| 1-1 | Microsoft Windows NT 3.1 | 3 |
| 1-2 | Copland architecture | 7 |
| 1-3 | BeOS | 8 |
| 1-4 | NEXTSTEP | 13 |
| 1-5 | The timeline of NeXT's operating systems | 14 |
| 1-6 | OPENSTEP | 15 |
| 1-7 | Mac OS 8 | 26 |
| 1-8 | Mac OS 9 | 27 |
| 1-9 | Rhapsody | 28 |
| 1-10 | Yellow Box running on Microsoft Windows XP | 30 |
| 1-11 | An approximation of the Mac OS X timeline | 32 |
| 1-12 | Mac OS X Public Beta | 35 |
| 2-1 | The high-level architecture of Mac OS X | 45 |
| 2-7 | A Universal Binary containing PowerPC and x86 Mach-O executables | 68 |
| 2-12 | Hierarchical structure of the iTunes application bundle | 77 |
| 2-14 | Standard frameworks on Mac OS X | 85 |
| 2-15 | Standard umbrella frameworks on Mac OS X | 86 |
| 2-19 | The Mac OS X graphics and multimedia architecture | 91 |
| 2-20 | The key constituents of Quartz | 92 |
| 2-21 | An overview of Quartz Extreme | 95 |
| 2-22 | An overview of Quartz Extreme with Accelerated 2D | 96 |
| 2-23 | Interfaces to OpenGL in Mac OS X | 97 |
| 2-24 | Image processing with Core Image | 98 |
| 2-25 | Core Image and Core Video in the QuickTime video-rendering pipeline | 98 |
| 2-27 | A Core Data stack | 112 |
| 2-34 | The Mac OS X security architecture | 133 |
| 2-40 | Xgrid architecture | 148 |
| 2-41 | Xsan architecture | 151 |
| 3-1 | Architecture of a dual-processor Power Mac G5 system | 158 |
| 3-2 | HyperTransport I/O link | 162 |
| 3-3 | The PowerPC 9xx family and the POWER4+ | 173 |
| 3-4 | Caches and buffers in the 970FX | 176 |
| 3-6 | Address translation in the 970FX MMU | 183 |
| 3-8 | PowerPC UISA and VEA registers | 189 |
| 3-11 | PowerPC OEA registers | 195 |
| 3-13 | The core of the 970FX | 203 |
| 3-14 | The 970FX instruction pipeline | 205 |
| 3-15 | The FPU and FXU/LSU issue queues in the 970FX | 209 |
| 3-21 | Darwin 32-bit ABI runtime stack | 235 |
| 3-23 | Examples of stack usage in functions | 235 |
| 3-24 | Examples of stack usage in functions (continued from Figure 3-23) | 236 |
| 3-29 | Overview of function rerouting by instruction patching | 249 |
| 3-30 | Unconditional branch instruction on the PowerPC | 249 |
| 3-37 | simg5 output | 261 |
| 4-1 | Defining a Forth word: syntactic requirements and conventions | 281 |
| 4-5 | The Towers of Hanoi: layout and relative dimensions of on-screen objects | 304 |
| 4-9 | Actual photo of the Towers of Hanoi program in Open Firmware | 314 |
| 4-15 | A window created using Open Firmware primitives | 324 |
| 4-19 | An AppleRAID software RAID configuration | 345 |
| 4-20 | The EFI architecture | 368 |
| 4-21 | Booting an operating system through EFI | 371 |
| 4-23 | A GPT-partitioned disk | 375 |
| 5-1 | A high-level view of Mac OS X system startup | 388 |
| 5-2 | Low-level processor initialization | 389 |
| 5-8 | High-level processor initialization | 406 |
| 5-11 | Bootstrapping kernel subsystems | 422 |
| 5-12 | High-level virtual memory subsystem initialization | 424 |
| 5-14 | I/O Kit initialization | 436 |
| 5-17 | BSD initialization | 444 |
| 5-22 | Slave processor initialization | 471 |
| 5-25 | Guidelines and caveats for creating launchd-compliant daemons | 478 |
| 5-28 | A high-level depiction of launchd's operation | 485 |
| 5-29 | The sequence of operations performed by /etc/rc | 486 |
| 5-30 | The sequence of operations performed by /etc/rc (continued from Figure 5-29) | 487 |
| 5-31 | Overview of session launching by launchd | 488 |
| 5-33 | Important steps performed by the loginwindow application | 492 |
| 5-34 | The handling of user logout, system restart, and system shutdown by loginwindow | 494 |
| 5-35 | Single-user bootstrap through launchd | 495 |
| 6-9 | A high-level view of exception processing in the xnu kernel | 543 |
| 6-11 | Processing of traps, interrupts, and system calls | 548 |
| 6-12 | Details of system call processing in Mac OS X | 555 |
| 6-13 | Mapping an incoming system call number to an index in the first-level system call dispatch table | 557 |
| 6-15 | An example of system call argument munging | 565 |
| 6-35 | The Mac OS X auditing system | 621 |
| 6-37 | The composition of a debug code in the kdebug facility | 626 |
| 6-44 | The low-memory global data area | 651 |
| 6-54 | Software dependencies in the kernel build process | 679 |
| 7-1 | An overview of the Mac OS X process subsystem | 688 |
| 7-4 | A processor set containing two processors | 694 |
| 7-5 | A processor set with two processors on its active queue | 695 |
| 7-11 | Functions for creating kernel threads | 713 |
| 7-12 | The shuttle and thread data structures in Mac OS X 10.0 | 715 |
| 7-13 | The shuttle and the thread within a single structure in Mac OS X 10.3 | 715 |
| 7-25 | User-space processing of the fork() system call | 749 |
| 7-27 | Kernel-space processing of the fork() system call | 753 |
| 7-29 | Kernel-space processing of the vfork() system call | 757 |
| 7-31 | Pthread creation in the system library | 761 |
| 7-38 | Scheduling-related initializations during system startup | 776 |
| 7-46 | A nonexhaustive call graph of functions involved in thread execution and scheduling | 790 |
| 7-57 | The operation of the execve() system call | 813 |
| 7-60 | User stack arranged by the execve() system call | 823 |
| 8-1 | An overview of the Mac OS X memory subsystem | 839 |
| 8-5 | The Mac OS X implementation of the Mach VM architecture | 848 |
| 8-6 | Details of the Mac OS X Mach VM architecture | 850 |
| 8-7 | The Mach pager interface in Mac OS X | 857 |
| 8-8 | Symmetric copy-on-write using shadow objects | 863 |
| 8-9 | Asymmetric copy-on-write using copy objects | 864 |
| 8-10 | The structure of a resident page | 869 |
| 8-13 | Initialization of the hardware-independent part of the Mach VM subsystem | 879 |
| 8-22 | dyld's operation while loading a non-split-segment file | 934 |
| 8-23 | dyld's operation while loading a split-segment file | 935 |
| 8-26 | Structure of the LC_PREBOUND_DYLIB load command | 941 |
| 8-30 | An overview of the Mac OS X malloc implementation | 954 |
| 8-32 | Internal bookkeeping of tiny allocations (32-bit) | 959 |
| 8-34 | Internal bookkeeping of small malloc allocations (32-bit) | 965 |
| 8-35 | Processing of the malloc() function in the system library | 967 |
| 8-43 | An overview of memory allocation in the Mac OS X kernel | 981 |
| 8-44 | An overview of memory deallocation in the Mac OS X kernel | 982 |
| 8-48 | Setting up the vnode pager during the open() system call | 1002 |
| 8-49 | Setting up of the vnode pager for a newly created vnode | 1003 |
| 8-50 | Kernel processing of the mmap() system call | 1004 |
| 8-51 | An overview of a page-in operation | 1006 |
| 8-52 | Paging in from a vnode | 1007 |
| 8-53 | An overview of a page-out operation | 1008 |
| 8-54 | Paging out to a vnode | 1009 |
| 8-56 | An overview of 64-bit support in Mac OS X | 1017 |
| 9-2 | The layout of a complex Mach message | 1035 |
| 9-5 | An overview of Mach IPC implementation in Mac OS X | 1041 |
| 9-7 | A view of the internal structure of a Mach port | 1045 |
| 9-10 | The allocation of a port right | 1053 |
| 9-12 | An overview of the kernel processing for sending a Mach IPC message | 1059 |
| 9-13 | An overview of the kernel processing for receiving a Mach IPC message | 1061 |
| 9-14 | Initialization of the IPC subsystem | 1062 |
| 9-30 | Creating a MIG-based client and server system | 1107 |
| 9-31 | Invocation of Miscellaneous Server routines by a client | 1109 |
| 9-35 | Kernel functions involved in Mach exception delivery | 1119 |
| 9-40 | Implementation of the signal mechanism in the kernel | 1139 |
| 9-41 | Program-visible data structures involved in file descriptor passing | 1148 |
| 9-47 | Communication in a Distributed Objects client-server system | 1166 |
| 9-64 | Creating and adding run-loop input sources | 1202 |
| 9-69 | An overview of Mac OS X synchronization mechanisms | 1211 |
| 9-76 | Interfaces for advisory-mode file locking | 1231 |
| 10-1 | An overview of the I/O Kit | 1238 |
| 10-2 | The I/O Kit class hierarchy | 1240 |
| 10-12 | Kext management | 1268 |
| 10-14 | The kernel's sysctl hierarchy | 1277 |
| 10-21 | The sequence of I/O Kit driver methods called in a driver's lifecycle | 1287 |
| 10-22 | Processing involved in user-program-induced framebuffer rotation | 1289 |
| 10-27 | Relevant contents of the IOExternalMethod structure corresponding to getOrientationUC() | 1300 |
| 10-39 | Dissection of a kernel panic dump | 1323 |
| 10-40 | Logging in Mac OS X | 1326 |
| 10-42 | Objects that implement target-side KDP | 1329 |
| 10-43 | A KDB setup | 1332 |
| 11-3 | A disk partitioned using the Apple partitioning scheme | 1351 |
| 11-4 | An overview of disk arbitration | 1354 |
| 11-8 | An I/O Kit stack depicting a disk device and its partitions | 1363 |
| 11-10 | A typical read request's journey to a disk device | 1365 |
| 11-11 | How a file descriptor leads to a file in Mac OS X | 1375 |
| 11-12 | An overview of the vnode/vfs layer's role in the operating system | 1377 |
| 11-13 | A mounted file system and its vnodes | 1379 |
| 11-14 | Configuration information for file system types supported by the kernel | 1380 |
| 11-18 | Mac OS X file system APIs | 1387 |
| 11-19 | Structure of a symbolic link on the MS-DOS file system on Mac OS X | 1390 |
| 11-20 | Implementation of the WebDAV file system | 1399 |
| 11-21 | Architecture of the Spotlight system | 1412 |
| 11-23 | An overview of the fsevents mechanism's implementation | 1419 |
| 11-24 | Event generation in the fsevents mechanism | 1421 |
| 11-30 | An overview of the kauth mechanism | 1447 |
| 11-31 | Kauth scopes and actions | 1448 |
| 11-32 | An overview of the scope and listener data structures in the kauth mechanism | 1450 |
| 11-33 | Authorization in the vnode scope | 1452 |
| 11-34 | The design of a simple vnode-level file system activity monitor | 1454 |
| 12-1 | A disk containing two HFS+ volumes | 1478 |
| 12-2 | The structure of an HFS+ B-Tree node | 1485 |
| 12-3 | The structure of an HFS+ B-Tree header node | 1486 |
| 12-4 | The structure of an HFS+ B-Tree record | 1487 |
| 12-5 | The contents of a hypothetical HFS+ B-Tree | 1489 |
| 12-6 | The structure of an HFS+ volume | 1492 |
| 12-9 | An HFS wrapper volume containing an embedded HFS+ volume | 1503 |
| 12-13 | Searching in the Catalog B-Tree | 1513 |
| 12-14 | An overview of accessing a file's contents | 1514 |
| 12-17 | Searching in the Extents Overflow B-Tree | 1521 |
| 12-19 | Searching in the Attributes B-Tree | 1525 |
| 12-21 | Unicode filenames in Mac OS X | 1533 |
| 12-22 | Algorithm for determining ownership rights to a file system object | 1537 |
| 12-23 | Processing of the F_FULLFSYNC file control operation | 1540 |
| 12-24 | The VFS-layer journaling interface in Mac OS X | 1541 |
| 12-25 | An overview of the file-system-independent journal used by HFS+ | 1543 |
| 12-30 | Layout of the HFS+ metadata zone | 1562 |
| 12-31 | Transitions between Hot File Clustering stages | 1564 |
| 12-32 | Searching in the Hot Files B-Tree | 1566 |