# 锚点速查笔记（本目录源码均已验证版本）

版本纪律：引用行号必须同时给出文件与版本。本目录三个源码桶：
- `src/xnu-7195/` = xnu-7195.141.2（iOS 14.8）。其中 `deep2_*/deep3_*` 前缀文件来自 test1/xnu-verify/deep-read（逐字节校验），其余为 GitHub tag 直接抓取。
  ⚠️ test1/xnu-verify **顶层** 的 .c 文件是 xnu **main 分支**（macOS 26 时代），行号与 7195 不通用，本目录已剔除。
- `src/xnu-11215/` = xnu-11215.1.10（iOS 18 世代，与 macOS 26 实测同代）。
- `src/linux-6.1/` = torvalds/linux v6.1。
- 6.12/zswap/zram/memcontrol/vmscan 等在 skill 目录 `~/.dsh/skills/xnu-source-analysis/linux-vm-archive/`。

实测数据：`empirical/`（zprint-macos-26.4.txt、vm_stat、sysctl、slabinfo-linux.txt、meminfo 等）。

## XNU 7195 关键锚点
- zalloc.c(8973行): L156 ZONE_MIN_ELEM_SIZE=8B; L157 ZONE_MAX_ALLOC_SIZE=32KB; L159-197 zone_page_metadata(16B/页,static_assert L197); L227-240 zone_magazine(zc_mag_size 深度); L6580 zone_gc; L8078-8107 zone_phys_size_max(zone map = RAM/4, LP64 再 ×1.5, clamp [CONFIG_ZONE_MAP_MIN, RAM/2, ZONE_MAP_MAX])
- deep2_zalloc_internal.h: L294-310 ZSECURITY_OPTIONS(SEQUESTER/SUBMAP_USER_DATA/SEQUESTER_KEXT_KALLOC/STRICT_IOKIT_FREE)
- kalloc.c(1531行): L199-236 k_zone_cfg 27 桶(16..32768, 小桶 kzc_caching=true); L344-349 堆名 default./data./kext.; L354-400 三堆 zone 数组; L414 kalloc_zones_init
- task.c(8404行): L987-996 phys_footprint 公式(internal-alt)+(internal_compressed-alt)+iokit_mapped+purgeable_nonvolatile(+comp)+page_table; L1018 init_task_ledgers(~45 条目)
- deep2_vm_page.h: L87 vm_page_packed_t=u32; L90-96 打包队列项 8B; L195 struct vm_page(≈48B: q_pageq8+listq8+backgroundq8+offset8+object4+wire位4+next_m4+busy位4); L273-276 ARM 无 vmp_phys_page(数组线性 ppnum); L409-413 vm_page_with_ppnum
- vm_resident.c(9853行): L1642 "vm pages array" 伪 zone(报表用, elem=sizeof(vm_page)); L1668-1685 "vm pages" zone(with_ppnum)
- deep2_vm_map.h: L255 vm_map_entry
- vm_pageout.c(10996行): L226-234 VM_PAGE_FREE_MIN=10+free/200(iOS)
- kern_memorystatus.c(8573行): L5066-5068 memorystatus_pages_update(pages_avail)
- vm_compressor.c(5041行): L818 c_segment_size=sizeof(c_segment)+C_SEG_MAX_PAGES×sizeof(c_slot)
- vm_compressor.h: L46 C_SEG_BUFSIZE=256KB; L47 C_SEG_MAX_PAGES; L192-247 struct c_segment; L250-253 c_slot_mapping=4B(22+10bit); L259
- stack.c: L121-123 kernel_stack_size; L161-171 stack_free_list 缓存; L175-197 KMA_GUARD_FIRST|KMA_GUARD_LAST+2 guard 页, tag VM_KERN_MEMORY_STACK
- machine_routines64.c: L1942 kernel_stack_size getter
- vm_statistics.h: L672 VM_KERN_MEMORY_STACK=8

## XNU 11215 关键锚点
- zalloc.c: L633-646 zone 子映射 VM/RO/GEN/DATA; L2817-2818 z_pcpu_cache; L4714 z_depot_size
- kalloc.c: L117 kt_zone_cfg(kalloc_type 定长桶表); L168-173 堆名 NONE/SHARED/DATA_BUFFERS/KT_VAR; L201 kalloc_type_heap_array; L424-431 KTV_FIXED/KTV_VAR
- vm_page.h: L195 struct vm_page(SPTM 代)
- vm_resident.c: L1629/1672 两个 vm_page zone

## Linux 6.1 关键锚点
- mm_slub.c(6310行): L3885-3887 slub_min_order/max_order(=PAGE_ALLOC_COSTLY_ORDER=3); L3939-3985 calculate_order(min_objects=4×(fls(nr_cpus)+1), 浪费容忍 1/16→1/4); L349-423 freelist_ptr(HARDENED 时 XOR+地址混合); L703 s->offset>=s->inuse
- include_linux_slub_def.h: kmem_cache_cpu(freelist/tid/slab/partial/local_lock ≈40B); struct kmem_cache
- mm_slab_common.c: L673 kmalloc_caches[NR_KMALLOC_TYPES][…]; L783 kmalloc_info[]
- include_linux_slab.h: L226 KMALLOC_MIN_SIZE=ARCH_DMA_MINALIGN; L300-302 KMALLOC_MAX_SIZE/MAX_CACHE_SIZE
- include_linux_mm_types.h: L332/363 STRUCT_PAGE_MAX_SHIFT; L444 vm_area_struct; L512 mm_struct
- kernel_fork.c(3307行): L167-176 task_struct_cachep; L274-423 alloc_thread_stack_node(VMAP_STACK); L464 vm_area_dup; L488-504 account_kernel_stack(NR_KERNEL_STACK_KB 按页记账)
- fs_proc_meminfo.c: L55-56 Slab=NR_SLAB_RECLAIMABLE_B+NR_SLAB_UNRECLAIMABLE_B
- mm_percpu.c / include_linux_percpu.h L22: PCPU_MIN_UNIT_SIZE=32KB
- arm64_asm_memory.h: L34 VMEMMAP_SIZE; L41-59 VA_BITS/VMALLOC/MODULES/KASAN; L77-99 MIN_THREAD_SHIFT=14→THREAD_SIZE=16KB(4K 页亦然)
- arm64_mm_pgd.c: L20-28 pgd_alloc(PGD_SIZE==PAGE_SIZE→单页)
- arm64_mm_mmu.c: L407-412 KPTI temp pgd; L414-442 pgd_pgtable_alloc
- fs_dcache.c: L3308 dentry_cache=KMEM_CACHE_USERCOPY(dentry, SLAB_RECLAIM_ACCOUNT|SLAB_ACCOUNT|…)
- include_linux_fs.h: L593 struct inode
- 页表/KPTI 用户侧 PGD 的逐行引用未定位（mmu.c/pgd.c/pgalloc.h 均无 per-mm 双 PGD 分配），报告中以[知识性结论]标注

## 实测快照（2026-03, Apple M3 同机）
macOS 26.4 (Darwin 25.4, XNU-11215 世代): 8GB/8CPU/16K页; zprint 292 zone 活跃 inuse×elem=840.2MiB; wired 表 total 1950.86M/3086.91M; BOOT_STOLEN 609856K; STATIC_KERNELCACHE 89296K; STACK 42720K; MAP_ZONE VA 159383552K; MAP_KERNEL VA 872415232K; kern.stack_size=16384; vm_stat wired 159482 页(2.44GB); kernel 文件 19.0MB(通用)+16.6MB(per-SoC)
关键 elem: threads 2160/threads_ro 56/proc_task 3640/Per-task.ledger 1568/vm.objects 256/VM.map.entries 64/VM.map.nodes 256/vnodes 264/namecache 104/pmap 160/ipc.ports 144/data.kalloc.16..32768/kalloc.288…
Linux (lima vz VM, Ubuntu 7.0.0-34 aarch64): 5GiB/4vCPU/4K页; Slab 253316K(SRec 163616+SUnrec 89700); KernelStack 2712K+SCS 704K; PageTables 3760K; Percpu 6720K; VmallocUsed 37132K; 内核 code 27776K+rwdata 6298K+rodata 20108K+bss 1303K(init 15168K 已释放); memmap boot 20480 页=80MB(=present 1310720×64B 精确); slabinfo 570 cache(411 有对象) 活跃 233.4MiB; task_struct 8704B; vm_area_struct 192B; dentry 192B; inode_cache 616B; ext4_inode 1128B; anon_vma 104B/anon_vma_chain 64B; files 704B; signal 1152B; kmalloc-rnd-01..15(15 组随机化); 169 线程; 1 module 1684 页

## 组成成分（报告 §2.5）锚点
- vm_resident.c: L328 vm_page_queue_free[MAX_COLORS]; L395/396 active/inactive; L400 anonymous 暂存队列(注释"inactive memory queue for anonymous pages"); L401 throttled; L462 cleaned; L164-166 speculative_age/steal_index + vm_page_queue_speculative[AGE_Q+1]; L446-453 purgeable/ext/int 五计数器
- vm_pageout.c: L216-238 VM_PAGE_FREE_MIN/TARGET（iOS 10+free/200、15+free/100；macOS 10+free/100、15+free/80）; L3479-3499 throttled 入队条件(无动态换页+internal+dirty+不可purge); L1074/L1213 pageout 遍历三队列
- vm_compressor.c: L267 c_segment_pages_compressed(stored 原页当量); L269 _incore(occupied 驻留); L399-413 accessor
- linux fs_proc_meminfo.c: L46-48 cached=NR_FILE_PAGES−total_swapcache−bufferram; L53-56 LRU 数组+slab 两态
- linux mm_page_alloc.c: L422 min_free_kbytes; L5933-5972 si_mem_available(free−totalreserve+pagecache/2−wmark_low+slab 可回收部分); L8720-8740 __setup_per_zone_wmarks(按 managed_pages 分摊)
- linux mmzone.h(skill 存档): L266-285 enum lru_list 五链; L546-551 enum zone_watermarks(MIN/LOW/HIGH/PROMO)
- 实测恒等式: XNU active+inactive+spec+thr = file+anon = 163,944(精确); 总和 485,202/524,288(差 39,086 页=611MiB 固件保留); stored/incore=12.5×; Linux Active+Inactive=四链和=2,141,180(精确); AnonPages 112,588K ≠ LRU-anon 103,708K(差=Unevictable)

## 六版本演化（skill multi-version 口径）
- ZC_ zone_create 标志: iOS12→18 = 0→0→21→33→34→34
- freezer 引用(两文件合计): 384→495→656→831→881→887
- sustained-pressure kill: 0→0→0→3→3→3
- swapout 引用: 48→50→55→101→102→102