diff --git a/hw/pxa2xx.c b/hw/pxa2xx.c
index 0cb16725af..1259dbe5d0 100644
--- a/hw/pxa2xx.c
+++ b/hw/pxa2xx.c
@@ -1233,9 +1233,9 @@ static void pxa2xx_rtc_save(QEMUFile *f, void *opaque)
     qemu_put_be32s(f, &s->last_rycr);
     qemu_put_be32s(f, &s->last_swcr);
     qemu_put_be32s(f, &s->last_rtcpicr);
-    qemu_put_be64s(f, &s->last_hz);
-    qemu_put_be64s(f, &s->last_sw);
-    qemu_put_be64s(f, &s->last_pi);
+    qemu_put_be64s(f, (uint64_t *) &s->last_hz);
+    qemu_put_be64s(f, (uint64_t *) &s->last_sw);
+    qemu_put_be64s(f, (uint64_t *) &s->last_pi);
 }
 
 static int pxa2xx_rtc_load(QEMUFile *f, void *opaque, int version_id)
@@ -1257,9 +1257,9 @@ static int pxa2xx_rtc_load(QEMUFile *f, void *opaque, int version_id)
     qemu_get_be32s(f, &s->last_rycr);
     qemu_get_be32s(f, &s->last_swcr);
     qemu_get_be32s(f, &s->last_rtcpicr);
-    qemu_get_be64s(f, &s->last_hz);
-    qemu_get_be64s(f, &s->last_sw);
-    qemu_get_be64s(f, &s->last_pi);
+    qemu_get_be64s(f, (uint64_t *) &s->last_hz);
+    qemu_get_be64s(f, (uint64_t *) &s->last_sw);
+    qemu_get_be64s(f, (uint64_t *) &s->last_pi);
 
     pxa2xx_rtc_alarm_update(s, s->rtsr);
 
diff --git a/hw/pxa2xx_timer.c b/hw/pxa2xx_timer.c
index 90777f8220..7e1504acc1 100644
--- a/hw/pxa2xx_timer.c
+++ b/hw/pxa2xx_timer.c
@@ -372,8 +372,8 @@ static void pxa2xx_timer_save(QEMUFile *f, void *opaque)
     pxa2xx_timer_info *s = (pxa2xx_timer_info *) opaque;
     int i;
 
-    qemu_put_be32s(f, &s->clock);
-    qemu_put_be32s(f, &s->oldclock);
+    qemu_put_be32s(f, (uint32_t *) &s->clock);
+    qemu_put_be32s(f, (uint32_t *) &s->oldclock);
     qemu_put_be64s(f, &s->lastload);
 
     for (i = 0; i < 4; i ++) {
@@ -384,8 +384,8 @@ static void pxa2xx_timer_save(QEMUFile *f, void *opaque)
         for (i = 0; i < 8; i ++) {
             qemu_put_be32s(f, &s->tm4[i].tm.value);
             qemu_put_be32(f, s->tm4[i].tm.level);
-            qemu_put_be32s(f, &s->tm4[i].oldclock);
-            qemu_put_be32s(f, &s->tm4[i].clock);
+            qemu_put_be32s(f, (uint32_t *) &s->tm4[i].oldclock);
+            qemu_put_be32s(f, (uint32_t *) &s->tm4[i].clock);
             qemu_put_be64s(f, &s->tm4[i].lastload);
             qemu_put_be32s(f, &s->tm4[i].freq);
             qemu_put_be32s(f, &s->tm4[i].control);
@@ -403,8 +403,8 @@ static int pxa2xx_timer_load(QEMUFile *f, void *opaque, int version_id)
     int64_t now;
     int i;
 
-    qemu_get_be32s(f, &s->clock);
-    qemu_get_be32s(f, &s->oldclock);
+    qemu_get_be32s(f, (uint32_t *) &s->clock);
+    qemu_get_be32s(f, (uint32_t *) &s->oldclock);
     qemu_get_be64s(f, &s->lastload);
 
     now = qemu_get_clock(vm_clock);
@@ -418,8 +418,8 @@ static int pxa2xx_timer_load(QEMUFile *f, void *opaque, int version_id)
         for (i = 0; i < 8; i ++) {
             qemu_get_be32s(f, &s->tm4[i].tm.value);
             s->tm4[i].tm.level = qemu_get_be32(f);
-            qemu_get_be32s(f, &s->tm4[i].oldclock);
-            qemu_get_be32s(f, &s->tm4[i].clock);
+            qemu_get_be32s(f, (uint32_t *) &s->tm4[i].oldclock);
+            qemu_get_be32s(f, (uint32_t *) &s->tm4[i].clock);
             qemu_get_be64s(f, &s->tm4[i].lastload);
             qemu_get_be32s(f, &s->tm4[i].freq);
             qemu_get_be32s(f, &s->tm4[i].control);
diff --git a/hw/tmp105.c b/hw/tmp105.c
index 6d0505d2dc..da26e46715 100644
--- a/hw/tmp105.c
+++ b/hw/tmp105.c
@@ -185,9 +185,9 @@ static void tmp105_save(QEMUFile *f, void *opaque)
 
     qemu_put_8s(f, &s->pointer);
     qemu_put_8s(f, &s->config);
-    qemu_put_be16s(f, &s->temperature);
-    qemu_put_be16s(f, &s->limit[0]);
-    qemu_put_be16s(f, &s->limit[1]);
+    qemu_put_be16s(f, (uint16_t *) &s->temperature);
+    qemu_put_be16s(f, (uint16_t *) &s->limit[0]);
+    qemu_put_be16s(f, (uint16_t *) &s->limit[1]);
     qemu_put_byte(f, s->alarm);
     s->faults = tmp105_faultq[(s->config >> 3) & 3];		/* F */
 
@@ -204,9 +204,9 @@ static int tmp105_load(QEMUFile *f, void *opaque, int version_id)
 
     qemu_get_8s(f, &s->pointer);
     qemu_get_8s(f, &s->config);
-    qemu_get_be16s(f, &s->temperature);
-    qemu_get_be16s(f, &s->limit[0]);
-    qemu_get_be16s(f, &s->limit[1]);
+    qemu_get_be16s(f, (uint16_t *) &s->temperature);
+    qemu_get_be16s(f, (uint16_t *) &s->limit[0]);
+    qemu_get_be16s(f, (uint16_t *) &s->limit[1]);
     s->alarm = qemu_get_byte(f);
 
     tmp105_interrupt_update(s);