Some news. My host lpj (loops per jiffy) is, per dmesg,
<4>Calibrating delay using timer specific routine.. 3334.85 BogoMIPS (lpj=16674259)
So, the current point is: Booting 2.6.18 or up inside VMware (host: 2.6.18.6 32-bit Workstation 5.5.3-34685 linux rpm with update105) hangs the virtual machine twice for a few seconds, once during LPJ calculation and one during APIC timer setup. The time spent in this hang, or whatever it should be called, is only visible on the host (i.e. the user), the guest machine does not recognize it has hung, judging from the kernel softclock time ("time" parameter to the linux kernel).
Booting the virtual machine with an explicit boot parameter "lpj=16674259", no LPJ calculation is done, and hence, this part does not hang. However, when it tries to set up the APIC timer, it still hangs for a few seconds.
Passing "lpj=1667425" (i.e. roughtly a tenth of the host's real lpj, so it thinks there are 333 bogomips) makes the virtual machine stack fault and so on, well, here is the log as captured with console=ttyS0:
[code]
[ 16.390559] Total of 1 processors activated (333.48 BogoMIPS).
[ 16.392283] ENABLING IO-APIC IRQs
[ 16.393534] ..TIMER: vector=0x31 apic1=0 pin1=2 apic2=-1 pin2=-1
[ 16.405615] ..MP-BIOS bug: 8254 timer not connected to IO-APIC
[ 16.405622] ...trying to set up timer (IRQ0) through the 8259A ... failed.
[ 16.405630] ...trying to set up timer as Virtual Wire IRQ... failed.
[ 16.415811] ...trying to set up timer as ExtINT IRQ...<6>spurious APIC interrupt on CPU#0, should never happen.
[ 16.418129] spurious APIC interrupt on CPU#0, should never happen.
[ 16.419710] spurious APIC interrupt on CPU#0, should never happen.
[ 16.420872] spurious APIC interrupt on CPU#0, should never happen.
[ 16.422204] spurious APIC interrupt on CPU#0, should never happen.
(lots more of these)
[ 16.507104] failed

.
[ 16.508024] Kernel panic - not syncing: IO-APIC + timer doesn't work! Boot with apic=debug and send a report. Then try booting with the 'noapic' option
[/code]
Booting with noapic works, but it's slow (hangs a while at LPJ calculation when not passing lpj= parameter). Somehow I come to the conclusion that the (virtual) hardware timer is fubared. I'd say it fires off to late.