KyberOS powered by Mach X

Under active development

KyberOS powered by Mach X

Mach, as an
alternative to Linux.

One kernel, kept pure: tasks, threads, ports, messages. Above it, a UNIX/POSIX personality. Beside it, a Linux personality speaking the Linux syscall ABI, so unmodified Linux software runs on Mach.

Why KyberOS The history of Mach

Native binaries are Mach-O; ELF belongs to the compatibility personality. Think WSL1 + Mach, except the host kernel is Mach and the host ABI is Mach-O.

qemu-system-x86_64 · kyberos.elf 
Hello, Mach!
KyberOS powered by Mach X

Vision

A microkernel that stays a microkernel.

Take the Mach microkernel and keep it pure: microkernel, IPC, user-space servers. Pair it with a UNIX/POSIX personality and provide Linux binary compatibility, so unmodified Linux software runs.

Linux grew monolithic: drivers, filesystems, and syscall policy share one address space and one bug surface, tens of millions of lines deep. Mach carved the opposite shape. Tasks, threads, ports, messages, and VM are the only kernel primitives; drivers, filesystems, and POSIX itself live in user-space servers, connected by IPC.

“Mach + POSIX” alone is not new. GNU/Hurd has chased it since 1990, and XNU shipped it by surrendering purity, bolting BSD inside the kernel. What is new is the combination nobody shipped: a pure Mach kernel built with clang/LLVM on x86_64, and a Linux syscall ABI personality that runs unmodified Linux software while the native ABI stays Mach-O.

Why

Why build another kernel?

Linux won by being good enough, everywhere, all at once. Mach lost by being early, slow, and unfinished. Neither result is a law of physics. KyberOS exists to find out what the microkernel looks like when someone finally finishes it.

Pure Mach, no hybrid

Unlike XNU, there is no in-kernel BSD layer. Performance comes from L4-class IPC, vDSO-style helpers, and page cache, not from moving policy into the kernel.

Multiple personalities

Mach was designed to host several OS personalities at once. KyberOS ships UNIX (primary) and Linux (compat) as thin shims over a shared POSIX core.

Capability-first

Ports are capabilities: no ambient authority, no global names. The personality boundary doubles as a capability-isolation boundary.

Mach-O native

clang + ld64.lld produce the native Mach-O ABI and a custom dyld handles dynamic linking. ELF exists only inside the Linux personality.

L4-class IPC

Null-RPC round-trips already measure in the low hundreds of cycles, with a direct-handoff fast path in progress. Speed is a design constraint, not an afterthought.

Apple’s finesse, done right

Version tracking, a polished boot experience, professional tooling: “KyberOS powered by Mach X” with the purity XNU gave up.

The field

How it compares.

An honest table, including the rows we lose. KyberOS is young; the point of the comparison is the shape of the design, not the scoreboard.

KyberOS Linux XNU GNU/Hurd seL4
Kernel modelpure Mach microkernelmonolithichybrid: Mach + in-kernel BSDMach microkernel + server suiteverified microkernel
Native binariesMach-OELFMach-OELFnone; it is a component
Linux binariesunmodified, via Linux personality (planned)nativenoPOSIX sources, not ELF ABIno
OS personalitiesmultiple, simultaneousoneone (BSD)one (the Hurd)whatever you build
Drivers & filesystemsuser-space serversin-kernelin-kernel (IOKit)user-space translatorsuser-space components
Security modelport-right capabilities; personality boundary is the isolation boundaryambient authority + LSMBSD + Mach ports + MACFports and translatorsformal capabilities, with proofs
Where policy livesuser-space serversthe kernelthe kernelserversyou decide
Maturityin development, boots in QEMUruns the worldevery Apple deviceresearch + Debian portdefense, aerospace, embedded

Rows we lose on purpose: seL4 is formally verified and field-proven, we are neither yet; Linux compatibility is a roadmap milestone, not a shipping claim. What no other row combines: a pure Mach kernel, a Mach-O native ABI, and Linux binaries running as a guest personality.

Architecture

Personalities on top, pure Mach underneath.

The kernel trap is a thin router: it reads the task’s personality field and hands the trap to that personality’s emulation entry point. The kernel never interprets a syscall number.

Thin shims, shared core

The POSIX core is a library linked into each personality server, not a shared server process, so the personality boundary stays a real isolation boundary. Shims handle only what diverges: kqueue vs epoll, clone vs rfork, sysctl vs procfs, ptrace dialects.

Single fat server, measured splits

Mach’s multi-server idea “hardly ever happened”; IPC overhead punished decomposition. KyberOS starts with one server per personality and decomposes only where measurement justifies it.

Toolchain

clang + LLVM is the native toolchain: ld64.lld for Mach-O, ld.lld/GNU ld for the kernel. LTO, PGO, and CFI are first-class. CMake + Ninja builds; no autotools in our tree.

Roadmap

From bare metal to /bin/sh and beyond.

The kernel boots in QEMU today with working memory management, tasks, and Mach IPC. Development is private for now; the milestones below are directional, not promises.

  1. M0–M2g done

    Foundations: multiboot2 + PVH boot, PMM, higher-half VM, kernel heap, Mach vm_fault with COW on both sides, ring 3, syscall/sysret.

  2. M3 current

    Mach-native IPC: spaces, ports, typed messages, blocking mach_msg_trap, LAPIC timer, and the direct-handoff fast path. The gate for dyld work.

  3. M4

    Console server over IPC + the first Linux syscall translation: write(1) → Mach IPC → console → serial.

  4. M5–M6

    UNIX personality shakedown on the frozen 4.3BSD interface, then the POSIX shell milestone: /bin/sh with pipes, fork/exec, job control.

  5. M7–M8

    The Linux personality over the same scaffolding, then libc: musl (static Mach-O) first, glibc (dynamic) after.

  6. M9+

    Capability sandboxing and MAC, secure/measured boot, SMP, rump-kernel hardware drivers, namespaces and containers.

Kernel charter

The Mach-shaped test.

Every kernel feature must pass all five rules, or earn a numbered, dated exception in the decision log with a measurement that justifies it.

  1. 1

    Same vocabulary

    Built from tasks, threads, ports, messages, vm_map, vm_object, memory objects, and the scheduler. No new kind of kernel object.

  2. 2

    Mechanism in the kernel, policy in servers

    The kernel offers the capability; a user-space server decides how to use it.

  3. 3

    Reached through ports

    User-visible features are MIG-style interfaces on kernel-served ports. The trap set stays small and stable.

  4. 4

    Capability-first

    Access goes through port rights. Nothing depends on ambient authority, user IDs, or global names.

  5. 5

    Internals are free, with limits

    Epochs, per-CPU zones, lock-free lookups, turnstile-style priority donation: any modern technique is allowed behind an unchanged interface with unchanged observable semantics.

Mach, reborn

The idea was interrupted, not defeated.

Mach did not lose on merit. It lost on timing: too early, too ambitious, too unfinished for an industry that needed software shipped yesterday. So the industry shipped its ideas anyway, inside kernels that traded purity for speed. Every Apple device is Mach that compromised. KyberOS is Mach that didn't.

None of this would exist if its authors had not written it all down. Papers, manuals, interface definitions: a design documented carefully enough to outlive its own lab. Rochester planted it, Pittsburgh built it, Utah carried it, GNU kept it warm, and Apple proved its ideas could run a billion devices. We are simply the next hands on the wheel.

KyberOS is not a clone and it is not nostalgia. It is the same project, resumed: the microkernel they sketched, finished with four decades of hindsight. Mach, reborn.

A promise, continued

To the people of Rochester, Pittsburgh, Utah, Grenoble, and Cupertino, and to everyone who ever compiled Mach, wrote for it, or believed the kernel could be small:

Thank you. We will take it from here.