diff --git a/executer/include/uprotocol.h b/executer/include/uprotocol.h
index 88a19316..b0d7500c 100644
--- a/executer/include/uprotocol.h
+++ b/executer/include/uprotocol.h
@@ -30,7 +30,7 @@
 #define HEADER_UPROTOCOL_H
 
 #define MCEXEC_UP_PREPARE_IMAGE  0x30a02900
-#define MCEXEC_UP_LOAD_IMAGE     0x30a02901
+#define MCEXEC_UP_TRANSFER       0x30a02901
 #define MCEXEC_UP_START_IMAGE    0x30a02902
 #define MCEXEC_UP_WAIT_SYSCALL   0x30a02903
 #define MCEXEC_UP_RET_SYSCALL    0x30a02904
@@ -42,10 +42,14 @@
 #define MCEXEC_UP_PREPARE_DMA    0x30a02910
 #define MCEXEC_UP_FREE_DMA       0x30a02911
 
-struct program_transfer {
-	unsigned long dest;
-	void *src;
-	unsigned long sz;
+#define MCEXEC_UP_TRANSFER_TO_REMOTE	0
+#define MCEXEC_UP_TRANSFER_FROM_REMOTE	1
+
+struct remote_transfer {
+	unsigned long rphys;
+	void *userp;
+	unsigned long size;
+	char direction;  
 };
 
 struct program_image_section {
diff --git a/executer/kernel/control.c b/executer/kernel/control.c
index 26d2637c..ff632bc7 100644
--- a/executer/kernel/control.c
+++ b/executer/kernel/control.c
@@ -152,9 +152,9 @@ free_out:
 	return ret;
 }
 
-int mcexec_load_image(ihk_os_t os, struct program_transfer *__user upt)
+int mcexec_transfer_image(ihk_os_t os, struct remote_transfer *__user upt)
 {
-	struct program_transfer pt;
+	struct remote_transfer pt;
 	unsigned long phys, ret = 0;
 	void *rpm;
 #if 0	
@@ -172,16 +172,32 @@ int mcexec_load_image(ihk_os_t os, struct program_transfer *__user upt)
 	if (copy_from_user(&pt, upt, sizeof(pt))) {
 		return -EFAULT;
 	}
+
+	if (pt.size > PAGE_SIZE) {
+		printk("mcexec_transfer_image(): ERROR: size exceeds PAGE_SIZE\n");
+		return -EFAULT;
+	}
 	
-	phys = ihk_device_map_memory(ihk_os_to_dev(os), pt.dest, PAGE_SIZE);
+	phys = ihk_device_map_memory(ihk_os_to_dev(os), pt.rphys, PAGE_SIZE);
 #ifdef CONFIG_MIC
 	rpm = ioremap_wc(phys, PAGE_SIZE);
 #else
 	rpm = ihk_device_map_virtual(ihk_os_to_dev(os), phys, PAGE_SIZE, NULL, 0);
 #endif
-
-	if (copy_from_user(rpm, pt.src, PAGE_SIZE)) {
-		ret = -EFAULT;
+	
+	if (pt.direction == MCEXEC_UP_TRANSFER_TO_REMOTE) {
+		if (copy_from_user(rpm, pt.userp, pt.size)) {
+			ret = -EFAULT;
+		}
+	}
+	else if (pt.direction == MCEXEC_UP_TRANSFER_FROM_REMOTE) {
+		if (copy_to_user(pt.userp, rpm, pt.size)) {
+			ret = -EFAULT;
+		}
+	}
+	else {
+		printk("mcexec_transfer_image(): ERROR: invalid direction\n");
+		ret = -EINVAL;
 	}
 
 #ifdef CONFIG_MIC
@@ -726,8 +742,8 @@ long __mcctrl_control(ihk_os_t os, unsigned int req, unsigned long arg)
 	case MCEXEC_UP_PREPARE_IMAGE:
 		return mcexec_prepare_image(os,
 		                            (struct program_load_desc *)arg);
-	case MCEXEC_UP_LOAD_IMAGE:
-		return mcexec_load_image(os, (struct program_transfer *)arg);
+	case MCEXEC_UP_TRANSFER:
+		return mcexec_transfer_image(os, (struct remote_transfer *)arg);
 
 	case MCEXEC_UP_START_IMAGE:
 		return mcexec_start_image(os, (struct program_load_desc *)arg);
diff --git a/executer/kernel/driver.c b/executer/kernel/driver.c
index 9f621376..dc0b0074 100644
--- a/executer/kernel/driver.c
+++ b/executer/kernel/driver.c
@@ -44,7 +44,7 @@ static long mcctrl_ioctl(ihk_os_t os, unsigned int request, void *priv,
 
 static struct ihk_os_user_call_handler mcctrl_uchs[] = {
 	{ .request = MCEXEC_UP_PREPARE_IMAGE, .func = mcctrl_ioctl },
-	{ .request = MCEXEC_UP_LOAD_IMAGE, .func = mcctrl_ioctl },
+	{ .request = MCEXEC_UP_TRANSFER, .func = mcctrl_ioctl },
 	{ .request = MCEXEC_UP_START_IMAGE, .func = mcctrl_ioctl },
 	{ .request = MCEXEC_UP_WAIT_SYSCALL, .func = mcctrl_ioctl },
 	{ .request = MCEXEC_UP_RET_SYSCALL, .func = mcctrl_ioctl },
diff --git a/executer/user/mcexec.c b/executer/user/mcexec.c
index c1b0344f..ad0f1f97 100644
--- a/executer/user/mcexec.c
+++ b/executer/user/mcexec.c
@@ -388,7 +388,7 @@ int load_elf_desc(char *filename, struct program_load_desc **desc_p)
 
 void transfer_image(int fd, struct program_load_desc *desc)
 {
-	struct program_transfer pt;
+	struct remote_transfer pt;
 	unsigned long s, e, flen, rpa;
 	int i, l, lr;
 	FILE *fp;
@@ -407,9 +407,10 @@ void transfer_image(int fd, struct program_load_desc *desc)
 		          desc->sections[i].offset, flen);
 
 		while (s < e) {
-			pt.dest = rpa;
-			pt.src = dma_buf;
-			pt.sz = PAGE_SIZE;
+			pt.rphys = rpa;
+			pt.userp = dma_buf;
+			pt.size = PAGE_SIZE;
+			pt.direction = MCEXEC_UP_TRANSFER_TO_REMOTE;
 			lr = 0;
 			
 			memset(dma_buf, 0, PAGE_SIZE);
@@ -438,7 +439,7 @@ void transfer_image(int fd, struct program_load_desc *desc)
 			/* No more left to upload.. */
 			if (lr == 0 && flen == 0) break;
 
-			if (ioctl(fd, MCEXEC_UP_LOAD_IMAGE,
+			if (ioctl(fd, MCEXEC_UP_TRANSFER,
 						(unsigned long)&pt)) {
 				perror("dma");
 				break;