#include <pexpert/pexpert.h>

pexpert/pexpert.h Kernel.framework

includes: sys/cdefs.h, IOKit/IOInterrupts.h, kern/kern_types.h, Kernel/mach/boolean.h, Kernel/mach/kern_return.h, Kernel/mach/machine/vm_types.h, pexpert/boot.h

67 functions · 12 variables · 11 macros · 9 typedefs · 8 enums · 4 structs

typedefcpu_id_t

typedef void *cpu_id_t

functionlpss_uart_enable

extern void lpss_uart_enable(boolean_t on_off)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu pexpert/i386/pe_serial.c

x86 only. Sets the power state of the Intel LPSS (low power subsystem) serial UART by rewriting the device's PMCS register: on_off FALSE places the UART in the D3 low-power state and marks serial output disabled; TRUE returns it to D0 and reinitializes the UART. Does nothing if no supported LPSS UART was detected at boot (mmio_uart boot-arg).

functionPE_enter_debugger

void PE_enter_debugger(const char *cause)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu pexpert/gen/pe_gen.c

Enters the kernel debugger with the given cause string, by calling Debugger(cause), but only if the debug= boot-arg includes DB_NMI (NMI/debug-key entry enabled); otherwise returns without effect.

functionPE_init_platform

void PE_init_platform(boolean_t vm_initialized, void *args)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu pexpert/arm/pe_init.c, pexpert/i386/pe_init.c

Initializes the platform expert; called twice during bootstrap. The first call, with vm_initialized FALSE, records the booter-supplied boot_args in PE_state (command line, flattened device tree location, boot video parameters), initializes the device tree accessors (SecureDTInit), identifies the machine (clock frequencies, machine type), captures target-type, model, debug-enabled, firmware-version and unique-chip-id properties from the device tree, and runs pe_init_debug. The second call, with vm_initialized TRUE, performs VM-dependent setup; on ARM this initializes platform interrupt handling. Not normally called by kexts.

functionPE_get_random_seed

uint32_t PE_get_random_seed(unsigned char * dst_random_seed, uint32_t request_size)

Copies the requested number of bytes from the "random-seed" property in the device tree, and zeros the corresponding bytes in the device tree. Returns the number of bytes actually copied.

functionPE_i_can_has_debugger

uint32_t PE_i_can_has_debugger(uint32_t *)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu pexpert/arm/pe_init.c, pexpert/i386/pe_init.c

Returns nonzero if kernel debugging is allowed on this device, i.e. it is running a variant of iBoot that permits debugging; typically returns 0 on production-fused hardware even with development iBoot. If debug_flags is non-NULL, it is filled with the flags parsed from the debug= boot-arg (0 when debugging is disabled), so kexts need not parse the boot-arg themselves.

functionPE_stub_poll_input

int PE_stub_poll_input(unsigned int options, char *c)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu pexpert/arm/pe_init.c, pexpert/i386/pe_init.c

Default PE_poll_input handler. Reads one character from the serial UART and stores it in *c. Returns 0 on success (1 would indicate the operation is unsupported); options is ignored.

functionPE_panic_debugging_enabled

boolean_t PE_panic_debugging_enabled(void)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu pexpert/arm/pe_init.c

Returns TRUE if the device is configured with panic debugging enabled (the panicDebugging state, controlled by the debug= boot-arg and platform policy), in which case a panic halts into the debugger or waits rather than immediately rebooting.

functionPE_mark_hwaccess

void PE_mark_hwaccess(uint64_t thread)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu pexpert/arm/pe_init.c, osfmk/arm/model_dep.c

Records the given thread identifier as the thread currently performing a hardware (device register) access, followed by a data memory barrier. If the access hangs and the system panics, the value is reported in the panic log as the AppleHWAccess thread, identifying the access in progress.

functionPE_mark_hwaccess_data

void PE_mark_hwaccess_data(uint8_t type, uint8_t size, uint64_t paddr)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu pexpert/arm/pe_init.c, osfmk/arm/model_dep.c

Records the parameters of the current hardware access for panic diagnostics: type (0 read, 1 write), access size in bytes, and the physical address, followed by a data memory barrier. Reported in the panic log alongside the thread recorded by PE_mark_hwaccess as the last AppleHWAccess access.

functionPE_get_offset_into_panic_region

uint32_t PE_get_offset_into_panic_region(char *location)

Return the offset of the specified address into the panic region

functionPE_init_panicheader

void PE_init_panicheader(void)

Zeroes the panic header, sets the panic magic and initializes the header to be used

functionPE_update_panicheader_nestedpanic

void PE_update_panicheader_nestedpanic(void)

Updates the panic header during a nested panic

functionPE_handle_platform_error

bool PE_handle_platform_error(vm_offset_t far)

Invokes AppleARMIO::handlePlatformError() if present

variablegPESerialBaud

extern int32_t gPESerialBaud

variablegPlatformECID

extern uint8_t gPlatformECID[8]

variablegPlatformMemoryID

extern uint32_t gPlatformMemoryID

functionPE_init_taproot

unsigned int PE_init_taproot(vm_offset_t *taddr)

▾

claude-fable-5, 2026-08-24 · not from Apple sources

Declared to return the address of a taproot region through *taddr, with the size as the result. No implementation is present in current xnu sources; the declaration appears to be vestigial.

variablePE_kputc

extern void (*PE_kputc)(char c)

functionPE_init_printf

void PE_init_printf(boolean_t vm_initialized)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu pexpert/gen/pe_gen.c

Initializes kernel printf console output. Called with vm_initialized FALSE early in boot, it points the PE_putc output routine at the console character writer; called again with TRUE once VM is up, it attaches the video console (vcattach).

variablePE_putc

extern void (*PE_putc)(char c)

functionPE_init_iokit

void PE_init_iokit(void)

Perform pre-lockdown IOKit initialization. This is guaranteed to execute prior to machine_lockdown(). The precise operations performed by this function depend upon the security model employed by the platform, but in general this function should be expected to at least perform basic C++ runtime and I/O registry initialization.

functionPE_lockdown_iokit

void PE_lockdown_iokit(void)

Perform post-lockdown IOKit initialization. This is guaranteed to execute after machine_lockdown(). The precise operations performed by this function depend upon the security model employed by the platform. For example, if the platform treats machine_lockdown() as a strict security checkpoint, general-purpose IOKit matching may not begin until this function is called.

structclock_frequency_info_t

size 200, align 8

unsigned long	bus_clock_rate_hz
unsigned long	cpu_clock_rate_hz
unsigned long	dec_clock_rate_hz
unsigned long	bus_clock_rate_num
unsigned long	bus_clock_rate_den
unsigned long	bus_to_cpu_rate_num
unsigned long	bus_to_cpu_rate_den
unsigned long	bus_to_dec_rate_num
unsigned long	bus_to_dec_rate_den
unsigned long	timebase_frequency_hz
unsigned long	timebase_frequency_num
unsigned long	timebase_frequency_den
unsigned long long	bus_frequency_hz
unsigned long long	bus_frequency_min_hz
unsigned long long	bus_frequency_max_hz
unsigned long long	cpu_frequency_hz
unsigned long long	cpu_frequency_min_hz
unsigned long long	cpu_frequency_max_hz
unsigned long long	prf_frequency_hz
unsigned long long	prf_frequency_min_hz
unsigned long long	prf_frequency_max_hz
unsigned long long	mem_frequency_hz
unsigned long long	mem_frequency_min_hz
unsigned long long	mem_frequency_max_hz
unsigned long long	fix_frequency_hz

variabledebug_cpu_performance_degradation_factor

extern int debug_cpu_performance_degradation_factor

typedefclock_frequency_info_t

typedef struct clock_frequency_info_t clock_frequency_info_t

variablegPEClockFrequencyInfo

extern clock_frequency_info_t gPEClockFrequencyInfo

structtimebase_freq_t

size 16, align 8

unsigned long	timebase_num
unsigned long	timebase_den

typedeftimebase_callback_func

typedef void (*timebase_callback_func)(struct timebase_freq_t *timebase_freq)

functionPE_register_timebase_callback

void PE_register_timebase_callback(timebase_callback_func callback)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu pexpert/arm/pe_init.c, pexpert/i386/pe_init.c

Registers a callback to receive the platform timebase frequency as a timebase_freq_t (numerator/denominator), and immediately invokes it via PE_call_timebase_callback. Only one callback is kept; used by the clock subsystem to learn the timebase rate from the platform expert.

functionPE_call_timebase_callback

void PE_call_timebase_callback(void)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu pexpert/arm/pe_init.c, pexpert/i386/pe_init.c

Invokes the callback registered by PE_register_timebase_callback, passing the current timebase frequency from gPEClockFrequencyInfo (on ARM, timebase_frequency_hz over a denominator of 1). Does nothing if no callback is registered.

functionPE_install_interrupt_handler

void PE_install_interrupt_handler(
	void *nub,
	int source,
	void *target,
	IOInterruptHandler handler,
	void *refCon
)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu pexpert/i386/pe_interrupt.c

x86 only. Records nub, target, handler and refCon as the platform interrupt vector; PE_incoming_interrupt later dispatches external interrupts to this handler. The source argument is ignored, and only a single handler is kept. On ARM platforms there is no implementation; interrupt registration goes through the IOInterruptController machinery instead.

variabledisable_serial_output

extern bool disable_serial_output

variabledisable_kprintf_output

extern bool disable_kprintf_output

macro_FN_KPRINTF

#define _FN_KPRINTF

functionkprintf

__printflike(1, 2)
void kprintf(const char *fmt, ...)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu pexpert/arm/pe_kprintf.c, pexpert/i386/pe_kprintf.c

Kernel debugging printf. When serial kprintf output is enabled (debug= boot-arg DB_KPRT/serial configuration, and on RELEASE kernels not suppressed by disable_kprintf_output), formats the message under a spinlock with interrupts disabled and writes it unbuffered to the serial console; the message is also always forwarded to os_log. Intended for low-level debugging output that must not depend on the buffered console path; format is printf-like (__printflike(1,2)).

functioninit_display_putc

void init_display_putc(unsigned char *baseaddr, int rowbytes, int height)

▾

claude-fable-5, 2026-08-24 · not from Apple sources

Declared to initialize a rudimentary direct-to-framebuffer character output facility, given the framebuffer base address, bytes per row, and height. No implementation is present in current xnu sources; the declaration is vestigial.

functiondisplay_putc

void display_putc(char c)

▾

claude-fable-5, 2026-08-24 · not from Apple sources

Declared to write one character using the rudimentary framebuffer output facility set up by init_display_putc. No implementation is present in current xnu sources; the declaration is vestigial.

enum(anonymous)

underlying type unsigned int

kPEReadTOD	0
kPEWriteTOD	1

enum(anonymous)

underlying type unsigned int

kPEWaitForInput	1
kPERawInput	2

enum(anonymous)

Private Stuff - eventually put in pexpertprivate.h

underlying type unsigned int

kDebugTypeNone	0
kDebugTypeDisplay	1
kDebugTypeSerial	2

enum(anonymous)

Scale factor values for PE_Video.v_scale

underlying type unsigned int

kPEScaleFactorUnknown	0
kPEScaleFactor1x	1
kPEScaleFactor2x	2

structPE_Video

size 144, align 8

unsigned long	v_baseAddr	Base address of video memory
unsigned long	v_rowBytes	Number of bytes per pixel row
unsigned long	v_width	Width
unsigned long	v_height	Height
unsigned long	v_depth	Pixel Depth
unsigned long	v_display	Text or Graphics
char[64]	v_pixelFormat
unsigned long	v_offset	offset into video memory to start at
unsigned long	v_length	length of video memory (0 for v_rowBytes * v_height)
unsigned char	v_rotate	Rotation: 0:normal, 1:right 90, 2:left 180, 3:left 90
unsigned char	v_scale	Scale Factor for both X & Y
char[2]	reserved1
long	reserved2

typedefPE_Video

typedef struct PE_Video PE_Video

functioninitialize_screen

extern void initialize_screen(PE_Video *, unsigned int)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu osfmk/console/video_console.c

Configures the kernel video console. If a PE_Video is supplied, captures the framebuffer geometry (width, height, depth, rowbytes, rotation, scale) and maps the framebuffer if given a physical address. Then performs the operation: kPEGraphicsMode/kPETextMode select graphics or text boot mode kPEAcquireScreen start the boot progress display and enable the console kPETextScreen force text console output (verbose/panic) kPEEnableScreen/kPEDisableScreen resume/pause console drawing around display driver transitions kPEReleaseScreen relinquish the display to the graphics driver kPEBaseAddressChange remap only the framebuffer base address Normally reached through PE_initialize_console.

functiondim_screen

extern void dim_screen(void)

▾

claude-fable-5, 2026-08-24 · not from Apple sources

Declared to dim the display. No implementation is present in current xnu sources; the declaration is a vestige of the legacy power-management console interface.

functionPE_current_console

extern int PE_current_console(PE_Video *info)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu pexpert/arm/pe_init.c, pexpert/i386/pe_init.c

Copies the current console video configuration (PE_state.video) into *info, describing the boot framebuffer: base address, rowbytes, width, height, depth, pixel format, rotation and scale. Returns 0.

functionPE_create_console

extern void PE_create_console(void)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu pexpert/arm/pe_init.c, pexpert/i386/pe_init.c

Creates the boot console from the booter-supplied video information: calls PE_initialize_console with kPEGraphicsMode if PE_state.video.v_display indicates a graphics display, kPETextMode otherwise. On ARM, first checks the head of VRAM for a panic log saved by a previous panic before the framebuffer is overwritten.

functionPE_initialize_console

extern int PE_initialize_console(PE_Video *newInfo, int op)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu pexpert/arm/pe_init.c, pexpert/i386/pe_init.c

Performs a console operation (kPEGraphicsMode, kPETextMode, kPEAcquireScreen, kPEReleaseScreen, kPEEnableScreen, kPEDisableScreen, ...) by way of initialize_screen. kPEDisableScreen additionally switches console output to serial; kPEEnableScreen records newInfo as the current video state and restores the previous console; kPEReleaseScreen initializes the boot progress display if not already done. Returns 0. Used by display drivers when taking over or releasing the boot framebuffer.

macrokPEGraphicsMode

#define kPEGraphicsMode 1

macrokPETextMode

#define kPETextMode 2

macrokPETextScreen

#define kPETextScreen 3

macrokPEAcquireScreen

#define kPEAcquireScreen 4

macrokPEReleaseScreen

#define kPEReleaseScreen 5

macrokPEEnableScreen

#define kPEEnableScreen 6

macrokPEDisableScreen

#define kPEDisableScreen 7

macrokPEBaseAddressChange

#define kPEBaseAddressChange 8

macrokPERefreshBootGraphics

#define kPERefreshBootGraphics 9

functionPE_display_icon

extern void PE_display_icon(unsigned int flags, const char * name)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu pexpert/arm/pe_init.c, pexpert/i386/pe_init.c

Draws the failed-boot picture on the console, if the booter provided one (the Pict-FailedBoot property in the device tree memory-map); called, e.g., with the name "noroot" when the root device cannot be found. The flags and name arguments are ignored by current implementations; on x86 the routine is a no-op.

structPE_state

size 176, align 8

boolean_t	initialized
PE_Video	video
void *	deviceTreeHead
void *	bootArgs
vm_size_t	deviceTreeSize

typedefPE_state_t

typedef struct PE_state PE_state_t;

variablePE_state

extern PE_state_t PE_state

functionPE_boot_args

extern char * PE_boot_args(void)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu pexpert/arm/pe_bootargs.c, pexpert/i386/pe_bootargs.c

Returns a pointer to the kernel command line string passed by the booter (the CommandLine field of the boot_args structure). This is the string searched by PE_parse_boot_argn.

functionPE_parse_boot_argn

extern boolean_t PE_parse_boot_argn(const char *arg_string, void *arg_ptr, int max_arg)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu pexpert/gen/bootargs.c

Searches the kernel command line (PE_boot_args) for the named boot argument and, if found, copies its value into arg_ptr and returns TRUE. A flag argument of the form -name stores the number 1. name=value arguments are parsed as numbers when numeric (decimal, 0x hex, leading-0 octal, with optional k/m/g binary-suffix scaling), truncated to max_arg bytes (1, 2, 3, 4, or 8); non-numeric values are copied as NUL-terminated strings of at most max_arg-1 characters. A max_arg of 0 tests only for presence, copying nothing. Returns FALSE if the argument is not present. See also PE_parse_boot_arg_str and PE_boot_arg_uint64_eq.

functionPE_boot_arg_uint64_eq

extern boolean_t PE_boot_arg_uint64_eq(const char *arg_string, uint64_t value)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu pexpert/gen/bootargs.c

Returns TRUE if the named boot argument is present (per PE_parse_boot_argn, parsed as a 64-bit value) and equal to value; FALSE if it is absent or differs.

functionPE_parse_boot_arg_str

extern boolean_t PE_parse_boot_arg_str(const char *arg_string, char * arg_ptr, int size)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu pexpert/gen/bootargs.c

Searches the kernel command line for the named boot argument and copies its value into arg_ptr as a NUL-terminated string of at most size-1 characters, forcing string interpretation even for numeric-looking values; a flag argument of the form -name yields the string "1". Returns TRUE if the argument was found, FALSE otherwise.

functionPE_get_default

extern boolean_t PE_get_default(
	const char *property_name,
	void *property_ptr,
	unsigned int max_property
)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu pexpert/gen/bootargs.c

Returns a default value published by the platform. Looks up the named property in the /defaults node of the device tree; if the node exists, copies the property data (which must fit in max_property bytes) to property_ptr and returns TRUE, or FALSE if the property is missing or too large. If there is no /defaults node, falls back to I/O Kit's IODTGetDefault. The PE_default_value macro wraps this call, substituting a compile-time default when the lookup fails.

macroPE_default_value

#define PE_default_value(_key, _variable, _default) do {
	        if (!PE_get_default((_key), &(_variable), sizeof(_variable)))
	                _variable = _default;
	} while(0)

enum(anonymous)

underlying type unsigned int

kPEOptionKey	58
kPECommandKey	55
kPEControlKey	54
kPEShiftKey	56

functionPE_get_hotkey

extern boolean_t PE_get_hotkey(unsigned char key)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu pexpert/arm/pe_init.c, pexpert/i386/pe_init.c

Obsolete. Always returns FALSE in current xnu; boot-time hotkey detection (kPEOptionKey, kPECommandKey, kPEControlKey, kPEShiftKey) is not supported.

functionPE_cpu_start

extern kern_return_t PE_cpu_start(
	cpu_id_t target,
	vm_offset_t start_paddr,
	vm_offset_t arg_paddr
)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu iokit/Kernel/IOCPU.cpp, iokit/Kernel/arm/AppleARMSMP.cpp, config/IOKit.exports

Unusable from kexts: the exported symbol is an alias for PE_cpu_start_from_kext, which panics ("PE_cpu_start_from_kext unimplemented"). Retained as IOKit KPI for linkage only. Within the kernel, the equivalent internal routine (PE_cpu_start_internal) releases the target CPU from reset - via IOCPU::startCPU on legacy platforms or the power manager's enableCPUCore on AppleARMSMP platforms - with start_paddr/arg_paddr unused on ARM.

functionPE_cpu_halt

extern void PE_cpu_halt(cpu_id_t target)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu iokit/Kernel/IOCPU.cpp, iokit/Kernel/arm/AppleARMSMP.cpp

IOKit KPI not used today: panics ("PE_cpu_halt unimplemented"). Retained for linkage only.

functionPE_cpu_down

extern bool PE_cpu_down(cpu_id_t target)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu iokit/Kernel/arm/AppleARMSMP.cpp

Takes a secondary CPU core offline at runtime; runs on the target CPU. Disables the core through the platform power manager and broadcasts the CPU_DOWN event. Returns true if the platform code should enter deep-sleep WFI - that is, on cluster-power-down platforms when this was the last awake CPU in its cluster - false otherwise.

functionPE_cpu_signal

extern void PE_cpu_signal(cpu_id_t source, cpu_id_t target)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu iokit/Kernel/arm/AppleARMSMP.cpp, iokit/Kernel/IOCPU.cpp

Sends an immediate interprocessor interrupt to the target CPU, through the AIC interrupt controller or the ml_cpu_signal fast-IPI path on AppleARMSMP platforms (source is ignored there), or via IOCPU::signalCPU on legacy platforms. Used by the scheduler to cause a cross-CPU AST.

functionPE_cpu_signal_deferred

extern void PE_cpu_signal_deferred(cpu_id_t source, cpu_id_t target)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu iokit/Kernel/arm/AppleARMSMP.cpp, iokit/Kernel/IOCPU.cpp

Posts a deferred (timer-coalesced) interprocessor interrupt to the target CPU: the IPI is delivered after the platform's deferred-IPI countdown rather than immediately, allowing idle-friendly batching. Cancelable with PE_cpu_signal_cancel before delivery.

functionPE_cpu_signal_cancel

extern void PE_cpu_signal_cancel(cpu_id_t source, cpu_id_t target)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu iokit/Kernel/arm/AppleARMSMP.cpp, iokit/Kernel/IOCPU.cpp

Cancels a deferred interprocessor interrupt previously posted to the target CPU with PE_cpu_signal_deferred, if it has not yet been delivered.

functionPE_cpu_machine_init

extern void PE_cpu_machine_init(cpu_id_t target, boolean_t bootb)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu iokit/Kernel/arm/AppleARMSMP.cpp, iokit/Kernel/IOCPU.cpp

Platform initialization for a CPU that is coming up; runs on the target CPU. bootb is TRUE on first boot of the CPU and FALSE on wake (e.g. resume from sleep). On AppleARMSMP platforms this runs platform active actions when the boot CPU resumes, broadcasts the CPU_BOOTED event, and sends the CPU its first self-IPI to enable IPI reception; on legacy platforms it invokes the IOCPU object's initCPU method. Called from the machine-dependent cpu_machine_init path.

functionPE_cpu_machine_quiesce

extern void PE_cpu_machine_quiesce(cpu_id_t target)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu iokit/Kernel/arm/AppleARMSMP.cpp, iokit/Kernel/IOCPU.cpp

Brings a CPU down for system sleep; runs on the target CPU. On AppleARMSMP platforms the boot CPU runs the platform quiesce actions while secondary CPUs have their core disabled through the power manager; the CPU_DOWN event is broadcast and the CPU then enters its low-power sleep state. On legacy platforms it invokes the IOCPU object's quiesceCPU method.

functionpe_init_debug

extern void pe_init_debug(void)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu pexpert/gen/pe_gen.c

Initializes the kernel configuration bitmask returned by PE_i_can_has_kernel_configuration from boot-args and build configuration: kPEICanHasAssertions (assertions boot-arg, default on for MACH_ASSERT kernels), kPEICanHasStatistics (statistics boot-arg, default on for DEVELOPMENT/DEBUG kernels), and kPEICanHasDiagnosticAPI (diagnostic_api boot-arg, requires PE_i_can_has_debugger and never set on SECURE_KERNEL). Also sets debug_cpu_performance_degradation_factor from the cpu-factor boot-arg, or to 10 when the device tree marks the target as an FPGA.

functionPE_imgsrc_mount_supported

extern boolean_t PE_imgsrc_mount_supported(void)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu pexpert/gen/bootargs.c

Returns TRUE. Platform-expert hook allowing a platform to disallow mounting the imageboot source volume; the current implementation always permits it.

functionPE_panic_hook

extern void PE_panic_hook(const char *str)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu pexpert/arm/hwtrace/hwtrace.c, pexpert/i386/pe_identify_machine.c

Platform hook invoked early in the panic path with the panic string. On DEVELOPMENT/DEBUG ARM kernels it dispatches to the panic_trace hook, which captures and halts hardware trace collection (the panic_trace boot-arg machinery); on RELEASE ARM kernels and on x86 it is a no-op.

functionPE_init_cpu

extern void PE_init_cpu(void)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu pexpert/arm/hwtrace/hwtrace.c

Per-CPU platform-expert initialization, called on each CPU as it boots or resumes. On ARM this runs the stop-clocks debug command when so configured (DEVELOPMENT/DEBUG panic_trace support) and initializes FIQ handling for the CPU.

functionPE_handle_ext_interrupt

extern void PE_handle_ext_interrupt(void)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu iokit/Kernel/arm/AppleARMSMP.cpp, osfmk/arm64/sleh.c

Dispatches an external (IRQ) interrupt to the platform interrupt controller's externalInterrupt handler. Called from the arm64 low-level exception handler when an external interrupt is taken.

functionPE_cpu_power_enable

extern void PE_cpu_power_enable(int cpu_id)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu iokit/Kernel/arm/AppleARMSMP.cpp

Marks the given CPU as powered in the platform's CPU power-state mask, prior to starting the core. On cluster-power-down platforms, if the CPU's cluster is currently offline, powers the cluster back up through the power manager, marks it online, and broadcasts the CLUSTER_ACTIVE event. Skipped for the boot CPU while the system is quiescing.

functionPE_cpu_power_disable

extern void PE_cpu_power_disable(int cpu_id)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu iokit/Kernel/arm/AppleARMSMP.cpp

Clears the given CPU from the platform's CPU power-state mask when the core powers down. On cluster-power-down platforms, if no other CPU in the same cluster remains awake, requests cluster exit (CLUSTER_EXIT_REQUESTED event), marks the cluster offline, and removes cluster power through the power manager. Skipped for the boot CPU while the system is quiescing. Unlocked; the panic path checks cluster power with PE_cpu_power_check_kdp.

functionPE_cpu_power_check_kdp

extern bool PE_cpu_power_check_kdp(int cpu_id)

This has no locking to prevent races, so it is only used in the panic path

functionPE_singlestep_hook

extern void PE_singlestep_hook(void)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu pexpert/arm/hwtrace/hwtrace.c

Empty platform hook called from single-step debugging paths; provided so platform debug tooling can intercept single-step events. No-op in current xnu.

typedefperfmon_interrupt_handler_func

typedef void (*perfmon_interrupt_handler_func)(cpu_id_t source)

functionPE_cpu_perfmon_interrupt_install_handler

extern kern_return_t PE_cpu_perfmon_interrupt_install_handler(
	perfmon_interrupt_handler_func handler
)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu iokit/Kernel/IOCPU.cpp

Records the given function as the performance-monitor interrupt (PMI) handler to be registered when PE_cpu_perfmon_interrupt_enable is called; returns KERN_SUCCESS. Legacy IOCPU path (arm64 only); on AppleARMSMP platforms PMI handlers are instead obtained from ml_processor_register and wired to the AIC at processor registration time.

functionPE_cpu_perfmon_interrupt_enable

extern void PE_cpu_perfmon_interrupt_enable(cpu_id_t target, boolean_t enable)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu iokit/Kernel/IOCPU.cpp

Enables or disables delivery of the performance-monitor interrupt on the target CPU. When enabling, registers the handler previously installed with PE_cpu_perfmon_interrupt_install_handler on interrupt source 1 of the CPU's provider nub and enables that interrupt; when disabling, disables the interrupt source. Does nothing if target is NULL. Legacy IOCPU path (arm64 only).

enumpanic_trace_t

panic_trace boot-arg modes

underlying type uint32_t

panic_trace_disabled	0
panic_trace_unused	1
panic_trace_enabled	2
panic_trace_alt_enabled	16
panic_trace_partial_policy	32
panic_trace_apt_present	256

typedefpanic_trace_t

typedef enum panic_trace_t panic_trace_t;

variablepanic_trace

extern panic_trace_t panic_trace

variablePE_arm_debug_panic_hook

extern void(*const PE_arm_debug_panic_hook)(const char *str)

enumkc_kind

underlying type int

KCKindNone	-1
KCKindUnknown	0
KCKindPrimary	1
KCKindPageable	2
KCKindAuxiliary	3
KCNumKinds	4

typedefkc_kind_t

typedef enum kc_kind kc_kind_t;

enumkc_format

underlying type unsigned int

KCFormatUnknown	0
KCFormatStatic	1
KCFormatDynamic	2
KCFormatFileset	3
KCFormatKCGEN	4

typedefkc_format_t

typedef enum kc_format kc_format_t;

functionPE_get_kc_header

extern void *PE_get_kc_header(kc_kind_t type)

returns a pointer to the mach-o header for a give KC type, returns NULL if nothing's been set

functionPE_get_kc_baseaddress

extern void *PE_get_kc_baseaddress(kc_kind_t type)

returns a pointer to the lowest VA of of the KC of the given type

functionPE_get_kc_base_pointers

extern const void * const*PE_get_kc_base_pointers(void)

returns an array of length KCNumKinds of the lowest VAs of each KC type - members could be NULL

functionPE_get_kc_slide

extern uintptr_t PE_get_kc_slide(kc_kind_t type)

returns the slide for the kext collection

functionPE_get_primary_kc_format

extern bool PE_get_primary_kc_format(kc_format_t *type)

quickly accesss the format of the primary kc

functionPE_get_kc_format

extern bool PE_get_kc_format(kc_kind_t type, kc_format_t *format)

gets format of KC of the given type

functionPE_set_kc_vp

extern void PE_set_kc_vp(kc_kind_t type, void *vp)

set vnode ptr for kc fileset

functionPE_get_kc_vp

void * PE_get_kc_vp(kc_kind_t type)

quickly set vnode ptr for kc fileset

functionPE_reset_all_kc_vp

void PE_reset_all_kc_vp(void)

drop reference to kc fileset vnodes

functionPE_init_socd_client

extern vm_size_t PE_init_socd_client(void)

@function PE_init_socd_client @brief Initialize the SOCD client mechanism, used for Xnu to contribute data to the SOCD buffers managed by the SMC in it's SRAM.

functionPE_read_socd_client_buffer

extern void PE_read_socd_client_buffer(vm_offset_t offset, void *out_buff, vm_size_t size)

@function PE_read_socd_client_buffer @brief read data from the SOCD client buffer in SMC SRAM.

functionPE_write_socd_client_buffer

extern void PE_write_socd_client_buffer(
	vm_offset_t offset,
	const void *in_buff,
	vm_size_t size
)

@function PE_write_socd_client_buffer @brief Write data to the SOCD client buffer in SMC SRAM

functionPE_device_is_simulated

extern boolean_t PE_device_is_simulated(void)

@function PE_device_is_simulated @brief Returns true if the device is a simulator, else false