自研x86_64 UEFI应用在真实硬件死机，QEMU OVMF运行正常

此问题与某传统BIOS引导加载问题相关，但本次针对x86_64 UEFI架构。

我们正在基于UEFI开发x86_64架构的操作系统，发现该系统在QEMU的OVMF固件中可正常启动，但在四款真实硬件（联想Thinkpad、System76笔记本、Steam Deck、一款x86单板计算机）上均出现黑屏无响应的永久死机情况。更糟的是，在入口点最前端添加代码（触发异常、写入ConOut、写入串口）试图输出信息后，结果仍是无响应死机，这表明真实硬件可能根本未加载镜像，或跳转到了错误地址。

因特定原因，我们自研代码生成PE镜像（未使用标准C工具），无法分享该代码，但可提供EFI头文件及第一阶段引导加载程序：

00000000  4d 5a 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |MZ..............|
00000010  b8 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 80 00 00 00  |................|
00000040  0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000050  69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000060  74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000070  6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|
00000080  50 45 00 00 64 86 03 00  00 00 00 00 00 00 00 00  |PE..d...........|
00000090  00 00 00 00 70 00 06 02  0b 02 02 26 00 10 00 00  |....p......&....|
000000a0  00 d0 16 00 00 00 00 00  00 10 00 00 00 10 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 10 00 00 00 10 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 f0 16 00 00 10 00 00  00 00 00 00 0a 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000110  00 10 00 00 00 10 00 00  00 10 00 00 00 10 00 00  |................|
00000120  00 00 00 00 00 00 00 00  00 00 00 00 20 00 00 60  |............ ..`|
00000130  00 00 00 00 00 00 00 00  00 80 11 00 00 20 00 00  |............. ..|
00000140  00 80 11 00 00 20 00 00  00 00 00 00 00 00 00 00  |..... ..........|
00000150  00 00 00 00 40 00 00 c0  00 00 00 00 00 00 00 00  |....@...........|
00000160  00 50 05 00 00 a0 11 00  00 50 05 00 00 a0 11 00  |.P.......P......|
00000170  00 00 00 00 00 00 00 00  00 00 00 00 40 00 00 c0  |............@...|
00000180  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00001000  51 52 48 89 e5 48 89 d3  48 c7 c2 54 00 21 00 52  |QRH..H..H..T.!.R|
00001010  48 ba 53 00 54 00 41 00  52 00 52 48 89 e2 48 83  |H.S.T.A.R.RH..H.|
00001020  ec 40 48 8b 4b 40 ff 51  08 48 89 ec 48 89 da 48  |.@H.K@.Q.H..H..H|
00001030  8b 42 60 68 01 00 00 00  59 89 ca 68 98 01 00 00  |.B`h....Y..h....|
00001040  41 58 68 00 00 00 01 49  89 e1 48 83 ec 48 ff 50  |AXh....I..H..H.P|
00001050  28 48 83 c4 48 5f 81 c7  00 00 08 00 57 68 00 80  |(H..H_......Wh..|
00001060  11 00 59 48 8d 35 96 0f  00 00 f3 a4 5f 48 8d 35  |..YH.5......_H.5|
00001070  8c 8f 11 00 68 7f 53 01  00 59 ad 01 3c 07 e2 fa  |....h.S..Y..<...|
00001080  5a 5e 89 fc 8b 07 50 c3  00 00 00 00 00 00 00 00  |Z^....P.........|
00001090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

（0x1000处代码段的反汇编，功能为打印信息，然后将另外两个段复制到新分配的内存页并跳转至其中一个）：

push rcx ; rcx contains EFI handle
push rdx ; rdx contains System Table
mov rbp, rsp
mov rbx, rdx
mov rdx, 0x210054 ; push L"T!"
push rdx
movabs rdx, 0x52004100540053 ; push L"STAR"
push rdx
mov rdx, rsp
sub rsp, 0x40
mov rcx, qword ptr [rbx + 0x40] ; ConOut
call qword ptr [rcx + 8] ; StringOutput
mov rsp, rbp
mov rdx, rbx
mov rax, qword ptr [rdx + 0x60] ; BootServices
push 1
pop rcx
mov edx, ecx
push 0x198
pop r8
push 0x1000000
mov r9, rsp
sub rsp, 0x48
call qword ptr [rax + 0x28] ; AllocatePages
add rsp, 0x48
pop rdi
add edi, 0x80000
push rdi
push 0x118000
pop rcx
lea rsi, qword ptr [rip + 0xf96] ; pointer to first section
rep movsb byte ptr es:[rdi], byte ptr [rsi]
pop rdi
lea rsi, qword ptr [rip + 0x118f8c] ; pointer to second section
push 0x1537f
pop rcx
lodsd eax, dword ptr [rsi]
add dword ptr [rdi + rax], edi
loop 0x1007a
pop rdx
pop rsi
mov esp, edi
mov eax, dword ptr [rdi]
push rax
ret 

我已通过PE-Bear工具对比Limine、EFI Shell等已知正常的EFI文件验证正确性，也尝试在EFI Shell中运行该程序、使用Intel管理引擎排查，但结果一致：QEMU中正常，真实硬件上黑屏死机。

补充：看门狗定时器无效——真实硬件10分钟后仍处于死机状态；Ctrl+Alt+Del也无法恢复，必须强制断电重启。

编辑1：修改了EFI函数调用的影子寄存器空间，解决了QEMU中的部分问题，但真实硬件上情况依旧。已更新上述转储和反汇编内容。

内容的提问来源于stack exchange，提问作者TheHans255