Firmware and its updating is a confusing topic: everything about them is unseen, updates just happen or fail silently, apparently out of our control. This article tries to put you back in charge of them.

Here’s a quick summary for those who won’t get any further:

• Each Mac can only have one firmware version installed at a time, no matter how many different startup disks it might have.
• Firmware updates are bundled within macOS updates and Security Updates. They’re not available by any other means.
• When you install a macOS update containing a firmware update for your Mac model, you aren’t informed, and have no option over whether to install it: the installer will try to install it, come what may.
• Firmware only updates to a more recent version; it’s practically impossible to downgrade your Mac’s firmware to an earlier version, except by replacing its logic board.
• Firmware and the kernel have a special relationship: firmware updates normally come with kernel updates intended to keep them compatible.
• Apple only provides kernel updates for supported versions of macOS – they’re the current and two previous major versions, soon to be Big Sur plus Catalina and Mojave.
• If possible, avoid updating the firmware of a Mac to a version more recent than its kernel. If your Mac is still running Sierra, for example, it will work best if its firmware is no more recent than the last Sierra Security Update.
• eficheck isn’t much help.

One firmware version at a time

Firmware resides in the logic board of your Mac, and those models with T2 chips also have its special iBridge firmware installed in that chip. During installation, the installer may use local storage for staging, but the firmware itself ends up in chips on the logic board.

This means that, if you have two or more versions of macOS installed on the same Mac, the firmware it should have installed is the latest version installed with the most recent of those versions of macOS. If you install a beta-release of Big Sur on a Mac which has been running Mojave, then that results in that Mac – not just an external disk – being upgraded to the firmware supplied with the beta-release of Big Sur.

Delivered in macOS installers and updaters

Many years ago, Apple used to supply firmware separately from Mac OS X, with a tool you could use to install it. That hasn’t been the case for a long time now: the only firmware installers and updaters are supplied as part of macOS installations and updates. Utilities like SilentKnight can’t install firmware for you, only a genuine Apple installer can. If you haven’t updated macOS, then it’s not possible for that Mac’s firmware to have been updated, not even by sharing an external disk with a Mac that has been updated.

There are a couple of marginal exceptions to this. Some users open up macOS updates and try to install firmware separately, with varying degrees of success. Apple technicians also have access to in-house tools which can perform firmware updates.

Firmware updates are mandatory

When you install a system update which contains a firmware update, the installer will check if your Mac’s firmware needs to be updated. If the version bundled in the update is more recent than that installed on your Mac, it will automatically proceed to perform that update. Installers may provide clues that an update is about to take place, for instance by warning the user of black screen phases and telling you not to interrupt that part of the update, but they give you no choice about whether to install it. Proceed with the installation, and the update is inevitable.

Firmware doesn’t downgrade

The logic in firmware updaters is simple: if the version available is more recent than that installed, the update proceeds. There doesn’t appear to be any reliable means of downgrading firmware to an earlier version. If you try to apply an older update containing an older firmware version, it simply doesn’t install the firmware. This appears to be the case even with Apple’s in-house tools. If you really want to downgrade, the only reliable method is to replace your Mac’s logic board with one which has an older firmware version.

Firmware and kernel go together

Your Mac’s firmware, the kernel and its extensions work very closely together. Mixing and matching them is a dangerous business: take firmware from the latest beta-release of Big Sur, run a kernel from a few years ago with its extensions, and don’t be surprised if you encounter problems. This is one good reason that Apple now updates firmware, kernel and extensions together in its macOS updates and Security Updates.

Beware running much newer firmware with older kernels

Clashes do occur. At worst, you can end up with an unstable Mac which is prone to kernel panics. Unfortunately, as you won’t be able to downgrade its firmware, the only solution is then to upgrade macOS to a supported version, which shortly will mean only Mojave, Catalina or Big Sur, as Apple is expected to drop High Sierra support when Big Sur is released.

Firmware updates for supported macOS

Because firmware updates only come with macOS updates and Security Updates, when Apple ceases providing those for a previous version of macOS, those firmware updates also come to an end. If you’re still running El Capitan, your Mac’s last firmware update should therefore have come from its last security update in 2018. The only way you could change that would be to install a later version of macOS; if you then reverted to using El Capitan, it would be running an older kernel which wasn’t intended to be fully compatible with its newer firmware, and steering into danger of compatibility problems.

In this respect, Sierra is a particular problem. Its last security update was released on 26 September 2019, unusually late in the cycle. There had been a flurry of firmware updates at the time, and Apple had also changed the firmware version numbering system over the previous year. This didn’t settle until Mojave’s release cycle was well established. Working out the ‘correct’ firmware versions for the last months of Sierra’s support is therefore fraught.

eficheck

Apple introduced eficheck to try to tackle problems with a wide range of firmware versions in use on different models of Mac. Unfortunately, it doesn’t check whether your Mac is running the latest firmware, even when its macOS is still supported, but works on an allow list which allows your Mac to run older firmware.

Not only that, but eficheck doesn’t work with Macs with a T2 chip, which now includes Apple’s complete product range. At least all T2 models (to date) run the same firmware, both internally in the ‘iBridge’ and in their EFI firmware, but Apple doesn’t appear to provide any means of determining whether it’s up to date.

Looking ahead to Apple Silicon Macs, this has surely got to become simpler. As they don’t have Intel processors, they don’t have EFI or EFI firmware. If Apple integrates the current functions of the T2 chip into their main SoC, they might perhaps have a single series of firmware versions which proves much easier to track. My fingers are crossed.

Useful articles

A plain guide to Mac firmware and its problems

Which EFI firmware should your Mac be using? (version 4) – for Catalina
Which EFI firmware should your Mac be using? (version 3) – for Sierra, High Sierra, Mojave
Which EFI firmware should your Mac be using? (version 2) – for El Capitan and earlier

What to do when a T2 Mac suffers a problem updating its firmware
Does replacing internal storage cause EFI updating problems?
Some Macs don’t update their firmware when they should
Firmware updates and the iMac Retina 5K 27-inch Late 2015 (iMac17,1)

SilentKnight, LockRattler and silnite: which should you use?