How OS Detects UEFI vs Legacy BIOS Boot Mode

When a computer starts up, the operating system must identify whether it was initialized via legacy BIOS or native Unified Extensible Firmware Interface (UEFI) to properly communicate with hardware and manage low-level system services. This article explains how operating systems detect the underlying boot mode during the boot sequence and details the specific mechanisms used by Linux and Windows to verify the active firmware interface.

The Firmware Handshake During Early Boot

The distinction between legacy BIOS and UEFI begins long before the operating system kernel is loaded. The firmware determines the initial execution environment, and the operating system detects this environment based on how control is transferred to the bootloader.

• Legacy BIOS Handshake: In a legacy boot, the BIOS loads the first sector of the boot drive (the Master Boot Record, or MBR) into memory address 0x7C00 and executes it in 16-bit Real Mode. Communication with the hardware is handled through legacy BIOS interrupts (such as INT 10h for video and INT 13h for disk services). If the operating system starts via this pathway, it receives no UEFI-specific memory structures, signaling that the system is operating in legacy mode.
• UEFI Handshake: UEFI executes pre-compiled 32-bit or 64-bit EFI application files directly from the EFI System Partition (ESP). Upon execution, UEFI passes a pointer to the UEFI System Table (EFI_SYSTEM_TABLE) directly to the bootloader. This table contains pointers to UEFI Boot Services and UEFI Runtime Services.

If the operating system kernel receives the UEFI System Table pointer from the bootloader, it knows it was booted in native UEFI mode. If that pointer is absent, the kernel assumes a legacy BIOS environment.

How Linux Detects the Boot Mode

During the early initialization phase, the Linux kernel checks for the presence of the EFI System Table passed by the bootloader.

1. The /sys/firmware/efi Directory

If the Linux kernel boots under UEFI, it initializes the EFI runtime subsystem and creates the /sys/firmware/efi directory in the virtual sysfs filesystem.

• If /sys/firmware/efi exists and contains subdirectories like efivars, the system is running in UEFI mode.
• If the directory is absent, the system was booted in legacy BIOS mode.

2. Kernel Boot Logs (dmesg)

Early during the boot process, the kernel logs the detected firmware interface. Commands like dmesg | grep -i efi will reveal log entries such as efi: EFI v2.xx by... if UEFI was detected, or indicate no EFI configuration if running under BIOS.

How Windows Detects the Boot Mode

Windows determines its boot mode through the Windows Boot Manager (bootmgr or bootmgfw.efi) and stores this information in system variables accessible by the kernel and administrative tools.

1. System Information (msinfo32)

Windows queries the hardware abstraction layer (HAL) to determine if EFI runtime services are functional. If valid, the BIOS Mode field in the System Information tool reports UEFI; otherwise, it reports Legacy.

2. Windows Boot Environment Detection

During installation and boot setup, the Windows setup engine runs the internal detection routine Callback_BootEnvironmentDetect. It writes the detected boot mode to setup logs (such as setupact.log), explicitly stating whether the boot environment is EFI or BIOS.

3. The GetFirmwareType API

Windows provides the Win32 API function GetFirmwareType. Software can call this API to programmatically receive an enumeration result:

• FirmwareTypeBios (Legacy)
• FirmwareTypeUefi (Native UEFI)
• FirmwareTypeUnknown

Key Differences at Runtime

Once booted, the OS maintains awareness of the firmware mode through the following differences:

By inspecting whether firmware runtime pointers exist and whether the bootloader passed an active EFI System Table, the operating system definitively identifies the active boot mode.