The address passed to io_remap_pfn_range() in hpet_mmap() does not need to be converted using __pa(): it is already a physical address. This bug was found and the patch suggested by Clay Harris. I introduced this particular bug when making io_remap_pfn_range changes a few months ago. In fact mmap()ing /dev/hpet has *never* previously worked: before my changes __pa() was being executed on an ioremap()ed virtual address, which is also invalid. Signed-off-by: Keir Fraser