Index: /trunk/src/VBox/Devices/Storage/DevAHCI.cpp
===================================================================
--- /trunk/src/VBox/Devices/Storage/DevAHCI.cpp	(revision 52025)
+++ /trunk/src/VBox/Devices/Storage/DevAHCI.cpp	(revision 52026)
@@ -5431,8 +5431,9 @@
  *
  * @returns Pointer to the memory or NULL on failure
+ * @param   pAhciPort   The AHCI port.
  * @param   pAhciReq    The request to allocate memory for.
  * @param   cb          The amount of memory to allocate.
  */
-static void *ahciReqMemAlloc(PAHCIREQ pAhciReq, size_t cb)
+static void *ahciReqMemAlloc(PAHCIPort pAhciPort, PAHCIREQ pAhciReq, size_t cb)
 {
     if (pAhciReq->cbAlloc > cb)
@@ -5443,8 +5444,12 @@
     {
         if (pAhciReq->cbAlloc)
-            RTMemPageFree(pAhciReq->pvAlloc, pAhciReq->cbAlloc);
-
+            pAhciPort->pDrvBlock->pfnIoBufFree(pAhciPort->pDrvBlock, pAhciReq->pvAlloc, pAhciReq->cbAlloc);
+
+        pAhciReq->pvAlloc = NULL;
         pAhciReq->cbAlloc = RT_ALIGN_Z(cb, _4K);
-        pAhciReq->pvAlloc = RTMemPageAlloc(pAhciReq->cbAlloc);
+        int rc = pAhciPort->pDrvBlock->pfnIoBufAlloc(pAhciPort->pDrvBlock, pAhciReq->cbAlloc, &pAhciReq->pvAlloc);
+        if (RT_FAILURE(rc))
+            pAhciReq->pvAlloc = NULL;
+
         pAhciReq->cAllocTooMuch = 0;
         if (RT_UNLIKELY(!pAhciReq->pvAlloc))
@@ -5459,13 +5464,19 @@
  *
  * @returns nothing.
+ * @param   pAhciPort   The AHCI port.
  * @param   pAhciReq    The request.
- */
-static void ahciReqMemFree(PAHCIREQ pAhciReq)
-{
-    if (pAhciReq->cAllocTooMuch >= AHCI_MAX_ALLOC_TOO_MUCH)
-    {
-        RTMemPageFree(pAhciReq->pvAlloc, pAhciReq->cbAlloc);
-        pAhciReq->cbAlloc = 0;
-        pAhciReq->cAllocTooMuch = 0;
+ * @param   fForceFree  Flag whether to force a free
+ */
+static void ahciReqMemFree(PAHCIPort pAhciPort, PAHCIREQ pAhciReq, bool fForceFree)
+{
+    if (   pAhciReq->cAllocTooMuch >= AHCI_MAX_ALLOC_TOO_MUCH
+        || fForceFree)
+    {
+        if (pAhciReq->cbAlloc)
+        {
+            pAhciPort->pDrvBlock->pfnIoBufFree(pAhciPort->pDrvBlock, pAhciReq->pvAlloc, pAhciReq->cbAlloc);
+            pAhciReq->cbAlloc = 0;
+            pAhciReq->cAllocTooMuch = 0;
+        }
     }
 }
@@ -5581,9 +5592,9 @@
  *
  * @returns VBox status code.
- * @param   pDevIns     The device instance.
+ * @param   pAhciPort   The AHCI port.
  * @param   pAhciReq    The request state.
  * @param   cbTransfer  Amount of bytes to allocate.
  */
-static int ahciIoBufAllocate(PPDMDEVINS pDevIns, PAHCIREQ pAhciReq, size_t cbTransfer)
+static int ahciIoBufAllocate(PAHCIPort pAhciPort, PAHCIREQ pAhciReq, size_t cbTransfer)
 {
     AssertMsg(   pAhciReq->enmTxDir == AHCITXDIR_READ
@@ -5591,5 +5602,5 @@
               ("Allocating I/O memory for a non I/O request is not allowed\n"));
 
-    pAhciReq->u.Io.DataSeg.pvSeg = ahciReqMemAlloc(pAhciReq, cbTransfer);
+    pAhciReq->u.Io.DataSeg.pvSeg = ahciReqMemAlloc(pAhciPort, pAhciReq, cbTransfer);
     if (!pAhciReq->u.Io.DataSeg.pvSeg)
         return VERR_NO_MEMORY;
@@ -5598,5 +5609,5 @@
     if (pAhciReq->enmTxDir == AHCITXDIR_WRITE)
     {
-        ahciCopyFromPrdtl(pDevIns, pAhciReq,
+        ahciCopyFromPrdtl(pAhciPort->pDevInsR3, pAhciReq,
                           pAhciReq->u.Io.DataSeg.pvSeg,
                           cbTransfer);
@@ -5609,10 +5620,10 @@
  *
  * @returns nothing.
- * @param   pDevIns      The device instance.
+ * @param   pAhciPort    The AHCI port.
  * @param   pAhciReq     The request state.
  * @param   fCopyToGuest Flag whether to update the guest buffer if necessary.
  *                       Nothing is copied if false even if the request was a read.
  */
-static void ahciIoBufFree(PPDMDEVINS pDevIns, PAHCIREQ pAhciReq,
+static void ahciIoBufFree(PAHCIPort pAhciPort, PAHCIREQ pAhciReq,
                           bool fCopyToGuest)
 {
@@ -5632,15 +5643,15 @@
             if (RT_SUCCESS(rc))
             {
-                pAhciReq->cbTransfer = ahciCopyToPrdtl(pDevIns, pAhciReq, pv, cb);
+                pAhciReq->cbTransfer = ahciCopyToPrdtl(pAhciPort->pDevInsR3, pAhciReq, pv, cb);
                 RTMemFree(pv);
             }
         }
         else
-            ahciCopyToPrdtl(pDevIns, pAhciReq,
+            ahciCopyToPrdtl(pAhciPort->pDevInsR3, pAhciReq,
                             pAhciReq->u.Io.DataSeg.pvSeg,
                             pAhciReq->u.Io.DataSeg.cbSeg);
     }
 
-    ahciReqMemFree(pAhciReq);
+    ahciReqMemFree(pAhciPort, pAhciReq, false /* fForceFree */);
     pAhciReq->u.Io.DataSeg.pvSeg = NULL;
     pAhciReq->u.Io.DataSeg.cbSeg = 0;
@@ -5956,5 +5967,5 @@
         if (pAhciReq->enmTxDir == AHCITXDIR_READ)
         {
-            ahciIoBufFree(pAhciPort->pDevInsR3, pAhciReq, true /* fCopyToGuest */);
+            ahciIoBufFree(pAhciPort, pAhciReq, true /* fCopyToGuest */);
             STAM_REL_COUNTER_ADD(&pAhciPort->StatBytesRead, pAhciReq->cbTransfer);
             pAhciPort->Led.Actual.s.fReading = 0;
@@ -5962,5 +5973,5 @@
         else if (pAhciReq->enmTxDir == AHCITXDIR_WRITE)
         {
-            ahciIoBufFree(pAhciPort->pDevInsR3, pAhciReq, false /* fCopyToGuest */);
+            ahciIoBufFree(pAhciPort, pAhciReq, false /* fCopyToGuest */);
             STAM_REL_COUNTER_ADD(&pAhciPort->StatBytesWritten, pAhciReq->cbTransfer);
             pAhciPort->Led.Actual.s.fWriting = 0;
@@ -6077,5 +6088,5 @@
             ahciTrimRangesDestroy(pAhciReq);
         else if (pAhciReq->enmTxDir != AHCITXDIR_FLUSH)
-            ahciIoBufFree(pAhciPort->pDevInsR3, pAhciReq, false /* fCopyToGuest */);
+            ahciIoBufFree(pAhciPort, pAhciReq, false /* fCopyToGuest */);
 
         /* Leave a log message about the canceled request. */
@@ -6368,5 +6379,5 @@
                                 ahciTrimRangesDestroy(pTaskErr);
                             else if (pTaskErr->enmTxDir != AHCITXDIR_FLUSH)
-                                ahciIoBufFree(pAhciPort->pDevInsR3, pTaskErr, false /* fCopyToGuest */);
+                                ahciIoBufFree(pAhciPort, pTaskErr, false /* fCopyToGuest */);
 
                             /* Finally free the error task state structure because it is completely unused now. */
@@ -6699,5 +6710,5 @@
                         STAM_REL_COUNTER_INC(&pAhciPort->StatDMA);
 
-                        rc = ahciIoBufAllocate(pAhciPort->pDevInsR3, pAhciReq, pAhciReq->cbTransfer);
+                        rc = ahciIoBufAllocate(pAhciPort, pAhciReq, pAhciReq->cbTransfer);
                         if (RT_FAILURE(rc))
                             AssertMsgFailed(("%s: Failed to process command %Rrc\n", __FUNCTION__, rc));
@@ -8049,4 +8060,5 @@
                 if (pAhciPort->aCachedTasks[i])
                 {
+                    ahciReqMemFree(pAhciPort, pAhciPort->aCachedTasks[i], true /* fForceFree */);
                     RTMemFree(pAhciPort->aCachedTasks[i]);
                     pAhciPort->aCachedTasks[i] = NULL;