hoakley Macs, Technology

Which EFI firmware should your Mac be using? (version 4)

macOS 10.15 Catalina brings EFI firmware updates for all supported models, and subsequent updates have changed those for most models too. This article lists the firmware versions of Macs which have been successfully updated with Catalina Security Update 2022-005.

For older Macs and earlier versions of macOS, please refer to the previous listing of firmware versions. If your Mac is still running an earlier version of macOS, such as El Capitan, then you should refer to version 2 of this list instead.

Apple doesn’t provide an official list of the current EFI firmware versions which should be installed on each model of Mac.

That displayed in System Information uses five decimal numbers separated by dots, e.g 96.0.0.0.0, and is given below.

One numbering system used by the eficheck tool still uses the older system with two hexadecimal numbers, e.g. F000.B00. However, in Catalina eficheck now also gives version numbers using the new notation.

The full eficheck version number is likely to resemble
IM144.88Z.0190.B00.1809171521
This is made up from the model designator IM144 = iMac14,4, the code 88Z or sometimes AAPLEFI4 or AAPLEFI5, the version number 0190 B00, and the datestamp of that version 1809171521 = [20]18/09/17 15:21. See below for further details of how to obtain this.

iMac:

  • iMac13,1, iMac13,2 429.0.0.0.0
  • iMac14,1, iMac14,2 433.140.2.0.0
  • iMac14,3 433.140.2.0.0
  • iMac14,4 433.140.2.0.0
  • iMac15,1 433.140.2.0.0
  • iMac16,1 430.140.3.0.0
  • iMac16,2 430.140.3.0.0
  • iMac17,1 451.140.1.0.0
  • iMac18,1 451.140.1.0.0
  • iMac18,3 451.140.1.0.0
  • iMac19,1 1731.140.1.0.0

iMac Pro:

  • iMacPro1,1 1731.140.2.0.0 (iBridge: 19.16.16064.0.0,0)

MacBook:

  • MacBook8,1 430.140.3.0.0
  • MacBook9,1 451.140.1.0.0
  • MacBook10,1 451.140.1.0.0

MacBook Air:

  • MacBookAir5,1, MacBookAir5,2 429.0.0.0.0
  • MacBookAir6,1, MacBookAir6,2 433.140.2.0.0
  • MacBookAir7,1, MacBookAir7,2 430.140.3.0.0
  • MacBookAir8,1 1731.140.2.0.0 (iBridge: 19.16.16064.0.0,0)
  • MacBookAir9,1 1731.140.2.0.0 (iBridge: 19.16.16064.0.0,0)

MacBook Pro:

  • MacBookPro9,1, MacBookPro9,2 429.0.0.0.0
  • MacBookPro10,1 429.0.0.0.0
  • MacBookPro10,2 429.0.0.0.0
  • MacBookPro11,1 433.140.2.0.0
  • MacBookPro11,2, MacBookPro11,3 433.140.2.0.0
  • MacBookPro11,4 430.140.3.0.0
  • MacBookPro12,1 430.140.3.0.0
  • MacBookPro13,1 451.140.1.0.0
  • MacBookPro13,2 451.140.1.0.0
  • MacBookPro13,3 451.140.1.0.0
  • MacBookPro14,1 451.140.1.0.0
  • MacBookPro14,2 451.140.1.0.0
  • MacBookPro14,3 451.140.1.0.0
  • MacBookPro15,1, MacBookPro15,2 1731.140.2.0.0 (iBridge: 19.16.16064.0.0,0)
  • MacBookPro16,1, MacBookPro15,2 1731.140.2.0.0 (iBridge: 19.16.16064.0.0,0)

Mac mini:

  • Macmini6,1, Macmini6,2 429.0.0.0.0
  • Macmini7,1 433.140.2.0.0
  • Macmini8,1 1731.140.2.0.0 (iBridge: 19.16.16064.0.0,0)

Mac Pro:

  • MacPro6,1 430.140.2.0.0
  • MacPro7,1 1731.140.2.0.0 (iBridge: 19.16.16064.0.0,0)

T2 chip models:
The iMac Pro, 2019 Mac Pro, iMac 27-inch 2020, 2018 MacBook Pro with Touch Bar (MacBookPro15,1 and 15,2), 2018 Mac mini and 2018 MacBook Air, and their successor models, all use a different mechanism for firmware updates, managed by their T2 chips. They are also unable to run eficheck.

How to check your Mac’s EFI firmware version

The simplest way now is to run either of my free tools SilentKnight or LockRattler, available from their product page. Note that, for the moment, SilentKnight’s reference list of firmware versions remains that for Mojave. I will update it to this new set when they have been distributed in security updates to High Sierra and Mojave.

Alternatively, use the About This Mac command at the top of the Apple menu, and click on the System Report… button. In the Hardware Overview listing, this is given as the Boot ROM Version, and typically now looks like
123.0.0.0.0. In that, 123 is a new model identifier. The firmware version is then given in the following four numbers. For almost all models at present, this appears to be 0.0.0.0, the current iMac being the sole exception.

What to do if your Mac’s EFI firmware is different from that shown

There are two reasons for the major version being higher than that shown:

  • Your Mac has installed an updater which has in turn installed a newer version of the EFI firmware. This may happen if you install a beta release of macOS, or could happen after service to your Mac. It may rarely occur if you download the latest Combo updater for macOS.
  • Your Mac has installed a spurious version of the EFI firmware, such as malware. You should be able to check that in High Sierra and above: see below for instructions.

If the installed version of EFI firmware has a version which is lower than that shown, you can try installing macOS Catalina a second time. Then check the firmware version again.

EFI firmware updaters are now only distributed as part of macOS updates and upgrades: Apple does not provide them separately.

How can you check the integrity of your EFI firmware?

If you are concerned that something bad may have happened to your EFI firmware, and your Mac is running High Sierra or later but doesn’t have a T2 chip, you can run the eficheck tool to test this. Normally, this is run automatically every week, and you should be informed of any issues which it raises. But there’s no harm in running it if that gives you peace of mind.

Open Terminal, and in its command line type
/usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check

Once it completes, you should see a response like
EFI Version: MBP141.88Z.F000.B00.1909131925 (Boot ROM Version: 202.0.0.0.0)
Primary allowlist version match found. No changes detected in primary hashes.
In the first line of the response, this gives the Mac model (MBP141 = MacBook Pro 14,1), the major version (F000), the minor version (B00), and the build datestamp of that version (= [20]19/09/13 19:25). The Boot ROM version given in parentheses should match the version given above.

If it doesn’t, save the result immediately and contact Apple support soonest, ready to quote to them the results of that check.

Fuller details about eficheck are given in this article.

Should you check your EFI firmware against the Allow List?

Although eficheck‘s Allow List is intended to ensure that your Mac’s EFI firmware is recent, it does not require that it is the current version, as listed above – it’s an Allow List. What it is primarily intended to do is check that nothing has tampered with your firmware. So its Allow List is content with older and newer firmware versions – it currently has more than 2,000 entries – but most importantly checks that the version installed is intact, as Apple expects it to be, and hasn’t been corrupted or altered.

Running eficheck as detailed above is the best way to perform that check. Looking through its Allow List won’t normally tell you the current version of the EFI firmware for your particular Mac, and can confuse.

What about SMC versions?

Isn’t EFI firmware complex enough for you? There is currently no way to check the integrity of other firmware, etc., and no one has even started to focus on SMC versions.

However, if you’re that curious, High Sierra and Mojave offer another firmware checker, which examines BCM5701 ethernet devices. In Terminal, type
/usr/libexec/firmwarecheckers/ethcheck/ethcheck --h
to see its usage information. The command
sudo /usr/libexec/firmwarecheckers/ethcheck/ethcheck --integrity-check
performs a check on your ethernet firmware, provided that your Mac has a real ethernet port. You can find the current version of the ethernet firmware listed in the Ethernet Cards section of System Information.

(Last updated on 24 July 2022)