--- x/xen/arch/ia64/linux-xen/sal.c
+++ x/xen/arch/ia64/linux-xen/sal.c
@@ -384,3 +384,30 @@ ia64_sal_oemcall_reentrant(struct ia64_s
 	return 0;
 }
 EXPORT_SYMBOL(ia64_sal_oemcall_reentrant);
+
+#ifdef XEN
+
+/* In practice this seems to be needed for at least SAL_GET_STATE_INFO
+ * Tested on a Tiger 2 box */
+struct ia64_sal_retval sal_call_phys(ia64_sal_handler ia64_sal,
+				     unsigned long a0, unsigned long a1,
+				     unsigned long a2, unsigned long a3,
+				     unsigned long a4, unsigned long a5,
+				     unsigned long a6, unsigned long a7)
+{
+	switch (a0) {
+	case SAL_GET_STATE_INFO:
+		a3 = __pa(a3);
+		break;
+	case SAL_MC_SET_PARAMS:
+		if (a2 == 0x2) /* It is a memory address */
+			a3 = __pa(a3);
+		break;
+	case SAL_UPDATE_PAL:
+		a1 = __pa(a1);
+		a2 = __pa(a2);
+		break;
+	}
+	return __sal_call_phys(ia64_sal, a0, a1, a2, a3, a4, a5, a6, a7);
+}
+#endif
--- x/xen/arch/ia64/linux-xen/sal_stub.S
+++ x/xen/arch/ia64/linux-xen/sal_stub.S
@@ -42,7 +42,7 @@
  *	r8..r11 = return
  */
 
-GLOBAL_ENTRY(sal_call_phys)
+GLOBAL_ENTRY(__sal_call_phys)
 	.prologue ASM_UNW_PRLG_RP|ASM_UNW_PRLG_PFS, ASM_UNW_PRLG_GRSAVE(9)
 	alloc loc1=ar.pfs,9,8,8,0
 	ld8 r2=[in0],8			// load SAL function's entry point
--- x/xen/include/asm-ia64/linux/asm/sal.h
+++ x/xen/include/asm-ia64/linux/asm/sal.h
@@ -62,16 +62,27 @@ struct ia64_sal_retval {
 typedef struct ia64_sal_retval (*ia64_sal_handler) (u64, ...);
 
 /* SAL spec _requires_ eight args for each call. */
+#ifndef XEN
 struct ia64_sal_retval sal_call_phys(ia64_sal_handler ia64_sal, ...);
 
-#ifdef XEN
+#define __SAL_CALL(result,a0,a1,a2,a3,a4,a5,a6,a7)			\
+	result = (*ia64_sal)(ia64_sal,a0,a1,a2,a3,a4,a5,a6,a7);
+#else
+struct ia64_sal_retval sal_call_phys(ia64_sal_handler ia64_sal,
+				     unsigned long a0, unsigned long a1,
+				     unsigned long a2, unsigned long a3,
+				     unsigned long a4, unsigned long a5,
+				     unsigned long a6, unsigned long a7);
+struct ia64_sal_retval __sal_call_phys(ia64_sal_handler ia64_sal,
+				       unsigned long a0, unsigned long a1,
+				       unsigned long a2, unsigned long a3,
+				       unsigned long a4, unsigned long a5,
+				       unsigned long a6, unsigned long a7);
+
 #define __SAL_CALL(result,a0,a1,a2,a3,a4,a5,a6,a7)			\
 	result = efi.mapped ? 						\
 		 (*ia64_sal)(a0,a1,a2,a3,a4,a5,a6,a7) :			\
 		 sal_call_phys(ia64_sal,a0,a1,a2,a3,a4,a5,a6,a7);
-#else
-#define __SAL_CALL(result,a0,a1,a2,a3,a4,a5,a6,a7)	\
-	result = (*ia64_sal)(ia64_sal,a0,a1,a2,a3,a4,a5,a6,a7);
 #endif
 
 # define SAL_CALL(result,args...) do {				\