diff --git a/system/dev/block/ahci/ahci.c b/system/dev/block/ahci/ahci.c
index 22e5f2c..a690768 100644
--- a/system/dev/block/ahci/ahci.c
+++ b/system/dev/block/ahci/ahci.c
@@ -34,8 +34,6 @@
 #define HI32(val) (((val) >> 32) & 0xffffffff)
 #define LO32(val) ((val) & 0xffffffff)
 
-#define PAGE_MASK (PAGE_SIZE - 1)
-
 // port is implemented by the controller
 #define AHCI_PORT_FLAG_IMPLEMENTED (1 << 0)
 // a device is present on port
@@ -80,8 +78,6 @@
     zx_handle_t irq_handle;
     thrd_t irq_thread;
 
-    zx_handle_t bti_handle;
-
     thrd_t worker_thread;
     completion_t worker_completion;
 
@@ -246,16 +242,17 @@
 
     zx_handle_t vmo = txn->bop.rw.vmo;
     uint64_t offset_vmo = txn->bop.rw.offset_vmo * port->devinfo.block_size;
-
-    bool is_write = cmd_is_write(txn->cmd);
-    uint32_t options = is_write ? ZX_BTI_PERM_READ : ZX_BTI_PERM_WRITE;
-    zx_status_t st = zx_bti_pin(dev->bti_handle, options, vmo, offset_vmo & ~PAGE_MASK,
-                    (bytes + PAGE_MASK) & ~(PAGE_MASK), pages, pagecount);
+    zx_status_t st = zx_vmo_op_range(vmo, ZX_VMO_OP_COMMIT, offset_vmo, bytes, NULL, 0);
     if (st != ZX_OK) {
-        zxlogf(SPEW, "ahci.%d: failed to pin pages, err = %d\n", port->nr, st);
+        zxlogf(SPEW, "ahci.%d: failed to commit pages, err = %d\n", port->nr, st);
         return st;
     }
-    txn->phys = pages[0];
+    st = zx_vmo_op_range(vmo, ZX_VMO_OP_LOOKUP, offset_vmo, bytes, pages,
+                         AHCI_MAX_PAGES * sizeof(zx_paddr_t));
+    if (st != ZX_OK) {
+        zxlogf(SPEW, "ahci.%d: failed to lookup pages, err = %d\n", port->nr, st);
+        return st;
+    }
 
     phys_iter_buffer_t physbuf = {
         .phys = pages,
@@ -285,7 +282,7 @@
     // don't clear the cl since we set up ctba/ctbau at init
     cl->prdtl_flags_cfl = 0;
     cl->cfl = 5; // 20 bytes
-    cl->w = is_write ? 1 : 0;
+    cl->w = cmd_is_write(cmd) ? 1 : 0;
     cl->prdbc = 0;
     memset(port->ct[slot], 0, sizeof(ahci_ct_t));
 
@@ -371,7 +368,7 @@
     return ZX_OK;
 }
 
-static zx_status_t ahci_port_initialize(ahci_device_t* dev, ahci_port_t* port) {
+static zx_status_t ahci_port_initialize(ahci_port_t* port) {
     uint32_t cmd = ahci_read(&port->regs->cmd);
     if (cmd & (AHCI_PORT_CMD_ST | AHCI_PORT_CMD_FRE | AHCI_PORT_CMD_CR | AHCI_PORT_CMD_FR)) {
         zxlogf(ERROR, "ahci.%d: port busy\n", port->nr);
@@ -383,8 +380,7 @@
     size_t ct_prd_padding = 0x80 - (ct_prd_sz & (0x80 - 1)); // 128-byte aligned
     size_t mem_sz = sizeof(ahci_fis_t) + sizeof(ahci_cl_t) * AHCI_MAX_COMMANDS
                     + (ct_prd_sz + ct_prd_padding) * AHCI_MAX_COMMANDS;
-    zx_status_t status = io_buffer_init_with_bti(&port->buffer, dev->bti_handle,
-                                                 mem_sz, IO_BUFFER_RW | IO_BUFFER_CONTIG);
+    zx_status_t status = io_buffer_init(&port->buffer, mem_sz, IO_BUFFER_RW | IO_BUFFER_CONTIG);
     if (status < 0) {
         zxlogf(ERROR, "ahci.%d: error %d allocating dma memory\n", port->nr, status);
         return status;
@@ -483,9 +479,6 @@
     zxlogf(SPEW, "ahci.%d: queue_txn txn %p offset_dev 0x%" PRIx64 " length 0x%x\n",
             port->nr, txn, txn->bop.rw.offset_dev, txn->bop.rw.length);
 
-    // reset the physical address
-    txn->phys = 0;
-
     // put the cmd on the queue
     mtx_lock(&port->lock);
     list_add_tail(&port->txn_list, &txn->node);
@@ -498,8 +491,6 @@
 static void ahci_release(void* ctx) {
     // FIXME - join threads created by this driver
     ahci_device_t* device = ctx;
-    zx_handle_close(device->irq_handle);
-    zx_handle_close(device->bti_handle);
     free(device);
 }
 
@@ -527,9 +518,6 @@
                             port->nr, slot);
                 } else {
                     mtx_unlock(&port->lock);
-                    if (txn->phys != 0) {
-                        zx_bti_unpin(dev->bti_handle, txn->phys);
-                    }
                     zxlogf(SPEW, "ahci.%d: complete txn %p\n", port->nr, txn);
                     block_complete(&txn->bop, ZX_OK);
                     mtx_lock(&port->lock);
@@ -736,7 +724,7 @@
         port->regs = &dev->regs->ports[i];
         list_initialize(&port->txn_list);
 
-        status = ahci_port_initialize(dev, port);
+        status = ahci_port_initialize(port);
         if (status) goto fail;
     }
 
@@ -853,13 +841,6 @@
         goto fail;
     }
 
-    // get bti handle
-    status = pci_get_bti(&device->pci, 0, &device->bti_handle);
-    if (status != ZX_OK) {
-        zxlogf(ERROR, "ahci: error %d getting bti handle\n", status);
-        goto fail;
-    }
-
     // get irq handle
     status = pci_map_interrupt(&device->pci, 0, &device->irq_handle);
     if (status != ZX_OK) {
diff --git a/system/dev/block/ahci/sata.h b/system/dev/block/ahci/sata.h
index 69609e0..82da16c 100644
--- a/system/dev/block/ahci/sata.h
+++ b/system/dev/block/ahci/sata.h
@@ -45,7 +45,6 @@
     uint8_t device;
 
     zx_status_t status;
-    zx_paddr_t phys;
 } sata_txn_t;
 
 typedef struct ahci_device ahci_device_t;
diff --git a/system/dev/block/pci-sdhci/pci-sdhci.c b/system/dev/block/pci-sdhci/pci-sdhci.c
index be43a3e..eb12f3d 100644
--- a/system/dev/block/pci-sdhci/pci-sdhci.c
+++ b/system/dev/block/pci-sdhci/pci-sdhci.c
@@ -25,7 +25,6 @@
     volatile sdhci_regs_t* regs;
     uint64_t regs_size;
     zx_handle_t regs_handle;
-    zx_handle_t bti_handle;
 } pci_sdhci_device_t;
 
 static zx_status_t pci_sdhci_get_interrupt(void* ctx, zx_handle_t* handle_out) {
@@ -64,17 +63,6 @@
     return ZX_OK;
 }
 
-static zx_status_t pci_sdhci_get_bti(void* ctx, uint32_t index, zx_handle_t* out_handle) {
-    pci_sdhci_device_t* dev = ctx;
-    if (dev->bti_handle == ZX_HANDLE_INVALID) {
-        zx_status_t st = pci_get_bti(&dev->pci, index, &dev->bti_handle);
-        if (st != ZX_OK) {
-            return st;
-        }
-    }
-    return zx_handle_duplicate(dev->bti_handle, ZX_RIGHT_SAME_RIGHTS, out_handle);
-}
-
 static uint32_t pci_sdhci_get_base_clock(void* ctx) {
     return 0;
 }
@@ -102,7 +90,6 @@
 static sdhci_protocol_ops_t pci_sdhci_sdhci_proto = {
     .get_interrupt = pci_sdhci_get_interrupt,
     .get_mmio = pci_sdhci_get_mmio,
-    .get_bti = pci_sdhci_get_bti,
     .get_base_clock = pci_sdhci_get_base_clock,
     .get_quirks = pci_sdhci_get_quirks,
     .hw_reset = pci_sdhci_hw_reset,
@@ -118,7 +105,6 @@
     if (dev->regs != NULL) {
         zx_handle_close(dev->regs_handle);
     }
-    zx_handle_close(dev->bti_handle);
     free(dev);
 }
 
diff --git a/system/dev/block/sdhci/sdhci.c b/system/dev/block/sdhci/sdhci.c
index 08b8f54..4facdb2 100644
--- a/system/dev/block/sdhci/sdhci.c
+++ b/system/dev/block/sdhci/sdhci.c
@@ -78,8 +78,6 @@
 
     sdhci_protocol_t sdhci;
 
-    zx_handle_t bti_handle;
-
     // DMA descriptors
     io_buffer_t iobuf;
     sdhci_adma64_desc_t* descs;
@@ -358,26 +356,8 @@
     block_op_t* bop = &req->txn->bop;
     uint64_t pagecount = ((bop->rw.offset_vmo & PAGE_MASK) + bop->rw.length + PAGE_MASK) /
                          PAGE_SIZE;
-    if (pagecount > SDMMC_PAGES_COUNT) {
-        return ZX_ERR_INVALID_ARGS;
-    }
-
-    // pin the vmo
-    zx_paddr_t phys[SDMMC_PAGES_COUNT];
-    // offset_vmo is converted to bytes by the sdmmc layer
-    uint32_t options = bop->command == BLOCK_OP_READ ? ZX_BTI_PERM_WRITE : ZX_BTI_PERM_READ;
-    zx_status_t st = zx_bti_pin(dev->bti_handle, options, bop->rw.vmo,
-                                bop->rw.offset_vmo & ~PAGE_MASK,
-                                pagecount * PAGE_SIZE, phys, pagecount);
-    if (st != ZX_OK) {
-        zxlogf(ERROR, "sdhci: error %d bti_pin\n", st);
-        return st;
-    }
-    // cache this for zx_bti_unpin() later
-    req->phys = phys[0];
-
     phys_iter_buffer_t buf = {
-        .phys = phys,
+        .phys = req->phys,
         .phys_count = pagecount,
         .length = bop->rw.length,
         .vmo_offset = bop->rw.offset_vmo,
@@ -508,18 +488,6 @@
     return st;
 }
 
-static zx_status_t sdhci_finish_req(sdhci_device_t* dev, sdmmc_req_t* req) {
-    zx_status_t st = ZX_OK;
-    if (req->use_dma && req->phys) {
-        st = zx_bti_unpin(dev->bti_handle, req->phys);
-        if (st != ZX_OK) {
-            zxlogf(ERROR, "sdhci: error %d in bti_unpin\n", st);
-        }
-        req->phys = 0;
-    }
-    return st;
-}
-
 static zx_status_t sdhci_host_info(void* ctx, sdmmc_host_info_t* info) {
     sdhci_device_t* dev = ctx;
     memcpy(info, &dev->info, sizeof(dev->info));
@@ -754,22 +722,15 @@
     }
 
     st = sdhci_start_req_locked(dev, req);
-    if (st != ZX_OK) {
-        goto unlock_out;
-    }
 
     mtx_unlock(&dev->mtx);
 
     completion_wait(&dev->req_completion, ZX_TIME_INFINITE);
-
-    sdhci_finish_req(dev, req);
-
     completion_reset(&dev->req_completion);
 
     return req->status;
 
 unlock_out:
-    sdhci_finish_req(dev, req);
     mtx_unlock(&dev->mtx);
     return st;
 }
@@ -837,8 +798,6 @@
 
 static void sdhci_release(void* ctx) {
     sdhci_device_t* dev = ctx;
-    zx_handle_close(dev->irq_handle);
-    zx_handle_close(dev->bti_handle);
     free(dev);
 }
 
@@ -873,9 +832,8 @@
 
     // allocate and setup DMA descriptor
     if (sdhci_supports_adma2_64bit(dev)) {
-        status = io_buffer_init_with_bti(&dev->iobuf, dev->bti_handle,
-                                         DMA_DESC_COUNT * sizeof(sdhci_adma64_desc_t),
-                                         IO_BUFFER_RW | IO_BUFFER_CONTIG);
+        status = io_buffer_init(&dev->iobuf, DMA_DESC_COUNT * sizeof(sdhci_adma64_desc_t),
+                                IO_BUFFER_RW | IO_BUFFER_CONTIG);
         if (status != ZX_OK) {
             zxlogf(ERROR, "sdhci: error allocating DMA descriptors\n");
             goto fail;
@@ -975,12 +933,6 @@
         goto fail;
     }
 
-    status = dev->sdhci.ops->get_bti(dev->sdhci.ctx, 0, &dev->bti_handle);
-    if (status != ZX_OK) {
-        zxlogf(ERROR, "sdhci: error %d in get_bti\n", status);
-        goto fail;
-    }
-
     status = dev->sdhci.ops->get_interrupt(dev->sdhci.ctx, &dev->irq_handle);
     if (status < 0) {
         zxlogf(ERROR, "sdhci: error %d in get_interrupt\n", status);
@@ -1058,9 +1010,6 @@
         if (dev->irq_handle != ZX_HANDLE_INVALID) {
             zx_handle_close(dev->irq_handle);
         }
-        if (dev->bti_handle != ZX_HANDLE_INVALID) {
-            zx_handle_close(dev->bti_handle);
-        }
         if (dev->iobuf.vmo_handle != ZX_HANDLE_INVALID) {
             zx_handle_close(dev->iobuf.vmo_handle);
         }
diff --git a/system/dev/block/sdmmc/sdmmc.c b/system/dev/block/sdmmc/sdmmc.c
index 28360a6..7d25e74 100644
--- a/system/dev/block/sdmmc/sdmmc.c
+++ b/system/dev/block/sdmmc/sdmmc.c
@@ -313,8 +313,25 @@
 
         req->use_dma = true;
         req->virt = NULL;
-        req->phys = 0;
 
+        // TODO: use pages in txn->bop.rw.pages
+        st = zx_vmo_op_range(txn->bop.rw.vmo, ZX_VMO_OP_COMMIT,
+                             txn->bop.rw.offset_vmo, txn->bop.rw.length, NULL, 0);
+        if (st != ZX_OK) {
+            zxlogf(TRACE, "sdmmc: do_txn vmo commit error %d\n", st);
+            block_complete(&txn->bop, st);
+            return;
+        }
+        st = zx_vmo_op_range(txn->bop.rw.vmo, ZX_VMO_OP_LOOKUP,
+                             txn->bop.rw.offset_vmo, txn->bop.rw.length,
+                             req->phys, sizeof(req->phys));
+        if (st != ZX_OK) {
+            zxlogf(TRACE, "sdmmc: do_txn vmo lookup error %d\n", st);
+            zxlogf(TRACE, "sdmmc: offset_vmo 0x%" PRIx64 " length 0x%x buflen 0x%zx\n",
+                   txn->bop.rw.offset_vmo, txn->bop.rw.length, sizeof(req->phys));
+            block_complete(&txn->bop, st);
+            return;
+        }
     } else {
         req->use_dma = false;
         st = zx_vmar_map(zx_vmar_root_self(), 0, txn->bop.rw.vmo,
diff --git a/system/ulib/ddk/include/ddk/protocol/sdhci.h b/system/ulib/ddk/include/ddk/protocol/sdhci.h
index 72271e2..e508985 100644
--- a/system/ulib/ddk/include/ddk/protocol/sdhci.h
+++ b/system/ulib/ddk/include/ddk/protocol/sdhci.h
@@ -14,10 +14,6 @@
     // TODO: should be replaced with a generic busdev mechanism
     zx_status_t (*get_interrupt)(void* ctx, zx_handle_t* handle_out);
     zx_status_t (*get_mmio)(void* ctx, volatile sdhci_regs_t** out);
-    // Gets a handle to the bus transaction initiator for the device. The caller
-    // receives ownership of the handle.
-    zx_status_t (*get_bti)(void* ctx, uint32_t index, zx_handle_t* out_handle);
-
     uint32_t (*get_base_clock)(void* ctx);
 
     // returns device quirks
diff --git a/system/ulib/ddk/include/ddk/protocol/sdmmc.h b/system/ulib/ddk/include/ddk/protocol/sdmmc.h
index 25dd58a..9171d1c 100644
--- a/system/ulib/ddk/include/ddk/protocol/sdmmc.h
+++ b/system/ulib/ddk/include/ddk/protocol/sdmmc.h
@@ -60,7 +60,7 @@
 
     bool use_dma;
     void* virt;
-    zx_paddr_t phys;
+    zx_paddr_t phys[SDMMC_PAGES_COUNT];
 
     // response data
     uint32_t response[4];