Index: /trunk/src/VBox/Devices/PC/DevAPIC.cpp
===================================================================
--- /trunk/src/VBox/Devices/PC/DevAPIC.cpp	(revision 37452)
+++ /trunk/src/VBox/Devices/PC/DevAPIC.cpp	(revision 37453)
@@ -338,26 +338,5 @@
 *   Internal Functions                                                         *
 *******************************************************************************/
-RT_C_DECLS_BEGIN
-PDMBOTHCBDECL(int)  apicMMIORead(PPDMDEVINS pDevIns, void *pvUser, RTGCPHYS GCPhysAddr, void *pv, unsigned cb);
-PDMBOTHCBDECL(int)  apicMMIOWrite(PPDMDEVINS pDevIns, void *pvUser, RTGCPHYS GCPhysAddr, void *pv, unsigned cb);
-PDMBOTHCBDECL(int)  apicGetInterrupt(PPDMDEVINS pDevIns);
-PDMBOTHCBDECL(bool) apicHasPendingIrq(PPDMDEVINS pDevIns);
-PDMBOTHCBDECL(void) apicSetBase(PPDMDEVINS pDevIns, uint64_t val);
-PDMBOTHCBDECL(uint64_t) apicGetBase(PPDMDEVINS pDevIns);
-PDMBOTHCBDECL(void) apicSetTPR(PPDMDEVINS pDevIns, VMCPUID idCpu, uint8_t val);
-PDMBOTHCBDECL(uint8_t) apicGetTPR(PPDMDEVINS pDevIns, VMCPUID idCpu);
-PDMBOTHCBDECL(int)  apicBusDeliverCallback(PPDMDEVINS pDevIns, uint8_t u8Dest, uint8_t u8DestMode,
-                                           uint8_t u8DeliveryMode, uint8_t iVector, uint8_t u8Polarity,
-                                           uint8_t u8TriggerMode);
-PDMBOTHCBDECL(int)  apicLocalInterrupt(PPDMDEVINS pDevIns, uint8_t u8Pin, uint8_t u8Level);
-PDMBOTHCBDECL(int)  apicWriteMSR(PPDMDEVINS pDevIns, VMCPUID iCpu, uint32_t u32Reg, uint64_t u64Value);
-PDMBOTHCBDECL(int)  apicReadMSR(PPDMDEVINS pDevIns, VMCPUID iCpu, uint32_t u32Reg, uint64_t *pu64Value);
-PDMBOTHCBDECL(int)  ioapicMMIORead(PPDMDEVINS pDevIns, void *pvUser, RTGCPHYS GCPhysAddr, void *pv, unsigned cb);
-PDMBOTHCBDECL(int)  ioapicMMIOWrite(PPDMDEVINS pDevIns, void *pvUser, RTGCPHYS GCPhysAddr, void *pv, unsigned cb);
-PDMBOTHCBDECL(void) ioapicSetIrq(PPDMDEVINS pDevIns, int iIrq, int iLevel);
-PDMBOTHCBDECL(void) ioapicSendMsi(PPDMDEVINS pDevIns, RTGCPHYS GCAddr, uint32_t uValue);
-
 static void apic_update_tpr(APICDeviceInfo *dev, APICState* s, uint32_t val);
-RT_C_DECLS_END
 
 static void apic_eoi(APICDeviceInfo *dev, APICState* s); /*  */
@@ -720,7 +699,8 @@
         return VERR_EM_INTERPRETER;
 
-    uint32_t index = (u32Reg - MSR_IA32_APIC_START) & 0xff;
-    APICState* apic = getLapicById(dev, idCpu);
-    uint64_t val = 0;
+    uint32_t    index = (u32Reg - MSR_IA32_APIC_START) & 0xff;
+    APICState  *apic = getLapicById(dev, idCpu);
+    uint64_t    val = 0;
+    int         rc = VINF_SUCCESS;
 
     switch (index)
@@ -730,7 +710,7 @@
             break;
         case 0x03: /* version */
-            val =   APIC_HW_VERSION                                     |
-                    ((APIC_LVT_NB - 1) << 16) /* Max LVT index */       |
-                    (0 << 24) /* Support for EOI broadcast suppression */;
+            val = APIC_HW_VERSION
+                | ((APIC_LVT_NB - 1) << 16) /* Max LVT index */
+                | (0 << 24) /* Support for EOI broadcast suppression */;
             break;
         case 0x08:
@@ -756,5 +736,5 @@
         case 0x0f:
             val = apic->spurious_vec;
-        break;
+            break;
         case 0x10: case 0x11: case 0x12: case 0x13: case 0x14: case 0x15: case 0x16: case 0x17:
             val = apic->isr[index & 7];
@@ -804,5 +784,5 @@
     }
     *pu64Value = val;
-    return VINF_SUCCESS;
+    return rc;
 }
 
@@ -1220,8 +1200,16 @@
 }
 
+/**
+ * May return to ring-3 to acquire the TM and PDM lock.
+ */
 static uint32_t apic_get_current_count(APICDeviceInfo *dev, APICState *s)
 {
     int64_t d;
     uint32_t val;
+
+    /* Acquire the timer lock w/ lock order kludge. */
+    PDMCritSectLeave(dev->CTX_SUFF(pCritSect));
+    TMTimerLock(s->CTX_SUFF(pTimer), VINF_SUCCESS);
+    PDMCritSectEnter(dev->CTX_SUFF(pCritSect), VINF_SUCCESS);
 
     d = (TMTimerGet(s->CTX_SUFF(pTimer)) - s->initial_count_load_time) >>
@@ -1237,4 +1225,7 @@
             val = s->initial_count - d;
     }
+
+    TMTimerUnlock(s->CTX_SUFF(pTimer));
+
     return val;
 }
@@ -1325,4 +1316,9 @@
 {
     STAM_COUNTER_INC(&pThis->StatTimerSetLvt);
+
+    /* Acquire the timer lock w/ lock order kludge. */
+    PDMCritSectLeave(dev->CTX_SUFF(pCritSect));
+    TMTimerLock(pThis->CTX_SUFF(pTimer), VINF_SUCCESS);
+    PDMCritSectEnter(dev->CTX_SUFF(pCritSect), VINF_SUCCESS);
 
     /*
@@ -1411,4 +1407,6 @@
     else
         STAM_COUNTER_INC(&pThis->StatTimerSetLvtNoRelevantChange);
+
+    TMTimerUnlock(pThis->CTX_SUFF(pTimer));
 }
 
@@ -1428,4 +1426,5 @@
     Assert(pThis->fTimerArmed);
     Assert(PDMCritSectIsOwned(dev->pCritSectR3));
+    Assert(TMTimerIsLockOwner(pTimer));
 
     if (!(pThis->lvt[APIC_LVT_TIMER] & APIC_LVT_MASKED)) {
@@ -2378,5 +2377,9 @@
     pThis->enmVersion = PDMAPICVERSION_APIC;
 
+    /* Disable locking in this device. */
+    pDevIns->pCritSectR3 = PDMDevHlpCritSectGetNop(pDevIns);
+
     PVM pVM = PDMDevHlpGetVM(pDevIns);
+
     /*
      * We are not freeing this memory, as it's automatically released when guest exits.
