diff --git a/src/drivers/bitbash/spi_bit.c b/src/drivers/bitbash/spi_bit.c
index 462fd72e..ef1d8ff7 100644
--- a/src/drivers/bitbash/spi_bit.c
+++ b/src/drivers/bitbash/spi_bit.c
@@ -139,13 +139,12 @@ static void spi_bit_transfer ( struct spi_bit_basher *spibit,
  * @v address		Address to read/write (<0 for no address)
  * @v data_out		TX data buffer (or NULL)
  * @v data_in		RX data buffer (or NULL)
- * @v len		Length of transfer (in @b words)
+ * @v len		Length of transfer
  * @ret rc		Return status code
  */
 static int spi_bit_rw ( struct spi_bus *bus, struct spi_device *device,
 			unsigned int command, int address,
-			const void *data_out, void *data_in,
-			unsigned int len ) {
+			const void *data_out, void *data_in, size_t len ) {
 	struct spi_bit_basher *spibit
 		= container_of ( bus, struct spi_bit_basher, bus );
 	struct spi_device_type *devtype = device->type;
@@ -167,8 +166,7 @@ static int spi_bit_rw ( struct spi_bus *bus, struct spi_device *device,
 	}
 
 	/* Transmit/receive data */
-	spi_bit_transfer ( spibit, data_out, data_in,
-			   ( len * devtype->word_len ) );
+	spi_bit_transfer ( spibit, data_out, data_in, ( len * 8 ) );
 
 	/* Deassert chip select on specified slave */
 	spi_bit_set_slave_select ( spibit, device->slave, DESELECT_SLAVE );
diff --git a/src/drivers/net/rtl8139.c b/src/drivers/net/rtl8139.c
index c1a29e4f..34d6572a 100644
--- a/src/drivers/net/rtl8139.c
+++ b/src/drivers/net/rtl8139.c
@@ -276,7 +276,7 @@ static void rtl_read_mac ( struct rtl8139_nic *rtl, uint8_t *mac_addr ) {
 	
 	DBG ( "MAC address is " );
 	for ( i = EE_MAC ; i < ( EE_MAC + ( ETH_ALEN / 2 ) ) ; i++ ) {
-		device->type->read ( device, i, mac_addr, 1 );
+		device->type->read ( device, i, mac_addr, 2 );
 		DBG ( "%02x%02x", mac_addr[0], mac_addr[1] );
 		mac_addr += 2;
 	}
diff --git a/src/drivers/nvs/threewire.c b/src/drivers/nvs/threewire.c
index fd360037..552c3b46 100644
--- a/src/drivers/nvs/threewire.c
+++ b/src/drivers/nvs/threewire.c
@@ -31,17 +31,16 @@
  * @v device		SPI device
  * @v address		Address from which to read
  * @v data		Data buffer
- * @v len		Length of data to read, in @b words
+ * @v len		Length of data buffer
  * @ret rc		Return status code
  */
 int threewire_read ( struct spi_device *device, unsigned int address,
-		     void *data, unsigned int len ) {
+		     void *data, size_t len ) {
 	struct spi_bus *bus = device->bus;
 
 	assert ( bus->mode == SPI_MODE_THREEWIRE );
 
-	DBG ( "3wire %p reading words [%04x,%04x)\n", device,
-	      address, ( address + len ) );
+	DBG ( "3wire %p reading %d bytes at %04x\n", device, len, address );
 
 	return bus->rw ( bus, device, THREEWIRE_READ, address,
 			 NULL, data, len );
diff --git a/src/include/gpxe/spi.h b/src/include/gpxe/spi.h
index 93214063..dba4c743 100644
--- a/src/include/gpxe/spi.h
+++ b/src/include/gpxe/spi.h
@@ -118,21 +118,21 @@ struct spi_device_type {
 	 * @v device		SPI device
 	 * @v address		Address from which to read
 	 * @v data		Data buffer
-	 * @v len		Length of data to read, in @b words
+	 * @v len		Length of data buffer
 	 * @ret rc		Return status code
 	 */
 	int ( * read ) ( struct spi_device *device, unsigned int address,
-			 void *data, unsigned int len );
+			 void *data, size_t len );
 	/** Write data to device
 	 *
 	 * @v device		SPI device
 	 * @v address		Address to which to write
 	 * @v data		Data buffer
-	 * @v len		Length of data to write, in @b words
+	 * @v len		Length of data buffer
 	 * @ret rc		Return status code
 	 */
 	int ( * write ) ( struct spi_device *device, unsigned int address,
-			  const void *data, unsigned int len );
+			  const void *data, size_t len );
 };
 
 /**
@@ -192,18 +192,15 @@ struct spi_bus {
 	 * @v address		Address to read/write (<0 for no address)
 	 * @v data_out		TX data buffer (or NULL)
 	 * @v data_in		RX data buffer (or NULL)
-	 * @v len		Length of transfer (in @b words)
+	 * @v len		Length of data buffer(s)
 	 *
 	 * This issues the specified command and optional address to
 	 * the SPI device, then reads and/or writes data to/from the
-	 * data buffers.  Note that the transfer length is measured in
-	 * words, not in bytes.  Some SPI devices have 16-bit word
-	 * lengths; take care with these devices not to accidentally
-	 * read or write twice as much data as intended.
+	 * data buffers.
 	 */
 	int ( * rw ) ( struct spi_bus *bus, struct spi_device *device,
 		       unsigned int command, int address,
-		       const void *data_out, void *data_in, unsigned int len );
+		       const void *data_out, void *data_in, size_t len );
 };
 
 /** Clock phase (CPHA) mode bit
diff --git a/src/include/gpxe/threewire.h b/src/include/gpxe/threewire.h
index 28cfea10..4277d8ab 100644
--- a/src/include/gpxe/threewire.h
+++ b/src/include/gpxe/threewire.h
@@ -56,6 +56,6 @@
 /** @} */
 
 extern int threewire_read ( struct spi_device *device, unsigned int address,
-			    void *data, unsigned int len );
+			    void *data, size_t len );
 
 #endif /* _GPXE_THREEWIRE_H */