Publishers of technology books, eBooks, and videos for creative people

Home > Articles > Apple > Operating Systems

  • Print
  • + Share This
This chapter is from the book

The Layers of Mac OS X: Darwin

Now you delve into the deepest layers of Mac OS X. The umbrella name for this layer is Darwin. Darwin is open-source code, which means that Apple makes the code publicly available ( This availability allows developers to better understand the code as well as modify and improve it. Darwin is sometimes referred to more generically as the Mac OS X kernel environment.

In discussing the layers of Mac OS X, what determines whether something is considered to be at a higher or lower level? The answer is that as a general rule, a component at a lower level is used by all higher-level layers. But the converse is not necessarily true. Thus, an application, whether it is Carbon and Cocoa, uses the core Darwin technology, but Darwin can function without a need for any additional application layer.

Darwin is the core of Mac OS X. The Darwin kernel consists mainly of the FreeBSD and Mach 3.0 technologies. Darwin includes various core services, such as those involved in networking and device drivers. I discuss this topic in more detail in Chapter 5, as I walk through the startup sequence of events. Beyond that, as an end-user troubleshooter, you need be aware only of the two key kernel components.


As a troubleshooter, you will rarely, if ever, be working directly with Mach code. Nonetheless, it is important to understand its basic concepts. Mach refers to the code that handles the most fundamental aspects of Mac OS X. It is also responsible for several of Mac OS X's most touted benefits:

Preemptive multitasking. This term refers to how Mac OS X can schedule its processor activity among different open applications or processes. (All applications are processes, but not all processes are user-accessible applications.) Mac OS 9 used cooperative multitasking, which was not very intelligent. In Mac OS 9, unimportant but CPU-intensive background events might take up so much of a processor's time that more important activities in the foreground would become sluggish and unresponsive. Neither you nor the OS could do much about this situation. Mac OS X's Mach has much more flexibility in how it handles these matters. In essence, it can preempt any running process, giving something else more attention. It can note intelligently what activities are in the foreground and make sure that they get the lion's share of attention. Developers can also write hooks in their software to increase (or decrease) the priority that their software should get. As a result, operations that need the most processor activity at any moment should get the most, enhancing overall performance. This is a good thing.

A related benefit of Mac OS X's multitasking capability is that fewer modal functions prevent you from doing other tasks. That is, Mac OS X offers multithreading. In Mac OS 9, when you launched an application, you typically had to wait for it to finish launching before you could do anything else. This process could take a minute or two. Mac OS X doesn't have these waiting games. Instead, once a program starts to launch, you can begin another activity right away. You could check your email while waiting for Classic to launch and Photoshop to open, for example.

Protected memory. Metaphorically, protected memory means that the memory assigned to each open process is entirely separate (protected) from that of every other open process. The result is that systemwide crashes should almost vanish from the landscape. If and when an application crashes, it should cause only the application itself to go belly up; the rest of the operating system should remain functional. In the event that a program freezes (such as when you get an endlessly spinning beach-ball pointer), you will still be able to switch to a different program (such as the Finder) and continue to work as normal, even while the problem application remains frozen. This would be impossible to do in Mac OS 9. Protected memory also means that you should almost never need to restart the Mac to recover from a crash.

Virtual memory. Virtual memory allows you to simulate memory (RAM) via a special file on your hard drive. The main advantage of virtual memory is that if you do not have sufficient physical (built-in) RAM for what you want to do, you may get the RAM boost you need via virtual memory.

In Mac OS 9, you could choose to turn virtual memory on or off. As virtual memory tended to slow performance, it typically was wise to turn it off if your physical RAM was more than adequate for your needs. In Mac OS X, virtual memory must always remain on. Until you really start pushing its limits (by having way too many applications open at the same time, for example), you should not notice a performance hit.

Still, you can't have too much physical RAM. And given the current low prices of memory, I would recommend buying as much RAM as you think you will ever need—or more.

Dynamic memory. In Mac OS 9, the amount of memory assigned to an application is fixed (or static) when the program is launched. You assign this fixed amount via the Memory settings in the application's Get Info window. After an application was launched, if it needed more or less memory than was assigned to it when it launched, the OS could not do about the situation. You had some limited ability to add RAM assigned to an application, via an OS feature called temporary memory, but not all programs could use this feature, and it did not solve the problem completely.

One result is that you would still wind up getting "out of memory" error messages in Mac OS 9, even when you technically had enough memory available for what you wanted to do. The OS could not shuttle the memory around to where it was needed at the moment.

In Mac OS X, memory assignment is dynamic, which means that the amount of memory assigned to an application can be increased or decreased as needed. Thus, if an application is idling in the background and hogging unused memory, the OS can grab some of this memory for another application that needs it more. The combination of dynamic memory assignment and Mac OS X's virtual memory means that you should almost never see "out of memory" error and should have fewer memory-related system freezes and crashes.

Similarly, the total amount of memory available as virtual memory can be adjusted on the fly in Mac OS X. You could not do this in Mac OS 9. Making a change in the total size of virtual memory required restarting the Mac.

Mac OS X manages all these tasks and also allocates memory intelligently from physical and virtual memory so as to maximize the performance of each application. Still, as I implied earlier, memory availability in Mac OS X is not infinite. If you push your Mac to its memory limits, you will start noticing an overall decline in the performance of everything. Applications may succeed in opening without an error message, but you will still see the effects of too-little memory. That's why getting more physical RAM still makes sense.


Mac OS X's Show Info window still includes a Memory tab for Classic applications, because Classic applications do not take advantage of Mac OS X's dynamic-memory feature.

Figure 04Figure 4.4 The Memory tab of the Show Info window for a Classic application.

BSD (Unix)

BSD stands for Berkeley Software Distribution. It used to be called the Berkeley version of Unix but is now referred to as BSD, so referring to it as Unix is a bit incorrect. For all practical purposes, however, the term is synonymous with "a version of Unix." A portion of the Mac OS X kernel is based on FreeBSD, a version of BSD.

Note: Part of the BSD installation is optional when you install Mac OS X. The optional component is installed by default, however, unless you do a custom installation and choose not to install it. Overall, there is little cost (other than some disk space) in installing the optional files, and there are some Mac OS X features and some third-party software will not work without the files present. So I advise going with the default installation.


  • "Mac OS X: The down and up sides," in Chapter 1, for background on why Unix is included as part of Mac OS X.

  • Chapter 2 for more information on installing Mac OS X.

The integration of Unix in Mac OS X represents a significant change from Mac OS 9. In Mac OS 9, the System Folder was the OS. Except for a few invisible files (such as the Desktop files), all OS files were in the System Folder where they were easily accessible. In Mac OS X, the entire Unix layer remains largely invisible from the Aqua Finder. Thus, Mac OS X has a sort of secondary OS underneath the visible OS.

Occasionally, troubleshooting will require that you access or modify these hidden Unix files. One place where this requirement will likely crop up is file privileges. The Show Info window's Privileges settings are only a subset of the underlying Unix permissions that are really in use. The settings that you can't see can cause a variety of unexpected problems with opening, moving, or deleting files.


  • "Technically Speaking: Privileges vs. Permissions," in Chapter 3, for more background on this subject.

  • Chapter 6 for solving troubleshooting problems that require modifying privileges/permissions settings.

  • Chapter 8 for more coverage of file sharing.

You access Unix commands and files in Mac OS X in three main ways:

Terminal. The Terminal application (included with Mac OS X) essentially provides a command-line environment where most Unix commands will work, just as though you were in a true Unix environment. Still, Terminal let's you know right away that you are not exactly in standard Unix, via its "Welcome to Darwin!" greeting. Any changes that you make in Terminal, such as renaming or deleting files, will modify the Aqua environment as well, so you need to be careful.

Finder and text editors. Tasks such as moving or deleting Unix files can usually be directly done from the Finder. You can also modify some Unix files via text editors such as TextEdit and BBEdit. In many cases, this will require you to log in as a root user or use a utility that makes invisible files visible.

Aqua utilities. Via an Aqua-based interface, many third-party utilities allow you to more easily do what otherwise would require you to use Terminal.


  • "Take Note: Root Access," in Chapter 3, for more information on logging in as a root user.

  • "Technically Speaking: Log Files and Cron Jobs," in Chapter 3, for an example of accessing Unix invisible files from the Finder and via GUI utilities.

  • Chapters 3 and 6 for several examples of how to access the invisible Unix files from the Finder.

  • Chapter 10 for more information on understanding Unix and using Terminal.


What and Where Are the Unix Files?

The "system" software for Unix is located at the root level of the Mac OS X volume. You can see these invisible directories and files from the Finder by using a utility, such as TinkerTool, to make invisible files visible (as described more in Chapter 6).

Or you can use Terminal. To do so from Terminal, type: <cd />. Now type <ls>. This will list the contents of the root level.

Here is a sampler of the Unix directories and files found at the root level:

bin is the directory where most of the main Unix commands (or executables) are stored. These are the equivalent of what in Mac OS X would be called applications.

dev is where device drivers are stored. This are the files needed for your computer to interact with other hardware, such as external drives.

etc contains a mish-mash of administrative files.

tmp as its name implies, contains files created by programs that are only needed temporarily. Unfortunately, some programs may forget to delete these tmp files, so you may find some files here "permanently."

usr is another place where critical Unix OS commands are found, especially in /usr/bin. For example, the ditto and open commands are stored here.

mach is Unix's kernel, or core code, of the operating system. This is a file, not a directory. It is the software equivalent of the Mac's CPU, the central processing location for all Unix commands. Without the mach, nothing else would work.

Figure 4.5Figure 4.5 Unix directories and files (for example, usr and bin) in the root directory, as viewed from (top) Terminal and (bottom) the Finder. The Unix items are normally invisible in the Finder; non-Unix visible items are also intermixed.


gdb: The Mac OS X Debugger

In Mac OS 9, developers and some end users employed a program called MacsBug, mainly used by developers to debug software. In the event of a system crash, it could occasionally be used to recover from the crash without restarting. For this reason, and for a few other uses, it was a valuable troubleshooting tool.

MacsBug does not work in Mac OS X. The debugger in Mac OS X is gdb, a Unix tool accessed via Terminal. I will not be discussing its use further in this book.


Folders vs. Directories

In Finder windows, you will see many icons that look like folders. Indeed, that is the Desktop metaphor for what they are: containers that hold other items (documents, applications, or other folders).

Folders vs. directories. In Unix jargon, a folder is referred to as a directory. And as Mac OS X has a Unix basis, I sometimes find it convenient to refer to these folders as directories, especially so when I am in a Unix environment, such as the Terminal application. Even in the Finder, I occasionally refer to folders as directories. I typically refer to the user's Home directory rather than Home folder, for example, because of the special significance that the Home directory has in Unix. (The directory is a default location where you log in via Terminal, for example.)

Thus, an Aqua folder is best viewed as being a graphical representation of a Unix directory. Moving an item in to or out of a folder in the Finder changes the underlying directory in Unix.The terms folder and directory are sometimes used interchangeably when the distinction is not relevant.

Note that not all Unix directories are displayed in the Finder. Most of them remain invisible to the Finder, because a typical Mac OS X end user will rarely, if ever, need to manipulate these files—and modifying them accidentally could lead to serious problems, including taking down the whole system. Still, as I said in the main text, I will cover throughout this book the essentials of how to access these files for troubleshooting.

Pathnames . A pathname is what Unix uses to define the location of a file or directory. An absolute pathname starts at the top or root level of the hierarchy and works its way down. /System/Library/Fonts/Geneva.dfont, for example, is an absolute pathname. Slashes separate the directory names. An initial forward slash indicates that you are starting at the root level. This setup is important, for example, in distinguishing otherwise-identical fonts in multiple Fonts folders (such as (/Library/Fonts vs. /System/Library/Fonts).

A relative pathname is the path starting from your current location.Thus, if you were already in the System/Library directory, the relative path to the same font file would simply be Fonts/Geneva.dfont.

The ~ symbol means to start at the top of the current Home directory. Thus, ~/Library/Fonts mean to look in the Fonts folder inside the Library folder inside your Home directory.

Because the forward slash is used in all these designations, you should not use the forward slash in the actual name of a file or folder in Mac OS X (much as the colon was not permitted in file/folder names in Mac OS 9).

  • + Share This
  • 🔖 Save To Your Account