diff --git a/src/core/buffer.c b/src/core/buffer.c
index 91df7b66..ba58a190 100644
--- a/src/core/buffer.c
+++ b/src/core/buffer.c
@@ -20,7 +20,7 @@
 #include <string.h>
 #include <errno.h>
 #include <assert.h>
-#include <io.h>
+#include <gpxe/uaccess.h>
 #include <gpxe/buffer.h>
 
 /** @file
@@ -49,7 +49,7 @@
  * block consists of the 1025th byte.
  * 
  * Note that the rather convoluted way of manipulating the buffer
- * descriptors (using copy_{to,from}_phys rather than straightforward
+ * descriptors (using copy_{to,from}_user rather than straightforward
  * pointers) is needed to cope with operation as a PXE stack, when we
  * may be running in real mode or 16-bit protected mode, and therefore
  * cannot directly access arbitrary areas of memory using simple
@@ -97,7 +97,7 @@ static int get_next_free_block ( struct buffer *buffer,
 		block->next = block->end = buffer->len;
 	} else {
 		/* Retrieve block descriptor */
-		copy_from_phys ( block, ( buffer->addr + block->start ),
+		copy_from_user ( block, buffer->addr, block->start,
 				 sizeof ( *block ) );
 	}
 
@@ -115,8 +115,7 @@ static void store_free_block ( struct buffer *buffer,
 	size_t free_block_size = ( block->end - block->start );
 
 	assert ( free_block_size >= sizeof ( *block ) );
-	copy_to_phys ( ( buffer->addr + block->start ), block,
-		       sizeof ( *block ) );
+	copy_to_user ( buffer->addr, block->start, block, sizeof ( *block ) );
 }
 
 /**
@@ -230,7 +229,7 @@ int fill_buffer ( struct buffer *buffer, const void *data,
 	}
 
 	/* Copy data into buffer */
-	copy_to_phys ( ( buffer->addr + data_start ), data, len );
+	copy_to_user ( buffer->addr, data_start, data, len );
 
 	return 0;
 }
diff --git a/src/include/gpxe/buffer.h b/src/include/gpxe/buffer.h
index e35e0b53..b366955c 100644
--- a/src/include/gpxe/buffer.h
+++ b/src/include/gpxe/buffer.h
@@ -2,7 +2,7 @@
 #define _GPXE_BUFFER_H
 
 #include <stdint.h>
-#include <io.h>
+#include <gpxe/uaccess.h>
 
 /** @file
  *
@@ -28,7 +28,7 @@
  *   size_t len;
  *   
  *   // We have an area of memory [buf_start,buf_start+len) into which to
- *   // load a file, where buf_start is a physical addresse.
+ *   // load a file, where buf_start is a userptr_t.
  *   memset ( &buffer, 0, sizeof ( buffer ) );
  *   buffer->start = buf_start;
  *   buffer->len = len;
@@ -43,7 +43,7 @@
  *   }
  *   ...
  *   // The whole file is now present at [buf_start,buf_start+filesize),
- *   // where buf_start is a physical address.  The struct buffer can simply
+ *   // where buf_start is a userptr_t.  The struct buffer can simply
  *   // be discarded.
  *
  * @endcode
@@ -77,8 +77,8 @@
  *
  */
 struct buffer {
-	/** Physical start address of buffer */
-	physaddr_t addr;
+	/** Start of buffer */
+	userptr_t addr;
 	/** Total length of buffer */
 	size_t len;
 	/** Offset to first free block within buffer */
diff --git a/src/tests/buffertest.c b/src/tests/buffertest.c
index c1cb3772..0d95d11a 100644
--- a/src/tests/buffertest.c
+++ b/src/tests/buffertest.c
@@ -34,7 +34,7 @@ int test_buffer ( void ) {
 	test.source_len = sizeof ( source );
 	test.dest = dest;
 	test.dest_len = sizeof ( dest );
-	test.buffer.addr = virt_to_phys ( dest );
+	test.buffer.addr = virt_to_user ( dest );
 	test.buffer.len = sizeof ( dest );
 
 	test_fill_buffer ( &test,  20,  38 );
diff --git a/src/tests/ftptest.c b/src/tests/ftptest.c
index d7208f94..fe08ec52 100644
--- a/src/tests/ftptest.c
+++ b/src/tests/ftptest.c
@@ -32,7 +32,7 @@ void test_ftp ( struct sockaddr_tcpip *server, const char *filename ) {
 	printf ( "FTP fetching %s\n", filename );
 	
 	memset ( &buffer, 0, sizeof ( buffer ) );
-	buffer.addr = virt_to_phys ( data );
+	buffer.addr = virt_to_user ( data );
 	buffer.len = sizeof ( data );
 
 	memset ( &ftp, 0, sizeof ( ftp ) );