Index: /trunk/include/VBox/VBoxVideo.h
===================================================================
--- /trunk/include/VBox/VBoxVideo.h	(revision 50830)
+++ /trunk/include/VBox/VBoxVideo.h	(revision 50831)
@@ -1581,4 +1581,6 @@
 /* same as VBOXCMDVBVA_OPTYPE_NOP, but contains VBOXCMDVBVA_HDR data */
 #define VBOXCMDVBVA_OPTYPE_NOPCMD                       7
+/* actual command is stored in guest system memory */
+#define VBOXCMDVBVA_OPTYPE_SYSMEMCMD                    8
 
 /* nop - is a one-bit command. The buffer size to skip is determined by VBVA buffer size */
@@ -1721,5 +1723,5 @@
      * paging transfer can NOT be initiated for allocations having host 3D object (hostID) associated */
     VBOXCMDVBVA_ALLOCINFO Alloc;
-    uint32_t cSysMem;
+    uint32_t u32Reserved;
     VBOXCMDVBVA_SYSMEMEL aSysMem[1];
 } VBOXCMDVBVA_PAGING_TRANSFER;
@@ -1734,4 +1736,10 @@
 } VBOXCMDVBVA_PAGING_FILL;
 
+typedef struct VBOXCMDVBVA_SYSMEMCMD
+{
+    VBOXCMDVBVA_HDR Hdr;
+    VBOXCMDVBVAPHADDR phSysMem;
+} VBOXCMDVBVA_SYSMEMCMD;
+
 #define VBOXCMDVBVACTL_TYPE_ENABLE     1
 #define VBOXCMDVBVACTL_TYPE_3DCTL      2
Index: /trunk/include/VBox/VBoxVideoHost3D.h
===================================================================
--- /trunk/include/VBox/VBoxVideoHost3D.h	(revision 50830)
+++ /trunk/include/VBox/VBoxVideoHost3D.h	(revision 50831)
@@ -58,5 +58,5 @@
 typedef DECLCALLBACKPTR(int, PFNVBOXCRCMD_SVR_DISABLE)(HVBOXCRCMDSVR hSvr);
 /* process command */
-typedef DECLCALLBACKPTR(int, PFNVBOXCRCMD_SVR_CMD)(HVBOXCRCMDSVR hSvr, PVBOXCMDVBVA_HDR pCmd, uint32_t cbCmd);
+typedef DECLCALLBACKPTR(int8_t, PFNVBOXCRCMD_SVR_CMD)(HVBOXCRCMDSVR hSvr, const VBOXCMDVBVA_HDR *pCmd, uint32_t cbCmd);
 /* process host control */
 typedef DECLCALLBACKPTR(int, PFNVBOXCRCMD_SVR_HOSTCTL)(HVBOXCRCMDSVR hSvr, uint8_t* pCtl, uint32_t cbCmd);
Index: /trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPVbva.cpp
===================================================================
--- /trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPVbva.cpp	(revision 50830)
+++ /trunk/src/VBox/Additions/WINNT/Graphics/Video/mp/wddm/VBoxMPVbva.cpp	(revision 50831)
@@ -1116,12 +1116,9 @@
 
     cbBuffer -= RT_OFFSETOF(VBOXCMDVBVA_PAGING_TRANSFER, aSysMem);
-    uint32_t i = 0;
-
-    for (; cPages && cbBuffer >= sizeof (VBOXCMDVBVA_PAGING_TRANSFER); ++cEls, cbBuffer-=sizeof (VBOXCMDVBVA_SYSMEMEL), ++pEl, ++i)
+
+    for (; cPages && cbBuffer >= sizeof (VBOXCMDVBVA_SYSMEMEL); ++cEls, cbBuffer-=sizeof (VBOXCMDVBVA_SYSMEMEL), ++pEl)
     {
         cPages = vboxCVDdiSysMemElBuild(pEl, pMdl, iPfn + cInitPages - cPages, cPages);
     }
-
-    pCmd->cSysMem = i;
 
 done:
Index: /trunk/src/VBox/Devices/Graphics/DevVGA_VDMA.cpp
===================================================================
--- /trunk/src/VBox/Devices/Graphics/DevVGA_VDMA.cpp	(revision 50830)
+++ /trunk/src/VBox/Devices/Graphics/DevVGA_VDMA.cpp	(revision 50831)
@@ -22,4 +22,5 @@
 #include <iprt/asm.h>
 #include <iprt/list.h>
+#include <iprt/param.h>
 
 #include "DevVGA.h"
@@ -1157,13 +1158,319 @@
 }
 
-
-/*
- * @returns
- *
+/**
+ * @param fIn - whether this is a page in or out op.
+ * the direction is VRA#M - related, so fIn == true - transfer to VRAM); false - transfer from VRAM
  */
-static int vboxVDMACrCmdProcess(struct VBOXVDMAHOST *pVdma, uint8_t* pu8Cmd, uint32_t cbCmd)
+static int vboxVDMACrCmdVbvaProcessPagingEl(PPDMDEVINS pDevIns, const VBOXCMDVBVA_SYSMEMEL *pMemEl, uint8_t *pu8Vram, uint8_t *pu8VramMax, uint8_t **ppu8VramNext, bool fIn)
+{
+    uint32_t u32Cpages = pMemEl->cPagesAfterFirst + 1;
+    RTGCPHYS phPage = (pMemEl->iPage1 | (pMemEl->iPage2 << 20));
+    PGMPAGEMAPLOCK Lock;
+    uint32_t cbCopy = u32Cpages * PAGE_SIZE;
+    uint8_t* pu8VramNext = pu8Vram + cbCopy;
+
+    if (pu8VramNext <= pu8Vram && pu8VramNext > pu8VramMax)
+    {
+        WARN(("invalid copy size"));
+        return VERR_INVALID_PARAMETER;
+    }
+
+    int rc;
+    if (fIn)
+    {
+        for (uint32_t i = 0; i < u32Cpages; ++i)
+        {
+            const void * pvPage;
+            rc = PDMDevHlpPhysGCPhys2CCPtrReadOnly(pDevIns, phPage, 0, &pvPage, &Lock);
+            if (!RT_SUCCESS(rc))
+            {
+                WARN(("PDMDevHlpPhysGCPhys2CCPtrReadOnly failed %d", rc));
+                return rc;
+            }
+
+            memcpy(pu8Vram, pvPage, PAGE_SIZE);
+
+            PDMDevHlpPhysReleasePageMappingLock(pDevIns, &Lock);
+
+            pu8Vram += PAGE_SIZE;
+        }
+    }
+    else
+    {
+        for (uint32_t i = 0; i < u32Cpages; ++i)
+        {
+            void * pvPage;
+            rc = PDMDevHlpPhysGCPhys2CCPtr(pDevIns, phPage, 0, &pvPage, &Lock);
+            if (!RT_SUCCESS(rc))
+            {
+                WARN(("PDMDevHlpPhysGCPhys2CCPtr failed %d", rc));
+                return rc;
+            }
+
+            memcpy(pvPage, pu8Vram, PAGE_SIZE);
+
+            PDMDevHlpPhysReleasePageMappingLock(pDevIns, &Lock);
+
+            pu8Vram += PAGE_SIZE;
+        }
+    }
+
+    if (ppu8VramNext)
+        *ppu8VramNext = pu8VramNext;
+
+    return VINF_SUCCESS;
+}
+
+static int vboxVDMACrCmdVbvaProcessPagingEls(PPDMDEVINS pDevIns, const VBOXCMDVBVA_SYSMEMEL *pMemEl, uint32_t cMemEls, uint8_t *pu8Vram, uint8_t *pu8VramMax, uint8_t **ppu8VramNext, bool fIn)
+{
+    uint8_t *pu8VramNext = pu8Vram;
+    for (uint32_t i = 0; i < cMemEls; ++i, ++pMemEl)
+    {
+        int rc = vboxVDMACrCmdVbvaProcessPagingEl(pDevIns, pMemEl, pu8Vram, pu8VramMax, &pu8VramNext, fIn);
+        if (!RT_SUCCESS(rc))
+        {
+            WARN(("vboxVDMACrCmdVbvaProcessPagingEl failed %d", rc));
+            return rc;
+        }
+    }
+
+    if (ppu8VramNext)
+        *ppu8VramNext = pu8VramNext;
+
+    return VINF_SUCCESS;
+}
+
+static int8_t vboxVDMACrCmdVbvaPagingDataInit(PVGASTATE pVGAState, const VBOXCMDVBVA_HDR *pCmd, uint32_t cbCmd,
+                            const VBOXCMDVBVA_SYSMEMEL **ppSysMem, uint32_t *pcSysMem,
+                            uint8_t **ppu8Vram, uint8_t **ppu8VramMax, bool *pfIn)
+{
+    if (cbCmd < sizeof (VBOXCMDVBVA_PAGING_TRANSFER))
+    {
+        WARN(("cmd too small"));
+        return -1;
+    }
+
+    uint32_t cSysMem = cbCmd - RT_OFFSETOF(VBOXCMDVBVA_PAGING_TRANSFER, aSysMem);
+    if (cSysMem % sizeof (VBOXCMDVBVA_SYSMEMEL))
+    {
+        WARN(("invalid cmd size"));
+        return -1;
+    }
+    cSysMem /= sizeof (VBOXCMDVBVA_SYSMEMEL);
+
+    VBOXCMDVBVA_PAGING_TRANSFER *pTransfer = (VBOXCMDVBVA_PAGING_TRANSFER*)pCmd;
+    VBOXCMDVBVAOFFSET offVRAM = pTransfer->Alloc.u.offVRAM;
+    if (offVRAM & PAGE_OFFSET_MASK)
+    {
+        WARN(("offVRAM address is not on page boundary\n"));
+        return -1;
+    }
+    const VBOXCMDVBVA_SYSMEMEL *pSysMem = pTransfer->aSysMem;
+
+    uint8_t * pu8VramBase = pVGAState->vram_ptrR3;
+    uint8_t *pu8VramMax = pu8VramBase + pVGAState->vram_size;
+    if (pTransfer->Alloc.u.offVRAM >= pVGAState->vram_size)
+    {
+        WARN(("invalid vram offset"));
+        return -1;
+    }
+
+    uint8_t *pu8Vram = pu8VramBase + pTransfer->Alloc.u.offVRAM;
+    bool fIn = (pTransfer->Hdr.u8Flags & VBOXCMDVBVA_OPF_PAGING_TRANSFER_IN);
+
+    *ppSysMem = pSysMem;
+    *pcSysMem = cSysMem;
+    *ppu8Vram = pu8Vram;
+    *ppu8VramMax = pu8VramMax;
+    *pfIn = fIn;
+    return 0;
+}
+
+static int8_t vboxVDMACrCmdVbvaProcessCmdData(struct VBOXVDMAHOST *pVdma, const VBOXCMDVBVA_HDR *pCmd, uint32_t cbCmd)
+{
+    switch (pCmd->u8OpCode)
+    {
+        case VBOXCMDVBVA_OPTYPE_NOPCMD:
+            return 0;
+        case VBOXCMDVBVA_OPTYPE_PAGING_TRANSFER:
+        {
+            PVGASTATE pVGAState = pVdma->pVGAState;
+            const VBOXCMDVBVA_SYSMEMEL *pSysMem;
+            uint32_t cSysMem;
+            uint8_t *pu8Vram;
+            uint8_t *pu8VramMax;
+            bool fIn;
+            int8_t i8Result = vboxVDMACrCmdVbvaPagingDataInit(pVGAState, pCmd, cbCmd,
+                                                                &pSysMem, &cSysMem,
+                                                                &pu8Vram, &pu8VramMax, &fIn);
+            if (i8Result < 0)
+            {
+                WARN(("vboxVDMACrCmdVbvaPagingDataInit failed %d", i8Result));
+                return i8Result;
+            }
+
+            PPDMDEVINS pDevIns = pVGAState->pDevInsR3;
+            int rc = vboxVDMACrCmdVbvaProcessPagingEls(pDevIns, pSysMem, cSysMem, pu8Vram, pu8VramMax, &pu8Vram, fIn);
+            if (!RT_SUCCESS(rc))
+            {
+                WARN(("vboxVDMACrCmdVbvaProcessPagingEls failed %d", rc));
+                return -1;
+            }
+
+            return 0;
+        }
+        case VBOXCMDVBVA_OPTYPE_PAGING_FILL:
+            WARN(("VBOXCMDVBVA_OPTYPE_PAGING_FILL not implemented"));
+            return -1;
+        default:
+            return pVdma->CrSrvInfo.pfnCmd(pVdma->CrSrvInfo.hSvr, pCmd, cbCmd);
+    }
+}
+
+#if 0
+typedef struct VBOXCMDVBVA_PAGING_TRANSFER
+{
+    VBOXCMDVBVA_HDR Hdr;
+    /* for now can only contain offVRAM.
+     * paging transfer can NOT be initiated for allocations having host 3D object (hostID) associated */
+    VBOXCMDVBVA_ALLOCINFO Alloc;
+    uint32_t u32Reserved;
+    VBOXCMDVBVA_SYSMEMEL aSysMem[1];
+} VBOXCMDVBVA_PAGING_TRANSFER;
+#endif
+
+AssertCompile(sizeof (VBOXCMDVBVA_HDR) == 8);
+AssertCompile(sizeof (VBOXCMDVBVA_ALLOCINFO) == 4);
+AssertCompile(sizeof (VBOXCMDVBVA_SYSMEMEL) == 8);
+AssertCompile(!(PAGE_SIZE % sizeof (VBOXCMDVBVA_SYSMEMEL)));
+AssertCompile(!(sizeof (VBOXCMDVBVA_PAGING_TRANSFER) % 8));
+
+#define VBOXCMDVBVA_NUM_SYSMEMEL_PER_PAGE (PAGE_SIZE / sizeof (VBOXCMDVBVA_SYSMEMEL))
+
+static int8_t vboxVDMACrCmdVbvaProcess(struct VBOXVDMAHOST *pVdma, const VBOXCMDVBVA_HDR *pCmd, uint32_t cbCmd)
+{
+    switch (pCmd->u8OpCode)
+    {
+        case VBOXCMDVBVA_OPTYPE_SYSMEMCMD:
+        {
+            VBOXCMDVBVA_SYSMEMCMD *pSysmemCmd = (VBOXCMDVBVA_SYSMEMCMD*)pCmd;
+            const VBOXCMDVBVA_HDR *pRealCmd;
+            uint32_t cbRealCmd = pCmd->u8Flags;
+            cbRealCmd |= (pCmd->u.u8PrimaryID << 8);
+            if (cbRealCmd < sizeof (VBOXCMDVBVA_HDR))
+            {
+                WARN(("invalid sysmem cmd size"));
+                return -1;
+            }
+
+            RTGCPHYS phPage = pSysmemCmd->phSysMem;
+            if (phPage & PAGE_OFFSET_MASK)
+            {
+                WARN(("cmd address is not on page boundary\n"));
+                return -1;
+            }
+
+            PGMPAGEMAPLOCK Lock;
+            PVGASTATE pVGAState = pVdma->pVGAState;
+            PPDMDEVINS pDevIns = pVGAState->pDevInsR3;
+            const void * pvCmd;
+            int rc = PDMDevHlpPhysGCPhys2CCPtrReadOnly(pDevIns, phPage, 0, &pvCmd, &Lock);
+            if (!RT_SUCCESS(rc))
+            {
+                WARN(("PDMDevHlpPhysGCPhys2CCPtrReadOnly failed %d\n", rc));
+                return -1;
+            }
+
+            pRealCmd = (const VBOXCMDVBVA_HDR *)pvCmd;
+
+            if (cbRealCmd <= PAGE_SIZE)
+            {
+                uint8_t i8Result = vboxVDMACrCmdVbvaProcessCmdData(pVdma, pRealCmd, cbRealCmd);
+                PDMDevHlpPhysReleasePageMappingLock(pDevIns, &Lock);
+                return i8Result;
+            }
+
+            int8_t i8Result = 0;
+
+            switch (pRealCmd->u8OpCode)
+            {
+                case VBOXCMDVBVA_OPTYPE_PAGING_TRANSFER:
+                {
+                    const VBOXCMDVBVA_SYSMEMEL *pSysMem;
+                    uint32_t cSysMem;
+                    uint8_t *pu8Vram;
+                    uint8_t *pu8VramMax;
+                    bool fIn;
+                    i8Result = vboxVDMACrCmdVbvaPagingDataInit(pVGAState, pCmd, cbCmd,
+                                                                        &pSysMem, &cSysMem,
+                                                                        &pu8Vram, &pu8VramMax, &fIn);
+                    if (i8Result < 0)
+                    {
+                        WARN(("vboxVDMACrCmdVbvaPagingDataInit failed %d", i8Result));
+                        return i8Result;
+                    }
+
+                    uint32_t cCurSysMem = PAGE_SIZE - RT_OFFSETOF(VBOXCMDVBVA_PAGING_TRANSFER, aSysMem);
+                    cCurSysMem /= sizeof (VBOXCMDVBVA_SYSMEMEL);
+                    Assert(cCurSysMem < cSysMem);
+
+                    do
+                    {
+                        rc = vboxVDMACrCmdVbvaProcessPagingEls(pDevIns, pSysMem, cCurSysMem, pu8Vram, pu8VramMax, &pu8Vram, fIn);
+                        if (!RT_SUCCESS(rc))
+                        {
+                            WARN(("vboxVDMACrCmdVbvaProcessPagingEls failed %d", rc));
+                            i8Result = -1;
+                            break;
+                        }
+
+                        Assert(cSysMem >= cCurSysMem);
+                        cSysMem -= cCurSysMem;
+
+                        if (!cSysMem)
+                            break;
+
+                        PDMDevHlpPhysReleasePageMappingLock(pDevIns, &Lock);
+
+                        phPage += PAGE_SIZE;
+
+                        rc = PDMDevHlpPhysGCPhys2CCPtrReadOnly(pDevIns, phPage, 0, &pvCmd, &Lock);
+                        if (!RT_SUCCESS(rc))
+                        {
+                            WARN(("PDMDevHlpPhysGCPhys2CCPtrReadOnly failed %d\n", rc));
+                            return -1;
+                        }
+
+                        if (cSysMem > VBOXCMDVBVA_NUM_SYSMEMEL_PER_PAGE)
+                            cCurSysMem = VBOXCMDVBVA_NUM_SYSMEMEL_PER_PAGE;
+                        else
+                            cCurSysMem = cSysMem;
+                    } while (1);
+                    break;
+                }
+                default:
+                    WARN(("command can not be splitted"));
+                    i8Result = -1;
+                    break;
+            }
+
+            PDMDevHlpPhysReleasePageMappingLock(pDevIns, &Lock);
+            return i8Result;
+        }
+        default:
+            return vboxVDMACrCmdVbvaProcessCmdData(pVdma, pCmd, cbCmd);
+    }
+}
+
+static void vboxVDMACrCmdProcess(struct VBOXVDMAHOST *pVdma, uint8_t* pu8Cmd, uint32_t cbCmd)
 {
     if (*pu8Cmd == VBOXCMDVBVA_OPTYPE_NOP)
-        return VINF_EOF;
+        return;
+
+    if (cbCmd < sizeof (VBOXCMDVBVA_HDR))
+    {
+        WARN(("invalid command size"));
+        return;
+    }
 
     PVBOXCMDVBVA_HDR pCmd = (PVBOXCMDVBVA_HDR)pu8Cmd;
@@ -1173,48 +1480,8 @@
     {
         Assert(pCmd->u8State == VBOXCMDVBVA_STATE_CANCELLED);
-        return VINF_EOF;
-    }
-
-    /* come commands can be handled right away? */
-    switch (pCmd->u8OpCode)
-    {
-        case VBOXCMDVBVA_OPTYPE_NOPCMD:
-            pCmd->u.i8Result = 0;
-            return VINF_EOF;
-        default:
-            return VINF_SUCCESS;
-    }
-}
-
-static DECLCALLBACK(int) vboxVDMACrCmdEnable(HVBOXCRCMDSVR hSvr, VBOXCRCMD_SVRENABLE_INFO *pInfo)
-{
-    return VINF_SUCCESS;
-}
-
-static DECLCALLBACK(void) vboxVDMACrCmdDisable(HVBOXCRCMDSVR hSvr)
-{
-}
-
-static DECLCALLBACK(int) vboxVDMACrCmdCtl(HVBOXCRCMDSVR hSvr, uint8_t* pCmd, uint32_t cbCmd)
-{
-    return VERR_NOT_SUPPORTED;
-}
-
-static DECLCALLBACK(int) vboxVDMACrCmdCmd(HVBOXCRCMDSVR hSvr, PVBOXCMDVBVA_HDR pCmd, uint32_t cbCmd)
-{
-    switch (pCmd->u8OpCode)
-    {
-#if 0
-        case VBOXCMDVBVA_OPTYPE_BLT_OFFPRIMSZFMT_OR_ID:
-        {
-            crVBoxServerCrCmdBltProcess(pCmd, cbCmd);
-            break;
-        }
-#endif
-        default:
-            WARN(("unsupported command\n"));
-            pCmd->u.i8Result = -1;
-    }
-    return VINF_SUCCESS;
+        return;
+    }
+
+    pCmd->u.i8Result = vboxVDMACrCmdVbvaProcess(pVdma, pCmd, cbCmd);
 }
 
Index: /trunk/src/VBox/GuestHost/OpenGL/include/cr_protocol.h
===================================================================
--- /trunk/src/VBox/GuestHost/OpenGL/include/cr_protocol.h	(revision 50830)
+++ /trunk/src/VBox/GuestHost/OpenGL/include/cr_protocol.h	(revision 50831)
@@ -103,5 +103,5 @@
         struct VBOXVDMACMD_CHROMIUM_CMD *pHgsmiCmd;
         struct VBOXCMDVBVA_CRCMD_CMD *pVbvaCmd;
-        void *pvCmd;
+        const void *pvCmd;
     };
     int          *pCmdRc;
Index: /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server.h
===================================================================
--- /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server.h	(revision 50830)
+++ /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server.h	(revision 50831)
@@ -464,5 +464,5 @@
 void CrFbTexDataInit(CR_TEXDATA* pFbTex, const VBOXVR_TEXTURE *pTex, PFNCRTEXDATA_RELEASED pfnTextureReleased);
 
-int32_t crVBoxServerCrCmdBltProcess(PVBOXCMDVBVA_HDR pCmd, uint32_t cbCmd);
+int8_t crVBoxServerCrCmdBltProcess(const VBOXCMDVBVA_HDR *pCmd, uint32_t cbCmd);
 
 //#define VBOX_WITH_CRSERVER_DUMPER
Index: /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_main.c
===================================================================
--- /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_main.c	(revision 50830)
+++ /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_main.c	(revision 50831)
@@ -60,5 +60,5 @@
 int tearingdown = 0; /* can't be static */
 
-static DECLCALLBACK(int) crVBoxCrCmdCmd(HVBOXCRCMDSVR hSvr, PVBOXCMDVBVA_HDR pCmd, uint32_t cbCmd);
+static DECLCALLBACK(int8_t) crVBoxCrCmdCmd(HVBOXCRCMDSVR hSvr, const VBOXCMDVBVA_HDR *pCmd, uint32_t cbCmd);
 
 DECLINLINE(CRClient*) crVBoxServerClientById(uint32_t u32ClientID)
@@ -2989,5 +2989,5 @@
 #ifdef VBOX_WITH_CRHGSMI
 
-static int32_t crVBoxServerCmdVbvaCrCmdProcess(struct VBOXCMDVBVA_CRCMD_CMD *pCmd, uint32_t cbCmd)
+static int32_t crVBoxServerCmdVbvaCrCmdProcess(const struct VBOXCMDVBVA_CRCMD_CMD *pCmd, uint32_t cbCmd)
 {
     int32_t rc;
@@ -3047,5 +3047,5 @@
             {
                 CRVBOXHGSMIWRITE* pFnCmd = (CRVBOXHGSMIWRITE*)pHdr;
-                VBOXCMDVBVA_CRCMD_BUFFER *pBuf = &pCmd->aBuffers[1];
+                const VBOXCMDVBVA_CRCMD_BUFFER *pBuf = &pCmd->aBuffers[1];
                 /* Fetch parameters. */
                 uint32_t cbBuffer = pBuf->cbBuffer;
@@ -3103,5 +3103,5 @@
                 /* Fetch parameters. */
                 uint32_t u32InjectClientID = pFnCmd->u32ClientID;
-                VBOXCMDVBVA_CRCMD_BUFFER *pBuf = &pCmd->aBuffers[1];
+                const VBOXCMDVBVA_CRCMD_BUFFER *pBuf = &pCmd->aBuffers[1];
                 uint32_t cbBuffer = pBuf->cbBuffer;
                 uint8_t *pBuffer  = VBOXCRHGSMI_PTR_SAFE(pBuf->offBuffer, cbBuffer, uint8_t);
@@ -3153,5 +3153,5 @@
             {
                 CRVBOXHGSMIREAD *pFnCmd = (CRVBOXHGSMIREAD*)pHdr;
-                VBOXCMDVBVA_CRCMD_BUFFER *pBuf = &pCmd->aBuffers[1];
+                const VBOXCMDVBVA_CRCMD_BUFFER *pBuf = &pCmd->aBuffers[1];
                 /* Fetch parameters. */
                 uint32_t cbBuffer = pBuf->cbBuffer;
@@ -3207,6 +3207,6 @@
             {
                 CRVBOXHGSMIWRITEREAD *pFnCmd = (CRVBOXHGSMIWRITEREAD*)pHdr;
-                VBOXCMDVBVA_CRCMD_BUFFER *pBuf = &pCmd->aBuffers[1];
-                VBOXCMDVBVA_CRCMD_BUFFER *pWbBuf = &pCmd->aBuffers[2];
+                const VBOXCMDVBVA_CRCMD_BUFFER *pBuf = &pCmd->aBuffers[1];
+                const VBOXCMDVBVA_CRCMD_BUFFER *pWbBuf = &pCmd->aBuffers[2];
 
                 /* Fetch parameters. */
@@ -3452,5 +3452,5 @@
 
 
-static DECLCALLBACK(int) crVBoxCrCmdCmd(HVBOXCRCMDSVR hSvr, PVBOXCMDVBVA_HDR pCmd, uint32_t cbCmd)
+static DECLCALLBACK(int8_t) crVBoxCrCmdCmd(HVBOXCRCMDSVR hSvr, const VBOXCMDVBVA_HDR *pCmd, uint32_t cbCmd)
 {
     AssertFailed();
@@ -3459,38 +3459,35 @@
         case VBOXCMDVBVA_OPTYPE_CRCMD:
         {
-            VBOXCMDVBVA_CRCMD *pCrCmdDr;
-            VBOXCMDVBVA_CRCMD_CMD *pCrCmd;
+            const VBOXCMDVBVA_CRCMD *pCrCmdDr;
+            const VBOXCMDVBVA_CRCMD_CMD *pCrCmd;
             int rc;
-            pCrCmdDr = (VBOXCMDVBVA_CRCMD*)pCmd;
+            pCrCmdDr = (const VBOXCMDVBVA_CRCMD*)pCmd;
             pCrCmd = &pCrCmdDr->Cmd;
             if (cbCmd < sizeof (VBOXCMDVBVA_CRCMD))
             {
                 WARN(("invalid buffer size"));
-                pCmd->u.i8Result = -1;
-                break;
+                return -1;
             }
             rc = crVBoxServerCmdVbvaCrCmdProcess(pCrCmd, cbCmd - RT_OFFSETOF(VBOXCMDVBVA_CRCMD, Cmd));
             if (RT_SUCCESS(rc))
             {
-            /* success */
-                pCmd->u.i8Result = 0;
+                /* success */
+                return 0;
             }
-            else
-            {
-                WARN(("crVBoxServerCmdVbvaCrCmdProcess failed, rc %d", rc));
-                pCmd->u.i8Result = -1;
-            }
-            break;
+
+            WARN(("crVBoxServerCmdVbvaCrCmdProcess failed, rc %d", rc));
+            return -1;
         }
         case VBOXCMDVBVA_OPTYPE_BLT_OFFPRIMSZFMT_OR_ID:
         {
-            crVBoxServerCrCmdBltProcess(pCmd, cbCmd);
-            break;
+            return crVBoxServerCrCmdBltProcess(pCmd, cbCmd);
         }
         default:
             WARN(("unsupported command"));
-            pCmd->u.i8Result = -1;
-    }
-    return VINF_SUCCESS;
+            return -1;
+    }
+
+    WARN(("internal error"));
+    return -1;
 }
 
Index: /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_presenter.cpp
===================================================================
--- /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_presenter.cpp	(revision 50830)
+++ /trunk/src/VBox/HostServices/SharedOpenGL/crserverlib/server_presenter.cpp	(revision 50831)
@@ -4629,5 +4629,5 @@
 }
 
-int32_t crVBoxServerCrCmdBltProcess(PVBOXCMDVBVA_HDR pCmd, uint32_t cbCmd)
+int8_t crVBoxServerCrCmdBltProcess(const VBOXCMDVBVA_HDR *pCmd, uint32_t cbCmd)
 {
     uint8_t u8Flags = pCmd->u8Flags;
@@ -4640,6 +4640,5 @@
         {
             WARN(("request to present on disabled framebuffer, ignore"));
-            pCmd->u.i8Result = -1;
-            return VINF_SUCCESS;
+            return -1;
         }
 
@@ -4658,6 +4657,5 @@
                 WARN(("RTMemAlloc failed!"));
                 g_CrPresenter.cbTmpBuf = 0;
-                pCmd->u.i8Result = -1;
-                return VINF_SUCCESS;
+                return -1;
             }
         }
@@ -4690,6 +4688,5 @@
                     {
                         WARN(("invalid param"));
-                        pCmd->u.i8Result = -1;
-                        return VINF_SUCCESS;
+                        return -1;
                     }
 
@@ -4702,5 +4699,5 @@
                     {
                         WARN(("CrFbBltPutContentsNe failed %d", rc));
-                        return rc;
+                        return -1;
                     }
 
@@ -4766,5 +4763,5 @@
                     }
                 }
-                return VINF_SUCCESS;
+                return 0;
             }
             else
@@ -4772,6 +4769,5 @@
                 /* blit from one primary to another primary, wow */
                 WARN(("not implemented"));
-                pCmd->u.i8Result = -1;
-                return VINF_SUCCESS;
+                return -1;
             }
         }
@@ -4784,6 +4780,5 @@
                 uint32_t texId = pBlt->alloc.u.id;
                 WARN(("not implemented"));
-                pCmd->u.i8Result = -1;
-                return VINF_SUCCESS;
+                return -1;
             }
             else
@@ -4796,6 +4791,5 @@
                 {
                     WARN(("invalid param"));
-                    pCmd->u.i8Result = -1;
-                    return VINF_SUCCESS;
+                    return -1;
                 }
 
@@ -4818,6 +4812,5 @@
                 {
                     WARN(("CrFbBltGetContents failed %d", rc));
-                    pCmd->u.i8Result = -1;
-                    return VINF_SUCCESS;
+                    return -1;
                 }
             }
@@ -4827,9 +4820,7 @@
     {
         WARN(("not implemented"));
-        pCmd->u.i8Result = -1;
-        return VINF_SUCCESS;
-    }
-
-    pCmd->u.i8Result = 0;
-    return VINF_SUCCESS;
-}
+        return -1;
+    }
+
+    return 0;
+}
