diff --git a/exec.c b/exec.c
index c927fbc..31374da 100644
--- a/exec.c
+++ b/exec.c
@@ -1418,7 +1418,7 @@
 #if !defined(CONFIG_SOFTMMU)
         /* must avoid mmap() usage of glibc by setting a buffer "by hand" */
         {
-            static uint8_t logfile_buf[4096];
+            static char logfile_buf[4096];
             setvbuf(logfile, logfile_buf, _IOLBF, sizeof(logfile_buf));
         }
 #else
diff --git a/fpu/softfloat.c b/fpu/softfloat.c
index 3ec1e0d..3988bd1 100644
--- a/fpu/softfloat.c
+++ b/fpu/softfloat.c
@@ -4987,7 +4987,7 @@
         sub128( aSig0, aSig1, bSig0, bSig1, &aSig0, &aSig1 );
     } while ( 0 <= (sbits64) aSig0 );
     add128(
-        aSig0, aSig1, alternateASig0, alternateASig1, &sigMean0, &sigMean1 );
+        aSig0, aSig1, alternateASig0, alternateASig1, (bits64 *)&sigMean0, &sigMean1 );
     if (    ( sigMean0 < 0 )
          || ( ( ( sigMean0 | sigMean1 ) == 0 ) && ( q & 1 ) ) ) {
         aSig0 = alternateASig0;
diff --git a/hw/mips_malta.c b/hw/mips_malta.c
index d94613c..449b13b 100644
--- a/hw/mips_malta.c
+++ b/hw/mips_malta.c
@@ -701,7 +701,8 @@
     ram_addr_t initrd_offset;
 
     if (load_elf(loaderparams.kernel_filename, VIRT_TO_PHYS_ADDEND,
-                 &kernel_entry, &kernel_low, &kernel_high) < 0) {
+                 (uint64_t *)&kernel_entry, (uint64_t *)&kernel_low,
+                 (uint64_t *)&kernel_high) < 0) {
         fprintf(stderr, "qemu: could not load kernel '%s'\n",
                 loaderparams.kernel_filename);
         exit(1);
diff --git a/hw/mips_mipssim.c b/hw/mips_mipssim.c
index fb56dc5..dc62f69 100644
--- a/hw/mips_mipssim.c
+++ b/hw/mips_mipssim.c
@@ -61,7 +61,8 @@
     ram_addr_t initrd_offset;
 
     kernel_size = load_elf(loaderparams.kernel_filename, VIRT_TO_PHYS_ADDEND,
-                           &entry, &kernel_low, &kernel_high);
+                           (uint64_t *)&entry, (uint64_t *)&kernel_low,
+                           (uint64_t *)&kernel_high);
     if (kernel_size >= 0) {
         if ((entry & ~0x7fffffffULL) == 0x80000000)
             entry = (int32_t)entry;
diff --git a/hw/mips_r4k.c b/hw/mips_r4k.c
index 8b3f4e9..1499af78 100644
--- a/hw/mips_r4k.c
+++ b/hw/mips_r4k.c
@@ -83,7 +83,8 @@
     ram_addr_t initrd_offset;
 
     kernel_size = load_elf(loaderparams.kernel_filename, VIRT_TO_PHYS_ADDEND,
-                           &entry, &kernel_low, &kernel_high);
+                           (uint64_t *)&entry, (uint64_t *)&kernel_low,
+                           (uint64_t *)&kernel_high);
     if (kernel_size >= 0) {
         if ((entry & ~0x7fffffffULL) == 0x80000000)
             entry = (int32_t)entry;
@@ -120,15 +121,15 @@
     /* Store command line.  */
     if (initrd_size > 0) {
         int ret;
-        ret = sprintf(phys_ram_base + (16 << 20) - 256,
+        ret = sprintf((char *)(phys_ram_base + (16 << 20) - 256),
                       "rd_start=0x" TARGET_FMT_lx " rd_size=%li ",
                       PHYS_TO_VIRT((uint32_t)initrd_offset),
                       initrd_size);
-        strcpy (phys_ram_base + (16 << 20) - 256 + ret,
+        strcpy ((char *)(phys_ram_base + (16 << 20) - 256 + ret),
                 loaderparams.kernel_cmdline);
     }
     else {
-        strcpy (phys_ram_base + (16 << 20) - 256,
+        strcpy ((char *)(phys_ram_base + (16 << 20) - 256),
                 loaderparams.kernel_cmdline);
     }
 
diff --git a/hw/nvram.h b/hw/nvram.h
index 3ec5483..b346822 100644
--- a/hw/nvram.h
+++ b/hw/nvram.h
@@ -17,12 +17,12 @@
 void NVRAM_set_lword (nvram_t *nvram, uint32_t addr, uint32_t value);
 uint32_t NVRAM_get_lword (nvram_t *nvram, uint32_t addr);
 void NVRAM_set_string (nvram_t *nvram, uint32_t addr,
-                       const unsigned char *str, uint32_t max);
+                       const char *str, uint32_t max);
 int NVRAM_get_string (nvram_t *nvram, uint8_t *dst, uint16_t addr, int max);
 void NVRAM_set_crc (nvram_t *nvram, uint32_t addr,
                     uint32_t start, uint32_t count);
 int PPC_NVRAM_set_params (nvram_t *nvram, uint16_t NVRAM_size,
-                          const unsigned char *arch,
+                          const char *arch,
                           uint32_t RAM_size, int boot_device,
                           uint32_t kernel_image, uint32_t kernel_size,
                           const char *cmdline,
diff --git a/hw/pl080.c b/hw/pl080.c
index 059e667..66d0398 100644
--- a/hw/pl080.c
+++ b/hw/pl080.c
@@ -80,7 +80,7 @@
     int src_id;
     int dest_id;
     int size;
-    char buff[4];
+    uint8_t buff[4];
     uint32_t req;
 
     s->tc_mask = 0;
diff --git a/hw/ppc.c b/hw/ppc.c
index fc92ab2..fd247aa 100644
--- a/hw/ppc.c
+++ b/hw/ppc.c
@@ -1305,7 +1305,7 @@
 }
 
 void NVRAM_set_string (nvram_t *nvram, uint32_t addr,
-                       const unsigned char *str, uint32_t max)
+                       const char *str, uint32_t max)
 {
     int i;
 
@@ -1366,7 +1366,7 @@
 #define CMDLINE_ADDR 0x017ff000
 
 int PPC_NVRAM_set_params (nvram_t *nvram, uint16_t NVRAM_size,
-                          const unsigned char *arch,
+                          const char *arch,
                           uint32_t RAM_size, int boot_device,
                           uint32_t kernel_image, uint32_t kernel_size,
                           const char *cmdline,
@@ -1387,7 +1387,7 @@
     NVRAM_set_lword(nvram,  0x3C, kernel_size);
     if (cmdline) {
         /* XXX: put the cmdline in NVRAM too ? */
-        strcpy(phys_ram_base + CMDLINE_ADDR, cmdline);
+        strcpy((char *)(phys_ram_base + CMDLINE_ADDR), cmdline);
         NVRAM_set_lword(nvram,  0x40, CMDLINE_ADDR);
         NVRAM_set_lword(nvram,  0x44, strlen(cmdline));
     } else {
diff --git a/hw/ppc4xx.h b/hw/ppc4xx.h
index 8d7863c..538e446 100644
--- a/hw/ppc4xx.h
+++ b/hw/ppc4xx.h
@@ -26,7 +26,7 @@
 #define PPC_4XX_H
 
 /* PowerPC 4xx core initialization */
-CPUState *ppc4xx_init (const unsigned char *cpu_model,
+CPUState *ppc4xx_init (const char *cpu_model,
                        clk_setup_t *cpu_clk, clk_setup_t *tb_clk,
                        uint32_t sysclk);
 
diff --git a/hw/ppc4xx_devs.c b/hw/ppc4xx_devs.c
index f9143dd..ee821f5 100644
--- a/hw/ppc4xx_devs.c
+++ b/hw/ppc4xx_devs.c
@@ -35,7 +35,7 @@
 
 /*****************************************************************************/
 /* Generic PowerPC 4xx processor instanciation */
-CPUState *ppc4xx_init (const unsigned char *cpu_model,
+CPUState *ppc4xx_init (const char *cpu_model,
                        clk_setup_t *cpu_clk, clk_setup_t *tb_clk,
                        uint32_t sysclk)
 {
diff --git a/hw/pxa2xx_dma.c b/hw/pxa2xx_dma.c
index 4e33c53..8219392 100644
--- a/hw/pxa2xx_dma.c
+++ b/hw/pxa2xx_dma.c
@@ -177,7 +177,7 @@
     uint32_t n, size;
     uint32_t width;
     uint32_t length;
-    char buffer[32];
+    uint8_t buffer[32];
     struct pxa2xx_dma_channel_s *ch;
 
     if (s->running ++)
diff --git a/hw/usb-net.c b/hw/usb-net.c
index a4714c5..82005af 100644
--- a/hw/usb-net.c
+++ b/hw/usb-net.c
@@ -681,8 +681,8 @@
 
     /* mandatory */
     case OID_GEN_VENDOR_DESCRIPTION:
-        pstrcpy(outbuf, outlen, "QEMU USB RNDIS Net");
-        return strlen(outbuf) + 1;
+        pstrcpy((char *)outbuf, outlen, "QEMU USB RNDIS Net");
+        return strlen((char *)outbuf) + 1;
 
     case OID_GEN_VENDOR_DRIVER_VERSION:
         *((le32 *) outbuf) = cpu_to_le32(1);
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 32767c0..fcae78f 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -1240,7 +1240,7 @@
 	}
 
 	if (interp_elf_ex.e_ident[0] != 0x7f ||
-	    	strncmp(&interp_elf_ex.e_ident[1], "ELF",3) != 0) {
+            strncmp((char *)&interp_elf_ex.e_ident[1], "ELF",3) != 0) {
 	    interpreter_type &= ~INTERPRETER_ELF;
 	}
 
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index a3b975d..0260756 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -947,7 +947,8 @@
                               abi_ulong optval_addr, abi_ulong optlen)
 {
     abi_long ret;
-    int len, lv, val;
+    int len, val;
+    socklen_t lv;
 
     switch(level) {
     case TARGET_SOL_SOCKET:
diff --git a/linux-user/uaccess.c b/linux-user/uaccess.c
index ed50437..4d50693 100644
--- a/linux-user/uaccess.c
+++ b/linux-user/uaccess.c
@@ -62,7 +62,7 @@
         ptr = lock_user(VERIFY_READ, guest_addr, max_len, 1);
         if (!ptr)
             return -TARGET_EFAULT;
-        len = qemu_strnlen(ptr, max_len);
+        len = qemu_strnlen((const char *)ptr, max_len);
         unlock_user(ptr, guest_addr, 0);
         guest_addr += len;
         /* we don't allow wrapping or integer overflow */
diff --git a/slirp/bootp.c b/slirp/bootp.c
index 3ae3db2..27220ee 100644
--- a/slirp/bootp.c
+++ b/slirp/bootp.c
@@ -172,7 +172,8 @@
     }
 
     if (bootp_filename)
-        snprintf(rbp->bp_file, sizeof(rbp->bp_file), "%s", bootp_filename);
+        snprintf((char *)rbp->bp_file, sizeof(rbp->bp_file), "%s",
+                 bootp_filename);
 
     dprintf("offered addr=%08x\n", ntohl(daddr.sin_addr.s_addr));
 
diff --git a/slirp/tcp_subr.c b/slirp/tcp_subr.c
index ec423b7..bce07a6 100644
--- a/slirp/tcp_subr.c
+++ b/slirp/tcp_subr.c
@@ -447,7 +447,7 @@
 {
 	struct socket *so;
 	struct sockaddr_in addr;
-	int addrlen = sizeof(struct sockaddr_in);
+	socklen_t addrlen = sizeof(struct sockaddr_in);
 	struct tcpcb *tp;
 	int s, opt;
 
@@ -649,7 +649,7 @@
 		{
 			struct socket *tmpso;
 			struct sockaddr_in addr;
-			int addrlen = sizeof(struct sockaddr_in);
+			socklen_t addrlen = sizeof(struct sockaddr_in);
 			struct sbuf *so_rcv = &so->so_rcv;
 
 			memcpy(so_rcv->sb_wptr, m->m_data, m->m_len);
diff --git a/slirp/tftp.c b/slirp/tftp.c
index 8c01268..4ad5504 100644
--- a/slirp/tftp.c
+++ b/slirp/tftp.c
@@ -149,8 +149,10 @@
     m->m_data += sizeof(struct udpiphdr);
 
     tp->tp_op = htons(TFTP_OACK);
-    n += snprintf(tp->x.tp_buf + n, sizeof(tp->x.tp_buf) - n, "%s", key) + 1;
-    n += snprintf(tp->x.tp_buf + n, sizeof(tp->x.tp_buf) - n, "%u", value) + 1;
+    n += snprintf((char *)tp->x.tp_buf + n, sizeof(tp->x.tp_buf) - n, "%s",
+                  key) + 1;
+    n += snprintf((char *)tp->x.tp_buf + n, sizeof(tp->x.tp_buf) - n, "%u",
+                  value) + 1;
 
     saddr.sin_addr = recv_tp->ip.ip_dst;
     saddr.sin_port = recv_tp->udp.uh_dport;
@@ -190,7 +192,7 @@
 
   tp->tp_op = htons(TFTP_ERROR);
   tp->x.tp_error.tp_error_code = htons(errorcode);
-  pstrcpy(tp->x.tp_error.tp_msg, sizeof(tp->x.tp_error.tp_msg), msg);
+  pstrcpy((char *)tp->x.tp_error.tp_msg, sizeof(tp->x.tp_error.tp_msg), msg);
 
   saddr.sin_addr = recv_tp->ip.ip_dst;
   saddr.sin_port = recv_tp->udp.uh_dport;
@@ -325,8 +327,8 @@
   /* do sanity checks on the filename */
 
   if ((spt->filename[0] != '/')
-      || (spt->filename[strlen(spt->filename) - 1] == '/')
-      ||  strstr(spt->filename, "/../")) {
+      || (spt->filename[strlen((char *)spt->filename) - 1] == '/')
+      ||  strstr((char *)spt->filename, "/../")) {
       tftp_send_error(spt, 2, "Access violation", tp);
       return;
   }
@@ -353,7 +355,7 @@
   while (k < n) {
       const char *key, *value;
 
-      key = src + k;
+      key = (char *)src + k;
       k += strlen(key) + 1;
 
       if (k >= n) {
@@ -361,7 +363,7 @@
 	  return;
       }
 
-      value = src + k;
+      value = (char *)src + k;
       k += strlen(value) + 1;
 
       if (strcmp(key, "tsize") == 0) {
diff --git a/softmmu-semi.h b/softmmu-semi.h
index 8bf96f4..79278cc 100644
--- a/softmmu-semi.h
+++ b/softmmu-semi.h
@@ -37,7 +37,7 @@
 static void *softmmu_lock_user(CPUState *env, uint32_t addr, uint32_t len,
                                int copy)
 {
-    char *p;
+    uint8_t *p;
     /* TODO: Make this something that isn't fixed size.  */
     p = malloc(len);
     if (copy)
diff --git a/target-alpha/helper.c b/target-alpha/helper.c
index 7384ba2..e0d06b4 100644
--- a/target-alpha/helper.c
+++ b/target-alpha/helper.c
@@ -411,7 +411,7 @@
                      int (*cpu_fprintf)(FILE *f, const char *fmt, ...),
                      int flags)
 {
-    static const unsigned char *linux_reg_names[] = {
+    static const char *linux_reg_names[] = {
         "v0 ", "t0 ", "t1 ", "t2 ", "t3 ", "t4 ", "t5 ", "t6 ",
         "t7 ", "s0 ", "s1 ", "s2 ", "s3 ", "s4 ", "s5 ", "fp ",
         "a0 ", "a1 ", "a2 ", "a3 ", "a4 ", "a5 ", "t8 ", "t9 ",
diff --git a/target-ppc/cpu.h b/target-ppc/cpu.h
index 1edf449..b50a593 100644
--- a/target-ppc/cpu.h
+++ b/target-ppc/cpu.h
@@ -303,7 +303,7 @@
     void (*hea_read)(void *opaque, int spr_num);
     void (*hea_write)(void *opaque, int spr_num);
 #endif
-    const unsigned char *name;
+    const char *name;
 };
 
 /* Altivec registers (128 bits) */
@@ -733,7 +733,7 @@
 
 void ppc_cpu_list (FILE *f, int (*cpu_fprintf)(FILE *f, const char *fmt, ...));
 
-const ppc_def_t *cpu_ppc_find_by_name (const unsigned char *name);
+const ppc_def_t *cpu_ppc_find_by_name (const char *name);
 int cpu_ppc_register_internal (CPUPPCState *env, const ppc_def_t *def);
 
 /* Time-base and decrementer management */
diff --git a/target-ppc/op_helper.c b/target-ppc/op_helper.c
index 1c08172..46e9b7a 100644
--- a/target-ppc/op_helper.c
+++ b/target-ppc/op_helper.c
@@ -244,7 +244,7 @@
     int64_t th;
     uint64_t tl;
 
-    muls64(&tl, &th, T0, T1);
+    muls64(&tl, (uint64_t *)&th, T0, T1);
     T0 = (int64_t)tl;
     /* If th != 0 && th != -1, then we had an overflow */
     if (likely((uint64_t)(th + 1) <= 1)) {
diff --git a/target-ppc/translate.c b/target-ppc/translate.c
index 56bdef2..2d646b9 100644
--- a/target-ppc/translate.c
+++ b/target-ppc/translate.c
@@ -220,7 +220,7 @@
     /* handler */
     void (*handler)(DisasContext *ctx);
 #if defined(DO_PPC_STATISTICS) || defined(PPC_DUMP_CPU)
-    const unsigned char *oname;
+    const char *oname;
 #endif
 #if defined(DO_PPC_STATISTICS)
     uint64_t count;
@@ -347,7 +347,7 @@
     unsigned char pad[1];
 #endif
     opc_handler_t handler;
-    const unsigned char *oname;
+    const char *oname;
 } opcode_t;
 
 /*****************************************************************************/
diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
index 3e103dd..67951bf 100644
--- a/target-ppc/translate_init.c
+++ b/target-ppc/translate_init.c
@@ -34,7 +34,7 @@
 #endif
 
 struct ppc_def_t {
-    const unsigned char *name;
+    const char *name;
     uint32_t pvr;
     uint32_t svr;
     uint64_t insns_flags;
@@ -433,13 +433,13 @@
      _spr_register(env, num, name, uea_read, uea_write, initial_value);       \
 } while (0)
 static inline void _spr_register (CPUPPCState *env, int num,
-                                  const unsigned char *name,
+                                  const char *name,
                                   void (*uea_read)(void *opaque, int sprn),
                                   void (*uea_write)(void *opaque, int sprn),
                                   target_ulong initial_value)
 #else
 static inline void spr_register (CPUPPCState *env, int num,
-                                 const unsigned char *name,
+                                 const char *name,
                                  void (*uea_read)(void *opaque, int sprn),
                                  void (*uea_write)(void *opaque, int sprn),
                                  void (*oea_read)(void *opaque, int sprn),
@@ -1245,7 +1245,7 @@
 /* PowerPC BookE SPR */
 static void gen_spr_BookE (CPUPPCState *env, uint64_t ivor_mask)
 {
-    const unsigned char *ivor_names[64] = {
+    const char *ivor_names[64] = {
         "IVOR0",  "IVOR1",  "IVOR2",  "IVOR3",
         "IVOR4",  "IVOR5",  "IVOR6",  "IVOR7",
         "IVOR8",  "IVOR9",  "IVOR10", "IVOR11",
@@ -1407,7 +1407,7 @@
 static void gen_spr_BookE_FSL (CPUPPCState *env, uint32_t mas_mask)
 {
 #if !defined(CONFIG_USER_ONLY)
-    const unsigned char *mas_names[8] = {
+    const char *mas_names[8] = {
         "MAS0", "MAS1", "MAS2", "MAS3", "MAS4", "MAS5", "MAS6", "MAS7",
     };
     int mas_sprn[8] = {
@@ -9157,7 +9157,7 @@
 static void dump_ppc_insns (CPUPPCState *env)
 {
     opc_handler_t **table, *handler;
-    const unsigned char *p, *q;
+    const char *p, *q;
     uint8_t opc1, opc2, opc3;
 
     printf("Instructions set:\n");
@@ -9240,7 +9240,7 @@
     init_ppc_proc(env, def);
 #if defined(PPC_DUMP_CPU)
     {
-        const unsigned char *mmu_model, *excp_model, *bus_model;
+        const char *mmu_model, *excp_model, *bus_model;
         switch (env->mmu_model) {
         case POWERPC_MMU_32B:
             mmu_model = "PowerPC 32";
@@ -9443,10 +9443,10 @@
 
 #include <ctype.h>
 
-const ppc_def_t *cpu_ppc_find_by_name (const unsigned char *name)
+const ppc_def_t *cpu_ppc_find_by_name (const char *name)
 {
     const ppc_def_t *ret;
-    const unsigned char *p;
+    const char *p;
     int i, max, len;
 
     /* Check if the given name is a PVR */
diff --git a/target-sh4/translate.c b/target-sh4/translate.c
index 82f4168..b9dcbc2 100644
--- a/target-sh4/translate.c
+++ b/target-sh4/translate.c
@@ -183,7 +183,7 @@
 }
 
 typedef struct {
-    const unsigned char *name;
+    const char *name;
     int id;
     uint32_t pvr;
     uint32_t prr;
@@ -206,7 +206,7 @@
     },
 };
 
-static const sh4_def_t *cpu_sh4_find_by_name(const unsigned char *name)
+static const sh4_def_t *cpu_sh4_find_by_name(const char *name)
 {
     int i;