diff --git a/ccid/ccid_device.c b/ccid/ccid_device.c
index b7077df..e3705ae 100644
--- a/ccid/ccid_device.c
+++ b/ccid/ccid_device.c
@@ -157,7 +157,7 @@
 /* Send given CCID message */
 static int ccid_send(struct ccid_instance *ci, struct msgb *msg)
 {
-	return ci->ops.send_in(ci, msg);
+	return ci->ops->send_in(ci, msg);
 }
 
 /* Send given CCID message for given slot; patch bSlot into message */
@@ -717,3 +717,18 @@
 	/* FIXME */
 	return -1;
 }
+
+void ccid_instance_init(struct ccid_instance *ci, const struct ccid_ops *ops, const char *name,
+			void *priv)
+{
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(ci->slot); i++) {
+		struct ccid_slot *cs = &ci->slot[i];
+		cs->slot_nr = i;
+		cs->ci = ci;
+	}
+	ci->ops= ops;
+	ci->name = name;
+	ci->priv = priv;
+}
diff --git a/ccid/ccid_device.h b/ccid/ccid_device.h
index c7cef47..4cdb325 100644
--- a/ccid/ccid_device.h
+++ b/ccid/ccid_device.h
@@ -63,8 +63,12 @@
 	/* slots within the reader */
 	struct ccid_slot slot[NR_SLOTS];
 	/* set of function pointers implementing specific operations */
-	const struct ccid_ops ops;
+	const struct ccid_ops *ops;
 	const char *name;
+	/* user-supplied opaque data */
+	void *priv;
 };
 
+void ccid_instance_init(struct ccid_instance *ci, const struct ccid_ops *ops, const char *name,
+			void *priv);
 int ccid_handle_out(struct ccid_instance *ci, struct msgb *msg);
diff --git a/ccid/ccid_main_functionfs.c b/ccid/ccid_main_functionfs.c
index 84eb70c..2b57182 100644
--- a/ccid/ccid_main_functionfs.c
+++ b/ccid/ccid_main_functionfs.c
@@ -277,16 +277,19 @@
 		} else if (fd == uh->ep_in.fd) {
 			/* IN endpoint AIO has completed. This means the IN transfer which
 			 * we sent to the host has completed */
+			msgb_free(uh->aio_in.msg);
+			uh->aio_in.msg = NULL;
 		} else if (fd == uh->ep_out.fd) {
 			/* IN endpoint AIO has completed. This means the host has sent us
 			 * some OUT data */
-			//printf("\t%s\n", osmo_hexdump(uh->aio_out.buf, evt[i].res));
-			//ccid_handle_out(uh->ccid_handle, uh->aio_out.buf, evt[i].res);
 			msgb_put(uh->aio_out.msg, evt[i].res);
+			printf("\t%s\n", msgb_hexdump(uh->aio_out.msg));
+			//ccid_handle_out(uh->ccid_handle, uh->aio_out.buf, evt[i].res);
 			ccid_handle_out(uh->ccid_handle, uh->aio_out.msg);
 			aio_refill_out(uh);
 		}
 	}
+	return 0;
 }
 #endif
 
@@ -353,12 +356,37 @@
 	return 0;
 }
 
+static int ccid_ops_send_in(struct ccid_instance *ci, struct msgb *msg)
+{
+	struct ufunc_handle *uh = ci->priv;
+	struct aio_help *ah = &uh->aio_in;
+	int rc;
+
+	/* FIXME: does this work with multiple iocbs? probably not yet! */
+	ah->iocb = malloc(sizeof(struct iocb));
+	OSMO_ASSERT(ah->iocb);
+	ah->msg = msg;
+	io_prep_pwrite(ah->iocb, uh->ep_in.fd, msgb_data(msg), msgb_length(msg), 0);
+	io_set_eventfd(ah->iocb, uh->aio_evfd.fd);
+	rc = io_submit(uh->aio_ctx, 1, &ah->iocb);
+	OSMO_ASSERT(rc >= 0);
+
+	return 0;
+}
+
+static const struct ccid_ops c_ops = {
+	.send_in = ccid_ops_send_in,
+};
 
 int main(int argc, char **argv)
 {
 	struct ufunc_handle ufh = (struct ufunc_handle) { 0, };
+	struct ccid_instance ci = (struct ccid_instance) { 0, };
 	int rc;
 
+	ccid_instance_init(&ci, &c_ops, "", &ufh);
+	ufh.ccid_handle = &ci;
+
 	chdir(argv[1]);
 	rc = ep0_init(&ufh);
 	if (rc < 0) {