Glossary

Plain-language definitions of SEO terms used across the blog.

Boot ROM: The first code that runs on power-on. Mask-programmed at silicon manufacture, immutable, and the cryptographic root of the entire boot chain.
Gatekeeper: The macOS feature that gates first-launch of downloaded apps based on signature, notarization, and quarantine. Implemented by syspolicyd.
IOUSBHost: The IOKit framework for USB device drivers on macOS. Replaces the older IOUSBFamily; the modern path for both in-kernel and DriverKit USB drivers.
kqueue: BSD's I/O event notification mechanism — register interest in events from file descriptors, sockets, timers, processes, signals, and get woken when they fire.
Time Machine: macOS's backup system. Local hourly snapshots via APFS plus optional external backups to USB or network destinations.
XPC: Apple's IPC framework for talking between processes. Built on Mach messages with a structured codec, queue-aware dispatch, and tight launchd integration.
AOP (Always-On Processor): A low-power ARM core on every Apple SoC that runs continuously, handling sensors and wake-event coordination while the main CPU sleeps.
LaunchServices: The macOS framework that answers 'which app handles this?' — bundle ID lookups, URL scheme handlers, file-type associations. The first stop on every app launch.
lck_mtx (kernel mutex): XNU's default kernel-side mutex. Block-and-wait under contention, adaptive-spin on short waits, priority-inheriting to prevent inversion.
lck_spin (kernel spinlock): Busy-wait kernel lock for very short critical sections in interrupt or scheduler context where blocking isn't an option.
mbuf: The 4.4 BSD memory buffer type. The atomic unit of networking memory in XNU — small inline payloads or pointers to clusters, chained to form a packet.
Skywalk: Apple's modern replacement for the BSD network data plane. Shared-memory rings, per-channel queues, QoS-aware throughout. Closed source, but increasingly the default.
IOSurface: The IOKit object that represents a chunk of memory mappable by both CPU and GPU. Zero-copy on Apple Silicon's unified memory.
kalloc: XNU's general-purpose kernel heap. A facade over the zone allocator using power-of-two-sized buckets; what kernel code calls when it needs malloc-like variable-size allocation.
Mach-O: Apple's executable file format. Holds load commands, segments, the code signature, and the dyld handoff metadata. Every binary on macOS, iOS, watchOS, tvOS is Mach-O.
Notarization: Apple's automated malware scan + signature for Developer ID binaries distributed outside the App Store. Required for Gatekeeper to run them on user Macs.
Slab allocator: An allocation strategy where memory is divided into per-type caches of fixed-size elements. XNU's zone allocator is a slab allocator.
Zone allocator (zalloc): XNU's per-type slab allocator. Each zone holds elements of one fixed size; allocation is a free-list pop. Foundation of nearly every kernel data structure.
AIC (Apple Interrupt Controller): The SoC's interrupt aggregator on Apple Silicon. Routes interrupts from devices to specific CPU clusters with per-source priority and masking.
FileVault: The macOS feature that gates the volume encryption key behind a user password. Disk is always encrypted; FileVault decides whether unwrap requires a user secret.
IOInterruptDispatchSource: IOKit's abstraction for an interrupt source. Registers a top-half filter with the kernel and dispatches the bottom-half action onto the driver's workloop.
IOWorkLoop: A single-threaded event queue an IOKit driver uses to serialize all its event handling — interrupts, timers, IO completions. Implicit per-driver locking comes for free.
IOPMrootDomain: The singleton IOService at the root of the power graph. Owns system-wide decisions: full sleep, display sleep, wake on packet, wake on alarm.
IOPM (IOKit Power Management): The framework IOKit drivers use to declare their power states and coordinate sleep/wake with the rest of the system.
ASID (Address Space Identifier): An 8-bit tag on every TLB entry that lets the ARM MMU cache translations for multiple address spaces simultaneously. Why context switch on Apple Silicon is so cheap.
Buffer cache (unified buffer cache): The shared store of file-backed pages in kernel memory. read(2) and mmap(2) hit the same cache; pages are kept until evicted under pressure.
mmap: The POSIX syscall that maps a file (or anonymous memory) into a process's virtual address space. Backbone of malloc, dyld, and zero-copy file access on macOS.
Pageout daemon (vm_pageout): The kernel thread that walks the page queues, demotes inactive pages, and feeds the compressor / swap when free memory runs low.
SBPL (Sandbox Profile Language): A Scheme-derived DSL Apple uses to write sandbox profiles. Compiled to bytecode by libsandbox; evaluated by Sandbox.kext on every controlled syscall.
Translation regime (TTBR): The ARM concept of a region of virtual addresses that translate through a specific page-table base register. XNU uses two: TTBR0 for userspace, TTBR1 for kernel.
Working set: The set of pages a process has touched in a recent window. XNU's pageout daemon tries to keep every process's working set resident; when it can't, memory pressure escalates.
AST (Asynchronous System Trap): The per-thread polling-point mechanism XNU uses to deliver preemption, signals, and other asynchronous work without breaking into running code mid-instruction.
iBoot: Apple's bootloader — BIOS + GRUB compressed into a single signed binary. Loads, verifies, and jumps into the macOS kernelcache.
ipc_mqueue: The per-port message queue and wait set. Receives appended kmsgs, blocks threads in mach_msg_receive, wakes them when a message arrives.
kernelcache: A prelinked image bundling XNU plus every kext required for boot into a single signed file iBoot can load in one read.
kmsg (ipc_kmsg): The kernel-side representation of a Mach message while it's in flight. Owns the port references, the inline payload, and any out-of-line VM copies.
Voucher (Mach voucher): An immutable kernel object carried in Mach messages that propagates QoS, resource accounting, importance, and persona across IPC boundaries.
AMFI (Apple Mobile File Integrity): The kernel extension that enforces what signed code is allowed to load and run on a Mac (or iPhone). Despite the name, it's not iOS-only — every macOS exec goes through it.
AMX (Apple Matrix Extensions): Apple Silicon's undocumented matrix coprocessor. Used heavily by Accelerate and Core ML; programmed via opaque MSR writes to undocumented system registers.
APRR / SPRR: Apple Silicon's hardware mechanism for changing a page's effective permissions per-thread by writing a register — no TLB shootdown required. Foundation of fast JIT on Macs.
Chained fixups: The modern Mach-O relocation format. Pointers in the binary encode the next fixup's offset in-line; dyld walks the chain in O(fixups), not O(opcode stream).
Code signing: The cryptographic signature embedded in every Mach-O binary on a modern Mac. Validates the binary is unmodified and identifies its author.
Dispatch queue: libdispatch's basic unit of serialization. Submit blocks; they run in submission order on worker threads from the kernel-managed pool.
dlopen: The runtime API for loading a dylib into a process's address space. The basis of plugin architectures and conditional framework loading.
DriverKit: Apple's framework for writing drivers as userspace processes. Same IOKit object model as kernel kexts; crashes can't take down the system.
DVFS (Dynamic Voltage and Frequency Scaling): The technique of choosing per-cluster voltage and frequency at runtime to balance performance and power. The foundation of Apple Silicon's power efficiency.
dyld shared cache: A pre-linked image bundling every Apple-supplied dylib, mapped into every process at the same address. The reason process startup is fast and resident memory is small.
Entitlement: A signed key-value pair inside a binary's code signature that grants a specific kernel- or daemon-checked privilege.
KDP (Kernel Debugger Protocol): XNU's wire protocol for remote kernel debugging — how lldb talks to a panicked Mac over the network.
Page-replacement clock: XNU's two-handed clock algorithm for aging pages from active to inactive, identifying reclaim candidates under memory pressure.
Panic (kernel panic): XNU's emergency stop. Triggered by unhandled exceptions, failed assertions, or explicit panic() calls. Writes a panic.log to disk; reboots.
pmgr (power manager): The IOKit driver that owns Apple Silicon's power-control registers. Implements DVFS, idle gating, and per-island power decisions.
PrebuiltLoader: dyld's data structure for a dylib in the shared cache. All dependency resolution and fixup info is pre-computed at cache build time; per-process loading is O(1).
QoS class: Quality-of-Service: the userspace-facing scheduling priority. USER_INTERACTIVE down through BACKGROUND, mapped onto Mach's scheduling classes by libdispatch.
Rosetta 2: Apple's binary translator that runs x86_64 code on Apple Silicon. AOT-translates most binaries on first launch; JIT-translates the rest at runtime.
Secure Enclave (SEP): A separate ARM core on every modern Apple device, running its own OS, holding cryptographic keys the main CPU never sees.
SIP (System Integrity Protection): A kernel-enforced runtime restriction that forbids even root from modifying system files, loading unsigned kexts, or attaching debuggers to Apple-signed processes.
TCC (Transparency, Consent, Control): The daemon and database that records user grants for sensitive data — camera, microphone, contacts, full disk access, screen recording, and dozens more.
TCP state (tcpcb): The kernel's per-connection state structure — sequence numbers, RTT estimates, congestion window, retransmit timers, and the protocol state machine.
Workqueue (pthread workqueue): The kernel-managed thread pool that backs libdispatch and direct pthread_workqueue clients. Threads bucketed by QoS, created and destroyed dynamically.
APFS: Apple File System. Copy-on-write, snapshots, clones, sealed system volumes — the default filesystem on every modern Apple device.
BSD (in XNU): The FreeBSD-derived upper half of XNU that implements processes, file descriptors, VFS, sockets, and POSIX system calls.
Darwin: The open-source Unix-like core under macOS, iOS, watchOS, tvOS, and visionOS. XNU kernel + BSD userland + Apple's frameworks-free base system.
dyld: macOS's dynamic linker and loader. Maps Mach-O binaries into a process's address space, resolves dependencies, runs initializers.
IOKit: XNU's C++ driver framework. Drivers are objects in a runtime-traversable tree, matched to hardware by dictionary.
Jetsam: XNU's memory-pressure killer. Terminates the lowest-priority process in a memory band when free RAM falls under threshold.
kext: A kernel extension bundle. Mach-O binary + plist + dependencies, loaded into the kernel address space to extend it at runtime. Being phased out in favor of DriverKit.
launchd: The first userland process on macOS. PID 1, the init system, the service manager, and the only thing that can spawn daemons and agents.
Mach message: The unit of data and capability transfer between tasks on macOS. A header plus optional typed body that can move ports and memory pages atomically.
Mach port: A kernel-owned message queue addressed by capability. The IPC primitive every higher layer on macOS — XPC, launchd, signals — is built on.
Mach: The microkernel core of XNU. Originated at CMU in the 1980s; provides tasks, threads, ports, messages, and virtual memory.
pmap: The machine-dependent half of XNU virtual memory. Translates a vm_map into the page tables a particular CPU architecture actually walks.
Sandbox: The kernel-enforced policy layer that restricts what a process can do. Foundation of App Store apps, helper isolation, and a lot of XPC service security.
Sealed System Volume (SSV): The cryptographically sealed read-only volume holding `/System` on macOS 11+. Apple signs a Merkle root of every file; modifying anything breaks the seal.
Task (Mach): The Mach object that owns a process's address space, threads, and port rights. Paired with a BSD `proc` to form what userspace calls a process.
Thread (Mach): The Mach unit of execution. Schedulable, has CPU registers, runs inside a task's address space. POSIX threads are a layer on top.
VM compressor: macOS's in-RAM 'soft swap'. Compresses cold pages with WKdm/LZ4 to free physical frames before writing actual swap to disk.
vm_map: The machine-independent description of a task's virtual address space. A sorted list of entries, each pointing at a vm_object.
XNU: The kernel that runs macOS, iOS, watchOS, tvOS, and visionOS — Mach core, BSD personality, IOKit drivers, all in one binary.