Apple Silicon HAL Batch 9: NVMe Scheduler, ANE Scheduler, HW Crypto, RTKit FW + PPC SPR, Cache, DBDMA, TLB

sigil-kernel's ninth HAL batch adds 8 more seams — Apple: NVMe I/O scheduler (ANS2/ANS3, 4 submission queues, 8-deep rings), ANE command scheduler (2 engines, 4-TD ring, RTKit-style), hardware crypto engine (AES-128 ECB + SHA-256 word-accumulator), RTKit firmware lifecycle (16 endpoints, HELLO/ACK handshake, crash recovery). PowerPC: SPR register file (HID0/MSR/SRR0-SRR1/XER/DSISR/DAR, cache-enable and MMU-translation helpers), L1 cache control (ICBI/DCBST/DCBF/DCBZ, 128-line model, DMA-coherency and self-modifying-code flush patterns), DBDMA (8 channels, INPUT_MORE/INPUT_LAST/OUTPUT_LAST/STOP descriptor ring), TLB + SLB (64-entry TLB tlbie/tlbia, G5 64-entry SLB slbie/slb_fill). All QEMU PASS. (0b39c9a, 9bf38c8, 061496c, 0e441a9)

Apple Silicon HAL QEMU batch verification

Apple Silicon seams

apple_nvme_sched.sg (9bf38c8) — ANS2/ANS3 NVMe I/O scheduler

The ANS2/ANS3 NVMe controller is an internal Apple fabric — not a standard PCIe NVMe. The scheduler seam models the queue dispatch interface that the kernel uses to submit reads/writes to internal SSD.

4 Submission Queues: admin, high-priority, default, low-priority. 8-deep ring each.
submit(opcode, nsid, lba, cnt) — enqueue to SQ ring, return cmd_id.
complete() — dequeue CQE (status/sq_head/cmd_id), decrement inflight.
Inflight tracking per-queue. Base: 0x45A000.

NVSCH init=1 sub=1 cmp=1

apple_ane_sched.sg (061496c) — Apple Neural Engine command scheduler

The ANE scheduler follows the same lifecycle model as apple_rtkit_fw — RTKit-style handshake governs engine boot and command dispatch.

2 ANE engines (M1 has 2 ANE cores). 4-TD (task descriptor) ring per engine.
TD fields: netid (model identifier), inlen/outlen (DMA buffer lengths), flags.
submit() / complete() with CMP status + cycles counter. Error counter tracks failed completions.
Base: 0x45C000.

ANE_S init=1 sub=1 cmp=1

apple_cryptoeng.sg (0b39c9a) — M1 AES/SHA hardware accelerator seam

The additive AES/SHA models are verifiable stubs — real silicon behavior replaces them at the seam; no component file changes needed when targeting real hardware.

AES-128 ECB: encrypt (toy additive model: each byte += round_key) + decrypt (subtract). Round-trip verifiable.
SHA-256: 8 digest word slots, additive word accumulator over input blocks.
BUSY/DONE status — the seam models the polling contract real drivers use. Base: 0x458000.

CE init=1 aes=1 sha=1

apple_rtkit_fw.sg (0e441a9) — RTKit firmware lifecycle seam

RTKit is Apple's co-processor IPC framework — it governs AOP/SEP/ISP/ANE mailboxes. Every Apple-specific subsystem that uses a co-processor (audio, camera, biometric) boots via RTKit. This seam models the kernel's firmware management interface.

16 endpoint slots matching M1 RTKit mailbox topology.
Per-EP state machine: IDLE → LOADING → BOOTED → CRASHED.
HELLO/HELLO_ACK handshake sequence. n_booted count.
Crash recovery: if crash_counter < 5, re-load firmware (LOADING→BOOTED). If ≥5, stays CRASHED.
Base: 0x45E000.

RTKFW init=1 boot=1 rec=1

PowerPC seams

ppc_spr.sg (9bf38c8) — G3/G4/G5 SPR register file

HID0: ICE/DCE/EMCP/BHT bits — cache and branch predictor control.
MSR: ME/EE/PR/FP/IR/DR — machine state: exception mode, FP enable, address translation.
SRR0/SRR1: exception save/restore registers. XER, DSISR, DAR.
Helpers: ppc_hid0_enable_caches() (set ICE+DCE), ppc_msr_enable_tr() (set IR+DR). Base: 0x45B000.

SPR init=1 cch=1 srr=1

ppc_cache.sg (061496c) — G3/G4/G5 L1 cache operations

128-line state model: INVALID / CLEAN / DIRTY.
ICBI — instruction cache block invalidate (for self-modifying code).
DCBST (data cache block store), DCBF (flush), DCBZ (zero — fill cache line without reading from memory).
DMA-coherency flush pattern: DCBST + ICBI on mapped buffer.
Self-modifying-code pattern: write code → DCBF → ICBI → sync. Base: 0x45D000.

L1C init=1 flu=1 icbi=1

ppc_dbdma.sg (0b39c9a) — G3/G4 DBDMA (descriptor-based DMA)

8 channels, each with a descriptor ring.
Descriptor types: INPUT_MORE (continue), INPUT_LAST (end of input), OUTPUT_LAST (write+stop), STOP (halt channel).
CH_CTRL/STAT/CMD/XFER registers. run/tick/stop lifecycle.
Base: 0x459000.

DBDMA init=1 desc=1 run=1

ppc_tlb.sg (0e441a9) — G3/G4/G5 TLB + G5 SLB

TLB: 64 entries, tlbie (invalidate entry by EA), tlbia (invalidate all). fill/lookup/count-valid.
G5 SLB: 64 ESID/VSID entry pairs, slbie (invalidate by ESID), slb_fill. Base: 0x45F000.

TLB init=1 inv=1 slb=1

Batch 9 at a glance

Seam	Arch	Base	Commit	PASS
`apple_cryptoeng.sg`	Apple Silicon	`0x458000`	`0b39c9a`	CE init=1 aes=1 sha=1
`ppc_dbdma.sg`	PowerPC	`0x459000`	`0b39c9a`	DBDMA init=1 desc=1 run=1
`apple_nvme_sched.sg`	Apple Silicon	`0x45A000`	`9bf38c8`	NVSCH init=1 sub=1 cmp=1
`ppc_spr.sg`	PowerPC	`0x45B000`	`9bf38c8`	SPR init=1 cch=1 srr=1
`apple_ane_sched.sg`	Apple Silicon	`0x45C000`	`061496c`	ANE_S init=1 sub=1 cmp=1
`ppc_cache.sg`	PowerPC	`0x45D000`	`061496c`	L1C init=1 flu=1 icbi=1
`apple_rtkit_fw.sg`	Apple Silicon	`0x45E000`	`0e441a9`	RTKFW init=1 boot=1 rec=1
`ppc_tlb.sg`	PowerPC	`0x45F000`	`0e441a9`	TLB init=1 inv=1 slb=1