HAL Batch 10 — MediaEngine/PMC + USB4/HT + SE/PMU-NVRAM

H.264/H.265/ProRes encode/decode ring. The Apple MediaEngine is the dedicated hardware video codec on M-series SoCs — offloading H.264/H.265 decode and ProRes encode/decode from CPU/GPU. It operates as a job ring similar to the ANE.

mediaengine_init(): initialises the 4-slot job ring at head=tail=0. mediaengine_submit(codec, mode, width, height, src_buf, dst_buf, kbps): submits a codec job — codec selects H264=0, H265=1, ProRes=2; mode selects decode=0 or encode=1; width/height give frame dimensions; src_buf/dst_buf are the I/O buffer pointers; kbps sets encode bitrate (ignored for decode). Writes the job descriptor at ring[tail], advances tail mod 4, sets me_busy=1. Returns 0 if ring full or not initialised. mediaengine_complete(): simulates HW completion — advances ring_head, increments done_count, clears me_busy when head catches tail. mediaengine_busy() / mediaengine_done_count(): status helpers.

ME init=1 sub=1 cmp=1 K.

G4/G5 hardware performance counters (MMCR0 + PMC1–4). The G4/G5 PMC subsystem provides hardware performance counters for counting instructions, cache misses, branch mispredictions, and bus transactions. Controlled by MMCR0 (Monitor Mode Control Register 0).

pmc_init(): zeros PMC1–4 and MMCR0 (counters frozen). pmc_mmcr0_set(val): writes MMCR0; the FREEZE bit (bit 31) gates whether counters tick; PMI_EN (bit 30) enables PMI interrupts; KERN (bit 7) enables kernel-mode counting; USER (bit 6) enables user-mode counting. pmc_tick(): increments PMC1–4 by 1 each if FREEZE=0 (counting enabled); no-op if frozen. pmc_ctx_save(ctx): context-switch save — sets FREEZE=1 (freezes counters during save), captures PMC1/PMC2 snapshots into ctx. pmc_pmc1() / pmc_pmc2() / pmc_pmc3() / pmc_pmc4(): read current counter values.

PMC init=1 run=1 sav=1 K.

USB4/Thunderbolt 4 2-port host manager (updated seam). USB4 (which also carries the Thunderbolt 4 protocol on Apple Silicon) is the high-bandwidth interconnect for external storage, displays, and peripherals. This commit updates apple_usb4.sg to the full 2-port manager.

usb4_init(): zeros port state for both ports (P0/P1). usb4_connect(port, speed_gbps, mode, power_ma): connects a device to port (0 or 1); speed_gbps is the negotiated speed (10/20/40); mode selects USB4=0 or TB4=1 (Thunderbolt tunnel); power_ma sets power delivery in milliamps. Sets P*_ONLINE=1. If mode=1 (TB tunnel), increments tb_tunnel_count. If power_ma > 0, adds to pd_mw_sum (power delivery budget in milliwatt-equivalent: power_ma/1000). usb4_disconnect(port): clears P*_ONLINE, decrements tb_tunnel_count if TB mode was active. usb4_online(port) / usb4_tb_tunnels() / usb4_pd_mw(): status helpers.

U4 init=1 con=1 dis=1 K.

G5/PPC970 HyperTransport host bridge. HyperTransport is the CPU-to-chipset interconnect on G5 Macs (PPC970/PPC970MP) — connecting the G5 processor to the northbridge (U3/U3H/U4 "Kodiak") for memory access and I/O.

ht_init(width_bits, freq_mhz): initialises the HT host bridge; width_bits is the bus width (8 or 16 bits — the G5 uses a 16-bit link), freq_mhz is the link frequency (800 MHz for G5). Sets link_up=1. ht_enum_downstream(unitid): enumerates a downstream device at unitid (0–15) — sets bit unitid in unit_bitmap, increments chain_depth. ht_unit_present(unitid): returns 1 if bit unitid is set. ht_send_packet(data): models sending an HT packet; increments tx_count. ht_recv_packet(): models receiving an HT packet; returns rx_count (the synthetic read value), increments rx_count. ht_link_up(): returns link_up status.

HT init=1 enm=1 txrx=1 K.

Secure Element command ring (PING/KEY_GEN/SIGN/VERIFY/BIOMETRIC_MATCH). The Apple Secure Element (SE) is a tamper-resistant security coprocessor that stores cryptographic keys and biometric templates, independently of the main SoC. Unlike the SEP (which is an on-SoC coprocessor), the SE is a discrete chip communicating over SPI/I2C.

se_init(): zeroes all state; clears biom_enrolled and key_exists. se_command(cmd, arg0, arg1): dispatches a command to the SE ring. PING (0): returns 1 (liveness check). KEY_GEN (1): generates a key; sets key_exists=1. SIGN (2): signs arg0 with the stored key; returns arg0 ^ 0xDEAD (synthetic signature); fails (returns 0) if key_exists=0. VERIFY (3): verifies a signature; returns 1 if cmd_count > 0 (key has been used). BIOMETRIC_MATCH (4): performs a biometric template match; returns 1 if biom_enrolled=1 AND arg0 != 0 (non-zero biometric data). se_enroll(template): sets biom_enrolled=1 (enrolls biometric data). se_biometric_match(data): directly matches biometric data — returns 1 if enrolled and data non-zero; returns 0 (denied) if not enrolled (even if called via se_command).

SE init=1 cmd=1 bio=1 K.

G3/G4 PMU + 64B NVRAM proxy. The G3/G4 PMU (Power Management Unit) is an embedded 68HC11 microcontroller that handles power sequencing, sleep/wake, battery monitoring, lid state, and NVRAM on old-world and new-world Macs. On G3/G4 machines, it also stores 64 bytes of NVRAM.

pmu_init(): zeros PMU state; sets ac_present=0, lid_open=1, battery_pct=100. pmu_set_ac(val): sets AC power status. pmu_set_lid(val): sets lid state (1=open, 0=closed). pmu_set_battery_pct(pct): sets battery level (0–100). pmu_sleep(reason): initiates system sleep; sets sleeping=1, stores sleep_reason (reason code: 0=user, 1=lid-close, 2=battery-critical). pmu_wake(): clears sleeping, increments wake_count. pmu_nvram_write(offset, val): writes 1 byte to the 64B NVRAM at offset; sets nvram_dirty=1. pmu_nvram_read(offset): reads 1 byte from NVRAM. pmu_cmd_count(): returns total PMU command count.

PMU init=1 nvm=1 slp=1 K.