qemu-malloc.c: Remove qemu-specific heap routines.

Remove all uses of qemu_malloc/malloc0/realloc/free/strdup/etc to use
the equivalent GLib functions (g_malloc, g_free, ...) as per upstream.

This also removes qemu-malloc.c since it's no longer required.

Change-Id: I3c36a0396b73dd114b8da385b43f56a2e54dbb15
diff --git a/Makefile.common b/Makefile.common
index 6fc9989..97d883f 100644
--- a/Makefile.common
+++ b/Makefile.common
@@ -429,7 +429,6 @@
     iohandler.c \
     ioport.c \
     qemu-char.c \
-    qemu-malloc.c \
     readline.c \
     savevm.c \
     android/boot-properties.c \
diff --git a/aio-android.c b/aio-android.c
index 9b6035f..50a59bb 100644
--- a/aio-android.c
+++ b/aio-android.c
@@ -76,13 +76,13 @@
                  * releasing the walking_handlers lock.
                  */
                 QLIST_REMOVE(node, node);
-                qemu_free(node);
+                g_free(node);
             }
         }
     } else {
         if (node == NULL) {
             /* Alloc and insert if it's not already there */
-            node = qemu_mallocz(sizeof(AioHandler));
+            node = g_malloc0(sizeof(AioHandler));
             node->fd = fd;
             QLIST_INSERT_HEAD(&aio_handlers, node, node);
         }
@@ -217,7 +217,7 @@
 
                 if (tmp->deleted) {
                     QLIST_REMOVE(tmp, node);
-                    qemu_free(tmp);
+                    g_free(tmp);
                 }
             }
 
diff --git a/aio.c b/aio.c
index b0ea242..f23030d 100644
--- a/aio.c
+++ b/aio.c
@@ -75,13 +75,13 @@
                  * releasing the walking_handlers lock.
                  */
                 QLIST_REMOVE(node, node);
-                qemu_free(node);
+                g_free(node);
             }
         }
     } else {
         if (node == NULL) {
             /* Alloc and insert if it's not already there */
-            node = qemu_mallocz(sizeof(AioHandler));
+            node = g_malloc0(sizeof(AioHandler));
             node->fd = fd;
             QLIST_INSERT_HEAD(&aio_handlers, node, node);
         }
@@ -220,7 +220,7 @@
 
                 if (tmp->deleted) {
                     QLIST_REMOVE(tmp, node);
-                    qemu_free(tmp);
+                    g_free(tmp);
                 }
             }
 
diff --git a/android/looper-qemu.c b/android/looper-qemu.c
index 49f996f..32737da 100644
--- a/android/looper-qemu.c
+++ b/android/looper-qemu.c
@@ -140,7 +140,7 @@
 static QLoopIo*
 qloopio_new(int fd, LoopIoFunc callback, void* opaque, QLooper* qlooper)
 {
-    QLoopIo*  io = qemu_malloc(sizeof(*io));
+    QLoopIo*  io = g_malloc(sizeof(*io));
 
     io->fd = fd;
     io->user_callback = callback;
@@ -251,7 +251,7 @@
     /* make QEMU forget about this fd */
     qemu_set_fd_handler(io->fd, NULL, NULL, NULL);
     io->fd = -1;
-    qemu_free(io);
+    g_free(io);
 }
 
 static unsigned
@@ -400,13 +400,13 @@
         qloopio_free(io);
 
     qemu_bh_delete(looper->io_bh);
-    qemu_free(looper);
+    g_free(looper);
 }
 
 Looper*
 looper_newCore(void)
 {
-    QLooper*  looper = qemu_mallocz(sizeof(*looper));
+    QLooper*  looper = g_malloc0(sizeof(*looper));
 
     looper->io_list    = NULL;
     looper->io_pending = NULL;
diff --git a/android/protocol/core-commands-impl.c b/android/protocol/core-commands-impl.c
index 8d2596e..8ca18c0 100644
--- a/android/protocol/core-commands-impl.c
+++ b/android/protocol/core-commands-impl.c
@@ -89,7 +89,7 @@
         corecmd->cmd_param_buf = &corecmd->cmd_param[0];
     } else {
         // Expected request us too large to fit into preallocated buffer.
-        corecmd->cmd_param_buf = qemu_malloc(size);
+        corecmd->cmd_param_buf = g_malloc(size);
     }
     return corecmd->cmd_param_buf;
 }
@@ -100,7 +100,7 @@
 _free_cmd_param_buf(CoreCmdImpl* corecmd)
 {
     if (corecmd->cmd_param_buf != &corecmd->cmd_param[0]) {
-        qemu_free(corecmd->cmd_param_buf);
+        g_free(corecmd->cmd_param_buf);
         corecmd->cmd_param_buf = &corecmd->cmd_param[0];
     }
 }
@@ -227,7 +227,7 @@
                 }
                 // Allocate and initialize response data buffer.
                 resp_data =
-                    (UICmdGetNetSpeedResp*)qemu_malloc(resp.resp_data_size);
+                    (UICmdGetNetSpeedResp*)g_malloc(resp.resp_data_size);
                 resp_data->upload = netspeed->upload;
                 resp_data->download = netspeed->download;
                 strcpy(resp_data->name, netspeed->name);
@@ -240,7 +240,7 @@
             }
             _coreCmdImpl_respond(corecmd, &resp, resp_data);
             if (resp_data != NULL) {
-                qemu_free(resp_data);
+                g_free(resp_data);
             }
             break;
         }
@@ -271,7 +271,7 @@
                 }
                 // Allocate and initialize response data buffer.
                 resp_data =
-                    (UICmdGetNetDelayResp*)qemu_malloc(resp.resp_data_size);
+                    (UICmdGetNetDelayResp*)g_malloc(resp.resp_data_size);
                 resp_data->min_ms = netdelay->min_ms;
                 resp_data->max_ms = netdelay->max_ms;
                 strcpy(resp_data->name, netdelay->name);
@@ -284,7 +284,7 @@
             }
             _coreCmdImpl_respond(corecmd, &resp, resp_data);
             if (resp_data != NULL) {
-                qemu_free(resp_data);
+                g_free(resp_data);
             }
             break;
         }
@@ -303,7 +303,7 @@
             }
             _coreCmdImpl_respond(corecmd, &resp, filepath);
             if (filepath != NULL) {
-                qemu_free(filepath);
+                g_free(filepath);
             }
             break;
         }
diff --git a/android/protocol/core-commands-qemu.c b/android/protocol/core-commands-qemu.c
index d888f9b..0b662c5 100644
--- a/android/protocol/core-commands-qemu.c
+++ b/android/protocol/core-commands-qemu.c
@@ -97,7 +97,7 @@
     }
     strncpy(path, filepath, path_buf_size);
     path[path_buf_size - 1] = '\0';
-    qemu_free(filepath);
+    g_free(filepath);
     return 0;
 }
 
diff --git a/android/protocol/ui-commands-proxy.c b/android/protocol/ui-commands-proxy.c
index d16092a..22994c5 100644
--- a/android/protocol/ui-commands-proxy.c
+++ b/android/protocol/ui-commands-proxy.c
@@ -149,12 +149,12 @@
     const size_t cmd_size = sizeof(UICmdChangeDispBrightness) + strlen(light) + 1;
     // Allocate and initialize parameters.
     UICmdChangeDispBrightness* cmd =
-        (UICmdChangeDispBrightness*)qemu_malloc(cmd_size);
+        (UICmdChangeDispBrightness*)g_malloc(cmd_size);
     cmd->brightness = brightness;
     strcpy(cmd->light, light);
     // Send the command.
     _uiCmdProxy_send_command(AUICMD_CHANGE_DISP_BRIGHTNESS, cmd, cmd_size);
-    qemu_free(cmd);
+    g_free(cmd);
 }
 
 int
diff --git a/android/shaper.c b/android/shaper.c
index 4dbb8ea..c0690c2 100644
--- a/android/shaper.c
+++ b/android/shaper.c
@@ -72,7 +72,7 @@
     if (do_copy)
         packet_size += size;
 
-    packet = qemu_malloc(packet_size);
+    packet = g_malloc(packet_size);
     packet->next       = NULL;
     packet->expiration = 0;
     packet->size       = (size_t)size;
@@ -91,7 +91,7 @@
 queued_packet_free( QueuedPacket  packet )
 {
     if (packet) {
-        qemu_free( packet );
+        g_free( packet );
     }
 }
 
@@ -126,7 +126,7 @@
         qemu_del_timer(shaper->timer);
         qemu_free_timer(shaper->timer);
         shaper->timer = NULL;
-        qemu_free(shaper);
+        g_free(shaper);
     }
 }
 
@@ -162,7 +162,7 @@
 netshaper_create( int                do_copy,
                   NetShaperSendFunc  send_func )
 {
-    NetShaper  shaper = qemu_malloc(sizeof(*shaper));
+    NetShaper  shaper = g_malloc(sizeof(*shaper));
 
     shaper->active = 0;
     shaper->packets = NULL;
@@ -188,7 +188,7 @@
         QueuedPacket  packet = shaper->packets;
         shaper->packets = packet->next;
         shaper->send_func(packet->data, packet->size, packet->opaque);
-        qemu_free(packet);
+        g_free(packet);
         shaper->num_packets = 0;
     }
 
@@ -311,7 +311,7 @@
             queued_packet_free(session->packet);
             session->packet = NULL;
         }
-        qemu_free( session );
+        g_free( session );
     }
 }
 
@@ -459,7 +459,7 @@
 NetDelay
 netdelay_create( NetShaperSendFunc  send_func )
 {
-    NetDelay  delay = qemu_malloc(sizeof(*delay));
+    NetDelay  delay = g_malloc(sizeof(*delay));
 
     delay->sessions     = NULL;
     delay->num_sessions = 0;
@@ -547,7 +547,7 @@
                     latency += rand() % range;
 
                     //fprintf(stderr, "NetDelay:RST: delay creation for %s\n", session_to_string(info) );
-                session = qemu_malloc( sizeof(*session) );
+                session = g_malloc( sizeof(*session) );
 
                 session->next        = delay->sessions;
                 delay->sessions      = session;
@@ -584,7 +584,7 @@
             delay->num_sessions -= 1;
         }
         delay->active = 0;
-        qemu_free( delay );
+        g_free( delay );
     }
 }
 
diff --git a/arch_init.c b/arch_init.c
index 098bf1e..4ad6a02 100644
--- a/arch_init.c
+++ b/arch_init.c
@@ -236,7 +236,7 @@
     QLIST_FOREACH(block, &ram_list.blocks, next) {
         ++n;
     }
-    blocks = qemu_malloc(n * sizeof *blocks);
+    blocks = g_malloc(n * sizeof *blocks);
     n = 0;
     QLIST_FOREACH_SAFE(block, &ram_list.blocks, next, nblock) {
         blocks[n++] = block;
@@ -246,7 +246,7 @@
     while (--n >= 0) {
         QLIST_INSERT_HEAD(&ram_list.blocks, blocks[n], next);
     }
-    qemu_free(blocks);
+    g_free(blocks);
 }
 
 int ram_save_live(QEMUFile *f, int stage, void *opaque)
diff --git a/async.c b/async.c
index a6078c5..8db64e3 100644
--- a/async.c
+++ b/async.c
@@ -64,7 +64,7 @@
  */
 void async_context_push(void)
 {
-    struct AsyncContext *new = qemu_mallocz(sizeof(*new));
+    struct AsyncContext *new = g_malloc0(sizeof(*new));
     new->parent = async_context;
     new->id = async_context->id + 1;
     async_context = new;
@@ -75,7 +75,7 @@
 {
     QEMUBH **bh = opaque;
     qemu_bh_delete(*bh);
-    qemu_free(bh);
+    g_free(bh);
     qemu_aio_process_queue();
 }
 /*
@@ -92,14 +92,14 @@
 
     /* Switch back to the parent context */
     async_context = async_context->parent;
-    qemu_free(old);
+    g_free(old);
 
     if (async_context == NULL) {
         abort();
     }
 
     /* Schedule BH to run any queued AIO completions as soon as possible */
-    bh = qemu_malloc(sizeof(*bh));
+    bh = g_malloc(sizeof(*bh));
     *bh = qemu_bh_new(bh_run_aio_completions, bh);
     qemu_bh_schedule(*bh);
 }
@@ -127,7 +127,7 @@
 QEMUBH *qemu_bh_new(QEMUBHFunc *cb, void *opaque)
 {
     QEMUBH *bh;
-    bh = qemu_mallocz(sizeof(QEMUBH));
+    bh = g_malloc0(sizeof(QEMUBH));
     bh->cb = cb;
     bh->opaque = opaque;
     bh->next = async_context->first_bh;
@@ -157,7 +157,7 @@
         bh = *bhp;
         if (bh->deleted) {
             *bhp = bh->next;
-            qemu_free(bh);
+            g_free(bh);
         } else
             bhp = &bh->next;
     }
diff --git a/audio/alsaaudio.c b/audio/alsaaudio.c
index cd54733..61b6316 100644
--- a/audio/alsaaudio.c
+++ b/audio/alsaaudio.c
@@ -208,7 +208,7 @@
         for (i = 0; i < hlp->count; ++i) {
             qemu_set_fd_handler (pfds[i].fd, NULL, NULL, NULL);
         }
-        qemu_free (pfds);
+        g_free (pfds);
     }
     hlp->pfds = NULL;
     hlp->count = 0;
@@ -332,7 +332,7 @@
     if (err < 0) {
         alsa_logerr (err, "Could not initialize poll mode\n"
                      "Could not obtain poll descriptors\n");
-        qemu_free (pfds);
+        g_free (pfds);
         return -1;
     }
 
@@ -360,7 +360,7 @@
             while (i--) {
                 qemu_set_fd_handler (pfds[i].fd, NULL, NULL, NULL);
             }
-            qemu_free (pfds);
+            g_free (pfds);
             return -1;
         }
     }
@@ -869,7 +869,7 @@
     alsa_anal_close (&alsa->handle, &alsa->pollhlp);
 
     if (alsa->pcm_buf) {
-        qemu_free (alsa->pcm_buf);
+        g_free (alsa->pcm_buf);
         alsa->pcm_buf = NULL;
     }
 }
@@ -1039,7 +1039,7 @@
     alsa_anal_close (&alsa->handle, &alsa->pollhlp);
 
     if (alsa->pcm_buf) {
-        qemu_free (alsa->pcm_buf);
+        g_free (alsa->pcm_buf);
         alsa->pcm_buf = NULL;
     }
 }
diff --git a/audio/audio.c b/audio/audio.c
index 0303958..2d2a5b5 100644
--- a/audio/audio.c
+++ b/audio/audio.c
@@ -286,7 +286,7 @@
         return NULL;
     }
 
-    return qemu_mallocz (len);
+    return g_malloc0 (len);
 }
 
 static char *audio_alloc_prefix (const char *s)
@@ -300,7 +300,7 @@
     }
 
     len = strlen (s);
-    r = qemu_malloc (len + sizeof (qemu_prefix));
+    r = g_malloc (len + sizeof (qemu_prefix));
 
     u = r + sizeof (qemu_prefix) - 1;
 
@@ -522,7 +522,7 @@
         printf ("    %s\n", opt->descr);
     }
 
-    qemu_free (uprefix);
+    g_free (uprefix);
 }
 
 static void audio_process_options (const char *prefix,
@@ -559,7 +559,7 @@
          * (includes trailing zero) + zero + underscore (on behalf of
          * sizeof) */
         optlen = len + preflen + sizeof (qemu_prefix) + 1;
-        optname = qemu_malloc (optlen);
+        optname = g_malloc (optlen);
 
         pstrcpy (optname, optlen, qemu_prefix);
 
@@ -604,7 +604,7 @@
             opt->overriddenp = &opt->overridden;
         }
         *opt->overriddenp = !def;
-        qemu_free (optname);
+        g_free (optname);
     }
 }
 
@@ -877,7 +877,7 @@
 
         QLIST_REMOVE (sw, entries);
         QLIST_REMOVE (sc, entries);
-        qemu_free (sc);
+        g_free (sc);
         if (was_active) {
             /* We have removed soft voice from the capture:
                this might have changed the overall status of the capture
@@ -917,7 +917,7 @@
         sw->rate = st_rate_start (sw->info.freq, hw_cap->info.freq);
         if (!sw->rate) {
             dolog ("Could not start rate conversion for `%s'\n", SW_NAME (sw));
-            qemu_free (sw);
+            g_free (sw);
             return -1;
         }
         QLIST_INSERT_HEAD (&hw_cap->sw_head, sw, entries);
@@ -2054,7 +2054,7 @@
 void AUD_register_card (const char *name, QEMUSoundCard *card)
 {
     audio_init ();
-    card->name = qemu_strdup (name);
+    card->name = g_strdup (name);
     memset (&card->entries, 0, sizeof (card->entries));
     QLIST_INSERT_HEAD (&glob_audio_state.card_head, card, entries);
 }
@@ -2062,7 +2062,7 @@
 void AUD_remove_card (QEMUSoundCard *card)
 {
     QLIST_REMOVE (card, entries);
-    qemu_free (card->name);
+    g_free (card->name);
 }
 
 
@@ -2147,11 +2147,11 @@
         return cap;
 
     err3:
-        qemu_free (cap->hw.mix_buf);
+        g_free (cap->hw.mix_buf);
     err2:
-        qemu_free (cap);
+        g_free (cap);
     err1:
-        qemu_free (cb);
+        g_free (cb);
     err0:
         return NULL;
     }
@@ -2165,7 +2165,7 @@
         if (cb->opaque == cb_opaque) {
             cb->ops.destroy (cb_opaque);
             QLIST_REMOVE (cb, entries);
-            qemu_free (cb);
+            g_free (cb);
 
             if (!cap->cb_head.lh_first) {
                 SWVoiceOut *sw = cap->hw.sw_head.lh_first, *sw1;
@@ -2183,11 +2183,11 @@
                     }
                     QLIST_REMOVE (sw, entries);
                     QLIST_REMOVE (sc, entries);
-                    qemu_free (sc);
+                    g_free (sc);
                     sw = sw1;
                 }
                 QLIST_REMOVE (cap, entries);
-                qemu_free (cap);
+                g_free (cap);
             }
             return;
         }
diff --git a/audio/audio_template.h b/audio/audio_template.h
index c0d07e5..9637045 100644
--- a/audio/audio_template.h
+++ b/audio/audio_template.h
@@ -72,7 +72,7 @@
 static void glue (audio_pcm_hw_free_resources_, TYPE) (HW *hw)
 {
     if (HWBUF) {
-        qemu_free (HWBUF);
+        g_free (HWBUF);
     }
 
     HWBUF = NULL;
@@ -93,7 +93,7 @@
 static void glue (audio_pcm_sw_free_resources_, TYPE) (SW *sw)
 {
     if (sw->buf) {
-        qemu_free (sw->buf);
+        g_free (sw->buf);
     }
 
     if (sw->rate) {
@@ -127,7 +127,7 @@
     sw->rate = st_rate_start (sw->hw->info.freq, sw->info.freq);
 #endif
     if (!sw->rate) {
-        qemu_free (sw->buf);
+        g_free (sw->buf);
         sw->buf = NULL;
         return -1;
     }
@@ -164,10 +164,10 @@
         [sw->info.swap_endianness]
         [audio_bits_to_index (sw->info.bits)];
 
-    sw->name = qemu_strdup (name);
+    sw->name = g_strdup (name);
     err = glue (audio_pcm_sw_alloc_resources_, TYPE) (sw);
     if (err) {
-        qemu_free (sw->name);
+        g_free (sw->name);
         sw->name = NULL;
     }
     return err;
@@ -177,7 +177,7 @@
 {
     glue (audio_pcm_sw_free_resources_, TYPE) (sw);
     if (sw->name) {
-        qemu_free (sw->name);
+        g_free (sw->name);
         sw->name = NULL;
     }
 }
@@ -207,7 +207,7 @@
         BEGIN_NOSIGALRM
         glue (hw->pcm_ops->fini_, TYPE) (hw);
         END_NOSIGALRM
-        qemu_free (hw);
+        g_free (hw);
         *hwp = NULL;
     }
 }
@@ -311,7 +311,7 @@
     glue (hw->pcm_ops->fini_, TYPE) (hw);
     END_NOSIGALRM
  err0:
-    qemu_free (hw);
+    g_free (hw);
     return NULL;
 }
 
@@ -379,7 +379,7 @@
     glue (audio_pcm_hw_del_sw_, TYPE) (sw);
     glue (audio_pcm_hw_gc_, TYPE) (&hw);
 err2:
-    qemu_free (sw);
+    g_free (sw);
 err1:
     return NULL;
 }
@@ -389,7 +389,7 @@
     glue (audio_pcm_sw_fini_, TYPE) (sw);
     glue (audio_pcm_hw_del_sw_, TYPE) (sw);
     glue (audio_pcm_hw_gc_, TYPE) (&sw->hw);
-    qemu_free (sw);
+    g_free (sw);
 }
 
 void glue (AUD_close_, TYPE) (QEMUSoundCard *card, SW *sw)
diff --git a/audio/esdaudio.c b/audio/esdaudio.c
index 5b6f6ff..6815a98 100644
--- a/audio/esdaudio.c
+++ b/audio/esdaudio.c
@@ -284,7 +284,7 @@
     esd->fd = -1;
 
  fail1:
-    qemu_free (esd->pcm_buf);
+    g_free (esd->pcm_buf);
     esd->pcm_buf = NULL;
     return -1;
 }
@@ -308,7 +308,7 @@
 
     audio_pt_fini (&esd->pt, AUDIO_FUNC);
 
-    qemu_free (esd->pcm_buf);
+    g_free (esd->pcm_buf);
     esd->pcm_buf = NULL;
 }
 
@@ -492,7 +492,7 @@
     esd->fd = -1;
 
  fail1:
-    qemu_free (esd->pcm_buf);
+    g_free (esd->pcm_buf);
     esd->pcm_buf = NULL;
     return -1;
 }
@@ -516,7 +516,7 @@
 
     audio_pt_fini (&esd->pt, AUDIO_FUNC);
 
-    qemu_free (esd->pcm_buf);
+    g_free (esd->pcm_buf);
     esd->pcm_buf = NULL;
 }
 
diff --git a/audio/mixeng.c b/audio/mixeng.c
index 9f1d93f..3f876e7 100644
--- a/audio/mixeng.c
+++ b/audio/mixeng.c
@@ -326,7 +326,7 @@
 
 void st_rate_stop (void *opaque)
 {
-    qemu_free (opaque);
+    g_free (opaque);
 }
 
 void mixeng_clear (struct st_sample *buf, int len)
diff --git a/audio/ossaudio.c b/audio/ossaudio.c
index 127c9a5..17d980f 100644
--- a/audio/ossaudio.c
+++ b/audio/ossaudio.c
@@ -498,7 +498,7 @@
             }
         }
         else {
-            qemu_free (oss->pcm_buf);
+            g_free (oss->pcm_buf);
         }
         oss->pcm_buf = NULL;
     }
@@ -731,7 +731,7 @@
     oss_anal_close (&oss->fd);
 
     if (oss->pcm_buf) {
-        qemu_free (oss->pcm_buf);
+        g_free (oss->pcm_buf);
         oss->pcm_buf = NULL;
     }
 }
diff --git a/audio/paaudio.c b/audio/paaudio.c
index da05671..baa3342 100644
--- a/audio/paaudio.c
+++ b/audio/paaudio.c
@@ -367,7 +367,7 @@
     return 0;
 
  fail3:
-    qemu_free (pa->pcm_buf);
+    g_free (pa->pcm_buf);
     pa->pcm_buf = NULL;
  fail2:
     FF(pa_simple_free) (pa->s);
@@ -421,7 +421,7 @@
     return 0;
 
  fail3:
-    qemu_free (pa->pcm_buf);
+    g_free (pa->pcm_buf);
     pa->pcm_buf = NULL;
  fail2:
     FF(pa_simple_free) (pa->s);
@@ -446,7 +446,7 @@
     }
 
     audio_pt_fini (&pa->pt, AUDIO_FUNC);
-    qemu_free (pa->pcm_buf);
+    g_free (pa->pcm_buf);
     pa->pcm_buf = NULL;
 }
 
@@ -466,7 +466,7 @@
     }
 
     audio_pt_fini (&pa->pt, AUDIO_FUNC);
-    qemu_free (pa->pcm_buf);
+    g_free (pa->pcm_buf);
     pa->pcm_buf = NULL;
 }
 
diff --git a/audio/wavaudio.c b/audio/wavaudio.c
index 7ed0db7..7213407 100644
--- a/audio/wavaudio.c
+++ b/audio/wavaudio.c
@@ -165,7 +165,7 @@
     if (!wav->f) {
         dolog ("Failed to open wave file `%s'\nReason: %s\n",
                conf_out.wav_path, strerror (errno));
-        qemu_free (wav->pcm_buf);
+        g_free (wav->pcm_buf);
         wav->pcm_buf = NULL;
         return -1;
     }
@@ -198,7 +198,7 @@
     qemu_fclose (wav->f);
     wav->f = NULL;
 
-    qemu_free (wav->pcm_buf);
+    g_free (wav->pcm_buf);
     wav->pcm_buf = NULL;
 }
 
@@ -338,7 +338,7 @@
     qemu_fclose (wav->f);
     wav->f = NULL;
 
-    qemu_free (wav->pcm_buf);
+    g_free (wav->pcm_buf);
     wav->pcm_buf = NULL;
 }
 
diff --git a/audio/wavcapture.c b/audio/wavcapture.c
index 151acdf..4d9b15d 100644
--- a/audio/wavcapture.c
+++ b/audio/wavcapture.c
@@ -48,7 +48,7 @@
         qemu_fclose (wav->f);
     }
 
-    qemu_free (wav->path);
+    g_free (wav->path);
 }
 
 static void wav_capture (void *opaque, void *buf, int size)
@@ -120,7 +120,7 @@
     ops.capture = wav_capture;
     ops.destroy = wav_destroy;
 
-    wav = qemu_mallocz (sizeof (*wav));
+    wav = g_malloc0 (sizeof (*wav));
 
     shift = bits16 + stereo;
     hdr[34] = bits16 ? 0x10 : 0x08;
@@ -134,11 +134,11 @@
     if (!wav->f) {
         monitor_printf(mon, "Failed to open wave file `%s'\nReason: %s\n",
                        path, strerror (errno));
-        qemu_free (wav);
+        g_free (wav);
         return -1;
     }
 
-    wav->path = qemu_strdup (path);
+    wav->path = g_strdup (path);
     wav->bits = bits;
     wav->nchannels = nchannels;
     wav->freq = freq;
@@ -148,9 +148,9 @@
     cap = AUD_add_capture (&as, &ops, wav);
     if (!cap) {
         monitor_printf(mon, "Failed to add audio capture\n");
-        qemu_free (wav->path);
+        g_free (wav->path);
         qemu_fclose (wav->f);
-        qemu_free (wav);
+        g_free (wav);
         return -1;
     }
 
diff --git a/audio/winaudio.c b/audio/winaudio.c
index 5c2c6b9..b2540f1 100644
--- a/audio/winaudio.c
+++ b/audio/winaudio.c
@@ -144,7 +144,7 @@
     }

 

     if (s->buffer_bytes != NULL) {

-        qemu_free(s->buffer_bytes);

+        g_free(s->buffer_bytes);

         s->buffer_bytes = NULL;

     }

 

@@ -204,7 +204,7 @@
     }

 

     samples_size    = format.nBlockAlign * conf.nb_samples;

-    s->buffer_bytes = qemu_malloc( NUM_OUT_BUFFERS * samples_size );

+    s->buffer_bytes = g_malloc( NUM_OUT_BUFFERS * samples_size );

     if (s->buffer_bytes == NULL) {

             waveOutClose( s->waveout );

             s->waveout = NULL;

@@ -390,7 +390,7 @@
     }

 

     if (s->buffer_bytes != NULL) {

-        qemu_free(s->buffer_bytes);

+        g_free(s->buffer_bytes);

         s->buffer_bytes = NULL;

     }

 

@@ -448,7 +448,7 @@
     }

 

     samples_size    = format.nBlockAlign * conf.nb_samples;

-    s->buffer_bytes = qemu_malloc( NUM_IN_BUFFERS * samples_size );

+    s->buffer_bytes = g_malloc( NUM_IN_BUFFERS * samples_size );

     if (s->buffer_bytes == NULL) {

             waveInClose( s->wavein );

             s->wavein = NULL;

diff --git a/backends/msmouse.c b/backends/msmouse.c
index acb4488..41edff3 100644
--- a/backends/msmouse.c
+++ b/backends/msmouse.c
@@ -61,14 +61,14 @@
 
 static void msmouse_chr_close (struct CharDriverState *chr)
 {
-    qemu_free (chr);
+    g_free (chr);
 }
 
 CharDriverState *qemu_chr_open_msmouse(QemuOpts *opts)
 {
     CharDriverState *chr;
 
-    chr = qemu_mallocz(sizeof(CharDriverState));
+    chr = g_malloc0(sizeof(CharDriverState));
     chr->chr_write = msmouse_chr_write;
     chr->chr_close = msmouse_chr_close;
 
diff --git a/block.c b/block.c
index 7952690..b82d600 100644
--- a/block.c
+++ b/block.c
@@ -157,7 +157,7 @@
 {
     BlockDriverState *bs;
 
-    bs = qemu_mallocz(sizeof(BlockDriverState));
+    bs = g_malloc0(sizeof(BlockDriverState));
     pstrcpy(bs->device_name, sizeof(bs->device_name), device_name);
     if (device_name[0] != '\0') {
         QTAILQ_INSERT_TAIL(&bdrv_states, bs, list);
@@ -429,7 +429,7 @@
     }
 
     bs->drv = drv;
-    bs->opaque = qemu_mallocz(drv->instance_size);
+    bs->opaque = g_malloc0(drv->instance_size);
 
     /*
      * Yes, BDRV_O_NOCACHE aka O_DIRECT means we have to present a
@@ -486,7 +486,7 @@
         bdrv_delete(bs->file);
         bs->file = NULL;
     }
-    qemu_free(bs->opaque);
+    g_free(bs->opaque);
     bs->opaque = NULL;
     bs->drv = NULL;
     return ret;
@@ -656,7 +656,7 @@
             bs->backing_hd = NULL;
         }
         bs->drv->bdrv_close(bs);
-        qemu_free(bs->opaque);
+        g_free(bs->opaque);
 #ifdef _WIN32
         if (bs->is_temporary) {
             unlink(bs->filename);
@@ -700,7 +700,7 @@
     }
 
     assert(bs != bs_snapshots);
-    qemu_free(bs);
+    g_free(bs);
 }
 
 int bdrv_attach(BlockDriverState *bs, DeviceState *qdev)
@@ -792,7 +792,7 @@
     }
 
     total_sectors = bdrv_getlength(bs) >> BDRV_SECTOR_BITS;
-    buf = qemu_malloc(COMMIT_BUF_SECTORS * BDRV_SECTOR_SIZE);
+    buf = g_malloc(COMMIT_BUF_SECTORS * BDRV_SECTOR_SIZE);
 
     for (sector = 0; sector < total_sectors; sector += n) {
         if (drv->bdrv_is_allocated(bs, sector, COMMIT_BUF_SECTORS, &n)) {
@@ -822,7 +822,7 @@
         bdrv_flush(bs->backing_hd);
 
 ro_cleanup:
-    qemu_free(buf);
+    g_free(buf);
 
     if (ro) {
         /* re-open as RO */
@@ -2054,7 +2054,7 @@
         if (mcb->callbacks[i].free_qiov) {
             qemu_iovec_destroy(mcb->callbacks[i].free_qiov);
         }
-        qemu_free(mcb->callbacks[i].free_qiov);
+        g_free(mcb->callbacks[i].free_qiov);
         qemu_vfree(mcb->callbacks[i].free_buf);
     }
 }
@@ -2070,7 +2070,7 @@
     mcb->num_requests--;
     if (mcb->num_requests == 0) {
         multiwrite_user_cb(mcb);
-        qemu_free(mcb);
+        g_free(mcb);
     }
 }
 
@@ -2130,7 +2130,7 @@
 
         if (merge) {
             size_t size;
-            QEMUIOVector *qiov = qemu_mallocz(sizeof(*qiov));
+            QEMUIOVector *qiov = g_malloc0(sizeof(*qiov));
             qemu_iovec_init(qiov,
                 reqs[outidx].qiov->niov + reqs[i].qiov->niov + 1);
 
@@ -2191,7 +2191,7 @@
     }
 
     // Create MultiwriteCB structure
-    mcb = qemu_mallocz(sizeof(*mcb) + num_reqs * sizeof(*mcb->callbacks));
+    mcb = g_malloc0(sizeof(*mcb) + num_reqs * sizeof(*mcb->callbacks));
     mcb->num_requests = 0;
     mcb->num_callbacks = num_reqs;
 
@@ -2251,7 +2251,7 @@
     for (i = 0; i < mcb->num_callbacks; i++) {
         reqs[i].error = -EIO;
     }
-    qemu_free(mcb);
+    g_free(mcb);
     return -1;
 }
 
@@ -2488,7 +2488,7 @@
         acb = pool->free_aiocb;
         pool->free_aiocb = acb->next;
     } else {
-        acb = qemu_mallocz(pool->aiocb_size);
+        acb = g_malloc0(pool->aiocb_size);
         acb->pool = pool;
     }
     acb->bs = bs;
@@ -2628,11 +2628,11 @@
                     BDRV_SECTORS_PER_DIRTY_CHUNK * 8 - 1;
             bitmap_size /= BDRV_SECTORS_PER_DIRTY_CHUNK * 8;
 
-            bs->dirty_bitmap = qemu_mallocz(bitmap_size);
+            bs->dirty_bitmap = g_malloc0(bitmap_size);
         }
     } else {
         if (bs->dirty_bitmap) {
-            qemu_free(bs->dirty_bitmap);
+            g_free(bs->dirty_bitmap);
             bs->dirty_bitmap = NULL;
         }
     }
diff --git a/block/bochs.c b/block/bochs.c
index 4c445b5..478852e 100644
--- a/block/bochs.c
+++ b/block/bochs.c
@@ -136,7 +136,7 @@
     }
 
     s->catalog_size = le32_to_cpu(bochs.extra.redolog.catalog);
-    s->catalog_bitmap = qemu_malloc(s->catalog_size * 4);
+    s->catalog_bitmap = g_malloc(s->catalog_size * 4);
     if (bdrv_pread(bs->file, le32_to_cpu(bochs.header), s->catalog_bitmap,
                    s->catalog_size * 4) != s->catalog_size * 4)
 	goto fail;
@@ -210,7 +210,7 @@
 static void bochs_close(BlockDriverState *bs)
 {
     BDRVBochsState *s = bs->opaque;
-    qemu_free(s->catalog_bitmap);
+    g_free(s->catalog_bitmap);
 }
 
 static BlockDriver bdrv_bochs = {
diff --git a/block/cloop.c b/block/cloop.c
index 3ba2027..62d6449 100644
--- a/block/cloop.c
+++ b/block/cloop.c
@@ -70,7 +70,7 @@
 
     /* read offsets */
     offsets_size = s->n_blocks * sizeof(uint64_t);
-    s->offsets = qemu_malloc(offsets_size);
+    s->offsets = g_malloc(offsets_size);
     if (bdrv_pread(bs->file, 128 + 4 + 4, s->offsets, offsets_size) <
             offsets_size) {
 	goto cloop_close;
@@ -85,8 +85,8 @@
     }
 
     /* initialize zlib engine */
-    s->compressed_block = qemu_malloc(max_compressed_block_size+1);
-    s->uncompressed_block = qemu_malloc(s->block_size);
+    s->compressed_block = g_malloc(max_compressed_block_size+1);
+    s->uncompressed_block = g_malloc(s->block_size);
     if(inflateInit(&s->zstream) != Z_OK)
 	goto cloop_close;
     s->current_block=s->n_blocks;
diff --git a/block/dmg.c b/block/dmg.c
index 49f0caf..1206ac2 100644
--- a/block/dmg.c
+++ b/block/dmg.c
@@ -127,11 +127,11 @@
 
 	    chunk_count = (count-204)/40;
 	    new_size = sizeof(uint64_t) * (s->n_chunks + chunk_count);
-	    s->types = qemu_realloc(s->types, new_size/2);
-	    s->offsets = qemu_realloc(s->offsets, new_size);
-	    s->lengths = qemu_realloc(s->lengths, new_size);
-	    s->sectors = qemu_realloc(s->sectors, new_size);
-	    s->sectorcounts = qemu_realloc(s->sectorcounts, new_size);
+	    s->types = g_realloc(s->types, new_size/2);
+	    s->offsets = g_realloc(s->offsets, new_size);
+	    s->lengths = g_realloc(s->lengths, new_size);
+	    s->sectors = g_realloc(s->sectors, new_size);
+	    s->sectorcounts = g_realloc(s->sectorcounts, new_size);
 
 	    for(i=s->n_chunks;i<s->n_chunks+chunk_count;i++) {
 		s->types[i] = read_uint32(bs, offset);
@@ -170,8 +170,8 @@
     }
 
     /* initialize zlib engine */
-    s->compressed_chunk = qemu_malloc(max_compressed_size+1);
-    s->uncompressed_chunk = qemu_malloc(512*max_sectors_per_chunk);
+    s->compressed_chunk = g_malloc(max_compressed_size+1);
+    s->uncompressed_chunk = g_malloc(512*max_sectors_per_chunk);
     if(inflateInit(&s->zstream) != Z_OK)
 	goto fail;
 
diff --git a/block/parallels.c b/block/parallels.c
index 61c7a0f..9aed8c5 100644
--- a/block/parallels.c
+++ b/block/parallels.c
@@ -88,7 +88,7 @@
     s->tracks = le32_to_cpu(ph.tracks);
 
     s->catalog_size = le32_to_cpu(ph.catalog_entries);
-    s->catalog_bitmap = qemu_malloc(s->catalog_size * 4);
+    s->catalog_bitmap = g_malloc(s->catalog_size * 4);
     if (bdrv_pread(bs->file, 64, s->catalog_bitmap, s->catalog_size * 4) !=
 	s->catalog_size * 4)
 	goto fail;
@@ -98,7 +98,7 @@
     return 0;
 fail:
     if (s->catalog_bitmap)
-	qemu_free(s->catalog_bitmap);
+	g_free(s->catalog_bitmap);
     return -1;
 }
 
@@ -137,7 +137,7 @@
 static void parallels_close(BlockDriverState *bs)
 {
     BDRVParallelsState *s = bs->opaque;
-    qemu_free(s->catalog_bitmap);
+    g_free(s->catalog_bitmap);
 }
 
 static BlockDriver bdrv_parallels = {
diff --git a/block/qcow.c b/block/qcow.c
index 6d7da92..1ec7d64 100644
--- a/block/qcow.c
+++ b/block/qcow.c
@@ -129,7 +129,7 @@
     s->l1_size = (header.size + (1LL << shift) - 1) >> shift;
 
     s->l1_table_offset = header.l1_table_offset;
-    s->l1_table = qemu_malloc(s->l1_size * sizeof(uint64_t));
+    s->l1_table = g_malloc(s->l1_size * sizeof(uint64_t));
     if (!s->l1_table)
         goto fail;
     if (bdrv_pread(bs->file, s->l1_table_offset, s->l1_table, s->l1_size * sizeof(uint64_t)) !=
@@ -139,13 +139,13 @@
         be64_to_cpus(&s->l1_table[i]);
     }
     /* alloc L2 cache */
-    s->l2_cache = qemu_malloc(s->l2_size * L2_CACHE_SIZE * sizeof(uint64_t));
+    s->l2_cache = g_malloc(s->l2_size * L2_CACHE_SIZE * sizeof(uint64_t));
     if (!s->l2_cache)
         goto fail;
-    s->cluster_cache = qemu_malloc(s->cluster_size);
+    s->cluster_cache = g_malloc(s->cluster_size);
     if (!s->cluster_cache)
         goto fail;
-    s->cluster_data = qemu_malloc(s->cluster_size);
+    s->cluster_data = g_malloc(s->cluster_size);
     if (!s->cluster_data)
         goto fail;
     s->cluster_cache_offset = -1;
@@ -162,10 +162,10 @@
     return 0;
 
  fail:
-    qemu_free(s->l1_table);
-    qemu_free(s->l2_cache);
-    qemu_free(s->cluster_cache);
-    qemu_free(s->cluster_data);
+    g_free(s->l1_table);
+    g_free(s->l2_cache);
+    g_free(s->cluster_cache);
+    g_free(s->cluster_data);
     return -1;
 }
 
@@ -681,7 +681,7 @@
     }
     if (s->crypt_method) {
         if (!acb->cluster_data) {
-            acb->cluster_data = qemu_mallocz(s->cluster_size);
+            acb->cluster_data = g_malloc0(s->cluster_size);
             if (!acb->cluster_data) {
                 ret = -ENOMEM;
                 goto done;
@@ -733,10 +733,10 @@
 static void qcow_close(BlockDriverState *bs)
 {
     BDRVQcowState *s = bs->opaque;
-    qemu_free(s->l1_table);
-    qemu_free(s->l2_cache);
-    qemu_free(s->cluster_cache);
-    qemu_free(s->cluster_data);
+    g_free(s->l1_table);
+    g_free(s->l2_cache);
+    g_free(s->cluster_cache);
+    g_free(s->cluster_data);
 }
 
 static int qcow_create(const char *filename, QEMUOptionParameter *options)
@@ -864,7 +864,7 @@
     if (nb_sectors != s->cluster_sectors)
         return -EINVAL;
 
-    out_buf = qemu_malloc(s->cluster_size + (s->cluster_size / 1000) + 128);
+    out_buf = g_malloc(s->cluster_size + (s->cluster_size / 1000) + 128);
     if (!out_buf)
         return -1;
 
@@ -874,7 +874,7 @@
                        Z_DEFLATED, -12,
                        9, Z_DEFAULT_STRATEGY);
     if (ret != 0) {
-        qemu_free(out_buf);
+        g_free(out_buf);
         return -1;
     }
 
@@ -885,7 +885,7 @@
 
     ret = deflate(&strm, Z_FINISH);
     if (ret != Z_STREAM_END && ret != Z_OK) {
-        qemu_free(out_buf);
+        g_free(out_buf);
         deflateEnd(&strm);
         return -1;
     }
@@ -901,12 +901,12 @@
                                             out_len, 0, 0);
         cluster_offset &= s->cluster_offset_mask;
         if (bdrv_pwrite(bs->file, cluster_offset, out_buf, out_len) != out_len) {
-            qemu_free(out_buf);
+            g_free(out_buf);
             return -1;
         }
     }
 
-    qemu_free(out_buf);
+    g_free(out_buf);
     return 0;
 }
 
diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
index 949e377..cb970b9 100644
--- a/block/qcow2-cluster.c
+++ b/block/qcow2-cluster.c
@@ -50,14 +50,14 @@
 #endif
 
     new_l1_size2 = sizeof(uint64_t) * new_l1_size;
-    new_l1_table = qemu_mallocz(align_offset(new_l1_size2, 512));
+    new_l1_table = g_malloc0(align_offset(new_l1_size2, 512));
     memcpy(new_l1_table, s->l1_table, s->l1_size * sizeof(uint64_t));
 
     /* write new table (align to cluster) */
     BLKDBG_EVENT(bs->file, BLKDBG_L1_GROW_ALLOC_TABLE);
     new_l1_table_offset = qcow2_alloc_clusters(bs, new_l1_size2);
     if (new_l1_table_offset < 0) {
-        qemu_free(new_l1_table);
+        g_free(new_l1_table);
         return new_l1_table_offset;
     }
 
@@ -78,14 +78,14 @@
     if (ret < 0) {
         goto fail;
     }
-    qemu_free(s->l1_table);
+    g_free(s->l1_table);
     qcow2_free_clusters(bs, s->l1_table_offset, s->l1_size * sizeof(uint64_t));
     s->l1_table_offset = new_l1_table_offset;
     s->l1_table = new_l1_table;
     s->l1_size = new_l1_size;
     return 0;
  fail:
-    qemu_free(new_l1_table);
+    g_free(new_l1_table);
     qcow2_free_clusters(bs, new_l1_table_offset, new_l1_size2);
     return ret;
 }
@@ -674,7 +674,7 @@
     if (m->nb_clusters == 0)
         return 0;
 
-    old_cluster = qemu_malloc(m->nb_clusters * sizeof(uint64_t));
+    old_cluster = g_malloc(m->nb_clusters * sizeof(uint64_t));
 
     /* copy content of unmodified sectors */
     start_sect = (m->offset & ~(s->cluster_size - 1)) >> 9;
@@ -724,7 +724,7 @@
 
     ret = 0;
 err:
-    qemu_free(old_cluster);
+    g_free(old_cluster);
     return ret;
  }
 
diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c
index d59c466..546634d 100644
--- a/block/qcow2-refcount.c
+++ b/block/qcow2-refcount.c
@@ -61,9 +61,9 @@
     BDRVQcowState *s = bs->opaque;
     int ret, refcount_table_size2, i;
 
-    s->refcount_block_cache = qemu_malloc(s->cluster_size);
+    s->refcount_block_cache = g_malloc(s->cluster_size);
     refcount_table_size2 = s->refcount_table_size * sizeof(uint64_t);
-    s->refcount_table = qemu_malloc(refcount_table_size2);
+    s->refcount_table = g_malloc(refcount_table_size2);
     if (s->refcount_table_size > 0) {
         BLKDBG_EVENT(bs->file, BLKDBG_REFTABLE_LOAD);
         ret = bdrv_pread(bs->file, s->refcount_table_offset,
@@ -81,8 +81,8 @@
 void qcow2_refcount_close(BlockDriverState *bs)
 {
     BDRVQcowState *s = bs->opaque;
-    qemu_free(s->refcount_block_cache);
-    qemu_free(s->refcount_table);
+    g_free(s->refcount_block_cache);
+    g_free(s->refcount_table);
 }
 
 
@@ -335,8 +335,8 @@
     uint64_t meta_offset = (blocks_used * refcount_block_clusters) *
         s->cluster_size;
     uint64_t table_offset = meta_offset + blocks_clusters * s->cluster_size;
-    uint16_t *new_blocks = qemu_mallocz(blocks_clusters * s->cluster_size);
-    uint64_t *new_table = qemu_mallocz(table_size * sizeof(uint64_t));
+    uint16_t *new_blocks = g_malloc0(blocks_clusters * s->cluster_size);
+    uint64_t *new_table = g_malloc0(table_size * sizeof(uint64_t));
 
     assert(meta_offset >= (s->free_cluster_index * s->cluster_size));
 
@@ -361,7 +361,7 @@
     BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_ALLOC_WRITE_BLOCKS);
     ret = bdrv_pwrite_sync(bs->file, meta_offset, new_blocks,
         blocks_clusters * s->cluster_size);
-    qemu_free(new_blocks);
+    g_free(new_blocks);
     if (ret < 0) {
         goto fail_table;
     }
@@ -397,7 +397,7 @@
     uint64_t old_table_offset = s->refcount_table_offset;
     uint64_t old_table_size = s->refcount_table_size;
 
-    qemu_free(s->refcount_table);
+    g_free(s->refcount_table);
     s->refcount_table = new_table;
     s->refcount_table_size = table_size;
     s->refcount_table_offset = table_offset;
@@ -415,7 +415,7 @@
     return new_block;
 
 fail_table:
-    qemu_free(new_table);
+    g_free(new_table);
 fail_block:
     s->refcount_block_cache_offset = 0;
     return ret;
@@ -758,7 +758,7 @@
     l1_size2 = l1_size * sizeof(uint64_t);
     if (l1_table_offset != s->l1_table_offset) {
         if (l1_size2 != 0) {
-            l1_table = qemu_mallocz(align_offset(l1_size2, 512));
+            l1_table = g_malloc0(align_offset(l1_size2, 512));
         } else {
             l1_table = NULL;
         }
@@ -775,7 +775,7 @@
     }
 
     l2_size = s->l2_size * sizeof(uint64_t);
-    l2_table = qemu_malloc(l2_size);
+    l2_table = g_malloc(l2_size);
     l1_modified = 0;
     for(i = 0; i < l1_size; i++) {
         l2_offset = l1_table[i];
@@ -857,15 +857,15 @@
             be64_to_cpus(&l1_table[i]);
     }
     if (l1_allocated)
-        qemu_free(l1_table);
-    qemu_free(l2_table);
+        g_free(l1_table);
+    g_free(l2_table);
     cache_refcount_updates = 0;
     write_refcount_block(bs);
     return 0;
  fail:
     if (l1_allocated)
-        qemu_free(l1_table);
-    qemu_free(l2_table);
+        g_free(l1_table);
+    g_free(l2_table);
     cache_refcount_updates = 0;
     write_refcount_block(bs);
     return -EIO;
@@ -941,7 +941,7 @@
 
     /* Read L2 table from disk */
     l2_size = s->l2_size * sizeof(uint64_t);
-    l2_table = qemu_malloc(l2_size);
+    l2_table = g_malloc(l2_size);
 
     if (bdrv_pread(bs->file, l2_offset, l2_table, l2_size) != l2_size)
         goto fail;
@@ -999,12 +999,12 @@
         }
     }
 
-    qemu_free(l2_table);
+    g_free(l2_table);
     return 0;
 
 fail:
     fprintf(stderr, "ERROR: I/O error in check_refcounts_l2\n");
-    qemu_free(l2_table);
+    g_free(l2_table);
     return -EIO;
 }
 
@@ -1037,7 +1037,7 @@
     if (l1_size2 == 0) {
         l1_table = NULL;
     } else {
-        l1_table = qemu_malloc(l1_size2);
+        l1_table = g_malloc(l1_size2);
         if (bdrv_pread(bs->file, l1_table_offset,
                        l1_table, l1_size2) != l1_size2)
             goto fail;
@@ -1085,13 +1085,13 @@
             }
         }
     }
-    qemu_free(l1_table);
+    g_free(l1_table);
     return 0;
 
 fail:
     fprintf(stderr, "ERROR: I/O error in check_refcounts_l1\n");
     res->check_errors++;
-    qemu_free(l1_table);
+    g_free(l1_table);
     return -EIO;
 }
 
@@ -1112,7 +1112,7 @@
 
     size = bdrv_getlength(bs->file);
     nb_clusters = size_to_clusters(s, size);
-    refcount_table = qemu_mallocz(nb_clusters * sizeof(uint16_t));
+    refcount_table = g_malloc0(nb_clusters * sizeof(uint16_t));
 
     /* header */
     inc_refcounts(bs, res, refcount_table, nb_clusters,
@@ -1195,7 +1195,7 @@
         }
     }
 
-    qemu_free(refcount_table);
+    g_free(refcount_table);
 
     return 0;
 }
diff --git a/block/qcow2-snapshot.c b/block/qcow2-snapshot.c
index 56871d9..1ccfc13 100644
--- a/block/qcow2-snapshot.c
+++ b/block/qcow2-snapshot.c
@@ -52,10 +52,10 @@
     int i;
 
     for(i = 0; i < s->nb_snapshots; i++) {
-        qemu_free(s->snapshots[i].name);
-        qemu_free(s->snapshots[i].id_str);
+        g_free(s->snapshots[i].name);
+        g_free(s->snapshots[i].id_str);
     }
-    qemu_free(s->snapshots);
+    g_free(s->snapshots);
     s->snapshots = NULL;
     s->nb_snapshots = 0;
 }
@@ -76,7 +76,7 @@
     }
 
     offset = s->snapshots_offset;
-    s->snapshots = qemu_mallocz(s->nb_snapshots * sizeof(QCowSnapshot));
+    s->snapshots = g_malloc0(s->nb_snapshots * sizeof(QCowSnapshot));
     for(i = 0; i < s->nb_snapshots; i++) {
         offset = align_offset(offset, 8);
         if (bdrv_pread(bs->file, offset, &h, sizeof(h)) != sizeof(h))
@@ -96,13 +96,13 @@
 
         offset += extra_data_size;
 
-        sn->id_str = qemu_malloc(id_str_size + 1);
+        sn->id_str = g_malloc(id_str_size + 1);
         if (bdrv_pread(bs->file, offset, sn->id_str, id_str_size) != id_str_size)
             goto fail;
         offset += id_str_size;
         sn->id_str[id_str_size] = '\0';
 
-        sn->name = qemu_malloc(name_size + 1);
+        sn->name = g_malloc(name_size + 1);
         if (bdrv_pread(bs->file, offset, sn->name, name_size) != name_size)
             goto fail;
         offset += name_size;
@@ -251,10 +251,10 @@
     if (find_snapshot_by_id(bs, sn_info->id_str) >= 0)
         return -ENOENT;
 
-    sn->id_str = qemu_strdup(sn_info->id_str);
+    sn->id_str = g_strdup(sn_info->id_str);
     if (!sn->id_str)
         goto fail;
-    sn->name = qemu_strdup(sn_info->name);
+    sn->name = g_strdup(sn_info->name);
     if (!sn->name)
         goto fail;
     sn->vm_state_size = sn_info->vm_state_size;
@@ -276,7 +276,7 @@
     sn->l1_size = s->l1_size;
 
     if (s->l1_size != 0) {
-        l1_table = qemu_malloc(s->l1_size * sizeof(uint64_t));
+        l1_table = g_malloc(s->l1_size * sizeof(uint64_t));
     } else {
         l1_table = NULL;
     }
@@ -287,13 +287,13 @@
     if (bdrv_pwrite_sync(bs->file, sn->l1_table_offset,
                     l1_table, s->l1_size * sizeof(uint64_t)) < 0)
         goto fail;
-    qemu_free(l1_table);
+    g_free(l1_table);
     l1_table = NULL;
 
-    snapshots1 = qemu_malloc((s->nb_snapshots + 1) * sizeof(QCowSnapshot));
+    snapshots1 = g_malloc((s->nb_snapshots + 1) * sizeof(QCowSnapshot));
     if (s->snapshots) {
         memcpy(snapshots1, s->snapshots, s->nb_snapshots * sizeof(QCowSnapshot));
-        qemu_free(s->snapshots);
+        g_free(s->snapshots);
     }
     s->snapshots = snapshots1;
     s->snapshots[s->nb_snapshots++] = *sn;
@@ -305,8 +305,8 @@
 #endif
     return 0;
  fail:
-    qemu_free(sn->name);
-    qemu_free(l1_table);
+    g_free(sn->name);
+    g_free(l1_table);
     return -1;
 }
 
@@ -372,8 +372,8 @@
         return ret;
     qcow2_free_clusters(bs, sn->l1_table_offset, sn->l1_size * sizeof(uint64_t));
 
-    qemu_free(sn->id_str);
-    qemu_free(sn->name);
+    g_free(sn->id_str);
+    g_free(sn->name);
     memmove(sn, sn + 1, (s->nb_snapshots - snapshot_index - 1) * sizeof(*sn));
     s->nb_snapshots--;
     ret = qcow_write_snapshots(bs);
@@ -399,7 +399,7 @@
         return s->nb_snapshots;
     }
 
-    sn_tab = qemu_mallocz(s->nb_snapshots * sizeof(QEMUSnapshotInfo));
+    sn_tab = g_malloc0(s->nb_snapshots * sizeof(QEMUSnapshotInfo));
     for(i = 0; i < s->nb_snapshots; i++) {
         sn_info = sn_tab + i;
         sn = s->snapshots + i;
diff --git a/block/qcow2.c b/block/qcow2.c
index 5b24fe2..752c06a 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -194,7 +194,7 @@
         goto fail;
     s->l1_table_offset = header.l1_table_offset;
     if (s->l1_size > 0) {
-        s->l1_table = qemu_mallocz(
+        s->l1_table = g_malloc0(
             align_offset(s->l1_size * sizeof(uint64_t), 512));
         if (bdrv_pread(bs->file, s->l1_table_offset, s->l1_table, s->l1_size * sizeof(uint64_t)) !=
             s->l1_size * sizeof(uint64_t))
@@ -204,10 +204,10 @@
         }
     }
     /* alloc L2 cache */
-    s->l2_cache = qemu_malloc(s->l2_size * L2_CACHE_SIZE * sizeof(uint64_t));
-    s->cluster_cache = qemu_malloc(s->cluster_size);
+    s->l2_cache = g_malloc(s->l2_size * L2_CACHE_SIZE * sizeof(uint64_t));
+    s->cluster_cache = g_malloc(s->cluster_size);
     /* one more sector for decompressed data alignment */
-    s->cluster_data = qemu_malloc(QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size
+    s->cluster_data = g_malloc(QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size
                                   + 512);
     s->cluster_cache_offset = -1;
 
@@ -244,10 +244,10 @@
  fail:
     qcow2_free_snapshots(bs);
     qcow2_refcount_close(bs);
-    qemu_free(s->l1_table);
-    qemu_free(s->l2_cache);
-    qemu_free(s->cluster_cache);
-    qemu_free(s->cluster_data);
+    g_free(s->l1_table);
+    g_free(s->l2_cache);
+    g_free(s->cluster_cache);
+    g_free(s->cluster_data);
     return -1;
 }
 
@@ -606,7 +606,7 @@
 
     if (s->crypt_method) {
         if (!acb->cluster_data) {
-            acb->cluster_data = qemu_mallocz(QCOW_MAX_CRYPT_CLUSTERS *
+            acb->cluster_data = g_malloc0(QCOW_MAX_CRYPT_CLUSTERS *
                                              s->cluster_size);
         }
         qcow2_encrypt_sectors(s, acb->sector_num, acb->cluster_data, acb->buf,
@@ -661,10 +661,10 @@
 static void qcow_close(BlockDriverState *bs)
 {
     BDRVQcowState *s = bs->opaque;
-    qemu_free(s->l1_table);
-    qemu_free(s->l2_cache);
-    qemu_free(s->cluster_cache);
-    qemu_free(s->cluster_data);
+    g_free(s->l1_table);
+    g_free(s->l2_cache);
+    g_free(s->cluster_cache);
+    g_free(s->cluster_data);
     qcow2_refcount_close(bs);
 }
 
@@ -934,7 +934,7 @@
 
     } while (ref_clusters != old_ref_clusters);
 
-    s->refcount_table = qemu_mallocz(reftable_clusters * s->cluster_size);
+    s->refcount_table = g_malloc0(reftable_clusters * s->cluster_size);
 
     s->refcount_table_offset = offset;
     header.refcount_table_offset = cpu_to_be64(offset);
@@ -947,7 +947,7 @@
         offset += s->cluster_size;
     }
 
-    s->refcount_block = qemu_mallocz(ref_clusters * s->cluster_size);
+    s->refcount_block = g_malloc0(ref_clusters * s->cluster_size);
 
     /* update refcounts */
     qcow2_create_refcount_update(s, 0, header_size);
@@ -1023,8 +1023,8 @@
 
     ret = 0;
 exit:
-    qemu_free(s->refcount_table);
-    qemu_free(s->refcount_block);
+    g_free(s->refcount_table);
+    g_free(s->refcount_block);
     close(fd);
 
     /* Preallocate metadata */
@@ -1167,7 +1167,7 @@
     if (nb_sectors != s->cluster_sectors)
         return -EINVAL;
 
-    out_buf = qemu_malloc(s->cluster_size + (s->cluster_size / 1000) + 128);
+    out_buf = g_malloc(s->cluster_size + (s->cluster_size / 1000) + 128);
 
     /* best compression, small window, no zlib header */
     memset(&strm, 0, sizeof(strm));
@@ -1175,7 +1175,7 @@
                        Z_DEFLATED, -12,
                        9, Z_DEFAULT_STRATEGY);
     if (ret != 0) {
-        qemu_free(out_buf);
+        g_free(out_buf);
         return -1;
     }
 
@@ -1186,7 +1186,7 @@
 
     ret = deflate(&strm, Z_FINISH);
     if (ret != Z_STREAM_END && ret != Z_OK) {
-        qemu_free(out_buf);
+        g_free(out_buf);
         deflateEnd(&strm);
         return -1;
     }
@@ -1205,12 +1205,12 @@
         cluster_offset &= s->cluster_offset_mask;
         BLKDBG_EVENT(bs->file, BLKDBG_WRITE_COMPRESSED);
         if (bdrv_pwrite(bs->file, cluster_offset, out_buf, out_len) != out_len) {
-            qemu_free(out_buf);
+            g_free(out_buf);
             return -1;
         }
     }
 
-    qemu_free(out_buf);
+    g_free(out_buf);
     return 0;
 }
 
diff --git a/block/raw.c b/block/raw.c
index a9c6b88..3c618d9 100644
--- a/block/raw.c
+++ b/block/raw.c
@@ -113,7 +113,7 @@
     }
 
     qemu_iovec_destroy(&b->qiov);
-    qemu_free(b);
+    g_free(b);
 }
 
 static BlockDriverAIOCB *raw_aio_writev(BlockDriverState *bs,
@@ -147,7 +147,7 @@
 
         /* adjust request to be everything but first sector */
 
-        b = qemu_malloc(sizeof(*b));
+        b = g_malloc(sizeof(*b));
         b->cb = cb;
         b->opaque = opaque;
 
@@ -245,7 +245,7 @@
 static BlockDriver bdrv_raw = {
     .format_name        = "raw",
 
-    /* It's really 0, but we need to make qemu_malloc() happy */
+    /* It's really 0, but we need to make g_malloc() happy */
     .instance_size      = 1,
 
     .bdrv_open          = raw_open,
diff --git a/block/vmdk.c b/block/vmdk.c
index 600b554..0a22e14 100644
--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -287,7 +287,7 @@
     gd_size = gde_entries * sizeof(uint32_t);
 
     /* write RGD */
-    rgd_buf = qemu_malloc(gd_size);
+    rgd_buf = g_malloc(gd_size);
     if (lseek(p_fd, rgd_offset, SEEK_SET) == -1) {
         ret = -errno;
         goto fail_rgd;
@@ -306,7 +306,7 @@
     }
 
     /* write GD */
-    gd_buf = qemu_malloc(gd_size);
+    gd_buf = g_malloc(gd_size);
     if (lseek(p_fd, gd_offset, SEEK_SET) == -1) {
         ret = -errno;
         goto fail_gd;
@@ -326,9 +326,9 @@
     ret = 0;
 
 fail_gd:
-    qemu_free(gd_buf);
+    g_free(gd_buf);
 fail_rgd:
-    qemu_free(rgd_buf);
+    g_free(rgd_buf);
 fail:
     close(p_fd);
     close(snp_fd);
@@ -408,7 +408,7 @@
 
     /* read the L1 table */
     l1_size = s->l1_size * sizeof(uint32_t);
-    s->l1_table = qemu_malloc(l1_size);
+    s->l1_table = g_malloc(l1_size);
     if (bdrv_pread(bs->file, s->l1_table_offset, s->l1_table, l1_size) != l1_size)
         goto fail;
     for(i = 0; i < s->l1_size; i++) {
@@ -416,7 +416,7 @@
     }
 
     if (s->l1_backup_table_offset) {
-        s->l1_backup_table = qemu_malloc(l1_size);
+        s->l1_backup_table = g_malloc(l1_size);
         if (bdrv_pread(bs->file, s->l1_backup_table_offset, s->l1_backup_table, l1_size) != l1_size)
             goto fail;
         for(i = 0; i < s->l1_size; i++) {
@@ -424,12 +424,12 @@
         }
     }
 
-    s->l2_cache = qemu_malloc(s->l2_size * L2_CACHE_SIZE * sizeof(uint32_t));
+    s->l2_cache = g_malloc(s->l2_size * L2_CACHE_SIZE * sizeof(uint32_t));
     return 0;
  fail:
-    qemu_free(s->l1_backup_table);
-    qemu_free(s->l1_table);
-    qemu_free(s->l2_cache);
+    g_free(s->l1_backup_table);
+    g_free(s->l1_table);
+    g_free(s->l2_cache);
     return -1;
 }
 
@@ -819,8 +819,8 @@
 {
     BDRVVmdkState *s = bs->opaque;
 
-    qemu_free(s->l1_table);
-    qemu_free(s->l2_cache);
+    g_free(s->l1_table);
+    g_free(s->l2_cache);
 }
 
 static void vmdk_flush(BlockDriverState *bs)
diff --git a/block/vpc.c b/block/vpc.c
index d1d0913..9adaa75 100644
--- a/block/vpc.c
+++ b/block/vpc.c
@@ -192,7 +192,7 @@
     s->bitmap_size = ((s->block_size / (8 * 512)) + 511) & ~511;
 
     s->max_table_entries = be32_to_cpu(dyndisk_header->max_table_entries);
-    s->pagetable = qemu_malloc(s->max_table_entries * 4);
+    s->pagetable = g_malloc(s->max_table_entries * 4);
 
     s->bat_offset = be64_to_cpu(dyndisk_header->table_offset);
     if (bdrv_pread(bs->file, s->bat_offset, s->pagetable,
@@ -216,7 +216,7 @@
     s->last_bitmap_offset = (int64_t) -1;
 
 #ifdef CACHE
-    s->pageentry_u8 = qemu_malloc(512);
+    s->pageentry_u8 = g_malloc(512);
     s->pageentry_u32 = s->pageentry_u8;
     s->pageentry_u16 = s->pageentry_u8;
     s->last_pagetable = -1;
@@ -602,9 +602,9 @@
 static void vpc_close(BlockDriverState *bs)
 {
     BDRVVPCState *s = bs->opaque;
-    qemu_free(s->pagetable);
+    g_free(s->pagetable);
 #ifdef CACHE
-    qemu_free(s->pageentry_u8);
+    g_free(s->pageentry_u8);
 #endif
 }
 
diff --git a/block/vvfat.c b/block/vvfat.c
index 5b631fb..0871352 100644
--- a/block/vvfat.c
+++ b/block/vvfat.c
@@ -101,7 +101,7 @@
 {
     if((index + 1) * array->item_size > array->size) {
 	int new_size = (index + 32) * array->item_size;
-	array->pointer = qemu_realloc(array->pointer, new_size);
+	array->pointer = g_realloc(array->pointer, new_size);
 	if (!array->pointer)
 	    return -1;
 	array->size = new_size;
@@ -127,7 +127,7 @@
 static inline void* array_insert(array_t* array,unsigned int index,unsigned int count) {
     if((array->next+count)*array->item_size>array->size) {
 	int increment=count*array->item_size;
-	array->pointer=qemu_realloc(array->pointer,array->size+increment);
+	array->pointer=g_realloc(array->pointer,array->size+increment);
 	if(!array->pointer)
             return NULL;
 	array->size+=increment;
@@ -159,7 +159,7 @@
     is=array->item_size;
     from=array->pointer+index_from*is;
     to=array->pointer+index_to*is;
-    buf=qemu_malloc(is*count);
+    buf=g_malloc(is*count);
     memcpy(buf,from,is*count);
 
     if(index_to<index_from)
@@ -728,7 +728,7 @@
 	if(first_cluster == 0 && (is_dotdot || is_dot))
 	    continue;
 
-	buffer=(char*)qemu_malloc(length);
+	buffer=(char*)g_malloc(length);
 	snprintf(buffer,length,"%s/%s",dirname,entry->d_name);
 
 	if(stat(buffer,&st)<0) {
@@ -849,7 +849,7 @@
     memset(&(s->first_sectors[0]),0,0x40*0x200);
 
     s->cluster_size=s->sectors_per_cluster*0x200;
-    s->cluster_buffer=qemu_malloc(s->cluster_size);
+    s->cluster_buffer=g_malloc(s->cluster_size);
 
     /*
      * The formula: sc = spf+1+spf*spc*(512*8/fat_type),
@@ -883,7 +883,7 @@
     mapping->dir_index = 0;
     mapping->info.dir.parent_mapping_index = -1;
     mapping->first_mapping_index = -1;
-    mapping->path = qemu_strdup(dirname);
+    mapping->path = g_strdup(dirname);
     i = strlen(mapping->path);
     if (i > 0 && mapping->path[i - 1] == '/')
 	mapping->path[i - 1] = '\0';
@@ -1637,10 +1637,10 @@
 
 	    /* rename */
 	    if (strcmp(basename, basename2))
-		schedule_rename(s, cluster_num, qemu_strdup(path));
+		schedule_rename(s, cluster_num, g_strdup(path));
 	} else if (is_file(direntry))
 	    /* new file */
-	    schedule_new_file(s, qemu_strdup(path), cluster_num);
+	    schedule_new_file(s, g_strdup(path), cluster_num);
 	else {
             abort();
 	    return 0;
@@ -1734,7 +1734,7 @@
 	int cluster_num, const char* path)
 {
     int ret = 0;
-    unsigned char* cluster = qemu_malloc(s->cluster_size);
+    unsigned char* cluster = g_malloc(s->cluster_size);
     direntry_t* direntries = (direntry_t*)cluster;
     mapping_t* mapping = find_mapping_for_cluster(s, cluster_num);
 
@@ -1757,10 +1757,10 @@
 	mapping->mode &= ~MODE_DELETED;
 
 	if (strcmp(basename, basename2))
-	    schedule_rename(s, cluster_num, qemu_strdup(path));
+	    schedule_rename(s, cluster_num, g_strdup(path));
     } else
 	/* new directory */
-	schedule_mkdir(s, cluster_num, qemu_strdup(path));
+	schedule_mkdir(s, cluster_num, g_strdup(path));
 
     lfn_init(&lfn);
     do {
@@ -1875,7 +1875,7 @@
      */
     if (s->fat2 == NULL) {
 	int size = 0x200 * s->sectors_per_fat;
-	s->fat2 = qemu_malloc(size);
+	s->fat2 = g_malloc(size);
 	memcpy(s->fat2, s->fat.pointer, size);
     }
     check = vvfat_read(s->bs,
@@ -2217,7 +2217,7 @@
     uint32_t first_cluster = c;
     mapping_t* mapping = find_mapping_for_cluster(s, c);
     uint32_t size = filesize_of_direntry(direntry);
-    char* cluster = qemu_malloc(s->cluster_size);
+    char* cluster = g_malloc(s->cluster_size);
     uint32_t i;
     int fd = 0;
 
@@ -2383,7 +2383,7 @@
 			    mapping_t* m = find_mapping_for_cluster(s,
 				    begin_of_direntry(d));
 			    int l = strlen(m->path);
-			    char* new_path = qemu_malloc(l + diff + 1);
+			    char* new_path = g_malloc(l + diff + 1);
 
 			    assert(!strncmp(m->path, mapping->path, l2));
 
@@ -2788,7 +2788,7 @@
 
     array_init(&(s->commits), sizeof(commit_t));
 
-    s->qcow_filename = qemu_malloc(1024);
+    s->qcow_filename = g_malloc(1024);
     get_tmp_filename(s->qcow_filename, 1024);
 
     bdrv_qcow = bdrv_find_format("qcow");
diff --git a/blockdev.c b/blockdev.c
index 3388c0d..08fdf57 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -111,7 +111,7 @@
     qemu_opts_del(dinfo->opts);
     bdrv_delete(dinfo->bdrv);
     QTAILQ_REMOVE(&drives, dinfo, next);
-    qemu_free(dinfo);
+    g_free(dinfo);
 }
 
 static int parse_block_error_action(const char *buf, int is_read)
@@ -396,12 +396,12 @@
 
     /* init */
 
-    dinfo = qemu_mallocz(sizeof(*dinfo));
+    dinfo = g_malloc0(sizeof(*dinfo));
     if ((buf = qemu_opts_id(opts)) != NULL) {
-        dinfo->id = qemu_strdup(buf);
+        dinfo->id = g_strdup(buf);
     } else {
         /* no id supplied -> create one */
-        dinfo->id = qemu_mallocz(32);
+        dinfo->id = g_malloc0(32);
         if (type == IF_IDE || type == IF_SCSI)
             mediastr = (media == MEDIA_CDROM) ? "-cd" : "-hd";
         if (max_devs)
diff --git a/bt-host.c b/bt-host.c
index b45c977..f80e685 100644
--- a/bt-host.c
+++ b/bt-host.c
@@ -177,7 +177,7 @@
     }
 # endif
 
-    s = qemu_mallocz(sizeof(struct bt_host_hci_s));
+    s = g_malloc0(sizeof(struct bt_host_hci_s));
     s->fd = fd;
     s->hci.cmd_send = bt_host_cmd;
     s->hci.sco_send = bt_host_sco;
diff --git a/bt-vhci.c b/bt-vhci.c
index b6b670f..c0e1d5c 100644
--- a/bt-vhci.c
+++ b/bt-vhci.c
@@ -156,7 +156,7 @@
         exit(-1);
     }
 
-    s = qemu_mallocz(sizeof(struct bt_vhci_s));
+    s = g_malloc0(sizeof(struct bt_vhci_s));
     s->fd = fd;
     s->info = info ?: qemu_next_hci();
     s->info->opaque = s;
diff --git a/buffered_file.c b/buffered_file.c
index 185ef57..a16da03 100644
--- a/buffered_file.c
+++ b/buffered_file.c
@@ -56,7 +56,7 @@
 
         s->buffer_capacity += size + 1024;
 
-        tmp = qemu_realloc(s->buffer, s->buffer_capacity);
+        tmp = g_realloc(s->buffer, s->buffer_capacity);
         if (tmp == NULL) {
             fprintf(stderr, "qemu file buffer expansion failed\n");
             exit(1);
@@ -183,8 +183,8 @@
 
     qemu_del_timer(s->timer);
     qemu_free_timer(s->timer);
-    qemu_free(s->buffer);
-    qemu_free(s);
+    g_free(s->buffer);
+    g_free(s);
 
     return ret;
 }
@@ -259,7 +259,7 @@
 {
     QEMUFileBuffered *s;
 
-    s = qemu_mallocz(sizeof(*s));
+    s = g_malloc0(sizeof(*s));
 
     s->opaque = opaque;
     s->xfer_limit = bytes_per_sec / 10;
diff --git a/cpus.c b/cpus.c
index 91db3a0..c4e8eea 100644
--- a/cpus.c
+++ b/cpus.c
@@ -515,8 +515,8 @@
     CPUState *env = _env;
     /* share a single thread for all cpus with TCG */
     if (!tcg_cpu_thread) {
-        env->thread = qemu_mallocz(sizeof(QemuThread));
-        env->halt_cond = qemu_mallocz(sizeof(QemuCond));
+        env->thread = g_malloc0(sizeof(QemuThread));
+        env->halt_cond = g_malloc0(sizeof(QemuCond));
         qemu_cond_init(env->halt_cond);
         qemu_thread_create(env->thread, tcg_cpu_thread_fn, env);
         while (env->created == 0)
@@ -533,8 +533,8 @@
 {
 #if 0
     kvm_init_vcpu(env);
-    env->thread = qemu_mallocz(sizeof(QemuThread));
-    env->halt_cond = qemu_mallocz(sizeof(QemuCond));
+    env->thread = g_malloc0(sizeof(QemuThread));
+    env->halt_cond = g_malloc0(sizeof(QemuCond));
     qemu_cond_init(env->halt_cond);
     qemu_thread_create(env->thread, kvm_cpu_thread_fn, env);
     while (env->created == 0)
diff --git a/device_tree.c b/device_tree.c
index a9642f4..2e941b8 100644
--- a/device_tree.c
+++ b/device_tree.c
@@ -43,7 +43,7 @@
     /* Expand to 2x size to give enough room for manipulation.  */
     dt_size *= 2;
     /* First allocate space in qemu for device tree */
-    fdt = qemu_mallocz(dt_size);
+    fdt = g_malloc0(dt_size);
 
     dt_file_load_size = load_image(filename_path, fdt);
     if (dt_file_load_size < 0) {
@@ -68,7 +68,7 @@
     return fdt;
 
 fail:
-    qemu_free(fdt);
+    g_free(fdt);
     return NULL;
 }
 
diff --git a/dma-helpers.c b/dma-helpers.c
index 29b3138..cdd212d 100644
--- a/dma-helpers.c
+++ b/dma-helpers.c
@@ -12,7 +12,7 @@
 
 void qemu_sglist_init(QEMUSGList *qsg, int alloc_hint)
 {
-    qsg->sg = qemu_malloc(alloc_hint * sizeof(ScatterGatherEntry));
+    qsg->sg = g_malloc(alloc_hint * sizeof(ScatterGatherEntry));
     qsg->nsg = 0;
     qsg->nalloc = alloc_hint;
     qsg->size = 0;
@@ -23,7 +23,7 @@
 {
     if (qsg->nsg == qsg->nalloc) {
         qsg->nalloc = 2 * qsg->nalloc + 1;
-        qsg->sg = qemu_realloc(qsg->sg, qsg->nalloc * sizeof(ScatterGatherEntry));
+        qsg->sg = g_realloc(qsg->sg, qsg->nalloc * sizeof(ScatterGatherEntry));
     }
     qsg->sg[qsg->nsg].base = base;
     qsg->sg[qsg->nsg].len = len;
@@ -33,7 +33,7 @@
 
 void qemu_sglist_destroy(QEMUSGList *qsg)
 {
-    qemu_free(qsg->sg);
+    g_free(qsg->sg);
 }
 
 typedef struct {
diff --git a/exec.c b/exec.c
index cd693b2..b8b1b6f 100644
--- a/exec.c
+++ b/exec.c
@@ -312,7 +312,7 @@
         /* allocate if not found */
 #if defined(CONFIG_USER_ONLY)
         size_t len = sizeof(PageDesc) * L2_SIZE;
-        /* Don't use qemu_malloc because it may recurse.  */
+        /* Don't use g_malloc because it may recurse.  */
         p = mmap(NULL, len, PROT_READ | PROT_WRITE,
                  MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
         *lp = p;
@@ -323,7 +323,7 @@
                            PAGE_RESERVED);
         }
 #else
-        p = qemu_mallocz(sizeof(PageDesc) * L2_SIZE);
+        p = g_malloc0(sizeof(PageDesc) * L2_SIZE);
         *lp = p;
 #endif
     }
@@ -499,7 +499,7 @@
         }
     }
 #else
-    code_gen_buffer = qemu_malloc(code_gen_buffer_size);
+    code_gen_buffer = g_malloc(code_gen_buffer_size);
     map_exec(code_gen_buffer, code_gen_buffer_size);
 #endif
 #endif /* !USE_STATIC_CODE_GEN_BUFFER */
@@ -507,7 +507,7 @@
     code_gen_buffer_max_size = code_gen_buffer_size -
         code_gen_max_block_size();
     code_gen_max_blocks = code_gen_buffer_size / CODE_GEN_AVG_BLOCK_SIZE;
-    tbs = qemu_malloc(code_gen_max_blocks * sizeof(TranslationBlock));
+    tbs = g_malloc(code_gen_max_blocks * sizeof(TranslationBlock));
 }
 
 /* Must be called before using the QEMU cpus. 'tb_size' is the size
@@ -609,7 +609,7 @@
 static inline void invalidate_page_bitmap(PageDesc *p)
 {
     if (p->code_bitmap) {
-        qemu_free(p->code_bitmap);
+        g_free(p->code_bitmap);
         p->code_bitmap = NULL;
     }
     p->code_write_count = 0;
@@ -655,7 +655,7 @@
         for (tb_to_clean = 0; tb_to_clean < TB_JMP_CACHE_SIZE; tb_to_clean++) {
             if (env->tb_jmp_cache[tb_to_clean] != NULL &&
                 env->tb_jmp_cache[tb_to_clean]->tpc2gpc != NULL) {
-                qemu_free(env->tb_jmp_cache[tb_to_clean]->tpc2gpc);
+                g_free(env->tb_jmp_cache[tb_to_clean]->tpc2gpc);
                 env->tb_jmp_cache[tb_to_clean]->tpc2gpc = NULL;
                 env->tb_jmp_cache[tb_to_clean]->tpc2gpc_pairs = 0;
             }
@@ -834,7 +834,7 @@
 
 #ifdef CONFIG_MEMCHECK
     if (tb->tpc2gpc != NULL) {
-        qemu_free(tb->tpc2gpc);
+        g_free(tb->tpc2gpc);
         tb->tpc2gpc = NULL;
         tb->tpc2gpc_pairs = 0;
     }
@@ -875,7 +875,7 @@
     int n, tb_start, tb_end;
     TranslationBlock *tb;
 
-    p->code_bitmap = qemu_mallocz(TARGET_PAGE_SIZE / 8);
+    p->code_bitmap = g_malloc0(TARGET_PAGE_SIZE / 8);
 
     tb = p->first_tb;
     while (tb != NULL) {
@@ -1373,7 +1373,7 @@
                 TARGET_FMT_lx ", len=" TARGET_FMT_lu "\n", addr, len);
         return -EINVAL;
     }
-    wp = qemu_malloc(sizeof(*wp));
+    wp = g_malloc(sizeof(*wp));
 
     wp->vaddr = addr;
     wp->len_mask = len_mask;
@@ -1416,7 +1416,7 @@
 
     tlb_flush_page(env, watchpoint->vaddr);
 
-    qemu_free(watchpoint);
+    g_free(watchpoint);
 }
 
 /* Remove all matching watchpoints.  */
@@ -1437,7 +1437,7 @@
 #if defined(TARGET_HAS_ICE)
     CPUBreakpoint *bp;
 
-    bp = qemu_malloc(sizeof(*bp));
+    bp = g_malloc(sizeof(*bp));
 
     bp->pc = pc;
     bp->flags = flags;
@@ -1484,7 +1484,7 @@
 
     breakpoint_invalidate(env, breakpoint->pc);
 
-    qemu_free(breakpoint);
+    g_free(breakpoint);
 #endif
 }
 
@@ -2522,14 +2522,14 @@
     RAMBlock *new_block, *block;
 
     size = TARGET_PAGE_ALIGN(size);
-    new_block = qemu_mallocz(sizeof(*new_block));
+    new_block = g_malloc0(sizeof(*new_block));
 
 #if 0
     if (dev && dev->parent_bus && dev->parent_bus->info->get_dev_path) {
         char *id = dev->parent_bus->info->get_dev_path(dev);
         if (id) {
             snprintf(new_block->idstr, sizeof(new_block->idstr), "%s/", id);
-            qemu_free(id);
+            g_free(id);
         }
     }
 #endif
@@ -2599,7 +2599,7 @@
 
     QLIST_INSERT_HEAD(&ram_list.blocks, new_block, next);
 
-    ram_list.phys_dirty = qemu_realloc(ram_list.phys_dirty,
+    ram_list.phys_dirty = g_realloc(ram_list.phys_dirty,
                                        last_ram_offset() >> TARGET_PAGE_BITS);
     memset(ram_list.phys_dirty + (new_block->offset >> TARGET_PAGE_BITS),
            0xff, size >> TARGET_PAGE_BITS);
@@ -2642,7 +2642,7 @@
                 qemu_vfree(block->host);
 #endif
             }
-            qemu_free(block);
+            g_free(block);
             return;
         }
     }
@@ -3169,7 +3169,7 @@
     subpage_t *mmio;
     int subpage_memory;
 
-    mmio = qemu_mallocz(sizeof(subpage_t));
+    mmio = g_malloc0(sizeof(subpage_t));
 
     mmio->base = base;
     subpage_memory = cpu_register_io_memory(subpage_read, subpage_write, mmio);
@@ -3472,7 +3472,7 @@
 
 void *cpu_register_map_client(void *opaque, void (*callback)(void *opaque))
 {
-    MapClient *client = qemu_malloc(sizeof(*client));
+    MapClient *client = g_malloc(sizeof(*client));
 
     client->opaque = opaque;
     client->callback = callback;
@@ -3485,7 +3485,7 @@
     MapClient *client = (MapClient *)_client;
 
     QLIST_REMOVE(client, link);
-    qemu_free(client);
+    g_free(client);
 }
 
 static void cpu_notify_map_clients(void)
diff --git a/gdbstub.c b/gdbstub.c
index efdf60a..2678301 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -1423,7 +1423,7 @@
     GDBRegisterState **p;
     static int last_reg = NUM_CORE_REGS;
 
-    s = (GDBRegisterState *)qemu_mallocz(sizeof(GDBRegisterState));
+    s = (GDBRegisterState *)g_malloc0(sizeof(GDBRegisterState));
     s->base_reg = last_reg;
     s->num_regs = num_regs;
     s->get_reg = get_reg;
@@ -2253,7 +2253,7 @@
     val = 1;
     setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, (char *)&val, sizeof(val));
 
-    s = qemu_mallocz(sizeof(GDBState));
+    s = g_malloc0(sizeof(GDBState));
     s->c_cpu = first_cpu;
     s->g_cpu = first_cpu;
     s->fd = fd;
@@ -2417,13 +2417,13 @@
 
     s = gdbserver_state;
     if (!s) {
-        s = qemu_mallocz(sizeof(GDBState));
+        s = g_malloc0(sizeof(GDBState));
         gdbserver_state = s;
 
         qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
 
         /* Initialize a monitor terminal for gdb */
-        mon_chr = qemu_mallocz(sizeof(*mon_chr));
+        mon_chr = g_malloc0(sizeof(*mon_chr));
         mon_chr->chr_write = gdb_monitor_write;
         monitor_init(mon_chr, 0);
     } else {
diff --git a/hw/android/android_arm.c b/hw/android/android_arm.c
index cfe8295..1f30e7f 100644
--- a/hw/android/android_arm.c
+++ b/hw/android/android_arm.c
@@ -102,7 +102,7 @@
             if (nd_table[i].model == NULL
                 || strcmp(nd_table[i].model, "smc91c111") == 0) {
                 struct goldfish_device *smc_device;
-                smc_device = qemu_mallocz(sizeof(*smc_device));
+                smc_device = g_malloc0(sizeof(*smc_device));
                 smc_device->name = "smc91x";
                 smc_device->id = i;
                 smc_device->size = 0x1000;
diff --git a/hw/android/android_mips.c b/hw/android/android_mips.c
index a18dcd1..16cde78 100644
--- a/hw/android/android_mips.c
+++ b/hw/android/android_mips.c
@@ -195,7 +195,7 @@
             if (nd_table[i].model == NULL
                 || strcmp(nd_table[i].model, "smc91c111") == 0) {
                 struct goldfish_device *smc_device;
-                smc_device = qemu_mallocz(sizeof(*smc_device));
+                smc_device = g_malloc0(sizeof(*smc_device));
                 smc_device->name = "smc91x";
                 smc_device->id = i;
                 smc_device->size = 0x1000;
diff --git a/hw/android/goldfish/audio.c b/hw/android/goldfish/audio.c
index 1bb3289..05ca3a4 100644
--- a/hw/android/goldfish/audio.c
+++ b/hw/android/goldfish/audio.c
@@ -137,7 +137,7 @@
 goldfish_audio_buff_ensure( struct goldfish_audio_buff*  b, uint32_t  size )
 {
     if (b->capacity < size) {
-        b->data     = qemu_realloc(b->data, size);
+        b->data     = g_realloc(b->data, size);
         b->capacity = size;
     }
 }
@@ -565,7 +565,7 @@
     if (!android_hw->hw_audioOutput && !android_hw->hw_audioInput)
         return;
 
-    s = (struct goldfish_audio_state *)qemu_mallocz(sizeof(*s));
+    s = (struct goldfish_audio_state *)g_malloc0(sizeof(*s));
     s->dev.name = "goldfish_audio";
     s->dev.id = id;
     s->dev.base = base;
diff --git a/hw/android/goldfish/battery.c b/hw/android/goldfish/battery.c
index 9c92e35..069d556 100644
--- a/hw/android/goldfish/battery.c
+++ b/hw/android/goldfish/battery.c
@@ -147,7 +147,7 @@
 {
     struct goldfish_battery_state *s;
 
-    s = (struct goldfish_battery_state *)qemu_mallocz(sizeof(*s));
+    s = (struct goldfish_battery_state *)g_malloc0(sizeof(*s));
     s->dev.name = "goldfish-battery";
     s->dev.base = 0;    // will be allocated dynamically
     s->dev.size = 0x1000;
diff --git a/hw/android/goldfish/events_device.c b/hw/android/goldfish/events_device.c
index e80813d..8a8720c 100644
--- a/hw/android/goldfish/events_device.c
+++ b/hw/android/goldfish/events_device.c
@@ -307,11 +307,11 @@
     il = bitl / 8;
     ih = bith / 8;
     if (ih >= s->ev_bits[type].len) {
-        bits = qemu_mallocz(ih + 1);
+        bits = g_malloc0(ih + 1);
         if (bits == NULL)
             return;
         memcpy(bits, s->ev_bits[type].bits, s->ev_bits[type].len);
-        qemu_free(s->ev_bits[type].bits);
+        g_free(s->ev_bits[type].bits);
         s->ev_bits[type].bits = bits;
         s->ev_bits[type].len = ih + 1;
     }
@@ -352,7 +352,7 @@
     int iomemtype;
     AndroidHwConfig*  config = android_hw;
 
-    s = (events_state *) qemu_mallocz(sizeof(events_state));
+    s = (events_state *) g_malloc0(sizeof(events_state));
 
     /* now set the events capability bits depending on hardware configuration */
     /* apparently, the EV_SYN array is used to indicate which other
@@ -526,7 +526,7 @@
     s->first = 0;
     s->last = 0;
     s->state = STATE_INIT;
-    s->name = qemu_strdup(config->hw_keyboard_charmap);
+    s->name = g_strdup(config->hw_keyboard_charmap);
 
     /* This function migh fire buffered events to the device, so
      * ensure that it is called after initialization is complete
diff --git a/hw/android/goldfish/fb.c b/hw/android/goldfish/fb.c
index dd35d43..e9ccf4b 100644
--- a/hw/android/goldfish/fb.c
+++ b/hw/android/goldfish/fb.c
@@ -648,7 +648,7 @@
 {
     struct goldfish_fb_state *s;
 
-    s = (struct goldfish_fb_state *)qemu_mallocz(sizeof(*s));
+    s = (struct goldfish_fb_state *)g_malloc0(sizeof(*s));
     s->dev.name = "goldfish_fb";
     s->dev.id = id;
     s->dev.size = 0x1000;
diff --git a/hw/android/goldfish/interrupt.c b/hw/android/goldfish/interrupt.c
index bd72a4c..62d534a 100644
--- a/hw/android/goldfish/interrupt.c
+++ b/hw/android/goldfish/interrupt.c
@@ -165,7 +165,7 @@
     struct goldfish_int_state *s;
     qemu_irq*  qi;
 
-    s = qemu_mallocz(sizeof(*s));
+    s = g_malloc0(sizeof(*s));
     qi = qemu_allocate_irqs(goldfish_int_set_irq, s, GFD_MAX_IRQ);
     s->dev.name = "goldfish_interrupt_controller";
     s->dev.id = -1;
@@ -176,7 +176,7 @@
 
     ret = goldfish_device_add(&s->dev, goldfish_int_readfn, goldfish_int_writefn, s);
     if(ret) {
-        qemu_free(s);
+        g_free(s);
         return NULL;
     }
 
diff --git a/hw/android/goldfish/mmc.c b/hw/android/goldfish/mmc.c
index 4d27e23..abab65d 100644
--- a/hw/android/goldfish/mmc.c
+++ b/hw/android/goldfish/mmc.c
@@ -503,7 +503,7 @@
 {
     struct goldfish_mmc_state *s;
 
-    s = (struct goldfish_mmc_state *)qemu_mallocz(sizeof(*s));
+    s = (struct goldfish_mmc_state *)g_malloc0(sizeof(*s));
     s->dev.name = "goldfish_mmc";
     s->dev.id = id;
     s->dev.base = base;
diff --git a/hw/android/goldfish/nand.c b/hw/android/goldfish/nand.c
index 56e5973..d4983c5 100644
--- a/hw/android/goldfish/nand.c
+++ b/hw/android/goldfish/nand.c
@@ -635,7 +635,7 @@
     static int  instance_id = 0;
     nand_dev_controller_state *s;
 
-    s = (nand_dev_controller_state *)qemu_mallocz(sizeof(nand_dev_controller_state));
+    s = (nand_dev_controller_state *)g_malloc0(sizeof(nand_dev_controller_state));
     iomemtype = cpu_register_io_memory(nand_dev_readfn, nand_dev_writefn, s);
     cpu_register_physical_memory(base, 0x00000fff, iomemtype);
     s->base = base;
diff --git a/hw/android/goldfish/pipe.c b/hw/android/goldfish/pipe.c
index a495b05..7f3dd90 100644
--- a/hw/android/goldfish/pipe.c
+++ b/hw/android/goldfish/pipe.c
@@ -1254,7 +1254,7 @@
 {
     PipeDevice *s;
 
-    s = (PipeDevice *) qemu_mallocz(sizeof(*s));
+    s = (PipeDevice *) g_malloc0(sizeof(*s));
 
     s->dev.name = "qemu_pipe";
     s->dev.id = -1;
diff --git a/hw/android/goldfish/switch.c b/hw/android/goldfish/switch.c
index eb8fe67..355f88a 100644
--- a/hw/android/goldfish/switch.c
+++ b/hw/android/goldfish/switch.c
@@ -147,7 +147,7 @@
     int ret;
     struct switch_state *s;
 
-    s = qemu_mallocz(sizeof(*s));
+    s = g_malloc0(sizeof(*s));
     s->dev.name = "goldfish-switch";
     s->dev.id = id;
     s->dev.size = 0x1000;
@@ -159,7 +159,7 @@
 
     ret = goldfish_device_add(&s->dev, goldfish_switch_readfn, goldfish_switch_writefn, s);
     if(ret) {
-        qemu_free(s);
+        g_free(s);
         return NULL;
     }
 
diff --git a/hw/android/goldfish/trace.c b/hw/android/goldfish/trace.c
index eb723fe..364e827 100644
--- a/hw/android/goldfish/trace.c
+++ b/hw/android/goldfish/trace.c
@@ -399,7 +399,7 @@
 {
     trace_dev_state *s;
 
-    s = (trace_dev_state *)qemu_mallocz(sizeof(trace_dev_state));
+    s = (trace_dev_state *)g_malloc0(sizeof(trace_dev_state));
     s->dev.name = "qemu_trace";
     s->dev.id = -1;
     s->dev.base = 0;       // will be allocated dynamically
diff --git a/hw/android/goldfish/tty.c b/hw/android/goldfish/tty.c
index 60bd8fb..e0dd8d3 100644
--- a/hw/android/goldfish/tty.c
+++ b/hw/android/goldfish/tty.c
@@ -201,7 +201,7 @@
     struct tty_state *s;
     static int  instance_id = 0;
 
-    s = qemu_mallocz(sizeof(*s));
+    s = g_malloc0(sizeof(*s));
     s->dev.name = "goldfish_tty";
     s->dev.id = id;
     s->dev.base = base;
@@ -216,7 +216,7 @@
 
     ret = goldfish_device_add(&s->dev, goldfish_tty_readfn, goldfish_tty_writefn, s);
     if(ret) {
-        qemu_free(s);
+        g_free(s);
     } else {
         register_savevm( "goldfish_tty", instance_id++, GOLDFISH_TTY_SAVE_VERSION,
                          goldfish_tty_save, goldfish_tty_load, s);
diff --git a/hw/bt/core.c b/hw/bt/core.c
index 854cbd5..15062cc 100644
--- a/hw/bt/core.c
+++ b/hw/bt/core.c
@@ -54,7 +54,7 @@
 /* Slaves that don't hold any additional per link state can use these */
 static void bt_dummy_lmp_connection_request(struct bt_link_s *req)
 {
-    struct bt_link_s *link = qemu_mallocz(sizeof(struct bt_link_s));
+    struct bt_link_s *link = g_malloc0(sizeof(struct bt_link_s));
 
     link->slave = req->slave;
     link->host = req->host;
@@ -65,13 +65,13 @@
 
 static void bt_dummy_lmp_disconnect_slave(struct bt_link_s *link)
 {
-    qemu_free(link);
+    g_free(link);
 }
 
 static void bt_dummy_destroy(struct bt_device_s *device)
 {
     bt_device_done(device);
-    qemu_free(device);
+    g_free(device);
 }
 
 static int bt_dev_idx = 0;
diff --git a/hw/bt/hci-csr.c b/hw/bt/hci-csr.c
index ca2002e..14cc362 100644
--- a/hw/bt/hci-csr.c
+++ b/hw/bt/hci-csr.c
@@ -435,7 +435,7 @@
 CharDriverState *uart_hci_init(qemu_irq wakeup)
 {
     struct csrhci_s *s = (struct csrhci_s *)
-            qemu_mallocz(sizeof(struct csrhci_s));
+            g_malloc0(sizeof(struct csrhci_s));
 
     s->chr.opaque = s;
     s->chr.chr_write = csrhci_write;
diff --git a/hw/bt/hci.c b/hw/bt/hci.c
index 716bec0..79669c8 100644
--- a/hw/bt/hci.c
+++ b/hw/bt/hci.c
@@ -721,7 +721,7 @@
 static void bt_hci_connection_accept(struct bt_hci_s *hci,
                 struct bt_device_s *host)
 {
-    struct bt_hci_link_s *link = qemu_mallocz(sizeof(struct bt_hci_link_s));
+    struct bt_hci_link_s *link = g_malloc0(sizeof(struct bt_hci_link_s));
     evt_conn_complete params;
     uint16_t handle;
     uint8_t status = HCI_SUCCESS;
@@ -736,7 +736,7 @@
             tries);
 
     if (!tries) {
-        qemu_free(link);
+        g_free(link);
         bt_hci_connection_reject(hci, host, HCI_REJECTED_LIMITED_RESOURCES);
         status = HCI_NO_CONNECTION;
         goto complete;
@@ -893,7 +893,7 @@
 
     /* We are the slave, we get to clean this burden */
     link = (struct bt_hci_link_s *) btlink;
-    qemu_free(link);
+    g_free(link);
 
 complete:
     bt_hci_lmp_link_teardown(hci, handle);
@@ -928,7 +928,7 @@
     uint16_t handle = link->handle;
     evt_disconn_complete params;
 
-    qemu_free(link);
+    g_free(link);
 
     bt_hci_lmp_link_teardown(hci, handle);
 
@@ -1138,7 +1138,7 @@
     hci->device.inquiry_scan = 0;
     hci->device.page_scan = 0;
     if (hci->device.lmp_name)
-        qemu_free((void *) hci->device.lmp_name);
+        g_free((void *) hci->device.lmp_name);
     hci->device.lmp_name = NULL;
     hci->device.class[0] = 0x00;
     hci->device.class[1] = 0x00;
@@ -1816,8 +1816,8 @@
         LENGTH_CHECK(change_local_name);
 
         if (hci->device.lmp_name)
-            qemu_free((void *) hci->device.lmp_name);
-        hci->device.lmp_name = qemu_strndup(PARAM(change_local_name, name),
+            g_free((void *) hci->device.lmp_name);
+        hci->device.lmp_name = g_strndup(PARAM(change_local_name, name),
                         sizeof(PARAM(change_local_name, name)));
         bt_hci_event_complete_status(hci, HCI_SUCCESS);
         break;
@@ -2143,7 +2143,7 @@
 
 struct HCIInfo *bt_new_hci(struct bt_scatternet_s *net)
 {
-    struct bt_hci_s *s = qemu_mallocz(sizeof(struct bt_hci_s));
+    struct bt_hci_s *s = g_malloc0(sizeof(struct bt_hci_s));
 
     s->lm.inquiry_done = qemu_new_timer_ns(vm_clock, bt_hci_inquiry_done, s);
     s->lm.inquiry_next = qemu_new_timer_ns(vm_clock, bt_hci_inquiry_next, s);
@@ -2188,7 +2188,7 @@
     bt_device_done(&hci->device);
 
     if (hci->device.lmp_name)
-        qemu_free((void *) hci->device.lmp_name);
+        g_free((void *) hci->device.lmp_name);
 
     /* Be gentle and send DISCONNECT to all connected peers and those
      * currently waiting for us to accept or reject a connection request.
@@ -2217,5 +2217,5 @@
     qemu_free_timer(hci->lm.inquiry_next);
     qemu_free_timer(hci->conn_accept_timer);
 
-    qemu_free(hci);
+    g_free(hci);
 }
diff --git a/hw/bt/hid.c b/hw/bt/hid.c
index 875dc7c..37c4239 100644
--- a/hw/bt/hid.c
+++ b/hw/bt/hid.c
@@ -520,7 +520,7 @@
 
     hid->usbdev->handle_destroy(hid->usbdev);
 
-    qemu_free(hid);
+    g_free(hid);
 }
 
 enum peripheral_minor_class {
@@ -533,7 +533,7 @@
 static struct bt_device_s *bt_hid_init(struct bt_scatternet_s *net,
                 USBDevice *dev, enum peripheral_minor_class minor)
 {
-    struct bt_hid_device_s *s = qemu_mallocz(sizeof(*s));
+    struct bt_hid_device_s *s = g_malloc0(sizeof(*s));
     uint32_t class =
             /* Format type */
             (0 << 0) |
diff --git a/hw/bt/l2cap.c b/hw/bt/l2cap.c
index b78ab98..ccd9e44 100644
--- a/hw/bt/l2cap.c
+++ b/hw/bt/l2cap.c
@@ -410,7 +410,7 @@
 
         if (psm_info) {
             /* Device supports this use-case.  */
-            ch = qemu_mallocz(sizeof(*ch));
+            ch = g_malloc0(sizeof(*ch));
             ch->params.sdu_out = l2cap_bframe_out;
             ch->params.sdu_submit = l2cap_bframe_submit;
             ch->frame_in = l2cap_bframe_in;
@@ -428,7 +428,7 @@
                 result = L2CAP_CR_SUCCESS;
                 status = L2CAP_CS_NO_INFO;
             } else {
-                qemu_free(ch);
+                g_free(ch);
 
                 result = L2CAP_CR_NO_MEM;
                 status = L2CAP_CS_NO_INFO;
@@ -473,7 +473,7 @@
         l2cap->cid[cid] = NULL;
 
         ch->params.close(ch->params.opaque);
-        qemu_free(ch);
+        g_free(ch);
     }
 
     l2cap_disconnection_response(l2cap, cid, source_cid);
@@ -1218,13 +1218,13 @@
     for (cid = L2CAP_CID_ALLOC; cid < L2CAP_CID_MAX; cid ++)
         if (l2cap->cid[cid]) {
             l2cap->cid[cid]->params.close(l2cap->cid[cid]->params.opaque);
-            qemu_free(l2cap->cid[cid]);
+            g_free(l2cap->cid[cid]);
         }
 
     if (l2cap->role)
-        qemu_free(l2cap);
+        g_free(l2cap);
     else
-        qemu_free(l2cap->link);
+        g_free(l2cap->link);
 }
 
 /* L2CAP glue to lower layers in bluetooth stack (LMP) */
@@ -1236,7 +1236,7 @@
 
     /* Always accept - we only get called if (dev->device->page_scan).  */
 
-    l2cap = qemu_mallocz(sizeof(struct slave_l2cap_instance_s));
+    l2cap = g_malloc0(sizeof(struct slave_l2cap_instance_s));
     l2cap->link.slave = &dev->device;
     l2cap->link.host = link->host;
     l2cap_init(&l2cap->l2cap, &l2cap->link, 0);
@@ -1257,7 +1257,7 @@
         return;
     }
 
-    l2cap = qemu_mallocz(sizeof(struct l2cap_instance_s));
+    l2cap = g_malloc0(sizeof(struct l2cap_instance_s));
     l2cap_init(l2cap, link, 1);
 
     link->acl_mode = acl_active;
@@ -1353,7 +1353,7 @@
         exit(-1);
     }
 
-    new_psm = qemu_mallocz(sizeof(*new_psm));
+    new_psm = g_malloc0(sizeof(*new_psm));
     new_psm->psm = psm;
     new_psm->min_mtu = min_mtu;
     new_psm->new_channel = new_channel;
diff --git a/hw/bt/sdp.c b/hw/bt/sdp.c
index 21e5f89..56395b6 100644
--- a/hw/bt/sdp.c
+++ b/hw/bt/sdp.c
@@ -567,12 +567,12 @@
     int i;
 
     for (i = 0; i < sdp->services; i ++) {
-        qemu_free(sdp->service_list[i].attribute_list->pair);
-        qemu_free(sdp->service_list[i].attribute_list);
-        qemu_free(sdp->service_list[i].uuid);
+        g_free(sdp->service_list[i].attribute_list->pair);
+        g_free(sdp->service_list[i].attribute_list);
+        g_free(sdp->service_list[i].uuid);
     }
-    qemu_free(sdp->service_list);
-    qemu_free(sdp);
+    g_free(sdp->service_list);
+    g_free(sdp);
 }
 
 struct sdp_def_service_s {
@@ -709,10 +709,10 @@
     }
     record->uuids = 1 << ffs(record->uuids - 1);
     record->attribute_list =
-            qemu_mallocz(record->attributes * sizeof(*record->attribute_list));
+            g_malloc0(record->attributes * sizeof(*record->attribute_list));
     record->uuid =
-            qemu_mallocz(record->uuids * sizeof(*record->uuid));
-    data = qemu_malloc(len);
+            g_malloc0(record->uuids * sizeof(*record->uuid));
+    data = g_malloc(len);
 
     record->attributes = 0;
     uuid = record->uuid;
@@ -753,7 +753,7 @@
     while (service[sdp->services])
         sdp->services ++;
     sdp->service_list =
-            qemu_mallocz(sdp->services * sizeof(*sdp->service_list));
+            g_malloc0(sdp->services * sizeof(*sdp->service_list));
 
     sdp->services = 0;
     while (*service) {
@@ -942,7 +942,7 @@
 static int bt_l2cap_sdp_new_ch(struct bt_l2cap_device_s *dev,
                 struct bt_l2cap_conn_params_s *params)
 {
-    struct bt_l2cap_sdp_state_s *sdp = qemu_mallocz(sizeof(*sdp));
+    struct bt_l2cap_sdp_state_s *sdp = g_malloc0(sizeof(*sdp));
     struct sdp_def_service_s *services[] = {
         &sdp_service_sdp_s,
         &sdp_service_hid_s,
diff --git a/hw/core/irq.c b/hw/core/irq.c
index d77b11b..c43fe48 100644
--- a/hw/core/irq.c
+++ b/hw/core/irq.c
@@ -44,8 +44,8 @@
     struct IRQState *p;
     int i;
 
-    s = (qemu_irq *)qemu_mallocz(sizeof(qemu_irq) * n);
-    p = (struct IRQState *)qemu_mallocz(sizeof(struct IRQState) * n);
+    s = (qemu_irq *)g_malloc0(sizeof(qemu_irq) * n);
+    p = (struct IRQState *)g_malloc0(sizeof(struct IRQState) * n);
     for (i = 0; i < n; i++) {
         p->handler = handler;
         p->opaque = opaque;
@@ -58,8 +58,8 @@
 
 void qemu_free_irqs(qemu_irq *s)
 {
-    qemu_free(s[0]);
-    qemu_free(s);
+    g_free(s[0]);
+    g_free(s);
 }
 
 static void qemu_notirq(void *opaque, int line, int level)
diff --git a/hw/core/loader.c b/hw/core/loader.c
index b0959e6..613b8d5 100644
--- a/hw/core/loader.c
+++ b/hw/core/loader.c
@@ -265,9 +265,9 @@
     void *ptr;
     if (lseek(fd, offset, SEEK_SET) < 0)
         return NULL;
-    ptr = qemu_malloc(size);
+    ptr = g_malloc(size);
     if (read(fd, ptr, size) != size) {
-        qemu_free(ptr);
+        g_free(ptr);
         return NULL;
     }
     return ptr;
@@ -377,14 +377,14 @@
     size *= items;
     size = (size + ZALLOC_ALIGNMENT - 1) & ~(ZALLOC_ALIGNMENT - 1);
 
-    p = qemu_malloc(size);
+    p = g_malloc(size);
 
     return (p);
 }
 
 static void zfree(void *x, void *addr)
 {
-    qemu_free(addr);
+    g_free(addr);
 }
 
 
@@ -502,7 +502,7 @@
     }
 
     *ep = hdr->ih_ep;
-    data = qemu_malloc(hdr->ih_size);
+    data = g_malloc(hdr->ih_size);
 
     if (read(fd, data, hdr->ih_size) != hdr->ih_size) {
         fprintf(stderr, "Error reading file\n");
@@ -516,10 +516,10 @@
 
         compressed_data = data;
         max_bytes = UBOOT_MAX_GUNZIP_BYTES;
-        data = qemu_malloc(max_bytes);
+        data = g_malloc(max_bytes);
 
         bytes = gunzip(data, max_bytes, compressed_data, hdr->ih_size);
-        qemu_free(compressed_data);
+        g_free(compressed_data);
         if (bytes < 0) {
             fprintf(stderr, "Unable to decompress gzipped image!\n");
             goto out;
@@ -536,7 +536,7 @@
 
 out:
     if (data)
-        qemu_free(data);
+        g_free(data);
     close(fd);
     return ret;
 }
diff --git a/hw/core/qdev.c b/hw/core/qdev.c
index 954563d..9c23047 100644
--- a/hw/core/qdev.c
+++ b/hw/core/qdev.c
@@ -59,7 +59,7 @@
 
     assert(info->size >= sizeof(DeviceState));
 
-    t = qemu_mallocz(sizeof(DeviceType));
+    t = g_malloc0(sizeof(DeviceType));
     t->next = device_type_list;
     device_type_list = t;
     t->info = info;
@@ -82,7 +82,7 @@
         hw_error("Unknown device '%s'\n", name);
     }
 
-    dev = qemu_mallocz(t->info->size);
+    dev = g_malloc0(t->info->size);
     dev->type = t;
 
     if (!bus) {
@@ -228,7 +228,7 @@
 void qdev_free(DeviceState *dev)
 {
     QLIST_REMOVE(dev, sibling);
-    qemu_free(dev);
+    g_free(dev);
 }
 
 static DeviceProperty *create_prop(DeviceState *dev, const char *name,
@@ -237,8 +237,8 @@
     DeviceProperty *prop;
 
     /* TODO: Check for duplicate properties.  */
-    prop = qemu_mallocz(sizeof(*prop));
-    prop->name = qemu_strdup(name);
+    prop = g_malloc0(sizeof(*prop));
+    prop->name = g_strdup(name);
     prop->type = type;
     prop->next = dev->props;
     dev->props = prop;
@@ -439,10 +439,10 @@
 {
     BusState *bus;
 
-    bus = qemu_mallocz(size);
+    bus = g_malloc0(size);
     bus->type = type;
     bus->parent = parent;
-    bus->name = qemu_strdup(name);
+    bus->name = g_strdup(name);
     QLIST_INIT(&bus->children);
     if (parent) {
         QLIST_INSERT_HEAD(&parent->child_bus, bus, sibling);
diff --git a/hw/core/sysbus.c b/hw/core/sysbus.c
index d345422..8e74125 100644
--- a/hw/core/sysbus.c
+++ b/hw/core/sysbus.c
@@ -118,8 +118,8 @@
 {
     SysBusDeviceInfo *info;
 
-    info = qemu_mallocz(sizeof(*info));
-    info->qdev.name = qemu_strdup(name);
+    info = g_malloc0(sizeof(*info));
+    info->qdev.name = g_strdup(name);
     info->qdev.size = size;
     info->init = init;
     sysbus_register_withprop(info);
diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index 6c6b909..bc93685 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -83,9 +83,9 @@
 
 static void option_rom_setup_reset(hwaddr addr, unsigned size)
 {
-    RomResetData *rrd = qemu_malloc(sizeof *rrd);
+    RomResetData *rrd = g_malloc(sizeof *rrd);
 
-    rrd->data = qemu_malloc(size);
+    rrd->data = g_malloc(size);
     cpu_physical_memory_read(addr, rrd->data, size);
     rrd->addr = addr;
     rrd->size = size;
@@ -497,7 +497,7 @@
      * of nodes, one word for each VCPU->node and one word for each node to
      * hold the amount of memory.
      */
-    numa_fw_cfg = qemu_mallocz((1 + smp_cpus + nb_numa_nodes) * 8);
+    numa_fw_cfg = g_malloc0((1 + smp_cpus + nb_numa_nodes) * 8);
     numa_fw_cfg[0] = cpu_to_le64(nb_numa_nodes);
     for (i = 0; i < smp_cpus; i++) {
         for (j = 0; j < nb_numa_nodes; j++) {
@@ -834,7 +834,7 @@
                 exit(1);
             }
             size = load_image_targphys(filename, start, end - start);
-            qemu_free(filename);
+            g_free(filename);
         } else {
             size = -1;
         }
@@ -987,7 +987,7 @@
         exit(1);
     }
     if (filename) {
-        qemu_free(filename);
+        g_free(filename);
     }
     /* map the last 128KB of the BIOS in ISA space */
     isa_bios_size = bios_size;
@@ -1227,7 +1227,7 @@
     }
 
     if (pci_enabled && acpi_enabled) {
-        uint8_t *eeprom_buf = qemu_mallocz(8 * 256); /* XXX: make this persistent */
+        uint8_t *eeprom_buf = g_malloc0(8 * 256); /* XXX: make this persistent */
         i2c_bus *smbus;
 
         /* TODO: Populate SPD eeprom data.  */
diff --git a/hw/i386/smbios.c b/hw/i386/smbios.c
index 177efb6..913b074 100644
--- a/hw/i386/smbios.c
+++ b/hw/i386/smbios.c
@@ -93,9 +93,9 @@
 
     if (!smbios_entries) {
         smbios_entries_len = sizeof(uint16_t);
-        smbios_entries = qemu_mallocz(smbios_entries_len);
+        smbios_entries = g_malloc0(smbios_entries_len);
     }
-    smbios_entries = qemu_realloc(smbios_entries, smbios_entries_len +
+    smbios_entries = g_realloc(smbios_entries, smbios_entries_len +
                                                   sizeof(*field) + len);
     field = (struct smbios_field *)(smbios_entries + smbios_entries_len);
     field->header.type = SMBIOS_FIELD_ENTRY;
@@ -180,10 +180,10 @@
 
         if (!smbios_entries) {
             smbios_entries_len = sizeof(uint16_t);
-            smbios_entries = qemu_mallocz(smbios_entries_len);
+            smbios_entries = g_malloc0(smbios_entries_len);
         }
 
-        smbios_entries = qemu_realloc(smbios_entries, smbios_entries_len +
+        smbios_entries = g_realloc(smbios_entries, smbios_entries_len +
                                                       sizeof(*table) + size);
         table = (struct smbios_table *)(smbios_entries + smbios_entries_len);
         table->header.type = SMBIOS_TABLE_ENTRY;
diff --git a/hw/input/ps2.c b/hw/input/ps2.c
index c24a59a..e965da6 100644
--- a/hw/input/ps2.c
+++ b/hw/input/ps2.c
@@ -585,7 +585,7 @@
 
 void *ps2_kbd_init(void (*update_irq)(void *, int), void *update_arg)
 {
-    PS2KbdState *s = (PS2KbdState *)qemu_mallocz(sizeof(PS2KbdState));
+    PS2KbdState *s = (PS2KbdState *)g_malloc0(sizeof(PS2KbdState));
 
     s->common.update_irq = update_irq;
     s->common.update_arg = update_arg;
@@ -599,7 +599,7 @@
 
 void *ps2_mouse_init(void (*update_irq)(void *, int), void *update_arg)
 {
-    PS2MouseState *s = (PS2MouseState *)qemu_mallocz(sizeof(PS2MouseState));
+    PS2MouseState *s = (PS2MouseState *)g_malloc0(sizeof(PS2MouseState));
 
     s->common.update_irq = update_irq;
     s->common.update_arg = update_arg;
diff --git a/hw/intc/apic.c b/hw/intc/apic.c
index 839ec56..c1342e9 100644
--- a/hw/intc/apic.c
+++ b/hw/intc/apic.c
@@ -939,7 +939,7 @@
 
     if (last_apic_idx >= MAX_APICS)
         return -1;
-    s = qemu_mallocz(sizeof(APICState));
+    s = g_malloc0(sizeof(APICState));
     env->apic_state = s;
     s->idx = last_apic_idx++;
     s->id = env->cpuid_apic_id;
diff --git a/hw/intc/i8259.c b/hw/intc/i8259.c
index 321b66a..4e72cd8 100644
--- a/hw/intc/i8259.c
+++ b/hw/intc/i8259.c
@@ -551,7 +551,7 @@
 {
     PicState2 *s;
 
-    s = qemu_mallocz(sizeof(PicState2));
+    s = g_malloc0(sizeof(PicState2));
     pic_init1(0x20, 0x4d0, &s->pics[0]);
     pic_init1(0xa0, 0x4d1, &s->pics[1]);
     s->pics[0].elcr_mask = 0xf8;
diff --git a/hw/intc/ioapic.c b/hw/intc/ioapic.c
index b80d684..8e0cd77 100644
--- a/hw/intc/ioapic.c
+++ b/hw/intc/ioapic.c
@@ -247,7 +247,7 @@
     IOAPICState *s;
     int io_memory;
 
-    s = qemu_mallocz(sizeof(IOAPICState));
+    s = g_malloc0(sizeof(IOAPICState));
     ioapic_reset(s);
 
     io_memory = cpu_register_io_memory(ioapic_mem_read,
diff --git a/hw/mips/mips_r4k.c b/hw/mips/mips_r4k.c
index 03de0dd..bf7d379 100644
--- a/hw/mips/mips_r4k.c
+++ b/hw/mips/mips_r4k.c
@@ -126,7 +126,7 @@
 
     /* Store command line.  */
     params_size = 264;
-    params_buf = qemu_malloc(params_size);
+    params_buf = g_malloc(params_size);
 
     params_buf[0] = tswap32(ram_size);
     params_buf[1] = tswap32(0x12345678);
@@ -186,7 +186,7 @@
         fprintf(stderr, "Unable to find CPU definition\n");
         exit(1);
     }
-    reset_info = qemu_mallocz(sizeof(ResetData));
+    reset_info = g_malloc0(sizeof(ResetData));
     reset_info->env = env;
     reset_info->vector = env->active_tc.PC;
     qemu_register_reset(main_cpu_reset, reset_info);
@@ -241,7 +241,7 @@
 		bios_name);
     }
     if (filename) {
-        qemu_free(filename);
+        g_free(filename);
     }
 
     if (kernel_filename) {
diff --git a/hw/net/ne2000.c b/hw/net/ne2000.c
index c0e256c..69df0bf 100644
--- a/hw/net/ne2000.c
+++ b/hw/net/ne2000.c
@@ -732,7 +732,7 @@
     isa_unassign_ioport(s->isa_io_base + 0x10, 2);
     isa_unassign_ioport(s->isa_io_base + 0x1f, 1);
 
-    qemu_free(s);
+    g_free(s);
 }
 
 void isa_ne2000_init(int base, qemu_irq irq, NICInfo *nd)
@@ -741,7 +741,7 @@
 
     qemu_check_nic_model(nd, "ne2k_isa");
 
-    s = qemu_mallocz(sizeof(NE2000State));
+    s = g_malloc0(sizeof(NE2000State));
 
     register_ioport_write(base, 16, 1, ne2000_ioport_write, s);
     register_ioport_read(base, 16, 1, ne2000_ioport_read, s);
diff --git a/hw/net/smc91c111.c b/hw/net/smc91c111.c
index a2ef1a2..30ea00f 100644
--- a/hw/net/smc91c111.c
+++ b/hw/net/smc91c111.c
@@ -774,7 +774,7 @@
     smc91c111_state *s = vc->opaque;
 
     cpu_unregister_io_memory(s->mmio_index);
-    qemu_free(s);
+    g_free(s);
 }
 
 static void smc91c111_init1(SysBusDevice *dev)
diff --git a/hw/nvram/fw_cfg.c b/hw/nvram/fw_cfg.c
index e1231db..a26ecd4 100644
--- a/hw/nvram/fw_cfg.c
+++ b/hw/nvram/fw_cfg.c
@@ -205,7 +205,7 @@
 {
     uint16_t *copy;
 
-    copy = qemu_malloc(sizeof(value));
+    copy = g_malloc(sizeof(value));
     *copy = cpu_to_le16(value);
     return fw_cfg_add_bytes(opaque, key, (uint8_t *)copy, sizeof(value));
 }
@@ -214,7 +214,7 @@
 {
     uint32_t *copy;
 
-    copy = qemu_malloc(sizeof(value));
+    copy = g_malloc(sizeof(value));
     *copy = cpu_to_le32(value);
     return fw_cfg_add_bytes(opaque, key, (uint8_t *)copy, sizeof(value));
 }
@@ -223,7 +223,7 @@
 {
     uint64_t *copy;
 
-    copy = qemu_malloc(sizeof(value));
+    copy = g_malloc(sizeof(value));
     *copy = cpu_to_le64(value);
     return fw_cfg_add_bytes(opaque, key, (uint8_t *)copy, sizeof(value));
 }
@@ -256,7 +256,7 @@
     FWCfgState *s;
     int io_ctl_memory, io_data_memory;
 
-    s = qemu_mallocz(sizeof(FWCfgState));
+    s = g_malloc0(sizeof(FWCfgState));
 
     if (ctl_port) {
         register_ioport_write(ctl_port, 2, 2, fw_cfg_io_writew, s);
diff --git a/hw/pci-host/piix.c b/hw/pci-host/piix.c
index 43ee738..055c858 100644
--- a/hw/pci-host/piix.c
+++ b/hw/pci-host/piix.c
@@ -175,7 +175,7 @@
     PCIDevice *d;
     I440FXState *s;
 
-    s = qemu_mallocz(sizeof(I440FXState));
+    s = g_malloc0(sizeof(I440FXState));
     b = pci_register_bus(NULL, "pci", 
                          piix3_set_irq, pci_slot_get_pirq, pic, 0, 4);
     s->bus = b;
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index 1eab25c..18f73ce 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -111,7 +111,7 @@
 static PCIBus *pci_register_secondary_bus(PCIDevice *dev, pci_map_irq_fn map_irq)
 {
     PCIBus *bus;
-    bus = qemu_mallocz(sizeof(PCIBus));
+    bus = g_malloc0(sizeof(PCIBus));
     bus->map_irq = map_irq;
     bus->parent_dev = dev;
     bus->next = dev->bus->next;
@@ -276,7 +276,7 @@
 {
     PCIDevice *pci_dev;
 
-    pci_dev = qemu_mallocz(instance_size);
+    pci_dev = g_malloc0(instance_size);
     pci_dev = do_pci_register_device(pci_dev, bus, name, devfn,
                                      config_read, config_write);
     return pci_dev;
@@ -923,8 +923,8 @@
 {
     PCIDeviceInfo *info;
 
-    info = qemu_mallocz(sizeof(*info));
-    info->qdev.name = qemu_strdup(name);
+    info = g_malloc0(sizeof(*info));
+    info->qdev.name = g_strdup(name);
     info->qdev.size = size;
     info->init = init;
     info->qdev.init = pci_qdev_init;
diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
index 3c5912a..482ad49 100644
--- a/hw/scsi/scsi-disk.c
+++ b/hw/scsi/scsi-disk.c
@@ -88,7 +88,7 @@
         r = free_requests;
         free_requests = r->next;
     } else {
-        r = qemu_malloc(sizeof(SCSIRequest));
+        r = g_malloc(sizeof(SCSIRequest));
         r->iov.iov_base = qemu_memalign(512, SCSI_DMA_BUF_SIZE);
     }
     r->dev = s;
@@ -923,8 +923,8 @@
 
 static void scsi_destroy(SCSIDevice *d)
 {
-    qemu_free(d->state);
-    qemu_free(d);
+    g_free(d->state);
+    g_free(d);
 }
 
 SCSIDevice *scsi_disk_init(BlockDriverState *bdrv, int tcq,
@@ -934,7 +934,7 @@
     SCSIDeviceState *s;
     uint64_t nb_sectors;
 
-    s = (SCSIDeviceState *)qemu_mallocz(sizeof(SCSIDeviceState));
+    s = (SCSIDeviceState *)g_malloc0(sizeof(SCSIDeviceState));
     s->bdrv = bdrv;
     s->tcq = tcq;
     s->completion = completion;
@@ -956,7 +956,7 @@
 #endif
         pstrcpy(s->drive_serial_str, sizeof(s->drive_serial_str), "0");
     qemu_add_vm_change_state_handler(scsi_dma_restart_cb, s);
-    d = (SCSIDevice *)qemu_mallocz(sizeof(SCSIDevice));
+    d = (SCSIDevice *)g_malloc0(sizeof(SCSIDevice));
     d->state = s;
     d->destroy = scsi_destroy;
     d->send_command = scsi_send_command;
diff --git a/hw/timer/mc146818rtc.c b/hw/timer/mc146818rtc.c
index 5036d78..6828e46 100644
--- a/hw/timer/mc146818rtc.c
+++ b/hw/timer/mc146818rtc.c
@@ -598,7 +598,7 @@
 {
     RTCState *s;
 
-    s = qemu_mallocz(sizeof(RTCState));
+    s = g_malloc0(sizeof(RTCState));
 
     s->irq = irq;
     s->sqw_irq = sqw_irq;
@@ -720,7 +720,7 @@
     RTCState *s;
     int io_memory;
 
-    s = qemu_mallocz(sizeof(RTCState));
+    s = g_malloc0(sizeof(RTCState));
 
     s->irq = irq;
     s->cmos_data[RTC_REG_A] = 0x26;
diff --git a/hw/usb/dev-hid.c b/hw/usb/dev-hid.c
index 3d5861c..15c1fd6 100644
--- a/hw/usb/dev-hid.c
+++ b/hw/usb/dev-hid.c
@@ -843,14 +843,14 @@
     if (s->kind != USB_KEYBOARD)
         qemu_remove_mouse_event_handler(s->ptr.eh_entry);
     /* TODO: else */
-    qemu_free(s);
+    g_free(s);
 }
 
 USBDevice *usb_tablet_init(void)
 {
     USBHIDState *s;
 
-    s = qemu_mallocz(sizeof(USBHIDState));
+    s = g_malloc0(sizeof(USBHIDState));
     s->dev.speed = USB_SPEED_FULL;
     s->dev.handle_packet = usb_generic_handle_packet;
 
@@ -871,7 +871,7 @@
 {
     USBHIDState *s;
 
-    s = qemu_mallocz(sizeof(USBHIDState));
+    s = g_malloc0(sizeof(USBHIDState));
     s->dev.speed = USB_SPEED_FULL;
     s->dev.handle_packet = usb_generic_handle_packet;
 
@@ -892,7 +892,7 @@
 {
     USBHIDState *s;
 
-    s = qemu_mallocz(sizeof(USBHIDState));
+    s = g_malloc0(sizeof(USBHIDState));
     s->dev.speed = USB_SPEED_FULL;
     s->dev.handle_packet = usb_generic_handle_packet;
 
diff --git a/hw/usb/dev-hub.c b/hw/usb/dev-hub.c
index e5e647b..46d0912 100644
--- a/hw/usb/dev-hub.c
+++ b/hw/usb/dev-hub.c
@@ -518,7 +518,7 @@
 {
     USBHubState *s = (USBHubState *)dev;
 
-    qemu_free(s);
+    g_free(s);
 }
 
 USBDevice *usb_hub_init(int nb_ports)
@@ -529,7 +529,7 @@
 
     if (nb_ports > MAX_PORTS)
         return NULL;
-    s = qemu_mallocz(sizeof(USBHubState));
+    s = g_malloc0(sizeof(USBHubState));
     s->dev.speed = USB_SPEED_FULL;
     s->dev.handle_packet = usb_hub_handle_packet;
 
diff --git a/hw/usb/dev-storage.c b/hw/usb/dev-storage.c
index 7a5e608..24d978c 100644
--- a/hw/usb/dev-storage.c
+++ b/hw/usb/dev-storage.c
@@ -511,7 +511,7 @@
 
     s->scsi_dev->destroy(s->scsi_dev);
     bdrv_delete(s->bs);
-    qemu_free(s);
+    g_free(s);
 }
 
 USBDevice *usb_msd_init(const char *filename)
@@ -548,7 +548,7 @@
         return NULL;
     }
 
-    s = qemu_mallocz(sizeof(MSDState));
+    s = g_malloc0(sizeof(MSDState));
 
     bdrv = bdrv_new("usb");
     if (bdrv_open(bdrv, filename, 0, drv) < 0)
@@ -570,7 +570,7 @@
     usb_msd_handle_reset((USBDevice *)s);
     return (USBDevice *)s;
  fail:
-    qemu_free(s);
+    g_free(s);
     return NULL;
 }
 
diff --git a/hw/usb/hcd-ohci.c b/hw/usb/hcd-ohci.c
index 1ac54a3..8328f1b 100644
--- a/hw/usb/hcd-ohci.c
+++ b/hw/usb/hcd-ohci.c
@@ -1738,7 +1738,7 @@
 void usb_ohci_init_pxa(hwaddr base, int num_ports, int devfn,
                        qemu_irq irq)
 {
-    OHCIState *ohci = (OHCIState *)qemu_mallocz(sizeof(OHCIState));
+    OHCIState *ohci = (OHCIState *)g_malloc0(sizeof(OHCIState));
 
     usb_ohci_init(ohci, num_ports, devfn, irq,
                   OHCI_TYPE_PXA, "OHCI USB", 0);
@@ -1749,7 +1749,7 @@
 void usb_ohci_init_sm501(uint32_t mmio_base, uint32_t localmem_base,
                          int num_ports, int devfn, qemu_irq irq)
 {
-    OHCIState *ohci = (OHCIState *)qemu_mallocz(sizeof(OHCIState));
+    OHCIState *ohci = (OHCIState *)g_malloc0(sizeof(OHCIState));
 
     usb_ohci_init(ohci, num_ports, devfn, irq,
                   OHCI_TYPE_SM501, "OHCI USB", localmem_base);
diff --git a/hw/usb/usb-linux.c b/hw/usb/usb-linux.c
index 4b0f640..05b9b27 100644
--- a/hw/usb/usb-linux.c
+++ b/hw/usb/usb-linux.c
@@ -209,12 +209,12 @@
 
 static AsyncURB *async_alloc(void)
 {
-    return (AsyncURB *) qemu_mallocz(sizeof(AsyncURB));
+    return (AsyncURB *) g_malloc0(sizeof(AsyncURB));
 }
 
 static void async_free(AsyncURB *aurb)
 {
-    qemu_free(aurb);
+    g_free(aurb);
 }
 
 static void async_complete_ctrl(USBHostDevice *s, USBPacket *p)
@@ -430,7 +430,7 @@
     if (s->fd >= 0)
         close(s->fd);
 
-    qemu_free(s);
+    g_free(s);
 }
 
 static int usb_linux_update_endp_table(USBHostDevice *s);
@@ -889,7 +889,7 @@
     struct usbdevfs_connectinfo ci;
     char buf[1024];
 
-    dev = qemu_mallocz(sizeof(USBHostDevice));
+    dev = g_malloc0(sizeof(USBHostDevice));
 
     dev->bus_num = bus_num;
     dev->addr = addr;
@@ -974,7 +974,7 @@
 
 fail:
     if (dev)
-        qemu_free(dev);
+        g_free(dev);
 
     close(fd);
     return NULL;
@@ -1300,7 +1300,7 @@
         }
 
         /* the module setting (used later for opening devices) */
-        usb_host_device_path = qemu_mallocz(strlen(devpath)+1);
+        usb_host_device_path = g_malloc0(strlen(devpath)+1);
         strcpy(usb_host_device_path, devpath);
         monitor_printf(mon, "husb: using %s file-system with %s\n",
                        fs_type[usb_fs_type], usb_host_device_path);
@@ -1442,7 +1442,7 @@
     if (parse_filter(spec, &filter) < 0)
         return -1;
 
-    f = qemu_mallocz(sizeof(*f));
+    f = g_malloc0(sizeof(*f));
 
     *f = filter;
 
@@ -1456,7 +1456,7 @@
 	usb_auto_timer = qemu_new_timer_ms(rt_clock, usb_host_auto_timer, NULL);
 	if (!usb_auto_timer) {
             fprintf(stderr, "husb: failed to allocate auto scan timer\n");
-            qemu_free(f);
+            g_free(f);
             return -1;
         }
 
diff --git a/include/android/monitor.h b/include/android/monitor.h
index b9b0b37..0d42319 100644
--- a/include/android/monitor.h
+++ b/include/android/monitor.h
@@ -8,7 +8,7 @@
     Monitor* mon;
 
     assert(cb != NULL);
-    mon = qemu_mallocz(sizeof(*mon));
+    mon = g_malloc0(sizeof(*mon));
     mon->fake_opaque = opaque;
     mon->fake_func   = cb;
     mon->fake_count  = 0;
diff --git a/include/hw/elf_ops.h b/include/hw/elf_ops.h
index 72cd83e..01be0fe 100644
--- a/include/hw/elf_ops.h
+++ b/include/hw/elf_ops.h
@@ -147,7 +147,7 @@
 #endif
         i++;
     }
-    syms = qemu_realloc(syms, nsyms * sizeof(*syms));
+    syms = g_realloc(syms, nsyms * sizeof(*syms));
 
     qsort(syms, nsyms, sizeof(*syms), glue(symcmp, SZ));
 
@@ -161,19 +161,19 @@
         goto fail;
 
     /* Commit */
-    s = qemu_mallocz(sizeof(*s));
+    s = g_malloc0(sizeof(*s));
     s->lookup_symbol = glue(lookup_symbol, SZ);
     glue(s->disas_symtab.elf, SZ) = syms;
     s->disas_num_syms = nsyms;
     s->disas_strtab = str;
     s->next = syminfos;
     syminfos = s;
-    qemu_free(shdr_table);
+    g_free(shdr_table);
     return 0;
  fail:
-    qemu_free(syms);
-    qemu_free(str);
-    qemu_free(shdr_table);
+    g_free(syms);
+    g_free(str);
+    g_free(shdr_table);
     return -1;
 }
 
@@ -217,7 +217,7 @@
 
     size = ehdr.e_phnum * sizeof(phdr[0]);
     lseek(fd, ehdr.e_phoff, SEEK_SET);
-    phdr = qemu_mallocz(size);
+    phdr = g_malloc0(size);
     if (!phdr)
         goto fail;
     if (read(fd, phdr, size) != size)
@@ -235,7 +235,7 @@
         if (ph->p_type == PT_LOAD) {
             mem_size = ph->p_memsz;
             /* XXX: avoid allocating */
-            data = qemu_mallocz(mem_size);
+            data = g_malloc0(mem_size);
             if (ph->p_filesz > 0) {
                 if (lseek(fd, ph->p_offset, SEEK_SET) < 0)
                     goto fail;
@@ -254,18 +254,18 @@
             if ((addr + mem_size) > high)
                 high = addr + mem_size;
 
-            qemu_free(data);
+            g_free(data);
             data = NULL;
         }
     }
-    qemu_free(phdr);
+    g_free(phdr);
     if (lowaddr)
         *lowaddr = (uint64_t)(elf_sword)low;
     if (highaddr)
         *highaddr = (uint64_t)(elf_sword)high;
     return total_size;
  fail:
-    qemu_free(data);
-    qemu_free(phdr);
+    g_free(data);
+    g_free(phdr);
     return -1;
 }
diff --git a/include/qemu-common.h b/include/qemu-common.h
index 949a39f..92c7a2e 100644
--- a/include/qemu-common.h
+++ b/include/qemu-common.h
@@ -39,6 +39,8 @@
 #include <sys/time.h>
 #include <assert.h>
 
+#include <glib.h>
+
 #ifdef _WIN32
 #include "sysemu/os-win32.h"
 #endif
@@ -205,14 +207,6 @@
 int ffs(int i);
 #endif
 
-void *qemu_oom_check(void *ptr);
-void *qemu_malloc(size_t size);
-void *qemu_realloc(void *ptr, size_t size);
-void *qemu_mallocz(size_t size);
-void qemu_free(void *ptr);
-char *qemu_strdup(const char *str);
-char *qemu_strndup(const char *str, size_t size);
-
 void qemu_mutex_lock_iothread(void);
 void qemu_mutex_unlock_iothread(void);
 
diff --git a/iohandler.c b/iohandler.c
index 8fc0e11..305cbeb 100644
--- a/iohandler.c
+++ b/iohandler.c
@@ -67,7 +67,7 @@
             if (ioh->fd == fd)
                 goto found;
         }
-        ioh = qemu_mallocz(sizeof(IOHandlerRecord));
+        ioh = g_malloc0(sizeof(IOHandlerRecord));
         QLIST_INSERT_HEAD(&io_handlers, ioh, next);
     found:
         ioh->fd = fd;
@@ -126,7 +126,7 @@
             /* Do this last in case read/write handlers marked it for deletion */
             if (ioh->deleted) {
                 QLIST_REMOVE(ioh, next);
-                qemu_free(ioh);
+                g_free(ioh);
             }
         }
     }
@@ -157,7 +157,7 @@
     QLIST_FOREACH_SAFE(rec, &child_watches, next, next) {
         if (waitpid(rec->pid, NULL, WNOHANG) == rec->pid) {
             QLIST_REMOVE(rec, next);
-            qemu_free(rec);
+            g_free(rec);
         }
     }
 }
@@ -185,7 +185,7 @@
             return 1;
         }
     }
-    rec = qemu_mallocz(sizeof(ChildProcessRecord));
+    rec = g_malloc0(sizeof(ChildProcessRecord));
     rec->pid = pid;
     QLIST_INSERT_HEAD(&child_watches, rec, next);
     return 0;
diff --git a/kvm-all.c b/kvm-all.c
index 64e6858..e510d39 100644
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -313,9 +313,9 @@
 
         size = ((mem->memory_size >> TARGET_PAGE_BITS) + 7) / 8;
         if (!d.dirty_bitmap) {
-            d.dirty_bitmap = qemu_malloc(size);
+            d.dirty_bitmap = g_malloc(size);
         } else if (size > allocated_size) {
-            d.dirty_bitmap = qemu_realloc(d.dirty_bitmap, size);
+            d.dirty_bitmap = g_realloc(d.dirty_bitmap, size);
         }
         allocated_size = size;
         memset(d.dirty_bitmap, 0, allocated_size);
@@ -342,7 +342,7 @@
         }
         start_addr = phys_addr;
     }
-    qemu_free(d.dirty_bitmap);
+    g_free(d.dirty_bitmap);
 
     return ret;
 }
@@ -416,7 +416,7 @@
         return -EINVAL;
     }
 
-    s = qemu_mallocz(sizeof(KVMState));
+    s = g_malloc0(sizeof(KVMState));
 
 #ifdef KVM_CAP_SET_GUEST_DEBUG
     QTAILQ_INIT(&s->kvm_sw_breakpoints);
@@ -511,7 +511,7 @@
         if (s->fd != -1)
             close(s->fd);
     }
-    qemu_free(s);
+    g_free(s);
 
     return ret;
 }
@@ -934,7 +934,7 @@
             return 0;
         }
 
-        bp = qemu_malloc(sizeof(struct kvm_sw_breakpoint));
+        bp = g_malloc(sizeof(struct kvm_sw_breakpoint));
         if (!bp)
             return -ENOMEM;
 
@@ -984,7 +984,7 @@
             return err;
 
         QTAILQ_REMOVE(&current_env->kvm_state->kvm_sw_breakpoints, bp, entry);
-        qemu_free(bp);
+        g_free(bp);
     } else {
         err = kvm_arch_remove_hw_breakpoint(addr, len, type);
         if (err)
diff --git a/memcheck/memcheck.c b/memcheck/memcheck.c
index 0865052..5f0376a 100644
--- a/memcheck/memcheck.c
+++ b/memcheck/memcheck.c
@@ -425,7 +425,7 @@
     thread = get_current_thread();
     desc.call_stack_count = thread->call_stack_count;
     if (desc.call_stack_count) {
-        desc.call_stack = qemu_malloc(desc.call_stack_count * sizeof(target_ulong));
+        desc.call_stack = g_malloc(desc.call_stack_count * sizeof(target_ulong));
         if (desc.call_stack == NULL) {
             ME("memcheck: Unable to allocate %u bytes for the calling stack",
                desc.call_stack_count * sizeof(target_ulong));
@@ -462,7 +462,7 @@
             memcheck_dump_malloc_desc(&replaced, 1, 1);
         }
         if (replaced.call_stack != NULL) {
-            qemu_free(replaced.call_stack);
+            g_free(replaced.call_stack);
         }
     } else {
         ME("memcheck: Unable to insert an entry to the allocation map:");
@@ -517,7 +517,7 @@
         }
     }
     if (pulled.call_stack != NULL) {
-        qemu_free(pulled.call_stack);
+        g_free(pulled.call_stack);
     }
 }
 
diff --git a/memcheck/memcheck_common.h b/memcheck/memcheck_common.h
index e753094..3c91744 100644
--- a/memcheck/memcheck_common.h
+++ b/memcheck/memcheck_common.h
@@ -415,7 +415,7 @@
     addr &= ~1;
     if (addr_array->num == 0) {
         /* First element. */
-        addr_array->addr = qemu_malloc(sizeof(target_ulong));
+        addr_array->addr = g_malloc(sizeof(target_ulong));
         assert(addr_array->addr != NULL);
         if (addr_array->addr == NULL) {
             return 0;
@@ -444,7 +444,7 @@
         m_max = 0;
     }
     /* Expand the array. */
-    new_arr = qemu_malloc(sizeof(target_ulong) * (addr_array->num + 1));
+    new_arr = g_malloc(sizeof(target_ulong) * (addr_array->num + 1));
     assert(new_arr != NULL);
     if (new_arr == NULL) {
         return 0;
@@ -465,7 +465,7 @@
                (addr_array->num - m_max) * sizeof(target_ulong));
     }
     /* Swap arrays. */
-    qemu_free(addr_array->addr);
+    g_free(addr_array->addr);
     addr_array->addr = new_arr;
     addr_array->num++;
     return 1;
diff --git a/memcheck/memcheck_malloc_map.c b/memcheck/memcheck_malloc_map.c
index d7e8032..42d935b 100644
--- a/memcheck/memcheck_malloc_map.c
+++ b/memcheck/memcheck_malloc_map.c
@@ -121,7 +121,7 @@
      * with the new one. */
     memcpy(replaced, &existing->desc, sizeof(MallocDescEx));
     AllocMap_RB_REMOVE(map, existing);
-    qemu_free(existing);
+    g_free(existing);
     AllocMap_RB_INSERT(map, adesc);
     return RBT_MAP_RESULT_ENTRY_REPLACED;
 }
@@ -165,7 +165,7 @@
     RBTMapResult ret;
 
     // Allocate and initialize new map entry.
-    AllocMapEntry* adesc = qemu_malloc(sizeof(AllocMapEntry));
+    AllocMapEntry* adesc = g_malloc(sizeof(AllocMapEntry));
     if (adesc == NULL) {
         ME("memcheck: Unable to allocate new AllocMapEntry on insert.");
         return RBT_MAP_RESULT_ERROR;
@@ -178,7 +178,7 @@
         ret == RBT_MAP_RESULT_ERROR) {
         /* Another descriptor already exists for this block, or an error
          * occurred. We have to tree new descriptor, as it wasn't inserted. */
-        qemu_free(adesc);
+        g_free(adesc);
     }
     return ret;
 }
@@ -197,7 +197,7 @@
     if (adesc != NULL) {
         memcpy(pulled, &adesc->desc, sizeof(MallocDescEx));
         AllocMap_RB_REMOVE(map, adesc);
-        qemu_free(adesc);
+        g_free(adesc);
         return 0;
     } else {
         return -1;
@@ -211,7 +211,7 @@
     if (first != NULL) {
         memcpy(pulled, &first->desc, sizeof(MallocDescEx));
         AllocMap_RB_REMOVE(map, first);
-        qemu_free(first);
+        g_free(first);
         return 0;
     } else {
         return -1;
@@ -228,7 +228,7 @@
     RB_FOREACH(entry, AllocMap, (AllocMap*)from) {
         RBTMapResult ins_res;
         AllocMapEntry* new_entry =
-                (AllocMapEntry*)qemu_malloc(sizeof(AllocMapEntry));
+                (AllocMapEntry*)g_malloc(sizeof(AllocMapEntry));
         if (new_entry == NULL) {
             ME("memcheck: Unable to allocate new AllocMapEntry on copy.");
             return -1;
@@ -238,7 +238,7 @@
         new_entry->desc.flags |= set_flags;
         if (entry->desc.call_stack_count) {
             new_entry->desc.call_stack =
-               qemu_malloc(entry->desc.call_stack_count * sizeof(target_ulong));
+               g_malloc(entry->desc.call_stack_count * sizeof(target_ulong));
             memcpy(new_entry->desc.call_stack, entry->desc.call_stack,
                    entry->desc.call_stack_count * sizeof(target_ulong));
         } else {
@@ -256,9 +256,9 @@
             ME("memcheck: Unable to insert new map entry on copy. Insert returned %u",
                ins_res);
             if (new_entry->desc.call_stack != NULL) {
-                qemu_free(new_entry->desc.call_stack);
+                g_free(new_entry->desc.call_stack);
             }
-            qemu_free(new_entry);
+            g_free(new_entry);
             return -1;
         }
     }
@@ -275,7 +275,7 @@
     while (!allocmap_pull_first(map, &pulled)) {
         removed++;
         if (pulled.call_stack != NULL) {
-            qemu_free(pulled.call_stack);
+            g_free(pulled.call_stack);
         }
     }
 
diff --git a/memcheck/memcheck_mmrange_map.c b/memcheck/memcheck_mmrange_map.c
index d9a1211..1dbfdfd 100644
--- a/memcheck/memcheck_mmrange_map.c
+++ b/memcheck/memcheck_mmrange_map.c
@@ -83,7 +83,7 @@
      * with the new one. */
     memcpy(replaced, &existing->desc, sizeof(MMRangeDesc));
     MMRangeMap_RB_REMOVE(map, existing);
-    qemu_free(existing);
+    g_free(existing);
     MMRangeMap_RB_INSERT(map, rdesc);
     return RBT_MAP_RESULT_ENTRY_REPLACED;
 }
@@ -126,7 +126,7 @@
     RBTMapResult ret;
 
     // Allocate and initialize new map entry.
-    MMRangeMapEntry* rdesc = qemu_malloc(sizeof(MMRangeMapEntry));
+    MMRangeMapEntry* rdesc = g_malloc(sizeof(MMRangeMapEntry));
     if (rdesc == NULL) {
         ME("memcheck: Unable to allocate new MMRangeMapEntry on insert.");
         return RBT_MAP_RESULT_ERROR;
@@ -139,7 +139,7 @@
         ret == RBT_MAP_RESULT_ERROR) {
         /* Another descriptor already exists for this block, or an error
          * occurred. We have to free new descriptor, as it wasn't inserted. */
-        qemu_free(rdesc);
+        g_free(rdesc);
     }
     return ret;
 }
@@ -161,7 +161,7 @@
     if (rdesc != NULL) {
         memcpy(pulled, &rdesc->desc, sizeof(MMRangeDesc));
         MMRangeMap_RB_REMOVE(map, rdesc);
-        qemu_free(rdesc);
+        g_free(rdesc);
         return 0;
     } else {
         return -1;
@@ -175,7 +175,7 @@
     if (first != NULL) {
         memcpy(pulled, &first->desc, sizeof(MMRangeDesc));
         MMRangeMap_RB_REMOVE(map, first);
-        qemu_free(first);
+        g_free(first);
         return 0;
     } else {
         return -1;
@@ -189,16 +189,16 @@
     RB_FOREACH(entry, MMRangeMap, (MMRangeMap*)from) {
         RBTMapResult ins_res;
         MMRangeMapEntry* new_entry =
-                (MMRangeMapEntry*)qemu_malloc(sizeof(MMRangeMapEntry));
+                (MMRangeMapEntry*)g_malloc(sizeof(MMRangeMapEntry));
         if (new_entry == NULL) {
             ME("memcheck: Unable to allocate new MMRangeMapEntry on copy.");
             return -1;
         }
         memcpy(new_entry, entry, sizeof(MMRangeMapEntry));
-        new_entry->desc.path = qemu_malloc(strlen(entry->desc.path) + 1);
+        new_entry->desc.path = g_malloc(strlen(entry->desc.path) + 1);
         if (new_entry->desc.path == NULL) {
             ME("memcheck: Unable to allocate new path for MMRangeMapEntry on copy.");
-            qemu_free(new_entry);
+            g_free(new_entry);
             return -1;
         }
         strcpy(new_entry->desc.path, entry->desc.path);
@@ -206,8 +206,8 @@
         if (ins_res != RBT_MAP_RESULT_ENTRY_INSERTED) {
             ME("memcheck: Unable to insert new range map entry on copy. Insert returned %u",
                ins_res);
-            qemu_free(new_entry->desc.path);
-            qemu_free(new_entry);
+            g_free(new_entry->desc.path);
+            g_free(new_entry);
             return -1;
         }
     }
@@ -222,7 +222,7 @@
     int removed = 0;
 
     while (!mmrangemap_pull_first(map, &pulled)) {
-        qemu_free(pulled.path);
+        g_free(pulled.path);
         removed++;
     }
 
diff --git a/memcheck/memcheck_proc_management.c b/memcheck/memcheck_proc_management.c
index 45cf141..d33ed97 100644
--- a/memcheck/memcheck_proc_management.c
+++ b/memcheck/memcheck_proc_management.c
@@ -68,7 +68,7 @@
 static ThreadDesc*
 create_new_thread(ProcDesc* proc, uint32_t tid)
 {
-    ThreadDesc* new_thread = (ThreadDesc*)qemu_malloc(sizeof(ThreadDesc));
+    ThreadDesc* new_thread = (ThreadDesc*)g_malloc(sizeof(ThreadDesc));
     if (new_thread == NULL) {
         ME("memcheck: Unable to allocate new thread descriptor.");
         return NULL;
@@ -98,7 +98,7 @@
 create_new_process(uint32_t pid, uint32_t parent_pid)
 {
     // Create and init new process descriptor.
-    ProcDesc* new_proc = (ProcDesc*)qemu_malloc(sizeof(ProcDesc));
+    ProcDesc* new_proc = (ProcDesc*)g_malloc(sizeof(ProcDesc));
     if (new_proc == NULL) {
         ME("memcheck: Unable to allocate new process descriptor");
         return NULL;
@@ -121,7 +121,7 @@
         if (parent == NULL) {
             ME("memcheck: Unable to get parent process pid=%u for new process pid=%u",
                parent_pid, pid);
-            qemu_free(new_proc);
+            g_free(new_proc);
             return NULL;
         }
 
@@ -134,7 +134,7 @@
             ME("memcheck: Unable to copy process' %s[pid=%u] allocation map to new process pid=%u",
                parent->image_path, parent_pid, pid);
             allocmap_empty(&new_proc->alloc_map);
-            qemu_free(new_proc);
+            g_free(new_proc);
             return NULL;
         }
 
@@ -145,7 +145,7 @@
                parent->image_path, parent_pid, pid);
             mmrangemap_empty(&new_proc->mmrange_map);
             allocmap_empty(&new_proc->alloc_map);
-            qemu_free(new_proc);
+            g_free(new_proc);
             return NULL;
         }
     }
@@ -154,7 +154,7 @@
     if(create_new_thread(new_proc, pid) == NULL) {
         mmrangemap_empty(&new_proc->mmrange_map);
         allocmap_empty(&new_proc->alloc_map);
-        qemu_free(new_proc);
+        g_free(new_proc);
         return NULL;
     }
 
@@ -264,12 +264,12 @@
             // Paths are the same. Just bail out.
             return 0;
         }
-        qemu_free(proc->image_path);
+        g_free(proc->image_path);
         proc->image_path = NULL;
     }
 
     // Save new image path into process' descriptor.
-    proc->image_path = qemu_malloc(strlen(image_path) + 1);
+    proc->image_path = g_malloc(strlen(image_path) + 1);
     if (proc->image_path == NULL) {
         ME("memcheck: Unable to allocate %u bytes for image path %s to set it for pid=%u",
            strlen(image_path) + 1, image_path, proc->pid);
@@ -293,12 +293,12 @@
     if (thread->call_stack != NULL) {
         for (indx = 0; indx < thread->call_stack_count; indx++) {
             if (thread->call_stack[indx].module_path != NULL) {
-                qemu_free(thread->call_stack[indx].module_path);
+                g_free(thread->call_stack[indx].module_path);
             }
         }
-        qemu_free(thread->call_stack);
+        g_free(thread->call_stack);
     }
-    qemu_free(thread);
+    g_free(thread);
 }
 
 // =============================================================================
@@ -382,7 +382,7 @@
         /* Expand calling stack array buffer. */
         thread->call_stack_max += grow_by;
         ThreadCallStackEntry* new_array =
-            qemu_malloc(thread->call_stack_max * sizeof(ThreadCallStackEntry));
+            g_malloc(thread->call_stack_max * sizeof(ThreadCallStackEntry));
         if (new_array == NULL) {
             ME("memcheck: Unable to allocate %u bytes for calling stack.",
                thread->call_stack_max * sizeof(ThreadCallStackEntry));
@@ -394,7 +394,7 @@
                    thread->call_stack_count * sizeof(ThreadCallStackEntry));
         }
         if (thread->call_stack != NULL) {
-            qemu_free(thread->call_stack);
+            g_free(thread->call_stack);
         }
         thread->call_stack = new_array;
     }
@@ -405,7 +405,7 @@
     thread->call_stack[thread->call_stack_count].ret_address_rel =
             mmrangedesc_get_module_offset(rdesc, ret);
     thread->call_stack[thread->call_stack_count].module_path =
-            qemu_malloc(strlen(rdesc->path) + 1);
+            g_malloc(strlen(rdesc->path) + 1);
     if (thread->call_stack[thread->call_stack_count].module_path == NULL) {
         ME("memcheck: Unable to allocate %u bytes for module path in the thread calling stack.",
             strlen(rdesc->path) + 1);
@@ -686,9 +686,9 @@
     // Empty process' mmapings map.
     mmrangemap_empty(&proc->mmrange_map);
     if (proc->image_path != NULL) {
-        qemu_free(proc->image_path);
+        g_free(proc->image_path);
     }
-    qemu_free(proc);
+    g_free(proc);
 }
 
 void
@@ -715,7 +715,7 @@
     desc.map_start = vstart;
     desc.map_end = vend;
     desc.exec_offset = exec_offset;
-    desc.path = qemu_malloc(strlen(path) + 1);
+    desc.path = g_malloc(strlen(path) + 1);
     if (desc.path == NULL) {
         ME("memcheck: MMAP(0x%08X, 0x%08X, 0x%08X, %s) Unable to allocate path for the entry.",
            vstart, vend, exec_offset, path);
@@ -727,7 +727,7 @@
     if (ins_res == RBT_MAP_RESULT_ERROR) {
         ME("memcheck: %s[pid=%u] unable to insert memory mapping entry: 0x%08X - 0x%08X",
            proc->image_path, proc->pid, vstart, vend);
-        qemu_free(desc.path);
+        g_free(desc.path);
         return;
     }
 
@@ -735,7 +735,7 @@
         MD("memcheck: %s[pid=%u] MMRANGE %s[0x%08X - 0x%08X] is replaced with %s[0x%08X - 0x%08X]",
            proc->image_path, proc->pid, replaced.path, replaced.map_start,
            replaced.map_end, desc.path, desc.map_start, desc.map_end);
-        qemu_free(replaced.path);
+        g_free(replaced.path);
     }
 
     T(PROC_MMAP, "memcheck: %s[pid=%u] %s is mapped: 0x%08X - 0x%08X + 0x%08X\n",
@@ -761,7 +761,7 @@
         /* Entire mapping has been deleted. */
         T(PROC_MMAP, "memcheck: %s[pid=%u] %s is unmapped: [0x%08X - 0x%08X + 0x%08X]\n",
           proc->image_path, proc->pid, desc.path, vstart, vend, desc.exec_offset);
-        qemu_free(desc.path);
+        g_free(desc.path);
         return;
     }
 
@@ -785,7 +785,7 @@
         tail.map_start = vend;
         tail.map_end = desc.map_end;
         tail.exec_offset = vend - desc.map_start + desc.exec_offset;
-        tail.path = qemu_malloc(strlen(desc.path) + 1);
+        tail.path = g_malloc(strlen(desc.path) + 1);
         strcpy(tail.path, desc.path);
         mmrangemap_insert(&proc->mmrange_map, &tail, NULL);
         desc.map_end = vstart;
diff --git a/migration-exec.c b/migration-exec.c
index 086ba12..2c4e7bc 100644
--- a/migration-exec.c
+++ b/migration-exec.c
@@ -69,7 +69,7 @@
     FdMigrationState *s;
     FILE *f;
 
-    s = qemu_mallocz(sizeof(*s));
+    s = g_malloc0(sizeof(*s));
 
     f = popen(command, "w");
     if (f == NULL) {
@@ -110,7 +110,7 @@
 err_after_open:
     pclose(f);
 err_after_alloc:
-    qemu_free(s);
+    g_free(s);
     return NULL;
 }
 
diff --git a/migration-tcp-android.c b/migration-tcp-android.c
index 6894852..ed3dd67 100644
--- a/migration-tcp-android.c
+++ b/migration-tcp-android.c
@@ -79,7 +79,7 @@
     if (parse_host_port(&addr, host_port) < 0)
         return NULL;
 
-    s = qemu_mallocz(sizeof(*s));
+    s = g_malloc0(sizeof(*s));
 
     s->get_error = socket_errno;
     s->write = socket_write;
@@ -93,7 +93,7 @@
     s->bandwidth_limit = bandwidth_limit;
     s->fd = socket_create_inet(SOCKET_STREAM);
     if (s->fd == -1) {
-        qemu_free(s);
+        g_free(s);
         return NULL;
     }
 
@@ -114,7 +114,7 @@
     if (ret < 0 && ret != -EINPROGRESS && ret != -EWOULDBLOCK && ret != -EAGAIN) {
         dprintf("connect failed\n");
         socket_close(s->fd);
-        qemu_free(s);
+        g_free(s);
         return NULL;
     } else if (ret >= 0)
         migrate_fd_connect(s);
diff --git a/migration-tcp.c b/migration-tcp.c
index d94d8e7..46354c3 100644
--- a/migration-tcp.c
+++ b/migration-tcp.c
@@ -87,7 +87,7 @@
     if (parse_host_port(&addr, host_port) < 0)
         return NULL;
 
-    s = qemu_mallocz(sizeof(*s));
+    s = g_malloc0(sizeof(*s));
 
     s->get_error = socket_errno;
     s->write = socket_write;
@@ -101,7 +101,7 @@
     s->bandwidth_limit = bandwidth_limit;
     s->fd = socket(PF_INET, SOCK_STREAM, 0);
     if (s->fd == -1) {
-        qemu_free(s);
+        g_free(s);
         return NULL;
     }
 
@@ -122,7 +122,7 @@
     if (ret < 0 && ret != -EINPROGRESS && ret != -EWOULDBLOCK) {
         dprintf("connect failed\n");
         close(s->fd);
-        qemu_free(s);
+        g_free(s);
         return NULL;
     } else if (ret >= 0)
         migrate_fd_connect(s);
diff --git a/monitor.c b/monitor.c
index 7866587..6b32668 100644
--- a/monitor.c
+++ b/monitor.c
@@ -1507,7 +1507,7 @@
         if (i == n) {
             s->ops.destroy (s->opaque);
             QLIST_REMOVE (s, entries);
-            qemu_free (s);
+            g_free (s);
             return;
         }
     }
@@ -1520,7 +1520,7 @@
 {
     CaptureState *s;
 
-    s = qemu_mallocz (sizeof (*s));
+    s = g_malloc0 (sizeof (*s));
 
     freq = has_freq ? freq : 44100;
     bits = has_bits ? bits : 16;
@@ -1528,7 +1528,7 @@
 
     if (wav_start_capture (s, path, freq, bits, nchannels)) {
         monitor_printf(mon, "Faied to add wave capture\n");
-        qemu_free (s);
+        g_free (s);
     }
     QLIST_INSERT_HEAD (&capture_head, s, entries);
 }
@@ -2511,7 +2511,7 @@
                     }
                     goto fail;
                 }
-                str = qemu_malloc(strlen(buf) + 1);
+                str = g_malloc(strlen(buf) + 1);
                 pstrcpy(str, sizeof(buf), buf);
                 str_allocated[nb_args] = str;
             add_str:
@@ -2753,7 +2753,7 @@
     }
  fail:
     for(i = 0; i < MAX_ARGS; i++)
-        qemu_free(str_allocated[i]);
+        g_free(str_allocated[i]);
 }
 
 void monitor_set_error(Monitor *mon, QError *qerror)
@@ -2878,7 +2878,7 @@
         if (nb_args >= MAX_ARGS)
             break;
         ret = get_str(buf, sizeof(buf), &p);
-        args[nb_args] = qemu_strdup(buf);
+        args[nb_args] = g_strdup(buf);
         nb_args++;
         if (ret < 0)
             break;
@@ -2908,7 +2908,7 @@
     if (len > 0 && qemu_isspace(cmdline[len - 1])) {
         if (nb_args >= MAX_ARGS)
             return;
-        args[nb_args++] = qemu_strdup("");
+        args[nb_args++] = g_strdup("");
     }
     if (nb_args <= 1) {
         /* command completion */
@@ -2970,7 +2970,7 @@
         }
     }
     for(i = 0; i < nb_args; i++)
-        qemu_free(args[i]);
+        g_free(args[i]);
 }
 
 static int monitor_can_read(void *opaque)
@@ -3087,7 +3087,7 @@
         is_first_init = 0;
     }
 
-    mon = qemu_mallocz(sizeof(*mon));
+    mon = g_malloc0(sizeof(*mon));
 
     mon->chr = chr;
     mon->flags = flags;
@@ -3114,7 +3114,7 @@
     readline_free(mon->rs);
     qemu_chr_close(mon->chr);
 
-    qemu_free(mon);
+    g_free(mon);
 }
 
 static void bdrv_password_cb(Monitor *mon, const char *password, void *opaque)
diff --git a/net/net-android.c b/net/net-android.c
index 5eca787..93a0062 100644
--- a/net/net-android.c
+++ b/net/net-android.c
@@ -372,7 +372,7 @@
                                       void *opaque)
 {
     VLANClientState *vc, **pvc;
-    vc = qemu_mallocz(sizeof(VLANClientState));
+    vc = g_malloc0(sizeof(VLANClientState));
     vc->model = strdup(model);
     if (name)
         vc->name = strdup(name);
@@ -405,7 +405,7 @@
             }
             free(vc->name);
             free(vc->model);
-            qemu_free(vc);
+            g_free(vc);
             break;
         } else
             pvc = &(*pvc)->next;
@@ -491,7 +491,7 @@
         if (packet->sent_cb)
             packet->sent_cb(packet->sender);
 
-        qemu_free(packet);
+        g_free(packet);
     }
 }
 
@@ -501,7 +501,7 @@
 {
     VLANPacket *packet;
 
-    packet = qemu_malloc(sizeof(VLANPacket) + size);
+    packet = g_malloc(sizeof(VLANPacket) + size);
     packet->next = sender->vlan->send_queue;
     packet->sender = sender;
     packet->size = size;
@@ -618,7 +618,7 @@
 
     max_len = calc_iov_length(iov, iovcnt);
 
-    packet = qemu_malloc(sizeof(VLANPacket) + max_len);
+    packet = g_malloc(sizeof(VLANPacket) + max_len);
     packet->next = sender->vlan->send_queue;
     packet->sender = sender;
     packet->sent_cb = sent_cb;
@@ -851,7 +851,7 @@
 
             slirp_redirection(NULL, config->str);
             slirp_redirs = config->next;
-            qemu_free(config);
+            g_free(config);
         }
 #ifndef _WIN32
         if (slirp_smb_export) {
@@ -1003,7 +1003,7 @@
         if (mon) {
             monitor_printf(mon, "user mode network stack not in use\n");
         } else {
-            config = qemu_malloc(sizeof(*config));
+            config = g_malloc(sizeof(*config));
             config->str = redir_str;
             config->next = slirp_redirs;
             slirp_redirs = config;
@@ -1245,7 +1245,7 @@
 
     qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
     close(s->fd);
-    qemu_free(s);
+    g_free(s);
 }
 
 /* fd support */
@@ -1257,7 +1257,7 @@
 {
     TAPState *s;
 
-    s = qemu_mallocz(sizeof(TAPState));
+    s = g_malloc0(sizeof(TAPState));
     s->fd = fd;
     s->vc = qemu_new_vlan_client(vlan, model, name, NULL, tap_receive,
                                  tap_receive_iov, tap_cleanup, s);
@@ -1570,7 +1570,7 @@
     VDEState *s = vc->opaque;
     qemu_set_fd_handler(vde_datafd(s->vde), NULL, NULL, NULL);
     vde_close(s->vde);
-    qemu_free(s);
+    g_free(s);
 }
 
 static int net_vde_init(VLANState *vlan, const char *model,
@@ -1587,7 +1587,7 @@
         .mode = mode,
     };
 
-    s = qemu_mallocz(sizeof(VDEState));
+    s = g_malloc0(sizeof(VDEState));
     s->vde = vde_open(init_sock, (char *)"QEMU", &args);
     if (!s->vde){
         free(s);
@@ -1775,7 +1775,7 @@
     NetSocketState *s = vc->opaque;
     qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
     socket_close(s->fd);
-    qemu_free(s);
+    g_free(s);
 }
 
 static NetSocketState *net_socket_fd_init_dgram(VLANState *vlan,
@@ -1818,7 +1818,7 @@
 	}
     }
 
-    s = qemu_mallocz(sizeof(NetSocketState));
+    s = g_malloc0(sizeof(NetSocketState));
     s->fd = fd;
 
     s->vc = qemu_new_vlan_client(vlan, model, name, NULL, net_socket_receive_dgram,
@@ -1847,7 +1847,7 @@
                                                  int fd, int is_connected)
 {
     NetSocketState *s;
-    s = qemu_mallocz(sizeof(NetSocketState));
+    s = g_malloc0(sizeof(NetSocketState));
     s->fd = fd;
     s->vc = qemu_new_vlan_client(vlan, model, name, NULL, net_socket_receive,
                                  NULL, net_socket_cleanup, s);
@@ -1916,7 +1916,7 @@
     if (parse_host_port(&saddr, host_str) < 0)
         return -1;
 
-    s = qemu_mallocz(sizeof(NetSocketListenState));
+    s = g_malloc0(sizeof(NetSocketListenState));
 
     fd = socket_create_inet(SOCKET_STREAM);
     if (fd < 0) {
@@ -2083,7 +2083,7 @@
     DumpState *s = vc->opaque;
 
     close(s->fd);
-    qemu_free(s);
+    g_free(s);
 }
 
 static int net_dump_init(Monitor *mon, VLANState *vlan, const char *device,
@@ -2092,7 +2092,7 @@
     struct pcap_file_hdr hdr;
     DumpState *s;
 
-    s = qemu_malloc(sizeof(DumpState));
+    s = g_malloc(sizeof(DumpState));
 
     s->fd = open(filename, O_CREAT | O_WRONLY, 0644);
     if (s->fd < 0) {
@@ -2113,7 +2113,7 @@
     if (write(s->fd, &hdr, sizeof(hdr)) < sizeof(hdr)) {
         config_error(mon, "-net dump write error: %s\n", strerror(errno));
         close(s->fd);
-        qemu_free(s);
+        g_free(s);
         return -1;
     }
 
@@ -2132,7 +2132,7 @@
         if (vlan->id == id)
             return vlan;
     }
-    vlan = qemu_mallocz(sizeof(VLANState));
+    vlan = g_malloc0(sizeof(VLANState));
     vlan->id = id;
     vlan->next = NULL;
     pvlan = &first_vlan;
@@ -2203,7 +2203,7 @@
     vlan = qemu_find_vlan(vlan_id);
 
     if (get_param_value(buf, sizeof(buf), "name", p)) {
-        name = qemu_strdup(buf);
+        name = g_strdup(buf);
     }
     if (!strcmp(device, "nic")) {
         static const char * const nic_params[] = {
@@ -2280,11 +2280,11 @@
             restricted = (buf[0] == 'y') ? 1 : 0;
         }
         if (get_param_value(buf, sizeof(buf), "ip", p)) {
-            ip = qemu_strdup(buf);
+            ip = g_strdup(buf);
         }
         vlan->nb_host_devs++;
         ret = net_slirp_init(vlan, device, name, restricted, ip);
-        qemu_free(ip);
+        g_free(ip);
     } else if (!strcmp(device, "channel")) {
         long port;
         char name[20], *devname;
@@ -2474,7 +2474,7 @@
         config_error(mon, "Could not initialize device '%s'\n", device);
     }
 out:
-    qemu_free(name);
+    g_free(name);
     return ret;
 }
 
diff --git a/net/net.c b/net/net.c
index 6e70691..b05181d 100644
--- a/net/net.c
+++ b/net/net.c
@@ -339,7 +339,7 @@
                                       void *opaque)
 {
     VLANClientState *vc, **pvc;
-    vc = qemu_mallocz(sizeof(VLANClientState));
+    vc = g_malloc0(sizeof(VLANClientState));
     vc->model = strdup(model);
     if (name)
         vc->name = strdup(name);
@@ -372,7 +372,7 @@
             }
             free(vc->name);
             free(vc->model);
-            qemu_free(vc);
+            g_free(vc);
             break;
         } else
             pvc = &(*pvc)->next;
@@ -458,7 +458,7 @@
         if (packet->sent_cb)
             packet->sent_cb(packet->sender);
 
-        qemu_free(packet);
+        g_free(packet);
     }
 }
 
@@ -468,7 +468,7 @@
 {
     VLANPacket *packet;
 
-    packet = qemu_malloc(sizeof(VLANPacket) + size);
+    packet = g_malloc(sizeof(VLANPacket) + size);
     packet->next = sender->vlan->send_queue;
     packet->sender = sender;
     packet->size = size;
@@ -585,7 +585,7 @@
 
     max_len = calc_iov_length(iov, iovcnt);
 
-    packet = qemu_malloc(sizeof(VLANPacket) + max_len);
+    packet = g_malloc(sizeof(VLANPacket) + max_len);
     packet->next = sender->vlan->send_queue;
     packet->sender = sender;
     packet->sent_cb = sent_cb;
@@ -724,7 +724,7 @@
 
             slirp_redirection(NULL, config->str);
             slirp_redirs = config->next;
-            qemu_free(config);
+            g_free(config);
         }
 #ifndef _WIN32
         if (slirp_smb_export) {
@@ -875,7 +875,7 @@
         if (mon) {
             monitor_printf(mon, "user mode network stack not in use\n");
         } else {
-            config = qemu_malloc(sizeof(*config));
+            config = g_malloc(sizeof(*config));
             config->str = redir_str;
             config->next = slirp_redirs;
             slirp_redirs = config;
@@ -1117,7 +1117,7 @@
 
     qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
     close(s->fd);
-    qemu_free(s);
+    g_free(s);
 }
 
 /* fd support */
@@ -1129,7 +1129,7 @@
 {
     TAPState *s;
 
-    s = qemu_mallocz(sizeof(TAPState));
+    s = g_malloc0(sizeof(TAPState));
     s->fd = fd;
     s->vc = qemu_new_vlan_client(vlan, model, name, NULL, tap_receive,
                                  tap_receive_iov, tap_cleanup, s);
@@ -1442,7 +1442,7 @@
     VDEState *s = vc->opaque;
     qemu_set_fd_handler(vde_datafd(s->vde), NULL, NULL, NULL);
     vde_close(s->vde);
-    qemu_free(s);
+    g_free(s);
 }
 
 static int net_vde_init(VLANState *vlan, const char *model,
@@ -1459,7 +1459,7 @@
         .mode = mode,
     };
 
-    s = qemu_mallocz(sizeof(VDEState));
+    s = g_malloc0(sizeof(VDEState));
     s->vde = vde_open(init_sock, (char *)"QEMU", &args);
     if (!s->vde){
         free(s);
@@ -1657,7 +1657,7 @@
     NetSocketState *s = vc->opaque;
     qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
     close(s->fd);
-    qemu_free(s);
+    g_free(s);
 }
 
 static NetSocketState *net_socket_fd_init_dgram(VLANState *vlan,
@@ -1701,7 +1701,7 @@
 	}
     }
 
-    s = qemu_mallocz(sizeof(NetSocketState));
+    s = g_malloc0(sizeof(NetSocketState));
     s->fd = fd;
 
     s->vc = qemu_new_vlan_client(vlan, model, name, NULL, net_socket_receive_dgram,
@@ -1730,7 +1730,7 @@
                                                  int fd, int is_connected)
 {
     NetSocketState *s;
-    s = qemu_mallocz(sizeof(NetSocketState));
+    s = g_malloc0(sizeof(NetSocketState));
     s->fd = fd;
     s->vc = qemu_new_vlan_client(vlan, model, name, NULL, net_socket_receive,
                                  NULL, net_socket_cleanup, s);
@@ -1807,7 +1807,7 @@
     if (parse_host_port(&saddr, host_str) < 0)
         return -1;
 
-    s = qemu_mallocz(sizeof(NetSocketListenState));
+    s = g_malloc0(sizeof(NetSocketListenState));
 
     fd = socket(PF_INET, SOCK_STREAM, 0);
     if (fd < 0) {
@@ -1979,7 +1979,7 @@
     DumpState *s = vc->opaque;
 
     close(s->fd);
-    qemu_free(s);
+    g_free(s);
 }
 
 static int net_dump_init(Monitor *mon, VLANState *vlan, const char *device,
@@ -1988,7 +1988,7 @@
     struct pcap_file_hdr hdr;
     DumpState *s;
 
-    s = qemu_malloc(sizeof(DumpState));
+    s = g_malloc(sizeof(DumpState));
 
     s->fd = open(filename, O_CREAT | O_WRONLY, 0644);
     if (s->fd < 0) {
@@ -2009,7 +2009,7 @@
     if (write(s->fd, &hdr, sizeof(hdr)) < sizeof(hdr)) {
         config_error(mon, "-net dump write error: %s\n", strerror(errno));
         close(s->fd);
-        qemu_free(s);
+        g_free(s);
         return -1;
     }
 
@@ -2028,7 +2028,7 @@
         if (vlan->id == id)
             return vlan;
     }
-    vlan = qemu_mallocz(sizeof(VLANState));
+    vlan = g_malloc0(sizeof(VLANState));
     vlan->id = id;
     vlan->next = NULL;
     pvlan = &first_vlan;
@@ -2099,7 +2099,7 @@
     vlan = qemu_find_vlan(vlan_id);
 
     if (get_param_value(buf, sizeof(buf), "name", p)) {
-        name = qemu_strdup(buf);
+        name = g_strdup(buf);
     }
     if (!strcmp(device, "nic")) {
         static const char * const nic_params[] = {
@@ -2176,11 +2176,11 @@
             restricted = (buf[0] == 'y') ? 1 : 0;
         }
         if (get_param_value(buf, sizeof(buf), "ip", p)) {
-            ip = qemu_strdup(buf);
+            ip = g_strdup(buf);
         }
         vlan->nb_host_devs++;
         ret = net_slirp_init(vlan, device, name, restricted, ip);
-        qemu_free(ip);
+        g_free(ip);
     } else if (!strcmp(device, "channel")) {
         long port;
         char name[20], *devname;
@@ -2370,7 +2370,7 @@
         config_error(mon, "Could not initialize device '%s'\n", device);
     }
 out:
-    qemu_free(name);
+    g_free(name);
     return ret;
 }
 
diff --git a/os-posix.c b/os-posix.c
index bb803c1..75d68b5 100644
--- a/os-posix.c
+++ b/os-posix.c
@@ -135,12 +135,12 @@
 
     max_len = strlen(dir) +
         MAX(strlen(SHARE_SUFFIX), strlen(BUILD_SUFFIX)) + 1;
-    res = qemu_mallocz(max_len);
+    res = g_malloc0(max_len);
     snprintf(res, max_len, "%s%s", dir, SHARE_SUFFIX);
     if (access(res, R_OK)) {
         snprintf(res, max_len, "%s%s", dir, BUILD_SUFFIX);
         if (access(res, R_OK)) {
-            qemu_free(res);
+            g_free(res);
             res = NULL;
         }
     }
diff --git a/os-win32.c b/os-win32.c
index 9c9d3a3..0acbaf9 100644
--- a/os-win32.c
+++ b/os-win32.c
@@ -41,7 +41,7 @@
     int result = 0;
     if (overwrite || !getenv(name)) {
         size_t length = strlen(name) + strlen(value) + 2;
-        char *string = qemu_malloc(length);
+        char *string = g_malloc(length);
         snprintf(string, length, "%s=%s", name, value);
         result = putenv(string);
     }
@@ -62,7 +62,7 @@
 int qemu_add_polling_cb(PollingFunc *func, void *opaque)
 {
     PollingEntry **ppe, *pe;
-    pe = qemu_mallocz(sizeof(PollingEntry));
+    pe = g_malloc0(sizeof(PollingEntry));
     pe->func = func;
     pe->opaque = opaque;
     for(ppe = &first_polling_entry; *ppe != NULL; ppe = &(*ppe)->next);
@@ -77,7 +77,7 @@
         pe = *ppe;
         if (pe->func == func && pe->opaque == opaque) {
             *ppe = pe->next;
-            qemu_free(pe);
+            g_free(pe);
             break;
         }
     }
@@ -218,7 +218,7 @@
         p--;
     *p = 0;
     if (access(buf, R_OK) == 0) {
-        return qemu_strdup(buf);
+        return g_strdup(buf);
     }
     return NULL;
 }
diff --git a/posix-aio-compat.c b/posix-aio-compat.c
index d1a50a5..aa9df42 100644
--- a/posix-aio-compat.c
+++ b/posix-aio-compat.c
@@ -628,7 +628,7 @@
     if (posix_aio_state)
         return 0;
 
-    s = qemu_malloc(sizeof(PosixAioState));
+    s = g_malloc(sizeof(PosixAioState));
 
     sigfillset(&act.sa_mask);
     act.sa_flags = 0; /* do not restart syscalls to interrupt select() */
diff --git a/proxy/proxy_http.c b/proxy/proxy_http.c
index f753587..b12b6c2 100644
--- a/proxy/proxy_http.c
+++ b/proxy/proxy_http.c
@@ -23,8 +23,8 @@
 {
     PROXY_LOG("%s", __FUNCTION__);
     if (service->footer != service->footer0)
-        qemu_free(service->footer);
-    qemu_free(service);
+        g_free(service->footer);
+    g_free(service);
 }
 
 
@@ -84,7 +84,7 @@
     }
 
     /* create service object */
-    service = qemu_mallocz(sizeof(*service));
+    service = g_malloc0(sizeof(*service));
     if (service == NULL) {
         PROXY_LOG("%s: not enough memory to allocate new proxy service", __FUNCTION__);
         return -1;
diff --git a/proxy/proxy_http_connector.c b/proxy/proxy_http_connector.c
index 6f03d9b..9144549 100644
--- a/proxy/proxy_http_connector.c
+++ b/proxy/proxy_http_connector.c
@@ -39,7 +39,7 @@
 connection_free( ProxyConnection*  root )
 {
     proxy_connection_done(root);
-    qemu_free(root);
+    g_free(root);
 }
 
 
@@ -183,7 +183,7 @@
     if (s < 0)
         return NULL;
 
-    conn = qemu_mallocz(sizeof(*conn));
+    conn = g_malloc0(sizeof(*conn));
     if (conn == NULL) {
         socket_close(s);
         return NULL;
diff --git a/proxy/proxy_http_rewriter.c b/proxy/proxy_http_rewriter.c
index 859e560..a45a5de 100644
--- a/proxy/proxy_http_rewriter.c
+++ b/proxy/proxy_http_rewriter.c
@@ -75,8 +75,8 @@
 http_header_free( HttpHeader*  h )
 {
     if (h) {
-        qemu_free((char*)h->value);
-        qemu_free(h);
+        g_free((char*)h->value);
+        g_free(h);
     }
 }
 
@@ -102,7 +102,7 @@
         h->next  = NULL;
         h->key   = (const char*)(h+1);
         memcpy( (char*)h->key, key, len );
-        h->value = qemu_strdup(value);
+        h->value = g_strdup(value);
     }
     return h;
 }
@@ -197,9 +197,9 @@
 {
     HttpRequest*  r = malloc(sizeof(*r));
 
-    r->req_method   = qemu_strdup(method);
-    r->req_uri      = qemu_strdup(uri);
-    r->req_version  = qemu_strdup(version);
+    r->req_method   = g_strdup(method);
+    r->req_uri      = g_strdup(uri);
+    r->req_version  = g_strdup(version);
     r->rep_version  = NULL;
     r->rep_code     = -1;
     r->rep_readable = NULL;
@@ -226,8 +226,8 @@
                           const char*   uri )
 {
     const char*  old = r->req_uri;
-    r->req_uri = qemu_strdup(uri);
-    qemu_free((char*)old);
+    r->req_uri = g_strdup(uri);
+    g_free((char*)old);
 }
 
 static void
@@ -236,12 +236,12 @@
     if (r) {
         http_header_list_done(r->headers);
 
-        qemu_free(r->req_method);
-        qemu_free(r->req_uri);
-        qemu_free(r->req_version);
-        qemu_free(r->rep_version);
-        qemu_free(r->rep_readable);
-        qemu_free(r);
+        g_free(r->req_method);
+        g_free(r->req_uri);
+        g_free(r->req_version);
+        g_free(r->rep_version);
+        g_free(r->rep_readable);
+        g_free(r);
     }
 }
 
@@ -293,8 +293,8 @@
         return -1;
     }
 
-    r->rep_version  = qemu_strdup(version);
-    r->rep_readable = qemu_strdup(readable);
+    r->rep_version  = g_strdup(version);
+    r->rep_readable = g_strdup(readable);
 
     /* reset the list of headers */
     http_header_list_done(r->headers);
@@ -375,7 +375,7 @@
     }
     http_request_free(conn->request);
     proxy_connection_done(root);
-    qemu_free(conn);
+    g_free(conn);
 }
 
 
@@ -1158,7 +1158,7 @@
     if (s < 0)
         return NULL;
 
-    conn = qemu_mallocz(sizeof(*conn));
+    conn = g_malloc0(sizeof(*conn));
     if (conn == NULL) {
         socket_close(s);
         return NULL;
diff --git a/qemu-char.c b/qemu-char.c
index 79af598..197144e 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -253,7 +253,7 @@
 {
     CharDriverState *chr;
 
-    chr = qemu_mallocz(sizeof(CharDriverState));
+    chr = g_malloc0(sizeof(CharDriverState));
     chr->chr_write = null_chr_write;
     return chr;
 }
@@ -500,8 +500,8 @@
     CharDriverState *chr;
     MuxDriver *d;
 
-    chr = qemu_mallocz(sizeof(CharDriverState));
-    d = qemu_mallocz(sizeof(MuxDriver));
+    chr = g_malloc0(sizeof(CharDriverState));
+    d = g_malloc0(sizeof(MuxDriver));
 
     chr->opaque = d;
     d->drv = drv;
@@ -668,7 +668,7 @@
         }
     }
 
-    qemu_free(s);
+    g_free(s);
     qemu_chr_event(chr, CHR_EVENT_CLOSED);
 }
 
@@ -678,8 +678,8 @@
     CharDriverState *chr;
     FDCharDriver *s;
 
-    chr = qemu_mallocz(sizeof(CharDriverState));
-    s = qemu_mallocz(sizeof(FDCharDriver));
+    chr = g_malloc0(sizeof(CharDriverState));
+    s = g_malloc0(sizeof(FDCharDriver));
     s->fd_in = fd_in;
     s->fd_out = fd_out;
     chr->opaque = s;
@@ -1033,7 +1033,7 @@
     close(s->fd);
     qemu_del_timer(s->timer);
     qemu_free_timer(s->timer);
-    qemu_free(s);
+    g_free(s);
     qemu_chr_event(chr, CHR_EVENT_CLOSED);
 }
 
@@ -1052,8 +1052,8 @@
     //extern char* ptsname(int);
 #endif
 
-    chr = qemu_mallocz(sizeof(CharDriverState));
-    s = qemu_mallocz(sizeof(PtyCharDriver));
+    chr = g_malloc0(sizeof(CharDriverState));
+    s = g_malloc0(sizeof(PtyCharDriver));
 
     if (openpty(&s->fd, &slave_fd, pty_name, NULL, NULL) < 0) {
         return NULL;
@@ -1066,7 +1066,7 @@
     close(slave_fd);
 
     len = strlen(q_ptsname(s->fd)) + 5;
-    chr->filename = qemu_malloc(len);
+    chr->filename = g_malloc(len);
     snprintf(chr->filename, len, "pty:%s", q_ptsname(s->fd));
     qemu_opt_set(opts, "path", q_ptsname(s->fd));
     fprintf(stderr, "char device redirected to %s\n", q_ptsname(s->fd));
@@ -1412,7 +1412,7 @@
     pp_hw_mode(drv, IEEE1284_MODE_COMPAT);
     ioctl(fd, PPRELEASE);
     close(fd);
-    qemu_free(drv);
+    g_free(drv);
     qemu_chr_event(chr, CHR_EVENT_CLOSED);
 }
 
@@ -1432,11 +1432,11 @@
         return NULL;
     }
 
-    drv = qemu_mallocz(sizeof(ParallelCharDriver));
+    drv = g_malloc0(sizeof(ParallelCharDriver));
     drv->fd = fd;
     drv->mode = IEEE1284_MODE_COMPAT;
 
-    chr = qemu_mallocz(sizeof(CharDriverState));
+    chr = g_malloc0(sizeof(CharDriverState));
     chr->chr_write = null_chr_write;
     chr->chr_ioctl = pp_ioctl;
     chr->chr_close = pp_close;
@@ -1496,7 +1496,7 @@
     if (fd < 0)
         return NULL;
 
-    chr = qemu_mallocz(sizeof(CharDriverState));
+    chr = g_malloc0(sizeof(CharDriverState));
     chr->opaque = (void *)(intptr_t)fd;
     chr->chr_write = null_chr_write;
     chr->chr_ioctl = pp_ioctl;
@@ -1712,8 +1712,8 @@
     CharDriverState *chr;
     WinCharState *s;
 
-    chr = qemu_mallocz(sizeof(CharDriverState));
-    s = qemu_mallocz(sizeof(WinCharState));
+    chr = g_malloc0(sizeof(CharDriverState));
+    s = g_malloc0(sizeof(WinCharState));
     chr->opaque = s;
     chr->chr_write = win_chr_write;
     chr->chr_close = win_chr_close;
@@ -1812,8 +1812,8 @@
     CharDriverState *chr;
     WinCharState *s;
 
-    chr = qemu_mallocz(sizeof(CharDriverState));
-    s = qemu_mallocz(sizeof(WinCharState));
+    chr = g_malloc0(sizeof(CharDriverState));
+    s = g_malloc0(sizeof(WinCharState));
     chr->opaque = s;
     chr->chr_write = win_chr_write;
     chr->chr_close = win_chr_close;
@@ -1832,8 +1832,8 @@
     CharDriverState *chr;
     WinCharState *s;
 
-    chr = qemu_mallocz(sizeof(CharDriverState));
-    s = qemu_mallocz(sizeof(WinCharState));
+    chr = g_malloc0(sizeof(CharDriverState));
+    s = g_malloc0(sizeof(WinCharState));
     s->hcom = fd_out;
     chr->opaque = s;
     chr->chr_write = win_chr_write;
@@ -1934,7 +1934,7 @@
         qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
         socket_close(s->fd);
     }
-    qemu_free(s);
+    g_free(s);
 }
 
 static CharDriverState *qemu_chr_open_udp(QemuOpts *opts)
@@ -1943,8 +1943,8 @@
     NetCharDriver *s = NULL;
     int fd = -1;
 
-    chr = qemu_mallocz(sizeof(CharDriverState));
-    s   = qemu_mallocz(sizeof(NetCharDriver));
+    chr = g_malloc0(sizeof(CharDriverState));
+    s   = g_malloc0(sizeof(NetCharDriver));
 
     fd = inet_dgram_opts(opts);
     if (fd < 0) {
@@ -2221,7 +2221,7 @@
         qemu_set_fd_handler(s->listen_fd, NULL, NULL, NULL);
         closesocket(s->listen_fd);
     }
-    qemu_free(s);
+    g_free(s);
     qemu_chr_event(chr, CHR_EVENT_CLOSED);
 }
 
@@ -2244,8 +2244,8 @@
     if (!is_listen)
         is_waitconnect = 0;
 
-    chr = qemu_mallocz(sizeof(CharDriverState));
-    s = qemu_mallocz(sizeof(TCPCharDriver));
+    chr = g_malloc0(sizeof(CharDriverState));
+    s = g_malloc0(sizeof(TCPCharDriver));
 
     if (is_unix) {
         if (is_listen) {
@@ -2292,7 +2292,7 @@
     }
 
     /* for "info chardev" monitor command */
-    chr->filename = qemu_malloc(256);
+    chr->filename = g_malloc(256);
     if (is_unix) {
         snprintf(chr->filename, 256, "unix:%s%s",
                  qemu_opt_get(opts, "path"),
@@ -2318,8 +2318,8 @@
  fail:
     if (fd >= 0)
         closesocket(fd);
-    qemu_free(s);
-    qemu_free(chr);
+    g_free(s);
+    g_free(chr);
     return NULL;
 }
 
@@ -2341,7 +2341,7 @@
         /* grow outbuf */
         d->outbuf_capacity += len;
         d->outbuf_capacity *= 2;
-        d->outbuf = qemu_realloc(d->outbuf, d->outbuf_capacity);
+        d->outbuf = g_realloc(d->outbuf, d->outbuf_capacity);
     }
 
     memcpy(d->outbuf + d->outbuf_size, buf, len);
@@ -2354,10 +2354,10 @@
 {
     MemoryDriver *d;
 
-    d = qemu_malloc(sizeof(*d));
+    d = g_malloc(sizeof(*d));
     d->outbuf_size = 0;
     d->outbuf_capacity = 4096;
-    d->outbuf = qemu_mallocz(d->outbuf_capacity);
+    d->outbuf = g_malloc0(d->outbuf_capacity);
 
     memset(chr, 0, sizeof(*chr));
     chr->opaque = d;
@@ -2375,8 +2375,8 @@
 {
     MemoryDriver *d = chr->opaque;
 
-    qemu_free(d->outbuf);
-    qemu_free(chr->opaque);
+    g_free(d->outbuf);
+    g_free(chr->opaque);
     chr->opaque = NULL;
     chr->chr_write = NULL;
 }
@@ -2622,14 +2622,14 @@
     }
 
     if (!chr->filename)
-        chr->filename = qemu_strdup(qemu_opt_get(opts, "backend"));
+        chr->filename = g_strdup(qemu_opt_get(opts, "backend"));
     chr->init = init;
     QTAILQ_INSERT_TAIL(&chardevs, chr, next);
 
     if (qemu_opt_get_bool(opts, "mux", 0)) {
         CharDriverState *base = chr;
         int len = strlen(qemu_opts_id(opts)) + 6;
-        base->label = qemu_malloc(len);
+        base->label = g_malloc(len);
         snprintf(base->label, len, "%s-base", qemu_opts_id(opts));
         chr = qemu_chr_open_mux(base);
         chr->filename = base->filename;
@@ -2638,7 +2638,7 @@
     } else {
         chr->avail_connections = 1;
     }
-    chr->label = qemu_strdup(qemu_opts_id(opts));
+    chr->label = g_strdup(qemu_opts_id(opts));
     return chr;
 }
 
@@ -2690,9 +2690,9 @@
     QTAILQ_REMOVE(&chardevs, chr, next);
     if (chr->chr_close)
         chr->chr_close(chr);
-    qemu_free(chr->filename);
-    qemu_free(chr->label);
-    qemu_free(chr);
+    g_free(chr->filename);
+    g_free(chr->label);
+    g_free(chr);
 }
 
 static void qemu_chr_qlist_iter(QObject *obj, void *opaque)
diff --git a/qemu-io.c b/qemu-io.c
index a85a208..0c1ab3e 100644
--- a/qemu-io.c
+++ b/qemu-io.c
@@ -930,9 +930,9 @@
 		}
 	}
 
-	reqs = qemu_malloc(nr_reqs * sizeof(*reqs));
-	buf = qemu_malloc(nr_reqs * sizeof(*buf));
-	qiovs = qemu_malloc(nr_reqs * sizeof(*qiovs));
+	reqs = g_malloc(nr_reqs * sizeof(*reqs));
+	buf = g_malloc(nr_reqs * sizeof(*buf));
+	qiovs = g_malloc(nr_reqs * sizeof(*qiovs));
 
 	for (i = 0; i < nr_reqs; i++) {
 		int j;
@@ -996,9 +996,9 @@
 		qemu_io_free(buf[i]);
 		qemu_iovec_destroy(&qiovs[i]);
 	}
-	qemu_free(buf);
-	qemu_free(reqs);
-	qemu_free(qiovs);
+	g_free(buf);
+	g_free(reqs);
+	g_free(qiovs);
 	return 0;
 }
 
diff --git a/qemu-malloc.c b/qemu-malloc.c
deleted file mode 100644
index 8749fc8..0000000
--- a/qemu-malloc.c
+++ /dev/null
@@ -1,97 +0,0 @@
-/*
- * malloc-like functions for system emulation.
- *
- * Copyright (c) 2006 Fabrice Bellard
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
- * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- */
-#include "qemu-common.h"
-#include <stdlib.h>
-
-void qemu_free(void *ptr)
-{
-    //trace_qemu_free(ptr);
-    free(ptr);
-}
-
-static int allow_zero_malloc(void)
-{
-#if defined(CONFIG_ZERO_MALLOC)
-    return 1;
-#else
-    return 0;
-#endif
-}
-
-void *qemu_malloc(size_t size)
-{
-    void *ptr;
-    if (!size && !allow_zero_malloc()) {
-        abort();
-    }
-    ptr = qemu_oom_check(malloc(size ? size : 1));
-    //trace_qemu_malloc(size, ptr);
-    return ptr;
-}
-
-void *qemu_realloc(void *ptr, size_t size)
-{
-    void *newptr;
-    if (!size && !allow_zero_malloc()) {
-        abort();
-    }
-    newptr = qemu_oom_check(realloc(ptr, size ? size : 1));
-    //trace_qemu_realloc(ptr, size, newptr);
-    return newptr;
-}
-
-void *qemu_mallocz(size_t size)
-{
-    void *ptr;
-    if (!size && !allow_zero_malloc()) {
-        abort();
-    }
-    ptr = qemu_oom_check(calloc(1, size ? size : 1));
-    //trace_qemu_malloc(size, ptr);
-    return ptr;
-}
-
-char *qemu_strdup(const char *str)
-{
-    char *ptr;
-    size_t len = strlen(str);
-    ptr = qemu_malloc(len + 1);
-    memcpy(ptr, str, len + 1);
-    return ptr;
-}
-
-char *qemu_strndup(const char *str, size_t size)
-{
-    const char *end = memchr(str, 0, size);
-    char *new;
-
-    if (end) {
-        size = end - str;
-    }
-
-    new = qemu_malloc(size + 1);
-    new[size] = 0;
-
-    return memcpy(new, str, size);
-}
diff --git a/qemu-timer.c b/qemu-timer.c
index d06b65b..25127e8 100644
--- a/qemu-timer.c
+++ b/qemu-timer.c
@@ -378,7 +378,7 @@
         exit(0);
     }
 
-    arg = qemu_strdup(opt);
+    arg = g_strdup(opt);
 
     /* Reorder the array */
     name = strtok(arg, ",");
@@ -407,7 +407,7 @@
         name = strtok(NULL, ",");
     }
 
-    qemu_free(arg);
+    g_free(arg);
 
     if (cur) {
         /* Disable remaining timers */
@@ -430,7 +430,7 @@
 static QEMUClock *qemu_new_clock(int type)
 {
     QEMUClock *clock;
-    clock = qemu_mallocz(sizeof(QEMUClock));
+    clock = g_malloc0(sizeof(QEMUClock));
     clock->type = type;
     clock->enabled = 1;
     return clock;
@@ -530,7 +530,7 @@
 {
     QEMUTimer *ts;
 
-    ts = qemu_mallocz(sizeof(QEMUTimer));
+    ts = g_malloc0(sizeof(QEMUTimer));
     ts->clock = clock;
     ts->cb = cb;
     ts->opaque = opaque;
@@ -540,7 +540,7 @@
 
 void qemu_free_timer(QEMUTimer *ts)
 {
-    qemu_free(ts);
+    g_free(ts);
 }
 
 /* stop a timer, but do not dealloc it */
diff --git a/qobject/qbool.c b/qobject/qbool.c
index 5108dce..a3d2afa 100644
--- a/qobject/qbool.c
+++ b/qobject/qbool.c
@@ -31,7 +31,7 @@
 {
     QBool *qb;
 
-    qb = qemu_malloc(sizeof(*qb));
+    qb = g_malloc(sizeof(*qb));
     qb->value = value;
     QOBJECT_INIT(qb, &qbool_type);
 
@@ -64,5 +64,5 @@
 static void qbool_destroy_obj(QObject *obj)
 {
     assert(obj != NULL);
-    qemu_free(qobject_to_qbool(obj));
+    g_free(qobject_to_qbool(obj));
 }
diff --git a/qobject/qdict.c b/qobject/qdict.c
index f1faccd..7543ccc 100644
--- a/qobject/qdict.c
+++ b/qobject/qdict.c
@@ -35,7 +35,7 @@
 {
     QDict *qdict;
 
-    qdict = qemu_mallocz(sizeof(*qdict));
+    qdict = g_malloc0(sizeof(*qdict));
     QOBJECT_INIT(qdict, &qdict_type);
 
     return qdict;
@@ -75,8 +75,8 @@
 {
     QDictEntry *entry;
 
-    entry = qemu_mallocz(sizeof(*entry));
-    entry->key = qemu_strdup(key);
+    entry = g_malloc0(sizeof(*entry));
+    entry->key = g_strdup(key);
     entry->value = value;
 
     return entry;
@@ -410,8 +410,8 @@
     assert(e->value != NULL);
 
     qobject_decref(e->value);
-    qemu_free(e->key);
-    qemu_free(e);
+    g_free(e->key);
+    g_free(e);
 }
 
 /**
@@ -452,5 +452,5 @@
         }
     }
 
-    qemu_free(qdict);
+    g_free(qdict);
 }
diff --git a/qobject/qerror.c b/qobject/qerror.c
index 0f47be0..40d0cbb 100644
--- a/qobject/qerror.c
+++ b/qobject/qerror.c
@@ -221,7 +221,7 @@
 {
     QError *qerr;
 
-    qerr = qemu_mallocz(sizeof(*qerr));
+    qerr = g_malloc0(sizeof(*qerr));
     QOBJECT_INIT(qerr, &qerror_type);
 
     return qerr;
@@ -459,5 +459,5 @@
     qerr = qobject_to_qerror(obj);
 
     QDECREF(qerr->error);
-    qemu_free(qerr);
+    g_free(qerr);
 }
diff --git a/qobject/qfloat.c b/qobject/qfloat.c
index 08b2e57..7de0992 100644
--- a/qobject/qfloat.c
+++ b/qobject/qfloat.c
@@ -31,7 +31,7 @@
 {
     QFloat *qf;
 
-    qf = qemu_malloc(sizeof(*qf));
+    qf = g_malloc(sizeof(*qf));
     qf->value = value;
     QOBJECT_INIT(qf, &qfloat_type);
 
@@ -64,5 +64,5 @@
 static void qfloat_destroy_obj(QObject *obj)
 {
     assert(obj != NULL);
-    qemu_free(qobject_to_qfloat(obj));
+    g_free(qobject_to_qfloat(obj));
 }
diff --git a/qobject/qint.c b/qobject/qint.c
index fe33b8f..86b9b04 100644
--- a/qobject/qint.c
+++ b/qobject/qint.c
@@ -30,7 +30,7 @@
 {
     QInt *qi;
 
-    qi = qemu_malloc(sizeof(*qi));
+    qi = g_malloc(sizeof(*qi));
     qi->value = value;
     QOBJECT_INIT(qi, &qint_type);
 
@@ -63,5 +63,5 @@
 static void qint_destroy_obj(QObject *obj)
 {
     assert(obj != NULL);
-    qemu_free(qobject_to_qint(obj));
+    g_free(qobject_to_qint(obj));
 }
diff --git a/qobject/qlist.c b/qobject/qlist.c
index f7b3897..815b6aa 100644
--- a/qobject/qlist.c
+++ b/qobject/qlist.c
@@ -31,7 +31,7 @@
 {
     QList *qlist;
 
-    qlist = qemu_malloc(sizeof(*qlist));
+    qlist = g_malloc(sizeof(*qlist));
     QTAILQ_INIT(&qlist->head);
     QOBJECT_INIT(qlist, &qlist_type);
 
@@ -64,7 +64,7 @@
 {
     QListEntry *entry;
 
-    entry = qemu_malloc(sizeof(*entry));
+    entry = g_malloc(sizeof(*entry));
     entry->value = value;
 
     QTAILQ_INSERT_TAIL(&qlist->head, entry, next);
@@ -98,7 +98,7 @@
     QTAILQ_REMOVE(&qlist->head, entry, next);
 
     ret = entry->value;
-    qemu_free(entry);
+    g_free(entry);
 
     return ret;
 }
@@ -150,8 +150,8 @@
     QTAILQ_FOREACH_SAFE(entry, &qlist->head, next, next_entry) {
         QTAILQ_REMOVE(&qlist->head, entry, next);
         qobject_decref(entry->value);
-        qemu_free(entry);
+        g_free(entry);
     }
 
-    qemu_free(qlist);
+    g_free(qlist);
 }
diff --git a/qobject/qstring.c b/qobject/qstring.c
index 77bd4c7..5f7376c 100644
--- a/qobject/qstring.c
+++ b/qobject/qstring.c
@@ -40,12 +40,12 @@
 {
     QString *qstring;
 
-    qstring = qemu_malloc(sizeof(*qstring));
+    qstring = g_malloc(sizeof(*qstring));
 
     qstring->length = end - start + 1;
     qstring->capacity = qstring->length;
 
-    qstring->string = qemu_malloc(qstring->capacity + 1);
+    qstring->string = g_malloc(qstring->capacity + 1);
     memcpy(qstring->string, str + start, qstring->length);
     qstring->string[qstring->length] = 0;
 
@@ -70,7 +70,7 @@
         qstring->capacity += len;
         qstring->capacity *= 2; /* use exponential growth */
 
-        qstring->string = qemu_realloc(qstring->string, qstring->capacity + 1);
+        qstring->string = g_realloc(qstring->string, qstring->capacity + 1);
     }
 }
 
@@ -136,6 +136,6 @@
 
     assert(obj != NULL);
     qs = qobject_to_qstring(obj);
-    qemu_free(qs->string);
-    qemu_free(qs);
+    g_free(qs->string);
+    g_free(qs);
 }
diff --git a/readline.c b/readline.c
index a16a0fd..f493349 100644
--- a/readline.c
+++ b/readline.c
@@ -264,7 +264,7 @@
 void readline_add_completion(ReadLineState *rs, const char *str)
 {
     if (rs->nb_completions < READLINE_MAX_COMPLETIONS) {
-        rs->completions[rs->nb_completions++] = qemu_strdup(str);
+        rs->completions[rs->nb_completions++] = g_strdup(str);
     }
 }
 
@@ -281,11 +281,11 @@
 
     rs->nb_completions = 0;
 
-    cmdline = qemu_malloc(rs->cmd_buf_index + 1);
+    cmdline = g_malloc(rs->cmd_buf_index + 1);
     memcpy(cmdline, rs->cmd_buf, rs->cmd_buf_index);
     cmdline[rs->cmd_buf_index] = '\0';
     rs->completion_finder(cmdline);
-    qemu_free(cmdline);
+    g_free(cmdline);
 
     /* no completion found */
     if (rs->nb_completions <= 0)
@@ -466,7 +466,7 @@
 ReadLineState *readline_init(Monitor *mon,
                              ReadLineCompletionFunc *completion_finder)
 {
-    ReadLineState *rs = qemu_mallocz(sizeof(*rs));
+    ReadLineState *rs = g_malloc0(sizeof(*rs));
 
     rs->hist_entry = -1;
     rs->mon = mon;
@@ -480,6 +480,6 @@
     if (rs) {
         rs->mon = NULL;
         rs->completion_finder = NULL;
-        qemu_free(rs);
+        g_free(rs);
     }
 }
diff --git a/savevm.c b/savevm.c
index c55f00a..a81b166 100644
--- a/savevm.c
+++ b/savevm.c
@@ -210,7 +210,7 @@
 static int file_socket_close(void *opaque)
 {
     QEMUFileSocket *s = opaque;
-    qemu_free(s);
+    g_free(s);
     return 0;
 }
 
@@ -238,7 +238,7 @@
     QEMUFileStdio *s = opaque;
     int ret;
     ret = pclose(s->stdio_file);
-    qemu_free(s);
+    g_free(s);
     return ret;
 }
 
@@ -246,7 +246,7 @@
 {
     QEMUFileStdio *s = opaque;
     fclose(s->stdio_file);
-    qemu_free(s);
+    g_free(s);
     return 0;
 }
 
@@ -259,7 +259,7 @@
         return NULL;
     }
 
-    s = qemu_mallocz(sizeof(QEMUFileStdio));
+    s = g_malloc0(sizeof(QEMUFileStdio));
 
     s->stdio_file = stdio_file;
 
@@ -307,7 +307,7 @@
         return NULL;
     }
 
-    s = qemu_mallocz(sizeof(QEMUFileStdio));
+    s = g_malloc0(sizeof(QEMUFileStdio));
     s->stdio_file = fdopen(fd, mode);
     if (!s->stdio_file)
         goto fail;
@@ -322,13 +322,13 @@
     return s->file;
 
 fail:
-    qemu_free(s);
+    g_free(s);
     return NULL;
 }
 
 QEMUFile *qemu_fopen_socket(int fd)
 {
-    QEMUFileSocket *s = qemu_mallocz(sizeof(QEMUFileSocket));
+    QEMUFileSocket *s = g_malloc0(sizeof(QEMUFileSocket));
 
     s->fd = fd;
     s->file = qemu_fopen_ops(s, NULL, socket_get_buffer, file_socket_close,
@@ -362,7 +362,7 @@
         return NULL;
     }
 
-    s = qemu_mallocz(sizeof(QEMUFileStdio));
+    s = g_malloc0(sizeof(QEMUFileStdio));
 
     s->stdio_file = fopen(filename, mode);
     if (!s->stdio_file)
@@ -377,7 +377,7 @@
     }
     return s->file;
 fail:
-    qemu_free(s);
+    g_free(s);
     return NULL;
 }
 
@@ -415,7 +415,7 @@
 {
     QEMUFile *f;
 
-    f = qemu_mallocz(sizeof(QEMUFile));
+    f = g_malloc0(sizeof(QEMUFile));
 
     f->opaque = opaque;
     f->put_buffer = put_buffer;
@@ -481,7 +481,7 @@
     qemu_fflush(f);
     if (f->close)
         ret = f->close(f->opaque);
-    qemu_free(f);
+    g_free(f);
     return ret;
 }
 
@@ -587,9 +587,9 @@
     if (slen == 0)
         return NULL;
 
-    str = qemu_malloc(slen+1);
+    str = g_malloc(slen+1);
     if (qemu_get_buffer(f, (uint8_t*)str, slen) != slen) {
-        qemu_free(str);
+        g_free(str);
         return NULL;
     }
     str[slen] = '\0';
@@ -836,7 +836,7 @@
     SaveStateEntry *se, **pse;
     static int global_section_id;
 
-    se = qemu_malloc(sizeof(SaveStateEntry));
+    se = g_malloc(sizeof(SaveStateEntry));
     pstrcpy(se->idstr, sizeof(se->idstr), idstr);
     se->instance_id = (instance_id == -1) ? 0 : instance_id;
     se->version_id = version_id;
@@ -879,7 +879,7 @@
     while (*pse != NULL) {
         if (strcmp((*pse)->idstr, idstr) == 0 && (*pse)->opaque == opaque) {
             SaveStateEntry *next = (*pse)->next;
-            qemu_free(*pse);
+            g_free(*pse);
             *pse = next;
             continue;
         }
@@ -1149,7 +1149,7 @@
             }
 
             /* Add entry */
-            le = qemu_mallocz(sizeof(*le));
+            le = g_malloc0(sizeof(*le));
 
             le->se = se;
             le->section_id = section_id;
@@ -1189,7 +1189,7 @@
     while (first_le) {
         LoadStateEntry *le = first_le;
         first_le = first_le->next;
-        qemu_free(le);
+        g_free(le);
     }
 
     if (qemu_file_has_error(f))
@@ -1234,7 +1234,7 @@
             break;
         }
     }
-    qemu_free(sn_tab);
+    g_free(sn_tab);
     return ret;
 }
 
@@ -1481,5 +1481,5 @@
         sn = &sn_tab[i];
         monitor_printf(out, "%s\n", bdrv_snapshot_dump(buf, sizeof(buf), sn));
     }
-    qemu_free(sn_tab);
+    g_free(sn_tab);
 }
diff --git a/tap-win32.c b/tap-win32.c
index af20674..734ad59 100644
--- a/tap-win32.c
+++ b/tap-win32.c
@@ -641,7 +641,7 @@
     /* FIXME: need to kill thread and close file handle:
        tap_win32_close(s);
     */
-    qemu_free(s);
+    g_free(s);
 }
 
 static ssize_t tap_receive(VLANClientState *vc, const uint8_t *buf, size_t size)
@@ -670,7 +670,7 @@
 {
     TAPState *s;
 
-    s = qemu_mallocz(sizeof(TAPState));
+    s = g_malloc0(sizeof(TAPState));
     if (!s)
         return -1;
     if (tap_win32_open(&s->handle, ifname) < 0) {
diff --git a/target-arm/helper.c b/target-arm/helper.c
index a59204f..cc6afa0 100644
--- a/target-arm/helper.c
+++ b/target-arm/helper.c
@@ -381,7 +381,7 @@
     id = cpu_arm_find_by_name(cpu_model);
     if (id == 0)
         return NULL;
-    env = qemu_mallocz(sizeof(CPUARMState));
+    env = g_malloc0(sizeof(CPUARMState));
     cpu_exec_init(env);
     if (!inited) {
         inited = 1;
diff --git a/target-i386/hax-all.c b/target-i386/hax-all.c
index 2540f54..339fd55 100644
--- a/target-i386/hax-all.c
+++ b/target-i386/hax-all.c
@@ -188,7 +188,7 @@
         return 0;
     }
 
-    vcpu = qemu_malloc(sizeof(struct hax_vcpu_state));
+    vcpu = g_malloc(sizeof(struct hax_vcpu_state));
     if (!vcpu)
     {
         dprint("Failed to alloc vcpu state\n");
@@ -229,7 +229,7 @@
         hax_close_fd(vcpu->fd);
 
     hax_global.vm->vcpus[id] = NULL;
-    qemu_free(vcpu);
+    g_free(vcpu);
     return -1;
 }
 
@@ -252,7 +252,7 @@
      */
     hax_close_fd(vcpu->fd);
     hax_global.vm->vcpus[vcpu->vcpu_id] = NULL;
-    qemu_free(vcpu);
+    g_free(vcpu);
     return 0;
 }
 
@@ -285,7 +285,7 @@
     if (hax->vm)
         return hax->vm;
 
-    vm = qemu_malloc(sizeof(struct hax_vm));
+    vm = g_malloc(sizeof(struct hax_vm));
     if (!vm)
         return NULL;
     memset(vm, 0, sizeof(struct hax_vm));
@@ -306,7 +306,7 @@
     return vm;
 
 error:
-    qemu_free(vm);
+    g_free(vm);
     hax->vm = NULL;
     return NULL;
 }
@@ -322,7 +322,7 @@
             return -1;
         }
     hax_close_fd(vm->fd);
-    qemu_free(vm);
+    g_free(vm);
     hax_global.vm = NULL;
     return 0;
 }
diff --git a/target-i386/hax-darwin.c b/target-i386/hax-darwin.c
index d8c3cf2..8743607 100644
--- a/target-i386/hax-darwin.c
+++ b/target-i386/hax-darwin.c
@@ -123,7 +123,7 @@
         return NULL;
     }
 
-    name = qemu_strdup("/dev/hax_vm/vmxx");
+    name = g_strdup("/dev/hax_vm/vmxx");
     if (!name)
         return NULL;
     sprintf(name, "/dev/hax_vm/vm%02d", vm_id);
@@ -141,7 +141,7 @@
         return NULL;
     }
 
-    name = qemu_strdup("/dev/hax_vmxx/vcpuyy");
+    name = g_strdup("/dev/hax_vmxx/vcpuyy");
     if (!name)
         return NULL;
 
@@ -176,7 +176,7 @@
         return -1;
 
     fd = open(vm_name, O_RDWR);
-    qemu_free(vm_name);
+    g_free(vm_name);
 
     return fd;
 }
@@ -227,7 +227,7 @@
     }
 
     fd = open(devfs_path, O_RDWR);
-    qemu_free(devfs_path);
+    g_free(devfs_path);
     if (fd < 0)
         dprint("Failed to open the vcpu devfs\n");
     return fd;
diff --git a/target-i386/hax-windows.c b/target-i386/hax-windows.c
index e4026ff..a2ace34 100644
--- a/target-i386/hax-windows.c
+++ b/target-i386/hax-windows.c
@@ -203,7 +203,7 @@
         return NULL;
     }
 
-    name = qemu_strdup("\\\\.\\hax_vmxx");
+    name = g_strdup("\\\\.\\hax_vmxx");
     if (!name)
         return NULL;
     sprintf(name, "\\\\.\\hax_vm%02d", vm_id);
@@ -220,7 +220,7 @@
         dprint("Too big vm id %x or vcpu id %x\n", vm_id, vcpu_id);
         return NULL;
     }
-    name = qemu_strdup("\\\\.\\hax_vmxx_vcpuxx");
+    name = g_strdup("\\\\.\\hax_vmxx_vcpuxx");
     if (!name)
         return NULL;
     sprintf(name, "\\\\.\\hax_vm%02d_vcpu%02d", vm_id, vcpu_id);
@@ -275,7 +275,7 @@
     if (hDeviceVM == INVALID_HANDLE_VALUE)
         dprint("Open the vm devcie error:%s, ec:%d\n", vm_name, GetLastError());
 
-    qemu_free(vm_name);
+    g_free(vm_name);
     return hDeviceVM;
 }
 
@@ -344,7 +344,7 @@
 
     if (hDeviceVCPU == INVALID_HANDLE_VALUE)
         dprint("Failed to open the vcpu devfs\n");
-    qemu_free(devfs_path);
+    g_free(devfs_path);
     return hDeviceVCPU;
 }
 
diff --git a/target-i386/helper.c b/target-i386/helper.c
index 856da20..daee391 100644
--- a/target-i386/helper.c
+++ b/target-i386/helper.c
@@ -536,7 +536,7 @@
 
 void cpu_x86_close(CPUX86State *env)
 {
-    qemu_free(env);
+    g_free(env);
 }
 
 /***********************************************************/
@@ -1526,7 +1526,7 @@
         cenv->mcg_cap = MCE_CAP_DEF | MCE_BANKS_DEF;
         cenv->mcg_ctl = ~(uint64_t)0;
         bank_num = cenv->mcg_cap & 0xff;
-        cenv->mce_banks = qemu_mallocz(bank_num * sizeof(uint64_t) * 4);
+        cenv->mce_banks = g_malloc0(bank_num * sizeof(uint64_t) * 4);
         for (bank = 0; bank < bank_num; bank++)
             cenv->mce_banks[bank*4] = ~(uint64_t)0;
     }
@@ -1780,7 +1780,7 @@
     CPUX86State *env;
     static int inited;
 
-    env = qemu_mallocz(sizeof(CPUX86State));
+    env = g_malloc0(sizeof(CPUX86State));
     cpu_exec_init(env);
     env->cpu_model_str = cpu_model;
 
diff --git a/target-i386/kvm.c b/target-i386/kvm.c
index f1bb2f5..2d55144 100644
--- a/target-i386/kvm.c
+++ b/target-i386/kvm.c
@@ -48,7 +48,7 @@
     int r, size;
 
     size = sizeof(*cpuid) + max * sizeof(*cpuid->entries);
-    cpuid = (struct kvm_cpuid2 *)qemu_mallocz(size);
+    cpuid = (struct kvm_cpuid2 *)g_malloc0(size);
     cpuid->nent = max;
     r = kvm_ioctl(s, KVM_GET_SUPPORTED_CPUID, cpuid);
     if (r == 0 && cpuid->nent >= max) {
@@ -56,7 +56,7 @@
     }
     if (r < 0) {
         if (r == -E2BIG) {
-            qemu_free(cpuid);
+            g_free(cpuid);
             return NULL;
         } else {
             fprintf(stderr, "KVM_GET_SUPPORTED_CPUID failed: %s\n",
@@ -109,7 +109,7 @@
         }
     }
 
-    qemu_free(cpuid);
+    g_free(cpuid);
 
     return ret;
 }
@@ -223,7 +223,7 @@
         if (ret < 0)
             return 0;
 
-        kvm_msr_list = qemu_mallocz(sizeof(msr_list) +
+        kvm_msr_list = g_malloc0(sizeof(msr_list) +
                                     msr_list.nmsrs * sizeof(msr_list.indices[0]));
 
         kvm_msr_list->nmsrs = msr_list.nmsrs;
diff --git a/target-mips/translate.c b/target-mips/translate.c
index b8b0073..9d20fbf 100755
--- a/target-mips/translate.c
+++ b/target-mips/translate.c
@@ -8588,7 +8588,7 @@
     def = cpu_mips_find_by_name(cpu_model);
     if (!def)
         return NULL;
-    env = qemu_mallocz(sizeof(CPUMIPSState));
+    env = g_malloc0(sizeof(CPUMIPSState));
     env->cpu_model = def;
     env->cpu_model_str = cpu_model;
 
diff --git a/target-mips/translate_init.c b/target-mips/translate_init.c
index 3978908..fd4ecc4 100644
--- a/target-mips/translate_init.c
+++ b/target-mips/translate_init.c
@@ -495,7 +495,7 @@
 
 static void mmu_init (CPUMIPSState *env, const mips_def_t *def)
 {
-    env->tlb = qemu_mallocz(sizeof(CPUMIPSTLBContext));
+    env->tlb = g_malloc0(sizeof(CPUMIPSTLBContext));
 
     switch (def->mmu_type) {
         case MMU_TYPE_NONE:
@@ -528,7 +528,7 @@
 
 static void mvp_init (CPUMIPSState *env, const mips_def_t *def)
 {
-    env->mvp = qemu_mallocz(sizeof(CPUMIPSMVPContext));
+    env->mvp = g_malloc0(sizeof(CPUMIPSMVPContext));
 
     /* MVPConf1 implemented, TLB sharable, no gating storage support,
        programmable cache partitioning implemented, number of allocatable
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 1d6a191..1d83a5e 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -176,7 +176,7 @@
     
     if (size > TCG_POOL_CHUNK_SIZE) {
         /* big malloc: insert a new pool (XXX: could optimize) */
-        p = qemu_malloc(sizeof(TCGPool) + size);
+        p = g_malloc(sizeof(TCGPool) + size);
         p->size = size;
         if (s->pool_current)
             s->pool_current->next = p;
@@ -193,7 +193,7 @@
             if (!p->next) {
             new_pool:
                 pool_size = TCG_POOL_CHUNK_SIZE;
-                p = qemu_malloc(sizeof(TCGPool) + pool_size);
+                p = g_malloc(sizeof(TCGPool) + pool_size);
                 p->size = pool_size;
                 p->next = NULL;
                 if (s->pool_current) 
@@ -237,8 +237,8 @@
         total_args += n;
     }
 
-    args_ct = qemu_malloc(sizeof(TCGArgConstraint) * total_args);
-    sorted_args = qemu_malloc(sizeof(int) * total_args);
+    args_ct = g_malloc(sizeof(TCGArgConstraint) * total_args);
+    sorted_args = g_malloc(sizeof(int) * total_args);
 
     for(op = 0; op < NB_OPS; op++) {
         def = &tcg_op_defs[op];
diff --git a/translate-all.c b/translate-all.c
index aaaed9f..5a44cf3 100644
--- a/translate-all.c
+++ b/translate-all.c
@@ -148,7 +148,7 @@
     /* Save translated PC -> guest PC map into TB. */
     if (memcheck_enabled && gen_opc_tpc2gpc_pairs && is_cpu_user(env)) {
         tb->tpc2gpc =
-                qemu_malloc(gen_opc_tpc2gpc_pairs * 2 * sizeof(uintptr_t));
+                g_malloc(gen_opc_tpc2gpc_pairs * 2 * sizeof(uintptr_t));
         if (tb->tpc2gpc != NULL) {
             memcpy(tb->tpc2gpc, gen_opc_tpc2gpc_ptr,
                    gen_opc_tpc2gpc_pairs * 2 * sizeof(uintptr_t));
diff --git a/ui/console.c b/ui/console.c
index 93e910e..c10032f 100644
--- a/ui/console.c
+++ b/ui/console.c
@@ -558,7 +558,7 @@
     if (s->width < w1)
         w1 = s->width;
 
-    cells = qemu_malloc(s->width * s->total_height * sizeof(TextCell));
+    cells = g_malloc(s->width * s->total_height * sizeof(TextCell));
     for(y = 0; y < s->total_height; y++) {
         c = &cells[y * s->width];
         if (w1 > 0) {
@@ -573,7 +573,7 @@
             c++;
         }
     }
-    qemu_free(s->cells);
+    g_free(s->cells);
     s->cells = cells;
 }
 
@@ -1294,7 +1294,7 @@
 
     if (nb_consoles >= MAX_CONSOLES)
         return NULL;
-    s = qemu_mallocz(sizeof(TextConsole));
+    s = g_malloc0(sizeof(TextConsole));
     if (!active_console || ((active_console->console_type != GRAPHIC_CONSOLE) &&
         (console_type == GRAPHIC_CONSOLE))) {
         active_console = s;
@@ -1318,7 +1318,7 @@
 
 static DisplaySurface* defaultallocator_create_displaysurface(int width, int height)
 {
-    DisplaySurface *surface = (DisplaySurface*) qemu_mallocz(sizeof(DisplaySurface));
+    DisplaySurface *surface = (DisplaySurface*) g_malloc0(sizeof(DisplaySurface));
 
     int linesize = width * 4;
     qemu_alloc_display(surface, width, height, linesize,
@@ -1344,10 +1344,10 @@
     surface->linesize = linesize;
     surface->pf = pf;
     if (surface->flags & QEMU_ALLOCATED_FLAG) {
-        data = qemu_realloc(surface->data,
+        data = g_realloc(surface->data,
                             surface->linesize * surface->height);
     } else {
-        data = qemu_malloc(surface->linesize * surface->height);
+        data = g_malloc(surface->linesize * surface->height);
     }
     surface->data = (uint8_t *)data;
     surface->flags = newflags | QEMU_ALLOCATED_FLAG;
@@ -1359,7 +1359,7 @@
 DisplaySurface* qemu_create_displaysurface_from(int width, int height, int bpp,
                                               int linesize, uint8_t *data)
 {
-    DisplaySurface *surface = (DisplaySurface*) qemu_mallocz(sizeof(DisplaySurface));
+    DisplaySurface *surface = (DisplaySurface*) g_malloc0(sizeof(DisplaySurface));
 
     surface->width = width;
     surface->height = height;
@@ -1378,8 +1378,8 @@
     if (surface == NULL)
         return;
     if (surface->flags & QEMU_ALLOCATED_FLAG)
-        qemu_free(surface->data);
-    qemu_free(surface);
+        g_free(surface->data);
+    g_free(surface);
 }
 
 static struct DisplayAllocator default_allocator = {
@@ -1390,7 +1390,7 @@
 
 static void dumb_display_init(void)
 {
-    DisplayState *ds = qemu_mallocz(sizeof(DisplayState));
+    DisplayState *ds = g_malloc0(sizeof(DisplayState));
     ds->allocator = &default_allocator;
     ds->surface = qemu_create_displaysurface(ds, 640, 480);
     register_displaystate(ds);
@@ -1438,7 +1438,7 @@
     TextConsole *s;
     DisplayState *ds;
 
-    ds = (DisplayState *) qemu_mallocz(sizeof(DisplayState));
+    ds = (DisplayState *) g_malloc0(sizeof(DisplayState));
     ds->allocator = &default_allocator;
 #ifdef CONFIG_ANDROID
     ds->surface = qemu_create_displaysurface(ds, android_display_width, android_display_height);
@@ -1449,7 +1449,7 @@
     s = new_console(ds, GRAPHIC_CONSOLE);
     if (s == NULL) {
         qemu_free_displaysurface(ds);
-        qemu_free(ds);
+        g_free(ds);
         return NULL;
     }
     s->hw_update = update;
@@ -1560,7 +1560,7 @@
     unsigned width;
     unsigned height;
 
-    chr = qemu_mallocz(sizeof(CharDriverState));
+    chr = g_malloc0(sizeof(CharDriverState));
 
     if (n_text_consoles == 128) {
         fprintf(stderr, "Too many text consoles\n");
@@ -1813,13 +1813,13 @@
 
     qemu_free_displaysurface(ds);
 
-    surface = (DisplaySurface*) qemu_mallocz(sizeof(DisplaySurface));
+    surface = (DisplaySurface*) g_malloc0(sizeof(DisplaySurface));
 
     surface->width = width;
     surface->height = height;
     surface->linesize = pitch;
     surface->pf = qemu_default_pixelformat(bitspp);
-    surface->data = (uint8_t*) qemu_malloc(surface->linesize * surface->height);
+    surface->data = (uint8_t*) g_malloc(surface->linesize * surface->height);
 #ifdef HOST_WORDS_BIGENDIAN
     surface->flags = QEMU_ALLOCATED_FLAG | QEMU_BIG_ENDIAN_FLAG;
 #else
diff --git a/ui/curses.c b/ui/curses.c
index 33e9540..6e3c1f5 100644
--- a/ui/curses.c
+++ b/ui/curses.c
@@ -358,7 +358,7 @@
 #endif
 #endif
 
-    dcl = (DisplayChangeListener *) qemu_mallocz(sizeof(DisplayChangeListener));
+    dcl = (DisplayChangeListener *) g_malloc0(sizeof(DisplayChangeListener));
     dcl->dpy_update = curses_update;
     dcl->dpy_resize = curses_resize;
     dcl->dpy_refresh = curses_refresh;
diff --git a/ui/input.c b/ui/input.c
index e2b605f..f4b9bed 100644
--- a/ui/input.c
+++ b/ui/input.c
@@ -48,7 +48,7 @@
     QEMUPutKBDEntry *s;
 
     if (func != NULL) {
-        s = qemu_mallocz(sizeof(QEMUPutKBDEntry));
+        s = g_malloc0(sizeof(QEMUPutKBDEntry));
 
         s->put_kbd_event = func;
         s->opaque = opaque;
@@ -94,12 +94,12 @@
     QEMUPutMouseEntry *s;
     static int mouse_index = 0;
 
-    s = qemu_mallocz(sizeof(QEMUPutMouseEntry));
+    s = g_malloc0(sizeof(QEMUPutMouseEntry));
 
     s->qemu_put_mouse_event = func;
     s->qemu_put_mouse_event_opaque = opaque;
     s->qemu_put_mouse_event_absolute = absolute;
-    s->qemu_put_mouse_event_name = qemu_strdup(name);
+    s->qemu_put_mouse_event_name = g_strdup(name);
     s->index = mouse_index++;
 
     QTAILQ_INSERT_TAIL(&mouse_handlers, s, node);
@@ -121,8 +121,8 @@
 {
     QTAILQ_REMOVE(&mouse_handlers, entry, node);
 
-    qemu_free(entry->qemu_put_mouse_event_name);
-    qemu_free(entry);
+    g_free(entry->qemu_put_mouse_event_name);
+    g_free(entry);
 
     check_mode_change();
 }
@@ -132,7 +132,7 @@
 {
     QEMUPutLEDEntry *s;
 
-    s = qemu_mallocz(sizeof(QEMUPutLEDEntry));
+    s = g_malloc0(sizeof(QEMUPutLEDEntry));
 
     s->put_led = func;
     s->opaque = opaque;
@@ -145,7 +145,7 @@
     if (entry == NULL)
         return;
     QTAILQ_REMOVE(&led_handlers, entry, next);
-    qemu_free(entry);
+    g_free(entry);
 }
 
 void kbd_put_keycode(int keycode)
diff --git a/ui/keymaps.c b/ui/keymaps.c
index fd109ef..feb360f 100644
--- a/ui/keymaps.c
+++ b/ui/keymaps.c
@@ -52,7 +52,7 @@
 	}
     }
     if (kr == NULL) {
-	kr = qemu_mallocz(sizeof(*kr));
+	kr = g_malloc0(sizeof(*kr));
         kr->start = kr->end = code;
         kr->next = *krp;
         *krp = kr;
@@ -92,14 +92,14 @@
 #endif  // CONFIG_STANDALONE_UI
 
     if (!k)
-	k = qemu_mallocz(sizeof(kbd_layout_t));
+	k = g_malloc0(sizeof(kbd_layout_t));
     if (!(f = fopen(filename, "r"))) {
 	fprintf(stderr,
 		"Could not read keymap file: '%s'\n", language);
 	return NULL;
     }
 #if defined(CONFIG_STANDALONE_UI)
-    qemu_free(filename);
+    g_free(filename);
 #endif  // CONFIG_STANDALONE_UI
     for(;;) {
 	if (fgets(line, 1024, f) == NULL)
diff --git a/ui/vnc-android.c b/ui/vnc-android.c
index 1fe2544..cf52bfe 100644
--- a/ui/vnc-android.c
+++ b/ui/vnc-android.c
@@ -76,7 +76,7 @@
     /* Enough for the existing format + the 2 vars we're
      * substituting in. */
     addrlen = strlen(format) + strlen(host) + strlen(serv);
-    addr = qemu_malloc(addrlen + 1);
+    addr = g_malloc(addrlen + 1);
     snprintf(addr, addrlen, format, host, serv);
     addr[addrlen] = '\0';
 
@@ -317,7 +317,7 @@
 {
     if ((buffer->capacity - buffer->offset) < len) {
         buffer->capacity += (len + 1024);
-        buffer->buffer = qemu_realloc(buffer->buffer, buffer->capacity);
+        buffer->buffer = g_realloc(buffer->buffer, buffer->capacity);
         if (buffer->buffer == NULL) {
             fprintf(stderr, "vnc: out of memory\n");
             exit(1);
@@ -353,7 +353,7 @@
 
     /* guest surface */
     if (!vs->guest.ds)
-        vs->guest.ds = qemu_mallocz(sizeof(*vs->guest.ds));
+        vs->guest.ds = g_malloc0(sizeof(*vs->guest.ds));
     if (ds_get_bytes_per_pixel(ds) != vs->guest.ds->pf.bytes_per_pixel)
         console_color_init(ds);
     vnc_colordepth(vs);
@@ -374,11 +374,11 @@
 
     /* server surface */
     if (!vs->server.ds)
-        vs->server.ds = qemu_mallocz(sizeof(*vs->server.ds));
+        vs->server.ds = g_malloc0(sizeof(*vs->server.ds));
     if (vs->server.ds->data)
-        qemu_free(vs->server.ds->data);
+        g_free(vs->server.ds->data);
     *(vs->server.ds) = *(ds->surface);
-    vs->server.ds->data = qemu_mallocz(vs->server.ds->linesize *
+    vs->server.ds->data = g_malloc0(vs->server.ds->linesize *
                                        vs->server.ds->height);
     memset(vs->server.dirty, 0xFF, sizeof(vs->guest.dirty));
 }
@@ -530,8 +530,8 @@
     int has_fg, has_bg;
     uint8_t *last_fg, *last_bg;
 
-    last_fg = (uint8_t *) qemu_malloc(vs->server.ds->pf.bytes_per_pixel);
-    last_bg = (uint8_t *) qemu_malloc(vs->server.ds->pf.bytes_per_pixel);
+    last_fg = (uint8_t *) g_malloc(vs->server.ds->pf.bytes_per_pixel);
+    last_bg = (uint8_t *) g_malloc(vs->server.ds->pf.bytes_per_pixel);
     has_fg = has_bg = 0;
     for (j = y; j < (y + h); j += 16) {
         for (i = x; i < (x + w); i += 16) {
@@ -897,8 +897,8 @@
 {
     qemu_del_timer(vs->timer);
     qemu_free_timer(vs->timer);
-    if (vs->input.buffer) qemu_free(vs->input.buffer);
-    if (vs->output.buffer) qemu_free(vs->output.buffer);
+    if (vs->input.buffer) g_free(vs->input.buffer);
+    if (vs->output.buffer) g_free(vs->output.buffer);
 #ifdef CONFIG_VNC_TLS
     vnc_tls_client_cleanup(vs);
 #endif /* CONFIG_VNC_TLS */
@@ -921,10 +921,10 @@
     if (!vs->vd->clients)
         dcl->idle = 1;
 
-    qemu_free(vs->server.ds->data);
-    qemu_free(vs->server.ds);
-    qemu_free(vs->guest.ds);
-    qemu_free(vs);
+    g_free(vs->server.ds->data);
+    g_free(vs->server.ds);
+    g_free(vs->guest.ds);
+    g_free(vs);
 }
 
 int vnc_client_io_error(VncState *vs, int ret, int last_errno)
@@ -2063,7 +2063,7 @@
 
 static void vnc_connect(VncDisplay *vd, int csock)
 {
-    VncState *vs = qemu_mallocz(sizeof(VncState));
+    VncState *vs = g_malloc0(sizeof(VncState));
     vs->csock = csock;
 
     VNC_DEBUG("New client on socket %d\n", csock);
@@ -2110,9 +2110,9 @@
 
 void vnc_display_init(DisplayState *ds)
 {
-    VncDisplay *vs = qemu_mallocz(sizeof(*vs));
+    VncDisplay *vs = g_malloc0(sizeof(*vs));
 
-    dcl = qemu_mallocz(sizeof(DisplayChangeListener));
+    dcl = g_malloc0(sizeof(DisplayChangeListener));
 
     ds->opaque = vs;
     dcl->idle = 1;
@@ -2145,7 +2145,7 @@
     if (!vs)
         return;
     if (vs->display) {
-        qemu_free(vs->display);
+        g_free(vs->display);
         vs->display = NULL;
     }
     if (vs->lsock != -1) {
@@ -2165,11 +2165,11 @@
     VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
 
     if (vs->password) {
-        qemu_free(vs->password);
+        g_free(vs->password);
         vs->password = NULL;
     }
     if (password && password[0]) {
-        if (!(vs->password = qemu_strdup(password)))
+        if (!(vs->password = g_strdup(password)))
             return -1;
     }
 
@@ -2236,20 +2236,20 @@
             end = strchr(options, ',');
             if (start && (!end || (start < end))) {
                 int len = end ? end-(start+1) : strlen(start+1);
-                char *path = qemu_strndup(start + 1, len);
+                char *path = g_strndup(start + 1, len);
 
                 VNC_DEBUG("Trying certificate path '%s'\n", path);
                 if (vnc_tls_set_x509_creds_dir(vs, path) < 0) {
                     fprintf(stderr, "Failed to find x509 certificates/keys in %s\n", path);
-                    qemu_free(path);
-                    qemu_free(vs->display);
+                    g_free(path);
+                    g_free(vs->display);
                     vs->display = NULL;
                     return -1;
                 }
-                qemu_free(path);
+                g_free(path);
             } else {
                 fprintf(stderr, "No certificate path provided\n");
-                qemu_free(vs->display);
+                g_free(vs->display);
                 vs->display = NULL;
                 return -1;
             }
@@ -2383,7 +2383,7 @@
     } else {
         /* listen for connects */
         char *dpy;
-        dpy = qemu_malloc(256);
+        dpy = g_malloc(256);
         if (strncmp(display, "unix:", 5) == 0) {
             pstrcpy(dpy, 256, "unix:");
             vs->lsock = unix_listen(display+5, dpy+5, 256-5);
diff --git a/ui/vnc.c b/ui/vnc.c
index f2804d7..f70ae39 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -67,7 +67,7 @@
     /* Enough for the existing format + the 2 vars we're
      * substituting in. */
     addrlen = strlen(format) + strlen(host) + strlen(serv);
-    addr = qemu_malloc(addrlen + 1);
+    addr = g_malloc(addrlen + 1);
     snprintf(addr, addrlen, format, host, serv);
     addr[addrlen] = '\0';
 
@@ -311,7 +311,7 @@
 {
     if ((buffer->capacity - buffer->offset) < len) {
         buffer->capacity += (len + 1024);
-        buffer->buffer = qemu_realloc(buffer->buffer, buffer->capacity);
+        buffer->buffer = g_realloc(buffer->buffer, buffer->capacity);
         if (buffer->buffer == NULL) {
             fprintf(stderr, "vnc: out of memory\n");
             exit(1);
@@ -347,7 +347,7 @@
 
     /* guest surface */
     if (!vs->guest.ds)
-        vs->guest.ds = qemu_mallocz(sizeof(*vs->guest.ds));
+        vs->guest.ds = g_malloc0(sizeof(*vs->guest.ds));
     if (ds_get_bytes_per_pixel(ds) != vs->guest.ds->pf.bytes_per_pixel)
         console_color_init(ds);
     vnc_colordepth(vs);
@@ -368,11 +368,11 @@
 
     /* server surface */
     if (!vs->server.ds)
-        vs->server.ds = qemu_mallocz(sizeof(*vs->server.ds));
+        vs->server.ds = g_malloc0(sizeof(*vs->server.ds));
     if (vs->server.ds->data)
-        qemu_free(vs->server.ds->data);
+        g_free(vs->server.ds->data);
     *(vs->server.ds) = *(ds->surface);
-    vs->server.ds->data = qemu_mallocz(vs->server.ds->linesize *
+    vs->server.ds->data = g_malloc0(vs->server.ds->linesize *
                                        vs->server.ds->height);
     memset(vs->server.dirty, 0xFF, sizeof(vs->guest.dirty));
 }
@@ -524,8 +524,8 @@
     int has_fg, has_bg;
     uint8_t *last_fg, *last_bg;
 
-    last_fg = (uint8_t *) qemu_malloc(vs->server.ds->pf.bytes_per_pixel);
-    last_bg = (uint8_t *) qemu_malloc(vs->server.ds->pf.bytes_per_pixel);
+    last_fg = (uint8_t *) g_malloc(vs->server.ds->pf.bytes_per_pixel);
+    last_bg = (uint8_t *) g_malloc(vs->server.ds->pf.bytes_per_pixel);
     has_fg = has_bg = 0;
     for (j = y; j < (y + h); j += 16) {
         for (i = x; i < (x + w); i += 16) {
@@ -891,8 +891,8 @@
 {
     qemu_del_timer(vs->timer);
     qemu_free_timer(vs->timer);
-    if (vs->input.buffer) qemu_free(vs->input.buffer);
-    if (vs->output.buffer) qemu_free(vs->output.buffer);
+    if (vs->input.buffer) g_free(vs->input.buffer);
+    if (vs->output.buffer) g_free(vs->output.buffer);
 #ifdef CONFIG_VNC_TLS
     vnc_tls_client_cleanup(vs);
 #endif /* CONFIG_VNC_TLS */
@@ -915,10 +915,10 @@
     if (!vs->vd->clients)
         dcl->idle = 1;
 
-    qemu_free(vs->server.ds->data);
-    qemu_free(vs->server.ds);
-    qemu_free(vs->guest.ds);
-    qemu_free(vs);
+    g_free(vs->server.ds->data);
+    g_free(vs->server.ds);
+    g_free(vs->guest.ds);
+    g_free(vs);
 }
 
 int vnc_client_io_error(VncState *vs, int ret, int last_errno)
@@ -2057,7 +2057,7 @@
 
 static void vnc_connect(VncDisplay *vd, int csock)
 {
-    VncState *vs = qemu_mallocz(sizeof(VncState));
+    VncState *vs = g_malloc0(sizeof(VncState));
     vs->csock = csock;
 
     VNC_DEBUG("New client on socket %d\n", csock);
@@ -2106,9 +2106,9 @@
 
 void vnc_display_init(DisplayState *ds)
 {
-    VncDisplay *vs = qemu_mallocz(sizeof(*vs));
+    VncDisplay *vs = g_malloc0(sizeof(*vs));
 
-    dcl = qemu_mallocz(sizeof(DisplayChangeListener));
+    dcl = g_malloc0(sizeof(DisplayChangeListener));
 
     ds->opaque = vs;
     dcl->idle = 1;
@@ -2141,7 +2141,7 @@
     if (!vs)
         return;
     if (vs->display) {
-        qemu_free(vs->display);
+        g_free(vs->display);
         vs->display = NULL;
     }
     if (vs->lsock != -1) {
@@ -2161,11 +2161,11 @@
     VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
 
     if (vs->password) {
-        qemu_free(vs->password);
+        g_free(vs->password);
         vs->password = NULL;
     }
     if (password && password[0]) {
-        if (!(vs->password = qemu_strdup(password)))
+        if (!(vs->password = g_strdup(password)))
             return -1;
     }
 
@@ -2232,20 +2232,20 @@
             end = strchr(options, ',');
             if (start && (!end || (start < end))) {
                 int len = end ? end-(start+1) : strlen(start+1);
-                char *path = qemu_strndup(start + 1, len);
+                char *path = g_strndup(start + 1, len);
 
                 VNC_DEBUG("Trying certificate path '%s'\n", path);
                 if (vnc_tls_set_x509_creds_dir(vs, path) < 0) {
                     fprintf(stderr, "Failed to find x509 certificates/keys in %s\n", path);
-                    qemu_free(path);
-                    qemu_free(vs->display);
+                    g_free(path);
+                    g_free(vs->display);
                     vs->display = NULL;
                     return -1;
                 }
-                qemu_free(path);
+                g_free(path);
             } else {
                 fprintf(stderr, "No certificate path provided\n");
-                qemu_free(vs->display);
+                g_free(vs->display);
                 vs->display = NULL;
                 return -1;
             }
@@ -2379,7 +2379,7 @@
     } else {
         /* listen for connects */
         char *dpy;
-        dpy = qemu_malloc(256);
+        dpy = g_malloc(256);
         if (strncmp(display, "unix:", 5) == 0) {
             pstrcpy(dpy, 256, "unix:");
             vs->lsock = unix_listen(display+5, dpy+5, 256-5);
diff --git a/util/acl.c b/util/acl.c
index 1b4238a..a462727 100644
--- a/util/acl.c
+++ b/util/acl.c
@@ -55,8 +55,8 @@
     if (acl)
         return acl;
 
-    acl = qemu_malloc(sizeof(*acl));
-    acl->aclname = qemu_strdup(aclname);
+    acl = g_malloc(sizeof(*acl));
+    acl->aclname = g_strdup(aclname);
     /* Deny by default, so there is no window of "open
      * access" between QEMU starting, and the user setting
      * up ACLs in the monitor */
@@ -65,7 +65,7 @@
     acl->nentries = 0;
     QTAILQ_INIT(&acl->entries);
 
-    acls = qemu_realloc(acls, sizeof(*acls) * (nacls +1));
+    acls = g_realloc(acls, sizeof(*acls) * (nacls +1));
     acls[nacls] = acl;
     nacls++;
 
@@ -116,8 +116,8 @@
 {
     qemu_acl_entry *entry;
 
-    entry = qemu_malloc(sizeof(*entry));
-    entry->match = qemu_strdup(match);
+    entry = g_malloc(sizeof(*entry));
+    entry->match = g_strdup(match);
     entry->deny = deny;
 
     QTAILQ_INSERT_TAIL(&acl->entries, entry, next);
@@ -142,8 +142,8 @@
         return qemu_acl_append(acl, deny, match);
 
 
-    entry = qemu_malloc(sizeof(*entry));
-    entry->match = qemu_strdup(match);
+    entry = g_malloc(sizeof(*entry));
+    entry->match = g_strdup(match);
     entry->deny = deny;
 
     QTAILQ_FOREACH(tmp, &acl->entries, next) {
diff --git a/util/cutils.c b/util/cutils.c
index 7b250b0..833f13d 100644
--- a/util/cutils.c
+++ b/util/cutils.c
@@ -136,7 +136,7 @@
 
 void qemu_iovec_init(QEMUIOVector *qiov, int alloc_hint)
 {
-    qiov->iov = qemu_malloc(alloc_hint * sizeof(struct iovec));
+    qiov->iov = g_malloc(alloc_hint * sizeof(struct iovec));
     qiov->niov = 0;
     qiov->nalloc = alloc_hint;
     qiov->size = 0;
@@ -160,7 +160,7 @@
 
     if (qiov->niov == qiov->nalloc) {
         qiov->nalloc = 2 * qiov->nalloc + 1;
-        qiov->iov = qemu_realloc(qiov->iov, qiov->nalloc * sizeof(struct iovec));
+        qiov->iov = g_realloc(qiov->iov, qiov->nalloc * sizeof(struct iovec));
     }
     qiov->iov[qiov->niov].iov_base = base;
     qiov->iov[qiov->niov].iov_len = len;
@@ -217,7 +217,7 @@
 {
     assert(qiov->nalloc != -1);
 
-    qemu_free(qiov->iov);
+    g_free(qiov->iov);
 }
 
 void qemu_iovec_reset(QEMUIOVector *qiov)
diff --git a/util/module.c b/util/module.c
index 0b3664e..89c082b 100644
--- a/util/module.c
+++ b/util/module.c
@@ -59,7 +59,7 @@
     ModuleEntry *e;
     ModuleTypeList *l;
 
-    e = qemu_mallocz(sizeof(*e));
+    e = g_malloc0(sizeof(*e));
     e->init = fn;
 
     l = find_type(type);
diff --git a/util/qemu-option.c b/util/qemu-option.c
index a9588e9..0bfea2d 100644
--- a/util/qemu-option.c
+++ b/util/qemu-option.c
@@ -277,7 +277,7 @@
 
     case OPT_STRING:
         if (value != NULL) {
-            list->value.s = qemu_strdup(value);
+            list->value.s = g_strdup(value);
         } else {
             fprintf(stderr, "Option '%s' needs a parameter\n", name);
             return -1;
@@ -337,12 +337,12 @@
 
     while (cur && cur->name) {
         if (cur->type == OPT_STRING) {
-            qemu_free(cur->value.s);
+            g_free(cur->value.s);
         }
         cur++;
     }
 
-    qemu_free(list);
+    g_free(list);
 }
 
 /*
@@ -377,7 +377,7 @@
 
     num_options += count_option_parameters(list);
 
-    dest = qemu_realloc(dest, (num_options + 1) * sizeof(QEMUOptionParameter));
+    dest = g_realloc(dest, (num_options + 1) * sizeof(QEMUOptionParameter));
     dest[num_dest_options].name = NULL;
 
     while (list && list->name) {
@@ -594,9 +594,9 @@
 static void qemu_opt_del(QemuOpt *opt)
 {
     QTAILQ_REMOVE(&opt->opts->head, opt, next);
-    qemu_free((/* !const */ char*)opt->name);
-    qemu_free((/* !const */ char*)opt->str);
-    qemu_free(opt);
+    g_free((/* !const */ char*)opt->name);
+    g_free((/* !const */ char*)opt->str);
+    g_free(opt);
 }
 
 int qemu_opt_set(QemuOpts *opts, const char *name, const char *value)
@@ -619,15 +619,15 @@
         }
     }
 
-    opt = qemu_mallocz(sizeof(*opt));
-    opt->name = qemu_strdup(name);
+    opt = g_malloc0(sizeof(*opt));
+    opt->name = g_strdup(name);
     opt->opts = opts;
     QTAILQ_INSERT_TAIL(&opts->head, opt, next);
     if (desc[i].name != NULL) {
         opt->desc = desc+i;
     }
     if (value) {
-        opt->str = qemu_strdup(value);
+        opt->str = g_strdup(value);
     }
     if (qemu_opt_parse(opt) < 0) {
         qemu_opt_del(opt);
@@ -701,9 +701,9 @@
             }
         }
     }
-    opts = qemu_mallocz(sizeof(*opts));
+    opts = g_malloc0(sizeof(*opts));
     if (id) {
-        opts->id = qemu_strdup(id);
+        opts->id = g_strdup(id);
     }
     opts->list = list;
     loc_save(&opts->loc);
@@ -754,8 +754,8 @@
         qemu_opt_del(opt);
     }
     QTAILQ_REMOVE(&opts->list->head, opts, next);
-    qemu_free(opts->id);
-    qemu_free(opts);
+    g_free(opts->id);
+    g_free(opts);
 }
 
 int qemu_opts_print(QemuOpts *opts, void *dummy)
diff --git a/util/qemu-sockets-android.c b/util/qemu-sockets-android.c
index 132c1ca..aa06256 100644
--- a/util/qemu-sockets-android.c
+++ b/util/qemu-sockets-android.c
@@ -564,10 +564,10 @@
     if (optstr) {
         len = optstr - str;
         if (len) {
-            path = qemu_malloc(len+1);
+            path = g_malloc(len+1);
             snprintf(path, len+1, "%.*s", len, str);
             qemu_opt_set(opts, "path", path);
-            qemu_free(path);
+            g_free(path);
         }
     } else {
         qemu_opt_set(opts, "path", str);
diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
index aa1fefb..16e0c44 100644
--- a/util/qemu-sockets.c
+++ b/util/qemu-sockets.c
@@ -631,10 +631,10 @@
     if (optstr) {
         len = optstr - str;
         if (len) {
-            path = qemu_malloc(len+1);
+            path = g_malloc(len+1);
             snprintf(path, len+1, "%.*s", len, str);
             qemu_opt_set(opts, "path", path);
-            qemu_free(path);
+            g_free(path);
         }
     } else {
         qemu_opt_set(opts, "path", str);
diff --git a/vl-android.c b/vl-android.c
index 4054a1c..4b0c991 100644
--- a/vl-android.c
+++ b/vl-android.c
@@ -699,7 +699,7 @@
         if (vlan->id == id)
             return &vlan->net;
     }
-    vlan = qemu_mallocz(sizeof(struct bt_vlan_s));
+    vlan = g_malloc0(sizeof(struct bt_vlan_s));
     vlan->id = id;
     pvlan = &first_bt_vlan;
     while (*pvlan != NULL)
@@ -1665,7 +1665,7 @@
 {
     struct pcmcia_socket_entry_s *entry;
 
-    entry = qemu_malloc(sizeof(struct pcmcia_socket_entry_s));
+    entry = g_malloc(sizeof(struct pcmcia_socket_entry_s));
     entry->socket = socket;
     entry->next = pcmcia_sockets;
     pcmcia_sockets = entry;
@@ -1679,7 +1679,7 @@
     for (entry = *ptr; entry; ptr = &entry->next, entry = *ptr)
         if (entry->socket == socket) {
             *ptr = entry->next;
-            qemu_free(entry);
+            g_free(entry);
         }
 }
 
@@ -1776,7 +1776,7 @@
 {
     VMChangeStateEntry *e;
 
-    e = qemu_mallocz(sizeof (*e));
+    e = g_malloc0(sizeof (*e));
 
     e->cb = cb;
     e->opaque = opaque;
@@ -1787,7 +1787,7 @@
 void qemu_del_vm_change_state_handler(VMChangeStateEntry *e)
 {
     QLIST_REMOVE (e, entries);
-    qemu_free (e);
+    g_free (e);
 }
 
 void vm_state_notify(int running, int reason)
@@ -1870,7 +1870,7 @@
     while (*pre != NULL && (*pre)->order >= order) {
         pre = &(*pre)->next;
     }
-    re = qemu_mallocz(sizeof(QEMUResetEntry));
+    re = g_malloc0(sizeof(QEMUResetEntry));
     re->func = func;
     re->opaque = opaque;
     re->order = order;
@@ -2182,7 +2182,7 @@
         p--;
     *p = 0;
     if (access(buf, R_OK) == 0) {
-        return qemu_strdup(buf);
+        return g_strdup(buf);
     }
     return NULL;
 }
@@ -2222,7 +2222,7 @@
         }
     }
 
-    return qemu_strdup(dirname(buf));
+    return g_strdup(dirname(buf));
 }
 #endif
 
@@ -2230,12 +2230,12 @@
 qemu_find_file_with_subdir(const char* data_dir, const char* subdir, const char* name)
 {
     int   len = strlen(data_dir) + strlen(name) + strlen(subdir) + 2;
-    char* buf = qemu_mallocz(len);
+    char* buf = g_malloc0(len);
 
     snprintf(buf, len, "%s/%s%s", data_dir, subdir, name);
     VERBOSE_PRINT(init,"    trying to find: %s\n", buf);
     if (access(buf, R_OK)) {
-        qemu_free(buf);
+        g_free(buf);
         return NULL;
     }
     return buf;
@@ -4048,12 +4048,12 @@
                     if (nb_option_roms >= MAX_OPTION_ROMS) {
                         PANIC("Too many option ROMs");
                     }
-                    option_rom[nb_option_roms] = qemu_strdup(buf);
+                    option_rom[nb_option_roms] = g_strdup(buf);
                     nb_option_roms++;
                     netroms++;
                 }
                 if (filename) {
-                    qemu_free(filename);
+                    g_free(filename);
                 }
             }
 	}
diff --git a/vl.c b/vl.c
index c5b66ea..4284222 100644
--- a/vl.c
+++ b/vl.c
@@ -503,7 +503,7 @@
         if (vlan->id == id)
             return &vlan->net;
     }
-    vlan = qemu_mallocz(sizeof(struct bt_vlan_s));
+    vlan = g_malloc0(sizeof(struct bt_vlan_s));
     vlan->id = id;
     pvlan = &first_bt_vlan;
     while (*pvlan != NULL)
@@ -1459,7 +1459,7 @@
 {
     struct pcmcia_socket_entry_s *entry;
 
-    entry = qemu_malloc(sizeof(struct pcmcia_socket_entry_s));
+    entry = g_malloc(sizeof(struct pcmcia_socket_entry_s));
     entry->socket = socket;
     entry->next = pcmcia_sockets;
     pcmcia_sockets = entry;
@@ -1473,7 +1473,7 @@
     for (entry = *ptr; entry; ptr = &entry->next, entry = *ptr)
         if (entry->socket == socket) {
             *ptr = entry->next;
-            qemu_free(entry);
+            g_free(entry);
         }
 }
 
@@ -1570,7 +1570,7 @@
 {
     VMChangeStateEntry *e;
 
-    e = qemu_mallocz(sizeof (*e));
+    e = g_malloc0(sizeof (*e));
 
     e->cb = cb;
     e->opaque = opaque;
@@ -1581,7 +1581,7 @@
 void qemu_del_vm_change_state_handler(VMChangeStateEntry *e)
 {
     QLIST_REMOVE (e, entries);
-    qemu_free (e);
+    g_free (e);
 }
 
 void vm_state_notify(int running, int reason)
@@ -1664,7 +1664,7 @@
     while (*pre != NULL && (*pre)->order >= order) {
         pre = &(*pre)->next;
     }
-    re = qemu_mallocz(sizeof(QEMUResetEntry));
+    re = g_malloc0(sizeof(QEMUResetEntry));
     re->func = func;
     re->opaque = opaque;
     re->order = order;
@@ -1952,7 +1952,7 @@
         p--;
     *p = 0;
     if (access(buf, R_OK) == 0) {
-        return qemu_strdup(buf);
+        return g_strdup(buf);
     }
     return NULL;
 }
@@ -2008,12 +2008,12 @@
 
     max_len = strlen(dir) +
         MAX(strlen(SHARE_SUFFIX), strlen(BUILD_SUFFIX)) + 1;
-    res = qemu_mallocz(max_len);
+    res = g_malloc0(max_len);
     snprintf(res, max_len, "%s%s", dir, SHARE_SUFFIX);
     if (access(res, R_OK)) {
         snprintf(res, max_len, "%s%s", dir, BUILD_SUFFIX);
         if (access(res, R_OK)) {
-            qemu_free(res);
+            g_free(res);
             res = NULL;
         }
     }
@@ -2035,7 +2035,7 @@
     /* If name contains path separators then try it as a straight path.  */
     if ((strchr(name, '/') || strchr(name, '\\'))
         && access(name, R_OK) == 0) {
-        return qemu_strdup(name);
+        return g_strdup(name);
     }
     switch (type) {
     case QEMU_FILE_TYPE_BIOS:
@@ -2048,10 +2048,10 @@
         abort();
     }
     len = strlen(data_dir) + strlen(name) + strlen(subdir) + 2;
-    buf = qemu_mallocz(len);
+    buf = g_malloc0(len);
     snprintf(buf, len, "%s/%s%s", data_dir, subdir, name);
     if (access(buf, R_OK)) {
-        qemu_free(buf);
+        g_free(buf);
         return NULL;
     }
     return buf;
@@ -2874,12 +2874,12 @@
                         fprintf(stderr, "Too many option ROMs\n");
                         exit(1);
                     }
-                    option_rom[nb_option_roms] = qemu_strdup(buf);
+                    option_rom[nb_option_roms] = g_strdup(buf);
                     nb_option_roms++;
                     netroms++;
                 }
                 if (filename) {
-                    qemu_free(filename);
+                    g_free(filename);
                 }
             }
 	}