diff --git a/hw/omap.h b/hw/omap.h
index 7006ecbe8e..4c30436a3e 100644
--- a/hw/omap.h
+++ b/hw/omap.h
@@ -660,6 +660,7 @@ struct omap_uart_s *omap2_uart_init(struct omap_target_agent_s *ta,
                 qemu_irq irq, omap_clk fclk, omap_clk iclk,
                 qemu_irq txdma, qemu_irq rxdma, CharDriverState *chr);
 void omap_uart_reset(struct omap_uart_s *s);
+void omap_uart_attach(struct omap_uart_s *s, CharDriverState *chr);
 
 struct omap_mpuio_s;
 struct omap_mpuio_s *omap_mpuio_init(target_phys_addr_t base,
diff --git a/hw/omap1.c b/hw/omap1.c
index 101d36b30b..f74637d091 100644
--- a/hw/omap1.c
+++ b/hw/omap1.c
@@ -1983,6 +1983,8 @@ struct omap_uart_s {
     SerialState *serial; /* TODO */
     struct omap_target_agent_s *ta;
     target_phys_addr_t base;
+    omap_clk fclk;
+    qemu_irq irq;
 
     uint8_t eblr;
     uint8_t syscontrol;
@@ -2007,6 +2009,9 @@ struct omap_uart_s *omap_uart_init(target_phys_addr_t base,
     struct omap_uart_s *s = (struct omap_uart_s *)
             qemu_mallocz(sizeof(struct omap_uart_s));
 
+    s->base = base;
+    s->fclk = fclk;
+    s->irq = irq;
     s->serial = serial_mm_init(base, 2, irq, omap_clk_getrate(fclk)/16,
                                chr ?: qemu_chr_open("null"), 1);
 
@@ -2108,13 +2113,20 @@ struct omap_uart_s *omap2_uart_init(struct omap_target_agent_s *ta,
                     omap_uart_writefn, s);
 
     s->ta = ta;
-    s->base = base;
 
     cpu_register_physical_memory(s->base + 0x20, 0x100, iomemtype);
 
     return s;
 }
 
+void omap_uart_attach(struct omap_uart_s *s, CharDriverState *chr)
+{
+    /* TODO: Should reuse or destroy current s->serial */
+    s->serial = serial_mm_init(s->base, 2, s->irq,
+                    omap_clk_getrate(s->fclk) / 16,
+                    chr ?: qemu_chr_open("null"), 1);
+}
+
 /* MPU Clock/Reset/Power Mode Control */
 static uint32_t omap_clkm_read(void *opaque, target_phys_addr_t addr)
 {
diff --git a/hw/omap2.c b/hw/omap2.c
index e3ea4f7f35..a5003834dd 100644
--- a/hw/omap2.c
+++ b/hw/omap2.c
@@ -156,7 +156,7 @@ static inline void omap_gp_timer_trigger(struct omap_gp_timer_s *timer)
 {
     if (timer->pt)
         /* TODO in overflow-and-match mode if the first event to
-         * occurs is the match, don't toggle.  */
+         * occur is the match, don't toggle.  */
         omap_gp_timer_out(timer, !timer->out_val);
     else
         /* TODO inverted pulse on timer->out_val == 1?  */
@@ -2151,12 +2151,12 @@ static void omap_sti_fifo_write(void *opaque, target_phys_addr_t addr,
 
     if (ch == STI_TRACE_CONTROL_CHANNEL) {
         /* Flush channel <i>value</i>.  */
-        qemu_chr_write(s->chr, "\r", 1);
+        qemu_chr_write(s->chr, (const uint8_t *) "\r", 1);
     } else if (ch == STI_TRACE_CONSOLE_CHANNEL || 1) {
         if (value == 0xc0 || value == 0xc3) {
             /* Open channel <i>ch</i>.  */
         } else if (value == 0x00)
-            qemu_chr_write(s->chr, "\n", 1);
+            qemu_chr_write(s->chr, (const uint8_t *) "\n", 1);
         else
             qemu_chr_write(s->chr, &byte, 1);
     }