Search
Search articles, subsystems, and glossary terms.
Boot ROM and Secure Boot on Apple Silicon: from power-on to iBoot
What runs in the first microseconds of a Mac boot — the SoC's Boot ROM, the Apple-signed LLB and iBoot stages, the SEP coming up alongside, and how the chain of trust starts.
Gatekeeper: what it actually does and how to read its decisions
The gauntlet every newly-downloaded app passes through — quarantine xattr, signature check, notarization check, user prompt. Where each decision is made and how to debug it.
How a USB device gets driven on macOS
From plug-in to working app — IOUSBHost enumeration, IOKit matching, the DriverKit dext load, the user-space SDK. A complete trace of one device's journey through the stack.
Time Machine on APFS: snapshots, network backups, and rollback
How Time Machine uses APFS snapshots for local backups, the per-hour/per-day/per-week retention policy, and what rollback actually does to your filesystem.
AOP and the secondary coprocessors on Apple Silicon
The Apple SoC isn't just CPU + GPU + SEP. AOP, ANE, ISP, AMC, AMX — half a dozen secondary processors that quietly handle sensors, ML, imaging, and accelerated workloads.
Kernel synchronization in XNU: locks, atomics, and lock-free patterns
Spinlocks, mutexes, reader-writer locks, and lock-class groups — the synchronization primitives XNU offers, when each is appropriate, and how the per-CPU caches stay fast under contention.
What happens when you launch an app on macOS
From double-click to first window: LaunchServices, launchd, posix_spawn, AMFI, dyld, the shared cache, sandbox profile installation, the runloop. Six subsystems in three seconds.
The XNU network stack: mbufs, TCP, and Skywalk
From the classic 4.4 BSD TCP/IP stack to Apple's modern Skywalk replacement — how packets traverse XNU's networking code, and why Apple is moving the data plane out of the BSD layer.
The Apple GPU and Metal driver: unified memory in practice
How macOS's GPU driver hands off work to Apple Silicon's tile-based deferred renderer, and why unified memory makes IOSurface zero-copy across CPU and GPU.
Code signing chain of trust: from binary to Apple's root
Every Mach-O on a Mac is signed; every signature chains to an Apple root cert. Here's what the kernel actually verifies, what notarization adds, and how the SEP roots it all.
Kernel memory allocators in XNU: zalloc, kalloc, slab
The kernel's own malloc — a hierarchy of zone allocators, the kalloc heap, and slab caches for specific types. Different from user-side VM, and just as important.
The Secure Enclave: SEPOS, mailbox protocol, what the SEP actually does
A separate ARM core, its own OS, a hardware mailbox. Here's how the main CPU talks to the SEP, what operations cross the boundary, and why kernel exploits don't compromise FileVault.
APFS encryption: FileVault, per-file keys, and the SEP's role
How macOS encrypts every byte on disk — per-file keys derived in the SEP, the volume encryption key wrapped by user password, hardware AES in the SSD controller.
Inside the APFS object map: how the filesystem b-tree works
Every block on an APFS volume is reachable through one b-tree — the object map. Here's how it's laid out, how it survives a write, and why APFS is self-checksumming by design.
Interrupt handling in IOKit: from device IRQ to driver callback
The full path of an interrupt from the device asserting a line, through the AIC, through XNU's exception handler, to the driver's IOInterruptDispatchSource callback running on a workloop.
Power management on macOS: IOPM, idle states, and wake from sleep
How XNU tells every driver to drop power when idle and bring it back when needed — the IORegistry-walked power graph, IOPMrootDomain, and the sleep/wake choreography.
Memory pressure on macOS: compressor, jetsam, and the working set
How XNU responds when memory gets tight — the four-stage pressure pipeline from free pages through compression to swap to process termination, and what each stage costs.
mmap on XNU: what really happens when you map a file
Walk a single mmap call from libc, through BSD into Mach VM, the lazy first-touch fault, and the pmap entry that finally makes the file accessible as memory.
Page tables on Apple Silicon: ASIDs, translation regimes, and APRR in detail
How XNU maps virtual to physical on Apple Silicon — the ARM translation regime, multi-level page tables, ASIDs that eliminate TLB flushes, and where APRR sits in the translation pipeline.
Sandbox profiles: SBPL and kernel evaluation
Inside the macOS sandbox — a Scheme-derived policy language, a compiler in libsandbox, and a kernel evaluator that runs on every controlled syscall.
A context switch in XNU, walked end to end
From the moment an interrupt fires to the moment a different thread is running on the core — trap, AST, thread_invoke, ASID switch, return.
How fork(), exec(), and posix_spawn work on XNU
The Unix-est of Unix calls, implemented on a Mach kernel. Why fork is awkward on macOS, what exec actually replaces, and why posix_spawn is now the preferred way to start a process.
How macOS boots: iBoot to launchd
The full chain from power-on to your login window. Boot ROM, iBoot, kernelcache, kernel_init, bsdinit_task, launchd — what each stage does and how control transfers.
Mach IPC internals: kmsg, mqueue, vouchers
Inside a Mach message: how it's allocated, queued, woken on, and copied. Plus vouchers — the QoS-and-resource-propagation system most people don't notice.
APFS clones and snapshots: the kernel calls that make them work
clonefile, fclonefileat, fs_snapshot — three syscalls that let you copy 50 GB in 50 milliseconds. Here's what happens under each one, and what doesn't get copied.
The Apple GPU command pipeline: Metal to silicon
From a MTLCommandBuffer.commit call to the shader cores running — the userspace encoder, the kernel driver's IOConnectCallMethod, the GPU firmware processor, and where commands actually dispatch.
Apple Silicon and XNU: APRR, unified memory, AMX, Rosetta 2
What changed in XNU when Apple shipped its own ARM silicon — P/E cores, APRR page-permission switching, the AMX matrix coprocessor, and Rosetta 2.
Power management on Apple Silicon: pmgr, DVFS, and idle clusters
How macOS keeps an Apple Silicon Mac running for 18 hours on a battery — cluster-level voltage scaling, idle gating, the pmgr driver, and the power-island architecture.
DriverKit: how Apple is moving every driver out of the kernel
Same IOKit object model, userland process. Why kexts are dying, what DriverKit gives you, and how a USB driver actually crosses the boundary.
dyld in depth: chained fixups, prebuilt loaders, and dlopen internals
Inside dyld — Loader data structures, the modern chained-fixups format, PrebuiltLoaders in the shared cache, and what dlopen actually does at runtime.
The dyld shared cache and shared regions
Every system dylib pre-linked into one giant memory-mappable file, shared across every process on the system. Why a fresh process has 1 GB of virtual size but tiny resident memory.
IOSurface in depth: zero-copy between every coprocessor
The IOKit object that lets CPU, GPU, ANE, ISP, and media engines share the same physical pages. The unifying primitive behind unified memory's performance story.
Kernel debugging on macOS: KDP, panics, and lldb-kdp
The path from a kernel panic to a stack trace — the panic handler, the KDP wire protocol, attaching lldb to a panicked kernel, and what's recoverable on a live system.
libdispatch internals: how GCD actually dispatches your blocks
Dispatch queues, the workqueue thread pool, voucher adoption, async vs sync — what happens between your dispatch_async call and your block running on a worker thread.
macOS security architecture: signing, sandbox, SIP, TCC
Six interlocking layers — code signing, AMFI, entitlements, sandbox profiles, SIP, TCC, and the SEP — that together decide what code is allowed to do on a Mac.
Signals in XNU: where POSIX semantics meet Mach reality
POSIX says signals are per-process. Mach says everything is a thread. Here's how XNU bridges the two — pending masks, delivery threads, the AST mechanism, and exception ports.
TCP internals on XNU: the state machine, congestion control, and the receive path
The 4.4 BSD TCP stack as it actually runs on macOS — state transitions, send/receive locking, Apple's congestion-control variants, and the kqueue path back to your app.
The XNU scheduler: bands, QoS, and how Mach decides who runs
Real-time, fixed-priority, timeshare, idle — four scheduling classes, 128 priorities, and a QoS layer on top. Here's how XNU picks a thread to put on a core.
Inside APFS: copy-on-write, snapshots, and the sealed system volume
Apple File System, the format under every modern Mac: how it lays out blocks, how it gets snapshots almost for free, and why your /System is read-only at the cryptographic level.
IOKit and the driver model: how a Mac talks to its hardware
Embedded C++, an object tree, and matching dictionaries — IOKit is how every driver on macOS gets loaded, paired with hardware, and called.
Mach ports: how every macOS process actually talks to another
Tasks, ports, messages, and rights — the IPC primitive that quietly carries every IPC on your Mac, from XPC to drag-and-drop.
The BSD personality: how XNU pretends to be Unix
Processes, file descriptors, signals, sockets — the FreeBSD-derived layer that sits on top of Mach and makes macOS pass POSIX.
Virtual memory in XNU: pmap, the VM map, and the compressor
Every macOS process gets a private address space it can't possibly afford. Here's how XNU gives it one anyway — pmap, vm_map, the compressor, and jetsam.