When does software take over firmware during boot in Macs?

Question

This is for me the $1 million question I’ve never had a certain answer about.

I learnt long ago that in newer 32bit-64bit PCs the initial phase of the startup process is controlled by firmware and is later taken over by software (loaded from the Hard Drive or SSD into memory during boot) which controls the system from them on. The reason being that the software drivers will usually be more up-to-date and will run the system better than the initial firmware drivers necessary to boot the computer.

According to this, the POST and initial image on the screen is controlled by firmware (software in a motherboard chip rather than loaded into Memory from the hard drive).

My doubt is whether this is also the case in Macs.

This is important in troubleshooting because it helps to narrow down whether software or firmware may be causing an issue (such as the display glitching at the beginning of the startup but not at the end of the boot or afterwards, after the software has taken over, which would hint the firmware is at fault rather than the software) or "the screen glitching after boot can't be attributed to firmware as firmware is not running after boot".

My doubt is if something different may be happening: such as “the initial image on the screen is controlled by software, because the software has already taken over”, which I think is probably not the case.

I’d very much appreciate some wisdom on this.

Answer 1

The answer to this depends on what exactly you mean by "controlled by".

In particular it doesn't make sense to say that it is either controlled by "firmware" or "software" - as firmware is also software.

You can define "controlled by" in two interesting ways in this context: Either (a) when is the first software to be run loaded in from disk (i.e. non-firmware), or (b) when does control of the computer (i.e. primarily interrupts) transfer from the firmware to the operating system.

In either case it works the same way on a Mac as it does on a EFI PC (all modern PCs).

If you take definition (a) the change of control happens when the boot.efi file is loaded in from disk. That file is stored on disk in various places depending on your configuration:

• HFS+ disk: /System/Library/CoreServices/boot.efi

• HFS+ and FileVault 2: On a seperate non-encrypted partition

• APFS (encrypted or not): //System/Library/CoreServices/boot.efi or /usr/standalone/i386/boot.efi. on a seperate preboot volume

If you have a Mac with a T2-chip, additional validation can take place of the boot.efi before it is run, but essentially it is the same process.

In terms of what you see on the monitor during the boot process, the change of control has taken place (a) shortly before you see the FileVault login screen for encrypted HFS+ disks or (b) slightly after you see the white Apple logo on a black background on other systems.

If you instead take definition (b) the change of control happens when the operating system kernel is loaded in and executed. The operating system kernel is located in /System/Library/Kernels/kernel on the actual root volume. At this point the kernel installs a new interrupt table, and control of the CPUs and peripherals is now in the hands of the kernel.

This is in contrast to how it worked on older PCs (i.e. not Macs) with BIOS. In that case the BIOS was kept in place after the operating system was booted, and systems such as DOS used the BIOS to interface with the hardware.

In terms of what you see on the monitor during the boot process, the change of control has taken place shortly before you see the white progress bar or spinner indicating that the system is loading up.