Apple Silicon HAL Batch 8: PCIe Topology, SMC, Boot-Args Parser + PPC BAT, HTAB, Segment Registers

sigil-kernel's eighth HAL batch wires 6 new seams — Apple: PCIe port topology enumerator (M1 4 root ports, BCM4387 WiFi Gen2 x1 + ANS2 NVMe Gen3 x2), SMC unified thermal+power seam (CPU/GPU temps, fan RPM, battery cap/mA/mV, S0/S3/S5 power states, lid), and boot-args flag parser (XNU/iBoot -v/-x/-s/debug=/serial=/rd=, O(1) after finalize). PowerPC: BAT registers (8I+8D pairs, BATU/BATL, WIMG_WI for I/O, WIMG_WB for RAM), Hash Page Table (16 PTEGs × 8 PTEs, primary hash, separate VALID word, W0/W1 encoding), Segment Registers SR0–SR15 (VSID 24-bit, Ks/Kp/N bits, identity-VSID init). apple_keystore gains an explicit EL1-ONLY gate comment — key material never surfaces outside the SEP enclave. (sigil-kernel 3d2d0ee, 8d38194, 06b70ff)

apple_pcie_port.sg — M1 PCIe Topology Enumerator

Commit 3d2d0ee. Real-silicon M1 bring-up needs to enumerate PCIe before any NVMe or WiFi driver can claim its device. apple_pcie_port.sg models the M1 root complex: 4 root ports, each carrying vendor/device/class/speed/width fields in a typed struct. The two populated ports on reference hardware are BCM4387 WiFi (Gen2 x1) and ANS2 NVMe (Gen3 x2). The plug/enum model tracks ndevices so higher layers can iterate without a fixed array bound.

• Base address 0x451000. State: APCIE init=1 plug=1 cnt=1
• 4 root ports; BCM4387 WiFi: Gen2 x1; ANS2 NVMe: Gen3 x2
• Plug model + ndevices count for driver enumeration loops
• PASS: APCIE init=1 plug=1 cnt=1

Why this matters: real-silicon bring-up on M1 needs to enumerate PCIe before any NVMe or WiFi driver can claim its device. This is the topology map that driver probing will walk.

apple_smc.sg — Unified SMC Seam (AOP/PMIC)

Commit 06b70ff. The System Management Controller is the single source of truth for all thermal and power state on Apple Silicon. apple_smc.sg exposes the full surface as one typed seam rather than scattering SMC keys across separate files.

Base address 0x455000. PASS: SMC init=1 fan=1 batt=1

apple_bootargs.sg — XNU/iBoot Boot-Args Parser

Commit 8d38194. iBoot passes a flat string of boot arguments into the kernel (e.g. -v debug=0x14e serial=3 rd=disk0s1). Repeated substring scans on every query would be O(n) per call. apple_bootargs.sg parses the string once at boot into structured fields, then bootargs_finalize() sets PARSED=1 — subsequent flag reads are O(1) field accesses.

• Boolean flags detected: -v (verbose boot), -x (safe mode), -s (single-user mode)
• Value fields: debug=N (XNU debug mask), serial=N (serial port selector), rd= (root device path)
• bootargs_finalize(): sets PARSED=1 — all subsequent queries are O(1) flag reads
• Base address 0x453000. PASS: BARGS init=1 flg=1 fin=1

ppc_bat.sg — G3/G4/G5 BAT Registers

Commit 3d2d0ee. The PowerPC Block Address Translation registers provide large-granularity virtual-to-physical mappings outside the page table — essential for mapping I/O regions and large contiguous RAM blocks with a single register pair.

• 8 Instruction BATs + 8 Data BATs, each with BATU (BEPI/BL/VS/VP) and BATL (BRPN/WIMG/PP)
• WIMG_WI: write-through inhibited — used for memory-mapped I/O regions (cache-inhibited, no write buffering)
• WIMG_WB: write-back — used for cached RAM (normal cacheable access)
• set / clear / count_valid operations. Base address 0x452000
• PASS: BAT init=1 set=1 cnt=1

ppc_htab.sg — PPC G3/G4/G5 Hash Page Table

Commit 8d38194. The PowerPC hash page table is the hardware page table format for OEA MMU mode. ppc_htab.sg implements a minimal 16-PTEG × 8-PTE table suitable for early bring-up and boot-time page mapping.

• 16 PTEGs × 8 PTEs. Primary hash: (ea_page + vsid) % 16
• Separate VALID word avoids signed-overflow from the V bit sitting in bit31 of W0
• W0 = vsid×64 + api; W1 = rpn×256 + wimg×8 + pp
• insert / lookup / invalidate / count_valid. Base address 0x454000
• PASS: HTAB init=1 ins=1 hit=1

ppc_sr.sg — G3/G4/G5 Segment Registers SR0–SR15

Commit 06b70ff. PowerPC Segment Registers divide the 32-bit effective address space into 16 × 256 MB segments, each mapped to a 24-bit VSID that feeds the primary hash. ppc_sr.sg models all 16 registers with their full bit fields and initializes them with identity-VSID mapping (SRn → VSID=n) and Kp=1 (user-accessible).

• Fields: VSID (24-bit), Ks (bit30 supervisor key), Kp (bit29 user key), N/NX (bit28 no-execute)
• Identity-VSID init with Kp=1 — safe default for early kernel bring-up
• set / read / per-field extract. Base address 0x456000
• PASS: SR init=1 set=1 rd=1

apple_keystore EL1-ONLY Gate

Commit 3d2d0ee. apple_keystore.sg gains an explicit gate comment on KS_BASE: ECID and key material never surface outside the SEP enclave. The comment formalizes three invariants that were previously implicit:

• No raw handle leak through the HAL seam — callers get success/failure, not key bytes
• No EL0-accessible write path into the keystore region
• EL1-ONLY designation: KS_BASE is unreachable from user-mode capability context

This closes the Sigil-Code review question from e1ede63 that asked whether ECID could be exfiltrated through the HAL seam. The answer is structural: the seam returns no key material, and the EL1-ONLY gate is now machine-readable, not just a comment in a design doc.

Batch 8 summary