port-xen/50446: dom0 kernel panics at boot attaching agp

[gson%gson.org@localhost (Andreas Gustafsson)]

>Number:         50446
>Category:       port-xen
>Synopsis:       dom0 kernel panics at boot attaching agp
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    port-xen-maintainer
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Nov 19 06:15:01 +0000 2015
>Originator:     Andreas Gustafsson
>Release:        NetBSD 7.0 + fix for PR 50060
>Organization:

>Environment:
System: NetBSD
Architecture: x86_64
Machine: amd64
>Description:

I'm trying to test NetBSD 7.0/Xen on a PC with a ASUS P5B-V
motherboard.  Since this machine is affected by PR 50060,
I have applied the fix for that bug to the 7.0 sources:

   cvs rdiff -u -r1.118 -r1.119 src/sys/dev/pci/agp_i810.c

With that patch, the machine sucessfully boots a non-Xen kernel.
However, attempting to boot a dom0 kernel under Xen 4.2.5 results
in a panic:

   pchb0 at pci0 dev 0 function 0: vendor 0x8086 product 0x29a0 (rev. 0x02)
   agp0 at pchb0: i965-family chipset
   xpq_flush_queue: 1 entries (0 successful) on cpu0 (0)
   cpu0 (0):
     0x000000009d5a2c78: 0x8000000000100017
    kpm_pdir[0]: 0xab009027
   panic: HYPERVISOR_mmu_update failed, ret: -16

   fatal breakpoint trap in supervisor mode
   trap type 1 code 0 rip ffffffff80206395 cs e030 rflags 246 cr2 0 ilevel 8 rsp ffffffff81003700
   curlwp 0xffffffff80c609e0 pid 0.1 lowest kstack 0xffffffff810012c0
   Stopped in pid 0.1 (system) at  netbsd:breakpoint+0x5:  leave
   breakpoint() at netbsd:breakpoint+0x5
   vpanic() at netbsd:vpanic+0x13c
   snprintf() at netbsd:snprintf
   xpq_queue_machphys_update() at netbsd:xpq_queue_machphys_update
   pmap_kenter_ma() at netbsd:pmap_kenter_ma+0xbe
   x86_mem_add_mapping() at netbsd:x86_mem_add_mapping+0xcb
   bus_space_alloc() at netbsd:bus_space_alloc+0x57
   agp_i810_attach() at netbsd:agp_i810_attach+0x7bb
   agpattach() at netbsd:agpattach+0xda
   config_attach_loc() at netbsd:config_attach_loc+0x16e
   pchbattach() at netbsd:pchbattach+0x119
   config_attach_loc() at netbsd:config_attach_loc+0x16e
   pci_probe_device() at netbsd:pci_probe_device+0x4ac
   pci_enumerate_bus() at netbsd:pci_enumerate_bus+0x168
   pcirescan() at netbsd:pcirescan+0x1c
   pciattach() at netbsd:pciattach+0x193
   config_attach_loc() at netbsd:config_attach_loc+0x16e
   mp_pci_scan() at netbsd:mp_pci_scan+0xa4
   hypervisor_attach() at netbsd:hypervisor_attach+0x186
   config_attach_loc() at netbsd:config_attach_loc+0x16e
   mainbus_attach() at netbsd:mainbus_attach+0xbf
   config_attach_loc() at netbsd:config_attach_loc+0x16e
   cpu_configure() at netbsd:cpu_configure+0x21
   main() at netbsd:main+0x2a3
   ds          36c8
   es          3710
   fs          8
   gs          a8ed
   rdi         8
   rsi         1
   rbp         ffffffff81003700
   rbx         104
   rdx         0
   rcx         0
   rax         1
   r8          ffffffff810036b0
   r9          0
   r10         7ff0
   r11         73
   r12         ffffffff80adb7e0
   r13         ffffffff81003738
   r14         ffffffff80d14530    xpq_queue_array+0x10
   r15         ffffa0000c18f000
   rip         ffffffff80206395    breakpoint+0x5
   cs          e030
   rflags      246
   rsp         ffffffff81003700
   ss          e02b
   netbsd:breakpoint+0x5:  leave
   db> 

I have scripts for reproducing this in an automated way,
so I can test patches easily.

>How-To-Repeat:

>Fix: