Index: uspace/drv/uhci/callback.h
===================================================================
--- uspace/drv/uhci/callback.h	(revision 96005163d202072b0cdf54f68060b64c90325f7f)
+++ uspace/drv/uhci/callback.h	(revision 643b98353f9443b4fab7c97692595995c2064a21)
@@ -35,15 +35,56 @@
 #define DRV_UHCI_CALLBACK_H
 
+#include <mem.h>
 #include <usbhc_iface.h>
+
+#include "debug.h"
+#include "translating_malloc.h"
 
 typedef struct callback
 {
-	union {
-		usbhc_iface_transfer_in_callback_t callback_in;
-		usbhc_iface_transfer_out_callback_t callback_out;
-	};
-	void* buffer;
+	usbhc_iface_transfer_in_callback_t callback_in;
+	usbhc_iface_transfer_out_callback_t callback_out;
+	void *old_buffer;
+	void *new_buffer;
+	void *arg;
+	size_t buffer_size;
+	device_t *dev;
 } callback_t;
 
+
+static inline int callback_init(callback_t *instance, device_t *dev,
+  void *buffer, size_t size, usbhc_iface_transfer_in_callback_t func_in,
+  usbhc_iface_transfer_out_callback_t func_out, void *arg)
+{
+	assert(instance);
+	assert(func_in == NULL || func_out == NULL);
+	instance->new_buffer = trans_malloc(size);
+	if (!instance->new_buffer) {
+		uhci_print_error("Failed to allocate device acessible buffer.\n");
+		return ENOMEM;
+	}
+
+	if (func_out)
+		memcpy(instance->new_buffer, buffer, size);
+
+	instance->callback_out = func_out;
+	instance->callback_in = func_in;
+	instance->old_buffer = buffer;
+	instance->buffer_size = size;
+	instance->dev = dev;
+	return EOK;
+}
+#define callback_in_init(instance, dev, buffer, size, func, arg) \
+	callback_init(instance, dev, buffer, size, func, NULL, arg)
+
+#define callback_out_init(instance, dev, buffer, size, func, arg) \
+	callback_init(instance, dev, buffer, size, func, NULL, arg)
+
+static inline void callback_fini(callback_t *instance)
+{
+	assert(instance);
+	if (instance->new_buffer)
+		trans_free(instance->new_buffer);
+}
 #endif
 /**
Index: uspace/drv/uhci/transfer_list.h
===================================================================
--- uspace/drv/uhci/transfer_list.h	(revision 96005163d202072b0cdf54f68060b64c90325f7f)
+++ uspace/drv/uhci/transfer_list.h	(revision 643b98353f9443b4fab7c97692595995c2064a21)
@@ -70,5 +70,5 @@
 	assert(instance);
 	if (instance->queue_head)
-		free(instance->queue_head);
+		trans_free(instance->queue_head);
 }
 
Index: uspace/drv/uhci/uhci.c
===================================================================
--- uspace/drv/uhci/uhci.c	(revision 96005163d202072b0cdf54f68060b64c90325f7f)
+++ uspace/drv/uhci/uhci.c	(revision 643b98353f9443b4fab7c97692595995c2064a21)
@@ -68,34 +68,4 @@
 }
 /*----------------------------------------------------------------------------*/
-int init_tranfer_lists(transfer_list_t transfers[])
-{
-	//TODO:refactor
-	int ret;
-	ret = transfer_list_init(&transfers[USB_TRANSFER_BULK], NULL);
-	if (ret != EOK) {
-		uhci_print_error("Failed to inititalize bulk queue.\n");
-		return ret;
-	}
-
-	ret = transfer_list_init(
-	  &transfers[USB_TRANSFER_CONTROL], &transfers[USB_TRANSFER_BULK]);
-	if (ret != EOK) {
-		uhci_print_error("Failed to inititalize control queue.\n");
-		transfer_list_fini(&transfers[USB_TRANSFER_BULK]);
-		return ret;
-	}
-
-	ret = transfer_list_init(
-	  &transfers[USB_TRANSFER_INTERRUPT], &transfers[USB_TRANSFER_CONTROL]);
-	if (ret != EOK) {
-		uhci_print_error("Failed to interrupt control queue.\n");
-		transfer_list_fini(&transfers[USB_TRANSFER_CONTROL]);
-		transfer_list_fini(&transfers[USB_TRANSFER_BULK]);
-		return ret;
-	}
-
-	return EOK;
-}
-/*----------------------------------------------------------------------------*/
 int uhci_in(
   device_t *dev,
@@ -110,6 +80,33 @@
 	    usb_str_transfer_type(transfer_type),
 	    size);
+	if (size >= 1024)
+		return ENOTSUP;
 
-	callback( dev, USB_OUTCOME_OK, size, arg );
+	callback_t *job = malloc(sizeof(callback_t));
+	if (job == NULL) {
+		uhci_print_error("Failed to allocate callback structure.\n");
+		return ENOMEM;
+	}
+
+#define CHECK_RET_FREE_JOB(r, message) \
+	if (r != EOK) { \
+		uhci_print_error(message); \
+		callback_fini(job); \
+		trans_free(job); \
+		return r; \
+	} else (void) 0
+
+	int ret = callback_in_init(job, dev, buffer, size, callback, arg);
+	CHECK_RET_FREE_JOB(ret, "Failed to initialize callback structure.\n");
+
+	transfer_descriptor_t *td = trans_malloc(sizeof(transfer_descriptor_t));
+	ret = (td == NULL) ? ENOMEM : EOK;
+	CHECK_RET_FREE_JOB(ret, "Failed to allocate tranfer descriptor.\n");
+
+	transfer_descriptor_init(td, 3, size, false, target, USB_PID_IN);
+
+
+	// TODO: add to list
+//	callback(dev, USB_OUTCOME_OK, size, arg);
 
 	return EOK;
@@ -152,2 +149,33 @@
 }
 /*----------------------------------------------------------------------------*/
+int init_tranfer_lists(transfer_list_t transfers[])
+{
+	//TODO:refactor
+	transfers[USB_TRANSFER_ISOCHRONOUS].first = NULL;
+	transfers[USB_TRANSFER_ISOCHRONOUS].last = NULL;
+	int ret;
+	ret = transfer_list_init(&transfers[USB_TRANSFER_BULK], NULL);
+	if (ret != EOK) {
+		uhci_print_error("Failed to inititalize bulk queue.\n");
+		return ret;
+	}
+
+	ret = transfer_list_init(
+	  &transfers[USB_TRANSFER_CONTROL], &transfers[USB_TRANSFER_BULK]);
+	if (ret != EOK) {
+		uhci_print_error("Failed to inititalize control queue.\n");
+		transfer_list_fini(&transfers[USB_TRANSFER_BULK]);
+		return ret;
+	}
+
+	ret = transfer_list_init(
+	  &transfers[USB_TRANSFER_INTERRUPT], &transfers[USB_TRANSFER_CONTROL]);
+	if (ret != EOK) {
+		uhci_print_error("Failed to interrupt control queue.\n");
+		transfer_list_fini(&transfers[USB_TRANSFER_CONTROL]);
+		transfer_list_fini(&transfers[USB_TRANSFER_BULK]);
+		return ret;
+	}
+
+	return EOK;
+}
Index: uspace/drv/uhci/uhci_struct/transfer_descriptor.h
===================================================================
--- uspace/drv/uhci/uhci_struct/transfer_descriptor.h	(revision 96005163d202072b0cdf54f68060b64c90325f7f)
+++ uspace/drv/uhci/uhci_struct/transfer_descriptor.h	(revision 643b98353f9443b4fab7c97692595995c2064a21)
@@ -35,4 +35,6 @@
 #define DRV_UHCI_TRANSFER_DESCRIPTOR_H
 
+#include <mem.h>
+#include <usb/usb.h>
 #include "callback.h"
 
@@ -70,5 +72,5 @@
 	char :1; /* reserved */
 	uint8_t toggle:1;
-	uint8_t end_point:4;
+	uint8_t endpoint:4;
 	uint8_t address:7;
 	uint8_t pid;
@@ -85,4 +87,29 @@
 } __attribute__((packed)) transfer_descriptor_t;
 
+static inline int transfer_descriptor_init(transfer_descriptor_t *instance,
+  int error_count, size_t size, bool isochronous, usb_target_t target,
+	int pid)
+{
+	assert(instance);
+	bzero(instance, sizeof(transfer_descriptor_t));
+
+	instance->depth = 1;
+	instance->terminate = 1;
+
+	assert(error_count < 4);
+	instance->error_count = error_count;
+	instance->status.active = 1;
+
+	assert(size < 1024);
+	instance->maxlen = size;
+
+	instance->address = target.address;
+	instance->endpoint = target.endpoint;
+
+	instance->pid = pid;
+
+	return EOK;
+}
+
 #endif
 /**
