diff --git a/[refs] b/[refs]
index 9b13d962448e..9422ff022338 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 728d577d357c9caf83f75d0a38f318f343999cc2
+refs/heads/master: cfe3950c2a19c1e1ad85b9dd2622617e309d2845
diff --git a/trunk/arch/arm/kvm/mmu.c b/trunk/arch/arm/kvm/mmu.c
index ec14269a791c..efded4f1a11b 100644
--- a/trunk/arch/arm/kvm/mmu.c
+++ b/trunk/arch/arm/kvm/mmu.c
@@ -606,8 +606,13 @@ int kvm_handle_guest_abort(struct kvm_vcpu *vcpu, struct kvm_run *run)
 			goto out_unlock;
 		}
 
-		/* Adjust page offset */
-		fault_ipa |= kvm_vcpu_get_hfar(vcpu) & ~PAGE_MASK;
+		/*
+		 * The IPA is reported as [MAX:12], so we need to
+		 * complement it with the bottom 12 bits from the
+		 * faulting VA. This is always 12 bits, irrespective
+		 * of the page size.
+		 */
+		fault_ipa |= kvm_vcpu_get_hfar(vcpu) & ((1 << 12) - 1);
 		ret = io_mem_abort(vcpu, run, fault_ipa);
 		goto out_unlock;
 	}