mov eax,cr0
and eax,not 1
mov cr0,eax    

Unless UEFI has introduced some sort of protection mechanism to prevent the processor from switching to RM.

Has anyone tried to switch back to Real Mode after UEFI/EFI initialization?
In theory I think it should be possible since UEFI/EFI based machines are simply x86 machines with a Firmware that does switch to Protected Mode after initialization (Maybe? or Maybe Not?). UEFI/EFI also uses POST from the BIOS-era.
So do you think this is possible?
I don't have a UEFI machine.

Unless UEFI has introduced some sort of protection mechanism to prevent the processor from switching to RM.

; some example how UEFI is started, this is disasm from a file containing UEFI firmware - code is located at physical memory address FFFFFFF0 and at offset 7FFFF0 in the file:
007FFFF0:i0F09                           wbinvd
007FFFF2:iE90BFB                         jmpn      file:007FFB00

007FFB00:i0F6EC0                         movd      mm0,ax
007FFB03:iB91B00                         mov       cx,001B
007FFB06:i0F32                           rdmsr
007FFB08:iF6C401                         test (b)  ah,01
007FFB0B:i7438                           je        file:007FFB45 ; check bootstrap CPU or application CPU
; this is executed at bootstrap CPU
007FFB0D:i66BEC0FCFFFF                   mov       esi,FFFFFCC0
007FFB13:i662E0F0114                     lgdt (p)  [si]
007FFB18:i0F20C0                         mov       eax,cr0
007FFB1B:i6683C803                       or (d)    eax,+03
007FFB1F:i0F22C0                         mov       cr0,eax
007FFB22:i0F20E0                         mov       eax,cr4
007FFB25:i660D00060000                   or        eax,00000600
007FFB2B:i0F22E0                         mov       cr4,eax
007FFB2E:iB81800                         mov       ax,0018
007FFB31:i8ED8                           mov       ds,ax
007FFB33:i8EC0                           mov       es,ax
007FFB35:i8EE0                           mov       fs,ax
007FFB37:i8EE8                           mov       gs,ax
007FFB39:i8ED0                           mov       ss,ax
007FFB3B:i66BEC6FCFFFF                   mov       esi,FFFFFCC6
007FFB41:i662EFF2C                       jmp (p)   [si]

; this is executed at application CPU - don't do anything, just halt the CPU (no worry it will be waken up later using INIT-SIPI coming from bootstrap)
007FFB45:iFA                             cli
007FFB46:iF4                             hlt
007FFB47:iEBFC                           jmps      file:007FFB45    

;9.9.2 Switching Back to Real-Address Mode
;The processor switches from protected mode back to real-address mode if software
;clears the PE bit in the CR0 register with a MOV CR0 instruction. A procedure that reenters
;real-address mode should perform the following steps:
;1. Disable interrupts. A CLI instruction disables maskable hardware interrupts. NMI
;interrupts can be disabled with external circuitry.
;2. If paging is enabled, perform the following operations:
;- Transfer program control to linear addresses that are identity mapped to
;physical addresses (that is, linear addresses equal physical addresses).
;- Insure that the GDT and IDT are in identity mapped pages.
;- Clear the PG bit in the CR0 register.
;- Move 0H into the CR3 register to flush the TLB.
;3. Transfer program control to a readable segment that has a limit of 64 KBytes
;(FFFFH). This operation loads the CS register with the segment limit required in
;real-address mode.

use64
        cli
        mov     eax,page1_mem
        mov     cr3,rax

        lgdt    [GDTR_init]
        push    DATA16_SELECTOR_init            ; target SS
        push    top_of_startup_stack            ; target RSP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! N.B. the same stack will be shared among all CPUs in the system !!!!!!!!!!!!!!!!!!!!!
                                                ; !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! it is possible to survive that only in case only one CPU is allowed to use stack and all others must have disabled interrupts and can't use stack like not doing call push pop instruction etc, disabled interrupts prevent interrupts from changing stack)
        pushf                                   ; target RFLAGS
        push    CODE16_SELECTOR_init            ; target CS
        push    return_back                     ; target RIP
        iretq                                   ; update CS and SS as well

return_back:
use16                   ; yeah, 16 bit code, but still long mode...
; we are in identity-mapped memory at this point, running 16 bit code under compatibility submode of long mode
; interrupts are disabled (so no external interrupt hit and we also never do software interrupts) which prevents to accessing stack (the same stack is shared among all CPUs, if they would arbitrary access the stack it will be overwritten for another CPUs and lead into big fucking mess)
        mov     ax,DATA16_SELECTOR_init
        mov     ds,ax
        mov     es,ax
        mov     fs,ax
        mov     gs,ax
; CS, SS already set by the iretq

        mov     eax,cr0
        and     eax,not ((1 shl 31) or (1 shl 0))
        mov     cr0,eax                 ; disable paging (bit 31.) and protected mode (bit 0.)
                                ; instruction must be located in an identity-mapped page

; at this point, EFER.LMA=0 (long mode is not active), but still LME=1
        mov     ecx,MSR_IA32_EFER
        rdmsr
        and     ah,not (1 shl (EFER_LME_bit-8)) ; disable long mode
        wrmsr

        mov     eax,cr4
;;      and     al,not ((1 shl 7) or (1 shl 5)) ; PGE bit 7., PAE bit 5.
;;      mov     cr4,eax                 ; disable global pages and physical-address extensions
;       and     al,not ((1 shl 6) or (1 shl 5)) ; MCE bit 6., PAE bit 5.
;       mov     cr4,eax                 ; disable physical-address extensions
; no, let #MC enabled
        and     al,not (1 shl 5)        ; PAE bit 5.
        mov     cr4,eax                 ; disable physical-address extensions

        xor     eax,eax
        mov     cr3,eax                 ; flush TLB

;       xor     ax,ax                   ; no need again, already zeroed
        mov     ds,ax
        mov     es,ax
        mov     fs,ax
        mov     gs,ax
        mov     ss,ax

        jmp     far 0 : real_mode

rmidt:  dw      3FFh    ; limit
        dd      0       ; base

real_mode:

        lidt    [rmidt]    

use16
; initialize paging tables
page_size                                       =       0000000000200000h
page_size_power                                 =       21      ; page_size = 2 ^ page_size_power
boot_identity_mapped_physical_virtual_memory    =       0       ; we map virtual memory at identical physical memory (RAM)
boot_physical_memory                            =       boot_identity_mapped_physical_virtual_memory and 11111111111111111111b
boot_virtual_memory                             =       boot_identity_mapped_physical_virtual_memory
a = (boot_virtual_memory shr 39) and 111111111b
b = (boot_virtual_memory shr 30) and 111111111b
c = (boot_virtual_memory shr 21) and 111111111b
; we construct paging tables for 2 MB paging at linear address boot_translation_tables_linear_address
        mov     di,page1_mem            ; this is physical address (in RAM)
; clear 3 pages
        mov     cx,6 * 1000h / 2        ; clear all 6 pages used for constructing paging tables
        xor     ax,ax
        cld
        repz    stosw                   ; clear the page tables at memory 1000h-3FFFh
                                        ; another benefit is scasw trick used later
        mov     word [page1_mem + a*8],page2_mem + 111b ; field 0. of of PML4 = pointer to first PDP table
                                        ; upper dword was set 0 at the above repz stosw
        mov     word [page2_mem + b*8],page3_mem + 111b ; field 0. of PDP table = pointer to first page directory table
; now we map 2 MB of memory, the memory will be identity-mapped (physical address in RAM = virtual address), when paging will be enabled, physical address switches into the same virtual address thanks to identity-mapping
        mov     word [page3_mem + c*8],boot_physical_memory + 110000011b        ; field 0. of page directory table (identically mapping of memory 00000-1FFFF)
                                        ; note, the above entries have bit 2. (U/S) set to 1, this last has set it to 0, so only supervisor (ring0, 1, 2) is allowed to access memory page mapped by last entry in PD (the entry has name PDE)
                                        ; N.B. this is 2 MB mapping (bit 7. = PDE.PSE = 1) and pages are global (bit 8. = 1)    

virtual at 1000h
        page1_mem       rb      1000h
        page2_mem       rb      1000h
        page3_mem       rb      1000h
        page4_mem       rb      1000h
        page5_mem       rb      1000h
        page6_mem       rb      1000h
        startup_stack   rb      0C00h
        top_of_startup_stack:
end virtual    

align 10h
GDTR_init:                              ; Global Descriptors Table Register
        dw      size_of_GDT_init - 1    ; limit of GDT (size minus one)
        dq      GDT_init                ; linear address of GDT

align 10h
GDT_init:
.null                   dq      0               ; null selector
CODE64_SELECTOR_init    =       $ - .null
                        dq      CODE64_DESCRIPTOR_init
DATA64_SELECTOR_init    =       $ - .null
                        dq      DATA64_DESCRIPTOR_init  ; used for DS, ES, FS, GS
STACK64_SELECTOR_init   =       $ - .null
                        dq      STACK64_DESCRIPTOR_init
TASK64_SELECTOR_init            =       $ - .null
                        dw      sizeof.TSS-1    ; limit
                        dw      0
                        db      0
                        db      TSS_ATTRIBUTES
                        dw      0
                        dd      0
                        dd      0
CODE16_SELECTOR_init    =       $ - .null
                        dw      0FFFFh,0,9A00h,0        ; 16-bit code descriptor to return to 16-bit real mode
                                        ; 9A present, ring 0, code, readable
                                        ; 0 granularity=0 Setting a limit of 0 indicates a 1-byte segment limit when G = 0.
DATA16_SELECTOR_init    =       $ - .null
                        dw      0FFFFh,0,9200h,0        ; 16-bit data descriptor to return to 16-bit real mode
                                        ; 92 present, ring 0, data, expand-up, writable
size_of_GDT_init        =       $ - .null    

This is quite good exercise. I like it, so I improved it further. I stripped some part from my other project and added it here - to return from real mode to UEFI long mode (UEFI runs at only 1 CPU and doesn't support SMP yet, in the past I needed to activate all CPUs in SMP and run UEFI long mode at all of them - I managed to activate all sleeping application CPUs in parallel at that my project - not one after one as is done usually).
After stripping that part and adding it into this exercise it worked fine.
Later I decided to try to put the real mode chunk to memory not only below 100000h but also above 10000h and a problem appeared immediately, the real mode chunk was never reached. I had to improve the old part which I posted yesterday. Now it works fine again.
Everybody having UEFI x64 please test it. All my 3 MBs are from ASUS (ASUS M5A99X EVO, ASUS P8Z77-V LX2, ASUS P9D WS) and all have UEFI by AMI.
Very probably it is still possible to find few things to improve in the exercise, suggestions are welcome, please post theme !