What Happens During Startup?

Summary

With careful observation and a little knowledge of the startup sequence of an Apple silicon Mac, you can learn a lot about what can and can’t happen during that sequence. This article explains how, with examples from the log of a Mac mini M4 Pro. In broad terms, startup of an Apple silicon Mac consists of the following sequence of events: Boot ROM, which ends in DFU mode if there’s a problem, otherwise it hands on to the Low-Level Bootloader (LLB) and iBoot (Stage 2), the firmware, that should end in validating and running the kernel, which initially runs on a single CPU core before starting others up and launching launchd, and later unlocking and accessing the Data volume, and progressing to userspace. The opening entry in the log is the boot announcement of === system boot: followed by the boot UUID. There’s then a gap of 5 seconds or more before the next entry, which marks the start of kernel boot. Those seconds are the silent phase during which the LLB and iBoot are doing their thing. They don’t write to the Unified log, but leave fragments of cryptic information known as breadcrumbs, which you can’t make use of. The kernel then writes its usual welcome of kprintf initialized and the following four seconds or so are filled by log entries from the kernel. Wallclock adjustment During this phase, the system clock is synchronised, and wallclock time adjusted, usually twice in rapid succession. This is obvious by step changes in timestamp, usually putting the clock back by several seconds in the first sync, then putting it forward slightly in the second. These play havoc with the timestamps, as you can have two or even more instances of the same time being recorded in the log. Beware of the entries === system wallclock time adjusted Early during the kernel phase, it starts up all the other CPU cores in the chip, and records that in the log. Entries become progressively more varied after launchd is loaded, and this first userspace boot (without Data volume access). Da...