Source map
Kernel directory names and source paths on this page are relative to Platydoc's read-only platydoc-data/xnu/ input. The project-root docs-ai/, docs-ai-html/ and .docs-cache/ directories belong to the documentation project and are not part of this source inventory.
Top-level directories
This inventory counts files, not compiled translation units. Source/header/interface counts include .c, .h, .cpp, .s, .S, .defs, .m, and .mm. Conditional implementations and bundled external headers are included; the counts do not measure how much was reviewed.
| Directory | All files | Source/header/interface files | Role and guide |
|---|---|---|---|
| bsd | 1,708 | 1,267 | POSIX processes, VFS, networking, security integration; processes, VFS, networking |
| osfmk | 1,502 | 1,188 | Mach runtime, IPC, VM, machine code; runtime, IPC, VM, platform |
| iokit | 304 | 258 | C++ driver framework and user-driver interfaces; drivers |
| libkern | 304 | 264 | Kernel C/C++ support, object containers, extension loading, compression and library interfaces; drivers |
| pexpert | 72 | 57 | Platform discovery, boot configuration, hardware callbacks; platform |
| security | 39 | 30 | MAC framework and operation-specific hooks; security |
| san | 60 | 36 | Memory/undefined-behavior/coverage instrumentation; observability |
| libsyscall | 257 | 232 | User-side syscall and Mach interface support; processes |
| libsa | 14 | 4 | Isolated bootstrap support, including startup extension discovery; bootstrap.cpp |
| libkdd | 18 | 12 | User-space decoding of kernel chunked data; observability |
| config | 79 | 0 | Kernel feature, architecture, platform, and export configurations |
| makedefs | 8 | 0 | Shared build machinery |
| SETUP | 25 | 13 | Build-time configuration and source-processing utilities |
| EXTERNAL_HEADERS | 148 | 139 | Headers from separately built projects; presence of a header does not imply an in-tree implementation |
| tests | 1,298 | 1,086 | User-space regression tests, subsystem tests, and unit-test harnesses |
| tools | 239 | 55 | Debugger macros, trace tools, performance tools, formal models, and developer utilities |
| doc | 34 | 0 | Existing technical documentation; linked from the relevant new guides |
These source/header/interface files total about 2.47 million lines, including tests, comments, headers, and external definitions. The documentation follows representative core implementations and interfaces; it is not a line-by-line review of that total.
Inside osfmk
| Area | How to orient yourself |
|---|---|
| kern | Start with task.h, thread.h, processor.h; then task.c, thread.c, sched_prim.c. Also contains allocators, locks, wait queues, timers, exceptions, accounting, stackshot, and Exclaves integration. The directory name is much broader than scheduling. |
| ipc | Begin with ipc_space.h, ipc_entry.h, ipc_port.h, and ipc_kmsg.h; follow mach_msg.c, ipc_kmsg.c, and ipc_mqueue.c. |
| vm | Public/internal/XNU-facing headers have distinct audiences. Start with map/object/page definitions, then vm_fault.c, vm_map.c, vm_resident.c, and vm_pageout.c. |
| mach | User-visible types and MIG interface definitions. These define contracts; implementation usually lives elsewhere. |
| arm64, arm, x86_64, i386, machine | Entry/exit, context switching, pmap, CPU features, timers, and machine abstractions. Do not infer supported execution modes from historical directory names alone. |
| device | IOKit/Mach device interface glue, including device.defs and iokit_rpc.c. |
| bank, voucher | Voucher attributes for accounting relationships and pthread priority. Follow these from the IPC/runtime guides rather than treating them as a separate scheduler. |
| atm | Activity tracing compatibility code. atm_types.h explicitly marks its contents deprecated; do not assume it is the primary modern tracing interface. |
| corpses | Task corpse/crash information, linked to task lifecycle and exception delivery. |
| kperf, kdp | Performance sampling and debugger/core-dump infrastructure. |
| gssd, lockd, kextd, UserNotification | Kernel-to-user-service interfaces. The .defs file is often the best starting point; the corresponding service need not be implemented here. |
| tests, conf | In-kernel tests and build-selection rules. |
Inside bsd
| Area | How to orient yourself |
|---|---|
| sys | Process, credential, descriptor, vnode, socket, and event structures and interfaces. *_internal.h often carries the implementation state that a public header hides. |
| kern | Process lifecycle, descriptors, signals, events, sockets, memory policy, credentials, code-signing integration, sysctl, tracing, TTYs, and multiple IPC mechanisms. |
| vfs, vm | Filesystem-independent operations and the vnode-pager bridge. bsd/vm is a boundary with Mach VM, not the whole VM implementation. |
| miscfs, nfs | In-tree filesystem implementations and special vnode operations. The generic VFS is not an APFS implementation. |
| net, netinet, netinet6, netkey | Interfaces/routing/policy, IPv4/TCP/UDP, IPv6, and key-management code. |
| skywalk | Channels, packet pools, nexuses, flow switching, and network-interface integration. Read alongside traditional sockets and mbufs. |
| pthread | Workqueue code and callback shims for pthread implementation supplied separately. |
| dev | Architecture syscall entry, device/TTY support, and DTrace. Some architecture code also lives under bsd/arm and bsd/i386. |
| security, bsm | Audit implementation and audit data/interface support, alongside framework hooks in top-level security. |
| man, tests, conf | API documentation, in-kernel tests, and build metadata. |
Generated interfaces and external boundaries
Searching only for a C definition can miss the most useful source. BSD syscall tables come from syscalls.master and makesyscalls.sh. Mach RPC stubs come from .defs files and build rules. DriverKit includes .iig interface descriptions, for example IOUserServer.iig. Generated outputs can live under a build directory and be absent from this source-only checkout.
An interface header, callback table, or stub can mark a real implementation boundary. Examples include pthread_functions in pthread_shims.c, crypto/trust headers in EXTERNAL_HEADERS, registered MAC policies in mac_policy.h, and providers discovered through IOService.cpp. Follow both the declaration and the registration/call site before concluding that an operation is implemented here.
Search by question
| Question | First stops |
|---|---|
| Why did this thread stop running? | sched_prim.c, selected sched_* policy, waitq.c, turnstile.c, thread state |
| Why does an address fault? | Architecture fault handler, vm_fault.c, map entry, object/page, pmap |
| What does a PID identify during exec? | kern_exec.c, kern_fork.c, kern_proc.c, proc_ro |
| Where does a Mach port name lead? | IPC space entry, right type, ipc_port, queue or kernel object |
| What does a descriptor point at? | filedesc, fileproc, fileglob, fileops, vnode/socket/pipe |
| Why is file access denied? | Name lookup context, vnode authorization, credentials, MAC hook, mount flags |
| How does a packet reach a socket? | Interface input, protocol dispatch, IP/TCP/UDP input, socket buffer wakeup |
| Why did a driver attach? | Catalogue personality, matching dictionary, provider relation, probe, start |
| What initializes this global? | STARTUP registration, explicit boot call, conf/files*, selected configuration |
| How can I inspect it? | Observability guide, tools/lldbmacros, corresponding tests |