List of Programs, Code Excerpts, and Command-Line Examples

2-2Sequence of GDB commands for generating a crash report61
2-3The structure of the Mach-O header (32-bit version)63
2-4A trivial C program to be compiled to an "empty" executable64
2-5Displaying the load commands in an executable's Mach-O header65
2-6Creating fat binaries66
2-8Compiling dynamic and static libraries69
2-9Using a custom initialization routine in a dynamic shared library70
2-10Using weak symbols on Mac OS X 10.2 and newer72
2-11Interposing a library function through dyld73
2-13Bundle structure of a Mac OS X framework83
2-16Listing the load commands in a Mach-O file87
2-17Printing libraries loaded in a program88
2-18Determining whether a Mach-O file is prebound89
2-26Using nibtool to view the contents of a nib file110
2-28Using precompiled headers123
2-29A trivial AppleScript program125
2-30Command-line interaction with the Disc Recording framework127
2-31Command-line interaction with the Disk Images framework127
2-32Using the sips command to resample an image and convert its format128
2-33Using the mdfind command to find files matching a given query129
2-35Using Authorization Services137
2-36Examining keychains using the security command140
2-37Interacting with Directory Services by using command-line tools141
2-38Using the scutil command to access the System Configuration dynamic store142
2-39An audit control file144
3-5Retrieving processor cache information using the sysctl command178
3-7Data prefetching in AltiVec187
3-9Retrieving and displaying the Timebase Register192
3-10Code template for inline assembly in the GNU assembler193
3-12Precision of the floating-point-estimate instruction on the G4 and the G5200
3-16A trivial AltiVec program215
3-17Displaying the contents of the VRSAVE216
3-18A simple C function that calls another function228
3-19Assembly code depicting an indirect function call229
3-20Assembly code depicting a direct function call230
3-22Assembly listing for a C function with no arguments and an empty body233
3-25Printing a function call stack trace237
3-26A recursive function to compute factorials241
3-27Annotated assembly listing for the function shown in Figure 3-26242
3-28A hardware-based compare-and-store function for the 970FX245
3-31Implementation of function rerouting by instruction patching250
3-32Function rerouting in action255
3-33Tracing an "empty" C program using amber257
3-34A C program with instructions that are illegal in user space257
3-35Tracing program execution with amber258
3-36Accounting for instructions traced by amber259
4-2Physical memory properties in the device tree of a PowerBook G4294
4-3Physical memory properties in the device tree of a Power Mac G5295
4-4Dumping NVRAM contents300
4-6The Towers of Hanoi: simulating recursion using a stack305
4-7The Towers of Hanoi: Forth code for animation306
4-8The Towers of Hanoi: Forth code for the program's core logic312
4-10Fabricating and using a mouse pointer in Open Firmware315
4-11AND and XOR masks for an X-shaped pointer317
4-12Pixel-addressable printing in Open Firmware made possible by stealing a font318
4-13A clock implemented in the Open Firmware environment321
4-14PPM image data for a 4x4-pixel image322
4-16A bootinfo file329
4-17Properties of the chosen device node as seen from Mac OS X334
4-18Retrieving a BSD device node's Open Firmware path341
4-22Using the EFI shell372
4-24Listing the partitions on a GPT-partitioned disk376
5-3The kernel's per-processor data table390
5-4The entry for the PowerPC 970FX in the processor-type table395
5-5Data structure and related definitions of a patch-table entry398
5-6The kernel's patch table399
5-7Flushing the L2 cache on the PowerPC 970FX404
5-9Calculating the PowerPC PTEG hash table size used by the kernel412
5-10Initialization of the kprintf() function417
5-13Initializing page frames during VM subsystem initialization425
5-15Loading a replacement panic user interface image into the kernel437
5-16Testing the panic user interface439
5-18Domain and protocol initialization451
5-19Mounting the root file system456
5-20Finding the root device with help from the I/O Kit457
5-21Doing the core work of finding the root device457
5-23A launchd configuration file474
5-24Creating a periodic launchd job476
5-26A trivial echo server called dummyd479
5-27The contents of the com.osxbook.dummyd.plist configuration file483
5-32Implementation of session creation and launching by launchd489
6-1Retrieving basic host information using Mach calls520
6-2Retrieving clock attributes and time values in Mach522
6-3Setting an alarm using Mach calls524
6-4Using Mach calls to retrieve scheduling and virtual memory statistics527
6-5The Mach-O segment containing the exception vectors in the kernel executable534
6-6The kernel's exception vectors535
6-7Trap vectors in Third Edition UNIX536
6-8Structure for a thread's machine-dependent state538
6-10Common code for exception processing544
6-14Passing a long long parameter in 32-bit and 64-bit ABIs564
6-16Details of the final dispatching of BSD system calls566
6-17System call data structures in Third Edition UNIX572
6-18Creating a user-space system call stub573
6-19Directly invoking a BSD system call575
6-20Multiple ways of retrieving a Mach task's self port577
6-21Mach trap table data structures and definitions579
6-22Mach trap table initialization580
6-23Setting up the pid_for_task() Mach trap582
6-24Testing the pid_for_task() Mach trap583
6-25Testing the Thread Info UFT588
6-26Testing the Facility Status UFT589
6-27Enabling the kernel's Blue Box support591
6-28Displaying the contents of the comm area597
6-29Initialization of the kprintf() function604
6-30Invocation of CHUD system-wide hooks for traps and ASTs607
6-31Invoking a disabled PowerPC-only system call608
6-32Implementing a kernel extension to register a PowerPC-only system call609
6-33Using kgmon and gprof for kernel profiling613
6-34Implementation of the profil() system call615
6-36Audit macros in the kernel and how they are used623
6-38kdebug tracing in the BSD system call handler627
6-39Using the kdebug facility in a program630
6-40Common header file for using the diagnostics system call interface642
6-41Retrieving boot-screen information using a diagnostics system call643
6-42Retrieving the physical address (if any) for a virtual address in the caller's address space644
6-43Retrieving physical memory using a diagnostics system call645
6-45Data structures for holding per-processor information652
6-46Causing an exception and retrieving the corresponding counter from the kernel653
6-47Maintenance of hardware exception counters in the kernel654
6-48Processing of low-tracing-related boot-time arguments during system startup656
6-49An example of low-trace record generation by kernel code658
6-50Control data structures for the VMM facility659
6-51A program to run machine code within a VM using the VMM facility663
6-52Result of running a sequence of machine instructions in a VM using the vmachmon32 program674
6-53Result of running a recursive factorial function within a VM using the vmachmon32 program676
7-2The processor set structure in the xnu kernel690
7-3The processor structure in the xnu kernel692
7-6Retrieving information about processors on the host696
7-7Out-of-line data received by a process from the kernel as a result of a Mach call699
7-8Starting and stopping a processor through the Mach processor interface700
7-9The task structure in the xnu kernel702
7-10The thread structure in the xnu kernel706
7-14Retrieving the current thread (shuttle) and the current activation on Mac OS X 10.3 and 10.4716
7-15Blocking with and without continuations719
7-16Continuation-related aspects of the BSD uthread structure721
7-17The use of continuations in the implementation of the select() system call722
7-18The skeleton of the nfsiod program723
7-19Creating a Mach task728
7-20Creating a Mach thread730
7-21Retrieving detailed task and thread information from the kernel732
7-22Counting the number of system calls made by a process745
7-23The BSD proc structure747
7-24The BSD uthread structure748
7-26Registering handlers to be run before and after a fork() system call invocation750
7-28Verifying the values returned by the kernel in the case of a raw fork() system call754
7-30Verifying that the child borrows the parent's resources during a vfork() system call758
7-32Creating and running Java threads762
7-33Using the NSTask Cocoa class763
7-34Using the NSThread Cocoa class765
7-35Launching an application through the Carbon Process Manager767
7-36Using Carbon Multiprocessing Services769
7-37Creating Carbon Thread Manager threads772
7-39Real-time clock interrupt processing778
7-40System clock configuration781
7-41Converting between absolute- and clock-time intervals783
7-42Scheduler startup785
7-43Sampling the value of the scheduler tick786
7-44Timer call processing788
7-45The scheduler's bookkeeping function788
7-47The run queue structure792
7-48Important scheduling-related fields of the task and thread structures793
7-49Computation of the timesharing priority of a thread795
7-50User-space computation of sched_pri_shift and sched_tick_interval796
7-51Computation of the usage-to-priority conversion factor for timeshared priorities798
7-52Approximating multiplication by 5/8 as implemented in the scheduler800
7-53Experimenting with the THREAD_PRECEDENCE_POLICY scheduling policy803
7-54Experimenting with the THREAD_TIME_CONSTRAINT_POLICY scheduling policy807
7-55Recomputing a thread's priority on a scheduling-policy change810
7-56Structure for holding executable image parameters during the execve() system call812
7-58Creation of the user stack during the execve() system call820
7-59A Mach-O executable with a custom stack821
7-61Dumping the Launch Services registration database829
7-62Example of a UTI declaration832
8-2A shell script for reading kernel virtual memory842
8-3Using the kvm(3) interface to read kernel memory844
8-4Determining the size of physical memory on a system846
8-11Grabbing a page from the free list873
8-12Reserving physical memory874
8-14Controlling memory inheritance894
8-15Protecting memory897
8-16Accessing another task's memory899
8-17Common header file for the shared memory client-server example902
8-18Source for the shared memory client903
8-19Source for the shared memory server905
8-20Examples of exported UBC routines915
8-21System-wide shared memory setup during bootstrapping923
8-24Using shared_region_map_file_np()936
8-25Loading a split-segment library in the global shared region939
8-27Reading the contents of the TWS subsystem's global user profile cache945
8-28TWS-related processing during the execve() system call947
8-29The malloc zones API952
8-31Scalable zone data structures955
8-33A program that performs tiny allocations960
8-36Determining the size of the largest single malloc() allocation968
8-37Allocating 2 petabytes of virtual memory970
8-38Implementing a version of the printf() function without using malloc()971
8-39Enumerating all malloc()-allocated pointers in a program972
8-40Displaying scalable-zone statistics974
8-41Logging malloc operations977
8-42Intercepting the malloc layer979
8-45Zone allocator functions988
8-46Printing sizes of kalloc zones supported in the kernel992
8-47Array of memory types supported by the BSD memory allocator998
8-55Using a 64-bit-only instruction1011
9-1System library wrappers around Mach messaging traps1033
9-3Descriptors for sending ports and out-of-line memory in Mach IPC messages1036
9-4Requesting the kernel to include the sender's security token in the message trailer1039
9-6The data structure for a task's IPC space1042
9-8IPC-related data structures associated with a Mach task1048
9-9IPC-related data structures associated with a Mach thread1051
9-11Listing the Mach ports and their attributes in a given process1055
9-15Displaying information about all known services in a bootstrap context1072
9-16A crash-resistant server1074
9-17launchd debug messages corresponding to a Mach server's initialization1077
9-18launchd debug messages corresponding to a Mach server's relaunch1078
9-19Common header file for the simple IPC client-server example1080
9-20Source for the simple IPC server1081
9-21Source for the simple IPC client1083
9-22Using a port set to receive request messages destined for multiple services1086
9-23Inserting port rights into an IPC space1088
9-24Sending out-of-line memory in an IPC message1091
9-25Sending port rights in an IPC message1093
9-26Common header file for the Miscellaneous Server and its client1100
9-27MIG specification file for the Miscellaneous Server1102
9-28Programmer-provided source for the Miscellaneous Server1103
9-29A client for accessing the services provided by the Miscellaneous Server1106
9-32Initialization of MIG subsystems during kernel bootstrap1111
9-33Exception ports at the host, task, and thread levels1113
9-34Initialization of exception handling during kernel bootstrap1114
9-36Delivery of Mach exceptions1120
9-37Processing of unresolved kernel traps1121
9-38An exception handler for "fixing" illegal instructions1123
9-39Signal notification of asynchronous I/O completion1133
9-42Common header file for the descriptor-passing client-server implementation1150
9-43Implementation of the descriptor-passing server1150
9-44Implementation of the descriptor-passing client1153
9-45Working with POSIX semaphores1157
9-46Working with POSIX shared memory1161
9-48Common header file for the Distributed Objects client-server example1167
9-49Server source for the Distributed Objects client-server example1167
9-50Client source for the Distributed Objects client-server example1169
9-51Exception-handling macros in the Foundation framework1171
9-52AppleScript program to speak the system version1173
9-53AppleScript program for opening and tiling Terminal application windows1175
9-54Sending Apple Events to the Finder from a C program1177
9-55A program for posting distributed notifications (NSNotification)1182
9-56A program for observing distributed notifications (NSNotification)1183
9-57Common header file for defining notification names1185
9-58Program for posting notify(3) notifications1186
9-59Receiving notifications through multiple mechanisms1187
9-60Monitoring a file through notify(3)1191
9-61Using the kqueue() and kevent() system calls to watch for file events1194
9-62A program for posting Core Foundation distributed notifications1198
9-63A program for observing Core Foundation distributed notifications1199
9-65A CFMessagePort server1204
9-66A CFMessagePort client1205
9-67A CFSocket client1207
9-68Using a CFRunLoopTimer1209
9-70Using locks in the kernel1217
9-71The Mach lock set interface1218
9-72Using Mach semaphores1220
9-73Internal structure of a Mach semaphore1222
9-74The structure of a Mac OS X funnel1225
9-75Automatic funnel use in a thread-unsafe file system1227
10-3The main function of the IOWorkLoop class1247
10-4Using IOWorkLoop in a driver1248
10-5The kmod_info structure1254
10-6The contents of a simple kernel extension bundle1260
10-7Excerpt from the build output of a Universal kernel extension1261
10-8Implementation of libkmodc++.a1263
10-9Declaration of the kmod_info structure for an I/O Kit driver kernel module1264
10-10Implementation of libkmod.a1265
10-11Declaration of the kmod_info structure for a generic kernel module1266
10-13Source for the DummySysctl kernel extension1273
10-15Implementing sysctl nodes1277
10-16An I/O Kit driver's personality and dependencies1281
10-17The driver personality of the BootCache kernel extension1282
10-18An excerpt from the iPod driver's property list file1283
10-19Header file for the DummyDriver I/O Kit driver1284
10-20Implementation of the DummyDriver I/O Kit driver's class1285
10-23Programmatically rotating a framebuffer1290
10-24Accessing framebuffer memory1293
10-25Retrieving the list of firmware variables from the I/O Registry1295
10-26Retrieving information about loaded kernel extensions1296
10-28Opening a connection to the motion sensor service object1301
10-29Invoking a user client method given an IOService connection handle1302
10-30Listing PCI devices in the system1303
10-31Retrieving the computer's serial number and model information1304
10-32Retrieving temperature sensor readings1306
10-33Retrieving the MAC addresses of Ethernet interfaces in the system1309
10-34Personality and dependency list for the SimpleCryptoDisk I/O Kit driver1311
10-35Header file for the SimpleCryptoDisk I/O Kit driver1312
10-36Source for the SimpleCryptoDisk I/O Kit driver1314
10-37Reading the contents of cleartext storage directly from the storage medium1320
10-38Using encrypted storage with the SimpleCryptoDisk filter scheme driver1321
10-41Periodic delivery of log messages to readers of the log device1327
10-44A simple C function1339
10-45Stabs-encoded debugging information in an assembly file1340
11-1Using ioctl operations to display information about a disk device1346
11-2Listing a disk's partitions1348
11-5Using Disk Arbitration to obtain a disk's description1355
11-6Expressing dissent against a mount operation1357
11-7Monitoring the appearance and disappearance of storage devices1359
11-9The Mac OS X block and character device switch structures1364
11-15Displaying information about all available file system types1380
11-16Vnode operations vectors in the VFS layer1383
11-17Initialization of vnode operations vectors during bootstrap1385
11-22Retrieving and setting an MDItem attribute1412
11-25A file system change logger based on the fsevents mechanism1422
11-26Programmatically launching the Spotlight search window1431
11-27Pseudocode for creating and running a Spotlight query using the MDQuery interface1433
11-28A program for executing raw Spotlight queries1435
11-29A program to create and set an ACL1443
11-35Common header file for the vnode-level file system activity monitor1455
11-36Source for the vnode-level file system activity monitor kernel extension1457
11-37Source for the user-space retrieval program for the vnode-level file system activity monitor1464
12-7The contents of an HFS+ volume header1494
12-8Finder information contained in the volume header of a boot volume1499
12-10The contents of a master directory block1503
12-11Hinting to the file system where to look for free space on a volume1507
12-12Examining allocation block consumption on a volume1508
12-15Using the Carbon File Manager API to convert a CNID to a Unix pathname1516
12-16The contents of a Catalog B-Tree's header node1518
12-18The contents of an Extents Overflow B-Tree's header node1523
12-20Programmatically setting an extended attribute1527
12-26Examining the HFS+ private metadata folder and hard-link creation1549
12-27Use of the private metadata folder for storing unlinked busy files1552
12-28A Python program to resolve an alias1555
12-29A Perl program to create a file with eight fragments on an HFS+ volume1559
12-33Viewing VFS event notifications using kqueue/kevent1572
12-34Querying a volume's capabilities1576
A-1Using the bless command to view boot-related information in the volume header1589
A-2Using command-line tools to display partitioning-related information1590
A-3Compiling an "empty" C program on the x86, PowerPC, and 64-bit PowerPC1592
A-4Running a program both natively and under Rosetta1593
A-5Testing a nonexecutable stack on the x86 version of Mac OS X1595
A-6Setting up a newly created thread's state on the x86 version of Mac OS X1596
A-7Invoking a system call on the x86 version of Mac OS X1597