This log extract is from the same hardware booting off the USB stick. This 
contains a lot of traceback, starting
======================================================
[ INFO: HARDIRQ-safe -> HARDIRQ-unsafe lock order detected ]
2.6.29-0.135.rc5.git3.fc10.i686.PAE #1
------------------------------------------------------
khubd/245 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire:
  (&retval->lock){......}, at: [<c04a5b9f>] dma_pool_alloc+0x1d/0x247

and this task is already holding:
  (&ehci->lock){-.....}, at: [<c0626797>] ehci_urb_enqueue+0xac/0xc6b
which would create a new lock dependency:
  (&ehci->lock){-.....} -> (&retval->lock){......}

but this new dependency connects a HARDIRQ-irq-safe lock:
  (&ehci->lock){-.....}
... which became HARDIRQ-irq-safe at:
   [<c0456ef2>] __lock_acquire+0x241/0xb1c
   [<c0457820>] lock_acquire+0x53/0x75
   [<c06fc2e3>] _spin_lock+0x1e/0x4e
   [<c0627fd6>] ehci_irq+0x21/0x193
   [<c0615829>] usb_hcd_irq+0x38/0x93
   [<c0477674>] handle_IRQ_event+0x1a/0x4b
   [<c0478890>] handle_level_irq+0x64/0xac
   [<ffffffff>] 0xffffffff

to a HARDIRQ-irq-unsafe lock:
  (purge_lock){+.+...}
... which became HARDIRQ-irq-unsafe at:
...  [<c0456f6f>] __lock_acquire+0x2be/0xb1c
   [<c0457820>] lock_acquire+0x53/0x75
   [<c06fc2e3>] _spin_lock+0x1e/0x4e
   [<c04a106d>] __purge_vmap_area_lazy+0x39/0x145
   [<c04a2362>] vm_unmap_aliases+0x150/0x159
   [<c04061e0>] xen_create_contiguous_region+0x4c/0xd8
   [<c056103d>] xen_swiotlb_fixup+0x6e/0x99
   [<c08f1c2d>] swiotlb_alloc_boot+0x2e/0x35
   [<c08fc3b2>] swiotlb_init_with_default_size+0x2f/0xdb
   [<c08fc46b>] swiotlb_init+0xd/0xf
   [<c08f1bf2>] pci_swiotlb_init+0x41/0x4e
   [<c08e53b8>] pci_iommu_alloc+0x8/0xa
   [<c08f283c>] mem_init+0xe/0x2b3
   [<c08db7ff>] start_kernel+0x26b/0x31a
   [<c08db096>] i386_start_kernel+0x85/0x8d
   [<c08e0e7a>] xen_start_kernel+0x4bc/0x4c4
   [<ffffffff>] 0xffffffff

the full crash is in the attached log (I didn't catch the entire log, so 
there is an earlier gap). Later there are further errors which eventually 
cause xen to give up.

BUG: unable to handle kernel NULL pointer dereference at 000000a8
IP: [<c0680000>] rtnetlink_net_exit+0x11/0x1e
*pdpt = 0000000004c33001 *pde = 0000000000000000
Oops: 0002 [#1] SMP
last sysfs file: /sys/devices/virtual/vtconsole/vtcon0/uevent
Modules linked in: pata_acpi ata_generic i915 drm i2c_algo_bit i2c_core

BUG: unable to handle kernel NULL pointer dereference at 00000005
IP: [<c065b8e5>] dmi_get_system_info+0x0/0xc
*pdpt = 0000000004c33001 *pde = 0000000000000000
Oops: 0002 [#2] SMP
last sysfs file: /sys/devices/virtual/vtconsole/vtcon0/uevent
Modules linked in: pata_acpi ata_generic i915 drm i2c_algo_bit i2c_core

BUG: unable to handle kernel NULL pointer dereference at 00000005
IP: [<c065b8e5>] dmi_get_system_info+0x0/0xc
*pdpt = 0000000004c33001 *pde = 0000000000000000
Oops: 0002 [#3] SMP
last sysfs file: /sys/devices/virtual/vtconsole/vtcon0/uevent
Modules linked in: pata_acpi ata_generic i915 drm i2c_algo_bit i2c_core

BUG: unable to handle kernel NULL pointer dereference at 00000005
IP: [<c065b8e5>] dmi_get_system_info+0x0/0xc
*pdpt = 0000000004c33001 *pde = 0000000000000000
Oops: 0002 [#4] SMP
last sysfs file: /sys/devices/virtual/vtconsole/vtcon0/uevent
Modules linked in: pata_acpi ata_generic i915 drm i2c_algo_bit i2c_core

BUG: unable to handle kernel NULL pointer dereference at 00000005
IP:(XEN) domain_crash_sync called from entry.S (ff1a2c9e)
(XEN) Domain 0 (vcpu#0) crashed on cpu#0:
(XEN) ----[ Xen-3.3.1  x86_32p  debug=n  Not tainted ]----
(XEN) CPU:    0
(XEN) EIP:    0061:[<c0545ef5>]
(XEN) EFLAGS: 00010206   EM: 1   CONTEXT: pv guest
(XEN) eax: da434171   ebx: da43415e   ecx: c07e154f   edx: 7fffffff
(XEN) esi: da434108   edi: c07cf380   ebp: da4340ec   esp: da433fcc
(XEN) cr0: 8005003b   cr4: 000006f0   cr3: 04c37000   cr2: da433fdc
(XEN) ds: 007b   es: 007b   fs: 00d8   gs: 0033   ss: 0069   cs: 0061
(XEN) Guest stack trace from esp=da433fcc:
(XEN)    00000000 00000000 00000000 00000000 00000000 00000000 00000000 
00000000(XEN)    00000000 00000000 00000000 00000000 00000000
(XEN) Domain 0 crashed: rebooting machine in 5 seconds.

 	Michael Young