Index: trunk/src/VBox/Runtime/r0drv/nt/initterm-r0drv-nt.cpp
===================================================================
--- trunk/src/VBox/Runtime/r0drv/nt/initterm-r0drv-nt.cpp	(revision 23376)
+++ trunk/src/VBox/Runtime/r0drv/nt/initterm-r0drv-nt.cpp	(revision 23412)
@@ -57,4 +57,8 @@
 /** KeFlushQueuedDpcs, introduced in XP. */
 PFNMYKEFLUSHQUEUEDDPCS      g_pfnrtNtKeFlushQueuedDpcs;
+/** HalRequestIpi, introduced in ??. */
+PFNHALREQUESTIPI            g_pfnrtNtHalRequestIpi;
+/** SendIpi handler based on Windows version */
+PFNRTSENDIPI                g_pfnrtSendIpi;
 
 /** Offset of the _KPRCB::QuantumEnd field. 0 if not found. */
@@ -83,4 +87,5 @@
     g_pfnrtNtExSetTimerResolution = NULL;
     g_pfnrtNtKeFlushQueuedDpcs = NULL;
+    g_pfnrtNtHalRequestIpi = NULL;
 #else
     /*
@@ -93,4 +98,7 @@
     RtlInitUnicodeString(&RoutineName, L"KeFlushQueuedDpcs");
     g_pfnrtNtKeFlushQueuedDpcs = (PFNMYKEFLUSHQUEUEDDPCS)MmGetSystemRoutineAddress(&RoutineName);
+
+    RtlInitUnicodeString(&RoutineName, L"HalRequestIpi");
+    g_pfnrtNtHalRequestIpi = (PFNHALREQUESTIPI)MmGetSystemRoutineAddress(&RoutineName);
 #endif
 
@@ -103,4 +111,23 @@
     BOOLEAN fChecked = PsGetVersion(&MajorVersion, &MinorVersion, &BuildNumber, NULL);
 
+    g_pfnrtSendIpi = rtMpSendIpiDummy;
+#ifndef IPRT_TARGET_NT4
+    if (g_pfnrtNtHalRequestIpi)
+    {
+        if (    MajorVersion == 6
+            &&  MinorVersion == 0)
+        {
+            /* Vista or Windows Server 2008 */
+            g_pfnrtSendIpi = rtMpSendIpiVista;
+        }
+        else
+        if (    MajorVersion == 6
+            &&  MinorVersion == 1)
+        {
+            /* Windows 7 or Windows Server 2008 R2 */
+            g_pfnrtSendIpi = rtMpSendIpiWin7;
+        }
+    }
+#endif
     KIRQL OldIrql;
     KeRaiseIrql(DISPATCH_LEVEL, &OldIrql); /* make sure we stay on the same cpu */
Index: trunk/src/VBox/Runtime/r0drv/nt/internal-r0drv-nt.h
===================================================================
--- trunk/src/VBox/Runtime/r0drv/nt/internal-r0drv-nt.h	(revision 23376)
+++ trunk/src/VBox/Runtime/r0drv/nt/internal-r0drv-nt.h	(revision 23412)
@@ -41,4 +41,6 @@
 typedef ULONG (__stdcall *PFNMYEXSETTIMERRESOLUTION)(ULONG, BOOLEAN);
 typedef VOID (__stdcall *PFNMYKEFLUSHQUEUEDDPCS)(VOID);
+typedef VOID (__stdcall *PFNHALREQUESTIPI)(KAFFINITY TargetSet);
+typedef int (__stdcall *PFNRTSENDIPI)(RTCPUID idCpu);
 
 
@@ -49,8 +51,14 @@
 extern PFNMYEXSETTIMERRESOLUTION    g_pfnrtNtExSetTimerResolution;
 extern PFNMYKEFLUSHQUEUEDDPCS       g_pfnrtNtKeFlushQueuedDpcs;
+extern PFNHALREQUESTIPI             g_pfnrtNtHalRequestIpi;
+extern PFNRTSENDIPI                 g_pfnrtSendIpi;
 extern uint32_t                     g_offrtNtPbQuantumEnd;
 extern uint32_t                     g_cbrtNtPbQuantumEnd;
 extern uint32_t                     g_offrtNtPbDpcQueueDepth;
 
+
+int rtMpSendIpiVista(RTCPUID idCpu);
+int rtMpSendIpiWin7(RTCPUID idCpu);
+int rtMpSendIpiDummy(RTCPUID idCpu);
 
 RT_C_DECLS_END
Index: trunk/src/VBox/Runtime/r0drv/nt/mp-r0drv-nt.cpp
===================================================================
--- trunk/src/VBox/Runtime/r0drv/nt/mp-r0drv-nt.cpp	(revision 23376)
+++ trunk/src/VBox/Runtime/r0drv/nt/mp-r0drv-nt.cpp	(revision 23412)
@@ -348,6 +348,24 @@
 }
 
-
-extern "C" void HalRequestIpi(KAFFINITY TargetSet);
+#ifndef IPRT_TARGET_NT4
+int rtMpSendIpiVista(RTCPUID idCpu)
+{
+    g_pfnrtNtHalRequestIpi(1 << idCpu);
+    return VINF_SUCCESS;
+}
+
+int rtMpSendIpiWin7(RTCPUID idCpu)
+{
+    VOID (__stdcall *pfRequestIpi)(KAFFINITY Zero, KAFFINITY TargetSet) = (VOID (__stdcall *)(KAFFINITY, KAFFINITY))g_pfnrtNtHalRequestIpi;
+
+    pfRequestIpi(0, 1 << idCpu);
+    return VINF_SUCCESS;
+}
+#endif /* IPRT_TARGET_NT4 */
+
+int rtMpSendIpiDummy(RTCPUID idCpu)
+{
+    return VERR_NOT_IMPLEMENTED;
+}
 
 RTDECL(int) RTMpPokeCpu(RTCPUID idCpu)
@@ -358,8 +376,9 @@
               : VERR_CPU_OFFLINE;
 
-#if 0 /* experiment!! */
-    HalRequestIpi(1 << idCpu);
-    return VINF_SUCCESS;
-#else
+    int rc = g_pfnrtSendIpi(idCpu);
+    if (rc == VINF_SUCCESS)
+        return rc;
+
+    /* Fallback. */
     if (!fPokeDPCsInitialized)
     {
@@ -383,5 +402,5 @@
 
     /* Assuming here that high importance DPCs will be delivered immediately; or at least an IPI will be sent immediately.
-     * Todo: verify!
+     * @note: not true on at least Vista & Windows 7
      */
     BOOLEAN bRet = KeInsertQueueDpc(&aPokeDpcs[idCpu], 0, 0);
@@ -389,5 +408,4 @@
     KeLowerIrql(oldIrql);
     return (bRet == TRUE) ? VINF_SUCCESS : VERR_ACCESS_DENIED /* already queued */;
-#endif
 }
 
