The address passed to io_remap_pfn_range() in hpet_mmap() does not need to
be converted using __pa(): it is already a physical address.  This bug was
found and the patch suggested by Clay Harris.
I introduced this particular bug when making io_remap_pfn_range changes a
few months ago.  In fact mmap()ing /dev/hpet has *never* previously worked:
before my changes __pa() was being executed on an ioremap()ed virtual
address, which is also invalid.
Signed-off-by: Keir Fraser <keir@xensource.com>
Cc: Robert Picco <Robert.Picco@hp.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
 
        vma->vm_flags |= VM_IO;
        vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
-       addr = __pa(addr);
 
        if (io_remap_pfn_range(vma, vma->vm_start, addr >> PAGE_SHIFT,
                                        PAGE_SIZE, vma->vm_page_prot)) {