You can learn a great deal from the unified log entries of a system startup, and that for an M1 Mac is even more fascinating for the insights it gives into the hardware in the M1 system-on-a-chip (SoC). These were obtained from an M1 MacBook Pro with 8 CPU cores and 8 GPU cores running macOS 11.0.1 fairly clean, and in full Secure Boot.

The iBoot firmware phase occurs before the start of logging, so the first entries are those from the kernel. For each log entry, the initial field is the system clock time in seconds.

Kernel phase

The first part of the boot sequence takes around 7 seconds, most of which is loading and initialisation of the kernel. This takes place on one of the CPU cores, here number 7, which is a ‘type 2’ core, presumably one of the four high-performance or Firestorm cores. As with Intel Macs, the first entry in the log is the standard announcement of the start of system boot. This is given with a UUID which uniquely records that event, is provided in System Information, and written into every log entry.
03.392395 === system boot: AE70F6FC-3AC5-4A05-81AA-D680203A1AF9

Following that, interrupt controllers are set up, and the kernel version declared.
09.939481 kernel Darwin Kernel Version 20.1.0: Sat Oct 31 00:07:10 PDT 2020; root:xnu-7195.50.7~2/RELEASE_ARM64_T8101

The next entries detail starting up of virtual memory, and the most basic services including IOKit, the unified log, scheduling, and three subsystems designated as ATM, BANK and IPC_PTHREAD_PRIORITY. These are followed by a declaration of the iBoot version, and the start of initialisation for corecrypto.
09.958814 kernel iBoot version: iBoot-6723.50.2
10.006368 corecrypto corecrypto_kext_start called
following which are more entries from corecrypto.

Those are a necessary preparation for validation of the seal on the Sealed System Volume (SSV), which is reported next.
10.085825 Darwin Image4 Validator Version 3.1.0: Sat Oct 31 00:10:29 PDT 2020; root:AppleImage4-106.40.12~2159/AppleImage4/RELEASE_ARM64E
If that fails, the Mac should proceed no further with a normal boot, but offer the user the facility to reinstall macOS.

The three major security systems Apple Mobile File Integrity (AMFI), the Sandbox, and Quarantine are then initialised. AMFI’s main concern is the checking of code signatures.
10.086158 kernel calling mpo_policy_init for AMFI
10.086162 kernel Security policy loaded: Apple Mobile File Integrity (AMFI)
10.086170 kernel calling mpo_policy_init for Sandbox
10.086240 kernel Security policy loaded: Seatbelt sandbox policy (Sandbox)
10.086293 kernel calling mpo_policy_init for Quarantine
10.086297 kernel Security policy loaded: Quarantine policy (Quarantine)
Following those any external trust cache modules are identified and loaded.

The next 0.2 second is largely devoted to the initialisation of hardware systems and the software which works with them. These start with power management
10.100886 PMRD: PMTraceWorker 0x6a92c9c5900a6f55
10.100953 PMRD: changePowerStateWithTagToPriv(ON_STATE, 10001)

The standard copyright notice appears, followed by initialisation of the MAC framework.
10.111907 Copyright (c) 1982, 1986, 1989, 1991, 1993
The Regents of the University of California. All rights reserved.
10.111927 kernel MAC Framework successfully initialized

A long list of hardware devices is then initialised, including:
T8101 (Apple A14 Bionic SoC), the ARMBacklight display, PMRD (power management), SPIMC Controller, S5L8940XI2C Controller, Synopsys MIPI DSI Controller (the display controller interface), BCM WLAN Core (Wi-Fi networking), Embedded PCIE (PCIe interface), T8103 PCIe C (Apple A14X PCIe controller), Thunderbolt, and the T8103 MemCache Controller (Apple A14X memory cache controller).

Further initialisations follow, including:
Apple Credential Manager, IOTimeSyncClockManager, AppleDiskImagesController, AppleSEPKeyStore (Secure Enclave Processor Key Store), Apple SSE, CoreAnalyticsHub, FairPlayIOKit (Apple DRM system), IOBluetoothFamily (Bluetooth), AppleInterruptController, S5L8920XPWM, Apple S8000 AES, Apple GPIO ICController, Audio DMA Controller T8103 (audio), Apple M2 Scaler CSC (scaler and colourspace converter for the display), Apple H13 Camera Interface, Apple H11 ANE Interface (Apple Neural Engine), Apple Embedded Temperature Sensors in T8015 and T8020 MTR, Apple T8103 CLPCv3 Closed Loop Performance Controller (patented by Apple, for scheduling threads on asymmetric multiprocessing systems), Apple Passthrough PPM, Apple Summit LCD (the 13-inch display in the M1 MacBook Pro), and Apple S8000 DWI.

Several of these hardware subsystems are MIPI, ‘Mobile Industry Processor Interface’, a trade alliance originally formed in 2003 by ARM, Intel, and others to develop standards for interfaces used in mobile devices. The M1 display interface has been designed by Synopsys, a MIPI specialist.

Now, almost 7 seconds after the kernel started to boot, the remaining 7 cores are started up.
10.281418 AppleFireStormErrorHandler AppleARM64ErrorHandler: will not panic on correctible ECC errors
Firestorm are the four high-performance CPU cores in the M1.

The CPUs are then started one after the other.
10.281434 cpu_start() cpu: 0
working successively through cpus numbered 0 to 6; 0-3 are ‘type 1’, and 4-7 are ‘type 2’.

This phase concludes with the last hardware initialisations, for:
Apple A7 IOP, Apple SPMI PMU (system power management interface), RT Buddy (SMC), and Apple S8000 AES.
The kernel then takes a back seat, allowing other processes to get on with their initialisation, which is mainly for security systems.

Security phase

Soon after the kernel ceases making its long sequence of log entries, the system clock time is corrected.
08.485687+0000 0 0 === system wallclock time adjusted
08.514649+0000 0 0 === system wallclock time adjusted
On this occasion, this resulted in log times being backdated by approximately 2 seconds, so all subsequent entries are timed according to this corrected clock.

The Wi-Fi hardware has completed its initialisation, and now proceeds to discover available services.
08.523417 wifiFirmwareLoader Going to discover services

The user kernel management subsystem starts.
08.525791 kernelmanagerd Starting userland kernel management subsystem (KernelManagement_executables-102.50.2)

Open Directory is launched.
08.541105 opendirectoryd (build 796.400) launched...

Security systems are now readying for the user to enter the scene.
08.548026 UserEventAgent All system critical plugins finished initializing from path:
08.548132 securityd entered sandbox
08.548156 securityd starting in installmode
08.548811 securityd 0x16fdb74e0 Session 100000 created, uid:-1 sessionId:100000

Now the privacy system service, tccd, starts up, with a report that it can’t find a whitelist.
08.556289 tccd Override: watchPlistChanges: failed to open(/System/Library/Sandbox/TCC_Compatibility.bundle/Contents/Resources/AllowApplicationsList.plist, O_EVTONLY): [2: No such file or directory]

Open Directory is now open for business too.
08.560334 opendirectoryd Startup - created trigger for /Search & /Local node registration

tccd is successful in locating and opening its database.
08.568945 tccd using database: /Library/Application Support/com.apple.TCC/TCC.db
08.569028 tccd using database version: 19

WindowServer is now running too.
08.626759 WindowServer SkyLight Server is starting up
Following that are many entries as authd imports rules

The Find My Mac service then starts up.
08.759966 findmydeviced has been launched
08.763183 findmydeviced FMCore FMStateCapture: Removing State Capture Handler 0.
08.763243 findmydeviced ************ FindMyDevice Daemon Starting... ************

The next major step in preparing to run user software is getting RunningBoard ready to manage resources for apps.
08.826077 runningboardd RunningBoard Battlecruiser operational.

At this stage, some 7.5 seconds after the start of the kernel boot phase, the log fills much more quickly with a torrent of messages as startup proceeds to user login.

I hope this quick tour through the early stages of startup has provided better insight into some of the hardware in the M1, and its much cleaner startup compared to that of an Intel Mac. If you’re not familiar with the main landmarks found when starting up in Catalina, this article provides a summary.

One notable absence in the M1’s log is that no ‘shutdown cause’ is given; early during startup, Intel Macs have traditionally reported
Previous shutdown cause: 5
or similar, the code explaining why that Mac was last shut down. There doesn’t appear to be any equivalent entry in the log from an M1.

Another surprising omission is of the kernel BSD root disk, which has been present since the first version of Mac OS X. This is also the first startup log since the introduction of APFS with High Sierra in which there’s no mention of the version of APFS which is running, nor of any of the volumes which are available. Indeed, APFS has fallen silent, at least during this early part of startup.