diff --git a/tools/testing/selftests/kvm/lib/ucall.c b/tools/testing/selftests/kvm/lib/ucall.c
index 4777f9bb5194..694bc2eaa63e 100644
--- a/tools/testing/selftests/kvm/lib/ucall.c
+++ b/tools/testing/selftests/kvm/lib/ucall.c
@@ -34,7 +34,7 @@ void ucall_init(struct kvm_vm *vm, ucall_type_t type, void *arg)
 		return;
 
 	if (type == UCALL_MMIO) {
-		vm_paddr_t gpa, start, end, step;
+		vm_paddr_t gpa, start, end, step, offset;
 		bool ret;
 
 		if (arg) {
@@ -53,17 +53,15 @@ void ucall_init(struct kvm_vm *vm, ucall_type_t type, void *arg)
 		 * KVM_EXIT_MMIO. Well, at least that's how it works for AArch64.
 		 * Here we start with a guess that the addresses around two
 		 * thirds of the VA space are unmapped and then work both down
-		 * and up from there in 1/6 VA space sized steps.
+		 * and up from there in 1/12 VA space sized steps.
 		 */
 		start = 1ul << (vm->va_bits * 2 / 3);
 		end = 1ul << vm->va_bits;
-		step = 1ul << (vm->va_bits / 6);
-		for (gpa = start; gpa >= 0; gpa -= step) {
-			if (ucall_mmio_init(vm, gpa & ~(vm->page_size - 1)))
+		step = 1ul << (vm->va_bits / 12);
+		for (offset = 0; offset < end - start; offset += step) {
+			if (ucall_mmio_init(vm, (gpa - offset) & ~(vm->page_size - 1)))
 				return;
-		}
-		for (gpa = start + step; gpa < end; gpa += step) {
-			if (ucall_mmio_init(vm, gpa & ~(vm->page_size - 1)))
+			if (ucall_mmio_init(vm, (gpa + offset) & ~(vm->page_size - 1)))
 				return;
 		}
 		TEST_ASSERT(false, "Can't find a ucall mmio address");