Index: uspace/drv/bus/usb/usbdiag/device.c
===================================================================
--- uspace/drv/bus/usb/usbdiag/device.c	(revision 7faf0f0d6efa841b26c49ec60562635b2657ffdf)
+++ uspace/drv/bus/usb/usbdiag/device.c	(revision 6a1211c7d0b8ed8ef4be1bafd0ec035d46c2c2d7)
@@ -35,4 +35,6 @@
  */
 #include <errno.h>
+#include <str_error.h>
+#include <macros.h>
 #include <usb/debug.h>
 #include <usbdiag_iface.h>
@@ -42,8 +44,60 @@
 #define NAME "usbdiag"
 
+static const usb_endpoint_description_t bulk_in_ep = {
+	.transfer_type = USB_TRANSFER_BULK,
+	.direction = USB_DIRECTION_IN,
+	.interface_class = 0xDC,
+	.interface_subclass = 0x00,
+	.interface_protocol = 0x01,
+	.flags = 0
+};
+
+static const usb_endpoint_description_t bulk_out_ep = {
+	.transfer_type = USB_TRANSFER_BULK,
+	.direction = USB_DIRECTION_OUT,
+	.interface_class = 0xDC,
+	.interface_subclass = 0x00,
+	.interface_protocol = 0x01,
+	.flags = 0
+};
+
 static int some_test(ddf_fun_t *fun, int x, int *y)
 {
+	int rc = EOK;
+	usb_diag_dev_t *dev = ddf_fun_to_usb_diag_dev(fun);
+
+	const size_t size = min(dev->bulk_in->desc.max_packet_size, dev->bulk_out->desc.max_packet_size);
+	char *buffer = (char *) malloc(size);
+	memset(buffer, 42, sizeof(buffer));
+
+	// Write buffer to device.
+	if ((rc = usb_pipe_write(dev->bulk_out, buffer, size))) {
+		usb_log_error("Bulk OUT write failed. %s\n", str_error(rc));
+	}
+
+	// Read device's response.
+	size_t remaining = size;
+	size_t transferred;
+	while (remaining > 0) {
+		if ((rc = usb_pipe_read(dev->bulk_in, buffer + size - remaining, remaining, &transferred))) {
+			usb_log_error("Bulk IN read failed. %s\n", str_error(rc));
+			break;
+		}
+
+		if (transferred > remaining) {
+			usb_log_error("Bulk IN read more than expected.\n");
+			rc = EINVAL;
+			break;
+		}
+
+		remaining -= transferred;
+	}
+
+	// TODO: Check output?
+
+	free(buffer);
+
 	*y = x + 42;
-	return EOK;
+	return rc;
 }
 
@@ -58,12 +112,32 @@
 static int device_init(usb_diag_dev_t *dev)
 {
+	int rc;
 	ddf_fun_t *fun = usb_device_ddf_fun_create(dev->usb_dev, fun_exposed, "tmon");
-	if (!fun)
-		return ENOMEM;
+	if (!fun) {
+		rc = ENOMEM;
+		goto err;
+	}
 
 	ddf_fun_set_ops(fun, &diag_ops);
+	dev->fun = fun;
 
-	dev->fun = fun;
+	usb_endpoint_mapping_t *epm_out = usb_device_get_mapped_ep_desc(dev->usb_dev, &bulk_out_ep);
+	usb_endpoint_mapping_t *epm_in = usb_device_get_mapped_ep_desc(dev->usb_dev, &bulk_in_ep);
+
+	if (!epm_in || !epm_out || !epm_in->present || !epm_out->present) {
+		usb_log_error("Required EPs were not mapped.\n");
+		rc = ENOENT;
+		goto err_fun;
+	}
+
+	dev->bulk_out = &epm_out->pipe;
+	dev->bulk_in = &epm_in->pipe;
+
 	return EOK;
+
+err_fun:
+	ddf_fun_destroy(fun);
+err:
+	return rc;
 }
 
Index: uspace/drv/bus/usb/usbdiag/device.h
===================================================================
--- uspace/drv/bus/usb/usbdiag/device.h	(revision 7faf0f0d6efa841b26c49ec60562635b2657ffdf)
+++ uspace/drv/bus/usb/usbdiag/device.h	(revision 6a1211c7d0b8ed8ef4be1bafd0ec035d46c2c2d7)
@@ -45,4 +45,6 @@
 	usb_device_t *usb_dev;
 	ddf_fun_t *fun;
+	usb_pipe_t *bulk_in;
+	usb_pipe_t *bulk_out;
 } usb_diag_dev_t;
 
@@ -50,8 +52,20 @@
 void usb_diag_dev_destroy(usb_diag_dev_t *);
 
-static inline usb_diag_dev_t * usb_diag_dev_get(usb_device_t *usb_dev)
+static inline usb_diag_dev_t * usb_device_to_usb_diag_dev(usb_device_t *usb_dev)
 {
 	assert(usb_dev);
 	return usb_device_data_get(usb_dev);
+}
+
+static inline usb_diag_dev_t * ddf_dev_to_usb_diag_dev(ddf_dev_t *ddf_dev)
+{
+	assert(ddf_dev);
+	return usb_device_to_usb_diag_dev(usb_device_get(ddf_dev));
+}
+
+static inline usb_diag_dev_t * ddf_fun_to_usb_diag_dev(ddf_fun_t *ddf_fun)
+{
+	assert(ddf_fun);
+	return ddf_dev_to_usb_diag_dev(ddf_fun_get_dev(ddf_fun));
 }
 
Index: uspace/drv/bus/usb/usbdiag/main.c
===================================================================
--- uspace/drv/bus/usb/usbdiag/main.c	(revision 7faf0f0d6efa841b26c49ec60562635b2657ffdf)
+++ uspace/drv/bus/usb/usbdiag/main.c	(revision 6a1211c7d0b8ed8ef4be1bafd0ec035d46c2c2d7)
@@ -82,5 +82,5 @@
 	usb_log_info("Removing device '%s'", usb_device_get_name(dev));
 
-	usb_diag_dev_t *diag_dev = usb_diag_dev_get(dev);
+	usb_diag_dev_t *diag_dev = usb_device_to_usb_diag_dev(dev);
 
 	/* TODO: Make sure nothing is going on with the device. */
@@ -103,5 +103,5 @@
 	usb_log_info("Device '%s' gone.", usb_device_get_name(dev));
 
-	usb_diag_dev_t *diag_dev = usb_diag_dev_get(dev);
+	usb_diag_dev_t *diag_dev = usb_device_to_usb_diag_dev(dev);
 
 	/* TODO: Make sure nothing is going on with the device. */