This is for me the $1 million question I’ve never had a certain answer about.

I learnt long ago that in newer 32bit-64bit PCs the initial phase of the startup process is controlled by firmware and is later taken over by software (loaded from the Hard Drive or SSD into memory during boot) which controls the system from them on. The reason being that the software drivers will usually be more up-to-date and will run the system better than the initial firmware drivers necessary to boot the computer.

According to this, the POST and initial image on the screen is controlled by firmware (software in a motherboard chip rather than loaded into Memory from the hard drive).

My doubt is whether this is also the case in Macs.

This is important in troubleshooting because it helps to narrow down whether software or firmware may be causing an issue (such as the display glitching at the beginning of the startup but not at the end of the boot or afterwards, after the software has taken over, which would hint the firmware is at fault rather than the software) or "the screen glitching after boot can't be attributed to firmware as firmware is not running after boot".

My doubt is if something different may be happening: such as “the initial image on the screen is controlled by software, because the software has already taken over”, which I think is probably not the case.

I’d very much appreciate some wisdom on this.

  • 2
    I remember reading this a while ago.
    – Nimesh Neema
    Commented Jun 8, 2019 at 20:39
  • Pretty much ALL computers start with firmware, which then hands it over to disk-based software. Boot" is an old term for "Pulling yourself up by your bootstraps." which computers essentially do. Look up the procedures for the earliest personal computers, where you had to write the code, that would tell the computer to understand the next bit of code you would enter, and so on. Therefore pulling itself up by its bootstraps. Nimesh's link is a more practical view of the process. Commented Jun 8, 2019 at 20:46
  • I seem to remember typing “GF” at the firmware prompt - gf means “go finder” but that was a long time ago on my pismo...
    – Solar Mike
    Commented Jun 8, 2019 at 21:33
  • What is your definition of firmware? Showing your research (links to documentation) or making this a practical question by explaining what you’re trying to do might help us help you.
    – bmike
    Commented Jun 8, 2019 at 21:56
  • @Nimesh Neema, The link in your comment is an excellent resource, thanks! Commented Jun 8, 2019 at 22:42

1 Answer 1


The answer to this depends on what exactly you mean by "controlled by".

In particular it doesn't make sense to say that it is either controlled by "firmware" or "software" - as firmware is also software.

You can define "controlled by" in two interesting ways in this context: Either (a) when is the first software to be run loaded in from disk (i.e. non-firmware), or (b) when does control of the computer (i.e. primarily interrupts) transfer from the firmware to the operating system.

In either case it works the same way on a Mac as it does on a EFI PC (all modern PCs).

If you take definition (a) the change of control happens when the boot.efi file is loaded in from disk. That file is stored on disk in various places depending on your configuration:

  • HFS+ disk: /System/Library/CoreServices/boot.efi

  • HFS+ and FileVault 2: On a seperate non-encrypted partition

  • APFS (encrypted or not): //System/Library/CoreServices/boot.efi or /usr/standalone/i386/boot.efi. on a seperate preboot volume

If you have a Mac with a T2-chip, additional validation can take place of the boot.efi before it is run, but essentially it is the same process.

In terms of what you see on the monitor during the boot process, the change of control has taken place (a) shortly before you see the FileVault login screen for encrypted HFS+ disks or (b) slightly after you see the white Apple logo on a black background on other systems.

If you instead take definition (b) the change of control happens when the operating system kernel is loaded in and executed. The operating system kernel is located in /System/Library/Kernels/kernel on the actual root volume. At this point the kernel installs a new interrupt table, and control of the CPUs and peripherals is now in the hands of the kernel.

This is in contrast to how it worked on older PCs (i.e. not Macs) with BIOS. In that case the BIOS was kept in place after the operating system was booted, and systems such as DOS used the BIOS to interface with the hardware.

In terms of what you see on the monitor during the boot process, the change of control has taken place shortly before you see the white progress bar or spinner indicating that the system is loading up.

  • jksoegaard: You're great!. Please help me make sure I understood you correctly: I’ve just booted my Mini 2014 (which uses a Flash Storage SSD and is not encrypted) and this is what I saw: - I heard the startup chime - I see the Apple logo for 1 second or so (no progress bar yet) - I see the Apple logo and progress bar for a few seconds till I see the log-in screen. If I understood you correctly: any issues (such as display glitches) happening before and during the 1st and 2nd stages: are not attributable to software, but to firmware, as the firmware is still controlling the Mac and displaying Commented Jun 9, 2019 at 0:05
  • Since the T2 chip is always running before and after the OS, I’d say there’s never a handoff but that there is a point where the OS starts if that’s what “firmware to software” is being defined here.
    – bmike
    Commented Jun 9, 2019 at 0:39
  • @Antonio23249 maybe Ask Different Chat is better for conversations relating to answers if they’re long.
    – bmike
    Commented Jun 9, 2019 at 2:11
  • @Antonio23249 yes, the chime and the first display of the logo is done by the firmware.
    – jksoegaard
    Commented Jun 9, 2019 at 7:28
  • 1
    @lx07 Yes, exactly the runtime service are there at all time - but the OS does not necessarily have to use it. It's kind of the same as the BIOS model for DOS and similar. Please note that when we say that it is "there" - it simply means that the code is available in memory. It is NOT running as such. It is fully up to the OS whether or not it wants to run EFI Runtime Services code. Regarding the handover - it is actually later. It is after the kernel is run - very shortly afterwards the kernel replaces the interrupt table, and that's where the real handover has happened.
    – jksoegaard
    Commented Jun 9, 2019 at 12:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .