4 ms·
M1 Macs are not like Intel macs, Apple have done a dismal job of documenting them, and their "for users" tooling is still buggy and broken because the launch wa
by marcan_42 6y ago
M1 Macs are not like Intel macs, Apple have done a dismal job of documenting them, and their "for users" tooling is still buggy and broken because the launch was clearly rushed.
Here is what you need to know to actually understand these things:
The SSD has 3 partitions. Each partition is an APFS container. Each container contains multiple APFS volumes.
Your OS, and everything you care about, is on the second partition/container.
The first partition contains boot configurations. The third partition contains the One True Recovery OS (1TR), which includes the Boot Picker menu (that thing you get when you hold down the power button). These partitions form part of system firmware, think of them as part of UEFI/BIOS. Do not touch these. If you mess up those volumes, the only way to recover the machine is via Apple Configurator 2 from another Mac (DFU mode).
Disk Utility, the GUI, is broken sometimes. If something doesn't work properly there, ditch it and use the command line.
Both Disk Utility, the GUI, and diskutil, the CLI, will hide the first and last APFS containers from you to stop you from shooting yourself in the foot. They're still there, just hidden from the main listing. You can get info for them. Be careful with that.
To do OS reinstalls, you want to be in 1TR. This is not the macOS recovery. Hold down the power button and pick Startup Options from there. Then you can use diskutil (preferably the command line version). You should delete the whole APFS container (disk0s2 usually) corresponding to your install, which will contain multiple volumes. Re-create it as APFS. That will create a container with one volume. You can then install to it and the macOS installer will create all the other volumes.
Additionally, the SEP data is stored separately from the OS (in one of the volumes of the first container). To wipe that, after wiping the partition and before reinstalling, run `xartutil --erase-all`. I've never tried that myself, and I suspect it's not really required because a reinstall should start with a fresh store, but it's probably a good idea to try if you have authentication/user-related issues after reinstalling.
There is also OS recovery, which is the recovery instance that comes with an OS install. It looks exactly the same as 1TR, but it's not the same, and this is highly confusing. For any serious digging around, you want to be in 1TR. Booting holding down the power button will get you there, usually; after a failed macOS boot I've seen it go into regular recovery anyway. To be absolutely sure, boot into 1TR (holding down power, then startup options), then do a clean shutdown, and boot again the same way.
More info on what's on the SSD of these things:
https://github.com/AsahiLinux/docs/wiki/SW:Storage https://github.com/AsahiLinux/docs/wiki/SW:Storage
- m1mac 6y ago> Additionally, the SEP data is stored separately from the OS (in one of the volumes of the first container). To wipe that, after wiping the partition and before reinstalling, run `xartutil --erase-all`. I believe the "Erase Mac" function in Recovery Assistant also erases the SEP data, based on the output of `xartutil --list` before and after. If I'm correct about that, going through Recovery Assistant should be the recommended way to fully erase an M1 Mac (short of a DFU restore through Apple Configurator which also restores firmware). On T2 Macs, `xartutil --erase-all` would wipe all SEP data, including the encryption keys used for the drive. In other words, it was the equivalent of a secure erase and was my recommended way to fully erase a Mac before resale. I suspect Recovery Assistant is just doing the equivalent of `xartutil --erase-all`, but I haven't tried `xartutil --erase-all` on an M1 because I'm afraid to brick the machine to the point of needing a DFU restore, and I don't have another Mac at hand to run Apple Configurator with right now.
- m1mac 6y agoBy the way, how do you get into OS recovery (not 1TR)? `man bputil` does allude to a distinction between the two, as you mention: > Boot environment requirements: software-launched macOS Recovery or 1TR. The only way I know of to get to any recovery mode is by holding down the power button, which the man page says is 1TR (though I know you mention seeing that boot into regular recovery anyway).
- m1mac 6y agoApple released a new platform security guide today. [1] According to that, there is a "fallback recovery OS" that can be accessed if you "[f]rom a shutdown state, double-press and hold the power button." I wonder if this one works if you zero the disk. It also answers my question about the distinction between OS recovery and 1TR: > Note: Apple uses the term One True recoveryOS (1TR) to indicate a boot into the primary recoveryOS which is achieved using a physical power button press. This is different from a normal recoveryOS boot, which can be achieved using NVRAM or which may happen when errors occur on startup. The physical button press increases trust that the boot environment isn’t reachable by a software-only attacker who has broken into macOS. [1] https://manuals.info.apple.com/MANUALS/1000/MA1902/en_US/apple-platform-security-guide.pdf https://manuals.info.apple.com/MANUALS/1000/MA1902/en_US/app...