Index: /trunk/src/VBox/Devices/Graphics/DevVGA_VBVA.cpp
===================================================================
--- /trunk/src/VBox/Devices/Graphics/DevVGA_VBVA.cpp	(revision 70599)
+++ /trunk/src/VBox/Devices/Graphics/DevVGA_VBVA.cpp	(revision 70600)
@@ -2245,5 +2245,5 @@
             const uint64_t u64ScreenSize = (uint64_t)screen.u32LineSize * screen.u32Height;
             if (   screen.u32StartOffset <= pView->u32ViewSize
-                && u64ScreenSize <= pView->u32MaxScreenSize
+                && u64ScreenSize         <= pView->u32MaxScreenSize
                 && screen.u32StartOffset <= pView->u32ViewSize - (uint32_t)u64ScreenSize)
             {
@@ -2252,14 +2252,10 @@
             }
 
-            /** @todo why not use "%#RX" instead of "0x%RX"? */
-            LogRelFlow(("VBVA: InfoScreen: invalid data! size 0x%RX64, max 0x%RX32\n",
+            LogRelFlow(("VBVA: InfoScreen: invalid data! size %#RX64, max %#RX32\n",
                         u64ScreenSize, pView->u32MaxScreenSize));
         }
     }
     else
-    {
-        LogRelFlow(("VBVA: InfoScreen: invalid data! index %RU32(%RU32)\n", screen.u32ViewIndex,
-                    pCtx->cViews));
-    }
+        LogRelFlow(("VBVA: InfoScreen: invalid data! index %RU32(%RU32)\n", screen.u32ViewIndex, pCtx->cViews));
 
     return VERR_INVALID_PARAMETER;
Index: /trunk/src/VBox/Devices/Graphics/DevVGA_VDMA.cpp
===================================================================
--- /trunk/src/VBox/Devices/Graphics/DevVGA_VDMA.cpp	(revision 70599)
+++ /trunk/src/VBox/Devices/Graphics/DevVGA_VDMA.cpp	(revision 70600)
@@ -202,24 +202,29 @@
 
 
+/**
+ * List selector for VBoxVBVAExHCtlSubmit(), vdmaVBVACtlSubmit().
+ */
+typedef enum
+{
+    VBVAEXHOSTCTL_SOURCE_GUEST = 0,
+    VBVAEXHOSTCTL_SOURCE_HOST
+} VBVAEXHOSTCTL_SOURCE;
+
+
 /*********************************************************************************************************************************
 *   Internal Functions                                                                                                           *
 *********************************************************************************************************************************/
 #ifdef VBOX_WITH_CRHGSMI
-static int vdmaVBVANotifyDisable(PVGASTATE pVGAState);
-
+static int  vdmaVBVANotifyDisable(PVGASTATE pVGAState);
 static void VBoxVBVAExHPDataCompleteCmd(struct VBVAEXHOSTCONTEXT *pCmdVbva, uint32_t cbCmd);
 static void VBoxVBVAExHPDataCompleteCtl(struct VBVAEXHOSTCONTEXT *pCmdVbva, VBVAEXHOSTCTL *pCtl, int rc);
+static int  VBoxVDMAThreadEventNotify(PVBOXVDMATHREAD pThread);
+static int  vboxVDMACmdExecBpbTransfer(PVBOXVDMAHOST pVdma, const VBOXVDMACMD_DMA_BPB_TRANSFER *pTransfer, uint32_t cbBuffer);
+static int  vdmaVBVACtlSubmitSync(PVBOXVDMAHOST pVdma, VBVAEXHOSTCTL *pCtl, VBVAEXHOSTCTL_SOURCE enmSource);
+static DECLCALLBACK(void) vdmaVBVACtlSubmitSyncCompletion(VBVAEXHOSTCONTEXT *pVbva, struct VBVAEXHOSTCTL *pCtl,
+                                                          int rc, void *pvContext);
 
 /* VBoxVBVAExHP**, i.e. processor functions, can NOT be called concurrently with each other,
  * can be called concurrently with istelf as well as with other VBoxVBVAEx** functions except Init/Start/Term aparently */
-static int VBoxVBVAExHSCheckCommands(struct VBVAEXHOSTCONTEXT *pCmdVbva);
-
-static int VBoxVBVAExHSInit(struct VBVAEXHOSTCONTEXT *pCmdVbva);
-static int VBoxVBVAExHSEnable(struct VBVAEXHOSTCONTEXT *pCmdVbva, VBVABUFFER *pVBVA);
-static int VBoxVBVAExHSDisable(struct VBVAEXHOSTCONTEXT *pCmdVbva);
-static void VBoxVBVAExHSTerm(struct VBVAEXHOSTCONTEXT *pCmdVbva);
-static int VBoxVBVAExHSSaveState(struct VBVAEXHOSTCONTEXT *pCmdVbva, uint8_t* pu8VramBase, PSSMHANDLE pSSM);
-static int VBoxVBVAExHSLoadState(struct VBVAEXHOSTCONTEXT *pCmdVbva, uint8_t* pu8VramBase, PSSMHANDLE pSSM, uint32_t u32Version);
-
 #endif /* VBOX_WITH_CRHGSMI */
 
@@ -228,13 +233,27 @@
 #ifdef VBOX_WITH_CRHGSMI
 
-static VBVAEXHOSTCTL* VBoxVBVAExHCtlAlloc(VBVAEXHOSTCONTEXT *pCmdVbva)
+/**
+ * Creates a host control command.
+ */
+static VBVAEXHOSTCTL *VBoxVBVAExHCtlCreate(VBVAEXHOSTCONTEXT *pCmdVbva, VBVAEXHOSTCTL_TYPE enmType)
 {
 # ifndef VBOXVDBG_MEMCACHE_DISABLE
-    return (VBVAEXHOSTCTL*)RTMemCacheAlloc(pCmdVbva->CtlCache);
+    VBVAEXHOSTCTL *pCtl = (VBVAEXHOSTCTL*)RTMemCacheAlloc(pCmdVbva->CtlCache);
 # else
-    return (VBVAEXHOSTCTL*)RTMemAlloc(sizeof (VBVAEXHOSTCTL));
+    VBVAEXHOSTCTL *pCtl = (VBVAEXHOSTCTL*)RTMemAlloc(sizeof(VBVAEXHOSTCTL));
 # endif
-}
-
+    if (pCtl)
+    {
+        RT_ZERO(*pCtl);
+        pCtl->enmType = enmType;
+    }
+    else
+        WARN(("VBoxVBVAExHCtlAlloc failed\n"));
+    return pCtl;
+}
+
+/**
+ * Destroys a host control command.
+ */
 static void VBoxVBVAExHCtlFree(VBVAEXHOSTCONTEXT *pCmdVbva, VBVAEXHOSTCTL *pCtl)
 {
@@ -246,17 +265,9 @@
 }
 
-static VBVAEXHOSTCTL *VBoxVBVAExHCtlCreate(VBVAEXHOSTCONTEXT *pCmdVbva, VBVAEXHOSTCTL_TYPE enmType)
-{
-    VBVAEXHOSTCTL* pCtl = VBoxVBVAExHCtlAlloc(pCmdVbva);
-    if (!pCtl)
-    {
-        WARN(("VBoxVBVAExHCtlAlloc failed\n"));
-        return NULL;
-    }
-
-    pCtl->enmType = enmType;
-    return pCtl;
-}
-
+
+
+/**
+ * Works the VBVA state.
+ */
 static int vboxVBVAExHSProcessorAcquire(struct VBVAEXHOSTCONTEXT *pCmdVbva)
 {
@@ -264,9 +275,19 @@
 
     if (ASMAtomicCmpXchgS32(&pCmdVbva->i32State, VBVAEXHOSTCONTEXT_STATE_PROCESSING, VBVAEXHOSTCONTEXT_STATE_LISTENING))
-            return VINF_SUCCESS;
+        return VINF_SUCCESS;
     return VERR_SEM_BUSY;
 }
 
-static VBVAEXHOSTCTL* vboxVBVAExHPCheckCtl(struct VBVAEXHOSTCONTEXT *pCmdVbva, bool *pfHostCtl, bool fHostOnlyMode)
+/**
+ * Worker for vboxVBVAExHPDataGet() and VBoxVBVAExHPCheckHostCtlOnDisable() that
+ * gets the next control command.
+ *
+ * @returns Pointer to command if found, NULL if not.
+ * @param   pCmdVbva        The VBVA command context.
+ * @param   pfHostCtl       Where to indicate whether it's a host or guest
+ *                          control command.
+ * @param   fHostOnlyMode   Whether to only fetch host commands, or both.
+ */
+static VBVAEXHOSTCTL *vboxVBVAExHPCheckCtl(struct VBVAEXHOSTCONTEXT *pCmdVbva, bool *pfHostCtl, bool fHostOnlyMode)
 {
     Assert(pCmdVbva->i32State == VBVAEXHOSTCONTEXT_STATE_PROCESSING);
@@ -278,5 +299,5 @@
     if (RT_SUCCESS(rc))
     {
-        VBVAEXHOSTCTL* pCtl = RTListGetFirst(&pCmdVbva->HostCtlList, VBVAEXHOSTCTL, Node);
+        VBVAEXHOSTCTL *pCtl = RTListGetFirst(&pCmdVbva->HostCtlList, VBVAEXHOSTCTL, Node);
         if (pCtl)
             *pfHostCtl = true;
@@ -304,13 +325,16 @@
     }
     else
-        WARN(("RTCritSectEnter failed %d\n", rc));
+        WARN(("RTCritSectEnter failed %Rrc\n", rc));
 
     return NULL;
 }
 
-static VBVAEXHOSTCTL* VBoxVBVAExHPCheckHostCtlOnDisable(struct VBVAEXHOSTCONTEXT *pCmdVbva)
+/**
+ * Worker for vboxVDMACrHgcmHandleEnableRemainingHostCommand().
+ */
+static VBVAEXHOSTCTL *VBoxVBVAExHPCheckHostCtlOnDisable(struct VBVAEXHOSTCONTEXT *pCmdVbva)
 {
     bool fHostCtl = false;
-    VBVAEXHOSTCTL* pCtl = vboxVBVAExHPCheckCtl(pCmdVbva, &fHostCtl, true);
+    VBVAEXHOSTCTL *pCtl = vboxVBVAExHPCheckCtl(pCmdVbva, &fHostCtl, true);
     Assert(!pCtl || fHostCtl);
     return pCtl;
@@ -333,4 +357,7 @@
 }
 
+/**
+ * Works the VBVA state in response to VBVAEXHOSTCTL_TYPE_HH_INTERNAL_RESUME.
+ */
 static int VBoxVBVAExHPResume(struct VBVAEXHOSTCONTEXT *pCmdVbva)
 {
@@ -345,4 +372,13 @@
 }
 
+/**
+ * Worker for vboxVBVAExHPDataGet that processes PAUSE and RESUME requests.
+ *
+ * Unclear why these cannot be handled the normal way.
+ *
+ * @returns true if handled, false if not.
+ * @param   pCmdVbva            The VBVA context.
+ * @param   pCtl                The host control command.
+ */
 static bool vboxVBVAExHPCheckProcessCtlInternal(struct VBVAEXHOSTCONTEXT *pCmdVbva, VBVAEXHOSTCTL* pCtl)
 {
@@ -366,4 +402,7 @@
 }
 
+/**
+ * Works the VBVA state.
+ */
 static void vboxVBVAExHPProcessorRelease(struct VBVAEXHOSTCONTEXT *pCmdVbva)
 {
@@ -373,4 +412,7 @@
 }
 
+/**
+ * Works the VBVA state.
+ */
 static void vboxVBVAExHPHgEventSet(struct VBVAEXHOSTCONTEXT *pCmdVbva)
 {
@@ -380,4 +422,7 @@
 }
 
+/**
+ * Works the VBVA state.
+ */
 static void vboxVBVAExHPHgEventClear(struct VBVAEXHOSTCONTEXT *pCmdVbva)
 {
@@ -457,4 +502,7 @@
 }
 
+/**
+ * Control command completion routine used by many.
+ */
 static void VBoxVBVAExHPDataCompleteCtl(struct VBVAEXHOSTCONTEXT *pCmdVbva, VBVAEXHOSTCTL *pCtl, int rc)
 {
@@ -489,5 +537,5 @@
                     return VBVAEXHOST_DATA_TYPE_HOSTCTL;
                 }
-                continue;
+                continue; /* Processed by vboxVBVAExHPCheckProcessCtlInternal, get next. */
             }
             *ppCmd = (uint8_t*)pCtl;
@@ -511,5 +559,5 @@
             default:
                 /* this is something really unexpected, i.e. most likely guest has written something incorrect to the VBVA buffer */
-                WARN(("Warning: vboxVBVAExHCmdGet returned unexpected status %d\n", rc));
+                WARN(("Warning: vboxVBVAExHCmdGet returned unexpected status %Rrc\n", rc));
                 return VBVAEXHOST_DATA_TYPE_NO_DATA;
         }
@@ -557,8 +605,10 @@
 }
 
+/**
+ * Checks for pending VBVA command or (internal) control command.
+ */
 DECLINLINE(bool) vboxVBVAExHSHasCommands(struct VBVAEXHOSTCONTEXT *pCmdVbva)
 {
     VBVABUFFER *pVBVA = pCmdVbva->pVBVA;
-
     if (pVBVA)
     {
@@ -570,5 +620,5 @@
     }
 
-    return !!ASMAtomicReadU32(&pCmdVbva->u32cCtls);
+    return ASMAtomicReadU32(&pCmdVbva->u32cCtls) > 0;
 }
 
@@ -599,7 +649,10 @@
 }
 
+/**
+ * Worker for vboxVDMAConstruct() that initializes the give VBVA host context.
+ */
 static int VBoxVBVAExHSInit(struct VBVAEXHOSTCONTEXT *pCmdVbva)
 {
-    memset(pCmdVbva, 0, sizeof (*pCmdVbva));
+    RT_ZERO(*pCmdVbva);
     int rc = RTCritSectInit(&pCmdVbva->CltCritSect);
     if (RT_SUCCESS(rc))
@@ -607,11 +660,11 @@
 # ifndef VBOXVDBG_MEMCACHE_DISABLE
         rc = RTMemCacheCreate(&pCmdVbva->CtlCache, sizeof (VBVAEXHOSTCTL),
-                                0, /* size_t cbAlignment */
-                                UINT32_MAX, /* uint32_t cMaxObjects */
-                                NULL, /* PFNMEMCACHECTOR pfnCtor*/
-                                NULL, /* PFNMEMCACHEDTOR pfnDtor*/
-                                NULL, /* void *pvUser*/
-                                0 /* uint32_t fFlags*/
-                                );
+                              0, /* size_t cbAlignment */
+                              UINT32_MAX, /* uint32_t cMaxObjects */
+                              NULL, /* PFNMEMCACHECTOR pfnCtor*/
+                              NULL, /* PFNMEMCACHEDTOR pfnDtor*/
+                              NULL, /* void *pvUser*/
+                              0 /* uint32_t fFlags*/
+                              );
         if (RT_SUCCESS(rc))
 # endif
@@ -619,29 +672,39 @@
             RTListInit(&pCmdVbva->GuestCtlList);
             RTListInit(&pCmdVbva->HostCtlList);
-            pCmdVbva->i32State = VBVAEXHOSTCONTEXT_STATE_PROCESSING;
+            pCmdVbva->i32State       = VBVAEXHOSTCONTEXT_STATE_PROCESSING;
             pCmdVbva->i32EnableState = VBVAEXHOSTCONTEXT_ESTATE_DISABLED;
             return VINF_SUCCESS;
         }
 # ifndef VBOXVDBG_MEMCACHE_DISABLE
-        else
-            WARN(("RTMemCacheCreate failed %d\n", rc));
+        WARN(("RTMemCacheCreate failed %Rrc\n", rc));
 # endif
     }
     else
-        WARN(("RTCritSectInit failed %d\n", rc));
+        WARN(("RTCritSectInit failed %Rrc\n", rc));
 
     return rc;
 }
 
+/**
+ * Checks if VBVA state is some form of enabled.
+ */
 DECLINLINE(bool) VBoxVBVAExHSIsEnabled(struct VBVAEXHOSTCONTEXT *pCmdVbva)
 {
-    return (ASMAtomicUoReadS32(&pCmdVbva->i32EnableState) >= VBVAEXHOSTCONTEXT_ESTATE_PAUSED);
-}
-
+    return ASMAtomicUoReadS32(&pCmdVbva->i32EnableState) >= VBVAEXHOSTCONTEXT_ESTATE_PAUSED;
+}
+
+/**
+ * Checks if VBVA state is disabled.
+ */
 DECLINLINE(bool) VBoxVBVAExHSIsDisabled(struct VBVAEXHOSTCONTEXT *pCmdVbva)
 {
-    return (ASMAtomicUoReadS32(&pCmdVbva->i32EnableState) == VBVAEXHOSTCONTEXT_ESTATE_DISABLED);
-}
-
+    return ASMAtomicUoReadS32(&pCmdVbva->i32EnableState) == VBVAEXHOSTCONTEXT_ESTATE_DISABLED;
+}
+
+/**
+ * Worker for vdmaVBVAEnableProcess().
+ *
+ * @thread VDMA
+ */
 static int VBoxVBVAExHSEnable(struct VBVAEXHOSTCONTEXT *pCmdVbva, VBVABUFFER *pVBVA)
 {
@@ -658,4 +721,8 @@
 }
 
+/**
+ * Works the enable state.
+ * @thread VDMA, CR, EMT, ...
+ */
 static int VBoxVBVAExHSDisable(struct VBVAEXHOSTCONTEXT *pCmdVbva)
 {
@@ -667,4 +734,7 @@
 }
 
+/**
+ * Worker for vboxVDMADestruct() and vboxVDMAConstruct().
+ */
 static void VBoxVBVAExHSTerm(struct VBVAEXHOSTCONTEXT *pCmdVbva)
 {
@@ -685,7 +755,12 @@
 # endif
 
-    memset(pCmdVbva, 0, sizeof (*pCmdVbva));
-}
-
+    RT_ZERO(*pCmdVbva);
+}
+
+
+/**
+ * Worker for vboxVBVAExHSSaveStateLocked().
+ * @thread VDMA
+ */
 static int vboxVBVAExHSSaveGuestCtl(struct VBVAEXHOSTCONTEXT *pCmdVbva, VBVAEXHOSTCTL* pCtl, uint8_t* pu8VramBase, PSSMHANDLE pSSM)
 {
@@ -701,4 +776,8 @@
 }
 
+/**
+ * Worker for VBoxVBVAExHSSaveState().
+ * @thread VDMA
+ */
 static int vboxVBVAExHSSaveStateLocked(struct VBVAEXHOSTCONTEXT *pCmdVbva, uint8_t* pu8VramBase, PSSMHANDLE pSSM)
 {
@@ -723,26 +802,30 @@
 }
 
-
-/** Saves state
+/**
+ * Handles VBVAEXHOSTCTL_TYPE_HH_SAVESTATE for vboxVDMACrHostCtlProcess, saving
+ * state on the VDMA thread.
+ *
  * @returns - same as VBoxVBVAExHSCheckCommands, or failure on load state fail
+ * @thread VDMA
  */
 static int VBoxVBVAExHSSaveState(struct VBVAEXHOSTCONTEXT *pCmdVbva, uint8_t* pu8VramBase, PSSMHANDLE pSSM)
 {
     int rc = RTCritSectEnter(&pCmdVbva->CltCritSect);
-    if (RT_FAILURE(rc))
-    {
-        WARN(("RTCritSectEnter failed %d\n", rc));
-        return rc;
-    }
+    AssertRCReturn(rc, rc);
 
     rc = vboxVBVAExHSSaveStateLocked(pCmdVbva, pu8VramBase, pSSM);
     if (RT_FAILURE(rc))
-        WARN(("vboxVBVAExHSSaveStateLocked failed %d\n", rc));
+        WARN(("vboxVBVAExHSSaveStateLocked failed %Rrc\n", rc));
 
     RTCritSectLeave(&pCmdVbva->CltCritSect);
-
     return rc;
 }
 
+
+/**
+ * Worker for vboxVBVAExHSLoadStateLocked.
+ * @retval VINF_EOF if end stuff to load.
+ * @thread VDMA
+ */
 static int vboxVBVAExHSLoadGuestCtl(struct VBVAEXHOSTCONTEXT *pCmdVbva, uint8_t* pu8VramBase, PSSMHANDLE pSSM, uint32_t u32Version)
 {
@@ -755,5 +838,5 @@
         return VINF_EOF;
 
-    VBVAEXHOSTCTL* pHCtl = VBoxVBVAExHCtlCreate(pCmdVbva, (VBVAEXHOSTCTL_TYPE)u32);
+    VBVAEXHOSTCTL *pHCtl = VBoxVBVAExHCtlCreate(pCmdVbva, (VBVAEXHOSTCTL_TYPE)u32);
     if (!pHCtl)
     {
@@ -776,5 +859,8 @@
 }
 
-
+/**
+ * Worker for VBoxVBVAExHSLoadState.
+ * @thread VDMA
+ */
 static int vboxVBVAExHSLoadStateLocked(struct VBVAEXHOSTCONTEXT *pCmdVbva, uint8_t* pu8VramBase, PSSMHANDLE pSSM, uint32_t u32Version)
 {
@@ -786,15 +872,19 @@
 
     int rc;
-
-    do {
+    do
+    {
         rc = vboxVBVAExHSLoadGuestCtl(pCmdVbva, pu8VramBase, pSSM, u32Version);
         AssertLogRelRCReturn(rc, rc);
-    } while (VINF_EOF != rc);
+    } while (rc != VINF_EOF);
 
     return VINF_SUCCESS;
 }
 
-/** Loads state
+/**
+ * Handles VBVAEXHOSTCTL_TYPE_HH_LOADSTATE for vboxVDMACrHostCtlProcess(),
+ * loading state on the VDMA thread.
+ *
  * @returns - same as VBoxVBVAExHSCheckCommands, or failure on load state fail
+ * @thread VDMA
  */
 static int VBoxVBVAExHSLoadState(struct VBVAEXHOSTCONTEXT *pCmdVbva, uint8_t* pu8VramBase, PSSMHANDLE pSSM, uint32_t u32Version)
@@ -802,64 +892,86 @@
     Assert(VGA_SAVEDSTATE_VERSION_3D <= u32Version);
     int rc = RTCritSectEnter(&pCmdVbva->CltCritSect);
-    if (RT_FAILURE(rc))
-    {
-        WARN(("RTCritSectEnter failed %d\n", rc));
-        return rc;
-    }
+    AssertRCReturn(rc, rc);
 
     rc = vboxVBVAExHSLoadStateLocked(pCmdVbva, pu8VramBase, pSSM, u32Version);
     if (RT_FAILURE(rc))
-        WARN(("vboxVBVAExHSSaveStateLocked failed %d\n", rc));
+        WARN(("vboxVBVAExHSSaveStateLocked failed %Rrc\n", rc));
 
     RTCritSectLeave(&pCmdVbva->CltCritSect);
-
     return rc;
 }
 
-typedef enum
-{
-    VBVAEXHOSTCTL_SOURCE_GUEST = 0,
-    VBVAEXHOSTCTL_SOURCE_HOST
-} VBVAEXHOSTCTL_SOURCE;
-
-
+
+
+/**
+ * Queues a control command to the VDMA worker thread.
+ *
+ * The @a enmSource argument decides which list (guest/host) it's queued on.
+ *
+ */
 static int VBoxVBVAExHCtlSubmit(VBVAEXHOSTCONTEXT *pCmdVbva, VBVAEXHOSTCTL* pCtl, VBVAEXHOSTCTL_SOURCE enmSource,
                                 PFNVBVAEXHOSTCTL_COMPLETE pfnComplete, void *pvComplete)
 {
-    if (!VBoxVBVAExHSIsEnabled(pCmdVbva))
+    int rc;
+    if (VBoxVBVAExHSIsEnabled(pCmdVbva))
+    {
+        pCtl->pfnComplete = pfnComplete;
+        pCtl->pvComplete  = pvComplete;
+
+        rc = RTCritSectEnter(&pCmdVbva->CltCritSect);
+        if (RT_SUCCESS(rc))
+        {
+            /* Recheck that we're enabled after we've got the lock. */
+            if (VBoxVBVAExHSIsEnabled(pCmdVbva))
+            {
+                /* Queue it. */
+                if (enmSource > VBVAEXHOSTCTL_SOURCE_GUEST)
+                    RTListAppend(&pCmdVbva->HostCtlList, &pCtl->Node);
+                else
+                    RTListAppend(&pCmdVbva->GuestCtlList, &pCtl->Node);
+                ASMAtomicIncU32(&pCmdVbva->u32cCtls);
+
+                RTCritSectLeave(&pCmdVbva->CltCritSect);
+
+                /* Work the state or something. */
+                rc = VBoxVBVAExHSCheckCommands(pCmdVbva);
+            }
+            else
+            {
+                RTCritSectLeave(&pCmdVbva->CltCritSect);
+                Log(("cmd vbva not enabled (race)\n"));
+                rc = VERR_INVALID_STATE;
+            }
+        }
+        else
+            AssertRC(rc);
+    }
+    else
     {
         Log(("cmd vbva not enabled\n"));
-        return VERR_INVALID_STATE;
-    }
-
-    pCtl->pfnComplete = pfnComplete;
-    pCtl->pvComplete = pvComplete;
-
-    int rc = RTCritSectEnter(&pCmdVbva->CltCritSect);
+        rc = VERR_INVALID_STATE;
+    }
+    return rc;
+}
+
+/**
+ * Submits the control command and notifies the VDMA thread.
+ */
+static int vdmaVBVACtlSubmit(PVBOXVDMAHOST pVdma, VBVAEXHOSTCTL *pCtl, VBVAEXHOSTCTL_SOURCE enmSource,
+                             PFNVBVAEXHOSTCTL_COMPLETE pfnComplete, void *pvComplete)
+{
+    int rc = VBoxVBVAExHCtlSubmit(&pVdma->CmdVbva, pCtl, enmSource, pfnComplete, pvComplete);
     if (RT_SUCCESS(rc))
     {
-        if (!VBoxVBVAExHSIsEnabled(pCmdVbva))
-        {
-            Log(("cmd vbva not enabled\n"));
-            RTCritSectLeave(&pCmdVbva->CltCritSect);
-            return VERR_INVALID_STATE;
-        }
-
-        if (enmSource > VBVAEXHOSTCTL_SOURCE_GUEST)
-            RTListAppend(&pCmdVbva->HostCtlList, &pCtl->Node);
-        else
-            RTListAppend(&pCmdVbva->GuestCtlList, &pCtl->Node);
-
-        ASMAtomicIncU32(&pCmdVbva->u32cCtls);
-
-        RTCritSectLeave(&pCmdVbva->CltCritSect);
-
-        rc = VBoxVBVAExHSCheckCommands(pCmdVbva);
+        if (rc == VINF_SUCCESS)
+            return VBoxVDMAThreadEventNotify(&pVdma->Thread);
+        Assert(rc == VINF_ALREADY_INITIALIZED);
     }
     else
-        WARN(("RTCritSectEnter failed %d\n", rc));
+        Log(("VBoxVBVAExHCtlSubmit failed %Rrc\n", rc));
 
     return rc;
 }
+
 
 /**
@@ -870,8 +982,8 @@
     Assert(pThread->u32State == VBOXVDMATHREAD_STATE_CREATING);
     PFNVBOXVDMATHREAD_CHANGED pfnChanged = pThread->pfnChanged;
-    void *pvChanged = pThread->pvChanged;
+    void                     *pvChanged  = pThread->pvChanged;
 
     pThread->pfnChanged = NULL;
-    pThread->pvChanged = NULL;
+    pThread->pvChanged  = NULL;
 
     ASMAtomicWriteU32(&pThread->u32State, VBOXVDMATHREAD_STATE_CREATED);
@@ -888,8 +1000,8 @@
     Assert(pThread->u32State == VBOXVDMATHREAD_STATE_TERMINATING);
     PFNVBOXVDMATHREAD_CHANGED pfnChanged = pThread->pfnChanged;
-    void *pvChanged = pThread->pvChanged;
+    void                     *pvChanged  = pThread->pvChanged;
 
     pThread->pfnChanged = NULL;
-    pThread->pvChanged = NULL;
+    pThread->pvChanged  = NULL;
 
     if (pfnChanged)
@@ -910,5 +1022,5 @@
 void VBoxVDMAThreadInit(PVBOXVDMATHREAD pThread)
 {
-    memset(pThread, 0, sizeof (*pThread));
+    RT_ZERO(*pThread);
     pThread->u32State = VBOXVDMATHREAD_STATE_TERMINATED;
 }
@@ -924,18 +1036,20 @@
         case VBOXVDMATHREAD_STATE_TERMINATED:
             return VINF_SUCCESS;
+
         case VBOXVDMATHREAD_STATE_TERMINATING:
         {
             int rc = RTThreadWait(pThread->hWorkerThread, RT_INDEFINITE_WAIT, NULL);
-            if (!RT_SUCCESS(rc))
+            if (RT_SUCCESS(rc))
             {
-                WARN(("RTThreadWait failed %d\n", rc));
-                return rc;
+                RTSemEventDestroy(pThread->hEvent);
+                pThread->hEvent        = NIL_RTSEMEVENT;
+                pThread->hWorkerThread = NIL_RTTHREAD;
+                ASMAtomicWriteU32(&pThread->u32State, VBOXVDMATHREAD_STATE_TERMINATED);
             }
-
-            RTSemEventDestroy(pThread->hEvent);
-
-            ASMAtomicWriteU32(&pThread->u32State, VBOXVDMATHREAD_STATE_TERMINATED);
-            return VINF_SUCCESS;
-        }
+            else
+                WARN(("RTThreadWait failed %Rrc\n", rc));
+            return rc;
+        }
+
         default:
             WARN(("invalid state"));
@@ -951,32 +1065,30 @@
 {
     int rc = VBoxVDMAThreadCleanup(pThread);
-    if (RT_FAILURE(rc))
-    {
-        WARN(("VBoxVDMAThreadCleanup failed %d\n", rc));
-        return rc;
-    }
-
-    rc = RTSemEventCreate(&pThread->hEvent);
     if (RT_SUCCESS(rc))
     {
-        pThread->u32State = VBOXVDMATHREAD_STATE_CREATING;
+        rc = RTSemEventCreate(&pThread->hEvent);
+        pThread->u32State   = VBOXVDMATHREAD_STATE_CREATING;
         pThread->pfnChanged = pfnCreated;
-        pThread->pvChanged = pvCreated;
+        pThread->pvChanged  = pvCreated;
         rc = RTThreadCreate(&pThread->hWorkerThread, pfnThread, pvThread, 0, RTTHREADTYPE_IO, RTTHREADFLAGS_WAITABLE, "VDMA");
         if (RT_SUCCESS(rc))
             return VINF_SUCCESS;
-        WARN(("RTThreadCreate failed %d\n", rc));
-
+
+        WARN(("RTThreadCreate failed %Rrc\n", rc));
         RTSemEventDestroy(pThread->hEvent);
+        pThread->hEvent        = NIL_RTSEMEVENT;
+        pThread->hWorkerThread = NIL_RTTHREAD;
+        pThread->u32State      = VBOXVDMATHREAD_STATE_TERMINATED;
     }
     else
-        WARN(("RTSemEventCreate failed %d\n", rc));
-
-    pThread->u32State = VBOXVDMATHREAD_STATE_TERMINATED;
-
+        WARN(("VBoxVDMAThreadCleanup failed %Rrc\n", rc));
     return rc;
 }
 
-DECLINLINE(int) VBoxVDMAThreadEventNotify(PVBOXVDMATHREAD pThread)
+/**
+ * Notifies the VDMA thread.
+ * @thread !VDMA
+ */
+static int VBoxVDMAThreadEventNotify(PVBOXVDMATHREAD pThread)
 {
     int rc = RTSemEventSignal(pThread->hEvent);
@@ -985,15 +1097,14 @@
 }
 
-DECLINLINE(int) VBoxVDMAThreadEventWait(PVBOXVDMATHREAD pThread, RTMSINTERVAL cMillies)
-{
-    int rc = RTSemEventWait(pThread->hEvent, cMillies);
-    AssertRC(rc);
-    return rc;
-}
-
-int VBoxVDMAThreadTerm(PVBOXVDMATHREAD pThread, PFNVBOXVDMATHREAD_CHANGED pfnTerminated, void*pvTerminated, bool fNotify)
-{
-    int rc;
-    do
+/**
+ * State worker for VBVAEXHOSTCTL_TYPE_HH_ON_HGCM_UNLOAD &
+ * VBVAEXHOSTCTL_TYPE_GHH_DISABLE in vboxVDMACrHostCtlProcess(), and
+ * VBVAEXHOSTCTL_TYPE_GHH_DISABLE in vboxVDMACrGuestCtlProcess().
+ *
+ * @thread VDMA
+ */
+static int VBoxVDMAThreadTerm(PVBOXVDMATHREAD pThread, PFNVBOXVDMATHREAD_CHANGED pfnTerminated, void *pvTerminated, bool fNotify)
+{
+    for (;;)
     {
         uint32_t u32State = ASMAtomicUoReadU32(&pThread->u32State);
@@ -1002,104 +1113,174 @@
             case VBOXVDMATHREAD_STATE_CREATED:
                 pThread->pfnChanged = pfnTerminated;
-                pThread->pvChanged = pvTerminated;
+                pThread->pvChanged  = pvTerminated;
                 ASMAtomicWriteU32(&pThread->u32State, VBOXVDMATHREAD_STATE_TERMINATING);
                 if (fNotify)
                 {
-                    rc = VBoxVDMAThreadEventNotify(pThread);
+                    int rc = VBoxVDMAThreadEventNotify(pThread);
                     AssertRC(rc);
                 }
                 return VINF_SUCCESS;
+
             case VBOXVDMATHREAD_STATE_TERMINATING:
             case VBOXVDMATHREAD_STATE_TERMINATED:
-            {
                 WARN(("thread is marked to termination or terminated\nn"));
                 return VERR_INVALID_STATE;
-            }
+
             case VBOXVDMATHREAD_STATE_CREATING:
-            {
                 /* wait till the thread creation is completed */
                 WARN(("concurrent thread create/destron\n"));
                 RTThreadYield();
                 continue;
-            }
+
             default:
                 WARN(("invalid state"));
                 return VERR_INVALID_STATE;
         }
-    } while (1);
-
-    WARN(("should never be here\n"));
-    return VERR_INTERNAL_ERROR;
-}
-
-static int vdmaVBVACtlSubmitSync(PVBOXVDMAHOST pVdma, VBVAEXHOSTCTL *pCtl, VBVAEXHOSTCTL_SOURCE enmSource);
-
+    }
+}
+
+
+
+/*
+ *
+ *
+ * vboxVDMACrCtlPost / vboxVDMACrCtlPostAsync
+ * vboxVDMACrCtlPost / vboxVDMACrCtlPostAsync
+ * vboxVDMACrCtlPost / vboxVDMACrCtlPostAsync
+ *
+ *
+ */
+
+/** Completion callback for vboxVDMACrCtlPostAsync(). */
 typedef DECLCALLBACK(void) FNVBOXVDMACRCTL_CALLBACK(PVGASTATE pVGAState, PVBOXVDMACMD_CHROMIUM_CTL pCmd, void* pvContext);
+/** Pointer to a vboxVDMACrCtlPostAsync completion callback. */
 typedef FNVBOXVDMACRCTL_CALLBACK *PFNVBOXVDMACRCTL_CALLBACK;
 
+/**
+ * Private wrapper around VBOXVDMACMD_CHROMIUM_CTL.
+ */
 typedef struct VBOXVDMACMD_CHROMIUM_CTL_PRIVATE
 {
-    uint32_t cRefs;
-    int32_t rc;
-    PFNVBOXVDMACRCTL_CALLBACK pfnCompletion;
-    void *pvCompletion;
-    VBOXVDMACMD_CHROMIUM_CTL Cmd;
+    uint32_t                    uMagic; /**< VBOXVDMACMD_CHROMIUM_CTL_PRIVATE_MAGIC */
+    uint32_t                    cRefs;
+    int32_t volatile            rc;
+    PFNVBOXVDMACRCTL_CALLBACK   pfnCompletion;
+    void                       *pvCompletion;
+    RTSEMEVENT                  hEvtDone;
+    VBOXVDMACMD_CHROMIUM_CTL    Cmd;
 } VBOXVDMACMD_CHROMIUM_CTL_PRIVATE, *PVBOXVDMACMD_CHROMIUM_CTL_PRIVATE;
-
-# define VBOXVDMACMD_CHROMIUM_CTL_PRIVATE_FROM_CTL(_p) ((PVBOXVDMACMD_CHROMIUM_CTL_PRIVATE)(((uint8_t*)(_p)) - RT_OFFSETOF(VBOXVDMACMD_CHROMIUM_CTL_PRIVATE, Cmd)))
-
+/** Magic number for VBOXVDMACMD_CHROMIUM_CTL_PRIVATE (Michael Wolff). */
+# define VBOXVDMACMD_CHROMIUM_CTL_PRIVATE_MAGIC         UINT32_C(0x19530827)
+
+/** Converts from a VBOXVDMACMD_CHROMIUM_CTL::Cmd pointer to a pointer to the
+ * containing structure. */
+# define VBOXVDMACMD_CHROMIUM_CTL_PRIVATE_FROM_CTL(_p)  RT_FROM_MEMBER(pCmd, VBOXVDMACMD_CHROMIUM_CTL_PRIVATE, Cmd)
+
+/**
+ * Creates a VBOXVDMACMD_CHROMIUM_CTL_PRIVATE instance.
+ */
 static PVBOXVDMACMD_CHROMIUM_CTL vboxVDMACrCtlCreate(VBOXVDMACMD_CHROMIUM_CTL_TYPE enmCmd, uint32_t cbCmd)
 {
-    PVBOXVDMACMD_CHROMIUM_CTL_PRIVATE pHdr = (PVBOXVDMACMD_CHROMIUM_CTL_PRIVATE)RTMemAllocZ(cbCmd + RT_OFFSETOF(VBOXVDMACMD_CHROMIUM_CTL_PRIVATE, Cmd));
-    Assert(pHdr);
+    PVBOXVDMACMD_CHROMIUM_CTL_PRIVATE pHdr;
+    pHdr = (PVBOXVDMACMD_CHROMIUM_CTL_PRIVATE)RTMemAllocZ(cbCmd + RT_OFFSETOF(VBOXVDMACMD_CHROMIUM_CTL_PRIVATE, Cmd));
     if (pHdr)
     {
-        pHdr->cRefs = 1;
-        pHdr->rc = VERR_NOT_IMPLEMENTED;
+        pHdr->uMagic      = VBOXVDMACMD_CHROMIUM_CTL_PRIVATE_MAGIC;
+        pHdr->cRefs       = 1;
+        pHdr->rc          = VERR_NOT_IMPLEMENTED;
+        pHdr->hEvtDone    = NIL_RTSEMEVENT;
         pHdr->Cmd.enmType = enmCmd;
-        pHdr->Cmd.cbCmd = cbCmd;
+        pHdr->Cmd.cbCmd   = cbCmd;
         return &pHdr->Cmd;
     }
-
     return NULL;
 }
 
-DECLINLINE(void) vboxVDMACrCtlRelease (PVBOXVDMACMD_CHROMIUM_CTL pCmd)
+/**
+ * Releases a reference to a VBOXVDMACMD_CHROMIUM_CTL_PRIVATE instance.
+ */
+DECLINLINE(void) vboxVDMACrCtlRelease(PVBOXVDMACMD_CHROMIUM_CTL pCmd)
 {
     PVBOXVDMACMD_CHROMIUM_CTL_PRIVATE pHdr = VBOXVDMACMD_CHROMIUM_CTL_PRIVATE_FROM_CTL(pCmd);
+    Assert(pHdr->uMagic == VBOXVDMACMD_CHROMIUM_CTL_PRIVATE_MAGIC);
+
     uint32_t cRefs = ASMAtomicDecU32(&pHdr->cRefs);
     if (!cRefs)
+    {
+        pHdr->uMagic = ~VBOXVDMACMD_CHROMIUM_CTL_PRIVATE_MAGIC;
+        if (pHdr->hEvtDone != NIL_RTSEMEVENT)
+        {
+            RTSemEventDestroy(pHdr->hEvtDone);
+            pHdr->hEvtDone = NIL_RTSEMEVENT;
+        }
         RTMemFree(pHdr);
-}
-
-#if 0 /* unused */
+    }
+}
+
+/**
+ * Releases a reference to a VBOXVDMACMD_CHROMIUM_CTL_PRIVATE instance.
+ */
 DECLINLINE(void) vboxVDMACrCtlRetain(PVBOXVDMACMD_CHROMIUM_CTL pCmd)
 {
     PVBOXVDMACMD_CHROMIUM_CTL_PRIVATE pHdr = VBOXVDMACMD_CHROMIUM_CTL_PRIVATE_FROM_CTL(pCmd);
-    ASMAtomicIncU32(&pHdr->cRefs);
-}
-#endif /* unused */
-
-DECLINLINE(int) vboxVDMACrCtlGetRc (PVBOXVDMACMD_CHROMIUM_CTL pCmd)
+    Assert(pHdr->uMagic == VBOXVDMACMD_CHROMIUM_CTL_PRIVATE_MAGIC);
+
+    uint32_t cRefs = ASMAtomicIncU32(&pHdr->cRefs);
+    Assert(cRefs > 1);
+    Assert(cRefs < _1K);
+    RT_NOREF_PV(cRefs);
+}
+
+/**
+ * Gets the result from our private chromium control command.
+ *
+ * @returns status code.
+ * @param   pCmd                The command.
+ */
+DECLINLINE(int) vboxVDMACrCtlGetRc(PVBOXVDMACMD_CHROMIUM_CTL pCmd)
 {
     PVBOXVDMACMD_CHROMIUM_CTL_PRIVATE pHdr = VBOXVDMACMD_CHROMIUM_CTL_PRIVATE_FROM_CTL(pCmd);
+    Assert(pHdr->uMagic == VBOXVDMACMD_CHROMIUM_CTL_PRIVATE_MAGIC);
     return pHdr->rc;
 }
 
-static DECLCALLBACK(void) vboxVDMACrCtlCbSetEvent(PVGASTATE pVGAState, PVBOXVDMACMD_CHROMIUM_CTL pCmd, void* pvContext)
-{
+/**
+ * @interface_method_impl{PDMIDISPLAYVBVACALLBACKS,pfnCrHgsmiControlCompleteAsync,
+ *      Some indirect completion magic, you gotta love this code! }
+ */
+DECLCALLBACK(int) vboxVDMACrHgsmiControlCompleteAsync(PPDMIDISPLAYVBVACALLBACKS pInterface, PVBOXVDMACMD_CHROMIUM_CTL pCmd, int rc)
+{
+    PVGASTATE                           pVGAState = PPDMIDISPLAYVBVACALLBACKS_2_PVGASTATE(pInterface);
+    PVBOXVDMACMD_CHROMIUM_CTL_PRIVATE   pHdr      = VBOXVDMACMD_CHROMIUM_CTL_PRIVATE_FROM_CTL(pCmd);
+    Assert(pHdr->uMagic == VBOXVDMACMD_CHROMIUM_CTL_PRIVATE_MAGIC);
+
+    pHdr->rc = rc;
+    if (pHdr->pfnCompletion)
+        pHdr->pfnCompletion(pVGAState, pCmd, pHdr->pvCompletion);
+    return VINF_SUCCESS;
+}
+
+/**
+ * @callback_method_impl{FNCRCTLCOMPLETION,
+ *      Completion callback for vboxVDMACrCtlPost. }
+ */
+static DECLCALLBACK(void) vboxVDMACrCtlCbSetEvent(PVGASTATE pVGAState, PVBOXVDMACMD_CHROMIUM_CTL pCmd, void *pvContext)
+{
+    PVBOXVDMACMD_CHROMIUM_CTL_PRIVATE pHdr = (PVBOXVDMACMD_CHROMIUM_CTL_PRIVATE)pvContext;
+    Assert(pHdr == VBOXVDMACMD_CHROMIUM_CTL_PRIVATE_FROM_CTL(pCmd));
+    Assert(pHdr->uMagic == VBOXVDMACMD_CHROMIUM_CTL_PRIVATE_MAGIC);
     RT_NOREF(pVGAState, pCmd);
-    RTSemEventSignal((RTSEMEVENT)pvContext);
-}
-
-# if 0 /** @todo vboxVDMACrCtlCbReleaseCmd is unused */
-static DECLCALLBACK(void) vboxVDMACrCtlCbReleaseCmd(PVGASTATE pVGAState, PVBOXVDMACMD_CHROMIUM_CTL pCmd, void* pvContext)
-{
-    RT_NOREF(pVGAState, pvContext);
-    vboxVDMACrCtlRelease(pCmd);
-}
-# endif
-
-static int vboxVDMACrCtlPostAsync (PVGASTATE pVGAState, PVBOXVDMACMD_CHROMIUM_CTL pCmd, uint32_t cbCmd, PFNVBOXVDMACRCTL_CALLBACK pfnCompletion, void *pvCompletion)
+
+    int rc = RTSemEventSignal(pHdr->hEvtDone);
+    AssertRC(rc);
+
+    vboxVDMACrCtlRelease(&pHdr->Cmd);
+}
+
+/**
+ * Worker for vboxVDMACrCtlPost().
+ */
+static int vboxVDMACrCtlPostAsync(PVGASTATE pVGAState, PVBOXVDMACMD_CHROMIUM_CTL pCmd, uint32_t cbCmd,
+                                  PFNVBOXVDMACRCTL_CALLBACK pfnCompletion, void *pvCompletion)
 {
     if (   pVGAState->pDrv
@@ -1108,11 +1289,8 @@
         PVBOXVDMACMD_CHROMIUM_CTL_PRIVATE pHdr = VBOXVDMACMD_CHROMIUM_CTL_PRIVATE_FROM_CTL(pCmd);
         pHdr->pfnCompletion = pfnCompletion;
-        pHdr->pvCompletion = pvCompletion;
+        pHdr->pvCompletion  = pvCompletion;
         pVGAState->pDrv->pfnCrHgsmiControlProcess(pVGAState->pDrv, pCmd, cbCmd);
         return VINF_SUCCESS;
     }
-# ifdef DEBUG_misha
-    Assert(0);
-# endif
     return VERR_NOT_SUPPORTED;
 }
@@ -1123,47 +1301,56 @@
 static int vboxVDMACrCtlPost(PVGASTATE pVGAState, PVBOXVDMACMD_CHROMIUM_CTL pCmd, uint32_t cbCmd)
 {
-    RTSEMEVENT hComplEvent;
-    int rc = RTSemEventCreate(&hComplEvent);
+    PVBOXVDMACMD_CHROMIUM_CTL_PRIVATE pHdr = VBOXVDMACMD_CHROMIUM_CTL_PRIVATE_FROM_CTL(pCmd);
+
+    /* Allocate the semaphore. */
+    Assert(pHdr->hEvtDone == NIL_RTSEMEVENT);
+    int rc = RTSemEventCreate(&pHdr->hEvtDone);
+    AssertRCReturn(rc, rc);
+
+    /* Grab a reference for the completion routine. */
+    vboxVDMACrCtlRetain(&pHdr->Cmd);
+
+    /* Submit and wait for it. */
+    rc = vboxVDMACrCtlPostAsync(pVGAState, pCmd, cbCmd, vboxVDMACrCtlCbSetEvent, pHdr);
     AssertRC(rc);
     if (RT_SUCCESS(rc))
-    {
-        rc = vboxVDMACrCtlPostAsync(pVGAState, pCmd, cbCmd, vboxVDMACrCtlCbSetEvent, (void*)hComplEvent);
-# ifdef DEBUG_misha
-        AssertRC(rc);
-# endif
-        if (RT_SUCCESS(rc))
-        {
-            rc = RTSemEventWaitNoResume(hComplEvent, RT_INDEFINITE_WAIT);
-            AssertRC(rc);
-            if (RT_SUCCESS(rc))
-            {
-                RTSemEventDestroy(hComplEvent);
-            }
-        }
-        else
-        {
-            /* the command is completed */
-            RTSemEventDestroy(hComplEvent);
-        }
-    }
+        rc = RTSemEventWaitNoResume(pHdr->hEvtDone, RT_INDEFINITE_WAIT);
+    else
+        vboxVDMACrCtlRelease(pCmd);
     return rc;
 }
 
+
+/**
+ * Structure for passing data between vboxVDMACrHgcmSubmitSync() and the
+ * completion routine vboxVDMACrHgcmSubmitSyncCompletion().
+ */
 typedef struct VDMA_VBVA_CTL_CYNC_COMPLETION
 {
-    int rc;
+    int volatile rc;
     RTSEMEVENT hEvent;
 } VDMA_VBVA_CTL_CYNC_COMPLETION;
 
-static DECLCALLBACK(void) vboxVDMACrHgcmSubmitSyncCompletion(struct VBOXCRCMDCTL* pCmd, uint32_t cbCmd, int rc, void *pvCompletion)
-{
-    RT_NOREF(pCmd, cbCmd);
+/**
+ * @callback_method_impl{FNCRCTLCOMPLETION,
+ *      Completion callback for vboxVDMACrHgcmSubmitSync() that signals the
+ *      waiting thread.}
+ */
+static DECLCALLBACK(void) vboxVDMACrHgcmSubmitSyncCompletion(struct VBOXCRCMDCTL *pCmd, uint32_t cbCmd, int rc, void *pvCompletion)
+{
     VDMA_VBVA_CTL_CYNC_COMPLETION *pData = (VDMA_VBVA_CTL_CYNC_COMPLETION*)pvCompletion;
     pData->rc = rc;
     rc = RTSemEventSignal(pData->hEvent);
-    if (!RT_SUCCESS(rc))
-        WARN(("RTSemEventSignal failed %d\n", rc));
-}
-
+    AssertLogRelRC(rc);
+
+    RT_NOREF(pCmd, cbCmd);
+}
+
+/**
+ * Worker for vboxVDMACrHgcmHandleEnable() and vdmaVBVAEnableProcess() that
+ * works pVGAState->pDrv->pfnCrHgcmCtlSubmit.
+ *
+ * @thread VDMA
+ */
 static int vboxVDMACrHgcmSubmitSync(struct VBOXVDMAHOST *pVdma, VBOXCRCMDCTL* pCtl, uint32_t cbCtl)
 {
@@ -1173,5 +1360,5 @@
     if (!RT_SUCCESS(rc))
     {
-        WARN(("RTSemEventCreate failed %d\n", rc));
+        WARN(("RTSemEventCreate failed %Rrc\n", rc));
         return rc;
     }
@@ -1189,13 +1376,13 @@
             if (!RT_SUCCESS(rc))
             {
-                WARN(("pfnCrHgcmCtlSubmit command failed %d\n", rc));
+                WARN(("pfnCrHgcmCtlSubmit command failed %Rrc\n", rc));
             }
 
         }
         else
-            WARN(("RTSemEventWait failed %d\n", rc));
+            WARN(("RTSemEventWait failed %Rrc\n", rc));
     }
     else
-        WARN(("pfnCrHgcmCtlSubmit failed %d\n", rc));
+        WARN(("pfnCrHgcmCtlSubmit failed %Rrc\n", rc));
 
 
@@ -1205,32 +1392,37 @@
 }
 
+
+/**
+ * Worker for vboxVDMAReset().
+ */
 static int vdmaVBVACtlDisableSync(PVBOXVDMAHOST pVdma)
 {
     VBVAEXHOSTCTL HCtl;
+    RT_ZERO(HCtl);
     HCtl.enmType = VBVAEXHOSTCTL_TYPE_GHH_DISABLE;
     int rc = vdmaVBVACtlSubmitSync(pVdma, &HCtl, VBVAEXHOSTCTL_SOURCE_HOST);
-    if (RT_FAILURE(rc))
-    {
-        Log(("vdmaVBVACtlSubmitSync failed %d\n", rc));
-        return rc;
-    }
-
-    vgaUpdateDisplayAll(pVdma->pVGAState, /* fFailOnResize = */ false);
-
-    return VINF_SUCCESS;
-}
-
-static DECLCALLBACK(uint8_t*) vboxVDMACrHgcmHandleEnableRemainingHostCommand(HVBOXCRCMDCTL_REMAINING_HOST_COMMAND hClient, uint32_t *pcbCtl, int prevCmdRc)
+    if (RT_SUCCESS(rc))
+        vgaUpdateDisplayAll(pVdma->pVGAState, /* fFailOnResize = */ false);
+    else
+        Log(("vdmaVBVACtlSubmitSync failed %Rrc\n", rc));
+    return rc;
+}
+
+
+/**
+ * @interface_method_impl{VBOXCRCMDCTL_HGCMENABLE_DATA,pfnRHCmd,
+ *      Used by vboxVDMACrHgcmNotifyTerminatingCb() and called by
+ *      crVBoxServerCrCmdDisablePostProcess() during crServerTearDown() to drain
+ *      command queues or something.}
+ */
+static DECLCALLBACK(uint8_t *)
+vboxVDMACrHgcmHandleEnableRemainingHostCommand(HVBOXCRCMDCTL_REMAINING_HOST_COMMAND hClient, uint32_t *pcbCtl, int prevCmdRc)
 {
     struct VBOXVDMAHOST *pVdma = hClient;
+
     if (!pVdma->pCurRemainingHostCtl)
-    {
-        /* disable VBVA, all subsequent host commands will go HGCM way */
-        VBoxVBVAExHSDisable(&pVdma->CmdVbva);
-    }
+        VBoxVBVAExHSDisable(&pVdma->CmdVbva); /* disable VBVA, all subsequent host commands will go HGCM way */
     else
-    {
         VBoxVBVAExHPDataCompleteCtl(&pVdma->CmdVbva, pVdma->pCurRemainingHostCtl, prevCmdRc);
-    }
 
     pVdma->pCurRemainingHostCtl = VBoxVBVAExHPCheckHostCtlOnDisable(&pVdma->CmdVbva);
@@ -1245,4 +1437,8 @@
 }
 
+/**
+ * @interface_method_impl{VBOXCRCMDCTL_HGCMDISABLE_DATA,pfnNotifyTermDone,
+ *      Called by crServerTearDown().}
+ */
 static DECLCALLBACK(void) vboxVDMACrHgcmNotifyTerminatingDoneCb(HVBOXCRCMDCTL_NOTIFY_TERMINATING hClient)
 {
@@ -1256,30 +1452,40 @@
 }
 
-static DECLCALLBACK(int) vboxVDMACrHgcmNotifyTerminatingCb(HVBOXCRCMDCTL_NOTIFY_TERMINATING hClient, VBOXCRCMDCTL_HGCMENABLE_DATA *pHgcmEnableData)
+/**
+ * @interface_method_impl{VBOXCRCMDCTL_HGCMDISABLE_DATA,pfnNotifyTerm,
+ *      Called by crServerTearDown().}
+ */
+static DECLCALLBACK(int) vboxVDMACrHgcmNotifyTerminatingCb(HVBOXCRCMDCTL_NOTIFY_TERMINATING hClient,
+                                                           VBOXCRCMDCTL_HGCMENABLE_DATA *pHgcmEnableData)
 {
     struct VBOXVDMAHOST *pVdma = hClient;
+
     VBVAEXHOSTCTL HCtl;
+    RT_ZERO(HCtl);
     HCtl.enmType = VBVAEXHOSTCTL_TYPE_HH_ON_HGCM_UNLOAD;
     int rc = vdmaVBVACtlSubmitSync(pVdma, &HCtl, VBVAEXHOSTCTL_SOURCE_HOST);
 
-    pHgcmEnableData->hRHCmd = pVdma;
+    pHgcmEnableData->hRHCmd   = pVdma;
     pHgcmEnableData->pfnRHCmd = vboxVDMACrHgcmHandleEnableRemainingHostCommand;
 
-    if (RT_FAILURE(rc))
-    {
-        if (rc == VERR_INVALID_STATE)
-            rc = VINF_SUCCESS;
-        else
-            WARN(("vdmaVBVACtlSubmitSync failed %d\n", rc));
-    }
+    if (rc == VERR_INVALID_STATE)
+        rc = VINF_SUCCESS;
+    else if (RT_FAILURE(rc))
+        WARN(("vdmaVBVACtlSubmitSync failed %Rrc\n", rc));
 
     return rc;
 }
 
+/**
+ * Worker for vdmaVBVAEnableProcess() and vdmaVBVADisableProcess().
+ *
+ * @thread VDMA
+ */
 static int vboxVDMACrHgcmHandleEnable(struct VBOXVDMAHOST *pVdma)
 {
     VBOXCRCMDCTL_ENABLE Enable;
-    Enable.Hdr.enmType = VBOXCRCMDCTL_TYPE_ENABLE;
-    Enable.Data.hRHCmd = pVdma;
+    RT_ZERO(Enable);
+    Enable.Hdr.enmType   = VBOXCRCMDCTL_TYPE_ENABLE;
+    Enable.Data.hRHCmd   = pVdma;
     Enable.Data.pfnRHCmd = vboxVDMACrHgcmHandleEnableRemainingHostCommand;
 
@@ -1293,9 +1499,14 @@
 
     Assert(VBoxVBVAExHSIsEnabled(&pVdma->CmdVbva));
-    WARN(("vboxVDMACrHgcmSubmitSync failed %d\n", rc));
-
+    WARN(("vboxVDMACrHgcmSubmitSync failed %Rrc\n", rc));
     return rc;
 }
 
+/**
+ * Handles VBVAEXHOSTCTL_TYPE_GHH_ENABLE and VBVAEXHOSTCTL_TYPE_GHH_ENABLE_PAUSED
+ * for vboxVDMACrGuestCtlProcess().
+ *
+ * @thread VDMA
+ */
 static int vdmaVBVAEnableProcess(struct VBOXVDMAHOST *pVdma, uint32_t u32Offset)
 {
@@ -1306,8 +1517,9 @@
     }
 
+/** @todo r=bird: This needs a closer look! */
     VBVABUFFER *pVBVA = (VBVABUFFER *)HGSMIOffsetToPointerHost(pVdma->pHgsmi, u32Offset);
     if (!pVBVA)
     {
-        WARN(("invalid offset %d\n", u32Offset));
+        WARN(("invalid offset %d (%#x)\n", u32Offset, u32Offset));
         return VERR_INVALID_PARAMETER;
     }
@@ -1323,7 +1535,7 @@
 
         VBOXCRCMDCTL_DISABLE Disable;
-        Disable.Hdr.enmType = VBOXCRCMDCTL_TYPE_DISABLE;
-        Disable.Data.hNotifyTerm = pVdma;
-        Disable.Data.pfnNotifyTerm = vboxVDMACrHgcmNotifyTerminatingCb;
+        Disable.Hdr.enmType            = VBOXCRCMDCTL_TYPE_DISABLE;
+        Disable.Data.hNotifyTerm       = pVdma;
+        Disable.Data.pfnNotifyTerm     = vboxVDMACrHgcmNotifyTerminatingCb;
         Disable.Data.pfnNotifyTermDone = vboxVDMACrHgcmNotifyTerminatingDoneCb;
         rc = vboxVDMACrHgcmSubmitSync(pVdma, &Disable.Hdr, sizeof (Disable));
@@ -1332,27 +1544,34 @@
             PVGASTATE pVGAState = pVdma->pVGAState;
             VBOXCRCMD_SVRENABLE_INFO Info;
-            Info.hCltScr = pVGAState->pDrv;
-            Info.pfnCltScrUpdateBegin = pVGAState->pDrv->pfnVBVAUpdateBegin;
+            Info.hCltScr                = pVGAState->pDrv;
+            Info.pfnCltScrUpdateBegin   = pVGAState->pDrv->pfnVBVAUpdateBegin;
             Info.pfnCltScrUpdateProcess = pVGAState->pDrv->pfnVBVAUpdateProcess;
-            Info.pfnCltScrUpdateEnd = pVGAState->pDrv->pfnVBVAUpdateEnd;
+            Info.pfnCltScrUpdateEnd     = pVGAState->pDrv->pfnVBVAUpdateEnd;
             rc = pVdma->CrSrvInfo.pfnEnable(pVdma->CrSrvInfo.hSvr, &Info);
             if (RT_SUCCESS(rc))
                 return VINF_SUCCESS;
-            else
-                WARN(("pfnEnable failed %d\n", rc));
-
+
+            WARN(("pfnEnable failed %Rrc\n", rc));
             vboxVDMACrHgcmHandleEnable(pVdma);
         }
         else
-            WARN(("vboxVDMACrHgcmSubmitSync failed %d\n", rc));
+            WARN(("vboxVDMACrHgcmSubmitSync failed %Rrc\n", rc));
 
         VBoxVBVAExHSDisable(&pVdma->CmdVbva);
     }
     else
-        WARN(("VBoxVBVAExHSEnable failed %d\n", rc));
+        WARN(("VBoxVBVAExHSEnable failed %Rrc\n", rc));
 
     return rc;
 }
 
+/**
+ * Worker for several vboxVDMACrHostCtlProcess() commands.
+ *
+ * @returns IPRT status code.
+ * @param   pVdma           The VDMA channel.
+ * @param   fDoHgcmEnable   ???
+ * @thread  VDMA
+ */
 static int vdmaVBVADisableProcess(struct VBOXVDMAHOST *pVdma, bool fDoHgcmEnable)
 {
@@ -1388,142 +1607,130 @@
 
             VBOXCRCMD_SVRENABLE_INFO Info;
-            Info.hCltScr = pVGAState->pDrv;
-            Info.pfnCltScrUpdateBegin = pVGAState->pDrv->pfnVBVAUpdateBegin;
+            Info.hCltScr                = pVGAState->pDrv;
+            Info.pfnCltScrUpdateBegin   = pVGAState->pDrv->pfnVBVAUpdateBegin;
             Info.pfnCltScrUpdateProcess = pVGAState->pDrv->pfnVBVAUpdateProcess;
-            Info.pfnCltScrUpdateEnd = pVGAState->pDrv->pfnVBVAUpdateEnd;
-            pVdma->CrSrvInfo.pfnEnable(pVdma->CrSrvInfo.hSvr, &Info);
+            Info.pfnCltScrUpdateEnd     = pVGAState->pDrv->pfnVBVAUpdateEnd;
+            pVdma->CrSrvInfo.pfnEnable(pVdma->CrSrvInfo.hSvr, &Info); /** @todo ignoring return code */
         }
     }
     else
-        WARN(("pfnDisable failed %d\n", rc));
+        WARN(("pfnDisable failed %Rrc\n", rc));
 
     return rc;
 }
 
+/**
+ * Handles VBVAEXHOST_DATA_TYPE_HOSTCTL for vboxVDMAWorkerThread.
+ *
+ * @returns VBox status code.
+ * @param   pVdma                   The VDMA channel.
+ * @param   pCmd                    The control command to process.  Should be
+ *                                  safe, i.e. not shared with guest.
+ * @param   pfContinue              Where to return whether to continue or not.
+ * @thread  VDMA
+ */
 static int vboxVDMACrHostCtlProcess(struct VBOXVDMAHOST *pVdma, VBVAEXHOSTCTL *pCmd, bool *pfContinue)
 {
     *pfContinue = true;
 
+    int rc;
     switch (pCmd->enmType)
     {
+        /*
+         * See vdmaVBVACtlOpaqueHostSubmit() and its callers.
+         */
         case VBVAEXHOSTCTL_TYPE_GHH_BE_OPAQUE:
-        {
-            if (!VBoxVBVAExHSIsEnabled(&pVdma->CmdVbva))
+            if (VBoxVBVAExHSIsEnabled(&pVdma->CmdVbva))
             {
+                if (pVdma->CrSrvInfo.pfnHostCtl)
+                    return pVdma->CrSrvInfo.pfnHostCtl(pVdma->CrSrvInfo.hSvr, pCmd->u.cmd.pu8Cmd, pCmd->u.cmd.cbCmd);
                 WARN(("VBVAEXHOSTCTL_TYPE_GHH_BE_OPAQUE for disabled vdma VBVA\n"));
-                return VERR_INVALID_STATE;
             }
-            if (!pVdma->CrSrvInfo.pfnHostCtl)
+            else
+                WARN(("VBVAEXHOSTCTL_TYPE_GHH_BE_OPAQUE for HGCM-less mode\n"));
+            return VERR_INVALID_STATE;
+
+        /*
+         * See vdmaVBVACtlDisableSync().
+         */
+        case VBVAEXHOSTCTL_TYPE_GHH_DISABLE:
+            rc = vdmaVBVADisableProcess(pVdma, true /* fDoHgcmEnable */);
+            if (RT_SUCCESS(rc))
+                rc = VBoxVDMAThreadTerm(&pVdma->Thread, NULL, NULL, false /* fNotify */ );
+            else
+                WARN(("vdmaVBVADisableProcess failed %Rrc\n", rc));
+            return rc;
+
+        /*
+         * See vboxVDMACrHgcmNotifyTerminatingCb().
+         */
+        case VBVAEXHOSTCTL_TYPE_HH_ON_HGCM_UNLOAD:
+            rc = vdmaVBVADisableProcess(pVdma, false /* fDoHgcmEnable */);
+            if (RT_SUCCESS(rc))
             {
-                /* Should not be. */
-                WARN(("VBVAEXHOSTCTL_TYPE_GHH_BE_OPAQUE for HGCM-less mode\n"));
-                return VERR_INVALID_STATE;
+                rc = VBoxVDMAThreadTerm(&pVdma->Thread, NULL, NULL, true /* fNotify */);
+                if (RT_SUCCESS(rc))
+                    *pfContinue = false;
+                else
+                    WARN(("VBoxVDMAThreadTerm failed %Rrc\n", rc));
             }
-            return pVdma->CrSrvInfo.pfnHostCtl(pVdma->CrSrvInfo.hSvr, pCmd->u.cmd.pu8Cmd, pCmd->u.cmd.cbCmd);
-        }
-        case VBVAEXHOSTCTL_TYPE_GHH_DISABLE:
-        {
-            int rc = vdmaVBVADisableProcess(pVdma, true);
-            if (RT_FAILURE(rc))
+            else
+                WARN(("vdmaVBVADisableProcess failed %Rrc\n", rc));
+            return rc;
+
+        /*
+         * See vboxVDMASaveStateExecPerform().
+         */
+        case VBVAEXHOSTCTL_TYPE_HH_SAVESTATE:
+            rc = VBoxVBVAExHSSaveState(&pVdma->CmdVbva, pVdma->pVGAState->vram_ptrR3, pCmd->u.state.pSSM);
+            if (RT_SUCCESS(rc))
             {
-                WARN(("vdmaVBVADisableProcess failed %d\n", rc));
-                return rc;
+                VGA_SAVED_STATE_PUT_MARKER(pCmd->u.state.pSSM, 4);
+                if (pVdma->CrSrvInfo.pfnSaveState)
+                    rc = pVdma->CrSrvInfo.pfnSaveState(pVdma->CrSrvInfo.hSvr, pCmd->u.state.pSSM);
             }
-
-            return VBoxVDMAThreadTerm(&pVdma->Thread, NULL, NULL, false);
-        }
-        case VBVAEXHOSTCTL_TYPE_HH_ON_HGCM_UNLOAD:
-        {
-            int rc = vdmaVBVADisableProcess(pVdma, false);
-            if (RT_FAILURE(rc))
+            else
+                WARN(("VBoxVBVAExHSSaveState failed %Rrc\n", rc));
+            return rc;
+
+        /*
+         * See vboxVDMASaveLoadExecPerform().
+         */
+        case VBVAEXHOSTCTL_TYPE_HH_LOADSTATE:
+            rc = VBoxVBVAExHSLoadState(&pVdma->CmdVbva, pVdma->pVGAState->vram_ptrR3, pCmd->u.state.pSSM, pCmd->u.state.u32Version);
+            if (RT_SUCCESS(rc))
             {
-                WARN(("vdmaVBVADisableProcess failed %d\n", rc));
-                return rc;
+                VGA_SAVED_STATE_GET_MARKER_RETURN_ON_MISMATCH(pCmd->u.state.pSSM, pCmd->u.state.u32Version, 4);
+                if (pVdma->CrSrvInfo.pfnLoadState)
+                {
+                    rc = pVdma->CrSrvInfo.pfnLoadState(pVdma->CrSrvInfo.hSvr, pCmd->u.state.pSSM, pCmd->u.state.u32Version);
+                    if (RT_FAILURE(rc))
+                        WARN(("pfnLoadState failed %Rrc\n", rc));
+                }
             }
-
-            rc = VBoxVDMAThreadTerm(&pVdma->Thread, NULL, NULL, true);
-            if (RT_FAILURE(rc))
-            {
-                WARN(("VBoxVDMAThreadTerm failed %d\n", rc));
-                return rc;
-            }
-
-            *pfContinue = false;
-            return VINF_SUCCESS;
-        }
-        case VBVAEXHOSTCTL_TYPE_HH_SAVESTATE:
+            else
+                WARN(("VBoxVBVAExHSLoadState failed %Rrc\n", rc));
+            return rc;
+
+        /*
+         * See vboxVDMASaveLoadDone().
+         */
+        case VBVAEXHOSTCTL_TYPE_HH_LOADSTATE_DONE:
         {
             PVGASTATE pVGAState = pVdma->pVGAState;
-            uint8_t * pu8VramBase = pVGAState->vram_ptrR3;
-            int rc = VBoxVBVAExHSSaveState(&pVdma->CmdVbva, pu8VramBase, pCmd->u.state.pSSM);
-            if (RT_FAILURE(rc))
-            {
-                WARN(("VBoxVBVAExHSSaveState failed %d\n", rc));
-                return rc;
-            }
-            VGA_SAVED_STATE_PUT_MARKER(pCmd->u.state.pSSM, 4);
-
-            if (!pVdma->CrSrvInfo.pfnSaveState)
-            {
-                /* Done. */
-                return VINF_SUCCESS;
-            }
-
-            return pVdma->CrSrvInfo.pfnSaveState(pVdma->CrSrvInfo.hSvr, pCmd->u.state.pSSM);
-        }
-        case VBVAEXHOSTCTL_TYPE_HH_LOADSTATE:
-        {
-            PVGASTATE pVGAState = pVdma->pVGAState;
-            uint8_t * pu8VramBase = pVGAState->vram_ptrR3;
-
-            int rc = VBoxVBVAExHSLoadState(&pVdma->CmdVbva, pu8VramBase, pCmd->u.state.pSSM, pCmd->u.state.u32Version);
-            if (RT_FAILURE(rc))
-            {
-                WARN(("VBoxVBVAExHSSaveState failed %d\n", rc));
-                return rc;
-            }
-
-            VGA_SAVED_STATE_GET_MARKER_RETURN_ON_MISMATCH(pCmd->u.state.pSSM, pCmd->u.state.u32Version, 4);
-            if (!pVdma->CrSrvInfo.pfnLoadState)
-            {
-                /* Done. */
-                return VINF_SUCCESS;
-            }
-
-            rc = pVdma->CrSrvInfo.pfnLoadState(pVdma->CrSrvInfo.hSvr, pCmd->u.state.pSSM, pCmd->u.state.u32Version);
-            if (RT_FAILURE(rc))
-            {
-                WARN(("pfnLoadState failed %d\n", rc));
-                return rc;
-            }
-
-            return VINF_SUCCESS;
-        }
-        case VBVAEXHOSTCTL_TYPE_HH_LOADSTATE_DONE:
-        {
-            PVGASTATE pVGAState = pVdma->pVGAState;
-
             for (uint32_t i = 0; i < pVGAState->cMonitors; ++i)
             {
                 VBVAINFOSCREEN CurScreen;
-                VBVAINFOVIEW CurView;
-
-                int rc = VBVAGetInfoViewAndScreen(pVGAState, i, &CurView, &CurScreen);
-                if (RT_FAILURE(rc))
-                {
-                    WARN(("VBVAGetInfoViewAndScreen failed %d\n", rc));
-                    return rc;
-                }
+                VBVAINFOVIEW   CurView;
+                rc = VBVAGetInfoViewAndScreen(pVGAState, i, &CurView, &CurScreen);
+                AssertLogRelMsgRCReturn(rc, ("VBVAGetInfoViewAndScreen [screen #%u] -> %#x\n", i, rc), rc);
 
                 rc = VBVAInfoScreen(pVGAState, &CurScreen);
-                if (RT_FAILURE(rc))
-                {
-                    WARN(("VBVAInfoScreen failed %d\n", rc));
-                    return rc;
-                }
+                AssertLogRelMsgRCReturn(rc, ("VBVAInfoScreen [screen #%u] -> %#x\n", i, rc), rc);
             }
 
             return VINF_SUCCESS;
         }
+
         default:
             WARN(("unexpected host ctl type %d\n", pCmd->enmType));
@@ -1532,17 +1739,24 @@
 }
 
+/**
+ * Worker for vboxVDMACrGuestCtlResizeEntryProcess.
+ *
+ * @returns VINF_SUCCESS or VERR_INVALID_PARAMETER.
+ * @param   pVGAState           The VGA device state.
+ * @param   pScreen             The screen info (safe copy).
+ */
 static int vboxVDMASetupScreenInfo(PVGASTATE pVGAState, VBVAINFOSCREEN *pScreen)
 {
-    const uint32_t u32ViewIndex = pScreen->u32ViewIndex;
-    const uint16_t u16Flags = pScreen->u16Flags;
-
-    if (u16Flags & VBVA_SCREEN_F_DISABLED)
-    {
-        if (   u32ViewIndex < pVGAState->cMonitors
-            || u32ViewIndex == UINT32_C(0xFFFFFFFF))
+    const uint32_t idxView = pScreen->u32ViewIndex;
+    const uint16_t fFlags  = pScreen->u16Flags;
+
+    if (fFlags & VBVA_SCREEN_F_DISABLED)
+    {
+        if (   idxView < pVGAState->cMonitors
+            || idxView == UINT32_C(0xFFFFFFFF))
         {
             RT_ZERO(*pScreen);
-            pScreen->u32ViewIndex = u32ViewIndex;
-            pScreen->u16Flags = VBVA_SCREEN_F_ACTIVE | VBVA_SCREEN_F_DISABLED;
+            pScreen->u32ViewIndex = idxView;
+            pScreen->u16Flags     = VBVA_SCREEN_F_ACTIVE | VBVA_SCREEN_F_DISABLED;
             return VINF_SUCCESS;
         }
@@ -1550,11 +1764,9 @@
     else
     {
-        if (u16Flags & VBVA_SCREEN_F_BLANK2)
-        {
-            if (   u32ViewIndex >= pVGAState->cMonitors
-                && u32ViewIndex != UINT32_C(0xFFFFFFFF))
-            {
+        if (fFlags & VBVA_SCREEN_F_BLANK2)
+        {
+            if (   idxView >= pVGAState->cMonitors
+                && idxView != UINT32_C(0xFFFFFFFF))
                 return VERR_INVALID_PARAMETER;
-            }
 
             /* Special case for blanking using current video mode.
@@ -1562,10 +1774,10 @@
              */
             RT_ZERO(*pScreen);
-            pScreen->u32ViewIndex = u32ViewIndex;
-            pScreen->u16Flags = u16Flags;
+            pScreen->u32ViewIndex = idxView;
+            pScreen->u16Flags     = fFlags;
             return VINF_SUCCESS;
         }
 
-        if (   u32ViewIndex < pVGAState->cMonitors
+        if (   idxView < pVGAState->cMonitors
             && pScreen->u16BitsPerPixel <= 32
             && pScreen->u32Width <= UINT16_MAX
@@ -1578,13 +1790,12 @@
                 const uint64_t u64ScreenSize = (uint64_t)pScreen->u32LineSize * pScreen->u32Height;
                 if (   pScreen->u32StartOffset <= pVGAState->vram_size
-                    && u64ScreenSize <= pVGAState->vram_size
+                    && u64ScreenSize           <= pVGAState->vram_size
                     && pScreen->u32StartOffset <= pVGAState->vram_size - (uint32_t)u64ScreenSize)
-                {
                     return VINF_SUCCESS;
-                }
             }
         }
     }
 
+    LogFunc(("Failed\n"));
     return VERR_INVALID_PARAMETER;
 }
@@ -1622,5 +1833,5 @@
         if (RT_FAILURE(rc))
         {
-            WARN(("pfnResize failed %d\n", rc));
+            WARN(("pfnResize failed %Rrc\n", rc));
             return rc;
         }
@@ -1629,6 +1840,6 @@
     /* A fake view which contains the current screen for the 2D VBVAInfoView. */
     VBVAINFOVIEW View;
-    View.u32ViewOffset = 0;
-    View.u32ViewSize = Screen.u32LineSize * Screen.u32Height + Screen.u32StartOffset;
+    View.u32ViewOffset    = 0;
+    View.u32ViewSize      = Screen.u32LineSize * Screen.u32Height + Screen.u32StartOffset;
     View.u32MaxScreenSize = Screen.u32LineSize * Screen.u32Height;
 
@@ -1636,6 +1847,6 @@
 
     for (int i = ASMBitFirstSet(aTargetMap, pVGAState->cMonitors);
-            i >= 0;
-            i = ASMBitNextSet(aTargetMap, pVGAState->cMonitors, i))
+         i >= 0;
+         i = ASMBitNextSet(aTargetMap, pVGAState->cMonitors, i))
     {
         Screen.u32ViewIndex = i;
@@ -1659,5 +1870,5 @@
             if (RT_FAILURE(rc))
             {
-                WARN(("VBVAInfoView failed %d\n", rc));
+                WARN(("VBVAInfoView failed %Rrc\n", rc));
                 break;
             }
@@ -1667,5 +1878,5 @@
         if (RT_FAILURE(rc))
         {
-            WARN(("VBVAInfoScreen failed %d\n", rc));
+            WARN(("VBVAInfoScreen failed %Rrc\n", rc));
             break;
         }
@@ -1682,5 +1893,6 @@
  * @returns VBox status code.
  * @param   pVdma               The VDMA channel.
- * @param   pCmd                The command to process.
+ * @param   pCmd                The command to process.  Maybe safe (not shared
+ *                              with guest).
  *
  * @thread  VDMA
@@ -1725,5 +1937,5 @@
                         if (RT_FAILURE(rc))
                         {
-                            WARN(("vboxVDMACrGuestCtlResizeEntryProcess failed %d\n", rc));
+                            WARN(("vboxVDMACrGuestCtlResizeEntryProcess failed %Rrc\n", rc));
                             return rc;
                         }
@@ -1757,8 +1969,8 @@
                 if (RT_SUCCESS(rc))
                     return VINF_SUCCESS;
-                WARN(("VBoxVBVAExHPPause failed %d\n", rc));
+                WARN(("VBoxVBVAExHPPause failed %Rrc\n", rc));
             }
             else
-                WARN(("vdmaVBVAEnableProcess failed %d\n", rc));
+                WARN(("vdmaVBVAEnableProcess failed %Rrc\n", rc));
             return rc;
         }
@@ -1769,8 +1981,8 @@
         case VBVAEXHOSTCTL_TYPE_GHH_DISABLE:
         {
-            int rc = vdmaVBVADisableProcess(pVdma, true);
+            int rc = vdmaVBVADisableProcess(pVdma, true /* fDoHgcmEnable */);
             if (RT_FAILURE(rc))
             {
-                WARN(("vdmaVBVADisableProcess failed %d\n", rc));
+                WARN(("vdmaVBVADisableProcess failed %Rrc\n", rc));
                 return rc;
             }
@@ -1780,9 +1992,9 @@
                               (PFNRT)vgaUpdateDisplayAll, 2, pVdma->pVGAState, /* fFailOnResize = */ false);
 
-            return VBoxVDMAThreadTerm(&pVdma->Thread, NULL, NULL, false);
+            return VBoxVDMAThreadTerm(&pVdma->Thread, NULL, NULL, false /* fNotify */);
         }
 
         default:
-            WARN(("unexpected ctl type %d\n", pCmd->enmType));
+            WARN(("unexpected ctl type %Rrc\n", pCmd->enmType));
             return VERR_INVALID_PARAMETER;
     }
@@ -1814,5 +2026,5 @@
         }
         else
-            WARN(("PDMDevHlpPhysGCPhys2CCPtrReadOnly failed %d", rc));
+            WARN(("PDMDevHlpPhysGCPhys2CCPtrReadOnly failed %Rrc", rc));
     }
     else
@@ -1826,5 +2038,5 @@
         }
         else
-            WARN(("PDMDevHlpPhysGCPhys2CCPtr failed %d", rc));
+            WARN(("PDMDevHlpPhysGCPhys2CCPtr failed %Rrc", rc));
     }
 
@@ -2016,5 +2228,5 @@
             if (!RT_SUCCESS(rc))
             {
-                WARN(("PDMDevHlpPhysGCPhys2CCPtrReadOnly failed %d\n", rc));
+                WARN(("PDMDevHlpPhysGCPhys2CCPtrReadOnly failed %Rrc\n", rc));
                 return -1;
             }
@@ -2125,9 +2337,12 @@
 }
 
+/**
+ * Worker for vboxVDMAConstruct().
+ */
 static int vboxVDMACrCtlHgsmiSetup(struct VBOXVDMAHOST *pVdma)
 {
-    PVBOXVDMACMD_CHROMIUM_CTL_CRHGSMI_SETUP pCmd = (PVBOXVDMACMD_CHROMIUM_CTL_CRHGSMI_SETUP)
-            vboxVDMACrCtlCreate (VBOXVDMACMD_CHROMIUM_CTL_TYPE_CRHGSMI_SETUP, sizeof (*pCmd));
-    int rc = VERR_NO_MEMORY;
+    PVBOXVDMACMD_CHROMIUM_CTL_CRHGSMI_SETUP pCmd;
+    pCmd = (PVBOXVDMACMD_CHROMIUM_CTL_CRHGSMI_SETUP)vboxVDMACrCtlCreate(VBOXVDMACMD_CHROMIUM_CTL_TYPE_CRHGSMI_SETUP, sizeof(*pCmd));
+    int rc;
     if (pCmd)
     {
@@ -2145,11 +2360,13 @@
                 pVdma->CrSrvInfo = pCmd->CrCmdServerInfo;
             else if (rc != VERR_NOT_SUPPORTED)
-                WARN(("vboxVDMACrCtlGetRc returned %d\n", rc));
+                WARN(("vboxVDMACrCtlGetRc returned %Rrc\n", rc));
         }
         else
-            WARN(("vboxVDMACrCtlPost failed %d\n", rc));
+            WARN(("vboxVDMACrCtlPost failed %Rrc\n", rc));
 
         vboxVDMACrCtlRelease(&pCmd->Hdr);
     }
+    else
+        rc = VERR_NO_MEMORY;
 
     if (!RT_SUCCESS(rc))
@@ -2158,6 +2375,4 @@
     return rc;
 }
-
-static int vboxVDMACmdExecBpbTransfer(PVBOXVDMAHOST pVdma, const VBOXVDMACMD_DMA_BPB_TRANSFER *pTransfer, uint32_t cbBuffer);
 
 /**
@@ -2244,10 +2459,15 @@
 }
 
-int vboxVDMACrHgsmiCommandCompleteAsync(PPDMIDISPLAYVBVACALLBACKS pInterface, PVBOXVDMACMD_CHROMIUM_CMD pCmd, int rc)
-{
-    PVGASTATE pVGAState = PPDMIDISPLAYVBVACALLBACKS_2_PVGASTATE(pInterface);
-    PHGSMIINSTANCE pIns = pVGAState->pHGSMI;
-    VBOXVDMACMD *pDmaHdr = VBOXVDMACMD_FROM_BODY(pCmd);
-    VBOXVDMACBUF_DR *pDr = VBOXVDMACBUF_DR_FROM_TAIL(pDmaHdr);
+/**
+ * @interface_method_impl{PDMIDISPLAYVBVACALLBACKS,pfnCrHgsmiControlCompleteAsync,
+ *      Some indirect completion magic, you gotta love this code! }
+ */
+DECLCALLBACK(int) vboxVDMACrHgsmiCommandCompleteAsync(PPDMIDISPLAYVBVACALLBACKS pInterface, PVBOXVDMACMD_CHROMIUM_CMD pCmd, int rc)
+{
+    PVGASTATE           pVGAState = PPDMIDISPLAYVBVACALLBACKS_2_PVGASTATE(pInterface);
+    PHGSMIINSTANCE      pIns      = pVGAState->pHGSMI;
+    VBOXVDMACMD        *pDmaHdr   = VBOXVDMACMD_FROM_BODY(pCmd);
+    VBOXVDMACBUF_DR    *pDr       = VBOXVDMACBUF_DR_FROM_TAIL(pDmaHdr);
+
     AssertRC(rc);
     pDr->rc = rc;
@@ -2256,17 +2476,6 @@
     rc = VBoxSHGSMICommandComplete(pIns, pDr);
     AssertRC(rc);
+
     return rc;
-}
-
-int vboxVDMACrHgsmiControlCompleteAsync(PPDMIDISPLAYVBVACALLBACKS pInterface, PVBOXVDMACMD_CHROMIUM_CTL pCmd, int rc)
-{
-    PVGASTATE pVGAState = PPDMIDISPLAYVBVACALLBACKS_2_PVGASTATE(pInterface);
-    PVBOXVDMACMD_CHROMIUM_CTL_PRIVATE pCmdPrivate = VBOXVDMACMD_CHROMIUM_CTL_PRIVATE_FROM_CTL(pCmd);
-    pCmdPrivate->rc = rc;
-    if (pCmdPrivate->pfnCompletion)
-    {
-        pCmdPrivate->pfnCompletion(pVGAState, pCmd, pCmdPrivate->pvCompletion);
-    }
-    return VINF_SUCCESS;
 }
 
@@ -2680,7 +2889,8 @@
             }
             RT_FALL_THRU();
+
             case VBVAEXHOST_DATA_TYPE_NO_DATA:
-                rc = VBoxVDMAThreadEventWait(&pVdma->Thread, RT_INDEFINITE_WAIT);
-                AssertRC(rc);
+                rc = RTSemEventWaitNoResume(pVdma->Thread.hEvent, RT_INDEFINITE_WAIT);
+                AssertMsg(RT_SUCCESS(rc) || rc == VERR_INTERRUPTED, ("%Rrc\n", rc));
                 break;
 
@@ -2702,4 +2912,5 @@
  * @param   cbCmd       Number of valid bytes at @a pCmd.  This is at least
  *                      sizeof(VBOXVDMACBUF_DR).
+ * @thread  VDMA
  */
 static void vboxVDMACommandProcess(PVBOXVDMAHOST pVdma, PVBOXVDMACBUF_DR pCmd, uint32_t cbCmd)
@@ -2855,13 +3066,13 @@
                     }
 
-                    WARN(("RTCritSectInit failed %d\n", rc));
+                    WARN(("RTCritSectInit failed %Rrc\n", rc));
                     VBoxVBVAExHSTerm(&pVdma->CmdVbva);
                 }
                 else
-                    WARN(("VBoxVBVAExHSInit failed %d\n", rc));
+                    WARN(("VBoxVBVAExHSInit failed %Rrc\n", rc));
                 RTSemEventMultiDestroy(pVdma->HostCrCtlCompleteEvent);
             }
             else
-                WARN(("RTSemEventMultiCreate failed %d\n", rc));
+                WARN(("RTSemEventMultiCreate failed %Rrc\n", rc));
 #endif
             /* the timer is cleaned up automatically */
@@ -2986,22 +3197,4 @@
 #ifdef VBOX_WITH_CRHGSMI
 
-static DECLCALLBACK(void) vdmaVBVACtlSubmitSyncCompletion(VBVAEXHOSTCONTEXT *pVbva, struct VBVAEXHOSTCTL *pCtl, int rc, void *pvContext);
-
-static int vdmaVBVACtlSubmit(PVBOXVDMAHOST pVdma, VBVAEXHOSTCTL* pCtl, VBVAEXHOSTCTL_SOURCE enmSource,
-                             PFNVBVAEXHOSTCTL_COMPLETE pfnComplete, void *pvComplete)
-{
-    int rc = VBoxVBVAExHCtlSubmit(&pVdma->CmdVbva, pCtl, enmSource, pfnComplete, pvComplete);
-    if (RT_SUCCESS(rc))
-    {
-        if (rc == VINF_SUCCESS)
-            return VBoxVDMAThreadEventNotify(&pVdma->Thread);
-        Assert(rc == VINF_ALREADY_INITIALIZED);
-    }
-    else
-        Log(("VBoxVBVAExHCtlSubmit failed %d\n", rc));
-
-    return rc;
-}
-
 /**
  * @callback_method_impl{FNVBVAEXHOSTCTL_COMPLETE,
@@ -3040,5 +3233,5 @@
 
         VBoxVBVAExHCtlFree(&pVdma->CmdVbva, pHCtl);
-        Log(("vdmaVBVACtlSubmit failed rc %d\n", rc));
+        Log(("vdmaVBVACtlSubmit failed %Rrc\n", rc));
     }
     else
@@ -3063,5 +3256,5 @@
         return VINF_SUCCESS;
 
-    WARN(("vdmaVBVACtlGenericSubmit failed %d\n", rc));
+    WARN(("vdmaVBVACtlGenericSubmit failed %Rrc\n", rc));
     pCtl->i32Result = rc;
     rc = VBoxSHGSMICommandComplete(pVdma->pHgsmi, pCtl);
@@ -3099,9 +3292,9 @@
             rc = pVGAState->pDrv->pfnCrHgcmCtlSubmit(pVGAState->pDrv, pCmd, cbCmd, pfnCompletion, pvCompletion);
             if (!RT_SUCCESS(rc))
-                WARN(("pfnCrHgsmiControlProcess failed %d\n", rc));
+                WARN(("pfnCrHgsmiControlProcess failed %Rrc\n", rc));
 
             return rc;
         }
-        WARN(("vdmaVBVACtlGenericSubmit failed %d\n", rc));
+        WARN(("vdmaVBVACtlGenericSubmit failed %Rrc\n", rc));
         return rc;
     }
@@ -3120,5 +3313,5 @@
         if (!RT_SUCCESS(rc))
         {
-            WARN(("pfnVBVAEnable failed %d\n", rc));
+            WARN(("pfnVBVAEnable failed %Rrc\n", rc));
             for (uint32_t j = 0; j < i; j++)
             {
@@ -3171,8 +3364,8 @@
         }
         else if (RT_FAILURE(rc))
-            WARN(("vboxVDMACrGuestCtlProcess failed %d\n", rc));
+            WARN(("vboxVDMACrGuestCtlProcess failed %Rrc\n", rc));
     }
     else
-        WARN(("vdmaVBVACtlThreadCreatedEnable is passed %d\n", rc));
+        WARN(("vdmaVBVACtlThreadCreatedEnable is passed %Rrc\n", rc));
 
     VBoxVBVAExHPDataCompleteCtl(&pVdma->CmdVbva, pHCtl, rc);
@@ -3224,5 +3417,5 @@
     if (!RT_SUCCESS(rc))
     {
-        WARN(("RTSemEventCreate failed %d\n", rc));
+        WARN(("RTSemEventCreate failed %Rrc\n", rc));
         return rc;
     }
@@ -3236,11 +3429,11 @@
             rc = Data.rc;
             if (!RT_SUCCESS(rc))
-                WARN(("vdmaVBVACtlSubmitSyncCompletion returned %d\n", rc));
+                WARN(("vdmaVBVACtlSubmitSyncCompletion returned %Rrc\n", rc));
         }
         else
-            WARN(("RTSemEventWait failed %d\n", rc));
+            WARN(("RTSemEventWait failed %Rrc\n", rc));
     }
     else
-        WARN(("vdmaVBVACtlSubmit failed %d\n", rc));
+        WARN(("vdmaVBVACtlSubmit failed %Rrc\n", rc));
 
     RTSemEventDestroy(Data.hEvent);
@@ -3276,5 +3469,5 @@
         return VINF_SUCCESS;
 
-    WARN(("vdmaVBVACtlSubmit failed rc %d\n", rc));
+    WARN(("vdmaVBVACtlSubmit failed rc %Rrc\n", rc));
     VBoxVBVAExHCtlFree(&pVdma->CmdVbva, pHCtl);
     return rc;
@@ -3303,5 +3496,5 @@
         return VINF_SUCCESS;
 
-    WARN(("vdmaVBVACtlEnableDisableSubmitInternal failed %d\n", rc));
+    WARN(("vdmaVBVACtlEnableDisableSubmitInternal failed %Rrc\n", rc));
     pEnable->Hdr.i32Result = rc;
     rc = VBoxSHGSMICommandComplete(pVdma->pHgsmi, &pEnable->Hdr);
@@ -3322,5 +3515,5 @@
     rc = RTSemEventSignal(pData->hEvent);
     if (!RT_SUCCESS(rc))
-        WARN(("RTSemEventSignal failed %d\n", rc));
+        WARN(("RTSemEventSignal failed %Rrc\n", rc));
 }
 
@@ -3333,5 +3526,5 @@
     if (!RT_SUCCESS(rc))
     {
-        WARN(("RTSemEventCreate failed %d\n", rc));
+        WARN(("RTSemEventCreate failed %Rrc\n", rc));
         return rc;
     }
@@ -3345,11 +3538,11 @@
             rc = Data.rc;
             if (!RT_SUCCESS(rc))
-                WARN(("vdmaVBVACtlSubmitSyncCompletion returned %d\n", rc));
+                WARN(("vdmaVBVACtlSubmitSyncCompletion returned %Rrc\n", rc));
         }
         else
-            WARN(("RTSemEventWait failed %d\n", rc));
+            WARN(("RTSemEventWait failed %Rrc\n", rc));
     }
     else
-        Log(("vdmaVBVACtlSubmit failed %d\n", rc));
+        Log(("vdmaVBVACtlSubmit failed %Rrc\n", rc));
 
     RTSemEventDestroy(Data.hEvent);
@@ -3463,5 +3656,5 @@
     }
     else
-        WARN(("RTCritSectEnter failed %d\n", rc));
+        WARN(("RTCritSectEnter failed %Rrc\n", rc));
 
     return rc;
@@ -3492,5 +3685,5 @@
         else
         {
-            WARN(("RTCritSectEnter failed %d\n", rc));
+            WARN(("RTCritSectEnter failed %Rrc\n", rc));
             break;
         }
@@ -3518,5 +3711,5 @@
     if (!RT_SUCCESS(rc))
     {
-        WARN(("vdmaVBVACtlOpaqueHostSubmit failed %d", rc));
+        WARN(("vdmaVBVACtlOpaqueHostSubmit failed %Rrc", rc));
         return rc;
     }
@@ -3548,5 +3741,5 @@
     rc = Data.rc;
     if (!RT_SUCCESS(rc))
-        WARN(("host call failed %d", rc));
+        WARN(("host call failed %Rrc", rc));
 
     return rc;
@@ -3654,5 +3847,5 @@
     if (rc != VERR_INVALID_STATE)
     {
-        WARN(("vdmaVBVAPause failed %d\n", rc));
+        WARN(("vdmaVBVAPause failed %Rrc\n", rc));
         return rc;
     }
@@ -3663,7 +3856,6 @@
 
     PVGASTATE pVGAState = pVdma->pVGAState;
-    PVBOXVDMACMD_CHROMIUM_CTL pCmd = (PVBOXVDMACMD_CHROMIUM_CTL)vboxVDMACrCtlCreate(
-            VBOXVDMACMD_CHROMIUM_CTL_TYPE_SAVESTATE_BEGIN, sizeof (*pCmd));
-    Assert(pCmd);
+    PVBOXVDMACMD_CHROMIUM_CTL pCmd;
+    pCmd = (PVBOXVDMACMD_CHROMIUM_CTL)vboxVDMACrCtlCreate(VBOXVDMACMD_CHROMIUM_CTL_TYPE_SAVESTATE_BEGIN, sizeof(*pCmd));
     if (pCmd)
     {
@@ -3671,7 +3863,5 @@
         AssertRC(rc);
         if (RT_SUCCESS(rc))
-        {
             rc = vboxVDMACrCtlGetRc(pCmd);
-        }
         vboxVDMACrCtlRelease(pCmd);
         return rc;
@@ -3693,5 +3883,5 @@
     if (rc != VERR_INVALID_STATE)
     {
-        WARN(("vdmaVBVAResume failed %d\n", rc));
+        WARN(("vdmaVBVAResume failed %Rrc\n", rc));
         return rc;
     }
@@ -3702,6 +3892,6 @@
 
     PVGASTATE pVGAState = pVdma->pVGAState;
-    PVBOXVDMACMD_CHROMIUM_CTL pCmd = (PVBOXVDMACMD_CHROMIUM_CTL)vboxVDMACrCtlCreate(
-            VBOXVDMACMD_CHROMIUM_CTL_TYPE_SAVESTATE_END, sizeof (*pCmd));
+    PVBOXVDMACMD_CHROMIUM_CTL pCmd;
+    pCmd = (PVBOXVDMACMD_CHROMIUM_CTL)vboxVDMACrCtlCreate(VBOXVDMACMD_CHROMIUM_CTL_TYPE_SAVESTATE_END, sizeof(*pCmd));
     Assert(pCmd);
     if (pCmd)
@@ -3710,7 +3900,5 @@
         AssertRC(rc);
         if (RT_SUCCESS(rc))
-        {
             rc = vboxVDMACrCtlGetRc(pCmd);
-        }
         vboxVDMACrCtlRelease(pCmd);
         return rc;
@@ -3796,5 +3984,5 @@
 /** @todo r=bird: BTW. would be great if you put in a couple of comments here and there explaining what
        * the purpose of this code is. */
-    VBVAEXHOSTCTL* pHCtl = VBoxVBVAExHCtlCreate(&pVdma->CmdVbva, VBVAEXHOSTCTL_TYPE_HH_LOADSTATE_DONE);
+    VBVAEXHOSTCTL *pHCtl = VBoxVBVAExHCtlCreate(&pVdma->CmdVbva, VBVAEXHOSTCTL_TYPE_HH_LOADSTATE_DONE);
     if (!pHCtl)
     {
@@ -3811,5 +3999,5 @@
     if (RT_FAILURE(rc))
     {
-        Log(("vdmaVBVACtlSubmit failed rc %d\n", rc));
+        Log(("vdmaVBVACtlSubmit failed %Rrc\n", rc));
         VBoxVBVAExHCtlFree(&pVdma->CmdVbva, pHCtl);
         return rc;
