Use glib memory allocation and free functions

qemu_malloc/qemu_free no longer exist after this commit.

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
diff --git a/hw/9pfs/cofs.c b/hw/9pfs/cofs.c
index 473ce53..1f10632 100644
--- a/hw/9pfs/cofs.c
+++ b/hw/9pfs/cofs.c
@@ -22,7 +22,7 @@
     int err;
     ssize_t len;
 
-    buf->data = qemu_malloc(PATH_MAX);
+    buf->data = g_malloc(PATH_MAX);
     v9fs_co_run_in_worker(
         {
             len = s->ops->readlink(&s->ctx, path->data,
@@ -36,7 +36,7 @@
             }
         });
     if (err) {
-        qemu_free(buf->data);
+        g_free(buf->data);
         buf->data = NULL;
         buf->size = 0;
     }
diff --git a/hw/9pfs/virtio-9p-device.c b/hw/9pfs/virtio-9p-device.c
index f4bf471..9466002 100644
--- a/hw/9pfs/virtio-9p-device.c
+++ b/hw/9pfs/virtio-9p-device.c
@@ -36,12 +36,12 @@
     struct virtio_9p_config *cfg;
     V9fsState *s = to_virtio_9p(vdev);
 
-    cfg = qemu_mallocz(sizeof(struct virtio_9p_config) +
+    cfg = g_malloc0(sizeof(struct virtio_9p_config) +
                         s->tag_len);
     stw_raw(&cfg->tag_len, s->tag_len);
     memcpy(cfg->tag, s->tag, s->tag_len);
     memcpy(config, cfg, s->config_size);
-    qemu_free(cfg);
+    g_free(cfg);
 }
 
 VirtIODevice *virtio_9p_init(DeviceState *dev, V9fsConf *conf)
@@ -114,13 +114,13 @@
         exit(1);
     }
 
-    s->ctx.fs_root = qemu_strdup(fse->path);
+    s->ctx.fs_root = g_strdup(fse->path);
     len = strlen(conf->tag);
     if (len > MAX_TAG_LEN) {
         len = MAX_TAG_LEN;
     }
     /* s->tag is non-NULL terminated string */
-    s->tag = qemu_malloc(len);
+    s->tag = g_malloc(len);
     memcpy(s->tag, conf->tag, len);
     s->tag_len = len;
     s->ctx.uid = -1;
diff --git a/hw/9pfs/virtio-9p-xattr.c b/hw/9pfs/virtio-9p-xattr.c
index bde0b7f..7f08f6e 100644
--- a/hw/9pfs/virtio-9p-xattr.c
+++ b/hw/9pfs/virtio-9p-xattr.c
@@ -79,7 +79,7 @@
     }
 
     /* Now fetch the xattr and find the actual size */
-    orig_value = qemu_malloc(xattr_len);
+    orig_value = g_malloc(xattr_len);
     xattr_len = llistxattr(rpath(ctx, path, buffer), orig_value, xattr_len);
 
     /* store the orig pointer */
@@ -111,7 +111,7 @@
     }
 
 err_out:
-    qemu_free(orig_value_start);
+    g_free(orig_value_start);
     return size;
 }
 
diff --git a/hw/9pfs/virtio-9p.c b/hw/9pfs/virtio-9p.c
index f2193d6..eb33636 100644
--- a/hw/9pfs/virtio-9p.c
+++ b/hw/9pfs/virtio-9p.c
@@ -239,7 +239,7 @@
 
 static void v9fs_string_free(V9fsString *str)
 {
-    qemu_free(str->data);
+    g_free(str->data);
     str->data = NULL;
     str->size = 0;
 }
@@ -338,7 +338,7 @@
     }
 
 alloc_print:
-    *strp = qemu_malloc((len + 1) * sizeof(**strp));
+    *strp = g_malloc((len + 1) * sizeof(**strp));
 
     return vsprintf(*strp, fmt, ap);
 }
@@ -408,7 +408,7 @@
         return NULL;
     }
 
-    f = qemu_mallocz(sizeof(V9fsFidState));
+    f = g_malloc0(sizeof(V9fsFidState));
 
     f->fid = fid;
     f->fid_type = P9_FID_NONE;
@@ -448,7 +448,7 @@
     v9fs_string_free(&fidp->fs.xattr.name);
 free_value:
     if (fidp->fs.xattr.value) {
-        qemu_free(fidp->fs.xattr.value);
+        g_free(fidp->fs.xattr.value);
     }
     return retval;
 }
@@ -479,7 +479,7 @@
         retval = v9fs_xattr_fid_clunk(s, fidp);
     }
     v9fs_string_free(&fidp->path);
-    qemu_free(fidp);
+    g_free(fidp);
 
     return retval;
 }
@@ -685,7 +685,7 @@
             V9fsString *str = va_arg(ap, V9fsString *);
             offset += pdu_unmarshal(pdu, offset, "w", &str->size);
             /* FIXME: sanity check str->size */
-            str->data = qemu_malloc(str->size + 1);
+            str->data = g_malloc(str->size + 1);
             offset += pdu_unpack(str->data, pdu, offset, str->size);
             str->data[str->size] = 0;
             break;
@@ -1209,7 +1209,7 @@
 out:
     complete_pdu(s, vs->pdu, err);
     v9fs_stat_free(&vs->v9stat);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_stat(void *opaque)
@@ -1220,7 +1220,7 @@
     V9fsStatState *vs;
     ssize_t err = 0;
 
-    vs = qemu_malloc(sizeof(*vs));
+    vs = g_malloc(sizeof(*vs));
     vs->pdu = pdu;
     vs->offset = 7;
 
@@ -1241,7 +1241,7 @@
 out:
     complete_pdu(s, vs->pdu, err);
     v9fs_stat_free(&vs->v9stat);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_getattr(void *opaque)
@@ -1379,8 +1379,8 @@
             v9fs_string_free(&vs->wnames[vs->name_idx]);
         }
 
-        qemu_free(vs->wnames);
-        qemu_free(vs->qids);
+        g_free(vs->wnames);
+        g_free(vs->qids);
     }
 }
 
@@ -1463,7 +1463,7 @@
     int err = 0;
     int i;
 
-    vs = qemu_malloc(sizeof(*vs));
+    vs = g_malloc(sizeof(*vs));
     vs->pdu = pdu;
     vs->wnames = NULL;
     vs->qids = NULL;
@@ -1473,9 +1473,9 @@
                                             &newfid, &vs->nwnames);
 
     if (vs->nwnames && vs->nwnames <= P9_MAXWELEM) {
-        vs->wnames = qemu_mallocz(sizeof(vs->wnames[0]) * vs->nwnames);
+        vs->wnames = g_malloc0(sizeof(vs->wnames[0]) * vs->nwnames);
 
-        vs->qids = qemu_mallocz(sizeof(vs->qids[0]) * vs->nwnames);
+        vs->qids = g_malloc0(sizeof(vs->qids[0]) * vs->nwnames);
 
         for (i = 0; i < vs->nwnames; i++) {
             vs->offset += pdu_unmarshal(vs->pdu, vs->offset, "s",
@@ -1568,7 +1568,7 @@
     err = vs->offset;
 out:
     complete_pdu(s, vs->pdu, err);
-    qemu_free(vs);
+    g_free(vs);
 
 }
 
@@ -1578,7 +1578,7 @@
     vs->offset += pdu_marshal(vs->pdu, vs->offset, "Qd", &vs->qid, vs->iounit);
     err = vs->offset;
     complete_pdu(s, vs->pdu, err);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_open_post_open(V9fsState *s, V9fsOpenState *vs, int err)
@@ -1593,7 +1593,7 @@
     return;
 out:
     complete_pdu(s, vs->pdu, err);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_open_post_lstat(V9fsState *s, V9fsOpenState *vs, int err)
@@ -1625,7 +1625,7 @@
     return;
 out:
     complete_pdu(s, vs->pdu, err);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_open(void *opaque)
@@ -1636,7 +1636,7 @@
     V9fsOpenState *vs;
     ssize_t err = 0;
 
-    vs = qemu_malloc(sizeof(*vs));
+    vs = g_malloc(sizeof(*vs));
     vs->pdu = pdu;
     vs->offset = 7;
     vs->mode = 0;
@@ -1661,7 +1661,7 @@
     return;
 out:
     complete_pdu(s, pdu, err);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_post_lcreate(V9fsState *s, V9fsLcreateState *vs, int err)
@@ -1683,7 +1683,7 @@
     complete_pdu(s, vs->pdu, err);
     v9fs_string_free(&vs->name);
     v9fs_string_free(&vs->fullname);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_lcreate_post_get_iounit(V9fsState *s, V9fsLcreateState *vs,
@@ -1724,7 +1724,7 @@
     V9fsLcreateState *vs;
     ssize_t err = 0;
 
-    vs = qemu_malloc(sizeof(*vs));
+    vs = g_malloc(sizeof(*vs));
     vs->pdu = pdu;
     vs->offset = 7;
 
@@ -1753,7 +1753,7 @@
 out:
     complete_pdu(s, vs->pdu, err);
     v9fs_string_free(&vs->name);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_post_do_fsync(V9fsState *s, V9fsPDU *pdu, int err)
@@ -1820,7 +1820,7 @@
     complete_pdu(s, vs->pdu, err);
     v9fs_stat_free(&vs->v9stat);
     v9fs_string_free(&vs->name);
-    qemu_free(vs);
+    g_free(vs);
     return;
 }
 
@@ -1874,7 +1874,7 @@
     vs->offset += vs->count;
     err = vs->offset;
     complete_pdu(s, vs->pdu, err);
-    qemu_free(vs);
+    g_free(vs);
     return;
 }
 
@@ -1925,7 +1925,7 @@
 
 out:
     complete_pdu(s, vs->pdu, err);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_xattr_read(V9fsState *s, V9fsReadState *vs)
@@ -1950,7 +1950,7 @@
                            read_count);
     err = vs->offset;
     complete_pdu(s, vs->pdu, err);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_read(void *opaque)
@@ -1961,7 +1961,7 @@
     V9fsReadState *vs;
     ssize_t err = 0;
 
-    vs = qemu_malloc(sizeof(*vs));
+    vs = g_malloc(sizeof(*vs));
     vs->pdu = pdu;
     vs->offset = 7;
     vs->total = 0;
@@ -2006,7 +2006,7 @@
     }
 out:
     complete_pdu(s, pdu, err);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static size_t v9fs_readdir_data_size(V9fsString *name)
@@ -2138,7 +2138,7 @@
     err = vs->offset;
 out:
     complete_pdu(s, vs->pdu, err);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_xattr_write(V9fsState *s, V9fsWriteState *vs)
@@ -2180,7 +2180,7 @@
     }
 out:
     complete_pdu(s, vs->pdu, err);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_write(void *opaque)
@@ -2191,7 +2191,7 @@
     V9fsWriteState *vs;
     ssize_t err;
 
-    vs = qemu_malloc(sizeof(*vs));
+    vs = g_malloc(sizeof(*vs));
 
     vs->pdu = pdu;
     vs->offset = 7;
@@ -2235,7 +2235,7 @@
     return;
 out:
     complete_pdu(s, vs->pdu, err);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_create_post_getiounit(V9fsState *s, V9fsCreateState *vs)
@@ -2251,7 +2251,7 @@
     v9fs_string_free(&vs->name);
     v9fs_string_free(&vs->extension);
     v9fs_string_free(&vs->fullname);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_post_create(V9fsState *s, V9fsCreateState *vs, int err)
@@ -2266,7 +2266,7 @@
     v9fs_string_free(&vs->name);
     v9fs_string_free(&vs->extension);
     v9fs_string_free(&vs->fullname);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_create_post_perms(V9fsState *s, V9fsCreateState *vs, int err)
@@ -2426,7 +2426,7 @@
     V9fsCreateState *vs;
     int err = 0;
 
-    vs = qemu_malloc(sizeof(*vs));
+    vs = g_malloc(sizeof(*vs));
     vs->pdu = pdu;
     vs->offset = 7;
 
@@ -2452,7 +2452,7 @@
     complete_pdu(s, vs->pdu, err);
     v9fs_string_free(&vs->name);
     v9fs_string_free(&vs->extension);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_post_symlink(V9fsState *s, V9fsSymlinkState *vs, int err)
@@ -2468,7 +2468,7 @@
     v9fs_string_free(&vs->name);
     v9fs_string_free(&vs->symname);
     v9fs_string_free(&vs->fullname);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_symlink_post_do_symlink(V9fsState *s, V9fsSymlinkState *vs,
@@ -2491,7 +2491,7 @@
     int err = 0;
     gid_t gid;
 
-    vs = qemu_malloc(sizeof(*vs));
+    vs = g_malloc(sizeof(*vs));
     vs->pdu = pdu;
     vs->offset = 7;
 
@@ -2517,7 +2517,7 @@
     complete_pdu(s, vs->pdu, err);
     v9fs_string_free(&vs->name);
     v9fs_string_free(&vs->symname);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_flush(void *opaque)
@@ -2605,7 +2605,7 @@
 out:
     v9fs_stat_free(&vs->v9stat);
     complete_pdu(s, vs->pdu, err);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_wstat_post_rename(V9fsState *s, V9fsWstatState *vs, int err)
@@ -2624,7 +2624,7 @@
 out:
     v9fs_stat_free(&vs->v9stat);
     complete_pdu(s, vs->pdu, err);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static int v9fs_complete_rename(V9fsState *s, V9fsFidState *fidp,
@@ -2643,7 +2643,7 @@
         }
         BUG_ON(dirfidp->fid_type != P9_FID_NONE);
 
-        new_name = qemu_mallocz(dirfidp->path.size + name->size + 2);
+        new_name = g_malloc0(dirfidp->path.size + name->size + 2);
 
         strcpy(new_name, dirfidp->path.data);
         strcat(new_name, "/");
@@ -2656,7 +2656,7 @@
         } else {
             end = old_name;
         }
-        new_name = qemu_mallocz(end - old_name + name->size + 1);
+        new_name = g_malloc0(end - old_name + name->size + 1);
 
         strncat(new_name, old_name, end - old_name);
         strncat(new_name + (end - old_name), name->data, name->size);
@@ -2710,7 +2710,7 @@
 out:
     v9fs_stat_free(&vs->v9stat);
     complete_pdu(s, vs->pdu, err);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_rename(void *opaque)
@@ -2760,7 +2760,7 @@
 out:
     v9fs_stat_free(&vs->v9stat);
     complete_pdu(s, vs->pdu, err);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_wstat_post_chmod(V9fsState *s, V9fsWstatState *vs, int err)
@@ -2795,7 +2795,7 @@
 out:
     v9fs_stat_free(&vs->v9stat);
     complete_pdu(s, vs->pdu, err);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_wstat_post_fsync(V9fsState *s, V9fsWstatState *vs, int err)
@@ -2805,7 +2805,7 @@
     }
     v9fs_stat_free(&vs->v9stat);
     complete_pdu(s, vs->pdu, err);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_wstat_post_lstat(V9fsState *s, V9fsWstatState *vs, int err)
@@ -2836,7 +2836,7 @@
 out:
     v9fs_stat_free(&vs->v9stat);
     complete_pdu(s, vs->pdu, err);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_wstat(void *opaque)
@@ -2847,7 +2847,7 @@
     V9fsWstatState *vs;
     int err = 0;
 
-    vs = qemu_malloc(sizeof(*vs));
+    vs = g_malloc(sizeof(*vs));
     vs->pdu = pdu;
     vs->offset = 7;
 
@@ -2878,7 +2878,7 @@
 out:
     v9fs_stat_free(&vs->v9stat);
     complete_pdu(s, vs->pdu, err);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static int v9fs_fill_statfs(V9fsState *s, V9fsPDU *pdu, struct statfs *stbuf)
@@ -3014,11 +3014,11 @@
     int32_t fid, err = 0;
     V9fsLockState *vs;
 
-    vs = qemu_mallocz(sizeof(*vs));
+    vs = g_malloc0(sizeof(*vs));
     vs->pdu = pdu;
     vs->offset = 7;
 
-    vs->flock = qemu_malloc(sizeof(*vs->flock));
+    vs->flock = g_malloc(sizeof(*vs->flock));
     pdu_unmarshal(vs->pdu, vs->offset, "dbdqqds", &fid, &vs->flock->type,
                 &vs->flock->flags, &vs->flock->start, &vs->flock->length,
                             &vs->flock->proc_id, &vs->flock->client_id);
@@ -3045,8 +3045,8 @@
 out:
     vs->offset += pdu_marshal(vs->pdu, vs->offset, "b", vs->status);
     complete_pdu(s, vs->pdu, err);
-    qemu_free(vs->flock);
-    qemu_free(vs);
+    g_free(vs->flock);
+    g_free(vs);
 }
 
 /*
@@ -3061,11 +3061,11 @@
     int32_t fid, err = 0;
     V9fsGetlockState *vs;
 
-    vs = qemu_mallocz(sizeof(*vs));
+    vs = g_malloc0(sizeof(*vs));
     vs->pdu = pdu;
     vs->offset = 7;
 
-    vs->glock = qemu_malloc(sizeof(*vs->glock));
+    vs->glock = g_malloc(sizeof(*vs->glock));
     pdu_unmarshal(vs->pdu, vs->offset, "dbqqds", &fid, &vs->glock->type,
                 &vs->glock->start, &vs->glock->length, &vs->glock->proc_id,
 		&vs->glock->client_id);
@@ -3087,8 +3087,8 @@
 		&vs->glock->client_id);
 out:
     complete_pdu(s, vs->pdu, err);
-    qemu_free(vs->glock);
-    qemu_free(vs);
+    g_free(vs->glock);
+    g_free(vs);
 }
 
 static void v9fs_mkdir(void *opaque)
@@ -3171,7 +3171,7 @@
         xattr_fidp->fid_type = P9_FID_XATTR;
         xattr_fidp->fs.xattr.copied_len = -1;
         if (size) {
-            xattr_fidp->fs.xattr.value = qemu_malloc(size);
+            xattr_fidp->fs.xattr.value = g_malloc(size);
             err = v9fs_co_llistxattr(s, &xattr_fidp->path,
                                      xattr_fidp->fs.xattr.value,
                                      xattr_fidp->fs.xattr.len);
@@ -3201,7 +3201,7 @@
         xattr_fidp->fid_type = P9_FID_XATTR;
         xattr_fidp->fs.xattr.copied_len = -1;
         if (size) {
-            xattr_fidp->fs.xattr.value = qemu_malloc(size);
+            xattr_fidp->fs.xattr.value = g_malloc(size);
             err = v9fs_co_lgetxattr(s, &xattr_fidp->path,
                                     &name, xattr_fidp->fs.xattr.value,
                                     xattr_fidp->fs.xattr.len);
@@ -3248,7 +3248,7 @@
     v9fs_string_init(&xattr_fidp->fs.xattr.name);
     v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name);
     if (size) {
-        xattr_fidp->fs.xattr.value = qemu_malloc(size);
+        xattr_fidp->fs.xattr.value = g_malloc(size);
     } else {
         xattr_fidp->fs.xattr.value = NULL;
     }
diff --git a/hw/acpi.c b/hw/acpi.c
index 79ec66c..d04b965 100644
--- a/hw/acpi.c
+++ b/hw/acpi.c
@@ -100,13 +100,13 @@
 
     if (!acpi_tables) {
         allen = sizeof(uint16_t);
-        acpi_tables = qemu_mallocz(allen);
+        acpi_tables = g_malloc0(allen);
     } else {
         allen = acpi_tables_len;
     }
 
     start = allen;
-    acpi_tables = qemu_realloc(acpi_tables, start + ACPI_TABLE_HDR_SIZE);
+    acpi_tables = g_realloc(acpi_tables, start + ACPI_TABLE_HDR_SIZE);
     allen += has_header ? ACPI_TABLE_PFX_SIZE : ACPI_TABLE_HDR_SIZE;
 
     /* now read in the data files, reallocating buffer as needed */
@@ -125,7 +125,7 @@
             if (r == 0) {
                 break;
             } else if (r > 0) {
-                acpi_tables = qemu_realloc(acpi_tables, allen + r);
+                acpi_tables = g_realloc(acpi_tables, allen + r);
                 memcpy(acpi_tables + allen, data, r);
                 allen += r;
             } else if (errno != EINTR) {
@@ -379,8 +379,8 @@
 void acpi_gpe_init(ACPIGPE *gpe, uint8_t len)
 {
     gpe->len = len;
-    gpe->sts = qemu_mallocz(len / 2);
-    gpe->en = qemu_mallocz(len / 2);
+    gpe->sts = g_malloc0(len / 2);
+    gpe->en = g_malloc0(len / 2);
 }
 
 void acpi_gpe_blk(ACPIGPE *gpe, uint32_t blk)
diff --git a/hw/adb.c b/hw/adb.c
index 7499cdc..8dedbf8 100644
--- a/hw/adb.c
+++ b/hw/adb.c
@@ -290,7 +290,7 @@
 {
     ADBDevice *d;
     KBDState *s;
-    s = qemu_mallocz(sizeof(KBDState));
+    s = g_malloc0(sizeof(KBDState));
     d = adb_register_device(bus, ADB_KEYBOARD, adb_kbd_request,
                             adb_kbd_reset, s);
     qemu_add_kbd_event_handler(adb_kbd_put_keycode, d);
@@ -447,7 +447,7 @@
     ADBDevice *d;
     MouseState *s;
 
-    s = qemu_mallocz(sizeof(MouseState));
+    s = g_malloc0(sizeof(MouseState));
     d = adb_register_device(bus, ADB_MOUSE, adb_mouse_request,
                             adb_mouse_reset, s);
     qemu_add_mouse_event_handler(adb_mouse_event, d, 0, "QEMU ADB Mouse");
diff --git a/hw/adlib.c b/hw/adlib.c
index 4d76d57..c1c46e3 100644
--- a/hw/adlib.c
+++ b/hw/adlib.c
@@ -268,7 +268,7 @@
 #endif
 
     if (s->mixbuf) {
-        qemu_free (s->mixbuf);
+        g_free (s->mixbuf);
     }
 
     s->active = 0;
@@ -323,7 +323,7 @@
     }
 
     s->samples = AUD_get_buffer_size_out (s->voice) >> SHIFT;
-    s->mixbuf = qemu_mallocz (s->samples << SHIFT);
+    s->mixbuf = g_malloc0 (s->samples << SHIFT);
 
     register_ioport_read (0x388, 4, 1, adlib_read, s);
     register_ioport_write (0x388, 4, 1, adlib_write, s);
diff --git a/hw/applesmc.c b/hw/applesmc.c
index 23ed328..c47b592 100644
--- a/hw/applesmc.c
+++ b/hw/applesmc.c
@@ -170,7 +170,7 @@
 {
     struct AppleSMCData *def;
 
-    def = qemu_mallocz(sizeof(struct AppleSMCData));
+    def = g_malloc0(sizeof(struct AppleSMCData));
     def->key = key;
     def->len = len;
     def->data = data;
diff --git a/hw/arm_timer.c b/hw/arm_timer.c
index fd9448f..f2832f9 100644
--- a/hw/arm_timer.c
+++ b/hw/arm_timer.c
@@ -159,7 +159,7 @@
     arm_timer_state *s;
     QEMUBH *bh;
 
-    s = (arm_timer_state *)qemu_mallocz(sizeof(arm_timer_state));
+    s = (arm_timer_state *)g_malloc0(sizeof(arm_timer_state));
     s->freq = freq;
     s->control = TIMER_CTRL_IE;
 
diff --git a/hw/axis_dev88.c b/hw/axis_dev88.c
index d9002a5..06200e2 100644
--- a/hw/axis_dev88.c
+++ b/hw/axis_dev88.c
@@ -315,7 +315,7 @@
     }
 
     /* Add the two ethernet blocks.  */
-    dma_eth = qemu_mallocz(sizeof dma_eth[0] * 4); /* Allocate 4 channels.  */
+    dma_eth = g_malloc0(sizeof dma_eth[0] * 4); /* Allocate 4 channels.  */
     etraxfs_eth_init(&nd_table[0], 0x30034000, 1, &dma_eth[0], &dma_eth[1]);
     if (nb_nics > 1) {
         etraxfs_eth_init(&nd_table[1], 0x30036000, 2, &dma_eth[2], &dma_eth[3]);
diff --git a/hw/baum.c b/hw/baum.c
index 33a22a7..26beeaf 100644
--- a/hw/baum.c
+++ b/hw/baum.c
@@ -559,7 +559,7 @@
     if (ret == -1 && (brlapi_errno != BRLAPI_ERROR_LIBCERR || errno != EINTR)) {
         brlapi_perror("baum: brlapi_readKey");
         brlapi__closeConnection(baum->brlapi);
-        qemu_free(baum->brlapi);
+        g_free(baum->brlapi);
         baum->brlapi = NULL;
     }
 }
@@ -571,9 +571,9 @@
     qemu_free_timer(baum->cellCount_timer);
     if (baum->brlapi) {
         brlapi__closeConnection(baum->brlapi);
-        qemu_free(baum->brlapi);
+        g_free(baum->brlapi);
     }
-    qemu_free(baum);
+    g_free(baum);
 }
 
 int chr_baum_init(QemuOpts *opts, CharDriverState **_chr)
@@ -586,8 +586,8 @@
 #endif
     int tty;
 
-    baum = qemu_mallocz(sizeof(BaumDriverState));
-    baum->chr = chr = qemu_mallocz(sizeof(CharDriverState));
+    baum = g_malloc0(sizeof(BaumDriverState));
+    baum->chr = chr = g_malloc0(sizeof(CharDriverState));
 
     chr->opaque = baum;
     chr->chr_write = baum_write;
@@ -595,7 +595,7 @@
     chr->chr_accept_input = baum_accept_input;
     chr->chr_close = baum_close;
 
-    handle = qemu_mallocz(brlapi_getHandleSize());
+    handle = g_malloc0(brlapi_getHandleSize());
     baum->brlapi = handle;
 
     baum->brlapi_fd = brlapi__openConnection(handle, NULL, NULL);
@@ -636,8 +636,8 @@
     qemu_free_timer(baum->cellCount_timer);
     brlapi__closeConnection(handle);
 fail_handle:
-    qemu_free(handle);
-    qemu_free(chr);
-    qemu_free(baum);
+    g_free(handle);
+    g_free(chr);
+    g_free(baum);
     return -EIO;
 }
diff --git a/hw/bitbang_i2c.c b/hw/bitbang_i2c.c
index 53e9c5c..431359d 100644
--- a/hw/bitbang_i2c.c
+++ b/hw/bitbang_i2c.c
@@ -171,7 +171,7 @@
 {
     bitbang_i2c_interface *s;
 
-    s = qemu_mallocz(sizeof(bitbang_i2c_interface));
+    s = g_malloc0(sizeof(bitbang_i2c_interface));
 
     s->bus = bus;
     s->last_data = 1;
diff --git a/hw/blizzard.c b/hw/blizzard.c
index c524550..b2c1b22 100644
--- a/hw/blizzard.c
+++ b/hw/blizzard.c
@@ -188,7 +188,7 @@
     s->data.len = s->bpp * s->data.dx * s->data.dy;
     s->data.pitch = s->data.dx;
     if (s->data.len > s->data.buflen) {
-        s->data.buf = qemu_realloc(s->data.buf, s->data.len);
+        s->data.buf = g_realloc(s->data.buf, s->data.len);
         s->data.buflen = s->data.len;
     }
     s->data.ptr = s->data.buf;
@@ -953,9 +953,9 @@
 
 void *s1d13745_init(qemu_irq gpio_int)
 {
-    BlizzardState *s = (BlizzardState *) qemu_mallocz(sizeof(*s));
+    BlizzardState *s = (BlizzardState *) g_malloc0(sizeof(*s));
 
-    s->fb = qemu_malloc(0x180000);
+    s->fb = g_malloc(0x180000);
 
     s->state = graphic_console_init(blizzard_update_display,
                                  blizzard_invalidate_display,
@@ -964,7 +964,7 @@
     switch (ds_get_bits_per_pixel(s->state)) {
     case 0:
         s->line_fn_tab[0] = s->line_fn_tab[1] =
-                qemu_mallocz(sizeof(blizzard_fn_t) * 0x10);
+                g_malloc0(sizeof(blizzard_fn_t) * 0x10);
         break;
     case 8:
         s->line_fn_tab[0] = blizzard_draw_fn_8;
diff --git a/hw/bt-hci-csr.c b/hw/bt-hci-csr.c
index d135ef4..0dcf897 100644
--- a/hw/bt-hci-csr.c
+++ b/hw/bt-hci-csr.c
@@ -434,7 +434,7 @@
 CharDriverState *uart_hci_init(qemu_irq wakeup)
 {
     struct csrhci_s *s = (struct csrhci_s *)
-            qemu_mallocz(sizeof(struct csrhci_s));
+            g_malloc0(sizeof(struct csrhci_s));
 
     s->chr.opaque = s;
     s->chr.chr_write = csrhci_write;
diff --git a/hw/bt-hci.c b/hw/bt-hci.c
index 41df24c..a3a7fb4 100644
--- a/hw/bt-hci.c
+++ b/hw/bt-hci.c
@@ -721,7 +721,7 @@
 static void bt_hci_connection_accept(struct bt_hci_s *hci,
                 struct bt_device_s *host)
 {
-    struct bt_hci_link_s *link = qemu_mallocz(sizeof(struct bt_hci_link_s));
+    struct bt_hci_link_s *link = g_malloc0(sizeof(struct bt_hci_link_s));
     evt_conn_complete params;
     uint16_t handle;
     uint8_t status = HCI_SUCCESS;
@@ -736,7 +736,7 @@
             tries);
 
     if (!tries) {
-        qemu_free(link);
+        g_free(link);
         bt_hci_connection_reject(hci, host, HCI_REJECTED_LIMITED_RESOURCES);
         status = HCI_NO_CONNECTION;
         goto complete;
@@ -893,7 +893,7 @@
 
     /* We are the slave, we get to clean this burden */
     link = (struct bt_hci_link_s *) btlink;
-    qemu_free(link);
+    g_free(link);
 
 complete:
     bt_hci_lmp_link_teardown(hci, handle);
@@ -928,7 +928,7 @@
     uint16_t handle = link->handle;
     evt_disconn_complete params;
 
-    qemu_free(link);
+    g_free(link);
 
     bt_hci_lmp_link_teardown(hci, handle);
 
@@ -1138,7 +1138,7 @@
     hci->device.inquiry_scan = 0;
     hci->device.page_scan = 0;
     if (hci->device.lmp_name)
-        qemu_free((void *) hci->device.lmp_name);
+        g_free((void *) hci->device.lmp_name);
     hci->device.lmp_name = NULL;
     hci->device.class[0] = 0x00;
     hci->device.class[1] = 0x00;
@@ -1816,8 +1816,8 @@
         LENGTH_CHECK(change_local_name);
 
         if (hci->device.lmp_name)
-            qemu_free((void *) hci->device.lmp_name);
-        hci->device.lmp_name = qemu_strndup(PARAM(change_local_name, name),
+            g_free((void *) hci->device.lmp_name);
+        hci->device.lmp_name = g_strndup(PARAM(change_local_name, name),
                         sizeof(PARAM(change_local_name, name)));
         bt_hci_event_complete_status(hci, HCI_SUCCESS);
         break;
@@ -2143,7 +2143,7 @@
 
 struct HCIInfo *bt_new_hci(struct bt_scatternet_s *net)
 {
-    struct bt_hci_s *s = qemu_mallocz(sizeof(struct bt_hci_s));
+    struct bt_hci_s *s = g_malloc0(sizeof(struct bt_hci_s));
 
     s->lm.inquiry_done = qemu_new_timer_ns(vm_clock, bt_hci_inquiry_done, s);
     s->lm.inquiry_next = qemu_new_timer_ns(vm_clock, bt_hci_inquiry_next, s);
@@ -2188,7 +2188,7 @@
     bt_device_done(&hci->device);
 
     if (hci->device.lmp_name)
-        qemu_free((void *) hci->device.lmp_name);
+        g_free((void *) hci->device.lmp_name);
 
     /* Be gentle and send DISCONNECT to all connected peers and those
      * currently waiting for us to accept or reject a connection request.
@@ -2217,5 +2217,5 @@
     qemu_free_timer(hci->lm.inquiry_next);
     qemu_free_timer(hci->conn_accept_timer);
 
-    qemu_free(hci);
+    g_free(hci);
 }
diff --git a/hw/bt-hid.c b/hw/bt-hid.c
index 5f1afe3..8d7a3da 100644
--- a/hw/bt-hid.c
+++ b/hw/bt-hid.c
@@ -504,7 +504,7 @@
 
     hid_free(&hid->hid);
 
-    qemu_free(hid);
+    g_free(hid);
 }
 
 enum peripheral_minor_class {
@@ -517,7 +517,7 @@
 static struct bt_device_s *bt_hid_init(struct bt_scatternet_s *net,
                                        enum peripheral_minor_class minor)
 {
-    struct bt_hid_device_s *s = qemu_mallocz(sizeof(*s));
+    struct bt_hid_device_s *s = g_malloc0(sizeof(*s));
     uint32_t class =
             /* Format type */
             (0 << 0) |
diff --git a/hw/bt-l2cap.c b/hw/bt-l2cap.c
index 7e2f668..2ccba60 100644
--- a/hw/bt-l2cap.c
+++ b/hw/bt-l2cap.c
@@ -410,7 +410,7 @@
 
         if (psm_info) {
             /* Device supports this use-case.  */
-            ch = qemu_mallocz(sizeof(*ch));
+            ch = g_malloc0(sizeof(*ch));
             ch->params.sdu_out = l2cap_bframe_out;
             ch->params.sdu_submit = l2cap_bframe_submit;
             ch->frame_in = l2cap_bframe_in;
@@ -428,7 +428,7 @@
                 result = L2CAP_CR_SUCCESS;
                 status = L2CAP_CS_NO_INFO;
             } else {
-                qemu_free(ch);
+                g_free(ch);
 
                 result = L2CAP_CR_NO_MEM;
                 status = L2CAP_CS_NO_INFO;
@@ -473,7 +473,7 @@
         l2cap->cid[cid] = NULL;
 
         ch->params.close(ch->params.opaque);
-        qemu_free(ch);
+        g_free(ch);
     }
 
     l2cap_disconnection_response(l2cap, cid, source_cid);
@@ -1218,13 +1218,13 @@
     for (cid = L2CAP_CID_ALLOC; cid < L2CAP_CID_MAX; cid ++)
         if (l2cap->cid[cid]) {
             l2cap->cid[cid]->params.close(l2cap->cid[cid]->params.opaque);
-            qemu_free(l2cap->cid[cid]);
+            g_free(l2cap->cid[cid]);
         }
 
     if (l2cap->role)
-        qemu_free(l2cap);
+        g_free(l2cap);
     else
-        qemu_free(l2cap->link);
+        g_free(l2cap->link);
 }
 
 /* L2CAP glue to lower layers in bluetooth stack (LMP) */
@@ -1236,7 +1236,7 @@
 
     /* Always accept - we only get called if (dev->device->page_scan).  */
 
-    l2cap = qemu_mallocz(sizeof(struct slave_l2cap_instance_s));
+    l2cap = g_malloc0(sizeof(struct slave_l2cap_instance_s));
     l2cap->link.slave = &dev->device;
     l2cap->link.host = link->host;
     l2cap_init(&l2cap->l2cap, &l2cap->link, 0);
@@ -1257,7 +1257,7 @@
         return;
     }
 
-    l2cap = qemu_mallocz(sizeof(struct l2cap_instance_s));
+    l2cap = g_malloc0(sizeof(struct l2cap_instance_s));
     l2cap_init(l2cap, link, 1);
 
     link->acl_mode = acl_active;
@@ -1353,7 +1353,7 @@
         exit(-1);
     }
 
-    new_psm = qemu_mallocz(sizeof(*new_psm));
+    new_psm = g_malloc0(sizeof(*new_psm));
     new_psm->psm = psm;
     new_psm->min_mtu = min_mtu;
     new_psm->new_channel = new_channel;
diff --git a/hw/bt-sdp.c b/hw/bt-sdp.c
index cdf2d95..3e390ab 100644
--- a/hw/bt-sdp.c
+++ b/hw/bt-sdp.c
@@ -567,12 +567,12 @@
     int i;
 
     for (i = 0; i < sdp->services; i ++) {
-        qemu_free(sdp->service_list[i].attribute_list->pair);
-        qemu_free(sdp->service_list[i].attribute_list);
-        qemu_free(sdp->service_list[i].uuid);
+        g_free(sdp->service_list[i].attribute_list->pair);
+        g_free(sdp->service_list[i].attribute_list);
+        g_free(sdp->service_list[i].uuid);
     }
-    qemu_free(sdp->service_list);
-    qemu_free(sdp);
+    g_free(sdp->service_list);
+    g_free(sdp);
 }
 
 struct sdp_def_service_s {
@@ -709,10 +709,10 @@
     }
     record->uuids = 1 << ffs(record->uuids - 1);
     record->attribute_list =
-            qemu_mallocz(record->attributes * sizeof(*record->attribute_list));
+            g_malloc0(record->attributes * sizeof(*record->attribute_list));
     record->uuid =
-            qemu_mallocz(record->uuids * sizeof(*record->uuid));
-    data = qemu_malloc(len);
+            g_malloc0(record->uuids * sizeof(*record->uuid));
+    data = g_malloc(len);
 
     record->attributes = 0;
     uuid = record->uuid;
@@ -753,7 +753,7 @@
     while (service[sdp->services])
         sdp->services ++;
     sdp->service_list =
-            qemu_mallocz(sdp->services * sizeof(*sdp->service_list));
+            g_malloc0(sdp->services * sizeof(*sdp->service_list));
 
     sdp->services = 0;
     while (*service) {
@@ -942,7 +942,7 @@
 static int bt_l2cap_sdp_new_ch(struct bt_l2cap_device_s *dev,
                 struct bt_l2cap_conn_params_s *params)
 {
-    struct bt_l2cap_sdp_state_s *sdp = qemu_mallocz(sizeof(*sdp));
+    struct bt_l2cap_sdp_state_s *sdp = g_malloc0(sizeof(*sdp));
     struct sdp_def_service_s *services[] = {
         &sdp_service_sdp_s,
         &sdp_service_hid_s,
diff --git a/hw/bt.c b/hw/bt.c
index 34bf004..dc99fc2 100644
--- a/hw/bt.c
+++ b/hw/bt.c
@@ -54,7 +54,7 @@
 /* Slaves that don't hold any additional per link state can use these */
 static void bt_dummy_lmp_connection_request(struct bt_link_s *req)
 {
-    struct bt_link_s *link = qemu_mallocz(sizeof(struct bt_link_s));
+    struct bt_link_s *link = g_malloc0(sizeof(struct bt_link_s));
 
     link->slave = req->slave;
     link->host = req->host;
@@ -65,13 +65,13 @@
 
 static void bt_dummy_lmp_disconnect_slave(struct bt_link_s *link)
 {
-    qemu_free(link);
+    g_free(link);
 }
 
 static void bt_dummy_destroy(struct bt_device_s *device)
 {
     bt_device_done(device);
-    qemu_free(device);
+    g_free(device);
 }
 
 static int bt_dev_idx = 0;
diff --git a/hw/cbus.c b/hw/cbus.c
index 8ae24e0..7216899 100644
--- a/hw/cbus.c
+++ b/hw/cbus.c
@@ -132,7 +132,7 @@
 
 CBus *cbus_init(qemu_irq dat)
 {
-    CBusPriv *s = (CBusPriv *) qemu_mallocz(sizeof(*s));
+    CBusPriv *s = (CBusPriv *) g_malloc0(sizeof(*s));
 
     s->dat_out = dat;
     s->cbus.clk = qemu_allocate_irqs(cbus_clk, s, 1)[0];
@@ -387,7 +387,7 @@
 
 void *retu_init(qemu_irq irq, int vilma)
 {
-    CBusRetu *s = (CBusRetu *) qemu_mallocz(sizeof(*s));
+    CBusRetu *s = (CBusRetu *) g_malloc0(sizeof(*s));
 
     s->irq = irq;
     s->irqen = 0xffff;
@@ -603,7 +603,7 @@
 
 void *tahvo_init(qemu_irq irq, int betty)
 {
-    CBusTahvo *s = (CBusTahvo *) qemu_mallocz(sizeof(*s));
+    CBusTahvo *s = (CBusTahvo *) g_malloc0(sizeof(*s));
 
     s->irq = irq;
     s->irqen = 0xffff;
diff --git a/hw/ccid-card-emulated.c b/hw/ccid-card-emulated.c
index 4762e85..092301b 100644
--- a/hw/ccid-card-emulated.c
+++ b/hw/ccid-card-emulated.c
@@ -135,7 +135,7 @@
     const uint8_t *apdu, uint32_t len)
 {
     EmulatedState *card = DO_UPCAST(EmulatedState, base, base);
-    EmulEvent *event = (EmulEvent *)qemu_malloc(sizeof(EmulEvent) + len);
+    EmulEvent *event = (EmulEvent *)g_malloc(sizeof(EmulEvent) + len);
 
     assert(event);
     event->p.data.type = EMUL_GUEST_APDU;
@@ -169,7 +169,7 @@
 
 static void emulated_push_type(EmulatedState *card, uint32_t type)
 {
-    EmulEvent *event = (EmulEvent *)qemu_malloc(sizeof(EmulEvent));
+    EmulEvent *event = (EmulEvent *)g_malloc(sizeof(EmulEvent));
 
     assert(event);
     event->p.gen.type = type;
@@ -178,7 +178,7 @@
 
 static void emulated_push_error(EmulatedState *card, uint64_t code)
 {
-    EmulEvent *event = (EmulEvent *)qemu_malloc(sizeof(EmulEvent));
+    EmulEvent *event = (EmulEvent *)g_malloc(sizeof(EmulEvent));
 
     assert(event);
     event->p.error.type = EMUL_ERROR;
@@ -189,7 +189,7 @@
 static void emulated_push_data_type(EmulatedState *card, uint32_t type,
     const uint8_t *data, uint32_t len)
 {
-    EmulEvent *event = (EmulEvent *)qemu_malloc(sizeof(EmulEvent) + len);
+    EmulEvent *event = (EmulEvent *)g_malloc(sizeof(EmulEvent) + len);
 
     assert(event);
     event->p.data.type = type;
@@ -249,12 +249,12 @@
             QSIMPLEQ_REMOVE_HEAD(&card->guest_apdu_list, entry);
             if (event->p.data.type != EMUL_GUEST_APDU) {
                 DPRINTF(card, 1, "unexpected message in handle_apdu_thread\n");
-                qemu_free(event);
+                g_free(event);
                 continue;
             }
             if (card->reader == NULL) {
                 DPRINTF(card, 1, "reader is NULL\n");
-                qemu_free(event);
+                g_free(event);
                 continue;
             }
             recv_len = sizeof(recv_data);
@@ -267,7 +267,7 @@
             } else {
                 emulated_push_error(card, reader_status);
             }
-            qemu_free(event);
+            g_free(event);
         }
         qemu_mutex_unlock(&card->vreader_mutex);
     }
@@ -401,7 +401,7 @@
             DPRINTF(card, 2, "unexpected event\n");
             break;
         }
-        qemu_free(event);
+        g_free(event);
     }
     QSIMPLEQ_INIT(&card->event_list);
     qemu_mutex_unlock(&card->event_list_mutex);
diff --git a/hw/cirrus_vga.c b/hw/cirrus_vga.c
index b489309..0f91112 100644
--- a/hw/cirrus_vga.c
+++ b/hw/cirrus_vga.c
@@ -174,8 +174,6 @@
 
 #define CIRRUS_PNPMMIO_SIZE         0x1000
 
-#define ABS(a) ((signed)(a) > 0 ? a : -a)
-
 #define BLTUNSAFE(s) \
     ( \
         ( /* check dst is within bounds */ \
@@ -2372,7 +2370,7 @@
         memory_region_del_subregion(&s->low_mem_container,
                                     s->cirrus_bank[bank]);
         memory_region_destroy(s->cirrus_bank[bank]);
-        qemu_free(s->cirrus_bank[bank]);
+        g_free(s->cirrus_bank[bank]);
         s->cirrus_bank[bank] = NULL;
     }
 }
@@ -2387,7 +2385,7 @@
         && !((s->vga.gr[0x0B] & 0x14) == 0x14)
         && !(s->vga.gr[0x0B] & 0x02)) {
 
-        mr = qemu_malloc(sizeof(*mr));
+        mr = g_malloc(sizeof(*mr));
         memory_region_init_alias(mr, names[bank], &s->vga.vram,
                                  s->cirrus_bank_base[bank], 0x8000);
         memory_region_add_subregion_overlap(
@@ -2903,7 +2901,7 @@
 {
     CirrusVGAState *s;
 
-    s = qemu_mallocz(sizeof(CirrusVGAState));
+    s = g_malloc0(sizeof(CirrusVGAState));
 
     vga_common_init(&s->vga, VGA_RAM_SIZE);
     cirrus_init_common(s, CIRRUS_ID_CLGD5430, 0);
diff --git a/hw/dp8393x.c b/hw/dp8393x.c
index 1bcd8ee..f66844b 100644
--- a/hw/dp8393x.c
+++ b/hw/dp8393x.c
@@ -870,7 +870,7 @@
     qemu_del_timer(s->watchdog);
     qemu_free_timer(s->watchdog);
 
-    qemu_free(s);
+    g_free(s);
 }
 
 static NetClientInfo net_dp83932_info = {
@@ -889,7 +889,7 @@
 
     qemu_check_nic_model(nd, "dp83932");
 
-    s = qemu_mallocz(sizeof(dp8393xState));
+    s = g_malloc0(sizeof(dp8393xState));
 
     s->mem_opaque = mem_opaque;
     s->memory_rw = memory_rw;
diff --git a/hw/ds1225y.c b/hw/ds1225y.c
index 662d7b5..9875c44 100644
--- a/hw/ds1225y.c
+++ b/hw/ds1225y.c
@@ -146,7 +146,7 @@
     QEMUFile *file;
     int s_io;
 
-    s->contents = qemu_mallocz(s->chip_size);
+    s->contents = g_malloc0(s->chip_size);
 
     s_io = cpu_register_io_memory(nvram_read, nvram_write, s,
                                   DEVICE_NATIVE_ENDIAN);
diff --git a/hw/eepro100.c b/hw/eepro100.c
index a636d30..4e3c52f 100644
--- a/hw/eepro100.c
+++ b/hw/eepro100.c
@@ -1901,7 +1901,7 @@
 
     qemu_register_reset(nic_reset, s);
 
-    s->vmstate = qemu_malloc(sizeof(vmstate_eepro100));
+    s->vmstate = g_malloc(sizeof(vmstate_eepro100));
     memcpy(s->vmstate, &vmstate_eepro100, sizeof(vmstate_eepro100));
     s->vmstate->name = s->nic->nc.model;
     vmstate_register(&pci_dev->qdev, -1, s->vmstate, s);
diff --git a/hw/eeprom93xx.c b/hw/eeprom93xx.c
index 7b21f98..4c7158d 100644
--- a/hw/eeprom93xx.c
+++ b/hw/eeprom93xx.c
@@ -310,7 +310,7 @@
             addrbits = 6;
     }
 
-    eeprom = (eeprom_t *)qemu_mallocz(sizeof(*eeprom) + nwords * 2);
+    eeprom = (eeprom_t *)g_malloc0(sizeof(*eeprom) + nwords * 2);
     eeprom->size = nwords;
     eeprom->addrbits = addrbits;
     /* Output DO is tristate, read results in 1. */
@@ -325,7 +325,7 @@
     /* Destroy EEPROM. */
     logout("eeprom = 0x%p\n", eeprom);
     vmstate_unregister(dev, &vmstate_eeprom, eeprom);
-    qemu_free(eeprom);
+    g_free(eeprom);
 }
 
 uint16_t *eeprom93xx_data(eeprom_t *eeprom)
diff --git a/hw/elf_ops.h b/hw/elf_ops.h
index 0bd7235..6af357f 100644
--- a/hw/elf_ops.h
+++ b/hw/elf_ops.h
@@ -150,7 +150,7 @@
         i++;
     }
     if (nsyms) {
-        syms = qemu_realloc(syms, nsyms * sizeof(*syms));
+        syms = g_realloc(syms, nsyms * sizeof(*syms));
 
         qsort(syms, nsyms, sizeof(*syms), glue(symcmp, SZ));
         for (i = 0; i < nsyms - 1; i++) {
@@ -159,7 +159,7 @@
             }
         }
     } else {
-        qemu_free(syms);
+        g_free(syms);
         syms = NULL;
     }
 
@@ -173,19 +173,19 @@
         goto fail;
 
     /* Commit */
-    s = qemu_mallocz(sizeof(*s));
+    s = g_malloc0(sizeof(*s));
     s->lookup_symbol = glue(lookup_symbol, SZ);
     glue(s->disas_symtab.elf, SZ) = syms;
     s->disas_num_syms = nsyms;
     s->disas_strtab = str;
     s->next = syminfos;
     syminfos = s;
-    qemu_free(shdr_table);
+    g_free(shdr_table);
     return 0;
  fail:
-    qemu_free(syms);
-    qemu_free(str);
-    qemu_free(shdr_table);
+    g_free(syms);
+    g_free(str);
+    g_free(shdr_table);
     return -1;
 }
 
@@ -238,7 +238,7 @@
 
     size = ehdr.e_phnum * sizeof(phdr[0]);
     lseek(fd, ehdr.e_phoff, SEEK_SET);
-    phdr = qemu_mallocz(size);
+    phdr = g_malloc0(size);
     if (!phdr)
         goto fail;
     if (read(fd, phdr, size) != size)
@@ -256,7 +256,7 @@
         if (ph->p_type == PT_LOAD) {
             mem_size = ph->p_memsz;
             /* XXX: avoid allocating */
-            data = qemu_mallocz(mem_size);
+            data = g_malloc0(mem_size);
             if (ph->p_filesz > 0) {
                 if (lseek(fd, ph->p_offset, SEEK_SET) < 0)
                     goto fail;
@@ -280,18 +280,18 @@
             if ((addr + mem_size) > high)
                 high = addr + mem_size;
 
-            qemu_free(data);
+            g_free(data);
             data = NULL;
         }
     }
-    qemu_free(phdr);
+    g_free(phdr);
     if (lowaddr)
         *lowaddr = (uint64_t)(elf_sword)low;
     if (highaddr)
         *highaddr = (uint64_t)(elf_sword)high;
     return total_size;
  fail:
-    qemu_free(data);
-    qemu_free(phdr);
+    g_free(data);
+    g_free(phdr);
     return -1;
 }
diff --git a/hw/etraxfs_dma.c b/hw/etraxfs_dma.c
index c205ec1..e8ad9e6 100644
--- a/hw/etraxfs_dma.c
+++ b/hw/etraxfs_dma.c
@@ -743,12 +743,12 @@
 {
 	struct fs_dma_ctrl *ctrl = NULL;
 
-	ctrl = qemu_mallocz(sizeof *ctrl);
+	ctrl = g_malloc0(sizeof *ctrl);
 
         ctrl->bh = qemu_bh_new(DMA_run, ctrl);
 
 	ctrl->nr_channels = nr_channels;
-	ctrl->channels = qemu_mallocz(sizeof ctrl->channels[0] * nr_channels);
+	ctrl->channels = g_malloc0(sizeof ctrl->channels[0] * nr_channels);
 
 	ctrl->map = cpu_register_io_memory(dma_read, dma_write, ctrl, DEVICE_NATIVE_ENDIAN);
 	cpu_register_physical_memory(base, nr_channels * 0x2000, ctrl->map);
diff --git a/hw/etraxfs_eth.c b/hw/etraxfs_eth.c
index 92d4eca..48de6dc 100644
--- a/hw/etraxfs_eth.c
+++ b/hw/etraxfs_eth.c
@@ -574,7 +574,7 @@
 	eth->dma_out->client.opaque = NULL;
 	eth->dma_in->client.opaque = NULL;
 	eth->dma_in->client.pull = NULL;
-        qemu_free(eth);
+        g_free(eth);
 }
 
 static NetClientInfo net_etraxfs_info = {
diff --git a/hw/fw_cfg.c b/hw/fw_cfg.c
index e4847b7..663ad80 100644
--- a/hw/fw_cfg.c
+++ b/hw/fw_cfg.c
@@ -177,14 +177,14 @@
         /* probing the file */
         fp = probe_splashfile(filename, &file_size, &file_type);
         if (fp == NULL) {
-            qemu_free(filename);
+            g_free(filename);
             return;
         }
         /* loading file data */
         if (boot_splash_filedata != NULL) {
-            qemu_free(boot_splash_filedata);
+            g_free(boot_splash_filedata);
         }
-        boot_splash_filedata = qemu_malloc(file_size);
+        boot_splash_filedata = g_malloc(file_size);
         boot_splash_filedata_size = file_size;
         fseek(fp, 0L, SEEK_SET);
         fop_ret = fread(boot_splash_filedata, 1, file_size, fp);
@@ -203,7 +203,7 @@
             fw_cfg_add_file(s, "bootsplash.bmp",
                     boot_splash_filedata, boot_splash_filedata_size);
         }
-        qemu_free(filename);
+        g_free(filename);
     }
 }
 
@@ -385,7 +385,7 @@
 {
     uint16_t *copy;
 
-    copy = qemu_malloc(sizeof(value));
+    copy = g_malloc(sizeof(value));
     *copy = cpu_to_le16(value);
     return fw_cfg_add_bytes(s, key, (uint8_t *)copy, sizeof(value));
 }
@@ -394,7 +394,7 @@
 {
     uint32_t *copy;
 
-    copy = qemu_malloc(sizeof(value));
+    copy = g_malloc(sizeof(value));
     *copy = cpu_to_le32(value);
     return fw_cfg_add_bytes(s, key, (uint8_t *)copy, sizeof(value));
 }
@@ -403,7 +403,7 @@
 {
     uint64_t *copy;
 
-    copy = qemu_malloc(sizeof(value));
+    copy = g_malloc(sizeof(value));
     *copy = cpu_to_le64(value);
     return fw_cfg_add_bytes(s, key, (uint8_t *)copy, sizeof(value));
 }
@@ -436,7 +436,7 @@
 
     if (!s->files) {
         int dsize = sizeof(uint32_t) + sizeof(FWCfgFile) * FW_CFG_FILE_SLOTS;
-        s->files = qemu_mallocz(dsize);
+        s->files = g_malloc0(dsize);
         fw_cfg_add_bytes(s, FW_CFG_FILE_DIR, (uint8_t*)s->files, dsize);
     }
 
diff --git a/hw/g364fb.c b/hw/g364fb.c
index a41e988..b3020c5 100644
--- a/hw/g364fb.c
+++ b/hw/g364fb.c
@@ -590,7 +590,7 @@
     G364State *s;
     int io_ctrl;
 
-    s = qemu_mallocz(sizeof(G364State));
+    s = g_malloc0(sizeof(G364State));
 
     s->vram_size = 8 * 1024 * 1024;
     s->vram_offset = qemu_ram_alloc(NULL, "g364fb.vram", s->vram_size);
diff --git a/hw/grlib_gptimer.c b/hw/grlib_gptimer.c
index 99e9033..85869b9 100644
--- a/hw/grlib_gptimer.c
+++ b/hw/grlib_gptimer.c
@@ -345,7 +345,7 @@
     assert(unit->nr_timers > 0);
     assert(unit->nr_timers <= GPTIMER_MAX_TIMERS);
 
-    unit->timers = qemu_mallocz(sizeof unit->timers[0] * unit->nr_timers);
+    unit->timers = g_malloc0(sizeof unit->timers[0] * unit->nr_timers);
 
     for (i = 0; i < unit->nr_timers; i++) {
         GPTimer *timer = &unit->timers[i];
diff --git a/hw/grlib_irqmp.c b/hw/grlib_irqmp.c
index b8738fc..9490a78 100644
--- a/hw/grlib_irqmp.c
+++ b/hw/grlib_irqmp.c
@@ -345,7 +345,7 @@
                                         grlib_irqmp_write,
                                         irqmp, DEVICE_NATIVE_ENDIAN);
 
-    irqmp->state = qemu_mallocz(sizeof *irqmp->state);
+    irqmp->state = g_malloc0(sizeof *irqmp->state);
 
     if (irqmp_regs < 0) {
         return -1;
diff --git a/hw/gus.c b/hw/gus.c
index ff9e7c7..37e543a 100644
--- a/hw/gus.c
+++ b/hw/gus.c
@@ -260,7 +260,7 @@
 
     s->shift = 2;
     s->samples = AUD_get_buffer_size_out (s->voice) >> s->shift;
-    s->mixbuf = qemu_mallocz (s->samples << s->shift);
+    s->mixbuf = g_malloc0 (s->samples << s->shift);
 
     register_ioport_write (s->port, 1, 1, gus_writeb, s);
     register_ioport_write (s->port, 1, 2, gus_writew, s);
diff --git a/hw/heathrow_pic.c b/hw/heathrow_pic.c
index 3ba0b0e..51996ab 100644
--- a/hw/heathrow_pic.c
+++ b/hw/heathrow_pic.c
@@ -202,7 +202,7 @@
 {
     HeathrowPICS *s;
 
-    s = qemu_mallocz(sizeof(HeathrowPICS));
+    s = g_malloc0(sizeof(HeathrowPICS));
     /* only 1 CPU */
     s->irqs = irqs[0];
     memory_region_init_io(&s->mem, &heathrow_pic_ops, s,
diff --git a/hw/i8259.c b/hw/i8259.c
index 84d330d..c0b96ab 100644
--- a/hw/i8259.c
+++ b/hw/i8259.c
@@ -526,7 +526,7 @@
 {
     PicState2 *s;
 
-    s = qemu_mallocz(sizeof(PicState2));
+    s = g_malloc0(sizeof(PicState2));
     pic_init1(0x20, 0x4d0, &s->pics[0]);
     pic_init1(0xa0, 0x4d1, &s->pics[1]);
     s->pics[0].elcr_mask = 0xf8;
diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c
index e207ca0..29521ba 100644
--- a/hw/ide/ahci.c
+++ b/hw/ide/ahci.c
@@ -1123,7 +1123,7 @@
     int i;
 
     s->ports = ports;
-    s->dev = qemu_mallocz(sizeof(AHCIDevice) * ports);
+    s->dev = g_malloc0(sizeof(AHCIDevice) * ports);
     ahci_reg_init(s);
     /* XXX BAR size should be 1k, but that breaks, so bump it to 4k for now */
     memory_region_init_io(&s->mem, &ahci_mem_ops, s, "ahci", 0x1000);
@@ -1146,7 +1146,7 @@
 void ahci_uninit(AHCIState *s)
 {
     memory_region_destroy(&s->mem);
-    qemu_free(s->dev);
+    g_free(s->dev);
 }
 
 void ahci_reset(void *opaque)
diff --git a/hw/ide/macio.c b/hw/ide/macio.c
index 7ee35e9..44fb3fe 100644
--- a/hw/ide/macio.c
+++ b/hw/ide/macio.c
@@ -325,7 +325,7 @@
 {
     MACIOIDEState *d;
 
-    d = qemu_mallocz(sizeof(MACIOIDEState));
+    d = g_malloc0(sizeof(MACIOIDEState));
     ide_init2_with_non_qdev_drives(&d->bus, hd_table[0], hd_table[1], irq);
 
     if (dbdma)
diff --git a/hw/ide/microdrive.c b/hw/ide/microdrive.c
index 9fbbf0e..91c0e3c 100644
--- a/hw/ide/microdrive.c
+++ b/hw/ide/microdrive.c
@@ -531,7 +531,7 @@
 
 PCMCIACardState *dscm1xxxx_init(DriveInfo *bdrv)
 {
-    MicroDriveState *md = (MicroDriveState *) qemu_mallocz(sizeof(MicroDriveState));
+    MicroDriveState *md = (MicroDriveState *) g_malloc0(sizeof(MicroDriveState));
     md->card.state = md;
     md->card.attach = dscm1xxxx_attach;
     md->card.detach = dscm1xxxx_detach;
@@ -542,7 +542,7 @@
                                    qemu_allocate_irqs(md_set_irq, md, 1)[0]);
     md->bus.ifs[0].drive_kind = IDE_CFATA;
     md->bus.ifs[0].mdata_size = METADATA_SIZE;
-    md->bus.ifs[0].mdata_storage = (uint8_t *) qemu_mallocz(METADATA_SIZE);
+    md->bus.ifs[0].mdata_storage = (uint8_t *) g_malloc0(METADATA_SIZE);
 
     vmstate_register(NULL, -1, &vmstate_microdrive, md);
 
diff --git a/hw/ide/mmio.c b/hw/ide/mmio.c
index 10f6f40..132b751 100644
--- a/hw/ide/mmio.c
+++ b/hw/ide/mmio.c
@@ -121,7 +121,7 @@
                     qemu_irq irq, int shift,
                     DriveInfo *hd0, DriveInfo *hd1)
 {
-    MMIOState *s = qemu_mallocz(sizeof(MMIOState));
+    MMIOState *s = g_malloc0(sizeof(MMIOState));
     int mem1, mem2;
 
     ide_init2_with_non_qdev_drives(&s->bus, hd0, hd1, irq);
diff --git a/hw/ide/qdev.c b/hw/ide/qdev.c
index 6bd8d20..4207127 100644
--- a/hw/ide/qdev.c
+++ b/hw/ide/qdev.c
@@ -148,10 +148,10 @@
     }
 
     if (!dev->version) {
-        dev->version = qemu_strdup(s->version);
+        dev->version = g_strdup(s->version);
     }
     if (!dev->serial) {
-        dev->serial = qemu_strdup(s->drive_serial_str);
+        dev->serial = g_strdup(s->drive_serial_str);
     }
 
     add_boot_device_path(dev->conf.bootindex, &dev->qdev,
diff --git a/hw/intel-hda.c b/hw/intel-hda.c
index fa56a92..4272204 100644
--- a/hw/intel-hda.c
+++ b/hw/intel-hda.c
@@ -467,8 +467,8 @@
 
     addr = intel_hda_addr(st->bdlp_lbase, st->bdlp_ubase);
     st->bentries = st->lvi +1;
-    qemu_free(st->bpl);
-    st->bpl = qemu_malloc(sizeof(bpl) * st->bentries);
+    g_free(st->bpl);
+    st->bpl = g_malloc(sizeof(bpl) * st->bentries);
     for (i = 0; i < st->bentries; i++, addr += 16) {
         cpu_physical_memory_read(addr, buf, 16);
         st->bpl[i].addr  = le64_to_cpu(*(uint64_t *)buf);
diff --git a/hw/irq.c b/hw/irq.c
index 4035a8c..60eabe8 100644
--- a/hw/irq.c
+++ b/hw/irq.c
@@ -44,8 +44,8 @@
     struct IRQState *p;
     int i;
 
-    s = (qemu_irq *)qemu_mallocz(sizeof(qemu_irq) * n);
-    p = (struct IRQState *)qemu_mallocz(sizeof(struct IRQState) * n);
+    s = (qemu_irq *)g_malloc0(sizeof(qemu_irq) * n);
+    p = (struct IRQState *)g_malloc0(sizeof(struct IRQState) * n);
     for (i = 0; i < n; i++) {
         p->handler = handler;
         p->opaque = opaque;
@@ -58,8 +58,8 @@
 
 void qemu_free_irqs(qemu_irq *s)
 {
-    qemu_free(s[0]);
-    qemu_free(s);
+    g_free(s[0]);
+    g_free(s);
 }
 
 static void qemu_notirq(void *opaque, int line, int level)
@@ -85,7 +85,7 @@
 
 qemu_irq qemu_irq_split(qemu_irq irq1, qemu_irq irq2)
 {
-    qemu_irq *s = qemu_mallocz(2 * sizeof(qemu_irq));
+    qemu_irq *s = g_malloc0(2 * sizeof(qemu_irq));
     s[0] = irq1;
     s[1] = irq2;
     return qemu_allocate_irqs(qemu_splitirq, s, 1)[0];
diff --git a/hw/isa_mmio.c b/hw/isa_mmio.c
index 3d2af1a..fd755ab 100644
--- a/hw/isa_mmio.c
+++ b/hw/isa_mmio.c
@@ -74,7 +74,7 @@
 
 void isa_mmio_init(target_phys_addr_t base, target_phys_addr_t size)
 {
-    MemoryRegion *mr = qemu_malloc(sizeof(*mr));
+    MemoryRegion *mr = g_malloc(sizeof(*mr));
 
     isa_mmio_setup(mr, size);
     memory_region_add_subregion(get_system_memory(), base, mr);
diff --git a/hw/ivshmem.c b/hw/ivshmem.c
index 42a5877..f4ae0d2 100644
--- a/hw/ivshmem.c
+++ b/hw/ivshmem.c
@@ -351,7 +351,7 @@
         close(s->peers[posn].eventfds[i]);
     }
 
-    qemu_free(s->peers[posn].eventfds);
+    g_free(s->peers[posn].eventfds);
     s->peers[posn].nb_eventfds = 0;
 }
 
@@ -383,7 +383,7 @@
         s->nb_peers = s->nb_peers * 2;
 
     IVSHMEM_DPRINTF("bumping storage to %d guests\n", s->nb_peers);
-    s->peers = qemu_realloc(s->peers, s->nb_peers * sizeof(Peer));
+    s->peers = g_realloc(s->peers, s->nb_peers * sizeof(Peer));
 
     /* zero out new pointers */
     for (j = old_nb_alloc; j < s->nb_peers; j++) {
@@ -467,7 +467,7 @@
 
     if (guest_max_eventfd == 0) {
         /* one eventfd per MSI vector */
-        s->peers[incoming_posn].eventfds = (int *) qemu_malloc(s->vectors *
+        s->peers[incoming_posn].eventfds = (int *) g_malloc(s->vectors *
                                                                 sizeof(int));
     }
 
@@ -557,7 +557,7 @@
     }
 
     /* allocate Qemu char devices for receiving interrupts */
-    s->eventfd_table = qemu_mallocz(s->vectors * sizeof(EventfdEntry));
+    s->eventfd_table = g_malloc0(s->vectors * sizeof(EventfdEntry));
 }
 
 static void ivshmem_save(QEMUFile* f, void *opaque)
@@ -691,12 +691,12 @@
         s->vm_id = -1;
 
         /* allocate/initialize space for interrupt handling */
-        s->peers = qemu_mallocz(s->nb_peers * sizeof(Peer));
+        s->peers = g_malloc0(s->nb_peers * sizeof(Peer));
 
         pci_register_bar(&s->dev, 2,
                          PCI_BASE_ADDRESS_SPACE_MEMORY, &s->ivshmem);
 
-        s->eventfd_chr = qemu_mallocz(s->vectors * sizeof(CharDriverState *));
+        s->eventfd_chr = g_malloc0(s->vectors * sizeof(CharDriverState *));
 
         qemu_chr_add_handlers(s->server_chr, ivshmem_can_receive, ivshmem_read,
                      ivshmem_event, s);
diff --git a/hw/jazz_led.c b/hw/jazz_led.c
index 1dc22cf..eb472a0 100644
--- a/hw/jazz_led.c
+++ b/hw/jazz_led.c
@@ -312,7 +312,7 @@
     LedState *s;
     int io;
 
-    s = qemu_mallocz(sizeof(LedState));
+    s = g_malloc0(sizeof(LedState));
 
     s->state = REDRAW_SEGMENTS | REDRAW_BACKGROUND;
 
diff --git a/hw/leon3.c b/hw/leon3.c
index 919f49f..a62a941 100644
--- a/hw/leon3.c
+++ b/hw/leon3.c
@@ -122,7 +122,7 @@
     cpu_sparc_set_id(env, 0);
 
     /* Reset data */
-    reset_info        = qemu_mallocz(sizeof(ResetData));
+    reset_info        = g_malloc0(sizeof(ResetData));
     reset_info->env   = env;
     qemu_register_reset(main_cpu_reset, reset_info);
 
diff --git a/hw/lm32_boards.c b/hw/lm32_boards.c
index 6462923..d18aad7 100644
--- a/hw/lm32_boards.c
+++ b/hw/lm32_boards.c
@@ -95,7 +95,7 @@
     int timer0_irq                 = 1;
     int timer1_irq                 = 3;
 
-    reset_info = qemu_mallocz(sizeof(ResetInfo));
+    reset_info = g_malloc0(sizeof(ResetInfo));
 
     if (cpu_model == NULL) {
         cpu_model = "lm32-full";
@@ -190,7 +190,7 @@
     target_phys_addr_t initrd_base  = 0x08400000;
     size_t initrd_max               = 0x01000000;
 
-    reset_info = qemu_mallocz(sizeof(ResetInfo));
+    reset_info = g_malloc0(sizeof(ResetInfo));
 
     if (cpu_model == NULL) {
         cpu_model = "lm32-full";
diff --git a/hw/lm32_hwsetup.h b/hw/lm32_hwsetup.h
index 9f47821..8fc285e 100644
--- a/hw/lm32_hwsetup.h
+++ b/hw/lm32_hwsetup.h
@@ -57,8 +57,8 @@
 {
     HWSetup *hw;
 
-    hw = qemu_malloc(sizeof(HWSetup));
-    hw->data = qemu_mallocz(TARGET_PAGE_SIZE);
+    hw = g_malloc(sizeof(HWSetup));
+    hw->data = g_malloc0(TARGET_PAGE_SIZE);
     hw->ptr = hw->data;
 
     return hw;
@@ -66,8 +66,8 @@
 
 static inline void hwsetup_free(HWSetup *hw)
 {
-    qemu_free(hw->data);
-    qemu_free(hw);
+    g_free(hw->data);
+    g_free(hw);
 }
 
 static inline void hwsetup_create_rom(HWSetup *hw,
diff --git a/hw/loader.c b/hw/loader.c
index 35d792e..8efb146 100644
--- a/hw/loader.c
+++ b/hw/loader.c
@@ -91,11 +91,11 @@
     uint8_t *buf;
     size_t did;
 
-    buf = qemu_malloc(nbytes);
+    buf = g_malloc(nbytes);
     did = read(fd, buf, nbytes);
     if (did > 0)
         rom_add_blob_fixed("read", buf, did, dst_addr);
-    qemu_free(buf);
+    g_free(buf);
     return did;
 }
 
@@ -234,9 +234,9 @@
     void *ptr;
     if (lseek(fd, offset, SEEK_SET) < 0)
         return NULL;
-    ptr = qemu_malloc(size);
+    ptr = g_malloc(size);
     if (read(fd, ptr, size) != size) {
-        qemu_free(ptr);
+        g_free(ptr);
         return NULL;
     }
     return ptr;
@@ -351,14 +351,14 @@
     size *= items;
     size = (size + ZALLOC_ALIGNMENT - 1) & ~(ZALLOC_ALIGNMENT - 1);
 
-    p = qemu_malloc(size);
+    p = g_malloc(size);
 
     return (p);
 }
 
 static void zfree(void *x, void *addr)
 {
-    qemu_free(addr);
+    g_free(addr);
 }
 
 
@@ -476,7 +476,7 @@
     }
 
     *ep = hdr->ih_ep;
-    data = qemu_malloc(hdr->ih_size);
+    data = g_malloc(hdr->ih_size);
 
     if (read(fd, data, hdr->ih_size) != hdr->ih_size) {
         fprintf(stderr, "Error reading file\n");
@@ -490,10 +490,10 @@
 
         compressed_data = data;
         max_bytes = UBOOT_MAX_GUNZIP_BYTES;
-        data = qemu_malloc(max_bytes);
+        data = g_malloc(max_bytes);
 
         bytes = gunzip(data, max_bytes, compressed_data, hdr->ih_size);
-        qemu_free(compressed_data);
+        g_free(compressed_data);
         if (bytes < 0) {
             fprintf(stderr, "Unable to decompress gzipped image!\n");
             goto out;
@@ -510,7 +510,7 @@
 
 out:
     if (data)
-        qemu_free(data);
+        g_free(data);
     close(fd);
     return ret;
 }
@@ -564,11 +564,11 @@
     int rc, fd = -1;
     char devpath[100];
 
-    rom = qemu_mallocz(sizeof(*rom));
-    rom->name = qemu_strdup(file);
+    rom = g_malloc0(sizeof(*rom));
+    rom->name = g_strdup(file);
     rom->path = qemu_find_file(QEMU_FILE_TYPE_BIOS, rom->name);
     if (rom->path == NULL) {
-        rom->path = qemu_strdup(file);
+        rom->path = g_strdup(file);
     }
 
     fd = open(rom->path, O_RDONLY | O_BINARY);
@@ -579,12 +579,12 @@
     }
 
     if (fw_dir) {
-        rom->fw_dir  = qemu_strdup(fw_dir);
-        rom->fw_file = qemu_strdup(file);
+        rom->fw_dir  = g_strdup(fw_dir);
+        rom->fw_file = g_strdup(file);
     }
     rom->addr    = addr;
     rom->romsize = lseek(fd, 0, SEEK_END);
-    rom->data    = qemu_mallocz(rom->romsize);
+    rom->data    = g_malloc0(rom->romsize);
     lseek(fd, 0, SEEK_SET);
     rc = read(fd, rom->data, rom->romsize);
     if (rc != rom->romsize) {
@@ -618,10 +618,10 @@
 err:
     if (fd != -1)
         close(fd);
-    qemu_free(rom->data);
-    qemu_free(rom->path);
-    qemu_free(rom->name);
-    qemu_free(rom);
+    g_free(rom->data);
+    g_free(rom->path);
+    g_free(rom->name);
+    g_free(rom);
     return -1;
 }
 
@@ -630,11 +630,11 @@
 {
     Rom *rom;
 
-    rom = qemu_mallocz(sizeof(*rom));
-    rom->name    = qemu_strdup(name);
+    rom = g_malloc0(sizeof(*rom));
+    rom->name    = g_strdup(name);
     rom->addr    = addr;
     rom->romsize = len;
-    rom->data    = qemu_mallocz(rom->romsize);
+    rom->data    = g_malloc0(rom->romsize);
     memcpy(rom->data, blob, len);
     rom_insert(rom);
     return 0;
@@ -664,7 +664,7 @@
         cpu_physical_memory_write_rom(rom->addr, rom->data, rom->romsize);
         if (rom->isrom) {
             /* rom needs to be written only once */
-            qemu_free(rom->data);
+            g_free(rom->data);
             rom->data = NULL;
         }
     }
diff --git a/hw/lsi53c895a.c b/hw/lsi53c895a.c
index 41c2fb0..1643a63 100644
--- a/hw/lsi53c895a.c
+++ b/hw/lsi53c895a.c
@@ -353,10 +353,10 @@
     while (!QTAILQ_EMPTY(&s->queue)) {
         p = QTAILQ_FIRST(&s->queue);
         QTAILQ_REMOVE(&s->queue, p, next);
-        qemu_free(p);
+        g_free(p);
     }
     if (s->current) {
-        qemu_free(s->current);
+        g_free(s->current);
         s->current = NULL;
     }
 }
@@ -664,7 +664,7 @@
 
     if (s->current && req == s->current->req) {
         scsi_req_unref(req);
-        qemu_free(s->current);
+        g_free(s->current);
         s->current = NULL;
         return;
     }
@@ -672,7 +672,7 @@
     if (p) {
         QTAILQ_REMOVE(&s->queue, p, next);
         scsi_req_unref(req);
-        qemu_free(p);
+        g_free(p);
     }
 }
 
@@ -723,7 +723,7 @@
 
     if (s->current && req == s->current->req) {
         scsi_req_unref(s->current->req);
-        qemu_free(s->current);
+        g_free(s->current);
         s->current = NULL;
     }
     lsi_resume_script(s);
@@ -779,7 +779,7 @@
     }
 
     assert(s->current == NULL);
-    s->current = qemu_mallocz(sizeof(lsi_request));
+    s->current = g_malloc0(sizeof(lsi_request));
     s->current->tag = s->select_tag;
     s->current->req = scsi_req_new(dev, s->current->tag, s->current_lun, buf,
                                    s->current);
diff --git a/hw/m48t59.c b/hw/m48t59.c
index 537c0f7..401b969 100644
--- a/hw/m48t59.c
+++ b/hw/m48t59.c
@@ -679,7 +679,7 @@
 
 static void m48t59_init_common(M48t59State *s)
 {
-    s->buffer = qemu_mallocz(s->size);
+    s->buffer = g_malloc0(s->size);
     if (s->type == 59) {
         s->alrm_timer = qemu_new_timer_ns(vm_clock, &alarm_cb, s);
         s->wd_timer = qemu_new_timer_ns(vm_clock, &watchdog_cb, s);
diff --git a/hw/mac_dbdma.c b/hw/mac_dbdma.c
index 350d901..5affdd1 100644
--- a/hw/mac_dbdma.c
+++ b/hw/mac_dbdma.c
@@ -846,7 +846,7 @@
 {
     DBDMAState *s;
 
-    s = qemu_mallocz(sizeof(DBDMAState));
+    s = g_malloc0(sizeof(DBDMAState));
 
     memory_region_init_io(&s->mem, &dbdma_ops, s, "dbdma", 0x1000);
     *dbdma_mem = &s->mem;
diff --git a/hw/mac_nvram.c b/hw/mac_nvram.c
index ced1e58..ed0a2b7 100644
--- a/hw/mac_nvram.c
+++ b/hw/mac_nvram.c
@@ -121,8 +121,8 @@
 {
     MacIONVRAMState *s;
 
-    s = qemu_mallocz(sizeof(MacIONVRAMState));
-    s->data = qemu_mallocz(size);
+    s = g_malloc0(sizeof(MacIONVRAMState));
+    s->data = g_malloc0(size);
     s->size = size;
     s->it_shift = it_shift;
 
diff --git a/hw/mcf5206.c b/hw/mcf5206.c
index fce282d..15d6f22 100644
--- a/hw/mcf5206.c
+++ b/hw/mcf5206.c
@@ -132,7 +132,7 @@
     m5206_timer_state *s;
     QEMUBH *bh;
 
-    s = (m5206_timer_state *)qemu_mallocz(sizeof(m5206_timer_state));
+    s = (m5206_timer_state *)g_malloc0(sizeof(m5206_timer_state));
     bh = qemu_bh_new(m5206_timer_trigger, s);
     s->timer = ptimer_init(bh);
     s->irq = irq;
@@ -523,7 +523,7 @@
     qemu_irq *pic;
     int iomemtype;
 
-    s = (m5206_mbar_state *)qemu_mallocz(sizeof(m5206_mbar_state));
+    s = (m5206_mbar_state *)g_malloc0(sizeof(m5206_mbar_state));
     iomemtype = cpu_register_io_memory(m5206_mbar_readfn,
                                        m5206_mbar_writefn, s,
                                        DEVICE_NATIVE_ENDIAN);
diff --git a/hw/mcf5208.c b/hw/mcf5208.c
index 78fbc5f..8fe507f 100644
--- a/hw/mcf5208.c
+++ b/hw/mcf5208.c
@@ -185,7 +185,7 @@
     cpu_register_physical_memory(0xfc0a8000, 0x00004000, iomemtype);
     /* Timers.  */
     for (i = 0; i < 2; i++) {
-        s = (m5208_timer_state *)qemu_mallocz(sizeof(m5208_timer_state));
+        s = (m5208_timer_state *)g_malloc0(sizeof(m5208_timer_state));
         bh = qemu_bh_new(m5208_timer_trigger, s);
         s->timer = ptimer_init(bh);
         iomemtype = cpu_register_io_memory(m5208_timer_readfn,
diff --git a/hw/mcf_fec.c b/hw/mcf_fec.c
index 748eb59..42a5d77 100644
--- a/hw/mcf_fec.c
+++ b/hw/mcf_fec.c
@@ -447,7 +447,7 @@
 
     cpu_unregister_io_memory(s->mmio_index);
 
-    qemu_free(s);
+    g_free(s);
 }
 
 static NetClientInfo net_mcf_fec_info = {
@@ -464,7 +464,7 @@
 
     qemu_check_nic_model(nd, "mcf_fec");
 
-    s = (mcf_fec_state *)qemu_mallocz(sizeof(mcf_fec_state));
+    s = (mcf_fec_state *)g_malloc0(sizeof(mcf_fec_state));
     s->irq = irq;
     s->mmio_index = cpu_register_io_memory(mcf_fec_readfn,
                                            mcf_fec_writefn, s,
diff --git a/hw/mcf_intc.c b/hw/mcf_intc.c
index 6cb0a09..99092e7 100644
--- a/hw/mcf_intc.c
+++ b/hw/mcf_intc.c
@@ -144,7 +144,7 @@
     mcf_intc_state *s;
     int iomemtype;
 
-    s = qemu_mallocz(sizeof(mcf_intc_state));
+    s = g_malloc0(sizeof(mcf_intc_state));
     s->env = env;
     mcf_intc_reset(s);
 
diff --git a/hw/mcf_uart.c b/hw/mcf_uart.c
index 905e116..6118ccb 100644
--- a/hw/mcf_uart.c
+++ b/hw/mcf_uart.c
@@ -272,7 +272,7 @@
 {
     mcf_uart_state *s;
 
-    s = qemu_mallocz(sizeof(mcf_uart_state));
+    s = g_malloc0(sizeof(mcf_uart_state));
     s->chr = chr;
     s->irq = irq;
     if (chr) {
diff --git a/hw/milkymist.c b/hw/milkymist.c
index 7879840..93288c8 100644
--- a/hw/milkymist.c
+++ b/hw/milkymist.c
@@ -99,7 +99,7 @@
     target_phys_addr_t cmdline_base = sdram_base + 0x1000000;
     size_t initrd_max = sdram_size - 0x1002000;
 
-    reset_info = qemu_mallocz(sizeof(ResetInfo));
+    reset_info = g_malloc0(sizeof(ResetInfo));
 
     if (cpu_model == NULL) {
         cpu_model = "lm32-full";
diff --git a/hw/mips_fulong2e.c b/hw/mips_fulong2e.c
index 420fada..ec8c88e 100644
--- a/hw/mips_fulong2e.c
+++ b/hw/mips_fulong2e.c
@@ -140,7 +140,7 @@
 
     /* Setup prom parameters. */
     prom_size = ENVP_NB_ENTRIES * (sizeof(int32_t) + ENVP_ENTRY_SIZE);
-    prom_buf = qemu_malloc(prom_size);
+    prom_buf = g_malloc(prom_size);
 
     prom_set(prom_buf, index++, "%s", loaderparams.kernel_filename);
     if (initrd_size > 0) {
@@ -313,7 +313,7 @@
         if (filename) {
             bios_size = load_image_targphys(filename, 0x1fc00000LL,
                                             BIOS_SIZE);
-            qemu_free(filename);
+            g_free(filename);
         } else {
             bios_size = -1;
         }
diff --git a/hw/mips_jazz.c b/hw/mips_jazz.c
index f6ab6dc..ea20510 100644
--- a/hw/mips_jazz.c
+++ b/hw/mips_jazz.c
@@ -158,7 +158,7 @@
     if (filename) {
         bios_size = load_image_targphys(filename, 0xfff00000LL,
                                         MAGNUM_BIOS_SIZE);
-        qemu_free(filename);
+        g_free(filename);
     } else {
         bios_size = -1;
     }
@@ -207,7 +207,7 @@
     for (n = 0; n < nb_nics; n++) {
         nd = &nd_table[n];
         if (!nd->model)
-            nd->model = qemu_strdup("dp83932");
+            nd->model = g_strdup("dp83932");
         if (strcmp(nd->model, "dp83932") == 0) {
             dp83932_init(nd, 0x80001000, 2, rc4030[4],
                          rc4030_opaque, rc4030_dma_memory_rw);
diff --git a/hw/mips_malta.c b/hw/mips_malta.c
index ed2a483..5bdb45b 100644
--- a/hw/mips_malta.c
+++ b/hw/mips_malta.c
@@ -433,7 +433,7 @@
     MaltaFPGAState *s;
     int malta;
 
-    s = (MaltaFPGAState *)qemu_mallocz(sizeof(MaltaFPGAState));
+    s = (MaltaFPGAState *)g_malloc0(sizeof(MaltaFPGAState));
 
     malta = cpu_register_io_memory(malta_fpga_read,
                                    malta_fpga_write, s,
@@ -709,7 +709,7 @@
 
     /* Setup prom parameters. */
     prom_size = ENVP_NB_ENTRIES * (sizeof(int32_t) + ENVP_ENTRY_SIZE);
-    prom_buf = qemu_malloc(prom_size);
+    prom_buf = g_malloc(prom_size);
 
     prom_set(prom_buf, prom_index++, "%s", loaderparams.kernel_filename);
     if (initrd_size > 0) {
@@ -863,7 +863,7 @@
             if (filename) {
                 bios_size = load_image_targphys(filename, 0x1fc00000LL,
                                                 BIOS_SIZE);
-                qemu_free(filename);
+                g_free(filename);
             } else {
                 bios_size = -1;
             }
diff --git a/hw/mips_mipssim.c b/hw/mips_mipssim.c
index 380a7eb..0d46cc4 100644
--- a/hw/mips_mipssim.c
+++ b/hw/mips_mipssim.c
@@ -138,7 +138,7 @@
         fprintf(stderr, "Unable to find CPU definition\n");
         exit(1);
     }
-    reset_info = qemu_mallocz(sizeof(ResetData));
+    reset_info = g_malloc0(sizeof(ResetData));
     reset_info->env = env;
     reset_info->vector = env->active_tc.PC;
     qemu_register_reset(main_cpu_reset, reset_info);
@@ -158,7 +158,7 @@
     filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, bios_name);
     if (filename) {
         bios_size = load_image_targphys(filename, 0x1fc00000LL, BIOS_SIZE);
-        qemu_free(filename);
+        g_free(filename);
     } else {
         bios_size = -1;
     }
diff --git a/hw/mips_r4k.c b/hw/mips_r4k.c
index 2834a46..9d90568 100644
--- a/hw/mips_r4k.c
+++ b/hw/mips_r4k.c
@@ -126,7 +126,7 @@
 
     /* Store command line.  */
     params_size = 264;
-    params_buf = qemu_malloc(params_size);
+    params_buf = g_malloc(params_size);
 
     params_buf[0] = tswap32(ram_size);
     params_buf[1] = tswap32(0x12345678);
@@ -186,7 +186,7 @@
         fprintf(stderr, "Unable to find CPU definition\n");
         exit(1);
     }
-    reset_info = qemu_mallocz(sizeof(ResetData));
+    reset_info = g_malloc0(sizeof(ResetData));
     reset_info->env = env;
     reset_info->vector = env->active_tc.PC;
     qemu_register_reset(main_cpu_reset, reset_info);
@@ -248,7 +248,7 @@
 		bios_name);
     }
     if (filename) {
-        qemu_free(filename);
+        g_free(filename);
     }
 
     if (kernel_filename) {
diff --git a/hw/mipsnet.c b/hw/mipsnet.c
index 0db3ba7..b889ee0 100644
--- a/hw/mipsnet.c
+++ b/hw/mipsnet.c
@@ -228,7 +228,7 @@
 
     isa_unassign_ioport(s->io_base, 36);
 
-    qemu_free(s);
+    g_free(s);
 }
 
 static NetClientInfo net_mipsnet_info = {
@@ -245,7 +245,7 @@
 
     qemu_check_nic_model(nd, "mipsnet");
 
-    s = qemu_mallocz(sizeof(MIPSnetState));
+    s = g_malloc0(sizeof(MIPSnetState));
 
     register_ioport_write(base, 36, 1, mipsnet_ioport_write, s);
     register_ioport_read(base, 36, 1, mipsnet_ioport_read, s);
diff --git a/hw/msix.c b/hw/msix.c
index 8536c3f..b15bafc 100644
--- a/hw/msix.c
+++ b/hw/msix.c
@@ -219,10 +219,10 @@
     if (nentries > MSIX_MAX_ENTRIES)
         return -EINVAL;
 
-    dev->msix_entry_used = qemu_mallocz(MSIX_MAX_ENTRIES *
+    dev->msix_entry_used = g_malloc0(MSIX_MAX_ENTRIES *
                                         sizeof *dev->msix_entry_used);
 
-    dev->msix_table_page = qemu_mallocz(MSIX_PAGE_SIZE);
+    dev->msix_table_page = g_malloc0(MSIX_PAGE_SIZE);
     msix_mask_all(dev, nentries);
 
     memory_region_init_io(&dev->msix_mmio, &msix_mmio_ops, dev,
@@ -240,9 +240,9 @@
 err_config:
     dev->msix_entries_nr = 0;
     memory_region_destroy(&dev->msix_mmio);
-    qemu_free(dev->msix_table_page);
+    g_free(dev->msix_table_page);
     dev->msix_table_page = NULL;
-    qemu_free(dev->msix_entry_used);
+    g_free(dev->msix_entry_used);
     dev->msix_entry_used = NULL;
     return ret;
 }
@@ -268,9 +268,9 @@
     dev->msix_entries_nr = 0;
     memory_region_del_subregion(bar, &dev->msix_mmio);
     memory_region_destroy(&dev->msix_mmio);
-    qemu_free(dev->msix_table_page);
+    g_free(dev->msix_table_page);
     dev->msix_table_page = NULL;
-    qemu_free(dev->msix_entry_used);
+    g_free(dev->msix_entry_used);
     dev->msix_entry_used = NULL;
     dev->cap_present &= ~QEMU_PCI_CAP_MSIX;
     return 0;
diff --git a/hw/msmouse.c b/hw/msmouse.c
index 67c6cd4..b611c2f 100644
--- a/hw/msmouse.c
+++ b/hw/msmouse.c
@@ -61,14 +61,14 @@
 
 static void msmouse_chr_close (struct CharDriverState *chr)
 {
-    qemu_free (chr);
+    g_free (chr);
 }
 
 int qemu_chr_open_msmouse(QemuOpts *opts, CharDriverState **_chr)
 {
     CharDriverState *chr;
 
-    chr = qemu_mallocz(sizeof(CharDriverState));
+    chr = g_malloc0(sizeof(CharDriverState));
     chr->chr_write = msmouse_chr_write;
     chr->chr_close = msmouse_chr_close;
 
diff --git a/hw/multiboot.c b/hw/multiboot.c
index a1d3f41..b4484a3 100644
--- a/hw/multiboot.c
+++ b/hw/multiboot.c
@@ -187,7 +187,7 @@
         mb_kernel_size = elf_high - elf_low;
         mh_entry_addr = elf_entry;
 
-        mbs.mb_buf = qemu_malloc(mb_kernel_size);
+        mbs.mb_buf = g_malloc(mb_kernel_size);
         if (rom_copy(mbs.mb_buf, mh_load_addr, mb_kernel_size) != mb_kernel_size) {
             fprintf(stderr, "Error while fetching elf kernel from rom\n");
             exit(1);
@@ -220,7 +220,7 @@
         mb_debug("qemu: loading multiboot kernel (%#x bytes) at %#x\n",
                  mb_load_size, mh_load_addr);
 
-        mbs.mb_buf = qemu_malloc(mb_kernel_size);
+        mbs.mb_buf = g_malloc(mb_kernel_size);
         fseek(f, mb_kernel_text_offset, SEEK_SET);
         if (fread(mbs.mb_buf, 1, mb_load_size, f) != mb_load_size) {
             fprintf(stderr, "fread() failed\n");
@@ -252,7 +252,7 @@
     mbs.mb_buf_size = TARGET_PAGE_ALIGN(mbs.mb_buf_size);
 
     /* enlarge mb_buf to hold cmdlines and mb-info structs */
-    mbs.mb_buf          = qemu_realloc(mbs.mb_buf, mbs.mb_buf_size);
+    mbs.mb_buf          = g_realloc(mbs.mb_buf, mbs.mb_buf_size);
     mbs.offset_cmdlines = mbs.offset_mbinfo + mbs.mb_mods_avail * MB_MOD_SIZE;
 
     if (initrd_filename) {
@@ -281,7 +281,7 @@
             }
 
             mbs.mb_buf_size = TARGET_PAGE_ALIGN(mb_mod_length + mbs.mb_buf_size);
-            mbs.mb_buf = qemu_realloc(mbs.mb_buf, mbs.mb_buf_size);
+            mbs.mb_buf = g_realloc(mbs.mb_buf, mbs.mb_buf_size);
 
             load_image(initrd_filename, (unsigned char *)mbs.mb_buf + offs);
             mb_add_mod(&mbs, mbs.mb_buf_phys + offs,
@@ -320,7 +320,7 @@
     mb_debug("           mb_mods_count = %d\n", mbs.mb_mods_count);
 
     /* save bootinfo off the stack */
-    mb_bootinfo_data = qemu_malloc(sizeof(bootinfo));
+    mb_bootinfo_data = g_malloc(sizeof(bootinfo));
     memcpy(mb_bootinfo_data, bootinfo, sizeof(bootinfo));
 
     /* Pass variables to option rom */
diff --git a/hw/nand.c b/hw/nand.c
index 28d9f0b..c27783e 100644
--- a/hw/nand.c
+++ b/hw/nand.c
@@ -399,7 +399,7 @@
         pagesize += 1 << s->page_shift;
     }
     if (pagesize) {
-        s->storage = (uint8_t *) memset(qemu_malloc(s->pages * pagesize),
+        s->storage = (uint8_t *) memset(g_malloc(s->pages * pagesize),
                         0xff, s->pages * pagesize);
     }
     /* Give s->ioaddr a sane value in case we save state before it is used. */
diff --git a/hw/nseries.c b/hw/nseries.c
index 6a5575e..144fd5a 100644
--- a/hw/nseries.c
+++ b/hw/nseries.c
@@ -654,7 +654,7 @@
 
 static void *mipid_init(void)
 {
-    struct mipid_s *s = (struct mipid_s *) qemu_mallocz(sizeof(*s));
+    struct mipid_s *s = (struct mipid_s *) g_malloc0(sizeof(*s));
 
     s->id = 0x838f03;
     mipid_reset(s);
@@ -710,10 +710,10 @@
     chip->write(chip->opaque, 1, 0x01);		/* Input Data Format */
     chip->write(chip->opaque, 1, 0x01);		/* Data Source Select */
 
-    fb_blank = memset(qemu_malloc(800 * 480 * 2), 0xff, 800 * 480 * 2);
+    fb_blank = memset(g_malloc(800 * 480 * 2), 0xff, 800 * 480 * 2);
     /* Display Memory Data Port */
     chip->block(chip->opaque, 1, fb_blank, 800 * 480 * 2, 800);
-    qemu_free(fb_blank);
+    g_free(fb_blank);
 }
 
 static void n8x0_dss_setup(struct n800_s *s)
@@ -1270,7 +1270,7 @@
                 const char *kernel_cmdline, const char *initrd_filename,
                 const char *cpu_model, struct arm_boot_info *binfo, int model)
 {
-    struct n800_s *s = (struct n800_s *) qemu_mallocz(sizeof(*s));
+    struct n800_s *s = (struct n800_s *) g_malloc0(sizeof(*s));
     int sdram_size = binfo->ram_size;
     DisplayState *ds;
 
diff --git a/hw/omap.h b/hw/omap.h
index a064353..2a6d589 100644
--- a/hw/omap.h
+++ b/hw/omap.h
@@ -1107,7 +1107,7 @@
                                            CPUWriteMemoryFunc * const *mem_write,
                                            void *opaque)
 {
-    struct io_fn *s = qemu_malloc(sizeof(struct io_fn));
+    struct io_fn *s = g_malloc(sizeof(struct io_fn));
 
     s->mem_read = mem_read;
     s->mem_write = mem_write;
diff --git a/hw/omap1.c b/hw/omap1.c
index 400de47..614fd31 100644
--- a/hw/omap1.c
+++ b/hw/omap1.c
@@ -255,7 +255,7 @@
 {
     int iomemtype;
     struct omap_mpu_timer_s *s = (struct omap_mpu_timer_s *)
-            qemu_mallocz(sizeof(struct omap_mpu_timer_s));
+            g_malloc0(sizeof(struct omap_mpu_timer_s));
 
     s->irq = irq;
     s->clk = clk;
@@ -379,7 +379,7 @@
 {
     int iomemtype;
     struct omap_watchdog_timer_s *s = (struct omap_watchdog_timer_s *)
-            qemu_mallocz(sizeof(struct omap_watchdog_timer_s));
+            g_malloc0(sizeof(struct omap_watchdog_timer_s));
 
     s->timer.irq = irq;
     s->timer.clk = clk;
@@ -481,7 +481,7 @@
 {
     int iomemtype;
     struct omap_32khz_timer_s *s = (struct omap_32khz_timer_s *)
-            qemu_mallocz(sizeof(struct omap_32khz_timer_s));
+            g_malloc0(sizeof(struct omap_32khz_timer_s));
 
     s->timer.irq = irq;
     s->timer.clk = clk;
@@ -1188,7 +1188,7 @@
 {
     int iomemtype;
     struct omap_tipb_bridge_s *s = (struct omap_tipb_bridge_s *)
-            qemu_mallocz(sizeof(struct omap_tipb_bridge_s));
+            g_malloc0(sizeof(struct omap_tipb_bridge_s));
 
     s->abort = abort_irq;
     omap_tipb_bridge_reset(s);
@@ -2025,7 +2025,7 @@
 {
     int iomemtype;
     struct omap_mpuio_s *s = (struct omap_mpuio_s *)
-            qemu_mallocz(sizeof(struct omap_mpuio_s));
+            g_malloc0(sizeof(struct omap_mpuio_s));
 
     s->irq = gpio_int;
     s->kbd_irq = kbd_int;
@@ -2211,7 +2211,7 @@
 {
     int iomemtype;
     struct omap_uwire_s *s = (struct omap_uwire_s *)
-            qemu_mallocz(sizeof(struct omap_uwire_s));
+            g_malloc0(sizeof(struct omap_uwire_s));
 
     s->txirq = irq[0];
     s->rxirq = irq[1];
@@ -2819,7 +2819,7 @@
 {
     int iomemtype;
     struct omap_rtc_s *s = (struct omap_rtc_s *)
-            qemu_mallocz(sizeof(struct omap_rtc_s));
+            g_malloc0(sizeof(struct omap_rtc_s));
 
     s->irq = irq[0];
     s->alarm = irq[1];
@@ -3339,7 +3339,7 @@
 {
     int iomemtype;
     struct omap_mcbsp_s *s = (struct omap_mcbsp_s *)
-            qemu_mallocz(sizeof(struct omap_mcbsp_s));
+            g_malloc0(sizeof(struct omap_mcbsp_s));
 
     s->txirq = irq[0];
     s->rxirq = irq[1];
@@ -3515,7 +3515,7 @@
 {
     int iomemtype;
     struct omap_lpg_s *s = (struct omap_lpg_s *)
-            qemu_mallocz(sizeof(struct omap_lpg_s));
+            g_malloc0(sizeof(struct omap_lpg_s));
 
     s->tm = qemu_new_timer_ms(rt_clock, omap_lpg_tick, s);
 
@@ -3711,7 +3711,7 @@
 {
     int i;
     struct omap_mpu_state_s *s = (struct omap_mpu_state_s *)
-            qemu_mallocz(sizeof(struct omap_mpu_state_s));
+            g_malloc0(sizeof(struct omap_mpu_state_s));
     ram_addr_t imif_base, emiff_base;
     qemu_irq *cpu_irq;
     qemu_irq dma_irqs[6];
diff --git a/hw/omap2.c b/hw/omap2.c
index c9b3540..3b51ac5 100644
--- a/hw/omap2.c
+++ b/hw/omap2.c
@@ -591,7 +591,7 @@
 {
     int iomemtype;
     struct omap_eac_s *s = (struct omap_eac_s *)
-            qemu_mallocz(sizeof(struct omap_eac_s));
+            g_malloc0(sizeof(struct omap_eac_s));
 
     s->irq = irq;
     s->codec.rxdrq = *drq ++;
@@ -777,7 +777,7 @@
 {
     int iomemtype;
     struct omap_sti_s *s = (struct omap_sti_s *)
-            qemu_mallocz(sizeof(struct omap_sti_s));
+            g_malloc0(sizeof(struct omap_sti_s));
 
     s->irq = irq;
     omap_sti_reset(s);
@@ -1790,7 +1790,7 @@
 {
     int iomemtype;
     struct omap_prcm_s *s = (struct omap_prcm_s *)
-            qemu_mallocz(sizeof(struct omap_prcm_s));
+            g_malloc0(sizeof(struct omap_prcm_s));
 
     s->irq[0] = mpu_int;
     s->irq[1] = dsp_int;
@@ -2163,7 +2163,7 @@
 {
     int iomemtype;
     struct omap_sysctl_s *s = (struct omap_sysctl_s *)
-            qemu_mallocz(sizeof(struct omap_sysctl_s));
+            g_malloc0(sizeof(struct omap_sysctl_s));
 
     s->mpu = mpu;
     omap_sysctl_reset(s);
@@ -2228,7 +2228,7 @@
                 const char *core)
 {
     struct omap_mpu_state_s *s = (struct omap_mpu_state_s *)
-            qemu_mallocz(sizeof(struct omap_mpu_state_s));
+            g_malloc0(sizeof(struct omap_mpu_state_s));
     ram_addr_t sram_base, q2_base;
     qemu_irq *cpu_irq;
     qemu_irq dma_irqs[4];
diff --git a/hw/omap_clk.c b/hw/omap_clk.c
index 577b326..8448006 100644
--- a/hw/omap_clk.c
+++ b/hw/omap_clk.c
@@ -1239,7 +1239,7 @@
     for (i = onchip_clks, count = 0; *i; i ++)
         if ((*i)->flags & flag)
             count ++;
-    mpu->clks = (struct clk *) qemu_mallocz(sizeof(struct clk) * (count + 1));
+    mpu->clks = (struct clk *) g_malloc0(sizeof(struct clk) * (count + 1));
     for (i = onchip_clks, j = mpu->clks; *i; i ++)
         if ((*i)->flags & flag) {
             memcpy(j, *i, sizeof(struct clk));
diff --git a/hw/omap_dma.c b/hw/omap_dma.c
index 8e2dcc9..f943d4e 100644
--- a/hw/omap_dma.c
+++ b/hw/omap_dma.c
@@ -1620,7 +1620,7 @@
 {
     int iomemtype, num_irqs, memsize, i;
     struct omap_dma_s *s = (struct omap_dma_s *)
-            qemu_mallocz(sizeof(struct omap_dma_s));
+            g_malloc0(sizeof(struct omap_dma_s));
 
     if (model <= omap_dma_3_1) {
         num_irqs = 6;
@@ -2039,7 +2039,7 @@
 {
     int iomemtype, i;
     struct omap_dma_s *s = (struct omap_dma_s *)
-            qemu_mallocz(sizeof(struct omap_dma_s));
+            g_malloc0(sizeof(struct omap_dma_s));
 
     s->model = omap_dma_4;
     s->chans = chans;
diff --git a/hw/omap_dss.c b/hw/omap_dss.c
index afe287a..c8387a8 100644
--- a/hw/omap_dss.c
+++ b/hw/omap_dss.c
@@ -627,7 +627,7 @@
     }
     if (!data) {
         if (len > bounce_len) {
-            bounce_buffer = qemu_realloc(bounce_buffer, len);
+            bounce_buffer = g_realloc(bounce_buffer, len);
         }
         data = bounce_buffer;
         cpu_physical_memory_read(data_addr, data, len);
@@ -1030,7 +1030,7 @@
 {
     int iomemtype[5];
     struct omap_dss_s *s = (struct omap_dss_s *)
-            qemu_mallocz(sizeof(struct omap_dss_s));
+            g_malloc0(sizeof(struct omap_dss_s));
 
     s->irq = irq;
     s->drq = drq;
diff --git a/hw/omap_gpio.c b/hw/omap_gpio.c
index c23964c..42e59c3 100644
--- a/hw/omap_gpio.c
+++ b/hw/omap_gpio.c
@@ -696,8 +696,8 @@
     } else {
         s->modulecount = 6;
     }
-    s->modules = qemu_mallocz(s->modulecount * sizeof(struct omap2_gpio_s));
-    s->handler = qemu_mallocz(s->modulecount * 32 * sizeof(qemu_irq));
+    s->modules = g_malloc0(s->modulecount * sizeof(struct omap2_gpio_s));
+    s->handler = g_malloc0(s->modulecount * 32 * sizeof(qemu_irq));
     qdev_init_gpio_in(&dev->qdev, omap2_gpio_set, s->modulecount * 32);
     qdev_init_gpio_out(&dev->qdev, s->handler, s->modulecount * 32);
     for (i = 0; i < s->modulecount; i++) {
diff --git a/hw/omap_gpmc.c b/hw/omap_gpmc.c
index 8bf3343..13e3e00 100644
--- a/hw/omap_gpmc.c
+++ b/hw/omap_gpmc.c
@@ -385,7 +385,7 @@
 {
     int iomemtype;
     struct omap_gpmc_s *s = (struct omap_gpmc_s *)
-            qemu_mallocz(sizeof(struct omap_gpmc_s));
+            g_malloc0(sizeof(struct omap_gpmc_s));
 
     omap_gpmc_reset(s);
 
diff --git a/hw/omap_gptimer.c b/hw/omap_gptimer.c
index f2a424f..704b000 100644
--- a/hw/omap_gptimer.c
+++ b/hw/omap_gptimer.c
@@ -465,7 +465,7 @@
 {
     int iomemtype;
     struct omap_gp_timer_s *s = (struct omap_gp_timer_s *)
-            qemu_mallocz(sizeof(struct omap_gp_timer_s));
+            g_malloc0(sizeof(struct omap_gp_timer_s));
 
     s->ta = ta;
     s->irq = irq;
diff --git a/hw/omap_i2c.c b/hw/omap_i2c.c
index 5cabb5a..11577b1 100644
--- a/hw/omap_i2c.c
+++ b/hw/omap_i2c.c
@@ -426,7 +426,7 @@
 {
     int iomemtype;
     struct omap_i2c_s *s = (struct omap_i2c_s *)
-            qemu_mallocz(sizeof(struct omap_i2c_s));
+            g_malloc0(sizeof(struct omap_i2c_s));
 
     /* TODO: set a value greater or equal to real hardware */
     s->revision = 0x11;
@@ -448,7 +448,7 @@
 {
     int iomemtype;
     struct omap_i2c_s *s = (struct omap_i2c_s *)
-            qemu_mallocz(sizeof(struct omap_i2c_s));
+            g_malloc0(sizeof(struct omap_i2c_s));
 
     s->revision = 0x34;
     s->irq = irq;
diff --git a/hw/omap_intc.c b/hw/omap_intc.c
index 001e20b..f1f570e 100644
--- a/hw/omap_intc.c
+++ b/hw/omap_intc.c
@@ -358,7 +358,7 @@
 {
     int iomemtype;
     struct omap_intr_handler_s *s = (struct omap_intr_handler_s *)
-            qemu_mallocz(sizeof(struct omap_intr_handler_s) +
+            g_malloc0(sizeof(struct omap_intr_handler_s) +
                             sizeof(struct omap_intr_handler_bank_s) * nbanks);
 
     s->parent_intr[0] = parent_irq;
@@ -577,7 +577,7 @@
 {
     int iomemtype;
     struct omap_intr_handler_s *s = (struct omap_intr_handler_s *)
-            qemu_mallocz(sizeof(struct omap_intr_handler_s) +
+            g_malloc0(sizeof(struct omap_intr_handler_s) +
                             sizeof(struct omap_intr_handler_bank_s) * nbanks);
 
     s->parent_intr[0] = parent_irq;
diff --git a/hw/omap_l4.c b/hw/omap_l4.c
index 59c84b1..a4a8883 100644
--- a/hw/omap_l4.c
+++ b/hw/omap_l4.c
@@ -120,7 +120,7 @@
 
 struct omap_l4_s *omap_l4_init(target_phys_addr_t base, int ta_num)
 {
-    struct omap_l4_s *bus = qemu_mallocz(
+    struct omap_l4_s *bus = g_malloc0(
                     sizeof(*bus) + ta_num * sizeof(*bus->ta));
 
     bus->ta_num = ta_num;
@@ -128,19 +128,19 @@
 
 #ifdef L4_MUX_HACK
     omap_l4_io_entries = 1;
-    omap_l4_io_entry = qemu_mallocz(125 * sizeof(*omap_l4_io_entry));
+    omap_l4_io_entry = g_malloc0(125 * sizeof(*omap_l4_io_entry));
 
     omap_cpu_io_entry =
             cpu_register_io_memory(omap_l4_io_readfn,
                             omap_l4_io_writefn, bus, DEVICE_NATIVE_ENDIAN);
 # define L4_PAGES	(0xb4000 / TARGET_PAGE_SIZE)
-    omap_l4_io_readb_fn = qemu_mallocz(sizeof(void *) * L4_PAGES);
-    omap_l4_io_readh_fn = qemu_mallocz(sizeof(void *) * L4_PAGES);
-    omap_l4_io_readw_fn = qemu_mallocz(sizeof(void *) * L4_PAGES);
-    omap_l4_io_writeb_fn = qemu_mallocz(sizeof(void *) * L4_PAGES);
-    omap_l4_io_writeh_fn = qemu_mallocz(sizeof(void *) * L4_PAGES);
-    omap_l4_io_writew_fn = qemu_mallocz(sizeof(void *) * L4_PAGES);
-    omap_l4_io_opaque = qemu_mallocz(sizeof(void *) * L4_PAGES);
+    omap_l4_io_readb_fn = g_malloc0(sizeof(void *) * L4_PAGES);
+    omap_l4_io_readh_fn = g_malloc0(sizeof(void *) * L4_PAGES);
+    omap_l4_io_readw_fn = g_malloc0(sizeof(void *) * L4_PAGES);
+    omap_l4_io_writeb_fn = g_malloc0(sizeof(void *) * L4_PAGES);
+    omap_l4_io_writeh_fn = g_malloc0(sizeof(void *) * L4_PAGES);
+    omap_l4_io_writew_fn = g_malloc0(sizeof(void *) * L4_PAGES);
+    omap_l4_io_opaque = g_malloc0(sizeof(void *) * L4_PAGES);
 #endif
 
     return bus;
diff --git a/hw/omap_lcdc.c b/hw/omap_lcdc.c
index 0c2c550..a905422 100644
--- a/hw/omap_lcdc.c
+++ b/hw/omap_lcdc.c
@@ -441,7 +441,7 @@
 {
     int iomemtype;
     struct omap_lcd_panel_s *s = (struct omap_lcd_panel_s *)
-            qemu_mallocz(sizeof(struct omap_lcd_panel_s));
+            g_malloc0(sizeof(struct omap_lcd_panel_s));
 
     s->irq = irq;
     s->dma = dma;
diff --git a/hw/omap_mmc.c b/hw/omap_mmc.c
index e9ec2f3..a1afeb5 100644
--- a/hw/omap_mmc.c
+++ b/hw/omap_mmc.c
@@ -576,7 +576,7 @@
 {
     int iomemtype;
     struct omap_mmc_s *s = (struct omap_mmc_s *)
-            qemu_mallocz(sizeof(struct omap_mmc_s));
+            g_malloc0(sizeof(struct omap_mmc_s));
 
     s->irq = irq;
     s->dma = dma;
@@ -602,7 +602,7 @@
 {
     int iomemtype;
     struct omap_mmc_s *s = (struct omap_mmc_s *)
-            qemu_mallocz(sizeof(struct omap_mmc_s));
+            g_malloc0(sizeof(struct omap_mmc_s));
 
     s->irq = irq;
     s->dma = dma;
diff --git a/hw/omap_sdrc.c b/hw/omap_sdrc.c
index e183762..1df2fd8 100644
--- a/hw/omap_sdrc.c
+++ b/hw/omap_sdrc.c
@@ -153,7 +153,7 @@
 {
     int iomemtype;
     struct omap_sdrc_s *s = (struct omap_sdrc_s *)
-            qemu_mallocz(sizeof(struct omap_sdrc_s));
+            g_malloc0(sizeof(struct omap_sdrc_s));
 
     omap_sdrc_reset(s);
 
diff --git a/hw/omap_spi.c b/hw/omap_spi.c
index a6b0349..6030ad9 100644
--- a/hw/omap_spi.c
+++ b/hw/omap_spi.c
@@ -315,7 +315,7 @@
 {
     int iomemtype;
     struct omap_mcspi_s *s = (struct omap_mcspi_s *)
-            qemu_mallocz(sizeof(struct omap_mcspi_s));
+            g_malloc0(sizeof(struct omap_mcspi_s));
     struct omap_mcspi_ch_s *ch = s->ch;
 
     s->irq = irq;
diff --git a/hw/omap_synctimer.c b/hw/omap_synctimer.c
index 67f65e6..b47ca88 100644
--- a/hw/omap_synctimer.c
+++ b/hw/omap_synctimer.c
@@ -86,7 +86,7 @@
 struct omap_synctimer_s *omap_synctimer_init(struct omap_target_agent_s *ta,
                 struct omap_mpu_state_s *mpu, omap_clk fclk, omap_clk iclk)
 {
-    struct omap_synctimer_s *s = qemu_mallocz(sizeof(*s));
+    struct omap_synctimer_s *s = g_malloc0(sizeof(*s));
 
     omap_synctimer_reset(s);
     omap_l4_attach(ta, 0, l4_register_io_memory(
diff --git a/hw/omap_uart.c b/hw/omap_uart.c
index 9cee81d..09ae9f8 100644
--- a/hw/omap_uart.c
+++ b/hw/omap_uart.c
@@ -55,7 +55,7 @@
                 const char *label, CharDriverState *chr)
 {
     struct omap_uart_s *s = (struct omap_uart_s *)
-            qemu_mallocz(sizeof(struct omap_uart_s));
+            g_malloc0(sizeof(struct omap_uart_s));
 
     s->base = base;
     s->fclk = fclk;
diff --git a/hw/onenand.c b/hw/onenand.c
index b0cbebc..c37cf59 100644
--- a/hw/onenand.c
+++ b/hw/onenand.c
@@ -186,7 +186,7 @@
         const uint8_t *sp = (const uint8_t *) src;
         uint8_t *dp = 0;
         if (s->bdrv_cur) {
-            dp = qemu_malloc(size);
+            dp = g_malloc(size);
             if (!dp || bdrv_read(s->bdrv_cur, sec, dp, secn) < 0) {
                 result = 1;
             }
@@ -207,7 +207,7 @@
             }
         }
         if (dp && s->bdrv_cur) {
-            qemu_free(dp);
+            g_free(dp);
         }
     }
 
@@ -239,7 +239,7 @@
         const uint8_t *sp = (const uint8_t *) src;
         uint8_t *dp = 0, *dpp = 0;
         if (s->bdrv_cur) {
-            dp = qemu_malloc(512);
+            dp = g_malloc(512);
             if (!dp || bdrv_read(s->bdrv_cur,
                                 s->secs_cur + (sec >> 5),
                                 dp, 1) < 0) {
@@ -265,7 +265,7 @@
             }
         }
         if (dp) {
-            qemu_free(dp);
+            g_free(dp);
         }
     }
     return result;
@@ -274,13 +274,13 @@
 static inline int onenand_erase(OneNANDState *s, int sec, int num)
 {
     uint8_t *blankbuf, *tmpbuf;
-    blankbuf = qemu_malloc(512);
+    blankbuf = g_malloc(512);
     if (!blankbuf) {
         return 1;
     }
-    tmpbuf = qemu_malloc(512);
+    tmpbuf = g_malloc(512);
     if (!tmpbuf) {
-        qemu_free(blankbuf);
+        g_free(blankbuf);
         return 1;
     }
     memset(blankbuf, 0xff, 512);
@@ -307,13 +307,13 @@
         }
     }
 
-    qemu_free(tmpbuf);
-    qemu_free(blankbuf);
+    g_free(tmpbuf);
+    g_free(blankbuf);
     return 0;
 
 fail:
-    qemu_free(tmpbuf);
-    qemu_free(blankbuf);
+    g_free(tmpbuf);
+    g_free(blankbuf);
     return 1;
 }
 
@@ -700,7 +700,7 @@
                 uint16_t man_id, uint16_t dev_id, uint16_t ver_id,
                 int regshift, qemu_irq irq)
 {
-    OneNANDState *s = (OneNANDState *) qemu_mallocz(sizeof(*s));
+    OneNANDState *s = (OneNANDState *) g_malloc0(sizeof(*s));
     uint32_t size = 1 << (24 + ((dev_id >> 4) & 7));
     void *ram;
 
@@ -712,16 +712,16 @@
     s->id.ver = ver_id;
     s->blocks = size >> BLOCK_SHIFT;
     s->secs = size >> 9;
-    s->blockwp = qemu_malloc(s->blocks);
+    s->blockwp = g_malloc(s->blocks);
     s->density_mask = (dev_id & 0x08) ? (1 << (6 + ((dev_id >> 4) & 7))) : 0;
     s->iomemtype = cpu_register_io_memory(onenand_readfn,
                     onenand_writefn, s, DEVICE_NATIVE_ENDIAN);
     s->bdrv = bdrv;
     if (!s->bdrv) {
-        s->image = memset(qemu_malloc(size + (size >> 5)),
+        s->image = memset(g_malloc(size + (size >> 5)),
                         0xff, size + (size >> 5));
     }
-    s->otp = memset(qemu_malloc((64 + 2) << PAGE_SHIFT),
+    s->otp = memset(g_malloc((64 + 2) << PAGE_SHIFT),
                     0xff, (64 + 2) << PAGE_SHIFT);
     s->ram = qemu_ram_alloc(NULL, "onenand.ram", 0xc000 << s->shift);
     ram = qemu_get_ram_ptr(s->ram);
diff --git a/hw/openpic.c b/hw/openpic.c
index ccd4a14..26c96e2 100644
--- a/hw/openpic.c
+++ b/hw/openpic.c
@@ -1180,7 +1180,7 @@
         pci_register_bar(&opp->pci_dev, 0,
                          PCI_BASE_ADDRESS_SPACE_MEMORY, &opp->mem);
     } else {
-        opp = qemu_mallocz(sizeof(openpic_t));
+        opp = g_malloc0(sizeof(openpic_t));
         memory_region_init_io(&opp->mem, &openpic_ops, opp, "openpic", 0x40000);
     }
 
@@ -1644,7 +1644,7 @@
     if (nb_cpus != 1)
         return NULL;
 
-    mpp = qemu_mallocz(sizeof(openpic_t));
+    mpp = g_malloc0(sizeof(openpic_t));
 
     for (i = 0; i < sizeof(list)/sizeof(list[0]); i++) {
         int mem_index;
@@ -1676,6 +1676,6 @@
     return qemu_allocate_irqs(openpic_set_irq, mpp, mpp->max_irq);
 
 free:
-    qemu_free(mpp);
+    g_free(mpp);
     return NULL;
 }
diff --git a/hw/parallel.c b/hw/parallel.c
index cc853a5..71f30ea 100644
--- a/hw/parallel.c
+++ b/hw/parallel.c
@@ -565,7 +565,7 @@
     ParallelState *s;
     int io_sw;
 
-    s = qemu_mallocz(sizeof(ParallelState));
+    s = g_malloc0(sizeof(ParallelState));
     s->irq = irq;
     s->chr = chr;
     s->it_shift = it_shift;
diff --git a/hw/pc.c b/hw/pc.c
index 4b07b35..7be60a4 100644
--- a/hw/pc.c
+++ b/hw/pc.c
@@ -617,7 +617,7 @@
      * of nodes, one word for each VCPU->node and one word for each node to
      * hold the amount of memory.
      */
-    numa_fw_cfg = qemu_mallocz((1 + smp_cpus + nb_numa_nodes) * 8);
+    numa_fw_cfg = g_malloc0((1 + smp_cpus + nb_numa_nodes) * 8);
     numa_fw_cfg[0] = cpu_to_le64(nb_numa_nodes);
     for (i = 0; i < smp_cpus; i++) {
         for (j = 0; j < nb_numa_nodes; j++) {
@@ -788,7 +788,7 @@
 
         initrd_addr = (initrd_max-initrd_size) & ~4095;
 
-        initrd_data = qemu_malloc(initrd_size);
+        initrd_data = g_malloc(initrd_size);
         load_image(initrd_filename, initrd_data);
 
         fw_cfg_add_i32(fw_cfg, FW_CFG_INITRD_ADDR, initrd_addr);
@@ -806,8 +806,8 @@
     setup_size = (setup_size+1)*512;
     kernel_size -= setup_size;
 
-    setup  = qemu_malloc(setup_size);
-    kernel = qemu_malloc(kernel_size);
+    setup  = g_malloc(setup_size);
+    kernel = g_malloc(kernel_size);
     fseek(f, 0, SEEK_SET);
     if (fread(setup, 1, setup_size, f) != setup_size) {
         fprintf(stderr, "fread() failed\n");
@@ -978,15 +978,15 @@
      * aliases to address portions of it, mostly for backwards compatiblity
      * with older qemus that used qemu_ram_alloc().
      */
-    ram = qemu_malloc(sizeof(*ram));
+    ram = g_malloc(sizeof(*ram));
     memory_region_init_ram(ram, NULL, "pc.ram",
                            below_4g_mem_size + above_4g_mem_size);
-    ram_below_4g = qemu_malloc(sizeof(*ram_below_4g));
+    ram_below_4g = g_malloc(sizeof(*ram_below_4g));
     memory_region_init_alias(ram_below_4g, "ram-below-4g", ram,
                              0, below_4g_mem_size);
     memory_region_add_subregion(system_memory, 0, ram_below_4g);
     if (above_4g_mem_size > 0) {
-        ram_above_4g = qemu_malloc(sizeof(*ram_above_4g));
+        ram_above_4g = g_malloc(sizeof(*ram_above_4g));
         memory_region_init_alias(ram_above_4g, "ram-above-4g", ram,
                                  below_4g_mem_size, above_4g_mem_size);
         memory_region_add_subregion(system_memory, 0x100000000ULL,
@@ -1006,7 +1006,7 @@
         (bios_size % 65536) != 0) {
         goto bios_error;
     }
-    bios = qemu_malloc(sizeof(*bios));
+    bios = g_malloc(sizeof(*bios));
     memory_region_init_ram(bios, NULL, "pc.bios", bios_size);
     memory_region_set_readonly(bios, true);
     ret = rom_add_file_fixed(bios_name, (uint32_t)(-bios_size), -1);
@@ -1016,13 +1016,13 @@
         exit(1);
     }
     if (filename) {
-        qemu_free(filename);
+        g_free(filename);
     }
     /* map the last 128KB of the BIOS in ISA space */
     isa_bios_size = bios_size;
     if (isa_bios_size > (128 * 1024))
         isa_bios_size = 128 * 1024;
-    isa_bios = qemu_malloc(sizeof(*isa_bios));
+    isa_bios = g_malloc(sizeof(*isa_bios));
     memory_region_init_alias(isa_bios, "isa-bios", bios,
                              bios_size - isa_bios_size, isa_bios_size);
     memory_region_add_subregion_overlap(system_memory,
@@ -1031,7 +1031,7 @@
                                         1);
     memory_region_set_readonly(isa_bios, true);
 
-    option_rom_mr = qemu_malloc(sizeof(*option_rom_mr));
+    option_rom_mr = g_malloc(sizeof(*option_rom_mr));
     memory_region_init_ram(option_rom_mr, NULL, "pc.rom", PC_ROM_SIZE);
     memory_region_add_subregion_overlap(system_memory,
                                         PC_ROM_MIN_VGA,
diff --git a/hw/pc_piix.c b/hw/pc_piix.c
index 7dd5008..a9fe596 100644
--- a/hw/pc_piix.c
+++ b/hw/pc_piix.c
@@ -121,7 +121,7 @@
     } else {
         i8259 = xen_interrupt_controller_init();
     }
-    isa_irq_state = qemu_mallocz(sizeof(*isa_irq_state));
+    isa_irq_state = g_malloc0(sizeof(*isa_irq_state));
     isa_irq_state->i8259 = i8259;
     if (pci_enabled) {
         ioapic_init(isa_irq_state);
diff --git a/hw/pci.c b/hw/pci.c
index dc7271a..4dc13d2 100644
--- a/hw/pci.c
+++ b/hw/pci.c
@@ -223,7 +223,7 @@
 static void pci_host_bus_register(int domain, PCIBus *bus)
 {
     struct PCIHostBus *host;
-    host = qemu_mallocz(sizeof(*host));
+    host = g_malloc0(sizeof(*host));
     host->domain = domain;
     host->bus = bus;
     QLIST_INSERT_HEAD(&host_buses, host, next);
@@ -288,7 +288,7 @@
 {
     PCIBus *bus;
 
-    bus = qemu_mallocz(sizeof(*bus));
+    bus = g_malloc0(sizeof(*bus));
     bus->qbus.qdev_allocated = 1;
     pci_bus_new_inplace(bus, parent, name, address_space_mem,
                         address_space_io, devfn_min);
@@ -302,7 +302,7 @@
     bus->map_irq = map_irq;
     bus->irq_opaque = irq_opaque;
     bus->nirq = nirq;
-    bus->irq_count = qemu_mallocz(nirq * sizeof(bus->irq_count[0]));
+    bus->irq_count = g_malloc0(nirq * sizeof(bus->irq_count[0]));
 }
 
 void pci_bus_hotplug(PCIBus *bus, pci_hotplug_fn hotplug, DeviceState *qdev)
@@ -346,13 +346,13 @@
     int i;
 
     assert(size == pci_config_size(s));
-    config = qemu_malloc(size);
+    config = g_malloc(size);
 
     qemu_get_buffer(f, config, size);
     for (i = 0; i < size; ++i) {
         if ((config[i] ^ s->config[i]) &
             s->cmask[i] & ~s->wmask[i] & ~s->w1cmask[i]) {
-            qemu_free(config);
+            g_free(config);
             return -EINVAL;
         }
     }
@@ -360,7 +360,7 @@
 
     pci_update_mappings(s);
 
-    qemu_free(config);
+    g_free(config);
     return 0;
 }
 
@@ -720,20 +720,20 @@
 {
     int config_size = pci_config_size(pci_dev);
 
-    pci_dev->config = qemu_mallocz(config_size);
-    pci_dev->cmask = qemu_mallocz(config_size);
-    pci_dev->wmask = qemu_mallocz(config_size);
-    pci_dev->w1cmask = qemu_mallocz(config_size);
-    pci_dev->used = qemu_mallocz(config_size);
+    pci_dev->config = g_malloc0(config_size);
+    pci_dev->cmask = g_malloc0(config_size);
+    pci_dev->wmask = g_malloc0(config_size);
+    pci_dev->w1cmask = g_malloc0(config_size);
+    pci_dev->used = g_malloc0(config_size);
 }
 
 static void pci_config_free(PCIDevice *pci_dev)
 {
-    qemu_free(pci_dev->config);
-    qemu_free(pci_dev->cmask);
-    qemu_free(pci_dev->wmask);
-    qemu_free(pci_dev->w1cmask);
-    qemu_free(pci_dev->used);
+    g_free(pci_dev->config);
+    g_free(pci_dev->cmask);
+    g_free(pci_dev->wmask);
+    g_free(pci_dev->w1cmask);
+    g_free(pci_dev->used);
 }
 
 /* -1 for devfn means auto assign */
@@ -825,7 +825,7 @@
         .config_write = config_write,
     };
 
-    pci_dev = qemu_mallocz(instance_size);
+    pci_dev = g_malloc0(instance_size);
     pci_dev = do_pci_register_device(pci_dev, bus, name, devfn, &info);
     if (pci_dev == NULL) {
         hw_error("PCI: can't register device\n");
@@ -865,7 +865,7 @@
 
     pci_unregister_io_regions(pci_dev);
     pci_del_option_rom(pci_dev);
-    qemu_free(pci_dev->romfile);
+    g_free(pci_dev->romfile);
     do_pci_unregister_device(pci_dev);
     return 0;
 }
@@ -1680,7 +1680,7 @@
     /* rom loading */
     is_default_rom = false;
     if (pci_dev->romfile == NULL && info->romfile != NULL) {
-        pci_dev->romfile = qemu_strdup(info->romfile);
+        pci_dev->romfile = g_strdup(info->romfile);
         is_default_rom = true;
     }
     pci_add_option_rom(pci_dev, is_default_rom);
@@ -1896,14 +1896,14 @@
 
     path = qemu_find_file(QEMU_FILE_TYPE_BIOS, pdev->romfile);
     if (path == NULL) {
-        path = qemu_strdup(pdev->romfile);
+        path = g_strdup(pdev->romfile);
     }
 
     size = get_image_size(path);
     if (size < 0) {
         error_report("%s: failed to find romfile \"%s\"",
                      __FUNCTION__, pdev->romfile);
-        qemu_free(path);
+        g_free(path);
         return -1;
     }
     if (size & (size - 1)) {
@@ -1918,7 +1918,7 @@
     memory_region_init_ram(&pdev->rom, &pdev->qdev, name, size);
     ptr = memory_region_get_ram_ptr(&pdev->rom);
     load_image(path, ptr);
-    qemu_free(path);
+    g_free(path);
 
     if (is_default_rom) {
         /* Only the default rom images will be patched (if needed). */
@@ -2108,7 +2108,7 @@
     path_len = domain_len + slot_len * slot_depth;
 
     /* Allocate memory, fill in the terminating null byte. */
-    path = qemu_malloc(path_len + 1 /* For '\0' */);
+    path = g_malloc(path_len + 1 /* For '\0' */);
     path[path_len] = '\0';
 
     /* First field is the domain. */
diff --git a/hw/pcie_aer.c b/hw/pcie_aer.c
index be019c7..2ae65ec 100644
--- a/hw/pcie_aer.c
+++ b/hw/pcie_aer.c
@@ -111,7 +111,7 @@
     if (dev->exp.aer_log.log_max > PCIE_AER_LOG_MAX_LIMIT) {
         return -EINVAL;
     }
-    dev->exp.aer_log.log = qemu_mallocz(sizeof dev->exp.aer_log.log[0] *
+    dev->exp.aer_log.log = g_malloc0(sizeof dev->exp.aer_log.log[0] *
                                         dev->exp.aer_log.log_max);
 
     pci_set_long(dev->w1cmask + offset + PCI_ERR_UNCOR_STATUS,
@@ -165,7 +165,7 @@
 
 void pcie_aer_exit(PCIDevice *dev)
 {
-    qemu_free(dev->exp.aer_log.log);
+    g_free(dev->exp.aer_log.log);
 }
 
 static void pcie_aer_update_uncor_status(PCIDevice *dev)
diff --git a/hw/pcie_port.c b/hw/pcie_port.c
index 340dcdb..8a36f5c 100644
--- a/hw/pcie_port.c
+++ b/hw/pcie_port.c
@@ -76,7 +76,7 @@
     if (c) {
         return;
     }
-    c = qemu_mallocz(sizeof(*c));
+    c = g_malloc0(sizeof(*c));
     c->number = chassis_number;
     QLIST_INIT(&c->slots);
     QLIST_INSERT_HEAD(&chassis, c, next);
diff --git a/hw/pckbd.c b/hw/pckbd.c
index ae65c04..a272ccd 100644
--- a/hw/pckbd.c
+++ b/hw/pckbd.c
@@ -416,7 +416,7 @@
                    target_phys_addr_t base, ram_addr_t size,
                    target_phys_addr_t mask)
 {
-    KBDState *s = qemu_mallocz(sizeof(KBDState));
+    KBDState *s = g_malloc0(sizeof(KBDState));
     int s_io_memory;
 
     s->irq_kbd = kbd_irq;
diff --git a/hw/petalogix_ml605_mmu.c b/hw/petalogix_ml605_mmu.c
index 8213902..e3a66e5 100644
--- a/hw/petalogix_ml605_mmu.c
+++ b/hw/petalogix_ml605_mmu.c
@@ -88,7 +88,7 @@
         path = qemu_find_file(QEMU_FILE_TYPE_BIOS, BINARY_DEVICE_TREE_FILE);
         if (path) {
             fdt = load_device_tree(path, &fdt_size);
-            qemu_free(path);
+            g_free(path);
         }
         if (!fdt) {
             return 0;
@@ -108,7 +108,7 @@
         path = qemu_find_file(QEMU_FILE_TYPE_BIOS, BINARY_DEVICE_TREE_FILE);
         if (path) {
             fdt_size = load_image_targphys(path, addr, 0x10000);
-            qemu_free(path);
+            g_free(path);
         }
     }
 
diff --git a/hw/petalogix_s3adsp1800_mmu.c b/hw/petalogix_s3adsp1800_mmu.c
index 4dcdfbd..589e8ca 100644
--- a/hw/petalogix_s3adsp1800_mmu.c
+++ b/hw/petalogix_s3adsp1800_mmu.c
@@ -75,7 +75,7 @@
         path = qemu_find_file(QEMU_FILE_TYPE_BIOS, BINARY_DEVICE_TREE_FILE);
         if (path) {
             fdt = load_device_tree(path, &fdt_size);
-            qemu_free(path);
+            g_free(path);
         }
         if (!fdt)
             return 0;
@@ -93,7 +93,7 @@
         path = qemu_find_file(QEMU_FILE_TYPE_BIOS, BINARY_DEVICE_TREE_FILE);
         if (path) {
             fdt_size = load_image_targphys(path, addr, 0x10000);
-	    qemu_free(path);
+	    g_free(path);
         }
     }
 
diff --git a/hw/pflash_cfi01.c b/hw/pflash_cfi01.c
index 90fdc84..90e1301 100644
--- a/hw/pflash_cfi01.c
+++ b/hw/pflash_cfi01.c
@@ -594,7 +594,7 @@
         return NULL;
 #endif
 
-    pfl = qemu_mallocz(sizeof(pflash_t));
+    pfl = g_malloc0(sizeof(pflash_t));
 
     /* FIXME: Allocate ram ourselves.  */
     pfl->storage = qemu_get_ram_ptr(off);
@@ -617,7 +617,7 @@
         ret = bdrv_read(pfl->bs, 0, pfl->storage, total_len >> 9);
         if (ret < 0) {
             cpu_unregister_io_memory(pfl->fl_mem);
-            qemu_free(pfl);
+            g_free(pfl);
             return NULL;
         }
     }
diff --git a/hw/pflash_cfi02.c b/hw/pflash_cfi02.c
index 725cd1e..ac5115e 100644
--- a/hw/pflash_cfi02.c
+++ b/hw/pflash_cfi02.c
@@ -617,7 +617,7 @@
         total_len != (32 * 1024 * 1024) && total_len != (64 * 1024 * 1024))
         return NULL;
 #endif
-    pfl = qemu_mallocz(sizeof(pflash_t));
+    pfl = g_malloc0(sizeof(pflash_t));
     /* FIXME: Allocate ram ourselves.  */
     pfl->storage = qemu_get_ram_ptr(off);
     if (be) {
@@ -640,7 +640,7 @@
         ret = bdrv_read(pfl->bs, 0, pfl->storage, chip_len >> 9);
         if (ret < 0) {
             cpu_unregister_io_memory(pfl->fl_mem);
-            qemu_free(pfl);
+            g_free(pfl);
             return NULL;
         }
     }
diff --git a/hw/ppc.c b/hw/ppc.c
index 9157719..8870748 100644
--- a/hw/ppc.c
+++ b/hw/ppc.c
@@ -761,7 +761,7 @@
 {
     ppc_tb_t *tb_env;
 
-    tb_env = qemu_mallocz(sizeof(ppc_tb_t));
+    tb_env = g_malloc0(sizeof(ppc_tb_t));
     env->tb_env = tb_env;
     /* Create new timer */
     tb_env->decr_timer = qemu_new_timer_ns(vm_clock, &cpu_ppc_decr_cb, env);
@@ -1038,9 +1038,9 @@
     ppc_tb_t *tb_env;
     ppcemb_timer_t *ppcemb_timer;
 
-    tb_env = qemu_mallocz(sizeof(ppc_tb_t));
+    tb_env = g_malloc0(sizeof(ppc_tb_t));
     env->tb_env = tb_env;
-    ppcemb_timer = qemu_mallocz(sizeof(ppcemb_timer_t));
+    ppcemb_timer = g_malloc0(sizeof(ppcemb_timer_t));
     tb_env->tb_freq = freq;
     tb_env->decr_freq = freq;
     tb_env->opaque = ppcemb_timer;
@@ -1145,7 +1145,7 @@
 {
     ppc_dcr_t *dcr_env;
 
-    dcr_env = qemu_mallocz(sizeof(ppc_dcr_t));
+    dcr_env = g_malloc0(sizeof(ppc_dcr_t));
     dcr_env->read_error = read_error;
     dcr_env->write_error = write_error;
     env->dcr_env = dcr_env;
diff --git a/hw/ppc405_boards.c b/hw/ppc405_boards.c
index ad27181..34f9350 100644
--- a/hw/ppc405_boards.c
+++ b/hw/ppc405_boards.c
@@ -162,7 +162,7 @@
     ref405ep_fpga_t *fpga;
     int fpga_memory;
 
-    fpga = qemu_mallocz(sizeof(ref405ep_fpga_t));
+    fpga = g_malloc0(sizeof(ref405ep_fpga_t));
     fpga_memory = cpu_register_io_memory(ref405ep_fpga_read,
                                          ref405ep_fpga_write, fpga,
                                          DEVICE_NATIVE_ENDIAN);
@@ -246,7 +246,7 @@
         filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, bios_name);
         if (filename) {
             bios_size = load_image(filename, qemu_get_ram_ptr(bios_offset));
-            qemu_free(filename);
+            g_free(filename);
         } else {
             bios_size = -1;
         }
@@ -487,7 +487,7 @@
     taihu_cpld_t *cpld;
     int cpld_memory;
 
-    cpld = qemu_mallocz(sizeof(taihu_cpld_t));
+    cpld = g_malloc0(sizeof(taihu_cpld_t));
     cpld_memory = cpu_register_io_memory(taihu_cpld_read,
                                          taihu_cpld_write, cpld,
                                          DEVICE_NATIVE_ENDIAN);
@@ -560,7 +560,7 @@
         filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, bios_name);
         if (filename) {
             bios_size = load_image(filename, qemu_get_ram_ptr(bios_offset));
-            qemu_free(filename);
+            g_free(filename);
         } else {
             bios_size = -1;
         }
diff --git a/hw/ppc405_uc.c b/hw/ppc405_uc.c
index 06a053b..68c7cbd 100644
--- a/hw/ppc405_uc.c
+++ b/hw/ppc405_uc.c
@@ -172,7 +172,7 @@
 {
     ppc4xx_plb_t *plb;
 
-    plb = qemu_mallocz(sizeof(ppc4xx_plb_t));
+    plb = g_malloc0(sizeof(ppc4xx_plb_t));
     ppc_dcr_register(env, PLB0_ACR, plb, &dcr_read_plb, &dcr_write_plb);
     ppc_dcr_register(env, PLB0_BEAR, plb, &dcr_read_plb, &dcr_write_plb);
     ppc_dcr_register(env, PLB0_BESR, plb, &dcr_read_plb, &dcr_write_plb);
@@ -248,7 +248,7 @@
 {
     ppc4xx_pob_t *pob;
 
-    pob = qemu_mallocz(sizeof(ppc4xx_pob_t));
+    pob = g_malloc0(sizeof(ppc4xx_pob_t));
     ppc_dcr_register(env, POB0_BEAR, pob, &dcr_read_pob, &dcr_write_pob);
     ppc_dcr_register(env, POB0_BESR0, pob, &dcr_read_pob, &dcr_write_pob);
     ppc_dcr_register(env, POB0_BESR1, pob, &dcr_read_pob, &dcr_write_pob);
@@ -383,7 +383,7 @@
     ppc4xx_opba_t *opba;
     int io;
 
-    opba = qemu_mallocz(sizeof(ppc4xx_opba_t));
+    opba = g_malloc0(sizeof(ppc4xx_opba_t));
 #ifdef DEBUG_OPBA
     printf("%s: offset " TARGET_FMT_plx "\n", __func__, base);
 #endif
@@ -582,7 +582,7 @@
 {
     ppc4xx_ebc_t *ebc;
 
-    ebc = qemu_mallocz(sizeof(ppc4xx_ebc_t));
+    ebc = g_malloc0(sizeof(ppc4xx_ebc_t));
     qemu_register_reset(&ebc_reset, ebc);
     ppc_dcr_register(env, EBC0_CFGADDR,
                      ebc, &dcr_read_ebc, &dcr_write_ebc);
@@ -665,7 +665,7 @@
 {
     ppc405_dma_t *dma;
 
-    dma = qemu_mallocz(sizeof(ppc405_dma_t));
+    dma = g_malloc0(sizeof(ppc405_dma_t));
     memcpy(dma->irqs, irqs, 4 * sizeof(qemu_irq));
     qemu_register_reset(&ppc405_dma_reset, dma);
     ppc_dcr_register(env, DMA0_CR0,
@@ -810,7 +810,7 @@
     ppc405_gpio_t *gpio;
     int io;
 
-    gpio = qemu_mallocz(sizeof(ppc405_gpio_t));
+    gpio = g_malloc0(sizeof(ppc405_gpio_t));
 #ifdef DEBUG_GPIO
     printf("%s: offset " TARGET_FMT_plx "\n", __func__, base);
 #endif
@@ -972,7 +972,7 @@
 {
     ppc405_ocm_t *ocm;
 
-    ocm = qemu_mallocz(sizeof(ppc405_ocm_t));
+    ocm = g_malloc0(sizeof(ppc405_ocm_t));
     ocm->offset = qemu_ram_alloc(NULL, "ppc405.ocm", 4096);
     qemu_register_reset(&ocm_reset, ocm);
     ppc_dcr_register(env, OCM0_ISARC,
@@ -1219,7 +1219,7 @@
     ppc4xx_i2c_t *i2c;
     int io;
 
-    i2c = qemu_mallocz(sizeof(ppc4xx_i2c_t));
+    i2c = g_malloc0(sizeof(ppc4xx_i2c_t));
     i2c->irq = irq;
 #ifdef DEBUG_I2C
     printf("%s: offset " TARGET_FMT_plx "\n", __func__, base);
@@ -1500,7 +1500,7 @@
     int i;
     int io;
 
-    gpt = qemu_mallocz(sizeof(ppc4xx_gpt_t));
+    gpt = g_malloc0(sizeof(ppc4xx_gpt_t));
     for (i = 0; i < 5; i++) {
         gpt->irqs[i] = irqs[i];
     }
@@ -1731,7 +1731,7 @@
     ppc40x_mal_t *mal;
     int i;
 
-    mal = qemu_mallocz(sizeof(ppc40x_mal_t));
+    mal = g_malloc0(sizeof(ppc40x_mal_t));
     for (i = 0; i < 4; i++)
         mal->irqs[i] = irqs[i];
     qemu_register_reset(&ppc40x_mal_reset, mal);
@@ -2096,7 +2096,7 @@
 {
     ppc405cr_cpc_t *cpc;
 
-    cpc = qemu_mallocz(sizeof(ppc405cr_cpc_t));
+    cpc = g_malloc0(sizeof(ppc405cr_cpc_t));
     memcpy(cpc->clk_setup, clk_setup,
            PPC405CR_CLK_NB * sizeof(clk_setup_t));
     cpc->sysclk = sysclk;
@@ -2142,7 +2142,7 @@
     /* OBP arbitrer */
     ppc4xx_opba_init(0xef600600);
     /* Universal interrupt controller */
-    irqs = qemu_mallocz(sizeof(qemu_irq) * PPCUIC_OUTPUT_NB);
+    irqs = g_malloc0(sizeof(qemu_irq) * PPCUIC_OUTPUT_NB);
     irqs[PPCUIC_OUTPUT_INT] =
         ((qemu_irq *)env->irq_inputs)[PPC40x_INPUT_INT];
     irqs[PPCUIC_OUTPUT_CINT] =
@@ -2433,7 +2433,7 @@
 {
     ppc405ep_cpc_t *cpc;
 
-    cpc = qemu_mallocz(sizeof(ppc405ep_cpc_t));
+    cpc = g_malloc0(sizeof(ppc405ep_cpc_t));
     memcpy(cpc->clk_setup, clk_setup,
            PPC405EP_CLK_NB * sizeof(clk_setup_t));
     cpc->jtagid = 0x20267049;
@@ -2490,7 +2490,7 @@
     /* OBP arbitrer */
     ppc4xx_opba_init(0xef600600);
     /* Universal interrupt controller */
-    irqs = qemu_mallocz(sizeof(qemu_irq) * PPCUIC_OUTPUT_NB);
+    irqs = g_malloc0(sizeof(qemu_irq) * PPCUIC_OUTPUT_NB);
     irqs[PPCUIC_OUTPUT_INT] =
         ((qemu_irq *)env->irq_inputs)[PPC40x_INPUT_INT];
     irqs[PPCUIC_OUTPUT_CINT] =
diff --git a/hw/ppc440.c b/hw/ppc440.c
index 90abc91..baf991f 100644
--- a/hw/ppc440.c
+++ b/hw/ppc440.c
@@ -57,7 +57,7 @@
     ppc_dcr_init(env, NULL, NULL);
 
     /* interrupt controller */
-    irqs = qemu_mallocz(sizeof(qemu_irq) * PPCUIC_OUTPUT_NB);
+    irqs = g_malloc0(sizeof(qemu_irq) * PPCUIC_OUTPUT_NB);
     irqs[PPCUIC_OUTPUT_INT] = ((qemu_irq *)env->irq_inputs)[PPC40x_INPUT_INT];
     irqs[PPCUIC_OUTPUT_CINT] = ((qemu_irq *)env->irq_inputs)[PPC40x_INPUT_CINT];
     pic = ppcuic_init(env, irqs, 0x0C0, 0, 1);
@@ -73,7 +73,7 @@
                       ram_sizes, do_init);
 
     /* PCI */
-    pci_irqs = qemu_malloc(sizeof(qemu_irq) * 4);
+    pci_irqs = g_malloc(sizeof(qemu_irq) * 4);
     pci_irqs[0] = pic[pci_irq_nrs[0]];
     pci_irqs[1] = pic[pci_irq_nrs[1]];
     pci_irqs[2] = pic[pci_irq_nrs[2]];
diff --git a/hw/ppc440_bamboo.c b/hw/ppc440_bamboo.c
index 20b8629..1addb68 100644
--- a/hw/ppc440_bamboo.c
+++ b/hw/ppc440_bamboo.c
@@ -49,7 +49,7 @@
         goto out;
     }
     fdt = load_device_tree(filename, &fdt_size);
-    qemu_free(filename);
+    g_free(filename);
     if (fdt == NULL) {
         goto out;
     }
@@ -80,7 +80,7 @@
         kvmppc_fdt_update(fdt);
 
     ret = rom_add_blob_fixed(BINARY_DEVICE_TREE_FILE, fdt, fdt_size, addr);
-    qemu_free(fdt);
+    g_free(fdt);
 
 out:
 #endif
diff --git a/hw/ppc4xx_devs.c b/hw/ppc4xx_devs.c
index 68bdfaa..1af5f2e 100644
--- a/hw/ppc4xx_devs.c
+++ b/hw/ppc4xx_devs.c
@@ -293,7 +293,7 @@
     ppcuic_t *uic;
     int i;
 
-    uic = qemu_mallocz(sizeof(ppcuic_t));
+    uic = g_malloc0(sizeof(ppcuic_t));
     uic->dcr_base = dcr_base;
     uic->irqs = irqs;
     if (has_vr)
@@ -627,7 +627,7 @@
 {
     ppc4xx_sdram_t *sdram;
 
-    sdram = qemu_mallocz(sizeof(ppc4xx_sdram_t));
+    sdram = g_malloc0(sizeof(ppc4xx_sdram_t));
     sdram->irq = irq;
     sdram->nbanks = nbanks;
     memset(sdram->ram_bases, 0, 4 * sizeof(target_phys_addr_t));
diff --git a/hw/ppc4xx_pci.c b/hw/ppc4xx_pci.c
index c7696b0..52e2663 100644
--- a/hw/ppc4xx_pci.c
+++ b/hw/ppc4xx_pci.c
@@ -341,7 +341,7 @@
     static int ppc4xx_pci_id;
     uint8_t *pci_conf;
 
-    controller = qemu_mallocz(sizeof(PPC4xxPCIState));
+    controller = g_malloc0(sizeof(PPC4xxPCIState));
 
     controller->pci_state.bus = pci_register_bus(NULL, "pci",
                                                  ppc4xx_pci_set_irq,
@@ -390,6 +390,6 @@
 
 free:
     printf("%s error\n", __func__);
-    qemu_free(controller);
+    g_free(controller);
     return NULL;
 }
diff --git a/hw/ppc_newworld.c b/hw/ppc_newworld.c
index 3039022..4727e07 100644
--- a/hw/ppc_newworld.c
+++ b/hw/ppc_newworld.c
@@ -189,7 +189,7 @@
         bios_size = load_elf(filename, NULL, NULL, NULL,
                              NULL, NULL, 1, ELF_MACHINE, 0);
 
-        qemu_free(filename);
+        g_free(filename);
     } else {
         bios_size = -1;
     }
@@ -271,9 +271,9 @@
                                          DEVICE_NATIVE_ENDIAN);
     cpu_register_physical_memory(0xf8000000, 0x00001000, unin_memory);
 
-    openpic_irqs = qemu_mallocz(smp_cpus * sizeof(qemu_irq *));
+    openpic_irqs = g_malloc0(smp_cpus * sizeof(qemu_irq *));
     openpic_irqs[0] =
-        qemu_mallocz(smp_cpus * sizeof(qemu_irq) * OPENPIC_OUTPUT_NB);
+        g_malloc0(smp_cpus * sizeof(qemu_irq) * OPENPIC_OUTPUT_NB);
     for (i = 0; i < smp_cpus; i++) {
         /* Mac99 IRQ connection between OpenPIC outputs pins
          * and PowerPC input pins
@@ -398,7 +398,7 @@
         uint8_t *hypercall;
 
         fw_cfg_add_i32(fw_cfg, FW_CFG_PPC_TBFREQ, kvmppc_get_tbfreq());
-        hypercall = qemu_malloc(16);
+        hypercall = g_malloc(16);
         kvmppc_get_hypercall(env, hypercall, 16);
         fw_cfg_add_bytes(fw_cfg, FW_CFG_PPC_KVM_HC, hypercall, 16);
         fw_cfg_add_i32(fw_cfg, FW_CFG_PPC_KVM_PID, getpid());
diff --git a/hw/ppc_oldworld.c b/hw/ppc_oldworld.c
index 41703a7..0071fc9 100644
--- a/hw/ppc_oldworld.c
+++ b/hw/ppc_oldworld.c
@@ -127,7 +127,7 @@
     if (filename) {
         bios_size = load_elf(filename, 0, NULL, NULL, NULL, NULL,
                              1, ELF_MACHINE, 0);
-        qemu_free(filename);
+        g_free(filename);
     } else {
         bios_size = -1;
     }
@@ -213,9 +213,9 @@
     isa_mmio_init(0xfe000000, 0x00200000);
 
     /* XXX: we register only 1 output pin for heathrow PIC */
-    heathrow_irqs = qemu_mallocz(smp_cpus * sizeof(qemu_irq *));
+    heathrow_irqs = g_malloc0(smp_cpus * sizeof(qemu_irq *));
     heathrow_irqs[0] =
-        qemu_mallocz(smp_cpus * sizeof(qemu_irq) * 1);
+        g_malloc0(smp_cpus * sizeof(qemu_irq) * 1);
     /* Connect the heathrow PIC outputs to the 6xx bus */
     for (i = 0; i < smp_cpus; i++) {
         switch (PPC_INPUT(env)) {
@@ -306,7 +306,7 @@
         uint8_t *hypercall;
 
         fw_cfg_add_i32(fw_cfg, FW_CFG_PPC_TBFREQ, kvmppc_get_tbfreq());
-        hypercall = qemu_malloc(16);
+        hypercall = g_malloc(16);
         kvmppc_get_hypercall(env, hypercall, 16);
         fw_cfg_add_bytes(fw_cfg, FW_CFG_PPC_KVM_HC, hypercall, 16);
         fw_cfg_add_i32(fw_cfg, FW_CFG_PPC_KVM_PID, getpid());
diff --git a/hw/ppc_prep.c b/hw/ppc_prep.c
index 38d8573..515de42 100644
--- a/hw/ppc_prep.c
+++ b/hw/ppc_prep.c
@@ -550,7 +550,7 @@
     DriveInfo *hd[MAX_IDE_BUS * MAX_IDE_DEVS];
     DriveInfo *fd[MAX_FD];
 
-    sysctrl = qemu_mallocz(sizeof(sysctrl_t));
+    sysctrl = g_malloc0(sizeof(sysctrl_t));
 
     linux_boot = (kernel_filename != NULL);
 
@@ -599,7 +599,7 @@
         hw_error("qemu: could not load PPC PREP bios '%s'\n", bios_name);
     }
     if (filename) {
-        qemu_free(filename);
+        g_free(filename);
     }
 
     if (linux_boot) {
@@ -673,7 +673,7 @@
         nb_nics1 = NE2000_NB_MAX;
     for(i = 0; i < nb_nics1; i++) {
         if (nd_table[i].model == NULL) {
-	    nd_table[i].model = qemu_strdup("ne2k_isa");
+	    nd_table[i].model = g_strdup("ne2k_isa");
         }
         if (strcmp(nd_table[i].model, "ne2k_isa") == 0) {
             isa_ne2000_init(ne2000_io[i], ne2000_irq[i], &nd_table[i]);
diff --git a/hw/ppce500_mpc8544ds.c b/hw/ppce500_mpc8544ds.c
index b739ce2..1274a3e 100644
--- a/hw/ppce500_mpc8544ds.c
+++ b/hw/ppce500_mpc8544ds.c
@@ -102,7 +102,7 @@
         goto out;
     }
     fdt = load_device_tree(filename, &fdt_size);
-    qemu_free(filename);
+    g_free(filename);
     if (fdt == NULL) {
         goto out;
     }
@@ -176,7 +176,7 @@
     }
 
     ret = rom_add_blob_fixed(BINARY_DEVICE_TREE_FILE, fdt, fdt_size, addr);
-    qemu_free(fdt);
+    g_free(fdt);
 
 out:
 #endif
@@ -267,7 +267,7 @@
                                  "mpc8544ds.ram", ram_size));
 
     /* MPIC */
-    irqs = qemu_mallocz(sizeof(qemu_irq) * OPENPIC_OUTPUT_NB);
+    irqs = g_malloc0(sizeof(qemu_irq) * OPENPIC_OUTPUT_NB);
     irqs[OPENPIC_OUTPUT_INT] = ((qemu_irq *)env->irq_inputs)[PPCE500_INPUT_INT];
     irqs[OPENPIC_OUTPUT_CINT] = ((qemu_irq *)env->irq_inputs)[PPCE500_INPUT_CINT];
     mpic = mpic_init(MPC8544_MPIC_REGS_BASE, 1, &irqs, NULL);
@@ -336,7 +336,7 @@
         }
     }
 
-    boot_info = qemu_mallocz(sizeof(struct boot_info));
+    boot_info = g_malloc0(sizeof(struct boot_info));
 
     /* If we're loading a kernel directly, we must load the device tree too. */
     if (kernel_filename) {
diff --git a/hw/prep_pci.c b/hw/prep_pci.c
index 58619dd..c36232a 100644
--- a/hw/prep_pci.c
+++ b/hw/prep_pci.c
@@ -118,7 +118,7 @@
     PCIDevice *d;
     int PPC_io_memory;
 
-    s = qemu_mallocz(sizeof(PREPPCIState));
+    s = g_malloc0(sizeof(PREPPCIState));
     s->bus = pci_register_bus(NULL, "pci",
                               prep_set_irq, prep_map_irq, pic,
                               address_space_mem,
diff --git a/hw/ps2.c b/hw/ps2.c
index 91b73e0..24228c1 100644
--- a/hw/ps2.c
+++ b/hw/ps2.c
@@ -604,7 +604,7 @@
 
 void *ps2_kbd_init(void (*update_irq)(void *, int), void *update_arg)
 {
-    PS2KbdState *s = (PS2KbdState *)qemu_mallocz(sizeof(PS2KbdState));
+    PS2KbdState *s = (PS2KbdState *)g_malloc0(sizeof(PS2KbdState));
 
     s->common.update_irq = update_irq;
     s->common.update_arg = update_arg;
@@ -617,7 +617,7 @@
 
 void *ps2_mouse_init(void (*update_irq)(void *, int), void *update_arg)
 {
-    PS2MouseState *s = (PS2MouseState *)qemu_mallocz(sizeof(PS2MouseState));
+    PS2MouseState *s = (PS2MouseState *)g_malloc0(sizeof(PS2MouseState));
 
     s->common.update_irq = update_irq;
     s->common.update_arg = update_arg;
diff --git a/hw/ptimer.c b/hw/ptimer.c
index 6f13ce9..b6cabd5 100644
--- a/hw/ptimer.c
+++ b/hw/ptimer.c
@@ -210,7 +210,7 @@
 {
     ptimer_state *s;
 
-    s = (ptimer_state *)qemu_mallocz(sizeof(ptimer_state));
+    s = (ptimer_state *)g_malloc0(sizeof(ptimer_state));
     s->bh = bh;
     s->timer = qemu_new_timer_ns(vm_clock, ptimer_tick, s);
     return s;
diff --git a/hw/pxa2xx.c b/hw/pxa2xx.c
index cf93110..d00edc6 100644
--- a/hw/pxa2xx.c
+++ b/hw/pxa2xx.c
@@ -1764,7 +1764,7 @@
 {
     int iomemtype;
     PXA2xxI2SState *s = (PXA2xxI2SState *)
-            qemu_mallocz(sizeof(PXA2xxI2SState));
+            g_malloc0(sizeof(PXA2xxI2SState));
 
     s->irq = irq;
     s->rx_dma = rx_dma;
@@ -2025,7 +2025,7 @@
 {
     int iomemtype;
     PXA2xxFIrState *s = (PXA2xxFIrState *)
-            qemu_mallocz(sizeof(PXA2xxFIrState));
+            g_malloc0(sizeof(PXA2xxFIrState));
 
     s->irq = irq;
     s->rx_dma = rx_dma;
@@ -2064,7 +2064,7 @@
     PXA2xxState *s;
     int iomemtype, i;
     DriveInfo *dinfo;
-    s = (PXA2xxState *) qemu_mallocz(sizeof(PXA2xxState));
+    s = (PXA2xxState *) g_malloc0(sizeof(PXA2xxState));
 
     if (revision && strncmp(revision, "pxa27", 5)) {
         fprintf(stderr, "Machine requires a PXA27x processor.\n");
@@ -2162,7 +2162,7 @@
     vmstate_register(NULL, 0, &vmstate_pxa2xx_pm, s);
 
     for (i = 0; pxa27x_ssp[i].io_base; i ++);
-    s->ssp = (SSIBus **)qemu_mallocz(sizeof(SSIBus *) * i);
+    s->ssp = (SSIBus **)g_malloc0(sizeof(SSIBus *) * i);
     for (i = 0; pxa27x_ssp[i].io_base; i ++) {
         DeviceState *dev;
         dev = sysbus_create_simple("pxa2xx-ssp", pxa27x_ssp[i].io_base,
@@ -2207,7 +2207,7 @@
     int iomemtype, i;
     DriveInfo *dinfo;
 
-    s = (PXA2xxState *) qemu_mallocz(sizeof(PXA2xxState));
+    s = (PXA2xxState *) g_malloc0(sizeof(PXA2xxState));
 
     s->env = cpu_init("pxa255");
     if (!s->env) {
@@ -2298,7 +2298,7 @@
     vmstate_register(NULL, 0, &vmstate_pxa2xx_pm, s);
 
     for (i = 0; pxa255_ssp[i].io_base; i ++);
-    s->ssp = (SSIBus **)qemu_mallocz(sizeof(SSIBus *) * i);
+    s->ssp = (SSIBus **)g_malloc0(sizeof(SSIBus *) * i);
     for (i = 0; pxa255_ssp[i].io_base; i ++) {
         DeviceState *dev;
         dev = sysbus_create_simple("pxa2xx-ssp", pxa255_ssp[i].io_base,
diff --git a/hw/pxa2xx_dma.c b/hw/pxa2xx_dma.c
index 599581e..07ec2db 100644
--- a/hw/pxa2xx_dma.c
+++ b/hw/pxa2xx_dma.c
@@ -461,7 +461,7 @@
         return -1;
     }
 
-    s->chan = qemu_mallocz(sizeof(PXA2xxDMAChannel) * s->channels);
+    s->chan = g_malloc0(sizeof(PXA2xxDMAChannel) * s->channels);
 
     memset(s->chan, 0, sizeof(PXA2xxDMAChannel) * s->channels);
     for (i = 0; i < s->channels; i ++)
diff --git a/hw/pxa2xx_keypad.c b/hw/pxa2xx_keypad.c
index 10ef154..e33959d 100644
--- a/hw/pxa2xx_keypad.c
+++ b/hw/pxa2xx_keypad.c
@@ -312,7 +312,7 @@
     int iomemtype;
     PXA2xxKeyPadState *s;
 
-    s = (PXA2xxKeyPadState *) qemu_mallocz(sizeof(PXA2xxKeyPadState));
+    s = (PXA2xxKeyPadState *) g_malloc0(sizeof(PXA2xxKeyPadState));
     s->irq = irq;
 
     iomemtype = cpu_register_io_memory(pxa2xx_keypad_readfn,
diff --git a/hw/pxa2xx_lcd.c b/hw/pxa2xx_lcd.c
index a5f8c51..97f9015 100644
--- a/hw/pxa2xx_lcd.c
+++ b/hw/pxa2xx_lcd.c
@@ -986,7 +986,7 @@
     int iomemtype;
     PXA2xxLCDState *s;
 
-    s = (PXA2xxLCDState *) qemu_mallocz(sizeof(PXA2xxLCDState));
+    s = (PXA2xxLCDState *) g_malloc0(sizeof(PXA2xxLCDState));
     s->invalidated = 1;
     s->irq = irq;
 
diff --git a/hw/pxa2xx_mmci.c b/hw/pxa2xx_mmci.c
index d86f735..1de4979 100644
--- a/hw/pxa2xx_mmci.c
+++ b/hw/pxa2xx_mmci.c
@@ -524,7 +524,7 @@
     int iomemtype;
     PXA2xxMMCIState *s;
 
-    s = (PXA2xxMMCIState *) qemu_mallocz(sizeof(PXA2xxMMCIState));
+    s = (PXA2xxMMCIState *) g_malloc0(sizeof(PXA2xxMMCIState));
     s->irq = irq;
     s->rx_dma = rx_dma;
     s->tx_dma = tx_dma;
diff --git a/hw/pxa2xx_pcmcia.c b/hw/pxa2xx_pcmcia.c
index 50d4649..74c6817 100644
--- a/hw/pxa2xx_pcmcia.c
+++ b/hw/pxa2xx_pcmcia.c
@@ -136,7 +136,7 @@
     PXA2xxPCMCIAState *s;
 
     s = (PXA2xxPCMCIAState *)
-            qemu_mallocz(sizeof(PXA2xxPCMCIAState));
+            g_malloc0(sizeof(PXA2xxPCMCIAState));
 
     /* Socket I/O Memory Space */
     iomemtype = cpu_register_io_memory(pxa2xx_pcmcia_io_readfn,
diff --git a/hw/qdev-properties.c b/hw/qdev-properties.c
index eff2d24..0c0c292 100644
--- a/hw/qdev-properties.c
+++ b/hw/qdev-properties.c
@@ -275,14 +275,14 @@
     char **ptr = qdev_get_prop_ptr(dev, prop);
 
     if (*ptr)
-        qemu_free(*ptr);
-    *ptr = qemu_strdup(str);
+        g_free(*ptr);
+    *ptr = g_strdup(str);
     return 0;
 }
 
 static void free_string(DeviceState *dev, Property *prop)
 {
-    qemu_free(*(char **)qdev_get_prop_ptr(dev, prop));
+    g_free(*(char **)qdev_get_prop_ptr(dev, prop));
 }
 
 static int print_string(DeviceState *dev, Property *prop, char *dest, size_t len)
@@ -768,7 +768,7 @@
 {
     GlobalProperty *g;
 
-    g = qemu_mallocz(sizeof(*g));
+    g = g_malloc0(sizeof(*g));
     g->driver   = qemu_opt_get(opts, "driver");
     g->property = qemu_opt_get(opts, "property");
     g->value    = qemu_opt_get(opts, "value");
diff --git a/hw/qdev.c b/hw/qdev.c
index d8114c6..c463c52 100644
--- a/hw/qdev.c
+++ b/hw/qdev.c
@@ -85,7 +85,7 @@
     DeviceState *dev;
 
     assert(bus->info == info->bus_info);
-    dev = qemu_mallocz(info->size);
+    dev = g_malloc0(info->size);
     dev->info = info;
     dev->parent_bus = bus;
     qdev_prop_set_defaults(dev, dev->info->props);
@@ -408,7 +408,7 @@
             prop->info->free(dev, prop);
         }
     }
-    qemu_free(dev);
+    g_free(dev);
 }
 
 void qdev_machine_creation_done(void)
@@ -750,17 +750,17 @@
 
     if (name) {
         /* use supplied name */
-        bus->name = qemu_strdup(name);
+        bus->name = g_strdup(name);
     } else if (parent && parent->id) {
         /* parent device has id -> use it for bus name */
         len = strlen(parent->id) + 16;
-        buf = qemu_malloc(len);
+        buf = g_malloc(len);
         snprintf(buf, len, "%s.%d", parent->id, parent->num_child_bus);
         bus->name = buf;
     } else {
         /* no id -> use lowercase bus type for bus name */
         len = strlen(info->name) + 16;
-        buf = qemu_malloc(len);
+        buf = g_malloc(len);
         len = snprintf(buf, len, "%s.%d", info->name,
                        parent ? parent->num_child_bus : 0);
         for (i = 0; i < len; i++)
@@ -783,7 +783,7 @@
 {
     BusState *bus;
 
-    bus = qemu_mallocz(info->size);
+    bus = g_malloc0(info->size);
     bus->qdev_allocated = 1;
     qbus_create_inplace(bus, info, parent, name);
     return bus;
@@ -793,7 +793,7 @@
 {
     /* assign main_system_bus before qbus_create_inplace()
      * in order to make "if (bus != main_system_bus)" work */
-    main_system_bus = qemu_mallocz(system_bus_info.size);
+    main_system_bus = g_malloc0(system_bus_info.size);
     main_system_bus->qdev_allocated = 1;
     qbus_create_inplace(main_system_bus, &system_bus_info, NULL,
                         "main-system-bus");
@@ -813,9 +813,9 @@
         assert(bus != main_system_bus); /* main_system_bus is never freed */
         qemu_unregister_reset(qbus_reset_all_fn, bus);
     }
-    qemu_free((void*)bus->name);
+    g_free((void*)bus->name);
     if (bus->qdev_allocated) {
-        qemu_free(bus);
+        g_free(bus);
     }
 }
 
@@ -935,7 +935,7 @@
         if (dev->parent_bus->info->get_fw_dev_path) {
             d = dev->parent_bus->info->get_fw_dev_path(dev);
             l += snprintf(p + l, size - l, "%s", d);
-            qemu_free(d);
+            g_free(d);
         } else {
             l += snprintf(p + l, size - l, "%s", dev->info->name);
         }
diff --git a/hw/qxl-render.c b/hw/qxl-render.c
index 1b77577..c290739 100644
--- a/hw/qxl-render.c
+++ b/hw/qxl-render.c
@@ -81,7 +81,7 @@
         qxl->guest_primary.resized = 0;
 
         if (qxl->guest_primary.flipped) {
-            qemu_free(qxl->guest_primary.flipped);
+            g_free(qxl->guest_primary.flipped);
             qxl->guest_primary.flipped = NULL;
         }
         qemu_free_displaysurface(vga->ds);
@@ -90,7 +90,7 @@
         if (qxl->guest_primary.stride < 0) {
             /* spice surface is upside down -> need extra buffer to flip */
             qxl->guest_primary.stride = -qxl->guest_primary.stride;
-            qxl->guest_primary.flipped = qemu_malloc(qxl->guest_primary.surface.width *
+            qxl->guest_primary.flipped = g_malloc(qxl->guest_primary.surface.width *
                                                      qxl->guest_primary.stride);
             ptr = qxl->guest_primary.flipped;
         } else {
diff --git a/hw/qxl.c b/hw/qxl.c
index b34bccf..bab60a5 100644
--- a/hw/qxl.c
+++ b/hw/qxl.c
@@ -1697,7 +1697,7 @@
         qxl_create_guest_primary(d, 1, QXL_SYNC);
 
         /* replay surface-create and cursor-set commands */
-        cmds = qemu_mallocz(sizeof(QXLCommandExt) * (NUM_SURFACES + 1));
+        cmds = g_malloc0(sizeof(QXLCommandExt) * (NUM_SURFACES + 1));
         for (in = 0, out = 0; in < NUM_SURFACES; in++) {
             if (d->guest_surfaces.cmds[in] == 0) {
                 continue;
@@ -1712,7 +1712,7 @@
         cmds[out].group_id = MEMSLOT_GROUP_GUEST;
         out++;
         qxl_spice_loadvm_commands(d, cmds, out);
-        qemu_free(cmds);
+        g_free(cmds);
 
         break;
     case QXL_MODE_COMPAT:
diff --git a/hw/r2d.c b/hw/r2d.c
index a0f8c1f..96a7ff8 100644
--- a/hw/r2d.c
+++ b/hw/r2d.c
@@ -184,7 +184,7 @@
     int iomemtype;
     r2d_fpga_t *s;
 
-    s = qemu_mallocz(sizeof(r2d_fpga_t));
+    s = g_malloc0(sizeof(r2d_fpga_t));
 
     s->irl = irl;
 
@@ -244,7 +244,7 @@
         fprintf(stderr, "Unable to find CPU definition\n");
         exit(1);
     }
-    reset_info = qemu_mallocz(sizeof(ResetData));
+    reset_info = g_malloc0(sizeof(ResetData));
     reset_info->env = env;
     reset_info->vector = env->pc;
     qemu_register_reset(main_cpu_reset, reset_info);
diff --git a/hw/rc4030.c b/hw/rc4030.c
index 6563336..a2a2099 100644
--- a/hw/rc4030.c
+++ b/hw/rc4030.c
@@ -789,8 +789,8 @@
     struct rc4030DMAState *p;
     int i;
 
-    s = (rc4030_dma *)qemu_mallocz(sizeof(rc4030_dma) * n);
-    p = (struct rc4030DMAState *)qemu_mallocz(sizeof(struct rc4030DMAState) * n);
+    s = (rc4030_dma *)g_malloc0(sizeof(rc4030_dma) * n);
+    p = (struct rc4030DMAState *)g_malloc0(sizeof(struct rc4030DMAState) * n);
     for (i = 0; i < n; i++) {
         p->opaque = opaque;
         p->n = i;
@@ -806,7 +806,7 @@
     rc4030State *s;
     int s_chipset, s_jazzio;
 
-    s = qemu_mallocz(sizeof(rc4030State));
+    s = g_malloc0(sizeof(rc4030State));
 
     *irqs = qemu_allocate_irqs(rc4030_irq_jazz_request, s, 16);
     *dmas = rc4030_allocate_dmas(s, 4);
diff --git a/hw/rtl8139.c b/hw/rtl8139.c
index c6cafc2..c5de5b4 100644
--- a/hw/rtl8139.c
+++ b/hw/rtl8139.c
@@ -1796,7 +1796,7 @@
 
         if (iov) {
             buf2_size = iov_size(iov, 3);
-            buf2 = qemu_malloc(buf2_size);
+            buf2 = g_malloc(buf2_size);
             iov_to_buf(iov, 3, buf2, 0, buf2_size);
             buf = buf2;
         }
@@ -1805,7 +1805,7 @@
         rtl8139_do_receive(&s->nic->nc, buf, size, do_interrupt);
 
         if (iov) {
-            qemu_free(buf2);
+            g_free(buf2);
         }
     }
     else
@@ -2053,7 +2053,7 @@
     if (!s->cplus_txbuffer)
     {
         s->cplus_txbuffer_len = CP_TX_BUFFER_SIZE;
-        s->cplus_txbuffer = qemu_malloc(s->cplus_txbuffer_len);
+        s->cplus_txbuffer = g_malloc(s->cplus_txbuffer_len);
         s->cplus_txbuffer_offset = 0;
 
         DPRINTF("+++ C+ mode transmission buffer allocated space %d\n",
@@ -2063,7 +2063,7 @@
     while (s->cplus_txbuffer && s->cplus_txbuffer_offset + txsize >= s->cplus_txbuffer_len)
     {
         s->cplus_txbuffer_len += CP_TX_BUFFER_SIZE;
-        s->cplus_txbuffer = qemu_realloc(s->cplus_txbuffer, s->cplus_txbuffer_len);
+        s->cplus_txbuffer = g_realloc(s->cplus_txbuffer, s->cplus_txbuffer_len);
 
         DPRINTF("+++ C+ mode transmission buffer space changed to %d\n",
             s->cplus_txbuffer_len);
@@ -2401,7 +2401,7 @@
         }
         else
         {
-            qemu_free(saved_buffer);
+            g_free(saved_buffer);
         }
     }
     else
@@ -3441,7 +3441,7 @@
     memory_region_destroy(&s->bar_io);
     memory_region_destroy(&s->bar_mem);
     if (s->cplus_txbuffer) {
-        qemu_free(s->cplus_txbuffer);
+        g_free(s->cplus_txbuffer);
         s->cplus_txbuffer = NULL;
     }
     qemu_del_timer(s->timer);
diff --git a/hw/s390-virtio.c b/hw/s390-virtio.c
index abe954d..acbf026 100644
--- a/hw/s390-virtio.c
+++ b/hw/s390-virtio.c
@@ -165,14 +165,14 @@
     cpu_register_physical_memory(0, my_ram_size, ram_addr);
 
     /* allocate storage keys */
-    storage_keys = qemu_mallocz(my_ram_size / TARGET_PAGE_SIZE);
+    storage_keys = g_malloc0(my_ram_size / TARGET_PAGE_SIZE);
 
     /* init CPUs */
     if (cpu_model == NULL) {
         cpu_model = "host";
     }
 
-    ipi_states = qemu_malloc(sizeof(CPUState *) * smp_cpus);
+    ipi_states = g_malloc(sizeof(CPUState *) * smp_cpus);
 
     for (i = 0; i < smp_cpus; i++) {
         CPUState *tmp_env;
@@ -211,7 +211,7 @@
 
         bios_filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, bios_name);
         bios_size = load_image(bios_filename, qemu_get_ram_ptr(ZIPL_LOAD_ADDR));
-        qemu_free(bios_filename);
+        g_free(bios_filename);
 
         if ((long)bios_size < 0) {
             hw_error("could not load bootloader '%s'\n", bios_name);
@@ -247,7 +247,7 @@
         DeviceState *dev;
 
         if (!nd->model) {
-            nd->model = qemu_strdup("virtio");
+            nd->model = g_strdup("virtio");
         }
 
         if (strcmp(nd->model, "virtio")) {
diff --git a/hw/scsi-bus.c b/hw/scsi-bus.c
index c3ce7df..6f0d039 100644
--- a/hw/scsi-bus.c
+++ b/hw/scsi-bus.c
@@ -346,7 +346,7 @@
 {
     SCSIRequest *req;
 
-    req = qemu_mallocz(reqops->size);
+    req = g_malloc0(reqops->size);
     req->refcount = 1;
     req->bus = scsi_bus_from_device(d);
     req->dev = d;
@@ -1015,7 +1015,7 @@
         if (req->ops->free_req) {
             req->ops->free_req(req);
         }
-        qemu_free(req);
+        g_free(req);
     }
 }
 
diff --git a/hw/scsi-disk.c b/hw/scsi-disk.c
index f1ffe95..d94b1eb 100644
--- a/hw/scsi-disk.c
+++ b/hw/scsi-disk.c
@@ -1125,12 +1125,12 @@
         /* try to fall back to value set with legacy -drive serial=... */
         dinfo = drive_get_by_blockdev(s->bs);
         if (*dinfo->serial) {
-            s->serial = qemu_strdup(dinfo->serial);
+            s->serial = g_strdup(dinfo->serial);
         }
     }
 
     if (!s->version) {
-        s->version = qemu_strdup(QEMU_VERSION);
+        s->version = g_strdup(QEMU_VERSION);
     }
 
     if (bdrv_is_sg(s->bs)) {
diff --git a/hw/scsi-generic.c b/hw/scsi-generic.c
index b63371e..cb5d4f1 100644
--- a/hw/scsi-generic.c
+++ b/hw/scsi-generic.c
@@ -66,7 +66,7 @@
 {
     SCSIGenericReq *r = DO_UPCAST(SCSIGenericReq, req, req);
 
-    qemu_free(r->buf);
+    g_free(r->buf);
 }
 
 /* Helper function for command completion.  */
@@ -288,7 +288,7 @@
 
     if (r->req.cmd.xfer == 0) {
         if (r->buf != NULL)
-            qemu_free(r->buf);
+            g_free(r->buf);
         r->buflen = 0;
         r->buf = NULL;
         ret = execute_command(s->bs, r, SG_DXFER_NONE, scsi_command_complete);
@@ -301,8 +301,8 @@
 
     if (r->buflen != r->req.cmd.xfer) {
         if (r->buf != NULL)
-            qemu_free(r->buf);
-        r->buf = qemu_malloc(r->req.cmd.xfer);
+            g_free(r->buf);
+        r->buf = g_malloc(r->req.cmd.xfer);
         r->buflen = r->req.cmd.xfer;
     }
 
diff --git a/hw/sd.c b/hw/sd.c
index c2c80ab..bb8c2ff 100644
--- a/hw/sd.c
+++ b/hw/sd.c
@@ -409,9 +409,9 @@
     sd->bdrv = bdrv;
 
     if (sd->wp_groups)
-        qemu_free(sd->wp_groups);
+        g_free(sd->wp_groups);
     sd->wp_switch = bdrv ? bdrv_is_read_only(bdrv) : 0;
-    sd->wp_groups = (int *) qemu_mallocz(sizeof(int) * sect);
+    sd->wp_groups = (int *) g_malloc0(sizeof(int) * sect);
     memset(sd->function_group, 0, sizeof(int) * 6);
     sd->erase_start = 0;
     sd->erase_end = 0;
@@ -443,7 +443,7 @@
 {
     SDState *sd;
 
-    sd = (SDState *) qemu_mallocz(sizeof(SDState));
+    sd = (SDState *) g_malloc0(sizeof(SDState));
     sd->buf = qemu_blockalign(bs, 512);
     sd->spi = is_spi;
     sd->enable = 1;
diff --git a/hw/serial.c b/hw/serial.c
index 0ee61dd..222e356 100644
--- a/hw/serial.c
+++ b/hw/serial.c
@@ -797,7 +797,7 @@
 {
     SerialState *s;
 
-    s = qemu_mallocz(sizeof(SerialState));
+    s = g_malloc0(sizeof(SerialState));
 
     s->irq = irq;
     s->baudbase = baudbase;
@@ -931,7 +931,7 @@
     SerialState *s;
     int s_io_memory;
 
-    s = qemu_mallocz(sizeof(SerialState));
+    s = g_malloc0(sizeof(SerialState));
 
     s->it_shift = it_shift;
     s->irq = irq;
diff --git a/hw/sh7750.c b/hw/sh7750.c
index 4f279e7..9f3ea92 100644
--- a/hw/sh7750.c
+++ b/hw/sh7750.c
@@ -712,7 +712,7 @@
     int sh7750_io_memory;
     int sh7750_mm_cache_and_tlb; /* memory mapped cache and tlb */
 
-    s = qemu_mallocz(sizeof(SH7750State));
+    s = g_malloc0(sizeof(SH7750State));
     s->cpu = cpu;
     s->periph_freq = 60000000;	/* 60MHz */
     sh7750_io_memory = cpu_register_io_memory(sh7750_mem_read,
diff --git a/hw/sh_intc.c b/hw/sh_intc.c
index c43b99f..ecb46e5 100644
--- a/hw/sh_intc.c
+++ b/hw/sh_intc.c
@@ -431,7 +431,7 @@
     desc->nr_prio_regs = nr_prio_regs;
 
     i = sizeof(struct intc_source) * nr_sources;
-    desc->sources = qemu_mallocz(i);
+    desc->sources = g_malloc0(i);
 
     for (i = 0; i < desc->nr_sources; i++) {
         struct intc_source *source = desc->sources + i;
diff --git a/hw/sh_serial.c b/hw/sh_serial.c
index 191f4a6..1767c97 100644
--- a/hw/sh_serial.c
+++ b/hw/sh_serial.c
@@ -361,7 +361,7 @@
     sh_serial_state *s;
     int s_io_memory;
 
-    s = qemu_mallocz(sizeof(sh_serial_state));
+    s = g_malloc0(sizeof(sh_serial_state));
 
     s->feat = feat;
     s->flags = SH_SERIAL_FLAG_TEND | SH_SERIAL_FLAG_TDE;
diff --git a/hw/sh_timer.c b/hw/sh_timer.c
index 5df7fb6..dca3c94 100644
--- a/hw/sh_timer.c
+++ b/hw/sh_timer.c
@@ -188,7 +188,7 @@
     sh_timer_state *s;
     QEMUBH *bh;
 
-    s = (sh_timer_state *)qemu_mallocz(sizeof(sh_timer_state));
+    s = (sh_timer_state *)g_malloc0(sizeof(sh_timer_state));
     s->freq = freq;
     s->feat = feat;
     s->tcor = 0xffffffff;
@@ -311,7 +311,7 @@
     tmu012_state *s;
     int timer_feat = (feat & TMU012_FEAT_EXTCLK) ? TIMER_FEAT_EXTCLK : 0;
 
-    s = (tmu012_state *)qemu_mallocz(sizeof(tmu012_state));
+    s = (tmu012_state *)g_malloc0(sizeof(tmu012_state));
     s->feat = feat;
     s->timer[0] = sh_timer_init(freq, timer_feat, ch0_irq);
     s->timer[1] = sh_timer_init(freq, timer_feat, ch1_irq);
diff --git a/hw/slavio_timer.c b/hw/slavio_timer.c
index 5511313..f89b4fb 100644
--- a/hw/slavio_timer.c
+++ b/hw/slavio_timer.c
@@ -381,7 +381,7 @@
     TimerContext *tc;
 
     for (i = 0; i <= MAX_CPUS; i++) {
-        tc = qemu_mallocz(sizeof(TimerContext));
+        tc = g_malloc0(sizeof(TimerContext));
         tc->s = s;
         tc->timer_index = i;
 
diff --git a/hw/sm501.c b/hw/sm501.c
index 0f0bf96..1ed0a7e 100644
--- a/hw/sm501.c
+++ b/hw/sm501.c
@@ -1395,7 +1395,7 @@
     int sm501_2d_engine_index;
 
     /* allocate management data region */
-    s = (SM501State *)qemu_mallocz(sizeof(SM501State));
+    s = (SM501State *)g_malloc0(sizeof(SM501State));
     s->base = base;
     s->local_mem_size_index
 	= get_local_mem_size_index(local_mem_bytes);
diff --git a/hw/smbios.c b/hw/smbios.c
index a3ae1de..8f2e965 100644
--- a/hw/smbios.c
+++ b/hw/smbios.c
@@ -105,9 +105,9 @@
 
     if (!smbios_entries) {
         smbios_entries_len = sizeof(uint16_t);
-        smbios_entries = qemu_mallocz(smbios_entries_len);
+        smbios_entries = g_malloc0(smbios_entries_len);
     }
-    smbios_entries = qemu_realloc(smbios_entries, smbios_entries_len +
+    smbios_entries = g_realloc(smbios_entries, smbios_entries_len +
                                                   sizeof(*field) + len);
     field = (struct smbios_field *)(smbios_entries + smbios_entries_len);
     field->header.type = SMBIOS_FIELD_ENTRY;
@@ -192,10 +192,10 @@
 
         if (!smbios_entries) {
             smbios_entries_len = sizeof(uint16_t);
-            smbios_entries = qemu_mallocz(smbios_entries_len);
+            smbios_entries = g_malloc0(smbios_entries_len);
         }
 
-        smbios_entries = qemu_realloc(smbios_entries, smbios_entries_len +
+        smbios_entries = g_realloc(smbios_entries, smbios_entries_len +
                                                       sizeof(*table) + size);
         table = (struct smbios_table *)(smbios_entries + smbios_entries_len);
         table->header.type = SMBIOS_TABLE_ENTRY;
diff --git a/hw/smbus_eeprom.c b/hw/smbus_eeprom.c
index 3634754..5d080ab 100644
--- a/hw/smbus_eeprom.c
+++ b/hw/smbus_eeprom.c
@@ -130,7 +130,7 @@
                        const uint8_t *eeprom_spd, int eeprom_spd_size)
 {
     int i;
-    uint8_t *eeprom_buf = qemu_mallocz(8 * 256); /* XXX: make this persistent */
+    uint8_t *eeprom_buf = g_malloc0(8 * 256); /* XXX: make this persistent */
     if (eeprom_spd_size > 0) {
         memcpy(eeprom_buf, eeprom_spd, eeprom_spd_size);
     }
diff --git a/hw/soc_dma.c b/hw/soc_dma.c
index 3f0f414..03bc846 100644
--- a/hw/soc_dma.c
+++ b/hw/soc_dma.c
@@ -48,7 +48,7 @@
 static void transfer_fifo2fifo(struct soc_dma_ch_s *ch)
 {
     if (ch->bytes > fifo_size)
-        fifo_buf = qemu_realloc(fifo_buf, fifo_size = ch->bytes);
+        fifo_buf = g_realloc(fifo_buf, fifo_size = ch->bytes);
 
     /* Implement as transfer_fifo2linear + transfer_linear2fifo.  */
     ch->io_fn[0](ch->io_opaque[0], fifo_buf, ch->bytes);
@@ -239,7 +239,7 @@
 struct soc_dma_s *soc_dma_init(int n)
 {
     int i;
-    struct dma_s *s = qemu_mallocz(sizeof(*s) + n * sizeof(*s->ch));
+    struct dma_s *s = g_malloc0(sizeof(*s) + n * sizeof(*s->ch));
 
     s->chnum = n;
     s->soc.ch = s->ch;
@@ -261,7 +261,7 @@
     struct memmap_entry_s *entry;
     struct dma_s *dma = (struct dma_s *) soc;
 
-    dma->memmap = qemu_realloc(dma->memmap, sizeof(*entry) *
+    dma->memmap = g_realloc(dma->memmap, sizeof(*entry) *
                     (dma->memmap_size + 1));
     entry = soc_dma_lookup(dma, virt_base);
 
@@ -313,7 +313,7 @@
     struct memmap_entry_s *entry;
     struct dma_s *dma = (struct dma_s *) soc;
 
-    dma->memmap = qemu_realloc(dma->memmap, sizeof(*entry) *
+    dma->memmap = g_realloc(dma->memmap, sizeof(*entry) *
                     (dma->memmap_size + 1));
     entry = soc_dma_lookup(dma, virt_base);
 
diff --git a/hw/spapr.c b/hw/spapr.c
index 109b774..1265cee 100644
--- a/hw/spapr.c
+++ b/hw/spapr.c
@@ -85,7 +85,7 @@
         }                                                          \
     } while (0)
 
-    fdt = qemu_mallocz(FDT_MAX_SIZE);
+    fdt = g_malloc0(FDT_MAX_SIZE);
     _FDT((fdt_create(fdt, FDT_MAX_SIZE)));
 
     _FDT((fdt_finish_reservemap(fdt)));
@@ -125,7 +125,7 @@
     _FDT((fdt_property_cell(fdt, "#address-cells", 0x1)));
     _FDT((fdt_property_cell(fdt, "#size-cells", 0x0)));
 
-    modelname = qemu_strdup(cpu_model);
+    modelname = g_strdup(cpu_model);
 
     for (i = 0; i < strlen(modelname); i++) {
         modelname[i] = toupper(modelname[i]);
@@ -176,7 +176,7 @@
         _FDT((fdt_end_node(fdt)));
     }
 
-    qemu_free(modelname);
+    g_free(modelname);
 
     _FDT((fdt_end_node(fdt)));
 
@@ -228,7 +228,7 @@
     int ret;
     void *fdt;
 
-    fdt = qemu_malloc(FDT_MAX_SIZE);
+    fdt = g_malloc(FDT_MAX_SIZE);
 
     /* open out the base tree into a temp buffer for the final tweaks */
     _FDT((fdt_open_into(spapr->fdt_skel, fdt, FDT_MAX_SIZE)));
@@ -249,7 +249,7 @@
 
     cpu_physical_memory_write(fdt_addr, fdt, fdt_totalsize(fdt));
 
-    qemu_free(fdt);
+    g_free(fdt);
 }
 
 static uint64_t translate_kernel_address(void *opaque, uint64_t addr)
@@ -300,7 +300,7 @@
     char *filename;
     int irq = 16;
 
-    spapr = qemu_malloc(sizeof(*spapr));
+    spapr = g_malloc(sizeof(*spapr));
     cpu_ppc_hypercall = emulate_spapr_hypercall;
 
     /* We place the device tree just below either the top of RAM, or
@@ -337,7 +337,7 @@
      * later we should probably make it scale to the size of guest
      * RAM */
     spapr->htab_size = 1ULL << (pteg_shift + 7);
-    spapr->htab = qemu_malloc(spapr->htab_size);
+    spapr->htab = g_malloc(spapr->htab_size);
 
     for (env = first_cpu; env != NULL; env = env->next_cpu) {
         env->external_htab = spapr->htab;
@@ -352,7 +352,7 @@
         hw_error("qemu: could not load LPAR rtas '%s'\n", filename);
         exit(1);
     }
-    qemu_free(filename);
+    g_free(filename);
 
     /* Set up Interrupt Controller */
     spapr->icp = xics_system_init(XICS_IRQS);
@@ -372,7 +372,7 @@
         NICInfo *nd = &nd_table[i];
 
         if (!nd->model) {
-            nd->model = qemu_strdup("ibmveth");
+            nd->model = g_strdup("ibmveth");
         }
 
         if (strcmp(nd->model, "ibmveth") == 0) {
@@ -436,7 +436,7 @@
             hw_error("qemu: could not load LPAR rtas '%s'\n", filename);
             exit(1);
         }
-        qemu_free(filename);
+        g_free(filename);
         spapr->entry_point = 0x100;
         initrd_base = 0;
         initrd_size = 0;
diff --git a/hw/spapr_vio.c b/hw/spapr_vio.c
index 481a804..ce6558b 100644
--- a/hw/spapr_vio.c
+++ b/hw/spapr_vio.c
@@ -160,7 +160,7 @@
         * sizeof(VIOsPAPR_RTCE);
 
     if (size) {
-        dev->rtce_table = qemu_mallocz(size);
+        dev->rtce_table = g_malloc0(size);
     }
 }
 
diff --git a/hw/spapr_vscsi.c b/hw/spapr_vscsi.c
index d98d1fd..fc9ac6a 100644
--- a/hw/spapr_vscsi.c
+++ b/hw/spapr_vscsi.c
@@ -788,7 +788,7 @@
     if (spapr_tce_dma_read(&s->vdev, crq->s.IU_data_ptr, &req->iu,
                            crq->s.IU_length)) {
         fprintf(stderr, "vscsi_got_payload: DMA read failure !\n");
-        qemu_free(req);
+        g_free(req);
     }
     memcpy(&req->crq, crq, sizeof(vscsi_crq));
 
diff --git a/hw/stellaris.c b/hw/stellaris.c
index a280930..646eec7 100644
--- a/hw/stellaris.c
+++ b/hw/stellaris.c
@@ -605,7 +605,7 @@
     int iomemtype;
     ssys_state *s;
 
-    s = (ssys_state *)qemu_mallocz(sizeof(ssys_state));
+    s = (ssys_state *)g_malloc0(sizeof(ssys_state));
     s->irq = irq;
     s->board = board;
     /* Most devices come preprogrammed with a MAC address in the user data. */
diff --git a/hw/stellaris_enet.c b/hw/stellaris_enet.c
index 1291931..f9bd3da 100644
--- a/hw/stellaris_enet.c
+++ b/hw/stellaris_enet.c
@@ -393,7 +393,7 @@
 
     cpu_unregister_io_memory(s->mmio_index);
 
-    qemu_free(s);
+    g_free(s);
 }
 
 static NetClientInfo net_stellaris_enet_info = {
diff --git a/hw/stellaris_input.c b/hw/stellaris_input.c
index 95604ec..68c600c 100644
--- a/hw/stellaris_input.c
+++ b/hw/stellaris_input.c
@@ -77,8 +77,8 @@
     gamepad_state *s;
     int i;
 
-    s = (gamepad_state *)qemu_mallocz(sizeof (gamepad_state));
-    s->buttons = (gamepad_button *)qemu_mallocz(n * sizeof (gamepad_button));
+    s = (gamepad_state *)g_malloc0(sizeof (gamepad_state));
+    s->buttons = (gamepad_button *)g_malloc0(n * sizeof (gamepad_button));
     for (i = 0; i < n; i++) {
         s->buttons[i].irq = irq[i];
         s->buttons[i].keycode = keycode[i];
diff --git a/hw/strongarm.c b/hw/strongarm.c
index 0e03d61..3a7fd6d 100644
--- a/hw/strongarm.c
+++ b/hw/strongarm.c
@@ -1529,7 +1529,7 @@
     qemu_irq *pic;
     int i;
 
-    s = qemu_mallocz(sizeof(StrongARMState));
+    s = g_malloc0(sizeof(StrongARMState));
 
     if (!rev) {
         rev = "sa1110-b5";
diff --git a/hw/sun4m.c b/hw/sun4m.c
index df3aa32..7516703 100644
--- a/hw/sun4m.c
+++ b/hw/sun4m.c
@@ -681,7 +681,7 @@
         if (ret < 0 || ret > PROM_SIZE_MAX) {
             ret = load_image_targphys(filename, addr, PROM_SIZE_MAX);
         }
-        qemu_free(filename);
+        g_free(filename);
     } else {
         ret = -1;
     }
diff --git a/hw/sun4u.c b/hw/sun4u.c
index 7b2d0b1..1b60e4e 100644
--- a/hw/sun4u.c
+++ b/hw/sun4u.c
@@ -351,7 +351,7 @@
                                   QEMUBHFunc *cb, uint32_t frequency,
                                   uint64_t disabled_mask)
 {
-    CPUTimer *timer = qemu_mallocz(sizeof (CPUTimer));
+    CPUTimer *timer = g_malloc0(sizeof (CPUTimer));
 
     timer->name = name;
     timer->frequency = frequency;
@@ -608,7 +608,7 @@
         if (ret < 0 || ret > PROM_SIZE_MAX) {
             ret = load_image_targphys(filename, addr, PROM_SIZE_MAX);
         }
-        qemu_free(filename);
+        g_free(filename);
     } else {
         ret = -1;
     }
@@ -723,7 +723,7 @@
     env->hstick = cpu_timer_create("hstick", env, hstick_irq,
                                     hstick_frequency, TICK_INT_DIS);
 
-    reset_info = qemu_mallocz(sizeof(ResetData));
+    reset_info = g_malloc0(sizeof(ResetData));
     reset_info->env = env;
     reset_info->prom_addr = hwdef->prom_addr;
     qemu_register_reset(main_cpu_reset, reset_info);
diff --git a/hw/syborg_interrupt.c b/hw/syborg_interrupt.c
index 5217983..1b0f3bb 100644
--- a/hw/syborg_interrupt.c
+++ b/hw/syborg_interrupt.c
@@ -213,7 +213,7 @@
                                        syborg_int_writefn, s,
                                        DEVICE_NATIVE_ENDIAN);
     sysbus_init_mmio(dev, 0x1000, iomemtype);
-    s->flags = qemu_mallocz(s->num_irqs * sizeof(syborg_int_flags));
+    s->flags = g_malloc0(s->num_irqs * sizeof(syborg_int_flags));
 
     register_savevm(&dev->qdev, "syborg_int", -1, 1, syborg_int_save,
                     syborg_int_load, s);
diff --git a/hw/syborg_keyboard.c b/hw/syborg_keyboard.c
index 706a039..82b9dc0 100644
--- a/hw/syborg_keyboard.c
+++ b/hw/syborg_keyboard.c
@@ -195,7 +195,7 @@
         fprintf(stderr, "syborg_keyboard: fifo too small\n");
         s->fifo_size = 16;
     }
-    s->key_fifo = qemu_mallocz(s->fifo_size * sizeof(s->key_fifo[0]));
+    s->key_fifo = g_malloc0(s->fifo_size * sizeof(s->key_fifo[0]));
 
     qemu_add_kbd_event_handler(syborg_keyboard_event, s);
 
diff --git a/hw/syborg_pointer.c b/hw/syborg_pointer.c
index 2f99707..b91214d 100644
--- a/hw/syborg_pointer.c
+++ b/hw/syborg_pointer.c
@@ -198,7 +198,7 @@
         fprintf(stderr, "syborg_pointer: fifo too small\n");
         s->fifo_size = 16;
     }
-    s->event_fifo = qemu_mallocz(s->fifo_size * sizeof(s->event_fifo[0]));
+    s->event_fifo = g_malloc0(s->fifo_size * sizeof(s->event_fifo[0]));
 
     qemu_add_mouse_event_handler(syborg_pointer_event, s, s->absolute,
                                  "Syborg Pointer");
diff --git a/hw/syborg_serial.c b/hw/syborg_serial.c
index 2ef7175..4d0ec04 100644
--- a/hw/syborg_serial.c
+++ b/hw/syborg_serial.c
@@ -311,7 +311,7 @@
         fprintf(stderr, "syborg_serial: fifo too small\n");
         s->fifo_size = 16;
     }
-    s->read_fifo = qemu_mallocz(s->fifo_size * sizeof(s->read_fifo[0]));
+    s->read_fifo = g_malloc0(s->fifo_size * sizeof(s->read_fifo[0]));
 
     return 0;
 }
diff --git a/hw/sysbus.c b/hw/sysbus.c
index ea442ac..f8f1746 100644
--- a/hw/sysbus.c
+++ b/hw/sysbus.c
@@ -158,8 +158,8 @@
 {
     SysBusDeviceInfo *info;
 
-    info = qemu_mallocz(sizeof(*info));
-    info->qdev.name = qemu_strdup(name);
+    info = g_malloc0(sizeof(*info));
+    info->qdev.name = g_strdup(name);
     info->qdev.size = size;
     info->init = init;
     sysbus_register_withprop(info);
diff --git a/hw/tc58128.c b/hw/tc58128.c
index 61b99dd..ee3ecad 100644
--- a/hw/tc58128.c
+++ b/hw/tc58128.c
@@ -30,7 +30,7 @@
     int ret, blocks;
 
     dev->state = WAIT;
-    dev->flash_contents = qemu_mallocz(FLASH_SIZE);
+    dev->flash_contents = g_malloc0(FLASH_SIZE);
     memset(dev->flash_contents, 0xff, FLASH_SIZE);
     if (!dev->flash_contents) {
 	fprintf(stderr, "could not alloc memory for flash\n");
diff --git a/hw/tc6393xb.c b/hw/tc6393xb.c
index a1c48bf..c28005a 100644
--- a/hw/tc6393xb.c
+++ b/hw/tc6393xb.c
@@ -579,7 +579,7 @@
         tc6393xb_writel,
     };
 
-    s = (TC6393xbState *) qemu_mallocz(sizeof(TC6393xbState));
+    s = (TC6393xbState *) g_malloc0(sizeof(TC6393xbState));
     s->irq = irq;
     s->gpio_in = qemu_allocate_irqs(tc6393xb_gpio_set, s, TC6393XB_GPIOS);
 
diff --git a/hw/tsc2005.c b/hw/tsc2005.c
index c95dcf0..9a500eb 100644
--- a/hw/tsc2005.c
+++ b/hw/tsc2005.c
@@ -524,7 +524,7 @@
     TSC2005State *s;
 
     s = (TSC2005State *)
-            qemu_mallocz(sizeof(TSC2005State));
+            g_malloc0(sizeof(TSC2005State));
     s->x = 400;
     s->y = 240;
     s->pressure = 0;
diff --git a/hw/tsc210x.c b/hw/tsc210x.c
index 96446dd..3c448a6 100644
--- a/hw/tsc210x.c
+++ b/hw/tsc210x.c
@@ -1105,7 +1105,7 @@
     TSC210xState *s;
 
     s = (TSC210xState *)
-            qemu_mallocz(sizeof(TSC210xState));
+            g_malloc0(sizeof(TSC210xState));
     memset(s, 0, sizeof(TSC210xState));
     s->x = 160;
     s->y = 160;
@@ -1154,7 +1154,7 @@
     TSC210xState *s;
 
     s = (TSC210xState *)
-            qemu_mallocz(sizeof(TSC210xState));
+            g_malloc0(sizeof(TSC210xState));
     memset(s, 0, sizeof(TSC210xState));
     s->x = 400;
     s->y = 240;
diff --git a/hw/tusb6010.c b/hw/tusb6010.c
index ccd01ad..d7ae527 100644
--- a/hw/tusb6010.c
+++ b/hw/tusb6010.c
@@ -729,7 +729,7 @@
 
 TUSBState *tusb6010_init(qemu_irq intr)
 {
-    TUSBState *s = qemu_mallocz(sizeof(*s));
+    TUSBState *s = g_malloc0(sizeof(*s));
 
     s->test_reset = TUSB_PROD_TEST_RESET_VAL;
     s->host_mode = 0;
diff --git a/hw/usb-bus.c b/hw/usb-bus.c
index f1dd55e..c0bbc7c 100644
--- a/hw/usb-bus.c
+++ b/hw/usb-bus.c
@@ -342,7 +342,7 @@
 static char *usb_get_dev_path(DeviceState *qdev)
 {
     USBDevice *dev = DO_UPCAST(USBDevice, qdev, qdev);
-    return qemu_strdup(dev->port->path);
+    return g_strdup(dev->port->path);
 }
 
 static char *usb_get_fw_dev_path(DeviceState *qdev)
@@ -353,7 +353,7 @@
     long nr;
 
     fw_len = 32 + strlen(dev->port->path) * 6;
-    fw_path = qemu_malloc(fw_len);
+    fw_path = g_malloc(fw_len);
     in = dev->port->path;
     while (fw_len - pos > 0) {
         nr = strtol(in, &in, 10);
diff --git a/hw/usb-desc.c b/hw/usb-desc.c
index bc6858f..ae2d384 100644
--- a/hw/usb-desc.c
+++ b/hw/usb-desc.c
@@ -283,12 +283,12 @@
         }
     }
     if (s == NULL) {
-        s = qemu_mallocz(sizeof(*s));
+        s = g_malloc0(sizeof(*s));
         s->index = index;
         QLIST_INSERT_HEAD(&dev->strings, s, next);
     }
-    qemu_free(s->str);
-    s->str = qemu_strdup(str);
+    g_free(s->str);
+    s->str = g_strdup(str);
 }
 
 const char *usb_desc_get_string(USBDevice *dev, uint8_t index)
diff --git a/hw/usb-ehci.c b/hw/usb-ehci.c
index c9d0a69..47a7fb9 100644
--- a/hw/usb-ehci.c
+++ b/hw/usb-ehci.c
@@ -652,7 +652,7 @@
 {
     EHCIQueue *q;
 
-    q = qemu_mallocz(sizeof(*q));
+    q = g_malloc0(sizeof(*q));
     q->ehci = ehci;
     q->async_schedule = async;
     QTAILQ_INSERT_HEAD(&ehci->queues, q, next);
@@ -667,7 +667,7 @@
         usb_cancel_packet(&q->packet);
     }
     QTAILQ_REMOVE(&q->ehci->queues, q, next);
-    qemu_free(q);
+    g_free(q);
 }
 
 static EHCIQueue *ehci_find_queue_by_qh(EHCIState *ehci, uint32_t addr)
diff --git a/hw/usb-musb.c b/hw/usb-musb.c
index d3ccde9..799fa6e 100644
--- a/hw/usb-musb.c
+++ b/hw/usb-musb.c
@@ -342,7 +342,7 @@
 
 struct MUSBState *musb_init(qemu_irq *irqs)
 {
-    MUSBState *s = qemu_mallocz(sizeof(*s));
+    MUSBState *s = g_malloc0(sizeof(*s));
     int i;
 
     s->irqs = irqs;
diff --git a/hw/usb-net.c b/hw/usb-net.c
index 0cb47d6..a8b7c8d 100644
--- a/hw/usb-net.c
+++ b/hw/usb-net.c
@@ -844,7 +844,7 @@
     QTAILQ_REMOVE(&s->rndis_resp, r, entries);
     ret = r->length;
     memcpy(buf, r->buf, r->length);
-    qemu_free(r);
+    g_free(r);
 
     return ret;
 }
@@ -852,7 +852,7 @@
 static void *rndis_queue_response(USBNetState *s, unsigned int length)
 {
     struct rndis_response *r =
-            qemu_mallocz(sizeof(struct rndis_response) + length);
+            g_malloc0(sizeof(struct rndis_response) + length);
 
     QTAILQ_INSERT_TAIL(&s->rndis_resp, r, entries);
     r->length = length;
@@ -866,7 +866,7 @@
 
     while ((r = s->rndis_resp.tqh_first)) {
         QTAILQ_REMOVE(&s->rndis_resp, r, entries);
-        qemu_free(r);
+        g_free(r);
     }
 }
 
diff --git a/hw/usb-uhci.c b/hw/usb-uhci.c
index 16088d7..6ca7ca8 100644
--- a/hw/usb-uhci.c
+++ b/hw/usb-uhci.c
@@ -168,7 +168,7 @@
 
 static UHCIAsync *uhci_async_alloc(UHCIState *s)
 {
-    UHCIAsync *async = qemu_malloc(sizeof(UHCIAsync));
+    UHCIAsync *async = g_malloc(sizeof(UHCIAsync));
 
     memset(&async->packet, 0, sizeof(async->packet));
     async->uhci  = s;
@@ -187,7 +187,7 @@
 {
     usb_packet_cleanup(&async->packet);
     qemu_sglist_destroy(&async->sgl);
-    qemu_free(async);
+    g_free(async);
 }
 
 static void uhci_async_link(UHCIState *s, UHCIAsync *async)
diff --git a/hw/vga-isa-mm.c b/hw/vga-isa-mm.c
index 96e6e7d..b934978 100644
--- a/hw/vga-isa-mm.c
+++ b/hw/vga-isa-mm.c
@@ -102,11 +102,11 @@
     MemoryRegion *s_ioport_ctrl, *vga_io_memory;
 
     s->it_shift = it_shift;
-    s_ioport_ctrl = qemu_malloc(sizeof(*s_ioport_ctrl));
+    s_ioport_ctrl = g_malloc(sizeof(*s_ioport_ctrl));
     memory_region_init_io(s_ioport_ctrl, &vga_mm_ctrl_ops, s,
                           "vga-mm-ctrl", 0x100000);
 
-    vga_io_memory = qemu_malloc(sizeof(*vga_io_memory));
+    vga_io_memory = g_malloc(sizeof(*vga_io_memory));
     /* XXX: endianness? */
     memory_region_init_io(vga_io_memory, &vga_mem_ops, &s->vga,
                           "vga-mem", 0x20000);
@@ -125,7 +125,7 @@
 {
     ISAVGAMMState *s;
 
-    s = qemu_mallocz(sizeof(*s));
+    s = g_malloc0(sizeof(*s));
 
     vga_common_init(&s->vga, VGA_RAM_SIZE);
     vga_mm_init(s, vram_base, ctrl_base, it_shift);
diff --git a/hw/vga.c b/hw/vga.c
index 33dc478..a190105 100644
--- a/hw/vga.c
+++ b/hw/vga.c
@@ -2234,7 +2234,7 @@
 #endif
 #endif /* CONFIG_BOCHS_VBE */
 
-    vga_mem = qemu_malloc(sizeof(*vga_mem));
+    vga_mem = g_malloc(sizeof(*vga_mem));
     memory_region_init_io(vga_mem, &vga_mem_ops, s,
                           "vga-lowmem", 0x20000);
 
@@ -2302,7 +2302,7 @@
         return -1;
     fprintf(f, "P6\n%d %d\n%d\n",
             ds->width, ds->height, 255);
-    linebuf = qemu_malloc(ds->width * 3);
+    linebuf = g_malloc(ds->width * 3);
     d1 = ds->data;
     for(y = 0; y < ds->height; y++) {
         d = d1;
@@ -2327,7 +2327,7 @@
         ret = fwrite(linebuf, 1, pbuf - linebuf, f);
         (void)ret;
     }
-    qemu_free(linebuf);
+    g_free(linebuf);
     fclose(f);
     return 0;
 }
@@ -2336,7 +2336,7 @@
 {
     DisplayChangeListener *dcl;
 
-    dcl = qemu_mallocz(sizeof(DisplayChangeListener));
+    dcl = g_malloc0(sizeof(DisplayChangeListener));
     dcl->dpy_update = vga_save_dpy_update;
     dcl->dpy_resize = vga_save_dpy_resize;
     dcl->dpy_refresh = vga_save_dpy_refresh;
diff --git a/hw/vhost.c b/hw/vhost.c
index 19e7255..1886067 100644
--- a/hw/vhost.c
+++ b/hw/vhost.c
@@ -252,7 +252,7 @@
     uint64_t log_base;
     int r;
     if (size) {
-        log = qemu_mallocz(size * sizeof *log);
+        log = g_malloc0(size * sizeof *log);
     } else {
         log = NULL;
     }
@@ -262,7 +262,7 @@
     vhost_client_sync_dirty_bitmap(&dev->client, 0,
                                    (target_phys_addr_t)~0x0ull);
     if (dev->log) {
-        qemu_free(dev->log);
+        g_free(dev->log);
     }
     dev->log = log;
     dev->log_size = size;
@@ -348,7 +348,7 @@
     uint64_t log_size;
     int r;
 
-    dev->mem = qemu_realloc(dev->mem, s);
+    dev->mem = g_realloc(dev->mem, s);
 
     if (log_dirty) {
         flags = IO_MEM_UNASSIGNED;
@@ -485,7 +485,7 @@
             return r;
         }
         if (dev->log) {
-            qemu_free(dev->log);
+            g_free(dev->log);
         }
         dev->log = NULL;
         dev->log_size = 0;
@@ -669,7 +669,7 @@
     hdev->client.migration_log = vhost_client_migration_log;
     hdev->client.log_start = NULL;
     hdev->client.log_stop = NULL;
-    hdev->mem = qemu_mallocz(offsetof(struct vhost_memory, regions));
+    hdev->mem = g_malloc0(offsetof(struct vhost_memory, regions));
     hdev->log = NULL;
     hdev->log_size = 0;
     hdev->log_enabled = false;
@@ -686,7 +686,7 @@
 void vhost_dev_cleanup(struct vhost_dev *hdev)
 {
     cpu_unregister_phys_memory_client(&hdev->client);
-    qemu_free(hdev->mem);
+    g_free(hdev->mem);
     close(hdev->control);
 }
 
@@ -734,7 +734,7 @@
     if (hdev->log_enabled) {
         hdev->log_size = vhost_get_log_size(hdev);
         hdev->log = hdev->log_size ?
-            qemu_mallocz(hdev->log_size * sizeof *hdev->log) : NULL;
+            g_malloc0(hdev->log_size * sizeof *hdev->log) : NULL;
         r = ioctl(hdev->control, VHOST_SET_LOG_BASE,
                   (uint64_t)(unsigned long)hdev->log);
         if (r < 0) {
@@ -782,7 +782,7 @@
     assert (r >= 0);
 
     hdev->started = false;
-    qemu_free(hdev->log);
+    g_free(hdev->log);
     hdev->log = NULL;
     hdev->log_size = 0;
 }
diff --git a/hw/vhost_net.c b/hw/vhost_net.c
index b6dc592..a559812 100644
--- a/hw/vhost_net.c
+++ b/hw/vhost_net.c
@@ -92,7 +92,7 @@
                                  bool force)
 {
     int r;
-    struct vhost_net *net = qemu_malloc(sizeof *net);
+    struct vhost_net *net = g_malloc(sizeof *net);
     if (!backend) {
         fprintf(stderr, "vhost-net requires backend to be setup\n");
         goto fail;
@@ -125,7 +125,7 @@
     vhost_net_ack_features(net, 0);
     return net;
 fail:
-    qemu_free(net);
+    g_free(net);
     return NULL;
 }
 
@@ -198,7 +198,7 @@
     if (net->dev.acked_features & (1 << VIRTIO_NET_F_MRG_RXBUF)) {
         tap_set_vnet_hdr_len(net->vc, sizeof(struct virtio_net_hdr));
     }
-    qemu_free(net);
+    g_free(net);
 }
 #else
 struct vhost_net *vhost_net_init(VLANClientState *backend, int devfd,
diff --git a/hw/virtex_ml507.c b/hw/virtex_ml507.c
index 7bde8c7..333050c 100644
--- a/hw/virtex_ml507.c
+++ b/hw/virtex_ml507.c
@@ -102,7 +102,7 @@
     ppc_dcr_init(env, NULL, NULL);
 
     /* interrupt controller */
-    irqs = qemu_mallocz(sizeof(qemu_irq) * PPCUIC_OUTPUT_NB);
+    irqs = g_malloc0(sizeof(qemu_irq) * PPCUIC_OUTPUT_NB);
     irqs[PPCUIC_OUTPUT_INT] = ((qemu_irq *)env->irq_inputs)[PPC40x_INPUT_INT];
     irqs[PPCUIC_OUTPUT_CINT] = ((qemu_irq *)env->irq_inputs)[PPC40x_INPUT_CINT];
     ppcuic_init(env, irqs, 0x0C0, 0, 1);
@@ -154,7 +154,7 @@
         path = qemu_find_file(QEMU_FILE_TYPE_BIOS, BINARY_DEVICE_TREE_FILE);
         if (path) {
             fdt = load_device_tree(path, &fdt_size);
-            qemu_free(path);
+            g_free(path);
         }
         if (!fdt) {
             return 0;
@@ -173,7 +173,7 @@
         path = qemu_find_file(QEMU_FILE_TYPE_BIOS, BINARY_DEVICE_TREE_FILE);
         if (path) {
             fdt_size = load_image_targphys(path, addr, 0x10000);
-            qemu_free(path);
+            g_free(path);
         }
     }
 
diff --git a/hw/virtio-blk.c b/hw/virtio-blk.c
index 836dbc3..dad8c0a 100644
--- a/hw/virtio-blk.c
+++ b/hw/virtio-blk.c
@@ -59,7 +59,7 @@
     virtqueue_push(s->vq, &req->elem, req->qiov.size + sizeof(*req->in));
     virtio_notify(&s->vdev, s->vq);
 
-    qemu_free(req);
+    g_free(req);
 }
 
 static int virtio_blk_handle_rw_error(VirtIOBlockReq *req, int error,
@@ -117,7 +117,7 @@
 
 static VirtIOBlockReq *virtio_blk_alloc_request(VirtIOBlock *s)
 {
-    VirtIOBlockReq *req = qemu_malloc(sizeof(*req));
+    VirtIOBlockReq *req = g_malloc(sizeof(*req));
     req->dev = s;
     req->qiov.size = 0;
     req->next = NULL;
@@ -130,7 +130,7 @@
 
     if (req != NULL) {
         if (!virtqueue_pop(s->vq, &req->elem)) {
-            qemu_free(req);
+            g_free(req);
             return NULL;
         }
     }
diff --git a/hw/virtio-net.c b/hw/virtio-net.c
index 3f10391..8c2f460 100644
--- a/hw/virtio-net.c
+++ b/hw/virtio-net.c
@@ -1039,9 +1039,9 @@
     n->mergeable_rx_bufs = 0;
     n->promisc = 1; /* for compatibility */
 
-    n->mac_table.macs = qemu_mallocz(MAC_TABLE_ENTRIES * ETH_ALEN);
+    n->mac_table.macs = g_malloc0(MAC_TABLE_ENTRIES * ETH_ALEN);
 
-    n->vlans = qemu_mallocz(MAX_VLAN >> 3);
+    n->vlans = g_malloc0(MAX_VLAN >> 3);
 
     n->qdev = dev;
     register_savevm(dev, "virtio-net", -1, VIRTIO_NET_VM_VERSION,
@@ -1063,8 +1063,8 @@
 
     unregister_savevm(n->qdev, "virtio-net", n);
 
-    qemu_free(n->mac_table.macs);
-    qemu_free(n->vlans);
+    g_free(n->mac_table.macs);
+    g_free(n->vlans);
 
     if (n->tx_timer) {
         qemu_del_timer(n->tx_timer);
diff --git a/hw/virtio-serial-bus.c b/hw/virtio-serial-bus.c
index c5eb931..a4825b9 100644
--- a/hw/virtio-serial-bus.c
+++ b/hw/virtio-serial-bus.c
@@ -383,14 +383,14 @@
             stw_p(&cpkt.value, 1);
 
             buffer_len = sizeof(cpkt) + strlen(port->name) + 1;
-            buffer = qemu_malloc(buffer_len);
+            buffer = g_malloc(buffer_len);
 
             memcpy(buffer, &cpkt, sizeof(cpkt));
             memcpy(buffer + sizeof(cpkt), port->name, strlen(port->name));
             buffer[buffer_len - 1] = 0;
 
             send_control_msg(port, buffer, buffer_len);
-            qemu_free(buffer);
+            g_free(buffer);
         }
 
         if (port->host_connected) {
@@ -447,9 +447,9 @@
          * if the size of the buf differs
          */
         if (cur_len > len) {
-            qemu_free(buf);
+            g_free(buf);
 
-            buf = qemu_malloc(cur_len);
+            buf = g_malloc(cur_len);
             len = cur_len;
         }
         copied = iov_to_buf(elem.out_sg, elem.out_num, buf, 0, len);
@@ -457,7 +457,7 @@
         handle_control_message(vser, buf, copied);
         virtqueue_push(vq, &elem, 0);
     }
-    qemu_free(buf);
+    g_free(buf);
     virtio_notify(vdev, vq);
 }
 
@@ -862,8 +862,8 @@
     QTAILQ_INIT(&vser->ports);
 
     vser->bus.max_nr_ports = conf->max_virtserial_ports;
-    vser->ivqs = qemu_malloc(conf->max_virtserial_ports * sizeof(VirtQueue *));
-    vser->ovqs = qemu_malloc(conf->max_virtserial_ports * sizeof(VirtQueue *));
+    vser->ivqs = g_malloc(conf->max_virtserial_ports * sizeof(VirtQueue *));
+    vser->ovqs = g_malloc(conf->max_virtserial_ports * sizeof(VirtQueue *));
 
     /* Add a queue for host to guest transfers for port 0 (backward compat) */
     vser->ivqs[0] = virtio_add_queue(vdev, 128, handle_input);
@@ -889,7 +889,7 @@
     }
 
     vser->config.max_nr_ports = tswap32(conf->max_virtserial_ports);
-    vser->ports_map = qemu_mallocz(((conf->max_virtserial_ports + 31) / 32)
+    vser->ports_map = g_malloc0(((conf->max_virtserial_ports + 31) / 32)
         * sizeof(vser->ports_map[0]));
     /*
      * Reserve location 0 for a console port for backward compat
@@ -919,9 +919,9 @@
 
     unregister_savevm(vser->qdev, "virtio-console", vser);
 
-    qemu_free(vser->ivqs);
-    qemu_free(vser->ovqs);
-    qemu_free(vser->ports_map);
+    g_free(vser->ivqs);
+    g_free(vser->ovqs);
+    g_free(vser->ports_map);
 
     virtio_cleanup(vdev);
 }
diff --git a/hw/virtio.c b/hw/virtio.c
index 93dfb1e..13aa0fa 100644
--- a/hw/virtio.c
+++ b/hw/virtio.c
@@ -832,9 +832,9 @@
 {
     qemu_del_vm_change_state_handler(vdev->vmstate);
     if (vdev->config)
-        qemu_free(vdev->config);
-    qemu_free(vdev->vq);
-    qemu_free(vdev);
+        g_free(vdev->config);
+    g_free(vdev->vq);
+    g_free(vdev);
 }
 
 static void virtio_vmstate_change(void *opaque, int running, int reason)
@@ -862,14 +862,14 @@
     VirtIODevice *vdev;
     int i;
 
-    vdev = qemu_mallocz(struct_size);
+    vdev = g_malloc0(struct_size);
 
     vdev->device_id = device_id;
     vdev->status = 0;
     vdev->isr = 0;
     vdev->queue_sel = 0;
     vdev->config_vector = VIRTIO_NO_VECTOR;
-    vdev->vq = qemu_mallocz(sizeof(VirtQueue) * VIRTIO_PCI_QUEUE_MAX);
+    vdev->vq = g_malloc0(sizeof(VirtQueue) * VIRTIO_PCI_QUEUE_MAX);
     vdev->vm_running = vm_running;
     for(i = 0; i < VIRTIO_PCI_QUEUE_MAX; i++) {
         vdev->vq[i].vector = VIRTIO_NO_VECTOR;
@@ -879,7 +879,7 @@
     vdev->name = name;
     vdev->config_len = config_size;
     if (vdev->config_len)
-        vdev->config = qemu_mallocz(config_size);
+        vdev->config = g_malloc0(config_size);
     else
         vdev->config = NULL;
 
diff --git a/hw/vmware_vga.c b/hw/vmware_vga.c
index d5cfa70..a840cbd 100644
--- a/hw/vmware_vga.c
+++ b/hw/vmware_vga.c
@@ -1068,7 +1068,7 @@
         DisplaySurface *ds = qemu_create_displaysurface_from(s->width,
                 s->height, 32, ds_get_linesize(s->vga.ds), s->vga.vram_ptr);
         ppm_save(filename, ds);
-        qemu_free(ds);
+        g_free(ds);
     }
 }
 
@@ -1210,7 +1210,7 @@
 static void vmsvga_init(struct vmsvga_state_s *s, int vga_ram_size)
 {
     s->scratch_size = SVGA_SCRATCH_SIZE;
-    s->scratch = qemu_malloc(s->scratch_size * 4);
+    s->scratch = g_malloc(s->scratch_size * 4);
 
     s->vga.ds = graphic_console_init(vmsvga_update_display,
                                      vmsvga_invalidate_display,
@@ -1274,7 +1274,7 @@
     MemoryRegion *iomem;
 
 #ifdef DIRECT_VRAM
-    DirectMem *directmem = qemu_malloc(sizeof(*directmem));
+    DirectMem *directmem = g_malloc(sizeof(*directmem));
 
     iomem = &directmem->mr;
     memory_region_init_io(iomem, &vmsvga_vram_io_ops, &s->chip, "vmsvga",
diff --git a/hw/wm8750.c b/hw/wm8750.c
index c9c6744..39383f4 100644
--- a/hw/wm8750.c
+++ b/hw/wm8750.c
@@ -625,7 +625,7 @@
     WM8750State *s = (WM8750State *) i2c;
     wm8750_reset(&s->i2c);
     AUD_remove_card(&s->card);
-    qemu_free(s);
+    g_free(s);
 }
 #endif
 
diff --git a/hw/xen_backend.c b/hw/xen_backend.c
index d881fa2..aa64267 100644
--- a/hw/xen_backend.c
+++ b/hw/xen_backend.c
@@ -75,8 +75,8 @@
     str = xs_read(xenstore, 0, abspath, &len);
     if (str != NULL) {
         /* move to qemu-allocated memory to make sure
-         * callers can savely qemu_free() stuff. */
-        ret = qemu_strdup(str);
+         * callers can savely g_free() stuff. */
+        ret = g_strdup(str);
         free(str);
     }
     return ret;
@@ -99,7 +99,7 @@
     if (val && 1 == sscanf(val, "%d", ival)) {
         rc = 0;
     }
-    qemu_free(val);
+    g_free(val);
     return rc;
 }
 
@@ -199,7 +199,7 @@
     }
 
     /* init new xendev */
-    xendev = qemu_mallocz(ops->size);
+    xendev = g_malloc0(ops->size);
     xendev->type  = type;
     xendev->dom   = dom;
     xendev->dev   = dev;
@@ -218,7 +218,7 @@
     xendev->evtchndev = xen_xc_evtchn_open(NULL, 0);
     if (xendev->evtchndev == XC_HANDLER_INITIAL_VALUE) {
         xen_be_printf(NULL, 0, "can't open evtchn device\n");
-        qemu_free(xendev);
+        g_free(xendev);
         return NULL;
     }
     fcntl(xc_evtchn_fd(xendev->evtchndev), F_SETFD, FD_CLOEXEC);
@@ -228,7 +228,7 @@
         if (xendev->gnttabdev == XC_HANDLER_INITIAL_VALUE) {
             xen_be_printf(NULL, 0, "can't open gnttab device\n");
             xc_evtchn_close(xendev->evtchndev);
-            qemu_free(xendev);
+            g_free(xendev);
             return NULL;
         }
     } else {
@@ -275,7 +275,7 @@
             char token[XEN_BUFSIZE];
             snprintf(token, sizeof(token), "fe:%p", xendev);
             xs_unwatch(xenstore, xendev->fe, token);
-            qemu_free(xendev->fe);
+            g_free(xendev->fe);
         }
 
         if (xendev->evtchndev != XC_HANDLER_INITIAL_VALUE) {
@@ -286,7 +286,7 @@
         }
 
         QTAILQ_REMOVE(&xendevs, xendev, next);
-        qemu_free(xendev);
+        g_free(xendev);
     }
     return NULL;
 }
@@ -328,7 +328,7 @@
         xendev->fe_state = fe_state;
     }
     if (node == NULL  ||  strcmp(node, "protocol") == 0) {
-        qemu_free(xendev->protocol);
+        g_free(xendev->protocol);
         xendev->protocol = xenstore_read_fe_str(xendev, "protocol");
         if (xendev->protocol) {
             xen_be_printf(xendev, 1, "frontend protocol: %s\n", xendev->protocol);
diff --git a/hw/xen_console.c b/hw/xen_console.c
index 8ef104c..99ff442 100644
--- a/hw/xen_console.c
+++ b/hw/xen_console.c
@@ -70,7 +70,7 @@
 
     if ((buffer->capacity - buffer->size) < size) {
 	buffer->capacity += (size + 1024);
-	buffer->data = qemu_realloc(buffer->data, buffer->capacity);
+	buffer->data = g_realloc(buffer->data, buffer->capacity);
     }
 
     while (cons != prod)
@@ -89,7 +89,7 @@
 	uint8_t *maxpos = buffer->data + buffer->max_capacity;
 
 	memmove(maxpos - over, maxpos, over);
-	buffer->data = qemu_realloc(buffer->data, buffer->max_capacity);
+	buffer->data = g_realloc(buffer->data, buffer->max_capacity);
 	buffer->size = buffer->capacity = buffer->max_capacity;
 
 	if (buffer->consumed > buffer->max_capacity - over)
@@ -208,7 +208,7 @@
     xenstore_store_pv_console_info(con->xendev.dev, con->chr);
 
 out:
-    qemu_free(type);
+    g_free(type);
     return ret;
 }
 
diff --git a/hw/xen_devconfig.c b/hw/xen_devconfig.c
index 6926c54..41accbb 100644
--- a/hw/xen_devconfig.c
+++ b/hw/xen_devconfig.c
@@ -14,7 +14,7 @@
 {
     struct xs_dirs *d;
 
-    d = qemu_malloc(sizeof(*d));
+    d = g_malloc(sizeof(*d));
     d->xs_dir = dir;
     QTAILQ_INSERT_TAIL(&xs_cleanup, d, list);
 }
@@ -43,7 +43,7 @@
 	xen_be_printf(NULL, 0, "xs_mkdir %s: failed\n", dev);
 	return -1;
     }
-    xen_config_cleanup_dir(qemu_strdup(dev));
+    xen_config_cleanup_dir(g_strdup(dev));
 
     if (!xs_set_permissions(xenstore, 0, dev, perms, 2)) {
 	xen_be_printf(NULL, 0, "xs_set_permissions %s: failed\n", dev);
diff --git a/hw/xen_disk.c b/hw/xen_disk.c
index add815f..31f9151 100644
--- a/hw/xen_disk.c
+++ b/hw/xen_disk.c
@@ -124,7 +124,7 @@
             goto out;
         }
         /* allocate new struct */
-        ioreq = qemu_mallocz(sizeof(*ioreq));
+        ioreq = g_malloc0(sizeof(*ioreq));
         ioreq->blkdev = blkdev;
         blkdev->requests_total++;
         qemu_iovec_init(&ioreq->v, BLKIF_MAX_SEGMENTS_PER_REQUEST);
@@ -716,15 +716,15 @@
     return 0;
 
 out_error:
-    qemu_free(blkdev->params);
+    g_free(blkdev->params);
     blkdev->params = NULL;
-    qemu_free(blkdev->mode);
+    g_free(blkdev->mode);
     blkdev->mode = NULL;
-    qemu_free(blkdev->type);
+    g_free(blkdev->type);
     blkdev->type = NULL;
-    qemu_free(blkdev->dev);
+    g_free(blkdev->dev);
     blkdev->dev = NULL;
-    qemu_free(blkdev->devtype);
+    g_free(blkdev->devtype);
     blkdev->devtype = NULL;
     return -1;
 }
@@ -822,14 +822,14 @@
         ioreq = QLIST_FIRST(&blkdev->freelist);
         QLIST_REMOVE(ioreq, list);
         qemu_iovec_destroy(&ioreq->v);
-        qemu_free(ioreq);
+        g_free(ioreq);
     }
 
-    qemu_free(blkdev->params);
-    qemu_free(blkdev->mode);
-    qemu_free(blkdev->type);
-    qemu_free(blkdev->dev);
-    qemu_free(blkdev->devtype);
+    g_free(blkdev->params);
+    g_free(blkdev->mode);
+    g_free(blkdev->type);
+    g_free(blkdev->dev);
+    g_free(blkdev->devtype);
     qemu_bh_delete(blkdev->bh);
     return 0;
 }
diff --git a/hw/xen_nic.c b/hw/xen_nic.c
index ff86491..b28b156 100644
--- a/hw/xen_nic.c
+++ b/hw/xen_nic.c
@@ -183,7 +183,7 @@
             if (txreq.flags & NETTXF_csum_blank) {
                 /* have read-only mapping -> can't fill checksum in-place */
                 if (!tmpbuf) {
-                    tmpbuf = qemu_malloc(XC_PAGE_SIZE);
+                    tmpbuf = g_malloc(XC_PAGE_SIZE);
                 }
                 memcpy(tmpbuf, page + txreq.offset, txreq.size);
                 net_checksum_calculate(tmpbuf, txreq.size);
@@ -199,7 +199,7 @@
         }
         netdev->tx_work = 0;
     }
-    qemu_free(tmpbuf);
+    g_free(tmpbuf);
 }
 
 /* ------------------------------------------------------------- */
@@ -423,7 +423,7 @@
 {
     struct XenNetDev *netdev = container_of(xendev, struct XenNetDev, xendev);
 
-    qemu_free(netdev->mac);
+    g_free(netdev->mac);
     return 0;
 }
 
diff --git a/hw/xenfb.c b/hw/xenfb.c
index 0a01ae3..d532d3e 100644
--- a/hw/xenfb.c
+++ b/hw/xenfb.c
@@ -366,7 +366,7 @@
             /* there is no vfb, run vkbd on its own */
             in->c.ds = get_displaystate();
         } else {
-            qemu_free(vfb);
+            g_free(vfb);
             xen_be_printf(xendev, 1, "ds not set (yet)\n");
             return -1;
         }
@@ -483,8 +483,8 @@
     n_fbdirs = xenfb->fbpages * mode / 8;
     n_fbdirs = (n_fbdirs + (XC_PAGE_SIZE - 1)) / XC_PAGE_SIZE;
 
-    pgmfns = qemu_mallocz(sizeof(unsigned long) * n_fbdirs);
-    fbmfns = qemu_mallocz(sizeof(unsigned long) * xenfb->fbpages);
+    pgmfns = g_malloc0(sizeof(unsigned long) * n_fbdirs);
+    fbmfns = g_malloc0(sizeof(unsigned long) * xenfb->fbpages);
 
     xenfb_copy_mfns(mode, n_fbdirs, pgmfns, pd);
     map = xc_map_foreign_pages(xen_xc, xenfb->c.xendev.dom,
@@ -502,8 +502,8 @@
     ret = 0; /* all is fine */
 
 out:
-    qemu_free(pgmfns);
-    qemu_free(fbmfns);
+    g_free(pgmfns);
+    g_free(fbmfns);
     return ret;
 }
 
diff --git a/hw/xics.c b/hw/xics.c
index 13a1d25..9bf82aa 100644
--- a/hw/xics.c
+++ b/hw/xics.c
@@ -440,9 +440,9 @@
         }
     }
 
-    icp = qemu_mallocz(sizeof(*icp));
+    icp = g_malloc0(sizeof(*icp));
     icp->nr_servers = max_server_num + 1;
-    icp->ss = qemu_mallocz(icp->nr_servers*sizeof(struct icp_server_state));
+    icp->ss = g_malloc0(icp->nr_servers*sizeof(struct icp_server_state));
 
     for (i = 0; i < icp->nr_servers; i++) {
         icp->ss[i].mfrr = 0xff;
@@ -467,10 +467,10 @@
         }
     }
 
-    ics = qemu_mallocz(sizeof(*ics));
+    ics = g_malloc0(sizeof(*ics));
     ics->nr_irqs = nr_irqs;
     ics->offset = 16;
-    ics->irqs = qemu_mallocz(nr_irqs * sizeof(struct ics_irq_state));
+    ics->irqs = g_malloc0(nr_irqs * sizeof(struct ics_irq_state));
 
     icp->ics = ics;
     ics->icp = icp;
diff --git a/hw/xilinx_axienet.c b/hw/xilinx_axienet.c
index 464d275..b875aad 100644
--- a/hw/xilinx_axienet.c
+++ b/hw/xilinx_axienet.c
@@ -789,8 +789,8 @@
 {
     /* FIXME.  */
     struct XilinxAXIEnet *s = DO_UPCAST(NICState, nc, nc)->opaque;
-    qemu_free(s->rxmem);
-    qemu_free(s);
+    g_free(s->rxmem);
+    g_free(s);
 }
 
 static void
@@ -871,7 +871,7 @@
 
     s->TEMAC.parent = s;
 
-    s->rxmem = qemu_malloc(s->c_rxmem);
+    s->rxmem = g_malloc(s->c_rxmem);
     axienet_reset(s);
 
     return 0;
diff --git a/hw/xilinx_timer.c b/hw/xilinx_timer.c
index d398c18..f1c7abc 100644
--- a/hw/xilinx_timer.c
+++ b/hw/xilinx_timer.c
@@ -198,7 +198,7 @@
     sysbus_init_irq(dev, &t->irq);
 
     /* Init all the ptimers.  */
-    t->timers = qemu_mallocz(sizeof t->timers[0] * t->nr_timers);
+    t->timers = g_malloc0(sizeof t->timers[0] * t->nr_timers);
     for (i = 0; i < t->nr_timers; i++) {
         struct xlx_timer *xt = &t->timers[i];