Appendix C. Decoded reference tables

This appendix collects the decoded values cited throughout the guide into one reference: enum tokens, struct layouts, status codes, the register-init table, command table, register map, and program-container schema. Each section begins with its table and names the research-corpus file that contains the full set when only a representative excerpt is reproduced here.

Each section reproduces the representative and structurally important rows of a larger table. Where a table runs to hundreds or thousands of rows, the full set is in the research corpus and the section names the file that contains it. Every value here is read out of an M1/H13 binary by static analysis.

C.1 Operation-attribute enum tokens to integer values

These are the integer codes the compiler resolves attribute string tokens to. Table C.1 is the front-end activation token map (MILOpConverter::NeuronTypeFromString, 33 entries, miss resolves to 0).

Table C.1. The front-end activation token names and the integer neuron codes they resolve to.

The serialization dtype enum (ANECIRDataType, the dtype / storage_type attribute) is an 11-code space, given as table C.2.

Table C.2. The serialization data-type codes and the element types they name.

The MLIR symbolize* enums are a length-dispatched chain of packed integer string compares, fully static, each miss resolving to 0, collected in table C.3.

Table C.3. The symbolized attribute tokens and the integer values each one maps to.

A second class of enum is in a packed pointer table in the data segment, the internal Zin enums the lowering layer dispatches on, listed in table C.4.

Table C.4. The internal Zin enum value-to-token maps the lowering layer dispatches on.

The op-class selector is the ZinUnitType table, 79 entries, the engine-unit each layer routes to, given in full as table C.5.

Table C.5. The complete 79-entry ZinUnitType op-class table and the engine unit each value selects.

The activation non-linear-mode space is a parallel table, NonLinearModeToString, 48 slots indexed directly by the lower hardware mode value, reproduced as table C.6.

Table C.6. The complete 48-slot NonLinearModeToString table indexed by hardware non-linear-mode value.

The micro-op opcode space (ZinIrOpLayerOpCodeType, 126 codes, 0x00..0x7d) has the codes the task-descriptor builder dispatches on, given in full as table C.7.

Table C.7. The complete 126-entry micro-operation opcode table and the layer-kind name each value dispatches on.

The opcode 0x3f is spelled AFFINE_TRANFORM in the binary, a vendor source typo preserved on the wire.

C.2 Operation-attribute schema and IOKit external-method struct layouts

The attribute schema is string-keyed: the token is the wire encoding the compiler matches on, and most integer constants are not recoverable statically. The converter recognizes 171 literal attribute keys, of which roughly 140 are op-facing. Table C.8 gives representative keys with their value types, meanings, and wire encodings.

Table C.8. Representative operation-attribute keys with their value types, meanings, and wire encodings.

The host-to-kernel IOKit dispatch key is the (selector, struct-size) tuple, not the selector alone. Table C.9 gives the control-client selectors with their method names and decoded input and output struct sizes.

Table C.9. The IOKit control-client selectors with their method names and decoded input and output struct sizes.

The ANEDeviceOpen shared in/out buffer (104 bytes, selector 0) decodes by byte offset as table C.10.

Table C.10. The field layout of the ANEDeviceOpen shared input and output buffer by byte offset.

The full 171-key attribute corpus, the decoded enum-value tables, and the per-selector field layouts for the HW direct-path client are in the research corpus.

C.3 Numeric error, status, and return codes

The ANE stack has no flat numeric status enum. The fixed numeric values that exist are the IOKit return constants and the firmware magic and sentinel words, the first of which table C.11 gives with their meanings on the dispatch path.

Table C.11. The IOKit return constants and their meanings on the engine dispatch path.

At every layer the error surface is name-based or message-based. The client-visible surface above IOKit is an error factory that wraps the lower-layer code into a structured error across four domains, named errorDomainCompiler, errorDomainEspresso, errorDomainGeneric, and errorDomainVirtIO. Its factory methods are the taxonomy: a generic wrapper, a missing-code-signing form, program-load and new-instance-load forms that hold the lower-layer code, surface map and unmap forms, and a virtualization-kernel form. The single most look-up-worthy client-visible value is 0xe00002c7 (kIOReturnUnsupported), returned on a disabled or unsupported path and when a gated feature's entitlement is absent.

Table C.12 gives the fixed firmware magic words and sentinel constants with their meanings.

Table C.12. The fixed firmware magic words and sentinel constants with their meanings.

This section shows the three loader magic words as 32-bit integers; on disk the bytes are little-endian, so a raw byte scan finds HENA, PENA, and SENA (the characters of ANEH, ANEP, ANES reversed). The firmware-to-host notification names, inline status=0x%x print sites, AArch64 and L2C fault-register dump fields, and compiler diagnostic categories are in the research corpus.

C.4 The tunable register-init table

The per-chip register init is a sequence of 12-byte (offset, mask, value) records, each applied as a masked read-modify-write, reg = (reg & ~mask) | value, where reg is the block MMIO base plus the offset. The M1 (ASC AscChinook) firmware has 1994 records across 10 named MMIO blocks, each block reached through a 32-byte descriptor of name, MMIO base, record pointer, and count, the blocks and their counts given in table C.13.

Table C.13. The named MMIO register-init blocks with their bases and record counts.

Table C.14 gives representative records, one or more per block, with their address, mask, value, and meaning.

Table C.14. Representative register-init records with their address, mask, value, and meaning.

The 32 mask=1 value=1 records at a regular stride are direct evidence of the 32-tile MAC array geometry, each tile individually clock and power gateable. The DPE system block has seven ascending sampling thresholds (25, 50, 70, 85, 95, 105, 115), and the SoC leakage-estimation block has eight (10, 22, 39, 64, 89, 121, 164, 189): the firmware-side breakpoints of the power model. All 1994 decoded records are in the research corpus.

C.5 The CSNE_CMD_* numeric command table

The host-to-firmware command set is 93 entries, numbered 0x00 through 0x5c, indexed by eCSneCmdId into the firmware command-name string table, whose index is the numeric command identifier. 0xFFFFFFFF is the no-command sentinel. Table C.15 gives the full set; its dir column is H->FW for a host request and FW->H for a firmware notification, and the subsystem codes are lifecycle, power, secure, program, execution, cache, ipc, buffer, property, and stats.

Table C.15. The complete 93-entry host-to-firmware command table with name, direction, subsystem, and purpose.

Two strings the prior corpus counted have no numeric identifier: CSNE_CMD_START is a standalone lifecycle log alias, and CSNE_CMD_IPC_ENDPOINT_TYPE_DATA_CHAINING is an endpoint-type enum value rather than a command. The per-call numeric limits the command bodies enforce on the M1 are fixed. The dispatch caps are at most 16 signal events per call, at most 32 custom barriers on the wire (128 in the program container), at most 128 custom execute-order entries, at most 16 trigger input buffers, and fewer than 2 active shared events. Priority levels run 0 through 7, split into a privileged band of 0 and 1 and a normal band of 2 through 7. The single dispatch path takes exactly one output buffer set, one task-descriptor partition, and one engine request per list.

Table C.16 gives the fixed-header layout (sCSneControllerCmdHdr) that prefixes every ring message, with each field's offset, width, and meaning.

Table C.16. The fixed command-header fields with their offsets, widths, and meanings.

The full 93-entry table with file offsets, the decoded request structs, and the per-call numeric limits are in the research corpus.

C.6 The task-descriptor hardware register map

A captured ane_reg record is a (regAddr, regValue) pair whose low address selects one of 7 aperture groups. Table C.17 is the aperture map that converts a raw address to a group, with the image base and window of each.

Table C.17. The register-address ranges and the aperture group, image base, and window each maps to.

Table C.18 gives representative G1 dimension fields, which also pack the format and control bits, with the bit range and width of each.

Table C.18. Representative G1 dimension register fields with their bit ranges, widths, and meanings.

To invert a raw value: DMA strides are 26-bit signed at bits [31:6]; L2-result base and strides are 17-bit at bits [20:4]; a full device address is (hi << 32) | lo with lo 64-byte aligned and hi 10 bits, capped at 42 bits. The complete inventory of roughly 190 register fields across the 7 groups, 11 reloc slots, and on-M1 stubbed engines (CCDMA, atomic scatter, LDTID) is in the research corpus.

Each operation descriptor in the task-descriptor stream has a 32-bit opcode word. Table C.19 gives the words decoded from a live M1 program for three operations.

Table C.19. The version-7 / H13 codegen opcode words for three operations, with the high half-word shared and the low 16 bits selecting the operation.

C.7 The .e5 FlatBuffer schema

The program container is a FlatBuffer whose root table holds four fields, the schema given as listing C.1. The schema reconstructs from the serializer method set and the wire bytes, since the binary strips the reflection schema, and round-trips cleanly through the FlatBuffers tool to 23 tables, 4 enums, and 1 union. The data-type and op-type enums are recovered by name; the numeric ordinals are inferred.

namespace E5RT.fb;

enum TensorDataType : int {
  Invalid = 0, Float16 = 1, Float32 = 2, Int8 = 3, UInt8 = 4,
  Int16 = 5, Int32 = 6, Int4 = 7, Bool = 8, E4M3 = 9, E5M2 = 10
}

enum OpType : int {
  Cast = 0, AneInference = 1, EirInference = 2, CpuInference = 3,
  BnnsCpuInference = 4, MlcCpuInference = 5, MpsGraphInference = 6,
  E5MinimalCpu = 7, Quant = 8, Dequant = 9, Barrier = 10, JitCall = 11
}

table TensorDescriptor {
  dim:[ulong];
  stride:[ulong];
  width:ulong;
  height:ulong;
  channels:ulong;
  batch_number:ulong;
  sequence_length:ulong;
  stride_width:ulong;
  stride_height:ulong;
  stride_channels:ulong;
  stride_batch_number:ulong;
  stride_sequence_length:ulong;
  storage_type:TensorDataType;
  component_pack:int;
}

table BuildInfoEntry { key:string; value:string; }
table BuildInfo { entries:[BuildInfoEntry]; }   // 7 key-value pairs in the sample

table AliasSymbol { name:string; symbol_index:uint; addr_offset:uint; }

table IOPort { name:string; byte_size:ulong; aperture_va:ulong; }

table Operand { descriptor:TensorDescriptor; }

table CastAttrs { src_dtype:TensorDataType; dst_dtype:TensorDataType; component_pack:int; }

table AneInferenceAttrs {
  procedure_name:string;
  anehash:string;
  program_symbol:string;
  intermediate_buffer_handle:uint;
  compiler_options:string;
}

table Operation {
  name:string;
  op_type:OpType;
  inputs:[uint];
  outputs:[uint];
  arg_frame:string;        // __arg_frame section reference
  attrs_section:string;    // __op_attrs section reference
}

table Block { name:string; operations:[Operation]; }

table Function { name:string; anehash_path:string; blocks:[Block]; }

table Section { name:string; kind:int; }

table E5Program {
  symbol_names:[string];   // field[0] name vector
  build_info:BuildInfo;    // field[1] 7-entry sub-table
  sections:[Section];      // field[2] 6-entry section vector
  format_version:int;      // field[3] inline scalar == 4
}

root_type E5Program;

Listing C.1. The reconstructed program-container FlatBuffer schema: root table, type enums, tensor descriptor, section tables, and operation structure.

The whole fused graph collapses to a single AneInference operation, with the surrounding Cast operations holding the input and output dtype conversion. The validation against the round-9 H13C.e5 sample reads the four root fields, the seven build-info pairs (built-for-profiling, input-file-path, the component versions, and on-device-compilation), and the operation chain Cast, AneInference, Cast straight out of the bytes with no contradiction. The enum ordinals, the e4m3 and e5m2 dtypes, segment-chaining fields, and field sets of the ten op-attribute tables other than CastAttrs and AneInferenceAttrs are inferred rather than byte-confirmed in this single-segment sample.