With careful observation and a little knowledge of the startup sequence of an Apple silicon Mac, you can learn a lot about what can and can’t happen during that sequence. This article explains how, with examples from the log of a Mac mini M4 Pro.
In broad terms, startup of an Apple silicon Mac consists of the following sequence of events:
Boot ROM, which ends in DFU mode if there’s a problem, otherwise it hands on to
the Low-Level Bootloader (LLB) and iBoot (Stage 2), the firmware, that should end in validating and running
the kernel, which initially runs on a single CPU core before starting others up and launching launchd , and later
, and later unlocking and accessing the Data volume, and progressing to
userspace.
The opening entry in the log is the boot announcement of
=== system boot:
followed by the boot UUID. There’s then a gap of 5 seconds or more before the next entry, which marks the start of kernel boot. Those seconds are the silent phase during which the LLB and iBoot are doing their thing. They don’t write to the Unified log, but leave fragments of cryptic information known as breadcrumbs, which you can’t make use of. The kernel then writes its usual welcome of
... continue reading