diff --git a/repos/dde_linux/src/lib/usb/spec/arm/platform_device.cc b/repos/dde_linux/src/lib/usb/spec/arm/platform_device.cc
index 866f9fd265..91e8c11929 100644
--- a/repos/dde_linux/src/lib/usb/spec/arm/platform_device.cc
+++ b/repos/dde_linux/src/lib/usb/spec/arm/platform_device.cc
@@ -203,8 +203,7 @@ void *_ioremap(resource_size_t phys_addr, unsigned long size, int wc)
 	try {
 		Genode::Attached_io_mem_dataspace *ds = new(Genode::env()->heap())
 		                                        Genode::Attached_io_mem_dataspace(phys_addr, size, !!wc);
-		/* map base + page offset */
-		return ds->local_addr<char>() + (phys_addr & (PAGE_SIZE - 1));
+		return ds->local_addr<void>();
 	} catch (...) {
 		panic("Failed to request I/O memory: [%zx,%lx)", phys_addr, phys_addr + size);
 		return 0;
diff --git a/repos/os/include/os/attached_io_mem_dataspace.h b/repos/os/include/os/attached_io_mem_dataspace.h
index 2b907216ef..d2dd678387 100644
--- a/repos/os/include/os/attached_io_mem_dataspace.h
+++ b/repos/os/include/os/attached_io_mem_dataspace.h
@@ -55,7 +55,10 @@ class Genode::Attached_io_mem_dataspace
 			_mmio(base, size, write_combined),
 			_ds(_mmio.dataspace()),
 			_local_addr(env()->rm_session()->attach(_ds))
-		{ }
+		{
+			/* apply sub-page offset to virtual address */
+			_local_addr = (void *)((addr_t)_local_addr | (base & (addr_t)0xfff));
+		}
 
 		/**
 		 * Destructor
diff --git a/repos/os/include/os/attached_mmio.h b/repos/os/include/os/attached_mmio.h
index 7774366d7a..beaab936db 100644
--- a/repos/os/include/os/attached_mmio.h
+++ b/repos/os/include/os/attached_mmio.h
@@ -50,7 +50,7 @@ class Genode::Attached_mmio : public Attached_io_mem_dataspace,
 		Attached_mmio(addr_t base, size_t size,
 		              bool write_combined = false)
 		: Attached_io_mem_dataspace(base, size, write_combined),
-		  Mmio((addr_t)local_addr<void>() | (base & 0xfff)) { }
+		  Mmio((addr_t)local_addr<void>()) { }
 };
 
 #endif /* _INCLUDE__OS__ATTACHED_MMIO_H_ */
diff --git a/repos/os/src/drivers/timer/spec/hw/spec/rpi/platform_timer_base.h b/repos/os/src/drivers/timer/spec/hw/spec/rpi/platform_timer_base.h
index 7ecad99e13..f700594f8c 100644
--- a/repos/os/src/drivers/timer/spec/hw/spec/rpi/platform_timer_base.h
+++ b/repos/os/src/drivers/timer/spec/hw/spec/rpi/platform_timer_base.h
@@ -29,7 +29,6 @@
  * The dataspace base address will correspond to 0x2000b000.
  */
 enum { TIMER_MMIO_BASE   = 0x2000b400,
-       TIMER_MMIO_OFFSET = 0x400,
        TIMER_MMIO_SIZE   = 0x100,
        TIMER_CLOCK       = 1984*1000 };
 
@@ -42,7 +41,7 @@ struct Platform_timer_base
 
 	Platform_timer_base() :
 		Attached_io_mem_dataspace(TIMER_MMIO_BASE, TIMER_MMIO_SIZE),
-		Sp804_base((Genode::addr_t)local_addr<void>() + TIMER_MMIO_OFFSET)
+		Sp804_base((Genode::addr_t)local_addr<void>())
 	{ }
 };