And for reference purposes here is dmesg from a 2.6.29-rc4 kernel when 
max_pfn = very end of e820 (all mapping types) and we dont call efi_ioremap.
Without setting max_pfn = end e820 (all mapping types) efi_ioremap is 
called, returning early with NULL.

I will try and gather a bit more from the working kernel, specifically 
what ranges efi_ioremap is being passed when things work properly.

Brian