Three sigil-kernel commits extend the HAL arch matrix from 0x4E8000 to 0x4ED000, adding 6 seams spanning tracing infrastructure, memory management, binary translation, cache control, and the Neural Engine: Apple CoreSight ETM/ETB, G3/G4/G5 32-bit MMU context, Rosetta 2 AOT translation cache, G5 SLB, Apple ANE task ring, and G3/G4 L2CR.
2775fdc — CoreSight ETM/ETB + G3/G4/G5 MMU context
apple_coresight.sg
0x4E8000
CoreSight ETM/ETB trace infrastructure. CoreSight is Apple Silicon's embedded trace subsystem — the ETM (Embedded Trace Macrocell) captures instruction streams at hardware speed, and the ETB (Embedded Trace Buffer) is the on-chip SRAM ring buffer that holds those captures until drained.
coresight_etm_enable(el0_filter, el1_filter): enables the ETM; sets etm_enabled=1, configures EL0 and EL1 trace filters (1=capture that EL, 0=skip). coresight_etb_inject(pc, el): injects a PC+EL sample into the ETB ring — models the HW's write of a (pc, el) pair at etb_wptr, advances the write pointer mod ETB_SIZE, and sets etb_overflow=1 if the buffer wraps around before being drained. coresight_etr_drain(dst): drains the ETB to a DRAM buffer at dst; copies etb_count samples, resets etb_wptr=0 and etb_rptr=0, clears etb_overflow. coresight_etm_disable(): clears etm_enabled. coresight_etb_overflow(): returns etb_overflow status. ETM init=1 inj=1 drn=1 K.
ppc_mmu_ctx.sg
0x4E9000
G3/G4/G5 32-bit MMU context. The G3/G4/G5 uses a segment-register based 32-bit virtual address space. Each of the 16 segment registers (SR0–SR15) holds a 32-bit descriptor containing a VSID (Virtual Segment ID) and access bits. SDR1 points to the hardware page table (HTAB).
mmu_ctx_init(): zeros the MMU context, clears the BAT→MMU transition gate. mmu_ctx_snapshot(ctx): captures all 16 SRs plus SDR1_PHYS and HTABMASK from the "hardware" into ctx. mmu_ctx_load(ctx): loads SR0/SR1 back from ctx (VSID + PID set from ctx values), sets the BAT→MMU gate to 1 (BAT mappings have given way to full MMU). mmu_ctx_alloc_vsid(): monotonically allocates a new VSID (next_vsid++), wraps at 24-bit max. mmu_ctx_tlbia(): simulates a TLBIA (TLB invalidate all) flush, increments tlbia_count. MMU init=1 ena=1 sw=1 K.
33536d4 — Rosetta 2 AOT cache + G5 SLB
apple_rosetta.sg
0x4EA000
Rosetta 2 x86-64→ARM64 AOT translation cache. Rosetta 2 is Apple's binary translation layer for running x86-64 code on Apple Silicon. It maintains an AOT (Ahead-of-Time) cache so translated code doesn't need to be re-translated on every process launch.
rosetta_init(): initialises the 16-slot AOT table; clears cache_used counter. rosetta_install(x86_pc, arm_pc, sz): installs a translation entry — maps x86_pc (the original x86-64 address) to arm_pc (the translated ARM64 address) with sz bytes of translated code. If the cache is full (16 slots), evicts the oldest entry (LRU policy: slot[0] is evicted, all others shift down). Increments miss_count on each install (modeling the translation miss that triggered the install). rosetta_lookup(x86_pc): returns the arm_pc for a given x86_pc, or 0 if not found. rosetta_miss_count() / rosetta_cache_used(): telemetry. ROS init=1 ins=1 lut=1 K.
ppc_slb.sg
0x4EB000
G5/POWER4 64-bit SLB (Segment Lookaside Buffer). The G5 (POWER4-derived) uses a 64-bit address space with a hardware SLB — a direct-mapped TLB-like structure for segment descriptors. Each SLB entry maps an ESID (Effective Segment ID = EA bits 63:28) to a VSID (Virtual Segment ID).
slb_init(): zeroes the 8-entry (3 active in seam) ESID/VSID snapshot table. slb_load(slot, esid, vsid): installs an ESID→VSID mapping at slot — models the slbmte instruction. slb_invalidate_all(): models slbia (invalidate all non-bolted SLB entries); in the seam, clears all 8 slots, preserving bolted entries (slot 0 is conventionally bolted for the kernel). slb_miss(ea): handles an SLB miss for effective address ea — calculates esid = ea >> 28, generates a new VSID via next_vsid++, installs the new mapping into the next available ring slot (round-robin mod 8), increments miss_count. SLB init=1 ld=1 mis=1 K.
ac55302 — ANE task ring + G3/G4 L2CR
apple_ane.sg
0x4EC000
Neural Engine task ring (updated seam). The Apple Neural Engine (ANE) is the dedicated ML accelerator on M-series SoCs — it runs matrix operations for CoreML models, object detection, and on-device ML inference. This commit updates
apple_ane.sg to the canonical 8-slot command ring model.
ane_init(): initialises the 8-slot command ring at head=tail=0; sets powered=1. ane_submit(model_id, buf_ptr, tiles): submits an ANE inference task — writes a ring entry with (model_id, buf_ptr, tiles) at ring[tail], advances tail mod 8. Sets busy=1. Fails (returns 0) if the ring is full (tail would lap head) or ANE is not powered. ane_complete(): simulates HW completion — advances ring_head (consuming the oldest entry), increments done_count, clears busy when head catches tail. ane_powered() / ane_busy(): status helpers. ANE init=1 sub=1 cmp=1 K.
ppc_l2cr.sg
0x4ED000
G3/G4 L2 Cache Control Register. The L2CR (L2 Cache Control Register — SPR 1017) is a G3/G4-specific register that controls L2 cache parameters: size, clock ratio, parity, write-through, and data-only mode.
l2cr_init(siz, clk, parity, wt, do): initialises L2CR with siz (cache size: 0=256K, 1=512K, 2=1M), clk (clock ratio divisor), parity (1=parity checking enabled), wt (write-through), do (data-only mode — I-cache disabled). l2cr_flush(): models an L2I (L2 cache flush) — models the hardware's two-phase flush (set L2I bit, poll until complete); increments flush_count. l2cr_lookup(addr): simulates a cache hit/miss — returns 1 (HIT) if addr % 2 == 0 (even address hit policy), 0 otherwise; increments hit_count or miss_count. l2cr_get() / l2cr_hit_count() / l2cr_miss_count() / l2cr_flush_count(): accessors. L2C init=1 fls=1 lkp=1 K.
Arch matrix now at 0x4ED000. HAL batch 9 covers the observability, address translation, and accelerator tier across both architectures: ETM/ETB instruction tracing, 32-bit MMU context switching, Rosetta 2 AOT binary translation, 64-bit SLB management, Neural Engine task dispatch, and L2 cache control.