diff --git a/Makefile.android b/Makefile.android
index b366f8b..bbaa767 100644
--- a/Makefile.android
+++ b/Makefile.android
@@ -641,6 +641,9 @@
 #
 CORE_MISC_SOURCES = vl-android.c \
                     console.c \
+                    qemu-malloc.c \
+                    cutils.c \
+                    osdep.c \
                     loader.c \
                     monitor.c \
                     readline.c \
@@ -653,6 +656,7 @@
                     d3des.c \
                     vnc-android.c \
                     acl.c \
+                    keymaps.c \
                     buffered_file.c \
                     cbuffer.c \
                     gdbstub.c \
@@ -742,11 +746,8 @@
 # lists of source files used by both, emulator UI and emulator core
 #
 
-UI_AND_CORE_SOURCES = osdep.c \
-                      cutils.c \
+UI_AND_CORE_SOURCES = \
                       sockets.c \
-                      keymaps.c \
-                      qemu-malloc.c \
                       android/keycode-array.c \
                       android/charmap.c \
                       android/utils/bufprint.c \
diff --git a/android/charmap.c b/android/charmap.c
index 1d200e6..81c866a 100644
--- a/android/charmap.c
+++ b/android/charmap.c
@@ -9,11 +9,13 @@
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 */
-#include "qemu-common.h"
 #include "android/utils/path.h"
 #include "android/utils/misc.h"
 #include "android/utils/debug.h"
+#include "android/utils/system.h"
 #include "android/charmap.h"
+#include <stdio.h>
+#include <errno.h>
 
 /* Parses .kcm file producing key characters map.
  * .kcm file parsed by this module is expected to contain 4 types of
@@ -636,7 +638,7 @@
 
     // Preallocate map.
     char_map->num_entries = 0;
-    char_map->entries = qemu_malloc(sizeof(AKeyEntry) * map_size);
+    AARRAY_NEW0(char_map->entries, map_size);
 
     // Line by line parse the file.
     for (; 0 != fgets(line, sizeof(line), kcm_file); cur_line++) {
@@ -651,13 +653,10 @@
             // Key information has been extracted. Add it to the map.
             // Lets see if we need to reallocate map.
             if (map_size == char_map->num_entries) {
-                void* new_map;
+                AKeyEntry* entries = (AKeyEntry*)char_map->entries;
                 map_size += 10;
-                new_map = qemu_malloc(sizeof(AKeyEntry) * map_size);
-                memcpy(new_map, char_map->entries,
-                       char_map->num_entries * sizeof(AKeyEntry));
-                qemu_free((void*)char_map->entries);
-                char_map->entries = new_map;
+                AARRAY_RENEW(entries, map_size);
+                char_map->entries = (const AKeyEntry*)entries;
             }
             entries = (AKeyEntry*)char_map->entries;
             entries[char_map->num_entries] = key_entry;
@@ -682,7 +681,7 @@
     if (err) {
         // Cleanup on failure.
         if (0 != char_map->entries) {
-            qemu_free((void*)char_map->entries);
+            AFREE((void*)char_map->entries);
             char_map->entries = 0;
         }
         char_map->num_entries = 0;
@@ -704,8 +703,7 @@
         if (!parse_kcm_file(kcm_file_path, &android_custom_charmap)) {
             // Here we have two default charmaps and the custom one.
             android_charmap_count = 3;
-            android_charmaps = qemu_malloc(sizeof(AKeyCharmap*) *
-                                           android_charmap_count);
+            AARRAY_NEW(android_charmaps, android_charmap_count);
             android_charmaps[0] = &android_custom_charmap;
             android_charmaps[1] = &_qwerty_charmap;
             android_charmaps[2] = &_qwerty2_charmap;
@@ -716,8 +714,7 @@
     } else {
         // Here we have only two default charmaps.
         android_charmap_count = 2;
-        android_charmaps = qemu_malloc(sizeof(AKeyCharmap*) *
-                           android_charmap_count);
+        AARRAY_NEW(android_charmaps, android_charmap_count);
         android_charmaps[0] = &_qwerty_charmap;
         android_charmaps[1] = &_qwerty2_charmap;
     }
@@ -734,10 +731,10 @@
           // static entries defined in charmap.c
           if ((_qwerty_charmap.entries != android_charmaps[n]->entries) &&
               (_qwerty2_charmap.entries != android_charmaps[n]->entries)) {
-              qemu_free((void*)android_charmaps[n]->entries);
+              AFREE((void*)android_charmaps[n]->entries);
           }
       }
-      qemu_free(android_charmaps);
+      AFREE(android_charmaps);
   }
 }
 
diff --git a/android/display.c b/android/display.c
index 0cfd98d..d7c261a 100644
--- a/android/display.c
+++ b/android/display.c
@@ -15,6 +15,7 @@
  * is supposed to do.
  */
 #include "android/display.h"
+#include "android/utils/system.h"
 
 /*
 
@@ -92,7 +93,7 @@
                                                     qf->pixels);
 
     /* Register a change listener for it */
-    dcl = (DisplayChangeListener *) qemu_mallocz(sizeof(DisplayChangeListener));
+    ANEW0(dcl);
     dcl->dpy_update      = android_display_update;
     dcl->dpy_resize      = android_display_resize;
     dcl->dpy_refresh     = android_display_refresh;
diff --git a/android/main.c b/android/main.c
index c5dc899..b88fb5e 100644
--- a/android/main.c
+++ b/android/main.c
@@ -657,7 +657,7 @@
 
 FOUND_IT:
     //D("image auto-detection: %s/%s", temp, fileName);
-    return qemu_strdup(temp);
+    return android_strdup(temp);
 }
 
 static char*
@@ -670,7 +670,7 @@
     if (p >= end || !path_exists(temp))
         return NULL;
 
-    return qemu_strdup(temp);
+    return android_strdup(temp);
 }
 
 static char*
@@ -968,7 +968,7 @@
 
         /* if no data directory is specified, use the system directory */
         if (!opts->datadir) {
-            opts->datadir   = qemu_strdup(opts->sysdir);
+            opts->datadir   = android_strdup(opts->sysdir);
             dataDirIsSystem = 1;
             D("autoconfig: -datadir %s", opts->sysdir);
         }
@@ -987,14 +987,14 @@
                 exit(2);
             }
 
-            opts->data = qemu_strdup(tmp);
+            opts->data = android_strdup(tmp);
             D("autoconfig: -data %s", opts->data);
         }
 
         if (!opts->sdcard && opts->datadir) {
             bufprint(tmp, tmpend, "%s/sdcard.img", opts->datadir);
             if (path_exists(tmp)) {
-                opts->sdcard = qemu_strdup(tmp);
+                opts->sdcard = android_strdup(tmp);
                 D("autoconfig: -sdcard %s", opts->sdcard);
             }
         }
@@ -1466,7 +1466,7 @@
     }
     if (!opts->memory) {
         bufprint(tmp, tmpend, "%d", hw->hw_ramSize);
-        opts->memory = qemu_strdup(tmp);
+        opts->memory = android_strdup(tmp);
     }
 
     if (opts->trace) {
diff --git a/android/skin/window.c b/android/skin/window.c
index 9aa7ec9..b1d98af 100644
--- a/android/skin/window.c
+++ b/android/skin/window.c
@@ -722,13 +722,13 @@
     for (nn = 0; nn < layout->num_displays; nn++)
         display_done( &layout->displays[nn] );
 
-    qemu_free( layout->buttons );
+    AFREE( layout->buttons );
     layout->buttons = NULL;
 
-    qemu_free( layout->backgrounds );
+    AFREE( layout->backgrounds );
     layout->backgrounds = NULL;
 
-    qemu_free( layout->displays );
+    AFREE( layout->displays );
     layout->displays = NULL;
 
     layout->num_buttons     = 0;
@@ -1100,7 +1100,7 @@
     }
 
     if (window->shrink_pixels) {
-        qemu_free(window->shrink_pixels);
+        AFREE(window->shrink_pixels);
         window->shrink_pixels = NULL;
     }
 
@@ -1267,7 +1267,7 @@
             window->shrink_surface = NULL;
         }
         if (window->shrink_pixels) {
-            qemu_free(window->shrink_pixels);
+            AFREE(window->shrink_pixels);
             window->shrink_pixels = NULL;
         }
         if (window->onion) {
@@ -1279,7 +1279,7 @@
             window->scaler = NULL;
         }
         layout_done( &window->layout );
-        qemu_free(window);
+        AFREE(window);
     }
 }
 
diff --git a/android/utils/dirscanner.c b/android/utils/dirscanner.c
index fc63ef0..9c6a39c 100644
--- a/android/utils/dirscanner.c
+++ b/android/utils/dirscanner.c
@@ -11,7 +11,8 @@
 */
 #include "android/utils/dirscanner.h"
 #include "android/utils/bufprint.h"
-#include "qemu-common.h"
+#include "android/utils/system.h"
+#include "android/utils/path.h"
 #include <stddef.h>
 
 #define  DIRSCANNER_BASE     \
@@ -149,7 +150,7 @@
 DirScanner*
 dirScanner_new ( const char*  rootPath )
 {
-    DirScanner*  s   = qemu_mallocz(sizeof *s);
+    DirScanner*  s   = android_alloc0(sizeof *s);
     char*        p   = s->root;
     char*        end = p + sizeof s->root;
 
@@ -177,7 +178,7 @@
         return;
 
     _dirScanner_done(s);
-    qemu_free(s);
+    AFREE(s);
 }
 
 
diff --git a/android/utils/system.c b/android/utils/system.c
index e09fd6b..8443877 100644
--- a/android/utils/system.c
+++ b/android/utils/system.c
@@ -122,7 +122,7 @@
             q++;
         }
     }
-Exit:	
+Exit:
     *pline = p;
     return line;
 }
diff --git a/android/utils/timezone.c b/android/utils/timezone.c
index f4b78db..2707e2e 100644
--- a/android/utils/timezone.c
+++ b/android/utils/timezone.c
@@ -131,7 +131,7 @@
                 return NULL;
             }
         }
-        pstrcpy( android_timezone0, sizeof(android_timezone0), tz );
+        snprintf(android_timezone0, sizeof(android_timezone0), "%s", tz );
         android_timezone = android_timezone0;
     }
     D( "found timezone %s", android_timezone );
@@ -402,7 +402,7 @@
             if (tz == NULL)
                 return NULL;
 
-            pstrcpy( android_timezone0, sizeof(android_timezone0), tz );
+            snprintf(android_timezone0, sizeof(android_timezone0), "%s", tz);
             android_timezone = android_timezone0;
         }
         D( "found timezone %s\n", android_timezone );
diff --git a/console-ui.c b/console-ui.c
index 8fd7e7d..42a5cb3 100644
--- a/console-ui.c
+++ b/console-ui.c
@@ -24,6 +24,7 @@
 #include "qemu-common.h"
 #include "console.h"
 #include "qemu-timer.h"
+#include "android/utils/system.h"
 
 //#define DEBUG_CONSOLE
 #define DEFAULT_BACKSCROLL 512
@@ -364,7 +365,7 @@
 
     if (nb_consoles >= MAX_CONSOLES)
         return NULL;
-    s = qemu_mallocz(sizeof(TextConsole));
+    ANEW0(s);
     if (!active_console || ((active_console->console_type != GRAPHIC_CONSOLE) &&
         (console_type == GRAPHIC_CONSOLE))) {
         active_console = s;
@@ -388,8 +389,9 @@
 
 static DisplaySurface* defaultallocator_create_displaysurface(int width, int height)
 {
-    DisplaySurface *surface = (DisplaySurface*) qemu_mallocz(sizeof(DisplaySurface));
+    DisplaySurface *surface;
 
+    ANEW0(surface);
     surface->width = width;
     surface->height = height;
     surface->linesize = width * 4;
@@ -399,7 +401,7 @@
 #else
     surface->flags = QEMU_ALLOCATED_FLAG;
 #endif
-    surface->data = (uint8_t*) qemu_mallocz(surface->linesize * surface->height);
+    surface->data = (uint8_t*) android_alloc0(surface->linesize * surface->height);
 
     return surface;
 }
@@ -412,9 +414,9 @@
     surface->linesize = width * 4;
     surface->pf = qemu_default_pixelformat(32);
     if (surface->flags & QEMU_ALLOCATED_FLAG)
-        surface->data = (uint8_t*) qemu_realloc(surface->data, surface->linesize * surface->height);
+        surface->data = (uint8_t*) android_realloc(surface->data, surface->linesize * surface->height);
     else
-        surface->data = (uint8_t*) qemu_malloc(surface->linesize * surface->height);
+        surface->data = (uint8_t*) android_alloc(surface->linesize * surface->height);
 #ifdef HOST_WORDS_BIGENDIAN
     surface->flags = QEMU_ALLOCATED_FLAG | QEMU_BIG_ENDIAN_FLAG;
 #else
@@ -427,8 +429,9 @@
 DisplaySurface* qemu_create_displaysurface_from(int width, int height, int bpp,
                                               int linesize, uint8_t *data)
 {
-    DisplaySurface *surface = (DisplaySurface*) qemu_mallocz(sizeof(DisplaySurface));
+    DisplaySurface *surface;
 
+    ANEW0(surface);
     surface->width = width;
     surface->height = height;
     surface->linesize = linesize;
@@ -446,8 +449,8 @@
     if (surface == NULL)
         return;
     if (surface->flags & QEMU_ALLOCATED_FLAG)
-        qemu_free(surface->data);
-    qemu_free(surface);
+        AFREE(surface->data);
+    AFREE(surface);
 }
 
 static struct DisplayAllocator default_allocator = {
@@ -458,7 +461,8 @@
 
 static void dumb_display_init(void)
 {
-    DisplayState *ds = qemu_mallocz(sizeof(DisplayState));
+    DisplayState *ds;
+    ANEW0(ds);
     ds->allocator = &default_allocator;
     ds->surface = qemu_create_displaysurface(ds, 640, 480);
     register_displaystate(ds);
@@ -506,7 +510,7 @@
     TextConsole *s;
     DisplayState *ds;
 
-    ds = (DisplayState *) qemu_mallocz(sizeof(DisplayState));
+    ANEW0(ds);
     ds->allocator = &default_allocator;
 #ifdef CONFIG_ANDROID
     ds->surface = qemu_create_displaysurface(ds, android_display_width, android_display_height);
@@ -517,7 +521,7 @@
     s = new_console(ds, GRAPHIC_CONSOLE);
     if (s == NULL) {
         qemu_free_displaysurface(ds);
-        qemu_free(ds);
+        AFREE(ds);
         return NULL;
     }
     s->hw_update = update;
@@ -702,7 +706,8 @@
 void
 android_display_init_from(int width, int height, int rotation, int bpp)
 {
-    DisplayState *ds = qemu_mallocz(sizeof(DisplayState));
+    DisplayState *ds;
+    ANEW0(ds);
     ds->allocator = &default_allocator;
     ds->surface = qemu_create_displaysurface(ds, width, height);
     register_displaystate(ds);
diff --git a/qemu-timer-ui.c b/qemu-timer-ui.c
index 912e634..ae85509 100644
--- a/qemu-timer-ui.c
+++ b/qemu-timer-ui.c
@@ -24,6 +24,7 @@
 
 #include "qemu-timer.h"
 #include "console.h"
+#include "android/utils/system.h"
 
 extern QEMUClock*  rtc_clock;
 
@@ -39,11 +40,6 @@
 
 #ifdef __linux__
 #include <sys/ioctl.h>
-#include <linux/rtc.h>
-/* For the benefit of older linux systems which don't supply it,
-   we use a local copy of hpet.h. */
-/* #include <linux/hpet.h> */
-#include "hpet.h"
 #endif
 
 #ifdef _WIN32
@@ -265,12 +261,6 @@
 static void dynticks_stop_timer(struct qemu_alarm_timer *t);
 static void dynticks_rearm_timer(struct qemu_alarm_timer *t);
 
-static int hpet_start_timer(struct qemu_alarm_timer *t);
-static void hpet_stop_timer(struct qemu_alarm_timer *t);
-
-static int rtc_start_timer(struct qemu_alarm_timer *t);
-static void rtc_stop_timer(struct qemu_alarm_timer *t);
-
 #endif /* __linux__ */
 
 #endif /* _WIN32 */
@@ -280,10 +270,6 @@
 #ifdef __linux__
     {"dynticks", dynticks_start_timer,
      dynticks_stop_timer, dynticks_rearm_timer, NULL},
-    /* HPET - if available - is preferred */
-    {"hpet", hpet_start_timer, hpet_stop_timer, NULL, NULL},
-    /* ...otherwise try RTC */
-    {"rtc", rtc_start_timer, rtc_stop_timer, NULL, NULL},
 #endif
     {"unix", unix_start_timer, unix_stop_timer, NULL, NULL},
 #else
@@ -295,70 +281,6 @@
     {NULL, }
 };
 
-static void show_available_alarms(void)
-{
-    int i;
-
-    printf("Available alarm timers, in order of precedence:\n");
-    for (i = 0; alarm_timers[i].name; i++)
-        printf("%s\n", alarm_timers[i].name);
-}
-
-void configure_alarms(char const *opt)
-{
-    int i;
-    int cur = 0;
-    int count = ARRAY_SIZE(alarm_timers) - 1;
-    char *arg;
-    char *name;
-    struct qemu_alarm_timer tmp;
-
-    if (!strcmp(opt, "?")) {
-        show_available_alarms();
-        exit(0);
-    }
-
-    arg = qemu_strdup(opt);
-
-    /* Reorder the array */
-    name = strtok(arg, ",");
-    while (name) {
-        for (i = 0; i < count && alarm_timers[i].name; i++) {
-            if (!strcmp(alarm_timers[i].name, name))
-                break;
-        }
-
-        if (i == count) {
-            fprintf(stderr, "Unknown clock %s\n", name);
-            goto next;
-        }
-
-        if (i < cur)
-            /* Ignore */
-            goto next;
-
-	/* Swap */
-        tmp = alarm_timers[i];
-        alarm_timers[i] = alarm_timers[cur];
-        alarm_timers[cur] = tmp;
-
-        cur++;
-next:
-        name = strtok(NULL, ",");
-    }
-
-    qemu_free(arg);
-
-    if (cur) {
-        /* Disable remaining timers */
-        for (i = cur; i < count; i++)
-            alarm_timers[i].name = NULL;
-    } else {
-        show_available_alarms();
-        exit(1);
-    }
-}
-
 #define QEMU_NUM_CLOCKS 3
 
 QEMUClock *rt_clock;
@@ -370,22 +292,17 @@
 static QEMUClock *qemu_new_clock(int type)
 {
     QEMUClock *clock;
-    clock = qemu_mallocz(sizeof(QEMUClock));
+    ANEW0(clock);
     clock->type = type;
     clock->enabled = 1;
     return clock;
 }
 
-void qemu_clock_enable(QEMUClock *clock, int enabled)
-{
-    clock->enabled = enabled;
-}
-
 QEMUTimer *qemu_new_timer(QEMUClock *clock, QEMUTimerCB *cb, void *opaque)
 {
     QEMUTimer *ts;
 
-    ts = qemu_mallocz(sizeof(QEMUTimer));
+    ANEW0(ts);
     ts->clock = clock;
     ts->cb = cb;
     ts->opaque = opaque;
@@ -394,7 +311,7 @@
 
 void qemu_free_timer(QEMUTimer *ts)
 {
-    qemu_free(ts);
+    AFREE(ts);
 }
 
 /* stop a timer, but do not dealloc it */
@@ -449,16 +366,6 @@
     }
 }
 
-int qemu_timer_pending(QEMUTimer *ts)
-{
-    QEMUTimer *t;
-    for(t = active_timers[ts->clock->type]; t != NULL; t = t->next) {
-        if (t == ts)
-            return 1;
-    }
-    return 0;
-}
-
 int qemu_timer_expired(QEMUTimer *timer_head, int64_t current_time)
 {
     if (!timer_head)
@@ -622,8 +529,6 @@
 
 #if defined(__linux__)
 
-#define RTC_FREQ 1024
-
 static uint64_t qemu_next_deadline_dyntick(void)
 {
     int64_t delta;
@@ -644,106 +549,6 @@
     return delta;
 }
 
-static void enable_sigio_timer(int fd)
-{
-    struct sigaction act;
-
-    /* timer signal */
-    sigfillset(&act.sa_mask);
-    act.sa_flags = 0;
-    act.sa_handler = host_alarm_handler;
-
-    sigaction(SIGIO, &act, NULL);
-    fcntl_setfl(fd, O_ASYNC);
-    fcntl(fd, F_SETOWN, getpid());
-}
-
-static int hpet_start_timer(struct qemu_alarm_timer *t)
-{
-    struct hpet_info info;
-    int r, fd;
-
-    fd = open("/dev/hpet", O_RDONLY);
-    if (fd < 0)
-        return -1;
-
-    /* Set frequency */
-    r = ioctl(fd, HPET_IRQFREQ, RTC_FREQ);
-    if (r < 0) {
-        fprintf(stderr, "Could not configure '/dev/hpet' to have a 1024Hz timer. This is not a fatal\n"
-                "error, but for better emulation accuracy type:\n"
-                "'echo 1024 > /proc/sys/dev/hpet/max-user-freq' as root.\n");
-        goto fail;
-    }
-
-    /* Check capabilities */
-    r = ioctl(fd, HPET_INFO, &info);
-    if (r < 0)
-        goto fail;
-
-    /* Enable periodic mode */
-    r = ioctl(fd, HPET_EPI, 0);
-    if (info.hi_flags && (r < 0))
-        goto fail;
-
-    /* Enable interrupt */
-    r = ioctl(fd, HPET_IE_ON, 0);
-    if (r < 0)
-        goto fail;
-
-    enable_sigio_timer(fd);
-    t->priv = (void *)(long)fd;
-
-    return 0;
-fail:
-    close(fd);
-    return -1;
-}
-
-static void hpet_stop_timer(struct qemu_alarm_timer *t)
-{
-    int fd = (long)t->priv;
-
-    close(fd);
-}
-
-#define TFR(cond)  while ((cond) && errno == EINTR) {}
-static int rtc_start_timer(struct qemu_alarm_timer *t)
-{
-    int rtc_fd;
-    unsigned long current_rtc_freq = 0;
-
-    TFR(rtc_fd = open("/dev/rtc", O_RDONLY));
-    if (rtc_fd < 0)
-        return -1;
-    ioctl(rtc_fd, RTC_IRQP_READ, &current_rtc_freq);
-    if (current_rtc_freq != RTC_FREQ &&
-        ioctl(rtc_fd, RTC_IRQP_SET, RTC_FREQ) < 0) {
-        fprintf(stderr, "Could not configure '/dev/rtc' to have a 1024 Hz timer. This is not a fatal\n"
-                "error, but for better emulation accuracy either use a 2.6 host Linux kernel or\n"
-                "type 'echo 1024 > /proc/sys/dev/rtc/max-user-freq' as root.\n");
-        goto fail;
-    }
-    if (ioctl(rtc_fd, RTC_PIE_ON, 0) < 0) {
-    fail:
-        close(rtc_fd);
-        return -1;
-    }
-
-    enable_sigio_timer(rtc_fd);
-
-    t->priv = (void *)(long)rtc_fd;
-
-    return 0;
-}
-
-static void rtc_stop_timer(struct qemu_alarm_timer *t)
-{
-    int rtc_fd = (long)t->priv;
-
-    close(rtc_fd);
-}
-
 static int dynticks_start_timer(struct qemu_alarm_timer *t)
 {
     struct sigevent ev;
@@ -934,12 +739,6 @@
 
 #endif /* _WIN32 */
 
-static void alarm_timer_on_change_state_rearm(void *opaque, int running, int reason)
-{
-    if (running)
-        qemu_rearm_alarm_timer((struct qemu_alarm_timer *) opaque);
-}
-
 int init_timer_alarm(void)
 {
     struct qemu_alarm_timer *t = NULL;
diff --git a/sockets.c b/sockets.c
index 14e9ad6..72a388a 100644
--- a/sockets.c
+++ b/sockets.c
@@ -15,7 +15,6 @@
 #endif
 
 #include "sockets.h"
-#include "qemu-common.h"
 #include <fcntl.h>
 #include <stddef.h>
 #include "qemu_debug.h"
@@ -25,6 +24,7 @@
 #include "android/utils/path.h"
 #include "android/utils/debug.h"
 #include "android/utils/misc.h"
+#include "android/utils/system.h"
 
 #define  D(...) VERBOSE_PRINT(socket,__VA_ARGS__)
 
@@ -786,8 +786,8 @@
     for (count = 0, e = res; e != NULL; e = e->ai_next)
         count += 1;
 
-    list = (SockAddress**) qemu_malloc((count+1)*sizeof(SockAddress*));
-    addr = (SockAddress*)  qemu_malloc(count*sizeof(SockAddress));
+    AARRAY_NEW(list, count+1);
+    AARRAY_NEW(addr, count);
 
     for (nn = 0, e = res; e != NULL; e = e->ai_next) {
 
@@ -816,8 +816,8 @@
         sock_address_done(list[nn]);
         list[nn] = NULL;
     }
-    qemu_free(addr);
-    qemu_free(list);
+    AFREE(addr);
+    AFREE(list);
 }
 
 int
diff --git a/vl-android-ui.c b/vl-android-ui.c
index dd20c80..d693d83 100644
--- a/vl-android-ui.c
+++ b/vl-android-ui.c
@@ -39,6 +39,7 @@
 #include "charpipe.h"
 #include "android/globals.h"
 #include "android/utils/bufprint.h"
+#include "android/utils/system.h"
 
 #ifdef CONFIG_MEMCHECK
 #include "memcheck/memcheck.h"
@@ -159,8 +160,6 @@
 int64_t ticks_per_sec;
 int vm_running;
 static int autostart;
-static int rtc_utc = 1;
-static int rtc_date_offset = -1; /* -1 means no change */
 QEMUClock *rtc_clock;
 #ifdef TARGET_SPARC
 int graphic_width = 1024;
@@ -204,10 +203,6 @@
 
 #define TFR(expr) do { if ((expr) != -1) break; } while (errno == EINTR)
 
-
-/***********************************************************/
-/* real time host monotonic timer */
-
 /* compute with 96 bit intermediate result: (a*b)/c */
 uint64_t muldiv64(uint64_t a, uint32_t b, uint32_t c)
 {
@@ -233,43 +228,6 @@
 }
 
 /***********************************************************/
-/* host time/date access */
-void qemu_get_timedate(struct tm *tm, int offset)
-{
-    time_t ti;
-    struct tm *ret;
-
-    time(&ti);
-    ti += offset;
-    if (rtc_date_offset == -1) {
-        if (rtc_utc)
-            ret = gmtime(&ti);
-        else
-            ret = localtime(&ti);
-    } else {
-        ti -= rtc_date_offset;
-        ret = gmtime(&ti);
-    }
-
-    memcpy(tm, ret, sizeof(struct tm));
-}
-
-int qemu_timedate_diff(struct tm *tm)
-{
-    time_t seconds;
-
-    if (rtc_date_offset == -1)
-        if (rtc_utc)
-            seconds = mktimegm(tm);
-        else
-            seconds = mktime(tm);
-    else
-        seconds = mktimegm(tm) + rtc_date_offset;
-
-    return seconds - time(NULL);
-}
-
-/***********************************************************/
 /* I/O handling */
 
 typedef struct IOHandlerRecord {
@@ -313,7 +271,7 @@
             if (ioh->fd == fd)
                 goto found;
         }
-        ioh = qemu_mallocz(sizeof(IOHandlerRecord));
+        ANEW0(ioh);
         ioh->next = first_io_handler;
         first_io_handler = ioh;
     found:
@@ -335,194 +293,6 @@
     return qemu_set_fd_handler2(fd, NULL, fd_read, fd_write, opaque);
 }
 
-#ifdef _WIN32
-/***********************************************************/
-/* Polling handling */
-
-typedef int PollingFunc(void *opaque);
-typedef void WaitObjectFunc(void *opaque);
-
-typedef struct PollingEntry {
-    PollingFunc *func;
-    void *opaque;
-    struct PollingEntry *next;
-} PollingEntry;
-
-static PollingEntry *first_polling_entry;
-
-int qemu_add_polling_cb(PollingFunc *func, void *opaque)
-{
-    PollingEntry **ppe, *pe;
-    pe = qemu_mallocz(sizeof(PollingEntry));
-    pe->func = func;
-    pe->opaque = opaque;
-    for(ppe = &first_polling_entry; *ppe != NULL; ppe = &(*ppe)->next);
-    *ppe = pe;
-    return 0;
-}
-
-void qemu_del_polling_cb(PollingFunc *func, void *opaque)
-{
-    PollingEntry **ppe, *pe;
-    for(ppe = &first_polling_entry; *ppe != NULL; ppe = &(*ppe)->next) {
-        pe = *ppe;
-        if (pe->func == func && pe->opaque == opaque) {
-            *ppe = pe->next;
-            qemu_free(pe);
-            break;
-        }
-    }
-}
-
-/***********************************************************/
-/* Wait objects support */
-typedef struct WaitObjects {
-    int num;
-    HANDLE events[MAXIMUM_WAIT_OBJECTS + 1];
-    WaitObjectFunc *func[MAXIMUM_WAIT_OBJECTS + 1];
-    void *opaque[MAXIMUM_WAIT_OBJECTS + 1];
-} WaitObjects;
-
-static WaitObjects wait_objects = {0};
-
-int qemu_add_wait_object(HANDLE handle, WaitObjectFunc *func, void *opaque)
-{
-    WaitObjects *w = &wait_objects;
-
-    if (w->num >= MAXIMUM_WAIT_OBJECTS)
-        return -1;
-    w->events[w->num] = handle;
-    w->func[w->num] = func;
-    w->opaque[w->num] = opaque;
-    w->num++;
-    return 0;
-}
-
-void qemu_del_wait_object(HANDLE handle, WaitObjectFunc *func, void *opaque)
-{
-    int i, found;
-    WaitObjects *w = &wait_objects;
-
-    found = 0;
-    for (i = 0; i < w->num; i++) {
-        if (w->events[i] == handle)
-            found = 1;
-        if (found) {
-            w->events[i] = w->events[i + 1];
-            w->func[i] = w->func[i + 1];
-            w->opaque[i] = w->opaque[i + 1];
-        }
-    }
-    if (found)
-        w->num--;
-}
-#endif
-
-
-/***********************************************************/
-/* bottom halves (can be seen as timers which expire ASAP) */
-
-struct QEMUBH {
-    QEMUBHFunc *cb;
-    void *opaque;
-    int scheduled;
-    int idle;
-    int deleted;
-    QEMUBH *next;
-};
-
-static QEMUBH *first_bh = NULL;
-
-QEMUBH *qemu_bh_new(QEMUBHFunc *cb, void *opaque)
-{
-    QEMUBH *bh;
-    bh = qemu_mallocz(sizeof(QEMUBH));
-    bh->cb = cb;
-    bh->opaque = opaque;
-    bh->next = first_bh;
-    first_bh = bh;
-    return bh;
-}
-
-int qemu_bh_poll(void)
-{
-    QEMUBH *bh, **bhp;
-    int ret;
-
-    ret = 0;
-    for (bh = first_bh; bh; bh = bh->next) {
-        if (!bh->deleted && bh->scheduled) {
-            bh->scheduled = 0;
-            if (!bh->idle)
-                ret = 1;
-            bh->idle = 0;
-            bh->cb(bh->opaque);
-        }
-    }
-
-    /* remove deleted bhs */
-    bhp = &first_bh;
-    while (*bhp) {
-        bh = *bhp;
-        if (bh->deleted) {
-            *bhp = bh->next;
-            qemu_free(bh);
-        } else
-            bhp = &bh->next;
-    }
-
-    return ret;
-}
-
-void qemu_bh_schedule_idle(QEMUBH *bh)
-{
-    if (bh->scheduled)
-        return;
-    bh->scheduled = 1;
-    bh->idle = 1;
-}
-
-void qemu_bh_schedule(QEMUBH *bh)
-{
-    if (bh->scheduled)
-        return;
-    bh->scheduled = 1;
-    bh->idle = 0;
-    /* stop the currently executing CPU to execute the BH ASAP */
-    //qemu_notify_event();
-}
-
-void qemu_bh_cancel(QEMUBH *bh)
-{
-    bh->scheduled = 0;
-}
-
-void qemu_bh_delete(QEMUBH *bh)
-{
-    bh->scheduled = 0;
-    bh->deleted = 1;
-}
-
-void qemu_bh_update_timeout(int *timeout)
-{
-    QEMUBH *bh;
-
-    for (bh = first_bh; bh; bh = bh->next) {
-        if (!bh->deleted && bh->scheduled) {
-            if (bh->idle) {
-                /* idle bottom halves will be polled at least
-                 * every 10ms */
-                *timeout = MIN(10, *timeout);
-            } else {
-                /* non-idle bottom halves will be executed
-                 * immediately */
-                *timeout = 0;
-                break;
-            }
-        }
-    }
-}
-
 /***********************************************************/
 /* main execution loop */
 
@@ -559,76 +329,11 @@
 
 
 
-#ifndef _WIN32
-static int io_thread_fd = -1;
-
-static void qemu_event_read(void *opaque)
-{
-    int fd = (unsigned long)opaque;
-    ssize_t len;
-
-    /* Drain the notify pipe */
-    do {
-        char buffer[512];
-        len = read(fd, buffer, sizeof(buffer));
-    } while ((len == -1 && errno == EINTR) || len > 0);
-}
-
 static int qemu_event_init(void)
 {
-    int err;
-    int fds[2];
-
-    err = pipe(fds);
-    if (err == -1)
-        return -errno;
-
-    err = fcntl_setfl(fds[0], O_NONBLOCK);
-    if (err < 0)
-        goto fail;
-
-    err = fcntl_setfl(fds[1], O_NONBLOCK);
-    if (err < 0)
-        goto fail;
-
-    qemu_set_fd_handler2(fds[0], NULL, qemu_event_read, NULL,
-                         (void *)(unsigned long)fds[0]);
-
-    io_thread_fd = fds[1];
-    return 0;
-
-fail:
-    close(fds[0]);
-    close(fds[1]);
-    return err;
-}
-#else
-HANDLE qemu_event_handle;
-
-static void dummy_event_handler(void *opaque)
-{
-}
-
-static int qemu_event_init(void)
-{
-    qemu_event_handle = CreateEvent(NULL, FALSE, FALSE, NULL);
-    if (!qemu_event_handle) {
-        perror("Failed CreateEvent");
-        return -1;
-    }
-    qemu_add_wait_object(qemu_event_handle, dummy_event_handler, NULL);
     return 0;
 }
 
-#if 0
-static void qemu_event_increment(void)
-{
-    SetEvent(qemu_event_handle);
-}
-#endif
-#endif
-
-#ifndef CONFIG_IOTHREAD
 static int qemu_init_main_loop(void)
 {
     return qemu_event_init();
@@ -637,128 +342,10 @@
 #define qemu_mutex_lock_iothread() do { } while (0)
 #define qemu_mutex_unlock_iothread() do { } while (0)
 
-#else /* CONFIG_IOTHREAD */
-
-#include "qemu-thread.h"
-
-QemuMutex qemu_global_mutex;
-static QemuMutex qemu_fair_mutex;
-
-static QemuThread io_thread;
-
-static QemuThread *tcg_cpu_thread;
-static QemuCond *tcg_halt_cond;
-
-static int qemu_system_ready;
-/* cpu creation */
-static QemuCond qemu_cpu_cond;
-/* system init */
-static QemuCond qemu_system_cond;
-static QemuCond qemu_pause_cond;
-
-static void block_io_signals(void);
-static void unblock_io_signals(void);
-
-static int qemu_init_main_loop(void)
-{
-    int ret;
-
-    ret = qemu_event_init();
-    if (ret)
-        return ret;
-
-    qemu_cond_init(&qemu_pause_cond);
-    qemu_mutex_init(&qemu_fair_mutex);
-    qemu_mutex_init(&qemu_global_mutex);
-    qemu_mutex_lock(&qemu_global_mutex);
-
-    unblock_io_signals();
-    qemu_thread_self(&io_thread);
-
-    return 0;
-}
-
-static void block_io_signals(void)
-{
-    sigset_t set;
-    struct sigaction sigact;
-
-    sigemptyset(&set);
-    sigaddset(&set, SIGUSR2);
-    sigaddset(&set, SIGIO);
-    sigaddset(&set, SIGALRM);
-    pthread_sigmask(SIG_BLOCK, &set, NULL);
-
-    sigemptyset(&set);
-    sigaddset(&set, SIGUSR1);
-    pthread_sigmask(SIG_UNBLOCK, &set, NULL);
-
-    memset(&sigact, 0, sizeof(sigact));
-    sigact.sa_handler = cpu_signal;
-    sigaction(SIGUSR1, &sigact, NULL);
-}
-
-static void unblock_io_signals(void)
-{
-    sigset_t set;
-
-    sigemptyset(&set);
-    sigaddset(&set, SIGUSR2);
-    sigaddset(&set, SIGIO);
-    sigaddset(&set, SIGALRM);
-    pthread_sigmask(SIG_UNBLOCK, &set, NULL);
-
-    sigemptyset(&set);
-    sigaddset(&set, SIGUSR1);
-    pthread_sigmask(SIG_BLOCK, &set, NULL);
-}
-
-#endif
-
 
 #ifdef _WIN32
 static void host_main_loop_wait(int *timeout)
 {
-    int ret, ret2, i;
-    PollingEntry *pe;
-
-
-    /* XXX: need to suppress polling by better using win32 events */
-    ret = 0;
-    for(pe = first_polling_entry; pe != NULL; pe = pe->next) {
-        ret |= pe->func(pe->opaque);
-    }
-    if (ret == 0) {
-        int err;
-        WaitObjects *w = &wait_objects;
-
-        ret = WaitForMultipleObjects(w->num, w->events, FALSE, *timeout);
-        if (WAIT_OBJECT_0 + 0 <= ret && ret <= WAIT_OBJECT_0 + w->num - 1) {
-            if (w->func[ret - WAIT_OBJECT_0])
-                w->func[ret - WAIT_OBJECT_0](w->opaque[ret - WAIT_OBJECT_0]);
-
-            /* Check for additional signaled events */
-            for(i = (ret - WAIT_OBJECT_0 + 1); i < w->num; i++) {
-
-                /* Check if event is signaled */
-                ret2 = WaitForSingleObject(w->events[i], 0);
-                if(ret2 == WAIT_OBJECT_0) {
-                    if (w->func[i])
-                        w->func[i](w->opaque[i]);
-                } else if (ret2 == WAIT_TIMEOUT) {
-                } else {
-                    err = GetLastError();
-                    fprintf(stderr, "WaitForSingleObject error %d %d\n", i, err);
-                }
-            }
-        } else if (ret == WAIT_TIMEOUT) {
-        } else {
-            err = GetLastError();
-            fprintf(stderr, "WaitForMultipleObjects error %d %d\n", ret, err);
-        }
-    }
-
-    *timeout = 0;
 }
 #else
 static void host_main_loop_wait(int *timeout)
@@ -773,8 +360,6 @@
     int ret, nfds;
     struct timeval tv;
 
-    qemu_bh_update_timeout(&timeout);
-
     host_main_loop_wait(&timeout);
 
     /* poll any events */
@@ -803,9 +388,7 @@
     tv.tv_sec = timeout / 1000;
     tv.tv_usec = (timeout % 1000) * 1000;
 
-    qemu_mutex_unlock_iothread();
     ret = select(nfds + 1, &rfds, &wfds, &xfds, &tv);
-    qemu_mutex_lock_iothread();
     if (ret > 0) {
         IOHandlerRecord **pioh;
 
@@ -818,34 +401,23 @@
             }
         }
 
-	/* remove deleted IO handlers */
-	pioh = &first_io_handler;
-	while (*pioh) {
+        /* remove deleted IO handlers */
+        pioh = &first_io_handler;
+        while (*pioh) {
             ioh = *pioh;
             if (ioh->deleted) {
                 *pioh = ioh->next;
-                qemu_free(ioh);
+                AFREE(ioh);
             } else
                 pioh = &ioh->next;
         }
     }
-    //charpipe_poll();
 
     qemu_run_all_timers();
-
-    /* Check bottom-halves last in case any of the earlier events triggered
-       them.  */
-    qemu_bh_poll();
-
 }
 
 static void main_loop(void)
 {
-#ifdef CONFIG_IOTHREAD
-    qemu_system_ready = 1;
-    qemu_cond_broadcast(&qemu_system_cond);
-#endif
-
     while (!shutdown_requested) {
         main_loop_wait(qemu_calculate_timeout());
     }
@@ -905,10 +477,10 @@
         abort();
     }
     len = strlen(data_dir) + strlen(name) + strlen(subdir) + 2;
-    buf = qemu_mallocz(len);
+    buf = android_alloc0(len);
     snprintf(buf, len, "%s/%s%s", data_dir, subdir, name);
     if (access(buf, R_OK)) {
-        qemu_free(buf);
+        AFREE(buf);
         return NULL;
     }
     return buf;
@@ -961,26 +533,6 @@
 
     autostart= 1;
 
-//    register_watchdogs();
-
-#if 0
-    /* Initialize boot properties. */
-    boot_property_init_service();
-
-    /* Initialize character map. */
-    if (android_charmap_setup(op_charmap_file)) {
-        if (op_charmap_file) {
-            fprintf(stderr,
-                    "Unable to initialize character map from file %s.\n",
-                    op_charmap_file);
-        } else {
-            fprintf(stderr,
-                    "Unable to initialize default character map.\n");
-        }
-        exit(1);
-    }
-#endif
-
     if (qemu_init_main_loop()) {
         fprintf(stderr, "qemu_init_main_loop failed\n");
         exit(1);