diff --git a/acl.c b/acl.c
index 82c2704..0654f38 100644
--- a/acl.c
+++ b/acl.c
@@ -55,8 +55,8 @@
     if (acl)
         return acl;
 
-    acl = qemu_malloc(sizeof(*acl));
-    acl->aclname = qemu_strdup(aclname);
+    acl = g_malloc(sizeof(*acl));
+    acl->aclname = g_strdup(aclname);
     /* Deny by default, so there is no window of "open
      * access" between QEMU starting, and the user setting
      * up ACLs in the monitor */
@@ -65,7 +65,7 @@
     acl->nentries = 0;
     QTAILQ_INIT(&acl->entries);
 
-    acls = qemu_realloc(acls, sizeof(*acls) * (nacls +1));
+    acls = g_realloc(acls, sizeof(*acls) * (nacls +1));
     acls[nacls] = acl;
     nacls++;
 
@@ -116,8 +116,8 @@
 {
     qemu_acl_entry *entry;
 
-    entry = qemu_malloc(sizeof(*entry));
-    entry->match = qemu_strdup(match);
+    entry = g_malloc(sizeof(*entry));
+    entry->match = g_strdup(match);
     entry->deny = deny;
 
     QTAILQ_INSERT_TAIL(&acl->entries, entry, next);
@@ -142,8 +142,8 @@
         return qemu_acl_append(acl, deny, match);
 
 
-    entry = qemu_malloc(sizeof(*entry));
-    entry->match = qemu_strdup(match);
+    entry = g_malloc(sizeof(*entry));
+    entry->match = g_strdup(match);
     entry->deny = deny;
 
     QTAILQ_FOREACH(tmp, &acl->entries, next) {
diff --git a/aio.c b/aio.c
index 2f08655..1239ca7 100644
--- a/aio.c
+++ b/aio.c
@@ -75,13 +75,13 @@
                  * releasing the walking_handlers lock.
                  */
                 QLIST_REMOVE(node, node);
-                qemu_free(node);
+                g_free(node);
             }
         }
     } else {
         if (node == NULL) {
             /* Alloc and insert if it's not already there */
-            node = qemu_mallocz(sizeof(AioHandler));
+            node = g_malloc0(sizeof(AioHandler));
             node->fd = fd;
             QLIST_INSERT_HEAD(&aio_handlers, node, node);
         }
@@ -220,7 +220,7 @@
 
                 if (tmp->deleted) {
                     QLIST_REMOVE(tmp, node);
-                    qemu_free(tmp);
+                    g_free(tmp);
                 }
             }
 
diff --git a/arch_init.c b/arch_init.c
index 484b39d..567ab32 100644
--- a/arch_init.c
+++ b/arch_init.c
@@ -235,7 +235,7 @@
     QLIST_FOREACH(block, &ram_list.blocks, next) {
         ++n;
     }
-    blocks = qemu_malloc(n * sizeof *blocks);
+    blocks = g_malloc(n * sizeof *blocks);
     n = 0;
     QLIST_FOREACH_SAFE(block, &ram_list.blocks, next, nblock) {
         blocks[n++] = block;
@@ -245,7 +245,7 @@
     while (--n >= 0) {
         QLIST_INSERT_HEAD(&ram_list.blocks, blocks[n], next);
     }
-    qemu_free(blocks);
+    g_free(blocks);
 }
 
 int ram_save_live(Monitor *mon, QEMUFile *f, int stage, void *opaque)
diff --git a/async.c b/async.c
index 3fe70b9..9d4e960 100644
--- a/async.c
+++ b/async.c
@@ -43,7 +43,7 @@
 QEMUBH *qemu_bh_new(QEMUBHFunc *cb, void *opaque)
 {
     QEMUBH *bh;
-    bh = qemu_mallocz(sizeof(QEMUBH));
+    bh = g_malloc0(sizeof(QEMUBH));
     bh->cb = cb;
     bh->opaque = opaque;
     bh->next = first_bh;
@@ -74,7 +74,7 @@
         bh = *bhp;
         if (bh->deleted) {
             *bhp = bh->next;
-            qemu_free(bh);
+            g_free(bh);
         } else
             bhp = &bh->next;
     }
diff --git a/audio/alsaaudio.c b/audio/alsaaudio.c
index 4d72014..cb45b49 100644
--- a/audio/alsaaudio.c
+++ b/audio/alsaaudio.c
@@ -136,7 +136,7 @@
         for (i = 0; i < hlp->count; ++i) {
             qemu_set_fd_handler (pfds[i].fd, NULL, NULL, NULL);
         }
-        qemu_free (pfds);
+        g_free (pfds);
     }
     hlp->pfds = NULL;
     hlp->count = 0;
@@ -260,7 +260,7 @@
     if (err < 0) {
         alsa_logerr (err, "Could not initialize poll mode\n"
                      "Could not obtain poll descriptors\n");
-        qemu_free (pfds);
+        g_free (pfds);
         return -1;
     }
 
@@ -288,7 +288,7 @@
             while (i--) {
                 qemu_set_fd_handler (pfds[i].fd, NULL, NULL, NULL);
             }
-            qemu_free (pfds);
+            g_free (pfds);
             return -1;
         }
     }
@@ -816,7 +816,7 @@
     alsa_anal_close (&alsa->handle, &alsa->pollhlp);
 
     if (alsa->pcm_buf) {
-        qemu_free (alsa->pcm_buf);
+        g_free (alsa->pcm_buf);
         alsa->pcm_buf = NULL;
     }
 }
@@ -979,7 +979,7 @@
     alsa_anal_close (&alsa->handle, &alsa->pollhlp);
 
     if (alsa->pcm_buf) {
-        qemu_free (alsa->pcm_buf);
+        g_free (alsa->pcm_buf);
         alsa->pcm_buf = NULL;
     }
 }
diff --git a/audio/audio.c b/audio/audio.c
index 50d2b64..5649075 100644
--- a/audio/audio.c
+++ b/audio/audio.c
@@ -196,7 +196,7 @@
         return NULL;
     }
 
-    return qemu_mallocz (len);
+    return g_malloc0 (len);
 }
 
 static char *audio_alloc_prefix (const char *s)
@@ -210,7 +210,7 @@
     }
 
     len = strlen (s);
-    r = qemu_malloc (len + sizeof (qemu_prefix));
+    r = g_malloc (len + sizeof (qemu_prefix));
 
     u = r + sizeof (qemu_prefix) - 1;
 
@@ -425,7 +425,7 @@
         printf ("    %s\n", opt->descr);
     }
 
-    qemu_free (uprefix);
+    g_free (uprefix);
 }
 
 static void audio_process_options (const char *prefix,
@@ -462,7 +462,7 @@
          * (includes trailing zero) + zero + underscore (on behalf of
          * sizeof) */
         optlen = len + preflen + sizeof (qemu_prefix) + 1;
-        optname = qemu_malloc (optlen);
+        optname = g_malloc (optlen);
 
         pstrcpy (optname, optlen, qemu_prefix);
 
@@ -507,7 +507,7 @@
             opt->overriddenp = &opt->overridden;
         }
         *opt->overriddenp = !def;
-        qemu_free (optname);
+        g_free (optname);
     }
 }
 
@@ -778,7 +778,7 @@
 
         QLIST_REMOVE (sw, entries);
         QLIST_REMOVE (sc, entries);
-        qemu_free (sc);
+        g_free (sc);
         if (was_active) {
             /* We have removed soft voice from the capture:
                this might have changed the overall status of the capture
@@ -818,7 +818,7 @@
         sw->rate = st_rate_start (sw->info.freq, hw_cap->info.freq);
         if (!sw->rate) {
             dolog ("Could not start rate conversion for `%s'\n", SW_NAME (sw));
-            qemu_free (sw);
+            g_free (sw);
             return -1;
         }
         QLIST_INSERT_HEAD (&hw_cap->sw_head, sw, entries);
@@ -1907,7 +1907,7 @@
 void AUD_register_card (const char *name, QEMUSoundCard *card)
 {
     audio_init ();
-    card->name = qemu_strdup (name);
+    card->name = g_strdup (name);
     memset (&card->entries, 0, sizeof (card->entries));
     QLIST_INSERT_HEAD (&glob_audio_state.card_head, card, entries);
 }
@@ -1915,7 +1915,7 @@
 void AUD_remove_card (QEMUSoundCard *card)
 {
     QLIST_REMOVE (card, entries);
-    qemu_free (card->name);
+    g_free (card->name);
 }
 
 
@@ -2000,11 +2000,11 @@
         return cap;
 
     err3:
-        qemu_free (cap->hw.mix_buf);
+        g_free (cap->hw.mix_buf);
     err2:
-        qemu_free (cap);
+        g_free (cap);
     err1:
-        qemu_free (cb);
+        g_free (cb);
     err0:
         return NULL;
     }
@@ -2018,7 +2018,7 @@
         if (cb->opaque == cb_opaque) {
             cb->ops.destroy (cb_opaque);
             QLIST_REMOVE (cb, entries);
-            qemu_free (cb);
+            g_free (cb);
 
             if (!cap->cb_head.lh_first) {
                 SWVoiceOut *sw = cap->hw.sw_head.lh_first, *sw1;
@@ -2036,11 +2036,11 @@
                     }
                     QLIST_REMOVE (sw, entries);
                     QLIST_REMOVE (sc, entries);
-                    qemu_free (sc);
+                    g_free (sc);
                     sw = sw1;
                 }
                 QLIST_REMOVE (cap, entries);
-                qemu_free (cap);
+                g_free (cap);
             }
             return;
         }
diff --git a/audio/audio_template.h b/audio/audio_template.h
index fd4469e..e62a713 100644
--- a/audio/audio_template.h
+++ b/audio/audio_template.h
@@ -72,7 +72,7 @@
 static void glue (audio_pcm_hw_free_resources_, TYPE) (HW *hw)
 {
     if (HWBUF) {
-        qemu_free (HWBUF);
+        g_free (HWBUF);
     }
 
     HWBUF = NULL;
@@ -93,7 +93,7 @@
 static void glue (audio_pcm_sw_free_resources_, TYPE) (SW *sw)
 {
     if (sw->buf) {
-        qemu_free (sw->buf);
+        g_free (sw->buf);
     }
 
     if (sw->rate) {
@@ -123,7 +123,7 @@
     sw->rate = st_rate_start (sw->hw->info.freq, sw->info.freq);
 #endif
     if (!sw->rate) {
-        qemu_free (sw->buf);
+        g_free (sw->buf);
         sw->buf = NULL;
         return -1;
     }
@@ -160,10 +160,10 @@
         [sw->info.swap_endianness]
         [audio_bits_to_index (sw->info.bits)];
 
-    sw->name = qemu_strdup (name);
+    sw->name = g_strdup (name);
     err = glue (audio_pcm_sw_alloc_resources_, TYPE) (sw);
     if (err) {
-        qemu_free (sw->name);
+        g_free (sw->name);
         sw->name = NULL;
     }
     return err;
@@ -173,7 +173,7 @@
 {
     glue (audio_pcm_sw_free_resources_, TYPE) (sw);
     if (sw->name) {
-        qemu_free (sw->name);
+        g_free (sw->name);
         sw->name = NULL;
     }
 }
@@ -201,7 +201,7 @@
         glue (s->nb_hw_voices_, TYPE) += 1;
         glue (audio_pcm_hw_free_resources_ ,TYPE) (hw);
         glue (hw->pcm_ops->fini_, TYPE) (hw);
-        qemu_free (hw);
+        g_free (hw);
         *hwp = NULL;
     }
 }
@@ -300,7 +300,7 @@
  err1:
     glue (hw->pcm_ops->fini_, TYPE) (hw);
  err0:
-    qemu_free (hw);
+    g_free (hw);
     return NULL;
 }
 
@@ -368,7 +368,7 @@
     glue (audio_pcm_hw_del_sw_, TYPE) (sw);
     glue (audio_pcm_hw_gc_, TYPE) (&hw);
 err2:
-    qemu_free (sw);
+    g_free (sw);
 err1:
     return NULL;
 }
@@ -378,7 +378,7 @@
     glue (audio_pcm_sw_fini_, TYPE) (sw);
     glue (audio_pcm_hw_del_sw_, TYPE) (sw);
     glue (audio_pcm_hw_gc_, TYPE) (&sw->hw);
-    qemu_free (sw);
+    g_free (sw);
 }
 
 void glue (AUD_close_, TYPE) (QEMUSoundCard *card, SW *sw)
diff --git a/audio/esdaudio.c b/audio/esdaudio.c
index ff97b39..bd6e1cc 100644
--- a/audio/esdaudio.c
+++ b/audio/esdaudio.c
@@ -246,7 +246,7 @@
     esd->fd = -1;
 
  fail1:
-    qemu_free (esd->pcm_buf);
+    g_free (esd->pcm_buf);
     esd->pcm_buf = NULL;
     return -1;
 }
@@ -270,7 +270,7 @@
 
     audio_pt_fini (&esd->pt, AUDIO_FUNC);
 
-    qemu_free (esd->pcm_buf);
+    g_free (esd->pcm_buf);
     esd->pcm_buf = NULL;
 }
 
@@ -453,7 +453,7 @@
     esd->fd = -1;
 
  fail1:
-    qemu_free (esd->pcm_buf);
+    g_free (esd->pcm_buf);
     esd->pcm_buf = NULL;
     return -1;
 }
@@ -477,7 +477,7 @@
 
     audio_pt_fini (&esd->pt, AUDIO_FUNC);
 
-    qemu_free (esd->pcm_buf);
+    g_free (esd->pcm_buf);
     esd->pcm_buf = NULL;
 }
 
diff --git a/audio/mixeng.c b/audio/mixeng.c
index 4a9e8eb..5446be6 100644
--- a/audio/mixeng.c
+++ b/audio/mixeng.c
@@ -326,7 +326,7 @@
 
 void st_rate_stop (void *opaque)
 {
-    qemu_free (opaque);
+    g_free (opaque);
 }
 
 void mixeng_clear (struct st_sample *buf, int len)
diff --git a/audio/ossaudio.c b/audio/ossaudio.c
index b49e102..df51b7c 100644
--- a/audio/ossaudio.c
+++ b/audio/ossaudio.c
@@ -508,7 +508,7 @@
             }
         }
         else {
-            qemu_free (oss->pcm_buf);
+            g_free (oss->pcm_buf);
         }
         oss->pcm_buf = NULL;
     }
@@ -741,7 +741,7 @@
     oss_anal_close (&oss->fd);
 
     if (oss->pcm_buf) {
-        qemu_free (oss->pcm_buf);
+        g_free (oss->pcm_buf);
         oss->pcm_buf = NULL;
     }
 }
diff --git a/audio/paaudio.c b/audio/paaudio.c
index fb4510e..d1f3912 100644
--- a/audio/paaudio.c
+++ b/audio/paaudio.c
@@ -339,7 +339,7 @@
     return 0;
 
  fail3:
-    qemu_free (pa->pcm_buf);
+    g_free (pa->pcm_buf);
     pa->pcm_buf = NULL;
  fail2:
     pa_simple_free (pa->s);
@@ -394,7 +394,7 @@
     return 0;
 
  fail3:
-    qemu_free (pa->pcm_buf);
+    g_free (pa->pcm_buf);
     pa->pcm_buf = NULL;
  fail2:
     pa_simple_free (pa->s);
@@ -419,7 +419,7 @@
     }
 
     audio_pt_fini (&pa->pt, AUDIO_FUNC);
-    qemu_free (pa->pcm_buf);
+    g_free (pa->pcm_buf);
     pa->pcm_buf = NULL;
 }
 
@@ -439,7 +439,7 @@
     }
 
     audio_pt_fini (&pa->pt, AUDIO_FUNC);
-    qemu_free (pa->pcm_buf);
+    g_free (pa->pcm_buf);
     pa->pcm_buf = NULL;
 }
 
diff --git a/audio/wavaudio.c b/audio/wavaudio.c
index 294f357..aed1817 100644
--- a/audio/wavaudio.c
+++ b/audio/wavaudio.c
@@ -156,7 +156,7 @@
     if (!wav->f) {
         dolog ("Failed to open wave file `%s'\nReason: %s\n",
                conf.wav_path, strerror (errno));
-        qemu_free (wav->pcm_buf);
+        g_free (wav->pcm_buf);
         wav->pcm_buf = NULL;
         return -1;
     }
@@ -189,7 +189,7 @@
     qemu_fclose (wav->f);
     wav->f = NULL;
 
-    qemu_free (wav->pcm_buf);
+    g_free (wav->pcm_buf);
     wav->pcm_buf = NULL;
 }
 
diff --git a/audio/wavcapture.c b/audio/wavcapture.c
index 1f49cd1..c64f0ef 100644
--- a/audio/wavcapture.c
+++ b/audio/wavcapture.c
@@ -48,7 +48,7 @@
         qemu_fclose (wav->f);
     }
 
-    qemu_free (wav->path);
+    g_free (wav->path);
 }
 
 static void wav_capture (void *opaque, void *buf, int size)
@@ -120,7 +120,7 @@
     ops.capture = wav_capture;
     ops.destroy = wav_destroy;
 
-    wav = qemu_mallocz (sizeof (*wav));
+    wav = g_malloc0 (sizeof (*wav));
 
     shift = bits16 + stereo;
     hdr[34] = bits16 ? 0x10 : 0x08;
@@ -134,11 +134,11 @@
     if (!wav->f) {
         monitor_printf(mon, "Failed to open wave file `%s'\nReason: %s\n",
                        path, strerror (errno));
-        qemu_free (wav);
+        g_free (wav);
         return -1;
     }
 
-    wav->path = qemu_strdup (path);
+    wav->path = g_strdup (path);
     wav->bits = bits;
     wav->nchannels = nchannels;
     wav->freq = freq;
@@ -148,9 +148,9 @@
     cap = AUD_add_capture (&as, &ops, wav);
     if (!cap) {
         monitor_printf(mon, "Failed to add audio capture\n");
-        qemu_free (wav->path);
+        g_free (wav->path);
         qemu_fclose (wav->f);
-        qemu_free (wav);
+        g_free (wav);
         return -1;
     }
 
diff --git a/audio/winwaveaudio.c b/audio/winwaveaudio.c
index e5ad3c6..87e7493 100644
--- a/audio/winwaveaudio.c
+++ b/audio/winwaveaudio.c
@@ -222,9 +222,9 @@
     return 0;
 
  err4:
-    qemu_free (wave->pcm_buf);
+    g_free (wave->pcm_buf);
  err3:
-    qemu_free (wave->hdrs);
+    g_free (wave->hdrs);
  err2:
     winwave_anal_close_out (wave);
  err1:
@@ -310,10 +310,10 @@
         wave->event = NULL;
     }
 
-    qemu_free (wave->pcm_buf);
+    g_free (wave->pcm_buf);
     wave->pcm_buf = NULL;
 
-    qemu_free (wave->hdrs);
+    g_free (wave->hdrs);
     wave->hdrs = NULL;
 }
 
@@ -511,9 +511,9 @@
     return 0;
 
  err4:
-    qemu_free (wave->pcm_buf);
+    g_free (wave->pcm_buf);
  err3:
-    qemu_free (wave->hdrs);
+    g_free (wave->hdrs);
  err2:
     winwave_anal_close_in (wave);
  err1:
@@ -550,10 +550,10 @@
         wave->event = NULL;
     }
 
-    qemu_free (wave->pcm_buf);
+    g_free (wave->pcm_buf);
     wave->pcm_buf = NULL;
 
-    qemu_free (wave->hdrs);
+    g_free (wave->hdrs);
     wave->hdrs = NULL;
 }
 
diff --git a/bitmap.h b/bitmap.h
index efd5d3a..08755eb 100644
--- a/bitmap.h
+++ b/bitmap.h
@@ -91,7 +91,7 @@
 static inline unsigned long *bitmap_new(int nbits)
 {
     int len = BITS_TO_LONGS(nbits) * sizeof(unsigned long);
-    return qemu_mallocz(len);
+    return g_malloc0(len);
 }
 
 static inline void bitmap_zero(unsigned long *dst, int nbits)
diff --git a/block-migration.c b/block-migration.c
index 0936c7d..e2775ee 100644
--- a/block-migration.c
+++ b/block-migration.c
@@ -180,7 +180,7 @@
             BDRV_SECTORS_PER_DIRTY_CHUNK * 8 - 1;
     bitmap_size /= BDRV_SECTORS_PER_DIRTY_CHUNK * 8;
 
-    bmds->aio_bitmap = qemu_mallocz(bitmap_size);
+    bmds->aio_bitmap = g_malloc0(bitmap_size);
 }
 
 static void blk_mig_read_cb(void *opaque, int ret)
@@ -235,8 +235,8 @@
         nr_sectors = total_sectors - cur_sector;
     }
 
-    blk = qemu_malloc(sizeof(BlkMigBlock));
-    blk->buf = qemu_malloc(BLOCK_SIZE);
+    blk = g_malloc(sizeof(BlkMigBlock));
+    blk->buf = g_malloc(BLOCK_SIZE);
     blk->bmds = bmds;
     blk->sector = cur_sector;
     blk->nr_sectors = nr_sectors;
@@ -264,8 +264,8 @@
 error:
     monitor_printf(mon, "Error reading sector %" PRId64 "\n", cur_sector);
     qemu_file_set_error(f);
-    qemu_free(blk->buf);
-    qemu_free(blk);
+    g_free(blk->buf);
+    g_free(blk);
     return 0;
 }
 
@@ -290,7 +290,7 @@
             return;
         }
 
-        bmds = qemu_mallocz(sizeof(BlkMigDevState));
+        bmds = g_malloc0(sizeof(BlkMigDevState));
         bmds->bs = bs;
         bmds->bulk_completed = 0;
         bmds->total_sectors = sectors;
@@ -395,8 +395,8 @@
             } else {
                 nr_sectors = BDRV_SECTORS_PER_DIRTY_CHUNK;
             }
-            blk = qemu_malloc(sizeof(BlkMigBlock));
-            blk->buf = qemu_malloc(BLOCK_SIZE);
+            blk = g_malloc(sizeof(BlkMigBlock));
+            blk->buf = g_malloc(BLOCK_SIZE);
             blk->bmds = bmds;
             blk->sector = sector;
             blk->nr_sectors = nr_sectors;
@@ -424,8 +424,8 @@
                 }
                 blk_send(f, blk);
 
-                qemu_free(blk->buf);
-                qemu_free(blk);
+                g_free(blk->buf);
+                g_free(blk);
             }
 
             bdrv_reset_dirty(bmds->bs, sector, nr_sectors);
@@ -440,8 +440,8 @@
 error:
     monitor_printf(mon, "Error reading sector %" PRId64 "\n", sector);
     qemu_file_set_error(f);
-    qemu_free(blk->buf);
-    qemu_free(blk);
+    g_free(blk->buf);
+    g_free(blk);
     return 0;
 }
 
@@ -479,8 +479,8 @@
         blk_send(f, blk);
 
         QSIMPLEQ_REMOVE_HEAD(&block_mig_state.blk_list, entry);
-        qemu_free(blk->buf);
-        qemu_free(blk);
+        g_free(blk->buf);
+        g_free(blk);
 
         block_mig_state.read_done--;
         block_mig_state.transferred++;
@@ -541,14 +541,14 @@
         QSIMPLEQ_REMOVE_HEAD(&block_mig_state.bmds_list, entry);
         bdrv_set_in_use(bmds->bs, 0);
         drive_put_ref(drive_get_by_blockdev(bmds->bs));
-        qemu_free(bmds->aio_bitmap);
-        qemu_free(bmds);
+        g_free(bmds->aio_bitmap);
+        g_free(bmds);
     }
 
     while ((blk = QSIMPLEQ_FIRST(&block_mig_state.blk_list)) != NULL) {
         QSIMPLEQ_REMOVE_HEAD(&block_mig_state.blk_list, entry);
-        qemu_free(blk->buf);
-        qemu_free(blk);
+        g_free(blk->buf);
+        g_free(blk);
     }
 
     monitor_printf(mon, "\n");
@@ -683,12 +683,12 @@
                 nr_sectors = BDRV_SECTORS_PER_DIRTY_CHUNK;
             }
 
-            buf = qemu_malloc(BLOCK_SIZE);
+            buf = g_malloc(BLOCK_SIZE);
 
             qemu_get_buffer(f, buf, BLOCK_SIZE);
             ret = bdrv_write(bs, addr, buf, nr_sectors);
 
-            qemu_free(buf);
+            g_free(buf);
             if (ret < 0) {
                 return ret;
             }
diff --git a/block.c b/block.c
index 26910ca..785c88e 100644
--- a/block.c
+++ b/block.c
@@ -215,7 +215,7 @@
 {
     BlockDriverState *bs;
 
-    bs = qemu_mallocz(sizeof(BlockDriverState));
+    bs = g_malloc0(sizeof(BlockDriverState));
     pstrcpy(bs->device_name, sizeof(bs->device_name), device_name);
     if (device_name[0] != '\0') {
         QTAILQ_INSERT_TAIL(&bdrv_states, bs, list);
@@ -462,7 +462,7 @@
     }
 
     bs->drv = drv;
-    bs->opaque = qemu_mallocz(drv->instance_size);
+    bs->opaque = g_malloc0(drv->instance_size);
 
     if (flags & BDRV_O_CACHE_WB)
         bs->enable_write_cache = 1;
@@ -513,7 +513,7 @@
         bdrv_delete(bs->file);
         bs->file = NULL;
     }
-    qemu_free(bs->opaque);
+    g_free(bs->opaque);
     bs->opaque = NULL;
     bs->drv = NULL;
     return ret;
@@ -687,7 +687,7 @@
             bs->backing_hd = NULL;
         }
         bs->drv->bdrv_close(bs);
-        qemu_free(bs->opaque);
+        g_free(bs->opaque);
 #ifdef _WIN32
         if (bs->is_temporary) {
             unlink(bs->filename);
@@ -739,7 +739,7 @@
     }
 
     assert(bs != bs_snapshots);
-    qemu_free(bs);
+    g_free(bs);
 }
 
 int bdrv_attach(BlockDriverState *bs, DeviceState *qdev)
@@ -837,7 +837,7 @@
     }
 
     total_sectors = bdrv_getlength(bs) >> BDRV_SECTOR_BITS;
-    buf = qemu_malloc(COMMIT_BUF_SECTORS * BDRV_SECTOR_SIZE);
+    buf = g_malloc(COMMIT_BUF_SECTORS * BDRV_SECTOR_SIZE);
 
     for (sector = 0; sector < total_sectors; sector += n) {
         if (drv->bdrv_is_allocated(bs, sector, COMMIT_BUF_SECTORS, &n)) {
@@ -867,7 +867,7 @@
         bdrv_flush(bs->backing_hd);
 
 ro_cleanup:
-    qemu_free(buf);
+    g_free(buf);
 
     if (ro) {
         /* re-open as RO */
@@ -2275,7 +2275,7 @@
         set_dirty_bitmap(b->bs, b->sector_num, b->nb_sectors, 1);
     }
     b->cb(b->opaque, ret);
-    qemu_free(b);
+    g_free(b);
 }
 
 static BlockCompleteData *blk_dirty_cb_alloc(BlockDriverState *bs,
@@ -2284,7 +2284,7 @@
                                              BlockDriverCompletionFunc *cb,
                                              void *opaque)
 {
-    BlockCompleteData *blkdata = qemu_mallocz(sizeof(BlockCompleteData));
+    BlockCompleteData *blkdata = g_malloc0(sizeof(BlockCompleteData));
 
     blkdata->bs = bs;
     blkdata->cb = cb;
@@ -2356,7 +2356,7 @@
         if (mcb->callbacks[i].free_qiov) {
             qemu_iovec_destroy(mcb->callbacks[i].free_qiov);
         }
-        qemu_free(mcb->callbacks[i].free_qiov);
+        g_free(mcb->callbacks[i].free_qiov);
         qemu_vfree(mcb->callbacks[i].free_buf);
     }
 }
@@ -2374,7 +2374,7 @@
     mcb->num_requests--;
     if (mcb->num_requests == 0) {
         multiwrite_user_cb(mcb);
-        qemu_free(mcb);
+        g_free(mcb);
     }
 }
 
@@ -2434,7 +2434,7 @@
 
         if (merge) {
             size_t size;
-            QEMUIOVector *qiov = qemu_mallocz(sizeof(*qiov));
+            QEMUIOVector *qiov = g_malloc0(sizeof(*qiov));
             qemu_iovec_init(qiov,
                 reqs[outidx].qiov->niov + reqs[i].qiov->niov + 1);
 
@@ -2503,7 +2503,7 @@
     }
 
     // Create MultiwriteCB structure
-    mcb = qemu_mallocz(sizeof(*mcb) + num_reqs * sizeof(*mcb->callbacks));
+    mcb = g_malloc0(sizeof(*mcb) + num_reqs * sizeof(*mcb->callbacks));
     mcb->num_requests = 0;
     mcb->num_callbacks = num_reqs;
 
@@ -2568,7 +2568,7 @@
     for (i = 0; i < mcb->num_callbacks; i++) {
         reqs[i].error = -EIO;
     }
-    qemu_free(mcb);
+    g_free(mcb);
     return -1;
 }
 
@@ -2884,7 +2884,7 @@
         acb = pool->free_aiocb;
         pool->free_aiocb = acb->next;
     } else {
-        acb = qemu_mallocz(pool->aiocb_size);
+        acb = g_malloc0(pool->aiocb_size);
         acb->pool = pool;
     }
     acb->bs = bs;
@@ -3088,11 +3088,11 @@
                     BDRV_SECTORS_PER_DIRTY_CHUNK * 8 - 1;
             bitmap_size /= BDRV_SECTORS_PER_DIRTY_CHUNK * 8;
 
-            bs->dirty_bitmap = qemu_mallocz(bitmap_size);
+            bs->dirty_bitmap = g_malloc0(bitmap_size);
         }
     } else {
         if (bs->dirty_bitmap) {
-            qemu_free(bs->dirty_bitmap);
+            g_free(bs->dirty_bitmap);
             bs->dirty_bitmap = NULL;
         }
     }
diff --git a/block/blkdebug.c b/block/blkdebug.c
index cd9eb80..b3c5d42 100644
--- a/block/blkdebug.c
+++ b/block/blkdebug.c
@@ -214,7 +214,7 @@
     }
 
     /* Set attributes common for all actions */
-    rule = qemu_mallocz(sizeof(*rule));
+    rule = g_malloc0(sizeof(*rule));
     *rule = (struct BlkdebugRule) {
         .event  = event,
         .action = d->action,
@@ -392,7 +392,7 @@
     for (i = 0; i < BLKDBG_EVENT_MAX; i++) {
         QLIST_FOREACH_SAFE(rule, &s->rules[i], next, next) {
             QLIST_REMOVE(rule, next);
-            qemu_free(rule);
+            g_free(rule);
         }
     }
 }
diff --git a/block/bochs.c b/block/bochs.c
index 5fe2fa3..3c2f8d1 100644
--- a/block/bochs.c
+++ b/block/bochs.c
@@ -136,7 +136,7 @@
     }
 
     s->catalog_size = le32_to_cpu(bochs.extra.redolog.catalog);
-    s->catalog_bitmap = qemu_malloc(s->catalog_size * 4);
+    s->catalog_bitmap = g_malloc(s->catalog_size * 4);
     if (bdrv_pread(bs->file, le32_to_cpu(bochs.header), s->catalog_bitmap,
                    s->catalog_size * 4) != s->catalog_size * 4)
 	goto fail;
@@ -210,7 +210,7 @@
 static void bochs_close(BlockDriverState *bs)
 {
     BDRVBochsState *s = bs->opaque;
-    qemu_free(s->catalog_bitmap);
+    g_free(s->catalog_bitmap);
 }
 
 static BlockDriver bdrv_bochs = {
diff --git a/block/cloop.c b/block/cloop.c
index fe015c4..8cff9f2 100644
--- a/block/cloop.c
+++ b/block/cloop.c
@@ -70,7 +70,7 @@
 
     /* read offsets */
     offsets_size = s->n_blocks * sizeof(uint64_t);
-    s->offsets = qemu_malloc(offsets_size);
+    s->offsets = g_malloc(offsets_size);
     if (bdrv_pread(bs->file, 128 + 4 + 4, s->offsets, offsets_size) <
             offsets_size) {
 	goto cloop_close;
@@ -85,8 +85,8 @@
     }
 
     /* initialize zlib engine */
-    s->compressed_block = qemu_malloc(max_compressed_block_size+1);
-    s->uncompressed_block = qemu_malloc(s->block_size);
+    s->compressed_block = g_malloc(max_compressed_block_size+1);
+    s->uncompressed_block = g_malloc(s->block_size);
     if(inflateInit(&s->zstream) != Z_OK)
 	goto cloop_close;
     s->current_block=s->n_blocks;
diff --git a/block/curl.c b/block/curl.c
index 407f095..5c157bc 100644
--- a/block/curl.c
+++ b/block/curl.c
@@ -310,7 +310,7 @@
 
     static int inited = 0;
 
-    file = qemu_strdup(filename);
+    file = g_strdup(filename);
     s->readahead_size = READ_AHEAD_SIZE;
 
     /* Parse a trailing ":readahead=#:" param, if present. */
@@ -390,7 +390,7 @@
     curl_easy_cleanup(state->curl);
     state->curl = NULL;
 out_noclean:
-    qemu_free(file);
+    g_free(file);
     return -EINVAL;
 }
 
@@ -444,11 +444,11 @@
 
     state->buf_off = 0;
     if (state->orig_buf)
-        qemu_free(state->orig_buf);
+        g_free(state->orig_buf);
     state->buf_start = start;
     state->buf_len = acb->end + s->readahead_size;
     end = MIN(start + state->buf_len, s->len) - 1;
-    state->orig_buf = qemu_malloc(state->buf_len);
+    state->orig_buf = g_malloc(state->buf_len);
     state->acb[0] = acb;
 
     snprintf(state->range, 127, "%zd-%zd", start, end);
@@ -476,7 +476,7 @@
             s->states[i].curl = NULL;
         }
         if (s->states[i].orig_buf) {
-            qemu_free(s->states[i].orig_buf);
+            g_free(s->states[i].orig_buf);
             s->states[i].orig_buf = NULL;
         }
     }
diff --git a/block/dmg.c b/block/dmg.c
index a3c815b..64c3cce 100644
--- a/block/dmg.c
+++ b/block/dmg.c
@@ -127,11 +127,11 @@
 
 	    chunk_count = (count-204)/40;
 	    new_size = sizeof(uint64_t) * (s->n_chunks + chunk_count);
-	    s->types = qemu_realloc(s->types, new_size/2);
-	    s->offsets = qemu_realloc(s->offsets, new_size);
-	    s->lengths = qemu_realloc(s->lengths, new_size);
-	    s->sectors = qemu_realloc(s->sectors, new_size);
-	    s->sectorcounts = qemu_realloc(s->sectorcounts, new_size);
+	    s->types = g_realloc(s->types, new_size/2);
+	    s->offsets = g_realloc(s->offsets, new_size);
+	    s->lengths = g_realloc(s->lengths, new_size);
+	    s->sectors = g_realloc(s->sectors, new_size);
+	    s->sectorcounts = g_realloc(s->sectorcounts, new_size);
 
 	    for(i=s->n_chunks;i<s->n_chunks+chunk_count;i++) {
 		s->types[i] = read_uint32(bs, offset);
@@ -170,8 +170,8 @@
     }
 
     /* initialize zlib engine */
-    s->compressed_chunk = qemu_malloc(max_compressed_size+1);
-    s->uncompressed_chunk = qemu_malloc(512*max_sectors_per_chunk);
+    s->compressed_chunk = g_malloc(max_compressed_size+1);
+    s->uncompressed_chunk = g_malloc(512*max_sectors_per_chunk);
     if(inflateInit(&s->zstream) != Z_OK)
 	goto fail;
 
diff --git a/block/nbd.c b/block/nbd.c
index 7a52f62..55cb2fd 100644
--- a/block/nbd.c
+++ b/block/nbd.c
@@ -65,7 +65,7 @@
     const char *unixpath;
     int err = -EINVAL;
 
-    file = qemu_strdup(filename);
+    file = g_strdup(filename);
 
     export_name = strstr(file, EN_OPTSTR);
     if (export_name) {
@@ -74,7 +74,7 @@
         }
         export_name[0] = 0; /* truncate 'file' */
         export_name += strlen(EN_OPTSTR);
-        s->export_name = qemu_strdup(export_name);
+        s->export_name = g_strdup(export_name);
     }
 
     /* extract the host_spec - fail if it's not nbd:... */
@@ -87,18 +87,18 @@
         if (unixpath[0] != '/') { /* We demand  an absolute path*/
             goto out;
         }
-        s->host_spec = qemu_strdup(unixpath);
+        s->host_spec = g_strdup(unixpath);
     } else {
-        s->host_spec = qemu_strdup(host_spec);
+        s->host_spec = g_strdup(host_spec);
     }
 
     err = 0;
 
 out:
-    qemu_free(file);
+    g_free(file);
     if (err != 0) {
-        qemu_free(s->export_name);
-        qemu_free(s->host_spec);
+        g_free(s->export_name);
+        g_free(s->host_spec);
     }
     return err;
 }
@@ -240,8 +240,8 @@
 static void nbd_close(BlockDriverState *bs)
 {
     BDRVNBDState *s = bs->opaque;
-    qemu_free(s->export_name);
-    qemu_free(s->host_spec);
+    g_free(s->export_name);
+    g_free(s->host_spec);
 
     nbd_teardown_connection(bs);
 }
diff --git a/block/parallels.c b/block/parallels.c
index 35a14aa..37d151d 100644
--- a/block/parallels.c
+++ b/block/parallels.c
@@ -88,7 +88,7 @@
     s->tracks = le32_to_cpu(ph.tracks);
 
     s->catalog_size = le32_to_cpu(ph.catalog_entries);
-    s->catalog_bitmap = qemu_malloc(s->catalog_size * 4);
+    s->catalog_bitmap = g_malloc(s->catalog_size * 4);
     if (bdrv_pread(bs->file, 64, s->catalog_bitmap, s->catalog_size * 4) !=
 	s->catalog_size * 4)
 	goto fail;
@@ -98,7 +98,7 @@
     return 0;
 fail:
     if (s->catalog_bitmap)
-	qemu_free(s->catalog_bitmap);
+	g_free(s->catalog_bitmap);
     return -1;
 }
 
@@ -137,7 +137,7 @@
 static void parallels_close(BlockDriverState *bs)
 {
     BDRVParallelsState *s = bs->opaque;
-    qemu_free(s->catalog_bitmap);
+    g_free(s->catalog_bitmap);
 }
 
 static BlockDriver bdrv_parallels = {
diff --git a/block/qcow.c b/block/qcow.c
index 6447c2a..e155d3c 100644
--- a/block/qcow.c
+++ b/block/qcow.c
@@ -129,7 +129,7 @@
     s->l1_size = (header.size + (1LL << shift) - 1) >> shift;
 
     s->l1_table_offset = header.l1_table_offset;
-    s->l1_table = qemu_malloc(s->l1_size * sizeof(uint64_t));
+    s->l1_table = g_malloc(s->l1_size * sizeof(uint64_t));
     if (!s->l1_table)
         goto fail;
     if (bdrv_pread(bs->file, s->l1_table_offset, s->l1_table, s->l1_size * sizeof(uint64_t)) !=
@@ -139,13 +139,13 @@
         be64_to_cpus(&s->l1_table[i]);
     }
     /* alloc L2 cache */
-    s->l2_cache = qemu_malloc(s->l2_size * L2_CACHE_SIZE * sizeof(uint64_t));
+    s->l2_cache = g_malloc(s->l2_size * L2_CACHE_SIZE * sizeof(uint64_t));
     if (!s->l2_cache)
         goto fail;
-    s->cluster_cache = qemu_malloc(s->cluster_size);
+    s->cluster_cache = g_malloc(s->cluster_size);
     if (!s->cluster_cache)
         goto fail;
-    s->cluster_data = qemu_malloc(s->cluster_size);
+    s->cluster_data = g_malloc(s->cluster_size);
     if (!s->cluster_data)
         goto fail;
     s->cluster_cache_offset = -1;
@@ -162,10 +162,10 @@
     return 0;
 
  fail:
-    qemu_free(s->l1_table);
-    qemu_free(s->l2_cache);
-    qemu_free(s->cluster_cache);
-    qemu_free(s->cluster_data);
+    g_free(s->l1_table);
+    g_free(s->l2_cache);
+    g_free(s->cluster_cache);
+    g_free(s->cluster_data);
     return -1;
 }
 
@@ -687,7 +687,7 @@
     }
     if (s->crypt_method) {
         if (!acb->cluster_data) {
-            acb->cluster_data = qemu_mallocz(s->cluster_size);
+            acb->cluster_data = g_malloc0(s->cluster_size);
         }
         encrypt_sectors(s, acb->sector_num, acb->cluster_data, acb->buf,
                         acb->n, 1, &s->aes_encrypt_key);
@@ -738,10 +738,10 @@
 static void qcow_close(BlockDriverState *bs)
 {
     BDRVQcowState *s = bs->opaque;
-    qemu_free(s->l1_table);
-    qemu_free(s->l2_cache);
-    qemu_free(s->cluster_cache);
-    qemu_free(s->cluster_data);
+    g_free(s->l1_table);
+    g_free(s->l2_cache);
+    g_free(s->cluster_cache);
+    g_free(s->cluster_data);
 }
 
 static int qcow_create(const char *filename, QEMUOptionParameter *options)
@@ -869,7 +869,7 @@
     if (nb_sectors != s->cluster_sectors)
         return -EINVAL;
 
-    out_buf = qemu_malloc(s->cluster_size + (s->cluster_size / 1000) + 128);
+    out_buf = g_malloc(s->cluster_size + (s->cluster_size / 1000) + 128);
     if (!out_buf)
         return -1;
 
@@ -879,7 +879,7 @@
                        Z_DEFLATED, -12,
                        9, Z_DEFAULT_STRATEGY);
     if (ret != 0) {
-        qemu_free(out_buf);
+        g_free(out_buf);
         return -1;
     }
 
@@ -890,7 +890,7 @@
 
     ret = deflate(&strm, Z_FINISH);
     if (ret != Z_STREAM_END && ret != Z_OK) {
-        qemu_free(out_buf);
+        g_free(out_buf);
         deflateEnd(&strm);
         return -1;
     }
@@ -906,12 +906,12 @@
                                             out_len, 0, 0);
         cluster_offset &= s->cluster_offset_mask;
         if (bdrv_pwrite(bs->file, cluster_offset, out_buf, out_len) != out_len) {
-            qemu_free(out_buf);
+            g_free(out_buf);
             return -1;
         }
     }
 
-    qemu_free(out_buf);
+    g_free(out_buf);
     return 0;
 }
 
diff --git a/block/qcow2-cache.c b/block/qcow2-cache.c
index 8408847..340a6f2 100644
--- a/block/qcow2-cache.c
+++ b/block/qcow2-cache.c
@@ -49,9 +49,9 @@
     Qcow2Cache *c;
     int i;
 
-    c = qemu_mallocz(sizeof(*c));
+    c = g_malloc0(sizeof(*c));
     c->size = num_tables;
-    c->entries = qemu_mallocz(sizeof(*c->entries) * num_tables);
+    c->entries = g_malloc0(sizeof(*c->entries) * num_tables);
     c->writethrough = writethrough;
 
     for (i = 0; i < c->size; i++) {
@@ -70,8 +70,8 @@
         qemu_vfree(c->entries[i].table);
     }
 
-    qemu_free(c->entries);
-    qemu_free(c);
+    g_free(c->entries);
+    g_free(c);
 
     return 0;
 }
diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
index 81cf77d..9269dda 100644
--- a/block/qcow2-cluster.c
+++ b/block/qcow2-cluster.c
@@ -57,14 +57,14 @@
 #endif
 
     new_l1_size2 = sizeof(uint64_t) * new_l1_size;
-    new_l1_table = qemu_mallocz(align_offset(new_l1_size2, 512));
+    new_l1_table = g_malloc0(align_offset(new_l1_size2, 512));
     memcpy(new_l1_table, s->l1_table, s->l1_size * sizeof(uint64_t));
 
     /* write new table (align to cluster) */
     BLKDBG_EVENT(bs->file, BLKDBG_L1_GROW_ALLOC_TABLE);
     new_l1_table_offset = qcow2_alloc_clusters(bs, new_l1_size2);
     if (new_l1_table_offset < 0) {
-        qemu_free(new_l1_table);
+        g_free(new_l1_table);
         return new_l1_table_offset;
     }
 
@@ -90,14 +90,14 @@
     if (ret < 0) {
         goto fail;
     }
-    qemu_free(s->l1_table);
+    g_free(s->l1_table);
     qcow2_free_clusters(bs, s->l1_table_offset, s->l1_size * sizeof(uint64_t));
     s->l1_table_offset = new_l1_table_offset;
     s->l1_table = new_l1_table;
     s->l1_size = new_l1_size;
     return 0;
  fail:
-    qemu_free(new_l1_table);
+    g_free(new_l1_table);
     qcow2_free_clusters(bs, new_l1_table_offset, new_l1_size2);
     return ret;
 }
@@ -612,7 +612,7 @@
     if (m->nb_clusters == 0)
         return 0;
 
-    old_cluster = qemu_malloc(m->nb_clusters * sizeof(uint64_t));
+    old_cluster = g_malloc(m->nb_clusters * sizeof(uint64_t));
 
     /* copy content of unmodified sectors */
     start_sect = (m->offset & ~(s->cluster_size - 1)) >> 9;
@@ -683,7 +683,7 @@
 
     ret = 0;
 err:
-    qemu_free(old_cluster);
+    g_free(old_cluster);
     return ret;
  }
 
diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c
index 14b2f67..2a915be 100644
--- a/block/qcow2-refcount.c
+++ b/block/qcow2-refcount.c
@@ -41,7 +41,7 @@
     int ret, refcount_table_size2, i;
 
     refcount_table_size2 = s->refcount_table_size * sizeof(uint64_t);
-    s->refcount_table = qemu_malloc(refcount_table_size2);
+    s->refcount_table = g_malloc(refcount_table_size2);
     if (s->refcount_table_size > 0) {
         BLKDBG_EVENT(bs->file, BLKDBG_REFTABLE_LOAD);
         ret = bdrv_pread(bs->file, s->refcount_table_offset,
@@ -59,7 +59,7 @@
 void qcow2_refcount_close(BlockDriverState *bs)
 {
     BDRVQcowState *s = bs->opaque;
-    qemu_free(s->refcount_table);
+    g_free(s->refcount_table);
 }
 
 
@@ -323,8 +323,8 @@
     uint64_t meta_offset = (blocks_used * refcount_block_clusters) *
         s->cluster_size;
     uint64_t table_offset = meta_offset + blocks_clusters * s->cluster_size;
-    uint16_t *new_blocks = qemu_mallocz(blocks_clusters * s->cluster_size);
-    uint64_t *new_table = qemu_mallocz(table_size * sizeof(uint64_t));
+    uint16_t *new_blocks = g_malloc0(blocks_clusters * s->cluster_size);
+    uint64_t *new_table = g_malloc0(table_size * sizeof(uint64_t));
 
     assert(meta_offset >= (s->free_cluster_index * s->cluster_size));
 
@@ -349,7 +349,7 @@
     BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_ALLOC_WRITE_BLOCKS);
     ret = bdrv_pwrite_sync(bs->file, meta_offset, new_blocks,
         blocks_clusters * s->cluster_size);
-    qemu_free(new_blocks);
+    g_free(new_blocks);
     if (ret < 0) {
         goto fail_table;
     }
@@ -385,7 +385,7 @@
     uint64_t old_table_offset = s->refcount_table_offset;
     uint64_t old_table_size = s->refcount_table_size;
 
-    qemu_free(s->refcount_table);
+    g_free(s->refcount_table);
     s->refcount_table = new_table;
     s->refcount_table_size = table_size;
     s->refcount_table_offset = table_offset;
@@ -403,7 +403,7 @@
     return new_block;
 
 fail_table:
-    qemu_free(new_table);
+    g_free(new_table);
 fail_block:
     if (*refcount_block != NULL) {
         qcow2_cache_put(bs, s->refcount_block_cache, (void**) refcount_block);
@@ -720,7 +720,7 @@
     l1_size2 = l1_size * sizeof(uint64_t);
     if (l1_table_offset != s->l1_table_offset) {
         if (l1_size2 != 0) {
-            l1_table = qemu_mallocz(align_offset(l1_size2, 512));
+            l1_table = g_malloc0(align_offset(l1_size2, 512));
         } else {
             l1_table = NULL;
         }
@@ -847,7 +847,7 @@
             be64_to_cpus(&l1_table[i]);
     }
     if (l1_allocated)
-        qemu_free(l1_table);
+        g_free(l1_table);
     return ret;
 }
 
@@ -921,7 +921,7 @@
 
     /* Read L2 table from disk */
     l2_size = s->l2_size * sizeof(uint64_t);
-    l2_table = qemu_malloc(l2_size);
+    l2_table = g_malloc(l2_size);
 
     if (bdrv_pread(bs->file, l2_offset, l2_table, l2_size) != l2_size)
         goto fail;
@@ -979,12 +979,12 @@
         }
     }
 
-    qemu_free(l2_table);
+    g_free(l2_table);
     return 0;
 
 fail:
     fprintf(stderr, "ERROR: I/O error in check_refcounts_l2\n");
-    qemu_free(l2_table);
+    g_free(l2_table);
     return -EIO;
 }
 
@@ -1017,7 +1017,7 @@
     if (l1_size2 == 0) {
         l1_table = NULL;
     } else {
-        l1_table = qemu_malloc(l1_size2);
+        l1_table = g_malloc(l1_size2);
         if (bdrv_pread(bs->file, l1_table_offset,
                        l1_table, l1_size2) != l1_size2)
             goto fail;
@@ -1065,13 +1065,13 @@
             }
         }
     }
-    qemu_free(l1_table);
+    g_free(l1_table);
     return 0;
 
 fail:
     fprintf(stderr, "ERROR: I/O error in check_refcounts_l1\n");
     res->check_errors++;
-    qemu_free(l1_table);
+    g_free(l1_table);
     return -EIO;
 }
 
@@ -1092,7 +1092,7 @@
 
     size = bdrv_getlength(bs->file);
     nb_clusters = size_to_clusters(s, size);
-    refcount_table = qemu_mallocz(nb_clusters * sizeof(uint16_t));
+    refcount_table = g_malloc0(nb_clusters * sizeof(uint16_t));
 
     /* header */
     inc_refcounts(bs, res, refcount_table, nb_clusters,
@@ -1178,7 +1178,7 @@
     ret = 0;
 
 fail:
-    qemu_free(refcount_table);
+    g_free(refcount_table);
 
     return ret;
 }
diff --git a/block/qcow2-snapshot.c b/block/qcow2-snapshot.c
index e32bcf0..3bd2a30 100644
--- a/block/qcow2-snapshot.c
+++ b/block/qcow2-snapshot.c
@@ -52,10 +52,10 @@
     int i;
 
     for(i = 0; i < s->nb_snapshots; i++) {
-        qemu_free(s->snapshots[i].name);
-        qemu_free(s->snapshots[i].id_str);
+        g_free(s->snapshots[i].name);
+        g_free(s->snapshots[i].id_str);
     }
-    qemu_free(s->snapshots);
+    g_free(s->snapshots);
     s->snapshots = NULL;
     s->nb_snapshots = 0;
 }
@@ -76,7 +76,7 @@
     }
 
     offset = s->snapshots_offset;
-    s->snapshots = qemu_mallocz(s->nb_snapshots * sizeof(QCowSnapshot));
+    s->snapshots = g_malloc0(s->nb_snapshots * sizeof(QCowSnapshot));
     for(i = 0; i < s->nb_snapshots; i++) {
         offset = align_offset(offset, 8);
         if (bdrv_pread(bs->file, offset, &h, sizeof(h)) != sizeof(h))
@@ -96,13 +96,13 @@
 
         offset += extra_data_size;
 
-        sn->id_str = qemu_malloc(id_str_size + 1);
+        sn->id_str = g_malloc(id_str_size + 1);
         if (bdrv_pread(bs->file, offset, sn->id_str, id_str_size) != id_str_size)
             goto fail;
         offset += id_str_size;
         sn->id_str[id_str_size] = '\0';
 
-        sn->name = qemu_malloc(name_size + 1);
+        sn->name = g_malloc(name_size + 1);
         if (bdrv_pread(bs->file, offset, sn->name, name_size) != name_size)
             goto fail;
         offset += name_size;
@@ -252,10 +252,10 @@
     if (find_snapshot_by_id(bs, sn_info->id_str) >= 0)
         return -ENOENT;
 
-    sn->id_str = qemu_strdup(sn_info->id_str);
+    sn->id_str = g_strdup(sn_info->id_str);
     if (!sn->id_str)
         goto fail;
-    sn->name = qemu_strdup(sn_info->name);
+    sn->name = g_strdup(sn_info->name);
     if (!sn->name)
         goto fail;
     sn->vm_state_size = sn_info->vm_state_size;
@@ -278,7 +278,7 @@
     sn->l1_size = s->l1_size;
 
     if (s->l1_size != 0) {
-        l1_table = qemu_malloc(s->l1_size * sizeof(uint64_t));
+        l1_table = g_malloc(s->l1_size * sizeof(uint64_t));
     } else {
         l1_table = NULL;
     }
@@ -289,13 +289,13 @@
     if (bdrv_pwrite_sync(bs->file, sn->l1_table_offset,
                     l1_table, s->l1_size * sizeof(uint64_t)) < 0)
         goto fail;
-    qemu_free(l1_table);
+    g_free(l1_table);
     l1_table = NULL;
 
-    snapshots1 = qemu_malloc((s->nb_snapshots + 1) * sizeof(QCowSnapshot));
+    snapshots1 = g_malloc((s->nb_snapshots + 1) * sizeof(QCowSnapshot));
     if (s->snapshots) {
         memcpy(snapshots1, s->snapshots, s->nb_snapshots * sizeof(QCowSnapshot));
-        qemu_free(s->snapshots);
+        g_free(s->snapshots);
     }
     s->snapshots = snapshots1;
     s->snapshots[s->nb_snapshots++] = *sn;
@@ -307,8 +307,8 @@
 #endif
     return 0;
  fail:
-    qemu_free(sn->name);
-    qemu_free(l1_table);
+    g_free(sn->name);
+    g_free(l1_table);
     return -1;
 }
 
@@ -380,8 +380,8 @@
         return ret;
     qcow2_free_clusters(bs, sn->l1_table_offset, sn->l1_size * sizeof(uint64_t));
 
-    qemu_free(sn->id_str);
-    qemu_free(sn->name);
+    g_free(sn->id_str);
+    g_free(sn->name);
     memmove(sn, sn + 1, (s->nb_snapshots - snapshot_index - 1) * sizeof(*sn));
     s->nb_snapshots--;
     ret = qcow2_write_snapshots(bs);
@@ -407,7 +407,7 @@
         return s->nb_snapshots;
     }
 
-    sn_tab = qemu_mallocz(s->nb_snapshots * sizeof(QEMUSnapshotInfo));
+    sn_tab = g_malloc0(s->nb_snapshots * sizeof(QEMUSnapshotInfo));
     for(i = 0; i < s->nb_snapshots; i++) {
         sn_info = sn_tab + i;
         sn = s->snapshots + i;
@@ -439,11 +439,11 @@
     s->l1_size = sn->l1_size;
     l1_size2 = s->l1_size * sizeof(uint64_t);
     if (s->l1_table != NULL) {
-        qemu_free(s->l1_table);
+        g_free(s->l1_table);
     }
 
     s->l1_table_offset = sn->l1_table_offset;
-    s->l1_table = qemu_mallocz(align_offset(l1_size2, 512));
+    s->l1_table = g_malloc0(align_offset(l1_size2, 512));
 
     if (bdrv_pread(bs->file, sn->l1_table_offset,
                    s->l1_table, l1_size2) != l1_size2) {
diff --git a/block/qcow2.c b/block/qcow2.c
index f07d550..bfff6cd 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -216,7 +216,7 @@
     }
     s->l1_table_offset = header.l1_table_offset;
     if (s->l1_size > 0) {
-        s->l1_table = qemu_mallocz(
+        s->l1_table = g_malloc0(
             align_offset(s->l1_size * sizeof(uint64_t), 512));
         ret = bdrv_pread(bs->file, s->l1_table_offset, s->l1_table,
                          s->l1_size * sizeof(uint64_t));
@@ -234,9 +234,9 @@
     s->refcount_block_cache = qcow2_cache_create(bs, REFCOUNT_CACHE_SIZE,
         writethrough);
 
-    s->cluster_cache = qemu_malloc(s->cluster_size);
+    s->cluster_cache = g_malloc(s->cluster_size);
     /* one more sector for decompressed data alignment */
-    s->cluster_data = qemu_malloc(QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size
+    s->cluster_data = g_malloc(QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size
                                   + 512);
     s->cluster_cache_offset = -1;
 
@@ -287,12 +287,12 @@
  fail:
     qcow2_free_snapshots(bs);
     qcow2_refcount_close(bs);
-    qemu_free(s->l1_table);
+    g_free(s->l1_table);
     if (s->l2_table_cache) {
         qcow2_cache_destroy(bs, s->l2_table_cache);
     }
-    qemu_free(s->cluster_cache);
-    qemu_free(s->cluster_data);
+    g_free(s->cluster_cache);
+    g_free(s->cluster_data);
     return ret;
 }
 
@@ -501,7 +501,7 @@
              */
             if (!acb->cluster_data) {
                 acb->cluster_data =
-                    qemu_mallocz(QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
+                    g_malloc0(QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
             }
 
             assert(acb->cur_nr_sectors <=
@@ -636,7 +636,7 @@
 
     if (s->crypt_method) {
         if (!acb->cluster_data) {
-            acb->cluster_data = qemu_mallocz(QCOW_MAX_CRYPT_CLUSTERS *
+            acb->cluster_data = g_malloc0(QCOW_MAX_CRYPT_CLUSTERS *
                                              s->cluster_size);
         }
 
@@ -691,7 +691,7 @@
 static void qcow2_close(BlockDriverState *bs)
 {
     BDRVQcowState *s = bs->opaque;
-    qemu_free(s->l1_table);
+    g_free(s->l1_table);
 
     qcow2_cache_flush(bs, s->l2_table_cache);
     qcow2_cache_flush(bs, s->refcount_block_cache);
@@ -699,8 +699,8 @@
     qcow2_cache_destroy(bs, s->l2_table_cache);
     qcow2_cache_destroy(bs, s->refcount_block_cache);
 
-    qemu_free(s->cluster_cache);
-    qemu_free(s->cluster_data);
+    g_free(s->cluster_cache);
+    g_free(s->cluster_data);
     qcow2_refcount_close(bs);
 }
 
@@ -923,9 +923,9 @@
     }
 
     /* Write an empty refcount table */
-    refcount_table = qemu_mallocz(cluster_size);
+    refcount_table = g_malloc0(cluster_size);
     ret = bdrv_pwrite(bs, cluster_size, refcount_table, cluster_size);
-    qemu_free(refcount_table);
+    g_free(refcount_table);
 
     if (ret < 0) {
         goto out;
@@ -1117,7 +1117,7 @@
     if (nb_sectors != s->cluster_sectors)
         return -EINVAL;
 
-    out_buf = qemu_malloc(s->cluster_size + (s->cluster_size / 1000) + 128);
+    out_buf = g_malloc(s->cluster_size + (s->cluster_size / 1000) + 128);
 
     /* best compression, small window, no zlib header */
     memset(&strm, 0, sizeof(strm));
@@ -1125,7 +1125,7 @@
                        Z_DEFLATED, -12,
                        9, Z_DEFAULT_STRATEGY);
     if (ret != 0) {
-        qemu_free(out_buf);
+        g_free(out_buf);
         return -1;
     }
 
@@ -1136,7 +1136,7 @@
 
     ret = deflate(&strm, Z_FINISH);
     if (ret != Z_STREAM_END && ret != Z_OK) {
-        qemu_free(out_buf);
+        g_free(out_buf);
         deflateEnd(&strm);
         return -1;
     }
@@ -1155,12 +1155,12 @@
         cluster_offset &= s->cluster_offset_mask;
         BLKDBG_EVENT(bs->file, BLKDBG_WRITE_COMPRESSED);
         if (bdrv_pwrite(bs->file, cluster_offset, out_buf, out_len) != out_len) {
-            qemu_free(out_buf);
+            g_free(out_buf);
             return -1;
         }
     }
 
-    qemu_free(out_buf);
+    g_free(out_buf);
     return 0;
 }
 
diff --git a/block/qed-check.c b/block/qed-check.c
index 22cd07f..e4a49ce 100644
--- a/block/qed-check.c
+++ b/block/qed-check.c
@@ -197,7 +197,7 @@
     };
     int ret;
 
-    check.used_clusters = qemu_mallocz(((check.nclusters + 31) / 32) *
+    check.used_clusters = g_malloc0(((check.nclusters + 31) / 32) *
                                        sizeof(check.used_clusters[0]));
 
     ret = qed_check_l1_table(&check, s->l1_table);
@@ -206,6 +206,6 @@
         qed_check_for_leaks(&check);
     }
 
-    qemu_free(check.used_clusters);
+    g_free(check.used_clusters);
     return ret;
 }
diff --git a/block/qed-cluster.c b/block/qed-cluster.c
index 3e19ad1..f64b2af 100644
--- a/block/qed-cluster.c
+++ b/block/qed-cluster.c
@@ -108,7 +108,7 @@
 
 out:
     find_cluster_cb->cb(find_cluster_cb->opaque, ret, offset, len);
-    qemu_free(find_cluster_cb);
+    g_free(find_cluster_cb);
 }
 
 /**
@@ -152,7 +152,7 @@
         return;
     }
 
-    find_cluster_cb = qemu_malloc(sizeof(*find_cluster_cb));
+    find_cluster_cb = g_malloc(sizeof(*find_cluster_cb));
     find_cluster_cb->s = s;
     find_cluster_cb->pos = pos;
     find_cluster_cb->len = len;
diff --git a/block/qed-gencb.c b/block/qed-gencb.c
index 1513dc6..7d7ac1f 100644
--- a/block/qed-gencb.c
+++ b/block/qed-gencb.c
@@ -15,7 +15,7 @@
 
 void *gencb_alloc(size_t len, BlockDriverCompletionFunc *cb, void *opaque)
 {
-    GenericCB *gencb = qemu_malloc(len);
+    GenericCB *gencb = g_malloc(len);
     gencb->cb = cb;
     gencb->opaque = opaque;
     return gencb;
@@ -27,6 +27,6 @@
     BlockDriverCompletionFunc *cb = gencb->cb;
     void *user_opaque = gencb->opaque;
 
-    qemu_free(gencb);
+    g_free(gencb);
     cb(user_opaque, ret);
 }
diff --git a/block/qed-l2-cache.c b/block/qed-l2-cache.c
index 57518a4..02b81a2 100644
--- a/block/qed-l2-cache.c
+++ b/block/qed-l2-cache.c
@@ -74,7 +74,7 @@
 
     QTAILQ_FOREACH_SAFE(entry, &l2_cache->entries, node, next_entry) {
         qemu_vfree(entry->table);
-        qemu_free(entry);
+        g_free(entry);
     }
 }
 
@@ -89,7 +89,7 @@
 {
     CachedL2Table *entry;
 
-    entry = qemu_mallocz(sizeof(*entry));
+    entry = g_malloc0(sizeof(*entry));
     entry->ref++;
 
     trace_qed_alloc_l2_cache_entry(l2_cache, entry);
@@ -111,7 +111,7 @@
     trace_qed_unref_l2_cache_entry(entry, entry->ref);
     if (entry->ref == 0) {
         qemu_vfree(entry->table);
-        qemu_free(entry);
+        g_free(entry);
     }
 }
 
diff --git a/block/qed.c b/block/qed.c
index 333f067..624e261 100644
--- a/block/qed.c
+++ b/block/qed.c
@@ -595,7 +595,7 @@
         goto out;
     }
 
-    l1_table = qemu_mallocz(l1_size);
+    l1_table = g_malloc0(l1_size);
     ret = bdrv_pwrite(bs, header.l1_table_offset, l1_table, l1_size);
     if (ret < 0) {
         goto out;
@@ -603,7 +603,7 @@
 
     ret = 0; /* success */
 out:
-    qemu_free(l1_table);
+    g_free(l1_table);
     bdrv_delete(bs);
     return ret;
 }
@@ -1419,7 +1419,7 @@
     }
 
     /* Prepare new header */
-    buffer = qemu_malloc(buffer_len);
+    buffer = g_malloc(buffer_len);
 
     qed_header_cpu_to_le(&new_header, &le_header);
     memcpy(buffer, &le_header, sizeof(le_header));
@@ -1430,7 +1430,7 @@
 
     /* Write new header */
     ret = bdrv_pwrite_sync(bs->file, 0, buffer, buffer_len);
-    qemu_free(buffer);
+    g_free(buffer);
     if (ret == 0) {
         memcpy(&s->header, &new_header, sizeof(new_header));
     }
diff --git a/block/raw.c b/block/raw.c
index cb6203e..555db4f 100644
--- a/block/raw.c
+++ b/block/raw.c
@@ -119,7 +119,7 @@
 static BlockDriver bdrv_raw = {
     .format_name        = "raw",
 
-    /* It's really 0, but we need to make qemu_malloc() happy */
+    /* It's really 0, but we need to make g_malloc() happy */
     .instance_size      = 1,
 
     .bdrv_open          = raw_open,
diff --git a/block/rbd.c b/block/rbd.c
index d5659cd..ce0f6ef 100644
--- a/block/rbd.c
+++ b/block/rbd.c
@@ -138,7 +138,7 @@
         return -EINVAL;
     }
 
-    buf = qemu_strdup(start);
+    buf = g_strdup(start);
     p = buf;
     *snap = '\0';
     *conf = '\0';
@@ -165,7 +165,7 @@
     ret = qemu_rbd_next_tok(conf, conf_len, p, '\0', "configuration", &p);
 
 done:
-    qemu_free(buf);
+    g_free(buf);
     return ret;
 }
 
@@ -176,7 +176,7 @@
     char value[RBD_MAX_CONF_VAL_SIZE];
     int ret = 0;
 
-    buf = qemu_strdup(conf);
+    buf = g_strdup(conf);
     p = buf;
 
     while (p) {
@@ -214,7 +214,7 @@
         }
     }
 
-    qemu_free(buf);
+    g_free(buf);
     return ret;
 }
 
@@ -341,7 +341,7 @@
     acb->bh = qemu_bh_new(rbd_aio_bh_cb, acb);
     qemu_bh_schedule(acb->bh);
 done:
-    qemu_free(rcb);
+    g_free(rcb);
 }
 
 /*
@@ -395,7 +395,7 @@
     }
     s->snap = NULL;
     if (snap_buf[0] != '\0') {
-        s->snap = qemu_strdup(snap_buf);
+        s->snap = g_strdup(snap_buf);
     }
 
     r = rados_create(&s->cluster, NULL);
@@ -478,7 +478,7 @@
 
     rbd_close(s->image);
     rados_ioctx_destroy(s->io_ctx);
-    qemu_free(s->snap);
+    g_free(s->snap);
     rados_shutdown(s->cluster);
 }
 
@@ -544,7 +544,7 @@
     ret = qemu_rbd_send_pipe(rcb->s, rcb);
     if (ret < 0) {
         error_report("failed writing to acb->s->fds");
-        qemu_free(rcb);
+        g_free(rcb);
     }
 }
 
@@ -605,7 +605,7 @@
 
     s->qemu_aio_count++; /* All the RADOSCB */
 
-    rcb = qemu_malloc(sizeof(RADOSCB));
+    rcb = g_malloc(sizeof(RADOSCB));
     rcb->done = 0;
     rcb->acb = acb;
     rcb->buf = buf;
@@ -629,7 +629,7 @@
     return &acb->common;
 
 failed:
-    qemu_free(rcb);
+    g_free(rcb);
     s->qemu_aio_count--;
     qemu_aio_release(acb);
     return NULL;
@@ -739,10 +739,10 @@
     int max_snaps = RBD_MAX_SNAPS;
 
     do {
-        snaps = qemu_malloc(sizeof(*snaps) * max_snaps);
+        snaps = g_malloc(sizeof(*snaps) * max_snaps);
         snap_count = rbd_snap_list(s->image, snaps, &max_snaps);
         if (snap_count < 0) {
-            qemu_free(snaps);
+            g_free(snaps);
         }
     } while (snap_count == -ERANGE);
 
@@ -750,7 +750,7 @@
         return snap_count;
     }
 
-    sn_tab = qemu_mallocz(snap_count * sizeof(QEMUSnapshotInfo));
+    sn_tab = g_malloc0(snap_count * sizeof(QEMUSnapshotInfo));
 
     for (i = 0; i < snap_count; i++) {
         const char *snap_name = snaps[i].name;
diff --git a/block/sheepdog.c b/block/sheepdog.c
index e150ac0..57b6e1a 100644
--- a/block/sheepdog.c
+++ b/block/sheepdog.c
@@ -368,7 +368,7 @@
 {
     AIOReq *aio_req;
 
-    aio_req = qemu_malloc(sizeof(*aio_req));
+    aio_req = g_malloc(sizeof(*aio_req));
     aio_req->aiocb = acb;
     aio_req->iov_offset = iov_offset;
     aio_req->oid = oid;
@@ -390,7 +390,7 @@
     SheepdogAIOCB *acb = aio_req->aiocb;
     QLIST_REMOVE(aio_req, outstanding_aio_siblings);
     QLIST_REMOVE(aio_req, aioreq_siblings);
-    qemu_free(aio_req);
+    g_free(aio_req);
 
     return !QLIST_EMPTY(&acb->aioreq_head);
 }
@@ -470,7 +470,7 @@
     for (i = 0; i < msg->msg_iovlen; i++) {
         size += msg->msg_iov[i].iov_len;
     }
-    buf = qemu_malloc(size);
+    buf = g_malloc(size);
 
     p = buf;
     for (i = 0; i < msg->msg_iovlen; i++) {
@@ -480,7 +480,7 @@
 
     ret = send(s, buf, size, flags);
 
-    qemu_free(buf);
+    g_free(buf);
     return ret;
 }
 
@@ -494,7 +494,7 @@
     for (i = 0; i < msg->msg_iovlen; i++) {
         size += msg->msg_iov[i].iov_len;
     }
-    buf = qemu_malloc(size);
+    buf = g_malloc(size);
 
     ret = qemu_recv(s, buf, size, flags);
     if (ret < 0) {
@@ -507,7 +507,7 @@
         p += msg->msg_iov[i].iov_len;
     }
 out:
-    qemu_free(buf);
+    g_free(buf);
     return ret;
 }
 
@@ -952,7 +952,7 @@
     char *p, *q;
     int nr_sep;
 
-    p = q = qemu_strdup(filename);
+    p = q = g_strdup(filename);
 
     /* count the number of separators */
     nr_sep = 0;
@@ -992,7 +992,7 @@
     }
 
     if (s->addr == NULL) {
-        qemu_free(q);
+        g_free(q);
     }
 
     return 0;
@@ -1210,7 +1210,7 @@
         goto out;
     }
 
-    buf = qemu_malloc(SD_INODE_SIZE);
+    buf = g_malloc(SD_INODE_SIZE);
     ret = read_object(fd, buf, vid_to_vdi_oid(vid), 0, SD_INODE_SIZE, 0);
 
     closesocket(fd);
@@ -1225,14 +1225,14 @@
 
     bs->total_sectors = s->inode.vdi_size / SECTOR_SIZE;
     strncpy(s->name, vdi, sizeof(s->name));
-    qemu_free(buf);
+    g_free(buf);
     return 0;
 out:
     qemu_aio_set_fd_handler(s->fd, NULL, NULL, NULL, NULL, NULL);
     if (s->fd >= 0) {
         closesocket(s->fd);
     }
-    qemu_free(buf);
+    g_free(buf);
     return -1;
 }
 
@@ -1291,7 +1291,7 @@
     BlockDriverState *bs = NULL;
     uint32_t idx, max_idx;
     int64_t vdi_size;
-    void *buf = qemu_mallocz(SD_DATA_OBJ_SIZE);
+    void *buf = g_malloc0(SD_DATA_OBJ_SIZE);
     int ret;
 
     ret = bdrv_file_open(&bs, filename, BDRV_O_RDWR);
@@ -1324,7 +1324,7 @@
     if (bs) {
         bdrv_delete(bs);
     }
-    qemu_free(buf);
+    g_free(buf);
 
     return ret;
 }
@@ -1444,7 +1444,7 @@
 
     qemu_aio_set_fd_handler(s->fd, NULL, NULL, NULL, NULL, NULL);
     closesocket(s->fd);
-    qemu_free(s->addr);
+    g_free(s->addr);
 }
 
 static int64_t sd_getlength(BlockDriverState *bs)
@@ -1542,7 +1542,7 @@
 
     dprintf("%" PRIx32 " is snapshot.\n", s->inode.vdi_id);
 
-    buf = qemu_malloc(SD_INODE_SIZE);
+    buf = g_malloc(SD_INODE_SIZE);
 
     ret = do_sd_create(s->name, s->inode.vdi_size, s->inode.vdi_id, &vid, 1,
                        s->addr, s->port);
@@ -1574,7 +1574,7 @@
     dprintf("%" PRIx32 " was newly created.\n", s->inode.vdi_id);
 
 out:
-    qemu_free(buf);
+    g_free(buf);
 
     return ret;
 }
@@ -1786,7 +1786,7 @@
         goto cleanup;
     }
 
-    inode = (SheepdogInode *)qemu_malloc(datalen);
+    inode = (SheepdogInode *)g_malloc(datalen);
 
     ret = read_object(fd, (char *)inode, vid_to_vdi_oid(new_vid),
                       s->inode.nr_copies, datalen, 0);
@@ -1816,7 +1816,7 @@
     uint32_t snapid = 0;
     int ret = -ENOENT, fd;
 
-    old_s = qemu_malloc(sizeof(BDRVSheepdogState));
+    old_s = g_malloc(sizeof(BDRVSheepdogState));
 
     memcpy(old_s, s, sizeof(BDRVSheepdogState));
 
@@ -1842,7 +1842,7 @@
         goto out;
     }
 
-    buf = qemu_malloc(SD_INODE_SIZE);
+    buf = g_malloc(SD_INODE_SIZE);
     ret = read_object(fd, buf, vid_to_vdi_oid(vid), s->inode.nr_copies,
                       SD_INODE_SIZE, 0);
 
@@ -1863,15 +1863,15 @@
 
     s->is_snapshot = 1;
 
-    qemu_free(buf);
-    qemu_free(old_s);
+    g_free(buf);
+    g_free(old_s);
 
     return 0;
 out:
     /* recover bdrv_sd_state */
     memcpy(s, old_s, sizeof(BDRVSheepdogState));
-    qemu_free(buf);
-    qemu_free(old_s);
+    g_free(buf);
+    g_free(old_s);
 
     error_report("failed to open. recover old bdrv_sd_state.");
 
@@ -1898,7 +1898,7 @@
     uint64_t hval;
     uint32_t vid;
 
-    vdi_inuse = qemu_malloc(max);
+    vdi_inuse = g_malloc(max);
 
     fd = connect_to_sdog(s->addr, s->port);
     if (fd < 0) {
@@ -1920,7 +1920,7 @@
         goto out;
     }
 
-    sn_tab = qemu_mallocz(nr * sizeof(*sn_tab));
+    sn_tab = g_malloc0(nr * sizeof(*sn_tab));
 
     /* calculate a vdi id with hash function */
     hval = fnv_64a_buf(s->name, strlen(s->name), FNV1A_64_INIT);
@@ -1963,7 +1963,7 @@
 out:
     *psn_tab = sn_tab;
 
-    qemu_free(vdi_inuse);
+    g_free(vdi_inuse);
 
     return found;
 }
diff --git a/block/vdi.c b/block/vdi.c
index 261cf9b..1d5ad2b 100644
--- a/block/vdi.c
+++ b/block/vdi.c
@@ -301,7 +301,7 @@
     uint32_t *bmap;
     logout("\n");
 
-    bmap = qemu_malloc(s->header.blocks_in_image * sizeof(uint32_t));
+    bmap = g_malloc(s->header.blocks_in_image * sizeof(uint32_t));
     memset(bmap, 0xff, s->header.blocks_in_image * sizeof(uint32_t));
 
     /* Check block map and value of blocks_allocated. */
@@ -331,7 +331,7 @@
         res->corruptions++;
     }
 
-    qemu_free(bmap);
+    g_free(bmap);
 
     return 0;
 }
@@ -443,7 +443,7 @@
     bmap_size = header.blocks_in_image * sizeof(uint32_t);
     bmap_size = (bmap_size + SECTOR_SIZE - 1) / SECTOR_SIZE;
     if (bmap_size > 0) {
-        s->bmap = qemu_malloc(bmap_size * SECTOR_SIZE);
+        s->bmap = g_malloc(bmap_size * SECTOR_SIZE);
     }
     if (bdrv_read(bs->file, s->bmap_sector, (uint8_t *)s->bmap, bmap_size) < 0) {
         goto fail_free_bmap;
@@ -452,7 +452,7 @@
     return 0;
 
  fail_free_bmap:
-    qemu_free(s->bmap);
+    g_free(s->bmap);
 
  fail:
     return -1;
@@ -704,7 +704,7 @@
             uint64_t offset;
             uint32_t bmap_first;
             uint32_t bmap_last;
-            qemu_free(acb->block_buffer);
+            g_free(acb->block_buffer);
             acb->block_buffer = NULL;
             bmap_first = acb->bmap_first;
             bmap_last = acb->bmap_last;
@@ -760,7 +760,7 @@
                  (uint64_t)bmap_entry * s->block_sectors;
         block = acb->block_buffer;
         if (block == NULL) {
-            block = qemu_mallocz(s->block_size);
+            block = g_malloc0(s->block_size);
             acb->block_buffer = block;
             acb->bmap_first = block_index;
             assert(!acb->header_modified);
@@ -906,7 +906,7 @@
 
     bmap = NULL;
     if (bmap_size > 0) {
-        bmap = (uint32_t *)qemu_mallocz(bmap_size);
+        bmap = (uint32_t *)g_malloc0(bmap_size);
     }
     for (i = 0; i < blocks; i++) {
         if (image_type == VDI_TYPE_STATIC) {
@@ -918,7 +918,7 @@
     if (write(fd, bmap, bmap_size) < 0) {
         result = -errno;
     }
-    qemu_free(bmap);
+    g_free(bmap);
     if (image_type == VDI_TYPE_STATIC) {
         if (ftruncate(fd, sizeof(header) + bmap_size + blocks * block_size)) {
             result = -errno;
diff --git a/block/vmdk.c b/block/vmdk.c
index 37478d2..8da87ac 100644
--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -167,11 +167,11 @@
     BDRVVmdkState *s = bs->opaque;
 
     for (i = 0; i < s->num_extents; i++) {
-        qemu_free(s->extents[i].l1_table);
-        qemu_free(s->extents[i].l2_cache);
-        qemu_free(s->extents[i].l1_backup_table);
+        g_free(s->extents[i].l1_table);
+        g_free(s->extents[i].l2_cache);
+        g_free(s->extents[i].l1_backup_table);
     }
-    qemu_free(s->extents);
+    g_free(s->extents);
 }
 
 static uint32_t vmdk_read_cid(BlockDriverState *bs, int parent)
@@ -289,7 +289,7 @@
     VmdkExtent *extent;
     BDRVVmdkState *s = bs->opaque;
 
-    s->extents = qemu_realloc(s->extents,
+    s->extents = g_realloc(s->extents,
                               (s->num_extents + 1) * sizeof(VmdkExtent));
     extent = &s->extents[s->num_extents];
     s->num_extents++;
@@ -321,7 +321,7 @@
 
     /* read the L1 table */
     l1_size = extent->l1_size * sizeof(uint32_t);
-    extent->l1_table = qemu_malloc(l1_size);
+    extent->l1_table = g_malloc(l1_size);
     ret = bdrv_pread(extent->file,
                     extent->l1_table_offset,
                     extent->l1_table,
@@ -334,7 +334,7 @@
     }
 
     if (extent->l1_backup_table_offset) {
-        extent->l1_backup_table = qemu_malloc(l1_size);
+        extent->l1_backup_table = g_malloc(l1_size);
         ret = bdrv_pread(extent->file,
                         extent->l1_backup_table_offset,
                         extent->l1_backup_table,
@@ -348,12 +348,12 @@
     }
 
     extent->l2_cache =
-        qemu_malloc(extent->l2_size * L2_CACHE_SIZE * sizeof(uint32_t));
+        g_malloc(extent->l2_size * L2_CACHE_SIZE * sizeof(uint32_t));
     return 0;
  fail_l1b:
-    qemu_free(extent->l1_backup_table);
+    g_free(extent->l1_backup_table);
  fail_l1:
-    qemu_free(extent->l1_table);
+    g_free(extent->l1_table);
     return ret;
 }
 
@@ -564,7 +564,7 @@
 
     /* try to open parent images, if exist */
     if (vmdk_parent_open(bs)) {
-        qemu_free(s->extents);
+        g_free(s->extents);
         return -EINVAL;
     }
     s->parent_cid = vmdk_read_cid(bs, 1);
diff --git a/block/vpc.c b/block/vpc.c
index fdd5236..cb6c570 100644
--- a/block/vpc.c
+++ b/block/vpc.c
@@ -196,7 +196,7 @@
     s->bitmap_size = ((s->block_size / (8 * 512)) + 511) & ~511;
 
     s->max_table_entries = be32_to_cpu(dyndisk_header->max_table_entries);
-    s->pagetable = qemu_malloc(s->max_table_entries * 4);
+    s->pagetable = g_malloc(s->max_table_entries * 4);
 
     s->bat_offset = be64_to_cpu(dyndisk_header->table_offset);
     if (bdrv_pread(bs->file, s->bat_offset, s->pagetable,
@@ -220,7 +220,7 @@
     s->last_bitmap_offset = (int64_t) -1;
 
 #ifdef CACHE
-    s->pageentry_u8 = qemu_malloc(512);
+    s->pageentry_u8 = g_malloc(512);
     s->pageentry_u32 = s->pageentry_u8;
     s->pageentry_u16 = s->pageentry_u8;
     s->last_pagetable = -1;
@@ -619,9 +619,9 @@
 static void vpc_close(BlockDriverState *bs)
 {
     BDRVVPCState *s = bs->opaque;
-    qemu_free(s->pagetable);
+    g_free(s->pagetable);
 #ifdef CACHE
-    qemu_free(s->pageentry_u8);
+    g_free(s->pageentry_u8);
 #endif
 }
 
diff --git a/block/vvfat.c b/block/vvfat.c
index fe568fe..d6a07ef 100644
--- a/block/vvfat.c
+++ b/block/vvfat.c
@@ -101,7 +101,7 @@
 {
     if((index + 1) * array->item_size > array->size) {
 	int new_size = (index + 32) * array->item_size;
-	array->pointer = qemu_realloc(array->pointer, new_size);
+	array->pointer = g_realloc(array->pointer, new_size);
 	if (!array->pointer)
 	    return -1;
 	array->size = new_size;
@@ -127,7 +127,7 @@
 static inline void* array_insert(array_t* array,unsigned int index,unsigned int count) {
     if((array->next+count)*array->item_size>array->size) {
 	int increment=count*array->item_size;
-	array->pointer=qemu_realloc(array->pointer,array->size+increment);
+	array->pointer=g_realloc(array->pointer,array->size+increment);
 	if(!array->pointer)
             return NULL;
 	array->size+=increment;
@@ -159,7 +159,7 @@
     is=array->item_size;
     from=array->pointer+index_from*is;
     to=array->pointer+index_to*is;
-    buf=qemu_malloc(is*count);
+    buf=g_malloc(is*count);
     memcpy(buf,from,is*count);
 
     if(index_to<index_from)
@@ -728,7 +728,7 @@
 	if(first_cluster == 0 && (is_dotdot || is_dot))
 	    continue;
 
-	buffer=(char*)qemu_malloc(length);
+	buffer=(char*)g_malloc(length);
 	snprintf(buffer,length,"%s/%s",dirname,entry->d_name);
 
 	if(stat(buffer,&st)<0) {
@@ -850,7 +850,7 @@
     memset(&(s->first_sectors[0]),0,0x40*0x200);
 
     s->cluster_size=s->sectors_per_cluster*0x200;
-    s->cluster_buffer=qemu_malloc(s->cluster_size);
+    s->cluster_buffer=g_malloc(s->cluster_size);
 
     /*
      * The formula: sc = spf+1+spf*spc*(512*8/fat_type),
@@ -884,7 +884,7 @@
     mapping->dir_index = 0;
     mapping->info.dir.parent_mapping_index = -1;
     mapping->first_mapping_index = -1;
-    mapping->path = qemu_strdup(dirname);
+    mapping->path = g_strdup(dirname);
     i = strlen(mapping->path);
     if (i > 0 && mapping->path[i - 1] == '/')
 	mapping->path[i - 1] = '\0';
@@ -1638,10 +1638,10 @@
 
 	    /* rename */
 	    if (strcmp(basename, basename2))
-		schedule_rename(s, cluster_num, qemu_strdup(path));
+		schedule_rename(s, cluster_num, g_strdup(path));
 	} else if (is_file(direntry))
 	    /* new file */
-	    schedule_new_file(s, qemu_strdup(path), cluster_num);
+	    schedule_new_file(s, g_strdup(path), cluster_num);
 	else {
             abort();
 	    return 0;
@@ -1735,7 +1735,7 @@
 	int cluster_num, const char* path)
 {
     int ret = 0;
-    unsigned char* cluster = qemu_malloc(s->cluster_size);
+    unsigned char* cluster = g_malloc(s->cluster_size);
     direntry_t* direntries = (direntry_t*)cluster;
     mapping_t* mapping = find_mapping_for_cluster(s, cluster_num);
 
@@ -1758,10 +1758,10 @@
 	mapping->mode &= ~MODE_DELETED;
 
 	if (strcmp(basename, basename2))
-	    schedule_rename(s, cluster_num, qemu_strdup(path));
+	    schedule_rename(s, cluster_num, g_strdup(path));
     } else
 	/* new directory */
-	schedule_mkdir(s, cluster_num, qemu_strdup(path));
+	schedule_mkdir(s, cluster_num, g_strdup(path));
 
     lfn_init(&lfn);
     do {
@@ -1876,7 +1876,7 @@
      */
     if (s->fat2 == NULL) {
 	int size = 0x200 * s->sectors_per_fat;
-	s->fat2 = qemu_malloc(size);
+	s->fat2 = g_malloc(size);
 	memcpy(s->fat2, s->fat.pointer, size);
     }
     check = vvfat_read(s->bs,
@@ -2218,7 +2218,7 @@
     uint32_t first_cluster = c;
     mapping_t* mapping = find_mapping_for_cluster(s, c);
     uint32_t size = filesize_of_direntry(direntry);
-    char* cluster = qemu_malloc(s->cluster_size);
+    char* cluster = g_malloc(s->cluster_size);
     uint32_t i;
     int fd = 0;
 
@@ -2383,7 +2383,7 @@
 			    mapping_t* m = find_mapping_for_cluster(s,
 				    begin_of_direntry(d));
 			    int l = strlen(m->path);
-			    char* new_path = qemu_malloc(l + diff + 1);
+			    char* new_path = g_malloc(l + diff + 1);
 
 			    assert(!strncmp(m->path, mapping->path, l2));
 
@@ -2794,7 +2794,7 @@
 
     array_init(&(s->commits), sizeof(commit_t));
 
-    s->qcow_filename = qemu_malloc(1024);
+    s->qcow_filename = g_malloc(1024);
     get_tmp_filename(s->qcow_filename, 1024);
 
     bdrv_qcow = bdrv_find_format("qcow");
@@ -2822,7 +2822,7 @@
 
     s->bs->backing_hd = calloc(sizeof(BlockDriverState), 1);
     s->bs->backing_hd->drv = &vvfat_write_target;
-    s->bs->backing_hd->opaque = qemu_malloc(sizeof(void*));
+    s->bs->backing_hd->opaque = g_malloc(sizeof(void*));
     *(void**)s->bs->backing_hd->opaque = s;
 
     return 0;
diff --git a/blockdev.c b/blockdev.c
index a25367a..d272659 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -182,9 +182,9 @@
 {
     qemu_opts_del(dinfo->opts);
     bdrv_delete(dinfo->bdrv);
-    qemu_free(dinfo->id);
+    g_free(dinfo->id);
     QTAILQ_REMOVE(&drives, dinfo, next);
-    qemu_free(dinfo);
+    g_free(dinfo);
 }
 
 void drive_put_ref(DriveInfo *dinfo)
@@ -442,12 +442,12 @@
 
     /* init */
 
-    dinfo = qemu_mallocz(sizeof(*dinfo));
+    dinfo = g_malloc0(sizeof(*dinfo));
     if ((buf = qemu_opts_id(opts)) != NULL) {
-        dinfo->id = qemu_strdup(buf);
+        dinfo->id = g_strdup(buf);
     } else {
         /* no id supplied -> create one */
-        dinfo->id = qemu_mallocz(32);
+        dinfo->id = g_malloc0(32);
         if (type == IF_IDE || type == IF_SCSI)
             mediastr = (media == MEDIA_CDROM) ? "-cd" : "-hd";
         if (max_devs)
@@ -542,9 +542,9 @@
 
 err:
     bdrv_delete(dinfo->bdrv);
-    qemu_free(dinfo->id);
+    g_free(dinfo->id);
     QTAILQ_REMOVE(&drives, dinfo, next);
-    qemu_free(dinfo);
+    g_free(dinfo);
     return NULL;
 }
 
diff --git a/bsd-user/mmap.c b/bsd-user/mmap.c
index 207c774..5d6cffc 100644
--- a/bsd-user/mmap.c
+++ b/bsd-user/mmap.c
@@ -94,7 +94,7 @@
     return p;
 }
 
-void *qemu_malloc(size_t size)
+void *g_malloc(size_t size)
 {
     char * p;
     size += 16;
@@ -104,12 +104,12 @@
 }
 
 /* We use map, which is always zero initialized.  */
-void * qemu_mallocz(size_t size)
+void * g_malloc0(size_t size)
 {
-    return qemu_malloc(size);
+    return g_malloc(size);
 }
 
-void qemu_free(void *ptr)
+void g_free(void *ptr)
 {
     /* FIXME: We should unmark the reserved pages here.  However this gets
        complicated when one target page spans multiple host pages, so we
@@ -119,18 +119,18 @@
     munmap(p, *p);
 }
 
-void *qemu_realloc(void *ptr, size_t size)
+void *g_realloc(void *ptr, size_t size)
 {
     size_t old_size, copy;
     void *new_ptr;
 
     if (!ptr)
-        return qemu_malloc(size);
+        return g_malloc(size);
     old_size = *(size_t *)((char *)ptr - 16);
     copy = old_size < size ? old_size : size;
-    new_ptr = qemu_malloc(size);
+    new_ptr = g_malloc(size);
     memcpy(new_ptr, ptr, copy);
-    qemu_free(ptr);
+    g_free(ptr);
     return new_ptr;
 }
 
diff --git a/bsd-user/syscall.c b/bsd-user/syscall.c
index d4d039a..18b43f1 100644
--- a/bsd-user/syscall.c
+++ b/bsd-user/syscall.c
@@ -231,7 +231,7 @@
     void *hnamep, *holdp, *hnewp = NULL;
     size_t holdlen;
     abi_ulong oldlen = 0;
-    int32_t *snamep = qemu_malloc(sizeof(int32_t) * namelen), *p, *q, i;
+    int32_t *snamep = g_malloc(sizeof(int32_t) * namelen), *p, *q, i;
     uint32_t kind = 0;
 
     if (oldlenp)
@@ -255,7 +255,7 @@
     unlock_user(holdp, oldp, holdlen);
     if (hnewp)
         unlock_user(hnewp, newp, 0);
-    qemu_free(snamep);
+    g_free(snamep);
     return ret;
 }
 #endif
diff --git a/bt-host.c b/bt-host.c
index 095254d..df5b7cd 100644
--- a/bt-host.c
+++ b/bt-host.c
@@ -177,7 +177,7 @@
     }
 # endif
 
-    s = qemu_mallocz(sizeof(struct bt_host_hci_s));
+    s = g_malloc0(sizeof(struct bt_host_hci_s));
     s->fd = fd;
     s->hci.cmd_send = bt_host_cmd;
     s->hci.sco_send = bt_host_sco;
diff --git a/bt-vhci.c b/bt-vhci.c
index 3c57720..bbc1029 100644
--- a/bt-vhci.c
+++ b/bt-vhci.c
@@ -156,7 +156,7 @@
         exit(-1);
     }
 
-    s = qemu_mallocz(sizeof(struct bt_vhci_s));
+    s = g_malloc0(sizeof(struct bt_vhci_s));
     s->fd = fd;
     s->info = info ?: qemu_next_hci();
     s->info->opaque = s;
diff --git a/buffered_file.c b/buffered_file.c
index 41b42c3..486af57 100644
--- a/buffered_file.c
+++ b/buffered_file.c
@@ -56,7 +56,7 @@
 
         s->buffer_capacity += size + 1024;
 
-        tmp = qemu_realloc(s->buffer, s->buffer_capacity);
+        tmp = g_realloc(s->buffer, s->buffer_capacity);
         if (tmp == NULL) {
             fprintf(stderr, "qemu file buffer expansion failed\n");
             exit(1);
@@ -183,8 +183,8 @@
 
     qemu_del_timer(s->timer);
     qemu_free_timer(s->timer);
-    qemu_free(s->buffer);
-    qemu_free(s);
+    g_free(s->buffer);
+    g_free(s);
 
     return ret;
 }
@@ -259,7 +259,7 @@
 {
     QEMUFileBuffered *s;
 
-    s = qemu_mallocz(sizeof(*s));
+    s = g_malloc0(sizeof(*s));
 
     s->opaque = opaque;
     s->xfer_limit = bytes_per_sec / 10;
diff --git a/check-qdict.c b/check-qdict.c
index ecc7fd7..5515773 100644
--- a/check-qdict.c
+++ b/check-qdict.c
@@ -56,9 +56,9 @@
 
     // destroy doesn't exit yet
     QDECREF(qi);
-    qemu_free(ent->key);
-    qemu_free(ent);
-    qemu_free(qdict);
+    g_free(ent->key);
+    g_free(ent);
+    g_free(qdict);
 }
 END_TEST
 
diff --git a/check-qfloat.c b/check-qfloat.c
index b71d983..3344057 100644
--- a/check-qfloat.c
+++ b/check-qfloat.c
@@ -33,7 +33,7 @@
     fail_unless(qobject_type(QOBJECT(qf)) == QTYPE_QFLOAT);
 
     // destroy doesn't exit yet
-    qemu_free(qf);
+    g_free(qf);
 }
 END_TEST
 
diff --git a/check-qint.c b/check-qint.c
index f3b0316..3af51f2 100644
--- a/check-qint.c
+++ b/check-qint.c
@@ -32,7 +32,7 @@
     fail_unless(qobject_type(QOBJECT(qi)) == QTYPE_QINT);
 
     // destroy doesn't exit yet
-    qemu_free(qi);
+    g_free(qi);
 }
 END_TEST
 
diff --git a/check-qlist.c b/check-qlist.c
index 58984cb..ee2454a 100644
--- a/check-qlist.c
+++ b/check-qlist.c
@@ -30,7 +30,7 @@
     fail_unless(qobject_type(QOBJECT(qlist)) == QTYPE_QLIST);
 
     // destroy doesn't exist yet
-    qemu_free(qlist);
+    g_free(qlist);
 }
 END_TEST
 
@@ -51,8 +51,8 @@
 
     // destroy doesn't exist yet
     QDECREF(qi);
-    qemu_free(entry);
-    qemu_free(qlist);
+    g_free(entry);
+    g_free(qlist);
 }
 END_TEST
 
@@ -65,7 +65,7 @@
     fail_unless(qobject_to_qlist(QOBJECT(qlist)) == qlist);
 
     // destroy doesn't exist yet
-    qemu_free(qlist);
+    g_free(qlist);
 }
 END_TEST
 
diff --git a/check-qstring.c b/check-qstring.c
index c9bafc2..93bd475 100644
--- a/check-qstring.c
+++ b/check-qstring.c
@@ -32,8 +32,8 @@
     fail_unless(qobject_type(QOBJECT(qstring)) == QTYPE_QSTRING);
 
     // destroy doesn't exit yet
-    qemu_free(qstring->string);
-    qemu_free(qstring);
+    g_free(qstring->string);
+    g_free(qstring);
 }
 END_TEST
 
diff --git a/console.c b/console.c
index 242086c..ec529ae 100644
--- a/console.c
+++ b/console.c
@@ -516,7 +516,7 @@
     if (s->width < w1)
         w1 = s->width;
 
-    cells = qemu_malloc(s->width * s->total_height * sizeof(TextCell));
+    cells = g_malloc(s->width * s->total_height * sizeof(TextCell));
     for(y = 0; y < s->total_height; y++) {
         c = &cells[y * s->width];
         if (w1 > 0) {
@@ -531,7 +531,7 @@
             c++;
         }
     }
-    qemu_free(s->cells);
+    g_free(s->cells);
     s->cells = cells;
 }
 
@@ -1252,7 +1252,7 @@
 
     if (nb_consoles >= MAX_CONSOLES)
         return NULL;
-    s = qemu_mallocz(sizeof(TextConsole));
+    s = g_malloc0(sizeof(TextConsole));
     if (!active_console || ((active_console->console_type != GRAPHIC_CONSOLE) &&
         (console_type == GRAPHIC_CONSOLE))) {
         active_console = s;
@@ -1276,7 +1276,7 @@
 
 static DisplaySurface* defaultallocator_create_displaysurface(int width, int height)
 {
-    DisplaySurface *surface = (DisplaySurface*) qemu_mallocz(sizeof(DisplaySurface));
+    DisplaySurface *surface = (DisplaySurface*) g_malloc0(sizeof(DisplaySurface));
 
     int linesize = width * 4;
     qemu_alloc_display(surface, width, height, linesize,
@@ -1302,10 +1302,10 @@
     surface->linesize = linesize;
     surface->pf = pf;
     if (surface->flags & QEMU_ALLOCATED_FLAG) {
-        data = qemu_realloc(surface->data,
+        data = g_realloc(surface->data,
                             surface->linesize * surface->height);
     } else {
-        data = qemu_malloc(surface->linesize * surface->height);
+        data = g_malloc(surface->linesize * surface->height);
     }
     surface->data = (uint8_t *)data;
     surface->flags = newflags | QEMU_ALLOCATED_FLAG;
@@ -1317,7 +1317,7 @@
 DisplaySurface* qemu_create_displaysurface_from(int width, int height, int bpp,
                                               int linesize, uint8_t *data)
 {
-    DisplaySurface *surface = (DisplaySurface*) qemu_mallocz(sizeof(DisplaySurface));
+    DisplaySurface *surface = (DisplaySurface*) g_malloc0(sizeof(DisplaySurface));
 
     surface->width = width;
     surface->height = height;
@@ -1336,8 +1336,8 @@
     if (surface == NULL)
         return;
     if (surface->flags & QEMU_ALLOCATED_FLAG)
-        qemu_free(surface->data);
-    qemu_free(surface);
+        g_free(surface->data);
+    g_free(surface);
 }
 
 static struct DisplayAllocator default_allocator = {
@@ -1348,7 +1348,7 @@
 
 static void dumb_display_init(void)
 {
-    DisplayState *ds = qemu_mallocz(sizeof(DisplayState));
+    DisplayState *ds = g_malloc0(sizeof(DisplayState));
     int width = 640;
     int height = 480;
 
@@ -1403,14 +1403,14 @@
     TextConsole *s;
     DisplayState *ds;
 
-    ds = (DisplayState *) qemu_mallocz(sizeof(DisplayState));
+    ds = (DisplayState *) g_malloc0(sizeof(DisplayState));
     ds->allocator = &default_allocator; 
     ds->surface = qemu_create_displaysurface(ds, 640, 480);
 
     s = new_console(ds, GRAPHIC_CONSOLE);
     if (s == NULL) {
         qemu_free_displaysurface(ds);
-        qemu_free(ds);
+        g_free(ds);
         return NULL;
     }
     s->hw_update = update;
@@ -1521,7 +1521,7 @@
     unsigned width;
     unsigned height;
 
-    chr = qemu_mallocz(sizeof(CharDriverState));
+    chr = g_malloc0(sizeof(CharDriverState));
 
     if (n_text_consoles == 128) {
         fprintf(stderr, "Too many text consoles\n");
diff --git a/coroutine-gthread.c b/coroutine-gthread.c
index f09877e..b00e548 100644
--- a/coroutine-gthread.c
+++ b/coroutine-gthread.c
@@ -71,11 +71,11 @@
 {
     CoroutineGThread *co;
 
-    co = qemu_mallocz(sizeof(*co));
+    co = g_malloc0(sizeof(*co));
     co->thread = g_thread_create_full(coroutine_thread, co, 0, TRUE, TRUE,
                                       G_THREAD_PRIORITY_NORMAL, NULL);
     if (!co->thread) {
-        qemu_free(co);
+        g_free(co);
         return NULL;
     }
     return &co->base;
@@ -86,7 +86,7 @@
     CoroutineGThread *co = DO_UPCAST(CoroutineGThread, base, co_);
 
     g_thread_join(co->thread);
-    qemu_free(co);
+    g_free(co);
 }
 
 CoroutineAction qemu_coroutine_switch(Coroutine *from_,
@@ -115,7 +115,7 @@
     CoroutineGThread *co = g_static_private_get(&coroutine_key);
 
     if (!co) {
-        co = qemu_mallocz(sizeof(*co));
+        co = g_malloc0(sizeof(*co));
         co->runnable = true;
         g_static_private_set(&coroutine_key, co, (GDestroyNotify)qemu_free);
     }
diff --git a/coroutine-ucontext.c b/coroutine-ucontext.c
index 42dc3e2..2b8d3e9 100644
--- a/coroutine-ucontext.c
+++ b/coroutine-ucontext.c
@@ -73,7 +73,7 @@
     CoroutineThreadState *s = pthread_getspecific(thread_state_key);
 
     if (!s) {
-        s = qemu_mallocz(sizeof(*s));
+        s = g_malloc0(sizeof(*s));
         s->current = &s->leader.base;
         QLIST_INIT(&s->pool);
         pthread_setspecific(thread_state_key, s);
@@ -88,10 +88,10 @@
     Coroutine *tmp;
 
     QLIST_FOREACH_SAFE(co, &s->pool, pool_next, tmp) {
-        qemu_free(DO_UPCAST(CoroutineUContext, base, co)->stack);
-        qemu_free(co);
+        g_free(DO_UPCAST(CoroutineUContext, base, co)->stack);
+        g_free(co);
     }
-    qemu_free(s);
+    g_free(s);
 }
 
 static void __attribute__((constructor)) coroutine_init(void)
@@ -146,8 +146,8 @@
         abort();
     }
 
-    co = qemu_mallocz(sizeof(*co));
-    co->stack = qemu_malloc(stack_size);
+    co = g_malloc0(sizeof(*co));
+    co->stack = g_malloc(stack_size);
     co->base.entry_arg = &old_env; /* stash away our jmp_buf */
 
     uc.uc_link = &old_uc;
@@ -194,8 +194,8 @@
         return;
     }
 
-    qemu_free(co->stack);
-    qemu_free(co);
+    g_free(co->stack);
+    g_free(co);
 }
 
 CoroutineAction qemu_coroutine_switch(Coroutine *from_, Coroutine *to_,
diff --git a/coroutine-win32.c b/coroutine-win32.c
index 0e29448..4179609 100644
--- a/coroutine-win32.c
+++ b/coroutine-win32.c
@@ -64,7 +64,7 @@
     const size_t stack_size = 1 << 20;
     CoroutineWin32 *co;
 
-    co = qemu_mallocz(sizeof(*co));
+    co = g_malloc0(sizeof(*co));
     co->fiber = CreateFiber(stack_size, coroutine_trampoline, &co->base);
     return &co->base;
 }
@@ -74,7 +74,7 @@
     CoroutineWin32 *co = DO_UPCAST(CoroutineWin32, base, co_);
 
     DeleteFiber(co->fiber);
-    qemu_free(co);
+    g_free(co);
 }
 
 Coroutine *qemu_coroutine_self(void)
diff --git a/cpus.c b/cpus.c
index 6bf4e3f..c996ac5 100644
--- a/cpus.c
+++ b/cpus.c
@@ -968,8 +968,8 @@
 
     /* share a single thread for all cpus with TCG */
     if (!tcg_cpu_thread) {
-        env->thread = qemu_mallocz(sizeof(QemuThread));
-        env->halt_cond = qemu_mallocz(sizeof(QemuCond));
+        env->thread = g_malloc0(sizeof(QemuThread));
+        env->halt_cond = g_malloc0(sizeof(QemuCond));
         qemu_cond_init(env->halt_cond);
         qemu_thread_create(env->thread, qemu_tcg_cpu_thread_fn, env);
         while (env->created == 0) {
@@ -985,8 +985,8 @@
 
 static void qemu_kvm_start_vcpu(CPUState *env)
 {
-    env->thread = qemu_mallocz(sizeof(QemuThread));
-    env->halt_cond = qemu_mallocz(sizeof(QemuCond));
+    env->thread = g_malloc0(sizeof(QemuThread));
+    env->halt_cond = g_malloc0(sizeof(QemuCond));
     qemu_cond_init(env->halt_cond);
     qemu_thread_create(env->thread, qemu_kvm_cpu_thread_fn, env);
     while (env->created == 0) {
diff --git a/cris-dis.c b/cris-dis.c
index 5fa67d9..5b8e90b 100644
--- a/cris-dis.c
+++ b/cris-dis.c
@@ -1396,32 +1396,32 @@
   /* Allocate and clear the opcode-table.  */
   if (opc_table == NULL)
     {
-      opc_table = qemu_malloc (65536 * sizeof (opc_table[0]));
+      opc_table = g_malloc (65536 * sizeof (opc_table[0]));
 
       memset (opc_table, 0, 65536 * sizeof (const struct cris_opcode *));
 
       dip_prefixes
-	= qemu_malloc (65536 * sizeof (const struct cris_opcode **));
+	= g_malloc (65536 * sizeof (const struct cris_opcode **));
 
       memset (dip_prefixes, 0, 65536 * sizeof (dip_prefixes[0]));
 
       bdapq_m1_prefixes
-	= qemu_malloc (65536 * sizeof (const struct cris_opcode **));
+	= g_malloc (65536 * sizeof (const struct cris_opcode **));
 
       memset (bdapq_m1_prefixes, 0, 65536 * sizeof (bdapq_m1_prefixes[0]));
 
       bdapq_m2_prefixes
-	= qemu_malloc (65536 * sizeof (const struct cris_opcode **));
+	= g_malloc (65536 * sizeof (const struct cris_opcode **));
 
       memset (bdapq_m2_prefixes, 0, 65536 * sizeof (bdapq_m2_prefixes[0]));
 
       bdapq_m4_prefixes
-	= qemu_malloc (65536 * sizeof (const struct cris_opcode **));
+	= g_malloc (65536 * sizeof (const struct cris_opcode **));
 
       memset (bdapq_m4_prefixes, 0, 65536 * sizeof (bdapq_m4_prefixes[0]));
 
       rest_prefixes
-	= qemu_malloc (65536 * sizeof (const struct cris_opcode **));
+	= g_malloc (65536 * sizeof (const struct cris_opcode **));
 
       memset (rest_prefixes, 0, 65536 * sizeof (rest_prefixes[0]));
     }
diff --git a/cursor.c b/cursor.c
index dfb9eef..efc5917 100644
--- a/cursor.c
+++ b/cursor.c
@@ -98,7 +98,7 @@
     QEMUCursor *c;
     int datasize = width * height * sizeof(uint32_t);
 
-    c = qemu_mallocz(sizeof(QEMUCursor) + datasize);
+    c = g_malloc0(sizeof(QEMUCursor) + datasize);
     c->width  = width;
     c->height = height;
     c->refcount = 1;
@@ -117,7 +117,7 @@
     c->refcount--;
     if (c->refcount)
         return;
-    qemu_free(c);
+    g_free(c);
 }
 
 int cursor_get_mono_bpl(QEMUCursor *c)
diff --git a/cutils.c b/cutils.c
index 28049e0..f2bcf20 100644
--- a/cutils.c
+++ b/cutils.c
@@ -136,7 +136,7 @@
 
 void qemu_iovec_init(QEMUIOVector *qiov, int alloc_hint)
 {
-    qiov->iov = qemu_malloc(alloc_hint * sizeof(struct iovec));
+    qiov->iov = g_malloc(alloc_hint * sizeof(struct iovec));
     qiov->niov = 0;
     qiov->nalloc = alloc_hint;
     qiov->size = 0;
@@ -160,7 +160,7 @@
 
     if (qiov->niov == qiov->nalloc) {
         qiov->nalloc = 2 * qiov->nalloc + 1;
-        qiov->iov = qemu_realloc(qiov->iov, qiov->nalloc * sizeof(struct iovec));
+        qiov->iov = g_realloc(qiov->iov, qiov->nalloc * sizeof(struct iovec));
     }
     qiov->iov[qiov->niov].iov_base = base;
     qiov->iov[qiov->niov].iov_len = len;
@@ -217,7 +217,7 @@
 {
     assert(qiov->nalloc != -1);
 
-    qemu_free(qiov->iov);
+    g_free(qiov->iov);
 }
 
 void qemu_iovec_reset(QEMUIOVector *qiov)
diff --git a/device_tree.c b/device_tree.c
index f5d5eb1..3a224d1 100644
--- a/device_tree.c
+++ b/device_tree.c
@@ -43,7 +43,7 @@
     /* Expand to 2x size to give enough room for manipulation.  */
     dt_size *= 2;
     /* First allocate space in qemu for device tree */
-    fdt = qemu_mallocz(dt_size);
+    fdt = g_malloc0(dt_size);
 
     dt_file_load_size = load_image(filename_path, fdt);
     if (dt_file_load_size < 0) {
@@ -68,7 +68,7 @@
     return fdt;
 
 fail:
-    qemu_free(fdt);
+    g_free(fdt);
     return NULL;
 }
 
diff --git a/dma-helpers.c b/dma-helpers.c
index ba7f897..4610ea0 100644
--- a/dma-helpers.c
+++ b/dma-helpers.c
@@ -12,7 +12,7 @@
 
 void qemu_sglist_init(QEMUSGList *qsg, int alloc_hint)
 {
-    qsg->sg = qemu_malloc(alloc_hint * sizeof(ScatterGatherEntry));
+    qsg->sg = g_malloc(alloc_hint * sizeof(ScatterGatherEntry));
     qsg->nsg = 0;
     qsg->nalloc = alloc_hint;
     qsg->size = 0;
@@ -23,7 +23,7 @@
 {
     if (qsg->nsg == qsg->nalloc) {
         qsg->nalloc = 2 * qsg->nalloc + 1;
-        qsg->sg = qemu_realloc(qsg->sg, qsg->nalloc * sizeof(ScatterGatherEntry));
+        qsg->sg = g_realloc(qsg->sg, qsg->nalloc * sizeof(ScatterGatherEntry));
     }
     qsg->sg[qsg->nsg].base = base;
     qsg->sg[qsg->nsg].len = len;
@@ -33,7 +33,7 @@
 
 void qemu_sglist_destroy(QEMUSGList *qsg)
 {
-    qemu_free(qsg->sg);
+    g_free(qsg->sg);
 }
 
 typedef struct {
diff --git a/error.c b/error.c
index 74d7398..b802752 100644
--- a/error.c
+++ b/error.c
@@ -32,7 +32,7 @@
         return;
     }
 
-    err = qemu_mallocz(sizeof(*err));
+    err = g_malloc0(sizeof(*err));
 
     va_start(ap, fmt);
     err->obj = qobject_to_qdict(qobject_from_jsonv(fmt, &ap));
@@ -52,7 +52,7 @@
     if (err->msg == NULL) {
         QString *str;
         str = qerror_format(err->fmt, err->obj);
-        err->msg = qemu_strdup(qstring_get_str(str));
+        err->msg = g_strdup(qstring_get_str(str));
         QDECREF(str);
     }
 
@@ -86,8 +86,8 @@
 {
     if (err) {
         QDECREF(err->obj);
-        qemu_free(err->msg);
-        qemu_free(err);
+        g_free(err->msg);
+        g_free(err);
     }
 }
 
@@ -133,7 +133,7 @@
     if (errp == NULL) {
         return;
     }
-    err = qemu_mallocz(sizeof(*err));
+    err = g_malloc0(sizeof(*err));
     err->obj = qobject_to_qdict(obj);
     qobject_incref(obj);
 
diff --git a/exec.c b/exec.c
index 63adb18..c1e045d 100644
--- a/exec.c
+++ b/exec.c
@@ -352,7 +352,7 @@
     int i;
 
 #if defined(CONFIG_USER_ONLY)
-    /* We can't use qemu_malloc because it may recurse into a locked mutex. */
+    /* We can't use g_malloc because it may recurse into a locked mutex. */
 # define ALLOC(P, SIZE)                                 \
     do {                                                \
         P = mmap(NULL, SIZE, PROT_READ | PROT_WRITE,    \
@@ -360,7 +360,7 @@
     } while (0)
 #else
 # define ALLOC(P, SIZE) \
-    do { P = qemu_mallocz(SIZE); } while (0)
+    do { P = g_malloc0(SIZE); } while (0)
 #endif
 
     /* Level 1.  Always allocated.  */
@@ -417,7 +417,7 @@
             if (!alloc) {
                 return NULL;
             }
-            *lp = p = qemu_mallocz(sizeof(void *) * L2_SIZE);
+            *lp = p = g_malloc0(sizeof(void *) * L2_SIZE);
         }
         lp = p + ((index >> (i * L2_BITS)) & (L2_SIZE - 1));
     }
@@ -430,7 +430,7 @@
             return NULL;
         }
 
-        *lp = pd = qemu_malloc(sizeof(PhysPageDesc) * L2_SIZE);
+        *lp = pd = g_malloc(sizeof(PhysPageDesc) * L2_SIZE);
 
         for (i = 0; i < L2_SIZE; i++) {
             pd[i].phys_offset = IO_MEM_UNASSIGNED;
@@ -558,7 +558,7 @@
         }
     }
 #else
-    code_gen_buffer = qemu_malloc(code_gen_buffer_size);
+    code_gen_buffer = g_malloc(code_gen_buffer_size);
     map_exec(code_gen_buffer, code_gen_buffer_size);
 #endif
 #endif /* !USE_STATIC_CODE_GEN_BUFFER */
@@ -566,7 +566,7 @@
     code_gen_buffer_max_size = code_gen_buffer_size -
         (TCG_MAX_OP_SIZE * OPC_BUF_SIZE);
     code_gen_max_blocks = code_gen_buffer_size / CODE_GEN_AVG_BLOCK_SIZE;
-    tbs = qemu_malloc(code_gen_max_blocks * sizeof(TranslationBlock));
+    tbs = g_malloc(code_gen_max_blocks * sizeof(TranslationBlock));
 }
 
 /* Must be called before using the QEMU cpus. 'tb_size' is the size
@@ -701,7 +701,7 @@
 static inline void invalidate_page_bitmap(PageDesc *p)
 {
     if (p->code_bitmap) {
-        qemu_free(p->code_bitmap);
+        g_free(p->code_bitmap);
         p->code_bitmap = NULL;
     }
     p->code_write_count = 0;
@@ -961,7 +961,7 @@
     int n, tb_start, tb_end;
     TranslationBlock *tb;
 
-    p->code_bitmap = qemu_mallocz(TARGET_PAGE_SIZE / 8);
+    p->code_bitmap = g_malloc0(TARGET_PAGE_SIZE / 8);
 
     tb = p->first_tb;
     while (tb != NULL) {
@@ -1448,7 +1448,7 @@
                 TARGET_FMT_lx ", len=" TARGET_FMT_lu "\n", addr, len);
         return -EINVAL;
     }
-    wp = qemu_malloc(sizeof(*wp));
+    wp = g_malloc(sizeof(*wp));
 
     wp->vaddr = addr;
     wp->len_mask = len_mask;
@@ -1491,7 +1491,7 @@
 
     tlb_flush_page(env, watchpoint->vaddr);
 
-    qemu_free(watchpoint);
+    g_free(watchpoint);
 }
 
 /* Remove all matching watchpoints.  */
@@ -1513,7 +1513,7 @@
 #if defined(TARGET_HAS_ICE)
     CPUBreakpoint *bp;
 
-    bp = qemu_malloc(sizeof(*bp));
+    bp = g_malloc(sizeof(*bp));
 
     bp->pc = pc;
     bp->flags = flags;
@@ -1560,7 +1560,7 @@
 
     breakpoint_invalidate(env, breakpoint->pc);
 
-    qemu_free(breakpoint);
+    g_free(breakpoint);
 #endif
 }
 
@@ -2921,13 +2921,13 @@
     RAMBlock *new_block, *block;
 
     size = TARGET_PAGE_ALIGN(size);
-    new_block = qemu_mallocz(sizeof(*new_block));
+    new_block = g_malloc0(sizeof(*new_block));
 
     if (dev && dev->parent_bus && dev->parent_bus->info->get_dev_path) {
         char *id = dev->parent_bus->info->get_dev_path(dev);
         if (id) {
             snprintf(new_block->idstr, sizeof(new_block->idstr), "%s/", id);
-            qemu_free(id);
+            g_free(id);
         }
     }
     pstrcat(new_block->idstr, sizeof(new_block->idstr), name);
@@ -2984,7 +2984,7 @@
 
     QLIST_INSERT_HEAD(&ram_list.blocks, new_block, next);
 
-    ram_list.phys_dirty = qemu_realloc(ram_list.phys_dirty,
+    ram_list.phys_dirty = g_realloc(ram_list.phys_dirty,
                                        last_ram_offset() >> TARGET_PAGE_BITS);
     memset(ram_list.phys_dirty + (new_block->offset >> TARGET_PAGE_BITS),
            0xff, size >> TARGET_PAGE_BITS);
@@ -3007,7 +3007,7 @@
     QLIST_FOREACH(block, &ram_list.blocks, next) {
         if (addr == block->offset) {
             QLIST_REMOVE(block, next);
-            qemu_free(block);
+            g_free(block);
             return;
         }
     }
@@ -3044,7 +3044,7 @@
                 }
 #endif
             }
-            qemu_free(block);
+            g_free(block);
             return;
         }
     }
@@ -3602,7 +3602,7 @@
     subpage_t *mmio;
     int subpage_memory;
 
-    mmio = qemu_mallocz(sizeof(subpage_t));
+    mmio = g_malloc0(sizeof(subpage_t));
 
     mmio->base = base;
     subpage_memory = cpu_register_io_memory(subpage_read, subpage_write, mmio,
@@ -3708,7 +3708,7 @@
 
 static void swapendian_init(int io_index)
 {
-    SwapEndianContainer *c = qemu_malloc(sizeof(SwapEndianContainer));
+    SwapEndianContainer *c = g_malloc(sizeof(SwapEndianContainer));
     int i;
 
     /* Swap mmio for big endian targets */
@@ -3726,7 +3726,7 @@
 static void swapendian_del(int io_index)
 {
     if (io_mem_read[io_index][0] == swapendian_readfn[0]) {
-        qemu_free(io_mem_opaque[io_index]);
+        g_free(io_mem_opaque[io_index]);
     }
 }
 
@@ -3828,11 +3828,11 @@
 
 static void memory_map_init(void)
 {
-    system_memory = qemu_malloc(sizeof(*system_memory));
+    system_memory = g_malloc(sizeof(*system_memory));
     memory_region_init(system_memory, "system", INT64_MAX);
     set_system_memory_map(system_memory);
 
-    system_io = qemu_malloc(sizeof(*system_io));
+    system_io = g_malloc(sizeof(*system_io));
     memory_region_init(system_io, "io", 65536);
     set_system_io_map(system_io);
 }
@@ -4048,7 +4048,7 @@
 
 void *cpu_register_map_client(void *opaque, void (*callback)(void *opaque))
 {
-    MapClient *client = qemu_malloc(sizeof(*client));
+    MapClient *client = g_malloc(sizeof(*client));
 
     client->opaque = opaque;
     client->callback = callback;
@@ -4061,7 +4061,7 @@
     MapClient *client = (MapClient *)_client;
 
     QLIST_REMOVE(client, link);
-    qemu_free(client);
+    g_free(client);
 }
 
 static void cpu_notify_map_clients(void)
diff --git a/fsdev/qemu-fsdev.c b/fsdev/qemu-fsdev.c
index 0b33290..336d7e4 100644
--- a/fsdev/qemu-fsdev.c
+++ b/fsdev/qemu-fsdev.c
@@ -65,11 +65,11 @@
         return -1;
     }
 
-    fsle = qemu_malloc(sizeof(*fsle));
+    fsle = g_malloc(sizeof(*fsle));
 
-    fsle->fse.fsdev_id = qemu_strdup(fsdev_id);
-    fsle->fse.path = qemu_strdup(path);
-    fsle->fse.security_model = qemu_strdup(sec_model);
+    fsle->fse.fsdev_id = g_strdup(fsdev_id);
+    fsle->fse.path = g_strdup(path);
+    fsle->fse.security_model = g_strdup(sec_model);
     fsle->fse.ops = FsTypes[i].ops;
 
     QTAILQ_INSERT_TAIL(&fstype_entries, fsle, next);
diff --git a/gdbstub.c b/gdbstub.c
index 27b0cfa..2f0206d 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -1668,7 +1668,7 @@
     GDBRegisterState **p;
     static int last_reg = NUM_CORE_REGS;
 
-    s = (GDBRegisterState *)qemu_mallocz(sizeof(GDBRegisterState));
+    s = (GDBRegisterState *)g_malloc0(sizeof(GDBRegisterState));
     s->base_reg = last_reg;
     s->num_regs = num_regs;
     s->get_reg = get_reg;
@@ -2606,7 +2606,7 @@
     val = 1;
     setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, (char *)&val, sizeof(val));
 
-    s = qemu_mallocz(sizeof(GDBState));
+    s = g_malloc0(sizeof(GDBState));
     s->c_cpu = first_cpu;
     s->g_cpu = first_cpu;
     s->fd = fd;
@@ -2774,13 +2774,13 @@
 
     s = gdbserver_state;
     if (!s) {
-        s = qemu_mallocz(sizeof(GDBState));
+        s = g_malloc0(sizeof(GDBState));
         gdbserver_state = s;
 
         qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
 
         /* Initialize a monitor terminal for gdb */
-        mon_chr = qemu_mallocz(sizeof(*mon_chr));
+        mon_chr = g_malloc0(sizeof(*mon_chr));
         mon_chr->chr_write = gdb_monitor_write;
         monitor_init(mon_chr, 0);
     } else {
diff --git a/hw/9pfs/cofs.c b/hw/9pfs/cofs.c
index 473ce53..1f10632 100644
--- a/hw/9pfs/cofs.c
+++ b/hw/9pfs/cofs.c
@@ -22,7 +22,7 @@
     int err;
     ssize_t len;
 
-    buf->data = qemu_malloc(PATH_MAX);
+    buf->data = g_malloc(PATH_MAX);
     v9fs_co_run_in_worker(
         {
             len = s->ops->readlink(&s->ctx, path->data,
@@ -36,7 +36,7 @@
             }
         });
     if (err) {
-        qemu_free(buf->data);
+        g_free(buf->data);
         buf->data = NULL;
         buf->size = 0;
     }
diff --git a/hw/9pfs/virtio-9p-device.c b/hw/9pfs/virtio-9p-device.c
index f4bf471..9466002 100644
--- a/hw/9pfs/virtio-9p-device.c
+++ b/hw/9pfs/virtio-9p-device.c
@@ -36,12 +36,12 @@
     struct virtio_9p_config *cfg;
     V9fsState *s = to_virtio_9p(vdev);
 
-    cfg = qemu_mallocz(sizeof(struct virtio_9p_config) +
+    cfg = g_malloc0(sizeof(struct virtio_9p_config) +
                         s->tag_len);
     stw_raw(&cfg->tag_len, s->tag_len);
     memcpy(cfg->tag, s->tag, s->tag_len);
     memcpy(config, cfg, s->config_size);
-    qemu_free(cfg);
+    g_free(cfg);
 }
 
 VirtIODevice *virtio_9p_init(DeviceState *dev, V9fsConf *conf)
@@ -114,13 +114,13 @@
         exit(1);
     }
 
-    s->ctx.fs_root = qemu_strdup(fse->path);
+    s->ctx.fs_root = g_strdup(fse->path);
     len = strlen(conf->tag);
     if (len > MAX_TAG_LEN) {
         len = MAX_TAG_LEN;
     }
     /* s->tag is non-NULL terminated string */
-    s->tag = qemu_malloc(len);
+    s->tag = g_malloc(len);
     memcpy(s->tag, conf->tag, len);
     s->tag_len = len;
     s->ctx.uid = -1;
diff --git a/hw/9pfs/virtio-9p-xattr.c b/hw/9pfs/virtio-9p-xattr.c
index bde0b7f..7f08f6e 100644
--- a/hw/9pfs/virtio-9p-xattr.c
+++ b/hw/9pfs/virtio-9p-xattr.c
@@ -79,7 +79,7 @@
     }
 
     /* Now fetch the xattr and find the actual size */
-    orig_value = qemu_malloc(xattr_len);
+    orig_value = g_malloc(xattr_len);
     xattr_len = llistxattr(rpath(ctx, path, buffer), orig_value, xattr_len);
 
     /* store the orig pointer */
@@ -111,7 +111,7 @@
     }
 
 err_out:
-    qemu_free(orig_value_start);
+    g_free(orig_value_start);
     return size;
 }
 
diff --git a/hw/9pfs/virtio-9p.c b/hw/9pfs/virtio-9p.c
index f2193d6..eb33636 100644
--- a/hw/9pfs/virtio-9p.c
+++ b/hw/9pfs/virtio-9p.c
@@ -239,7 +239,7 @@
 
 static void v9fs_string_free(V9fsString *str)
 {
-    qemu_free(str->data);
+    g_free(str->data);
     str->data = NULL;
     str->size = 0;
 }
@@ -338,7 +338,7 @@
     }
 
 alloc_print:
-    *strp = qemu_malloc((len + 1) * sizeof(**strp));
+    *strp = g_malloc((len + 1) * sizeof(**strp));
 
     return vsprintf(*strp, fmt, ap);
 }
@@ -408,7 +408,7 @@
         return NULL;
     }
 
-    f = qemu_mallocz(sizeof(V9fsFidState));
+    f = g_malloc0(sizeof(V9fsFidState));
 
     f->fid = fid;
     f->fid_type = P9_FID_NONE;
@@ -448,7 +448,7 @@
     v9fs_string_free(&fidp->fs.xattr.name);
 free_value:
     if (fidp->fs.xattr.value) {
-        qemu_free(fidp->fs.xattr.value);
+        g_free(fidp->fs.xattr.value);
     }
     return retval;
 }
@@ -479,7 +479,7 @@
         retval = v9fs_xattr_fid_clunk(s, fidp);
     }
     v9fs_string_free(&fidp->path);
-    qemu_free(fidp);
+    g_free(fidp);
 
     return retval;
 }
@@ -685,7 +685,7 @@
             V9fsString *str = va_arg(ap, V9fsString *);
             offset += pdu_unmarshal(pdu, offset, "w", &str->size);
             /* FIXME: sanity check str->size */
-            str->data = qemu_malloc(str->size + 1);
+            str->data = g_malloc(str->size + 1);
             offset += pdu_unpack(str->data, pdu, offset, str->size);
             str->data[str->size] = 0;
             break;
@@ -1209,7 +1209,7 @@
 out:
     complete_pdu(s, vs->pdu, err);
     v9fs_stat_free(&vs->v9stat);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_stat(void *opaque)
@@ -1220,7 +1220,7 @@
     V9fsStatState *vs;
     ssize_t err = 0;
 
-    vs = qemu_malloc(sizeof(*vs));
+    vs = g_malloc(sizeof(*vs));
     vs->pdu = pdu;
     vs->offset = 7;
 
@@ -1241,7 +1241,7 @@
 out:
     complete_pdu(s, vs->pdu, err);
     v9fs_stat_free(&vs->v9stat);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_getattr(void *opaque)
@@ -1379,8 +1379,8 @@
             v9fs_string_free(&vs->wnames[vs->name_idx]);
         }
 
-        qemu_free(vs->wnames);
-        qemu_free(vs->qids);
+        g_free(vs->wnames);
+        g_free(vs->qids);
     }
 }
 
@@ -1463,7 +1463,7 @@
     int err = 0;
     int i;
 
-    vs = qemu_malloc(sizeof(*vs));
+    vs = g_malloc(sizeof(*vs));
     vs->pdu = pdu;
     vs->wnames = NULL;
     vs->qids = NULL;
@@ -1473,9 +1473,9 @@
                                             &newfid, &vs->nwnames);
 
     if (vs->nwnames && vs->nwnames <= P9_MAXWELEM) {
-        vs->wnames = qemu_mallocz(sizeof(vs->wnames[0]) * vs->nwnames);
+        vs->wnames = g_malloc0(sizeof(vs->wnames[0]) * vs->nwnames);
 
-        vs->qids = qemu_mallocz(sizeof(vs->qids[0]) * vs->nwnames);
+        vs->qids = g_malloc0(sizeof(vs->qids[0]) * vs->nwnames);
 
         for (i = 0; i < vs->nwnames; i++) {
             vs->offset += pdu_unmarshal(vs->pdu, vs->offset, "s",
@@ -1568,7 +1568,7 @@
     err = vs->offset;
 out:
     complete_pdu(s, vs->pdu, err);
-    qemu_free(vs);
+    g_free(vs);
 
 }
 
@@ -1578,7 +1578,7 @@
     vs->offset += pdu_marshal(vs->pdu, vs->offset, "Qd", &vs->qid, vs->iounit);
     err = vs->offset;
     complete_pdu(s, vs->pdu, err);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_open_post_open(V9fsState *s, V9fsOpenState *vs, int err)
@@ -1593,7 +1593,7 @@
     return;
 out:
     complete_pdu(s, vs->pdu, err);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_open_post_lstat(V9fsState *s, V9fsOpenState *vs, int err)
@@ -1625,7 +1625,7 @@
     return;
 out:
     complete_pdu(s, vs->pdu, err);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_open(void *opaque)
@@ -1636,7 +1636,7 @@
     V9fsOpenState *vs;
     ssize_t err = 0;
 
-    vs = qemu_malloc(sizeof(*vs));
+    vs = g_malloc(sizeof(*vs));
     vs->pdu = pdu;
     vs->offset = 7;
     vs->mode = 0;
@@ -1661,7 +1661,7 @@
     return;
 out:
     complete_pdu(s, pdu, err);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_post_lcreate(V9fsState *s, V9fsLcreateState *vs, int err)
@@ -1683,7 +1683,7 @@
     complete_pdu(s, vs->pdu, err);
     v9fs_string_free(&vs->name);
     v9fs_string_free(&vs->fullname);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_lcreate_post_get_iounit(V9fsState *s, V9fsLcreateState *vs,
@@ -1724,7 +1724,7 @@
     V9fsLcreateState *vs;
     ssize_t err = 0;
 
-    vs = qemu_malloc(sizeof(*vs));
+    vs = g_malloc(sizeof(*vs));
     vs->pdu = pdu;
     vs->offset = 7;
 
@@ -1753,7 +1753,7 @@
 out:
     complete_pdu(s, vs->pdu, err);
     v9fs_string_free(&vs->name);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_post_do_fsync(V9fsState *s, V9fsPDU *pdu, int err)
@@ -1820,7 +1820,7 @@
     complete_pdu(s, vs->pdu, err);
     v9fs_stat_free(&vs->v9stat);
     v9fs_string_free(&vs->name);
-    qemu_free(vs);
+    g_free(vs);
     return;
 }
 
@@ -1874,7 +1874,7 @@
     vs->offset += vs->count;
     err = vs->offset;
     complete_pdu(s, vs->pdu, err);
-    qemu_free(vs);
+    g_free(vs);
     return;
 }
 
@@ -1925,7 +1925,7 @@
 
 out:
     complete_pdu(s, vs->pdu, err);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_xattr_read(V9fsState *s, V9fsReadState *vs)
@@ -1950,7 +1950,7 @@
                            read_count);
     err = vs->offset;
     complete_pdu(s, vs->pdu, err);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_read(void *opaque)
@@ -1961,7 +1961,7 @@
     V9fsReadState *vs;
     ssize_t err = 0;
 
-    vs = qemu_malloc(sizeof(*vs));
+    vs = g_malloc(sizeof(*vs));
     vs->pdu = pdu;
     vs->offset = 7;
     vs->total = 0;
@@ -2006,7 +2006,7 @@
     }
 out:
     complete_pdu(s, pdu, err);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static size_t v9fs_readdir_data_size(V9fsString *name)
@@ -2138,7 +2138,7 @@
     err = vs->offset;
 out:
     complete_pdu(s, vs->pdu, err);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_xattr_write(V9fsState *s, V9fsWriteState *vs)
@@ -2180,7 +2180,7 @@
     }
 out:
     complete_pdu(s, vs->pdu, err);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_write(void *opaque)
@@ -2191,7 +2191,7 @@
     V9fsWriteState *vs;
     ssize_t err;
 
-    vs = qemu_malloc(sizeof(*vs));
+    vs = g_malloc(sizeof(*vs));
 
     vs->pdu = pdu;
     vs->offset = 7;
@@ -2235,7 +2235,7 @@
     return;
 out:
     complete_pdu(s, vs->pdu, err);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_create_post_getiounit(V9fsState *s, V9fsCreateState *vs)
@@ -2251,7 +2251,7 @@
     v9fs_string_free(&vs->name);
     v9fs_string_free(&vs->extension);
     v9fs_string_free(&vs->fullname);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_post_create(V9fsState *s, V9fsCreateState *vs, int err)
@@ -2266,7 +2266,7 @@
     v9fs_string_free(&vs->name);
     v9fs_string_free(&vs->extension);
     v9fs_string_free(&vs->fullname);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_create_post_perms(V9fsState *s, V9fsCreateState *vs, int err)
@@ -2426,7 +2426,7 @@
     V9fsCreateState *vs;
     int err = 0;
 
-    vs = qemu_malloc(sizeof(*vs));
+    vs = g_malloc(sizeof(*vs));
     vs->pdu = pdu;
     vs->offset = 7;
 
@@ -2452,7 +2452,7 @@
     complete_pdu(s, vs->pdu, err);
     v9fs_string_free(&vs->name);
     v9fs_string_free(&vs->extension);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_post_symlink(V9fsState *s, V9fsSymlinkState *vs, int err)
@@ -2468,7 +2468,7 @@
     v9fs_string_free(&vs->name);
     v9fs_string_free(&vs->symname);
     v9fs_string_free(&vs->fullname);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_symlink_post_do_symlink(V9fsState *s, V9fsSymlinkState *vs,
@@ -2491,7 +2491,7 @@
     int err = 0;
     gid_t gid;
 
-    vs = qemu_malloc(sizeof(*vs));
+    vs = g_malloc(sizeof(*vs));
     vs->pdu = pdu;
     vs->offset = 7;
 
@@ -2517,7 +2517,7 @@
     complete_pdu(s, vs->pdu, err);
     v9fs_string_free(&vs->name);
     v9fs_string_free(&vs->symname);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_flush(void *opaque)
@@ -2605,7 +2605,7 @@
 out:
     v9fs_stat_free(&vs->v9stat);
     complete_pdu(s, vs->pdu, err);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_wstat_post_rename(V9fsState *s, V9fsWstatState *vs, int err)
@@ -2624,7 +2624,7 @@
 out:
     v9fs_stat_free(&vs->v9stat);
     complete_pdu(s, vs->pdu, err);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static int v9fs_complete_rename(V9fsState *s, V9fsFidState *fidp,
@@ -2643,7 +2643,7 @@
         }
         BUG_ON(dirfidp->fid_type != P9_FID_NONE);
 
-        new_name = qemu_mallocz(dirfidp->path.size + name->size + 2);
+        new_name = g_malloc0(dirfidp->path.size + name->size + 2);
 
         strcpy(new_name, dirfidp->path.data);
         strcat(new_name, "/");
@@ -2656,7 +2656,7 @@
         } else {
             end = old_name;
         }
-        new_name = qemu_mallocz(end - old_name + name->size + 1);
+        new_name = g_malloc0(end - old_name + name->size + 1);
 
         strncat(new_name, old_name, end - old_name);
         strncat(new_name + (end - old_name), name->data, name->size);
@@ -2710,7 +2710,7 @@
 out:
     v9fs_stat_free(&vs->v9stat);
     complete_pdu(s, vs->pdu, err);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_rename(void *opaque)
@@ -2760,7 +2760,7 @@
 out:
     v9fs_stat_free(&vs->v9stat);
     complete_pdu(s, vs->pdu, err);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_wstat_post_chmod(V9fsState *s, V9fsWstatState *vs, int err)
@@ -2795,7 +2795,7 @@
 out:
     v9fs_stat_free(&vs->v9stat);
     complete_pdu(s, vs->pdu, err);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_wstat_post_fsync(V9fsState *s, V9fsWstatState *vs, int err)
@@ -2805,7 +2805,7 @@
     }
     v9fs_stat_free(&vs->v9stat);
     complete_pdu(s, vs->pdu, err);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_wstat_post_lstat(V9fsState *s, V9fsWstatState *vs, int err)
@@ -2836,7 +2836,7 @@
 out:
     v9fs_stat_free(&vs->v9stat);
     complete_pdu(s, vs->pdu, err);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static void v9fs_wstat(void *opaque)
@@ -2847,7 +2847,7 @@
     V9fsWstatState *vs;
     int err = 0;
 
-    vs = qemu_malloc(sizeof(*vs));
+    vs = g_malloc(sizeof(*vs));
     vs->pdu = pdu;
     vs->offset = 7;
 
@@ -2878,7 +2878,7 @@
 out:
     v9fs_stat_free(&vs->v9stat);
     complete_pdu(s, vs->pdu, err);
-    qemu_free(vs);
+    g_free(vs);
 }
 
 static int v9fs_fill_statfs(V9fsState *s, V9fsPDU *pdu, struct statfs *stbuf)
@@ -3014,11 +3014,11 @@
     int32_t fid, err = 0;
     V9fsLockState *vs;
 
-    vs = qemu_mallocz(sizeof(*vs));
+    vs = g_malloc0(sizeof(*vs));
     vs->pdu = pdu;
     vs->offset = 7;
 
-    vs->flock = qemu_malloc(sizeof(*vs->flock));
+    vs->flock = g_malloc(sizeof(*vs->flock));
     pdu_unmarshal(vs->pdu, vs->offset, "dbdqqds", &fid, &vs->flock->type,
                 &vs->flock->flags, &vs->flock->start, &vs->flock->length,
                             &vs->flock->proc_id, &vs->flock->client_id);
@@ -3045,8 +3045,8 @@
 out:
     vs->offset += pdu_marshal(vs->pdu, vs->offset, "b", vs->status);
     complete_pdu(s, vs->pdu, err);
-    qemu_free(vs->flock);
-    qemu_free(vs);
+    g_free(vs->flock);
+    g_free(vs);
 }
 
 /*
@@ -3061,11 +3061,11 @@
     int32_t fid, err = 0;
     V9fsGetlockState *vs;
 
-    vs = qemu_mallocz(sizeof(*vs));
+    vs = g_malloc0(sizeof(*vs));
     vs->pdu = pdu;
     vs->offset = 7;
 
-    vs->glock = qemu_malloc(sizeof(*vs->glock));
+    vs->glock = g_malloc(sizeof(*vs->glock));
     pdu_unmarshal(vs->pdu, vs->offset, "dbqqds", &fid, &vs->glock->type,
                 &vs->glock->start, &vs->glock->length, &vs->glock->proc_id,
 		&vs->glock->client_id);
@@ -3087,8 +3087,8 @@
 		&vs->glock->client_id);
 out:
     complete_pdu(s, vs->pdu, err);
-    qemu_free(vs->glock);
-    qemu_free(vs);
+    g_free(vs->glock);
+    g_free(vs);
 }
 
 static void v9fs_mkdir(void *opaque)
@@ -3171,7 +3171,7 @@
         xattr_fidp->fid_type = P9_FID_XATTR;
         xattr_fidp->fs.xattr.copied_len = -1;
         if (size) {
-            xattr_fidp->fs.xattr.value = qemu_malloc(size);
+            xattr_fidp->fs.xattr.value = g_malloc(size);
             err = v9fs_co_llistxattr(s, &xattr_fidp->path,
                                      xattr_fidp->fs.xattr.value,
                                      xattr_fidp->fs.xattr.len);
@@ -3201,7 +3201,7 @@
         xattr_fidp->fid_type = P9_FID_XATTR;
         xattr_fidp->fs.xattr.copied_len = -1;
         if (size) {
-            xattr_fidp->fs.xattr.value = qemu_malloc(size);
+            xattr_fidp->fs.xattr.value = g_malloc(size);
             err = v9fs_co_lgetxattr(s, &xattr_fidp->path,
                                     &name, xattr_fidp->fs.xattr.value,
                                     xattr_fidp->fs.xattr.len);
@@ -3248,7 +3248,7 @@
     v9fs_string_init(&xattr_fidp->fs.xattr.name);
     v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name);
     if (size) {
-        xattr_fidp->fs.xattr.value = qemu_malloc(size);
+        xattr_fidp->fs.xattr.value = g_malloc(size);
     } else {
         xattr_fidp->fs.xattr.value = NULL;
     }
diff --git a/hw/acpi.c b/hw/acpi.c
index 79ec66c..d04b965 100644
--- a/hw/acpi.c
+++ b/hw/acpi.c
@@ -100,13 +100,13 @@
 
     if (!acpi_tables) {
         allen = sizeof(uint16_t);
-        acpi_tables = qemu_mallocz(allen);
+        acpi_tables = g_malloc0(allen);
     } else {
         allen = acpi_tables_len;
     }
 
     start = allen;
-    acpi_tables = qemu_realloc(acpi_tables, start + ACPI_TABLE_HDR_SIZE);
+    acpi_tables = g_realloc(acpi_tables, start + ACPI_TABLE_HDR_SIZE);
     allen += has_header ? ACPI_TABLE_PFX_SIZE : ACPI_TABLE_HDR_SIZE;
 
     /* now read in the data files, reallocating buffer as needed */
@@ -125,7 +125,7 @@
             if (r == 0) {
                 break;
             } else if (r > 0) {
-                acpi_tables = qemu_realloc(acpi_tables, allen + r);
+                acpi_tables = g_realloc(acpi_tables, allen + r);
                 memcpy(acpi_tables + allen, data, r);
                 allen += r;
             } else if (errno != EINTR) {
@@ -379,8 +379,8 @@
 void acpi_gpe_init(ACPIGPE *gpe, uint8_t len)
 {
     gpe->len = len;
-    gpe->sts = qemu_mallocz(len / 2);
-    gpe->en = qemu_mallocz(len / 2);
+    gpe->sts = g_malloc0(len / 2);
+    gpe->en = g_malloc0(len / 2);
 }
 
 void acpi_gpe_blk(ACPIGPE *gpe, uint32_t blk)
diff --git a/hw/adb.c b/hw/adb.c
index 7499cdc..8dedbf8 100644
--- a/hw/adb.c
+++ b/hw/adb.c
@@ -290,7 +290,7 @@
 {
     ADBDevice *d;
     KBDState *s;
-    s = qemu_mallocz(sizeof(KBDState));
+    s = g_malloc0(sizeof(KBDState));
     d = adb_register_device(bus, ADB_KEYBOARD, adb_kbd_request,
                             adb_kbd_reset, s);
     qemu_add_kbd_event_handler(adb_kbd_put_keycode, d);
@@ -447,7 +447,7 @@
     ADBDevice *d;
     MouseState *s;
 
-    s = qemu_mallocz(sizeof(MouseState));
+    s = g_malloc0(sizeof(MouseState));
     d = adb_register_device(bus, ADB_MOUSE, adb_mouse_request,
                             adb_mouse_reset, s);
     qemu_add_mouse_event_handler(adb_mouse_event, d, 0, "QEMU ADB Mouse");
diff --git a/hw/adlib.c b/hw/adlib.c
index 4d76d57..c1c46e3 100644
--- a/hw/adlib.c
+++ b/hw/adlib.c
@@ -268,7 +268,7 @@
 #endif
 
     if (s->mixbuf) {
-        qemu_free (s->mixbuf);
+        g_free (s->mixbuf);
     }
 
     s->active = 0;
@@ -323,7 +323,7 @@
     }
 
     s->samples = AUD_get_buffer_size_out (s->voice) >> SHIFT;
-    s->mixbuf = qemu_mallocz (s->samples << SHIFT);
+    s->mixbuf = g_malloc0 (s->samples << SHIFT);
 
     register_ioport_read (0x388, 4, 1, adlib_read, s);
     register_ioport_write (0x388, 4, 1, adlib_write, s);
diff --git a/hw/applesmc.c b/hw/applesmc.c
index 23ed328..c47b592 100644
--- a/hw/applesmc.c
+++ b/hw/applesmc.c
@@ -170,7 +170,7 @@
 {
     struct AppleSMCData *def;
 
-    def = qemu_mallocz(sizeof(struct AppleSMCData));
+    def = g_malloc0(sizeof(struct AppleSMCData));
     def->key = key;
     def->len = len;
     def->data = data;
diff --git a/hw/arm_timer.c b/hw/arm_timer.c
index fd9448f..f2832f9 100644
--- a/hw/arm_timer.c
+++ b/hw/arm_timer.c
@@ -159,7 +159,7 @@
     arm_timer_state *s;
     QEMUBH *bh;
 
-    s = (arm_timer_state *)qemu_mallocz(sizeof(arm_timer_state));
+    s = (arm_timer_state *)g_malloc0(sizeof(arm_timer_state));
     s->freq = freq;
     s->control = TIMER_CTRL_IE;
 
diff --git a/hw/axis_dev88.c b/hw/axis_dev88.c
index d9002a5..06200e2 100644
--- a/hw/axis_dev88.c
+++ b/hw/axis_dev88.c
@@ -315,7 +315,7 @@
     }
 
     /* Add the two ethernet blocks.  */
-    dma_eth = qemu_mallocz(sizeof dma_eth[0] * 4); /* Allocate 4 channels.  */
+    dma_eth = g_malloc0(sizeof dma_eth[0] * 4); /* Allocate 4 channels.  */
     etraxfs_eth_init(&nd_table[0], 0x30034000, 1, &dma_eth[0], &dma_eth[1]);
     if (nb_nics > 1) {
         etraxfs_eth_init(&nd_table[1], 0x30036000, 2, &dma_eth[2], &dma_eth[3]);
diff --git a/hw/baum.c b/hw/baum.c
index 33a22a7..26beeaf 100644
--- a/hw/baum.c
+++ b/hw/baum.c
@@ -559,7 +559,7 @@
     if (ret == -1 && (brlapi_errno != BRLAPI_ERROR_LIBCERR || errno != EINTR)) {
         brlapi_perror("baum: brlapi_readKey");
         brlapi__closeConnection(baum->brlapi);
-        qemu_free(baum->brlapi);
+        g_free(baum->brlapi);
         baum->brlapi = NULL;
     }
 }
@@ -571,9 +571,9 @@
     qemu_free_timer(baum->cellCount_timer);
     if (baum->brlapi) {
         brlapi__closeConnection(baum->brlapi);
-        qemu_free(baum->brlapi);
+        g_free(baum->brlapi);
     }
-    qemu_free(baum);
+    g_free(baum);
 }
 
 int chr_baum_init(QemuOpts *opts, CharDriverState **_chr)
@@ -586,8 +586,8 @@
 #endif
     int tty;
 
-    baum = qemu_mallocz(sizeof(BaumDriverState));
-    baum->chr = chr = qemu_mallocz(sizeof(CharDriverState));
+    baum = g_malloc0(sizeof(BaumDriverState));
+    baum->chr = chr = g_malloc0(sizeof(CharDriverState));
 
     chr->opaque = baum;
     chr->chr_write = baum_write;
@@ -595,7 +595,7 @@
     chr->chr_accept_input = baum_accept_input;
     chr->chr_close = baum_close;
 
-    handle = qemu_mallocz(brlapi_getHandleSize());
+    handle = g_malloc0(brlapi_getHandleSize());
     baum->brlapi = handle;
 
     baum->brlapi_fd = brlapi__openConnection(handle, NULL, NULL);
@@ -636,8 +636,8 @@
     qemu_free_timer(baum->cellCount_timer);
     brlapi__closeConnection(handle);
 fail_handle:
-    qemu_free(handle);
-    qemu_free(chr);
-    qemu_free(baum);
+    g_free(handle);
+    g_free(chr);
+    g_free(baum);
     return -EIO;
 }
diff --git a/hw/bitbang_i2c.c b/hw/bitbang_i2c.c
index 53e9c5c..431359d 100644
--- a/hw/bitbang_i2c.c
+++ b/hw/bitbang_i2c.c
@@ -171,7 +171,7 @@
 {
     bitbang_i2c_interface *s;
 
-    s = qemu_mallocz(sizeof(bitbang_i2c_interface));
+    s = g_malloc0(sizeof(bitbang_i2c_interface));
 
     s->bus = bus;
     s->last_data = 1;
diff --git a/hw/blizzard.c b/hw/blizzard.c
index c524550..b2c1b22 100644
--- a/hw/blizzard.c
+++ b/hw/blizzard.c
@@ -188,7 +188,7 @@
     s->data.len = s->bpp * s->data.dx * s->data.dy;
     s->data.pitch = s->data.dx;
     if (s->data.len > s->data.buflen) {
-        s->data.buf = qemu_realloc(s->data.buf, s->data.len);
+        s->data.buf = g_realloc(s->data.buf, s->data.len);
         s->data.buflen = s->data.len;
     }
     s->data.ptr = s->data.buf;
@@ -953,9 +953,9 @@
 
 void *s1d13745_init(qemu_irq gpio_int)
 {
-    BlizzardState *s = (BlizzardState *) qemu_mallocz(sizeof(*s));
+    BlizzardState *s = (BlizzardState *) g_malloc0(sizeof(*s));
 
-    s->fb = qemu_malloc(0x180000);
+    s->fb = g_malloc(0x180000);
 
     s->state = graphic_console_init(blizzard_update_display,
                                  blizzard_invalidate_display,
@@ -964,7 +964,7 @@
     switch (ds_get_bits_per_pixel(s->state)) {
     case 0:
         s->line_fn_tab[0] = s->line_fn_tab[1] =
-                qemu_mallocz(sizeof(blizzard_fn_t) * 0x10);
+                g_malloc0(sizeof(blizzard_fn_t) * 0x10);
         break;
     case 8:
         s->line_fn_tab[0] = blizzard_draw_fn_8;
diff --git a/hw/bt-hci-csr.c b/hw/bt-hci-csr.c
index d135ef4..0dcf897 100644
--- a/hw/bt-hci-csr.c
+++ b/hw/bt-hci-csr.c
@@ -434,7 +434,7 @@
 CharDriverState *uart_hci_init(qemu_irq wakeup)
 {
     struct csrhci_s *s = (struct csrhci_s *)
-            qemu_mallocz(sizeof(struct csrhci_s));
+            g_malloc0(sizeof(struct csrhci_s));
 
     s->chr.opaque = s;
     s->chr.chr_write = csrhci_write;
diff --git a/hw/bt-hci.c b/hw/bt-hci.c
index 41df24c..a3a7fb4 100644
--- a/hw/bt-hci.c
+++ b/hw/bt-hci.c
@@ -721,7 +721,7 @@
 static void bt_hci_connection_accept(struct bt_hci_s *hci,
                 struct bt_device_s *host)
 {
-    struct bt_hci_link_s *link = qemu_mallocz(sizeof(struct bt_hci_link_s));
+    struct bt_hci_link_s *link = g_malloc0(sizeof(struct bt_hci_link_s));
     evt_conn_complete params;
     uint16_t handle;
     uint8_t status = HCI_SUCCESS;
@@ -736,7 +736,7 @@
             tries);
 
     if (!tries) {
-        qemu_free(link);
+        g_free(link);
         bt_hci_connection_reject(hci, host, HCI_REJECTED_LIMITED_RESOURCES);
         status = HCI_NO_CONNECTION;
         goto complete;
@@ -893,7 +893,7 @@
 
     /* We are the slave, we get to clean this burden */
     link = (struct bt_hci_link_s *) btlink;
-    qemu_free(link);
+    g_free(link);
 
 complete:
     bt_hci_lmp_link_teardown(hci, handle);
@@ -928,7 +928,7 @@
     uint16_t handle = link->handle;
     evt_disconn_complete params;
 
-    qemu_free(link);
+    g_free(link);
 
     bt_hci_lmp_link_teardown(hci, handle);
 
@@ -1138,7 +1138,7 @@
     hci->device.inquiry_scan = 0;
     hci->device.page_scan = 0;
     if (hci->device.lmp_name)
-        qemu_free((void *) hci->device.lmp_name);
+        g_free((void *) hci->device.lmp_name);
     hci->device.lmp_name = NULL;
     hci->device.class[0] = 0x00;
     hci->device.class[1] = 0x00;
@@ -1816,8 +1816,8 @@
         LENGTH_CHECK(change_local_name);
 
         if (hci->device.lmp_name)
-            qemu_free((void *) hci->device.lmp_name);
-        hci->device.lmp_name = qemu_strndup(PARAM(change_local_name, name),
+            g_free((void *) hci->device.lmp_name);
+        hci->device.lmp_name = g_strndup(PARAM(change_local_name, name),
                         sizeof(PARAM(change_local_name, name)));
         bt_hci_event_complete_status(hci, HCI_SUCCESS);
         break;
@@ -2143,7 +2143,7 @@
 
 struct HCIInfo *bt_new_hci(struct bt_scatternet_s *net)
 {
-    struct bt_hci_s *s = qemu_mallocz(sizeof(struct bt_hci_s));
+    struct bt_hci_s *s = g_malloc0(sizeof(struct bt_hci_s));
 
     s->lm.inquiry_done = qemu_new_timer_ns(vm_clock, bt_hci_inquiry_done, s);
     s->lm.inquiry_next = qemu_new_timer_ns(vm_clock, bt_hci_inquiry_next, s);
@@ -2188,7 +2188,7 @@
     bt_device_done(&hci->device);
 
     if (hci->device.lmp_name)
-        qemu_free((void *) hci->device.lmp_name);
+        g_free((void *) hci->device.lmp_name);
 
     /* Be gentle and send DISCONNECT to all connected peers and those
      * currently waiting for us to accept or reject a connection request.
@@ -2217,5 +2217,5 @@
     qemu_free_timer(hci->lm.inquiry_next);
     qemu_free_timer(hci->conn_accept_timer);
 
-    qemu_free(hci);
+    g_free(hci);
 }
diff --git a/hw/bt-hid.c b/hw/bt-hid.c
index 5f1afe3..8d7a3da 100644
--- a/hw/bt-hid.c
+++ b/hw/bt-hid.c
@@ -504,7 +504,7 @@
 
     hid_free(&hid->hid);
 
-    qemu_free(hid);
+    g_free(hid);
 }
 
 enum peripheral_minor_class {
@@ -517,7 +517,7 @@
 static struct bt_device_s *bt_hid_init(struct bt_scatternet_s *net,
                                        enum peripheral_minor_class minor)
 {
-    struct bt_hid_device_s *s = qemu_mallocz(sizeof(*s));
+    struct bt_hid_device_s *s = g_malloc0(sizeof(*s));
     uint32_t class =
             /* Format type */
             (0 << 0) |
diff --git a/hw/bt-l2cap.c b/hw/bt-l2cap.c
index 7e2f668..2ccba60 100644
--- a/hw/bt-l2cap.c
+++ b/hw/bt-l2cap.c
@@ -410,7 +410,7 @@
 
         if (psm_info) {
             /* Device supports this use-case.  */
-            ch = qemu_mallocz(sizeof(*ch));
+            ch = g_malloc0(sizeof(*ch));
             ch->params.sdu_out = l2cap_bframe_out;
             ch->params.sdu_submit = l2cap_bframe_submit;
             ch->frame_in = l2cap_bframe_in;
@@ -428,7 +428,7 @@
                 result = L2CAP_CR_SUCCESS;
                 status = L2CAP_CS_NO_INFO;
             } else {
-                qemu_free(ch);
+                g_free(ch);
 
                 result = L2CAP_CR_NO_MEM;
                 status = L2CAP_CS_NO_INFO;
@@ -473,7 +473,7 @@
         l2cap->cid[cid] = NULL;
 
         ch->params.close(ch->params.opaque);
-        qemu_free(ch);
+        g_free(ch);
     }
 
     l2cap_disconnection_response(l2cap, cid, source_cid);
@@ -1218,13 +1218,13 @@
     for (cid = L2CAP_CID_ALLOC; cid < L2CAP_CID_MAX; cid ++)
         if (l2cap->cid[cid]) {
             l2cap->cid[cid]->params.close(l2cap->cid[cid]->params.opaque);
-            qemu_free(l2cap->cid[cid]);
+            g_free(l2cap->cid[cid]);
         }
 
     if (l2cap->role)
-        qemu_free(l2cap);
+        g_free(l2cap);
     else
-        qemu_free(l2cap->link);
+        g_free(l2cap->link);
 }
 
 /* L2CAP glue to lower layers in bluetooth stack (LMP) */
@@ -1236,7 +1236,7 @@
 
     /* Always accept - we only get called if (dev->device->page_scan).  */
 
-    l2cap = qemu_mallocz(sizeof(struct slave_l2cap_instance_s));
+    l2cap = g_malloc0(sizeof(struct slave_l2cap_instance_s));
     l2cap->link.slave = &dev->device;
     l2cap->link.host = link->host;
     l2cap_init(&l2cap->l2cap, &l2cap->link, 0);
@@ -1257,7 +1257,7 @@
         return;
     }
 
-    l2cap = qemu_mallocz(sizeof(struct l2cap_instance_s));
+    l2cap = g_malloc0(sizeof(struct l2cap_instance_s));
     l2cap_init(l2cap, link, 1);
 
     link->acl_mode = acl_active;
@@ -1353,7 +1353,7 @@
         exit(-1);
     }
 
-    new_psm = qemu_mallocz(sizeof(*new_psm));
+    new_psm = g_malloc0(sizeof(*new_psm));
     new_psm->psm = psm;
     new_psm->min_mtu = min_mtu;
     new_psm->new_channel = new_channel;
diff --git a/hw/bt-sdp.c b/hw/bt-sdp.c
index cdf2d95..3e390ab 100644
--- a/hw/bt-sdp.c
+++ b/hw/bt-sdp.c
@@ -567,12 +567,12 @@
     int i;
 
     for (i = 0; i < sdp->services; i ++) {
-        qemu_free(sdp->service_list[i].attribute_list->pair);
-        qemu_free(sdp->service_list[i].attribute_list);
-        qemu_free(sdp->service_list[i].uuid);
+        g_free(sdp->service_list[i].attribute_list->pair);
+        g_free(sdp->service_list[i].attribute_list);
+        g_free(sdp->service_list[i].uuid);
     }
-    qemu_free(sdp->service_list);
-    qemu_free(sdp);
+    g_free(sdp->service_list);
+    g_free(sdp);
 }
 
 struct sdp_def_service_s {
@@ -709,10 +709,10 @@
     }
     record->uuids = 1 << ffs(record->uuids - 1);
     record->attribute_list =
-            qemu_mallocz(record->attributes * sizeof(*record->attribute_list));
+            g_malloc0(record->attributes * sizeof(*record->attribute_list));
     record->uuid =
-            qemu_mallocz(record->uuids * sizeof(*record->uuid));
-    data = qemu_malloc(len);
+            g_malloc0(record->uuids * sizeof(*record->uuid));
+    data = g_malloc(len);
 
     record->attributes = 0;
     uuid = record->uuid;
@@ -753,7 +753,7 @@
     while (service[sdp->services])
         sdp->services ++;
     sdp->service_list =
-            qemu_mallocz(sdp->services * sizeof(*sdp->service_list));
+            g_malloc0(sdp->services * sizeof(*sdp->service_list));
 
     sdp->services = 0;
     while (*service) {
@@ -942,7 +942,7 @@
 static int bt_l2cap_sdp_new_ch(struct bt_l2cap_device_s *dev,
                 struct bt_l2cap_conn_params_s *params)
 {
-    struct bt_l2cap_sdp_state_s *sdp = qemu_mallocz(sizeof(*sdp));
+    struct bt_l2cap_sdp_state_s *sdp = g_malloc0(sizeof(*sdp));
     struct sdp_def_service_s *services[] = {
         &sdp_service_sdp_s,
         &sdp_service_hid_s,
diff --git a/hw/bt.c b/hw/bt.c
index 34bf004..dc99fc2 100644
--- a/hw/bt.c
+++ b/hw/bt.c
@@ -54,7 +54,7 @@
 /* Slaves that don't hold any additional per link state can use these */
 static void bt_dummy_lmp_connection_request(struct bt_link_s *req)
 {
-    struct bt_link_s *link = qemu_mallocz(sizeof(struct bt_link_s));
+    struct bt_link_s *link = g_malloc0(sizeof(struct bt_link_s));
 
     link->slave = req->slave;
     link->host = req->host;
@@ -65,13 +65,13 @@
 
 static void bt_dummy_lmp_disconnect_slave(struct bt_link_s *link)
 {
-    qemu_free(link);
+    g_free(link);
 }
 
 static void bt_dummy_destroy(struct bt_device_s *device)
 {
     bt_device_done(device);
-    qemu_free(device);
+    g_free(device);
 }
 
 static int bt_dev_idx = 0;
diff --git a/hw/cbus.c b/hw/cbus.c
index 8ae24e0..7216899 100644
--- a/hw/cbus.c
+++ b/hw/cbus.c
@@ -132,7 +132,7 @@
 
 CBus *cbus_init(qemu_irq dat)
 {
-    CBusPriv *s = (CBusPriv *) qemu_mallocz(sizeof(*s));
+    CBusPriv *s = (CBusPriv *) g_malloc0(sizeof(*s));
 
     s->dat_out = dat;
     s->cbus.clk = qemu_allocate_irqs(cbus_clk, s, 1)[0];
@@ -387,7 +387,7 @@
 
 void *retu_init(qemu_irq irq, int vilma)
 {
-    CBusRetu *s = (CBusRetu *) qemu_mallocz(sizeof(*s));
+    CBusRetu *s = (CBusRetu *) g_malloc0(sizeof(*s));
 
     s->irq = irq;
     s->irqen = 0xffff;
@@ -603,7 +603,7 @@
 
 void *tahvo_init(qemu_irq irq, int betty)
 {
-    CBusTahvo *s = (CBusTahvo *) qemu_mallocz(sizeof(*s));
+    CBusTahvo *s = (CBusTahvo *) g_malloc0(sizeof(*s));
 
     s->irq = irq;
     s->irqen = 0xffff;
diff --git a/hw/ccid-card-emulated.c b/hw/ccid-card-emulated.c
index 4762e85..092301b 100644
--- a/hw/ccid-card-emulated.c
+++ b/hw/ccid-card-emulated.c
@@ -135,7 +135,7 @@
     const uint8_t *apdu, uint32_t len)
 {
     EmulatedState *card = DO_UPCAST(EmulatedState, base, base);
-    EmulEvent *event = (EmulEvent *)qemu_malloc(sizeof(EmulEvent) + len);
+    EmulEvent *event = (EmulEvent *)g_malloc(sizeof(EmulEvent) + len);
 
     assert(event);
     event->p.data.type = EMUL_GUEST_APDU;
@@ -169,7 +169,7 @@
 
 static void emulated_push_type(EmulatedState *card, uint32_t type)
 {
-    EmulEvent *event = (EmulEvent *)qemu_malloc(sizeof(EmulEvent));
+    EmulEvent *event = (EmulEvent *)g_malloc(sizeof(EmulEvent));
 
     assert(event);
     event->p.gen.type = type;
@@ -178,7 +178,7 @@
 
 static void emulated_push_error(EmulatedState *card, uint64_t code)
 {
-    EmulEvent *event = (EmulEvent *)qemu_malloc(sizeof(EmulEvent));
+    EmulEvent *event = (EmulEvent *)g_malloc(sizeof(EmulEvent));
 
     assert(event);
     event->p.error.type = EMUL_ERROR;
@@ -189,7 +189,7 @@
 static void emulated_push_data_type(EmulatedState *card, uint32_t type,
     const uint8_t *data, uint32_t len)
 {
-    EmulEvent *event = (EmulEvent *)qemu_malloc(sizeof(EmulEvent) + len);
+    EmulEvent *event = (EmulEvent *)g_malloc(sizeof(EmulEvent) + len);
 
     assert(event);
     event->p.data.type = type;
@@ -249,12 +249,12 @@
             QSIMPLEQ_REMOVE_HEAD(&card->guest_apdu_list, entry);
             if (event->p.data.type != EMUL_GUEST_APDU) {
                 DPRINTF(card, 1, "unexpected message in handle_apdu_thread\n");
-                qemu_free(event);
+                g_free(event);
                 continue;
             }
             if (card->reader == NULL) {
                 DPRINTF(card, 1, "reader is NULL\n");
-                qemu_free(event);
+                g_free(event);
                 continue;
             }
             recv_len = sizeof(recv_data);
@@ -267,7 +267,7 @@
             } else {
                 emulated_push_error(card, reader_status);
             }
-            qemu_free(event);
+            g_free(event);
         }
         qemu_mutex_unlock(&card->vreader_mutex);
     }
@@ -401,7 +401,7 @@
             DPRINTF(card, 2, "unexpected event\n");
             break;
         }
-        qemu_free(event);
+        g_free(event);
     }
     QSIMPLEQ_INIT(&card->event_list);
     qemu_mutex_unlock(&card->event_list_mutex);
diff --git a/hw/cirrus_vga.c b/hw/cirrus_vga.c
index b489309..0f91112 100644
--- a/hw/cirrus_vga.c
+++ b/hw/cirrus_vga.c
@@ -174,8 +174,6 @@
 
 #define CIRRUS_PNPMMIO_SIZE         0x1000
 
-#define ABS(a) ((signed)(a) > 0 ? a : -a)
-
 #define BLTUNSAFE(s) \
     ( \
         ( /* check dst is within bounds */ \
@@ -2372,7 +2370,7 @@
         memory_region_del_subregion(&s->low_mem_container,
                                     s->cirrus_bank[bank]);
         memory_region_destroy(s->cirrus_bank[bank]);
-        qemu_free(s->cirrus_bank[bank]);
+        g_free(s->cirrus_bank[bank]);
         s->cirrus_bank[bank] = NULL;
     }
 }
@@ -2387,7 +2385,7 @@
         && !((s->vga.gr[0x0B] & 0x14) == 0x14)
         && !(s->vga.gr[0x0B] & 0x02)) {
 
-        mr = qemu_malloc(sizeof(*mr));
+        mr = g_malloc(sizeof(*mr));
         memory_region_init_alias(mr, names[bank], &s->vga.vram,
                                  s->cirrus_bank_base[bank], 0x8000);
         memory_region_add_subregion_overlap(
@@ -2903,7 +2901,7 @@
 {
     CirrusVGAState *s;
 
-    s = qemu_mallocz(sizeof(CirrusVGAState));
+    s = g_malloc0(sizeof(CirrusVGAState));
 
     vga_common_init(&s->vga, VGA_RAM_SIZE);
     cirrus_init_common(s, CIRRUS_ID_CLGD5430, 0);
diff --git a/hw/dp8393x.c b/hw/dp8393x.c
index 1bcd8ee..f66844b 100644
--- a/hw/dp8393x.c
+++ b/hw/dp8393x.c
@@ -870,7 +870,7 @@
     qemu_del_timer(s->watchdog);
     qemu_free_timer(s->watchdog);
 
-    qemu_free(s);
+    g_free(s);
 }
 
 static NetClientInfo net_dp83932_info = {
@@ -889,7 +889,7 @@
 
     qemu_check_nic_model(nd, "dp83932");
 
-    s = qemu_mallocz(sizeof(dp8393xState));
+    s = g_malloc0(sizeof(dp8393xState));
 
     s->mem_opaque = mem_opaque;
     s->memory_rw = memory_rw;
diff --git a/hw/ds1225y.c b/hw/ds1225y.c
index 662d7b5..9875c44 100644
--- a/hw/ds1225y.c
+++ b/hw/ds1225y.c
@@ -146,7 +146,7 @@
     QEMUFile *file;
     int s_io;
 
-    s->contents = qemu_mallocz(s->chip_size);
+    s->contents = g_malloc0(s->chip_size);
 
     s_io = cpu_register_io_memory(nvram_read, nvram_write, s,
                                   DEVICE_NATIVE_ENDIAN);
diff --git a/hw/eepro100.c b/hw/eepro100.c
index a636d30..4e3c52f 100644
--- a/hw/eepro100.c
+++ b/hw/eepro100.c
@@ -1901,7 +1901,7 @@
 
     qemu_register_reset(nic_reset, s);
 
-    s->vmstate = qemu_malloc(sizeof(vmstate_eepro100));
+    s->vmstate = g_malloc(sizeof(vmstate_eepro100));
     memcpy(s->vmstate, &vmstate_eepro100, sizeof(vmstate_eepro100));
     s->vmstate->name = s->nic->nc.model;
     vmstate_register(&pci_dev->qdev, -1, s->vmstate, s);
diff --git a/hw/eeprom93xx.c b/hw/eeprom93xx.c
index 7b21f98..4c7158d 100644
--- a/hw/eeprom93xx.c
+++ b/hw/eeprom93xx.c
@@ -310,7 +310,7 @@
             addrbits = 6;
     }
 
-    eeprom = (eeprom_t *)qemu_mallocz(sizeof(*eeprom) + nwords * 2);
+    eeprom = (eeprom_t *)g_malloc0(sizeof(*eeprom) + nwords * 2);
     eeprom->size = nwords;
     eeprom->addrbits = addrbits;
     /* Output DO is tristate, read results in 1. */
@@ -325,7 +325,7 @@
     /* Destroy EEPROM. */
     logout("eeprom = 0x%p\n", eeprom);
     vmstate_unregister(dev, &vmstate_eeprom, eeprom);
-    qemu_free(eeprom);
+    g_free(eeprom);
 }
 
 uint16_t *eeprom93xx_data(eeprom_t *eeprom)
diff --git a/hw/elf_ops.h b/hw/elf_ops.h
index 0bd7235..6af357f 100644
--- a/hw/elf_ops.h
+++ b/hw/elf_ops.h
@@ -150,7 +150,7 @@
         i++;
     }
     if (nsyms) {
-        syms = qemu_realloc(syms, nsyms * sizeof(*syms));
+        syms = g_realloc(syms, nsyms * sizeof(*syms));
 
         qsort(syms, nsyms, sizeof(*syms), glue(symcmp, SZ));
         for (i = 0; i < nsyms - 1; i++) {
@@ -159,7 +159,7 @@
             }
         }
     } else {
-        qemu_free(syms);
+        g_free(syms);
         syms = NULL;
     }
 
@@ -173,19 +173,19 @@
         goto fail;
 
     /* Commit */
-    s = qemu_mallocz(sizeof(*s));
+    s = g_malloc0(sizeof(*s));
     s->lookup_symbol = glue(lookup_symbol, SZ);
     glue(s->disas_symtab.elf, SZ) = syms;
     s->disas_num_syms = nsyms;
     s->disas_strtab = str;
     s->next = syminfos;
     syminfos = s;
-    qemu_free(shdr_table);
+    g_free(shdr_table);
     return 0;
  fail:
-    qemu_free(syms);
-    qemu_free(str);
-    qemu_free(shdr_table);
+    g_free(syms);
+    g_free(str);
+    g_free(shdr_table);
     return -1;
 }
 
@@ -238,7 +238,7 @@
 
     size = ehdr.e_phnum * sizeof(phdr[0]);
     lseek(fd, ehdr.e_phoff, SEEK_SET);
-    phdr = qemu_mallocz(size);
+    phdr = g_malloc0(size);
     if (!phdr)
         goto fail;
     if (read(fd, phdr, size) != size)
@@ -256,7 +256,7 @@
         if (ph->p_type == PT_LOAD) {
             mem_size = ph->p_memsz;
             /* XXX: avoid allocating */
-            data = qemu_mallocz(mem_size);
+            data = g_malloc0(mem_size);
             if (ph->p_filesz > 0) {
                 if (lseek(fd, ph->p_offset, SEEK_SET) < 0)
                     goto fail;
@@ -280,18 +280,18 @@
             if ((addr + mem_size) > high)
                 high = addr + mem_size;
 
-            qemu_free(data);
+            g_free(data);
             data = NULL;
         }
     }
-    qemu_free(phdr);
+    g_free(phdr);
     if (lowaddr)
         *lowaddr = (uint64_t)(elf_sword)low;
     if (highaddr)
         *highaddr = (uint64_t)(elf_sword)high;
     return total_size;
  fail:
-    qemu_free(data);
-    qemu_free(phdr);
+    g_free(data);
+    g_free(phdr);
     return -1;
 }
diff --git a/hw/etraxfs_dma.c b/hw/etraxfs_dma.c
index c205ec1..e8ad9e6 100644
--- a/hw/etraxfs_dma.c
+++ b/hw/etraxfs_dma.c
@@ -743,12 +743,12 @@
 {
 	struct fs_dma_ctrl *ctrl = NULL;
 
-	ctrl = qemu_mallocz(sizeof *ctrl);
+	ctrl = g_malloc0(sizeof *ctrl);
 
         ctrl->bh = qemu_bh_new(DMA_run, ctrl);
 
 	ctrl->nr_channels = nr_channels;
-	ctrl->channels = qemu_mallocz(sizeof ctrl->channels[0] * nr_channels);
+	ctrl->channels = g_malloc0(sizeof ctrl->channels[0] * nr_channels);
 
 	ctrl->map = cpu_register_io_memory(dma_read, dma_write, ctrl, DEVICE_NATIVE_ENDIAN);
 	cpu_register_physical_memory(base, nr_channels * 0x2000, ctrl->map);
diff --git a/hw/etraxfs_eth.c b/hw/etraxfs_eth.c
index 92d4eca..48de6dc 100644
--- a/hw/etraxfs_eth.c
+++ b/hw/etraxfs_eth.c
@@ -574,7 +574,7 @@
 	eth->dma_out->client.opaque = NULL;
 	eth->dma_in->client.opaque = NULL;
 	eth->dma_in->client.pull = NULL;
-        qemu_free(eth);
+        g_free(eth);
 }
 
 static NetClientInfo net_etraxfs_info = {
diff --git a/hw/fw_cfg.c b/hw/fw_cfg.c
index e4847b7..663ad80 100644
--- a/hw/fw_cfg.c
+++ b/hw/fw_cfg.c
@@ -177,14 +177,14 @@
         /* probing the file */
         fp = probe_splashfile(filename, &file_size, &file_type);
         if (fp == NULL) {
-            qemu_free(filename);
+            g_free(filename);
             return;
         }
         /* loading file data */
         if (boot_splash_filedata != NULL) {
-            qemu_free(boot_splash_filedata);
+            g_free(boot_splash_filedata);
         }
-        boot_splash_filedata = qemu_malloc(file_size);
+        boot_splash_filedata = g_malloc(file_size);
         boot_splash_filedata_size = file_size;
         fseek(fp, 0L, SEEK_SET);
         fop_ret = fread(boot_splash_filedata, 1, file_size, fp);
@@ -203,7 +203,7 @@
             fw_cfg_add_file(s, "bootsplash.bmp",
                     boot_splash_filedata, boot_splash_filedata_size);
         }
-        qemu_free(filename);
+        g_free(filename);
     }
 }
 
@@ -385,7 +385,7 @@
 {
     uint16_t *copy;
 
-    copy = qemu_malloc(sizeof(value));
+    copy = g_malloc(sizeof(value));
     *copy = cpu_to_le16(value);
     return fw_cfg_add_bytes(s, key, (uint8_t *)copy, sizeof(value));
 }
@@ -394,7 +394,7 @@
 {
     uint32_t *copy;
 
-    copy = qemu_malloc(sizeof(value));
+    copy = g_malloc(sizeof(value));
     *copy = cpu_to_le32(value);
     return fw_cfg_add_bytes(s, key, (uint8_t *)copy, sizeof(value));
 }
@@ -403,7 +403,7 @@
 {
     uint64_t *copy;
 
-    copy = qemu_malloc(sizeof(value));
+    copy = g_malloc(sizeof(value));
     *copy = cpu_to_le64(value);
     return fw_cfg_add_bytes(s, key, (uint8_t *)copy, sizeof(value));
 }
@@ -436,7 +436,7 @@
 
     if (!s->files) {
         int dsize = sizeof(uint32_t) + sizeof(FWCfgFile) * FW_CFG_FILE_SLOTS;
-        s->files = qemu_mallocz(dsize);
+        s->files = g_malloc0(dsize);
         fw_cfg_add_bytes(s, FW_CFG_FILE_DIR, (uint8_t*)s->files, dsize);
     }
 
diff --git a/hw/g364fb.c b/hw/g364fb.c
index a41e988..b3020c5 100644
--- a/hw/g364fb.c
+++ b/hw/g364fb.c
@@ -590,7 +590,7 @@
     G364State *s;
     int io_ctrl;
 
-    s = qemu_mallocz(sizeof(G364State));
+    s = g_malloc0(sizeof(G364State));
 
     s->vram_size = 8 * 1024 * 1024;
     s->vram_offset = qemu_ram_alloc(NULL, "g364fb.vram", s->vram_size);
diff --git a/hw/grlib_gptimer.c b/hw/grlib_gptimer.c
index 99e9033..85869b9 100644
--- a/hw/grlib_gptimer.c
+++ b/hw/grlib_gptimer.c
@@ -345,7 +345,7 @@
     assert(unit->nr_timers > 0);
     assert(unit->nr_timers <= GPTIMER_MAX_TIMERS);
 
-    unit->timers = qemu_mallocz(sizeof unit->timers[0] * unit->nr_timers);
+    unit->timers = g_malloc0(sizeof unit->timers[0] * unit->nr_timers);
 
     for (i = 0; i < unit->nr_timers; i++) {
         GPTimer *timer = &unit->timers[i];
diff --git a/hw/grlib_irqmp.c b/hw/grlib_irqmp.c
index b8738fc..9490a78 100644
--- a/hw/grlib_irqmp.c
+++ b/hw/grlib_irqmp.c
@@ -345,7 +345,7 @@
                                         grlib_irqmp_write,
                                         irqmp, DEVICE_NATIVE_ENDIAN);
 
-    irqmp->state = qemu_mallocz(sizeof *irqmp->state);
+    irqmp->state = g_malloc0(sizeof *irqmp->state);
 
     if (irqmp_regs < 0) {
         return -1;
diff --git a/hw/gus.c b/hw/gus.c
index ff9e7c7..37e543a 100644
--- a/hw/gus.c
+++ b/hw/gus.c
@@ -260,7 +260,7 @@
 
     s->shift = 2;
     s->samples = AUD_get_buffer_size_out (s->voice) >> s->shift;
-    s->mixbuf = qemu_mallocz (s->samples << s->shift);
+    s->mixbuf = g_malloc0 (s->samples << s->shift);
 
     register_ioport_write (s->port, 1, 1, gus_writeb, s);
     register_ioport_write (s->port, 1, 2, gus_writew, s);
diff --git a/hw/heathrow_pic.c b/hw/heathrow_pic.c
index 3ba0b0e..51996ab 100644
--- a/hw/heathrow_pic.c
+++ b/hw/heathrow_pic.c
@@ -202,7 +202,7 @@
 {
     HeathrowPICS *s;
 
-    s = qemu_mallocz(sizeof(HeathrowPICS));
+    s = g_malloc0(sizeof(HeathrowPICS));
     /* only 1 CPU */
     s->irqs = irqs[0];
     memory_region_init_io(&s->mem, &heathrow_pic_ops, s,
diff --git a/hw/i8259.c b/hw/i8259.c
index 84d330d..c0b96ab 100644
--- a/hw/i8259.c
+++ b/hw/i8259.c
@@ -526,7 +526,7 @@
 {
     PicState2 *s;
 
-    s = qemu_mallocz(sizeof(PicState2));
+    s = g_malloc0(sizeof(PicState2));
     pic_init1(0x20, 0x4d0, &s->pics[0]);
     pic_init1(0xa0, 0x4d1, &s->pics[1]);
     s->pics[0].elcr_mask = 0xf8;
diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c
index e207ca0..29521ba 100644
--- a/hw/ide/ahci.c
+++ b/hw/ide/ahci.c
@@ -1123,7 +1123,7 @@
     int i;
 
     s->ports = ports;
-    s->dev = qemu_mallocz(sizeof(AHCIDevice) * ports);
+    s->dev = g_malloc0(sizeof(AHCIDevice) * ports);
     ahci_reg_init(s);
     /* XXX BAR size should be 1k, but that breaks, so bump it to 4k for now */
     memory_region_init_io(&s->mem, &ahci_mem_ops, s, "ahci", 0x1000);
@@ -1146,7 +1146,7 @@
 void ahci_uninit(AHCIState *s)
 {
     memory_region_destroy(&s->mem);
-    qemu_free(s->dev);
+    g_free(s->dev);
 }
 
 void ahci_reset(void *opaque)
diff --git a/hw/ide/macio.c b/hw/ide/macio.c
index 7ee35e9..44fb3fe 100644
--- a/hw/ide/macio.c
+++ b/hw/ide/macio.c
@@ -325,7 +325,7 @@
 {
     MACIOIDEState *d;
 
-    d = qemu_mallocz(sizeof(MACIOIDEState));
+    d = g_malloc0(sizeof(MACIOIDEState));
     ide_init2_with_non_qdev_drives(&d->bus, hd_table[0], hd_table[1], irq);
 
     if (dbdma)
diff --git a/hw/ide/microdrive.c b/hw/ide/microdrive.c
index 9fbbf0e..91c0e3c 100644
--- a/hw/ide/microdrive.c
+++ b/hw/ide/microdrive.c
@@ -531,7 +531,7 @@
 
 PCMCIACardState *dscm1xxxx_init(DriveInfo *bdrv)
 {
-    MicroDriveState *md = (MicroDriveState *) qemu_mallocz(sizeof(MicroDriveState));
+    MicroDriveState *md = (MicroDriveState *) g_malloc0(sizeof(MicroDriveState));
     md->card.state = md;
     md->card.attach = dscm1xxxx_attach;
     md->card.detach = dscm1xxxx_detach;
@@ -542,7 +542,7 @@
                                    qemu_allocate_irqs(md_set_irq, md, 1)[0]);
     md->bus.ifs[0].drive_kind = IDE_CFATA;
     md->bus.ifs[0].mdata_size = METADATA_SIZE;
-    md->bus.ifs[0].mdata_storage = (uint8_t *) qemu_mallocz(METADATA_SIZE);
+    md->bus.ifs[0].mdata_storage = (uint8_t *) g_malloc0(METADATA_SIZE);
 
     vmstate_register(NULL, -1, &vmstate_microdrive, md);
 
diff --git a/hw/ide/mmio.c b/hw/ide/mmio.c
index 10f6f40..132b751 100644
--- a/hw/ide/mmio.c
+++ b/hw/ide/mmio.c
@@ -121,7 +121,7 @@
                     qemu_irq irq, int shift,
                     DriveInfo *hd0, DriveInfo *hd1)
 {
-    MMIOState *s = qemu_mallocz(sizeof(MMIOState));
+    MMIOState *s = g_malloc0(sizeof(MMIOState));
     int mem1, mem2;
 
     ide_init2_with_non_qdev_drives(&s->bus, hd0, hd1, irq);
diff --git a/hw/ide/qdev.c b/hw/ide/qdev.c
index 6bd8d20..4207127 100644
--- a/hw/ide/qdev.c
+++ b/hw/ide/qdev.c
@@ -148,10 +148,10 @@
     }
 
     if (!dev->version) {
-        dev->version = qemu_strdup(s->version);
+        dev->version = g_strdup(s->version);
     }
     if (!dev->serial) {
-        dev->serial = qemu_strdup(s->drive_serial_str);
+        dev->serial = g_strdup(s->drive_serial_str);
     }
 
     add_boot_device_path(dev->conf.bootindex, &dev->qdev,
diff --git a/hw/intel-hda.c b/hw/intel-hda.c
index fa56a92..4272204 100644
--- a/hw/intel-hda.c
+++ b/hw/intel-hda.c
@@ -467,8 +467,8 @@
 
     addr = intel_hda_addr(st->bdlp_lbase, st->bdlp_ubase);
     st->bentries = st->lvi +1;
-    qemu_free(st->bpl);
-    st->bpl = qemu_malloc(sizeof(bpl) * st->bentries);
+    g_free(st->bpl);
+    st->bpl = g_malloc(sizeof(bpl) * st->bentries);
     for (i = 0; i < st->bentries; i++, addr += 16) {
         cpu_physical_memory_read(addr, buf, 16);
         st->bpl[i].addr  = le64_to_cpu(*(uint64_t *)buf);
diff --git a/hw/irq.c b/hw/irq.c
index 4035a8c..60eabe8 100644
--- a/hw/irq.c
+++ b/hw/irq.c
@@ -44,8 +44,8 @@
     struct IRQState *p;
     int i;
 
-    s = (qemu_irq *)qemu_mallocz(sizeof(qemu_irq) * n);
-    p = (struct IRQState *)qemu_mallocz(sizeof(struct IRQState) * n);
+    s = (qemu_irq *)g_malloc0(sizeof(qemu_irq) * n);
+    p = (struct IRQState *)g_malloc0(sizeof(struct IRQState) * n);
     for (i = 0; i < n; i++) {
         p->handler = handler;
         p->opaque = opaque;
@@ -58,8 +58,8 @@
 
 void qemu_free_irqs(qemu_irq *s)
 {
-    qemu_free(s[0]);
-    qemu_free(s);
+    g_free(s[0]);
+    g_free(s);
 }
 
 static void qemu_notirq(void *opaque, int line, int level)
@@ -85,7 +85,7 @@
 
 qemu_irq qemu_irq_split(qemu_irq irq1, qemu_irq irq2)
 {
-    qemu_irq *s = qemu_mallocz(2 * sizeof(qemu_irq));
+    qemu_irq *s = g_malloc0(2 * sizeof(qemu_irq));
     s[0] = irq1;
     s[1] = irq2;
     return qemu_allocate_irqs(qemu_splitirq, s, 1)[0];
diff --git a/hw/isa_mmio.c b/hw/isa_mmio.c
index 3d2af1a..fd755ab 100644
--- a/hw/isa_mmio.c
+++ b/hw/isa_mmio.c
@@ -74,7 +74,7 @@
 
 void isa_mmio_init(target_phys_addr_t base, target_phys_addr_t size)
 {
-    MemoryRegion *mr = qemu_malloc(sizeof(*mr));
+    MemoryRegion *mr = g_malloc(sizeof(*mr));
 
     isa_mmio_setup(mr, size);
     memory_region_add_subregion(get_system_memory(), base, mr);
diff --git a/hw/ivshmem.c b/hw/ivshmem.c
index 42a5877..f4ae0d2 100644
--- a/hw/ivshmem.c
+++ b/hw/ivshmem.c
@@ -351,7 +351,7 @@
         close(s->peers[posn].eventfds[i]);
     }
 
-    qemu_free(s->peers[posn].eventfds);
+    g_free(s->peers[posn].eventfds);
     s->peers[posn].nb_eventfds = 0;
 }
 
@@ -383,7 +383,7 @@
         s->nb_peers = s->nb_peers * 2;
 
     IVSHMEM_DPRINTF("bumping storage to %d guests\n", s->nb_peers);
-    s->peers = qemu_realloc(s->peers, s->nb_peers * sizeof(Peer));
+    s->peers = g_realloc(s->peers, s->nb_peers * sizeof(Peer));
 
     /* zero out new pointers */
     for (j = old_nb_alloc; j < s->nb_peers; j++) {
@@ -467,7 +467,7 @@
 
     if (guest_max_eventfd == 0) {
         /* one eventfd per MSI vector */
-        s->peers[incoming_posn].eventfds = (int *) qemu_malloc(s->vectors *
+        s->peers[incoming_posn].eventfds = (int *) g_malloc(s->vectors *
                                                                 sizeof(int));
     }
 
@@ -557,7 +557,7 @@
     }
 
     /* allocate Qemu char devices for receiving interrupts */
-    s->eventfd_table = qemu_mallocz(s->vectors * sizeof(EventfdEntry));
+    s->eventfd_table = g_malloc0(s->vectors * sizeof(EventfdEntry));
 }
 
 static void ivshmem_save(QEMUFile* f, void *opaque)
@@ -691,12 +691,12 @@
         s->vm_id = -1;
 
         /* allocate/initialize space for interrupt handling */
-        s->peers = qemu_mallocz(s->nb_peers * sizeof(Peer));
+        s->peers = g_malloc0(s->nb_peers * sizeof(Peer));
 
         pci_register_bar(&s->dev, 2,
                          PCI_BASE_ADDRESS_SPACE_MEMORY, &s->ivshmem);
 
-        s->eventfd_chr = qemu_mallocz(s->vectors * sizeof(CharDriverState *));
+        s->eventfd_chr = g_malloc0(s->vectors * sizeof(CharDriverState *));
 
         qemu_chr_add_handlers(s->server_chr, ivshmem_can_receive, ivshmem_read,
                      ivshmem_event, s);
diff --git a/hw/jazz_led.c b/hw/jazz_led.c
index 1dc22cf..eb472a0 100644
--- a/hw/jazz_led.c
+++ b/hw/jazz_led.c
@@ -312,7 +312,7 @@
     LedState *s;
     int io;
 
-    s = qemu_mallocz(sizeof(LedState));
+    s = g_malloc0(sizeof(LedState));
 
     s->state = REDRAW_SEGMENTS | REDRAW_BACKGROUND;
 
diff --git a/hw/leon3.c b/hw/leon3.c
index 919f49f..a62a941 100644
--- a/hw/leon3.c
+++ b/hw/leon3.c
@@ -122,7 +122,7 @@
     cpu_sparc_set_id(env, 0);
 
     /* Reset data */
-    reset_info        = qemu_mallocz(sizeof(ResetData));
+    reset_info        = g_malloc0(sizeof(ResetData));
     reset_info->env   = env;
     qemu_register_reset(main_cpu_reset, reset_info);
 
diff --git a/hw/lm32_boards.c b/hw/lm32_boards.c
index 6462923..d18aad7 100644
--- a/hw/lm32_boards.c
+++ b/hw/lm32_boards.c
@@ -95,7 +95,7 @@
     int timer0_irq                 = 1;
     int timer1_irq                 = 3;
 
-    reset_info = qemu_mallocz(sizeof(ResetInfo));
+    reset_info = g_malloc0(sizeof(ResetInfo));
 
     if (cpu_model == NULL) {
         cpu_model = "lm32-full";
@@ -190,7 +190,7 @@
     target_phys_addr_t initrd_base  = 0x08400000;
     size_t initrd_max               = 0x01000000;
 
-    reset_info = qemu_mallocz(sizeof(ResetInfo));
+    reset_info = g_malloc0(sizeof(ResetInfo));
 
     if (cpu_model == NULL) {
         cpu_model = "lm32-full";
diff --git a/hw/lm32_hwsetup.h b/hw/lm32_hwsetup.h
index 9f47821..8fc285e 100644
--- a/hw/lm32_hwsetup.h
+++ b/hw/lm32_hwsetup.h
@@ -57,8 +57,8 @@
 {
     HWSetup *hw;
 
-    hw = qemu_malloc(sizeof(HWSetup));
-    hw->data = qemu_mallocz(TARGET_PAGE_SIZE);
+    hw = g_malloc(sizeof(HWSetup));
+    hw->data = g_malloc0(TARGET_PAGE_SIZE);
     hw->ptr = hw->data;
 
     return hw;
@@ -66,8 +66,8 @@
 
 static inline void hwsetup_free(HWSetup *hw)
 {
-    qemu_free(hw->data);
-    qemu_free(hw);
+    g_free(hw->data);
+    g_free(hw);
 }
 
 static inline void hwsetup_create_rom(HWSetup *hw,
diff --git a/hw/loader.c b/hw/loader.c
index 35d792e..8efb146 100644
--- a/hw/loader.c
+++ b/hw/loader.c
@@ -91,11 +91,11 @@
     uint8_t *buf;
     size_t did;
 
-    buf = qemu_malloc(nbytes);
+    buf = g_malloc(nbytes);
     did = read(fd, buf, nbytes);
     if (did > 0)
         rom_add_blob_fixed("read", buf, did, dst_addr);
-    qemu_free(buf);
+    g_free(buf);
     return did;
 }
 
@@ -234,9 +234,9 @@
     void *ptr;
     if (lseek(fd, offset, SEEK_SET) < 0)
         return NULL;
-    ptr = qemu_malloc(size);
+    ptr = g_malloc(size);
     if (read(fd, ptr, size) != size) {
-        qemu_free(ptr);
+        g_free(ptr);
         return NULL;
     }
     return ptr;
@@ -351,14 +351,14 @@
     size *= items;
     size = (size + ZALLOC_ALIGNMENT - 1) & ~(ZALLOC_ALIGNMENT - 1);
 
-    p = qemu_malloc(size);
+    p = g_malloc(size);
 
     return (p);
 }
 
 static void zfree(void *x, void *addr)
 {
-    qemu_free(addr);
+    g_free(addr);
 }
 
 
@@ -476,7 +476,7 @@
     }
 
     *ep = hdr->ih_ep;
-    data = qemu_malloc(hdr->ih_size);
+    data = g_malloc(hdr->ih_size);
 
     if (read(fd, data, hdr->ih_size) != hdr->ih_size) {
         fprintf(stderr, "Error reading file\n");
@@ -490,10 +490,10 @@
 
         compressed_data = data;
         max_bytes = UBOOT_MAX_GUNZIP_BYTES;
-        data = qemu_malloc(max_bytes);
+        data = g_malloc(max_bytes);
 
         bytes = gunzip(data, max_bytes, compressed_data, hdr->ih_size);
-        qemu_free(compressed_data);
+        g_free(compressed_data);
         if (bytes < 0) {
             fprintf(stderr, "Unable to decompress gzipped image!\n");
             goto out;
@@ -510,7 +510,7 @@
 
 out:
     if (data)
-        qemu_free(data);
+        g_free(data);
     close(fd);
     return ret;
 }
@@ -564,11 +564,11 @@
     int rc, fd = -1;
     char devpath[100];
 
-    rom = qemu_mallocz(sizeof(*rom));
-    rom->name = qemu_strdup(file);
+    rom = g_malloc0(sizeof(*rom));
+    rom->name = g_strdup(file);
     rom->path = qemu_find_file(QEMU_FILE_TYPE_BIOS, rom->name);
     if (rom->path == NULL) {
-        rom->path = qemu_strdup(file);
+        rom->path = g_strdup(file);
     }
 
     fd = open(rom->path, O_RDONLY | O_BINARY);
@@ -579,12 +579,12 @@
     }
 
     if (fw_dir) {
-        rom->fw_dir  = qemu_strdup(fw_dir);
-        rom->fw_file = qemu_strdup(file);
+        rom->fw_dir  = g_strdup(fw_dir);
+        rom->fw_file = g_strdup(file);
     }
     rom->addr    = addr;
     rom->romsize = lseek(fd, 0, SEEK_END);
-    rom->data    = qemu_mallocz(rom->romsize);
+    rom->data    = g_malloc0(rom->romsize);
     lseek(fd, 0, SEEK_SET);
     rc = read(fd, rom->data, rom->romsize);
     if (rc != rom->romsize) {
@@ -618,10 +618,10 @@
 err:
     if (fd != -1)
         close(fd);
-    qemu_free(rom->data);
-    qemu_free(rom->path);
-    qemu_free(rom->name);
-    qemu_free(rom);
+    g_free(rom->data);
+    g_free(rom->path);
+    g_free(rom->name);
+    g_free(rom);
     return -1;
 }
 
@@ -630,11 +630,11 @@
 {
     Rom *rom;
 
-    rom = qemu_mallocz(sizeof(*rom));
-    rom->name    = qemu_strdup(name);
+    rom = g_malloc0(sizeof(*rom));
+    rom->name    = g_strdup(name);
     rom->addr    = addr;
     rom->romsize = len;
-    rom->data    = qemu_mallocz(rom->romsize);
+    rom->data    = g_malloc0(rom->romsize);
     memcpy(rom->data, blob, len);
     rom_insert(rom);
     return 0;
@@ -664,7 +664,7 @@
         cpu_physical_memory_write_rom(rom->addr, rom->data, rom->romsize);
         if (rom->isrom) {
             /* rom needs to be written only once */
-            qemu_free(rom->data);
+            g_free(rom->data);
             rom->data = NULL;
         }
     }
diff --git a/hw/lsi53c895a.c b/hw/lsi53c895a.c
index 41c2fb0..1643a63 100644
--- a/hw/lsi53c895a.c
+++ b/hw/lsi53c895a.c
@@ -353,10 +353,10 @@
     while (!QTAILQ_EMPTY(&s->queue)) {
         p = QTAILQ_FIRST(&s->queue);
         QTAILQ_REMOVE(&s->queue, p, next);
-        qemu_free(p);
+        g_free(p);
     }
     if (s->current) {
-        qemu_free(s->current);
+        g_free(s->current);
         s->current = NULL;
     }
 }
@@ -664,7 +664,7 @@
 
     if (s->current && req == s->current->req) {
         scsi_req_unref(req);
-        qemu_free(s->current);
+        g_free(s->current);
         s->current = NULL;
         return;
     }
@@ -672,7 +672,7 @@
     if (p) {
         QTAILQ_REMOVE(&s->queue, p, next);
         scsi_req_unref(req);
-        qemu_free(p);
+        g_free(p);
     }
 }
 
@@ -723,7 +723,7 @@
 
     if (s->current && req == s->current->req) {
         scsi_req_unref(s->current->req);
-        qemu_free(s->current);
+        g_free(s->current);
         s->current = NULL;
     }
     lsi_resume_script(s);
@@ -779,7 +779,7 @@
     }
 
     assert(s->current == NULL);
-    s->current = qemu_mallocz(sizeof(lsi_request));
+    s->current = g_malloc0(sizeof(lsi_request));
     s->current->tag = s->select_tag;
     s->current->req = scsi_req_new(dev, s->current->tag, s->current_lun, buf,
                                    s->current);
diff --git a/hw/m48t59.c b/hw/m48t59.c
index 537c0f7..401b969 100644
--- a/hw/m48t59.c
+++ b/hw/m48t59.c
@@ -679,7 +679,7 @@
 
 static void m48t59_init_common(M48t59State *s)
 {
-    s->buffer = qemu_mallocz(s->size);
+    s->buffer = g_malloc0(s->size);
     if (s->type == 59) {
         s->alrm_timer = qemu_new_timer_ns(vm_clock, &alarm_cb, s);
         s->wd_timer = qemu_new_timer_ns(vm_clock, &watchdog_cb, s);
diff --git a/hw/mac_dbdma.c b/hw/mac_dbdma.c
index 350d901..5affdd1 100644
--- a/hw/mac_dbdma.c
+++ b/hw/mac_dbdma.c
@@ -846,7 +846,7 @@
 {
     DBDMAState *s;
 
-    s = qemu_mallocz(sizeof(DBDMAState));
+    s = g_malloc0(sizeof(DBDMAState));
 
     memory_region_init_io(&s->mem, &dbdma_ops, s, "dbdma", 0x1000);
     *dbdma_mem = &s->mem;
diff --git a/hw/mac_nvram.c b/hw/mac_nvram.c
index ced1e58..ed0a2b7 100644
--- a/hw/mac_nvram.c
+++ b/hw/mac_nvram.c
@@ -121,8 +121,8 @@
 {
     MacIONVRAMState *s;
 
-    s = qemu_mallocz(sizeof(MacIONVRAMState));
-    s->data = qemu_mallocz(size);
+    s = g_malloc0(sizeof(MacIONVRAMState));
+    s->data = g_malloc0(size);
     s->size = size;
     s->it_shift = it_shift;
 
diff --git a/hw/mcf5206.c b/hw/mcf5206.c
index fce282d..15d6f22 100644
--- a/hw/mcf5206.c
+++ b/hw/mcf5206.c
@@ -132,7 +132,7 @@
     m5206_timer_state *s;
     QEMUBH *bh;
 
-    s = (m5206_timer_state *)qemu_mallocz(sizeof(m5206_timer_state));
+    s = (m5206_timer_state *)g_malloc0(sizeof(m5206_timer_state));
     bh = qemu_bh_new(m5206_timer_trigger, s);
     s->timer = ptimer_init(bh);
     s->irq = irq;
@@ -523,7 +523,7 @@
     qemu_irq *pic;
     int iomemtype;
 
-    s = (m5206_mbar_state *)qemu_mallocz(sizeof(m5206_mbar_state));
+    s = (m5206_mbar_state *)g_malloc0(sizeof(m5206_mbar_state));
     iomemtype = cpu_register_io_memory(m5206_mbar_readfn,
                                        m5206_mbar_writefn, s,
                                        DEVICE_NATIVE_ENDIAN);
diff --git a/hw/mcf5208.c b/hw/mcf5208.c
index 78fbc5f..8fe507f 100644
--- a/hw/mcf5208.c
+++ b/hw/mcf5208.c
@@ -185,7 +185,7 @@
     cpu_register_physical_memory(0xfc0a8000, 0x00004000, iomemtype);
     /* Timers.  */
     for (i = 0; i < 2; i++) {
-        s = (m5208_timer_state *)qemu_mallocz(sizeof(m5208_timer_state));
+        s = (m5208_timer_state *)g_malloc0(sizeof(m5208_timer_state));
         bh = qemu_bh_new(m5208_timer_trigger, s);
         s->timer = ptimer_init(bh);
         iomemtype = cpu_register_io_memory(m5208_timer_readfn,
diff --git a/hw/mcf_fec.c b/hw/mcf_fec.c
index 748eb59..42a5d77 100644
--- a/hw/mcf_fec.c
+++ b/hw/mcf_fec.c
@@ -447,7 +447,7 @@
 
     cpu_unregister_io_memory(s->mmio_index);
 
-    qemu_free(s);
+    g_free(s);
 }
 
 static NetClientInfo net_mcf_fec_info = {
@@ -464,7 +464,7 @@
 
     qemu_check_nic_model(nd, "mcf_fec");
 
-    s = (mcf_fec_state *)qemu_mallocz(sizeof(mcf_fec_state));
+    s = (mcf_fec_state *)g_malloc0(sizeof(mcf_fec_state));
     s->irq = irq;
     s->mmio_index = cpu_register_io_memory(mcf_fec_readfn,
                                            mcf_fec_writefn, s,
diff --git a/hw/mcf_intc.c b/hw/mcf_intc.c
index 6cb0a09..99092e7 100644
--- a/hw/mcf_intc.c
+++ b/hw/mcf_intc.c
@@ -144,7 +144,7 @@
     mcf_intc_state *s;
     int iomemtype;
 
-    s = qemu_mallocz(sizeof(mcf_intc_state));
+    s = g_malloc0(sizeof(mcf_intc_state));
     s->env = env;
     mcf_intc_reset(s);
 
diff --git a/hw/mcf_uart.c b/hw/mcf_uart.c
index 905e116..6118ccb 100644
--- a/hw/mcf_uart.c
+++ b/hw/mcf_uart.c
@@ -272,7 +272,7 @@
 {
     mcf_uart_state *s;
 
-    s = qemu_mallocz(sizeof(mcf_uart_state));
+    s = g_malloc0(sizeof(mcf_uart_state));
     s->chr = chr;
     s->irq = irq;
     if (chr) {
diff --git a/hw/milkymist.c b/hw/milkymist.c
index 7879840..93288c8 100644
--- a/hw/milkymist.c
+++ b/hw/milkymist.c
@@ -99,7 +99,7 @@
     target_phys_addr_t cmdline_base = sdram_base + 0x1000000;
     size_t initrd_max = sdram_size - 0x1002000;
 
-    reset_info = qemu_mallocz(sizeof(ResetInfo));
+    reset_info = g_malloc0(sizeof(ResetInfo));
 
     if (cpu_model == NULL) {
         cpu_model = "lm32-full";
diff --git a/hw/mips_fulong2e.c b/hw/mips_fulong2e.c
index 420fada..ec8c88e 100644
--- a/hw/mips_fulong2e.c
+++ b/hw/mips_fulong2e.c
@@ -140,7 +140,7 @@
 
     /* Setup prom parameters. */
     prom_size = ENVP_NB_ENTRIES * (sizeof(int32_t) + ENVP_ENTRY_SIZE);
-    prom_buf = qemu_malloc(prom_size);
+    prom_buf = g_malloc(prom_size);
 
     prom_set(prom_buf, index++, "%s", loaderparams.kernel_filename);
     if (initrd_size > 0) {
@@ -313,7 +313,7 @@
         if (filename) {
             bios_size = load_image_targphys(filename, 0x1fc00000LL,
                                             BIOS_SIZE);
-            qemu_free(filename);
+            g_free(filename);
         } else {
             bios_size = -1;
         }
diff --git a/hw/mips_jazz.c b/hw/mips_jazz.c
index f6ab6dc..ea20510 100644
--- a/hw/mips_jazz.c
+++ b/hw/mips_jazz.c
@@ -158,7 +158,7 @@
     if (filename) {
         bios_size = load_image_targphys(filename, 0xfff00000LL,
                                         MAGNUM_BIOS_SIZE);
-        qemu_free(filename);
+        g_free(filename);
     } else {
         bios_size = -1;
     }
@@ -207,7 +207,7 @@
     for (n = 0; n < nb_nics; n++) {
         nd = &nd_table[n];
         if (!nd->model)
-            nd->model = qemu_strdup("dp83932");
+            nd->model = g_strdup("dp83932");
         if (strcmp(nd->model, "dp83932") == 0) {
             dp83932_init(nd, 0x80001000, 2, rc4030[4],
                          rc4030_opaque, rc4030_dma_memory_rw);
diff --git a/hw/mips_malta.c b/hw/mips_malta.c
index ed2a483..5bdb45b 100644
--- a/hw/mips_malta.c
+++ b/hw/mips_malta.c
@@ -433,7 +433,7 @@
     MaltaFPGAState *s;
     int malta;
 
-    s = (MaltaFPGAState *)qemu_mallocz(sizeof(MaltaFPGAState));
+    s = (MaltaFPGAState *)g_malloc0(sizeof(MaltaFPGAState));
 
     malta = cpu_register_io_memory(malta_fpga_read,
                                    malta_fpga_write, s,
@@ -709,7 +709,7 @@
 
     /* Setup prom parameters. */
     prom_size = ENVP_NB_ENTRIES * (sizeof(int32_t) + ENVP_ENTRY_SIZE);
-    prom_buf = qemu_malloc(prom_size);
+    prom_buf = g_malloc(prom_size);
 
     prom_set(prom_buf, prom_index++, "%s", loaderparams.kernel_filename);
     if (initrd_size > 0) {
@@ -863,7 +863,7 @@
             if (filename) {
                 bios_size = load_image_targphys(filename, 0x1fc00000LL,
                                                 BIOS_SIZE);
-                qemu_free(filename);
+                g_free(filename);
             } else {
                 bios_size = -1;
             }
diff --git a/hw/mips_mipssim.c b/hw/mips_mipssim.c
index 380a7eb..0d46cc4 100644
--- a/hw/mips_mipssim.c
+++ b/hw/mips_mipssim.c
@@ -138,7 +138,7 @@
         fprintf(stderr, "Unable to find CPU definition\n");
         exit(1);
     }
-    reset_info = qemu_mallocz(sizeof(ResetData));
+    reset_info = g_malloc0(sizeof(ResetData));
     reset_info->env = env;
     reset_info->vector = env->active_tc.PC;
     qemu_register_reset(main_cpu_reset, reset_info);
@@ -158,7 +158,7 @@
     filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, bios_name);
     if (filename) {
         bios_size = load_image_targphys(filename, 0x1fc00000LL, BIOS_SIZE);
-        qemu_free(filename);
+        g_free(filename);
     } else {
         bios_size = -1;
     }
diff --git a/hw/mips_r4k.c b/hw/mips_r4k.c
index 2834a46..9d90568 100644
--- a/hw/mips_r4k.c
+++ b/hw/mips_r4k.c
@@ -126,7 +126,7 @@
 
     /* Store command line.  */
     params_size = 264;
-    params_buf = qemu_malloc(params_size);
+    params_buf = g_malloc(params_size);
 
     params_buf[0] = tswap32(ram_size);
     params_buf[1] = tswap32(0x12345678);
@@ -186,7 +186,7 @@
         fprintf(stderr, "Unable to find CPU definition\n");
         exit(1);
     }
-    reset_info = qemu_mallocz(sizeof(ResetData));
+    reset_info = g_malloc0(sizeof(ResetData));
     reset_info->env = env;
     reset_info->vector = env->active_tc.PC;
     qemu_register_reset(main_cpu_reset, reset_info);
@@ -248,7 +248,7 @@
 		bios_name);
     }
     if (filename) {
-        qemu_free(filename);
+        g_free(filename);
     }
 
     if (kernel_filename) {
diff --git a/hw/mipsnet.c b/hw/mipsnet.c
index 0db3ba7..b889ee0 100644
--- a/hw/mipsnet.c
+++ b/hw/mipsnet.c
@@ -228,7 +228,7 @@
 
     isa_unassign_ioport(s->io_base, 36);
 
-    qemu_free(s);
+    g_free(s);
 }
 
 static NetClientInfo net_mipsnet_info = {
@@ -245,7 +245,7 @@
 
     qemu_check_nic_model(nd, "mipsnet");
 
-    s = qemu_mallocz(sizeof(MIPSnetState));
+    s = g_malloc0(sizeof(MIPSnetState));
 
     register_ioport_write(base, 36, 1, mipsnet_ioport_write, s);
     register_ioport_read(base, 36, 1, mipsnet_ioport_read, s);
diff --git a/hw/msix.c b/hw/msix.c
index 8536c3f..b15bafc 100644
--- a/hw/msix.c
+++ b/hw/msix.c
@@ -219,10 +219,10 @@
     if (nentries > MSIX_MAX_ENTRIES)
         return -EINVAL;
 
-    dev->msix_entry_used = qemu_mallocz(MSIX_MAX_ENTRIES *
+    dev->msix_entry_used = g_malloc0(MSIX_MAX_ENTRIES *
                                         sizeof *dev->msix_entry_used);
 
-    dev->msix_table_page = qemu_mallocz(MSIX_PAGE_SIZE);
+    dev->msix_table_page = g_malloc0(MSIX_PAGE_SIZE);
     msix_mask_all(dev, nentries);
 
     memory_region_init_io(&dev->msix_mmio, &msix_mmio_ops, dev,
@@ -240,9 +240,9 @@
 err_config:
     dev->msix_entries_nr = 0;
     memory_region_destroy(&dev->msix_mmio);
-    qemu_free(dev->msix_table_page);
+    g_free(dev->msix_table_page);
     dev->msix_table_page = NULL;
-    qemu_free(dev->msix_entry_used);
+    g_free(dev->msix_entry_used);
     dev->msix_entry_used = NULL;
     return ret;
 }
@@ -268,9 +268,9 @@
     dev->msix_entries_nr = 0;
     memory_region_del_subregion(bar, &dev->msix_mmio);
     memory_region_destroy(&dev->msix_mmio);
-    qemu_free(dev->msix_table_page);
+    g_free(dev->msix_table_page);
     dev->msix_table_page = NULL;
-    qemu_free(dev->msix_entry_used);
+    g_free(dev->msix_entry_used);
     dev->msix_entry_used = NULL;
     dev->cap_present &= ~QEMU_PCI_CAP_MSIX;
     return 0;
diff --git a/hw/msmouse.c b/hw/msmouse.c
index 67c6cd4..b611c2f 100644
--- a/hw/msmouse.c
+++ b/hw/msmouse.c
@@ -61,14 +61,14 @@
 
 static void msmouse_chr_close (struct CharDriverState *chr)
 {
-    qemu_free (chr);
+    g_free (chr);
 }
 
 int qemu_chr_open_msmouse(QemuOpts *opts, CharDriverState **_chr)
 {
     CharDriverState *chr;
 
-    chr = qemu_mallocz(sizeof(CharDriverState));
+    chr = g_malloc0(sizeof(CharDriverState));
     chr->chr_write = msmouse_chr_write;
     chr->chr_close = msmouse_chr_close;
 
diff --git a/hw/multiboot.c b/hw/multiboot.c
index a1d3f41..b4484a3 100644
--- a/hw/multiboot.c
+++ b/hw/multiboot.c
@@ -187,7 +187,7 @@
         mb_kernel_size = elf_high - elf_low;
         mh_entry_addr = elf_entry;
 
-        mbs.mb_buf = qemu_malloc(mb_kernel_size);
+        mbs.mb_buf = g_malloc(mb_kernel_size);
         if (rom_copy(mbs.mb_buf, mh_load_addr, mb_kernel_size) != mb_kernel_size) {
             fprintf(stderr, "Error while fetching elf kernel from rom\n");
             exit(1);
@@ -220,7 +220,7 @@
         mb_debug("qemu: loading multiboot kernel (%#x bytes) at %#x\n",
                  mb_load_size, mh_load_addr);
 
-        mbs.mb_buf = qemu_malloc(mb_kernel_size);
+        mbs.mb_buf = g_malloc(mb_kernel_size);
         fseek(f, mb_kernel_text_offset, SEEK_SET);
         if (fread(mbs.mb_buf, 1, mb_load_size, f) != mb_load_size) {
             fprintf(stderr, "fread() failed\n");
@@ -252,7 +252,7 @@
     mbs.mb_buf_size = TARGET_PAGE_ALIGN(mbs.mb_buf_size);
 
     /* enlarge mb_buf to hold cmdlines and mb-info structs */
-    mbs.mb_buf          = qemu_realloc(mbs.mb_buf, mbs.mb_buf_size);
+    mbs.mb_buf          = g_realloc(mbs.mb_buf, mbs.mb_buf_size);
     mbs.offset_cmdlines = mbs.offset_mbinfo + mbs.mb_mods_avail * MB_MOD_SIZE;
 
     if (initrd_filename) {
@@ -281,7 +281,7 @@
             }
 
             mbs.mb_buf_size = TARGET_PAGE_ALIGN(mb_mod_length + mbs.mb_buf_size);
-            mbs.mb_buf = qemu_realloc(mbs.mb_buf, mbs.mb_buf_size);
+            mbs.mb_buf = g_realloc(mbs.mb_buf, mbs.mb_buf_size);
 
             load_image(initrd_filename, (unsigned char *)mbs.mb_buf + offs);
             mb_add_mod(&mbs, mbs.mb_buf_phys + offs,
@@ -320,7 +320,7 @@
     mb_debug("           mb_mods_count = %d\n", mbs.mb_mods_count);
 
     /* save bootinfo off the stack */
-    mb_bootinfo_data = qemu_malloc(sizeof(bootinfo));
+    mb_bootinfo_data = g_malloc(sizeof(bootinfo));
     memcpy(mb_bootinfo_data, bootinfo, sizeof(bootinfo));
 
     /* Pass variables to option rom */
diff --git a/hw/nand.c b/hw/nand.c
index 28d9f0b..c27783e 100644
--- a/hw/nand.c
+++ b/hw/nand.c
@@ -399,7 +399,7 @@
         pagesize += 1 << s->page_shift;
     }
     if (pagesize) {
-        s->storage = (uint8_t *) memset(qemu_malloc(s->pages * pagesize),
+        s->storage = (uint8_t *) memset(g_malloc(s->pages * pagesize),
                         0xff, s->pages * pagesize);
     }
     /* Give s->ioaddr a sane value in case we save state before it is used. */
diff --git a/hw/nseries.c b/hw/nseries.c
index 6a5575e..144fd5a 100644
--- a/hw/nseries.c
+++ b/hw/nseries.c
@@ -654,7 +654,7 @@
 
 static void *mipid_init(void)
 {
-    struct mipid_s *s = (struct mipid_s *) qemu_mallocz(sizeof(*s));
+    struct mipid_s *s = (struct mipid_s *) g_malloc0(sizeof(*s));
 
     s->id = 0x838f03;
     mipid_reset(s);
@@ -710,10 +710,10 @@
     chip->write(chip->opaque, 1, 0x01);		/* Input Data Format */
     chip->write(chip->opaque, 1, 0x01);		/* Data Source Select */
 
-    fb_blank = memset(qemu_malloc(800 * 480 * 2), 0xff, 800 * 480 * 2);
+    fb_blank = memset(g_malloc(800 * 480 * 2), 0xff, 800 * 480 * 2);
     /* Display Memory Data Port */
     chip->block(chip->opaque, 1, fb_blank, 800 * 480 * 2, 800);
-    qemu_free(fb_blank);
+    g_free(fb_blank);
 }
 
 static void n8x0_dss_setup(struct n800_s *s)
@@ -1270,7 +1270,7 @@
                 const char *kernel_cmdline, const char *initrd_filename,
                 const char *cpu_model, struct arm_boot_info *binfo, int model)
 {
-    struct n800_s *s = (struct n800_s *) qemu_mallocz(sizeof(*s));
+    struct n800_s *s = (struct n800_s *) g_malloc0(sizeof(*s));
     int sdram_size = binfo->ram_size;
     DisplayState *ds;
 
diff --git a/hw/omap.h b/hw/omap.h
index a064353..2a6d589 100644
--- a/hw/omap.h
+++ b/hw/omap.h
@@ -1107,7 +1107,7 @@
                                            CPUWriteMemoryFunc * const *mem_write,
                                            void *opaque)
 {
-    struct io_fn *s = qemu_malloc(sizeof(struct io_fn));
+    struct io_fn *s = g_malloc(sizeof(struct io_fn));
 
     s->mem_read = mem_read;
     s->mem_write = mem_write;
diff --git a/hw/omap1.c b/hw/omap1.c
index 400de47..614fd31 100644
--- a/hw/omap1.c
+++ b/hw/omap1.c
@@ -255,7 +255,7 @@
 {
     int iomemtype;
     struct omap_mpu_timer_s *s = (struct omap_mpu_timer_s *)
-            qemu_mallocz(sizeof(struct omap_mpu_timer_s));
+            g_malloc0(sizeof(struct omap_mpu_timer_s));
 
     s->irq = irq;
     s->clk = clk;
@@ -379,7 +379,7 @@
 {
     int iomemtype;
     struct omap_watchdog_timer_s *s = (struct omap_watchdog_timer_s *)
-            qemu_mallocz(sizeof(struct omap_watchdog_timer_s));
+            g_malloc0(sizeof(struct omap_watchdog_timer_s));
 
     s->timer.irq = irq;
     s->timer.clk = clk;
@@ -481,7 +481,7 @@
 {
     int iomemtype;
     struct omap_32khz_timer_s *s = (struct omap_32khz_timer_s *)
-            qemu_mallocz(sizeof(struct omap_32khz_timer_s));
+            g_malloc0(sizeof(struct omap_32khz_timer_s));
 
     s->timer.irq = irq;
     s->timer.clk = clk;
@@ -1188,7 +1188,7 @@
 {
     int iomemtype;
     struct omap_tipb_bridge_s *s = (struct omap_tipb_bridge_s *)
-            qemu_mallocz(sizeof(struct omap_tipb_bridge_s));
+            g_malloc0(sizeof(struct omap_tipb_bridge_s));
 
     s->abort = abort_irq;
     omap_tipb_bridge_reset(s);
@@ -2025,7 +2025,7 @@
 {
     int iomemtype;
     struct omap_mpuio_s *s = (struct omap_mpuio_s *)
-            qemu_mallocz(sizeof(struct omap_mpuio_s));
+            g_malloc0(sizeof(struct omap_mpuio_s));
 
     s->irq = gpio_int;
     s->kbd_irq = kbd_int;
@@ -2211,7 +2211,7 @@
 {
     int iomemtype;
     struct omap_uwire_s *s = (struct omap_uwire_s *)
-            qemu_mallocz(sizeof(struct omap_uwire_s));
+            g_malloc0(sizeof(struct omap_uwire_s));
 
     s->txirq = irq[0];
     s->rxirq = irq[1];
@@ -2819,7 +2819,7 @@
 {
     int iomemtype;
     struct omap_rtc_s *s = (struct omap_rtc_s *)
-            qemu_mallocz(sizeof(struct omap_rtc_s));
+            g_malloc0(sizeof(struct omap_rtc_s));
 
     s->irq = irq[0];
     s->alarm = irq[1];
@@ -3339,7 +3339,7 @@
 {
     int iomemtype;
     struct omap_mcbsp_s *s = (struct omap_mcbsp_s *)
-            qemu_mallocz(sizeof(struct omap_mcbsp_s));
+            g_malloc0(sizeof(struct omap_mcbsp_s));
 
     s->txirq = irq[0];
     s->rxirq = irq[1];
@@ -3515,7 +3515,7 @@
 {
     int iomemtype;
     struct omap_lpg_s *s = (struct omap_lpg_s *)
-            qemu_mallocz(sizeof(struct omap_lpg_s));
+            g_malloc0(sizeof(struct omap_lpg_s));
 
     s->tm = qemu_new_timer_ms(rt_clock, omap_lpg_tick, s);
 
@@ -3711,7 +3711,7 @@
 {
     int i;
     struct omap_mpu_state_s *s = (struct omap_mpu_state_s *)
-            qemu_mallocz(sizeof(struct omap_mpu_state_s));
+            g_malloc0(sizeof(struct omap_mpu_state_s));
     ram_addr_t imif_base, emiff_base;
     qemu_irq *cpu_irq;
     qemu_irq dma_irqs[6];
diff --git a/hw/omap2.c b/hw/omap2.c
index c9b3540..3b51ac5 100644
--- a/hw/omap2.c
+++ b/hw/omap2.c
@@ -591,7 +591,7 @@
 {
     int iomemtype;
     struct omap_eac_s *s = (struct omap_eac_s *)
-            qemu_mallocz(sizeof(struct omap_eac_s));
+            g_malloc0(sizeof(struct omap_eac_s));
 
     s->irq = irq;
     s->codec.rxdrq = *drq ++;
@@ -777,7 +777,7 @@
 {
     int iomemtype;
     struct omap_sti_s *s = (struct omap_sti_s *)
-            qemu_mallocz(sizeof(struct omap_sti_s));
+            g_malloc0(sizeof(struct omap_sti_s));
 
     s->irq = irq;
     omap_sti_reset(s);
@@ -1790,7 +1790,7 @@
 {
     int iomemtype;
     struct omap_prcm_s *s = (struct omap_prcm_s *)
-            qemu_mallocz(sizeof(struct omap_prcm_s));
+            g_malloc0(sizeof(struct omap_prcm_s));
 
     s->irq[0] = mpu_int;
     s->irq[1] = dsp_int;
@@ -2163,7 +2163,7 @@
 {
     int iomemtype;
     struct omap_sysctl_s *s = (struct omap_sysctl_s *)
-            qemu_mallocz(sizeof(struct omap_sysctl_s));
+            g_malloc0(sizeof(struct omap_sysctl_s));
 
     s->mpu = mpu;
     omap_sysctl_reset(s);
@@ -2228,7 +2228,7 @@
                 const char *core)
 {
     struct omap_mpu_state_s *s = (struct omap_mpu_state_s *)
-            qemu_mallocz(sizeof(struct omap_mpu_state_s));
+            g_malloc0(sizeof(struct omap_mpu_state_s));
     ram_addr_t sram_base, q2_base;
     qemu_irq *cpu_irq;
     qemu_irq dma_irqs[4];
diff --git a/hw/omap_clk.c b/hw/omap_clk.c
index 577b326..8448006 100644
--- a/hw/omap_clk.c
+++ b/hw/omap_clk.c
@@ -1239,7 +1239,7 @@
     for (i = onchip_clks, count = 0; *i; i ++)
         if ((*i)->flags & flag)
             count ++;
-    mpu->clks = (struct clk *) qemu_mallocz(sizeof(struct clk) * (count + 1));
+    mpu->clks = (struct clk *) g_malloc0(sizeof(struct clk) * (count + 1));
     for (i = onchip_clks, j = mpu->clks; *i; i ++)
         if ((*i)->flags & flag) {
             memcpy(j, *i, sizeof(struct clk));
diff --git a/hw/omap_dma.c b/hw/omap_dma.c
index 8e2dcc9..f943d4e 100644
--- a/hw/omap_dma.c
+++ b/hw/omap_dma.c
@@ -1620,7 +1620,7 @@
 {
     int iomemtype, num_irqs, memsize, i;
     struct omap_dma_s *s = (struct omap_dma_s *)
-            qemu_mallocz(sizeof(struct omap_dma_s));
+            g_malloc0(sizeof(struct omap_dma_s));
 
     if (model <= omap_dma_3_1) {
         num_irqs = 6;
@@ -2039,7 +2039,7 @@
 {
     int iomemtype, i;
     struct omap_dma_s *s = (struct omap_dma_s *)
-            qemu_mallocz(sizeof(struct omap_dma_s));
+            g_malloc0(sizeof(struct omap_dma_s));
 
     s->model = omap_dma_4;
     s->chans = chans;
diff --git a/hw/omap_dss.c b/hw/omap_dss.c
index afe287a..c8387a8 100644
--- a/hw/omap_dss.c
+++ b/hw/omap_dss.c
@@ -627,7 +627,7 @@
     }
     if (!data) {
         if (len > bounce_len) {
-            bounce_buffer = qemu_realloc(bounce_buffer, len);
+            bounce_buffer = g_realloc(bounce_buffer, len);
         }
         data = bounce_buffer;
         cpu_physical_memory_read(data_addr, data, len);
@@ -1030,7 +1030,7 @@
 {
     int iomemtype[5];
     struct omap_dss_s *s = (struct omap_dss_s *)
-            qemu_mallocz(sizeof(struct omap_dss_s));
+            g_malloc0(sizeof(struct omap_dss_s));
 
     s->irq = irq;
     s->drq = drq;
diff --git a/hw/omap_gpio.c b/hw/omap_gpio.c
index c23964c..42e59c3 100644
--- a/hw/omap_gpio.c
+++ b/hw/omap_gpio.c
@@ -696,8 +696,8 @@
     } else {
         s->modulecount = 6;
     }
-    s->modules = qemu_mallocz(s->modulecount * sizeof(struct omap2_gpio_s));
-    s->handler = qemu_mallocz(s->modulecount * 32 * sizeof(qemu_irq));
+    s->modules = g_malloc0(s->modulecount * sizeof(struct omap2_gpio_s));
+    s->handler = g_malloc0(s->modulecount * 32 * sizeof(qemu_irq));
     qdev_init_gpio_in(&dev->qdev, omap2_gpio_set, s->modulecount * 32);
     qdev_init_gpio_out(&dev->qdev, s->handler, s->modulecount * 32);
     for (i = 0; i < s->modulecount; i++) {
diff --git a/hw/omap_gpmc.c b/hw/omap_gpmc.c
index 8bf3343..13e3e00 100644
--- a/hw/omap_gpmc.c
+++ b/hw/omap_gpmc.c
@@ -385,7 +385,7 @@
 {
     int iomemtype;
     struct omap_gpmc_s *s = (struct omap_gpmc_s *)
-            qemu_mallocz(sizeof(struct omap_gpmc_s));
+            g_malloc0(sizeof(struct omap_gpmc_s));
 
     omap_gpmc_reset(s);
 
diff --git a/hw/omap_gptimer.c b/hw/omap_gptimer.c
index f2a424f..704b000 100644
--- a/hw/omap_gptimer.c
+++ b/hw/omap_gptimer.c
@@ -465,7 +465,7 @@
 {
     int iomemtype;
     struct omap_gp_timer_s *s = (struct omap_gp_timer_s *)
-            qemu_mallocz(sizeof(struct omap_gp_timer_s));
+            g_malloc0(sizeof(struct omap_gp_timer_s));
 
     s->ta = ta;
     s->irq = irq;
diff --git a/hw/omap_i2c.c b/hw/omap_i2c.c
index 5cabb5a..11577b1 100644
--- a/hw/omap_i2c.c
+++ b/hw/omap_i2c.c
@@ -426,7 +426,7 @@
 {
     int iomemtype;
     struct omap_i2c_s *s = (struct omap_i2c_s *)
-            qemu_mallocz(sizeof(struct omap_i2c_s));
+            g_malloc0(sizeof(struct omap_i2c_s));
 
     /* TODO: set a value greater or equal to real hardware */
     s->revision = 0x11;
@@ -448,7 +448,7 @@
 {
     int iomemtype;
     struct omap_i2c_s *s = (struct omap_i2c_s *)
-            qemu_mallocz(sizeof(struct omap_i2c_s));
+            g_malloc0(sizeof(struct omap_i2c_s));
 
     s->revision = 0x34;
     s->irq = irq;
diff --git a/hw/omap_intc.c b/hw/omap_intc.c
index 001e20b..f1f570e 100644
--- a/hw/omap_intc.c
+++ b/hw/omap_intc.c
@@ -358,7 +358,7 @@
 {
     int iomemtype;
     struct omap_intr_handler_s *s = (struct omap_intr_handler_s *)
-            qemu_mallocz(sizeof(struct omap_intr_handler_s) +
+            g_malloc0(sizeof(struct omap_intr_handler_s) +
                             sizeof(struct omap_intr_handler_bank_s) * nbanks);
 
     s->parent_intr[0] = parent_irq;
@@ -577,7 +577,7 @@
 {
     int iomemtype;
     struct omap_intr_handler_s *s = (struct omap_intr_handler_s *)
-            qemu_mallocz(sizeof(struct omap_intr_handler_s) +
+            g_malloc0(sizeof(struct omap_intr_handler_s) +
                             sizeof(struct omap_intr_handler_bank_s) * nbanks);
 
     s->parent_intr[0] = parent_irq;
diff --git a/hw/omap_l4.c b/hw/omap_l4.c
index 59c84b1..a4a8883 100644
--- a/hw/omap_l4.c
+++ b/hw/omap_l4.c
@@ -120,7 +120,7 @@
 
 struct omap_l4_s *omap_l4_init(target_phys_addr_t base, int ta_num)
 {
-    struct omap_l4_s *bus = qemu_mallocz(
+    struct omap_l4_s *bus = g_malloc0(
                     sizeof(*bus) + ta_num * sizeof(*bus->ta));
 
     bus->ta_num = ta_num;
@@ -128,19 +128,19 @@
 
 #ifdef L4_MUX_HACK
     omap_l4_io_entries = 1;
-    omap_l4_io_entry = qemu_mallocz(125 * sizeof(*omap_l4_io_entry));
+    omap_l4_io_entry = g_malloc0(125 * sizeof(*omap_l4_io_entry));
 
     omap_cpu_io_entry =
             cpu_register_io_memory(omap_l4_io_readfn,
                             omap_l4_io_writefn, bus, DEVICE_NATIVE_ENDIAN);
 # define L4_PAGES	(0xb4000 / TARGET_PAGE_SIZE)
-    omap_l4_io_readb_fn = qemu_mallocz(sizeof(void *) * L4_PAGES);
-    omap_l4_io_readh_fn = qemu_mallocz(sizeof(void *) * L4_PAGES);
-    omap_l4_io_readw_fn = qemu_mallocz(sizeof(void *) * L4_PAGES);
-    omap_l4_io_writeb_fn = qemu_mallocz(sizeof(void *) * L4_PAGES);
-    omap_l4_io_writeh_fn = qemu_mallocz(sizeof(void *) * L4_PAGES);
-    omap_l4_io_writew_fn = qemu_mallocz(sizeof(void *) * L4_PAGES);
-    omap_l4_io_opaque = qemu_mallocz(sizeof(void *) * L4_PAGES);
+    omap_l4_io_readb_fn = g_malloc0(sizeof(void *) * L4_PAGES);
+    omap_l4_io_readh_fn = g_malloc0(sizeof(void *) * L4_PAGES);
+    omap_l4_io_readw_fn = g_malloc0(sizeof(void *) * L4_PAGES);
+    omap_l4_io_writeb_fn = g_malloc0(sizeof(void *) * L4_PAGES);
+    omap_l4_io_writeh_fn = g_malloc0(sizeof(void *) * L4_PAGES);
+    omap_l4_io_writew_fn = g_malloc0(sizeof(void *) * L4_PAGES);
+    omap_l4_io_opaque = g_malloc0(sizeof(void *) * L4_PAGES);
 #endif
 
     return bus;
diff --git a/hw/omap_lcdc.c b/hw/omap_lcdc.c
index 0c2c550..a905422 100644
--- a/hw/omap_lcdc.c
+++ b/hw/omap_lcdc.c
@@ -441,7 +441,7 @@
 {
     int iomemtype;
     struct omap_lcd_panel_s *s = (struct omap_lcd_panel_s *)
-            qemu_mallocz(sizeof(struct omap_lcd_panel_s));
+            g_malloc0(sizeof(struct omap_lcd_panel_s));
 
     s->irq = irq;
     s->dma = dma;
diff --git a/hw/omap_mmc.c b/hw/omap_mmc.c
index e9ec2f3..a1afeb5 100644
--- a/hw/omap_mmc.c
+++ b/hw/omap_mmc.c
@@ -576,7 +576,7 @@
 {
     int iomemtype;
     struct omap_mmc_s *s = (struct omap_mmc_s *)
-            qemu_mallocz(sizeof(struct omap_mmc_s));
+            g_malloc0(sizeof(struct omap_mmc_s));
 
     s->irq = irq;
     s->dma = dma;
@@ -602,7 +602,7 @@
 {
     int iomemtype;
     struct omap_mmc_s *s = (struct omap_mmc_s *)
-            qemu_mallocz(sizeof(struct omap_mmc_s));
+            g_malloc0(sizeof(struct omap_mmc_s));
 
     s->irq = irq;
     s->dma = dma;
diff --git a/hw/omap_sdrc.c b/hw/omap_sdrc.c
index e183762..1df2fd8 100644
--- a/hw/omap_sdrc.c
+++ b/hw/omap_sdrc.c
@@ -153,7 +153,7 @@
 {
     int iomemtype;
     struct omap_sdrc_s *s = (struct omap_sdrc_s *)
-            qemu_mallocz(sizeof(struct omap_sdrc_s));
+            g_malloc0(sizeof(struct omap_sdrc_s));
 
     omap_sdrc_reset(s);
 
diff --git a/hw/omap_spi.c b/hw/omap_spi.c
index a6b0349..6030ad9 100644
--- a/hw/omap_spi.c
+++ b/hw/omap_spi.c
@@ -315,7 +315,7 @@
 {
     int iomemtype;
     struct omap_mcspi_s *s = (struct omap_mcspi_s *)
-            qemu_mallocz(sizeof(struct omap_mcspi_s));
+            g_malloc0(sizeof(struct omap_mcspi_s));
     struct omap_mcspi_ch_s *ch = s->ch;
 
     s->irq = irq;
diff --git a/hw/omap_synctimer.c b/hw/omap_synctimer.c
index 67f65e6..b47ca88 100644
--- a/hw/omap_synctimer.c
+++ b/hw/omap_synctimer.c
@@ -86,7 +86,7 @@
 struct omap_synctimer_s *omap_synctimer_init(struct omap_target_agent_s *ta,
                 struct omap_mpu_state_s *mpu, omap_clk fclk, omap_clk iclk)
 {
-    struct omap_synctimer_s *s = qemu_mallocz(sizeof(*s));
+    struct omap_synctimer_s *s = g_malloc0(sizeof(*s));
 
     omap_synctimer_reset(s);
     omap_l4_attach(ta, 0, l4_register_io_memory(
diff --git a/hw/omap_uart.c b/hw/omap_uart.c
index 9cee81d..09ae9f8 100644
--- a/hw/omap_uart.c
+++ b/hw/omap_uart.c
@@ -55,7 +55,7 @@
                 const char *label, CharDriverState *chr)
 {
     struct omap_uart_s *s = (struct omap_uart_s *)
-            qemu_mallocz(sizeof(struct omap_uart_s));
+            g_malloc0(sizeof(struct omap_uart_s));
 
     s->base = base;
     s->fclk = fclk;
diff --git a/hw/onenand.c b/hw/onenand.c
index b0cbebc..c37cf59 100644
--- a/hw/onenand.c
+++ b/hw/onenand.c
@@ -186,7 +186,7 @@
         const uint8_t *sp = (const uint8_t *) src;
         uint8_t *dp = 0;
         if (s->bdrv_cur) {
-            dp = qemu_malloc(size);
+            dp = g_malloc(size);
             if (!dp || bdrv_read(s->bdrv_cur, sec, dp, secn) < 0) {
                 result = 1;
             }
@@ -207,7 +207,7 @@
             }
         }
         if (dp && s->bdrv_cur) {
-            qemu_free(dp);
+            g_free(dp);
         }
     }
 
@@ -239,7 +239,7 @@
         const uint8_t *sp = (const uint8_t *) src;
         uint8_t *dp = 0, *dpp = 0;
         if (s->bdrv_cur) {
-            dp = qemu_malloc(512);
+            dp = g_malloc(512);
             if (!dp || bdrv_read(s->bdrv_cur,
                                 s->secs_cur + (sec >> 5),
                                 dp, 1) < 0) {
@@ -265,7 +265,7 @@
             }
         }
         if (dp) {
-            qemu_free(dp);
+            g_free(dp);
         }
     }
     return result;
@@ -274,13 +274,13 @@
 static inline int onenand_erase(OneNANDState *s, int sec, int num)
 {
     uint8_t *blankbuf, *tmpbuf;
-    blankbuf = qemu_malloc(512);
+    blankbuf = g_malloc(512);
     if (!blankbuf) {
         return 1;
     }
-    tmpbuf = qemu_malloc(512);
+    tmpbuf = g_malloc(512);
     if (!tmpbuf) {
-        qemu_free(blankbuf);
+        g_free(blankbuf);
         return 1;
     }
     memset(blankbuf, 0xff, 512);
@@ -307,13 +307,13 @@
         }
     }
 
-    qemu_free(tmpbuf);
-    qemu_free(blankbuf);
+    g_free(tmpbuf);
+    g_free(blankbuf);
     return 0;
 
 fail:
-    qemu_free(tmpbuf);
-    qemu_free(blankbuf);
+    g_free(tmpbuf);
+    g_free(blankbuf);
     return 1;
 }
 
@@ -700,7 +700,7 @@
                 uint16_t man_id, uint16_t dev_id, uint16_t ver_id,
                 int regshift, qemu_irq irq)
 {
-    OneNANDState *s = (OneNANDState *) qemu_mallocz(sizeof(*s));
+    OneNANDState *s = (OneNANDState *) g_malloc0(sizeof(*s));
     uint32_t size = 1 << (24 + ((dev_id >> 4) & 7));
     void *ram;
 
@@ -712,16 +712,16 @@
     s->id.ver = ver_id;
     s->blocks = size >> BLOCK_SHIFT;
     s->secs = size >> 9;
-    s->blockwp = qemu_malloc(s->blocks);
+    s->blockwp = g_malloc(s->blocks);
     s->density_mask = (dev_id & 0x08) ? (1 << (6 + ((dev_id >> 4) & 7))) : 0;
     s->iomemtype = cpu_register_io_memory(onenand_readfn,
                     onenand_writefn, s, DEVICE_NATIVE_ENDIAN);
     s->bdrv = bdrv;
     if (!s->bdrv) {
-        s->image = memset(qemu_malloc(size + (size >> 5)),
+        s->image = memset(g_malloc(size + (size >> 5)),
                         0xff, size + (size >> 5));
     }
-    s->otp = memset(qemu_malloc((64 + 2) << PAGE_SHIFT),
+    s->otp = memset(g_malloc((64 + 2) << PAGE_SHIFT),
                     0xff, (64 + 2) << PAGE_SHIFT);
     s->ram = qemu_ram_alloc(NULL, "onenand.ram", 0xc000 << s->shift);
     ram = qemu_get_ram_ptr(s->ram);
diff --git a/hw/openpic.c b/hw/openpic.c
index ccd4a14..26c96e2 100644
--- a/hw/openpic.c
+++ b/hw/openpic.c
@@ -1180,7 +1180,7 @@
         pci_register_bar(&opp->pci_dev, 0,
                          PCI_BASE_ADDRESS_SPACE_MEMORY, &opp->mem);
     } else {
-        opp = qemu_mallocz(sizeof(openpic_t));
+        opp = g_malloc0(sizeof(openpic_t));
         memory_region_init_io(&opp->mem, &openpic_ops, opp, "openpic", 0x40000);
     }
 
@@ -1644,7 +1644,7 @@
     if (nb_cpus != 1)
         return NULL;
 
-    mpp = qemu_mallocz(sizeof(openpic_t));
+    mpp = g_malloc0(sizeof(openpic_t));
 
     for (i = 0; i < sizeof(list)/sizeof(list[0]); i++) {
         int mem_index;
@@ -1676,6 +1676,6 @@
     return qemu_allocate_irqs(openpic_set_irq, mpp, mpp->max_irq);
 
 free:
-    qemu_free(mpp);
+    g_free(mpp);
     return NULL;
 }
diff --git a/hw/parallel.c b/hw/parallel.c
index cc853a5..71f30ea 100644
--- a/hw/parallel.c
+++ b/hw/parallel.c
@@ -565,7 +565,7 @@
     ParallelState *s;
     int io_sw;
 
-    s = qemu_mallocz(sizeof(ParallelState));
+    s = g_malloc0(sizeof(ParallelState));
     s->irq = irq;
     s->chr = chr;
     s->it_shift = it_shift;
diff --git a/hw/pc.c b/hw/pc.c
index 4b07b35..7be60a4 100644
--- a/hw/pc.c
+++ b/hw/pc.c
@@ -617,7 +617,7 @@
      * of nodes, one word for each VCPU->node and one word for each node to
      * hold the amount of memory.
      */
-    numa_fw_cfg = qemu_mallocz((1 + smp_cpus + nb_numa_nodes) * 8);
+    numa_fw_cfg = g_malloc0((1 + smp_cpus + nb_numa_nodes) * 8);
     numa_fw_cfg[0] = cpu_to_le64(nb_numa_nodes);
     for (i = 0; i < smp_cpus; i++) {
         for (j = 0; j < nb_numa_nodes; j++) {
@@ -788,7 +788,7 @@
 
         initrd_addr = (initrd_max-initrd_size) & ~4095;
 
-        initrd_data = qemu_malloc(initrd_size);
+        initrd_data = g_malloc(initrd_size);
         load_image(initrd_filename, initrd_data);
 
         fw_cfg_add_i32(fw_cfg, FW_CFG_INITRD_ADDR, initrd_addr);
@@ -806,8 +806,8 @@
     setup_size = (setup_size+1)*512;
     kernel_size -= setup_size;
 
-    setup  = qemu_malloc(setup_size);
-    kernel = qemu_malloc(kernel_size);
+    setup  = g_malloc(setup_size);
+    kernel = g_malloc(kernel_size);
     fseek(f, 0, SEEK_SET);
     if (fread(setup, 1, setup_size, f) != setup_size) {
         fprintf(stderr, "fread() failed\n");
@@ -978,15 +978,15 @@
      * aliases to address portions of it, mostly for backwards compatiblity
      * with older qemus that used qemu_ram_alloc().
      */
-    ram = qemu_malloc(sizeof(*ram));
+    ram = g_malloc(sizeof(*ram));
     memory_region_init_ram(ram, NULL, "pc.ram",
                            below_4g_mem_size + above_4g_mem_size);
-    ram_below_4g = qemu_malloc(sizeof(*ram_below_4g));
+    ram_below_4g = g_malloc(sizeof(*ram_below_4g));
     memory_region_init_alias(ram_below_4g, "ram-below-4g", ram,
                              0, below_4g_mem_size);
     memory_region_add_subregion(system_memory, 0, ram_below_4g);
     if (above_4g_mem_size > 0) {
-        ram_above_4g = qemu_malloc(sizeof(*ram_above_4g));
+        ram_above_4g = g_malloc(sizeof(*ram_above_4g));
         memory_region_init_alias(ram_above_4g, "ram-above-4g", ram,
                                  below_4g_mem_size, above_4g_mem_size);
         memory_region_add_subregion(system_memory, 0x100000000ULL,
@@ -1006,7 +1006,7 @@
         (bios_size % 65536) != 0) {
         goto bios_error;
     }
-    bios = qemu_malloc(sizeof(*bios));
+    bios = g_malloc(sizeof(*bios));
     memory_region_init_ram(bios, NULL, "pc.bios", bios_size);
     memory_region_set_readonly(bios, true);
     ret = rom_add_file_fixed(bios_name, (uint32_t)(-bios_size), -1);
@@ -1016,13 +1016,13 @@
         exit(1);
     }
     if (filename) {
-        qemu_free(filename);
+        g_free(filename);
     }
     /* map the last 128KB of the BIOS in ISA space */
     isa_bios_size = bios_size;
     if (isa_bios_size > (128 * 1024))
         isa_bios_size = 128 * 1024;
-    isa_bios = qemu_malloc(sizeof(*isa_bios));
+    isa_bios = g_malloc(sizeof(*isa_bios));
     memory_region_init_alias(isa_bios, "isa-bios", bios,
                              bios_size - isa_bios_size, isa_bios_size);
     memory_region_add_subregion_overlap(system_memory,
@@ -1031,7 +1031,7 @@
                                         1);
     memory_region_set_readonly(isa_bios, true);
 
-    option_rom_mr = qemu_malloc(sizeof(*option_rom_mr));
+    option_rom_mr = g_malloc(sizeof(*option_rom_mr));
     memory_region_init_ram(option_rom_mr, NULL, "pc.rom", PC_ROM_SIZE);
     memory_region_add_subregion_overlap(system_memory,
                                         PC_ROM_MIN_VGA,
diff --git a/hw/pc_piix.c b/hw/pc_piix.c
index 7dd5008..a9fe596 100644
--- a/hw/pc_piix.c
+++ b/hw/pc_piix.c
@@ -121,7 +121,7 @@
     } else {
         i8259 = xen_interrupt_controller_init();
     }
-    isa_irq_state = qemu_mallocz(sizeof(*isa_irq_state));
+    isa_irq_state = g_malloc0(sizeof(*isa_irq_state));
     isa_irq_state->i8259 = i8259;
     if (pci_enabled) {
         ioapic_init(isa_irq_state);
diff --git a/hw/pci.c b/hw/pci.c
index dc7271a..4dc13d2 100644
--- a/hw/pci.c
+++ b/hw/pci.c
@@ -223,7 +223,7 @@
 static void pci_host_bus_register(int domain, PCIBus *bus)
 {
     struct PCIHostBus *host;
-    host = qemu_mallocz(sizeof(*host));
+    host = g_malloc0(sizeof(*host));
     host->domain = domain;
     host->bus = bus;
     QLIST_INSERT_HEAD(&host_buses, host, next);
@@ -288,7 +288,7 @@
 {
     PCIBus *bus;
 
-    bus = qemu_mallocz(sizeof(*bus));
+    bus = g_malloc0(sizeof(*bus));
     bus->qbus.qdev_allocated = 1;
     pci_bus_new_inplace(bus, parent, name, address_space_mem,
                         address_space_io, devfn_min);
@@ -302,7 +302,7 @@
     bus->map_irq = map_irq;
     bus->irq_opaque = irq_opaque;
     bus->nirq = nirq;
-    bus->irq_count = qemu_mallocz(nirq * sizeof(bus->irq_count[0]));
+    bus->irq_count = g_malloc0(nirq * sizeof(bus->irq_count[0]));
 }
 
 void pci_bus_hotplug(PCIBus *bus, pci_hotplug_fn hotplug, DeviceState *qdev)
@@ -346,13 +346,13 @@
     int i;
 
     assert(size == pci_config_size(s));
-    config = qemu_malloc(size);
+    config = g_malloc(size);
 
     qemu_get_buffer(f, config, size);
     for (i = 0; i < size; ++i) {
         if ((config[i] ^ s->config[i]) &
             s->cmask[i] & ~s->wmask[i] & ~s->w1cmask[i]) {
-            qemu_free(config);
+            g_free(config);
             return -EINVAL;
         }
     }
@@ -360,7 +360,7 @@
 
     pci_update_mappings(s);
 
-    qemu_free(config);
+    g_free(config);
     return 0;
 }
 
@@ -720,20 +720,20 @@
 {
     int config_size = pci_config_size(pci_dev);
 
-    pci_dev->config = qemu_mallocz(config_size);
-    pci_dev->cmask = qemu_mallocz(config_size);
-    pci_dev->wmask = qemu_mallocz(config_size);
-    pci_dev->w1cmask = qemu_mallocz(config_size);
-    pci_dev->used = qemu_mallocz(config_size);
+    pci_dev->config = g_malloc0(config_size);
+    pci_dev->cmask = g_malloc0(config_size);
+    pci_dev->wmask = g_malloc0(config_size);
+    pci_dev->w1cmask = g_malloc0(config_size);
+    pci_dev->used = g_malloc0(config_size);
 }
 
 static void pci_config_free(PCIDevice *pci_dev)
 {
-    qemu_free(pci_dev->config);
-    qemu_free(pci_dev->cmask);
-    qemu_free(pci_dev->wmask);
-    qemu_free(pci_dev->w1cmask);
-    qemu_free(pci_dev->used);
+    g_free(pci_dev->config);
+    g_free(pci_dev->cmask);
+    g_free(pci_dev->wmask);
+    g_free(pci_dev->w1cmask);
+    g_free(pci_dev->used);
 }
 
 /* -1 for devfn means auto assign */
@@ -825,7 +825,7 @@
         .config_write = config_write,
     };
 
-    pci_dev = qemu_mallocz(instance_size);
+    pci_dev = g_malloc0(instance_size);
     pci_dev = do_pci_register_device(pci_dev, bus, name, devfn, &info);
     if (pci_dev == NULL) {
         hw_error("PCI: can't register device\n");
@@ -865,7 +865,7 @@
 
     pci_unregister_io_regions(pci_dev);
     pci_del_option_rom(pci_dev);
-    qemu_free(pci_dev->romfile);
+    g_free(pci_dev->romfile);
     do_pci_unregister_device(pci_dev);
     return 0;
 }
@@ -1680,7 +1680,7 @@
     /* rom loading */
     is_default_rom = false;
     if (pci_dev->romfile == NULL && info->romfile != NULL) {
-        pci_dev->romfile = qemu_strdup(info->romfile);
+        pci_dev->romfile = g_strdup(info->romfile);
         is_default_rom = true;
     }
     pci_add_option_rom(pci_dev, is_default_rom);
@@ -1896,14 +1896,14 @@
 
     path = qemu_find_file(QEMU_FILE_TYPE_BIOS, pdev->romfile);
     if (path == NULL) {
-        path = qemu_strdup(pdev->romfile);
+        path = g_strdup(pdev->romfile);
     }
 
     size = get_image_size(path);
     if (size < 0) {
         error_report("%s: failed to find romfile \"%s\"",
                      __FUNCTION__, pdev->romfile);
-        qemu_free(path);
+        g_free(path);
         return -1;
     }
     if (size & (size - 1)) {
@@ -1918,7 +1918,7 @@
     memory_region_init_ram(&pdev->rom, &pdev->qdev, name, size);
     ptr = memory_region_get_ram_ptr(&pdev->rom);
     load_image(path, ptr);
-    qemu_free(path);
+    g_free(path);
 
     if (is_default_rom) {
         /* Only the default rom images will be patched (if needed). */
@@ -2108,7 +2108,7 @@
     path_len = domain_len + slot_len * slot_depth;
 
     /* Allocate memory, fill in the terminating null byte. */
-    path = qemu_malloc(path_len + 1 /* For '\0' */);
+    path = g_malloc(path_len + 1 /* For '\0' */);
     path[path_len] = '\0';
 
     /* First field is the domain. */
diff --git a/hw/pcie_aer.c b/hw/pcie_aer.c
index be019c7..2ae65ec 100644
--- a/hw/pcie_aer.c
+++ b/hw/pcie_aer.c
@@ -111,7 +111,7 @@
     if (dev->exp.aer_log.log_max > PCIE_AER_LOG_MAX_LIMIT) {
         return -EINVAL;
     }
-    dev->exp.aer_log.log = qemu_mallocz(sizeof dev->exp.aer_log.log[0] *
+    dev->exp.aer_log.log = g_malloc0(sizeof dev->exp.aer_log.log[0] *
                                         dev->exp.aer_log.log_max);
 
     pci_set_long(dev->w1cmask + offset + PCI_ERR_UNCOR_STATUS,
@@ -165,7 +165,7 @@
 
 void pcie_aer_exit(PCIDevice *dev)
 {
-    qemu_free(dev->exp.aer_log.log);
+    g_free(dev->exp.aer_log.log);
 }
 
 static void pcie_aer_update_uncor_status(PCIDevice *dev)
diff --git a/hw/pcie_port.c b/hw/pcie_port.c
index 340dcdb..8a36f5c 100644
--- a/hw/pcie_port.c
+++ b/hw/pcie_port.c
@@ -76,7 +76,7 @@
     if (c) {
         return;
     }
-    c = qemu_mallocz(sizeof(*c));
+    c = g_malloc0(sizeof(*c));
     c->number = chassis_number;
     QLIST_INIT(&c->slots);
     QLIST_INSERT_HEAD(&chassis, c, next);
diff --git a/hw/pckbd.c b/hw/pckbd.c
index ae65c04..a272ccd 100644
--- a/hw/pckbd.c
+++ b/hw/pckbd.c
@@ -416,7 +416,7 @@
                    target_phys_addr_t base, ram_addr_t size,
                    target_phys_addr_t mask)
 {
-    KBDState *s = qemu_mallocz(sizeof(KBDState));
+    KBDState *s = g_malloc0(sizeof(KBDState));
     int s_io_memory;
 
     s->irq_kbd = kbd_irq;
diff --git a/hw/petalogix_ml605_mmu.c b/hw/petalogix_ml605_mmu.c
index 8213902..e3a66e5 100644
--- a/hw/petalogix_ml605_mmu.c
+++ b/hw/petalogix_ml605_mmu.c
@@ -88,7 +88,7 @@
         path = qemu_find_file(QEMU_FILE_TYPE_BIOS, BINARY_DEVICE_TREE_FILE);
         if (path) {
             fdt = load_device_tree(path, &fdt_size);
-            qemu_free(path);
+            g_free(path);
         }
         if (!fdt) {
             return 0;
@@ -108,7 +108,7 @@
         path = qemu_find_file(QEMU_FILE_TYPE_BIOS, BINARY_DEVICE_TREE_FILE);
         if (path) {
             fdt_size = load_image_targphys(path, addr, 0x10000);
-            qemu_free(path);
+            g_free(path);
         }
     }
 
diff --git a/hw/petalogix_s3adsp1800_mmu.c b/hw/petalogix_s3adsp1800_mmu.c
index 4dcdfbd..589e8ca 100644
--- a/hw/petalogix_s3adsp1800_mmu.c
+++ b/hw/petalogix_s3adsp1800_mmu.c
@@ -75,7 +75,7 @@
         path = qemu_find_file(QEMU_FILE_TYPE_BIOS, BINARY_DEVICE_TREE_FILE);
         if (path) {
             fdt = load_device_tree(path, &fdt_size);
-            qemu_free(path);
+            g_free(path);
         }
         if (!fdt)
             return 0;
@@ -93,7 +93,7 @@
         path = qemu_find_file(QEMU_FILE_TYPE_BIOS, BINARY_DEVICE_TREE_FILE);
         if (path) {
             fdt_size = load_image_targphys(path, addr, 0x10000);
-	    qemu_free(path);
+	    g_free(path);
         }
     }
 
diff --git a/hw/pflash_cfi01.c b/hw/pflash_cfi01.c
index 90fdc84..90e1301 100644
--- a/hw/pflash_cfi01.c
+++ b/hw/pflash_cfi01.c
@@ -594,7 +594,7 @@
         return NULL;
 #endif
 
-    pfl = qemu_mallocz(sizeof(pflash_t));
+    pfl = g_malloc0(sizeof(pflash_t));
 
     /* FIXME: Allocate ram ourselves.  */
     pfl->storage = qemu_get_ram_ptr(off);
@@ -617,7 +617,7 @@
         ret = bdrv_read(pfl->bs, 0, pfl->storage, total_len >> 9);
         if (ret < 0) {
             cpu_unregister_io_memory(pfl->fl_mem);
-            qemu_free(pfl);
+            g_free(pfl);
             return NULL;
         }
     }
diff --git a/hw/pflash_cfi02.c b/hw/pflash_cfi02.c
index 725cd1e..ac5115e 100644
--- a/hw/pflash_cfi02.c
+++ b/hw/pflash_cfi02.c
@@ -617,7 +617,7 @@
         total_len != (32 * 1024 * 1024) && total_len != (64 * 1024 * 1024))
         return NULL;
 #endif
-    pfl = qemu_mallocz(sizeof(pflash_t));
+    pfl = g_malloc0(sizeof(pflash_t));
     /* FIXME: Allocate ram ourselves.  */
     pfl->storage = qemu_get_ram_ptr(off);
     if (be) {
@@ -640,7 +640,7 @@
         ret = bdrv_read(pfl->bs, 0, pfl->storage, chip_len >> 9);
         if (ret < 0) {
             cpu_unregister_io_memory(pfl->fl_mem);
-            qemu_free(pfl);
+            g_free(pfl);
             return NULL;
         }
     }
diff --git a/hw/ppc.c b/hw/ppc.c
index 9157719..8870748 100644
--- a/hw/ppc.c
+++ b/hw/ppc.c
@@ -761,7 +761,7 @@
 {
     ppc_tb_t *tb_env;
 
-    tb_env = qemu_mallocz(sizeof(ppc_tb_t));
+    tb_env = g_malloc0(sizeof(ppc_tb_t));
     env->tb_env = tb_env;
     /* Create new timer */
     tb_env->decr_timer = qemu_new_timer_ns(vm_clock, &cpu_ppc_decr_cb, env);
@@ -1038,9 +1038,9 @@
     ppc_tb_t *tb_env;
     ppcemb_timer_t *ppcemb_timer;
 
-    tb_env = qemu_mallocz(sizeof(ppc_tb_t));
+    tb_env = g_malloc0(sizeof(ppc_tb_t));
     env->tb_env = tb_env;
-    ppcemb_timer = qemu_mallocz(sizeof(ppcemb_timer_t));
+    ppcemb_timer = g_malloc0(sizeof(ppcemb_timer_t));
     tb_env->tb_freq = freq;
     tb_env->decr_freq = freq;
     tb_env->opaque = ppcemb_timer;
@@ -1145,7 +1145,7 @@
 {
     ppc_dcr_t *dcr_env;
 
-    dcr_env = qemu_mallocz(sizeof(ppc_dcr_t));
+    dcr_env = g_malloc0(sizeof(ppc_dcr_t));
     dcr_env->read_error = read_error;
     dcr_env->write_error = write_error;
     env->dcr_env = dcr_env;
diff --git a/hw/ppc405_boards.c b/hw/ppc405_boards.c
index ad27181..34f9350 100644
--- a/hw/ppc405_boards.c
+++ b/hw/ppc405_boards.c
@@ -162,7 +162,7 @@
     ref405ep_fpga_t *fpga;
     int fpga_memory;
 
-    fpga = qemu_mallocz(sizeof(ref405ep_fpga_t));
+    fpga = g_malloc0(sizeof(ref405ep_fpga_t));
     fpga_memory = cpu_register_io_memory(ref405ep_fpga_read,
                                          ref405ep_fpga_write, fpga,
                                          DEVICE_NATIVE_ENDIAN);
@@ -246,7 +246,7 @@
         filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, bios_name);
         if (filename) {
             bios_size = load_image(filename, qemu_get_ram_ptr(bios_offset));
-            qemu_free(filename);
+            g_free(filename);
         } else {
             bios_size = -1;
         }
@@ -487,7 +487,7 @@
     taihu_cpld_t *cpld;
     int cpld_memory;
 
-    cpld = qemu_mallocz(sizeof(taihu_cpld_t));
+    cpld = g_malloc0(sizeof(taihu_cpld_t));
     cpld_memory = cpu_register_io_memory(taihu_cpld_read,
                                          taihu_cpld_write, cpld,
                                          DEVICE_NATIVE_ENDIAN);
@@ -560,7 +560,7 @@
         filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, bios_name);
         if (filename) {
             bios_size = load_image(filename, qemu_get_ram_ptr(bios_offset));
-            qemu_free(filename);
+            g_free(filename);
         } else {
             bios_size = -1;
         }
diff --git a/hw/ppc405_uc.c b/hw/ppc405_uc.c
index 06a053b..68c7cbd 100644
--- a/hw/ppc405_uc.c
+++ b/hw/ppc405_uc.c
@@ -172,7 +172,7 @@
 {
     ppc4xx_plb_t *plb;
 
-    plb = qemu_mallocz(sizeof(ppc4xx_plb_t));
+    plb = g_malloc0(sizeof(ppc4xx_plb_t));
     ppc_dcr_register(env, PLB0_ACR, plb, &dcr_read_plb, &dcr_write_plb);
     ppc_dcr_register(env, PLB0_BEAR, plb, &dcr_read_plb, &dcr_write_plb);
     ppc_dcr_register(env, PLB0_BESR, plb, &dcr_read_plb, &dcr_write_plb);
@@ -248,7 +248,7 @@
 {
     ppc4xx_pob_t *pob;
 
-    pob = qemu_mallocz(sizeof(ppc4xx_pob_t));
+    pob = g_malloc0(sizeof(ppc4xx_pob_t));
     ppc_dcr_register(env, POB0_BEAR, pob, &dcr_read_pob, &dcr_write_pob);
     ppc_dcr_register(env, POB0_BESR0, pob, &dcr_read_pob, &dcr_write_pob);
     ppc_dcr_register(env, POB0_BESR1, pob, &dcr_read_pob, &dcr_write_pob);
@@ -383,7 +383,7 @@
     ppc4xx_opba_t *opba;
     int io;
 
-    opba = qemu_mallocz(sizeof(ppc4xx_opba_t));
+    opba = g_malloc0(sizeof(ppc4xx_opba_t));
 #ifdef DEBUG_OPBA
     printf("%s: offset " TARGET_FMT_plx "\n", __func__, base);
 #endif
@@ -582,7 +582,7 @@
 {
     ppc4xx_ebc_t *ebc;
 
-    ebc = qemu_mallocz(sizeof(ppc4xx_ebc_t));
+    ebc = g_malloc0(sizeof(ppc4xx_ebc_t));
     qemu_register_reset(&ebc_reset, ebc);
     ppc_dcr_register(env, EBC0_CFGADDR,
                      ebc, &dcr_read_ebc, &dcr_write_ebc);
@@ -665,7 +665,7 @@
 {
     ppc405_dma_t *dma;
 
-    dma = qemu_mallocz(sizeof(ppc405_dma_t));
+    dma = g_malloc0(sizeof(ppc405_dma_t));
     memcpy(dma->irqs, irqs, 4 * sizeof(qemu_irq));
     qemu_register_reset(&ppc405_dma_reset, dma);
     ppc_dcr_register(env, DMA0_CR0,
@@ -810,7 +810,7 @@
     ppc405_gpio_t *gpio;
     int io;
 
-    gpio = qemu_mallocz(sizeof(ppc405_gpio_t));
+    gpio = g_malloc0(sizeof(ppc405_gpio_t));
 #ifdef DEBUG_GPIO
     printf("%s: offset " TARGET_FMT_plx "\n", __func__, base);
 #endif
@@ -972,7 +972,7 @@
 {
     ppc405_ocm_t *ocm;
 
-    ocm = qemu_mallocz(sizeof(ppc405_ocm_t));
+    ocm = g_malloc0(sizeof(ppc405_ocm_t));
     ocm->offset = qemu_ram_alloc(NULL, "ppc405.ocm", 4096);
     qemu_register_reset(&ocm_reset, ocm);
     ppc_dcr_register(env, OCM0_ISARC,
@@ -1219,7 +1219,7 @@
     ppc4xx_i2c_t *i2c;
     int io;
 
-    i2c = qemu_mallocz(sizeof(ppc4xx_i2c_t));
+    i2c = g_malloc0(sizeof(ppc4xx_i2c_t));
     i2c->irq = irq;
 #ifdef DEBUG_I2C
     printf("%s: offset " TARGET_FMT_plx "\n", __func__, base);
@@ -1500,7 +1500,7 @@
     int i;
     int io;
 
-    gpt = qemu_mallocz(sizeof(ppc4xx_gpt_t));
+    gpt = g_malloc0(sizeof(ppc4xx_gpt_t));
     for (i = 0; i < 5; i++) {
         gpt->irqs[i] = irqs[i];
     }
@@ -1731,7 +1731,7 @@
     ppc40x_mal_t *mal;
     int i;
 
-    mal = qemu_mallocz(sizeof(ppc40x_mal_t));
+    mal = g_malloc0(sizeof(ppc40x_mal_t));
     for (i = 0; i < 4; i++)
         mal->irqs[i] = irqs[i];
     qemu_register_reset(&ppc40x_mal_reset, mal);
@@ -2096,7 +2096,7 @@
 {
     ppc405cr_cpc_t *cpc;
 
-    cpc = qemu_mallocz(sizeof(ppc405cr_cpc_t));
+    cpc = g_malloc0(sizeof(ppc405cr_cpc_t));
     memcpy(cpc->clk_setup, clk_setup,
            PPC405CR_CLK_NB * sizeof(clk_setup_t));
     cpc->sysclk = sysclk;
@@ -2142,7 +2142,7 @@
     /* OBP arbitrer */
     ppc4xx_opba_init(0xef600600);
     /* Universal interrupt controller */
-    irqs = qemu_mallocz(sizeof(qemu_irq) * PPCUIC_OUTPUT_NB);
+    irqs = g_malloc0(sizeof(qemu_irq) * PPCUIC_OUTPUT_NB);
     irqs[PPCUIC_OUTPUT_INT] =
         ((qemu_irq *)env->irq_inputs)[PPC40x_INPUT_INT];
     irqs[PPCUIC_OUTPUT_CINT] =
@@ -2433,7 +2433,7 @@
 {
     ppc405ep_cpc_t *cpc;
 
-    cpc = qemu_mallocz(sizeof(ppc405ep_cpc_t));
+    cpc = g_malloc0(sizeof(ppc405ep_cpc_t));
     memcpy(cpc->clk_setup, clk_setup,
            PPC405EP_CLK_NB * sizeof(clk_setup_t));
     cpc->jtagid = 0x20267049;
@@ -2490,7 +2490,7 @@
     /* OBP arbitrer */
     ppc4xx_opba_init(0xef600600);
     /* Universal interrupt controller */
-    irqs = qemu_mallocz(sizeof(qemu_irq) * PPCUIC_OUTPUT_NB);
+    irqs = g_malloc0(sizeof(qemu_irq) * PPCUIC_OUTPUT_NB);
     irqs[PPCUIC_OUTPUT_INT] =
         ((qemu_irq *)env->irq_inputs)[PPC40x_INPUT_INT];
     irqs[PPCUIC_OUTPUT_CINT] =
diff --git a/hw/ppc440.c b/hw/ppc440.c
index 90abc91..baf991f 100644
--- a/hw/ppc440.c
+++ b/hw/ppc440.c
@@ -57,7 +57,7 @@
     ppc_dcr_init(env, NULL, NULL);
 
     /* interrupt controller */
-    irqs = qemu_mallocz(sizeof(qemu_irq) * PPCUIC_OUTPUT_NB);
+    irqs = g_malloc0(sizeof(qemu_irq) * PPCUIC_OUTPUT_NB);
     irqs[PPCUIC_OUTPUT_INT] = ((qemu_irq *)env->irq_inputs)[PPC40x_INPUT_INT];
     irqs[PPCUIC_OUTPUT_CINT] = ((qemu_irq *)env->irq_inputs)[PPC40x_INPUT_CINT];
     pic = ppcuic_init(env, irqs, 0x0C0, 0, 1);
@@ -73,7 +73,7 @@
                       ram_sizes, do_init);
 
     /* PCI */
-    pci_irqs = qemu_malloc(sizeof(qemu_irq) * 4);
+    pci_irqs = g_malloc(sizeof(qemu_irq) * 4);
     pci_irqs[0] = pic[pci_irq_nrs[0]];
     pci_irqs[1] = pic[pci_irq_nrs[1]];
     pci_irqs[2] = pic[pci_irq_nrs[2]];
diff --git a/hw/ppc440_bamboo.c b/hw/ppc440_bamboo.c
index 20b8629..1addb68 100644
--- a/hw/ppc440_bamboo.c
+++ b/hw/ppc440_bamboo.c
@@ -49,7 +49,7 @@
         goto out;
     }
     fdt = load_device_tree(filename, &fdt_size);
-    qemu_free(filename);
+    g_free(filename);
     if (fdt == NULL) {
         goto out;
     }
@@ -80,7 +80,7 @@
         kvmppc_fdt_update(fdt);
 
     ret = rom_add_blob_fixed(BINARY_DEVICE_TREE_FILE, fdt, fdt_size, addr);
-    qemu_free(fdt);
+    g_free(fdt);
 
 out:
 #endif
diff --git a/hw/ppc4xx_devs.c b/hw/ppc4xx_devs.c
index 68bdfaa..1af5f2e 100644
--- a/hw/ppc4xx_devs.c
+++ b/hw/ppc4xx_devs.c
@@ -293,7 +293,7 @@
     ppcuic_t *uic;
     int i;
 
-    uic = qemu_mallocz(sizeof(ppcuic_t));
+    uic = g_malloc0(sizeof(ppcuic_t));
     uic->dcr_base = dcr_base;
     uic->irqs = irqs;
     if (has_vr)
@@ -627,7 +627,7 @@
 {
     ppc4xx_sdram_t *sdram;
 
-    sdram = qemu_mallocz(sizeof(ppc4xx_sdram_t));
+    sdram = g_malloc0(sizeof(ppc4xx_sdram_t));
     sdram->irq = irq;
     sdram->nbanks = nbanks;
     memset(sdram->ram_bases, 0, 4 * sizeof(target_phys_addr_t));
diff --git a/hw/ppc4xx_pci.c b/hw/ppc4xx_pci.c
index c7696b0..52e2663 100644
--- a/hw/ppc4xx_pci.c
+++ b/hw/ppc4xx_pci.c
@@ -341,7 +341,7 @@
     static int ppc4xx_pci_id;
     uint8_t *pci_conf;
 
-    controller = qemu_mallocz(sizeof(PPC4xxPCIState));
+    controller = g_malloc0(sizeof(PPC4xxPCIState));
 
     controller->pci_state.bus = pci_register_bus(NULL, "pci",
                                                  ppc4xx_pci_set_irq,
@@ -390,6 +390,6 @@
 
 free:
     printf("%s error\n", __func__);
-    qemu_free(controller);
+    g_free(controller);
     return NULL;
 }
diff --git a/hw/ppc_newworld.c b/hw/ppc_newworld.c
index 3039022..4727e07 100644
--- a/hw/ppc_newworld.c
+++ b/hw/ppc_newworld.c
@@ -189,7 +189,7 @@
         bios_size = load_elf(filename, NULL, NULL, NULL,
                              NULL, NULL, 1, ELF_MACHINE, 0);
 
-        qemu_free(filename);
+        g_free(filename);
     } else {
         bios_size = -1;
     }
@@ -271,9 +271,9 @@
                                          DEVICE_NATIVE_ENDIAN);
     cpu_register_physical_memory(0xf8000000, 0x00001000, unin_memory);
 
-    openpic_irqs = qemu_mallocz(smp_cpus * sizeof(qemu_irq *));
+    openpic_irqs = g_malloc0(smp_cpus * sizeof(qemu_irq *));
     openpic_irqs[0] =
-        qemu_mallocz(smp_cpus * sizeof(qemu_irq) * OPENPIC_OUTPUT_NB);
+        g_malloc0(smp_cpus * sizeof(qemu_irq) * OPENPIC_OUTPUT_NB);
     for (i = 0; i < smp_cpus; i++) {
         /* Mac99 IRQ connection between OpenPIC outputs pins
          * and PowerPC input pins
@@ -398,7 +398,7 @@
         uint8_t *hypercall;
 
         fw_cfg_add_i32(fw_cfg, FW_CFG_PPC_TBFREQ, kvmppc_get_tbfreq());
-        hypercall = qemu_malloc(16);
+        hypercall = g_malloc(16);
         kvmppc_get_hypercall(env, hypercall, 16);
         fw_cfg_add_bytes(fw_cfg, FW_CFG_PPC_KVM_HC, hypercall, 16);
         fw_cfg_add_i32(fw_cfg, FW_CFG_PPC_KVM_PID, getpid());
diff --git a/hw/ppc_oldworld.c b/hw/ppc_oldworld.c
index 41703a7..0071fc9 100644
--- a/hw/ppc_oldworld.c
+++ b/hw/ppc_oldworld.c
@@ -127,7 +127,7 @@
     if (filename) {
         bios_size = load_elf(filename, 0, NULL, NULL, NULL, NULL,
                              1, ELF_MACHINE, 0);
-        qemu_free(filename);
+        g_free(filename);
     } else {
         bios_size = -1;
     }
@@ -213,9 +213,9 @@
     isa_mmio_init(0xfe000000, 0x00200000);
 
     /* XXX: we register only 1 output pin for heathrow PIC */
-    heathrow_irqs = qemu_mallocz(smp_cpus * sizeof(qemu_irq *));
+    heathrow_irqs = g_malloc0(smp_cpus * sizeof(qemu_irq *));
     heathrow_irqs[0] =
-        qemu_mallocz(smp_cpus * sizeof(qemu_irq) * 1);
+        g_malloc0(smp_cpus * sizeof(qemu_irq) * 1);
     /* Connect the heathrow PIC outputs to the 6xx bus */
     for (i = 0; i < smp_cpus; i++) {
         switch (PPC_INPUT(env)) {
@@ -306,7 +306,7 @@
         uint8_t *hypercall;
 
         fw_cfg_add_i32(fw_cfg, FW_CFG_PPC_TBFREQ, kvmppc_get_tbfreq());
-        hypercall = qemu_malloc(16);
+        hypercall = g_malloc(16);
         kvmppc_get_hypercall(env, hypercall, 16);
         fw_cfg_add_bytes(fw_cfg, FW_CFG_PPC_KVM_HC, hypercall, 16);
         fw_cfg_add_i32(fw_cfg, FW_CFG_PPC_KVM_PID, getpid());
diff --git a/hw/ppc_prep.c b/hw/ppc_prep.c
index 38d8573..515de42 100644
--- a/hw/ppc_prep.c
+++ b/hw/ppc_prep.c
@@ -550,7 +550,7 @@
     DriveInfo *hd[MAX_IDE_BUS * MAX_IDE_DEVS];
     DriveInfo *fd[MAX_FD];
 
-    sysctrl = qemu_mallocz(sizeof(sysctrl_t));
+    sysctrl = g_malloc0(sizeof(sysctrl_t));
 
     linux_boot = (kernel_filename != NULL);
 
@@ -599,7 +599,7 @@
         hw_error("qemu: could not load PPC PREP bios '%s'\n", bios_name);
     }
     if (filename) {
-        qemu_free(filename);
+        g_free(filename);
     }
 
     if (linux_boot) {
@@ -673,7 +673,7 @@
         nb_nics1 = NE2000_NB_MAX;
     for(i = 0; i < nb_nics1; i++) {
         if (nd_table[i].model == NULL) {
-	    nd_table[i].model = qemu_strdup("ne2k_isa");
+	    nd_table[i].model = g_strdup("ne2k_isa");
         }
         if (strcmp(nd_table[i].model, "ne2k_isa") == 0) {
             isa_ne2000_init(ne2000_io[i], ne2000_irq[i], &nd_table[i]);
diff --git a/hw/ppce500_mpc8544ds.c b/hw/ppce500_mpc8544ds.c
index b739ce2..1274a3e 100644
--- a/hw/ppce500_mpc8544ds.c
+++ b/hw/ppce500_mpc8544ds.c
@@ -102,7 +102,7 @@
         goto out;
     }
     fdt = load_device_tree(filename, &fdt_size);
-    qemu_free(filename);
+    g_free(filename);
     if (fdt == NULL) {
         goto out;
     }
@@ -176,7 +176,7 @@
     }
 
     ret = rom_add_blob_fixed(BINARY_DEVICE_TREE_FILE, fdt, fdt_size, addr);
-    qemu_free(fdt);
+    g_free(fdt);
 
 out:
 #endif
@@ -267,7 +267,7 @@
                                  "mpc8544ds.ram", ram_size));
 
     /* MPIC */
-    irqs = qemu_mallocz(sizeof(qemu_irq) * OPENPIC_OUTPUT_NB);
+    irqs = g_malloc0(sizeof(qemu_irq) * OPENPIC_OUTPUT_NB);
     irqs[OPENPIC_OUTPUT_INT] = ((qemu_irq *)env->irq_inputs)[PPCE500_INPUT_INT];
     irqs[OPENPIC_OUTPUT_CINT] = ((qemu_irq *)env->irq_inputs)[PPCE500_INPUT_CINT];
     mpic = mpic_init(MPC8544_MPIC_REGS_BASE, 1, &irqs, NULL);
@@ -336,7 +336,7 @@
         }
     }
 
-    boot_info = qemu_mallocz(sizeof(struct boot_info));
+    boot_info = g_malloc0(sizeof(struct boot_info));
 
     /* If we're loading a kernel directly, we must load the device tree too. */
     if (kernel_filename) {
diff --git a/hw/prep_pci.c b/hw/prep_pci.c
index 58619dd..c36232a 100644
--- a/hw/prep_pci.c
+++ b/hw/prep_pci.c
@@ -118,7 +118,7 @@
     PCIDevice *d;
     int PPC_io_memory;
 
-    s = qemu_mallocz(sizeof(PREPPCIState));
+    s = g_malloc0(sizeof(PREPPCIState));
     s->bus = pci_register_bus(NULL, "pci",
                               prep_set_irq, prep_map_irq, pic,
                               address_space_mem,
diff --git a/hw/ps2.c b/hw/ps2.c
index 91b73e0..24228c1 100644
--- a/hw/ps2.c
+++ b/hw/ps2.c
@@ -604,7 +604,7 @@
 
 void *ps2_kbd_init(void (*update_irq)(void *, int), void *update_arg)
 {
-    PS2KbdState *s = (PS2KbdState *)qemu_mallocz(sizeof(PS2KbdState));
+    PS2KbdState *s = (PS2KbdState *)g_malloc0(sizeof(PS2KbdState));
 
     s->common.update_irq = update_irq;
     s->common.update_arg = update_arg;
@@ -617,7 +617,7 @@
 
 void *ps2_mouse_init(void (*update_irq)(void *, int), void *update_arg)
 {
-    PS2MouseState *s = (PS2MouseState *)qemu_mallocz(sizeof(PS2MouseState));
+    PS2MouseState *s = (PS2MouseState *)g_malloc0(sizeof(PS2MouseState));
 
     s->common.update_irq = update_irq;
     s->common.update_arg = update_arg;
diff --git a/hw/ptimer.c b/hw/ptimer.c
index 6f13ce9..b6cabd5 100644
--- a/hw/ptimer.c
+++ b/hw/ptimer.c
@@ -210,7 +210,7 @@
 {
     ptimer_state *s;
 
-    s = (ptimer_state *)qemu_mallocz(sizeof(ptimer_state));
+    s = (ptimer_state *)g_malloc0(sizeof(ptimer_state));
     s->bh = bh;
     s->timer = qemu_new_timer_ns(vm_clock, ptimer_tick, s);
     return s;
diff --git a/hw/pxa2xx.c b/hw/pxa2xx.c
index cf93110..d00edc6 100644
--- a/hw/pxa2xx.c
+++ b/hw/pxa2xx.c
@@ -1764,7 +1764,7 @@
 {
     int iomemtype;
     PXA2xxI2SState *s = (PXA2xxI2SState *)
-            qemu_mallocz(sizeof(PXA2xxI2SState));
+            g_malloc0(sizeof(PXA2xxI2SState));
 
     s->irq = irq;
     s->rx_dma = rx_dma;
@@ -2025,7 +2025,7 @@
 {
     int iomemtype;
     PXA2xxFIrState *s = (PXA2xxFIrState *)
-            qemu_mallocz(sizeof(PXA2xxFIrState));
+            g_malloc0(sizeof(PXA2xxFIrState));
 
     s->irq = irq;
     s->rx_dma = rx_dma;
@@ -2064,7 +2064,7 @@
     PXA2xxState *s;
     int iomemtype, i;
     DriveInfo *dinfo;
-    s = (PXA2xxState *) qemu_mallocz(sizeof(PXA2xxState));
+    s = (PXA2xxState *) g_malloc0(sizeof(PXA2xxState));
 
     if (revision && strncmp(revision, "pxa27", 5)) {
         fprintf(stderr, "Machine requires a PXA27x processor.\n");
@@ -2162,7 +2162,7 @@
     vmstate_register(NULL, 0, &vmstate_pxa2xx_pm, s);
 
     for (i = 0; pxa27x_ssp[i].io_base; i ++);
-    s->ssp = (SSIBus **)qemu_mallocz(sizeof(SSIBus *) * i);
+    s->ssp = (SSIBus **)g_malloc0(sizeof(SSIBus *) * i);
     for (i = 0; pxa27x_ssp[i].io_base; i ++) {
         DeviceState *dev;
         dev = sysbus_create_simple("pxa2xx-ssp", pxa27x_ssp[i].io_base,
@@ -2207,7 +2207,7 @@
     int iomemtype, i;
     DriveInfo *dinfo;
 
-    s = (PXA2xxState *) qemu_mallocz(sizeof(PXA2xxState));
+    s = (PXA2xxState *) g_malloc0(sizeof(PXA2xxState));
 
     s->env = cpu_init("pxa255");
     if (!s->env) {
@@ -2298,7 +2298,7 @@
     vmstate_register(NULL, 0, &vmstate_pxa2xx_pm, s);
 
     for (i = 0; pxa255_ssp[i].io_base; i ++);
-    s->ssp = (SSIBus **)qemu_mallocz(sizeof(SSIBus *) * i);
+    s->ssp = (SSIBus **)g_malloc0(sizeof(SSIBus *) * i);
     for (i = 0; pxa255_ssp[i].io_base; i ++) {
         DeviceState *dev;
         dev = sysbus_create_simple("pxa2xx-ssp", pxa255_ssp[i].io_base,
diff --git a/hw/pxa2xx_dma.c b/hw/pxa2xx_dma.c
index 599581e..07ec2db 100644
--- a/hw/pxa2xx_dma.c
+++ b/hw/pxa2xx_dma.c
@@ -461,7 +461,7 @@
         return -1;
     }
 
-    s->chan = qemu_mallocz(sizeof(PXA2xxDMAChannel) * s->channels);
+    s->chan = g_malloc0(sizeof(PXA2xxDMAChannel) * s->channels);
 
     memset(s->chan, 0, sizeof(PXA2xxDMAChannel) * s->channels);
     for (i = 0; i < s->channels; i ++)
diff --git a/hw/pxa2xx_keypad.c b/hw/pxa2xx_keypad.c
index 10ef154..e33959d 100644
--- a/hw/pxa2xx_keypad.c
+++ b/hw/pxa2xx_keypad.c
@@ -312,7 +312,7 @@
     int iomemtype;
     PXA2xxKeyPadState *s;
 
-    s = (PXA2xxKeyPadState *) qemu_mallocz(sizeof(PXA2xxKeyPadState));
+    s = (PXA2xxKeyPadState *) g_malloc0(sizeof(PXA2xxKeyPadState));
     s->irq = irq;
 
     iomemtype = cpu_register_io_memory(pxa2xx_keypad_readfn,
diff --git a/hw/pxa2xx_lcd.c b/hw/pxa2xx_lcd.c
index a5f8c51..97f9015 100644
--- a/hw/pxa2xx_lcd.c
+++ b/hw/pxa2xx_lcd.c
@@ -986,7 +986,7 @@
     int iomemtype;
     PXA2xxLCDState *s;
 
-    s = (PXA2xxLCDState *) qemu_mallocz(sizeof(PXA2xxLCDState));
+    s = (PXA2xxLCDState *) g_malloc0(sizeof(PXA2xxLCDState));
     s->invalidated = 1;
     s->irq = irq;
 
diff --git a/hw/pxa2xx_mmci.c b/hw/pxa2xx_mmci.c
index d86f735..1de4979 100644
--- a/hw/pxa2xx_mmci.c
+++ b/hw/pxa2xx_mmci.c
@@ -524,7 +524,7 @@
     int iomemtype;
     PXA2xxMMCIState *s;
 
-    s = (PXA2xxMMCIState *) qemu_mallocz(sizeof(PXA2xxMMCIState));
+    s = (PXA2xxMMCIState *) g_malloc0(sizeof(PXA2xxMMCIState));
     s->irq = irq;
     s->rx_dma = rx_dma;
     s->tx_dma = tx_dma;
diff --git a/hw/pxa2xx_pcmcia.c b/hw/pxa2xx_pcmcia.c
index 50d4649..74c6817 100644
--- a/hw/pxa2xx_pcmcia.c
+++ b/hw/pxa2xx_pcmcia.c
@@ -136,7 +136,7 @@
     PXA2xxPCMCIAState *s;
 
     s = (PXA2xxPCMCIAState *)
-            qemu_mallocz(sizeof(PXA2xxPCMCIAState));
+            g_malloc0(sizeof(PXA2xxPCMCIAState));
 
     /* Socket I/O Memory Space */
     iomemtype = cpu_register_io_memory(pxa2xx_pcmcia_io_readfn,
diff --git a/hw/qdev-properties.c b/hw/qdev-properties.c
index eff2d24..0c0c292 100644
--- a/hw/qdev-properties.c
+++ b/hw/qdev-properties.c
@@ -275,14 +275,14 @@
     char **ptr = qdev_get_prop_ptr(dev, prop);
 
     if (*ptr)
-        qemu_free(*ptr);
-    *ptr = qemu_strdup(str);
+        g_free(*ptr);
+    *ptr = g_strdup(str);
     return 0;
 }
 
 static void free_string(DeviceState *dev, Property *prop)
 {
-    qemu_free(*(char **)qdev_get_prop_ptr(dev, prop));
+    g_free(*(char **)qdev_get_prop_ptr(dev, prop));
 }
 
 static int print_string(DeviceState *dev, Property *prop, char *dest, size_t len)
@@ -768,7 +768,7 @@
 {
     GlobalProperty *g;
 
-    g = qemu_mallocz(sizeof(*g));
+    g = g_malloc0(sizeof(*g));
     g->driver   = qemu_opt_get(opts, "driver");
     g->property = qemu_opt_get(opts, "property");
     g->value    = qemu_opt_get(opts, "value");
diff --git a/hw/qdev.c b/hw/qdev.c
index d8114c6..c463c52 100644
--- a/hw/qdev.c
+++ b/hw/qdev.c
@@ -85,7 +85,7 @@
     DeviceState *dev;
 
     assert(bus->info == info->bus_info);
-    dev = qemu_mallocz(info->size);
+    dev = g_malloc0(info->size);
     dev->info = info;
     dev->parent_bus = bus;
     qdev_prop_set_defaults(dev, dev->info->props);
@@ -408,7 +408,7 @@
             prop->info->free(dev, prop);
         }
     }
-    qemu_free(dev);
+    g_free(dev);
 }
 
 void qdev_machine_creation_done(void)
@@ -750,17 +750,17 @@
 
     if (name) {
         /* use supplied name */
-        bus->name = qemu_strdup(name);
+        bus->name = g_strdup(name);
     } else if (parent && parent->id) {
         /* parent device has id -> use it for bus name */
         len = strlen(parent->id) + 16;
-        buf = qemu_malloc(len);
+        buf = g_malloc(len);
         snprintf(buf, len, "%s.%d", parent->id, parent->num_child_bus);
         bus->name = buf;
     } else {
         /* no id -> use lowercase bus type for bus name */
         len = strlen(info->name) + 16;
-        buf = qemu_malloc(len);
+        buf = g_malloc(len);
         len = snprintf(buf, len, "%s.%d", info->name,
                        parent ? parent->num_child_bus : 0);
         for (i = 0; i < len; i++)
@@ -783,7 +783,7 @@
 {
     BusState *bus;
 
-    bus = qemu_mallocz(info->size);
+    bus = g_malloc0(info->size);
     bus->qdev_allocated = 1;
     qbus_create_inplace(bus, info, parent, name);
     return bus;
@@ -793,7 +793,7 @@
 {
     /* assign main_system_bus before qbus_create_inplace()
      * in order to make "if (bus != main_system_bus)" work */
-    main_system_bus = qemu_mallocz(system_bus_info.size);
+    main_system_bus = g_malloc0(system_bus_info.size);
     main_system_bus->qdev_allocated = 1;
     qbus_create_inplace(main_system_bus, &system_bus_info, NULL,
                         "main-system-bus");
@@ -813,9 +813,9 @@
         assert(bus != main_system_bus); /* main_system_bus is never freed */
         qemu_unregister_reset(qbus_reset_all_fn, bus);
     }
-    qemu_free((void*)bus->name);
+    g_free((void*)bus->name);
     if (bus->qdev_allocated) {
-        qemu_free(bus);
+        g_free(bus);
     }
 }
 
@@ -935,7 +935,7 @@
         if (dev->parent_bus->info->get_fw_dev_path) {
             d = dev->parent_bus->info->get_fw_dev_path(dev);
             l += snprintf(p + l, size - l, "%s", d);
-            qemu_free(d);
+            g_free(d);
         } else {
             l += snprintf(p + l, size - l, "%s", dev->info->name);
         }
diff --git a/hw/qxl-render.c b/hw/qxl-render.c
index 1b77577..c290739 100644
--- a/hw/qxl-render.c
+++ b/hw/qxl-render.c
@@ -81,7 +81,7 @@
         qxl->guest_primary.resized = 0;
 
         if (qxl->guest_primary.flipped) {
-            qemu_free(qxl->guest_primary.flipped);
+            g_free(qxl->guest_primary.flipped);
             qxl->guest_primary.flipped = NULL;
         }
         qemu_free_displaysurface(vga->ds);
@@ -90,7 +90,7 @@
         if (qxl->guest_primary.stride < 0) {
             /* spice surface is upside down -> need extra buffer to flip */
             qxl->guest_primary.stride = -qxl->guest_primary.stride;
-            qxl->guest_primary.flipped = qemu_malloc(qxl->guest_primary.surface.width *
+            qxl->guest_primary.flipped = g_malloc(qxl->guest_primary.surface.width *
                                                      qxl->guest_primary.stride);
             ptr = qxl->guest_primary.flipped;
         } else {
diff --git a/hw/qxl.c b/hw/qxl.c
index b34bccf..bab60a5 100644
--- a/hw/qxl.c
+++ b/hw/qxl.c
@@ -1697,7 +1697,7 @@
         qxl_create_guest_primary(d, 1, QXL_SYNC);
 
         /* replay surface-create and cursor-set commands */
-        cmds = qemu_mallocz(sizeof(QXLCommandExt) * (NUM_SURFACES + 1));
+        cmds = g_malloc0(sizeof(QXLCommandExt) * (NUM_SURFACES + 1));
         for (in = 0, out = 0; in < NUM_SURFACES; in++) {
             if (d->guest_surfaces.cmds[in] == 0) {
                 continue;
@@ -1712,7 +1712,7 @@
         cmds[out].group_id = MEMSLOT_GROUP_GUEST;
         out++;
         qxl_spice_loadvm_commands(d, cmds, out);
-        qemu_free(cmds);
+        g_free(cmds);
 
         break;
     case QXL_MODE_COMPAT:
diff --git a/hw/r2d.c b/hw/r2d.c
index a0f8c1f..96a7ff8 100644
--- a/hw/r2d.c
+++ b/hw/r2d.c
@@ -184,7 +184,7 @@
     int iomemtype;
     r2d_fpga_t *s;
 
-    s = qemu_mallocz(sizeof(r2d_fpga_t));
+    s = g_malloc0(sizeof(r2d_fpga_t));
 
     s->irl = irl;
 
@@ -244,7 +244,7 @@
         fprintf(stderr, "Unable to find CPU definition\n");
         exit(1);
     }
-    reset_info = qemu_mallocz(sizeof(ResetData));
+    reset_info = g_malloc0(sizeof(ResetData));
     reset_info->env = env;
     reset_info->vector = env->pc;
     qemu_register_reset(main_cpu_reset, reset_info);
diff --git a/hw/rc4030.c b/hw/rc4030.c
index 6563336..a2a2099 100644
--- a/hw/rc4030.c
+++ b/hw/rc4030.c
@@ -789,8 +789,8 @@
     struct rc4030DMAState *p;
     int i;
 
-    s = (rc4030_dma *)qemu_mallocz(sizeof(rc4030_dma) * n);
-    p = (struct rc4030DMAState *)qemu_mallocz(sizeof(struct rc4030DMAState) * n);
+    s = (rc4030_dma *)g_malloc0(sizeof(rc4030_dma) * n);
+    p = (struct rc4030DMAState *)g_malloc0(sizeof(struct rc4030DMAState) * n);
     for (i = 0; i < n; i++) {
         p->opaque = opaque;
         p->n = i;
@@ -806,7 +806,7 @@
     rc4030State *s;
     int s_chipset, s_jazzio;
 
-    s = qemu_mallocz(sizeof(rc4030State));
+    s = g_malloc0(sizeof(rc4030State));
 
     *irqs = qemu_allocate_irqs(rc4030_irq_jazz_request, s, 16);
     *dmas = rc4030_allocate_dmas(s, 4);
diff --git a/hw/rtl8139.c b/hw/rtl8139.c
index c6cafc2..c5de5b4 100644
--- a/hw/rtl8139.c
+++ b/hw/rtl8139.c
@@ -1796,7 +1796,7 @@
 
         if (iov) {
             buf2_size = iov_size(iov, 3);
-            buf2 = qemu_malloc(buf2_size);
+            buf2 = g_malloc(buf2_size);
             iov_to_buf(iov, 3, buf2, 0, buf2_size);
             buf = buf2;
         }
@@ -1805,7 +1805,7 @@
         rtl8139_do_receive(&s->nic->nc, buf, size, do_interrupt);
 
         if (iov) {
-            qemu_free(buf2);
+            g_free(buf2);
         }
     }
     else
@@ -2053,7 +2053,7 @@
     if (!s->cplus_txbuffer)
     {
         s->cplus_txbuffer_len = CP_TX_BUFFER_SIZE;
-        s->cplus_txbuffer = qemu_malloc(s->cplus_txbuffer_len);
+        s->cplus_txbuffer = g_malloc(s->cplus_txbuffer_len);
         s->cplus_txbuffer_offset = 0;
 
         DPRINTF("+++ C+ mode transmission buffer allocated space %d\n",
@@ -2063,7 +2063,7 @@
     while (s->cplus_txbuffer && s->cplus_txbuffer_offset + txsize >= s->cplus_txbuffer_len)
     {
         s->cplus_txbuffer_len += CP_TX_BUFFER_SIZE;
-        s->cplus_txbuffer = qemu_realloc(s->cplus_txbuffer, s->cplus_txbuffer_len);
+        s->cplus_txbuffer = g_realloc(s->cplus_txbuffer, s->cplus_txbuffer_len);
 
         DPRINTF("+++ C+ mode transmission buffer space changed to %d\n",
             s->cplus_txbuffer_len);
@@ -2401,7 +2401,7 @@
         }
         else
         {
-            qemu_free(saved_buffer);
+            g_free(saved_buffer);
         }
     }
     else
@@ -3441,7 +3441,7 @@
     memory_region_destroy(&s->bar_io);
     memory_region_destroy(&s->bar_mem);
     if (s->cplus_txbuffer) {
-        qemu_free(s->cplus_txbuffer);
+        g_free(s->cplus_txbuffer);
         s->cplus_txbuffer = NULL;
     }
     qemu_del_timer(s->timer);
diff --git a/hw/s390-virtio.c b/hw/s390-virtio.c
index abe954d..acbf026 100644
--- a/hw/s390-virtio.c
+++ b/hw/s390-virtio.c
@@ -165,14 +165,14 @@
     cpu_register_physical_memory(0, my_ram_size, ram_addr);
 
     /* allocate storage keys */
-    storage_keys = qemu_mallocz(my_ram_size / TARGET_PAGE_SIZE);
+    storage_keys = g_malloc0(my_ram_size / TARGET_PAGE_SIZE);
 
     /* init CPUs */
     if (cpu_model == NULL) {
         cpu_model = "host";
     }
 
-    ipi_states = qemu_malloc(sizeof(CPUState *) * smp_cpus);
+    ipi_states = g_malloc(sizeof(CPUState *) * smp_cpus);
 
     for (i = 0; i < smp_cpus; i++) {
         CPUState *tmp_env;
@@ -211,7 +211,7 @@
 
         bios_filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, bios_name);
         bios_size = load_image(bios_filename, qemu_get_ram_ptr(ZIPL_LOAD_ADDR));
-        qemu_free(bios_filename);
+        g_free(bios_filename);
 
         if ((long)bios_size < 0) {
             hw_error("could not load bootloader '%s'\n", bios_name);
@@ -247,7 +247,7 @@
         DeviceState *dev;
 
         if (!nd->model) {
-            nd->model = qemu_strdup("virtio");
+            nd->model = g_strdup("virtio");
         }
 
         if (strcmp(nd->model, "virtio")) {
diff --git a/hw/scsi-bus.c b/hw/scsi-bus.c
index c3ce7df..6f0d039 100644
--- a/hw/scsi-bus.c
+++ b/hw/scsi-bus.c
@@ -346,7 +346,7 @@
 {
     SCSIRequest *req;
 
-    req = qemu_mallocz(reqops->size);
+    req = g_malloc0(reqops->size);
     req->refcount = 1;
     req->bus = scsi_bus_from_device(d);
     req->dev = d;
@@ -1015,7 +1015,7 @@
         if (req->ops->free_req) {
             req->ops->free_req(req);
         }
-        qemu_free(req);
+        g_free(req);
     }
 }
 
diff --git a/hw/scsi-disk.c b/hw/scsi-disk.c
index f1ffe95..d94b1eb 100644
--- a/hw/scsi-disk.c
+++ b/hw/scsi-disk.c
@@ -1125,12 +1125,12 @@
         /* try to fall back to value set with legacy -drive serial=... */
         dinfo = drive_get_by_blockdev(s->bs);
         if (*dinfo->serial) {
-            s->serial = qemu_strdup(dinfo->serial);
+            s->serial = g_strdup(dinfo->serial);
         }
     }
 
     if (!s->version) {
-        s->version = qemu_strdup(QEMU_VERSION);
+        s->version = g_strdup(QEMU_VERSION);
     }
 
     if (bdrv_is_sg(s->bs)) {
diff --git a/hw/scsi-generic.c b/hw/scsi-generic.c
index b63371e..cb5d4f1 100644
--- a/hw/scsi-generic.c
+++ b/hw/scsi-generic.c
@@ -66,7 +66,7 @@
 {
     SCSIGenericReq *r = DO_UPCAST(SCSIGenericReq, req, req);
 
-    qemu_free(r->buf);
+    g_free(r->buf);
 }
 
 /* Helper function for command completion.  */
@@ -288,7 +288,7 @@
 
     if (r->req.cmd.xfer == 0) {
         if (r->buf != NULL)
-            qemu_free(r->buf);
+            g_free(r->buf);
         r->buflen = 0;
         r->buf = NULL;
         ret = execute_command(s->bs, r, SG_DXFER_NONE, scsi_command_complete);
@@ -301,8 +301,8 @@
 
     if (r->buflen != r->req.cmd.xfer) {
         if (r->buf != NULL)
-            qemu_free(r->buf);
-        r->buf = qemu_malloc(r->req.cmd.xfer);
+            g_free(r->buf);
+        r->buf = g_malloc(r->req.cmd.xfer);
         r->buflen = r->req.cmd.xfer;
     }
 
diff --git a/hw/sd.c b/hw/sd.c
index c2c80ab..bb8c2ff 100644
--- a/hw/sd.c
+++ b/hw/sd.c
@@ -409,9 +409,9 @@
     sd->bdrv = bdrv;
 
     if (sd->wp_groups)
-        qemu_free(sd->wp_groups);
+        g_free(sd->wp_groups);
     sd->wp_switch = bdrv ? bdrv_is_read_only(bdrv) : 0;
-    sd->wp_groups = (int *) qemu_mallocz(sizeof(int) * sect);
+    sd->wp_groups = (int *) g_malloc0(sizeof(int) * sect);
     memset(sd->function_group, 0, sizeof(int) * 6);
     sd->erase_start = 0;
     sd->erase_end = 0;
@@ -443,7 +443,7 @@
 {
     SDState *sd;
 
-    sd = (SDState *) qemu_mallocz(sizeof(SDState));
+    sd = (SDState *) g_malloc0(sizeof(SDState));
     sd->buf = qemu_blockalign(bs, 512);
     sd->spi = is_spi;
     sd->enable = 1;
diff --git a/hw/serial.c b/hw/serial.c
index 0ee61dd..222e356 100644
--- a/hw/serial.c
+++ b/hw/serial.c
@@ -797,7 +797,7 @@
 {
     SerialState *s;
 
-    s = qemu_mallocz(sizeof(SerialState));
+    s = g_malloc0(sizeof(SerialState));
 
     s->irq = irq;
     s->baudbase = baudbase;
@@ -931,7 +931,7 @@
     SerialState *s;
     int s_io_memory;
 
-    s = qemu_mallocz(sizeof(SerialState));
+    s = g_malloc0(sizeof(SerialState));
 
     s->it_shift = it_shift;
     s->irq = irq;
diff --git a/hw/sh7750.c b/hw/sh7750.c
index 4f279e7..9f3ea92 100644
--- a/hw/sh7750.c
+++ b/hw/sh7750.c
@@ -712,7 +712,7 @@
     int sh7750_io_memory;
     int sh7750_mm_cache_and_tlb; /* memory mapped cache and tlb */
 
-    s = qemu_mallocz(sizeof(SH7750State));
+    s = g_malloc0(sizeof(SH7750State));
     s->cpu = cpu;
     s->periph_freq = 60000000;	/* 60MHz */
     sh7750_io_memory = cpu_register_io_memory(sh7750_mem_read,
diff --git a/hw/sh_intc.c b/hw/sh_intc.c
index c43b99f..ecb46e5 100644
--- a/hw/sh_intc.c
+++ b/hw/sh_intc.c
@@ -431,7 +431,7 @@
     desc->nr_prio_regs = nr_prio_regs;
 
     i = sizeof(struct intc_source) * nr_sources;
-    desc->sources = qemu_mallocz(i);
+    desc->sources = g_malloc0(i);
 
     for (i = 0; i < desc->nr_sources; i++) {
         struct intc_source *source = desc->sources + i;
diff --git a/hw/sh_serial.c b/hw/sh_serial.c
index 191f4a6..1767c97 100644
--- a/hw/sh_serial.c
+++ b/hw/sh_serial.c
@@ -361,7 +361,7 @@
     sh_serial_state *s;
     int s_io_memory;
 
-    s = qemu_mallocz(sizeof(sh_serial_state));
+    s = g_malloc0(sizeof(sh_serial_state));
 
     s->feat = feat;
     s->flags = SH_SERIAL_FLAG_TEND | SH_SERIAL_FLAG_TDE;
diff --git a/hw/sh_timer.c b/hw/sh_timer.c
index 5df7fb6..dca3c94 100644
--- a/hw/sh_timer.c
+++ b/hw/sh_timer.c
@@ -188,7 +188,7 @@
     sh_timer_state *s;
     QEMUBH *bh;
 
-    s = (sh_timer_state *)qemu_mallocz(sizeof(sh_timer_state));
+    s = (sh_timer_state *)g_malloc0(sizeof(sh_timer_state));
     s->freq = freq;
     s->feat = feat;
     s->tcor = 0xffffffff;
@@ -311,7 +311,7 @@
     tmu012_state *s;
     int timer_feat = (feat & TMU012_FEAT_EXTCLK) ? TIMER_FEAT_EXTCLK : 0;
 
-    s = (tmu012_state *)qemu_mallocz(sizeof(tmu012_state));
+    s = (tmu012_state *)g_malloc0(sizeof(tmu012_state));
     s->feat = feat;
     s->timer[0] = sh_timer_init(freq, timer_feat, ch0_irq);
     s->timer[1] = sh_timer_init(freq, timer_feat, ch1_irq);
diff --git a/hw/slavio_timer.c b/hw/slavio_timer.c
index 5511313..f89b4fb 100644
--- a/hw/slavio_timer.c
+++ b/hw/slavio_timer.c
@@ -381,7 +381,7 @@
     TimerContext *tc;
 
     for (i = 0; i <= MAX_CPUS; i++) {
-        tc = qemu_mallocz(sizeof(TimerContext));
+        tc = g_malloc0(sizeof(TimerContext));
         tc->s = s;
         tc->timer_index = i;
 
diff --git a/hw/sm501.c b/hw/sm501.c
index 0f0bf96..1ed0a7e 100644
--- a/hw/sm501.c
+++ b/hw/sm501.c
@@ -1395,7 +1395,7 @@
     int sm501_2d_engine_index;
 
     /* allocate management data region */
-    s = (SM501State *)qemu_mallocz(sizeof(SM501State));
+    s = (SM501State *)g_malloc0(sizeof(SM501State));
     s->base = base;
     s->local_mem_size_index
 	= get_local_mem_size_index(local_mem_bytes);
diff --git a/hw/smbios.c b/hw/smbios.c
index a3ae1de..8f2e965 100644
--- a/hw/smbios.c
+++ b/hw/smbios.c
@@ -105,9 +105,9 @@
 
     if (!smbios_entries) {
         smbios_entries_len = sizeof(uint16_t);
-        smbios_entries = qemu_mallocz(smbios_entries_len);
+        smbios_entries = g_malloc0(smbios_entries_len);
     }
-    smbios_entries = qemu_realloc(smbios_entries, smbios_entries_len +
+    smbios_entries = g_realloc(smbios_entries, smbios_entries_len +
                                                   sizeof(*field) + len);
     field = (struct smbios_field *)(smbios_entries + smbios_entries_len);
     field->header.type = SMBIOS_FIELD_ENTRY;
@@ -192,10 +192,10 @@
 
         if (!smbios_entries) {
             smbios_entries_len = sizeof(uint16_t);
-            smbios_entries = qemu_mallocz(smbios_entries_len);
+            smbios_entries = g_malloc0(smbios_entries_len);
         }
 
-        smbios_entries = qemu_realloc(smbios_entries, smbios_entries_len +
+        smbios_entries = g_realloc(smbios_entries, smbios_entries_len +
                                                       sizeof(*table) + size);
         table = (struct smbios_table *)(smbios_entries + smbios_entries_len);
         table->header.type = SMBIOS_TABLE_ENTRY;
diff --git a/hw/smbus_eeprom.c b/hw/smbus_eeprom.c
index 3634754..5d080ab 100644
--- a/hw/smbus_eeprom.c
+++ b/hw/smbus_eeprom.c
@@ -130,7 +130,7 @@
                        const uint8_t *eeprom_spd, int eeprom_spd_size)
 {
     int i;
-    uint8_t *eeprom_buf = qemu_mallocz(8 * 256); /* XXX: make this persistent */
+    uint8_t *eeprom_buf = g_malloc0(8 * 256); /* XXX: make this persistent */
     if (eeprom_spd_size > 0) {
         memcpy(eeprom_buf, eeprom_spd, eeprom_spd_size);
     }
diff --git a/hw/soc_dma.c b/hw/soc_dma.c
index 3f0f414..03bc846 100644
--- a/hw/soc_dma.c
+++ b/hw/soc_dma.c
@@ -48,7 +48,7 @@
 static void transfer_fifo2fifo(struct soc_dma_ch_s *ch)
 {
     if (ch->bytes > fifo_size)
-        fifo_buf = qemu_realloc(fifo_buf, fifo_size = ch->bytes);
+        fifo_buf = g_realloc(fifo_buf, fifo_size = ch->bytes);
 
     /* Implement as transfer_fifo2linear + transfer_linear2fifo.  */
     ch->io_fn[0](ch->io_opaque[0], fifo_buf, ch->bytes);
@@ -239,7 +239,7 @@
 struct soc_dma_s *soc_dma_init(int n)
 {
     int i;
-    struct dma_s *s = qemu_mallocz(sizeof(*s) + n * sizeof(*s->ch));
+    struct dma_s *s = g_malloc0(sizeof(*s) + n * sizeof(*s->ch));
 
     s->chnum = n;
     s->soc.ch = s->ch;
@@ -261,7 +261,7 @@
     struct memmap_entry_s *entry;
     struct dma_s *dma = (struct dma_s *) soc;
 
-    dma->memmap = qemu_realloc(dma->memmap, sizeof(*entry) *
+    dma->memmap = g_realloc(dma->memmap, sizeof(*entry) *
                     (dma->memmap_size + 1));
     entry = soc_dma_lookup(dma, virt_base);
 
@@ -313,7 +313,7 @@
     struct memmap_entry_s *entry;
     struct dma_s *dma = (struct dma_s *) soc;
 
-    dma->memmap = qemu_realloc(dma->memmap, sizeof(*entry) *
+    dma->memmap = g_realloc(dma->memmap, sizeof(*entry) *
                     (dma->memmap_size + 1));
     entry = soc_dma_lookup(dma, virt_base);
 
diff --git a/hw/spapr.c b/hw/spapr.c
index 109b774..1265cee 100644
--- a/hw/spapr.c
+++ b/hw/spapr.c
@@ -85,7 +85,7 @@
         }                                                          \
     } while (0)
 
-    fdt = qemu_mallocz(FDT_MAX_SIZE);
+    fdt = g_malloc0(FDT_MAX_SIZE);
     _FDT((fdt_create(fdt, FDT_MAX_SIZE)));
 
     _FDT((fdt_finish_reservemap(fdt)));
@@ -125,7 +125,7 @@
     _FDT((fdt_property_cell(fdt, "#address-cells", 0x1)));
     _FDT((fdt_property_cell(fdt, "#size-cells", 0x0)));
 
-    modelname = qemu_strdup(cpu_model);
+    modelname = g_strdup(cpu_model);
 
     for (i = 0; i < strlen(modelname); i++) {
         modelname[i] = toupper(modelname[i]);
@@ -176,7 +176,7 @@
         _FDT((fdt_end_node(fdt)));
     }
 
-    qemu_free(modelname);
+    g_free(modelname);
 
     _FDT((fdt_end_node(fdt)));
 
@@ -228,7 +228,7 @@
     int ret;
     void *fdt;
 
-    fdt = qemu_malloc(FDT_MAX_SIZE);
+    fdt = g_malloc(FDT_MAX_SIZE);
 
     /* open out the base tree into a temp buffer for the final tweaks */
     _FDT((fdt_open_into(spapr->fdt_skel, fdt, FDT_MAX_SIZE)));
@@ -249,7 +249,7 @@
 
     cpu_physical_memory_write(fdt_addr, fdt, fdt_totalsize(fdt));
 
-    qemu_free(fdt);
+    g_free(fdt);
 }
 
 static uint64_t translate_kernel_address(void *opaque, uint64_t addr)
@@ -300,7 +300,7 @@
     char *filename;
     int irq = 16;
 
-    spapr = qemu_malloc(sizeof(*spapr));
+    spapr = g_malloc(sizeof(*spapr));
     cpu_ppc_hypercall = emulate_spapr_hypercall;
 
     /* We place the device tree just below either the top of RAM, or
@@ -337,7 +337,7 @@
      * later we should probably make it scale to the size of guest
      * RAM */
     spapr->htab_size = 1ULL << (pteg_shift + 7);
-    spapr->htab = qemu_malloc(spapr->htab_size);
+    spapr->htab = g_malloc(spapr->htab_size);
 
     for (env = first_cpu; env != NULL; env = env->next_cpu) {
         env->external_htab = spapr->htab;
@@ -352,7 +352,7 @@
         hw_error("qemu: could not load LPAR rtas '%s'\n", filename);
         exit(1);
     }
-    qemu_free(filename);
+    g_free(filename);
 
     /* Set up Interrupt Controller */
     spapr->icp = xics_system_init(XICS_IRQS);
@@ -372,7 +372,7 @@
         NICInfo *nd = &nd_table[i];
 
         if (!nd->model) {
-            nd->model = qemu_strdup("ibmveth");
+            nd->model = g_strdup("ibmveth");
         }
 
         if (strcmp(nd->model, "ibmveth") == 0) {
@@ -436,7 +436,7 @@
             hw_error("qemu: could not load LPAR rtas '%s'\n", filename);
             exit(1);
         }
-        qemu_free(filename);
+        g_free(filename);
         spapr->entry_point = 0x100;
         initrd_base = 0;
         initrd_size = 0;
diff --git a/hw/spapr_vio.c b/hw/spapr_vio.c
index 481a804..ce6558b 100644
--- a/hw/spapr_vio.c
+++ b/hw/spapr_vio.c
@@ -160,7 +160,7 @@
         * sizeof(VIOsPAPR_RTCE);
 
     if (size) {
-        dev->rtce_table = qemu_mallocz(size);
+        dev->rtce_table = g_malloc0(size);
     }
 }
 
diff --git a/hw/spapr_vscsi.c b/hw/spapr_vscsi.c
index d98d1fd..fc9ac6a 100644
--- a/hw/spapr_vscsi.c
+++ b/hw/spapr_vscsi.c
@@ -788,7 +788,7 @@
     if (spapr_tce_dma_read(&s->vdev, crq->s.IU_data_ptr, &req->iu,
                            crq->s.IU_length)) {
         fprintf(stderr, "vscsi_got_payload: DMA read failure !\n");
-        qemu_free(req);
+        g_free(req);
     }
     memcpy(&req->crq, crq, sizeof(vscsi_crq));
 
diff --git a/hw/stellaris.c b/hw/stellaris.c
index a280930..646eec7 100644
--- a/hw/stellaris.c
+++ b/hw/stellaris.c
@@ -605,7 +605,7 @@
     int iomemtype;
     ssys_state *s;
 
-    s = (ssys_state *)qemu_mallocz(sizeof(ssys_state));
+    s = (ssys_state *)g_malloc0(sizeof(ssys_state));
     s->irq = irq;
     s->board = board;
     /* Most devices come preprogrammed with a MAC address in the user data. */
diff --git a/hw/stellaris_enet.c b/hw/stellaris_enet.c
index 1291931..f9bd3da 100644
--- a/hw/stellaris_enet.c
+++ b/hw/stellaris_enet.c
@@ -393,7 +393,7 @@
 
     cpu_unregister_io_memory(s->mmio_index);
 
-    qemu_free(s);
+    g_free(s);
 }
 
 static NetClientInfo net_stellaris_enet_info = {
diff --git a/hw/stellaris_input.c b/hw/stellaris_input.c
index 95604ec..68c600c 100644
--- a/hw/stellaris_input.c
+++ b/hw/stellaris_input.c
@@ -77,8 +77,8 @@
     gamepad_state *s;
     int i;
 
-    s = (gamepad_state *)qemu_mallocz(sizeof (gamepad_state));
-    s->buttons = (gamepad_button *)qemu_mallocz(n * sizeof (gamepad_button));
+    s = (gamepad_state *)g_malloc0(sizeof (gamepad_state));
+    s->buttons = (gamepad_button *)g_malloc0(n * sizeof (gamepad_button));
     for (i = 0; i < n; i++) {
         s->buttons[i].irq = irq[i];
         s->buttons[i].keycode = keycode[i];
diff --git a/hw/strongarm.c b/hw/strongarm.c
index 0e03d61..3a7fd6d 100644
--- a/hw/strongarm.c
+++ b/hw/strongarm.c
@@ -1529,7 +1529,7 @@
     qemu_irq *pic;
     int i;
 
-    s = qemu_mallocz(sizeof(StrongARMState));
+    s = g_malloc0(sizeof(StrongARMState));
 
     if (!rev) {
         rev = "sa1110-b5";
diff --git a/hw/sun4m.c b/hw/sun4m.c
index df3aa32..7516703 100644
--- a/hw/sun4m.c
+++ b/hw/sun4m.c
@@ -681,7 +681,7 @@
         if (ret < 0 || ret > PROM_SIZE_MAX) {
             ret = load_image_targphys(filename, addr, PROM_SIZE_MAX);
         }
-        qemu_free(filename);
+        g_free(filename);
     } else {
         ret = -1;
     }
diff --git a/hw/sun4u.c b/hw/sun4u.c
index 7b2d0b1..1b60e4e 100644
--- a/hw/sun4u.c
+++ b/hw/sun4u.c
@@ -351,7 +351,7 @@
                                   QEMUBHFunc *cb, uint32_t frequency,
                                   uint64_t disabled_mask)
 {
-    CPUTimer *timer = qemu_mallocz(sizeof (CPUTimer));
+    CPUTimer *timer = g_malloc0(sizeof (CPUTimer));
 
     timer->name = name;
     timer->frequency = frequency;
@@ -608,7 +608,7 @@
         if (ret < 0 || ret > PROM_SIZE_MAX) {
             ret = load_image_targphys(filename, addr, PROM_SIZE_MAX);
         }
-        qemu_free(filename);
+        g_free(filename);
     } else {
         ret = -1;
     }
@@ -723,7 +723,7 @@
     env->hstick = cpu_timer_create("hstick", env, hstick_irq,
                                     hstick_frequency, TICK_INT_DIS);
 
-    reset_info = qemu_mallocz(sizeof(ResetData));
+    reset_info = g_malloc0(sizeof(ResetData));
     reset_info->env = env;
     reset_info->prom_addr = hwdef->prom_addr;
     qemu_register_reset(main_cpu_reset, reset_info);
diff --git a/hw/syborg_interrupt.c b/hw/syborg_interrupt.c
index 5217983..1b0f3bb 100644
--- a/hw/syborg_interrupt.c
+++ b/hw/syborg_interrupt.c
@@ -213,7 +213,7 @@
                                        syborg_int_writefn, s,
                                        DEVICE_NATIVE_ENDIAN);
     sysbus_init_mmio(dev, 0x1000, iomemtype);
-    s->flags = qemu_mallocz(s->num_irqs * sizeof(syborg_int_flags));
+    s->flags = g_malloc0(s->num_irqs * sizeof(syborg_int_flags));
 
     register_savevm(&dev->qdev, "syborg_int", -1, 1, syborg_int_save,
                     syborg_int_load, s);
diff --git a/hw/syborg_keyboard.c b/hw/syborg_keyboard.c
index 706a039..82b9dc0 100644
--- a/hw/syborg_keyboard.c
+++ b/hw/syborg_keyboard.c
@@ -195,7 +195,7 @@
         fprintf(stderr, "syborg_keyboard: fifo too small\n");
         s->fifo_size = 16;
     }
-    s->key_fifo = qemu_mallocz(s->fifo_size * sizeof(s->key_fifo[0]));
+    s->key_fifo = g_malloc0(s->fifo_size * sizeof(s->key_fifo[0]));
 
     qemu_add_kbd_event_handler(syborg_keyboard_event, s);
 
diff --git a/hw/syborg_pointer.c b/hw/syborg_pointer.c
index 2f99707..b91214d 100644
--- a/hw/syborg_pointer.c
+++ b/hw/syborg_pointer.c
@@ -198,7 +198,7 @@
         fprintf(stderr, "syborg_pointer: fifo too small\n");
         s->fifo_size = 16;
     }
-    s->event_fifo = qemu_mallocz(s->fifo_size * sizeof(s->event_fifo[0]));
+    s->event_fifo = g_malloc0(s->fifo_size * sizeof(s->event_fifo[0]));
 
     qemu_add_mouse_event_handler(syborg_pointer_event, s, s->absolute,
                                  "Syborg Pointer");
diff --git a/hw/syborg_serial.c b/hw/syborg_serial.c
index 2ef7175..4d0ec04 100644
--- a/hw/syborg_serial.c
+++ b/hw/syborg_serial.c
@@ -311,7 +311,7 @@
         fprintf(stderr, "syborg_serial: fifo too small\n");
         s->fifo_size = 16;
     }
-    s->read_fifo = qemu_mallocz(s->fifo_size * sizeof(s->read_fifo[0]));
+    s->read_fifo = g_malloc0(s->fifo_size * sizeof(s->read_fifo[0]));
 
     return 0;
 }
diff --git a/hw/sysbus.c b/hw/sysbus.c
index ea442ac..f8f1746 100644
--- a/hw/sysbus.c
+++ b/hw/sysbus.c
@@ -158,8 +158,8 @@
 {
     SysBusDeviceInfo *info;
 
-    info = qemu_mallocz(sizeof(*info));
-    info->qdev.name = qemu_strdup(name);
+    info = g_malloc0(sizeof(*info));
+    info->qdev.name = g_strdup(name);
     info->qdev.size = size;
     info->init = init;
     sysbus_register_withprop(info);
diff --git a/hw/tc58128.c b/hw/tc58128.c
index 61b99dd..ee3ecad 100644
--- a/hw/tc58128.c
+++ b/hw/tc58128.c
@@ -30,7 +30,7 @@
     int ret, blocks;
 
     dev->state = WAIT;
-    dev->flash_contents = qemu_mallocz(FLASH_SIZE);
+    dev->flash_contents = g_malloc0(FLASH_SIZE);
     memset(dev->flash_contents, 0xff, FLASH_SIZE);
     if (!dev->flash_contents) {
 	fprintf(stderr, "could not alloc memory for flash\n");
diff --git a/hw/tc6393xb.c b/hw/tc6393xb.c
index a1c48bf..c28005a 100644
--- a/hw/tc6393xb.c
+++ b/hw/tc6393xb.c
@@ -579,7 +579,7 @@
         tc6393xb_writel,
     };
 
-    s = (TC6393xbState *) qemu_mallocz(sizeof(TC6393xbState));
+    s = (TC6393xbState *) g_malloc0(sizeof(TC6393xbState));
     s->irq = irq;
     s->gpio_in = qemu_allocate_irqs(tc6393xb_gpio_set, s, TC6393XB_GPIOS);
 
diff --git a/hw/tsc2005.c b/hw/tsc2005.c
index c95dcf0..9a500eb 100644
--- a/hw/tsc2005.c
+++ b/hw/tsc2005.c
@@ -524,7 +524,7 @@
     TSC2005State *s;
 
     s = (TSC2005State *)
-            qemu_mallocz(sizeof(TSC2005State));
+            g_malloc0(sizeof(TSC2005State));
     s->x = 400;
     s->y = 240;
     s->pressure = 0;
diff --git a/hw/tsc210x.c b/hw/tsc210x.c
index 96446dd..3c448a6 100644
--- a/hw/tsc210x.c
+++ b/hw/tsc210x.c
@@ -1105,7 +1105,7 @@
     TSC210xState *s;
 
     s = (TSC210xState *)
-            qemu_mallocz(sizeof(TSC210xState));
+            g_malloc0(sizeof(TSC210xState));
     memset(s, 0, sizeof(TSC210xState));
     s->x = 160;
     s->y = 160;
@@ -1154,7 +1154,7 @@
     TSC210xState *s;
 
     s = (TSC210xState *)
-            qemu_mallocz(sizeof(TSC210xState));
+            g_malloc0(sizeof(TSC210xState));
     memset(s, 0, sizeof(TSC210xState));
     s->x = 400;
     s->y = 240;
diff --git a/hw/tusb6010.c b/hw/tusb6010.c
index ccd01ad..d7ae527 100644
--- a/hw/tusb6010.c
+++ b/hw/tusb6010.c
@@ -729,7 +729,7 @@
 
 TUSBState *tusb6010_init(qemu_irq intr)
 {
-    TUSBState *s = qemu_mallocz(sizeof(*s));
+    TUSBState *s = g_malloc0(sizeof(*s));
 
     s->test_reset = TUSB_PROD_TEST_RESET_VAL;
     s->host_mode = 0;
diff --git a/hw/usb-bus.c b/hw/usb-bus.c
index f1dd55e..c0bbc7c 100644
--- a/hw/usb-bus.c
+++ b/hw/usb-bus.c
@@ -342,7 +342,7 @@
 static char *usb_get_dev_path(DeviceState *qdev)
 {
     USBDevice *dev = DO_UPCAST(USBDevice, qdev, qdev);
-    return qemu_strdup(dev->port->path);
+    return g_strdup(dev->port->path);
 }
 
 static char *usb_get_fw_dev_path(DeviceState *qdev)
@@ -353,7 +353,7 @@
     long nr;
 
     fw_len = 32 + strlen(dev->port->path) * 6;
-    fw_path = qemu_malloc(fw_len);
+    fw_path = g_malloc(fw_len);
     in = dev->port->path;
     while (fw_len - pos > 0) {
         nr = strtol(in, &in, 10);
diff --git a/hw/usb-desc.c b/hw/usb-desc.c
index bc6858f..ae2d384 100644
--- a/hw/usb-desc.c
+++ b/hw/usb-desc.c
@@ -283,12 +283,12 @@
         }
     }
     if (s == NULL) {
-        s = qemu_mallocz(sizeof(*s));
+        s = g_malloc0(sizeof(*s));
         s->index = index;
         QLIST_INSERT_HEAD(&dev->strings, s, next);
     }
-    qemu_free(s->str);
-    s->str = qemu_strdup(str);
+    g_free(s->str);
+    s->str = g_strdup(str);
 }
 
 const char *usb_desc_get_string(USBDevice *dev, uint8_t index)
diff --git a/hw/usb-ehci.c b/hw/usb-ehci.c
index c9d0a69..47a7fb9 100644
--- a/hw/usb-ehci.c
+++ b/hw/usb-ehci.c
@@ -652,7 +652,7 @@
 {
     EHCIQueue *q;
 
-    q = qemu_mallocz(sizeof(*q));
+    q = g_malloc0(sizeof(*q));
     q->ehci = ehci;
     q->async_schedule = async;
     QTAILQ_INSERT_HEAD(&ehci->queues, q, next);
@@ -667,7 +667,7 @@
         usb_cancel_packet(&q->packet);
     }
     QTAILQ_REMOVE(&q->ehci->queues, q, next);
-    qemu_free(q);
+    g_free(q);
 }
 
 static EHCIQueue *ehci_find_queue_by_qh(EHCIState *ehci, uint32_t addr)
diff --git a/hw/usb-musb.c b/hw/usb-musb.c
index d3ccde9..799fa6e 100644
--- a/hw/usb-musb.c
+++ b/hw/usb-musb.c
@@ -342,7 +342,7 @@
 
 struct MUSBState *musb_init(qemu_irq *irqs)
 {
-    MUSBState *s = qemu_mallocz(sizeof(*s));
+    MUSBState *s = g_malloc0(sizeof(*s));
     int i;
 
     s->irqs = irqs;
diff --git a/hw/usb-net.c b/hw/usb-net.c
index 0cb47d6..a8b7c8d 100644
--- a/hw/usb-net.c
+++ b/hw/usb-net.c
@@ -844,7 +844,7 @@
     QTAILQ_REMOVE(&s->rndis_resp, r, entries);
     ret = r->length;
     memcpy(buf, r->buf, r->length);
-    qemu_free(r);
+    g_free(r);
 
     return ret;
 }
@@ -852,7 +852,7 @@
 static void *rndis_queue_response(USBNetState *s, unsigned int length)
 {
     struct rndis_response *r =
-            qemu_mallocz(sizeof(struct rndis_response) + length);
+            g_malloc0(sizeof(struct rndis_response) + length);
 
     QTAILQ_INSERT_TAIL(&s->rndis_resp, r, entries);
     r->length = length;
@@ -866,7 +866,7 @@
 
     while ((r = s->rndis_resp.tqh_first)) {
         QTAILQ_REMOVE(&s->rndis_resp, r, entries);
-        qemu_free(r);
+        g_free(r);
     }
 }
 
diff --git a/hw/usb-uhci.c b/hw/usb-uhci.c
index 16088d7..6ca7ca8 100644
--- a/hw/usb-uhci.c
+++ b/hw/usb-uhci.c
@@ -168,7 +168,7 @@
 
 static UHCIAsync *uhci_async_alloc(UHCIState *s)
 {
-    UHCIAsync *async = qemu_malloc(sizeof(UHCIAsync));
+    UHCIAsync *async = g_malloc(sizeof(UHCIAsync));
 
     memset(&async->packet, 0, sizeof(async->packet));
     async->uhci  = s;
@@ -187,7 +187,7 @@
 {
     usb_packet_cleanup(&async->packet);
     qemu_sglist_destroy(&async->sgl);
-    qemu_free(async);
+    g_free(async);
 }
 
 static void uhci_async_link(UHCIState *s, UHCIAsync *async)
diff --git a/hw/vga-isa-mm.c b/hw/vga-isa-mm.c
index 96e6e7d..b934978 100644
--- a/hw/vga-isa-mm.c
+++ b/hw/vga-isa-mm.c
@@ -102,11 +102,11 @@
     MemoryRegion *s_ioport_ctrl, *vga_io_memory;
 
     s->it_shift = it_shift;
-    s_ioport_ctrl = qemu_malloc(sizeof(*s_ioport_ctrl));
+    s_ioport_ctrl = g_malloc(sizeof(*s_ioport_ctrl));
     memory_region_init_io(s_ioport_ctrl, &vga_mm_ctrl_ops, s,
                           "vga-mm-ctrl", 0x100000);
 
-    vga_io_memory = qemu_malloc(sizeof(*vga_io_memory));
+    vga_io_memory = g_malloc(sizeof(*vga_io_memory));
     /* XXX: endianness? */
     memory_region_init_io(vga_io_memory, &vga_mem_ops, &s->vga,
                           "vga-mem", 0x20000);
@@ -125,7 +125,7 @@
 {
     ISAVGAMMState *s;
 
-    s = qemu_mallocz(sizeof(*s));
+    s = g_malloc0(sizeof(*s));
 
     vga_common_init(&s->vga, VGA_RAM_SIZE);
     vga_mm_init(s, vram_base, ctrl_base, it_shift);
diff --git a/hw/vga.c b/hw/vga.c
index 33dc478..a190105 100644
--- a/hw/vga.c
+++ b/hw/vga.c
@@ -2234,7 +2234,7 @@
 #endif
 #endif /* CONFIG_BOCHS_VBE */
 
-    vga_mem = qemu_malloc(sizeof(*vga_mem));
+    vga_mem = g_malloc(sizeof(*vga_mem));
     memory_region_init_io(vga_mem, &vga_mem_ops, s,
                           "vga-lowmem", 0x20000);
 
@@ -2302,7 +2302,7 @@
         return -1;
     fprintf(f, "P6\n%d %d\n%d\n",
             ds->width, ds->height, 255);
-    linebuf = qemu_malloc(ds->width * 3);
+    linebuf = g_malloc(ds->width * 3);
     d1 = ds->data;
     for(y = 0; y < ds->height; y++) {
         d = d1;
@@ -2327,7 +2327,7 @@
         ret = fwrite(linebuf, 1, pbuf - linebuf, f);
         (void)ret;
     }
-    qemu_free(linebuf);
+    g_free(linebuf);
     fclose(f);
     return 0;
 }
@@ -2336,7 +2336,7 @@
 {
     DisplayChangeListener *dcl;
 
-    dcl = qemu_mallocz(sizeof(DisplayChangeListener));
+    dcl = g_malloc0(sizeof(DisplayChangeListener));
     dcl->dpy_update = vga_save_dpy_update;
     dcl->dpy_resize = vga_save_dpy_resize;
     dcl->dpy_refresh = vga_save_dpy_refresh;
diff --git a/hw/vhost.c b/hw/vhost.c
index 19e7255..1886067 100644
--- a/hw/vhost.c
+++ b/hw/vhost.c
@@ -252,7 +252,7 @@
     uint64_t log_base;
     int r;
     if (size) {
-        log = qemu_mallocz(size * sizeof *log);
+        log = g_malloc0(size * sizeof *log);
     } else {
         log = NULL;
     }
@@ -262,7 +262,7 @@
     vhost_client_sync_dirty_bitmap(&dev->client, 0,
                                    (target_phys_addr_t)~0x0ull);
     if (dev->log) {
-        qemu_free(dev->log);
+        g_free(dev->log);
     }
     dev->log = log;
     dev->log_size = size;
@@ -348,7 +348,7 @@
     uint64_t log_size;
     int r;
 
-    dev->mem = qemu_realloc(dev->mem, s);
+    dev->mem = g_realloc(dev->mem, s);
 
     if (log_dirty) {
         flags = IO_MEM_UNASSIGNED;
@@ -485,7 +485,7 @@
             return r;
         }
         if (dev->log) {
-            qemu_free(dev->log);
+            g_free(dev->log);
         }
         dev->log = NULL;
         dev->log_size = 0;
@@ -669,7 +669,7 @@
     hdev->client.migration_log = vhost_client_migration_log;
     hdev->client.log_start = NULL;
     hdev->client.log_stop = NULL;
-    hdev->mem = qemu_mallocz(offsetof(struct vhost_memory, regions));
+    hdev->mem = g_malloc0(offsetof(struct vhost_memory, regions));
     hdev->log = NULL;
     hdev->log_size = 0;
     hdev->log_enabled = false;
@@ -686,7 +686,7 @@
 void vhost_dev_cleanup(struct vhost_dev *hdev)
 {
     cpu_unregister_phys_memory_client(&hdev->client);
-    qemu_free(hdev->mem);
+    g_free(hdev->mem);
     close(hdev->control);
 }
 
@@ -734,7 +734,7 @@
     if (hdev->log_enabled) {
         hdev->log_size = vhost_get_log_size(hdev);
         hdev->log = hdev->log_size ?
-            qemu_mallocz(hdev->log_size * sizeof *hdev->log) : NULL;
+            g_malloc0(hdev->log_size * sizeof *hdev->log) : NULL;
         r = ioctl(hdev->control, VHOST_SET_LOG_BASE,
                   (uint64_t)(unsigned long)hdev->log);
         if (r < 0) {
@@ -782,7 +782,7 @@
     assert (r >= 0);
 
     hdev->started = false;
-    qemu_free(hdev->log);
+    g_free(hdev->log);
     hdev->log = NULL;
     hdev->log_size = 0;
 }
diff --git a/hw/vhost_net.c b/hw/vhost_net.c
index b6dc592..a559812 100644
--- a/hw/vhost_net.c
+++ b/hw/vhost_net.c
@@ -92,7 +92,7 @@
                                  bool force)
 {
     int r;
-    struct vhost_net *net = qemu_malloc(sizeof *net);
+    struct vhost_net *net = g_malloc(sizeof *net);
     if (!backend) {
         fprintf(stderr, "vhost-net requires backend to be setup\n");
         goto fail;
@@ -125,7 +125,7 @@
     vhost_net_ack_features(net, 0);
     return net;
 fail:
-    qemu_free(net);
+    g_free(net);
     return NULL;
 }
 
@@ -198,7 +198,7 @@
     if (net->dev.acked_features & (1 << VIRTIO_NET_F_MRG_RXBUF)) {
         tap_set_vnet_hdr_len(net->vc, sizeof(struct virtio_net_hdr));
     }
-    qemu_free(net);
+    g_free(net);
 }
 #else
 struct vhost_net *vhost_net_init(VLANClientState *backend, int devfd,
diff --git a/hw/virtex_ml507.c b/hw/virtex_ml507.c
index 7bde8c7..333050c 100644
--- a/hw/virtex_ml507.c
+++ b/hw/virtex_ml507.c
@@ -102,7 +102,7 @@
     ppc_dcr_init(env, NULL, NULL);
 
     /* interrupt controller */
-    irqs = qemu_mallocz(sizeof(qemu_irq) * PPCUIC_OUTPUT_NB);
+    irqs = g_malloc0(sizeof(qemu_irq) * PPCUIC_OUTPUT_NB);
     irqs[PPCUIC_OUTPUT_INT] = ((qemu_irq *)env->irq_inputs)[PPC40x_INPUT_INT];
     irqs[PPCUIC_OUTPUT_CINT] = ((qemu_irq *)env->irq_inputs)[PPC40x_INPUT_CINT];
     ppcuic_init(env, irqs, 0x0C0, 0, 1);
@@ -154,7 +154,7 @@
         path = qemu_find_file(QEMU_FILE_TYPE_BIOS, BINARY_DEVICE_TREE_FILE);
         if (path) {
             fdt = load_device_tree(path, &fdt_size);
-            qemu_free(path);
+            g_free(path);
         }
         if (!fdt) {
             return 0;
@@ -173,7 +173,7 @@
         path = qemu_find_file(QEMU_FILE_TYPE_BIOS, BINARY_DEVICE_TREE_FILE);
         if (path) {
             fdt_size = load_image_targphys(path, addr, 0x10000);
-            qemu_free(path);
+            g_free(path);
         }
     }
 
diff --git a/hw/virtio-blk.c b/hw/virtio-blk.c
index 836dbc3..dad8c0a 100644
--- a/hw/virtio-blk.c
+++ b/hw/virtio-blk.c
@@ -59,7 +59,7 @@
     virtqueue_push(s->vq, &req->elem, req->qiov.size + sizeof(*req->in));
     virtio_notify(&s->vdev, s->vq);
 
-    qemu_free(req);
+    g_free(req);
 }
 
 static int virtio_blk_handle_rw_error(VirtIOBlockReq *req, int error,
@@ -117,7 +117,7 @@
 
 static VirtIOBlockReq *virtio_blk_alloc_request(VirtIOBlock *s)
 {
-    VirtIOBlockReq *req = qemu_malloc(sizeof(*req));
+    VirtIOBlockReq *req = g_malloc(sizeof(*req));
     req->dev = s;
     req->qiov.size = 0;
     req->next = NULL;
@@ -130,7 +130,7 @@
 
     if (req != NULL) {
         if (!virtqueue_pop(s->vq, &req->elem)) {
-            qemu_free(req);
+            g_free(req);
             return NULL;
         }
     }
diff --git a/hw/virtio-net.c b/hw/virtio-net.c
index 3f10391..8c2f460 100644
--- a/hw/virtio-net.c
+++ b/hw/virtio-net.c
@@ -1039,9 +1039,9 @@
     n->mergeable_rx_bufs = 0;
     n->promisc = 1; /* for compatibility */
 
-    n->mac_table.macs = qemu_mallocz(MAC_TABLE_ENTRIES * ETH_ALEN);
+    n->mac_table.macs = g_malloc0(MAC_TABLE_ENTRIES * ETH_ALEN);
 
-    n->vlans = qemu_mallocz(MAX_VLAN >> 3);
+    n->vlans = g_malloc0(MAX_VLAN >> 3);
 
     n->qdev = dev;
     register_savevm(dev, "virtio-net", -1, VIRTIO_NET_VM_VERSION,
@@ -1063,8 +1063,8 @@
 
     unregister_savevm(n->qdev, "virtio-net", n);
 
-    qemu_free(n->mac_table.macs);
-    qemu_free(n->vlans);
+    g_free(n->mac_table.macs);
+    g_free(n->vlans);
 
     if (n->tx_timer) {
         qemu_del_timer(n->tx_timer);
diff --git a/hw/virtio-serial-bus.c b/hw/virtio-serial-bus.c
index c5eb931..a4825b9 100644
--- a/hw/virtio-serial-bus.c
+++ b/hw/virtio-serial-bus.c
@@ -383,14 +383,14 @@
             stw_p(&cpkt.value, 1);
 
             buffer_len = sizeof(cpkt) + strlen(port->name) + 1;
-            buffer = qemu_malloc(buffer_len);
+            buffer = g_malloc(buffer_len);
 
             memcpy(buffer, &cpkt, sizeof(cpkt));
             memcpy(buffer + sizeof(cpkt), port->name, strlen(port->name));
             buffer[buffer_len - 1] = 0;
 
             send_control_msg(port, buffer, buffer_len);
-            qemu_free(buffer);
+            g_free(buffer);
         }
 
         if (port->host_connected) {
@@ -447,9 +447,9 @@
          * if the size of the buf differs
          */
         if (cur_len > len) {
-            qemu_free(buf);
+            g_free(buf);
 
-            buf = qemu_malloc(cur_len);
+            buf = g_malloc(cur_len);
             len = cur_len;
         }
         copied = iov_to_buf(elem.out_sg, elem.out_num, buf, 0, len);
@@ -457,7 +457,7 @@
         handle_control_message(vser, buf, copied);
         virtqueue_push(vq, &elem, 0);
     }
-    qemu_free(buf);
+    g_free(buf);
     virtio_notify(vdev, vq);
 }
 
@@ -862,8 +862,8 @@
     QTAILQ_INIT(&vser->ports);
 
     vser->bus.max_nr_ports = conf->max_virtserial_ports;
-    vser->ivqs = qemu_malloc(conf->max_virtserial_ports * sizeof(VirtQueue *));
-    vser->ovqs = qemu_malloc(conf->max_virtserial_ports * sizeof(VirtQueue *));
+    vser->ivqs = g_malloc(conf->max_virtserial_ports * sizeof(VirtQueue *));
+    vser->ovqs = g_malloc(conf->max_virtserial_ports * sizeof(VirtQueue *));
 
     /* Add a queue for host to guest transfers for port 0 (backward compat) */
     vser->ivqs[0] = virtio_add_queue(vdev, 128, handle_input);
@@ -889,7 +889,7 @@
     }
 
     vser->config.max_nr_ports = tswap32(conf->max_virtserial_ports);
-    vser->ports_map = qemu_mallocz(((conf->max_virtserial_ports + 31) / 32)
+    vser->ports_map = g_malloc0(((conf->max_virtserial_ports + 31) / 32)
         * sizeof(vser->ports_map[0]));
     /*
      * Reserve location 0 for a console port for backward compat
@@ -919,9 +919,9 @@
 
     unregister_savevm(vser->qdev, "virtio-console", vser);
 
-    qemu_free(vser->ivqs);
-    qemu_free(vser->ovqs);
-    qemu_free(vser->ports_map);
+    g_free(vser->ivqs);
+    g_free(vser->ovqs);
+    g_free(vser->ports_map);
 
     virtio_cleanup(vdev);
 }
diff --git a/hw/virtio.c b/hw/virtio.c
index 93dfb1e..13aa0fa 100644
--- a/hw/virtio.c
+++ b/hw/virtio.c
@@ -832,9 +832,9 @@
 {
     qemu_del_vm_change_state_handler(vdev->vmstate);
     if (vdev->config)
-        qemu_free(vdev->config);
-    qemu_free(vdev->vq);
-    qemu_free(vdev);
+        g_free(vdev->config);
+    g_free(vdev->vq);
+    g_free(vdev);
 }
 
 static void virtio_vmstate_change(void *opaque, int running, int reason)
@@ -862,14 +862,14 @@
     VirtIODevice *vdev;
     int i;
 
-    vdev = qemu_mallocz(struct_size);
+    vdev = g_malloc0(struct_size);
 
     vdev->device_id = device_id;
     vdev->status = 0;
     vdev->isr = 0;
     vdev->queue_sel = 0;
     vdev->config_vector = VIRTIO_NO_VECTOR;
-    vdev->vq = qemu_mallocz(sizeof(VirtQueue) * VIRTIO_PCI_QUEUE_MAX);
+    vdev->vq = g_malloc0(sizeof(VirtQueue) * VIRTIO_PCI_QUEUE_MAX);
     vdev->vm_running = vm_running;
     for(i = 0; i < VIRTIO_PCI_QUEUE_MAX; i++) {
         vdev->vq[i].vector = VIRTIO_NO_VECTOR;
@@ -879,7 +879,7 @@
     vdev->name = name;
     vdev->config_len = config_size;
     if (vdev->config_len)
-        vdev->config = qemu_mallocz(config_size);
+        vdev->config = g_malloc0(config_size);
     else
         vdev->config = NULL;
 
diff --git a/hw/vmware_vga.c b/hw/vmware_vga.c
index d5cfa70..a840cbd 100644
--- a/hw/vmware_vga.c
+++ b/hw/vmware_vga.c
@@ -1068,7 +1068,7 @@
         DisplaySurface *ds = qemu_create_displaysurface_from(s->width,
                 s->height, 32, ds_get_linesize(s->vga.ds), s->vga.vram_ptr);
         ppm_save(filename, ds);
-        qemu_free(ds);
+        g_free(ds);
     }
 }
 
@@ -1210,7 +1210,7 @@
 static void vmsvga_init(struct vmsvga_state_s *s, int vga_ram_size)
 {
     s->scratch_size = SVGA_SCRATCH_SIZE;
-    s->scratch = qemu_malloc(s->scratch_size * 4);
+    s->scratch = g_malloc(s->scratch_size * 4);
 
     s->vga.ds = graphic_console_init(vmsvga_update_display,
                                      vmsvga_invalidate_display,
@@ -1274,7 +1274,7 @@
     MemoryRegion *iomem;
 
 #ifdef DIRECT_VRAM
-    DirectMem *directmem = qemu_malloc(sizeof(*directmem));
+    DirectMem *directmem = g_malloc(sizeof(*directmem));
 
     iomem = &directmem->mr;
     memory_region_init_io(iomem, &vmsvga_vram_io_ops, &s->chip, "vmsvga",
diff --git a/hw/wm8750.c b/hw/wm8750.c
index c9c6744..39383f4 100644
--- a/hw/wm8750.c
+++ b/hw/wm8750.c
@@ -625,7 +625,7 @@
     WM8750State *s = (WM8750State *) i2c;
     wm8750_reset(&s->i2c);
     AUD_remove_card(&s->card);
-    qemu_free(s);
+    g_free(s);
 }
 #endif
 
diff --git a/hw/xen_backend.c b/hw/xen_backend.c
index d881fa2..aa64267 100644
--- a/hw/xen_backend.c
+++ b/hw/xen_backend.c
@@ -75,8 +75,8 @@
     str = xs_read(xenstore, 0, abspath, &len);
     if (str != NULL) {
         /* move to qemu-allocated memory to make sure
-         * callers can savely qemu_free() stuff. */
-        ret = qemu_strdup(str);
+         * callers can savely g_free() stuff. */
+        ret = g_strdup(str);
         free(str);
     }
     return ret;
@@ -99,7 +99,7 @@
     if (val && 1 == sscanf(val, "%d", ival)) {
         rc = 0;
     }
-    qemu_free(val);
+    g_free(val);
     return rc;
 }
 
@@ -199,7 +199,7 @@
     }
 
     /* init new xendev */
-    xendev = qemu_mallocz(ops->size);
+    xendev = g_malloc0(ops->size);
     xendev->type  = type;
     xendev->dom   = dom;
     xendev->dev   = dev;
@@ -218,7 +218,7 @@
     xendev->evtchndev = xen_xc_evtchn_open(NULL, 0);
     if (xendev->evtchndev == XC_HANDLER_INITIAL_VALUE) {
         xen_be_printf(NULL, 0, "can't open evtchn device\n");
-        qemu_free(xendev);
+        g_free(xendev);
         return NULL;
     }
     fcntl(xc_evtchn_fd(xendev->evtchndev), F_SETFD, FD_CLOEXEC);
@@ -228,7 +228,7 @@
         if (xendev->gnttabdev == XC_HANDLER_INITIAL_VALUE) {
             xen_be_printf(NULL, 0, "can't open gnttab device\n");
             xc_evtchn_close(xendev->evtchndev);
-            qemu_free(xendev);
+            g_free(xendev);
             return NULL;
         }
     } else {
@@ -275,7 +275,7 @@
             char token[XEN_BUFSIZE];
             snprintf(token, sizeof(token), "fe:%p", xendev);
             xs_unwatch(xenstore, xendev->fe, token);
-            qemu_free(xendev->fe);
+            g_free(xendev->fe);
         }
 
         if (xendev->evtchndev != XC_HANDLER_INITIAL_VALUE) {
@@ -286,7 +286,7 @@
         }
 
         QTAILQ_REMOVE(&xendevs, xendev, next);
-        qemu_free(xendev);
+        g_free(xendev);
     }
     return NULL;
 }
@@ -328,7 +328,7 @@
         xendev->fe_state = fe_state;
     }
     if (node == NULL  ||  strcmp(node, "protocol") == 0) {
-        qemu_free(xendev->protocol);
+        g_free(xendev->protocol);
         xendev->protocol = xenstore_read_fe_str(xendev, "protocol");
         if (xendev->protocol) {
             xen_be_printf(xendev, 1, "frontend protocol: %s\n", xendev->protocol);
diff --git a/hw/xen_console.c b/hw/xen_console.c
index 8ef104c..99ff442 100644
--- a/hw/xen_console.c
+++ b/hw/xen_console.c
@@ -70,7 +70,7 @@
 
     if ((buffer->capacity - buffer->size) < size) {
 	buffer->capacity += (size + 1024);
-	buffer->data = qemu_realloc(buffer->data, buffer->capacity);
+	buffer->data = g_realloc(buffer->data, buffer->capacity);
     }
 
     while (cons != prod)
@@ -89,7 +89,7 @@
 	uint8_t *maxpos = buffer->data + buffer->max_capacity;
 
 	memmove(maxpos - over, maxpos, over);
-	buffer->data = qemu_realloc(buffer->data, buffer->max_capacity);
+	buffer->data = g_realloc(buffer->data, buffer->max_capacity);
 	buffer->size = buffer->capacity = buffer->max_capacity;
 
 	if (buffer->consumed > buffer->max_capacity - over)
@@ -208,7 +208,7 @@
     xenstore_store_pv_console_info(con->xendev.dev, con->chr);
 
 out:
-    qemu_free(type);
+    g_free(type);
     return ret;
 }
 
diff --git a/hw/xen_devconfig.c b/hw/xen_devconfig.c
index 6926c54..41accbb 100644
--- a/hw/xen_devconfig.c
+++ b/hw/xen_devconfig.c
@@ -14,7 +14,7 @@
 {
     struct xs_dirs *d;
 
-    d = qemu_malloc(sizeof(*d));
+    d = g_malloc(sizeof(*d));
     d->xs_dir = dir;
     QTAILQ_INSERT_TAIL(&xs_cleanup, d, list);
 }
@@ -43,7 +43,7 @@
 	xen_be_printf(NULL, 0, "xs_mkdir %s: failed\n", dev);
 	return -1;
     }
-    xen_config_cleanup_dir(qemu_strdup(dev));
+    xen_config_cleanup_dir(g_strdup(dev));
 
     if (!xs_set_permissions(xenstore, 0, dev, perms, 2)) {
 	xen_be_printf(NULL, 0, "xs_set_permissions %s: failed\n", dev);
diff --git a/hw/xen_disk.c b/hw/xen_disk.c
index add815f..31f9151 100644
--- a/hw/xen_disk.c
+++ b/hw/xen_disk.c
@@ -124,7 +124,7 @@
             goto out;
         }
         /* allocate new struct */
-        ioreq = qemu_mallocz(sizeof(*ioreq));
+        ioreq = g_malloc0(sizeof(*ioreq));
         ioreq->blkdev = blkdev;
         blkdev->requests_total++;
         qemu_iovec_init(&ioreq->v, BLKIF_MAX_SEGMENTS_PER_REQUEST);
@@ -716,15 +716,15 @@
     return 0;
 
 out_error:
-    qemu_free(blkdev->params);
+    g_free(blkdev->params);
     blkdev->params = NULL;
-    qemu_free(blkdev->mode);
+    g_free(blkdev->mode);
     blkdev->mode = NULL;
-    qemu_free(blkdev->type);
+    g_free(blkdev->type);
     blkdev->type = NULL;
-    qemu_free(blkdev->dev);
+    g_free(blkdev->dev);
     blkdev->dev = NULL;
-    qemu_free(blkdev->devtype);
+    g_free(blkdev->devtype);
     blkdev->devtype = NULL;
     return -1;
 }
@@ -822,14 +822,14 @@
         ioreq = QLIST_FIRST(&blkdev->freelist);
         QLIST_REMOVE(ioreq, list);
         qemu_iovec_destroy(&ioreq->v);
-        qemu_free(ioreq);
+        g_free(ioreq);
     }
 
-    qemu_free(blkdev->params);
-    qemu_free(blkdev->mode);
-    qemu_free(blkdev->type);
-    qemu_free(blkdev->dev);
-    qemu_free(blkdev->devtype);
+    g_free(blkdev->params);
+    g_free(blkdev->mode);
+    g_free(blkdev->type);
+    g_free(blkdev->dev);
+    g_free(blkdev->devtype);
     qemu_bh_delete(blkdev->bh);
     return 0;
 }
diff --git a/hw/xen_nic.c b/hw/xen_nic.c
index ff86491..b28b156 100644
--- a/hw/xen_nic.c
+++ b/hw/xen_nic.c
@@ -183,7 +183,7 @@
             if (txreq.flags & NETTXF_csum_blank) {
                 /* have read-only mapping -> can't fill checksum in-place */
                 if (!tmpbuf) {
-                    tmpbuf = qemu_malloc(XC_PAGE_SIZE);
+                    tmpbuf = g_malloc(XC_PAGE_SIZE);
                 }
                 memcpy(tmpbuf, page + txreq.offset, txreq.size);
                 net_checksum_calculate(tmpbuf, txreq.size);
@@ -199,7 +199,7 @@
         }
         netdev->tx_work = 0;
     }
-    qemu_free(tmpbuf);
+    g_free(tmpbuf);
 }
 
 /* ------------------------------------------------------------- */
@@ -423,7 +423,7 @@
 {
     struct XenNetDev *netdev = container_of(xendev, struct XenNetDev, xendev);
 
-    qemu_free(netdev->mac);
+    g_free(netdev->mac);
     return 0;
 }
 
diff --git a/hw/xenfb.c b/hw/xenfb.c
index 0a01ae3..d532d3e 100644
--- a/hw/xenfb.c
+++ b/hw/xenfb.c
@@ -366,7 +366,7 @@
             /* there is no vfb, run vkbd on its own */
             in->c.ds = get_displaystate();
         } else {
-            qemu_free(vfb);
+            g_free(vfb);
             xen_be_printf(xendev, 1, "ds not set (yet)\n");
             return -1;
         }
@@ -483,8 +483,8 @@
     n_fbdirs = xenfb->fbpages * mode / 8;
     n_fbdirs = (n_fbdirs + (XC_PAGE_SIZE - 1)) / XC_PAGE_SIZE;
 
-    pgmfns = qemu_mallocz(sizeof(unsigned long) * n_fbdirs);
-    fbmfns = qemu_mallocz(sizeof(unsigned long) * xenfb->fbpages);
+    pgmfns = g_malloc0(sizeof(unsigned long) * n_fbdirs);
+    fbmfns = g_malloc0(sizeof(unsigned long) * xenfb->fbpages);
 
     xenfb_copy_mfns(mode, n_fbdirs, pgmfns, pd);
     map = xc_map_foreign_pages(xen_xc, xenfb->c.xendev.dom,
@@ -502,8 +502,8 @@
     ret = 0; /* all is fine */
 
 out:
-    qemu_free(pgmfns);
-    qemu_free(fbmfns);
+    g_free(pgmfns);
+    g_free(fbmfns);
     return ret;
 }
 
diff --git a/hw/xics.c b/hw/xics.c
index 13a1d25..9bf82aa 100644
--- a/hw/xics.c
+++ b/hw/xics.c
@@ -440,9 +440,9 @@
         }
     }
 
-    icp = qemu_mallocz(sizeof(*icp));
+    icp = g_malloc0(sizeof(*icp));
     icp->nr_servers = max_server_num + 1;
-    icp->ss = qemu_mallocz(icp->nr_servers*sizeof(struct icp_server_state));
+    icp->ss = g_malloc0(icp->nr_servers*sizeof(struct icp_server_state));
 
     for (i = 0; i < icp->nr_servers; i++) {
         icp->ss[i].mfrr = 0xff;
@@ -467,10 +467,10 @@
         }
     }
 
-    ics = qemu_mallocz(sizeof(*ics));
+    ics = g_malloc0(sizeof(*ics));
     ics->nr_irqs = nr_irqs;
     ics->offset = 16;
-    ics->irqs = qemu_mallocz(nr_irqs * sizeof(struct ics_irq_state));
+    ics->irqs = g_malloc0(nr_irqs * sizeof(struct ics_irq_state));
 
     icp->ics = ics;
     ics->icp = icp;
diff --git a/hw/xilinx_axienet.c b/hw/xilinx_axienet.c
index 464d275..b875aad 100644
--- a/hw/xilinx_axienet.c
+++ b/hw/xilinx_axienet.c
@@ -789,8 +789,8 @@
 {
     /* FIXME.  */
     struct XilinxAXIEnet *s = DO_UPCAST(NICState, nc, nc)->opaque;
-    qemu_free(s->rxmem);
-    qemu_free(s);
+    g_free(s->rxmem);
+    g_free(s);
 }
 
 static void
@@ -871,7 +871,7 @@
 
     s->TEMAC.parent = s;
 
-    s->rxmem = qemu_malloc(s->c_rxmem);
+    s->rxmem = g_malloc(s->c_rxmem);
     axienet_reset(s);
 
     return 0;
diff --git a/hw/xilinx_timer.c b/hw/xilinx_timer.c
index d398c18..f1c7abc 100644
--- a/hw/xilinx_timer.c
+++ b/hw/xilinx_timer.c
@@ -198,7 +198,7 @@
     sysbus_init_irq(dev, &t->irq);
 
     /* Init all the ptimers.  */
-    t->timers = qemu_mallocz(sizeof t->timers[0] * t->nr_timers);
+    t->timers = g_malloc0(sizeof t->timers[0] * t->nr_timers);
     for (i = 0; i < t->nr_timers; i++) {
         struct xlx_timer *xt = &t->timers[i];
 
diff --git a/input.c b/input.c
index 310bad5..e2f7c92 100644
--- a/input.c
+++ b/input.c
@@ -73,12 +73,12 @@
     QEMUPutMouseEntry *s;
     static int mouse_index = 0;
 
-    s = qemu_mallocz(sizeof(QEMUPutMouseEntry));
+    s = g_malloc0(sizeof(QEMUPutMouseEntry));
 
     s->qemu_put_mouse_event = func;
     s->qemu_put_mouse_event_opaque = opaque;
     s->qemu_put_mouse_event_absolute = absolute;
-    s->qemu_put_mouse_event_name = qemu_strdup(name);
+    s->qemu_put_mouse_event_name = g_strdup(name);
     s->index = mouse_index++;
 
     QTAILQ_INSERT_TAIL(&mouse_handlers, s, node);
@@ -100,8 +100,8 @@
 {
     QTAILQ_REMOVE(&mouse_handlers, entry, node);
 
-    qemu_free(entry->qemu_put_mouse_event_name);
-    qemu_free(entry);
+    g_free(entry->qemu_put_mouse_event_name);
+    g_free(entry);
 
     check_mode_change();
 }
@@ -111,7 +111,7 @@
 {
     QEMUPutLEDEntry *s;
 
-    s = qemu_mallocz(sizeof(QEMUPutLEDEntry));
+    s = g_malloc0(sizeof(QEMUPutLEDEntry));
 
     s->put_led = func;
     s->opaque = opaque;
@@ -124,7 +124,7 @@
     if (entry == NULL)
         return;
     QTAILQ_REMOVE(&led_handlers, entry, next);
-    qemu_free(entry);
+    g_free(entry);
 }
 
 void kbd_put_keycode(int keycode)
diff --git a/iohandler.c b/iohandler.c
index 2b82421..4deae1e 100644
--- a/iohandler.c
+++ b/iohandler.c
@@ -67,7 +67,7 @@
             if (ioh->fd == fd)
                 goto found;
         }
-        ioh = qemu_mallocz(sizeof(IOHandlerRecord));
+        ioh = g_malloc0(sizeof(IOHandlerRecord));
         QLIST_INSERT_HEAD(&io_handlers, ioh, next);
     found:
         ioh->fd = fd;
@@ -126,7 +126,7 @@
             /* Do this last in case read/write handlers marked it for deletion */
             if (ioh->deleted) {
                 QLIST_REMOVE(ioh, next);
-                qemu_free(ioh);
+                g_free(ioh);
             }
         }
     }
@@ -157,7 +157,7 @@
     QLIST_FOREACH_SAFE(rec, &child_watches, next, next) {
         if (waitpid(rec->pid, NULL, WNOHANG) == rec->pid) {
             QLIST_REMOVE(rec, next);
-            qemu_free(rec);
+            g_free(rec);
         }
     }
 }
@@ -185,7 +185,7 @@
             return 1;
         }
     }
-    rec = qemu_mallocz(sizeof(ChildProcessRecord));
+    rec = g_malloc0(sizeof(ChildProcessRecord));
     rec->pid = pid;
     QLIST_INSERT_HEAD(&child_watches, rec, next);
     return 0;
diff --git a/kvm-all.c b/kvm-all.c
index b9c172b..0ae2e26 100644
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -400,9 +400,9 @@
         size = ALIGN(((mem->memory_size) >> TARGET_PAGE_BITS),
                      /*HOST_LONG_BITS*/ 64) / 8;
         if (!d.dirty_bitmap) {
-            d.dirty_bitmap = qemu_malloc(size);
+            d.dirty_bitmap = g_malloc(size);
         } else if (size > allocated_size) {
-            d.dirty_bitmap = qemu_realloc(d.dirty_bitmap, size);
+            d.dirty_bitmap = g_realloc(d.dirty_bitmap, size);
         }
         allocated_size = size;
         memset(d.dirty_bitmap, 0, allocated_size);
@@ -419,7 +419,7 @@
                                       mem->start_addr, mem->memory_size);
         start_addr = mem->start_addr + mem->memory_size;
     }
-    qemu_free(d.dirty_bitmap);
+    g_free(d.dirty_bitmap);
 
     return ret;
 }
@@ -702,7 +702,7 @@
     int ret;
     int i;
 
-    s = qemu_mallocz(sizeof(KVMState));
+    s = g_malloc0(sizeof(KVMState));
 
 #ifdef KVM_CAP_SET_GUEST_DEBUG
     QTAILQ_INIT(&s->kvm_sw_breakpoints);
@@ -804,7 +804,7 @@
             close(s->fd);
         }
     }
-    qemu_free(s);
+    g_free(s);
 
     return ret;
 }
@@ -1188,7 +1188,7 @@
             return 0;
         }
 
-        bp = qemu_malloc(sizeof(struct kvm_sw_breakpoint));
+        bp = g_malloc(sizeof(struct kvm_sw_breakpoint));
         if (!bp) {
             return -ENOMEM;
         }
@@ -1197,7 +1197,7 @@
         bp->use_count = 1;
         err = kvm_arch_insert_sw_breakpoint(current_env, bp);
         if (err) {
-            qemu_free(bp);
+            g_free(bp);
             return err;
         }
 
@@ -1243,7 +1243,7 @@
         }
 
         QTAILQ_REMOVE(&current_env->kvm_state->kvm_sw_breakpoints, bp, entry);
-        qemu_free(bp);
+        g_free(bp);
     } else {
         err = kvm_arch_remove_hw_breakpoint(addr, len, type);
         if (err) {
@@ -1316,12 +1316,12 @@
         return kvm_vcpu_ioctl(env, KVM_SET_SIGNAL_MASK, NULL);
     }
 
-    sigmask = qemu_malloc(sizeof(*sigmask) + sizeof(*sigset));
+    sigmask = g_malloc(sizeof(*sigmask) + sizeof(*sigset));
 
     sigmask->len = 8;
     memcpy(sigmask->sigset, sigset, sizeof(*sigset));
     r = kvm_vcpu_ioctl(env, KVM_SET_SIGNAL_MASK, sigmask);
-    qemu_free(sigmask);
+    g_free(sigmask);
 
     return r;
 }
diff --git a/libcacard/cac.c b/libcacard/cac.c
index f34f63a..f4b0b1b 100644
--- a/libcacard/cac.c
+++ b/libcacard/cac.c
@@ -98,7 +98,7 @@
 
     pki_applet->cert_buffer = NULL;
     if (pki_applet->sign_buffer) {
-        qemu_free(pki_applet->sign_buffer);
+        g_free(pki_applet->sign_buffer);
         pki_applet->sign_buffer = NULL;
     }
     pki_applet->cert_buffer_len = 0;
@@ -166,7 +166,7 @@
         sign_buffer = realloc(pki_applet->sign_buffer,
                       pki_applet->sign_buffer_len+size);
         if (sign_buffer == NULL) {
-            qemu_free(pki_applet->sign_buffer);
+            g_free(pki_applet->sign_buffer);
             pki_applet->sign_buffer = NULL;
             pki_applet->sign_buffer_len = 0;
             *response = vcard_make_response(
@@ -204,7 +204,7 @@
                                 VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
             break;
         }
-        qemu_free(sign_buffer);
+        g_free(sign_buffer);
         pki_applet->sign_buffer = NULL;
         pki_applet->sign_buffer_len = 0;
         return VCARD_DONE;
@@ -271,15 +271,15 @@
     }
     pki_applet_data = &(applet_private->u.pki_data);
     if (pki_applet_data->cert != NULL) {
-        qemu_free(pki_applet_data->cert);
+        g_free(pki_applet_data->cert);
     }
     if (pki_applet_data->sign_buffer != NULL) {
-        qemu_free(pki_applet_data->sign_buffer);
+        g_free(pki_applet_data->sign_buffer);
     }
     if (pki_applet_data->key != NULL) {
         vcard_emul_delete_key(pki_applet_data->key);
     }
-    qemu_free(applet_private);
+    g_free(applet_private);
 }
 
 static VCardAppletPrivate *
@@ -288,7 +288,7 @@
 {
     CACPKIAppletData *pki_applet_data = NULL;
     VCardAppletPrivate *applet_private = NULL;
-    applet_private = (VCardAppletPrivate *)qemu_malloc(sizeof(VCardAppletPrivate));
+    applet_private = (VCardAppletPrivate *)g_malloc(sizeof(VCardAppletPrivate));
 
     pki_applet_data = &(applet_private->u.pki_data);
     pki_applet_data->cert_buffer = NULL;
@@ -296,7 +296,7 @@
     pki_applet_data->sign_buffer = NULL;
     pki_applet_data->sign_buffer_len = 0;
     pki_applet_data->key = NULL;
-    pki_applet_data->cert = (unsigned char *)qemu_malloc(cert_len+1);
+    pki_applet_data->cert = (unsigned char *)g_malloc(cert_len+1);
     /*
      * if we want to support compression, then we simply change the 0 to a 1
      * and compress the cert data with libz
diff --git a/libcacard/card_7816.c b/libcacard/card_7816.c
index eeea849..9fd59d4 100644
--- a/libcacard/card_7816.c
+++ b/libcacard/card_7816.c
@@ -51,8 +51,8 @@
 {
     VCardResponse *new_response;
 
-    new_response = (VCardResponse *)qemu_malloc(sizeof(VCardResponse));
-    new_response->b_data = qemu_malloc(len + 2);
+    new_response = (VCardResponse *)g_malloc(sizeof(VCardResponse));
+    new_response->b_data = g_malloc(len + 2);
     memcpy(new_response->b_data, buf, len);
     new_response->b_total_len = len+2;
     new_response->b_len = len;
@@ -132,7 +132,7 @@
 {
     VCardResponse *new_response;
 
-    new_response = (VCardResponse *)qemu_malloc(sizeof(VCardResponse));
+    new_response = (VCardResponse *)g_malloc(sizeof(VCardResponse));
     new_response->b_data = &new_response->b_sw1;
     new_response->b_len = 0;
     new_response->b_total_len = 2;
@@ -149,7 +149,7 @@
 {
     VCardResponse *new_response;
 
-    new_response = (VCardResponse *)qemu_malloc(sizeof(VCardResponse));
+    new_response = (VCardResponse *)g_malloc(sizeof(VCardResponse));
     new_response->b_data = &new_response->b_sw1;
     new_response->b_len = 0;
     new_response->b_total_len = 2;
@@ -173,19 +173,19 @@
     case VCARD_MALLOC:
         /* everything was malloc'ed */
         if (response->b_data) {
-            qemu_free(response->b_data);
+            g_free(response->b_data);
         }
-        qemu_free(response);
+        g_free(response);
         break;
     case VCARD_MALLOC_DATA:
         /* only the data buffer was malloc'ed */
         if (response->b_data) {
-            qemu_free(response->b_data);
+            g_free(response->b_data);
         }
         break;
     case VCARD_MALLOC_STRUCT:
         /* only the structure was malloc'ed */
-        qemu_free(response);
+        g_free(response);
         break;
     case VCARD_STATIC:
         break;
@@ -336,18 +336,18 @@
         return NULL;
     }
 
-    new_apdu = (VCardAPDU *)qemu_malloc(sizeof(VCardAPDU));
-    new_apdu->a_data = qemu_malloc(len);
+    new_apdu = (VCardAPDU *)g_malloc(sizeof(VCardAPDU));
+    new_apdu->a_data = g_malloc(len);
     memcpy(new_apdu->a_data, raw_apdu, len);
     new_apdu->a_len = len;
     *status = vcard_apdu_set_class(new_apdu);
     if (*status != VCARD7816_STATUS_SUCCESS) {
-        qemu_free(new_apdu);
+        g_free(new_apdu);
         return NULL;
     }
     *status = vcard_apdu_set_length(new_apdu);
     if (*status != VCARD7816_STATUS_SUCCESS) {
-        qemu_free(new_apdu);
+        g_free(new_apdu);
         new_apdu = NULL;
     }
     return new_apdu;
@@ -360,9 +360,9 @@
         return;
     }
     if (apdu->a_data) {
-        qemu_free(apdu->a_data);
+        g_free(apdu->a_data);
     }
-    qemu_free(apdu);
+    g_free(apdu);
 }
 
 
diff --git a/libcacard/event.c b/libcacard/event.c
index bb2f921..6192376 100644
--- a/libcacard/event.c
+++ b/libcacard/event.c
@@ -17,7 +17,7 @@
 {
     VEvent *new_vevent;
 
-    new_vevent = (VEvent *)qemu_malloc(sizeof(VEvent));
+    new_vevent = (VEvent *)g_malloc(sizeof(VEvent));
     new_vevent->next = NULL;
     new_vevent->type = type;
     new_vevent->reader = vreader_reference(reader);
@@ -34,7 +34,7 @@
     }
     vreader_free(vevent->reader);
     vcard_free(vevent->card);
-    qemu_free(vevent);
+    g_free(vevent);
 }
 
 /*
diff --git a/libcacard/vcard.c b/libcacard/vcard.c
index 29b4cce..b02556e 100644
--- a/libcacard/vcard.c
+++ b/libcacard/vcard.c
@@ -37,8 +37,8 @@
 {
     VCardBufferResponse *new_buffer;
 
-    new_buffer = (VCardBufferResponse *)qemu_malloc(sizeof(VCardBufferResponse));
-    new_buffer->buffer = (unsigned char *)qemu_malloc(size);
+    new_buffer = (VCardBufferResponse *)g_malloc(sizeof(VCardBufferResponse));
+    new_buffer->buffer = (unsigned char *)g_malloc(size);
     memcpy(new_buffer->buffer, buffer, size);
     new_buffer->buffer_len = size;
     new_buffer->current = new_buffer->buffer;
@@ -53,9 +53,9 @@
         return;
     }
     if (buffer_response->buffer) {
-        qemu_free(buffer_response->buffer);
+        g_free(buffer_response->buffer);
     }
-    qemu_free(buffer_response);
+    g_free(buffer_response);
 }
 
 
@@ -102,14 +102,14 @@
 {
     VCardApplet *applet;
 
-    applet = (VCardApplet *)qemu_malloc(sizeof(VCardApplet));
+    applet = (VCardApplet *)g_malloc(sizeof(VCardApplet));
     applet->next = NULL;
     applet->applet_private = NULL;
     applet->applet_private_free = NULL;
     applet->process_apdu = applet_process_function;
     applet->reset_applet = applet_reset_function;
 
-    applet->aid = qemu_malloc(aid_len);
+    applet->aid = g_malloc(aid_len);
     memcpy(applet->aid, aid, aid_len);
     applet->aid_len = aid_len;
     return applet;
@@ -127,10 +127,10 @@
         applet->applet_private = NULL;
     }
     if (applet->aid) {
-        qemu_free(applet->aid);
+        g_free(applet->aid);
         applet->aid = NULL;
     }
-    qemu_free(applet);
+    g_free(applet);
 }
 
 /* accessor */
@@ -151,7 +151,7 @@
     VCard *new_card;
     int i;
 
-    new_card = (VCard *)qemu_malloc(sizeof(VCard));
+    new_card = (VCard *)g_malloc(sizeof(VCard));
     new_card->applet_list = NULL;
     for (i = 0; i < MAX_CHANNEL; i++) {
         new_card->current_applet[i] = NULL;
@@ -199,7 +199,7 @@
         vcard_delete_applet(current_applet);
     }
     vcard_buffer_response_delete(vcard->vcard_buffer_response);
-    qemu_free(vcard);
+    g_free(vcard);
     return;
 }
 
diff --git a/libcacard/vcard_emul_nss.c b/libcacard/vcard_emul_nss.c
index 84fc490..397485c 100644
--- a/libcacard/vcard_emul_nss.c
+++ b/libcacard/vcard_emul_nss.c
@@ -94,9 +94,9 @@
     *certsp = NULL;
     *cert_lenp = NULL;
     *keysp = NULL;
-    *certsp = (unsigned char **)qemu_malloc(sizeof(unsigned char *)*cert_count);
-    *cert_lenp = (int *)qemu_malloc(sizeof(int)*cert_count);
-    *keysp = (VCardKey **)qemu_malloc(sizeof(VCardKey *)*cert_count);
+    *certsp = (unsigned char **)g_malloc(sizeof(unsigned char *)*cert_count);
+    *cert_lenp = (int *)g_malloc(sizeof(int)*cert_count);
+    *keysp = (VCardKey **)g_malloc(sizeof(VCardKey *)*cert_count);
     return PR_TRUE;
 }
 
@@ -140,7 +140,7 @@
 {
     VCardKey *key;
 
-    key = (VCardKey *)qemu_malloc(sizeof(VCardKey));
+    key = (VCardKey *)g_malloc(sizeof(VCardKey));
     key->slot = PK11_ReferenceSlot(slot);
     key->cert = CERT_DupCertificate(cert);
     /* NOTE: if we aren't logged into the token, this could return NULL */
@@ -244,7 +244,7 @@
     /* be able to handle larger keys if necessariy */
     bp = &buf[0];
     if (sizeof(buf) < signature_len) {
-        bp = qemu_malloc(signature_len);
+        bp = g_malloc(signature_len);
     }
 
     /*
@@ -348,7 +348,7 @@
     key->failedX509 = VCardEmulTrue;
 cleanup:
     if (bp != buf) {
-        qemu_free(bp);
+        g_free(bp);
     }
     return ret;
 }
@@ -382,7 +382,7 @@
       * to handle multiple guests from one process, then we would need to keep
       * a lot of extra state in our card structure
       * */
-    pin_string = qemu_malloc(pin_len+1);
+    pin_string = g_malloc(pin_len+1);
     memcpy(pin_string, pin, pin_len);
     pin_string[pin_len] = 0;
 
@@ -394,7 +394,7 @@
     rv = PK11_Authenticate(slot, PR_FALSE, pin_string);
     memset(pin_string, 0, pin_len);  /* don't let the pin hang around in memory
                                         to be snooped */
-    qemu_free(pin_string);
+    g_free(pin_string);
     if (rv == SECSuccess) {
         return VCARD7816_STATUS_SUCCESS;
     }
@@ -452,7 +452,7 @@
 {
     VReaderEmul *new_reader_emul;
 
-    new_reader_emul = (VReaderEmul *)qemu_malloc(sizeof(VReaderEmul));
+    new_reader_emul = (VReaderEmul *)g_malloc(sizeof(VReaderEmul));
 
     new_reader_emul->slot = PK11_ReferenceSlot(slot);
     new_reader_emul->default_type = type;
@@ -473,9 +473,9 @@
         PK11_FreeSlot(vreader_emul->slot);
     }
     if (vreader_emul->type_params) {
-        qemu_free(vreader_emul->type_params);
+        g_free(vreader_emul->type_params);
     }
-    qemu_free(vreader_emul);
+    g_free(vreader_emul);
 }
 
 /*
@@ -658,9 +658,9 @@
 
     /* now create the card */
     card = vcard_emul_make_card(vreader, certs, cert_len, keys, cert_count);
-    qemu_free(certs);
-    qemu_free(cert_len);
-    qemu_free(keys);
+    g_free(certs);
+    g_free(cert_len);
+    g_free(keys);
 
     return card;
 }
@@ -947,9 +947,9 @@
             vreader_free(vreader);
             has_readers = PR_TRUE;
         }
-        qemu_free(certs);
-        qemu_free(cert_len);
-        qemu_free(keys);
+        g_free(certs);
+        g_free(cert_len);
+        g_free(keys);
     }
 
     /* if we aren't suppose to use hw, skip looking up hardware tokens */
@@ -1173,18 +1173,18 @@
             }
             opts->vreader = vreaderOpt;
             vreaderOpt = &vreaderOpt[opts->vreader_count];
-            vreaderOpt->name = qemu_strndup(name, name_length);
-            vreaderOpt->vname = qemu_strndup(vname, vname_length);
+            vreaderOpt->name = g_strndup(name, name_length);
+            vreaderOpt->vname = g_strndup(vname, vname_length);
             vreaderOpt->card_type = type;
             vreaderOpt->type_params =
-                qemu_strndup(type_params, type_params_length);
+                g_strndup(type_params, type_params_length);
             count = count_tokens(args, ',', ')') + 1;
             vreaderOpt->cert_count = count;
-            vreaderOpt->cert_name = (char **)qemu_malloc(count*sizeof(char *));
+            vreaderOpt->cert_name = (char **)g_malloc(count*sizeof(char *));
             for (i = 0; i < count; i++) {
                 const char *cert = args;
                 args = strpbrk(args, ",)");
-                vreaderOpt->cert_name[i] = qemu_strndup(cert, args - cert);
+                vreaderOpt->cert_name[i] = g_strndup(cert, args - cert);
                 args = strip(args+1);
             }
             if (*args == ')') {
@@ -1211,7 +1211,7 @@
             args = strip(args+10);
             params = args;
             args = find_blank(args);
-            opts->hw_type_params = qemu_strndup(params, args-params);
+            opts->hw_type_params = g_strndup(params, args-params);
         /* db="/data/base/path" */
         } else if (strncmp(args, "db=", 3) == 0) {
             const char *db;
@@ -1222,7 +1222,7 @@
             args++;
             db = args;
             args = strpbrk(args, "\"\n");
-            opts->nss_db = qemu_strndup(db, args-db);
+            opts->nss_db = g_strndup(db, args-db);
             if (*args != 0) {
                 args++;
             }
diff --git a/libcacard/vreader.c b/libcacard/vreader.c
index 4a0125b..ec126df 100644
--- a/libcacard/vreader.c
+++ b/libcacard/vreader.c
@@ -46,7 +46,7 @@
 {
     VReader *reader;
 
-    reader = (VReader *)qemu_malloc(sizeof(VReader));
+    reader = (VReader *)g_malloc(sizeof(VReader));
     qemu_mutex_init(&reader->lock);
     reader->reference_count = 1;
     reader->name = name ? strdup(name) : NULL;
@@ -87,12 +87,12 @@
         vcard_free(reader->card);
     }
     if (reader->name) {
-        qemu_free(reader->name);
+        g_free(reader->name);
     }
     if (reader->reader_private_free) {
         reader->reader_private_free(reader->reader_private);
     }
-    qemu_free(reader);
+    g_free(reader);
     return;
 }
 
@@ -237,7 +237,7 @@
     VReaderListEntry *new_reader_list_entry;
 
     new_reader_list_entry = (VReaderListEntry *)
-                               qemu_malloc(sizeof(VReaderListEntry));
+                               g_malloc(sizeof(VReaderListEntry));
     new_reader_list_entry->next = NULL;
     new_reader_list_entry->prev = NULL;
     new_reader_list_entry->reader = vreader_reference(reader);
@@ -251,7 +251,7 @@
         return;
     }
     vreader_free(entry->reader);
-    qemu_free(entry);
+    g_free(entry);
 }
 
 
@@ -260,7 +260,7 @@
 {
     VReaderList *new_reader_list;
 
-    new_reader_list = (VReaderList *)qemu_malloc(sizeof(VReaderList));
+    new_reader_list = (VReaderList *)g_malloc(sizeof(VReaderList));
     new_reader_list->head = NULL;
     new_reader_list->tail = NULL;
     return new_reader_list;
@@ -278,7 +278,7 @@
     }
     list->head = NULL;
     list->tail = NULL;
-    qemu_free(list);
+    g_free(list);
 }
 
 
diff --git a/libcacard/vscclient.c b/libcacard/vscclient.c
index ce33f5a..a7b3834 100644
--- a/libcacard/vscclient.c
+++ b/libcacard/vscclient.c
@@ -488,7 +488,7 @@
         for (i = 0; i < cert_count; i++) {
             len += strlen(cert_names[i])+1; /* 1 == comma */
         }
-        new_args = qemu_malloc(len);
+        new_args = g_malloc(len);
         strcpy(new_args, emul_args);
         strcat(new_args, SOFT_STRING);
         for (i = 0; i < cert_count; i++) {
diff --git a/linux-aio.c b/linux-aio.c
index dc3faf2..5fd3932 100644
--- a/linux-aio.c
+++ b/linux-aio.c
@@ -204,7 +204,7 @@
 {
     struct qemu_laio_state *s;
 
-    s = qemu_mallocz(sizeof(*s));
+    s = g_malloc0(sizeof(*s));
     s->efd = eventfd(0, 0);
     if (s->efd == -1)
         goto out_free_state;
@@ -221,6 +221,6 @@
 out_close_efd:
     close(s->efd);
 out_free_state:
-    qemu_free(s);
+    g_free(s);
     return NULL;
 }
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 443d246..04e8e6e 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -1473,7 +1473,7 @@
 #ifdef CONFIG_USE_FDPIC
     {
         struct elf32_fdpic_loadseg *loadsegs = info->loadsegs =
-            qemu_malloc(sizeof(*loadsegs) * info->nsegs);
+            g_malloc(sizeof(*loadsegs) * info->nsegs);
 
         for (i = 0; i < ehdr->e_phnum; ++i) {
             switch (phdr[i].p_type) {
@@ -2063,7 +2063,7 @@
 {
     struct mm_struct *mm;
 
-    if ((mm = qemu_malloc(sizeof (*mm))) == NULL)
+    if ((mm = g_malloc(sizeof (*mm))) == NULL)
         return (NULL);
 
     mm->mm_count = 0;
@@ -2078,9 +2078,9 @@
 
     while ((vma = vma_first(mm)) != NULL) {
         QTAILQ_REMOVE(&mm->mm_mmap, vma, vma_link);
-        qemu_free(vma);
+        g_free(vma);
     }
-    qemu_free(mm);
+    g_free(mm);
 }
 
 static int vma_add_mapping(struct mm_struct *mm, abi_ulong start,
@@ -2088,7 +2088,7 @@
 {
     struct vm_area_struct *vma;
 
-    if ((vma = qemu_mallocz(sizeof (*vma))) == NULL)
+    if ((vma = g_malloc0(sizeof (*vma))) == NULL)
         return (-1);
 
     vma->vma_start = start;
@@ -2412,7 +2412,7 @@
     TaskState *ts = (TaskState *)env->opaque;
     struct elf_thread_status *ets;
 
-    ets = qemu_mallocz(sizeof (*ets));
+    ets = g_malloc0(sizeof (*ets));
     ets->num_notes = 1; /* only prstatus is dumped */
     fill_prstatus(&ets->prstatus, ts, 0);
     elf_core_copy_regs(&ets->prstatus.pr_reg, env);
@@ -2436,13 +2436,13 @@
 
     QTAILQ_INIT(&info->thread_list);
 
-    info->notes = qemu_mallocz(NUMNOTES * sizeof (struct memelfnote));
+    info->notes = g_malloc0(NUMNOTES * sizeof (struct memelfnote));
     if (info->notes == NULL)
         return (-ENOMEM);
-    info->prstatus = qemu_mallocz(sizeof (*info->prstatus));
+    info->prstatus = g_malloc0(sizeof (*info->prstatus));
     if (info->prstatus == NULL)
         return (-ENOMEM);
-    info->psinfo = qemu_mallocz(sizeof (*info->psinfo));
+    info->psinfo = g_malloc0(sizeof (*info->psinfo));
     if (info->prstatus == NULL)
         return (-ENOMEM);
 
@@ -2483,12 +2483,12 @@
     while (!QTAILQ_EMPTY(&info->thread_list)) {
         ets = QTAILQ_FIRST(&info->thread_list);
         QTAILQ_REMOVE(&info->thread_list, ets, ets_link);
-        qemu_free(ets);
+        g_free(ets);
     }
 
-    qemu_free(info->prstatus);
-    qemu_free(info->psinfo);
-    qemu_free(info->notes);
+    g_free(info->prstatus);
+    g_free(info->psinfo);
+    g_free(info->notes);
 }
 
 static int write_note_info(struct elf_note_info *info, int fd)
diff --git a/linux-user/main.c b/linux-user/main.c
index 8e15474..95e3fe6 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -3216,7 +3216,7 @@
     }
     target_argv[target_argc] = NULL;
 
-    ts = qemu_mallocz (sizeof(TaskState));
+    ts = g_malloc0 (sizeof(TaskState));
     init_task_state(ts);
     /* build Task State */
     ts->info = info;
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 73f9baa..6bdf4e6 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -3991,7 +3991,7 @@
         new_thread_info info;
         pthread_attr_t attr;
 #endif
-        ts = qemu_mallocz(sizeof(TaskState));
+        ts = g_malloc0(sizeof(TaskState));
         init_task_state(ts);
         /* we create a new CPU instance. */
         new_env = cpu_copy(env);
@@ -4057,7 +4057,7 @@
         if (flags & CLONE_NPTL_FLAGS2)
             return -EINVAL;
         /* This is probably going to die very quickly, but do it anyway.  */
-        new_stack = qemu_mallocz (NEW_STACK_SIZE);
+        new_stack = g_malloc0 (NEW_STACK_SIZE);
 #ifdef __ia64__
         ret = __clone2(clone_func, new_stack, NEW_STACK_SIZE, flags, new_env);
 #else
@@ -4651,8 +4651,8 @@
                         NULL, NULL, 0);
           }
           thread_env = NULL;
-          qemu_free(cpu_env);
-          qemu_free(ts);
+          g_free(cpu_env);
+          g_free(ts);
           pthread_exit(NULL);
       }
 #endif
diff --git a/memory.c b/memory.c
index beff98c..24439f3 100644
--- a/memory.c
+++ b/memory.c
@@ -183,7 +183,7 @@
 {
     if (view->nr == view->nr_allocated) {
         view->nr_allocated = MAX(2 * view->nr, 10);
-        view->ranges = qemu_realloc(view->ranges,
+        view->ranges = g_realloc(view->ranges,
                                     view->nr_allocated * sizeof(*view->ranges));
     }
     memmove(view->ranges + pos + 1, view->ranges + pos,
@@ -194,7 +194,7 @@
 
 static void flatview_destroy(FlatView *view)
 {
-    qemu_free(view->ranges);
+    g_free(view->ranges);
 }
 
 static bool can_merge(FlatRange *r1, FlatRange *r2)
@@ -553,7 +553,7 @@
                                   fr->addr.start - fr->offset_in_region);
             if (addrrange_intersects(fr->addr, tmp)) {
                 ++ioeventfd_nb;
-                ioeventfds = qemu_realloc(ioeventfds,
+                ioeventfds = g_realloc(ioeventfds,
                                           ioeventfd_nb * sizeof(*ioeventfds));
                 ioeventfds[ioeventfd_nb-1] = fr->mr->ioeventfds[i];
                 ioeventfds[ioeventfd_nb-1].addr = tmp;
@@ -564,7 +564,7 @@
     address_space_add_del_ioeventfds(as, ioeventfds, ioeventfd_nb,
                                      as->ioeventfds, as->ioeventfd_nb);
 
-    qemu_free(as->ioeventfds);
+    g_free(as->ioeventfds);
     as->ioeventfds = ioeventfds;
     as->ioeventfd_nb = ioeventfd_nb;
 }
@@ -713,7 +713,7 @@
     QTAILQ_INIT(&mr->subregions);
     memset(&mr->subregions_link, 0, sizeof mr->subregions_link);
     QTAILQ_INIT(&mr->coalesced);
-    mr->name = qemu_strdup(name);
+    mr->name = g_strdup(name);
     mr->dirty_log_mask = 0;
     mr->ioeventfd_nb = 0;
     mr->ioeventfds = NULL;
@@ -949,8 +949,8 @@
     assert(QTAILQ_EMPTY(&mr->subregions));
     mr->destructor(mr);
     memory_region_clear_coalescing(mr);
-    qemu_free((char *)mr->name);
-    qemu_free(mr->ioeventfds);
+    g_free((char *)mr->name);
+    g_free(mr->ioeventfds);
 }
 
 uint64_t memory_region_size(MemoryRegion *mr)
@@ -1061,7 +1061,7 @@
                                   target_phys_addr_t offset,
                                   uint64_t size)
 {
-    CoalescedMemoryRange *cmr = qemu_malloc(sizeof(*cmr));
+    CoalescedMemoryRange *cmr = g_malloc(sizeof(*cmr));
 
     cmr->addr = addrrange_make(offset, size);
     QTAILQ_INSERT_TAIL(&mr->coalesced, cmr, link);
@@ -1075,7 +1075,7 @@
     while (!QTAILQ_EMPTY(&mr->coalesced)) {
         cmr = QTAILQ_FIRST(&mr->coalesced);
         QTAILQ_REMOVE(&mr->coalesced, cmr, link);
-        qemu_free(cmr);
+        g_free(cmr);
     }
     memory_region_update_coalesced_range(mr);
 }
@@ -1102,7 +1102,7 @@
         }
     }
     ++mr->ioeventfd_nb;
-    mr->ioeventfds = qemu_realloc(mr->ioeventfds,
+    mr->ioeventfds = g_realloc(mr->ioeventfds,
                                   sizeof(*mr->ioeventfds) * mr->ioeventfd_nb);
     memmove(&mr->ioeventfds[i+1], &mr->ioeventfds[i],
             sizeof(*mr->ioeventfds) * (mr->ioeventfd_nb-1 - i));
@@ -1135,7 +1135,7 @@
     memmove(&mr->ioeventfds[i], &mr->ioeventfds[i+1],
             sizeof(*mr->ioeventfds) * (mr->ioeventfd_nb - (i+1)));
     --mr->ioeventfd_nb;
-    mr->ioeventfds = qemu_realloc(mr->ioeventfds,
+    mr->ioeventfds = g_realloc(mr->ioeventfds,
                                   sizeof(*mr->ioeventfds)*mr->ioeventfd_nb + 1);
     memory_region_update_topology();
 }
diff --git a/migration-exec.c b/migration-exec.c
index 4b7aad8..2cfb6f2 100644
--- a/migration-exec.c
+++ b/migration-exec.c
@@ -71,7 +71,7 @@
     FdMigrationState *s;
     FILE *f;
 
-    s = qemu_mallocz(sizeof(*s));
+    s = g_malloc0(sizeof(*s));
 
     f = popen(command, "w");
     if (f == NULL) {
@@ -113,7 +113,7 @@
 err_after_open:
     pclose(f);
 err_after_alloc:
-    qemu_free(s);
+    g_free(s);
     return NULL;
 }
 
diff --git a/migration-fd.c b/migration-fd.c
index 66d51c1..aee690a 100644
--- a/migration-fd.c
+++ b/migration-fd.c
@@ -59,7 +59,7 @@
 {
     FdMigrationState *s;
 
-    s = qemu_mallocz(sizeof(*s));
+    s = g_malloc0(sizeof(*s));
 
     s->fd = monitor_get_fd(mon, fdname);
     if (s->fd == -1) {
@@ -96,7 +96,7 @@
 err_after_open:
     close(s->fd);
 err_after_alloc:
-    qemu_free(s);
+    g_free(s);
     return NULL;
 }
 
diff --git a/migration-tcp.c b/migration-tcp.c
index d3d80c9..c431e03 100644
--- a/migration-tcp.c
+++ b/migration-tcp.c
@@ -89,7 +89,7 @@
     if (parse_host_port(&addr, host_port) < 0)
         return NULL;
 
-    s = qemu_mallocz(sizeof(*s));
+    s = g_malloc0(sizeof(*s));
 
     s->get_error = socket_errno;
     s->write = socket_write;
@@ -106,7 +106,7 @@
     s->bandwidth_limit = bandwidth_limit;
     s->fd = qemu_socket(PF_INET, SOCK_STREAM, 0);
     if (s->fd == -1) {
-        qemu_free(s);
+        g_free(s);
         return NULL;
     }
 
diff --git a/migration-unix.c b/migration-unix.c
index c8625c7..6dc985d 100644
--- a/migration-unix.c
+++ b/migration-unix.c
@@ -88,7 +88,7 @@
     addr.sun_family = AF_UNIX;
     snprintf(addr.sun_path, sizeof(addr.sun_path), "%s", path);
 
-    s = qemu_mallocz(sizeof(*s));
+    s = g_malloc0(sizeof(*s));
 
     s->get_error = unix_errno;
     s->write = unix_write;
@@ -138,7 +138,7 @@
     close(s->fd);
 
 err_after_alloc:
-    qemu_free(s);
+    g_free(s);
     return NULL;
 }
 
diff --git a/migration.c b/migration.c
index 756fa62..f5959b4 100644
--- a/migration.c
+++ b/migration.c
@@ -428,7 +428,7 @@
         notifier_list_notify(&migration_state_notifiers, NULL);
         migrate_fd_cleanup(s);
     }
-    qemu_free(s);
+    g_free(s);
 }
 
 void migrate_fd_wait_for_unfreeze(void *opaque)
diff --git a/module.c b/module.c
index e77d569..91f0e61 100644
--- a/module.c
+++ b/module.c
@@ -59,7 +59,7 @@
     ModuleEntry *e;
     ModuleTypeList *l;
 
-    e = qemu_mallocz(sizeof(*e));
+    e = g_malloc0(sizeof(*e));
     e->init = fn;
 
     l = find_type(type);
diff --git a/monitor.c b/monitor.c
index 1b8ba2c..68553f1 100644
--- a/monitor.c
+++ b/monitor.c
@@ -636,7 +636,7 @@
         data->user_print(data->mon, ret_data);
     }
     monitor_resume(data->mon);
-    qemu_free(data);
+    g_free(data);
 }
 
 static void qmp_monitor_complete(void *opaque, QObject *ret_data)
@@ -660,7 +660,7 @@
 {
     int ret;
 
-    MonitorCompletionData *cb_data = qemu_malloc(sizeof(*cb_data));
+    MonitorCompletionData *cb_data = g_malloc(sizeof(*cb_data));
     cb_data->mon = mon;
     cb_data->user_print = cmd->user_print;
     monitor_suspend(mon);
@@ -668,7 +668,7 @@
                                   user_monitor_complete, cb_data);
     if (ret < 0) {
         monitor_resume(mon);
-        qemu_free(cb_data);
+        g_free(cb_data);
     }
 }
 
@@ -676,14 +676,14 @@
 {
     int ret;
 
-    MonitorCompletionData *cb_data = qemu_malloc(sizeof(*cb_data));
+    MonitorCompletionData *cb_data = g_malloc(sizeof(*cb_data));
     cb_data->mon = mon;
     cb_data->user_print = cmd->user_print;
     monitor_suspend(mon);
     ret = cmd->mhandler.info_async(mon, user_monitor_complete, cb_data);
     if (ret < 0) {
         monitor_resume(mon);
-        qemu_free(cb_data);
+        g_free(cb_data);
     }
 }
 
@@ -2545,7 +2545,7 @@
         if (i == n) {
             s->ops.destroy (s->opaque);
             QLIST_REMOVE (s, entries);
-            qemu_free (s);
+            g_free (s);
             return;
         }
     }
@@ -2562,7 +2562,7 @@
     int nchannels = qdict_get_try_int(qdict, "nchannels", -1);
     CaptureState *s;
 
-    s = qemu_mallocz (sizeof (*s));
+    s = g_malloc0 (sizeof (*s));
 
     freq = has_freq ? freq : 44100;
     bits = has_bits ? bits : 16;
@@ -2570,7 +2570,7 @@
 
     if (wav_start_capture (s, path, freq, bits, nchannels)) {
         monitor_printf(mon, "Failed to add wave capture\n");
-        qemu_free (s);
+        g_free (s);
         return;
     }
     QLIST_INSERT_HEAD (&capture_head, s, entries);
@@ -2780,8 +2780,8 @@
         return 0;
     }
 
-    monfd = qemu_mallocz(sizeof(mon_fd_t));
-    monfd->name = qemu_strdup(fdname);
+    monfd = g_malloc0(sizeof(mon_fd_t));
+    monfd->name = g_strdup(fdname);
     monfd->fd = fd;
 
     QLIST_INSERT_HEAD(&mon->fds, monfd, next);
@@ -2800,8 +2800,8 @@
 
         QLIST_REMOVE(monfd, next);
         close(monfd->fd);
-        qemu_free(monfd->name);
-        qemu_free(monfd);
+        g_free(monfd->name);
+        g_free(monfd);
         return 0;
     }
 
@@ -2836,8 +2836,8 @@
 
         /* caller takes ownership of fd */
         QLIST_REMOVE(monfd, next);
-        qemu_free(monfd->name);
-        qemu_free(monfd);
+        g_free(monfd->name);
+        g_free(monfd);
 
         return fd;
     }
@@ -4034,7 +4034,7 @@
     }
     len = p - type;
 
-    str = qemu_malloc(len + 1);
+    str = g_malloc(len + 1);
     memcpy(str, type, len);
     str[len] = '\0';
 
@@ -4417,7 +4417,7 @@
             monitor_printf(mon, "%s: unknown type '%c'\n", cmdname, c);
             goto fail;
         }
-        qemu_free(key);
+        g_free(key);
         key = NULL;
     }
     /* check that all arguments were parsed */
@@ -4432,7 +4432,7 @@
     return cmd;
 
 fail:
-    qemu_free(key);
+    g_free(key);
     return NULL;
 }
 
@@ -4631,7 +4631,7 @@
         if (nb_args >= MAX_ARGS)
             break;
         ret = get_str(buf, sizeof(buf), &p);
-        args[nb_args] = qemu_strdup(buf);
+        args[nb_args] = g_strdup(buf);
         nb_args++;
         if (ret < 0)
             break;
@@ -4668,7 +4668,7 @@
         if (nb_args >= MAX_ARGS) {
             goto cleanup;
         }
-        args[nb_args++] = qemu_strdup("");
+        args[nb_args++] = g_strdup("");
     }
     if (nb_args <= 1) {
         /* command completion */
@@ -4743,7 +4743,7 @@
 
 cleanup:
     for (i = 0; i < nb_args; i++) {
-        qemu_free(args[i]);
+        g_free(args[i]);
     }
 }
 
@@ -5261,7 +5261,7 @@
         is_first_init = 0;
     }
 
-    mon = qemu_mallocz(sizeof(*mon));
+    mon = g_malloc0(sizeof(*mon));
 
     mon->chr = chr;
     mon->flags = flags;
@@ -5271,7 +5271,7 @@
     }
 
     if (monitor_ctrl_mode(mon)) {
-        mon->mc = qemu_mallocz(sizeof(MonitorControl));
+        mon->mc = g_malloc0(sizeof(MonitorControl));
         /* Control mode requires special handlers */
         qemu_chr_add_handlers(chr, monitor_can_read, monitor_control_read,
                               monitor_control_event, mon);
diff --git a/net.c b/net.c
index cb6a2b0..d05930c 100644
--- a/net.c
+++ b/net.c
@@ -170,7 +170,7 @@
 
     snprintf(buf, sizeof(buf), "%s.%d", model, id);
 
-    return qemu_strdup(buf);
+    return g_strdup(buf);
 }
 
 static ssize_t qemu_deliver_packet(VLANClientState *sender,
@@ -194,12 +194,12 @@
 
     assert(info->size >= sizeof(VLANClientState));
 
-    vc = qemu_mallocz(info->size);
+    vc = g_malloc0(info->size);
 
     vc->info = info;
-    vc->model = qemu_strdup(model);
+    vc->model = g_strdup(model);
     if (name) {
-        vc->name = qemu_strdup(name);
+        vc->name = g_strdup(name);
     } else {
         vc->name = assign_name(vc, model);
     }
@@ -268,9 +268,9 @@
             vc->peer->peer = NULL;
         }
     }
-    qemu_free(vc->name);
-    qemu_free(vc->model);
-    qemu_free(vc);
+    g_free(vc->name);
+    g_free(vc->model);
+    g_free(vc);
 }
 
 void qemu_del_vlan_client(VLANClientState *vc)
@@ -640,7 +640,7 @@
         return NULL;
     }
 
-    vlan = qemu_mallocz(sizeof(VLANState));
+    vlan = g_malloc0(sizeof(VLANState));
     vlan->id = id;
     QTAILQ_INIT(&vlan->clients);
 
@@ -710,7 +710,7 @@
     int i;
 
     if (!nd->model)
-        nd->model = qemu_strdup(default_model);
+        nd->model = g_strdup(default_model);
 
     for (i = 0 ; models[i]; i++) {
         if (strcmp(nd->model, models[i]) == 0)
@@ -774,13 +774,13 @@
         nd->vlan = vlan;
     }
     if (name) {
-        nd->name = qemu_strdup(name);
+        nd->name = g_strdup(name);
     }
     if (qemu_opt_get(opts, "model")) {
-        nd->model = qemu_strdup(qemu_opt_get(opts, "model"));
+        nd->model = g_strdup(qemu_opt_get(opts, "model"));
     }
     if (qemu_opt_get(opts, "addr")) {
-        nd->devaddr = qemu_strdup(qemu_opt_get(opts, "addr"));
+        nd->devaddr = g_strdup(qemu_opt_get(opts, "addr"));
     }
 
     if (qemu_opt_get(opts, "macaddr") &&
diff --git a/net/queue.c b/net/queue.c
index 2ea6cd0..1ab5247 100644
--- a/net/queue.c
+++ b/net/queue.c
@@ -63,7 +63,7 @@
 {
     NetQueue *queue;
 
-    queue = qemu_mallocz(sizeof(NetQueue));
+    queue = g_malloc0(sizeof(NetQueue));
 
     queue->deliver = deliver;
     queue->deliver_iov = deliver_iov;
@@ -82,10 +82,10 @@
 
     QTAILQ_FOREACH_SAFE(packet, &queue->packets, entry, next) {
         QTAILQ_REMOVE(&queue->packets, packet, entry);
-        qemu_free(packet);
+        g_free(packet);
     }
 
-    qemu_free(queue);
+    g_free(queue);
 }
 
 static ssize_t qemu_net_queue_append(NetQueue *queue,
@@ -97,7 +97,7 @@
 {
     NetPacket *packet;
 
-    packet = qemu_malloc(sizeof(NetPacket) + size);
+    packet = g_malloc(sizeof(NetPacket) + size);
     packet->sender = sender;
     packet->flags = flags;
     packet->size = size;
@@ -124,7 +124,7 @@
         max_len += iov[i].iov_len;
     }
 
-    packet = qemu_malloc(sizeof(NetPacket) + max_len);
+    packet = g_malloc(sizeof(NetPacket) + max_len);
     packet->sender = sender;
     packet->sent_cb = sent_cb;
     packet->flags = flags;
@@ -227,7 +227,7 @@
     QTAILQ_FOREACH_SAFE(packet, &queue->packets, entry, next) {
         if (packet->sender == from) {
             QTAILQ_REMOVE(&queue->packets, packet, entry);
-            qemu_free(packet);
+            g_free(packet);
         }
     }
 }
@@ -255,6 +255,6 @@
             packet->sent_cb(packet->sender, ret);
         }
 
-        qemu_free(packet);
+        g_free(packet);
     }
 }
diff --git a/net/slirp.c b/net/slirp.c
index 157b80a..ec7433f 100644
--- a/net/slirp.c
+++ b/net/slirp.c
@@ -450,7 +450,7 @@
     struct slirp_config_str *config;
 
     if (QTAILQ_EMPTY(&slirp_stacks)) {
-        config = qemu_malloc(sizeof(*config));
+        config = g_malloc(sizeof(*config));
         pstrcpy(config->str, sizeof(config->str), redir_str);
         config->flags = SLIRP_CFG_HOSTFWD | SLIRP_CFG_LEGACY;
         config->next = slirp_configs;
@@ -614,19 +614,19 @@
         goto fail_syntax;
     }
 
-    fwd = qemu_malloc(sizeof(struct GuestFwd));
+    fwd = g_malloc(sizeof(struct GuestFwd));
     snprintf(buf, sizeof(buf), "guestfwd.tcp.%d", port);
     fwd->hd = qemu_chr_open(buf, p, NULL);
     if (!fwd->hd) {
         error_report("could not open guest forwarding device '%s'", buf);
-        qemu_free(fwd);
+        g_free(fwd);
         return -1;
     }
 
     if (slirp_add_exec(s->slirp, 3, fwd->hd, &server, port) < 0) {
         error_report("conflicting/invalid host:port in guest forwarding "
                      "rule '%s'", config_str);
-        qemu_free(fwd);
+        g_free(fwd);
         return -1;
     }
     fwd->server = server;
@@ -662,7 +662,7 @@
         return 0;
     }
 
-    config = qemu_mallocz(sizeof(*config));
+    config = g_malloc0(sizeof(*config));
 
     pstrcpy(config->str, sizeof(config->str), value);
 
@@ -720,7 +720,7 @@
         const char *ip = qemu_opt_get(opts, "ip");
         int l = strlen(ip) + strlen("/24") + 1;
 
-        vnet = qemu_malloc(l);
+        vnet = g_malloc(l);
 
         /* emulate legacy ip= parameter */
         pstrcpy(vnet, l, ip);
@@ -729,9 +729,9 @@
 
     if (qemu_opt_get(opts, "net")) {
         if (vnet) {
-            qemu_free(vnet);
+            g_free(vnet);
         }
-        vnet = qemu_strdup(qemu_opt_get(opts, "net"));
+        vnet = g_strdup(qemu_opt_get(opts, "net"));
     }
 
     qemu_opt_foreach(opts, net_init_slirp_configs, NULL, 0);
@@ -743,10 +743,10 @@
     while (slirp_configs) {
         config = slirp_configs;
         slirp_configs = config->next;
-        qemu_free(config);
+        g_free(config);
     }
 
-    qemu_free(vnet);
+    g_free(vnet);
 
     return ret;
 }
@@ -764,7 +764,7 @@
     if (QTAILQ_EMPTY(&slirp_stacks)) {
         struct slirp_config_str *config;
 
-        config = qemu_malloc(sizeof(*config));
+        config = g_malloc(sizeof(*config));
         pstrcpy(config->str, sizeof(config->str), optarg);
         config->flags = SLIRP_CFG_LEGACY;
         config->next = slirp_configs;
diff --git a/net/socket.c b/net/socket.c
index 5cd0b9a..e9ef128 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -404,7 +404,7 @@
     if (parse_host_port(&saddr, host_str) < 0)
         return -1;
 
-    s = qemu_mallocz(sizeof(NetSocketListenState));
+    s = g_malloc0(sizeof(NetSocketListenState));
 
     fd = qemu_socket(PF_INET, SOCK_STREAM, 0);
     if (fd < 0) {
@@ -428,8 +428,8 @@
         return -1;
     }
     s->vlan = vlan;
-    s->model = qemu_strdup(model);
-    s->name = name ? qemu_strdup(name) : NULL;
+    s->model = g_strdup(model);
+    s->name = name ? g_strdup(name) : NULL;
     s->fd = fd;
     qemu_set_fd_handler(fd, net_socket_accept, NULL, s);
     return 0;
diff --git a/os-posix.c b/os-posix.c
index 6f8d488..dbf3b24 100644
--- a/os-posix.c
+++ b/os-posix.c
@@ -128,12 +128,12 @@
 
     max_len = strlen(dir) +
         MAX(strlen(SHARE_SUFFIX), strlen(BUILD_SUFFIX)) + 1;
-    res = qemu_mallocz(max_len);
+    res = g_malloc0(max_len);
     snprintf(res, max_len, "%s%s", dir, SHARE_SUFFIX);
     if (access(res, R_OK)) {
         snprintf(res, max_len, "%s%s", dir, BUILD_SUFFIX);
         if (access(res, R_OK)) {
-            qemu_free(res);
+            g_free(res);
             res = NULL;
         }
     }
diff --git a/os-win32.c b/os-win32.c
index b6652af..d3cea42 100644
--- a/os-win32.c
+++ b/os-win32.c
@@ -41,7 +41,7 @@
     int result = 0;
     if (overwrite || !getenv(name)) {
         size_t length = strlen(name) + strlen(value) + 2;
-        char *string = qemu_malloc(length);
+        char *string = g_malloc(length);
         snprintf(string, length, "%s=%s", name, value);
         result = putenv(string);
     }
@@ -62,7 +62,7 @@
 int qemu_add_polling_cb(PollingFunc *func, void *opaque)
 {
     PollingEntry **ppe, *pe;
-    pe = qemu_mallocz(sizeof(PollingEntry));
+    pe = g_malloc0(sizeof(PollingEntry));
     pe->func = func;
     pe->opaque = opaque;
     for(ppe = &first_polling_entry; *ppe != NULL; ppe = &(*ppe)->next);
@@ -77,7 +77,7 @@
         pe = *ppe;
         if (pe->func == func && pe->opaque == opaque) {
             *ppe = pe->next;
-            qemu_free(pe);
+            g_free(pe);
             break;
         }
     }
@@ -218,7 +218,7 @@
         p--;
     *p = 0;
     if (access(buf, R_OK) == 0) {
-        return qemu_strdup(buf);
+        return g_strdup(buf);
     }
     return NULL;
 }
diff --git a/pflib.c b/pflib.c
index 1154d0c..64cb2b3 100644
--- a/pflib.c
+++ b/pflib.c
@@ -145,7 +145,7 @@
 {
     if (conv->conv_cnt < cnt) {
         conv->conv_cnt = cnt;
-        conv->conv_buf = qemu_realloc(conv->conv_buf, sizeof(QemuPixel) * conv->conv_cnt);
+        conv->conv_buf = g_realloc(conv->conv_buf, sizeof(QemuPixel) * conv->conv_cnt);
     }
     conv->conv_from(&conv->src, conv->conv_buf, src, cnt);
     conv->conv_to(&conv->dst, dst, conv->conv_buf, cnt);
@@ -156,7 +156,7 @@
 
 QemuPfConv *qemu_pf_conv_get(PixelFormat *dst, PixelFormat *src)
 {
-    QemuPfConv *conv = qemu_mallocz(sizeof(QemuPfConv));
+    QemuPfConv *conv = g_malloc0(sizeof(QemuPfConv));
 
     conv->src = *src;
     conv->dst = *dst;
@@ -195,7 +195,7 @@
     return conv;
 
 err:
-    qemu_free(conv);
+    g_free(conv);
     return NULL;
 }
 
@@ -207,7 +207,7 @@
 void qemu_pf_conv_put(QemuPfConv *conv)
 {
     if (conv) {
-        qemu_free(conv->conv_buf);
-        qemu_free(conv);
+        g_free(conv->conv_buf);
+        g_free(conv);
     }
 }
diff --git a/posix-aio-compat.c b/posix-aio-compat.c
index 8dc00cb..babb094 100644
--- a/posix-aio-compat.c
+++ b/posix-aio-compat.c
@@ -634,7 +634,7 @@
     if (posix_aio_state)
         return 0;
 
-    s = qemu_malloc(sizeof(PosixAioState));
+    s = g_malloc(sizeof(PosixAioState));
 
     sigfillset(&act.sa_mask);
     act.sa_flags = 0; /* do not restart syscalls to interrupt select() */
diff --git a/qapi/qapi-dealloc-visitor.c b/qapi/qapi-dealloc-visitor.c
index 8cde4dd..f629061 100644
--- a/qapi/qapi-dealloc-visitor.c
+++ b/qapi/qapi-dealloc-visitor.c
@@ -35,7 +35,7 @@
 
 static void qapi_dealloc_push(QapiDeallocVisitor *qov, void *value)
 {
-    StackEntry *e = qemu_mallocz(sizeof(*e));
+    StackEntry *e = g_malloc0(sizeof(*e));
 
     e->value = value;
     QTAILQ_INSERT_HEAD(&qov->stack, e, node);
@@ -47,7 +47,7 @@
     QObject *value;
     QTAILQ_REMOVE(&qov->stack, e, node);
     value = e->value;
-    qemu_free(e);
+    g_free(e);
     return value;
 }
 
@@ -64,7 +64,7 @@
     QapiDeallocVisitor *qov = to_qov(v);
     void **obj = qapi_dealloc_pop(qov);
     if (obj) {
-        qemu_free(*obj);
+        g_free(*obj);
     }
 }
 
@@ -76,7 +76,7 @@
                                            Error **errp)
 {
     GenericList *retval = *list;
-    qemu_free(retval->value);
+    g_free(retval->value);
     *list = retval->next;
     return retval;
 }
@@ -89,7 +89,7 @@
                                   Error **errp)
 {
     if (obj) {
-        qemu_free(*obj);
+        g_free(*obj);
     }
 }
 
@@ -121,14 +121,14 @@
 
 void qapi_dealloc_visitor_cleanup(QapiDeallocVisitor *v)
 {
-    qemu_free(v);
+    g_free(v);
 }
 
 QapiDeallocVisitor *qapi_dealloc_visitor_new(void)
 {
     QapiDeallocVisitor *v;
 
-    v = qemu_mallocz(sizeof(*v));
+    v = g_malloc0(sizeof(*v));
 
     v->visitor.start_struct = qapi_dealloc_start_struct;
     v->visitor.end_struct = qapi_dealloc_end_struct;
diff --git a/qapi/qmp-input-visitor.c b/qapi/qmp-input-visitor.c
index 6a1adc9..fcf8bf9 100644
--- a/qapi/qmp-input-visitor.c
+++ b/qapi/qmp-input-visitor.c
@@ -99,7 +99,7 @@
     }
 
     if (obj) {
-        *obj = qemu_mallocz(size);
+        *obj = g_malloc0(size);
     }
 }
 
@@ -135,11 +135,11 @@
         return NULL;
     }
 
-    entry = qemu_mallocz(sizeof(*entry));
+    entry = g_malloc0(sizeof(*entry));
     if (*list) {
         so->entry = qlist_next(so->entry);
         if (so->entry == NULL) {
-            qemu_free(entry);
+            g_free(entry);
             return NULL;
         }
         (*list)->next = entry;
@@ -199,7 +199,7 @@
         return;
     }
 
-    *obj = qemu_strdup(qstring_get_str(qobject_to_qstring(qobj)));
+    *obj = g_strdup(qstring_get_str(qobject_to_qstring(qobj)));
 }
 
 static void qmp_input_type_number(Visitor *v, double *obj, const char *name,
@@ -272,14 +272,14 @@
 void qmp_input_visitor_cleanup(QmpInputVisitor *v)
 {
     qobject_decref(v->obj);
-    qemu_free(v);
+    g_free(v);
 }
 
 QmpInputVisitor *qmp_input_visitor_new(QObject *obj)
 {
     QmpInputVisitor *v;
 
-    v = qemu_mallocz(sizeof(*v));
+    v = g_malloc0(sizeof(*v));
 
     v->visitor.start_struct = qmp_input_start_struct;
     v->visitor.end_struct = qmp_input_end_struct;
diff --git a/qapi/qmp-output-visitor.c b/qapi/qmp-output-visitor.c
index c398cac..4419a31 100644
--- a/qapi/qmp-output-visitor.c
+++ b/qapi/qmp-output-visitor.c
@@ -42,7 +42,7 @@
 
 static void qmp_output_push_obj(QmpOutputVisitor *qov, QObject *value)
 {
-    QStackEntry *e = qemu_mallocz(sizeof(*e));
+    QStackEntry *e = g_malloc0(sizeof(*e));
 
     e->value = value;
     QTAILQ_INSERT_HEAD(&qov->stack, e, node);
@@ -54,7 +54,7 @@
     QObject *value;
     QTAILQ_REMOVE(&qov->stack, e, node);
     value = e->value;
-    qemu_free(e);
+    g_free(e);
     return value;
 }
 
@@ -210,17 +210,17 @@
         if (e->value) {
             qobject_decref(e->value);
         }
-        qemu_free(e);
+        g_free(e);
     }
 
-    qemu_free(v);
+    g_free(v);
 }
 
 QmpOutputVisitor *qmp_output_visitor_new(void)
 {
     QmpOutputVisitor *v;
 
-    v = qemu_mallocz(sizeof(*v));
+    v = g_malloc0(sizeof(*v));
 
     v->visitor.start_struct = qmp_output_start_struct;
     v->visitor.end_struct = qmp_output_end_struct;
diff --git a/qapi/qmp-registry.c b/qapi/qmp-registry.c
index 3fe8866..5ff99cf 100644
--- a/qapi/qmp-registry.c
+++ b/qapi/qmp-registry.c
@@ -19,7 +19,7 @@
 
 void qmp_register_command(const char *name, QmpCommandFunc *fn)
 {
-    QmpCommand *cmd = qemu_mallocz(sizeof(*cmd));
+    QmpCommand *cmd = g_malloc0(sizeof(*cmd));
 
     cmd->name = name;
     cmd->type = QCT_NORMAL;
diff --git a/qbool.c b/qbool.c
index ad4873f..590cd71 100644
--- a/qbool.c
+++ b/qbool.c
@@ -31,7 +31,7 @@
 {
     QBool *qb;
 
-    qb = qemu_malloc(sizeof(*qb));
+    qb = g_malloc(sizeof(*qb));
     qb->value = value;
     QOBJECT_INIT(qb, &qbool_type);
 
@@ -64,5 +64,5 @@
 static void qbool_destroy_obj(QObject *obj)
 {
     assert(obj != NULL);
-    qemu_free(qobject_to_qbool(obj));
+    g_free(qobject_to_qbool(obj));
 }
diff --git a/qdict.c b/qdict.c
index dee0fb4..4bf308b 100644
--- a/qdict.c
+++ b/qdict.c
@@ -35,7 +35,7 @@
 {
     QDict *qdict;
 
-    qdict = qemu_mallocz(sizeof(*qdict));
+    qdict = g_malloc0(sizeof(*qdict));
     QOBJECT_INIT(qdict, &qdict_type);
 
     return qdict;
@@ -75,8 +75,8 @@
 {
     QDictEntry *entry;
 
-    entry = qemu_mallocz(sizeof(*entry));
-    entry->key = qemu_strdup(key);
+    entry = g_malloc0(sizeof(*entry));
+    entry->key = g_strdup(key);
     entry->value = value;
 
     return entry;
@@ -410,8 +410,8 @@
     assert(e->value != NULL);
 
     qobject_decref(e->value);
-    qemu_free(e->key);
-    qemu_free(e);
+    g_free(e->key);
+    g_free(e);
 }
 
 /**
@@ -452,5 +452,5 @@
         }
     }
 
-    qemu_free(qdict);
+    g_free(qdict);
 }
diff --git a/qemu-char.c b/qemu-char.c
index 8e8cf31..2358117 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -228,7 +228,7 @@
 {
     CharDriverState *chr;
 
-    chr = qemu_mallocz(sizeof(CharDriverState));
+    chr = g_malloc0(sizeof(CharDriverState));
     chr->chr_write = null_chr_write;
 
     *_chr= chr;
@@ -477,8 +477,8 @@
     CharDriverState *chr;
     MuxDriver *d;
 
-    chr = qemu_mallocz(sizeof(CharDriverState));
-    d = qemu_mallocz(sizeof(MuxDriver));
+    chr = g_malloc0(sizeof(CharDriverState));
+    d = g_malloc0(sizeof(MuxDriver));
 
     chr->opaque = d;
     d->drv = drv;
@@ -617,7 +617,7 @@
         }
     }
 
-    qemu_free(s);
+    g_free(s);
     qemu_chr_event(chr, CHR_EVENT_CLOSED);
 }
 
@@ -627,8 +627,8 @@
     CharDriverState *chr;
     FDCharDriver *s;
 
-    chr = qemu_mallocz(sizeof(CharDriverState));
-    s = qemu_mallocz(sizeof(FDCharDriver));
+    chr = g_malloc0(sizeof(CharDriverState));
+    s = g_malloc0(sizeof(FDCharDriver));
     s->fd_in = fd_in;
     s->fd_out = fd_out;
     chr->opaque = s;
@@ -981,7 +981,7 @@
     close(s->fd);
     qemu_del_timer(s->timer);
     qemu_free_timer(s->timer);
-    qemu_free(s);
+    g_free(s);
     qemu_chr_event(chr, CHR_EVENT_CLOSED);
 }
 
@@ -999,8 +999,8 @@
 #define q_ptsname(x) ptsname(x)
 #endif
 
-    chr = qemu_mallocz(sizeof(CharDriverState));
-    s = qemu_mallocz(sizeof(PtyCharDriver));
+    chr = g_malloc0(sizeof(CharDriverState));
+    s = g_malloc0(sizeof(PtyCharDriver));
 
     if (openpty(&s->fd, &slave_fd, pty_name, NULL, NULL) < 0) {
         return -errno;
@@ -1013,7 +1013,7 @@
     close(slave_fd);
 
     len = strlen(q_ptsname(s->fd)) + 5;
-    chr->filename = qemu_malloc(len);
+    chr->filename = g_malloc(len);
     snprintf(chr->filename, len, "pty:%s", q_ptsname(s->fd));
     qemu_opt_set(opts, "path", q_ptsname(s->fd));
     fprintf(stderr, "char device redirected to %s\n", q_ptsname(s->fd));
@@ -1358,7 +1358,7 @@
     pp_hw_mode(drv, IEEE1284_MODE_COMPAT);
     ioctl(fd, PPRELEASE);
     close(fd);
-    qemu_free(drv);
+    g_free(drv);
     qemu_chr_event(chr, CHR_EVENT_CLOSED);
 }
 
@@ -1379,11 +1379,11 @@
         return -errno;
     }
 
-    drv = qemu_mallocz(sizeof(ParallelCharDriver));
+    drv = g_malloc0(sizeof(ParallelCharDriver));
     drv->fd = fd;
     drv->mode = IEEE1284_MODE_COMPAT;
 
-    chr = qemu_mallocz(sizeof(CharDriverState));
+    chr = g_malloc0(sizeof(CharDriverState));
     chr->chr_write = null_chr_write;
     chr->chr_ioctl = pp_ioctl;
     chr->chr_close = pp_close;
@@ -1445,7 +1445,7 @@
         return -errno;
     }
 
-    chr = qemu_mallocz(sizeof(CharDriverState));
+    chr = g_malloc0(sizeof(CharDriverState));
     chr->opaque = (void *)(intptr_t)fd;
     chr->chr_write = null_chr_write;
     chr->chr_ioctl = pp_ioctl;
@@ -1663,8 +1663,8 @@
     CharDriverState *chr;
     WinCharState *s;
 
-    chr = qemu_mallocz(sizeof(CharDriverState));
-    s = qemu_mallocz(sizeof(WinCharState));
+    chr = g_malloc0(sizeof(CharDriverState));
+    s = g_malloc0(sizeof(WinCharState));
     chr->opaque = s;
     chr->chr_write = win_chr_write;
     chr->chr_close = win_chr_close;
@@ -1765,8 +1765,8 @@
     CharDriverState *chr;
     WinCharState *s;
 
-    chr = qemu_mallocz(sizeof(CharDriverState));
-    s = qemu_mallocz(sizeof(WinCharState));
+    chr = g_malloc0(sizeof(CharDriverState));
+    s = g_malloc0(sizeof(WinCharState));
     chr->opaque = s;
     chr->chr_write = win_chr_write;
     chr->chr_close = win_chr_close;
@@ -1787,8 +1787,8 @@
     CharDriverState *chr;
     WinCharState *s;
 
-    chr = qemu_mallocz(sizeof(CharDriverState));
-    s = qemu_mallocz(sizeof(WinCharState));
+    chr = g_malloc0(sizeof(CharDriverState));
+    s = g_malloc0(sizeof(WinCharState));
     s->hcom = fd_out;
     chr->opaque = s;
     chr->chr_write = win_chr_write;
@@ -1890,7 +1890,7 @@
         qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
         closesocket(s->fd);
     }
-    qemu_free(s);
+    g_free(s);
     qemu_chr_event(chr, CHR_EVENT_CLOSED);
 }
 
@@ -1901,8 +1901,8 @@
     int fd = -1;
     int ret;
 
-    chr = qemu_mallocz(sizeof(CharDriverState));
-    s = qemu_mallocz(sizeof(NetCharDriver));
+    chr = g_malloc0(sizeof(CharDriverState));
+    s = g_malloc0(sizeof(NetCharDriver));
 
     fd = inet_dgram_opts(opts);
     if (fd < 0) {
@@ -1923,8 +1923,8 @@
     return 0;
 
 return_err:
-    qemu_free(chr);
-    qemu_free(s);
+    g_free(chr);
+    g_free(s);
     if (fd >= 0) {
         closesocket(fd);
     }
@@ -2215,7 +2215,7 @@
         qemu_set_fd_handler(s->listen_fd, NULL, NULL, NULL);
         closesocket(s->listen_fd);
     }
-    qemu_free(s);
+    g_free(s);
     qemu_chr_event(chr, CHR_EVENT_CLOSED);
 }
 
@@ -2239,8 +2239,8 @@
     if (!is_listen)
         is_waitconnect = 0;
 
-    chr = qemu_mallocz(sizeof(CharDriverState));
-    s = qemu_mallocz(sizeof(TCPCharDriver));
+    chr = g_malloc0(sizeof(CharDriverState));
+    s = g_malloc0(sizeof(TCPCharDriver));
 
     if (is_unix) {
         if (is_listen) {
@@ -2290,7 +2290,7 @@
     }
 
     /* for "info chardev" monitor command */
-    chr->filename = qemu_malloc(256);
+    chr->filename = g_malloc(256);
     if (is_unix) {
         snprintf(chr->filename, 256, "unix:%s%s",
                  qemu_opt_get(opts, "path"),
@@ -2318,8 +2318,8 @@
  fail:
     if (fd >= 0)
         closesocket(fd);
-    qemu_free(s);
-    qemu_free(chr);
+    g_free(s);
+    g_free(chr);
     return ret;
 }
 
@@ -2341,7 +2341,7 @@
         /* grow outbuf */
         d->outbuf_capacity += len;
         d->outbuf_capacity *= 2;
-        d->outbuf = qemu_realloc(d->outbuf, d->outbuf_capacity);
+        d->outbuf = g_realloc(d->outbuf, d->outbuf_capacity);
     }
 
     memcpy(d->outbuf + d->outbuf_size, buf, len);
@@ -2354,10 +2354,10 @@
 {
     MemoryDriver *d;
 
-    d = qemu_malloc(sizeof(*d));
+    d = g_malloc(sizeof(*d));
     d->outbuf_size = 0;
     d->outbuf_capacity = 4096;
-    d->outbuf = qemu_mallocz(d->outbuf_capacity);
+    d->outbuf = g_malloc0(d->outbuf_capacity);
 
     memset(chr, 0, sizeof(*chr));
     chr->opaque = d;
@@ -2375,8 +2375,8 @@
 {
     MemoryDriver *d = chr->opaque;
 
-    qemu_free(d->outbuf);
-    qemu_free(chr->opaque);
+    g_free(d->outbuf);
+    g_free(chr->opaque);
     chr->opaque = NULL;
     chr->chr_write = NULL;
 }
@@ -2583,14 +2583,14 @@
     }
 
     if (!chr->filename)
-        chr->filename = qemu_strdup(qemu_opt_get(opts, "backend"));
+        chr->filename = g_strdup(qemu_opt_get(opts, "backend"));
     chr->init = init;
     QTAILQ_INSERT_TAIL(&chardevs, chr, next);
 
     if (qemu_opt_get_bool(opts, "mux", 0)) {
         CharDriverState *base = chr;
         int len = strlen(qemu_opts_id(opts)) + 6;
-        base->label = qemu_malloc(len);
+        base->label = g_malloc(len);
         snprintf(base->label, len, "%s-base", qemu_opts_id(opts));
         chr = qemu_chr_open_mux(base);
         chr->filename = base->filename;
@@ -2599,7 +2599,7 @@
     } else {
         chr->avail_connections = 1;
     }
-    chr->label = qemu_strdup(qemu_opts_id(opts));
+    chr->label = g_strdup(qemu_opts_id(opts));
     return chr;
 }
 
@@ -2651,9 +2651,9 @@
     QTAILQ_REMOVE(&chardevs, chr, next);
     if (chr->chr_close)
         chr->chr_close(chr);
-    qemu_free(chr->filename);
-    qemu_free(chr->label);
-    qemu_free(chr);
+    g_free(chr->filename);
+    g_free(chr->label);
+    g_free(chr);
 }
 
 static void qemu_chr_qlist_iter(QObject *obj, void *opaque)
diff --git a/qemu-ga.c b/qemu-ga.c
index 869ee37..eb632b7 100644
--- a/qemu-ga.c
+++ b/qemu-ga.c
@@ -610,7 +610,7 @@
         become_daemon(pidfile);
     }
 
-    s = qemu_mallocz(sizeof(GAState));
+    s = g_malloc0(sizeof(GAState));
     s->conn_channel = NULL;
     s->path = path;
     s->method = method;
diff --git a/qemu-img.c b/qemu-img.c
index b205e98..95f3219 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -713,7 +713,7 @@
     qemu_progress_init(progress, 2.0);
     qemu_progress_print(0, 100);
 
-    bs = qemu_mallocz(bs_n * sizeof(BlockDriverState *));
+    bs = g_malloc0(bs_n * sizeof(BlockDriverState *));
 
     total_sectors = 0;
     for (bs_i = 0; bs_i < bs_n; bs_i++) {
@@ -834,7 +834,7 @@
     bs_i = 0;
     bs_offset = 0;
     bdrv_get_geometry(bs[0], &bs_sectors);
-    buf = qemu_malloc(IO_BUF_SIZE);
+    buf = g_malloc(IO_BUF_SIZE);
 
     if (compress) {
         ret = bdrv_get_info(out_bs, &bdi);
@@ -1006,7 +1006,7 @@
     qemu_progress_end();
     free_option_parameters(create_options);
     free_option_parameters(param);
-    qemu_free(buf);
+    g_free(buf);
     if (out_bs) {
         bdrv_delete(out_bs);
     }
@@ -1016,7 +1016,7 @@
                 bdrv_delete(bs[bs_i]);
             }
         }
-        qemu_free(bs);
+        g_free(bs);
     }
     if (ret) {
         return 1;
@@ -1040,7 +1040,7 @@
         sn = &sn_tab[i];
         printf("%s\n", bdrv_snapshot_dump(buf, sizeof(buf), sn));
     }
-    qemu_free(sn_tab);
+    g_free(sn_tab);
 }
 
 static int img_info(int argc, char **argv)
@@ -1373,8 +1373,8 @@
         uint8_t * buf_new;
         float local_progress;
 
-        buf_old = qemu_malloc(IO_BUF_SIZE);
-        buf_new = qemu_malloc(IO_BUF_SIZE);
+        buf_old = g_malloc(IO_BUF_SIZE);
+        buf_new = g_malloc(IO_BUF_SIZE);
 
         bdrv_get_geometry(bs, &num_sectors);
 
@@ -1430,8 +1430,8 @@
             qemu_progress_print(local_progress, 100);
         }
 
-        qemu_free(buf_old);
-        qemu_free(buf_new);
+        g_free(buf_old);
+        g_free(buf_new);
     }
 
     /*
diff --git a/qemu-io.c b/qemu-io.c
index a553d0c..7e40c48 100644
--- a/qemu-io.c
+++ b/qemu-io.c
@@ -950,9 +950,9 @@
         }
     }
 
-    reqs = qemu_malloc(nr_reqs * sizeof(*reqs));
-    buf = qemu_malloc(nr_reqs * sizeof(*buf));
-    qiovs = qemu_malloc(nr_reqs * sizeof(*qiovs));
+    reqs = g_malloc(nr_reqs * sizeof(*reqs));
+    buf = g_malloc(nr_reqs * sizeof(*buf));
+    qiovs = g_malloc(nr_reqs * sizeof(*qiovs));
 
     for (i = 0; i < nr_reqs; i++) {
         int j;
@@ -1017,9 +1017,9 @@
         qemu_io_free(buf[i]);
         qemu_iovec_destroy(&qiovs[i]);
     }
-    qemu_free(buf);
-    qemu_free(reqs);
-    qemu_free(qiovs);
+    g_free(buf);
+    g_free(reqs);
+    g_free(qiovs);
     return 0;
 }
 
diff --git a/qemu-nbd.c b/qemu-nbd.c
index d91c02c..0b25a4d 100644
--- a/qemu-nbd.c
+++ b/qemu-nbd.c
@@ -431,7 +431,7 @@
         /* children */
     }
 
-    sharing_fds = qemu_malloc((shared + 1) * sizeof(int));
+    sharing_fds = g_malloc((shared + 1) * sizeof(int));
 
     if (socket) {
         sharing_fds[0] = unix_socket_incoming(socket);
@@ -491,7 +491,7 @@
 
     close(sharing_fds[0]);
     bdrv_close(bs);
-    qemu_free(sharing_fds);
+    g_free(sharing_fds);
     if (socket)
         unlink(socket);
 
diff --git a/qemu-option.c b/qemu-option.c
index 65db542..105d760 100644
--- a/qemu-option.c
+++ b/qemu-option.c
@@ -277,7 +277,7 @@
 
     case OPT_STRING:
         if (value != NULL) {
-            list->value.s = qemu_strdup(value);
+            list->value.s = g_strdup(value);
         } else {
             fprintf(stderr, "Option '%s' needs a parameter\n", name);
             return -1;
@@ -337,12 +337,12 @@
 
     while (cur && cur->name) {
         if (cur->type == OPT_STRING) {
-            qemu_free(cur->value.s);
+            g_free(cur->value.s);
         }
         cur++;
     }
 
-    qemu_free(list);
+    g_free(list);
 }
 
 /*
@@ -377,7 +377,7 @@
 
     num_options += count_option_parameters(list);
 
-    dest = qemu_realloc(dest, (num_options + 1) * sizeof(QEMUOptionParameter));
+    dest = g_realloc(dest, (num_options + 1) * sizeof(QEMUOptionParameter));
     dest[num_dest_options].name = NULL;
 
     while (list && list->name) {
@@ -594,9 +594,9 @@
 static void qemu_opt_del(QemuOpt *opt)
 {
     QTAILQ_REMOVE(&opt->opts->head, opt, next);
-    qemu_free((/* !const */ char*)opt->name);
-    qemu_free((/* !const */ char*)opt->str);
-    qemu_free(opt);
+    g_free((/* !const */ char*)opt->name);
+    g_free((/* !const */ char*)opt->str);
+    g_free(opt);
 }
 
 int qemu_opt_set(QemuOpts *opts, const char *name, const char *value)
@@ -619,15 +619,15 @@
         }
     }
 
-    opt = qemu_mallocz(sizeof(*opt));
-    opt->name = qemu_strdup(name);
+    opt = g_malloc0(sizeof(*opt));
+    opt->name = g_strdup(name);
     opt->opts = opts;
     QTAILQ_INSERT_TAIL(&opts->head, opt, next);
     if (desc[i].name != NULL) {
         opt->desc = desc+i;
     }
     if (value) {
-        opt->str = qemu_strdup(value);
+        opt->str = g_strdup(value);
     }
     if (qemu_opt_parse(opt) < 0) {
         qemu_opt_del(opt);
@@ -701,9 +701,9 @@
             }
         }
     }
-    opts = qemu_mallocz(sizeof(*opts));
+    opts = g_malloc0(sizeof(*opts));
     if (id) {
-        opts->id = qemu_strdup(id);
+        opts->id = g_strdup(id);
     }
     opts->list = list;
     loc_save(&opts->loc);
@@ -754,8 +754,8 @@
         qemu_opt_del(opt);
     }
     QTAILQ_REMOVE(&opts->list->head, opts, next);
-    qemu_free(opts->id);
-    qemu_free(opts);
+    g_free(opts->id);
+    g_free(opts);
 }
 
 int qemu_opts_print(QemuOpts *opts, void *dummy)
diff --git a/qemu-sockets.c b/qemu-sockets.c
index eda1850..183a9cb 100644
--- a/qemu-sockets.c
+++ b/qemu-sockets.c
@@ -593,10 +593,10 @@
     if (optstr) {
         len = optstr - str;
         if (len) {
-            path = qemu_malloc(len+1);
+            path = g_malloc(len+1);
             snprintf(path, len+1, "%.*s", len, str);
             qemu_opt_set(opts, "path", path);
-            qemu_free(path);
+            g_free(path);
         }
     } else {
         qemu_opt_set(opts, "path", str);
diff --git a/qemu-thread-win32.c b/qemu-thread-win32.c
index 2d2d5ab..a27332e 100644
--- a/qemu-thread-win32.c
+++ b/qemu-thread-win32.c
@@ -249,7 +249,7 @@
 
     struct QemuThreadData *data;
     qemu_thread_init();
-    data = qemu_malloc(sizeof *data);
+    data = g_malloc(sizeof *data);
     data->thread = thread;
     data->start_routine = start_routine;
     data->arg = arg;
diff --git a/qemu-timer.c b/qemu-timer.c
index 30e8f12..19313d3 100644
--- a/qemu-timer.c
+++ b/qemu-timer.c
@@ -327,7 +327,7 @@
         exit(0);
     }
 
-    arg = qemu_strdup(opt);
+    arg = g_strdup(opt);
 
     /* Reorder the array */
     name = strtok(arg, ",");
@@ -356,7 +356,7 @@
         name = strtok(NULL, ",");
     }
 
-    qemu_free(arg);
+    g_free(arg);
 
     if (cur) {
         /* Disable remaining timers */
@@ -380,7 +380,7 @@
 {
     QEMUClock *clock;
 
-    clock = qemu_mallocz(sizeof(QEMUClock));
+    clock = g_malloc0(sizeof(QEMUClock));
     clock->type = type;
     clock->enabled = 1;
     notifier_list_init(&clock->reset_notifiers);
@@ -485,7 +485,7 @@
 {
     QEMUTimer *ts;
 
-    ts = qemu_mallocz(sizeof(QEMUTimer));
+    ts = g_malloc0(sizeof(QEMUTimer));
     ts->clock = clock;
     ts->cb = cb;
     ts->opaque = opaque;
@@ -495,7 +495,7 @@
 
 void qemu_free_timer(QEMUTimer *ts)
 {
-    qemu_free(ts);
+    g_free(ts);
 }
 
 /* stop a timer, but do not dealloc it */
diff --git a/qemu-tool.c b/qemu-tool.c
index 41e5c41..eb89fe0 100644
--- a/qemu-tool.c
+++ b/qemu-tool.c
@@ -76,12 +76,12 @@
 QEMUTimer *qemu_new_timer(QEMUClock *clock, int scale,
                           QEMUTimerCB *cb, void *opaque)
 {
-    return qemu_malloc(1);
+    return g_malloc(1);
 }
 
 void qemu_free_timer(QEMUTimer *ts)
 {
-    qemu_free(ts);
+    g_free(ts);
 }
 
 void qemu_del_timer(QEMUTimer *ts)
diff --git a/qerror.c b/qerror.c
index 69c1bc9..3d64b80 100644
--- a/qerror.c
+++ b/qerror.c
@@ -242,7 +242,7 @@
 {
     QError *qerr;
 
-    qerr = qemu_mallocz(sizeof(*qerr));
+    qerr = g_malloc0(sizeof(*qerr));
     QOBJECT_INIT(qerr, &qerror_type);
 
     return qerr;
@@ -501,5 +501,5 @@
     qerr = qobject_to_qerror(obj);
 
     QDECREF(qerr->error);
-    qemu_free(qerr);
+    g_free(qerr);
 }
diff --git a/qfloat.c b/qfloat.c
index f8c8a2e..98338f3 100644
--- a/qfloat.c
+++ b/qfloat.c
@@ -31,7 +31,7 @@
 {
     QFloat *qf;
 
-    qf = qemu_malloc(sizeof(*qf));
+    qf = g_malloc(sizeof(*qf));
     qf->value = value;
     QOBJECT_INIT(qf, &qfloat_type);
 
@@ -64,5 +64,5 @@
 static void qfloat_destroy_obj(QObject *obj)
 {
     assert(obj != NULL);
-    qemu_free(qobject_to_qfloat(obj));
+    g_free(qobject_to_qfloat(obj));
 }
diff --git a/qga/guest-agent-command-state.c b/qga/guest-agent-command-state.c
index bc6e0bd..969da23 100644
--- a/qga/guest-agent-command-state.c
+++ b/qga/guest-agent-command-state.c
@@ -27,7 +27,7 @@
                           void (*init)(void),
                           void (*cleanup)(void))
 {
-    GACommandGroup *cg = qemu_mallocz(sizeof(GACommandGroup));
+    GACommandGroup *cg = g_malloc0(sizeof(GACommandGroup));
     cg->init = init;
     cg->cleanup = cleanup;
     cs->groups = g_slist_append(cs->groups, cg);
@@ -67,7 +67,7 @@
 
 GACommandState *ga_command_state_new(void)
 {
-    GACommandState *cs = qemu_mallocz(sizeof(GACommandState));
+    GACommandState *cs = g_malloc0(sizeof(GACommandState));
     cs->groups = NULL;
     return cs;
 }
diff --git a/qga/guest-agent-commands.c b/qga/guest-agent-commands.c
index 30c4068..6da9904 100644
--- a/qga/guest-agent-commands.c
+++ b/qga/guest-agent-commands.c
@@ -56,7 +56,7 @@
 
 struct GuestAgentInfo *qmp_guest_info(Error **err)
 {
-    GuestAgentInfo *info = qemu_mallocz(sizeof(GuestAgentInfo));
+    GuestAgentInfo *info = g_malloc0(sizeof(GuestAgentInfo));
 
     info->version = g_strdup(QGA_VERSION);
 
@@ -114,7 +114,7 @@
 {
     GuestFileHandle *gfh;
 
-    gfh = qemu_mallocz(sizeof(GuestFileHandle));
+    gfh = g_malloc0(sizeof(GuestFileHandle));
     gfh->id = fileno(fh);
     gfh->fh = fh;
     QTAILQ_INSERT_TAIL(&guest_file_state.filehandles, gfh, next);
@@ -185,7 +185,7 @@
     }
 
     QTAILQ_REMOVE(&guest_file_state.filehandles, gfh, next);
-    qemu_free(gfh);
+    g_free(gfh);
 }
 
 struct GuestFileRead *qmp_guest_file_read(int64_t handle, bool has_count,
@@ -210,21 +210,21 @@
     }
 
     fh = gfh->fh;
-    buf = qemu_mallocz(count+1);
+    buf = g_malloc0(count+1);
     read_count = fread(buf, 1, count, fh);
     if (ferror(fh)) {
         slog("guest-file-read failed, handle: %ld", handle);
         error_set(err, QERR_QGA_COMMAND_FAILED, "fread() failed");
     } else {
         buf[read_count] = 0;
-        read_data = qemu_mallocz(sizeof(GuestFileRead));
+        read_data = g_malloc0(sizeof(GuestFileRead));
         read_data->count = read_count;
         read_data->eof = feof(fh);
         if (read_count) {
             read_data->buf_b64 = g_base64_encode(buf, read_count);
         }
     }
-    qemu_free(buf);
+    g_free(buf);
     clearerr(fh);
 
     return read_data;
@@ -251,7 +251,7 @@
     if (!has_count) {
         count = buf_len;
     } else if (count < 0 || count > buf_len) {
-        qemu_free(buf);
+        g_free(buf);
         error_set(err, QERR_INVALID_PARAMETER, "count");
         return NULL;
     }
@@ -261,11 +261,11 @@
         slog("guest-file-write failed, handle: %ld", handle);
         error_set(err, QERR_QGA_COMMAND_FAILED, "fwrite() error");
     } else {
-        write_data = qemu_mallocz(sizeof(GuestFileWrite));
+        write_data = g_malloc0(sizeof(GuestFileWrite));
         write_data->count = write_count;
         write_data->eof = feof(fh);
     }
-    qemu_free(buf);
+    g_free(buf);
     clearerr(fh);
 
     return write_data;
@@ -289,7 +289,7 @@
     if (ret == -1) {
         error_set(err, QERR_QGA_COMMAND_FAILED, strerror(errno));
     } else {
-        seek_data = qemu_mallocz(sizeof(GuestFileRead));
+        seek_data = g_malloc0(sizeof(GuestFileRead));
         seek_data->position = ftell(fh);
         seek_data->eof = feof(fh);
     }
@@ -355,9 +355,9 @@
 
     QTAILQ_FOREACH_SAFE(mount, &guest_fsfreeze_state.mount_list, next, temp) {
         QTAILQ_REMOVE(&guest_fsfreeze_state.mount_list, mount, next);
-        qemu_free(mount->dirname);
-        qemu_free(mount->devtype);
-        qemu_free(mount);
+        g_free(mount->dirname);
+        g_free(mount->devtype);
+        g_free(mount);
     }
 
     fp = setmntent(mtab, "r");
@@ -379,9 +379,9 @@
             continue;
         }
 
-        mount = qemu_mallocz(sizeof(GuestFsfreezeMount));
-        mount->dirname = qemu_strdup(ment->mnt_dir);
-        mount->devtype = qemu_strdup(ment->mnt_type);
+        mount = g_malloc0(sizeof(GuestFsfreezeMount));
+        mount->dirname = g_strdup(ment->mnt_dir);
+        mount->devtype = g_strdup(ment->mnt_type);
 
         QTAILQ_INSERT_TAIL(&guest_fsfreeze_state.mount_list, mount, next);
     }
diff --git a/qint.c b/qint.c
index fb3823a..ee51804 100644
--- a/qint.c
+++ b/qint.c
@@ -30,7 +30,7 @@
 {
     QInt *qi;
 
-    qi = qemu_malloc(sizeof(*qi));
+    qi = g_malloc(sizeof(*qi));
     qi->value = value;
     QOBJECT_INIT(qi, &qint_type);
 
@@ -63,5 +63,5 @@
 static void qint_destroy_obj(QObject *obj)
 {
     assert(obj != NULL);
-    qemu_free(qobject_to_qint(obj));
+    g_free(qobject_to_qint(obj));
 }
diff --git a/qlist.c b/qlist.c
index 5730fb8..88498b1 100644
--- a/qlist.c
+++ b/qlist.c
@@ -31,7 +31,7 @@
 {
     QList *qlist;
 
-    qlist = qemu_malloc(sizeof(*qlist));
+    qlist = g_malloc(sizeof(*qlist));
     QTAILQ_INIT(&qlist->head);
     QOBJECT_INIT(qlist, &qlist_type);
 
@@ -64,7 +64,7 @@
 {
     QListEntry *entry;
 
-    entry = qemu_malloc(sizeof(*entry));
+    entry = g_malloc(sizeof(*entry));
     entry->value = value;
 
     QTAILQ_INSERT_TAIL(&qlist->head, entry, next);
@@ -98,7 +98,7 @@
     QTAILQ_REMOVE(&qlist->head, entry, next);
 
     ret = entry->value;
-    qemu_free(entry);
+    g_free(entry);
 
     return ret;
 }
@@ -150,8 +150,8 @@
     QTAILQ_FOREACH_SAFE(entry, &qlist->head, next, next_entry) {
         QTAILQ_REMOVE(&qlist->head, entry, next);
         qobject_decref(entry->value);
-        qemu_free(entry);
+        g_free(entry);
     }
 
-    qemu_free(qlist);
+    g_free(qlist);
 }
diff --git a/qstring.c b/qstring.c
index 4e2ba08..b7e12e4 100644
--- a/qstring.c
+++ b/qstring.c
@@ -40,12 +40,12 @@
 {
     QString *qstring;
 
-    qstring = qemu_malloc(sizeof(*qstring));
+    qstring = g_malloc(sizeof(*qstring));
 
     qstring->length = end - start + 1;
     qstring->capacity = qstring->length;
 
-    qstring->string = qemu_malloc(qstring->capacity + 1);
+    qstring->string = g_malloc(qstring->capacity + 1);
     memcpy(qstring->string, str + start, qstring->length);
     qstring->string[qstring->length] = 0;
 
@@ -70,7 +70,7 @@
         qstring->capacity += len;
         qstring->capacity *= 2; /* use exponential growth */
 
-        qstring->string = qemu_realloc(qstring->string, qstring->capacity + 1);
+        qstring->string = g_realloc(qstring->string, qstring->capacity + 1);
     }
 }
 
@@ -136,6 +136,6 @@
 
     assert(obj != NULL);
     qs = qobject_to_qstring(obj);
-    qemu_free(qs->string);
-    qemu_free(qs);
+    g_free(qs->string);
+    g_free(qs);
 }
diff --git a/readline.c b/readline.c
index 92f9cd1..6a3160a 100644
--- a/readline.c
+++ b/readline.c
@@ -264,7 +264,7 @@
 void readline_add_completion(ReadLineState *rs, const char *str)
 {
     if (rs->nb_completions < READLINE_MAX_COMPLETIONS) {
-        rs->completions[rs->nb_completions++] = qemu_strdup(str);
+        rs->completions[rs->nb_completions++] = g_strdup(str);
     }
 }
 
@@ -281,11 +281,11 @@
 
     rs->nb_completions = 0;
 
-    cmdline = qemu_malloc(rs->cmd_buf_index + 1);
+    cmdline = g_malloc(rs->cmd_buf_index + 1);
     memcpy(cmdline, rs->cmd_buf, rs->cmd_buf_index);
     cmdline[rs->cmd_buf_index] = '\0';
     rs->completion_finder(cmdline);
-    qemu_free(cmdline);
+    g_free(cmdline);
 
     /* no completion found */
     if (rs->nb_completions <= 0)
@@ -466,7 +466,7 @@
 ReadLineState *readline_init(Monitor *mon,
                              ReadLineCompletionFunc *completion_finder)
 {
-    ReadLineState *rs = qemu_mallocz(sizeof(*rs));
+    ReadLineState *rs = g_malloc0(sizeof(*rs));
 
     rs->hist_entry = -1;
     rs->mon = mon;
diff --git a/savevm.c b/savevm.c
index 7801aa7..b06308b 100644
--- a/savevm.c
+++ b/savevm.c
@@ -206,7 +206,7 @@
 static int socket_close(void *opaque)
 {
     QEMUFileSocket *s = opaque;
-    qemu_free(s);
+    g_free(s);
     return 0;
 }
 
@@ -234,7 +234,7 @@
     QEMUFileStdio *s = opaque;
     int ret;
     ret = pclose(s->stdio_file);
-    qemu_free(s);
+    g_free(s);
     return ret;
 }
 
@@ -242,7 +242,7 @@
 {
     QEMUFileStdio *s = opaque;
     fclose(s->stdio_file);
-    qemu_free(s);
+    g_free(s);
     return 0;
 }
 
@@ -255,7 +255,7 @@
         return NULL;
     }
 
-    s = qemu_mallocz(sizeof(QEMUFileStdio));
+    s = g_malloc0(sizeof(QEMUFileStdio));
 
     s->stdio_file = stdio_file;
 
@@ -303,7 +303,7 @@
         return NULL;
     }
 
-    s = qemu_mallocz(sizeof(QEMUFileStdio));
+    s = g_malloc0(sizeof(QEMUFileStdio));
     s->stdio_file = fdopen(fd, mode);
     if (!s->stdio_file)
         goto fail;
@@ -318,13 +318,13 @@
     return s->file;
 
 fail:
-    qemu_free(s);
+    g_free(s);
     return NULL;
 }
 
 QEMUFile *qemu_fopen_socket(int fd)
 {
-    QEMUFileSocket *s = qemu_mallocz(sizeof(QEMUFileSocket));
+    QEMUFileSocket *s = g_malloc0(sizeof(QEMUFileSocket));
 
     s->fd = fd;
     s->file = qemu_fopen_ops(s, NULL, socket_get_buffer, socket_close, 
@@ -358,7 +358,7 @@
         return NULL;
     }
 
-    s = qemu_mallocz(sizeof(QEMUFileStdio));
+    s = g_malloc0(sizeof(QEMUFileStdio));
 
     s->stdio_file = fopen(filename, mode);
     if (!s->stdio_file)
@@ -373,7 +373,7 @@
     }
     return s->file;
 fail:
-    qemu_free(s);
+    g_free(s);
     return NULL;
 }
 
@@ -411,7 +411,7 @@
 {
     QEMUFile *f;
 
-    f = qemu_mallocz(sizeof(QEMUFile));
+    f = g_malloc0(sizeof(QEMUFile));
 
     f->opaque = opaque;
     f->put_buffer = put_buffer;
@@ -477,7 +477,7 @@
     qemu_fflush(f);
     if (f->close)
         ret = f->close(f->opaque);
-    qemu_free(f);
+    g_free(f);
     return ret;
 }
 
@@ -1114,7 +1114,7 @@
 {
     SaveStateEntry *se;
 
-    se = qemu_mallocz(sizeof(SaveStateEntry));
+    se = g_malloc0(sizeof(SaveStateEntry));
     se->version_id = version_id;
     se->section_id = global_section_id++;
     se->set_params = set_params;
@@ -1130,9 +1130,9 @@
         if (id) {
             pstrcpy(se->idstr, sizeof(se->idstr), id);
             pstrcat(se->idstr, sizeof(se->idstr), "/");
-            qemu_free(id);
+            g_free(id);
 
-            se->compat = qemu_mallocz(sizeof(CompatEntry));
+            se->compat = g_malloc0(sizeof(CompatEntry));
             pstrcpy(se->compat->idstr, sizeof(se->compat->idstr), idstr);
             se->compat->instance_id = instance_id == -1 ?
                          calculate_compat_instance_id(idstr) : instance_id;
@@ -1174,7 +1174,7 @@
         if (path) {
             pstrcpy(id, sizeof(id), path);
             pstrcat(id, sizeof(id), "/");
-            qemu_free(path);
+            g_free(path);
         }
     }
     pstrcat(id, sizeof(id), idstr);
@@ -1183,9 +1183,9 @@
         if (strcmp(se->idstr, id) == 0 && se->opaque == opaque) {
             QTAILQ_REMOVE(&savevm_handlers, se, entry);
             if (se->compat) {
-                qemu_free(se->compat);
+                g_free(se->compat);
             }
-            qemu_free(se);
+            g_free(se);
         }
     }
 }
@@ -1203,7 +1203,7 @@
         if (path) {
             pstrcpy(id, sizeof(id), path);
             pstrcat(id, sizeof(id), "/");
-            qemu_free(path);
+            g_free(path);
         }
     }
     pstrcat(id, sizeof(id), idstr);
@@ -1225,7 +1225,7 @@
     /* If this triggers, alias support can be dropped for the vmsd. */
     assert(alias_id == -1 || required_for_version >= vmsd->minimum_version_id);
 
-    se = qemu_mallocz(sizeof(SaveStateEntry));
+    se = g_malloc0(sizeof(SaveStateEntry));
     se->version_id = vmsd->version_id;
     se->section_id = global_section_id++;
     se->save_live_state = NULL;
@@ -1241,9 +1241,9 @@
         if (id) {
             pstrcpy(se->idstr, sizeof(se->idstr), id);
             pstrcat(se->idstr, sizeof(se->idstr), "/");
-            qemu_free(id);
+            g_free(id);
 
-            se->compat = qemu_mallocz(sizeof(CompatEntry));
+            se->compat = g_malloc0(sizeof(CompatEntry));
             pstrcpy(se->compat->idstr, sizeof(se->compat->idstr), vmsd->name);
             se->compat->instance_id = instance_id == -1 ?
                          calculate_compat_instance_id(vmsd->name) : instance_id;
@@ -1279,9 +1279,9 @@
         if (se->vmsd == vmsd && se->opaque == opaque) {
             QTAILQ_REMOVE(&savevm_handlers, se, entry);
             if (se->compat) {
-                qemu_free(se->compat);
+                g_free(se->compat);
             }
-            qemu_free(se);
+            g_free(se);
         }
     }
 }
@@ -1785,7 +1785,7 @@
             }
 
             /* Add entry */
-            le = qemu_mallocz(sizeof(*le));
+            le = g_malloc0(sizeof(*le));
 
             le->se = se;
             le->section_id = section_id;
@@ -1835,7 +1835,7 @@
 out:
     QLIST_FOREACH_SAFE(le, &loadvm_handlers, entry, new_le) {
         QLIST_REMOVE(le, entry);
-        qemu_free(le);
+        g_free(le);
     }
 
     if (qemu_file_has_error(f))
@@ -1862,7 +1862,7 @@
             break;
         }
     }
-    qemu_free(sn_tab);
+    g_free(sn_tab);
     return ret;
 }
 
@@ -2141,7 +2141,7 @@
         return;
     }
 
-    available_snapshots = qemu_mallocz(sizeof(int) * nb_sns);
+    available_snapshots = g_malloc0(sizeof(int) * nb_sns);
     total = 0;
     for (i = 0; i < nb_sns; i++) {
         sn = &sn_tab[i];
@@ -2174,7 +2174,7 @@
         monitor_printf(mon, "There is no suitable snapshot available\n");
     }
 
-    qemu_free(sn_tab);
-    qemu_free(available_snapshots);
+    g_free(sn_tab);
+    g_free(available_snapshots);
 
 }
diff --git a/slirp/misc.c b/slirp/misc.c
index 6002550..6c80e69 100644
--- a/slirp/misc.c
+++ b/slirp/misc.c
@@ -182,7 +182,7 @@
 		   close(s);
 
 		i = 0;
-		bptr = qemu_strdup(ex); /* No need to free() this */
+		bptr = g_strdup(ex); /* No need to free() this */
 		if (do_pty == 1) {
 			/* Setup "slirp.telnetd -x" */
 			argv[i++] = "slirp.telnetd";
diff --git a/slirp/slirp.c b/slirp/slirp.c
index 2c242ef..655b3f4 100644
--- a/slirp/slirp.c
+++ b/slirp/slirp.c
@@ -202,7 +202,7 @@
                   const char *bootfile, struct in_addr vdhcp_start,
                   struct in_addr vnameserver, void *opaque)
 {
-    Slirp *slirp = qemu_mallocz(sizeof(Slirp));
+    Slirp *slirp = g_malloc0(sizeof(Slirp));
 
     slirp_init_once();
 
@@ -222,10 +222,10 @@
                 vhostname);
     }
     if (tftp_path) {
-        slirp->tftp_prefix = qemu_strdup(tftp_path);
+        slirp->tftp_prefix = g_strdup(tftp_path);
     }
     if (bootfile) {
-        slirp->bootp_filename = qemu_strdup(bootfile);
+        slirp->bootp_filename = g_strdup(bootfile);
     }
     slirp->vdhcp_startaddr = vdhcp_start;
     slirp->vnameserver_addr = vnameserver;
@@ -246,9 +246,9 @@
 
     unregister_savevm(NULL, "slirp", slirp);
 
-    qemu_free(slirp->tftp_prefix);
-    qemu_free(slirp->bootp_filename);
-    qemu_free(slirp);
+    g_free(slirp->tftp_prefix);
+    g_free(slirp->bootp_filename);
+    g_free(slirp);
 }
 
 #define CONN_CANFSEND(so) (((so)->so_state & (SS_FCANTSENDMORE|SS_ISFCONNECTED)) == SS_ISFCONNECTED)
diff --git a/slirp/tftp.c b/slirp/tftp.c
index 8055ccc..b78765f 100644
--- a/slirp/tftp.c
+++ b/slirp/tftp.c
@@ -37,7 +37,7 @@
 
 static void tftp_session_terminate(struct tftp_session *spt)
 {
-    qemu_free(spt->filename);
+    g_free(spt->filename);
     spt->slirp = NULL;
 }
 
@@ -54,7 +54,7 @@
 
     /* sessions time out after 5 inactive seconds */
     if ((int)(curtime - spt->timestamp) > 5000) {
-        qemu_free(spt->filename);
+        g_free(spt->filename);
         goto found;
     }
   }
@@ -287,7 +287,7 @@
 
   /* prepend tftp_prefix */
   prefix_len = strlen(slirp->tftp_prefix);
-  spt->filename = qemu_malloc(prefix_len + TFTP_FILENAME_MAX + 2);
+  spt->filename = g_malloc(prefix_len + TFTP_FILENAME_MAX + 2);
   memcpy(spt->filename, slirp->tftp_prefix, prefix_len);
   spt->filename[prefix_len] = '/';
 
diff --git a/spice-qemu-char.c b/spice-qemu-char.c
index 95bf6b6..684024b 100644
--- a/spice-qemu-char.c
+++ b/spice-qemu-char.c
@@ -112,7 +112,7 @@
     assert(s->datalen == 0);
     if (s->bufsize < len) {
         s->bufsize = len;
-        s->buffer = qemu_realloc(s->buffer, s->bufsize);
+        s->buffer = g_realloc(s->buffer, s->bufsize);
     }
     memcpy(s->buffer, buf, len);
     s->datapos = s->buffer;
@@ -127,7 +127,7 @@
 
     printf("%s\n", __func__);
     vmc_unregister_interface(s);
-    qemu_free(s);
+    g_free(s);
 }
 
 static void spice_chr_guest_open(struct CharDriverState *chr)
@@ -185,8 +185,8 @@
         return -EINVAL;
     }
 
-    chr = qemu_mallocz(sizeof(CharDriverState));
-    s = qemu_mallocz(sizeof(SpiceCharDriver));
+    chr = g_malloc0(sizeof(CharDriverState));
+    s = g_malloc0(sizeof(SpiceCharDriver));
     s->chr = chr;
     s->debug = debug;
     s->active = false;
diff --git a/target-alpha/translate.c b/target-alpha/translate.c
index c61906a..1e224a2 100644
--- a/target-alpha/translate.c
+++ b/target-alpha/translate.c
@@ -3449,7 +3449,7 @@
     CPUAlphaState *env;
     int implver, amask, i, max;
 
-    env = qemu_mallocz(sizeof(CPUAlphaState));
+    env = g_malloc0(sizeof(CPUAlphaState));
     cpu_exec_init(env);
     alpha_translate_init();
     tlb_flush(env, 1);
diff --git a/target-arm/helper.c b/target-arm/helper.c
index 8cae972..d3a3ba2 100644
--- a/target-arm/helper.c
+++ b/target-arm/helper.c
@@ -384,7 +384,7 @@
     id = cpu_arm_find_by_name(cpu_model);
     if (id == 0)
         return NULL;
-    env = qemu_mallocz(sizeof(CPUARMState));
+    env = g_malloc0(sizeof(CPUARMState));
     cpu_exec_init(env);
     if (!inited) {
         inited = 1;
diff --git a/target-cris/translate.c b/target-cris/translate.c
index dd85859..70abf8a 100644
--- a/target-cris/translate.c
+++ b/target-cris/translate.c
@@ -3516,7 +3516,7 @@
 	static int tcg_initialized = 0;
 	int i;
 
-	env = qemu_mallocz(sizeof(CPUCRISState));
+	env = g_malloc0(sizeof(CPUCRISState));
 
 	env->pregs[PR_VR] = vr_by_name(cpu_model);
 	cpu_exec_init(env);
diff --git a/target-i386/cpuid.c b/target-i386/cpuid.c
index 89e9623..1e8bcff 100644
--- a/target-i386/cpuid.c
+++ b/target-i386/cpuid.c
@@ -1009,7 +1009,7 @@
  */
 static int cpudef_register(QemuOpts *opts, void *opaque)
 {
-    x86_def_t *def = qemu_mallocz(sizeof (x86_def_t));
+    x86_def_t *def = g_malloc0(sizeof (x86_def_t));
 
     qemu_opt_foreach(opts, cpudef_setfield, def, 1);
     def->next = x86_defs;
diff --git a/target-i386/helper.c b/target-i386/helper.c
index f8c8633..5df40d4 100644
--- a/target-i386/helper.c
+++ b/target-i386/helper.c
@@ -108,7 +108,7 @@
 
 void cpu_x86_close(CPUX86State *env)
 {
-    qemu_free(env);
+    g_free(env);
 }
 
 static void cpu_x86_version(CPUState *env, int *family, int *model)
@@ -1239,7 +1239,7 @@
     CPUX86State *env;
     static int inited;
 
-    env = qemu_mallocz(sizeof(CPUX86State));
+    env = g_malloc0(sizeof(CPUX86State));
     cpu_exec_init(env);
     env->cpu_model_str = cpu_model;
 
diff --git a/target-i386/kvm.c b/target-i386/kvm.c
index 31b88b7..bd850ed 100644
--- a/target-i386/kvm.c
+++ b/target-i386/kvm.c
@@ -68,7 +68,7 @@
     int r, size;
 
     size = sizeof(*cpuid) + max * sizeof(*cpuid->entries);
-    cpuid = (struct kvm_cpuid2 *)qemu_mallocz(size);
+    cpuid = (struct kvm_cpuid2 *)g_malloc0(size);
     cpuid->nent = max;
     r = kvm_ioctl(s, KVM_GET_SUPPORTED_CPUID, cpuid);
     if (r == 0 && cpuid->nent >= max) {
@@ -76,7 +76,7 @@
     }
     if (r < 0) {
         if (r == -E2BIG) {
-            qemu_free(cpuid);
+            g_free(cpuid);
             return NULL;
         } else {
             fprintf(stderr, "KVM_GET_SUPPORTED_CPUID failed: %s\n",
@@ -162,7 +162,7 @@
         }
     }
 
-    qemu_free(cpuid);
+    g_free(cpuid);
 
     /* fallback for older kernels */
     if (!has_kvm_features && (function == KVM_CPUID_FEATURES)) {
@@ -187,7 +187,7 @@
     QLIST_FOREACH_SAFE(page, &hwpoison_page_list, list, next_page) {
         QLIST_REMOVE(page, list);
         qemu_ram_remap(page->ram_addr, TARGET_PAGE_SIZE);
-        qemu_free(page);
+        g_free(page);
     }
 }
 
@@ -200,7 +200,7 @@
             return;
         }
     }
-    page = qemu_malloc(sizeof(HWPoisonPage));
+    page = g_malloc(sizeof(HWPoisonPage));
     page->ram_addr = ram_addr;
     QLIST_INSERT_HEAD(&hwpoison_page_list, page, list);
 }
@@ -549,7 +549,7 @@
         }
         /* Old kernel modules had a bug and could write beyond the provided
            memory. Allocate at least a safe amount of 1K. */
-        kvm_msr_list = qemu_mallocz(MAX(1024, sizeof(msr_list) +
+        kvm_msr_list = g_malloc0(MAX(1024, sizeof(msr_list) +
                                               msr_list.nmsrs *
                                               sizeof(msr_list.indices[0])));
 
@@ -570,7 +570,7 @@
             }
         }
 
-        qemu_free(kvm_msr_list);
+        g_free(kvm_msr_list);
     }
 
     return ret;
@@ -788,7 +788,7 @@
     memcpy(&xsave->region[XSAVE_YMMH_SPACE], env->ymmh_regs,
             sizeof env->ymmh_regs);
     r = kvm_vcpu_ioctl(env, KVM_SET_XSAVE, xsave);
-    qemu_free(xsave);
+    g_free(xsave);
     return r;
 }
 
@@ -969,7 +969,7 @@
     xsave = qemu_memalign(4096, sizeof(struct kvm_xsave));
     ret = kvm_vcpu_ioctl(env, KVM_GET_XSAVE, xsave);
     if (ret < 0) {
-        qemu_free(xsave);
+        g_free(xsave);
         return ret;
     }
 
@@ -993,7 +993,7 @@
     env->xstate_bv = *(uint64_t *)&xsave->region[XSAVE_XSTATE_BV];
     memcpy(env->ymmh_regs, &xsave->region[XSAVE_YMMH_SPACE],
             sizeof env->ymmh_regs);
-    qemu_free(xsave);
+    g_free(xsave);
     return 0;
 }
 
diff --git a/target-lm32/helper.c b/target-lm32/helper.c
index 48c402e..014fd8d 100644
--- a/target-lm32/helper.c
+++ b/target-lm32/helper.c
@@ -208,7 +208,7 @@
         return NULL;
     }
 
-    env = qemu_mallocz(sizeof(CPUState));
+    env = g_malloc0(sizeof(CPUState));
 
     env->features = def->features;
     env->num_bps = def->num_breakpoints;
diff --git a/target-m68k/helper.c b/target-m68k/helper.c
index 7ca75fb..674c8e6 100644
--- a/target-m68k/helper.c
+++ b/target-m68k/helper.c
@@ -172,7 +172,7 @@
     CPUM68KState *env;
     static int inited;
 
-    env = qemu_mallocz(sizeof(CPUM68KState));
+    env = g_malloc0(sizeof(CPUM68KState));
     cpu_exec_init(env);
     if (!inited) {
         inited = 1;
@@ -193,7 +193,7 @@
 
 void cpu_m68k_close(CPUM68KState *env)
 {
-    qemu_free(env);
+    g_free(env);
 }
 
 void cpu_m68k_flush_flags(CPUM68KState *env, int cc_op)
diff --git a/target-microblaze/translate.c b/target-microblaze/translate.c
index 41beb0a..1a862d3 100644
--- a/target-microblaze/translate.c
+++ b/target-microblaze/translate.c
@@ -1846,7 +1846,7 @@
     static int tcg_initialized = 0;
     int i;
 
-    env = qemu_mallocz(sizeof(CPUState));
+    env = g_malloc0(sizeof(CPUState));
 
     cpu_exec_init(env);
     cpu_reset(env);
diff --git a/target-mips/translate.c b/target-mips/translate.c
index 2848c6a..6c4e0d7 100644
--- a/target-mips/translate.c
+++ b/target-mips/translate.c
@@ -12618,7 +12618,7 @@
     def = cpu_mips_find_by_name(cpu_model);
     if (!def)
         return NULL;
-    env = qemu_mallocz(sizeof(CPUMIPSState));
+    env = g_malloc0(sizeof(CPUMIPSState));
     env->cpu_model = def;
     env->cpu_model_str = cpu_model;
 
diff --git a/target-mips/translate_init.c b/target-mips/translate_init.c
index d55c522..5bb4215 100644
--- a/target-mips/translate_init.c
+++ b/target-mips/translate_init.c
@@ -535,7 +535,7 @@
 
 static void mmu_init (CPUMIPSState *env, const mips_def_t *def)
 {
-    env->tlb = qemu_mallocz(sizeof(CPUMIPSTLBContext));
+    env->tlb = g_malloc0(sizeof(CPUMIPSTLBContext));
 
     switch (def->mmu_type) {
         case MMU_TYPE_NONE:
@@ -568,7 +568,7 @@
 
 static void mvp_init (CPUMIPSState *env, const mips_def_t *def)
 {
-    env->mvp = qemu_mallocz(sizeof(CPUMIPSMVPContext));
+    env->mvp = g_malloc0(sizeof(CPUMIPSMVPContext));
 
     /* MVPConf1 implemented, TLB sharable, no gating storage support,
        programmable cache partitioning implemented, number of allocatable
diff --git a/target-ppc/helper.c b/target-ppc/helper.c
index 789e6aa..3abab1a 100644
--- a/target-ppc/helper.c
+++ b/target-ppc/helper.c
@@ -3089,7 +3089,7 @@
     if (!def)
         return NULL;
 
-    env = qemu_mallocz(sizeof(CPUPPCState));
+    env = g_malloc0(sizeof(CPUPPCState));
     cpu_exec_init(env);
     if (tcg_enabled()) {
         ppc_translate_init();
@@ -3105,5 +3105,5 @@
 void cpu_ppc_close (CPUPPCState *env)
 {
     /* Should also remove all opcode tables... */
-    qemu_free(env);
+    g_free(env);
 }
diff --git a/target-ppc/kvm_ppc.c b/target-ppc/kvm_ppc.c
index 536fcab..867dc1d 100644
--- a/target-ppc/kvm_ppc.c
+++ b/target-ppc/kvm_ppc.c
@@ -32,7 +32,7 @@
 
     pathlen = snprintf(NULL, 0, "%s/%s/%s", PROC_DEVTREE_PATH, node_path, prop)
               + 1;
-    path = qemu_malloc(pathlen);
+    path = g_malloc(pathlen);
 
     snprintf(path, pathlen, "%s/%s/%s", PROC_DEVTREE_PATH, node_path, prop);
 
diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
index f542b8e..9ea193d 100644
--- a/target-ppc/translate_init.c
+++ b/target-ppc/translate_init.c
@@ -9327,13 +9327,13 @@
             nb_tlb *= 2;
         switch (env->tlb_type) {
         case TLB_6XX:
-            env->tlb.tlb6 = qemu_mallocz(nb_tlb * sizeof(ppc6xx_tlb_t));
+            env->tlb.tlb6 = g_malloc0(nb_tlb * sizeof(ppc6xx_tlb_t));
             break;
         case TLB_EMB:
-            env->tlb.tlbe = qemu_mallocz(nb_tlb * sizeof(ppcemb_tlb_t));
+            env->tlb.tlbe = g_malloc0(nb_tlb * sizeof(ppcemb_tlb_t));
             break;
         case TLB_MAS:
-            env->tlb.tlbm = qemu_mallocz(nb_tlb * sizeof(ppcmas_tlb_t));
+            env->tlb.tlbm = g_malloc0(nb_tlb * sizeof(ppcmas_tlb_t));
             break;
         }
         /* Pre-compute some useful values */
diff --git a/target-s390x/helper.c b/target-s390x/helper.c
index db88603..96dd867 100644
--- a/target-s390x/helper.c
+++ b/target-s390x/helper.c
@@ -79,7 +79,7 @@
     static int inited = 0;
     static int cpu_num = 0;
 
-    env = qemu_mallocz(sizeof(CPUS390XState));
+    env = g_malloc0(sizeof(CPUS390XState));
     cpu_exec_init(env);
     if (tcg_enabled() && !inited) {
         inited = 1;
diff --git a/target-sh4/translate.c b/target-sh4/translate.c
index 569bc73..bad3577 100644
--- a/target-sh4/translate.c
+++ b/target-sh4/translate.c
@@ -279,7 +279,7 @@
     def = cpu_sh4_find_by_name(cpu_model);
     if (!def)
 	return NULL;
-    env = qemu_mallocz(sizeof(CPUSH4State));
+    env = g_malloc0(sizeof(CPUSH4State));
     env->features = def->features;
     cpu_exec_init(env);
     env->movcal_backup_tail = &(env->movcal_backup);
diff --git a/target-sparc/helper.c b/target-sparc/helper.c
index 47110a5..1fe1f07 100644
--- a/target-sparc/helper.c
+++ b/target-sparc/helper.c
@@ -1091,7 +1091,7 @@
     if (cpu_sparc_find_by_name(def, cpu_model) < 0)
         return -1;
 
-    env->def = qemu_mallocz(sizeof(*def));
+    env->def = g_malloc0(sizeof(*def));
     memcpy(env->def, def, sizeof(*def));
 #if defined(CONFIG_USER_ONLY)
     if ((env->def->features & CPU_FEATURE_FLOAT))
@@ -1124,7 +1124,7 @@
 {
     CPUSPARCState *env;
 
-    env = qemu_mallocz(sizeof(CPUSPARCState));
+    env = g_malloc0(sizeof(CPUSPARCState));
     cpu_exec_init(env);
 
     gen_intermediate_code_init(env);
diff --git a/target-unicore32/helper.c b/target-unicore32/helper.c
index 8edfcb7..b5b1cb7 100644
--- a/target-unicore32/helper.c
+++ b/target-unicore32/helper.c
@@ -53,7 +53,7 @@
     uint32_t id;
     static int inited = 1;
 
-    env = qemu_mallocz(sizeof(CPUState));
+    env = g_malloc0(sizeof(CPUState));
     cpu_exec_init(env);
 
     id = uc32_cpu_find_by_name(cpu_model);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 92f1989..c735348 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -166,7 +166,7 @@
     
     if (size > TCG_POOL_CHUNK_SIZE) {
         /* big malloc: insert a new pool (XXX: could optimize) */
-        p = qemu_malloc(sizeof(TCGPool) + size);
+        p = g_malloc(sizeof(TCGPool) + size);
         p->size = size;
         if (s->pool_current)
             s->pool_current->next = p;
@@ -183,7 +183,7 @@
             if (!p->next) {
             new_pool:
                 pool_size = TCG_POOL_CHUNK_SIZE;
-                p = qemu_malloc(sizeof(TCGPool) + pool_size);
+                p = g_malloc(sizeof(TCGPool) + pool_size);
                 p->size = pool_size;
                 p->next = NULL;
                 if (s->pool_current) 
@@ -227,8 +227,8 @@
         total_args += n;
     }
 
-    args_ct = qemu_malloc(sizeof(TCGArgConstraint) * total_args);
-    sorted_args = qemu_malloc(sizeof(int) * total_args);
+    args_ct = g_malloc(sizeof(TCGArgConstraint) * total_args);
+    sorted_args = g_malloc(sizeof(int) * total_args);
 
     for(op = 0; op < NB_OPS; op++) {
         def = &tcg_op_defs[op];
diff --git a/test-qmp-commands.c b/test-qmp-commands.c
index 7752904..f142cc6 100644
--- a/test-qmp-commands.c
+++ b/test-qmp-commands.c
@@ -15,15 +15,15 @@
 UserDefTwo * qmp_user_def_cmd2(UserDefOne * ud1a, UserDefOne * ud1b, Error **errp)
 {
     UserDefTwo *ret;
-    UserDefOne *ud1c = qemu_mallocz(sizeof(UserDefOne));
-    UserDefOne *ud1d = qemu_mallocz(sizeof(UserDefOne));
+    UserDefOne *ud1c = g_malloc0(sizeof(UserDefOne));
+    UserDefOne *ud1d = g_malloc0(sizeof(UserDefOne));
 
     ud1c->string = strdup(ud1a->string);
     ud1c->integer = ud1a->integer;
     ud1d->string = strdup(ud1b->string);
     ud1d->integer = ud1b->integer;
 
-    ret = qemu_mallocz(sizeof(UserDefTwo));
+    ret = g_malloc0(sizeof(UserDefTwo));
     ret->string = strdup("blah1");
     ret->dict.string = strdup("blah2");
     ret->dict.dict.userdef = ud1c;
diff --git a/test-visitor.c b/test-visitor.c
index 5133ad6..b7717de 100644
--- a/test-visitor.c
+++ b/test-visitor.c
@@ -191,11 +191,11 @@
     g_assert(!g_strcmp0(ud1c_p->string, ud1_p->string));
 
     g_assert(!g_strcmp0(ud2c_p->dict.dict2.string, ud2.dict.dict2.string));
-    qemu_free(ud1.string);
-    qemu_free(ud2.string);
-    qemu_free(ud2.dict.string);
-    qemu_free(ud2.dict.dict.string);
-    qemu_free(ud2.dict.dict2.string);
+    g_free(ud1.string);
+    g_free(ud2.string);
+    g_free(ud2.dict.string);
+    g_free(ud2.dict.dict.string);
+    g_free(ud2.dict.dict2.string);
 
     qapi_free_UserDefTwo(ud2c_p);
 
@@ -251,7 +251,7 @@
     QObject *obj;
     QString *str;
 
-    nested_enums = qemu_mallocz(sizeof(NestedEnumsOne));
+    nested_enums = g_malloc0(sizeof(NestedEnumsOne));
     nested_enums->enum1 = ENUM_ONE_VALUE1;
     nested_enums->enum2 = ENUM_ONE_VALUE2;
     nested_enums->enum3 = ENUM_ONE_VALUE3;
diff --git a/tests/qruncom.c b/tests/qruncom.c
index 079f7a2..2e93aaf 100644
--- a/tests/qruncom.c
+++ b/tests/qruncom.c
@@ -44,20 +44,20 @@
     set_gate(idt_table + n, 0, dpl, 0, 0);
 }
 
-void qemu_free(void *ptr)
+void g_free(void *ptr)
 {
     free(ptr);
 }
 
-void *qemu_malloc(size_t size)
+void *g_malloc(size_t size)
 {
     return malloc(size);
 }
 
-void *qemu_mallocz(size_t size)
+void *g_malloc0(size_t size)
 {
     void *ptr;
-    ptr = qemu_malloc(size);
+    ptr = g_malloc(size);
     if (!ptr)
         return NULL;
     memset(ptr, 0, size);
diff --git a/ui/curses.c b/ui/curses.c
index d29b6cf..c2be2c6 100644
--- a/ui/curses.c
+++ b/ui/curses.c
@@ -354,7 +354,7 @@
 #endif
 #endif
 
-    dcl = (DisplayChangeListener *) qemu_mallocz(sizeof(DisplayChangeListener));
+    dcl = (DisplayChangeListener *) g_malloc0(sizeof(DisplayChangeListener));
     dcl->dpy_update = curses_update;
     dcl->dpy_resize = curses_resize;
     dcl->dpy_refresh = curses_refresh;
diff --git a/ui/keymaps.c b/ui/keymaps.c
index 78c7ea3..81003bb 100644
--- a/ui/keymaps.c
+++ b/ui/keymaps.c
@@ -52,7 +52,7 @@
 	}
     }
     if (kr == NULL) {
-	kr = qemu_mallocz(sizeof(*kr));
+	kr = g_malloc0(sizeof(*kr));
         kr->start = kr->end = code;
         kr->next = *krp;
         *krp = kr;
@@ -94,13 +94,13 @@
     filename = qemu_find_file(QEMU_FILE_TYPE_KEYMAP, language);
 
     if (!k)
-	k = qemu_mallocz(sizeof(kbd_layout_t));
+	k = g_malloc0(sizeof(kbd_layout_t));
     if (!(filename && (f = fopen(filename, "r")))) {
 	fprintf(stderr,
 		"Could not read keymap file: '%s'\n", language);
 	return NULL;
     }
-    qemu_free(filename);
+    g_free(filename);
     for(;;) {
 	if (fgets(line, 1024, f) == NULL)
             break;
diff --git a/ui/sdl.c b/ui/sdl.c
index 30cde86..385cc91 100644
--- a/ui/sdl.c
+++ b/ui/sdl.c
@@ -166,7 +166,7 @@
 
 static DisplaySurface* sdl_create_displaysurface(int width, int height)
 {
-    DisplaySurface *surface = (DisplaySurface*) qemu_mallocz(sizeof(DisplaySurface));
+    DisplaySurface *surface = (DisplaySurface*) g_malloc0(sizeof(DisplaySurface));
     if (surface == NULL) {
         fprintf(stderr, "sdl_create_displaysurface: malloc failed\n");
         exit(1);
@@ -215,8 +215,8 @@
         return;
 
     if (surface->flags & QEMU_ALLOCATED_FLAG)
-        qemu_free(surface->data);
-    qemu_free(surface);
+        g_free(surface->data);
+    g_free(surface);
 }
 
 static DisplaySurface* sdl_resize_displaysurface(DisplaySurface *surface, int width, int height)
@@ -928,14 +928,14 @@
         SDL_FreeCursor(guest_sprite);
 
     bpl = cursor_get_mono_bpl(c);
-    image = qemu_mallocz(bpl * c->height);
-    mask  = qemu_mallocz(bpl * c->height);
+    image = g_malloc0(bpl * c->height);
+    mask  = g_malloc0(bpl * c->height);
     cursor_get_mono_image(c, 0x000000, image);
     cursor_get_mono_mask(c, 0, mask);
     guest_sprite = SDL_CreateCursor(image, mask, c->width, c->height,
                                     c->hot_x, c->hot_y);
-    qemu_free(image);
-    qemu_free(mask);
+    g_free(image);
+    g_free(mask);
 
     if (guest_cursor &&
             (gui_grab || kbd_mouse_is_absolute() || absolute_enabled))
@@ -1009,7 +1009,7 @@
             SDL_SetColorKey(image, SDL_SRCCOLORKEY, colorkey);
             SDL_WM_SetIcon(image, NULL);
         }
-        qemu_free(filename);
+        g_free(filename);
     }
 
     if (full_screen) {
@@ -1017,7 +1017,7 @@
         sdl_grab_start();
     }
 
-    dcl = qemu_mallocz(sizeof(DisplayChangeListener));
+    dcl = g_malloc0(sizeof(DisplayChangeListener));
     dcl->dpy_update = sdl_update;
     dcl->dpy_resize = sdl_resize;
     dcl->dpy_refresh = sdl_refresh;
@@ -1027,7 +1027,7 @@
     ds->cursor_define = sdl_mouse_define;
     register_displaychangelistener(ds, dcl);
 
-    da = qemu_mallocz(sizeof(DisplayAllocator));
+    da = g_malloc0(sizeof(DisplayAllocator));
     da->create_displaysurface = sdl_create_displaysurface;
     da->resize_displaysurface = sdl_resize_displaysurface;
     da->free_displaysurface = sdl_free_displaysurface;
diff --git a/ui/spice-core.c b/ui/spice-core.c
index 8bb62ea..dba11f0 100644
--- a/ui/spice-core.c
+++ b/ui/spice-core.c
@@ -54,7 +54,7 @@
 {
     SpiceTimer *timer;
 
-    timer = qemu_mallocz(sizeof(*timer));
+    timer = g_malloc0(sizeof(*timer));
     timer->timer = qemu_new_timer_ms(rt_clock, func, opaque);
     QTAILQ_INSERT_TAIL(&timers, timer, next);
     return timer;
@@ -75,7 +75,7 @@
     qemu_del_timer(timer->timer);
     qemu_free_timer(timer->timer);
     QTAILQ_REMOVE(&timers, timer, next);
-    qemu_free(timer);
+    g_free(timer);
 }
 
 struct SpiceWatch {
@@ -118,7 +118,7 @@
 {
     SpiceWatch *watch;
 
-    watch = qemu_mallocz(sizeof(*watch));
+    watch = g_malloc0(sizeof(*watch));
     watch->fd     = fd;
     watch->func   = func;
     watch->opaque = opaque;
@@ -132,7 +132,7 @@
 {
     watch_update_mask(watch, 0);
     QTAILQ_REMOVE(&watches, watch, next);
-    qemu_free(watch);
+    g_free(watch);
 }
 
 #if SPICE_INTERFACE_CORE_MINOR >= 3
@@ -148,7 +148,7 @@
 {
     ChannelList *item;
 
-    item = qemu_mallocz(sizeof(*item));
+    item = g_malloc0(sizeof(*item));
     item->info = info;
     QTAILQ_INSERT_TAIL(&channel_list, item, link);
 }
@@ -162,7 +162,7 @@
             continue;
         }
         QTAILQ_REMOVE(&channel_list, item, link);
-        qemu_free(item);
+        g_free(item);
         return;
     }
 }
@@ -510,25 +510,25 @@
 
         str = qemu_opt_get(opts, "x509-key-file");
         if (str) {
-            x509_key_file = qemu_strdup(str);
+            x509_key_file = g_strdup(str);
         } else {
-            x509_key_file = qemu_malloc(len);
+            x509_key_file = g_malloc(len);
             snprintf(x509_key_file, len, "%s/%s", x509_dir, X509_SERVER_KEY_FILE);
         }
 
         str = qemu_opt_get(opts, "x509-cert-file");
         if (str) {
-            x509_cert_file = qemu_strdup(str);
+            x509_cert_file = g_strdup(str);
         } else {
-            x509_cert_file = qemu_malloc(len);
+            x509_cert_file = g_malloc(len);
             snprintf(x509_cert_file, len, "%s/%s", x509_dir, X509_SERVER_CERT_FILE);
         }
 
         str = qemu_opt_get(opts, "x509-cacert-file");
         if (str) {
-            x509_cacert_file = qemu_strdup(str);
+            x509_cacert_file = g_strdup(str);
         } else {
-            x509_cacert_file = qemu_malloc(len);
+            x509_cacert_file = g_malloc(len);
             snprintf(x509_cacert_file, len, "%s/%s", x509_dir, X509_CA_CERT_FILE);
         }
 
@@ -631,9 +631,9 @@
     qemu_spice_input_init();
     qemu_spice_audio_init();
 
-    qemu_free(x509_key_file);
-    qemu_free(x509_cert_file);
-    qemu_free(x509_cacert_file);
+    g_free(x509_key_file);
+    g_free(x509_cert_file);
+    g_free(x509_cacert_file);
 }
 
 int qemu_spice_add_interface(SpiceBaseInstance *sin)
diff --git a/ui/spice-display.c b/ui/spice-display.c
index 683d454..4983963 100644
--- a/ui/spice-display.c
+++ b/ui/spice-display.c
@@ -144,14 +144,14 @@
            ssd->dirty.left, ssd->dirty.right,
            ssd->dirty.top, ssd->dirty.bottom);
 
-    update   = qemu_mallocz(sizeof(*update));
+    update   = g_malloc0(sizeof(*update));
     drawable = &update->drawable;
     image    = &update->image;
     cmd      = &update->ext.cmd;
 
     bw       = ssd->dirty.right - ssd->dirty.left;
     bh       = ssd->dirty.bottom - ssd->dirty.top;
-    update->bitmap = qemu_malloc(bw * bh * 4);
+    update->bitmap = g_malloc(bw * bh * 4);
 
     drawable->bbox            = ssd->dirty;
     drawable->clip.type       = SPICE_CLIP_TYPE_NONE;
@@ -208,12 +208,12 @@
  * Called from spice server thread context (via interface_release_ressource)
  * We do *not* hold the global qemu mutex here, so extra care is needed
  * when calling qemu functions.  Qemu interfaces used:
- *    - qemu_free (underlying glibc free is re-entrant).
+ *    - g_free (underlying glibc free is re-entrant).
  */
 void qemu_spice_destroy_update(SimpleSpiceDisplay *sdpy, SimpleSpiceUpdate *update)
 {
-    qemu_free(update->bitmap);
-    qemu_free(update);
+    g_free(update->bitmap);
+    g_free(update);
 }
 
 void qemu_spice_create_host_memslot(SimpleSpiceDisplay *ssd)
@@ -274,7 +274,7 @@
     ssd->mouse_x = -1;
     ssd->mouse_y = -1;
     ssd->bufsize = (16 * 1024 * 1024);
-    ssd->buf = qemu_malloc(ssd->bufsize);
+    ssd->buf = g_malloc(ssd->bufsize);
 }
 
 /* display listener callbacks */
diff --git a/ui/spice-input.c b/ui/spice-input.c
index 75abf5f..af4223d 100644
--- a/ui/spice-input.c
+++ b/ui/spice-input.c
@@ -200,12 +200,12 @@
     QemuSpiceKbd *kbd;
     QemuSpicePointer *pointer;
 
-    kbd = qemu_mallocz(sizeof(*kbd));
+    kbd = g_malloc0(sizeof(*kbd));
     kbd->sin.base.sif = &kbd_interface.base;
     qemu_spice_add_interface(&kbd->sin.base);
     qemu_add_led_event_handler(kbd_leds, kbd);
 
-    pointer = qemu_mallocz(sizeof(*pointer));
+    pointer = g_malloc0(sizeof(*pointer));
     pointer->mouse.base.sif  = &mouse_interface.base;
     pointer->tablet.base.sif = &tablet_interface.base;
     qemu_spice_add_interface(&pointer->mouse.base);
diff --git a/ui/vnc-auth-sasl.c b/ui/vnc-auth-sasl.c
index 15af49b..e96095a 100644
--- a/ui/vnc-auth-sasl.c
+++ b/ui/vnc-auth-sasl.c
@@ -135,7 +135,7 @@
     }
     VNC_DEBUG("SASL client username %s\n", (const char *)val);
 
-    vs->sasl.username = qemu_strdup((const char*)val);
+    vs->sasl.username = g_strdup((const char*)val);
 
     if (vs->vd->sasl.acl == NULL) {
         VNC_DEBUG("no ACL activated, allowing access\n");
diff --git a/ui/vnc-enc-hextile.c b/ui/vnc-enc-hextile.c
index 364a491..d2905c8 100644
--- a/ui/vnc-enc-hextile.c
+++ b/ui/vnc-enc-hextile.c
@@ -70,8 +70,8 @@
     uint8_t *last_fg, *last_bg;
     VncDisplay *vd = vs->vd;
 
-    last_fg = (uint8_t *) qemu_malloc(vd->server->pf.bytes_per_pixel);
-    last_bg = (uint8_t *) qemu_malloc(vd->server->pf.bytes_per_pixel);
+    last_fg = (uint8_t *) g_malloc(vd->server->pf.bytes_per_pixel);
+    last_bg = (uint8_t *) g_malloc(vd->server->pf.bytes_per_pixel);
     has_fg = has_bg = 0;
     for (j = y; j < (y + h); j += 16) {
         for (i = x; i < (x + w); i += 16) {
diff --git a/ui/vnc-enc-tight.c b/ui/vnc-enc-tight.c
index 5c02803..5d492ab 100644
--- a/ui/vnc-enc-tight.c
+++ b/ui/vnc-enc-tight.c
@@ -1293,13 +1293,13 @@
 
     jpeg_start_compress(&cinfo, true);
 
-    buf = qemu_malloc(w * 3);
+    buf = g_malloc(w * 3);
     row[0] = buf;
     for (dy = 0; dy < h; dy++) {
         rgb_prepare_row(vs, buf, x, y + dy, w);
         jpeg_write_scanlines(&cinfo, row, 1);
     }
-    qemu_free(buf);
+    g_free(buf);
 
     jpeg_finish_compress(&cinfo);
     jpeg_destroy_compress(&cinfo);
@@ -1363,12 +1363,12 @@
 
 static void *vnc_png_malloc(png_structp png_ptr, png_size_t size)
 {
-    return qemu_malloc(size);
+    return g_malloc(size);
 }
 
 static void vnc_png_free(png_structp png_ptr, png_voidp ptr)
 {
-    qemu_free(ptr);
+    g_free(ptr);
 }
 
 static int send_png_rect(VncState *vs, int x, int y, int w, int h,
@@ -1432,7 +1432,7 @@
     png_write_info(png_ptr, info_ptr);
 
     buffer_reserve(&vs->tight.png, 2048);
-    buf = qemu_malloc(w * 3);
+    buf = g_malloc(w * 3);
     for (dy = 0; dy < h; dy++)
     {
         if (color_type == PNG_COLOR_TYPE_PALETTE) {
@@ -1442,7 +1442,7 @@
         }
         png_write_row(png_ptr, buf);
     }
-    qemu_free(buf);
+    g_free(buf);
 
     png_write_end(png_ptr, NULL);
 
diff --git a/ui/vnc-enc-zlib.c b/ui/vnc-enc-zlib.c
index e32e4cd..d1b97f2 100644
--- a/ui/vnc-enc-zlib.c
+++ b/ui/vnc-enc-zlib.c
@@ -35,14 +35,14 @@
     size *= items;
     size = (size + ZALLOC_ALIGNMENT - 1) & ~(ZALLOC_ALIGNMENT - 1);
 
-    p = qemu_mallocz(size);
+    p = g_malloc0(size);
 
     return (p);
 }
 
 void vnc_zlib_zfree(void *x, void *addr)
 {
-    qemu_free(addr);
+    g_free(addr);
 }
 
 static void vnc_zlib_start(VncState *vs)
diff --git a/ui/vnc-jobs-async.c b/ui/vnc-jobs-async.c
index 1dfa6c3..de5ea6b 100644
--- a/ui/vnc-jobs-async.c
+++ b/ui/vnc-jobs-async.c
@@ -77,7 +77,7 @@
 
 VncJob *vnc_job_new(VncState *vs)
 {
-    VncJob *job = qemu_mallocz(sizeof(VncJob));
+    VncJob *job = g_malloc0(sizeof(VncJob));
 
     job->vs = vs;
     vnc_lock_queue(queue);
@@ -88,7 +88,7 @@
 
 int vnc_job_add_rect(VncJob *job, int x, int y, int w, int h)
 {
-    VncRectEntry *entry = qemu_mallocz(sizeof(VncRectEntry));
+    VncRectEntry *entry = g_malloc0(sizeof(VncRectEntry));
 
     entry->rect.x = x;
     entry->rect.y = y;
@@ -105,7 +105,7 @@
 {
     vnc_lock_queue(queue);
     if (queue->exit || QLIST_EMPTY(&job->rectangles)) {
-        qemu_free(job);
+        g_free(job);
     } else {
         QTAILQ_INSERT_TAIL(&queue->jobs, job, next);
         qemu_cond_broadcast(&queue->cond);
@@ -246,7 +246,7 @@
         if (n >= 0) {
             n_rectangles += n;
         }
-        qemu_free(entry);
+        g_free(entry);
     }
     vnc_unlock_display(job->vs->vd);
 
@@ -276,13 +276,13 @@
     QTAILQ_REMOVE(&queue->jobs, job, next);
     vnc_unlock_queue(queue);
     qemu_cond_broadcast(&queue->cond);
-    qemu_free(job);
+    g_free(job);
     return 0;
 }
 
 static VncJobQueue *vnc_queue_init(void)
 {
-    VncJobQueue *queue = qemu_mallocz(sizeof(VncJobQueue));
+    VncJobQueue *queue = g_malloc0(sizeof(VncJobQueue));
 
     qemu_cond_init(&queue->cond);
     qemu_mutex_init(&queue->mutex);
@@ -295,7 +295,7 @@
     qemu_cond_destroy(&queue->cond);
     qemu_mutex_destroy(&queue->mutex);
     buffer_free(&queue->buffer);
-    qemu_free(q);
+    g_free(q);
     queue = NULL; /* Unset global queue */
 }
 
diff --git a/ui/vnc-palette.c b/ui/vnc-palette.c
index 13ece42..63d5f64 100644
--- a/ui/vnc-palette.c
+++ b/ui/vnc-palette.c
@@ -55,7 +55,7 @@
 {
     VncPalette *palette;
 
-    palette = qemu_mallocz(sizeof(*palette));
+    palette = g_malloc0(sizeof(*palette));
     palette_init(palette, max, bpp);
     return palette;
 }
@@ -69,7 +69,7 @@
 
 void palette_destroy(VncPalette *palette)
 {
-    qemu_free(palette);
+    g_free(palette);
 }
 
 int palette_put(VncPalette *palette, uint32_t color)
diff --git a/ui/vnc-tls.c b/ui/vnc-tls.c
index 31f1467..2e2456e 100644
--- a/ui/vnc-tls.c
+++ b/ui/vnc-tls.c
@@ -244,11 +244,11 @@
 
         if (i == 0) {
             size_t dnameSize = 1024;
-            vs->tls.dname = qemu_malloc(dnameSize);
+            vs->tls.dname = g_malloc(dnameSize);
         requery:
             if ((ret = gnutls_x509_crt_get_dn (cert, vs->tls.dname, &dnameSize)) != 0) {
                 if (ret == GNUTLS_E_SHORT_MEMORY_BUFFER) {
-                    vs->tls.dname = qemu_realloc(vs->tls.dname, dnameSize);
+                    vs->tls.dname = g_realloc(vs->tls.dname, dnameSize);
                     goto requery;
                 }
                 gnutls_x509_crt_deinit (cert);
@@ -397,11 +397,11 @@
     struct stat sb;
 
     if (*cred) {
-        qemu_free(*cred);
+        g_free(*cred);
         *cred = NULL;
     }
 
-    *cred = qemu_malloc(strlen(certdir) + strlen(filename) + 2);
+    *cred = g_malloc(strlen(certdir) + strlen(filename) + 2);
 
     strcpy(*cred, certdir);
     strcat(*cred, "/");
@@ -409,7 +409,7 @@
 
     VNC_DEBUG("Check %s\n", *cred);
     if (stat(*cred, &sb) < 0) {
-        qemu_free(*cred);
+        g_free(*cred);
         *cred = NULL;
         if (ignoreMissing && errno == ENOENT)
             return 0;
@@ -435,10 +435,10 @@
     return 0;
 
  cleanup:
-    qemu_free(vd->tls.x509cacert);
-    qemu_free(vd->tls.x509cacrl);
-    qemu_free(vd->tls.x509cert);
-    qemu_free(vd->tls.x509key);
+    g_free(vd->tls.x509cacert);
+    g_free(vd->tls.x509cacrl);
+    g_free(vd->tls.x509cert);
+    g_free(vd->tls.x509key);
     vd->tls.x509cacert = vd->tls.x509cacrl = vd->tls.x509cert = vd->tls.x509key = NULL;
     return -1;
 }
diff --git a/ui/vnc.c b/ui/vnc.c
index f1e27d9..fc3a612 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -67,7 +67,7 @@
     /* Enough for the existing format + the 2 vars we're
      * substituting in. */
     addrlen = strlen(format) + strlen(host) + strlen(serv);
-    addr = qemu_malloc(addrlen + 1);
+    addr = g_malloc(addrlen + 1);
     snprintf(addr, addrlen, format, host, serv);
     addr[addrlen] = '\0';
 
@@ -411,7 +411,7 @@
 {
     if ((buffer->capacity - buffer->offset) < len) {
         buffer->capacity += (len + 1024);
-        buffer->buffer = qemu_realloc(buffer->buffer, buffer->capacity);
+        buffer->buffer = g_realloc(buffer->buffer, buffer->capacity);
         if (buffer->buffer == NULL) {
             fprintf(stderr, "vnc: out of memory\n");
             exit(1);
@@ -436,7 +436,7 @@
 
 void buffer_free(Buffer *buffer)
 {
-    qemu_free(buffer->buffer);
+    g_free(buffer->buffer);
     buffer->offset = 0;
     buffer->capacity = 0;
     buffer->buffer = NULL;
@@ -505,16 +505,16 @@
 
     /* server surface */
     if (!vd->server)
-        vd->server = qemu_mallocz(sizeof(*vd->server));
+        vd->server = g_malloc0(sizeof(*vd->server));
     if (vd->server->data)
-        qemu_free(vd->server->data);
+        g_free(vd->server->data);
     *(vd->server) = *(ds->surface);
-    vd->server->data = qemu_mallocz(vd->server->linesize *
+    vd->server->data = g_malloc0(vd->server->linesize *
                                     vd->server->height);
 
     /* guest surface */
     if (!vd->guest.ds)
-        vd->guest.ds = qemu_mallocz(sizeof(*vd->guest.ds));
+        vd->guest.ds = g_malloc0(sizeof(*vd->guest.ds));
     if (ds_get_bytes_per_pixel(ds) != vd->guest.ds->pf.bytes_per_pixel)
         console_color_init(ds);
     *(vd->guest.ds) = *(ds->surface);
@@ -781,12 +781,12 @@
     VncState *vs;
 
     cursor_put(vd->cursor);
-    qemu_free(vd->cursor_mask);
+    g_free(vd->cursor_mask);
 
     vd->cursor = c;
     cursor_get(vd->cursor);
     vd->cursor_msize = cursor_get_mono_bpl(c) * c->height;
-    vd->cursor_mask = qemu_mallocz(vd->cursor_msize);
+    vd->cursor_mask = g_malloc0(vd->cursor_msize);
     cursor_get_mono_mask(c, 0, vd->cursor_mask);
 
     QTAILQ_FOREACH(vs, &vd->clients, next) {
@@ -1013,10 +1013,10 @@
     qemu_mutex_destroy(&vs->output_mutex);
 #endif
     for (i = 0; i < VNC_STAT_ROWS; ++i) {
-        qemu_free(vs->lossy_rect[i]);
+        g_free(vs->lossy_rect[i]);
     }
-    qemu_free(vs->lossy_rect);
-    qemu_free(vs);
+    g_free(vs->lossy_rect);
+    g_free(vs);
 }
 
 int vnc_client_io_error(VncState *vs, int ret, int last_errno)
@@ -2496,7 +2496,7 @@
 
 static void vnc_connect(VncDisplay *vd, int csock, int skipauth)
 {
-    VncState *vs = qemu_mallocz(sizeof(VncState));
+    VncState *vs = g_malloc0(sizeof(VncState));
     int i;
 
     vs->csock = csock;
@@ -2513,9 +2513,9 @@
 #endif
     }
 
-    vs->lossy_rect = qemu_mallocz(VNC_STAT_ROWS * sizeof (*vs->lossy_rect));
+    vs->lossy_rect = g_malloc0(VNC_STAT_ROWS * sizeof (*vs->lossy_rect));
     for (i = 0; i < VNC_STAT_ROWS; ++i) {
-        vs->lossy_rect[i] = qemu_mallocz(VNC_STAT_COLS * sizeof (uint8_t));
+        vs->lossy_rect[i] = g_malloc0(VNC_STAT_COLS * sizeof (uint8_t));
     }
 
     VNC_DEBUG("New client on socket %d\n", csock);
@@ -2576,9 +2576,9 @@
 
 void vnc_display_init(DisplayState *ds)
 {
-    VncDisplay *vs = qemu_mallocz(sizeof(*vs));
+    VncDisplay *vs = g_malloc0(sizeof(*vs));
 
-    dcl = qemu_mallocz(sizeof(DisplayChangeListener));
+    dcl = g_malloc0(sizeof(DisplayChangeListener));
 
     ds->opaque = vs;
     dcl->idle = 1;
@@ -2620,7 +2620,7 @@
     if (!vs)
         return;
     if (vs->display) {
-        qemu_free(vs->display);
+        g_free(vs->display);
         vs->display = NULL;
     }
     if (vs->lsock != -1) {
@@ -2644,7 +2644,7 @@
     }
 
     if (vs->password) {
-        qemu_free(vs->password);
+        g_free(vs->password);
     }
 
     vs->password = NULL;
@@ -2671,10 +2671,10 @@
     }
 
     if (vs->password) {
-        qemu_free(vs->password);
+        g_free(vs->password);
         vs->password = NULL;
     }
-    vs->password = qemu_strdup(password);
+    vs->password = g_strdup(password);
     vs->auth = VNC_AUTH_VNC;
 out:
     if (ret != 0) {
@@ -2753,20 +2753,20 @@
             end = strchr(options, ',');
             if (start && (!end || (start < end))) {
                 int len = end ? end-(start+1) : strlen(start+1);
-                char *path = qemu_strndup(start + 1, len);
+                char *path = g_strndup(start + 1, len);
 
                 VNC_DEBUG("Trying certificate path '%s'\n", path);
                 if (vnc_tls_set_x509_creds_dir(vs, path) < 0) {
                     fprintf(stderr, "Failed to find x509 certificates/keys in %s\n", path);
-                    qemu_free(path);
-                    qemu_free(vs->display);
+                    g_free(path);
+                    g_free(vs->display);
                     vs->display = NULL;
                     return -1;
                 }
-                qemu_free(path);
+                g_free(path);
             } else {
                 fprintf(stderr, "No certificate path provided\n");
-                qemu_free(vs->display);
+                g_free(vs->display);
                 vs->display = NULL;
                 return -1;
             }
@@ -2907,7 +2907,7 @@
     } else {
         /* listen for connects */
         char *dpy;
-        dpy = qemu_malloc(256);
+        dpy = g_malloc(256);
         if (strncmp(display, "unix:", 5) == 0) {
             pstrcpy(dpy, 256, "unix:");
             vs->lsock = unix_listen(display+5, dpy+5, 256-5);
diff --git a/usb-bsd.c b/usb-bsd.c
index ab84d93..1187552 100644
--- a/usb-bsd.c
+++ b/usb-bsd.c
@@ -290,7 +290,7 @@
 
     close(s->devfd);
 
-    qemu_free(s);
+    g_free(s);
 }
 
 static int usb_host_initfn(USBDevice *dev)
diff --git a/usb-linux.c b/usb-linux.c
index 5562187..2e20f8e 100644
--- a/usb-linux.c
+++ b/usb-linux.c
@@ -271,7 +271,7 @@
 
 static AsyncURB *async_alloc(USBHostDevice *s)
 {
-    AsyncURB *aurb = qemu_mallocz(sizeof(AsyncURB));
+    AsyncURB *aurb = g_malloc0(sizeof(AsyncURB));
     aurb->hdev = s;
     QLIST_INSERT_HEAD(&s->aurbs, aurb, next);
     return aurb;
@@ -280,7 +280,7 @@
 static void async_free(AsyncURB *aurb)
 {
     QLIST_REMOVE(aurb, next);
-    qemu_free(aurb);
+    g_free(aurb);
 }
 
 static void do_disconnect(USBHostDevice *s)
@@ -528,11 +528,11 @@
     AsyncURB *aurb;
     int i, j, len = get_max_packet_size(s, ep);
 
-    aurb = qemu_mallocz(s->iso_urb_count * sizeof(*aurb));
+    aurb = g_malloc0(s->iso_urb_count * sizeof(*aurb));
     for (i = 0; i < s->iso_urb_count; i++) {
         aurb[i].urb.endpoint      = ep;
         aurb[i].urb.buffer_length = ISO_FRAME_DESC_PER_URB * len;
-        aurb[i].urb.buffer        = qemu_malloc(aurb[i].urb.buffer_length);
+        aurb[i].urb.buffer        = g_malloc(aurb[i].urb.buffer_length);
         aurb[i].urb.type          = USBDEVFS_URB_TYPE_ISO;
         aurb[i].urb.flags         = USBDEVFS_URB_ISO_ASAP;
         aurb[i].urb.number_of_packets = ISO_FRAME_DESC_PER_URB;
@@ -578,11 +578,11 @@
     }
 
     for (i = 0; i < s->iso_urb_count; i++) {
-        qemu_free(aurb[i].urb.buffer);
+        g_free(aurb[i].urb.buffer);
     }
 
     if (free)
-        qemu_free(aurb);
+        g_free(aurb);
     else
         printf("husb: leaking iso urbs because of discard failure\n");
     set_iso_urb(s, ep, NULL);
@@ -1688,7 +1688,7 @@
         }
 
         /* the module setting (used later for opening devices) */
-        usb_host_device_path = qemu_mallocz(strlen(devpath)+1);
+        usb_host_device_path = g_malloc0(strlen(devpath)+1);
         strcpy(usb_host_device_path, devpath);
         if (mon) {
             monitor_printf(mon, "husb: using %s file-system with %s\n",
diff --git a/usb-redir.c b/usb-redir.c
index 9e5fce2..3fbbcff 100644
--- a/usb-redir.c
+++ b/usb-redir.c
@@ -234,7 +234,7 @@
 
 static AsyncURB *async_alloc(USBRedirDevice *dev, USBPacket *p)
 {
-    AsyncURB *aurb = (AsyncURB *) qemu_mallocz(sizeof(AsyncURB));
+    AsyncURB *aurb = (AsyncURB *) g_malloc0(sizeof(AsyncURB));
     aurb->dev = dev;
     aurb->packet = p;
     aurb->packet_id = dev->packet_id;
@@ -247,7 +247,7 @@
 static void async_free(USBRedirDevice *dev, AsyncURB *aurb)
 {
     QTAILQ_REMOVE(&dev->asyncq, aurb, next);
-    qemu_free(aurb);
+    g_free(aurb);
 }
 
 static AsyncURB *async_find(USBRedirDevice *dev, uint32_t packet_id)
@@ -286,7 +286,7 @@
 static struct buf_packet *bufp_alloc(USBRedirDevice *dev,
     uint8_t *data, int len, int status, uint8_t ep)
 {
-    struct buf_packet *bufp = qemu_malloc(sizeof(struct buf_packet));
+    struct buf_packet *bufp = g_malloc(sizeof(struct buf_packet));
     bufp->data   = data;
     bufp->len    = len;
     bufp->status = status;
@@ -299,7 +299,7 @@
 {
     QTAILQ_REMOVE(&dev->endpoint[EP2I(ep)].bufpq, bufp, next);
     free(bufp->data);
-    qemu_free(bufp);
+    g_free(bufp);
 }
 
 static void usbredir_free_bufpq(USBRedirDevice *dev, uint8_t ep)
diff --git a/vl.c b/vl.c
index d1971df..8405429 100644
--- a/vl.c
+++ b/vl.c
@@ -300,7 +300,7 @@
 static void res_free(void)
 {
     if (boot_splash_filedata != NULL) {
-        qemu_free(boot_splash_filedata);
+        g_free(boot_splash_filedata);
         boot_splash_filedata = NULL;
     }
 }
@@ -466,7 +466,7 @@
         if (vlan->id == id)
             return &vlan->net;
     }
-    vlan = qemu_mallocz(sizeof(struct bt_vlan_s));
+    vlan = g_malloc0(sizeof(struct bt_vlan_s));
     vlan->id = id;
     pvlan = &first_bt_vlan;
     while (*pvlan != NULL)
@@ -741,7 +741,7 @@
     qemu_boot_set(standard_boot_devices);
 
     qemu_unregister_reset(restore_boot_devices, standard_boot_devices);
-    qemu_free(standard_boot_devices);
+    g_free(standard_boot_devices);
 }
 
 void add_boot_device_path(int32_t bootindex, DeviceState *dev,
@@ -755,9 +755,9 @@
 
     assert(dev != NULL || suffix != NULL);
 
-    node = qemu_mallocz(sizeof(FWBootEntry));
+    node = g_malloc0(sizeof(FWBootEntry));
     node->bootindex = bootindex;
-    node->suffix = suffix ? qemu_strdup(suffix) : NULL;
+    node->suffix = suffix ? g_strdup(suffix) : NULL;
     node->dev = dev;
 
     QTAILQ_FOREACH(i, &fw_boot_order, link) {
@@ -798,13 +798,13 @@
         if (i->suffix && devpath) {
             size_t bootpathlen = strlen(devpath) + strlen(i->suffix) + 1;
 
-            bootpath = qemu_malloc(bootpathlen);
+            bootpath = g_malloc(bootpathlen);
             snprintf(bootpath, bootpathlen, "%s%s", devpath, i->suffix);
-            qemu_free(devpath);
+            g_free(devpath);
         } else if (devpath) {
             bootpath = devpath;
         } else {
-            bootpath = qemu_strdup(i->suffix);
+            bootpath = g_strdup(i->suffix);
             assert(bootpath);
         }
 
@@ -812,10 +812,10 @@
             list[total-1] = '\n';
         }
         len = strlen(bootpath) + 1;
-        list = qemu_realloc(list, total + len);
+        list = g_realloc(list, total + len);
         memcpy(&list[total], bootpath, len);
         total += len;
-        qemu_free(bootpath);
+        g_free(bootpath);
     }
 
     *size = total;
@@ -1014,7 +1014,7 @@
 {
     struct pcmcia_socket_entry_s *entry;
 
-    entry = qemu_malloc(sizeof(struct pcmcia_socket_entry_s));
+    entry = g_malloc(sizeof(struct pcmcia_socket_entry_s));
     entry->socket = socket;
     entry->next = pcmcia_sockets;
     pcmcia_sockets = entry;
@@ -1028,7 +1028,7 @@
     for (entry = *ptr; entry; ptr = &entry->next, entry = *ptr)
         if (entry->socket == socket) {
             *ptr = entry->next;
-            qemu_free(entry);
+            g_free(entry);
         }
 }
 
@@ -1129,7 +1129,7 @@
 {
     VMChangeStateEntry *e;
 
-    e = qemu_mallocz(sizeof (*e));
+    e = g_malloc0(sizeof (*e));
 
     e->cb = cb;
     e->opaque = opaque;
@@ -1140,7 +1140,7 @@
 void qemu_del_vm_change_state_handler(VMChangeStateEntry *e)
 {
     QLIST_REMOVE (e, entries);
-    qemu_free (e);
+    g_free (e);
 }
 
 void vm_state_notify(int running, int reason)
@@ -1245,7 +1245,7 @@
 
 void qemu_register_reset(QEMUResetHandler *func, void *opaque)
 {
-    QEMUResetEntry *re = qemu_mallocz(sizeof(QEMUResetEntry));
+    QEMUResetEntry *re = g_malloc0(sizeof(QEMUResetEntry));
 
     re->func = func;
     re->opaque = opaque;
@@ -1259,7 +1259,7 @@
     QTAILQ_FOREACH(re, &reset_handlers, entry) {
         if (re->func == func && re->opaque == opaque) {
             QTAILQ_REMOVE(&reset_handlers, re, entry);
-            qemu_free(re);
+            g_free(re);
             return;
         }
     }
@@ -1648,7 +1648,7 @@
     /* If name contains path separators then try it as a straight path.  */
     if ((strchr(name, '/') || strchr(name, '\\'))
         && access(name, R_OK) == 0) {
-        return qemu_strdup(name);
+        return g_strdup(name);
     }
     switch (type) {
     case QEMU_FILE_TYPE_BIOS:
@@ -1661,10 +1661,10 @@
         abort();
     }
     len = strlen(data_dir) + strlen(name) + strlen(subdir) + 2;
-    buf = qemu_mallocz(len);
+    buf = g_malloc0(len);
     snprintf(buf, len, "%s/%s%s", data_dir, subdir, name);
     if (access(buf, R_OK)) {
-        qemu_free(buf);
+        g_free(buf);
         return NULL;
     }
     return buf;
@@ -1795,7 +1795,7 @@
 {
     struct device_config *conf;
 
-    conf = qemu_mallocz(sizeof(*conf));
+    conf = g_malloc0(sizeof(*conf));
     conf->type = type;
     conf->cmdline = cmdline;
     QTAILQ_INSERT_TAIL(&device_configs, conf, next);
@@ -2367,7 +2367,7 @@
                         if (get_param_value(buf, sizeof(buf),
                                             "once", optarg)) {
                             validate_bootdevices(buf);
-                            standard_boot_devices = qemu_strdup(boot_devices);
+                            standard_boot_devices = g_strdup(boot_devices);
                             pstrcpy(boot_devices, sizeof(boot_devices), buf);
                             qemu_register_reset(restore_boot_devices,
                                                 standard_boot_devices);
@@ -2808,7 +2808,7 @@
                 semihosting_enabled = 1;
                 break;
             case QEMU_OPTION_name:
-                qemu_name = qemu_strdup(optarg);
+                qemu_name = g_strdup(optarg);
 		 {
 		     char *p = strchr(qemu_name, ',');
 		     if (p != NULL) {
diff --git a/xen-all.c b/xen-all.c
index 9eaeac1..84420d8 100644
--- a/xen-all.c
+++ b/xen-all.c
@@ -140,7 +140,7 @@
     RAMBlock *new_block;
     ram_addr_t below_4g_mem_size, above_4g_mem_size = 0;
 
-    new_block = qemu_mallocz(sizeof (*new_block));
+    new_block = g_malloc0(sizeof (*new_block));
     pstrcpy(new_block->idstr, sizeof (new_block->idstr), "xen.ram");
     new_block->host = NULL;
     new_block->offset = 0;
@@ -154,7 +154,7 @@
 
     QLIST_INSERT_HEAD(&ram_list.blocks, new_block, next);
 
-    ram_list.phys_dirty = qemu_realloc(ram_list.phys_dirty,
+    ram_list.phys_dirty = g_realloc(ram_list.phys_dirty,
                                        new_block->length >> TARGET_PAGE_BITS);
     memset(ram_list.phys_dirty + (new_block->offset >> TARGET_PAGE_BITS),
            0xff, new_block->length >> TARGET_PAGE_BITS);
@@ -190,7 +190,7 @@
     trace_xen_ram_alloc(ram_addr, size);
 
     nr_pfn = size >> TARGET_PAGE_BITS;
-    pfn_list = qemu_malloc(sizeof (*pfn_list) * nr_pfn);
+    pfn_list = g_malloc(sizeof (*pfn_list) * nr_pfn);
 
     for (i = 0; i < nr_pfn; i++) {
         pfn_list[i] = (ram_addr >> TARGET_PAGE_BITS) + i;
@@ -200,7 +200,7 @@
         hw_error("xen: failed to populate ram at " RAM_ADDR_FMT, ram_addr);
     }
 
-    qemu_free(pfn_list);
+    g_free(pfn_list);
 }
 
 static XenPhysmap *get_physmapping(XenIOState *state,
@@ -267,7 +267,7 @@
         }
     }
 
-    physmap = qemu_malloc(sizeof (XenPhysmap));
+    physmap = g_malloc(sizeof (XenPhysmap));
 
     physmap->start_addr = start_addr;
     physmap->size = size;
@@ -888,7 +888,7 @@
     unsigned long ioreq_pfn;
     XenIOState *state;
 
-    state = qemu_mallocz(sizeof (XenIOState));
+    state = g_malloc0(sizeof (XenIOState));
 
     state->xce_handle = xen_xc_evtchn_open(NULL, 0);
     if (state->xce_handle == XC_HANDLER_INITIAL_VALUE) {
@@ -922,7 +922,7 @@
         hw_error("map buffered IO page returned error %d", errno);
     }
 
-    state->ioreq_local_port = qemu_mallocz(smp_cpus * sizeof (evtchn_port_t));
+    state->ioreq_local_port = g_malloc0(smp_cpus * sizeof (evtchn_port_t));
 
     /* FIXME: how about if we overflow the page here? */
     for (i = 0; i < smp_cpus; i++) {
diff --git a/xen-mapcache.c b/xen-mapcache.c
index 15d1241..5b247ee 100644
--- a/xen-mapcache.c
+++ b/xen-mapcache.c
@@ -87,7 +87,7 @@
     unsigned long size;
     struct rlimit rlimit_as;
 
-    mapcache = qemu_mallocz(sizeof (MapCache));
+    mapcache = g_malloc0(sizeof (MapCache));
 
     QTAILQ_INIT(&mapcache->locked_entries);
     mapcache->last_address_index = -1;
@@ -111,7 +111,7 @@
     size = (size + XC_PAGE_SIZE - 1) & ~(XC_PAGE_SIZE - 1);
     DPRINTF("%s, nr_buckets = %lx size %lu\n", __func__,
             mapcache->nr_buckets, size);
-    mapcache->entry = qemu_mallocz(size);
+    mapcache->entry = g_malloc0(size);
 }
 
 static void xen_remap_bucket(MapCacheEntry *entry,
@@ -126,8 +126,8 @@
 
     trace_xen_remap_bucket(address_index);
 
-    pfns = qemu_mallocz(nb_pfn * sizeof (xen_pfn_t));
-    err = qemu_mallocz(nb_pfn * sizeof (int));
+    pfns = g_malloc0(nb_pfn * sizeof (xen_pfn_t));
+    err = g_malloc0(nb_pfn * sizeof (int));
 
     if (entry->vaddr_base != NULL) {
         if (munmap(entry->vaddr_base, entry->size) != 0) {
@@ -136,7 +136,7 @@
         }
     }
     if (entry->valid_mapping != NULL) {
-        qemu_free(entry->valid_mapping);
+        g_free(entry->valid_mapping);
         entry->valid_mapping = NULL;
     }
 
@@ -154,7 +154,7 @@
     entry->vaddr_base = vaddr_base;
     entry->paddr_index = address_index;
     entry->size = size;
-    entry->valid_mapping = (unsigned long *) qemu_mallocz(sizeof(unsigned long) *
+    entry->valid_mapping = (unsigned long *) g_malloc0(sizeof(unsigned long) *
             BITS_TO_LONGS(size >> XC_PAGE_SHIFT));
 
     bitmap_zero(entry->valid_mapping, nb_pfn);
@@ -164,8 +164,8 @@
         }
     }
 
-    qemu_free(pfns);
-    qemu_free(err);
+    g_free(pfns);
+    g_free(err);
 }
 
 uint8_t *xen_map_cache(target_phys_addr_t phys_addr, target_phys_addr_t size,
@@ -201,7 +201,7 @@
         entry = entry->next;
     }
     if (!entry) {
-        entry = qemu_mallocz(sizeof (MapCacheEntry));
+        entry = g_malloc0(sizeof (MapCacheEntry));
         pentry->next = entry;
         xen_remap_bucket(entry, __size, address_index);
     } else if (!entry->lock) {
@@ -223,7 +223,7 @@
     mapcache->last_address_index = address_index;
     mapcache->last_address_vaddr = entry->vaddr_base;
     if (lock) {
-        MapCacheRev *reventry = qemu_mallocz(sizeof(MapCacheRev));
+        MapCacheRev *reventry = g_malloc0(sizeof(MapCacheRev));
         entry->lock++;
         reventry->vaddr_req = mapcache->last_address_vaddr + address_offset;
         reventry->paddr_index = mapcache->last_address_index;
@@ -301,7 +301,7 @@
         return;
     }
     QTAILQ_REMOVE(&mapcache->locked_entries, reventry, next);
-    qemu_free(reventry);
+    g_free(reventry);
 
     entry = &mapcache->entry[paddr_index % mapcache->nr_buckets];
     while (entry && (entry->paddr_index != paddr_index || entry->size != size)) {
@@ -322,8 +322,8 @@
         perror("unmap fails");
         exit(-1);
     }
-    qemu_free(entry->valid_mapping);
-    qemu_free(entry);
+    g_free(entry->valid_mapping);
+    g_free(entry);
 }
 
 void xen_invalidate_map_cache(void)
@@ -357,7 +357,7 @@
         entry->paddr_index = 0;
         entry->vaddr_base = NULL;
         entry->size = 0;
-        qemu_free(entry->valid_mapping);
+        g_free(entry->valid_mapping);
         entry->valid_mapping = NULL;
     }