--- 0001/xen/arch/ia64/linux-xen/efi.c
+++ work/xen/arch/ia64/linux-xen/efi.c
@@ -309,6 +309,11 @@ efi_get_pal_addr (void)
 	int pal_code_count = 0;
 	u64 vaddr, mask;
 
+#ifdef XEN
+	if (saved_pal_vaddr)
+		return saved_pal_vaddr;
+#endif
+
 	efi_map_start = __va(ia64_boot_param->efi_memmap);
 	efi_map_end   = efi_map_start + ia64_boot_param->efi_memmap_size;
 	efi_desc_size = ia64_boot_param->efi_memdesc_size;
@@ -368,24 +373,17 @@ efi_get_pal_addr (void)
 
 
 #ifdef XEN
-void *pal_vaddr = 0;
+static void *saved_pal_vaddr = 0;
 #endif
 
 void
 efi_map_pal_code (void)
 {
-#ifdef XEN
-	u64 psr;
-	if (!pal_vaddr) {
-		pal_vaddr = efi_get_pal_addr ();
-	}
-#else
 	void *pal_vaddr = efi_get_pal_addr ();
 	u64 psr;
 
 	if (!pal_vaddr)
 		return;
-#endif
 
 	/*
 	 * Cannot write to CRx with PSR.ic=1
--- 0001/xen/arch/ia64/vmx/vmx_phy_mode.c
+++ work/xen/arch/ia64/vmx/vmx_phy_mode.c
@@ -137,8 +137,6 @@ vmx_init_all_rr(VCPU *vcpu)
 	VMX(vcpu, vrr[VRN7]) = 0x738;
 }
 
-extern void * pal_vaddr;
-
 void
 vmx_load_all_rr(VCPU *vcpu)
 {
@@ -186,7 +184,7 @@ vmx_load_all_rr(VCPU *vcpu)
 	vmx_switch_rr7(vrrtomrr(vcpu,VMX(vcpu, vrr[VRN7])),
 			(void *)vcpu->domain->shared_info,
 			(void *)vcpu->arch.privregs,
-			(void *)vcpu->arch.vhpt.hash, pal_vaddr );
+			(void *)vcpu->arch.vhpt.hash, efi_get_pal_addr());
 	ia64_set_pta(VMX(vcpu, mpta));
 	ia64_set_dcr(VMX(vcpu, mdcr));
 
--- 0001/xen/arch/ia64/vmx/vmx_vcpu.c
+++ work/xen/arch/ia64/vmx/vmx_vcpu.c
@@ -211,7 +211,6 @@ vmx_vcpu_get_plat(VCPU *vcpu)
 IA64FAULT vmx_vcpu_set_rr(VCPU *vcpu, u64 reg, u64 val)
 {
     ia64_rr oldrr,newrr;
-    extern void * pal_vaddr;
     u64 rrval;
 
     vcpu_get_rr(vcpu, reg, &oldrr.rrval);
@@ -224,7 +223,7 @@ IA64FAULT vmx_vcpu_set_rr(VCPU *vcpu, u6
     case VRN7:
         vmx_switch_rr7(vrrtomrr(vcpu,val),vcpu->domain->shared_info,
         (void *)vcpu->arch.privregs,
-        (void *)vcpu->arch.vhpt.hash, pal_vaddr );
+        (void *)vcpu->arch.vhpt.hash, efi_get_pal_addr());
        break;
     case VRN4:
         rrval = vrrtomrr(vcpu,val);
--- 0001/xen/arch/ia64/xen/regionreg.c
+++ work/xen/arch/ia64/xen/regionreg.c
@@ -17,7 +17,9 @@
 #include <asm/vcpu.h>
 
 /* Defined in xemasm.S  */
-extern void ia64_new_rr7(unsigned long rid, void *shared_info, void *shared_arch_info, unsigned long shared_info_va, unsigned long va_vhpt);
+extern void ia64_new_rr7(unsigned long rid, void *shared_info, 
+			 void *shared_arch_info, unsigned long shared_info_va,
+			 unsigned long va_vhpt void *pal_vaddr);
 
 /* RID virtualization mechanism is really simple:  domains have less rid bits
    than the host and the host rid space is shared among the domains.  (Values
@@ -260,7 +262,7 @@ int set_one_rr(unsigned long rr, unsigne
 	} else if (rreg == 7) {
 		ia64_new_rr7(vmMangleRID(newrrv.rrval),v->domain->shared_info,
 			     v->arch.privregs, v->domain->arch.shared_info_va,
-		             __va_ul(vcpu_vhpt_maddr(v)));
+		             __va_ul(vcpu_vhpt_maddr(v)), efi_get_pal_addr());
 	} else {
 		set_rr(rr,newrrv.rrval);
 	}
--- 0001/xen/arch/ia64/xen/xenasm.S
+++ work/xen/arch/ia64/xen/xenasm.S
@@ -27,6 +27,7 @@
 //                         void *shared_arch_info, 	 /* in2 */
 //                         unsigned long shared_info_va, /* in3 */
 //                         unsigned long va_vhpt)   	 /* in4 */
+//                         void *pal_vaddr)   	 	 /* in5 */
 //Local usage:
 //  loc0=rp, loc1=ar.pfs, loc2=percpu_paddr, loc3=psr, loc4=ar.rse
 //  loc5=pal_vaddr, loc6=xen_paddr, loc7=shared_archinfo_paddr,
@@ -34,7 +35,7 @@
 GLOBAL_ENTRY(ia64_new_rr7)
 	// FIXME? not sure this unwind statement is correct...
 	.prologue ASM_UNW_PRLG_RP|ASM_UNW_PRLG_PFS, ASM_UNW_PRLG_GRSAVE(1)
-	alloc loc1 = ar.pfs, 5, 8, 0, 0
+	alloc loc1 = ar.pfs, 6, 8, 0, 0
 	movl loc2=PERCPU_ADDR
 1:	{
 	  mov loc3 = psr		// save psr	
@@ -60,9 +61,7 @@ GLOBAL_ENTRY(ia64_new_rr7)
 	br.call.sptk.many rp=ia64_switch_mode_phys
 1:
 	// now in physical mode with psr.i/ic off so do rr7 switch
-	movl r16=pal_vaddr		// Note: belong to region 7!
-	;; 
-	mov	rr[r16]=in0
+	mov	rr[in5]=in0
 	;; 
 	srlz.d
 	dep	r16=0,r16,60,4		// Get physical address.