diff --git a/src/security/intel/txt/getsec_mtrr_setup.inc b/src/security/intel/txt/getsec_mtrr_setup.inc
index 15e8cc17ad..44471ebea8 100644
--- a/src/security/intel/txt/getsec_mtrr_setup.inc
+++ b/src/security/intel/txt/getsec_mtrr_setup.inc
@@ -3,8 +3,6 @@
 #include <cpu/x86/mtrr.h>
 #include <cpu/x86/msr.h>
 
-#define MTRR_HIGH_MASK $((1 << (CONFIG_CPU_ADDR_BITS - 32)) - 1)
-
 /*
  * Configure the MTRRs to cache the BIOS ACM. No general-purpose
  * registers are preserved. Inputs are taken from SSE registers:
@@ -16,6 +14,16 @@
  */
 .macro SET_UP_MTRRS_FOR_BIOS_ACM
 
+	/* Determine CPU_ADDR_BITS and load PHYSMASK high word to %edx. */
+	movl	$0x80000008, %eax
+	cpuid
+	movb	%al, %cl
+	sub	$32, %cl
+	movl	$1, %edx
+	shl	%cl, %edx
+	subl	$1, %edx
+	movl	%edx, %edi /* %edi contains the MTRR_HIGH_MASK */
+
 	/* Get the number of variable MTRRs */
 	movl	$(MTRR_CAP_MSR), %ecx
 	rdmsr
@@ -56,7 +64,7 @@ body_allocate_var_mtrrs:
 	movd	%eax, %xmm1
 
 	/* Program MTRR mask */
-	movl	MTRR_HIGH_MASK, %edx
+	movl	%edi, %edx
 	xorl	%eax, %eax
 	subl	%ebx, %eax			/* %eax = 4GIB - size to cache */
 	orl	$(MTRR_PHYS_MASK_VALID), %eax
diff --git a/src/security/intel/txt/getsec_sclean.S b/src/security/intel/txt/getsec_sclean.S
index e240a2faaa..0944e158e2 100644
--- a/src/security/intel/txt/getsec_sclean.S
+++ b/src/security/intel/txt/getsec_sclean.S
@@ -6,8 +6,6 @@
 
 #include "getsec_mtrr_setup.inc"
 
-#define MTRR_HIGH_MASK	$((1 << (CONFIG_CPU_ADDR_BITS - 32)) - 1)
-
 #define NO_EVICT_MODE	0x2e0
 
 .align 4