Troubleshooting the boot process for Intel Macs

A number of events happen when you boot your Mac that activate the hardware and load the system software. Understanding these and some of the behaviors that the system might show when problems occur during these steps can help determine what you should do if your system will not boot properly.

Powering up
Upon pressing the power button on your system, computer components such as hard drives, add-in cards, and other controllers receive power and start initialization routines to ensure that their hardware is working OK. If these components are all in working order, then they will assume a "ready" state to send and receive instructions and data from other controllers in the system.

The main firmware on the motherboard then gets executed and interacts with the various system components in their "ready" states to ensure everything is running properly. If a vital component is not working properly, then the firmware will detect this and provide an alert or otherwise handle the situation such as by disabling access to the device.

The firmware's first routine is to perform a Power-On Self Test (POST) to check for the presence and fidelity of the resources required to properly boot (i.e., RAM presence and abundance, or corruption in the system ROM files). At this point you may see or hear the following conditions if a problem arises:

• Black screen with the power light on --> POST or boot ROM failure
• Slow pulsing power LED --> bad RAM or no RAM
• Groups of three pulsing power LED flashes --> not enough RAM

In some systems you may hear sounds if there is a problem:

• A single tone sound every 5 seconds --> No RAM
• Three tones every 5 seconds --> Bad RAM

Many times people may think problems such as battery malfunction or hard-drive failure may be the cause for these tones and flashing lights, but at this point the system is just interested in motherboard-based hardware components.

After the RAM is checked and the Boot ROM's POST procedure completes with no errors, the system continues to load the EFI firmware that controls the motherboard's hardware components, and when it does this it plays the boot chimes and activates the display. At this point you know the system hardware has checked out, and the system is ready to boot.

The firmware's next step is to load variables that are stored in the system's PRAM in addition to any you manually send it from keyboard hotkeys, some of which are the following:

• Shift -- Boot to Safe Mode
• Command-V -- boot to Verbose mode
• Option -- Load the boot menu
• Option-Command-P-R -- Reset PRAM settings

If the system is told to reset the PRAM, then the firmware clears all the PRAM values and restarts the system. If you hold the Option key, then the system will scan any initialized boot devices for the presence of a valid operating system and present them on screen in a boot menu. Other options like Shift or Command-V are stored for use later in the boot process.

Finding a boot device
If neither the boot menu nor PRAM reset commands are initiated, then the system scans initialized boot devices (hard drives in their "ready" state) for availability and searches them for a valid boot loader. Most computers will have a specific hard drive designated as the boot device in the computer's firmware settings (PRAM) which will allow for quick booting from that device. If the device is neither present nor designated in the system's PRAM, then the computer will search for a boot loader on each initialized hard drive in sequence and will boot to the first one that is found.

The boot loader for Macs using EFI firmware is called "Boot.efi" and is located on a small 200MB hidden partition that is set up by the GUID partition scheme, which is the default on Mac systems (on some systems this partition is called "Boot OSX"). When this file is read it directs the system to loads the OS X kernel and hardware required for booting, and accepts various boot commands from the firmware. These commands are passed to the system kernel, which then boots the system in different ways based on the command being given (such as Safe Mode and Verbose Mode mentioned earlier).

At this point, the computer still displays a gray screen, and if a problem occurs then the system may sit on the gray screen and not proceed any further. Some possible reasons for this would be that filesystem errors might prevent reading from the hard drive, a hardware conflict might be causing a hang, or a power management error might be preventing access to required system components. In these cases you can try booting from an alternative boot device such as an OS X installation DVD or recovery volume and then run Disk Utility to check and repair the hard drive, reset the PRAM and SMC on your system, or remove all peripheral devices and add-in cards. Apple has a knowledge base article that covers some troubleshooting routes for a system that is stuck on the grey startup screen.

If everything checks out with the boot.efi file and the system is bootable, then a gray Apple will appear; however, if not, then you may see the following alternative symbols displayed:

• Folder with a question mark --> No bootable device found
• Circle with a slash through it --> Cannot load the boot.efi boot loader

In these cases, the system will likely require a reinstallation of the operating system, especially if you already have tried checking for and repairing errors on the hard drive with Disk Utility. Another possible alternative symbol you may see is a globe, which means the system is looking for a net boot server. To prevent the system from doing this, try resetting the PRAM.

Loading the kernel
If none of these errors occur, you will then see a spinning wheel appear below the gray Apple symbol as the kernel is loaded and activated from the boot volume. At this point the system creates a sequestered virtual memory space called "kernel space" where it loads all the core system features and kernel extensions for managing low-level components like hardware and network access.

To aid in a quick launch of the system, the kernel reads the necessary kernel extensions from the boot caches, which may be located in the same EFI boot partition as the boot loader and kernel, and which reference the extensions that were used in the last active hardware configuration.

If new hardware is found or the caches are missing (as is the case when you clear system caches with third-party utilities), then the system will scan the various Extensions folders on the system for proper extensions, load them, and then update the caches accordingly. This process of rebuilding the caches may take a while, so you may see the gray wheel spin a little longer than usual during this time. If your system is always showing the spinning wheel for a long time, try booting into Safe Mode (hold Shift at startup), and also disconnect any add-on devices, especially those that require a device driver to run. Doing this will boot a minimal OS, leaving out unnecessary and third-party extensions. You can also try using a third-party utility in a general maintenance routine to clear the system and boot caches, to force the OS to rebuild them.

Up until this point the system has been loading in "kernel space," but once the kernel has loaded all the drivers it needs, then the system needs to be able to run processes under different user accounts and manage access permissions, so it now creates a second virtual memory segment called "user space," where it loads processes that are governed by user accounts and permissions.

Loading the system software
The first software process loaded in "user space" is called "launchd" (the system loader) and is run under the main system user account called "root." The launchd process accepts some of the various boot commands passed to it from the EFI firmware (single-user mode, verbose mode, safe mode, etc.) from the firmware and proceeds to run the boot scripts which launch programs and services in the required sequence for booting.

When launchd is activated you will see a blue screen displayed on the system. Sometimes this blue screen will stay for a while as various low-level processes including the "Core" components (core audio, core image, core graphics, etc.), SystemStarter, WindowServer, and loginwindow are all started up. These processes allow for things like startup items to run, windows to be drawn and displayed on the screen, and finally the log-in window to be presented. At this point conflicts with the loading of launchd or any of these low-level processes may cause launchd to hang and show a long blue screen session.

If you experience a long blue-screen session, then try booting to Safe Mode and running a permissions fix on the boot drive using Disk Utility. If you cannot boot even in Safe Mode, then try doing the same in Single User mode by restarting with the Command-S keys held down. Then at the command prompt run the following two commands:

/sbin/mount -uw /

diskutil repairPermissions /

The first command will set the hard drive to be writable, and the second command will run the permissions fix routine. After the permissions repair routine is complete, then type "reboot" to restart the system normally.

Logging in
If the main launchd process loads properly, then the log-in window and its background will appear on the screen. The system directory that contains user account information is referenced and accounts details such as usernames and icons are loaded into the log-in window. The system then waits for valid log-in credentials, and then loads another "launchd" process under the supplied username (if you have your system set to automatically log on, then you will not see the log-in window). This second launchd process is similar to the main one, except that it loads under the restrictions of a specific user account instead of under the main "root" account. This ensures that it and all processes launched under it are restricted from accessing critical system files or those in other user accounts.

When the second launchd process initializes, the system will again display a blue screen before the system shows a log-in progress bar. The blue screen may be very brief if shown at all, though it also may be long if a conflict occurs. To address blue screen issues upon log-in, you can try running a permissions fix on the boot drive with Disk Utility as mentioned above, but also try resetting home folder permissions for your user accounts.

NOTE: If you are not sure whether your system is showing a blue screen at log-in or before, try turning off automatic log-in in the Security system preferences to see if the blue screen hangs happen before or after you see the log-in window.

Upon successful log-in, the new launchd process loads some background account services like the system interface server for managing the menu bar, font and text management routines and mdworker for indexing files for Spotlight. Finally it loads the Finder and Dock, which give you the environment needed for managing applications and the filesystem. At this point the system also runs any log-in items you have set in your account's system preferences, and when these are complete, your system is ready to use.

Sometimes log-in items can result in problems such as system crashes or hangs if they are not configured correctly. In these cases, logging into the system may be a frustrating experience that always ends in a problem or two. To get around this, you try using the OS X Safe Login mode, which will prevent log-in items from automatically starting. To do this, immediately press and hold the Shift key after clicking the log-in button at the log-in window. If you have your system set to automatically log in, once you see the spinning gear under the Apple menu, then press and hold the Shift key. Do not do this before the spinning gear shows, or you will command the system to boot to Safe Mode instead of Safe Login.

Questions? Comments? Have a fix? Post them below or e-mail us!
Be sure to check us out on Twitter and the CNET Mac forums.