diff --git a/hw/pci-host/apb.c b/hw/pci-host/apb.c
index bea7092eeb..e25791fcdd 100644
--- a/hw/pci-host/apb.c
+++ b/hw/pci-host/apb.c
@@ -71,7 +71,7 @@ do { printf("APB: " fmt , ## __VA_ARGS__); } while (0)
 #define NO_IRQ_REQUEST (MAX_IVEC + 1)
 
 typedef struct IOMMUState {
-    uint32_t regs[4];
+    uint32_t regs[6];
 } IOMMUState;
 
 #define TYPE_APB "pbm"
@@ -157,11 +157,9 @@ static void apb_config_writel (void *opaque, hwaddr addr,
     case 0x30 ... 0x4f: /* DMA error registers */
         /* XXX: not implemented yet */
         break;
-    case 0x200 ... 0x20b: /* IOMMU */
+    case 0x200 ... 0x217: /* IOMMU */
         is->regs[(addr & 0xf) >> 2] = val;
         break;
-    case 0x20c ... 0x3ff: /* IOMMU flush */
-        break;
     case 0xc00 ... 0xc3f: /* PCI interrupt control */
         if (addr & 4) {
             unsigned int ino = (addr & 0x3f) >> 3;
@@ -241,12 +239,9 @@ static uint64_t apb_config_readl (void *opaque,
         val = 0;
         /* XXX: not implemented yet */
         break;
-    case 0x200 ... 0x20b: /* IOMMU */
+    case 0x200 ... 0x217: /* IOMMU */
         val = is->regs[(addr & 0xf) >> 2];
         break;
-    case 0x20c ... 0x3ff: /* IOMMU flush */
-        val = 0;
-        break;
     case 0xc00 ... 0xc3f: /* PCI interrupt control */
         if (addr & 4) {
             val = s->pci_irq_map[(addr & 0x3f) >> 3];