@@ -125,8 +125,10 @@ BITS 16
125125 mov cr4, eax
126126o32 lgdt [cs:bx + (SavedGdt - .Base)]
127127 mov ecx, 0c0000080h
128- rdmsr
129- or ah, 1
128+ mov eax, strict dword 0
129+ .SavedEFERLowEnd:
130+ mov edx, strict dword 0
131+ .SavedEFERHighEnd:
130132 wrmsr
131133 mov eax, strict dword 0
132134.SavedCr0End:
@@ -164,8 +166,8 @@ BITS 16
164166 mov gs, dx
165167 mov ecx, 0c0000080h
166168 mov cr0, eax ; real mode starts at next instruction
167- rdmsr
168- and ah, ~1
169+ xor eax, eax
170+ xor edx, edx
169171 wrmsr
170172 mov cr4, ebp
171173 mov ss, si ; set up 16-bit stack segment
@@ -283,10 +285,23 @@ BITS 64
283285 sidt [rsp + 50h] ; save IDT stack in argument space
284286 mov rax, cr0
285287 mov [rcx + (_BackFromUserCode.SavedCr0End - 4 - _BackFromUserCode.SavedCr4End)], eax
286- and eax, 7ffffffeh ; clear PE, PG bits
288+ mov eax, 00000010h ; clear all bits except ET
289+ push rax
290+ push rcx
291+ push rdx
292+ mov ecx, 0c0000080h
293+ rdmsr
294+ btr eax, 10 ; Reset LMA flag to avoid crash on AMD Zen CPUs
295+ mov r10d, eax
296+ mov r11d, edx
297+ pop rdx
298+ pop rcx
299+ pop rax
300+ mov [rcx + (_BackFromUserCode.SavedEFERLowEnd - 4 - _BackFromUserCode.SavedCr4End)], r10d
301+ mov [rcx + (_BackFromUserCode.SavedEFERHighEnd - 4 - _BackFromUserCode.SavedCr4End)], r11d
287302 mov rbp, cr4
288303 mov [rcx - 4], ebp ; save CR4 in _BackFromUserCode.SavedCr4End - 4
289- and ebp, ~30h ; clear PAE, PSE bits
304+ xor ebp, ebp ; zero out CR4
290305 mov esi, r8d ; esi <- 16-bit stack segment
291306 push DATA32
292307 pop rdx ; rdx <- 32-bit data segment selector
0 commit comments