Index: 20071119-ia64/xen/arch/ia64/xen/ivt.S
===================================================================
--- 20071119-ia64.orig/xen/arch/ia64/xen/ivt.S	2007-11-25 21:18:46.000000000 -0700
+++ 20071119-ia64/xen/arch/ia64/xen/ivt.S	2007-11-25 21:25:32.000000000 -0700
@@ -229,8 +229,69 @@
 	/* If address belongs to VMM, go to alt tlb handler */
 	cmp.eq p6,p0=0x1e,r17
 (p6)	br.cond.spnt	late_alt_dtlb_miss
-	br.cond.sptk fast_tlb_miss_reflect
+
+	// XXX: Does a cached EFI memory fault ever get here?
+	//      I've never seen one
+	extr.u r22=r16,59,5
+	mov r25=XEN_EFI_RID
+	;;
+	cmp.eq p8,p0=0x18,r22		// address == 0xc...
+	mov r23=6
+	;;
+	cmp.eq.or p8,p0=0x1c,r22	// address == 0xe...
+	mov r23=rr[r23]
+	;;
+	cmp.eq.and p8,p0=r25,r23	// rr[6] == XEN_EFI_RID
+	;;
+(p8)	br.cond.spnt next
+	br.cond.spnt fast_tlb_miss_reflect
+	;;
+
+next:
+	mov r21=cr.ipsr
+	;;
+	extr.u r23=r21,IA64_PSR_CPL0_BIT,2      // extract psr.cpl
+	;;
+	cmp.ne p8,p0=r0,r23     // psr.cpl != 0
+	;;
+(p8)	br.cond.sptk fast_tlb_miss_reflect
+	;;
+
+	// EFI PAGE size is IA64_GRANULE_SIZE
+	// itir's key should be 0, as should the reserved space
+	// thus we can just set itir = (IA64_GRANULE_SHIFT << 2)
+	movl r20=IA64_GRANULE_SHIFT
+	;;
+	shl r20=r20,2
+	;;
+	mov cr.itir=r20
 	;;
+
+	cmp.eq p6,p0=0x18,r22   // address == 0xe...
+	cmp.eq p7,p0=0x1c,r22   // address == 0xf...
+	movl r17=PAGE_KERNEL
+	;;
+(p6)	movl r17=(__DIRTY_BITS | _PAGE_AR_RWX | _PAGE_PL_PRIV | _PAGE_MA_UC)
+(p7)	movl r17=(__DIRTY_BITS | _PAGE_AR_RWX)
+	movl r19=(((1 << IA64_MAX_PHYS_BITS) - 1) & ~0xfff)
+	;;
+	and r19=r19,r16         // clear ed, reserved bits, and PTE ctrl bits
+  	;;
+	or r19=r17,r19          // insert PTE control bits into r19
+	;;
+
+	cmp.eq p8,p0=0x18,r22	// Region 6 is UC for EFI
+	;;
+(p8)	dep r19=-1,r19,4,1	// set bit 4 (uncached) if access to UC area
+	;;
+
+	itc.d r19		// insert the TLB entry
+	mov pr=r31,-1
+	rfi
+	//;;
+	//
+	//br.cond.sptk fast_tlb_miss_reflect
+	//;;
 END(dtlb_miss)
 
 	.org ia64_ivt+0x0c00