Index: uspace/lib/drv/generic/remote_usbhc.c
===================================================================
--- uspace/lib/drv/generic/remote_usbhc.c	(revision 867e673594feb1369f8c454ec96150b18352e54e)
+++ uspace/lib/drv/generic/remote_usbhc.c	(revision 228f251738084b5f1ff0e2c12bfbacdfcf3f1689)
@@ -297,5 +297,5 @@
 	}
 
-	size_t expected_len = DEV_IPC_GET_ARG3(*call);
+	size_t max_packet_size = DEV_IPC_GET_ARG3(*call);
 	usb_target_t target = {
 		.address = DEV_IPC_GET_ARG1(*call),
@@ -305,13 +305,12 @@
 	size_t len = 0;
 	void *buffer = NULL;
-	if (expected_len > 0) {
-		int rc = async_data_write_accept(&buffer, false,
-		    1, USB_MAX_PAYLOAD_SIZE,
-		    0, &len);
-
-		if (rc != EOK) {
-			async_answer_0(callid, rc);
-			return;
-		}
+
+	int rc = async_data_write_accept(&buffer, false,
+	    1, USB_MAX_PAYLOAD_SIZE,
+	    0, &len);
+
+	if (rc != EOK) {
+		async_answer_0(callid, rc);
+		return;
 	}
 
@@ -328,5 +327,5 @@
 	trans->size = len;
 
-	int rc = transfer_func(device, target, HACK_MAX_PACKET_SIZE,
+	rc = transfer_func(device, target, max_packet_size,
 	    buffer, len,
 	    callback_out, trans);
@@ -354,5 +353,5 @@
 	}
 
-	size_t len = DEV_IPC_GET_ARG3(*call);
+	size_t max_packet_size = DEV_IPC_GET_ARG3(*call);
 	usb_target_t target = {
 		.address = DEV_IPC_GET_ARG1(*call),
@@ -360,4 +359,5 @@
 	};
 
+	size_t len;
 	ipc_callid_t data_callid;
 	if (!async_data_read_receive(&data_callid, &len)) {
@@ -375,5 +375,5 @@
 	trans->size = len;
 
-	int rc = transfer_func(device, target, HACK_MAX_PACKET_SIZE_INTERRUPT_IN,
+	int rc = transfer_func(device, target, max_packet_size,
 	    trans->buffer, len,
 	    callback_in, trans);
@@ -549,4 +549,5 @@
 	};
 	size_t data_buffer_len = DEV_IPC_GET_ARG3(*call);
+	size_t max_packet_size = DEV_IPC_GET_ARG4(*call);
 
 	int rc;
@@ -584,5 +585,5 @@
 	trans->size = data_buffer_len;
 
-	rc = usb_iface->control_write(device, target, HACK_MAX_PACKET_SIZE,
+	rc = usb_iface->control_write(device, target, max_packet_size,
 	    setup_packet, setup_packet_len,
 	    data_buffer, data_buffer_len,
@@ -611,4 +612,5 @@
 		.endpoint = DEV_IPC_GET_ARG2(*call)
 	};
+	size_t max_packet_size = DEV_IPC_GET_ARG3(*call);
 
 	int rc;
@@ -648,5 +650,5 @@
 	}
 
-	rc = usb_iface->control_read(device, target, HACK_MAX_PACKET_SIZE,
+	rc = usb_iface->control_read(device, target, max_packet_size,
 	    setup_packet, setup_packet_len,
 	    trans->buffer, trans->size,
Index: uspace/lib/drv/include/usbhc_iface.h
===================================================================
--- uspace/lib/drv/include/usbhc_iface.h	(revision 867e673594feb1369f8c454ec96150b18352e54e)
+++ uspace/lib/drv/include/usbhc_iface.h	(revision 228f251738084b5f1ff0e2c12bfbacdfcf3f1689)
@@ -53,5 +53,5 @@
  *   - argument #1 is target address
  *   - argument #2 is target endpoint
- *   - argument #3 is buffer size
+ *   - argument #3 is max packet size of the endpoint
  * - this call is immediately followed by IPC data write (from caller)
  * - the initial call (and the whole transaction) is answer after the
@@ -66,5 +66,5 @@
  *   - argument #1 is target address
  *   - argument #2 is target endpoint
- *   - argument #3 is buffer size
+ *   - argument #3 is max packet size of the endpoint
  * - this call is immediately followed by IPC data read (async version)
  * - the call is not answered until the device returns some data (or until
@@ -194,10 +194,9 @@
 	IPC_M_USBHC_CONTROL_WRITE,
 
-	/** Issue control WRITE transfer.
+	/** Issue control READ transfer.
 	 * See explanation at usb_iface_funcs_t (IN transaction) for
 	 * call parameters.
-	 * This call is immediately followed by IPC data read from the caller
-	 * (setup packet).
-	 * Actual data are retrieved through IPC_M_USBHC_GET_BUFFER.
+	 * This call is immediately followed by IPC data write from the caller
+	 * (setup packet) and IPC data read (buffer that was read).
 	 */
 	IPC_M_USBHC_CONTROL_READ,
Index: uspace/lib/usb/src/pipesio.c
===================================================================
--- uspace/lib/usb/src/pipesio.c	(revision 867e673594feb1369f8c454ec96150b18352e54e)
+++ uspace/lib/usb/src/pipesio.c	(revision 228f251738084b5f1ff0e2c12bfbacdfcf3f1689)
@@ -78,7 +78,8 @@
 	 * Make call identifying target USB device and type of transfer.
 	 */
-	aid_t opening_request = async_send_3(pipe->hc_phone,
+	aid_t opening_request = async_send_4(pipe->hc_phone,
 	    DEV_IFACE_ID(USBHC_DEV_IFACE), ipc_method,
 	    pipe->wire->address, pipe->endpoint_no,
+	    pipe->max_packet_size,
 	    NULL);
 	if (opening_request == 0) {
@@ -201,7 +202,8 @@
 	 * Make call identifying target USB device and type of transfer.
 	 */
-	aid_t opening_request = async_send_3(pipe->hc_phone,
+	aid_t opening_request = async_send_4(pipe->hc_phone,
 	    DEV_IFACE_ID(USBHC_DEV_IFACE), ipc_method,
 	    pipe->wire->address, pipe->endpoint_no,
+	    pipe->max_packet_size,
 	    NULL);
 	if (opening_request == 0) {
@@ -283,7 +285,8 @@
 	 * Make call identifying target USB device and control transfer type.
 	 */
-	aid_t opening_request = async_send_3(pipe->hc_phone,
+	aid_t opening_request = async_send_4(pipe->hc_phone,
 	    DEV_IFACE_ID(USBHC_DEV_IFACE), IPC_M_USBHC_CONTROL_READ,
 	    pipe->wire->address, pipe->endpoint_no,
+	    pipe->max_packet_size,
 	    NULL);
 	if (opening_request == 0) {
@@ -402,8 +405,9 @@
 	 * Make call identifying target USB device and control transfer type.
 	 */
-	aid_t opening_request = async_send_4(pipe->hc_phone,
+	aid_t opening_request = async_send_5(pipe->hc_phone,
 	    DEV_IFACE_ID(USBHC_DEV_IFACE), IPC_M_USBHC_CONTROL_WRITE,
 	    pipe->wire->address, pipe->endpoint_no,
 	    data_buffer_size,
+	    pipe->max_packet_size,
 	    NULL);
 	if (opening_request == 0) {