Description of problem:
Using a Xen Dom0 on x86_64, and running an SMP HVM guest with RHEL-3 kernel-smp
results in a kernel panic in the guest OS:
 
Booting processor 1/1 eip 2000
Initializing CPU#1
------------[ cut here ]------------
kernel BUG at apic.c:298!
invalid operand: 0000
 
CPU:    1
EIP:    0060:[<c0404ac3>]    Not tainted
EFLAGS: 00010046

EIP is at setup_local_APIC [kernel] 0x53 (2.4.21-47.ELsmp/i686)
eax: 00000000   ebx: ffffffff   ecx: 00000100   edx: 00000000
esi: 000000ff   edi: 00000000   ebp: 00000000   esp: c2647f98
ds: 0068   es: 0068   ss: 0068
Process swapper (pid: 0, stackpage=c2647000)
Stack: 00000001 c03841f8 00000001 00000000 c0402bd1 00000018 00010800 00000000 
       00000000 00010800 c0402c5a c0129663 00000282 00000d6f ffffffff 00000d43 
       00000296 00000000 00000282 00000001 c0388e98 00000000 00000246 0000002a 
Call Trace:   [<c0129663>] call_console_drivers [kernel] 0x63 (0xc2647fc4)
[<c0129993>] printk [kernel] 0x153 (0xc2647ffc)

Code: 0f 0b 2a 01 cc be 2b c0 80 fa 02 74 27 fe ca b8 ff ff ff 0f

Kernel panic: Fatal exception
In idle task - not syncing
 


Version-Release number of selected component (if applicable):
xen-3.0.2-33

Guest: RHEL-3, Update 8 kernel-smp   (2.4.21-47ELsmp/i686)

How reproducible:
Always

Steps to Reproduce:
1. Create a RHEL-3 guest, with pae=1, apic=1, acpi=1 and vcpus=4
2. Boot the guest
3.
  
Actual results:
Kernel panic 

Expected results:
Boots normally

Additional info: