:: commit db04cd25959958143fbdb8db6e93a3465f7b3228

diff --git a/PROTOCOL.md b/PROTOCOL.md
index 94b49e6a..dea07a0f 100644
--- a/PROTOCOL.md
+++ b/PROTOCOL.md
@@ -121,8 +121,17 @@ All HHDM memory regions are mapped using write-back (WB) caching at the page
 tables level, except framebuffer regions which are mapped using write-combining
 (WC) caching at the page tables level.
 
-The PAT's (Page Attribute Table) layout is unspecified and the OS should
-not be making assumptions about it.
+The PAT's (Page Attribute Table) layout is specified to be as follows:
+```
+PAT0 -> WB
+PAT1 -> WT
+PAT2 -> UC-
+PAT3 -> UC
+PAT4 -> WP
+PAT5 -> WC
+PAT6 -> unspecified
+PAT7 -> unspecified
+```
 
 The MTRRs are left as the firmware set them up.
 
diff --git a/common/protos/limine.c b/common/protos/limine.c
index ec8a30e8..f371e7f2 100644
--- a/common/protos/limine.c
+++ b/common/protos/limine.c
@@ -1066,10 +1066,14 @@ FEAT_END
     rm_int(0x15, &r, &r);
 #endif
 
-    // Enable PAT (write-combining/write-protect)
-    uint64_t pat = rdmsr(0x277);
-    pat &= 0xffffffff;
-    pat |= (uint64_t)0x0105 << 32;
+    // Set PAT as:
+    // PAT0 -> WB  (06)
+    // PAT1 -> WT  (04)
+    // PAT2 -> UC- (07)
+    // PAT3 -> UC  (00)
+    // PAT4 -> WP  (05)
+    // PAT5 -> WC  (01)
+    uint64_t pat = (uint64_t)0x010500070406;
     wrmsr(0x277, pat);
 
     pic_mask_all();
diff --git a/common/sys/smp_trampoline.asm_x86 b/common/sys/smp_trampoline.asm_x86
index e23b2e30..59f581b0 100644
--- a/common/sys/smp_trampoline.asm_x86
+++ b/common/sys/smp_trampoline.asm_x86
@@ -40,8 +40,8 @@ smp_trampoline_start:
     mov cr4, eax
 
     mov ecx, 0x277
-    rdmsr
-    mov edx, 0x0105
+    mov eax, 0x00070406
+    mov edx, 0x00000105
     wrmsr
 
     test dword [ebx + (passed_info.target_mode - smp_trampoline_start)], (1 << 2)