Vocabulary and object index
These definitions describe how to read the terms in this source tree. They are deliberately short; the linked guides explain the actual fields, ownership, and control paths.
Execution and concurrency
| Term | Meaning in the guides |
|---|---|
proc |
BSD process object: Unix identity, relationships, descriptors, signals, and lifecycle state. Process objects |
task |
Mach resource container with a VM map, IPC space, threads, policy, and accounting. Runtime objects |
thread / uthread |
Schedulable Mach execution state and its associated BSD state; they do not represent two independently scheduled threads. Process objects |
processor_set |
A scheduler domain containing CPU state and queues; its relationship to hardware topology depends on configuration. Scheduling |
| QoS | Quality-of-service classification used by policy and work admission; it contributes to scheduling behavior but is not identical to one fixed numeric priority. Scheduling |
| Base priority / scheduled priority / quantum | Policy-derived priority, the priority currently used for scheduling, and the execution interval assigned by the scheduler. Decay, promotion and quantum accounting have separate update paths. Priority and quanta |
| RT computation / constraint / deadline | Declared execution budget, permitted completion interval, and the absolute deadline used in real-time queue selection. Their local validation and ordering do not establish system-wide schedulability. Real-time scheduling |
| Clutch bucket / bucket group | A scheduling tier within a processor-set hierarchy / shared thread-group accounting used by Clutch selection and interactivity. These are not simply one FIFO per priority. Clutch and Edge |
| AST | Asynchronous system trap: deferred work requested for an appropriate execution/return boundary, including scheduling and BSD attention. Signals and exceptions |
| EL0 / EL1 / EL2 | ARM exception levels: applications, the ordinary XNU kernel context, and a hypervisor context respectively in the paths described here. Hardware entry saves return PC/status in the target level's exception registers; software saves additional context. ARM64 entry, EL2 boundaries |
User PCB / arm_context_t |
Persistent per-thread user register state used to resume after a syscall, fault, or continuation; distinct from a kernel stack frame and from a networking PCB. Entry frames |
ERET |
ARM exception-return instruction restoring PC and processor state from the target return registers; distinct from an ordinary function ret. Return path |
| PPL / SPTM / GL | Page Protection Layer / Secure Page Table Monitor / Apple guarded-level terminology. Their caller-side interfaces and conditional paths are present, while protected transition bodies are incomplete or external. Protected execution |
| Wait queue | Registration and wakeup machinery for threads waiting on an event. Waits |
| Turnstile | A dependency/priority-inheritance object connecting waiters to an inheritor that can unblock them. Locks and turnstiles |
| SMR | Safe memory reclamation: read-side participation and deferred reclamation protect supported lockless-access patterns. A reader grace period and completion of queued reclamation callbacks are separate obligations. SMR and publication |
| Workqueue / workloop | Context-dependent names. BSD workqueues supply servicing threads; BSD event workloops manage event/service relationships; IOKit work loops serialize participating driver event sources. BSD events, drivers |
| Knote | A registered event/filter relationship with its own activation, processing and removal state; consuming or dropping it can precede delivery of the result to userspace. Kqueue and workloops |
| Timer call / thread call | Deadline-triggered callback machinery / deferred execution on worker threads, with distinct enqueue, invocation and cancellation protocols. A successful cancellation does not universally mean no callback is running. Call lifetimes |
Memory and IPC
| Term | Meaning in the guides |
|---|---|
| VM map / map entry | An address space and one of its virtual ranges, with protections and a backing-object or submap relationship. Virtual address maps |
| VM object | Logical backing contents indexed by offset, including resident pages, shadow relationships, and pager state. Objects and pages |
vm_page |
Metadata for a physical-page representation and its VM/object/queue state; it is distinct from the page's bytes. Objects and pages |
| Pmap | The architecture-facing physical-map implementation that manages hardware address translations and related bookkeeping. ARM64, x86 |
| COW | Copy-on-write: share contents until a write requires private backing, subject to the mapping/object copy strategy. Fault resolution |
| PTE / table descriptor | A hardware translation-table entry; its level and type determine whether it points to another table or describes a physical mapping. ARM64 geometry |
| PV / reverse mapping | Physical-to-virtual metadata that lets pmap start with a physical page and find its installed aliases. Mapping lifecycle |
| PTD | ARM page-table descriptor: software metadata associating table storage with its owner and per-table state. Its counters differ between legacy and SPTM implementations. ARM64 metadata |
| Translation granule / VM page size | The hardware table-walk unit and the VM system's page unit; a map can also specify its own page shift. Check each layer before computing indices or offsets. ARM64 geometry |
| ASID / PCID | Address-space tags used to distinguish cached translations; allocating/reusing tags requires backend-specific coherency rules. ARM64 activation, x86 activation |
| TLB / shootdown | Cached translations / the protocol that invalidates stale translations on affected CPUs and establishes required completion. TLB operations |
| Wiring | Residency protection represented at map, physical-page and pmap layers; their counts and lifetimes are distinct. Wiring |
| Memory entry / map copy | A port-backed capability to memory and a kernel representation used for range transfer. A copy representation does not by itself imply an eager byte copy. Memory entries |
| Compressed marker / compressor slot | An invalid PTE's accounting marker and the pager's locator for compressed contents are separate state. Reclaim and compression |
| Memorystatus / freezer | Process-level memory-pressure policy and selected task-memory freezing. Candidate selection, VM work, process accounting and later termination or thaw are separate stages. Pressure and freezing |
| Pager | An implementation that supplies or accepts backing contents through the memory-object interface; it need not be a user-space server. Pagers |
| UBC / UPL | Unified buffer cache connects vnode contents to VM; a universal page list carries page-transfer and completion state during I/O. Pagers and UPL |
| Zone / typed allocation | Kernel object-allocation mechanisms backed by VM; allocation placement does not replace C ownership/lifetime rules. Allocation |
| Zone magazine / depot | A batch of free elements / inventory holding such batches between CPU caches and a zone. Zone allocator |
| Kalloc heap view | Routing and accounting information over existing size-class zones; a separate view name need not identify exclusive backing. Kalloc routing |
| Type signature / signature equivalence | Compiler-supplied allocation layout and startup compatibility classes used in assignment/free checks; neither is nominal C type identity. Type isolation |
| Guard object / VA sequestering | VM allocation-slot/guard management and zone address-retention policy are distinct mechanisms with different reuse rules. VM guards, zones |
| Restricted frame / read-only zone | A kernel-private mapping category and storage requiring controlled writes; these enforce different contracts. Mapping categories, RO allocator |
| IPC space / port name | A task-local namespace and an integer name interpreted through an entry in that namespace. Names and rights |
| Port / right | A kernel endpoint object and a capability such as receive, send, or send-once authority referring to it. Names and rights |
| Kmsg / OOL | Kernel message representation / out-of-line descriptor data. OOL does not by itself imply zero-copy transfer. Messages |
| MIG | Mach Interface Generator: generates client/server boundary code from .defs interfaces. Kernel RPC |
| Kobject | A typed kernel object associated with a port, reached through validated conversions and dispatch. Kernel RPC |
| Urefs / send rights / object references | User-reference count in a space entry, kernel send-right instances, and allocation-lifetime references are different counts. Rights model |
| Mach exception / exception action | A kernel event delivered through an exception RPC, and its registered destination/behavior/state flavor. Hardware faults are one source of these events. Exception delivery |
| Voucher | An IPC object containing references to managed attribute values. Transporting a voucher in a message and adopting its attributes on a thread are separate operations. Vouchers and importance |
| Port guard / construction policy | Guard-context checks and port-type restrictions applied to selected operations. A guard context is not a replacement for an IPC right. Guards and policy |
Protected execution
| Term | Meaning in the guides |
|---|---|
| SPTM | Secure Page Table Monitor: external authority over typed physical frames and protected mapping operations; XNU retains VM, reverse-map and lifetime bookkeeping. SPTM |
| TXM / CSM | Trusted Execution Monitor / common code-signing-monitor interface. CSM selects TXM in SPTM builds; registration, verification, region association and executable mapping are separate operations. TXM |
| Frame type / page ownership | Protected physical-frame classification and permitted uses; distinct from a single PTE's permissions or retaining a vm_page record. Frame types |
| Exclaves / conclave | Exclaves is the secure-execution integration; a conclave resource associates an external domain/manager and lifecycle state with an XNU task. Resources and task lifecycle |
| SCID / host ID | External scheduling-context identifier / XNU compact thread identifier, paired in scheduler messages. Neither is a Mach port name. Execution context |
| Ringgate / Tightbeam | Named secure-entry endpoints and status contract / generated service RPC interfaces and runtime. Their XNU call sites are visible, while substantial transport code is supplied externally. Execution, services |
| Epoch synchronization | Exclaves host wait/wake protocol using external epochs, hashed local wait objects and turnstiles; distinct from SPTM pmap epochs protecting mapping/table observations. Exclaves waits, pmap epochs |
Files, networks, drivers, and policy
| Term | Meaning in the guides |
|---|---|
Fd / fileproc / fileglob |
Process-local descriptor number, descriptor instance, and shared open-file object. Descriptors |
| Vnode / mount | Generic filesystem-object state and a mounted filesystem instance. A vnode is not merely a pathname. VFS objects |
| Vnode hold / I/O count / use count | Allocation protection, active-operation protection, and persistent-use accounting. Converting a cached pointer into usable vnode state also requires identity validation. Vnode lifetime |
| Mount busy / cross-reference | Participation in the mount's operation-versus-unmount protocol / protection while crossing from a covered vnode. These coexist with ordinary and iteration references. Mount lifetime |
| Compound VNOP | Filesystem operation that combines lookup and a namespace mutation with explicit returned-vnode and retry ownership. It does not imply that every later VFS failure undoes the completed mutation. Namespace mutations |
| Specfs / devfs / FIFO vnode | Device operation dispatch, device namespace construction, and named-pipe vnode operations backed by a socket pair. They provide different parts of the pathname-to-I/O path. Devices and FIFOs |
| NFS duplicate-request cache | Bounded server-side request/reply state keyed by RPC identity and peer information. It reduces duplicate execution for selected requests without providing a universal exactly-once guarantee. NFS server |
namei / name cache |
Pathname-resolution machinery and cached name-to-vnode relationships, with identity/concurrency validation. Lookup |
uio / buf |
A description of data-transfer buffers/progress and a block/transfer buffer descriptor. They play different roles from VM pages. VFS I/O |
| UBC / file-data cache | The vnode-to-VM association and file-object resident pages that can serve reads and mappings. A valid data page is not necessarily signature-checked or executable. File-data caching |
| Buffer-cache hit | A matching vnode/logical-block buffer header. Busy ownership, byte validity and metadata-versus-UPL backing remain separate decisions. Buffer cache |
| Vnode generation / hold | An identity check against recycling / protection of the vnode allocation's storage. A hold alone does not authorize operations on the filesystem object; the acquisition path must establish the required iocount and identity. Vnode identity |
cl_writebehind / DRT |
Per-vnode clustered-write tracking / sparse dirty-region tracking. Removing a range from these structures does not itself clean its VM pages or complete storage I/O. Clustered writeback |
VNOP_* / VFS_* |
Dispatch interfaces for per-vnode operations and filesystem-wide operations. VFS dispatch |
| PCB | Protocol control block, such as inpcb for Internet endpoint state and tcpcb for TCP-specific connection state. TCP/IP |
| Mbuf | BSD packet/data storage unit with chain links, metadata, and optional external backing. TCP/IP |
ifnet / DLIL |
Network-interface state and the data-link interface layer connecting protocols, queues, and driver callbacks. TCP/IP |
| Interface I/O reference / data-movement reference | Separate participation counts used to quiesce interface users and data paths during detach; retaining the ifnet object alone is insufficient. Packet and interface lifetimes |
| Skywalk channel / nexus | Shared-ring endpoint and provider-instance infrastructure for supported packet/data paths. Skywalk |
IOService / user client |
An IOKit service/driver object and an interface object controlling operations from user space. Drivers |
OSObject / OSMetaClass |
Reference-counted kernel C++ object and its class metadata. Collection-tagged ownership, module/class pins and class-instance tracking have distinct accounting rules. Object runtime |
| Registry plane | A named parent/child graph over I/O Registry entries. One entry can participate in several planes and has a separate property dictionary. Registry planes |
| Matching notifier / interest notifier | Registration for matching service lifecycle events / messages associated with a particular service. Removal includes an invocation-drain protocol with a self-callback exception. Notifications and arbitration |
OSAction |
DriverKit callback object holding a target, callback/target method IDs and optional private reference bytes. Its kernel aborted notification is separate from the externally implemented user-space cancellation/wait contract. DriverKit actions |
| Memory descriptor / DMA command | IOKit descriptions/preparation of memory and machinery for device-visible mappings/segments. CPU virtual addresses and DMA addresses are distinct. Drivers |
IOMemoryMap |
An IOKit CPU mapping object, retained subset view, or static alias. Mapping ownership differs from descriptor preparation and device-address mappings. CPU mappings |
IODataQueue / IOCircularDataQueue |
Shared-memory FIFO with producer/consumer offsets / overwriting queue with per-entry and reader-cursor validation. Their notification and failure-progress contracts differ. Shared queues |
IOPMPowerState / PM request |
A driver's declared power-state capabilities and requirements / queued work used by the power state machine. State index, optional state order, parent power and outstanding acknowledgments are separate inputs. Device power |
| Root-domain capability transition | System-level change in available CPU, graphics, audio and network capabilities, coordinated with notifications, driver power and platform sleep/wake. System sleep |
| Hibernation image1 / image2 | Early-restored image portion and the remaining pageable image restored after kernel execution resumes. Selection bitmaps, scratch-page collision handling and VM cleanup connect the two stages. Image creation, restoration |
IOReporter / performance-control token |
Channel/element sampling infrastructure / identity and retained state for a submitted unit of device work. Reporting samples and controller work lifetime are separate protocols. Reporting and performance control |
| Kauth / MAC | Authorization and mandatory-access-control framework mechanisms called by operation-specific code. Their interfaces do not contain every external policy implementation. Security |
ucred / kaudit_record |
Shared credential identity and label state / an in-progress or queued audit event. Credential publication, operation authorization, audit commit and audit-file output have different completion points. Credentials, audit |
| SuperBlob / CodeDirectory | An indexed serialized signature container / the selected signed description of code and special-slot hashes, geometry, identifiers and flags. Structural acceptance, certificate trust and page-byte matching are separate checks. Signature format |
| CDHash | The fixed 20-byte identity derived from hashing the selected CodeDirectory. It is not a hash of the entire file or SuperBlob; the cached identity survives selected in-memory signature transformations. Hash identities |
cs_blob / signature attachment |
A vnode-owned wrapper for signature coverage, retained bytes, accepted properties and optional monitor/entitlement state, published through UBC. Readers require the documented vnode/paging lifetime protection. Attachment lifecycle |
Signing generation / cs_mtime |
Cached policy-generation acceptance / a recorded first-attachment modification time. Neither is a per-page byte-integrity result. Revalidation and invalidation |
vmp_cs_validated / tainted / NX |
VM subpage masks recording checked, tainted, and non-executable state. A mismatch can set both validated and tainted; callers must interpret all applicable bits and policy. Page integrity |
csm_associated |
VM-entry state recording successful code-signing-monitor region association. It does not by itself establish that every resident page has passed the eventual executable-mapping check. Executable policy |
| Kdebug / kperf / Recount | Event tracing, triggered sampling, and accumulated resource accounting. They answer different questions. Observability |
| Stackshot / kcdata | Structured task/thread capture and the chunked record format used for diagnostic output. Observability |
For a name not listed here, use the source-reference index or start from the subsystem's structure table. The definition and its nearby lock/lifetime comments are usually more informative than expanding the acronym alone.