Apple Silicon HAL Batch 7: DDC/EDID, Grand Central IRQ, Secboot Hard Stop Fix + DEADFACE Correction

sigil-kernel's seventh HAL batch adds two new seams — Apple DDC/CI + EDID (monitor identity: Apple Pro Display XDR 6016×3384, Dell 4K 3840×2160/144Hz) and PPC Grand Central IRQ (32 sources, ADB/ETH/IDE/TMR bit positions, bit-scan lowest pending). Two critical correctness fixes also land: apple_secboot replaces its unconditional VERIFIED=1 stub with real FNV-inspired hash verification (tamper test: corrupt a stage word → chain broken → finalize returns 0), and apple_panic corrects the DEADFACE magic constant (was 3735945918, now 3735943886 = real 0xDEADFACE). (sigil-kernel effc5d3, f551314, 6dfc207)

apple_ddc.sg — DDC/CI + EDID seam (effc5d3)

apple_ddc.sg models the Display Data Channel / Command Interface + EDID seam at 0x44F000. EDID exposes the monitor's identity to the OS so the compositor can select correct timings and pixel geometries.

EDID fields modeled:

• Manufacturer ID (4-char code): Apple = 0x0610, Dell = 0x0D4C
• Product code, manufacture year
• Physical dimensions: width/height in mm
• Sync frequencies: hsync and vsync ranges

Two monitors are modeled:

The seam includes a full connect/disconnect lifecycle. Test result: PASS: DDC init=1 edid=1 dsp=1.

ppc_gc_irq.sg — G3/G4 Grand Central IRQ controller (effc5d3)

ppc_gc_irq.sg models the Grand Central interrupt controller used in G3/G4 PowerPC systems, at 0x450000. The controller manages 32 interrupt sources via EVENTS and MASK registers.

Modeled bit positions:

• Bit 0: ADB (Apple Desktop Bus)
• Bit 1: ETH (Ethernet)
• Bit 2: IDE (disk)
• Bit 3: TMR (timer)

The seam supports inject/enable/clear per source. The dispatch routine performs a bit-scan for the lowest pending+enabled IRQ with no overflow, returning GC_NO_IRQ=99 as a sentinel when no IRQ is pending. Test result: PASS: GCIRQ init=1 inj=1 clr=1.

apple_secboot: hard stop fix (6dfc207)

The prior apple_secboot.sg was a chain-of-trust lie — it unconditionally set VERIFIED=1 for all stages with made-up constants. This is worse than no verification: it creates false trust. A boot chain that always reports VERIFIED regardless of image content provides no security guarantee and misleads every layer above it about the integrity of the loaded firmware. The HAL must match what silicon does.

The fix implements genuine verification across three functions:

secboot_finalize() returns 0 if the chain is broken OR if stages_done < 4. Both conditions independently block finalization.

The tamper test demonstrates both paths:

• Step 2: 4 images loaded, hashes seeded, all 4 verify → chain complete, finalize returns 1.
• Step 3: Tamper stage 2 word 0 (9999→99999) → hash mismatch → FAIL, chain broken, finalize=0.

EL0 access is structurally blocked — no write-path is exposed through the HAL seam. Test result: SBOOT init=1 chain=1 tamp=1.

DEADFACE constant fix + chipid EL0 gate (f551314)

apple_panic.sg carried PANIC_MAGIC_VAL = 3735945918 — that is 0xDEADFBEE, off by 2032 from the real value. The correct constant is 0xDEADFACE = 3735943886. The magic value is what hardware uses to identify a valid panic slot in the crash-log ring — a wrong value would fail to trigger the panic-log recovery path on real silicon, silently dropping crash records.

Fixed to 3735943886. The self-consistent test still PASS.

Additionally, apple_chipid.sg gains an explicit EL1-ONLY gate comment on CHIPID_BASE, documenting that the ECID (Electrically Programmable Chip ID) is not EL0-readable and that there is no runtime fuse-write path. This documentation was raised by Sigil-Code review of b22b32a and closes that review thread.

Batch 7 summary