qemu-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Qemu-devel] [PATCH 2/2] Use g_new() & friends where that makes obvious


From: Markus Armbruster
Subject: [Qemu-devel] [PATCH 2/2] Use g_new() & friends where that makes obvious sense
Date: Fri, 31 Jan 2014 16:53:24 +0100

g_new(T, n) is safer than g_malloc(sizeof(T) * n) for two reasons.
One, it catches multiplication overflowing size_t.  Two, it returns
T * rather than void *, which lets the compiler catch more type
errors.

Patch created with the following Coccinelle patch, with two hunks
dropped from the result:

    @@
    type T;
    @@
    -g_malloc(sizeof(T))
    +g_new(T, 1)
    @@
    type T;
    @@
    -g_malloc0(sizeof(T))
    +g_new0(T, 1)
    @@
    type T;
    expression n;
    @@
    -g_malloc(sizeof(T) * (n))
    +g_new(T, n)
    @@
    type T;
    expression n;
    @@
    -g_malloc0(sizeof(T) * (n))
    +g_new0(T, n)
    @@
    type T;
    expression p, n;
    @@
    -g_realloc(p, sizeof(T) * (n))
    +g_renew(T, p, n)
    @@
    type T;
    expression n;
    @@
    -(T *)g_new(T, n)
    +g_new(T, n)
    @@
    type T;
    expression n;
    @@
    -(T *)g_new0(T, n)
    +g_new0(T, n)
    @@
    type T;
    expression p, n;
    @@
    -(T *)g_renew(T, p, n)
    +g_renew(T, p, n)

First dropped hunk:

    diff --git a/hw/9pfs/virtio-9p-synth.c b/hw/9pfs/virtio-9p-synth.c
    index fd888d6..96ef2b0 100644
    --- a/hw/9pfs/virtio-9p-synth.c
    +++ b/hw/9pfs/virtio-9p-synth.c
    @@ -497,7 +497,7 @@ static int v9fs_synth_name_to_path(FsContext *ctx, 
V9fsPath *dir_path,
         }
     out:
         /* Copy the node pointer to fid */
    -    target->data = g_new(void *, 1);
    +    target->data = g_malloc(sizeof(void *));
         memcpy(target->data, &node, sizeof(void *));
         target->size = sizeof(void *);
         return 0;

Here, the value of g_malloc() is assigned to a variable of type char *.
The value of g_new() would need a type cast, which in my opinion makes
the change pointless.

Second dropped hunk:

    diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
    index c030a20..6c6591e 100644
    --- a/target-ppc/translate_init.c
    +++ b/target-ppc/translate_init.c
    @@ -7573,7 +7573,7 @@ static int create_new_table (opc_handler_t **table, 
unsigned char idx)
     {
         opc_handler_t **tmp;

    -    tmp = g_malloc(0x20 * sizeof(opc_handler_t));
    +    tmp = g_new(opc_handler_t *, 0x20);
         fill_new_table(tmp, 0x20);
         table[idx] = (opc_handler_t *)((uintptr_t)tmp | PPC_INDIRECT);

Here, I suspect a bug, namely allocating opc_handler_t[0x20] instead
of opc_handler_t *[0x20].  But there's so much dirty hackery going on
around this array that I refuse to touch it.

Signed-off-by: Markus Armbruster <address@hidden>
---
 aio-posix.c                        |  2 +-
 aio-win32.c                        |  2 +-
 async.c                            |  2 +-
 backends/baum.c                    |  4 ++--
 backends/msmouse.c                 |  2 +-
 block-migration.c                  |  6 ++---
 block.c                            |  8 +++----
 block/gluster.c                    |  4 ++--
 block/iscsi.c                      |  2 +-
 block/qcow.c                       |  4 ++--
 block/qcow2-cluster.c              |  2 +-
 block/qcow2-refcount.c             |  8 +++----
 block/qcow2-snapshot.c             |  8 +++----
 block/raw-posix.c                  |  2 +-
 block/rbd.c                        |  4 ++--
 block/sheepdog.c                   |  4 ++--
 block/vdi.c                        |  2 +-
 block/vhdx.c                       |  4 ++--
 block/vmdk.c                       |  7 +++---
 block/vvfat.c                      |  2 +-
 blockdev-nbd.c                     |  2 +-
 blockdev.c                         |  2 +-
 bsd-user/syscall.c                 |  2 +-
 bt-host.c                          |  2 +-
 bt-vhci.c                          |  2 +-
 cpus.c                             | 14 ++++++------
 dump.c                             |  2 +-
 exec.c                             |  2 +-
 gdbstub.c                          |  4 ++--
 hw/9pfs/virtio-9p-handle.c         |  2 +-
 hw/9pfs/virtio-9p-proxy.c          |  2 +-
 hw/9pfs/virtio-9p-synth.c          |  4 ++--
 hw/9pfs/virtio-9p.c                |  6 ++---
 hw/arm/integratorcp.c              |  2 +-
 hw/arm/omap1.c                     | 30 +++++++++----------------
 hw/arm/omap2.c                     | 15 +++++--------
 hw/arm/pxa2xx.c                    | 14 +++++-------
 hw/arm/stellaris.c                 |  2 +-
 hw/arm/strongarm.c                 |  2 +-
 hw/audio/intel-hda.c               |  2 +-
 hw/bt/core.c                       |  4 ++--
 hw/bt/hci-csr.c                    |  3 +--
 hw/bt/hci.c                        |  4 ++--
 hw/bt/l2cap.c                      |  4 ++--
 hw/char/mcf_uart.c                 |  2 +-
 hw/char/omap_uart.c                |  3 +--
 hw/char/parallel.c                 |  2 +-
 hw/char/serial.c                   |  4 ++--
 hw/char/sh_serial.c                |  2 +-
 hw/char/virtio-serial-bus.c        |  6 ++---
 hw/core/irq.c                      |  2 +-
 hw/core/ptimer.c                   |  2 +-
 hw/display/blizzard.c              |  2 +-
 hw/display/omap_dss.c              |  3 +--
 hw/display/omap_lcdc.c             |  3 +--
 hw/display/pxa2xx_lcd.c            |  2 +-
 hw/display/qxl.c                   |  2 +-
 hw/display/sm501.c                 |  2 +-
 hw/display/tc6393xb.c              |  2 +-
 hw/display/xenfb.c                 |  4 ++--
 hw/dma/omap_dma.c                  |  6 ++---
 hw/dma/pxa2xx_dma.c                |  2 +-
 hw/dma/rc4030.c                    |  6 ++---
 hw/gpio/omap_gpio.c                |  4 ++--
 hw/i2c/bitbang_i2c.c               |  2 +-
 hw/i386/pc.c                       |  3 +--
 hw/ide/ahci.c                      |  2 +-
 hw/input/pckbd.c                   |  2 +-
 hw/input/ps2.c                     |  4 ++--
 hw/input/pxa2xx_keypad.c           |  2 +-
 hw/input/stellaris_input.c         |  4 ++--
 hw/input/tsc2005.c                 |  3 +--
 hw/input/tsc210x.c                 |  6 ++---
 hw/intc/heathrow_pic.c             |  2 +-
 hw/intc/i8259.c                    |  2 +-
 hw/intc/xics.c                     |  6 ++---
 hw/intc/xics_kvm.c                 |  4 ++--
 hw/lm32/lm32_boards.c              |  4 ++--
 hw/lm32/lm32_hwsetup.h             |  2 +-
 hw/lm32/milkymist.c                |  2 +-
 hw/m68k/mcf5206.c                  |  4 ++--
 hw/m68k/mcf5208.c                  |  2 +-
 hw/m68k/mcf_intc.c                 |  2 +-
 hw/mips/mips_malta.c               |  2 +-
 hw/mips/mips_mipssim.c             |  2 +-
 hw/mips/mips_r4k.c                 |  2 +-
 hw/misc/applesmc.c                 |  2 +-
 hw/misc/ivshmem.c                  |  8 +++----
 hw/misc/macio/mac_dbdma.c          |  2 +-
 hw/misc/omap_clk.c                 |  2 +-
 hw/misc/omap_gpmc.c                |  3 +--
 hw/misc/omap_sdrc.c                |  3 +--
 hw/misc/vfio.c                     |  4 ++--
 hw/net/dp8393x.c                   |  2 +-
 hw/net/mcf_fec.c                   |  2 +-
 hw/net/virtio-net.c                |  2 +-
 hw/ppc/e500.c                      |  4 ++--
 hw/ppc/mac_newworld.c              |  2 +-
 hw/ppc/mac_oldworld.c              |  2 +-
 hw/ppc/ppc.c                       |  8 +++----
 hw/ppc/ppc405_boards.c             |  4 ++--
 hw/ppc/ppc405_uc.c                 | 28 +++++++++++------------
 hw/ppc/ppc440_bamboo.c             |  2 +-
 hw/ppc/ppc4xx_devs.c               |  4 ++--
 hw/ppc/ppc_booke.c                 |  4 ++--
 hw/ppc/prep.c                      |  2 +-
 hw/ppc/virtex_ml507.c              |  2 +-
 hw/s390x/css.c                     |  4 ++--
 hw/s390x/event-facility.c          |  2 +-
 hw/s390x/s390-virtio.c             |  2 +-
 hw/s390x/virtio-ccw.c              |  2 +-
 hw/scsi/lsi53c895a.c               |  2 +-
 hw/scsi/virtio-scsi.c              |  2 +-
 hw/sd/omap_mmc.c                   |  6 ++---
 hw/sd/pxa2xx_mmci.c                |  2 +-
 hw/sd/sd.c                         |  2 +-
 hw/sh4/r2d.c                       |  4 ++--
 hw/sh4/sh7750.c                    |  2 +-
 hw/sparc/leon3.c                   |  2 +-
 hw/sparc64/sun4u.c                 |  4 ++--
 hw/ssi/omap_spi.c                  |  3 +--
 hw/timer/arm_timer.c               |  2 +-
 hw/timer/omap_gptimer.c            |  3 +--
 hw/timer/sh_timer.c                |  4 ++--
 hw/timer/slavio_timer.c            |  2 +-
 hw/usb/ccid-card-emulated.c        |  4 ++--
 hw/usb/hcd-xhci.c                  |  2 +-
 hw/usb/redirect.c                  |  6 ++---
 hw/virtio/virtio.c                 |  2 +-
 hw/xtensa/xtensa_lx60.c            |  2 +-
 include/qemu/timer.h               |  2 +-
 iohandler.c                        |  4 ++--
 kvm-all.c                          |  8 +++----
 libcacard/cac.c                    |  2 +-
 libcacard/card_7816.c              |  8 +++----
 libcacard/event.c                  |  2 +-
 libcacard/vcard.c                  |  6 ++---
 libcacard/vcard_emul_nss.c         | 12 +++++-----
 libcacard/vreader.c                |  7 +++---
 linux-user/elfload.c               |  2 +-
 linux-user/main.c                  |  2 +-
 linux-user/syscall.c               |  2 +-
 main-loop.c                        |  2 +-
 memory_mapping.c                   |  2 +-
 migration-rdma.c                   | 16 ++++++-------
 monitor.c                          |  4 ++--
 nbd.c                              |  4 ++--
 net/queue.c                        |  2 +-
 net/slirp.c                        |  2 +-
 qemu-char.c                        | 46 +++++++++++++++++++-------------------
 qemu-file.c                        | 10 ++++-----
 qemu-img.c                         |  2 +-
 qemu-io-cmds.c                     |  2 +-
 qemu-io.c                          |  2 +-
 qemu-timer.c                       |  2 +-
 qga/channel-posix.c                |  2 +-
 qga/channel-win32.c                |  2 +-
 qga/commands-posix.c               |  8 +++----
 qga/commands-win32.c               |  4 ++--
 qga/commands.c                     |  6 ++---
 qga/guest-agent-command-state.c    |  4 ++--
 qga/main.c                         |  2 +-
 qobject/json-parser.c              |  4 ++--
 savevm.c                           | 12 +++++-----
 slirp/slirp.c                      |  2 +-
 spice-qemu-char.c                  |  4 ++--
 target-i386/kvm.c                  |  2 +-
 tcg/tcg.c                          |  4 ++--
 tests/test-qmp-commands.c          | 16 ++++++-------
 tests/test-qmp-output-visitor.c    |  2 +-
 tests/test-visitor-serialization.c |  2 +-
 translate-all.c                    |  2 +-
 ui/console.c                       |  4 ++--
 ui/curses.c                        |  2 +-
 ui/input.c                         |  8 +++----
 ui/keymaps.c                       |  2 +-
 ui/sdl.c                           |  2 +-
 ui/vnc-jobs.c                      |  6 ++---
 ui/vnc.c                           |  4 ++--
 util/hbitmap.c                     |  4 ++--
 util/iov.c                         |  4 ++--
 util/qemu-option.c                 |  2 +-
 util/uri.c                         |  2 +-
 vl.c                               |  6 ++---
 xen-all.c                          |  8 +++----
 xen-mapcache.c                     | 14 ++++++------
 186 files changed, 375 insertions(+), 414 deletions(-)

diff --git a/aio-posix.c b/aio-posix.c
index f921d4f..a3592f9 100644
--- a/aio-posix.c
+++ b/aio-posix.c
@@ -73,7 +73,7 @@ void aio_set_fd_handler(AioContext *ctx,
     } else {
         if (node == NULL) {
             /* Alloc and insert if it's not already there */
-            node = g_malloc0(sizeof(AioHandler));
+            node = g_new0(AioHandler, 1);
             node->pfd.fd = fd;
             QLIST_INSERT_HEAD(&ctx->aio_handlers, node, node);
 
diff --git a/aio-win32.c b/aio-win32.c
index 23f4e5b..20ac18e 100644
--- a/aio-win32.c
+++ b/aio-win32.c
@@ -61,7 +61,7 @@ void aio_set_event_notifier(AioContext *ctx,
     } else {
         if (node == NULL) {
             /* Alloc and insert if it's not already there */
-            node = g_malloc0(sizeof(AioHandler));
+            node = g_new0(AioHandler, 1);
             node->e = e;
             node->pfd.fd = (uintptr_t)event_notifier_get_handle(e);
             node->pfd.events = G_IO_IN;
diff --git a/async.c b/async.c
index 5fb3fa6..6069757 100644
--- a/async.c
+++ b/async.c
@@ -43,7 +43,7 @@ struct QEMUBH {
 QEMUBH *aio_bh_new(AioContext *ctx, QEMUBHFunc *cb, void *opaque)
 {
     QEMUBH *bh;
-    bh = g_malloc0(sizeof(QEMUBH));
+    bh = g_new0(QEMUBH, 1);
     bh->ctx = ctx;
     bh->cb = cb;
     bh->opaque = opaque;
diff --git a/backends/baum.c b/backends/baum.c
index 1132899..ea8ce6a 100644
--- a/backends/baum.c
+++ b/backends/baum.c
@@ -571,8 +571,8 @@ CharDriverState *chr_baum_init(void)
 #endif
     int tty;
 
-    baum = g_malloc0(sizeof(BaumDriverState));
-    baum->chr = chr = g_malloc0(sizeof(CharDriverState));
+    baum = g_new0(BaumDriverState, 1);
+    baum->chr = chr = g_new0(CharDriverState, 1);
 
     chr->opaque = baum;
     chr->chr_write = baum_write;
diff --git a/backends/msmouse.c b/backends/msmouse.c
index c0dbfcd..7596e3b 100644
--- a/backends/msmouse.c
+++ b/backends/msmouse.c
@@ -67,7 +67,7 @@ CharDriverState *qemu_chr_open_msmouse(void)
 {
     CharDriverState *chr;
 
-    chr = g_malloc0(sizeof(CharDriverState));
+    chr = g_new0(CharDriverState, 1);
     chr->chr_write = msmouse_chr_write;
     chr->chr_close = msmouse_chr_close;
     chr->explicit_be_open = true;
diff --git a/block-migration.c b/block-migration.c
index 897fdba..f28e9c8 100644
--- a/block-migration.c
+++ b/block-migration.c
@@ -283,7 +283,7 @@ static int mig_save_device_bulk(QEMUFile *f, BlkMigDevState 
*bmds)
         nr_sectors = total_sectors - cur_sector;
     }
 
-    blk = g_malloc(sizeof(BlkMigBlock));
+    blk = g_new(BlkMigBlock, 1);
     blk->buf = g_malloc(BLOCK_SIZE);
     blk->bmds = bmds;
     blk->sector = cur_sector;
@@ -339,7 +339,7 @@ static void init_blk_migration_it(void *opaque, 
BlockDriverState *bs)
             return;
         }
 
-        bmds = g_malloc0(sizeof(BlkMigDevState));
+        bmds = g_new0(BlkMigDevState, 1);
         bmds->bs = bs;
         bmds->bulk_completed = 0;
         bmds->total_sectors = sectors;
@@ -449,7 +449,7 @@ static int mig_save_device_dirty(QEMUFile *f, 
BlkMigDevState *bmds,
             } else {
                 nr_sectors = BDRV_SECTORS_PER_DIRTY_CHUNK;
             }
-            blk = g_malloc(sizeof(BlkMigBlock));
+            blk = g_new(BlkMigBlock, 1);
             blk->buf = g_malloc(BLOCK_SIZE);
             blk->bmds = bmds;
             blk->sector = sector;
diff --git a/block.c b/block.c
index cb21a5f..ba06c31 100644
--- a/block.c
+++ b/block.c
@@ -336,7 +336,7 @@ BlockDriverState *bdrv_new(const char *device_name)
 {
     BlockDriverState *bs;
 
-    bs = g_malloc0(sizeof(BlockDriverState));
+    bs = g_new0(BlockDriverState, 1);
     QLIST_INIT(&bs->dirty_bitmaps);
     pstrcpy(bs->device_name, sizeof(bs->device_name), device_name);
     if (device_name[0] != '\0') {
@@ -5026,7 +5026,7 @@ BdrvDirtyBitmap 
*bdrv_create_dirty_bitmap(BlockDriverState *bs, int granularity)
     granularity >>= BDRV_SECTOR_BITS;
     assert(granularity);
     bitmap_size = (bdrv_getlength(bs) >> BDRV_SECTOR_BITS);
-    bitmap = g_malloc0(sizeof(BdrvDirtyBitmap));
+    bitmap = g_new0(BdrvDirtyBitmap, 1);
     bitmap->bitmap = hbitmap_alloc(bitmap_size, ffs(granularity) - 1);
     QLIST_INSERT_HEAD(&bs->dirty_bitmaps, bitmap, list);
     return bitmap;
@@ -5052,8 +5052,8 @@ BlockDirtyInfoList 
*bdrv_query_dirty_bitmaps(BlockDriverState *bs)
     BlockDirtyInfoList **plist = &list;
 
     QLIST_FOREACH(bm, &bs->dirty_bitmaps, list) {
-        BlockDirtyInfo *info = g_malloc0(sizeof(BlockDirtyInfo));
-        BlockDirtyInfoList *entry = g_malloc0(sizeof(BlockDirtyInfoList));
+        BlockDirtyInfo *info = g_new0(BlockDirtyInfo, 1);
+        BlockDirtyInfoList *entry = g_new0(BlockDirtyInfoList, 1);
         info->count = bdrv_get_dirty_count(bs, bm);
         info->granularity =
             ((int64_t) BDRV_SECTOR_SIZE << hbitmap_granularity(bm->bitmap));
diff --git a/block/gluster.c b/block/gluster.c
index a009b15..6598214 100644
--- a/block/gluster.c
+++ b/block/gluster.c
@@ -275,7 +275,7 @@ static int qemu_gluster_open(BlockDriverState *bs,  QDict 
*options,
     BDRVGlusterState *s = bs->opaque;
     int open_flags = O_BINARY;
     int ret = 0;
-    GlusterConf *gconf = g_malloc0(sizeof(GlusterConf));
+    GlusterConf *gconf = g_new0(GlusterConf, 1);
     QemuOpts *opts;
     Error *local_err = NULL;
     const char *filename;
@@ -387,7 +387,7 @@ static int qemu_gluster_create(const char *filename,
     int ret = 0;
     int prealloc = 0;
     int64_t total_size = 0;
-    GlusterConf *gconf = g_malloc0(sizeof(GlusterConf));
+    GlusterConf *gconf = g_new0(GlusterConf, 1);
 
     glfs = qemu_gluster_init(gconf, filename);
     if (!glfs) {
diff --git a/block/iscsi.c b/block/iscsi.c
index 6f4af72..646834c 100644
--- a/block/iscsi.c
+++ b/block/iscsi.c
@@ -1384,7 +1384,7 @@ static int iscsi_create(const char *filename, 
QEMUOptionParameter *options,
         options++;
     }
 
-    bs->opaque = g_malloc0(sizeof(struct IscsiLun));
+    bs->opaque = g_new0(struct IscsiLun, 1);
     iscsilun = bs->opaque;
 
     bs_options = qdict_new();
diff --git a/block/qcow.c b/block/qcow.c
index 948b0c5..d7c4c96 100644
--- a/block/qcow.c
+++ b/block/qcow.c
@@ -150,7 +150,7 @@ static int qcow_open(BlockDriverState *bs, QDict *options, 
int flags,
     s->l1_size = (header.size + (1LL << shift) - 1) >> shift;
 
     s->l1_table_offset = header.l1_table_offset;
-    s->l1_table = g_malloc(s->l1_size * sizeof(uint64_t));
+    s->l1_table = g_new(uint64_t, s->l1_size);
 
     ret = bdrv_pread(bs->file, s->l1_table_offset, s->l1_table,
                s->l1_size * sizeof(uint64_t));
@@ -162,7 +162,7 @@ static int qcow_open(BlockDriverState *bs, QDict *options, 
int flags,
         be64_to_cpus(&s->l1_table[i]);
     }
     /* alloc L2 cache */
-    s->l2_cache = g_malloc(s->l2_size * L2_CACHE_SIZE * sizeof(uint64_t));
+    s->l2_cache = g_new(uint64_t, s->l2_size * L2_CACHE_SIZE);
     s->cluster_cache = g_malloc(s->cluster_size);
     s->cluster_data = g_malloc(s->cluster_size);
     s->cluster_cache_offset = -1;
diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
index 8534084..f16d2c8 100644
--- a/block/qcow2-cluster.c
+++ b/block/qcow2-cluster.c
@@ -698,7 +698,7 @@ int qcow2_alloc_cluster_link_l2(BlockDriverState *bs, 
QCowL2Meta *m)
     trace_qcow2_cluster_link_l2(qemu_coroutine_self(), m->nb_clusters);
     assert(m->nb_clusters > 0);
 
-    old_cluster = g_malloc(m->nb_clusters * sizeof(uint64_t));
+    old_cluster = g_new(uint64_t, m->nb_clusters);
 
     /* copy content of unmodified sectors */
     ret = perform_cow(bs, m, &m->cow_start);
diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c
index c974abe..d0ff0e5 100644
--- a/block/qcow2-refcount.c
+++ b/block/qcow2-refcount.c
@@ -334,7 +334,7 @@ static int alloc_refcount_block(BlockDriverState *bs,
         s->cluster_size;
     uint64_t table_offset = meta_offset + blocks_clusters * s->cluster_size;
     uint16_t *new_blocks = g_malloc0(blocks_clusters * s->cluster_size);
-    uint64_t *new_table = g_malloc0(table_size * sizeof(uint64_t));
+    uint64_t *new_table = g_new0(uint64_t, table_size);
 
     assert(meta_offset >= (s->free_cluster_index * s->cluster_size));
 
@@ -1468,7 +1468,7 @@ int qcow2_check_refcounts(BlockDriverState *bs, 
BdrvCheckResult *res,
 
     size = bdrv_getlength(bs->file);
     nb_clusters = size_to_clusters(s, size);
-    refcount_table = g_malloc0(nb_clusters * sizeof(uint16_t));
+    refcount_table = g_new0(uint16_t, nb_clusters);
 
     res->bfi.total_clusters =
         size_to_clusters(s, bs->total_sectors * BDRV_SECTOR_SIZE);
@@ -1545,8 +1545,8 @@ int qcow2_check_refcounts(BlockDriverState *bs, 
BdrvCheckResult *res,
                         /* increase refcount_table size if necessary */
                         int old_nb_clusters = nb_clusters;
                         nb_clusters = (new_offset >> s->cluster_bits) + 1;
-                        refcount_table = g_realloc(refcount_table,
-                                nb_clusters * sizeof(uint16_t));
+                        refcount_table = g_renew(uint16_t, refcount_table,
+                                                 nb_clusters);
                         memset(&refcount_table[old_nb_clusters], 0, 
(nb_clusters
                                 - old_nb_clusters) * sizeof(uint16_t));
                     }
diff --git a/block/qcow2-snapshot.c b/block/qcow2-snapshot.c
index ad8bf3d..0d19818 100644
--- a/block/qcow2-snapshot.c
+++ b/block/qcow2-snapshot.c
@@ -83,7 +83,7 @@ int qcow2_read_snapshots(BlockDriverState *bs)
     }
 
     offset = s->snapshots_offset;
-    s->snapshots = g_malloc0(s->nb_snapshots * sizeof(QCowSnapshot));
+    s->snapshots = g_new0(QCowSnapshot, s->nb_snapshots);
 
     for(i = 0; i < s->nb_snapshots; i++) {
         /* Read statically sized part of the snapshot header */
@@ -389,7 +389,7 @@ int qcow2_snapshot_create(BlockDriverState *bs, 
QEMUSnapshotInfo *sn_info)
     sn->l1_table_offset = l1_table_offset;
     sn->l1_size = s->l1_size;
 
-    l1_table = g_malloc(s->l1_size * sizeof(uint64_t));
+    l1_table = g_new(uint64_t, s->l1_size);
     for(i = 0; i < s->l1_size; i++) {
         l1_table[i] = cpu_to_be64(s->l1_table[i]);
     }
@@ -420,7 +420,7 @@ int qcow2_snapshot_create(BlockDriverState *bs, 
QEMUSnapshotInfo *sn_info)
     }
 
     /* Append the new snapshot to the snapshot list */
-    new_snapshot_list = g_malloc((s->nb_snapshots + 1) * sizeof(QCowSnapshot));
+    new_snapshot_list = g_new(QCowSnapshot, s->nb_snapshots + 1);
     if (s->snapshots) {
         memcpy(new_snapshot_list, s->snapshots,
                s->nb_snapshots * sizeof(QCowSnapshot));
@@ -658,7 +658,7 @@ int qcow2_snapshot_list(BlockDriverState *bs, 
QEMUSnapshotInfo **psn_tab)
         return s->nb_snapshots;
     }
 
-    sn_tab = g_malloc0(s->nb_snapshots * sizeof(QEMUSnapshotInfo));
+    sn_tab = g_new0(QEMUSnapshotInfo, s->nb_snapshots);
     for(i = 0; i < s->nb_snapshots; i++) {
         sn_info = sn_tab + i;
         sn = s->snapshots + i;
diff --git a/block/raw-posix.c b/block/raw-posix.c
index 126a634..ba52387 100644
--- a/block/raw-posix.c
+++ b/block/raw-posix.c
@@ -466,7 +466,7 @@ static int raw_reopen_prepare(BDRVReopenState *state,
 
     s = state->bs->opaque;
 
-    state->opaque = g_malloc0(sizeof(BDRVRawReopenState));
+    state->opaque = g_new0(BDRVRawReopenState, 1);
     raw_s = state->opaque;
 
 #ifdef CONFIG_LINUX_AIO
diff --git a/block/rbd.c b/block/rbd.c
index 121fae2..2569f5c 100644
--- a/block/rbd.c
+++ b/block/rbd.c
@@ -648,7 +648,7 @@ static BlockDriverAIOCB *rbd_start_aio(BlockDriverState *bs,
     off = sector_num * BDRV_SECTOR_SIZE;
     size = nb_sectors * BDRV_SECTOR_SIZE;
 
-    rcb = g_malloc(sizeof(RADOSCB));
+    rcb = g_new(RADOSCB, 1);
     rcb->done = 0;
     rcb->acb = acb;
     rcb->buf = buf;
@@ -866,7 +866,7 @@ static int qemu_rbd_snap_list(BlockDriverState *bs,
         goto done;
     }
 
-    sn_tab = g_malloc0(snap_count * sizeof(QEMUSnapshotInfo));
+    sn_tab = g_new0(QEMUSnapshotInfo, snap_count);
 
     for (i = 0; i < snap_count; i++) {
         const char *snap_name = snaps[i].name;
diff --git a/block/sheepdog.c b/block/sheepdog.c
index 672b9c9..a1b2fdd 100644
--- a/block/sheepdog.c
+++ b/block/sheepdog.c
@@ -1637,7 +1637,7 @@ static int sd_create(const char *filename, 
QEMUOptionParameter *options,
     bool prealloc = false;
     Error *local_err = NULL;
 
-    s = g_malloc0(sizeof(BDRVSheepdogState));
+    s = g_new0(BDRVSheepdogState, 1);
 
     memset(tag, 0, sizeof(tag));
     if (strstr(filename, "://")) {
@@ -2201,7 +2201,7 @@ static int sd_snapshot_goto(BlockDriverState *bs, const 
char *snapshot_id)
     uint32_t snapid = 0;
     int ret = 0;
 
-    old_s = g_malloc(sizeof(BDRVSheepdogState));
+    old_s = g_new(BDRVSheepdogState, 1);
 
     memcpy(old_s, s, sizeof(BDRVSheepdogState));
 
diff --git a/block/vdi.c b/block/vdi.c
index 2d7490f..bcf9c14 100644
--- a/block/vdi.c
+++ b/block/vdi.c
@@ -288,7 +288,7 @@ static int vdi_check(BlockDriverState *bs, BdrvCheckResult 
*res,
         return -ENOTSUP;
     }
 
-    bmap = g_malloc(s->header.blocks_in_image * sizeof(uint32_t));
+    bmap = g_new(uint32_t, s->header.blocks_in_image);
     memset(bmap, 0xff, s->header.blocks_in_image * sizeof(uint32_t));
 
     /* Check block map and value of blocks_allocated. */
diff --git a/block/vhdx.c b/block/vhdx.c
index 9ee0a61..5189868 100644
--- a/block/vhdx.c
+++ b/block/vhdx.c
@@ -1357,7 +1357,7 @@ static int vhdx_create_new_headers(BlockDriverState *bs, 
uint64_t image_size,
     int ret = 0;
     VHDXHeader *hdr = NULL;
 
-    hdr = g_malloc0(sizeof(VHDXHeader));
+    hdr = g_new0(VHDXHeader, 1);
 
     hdr->signature       = VHDX_HEADER_SIGNATURE;
     hdr->sequence_number = g_random_int();
@@ -1623,7 +1623,7 @@ static int vhdx_create_new_region_table(BlockDriverState 
*bs,
 
     /* Populate enough of the BDRVVHDXState to be able to use the
      * pre-existing BAT calculation, translation, and update functions */
-    s = g_malloc0(sizeof(BDRVVHDXState));
+    s = g_new0(BDRVVHDXState, 1);
 
     s->chunk_ratio = (VHDX_MAX_SECTORS_PER_BLOCK) *
                      (uint64_t) sector_size / (uint64_t) block_size;
diff --git a/block/vmdk.c b/block/vmdk.c
index 99ca60f..f01a8ed 100644
--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -233,7 +233,7 @@ static void vmdk_free_last_extent(BlockDriverState *bs)
         return;
     }
     s->num_extents--;
-    s->extents = g_realloc(s->extents, s->num_extents * sizeof(VmdkExtent));
+    s->extents = g_renew(VmdkExtent, s->extents, s->num_extents);
 }
 
 static uint32_t vmdk_read_cid(BlockDriverState *bs, int parent)
@@ -412,8 +412,7 @@ static int vmdk_add_extent(BlockDriverState *bs,
         return -EFBIG;
     }
 
-    s->extents = g_realloc(s->extents,
-                              (s->num_extents + 1) * sizeof(VmdkExtent));
+    s->extents = g_renew(VmdkExtent, s->extents, s->num_extents + 1);
     extent = &s->extents[s->num_extents];
     s->num_extents++;
 
@@ -481,7 +480,7 @@ static int vmdk_init_tables(BlockDriverState *bs, 
VmdkExtent *extent,
     }
 
     extent->l2_cache =
-        g_malloc(extent->l2_size * L2_CACHE_SIZE * sizeof(uint32_t));
+        g_new(uint32_t, extent->l2_size * L2_CACHE_SIZE);
     return 0;
  fail_l1b:
     g_free(extent->l1_backup_table);
diff --git a/block/vvfat.c b/block/vvfat.c
index 664941c..71068eb 100644
--- a/block/vvfat.c
+++ b/block/vvfat.c
@@ -2954,7 +2954,7 @@ static int enable_write_target(BDRVVVFATState *s)
 
     s->bs->backing_hd = bdrv_new("");
     s->bs->backing_hd->drv = &vvfat_write_target;
-    s->bs->backing_hd->opaque = g_malloc(sizeof(void*));
+    s->bs->backing_hd->opaque = g_new(void *, 1);
     *(void**)s->bs->backing_hd->opaque = s;
 
     return 0;
diff --git a/blockdev-nbd.c b/blockdev-nbd.c
index 922cf56..f8c43d2 100644
--- a/blockdev-nbd.c
+++ b/blockdev-nbd.c
@@ -103,7 +103,7 @@ void qmp_nbd_server_add(const char *device, bool 
has_writable, bool writable,
 
     nbd_export_set_name(exp, device);
 
-    n = g_malloc0(sizeof(NBDCloseNotifier));
+    n = g_new0(NBDCloseNotifier, 1);
     n->n.notify = nbd_close_notifier;
     n->exp = exp;
     bdrv_add_close_notifier(bs, &n->n);
diff --git a/blockdev.c b/blockdev.c
index 36ceece..525a1fc 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -1035,7 +1035,7 @@ SnapshotInfo 
*qmp_blockdev_snapshot_delete_internal_sync(const char *device,
         return NULL;
     }
 
-    info = g_malloc0(sizeof(SnapshotInfo));
+    info = g_new0(SnapshotInfo, 1);
     info->id = g_strdup(sn.id_str);
     info->name = g_strdup(sn.name);
     info->date_nsec = sn.date_nsec;
diff --git a/bsd-user/syscall.c b/bsd-user/syscall.c
index a4d1583..c1f3529 100644
--- a/bsd-user/syscall.c
+++ b/bsd-user/syscall.c
@@ -236,7 +236,7 @@ static abi_long do_freebsd_sysctl(abi_ulong namep, int32_t 
namelen, abi_ulong ol
     void *hnamep, *holdp, *hnewp = NULL;
     size_t holdlen;
     abi_ulong oldlen = 0;
-    int32_t *snamep = g_malloc(sizeof(int32_t) * namelen), *p, *q, i;
+    int32_t *snamep = g_new(int32_t, namelen), *p, *q, i;
     uint32_t kind = 0;
 
     if (oldlenp)
diff --git a/bt-host.c b/bt-host.c
index 49205bf..86f6dd1 100644
--- a/bt-host.c
+++ b/bt-host.c
@@ -177,7 +177,7 @@ struct HCIInfo *bt_host_hci(const char *id)
     }
 # endif
 
-    s = g_malloc0(sizeof(struct bt_host_hci_s));
+    s = g_new0(struct bt_host_hci_s, 1);
     s->fd = fd;
     s->hci.cmd_send = bt_host_cmd;
     s->hci.sco_send = bt_host_sco;
diff --git a/bt-vhci.c b/bt-vhci.c
index e267c8a..f4e1de3 100644
--- a/bt-vhci.c
+++ b/bt-vhci.c
@@ -156,7 +156,7 @@ void bt_vhci_init(struct HCIInfo *info)
         exit(-1);
     }
 
-    s = g_malloc0(sizeof(struct bt_vhci_s));
+    s = g_new0(struct bt_vhci_s, 1);
     s->fd = fd;
     s->info = info ?: qemu_next_hci();
     s->info->opaque = s;
diff --git a/cpus.c b/cpus.c
index ca4c59f..c54e290 100644
--- a/cpus.c
+++ b/cpus.c
@@ -770,7 +770,7 @@ void async_run_on_cpu(CPUState *cpu, void (*func)(void 
*data), void *data)
         return;
     }
 
-    wi = g_malloc0(sizeof(struct qemu_work_item));
+    wi = g_new0(struct qemu_work_item, 1);
     wi->func = func;
     wi->data = data;
     wi->free = true;
@@ -1121,8 +1121,8 @@ static void qemu_tcg_init_vcpu(CPUState *cpu)
 {
     /* share a single thread for all cpus with TCG */
     if (!tcg_cpu_thread) {
-        cpu->thread = g_malloc0(sizeof(QemuThread));
-        cpu->halt_cond = g_malloc0(sizeof(QemuCond));
+        cpu->thread = g_new0(QemuThread, 1);
+        cpu->halt_cond = g_new0(QemuCond, 1);
         qemu_cond_init(cpu->halt_cond);
         tcg_halt_cond = cpu->halt_cond;
         qemu_thread_create(cpu->thread, qemu_tcg_cpu_thread_fn, cpu,
@@ -1142,8 +1142,8 @@ static void qemu_tcg_init_vcpu(CPUState *cpu)
 
 static void qemu_kvm_start_vcpu(CPUState *cpu)
 {
-    cpu->thread = g_malloc0(sizeof(QemuThread));
-    cpu->halt_cond = g_malloc0(sizeof(QemuCond));
+    cpu->thread = g_new0(QemuThread, 1);
+    cpu->halt_cond = g_new0(QemuCond, 1);
     qemu_cond_init(cpu->halt_cond);
     qemu_thread_create(cpu->thread, qemu_kvm_cpu_thread_fn, cpu,
                        QEMU_THREAD_JOINABLE);
@@ -1154,8 +1154,8 @@ static void qemu_kvm_start_vcpu(CPUState *cpu)
 
 static void qemu_dummy_start_vcpu(CPUState *cpu)
 {
-    cpu->thread = g_malloc0(sizeof(QemuThread));
-    cpu->halt_cond = g_malloc0(sizeof(QemuCond));
+    cpu->thread = g_new0(QemuThread, 1);
+    cpu->halt_cond = g_new0(QemuCond, 1);
     qemu_cond_init(cpu->halt_cond);
     qemu_thread_create(cpu->thread, qemu_dummy_cpu_thread_fn, cpu,
                        QEMU_THREAD_JOINABLE);
diff --git a/dump.c b/dump.c
index 80a9116..c40c3ea 100644
--- a/dump.c
+++ b/dump.c
@@ -880,7 +880,7 @@ void qmp_dump_guest_memory(bool paging, const char *file, 
bool has_begin,
         return;
     }
 
-    s = g_malloc0(sizeof(DumpState));
+    s = g_new0(DumpState, 1);
 
     ret = dump_init(s, fd, paging, has_begin, begin, length, errp);
     if (ret < 0) {
diff --git a/exec.c b/exec.c
index 2435d9e..b417de3 100644
--- a/exec.c
+++ b/exec.c
@@ -1700,7 +1700,7 @@ static subpage_t *subpage_init(AddressSpace *as, hwaddr 
base)
 {
     subpage_t *mmio;
 
-    mmio = g_malloc0(sizeof(subpage_t));
+    mmio = g_new0(subpage_t, 1);
 
     mmio->as = as;
     mmio->base = base;
diff --git a/gdbstub.c b/gdbstub.c
index e8ab0b2..f60474f 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -1536,7 +1536,7 @@ static void gdb_accept(void)
     /* set short latency */
     socket_set_nodelay(fd);
 
-    s = g_malloc0(sizeof(GDBState));
+    s = g_new0(GDBState, 1);
     s->c_cpu = first_cpu;
     s->g_cpu = first_cpu;
     s->fd = fd;
@@ -1705,7 +1705,7 @@ int gdbserver_start(const char *device)
 
     s = gdbserver_state;
     if (!s) {
-        s = g_malloc0(sizeof(GDBState));
+        s = g_new0(GDBState, 1);
         gdbserver_state = s;
 
         qemu_add_vm_change_state_handler(gdb_vm_state_change, NULL);
diff --git a/hw/9pfs/virtio-9p-handle.c b/hw/9pfs/virtio-9p-handle.c
index fe8e0ed..d7852e7 100644
--- a/hw/9pfs/virtio-9p-handle.c
+++ b/hw/9pfs/virtio-9p-handle.c
@@ -606,7 +606,7 @@ static int handle_init(FsContext *ctx)
     int ret, mnt_id;
     struct statfs stbuf;
     struct file_handle fh;
-    struct handle_data *data = g_malloc(sizeof(struct handle_data));
+    struct handle_data *data = g_new(struct handle_data, 1);
 
     data->mountfd = open(ctx->fs_root, O_DIRECTORY);
     if (data->mountfd < 0) {
diff --git a/hw/9pfs/virtio-9p-proxy.c b/hw/9pfs/virtio-9p-proxy.c
index 5f44bb7..29c6d0b 100644
--- a/hw/9pfs/virtio-9p-proxy.c
+++ b/hw/9pfs/virtio-9p-proxy.c
@@ -1144,7 +1144,7 @@ static int proxy_parse_opts(QemuOpts *opts, struct 
FsDriverEntry *fs)
 
 static int proxy_init(FsContext *ctx)
 {
-    V9fsProxy *proxy = g_malloc(sizeof(V9fsProxy));
+    V9fsProxy *proxy = g_new(V9fsProxy, 1);
     int sock_id;
 
     if (ctx->export_flags & V9FS_PROXY_SOCK_NAME) {
diff --git a/hw/9pfs/virtio-9p-synth.c b/hw/9pfs/virtio-9p-synth.c
index 840e4eb..96ef2b0 100644
--- a/hw/9pfs/virtio-9p-synth.c
+++ b/hw/9pfs/virtio-9p-synth.c
@@ -43,7 +43,7 @@ static V9fsSynthNode *v9fs_add_dir_node(V9fsSynthNode 
*parent, int mode,
 
     /* Add directory type and remove write bits */
     mode = ((mode & 0777) | S_IFDIR) & ~(S_IWUSR | S_IWGRP | S_IWOTH);
-    node = g_malloc0(sizeof(V9fsSynthNode));
+    node = g_new0(V9fsSynthNode, 1);
     if (attr) {
         /* We are adding .. or . entries */
         node->attr = attr;
@@ -124,7 +124,7 @@ int qemu_v9fs_synth_add_file(V9fsSynthNode *parent, int 
mode,
     }
     /* Add file type and remove write bits */
     mode = ((mode & 0777) | S_IFREG);
-    node = g_malloc0(sizeof(V9fsSynthNode));
+    node = g_new0(V9fsSynthNode, 1);
     node->attr         = &node->actual_attr;
     node->attr->inode  = v9fs_synth_node_count++;
     node->attr->nlink  = 1;
diff --git a/hw/9pfs/virtio-9p.c b/hw/9pfs/virtio-9p.c
index 8cbb8ae..b2d42bb 100644
--- a/hw/9pfs/virtio-9p.c
+++ b/hw/9pfs/virtio-9p.c
@@ -256,7 +256,7 @@ static V9fsFidState *alloc_fid(V9fsState *s, int32_t fid)
             return NULL;
         }
     }
-    f = g_malloc0(sizeof(V9fsFidState));
+    f = g_new0(V9fsFidState, 1);
     f->fid = fid;
     f->fid_type = P9_FID_NONE;
     f->ref = 1;
@@ -1595,7 +1595,7 @@ static int v9fs_do_readdir_with_stat(V9fsPDU *pdu,
         return saved_dir_pos;
     }
 
-    dent = g_malloc(sizeof(struct dirent));
+    dent = g_new(struct dirent, 1);
 
     while (1) {
         v9fs_path_init(&path);
@@ -1781,7 +1781,7 @@ static int v9fs_do_readdir(V9fsPDU *pdu,
         return saved_dir_pos;
     }
 
-    dent = g_malloc(sizeof(struct dirent));
+    dent = g_new(struct dirent, 1);
 
     while (1) {
         err = v9fs_co_readdir_r(pdu, fidp, dent, &result);
diff --git a/hw/arm/integratorcp.c b/hw/arm/integratorcp.c
index a759689..8bd30b9 100644
--- a/hw/arm/integratorcp.c
+++ b/hw/arm/integratorcp.c
@@ -446,7 +446,7 @@ static void icp_control_init(hwaddr base)
 {
     MemoryRegion *io;
 
-    io = (MemoryRegion *)g_malloc0(sizeof(MemoryRegion));
+    io = g_new0(MemoryRegion, 1);
     memory_region_init_io(io, NULL, &icp_control_ops, NULL,
                           "control", 0x00800000);
     memory_region_add_subregion(get_system_memory(), base, io);
diff --git a/hw/arm/omap1.c b/hw/arm/omap1.c
index 47511d2..a6e24cc 100644
--- a/hw/arm/omap1.c
+++ b/hw/arm/omap1.c
@@ -254,8 +254,7 @@ static struct omap_mpu_timer_s 
*omap_mpu_timer_init(MemoryRegion *system_memory,
                 hwaddr base,
                 qemu_irq irq, omap_clk clk)
 {
-    struct omap_mpu_timer_s *s = (struct omap_mpu_timer_s *)
-            g_malloc0(sizeof(struct omap_mpu_timer_s));
+    struct omap_mpu_timer_s *s = g_new0(struct omap_mpu_timer_s, 1);
 
     s->irq = irq;
     s->clk = clk;
@@ -383,8 +382,7 @@ static struct omap_watchdog_timer_s 
*omap_wd_timer_init(MemoryRegion *memory,
                 hwaddr base,
                 qemu_irq irq, omap_clk clk)
 {
-    struct omap_watchdog_timer_s *s = (struct omap_watchdog_timer_s *)
-            g_malloc0(sizeof(struct omap_watchdog_timer_s));
+    struct omap_watchdog_timer_s *s = g_new0(struct omap_watchdog_timer_s, 1);
 
     s->timer.irq = irq;
     s->timer.clk = clk;
@@ -489,8 +487,7 @@ static struct omap_32khz_timer_s 
*omap_os_timer_init(MemoryRegion *memory,
                 hwaddr base,
                 qemu_irq irq, omap_clk clk)
 {
-    struct omap_32khz_timer_s *s = (struct omap_32khz_timer_s *)
-            g_malloc0(sizeof(struct omap_32khz_timer_s));
+    struct omap_32khz_timer_s *s = g_new0(struct omap_32khz_timer_s, 1);
 
     s->timer.irq = irq;
     s->timer.clk = clk;
@@ -1221,8 +1218,7 @@ static struct omap_tipb_bridge_s *omap_tipb_bridge_init(
     MemoryRegion *memory, hwaddr base,
     qemu_irq abort_irq, omap_clk clk)
 {
-    struct omap_tipb_bridge_s *s = (struct omap_tipb_bridge_s *)
-            g_malloc0(sizeof(struct omap_tipb_bridge_s));
+    struct omap_tipb_bridge_s *s = g_new0(struct omap_tipb_bridge_s, 1);
 
     s->abort = abort_irq;
     omap_tipb_bridge_reset(s);
@@ -2081,8 +2077,7 @@ static struct omap_mpuio_s *omap_mpuio_init(MemoryRegion 
*memory,
                 qemu_irq kbd_int, qemu_irq gpio_int, qemu_irq wakeup,
                 omap_clk clk)
 {
-    struct omap_mpuio_s *s = (struct omap_mpuio_s *)
-            g_malloc0(sizeof(struct omap_mpuio_s));
+    struct omap_mpuio_s *s = g_new0(struct omap_mpuio_s, 1);
 
     s->irq = gpio_int;
     s->kbd_irq = kbd_int;
@@ -2273,8 +2268,7 @@ static struct omap_uwire_s *omap_uwire_init(MemoryRegion 
*system_memory,
                                             qemu_irq dma,
                                             omap_clk clk)
 {
-    struct omap_uwire_s *s = (struct omap_uwire_s *)
-            g_malloc0(sizeof(struct omap_uwire_s));
+    struct omap_uwire_s *s = g_new0(struct omap_uwire_s, 1);
 
     s->txirq = txirq;
     s->rxirq = rxirq;
@@ -2910,8 +2904,7 @@ static struct omap_rtc_s *omap_rtc_init(MemoryRegion 
*system_memory,
                                         qemu_irq timerirq, qemu_irq alarmirq,
                                         omap_clk clk)
 {
-    struct omap_rtc_s *s = (struct omap_rtc_s *)
-            g_malloc0(sizeof(struct omap_rtc_s));
+    struct omap_rtc_s *s = g_new0(struct omap_rtc_s, 1);
 
     s->irq = timerirq;
     s->alarm = alarmirq;
@@ -3441,8 +3434,7 @@ static struct omap_mcbsp_s *omap_mcbsp_init(MemoryRegion 
*system_memory,
                                             qemu_irq txirq, qemu_irq rxirq,
                                             qemu_irq *dma, omap_clk clk)
 {
-    struct omap_mcbsp_s *s = (struct omap_mcbsp_s *)
-            g_malloc0(sizeof(struct omap_mcbsp_s));
+    struct omap_mcbsp_s *s = g_new0(struct omap_mcbsp_s, 1);
 
     s->txirq = txirq;
     s->rxirq = rxirq;
@@ -3620,8 +3612,7 @@ static void omap_lpg_clk_update(void *opaque, int line, 
int on)
 static struct omap_lpg_s *omap_lpg_init(MemoryRegion *system_memory,
                                         hwaddr base, omap_clk clk)
 {
-    struct omap_lpg_s *s = (struct omap_lpg_s *)
-            g_malloc0(sizeof(struct omap_lpg_s));
+    struct omap_lpg_s *s = g_new0(struct omap_lpg_s, 1);
 
     s->tm = timer_new_ms(QEMU_CLOCK_VIRTUAL, omap_lpg_tick, s);
 
@@ -3825,8 +3816,7 @@ struct omap_mpu_state_s *omap310_mpu_init(MemoryRegion 
*system_memory,
                 const char *core)
 {
     int i;
-    struct omap_mpu_state_s *s = (struct omap_mpu_state_s *)
-            g_malloc0(sizeof(struct omap_mpu_state_s));
+    struct omap_mpu_state_s *s = g_new0(struct omap_mpu_state_s, 1);
     qemu_irq dma_irqs[6];
     DriveInfo *dinfo;
     SysBusDevice *busdev;
diff --git a/hw/arm/omap2.c b/hw/arm/omap2.c
index 36efde0..0019404 100644
--- a/hw/arm/omap2.c
+++ b/hw/arm/omap2.c
@@ -593,8 +593,7 @@ static const MemoryRegionOps omap_eac_ops = {
 static struct omap_eac_s *omap_eac_init(struct omap_target_agent_s *ta,
                 qemu_irq irq, qemu_irq *drq, omap_clk fclk, omap_clk iclk)
 {
-    struct omap_eac_s *s = (struct omap_eac_s *)
-            g_malloc0(sizeof(struct omap_eac_s));
+    struct omap_eac_s *s = g_new0(struct omap_eac_s, 1);
 
     s->irq = irq;
     s->codec.rxdrq = *drq ++;
@@ -783,8 +782,7 @@ static struct omap_sti_s *omap_sti_init(struct 
omap_target_agent_s *ta,
                 hwaddr channel_base, qemu_irq irq, omap_clk clk,
                 CharDriverState *chr)
 {
-    struct omap_sti_s *s = (struct omap_sti_s *)
-            g_malloc0(sizeof(struct omap_sti_s));
+    struct omap_sti_s *s = g_new0(struct omap_sti_s, 1);
 
     s->irq = irq;
     omap_sti_reset(s);
@@ -1800,8 +1798,7 @@ static struct omap_prcm_s *omap_prcm_init(struct 
omap_target_agent_s *ta,
                 qemu_irq mpu_int, qemu_irq dsp_int, qemu_irq iva_int,
                 struct omap_mpu_state_s *mpu)
 {
-    struct omap_prcm_s *s = (struct omap_prcm_s *)
-            g_malloc0(sizeof(struct omap_prcm_s));
+    struct omap_prcm_s *s = g_new0(struct omap_prcm_s, 1);
 
     s->irq[0] = mpu_int;
     s->irq[1] = dsp_int;
@@ -2179,8 +2176,7 @@ static void omap_sysctl_reset(struct omap_sysctl_s *s)
 static struct omap_sysctl_s *omap_sysctl_init(struct omap_target_agent_s *ta,
                 omap_clk iclk, struct omap_mpu_state_s *mpu)
 {
-    struct omap_sysctl_s *s = (struct omap_sysctl_s *)
-            g_malloc0(sizeof(struct omap_sysctl_s));
+    struct omap_sysctl_s *s = g_new0(struct omap_sysctl_s, 1);
 
     s->mpu = mpu;
     omap_sysctl_reset(s);
@@ -2242,8 +2238,7 @@ struct omap_mpu_state_s *omap2420_mpu_init(MemoryRegion 
*sysmem,
                 unsigned long sdram_size,
                 const char *core)
 {
-    struct omap_mpu_state_s *s = (struct omap_mpu_state_s *)
-            g_malloc0(sizeof(struct omap_mpu_state_s));
+    struct omap_mpu_state_s *s = g_new0(struct omap_mpu_state_s, 1);
     qemu_irq dma_irqs[4];
     DriveInfo *dinfo;
     int i;
diff --git a/hw/arm/pxa2xx.c b/hw/arm/pxa2xx.c
index 02b7016..fc337d1 100644
--- a/hw/arm/pxa2xx.c
+++ b/hw/arm/pxa2xx.c
@@ -1739,8 +1739,7 @@ static PXA2xxI2SState *pxa2xx_i2s_init(MemoryRegion 
*sysmem,
                 hwaddr base,
                 qemu_irq irq, qemu_irq rx_dma, qemu_irq tx_dma)
 {
-    PXA2xxI2SState *s = (PXA2xxI2SState *)
-            g_malloc0(sizeof(PXA2xxI2SState));
+    PXA2xxI2SState *s = g_new0(PXA2xxI2SState, 1);
 
     s->irq = irq;
     s->rx_dma = rx_dma;
@@ -1997,8 +1996,7 @@ static PXA2xxFIrState *pxa2xx_fir_init(MemoryRegion 
*sysmem,
                 qemu_irq irq, qemu_irq rx_dma, qemu_irq tx_dma,
                 CharDriverState *chr)
 {
-    PXA2xxFIrState *s = (PXA2xxFIrState *)
-            g_malloc0(sizeof(PXA2xxFIrState));
+    PXA2xxFIrState *s = g_new0(PXA2xxFIrState, 1);
 
     s->irq = irq;
     s->rx_dma = rx_dma;
@@ -2039,7 +2037,7 @@ PXA2xxState *pxa270_init(MemoryRegion *address_space,
     PXA2xxState *s;
     int i;
     DriveInfo *dinfo;
-    s = (PXA2xxState *) g_malloc0(sizeof(PXA2xxState));
+    s = g_new0(PXA2xxState, 1);
 
     if (revision && strncmp(revision, "pxa27", 5)) {
         fprintf(stderr, "Machine requires a PXA27x processor.\n");
@@ -2132,7 +2130,7 @@ PXA2xxState *pxa270_init(MemoryRegion *address_space,
     vmstate_register(NULL, 0, &vmstate_pxa2xx_pm, s);
 
     for (i = 0; pxa27x_ssp[i].io_base; i ++);
-    s->ssp = (SSIBus **)g_malloc0(sizeof(SSIBus *) * i);
+    s->ssp = g_new0(SSIBus *, i);
     for (i = 0; pxa27x_ssp[i].io_base; i ++) {
         DeviceState *dev;
         dev = sysbus_create_simple(TYPE_PXA2XX_SSP, pxa27x_ssp[i].io_base,
@@ -2177,7 +2175,7 @@ PXA2xxState *pxa255_init(MemoryRegion *address_space, 
unsigned int sdram_size)
     int i;
     DriveInfo *dinfo;
 
-    s = (PXA2xxState *) g_malloc0(sizeof(PXA2xxState));
+    s = g_new0(PXA2xxState, 1);
 
     s->cpu = cpu_arm_init("pxa255");
     if (s->cpu == NULL) {
@@ -2263,7 +2261,7 @@ PXA2xxState *pxa255_init(MemoryRegion *address_space, 
unsigned int sdram_size)
     vmstate_register(NULL, 0, &vmstate_pxa2xx_pm, s);
 
     for (i = 0; pxa255_ssp[i].io_base; i ++);
-    s->ssp = (SSIBus **)g_malloc0(sizeof(SSIBus *) * i);
+    s->ssp = g_new0(SSIBus *, i);
     for (i = 0; pxa255_ssp[i].io_base; i ++) {
         DeviceState *dev;
         dev = sysbus_create_simple(TYPE_PXA2XX_SSP, pxa255_ssp[i].io_base,
diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index 3170d69..26b5acc 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -668,7 +668,7 @@ static int stellaris_sys_init(uint32_t base, qemu_irq irq,
 {
     ssys_state *s;
 
-    s = (ssys_state *)g_malloc0(sizeof(ssys_state));
+    s = g_new0(ssys_state, 1);
     s->irq = irq;
     s->board = board;
     /* Most devices come preprogrammed with a MAC address in the user data. */
diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
index 170d0ce..e379153 100644
--- a/hw/arm/strongarm.c
+++ b/hw/arm/strongarm.c
@@ -1590,7 +1590,7 @@ StrongARMState *sa1110_init(MemoryRegion *sysmem,
     StrongARMState *s;
     int i;
 
-    s = g_malloc0(sizeof(StrongARMState));
+    s = g_new0(StrongARMState, 1);
 
     if (!rev) {
         rev = "sa1110-b5";
diff --git a/hw/audio/intel-hda.c b/hw/audio/intel-hda.c
index d41f82c..1edf608 100644
--- a/hw/audio/intel-hda.c
+++ b/hw/audio/intel-hda.c
@@ -466,7 +466,7 @@ static void intel_hda_parse_bdl(IntelHDAState *d, 
IntelHDAStream *st)
     addr = intel_hda_addr(st->bdlp_lbase, st->bdlp_ubase);
     st->bentries = st->lvi +1;
     g_free(st->bpl);
-    st->bpl = g_malloc(sizeof(bpl) * st->bentries);
+    st->bpl = g_new(bpl, st->bentries);
     for (i = 0; i < st->bentries; i++, addr += 16) {
         pci_dma_read(&d->pci, addr, buf, 16);
         st->bpl[i].addr  = le64_to_cpu(*(uint64_t *)buf);
diff --git a/hw/bt/core.c b/hw/bt/core.c
index 0ffc948..6ac4656 100644
--- a/hw/bt/core.c
+++ b/hw/bt/core.c
@@ -54,7 +54,7 @@ static void bt_dummy_lmp_acl_resp(struct bt_link_s *link,
 /* Slaves that don't hold any additional per link state can use these */
 static void bt_dummy_lmp_connection_request(struct bt_link_s *req)
 {
-    struct bt_link_s *link = g_malloc0(sizeof(struct bt_link_s));
+    struct bt_link_s *link = g_new0(struct bt_link_s, 1);
 
     link->slave = req->slave;
     link->host = req->host;
@@ -134,7 +134,7 @@ struct bt_scatternet_s *qemu_find_bt_vlan(int id)
         if (vlan->id == id)
             return &vlan->net;
     }
-    vlan = g_malloc0(sizeof(struct bt_vlan_s));
+    vlan = g_new0(struct bt_vlan_s, 1);
     vlan->id = id;
     pvlan = &first_bt_vlan;
     while (*pvlan != NULL)
diff --git a/hw/bt/hci-csr.c b/hw/bt/hci-csr.c
index 7b9b916..2f53ced 100644
--- a/hw/bt/hci-csr.c
+++ b/hw/bt/hci-csr.c
@@ -433,8 +433,7 @@ qemu_irq *csrhci_pins_get(CharDriverState *chr)
 
 CharDriverState *uart_hci_init(qemu_irq wakeup)
 {
-    struct csrhci_s *s = (struct csrhci_s *)
-            g_malloc0(sizeof(struct csrhci_s));
+    struct csrhci_s *s = g_new0(struct csrhci_s, 1);
 
     s->chr.opaque = s;
     s->chr.chr_write = csrhci_write;
diff --git a/hw/bt/hci.c b/hw/bt/hci.c
index 7ea3dc6..931ba33 100644
--- a/hw/bt/hci.c
+++ b/hw/bt/hci.c
@@ -739,7 +739,7 @@ static void bt_hci_connection_reject_event(struct bt_hci_s 
*hci,
 static void bt_hci_connection_accept(struct bt_hci_s *hci,
                 struct bt_device_s *host)
 {
-    struct bt_hci_link_s *link = g_malloc0(sizeof(struct bt_hci_link_s));
+    struct bt_hci_link_s *link = g_new0(struct bt_hci_link_s, 1);
     evt_conn_complete params;
     uint16_t handle;
     uint8_t status = HCI_SUCCESS;
@@ -2157,7 +2157,7 @@ static void bt_hci_destroy(struct bt_device_s *dev)
 
 struct HCIInfo *bt_new_hci(struct bt_scatternet_s *net)
 {
-    struct bt_hci_s *s = g_malloc0(sizeof(struct bt_hci_s));
+    struct bt_hci_s *s = g_new0(struct bt_hci_s, 1);
 
     s->lm.inquiry_done = timer_new_ns(QEMU_CLOCK_VIRTUAL, bt_hci_inquiry_done, 
s);
     s->lm.inquiry_next = timer_new_ns(QEMU_CLOCK_VIRTUAL, bt_hci_inquiry_next, 
s);
diff --git a/hw/bt/l2cap.c b/hw/bt/l2cap.c
index 2301d6f..269a9c7 100644
--- a/hw/bt/l2cap.c
+++ b/hw/bt/l2cap.c
@@ -1239,7 +1239,7 @@ static void l2cap_lmp_connection_request(struct bt_link_s 
*link)
 
     /* Always accept - we only get called if (dev->device->page_scan).  */
 
-    l2cap = g_malloc0(sizeof(struct slave_l2cap_instance_s));
+    l2cap = g_new0(struct slave_l2cap_instance_s, 1);
     l2cap->link.slave = &dev->device;
     l2cap->link.host = link->host;
     l2cap_init(&l2cap->l2cap, &l2cap->link, 0);
@@ -1260,7 +1260,7 @@ static void l2cap_lmp_connection_complete(struct 
bt_link_s *link)
         return;
     }
 
-    l2cap = g_malloc0(sizeof(struct l2cap_instance_s));
+    l2cap = g_new0(struct l2cap_instance_s, 1);
     l2cap_init(l2cap, link, 1);
 
     link->acl_mode = acl_active;
diff --git a/hw/char/mcf_uart.c b/hw/char/mcf_uart.c
index 98fd44e..ae65b29 100644
--- a/hw/char/mcf_uart.c
+++ b/hw/char/mcf_uart.c
@@ -276,7 +276,7 @@ void *mcf_uart_init(qemu_irq irq, CharDriverState *chr)
 {
     mcf_uart_state *s;
 
-    s = g_malloc0(sizeof(mcf_uart_state));
+    s = g_new0(mcf_uart_state, 1);
     s->chr = chr;
     s->irq = irq;
     if (chr) {
diff --git a/hw/char/omap_uart.c b/hw/char/omap_uart.c
index 0b91693..e3631b1 100644
--- a/hw/char/omap_uart.c
+++ b/hw/char/omap_uart.c
@@ -55,8 +55,7 @@ struct omap_uart_s *omap_uart_init(hwaddr base,
                 qemu_irq txdma, qemu_irq rxdma,
                 const char *label, CharDriverState *chr)
 {
-    struct omap_uart_s *s = (struct omap_uart_s *)
-            g_malloc0(sizeof(struct omap_uart_s));
+    struct omap_uart_s *s = g_new0(struct omap_uart_s, 1);
 
     s->base = base;
     s->fclk = fclk;
diff --git a/hw/char/parallel.c b/hw/char/parallel.c
index 7a3b264..bc76035 100644
--- a/hw/char/parallel.c
+++ b/hw/char/parallel.c
@@ -581,7 +581,7 @@ bool parallel_mm_init(MemoryRegion *address_space,
 {
     ParallelState *s;
 
-    s = g_malloc0(sizeof(ParallelState));
+    s = g_new0(ParallelState, 1);
     s->irq = irq;
     s->chr = chr;
     s->it_shift = it_shift;
diff --git a/hw/char/serial.c b/hw/char/serial.c
index 27dab7d..67d6639 100644
--- a/hw/char/serial.c
+++ b/hw/char/serial.c
@@ -690,7 +690,7 @@ SerialState *serial_init(int base, qemu_irq irq, int 
baudbase,
     SerialState *s;
     Error *err = NULL;
 
-    s = g_malloc0(sizeof(SerialState));
+    s = g_new0(SerialState, 1);
 
     s->irq = irq;
     s->baudbase = baudbase;
@@ -752,7 +752,7 @@ SerialState *serial_mm_init(MemoryRegion *address_space,
     SerialState *s;
     Error *err = NULL;
 
-    s = g_malloc0(sizeof(SerialState));
+    s = g_new0(SerialState, 1);
 
     s->it_shift = it_shift;
     s->irq = irq;
diff --git a/hw/char/sh_serial.c b/hw/char/sh_serial.c
index 9328dd1..fb66055 100644
--- a/hw/char/sh_serial.c
+++ b/hw/char/sh_serial.c
@@ -361,7 +361,7 @@ void sh_serial_init(MemoryRegion *sysmem,
 {
     sh_serial_state *s;
 
-    s = g_malloc0(sizeof(sh_serial_state));
+    s = g_new0(sh_serial_state, 1);
 
     s->feat = feat;
     s->flags = SH_SERIAL_FLAG_TEND | SH_SERIAL_FLAG_TDE;
diff --git a/hw/char/virtio-serial-bus.c b/hw/char/virtio-serial-bus.c
index 226e9f9..481bcb8 100644
--- a/hw/char/virtio-serial-bus.c
+++ b/hw/char/virtio-serial-bus.c
@@ -921,10 +921,8 @@ static void virtio_serial_device_realize(DeviceState *dev, 
Error **errp)
     QTAILQ_INIT(&vser->ports);
 
     vser->bus.max_nr_ports = vser->serial.max_virtserial_ports;
-    vser->ivqs = g_malloc(vser->serial.max_virtserial_ports
-                          * sizeof(VirtQueue *));
-    vser->ovqs = g_malloc(vser->serial.max_virtserial_ports
-                          * sizeof(VirtQueue *));
+    vser->ivqs = g_new(VirtQueue *, vser->serial.max_virtserial_ports);
+    vser->ovqs = g_new(VirtQueue *, vser->serial.max_virtserial_ports);
 
     /* Add a queue for host to guest transfers for port 0 (backward compat) */
     vser->ivqs[0] = virtio_add_queue(vdev, 128, handle_input);
diff --git a/hw/core/irq.c b/hw/core/irq.c
index 03c8cb3..b1158f5 100644
--- a/hw/core/irq.c
+++ b/hw/core/irq.c
@@ -114,7 +114,7 @@ static void qemu_splitirq(void *opaque, int line, int level)
 
 qemu_irq qemu_irq_split(qemu_irq irq1, qemu_irq irq2)
 {
-    qemu_irq *s = g_malloc0(2 * sizeof(qemu_irq));
+    qemu_irq *s = g_new0(qemu_irq, 2);
     s[0] = irq1;
     s[1] = irq2;
     return qemu_allocate_irqs(qemu_splitirq, s, 1)[0];
diff --git a/hw/core/ptimer.c b/hw/core/ptimer.c
index 3036bde..f94d142 100644
--- a/hw/core/ptimer.c
+++ b/hw/core/ptimer.c
@@ -224,7 +224,7 @@ ptimer_state *ptimer_init(QEMUBH *bh)
 {
     ptimer_state *s;
 
-    s = (ptimer_state *)g_malloc0(sizeof(ptimer_state));
+    s = g_new0(ptimer_state, 1);
     s->bh = bh;
     s->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, ptimer_tick, s);
     return s;
diff --git a/hw/display/blizzard.c b/hw/display/blizzard.c
index 4a466c8..147111a 100644
--- a/hw/display/blizzard.c
+++ b/hw/display/blizzard.c
@@ -962,7 +962,7 @@ void *s1d13745_init(qemu_irq gpio_int)
     switch (surface_bits_per_pixel(surface)) {
     case 0:
         s->line_fn_tab[0] = s->line_fn_tab[1] =
-                g_malloc0(sizeof(blizzard_fn_t) * 0x10);
+                g_new0(blizzard_fn_t, 0x10);
         break;
     case 8:
         s->line_fn_tab[0] = blizzard_draw_fn_8;
diff --git a/hw/display/omap_dss.c b/hw/display/omap_dss.c
index 24ccbcc..eef3c99 100644
--- a/hw/display/omap_dss.c
+++ b/hw/display/omap_dss.c
@@ -1046,8 +1046,7 @@ struct omap_dss_s *omap_dss_init(struct 
omap_target_agent_s *ta,
                 omap_clk fck1, omap_clk fck2, omap_clk ck54m,
                 omap_clk ick1, omap_clk ick2)
 {
-    struct omap_dss_s *s = (struct omap_dss_s *)
-            g_malloc0(sizeof(struct omap_dss_s));
+    struct omap_dss_s *s = g_new0(struct omap_dss_s, 1);
 
     s->irq = irq;
     s->drq = drq;
diff --git a/hw/display/omap_lcdc.c b/hw/display/omap_lcdc.c
index c3b9b68..7c8f144 100644
--- a/hw/display/omap_lcdc.c
+++ b/hw/display/omap_lcdc.c
@@ -395,8 +395,7 @@ struct omap_lcd_panel_s *omap_lcdc_init(MemoryRegion 
*sysmem,
                                         struct omap_dma_lcd_channel_s *dma,
                                         omap_clk clk)
 {
-    struct omap_lcd_panel_s *s = (struct omap_lcd_panel_s *)
-            g_malloc0(sizeof(struct omap_lcd_panel_s));
+    struct omap_lcd_panel_s *s = g_new0(struct omap_lcd_panel_s, 1);
 
     s->irq = irq;
     s->dma = dma;
diff --git a/hw/display/pxa2xx_lcd.c b/hw/display/pxa2xx_lcd.c
index 990931a..d938cf9 100644
--- a/hw/display/pxa2xx_lcd.c
+++ b/hw/display/pxa2xx_lcd.c
@@ -1002,7 +1002,7 @@ PXA2xxLCDState *pxa2xx_lcdc_init(MemoryRegion *sysmem,
     PXA2xxLCDState *s;
     DisplaySurface *surface;
 
-    s = (PXA2xxLCDState *) g_malloc0(sizeof(PXA2xxLCDState));
+    s = g_new0(PXA2xxLCDState, 1);
     s->invalidated = 1;
     s->irq = irq;
     s->sysmem = sysmem;
diff --git a/hw/display/qxl.c b/hw/display/qxl.c
index e4f172e..dcf6ab0 100644
--- a/hw/display/qxl.c
+++ b/hw/display/qxl.c
@@ -2158,7 +2158,7 @@ static int qxl_post_load(void *opaque, int version)
         qxl_create_guest_primary(d, 1, QXL_SYNC);
 
         /* replay surface-create and cursor-set commands */
-        cmds = g_malloc0(sizeof(QXLCommandExt) * (d->ssd.num_surfaces + 1));
+        cmds = g_new0(QXLCommandExt, d->ssd.num_surfaces + 1);
         for (in = 0, out = 0; in < d->ssd.num_surfaces; in++) {
             if (d->guest_surfaces.cmds[in] == 0) {
                 continue;
diff --git a/hw/display/sm501.c b/hw/display/sm501.c
index c75d6ac..eb7410d 100644
--- a/hw/display/sm501.c
+++ b/hw/display/sm501.c
@@ -1396,7 +1396,7 @@ void sm501_init(MemoryRegion *address_space_mem, uint32_t 
base,
     MemoryRegion *sm501_2d_engine = g_new(MemoryRegion, 1);
 
     /* allocate management data region */
-    s = (SM501State *)g_malloc0(sizeof(SM501State));
+    s = g_new0(SM501State, 1);
     s->base = base;
     s->local_mem_size_index
        = get_local_mem_size_index(local_mem_bytes);
diff --git a/hw/display/tc6393xb.c b/hw/display/tc6393xb.c
index 3dd9b98..f463051 100644
--- a/hw/display/tc6393xb.c
+++ b/hw/display/tc6393xb.c
@@ -566,7 +566,7 @@ TC6393xbState *tc6393xb_init(MemoryRegion *sysmem, uint32_t 
base, qemu_irq irq)
         },
     };
 
-    s = (TC6393xbState *) g_malloc0(sizeof(TC6393xbState));
+    s = g_new0(TC6393xbState, 1);
     s->irq = irq;
     s->gpio_in = qemu_allocate_irqs(tc6393xb_gpio_set, s, TC6393XB_GPIOS);
 
diff --git a/hw/display/xenfb.c b/hw/display/xenfb.c
index f0333a0..c9320d2 100644
--- a/hw/display/xenfb.c
+++ b/hw/display/xenfb.c
@@ -483,8 +483,8 @@ static int xenfb_map_fb(struct XenFB *xenfb)
     n_fbdirs = xenfb->fbpages * mode / 8;
     n_fbdirs = (n_fbdirs + (XC_PAGE_SIZE - 1)) / XC_PAGE_SIZE;
 
-    pgmfns = g_malloc0(sizeof(unsigned long) * n_fbdirs);
-    fbmfns = g_malloc0(sizeof(unsigned long) * xenfb->fbpages);
+    pgmfns = g_new0(unsigned long, n_fbdirs);
+    fbmfns = g_new0(unsigned long, xenfb->fbpages);
 
     xenfb_copy_mfns(mode, n_fbdirs, pgmfns, pd);
     map = xc_map_foreign_pages(xen_xc, xenfb->c.xendev.dom,
diff --git a/hw/dma/omap_dma.c b/hw/dma/omap_dma.c
index 0e8cccd..7bf9c4e 100644
--- a/hw/dma/omap_dma.c
+++ b/hw/dma/omap_dma.c
@@ -1625,8 +1625,7 @@ struct soc_dma_s *omap_dma_init(hwaddr base, qemu_irq 
*irqs,
                 enum omap_dma_model model)
 {
     int num_irqs, memsize, i;
-    struct omap_dma_s *s = (struct omap_dma_s *)
-            g_malloc0(sizeof(struct omap_dma_s));
+    struct omap_dma_s *s = g_new0(struct omap_dma_s, 1);
 
     if (model <= omap_dma_3_1) {
         num_irqs = 6;
@@ -2059,8 +2058,7 @@ struct soc_dma_s *omap_dma4_init(hwaddr base, qemu_irq 
*irqs,
                 int chans, omap_clk iclk, omap_clk fclk)
 {
     int i;
-    struct omap_dma_s *s = (struct omap_dma_s *)
-            g_malloc0(sizeof(struct omap_dma_s));
+    struct omap_dma_s *s = g_new0(struct omap_dma_s, 1);
 
     s->model = omap_dma_4;
     s->chans = chans;
diff --git a/hw/dma/pxa2xx_dma.c b/hw/dma/pxa2xx_dma.c
index c013abb..b149fd7 100644
--- a/hw/dma/pxa2xx_dma.c
+++ b/hw/dma/pxa2xx_dma.c
@@ -459,7 +459,7 @@ static int pxa2xx_dma_init(SysBusDevice *sbd)
         return -1;
     }
 
-    s->chan = g_malloc0(sizeof(PXA2xxDMAChannel) * s->channels);
+    s->chan = g_new0(PXA2xxDMAChannel, s->channels);
 
     memset(s->chan, 0, sizeof(PXA2xxDMAChannel) * s->channels);
     for (i = 0; i < s->channels; i ++)
diff --git a/hw/dma/rc4030.c b/hw/dma/rc4030.c
index af26632..f2bb6a1 100644
--- a/hw/dma/rc4030.c
+++ b/hw/dma/rc4030.c
@@ -784,8 +784,8 @@ static rc4030_dma *rc4030_allocate_dmas(void *opaque, int n)
     struct rc4030DMAState *p;
     int i;
 
-    s = (rc4030_dma *)g_malloc0(sizeof(rc4030_dma) * n);
-    p = (struct rc4030DMAState *)g_malloc0(sizeof(struct rc4030DMAState) * n);
+    s = g_new0(rc4030_dma, n);
+    p = g_new0(struct rc4030DMAState, n);
     for (i = 0; i < n; i++) {
         p->opaque = opaque;
         p->n = i;
@@ -801,7 +801,7 @@ void *rc4030_init(qemu_irq timer, qemu_irq jazz_bus,
 {
     rc4030State *s;
 
-    s = g_malloc0(sizeof(rc4030State));
+    s = g_new0(rc4030State, 1);
 
     *irqs = qemu_allocate_irqs(rc4030_irq_jazz_request, s, 16);
     *dmas = rc4030_allocate_dmas(s, 4);
diff --git a/hw/gpio/omap_gpio.c b/hw/gpio/omap_gpio.c
index 938782a..b4a27c6 100644
--- a/hw/gpio/omap_gpio.c
+++ b/hw/gpio/omap_gpio.c
@@ -712,8 +712,8 @@ static int omap2_gpio_init(SysBusDevice *sbd)
     } else {
         s->modulecount = 6;
     }
-    s->modules = g_malloc0(s->modulecount * sizeof(struct omap2_gpio_s));
-    s->handler = g_malloc0(s->modulecount * 32 * sizeof(qemu_irq));
+    s->modules = g_new0(struct omap2_gpio_s, s->modulecount);
+    s->handler = g_new0(qemu_irq, s->modulecount * 32);
     qdev_init_gpio_in(dev, omap2_gpio_set, s->modulecount * 32);
     qdev_init_gpio_out(dev, s->handler, s->modulecount * 32);
     for (i = 0; i < s->modulecount; i++) {
diff --git a/hw/i2c/bitbang_i2c.c b/hw/i2c/bitbang_i2c.c
index ca59456..6393f49 100644
--- a/hw/i2c/bitbang_i2c.c
+++ b/hw/i2c/bitbang_i2c.c
@@ -174,7 +174,7 @@ bitbang_i2c_interface *bitbang_i2c_init(i2c_bus *bus)
 {
     bitbang_i2c_interface *s;
 
-    s = g_malloc0(sizeof(bitbang_i2c_interface));
+    s = g_new0(bitbang_i2c_interface, 1);
 
     s->bus = bus;
     s->last_data = 1;
diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index 6f0be37..dc58ebf 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -601,8 +601,7 @@ int e820_add_entry(uint64_t address, uint64_t length, 
uint32_t type)
     }
 
     /* new "etc/e820" file -- include ram too */
-    e820_table = g_realloc(e820_table,
-                           sizeof(struct e820_entry) * (e820_entries+1));
+    e820_table = g_renew(struct e820_entry, e820_table, e820_entries + 1);
     e820_table[e820_entries].address = cpu_to_le64(address);
     e820_table[e820_entries].length = cpu_to_le64(length);
     e820_table[e820_entries].type = cpu_to_le32(type);
diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c
index fbea9e8..bbd84c6 100644
--- a/hw/ide/ahci.c
+++ b/hw/ide/ahci.c
@@ -1163,7 +1163,7 @@ void ahci_init(AHCIState *s, DeviceState *qdev, 
AddressSpace *as, int ports)
 
     s->as = as;
     s->ports = ports;
-    s->dev = g_malloc0(sizeof(AHCIDevice) * ports);
+    s->dev = g_new0(AHCIDevice, ports);
     ahci_reg_init(s);
     /* XXX BAR size should be 1k, but that breaks, so bump it to 4k for now */
     memory_region_init_io(&s->mem, OBJECT(qdev), &ahci_mem_ops, s,
diff --git a/hw/input/pckbd.c b/hw/input/pckbd.c
index 655b8c5..399c6aa 100644
--- a/hw/input/pckbd.c
+++ b/hw/input/pckbd.c
@@ -416,7 +416,7 @@ void i8042_mm_init(qemu_irq kbd_irq, qemu_irq mouse_irq,
                    MemoryRegion *region, ram_addr_t size,
                    hwaddr mask)
 {
-    KBDState *s = g_malloc0(sizeof(KBDState));
+    KBDState *s = g_new0(KBDState, 1);
 
     s->irq_kbd = kbd_irq;
     s->irq_mouse = mouse_irq;
diff --git a/hw/input/ps2.c b/hw/input/ps2.c
index 3412079..86304ae 100644
--- a/hw/input/ps2.c
+++ b/hw/input/ps2.c
@@ -652,7 +652,7 @@ static const VMStateDescription vmstate_ps2_mouse = {
 
 void *ps2_kbd_init(void (*update_irq)(void *, int), void *update_arg)
 {
-    PS2KbdState *s = (PS2KbdState *)g_malloc0(sizeof(PS2KbdState));
+    PS2KbdState *s = g_new0(PS2KbdState, 1);
 
     s->common.update_irq = update_irq;
     s->common.update_arg = update_arg;
@@ -665,7 +665,7 @@ void *ps2_kbd_init(void (*update_irq)(void *, int), void 
*update_arg)
 
 void *ps2_mouse_init(void (*update_irq)(void *, int), void *update_arg)
 {
-    PS2MouseState *s = (PS2MouseState *)g_malloc0(sizeof(PS2MouseState));
+    PS2MouseState *s = g_new0(PS2MouseState, 1);
 
     s->common.update_irq = update_irq;
     s->common.update_arg = update_arg;
diff --git a/hw/input/pxa2xx_keypad.c b/hw/input/pxa2xx_keypad.c
index b90b0ba..c575cd2 100644
--- a/hw/input/pxa2xx_keypad.c
+++ b/hw/input/pxa2xx_keypad.c
@@ -310,7 +310,7 @@ PXA2xxKeyPadState *pxa27x_keypad_init(MemoryRegion *sysmem,
 {
     PXA2xxKeyPadState *s;
 
-    s = (PXA2xxKeyPadState *) g_malloc0(sizeof(PXA2xxKeyPadState));
+    s = g_new0(PXA2xxKeyPadState, 1);
     s->irq = irq;
 
     memory_region_init_io(&s->iomem, NULL, &pxa2xx_keypad_ops, s,
diff --git a/hw/input/stellaris_input.c b/hw/input/stellaris_input.c
index 4e40792..5c3ea3e 100644
--- a/hw/input/stellaris_input.c
+++ b/hw/input/stellaris_input.c
@@ -77,8 +77,8 @@ void stellaris_gamepad_init(int n, qemu_irq *irq, const int 
*keycode)
     gamepad_state *s;
     int i;
 
-    s = (gamepad_state *)g_malloc0(sizeof (gamepad_state));
-    s->buttons = (gamepad_button *)g_malloc0(n * sizeof (gamepad_button));
+    s = g_new0(gamepad_state, 1);
+    s->buttons = g_new0(gamepad_button, n);
     for (i = 0; i < n; i++) {
         s->buttons[i].irq = irq[i];
         s->buttons[i].keycode = keycode[i];
diff --git a/hw/input/tsc2005.c b/hw/input/tsc2005.c
index 21d4f4d..75cc865 100644
--- a/hw/input/tsc2005.c
+++ b/hw/input/tsc2005.c
@@ -523,8 +523,7 @@ void *tsc2005_init(qemu_irq pintdav)
 {
     TSC2005State *s;
 
-    s = (TSC2005State *)
-            g_malloc0(sizeof(TSC2005State));
+    s = g_new0(TSC2005State, 1);
     s->x = 400;
     s->y = 240;
     s->pressure = 0;
diff --git a/hw/input/tsc210x.c b/hw/input/tsc210x.c
index 485c9e5..dac2fbc 100644
--- a/hw/input/tsc210x.c
+++ b/hw/input/tsc210x.c
@@ -1104,8 +1104,7 @@ uWireSlave *tsc2102_init(qemu_irq pint)
 {
     TSC210xState *s;
 
-    s = (TSC210xState *)
-            g_malloc0(sizeof(TSC210xState));
+    s = g_new0(TSC210xState, 1);
     memset(s, 0, sizeof(TSC210xState));
     s->x = 160;
     s->y = 160;
@@ -1153,8 +1152,7 @@ uWireSlave *tsc2301_init(qemu_irq penirq, qemu_irq kbirq, 
qemu_irq dav)
 {
     TSC210xState *s;
 
-    s = (TSC210xState *)
-            g_malloc0(sizeof(TSC210xState));
+    s = g_new0(TSC210xState, 1);
     memset(s, 0, sizeof(TSC210xState));
     s->x = 400;
     s->y = 240;
diff --git a/hw/intc/heathrow_pic.c b/hw/intc/heathrow_pic.c
index 9818f24..2011ccb 100644
--- a/hw/intc/heathrow_pic.c
+++ b/hw/intc/heathrow_pic.c
@@ -202,7 +202,7 @@ qemu_irq *heathrow_pic_init(MemoryRegion **pmem,
 {
     HeathrowPICS *s;
 
-    s = g_malloc0(sizeof(HeathrowPICS));
+    s = g_new0(HeathrowPICS, 1);
     /* only 1 CPU */
     s->irqs = irqs[0];
     memory_region_init_io(&s->mem, NULL, &heathrow_pic_ops, s,
diff --git a/hw/intc/i8259.c b/hw/intc/i8259.c
index c6f248b..edeb816 100644
--- a/hw/intc/i8259.c
+++ b/hw/intc/i8259.c
@@ -471,7 +471,7 @@ qemu_irq *i8259_init(ISABus *bus, qemu_irq parent_irq)
     ISADevice *isadev;
     int i;
 
-    irq_set = g_malloc(ISA_NUM_IRQS * sizeof(qemu_irq));
+    irq_set = g_new(qemu_irq, ISA_NUM_IRQS);
 
     isadev = i8259_init_chip(TYPE_I8259, bus, true);
     dev = DEVICE(isadev);
diff --git a/hw/intc/xics.c b/hw/intc/xics.c
index b437563..71d556b 100644
--- a/hw/intc/xics.c
+++ b/hw/intc/xics.c
@@ -597,8 +597,8 @@ static void ics_realize(DeviceState *dev, Error **errp)
         error_setg(errp, "Number of interrupts needs to be greater 0");
         return;
     }
-    ics->irqs = g_malloc0(ics->nr_irqs * sizeof(ICSIRQState));
-    ics->islsi = g_malloc0(ics->nr_irqs * sizeof(bool));
+    ics->irqs = g_new0(ICSIRQState, ics->nr_irqs);
+    ics->islsi = g_new0(bool, ics->nr_irqs);
     ics->qirqs = qemu_allocate_irqs(ics_set_irq, ics, ics->nr_irqs);
 }
 
@@ -836,7 +836,7 @@ static void xics_set_nr_servers(XICSState *icp, uint32_t 
nr_servers,
 
     icp->nr_servers = nr_servers;
 
-    icp->ss = g_malloc0(icp->nr_servers*sizeof(ICPState));
+    icp->ss = g_new0(ICPState, icp->nr_servers);
     for (i = 0; i < icp->nr_servers; i++) {
         char buffer[32];
         object_initialize(&icp->ss[i], sizeof(icp->ss[i]), TYPE_ICP);
diff --git a/hw/intc/xics_kvm.c b/hw/intc/xics_kvm.c
index c203646..cb80bd1 100644
--- a/hw/intc/xics_kvm.c
+++ b/hw/intc/xics_kvm.c
@@ -280,7 +280,7 @@ static void ics_kvm_realize(DeviceState *dev, Error **errp)
         error_setg(errp, "Number of interrupts needs to be greater 0");
         return;
     }
-    ics->irqs = g_malloc0(ics->nr_irqs * sizeof(ICSIRQState));
+    ics->irqs = g_new0(ICSIRQState, ics->nr_irqs);
     ics->islsi = g_malloc0(ics->nr_irqs * sizeof(bool));
     ics->qirqs = qemu_allocate_irqs(ics_kvm_set_irq, ics, ics->nr_irqs);
 }
@@ -351,7 +351,7 @@ static void xics_kvm_set_nr_servers(XICSState *icp, 
uint32_t nr_servers,
 
     icp->nr_servers = nr_servers;
 
-    icp->ss = g_malloc0(icp->nr_servers*sizeof(ICPState));
+    icp->ss = g_new0(ICPState, icp->nr_servers);
     for (i = 0; i < icp->nr_servers; i++) {
         char buffer[32];
         object_initialize(&icp->ss[i], sizeof(icp->ss[i]), TYPE_KVM_ICP);
diff --git a/hw/lm32/lm32_boards.c b/hw/lm32/lm32_boards.c
index c032bb8..a443d87 100644
--- a/hw/lm32/lm32_boards.c
+++ b/hw/lm32/lm32_boards.c
@@ -95,7 +95,7 @@ static void lm32_evr_init(QEMUMachineInitArgs *args)
     int timer0_irq                 = 1;
     int timer1_irq                 = 3;
 
-    reset_info = g_malloc0(sizeof(ResetInfo));
+    reset_info = g_new0(ResetInfo, 1);
 
     if (cpu_model == NULL) {
         cpu_model = "lm32-full";
@@ -192,7 +192,7 @@ static void lm32_uclinux_init(QEMUMachineInitArgs *args)
     hwaddr initrd_base  = 0x08400000;
     size_t initrd_max               = 0x01000000;
 
-    reset_info = g_malloc0(sizeof(ResetInfo));
+    reset_info = g_new0(ResetInfo, 1);
 
     if (cpu_model == NULL) {
         cpu_model = "lm32-full";
diff --git a/hw/lm32/lm32_hwsetup.h b/hw/lm32/lm32_hwsetup.h
index 9fd5e69..ea58fae 100644
--- a/hw/lm32/lm32_hwsetup.h
+++ b/hw/lm32/lm32_hwsetup.h
@@ -57,7 +57,7 @@ static inline HWSetup *hwsetup_init(void)
 {
     HWSetup *hw;
 
-    hw = g_malloc(sizeof(HWSetup));
+    hw = g_new(HWSetup, 1);
     hw->data = g_malloc0(TARGET_PAGE_SIZE);
     hw->ptr = hw->data;
 
diff --git a/hw/lm32/milkymist.c b/hw/lm32/milkymist.c
index 15053c4..23df713 100644
--- a/hw/lm32/milkymist.c
+++ b/hw/lm32/milkymist.c
@@ -102,7 +102,7 @@ milkymist_init(QEMUMachineInitArgs *args)
     hwaddr cmdline_base = sdram_base + 0x1000000;
     size_t initrd_max = sdram_size - 0x1002000;
 
-    reset_info = g_malloc0(sizeof(ResetInfo));
+    reset_info = g_new0(ResetInfo, 1);
 
     if (cpu_model == NULL) {
         cpu_model = "lm32-full";
diff --git a/hw/m68k/mcf5206.c b/hw/m68k/mcf5206.c
index 1727a46..4bae5e7 100644
--- a/hw/m68k/mcf5206.c
+++ b/hw/m68k/mcf5206.c
@@ -134,7 +134,7 @@ static m5206_timer_state *m5206_timer_init(qemu_irq irq)
     m5206_timer_state *s;
     QEMUBH *bh;
 
-    s = (m5206_timer_state *)g_malloc0(sizeof(m5206_timer_state));
+    s = g_new0(m5206_timer_state, 1);
     bh = qemu_bh_new(m5206_timer_trigger, s);
     s->timer = ptimer_init(bh);
     s->irq = irq;
@@ -530,7 +530,7 @@ qemu_irq *mcf5206_init(MemoryRegion *sysmem, uint32_t base, 
M68kCPU *cpu)
     m5206_mbar_state *s;
     qemu_irq *pic;
 
-    s = (m5206_mbar_state *)g_malloc0(sizeof(m5206_mbar_state));
+    s = g_new0(m5206_mbar_state, 1);
 
     memory_region_init_io(&s->iomem, NULL, &m5206_mbar_ops, s,
                           "mbar", 0x00001000);
diff --git a/hw/m68k/mcf5208.c b/hw/m68k/mcf5208.c
index 6e30c0b..c2f35f9 100644
--- a/hw/m68k/mcf5208.c
+++ b/hw/m68k/mcf5208.c
@@ -177,7 +177,7 @@ static void mcf5208_sys_init(MemoryRegion *address_space, 
qemu_irq *pic)
     memory_region_add_subregion(address_space, 0xfc0a8000, iomem);
     /* Timers.  */
     for (i = 0; i < 2; i++) {
-        s = (m5208_timer_state *)g_malloc0(sizeof(m5208_timer_state));
+        s = g_new0(m5208_timer_state, 1);
         bh = qemu_bh_new(m5208_timer_trigger, s);
         s->timer = ptimer_init(bh);
         memory_region_init_io(&s->iomem, NULL, &m5208_timer_ops, s,
diff --git a/hw/m68k/mcf_intc.c b/hw/m68k/mcf_intc.c
index 621423c..4c085b2 100644
--- a/hw/m68k/mcf_intc.c
+++ b/hw/m68k/mcf_intc.c
@@ -143,7 +143,7 @@ qemu_irq *mcf_intc_init(MemoryRegion *sysmem,
 {
     mcf_intc_state *s;
 
-    s = g_malloc0(sizeof(mcf_intc_state));
+    s = g_new0(mcf_intc_state, 1);
     s->cpu = cpu;
     mcf_intc_reset(s);
 
diff --git a/hw/mips/mips_malta.c b/hw/mips/mips_malta.c
index 05c8771..af7b4dc 100644
--- a/hw/mips/mips_malta.c
+++ b/hw/mips/mips_malta.c
@@ -540,7 +540,7 @@ static MaltaFPGAState *malta_fpga_init(MemoryRegion 
*address_space,
 {
     MaltaFPGAState *s;
 
-    s = (MaltaFPGAState *)g_malloc0(sizeof(MaltaFPGAState));
+    s = g_new0(MaltaFPGAState, 1);
 
     memory_region_init_io(&s->iomem, NULL, &malta_fpga_ops, s,
                           "malta-fpga", 0x100000);
diff --git a/hw/mips/mips_mipssim.c b/hw/mips/mips_mipssim.c
index 239aa6a..96a6e15 100644
--- a/hw/mips/mips_mipssim.c
+++ b/hw/mips/mips_mipssim.c
@@ -165,7 +165,7 @@ mips_mipssim_init(QEMUMachineInitArgs *args)
     }
     env = &cpu->env;
 
-    reset_info = g_malloc0(sizeof(ResetData));
+    reset_info = g_new0(ResetData, 1);
     reset_info->cpu = cpu;
     reset_info->vector = env->active_tc.PC;
     qemu_register_reset(main_cpu_reset, reset_info);
diff --git a/hw/mips/mips_r4k.c b/hw/mips/mips_r4k.c
index e94b543..38663c4 100644
--- a/hw/mips/mips_r4k.c
+++ b/hw/mips/mips_r4k.c
@@ -192,7 +192,7 @@ void mips_r4k_init(QEMUMachineInitArgs *args)
     }
     env = &cpu->env;
 
-    reset_info = g_malloc0(sizeof(ResetData));
+    reset_info = g_new0(ResetData, 1);
     reset_info->cpu = cpu;
     reset_info->vector = env->active_tc.PC;
     qemu_register_reset(main_cpu_reset, reset_info);
diff --git a/hw/misc/applesmc.c b/hw/misc/applesmc.c
index 1e8d183..152a460 100644
--- a/hw/misc/applesmc.c
+++ b/hw/misc/applesmc.c
@@ -180,7 +180,7 @@ static void applesmc_add_key(AppleSMCState *s, const char 
*key,
 {
     struct AppleSMCData *def;
 
-    def = g_malloc0(sizeof(struct AppleSMCData));
+    def = g_new0(struct AppleSMCData, 1);
     def->key = key;
     def->len = len;
     def->data = data;
diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c
index 8d144ba..161c2d6 100644
--- a/hw/misc/ivshmem.c
+++ b/hw/misc/ivshmem.c
@@ -411,7 +411,7 @@ static void increase_dynamic_storage(IVShmemState *s, int 
new_min_size) {
         s->nb_peers = s->nb_peers * 2;
 
     IVSHMEM_DPRINTF("bumping storage to %d guests\n", s->nb_peers);
-    s->peers = g_realloc(s->peers, s->nb_peers * sizeof(Peer));
+    s->peers = g_renew(Peer, s->peers, s->nb_peers);
 
     /* zero out new pointers */
     for (j = old_nb_alloc; j < s->nb_peers; j++) {
@@ -586,7 +586,7 @@ static void ivshmem_setup_msi(IVShmemState * s)
     IVSHMEM_DPRINTF("msix initialized (%d vectors)\n", s->vectors);
 
     /* allocate QEMU char devices for receiving interrupts */
-    s->eventfd_table = g_malloc0(s->vectors * sizeof(EventfdEntry));
+    s->eventfd_table = g_new0(EventfdEntry, s->vectors);
 
     ivshmem_use_msix(s);
 }
@@ -732,11 +732,11 @@ static int pci_ivshmem_init(PCIDevice *dev)
         s->vm_id = -1;
 
         /* allocate/initialize space for interrupt handling */
-        s->peers = g_malloc0(s->nb_peers * sizeof(Peer));
+        s->peers = g_new0(Peer, s->nb_peers);
 
         pci_register_bar(dev, 2, s->ivshmem_attr, &s->bar);
 
-        s->eventfd_chr = g_malloc0(s->vectors * sizeof(CharDriverState *));
+        s->eventfd_chr = g_new0(CharDriverState *, s->vectors);
 
         qemu_chr_add_handlers(s->server_chr, ivshmem_can_receive, ivshmem_read,
                      ivshmem_event, s);
diff --git a/hw/misc/macio/mac_dbdma.c b/hw/misc/macio/mac_dbdma.c
index f47a736..392c524 100644
--- a/hw/misc/macio/mac_dbdma.c
+++ b/hw/misc/macio/mac_dbdma.c
@@ -751,7 +751,7 @@ void* DBDMA_init (MemoryRegion **dbdma_mem)
 {
     DBDMAState *s;
 
-    s = g_malloc0(sizeof(DBDMAState));
+    s = g_new0(DBDMAState, 1);
 
     memory_region_init_io(&s->mem, NULL, &dbdma_ops, s, "dbdma", 0x1000);
     *dbdma_mem = &s->mem;
diff --git a/hw/misc/omap_clk.c b/hw/misc/omap_clk.c
index 80a3c50..73d4f8b 100644
--- a/hw/misc/omap_clk.c
+++ b/hw/misc/omap_clk.c
@@ -1239,7 +1239,7 @@ void omap_clk_init(struct omap_mpu_state_s *mpu)
     for (i = onchip_clks, count = 0; *i; i ++)
         if ((*i)->flags & flag)
             count ++;
-    mpu->clks = (struct clk *) g_malloc0(sizeof(struct clk) * (count + 1));
+    mpu->clks = g_new0(struct clk, count + 1);
     for (i = onchip_clks, j = mpu->clks; *i; i ++)
         if ((*i)->flags & flag) {
             memcpy(j, *i, sizeof(struct clk));
diff --git a/hw/misc/omap_gpmc.c b/hw/misc/omap_gpmc.c
index 2047274..4bc7870 100644
--- a/hw/misc/omap_gpmc.c
+++ b/hw/misc/omap_gpmc.c
@@ -823,8 +823,7 @@ struct omap_gpmc_s *omap_gpmc_init(struct omap_mpu_state_s 
*mpu,
                                    qemu_irq irq, qemu_irq drq)
 {
     int cs;
-    struct omap_gpmc_s *s = (struct omap_gpmc_s *)
-            g_malloc0(sizeof(struct omap_gpmc_s));
+    struct omap_gpmc_s *s = g_new0(struct omap_gpmc_s, 1);
 
     memory_region_init_io(&s->iomem, NULL, &omap_gpmc_ops, s, "omap-gpmc", 
0x1000);
     memory_region_add_subregion(get_system_memory(), base, &s->iomem);
diff --git a/hw/misc/omap_sdrc.c b/hw/misc/omap_sdrc.c
index ed62caf..04bfeaf 100644
--- a/hw/misc/omap_sdrc.c
+++ b/hw/misc/omap_sdrc.c
@@ -156,8 +156,7 @@ static const MemoryRegionOps omap_sdrc_ops = {
 struct omap_sdrc_s *omap_sdrc_init(MemoryRegion *sysmem,
                                    hwaddr base)
 {
-    struct omap_sdrc_s *s = (struct omap_sdrc_s *)
-            g_malloc0(sizeof(struct omap_sdrc_s));
+    struct omap_sdrc_s *s = g_new0(struct omap_sdrc_s, 1);
 
     omap_sdrc_reset(s);
 
diff --git a/hw/misc/vfio.c b/hw/misc/vfio.c
index 9aecaa8..b50f37b 100644
--- a/hw/misc/vfio.c
+++ b/hw/misc/vfio.c
@@ -787,7 +787,7 @@ static void vfio_enable_msix(VFIODevice *vdev)
 {
     vfio_disable_interrupts(vdev);
 
-    vdev->msi_vectors = g_malloc0(vdev->msix->entries * sizeof(VFIOMSIVector));
+    vdev->msi_vectors = g_new0(VFIOMSIVector, vdev->msix->entries);
 
     vdev->interrupt = VFIO_INT_MSIX;
 
@@ -824,7 +824,7 @@ static void vfio_enable_msi(VFIODevice *vdev)
 
     vdev->nr_vectors = msi_nr_vectors_allocated(&vdev->pdev);
 retry:
-    vdev->msi_vectors = g_malloc0(vdev->nr_vectors * sizeof(VFIOMSIVector));
+    vdev->msi_vectors = g_new0(VFIOMSIVector, vdev->nr_vectors);
 
     for (i = 0; i < vdev->nr_vectors; i++) {
         VFIOMSIVector *vector = &vdev->msi_vectors[i];
diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
index 789d385..92f01f6 100644
--- a/hw/net/dp8393x.c
+++ b/hw/net/dp8393x.c
@@ -889,7 +889,7 @@ void dp83932_init(NICInfo *nd, hwaddr base, int it_shift,
 
     qemu_check_nic_model(nd, "dp83932");
 
-    s = g_malloc0(sizeof(dp8393xState));
+    s = g_new0(dp8393xState, 1);
 
     s->address_space = address_space;
     s->mem_opaque = mem_opaque;
diff --git a/hw/net/mcf_fec.c b/hw/net/mcf_fec.c
index 4bff3de..2a53c30 100644
--- a/hw/net/mcf_fec.c
+++ b/hw/net/mcf_fec.c
@@ -464,7 +464,7 @@ void mcf_fec_init(MemoryRegion *sysmem, NICInfo *nd,
 
     qemu_check_nic_model(nd, "mcf_fec");
 
-    s = (mcf_fec_state *)g_malloc0(sizeof(mcf_fec_state));
+    s = g_new0(mcf_fec_state, 1);
     s->sysmem = sysmem;
     s->irq = irq;
 
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 3626608..0fe130a 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -1501,7 +1501,7 @@ static void virtio_net_device_realize(DeviceState *dev, 
Error **errp)
     virtio_init(vdev, "virtio-net", VIRTIO_ID_NET, n->config_size);
 
     n->max_queues = MAX(n->nic_conf.queues, 1);
-    n->vqs = g_malloc0(sizeof(VirtIONetQueue) * n->max_queues);
+    n->vqs = g_new0(VirtIONetQueue, n->max_queues);
     n->vqs[0].rx_vq = virtio_add_queue(vdev, 256, virtio_net_handle_rx);
     n->curr_queues = 1;
     n->vqs[0].n = n;
diff --git a/hw/ppc/e500.c b/hw/ppc/e500.c
index b37ce9d..cd9a021 100644
--- a/hw/ppc/e500.c
+++ b/hw/ppc/e500.c
@@ -624,7 +624,7 @@ void ppce500_init(QEMUMachineInitArgs *args, PPCE500Params 
*params)
         args->cpu_model = "e500v2_v30";
     }
 
-    irqs = g_malloc0(smp_cpus * sizeof(qemu_irq *));
+    irqs = g_new0(qemu_irq *, smp_cpus);
     irqs[0] = g_malloc0(smp_cpus * sizeof(qemu_irq) * OPENPIC_OUTPUT_NB);
     for (i = 0; i < smp_cpus; i++) {
         PowerPCCPU *cpu;
@@ -657,7 +657,7 @@ void ppce500_init(QEMUMachineInitArgs *args, PPCE500Params 
*params)
         if (!i) {
             /* Primary CPU */
             struct boot_info *boot_info;
-            boot_info = g_malloc0(sizeof(struct boot_info));
+            boot_info = g_new0(struct boot_info, 1);
             qemu_register_reset(ppce500_cpu_reset, cpu);
             env->load_info = boot_info;
         } else {
diff --git a/hw/ppc/mac_newworld.c b/hw/ppc/mac_newworld.c
index 5e79575..31789d1 100644
--- a/hw/ppc/mac_newworld.c
+++ b/hw/ppc/mac_newworld.c
@@ -300,7 +300,7 @@ static void ppc_core99_init(QEMUMachineInitArgs *args)
     memory_region_init_io(unin2_memory, NULL, &unin_ops, token, "unin", 
0x1000);
     memory_region_add_subregion(get_system_memory(), 0xf3000000, unin2_memory);
 
-    openpic_irqs = g_malloc0(smp_cpus * sizeof(qemu_irq *));
+    openpic_irqs = g_new0(qemu_irq *, smp_cpus);
     openpic_irqs[0] =
         g_malloc0(smp_cpus * sizeof(qemu_irq) * OPENPIC_OUTPUT_NB);
     for (i = 0; i < smp_cpus; i++) {
diff --git a/hw/ppc/mac_oldworld.c b/hw/ppc/mac_oldworld.c
index 2f27754..39b4ff3 100644
--- a/hw/ppc/mac_oldworld.c
+++ b/hw/ppc/mac_oldworld.c
@@ -231,7 +231,7 @@ static void ppc_heathrow_init(QEMUMachineInitArgs *args)
     memory_region_add_subregion(sysmem, 0xfe000000, isa);
 
     /* XXX: we register only 1 output pin for heathrow PIC */
-    heathrow_irqs = g_malloc0(smp_cpus * sizeof(qemu_irq *));
+    heathrow_irqs = g_new0(qemu_irq *, smp_cpus);
     heathrow_irqs[0] =
         g_malloc0(smp_cpus * sizeof(qemu_irq) * 1);
     /* Connect the heathrow PIC outputs to the 6xx bus */
diff --git a/hw/ppc/ppc.c b/hw/ppc/ppc.c
index 114be64..d148080 100644
--- a/hw/ppc/ppc.c
+++ b/hw/ppc/ppc.c
@@ -802,7 +802,7 @@ clk_setup_cb cpu_ppc_tb_init (CPUPPCState *env, uint32_t 
freq)
     PowerPCCPU *cpu = ppc_env_get_cpu(env);
     ppc_tb_t *tb_env;
 
-    tb_env = g_malloc0(sizeof(ppc_tb_t));
+    tb_env = g_new0(ppc_tb_t, 1);
     env->tb_env = tb_env;
     tb_env->flags = PPC_DECR_UNDERFLOW_TRIGGERED;
     /* Create new timer */
@@ -1066,10 +1066,10 @@ clk_setup_cb ppc_40x_timers_init (CPUPPCState *env, 
uint32_t freq,
     ppc_tb_t *tb_env;
     ppc40x_timer_t *ppc40x_timer;
 
-    tb_env = g_malloc0(sizeof(ppc_tb_t));
+    tb_env = g_new0(ppc_tb_t, 1);
     env->tb_env = tb_env;
     tb_env->flags = PPC_DECR_UNDERFLOW_TRIGGERED;
-    ppc40x_timer = g_malloc0(sizeof(ppc40x_timer_t));
+    ppc40x_timer = g_new0(ppc40x_timer_t, 1);
     tb_env->tb_freq = freq;
     tb_env->decr_freq = freq;
     tb_env->opaque = ppc40x_timer;
@@ -1174,7 +1174,7 @@ int ppc_dcr_init (CPUPPCState *env, int (*read_error)(int 
dcrn),
 {
     ppc_dcr_t *dcr_env;
 
-    dcr_env = g_malloc0(sizeof(ppc_dcr_t));
+    dcr_env = g_new0(ppc_dcr_t, 1);
     dcr_env->read_error = read_error;
     dcr_env->write_error = write_error;
     env->dcr_env = dcr_env;
diff --git a/hw/ppc/ppc405_boards.c b/hw/ppc/ppc405_boards.c
index f1a8f67..233841d 100644
--- a/hw/ppc/ppc405_boards.c
+++ b/hw/ppc/ppc405_boards.c
@@ -165,7 +165,7 @@ static void ref405ep_fpga_init(MemoryRegion *sysmem, 
uint32_t base)
     ref405ep_fpga_t *fpga;
     MemoryRegion *fpga_memory = g_new(MemoryRegion, 1);
 
-    fpga = g_malloc0(sizeof(ref405ep_fpga_t));
+    fpga = g_new0(ref405ep_fpga_t, 1);
     memory_region_init_io(fpga_memory, NULL, &ref405ep_fpga_ops, fpga,
                           "fpga", 0x00000100);
     memory_region_add_subregion(sysmem, base, fpga_memory);
@@ -493,7 +493,7 @@ static void taihu_cpld_init(MemoryRegion *sysmem, uint32_t 
base)
     taihu_cpld_t *cpld;
     MemoryRegion *cpld_memory = g_new(MemoryRegion, 1);
 
-    cpld = g_malloc0(sizeof(taihu_cpld_t));
+    cpld = g_new0(taihu_cpld_t, 1);
     memory_region_init_io(cpld_memory, NULL, &taihu_cpld_ops, cpld, "cpld", 
0x100);
     memory_region_add_subregion(sysmem, base, cpld_memory);
     qemu_register_reset(&taihu_cpld_reset, cpld);
diff --git a/hw/ppc/ppc405_uc.c b/hw/ppc/ppc405_uc.c
index 8109f92..f6a6b33 100644
--- a/hw/ppc/ppc405_uc.c
+++ b/hw/ppc/ppc405_uc.c
@@ -173,7 +173,7 @@ static void ppc4xx_plb_init(CPUPPCState *env)
 {
     ppc4xx_plb_t *plb;
 
-    plb = g_malloc0(sizeof(ppc4xx_plb_t));
+    plb = g_new0(ppc4xx_plb_t, 1);
     ppc_dcr_register(env, PLB0_ACR, plb, &dcr_read_plb, &dcr_write_plb);
     ppc_dcr_register(env, PLB0_BEAR, plb, &dcr_read_plb, &dcr_write_plb);
     ppc_dcr_register(env, PLB0_BESR, plb, &dcr_read_plb, &dcr_write_plb);
@@ -255,7 +255,7 @@ static void ppc4xx_pob_init(CPUPPCState *env)
 {
     ppc4xx_pob_t *pob;
 
-    pob = g_malloc0(sizeof(ppc4xx_pob_t));
+    pob = g_new0(ppc4xx_pob_t, 1);
     ppc_dcr_register(env, POB0_BEAR, pob, &dcr_read_pob, &dcr_write_pob);
     ppc_dcr_register(env, POB0_BESR0, pob, &dcr_read_pob, &dcr_write_pob);
     ppc_dcr_register(env, POB0_BESR1, pob, &dcr_read_pob, &dcr_write_pob);
@@ -386,7 +386,7 @@ static void ppc4xx_opba_init(hwaddr base)
 {
     ppc4xx_opba_t *opba;
 
-    opba = g_malloc0(sizeof(ppc4xx_opba_t));
+    opba = g_new0(ppc4xx_opba_t, 1);
 #ifdef DEBUG_OPBA
     printf("%s: offset " TARGET_FMT_plx "\n", __func__, base);
 #endif
@@ -584,7 +584,7 @@ static void ppc405_ebc_init(CPUPPCState *env)
 {
     ppc4xx_ebc_t *ebc;
 
-    ebc = g_malloc0(sizeof(ppc4xx_ebc_t));
+    ebc = g_new0(ppc4xx_ebc_t, 1);
     qemu_register_reset(&ebc_reset, ebc);
     ppc_dcr_register(env, EBC0_CFGADDR,
                      ebc, &dcr_read_ebc, &dcr_write_ebc);
@@ -667,7 +667,7 @@ static void ppc405_dma_init(CPUPPCState *env, qemu_irq 
irqs[4])
 {
     ppc405_dma_t *dma;
 
-    dma = g_malloc0(sizeof(ppc405_dma_t));
+    dma = g_new0(ppc405_dma_t, 1);
     memcpy(dma->irqs, irqs, 4 * sizeof(qemu_irq));
     qemu_register_reset(&ppc405_dma_reset, dma);
     ppc_dcr_register(env, DMA0_CR0,
@@ -808,7 +808,7 @@ static void ppc405_gpio_init(hwaddr base)
 {
     ppc405_gpio_t *gpio;
 
-    gpio = g_malloc0(sizeof(ppc405_gpio_t));
+    gpio = g_new0(ppc405_gpio_t, 1);
 #ifdef DEBUG_GPIO
     printf("%s: offset " TARGET_FMT_plx "\n", __func__, base);
 #endif
@@ -970,7 +970,7 @@ static void ppc405_ocm_init(CPUPPCState *env)
 {
     ppc405_ocm_t *ocm;
 
-    ocm = g_malloc0(sizeof(ppc405_ocm_t));
+    ocm = g_new0(ppc405_ocm_t, 1);
     /* XXX: Size is 4096 or 0x04000000 */
     memory_region_init_ram(&ocm->isarc_ram, NULL, "ppc405.ocm", 4096);
     vmstate_register_ram_global(&ocm->isarc_ram);
@@ -1217,7 +1217,7 @@ static void ppc405_i2c_init(hwaddr base, qemu_irq irq)
 {
     ppc4xx_i2c_t *i2c;
 
-    i2c = g_malloc0(sizeof(ppc4xx_i2c_t));
+    i2c = g_new0(ppc4xx_i2c_t, 1);
     i2c->irq = irq;
 #ifdef DEBUG_I2C
     printf("%s: offset " TARGET_FMT_plx "\n", __func__, base);
@@ -1493,7 +1493,7 @@ static void ppc4xx_gpt_init(hwaddr base, qemu_irq irqs[5])
     ppc4xx_gpt_t *gpt;
     int i;
 
-    gpt = g_malloc0(sizeof(ppc4xx_gpt_t));
+    gpt = g_new0(ppc4xx_gpt_t, 1);
     for (i = 0; i < 5; i++) {
         gpt->irqs[i] = irqs[i];
     }
@@ -1724,7 +1724,7 @@ static void ppc405_mal_init(CPUPPCState *env, qemu_irq 
irqs[4])
     ppc40x_mal_t *mal;
     int i;
 
-    mal = g_malloc0(sizeof(ppc40x_mal_t));
+    mal = g_new0(ppc40x_mal_t, 1);
     for (i = 0; i < 4; i++)
         mal->irqs[i] = irqs[i];
     qemu_register_reset(&ppc40x_mal_reset, mal);
@@ -2081,7 +2081,7 @@ static void ppc405cr_cpc_init (CPUPPCState *env, 
clk_setup_t clk_setup[7],
 {
     ppc405cr_cpc_t *cpc;
 
-    cpc = g_malloc0(sizeof(ppc405cr_cpc_t));
+    cpc = g_new0(ppc405cr_cpc_t, 1);
     memcpy(cpc->clk_setup, clk_setup,
            PPC405CR_CLK_NB * sizeof(clk_setup_t));
     cpc->sysclk = sysclk;
@@ -2131,7 +2131,7 @@ CPUPPCState *ppc405cr_init(MemoryRegion 
*address_space_mem,
     /* OBP arbitrer */
     ppc4xx_opba_init(0xef600600);
     /* Universal interrupt controller */
-    irqs = g_malloc0(sizeof(qemu_irq) * PPCUIC_OUTPUT_NB);
+    irqs = g_new0(qemu_irq, PPCUIC_OUTPUT_NB);
     irqs[PPCUIC_OUTPUT_INT] =
         ((qemu_irq *)env->irq_inputs)[PPC40x_INPUT_INT];
     irqs[PPCUIC_OUTPUT_CINT] =
@@ -2425,7 +2425,7 @@ static void ppc405ep_cpc_init (CPUPPCState *env, 
clk_setup_t clk_setup[8],
 {
     ppc405ep_cpc_t *cpc;
 
-    cpc = g_malloc0(sizeof(ppc405ep_cpc_t));
+    cpc = g_new0(ppc405ep_cpc_t, 1);
     memcpy(cpc->clk_setup, clk_setup,
            PPC405EP_CLK_NB * sizeof(clk_setup_t));
     cpc->jtagid = 0x20267049;
@@ -2488,7 +2488,7 @@ CPUPPCState *ppc405ep_init(MemoryRegion 
*address_space_mem,
     /* Initialize timers */
     ppc_booke_timers_init(cpu, sysclk, 0);
     /* Universal interrupt controller */
-    irqs = g_malloc0(sizeof(qemu_irq) * PPCUIC_OUTPUT_NB);
+    irqs = g_new0(qemu_irq, PPCUIC_OUTPUT_NB);
     irqs[PPCUIC_OUTPUT_INT] =
         ((qemu_irq *)env->irq_inputs)[PPC40x_INPUT_INT];
     irqs[PPCUIC_OUTPUT_CINT] =
diff --git a/hw/ppc/ppc440_bamboo.c b/hw/ppc/ppc440_bamboo.c
index ec15bab..806d533 100644
--- a/hw/ppc/ppc440_bamboo.c
+++ b/hw/ppc/ppc440_bamboo.c
@@ -199,7 +199,7 @@ static void bamboo_init(QEMUMachineInitArgs *args)
     ppc_dcr_init(env, NULL, NULL);
 
     /* interrupt controller */
-    irqs = g_malloc0(sizeof(qemu_irq) * PPCUIC_OUTPUT_NB);
+    irqs = g_new0(qemu_irq, PPCUIC_OUTPUT_NB);
     irqs[PPCUIC_OUTPUT_INT] = ((qemu_irq *)env->irq_inputs)[PPC40x_INPUT_INT];
     irqs[PPCUIC_OUTPUT_CINT] = ((qemu_irq 
*)env->irq_inputs)[PPC40x_INPUT_CINT];
     pic = ppcuic_init(env, irqs, 0x0C0, 0, 1);
diff --git a/hw/ppc/ppc4xx_devs.c b/hw/ppc/ppc4xx_devs.c
index 239aada..72a3ae4 100644
--- a/hw/ppc/ppc4xx_devs.c
+++ b/hw/ppc/ppc4xx_devs.c
@@ -304,7 +304,7 @@ qemu_irq *ppcuic_init (CPUPPCState *env, qemu_irq *irqs,
     ppcuic_t *uic;
     int i;
 
-    uic = g_malloc0(sizeof(ppcuic_t));
+    uic = g_new0(ppcuic_t, 1);
     uic->dcr_base = dcr_base;
     uic->irqs = irqs;
     if (has_vr)
@@ -652,7 +652,7 @@ void ppc4xx_sdram_init (CPUPPCState *env, qemu_irq irq, int 
nbanks,
 {
     ppc4xx_sdram_t *sdram;
 
-    sdram = g_malloc0(sizeof(ppc4xx_sdram_t));
+    sdram = g_new0(ppc4xx_sdram_t, 1);
     sdram->irq = irq;
     sdram->nbanks = nbanks;
     sdram->ram_memories = ram_memories;
diff --git a/hw/ppc/ppc_booke.c b/hw/ppc/ppc_booke.c
index d839960..ffb0567 100644
--- a/hw/ppc/ppc_booke.c
+++ b/hw/ppc/ppc_booke.c
@@ -333,8 +333,8 @@ void ppc_booke_timers_init(PowerPCCPU *cpu, uint32_t freq, 
uint32_t flags)
     booke_timer_t *booke_timer;
     int ret = 0;
 
-    tb_env      = g_malloc0(sizeof(ppc_tb_t));
-    booke_timer = g_malloc0(sizeof(booke_timer_t));
+    tb_env      = g_new0(ppc_tb_t, 1);
+    booke_timer = g_new0(booke_timer_t, 1);
 
     cpu->env.tb_env = tb_env;
     tb_env->flags = flags | PPC_TIMER_BOOKE | PPC_DECR_ZERO_TRIGGERED;
diff --git a/hw/ppc/prep.c b/hw/ppc/prep.c
index aad0f69..6288ba5 100644
--- a/hw/ppc/prep.c
+++ b/hw/ppc/prep.c
@@ -479,7 +479,7 @@ static void ppc_prep_init(QEMUMachineInitArgs *args)
     int ppc_boot_device;
     DriveInfo *hd[MAX_IDE_BUS * MAX_IDE_DEVS];
 
-    sysctrl = g_malloc0(sizeof(sysctrl_t));
+    sysctrl = g_new0(sysctrl_t, 1);
 
     linux_boot = (kernel_filename != NULL);
 
diff --git a/hw/ppc/virtex_ml507.c b/hw/ppc/virtex_ml507.c
index bdb057e..00fe0f5 100644
--- a/hw/ppc/virtex_ml507.c
+++ b/hw/ppc/virtex_ml507.c
@@ -98,7 +98,7 @@ static PowerPCCPU *ppc440_init_xilinx(ram_addr_t *ram_size,
     ppc_dcr_init(env, NULL, NULL);
 
     /* interrupt controller */
-    irqs = g_malloc0(sizeof(qemu_irq) * PPCUIC_OUTPUT_NB);
+    irqs = g_new0(qemu_irq, PPCUIC_OUTPUT_NB);
     irqs[PPCUIC_OUTPUT_INT] = ((qemu_irq *)env->irq_inputs)[PPC40x_INPUT_INT];
     irqs[PPCUIC_OUTPUT_CINT] = ((qemu_irq 
*)env->irq_inputs)[PPC40x_INPUT_CINT];
     ppcuic_init(env, irqs, 0x0C0, 0, 1);
diff --git a/hw/s390x/css.c b/hw/s390x/css.c
index 101da63..0140121 100644
--- a/hw/s390x/css.c
+++ b/hw/s390x/css.c
@@ -61,7 +61,7 @@ int css_create_css_image(uint8_t cssid, bool default_image)
     if (channel_subsys->css[cssid]) {
         return -EBUSY;
     }
-    channel_subsys->css[cssid] = g_malloc0(sizeof(CssImage));
+    channel_subsys->css[cssid] = g_new0(CssImage, 1);
     if (default_image) {
         channel_subsys->default_cssid = cssid;
     }
@@ -1120,7 +1120,7 @@ void css_subch_assign(uint8_t cssid, uint8_t ssid, 
uint16_t schid,
     css = channel_subsys->css[cssid];
 
     if (!css->sch_set[ssid]) {
-        css->sch_set[ssid] = g_malloc0(sizeof(SubchSet));
+        css->sch_set[ssid] = g_new0(SubchSet, 1);
     }
     s_set = css->sch_set[ssid];
 
diff --git a/hw/s390x/event-facility.c b/hw/s390x/event-facility.c
index 25951a0..371e67c 100644
--- a/hw/s390x/event-facility.c
+++ b/hw/s390x/event-facility.c
@@ -318,7 +318,7 @@ static int init_event_facility(S390SCLPDevice *sdev)
     SCLPEventFacility *event_facility;
     DeviceState *quiesce;
 
-    event_facility = g_malloc0(sizeof(SCLPEventFacility));
+    event_facility = g_new0(SCLPEventFacility, 1);
     sdev->ef = event_facility;
     sdev->sclp_command_handler = command_handler;
     sdev->event_pending = event_pending;
diff --git a/hw/s390x/s390-virtio.c b/hw/s390x/s390-virtio.c
index 7adf92a..7548a67 100644
--- a/hw/s390x/s390-virtio.c
+++ b/hw/s390x/s390-virtio.c
@@ -184,7 +184,7 @@ void s390_init_cpus(const char *cpu_model, uint8_t 
*storage_keys)
         cpu_model = "host";
     }
 
-    ipi_states = g_malloc(sizeof(S390CPU *) * smp_cpus);
+    ipi_states = g_new(S390CPU *, smp_cpus);
 
     for (i = 0; i < smp_cpus; i++) {
         S390CPU *cpu;
diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c
index bc88712..d85c995 100644
--- a/hw/s390x/virtio-ccw.c
+++ b/hw/s390x/virtio-ccw.c
@@ -494,7 +494,7 @@ static int virtio_ccw_device_init(VirtioCcwDevice *dev, 
VirtIODevice *vdev)
     int num;
     DeviceState *parent = DEVICE(dev);
 
-    sch = g_malloc0(sizeof(SubchDev));
+    sch = g_new0(SubchDev, 1);
 
     sch->driver_data = dev;
     dev->sch = sch;
diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c
index cb30414..bc828f2 100644
--- a/hw/scsi/lsi53c895a.c
+++ b/hw/scsi/lsi53c895a.c
@@ -780,7 +780,7 @@ static void lsi_do_command(LSIState *s)
     }
 
     assert(s->current == NULL);
-    s->current = g_malloc0(sizeof(lsi_request));
+    s->current = g_new0(lsi_request, 1);
     s->current->tag = s->select_tag;
     s->current->req = scsi_req_new(dev, s->current->tag, s->current_lun, buf,
                                    s->current);
diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
index 6610b3a..356ff63 100644
--- a/hw/scsi/virtio-scsi.c
+++ b/hw/scsi/virtio-scsi.c
@@ -602,7 +602,7 @@ void virtio_scsi_common_realize(DeviceState *dev, Error 
**errp)
     virtio_init(vdev, "virtio-scsi", VIRTIO_ID_SCSI,
                 sizeof(VirtIOSCSIConfig));
 
-    s->cmd_vqs = g_malloc0(s->conf.num_queues * sizeof(VirtQueue *));
+    s->cmd_vqs = g_new0(VirtQueue *, s->conf.num_queues);
     s->sense_size = VIRTIO_SCSI_SENSE_SIZE;
     s->cdb_size = VIRTIO_SCSI_CDB_SIZE;
 
diff --git a/hw/sd/omap_mmc.c b/hw/sd/omap_mmc.c
index 937a478..6ee7dd5 100644
--- a/hw/sd/omap_mmc.c
+++ b/hw/sd/omap_mmc.c
@@ -577,8 +577,7 @@ struct omap_mmc_s *omap_mmc_init(hwaddr base,
                 BlockDriverState *bd,
                 qemu_irq irq, qemu_irq dma[], omap_clk clk)
 {
-    struct omap_mmc_s *s = (struct omap_mmc_s *)
-            g_malloc0(sizeof(struct omap_mmc_s));
+    struct omap_mmc_s *s = g_new0(struct omap_mmc_s, 1);
 
     s->irq = irq;
     s->dma = dma;
@@ -604,8 +603,7 @@ struct omap_mmc_s *omap2_mmc_init(struct 
omap_target_agent_s *ta,
                 BlockDriverState *bd, qemu_irq irq, qemu_irq dma[],
                 omap_clk fclk, omap_clk iclk)
 {
-    struct omap_mmc_s *s = (struct omap_mmc_s *)
-            g_malloc0(sizeof(struct omap_mmc_s));
+    struct omap_mmc_s *s = g_new0(struct omap_mmc_s, 1);
 
     s->irq = irq;
     s->dma = dma;
diff --git a/hw/sd/pxa2xx_mmci.c b/hw/sd/pxa2xx_mmci.c
index b9d8b1a..5a70a3b 100644
--- a/hw/sd/pxa2xx_mmci.c
+++ b/hw/sd/pxa2xx_mmci.c
@@ -528,7 +528,7 @@ PXA2xxMMCIState *pxa2xx_mmci_init(MemoryRegion *sysmem,
 {
     PXA2xxMMCIState *s;
 
-    s = (PXA2xxMMCIState *) g_malloc0(sizeof(PXA2xxMMCIState));
+    s = g_new0(PXA2xxMMCIState, 1);
     s->irq = irq;
     s->rx_dma = rx_dma;
     s->tx_dma = tx_dma;
diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index 4502ad1..337ccdf 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -499,7 +499,7 @@ SDState *sd_init(BlockDriverState *bs, bool is_spi)
         return NULL;
     }
 
-    sd = (SDState *) g_malloc0(sizeof(SDState));
+    sd = g_new0(SDState, 1);
     sd->buf = qemu_blockalign(bs, 512);
     sd->spi = is_spi;
     sd->enable = true;
diff --git a/hw/sh4/r2d.c b/hw/sh4/r2d.c
index 7b1de85..81e17f1 100644
--- a/hw/sh4/r2d.c
+++ b/hw/sh4/r2d.c
@@ -182,7 +182,7 @@ static qemu_irq *r2d_fpga_init(MemoryRegion *sysmem,
 {
     r2d_fpga_t *s;
 
-    s = g_malloc0(sizeof(r2d_fpga_t));
+    s = g_new0(r2d_fpga_t, 1);
 
     s->irl = irl;
 
@@ -249,7 +249,7 @@ static void r2d_init(QEMUMachineInitArgs *args)
     }
     env = &cpu->env;
 
-    reset_info = g_malloc0(sizeof(ResetData));
+    reset_info = g_new0(ResetData, 1);
     reset_info->cpu = cpu;
     reset_info->vector = env->pc;
     qemu_register_reset(main_cpu_reset, reset_info);
diff --git a/hw/sh4/sh7750.c b/hw/sh4/sh7750.c
index 1439ba4..0fd813b 100644
--- a/hw/sh4/sh7750.c
+++ b/hw/sh4/sh7750.c
@@ -727,7 +727,7 @@ SH7750State *sh7750_init(SuperHCPU *cpu, MemoryRegion 
*sysmem)
 {
     SH7750State *s;
 
-    s = g_malloc0(sizeof(SH7750State));
+    s = g_new0(SH7750State, 1);
     s->cpu = cpu;
     s->periph_freq = 60000000; /* 60MHz */
     memory_region_init_io(&s->iomem, NULL, &sh7750_mem_ops, s,
diff --git a/hw/sparc/leon3.c b/hw/sparc/leon3.c
index c583c3d..423f485 100644
--- a/hw/sparc/leon3.c
+++ b/hw/sparc/leon3.c
@@ -131,7 +131,7 @@ static void leon3_generic_hw_init(QEMUMachineInitArgs *args)
     cpu_sparc_set_id(env, 0);
 
     /* Reset data */
-    reset_info        = g_malloc0(sizeof(ResetData));
+    reset_info        = g_new0(ResetData, 1);
     reset_info->cpu   = cpu;
     qemu_register_reset(main_cpu_reset, reset_info);
 
diff --git a/hw/sparc64/sun4u.c b/hw/sparc64/sun4u.c
index 6f271d9..2b4978a 100644
--- a/hw/sparc64/sun4u.c
+++ b/hw/sparc64/sun4u.c
@@ -380,7 +380,7 @@ static CPUTimer *cpu_timer_create(const char *name, 
SPARCCPU *cpu,
                                   QEMUBHFunc *cb, uint32_t frequency,
                                   uint64_t disabled_mask)
 {
-    CPUTimer *timer = g_malloc0(sizeof (CPUTimer));
+    CPUTimer *timer = g_new0(CPUTimer, 1);
 
     timer->name = name;
     timer->frequency = frequency;
@@ -802,7 +802,7 @@ static SPARCCPU *cpu_devinit(const char *cpu_model, const 
struct hwdef *hwdef)
     env->hstick = cpu_timer_create("hstick", cpu, hstick_irq,
                                     hstick_frequency, TICK_INT_DIS);
 
-    reset_info = g_malloc0(sizeof(ResetData));
+    reset_info = g_new0(ResetData, 1);
     reset_info->cpu = cpu;
     reset_info->prom_addr = hwdef->prom_addr;
     qemu_register_reset(main_cpu_reset, reset_info);
diff --git a/hw/ssi/omap_spi.c b/hw/ssi/omap_spi.c
index 0ed3b11..10a472a 100644
--- a/hw/ssi/omap_spi.c
+++ b/hw/ssi/omap_spi.c
@@ -341,8 +341,7 @@ static const MemoryRegionOps omap_mcspi_ops = {
 struct omap_mcspi_s *omap_mcspi_init(struct omap_target_agent_s *ta, int chnum,
                 qemu_irq irq, qemu_irq *drq, omap_clk fclk, omap_clk iclk)
 {
-    struct omap_mcspi_s *s = (struct omap_mcspi_s *)
-            g_malloc0(sizeof(struct omap_mcspi_s));
+    struct omap_mcspi_s *s = g_new0(struct omap_mcspi_s, 1);
     struct omap_mcspi_ch_s *ch = s->ch;
 
     s->irq = irq;
diff --git a/hw/timer/arm_timer.c b/hw/timer/arm_timer.c
index a47afde..2ee448c 100644
--- a/hw/timer/arm_timer.c
+++ b/hw/timer/arm_timer.c
@@ -165,7 +165,7 @@ static arm_timer_state *arm_timer_init(uint32_t freq)
     arm_timer_state *s;
     QEMUBH *bh;
 
-    s = (arm_timer_state *)g_malloc0(sizeof(arm_timer_state));
+    s = g_new0(arm_timer_state, 1);
     s->freq = freq;
     s->control = TIMER_CTRL_IE;
 
diff --git a/hw/timer/omap_gptimer.c b/hw/timer/omap_gptimer.c
index 016207f..c2ef701 100644
--- a/hw/timer/omap_gptimer.c
+++ b/hw/timer/omap_gptimer.c
@@ -468,8 +468,7 @@ static const MemoryRegionOps omap_gp_timer_ops = {
 struct omap_gp_timer_s *omap_gp_timer_init(struct omap_target_agent_s *ta,
                 qemu_irq irq, omap_clk fclk, omap_clk iclk)
 {
-    struct omap_gp_timer_s *s = (struct omap_gp_timer_s *)
-            g_malloc0(sizeof(struct omap_gp_timer_s));
+    struct omap_gp_timer_s *s = g_new0(struct omap_gp_timer_s, 1);
 
     s->ta = ta;
     s->irq = irq;
diff --git a/hw/timer/sh_timer.c b/hw/timer/sh_timer.c
index 07f0670..1d105bc 100644
--- a/hw/timer/sh_timer.c
+++ b/hw/timer/sh_timer.c
@@ -191,7 +191,7 @@ static void *sh_timer_init(uint32_t freq, int feat, 
qemu_irq irq)
     sh_timer_state *s;
     QEMUBH *bh;
 
-    s = (sh_timer_state *)g_malloc0(sizeof(sh_timer_state));
+    s = g_new0(sh_timer_state, 1);
     s->freq = freq;
     s->feat = feat;
     s->tcor = 0xffffffff;
@@ -312,7 +312,7 @@ void tmu012_init(MemoryRegion *sysmem, hwaddr base,
     tmu012_state *s;
     int timer_feat = (feat & TMU012_FEAT_EXTCLK) ? TIMER_FEAT_EXTCLK : 0;
 
-    s = (tmu012_state *)g_malloc0(sizeof(tmu012_state));
+    s = g_new0(tmu012_state, 1);
     s->feat = feat;
     s->timer[0] = sh_timer_init(freq, timer_feat, ch0_irq);
     s->timer[1] = sh_timer_init(freq, timer_feat, ch1_irq);
diff --git a/hw/timer/slavio_timer.c b/hw/timer/slavio_timer.c
index f75b914..dea7695 100644
--- a/hw/timer/slavio_timer.c
+++ b/hw/timer/slavio_timer.c
@@ -390,7 +390,7 @@ static int slavio_timer_init1(SysBusDevice *dev)
         uint64_t size;
         char timer_name[20];
 
-        tc = g_malloc0(sizeof(TimerContext));
+        tc = g_new0(TimerContext, 1);
         tc->s = s;
         tc->timer_index = i;
 
diff --git a/hw/usb/ccid-card-emulated.c b/hw/usb/ccid-card-emulated.c
index aa913df..fb48f60 100644
--- a/hw/usb/ccid-card-emulated.c
+++ b/hw/usb/ccid-card-emulated.c
@@ -169,7 +169,7 @@ static void emulated_push_event(EmulatedState *card, 
EmulEvent *event)
 
 static void emulated_push_type(EmulatedState *card, uint32_t type)
 {
-    EmulEvent *event = (EmulEvent *)g_malloc(sizeof(EmulEvent));
+    EmulEvent *event = g_new(EmulEvent, 1);
 
     assert(event);
     event->p.gen.type = type;
@@ -178,7 +178,7 @@ static void emulated_push_type(EmulatedState *card, 
uint32_t type)
 
 static void emulated_push_error(EmulatedState *card, uint64_t code)
 {
-    EmulEvent *event = (EmulEvent *)g_malloc(sizeof(EmulEvent));
+    EmulEvent *event = g_new(EmulEvent, 1);
 
     assert(event);
     event->p.error.type = EMUL_ERROR;
diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
index bafe085..30f209c 100644
--- a/hw/usb/hcd-xhci.c
+++ b/hw/usb/hcd-xhci.c
@@ -2173,7 +2173,7 @@ static void xhci_kick_ep(XHCIState *xhci, unsigned int 
slotid,
             xfer->trbs = NULL;
         }
         if (!xfer->trbs) {
-            xfer->trbs = g_malloc(sizeof(XHCITRB) * length);
+            xfer->trbs = g_new(XHCITRB, length);
             xfer->trb_alloced = length;
         }
         xfer->trb_count = length;
diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
index 287a505..6b63bd4 100644
--- a/hw/usb/redirect.c
+++ b/hw/usb/redirect.c
@@ -314,7 +314,7 @@ static void packet_id_queue_add(struct PacketIdQueue *q, 
uint64_t id)
 
     DPRINTF("adding packet id %"PRIu64" to %s queue\n", id, q->name);
 
-    e = g_malloc0(sizeof(struct PacketIdQueueEntry));
+    e = g_new0(struct PacketIdQueueEntry, 1);
     e->id = id;
     QTAILQ_INSERT_TAIL(&q->head, e, next);
     q->size++;
@@ -460,7 +460,7 @@ static void bufp_alloc(USBRedirDevice *dev, uint8_t *data, 
uint16_t len,
         dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0;
     }
 
-    bufp = g_malloc(sizeof(struct buf_packet));
+    bufp = g_new(struct buf_packet, 1);
     bufp->data   = data;
     bufp->len    = len;
     bufp->offset = 0;
@@ -2126,7 +2126,7 @@ static int usbredir_get_bufpq(QEMUFile *f, void *priv, 
size_t unused)
 
     endp->bufpq_size = qemu_get_be32(f);
     for (i = 0; i < endp->bufpq_size; i++) {
-        bufp = g_malloc(sizeof(struct buf_packet));
+        bufp = g_new(struct buf_packet, 1);
         bufp->len = qemu_get_be32(f);
         bufp->status = qemu_get_be32(f);
         bufp->offset = 0;
diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index a001e66..999f0bb 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -993,7 +993,7 @@ void virtio_init(VirtIODevice *vdev, const char *name,
     vdev->isr = 0;
     vdev->queue_sel = 0;
     vdev->config_vector = VIRTIO_NO_VECTOR;
-    vdev->vq = g_malloc0(sizeof(VirtQueue) * VIRTIO_PCI_QUEUE_MAX);
+    vdev->vq = g_new0(VirtQueue, VIRTIO_PCI_QUEUE_MAX);
     vdev->vm_running = runstate_is_running();
     for (i = 0; i < VIRTIO_PCI_QUEUE_MAX; i++) {
         vdev->vq[i].vector = VIRTIO_NO_VECTOR;
diff --git a/hw/xtensa/xtensa_lx60.c b/hw/xtensa/xtensa_lx60.c
index 22e124d..7aec5db 100644
--- a/hw/xtensa/xtensa_lx60.c
+++ b/hw/xtensa/xtensa_lx60.c
@@ -107,7 +107,7 @@ static const MemoryRegionOps lx60_fpga_ops = {
 static Lx60FpgaState *lx60_fpga_init(MemoryRegion *address_space,
         hwaddr base)
 {
-    Lx60FpgaState *s = g_malloc(sizeof(Lx60FpgaState));
+    Lx60FpgaState *s = g_new(Lx60FpgaState, 1);
 
     memory_region_init_io(&s->iomem, NULL, &lx60_fpga_ops, s,
             "lx60.fpga", 0x10000);
diff --git a/include/qemu/timer.h b/include/qemu/timer.h
index 5afcffc..0553cde 100644
--- a/include/qemu/timer.h
+++ b/include/qemu/timer.h
@@ -439,7 +439,7 @@ static inline QEMUTimer *timer_new_tl(QEMUTimerList 
*timer_list,
                                       QEMUTimerCB *cb,
                                       void *opaque)
 {
-    QEMUTimer *ts = g_malloc0(sizeof(QEMUTimer));
+    QEMUTimer *ts = g_new0(QEMUTimer, 1);
     timer_init(ts, timer_list, scale, cb, opaque);
     return ts;
 }
diff --git a/iohandler.c b/iohandler.c
index ae2ef8f..38d7ab6 100644
--- a/iohandler.c
+++ b/iohandler.c
@@ -71,7 +71,7 @@ int qemu_set_fd_handler2(int fd,
             if (ioh->fd == fd)
                 goto found;
         }
-        ioh = g_malloc0(sizeof(IOHandlerRecord));
+        ioh = g_new0(IOHandlerRecord, 1);
         QLIST_INSERT_HEAD(&io_handlers, ioh, next);
     found:
         ioh->fd = fd;
@@ -209,7 +209,7 @@ int qemu_add_child_watch(pid_t pid)
             return 1;
         }
     }
-    rec = g_malloc0(sizeof(ChildProcessRecord));
+    rec = g_new0(ChildProcessRecord, 1);
     rec->pid = pid;
     QLIST_INSERT_HEAD(&child_watches, rec, next);
     return 0;
diff --git a/kvm-all.c b/kvm-all.c
index a3fb8de..43ed133 100644
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -1151,7 +1151,7 @@ int kvm_irqchip_send_msi(KVMState *s, MSIMessage msg)
             return virq;
         }
 
-        route = g_malloc0(sizeof(KVMMSIRoute));
+        route = g_new0(KVMMSIRoute, 1);
         route->kroute.gsi = virq;
         route->kroute.type = KVM_IRQ_ROUTING_MSI;
         route->kroute.flags = 0;
@@ -1351,7 +1351,7 @@ int kvm_init(void)
     int ret;
     int i;
 
-    s = g_malloc0(sizeof(KVMState));
+    s = g_new0(KVMState, 1);
 
     /*
      * On systems where the kernel can support different base page
@@ -1394,7 +1394,7 @@ int kvm_init(void)
         s->nr_slots = 32;
     }
 
-    s->slots = g_malloc0(s->nr_slots * sizeof(KVMSlot));
+    s->slots = g_new0(KVMSlot, s->nr_slots);
 
     for (i = 0; i < s->nr_slots; i++) {
         s->slots[i].slot = i;
@@ -1913,7 +1913,7 @@ int kvm_insert_breakpoint(CPUState *cpu, target_ulong 
addr,
             return 0;
         }
 
-        bp = g_malloc(sizeof(struct kvm_sw_breakpoint));
+        bp = g_new(struct kvm_sw_breakpoint, 1);
         if (!bp) {
             return -ENOMEM;
         }
diff --git a/libcacard/cac.c b/libcacard/cac.c
index 74ef3e3..7c6706c 100644
--- a/libcacard/cac.c
+++ b/libcacard/cac.c
@@ -312,7 +312,7 @@ cac_new_pki_applet_private(const unsigned char *cert,
 {
     CACPKIAppletData *pki_applet_data = NULL;
     VCardAppletPrivate *applet_private = NULL;
-    applet_private = (VCardAppletPrivate 
*)g_malloc(sizeof(VCardAppletPrivate));
+    applet_private = g_new(VCardAppletPrivate, 1);
 
     pki_applet_data = &(applet_private->u.pki_data);
     pki_applet_data->cert_buffer = NULL;
diff --git a/libcacard/card_7816.c b/libcacard/card_7816.c
index c28bb60..7958244 100644
--- a/libcacard/card_7816.c
+++ b/libcacard/card_7816.c
@@ -51,7 +51,7 @@ vcard_response_new_data(unsigned char *buf, int len)
 {
     VCardResponse *new_response;
 
-    new_response = (VCardResponse *)g_malloc(sizeof(VCardResponse));
+    new_response = g_new(VCardResponse, 1);
     new_response->b_data = g_malloc(len + 2);
     memcpy(new_response->b_data, buf, len);
     new_response->b_total_len = len+2;
@@ -132,7 +132,7 @@ vcard_response_new_status(vcard_7816_status_t status)
 {
     VCardResponse *new_response;
 
-    new_response = (VCardResponse *)g_malloc(sizeof(VCardResponse));
+    new_response = g_new(VCardResponse, 1);
     new_response->b_data = &new_response->b_sw1;
     new_response->b_len = 0;
     new_response->b_total_len = 2;
@@ -149,7 +149,7 @@ vcard_response_new_status_bytes(unsigned char sw1, unsigned 
char sw2)
 {
     VCardResponse *new_response;
 
-    new_response = (VCardResponse *)g_malloc(sizeof(VCardResponse));
+    new_response = g_new(VCardResponse, 1);
     new_response->b_data = &new_response->b_sw1;
     new_response->b_len = 0;
     new_response->b_total_len = 2;
@@ -336,7 +336,7 @@ vcard_apdu_new(unsigned char *raw_apdu, int len, 
vcard_7816_status_t *status)
         return NULL;
     }
 
-    new_apdu = (VCardAPDU *)g_malloc(sizeof(VCardAPDU));
+    new_apdu = g_new(VCardAPDU, 1);
     new_apdu->a_data = g_malloc(len);
     memcpy(new_apdu->a_data, raw_apdu, len);
     new_apdu->a_len = len;
diff --git a/libcacard/event.c b/libcacard/event.c
index 2d7500f..a2e6c7d 100644
--- a/libcacard/event.c
+++ b/libcacard/event.c
@@ -17,7 +17,7 @@ vevent_new(VEventType type, VReader *reader, VCard *card)
 {
     VEvent *new_vevent;
 
-    new_vevent = (VEvent *)g_malloc(sizeof(VEvent));
+    new_vevent = g_new(VEvent, 1);
     new_vevent->next = NULL;
     new_vevent->type = type;
     new_vevent->reader = vreader_reference(reader);
diff --git a/libcacard/vcard.c b/libcacard/vcard.c
index 539177b..7fe585e 100644
--- a/libcacard/vcard.c
+++ b/libcacard/vcard.c
@@ -37,7 +37,7 @@ vcard_buffer_response_new(unsigned char *buffer, int size)
 {
     VCardBufferResponse *new_buffer;
 
-    new_buffer = (VCardBufferResponse *)g_malloc(sizeof(VCardBufferResponse));
+    new_buffer = g_new(VCardBufferResponse, 1);
     new_buffer->buffer = (unsigned char *)g_malloc(size);
     memcpy(new_buffer->buffer, buffer, size);
     new_buffer->buffer_len = size;
@@ -102,7 +102,7 @@ vcard_new_applet(VCardProcessAPDU applet_process_function,
 {
     VCardApplet *applet;
 
-    applet = (VCardApplet *)g_malloc(sizeof(VCardApplet));
+    applet = g_new(VCardApplet, 1);
     applet->next = NULL;
     applet->applet_private = NULL;
     applet->applet_private_free = NULL;
@@ -151,7 +151,7 @@ vcard_new(VCardEmul *private, VCardEmulFree private_free)
     VCard *new_card;
     int i;
 
-    new_card = (VCard *)g_malloc(sizeof(VCard));
+    new_card = g_new(VCard, 1);
     new_card->applet_list = NULL;
     for (i = 0; i < MAX_CHANNEL; i++) {
         new_card->current_applet[i] = NULL;
diff --git a/libcacard/vcard_emul_nss.c b/libcacard/vcard_emul_nss.c
index ee2dfae..34325bf 100644
--- a/libcacard/vcard_emul_nss.c
+++ b/libcacard/vcard_emul_nss.c
@@ -94,9 +94,9 @@ static void
 vcard_emul_alloc_arrays(unsigned char ***certsp, int **cert_lenp,
                         VCardKey ***keysp, int cert_count)
 {
-    *certsp = (unsigned char **)g_malloc(sizeof(unsigned char *)*cert_count);
-    *cert_lenp = (int *)g_malloc(sizeof(int)*cert_count);
-    *keysp = (VCardKey **)g_malloc(sizeof(VCardKey *)*cert_count);
+    *certsp = g_new(unsigned char *, cert_count);
+    *cert_lenp = g_new(int, cert_count);
+    *keysp = g_new(VCardKey *, cert_count);
 }
 
 /*
@@ -139,7 +139,7 @@ vcard_emul_make_key(PK11SlotInfo *slot, CERTCertificate 
*cert)
 {
     VCardKey *key;
 
-    key = (VCardKey *)g_malloc(sizeof(VCardKey));
+    key = g_new(VCardKey, 1);
     key->slot = PK11_ReferenceSlot(slot);
     key->cert = CERT_DupCertificate(cert);
     /* NOTE: if we aren't logged into the token, this could return NULL */
@@ -449,7 +449,7 @@ vreader_emul_new(PK11SlotInfo *slot, VCardEmulType type, 
const char *params)
 {
     VReaderEmul *new_reader_emul;
 
-    new_reader_emul = (VReaderEmul *)g_malloc(sizeof(VReaderEmul));
+    new_reader_emul = g_new(VReaderEmul, 1);
 
     new_reader_emul->slot = PK11_ReferenceSlot(slot);
     new_reader_emul->default_type = type;
@@ -1188,7 +1188,7 @@ vcard_emul_options(const char *args)
                 g_strndup(type_params, type_params_length);
             count = count_tokens(args, ',', ')') + 1;
             vreaderOpt->cert_count = count;
-            vreaderOpt->cert_name = (char **)g_malloc(count*sizeof(char *));
+            vreaderOpt->cert_name = g_new(char *, count);
             for (i = 0; i < count; i++) {
                 const char *cert = args;
                 args = strpbrk(args, ",)");
diff --git a/libcacard/vreader.c b/libcacard/vreader.c
index 5793d73..6a5a86f 100644
--- a/libcacard/vreader.c
+++ b/libcacard/vreader.c
@@ -115,7 +115,7 @@ vreader_new(const char *name, VReaderEmul *private,
 {
     VReader *reader;
 
-    reader = (VReader *)g_malloc(sizeof(VReader));
+    reader = g_new(VReader, 1);
     qemu_mutex_init(&reader->lock);
     reader->reference_count = 1;
     reader->name = g_strdup(name);
@@ -312,8 +312,7 @@ vreader_list_entry_new(VReader *reader)
 {
     VReaderListEntry *new_reader_list_entry;
 
-    new_reader_list_entry = (VReaderListEntry *)
-                               g_malloc(sizeof(VReaderListEntry));
+    new_reader_list_entry = g_new(VReaderListEntry, 1);
     new_reader_list_entry->next = NULL;
     new_reader_list_entry->prev = NULL;
     new_reader_list_entry->reader = vreader_reference(reader);
@@ -336,7 +335,7 @@ vreader_list_new(void)
 {
     VReaderList *new_reader_list;
 
-    new_reader_list = (VReaderList *)g_malloc(sizeof(VReaderList));
+    new_reader_list = g_new(VReaderList, 1);
     new_reader_list->head = NULL;
     new_reader_list->tail = NULL;
     return new_reader_list;
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 5902f16..8686f2f 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -2648,7 +2648,7 @@ static int fill_note_info(struct elf_note_info *info,
 
     QTAILQ_INIT(&info->thread_list);
 
-    info->notes = g_malloc0(NUMNOTES * sizeof (struct memelfnote));
+    info->notes = g_new0(struct memelfnote, NUMNOTES);
     if (info->notes == NULL)
         return (-ENOMEM);
     info->prstatus = g_malloc0(sizeof (*info->prstatus));
diff --git a/linux-user/main.c b/linux-user/main.c
index cabc9e1..81e08c3 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -3974,7 +3974,7 @@ int main(int argc, char **argv, char **envp)
     }
     target_argv[target_argc] = NULL;
 
-    ts = g_malloc0 (sizeof(TaskState));
+    ts = g_new0(TaskState, 1);
     init_task_state(ts);
     /* build Task State */
     ts->info = info;
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 0ac05b8..22694ee 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -4410,7 +4410,7 @@ static int do_fork(CPUArchState *env, unsigned int flags, 
abi_ulong newsp,
         new_thread_info info;
         pthread_attr_t attr;
 
-        ts = g_malloc0(sizeof(TaskState));
+        ts = g_new0(TaskState, 1);
         init_task_state(ts);
         /* we create a new CPU instance. */
         new_env = cpu_copy(env);
diff --git a/main-loop.c b/main-loop.c
index c3c9c28..e5fe902 100644
--- a/main-loop.c
+++ b/main-loop.c
@@ -249,7 +249,7 @@ static PollingEntry *first_polling_entry;
 int qemu_add_polling_cb(PollingFunc *func, void *opaque)
 {
     PollingEntry **ppe, *pe;
-    pe = g_malloc0(sizeof(PollingEntry));
+    pe = g_new0(PollingEntry, 1);
     pe->func = func;
     pe->opaque = opaque;
     for(ppe = &first_polling_entry; *ppe != NULL; ppe = &(*ppe)->next);
diff --git a/memory_mapping.c b/memory_mapping.c
index 87a6ed5..8b72fdc 100644
--- a/memory_mapping.c
+++ b/memory_mapping.c
@@ -42,7 +42,7 @@ static void create_new_memory_mapping(MemoryMappingList *list,
 {
     MemoryMapping *memory_mapping;
 
-    memory_mapping = g_malloc(sizeof(MemoryMapping));
+    memory_mapping = g_new(MemoryMapping, 1);
     memory_mapping->phys_addr = phys_addr;
     memory_mapping->virt_addr = virt_addr;
     memory_mapping->length = length;
diff --git a/migration-rdma.c b/migration-rdma.c
index f94f3b4..b5695b7 100644
--- a/migration-rdma.c
+++ b/migration-rdma.c
@@ -547,7 +547,7 @@ static int __qemu_rdma_add_block(RDMAContext *rdma, void 
*host_addr,
 
     assert(block == NULL);
 
-    local->block = g_malloc0(sizeof(RDMALocalBlock) * (local->nb_blocks + 1));
+    local->block = g_new0(RDMALocalBlock, local->nb_blocks + 1);
 
     if (local->nb_blocks) {
         int x;
@@ -572,7 +572,7 @@ static int __qemu_rdma_add_block(RDMAContext *rdma, void 
*host_addr,
     bitmap_clear(block->transit_bitmap, 0, block->nb_chunks);
     block->unregister_bitmap = bitmap_new(block->nb_chunks);
     bitmap_clear(block->unregister_bitmap, 0, block->nb_chunks);
-    block->remote_keys = g_malloc0(block->nb_chunks * sizeof(uint32_t));
+    block->remote_keys = g_new0(uint32_t, block->nb_chunks);
 
     block->is_ram_block = local->init ? false : true;
 
@@ -615,8 +615,7 @@ static int qemu_rdma_init_ram_blocks(RDMAContext *rdma)
     memset(local, 0, sizeof *local);
     qemu_ram_foreach_block(qemu_rdma_init_one_block, rdma);
     DPRINTF("Allocated %d local ram block structures\n", local->nb_blocks);
-    rdma->block = (RDMARemoteBlock *) g_malloc0(sizeof(RDMARemoteBlock) *
-                        rdma->local_ram_blocks.nb_blocks);
+    rdma->block = g_new0(RDMARemoteBlock, rdma->local_ram_blocks.nb_blocks);
     local->init = true;
     return 0;
 }
@@ -666,8 +665,7 @@ static int __qemu_rdma_delete_block(RDMAContext *rdma, 
ram_addr_t block_offset)
 
     if (local->nb_blocks > 1) {
 
-        local->block = g_malloc0(sizeof(RDMALocalBlock) *
-                                    (local->nb_blocks - 1));
+        local->block = g_new0(RDMALocalBlock, local->nb_blocks - 1);
 
         if (block->index) {
             memcpy(local->block, old, sizeof(RDMALocalBlock) * block->index);
@@ -1145,7 +1143,7 @@ static int qemu_rdma_register_and_get_keys(RDMAContext 
*rdma,
 
     /* allocate memory to store chunk MRs */
     if (!block->pmr) {
-        block->pmr = g_malloc0(block->nb_chunks * sizeof(struct ibv_mr *));
+        block->pmr = g_new0(struct ibv_mr *, block->nb_chunks);
         if (!block->pmr) {
             return -1;
         }
@@ -2500,7 +2498,7 @@ static void *qemu_rdma_data_init(const char *host_port, 
Error **errp)
     InetSocketAddress *addr;
 
     if (host_port) {
-        rdma = g_malloc0(sizeof(RDMAContext));
+        rdma = g_new0(RDMAContext, 1);
         memset(rdma, 0, sizeof(RDMAContext));
         rdma->current_index = -1;
         rdma->current_chunk = -1;
@@ -3314,7 +3312,7 @@ const QEMUFileOps rdma_write_ops = {
 
 static void *qemu_fopen_rdma(RDMAContext *rdma, const char *mode)
 {
-    QEMUFileRDMA *r = g_malloc0(sizeof(QEMUFileRDMA));
+    QEMUFileRDMA *r = g_new0(QEMUFileRDMA, 1);
 
     if (qemu_file_mode_is_not_valid(mode)) {
         return NULL;
diff --git a/monitor.c b/monitor.c
index 80456fb..da508a5 100644
--- a/monitor.c
+++ b/monitor.c
@@ -2246,7 +2246,7 @@ void qmp_getfd(const char *fdname, Error **errp)
         return;
     }
 
-    monfd = g_malloc0(sizeof(mon_fd_t));
+    monfd = g_new0(mon_fd_t, 1);
     monfd->name = g_strdup(fdname);
     monfd->fd = fd;
 
@@ -4926,7 +4926,7 @@ void monitor_init(CharDriverState *chr, int flags)
     }
 
     if (monitor_ctrl_mode(mon)) {
-        mon->mc = g_malloc0(sizeof(MonitorControl));
+        mon->mc = g_new0(MonitorControl, 1);
         /* Control mode requires special handlers */
         qemu_chr_add_handlers(chr, monitor_can_read, monitor_control_read,
                               monitor_control_event, mon);
diff --git a/nbd.c b/nbd.c
index 030f56b..f0a1468 100644
--- a/nbd.c
+++ b/nbd.c
@@ -872,7 +872,7 @@ NBDExport *nbd_export_new(BlockDriverState *bs, off_t 
dev_offset,
                           off_t size, uint32_t nbdflags,
                           void (*close)(NBDExport *))
 {
-    NBDExport *exp = g_malloc0(sizeof(NBDExport));
+    NBDExport *exp = g_new0(NBDExport, 1);
     exp->refcount = 1;
     QTAILQ_INIT(&exp->clients);
     exp->bs = bs;
@@ -1235,7 +1235,7 @@ NBDClient *nbd_client_new(NBDExport *exp, int csock,
                           void (*close)(NBDClient *))
 {
     NBDClient *client;
-    client = g_malloc0(sizeof(NBDClient));
+    client = g_new0(NBDClient, 1);
     client->refcount = 1;
     client->exp = exp;
     client->sock = csock;
diff --git a/net/queue.c b/net/queue.c
index 859d02a..8567b2d 100644
--- a/net/queue.c
+++ b/net/queue.c
@@ -62,7 +62,7 @@ NetQueue *qemu_new_net_queue(void *opaque)
 {
     NetQueue *queue;
 
-    queue = g_malloc0(sizeof(NetQueue));
+    queue = g_new0(NetQueue, 1);
 
     queue->opaque = opaque;
     queue->nq_maxlen = 10000;
diff --git a/net/slirp.c b/net/slirp.c
index 124e953..5579081 100644
--- a/net/slirp.c
+++ b/net/slirp.c
@@ -632,7 +632,7 @@ static int slirp_guestfwd(SlirpState *s, const char 
*config_str,
         goto fail_syntax;
     }
 
-    fwd = g_malloc(sizeof(struct GuestFwd));
+    fwd = g_new(struct GuestFwd, 1);
     snprintf(buf, sizeof(buf), "guestfwd.tcp.%d", port);
 
     if ((strlen(p) > 4) && !strncmp(p, "cmd:", 4)) {
diff --git a/qemu-char.c b/qemu-char.c
index 30c5a6a..8fc29d7 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -236,7 +236,7 @@ static CharDriverState *qemu_chr_open_null(void)
 {
     CharDriverState *chr;
 
-    chr = g_malloc0(sizeof(CharDriverState));
+    chr = g_new0(CharDriverState, 1);
     chr->chr_write = null_chr_write;
     chr->explicit_be_open = true;
     return chr;
@@ -524,8 +524,8 @@ static CharDriverState *qemu_chr_open_mux(CharDriverState 
*drv)
     CharDriverState *chr;
     MuxDriver *d;
 
-    chr = g_malloc0(sizeof(CharDriverState));
-    d = g_malloc0(sizeof(MuxDriver));
+    chr = g_new0(CharDriverState, 1);
+    d = g_new0(MuxDriver, 1);
 
     chr->opaque = d;
     d->drv = drv;
@@ -899,8 +899,8 @@ static CharDriverState *qemu_chr_open_fd(int fd_in, int 
fd_out)
     CharDriverState *chr;
     FDCharDriver *s;
 
-    chr = g_malloc0(sizeof(CharDriverState));
-    s = g_malloc0(sizeof(FDCharDriver));
+    chr = g_new0(CharDriverState, 1);
+    s = g_new0(FDCharDriver, 1);
     s->fd_in = io_channel_from_fd(fd_in);
     s->fd_out = io_channel_from_fd(fd_out);
     fcntl(fd_out, F_SETFL, O_NONBLOCK);
@@ -1175,7 +1175,7 @@ static CharDriverState *qemu_chr_open_pty(const char *id,
 
     close(slave_fd);
 
-    chr = g_malloc0(sizeof(CharDriverState));
+    chr = g_new0(CharDriverState, 1);
 
     chr->filename = g_strdup_printf("pty:%s", pty_name);
     ret->pty = g_strdup(pty_name);
@@ -1184,7 +1184,7 @@ static CharDriverState *qemu_chr_open_pty(const char *id,
     fprintf(stderr, "char device redirected to %s (label %s)\n",
             pty_name, id);
 
-    s = g_malloc0(sizeof(PtyCharDriver));
+    s = g_new0(PtyCharDriver, 1);
     chr->opaque = s;
     chr->chr_write = pty_chr_write;
     chr->chr_update_read_handler = pty_chr_update_read_handler;
@@ -1533,11 +1533,11 @@ static CharDriverState *qemu_chr_open_pp_fd(int fd)
         return NULL;
     }
 
-    drv = g_malloc0(sizeof(ParallelCharDriver));
+    drv = g_new0(ParallelCharDriver, 1);
     drv->fd = fd;
     drv->mode = IEEE1284_MODE_COMPAT;
 
-    chr = g_malloc0(sizeof(CharDriverState));
+    chr = g_new0(CharDriverState, 1);
     chr->chr_write = null_chr_write;
     chr->chr_ioctl = pp_ioctl;
     chr->chr_close = pp_close;
@@ -1592,7 +1592,7 @@ static CharDriverState *qemu_chr_open_pp_fd(int fd)
 {
     CharDriverState *chr;
 
-    chr = g_malloc0(sizeof(CharDriverState));
+    chr = g_new0(CharDriverState, 1);
     chr->opaque = (void *)(intptr_t)fd;
     chr->chr_write = null_chr_write;
     chr->chr_ioctl = pp_ioctl;
@@ -1816,8 +1816,8 @@ static CharDriverState *qemu_chr_open_win_path(const char 
*filename)
     CharDriverState *chr;
     WinCharState *s;
 
-    chr = g_malloc0(sizeof(CharDriverState));
-    s = g_malloc0(sizeof(WinCharState));
+    chr = g_new0(CharDriverState, 1);
+    s = g_new0(WinCharState, 1);
     chr->opaque = s;
     chr->chr_write = win_chr_write;
     chr->chr_close = win_chr_close;
@@ -1915,8 +1915,8 @@ static CharDriverState *qemu_chr_open_pipe(ChardevHostdev 
*opts)
     CharDriverState *chr;
     WinCharState *s;
 
-    chr = g_malloc0(sizeof(CharDriverState));
-    s = g_malloc0(sizeof(WinCharState));
+    chr = g_new0(CharDriverState, 1);
+    s = g_new0(WinCharState, 1);
     chr->opaque = s;
     chr->chr_write = win_chr_write;
     chr->chr_close = win_chr_close;
@@ -1934,8 +1934,8 @@ static CharDriverState *qemu_chr_open_win_file(HANDLE 
fd_out)
     CharDriverState *chr;
     WinCharState *s;
 
-    chr = g_malloc0(sizeof(CharDriverState));
-    s = g_malloc0(sizeof(WinCharState));
+    chr = g_new0(CharDriverState, 1);
+    s = g_new0(WinCharState, 1);
     s->hcom = fd_out;
     chr->opaque = s;
     chr->chr_write = win_chr_write;
@@ -2090,8 +2090,8 @@ static CharDriverState *qemu_chr_open_stdio(ChardevStdio 
*opts)
     DWORD              dwMode;
     int                is_console = 0;
 
-    chr   = g_malloc0(sizeof(CharDriverState));
-    stdio = g_malloc0(sizeof(WinStdioCharState));
+    chr   = g_new0(CharDriverState, 1);
+    stdio = g_new0(WinStdioCharState, 1);
 
     stdio->hStdIn = GetStdHandle(STD_INPUT_HANDLE);
     if (stdio->hStdIn == INVALID_HANDLE_VALUE) {
@@ -2252,8 +2252,8 @@ static CharDriverState *qemu_chr_open_udp_fd(int fd)
     CharDriverState *chr = NULL;
     NetCharDriver *s = NULL;
 
-    chr = g_malloc0(sizeof(CharDriverState));
-    s = g_malloc0(sizeof(NetCharDriver));
+    chr = g_new0(CharDriverState, 1);
+    s = g_new0(NetCharDriver, 1);
 
     s->fd = fd;
     s->chan = io_channel_from_socket(s->fd);
@@ -2625,8 +2625,8 @@ static CharDriverState *qemu_chr_open_socket_fd(int fd, 
bool do_nodelay,
         return NULL;
     }
 
-    chr = g_malloc0(sizeof(CharDriverState));
-    s = g_malloc0(sizeof(TCPCharDriver));
+    chr = g_new0(CharDriverState, 1);
+    s = g_new0(TCPCharDriver, 1);
 
     s->connected = 0;
     s->fd = -1;
@@ -2809,7 +2809,7 @@ static CharDriverState 
*qemu_chr_open_ringbuf(ChardevRingbuf *opts,
     CharDriverState *chr;
     RingBufCharDriver *d;
 
-    chr = g_malloc0(sizeof(CharDriverState));
+    chr = g_new0(CharDriverState, 1);
     d = g_malloc(sizeof(*d));
 
     d->size = opts->has_size ? opts->size : 65536;
diff --git a/qemu-file.c b/qemu-file.c
index 9473b67..502e6f8 100644
--- a/qemu-file.c
+++ b/qemu-file.c
@@ -195,7 +195,7 @@ QEMUFile *qemu_popen_cmd(const char *command, const char 
*mode)
         return NULL;
     }
 
-    s = g_malloc0(sizeof(QEMUFileStdio));
+    s = g_new0(QEMUFileStdio, 1);
 
     s->stdio_file = stdio_file;
 
@@ -315,7 +315,7 @@ QEMUFile *qemu_fdopen(int fd, const char *mode)
         return NULL;
     }
 
-    s = g_malloc0(sizeof(QEMUFileSocket));
+    s = g_new0(QEMUFileSocket, 1);
     s->fd = fd;
 
     if (mode[0] == 'r') {
@@ -358,7 +358,7 @@ QEMUFile *qemu_fopen_socket(int fd, const char *mode)
         return NULL;
     }
 
-    s = g_malloc0(sizeof(QEMUFileSocket));
+    s = g_new0(QEMUFileSocket, 1);
     s->fd = fd;
     if (mode[0] == 'w') {
         qemu_set_block(s->fd);
@@ -377,7 +377,7 @@ QEMUFile *qemu_fopen(const char *filename, const char *mode)
         return NULL;
     }
 
-    s = g_malloc0(sizeof(QEMUFileStdio));
+    s = g_new0(QEMUFileStdio, 1);
 
     s->stdio_file = fopen(filename, mode);
     if (!s->stdio_file) {
@@ -399,7 +399,7 @@ QEMUFile *qemu_fopen_ops(void *opaque, const QEMUFileOps 
*ops)
 {
     QEMUFile *f;
 
-    f = g_malloc0(sizeof(QEMUFile));
+    f = g_new0(QEMUFile, 1);
 
     f->opaque = opaque;
     f->ops = ops;
diff --git a/qemu-img.c b/qemu-img.c
index c989850..f0ca6e2 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -1260,7 +1260,7 @@ static int img_convert(int argc, char **argv)
 
     qemu_progress_print(0, 100);
 
-    bs = g_malloc0(bs_n * sizeof(BlockDriverState *));
+    bs = g_new0(BlockDriverState *, bs_n);
 
     total_sectors = 0;
     for (bs_i = 0; bs_i < bs_n; bs_i++) {
diff --git a/qemu-io-cmds.c b/qemu-io-cmds.c
index f1de24c..95170b2 100644
--- a/qemu-io-cmds.c
+++ b/qemu-io-cmds.c
@@ -114,7 +114,7 @@ static char **breakline(char *input, int *count)
 {
     int c = 0;
     char *p;
-    char **rval = g_malloc0(sizeof(char *));
+    char **rval = g_new0(char *, 1);
     char **tmp;
 
     while (rval && (p = qemu_strsep(&input, " ")) != NULL) {
diff --git a/qemu-io.c b/qemu-io.c
index d669028..1ee5f12 100644
--- a/qemu-io.c
+++ b/qemu-io.c
@@ -341,7 +341,7 @@ static void command_loop(void)
 
 static void add_user_command(char *optarg)
 {
-    cmdline = g_realloc(cmdline, ++ncmdline * sizeof(char *));
+    cmdline = g_renew(char *, cmdline, ++ncmdline);
     cmdline[ncmdline-1] = optarg;
 }
 
diff --git a/qemu-timer.c b/qemu-timer.c
index e15ce47..4e64a04 100644
--- a/qemu-timer.c
+++ b/qemu-timer.c
@@ -102,7 +102,7 @@ QEMUTimerList *timerlist_new(QEMUClockType type,
     QEMUTimerList *timer_list;
     QEMUClock *clock = qemu_clock_ptr(type);
 
-    timer_list = g_malloc0(sizeof(QEMUTimerList));
+    timer_list = g_new0(QEMUTimerList, 1);
     qemu_event_init(&timer_list->timers_done_ev, false);
     timer_list->clock = clock;
     timer_list->notify_cb = cb;
diff --git a/qga/channel-posix.c b/qga/channel-posix.c
index e65dda3..6f87f35 100644
--- a/qga/channel-posix.c
+++ b/qga/channel-posix.c
@@ -249,7 +249,7 @@ GIOStatus ga_channel_read(GAChannel *c, gchar *buf, gsize 
size, gsize *count)
 GAChannel *ga_channel_new(GAChannelMethod method, const gchar *path,
                           GAChannelCallback cb, gpointer opaque)
 {
-    GAChannel *c = g_malloc0(sizeof(GAChannel));
+    GAChannel *c = g_new0(GAChannel, 1);
     c->event_cb = cb;
     c->user_data = opaque;
 
diff --git a/qga/channel-win32.c b/qga/channel-win32.c
index 8a303f3..b5b4a1e 100644
--- a/qga/channel-win32.c
+++ b/qga/channel-win32.c
@@ -306,7 +306,7 @@ static gboolean ga_channel_open(GAChannel *c, 
GAChannelMethod method,
 GAChannel *ga_channel_new(GAChannelMethod method, const gchar *path,
                           GAChannelCallback cb, gpointer opaque)
 {
-    GAChannel *c = g_malloc0(sizeof(GAChannel));
+    GAChannel *c = g_new0(GAChannel, 1);
     SECURITY_ATTRIBUTES sec_attrs;
 
     if (!ga_channel_open(c, method, path)) {
diff --git a/qga/commands-posix.c b/qga/commands-posix.c
index 8763308..74cbdd5 100644
--- a/qga/commands-posix.c
+++ b/qga/commands-posix.c
@@ -217,7 +217,7 @@ static int64_t guest_file_handle_add(FILE *fh, Error **errp)
         return 0;
     }
 
-    gfh = g_malloc0(sizeof(GuestFileHandle));
+    gfh = g_new0(GuestFileHandle, 1);
     gfh->id = handle;
     gfh->fh = fh;
     QTAILQ_INSERT_TAIL(&guest_file_state.filehandles, gfh, next);
@@ -454,7 +454,7 @@ struct GuestFileRead *qmp_guest_file_read(int64_t handle, 
bool has_count,
         slog("guest-file-read failed, handle: %" PRId64, handle);
     } else {
         buf[read_count] = 0;
-        read_data = g_malloc0(sizeof(GuestFileRead));
+        read_data = g_new0(GuestFileRead, 1);
         read_data->count = read_count;
         read_data->eof = feof(fh);
         if (read_count) {
@@ -498,7 +498,7 @@ GuestFileWrite *qmp_guest_file_write(int64_t handle, const 
char *buf_b64,
         error_setg_errno(err, errno, "failed to write to file");
         slog("guest-file-write failed, handle: %" PRId64, handle);
     } else {
-        write_data = g_malloc0(sizeof(GuestFileWrite));
+        write_data = g_new0(GuestFileWrite, 1);
         write_data->count = write_count;
         write_data->eof = feof(fh);
     }
@@ -613,7 +613,7 @@ static void build_fs_mount_list(FsMountList *mounts, Error 
**err)
             continue;
         }
 
-        mount = g_malloc0(sizeof(FsMount));
+        mount = g_new0(FsMount, 1);
         mount->dirname = g_strdup(ment->mnt_dir);
         mount->devtype = g_strdup(ment->mnt_type);
 
diff --git a/qga/commands-win32.c b/qga/commands-win32.c
index a6a0af2..79edbb0 100644
--- a/qga/commands-win32.c
+++ b/qga/commands-win32.c
@@ -310,7 +310,7 @@ static DWORD WINAPI do_suspend(LPVOID opaque)
 
 void qmp_guest_suspend_disk(Error **err)
 {
-    GuestSuspendMode *mode = g_malloc(sizeof(GuestSuspendMode));
+    GuestSuspendMode *mode = g_new(GuestSuspendMode, 1);
 
     *mode = GUEST_SUSPEND_MODE_DISK;
     check_suspend_mode(*mode, err);
@@ -324,7 +324,7 @@ void qmp_guest_suspend_disk(Error **err)
 
 void qmp_guest_suspend_ram(Error **err)
 {
-    GuestSuspendMode *mode = g_malloc(sizeof(GuestSuspendMode));
+    GuestSuspendMode *mode = g_new(GuestSuspendMode, 1);
 
     *mode = GUEST_SUSPEND_MODE_RAM;
     check_suspend_mode(*mode, err);
diff --git a/qga/commands.c b/qga/commands.c
index a0c2de0..dabc9c4 100644
--- a/qga/commands.c
+++ b/qga/commands.c
@@ -51,12 +51,12 @@ static void qmp_command_info(QmpCommand *cmd, void *opaque)
     GuestAgentCommandInfo *cmd_info;
     GuestAgentCommandInfoList *cmd_info_list;
 
-    cmd_info = g_malloc0(sizeof(GuestAgentCommandInfo));
+    cmd_info = g_new0(GuestAgentCommandInfo, 1);
     cmd_info->name = g_strdup(qmp_command_name(cmd));
     cmd_info->enabled = qmp_command_is_enabled(cmd);
     cmd_info->success_response = qmp_has_success_response(cmd);
 
-    cmd_info_list = g_malloc0(sizeof(GuestAgentCommandInfoList));
+    cmd_info_list = g_new0(GuestAgentCommandInfoList, 1);
     cmd_info_list->value = cmd_info;
     cmd_info_list->next = info->supported_commands;
     info->supported_commands = cmd_info_list;
@@ -64,7 +64,7 @@ static void qmp_command_info(QmpCommand *cmd, void *opaque)
 
 struct GuestAgentInfo *qmp_guest_info(Error **err)
 {
-    GuestAgentInfo *info = g_malloc0(sizeof(GuestAgentInfo));
+    GuestAgentInfo *info = g_new0(GuestAgentInfo, 1);
 
     info->version = g_strdup(QEMU_VERSION);
     qmp_for_each_command(qmp_command_info, info);
diff --git a/qga/guest-agent-command-state.c b/qga/guest-agent-command-state.c
index 969da23..128c549 100644
--- a/qga/guest-agent-command-state.c
+++ b/qga/guest-agent-command-state.c
@@ -27,7 +27,7 @@ void ga_command_state_add(GACommandState *cs,
                           void (*init)(void),
                           void (*cleanup)(void))
 {
-    GACommandGroup *cg = g_malloc0(sizeof(GACommandGroup));
+    GACommandGroup *cg = g_new0(GACommandGroup, 1);
     cg->init = init;
     cg->cleanup = cleanup;
     cs->groups = g_slist_append(cs->groups, cg);
@@ -67,7 +67,7 @@ void ga_command_state_cleanup_all(GACommandState *cs)
 
 GACommandState *ga_command_state_new(void)
 {
-    GACommandState *cs = g_malloc0(sizeof(GACommandState));
+    GACommandState *cs = g_new0(GACommandState, 1);
     cs->groups = NULL;
     return cs;
 }
diff --git a/qga/main.c b/qga/main.c
index c58b26a..d81e89c 100644
--- a/qga/main.c
+++ b/qga/main.c
@@ -1057,7 +1057,7 @@ int main(int argc, char **argv)
     }
 #endif
 
-    s = g_malloc0(sizeof(GAState));
+    s = g_new0(GAState, 1);
     s->log_level = log_level;
     s->log_file = stderr;
 #ifdef CONFIG_FSFREEZE
diff --git a/qobject/json-parser.c b/qobject/json-parser.c
index e7947b3..283c04b 100644
--- a/qobject/json-parser.c
+++ b/qobject/json-parser.c
@@ -336,10 +336,10 @@ static JSONParserContext *parser_context_new(QList 
*tokens)
         return NULL;
     }
 
-    ctxt = g_malloc0(sizeof(JSONParserContext));
+    ctxt = g_new0(JSONParserContext, 1);
     ctxt->tokens.pos = 0;
     ctxt->tokens.count = count;
-    ctxt->tokens.buf = g_malloc(count * sizeof(QObject *));
+    ctxt->tokens.buf = g_new(QObject *, count);
     qlist_iter(tokens, tokens_append_from_iter, ctxt);
     ctxt->tokens.pos = 0;
 
diff --git a/savevm.c b/savevm.c
index a7dbe18..8646cd5 100644
--- a/savevm.c
+++ b/savevm.c
@@ -285,7 +285,7 @@ int register_savevm_live(DeviceState *dev,
 {
     SaveStateEntry *se;
 
-    se = g_malloc0(sizeof(SaveStateEntry));
+    se = g_new0(SaveStateEntry, 1);
     se->version_id = version_id;
     se->section_id = global_section_id++;
     se->ops = ops;
@@ -304,7 +304,7 @@ int register_savevm_live(DeviceState *dev,
             pstrcat(se->idstr, sizeof(se->idstr), "/");
             g_free(id);
 
-            se->compat = g_malloc0(sizeof(CompatEntry));
+            se->compat = g_new0(CompatEntry, 1);
             pstrcpy(se->compat->idstr, sizeof(se->compat->idstr), idstr);
             se->compat->instance_id = instance_id == -1 ?
                          calculate_compat_instance_id(idstr) : instance_id;
@@ -332,7 +332,7 @@ int register_savevm(DeviceState *dev,
                     LoadStateHandler *load_state,
                     void *opaque)
 {
-    SaveVMHandlers *ops = g_malloc0(sizeof(SaveVMHandlers));
+    SaveVMHandlers *ops = g_new0(SaveVMHandlers, 1);
     ops->save_state = save_state;
     ops->load_state = load_state;
     return register_savevm_live(dev, idstr, instance_id, version_id,
@@ -376,7 +376,7 @@ int vmstate_register_with_alias_id(DeviceState *dev, int 
instance_id,
     /* If this triggers, alias support can be dropped for the vmsd. */
     assert(alias_id == -1 || required_for_version >= vmsd->minimum_version_id);
 
-    se = g_malloc0(sizeof(SaveStateEntry));
+    se = g_new0(SaveStateEntry, 1);
     se->version_id = vmsd->version_id;
     se->section_id = global_section_id++;
     se->opaque = opaque;
@@ -391,7 +391,7 @@ int vmstate_register_with_alias_id(DeviceState *dev, int 
instance_id,
             pstrcat(se->idstr, sizeof(se->idstr), "/");
             g_free(id);
 
-            se->compat = g_malloc0(sizeof(CompatEntry));
+            se->compat = g_new0(CompatEntry, 1);
             pstrcpy(se->compat->idstr, sizeof(se->compat->idstr), vmsd->name);
             se->compat->instance_id = instance_id == -1 ?
                          calculate_compat_instance_id(vmsd->name) : 
instance_id;
@@ -1152,7 +1152,7 @@ void do_info_snapshots(Monitor *mon, const QDict *qdict)
         return;
     }
 
-    available_snapshots = g_malloc0(sizeof(int) * nb_sns);
+    available_snapshots = g_new0(int, nb_sns);
     total = 0;
     for (i = 0; i < nb_sns; i++) {
         sn = &sn_tab[i];
diff --git a/slirp/slirp.c b/slirp/slirp.c
index bad8dad..9a31d20 100644
--- a/slirp/slirp.c
+++ b/slirp/slirp.c
@@ -206,7 +206,7 @@ Slirp *slirp_init(int restricted, struct in_addr vnetwork,
                   struct in_addr vnameserver, const char **vdnssearch,
                   void *opaque)
 {
-    Slirp *slirp = g_malloc0(sizeof(Slirp));
+    Slirp *slirp = g_new0(Slirp, 1);
 
     slirp_init_once();
 
diff --git a/spice-qemu-char.c b/spice-qemu-char.c
index 16439c5..83e9f87 100644
--- a/spice-qemu-char.c
+++ b/spice-qemu-char.c
@@ -253,8 +253,8 @@ static CharDriverState *chr_open(const char *subtype)
     CharDriverState *chr;
     SpiceCharDriver *s;
 
-    chr = g_malloc0(sizeof(CharDriverState));
-    s = g_malloc0(sizeof(SpiceCharDriver));
+    chr = g_new0(CharDriverState, 1);
+    s = g_new0(SpiceCharDriver, 1);
     s->chr = chr;
     s->active = false;
     s->sin.subtype = g_strdup(subtype);
diff --git a/target-i386/kvm.c b/target-i386/kvm.c
index 0a21c30..e436bdc 100644
--- a/target-i386/kvm.c
+++ b/target-i386/kvm.c
@@ -270,7 +270,7 @@ static void kvm_hwpoison_page_add(ram_addr_t ram_addr)
             return;
         }
     }
-    page = g_malloc(sizeof(HWPoisonPage));
+    page = g_new(HWPoisonPage, 1);
     page->ram_addr = ram_addr;
     QLIST_INSERT_HEAD(&hwpoison_page_list, page, list);
 }
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 712438c..dad428d 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -305,8 +305,8 @@ void tcg_context_init(TCGContext *s)
         total_args += n;
     }
 
-    args_ct = g_malloc(sizeof(TCGArgConstraint) * total_args);
-    sorted_args = g_malloc(sizeof(int) * total_args);
+    args_ct = g_new(TCGArgConstraint, total_args);
+    sorted_args = g_new(int, total_args);
 
     for(op = 0; op < NB_OPS; op++) {
         def = &tcg_op_defs[op];
diff --git a/tests/test-qmp-commands.c b/tests/test-qmp-commands.c
index 5a3e82a..1fc8624 100644
--- a/tests/test-qmp-commands.c
+++ b/tests/test-qmp-commands.c
@@ -19,15 +19,15 @@ void qmp_user_def_cmd1(UserDefOne * ud1, Error **errp)
 UserDefTwo * qmp_user_def_cmd2(UserDefOne * ud1a, UserDefOne * ud1b, Error 
**errp)
 {
     UserDefTwo *ret;
-    UserDefOne *ud1c = g_malloc0(sizeof(UserDefOne));
-    UserDefOne *ud1d = g_malloc0(sizeof(UserDefOne));
+    UserDefOne *ud1c = g_new0(UserDefOne, 1);
+    UserDefOne *ud1d = g_new0(UserDefOne, 1);
 
     ud1c->string = strdup(ud1a->string);
     ud1c->integer = ud1a->integer;
     ud1d->string = strdup(ud1b->string);
     ud1d->integer = ud1b->integer;
 
-    ret = g_malloc0(sizeof(UserDefTwo));
+    ret = g_new0(UserDefTwo, 1);
     ret->string = strdup("blah1");
     ret->dict.string = strdup("blah2");
     ret->dict.dict.userdef = ud1c;
@@ -105,23 +105,23 @@ static void test_dealloc_types(void)
     UserDefOne *ud1test, *ud1a, *ud1b;
     UserDefOneList *ud1list;
 
-    ud1test = g_malloc0(sizeof(UserDefOne));
+    ud1test = g_new0(UserDefOne, 1);
     ud1test->integer = 42;
     ud1test->string = g_strdup("hi there 42");
 
     qapi_free_UserDefOne(ud1test);
 
-    ud1a = g_malloc0(sizeof(UserDefOne));
+    ud1a = g_new0(UserDefOne, 1);
     ud1a->integer = 43;
     ud1a->string = g_strdup("hi there 43");
 
-    ud1b = g_malloc0(sizeof(UserDefOne));
+    ud1b = g_new0(UserDefOne, 1);
     ud1b->integer = 44;
     ud1b->string = g_strdup("hi there 44");
 
-    ud1list = g_malloc0(sizeof(UserDefOneList));
+    ud1list = g_new0(UserDefOneList, 1);
     ud1list->value = ud1a;
-    ud1list->next = g_malloc0(sizeof(UserDefOneList));
+    ud1list->next = g_new0(UserDefOneList, 1);
     ud1list->next->value = ud1b;
 
     qapi_free_UserDefOneList(ud1list);
diff --git a/tests/test-qmp-output-visitor.c b/tests/test-qmp-output-visitor.c
index e073d83..01287ab 100644
--- a/tests/test-qmp-output-visitor.c
+++ b/tests/test-qmp-output-visitor.c
@@ -389,7 +389,7 @@ static void 
test_visitor_out_list_qapi_free(TestOutputVisitorData *data,
 
         p->value->string0 = g_strdup(string);
         p->value->dict1.string1 = g_strdup(string);
-        p->value->dict1.dict2.userdef1 = g_malloc0(sizeof(UserDefOne));
+        p->value->dict1.dict2.userdef1 = g_new0(UserDefOne, 1);
         p->value->dict1.dict2.userdef1->string = g_strdup(string);
         p->value->dict1.dict2.userdef1->integer = 42;
         p->value->dict1.dict2.string2 = g_strdup(string);
diff --git a/tests/test-visitor-serialization.c 
b/tests/test-visitor-serialization.c
index 9aaa587..3c18893 100644
--- a/tests/test-visitor-serialization.c
+++ b/tests/test-visitor-serialization.c
@@ -725,7 +725,7 @@ static void test_nested_struct_list(gconstpointer opaque)
     int i = 0;
 
     for (i = 0; i < 8; i++) {
-        tmp = g_malloc0(sizeof(UserDefNestedList));
+        tmp = g_new0(UserDefNestedList, 1);
         tmp->value = nested_struct_create();
         tmp->next = listp;
         listp = tmp;
diff --git a/translate-all.c b/translate-all.c
index 105c25a..cc7c7a8 100644
--- a/translate-all.c
+++ b/translate-all.c
@@ -585,7 +585,7 @@ static inline void code_gen_alloc(size_t tb_size)
     tcg_ctx.code_gen_max_blocks = tcg_ctx.code_gen_buffer_size /
             CODE_GEN_AVG_BLOCK_SIZE;
     tcg_ctx.tb_ctx.tbs =
-            g_malloc(tcg_ctx.code_gen_max_blocks * sizeof(TranslationBlock));
+            g_new(TranslationBlock, tcg_ctx.code_gen_max_blocks);
 }
 
 /* Must be called before using the QEMU cpus. 'tb_size' is the size
diff --git a/ui/console.c b/ui/console.c
index 502e160..d502acd 100644
--- a/ui/console.c
+++ b/ui/console.c
@@ -444,7 +444,7 @@ static void text_console_resize(QemuConsole *s)
     if (s->width < w1)
         w1 = s->width;
 
-    cells = g_malloc(s->width * s->total_height * sizeof(TextCell));
+    cells = g_new(TextCell, s->width * s->total_height);
     for(y = 0; y < s->total_height; y++) {
         c = &cells[y * s->width];
         if (w1 > 0) {
@@ -1731,7 +1731,7 @@ static CharDriverState *text_console_init(ChardevVC *vc)
     unsigned width = 0;
     unsigned height = 0;
 
-    chr = g_malloc0(sizeof(CharDriverState));
+    chr = g_new0(CharDriverState, 1);
 
     if (vc->has_width) {
         width = vc->width;
diff --git a/ui/curses.c b/ui/curses.c
index dbc3d5e..9ad9023 100644
--- a/ui/curses.c
+++ b/ui/curses.c
@@ -369,7 +369,7 @@ void curses_display_init(DisplayState *ds, int full_screen)
 
     curses_winch_init();
 
-    dcl = (DisplayChangeListener *) g_malloc0(sizeof(DisplayChangeListener));
+    dcl = g_new0(DisplayChangeListener, 1);
     dcl->ops = &dcl_ops;
     register_displaychangelistener(dcl);
 
diff --git a/ui/input.c b/ui/input.c
index 1c70f60..eb67026 100644
--- a/ui/input.c
+++ b/ui/input.c
@@ -303,7 +303,7 @@ void qmp_send_key(KeyValueList *keys, bool has_hold_time, 
int64_t hold_time,
         }
         kbd_put_keycode(keycode & SCANCODE_KEYCODEMASK);
 
-        keycodes = g_realloc(keycodes, sizeof(int) * (keycodes_size + 1));
+        keycodes = g_renew(int, keycodes, keycodes_size + 1);
         keycodes[keycodes_size++] = keycode;
     }
 
@@ -316,7 +316,7 @@ QEMUPutKbdEntry *qemu_add_kbd_event_handler(QEMUPutKBDEvent 
*func, void *opaque)
 {
     QEMUPutKbdEntry *entry;
 
-    entry = g_malloc0(sizeof(QEMUPutKbdEntry));
+    entry = g_new0(QEMUPutKbdEntry, 1);
     entry->put_kbd = func;
     entry->opaque = opaque;
     QTAILQ_INSERT_HEAD(&kbd_handlers, entry, next);
@@ -353,7 +353,7 @@ QEMUPutMouseEntry 
*qemu_add_mouse_event_handler(QEMUPutMouseEvent *func,
     QEMUPutMouseEntry *s;
     static int mouse_index = 0;
 
-    s = g_malloc0(sizeof(QEMUPutMouseEntry));
+    s = g_new0(QEMUPutMouseEntry, 1);
 
     s->qemu_put_mouse_event = func;
     s->qemu_put_mouse_event_opaque = opaque;
@@ -391,7 +391,7 @@ QEMUPutLEDEntry *qemu_add_led_event_handler(QEMUPutLEDEvent 
*func,
 {
     QEMUPutLEDEntry *s;
 
-    s = g_malloc0(sizeof(QEMUPutLEDEntry));
+    s = g_new0(QEMUPutLEDEntry, 1);
 
     s->put_led = func;
     s->opaque = opaque;
diff --git a/ui/keymaps.c b/ui/keymaps.c
index 80d658d..3eb057a 100644
--- a/ui/keymaps.c
+++ b/ui/keymaps.c
@@ -107,7 +107,7 @@ static kbd_layout_t *parse_keyboard_layout(const 
name2keysym_t *table,
     }
 
     if (!k)
-       k = g_malloc0(sizeof(kbd_layout_t));
+        k = g_new0(kbd_layout_t, 1);
 
     for(;;) {
        if (fgets(line, 1024, f) == NULL)
diff --git a/ui/sdl.c b/ui/sdl.c
index 9d8583c..976250b 100644
--- a/ui/sdl.c
+++ b/ui/sdl.c
@@ -950,7 +950,7 @@ void sdl_display_init(DisplayState *ds, int full_screen, 
int no_frame)
         sdl_grab_start();
     }
 
-    dcl = g_malloc0(sizeof(DisplayChangeListener));
+    dcl = g_new0(DisplayChangeListener, 1);
     dcl->ops = &dcl_ops;
     register_displaychangelistener(dcl);
 
diff --git a/ui/vnc-jobs.c b/ui/vnc-jobs.c
index 2d3fce8..426690f 100644
--- a/ui/vnc-jobs.c
+++ b/ui/vnc-jobs.c
@@ -78,7 +78,7 @@ static void vnc_unlock_queue(VncJobQueue *queue)
 
 VncJob *vnc_job_new(VncState *vs)
 {
-    VncJob *job = g_malloc0(sizeof(VncJob));
+    VncJob *job = g_new0(VncJob, 1);
 
     job->vs = vs;
     vnc_lock_queue(queue);
@@ -89,7 +89,7 @@ VncJob *vnc_job_new(VncState *vs)
 
 int vnc_job_add_rect(VncJob *job, int x, int y, int w, int h)
 {
-    VncRectEntry *entry = g_malloc0(sizeof(VncRectEntry));
+    VncRectEntry *entry = g_new0(VncRectEntry, 1);
 
     entry->rect.x = x;
     entry->rect.y = y;
@@ -292,7 +292,7 @@ disconnected:
 
 static VncJobQueue *vnc_queue_init(void)
 {
-    VncJobQueue *queue = g_malloc0(sizeof(VncJobQueue));
+    VncJobQueue *queue = g_new0(VncJobQueue, 1);
 
     qemu_cond_init(&queue->cond);
     qemu_mutex_init(&queue->mutex);
diff --git a/ui/vnc.c b/ui/vnc.c
index 5601cc3..adb52a2 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -2774,7 +2774,7 @@ static void vnc_refresh(DisplayChangeListener *dcl)
 static void vnc_connect(VncDisplay *vd, int csock,
                         bool skipauth, bool websocket)
 {
-    VncState *vs = g_malloc0(sizeof(VncState));
+    VncState *vs = g_new0(VncState, 1);
     int i;
 
     vs->csock = csock;
@@ -2793,7 +2793,7 @@ static void vnc_connect(VncDisplay *vd, int csock,
 
     vs->lossy_rect = g_malloc0(VNC_STAT_ROWS * sizeof (*vs->lossy_rect));
     for (i = 0; i < VNC_STAT_ROWS; ++i) {
-        vs->lossy_rect[i] = g_malloc0(VNC_STAT_COLS * sizeof (uint8_t));
+        vs->lossy_rect[i] = g_new0(uint8_t, VNC_STAT_COLS);
     }
 
     VNC_DEBUG("New client on socket %d\n", csock);
diff --git a/util/hbitmap.c b/util/hbitmap.c
index d936831..3a1acfc 100644
--- a/util/hbitmap.c
+++ b/util/hbitmap.c
@@ -378,7 +378,7 @@ void hbitmap_free(HBitmap *hb)
 
 HBitmap *hbitmap_alloc(uint64_t size, int granularity)
 {
-    HBitmap *hb = g_malloc0(sizeof (struct HBitmap));
+    HBitmap *hb = g_new0(struct HBitmap, 1);
     unsigned i;
 
     assert(granularity >= 0 && granularity < 64);
@@ -389,7 +389,7 @@ HBitmap *hbitmap_alloc(uint64_t size, int granularity)
     hb->granularity = granularity;
     for (i = HBITMAP_LEVELS; i-- > 0; ) {
         size = MAX((size + BITS_PER_LONG - 1) >> BITS_PER_LEVEL, 1);
-        hb->levels[i] = g_malloc0(size * sizeof(unsigned long));
+        hb->levels[i] = g_new0(unsigned long, size);
     }
 
     /* We necessarily have free bits in level 0 due to the definition
diff --git a/util/iov.c b/util/iov.c
index bb46c04..53ca7be 100644
--- a/util/iov.c
+++ b/util/iov.c
@@ -260,7 +260,7 @@ unsigned iov_copy(struct iovec *dst_iov, unsigned int 
dst_iov_cnt,
 
 void qemu_iovec_init(QEMUIOVector *qiov, int alloc_hint)
 {
-    qiov->iov = g_malloc(alloc_hint * sizeof(struct iovec));
+    qiov->iov = g_new(struct iovec, alloc_hint);
     qiov->niov = 0;
     qiov->nalloc = alloc_hint;
     qiov->size = 0;
@@ -284,7 +284,7 @@ void qemu_iovec_add(QEMUIOVector *qiov, void *base, size_t 
len)
 
     if (qiov->niov == qiov->nalloc) {
         qiov->nalloc = 2 * qiov->nalloc + 1;
-        qiov->iov = g_realloc(qiov->iov, qiov->nalloc * sizeof(struct iovec));
+        qiov->iov = g_renew(struct iovec, qiov->iov, qiov->nalloc);
     }
     qiov->iov[qiov->niov].iov_base = base;
     qiov->iov[qiov->niov].iov_len = len;
diff --git a/util/qemu-option.c b/util/qemu-option.c
index 668e5d9..ac4635b 100644
--- a/util/qemu-option.c
+++ b/util/qemu-option.c
@@ -362,7 +362,7 @@ QEMUOptionParameter 
*append_option_parameters(QEMUOptionParameter *dest,
 
     num_options += count_option_parameters(list);
 
-    dest = g_realloc(dest, (num_options + 1) * sizeof(QEMUOptionParameter));
+    dest = g_renew(QEMUOptionParameter, dest, num_options + 1);
     dest[num_dest_options].name = NULL;
 
     while (list && list->name) {
diff --git a/util/uri.c b/util/uri.c
index e348c17..46a94ac 100644
--- a/util/uri.c
+++ b/util/uri.c
@@ -1006,7 +1006,7 @@ URI *
 uri_new(void) {
     URI *ret;
 
-    ret = (URI *) g_malloc(sizeof(URI));
+    ret = g_new(URI, 1);
     memset(ret, 0, sizeof(URI));
     return(ret);
 }
diff --git a/vl.c b/vl.c
index 7f4fe0d..2932f55 100644
--- a/vl.c
+++ b/vl.c
@@ -1171,7 +1171,7 @@ void add_boot_device_path(int32_t bootindex, DeviceState 
*dev,
 
     assert(dev != NULL || suffix != NULL);
 
-    node = g_malloc0(sizeof(FWBootEntry));
+    node = g_new0(FWBootEntry, 1);
     node->bootindex = bootindex;
     node->suffix = g_strdup(suffix);
     node->dev = dev;
@@ -1547,7 +1547,7 @@ void pcmcia_socket_register(PCMCIASocket *socket)
 {
     struct pcmcia_socket_entry_s *entry;
 
-    entry = g_malloc(sizeof(struct pcmcia_socket_entry_s));
+    entry = g_new(struct pcmcia_socket_entry_s, 1);
     entry->socket = socket;
     entry->next = pcmcia_sockets;
     pcmcia_sockets = entry;
@@ -1810,7 +1810,7 @@ static bool qemu_vmstop_requested(RunState *r)
 
 void qemu_register_reset(QEMUResetHandler *func, void *opaque)
 {
-    QEMUResetEntry *re = g_malloc0(sizeof(QEMUResetEntry));
+    QEMUResetEntry *re = g_new0(QEMUResetEntry, 1);
 
     re->func = func;
     re->opaque = opaque;
diff --git a/xen-all.c b/xen-all.c
index 4a594bd..ed36741 100644
--- a/xen-all.c
+++ b/xen-all.c
@@ -312,7 +312,7 @@ go_physmap:
         }
     }
 
-    physmap = g_malloc(sizeof (XenPhysmap));
+    physmap = g_new(XenPhysmap, 1);
 
     physmap->start_addr = start_addr;
     physmap->size = size;
@@ -1027,7 +1027,7 @@ static void xen_read_physmap(XenIOState *state)
         return;
 
     for (i = 0; i < num; i++) {
-        physmap = g_malloc(sizeof (XenPhysmap));
+        physmap = g_new(XenPhysmap, 1);
         physmap->phys_offset = strtoull(entries[i], NULL, 16);
         snprintf(path, sizeof(path),
                 "/local/domain/0/device-model/%d/physmap/%s/start_addr",
@@ -1073,7 +1073,7 @@ int xen_hvm_init(MemoryRegion **ram_memory)
     unsigned long bufioreq_evtchn;
     XenIOState *state;
 
-    state = g_malloc0(sizeof (XenIOState));
+    state = g_new0(XenIOState, 1);
 
     state->xce_handle = xen_xc_evtchn_open(NULL, 0);
     if (state->xce_handle == XC_HANDLER_INITIAL_VALUE) {
@@ -1115,7 +1115,7 @@ int xen_hvm_init(MemoryRegion **ram_memory)
         hw_error("map buffered IO page returned error %d", errno);
     }
 
-    state->ioreq_local_port = g_malloc0(max_cpus * sizeof (evtchn_port_t));
+    state->ioreq_local_port = g_new0(evtchn_port_t, max_cpus);
 
     /* FIXME: how about if we overflow the page here? */
     for (i = 0; i < max_cpus; i++) {
diff --git a/xen-mapcache.c b/xen-mapcache.c
index eda914a..4ec3d28 100644
--- a/xen-mapcache.c
+++ b/xen-mapcache.c
@@ -98,7 +98,7 @@ void xen_map_cache_init(phys_offset_to_gaddr_t f, void 
*opaque)
     unsigned long size;
     struct rlimit rlimit_as;
 
-    mapcache = g_malloc0(sizeof (MapCache));
+    mapcache = g_new0(MapCache, 1);
 
     mapcache->phys_offset_to_gaddr = f;
     mapcache->opaque = opaque;
@@ -151,8 +151,8 @@ static void xen_remap_bucket(MapCacheEntry *entry,
 
     trace_xen_remap_bucket(address_index);
 
-    pfns = g_malloc0(nb_pfn * sizeof (xen_pfn_t));
-    err = g_malloc0(nb_pfn * sizeof (int));
+    pfns = g_new0(xen_pfn_t, nb_pfn);
+    err = g_new0(int, nb_pfn);
 
     if (entry->vaddr_base != NULL) {
         if (munmap(entry->vaddr_base, entry->size) != 0) {
@@ -179,8 +179,8 @@ static void xen_remap_bucket(MapCacheEntry *entry,
     entry->vaddr_base = vaddr_base;
     entry->paddr_index = address_index;
     entry->size = size;
-    entry->valid_mapping = (unsigned long *) g_malloc0(sizeof(unsigned long) *
-            BITS_TO_LONGS(size >> XC_PAGE_SHIFT));
+    entry->valid_mapping = g_new0(unsigned long,
+                                  BITS_TO_LONGS(size >> XC_PAGE_SHIFT));
 
     bitmap_zero(entry->valid_mapping, nb_pfn);
     for (i = 0; i < nb_pfn; i++) {
@@ -251,7 +251,7 @@ tryagain:
         entry = entry->next;
     }
     if (!entry) {
-        entry = g_malloc0(sizeof (MapCacheEntry));
+        entry = g_new0(MapCacheEntry, 1);
         pentry->next = entry;
         xen_remap_bucket(entry, __size, address_index);
     } else if (!entry->lock) {
@@ -279,7 +279,7 @@ tryagain:
 
     mapcache->last_entry = entry;
     if (lock) {
-        MapCacheRev *reventry = g_malloc0(sizeof(MapCacheRev));
+        MapCacheRev *reventry = g_new0(MapCacheRev, 1);
         entry->lock++;
         reventry->vaddr_req = mapcache->last_entry->vaddr_base + 
address_offset;
         reventry->paddr_index = mapcache->last_entry->paddr_index;
-- 
1.8.1.4




reply via email to

[Prev in Thread] Current Thread [Next in Thread]