bottleneck - don't wait in critical sections, resource garbage collector in driver

8 files changed, 340 insertions, 90 deletions

diff --git a/makefile b/makefile
index b509e51..55cd126 100644
--- a/makefile
+++ b/makefile
@@ -12,7 +12,7 @@ OBJS += &
 

 INCS = -I$(%WATCOM)\h\win -Iddk -Ivmware

 

-VER_BUILD = 80

+VER_BUILD = 81

 

 FLAGS = -DDRV_VER_BUILD=$(VER_BUILD)

 

diff --git a/vmm.h b/vmm.h
index effe3df..fc64c36 100644
--- a/vmm.h
+++ b/vmm.h
@@ -186,6 +186,7 @@ typedef struct tagVxD_Desc_Block
 #define BPA_32_Bit_Flag       0x0001

 

 #define End_PM_App            0x0016

+#define End_PM_App2           0x002C

 

 #define Device_Reboot_Notify  0x0017

 #define Crit_Reboot_Notify    0x0018

@@ -200,6 +201,61 @@ typedef struct tagVxD_Desc_Block
 #define Sys_Dynamic_Device_Init 0x001B

 #define Sys_Dynamic_Device_Exit 0x001C

 

+

+/* -------------------- CALLS FOR Win32  ------------------------- */

+

+/* vWin32 communicates with Vxds on behalf of Win32 apps thru this mechanism.

+ * BUGBUG: need more doc here, describing the interface

+ */

+

+#define W32_DEVICEIOCONTROL 0x0023

+

+/* sub-functions */

+#define DIOC_GETVERSION     0x0

+#define DIOC_OPEN	DIOC_GETVERSION

+#define DIOC_CLOSEHANDLE    -1

+

+/* -------------------- MORE SYSTEM CALLS ------------------------- */

+

+/*

+ * All these messages are sent immediately following the corresponding

+ * message of the same name, except that the "2" messages are sent

+ * in *reverse* init order.

+ */

+

+#define SYS_VM_TERMINATE2   0x0024

+#define SYSTEM_EXIT2	    0x0025

+#define SYS_CRITICAL_EXIT2  0x0026

+#define VM_TERMINATE2	    0x0027

+#define VM_NOT_EXECUTEABLE2 0x0028

+#define DESTROY_VM2	0x0029

+#define VM_SUSPEND2	0x002A

+#define END_MESSAGE_MODE2   0x002B

+#define END_PM_APP2	0x002C

+#define DEVICE_REBOOT_NOTIFY2	0x002D

+#define CRIT_REBOOT_NOTIFY2 0x002E

+#define CLOSE_VM_NOTIFY2    0x002F

+

+/*

+ * VCOMM gets Address of Contention handler from VxDs by sending this

+ * control message

+ */

+

+#define GET_CONTENTION_HANDLER	0x0030

+

+#define KERNEL32_INITIALIZED	0x0031

+

+#define KERNEL32_SHUTDOWN	0x0032

+

+#define CREATE_PROCESS		0x0033

+#define DESTROY_PROCESS 	0x0034

+

+#ifndef WIN40COMPAT

+#define SYS_DYNAMIC_DEVICE_REINIT 0x0035

+#endif

+#define SYS_POWER_DOWN		0x0036

+

+#define MAX_SYSTEM_CONTROL	0x0036

 /* 

  * Macro to call VXD service

  * @param _vxd: VXD name (numeric id must be defined as _vxd ## _DEVICE_ID)

@@ -1335,4 +1391,12 @@ typedef struct _MEMORY_BASIC_INFORMATION
 #define MEM_PRIVATE         0x20000     

 #endif /* _WINNT_ */

 

+/*

+ *   Protected mode application control blocks

+ */

+struct pmcb_s {

+    ULONG PMCB_Flags;

+    ULONG PMCB_Parent;

+};

+

 #endif /* __VMM_H__INCLUDED__ */

diff --git a/vxd_lib.c b/vxd_lib.c
index 509a288..dfbe552 100644
--- a/vxd_lib.c
+++ b/vxd_lib.c
@@ -419,6 +419,7 @@ ULONG __cdecl _PageAllocate(ULONG nPages, ULONG pType, ULONG VM, ULONG AlignMask
 {

 	ULONG r = _PageAllocate_call(nPages, pType, VM, AlignMask, minPhys, maxPhys, PhysAddr, flags);

 	

+#if 0

 	/* do examplicit TLB flush, help much for stability.

 	 * There is probably another TLB bug in VMM...

 	 */

@@ -429,6 +430,7 @@ ULONG __cdecl _PageAllocate(ULONG nPages, ULONG pType, ULONG VM, ULONG AlignMask
 		mov cr3, eax

 		pop eax

 	};

+#endif

 	return r;

 }

 

diff --git a/vxd_main.c b/vxd_main.c
index cac0ea1..68bae7f 100644
--- a/vxd_main.c
+++ b/vxd_main.c
@@ -57,10 +57,10 @@ THE SOFTWARE.
 

 void VXD_control();

 void VXD_API_entry();

-void Device_Init_proc();

-void __stdcall Device_Dynamic_Init_proc(DWORD VM);

+void __stdcall Device_Init_proc(DWORD VM);

 void __stdcall Device_Exit_proc(DWORD VM);

 void __stdcall Device_Init_Complete(DWORD VM);

+void __stdcall win32_destroy_process_proc(DWORD pid);

 

 #define SERVICE_TABLE_CNT (FBHDA__OVERLAY_UNLOCK+1)

 extern DWORD service_table[SERVICE_TABLE_CNT];

@@ -161,6 +161,11 @@ void __declspec(naked) Device_IO_Control_entry()
 	}

 }

 

+void __stdcall print_ctrl(DWORD type)

+{

+	dbg_printf("VXD_control: %d\n", type);

+}

+

 /*

  * service module calls (init, exit, deviceIoControl, ...)

  * clear carry if succes (this is always success)

@@ -184,6 +189,7 @@ void __declspec(naked) VXD_control()
 		control_1: 

 		cmp eax,Device_Init

 		jnz control_2

+			push ebx ; VM handle

 		  call Device_Init_proc

 			popad

 			clc

@@ -198,11 +204,11 @@ void __declspec(naked) VXD_control()
 			clc

 			ret

 		control_3:

-		cmp eax,0x1B

+		cmp eax,Sys_Dynamic_Device_Init

 		jnz control_4

 			pushad

 			push ebx ; VM handle

-		  call Device_Dynamic_Init_proc

+		  call Device_Init_proc

 		  popad

 			clc

 			ret

@@ -219,7 +225,28 @@ void __declspec(naked) VXD_control()
 			popad

 			clc

 			ret

+/*

+	https://www.codeproject.com/Articles/3874/The-Ultimate-Process-Thread-spy-for-Windows-9x

+	

+	"You will find the definition of CREATE_PROCESS, but wont find how to get the

+	PID of a newly created process. For thread (CREATE_THREAD), the thread ID is

+	passed in EDI register, but for CREATE_PROCESS it's not there. At last, by

+	trial and error I found where it is, the PID value, it is in EDX reg."

+*/

 		control_6:

+		cmp eax,DESTROY_PROCESS

+		jnz control_7

+			pushad

+			push edx ; PID

+			call win32_destroy_process_proc

+			popad

+			clc

+			ret

+		control_7:

+;			pushad

+;			push eax

+;			call print_ctrl

+;			popad

 		clc

 	  ret

 	};

@@ -231,8 +258,8 @@ WORD __stdcall VXD_API_Proc(PCRS_32 state)
 	WORD rc = 0xFFFF;

 	WORD service = state->Client_EDX & 0xFFFF;

 	

-	//dbg_printf(dbg_vxd_api, service);

-	Begin_Critical_Section(0);

+	//dbg_printf("VXD_API_Proc, service: %X\n", service);

+	//Begin_Critical_Section(0);

 	

 	switch(service)

 	{

@@ -281,20 +308,18 @@ WORD __stdcall VXD_API_Proc(PCRS_32 state)
 			rc = 1;

 			break;

 		case OP_FBHDA_PALETTE_GET:

-			{

-				DWORD color;

-				color = FBHDA_palette_get(state->Client_ECX & 0xFF);

-				state->Client_EDI = color;

-				rc = 1;

-				break;

-			}

+		{

+			DWORD color;

+			color = FBHDA_palette_get(state->Client_ECX & 0xFF);

+			state->Client_EDI = color;

+			rc = 1;

+			break;

+		}

 		case OP_FBHDA_GAMMA_GET:

-			dbg_printf("OP_FBHDA_GAMMA_GET\n");

 			state->Client_ECX = FBHDA_gamma_get((void *)state->Client_EDI, state->Client_ECX);

 			rc = 1;

 			break;

 		case OP_FBHDA_GAMMA_SET:

-			dbg_printf("OP_FBHDA_GAMMA_SET\n");

 			state->Client_ECX = FBHDA_gamma_set((void *)state->Client_ESI, state->Client_ECX);

 			rc = 1;

 			break;

@@ -321,29 +346,31 @@ WORD __stdcall VXD_API_Proc(PCRS_32 state)
 			break;

 #ifdef SVGA

 		case OP_SVGA_VALID:

-			{

-				BOOL rs;

-				rs = SVGA_valid();

-				state->Client_ECX = (DWORD)rs;

-				rc = 1;

-				break;

-			}

+		{

+			BOOL rs;

+			rs = SVGA_valid();

+			state->Client_ECX = (DWORD)rs;

+			rc = 1;

+			break;

+		}

 		case OP_SVGA_SETMODE:

-			{

-				BOOL rs;

-				rs = SVGA_setmode(state->Client_ESI, state->Client_EDI, state->Client_ECX);

-				state->Client_ECX = (DWORD)rs;

-				rc = 1;

-				break;

-			}

+		{

+			BOOL rs;

+			Begin_Critical_Section(0);

+			rs = SVGA_setmode(state->Client_ESI, state->Client_EDI, state->Client_ECX);

+			End_Critical_Section();

+			state->Client_ECX = (DWORD)rs;

+			rc = 1;

+			break;

+		}

 		case OP_SVGA_VALIDMODE:

-			{

-				BOOL rs;

-				rs = SVGA_validmode(state->Client_ESI, state->Client_EDI, state->Client_ECX);

-				state->Client_ECX = (DWORD)rs;

-				rc = 1;

-				break;

-			}

+		{

+			BOOL rs;

+			rs = SVGA_validmode(state->Client_ESI, state->Client_EDI, state->Client_ECX);

+			state->Client_ECX = (DWORD)rs;

+			rc = 1;

+			break;

+		}

 		case OP_SVGA_HW_ENABLE:

 			SVGA_HW_enable();

 			rc = 1;

@@ -356,29 +383,31 @@ WORD __stdcall VXD_API_Proc(PCRS_32 state)
 

 #ifdef VBE

 		case OP_VBE_VALID:

-			{

-				BOOL rs;

-				rs = VBE_valid();

-				state->Client_ECX = (DWORD)rs;

-				rc = 1;

-				break;

-			}

+		{

+			BOOL rs;

+			rs = VBE_valid();

+			state->Client_ECX = (DWORD)rs;

+			rc = 1;

+			break;

+		}

 		case OP_VBE_SETMODE:

-			{

-				BOOL rs;

-				rs = VBE_setmode(state->Client_ESI, state->Client_EDI, state->Client_ECX);

-				state->Client_ECX = (DWORD)rs;

-				rc = 1;

-				break;

-			}

+		{

+			BOOL rs;

+			Begin_Critical_Section(0);

+			rs = VBE_setmode(state->Client_ESI, state->Client_EDI, state->Client_ECX);

+			End_Critical_Section();

+			state->Client_ECX = (DWORD)rs;

+			rc = 1;

+			break;

+		}

 		case OP_VBE_VALIDMODE:

-			{

-				BOOL rs;

-				rs = VBE_validmode(state->Client_ESI, state->Client_EDI, state->Client_ECX);

-				state->Client_ECX = (DWORD)rs;

-				rc = 1;

-				break;

-			}

+		{

+			BOOL rs;

+			rs = VBE_validmode(state->Client_ESI, state->Client_EDI, state->Client_ECX);

+			state->Client_ECX = (DWORD)rs;

+			rc = 1;

+			break;

+		}

 #endif

 

 	}

@@ -392,7 +421,9 @@ WORD __stdcall VXD_API_Proc(PCRS_32 state)
 		state->Client_EFlags &= 0xFFFFFFFEUL; // clear carry

 	}

 	

-	End_Critical_Section();

+	//dbg_printf("VXD_API_Proc end\n");

+	

+	//End_Critical_Section();

 	

 	return rc;

 }

@@ -505,8 +536,9 @@ static void configure_FBHDA()
 #define VDDNAKED VDDFUNC

 

 /* init device and fill dispatch table */

-void Device_Dynamic_Init_proc(DWORD VM)

+void Device_Init_proc(DWORD VM)

 {

+	Begin_Critical_Section(0);

 	dbg_printf(dbg_Device_Init_proc);

 

 	VMMCall(_Allocate_Device_CB_Area);

@@ -535,6 +567,7 @@ void Device_Dynamic_Init_proc(DWORD VM)
 	}

 	

 	configure_FBHDA();

+	End_Critical_Section();

 }

 #undef VDDFUNC

 #undef VDDNAKED

@@ -546,7 +579,7 @@ DWORD __stdcall Device_IO_Control_proc(DWORD vmhandle, struct DIOCParams *params
 	DWORD *outBuf = (DWORD*)params->lpOutBuffer;

 	DWORD rc = 1;

 	

-	Begin_Critical_Section(0);

+	//Begin_Critical_Section(0);

 	

 	//dbg_printf("I%x\n", params->dwIoControlCode);

 	

@@ -616,14 +649,14 @@ DWORD __stdcall Device_IO_Control_proc(DWORD vmhandle, struct DIOCParams *params
 			rc = 0;

 			break;

 		case OP_SVGA_CMB_SUBMIT:

-			{

+		{

 				SVGA_CMB_submit_io_t *inio  = (SVGA_CMB_submit_io_t*)inBuf;

 				SVGA_CMB_status_t *status = (SVGA_CMB_status_t*)outBuf;

 				

 				SVGA_CMB_submit(inio->cmb, inio->cmb_size, status, inio->flags, inio->DXCtxId);

 				rc = 0;

 				break;

-			}

+		}

 		case OP_SVGA_FENCE_GET:

 			outBuf[0] = SVGA_fence_get();

 			rc = 0;

@@ -637,22 +670,22 @@ DWORD __stdcall Device_IO_Control_proc(DWORD vmhandle, struct DIOCParams *params
 			rc = 0;

 			break;

 		case OP_SVGA_REGION_CREATE:

+		{

+			SVGA_region_info_t *inio  = (SVGA_region_info_t*)inBuf;

+			SVGA_region_info_t *outio = (SVGA_region_info_t*)outBuf;

+			if(outio != inio)

 			{

-				SVGA_region_info_t *inio  = (SVGA_region_info_t*)inBuf;

-				SVGA_region_info_t *outio = (SVGA_region_info_t*)outBuf;

-				if(outio != inio)

-				{

-					memcpy(outio, inio, sizeof(SVGA_region_info_t));

-				}

-				outio->address = NULL;

-				if(!SVGA_region_create(outio))

-				{

-					SVGA_flushcache();

-					SVGA_region_create(outio);

-				}

-				rc = 0;

-				break;

+				memcpy(outio, inio, sizeof(SVGA_region_info_t));

+			}

+			outio->address = NULL;

+			if(!SVGA_region_create(outio))

+			{

+				SVGA_flushcache();

+				SVGA_region_create(outio);

 			}

+			rc = 0;

+			break;

+		}

 		case OP_SVGA_REGION_FREE:

 			{

 				SVGA_region_info_t *inio  = (SVGA_region_info_t*)inBuf;

@@ -706,16 +739,11 @@ DWORD __stdcall Device_IO_Control_proc(DWORD vmhandle, struct DIOCParams *params
 	}

 	

 	//dbg_printf("IL\n");

-	End_Critical_Section();

+	//End_Critical_Section();

 

 	return rc;

 }

 

-void Device_Init_proc()

-{

-	/* nop */

-}

-

 void Device_Init_Complete(DWORD VM)

 {

 #ifdef QEMU

@@ -793,3 +821,12 @@ DWORD service_table[SERVICE_TABLE_CNT] = {
 	(DWORD)&service_overlay_lock, // 10

 	(DWORD)&service_overlay_unlock, // 11

 };

+

+void __stdcall win32_destroy_process_proc(DWORD pid)

+{

+	dbg_printf("DESTROY_PROCESS: %lX\n", pid);

+	

+#ifdef SVGA

+	SVGA_ProcessCleanup(pid);

+#endif

+}

diff --git a/vxd_svga.c b/vxd_svga.c
index 550db46..1c0af6b 100644
--- a/vxd_svga.c
+++ b/vxd_svga.c
@@ -85,6 +85,9 @@ void *ctlbuf = NULL;
 DWORD async_mobs = 1;

 DWORD hw_cursor  = 0;

 

+ULONG cb_sem = 0;

+ULONG mem_sem = 0;

+

 /* vxd_mouse.vxd */

 BOOL mouse_get_rect(DWORD *ptr_left, DWORD *ptr_top,

 	DWORD *ptr_right, DWORD *ptr_bottom);

@@ -400,6 +403,10 @@ BOOL SVGA_init_hw()
 #endif

 

 	int rc;

+

+	/* some semaphores */

+	mem_sem = Create_Semaphore(1);

+	cb_sem = Create_Semaphore(1);

 	

 	/* configs in registry */

  	RegReadConf(HKEY_LOCAL_MACHINE, SVGA_conf_path, SVGA_conf_vram_limit, &conf_vram_limit);

@@ -1190,15 +1197,17 @@ void FBHDA_access_rect(DWORD left, DWORD top, DWORD right, DWORD bottom)
 	

 	Wait_Semaphore(hda_sem, 0);

 	

-/*	dbg_printf("FBHDA_access_rect(%ld, %ld, %ld, %ld)\n",

-		left, top, right, bottom

-	);*/

-	

 	if(left > hda->width)

+	{

+		Signal_Semaphore(hda_sem);

 		return;

+	}

 	

 	if(top > hda->height)

+	{

+		Signal_Semaphore(hda_sem);

 		return;

+	}

 	

 	if(right > hda->width)

 		right = hda->width;

@@ -1241,7 +1250,6 @@ void FBHDA_access_begin(DWORD flags)
 	if(flags & (FBHDA_ACCESS_RAW_BUFFERING | FBHDA_ACCESS_MOUSE_MOVE))

 	{

 		Wait_Semaphore(hda_sem, 0);

-		check_dirty();

 		

 //		dbg_printf("FBHDA_access_begin(%ld)\n", flags);

 		

@@ -1249,6 +1257,7 @@ void FBHDA_access_begin(DWORD flags)
 		{

 			SVGA_CMB_wait_update();

 			mouse_erase();

+			check_dirty();

 			

 			if(!mouse_get_rect(&rect_left, &rect_top, &rect_right, &rect_bottom))

 			{

@@ -1560,3 +1569,115 @@ void  FBHDA_overlay_unlock(DWORD flags)
 		}

 	}

 }

+

+#define BSTEP (sizeof(DWORD)*8)

+

+static inline void map_reset(DWORD *bitmap, DWORD id)

+{

+	DWORD i = id / BSTEP;

+	DWORD ii = id % BSTEP;

+	

+	bitmap += i;

+	*bitmap |= ((DWORD)1 << ii);

+}

+

+void SVGA_ProcessCleanup(DWORD pid)

+{

+	DWORD id;

+	

+	/* just for safety */

+	if(pid == 0)

+		return;

+

+	Begin_Critical_Section(0);

+	if(svga_db != NULL)

+	{

+		/* clean surfaces */

+		for(id = 0; id < svga_db->surfaces_cnt; id++)

+		{

+			SVGA_DB_surface_t *sinfo = &svga_db->surfaces[id];

+			if(sinfo->pid == pid)

+			{

+				dbg_printf("Cleaning surface: %d\n", id);

+				if(sinfo->gmrId) // GB surface

+				{

+					DWORD cmd_offset =  0;

+					SVGA3dCmdBindGBSurface *unbind;

+					SVGA3dCmdDestroySurface *destgb;

+

+					wait_for_cmdbuf();

+					unbind = SVGA_cmd3d_ptr(cmdbuf, &cmd_offset, SVGA_3D_CMD_BIND_GB_SURFACE, sizeof(SVGA3dCmdBindGBSurface));

+					unbind->sid   = id+1;

+					unbind->mobid = SVGA3D_INVALID_ID;

+

+					destgb = SVGA_cmd3d_ptr(cmdbuf, &cmd_offset, SVGA_3D_CMD_DESTROY_GB_SURFACE, sizeof(SVGA3dCmdDestroySurface));

+					destgb->sid = id+1;

+

+					submit_cmdbuf(cmd_offset, SVGA_CB_SYNC, 0);

+				}

+				else

+				{

+					DWORD cmd_offset =  0;

+					SVGA3dCmdDestroySurface *dest;

+					

+					wait_for_cmdbuf();

+					dest = SVGA_cmd3d_ptr(cmdbuf, &cmd_offset, SVGA_3D_CMD_SURFACE_DESTROY, sizeof(SVGA3dCmdDestroySurface));

+					dest->sid = id+1;

+					

+					submit_cmdbuf(cmd_offset, SVGA_CB_SYNC, 0);

+				}

+

+				sinfo->pid = 0;

+				map_reset(svga_db->surfaces_map, id);

+			}

+		} // for

+

+		/* clean contexts */

+		for(id = 0; id < svga_db->contexts_cnt; id++)

+		{

+			SVGA_DB_context_t *cinfo = &svga_db->contexts[id];

+			

+			if(cinfo->pid == pid)

+			{

+				DWORD cmd_offset = 0;

+				dbg_printf("Cleaning context: %d\n", id);

+				

+				wait_for_cmdbuf();

+				if(cinfo->gmrId != 0) /* GB Context */

+				{

+					SVGA3dCmdDXDestroyContext *dest_ctx_gb =

+						SVGA_cmd3d_ptr(cmdbuf, &cmd_offset, SVGA_3D_CMD_DX_DESTROY_CONTEXT, sizeof(SVGA3dCmdDXDestroyContext));

+					dest_ctx_gb->cid = id+1;

+					submit_cmdbuf(cmd_offset, SVGA_CB_SYNC, 0);

+				}

+				else

+				{

+					SVGA3dCmdDestroyContext *dest_ctx =

+						SVGA_cmd3d_ptr(cmdbuf, &cmd_offset, SVGA_3D_CMD_CONTEXT_DESTROY, sizeof(SVGA3dCmdDestroyContext));

+					dest_ctx->cid = id+1;

+					submit_cmdbuf(cmd_offset, SVGA_CB_SYNC, 0);

+				}

+				

+				cinfo->pid = 0;

+				map_reset(svga_db->contexts_map, id);

+			}

+		} // for

+

+		/* clean regision */

+		for(id = 0; id < svga_db->regions_cnt; id++)

+		{

+			SVGA_DB_region_t *rinfo = &svga_db->regions[id];

+			if(rinfo->pid == pid)

+			{

+				dbg_printf("Cleaning regions: %d\n", id);

+

+				SVGA_region_free(&rinfo->info);

+				rinfo->pid = 0;

+				map_reset(svga_db->regions_map, id);

+			}

+		} // for

+	} // db != NULL

+	

+	End_Critical_Section();

+}

+

diff --git a/vxd_svga.h b/vxd_svga.h
index 7b56564..911a049 100644
--- a/vxd_svga.h
+++ b/vxd_svga.h
@@ -9,6 +9,9 @@
 #define ST_CURSOR  2

 #define ST_CURSOR_HIDEABLE 4

 

+/* semaphores */

+extern ULONG cb_sem;

+extern ULONG mem_sem;

 

 /* VM handle */

 extern DWORD ThisVM;

@@ -36,6 +39,7 @@ void update_pm16(DWORD vm, DWORD oldmap, DWORD linear, DWORD size);
 

 void SVGA_Sync();

 void SVGA_Flush_CB();

+void SVGA_ProcessCleanup(DWORD pid);

 

 /* mouse */

 BOOL SVGA_mouse_hw();

diff --git a/vxd_svga_cb.c b/vxd_svga_cb.c
index b368ba7..24bc383 100644
--- a/vxd_svga_cb.c
+++ b/vxd_svga_cb.c
@@ -111,6 +111,13 @@ static uint64 cb_next_id = {0, 0};
 #define WAIT_FOR_CB_SYNC_0

 #define WAIT_FOR_CB_SYNC_1 SVGA_Sync();

 

+#define WAIT_FOR_CB_FINAL(_cb) \

+	do{ \

+			while(!CB_queue_check_inline(_cb)){ \

+				SVGA_Sync(); \

+		} \

+	}while(0)

+

 /* wait for all commands */

 void SVGA_Flush_CB()

 {

@@ -158,7 +165,8 @@ void SVGA_CMB_free(DWORD *cmb)
 {

 	SVGACBHeader *cb = ((SVGACBHeader *)cmb)-1;

 

-	WAIT_FOR_CB(cb, 1);

+	//WAIT_FOR_CB(cb, 1);

+	WAIT_FOR_CB_FINAL(cb);

 		

 	_PageFree(cb-1, 0);

 }

@@ -469,6 +477,8 @@ void SVGA_CMB_submit(DWORD FBPTR cmb, DWORD cmb_size, SVGA_CMB_status_t FBPTR st
 	SVGACBHeader *cb = ((SVGACBHeader *)cmb)-1;

 	BOOL proc_by_cb = cb_support && cb_context0 && (flags & SVGA_CB_FORCE_FIFO) == 0;

 	

+	Wait_Semaphore(cb_sem, 0);

+	

 	/* wait and tidy CB queue */

 	if(proc_by_cb)

 	{

@@ -678,6 +688,7 @@ void SVGA_CMB_submit(DWORD FBPTR cmb, DWORD cmb_size, SVGA_CMB_status_t FBPTR st
 		status->fifo_fence_last = SVGA_fence_passed();

 	}

 	

+	Signal_Semaphore(cb_sem);

 	//dbg_printf(dbg_cmd_off, cmb[0]);

 }

 

diff --git a/vxd_svga_mem.c b/vxd_svga_mem.c
index 026da70..49e5188 100644
--- a/vxd_svga_mem.c
+++ b/vxd_svga_mem.c
@@ -690,6 +690,8 @@ BOOL SVGA_region_create(SVGA_region_info_t *rinfo)
 	

 	DWORD pt_pages = PT_count(new_size);

 

+	Wait_Semaphore(mem_sem, 0);

+

 #ifdef GMR_SYSTEM

 		pa_vm = 0;

 		pa_type = PG_SYS;

@@ -753,6 +755,7 @@ BOOL SVGA_region_create(SVGA_region_info_t *rinfo)
 

 		if(!maddr)

 		{

+			Signal_Semaphore(mem_sem);

 			return FALSE;

 		}

 		

@@ -796,6 +799,7 @@ BOOL SVGA_region_create(SVGA_region_info_t *rinfo)
 			if(!pgblk)

 			{

 				_PageFree((PVOID)laddr, 0);

+				Signal_Semaphore(mem_sem);

 				return FALSE;

 			}

 	

@@ -918,6 +922,7 @@ BOOL SVGA_region_create(SVGA_region_info_t *rinfo)
 	svga_db->stat_regions_usage += rinfo->size;

 	

 //	dbg_printf(dbg_gmr_succ, rinfo->region_id, rinfo->size);

+	Signal_Semaphore(mem_sem);

 	

 	return TRUE;

 }

@@ -933,6 +938,8 @@ void SVGA_region_free(SVGA_region_info_t *rinfo)
 

 	svga_db->stat_regions_usage -= rinfo->size;

 	

+	Wait_Semaphore(mem_sem, 0);

+	

 	saved_in_cache = cache_insert(rinfo);

 	

 	if(gb_support)

@@ -988,7 +995,8 @@ void SVGA_region_free(SVGA_region_info_t *rinfo)
 	}

 		

 	//dbg_printf(dbg_pagefree_end, rinfo->region_id, rinfo->size, saved_in_cache);

-		

+	Signal_Semaphore(mem_sem);

+	

 	rinfo->address        = NULL;

 	rinfo->region_address = NULL;

 	rinfo->mob_address    = NULL;

@@ -1004,6 +1012,7 @@ void SVGA_region_free(SVGA_region_info_t *rinfo)
 void SVGA_flushcache()

 {

 	int i;

+	Wait_Semaphore(mem_sem, 0);

 	

 	for(i = 0; i < cache_state.free_index_max ; i++)

 	{

@@ -1015,5 +1024,7 @@ void SVGA_flushcache()
 	cache_state.cnt_large      = 0;

 	cache_state.cnt_medium     = 0;

 	cache_state.cnt_small      = 0;

+	

+	Signal_Semaphore(mem_sem);

 }