@@ Line 1,991: / Line 2,222: @@
 !  Description
 |-
-| 0-1
+| 0-3
-| RSTAT4_ICD_STATE
+| RSTAT1_WB_ALLOC
-x00: NORMAL
-x01: WAIT_ISSUE_CLEAR
-x02: WAIT_EXLDQ_CLEAR
-x03: FULL_DBG_MODE
 |-
-| 2-3
+| 4-7
-| RSTAT4_ICD_MODE
+| RSTAT1_WB_VALID
-x00: SUPPRESSICD
-x01: ENTERICD_IBRK
-x02: ENTERICD_STEP
 |-
-| 16
+| 8-9
-| RSTAT4_ICD_EMASK_TRAP0
+| RSTAT1_WB0_SZ
 |-
-| 17
+| 10-11
-| RSTAT4_ICD_EMASK_TRAP1
+| RSTAT1_WB1_SZ
 |-
-| 18
+| 12-13
-| RSTAT4_ICD_EMASK_TRAP2
+| RSTAT1_WB2_SZ
 |-
-| 19
+| 14-15
-| RSTAT4_ICD_EMASK_TRAP3
+| RSTAT1_WB3_SZ
 |-
-| 20
+| 16-19
-| RSTAT4_ICD_EMASK_EXC_UNIMP
+| RSTAT1_WB0_IDX
 |-
-| 21
+| 20-23
-| RSTAT4_ICD_EMASK_EXC_IMISS
+| RSTAT1_WB1_IDX
 |-
-| 22
+| 24-27
-| RSTAT4_ICD_EMASK_EXC_IMHIT
+| RSTAT1_WB2_IDX
 |-
-| 23
+| 28-31
-| RSTAT4_ICD_EMASK_EXC_IBREAK
+| RSTAT1_WB3_IDX
+|}
+{| class="wikitable" border="1"
+!  Bits
+!  Description
 |-
-| 24
+| 0-3
-| RSTAT4_ICD_EMASK_IV0
+| RSTAT2_DMAQ_NUM
 |-
-| 25
+| 4
-| RSTAT4_ICD_EMASK_IV1
+| RSTAT2_DMA_ENABLE
 |-
-| 26
+| 5-7
-| RSTAT4_ICD_EMASK_IV2
+| RSTAT2_LDSTQ_NUM
 |-
-| 27
+| 16-19
-| RSTAT4_ICD_EMASK_EXT0
+| RSTAT2_EM_BUSY
 |-
-| 28
+| 20-23
-| RSTAT4_ICD_EMASK_EXT1
+| RSTAT2_EM_ACKED
 |-
-| 29
+| 24-27
-| RSTAT4_ICD_EMASK_EXT2
+| RSTAT2_EM_ISWR
 |-
-| 30
+| 28-31
-| RSTAT4_ICD_EMASK_EXT3
+| RSTAT2_EM_DVLD
-|-
-| 31
-| RSTAT4_ICD_EMASK_EXT4
 |}
 {| class="wikitable" border="1"
@@ Line 2,056: / Line 2,281: @@
 !  Description
 |-
-| 0-7
+| 0
-| RSTAT5_LRU_STATE
+| RSTAT3_MTHD_IDLE
-|}
-=== FALCON_SCTL ===
-{| class="wikitable" border="1"
-!  Bits
-!  Description
 |-
-| 0-1
+| 1
-| FALCON_SCTL_SEC_MODE
+| RSTAT3_CTXSW_IDLE
-: Non-secure
-: Light Secure
-: Heavy Secure
 |-
-| 4-5
+| 2
-| FALCON_SCTL_OLD_SEC_MODE
+| RSTAT3_DMA_IDLE
-: Non-secure
-: Light Secure
-: Heavy Secure
 |-
-| 12-13
+| 3
-| Unknown
+| RSTAT3_SCP_IDLE
 |-
-| 14
+| 4
-| Initialize the transition to LS mode
+| RSTAT3_LDST_IDLE
-|}
-=== FALCON_SCTL_STAT ===
-{| class="wikitable" border="1"
-!  Bits
-!  Description
 |-
-| 31
+| 5
-| Set on memory protection violation
+| RSTAT3_SBWB_EMPTY
-|}
-=== FALCON_SPROT_IMEM ===
-{| class="wikitable" border="1"
-!  Bits
-!  Description
 |-
-| 0-3
+| 6-8
-| Read access level
+| RSTAT3_CSWIE
 |-
-| 4-7
+| 10
-| Write access level
+| RSTAT3_CSWE
-|}
-Controls accesses to Falcon IMEM.
-=== FALCON_SPROT_DMEM ===
-{| class="wikitable" border="1"
-!  Bits
-!  Description
 |-
-| 0-3
+| 12-14
-| Read access level
+| RSTAT3_CTXSW_STATE
+x00: IDLE
+x01: SM_CHECK
+x02: SM_SAVE
+x03: SM_SAVE_WAIT
+x04: SM_BLK_BIND
+x05: SM_RESET
+x06: SM_RESETWAIT
+x07: SM_ACK
 |-
-| 4-7
+| 15
-| Write access level
+| RSTAT3_CTXSW_PEND
-|}
-Controls accesses to Falcon DMEM.
-=== FALCON_SPROT_CPUCTL ===
-{| class="wikitable" border="1"
-!  Bits
-!  Description
 |-
-| 0-3
+| 17
-| Read access level
+| RSTAT3_DMA_FBREQ_IDLE
 |-
-| 4-7
+| 18
-| Write access level
+| RSTAT3_DMA_ACKQ_EMPTY
-|}
-Controls accesses to the [[#FALCON_CPUCTL|FALCON_CPUCTL]] register.
-=== FALCON_SPROT_MISC ===
-{| class="wikitable" border="1"
-!  Bits
-!  Description
 |-
-| 0-3
+| 19
-| Read access level
+| RSTAT3_DMA_RDQ_EMPTY
+|-
+| 20
+| RSTAT3_DMA_WR_BUSY
+|-
+| 21
+| RSTAT3_DMA_RD_BUSY
 |-
-| 4-7
+| 22
-| Write access level
+| RSTAT3_LDST_XT_BUSY
-|}
-Controls accesses to the following registers:
-* FALCON_VM_SUPERVISOR
-* FALCON_SUBENGINE_RESET
-* FALCON_HOST_IO_INDEX
-* [[#FALCON_DMACTL|FALCON_DMACTL]]
-* [[#FALCON_IMCTL|FALCON_IMCTL]]
-* [[#FALCON_IMSTAT|FALCON_IMSTAT]]
-* FALCON_UNK_250
-* FALCON_UNK_2E0
-=== FALCON_SPROT_IRQ ===
-{| class="wikitable" border="1"
-!  Bits
-!  Description
 |-
-| 0-3
+| 23
-| Read access level
+| RSTAT3_LDST_XT_BLOCK
 |-
-| 4-7
+| 24
-| Write access level
+| RSTAT3_ENG_IDLE
 |}
-Controls accesses to the following registers:
-* [[#FALCON_IRQMODE|FALCON_IRQMODE]]
-* [[#FALCON_IRQMSET|FALCON_IRQMSET]]
-* [[#FALCON_IRQMCLR|FALCON_IRQMCLR]]
-* [[#FALCON_IRQDEST|FALCON_IRQDEST]]
-* FALCON_GPTMR_PERIOD
-* FALCON_GPTMR_TIME
-* FALCON_GPTMR_ENABLE
-* FALCON_UNK_3C
-* FALCON_UNK_E0
-=== FALCON_SPROT_MTHD ===
 {| class="wikitable" border="1"
 !  Bits
 !  Description
 |-
-| 0-3
+| 0-1
-| Read access level
+| RSTAT4_ICD_STATE
+x00: NORMAL
+x01: WAIT_ISSUE_CLEAR
+x02: WAIT_EXLDQ_CLEAR
+x03: FULL_DBG_MODE
 |-
-| 4-7
+| 2-3
-| Write access level
+| RSTAT4_ICD_MODE
-|}
+x00: SUPPRESSICD
+x01: ENTERICD_IBRK
-Controls accesses to the following registers:
+x02: ENTERICD_STEP
-* [[#FALCON_ITFEN|FALCON_ITFEN]]
-* FALCON_CURCTX
-* FALCON_NXTCTX
-* FALCON_CMDCTX
-* FALCON_MTHD_DATA
-* FALCON_MTHD_CMD
-* FALCON_MTHD_DATA_WR
-* FALCON_MTHD_OCCUPIED
-* FALCON_MTHD_ACK
-* FALCON_MTHD_LIMIT
-* [[#FALCON_DEBUG1|FALCON_DEBUG1]]
-=== FALCON_SPROT_SCTL ===
-{| class="wikitable" border="1"
-!  Bits
-!  Description
 |-
-| 0-3
+| 16
-| Read access level
+| RSTAT4_ICD_EMASK_TRAP0
 |-
-| 4-7
+| 17
-| Write access level
+| RSTAT4_ICD_EMASK_TRAP1
-|}
-Controls accesses to the [[#FALCON_SCTL|FALCON_SCTL]] register.
-=== FALCON_SPROT_WDTMR ===
-{| class="wikitable" border="1"
-!  Bits
-!  Description
 |-
-| 0-3
+| 18
-| Read access level
+| RSTAT4_ICD_EMASK_TRAP2
 |-
-| 4-7
+| 19
-| Write access level
+| RSTAT4_ICD_EMASK_TRAP3
-|}
-Controls accesses to the following registers:
-* FALCON_WDTMR_TIME
-* FALCON_WDTMR_ENABLE
-=== TSEC_SCP_CTL0 ===
-{| class="wikitable" border="1"
-!  Bits
-!  Description
 |-
 | 20
-| Enable TSEC_SCP_INSN_STAT register
+| RSTAT4_ICD_EMASK_EXC_UNIMP
-|}
-=== TSEC_SCP_CTL1 ===
-{| class="wikitable" border="1"
-!  Bits
-!  Description
 |-
-| 11
+| 21
-| Enable TRNG testing mode
+| RSTAT4_ICD_EMASK_EXC_IMISS
 |-
-| 12
+| 22
-| Enable the TRNG
+| RSTAT4_ICD_EMASK_EXC_IMHIT
-|}
-=== TSEC_SCP_CTL_STAT ===
-{| class="wikitable" border="1"
-!  Bits
-!  Description
 |-
-| 20
+| 23
-| TSEC_SCP_CTL_STAT_DEBUG_MODE
+| RSTAT4_ICD_EMASK_EXC_IBREAK
-|}
-=== TSEC_SCP_CTL_LOCK ===
-{| class="wikitable" border="1"
-!  Bits
-!  Description
 |-
-| 0
+| 24
-| Disable reads for the SCP and TRNG register blocks
+| RSTAT4_ICD_EMASK_IV0
 |-
-| 1
+| 25
-| Disable reads for the TFBIF register block
+| RSTAT4_ICD_EMASK_IV1
 |-
-| 2
+| 26
-| Disable reads for the DMA register block
+| RSTAT4_ICD_EMASK_IV2
 |-
-| 3
+| 27
-| Disable reads for the TEGRA register block
+| RSTAT4_ICD_EMASK_EXT0
 |-
-| 4
+| 28
-| Disable writes for the SCP and TRNG register blocks
+| RSTAT4_ICD_EMASK_EXT1
 |-
-| 5
+| 29
-| Disable writes for the TFBIF register block
+| RSTAT4_ICD_EMASK_EXT2
 |-
-| 6
+| 30
-| Disable writes for the DMA register block
+| RSTAT4_ICD_EMASK_EXT3
 |-
-| 7
+| 31
-| Disable writes for the TEGRA register block
+| RSTAT4_ICD_EMASK_EXT4
 |}
-Locks accesses to sub-engines and can only be cleared in Heavy Secure mode.
-=== TSEC_SCP_CTL_PKEY ===
 {| class="wikitable" border="1"
 !  Bits
 !  Description
 |-
-| 0
+| 0-7
-| TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
+| RSTAT5_LRU_STATE
-|-
-| 1
-| TSEC_SCP_CTL_PKEY_LOADED
 |}
-=== TSEC_SCP_SEQ_CTL ===
+=== TSEC_FALCON_SCTL ===
 {| class="wikitable" border="1"
 !  Bits
 !  Description
 |-
-| 0-3
+| 0-1
-| Sequence's instruction index
+| TSEC_FALCON_SCTL_SEC_MODE
+: Non-secure
+: Light Secure
+: Heavy Secure
+|-
+| 4-5
+| Previous security mode
+: Non-secure
+: Light Secure
+: Heavy Secure
 |-
-| 4-7
+| 12-13
-| Target and control flags
+| Unknown
 |-
-| 8-11
+| 14
-| Sequence's size
+| Initialize the transition to LS mode
 |}
-Controls the last crypto sequence (cs0 or cs1) created.
+=== TSEC_FALCON_SSTAT ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 31
+| Set on memory protection violation
+|}
-=== TSEC_SCP_SEQ_VAL ===
+=== TSEC_FALCON_SPROT_IMEM ===
 {| class="wikitable" border="1"
 !  Bits
@@ Line 2,332: / Line 2,455: @@
 |-
 | 0-3
-| Sequence instruction's first operand
+| Read access level
 |-
-| 4-9
+| 4-7
-| Sequence instruction's second operand
+| Write access level
-|-
-| 10-14
-| Sequence instruction's opcode
 |}
-Contains information on the last crypto sequence (cs0 or cs1) created.
+Controls accesses to Falcon IMEM.
-=== TSEC_SCP_SEQ_STAT ===
+=== TSEC_FALCON_SPROT_DMEM ===
 {| class="wikitable" border="1"
 !  Bits
 !  Description
 |-
-| 0
+| 0-3
-| Set if crypto sequence recording (cs0begin/cs1begin) is active
+| Read access level
 |-
 | 4-7
-| Number of instructions left for the crypto sequence
+| Write access level
+|}
+Controls accesses to Falcon DMEM.
+=== TSEC_FALCON_SPROT_CPUCTL ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
 |-
-| 12-15
+| 0-3
-| Active crypto key register
+| Read access level
+|-
+| 4-7
+| Write access level
 |}
-Contains information on the last crypto sequence (cs0 or cs1) executed.
+Controls accesses to the [[#TSEC_FALCON_CPUCTL|TSEC_FALCON_CPUCTL]] register.
-=== TSEC_SCP_INSN_STAT ===
+=== TSEC_FALCON_SPROT_MISC ===
 {| class="wikitable" border="1"
 !  Bits
@@ Line 2,366: / Line 2,497: @@
 |-
 | 0-3
-| Destination register or immediate value
+| Read access level
 |-
-| 8-13
+| 4-7
-| Source register or immediate value
+| Write access level
+|}
+Controls accesses to the following registers:
+* TSEC_FALCON_PRIVSTATE
+* TSEC_FALCON_SFTRESET
+* TSEC_FALCON_ADDR
+* [[#TSEC_FALCON_DMACTL|TSEC_FALCON_DMACTL]]
+* [[#TSEC_FALCON_IMCTL|TSEC_FALCON_IMCTL]]
+* [[#TSEC_FALCON_IMSTAT|TSEC_FALCON_IMSTAT]]
+* TSEC_FALCON_UNK_250
+* TSEC_FALCON_DMAINFO_CTL
+=== TSEC_FALCON_SPROT_IRQ ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0-3
+| Read access level
 |-
-| 20-24
+| 4-7
-| Operation
+| Write access level
-x0:  nop (fuc5 opcode 0x00)
-x1:  cmov (fuc5 opcode 0x84)
-x2:  cxsin (fuc5 opcode 0x88) or xdst (with cxset)
-x3:  cxsout (fuc5 opcode 0x8C) or xdld (with cxset)
-x4:  crnd (fuc5 opcode 0x90)
-x5:  cs0begin (fuc5 opcode 0x94)
-x6:  cs0exec (fuc5 opcode 0x98)
-x7:  cs1begin (fuc5 opcode 0x9C)
-x8:  cs1exec (fuc5 opcode 0xA0)
-x9:  invalid (fuc5 opcode 0xA4)
-xA:  cchmod (fuc5 opcode 0xA8)
-xB:  cxor (fuc5 opcode 0xAC)
-xC:  cadd (fuc5 opcode 0xB0)
-xD:  cand (fuc5 opcode 0xB4)
-xE:  crev (fuc5 opcode 0xB8)
-xF:  cprecmac (fuc5 opcode 0xBC)
-x10: csecret (fuc5 opcode 0xC0)
-x11: ckeyreg (fuc5 opcode 0xC4)
-x12: ckexp (fuc5 opcode 0xC8)
-x13: ckrexp (fuc5 opcode 0xCC)
-x14: cenc (fuc5 opcode 0xD0)
-x15: cdec (fuc5 opcode 0xD4)
-x16: csigauth (fuc5 opcode 0xD8)
-x17: csigenc (fuc5 opcode 0xDC)
-x18: csigclr (fuc5 opcode 0xE0)
-|-
-| 28
-| Set if the instruction is valid
-|-
-| 31
-| Set if running in HS mode
 |}
-Contains information on the last crypto instruction executed.
+Controls accesses to the following registers:
+* [[#TSEC_FALCON_IRQMODE|TSEC_FALCON_IRQMODE]]
+* [[#TSEC_FALCON_IRQMSET|TSEC_FALCON_IRQMSET]]
+* [[#TSEC_FALCON_IRQMCLR|TSEC_FALCON_IRQMCLR]]
+* [[#TSEC_FALCON_IRQDEST|TSEC_FALCON_IRQDEST]]
+* TSEC_FALCON_GPTMRINT
+* TSEC_FALCON_GPTMRVAL
+* TSEC_FALCON_GPTMRCTL
+* TSEC_FALCON_IRQDEST2
+* TSEC_FALCON_UNK_E0
-=== TSEC_SCP_AUTH_STAT ===
+=== TSEC_FALCON_SPROT_MTHD ===
 {| class="wikitable" border="1"
 !  Bits
 !  Description
 |-
-| 0-1
+| 0-3
-| Signature comparison result (3=succeeded, 2=failed)
+| Read access level
-|}
+|-
+| 4-7
+| Write access level
+|}
-Contains information on the last authentication attempt.
+Controls accesses to the following registers:
+* [[#TSEC_FALCON_ITFEN|TSEC_FALCON_ITFEN]]
+* TSEC_FALCON_CURCTX
+* TSEC_FALCON_NXTCTX
+* TSEC_FALCON_CTXACK
+* TSEC_FALCON_MTHDDATA
+* TSEC_FALCON_MTHDID
+* TSEC_FALCON_MTHDWDAT
+* TSEC_FALCON_MTHDCOUNT
+* TSEC_FALCON_MTHDPOP
+* TSEC_FALCON_MTHDRAMSZ
+* [[#TSEC_FALCON_DEBUG1|TSEC_FALCON_DEBUG1]]
-=== TSEC_SCP_AES_STAT ===
+=== TSEC_FALCON_SPROT_SCTL ===
 {| class="wikitable" border="1"
 !  Bits
 !  Description
 |-
-| 0-4
+| 0-3
-| First opcode
+| Read access level
+|-
+| 4-7
+| Write access level
+|}
+Controls accesses to the [[#TSEC_FALCON_SCTL|TSEC_FALCON_SCTL]] register.
+=== TSEC_FALCON_SPROT_WDTMR ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
 |-
-| 5-9
+| 0-3
-| Second opcode
+| Read access level
 |-
-| 15-16
+| 4-7
-| AES operation
+| Write access level
-: Encryption
-: Decryption
-: Key expansion
-: Key reverse expansion
 |}
-Contains information on the last AES sequence executed.
+Controls accesses to the following registers:
+* TSEC_FALCON_WDTMRVAL
+* TSEC_FALCON_WDTMRCTL
-=== TSEC_SCP_IRQSTAT ===
+=== TSEC_SCP_CTL0 ===
 {| class="wikitable" border="1"
 !  Bits
 !  Description
 |-
-| 0
+| 10
-| TSEC_SCP_IRQSTAT_TRNG
+| Enable the LOAD interface
 |-
-| 8
+| 12
-| TSEC_SCP_IRQSTAT_ACL_ERROR
+| Enable the STORE interface
 |-
-| 12
+| 14
-| Unknown
+| Enable the CMD interface
 |-
 | 16
-| TSEC_SCP_IRQSTAT_INSN_ERROR
+| Enable the SEQ controller
 |-
 | 20
-| TSEC_SCP_IRQSTAT_SINGLE_STEP
+| Enable the [[#TSEC_SCP_CMD|TSEC_SCP_CMD]] register
-|-
-| 24
-| Unknown
-|-
-| 28
-| Unknown
 |}
-Used for getting the status of crypto IRQs.
+=== TSEC_SCP_CTL1 ===
-=== TSEC_SCP_IRQMASK ===
 {| class="wikitable" border="1"
 !  Bits
@@ Line 2,475: / Line 2,618: @@
 |-
 | 0
-| TSEC_SCP_IRQMASK_TRNG
+| Flush the SEQ controller
 |-
 | 8
-| TSEC_SCP_IRQMASK_ACL_ERROR
+| Unknown
+|-
+| 11
+| Enable RNG test mode
 |-
 | 12
-| Unknown
+| Enable the RNG controller
 |-
 | 16
-| TSEC_SCP_IRQMASK_INSN_ERROR
+| Enable LOAD interface dummy mode (all reads return 0)
 |-
 | 20
-| TSEC_SCP_IRQMASK_SINGLE_STEP
+| Enable LOAD interface bypassing (all reads are dropped)
 |-
 | 24
-| Unknown
+| Enable STORE interface bypassing (all writes are dropped)
+|}
+=== TSEC_SCP_CTL_STAT ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
 |-
-| 28
+| 20
-| Unknown
+| TSEC_SCP_CTL_STAT_DEBUG_MODE
 |}
-Used for getting the value of the mask for crypto IRQs.
+=== TSEC_SCP_CTL_LOCK ===
-=== TSEC_SCP_ACL_ERR ===
 {| class="wikitable" border="1"
 !  Bits
@@ Line 2,504: / Line 2,654: @@
 |-
 | 0
-| Set when writing to a crypto register without the correct ACL
+| Enable lockdown mode
 |-
-| 4
+| 1
-| Set when reading from a crypto register without the correct ACL
+| Unknown
 |-
-| 8
+| 2
-| Set on an invalid ACL change (cchmod)
+| Unknown
 |-
-| 31
+| 3
-| An ACL error occurred
+| Unknown
-|}
-Contains information on the status generated by the [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT_ACL_ERROR]] IRQ.
-=== TSEC_SCP_INSN_ERR ===
-{| class="wikitable" border="1"
-!  Bits
-!  Description
-|-
-| 0
-| Invalid instruction
 |-
 | 4
-| Empty crypto sequence
+| Lock the SCP
 |-
-| 8
+| 5
-| Crypto sequence is too long
+| Unknown
 |-
-| 12
+| 6
-| Crypto sequence was not finished
+| Unknown
 |-
-| 16
+| 7
-| Insecure signature (csigenc, csigclr or csigauth)
+| Unknown
-|-
-| 20
-| Invalid signature (csigauth in HS mode)
-|-
-| 24
-| Forbidden ACL change (cchmod in NS mode)
 |}
-Contains information on crypto errors generated by the [[#TSEC_SCP_IRQSTAT|TSEC_SCP_IRQSTAT_INSN_ERROR]] IRQ.
+Controls lockdown mode and can only be cleared in Heavy Secure mode.
-=== TSEC_TFBIF_MCCIF_FIFOCTRL ===
+=== TSEC_SCP_CFG ===
 {| class="wikitable" border="1"
 !  Bits
@@ Line 2,553: / Line 2,686: @@
 |-
 | 0
-| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
+| Unknown
 |-
 | 1
-| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
+| Unknown
 |-
 | 2
-| TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
+| Unknown
 |-
 | 3
-| TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
+| Unknown
 |-
 | 4
-| TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
+| Unknown
+|-
+| 8
+| Flush the CMD interface
 |-
-| 5
+| 12-13
-| TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
+| Carry chain size
+: 32 bits
+: 64 bits
+: 96 bits
+: 128 bits
 |-
-| 6
+| 16-31
-| TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
+| Timeout value
+|}
+=== TSEC_SCP_CTL_SCP ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
 |-
-| 7
+| 0
-| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
+| Swap SCP master
 |-
-| 8
+| 1
-| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE
+| Current SCP master
+: Falcon
+: External
 |}
-=== TSEC_TFBIF_MCCIF_FIFOCTRL1 ===
+=== TSEC_SCP_CTL_PKEY ===
 {| class="wikitable" border="1"
 !  Bits
 !  Description
 |-
-| 0-15
+| 0
-| TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
+| TSEC_SCP_CTL_PKEY_REQUEST_RELOAD
+|-
+| 1
+| TSEC_SCP_CTL_PKEY_LOADED
+|}
+=== TSEC_SCP_CTL_DBG ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0
+| Unknown
+|-
+| 4
+| Unknown
+|-
+| 8
+| Unknown
+|-
+| 12
+| Unknown
+|}
+=== TSEC_SCP_DBG0 ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0-3
+| Index
+|-
+| 4
+| Automatic increment
+|-
+| 5-6
+| Target
+: None
+: STORE
+: LOAD
+: SEQ
+|-
+| 8-12
+| SEQ size
+|-
+| 13-16
+| Unknown
+|-
+| 17
+| SEQ instruction is valid
+|-
+| 18
+| SEQ controller is running in HS mode
+|-
+| 19-22
+| LOAD size
+|-
+| 23
+| LOAD instruction is valid
+|-
+| 24
+| LOAD interface is running in HS mode
+|-
+| 25-26
+| STORE size
+|-
+| 30
+| STORE instruction is valid
+|-
+| 31
+| STORE interface is running in HS mode
+|}
+Used for debugging crypto controllers such as the SEQ (crypto sequence).
+=== TSEC_SCP_DBG1 ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0-3
+| SEQ instruction's first operand
+|-
+| 4-9
+| SEQ instruction's second operand
+|-
+| 10-14
+| SEQ instruction's opcode
+|}
+Used for retrieving debug data. Contains information on the last crypto sequence created when debugging the SEQ controller.
+=== TSEC_SCP_DBG2 ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0-1
+| SEQ controller's state
+: Idle
+: Recording is active (cs0begin/cs1begin)
+|-
+| 4-7
+| Number of SEQ instructions left
+|-
+| 12-15
+| Active crypto key register
+|}
+Used for retrieving additional debug data associated with the SEQ controller.
+=== TSEC_SCP_CMD ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0-3
+| Destination register
+|-
+| 8-13
+| Source register or immediate value
+|-
+| 20-24
+| Command opcode
+x0:  nop (fuc5 opcode 0x00)
+x1:  cmov (fuc5 opcode 0x84)
+x2:  cxsin (fuc5 opcode 0x88) or xdst (with cxset)
+x3:  cxsout (fuc5 opcode 0x8C) or xdld (with cxset)
+x4:  crnd (fuc5 opcode 0x90)
+x5:  cs0begin (fuc5 opcode 0x94)
+x6:  cs0exec (fuc5 opcode 0x98)
+x7:  cs1begin (fuc5 opcode 0x9C)
+x8:  cs1exec (fuc5 opcode 0xA0)
+x9:  invalid (fuc5 opcode 0xA4)
+xA:  cchmod (fuc5 opcode 0xA8)
+xB:  cxor (fuc5 opcode 0xAC)
+xC:  cadd (fuc5 opcode 0xB0)
+xD:  cand (fuc5 opcode 0xB4)
+xE:  crev (fuc5 opcode 0xB8)
+xF:  cprecmac (fuc5 opcode 0xBC)
+x10: csecret (fuc5 opcode 0xC0)
+x11: ckeyreg (fuc5 opcode 0xC4)
+x12: ckexp (fuc5 opcode 0xC8)
+x13: ckrexp (fuc5 opcode 0xCC)
+x14: cenc (fuc5 opcode 0xD0)
+x15: cdec (fuc5 opcode 0xD4)
+x16: csigauth (fuc5 opcode 0xD8)
+x17: csigenc (fuc5 opcode 0xDC)
+x18: csigclr (fuc5 opcode 0xE0)
+|-
+| 28
+| CMD instruction is valid
+|-
+| 31
+| CMD interface is running in HS mode
+|}
+Contains information on the last crypto command executed.
+=== TSEC_SCP_STAT0 ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0
+| SCP is active
+|-
+| 2
+| CMD interface is active
+|-
+| 4
+| STORE interface is active
+|-
+| 6
+| SEQ controller is active
+|-
+| 8
+| [[#TSEC_SCP_CMD|TSEC_SCP_CMD]] register is enabled
+|-
+| 10
+| LOAD interface is active
+|-
+| 14
+| AES controller is active
+|-
+| 16
+| RNG controller is active
+|}
+Contains the status of the crypto controllers and interfaces.
+=== TSEC_SCP_STAT1 ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0-1
+| Signature comparison result
+: None
+: Running
+: Failed
+: Succeeded
+|-
+| 4
+| LOAD interface is running in HS mode
+|-
+| 6
+| LOAD interface is ready
+|-
+| 8
+| STORE interface is running in HS mode
+|-
+| 10
+| STORE interface received a valid instruction
+|-
+| 12
+| CMD interface is running in HS mode
+|-
+| 14
+| CMD interface received a valid instruction
+|}
+Contains the status of the last authentication attempt and other miscellaneous statuses.
+=== TSEC_SCP_STAT2 ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0-4
+| Current SEQ opcode
+|-
+| 5-9
+| Current CMD opcode
+|-
+| 10-14
+| Pending CMD opcode
+|-
+| 15-16
+| AES operation
+: Encryption
+: Decryption
+: Key expansion
+: Key reverse expansion
+|-
+| 24
+| Unknown
+|-
+| 25
+| STORE operation is stalled
+|-
+| 26
+| LOAD operation is stalled
+|-
+| 27
+| RNG operation is stalled
+|-
+| 28
+| Unknown
+|-
+| 29
+| AES operation is stalled
+|}
+Contains the status of crypto operations.
+=== TSEC_SCP_RNG_STAT0 ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0
+| Internal RND controller is ready
+|-
+| 4-7
+| Unknown
+|-
+| 8-11
+| Unknown
+|-
+| 16
+| Unknown
+|-
+| 20
+| Unknown
+|}
+=== TSEC_SCP_RNG_STAT1 ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0-15
+| Unknown
 |-
 | 16-31
-| TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT
+| Unknown
 |}
-=== TSEC_TFBIF_MMU_PROT ===
+=== TSEC_SCP_IRQSTAT ===
 {| class="wikitable" border="1"
 !  Bits
 !  Description
 |-
-| 0-3
+| 0
-| Read access level
+| RND ready
 |-
-| 4-7
+| 8
-| Write access level
+| ACL error
+|-
+| 12
+| SEC error
+|-
+| 16
+| CMD error
+|-
+| 20
+| Single step
+|-
+| 24
+| RND operation
+|-
+| 28
+| Timeout
+|}
+Used for getting the status of crypto IRQs.
+=== TSEC_SCP_IRQMASK ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0
+| RND ready
+|-
+| 8
+| ACL error
+|-
+| 12
+| SEC error
+|-
+| 16
+| CMD error
+|-
+| 20
+| Single step
+|-
+| 24
+| RND operation
+|-
+| 28
+| Timeout
+|}
+Used for getting the value of the mask for crypto IRQs.
+=== TSEC_SCP_ACL_ERR ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0
+| Writing to a crypto register without the correct ACL
+|-
+| 4
+| Reading from a crypto register without the correct ACL
+|-
+| 8
+| Invalid ACL change (cchmod)
+|-
+| 31
+| ACL error occurred
+|}
+Contains information on errors generated by the [[#TSEC_SCP_IRQSTAT|ACL error]] IRQ.
+=== TSEC_SCP_SEC_ERR ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0
+| Unknown
+|-
+| 1-2
+| Unknown
+|-
+| 4
+| Unknown
+|-
+| 5-6
+| Unknown
+|-
+| 16
+| Unknown
+|-
+| 17-18
+| Unknown
+|-
+| 20
+| Unknown
+|-
+| 21-22
+| Unknown
+|-
+| 24
+| Unknown
+|-
+| 25-26
+| Unknown
+|-
+| 31
+| SEC error occurred
+|}
+=== TSEC_SCP_CMD_ERR ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0
+| Invalid command
+|-
+| 4
+| Empty crypto sequence
+|-
+| 8
+| Crypto sequence is too long
+|-
+| 12
+| Crypto sequence was not finished
+|-
+| 16
+| Forbidden signature operation (csigenc, csigclr or csigauth in NS mode)
+|-
+| 20
+| Invalid signature operation (csigauth in HS mode)
+|-
+| 24
+| Forbidden ACL change (cchmod in NS mode)
+|}
+Contains information on errors generated by the [[#TSEC_SCP_IRQSTAT|CMD error]] IRQ.
+=== TSEC_SCP_RND_CTL0 ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0-31
+| RND clock trigger lower limit
+|}
+=== TSEC_SCP_RND_CTL1 ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0-15
+| RND clock trigger upper limit
+|-
+| 16-31
+| RND clock trigger mask
+|}
+=== TSEC_TFBIF_CTL ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0
+| TSEC_TFBIF_CTL_CLR_BWCOUNT
+|-
+| 1
+| TSEC_TFBIF_CTL_ENABLE
+|-
+| 2
+| TSEC_TFBIF_CTL_CLR_IDLEWDERR
+|-
+| 3
+| TSEC_TFBIF_CTL_RESET
+|-
+| 4
+| TSEC_TFBIF_CTL_IDLE
+|-
+| 5
+| TSEC_TFBIF_CTL_IDLEWDERR
+|-
+| 6
+| TSEC_TFBIF_CTL_SRTOUT
+|-
+| 7
+| TSEC_TFBIF_CTL_CLR_SRTOUT
+|-
+| 8-11
+| TSEC_TFBIF_CTL_SRTOVAL
+|-
+| 12
+| TSEC_TFBIF_CTL_VPR
+|}
+=== TSEC_TFBIF_MCCIF_FIFOCTRL ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0
+| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVERRIDE
+|-
+| 1
+| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVERRIDE
+|-
+| 2
+| TSEC_TFBIF_MCCIF_FIFOCTRL_WRCL_MCLE2X
+|-
+| 3
+| TSEC_TFBIF_MCCIF_FIFOCTRL_RDMC_RDFAST
+|-
+| 4
+| TSEC_TFBIF_MCCIF_FIFOCTRL_WRMC_CLLE2X
+|-
+| 5
+| TSEC_TFBIF_MCCIF_FIFOCTRL_RDCL_RDFAST
+|-
+| 6
+| TSEC_TFBIF_MCCIF_FIFOCTRL_CCLK_OVERRIDE
+|-
+| 7
+| TSEC_TFBIF_MCCIF_FIFOCTRL_RCLK_OVR_MODE
+|-
+| 8
+| TSEC_TFBIF_MCCIF_FIFOCTRL_WCLK_OVR_MODE
+|}
+=== TSEC_TFBIF_MCCIF_FIFOCTRL1 ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0-15
+| TSEC_TFBIF_MCCIF_FIFOCTRL1_SRD2MC_REORDER_DEPTH_LIMIT
+|-
+| 16-31
+| TSEC_TFBIF_MCCIF_FIFOCTRL1_SWR2MC_REORDER_DEPTH_LIMIT
+|}
+=== TSEC_TFBIF_THROTTLE ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0-11
+| TSEC_TFBIF_THROTTLE_BUCKET_SIZE
+|-
+| 16-27
+| TSEC_TFBIF_THROTTLE_LEAK_COUNT
+|-
+| 30-31
+| TSEC_TFBIF_THROTTLE_LEAK_SIZE
+|}
+=== TSEC_TFBIF_DBG_STAT0 ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0
+| TSEC_TFBIF_DBG_STAT0_1K_TRANSFER
+|-
+| 1
+| TSEC_TFBIF_DBG_STAT0_RREQ_ISSUED
+|-
+| 2
+| TSEC_TFBIF_DBG_STAT0_WREQ_ISSUED
+|-
+| 3
+| TSEC_TFBIF_DBG_STAT0_TAGQ_ISSUED
+|-
+| 4
+| TSEC_TFBIF_DBG_STAT0_STALL_RDATQ
+|-
+| 5
+| TSEC_TFBIF_DBG_STAT0_STALL_RACKQ
+|-
+| 6
+| TSEC_TFBIF_DBG_STAT0_STALL_WREQQ
+|-
+| 7
+| TSEC_TFBIF_DBG_STAT0_STALL_WDATQ
+|-
+| 8
+| TSEC_TFBIF_DBG_STAT0_STALL_WACKQ
+|-
+| 9
+| TSEC_TFBIF_DBG_STAT0_STALL_RREQ_PENDING
+|-
+| 10
+| TSEC_TFBIF_DBG_STAT0_STALL_WREQ_PENDING
+|-
+| 11
+| TSEC_TFBIF_DBG_STAT0_STALL_MREQ
+|-
+| 12
+| TSEC_TFBIF_DBG_STAT0_ENGINE_IDLE
+|-
+| 13
+| TSEC_TFBIF_DBG_STAT0_RMCCIF_IDLE
+|-
+| 14
+| TSEC_TFBIF_DBG_STAT0_WMCCIF_IDLE
+|-
+| 15
+| TSEC_TFBIF_DBG_STAT0_CSB_IDLE
+|-
+| 16
+| TSEC_TFBIF_DBG_STAT0_RU_IDLE
+|-
+| 17
+| TSEC_TFBIF_DBG_STAT0_WU_IDLE
+|-
+| 19
+| TSEC_TFBIF_DBG_STAT0_UNWEIGHT_ACTMON_ACTIVE
+|-
+| 20
+| TSEC_TFBIF_DBG_STAT0_UNWEIGHT_ACTMON_MCB
+|}
+=== TSEC_TFBIF_SPROT_EMEM ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0-3
+| Read access level
+|-
+| 4-7
+| Write access level
+|}
+Controls accesses to external memory regions. Accessible in HS mode only.
+=== TSEC_TFBIF_TRANSCFG ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0
+| TSEC_TFBIF_TRANSCFG_ATT0_SWID
+|-
+| 4
+| TSEC_TFBIF_TRANSCFG_ATT1_SWID
+|-
+| 8
+| TSEC_TFBIF_TRANSCFG_ATT2_SWID
+|-
+| 12
+| TSEC_TFBIF_TRANSCFG_ATT3_SWID
+|-
+| 16
+| TSEC_TFBIF_TRANSCFG_ATT4_SWID
+|-
+| 20
+| TSEC_TFBIF_TRANSCFG_ATT5_SWID
+|-
+| 24
+| TSEC_TFBIF_TRANSCFG_ATT6_SWID
+|-
+| 28
+| TSEC_TFBIF_TRANSCFG_ATT7_SWID
+|}
+Configures the software ID per CTXDMA port for memory transactions. Software ID 0 (HW_SWID) forces all transactions to go through the SMMU while software ID 1 (PHY_SWID) bypasses it. Accessible in HS mode only.
+[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.
+=== TSEC_TFBIF_REGIONCFG ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0-2
+| TSEC_TFBIF_REGIONCFG_T0_APERT_ID
+|-
+| 3
+| TSEC_TFBIF_REGIONCFG_T0_VPR
+|-
+| 4-6
+| TSEC_TFBIF_REGIONCFG_T1_APERT_ID
+|-
+| 7
+| TSEC_TFBIF_REGIONCFG_T1_VPR
+|-
+| 8-10
+| TSEC_TFBIF_REGIONCFG_T2_APERT_ID
+|-
+| 11
+| TSEC_TFBIF_REGIONCFG_T2_VPR
+|-
+| 12-14
+| TSEC_TFBIF_REGIONCFG_T3_APERT_ID
+|-
+| 15
+| TSEC_TFBIF_REGIONCFG_T3_VPR
+|-
+| 16-18
+| TSEC_TFBIF_REGIONCFG_T4_APERT_ID
+|-
+| 19
+| TSEC_TFBIF_REGIONCFG_T4_VPR
+|-
+| 20-22
+| TSEC_TFBIF_REGIONCFG_T5_APERT_ID
+|-
+| 23
+| TSEC_TFBIF_REGIONCFG_T5_VPR
+|-
+| 24-26
+| TSEC_TFBIF_REGIONCFG_T6_APERT_ID
+|-
+| 27
+| TSEC_TFBIF_REGIONCFG_T6_VPR
+|-
+| 28-30
+| TSEC_TFBIF_REGIONCFG_T7_APERT_ID
+|-
+| 31
+| TSEC_TFBIF_REGIONCFG_T7_VPR
+|}
+Configures the aperture ID and VPR mode per CTXDMA port for memory region accessing. Accessible in HS mode only.
+[6.0.0+] The nvhost_tsec firmware sets this register to 0x20 or 0x140 before reading memory from the GPU UCODE carveout.
+=== TSEC_TFBIF_ACTMON_ACTIVE_MASK ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0
+| TSEC_TFBIF_ACTMON_ACTIVE_MASK_STARVED_MC
+|-
+| 1
+| TSEC_TFBIF_ACTMON_ACTIVE_MASK_STALLED_MC
+|-
+| 2
+| TSEC_TFBIF_ACTMON_ACTIVE_MASK_DELAYED_MC
+|-
+| 3
+| TSEC_TFBIF_ACTMON_ACTIVE_MASK_ACTIVE
+|}
+Takes the memory access mask for the Activity Monitor. Disconnected on the TSEC, but available on NVDEC, NVENC and NVJPG.
+=== TSEC_TFBIF_ACTMON_ACTIVE_BORPS ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0
+| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_STARVED_MC_POLARITY
+|-
+| 1
+| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_STARVED_MC_OPERATION
+|-
+| 2
+| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_STALLED_MC_POLARITY
+|-
+| 3
+| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_STALLED_MC_OPERATION
+|-
+| 4
+| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_DELAYED_MC_POLARITY
+|-
+| 5
+| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_DELAYED_MC_OPERATION
+|-
+| 6
+| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_ACTIVE_POLARITY
+|-
+| 7
+| TSEC_TFBIF_ACTMON_ACTIVE_BORPS_ACTIVE_OPERATION
+|}
+Takes the billions of records per second count for the Activity Monitor. Disconnected on the TSEC, but available on NVDEC, NVENC and NVJPG.
+=== TSEC_TFBIF_ACTMON_ACTIVE_WEIGHT ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0-31
+| TSEC_TFBIF_ACTMON_ACTIVE_WEIGHT_VAL
+|}
+Controls the Activity Monitor. Disconnected on the TSEC, but available on NVDEC, NVENC and NVJPG.
+=== TSEC_CG ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0-5
+| TSEC_CG_IDLE_CG_DLY_CNT
+|-
+| 6
+| TSEC_CG_IDLE_CG_EN
+|-
+| 16-18
+| TSEC_CG_WAKEUP_DLY_CNT
+|-
+| 19
+| TSEC_CG_WAKEUP_DLY_EN
+|}
+=== TSEC_BAR0_CTL ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0
+| TSEC_BAR0_CTL_READ
+|-
+| 1
+| TSEC_BAR0_CTL_WRITE
+|-
+| 4-7
+| TSEC_BAR0_CTL_BYTE_MASK
+|-
+| 12-13
+| TSEC_BAR0_CTL_STATUS
+: Idle
+: Busy
+: Error
+: Disabled
+|-
+| 31
+| TSEC_BAR0_CTL_INIT
+|}
+A BAR0 DMA read/write operation requires bits TSEC_BAR0_CTL_INIT and TSEC_BAR0_CTL_READ/TSEC_BAR0_CTL_WRITE to be set in TSEC_BAR0_CTL.
+During the transfer, TSEC_BAR0_CTL_STATUS is set to "Busy".
+Accessing an invalid address sets TSEC_BAR0_CTL_STATUS to "Error".
+=== TSEC_BAR0_ADDR ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0-31
+| TSEC_BAR0_ADDR_VAL
+|}
+Takes the address for DMA transfers between TSEC and HOST1X (master and clients).
+=== TSEC_BAR0_DATA ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0-31
+| TSEC_BAR0_DATA_VAL
+|}
+Takes the data for DMA transfers between TSEC and HOST1X (master and clients).
+=== TSEC_BAR0_TIMEOUT ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0-31
+| TSEC_BAR0_TIMEOUT_VAL
+|}
+Takes the timeout value for DMA transfers between TSEC and HOST1X (master and clients).
+=== TSEC_TEGRA_CTL ===
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 16
+| TSEC_TEGRA_CTL_TKFI_KFUSE
+|-
+| 17
+| TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
+|-
+| 24
+| TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
+|-
+| 25
+| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
+|-
+| 26
+| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
+|-
+| 27
+| TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C
+|}
+== Falcon ==
+"Falcon" (FAst Logic CONtroller) is a proprietary general purpose CPU which can be found inside various hardware blocks that require some sort of logic processing such as TSEC (TSECA and TSECB), NVDEC, NVENC, NVJPG, VIC, GPU PMU and XUSB.
+=== Processor Registers ===
+A total of 32 processor registers are available in the Falcon CPU.
+==== REG0-REG15 ====
+These are 16 32-bit GPRs (general purpose registers).
+==== IV0 ====
+This is a SPR (special purpose register) that holds the address for interrupt vector 0.
+==== IV1 ====
+This is a SPR (special purpose register) that holds the address for interrupt vector 1.
+==== IV2 ====
+This is a SPR (special purpose register) that holds the address for interrupt vector 2. This register is considered "UNDEFINED" and appears to be unused.
+==== EV ====
+This is a SPR (special purpose register) that holds the address for the exception vector.
+Alternative name (envytools): "tv".
+==== SP ====
+This is a SPR (special purpose register) that holds the current stack pointer.
+==== PC ====
+This is a SPR (special purpose register) that holds the current program counter.
+==== IMB ====
+This is a SPR (special purpose register) that holds the external base address for IMEM transfers.
+Alternative name (envytools): "xcbase".
+==== DMB ====
+This is a SPR (special purpose register) that holds the external base address for DMEM transfers.
+Alternative name (envytools): "xdbase".
+==== CSW ====
+This is a SPR (special purpose register) that holds various flag bits.
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0-7 || General purpose predicates
+|-
+| 8 || ALU carry flag
+|-
+| 9 || ALU signed overflow flag
+|-
+| 10 || ALU sign flag
+|-
+| 11 || ALU zero flag
+|-
+| 12-15 || Unused
+|-
+| 16 || Interrupt 0 enable
+|-
+| 17 || Interrupt 1 enable
+|-
+| 18 || Interrupt 2 enable (undefined)
+|-
+| 19 || Unused
+|-
+| 20 || Interrupt 0 saved enable
+|-
+| 21 || Interrupt 1 saved enable
+|-
+| 22 || Interrupt 2 saved enable (undefined)
+|-
+| 23 || Unused
+|-
+| 24 || Exception active
+|-
+| 25 || Unused
+|-
+| 26 || Unknown
+|-
+| 27-28 || Unused
+|-
+| 29 || Unknown
+|-
+| 30-31 || Unused
+|}
+Alternative name (envytools): "flags".
+==== CCR ====
+This is a SPR (special purpose register) that holds configuration bits for the SCP DMA override functionality. The value of this register is set using the "cxset" instruction which provides a way to change the behavior of a variable amount of successively executed DMA-related instructions ("xdwait", "xdst" and "xdld").
+{| class=wikitable
+! Bits || Description
+|-
+| 0-4 || Number of instructions the override is valid for (0x1F means infinite)
+|-
+| 5 || Crypto destination/source select
+: Crypto register
+: Crypto stream
+|-
+| 6 || External memory override
+: Disabled
+: Enabled
+|-
+| 7 || Internal memory select
+: DMEM
+: IMEM
+|-
+| 8-31 || Unused
+|}
+Alternative name (envytools): "cx".
+==== SEC ====
+This is a SPR (special purpose register) that holds configuration bits for the SCP authentication process.
+{| class="wikitable" border="1"
+!  Bits
+!  Description
+|-
+| 0-7 || Start of region to authenticate (in 0x100 pages)
+|-
+| 8-15 || Unused
+|-
+| 16 || Mark all subsequent code transfers as secret
+|-
+| 17 || Region is encrypted
+|-
+| 18 || Unknown (set in HS mode)
+|-
+| 19 || Block traps and interrupts (set in HS mode)
+|-
+| 20-23 || Unused
+|-
+| 24-31 || Size of region to authenticate (in 0x100 pages)
 |}
-Controls accesses to external memory at the MMU level. Accessible in HS mode only.
+Alternative name (envytools): "cauth".
-=== TSEC_TFBIF_MMU_PHYS_SEC ===
+==== CTX ====
-{| class="wikitable" border="1"
+This is a SPR (special purpose register) that holds configuration bits for the CTXDMA ports.
-!  Bits
-!  Description
-|-
-| 0
-| Bypass MMU translation on CTXDMA port 0
-|-
-| 4
-| Bypass MMU translation on CTXDMA port 1
-|-
-| 8
-| Bypass MMU translation on CTXDMA port 2
-|-
-| 12
-| Bypass MMU translation on CTXDMA port 3
-|-
-| 16
-| Bypass MMU translation on CTXDMA port 4
-|-
-| 20
-| Bypass MMU translation on CTXDMA port 5
-|-
-| 24
-| Bypass MMU translation on CTXDMA port 6
-|-
-| 28
-| Bypass MMU translation on CTXDMA port 7
-|}
-Controls MMU bypass mode. Accessible in HS mode only.
-[6.0.0+] The nvhost_tsec firmware sets this register to 0x10 or 0x111110 before reading memory from the GPU UCODE carveout.
-=== TSEC_TFBIF_MMU_TRANSCFG ===
 {| class="wikitable" border="1"
 !  Bits
 !  Description
 |-
-| 0-3
+| 0-2 || CTXDMA port for code loads (xcld)
-| Transfer configuration for CTXDMA port 0
 |-
-| 4-7
+| 3 || Unused
-| Transfer configuration for CTXDMA port 1
 |-
-| 8-11
+| 4-6 || CTXDMA port for code stores (invalid)
-| Transfer configuration for CTXDMA port 2
 |-
-| 12-15
+| 7 || Unused
-| Transfer configuration for CTXDMA port 3
 |-
-| 16-19
+| 8-10 || CTXDMA port for data loads (xdld)
-| Transfer configuration for CTXDMA port 4
 |-
-| 20-23
+| 11 || Unused
-| Transfer configuration for CTXDMA port 5
 |-
-| 24-27
+| 12-14 || CTXDMA port for data stores (xdst)
-| Transfer configuration for CTXDMA port 6
 |-
-| 28-31
+| 15-31 || Unused
-| Transfer configuration for CTXDMA port 7
 |}
-Controls external memory transfers' configuration at the MMU level. Accessible in HS mode only.
+Alternative name (envytools): "xtargets".
-[6.0.0+] The nvhost_tsec firmware sets this register to 0x20 or 0x140 before reading memory from the GPU UCODE carveout.
-=== TSEC_TFBIF_ACTMON_MAMASK ===
+==== EXCI ====
-Takes the memory access mask for the Activity Monitor. Disconnected on the TSEC, but available on NVDEC, NVENC and NVJPG.
+This is a SPR (special purpose register) that holds information on raised exceptions.
-=== TSEC_TFBIF_ACTMON_BORPS ===
-Takes the billions of records per second count for the Activity Monitor. Disconnected on the TSEC, but available on NVDEC, NVENC and NVJPG.
-=== TSEC_TFBIF_ACTMON_CTL ===
-Controls the Activity Monitor. Disconnected on the TSEC, but available on NVDEC, NVENC and NVJPG.
-=== TSEC_CG ===
 {| class="wikitable" border="1"
 !  Bits
 !  Description
 |-
-| 0-5
+| 0-19 || Exception PC
-| TSEC_CG_IDLE_CG_DLY_CNT
-|-
-| 6
-| TSEC_CG_IDLE_CG_EN
-|-
-| 16-18
-| TSEC_CG_WAKEUP_DLY_CNT
-|-
-| 19
-| TSEC_CG_WAKEUP_DLY_EN
-|}
-=== TSEC_DMA_CMD ===
-{| class="wikitable" border="1"
-!  Bits
-!  Description
-|-
-| 0
-| TSEC_DMA_CMD_READ
-|-
-| 1
-| TSEC_DMA_CMD_WRITE
 |-
-| 4-7
+| 20-23 || Exception cause
-| TSEC_DMA_CMD_BYTE_MASK
 |-
-| 12-13
+| 24-31 || Unused
-| TSEC_DMA_CMD_STATUS
-: Idle
-: Busy
-: Error
-: Disabled
-|-
-| 31
-| TSEC_DMA_CMD_INIT
 |}
-A DMA read/write operation requires bits TSEC_DMA_CMD_INIT and TSEC_DMA_CMD_READ/TSEC_DMA_CMD_WRITE to be set in TSEC_DMA_CMD.
+Alternative name (envytools): "tstatus".
-During the transfer, TSEC_DMA_CMD_STATUS is set to "Busy".
-Accessing an invalid address sets TSEC_DMA_CMD_STATUS to "Error".
+==== SEC1 ====
+Unknown. Marked as "RESERVED".
-=== TSEC_DMA_ADDR ===
+==== IMB1 ====
-Takes the address for DMA transfers between TSEC and HOST1X (master and clients).
+Unknown. Marked as "RESERVED".
-=== TSEC_DMA_DATA ===
+==== DMB1 ====
-Takes the data for DMA transfers between TSEC and HOST1X (master and clients).
+Unknown. Marked as "RESERVED".
-=== TSEC_DMA_TIMEOUT ===
-Always 0xFFF.
-=== TSEC_TEGRA_CTL ===
-{| class="wikitable" border="1"
-!  Bits
-!  Description
-|-
-| 16
-| TSEC_TEGRA_CTL_TKFI_KFUSE
-|-
-| 17
-| TSEC_TEGRA_CTL_TKFI_RESTART_FSM_KFUSE
-|-
-| 24
-| TSEC_TEGRA_CTL_TMPI_FORCE_IDLE_INPUTS_I2C
-|-
-| 25
-| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_HOST1X
-|-
-| 26
-| TSEC_TEGRA_CTL_TMPI_RESTART_FSM_APB
-|-
-| 27
-| TSEC_TEGRA_CTL_TMPI_DISABLE_OUTPUT_I2C
-|}
 == SCP ==
 Part of the information here (which hasn't made it into envytools documentation yet) was shared by [https://wiki.0x04.net/wiki/Marcin_Ko%C5%9Bcielnicki mwk] from reverse engineering falcon processors over the years.
-=== Authenticated Mode ===
+=== Heavy Secure Mode ===
 ==== Entry ====
 From non-secure mode, upon jumping to a page marked as secret, a secret fault occurs. This causes the CPU to verify the region specified in $cauth against the MAC loaded in $c6. If the comparison is successful, the valid bit (bit0) is set on all pages in the $cauth region, and $pc is set to the base of the $cauth region. If the comparsion fails, the CPU is halted.
@@ Line 2,776: / Line 3,839: @@
 ==== Implementation ====
-Under certain circumstances, it is possible to observe [[#csigauth|csigauth]] being briefly written to [[#TSEC_SCP_INSN_STAT|TSEC_SCP_INSN_STAT]] as "csigauth $c4 $c6" while the opcodes in [[#TSEC_SCP_AES_STAT|TSEC_SCP_AES_STAT]] are set to "cxsin" and "csigauth", respectively.
+Under certain circumstances, it is possible to observe [[#sigauth|sigauth]] being briefly written to [[#TSEC_SCP_CMD|TSEC_SCP_CMD]] as "csigauth $c4 $c6" while the opcodes in [[#TSEC_SCP_STAT2|TSEC_SCP_STAT2]] are set to "cxsin" and "csigauth", respectively.
-Via [[#TSEC_SCP_SEQ_CTL|TSEC_SCP_SEQ_CTL]] it can be observed that a 3-sized macro sequence is loaded into cs0 during a secure mode transition.
+Via [[#TSEC_SCP_DBG0|TSEC_SCP_DBG0]] it can be observed that a 3-sized macro sequence is loaded into cs0 during a secure mode transition.
 === Operations ===
@@ Line 2,797: / Line 3,860: @@
 | 3 || sout || $cX || N/A || <code>write_stream($cX);</code> || ?
 |-
-| 4 || rnd || $cX || N/A || <code>$cX = read_trng(); ACL(X) = ???;</code> ||
+| 4 || [[#rnd|rnd]] || $cX || N/A || <code>$cX = read_rnd(); ACL(X) = ???;</code> ||
 |-
 | 5 || s0begin || immX || N/A || <code>record_macro_for_N_instructions(0, immX);</code> ||
@@ Line 2,809: / Line 3,872: @@
 | 9 || <invalid> || || || ||
 |-
-| 0xA || chmod || $cX || immY || Complicated, see [[#ACL|ACL]]. ||
+| 0xA || [[#chmod|chmod]] || $cX || immY || Complicated, see [[#ACL|ACL]]. ||
 |-
 | 0xB || xor || $cX || $cY || <code>$cX ^= $cY;</code> || <code>(ACL(X) & 2) && (ACL(Y) & 2)</code>
@@ Line 2,833: / Line 3,896: @@
 | 0x15 || dec || $cX || $cY || <code>$cX = aes_dec(active_key_idx, $cY); ACL(X) = ACL(active_key_idx) & ACL(Y);</code> ||
 |-
-| 0x16 || csigauth || $cX || $cY || <code>if (hash_verify($cX, $cY)) { has_sig = true; current_sig = $cX; }</code> || ?
+| 0x16 || [[#sigauth|sigauth]] || $cX || $cY || <code>if (hash_verify($cX, $cY)) { has_sig = true; current_sig = $cX; }</code> || ?
 |-
-| 0x17 || csigclr || N/A || N/A || <code>has_sig = false;</code> ||
+| 0x17 || [[#sigclr|sigclr]] || N/A || N/A || <code>has_sig = false;</code> ||
 |-
-| 0x18 || csigenc || $cX || $cY || <code>if (has_sig) { $cX = aes_enc($cY, current_sig); ACL(X) = 0x13; }</code> ||
+| 0x18 || sigenc || $cX || $cY || <code>if (has_sig) { $cX = aes_enc($cY, current_sig); ACL(X) = 0x13; }</code> ||
 |}
-==== csigauth ====
+==== sigauth ====
 <code>00000000: f5 3c XY d8     csigauth $cY $cX</code>
 Takes 2 crypto registers as operands and is automatically executed when jumping to a code region previously uploaded as secret. This instruction does not work in secure mode.
-==== csigclr ====
+==== sigclr ====
 <code>00000000: f5 3c 00 e0     csigclr</code>
-This instruction takes no operands and appears to clear the saved cauth signature used by the csigenc instruction.
+This instruction takes no operands and clears the saved cauth signature used by the csigenc instruction.
-==== cchmod ====
+==== chmod ====
 <code>00000000: f5 3c XY a8     cchmod $cY 0X</code> or <code>00000000: f5 3c XY a9     cchmod $cY 1X</code>
 This instruction takes a crypto register and a 5 bit immediate value which represents the [[#ACL|ACL]] mask to set.
-==== crnd ====
+==== rnd ====
 <code>00000000: f5 3c 0X 90     crnd $cX</code>
 This instruction initializes a crypto register with random data.
-Executing this instruction only succeeds if the TRNG is enabled for the SCP, which requires taking the following steps:
+Executing this instruction only succeeds if the RNG controller is enabled for the SCP, which requires taking the following steps:
-* Write 0x7FFF to TSEC_TRNG_CLK_LIMIT_LOW.
+* Write 0x7FFF to [[#TSEC_SCP_RND_CTL0|TSEC_SCP_RND_CTL0]].
-* Write 0x3FF0000 to TSEC_TRNG_CLK_LIMIT_HIGH.
+* Write 0x3FF0000 to [[#TSEC_SCP_RND_CTL1|TSEC_SCP_RND_CTL1]].
-* Write 0xFF00 to TSEC_TRNG_CTL.
+* Write 0xFF00 to TSEC_SCP_RND_CTL11.
 * Write 0x1000 to [[#TSEC_SCP_CTL1|TSEC_SCP_CTL1]].
@@ Line 2,892: / Line 3,955: @@
 Loading a secret into $cX sets a per-secret ACL, unconditionally.
-=== cauth ===
-$cauth is a special purpose register in the CPU.
-{| class="wikitable" border="1"
-!  Bits
-!  Description
-|-
-| 0-7 || Start of region to authenticate (in 0x100 pages)
-|-
-| 8-15 || Unknown
-|-
-| 16 || Use secret xfers
-|-
-| 17 || Region is encrypted
-|-
-| 18 || Unknown (set in HS mode)
-|-
-| 19 || Block traps and interrupts (set in HS mode)
-|-
-| 20-23 || Unknown
-|-
-| 24-31 || Size of region to authenticate (in 0x100 pages)
-|}
-=== cxset ===
-cxset instruction provides a way to change behavior of a variable amount of successively executed DMA-related instructions.
-for example: <code>000000de: f4 3c 02              cxset 0x2</code>
-can be read as: <code>dma_override(type=crypto_reg, count=2)</code>
-The argument to cxset specifies the type of behavior change in the top 3 bits, and the number of DMA-related instructions the effect lasts for in the lower 5 bits.
-{| class=wikitable
-! Bits || Description
-|-
-| 0-4 || Number of instructions it is valid for (0x1f is a special value meaning infinitely many instructions -- until overriden by another cxset)
-|-
-| 5 || Crypto destination/source select (0=crypto register, 1=crypto stream)
-|-
-| 6 || External memory override (0=Disabled, 1=Enabled)
-|-
-| 7 || Internal memory select (0=DMEM, 1=IMEM)
-|}
-==== DMA-Related Instructions ====
-At least the following instructions may have changed behavior, and count against the cxset "count" argument: <code>xdwait</code>, <code>xdst</code>, <code>xdld</code>.
-For example, if override type=0b000, then the "length" argument to <code>xdst</code> is instead treated as the index of the target $cX register.
 === Secrets ===
-Falcon's Authenticated Mode has access to 64 128-bit keys which are burned at factory. These keys can be loaded by using the $csecret instruction which takes the target crypto register and the key index as arguments.
+Falcon's Heavy Secure Mode has access to 64 128-bit keys which are burned at factory. These keys can be loaded using the $csecret instruction which takes the target crypto register and the key index as arguments.
 Secrets are specific to each Falcon unit with the exception of secret 0x3F. This secret is effectively empty (all zeros), but is configured to be overwritten with the KFUSE private key once the KFUSE clock is enabled. The KFUSE private key is console-unique.
@@ Line 2,963: / Line 3,976: @@
 | 0x05 || 0x13 || Used by nvhost_tsec, nvhost_nvdec_bl020_prod, nvhost_nvdec020_prod, nvhost_nvdec020_ns and acr_ucode firmwares.
 |-
-| 0x06 || 0x11 ||
+| 0x06 || 0x11 || Used by the [[#SCP|SCP]] as key to encrypt/decrypt data during authentication (decided by bit 17 from the [[#SEC|SEC/cauth]] register).
 |-
 | 0x07 || 0x11 || Used by [6.0.0+] nvhost_tsec firmware.

Difference between revisions of "TSEC"

Latest revision as of 19:25, 12 June 2020

Contents

Driver

Registers

TSEC_THI_METHOD0

TSEC_THI_METHOD1

TSEC_THI_INT_STATUS

TSEC_THI_INT_MASK

TSEC_FALCON_IRQSSET

TSEC_FALCON_IRQSCLR

TSEC_FALCON_IRQSTAT

TSEC_FALCON_IRQMODE

TSEC_FALCON_IRQMSET

TSEC_FALCON_IRQMCLR

TSEC_FALCON_IRQMASK

TSEC_FALCON_IRQDEST

TSEC_FALCON_IRQDEST2

TSEC_FALCON_MAILBOX0

TSEC_FALCON_MAILBOX1

TSEC_FALCON_ITFEN

TSEC_FALCON_IDLESTATE

TSEC_FALCON_DEBUG1

TSEC_FALCON_DEBUGINFO

TSEC_FALCON_EXCI

TSEC_FALCON_SVEC_SPR

TSEC_FALCON_RSTAT0

TSEC_FALCON_RSTAT3

TSEC_FALCON_CPUCTL

TSEC_FALCON_BOOTVEC

TSEC_FALCON_HWCFG

TSEC_FALCON_DMACTL

TSEC_FALCON_DMATRFBASE

TSEC_FALCON_DMATRFMOFFS

TSEC_FALCON_DMATRFCMD

TSEC_FALCON_DMATRFFBOFFS

TSEC_FALCON_DMAPOLL_FB

TSEC_FALCON_DMAPOLL_CP

TSEC_FALCON_HWCFG1

TSEC_FALCON_IMCTL

TSEC_FALCON_IMSTAT

TSEC_FALCON_TRACEIDX

TSEC_FALCON_TRACEPC

TSEC_FALCON_IMEMC0

TSEC_FALCON_IMEMD0

TSEC_FALCON_IMEMT0

TSEC_FALCON_DMEMC0

TSEC_FALCON_DMEMD0

TSEC_FALCON_ICD_CMD

TSEC_FALCON_ICD_ADDR

TSEC_FALCON_ICD_WDATA

TSEC_FALCON_ICD_RDATA

TSEC_FALCON_SCTL

TSEC_FALCON_SSTAT

TSEC_FALCON_SPROT_IMEM

TSEC_FALCON_SPROT_DMEM

TSEC_FALCON_SPROT_CPUCTL

TSEC_FALCON_SPROT_MISC

TSEC_FALCON_SPROT_IRQ

TSEC_FALCON_SPROT_MTHD

TSEC_FALCON_SPROT_SCTL

TSEC_FALCON_SPROT_WDTMR

TSEC_SCP_CTL0

TSEC_SCP_CTL1

TSEC_SCP_CTL_STAT

TSEC_SCP_CTL_LOCK

TSEC_SCP_CFG

TSEC_SCP_CTL_SCP

TSEC_SCP_CTL_PKEY

TSEC_SCP_CTL_DBG

TSEC_SCP_DBG0

TSEC_SCP_DBG1

TSEC_SCP_DBG2

TSEC_SCP_CMD

TSEC_SCP_STAT0

TSEC_SCP_STAT1

TSEC_SCP_STAT2

TSEC_SCP_RNG_STAT0

TSEC_SCP_RNG_STAT1

TSEC_SCP_IRQSTAT