diff --git a/hw/iommu.c b/hw/iommu.c
index 0879df95fa4dfe19c2bbc7a4b45726d72311e00c..fe6911e5e0227a90ada25eb3c1aec36e3578ac2c 100644
--- a/hw/iommu.c
+++ b/hw/iommu.c
@@ -301,9 +301,9 @@ void sparc_iommu_memory_rw(void *opaque, target_phys_addr_t addr,
                 iommu_bad_addr(opaque, page, is_write);
                 return;
             }
-            cpu_physical_memory_write(phys_addr, buf, len);
+            cpu_physical_memory_write(phys_addr, buf, l);
         } else {
-            cpu_physical_memory_read(phys_addr, buf, len);
+            cpu_physical_memory_read(phys_addr, buf, l);
         }
         len -= l;
         buf += l;