Index: /trunk/include/VBox/VBoxVideo.h
===================================================================
--- /trunk/include/VBox/VBoxVideo.h	(revision 50858)
+++ /trunk/include/VBox/VBoxVideo.h	(revision 50859)
@@ -1781,4 +1781,22 @@
 } VBOXCMDVBVA_3DCTL_CMD;
 
+typedef struct VBOXCMDVBVA_CTL_3DCTL_CMD
+{
+    VBOXCMDVBVA_CTL Hdr;
+    VBOXCMDVBVA_3DCTL_CMD Cmd;
+} VBOXCMDVBVA_CTL_3DCTL_CMD;
+
+typedef struct VBOXCMDVBVA_CTL_3DCTL_CONNECT
+{
+    VBOXCMDVBVA_CTL Hdr;
+    VBOXCMDVBVA_3DCTL_CONNECT Connect;
+} VBOXCMDVBVA_CTL_3DCTL_CONNECT;
+
+typedef struct VBOXCMDVBVA_CTL_3DCTL
+{
+    VBOXCMDVBVA_CTL Hdr;
+    VBOXCMDVBVA_3DCTL Ctl;
+} VBOXCMDVBVA_CTL_3DCTL;
+
 #pragma pack()
 
Index: /trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPCr.cpp
===================================================================
--- /trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPCr.cpp	(revision 50858)
+++ /trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPCr.cpp	(revision 50859)
@@ -222,4 +222,13 @@
     CRVBOXHGSMIWRITE Cmd;
 } VBOXMP_CRHGSMICMD_WRITE, *PVBOXMP_CRHGSMICMD_WRITE;
+
+
+#define VBOXMP_CRSHGSMICON_CMD_CMDBUF_OFFSET(_cBuffers) VBOXWDDM_ROUNDBOUND(RT_OFFSETOF(VBOXVDMACMD_CHROMIUM_CMD, aBuffers[_cBuffers]), 8)
+#define VBOXMP_CRSHGSMICON_CMD_CMDCTX_OFFSET(_cBuffers, _cbCmdBuf) ( VBOXMP_CRSHGSMICON_CMD_CMDBUF_OFFSET(_cBuffers) + VBOXWDDM_ROUNDBOUND(_cbCmdBuf, 8))
+#define VBOXMP_CRSHGSMICON_CMD_GET_CMDBUF(_pCmd, _cBuffers, _type) ((_type*)(((uint8_t*)(_pCmd)) + VBOXMP_CRSHGSMICON_CMD_CMDBUF_OFFSET(_cBuffers)))
+#define VBOXMP_CRSHGSMICON_CMD_GET_CMDCTX(_pCmd, _cBuffers, _cbCmdBuf, _type) ((_type*)(((uint8_t*)(_pCmd)) +  VBOXMP_CRSHGSMICON_CMD_CMDCTX_OFFSET(_cBuffers, _cbCmdBuf)))
+#define VBOXMP_CRSHGSMICON_CMD_GET_FROM_CMDCTX(_pCtx, _cBuffers, _cbCmdBuf, _type) ((_type*)(((uint8_t*)(_pCtx)) -  VBOXMP_CRSHGSMICON_CMD_CMDCTX_OFFSET(_cBuffers, _cbCmdBuf)))
+#define VBOXMP_CRSHGSMICON_CMD_SIZE(_cBuffers, _cbCmdBuf, _cbCtx) (VBOXMP_CRSHGSMICON_CMD_CMDCTX_OFFSET(_cBuffers, _cbCmdBuf) + (_cbCtx))
+
 
 #define VBOXMP_CRSHGSMICON_DR_CMDBUF_OFFSET(_cBuffers) VBOXWDDM_ROUNDBOUND((VBOXVDMACMD_SIZE_FROMBODYSIZE(RT_OFFSETOF(VBOXVDMACMD_CHROMIUM_CMD, aBuffers[_cBuffers]))), 8)
@@ -467,5 +476,5 @@
 }
 
-static DECLCALLBACK(VOID) vboxMpCrShgsmiTransportSendWriteAsyncCompletion(PVBOXMP_DEVEXT pDevExt, PVBOXVDMADDI_CMD pDdiCmd, PVOID pvContext)
+static DECLCALLBACK(VOID) vboxMpCrShgsmiTransportVdmaSendWriteAsyncCompletion(PVBOXMP_DEVEXT pDevExt, PVBOXVDMADDI_CMD pDdiCmd, PVOID pvContext)
 {
     /* we should be called from our DPC routine */
@@ -505,4 +514,26 @@
 }
 
+static DECLCALLBACK(VOID) vboxMpCrShgsmiTransportVbvaSendWriteAsyncCompletion(PVBOXSHGSMI pHeap, void *pvCmd, void *pvContext)
+{
+    /* we should be called from our DPC routine */
+    Assert(KeGetCurrentIrql() == DISPATCH_LEVEL);
+
+    PVBOXMP_CRSHGSMITRANSPORT pCon;
+    PVBOXMP_DEVEXT pDevExt = pCon->pDevExt;
+    VBOXCMDVBVA_CRCMD_CMD *pCmd;
+    int rc = VBoxCmdVbvaConCmdCompletionData(pvCmd, &pCmd);
+    const UINT cBuffers = 2;
+    Assert(pCmd->cBuffers == cBuffers);
+    PVBOXMP_CRHGSMICMD_WRITE pWrData = VBOXMP_CRSHGSMICON_CMD_GET_CMDBUF(pCmd, cBuffers, VBOXMP_CRHGSMICMD_WRITE);
+    uint64_t *pu64Completion = (uint64_t*)(pWrData + 1);
+    PFNVBOXMP_CRSHGSMITRANSPORT_SENDWRITEASYNC_COMPLETION pfnCompletion = (PFNVBOXMP_CRSHGSMITRANSPORT_SENDWRITEASYNC_COMPLETION)(*pu64Completion);
+
+    if (!RT_SUCCESS(rc))
+        WARN(("CRVBOXHGSMIWRITE failed, rc %d", rc));
+
+    if (pfnCompletion)
+        pfnCompletion(pCon, rc, (void*)(pu64Completion+1));
+}
+
 void* VBoxMpCrShgsmiTransportCmdCreateWriteReadAsync(PVBOXMP_CRSHGSMITRANSPORT pCon, uint32_t u32ClientID, void *pvBuffer, uint32_t cbBuffer,
         PFNVBOXMP_CRSHGSMITRANSPORT_SENDWRITEREADASYNC_COMPLETION pfnCompletion, uint32_t cbContextData)
@@ -571,10 +602,44 @@
 }
 
-void* VBoxMpCrShgsmiTransportCmdCreateWriteAsync(PVBOXMP_CRSHGSMITRANSPORT pCon, uint32_t u32ClientID, void *pvBuffer, uint32_t cbBuffer,
+static void * vboxMpCrShgsmiTransportCmdVbvaCreateWriteAsync(PVBOXMP_DEVEXT pDevExt, uint32_t u32ClientID, void *pvBuffer, uint32_t cbBuffer, PFNVBOXMP_CRSHGSMITRANSPORT_SENDWRITEASYNC_COMPLETION pfnCompletion, uint32_t cbContextData)
+{
+    const uint32_t cBuffers = 2;
+    const uint32_t cbCmd = VBOXMP_CRSHGSMICON_CMD_SIZE(cBuffers, sizeof (VBOXMP_CRHGSMICMD_WRITE) + 8, cbContextData);
+    VBOXCMDVBVA_CRCMD_CMD* pCmd = VBoxCmdVbvaConCmdAlloc(pDevExt, cbCmd);
+    if (!pCmd)
+    {
+        WARN(("VBoxCmdVbvaConCmdAlloc failed"));
+        return NULL;
+    }
+
+    pCmd->cBuffers = cBuffers;
+
+    PVBOXMP_CRHGSMICMD_WRITE pWrData = VBOXMP_CRSHGSMICON_CMD_GET_CMDBUF(pCmd, cBuffers, VBOXMP_CRHGSMICMD_WRITE);
+    CRVBOXHGSMIWRITE *pCmdWrite = &pWrData->Cmd;
+
+    pCmdWrite->hdr.result      = VERR_WRONG_ORDER;
+    pCmdWrite->hdr.u32ClientID = u32ClientID;
+    pCmdWrite->hdr.u32Function = SHCRGL_GUEST_FN_WRITE;
+    //    pCmdWrite->hdr.u32Reserved = 0;
+    pCmdWrite->iBuffer = 1;
+
+    VBOXCMDVBVA_CRCMD_BUFFER *pBufCmd = &pCmd->aBuffers[0];
+    pBufCmd->offBuffer = (VBOXCMDVBVAOFFSET)vboxMpCrShgsmiBufferOffset(pDevExt, pCmdWrite);
+    pBufCmd->cbBuffer = sizeof (*pCmdWrite);
+
+    pBufCmd = &pCmd->aBuffers[1];
+    pBufCmd->offBuffer = (VBOXCMDVBVAOFFSET)vboxMpCrShgsmiBufferOffset(pDevExt, pvBuffer);
+    pBufCmd->cbBuffer = cbBuffer;
+
+    uint64_t*pu64Completion = VBOXMP_CRSHGSMICON_CMD_GET_CMDCTX(pCmd, cBuffers, sizeof (VBOXMP_CRHGSMICMD_WRITE), uint64_t);
+    *pu64Completion = (uint64_t)pfnCompletion;
+    return (void*)(pu64Completion+1);
+}
+
+void* vboxMpCrShgsmiTransportCmdVdmaCreateWriteAsync(PVBOXMP_DEVEXT pDevExt, uint32_t u32ClientID, void *pvBuffer, uint32_t cbBuffer,
         PFNVBOXMP_CRSHGSMITRANSPORT_SENDWRITEASYNC_COMPLETION pfnCompletion, uint32_t cbContextData)
 {
     const uint32_t cBuffers = 2;
     const uint32_t cbCmd = VBOXMP_CRSHGSMICON_DR_SIZE(cBuffers, sizeof (VBOXMP_CRHGSMICMD_WRITE), cbContextData);
-    PVBOXMP_DEVEXT pDevExt = pCon->pDevExt;
     PVBOXVDMACBUF_DR pDr = vboxVdmaCBufDrCreate(&pDevExt->u.primary.Vdma, cbCmd);
     if (!pDr)
@@ -612,5 +677,5 @@
 
     pBufCmd = &pBody->aBuffers[1];
-    pBufCmd->offBuffer = vboxMpCrShgsmiTransportBufOffset(pCon, pvBuffer);
+    pBufCmd->offBuffer = vboxMpCrShgsmiBufferOffset(pDevExt, pvBuffer);
     pBufCmd->cbBuffer = cbBuffer;
     pBufCmd->u32GuestData = 0;
@@ -620,4 +685,13 @@
 }
 
+void* VBoxMpCrShgsmiTransportCmdCreateWriteAsync(PVBOXMP_CRSHGSMITRANSPORT pCon, uint32_t u32ClientID, void *pvBuffer, uint32_t cbBuffer,
+        PFNVBOXMP_CRSHGSMITRANSPORT_SENDWRITEASYNC_COMPLETION pfnCompletion, uint32_t cbContextData)
+{
+    PVBOXMP_DEVEXT pDevExt = pCon->pDevExt;
+    if (pDevExt->fCmdVbvaEnabled)
+        return vboxMpCrShgsmiTransportCmdVbvaCreateWriteAsync(pDevExt, u32ClientID, pvBuffer, cbBuffer, pfnCompletion, cbContextData);
+    return vboxMpCrShgsmiTransportCmdVdmaCreateWriteAsync(pDevExt, u32ClientID, pvBuffer, cbBuffer, pfnCompletion, cbContextData);
+}
+
 int VBoxMpCrShgsmiTransportCmdSubmitWriteReadAsync(PVBOXMP_CRSHGSMITRANSPORT pCon, void *pvContext)
 {
@@ -626,8 +700,22 @@
 }
 
+static int vboxMpCrShgsmiTransportCmdVdmaSubmitWriteAsync(PVBOXMP_CRSHGSMITRANSPORT pCon, void *pvContext)
+{
+    VBOXVDMACMD* pHdr = VBOXMP_CRSHGSMICON_DR_GET_FROM_CMDCTX(pvContext, 2, sizeof (VBOXMP_CRHGSMICMD_WRITE));
+    return vboxMpCrShgsmiTransportCmdSubmitDmaCmd(pCon, pHdr, vboxMpCrShgsmiTransportVdmaSendWriteAsyncCompletion);
+}
+
+static int vboxMpCrShgsmiTransportCmdVbvaSubmitWriteAsync(PVBOXMP_CRSHGSMITRANSPORT pCon, void *pvContext)
+{
+    PVBOXMP_DEVEXT pDevExt = pCon->pDevExt;
+    VBOXCMDVBVA_CRCMD_CMD* pCmd = VBOXMP_CRSHGSMICON_CMD_GET_FROM_CMDCTX(pvContext, 2, sizeof (VBOXMP_CRHGSMICMD_WRITE) + 8, VBOXCMDVBVA_CRCMD_CMD);
+    return VBoxCmdVbvaConCmdSubmitAsync(pDevExt, pCmd, vboxMpCrShgsmiTransportVbvaSendWriteAsyncCompletion, pCon);
+}
+
 int VBoxMpCrShgsmiTransportCmdSubmitWriteAsync(PVBOXMP_CRSHGSMITRANSPORT pCon, void *pvContext)
 {
-    VBOXVDMACMD* pHdr = VBOXMP_CRSHGSMICON_DR_GET_FROM_CMDCTX(pvContext, 2, sizeof (VBOXMP_CRHGSMICMD_WRITE));
-    return vboxMpCrShgsmiTransportCmdSubmitDmaCmd(pCon, pHdr, vboxMpCrShgsmiTransportSendWriteAsyncCompletion);
+    if (pCon->pDevExt->fCmdVbvaEnabled)
+        return vboxMpCrShgsmiTransportCmdVbvaSubmitWriteAsync(pCon, pvContext);
+    return vboxMpCrShgsmiTransportCmdVdmaSubmitWriteAsync(pCon, pvContext);
 }
 
@@ -638,8 +726,22 @@
 }
 
-void VBoxMpCrShgsmiTransportCmdTermWriteAsync(PVBOXMP_CRSHGSMITRANSPORT pCon, void *pvContext)
+static void vboxMpCrShgsmiTransportCmdVbvaTermWriteAsync(PVBOXMP_CRSHGSMITRANSPORT pCon, void *pvContext)
+{
+    VBOXCMDVBVA_CRCMD_CMD* pCmd = VBOXMP_CRSHGSMICON_CMD_GET_FROM_CMDCTX(pvContext, 2, sizeof (VBOXMP_CRHGSMICMD_WRITE) + 8, VBOXCMDVBVA_CRCMD_CMD);
+    VBoxCmdVbvaConCmdFree(pCon->pDevExt, pCmd);
+}
+
+static void vboxMpCrShgsmiTransportCmdVdmaTermWriteAsync(PVBOXMP_CRSHGSMITRANSPORT pCon, void *pvContext)
 {
     VBOXVDMACMD* pHdr = VBOXMP_CRSHGSMICON_DR_GET_FROM_CMDCTX(pvContext, 2, sizeof (VBOXMP_CRHGSMICMD_WRITE));
     vboxMpCrShgsmiTransportCmdTermDmaCmd(pCon, pHdr);
+}
+
+void VBoxMpCrShgsmiTransportCmdTermWriteAsync(PVBOXMP_CRSHGSMITRANSPORT pCon, void *pvContext)
+{
+    if (pCon->pDevExt->fCmdVbvaEnabled)
+        vboxMpCrShgsmiTransportCmdVbvaTermWriteAsync(pCon, pvContext);
+    else
+        vboxMpCrShgsmiTransportCmdVdmaTermWriteAsync(pCon, pvContext);
 }
 
@@ -778,5 +880,5 @@
 }
 
-int VBoxMpCrCtlConConnect(PVBOXMP_CRCTLCON pCrCtlCon,
+int VBoxMpCrCtlConConnectHgcm(PVBOXMP_CRCTLCON pCrCtlCon,
         uint32_t crVersionMajor, uint32_t crVersionMinor,
         uint32_t *pu32ClientID)
@@ -825,5 +927,36 @@
 }
 
-int VBoxMpCrCtlConDisconnect(PVBOXMP_CRCTLCON pCrCtlCon, uint32_t u32ClientID)
+int VBoxMpCrCtlConConnectVbva(PVBOXMP_DEVEXT pDevExt, PVBOXMP_CRCTLCON pCrCtlCon,
+        uint32_t crVersionMajor, uint32_t crVersionMinor,
+        uint32_t *pu32ClientID)
+{
+    if (pCrCtlCon->hCrCtl)
+    {
+        WARN(("pCrCtlCon is HGCM connection"));
+        return VERR_INVALID_STATE;
+    }
+
+    Assert(!pCrCtlCon->cCrCtlRefs);
+    return VBoxCmdVbvaConConnect(pDevExt, &pDevExt->CmdVbva,
+            crVersionMajor, crVersionMinor,
+            pu32ClientID);
+}
+
+int VBoxMpCrCtlConConnect(PVBOXMP_DEVEXT pDevExt, PVBOXMP_CRCTLCON pCrCtlCon,
+        uint32_t crVersionMajor, uint32_t crVersionMinor,
+        uint32_t *pu32ClientID)
+{
+    if (pDevExt->fCmdVbvaEnabled)
+    {
+        return VBoxMpCrCtlConConnectVbva(pDevExt, pCrCtlCon,
+                crVersionMajor, crVersionMinor,
+                pu32ClientID);
+    }
+    return VBoxMpCrCtlConConnectHgcm(pCrCtlCon,
+            crVersionMajor, crVersionMinor,
+            pu32ClientID);
+}
+
+int VBoxMpCrCtlConDisconnectHgcm(PVBOXMP_CRCTLCON pCrCtlCon, uint32_t u32ClientID)
 {
     int rc = vboxCrCtlConDisconnect(pCrCtlCon->hCrCtl, u32ClientID);
@@ -838,4 +971,18 @@
     }
     return rc;
+}
+
+int VBoxMpCrCtlConDisconnectVbva(PVBOXMP_DEVEXT pDevExt, PVBOXMP_CRCTLCON pCrCtlCon, uint32_t u32ClientID)
+{
+    Assert(!pCrCtlCon->hCrCtl);
+    Assert(!pCrCtlCon->cCrCtlRefs);
+    return VBoxCmdVbvaConDisconnect(pDevExt, &pDevExt->CmdVbva, u32ClientID);
+}
+
+int VBoxMpCrCtlConDisconnect(PVBOXMP_DEVEXT pDevExt, PVBOXMP_CRCTLCON pCrCtlCon, uint32_t u32ClientID)
+{
+    if (!pCrCtlCon->hCrCtl)
+        return VBoxMpCrCtlConDisconnectVbva(pDevExt, pCrCtlCon, u32ClientID);
+    return VBoxMpCrCtlConDisconnectHgcm(pCrCtlCon, u32ClientID);
 }
 
@@ -868,8 +1015,8 @@
     VBOXMP_CRCTLCON CrCtlCon = {0};
     uint32_t u32ClientID = 0;
-    int rc = VBoxMpCrCtlConConnect(&CrCtlCon, CR_PROTOCOL_VERSION_MAJOR, CR_PROTOCOL_VERSION_MINOR, &u32ClientID);
+    int rc = VBoxMpCrCtlConConnectHgcm(&CrCtlCon, CR_PROTOCOL_VERSION_MAJOR, CR_PROTOCOL_VERSION_MINOR, &u32ClientID);
     if (RT_FAILURE(rc))
     {
-        LOGREL(("VBoxMpCrCtlConConnect failed with rc(%d), 3D not supported!"));
+        LOGREL(("VBoxMpCrCtlConConnectHgcm failed with rc(%d), 3D not supported!"));
         return;
     }
@@ -888,7 +1035,7 @@
 #endif
 
-    rc = VBoxMpCrCtlConDisconnect(&CrCtlCon, u32ClientID);
+    rc = VBoxMpCrCtlConDisconnectHgcm(&CrCtlCon, u32ClientID);
     if (RT_FAILURE(rc))
-        WARN(("VBoxMpCrCtlConDisconnect failed rc (%d), ignoring..", rc));
+        WARN(("VBoxMpCrCtlConDisconnectHgcm failed rc (%d), ignoring..", rc));
 #endif
 }
Index: /trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPCr.h
===================================================================
--- /trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPCr.h	(revision 50858)
+++ /trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPCr.h	(revision 50859)
@@ -32,45 +32,12 @@
 bool VBoxMpCrCtlConIs3DSupported();
 
-int VBoxMpCrCtlConConnect(PVBOXMP_CRCTLCON pCrCtlCon,
+int VBoxMpCrCtlConConnect(PVBOXMP_DEVEXT pDevExt, PVBOXMP_CRCTLCON pCrCtlCon,
         uint32_t crVersionMajor, uint32_t crVersionMinor,
         uint32_t *pu32ClientID);
-int VBoxMpCrCtlConDisconnect(PVBOXMP_CRCTLCON pCrCtlCon, uint32_t u32ClientID);
+int VBoxMpCrCtlConDisconnect(PVBOXMP_DEVEXT pDevExt, PVBOXMP_CRCTLCON pCrCtlCon, uint32_t u32ClientID);
 int VBoxMpCrCtlConCall(PVBOXMP_CRCTLCON pCrCtlCon, struct VBoxGuestHGCMCallInfo *pData, uint32_t cbData);
 int VBoxMpCrCtlConCallUserData(PVBOXMP_CRCTLCON pCrCtlCon, struct VBoxGuestHGCMCallInfo *pData, uint32_t cbData);
 
 # include <cr_pack.h>
-
-typedef struct VBOXMP_CRDATACON
-{
-    PVBOXMP_CRCTLCON pCtl;
-    uint32_t u32ClientID;
-} VBOXMP_CRDATACON, *PVBOXMP_CRDATACON;
-
-DECLINLINE(int) VBoxMpCrDataConCreate(PVBOXMP_CRDATACON pDataCon, PVBOXMP_CRCTLCON pCtlCon)
-{
-    int rc = VBoxMpCrCtlConConnect(pCtlCon, CR_PROTOCOL_VERSION_MAJOR, CR_PROTOCOL_VERSION_MINOR, &pDataCon->u32ClientID);
-    if (RT_SUCCESS(rc))
-    {
-        Assert(pDataCon->u32ClientID);
-        pDataCon->pCtl = pCtlCon;
-        return VINF_SUCCESS;
-    }
-    WARN(("VBoxMpCrCtlConConnect failed, rc %d", rc));
-    return rc;
-}
-
-DECLINLINE(int) VBoxMpCrDataConDestroy(PVBOXMP_CRDATACON pDataCon)
-{
-    int rc = VBoxMpCrCtlConDisconnect(pDataCon->pCtl, pDataCon->u32ClientID);
-    if (RT_SUCCESS(rc))
-    {
-        /* sanity */
-        pDataCon->pCtl = NULL;
-        pDataCon->u32ClientID = 0;
-        return VINF_SUCCESS;
-    }
-    WARN(("VBoxMpCrCtlConDisconnect failed, rc %d", rc));
-    return rc;
-}
 
 typedef struct VBOXMP_CRSHGSMICON_BUFDR
Index: /trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPShgsmi.cpp
===================================================================
--- /trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPShgsmi.cpp	(revision 50858)
+++ /trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPShgsmi.cpp	(revision 50859)
@@ -235,5 +235,5 @@
             void *pvCallback = (void*)pCur->u64Info2;
 
-            pfnCallback(pHeap, VBoxSHGSMIBufferData(pCur), pvCallback, &pfnCompletion, &pvCompletion);
+            pfnCompletion = pfnCallback(pHeap, VBoxSHGSMIBufferData(pCur), pvCallback, &pvCompletion);
             if (pfnCompletion)
             {
Index: /trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPShgsmi.h
===================================================================
--- /trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPShgsmi.h	(revision 50858)
+++ /trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPShgsmi.h	(revision 50859)
@@ -34,6 +34,5 @@
 typedef FNVBOXSHGSMICMDCOMPLETION *PFNVBOXSHGSMICMDCOMPLETION;
 
-typedef DECLCALLBACK(void) FNVBOXSHGSMICMDCOMPLETION_IRQ(PVBOXSHGSMI pHeap, void *pvCmd, void *pvContext,
-                                        PFNVBOXSHGSMICMDCOMPLETION *ppfnCompletion, void **ppvCompletion);
+typedef DECLCALLBACK(PFNVBOXSHGSMICMDCOMPLETION) FNVBOXSHGSMICMDCOMPLETION_IRQ(PVBOXSHGSMI pHeap, void *pvCmd, void *pvContext, void **ppvCompletion);
 typedef FNVBOXSHGSMICMDCOMPLETION_IRQ *PFNVBOXSHGSMICMDCOMPLETION_IRQ;
 
Index: /trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPVbva.cpp
===================================================================
--- /trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPVbva.cpp	(revision 50858)
+++ /trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPVbva.cpp	(revision 50859)
@@ -172,13 +172,7 @@
 }
 
-static int vboxCmdVbvaCtlSubmitAsync(PHGSMIGUESTCOMMANDCONTEXT pHGSMICtx, VBOXCMDVBVA_CTL * pCtl, PFNVBOXSHGSMICMDCOMPLETION_IRQ pfnCompletionIrq, void *pvCompletionIrq)
-{
-    const VBOXSHGSMIHEADER* pHdr = VBoxSHGSMICommandPrepAsynchIrq(&pHGSMICtx->heapCtx, pCtl, pfnCompletionIrq, pvCompletionIrq, VBOXSHGSMI_FLAG_GH_ASYNCH_FORCE);
-    if (!pHdr)
-    {
-        WARN(("VBoxSHGSMICommandPrepAsynchIrq returnd NULL"));
-        return VERR_INVALID_PARAMETER;
-    }
-
+static int vboxCmdVbvaCtlSubmitAsync(PHGSMIGUESTCOMMANDCONTEXT pHGSMICtx, VBOXCMDVBVA_CTL * pCtl, FNVBOXSHGSMICMDCOMPLETION pfnCompletion, void *pvCompletion)
+{
+    const VBOXSHGSMIHEADER* pHdr = VBoxSHGSMICommandPrepAsynch(&pHGSMICtx->heapCtx, pCtl, pfnCompletion, pvCompletion, 0);
     HGSMIOFFSET offCmd = VBoxSHGSMICommandOffset(&pHGSMICtx->heapCtx, pHdr);
     if (offCmd == HGSMIOFFSET_VOID)
@@ -1127,2 +1121,132 @@
 }
 
+int vboxCmdVbvaConConnect(PHGSMIGUESTCOMMANDCONTEXT pHGSMICtx,
+        uint32_t crVersionMajor, uint32_t crVersionMinor,
+        uint32_t *pu32ClientID)
+{
+    VBOXCMDVBVA_CTL_3DCTL_CONNECT *pConnect = (VBOXCMDVBVA_CTL_3DCTL_CONNECT*)vboxCmdVbvaCtlCreate(pHGSMICtx, sizeof (VBOXCMDVBVA_CTL_3DCTL_CONNECT));
+    if (!pConnect)
+    {
+        WARN(("vboxCmdVbvaCtlCreate failed"));
+        return VERR_OUT_OF_RESOURCES;
+    }
+    pConnect->Hdr.u32Type = VBOXCMDVBVACTL_TYPE_3DCTL;
+    pConnect->Hdr.i32Result = VERR_NOT_SUPPORTED;
+    pConnect->Connect.Hdr.u32Type = VBOXCMDVBVA3DCTL_TYPE_CONNECT;
+    pConnect->Connect.Hdr.u32CmdClientId = 0;
+    pConnect->Connect.u32MajorVersion = crVersionMajor;
+    pConnect->Connect.u32MinorVersion = crVersionMinor;
+    pConnect->Connect.u64Pid = (uint64_t)PsGetCurrentProcessId();
+
+    int rc = vboxCmdVbvaCtlSubmitSync(pHGSMICtx, &pConnect->Hdr);
+    if (RT_SUCCESS(rc))
+    {
+        rc = pConnect->Hdr.i32Result;
+        if (RT_SUCCESS(rc))
+            *pu32ClientID = pConnect->Connect.Hdr.u32CmdClientId;
+        else
+            WARN(("VBOXCMDVBVA3DCTL_TYPE_CONNECT Disable failed %d", rc));
+    }
+    else
+        WARN(("vboxCmdVbvaCtlSubmitSync returnd %d", rc));
+
+    vboxCmdVbvaCtlFree(pHGSMICtx, &pConnect->Hdr);
+
+    return rc;
+}
+
+int vboxCmdVbvaConDisconnect(PHGSMIGUESTCOMMANDCONTEXT pHGSMICtx, uint32_t u32ClientID)
+{
+    VBOXCMDVBVA_CTL_3DCTL *pDisconnect = (VBOXCMDVBVA_CTL_3DCTL*)vboxCmdVbvaCtlCreate(pHGSMICtx, sizeof (VBOXCMDVBVA_CTL_3DCTL));
+    if (!pDisconnect)
+    {
+        WARN(("vboxCmdVbvaCtlCreate failed"));
+        return VERR_OUT_OF_RESOURCES;
+    }
+    pDisconnect->Hdr.u32Type = VBOXCMDVBVACTL_TYPE_3DCTL;
+    pDisconnect->Hdr.i32Result = VERR_NOT_SUPPORTED;
+    pDisconnect->Ctl.u32Type = VBOXCMDVBVA3DCTL_TYPE_DISCONNECT;
+    pDisconnect->Ctl.u32CmdClientId = u32ClientID;
+
+    int rc = vboxCmdVbvaCtlSubmitSync(pHGSMICtx, &pDisconnect->Hdr);
+    if (RT_SUCCESS(rc))
+    {
+        rc = pDisconnect->Hdr.i32Result;
+        if (!RT_SUCCESS(rc))
+            WARN(("VBOXCMDVBVA3DCTL_TYPE_DISCONNECT Disable failed %d", rc));
+    }
+    else
+        WARN(("vboxCmdVbvaCtlSubmitSync returnd %d", rc));
+
+    vboxCmdVbvaCtlFree(pHGSMICtx, &pDisconnect->Hdr);
+
+    return rc;
+}
+
+int VBoxCmdVbvaConConnect(PVBOXMP_DEVEXT pDevExt, VBOXCMDVBVA *pVbva,
+        uint32_t crVersionMajor, uint32_t crVersionMinor,
+        uint32_t *pu32ClientID)
+{
+    return vboxCmdVbvaConConnect(&VBoxCommonFromDeviceExt(pDevExt)->guestCtx, crVersionMajor, crVersionMinor, pu32ClientID);
+}
+
+int VBoxCmdVbvaConDisconnect(PVBOXMP_DEVEXT pDevExt, VBOXCMDVBVA *pVbva, uint32_t u32ClientID)
+{
+    return vboxCmdVbvaConDisconnect(&VBoxCommonFromDeviceExt(pDevExt)->guestCtx, u32ClientID);
+}
+
+VBOXCMDVBVA_CRCMD_CMD* vboxCmdVbvaConCmdAlloc(PHGSMIGUESTCOMMANDCONTEXT pHGSMICtx, uint32_t cbCmd)
+{
+    VBOXCMDVBVA_CTL_3DCTL_CMD *pCmd = (VBOXCMDVBVA_CTL_3DCTL_CMD*)vboxCmdVbvaCtlCreate(pHGSMICtx, sizeof (VBOXCMDVBVA_CTL_3DCTL_CMD) + cbCmd);
+    if (!pCmd)
+    {
+        WARN(("vboxCmdVbvaCtlCreate failed"));
+        return NULL;
+    }
+    pCmd->Hdr.u32Type = VBOXCMDVBVACTL_TYPE_3DCTL;
+    pCmd->Hdr.i32Result = VERR_NOT_SUPPORTED;
+    pCmd->Cmd.Hdr.u32Type = VBOXCMDVBVA3DCTL_TYPE_CMD;
+    pCmd->Cmd.Hdr.u32CmdClientId = 0;
+    pCmd->Cmd.Cmd.u8OpCode = VBOXCMDVBVA_OPTYPE_CRCMD;
+    pCmd->Cmd.Cmd.u8Flags = 0;
+    pCmd->Cmd.Cmd.u8State = VBOXCMDVBVA_STATE_SUBMITTED;
+    pCmd->Cmd.Cmd.u.i8Result = -1;
+    pCmd->Cmd.Cmd.u32FenceID = 0;
+
+    return (VBOXCMDVBVA_CRCMD_CMD*)(pCmd+1);
+}
+
+void vboxCmdVbvaConCmdFree(PHGSMIGUESTCOMMANDCONTEXT pHGSMICtx, VBOXCMDVBVA_CRCMD_CMD *pCmd)
+{
+    VBOXCMDVBVA_CTL_3DCTL_CMD *pHdr = ((VBOXCMDVBVA_CTL_3DCTL_CMD*)pCmd)-1;
+    vboxCmdVbvaCtlFree(pHGSMICtx, &pHdr->Hdr);
+}
+
+int vboxCmdVbvaConSubmitAsync(PHGSMIGUESTCOMMANDCONTEXT pHGSMICtx, VBOXCMDVBVA_CRCMD_CMD* pCmd, FNVBOXSHGSMICMDCOMPLETION pfnCompletion, void *pvCompletion)
+{
+    VBOXCMDVBVA_CTL_3DCTL_CMD *pHdr = ((VBOXCMDVBVA_CTL_3DCTL_CMD*)pCmd)-1;
+    return vboxCmdVbvaCtlSubmitAsync(pHGSMICtx, &pHdr->Hdr, pfnCompletion, pvCompletion);
+}
+
+VBOXCMDVBVA_CRCMD_CMD* VBoxCmdVbvaConCmdAlloc(PVBOXMP_DEVEXT pDevExt, uint32_t cbCmd)
+{
+    return vboxCmdVbvaConCmdAlloc(&VBoxCommonFromDeviceExt(pDevExt)->guestCtx, cbCmd);
+}
+
+void VBoxCmdVbvaConCmdFree(PVBOXMP_DEVEXT pDevExt, VBOXCMDVBVA_CRCMD_CMD *pCmd)
+{
+    vboxCmdVbvaConCmdFree(&VBoxCommonFromDeviceExt(pDevExt)->guestCtx, pCmd);
+}
+
+int VBoxCmdVbvaConCmdSubmitAsync(PVBOXMP_DEVEXT pDevExt, VBOXCMDVBVA_CRCMD_CMD* pCmd, FNVBOXSHGSMICMDCOMPLETION pfnCompletion, void *pvCompletion)
+{
+    return vboxCmdVbvaConSubmitAsync(&VBoxCommonFromDeviceExt(pDevExt)->guestCtx, pCmd, pfnCompletion, pvCompletion);
+}
+
+int VBoxCmdVbvaConCmdCompletionData(void *pvCmd, VBOXCMDVBVA_CRCMD_CMD **ppCmd)
+{
+    VBOXCMDVBVA_CTL_3DCTL_CMD *pCmd = (VBOXCMDVBVA_CTL_3DCTL_CMD*)pvCmd;
+    if (ppCmd)
+        *ppCmd = (VBOXCMDVBVA_CRCMD_CMD*)(pCmd+1);
+    return pCmd->Hdr.i32Result;
+}
Index: /trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPVbva.h
===================================================================
--- /trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPVbva.h	(revision 50858)
+++ /trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPVbva.h	(revision 50859)
@@ -224,3 +224,12 @@
 uint32_t VBoxCVDdiPTransferVRamSysBuildEls(VBOXCMDVBVA_PAGING_TRANSFER *pCmd, PMDL pMdl, uint32_t iPfn, uint32_t cPages, uint32_t cbBuffer, uint32_t *pcPagesWritten);
 
+int VBoxCmdVbvaConConnect(PVBOXMP_DEVEXT pDevExt, VBOXCMDVBVA *pVbva,
+        uint32_t crVersionMajor, uint32_t crVersionMinor,
+        uint32_t *pu32ClientID);
+int VBoxCmdVbvaConDisconnect(PVBOXMP_DEVEXT pDevExt, VBOXCMDVBVA *pVbva, uint32_t u32ClientID);
+VBOXCMDVBVA_CRCMD_CMD* VBoxCmdVbvaConCmdAlloc(PVBOXMP_DEVEXT pDevExt, uint32_t cbCmd);
+void VBoxCmdVbvaConCmdFree(PVBOXMP_DEVEXT pDevExt, VBOXCMDVBVA_CRCMD_CMD* pCmd);
+int VBoxCmdVbvaConCmdSubmitAsync(PVBOXMP_DEVEXT pDevExt, VBOXCMDVBVA_CRCMD_CMD* pCmd, FNVBOXSHGSMICMDCOMPLETION pfnCompletion, void *pvCompletion);
+int VBoxCmdVbvaConCmdCompletionData(void *pvCmd, VBOXCMDVBVA_CRCMD_CMD **ppCmd);
+
 #endif /* #ifndef ___VBoxMPVbva_h___ */
Index: /trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPVdma.cpp
===================================================================
--- /trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPVdma.cpp	(revision 50858)
+++ /trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPVdma.cpp	(revision 50859)
@@ -358,5 +358,5 @@
                 return STATUS_SUCCESS;
             }
-            WARN(("VBoxMpCrShgsmiTransportCmdSubmitWriteAsync failed, rc %d", rc));
+            WARN(("VBoxMpCrShgsmiTransportCmdSubmitWriteReadAsync failed, rc %d", rc));
             Status = STATUS_UNSUCCESSFUL;
             VBoxMpCrShgsmiTransportCmdTermWriteReadAsync(&pDevExt->CrHgsmiTransport, pvCompletionData);
@@ -364,5 +364,5 @@
         else
         {
-            WARN(("VBoxMpCrShgsmiTransportCmdCreateWriteAsync failed"));
+            WARN(("VBoxMpCrShgsmiTransportCmdCreateWriteReadAsync failed"));
             Status = STATUS_INSUFFICIENT_RESOURCES;
         }
@@ -1041,5 +1041,5 @@
         VBoxMpCrPackerInit(&CrPacker);
 
-        int rc = VBoxMpCrCtlConConnect(&pDevExt->CrCtlCon, CR_PROTOCOL_VERSION_MAJOR, CR_PROTOCOL_VERSION_MINOR, &pDevExt->u32CrConDefaultClientID);
+        int rc = VBoxMpCrCtlConConnect(pDevExt, &pDevExt->CrCtlCon, CR_PROTOCOL_VERSION_MAJOR, CR_PROTOCOL_VERSION_MINOR, &pDevExt->u32CrConDefaultClientID);
         if (!RT_SUCCESS(rc))
         {
@@ -1099,5 +1099,5 @@
         }
 
-        int rc = VBoxMpCrCtlConConnect(&pDevExt->CrCtlCon, CR_PROTOCOL_VERSION_MAJOR, CR_PROTOCOL_VERSION_MINOR, &pDevExt->u32CrConDefaultClientID);
+        int rc = VBoxMpCrCtlConConnect(pDevExt, &pDevExt->CrCtlCon, CR_PROTOCOL_VERSION_MAJOR, CR_PROTOCOL_VERSION_MINOR, &pDevExt->u32CrConDefaultClientID);
         if (!RT_SUCCESS(rc))
         {
@@ -1616,6 +1616,5 @@
 }
 
-static DECLCALLBACK(void) vboxVdmaCBufDrCompletionIrq(PVBOXSHGSMI pHeap, void *pvCmd, void *pvContext,
-                                        PFNVBOXSHGSMICMDCOMPLETION *ppfnCompletion, void **ppvCompletion)
+static DECLCALLBACK(PFNVBOXSHGSMICMDCOMPLETION) vboxVdmaCBufDrCompletionIrq(PVBOXSHGSMI pHeap, void *pvCmd, void *pvContext, void **ppvCompletion)
 {
     PVBOXMP_DEVEXT pDevExt = (PVBOXMP_DEVEXT)pvContext;
@@ -1646,5 +1645,5 @@
 
     /* inform SHGSMI we DO NOT want to be called at DPC later */
-    *ppfnCompletion = NULL;
+    return NULL;
 //    *ppvCompletion = pvContext;
 }
Index: /trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPWddm.cpp
===================================================================
--- /trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPWddm.cpp	(revision 50858)
+++ /trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPWddm.cpp	(revision 50859)
@@ -3089,15 +3089,62 @@
     /* the DMA command buffer is located in system RAM, the host will need to pick it from there */
     //BufInfo.fFlags = 0; /* see VBOXVDMACBUF_FLAG_xx */
+    VBOXCMDVBVA_HDR *pHdr;
+    VBOXCMDVBVA_SYSMEMCMD SysMem;
     uint32_t cbCmd = pSubmitCommand->DmaBufferPrivateDataSubmissionEndOffset - pSubmitCommand->DmaBufferPrivateDataSubmissionStartOffset;
-    if (cbCmd < sizeof (VBOXCMDVBVA_HDR))
-    {
-        WARN(("DmaBufferPrivateDataSubmissionEndOffset (%d) - DmaBufferPrivateDataSubmissionStartOffset (%d) < sizeof (VBOXCMDVBVA_HDR) (%d)",
-                pSubmitCommand->DmaBufferPrivateDataSubmissionEndOffset,
-                pSubmitCommand->DmaBufferPrivateDataSubmissionStartOffset,
-                sizeof (VBOXWDDM_DMA_PRIVATEDATA_BASEHDR)));
-        return STATUS_INVALID_PARAMETER;
-    }
-
-    VBOXCMDVBVA_HDR *pHdr = (VBOXCMDVBVA_HDR*)((uint8_t*)pSubmitCommand->pDmaBufferPrivateData + pSubmitCommand->DmaBufferPrivateDataSubmissionStartOffset);
+    if (!cbCmd)
+    {
+        cbCmd = pSubmitCommand->DmaBufferSubmissionEndOffset - pSubmitCommand->DmaBufferSubmissionStartOffset;
+        if (cbCmd < sizeof (VBOXCMDVBVA_HDR))
+        {
+            WARN(("DmaBufferPrivateDataSubmissionEndOffset (%d) - DmaBufferPrivateDataSubmissionStartOffset (%d) < sizeof (VBOXCMDVBVA_HDR) (%d)",
+                    pSubmitCommand->DmaBufferPrivateDataSubmissionEndOffset,
+                    pSubmitCommand->DmaBufferPrivateDataSubmissionStartOffset,
+                    sizeof (VBOXWDDM_DMA_PRIVATEDATA_BASEHDR)));
+            return STATUS_INVALID_PARAMETER;
+        }
+
+        if (cbCmd > 0xffff)
+        {
+            WARN(("cbCmd too big"));
+            return STATUS_INVALID_PARAMETER;
+        }
+
+        if (VBOXWDDM_DUMMY_DMABUFFER_SIZE == cbCmd)
+        {
+            SysMem.Hdr.u8OpCode = VBOXCMDVBVA_OPTYPE_NOPCMD;
+            SysMem.Hdr.u8Flags = 0;
+            SysMem.Hdr.u8State = VBOXCMDVBVA_STATE_SUBMITTED;
+            cbCmd = sizeof (SysMem.Hdr);
+        }
+        else
+        {
+            SysMem.Hdr.u8OpCode = VBOXCMDVBVA_OPTYPE_SYSMEMCMD;
+            SysMem.Hdr.u8Flags = cbCmd & 0xff;
+            SysMem.Hdr.u.u8PrimaryID = (cbCmd >> 8) & 0xff;
+            SysMem.Hdr.u8State = VBOXCMDVBVA_STATE_SUBMITTED;
+            SysMem.phSysMem = pSubmitCommand->DmaBufferPhysicalAddress.QuadPart + pSubmitCommand->DmaBufferSubmissionStartOffset;
+            if (SysMem.phSysMem & PAGE_OFFSET_MASK)
+            {
+                WARN(("command should be page aligned for now"));
+                return STATUS_INVALID_PARAMETER;
+            }
+        }
+
+        pHdr = &SysMem.Hdr;
+        cbCmd = sizeof (SysMem);
+    }
+    else
+    {
+        if (cbCmd < sizeof (VBOXCMDVBVA_HDR))
+        {
+            WARN(("DmaBufferPrivateDataSubmissionEndOffset (%d) - DmaBufferPrivateDataSubmissionStartOffset (%d) < sizeof (VBOXCMDVBVA_HDR) (%d)",
+                    pSubmitCommand->DmaBufferPrivateDataSubmissionEndOffset,
+                    pSubmitCommand->DmaBufferPrivateDataSubmissionStartOffset,
+                    sizeof (VBOXWDDM_DMA_PRIVATEDATA_BASEHDR)));
+            return STATUS_INVALID_PARAMETER;
+        }
+
+        pHdr = (VBOXCMDVBVA_HDR*)((uint8_t*)pSubmitCommand->pDmaBufferPrivateData + pSubmitCommand->DmaBufferPrivateDataSubmissionStartOffset);
+    }
     pHdr->u32FenceID = pSubmitCommand->SubmissionFenceId;
     int rc = VBoxCmdVbvaSubmit(pDevExt, &pDevExt->CmdVbva, pHdr, cbCmd);
@@ -3368,10 +3415,4 @@
         case DXGK_OPERATION_TRANSFER:
         {
-            VBOXCMDVBVA_HDR *pHdr = (VBOXCMDVBVA_HDR*)pBuildPagingBuffer->pDmaBuffer;
-            pHdr->u8Flags = 0;
-            pHdr->u8State = VBOXCMDVBVA_STATE_SUBMITTED;
-            /* sanity */
-            pHdr->u32FenceID = 0;
-
             if ((!pBuildPagingBuffer->Transfer.Source.SegmentId) == (!pBuildPagingBuffer->Transfer.Destination.SegmentId))
             {
@@ -3389,13 +3430,11 @@
             if (pAlloc->AllocData.hostID)
             {
-                pHdr->u8OpCode = VBOXCMDVBVA_OPTYPE_NOPCMD;
                 cbBuffer = VBOXWDDM_DUMMY_DMABUFFER_SIZE;
-                cbPrivateData = sizeof (*pHdr);
                 break;
             }
 
-            if (pBuildPagingBuffer->DmaBufferPrivateDataSize < sizeof (VBOXCMDVBVA_PAGING_TRANSFER))
-            {
-                WARN(("pBuildPagingBuffer->DmaBufferPrivateDataSize(%d) < sizeof VBOXCMDVBVA_PAGING_TRANSFER (%d)", pBuildPagingBuffer->DmaBufferPrivateDataSize , sizeof (VBOXCMDVBVA_PAGING_TRANSFER)));
+            if (pBuildPagingBuffer->DmaSize < sizeof (VBOXCMDVBVA_PAGING_TRANSFER))
+            {
+                WARN(("pBuildPagingBuffer->DmaSize(%d) < sizeof VBOXCMDVBVA_PAGING_TRANSFER (%d)", pBuildPagingBuffer->DmaSize , sizeof (VBOXCMDVBVA_PAGING_TRANSFER)));
                 /* @todo: can this actually happen? what status to return? */
                 return STATUS_INVALID_PARAMETER;
@@ -3404,4 +3443,9 @@
             VBOXCMDVBVA_PAGING_TRANSFER *pPaging = (VBOXCMDVBVA_PAGING_TRANSFER*)pBuildPagingBuffer->pDmaBuffer;
             pPaging->Hdr.u8OpCode = VBOXCMDVBVA_OPTYPE_PAGING_TRANSFER;
+            /* sanity */
+            pPaging->Hdr.u8Flags = 0;
+            pPaging->Hdr.u8State = VBOXCMDVBVA_STATE_SUBMITTED;
+            pPaging->Hdr.u32FenceID = 0;
+
 
             PMDL pMdl;
@@ -3437,5 +3481,5 @@
             if (fIn)
                 pPaging->Hdr.u8Flags |= VBOXCMDVBVA_OPF_PAGING_TRANSFER_IN;
-            cbPrivateData = VBoxCVDdiPTransferVRamSysBuildEls(pPaging, pMdl, iFirstPage, cPages, pBuildPagingBuffer->DmaBufferPrivateDataSize, &cPagesWritten);
+            cbBuffer = VBoxCVDdiPTransferVRamSysBuildEls(pPaging, pMdl, iFirstPage, cPages, pBuildPagingBuffer->DmaBufferPrivateDataSize, &cPagesWritten);
             if (cPagesWritten != cPages)
                 pBuildPagingBuffer->MultipassOffset += cPagesWritten;
@@ -3443,5 +3487,4 @@
                 pBuildPagingBuffer->MultipassOffset = 0;
 
-            cbBuffer = VBOXWDDM_DUMMY_DMABUFFER_SIZE;
             break;
         }
@@ -3475,4 +3518,6 @@
         }
     }
+
+    Assert(!cbPrivateData);
 
     pBuildPagingBuffer->pDmaBuffer = ((uint8_t*)pBuildPagingBuffer->pDmaBuffer) + cbBuffer;
@@ -6608,5 +6653,5 @@
             {
                 VBoxMpCrPackerInit(&pContext->CrPacker);
-                int rc = VBoxMpCrCtlConConnect(&pDevExt->CrCtlCon, CR_PROTOCOL_VERSION_MAJOR, CR_PROTOCOL_VERSION_MINOR, &pContext->u32CrConClientID);
+                int rc = VBoxMpCrCtlConConnect(pDevExt, &pDevExt->CrCtlCon, CR_PROTOCOL_VERSION_MAJOR, CR_PROTOCOL_VERSION_MINOR, &pContext->u32CrConClientID);
                 if (!RT_SUCCESS(rc))
                     WARN(("VBoxMpCrCtlConConnect failed rc (%d), ignoring for system context", rc));
@@ -6644,5 +6689,5 @@
                                         if (pDevExt->f3DEnabled)
                                         {
-                                            int rc = VBoxMpCrCtlConConnect(&pDevExt->CrCtlCon,
+                                            int rc = VBoxMpCrCtlConConnect(pDevExt, &pDevExt->CrCtlCon,
                                                 pInfo->crVersionMajor, pInfo->crVersionMinor,
                                                 &pContext->u32CrConClientID);
@@ -6689,5 +6734,5 @@
                                 if (pDevExt->f3DEnabled)
                                 {
-                                    int rc = VBoxMpCrCtlConConnect(&pDevExt->CrCtlCon,
+                                    int rc = VBoxMpCrCtlConConnect(pDevExt, &pDevExt->CrCtlCon,
                                         pInfo->crVersionMajor, pInfo->crVersionMinor,
                                         &pContext->u32CrConClientID);
@@ -6825,5 +6870,5 @@
     if (pContext->u32CrConClientID)
     {
-        VBoxMpCrCtlConDisconnect(&pDevExt->CrCtlCon, pContext->u32CrConClientID);
+        VBoxMpCrCtlConDisconnect(pDevExt, &pDevExt->CrCtlCon, pContext->u32CrConClientID);
     }
 
