Understanding Mac boot Process

Just like Windows and Linux, Mac also has its own boot process which goes through certain phases and each phase / sequence has different screen that appears to indicate the startup progress. From pressing the power button to get into the desktop it goes through four major boot phases /sequences which are as follows.

Mac Boot Process

Understanding Mac Boot Process

1). Boot ROM Initialization

• As soon as you press the Power button to turn your Mac on, it sends the electric signals to the Main Logicboard ( also called Motherboard) which initializes the small program code called BootROM and makes the memory(RAM) usable. BootROM controls two other sub programs called POST and EFI.
• BootROM first performs POST( Power On Self Test) which checks and activate all other hardware components essential to boot your Mac. It also verifies if the sufficient memory(RAM) is available and in a good condition and produces the startup sound (with a Single beep, also called chimes sound) signalling all the essential hardware are working otherwise you hear additional beeps indicating possible hardware failure which halts the startup process. As it does the POST, the Display remains black.
• After the POST has been completed, your BootROM sends a video check signal to built-in or connected displays and when it does so the screen turns gray at this point in Mac boot process.
• A subset of BootROM which is called EFI (Extensible Firmware Interface) then selects the preferred operating system partition to use.
• If more than one operating system is found then it loads the last selected operating system under system preferences. At this stage a user can hold down the option key causing the EFI to display the choices of operating systems available.This whole process completes so quickly within few seconds that if a user wants to get the operating system selection screen he/she needs to hold the option key as soon as he presses the Power button.

2). Executing Boot Loader

• Once the macOS partition has been selected, Boot ROM passes the control over to the Boot Loader file called Boot.efi ( earlier known as BootX) which is located in /System/Library/CoreServices folder on the root partition.
• Once the Boot.efi file (Boot Loader) is found, it draws the “Apple logo” on the screen.
• The primary job of this Boot.efi file is to load the essential kernel extensions (hardware drivers also known as kexts) from its cache folder located in /System/Library/Caches/com.apple.kext.caches/Startup/kernelcache directory into main memory(RAM) and then allow the kernel to take over the system.
• This cache is like the last knows good configuration in Windows and holds exactly the same set of kernel extensions which were used during the previous successful boot. If the Boot Loader could not load any of these extensions from kernelcache due to missing, damage, or unusable state it then goes through a list of whole bunch of kexts and drivers stored in /System/Library/Extensions folder and look for and load all those kexts whose attribute is set to a value which is required during boot. The later process is very time consuming as boot loader goes through each kexts and driver to check whether its required during boot or not.
• When the Boot Loader starts loading the kernel extensions, a progress bar or spinning wheel appears underneath the Apple Logo on the screen indicating the progress in boot process.
• However, if the FileVault encryption is turned on, the Boot Loader draws the login window on the screen asking for the FileVault password first before it loads any kernel extensions. The administrator of the computer needs to put in the FileVault password to enable access to the encrypted disk to boot from it. This login windows is shown later otherwise.

3). Kernel Initialization and Rooting

• As we read earlier that Boot.efi (the Boot Loader) finds the System Folder on your startup disk and loads the kernel extensions into main memory(RAM). Once it has loaded all the essential kernel extensions, it passes the control over to recently loaded kernel extensions and the user still sees the screen with grey Apple logo with a loading bar.
• This phase is known as kernel initialization as the previously downloaded kexts starts loading additional drivers and the core BSD Unix system necessary to boot your Mac and then later it initializes the I/O Kit which links the loaded drivers into the kernel. At this stage the screen changes to a dark gray spinning gear right below the Apple logo.
• At this stage, enough drivers are loaded for the kernel to find the root device. Once the root device is found, the kernel roots itself off of BSD and mounts the system partition as the root, or top-level, file system which is also known as rooting.
• After the root partition is mounted, the kernel passes the control over to the root system processes which show the login screen and create user interface and environment.This process is known as System Initialization.

4). System Initialization

• This is the stage where the dark gray Apple logo is replaced by the login window or the user’s desktop background if the auto login is enabled.
• Root system processes take over the control from kernel and start the first non-kernel process called Launchd, located at /sbin/launchd, which has the process identification number (PID) as 1 and runs as root. It runs as a parent process and brings forth several other child processes.
• So the prime job of the Launchd process is to complete the system initialization and start all other processes responsible to create user interface and environment. Three major processes for creating user environment are “loginwindow”, “SystemStarter” and “user launchd” which then handle various other tasks including display of the login window, and execution of system script and startup items.

Comparison of Boot Process in Mac, Windows and Linux