Index: /trunk/src/VBox/Additions/solaris/Mouse/vboxmouse.c
===================================================================
--- /trunk/src/VBox/Additions/solaris/Mouse/vboxmouse.c	(revision 42202)
+++ /trunk/src/VBox/Additions/solaris/Mouse/vboxmouse.c	(revision 42203)
@@ -559,6 +559,6 @@
     if (canput(pReadQueue->q_next))
         putnext(pReadQueue, pMBlk);
-    // else
-    //     putq(pReadQueue, pMBlk);
+    else
+        putq(pReadQueue, pMBlk);
 }
 
@@ -625,5 +625,5 @@
 
 /* Helper for vbmsSolWPut. */
-static int vbmsSolDispatchIOCtl(queue_t *pWriteQueue, mblk_t *pMBlk);
+static int vbmsSolDispatchIOCtl(PVBMSSTATE pState, mblk_t *pMBlk);
 
 /**
@@ -633,8 +633,10 @@
 int vbmsSolWPut(queue_t *pWriteQueue, mblk_t *pMBlk)
 {
-    LogRelFlowFunc((DEVICE_NAME "::\n"));
+    LogRelFlowFunc((DEVICE_NAME "::"));
     switch (pMBlk->b_datap->db_type)
     {
         case M_FLUSH:
+            LogRelFlow(("M_FLUSH, FLUSHW=%RTbool, FLUSHR=%RTbool\n",
+                        *pMBlk->b_rptr & FLUSHW, *pMBlk->b_rptr & FLUSHR));
             /* Flush the write queue if so requested. */
             if (*pMBlk->b_rptr & FLUSHW)
@@ -653,5 +655,10 @@
         case M_IOCDATA:
         {
-            int err = vbmsSolDispatchIOCtl(pWriteQueue, pMBlk);
+            PVBMSSTATE pState = (PVBMSSTATE)pWriteQueue->q_ptr;
+            int err;
+
+            LogRelFlow((  pMBlk->b_datap->db_type == M_IOCTL
+                        ? "M_IOCTL\n" : "M_IOCDATA\n"));
+            err = vbmsSolDispatchIOCtl(pState, pMBlk);
             if (!err)
                 qreply(pWriteQueue, pMBlk);
@@ -660,4 +667,6 @@
             break;
         }
+        default:
+            LogRelFlow(("Unknown command, not acknowledging.\n"));
     }
     return 0;
@@ -1021,7 +1030,7 @@
 
 /* Helpers for vbmsSolDispatchIOCtl. */
-static int vbmsSolHandleIOCtl(queue_t *pWriteQueue, mblk_t *pMBlk,
+static int vbmsSolHandleIOCtl(PVBMSSTATE pState, mblk_t *pMBlk,
                                PFNVBMSSOLIOCTL pfnHandler,
-                               int iCmd, size_t cbTransparent,
+                               int iCmd, size_t cbCmd,
                                enum IOCTLDIRECTION enmDirection);
 static int vbmsSolVUIDIOCtl(PVBMSSTATE pState, int iCmd, void *pvData,
@@ -1061,8 +1070,8 @@
  * respectively.
  * @returns  0 on success or the IOCtl error code on failure.
- * @param  pWriteQueue  pointer to the STREAMS write queue structure.
+ * @param  pState       pointer to the state structure.
  * @param  pMBlk        pointer to the STREAMS message block structure.
  */
-static int vbmsSolDispatchIOCtl(queue_t *pWriteQueue, mblk_t *pMBlk)
+static int vbmsSolDispatchIOCtl(PVBMSSTATE pState, mblk_t *pMBlk)
 {
     struct iocblk *pIOCBlk = (struct iocblk *)pMBlk->b_rptr;
@@ -1071,6 +1080,6 @@
     enum IOCTLDIRECTION enmDirection;
 
-    LogRelFlowFunc((DEVICE_NAME "::iCmdType=%c, iCmd=0x%x\n",
-                 (char) (iCmdType >> 8), (unsigned)iCmd));
+    LogRelFlowFunc((DEVICE_NAME "::pIOCBlk=%p, iCmdType=%c, iCmd=0x%x\n",
+                    pIOCBlk, (char) (iCmdType >> 8), (unsigned)iCmd));
     switch (iCmdType)
     {
@@ -1085,7 +1094,7 @@
                     cbBuffer     = g_aVUIDIOCtlDescriptions[i].cbBuffer;
                     enmDirection = g_aVUIDIOCtlDescriptions[i].enmDirection;
-                    return vbmsSolHandleIOCtl(pWriteQueue, pMBlk,
-                                               vbmsSolVUIDIOCtl, iCmd,
-                                               cbBuffer, enmDirection);
+                    return vbmsSolHandleIOCtl(pState, pMBlk,
+                                              vbmsSolVUIDIOCtl, iCmd,
+                                              cbBuffer, enmDirection);
                 }
             return EINVAL;
@@ -1098,16 +1107,26 @@
 
 /* Helpers for vbmsSolHandleIOCtl. */
-static int vbmsSolHandleIOCtlData(queue_t *pWriteQueue, mblk_t *pMBlk,
-                                   PFNVBMSSOLIOCTL pfnHandler, int iCmd,
-                                   size_t cbTransparent,
-                                   enum IOCTLDIRECTION enmDirection);
-
-static int vbmsSolHandleTransparentIOCtl(queue_t *pWriteQueue, mblk_t *pMBlk,
-                                          PFNVBMSSOLIOCTL pfnHandler,
-                                          int iCmd, size_t cbTransparent,
-                                          enum IOCTLDIRECTION enmDirection);
-
-static int vbmsSolHandleIStrIOCtl(queue_t *pWriteQueue, mblk_t *pMBlk,
+static int vbmsSolHandleIOCtlData(PVBMSSTATE pState, mblk_t *pMBlk,
+                                  PFNVBMSSOLIOCTL pfnHandler, int iCmd,
+                                  size_t cbCmd,
+                                  enum IOCTLDIRECTION enmDirection);
+
+static int vbmsSolHandleTransparentIOCtl(PVBMSSTATE pState, mblk_t *pMBlk,
+                                         PFNVBMSSOLIOCTL pfnHandler,
+                                         int iCmd, size_t cbCmd,
+                                         enum IOCTLDIRECTION enmDirection);
+
+static int vbmsSolHandleIStrIOCtl(PVBMSSTATE pState, mblk_t *pMBlk,
                                    PFNVBMSSOLIOCTL pfnHandler, int iCmd);
+
+static void vbmsSolAcknowledgeIOCtl(mblk_t *pMBlk, int cbData, int rc)
+{
+    struct iocblk *pIOCBlk = (struct iocblk *)pMBlk->b_rptr;
+
+    pMBlk->b_datap->db_type = M_IOCACK;
+    pIOCBlk->ioc_count = cbData;
+    pIOCBlk->ioc_rval = rc;
+    pIOCBlk->ioc_error = 0;
+}
 
 /**
@@ -1120,10 +1139,10 @@
  * buffer anyway, but the caller can choose the buffer size).
  * @returns  0 on success or the IOCtl error code on failure.
- * @param  pWriteQueue    pointer to the STREAMS write queue structure.
+ * @param  pState         pointer to the state structure.
  * @param  pMBlk          pointer to the STREAMS message block structure.
  * @param  pfnHandler     pointer to the right IOCtl handler function for this
  *                        IOCtl number.
  * @param  iCmd           IOCtl command number.
- * @param  cbTransparent  size of the user space buffer for this IOCtl number,
+ * @param  cbCmd          size of the user space buffer for this IOCtl number,
  *                        used for processing transparent IOCtls.  Pass zero
  *                        for IOCtls with no maximum buffer size (which will
@@ -1132,23 +1151,21 @@
  * @param  enmDirection   data transfer direction of the IOCtl.
  */
-static int vbmsSolHandleIOCtl(queue_t *pWriteQueue, mblk_t *pMBlk,
-                               PFNVBMSSOLIOCTL pfnHandler, int iCmd,
-                               size_t cbTransparent,
-                               enum IOCTLDIRECTION enmDirection)
+static int vbmsSolHandleIOCtl(PVBMSSTATE pState, mblk_t *pMBlk,
+                              PFNVBMSSOLIOCTL pfnHandler, int iCmd,
+                              size_t cbCmd, enum IOCTLDIRECTION enmDirection)
 {
     struct iocblk *pIOCBlk = (struct iocblk *)pMBlk->b_rptr;
 
     LogFlowFunc(("iCmd=0x%x, cbBuffer=%d, enmDirection=%d\n",
-                 (unsigned)iCmd, (int)cbTransparent, (int)enmDirection));
+                 (unsigned)iCmd, (int)cbCmd, (int)enmDirection));
     if (pMBlk->b_datap->db_type == M_IOCDATA)
-        return vbmsSolHandleIOCtlData(pWriteQueue, pMBlk, pfnHandler, iCmd,
-                                       cbTransparent, enmDirection);
+        return vbmsSolHandleIOCtlData(pState, pMBlk, pfnHandler, iCmd,
+                                      cbCmd, enmDirection);
     else if (   pMBlk->b_datap->db_type == M_IOCTL
              && pIOCBlk->ioc_count == TRANSPARENT)
-        return vbmsSolHandleTransparentIOCtl(pWriteQueue, pMBlk, pfnHandler,
-                                              iCmd, cbTransparent,
-                                              enmDirection);
+        return vbmsSolHandleTransparentIOCtl(pState, pMBlk, pfnHandler,
+                                             iCmd, cbCmd, enmDirection);
     else if (pMBlk->b_datap->db_type == M_IOCTL)
-        return vbmsSolHandleIStrIOCtl(pWriteQueue, pMBlk, pfnHandler, iCmd);
+        return vbmsSolHandleIStrIOCtl(pState, pMBlk, pfnHandler, iCmd);
     return EINVAL;
 }
@@ -1161,14 +1178,13 @@
  * @copydoc vbmsSolHandleIOCtl
  */
-static int vbmsSolHandleIOCtlData(queue_t *pWriteQueue, mblk_t *pMBlk,
-                                   PFNVBMSSOLIOCTL pfnHandler, int iCmd,
-                                   size_t cbTransparent,
-                                   enum IOCTLDIRECTION enmDirection)
+static int vbmsSolHandleIOCtlData(PVBMSSTATE pState, mblk_t *pMBlk,
+                                  PFNVBMSSOLIOCTL pfnHandler, int iCmd,
+                                  size_t cbCmd,
+                                  enum IOCTLDIRECTION enmDirection)
 {
     struct copyresp *pCopyResp = (struct copyresp *)pMBlk->b_rptr;
-    PVBMSSTATE pState = (PVBMSSTATE)pWriteQueue->q_ptr;
 
     LogFlowFunc(("iCmd=0x%x, cbBuffer=%d, enmDirection=%d, cp_rval=%d, cp_private=%p\n",
-                 (unsigned)iCmd, (int)cbTransparent, (int)enmDirection,
+                 (unsigned)iCmd, (int)cbCmd, (int)enmDirection,
                  (int)(uintptr_t)pCopyResp->cp_rval,
                  (void *)pCopyResp->cp_private));
@@ -1189,9 +1205,9 @@
             return EINVAL;
         pvData = pMBlk->b_cont->b_rptr;
-        err = pfnHandler(pState, iCmd, pvData, cbTransparent, &cbData, NULL);
+        err = pfnHandler(pState, iCmd, pvData, cbCmd, &cbData, NULL);
         if (!err && enmDirection == BOTH)
             mcopyout(pMBlk, NULL, cbData, pCopyResp->cp_private, NULL);
         else if (!err && enmDirection == IN)
-            miocack(pWriteQueue, pMBlk, 0, 0);
+            vbmsSolAcknowledgeIOCtl(pMBlk, 0, 0);
         return err;
     }
@@ -1199,5 +1215,5 @@
     {
         AssertReturn(enmDirection == OUT || enmDirection == BOTH, EINVAL);
-        miocack(pWriteQueue, pMBlk, 0, 0);
+        vbmsSolAcknowledgeIOCtl(pMBlk, 0, 0);
         return 0;
     }
@@ -1210,15 +1226,14 @@
  * @copydoc vbmsSolHandleIOCtl
  */
-int vbmsSolHandleTransparentIOCtl(queue_t *pWriteQueue, mblk_t *pMBlk,
-                                   PFNVBMSSOLIOCTL pfnHandler, int iCmd,
-                                   size_t cbTransparent,
-                                   enum IOCTLDIRECTION enmDirection)
+int vbmsSolHandleTransparentIOCtl(PVBMSSTATE pState, mblk_t *pMBlk,
+                                  PFNVBMSSOLIOCTL pfnHandler, int iCmd,
+                                  size_t cbCmd,
+                                  enum IOCTLDIRECTION enmDirection)
 {
     int err = 0, rc = 0;
     size_t cbData = 0;
-    PVBMSSTATE pState = (PVBMSSTATE)pWriteQueue->q_ptr;
 
     LogFlowFunc(("iCmd=0x%x, cbBuffer=%d, enmDirection=%d\n",
-                 (unsigned)iCmd, (int)cbTransparent, (int)enmDirection));
+                 (unsigned)iCmd, (int)cbCmd, (int)enmDirection));
     if (   (enmDirection != NONE && !pMBlk->b_cont)
         || enmDirection == UNSPECIFIED)
@@ -1230,9 +1245,9 @@
         if (enmDirection == BOTH)
             pUserAddr = *(void **)pMBlk->b_cont->b_rptr;
-	    mcopyin(pMBlk, pUserAddr /* state data */, cbTransparent, NULL);
+	    mcopyin(pMBlk, pUserAddr /* state data */, cbCmd, NULL);
 	}
 	else if (enmDirection == OUT)
     {
-        mblk_t *pMBlkOut = allocb(cbTransparent, BPRI_MED);
+        mblk_t *pMBlkOut = allocb(cbCmd, BPRI_MED);
         void *pvData;
 
@@ -1240,5 +1255,5 @@
             return EAGAIN;
         pvData = pMBlkOut->b_rptr;
-        err = pfnHandler(pState, iCmd, pvData, cbTransparent, &cbData, NULL);
+        err = pfnHandler(pState, iCmd, pvData, cbCmd, &cbData, NULL);
         if (!err)
             mcopyout(pMBlk, NULL, cbData, NULL, pMBlkOut);
@@ -1251,5 +1266,5 @@
         err = pfnHandler(pState, iCmd, NULL, 0, NULL, &rc);
         if (!err)
-            miocack(pWriteQueue, pMBlk, 0, rc);
+            vbmsSolAcknowledgeIOCtl(pMBlk, 0, rc);
     }
     return err;
@@ -1261,9 +1276,8 @@
  * @copydoc vbmsSolHandleIOCtl
  */
-static int vbmsSolHandleIStrIOCtl(queue_t *pWriteQueue, mblk_t *pMBlk,
-                                   PFNVBMSSOLIOCTL pfnHandler, int iCmd)
+static int vbmsSolHandleIStrIOCtl(PVBMSSTATE pState, mblk_t *pMBlk,
+                                  PFNVBMSSOLIOCTL pfnHandler, int iCmd)
 {
     struct iocblk *pIOCBlk = (struct iocblk *)pMBlk->b_rptr;
-    PVBMSSTATE pState = (PVBMSSTATE)pWriteQueue->q_ptr;
     uint_t cbBuffer = pIOCBlk->ioc_count;
     void *pvData = NULL;
@@ -1281,13 +1295,19 @@
         if (err)
             return err;
-    }
-    if (pMBlk->b_cont)  /* consms forgets to set ioc_count. */
-    {
         pvData = pMBlk->b_cont->b_rptr;
-        cbBuffer = pMBlk->b_cont->b_wptr - pMBlk->b_cont->b_rptr;
+    }
+    else if (pMBlk->b_cont)  /* consms forgets to set ioc_count. */
+    {
+        pvData = pMBlk->b_cont->b_rptr;
+        cbBuffer =   pMBlk->b_cont->b_datap->db_lim
+                   - pMBlk->b_cont->b_datap->db_base;
     }
     err = pfnHandler(pState, iCmd, pvData, cbBuffer, &cbData, &rc);
     if (!err)
-        miocack(pWriteQueue, pMBlk, cbData, rc);
+    {
+        LogRelFlowFunc(("pMBlk=%p, pMBlk->b_datap=%p, pMBlk->b_rptr=%p\n",
+                        pMBlk, pMBlk->b_datap, pMBlk->b_rptr));
+        vbmsSolAcknowledgeIOCtl(pMBlk, cbData, rc);
+    }
     return err;
 }
@@ -1301,5 +1321,5 @@
                              size_t cbBuffer, size_t *pcbData, int *prc)
 {
-    LogRelFlowFunc((DEVICE_NAME ":: " /* no '\n' */));
+    LogRelFlowFunc((DEVICE_NAME "::pvData=%p " /* no '\n' */, pvData));
     switch (iCmd)
     {
