Index: linux-2.6/arch/ia64/kernel/sal.c
===================================================================
--- linux-2.6.orig/arch/ia64/kernel/sal.c	2007-01-10 14:25:51.000000000 +0900
+++ linux-2.6/arch/ia64/kernel/sal.c	2007-01-10 14:31:34.000000000 +0900
@@ -373,3 +373,27 @@
 	return 0;
 }
 EXPORT_SYMBOL(ia64_sal_oemcall_reentrant);
+
+/* In practice this seems to be needed for at least SAL_GET_STATE_INFO
+ * in Xen. Tested on a Tiger 2 box */
+struct ia64_sal_retval sal_call_phys(ia64_sal_handler ia64_sal,
+				    unsigned long a0, unsigned long a1,
+				    unsigned long a2, unsigned long a3,
+				    unsigned long a4, unsigned long a5,
+				    unsigned long a6, unsigned long a7)
+{
+       switch (a0) {
+       case SAL_GET_STATE_INFO:
+	       a3 = __pa(a3);
+	       break;
+       case SAL_MC_SET_PARAMS:
+	       if (a2 == 0x2) /* It is a memory address */
+		       a3 = __pa(a3);
+	       break;
+       case SAL_UPDATE_PAL:
+	       a1 = __pa(a1);
+	       a2 = __pa(a2);
+	       break;
+       }
+       return __sal_call_phys(ia64_sal, a0, a1, a2, a3, a4, a5, a6, a7);
+}
Index: linux-2.6/arch/ia64/kernel/sal_stub.S
===================================================================
--- linux-2.6.orig/arch/ia64/kernel/sal_stub.S	2007-01-10 14:32:09.000000000 +0900
+++ linux-2.6/arch/ia64/kernel/sal_stub.S	2007-01-10 14:32:21.000000000 +0900
@@ -42,7 +42,7 @@
  *	r8..r11 = return
  */
 
-GLOBAL_ENTRY(sal_call_phys)
+GLOBAL_ENTRY(__sal_call_phys)
 	.prologue ASM_UNW_PRLG_RP|ASM_UNW_PRLG_PFS, ASM_UNW_PRLG_GRSAVE(9)
 	alloc loc1=ar.pfs,9,8,8,0
 	ld8 r2=[in0],8			// load SAL function's entry point
Index: linux-2.6/include/asm-ia64/sal.h
===================================================================
--- linux-2.6.orig/include/asm-ia64/sal.h	2007-01-10 14:32:34.000000000 +0900
+++ linux-2.6/include/asm-ia64/sal.h	2007-01-10 14:34:18.000000000 +0900
@@ -62,7 +62,16 @@
 typedef struct ia64_sal_retval (*ia64_sal_handler) (u64, ...);
 
 /* SAL spec _requires_ eight args for each call. */
-struct ia64_sal_retval sal_call_phys(ia64_sal_handler ia64_sal, ...);
+struct ia64_sal_retval sal_call_phys(ia64_sal_handler ia64_sal,
+				     unsigned long a0, unsigned long a1,
+				     unsigned long a2, unsigned long a3,
+				     unsigned long a4, unsigned long a5,
+				     unsigned long a6, unsigned long a7);
+struct ia64_sal_retval __sal_call_phys(ia64_sal_handler ia64_sal,
+				       unsigned long a0, unsigned long a1,
+				       unsigned long a2, unsigned long a3,
+				       unsigned long a4, unsigned long a5,
+				       unsigned long a6, unsigned long a7);
 
 #define __SAL_CALL(result,a0,a1,a2,a3,a4,a5,a6,a7)			\
 	result = efi.mapped ? 						\