Index: kernel/generic/src/ipc/ops/conctmeto.c
===================================================================
--- kernel/generic/src/ipc/ops/conctmeto.c	(revision 4d6629f35433100ab954e68c6ed4fc9bf24accb1)
+++ kernel/generic/src/ipc/ops/conctmeto.c	(revision 943aaf1b5f329ccc9f76244a88cef32d566f8576)
@@ -1,5 +1,5 @@
 /*
  * Copyright (c) 2006 Ondrej Palkovsky
- * Copyright (c) 2012 Jakub Jermar 
+ * Copyright (c) 2012 Jakub Jermar
  * All rights reserved.
  *
@@ -42,13 +42,16 @@
 static int request_preprocess(call_t *call, phone_t *phone)
 {
-	int cap = phone_alloc(TASK);
+	cap_handle_t phone_handle = phone_alloc(TASK);
 
 	/* Remember the phone capability or the error. */
-	call->priv = cap;
-	if (cap < 0)
-		return ELIMIT;
-		
+	call->priv = phone_handle;
+	if (phone_handle < 0)
+		return phone_handle;
+
 	/* Set arg5 for server */
-	IPC_SET_ARG5(call->data, (sysarg_t) phone_get_current(cap));
+	kobject_t *phone_obj = kobject_get(TASK, phone_handle,
+	    KOBJECT_TYPE_PHONE);
+	/* Hand over phone_obj's reference to ARG5 */
+	IPC_SET_ARG5(call->data, (sysarg_t) phone_obj->phone);
 
 	return EOK;
@@ -57,5 +60,10 @@
 static int request_forget(call_t *call)
 {
-	phone_dealloc(call->priv);
+	cap_handle_t phone_handle = (cap_handle_t) call->priv;
+	phone_dealloc(phone_handle);
+	/* Hand over reference from ARG5 to phone->kobject */
+	phone_t *phone = (phone_t *) IPC_GET_ARG5(call->data);
+	/* Drop phone_obj's reference */
+	kobject_put(phone->kobject);
 	return EOK;
 }
@@ -63,9 +71,14 @@
 static int answer_preprocess(call_t *answer, ipc_data_t *olddata)
 {
+	/* Hand over reference from ARG5 to phone */
 	phone_t *phone = (phone_t *) IPC_GET_ARG5(*olddata);
 
 	/* If the user accepted call, connect */
-	if (IPC_GET_RETVAL(answer->data) == EOK)
+	if (IPC_GET_RETVAL(answer->data) == EOK) {
+		/* Hand over reference from phone to the answerbox */
 		(void) ipc_phone_connect(phone, &TASK->answerbox);
+	} else {
+		kobject_put(phone->kobject);
+	}
 
 	return EOK;
@@ -74,16 +87,16 @@
 static int answer_process(call_t *answer)
 {
-	int cap = (int) answer->priv;
+	cap_handle_t phone_handle = (cap_handle_t) answer->priv;
 
 	if (IPC_GET_RETVAL(answer->data)) {
-		if (cap >= 0) {
+		if (phone_handle >= 0) {
 			/*
 			 * The phone was indeed allocated and now needs
 			 * to be deallocated.
 			 */
-			phone_dealloc(cap);
+			phone_dealloc(phone_handle);
 		}
 	} else {
-		IPC_SET_ARG5(answer->data, cap);
+		IPC_SET_ARG5(answer->data, phone_handle);
 	}
 	
Index: kernel/generic/src/ipc/ops/concttome.c
===================================================================
--- kernel/generic/src/ipc/ops/concttome.c	(revision 4d6629f35433100ab954e68c6ed4fc9bf24accb1)
+++ kernel/generic/src/ipc/ops/concttome.c	(revision 943aaf1b5f329ccc9f76244a88cef32d566f8576)
@@ -1,5 +1,5 @@
 /*
  * Copyright (c) 2006 Ondrej Palkovsky
- * Copyright (c) 2012 Jakub Jermar 
+ * Copyright (c) 2012 Jakub Jermar
  * All rights reserved.
  *
@@ -42,7 +42,7 @@
 static int request_process(call_t *call, answerbox_t *box)
 {
-	int cap = phone_alloc(TASK);
+	cap_handle_t phone_handle = phone_alloc(TASK);
 
-	IPC_SET_ARG5(call->data, cap);
+	IPC_SET_ARG5(call->data, phone_handle);
 	
 	return EOK;
@@ -51,8 +51,8 @@
 static int answer_cleanup(call_t *answer, ipc_data_t *olddata)
 {
-	int cap = (int) IPC_GET_ARG5(*olddata);
+	cap_handle_t phone_handle = (cap_handle_t) IPC_GET_ARG5(*olddata);
 
-	if (cap >= 0)
-		phone_dealloc(cap);
+	if (phone_handle >= 0)
+		phone_dealloc(phone_handle);
 
 	return EOK;
@@ -61,15 +61,18 @@
 static int answer_preprocess(call_t *answer, ipc_data_t *olddata)
 {
-	int cap = (int) IPC_GET_ARG5(*olddata);
+	cap_handle_t phone_handle = (cap_handle_t) IPC_GET_ARG5(*olddata);
 
 	if (IPC_GET_RETVAL(answer->data) != EOK) {
 		/* The connection was not accepted */
 		answer_cleanup(answer, olddata);
-	} else if (cap >= 0) {
+	} else if (phone_handle >= 0) {
 		/* The connection was accepted */
-		if (phone_connect(cap, &answer->sender->answerbox)) {
-			/* Set 'phone hash' as arg5 of response */
+		if (phone_connect(phone_handle, &answer->sender->answerbox)) {
+			/* Set 'phone hash' as ARG5 of response */
+			kobject_t *phone_obj = kobject_get(TASK, phone_handle,
+			    KOBJECT_TYPE_PHONE);
 			IPC_SET_ARG5(answer->data,
-			    (sysarg_t) phone_get_current(cap));
+			    (sysarg_t) phone_obj->phone);
+			kobject_put(phone_obj);
 		} else {
 			/* The answerbox is shutting down. */
Index: kernel/generic/src/ipc/ops/stchngath.c
===================================================================
--- kernel/generic/src/ipc/ops/stchngath.c	(revision 4d6629f35433100ab954e68c6ed4fc9bf24accb1)
+++ kernel/generic/src/ipc/ops/stchngath.c	(revision 943aaf1b5f329ccc9f76244a88cef32d566f8576)
@@ -45,21 +45,24 @@
 	task_t *other_task_s;
 
-	phone_t *sender_phone = phone_get_current(IPC_GET_ARG5(call->data));
-	if (!sender_phone)
+	kobject_t *sender_obj = kobject_get(TASK, IPC_GET_ARG5(call->data),
+	    KOBJECT_TYPE_PHONE);
+	if (!sender_obj)
 		return ENOENT;
 
-	mutex_lock(&sender_phone->lock);
-	if (sender_phone->state != IPC_PHONE_CONNECTED) {
-		mutex_unlock(&sender_phone->lock);
+	mutex_lock(&sender_obj->phone->lock);
+	if (sender_obj->phone->state != IPC_PHONE_CONNECTED) {
+		mutex_unlock(&sender_obj->phone->lock);
+		kobject_put(sender_obj);
 		return EINVAL;
 	}
 
-	other_task_s = sender_phone->callee->task;
+	other_task_s = sender_obj->phone->callee->task;
 
-	mutex_unlock(&sender_phone->lock);
+	mutex_unlock(&sender_obj->phone->lock);
 
 	/* Remember the third party task hash. */
 	IPC_SET_ARG5(call->data, (sysarg_t) other_task_s);
 
+	kobject_put(sender_obj);
 	return EOK;
 }
@@ -71,22 +74,23 @@
 	if (!IPC_GET_RETVAL(answer->data)) {
 		/* The recipient authorized the change of state. */
-		phone_t *recipient_phone;
 		task_t *other_task_s;
 		task_t *other_task_r;
 
-		recipient_phone = phone_get_current(IPC_GET_ARG1(answer->data));
-		if (!recipient_phone) {
+		kobject_t *recipient_obj = kobject_get(TASK,
+		    IPC_GET_ARG1(answer->data), KOBJECT_TYPE_PHONE);
+		if (!recipient_obj) {
 			IPC_SET_RETVAL(answer->data, ENOENT);
 			return ENOENT;
 		}
 
-		mutex_lock(&recipient_phone->lock);
-		if (recipient_phone->state != IPC_PHONE_CONNECTED) {
-			mutex_unlock(&recipient_phone->lock);
+		mutex_lock(&recipient_obj->phone->lock);
+		if (recipient_obj->phone->state != IPC_PHONE_CONNECTED) {
+			mutex_unlock(&recipient_obj->phone->lock);
 			IPC_SET_RETVAL(answer->data, EINVAL);
+			kobject_put(recipient_obj);
 			return EINVAL;
 		}
 
-		other_task_r = recipient_phone->callee->task;
+		other_task_r = recipient_obj->phone->callee->task;
 		other_task_s = (task_t *) IPC_GET_ARG5(*olddata);
 
@@ -109,5 +113,6 @@
 		}
 
-		mutex_unlock(&recipient_phone->lock);
+		mutex_unlock(&recipient_obj->phone->lock);
+		kobject_put(recipient_obj);
 	}