27 files changed, 871 insertions, 733 deletions

diff --git a/drivers/uwb/Makefile b/drivers/uwb/Makefile
index 257e6908304c..ce21a95da04a 100644
--- a/drivers/uwb/Makefile
+++ b/drivers/uwb/Makefile
@@ -13,10 +13,12 @@ uwb-objs :=		\
         drp-ie.o        \
         est.o           \
         ie.o            \
+        ie-rcv.o        \
         lc-dev.o        \
         lc-rc.o         \
         neh.o           \
         pal.o           \
+        radio.o         \
         reset.o         \
         rsv.o           \
         scan.o          \
diff --git a/drivers/uwb/beacon.c b/drivers/uwb/beacon.c
index 46b18eec5026..d9c60cb94993 100644
--- a/drivers/uwb/beacon.c
+++ b/drivers/uwb/beacon.c
@@ -119,7 +119,6 @@ int uwb_rc_beacon(struct uwb_rc *rc, int channel, unsigned bpst_offset)
         int result;
         struct device *dev = &rc->uwb_dev.dev;
 
-        mutex_lock(&rc->uwb_dev.mutex);
         if (channel < 0)
                 channel = -1;
         if (channel == -1)
@@ -128,7 +127,7 @@ int uwb_rc_beacon(struct uwb_rc *rc, int channel, unsigned bpst_offset)
                 /* channel >= 0...dah */
                 result = uwb_rc_start_beacon(rc, bpst_offset, channel);
                 if (result < 0)
-                        goto out_up;
+                        return result;
                 if (le16_to_cpu(rc->ies->wIELength) > 0) {
                         result = uwb_rc_set_ie(rc, rc->ies);
                         if (result < 0) {
@@ -137,19 +136,12 @@ int uwb_rc_beacon(struct uwb_rc *rc, int channel, unsigned bpst_offset)
                                 result = uwb_rc_stop_beacon(rc);
                                 channel = -1;
                                 bpst_offset = 0;
-                        } else
-                                result = 0;
+                        }
                 }
         }
 
-        if (result < 0)
-                goto out_up;
-        rc->beaconing = channel;
-
-        uwb_notify(rc, NULL, uwb_bg_joined(rc) ? UWB_NOTIF_BG_JOIN : UWB_NOTIF_BG_LEAVE);
-
-out_up:
-        mutex_unlock(&rc->uwb_dev.mutex);
+        if (result >= 0)
+                rc->beaconing = channel;
         return result;
 }
 
@@ -168,12 +160,6 @@ out_up:
  * FIXME: use something faster for search than a list
  */
 
-struct uwb_beca uwb_beca = {
-        .list = LIST_HEAD_INIT(uwb_beca.list),
-        .mutex = __MUTEX_INITIALIZER(uwb_beca.mutex)
-};
-
-
 void uwb_bce_kfree(struct kref *_bce)
 {
         struct uwb_beca_e *bce = container_of(_bce, struct uwb_beca_e, refcnt);
@@ -185,10 +171,11 @@ void uwb_bce_kfree(struct kref *_bce)
 
 /* Find a beacon by dev addr in the cache */
 static
-struct uwb_beca_e *__uwb_beca_find_bydev(const struct uwb_dev_addr *dev_addr)
+struct uwb_beca_e *__uwb_beca_find_bydev(struct uwb_rc *rc,
+                                         const struct uwb_dev_addr *dev_addr)
 {
         struct uwb_beca_e *bce, *next;
-        list_for_each_entry_safe(bce, next, &uwb_beca.list, node) {
+        list_for_each_entry_safe(bce, next, &rc->uwb_beca.list, node) {
                 d_printf(6, NULL, "looking for addr %02x:%02x in %02x:%02x\n",
                          dev_addr->data[0], dev_addr->data[1],
                          bce->dev_addr.data[0], bce->dev_addr.data[1]);
@@ -202,10 +189,11 @@ out:
 
 /* Find a beacon by dev addr in the cache */
 static
-struct uwb_beca_e *__uwb_beca_find_bymac(const struct uwb_mac_addr *mac_addr)
+struct uwb_beca_e *__uwb_beca_find_bymac(struct uwb_rc *rc, 
+                                         const struct uwb_mac_addr *mac_addr)
 {
         struct uwb_beca_e *bce, *next;
-        list_for_each_entry_safe(bce, next, &uwb_beca.list, node) {
+        list_for_each_entry_safe(bce, next, &rc->uwb_beca.list, node) {
                 if (!memcmp(bce->mac_addr, mac_addr->data,
                             sizeof(struct uwb_mac_addr)))
                         goto out;
@@ -229,11 +217,11 @@ struct uwb_dev *uwb_dev_get_by_devaddr(struct uwb_rc *rc,
         struct uwb_dev *found = NULL;
         struct uwb_beca_e *bce;
 
-        mutex_lock(&uwb_beca.mutex);
-        bce = __uwb_beca_find_bydev(devaddr);
+        mutex_lock(&rc->uwb_beca.mutex);
+        bce = __uwb_beca_find_bydev(rc, devaddr);
         if (bce)
                 found = uwb_dev_try_get(rc, bce->uwb_dev);
-        mutex_unlock(&uwb_beca.mutex);
+        mutex_unlock(&rc->uwb_beca.mutex);
 
         return found;
 }
@@ -249,11 +237,11 @@ struct uwb_dev *uwb_dev_get_by_macaddr(struct uwb_rc *rc,
         struct uwb_dev *found = NULL;
         struct uwb_beca_e *bce;
 
-        mutex_lock(&uwb_beca.mutex);
-        bce = __uwb_beca_find_bymac(macaddr);
+        mutex_lock(&rc->uwb_beca.mutex);
+        bce = __uwb_beca_find_bymac(rc, macaddr);
         if (bce)
                 found = uwb_dev_try_get(rc, bce->uwb_dev);
-        mutex_unlock(&uwb_beca.mutex);
+        mutex_unlock(&rc->uwb_beca.mutex);
 
         return found;
 }
@@ -274,7 +262,9 @@ static void uwb_beca_e_init(struct uwb_beca_e *bce)
  * @bf:         Beacon frame (part of b, really)
  * @ts_jiffies: Timestamp (in jiffies) when the beacon was received
  */
-struct uwb_beca_e *__uwb_beca_add(struct uwb_rc_evt_beacon *be,
+static
+struct uwb_beca_e *__uwb_beca_add(struct uwb_rc *rc,
+                                  struct uwb_rc_evt_beacon *be,
                                   struct uwb_beacon_frame *bf,
                                   unsigned long ts_jiffies)
 {
@@ -286,7 +276,7 @@ struct uwb_beca_e *__uwb_beca_add(struct uwb_rc_evt_beacon *be,
         uwb_beca_e_init(bce);
         bce->ts_jiffies = ts_jiffies;
         bce->uwb_dev = NULL;
-        list_add(&bce->node, &uwb_beca.list);
+        list_add(&bce->node, &rc->uwb_beca.list);
         return bce;
 }
 
@@ -295,13 +285,13 @@ struct uwb_beca_e *__uwb_beca_add(struct uwb_rc_evt_beacon *be,
  *
  * Remove associated devicest too.
  */
-void uwb_beca_purge(void)
+void uwb_beca_purge(struct uwb_rc *rc)
 {
         struct uwb_beca_e *bce, *next;
         unsigned long expires;
 
-        mutex_lock(&uwb_beca.mutex);
-        list_for_each_entry_safe(bce, next, &uwb_beca.list, node) {
+        mutex_lock(&rc->uwb_beca.mutex);
+        list_for_each_entry_safe(bce, next, &rc->uwb_beca.list, node) {
                 expires = bce->ts_jiffies + msecs_to_jiffies(beacon_timeout_ms);
                 if (time_after(jiffies, expires)) {
                         uwbd_dev_offair(bce);
@@ -309,19 +299,20 @@ void uwb_beca_purge(void)
                         uwb_bce_put(bce);
                 }
         }
-        mutex_unlock(&uwb_beca.mutex);
+        mutex_unlock(&rc->uwb_beca.mutex);
 }
 
 /* Clean up the whole beacon cache. Called on shutdown */
-void uwb_beca_release(void)
+void uwb_beca_release(struct uwb_rc *rc)
 {
         struct uwb_beca_e *bce, *next;
-        mutex_lock(&uwb_beca.mutex);
-        list_for_each_entry_safe(bce, next, &uwb_beca.list, node) {
+
+        mutex_lock(&rc->uwb_beca.mutex);
+        list_for_each_entry_safe(bce, next, &rc->uwb_beca.list, node) {
                 list_del(&bce->node);
                 uwb_bce_put(bce);
         }
-        mutex_unlock(&uwb_beca.mutex);
+        mutex_unlock(&rc->uwb_beca.mutex);
 }
 
 static void uwb_beacon_print(struct uwb_rc *rc, struct uwb_rc_evt_beacon *be,
@@ -349,22 +340,22 @@ ssize_t uwb_bce_print_IEs(struct uwb_dev *uwb_dev, struct uwb_beca_e *bce,
         ssize_t result = 0;
         struct uwb_rc_evt_beacon *be;
         struct uwb_beacon_frame *bf;
-        struct uwb_buf_ctx ctx = {
-                .buf = buf,
-                .bytes = 0,
-                .size = size
-        };
+        int ies_len;
+        struct uwb_ie_hdr *ies;
 
         mutex_lock(&bce->mutex);
+
         be = bce->be;
-        if (be == NULL)
-                goto out;
-        bf = (void *) be->BeaconInfo;
-        uwb_ie_for_each(uwb_dev, uwb_ie_dump_hex, &ctx,
-                        bf->IEData, be->wBeaconInfoLength - sizeof(*bf));
-        result = ctx.bytes;
-out:
+        if (be) {
+                bf = (struct uwb_beacon_frame *)bce->be->BeaconInfo;
+                ies_len = be->wBeaconInfoLength - sizeof(struct uwb_beacon_frame);
+                ies = (struct uwb_ie_hdr *)bf->IEData;
+
+                result = uwb_ie_dump_hex(ies, ies_len, buf, size);
+        }
+
         mutex_unlock(&bce->mutex);
+
         return result;
 }
 
@@ -437,18 +428,18 @@ int uwbd_evt_handle_rc_beacon(struct uwb_event *evt)
         if (uwb_mac_addr_bcast(&bf->Device_Identifier))
                 return 0;
 
-        mutex_lock(&uwb_beca.mutex);
-        bce = __uwb_beca_find_bymac(&bf->Device_Identifier);
+        mutex_lock(&rc->uwb_beca.mutex);
+        bce = __uwb_beca_find_bymac(rc, &bf->Device_Identifier);
         if (bce == NULL) {
                 /* Not in there, a new device is pinging */
                 uwb_beacon_print(evt->rc, be, bf);
-                bce = __uwb_beca_add(be, bf, evt->ts_jiffies);
+                bce = __uwb_beca_add(rc, be, bf, evt->ts_jiffies);
                 if (bce == NULL) {
-                        mutex_unlock(&uwb_beca.mutex);
+                        mutex_unlock(&rc->uwb_beca.mutex);
                         return -ENOMEM;
                 }
         }
-        mutex_unlock(&uwb_beca.mutex);
+        mutex_unlock(&rc->uwb_beca.mutex);
 
         mutex_lock(&bce->mutex);
         /* purge old beacon data */
@@ -588,19 +579,6 @@ error:
         return result;
 }
 
-/**
- * uwb_bg_joined - is the RC in a beacon group?
- * @rc: the radio controller
- *
- * Returns true if the radio controller is in a beacon group (even if
- * it's the sole member).
- */
-int uwb_bg_joined(struct uwb_rc *rc)
-{
-        return rc->beaconing != -1;
-}
-EXPORT_SYMBOL_GPL(uwb_bg_joined);
-
 /*
  * Print beaconing state.
  */
@@ -619,9 +597,6 @@ static ssize_t uwb_rc_beacon_show(struct device *dev,
 
 /*
  * Start beaconing on the specified channel, or stop beaconing.
- *
- * The BPST offset of when to start searching for a beacon group to
- * join may be specified.
  */
 static ssize_t uwb_rc_beacon_store(struct device *dev,
                                    struct device_attribute *attr,
@@ -630,12 +605,11 @@ static ssize_t uwb_rc_beacon_store(struct device *dev,
         struct uwb_dev *uwb_dev = to_uwb_dev(dev);
         struct uwb_rc *rc = uwb_dev->rc;
         int channel;
-        unsigned bpst_offset = 0;
         ssize_t result = -EINVAL;
 
-        result = sscanf(buf, "%d %u\n", &channel, &bpst_offset);
+        result = sscanf(buf, "%d", &channel);
         if (result >= 1)
-                result = uwb_rc_beacon(rc, channel, bpst_offset);
+                result = uwb_radio_force_channel(rc, channel);
 
         return result < 0 ? result : size;
 }
diff --git a/drivers/uwb/driver.c b/drivers/uwb/driver.c
index 521cdeb84971..f57c26580de2 100644
--- a/drivers/uwb/driver.c
+++ b/drivers/uwb/driver.c
@@ -118,7 +118,6 @@ static int __init uwb_subsys_init(void)
         result = class_register(&uwb_rc_class);
         if (result < 0)
                 goto error_uwb_rc_class_register;
-        uwbd_start();
         uwb_dbg_init();
         return 0;
 
@@ -132,7 +131,6 @@ module_init(uwb_subsys_init);
 static void __exit uwb_subsys_exit(void)
 {
         uwb_dbg_exit();
-        uwbd_stop();
         class_unregister(&uwb_rc_class);
         uwb_est_destroy();
         return;
diff --git a/drivers/uwb/drp-ie.c b/drivers/uwb/drp-ie.c
index 882724c5f126..75491d47806b 100644
--- a/drivers/uwb/drp-ie.c
+++ b/drivers/uwb/drp-ie.c
@@ -16,7 +16,6 @@
  * You should have received a copy of the GNU General Public License
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
-#include <linux/version.h>
 #include <linux/kernel.h>
 #include <linux/random.h>
 #include <linux/uwb.h>
diff --git a/drivers/uwb/drp.c b/drivers/uwb/drp.c
index c0b1e5e2bd08..fe328146adb7 100644
--- a/drivers/uwb/drp.c
+++ b/drivers/uwb/drp.c
@@ -37,14 +37,13 @@
  *
  * A DRP Availability IE is appended.
  *
- * rc->uwb_dev.mutex is held
+ * rc->rsvs_mutex is held
  *
  * FIXME We currently ignore the returned value indicating the remaining space
  * in beacon. This could be used to deny reservation requests earlier if
  * determined that they would cause the beacon space to be exceeded.
  */
-static
-int uwb_rc_gen_send_drp_ie(struct uwb_rc *rc)
+int uwb_rc_send_all_drp_ie(struct uwb_rc *rc)
 {
         int result;
         struct device *dev = &rc->uwb_dev.dev;
@@ -102,25 +101,6 @@ error_cmd:
         kfree(cmd);
 error:
         return result;
-
-}
-/**
- * Send all DRP IEs associated with this host
- *
- * @returns:    >= 0 number of bytes still available in the beacon
- *              < 0 errno code on error.
- *
- * As per the protocol we obtain the host controller device lock to access
- * bandwidth structures.
- */
-int uwb_rc_send_all_drp_ie(struct uwb_rc *rc)
-{
-        int result;
-
-        mutex_lock(&rc->uwb_dev.mutex);
-        result = uwb_rc_gen_send_drp_ie(rc);
-        mutex_unlock(&rc->uwb_dev.mutex);
-        return result;
 }
 
 void uwb_drp_handle_timeout(struct uwb_rsv *rsv)
diff --git a/drivers/uwb/hwa-rc.c b/drivers/uwb/hwa-rc.c
index 3d26fa0f8ae1..158e98d08af9 100644
--- a/drivers/uwb/hwa-rc.c
+++ b/drivers/uwb/hwa-rc.c
@@ -51,7 +51,6 @@
  *
  *
  */
-#include <linux/version.h>
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/usb.h>
@@ -882,6 +881,24 @@ static void hwarc_disconnect(struct usb_interface *iface)
         uwb_rc_put(uwb_rc);     /* when creating the device, refcount = 1 */
 }
 
+static int hwarc_pre_reset(struct usb_interface *iface)
+{
+        struct hwarc *hwarc = usb_get_intfdata(iface);
+        struct uwb_rc *uwb_rc = hwarc->uwb_rc;
+
+        uwb_rc_pre_reset(uwb_rc);
+        return 0;
+}
+
+static int hwarc_post_reset(struct usb_interface *iface)
+{
+        struct hwarc *hwarc = usb_get_intfdata(iface);
+        struct uwb_rc *uwb_rc = hwarc->uwb_rc;
+
+        uwb_rc_post_reset(uwb_rc);
+        return 0;
+}
+
 /** USB device ID's that we handle */
 static struct usb_device_id hwarc_id_table[] = {
         /* D-Link DUB-1210 */
@@ -898,9 +915,11 @@ MODULE_DEVICE_TABLE(usb, hwarc_id_table);
 
 static struct usb_driver hwarc_driver = {
         .name =         "hwa-rc",
+        .id_table =     hwarc_id_table,
         .probe =        hwarc_probe,
         .disconnect =   hwarc_disconnect,
-        .id_table =     hwarc_id_table,
+        .pre_reset =    hwarc_pre_reset,
+        .post_reset =   hwarc_post_reset,
 };
 
 static int __init hwarc_driver_init(void)
diff --git a/drivers/uwb/i1480/dfu/usb.c b/drivers/uwb/i1480/dfu/usb.c
index 98eeeff051aa..b7ea525fc06a 100644
--- a/drivers/uwb/i1480/dfu/usb.c
+++ b/drivers/uwb/i1480/dfu/usb.c
@@ -35,7 +35,6 @@
  * the functions are i1480_usb_NAME().
  */
 #include <linux/module.h>
-#include <linux/version.h>
 #include <linux/usb.h>
 #include <linux/interrupt.h>
 #include <linux/delay.h>
diff --git a/drivers/uwb/i1480/i1480u-wlp/lc.c b/drivers/uwb/i1480/i1480u-wlp/lc.c
index 737d60cd5b73..488b2e30a0a8 100644
--- a/drivers/uwb/i1480/i1480u-wlp/lc.c
+++ b/drivers/uwb/i1480/i1480u-wlp/lc.c
@@ -55,7 +55,6 @@
  *                          is being removed.
  *         i1480u_rm()
  */
-#include <linux/version.h>
 #include <linux/if_arp.h>
 #include <linux/etherdevice.h>
 #include <linux/uwb/debug.h>
@@ -207,7 +206,7 @@ int i1480u_add(struct i1480u *i1480u, struct usb_interface *iface)
         wlp->fill_device_info = i1480u_fill_device_info;
         wlp->stop_queue = i1480u_stop_queue;
         wlp->start_queue = i1480u_start_queue;
-        result = wlp_setup(wlp, rc);
+        result = wlp_setup(wlp, rc, net_dev);
         if (result < 0) {
                 dev_err(&iface->dev, "Cannot setup WLP\n");
                 goto error_wlp_setup;
diff --git a/drivers/uwb/i1480/i1480u-wlp/netdev.c b/drivers/uwb/i1480/i1480u-wlp/netdev.c
index 8802ac43d872..2eafb973cd05 100644
--- a/drivers/uwb/i1480/i1480u-wlp/netdev.c
+++ b/drivers/uwb/i1480/i1480u-wlp/netdev.c
@@ -207,6 +207,11 @@ int i1480u_open(struct net_device *net_dev)
         result = i1480u_rx_setup(i1480u);               /* Alloc RX stuff */
         if (result < 0)
                 goto error_rx_setup;
+
+        result = uwb_radio_start(&wlp->pal);
+        if (result < 0)
+                goto error_radio_start;
+
         netif_wake_queue(net_dev);
 #ifdef i1480u_FLOW_CONTROL
         result = usb_submit_urb(i1480u->notif_urb, GFP_KERNEL);;
@@ -215,25 +220,20 @@ int i1480u_open(struct net_device *net_dev)
                 goto error_notif_urb_submit;
         }
 #endif
-        i1480u->uwb_notifs_handler.cb = i1480u_uwb_notifs_cb;
-        i1480u->uwb_notifs_handler.data = i1480u;
-        if (uwb_bg_joined(rc))
-                netif_carrier_on(net_dev);
-        else
-                netif_carrier_off(net_dev);
-        uwb_notifs_register(rc, &i1480u->uwb_notifs_handler);
         /* Interface is up with an address, now we can create WSS */
         result = wlp_wss_setup(net_dev, &wlp->wss);
         if (result < 0) {
                 dev_err(dev, "Can't create WSS: %d. \n", result);
-                goto error_notif_deregister;
+                goto error_wss_setup;
         }
         return 0;
-error_notif_deregister:
-        uwb_notifs_deregister(rc, &i1480u->uwb_notifs_handler);
+error_wss_setup:
 #ifdef i1480u_FLOW_CONTROL
+        usb_kill_urb(i1480u->notif_urb);
 error_notif_urb_submit:
 #endif
+        uwb_radio_stop(&wlp->pal);
+error_radio_start:
         netif_stop_queue(net_dev);
         i1480u_rx_release(i1480u);
 error_rx_setup:
@@ -248,16 +248,15 @@ int i1480u_stop(struct net_device *net_dev)
 {
         struct i1480u *i1480u = netdev_priv(net_dev);
         struct wlp *wlp = &i1480u->wlp;
-        struct uwb_rc *rc = wlp->rc;
 
         BUG_ON(wlp->rc == NULL);
         wlp_wss_remove(&wlp->wss);
-        uwb_notifs_deregister(rc, &i1480u->uwb_notifs_handler);
         netif_carrier_off(net_dev);
 #ifdef i1480u_FLOW_CONTROL
         usb_kill_urb(i1480u->notif_urb);
 #endif
         netif_stop_queue(net_dev);
+        uwb_radio_stop(&wlp->pal);
         i1480u_rx_release(i1480u);
         i1480u_tx_release(i1480u);
         return 0;
@@ -303,34 +302,6 @@ int i1480u_change_mtu(struct net_device *net_dev, int mtu)
         return 0;
 }
 
-
-/**
- * Callback function to handle events from UWB
- * When we see other devices we know the carrier is ok,
- * if we are the only device in the beacon group we set the carrier
- * state to off.
- * */
-void i1480u_uwb_notifs_cb(void *data, struct uwb_dev *uwb_dev,
-                          enum uwb_notifs event)
-{
-        struct i1480u *i1480u = data;
-        struct net_device *net_dev = i1480u->net_dev;
-        struct device *dev = &i1480u->usb_iface->dev;
-        switch (event) {
-        case UWB_NOTIF_BG_JOIN:
-                netif_carrier_on(net_dev);
-                dev_info(dev, "Link is up\n");
-                break;
-        case UWB_NOTIF_BG_LEAVE:
-                netif_carrier_off(net_dev);
-                dev_info(dev, "Link is down\n");
-                break;
-        default:
-                dev_err(dev, "don't know how to handle event %d from uwb\n",
-                                event);
-        }
-}
-
 /**
  * Stop the network queue
  *
diff --git a/drivers/uwb/i1480/i1480u-wlp/sysfs.c b/drivers/uwb/i1480/i1480u-wlp/sysfs.c
index a1d8ca6ac935..a92a787725fc 100644
--- a/drivers/uwb/i1480/i1480u-wlp/sysfs.c
+++ b/drivers/uwb/i1480/i1480u-wlp/sysfs.c
@@ -226,7 +226,6 @@ ssize_t wlp_tx_inflight_store(struct i1480u_tx_inflight *inflight,
  * (CLASS_DEVICE_ATTR or DEVICE_ATTR) and i1480u_ATTR_NAME produces a
  * class_device_attr_NAME or device_attr_NAME (for group registration).
  */
-#include <linux/version.h>
 
 #define i1480u_SHOW(name, fn, param)                            \
 static ssize_t i1480u_show_##name(struct device *dev,           \
diff --git a/drivers/uwb/ie-rcv.c b/drivers/uwb/ie-rcv.c
new file mode 100644
index 000000000000..917e6d78a798
--- /dev/null
+++ b/drivers/uwb/ie-rcv.c
@@ -0,0 +1,55 @@
+/*
+ * Ultra Wide Band
+ * IE Received notification handling.
+ *
+ * Copyright (C) 2008 Cambridge Silicon Radio Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License version
+ * 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/errno.h>
+#include <linux/module.h>
+#include <linux/device.h>
+#include <linux/bitmap.h>
+#include "uwb-internal.h"
+
+/*
+ * Process an incoming IE Received notification.
+ */
+int uwbd_evt_handle_rc_ie_rcv(struct uwb_event *evt)
+{
+        int result = -EINVAL;
+        struct device *dev = &evt->rc->uwb_dev.dev;
+        struct uwb_rc_evt_ie_rcv *iercv;
+        size_t iesize;
+
+        /* Is there enough data to decode it? */
+        if (evt->notif.size < sizeof(*iercv)) {
+                dev_err(dev, "IE Received notification: Not enough data to "
+                        "decode (%zu vs %zu bytes needed)\n",
+                        evt->notif.size, sizeof(*iercv));
+                goto error;
+        }
+        iercv = container_of(evt->notif.rceb, struct uwb_rc_evt_ie_rcv, rceb);
+        iesize = le16_to_cpu(iercv->wIELength);
+
+        dev_dbg(dev, "IE received, element ID=%d\n", iercv->IEData[0]);
+
+        if (iercv->IEData[0] == UWB_RELINQUISH_REQUEST_IE) {
+                dev_warn(dev, "unhandled Relinquish Request IE\n");
+        }
+
+        return 0;
+error:
+        return result;
+}
diff --git a/drivers/uwb/ie.c b/drivers/uwb/ie.c
index cf6f3d152b9d..ab976686175b 100644
--- a/drivers/uwb/ie.c
+++ b/drivers/uwb/ie.c
@@ -25,8 +25,6 @@
  */
 
 #include "uwb-internal.h"
-#define D_LOCAL 0
-#include <linux/uwb/debug.h>
 
 /**
  * uwb_ie_next - get the next IE in a buffer
@@ -61,6 +59,42 @@ struct uwb_ie_hdr *uwb_ie_next(void **ptr, size_t *len)
 EXPORT_SYMBOL_GPL(uwb_ie_next);
 
 /**
+ * uwb_ie_dump_hex - print IEs to a character buffer
+ * @ies: the IEs to print.
+ * @len: length of all the IEs.
+ * @buf: the destination buffer.
+ * @size: size of @buf.
+ *
+ * Returns the number of characters written.
+ */
+int uwb_ie_dump_hex(const struct uwb_ie_hdr *ies, size_t len,
+                    char *buf, size_t size)
+{
+        void *ptr;
+        const struct uwb_ie_hdr *ie;
+        int r = 0;
+        u8 *d;
+
+        ptr = (void *)ies;
+        for (;;) {
+                ie = uwb_ie_next(&ptr, &len);
+                if (!ie)
+                        break;
+
+                r += scnprintf(buf + r, size - r, "%02x %02x",
+                               (unsigned)ie->element_id,
+                               (unsigned)ie->length);
+                d = (uint8_t *)ie + sizeof(struct uwb_ie_hdr);
+                while (d != ptr && r < size)
+                        r += scnprintf(buf + r, size - r, " %02x", (unsigned)*d++);
+                if (r < size)
+                        buf[r++] = '\n';
+        };
+
+        return r;
+}
+
+/**
  * Get the IEs that a radio controller is sending in its beacon
  *
  * @uwb_rc:  UWB Radio Controller
@@ -70,6 +104,7 @@ EXPORT_SYMBOL_GPL(uwb_ie_next);
  * anything. Once done with the iedata buffer, call
  * uwb_rc_ie_release(iedata). Don't call kfree on it.
  */
+static
 ssize_t uwb_rc_get_ie(struct uwb_rc *uwb_rc, struct uwb_rc_evt_get_ie **pget_ie)
 {
         ssize_t result;
@@ -78,148 +113,35 @@ ssize_t uwb_rc_get_ie(struct uwb_rc *uwb_rc, struct uwb_rc_evt_get_ie **pget_ie)
         struct uwb_rceb *reply = NULL;
         struct uwb_rc_evt_get_ie *get_ie;
 
-        d_fnstart(3, dev, "(%p, %p)\n", uwb_rc, pget_ie);
-        result = -ENOMEM;
         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
         if (cmd == NULL)
-                goto error_kzalloc;
+                return -ENOMEM;
+
         cmd->bCommandType = UWB_RC_CET_GENERAL;
         cmd->wCommand = cpu_to_le16(UWB_RC_CMD_GET_IE);
         result = uwb_rc_vcmd(uwb_rc, "GET_IE", cmd, sizeof(*cmd),
                              UWB_RC_CET_GENERAL, UWB_RC_CMD_GET_IE,
                              &reply);
+        kfree(cmd);
         if (result < 0)
-                goto error_cmd;
+                return result;
+
         get_ie = container_of(reply, struct uwb_rc_evt_get_ie, rceb);
         if (result < sizeof(*get_ie)) {
                 dev_err(dev, "not enough data returned for decoding GET IE "
                         "(%zu bytes received vs %zu needed)\n",
                         result, sizeof(*get_ie));
-                result = -EINVAL;
+                return -EINVAL;
         } else if (result < sizeof(*get_ie) + le16_to_cpu(get_ie->wIELength)) {
                 dev_err(dev, "not enough data returned for decoding GET IE "
                         "payload (%zu bytes received vs %zu needed)\n", result,
                         sizeof(*get_ie) + le16_to_cpu(get_ie->wIELength));
-                result = -EINVAL;
-        } else
-                *pget_ie = get_ie;
-error_cmd:
-        kfree(cmd);
-error_kzalloc:
-        d_fnend(3, dev, "(%p, %p) = %d\n", uwb_rc, pget_ie, (int)result);
-        return result;
-}
-EXPORT_SYMBOL_GPL(uwb_rc_get_ie);
-
-
-/*
- * Given a pointer to an IE, print it in ASCII/hex followed by a new line
- *
- * @ie_hdr: pointer to the IE header. Length is in there, and it is
- *          guaranteed that the ie_hdr->length bytes following it are
- *          safely accesible.
- *
- * @_data: context data passed from uwb_ie_for_each(), an struct output_ctx
- */
-int uwb_ie_dump_hex(struct uwb_dev *uwb_dev, const struct uwb_ie_hdr *ie_hdr,
-                    size_t offset, void *_ctx)
-{
-        struct uwb_buf_ctx *ctx = _ctx;
-        const u8 *pl = (void *)(ie_hdr + 1);
-        u8 pl_itr;
-
-        ctx->bytes += scnprintf(ctx->buf + ctx->bytes, ctx->size - ctx->bytes,
-                                "%02x %02x ", (unsigned) ie_hdr->element_id,
-                                (unsigned) ie_hdr->length);
-        pl_itr = 0;
-        while (pl_itr < ie_hdr->length && ctx->bytes < ctx->size)
-                ctx->bytes += scnprintf(ctx->buf + ctx->bytes,
-                                        ctx->size - ctx->bytes,
-                                        "%02x ", (unsigned) pl[pl_itr++]);
-        if (ctx->bytes < ctx->size)
-                ctx->buf[ctx->bytes++] = '\n';
-        return 0;
-}
-EXPORT_SYMBOL_GPL(uwb_ie_dump_hex);
-
-
-/**
- * Verify that a pointer in a buffer points to valid IE
- *
- * @start: pointer to start of buffer in which IE appears
- * @itr:   pointer to IE inside buffer that will be verified
- * @top:   pointer to end of buffer
- *
- * @returns: 0 if IE is valid, <0 otherwise
- *
- * Verification involves checking that the buffer can contain a
- * header and the amount of data reported in the IE header can be found in
- * the buffer.
- */
-static
-int uwb_rc_ie_verify(struct uwb_dev *uwb_dev, const void *start,
-                     const void *itr, const void *top)
-{
-        struct device *dev = &uwb_dev->dev;
-        const struct uwb_ie_hdr *ie_hdr;
-
-        if (top - itr < sizeof(*ie_hdr)) {
-                dev_err(dev, "Bad IE: no data to decode header "
-                        "(%zu bytes left vs %zu needed) at offset %zu\n",
-                        top - itr, sizeof(*ie_hdr), itr - start);
-                return -EINVAL;
-        }
-        ie_hdr = itr;
-        itr += sizeof(*ie_hdr);
-        if (top - itr < ie_hdr->length) {
-                dev_err(dev, "Bad IE: not enough data for payload "
-                        "(%zu bytes left vs %zu needed) at offset %zu\n",
-                        top - itr, (size_t)ie_hdr->length,
-                        (void *)ie_hdr - start);
                 return -EINVAL;
         }
-        return 0;
-}
 
-
-/**
- * Walk a buffer filled with consecutive IE's a buffer
- *
- * @uwb_dev: UWB device this IEs belong to (for err messages mainly)
- *
- * @fn: function to call with each IE; if it returns 0, we keep
- *      traversing the buffer. If it returns !0, we'll stop and return
- *      that value.
- *
- * @data: pointer passed to @fn
- *
- * @buf: buffer where the consecutive IEs are located
- *
- * @size: size of @buf
- *
- * Each IE is checked for basic correctness (there is space left for
- * the header and the payload). If that test is failed, we stop
- * processing. For every good IE, @fn is called.
- */
-ssize_t uwb_ie_for_each(struct uwb_dev *uwb_dev, uwb_ie_f fn, void *data,
-                        const void *buf, size_t size)
-{
-        ssize_t result = 0;
-        const struct uwb_ie_hdr *ie_hdr;
-        const void *itr = buf, *top = itr + size;
-
-        while (itr < top) {
-                if (uwb_rc_ie_verify(uwb_dev, buf, itr, top) != 0)
-                        break;
-                ie_hdr = itr;
-                itr += sizeof(*ie_hdr) + ie_hdr->length;
-                result = fn(uwb_dev, ie_hdr, itr - buf, data);
-                if (result != 0)
-                        break;
-        }
+        *pget_ie = get_ie;
         return result;
 }
-EXPORT_SYMBOL_GPL(uwb_ie_for_each);
 
 
 /**
@@ -256,70 +178,6 @@ error_cmd:
         return result;
 }
 
-/**
- * Determine by IE id if IE is host settable
- * WUSB 1.0 [8.6.2.8 Table 8.85]
- *
- * EXCEPTION:
- * All but UWB_IE_WLP appears in Table 8.85 from WUSB 1.0. Setting this IE
- * is required for the WLP substack to perform association with its WSS so
- * we hope that the WUSB spec will be changed to reflect this.
- */
-static
-int uwb_rc_ie_is_host_settable(enum uwb_ie element_id)
-{
-        if (element_id == UWB_PCA_AVAILABILITY ||
-            element_id == UWB_BP_SWITCH_IE ||
-            element_id == UWB_MAC_CAPABILITIES_IE ||
-            element_id == UWB_PHY_CAPABILITIES_IE ||
-            element_id == UWB_APP_SPEC_PROBE_IE ||
-            element_id == UWB_IDENTIFICATION_IE ||
-            element_id == UWB_MASTER_KEY_ID_IE ||
-            element_id == UWB_IE_WLP ||
-            element_id == UWB_APP_SPEC_IE)
-                return 1;
-        return 0;
-}
-
-
-/**
- * Extract Host Settable IEs from IE
- *
- * @ie_data: pointer to buffer containing all IEs
- * @size:    size of buffer
- *
- * @returns: length of buffer that only includes host settable IEs
- *
- * Given a buffer of IEs we move all Host Settable IEs to front of buffer
- * by overwriting the IEs that are not Host Settable.
- * Buffer length is adjusted accordingly.
- */
-static
-ssize_t uwb_rc_parse_host_settable_ie(struct uwb_dev *uwb_dev,
-                                      void *ie_data, size_t size)
-{
-        size_t new_len = size;
-        struct uwb_ie_hdr *ie_hdr;
-        size_t ie_length;
-        void *itr = ie_data, *top = itr + size;
-
-        while (itr < top) {
-                if (uwb_rc_ie_verify(uwb_dev, ie_data, itr, top) != 0)
-                        break;
-                ie_hdr = itr;
-                ie_length = sizeof(*ie_hdr) + ie_hdr->length;
-                if (uwb_rc_ie_is_host_settable(ie_hdr->element_id)) {
-                        itr += ie_length;
-                } else {
-                        memmove(itr, itr + ie_length, top - (itr + ie_length));
-                        new_len -= ie_length;
-                        top -= ie_length;
-                }
-        }
-        return new_len;
-}
-
-
 /* Cleanup the whole IE management subsystem */
 void uwb_rc_ie_init(struct uwb_rc *uwb_rc)
 {
@@ -328,49 +186,34 @@ void uwb_rc_ie_init(struct uwb_rc *uwb_rc)
 
 
 /**
- * Set up cache for host settable IEs currently being transmitted
+ * uwb_rc_ie_setup - setup a radio controller's IE manager
+ * @uwb_rc: the radio controller.
  *
- * First we just call GET-IE to get the current IEs being transmitted
- * (or we workaround and pretend we did) and (because the format is
- * the same) reuse that as the IE cache (with the command prefix, as
- * explained in 'struct uwb_rc').
+ * The current set of IEs are obtained from the hardware with a GET-IE
+ * command (since the radio controller is not yet beaconing this will
+ * be just the hardware's MAC and PHY Capability IEs).
  *
- * @returns: size of cache created
+ * Returns 0 on success; -ve on an error.
  */
-ssize_t uwb_rc_ie_setup(struct uwb_rc *uwb_rc)
+int uwb_rc_ie_setup(struct uwb_rc *uwb_rc)
 {
-        struct device *dev = &uwb_rc->uwb_dev.dev;
-        ssize_t result;
-        size_t capacity;
-        struct uwb_rc_evt_get_ie *ie_info;
+        struct uwb_rc_evt_get_ie *ie_info = NULL;
+        int capacity;
+
+        capacity = uwb_rc_get_ie(uwb_rc, &ie_info);
+        if (capacity < 0)
+                return capacity;
 
-        d_fnstart(3, dev, "(%p)\n", uwb_rc);
         mutex_lock(&uwb_rc->ies_mutex);
-        result = uwb_rc_get_ie(uwb_rc, &ie_info);
-        if (result < 0)
-                goto error_get_ie;
-        capacity = result;
-        d_printf(5, dev, "Got IEs %zu bytes (%zu long at %p)\n", result,
-                 (size_t)le16_to_cpu(ie_info->wIELength), ie_info);
-
-        /* Remove IEs that host should not set. */
-        result = uwb_rc_parse_host_settable_ie(&uwb_rc->uwb_dev,
-                        ie_info->IEData, le16_to_cpu(ie_info->wIELength));
-        if (result < 0)
-                goto error_parse;
-        d_printf(5, dev, "purged non-settable IEs to %zu bytes\n", result);
-        uwb_rc->ies = (void *) ie_info;
+
+        uwb_rc->ies = (struct uwb_rc_cmd_set_ie *)ie_info;
         uwb_rc->ies->rccb.bCommandType = UWB_RC_CET_GENERAL;
         uwb_rc->ies->rccb.wCommand = cpu_to_le16(UWB_RC_CMD_SET_IE);
         uwb_rc->ies_capacity = capacity;
-        d_printf(5, dev, "IE cache at %p %zu bytes, %zu capacity\n",
-                 ie_info, result, capacity);
-        result = 0;
-error_parse:
-error_get_ie:
+
         mutex_unlock(&uwb_rc->ies_mutex);
-        d_fnend(3, dev, "(%p) = %zu\n", uwb_rc, result);
-        return result;
+
+        return 0;
 }
 
 
@@ -383,26 +226,47 @@ void uwb_rc_ie_release(struct uwb_rc *uwb_rc)
 }
 
 
-static
-int __acc_size(struct uwb_dev *uwb_dev, const struct uwb_ie_hdr *ie_hdr,
-               size_t offset, void *_ctx)
+static int uwb_rc_ie_add_one(struct uwb_rc *rc, const struct uwb_ie_hdr *new_ie)
 {
-        size_t *acc_size = _ctx;
-        *acc_size += sizeof(*ie_hdr) + ie_hdr->length;
-        d_printf(6, &uwb_dev->dev, "new acc size %zu\n", *acc_size);
+        struct uwb_rc_cmd_set_ie *new_ies;
+        void *ptr, *prev_ie;
+        struct uwb_ie_hdr *ie;
+        size_t length, new_ie_len, new_capacity, size, prev_size;
+
+        length = le16_to_cpu(rc->ies->wIELength);
+        new_ie_len = sizeof(struct uwb_ie_hdr) + new_ie->length;
+        new_capacity = sizeof(struct uwb_rc_cmd_set_ie) + length + new_ie_len;
+
+        if (new_capacity > rc->ies_capacity) {
+                new_ies = krealloc(rc->ies, new_capacity, GFP_KERNEL);
+                if (!new_ies)
+                        return -ENOMEM;
+                rc->ies = new_ies;
+        }
+
+        ptr = rc->ies->IEData;
+        size = length;
+        for (;;) {
+                prev_ie = ptr;
+                prev_size = size;
+                ie = uwb_ie_next(&ptr, &size);
+                if (!ie || ie->element_id > new_ie->element_id)
+                        break;
+        }
+
+        memmove(prev_ie + new_ie_len, prev_ie, prev_size);
+        memcpy(prev_ie, new_ie, new_ie_len);
+        rc->ies->wIELength = cpu_to_le16(length + new_ie_len);
+
         return 0;
 }
 
-
 /**
- * Add a new IE to IEs currently being transmitted by device
- *
+ * uwb_rc_ie_add - add new IEs to the radio controller's beacon
+ * @uwb_rc: the radio controller.
  * @ies: the buffer containing the new IE or IEs to be added to
- *       the device's beacon. The buffer will be verified for
- *       consistence (meaning the headers should be right) and
- *       consistent with the buffer size.
- * @size: size of @ies (in bytes, total buffer size)
- * @returns: 0 if ok, <0 errno code on error
+ *       the device's beacon.
+ * @size: length of all the IEs.
  *
  * According to WHCI 0.95 [4.13.6] the driver will only receive the RCEB
  * after the device sent the first beacon that includes the IEs specified
@@ -411,66 +275,40 @@ int __acc_size(struct uwb_dev *uwb_dev, const struct uwb_ie_hdr *ie_hdr,
  * we start beaconing.
  *
  * Setting an IE on the device will overwrite all current IEs in device. So
- * we take the current IEs being transmitted by the device, append the
+ * we take the current IEs being transmitted by the device, insert the
  * new one, and call SET IE with all the IEs needed.
  *
- * The local IE cache will only be updated with the new IE if SET IE
- * completed successfully.
+ * Returns 0 on success; or -ENOMEM.
  */
 int uwb_rc_ie_add(struct uwb_rc *uwb_rc,
                   const struct uwb_ie_hdr *ies, size_t size)
 {
         int result = 0;
-        struct device *dev = &uwb_rc->uwb_dev.dev;
-        struct uwb_rc_cmd_set_ie *new_ies;
-        size_t ies_size, total_size, acc_size = 0;
-
-        if (uwb_rc->ies == NULL)
-                return -ESHUTDOWN;
-        uwb_ie_for_each(&uwb_rc->uwb_dev, __acc_size, &acc_size, ies, size);
-        if (acc_size != size) {
-                dev_err(dev, "BUG: bad IEs, misconstructed headers "
-                        "[%zu bytes reported vs %zu calculated]\n",
-                        size, acc_size);
-                WARN_ON(1);
-                return -EINVAL;
-        }
+        void *ptr;
+        const struct uwb_ie_hdr *ie;
+
         mutex_lock(&uwb_rc->ies_mutex);
-        ies_size = le16_to_cpu(uwb_rc->ies->wIELength);
-        total_size = sizeof(*uwb_rc->ies) + ies_size;
-        if (total_size + size > uwb_rc->ies_capacity) {
-                d_printf(4, dev, "Reallocating IE cache from %p capacity %zu "
-                         "to capacity %zu\n", uwb_rc->ies, uwb_rc->ies_capacity,
-                         total_size + size);
-                new_ies = kzalloc(total_size + size, GFP_KERNEL);
-                if (new_ies == NULL) {
-                        dev_err(dev, "No memory for adding new IE\n");
-                        result = -ENOMEM;
-                        goto error_alloc;
-                }
-                memcpy(new_ies, uwb_rc->ies, total_size);
-                uwb_rc->ies_capacity = total_size + size;
-                kfree(uwb_rc->ies);
-                uwb_rc->ies = new_ies;
-                d_printf(4, dev, "New IE cache at %p capacity %zu\n",
-                         uwb_rc->ies, uwb_rc->ies_capacity);
+
+        ptr = (void *)ies;
+        for (;;) {
+                ie = uwb_ie_next(&ptr, &size);
+                if (!ie)
+                        break;
+
+                result = uwb_rc_ie_add_one(uwb_rc, ie);
+                if (result < 0)
+                        break;
         }
-        memcpy((void *)uwb_rc->ies + total_size, ies, size);
-        uwb_rc->ies->wIELength = cpu_to_le16(ies_size + size);
-        if (uwb_rc->beaconing != -1) {
-                result = uwb_rc_set_ie(uwb_rc, uwb_rc->ies);
-                if (result < 0) {
-                        dev_err(dev, "Cannot set new IE on device: %d\n",
-                                result);
-                        uwb_rc->ies->wIELength = cpu_to_le16(ies_size);
+        if (result >= 0) {
+                if (size == 0) {
+                        if (uwb_rc->beaconing != -1)
+                                result = uwb_rc_set_ie(uwb_rc, uwb_rc->ies);
                 } else
-                        result = 0;
+                        result = -EINVAL;
         }
-        d_printf(4, dev, "IEs now occupy %hu bytes of %zu capacity at %p\n",
-                 le16_to_cpu(uwb_rc->ies->wIELength), uwb_rc->ies_capacity,
-                 uwb_rc->ies);
-error_alloc:
+
         mutex_unlock(&uwb_rc->ies_mutex);
+
         return result;
 }
 EXPORT_SYMBOL_GPL(uwb_rc_ie_add);
@@ -489,53 +327,52 @@ EXPORT_SYMBOL_GPL(uwb_rc_ie_add);
  * beacon. We don't reallocate, we just mark the size smaller.
  */
 static
-int uwb_rc_ie_cache_rm(struct uwb_rc *uwb_rc, enum uwb_ie to_remove)
+void uwb_rc_ie_cache_rm(struct uwb_rc *uwb_rc, enum uwb_ie to_remove)
 {
-        struct uwb_ie_hdr *ie_hdr;
-        size_t new_len = le16_to_cpu(uwb_rc->ies->wIELength);
-        void *itr = uwb_rc->ies->IEData;
-        void *top = itr + new_len;
-
-        while (itr < top) {
-                ie_hdr = itr;
-                if (ie_hdr->element_id != to_remove) {
-                        itr += sizeof(*ie_hdr) + ie_hdr->length;
-                } else {
-                        int ie_length;
-                        ie_length = sizeof(*ie_hdr) + ie_hdr->length;
-                        if (top - itr != ie_length)
-                                memmove(itr, itr + ie_length, top - itr + ie_length);
-                        top -= ie_length;
-                        new_len -= ie_length;
+        struct uwb_ie_hdr *ie;
+        size_t len = le16_to_cpu(uwb_rc->ies->wIELength);
+        void *ptr;
+        size_t size;
+
+        ptr = uwb_rc->ies->IEData;
+        size = len;
+        for (;;) {
+                ie = uwb_ie_next(&ptr, &size);
+                if (!ie)
+                        break;
+                if (ie->element_id == to_remove) {
+                        len -= sizeof(struct uwb_ie_hdr) + ie->length;
+                        memmove(ie, ptr, size);
+                        ptr = ie;
                 }
         }
-        uwb_rc->ies->wIELength = cpu_to_le16(new_len);
-        return 0;
+        uwb_rc->ies->wIELength = cpu_to_le16(len);
 }
 
 
 /**
- * Remove an IE currently being transmitted by device
+ * uwb_rc_ie_rm - remove an IE from the radio controller's beacon
+ * @uwb_rc: the radio controller.
+ * @element_id: the element ID of the IE to remove.
  *
- * @element_id: id of IE to be removed from device's beacon
+ * Only IEs previously added with uwb_rc_ie_add() may be removed.
+ *
+ * Returns 0 on success; or -ve the SET-IE command to the radio
+ * controller failed.
  */
 int uwb_rc_ie_rm(struct uwb_rc *uwb_rc, enum uwb_ie element_id)
 {
-        struct device *dev = &uwb_rc->uwb_dev.dev;
-        int result;
+        int result = 0;
 
-        if (uwb_rc->ies == NULL)
-                return -ESHUTDOWN;
         mutex_lock(&uwb_rc->ies_mutex);
-        result = uwb_rc_ie_cache_rm(uwb_rc, element_id);
-        if (result < 0)
-                dev_err(dev, "Cannot remove IE from cache.\n");
-        if (uwb_rc->beaconing != -1) {
+
+        uwb_rc_ie_cache_rm(uwb_rc, element_id);
+
+        if (uwb_rc->beaconing != -1)
                 result = uwb_rc_set_ie(uwb_rc, uwb_rc->ies);
-                if (result < 0)
-                        dev_err(dev, "Cannot set new IE on device.\n");
-        }
+
         mutex_unlock(&uwb_rc->ies_mutex);
+
         return result;
 }
 EXPORT_SYMBOL_GPL(uwb_rc_ie_rm);
diff --git a/drivers/uwb/lc-rc.c b/drivers/uwb/lc-rc.c
index ee5772f00d42..9cf21e6bb624 100644
--- a/drivers/uwb/lc-rc.c
+++ b/drivers/uwb/lc-rc.c
@@ -36,8 +36,6 @@
 #include <linux/etherdevice.h>
 #include <linux/usb.h>
 
-#define D_LOCAL 1
-#include <linux/uwb/debug.h>
 #include "uwb-internal.h"
 
 static int uwb_rc_index_match(struct device *dev, void *data)
@@ -81,9 +79,7 @@ static void uwb_rc_sys_release(struct device *dev)
         struct uwb_dev *uwb_dev = container_of(dev, struct uwb_dev, dev);
         struct uwb_rc *rc = container_of(uwb_dev, struct uwb_rc, uwb_dev);
 
-        uwb_rc_neh_destroy(rc);
         uwb_rc_ie_release(rc);
-        d_printf(1, dev, "freed uwb_rc %p\n", rc);
         kfree(rc);
 }
 
@@ -100,6 +96,8 @@ void uwb_rc_init(struct uwb_rc *rc)
         rc->scan_type = UWB_SCAN_DISABLED;
         INIT_LIST_HEAD(&rc->notifs_chain.list);
         mutex_init(&rc->notifs_chain.mutex);
+        INIT_LIST_HEAD(&rc->uwb_beca.list);
+        mutex_init(&rc->uwb_beca.mutex);
         uwb_drp_avail_init(rc);
         uwb_rc_ie_init(rc);
         uwb_rsv_init(rc);
@@ -191,9 +189,9 @@ static int uwb_rc_setup(struct uwb_rc *rc)
         int result;
         struct device *dev = &rc->uwb_dev.dev;
 
-        result = uwb_rc_reset(rc);
+        result = uwb_radio_setup(rc);
         if (result < 0) {
-                dev_err(dev, "cannot reset UWB radio: %d\n", result);
+                dev_err(dev, "cannot setup UWB radio: %d\n", result);
                 goto error;
         }
         result = uwb_rc_mac_addr_setup(rc);
@@ -250,6 +248,12 @@ int uwb_rc_add(struct uwb_rc *rc, struct device *parent_dev, void *priv)
 
         rc->priv = priv;
 
+        init_waitqueue_head(&rc->uwbd.wq);
+        INIT_LIST_HEAD(&rc->uwbd.event_list);
+        spin_lock_init(&rc->uwbd.event_list_lock);
+
+        uwbd_start(rc);
+
         result = rc->start(rc);
         if (result < 0)
                 goto error_rc_start;
@@ -284,7 +288,7 @@ error_sys_add:
 error_dev_add:
 error_rc_setup:
         rc->stop(rc);
-        uwbd_flush(rc);
+        uwbd_stop(rc);
 error_rc_start:
         return result;
 }
@@ -306,25 +310,24 @@ void uwb_rc_rm(struct uwb_rc *rc)
         rc->ready = 0;
 
         uwb_dbg_del_rc(rc);
-        uwb_rsv_cleanup(rc);
-        uwb_rc_ie_rm(rc, UWB_IDENTIFICATION_IE);
-        if (rc->beaconing >= 0)
-                uwb_rc_beacon(rc, -1, 0);
-        if (rc->scan_type != UWB_SCAN_DISABLED)
-                uwb_rc_scan(rc, rc->scanning, UWB_SCAN_DISABLED, 0);
-        uwb_rc_reset(rc);
+        uwb_rsv_remove_all(rc);
+        uwb_radio_shutdown(rc);
 
         rc->stop(rc);
-        uwbd_flush(rc);
+
+        uwbd_stop(rc);
+        uwb_rc_neh_destroy(rc);
 
         uwb_dev_lock(&rc->uwb_dev);
         rc->priv = NULL;
         rc->cmd = NULL;
         uwb_dev_unlock(&rc->uwb_dev);
-        mutex_lock(&uwb_beca.mutex);
+        mutex_lock(&rc->uwb_beca.mutex);
         uwb_dev_for_each(rc, uwb_dev_offair_helper, NULL);
         __uwb_rc_sys_rm(rc);
-        mutex_unlock(&uwb_beca.mutex);
+        mutex_unlock(&rc->uwb_beca.mutex);
+        uwb_rsv_cleanup(rc);
+        uwb_beca_release(rc);
         uwb_dev_rm(&rc->uwb_dev);
 }
 EXPORT_SYMBOL_GPL(uwb_rc_rm);
@@ -468,28 +471,3 @@ void uwb_rc_put(struct uwb_rc *rc)
         __uwb_rc_put(rc);
 }
 EXPORT_SYMBOL_GPL(uwb_rc_put);
-
-/*
- *
- *
- */
-ssize_t uwb_rc_print_IEs(struct uwb_rc *uwb_rc, char *buf, size_t size)
-{
-        ssize_t result;
-        struct uwb_rc_evt_get_ie *ie_info;
-        struct uwb_buf_ctx ctx;
-
-        result = uwb_rc_get_ie(uwb_rc, &ie_info);
-        if (result < 0)
-                goto error_get_ie;
-        ctx.buf = buf;
-        ctx.size = size;
-        ctx.bytes = 0;
-        uwb_ie_for_each(&uwb_rc->uwb_dev, uwb_ie_dump_hex, &ctx,
-                        ie_info->IEData, result - sizeof(*ie_info));
-        result = ctx.bytes;
-        kfree(ie_info);
-error_get_ie:
-        return result;
-}
-
diff --git a/drivers/uwb/neh.c b/drivers/uwb/neh.c
index 9b4eb64327ac..48b4ece1a627 100644
--- a/drivers/uwb/neh.c
+++ b/drivers/uwb/neh.c
@@ -254,7 +254,6 @@ error_kzalloc:
 
 static void __uwb_rc_neh_rm(struct uwb_rc *rc, struct uwb_rc_neh *neh)
 {
-        del_timer(&neh->timer);
         __uwb_rc_ctx_put(rc, neh);
         list_del(&neh->list_node);
 }
@@ -275,6 +274,7 @@ void uwb_rc_neh_rm(struct uwb_rc *rc, struct uwb_rc_neh *neh)
         __uwb_rc_neh_rm(rc, neh);
         spin_unlock_irqrestore(&rc->neh_lock, flags);
 
+        del_timer_sync(&neh->timer);
         uwb_rc_neh_put(neh);
 }
 
@@ -438,9 +438,10 @@ static void uwb_rc_neh_grok_event(struct uwb_rc *rc, struct uwb_rceb *rceb, size
                                 rceb->bEventContext, size);
         } else {
                 neh = uwb_rc_neh_lookup(rc, rceb);
-                if (neh)
+                if (neh) {
+                        del_timer_sync(&neh->timer);
                         uwb_rc_neh_cb(neh, rceb, size);
-                else
+                } else
                         dev_warn(dev, "event 0x%02x/%04x/%02x (%zu bytes): nobody cared\n",
                                  rceb->bEventType, le16_to_cpu(rceb->wEvent),
                                  rceb->bEventContext, size);
@@ -562,16 +563,22 @@ EXPORT_SYMBOL_GPL(uwb_rc_neh_grok);
  */
 void uwb_rc_neh_error(struct uwb_rc *rc, int error)
 {
-        struct uwb_rc_neh *neh, *next;
+        struct uwb_rc_neh *neh;
         unsigned long flags;
 
-        BUG_ON(error >= 0);
-        spin_lock_irqsave(&rc->neh_lock, flags);
-        list_for_each_entry_safe(neh, next, &rc->neh_list, list_node) {
+        for (;;) {
+                spin_lock_irqsave(&rc->neh_lock, flags);
+                if (list_empty(&rc->neh_list)) {
+                        spin_unlock_irqrestore(&rc->neh_lock, flags);
+                        break;
+                }
+                neh = list_first_entry(&rc->neh_list, struct uwb_rc_neh, list_node);
                 __uwb_rc_neh_rm(rc, neh);
+                spin_unlock_irqrestore(&rc->neh_lock, flags);
+
+                del_timer_sync(&neh->timer);
                 uwb_rc_neh_cb(neh, NULL, error);
         }
-        spin_unlock_irqrestore(&rc->neh_lock, flags);
 }
 EXPORT_SYMBOL_GPL(uwb_rc_neh_error);
 
@@ -583,10 +590,14 @@ static void uwb_rc_neh_timer(unsigned long arg)
         unsigned long flags;
 
         spin_lock_irqsave(&rc->neh_lock, flags);
-        __uwb_rc_neh_rm(rc, neh);
+        if (neh->context)
+                __uwb_rc_neh_rm(rc, neh);
+        else
+                neh = NULL;
         spin_unlock_irqrestore(&rc->neh_lock, flags);
 
-        uwb_rc_neh_cb(neh, NULL, -ETIMEDOUT);
+        if (neh)
+                uwb_rc_neh_cb(neh, NULL, -ETIMEDOUT);
 }
 
 /** Initializes the @rc's neh subsystem
@@ -605,12 +616,19 @@ void uwb_rc_neh_create(struct uwb_rc *rc)
 void uwb_rc_neh_destroy(struct uwb_rc *rc)
 {
         unsigned long flags;
-        struct uwb_rc_neh *neh, *next;
+        struct uwb_rc_neh *neh;
 
-        spin_lock_irqsave(&rc->neh_lock, flags);
-        list_for_each_entry_safe(neh, next, &rc->neh_list, list_node) {
+        for (;;) {
+                spin_lock_irqsave(&rc->neh_lock, flags);
+                if (list_empty(&rc->neh_list)) {
+                        spin_unlock_irqrestore(&rc->neh_lock, flags);
+                        break;
+                }
+                neh = list_first_entry(&rc->neh_list, struct uwb_rc_neh, list_node);
                 __uwb_rc_neh_rm(rc, neh);
+                spin_unlock_irqrestore(&rc->neh_lock, flags);
+
+                del_timer_sync(&neh->timer);
                 uwb_rc_neh_put(neh);
         }
-        spin_unlock_irqrestore(&rc->neh_lock, flags);
 }
diff --git a/drivers/uwb/pal.c b/drivers/uwb/pal.c
index 1afb38eacb9a..99a19c199095 100644
--- a/drivers/uwb/pal.c
+++ b/drivers/uwb/pal.c
@@ -16,6 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 #include <linux/kernel.h>
+#include <linux/debugfs.h>
 #include <linux/uwb.h>
 
 #include "uwb-internal.h"
@@ -32,13 +33,13 @@ EXPORT_SYMBOL_GPL(uwb_pal_init);
 
 /**
  * uwb_pal_register - register a UWB PAL
- * @rc: the radio controller the PAL will be using
  * @pal: the PAL
  *
  * The PAL must be initialized with uwb_pal_init().
  */
-int uwb_pal_register(struct uwb_rc *rc, struct uwb_pal *pal)
+int uwb_pal_register(struct uwb_pal *pal)
 {
+        struct uwb_rc *rc = pal->rc;
         int ret;
 
         if (pal->device) {
@@ -54,9 +55,11 @@ int uwb_pal_register(struct uwb_rc *rc, struct uwb_pal *pal)
                 }
         }
 
-        spin_lock(&rc->pal_lock);
+        pal->debugfs_dir = uwb_dbg_create_pal_dir(pal);
+
+        mutex_lock(&rc->uwb_dev.mutex);
         list_add(&pal->node, &rc->pals);
-        spin_unlock(&rc->pal_lock);
+        mutex_unlock(&rc->uwb_dev.mutex);
 
         return 0;
 }
@@ -64,14 +67,19 @@ EXPORT_SYMBOL_GPL(uwb_pal_register);
 
 /**
  * uwb_pal_register - unregister a UWB PAL
- * @rc: the radio controller the PAL was using
  * @pal: the PAL
  */
-void uwb_pal_unregister(struct uwb_rc *rc, struct uwb_pal *pal)
+void uwb_pal_unregister(struct uwb_pal *pal)
 {
-        spin_lock(&rc->pal_lock);
+        struct uwb_rc *rc = pal->rc;
+
+        uwb_radio_stop(pal);
+
+        mutex_lock(&rc->uwb_dev.mutex);
         list_del(&pal->node);
-        spin_unlock(&rc->pal_lock);
+        mutex_unlock(&rc->uwb_dev.mutex);
+
+        debugfs_remove(pal->debugfs_dir);
 
         if (pal->device) {
                 sysfs_remove_link(&rc->uwb_dev.dev.kobj, pal->name);
@@ -86,6 +94,5 @@ EXPORT_SYMBOL_GPL(uwb_pal_unregister);
  */
 void uwb_rc_pal_init(struct uwb_rc *rc)
 {
-        spin_lock_init(&rc->pal_lock);
         INIT_LIST_HEAD(&rc->pals);
 }
diff --git a/drivers/uwb/radio.c b/drivers/uwb/radio.c
new file mode 100644
index 000000000000..f0d55495f5e9
--- /dev/null
+++ b/drivers/uwb/radio.c
@@ -0,0 +1,202 @@
+/*
+ * UWB radio (channel) management.
+ *
+ * Copyright (C) 2008 Cambridge Silicon Radio Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License version
+ * 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#include <linux/kernel.h>
+#include <linux/uwb.h>
+
+#include "uwb-internal.h"
+
+
+static int uwb_radio_select_channel(struct uwb_rc *rc)
+{
+        /*
+         * Default to channel 9 (BG1, TFC1) unless the user has
+         * selected a specific channel or there are no active PALs.
+         */
+        if (rc->active_pals == 0)
+                return -1;
+        if (rc->beaconing_forced)
+                return rc->beaconing_forced;
+        return 9;
+}
+
+
+/*
+ * Notify all active PALs that the channel has changed.
+ */
+static void uwb_radio_channel_changed(struct uwb_rc *rc, int channel)
+{
+        struct uwb_pal *pal;
+
+        list_for_each_entry(pal, &rc->pals, node) {
+                if (pal->channel && channel != pal->channel) {
+                        pal->channel = channel;
+                        if (pal->channel_changed)
+                                pal->channel_changed(pal, pal->channel);
+                }
+        }
+}
+
+/*
+ * Change to a new channel and notify any active PALs of the new
+ * channel.
+ *
+ * When stopping the radio, PALs need to be notified first so they can
+ * terminate any active reservations.
+ */
+static int uwb_radio_change_channel(struct uwb_rc *rc, int channel)
+{
+        int ret = 0;
+
+        if (channel == -1)
+                uwb_radio_channel_changed(rc, channel);
+
+        if (channel != rc->beaconing) {
+                if (rc->beaconing != -1 && channel != -1) {
+                        /*
+                         * FIXME: should signal the channel change
+                         * with a Channel Change IE.
+                         */
+                        ret = uwb_radio_change_channel(rc, -1);
+                        if (ret < 0)
+                                return ret;
+                }
+                ret = uwb_rc_beacon(rc, channel, 0);
+        }
+
+        if (channel != -1)
+                uwb_radio_channel_changed(rc, rc->beaconing);
+
+        return ret;
+}
+
+/**
+ * uwb_radio_start - request that the radio be started
+ * @pal: the PAL making the request.
+ *
+ * If the radio is not already active, aa suitable channel is selected
+ * and beacons are started.
+ */
+int uwb_radio_start(struct uwb_pal *pal)
+{
+        struct uwb_rc *rc = pal->rc;
+        int ret = 0;
+
+        mutex_lock(&rc->uwb_dev.mutex);
+
+        if (!pal->channel) {
+                pal->channel = -1;
+                rc->active_pals++;
+                ret = uwb_radio_change_channel(rc, uwb_radio_select_channel(rc));
+        }
+
+        mutex_unlock(&rc->uwb_dev.mutex);
+        return ret;
+}
+EXPORT_SYMBOL_GPL(uwb_radio_start);
+
+/**
+ * uwb_radio_stop - request tha the radio be stopped.
+ * @pal: the PAL making the request.
+ *
+ * Stops the radio if no other PAL is making use of it.
+ */
+void uwb_radio_stop(struct uwb_pal *pal)
+{
+        struct uwb_rc *rc = pal->rc;
+
+        mutex_lock(&rc->uwb_dev.mutex);
+
+        if (pal->channel) {
+                rc->active_pals--;
+                uwb_radio_change_channel(rc, uwb_radio_select_channel(rc));
+                pal->channel = 0;
+        }
+
+        mutex_unlock(&rc->uwb_dev.mutex);
+}
+EXPORT_SYMBOL_GPL(uwb_radio_stop);
+
+/*
+ * uwb_radio_force_channel - force a specific channel to be used
+ * @rc: the radio controller.
+ * @channel: the channel to use; -1 to force the radio to stop; 0 to
+ *   use the default channel selection algorithm.
+ */
+int uwb_radio_force_channel(struct uwb_rc *rc, int channel)
+{
+        int ret = 0;
+
+        mutex_lock(&rc->uwb_dev.mutex);
+
+        rc->beaconing_forced = channel;
+        ret = uwb_radio_change_channel(rc, uwb_radio_select_channel(rc));
+
+        mutex_unlock(&rc->uwb_dev.mutex);
+        return ret;
+}
+
+/*
+ * uwb_radio_setup - setup the radio manager
+ * @rc: the radio controller.
+ *
+ * The radio controller is reset to ensure it's in a known state
+ * before it's used.
+ */
+int uwb_radio_setup(struct uwb_rc *rc)
+{
+        return uwb_rc_reset(rc);
+}
+
+/*
+ * uwb_radio_reset_state - reset any radio manager state
+ * @rc: the radio controller.
+ *
+ * All internal radio manager state is reset to values corresponding
+ * to a reset radio controller.
+ */
+void uwb_radio_reset_state(struct uwb_rc *rc)
+{
+        struct uwb_pal *pal;
+
+        mutex_lock(&rc->uwb_dev.mutex);
+
+        list_for_each_entry(pal, &rc->pals, node) {
+                if (pal->channel) {
+                        pal->channel = -1;
+                        if (pal->channel_changed)
+                                pal->channel_changed(pal, -1);
+                }
+        }
+
+        rc->beaconing = -1;
+        rc->scanning = -1;
+
+        mutex_unlock(&rc->uwb_dev.mutex);
+}
+
+/*
+ * uwb_radio_shutdown - shutdown the radio manager
+ * @rc: the radio controller.
+ *
+ * The radio controller is reset.
+ */
+void uwb_radio_shutdown(struct uwb_rc *rc)
+{
+        uwb_radio_reset_state(rc);
+        uwb_rc_reset(rc);
+}
diff --git a/drivers/uwb/reset.c b/drivers/uwb/reset.c
index 8de856fa7958..ce8283cc8098 100644
--- a/drivers/uwb/reset.c
+++ b/drivers/uwb/reset.c
@@ -323,17 +323,16 @@ int uwbd_msg_handle_reset(struct uwb_event *evt)
         struct uwb_rc *rc = evt->rc;
         int ret;
 
-        /* Need to prevent the RC hardware module going away while in
-           the rc->reset() call. */
-        if (!try_module_get(rc->owner))
-                return 0;
-
         dev_info(&rc->uwb_dev.dev, "resetting radio controller\n");
         ret = rc->reset(rc);
-        if (ret)
+        if (ret) {
                 dev_err(&rc->uwb_dev.dev, "failed to reset hardware: %d\n", ret);
-
-        module_put(rc->owner);
+                goto error;
+        }
+        return 0;
+error:
+        /* Nothing can be done except try the reset again. */
+        uwb_rc_reset_all(rc);
         return ret;
 }
 
@@ -360,3 +359,33 @@ void uwb_rc_reset_all(struct uwb_rc *rc)
         uwbd_event_queue(evt);
 }
 EXPORT_SYMBOL_GPL(uwb_rc_reset_all);
+
+void uwb_rc_pre_reset(struct uwb_rc *rc)
+{
+        rc->stop(rc);
+        uwbd_flush(rc);
+
+        uwb_radio_reset_state(rc);
+        uwb_rsv_remove_all(rc);
+}
+EXPORT_SYMBOL_GPL(uwb_rc_pre_reset);
+
+void uwb_rc_post_reset(struct uwb_rc *rc)
+{
+        int ret;
+
+        ret = rc->start(rc);
+        if (ret)
+                goto error;
+        ret = uwb_rc_mac_addr_set(rc, &rc->uwb_dev.mac_addr);
+        if (ret)
+                goto error;
+        ret = uwb_rc_dev_addr_set(rc, &rc->uwb_dev.dev_addr);
+        if (ret)
+                goto error;
+        return;
+error:
+        /* Nothing can be done except try the reset again. */
+        uwb_rc_reset_all(rc);
+}
+EXPORT_SYMBOL_GPL(uwb_rc_post_reset);
diff --git a/drivers/uwb/rsv.c b/drivers/uwb/rsv.c
index bae16204576d..1cd84f927540 100644
--- a/drivers/uwb/rsv.c
+++ b/drivers/uwb/rsv.c
@@ -15,7 +15,6 @@
  * You should have received a copy of the GNU General Public License
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
-#include <linux/version.h>
 #include <linux/kernel.h>
 #include <linux/uwb.h>
 
@@ -82,6 +81,23 @@ static void uwb_rsv_dump(struct uwb_rsv *rsv)
         dev_dbg(dev, "rsv %s -> %s: %s\n", owner, target, uwb_rsv_state_str(rsv->state));
 }
 
+static void uwb_rsv_release(struct kref *kref)
+{
+        struct uwb_rsv *rsv = container_of(kref, struct uwb_rsv, kref);
+
+        kfree(rsv);
+}
+
+static void uwb_rsv_get(struct uwb_rsv *rsv)
+{
+        kref_get(&rsv->kref);
+}
+
+static void uwb_rsv_put(struct uwb_rsv *rsv)
+{
+        kref_put(&rsv->kref, uwb_rsv_release);
+}
+
 /*
  * Get a free stream index for a reservation.
  *
@@ -285,7 +301,8 @@ void uwb_rsv_set_state(struct uwb_rsv *rsv, enum uwb_rsv_state new_state)
         switch (new_state) {
         case UWB_RSV_STATE_NONE:
                 uwb_drp_avail_release(rsv->rc, &rsv->mas);
-                uwb_rsv_put_stream(rsv);
+                if (uwb_rsv_is_owner(rsv))
+                        uwb_rsv_put_stream(rsv);
                 uwb_rsv_state_update(rsv, UWB_RSV_STATE_NONE);
                 uwb_rsv_callback(rsv);
                 break;
@@ -324,6 +341,7 @@ static struct uwb_rsv *uwb_rsv_alloc(struct uwb_rc *rc)
 
         INIT_LIST_HEAD(&rsv->rc_node);
         INIT_LIST_HEAD(&rsv->pal_node);
+        kref_init(&rsv->kref);
         init_timer(&rsv->timer);
         rsv->timer.function = uwb_rsv_timer;
         rsv->timer.data     = (unsigned long)rsv;
@@ -333,14 +351,6 @@ static struct uwb_rsv *uwb_rsv_alloc(struct uwb_rc *rc)
         return rsv;
 }
 
-static void uwb_rsv_free(struct uwb_rsv *rsv)
-{
-        uwb_dev_put(rsv->owner);
-        if (rsv->target.type == UWB_RSV_TARGET_DEV)
-                uwb_dev_put(rsv->target.dev);
-        kfree(rsv);
-}
-
 /**
  * uwb_rsv_create - allocate and initialize a UWB reservation structure
  * @rc: the radio controller
@@ -374,23 +384,23 @@ void uwb_rsv_remove(struct uwb_rsv *rsv)
         if (rsv->state != UWB_RSV_STATE_NONE)
                 uwb_rsv_set_state(rsv, UWB_RSV_STATE_NONE);
         del_timer_sync(&rsv->timer);
-        list_del(&rsv->rc_node);
-        uwb_rsv_free(rsv);
+        uwb_dev_put(rsv->owner);
+        if (rsv->target.type == UWB_RSV_TARGET_DEV)
+                uwb_dev_put(rsv->target.dev);
+
+        list_del_init(&rsv->rc_node);
+        uwb_rsv_put(rsv);
 }
 
 /**
  * uwb_rsv_destroy - free a UWB reservation structure
  * @rsv: the reservation to free
  *
- * The reservation will be terminated if it is pending or established.
+ * The reservation must already be terminated.
  */
 void uwb_rsv_destroy(struct uwb_rsv *rsv)
 {
-        struct uwb_rc *rc = rsv->rc;
-
-        mutex_lock(&rc->rsvs_mutex);
-        uwb_rsv_remove(rsv);
-        mutex_unlock(&rc->rsvs_mutex);
+        uwb_rsv_put(rsv);
 }
 EXPORT_SYMBOL_GPL(uwb_rsv_destroy);
 
@@ -422,6 +432,7 @@ int uwb_rsv_establish(struct uwb_rsv *rsv)
                 goto out;
         }
 
+        uwb_rsv_get(rsv);
         list_add_tail(&rsv->rc_node, &rc->reservations);
         rsv->owner = &rc->uwb_dev;
         uwb_dev_get(rsv->owner);
@@ -477,9 +488,14 @@ EXPORT_SYMBOL_GPL(uwb_rsv_terminate);
  *
  * Reservation requests from peers are denied unless a PAL accepts it
  * by calling this function.
+ *
+ * The PAL call uwb_rsv_destroy() for all accepted reservations before
+ * calling uwb_pal_unregister().
  */
 void uwb_rsv_accept(struct uwb_rsv *rsv, uwb_rsv_cb_f cb, void *pal_priv)
 {
+        uwb_rsv_get(rsv);
+
         rsv->callback = cb;
         rsv->pal_priv = pal_priv;
         rsv->state    = UWB_RSV_STATE_T_ACCEPTED;
@@ -532,7 +548,6 @@ static struct uwb_rsv *uwb_rsv_new_target(struct uwb_rc *rc,
         rsv->target.dev  = &rc->uwb_dev;
         rsv->type        = uwb_ie_drp_type(drp_ie);
         rsv->stream      = uwb_ie_drp_stream_index(drp_ie);
-        set_bit(rsv->stream, rsv->owner->streams);
         uwb_drp_ie_to_bm(&rsv->mas, drp_ie);
 
         /*
@@ -540,14 +555,14 @@ static struct uwb_rsv *uwb_rsv_new_target(struct uwb_rc *rc,
          * deny the request.
          */
         rsv->state = UWB_RSV_STATE_T_DENIED;
-        spin_lock(&rc->pal_lock);
+        mutex_lock(&rc->uwb_dev.mutex);
         list_for_each_entry(pal, &rc->pals, node) {
                 if (pal->new_rsv)
-                        pal->new_rsv(rsv);
+                        pal->new_rsv(pal, rsv);
                 if (rsv->state == UWB_RSV_STATE_T_ACCEPTED)
                         break;
         }
-        spin_unlock(&rc->pal_lock);
+        mutex_unlock(&rc->uwb_dev.mutex);
 
         list_add_tail(&rsv->rc_node, &rc->reservations);
         state = rsv->state;
@@ -644,6 +659,25 @@ static void uwb_rsv_timer(unsigned long arg)
         uwb_rsv_sched_update(rsv->rc);
 }
 
+/**
+ * uwb_rsv_remove_all - remove all reservations
+ * @rc: the radio controller
+ *
+ * A DRP IE update is not done.
+ */
+void uwb_rsv_remove_all(struct uwb_rc *rc)
+{
+        struct uwb_rsv *rsv, *t;
+
+        mutex_lock(&rc->rsvs_mutex);
+        list_for_each_entry_safe(rsv, t, &rc->reservations, rc_node) {
+                uwb_rsv_remove(rsv);
+        }
+        mutex_unlock(&rc->rsvs_mutex);
+
+        cancel_work_sync(&rc->rsv_update_work);
+}
+
 void uwb_rsv_init(struct uwb_rc *rc)
 {
         INIT_LIST_HEAD(&rc->reservations);
@@ -667,14 +701,6 @@ int uwb_rsv_setup(struct uwb_rc *rc)
 
 void uwb_rsv_cleanup(struct uwb_rc *rc)
 {
-        struct uwb_rsv *rsv, *t;
-
-        mutex_lock(&rc->rsvs_mutex);
-        list_for_each_entry_safe(rsv, t, &rc->reservations, rc_node) {
-                uwb_rsv_remove(rsv);
-        }
-        mutex_unlock(&rc->rsvs_mutex);
-
-        cancel_work_sync(&rc->rsv_update_work);
+        uwb_rsv_remove_all(rc);
         destroy_workqueue(rc->rsv_workq);
 }
diff --git a/drivers/uwb/umc-bus.c b/drivers/uwb/umc-bus.c
index 2d8d62d9f53e..5ad36164c13b 100644
--- a/drivers/uwb/umc-bus.c
+++ b/drivers/uwb/umc-bus.c
@@ -11,23 +11,48 @@
 #include <linux/uwb/umc.h>
 #include <linux/pci.h>
 
-static int umc_bus_unbind_helper(struct device *dev, void *data)
+static int umc_bus_pre_reset_helper(struct device *dev, void *data)
 {
-        struct device *parent = data;
+        int ret = 0;
 
-        if (dev->parent == parent && dev->driver)
-                device_release_driver(dev);
-        return 0;
+        if (dev->driver) {
+                struct umc_dev *umc = to_umc_dev(dev);
+                struct umc_driver *umc_drv = to_umc_driver(dev->driver);
+
+                if (umc_drv->pre_reset)
+                        ret = umc_drv->pre_reset(umc);
+                else
+                        device_release_driver(dev);
+        }
+        return ret;
+}
+
+static int umc_bus_post_reset_helper(struct device *dev, void *data)
+{
+        int ret = 0;
+
+        if (dev->driver) {
+                struct umc_dev *umc = to_umc_dev(dev);
+                struct umc_driver *umc_drv = to_umc_driver(dev->driver);
+
+                if (umc_drv->post_reset)
+                        ret = umc_drv->post_reset(umc);
+        } else
+                ret = device_attach(dev);
+
+        return ret;
 }
 
 /**
  * umc_controller_reset - reset the whole UMC controller
  * @umc: the UMC device for the radio controller.
  *
- * Drivers will be unbound from all UMC devices belonging to the
- * controller and then the radio controller will be rebound.  The
- * radio controller is expected to do a full hardware reset when it is
- * probed.
+ * Drivers or all capabilities of the controller will have their
+ * pre_reset methods called or be unbound from their device.  Then all
+ * post_reset methods will be called or the drivers will be rebound.
+ *
+ * Radio controllers must provide pre_reset and post_reset methods and
+ * reset the hardware in their start method.
  *
  * If this is called while a probe() or remove() is in progress it
  * will return -EAGAIN and not perform the reset.
@@ -35,14 +60,13 @@ static int umc_bus_unbind_helper(struct device *dev, void *data)
 int umc_controller_reset(struct umc_dev *umc)
 {
         struct device *parent = umc->dev.parent;
-        int ret;
+        int ret = 0;
 
-        if (down_trylock(&parent->sem))
+        if(down_trylock(&parent->sem))
                 return -EAGAIN;
-        bus_for_each_dev(&umc_bus_type, NULL, parent, umc_bus_unbind_helper);
-        ret = device_attach(&umc->dev);
-        if (ret == 1)
-                ret = 0;
+        ret = device_for_each_child(parent, parent, umc_bus_pre_reset_helper);
+        if (ret >= 0)
+                device_for_each_child(parent, parent, umc_bus_post_reset_helper);
         up(&parent->sem);
 
         return ret;
@@ -75,10 +99,10 @@ static int umc_bus_rescan_helper(struct device *dev, void *data)
         if (!dev->driver)
                 ret = device_attach(dev);
 
-        return ret < 0 ? ret : 0;
+        return ret;
 }
 
-static void umc_bus_rescan(void)
+static void umc_bus_rescan(struct device *parent)
 {
         int err;
 
@@ -86,7 +110,7 @@ static void umc_bus_rescan(void)
          * We can't use bus_rescan_devices() here as it deadlocks when
          * it tries to retake the dev->parent semaphore.
          */
-        err = bus_for_each_dev(&umc_bus_type, NULL, NULL, umc_bus_rescan_helper);
+        err = device_for_each_child(parent, NULL, umc_bus_rescan_helper);
         if (err < 0)
                 printk(KERN_WARNING "%s: rescan of bus failed: %d\n",
                        KBUILD_MODNAME, err);
@@ -120,7 +144,7 @@ static int umc_device_probe(struct device *dev)
         if (err)
                 put_device(dev);
         else
-                umc_bus_rescan();
+                umc_bus_rescan(dev->parent);
 
         return err;
 }
diff --git a/drivers/uwb/umc-dev.c b/drivers/uwb/umc-dev.c
index aa44e1c1a102..53207e14cd8f 100644
--- a/drivers/uwb/umc-dev.c
+++ b/drivers/uwb/umc-dev.c
@@ -31,8 +31,7 @@ struct umc_dev *umc_device_create(struct device *parent, int n)
 
         umc = kzalloc(sizeof(struct umc_dev), GFP_KERNEL);
         if (umc) {
-                snprintf(umc->dev.bus_id, sizeof(umc->dev.bus_id), "%s-%d",
-                         parent->bus_id, n);
+                dev_set_name(&umc->dev, "%s-%d", dev_name(parent), n);
                 umc->dev.parent  = parent;
                 umc->dev.bus     = &umc_bus_type;
                 umc->dev.release = umc_device_release;
diff --git a/drivers/uwb/uwb-debug.c b/drivers/uwb/uwb-debug.c
index 6d232c35d07d..a6debb9baf38 100644
--- a/drivers/uwb/uwb-debug.c
+++ b/drivers/uwb/uwb-debug.c
@@ -33,8 +33,6 @@
 #include <linux/seq_file.h>
 
 #include <linux/uwb/debug-cmd.h>
-#define D_LOCAL 0
-#include <linux/uwb/debug.h>
 
 #include "uwb-internal.h"
 
@@ -104,6 +102,11 @@ static void uwb_dbg_rsv_cb(struct uwb_rsv *rsv)
 
         dev_dbg(dev, "debug: rsv %s -> %s: %s\n",
                 owner, target, uwb_rsv_state_str(rsv->state));
+
+        if (rsv->state == UWB_RSV_STATE_NONE) {
+                list_del(&rsv->pal_node);
+                uwb_rsv_destroy(rsv);
+        }
 }
 
 static int cmd_rsv_establish(struct uwb_rc *rc,
@@ -119,7 +122,7 @@ static int cmd_rsv_establish(struct uwb_rc *rc,
         if (target == NULL)
                 return -ENODEV;
 
-        rsv = uwb_rsv_create(rc, uwb_dbg_rsv_cb, NULL);
+        rsv = uwb_rsv_create(rc, uwb_dbg_rsv_cb, rc->dbg);
         if (rsv == NULL) {
                 uwb_dev_put(target);
                 return -ENOMEM;
@@ -153,16 +156,28 @@ static int cmd_rsv_terminate(struct uwb_rc *rc,
                         found = rsv;
                         break;
                 }
+                i++;
         }
         if (!found)
                 return -EINVAL;
 
-        list_del(&found->pal_node);
         uwb_rsv_terminate(found);
 
         return 0;
 }
 
+static int cmd_ie_add(struct uwb_rc *rc, struct uwb_dbg_cmd_ie *ie_to_add)
+{
+        return uwb_rc_ie_add(rc,
+                             (const struct uwb_ie_hdr *) ie_to_add->data,
+                             ie_to_add->len);
+}
+
+static int cmd_ie_rm(struct uwb_rc *rc, struct uwb_dbg_cmd_ie *ie_to_rm)
+{
+        return uwb_rc_ie_rm(rc, ie_to_rm->data[0]);
+}
+
 static int command_open(struct inode *inode, struct file *file)
 {
         file->private_data = inode->i_private;
@@ -175,7 +190,7 @@ static ssize_t command_write(struct file *file, const char __user *buf,
 {
         struct uwb_rc *rc = file->private_data;
         struct uwb_dbg_cmd cmd;
-        int ret;
+        int ret = 0;
 
         if (len != sizeof(struct uwb_dbg_cmd))
                 return -EINVAL;
@@ -190,6 +205,18 @@ static ssize_t command_write(struct file *file, const char __user *buf,
         case UWB_DBG_CMD_RSV_TERMINATE:
                 ret = cmd_rsv_terminate(rc, &cmd.rsv_terminate);
                 break;
+        case UWB_DBG_CMD_IE_ADD:
+                ret = cmd_ie_add(rc, &cmd.ie_add);
+                break;
+        case UWB_DBG_CMD_IE_RM:
+                ret = cmd_ie_rm(rc, &cmd.ie_rm);
+                break;
+        case UWB_DBG_CMD_RADIO_START:
+                ret = uwb_radio_start(&rc->dbg->pal);
+                break;
+        case UWB_DBG_CMD_RADIO_STOP:
+                uwb_radio_stop(&rc->dbg->pal);
+                break;
         default:
                 return -EINVAL;
         }
@@ -283,12 +310,24 @@ static struct file_operations drp_avail_fops = {
         .owner   = THIS_MODULE,
 };
 
-static void uwb_dbg_new_rsv(struct uwb_rsv *rsv)
+static void uwb_dbg_channel_changed(struct uwb_pal *pal, int channel)
 {
-        struct uwb_rc *rc = rsv->rc;
+        struct device *dev = &pal->rc->uwb_dev.dev;
 
-        if (rc->dbg->accept)
-                uwb_rsv_accept(rsv, uwb_dbg_rsv_cb, NULL);
+        if (channel > 0)
+                dev_info(dev, "debug: channel %d started\n", channel);
+        else
+                dev_info(dev, "debug: channel stopped\n");
+}
+
+static void uwb_dbg_new_rsv(struct uwb_pal *pal, struct uwb_rsv *rsv)
+{
+        struct uwb_dbg *dbg = container_of(pal, struct uwb_dbg, pal);
+
+        if (dbg->accept) {
+                list_add_tail(&rsv->pal_node, &dbg->rsvs);
+                uwb_rsv_accept(rsv, uwb_dbg_rsv_cb, dbg);
+        }
 }
 
 /**
@@ -304,8 +343,11 @@ void uwb_dbg_add_rc(struct uwb_rc *rc)
         INIT_LIST_HEAD(&rc->dbg->rsvs);
 
         uwb_pal_init(&rc->dbg->pal);
+        rc->dbg->pal.rc = rc;
+        rc->dbg->pal.channel_changed = uwb_dbg_channel_changed;
         rc->dbg->pal.new_rsv = uwb_dbg_new_rsv;
-        uwb_pal_register(rc, &rc->dbg->pal);
+        uwb_pal_register(&rc->dbg->pal);
+
         if (root_dir) {
                 rc->dbg->root_d = debugfs_create_dir(dev_name(&rc->uwb_dev.dev),
                                                      root_dir);
@@ -325,7 +367,7 @@ void uwb_dbg_add_rc(struct uwb_rc *rc)
 }
 
 /**
- * uwb_dbg_add_rc - remove a radio controller's debug interface
+ * uwb_dbg_del_rc - remove a radio controller's debug interface
  * @rc: the radio controller
  */
 void uwb_dbg_del_rc(struct uwb_rc *rc)
@@ -336,10 +378,10 @@ void uwb_dbg_del_rc(struct uwb_rc *rc)
                 return;
 
         list_for_each_entry_safe(rsv, t, &rc->dbg->rsvs, pal_node) {
-                uwb_rsv_destroy(rsv);
+                uwb_rsv_terminate(rsv);
         }
 
-        uwb_pal_unregister(rc, &rc->dbg->pal);
+        uwb_pal_unregister(&rc->dbg->pal);
 
         if (root_dir) {
                 debugfs_remove(rc->dbg->drp_avail_f);
@@ -365,3 +407,16 @@ void uwb_dbg_exit(void)
 {
         debugfs_remove(root_dir);
 }
+
+/**
+ * uwb_dbg_create_pal_dir - create a debugfs directory for a PAL
+ * @pal: The PAL.
+ */
+struct dentry *uwb_dbg_create_pal_dir(struct uwb_pal *pal)
+{
+        struct uwb_rc *rc = pal->rc;
+
+        if (root_dir && rc->dbg && rc->dbg->root_d && pal->name)
+                return debugfs_create_dir(pal->name, rc->dbg->root_d);
+        return NULL;
+}
diff --git a/drivers/uwb/uwb-internal.h b/drivers/uwb/uwb-internal.h
index 2ad307d12961..f0f21f406bf0 100644
--- a/drivers/uwb/uwb-internal.h
+++ b/drivers/uwb/uwb-internal.h
@@ -66,14 +66,14 @@ extern int uwb_rc_scan(struct uwb_rc *rc,
                        unsigned channel, enum uwb_scan_type type,
                        unsigned bpst_offset);
 extern int uwb_rc_send_all_drp_ie(struct uwb_rc *rc);
-extern ssize_t uwb_rc_print_IEs(struct uwb_rc *rc, char *, size_t);
-extern void uwb_rc_ie_init(struct uwb_rc *);
-extern void uwb_rc_ie_init(struct uwb_rc *);
-extern ssize_t uwb_rc_ie_setup(struct uwb_rc *);
-extern void uwb_rc_ie_release(struct uwb_rc *);
-extern int uwb_rc_ie_add(struct uwb_rc *,
-                         const struct uwb_ie_hdr *, size_t);
-extern int uwb_rc_ie_rm(struct uwb_rc *, enum uwb_ie);
+
+void uwb_rc_ie_init(struct uwb_rc *);
+int uwb_rc_ie_setup(struct uwb_rc *);
+void uwb_rc_ie_release(struct uwb_rc *);
+int uwb_ie_dump_hex(const struct uwb_ie_hdr *ies, size_t len,
+                    char *buf, size_t size);
+int uwb_rc_set_ie(struct uwb_rc *, struct uwb_rc_cmd_set_ie *);
+
 
 extern const char *uwb_rc_strerror(unsigned code);
 
@@ -160,13 +160,14 @@ struct uwb_event {
         };
 };
 
-extern void uwbd_start(void);
-extern void uwbd_stop(void);
+extern void uwbd_start(struct uwb_rc *rc);
+extern void uwbd_stop(struct uwb_rc *rc);
 extern struct uwb_event *uwb_event_alloc(size_t, gfp_t gfp_mask);
 extern void uwbd_event_queue(struct uwb_event *);
 void uwbd_flush(struct uwb_rc *rc);
 
 /* UWB event handlers */
+extern int uwbd_evt_handle_rc_ie_rcv(struct uwb_event *);
 extern int uwbd_evt_handle_rc_beacon(struct uwb_event *);
 extern int uwbd_evt_handle_rc_beacon_size(struct uwb_event *);
 extern int uwbd_evt_handle_rc_bpoie_change(struct uwb_event *);
@@ -193,15 +194,6 @@ int uwbd_evt_handle_rc_dev_addr_conflict(struct uwb_event *evt);
 
 extern unsigned long beacon_timeout_ms;
 
-/** Beacon cache list */
-struct uwb_beca {
-        struct list_head list;
-        size_t entries;
-        struct mutex mutex;
-};
-
-extern struct uwb_beca uwb_beca;
-
 /**
  * Beacon cache entry
  *
@@ -228,9 +220,6 @@ struct uwb_beca_e {
 struct uwb_beacon_frame;
 extern ssize_t uwb_bce_print_IEs(struct uwb_dev *, struct uwb_beca_e *,
                                  char *, size_t);
-extern struct uwb_beca_e *__uwb_beca_add(struct uwb_rc_evt_beacon *,
-                                         struct uwb_beacon_frame *,
-                                         unsigned long);
 
 extern void uwb_bce_kfree(struct kref *_bce);
 static inline void uwb_bce_get(struct uwb_beca_e *bce)
@@ -241,14 +230,19 @@ static inline void uwb_bce_put(struct uwb_beca_e *bce)
 {
         kref_put(&bce->refcnt, uwb_bce_kfree);
 }
-extern void uwb_beca_purge(void);
-extern void uwb_beca_release(void);
+extern void uwb_beca_purge(struct uwb_rc *rc);
+extern void uwb_beca_release(struct uwb_rc *rc);
 
 struct uwb_dev *uwb_dev_get_by_devaddr(struct uwb_rc *rc,
                                        const struct uwb_dev_addr *devaddr);
 struct uwb_dev *uwb_dev_get_by_macaddr(struct uwb_rc *rc,
                                        const struct uwb_mac_addr *macaddr);
 
+int uwb_radio_setup(struct uwb_rc *rc);
+void uwb_radio_reset_state(struct uwb_rc *rc);
+void uwb_radio_shutdown(struct uwb_rc *rc);
+int uwb_radio_force_channel(struct uwb_rc *rc, int channel);
+
 /* -- UWB Sysfs representation */
 extern struct class uwb_rc_class;
 extern struct device_attribute dev_attr_mac_address;
@@ -259,6 +253,7 @@ extern struct device_attribute dev_attr_scan;
 void uwb_rsv_init(struct uwb_rc *rc);
 int uwb_rsv_setup(struct uwb_rc *rc);
 void uwb_rsv_cleanup(struct uwb_rc *rc);
+void uwb_rsv_remove_all(struct uwb_rc *rc);
 
 void uwb_rsv_set_state(struct uwb_rsv *rsv, enum uwb_rsv_state new_state);
 void uwb_rsv_remove(struct uwb_rsv *rsv);
@@ -289,8 +284,7 @@ void uwb_dbg_init(void);
 void uwb_dbg_exit(void);
 void uwb_dbg_add_rc(struct uwb_rc *rc);
 void uwb_dbg_del_rc(struct uwb_rc *rc);
-
-/* Workarounds for version specific stuff */
+struct dentry *uwb_dbg_create_pal_dir(struct uwb_pal *pal);
 
 static inline void uwb_dev_lock(struct uwb_dev *uwb_dev)
 {
diff --git a/drivers/uwb/uwbd.c b/drivers/uwb/uwbd.c
index 78908416e42c..ec42ce92dbce 100644
--- a/drivers/uwb/uwbd.c
+++ b/drivers/uwb/uwbd.c
@@ -104,6 +104,10 @@ struct uwbd_event {
 /** Table of handlers for and properties of the UWBD Radio Control Events */
 static
 struct uwbd_event uwbd_events[] = {
+        [UWB_RC_EVT_IE_RCV] = {
+                .handler = uwbd_evt_handle_rc_ie_rcv,
+                .name = "IE_RECEIVED"
+        },
         [UWB_RC_EVT_BEACON] = {
                 .handler = uwbd_evt_handle_rc_beacon,
                 .name = "BEACON_RECEIVED"
@@ -166,8 +170,6 @@ static const struct uwbd_event uwbd_message_handlers[] = {
         },
 };
 
-static DEFINE_MUTEX(uwbd_event_mutex);
-
 /**
  * Handle an URC event passed to the UWB Daemon
  *
@@ -231,19 +233,10 @@ static void uwbd_event_handle_message(struct uwb_event *evt)
                 return;
         }
 
-        /* If this is a reset event we need to drop the
-         * uwbd_event_mutex or it deadlocks when the reset handler
-         * attempts to flush the uwbd events. */
-        if (evt->message == UWB_EVT_MSG_RESET)
-                mutex_unlock(&uwbd_event_mutex);
-
         result = uwbd_message_handlers[evt->message].handler(evt);
         if (result < 0)
                 dev_err(&rc->uwb_dev.dev, "UWBD: '%s' message failed: %d\n",
                         uwbd_message_handlers[evt->message].name, result);
-
-        if (evt->message == UWB_EVT_MSG_RESET)
-                mutex_lock(&uwbd_event_mutex);
 }
 
 static void uwbd_event_handle(struct uwb_event *evt)
@@ -271,20 +264,6 @@ static void uwbd_event_handle(struct uwb_event *evt)
 
         __uwb_rc_put(rc);       /* for the __uwb_rc_get() in uwb_rc_notif_cb() */
 }
-/* The UWB Daemon */
-
-
-/** Daemon's PID: used to decide if we can queue or not */
-static int uwbd_pid;
-/** Daemon's task struct for managing the kthread */
-static struct task_struct *uwbd_task;
-/** Daemon's waitqueue for waiting for new events */
-static DECLARE_WAIT_QUEUE_HEAD(uwbd_wq);
-/** Daemon's list of events; we queue/dequeue here */
-static struct list_head uwbd_event_list = LIST_HEAD_INIT(uwbd_event_list);
-/** Daemon's list lock to protect concurent access */
-static DEFINE_SPINLOCK(uwbd_event_list_lock);
-
 
 /**
  * UWB Daemon
@@ -298,65 +277,58 @@ static DEFINE_SPINLOCK(uwbd_event_list_lock);
  * FIXME: should change so we don't have a 1HZ timer all the time, but
  *        only if there are devices.
  */
-static int uwbd(void *unused)
+static int uwbd(void *param)
 {
+        struct uwb_rc *rc = param;
         unsigned long flags;
-        struct list_head list = LIST_HEAD_INIT(list);
-        struct uwb_event *evt, *nxt;
+        struct uwb_event *evt;
         int should_stop = 0;
+
         while (1) {
                 wait_event_interruptible_timeout(
-                        uwbd_wq,
-                        !list_empty(&uwbd_event_list)
+                        rc->uwbd.wq,
+                        !list_empty(&rc->uwbd.event_list)
                           || (should_stop = kthread_should_stop()),
                         HZ);
                 if (should_stop)
                         break;
                 try_to_freeze();
 
-                mutex_lock(&uwbd_event_mutex);
-                spin_lock_irqsave(&uwbd_event_list_lock, flags);
-                list_splice_init(&uwbd_event_list, &list);
-                spin_unlock_irqrestore(&uwbd_event_list_lock, flags);
-                list_for_each_entry_safe(evt, nxt, &list, list_node) {
+                spin_lock_irqsave(&rc->uwbd.event_list_lock, flags);
+                if (!list_empty(&rc->uwbd.event_list)) {
+                        evt = list_first_entry(&rc->uwbd.event_list, struct uwb_event, list_node);
                         list_del(&evt->list_node);
+                } else
+                        evt = NULL;
+                spin_unlock_irqrestore(&rc->uwbd.event_list_lock, flags);
+
+                if (evt) {
                         uwbd_event_handle(evt);
                         kfree(evt);
                 }
-                mutex_unlock(&uwbd_event_mutex);
 
-                uwb_beca_purge();       /* Purge devices that left */
+                uwb_beca_purge(rc);     /* Purge devices that left */
         }
         return 0;
 }
 
 
 /** Start the UWB daemon */
-void uwbd_start(void)
+void uwbd_start(struct uwb_rc *rc)
 {
-        uwbd_task = kthread_run(uwbd, NULL, "uwbd");
-        if (uwbd_task == NULL)
+        rc->uwbd.task = kthread_run(uwbd, rc, "uwbd");
+        if (rc->uwbd.task == NULL)
                 printk(KERN_ERR "UWB: Cannot start management daemon; "
                        "UWB won't work\n");
         else
-                uwbd_pid = uwbd_task->pid;
+                rc->uwbd.pid = rc->uwbd.task->pid;
 }
 
 /* Stop the UWB daemon and free any unprocessed events */
-void uwbd_stop(void)
+void uwbd_stop(struct uwb_rc *rc)
 {
-        unsigned long flags;
-        struct uwb_event *evt, *nxt;
-        kthread_stop(uwbd_task);
-        spin_lock_irqsave(&uwbd_event_list_lock, flags);
-        uwbd_pid = 0;
-        list_for_each_entry_safe(evt, nxt, &uwbd_event_list, list_node) {
-                if (evt->type == UWB_EVT_TYPE_NOTIF)
-                        kfree(evt->notif.rceb);
-                kfree(evt);
-        }
-        spin_unlock_irqrestore(&uwbd_event_list_lock, flags);
-        uwb_beca_release();
+        kthread_stop(rc->uwbd.task);
+        uwbd_flush(rc);
 }
 
 /*
@@ -373,18 +345,20 @@ void uwbd_stop(void)
  */
 void uwbd_event_queue(struct uwb_event *evt)
 {
+        struct uwb_rc *rc = evt->rc;
         unsigned long flags;
-        spin_lock_irqsave(&uwbd_event_list_lock, flags);
-        if (uwbd_pid != 0) {
-                list_add(&evt->list_node, &uwbd_event_list);
-                wake_up_all(&uwbd_wq);
+
+        spin_lock_irqsave(&rc->uwbd.event_list_lock, flags);
+        if (rc->uwbd.pid != 0) {
+                list_add(&evt->list_node, &rc->uwbd.event_list);
+                wake_up_all(&rc->uwbd.wq);
         } else {
                 __uwb_rc_put(evt->rc);
                 if (evt->type == UWB_EVT_TYPE_NOTIF)
                         kfree(evt->notif.rceb);
                 kfree(evt);
         }
-        spin_unlock_irqrestore(&uwbd_event_list_lock, flags);
+        spin_unlock_irqrestore(&rc->uwbd.event_list_lock, flags);
         return;
 }
 
@@ -392,10 +366,8 @@ void uwbd_flush(struct uwb_rc *rc)
 {
         struct uwb_event *evt, *nxt;
 
-        mutex_lock(&uwbd_event_mutex);
-
-        spin_lock_irq(&uwbd_event_list_lock);
-        list_for_each_entry_safe(evt, nxt, &uwbd_event_list, list_node) {
+        spin_lock_irq(&rc->uwbd.event_list_lock);
+        list_for_each_entry_safe(evt, nxt, &rc->uwbd.event_list, list_node) {
                 if (evt->rc == rc) {
                         __uwb_rc_put(rc);
                         list_del(&evt->list_node);
@@ -404,7 +376,5 @@ void uwbd_flush(struct uwb_rc *rc)
                         kfree(evt);
                 }
         }
-        spin_unlock_irq(&uwbd_event_list_lock);
-
-        mutex_unlock(&uwbd_event_mutex);
+        spin_unlock_irq(&rc->uwbd.event_list_lock);
 }
diff --git a/drivers/uwb/whc-rc.c b/drivers/uwb/whc-rc.c
index 1711deadb114..5f00386e26c7 100644
--- a/drivers/uwb/whc-rc.c
+++ b/drivers/uwb/whc-rc.c
@@ -39,7 +39,6 @@
  * them to the hw and transfer the replies/notifications back to the
  * UWB stack through the UWB daemon (UWBD).
  */
-#include <linux/version.h>
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/pci.h>
@@ -333,47 +332,23 @@ void whcrc_release_rc_umc(struct whcrc *whcrc)
 static int whcrc_start_rc(struct uwb_rc *rc)
 {
         struct whcrc *whcrc = rc->priv;
-        int result = 0;
         struct device *dev = &whcrc->umc_dev->dev;
-        unsigned long start, duration;
 
         /* Reset the thing */
         le_writel(URCCMD_RESET, whcrc->rc_base + URCCMD);
-        if (d_test(3))
-                start = jiffies;
         if (whci_wait_for(dev, whcrc->rc_base + URCCMD, URCCMD_RESET, 0,
-                          5000, "device to reset at init") < 0) {
-                result = -EBUSY;
-                goto error;
-        } else if (d_test(3)) {
-                duration = jiffies - start;
-                if (duration > msecs_to_jiffies(40))
-                        dev_err(dev, "Device took %ums to "
-                                     "reset. MAX expected: 40ms\n",
-                                     jiffies_to_msecs(duration));
-        }
+                          5000, "hardware reset") < 0)
+                return -EBUSY;
 
         /* Set the event buffer, start the controller (enable IRQs later) */
         le_writel(0, whcrc->rc_base + URCINTR);
         le_writel(URCCMD_RS, whcrc->rc_base + URCCMD);
-        result = -ETIMEDOUT;
-        if (d_test(3))
-                start = jiffies;
         if (whci_wait_for(dev, whcrc->rc_base + URCSTS, URCSTS_HALTED, 0,
-                          5000, "device to start") < 0)
-                goto error;
-        if (d_test(3)) {
-                duration = jiffies - start;
-                if (duration > msecs_to_jiffies(40))
-                        dev_err(dev, "Device took %ums to start. "
-                                     "MAX expected: 40ms\n",
-                                     jiffies_to_msecs(duration));
-        }
+                          5000, "radio controller start") < 0)
+                return -ETIMEDOUT;
         whcrc_enable_events(whcrc);
-        result = 0;
         le_writel(URCINTR_EN_ALL, whcrc->rc_base + URCINTR);
-error:
-        return result;
+        return 0;
 }
 
 
@@ -395,7 +370,7 @@ void whcrc_stop_rc(struct uwb_rc *rc)
 
         le_writel(0, whcrc->rc_base + URCCMD);
         whci_wait_for(&umc_dev->dev, whcrc->rc_base + URCSTS,
-                      URCSTS_HALTED, 0, 40, "URCSTS.HALTED");
+                      URCSTS_HALTED, URCSTS_HALTED, 100, "radio controller stop");
 }
 
 static void whcrc_init(struct whcrc *whcrc)
@@ -489,6 +464,24 @@ static void whcrc_remove(struct umc_dev *umc_dev)
         d_printf(1, &umc_dev->dev, "freed whcrc %p\n", whcrc);
 }
 
+static int whcrc_pre_reset(struct umc_dev *umc)
+{
+        struct whcrc *whcrc = umc_get_drvdata(umc);
+        struct uwb_rc *uwb_rc = whcrc->uwb_rc;
+
+        uwb_rc_pre_reset(uwb_rc);
+        return 0;
+}
+
+static int whcrc_post_reset(struct umc_dev *umc)
+{
+        struct whcrc *whcrc = umc_get_drvdata(umc);
+        struct uwb_rc *uwb_rc = whcrc->uwb_rc;
+
+        uwb_rc_post_reset(uwb_rc);
+        return 0;
+}
+
 /* PCI device ID's that we handle [so it gets loaded] */
 static struct pci_device_id whcrc_id_table[] = {
         { PCI_DEVICE_CLASS(PCI_CLASS_WIRELESS_WHCI, ~0) },
@@ -497,10 +490,12 @@ static struct pci_device_id whcrc_id_table[] = {
 MODULE_DEVICE_TABLE(pci, whcrc_id_table);
 
 static struct umc_driver whcrc_driver = {
-        .name   = "whc-rc",
-        .cap_id = UMC_CAP_ID_WHCI_RC,
-        .probe  = whcrc_probe,
-        .remove = whcrc_remove,
+        .name       = "whc-rc",
+        .cap_id     = UMC_CAP_ID_WHCI_RC,
+        .probe      = whcrc_probe,
+        .remove     = whcrc_remove,
+        .pre_reset  = whcrc_pre_reset,
+        .post_reset = whcrc_post_reset,
 };
 
 static int __init whcrc_driver_init(void)
diff --git a/drivers/uwb/whci.c b/drivers/uwb/whci.c
index 3df2388f908f..1f8964ed9882 100644
--- a/drivers/uwb/whci.c
+++ b/drivers/uwb/whci.c
@@ -67,11 +67,11 @@ int whci_wait_for(struct device *dev, u32 __iomem *reg, u32 mask, u32 result,
                 val = le_readl(reg);
                 if ((val & mask) == result)
                         break;
-                msleep(10);
                 if (t >= max_ms) {
-                        dev_err(dev, "timed out waiting for %s ", tag);
+                        dev_err(dev, "%s timed out\n", tag);
                         return -ETIMEDOUT;
                 }
+                msleep(10);
                 t += 10;
         }
         return 0;
@@ -111,7 +111,7 @@ static int whci_add_cap(struct whci_card *card, int n)
                 + UWBCAPDATA_TO_OFFSET(capdata);
         umc->resource.end    = umc->resource.start
                 + (n == 0 ? 0x20 : UWBCAPDATA_TO_SIZE(capdata)) - 1;
-        umc->resource.name   = umc->dev.bus_id;
+        umc->resource.name   = dev_name(&umc->dev);
         umc->resource.flags  = card->pci->resource[bar].flags;
         umc->resource.parent = &card->pci->resource[bar];
         umc->irq             = card->pci->irq;
diff --git a/drivers/uwb/wlp/wlp-internal.h b/drivers/uwb/wlp/wlp-internal.h
index 1c94fabfb1a7..3e8d5de7c5b9 100644
--- a/drivers/uwb/wlp/wlp-internal.h
+++ b/drivers/uwb/wlp/wlp-internal.h
@@ -42,10 +42,6 @@ enum wlp_wss_connect {
 extern struct kobj_type wss_ktype;
 extern struct attribute_group wss_attr_group;
 
-extern int uwb_rc_ie_add(struct uwb_rc *, const struct uwb_ie_hdr *, size_t);
-extern int uwb_rc_ie_rm(struct uwb_rc *, enum uwb_ie);
-
-
 /* This should be changed to a dynamic array where entries are sorted
  * by eth_addr and search is done in a binary form
  *
diff --git a/drivers/uwb/wlp/wlp-lc.c b/drivers/uwb/wlp/wlp-lc.c
index 0799402e73fb..e531093c4162 100644
--- a/drivers/uwb/wlp/wlp-lc.c
+++ b/drivers/uwb/wlp/wlp-lc.c
@@ -526,7 +526,17 @@ void wlp_uwb_notifs_cb(void *_wlp, struct uwb_dev *uwb_dev,
         }
 }
 
-int wlp_setup(struct wlp *wlp, struct uwb_rc *rc)
+static void wlp_channel_changed(struct uwb_pal *pal, int channel)
+{
+        struct wlp *wlp = container_of(pal, struct wlp, pal);
+
+        if (channel < 0)
+                netif_carrier_off(wlp->ndev);
+        else
+                netif_carrier_on(wlp->ndev);
+}
+
+int wlp_setup(struct wlp *wlp, struct uwb_rc *rc, struct net_device *ndev)
 {
         struct device *dev = &rc->uwb_dev.dev;
         int result;
@@ -537,13 +547,16 @@ int wlp_setup(struct wlp *wlp, struct uwb_rc *rc)
         BUG_ON(wlp->stop_queue == NULL);
         BUG_ON(wlp->start_queue == NULL);
         wlp->rc = rc;
+        wlp->ndev = ndev;
         wlp_eda_init(&wlp->eda);/* Set up address cache */
         wlp->uwb_notifs_handler.cb = wlp_uwb_notifs_cb;
         wlp->uwb_notifs_handler.data = wlp;
         uwb_notifs_register(rc, &wlp->uwb_notifs_handler);
 
         uwb_pal_init(&wlp->pal);
-        result = uwb_pal_register(rc, &wlp->pal);
+        wlp->pal.rc = rc;
+        wlp->pal.channel_changed = wlp_channel_changed;
+        result = uwb_pal_register(&wlp->pal);
         if (result < 0)
                 uwb_notifs_deregister(wlp->rc, &wlp->uwb_notifs_handler);
 
@@ -557,7 +570,7 @@ void wlp_remove(struct wlp *wlp)
         struct device *dev = &wlp->rc->uwb_dev.dev;
         d_fnstart(6, dev, "wlp %p\n", wlp);
         wlp_neighbors_release(wlp);
-        uwb_pal_unregister(wlp->rc, &wlp->pal);
+        uwb_pal_unregister(&wlp->pal);
         uwb_notifs_deregister(wlp->rc, &wlp->uwb_notifs_handler);
         wlp_eda_release(&wlp->eda);
         mutex_lock(&wlp->mutex);