The macOS Evolution

The architecture of macOS evolved from a proprietary, non-protected cooperative system into a standardized Unix operating system. By analyzing its transition from the Classic Mac OS to the NeXTSTEP foundation, developers can understand how modern features like memory protection, hybrid kernel architecture, and dynamic binary translation are implemented in consumer systems.

The Problem: Classic Mac OS (1-9)

The original Mac OS, spanning versions 1 through 9, was optimized for single-user desktop hardware but lacked the architectural safeguards of modern multi-user systems:

• Cooperative Multitasking: Rather than the kernel scheduling processor time, applications voluntarily yielded control back to the operating system. If an application entered an infinite loop, the entire system hung.
• Shared Address Space: There was no virtual memory isolation between processes or between user applications and the operating system. Any application could write directly to memory areas reserved for other programs or the OS itself.
• Lack of Kernel Abstraction: The system operated as a collection of system traps and toolbox managers loaded directly into memory without a central kernel coordinator.

The cooperative yielding loop in Classic Mac OS applications is illustrated by the standard event loop skeleton:

/* Example of Classic Mac OS cooperative event loop yielding */
#import <Events.h>

void event_loop(void) {
    EventRecord event;
    Boolean done = false;
    while (!done) {
        // The application had to explicitly call WaitNextEvent to yield CPU cycles to the OS
        if (WaitNextEvent(everyEvent, &event, 60, NULL)) {
            if (event.what == kHighLevelEvent) {
                // Process events
            }
        }
    }
}

If the application failed to execute WaitNextEvent, other processes received no CPU execution time.

The Savior: NeXTSTEP

After leaving Apple, Steve Jobs founded NeXT Computer, which developed the NeXTSTEP operating system. NeXTSTEP departed from cooperative architectures by implementing a modern Unix platform constructed from:

1. The Mach Microkernel: Providing hardware abstraction, virtual memory management, and inter-process communication.
2. BSD Unix: Sourcing system commands, file systems, user permission structures, and the TCP/IP networking stack.
3. Objective-C: Serving as the system-native object-oriented language.

When Apple acquired NeXT in 1997, NeXTSTEP was selected as the replacement for Classic Mac OS, forming the foundation of Mac OS X.

The following code illustrates the object-oriented structure of a NeXTSTEP application using AppKit:

/* Example of NeXTSTEP-style Objective-C using AppKit components */
#import <appkit/appkit.h>

@interface AppController : NSObject
- (void)applicationDidFinishLaunching:(NSNotification *)notification;
@end

@implementation AppController
- (void)applicationDidFinishLaunching:(NSNotification *)notification {
    // NeXTSTEP used Display PostScript alerts managed via AppKit objects
    NXRunAlertPanel("Alert", "Hello from NeXTSTEP!", "OK", NULL, NULL);
}
@end

The Darwin Architecture

Underneath the Aqua graphical interface, macOS runs on Darwin, an open-source Unix operating system maintained by Apple. At the center of Darwin is the XNU kernel (X is Not Unix).

package "User Interface (Aqua)" {
[Finder / Dock]
}
package "Application Frameworks" {
[SwiftUI / Cocoa]
[Metal (Graphics)]
[Quartz / Core Animation]
}
package "Darwin (Open Source Core)" {
package "XNU Kernel" {
  [Mach (Microkernel)]
  [BSD (Monolithic Logic)]
  [I/O Kit (Drivers)]
}
}
node "Hardware (Apple Silicon / Intel)"
Darwin -> Hardware

The Hybrid Approach

XNU is classified as a hybrid kernel because it runs Mach microkernel primitives and monolithic BSD code within a single kernel address space. This design preserves the clean abstractions of Mach ports and tasks while resolving the performance issues that affect pure microkernels, where message passing requires traversing memory boundaries.

Darwin environment properties can be inspected directly using command line utilities:

# Example: Query kernel name, release, and Darwin version info
uname -a

On a modern system, this command returns the XNU version tag:

Darwin MacBook-Pro.local 23.5.0 Darwin Kernel Version 23.5.0: Wed Apr 10 22:06:25 PDT 2024; root:xnu-10089.121.1~2/RELEASE_ARM64_T6030 arm64

The Transitions

Apple transitioned the operating system across multiple hardware architectures while maintaining software backward compatibility:

1. 68k to PowerPC (1994): Integrated a 68k emulator inside the system ROM.
2. PowerPC to Intel (2006): Employed the original Rosetta translator to convert PPC code at runtime.
3. Intel to Apple Silicon (2020): Implemented Rosetta 2 to translate x86_64 instructions into ARM64 instructions.

To support these transitions, compiler toolchains package binaries using universal container formats (fat binaries) containing compiled code for multiple instruction set architectures.

# Example: Query architectures supported by a universal binary using lipo
lipo -info /usr/bin/python3

This query shows the target architectures embedded in the binary:

Architectures in the fat file: /usr/bin/python3 are: x86_64 arm64e

The Apple Ecosystem: iOS, iPadOS, tvOS

The operating systems running on Apple’s mobile, tablet, and wearable devices are branches of the macOS codebase. iOS, iPadOS, tvOS, and watchOS run on the same Darwin core, utilize the XNU kernel, and share core libraries like Core Animation and the Metal graphics API. The primary differences lie in the shell applications (such as SpringBoard on iOS versus Finder on macOS) and optimized user interface layers.

Both platforms share identical system call interfaces and configuration structures, which can be verified by querying system properties:

# Example: Query the hardware machine type, uniform across macOS/iOS
sysctl hw.machine

This returns the hardware identifier (such as iPhone15,2 or Mac14,7) through the shared Darwin sysctl interface.

Modern macOS Features

The APFS File System

In 2017, Apple introduced the Apple File System (APFS) to replace the legacy HFS+ format. Optimized for solid-state storage, APFS supports file cloning (where copying a file writes no new blocks to disk until one copy is modified) and system-level snapshots.

Security: SIP and Gatekeeper

To prevent malware from gaining persistence, macOS implements System Integrity Protection (SIP). SIP restricts the root user from modifying directories containing system binaries (such as /System, /sbin, and /usr). You can query the SIP status from the terminal:

# Example: Check System Integrity Protection (SIP) status
csrutil status

If protected, the command reports:

System Integrity Protection status: enabled.

Interactive Practice: macOS and Darwin Evolution

To demonstrate your understanding of the Darwin architecture and history, complete the practice quiz below.

References & Further Reading

For an example of detailed documentation on Darwin/macOS evolution, refer to the sources below:

• Singh, A. (2006). Mac OS X Internals: A Systems Approach. Addison-Wesley Professional.
• Levin, J. (2013). Mac OS X and iOS Internals: To the Apple’s Core. Wrox.
• Apple Inc. (2020). Apple File System Reference. Apple Developer Publications.
• Cooperative multitasking (CC-BY-SA 4.0)