8 files changed, 118 insertions, 405 deletions

diff --git a/src/core/hle/ipc.h b/src/core/hle/ipc.h
index 4c21f5024..c2f481624 100644
--- a/src/core/hle/ipc.h
+++ b/src/core/hle/ipc.h
@@ -143,120 +143,25 @@ struct DataPayloadHeader {
 };
 static_assert(sizeof(DataPayloadHeader) == 8, "DataPayloadRequest size is incorrect");
 
-struct DomainRequestMessageHeader {
+struct DomainMessageHeader {
     union {
-        BitField<0, 8, u32_le> command;
-        BitField<16, 16, u32_le> size;
+        // Used when responding to an IPC request, Server -> Client.
+        struct {
+            u32_le num_objects;
+            INSERT_PADDING_WORDS(3);
+        };
+
+        // Used when performing an IPC request, Client -> Server.
+        struct {
+            union {
+                BitField<0, 8, u32_le> command;
+                BitField<16, 16, u32_le> size;
+            };
+            u32_le object_id;
+            INSERT_PADDING_WORDS(2);
+        };
     };
-    u32_le object_id;
-    INSERT_PADDING_WORDS(2);
-};
-static_assert(sizeof(DomainRequestMessageHeader) == 16, "DomainRequestMessageHeader size is incorrect");
-
-struct DomainResponseMessageHeader {
-    u32_le num_objects;
-    INSERT_PADDING_WORDS(3);
-};
-static_assert(sizeof(DomainResponseMessageHeader) == 16, "DomainResponseMessageHeader size is incorrect");
-
-enum DescriptorType : u32 {
-    // Buffer related desciptors types (mask : 0x0F)
-    StaticBuffer = 0x02,
-    PXIBuffer = 0x04,
-    MappedBuffer = 0x08,
-    // Handle related descriptors types (mask : 0x30, but need to check for buffer related
-    // descriptors first )
-    CopyHandle = 0x00,
-    MoveHandle = 0x10,
-    CallingPid = 0x20,
-};
-
-constexpr u32 MoveHandleDesc(u32 num_handles = 1) {
-    return MoveHandle | ((num_handles - 1) << 26);
-}
-
-constexpr u32 CopyHandleDesc(u32 num_handles = 1) {
-    return CopyHandle | ((num_handles - 1) << 26);
-}
-
-constexpr u32 CallingPidDesc() {
-    return CallingPid;
-}
-
-constexpr bool IsHandleDescriptor(u32 descriptor) {
-    return (descriptor & 0xF) == 0x0;
-}
-
-constexpr u32 HandleNumberFromDesc(u32 handle_descriptor) {
-    return (handle_descriptor >> 26) + 1;
-}
-
-union StaticBufferDescInfo {
-    u32 raw;
-    BitField<0, 4, u32> descriptor_type;
-    BitField<10, 4, u32> buffer_id;
-    BitField<14, 18, u32> size;
 };
-
-inline u32 StaticBufferDesc(size_t size, u8 buffer_id) {
-    StaticBufferDescInfo info{};
-    info.descriptor_type.Assign(StaticBuffer);
-    info.buffer_id.Assign(buffer_id);
-    info.size.Assign(static_cast<u32>(size));
-    return info.raw;
-}
-
-/**
- * @brief Creates a header describing a buffer to be sent over PXI.
- * @param size         Size of the buffer. Max 0x00FFFFFF.
- * @param buffer_id    The Id of the buffer. Max 0xF.
- * @param is_read_only true if the buffer is read-only. If false, the buffer is considered to have
- * read-write access.
- * @return The created PXI buffer header.
- *
- * The next value is a phys-address of a table located in the BASE memregion.
- */
-inline u32 PXIBufferDesc(u32 size, unsigned buffer_id, bool is_read_only) {
-    u32 type = PXIBuffer;
-    if (is_read_only)
-        type |= 0x2;
-    return type | (size << 8) | ((buffer_id & 0xF) << 4);
-}
-
-enum MappedBufferPermissions : u32 {
-    R = 1,
-    W = 2,
-    RW = R | W,
-};
-
-union MappedBufferDescInfo {
-    u32 raw;
-    BitField<0, 4, u32> flags;
-    BitField<1, 2, MappedBufferPermissions> perms;
-    BitField<4, 28, u32> size;
-};
-
-inline u32 MappedBufferDesc(size_t size, MappedBufferPermissions perms) {
-    MappedBufferDescInfo info{};
-    info.flags.Assign(MappedBuffer);
-    info.perms.Assign(perms);
-    info.size.Assign(static_cast<u32>(size));
-    return info.raw;
-}
-
-inline DescriptorType GetDescriptorType(u32 descriptor) {
-    // Note: Those checks must be done in this order
-    if (IsHandleDescriptor(descriptor))
-        return (DescriptorType)(descriptor & 0x30);
-
-    // handle the fact that the following descriptors can have rights
-    if (descriptor & MappedBuffer)
-        return MappedBuffer;
-
-    if (descriptor & PXIBuffer)
-        return PXIBuffer;
-
-    return StaticBuffer;
-}
+static_assert(sizeof(DomainMessageHeader) == 16, "DomainMessageHeader size is incorrect");
 
 } // namespace IPC
diff --git a/src/core/hle/ipc_helpers.h b/src/core/hle/ipc_helpers.h
index 705943e6b..368b50011 100644
--- a/src/core/hle/ipc_helpers.h
+++ b/src/core/hle/ipc_helpers.h
@@ -58,18 +58,18 @@ public:
     RequestBuilder(u32* command_buffer) : RequestHelperBase(command_buffer) {}
 
     RequestBuilder(Kernel::HLERequestContext& context, unsigned normal_params_size,
-                   u32 num_handles_to_copy = 0, u32 num_handles_to_move = 0, u32 num_domain_objects = 0)
+                   u32 num_handles_to_copy = 0, u32 num_handles_to_move = 0,
+                   u32 num_domain_objects = 0)
         : RequestHelperBase(context) {
-        memset(cmdbuf, 0, 64);
-
-        context.ClearIncomingObjects();
+        memset(cmdbuf, 0, sizeof(u32) * IPC::COMMAND_BUFFER_LENGTH);
 
         IPC::CommandHeader header{};
 
-        // The entire size of the raw data section in u32 units, including the 16 bytes of mandatory padding.
+        // The entire size of the raw data section in u32 units, including the 16 bytes of mandatory
+        // padding.
         u32 raw_data_size = sizeof(IPC::DataPayloadHeader) / 4 + 4 + normal_params_size;
         if (context.IsDomain())
-            raw_data_size += sizeof(DomainResponseMessageHeader) / 4 + num_domain_objects;
+            raw_data_size += sizeof(DomainMessageHeader) / 4 + num_domain_objects;
 
         header.data_size.Assign(raw_data_size);
         if (num_handles_to_copy || num_handles_to_move) {
@@ -88,7 +88,7 @@ public:
         AlignWithPadding();
 
         if (context.IsDomain()) {
-            IPC::DomainResponseMessageHeader domain_header{};
+            IPC::DomainMessageHeader domain_header{};
             domain_header.num_objects = num_domain_objects;
             PushRaw(domain_header);
         }
@@ -100,12 +100,7 @@ public:
 
     template <class T>
     void PushIpcInterface() {
-        auto& request_handlers = context->Domain()->request_handlers;
-        request_handlers.emplace_back(std::make_shared<T>());
-        Push(RESULT_SUCCESS);
-        Push<u32>(0); // The error code is the lower word of an u64, so we fill the rest with 0.
-        // Now push the id of the newly-added object.
-        Push<u32>(static_cast<u32>(request_handlers.size()));
+        context->AddDomainObject(std::make_shared<T>());
     }
 
     // Validate on destruction, as there shouldn't be any case where we don't want it
@@ -127,21 +122,11 @@ public:
     template <typename T>
     void PushRaw(const T& value);
 
-    // TODO : ensure that translate params are added after all regular params
-    template <typename... H>
-    void PushCopyHandles(H... handles);
-
-    template <typename... H>
-    void PushMoveHandles(H... handles);
-
     template <typename... O>
-    void PushObjects(Kernel::SharedPtr<O>... pointers);
-
-    void PushCurrentPIDHandle();
+    void PushMoveObjects(Kernel::SharedPtr<O>... pointers);
 
-    void PushStaticBuffer(VAddr buffer_vaddr, size_t size, u8 buffer_id);
-
-    void PushMappedBuffer(VAddr buffer_vaddr, size_t size, MappedBufferPermissions perms);
+    template <typename... O>
+    void PushCopyObjects(Kernel::SharedPtr<O>... pointers);
 };
 
 /// Push ///
@@ -189,37 +174,20 @@ void RequestBuilder::Push(const First& first_value, const Other&... other_values
     Push(other_values...);
 }
 
-template <typename... H>
-inline void RequestBuilder::PushCopyHandles(H... handles) {
-    Push(CopyHandleDesc(sizeof...(H)));
-    Push(static_cast<Kernel::Handle>(handles)...);
-}
-
-template <typename... H>
-inline void RequestBuilder::PushMoveHandles(H... handles) {
-    Push(MoveHandleDesc(sizeof...(H)));
-    Push(static_cast<Kernel::Handle>(handles)...);
-}
-
 template <typename... O>
-inline void RequestBuilder::PushObjects(Kernel::SharedPtr<O>... pointers) {
-    PushMoveHandles(context->AddOutgoingHandle(std::move(pointers))...);
-}
-
-inline void RequestBuilder::PushCurrentPIDHandle() {
-    Push(CallingPidDesc());
-    Push(u32(0));
-}
-
-inline void RequestBuilder::PushStaticBuffer(VAddr buffer_vaddr, size_t size, u8 buffer_id) {
-    Push(StaticBufferDesc(size, buffer_id));
-    Push(buffer_vaddr);
+inline void RequestBuilder::PushCopyObjects(Kernel::SharedPtr<O>... pointers) {
+    auto objects = {pointers...};
+    for (auto& object : objects) {
+        context->AddCopyObject(std::move(object));
+    }
 }
 
-inline void RequestBuilder::PushMappedBuffer(VAddr buffer_vaddr, size_t size,
-                                             MappedBufferPermissions perms) {
-    Push(MappedBufferDesc(size, perms));
-    Push(buffer_vaddr);
+template <typename... O>
+inline void RequestBuilder::PushMoveObjects(Kernel::SharedPtr<O>... pointers) {
+    auto objects = {pointers...};
+    for (auto& object : objects) {
+        context->AddMoveObject(std::move(object));
+    }
 }
 
 class RequestParser : public RequestHelperBase {
@@ -229,6 +197,9 @@ public:
     RequestParser(Kernel::HLERequestContext& context) : RequestHelperBase(context) {
         ASSERT_MSG(context.GetDataPayloadOffset(), "context is incomplete");
         Skip(context.GetDataPayloadOffset(), false);
+        // Skip the u64 command id, it's already stored in the context
+        static constexpr u32 CommandIdSize = 2;
+        Skip(CommandIdSize, false);
     }
 
     RequestBuilder MakeBuilder(u32 normal_params_size, u32 num_handles_to_copy,
@@ -249,80 +220,6 @@ public:
     template <typename First, typename... Other>
     void Pop(First& first_value, Other&... other_values);
 
-    /// Equivalent to calling `PopHandles<1>()[0]`.
-    Kernel::Handle PopHandle();
-
-    /**
-     * Pops a descriptor containing `N` handles. The handles are returned as an array. The
-     * descriptor must contain exactly `N` handles, it is not permitted to, for example, call
-     * PopHandles<1>() twice to read a multi-handle descriptor with 2 handles, or to make a single
-     * PopHandles<2>() call to read 2 single-handle descriptors.
-     */
-    template <unsigned int N>
-    std::array<Kernel::Handle, N> PopHandles();
-
-    /// Convenience wrapper around PopHandles() which assigns the handles to the passed references.
-    template <typename... H>
-    void PopHandles(H&... handles) {
-        std::tie(handles...) = PopHandles<sizeof...(H)>();
-    }
-
-    /// Equivalent to calling `PopGenericObjects<1>()[0]`.
-    Kernel::SharedPtr<Kernel::Object> PopGenericObject();
-
-    /// Equivalent to calling `std::get<0>(PopObjects<T>())`.
-    template <typename T>
-    Kernel::SharedPtr<T> PopObject();
-
-    /**
-     * Pop a descriptor containing `N` handles and resolves them to Kernel::Object pointers. If a
-     * handle is invalid, null is returned for that object instead. The same caveats from
-     * PopHandles() apply regarding `N` matching the number of handles in the descriptor.
-     */
-    template <unsigned int N>
-    std::array<Kernel::SharedPtr<Kernel::Object>, N> PopGenericObjects();
-
-    /**
-     * Resolves handles to Kernel::Objects as in PopGenericsObjects(), but then also casts them to
-     * the passed `T` types, while verifying that the cast is valid. If the type of an object does
-     * not match, null is returned instead.
-     */
-    template <typename... T>
-    std::tuple<Kernel::SharedPtr<T>...> PopObjects();
-
-    /// Convenience wrapper around PopObjects() which assigns the handles to the passed references.
-    template <typename... T>
-    void PopObjects(Kernel::SharedPtr<T>&... pointers) {
-        std::tie(pointers...) = PopObjects<T...>();
-    }
-
-    /**
-     * @brief Pops the static buffer vaddr
-     * @return                  The virtual address of the buffer
-     * @param[out] data_size    If non-null, the pointed value will be set to the size of the data
-     * @param[out] useStaticBuffersToGetVaddr Indicates if we should read the vaddr from the static
-     * buffers (which is the correct thing to do, but no service presently implement it) instead of
-     * using the same value as the process who sent the request
-     * given by the source process
-     *
-     * Static buffers must be set up before any IPC request using those is sent.
-     * It is the duty of the process (usually services) to allocate and set up the receiving static
-     * buffer information
-     * Please note that the setup uses virtual addresses.
-     */
-    VAddr PopStaticBuffer(size_t* data_size = nullptr, bool useStaticBuffersToGetVaddr = false);
-
-    /**
-     * @brief Pops the mapped buffer vaddr
-     * @return                  The virtual address of the buffer
-     * @param[out] data_size    If non-null, the pointed value will be set to the size of the data
-     * given by the source process
-     * @param[out] buffer_perms If non-null, the pointed value will be set to the permissions of the
-     * buffer
-     */
-    VAddr PopMappedBuffer(size_t* data_size = nullptr,
-                          MappedBufferPermissions* buffer_perms = nullptr);
-
     /**
      * @brief Reads the next normal parameters as a struct, by copying it
      * @note: The output class must be correctly packed/padded to fit hardware layout.
@@ -396,91 +293,4 @@ void RequestParser::Pop(First& first_value, Other&... other_values) {
     Pop(other_values...);
 }
 
-inline Kernel::Handle RequestParser::PopHandle() {
-    const u32 handle_descriptor = Pop<u32>();
-    DEBUG_ASSERT_MSG(IsHandleDescriptor(handle_descriptor),
-                     "Tried to pop handle(s) but the descriptor is not a handle descriptor");
-    DEBUG_ASSERT_MSG(HandleNumberFromDesc(handle_descriptor) == 1,
-                     "Descriptor indicates that there isn't exactly one handle");
-    return Pop<Kernel::Handle>();
-}
-
-template <unsigned int N>
-std::array<Kernel::Handle, N> RequestParser::PopHandles() {
-    u32 handle_descriptor = Pop<u32>();
-    ASSERT_MSG(IsHandleDescriptor(handle_descriptor),
-               "Tried to pop handle(s) but the descriptor is not a handle descriptor");
-    ASSERT_MSG(N == HandleNumberFromDesc(handle_descriptor),
-               "Number of handles doesn't match the descriptor");
-
-    std::array<Kernel::Handle, N> handles{};
-    for (Kernel::Handle& handle : handles) {
-        handle = Pop<Kernel::Handle>();
-    }
-    return handles;
-}
-
-inline Kernel::SharedPtr<Kernel::Object> RequestParser::PopGenericObject() {
-    Kernel::Handle handle = PopHandle();
-    return context->GetIncomingHandle(handle);
-}
-
-template <typename T>
-Kernel::SharedPtr<T> RequestParser::PopObject() {
-    return Kernel::DynamicObjectCast<T>(PopGenericObject());
-}
-
-template <unsigned int N>
-inline std::array<Kernel::SharedPtr<Kernel::Object>, N> RequestParser::PopGenericObjects() {
-    std::array<Kernel::Handle, N> handles = PopHandles<N>();
-    std::array<Kernel::SharedPtr<Kernel::Object>, N> pointers;
-    for (int i = 0; i < N; ++i) {
-        pointers[i] = context->GetIncomingHandle(handles[i]);
-    }
-    return pointers;
-}
-
-namespace detail {
-template <typename... T, size_t... I>
-std::tuple<Kernel::SharedPtr<T>...> PopObjectsHelper(
-    std::array<Kernel::SharedPtr<Kernel::Object>, sizeof...(T)>&& pointers,
-    std::index_sequence<I...>) {
-    return std::make_tuple(Kernel::DynamicObjectCast<T>(std::move(pointers[I]))...);
-}
-} // namespace detail
-
-template <typename... T>
-inline std::tuple<Kernel::SharedPtr<T>...> RequestParser::PopObjects() {
-    return detail::PopObjectsHelper<T...>(PopGenericObjects<sizeof...(T)>(),
-                                          std::index_sequence_for<T...>{});
-}
-
-inline VAddr RequestParser::PopStaticBuffer(size_t* data_size, bool useStaticBuffersToGetVaddr) {
-    const u32 sbuffer_descriptor = Pop<u32>();
-    StaticBufferDescInfo bufferInfo{sbuffer_descriptor};
-    if (data_size != nullptr)
-        *data_size = bufferInfo.size;
-    if (!useStaticBuffersToGetVaddr)
-        return Pop<VAddr>();
-    else {
-        ASSERT_MSG(0, "remove the assert if multiprocess/IPC translation are implemented.");
-        // The buffer has already been copied to the static buffer by the kernel during
-        // translation
-        Pop<VAddr>(); // Pop the calling process buffer address
-                      // and get the vaddr from the static buffers
-        return cmdbuf[(0x100 >> 2) + bufferInfo.buffer_id * 2 + 1];
-    }
-}
-
-inline VAddr RequestParser::PopMappedBuffer(size_t* data_size,
-                                            MappedBufferPermissions* buffer_perms) {
-    const u32 sbuffer_descriptor = Pop<u32>();
-    MappedBufferDescInfo bufferInfo{sbuffer_descriptor};
-    if (data_size != nullptr)
-        *data_size = bufferInfo.size;
-    if (buffer_perms != nullptr)
-        *buffer_perms = bufferInfo.perms;
-    return Pop<VAddr>();
-}
-
 } // namespace IPC
diff --git a/src/core/hle/kernel/hle_ipc.cpp b/src/core/hle/kernel/hle_ipc.cpp
index ac81dbf3f..518e44f33 100644
--- a/src/core/hle/kernel/hle_ipc.cpp
+++ b/src/core/hle/kernel/hle_ipc.cpp
@@ -37,20 +37,6 @@ HLERequestContext::HLERequestContext(SharedPtr<Kernel::ServerSession> server_ses
 
 HLERequestContext::~HLERequestContext() = default;
 
-SharedPtr<Object> HLERequestContext::GetIncomingHandle(u32 id_from_cmdbuf) const {
-    ASSERT(id_from_cmdbuf < request_handles.size());
-    return request_handles[id_from_cmdbuf];
-}
-
-u32 HLERequestContext::AddOutgoingHandle(SharedPtr<Object> object) {
-    request_handles.push_back(std::move(object));
-    return static_cast<u32>(request_handles.size() - 1);
-}
-
-void HLERequestContext::ClearIncomingObjects() {
-    request_handles.clear();
-}
-
 void HLERequestContext::ParseCommandBuffer(u32_le* src_cmdbuf, bool incoming) {
     IPC::RequestParser rp(src_cmdbuf);
     command_header = std::make_unique<IPC::CommandHeader>(rp.PopRaw<IPC::CommandHeader>());
@@ -95,7 +81,7 @@ void HLERequestContext::ParseCommandBuffer(u32_le* src_cmdbuf, bool incoming) {
         // If this is an incoming message, only CommandType "Request" has a domain header
         // All outgoing domain messages have the domain header
         domain_message_header =
-            std::make_unique<IPC::DomainRequestMessageHeader>(rp.PopRaw<IPC::DomainRequestMessageHeader>());
+            std::make_unique<IPC::DomainMessageHeader>(rp.PopRaw<IPC::DomainMessageHeader>());
     }
 
     data_payload_header =
@@ -107,61 +93,78 @@ void HLERequestContext::ParseCommandBuffer(u32_le* src_cmdbuf, bool incoming) {
         ASSERT(data_payload_header->magic == Common::MakeMagic('S', 'F', 'C', 'O'));
     }
 
+    data_payload_offset = rp.GetCurrentOffset();
     command = rp.Pop<u32_le>();
     rp.Skip(1, false); // The command is actually an u64, but we don't use the high part.
-    data_payload_offset = rp.GetCurrentOffset();
 }
 
 ResultCode HLERequestContext::PopulateFromIncomingCommandBuffer(u32_le* src_cmdbuf,
                                                                 Process& src_process,
                                                                 HandleTable& src_table) {
     ParseCommandBuffer(src_cmdbuf, true);
-    size_t untranslated_size = data_payload_offset + command_header->data_size;
-    std::copy_n(src_cmdbuf, untranslated_size, cmd_buf.begin());
+    // The data_size already includes the payload header, the padding and the domain header.
+    size_t size = data_payload_offset + command_header->data_size -
+                  sizeof(IPC::DataPayloadHeader) / sizeof(u32) - 4;
+    if (domain_message_header)
+        size -= sizeof(IPC::DomainMessageHeader) / sizeof(u32);
+    std::copy_n(src_cmdbuf, size, cmd_buf.begin());
     return RESULT_SUCCESS;
 }
 
 ResultCode HLERequestContext::WriteToOutgoingCommandBuffer(u32_le* dst_cmdbuf, Process& dst_process,
                                                            HandleTable& dst_table) {
-    ParseCommandBuffer(&cmd_buf[0], false);
-    size_t untranslated_size = data_payload_offset + command_header->data_size;
-    std::copy_n(cmd_buf.begin(), untranslated_size, dst_cmdbuf);
+    // The header was already built in the internal command buffer. Attempt to parse it to verify
+    // the integrity and then copy it over to the target command buffer.
+    ParseCommandBuffer(cmd_buf.data(), false);
+
+    // The data_size already includes the payload header, the padding and the domain header.
+    size_t size = data_payload_offset + command_header->data_size -
+                  sizeof(IPC::DataPayloadHeader) / sizeof(u32) - 4;
+    if (domain_message_header)
+        size -= sizeof(IPC::DomainMessageHeader) / sizeof(u32);
+
+    std::copy_n(cmd_buf.begin(), size, dst_cmdbuf);
 
     if (command_header->enable_handle_descriptor) {
-        size_t command_size = untranslated_size + handle_descriptor_header->num_handles_to_copy +
-                              handle_descriptor_header->num_handles_to_move;
-        ASSERT(command_size <= IPC::COMMAND_BUFFER_LENGTH);
-
-        size_t untranslated_index = untranslated_size;
-        size_t handle_write_offset = 3;
-        while (untranslated_index < command_size) {
-            u32 descriptor = cmd_buf[untranslated_index];
-            untranslated_index += 1;
-
-            switch (IPC::GetDescriptorType(descriptor)) {
-            case IPC::DescriptorType::CopyHandle:
-            case IPC::DescriptorType::MoveHandle: {
-                // HLE services don't use handles, so we treat both CopyHandle and MoveHandle
-                // equally
-                u32 num_handles = IPC::HandleNumberFromDesc(descriptor);
-                for (u32 j = 0; j < num_handles; ++j) {
-                    SharedPtr<Object> object = GetIncomingHandle(cmd_buf[untranslated_index]);
-                    Handle handle = 0;
-                    if (object != nullptr) {
-                        // TODO(yuriks): Figure out the proper error handling for if this fails
-                        handle = dst_table.Create(object).Unwrap();
-                    }
-                    dst_cmdbuf[handle_write_offset++] = handle;
-                    untranslated_index++;
-                }
-                break;
-            }
-            default:
-                UNIMPLEMENTED_MSG("Unsupported handle translation: 0x%08X", descriptor);
-            }
+        ASSERT_MSG(!move_objects.empty() || !copy_objects.empty(),
+                   "Handle descriptor bit set but no handles to translate");
+        // We write the translated handles at a specific offset in the command buffer, this space
+        // was already reserved when writing the header.
+        size_t current_offset =
+            (sizeof(IPC::CommandHeader) + sizeof(IPC::HandleDescriptorHeader)) / sizeof(u32);
+        ASSERT_MSG(!handle_descriptor_header->send_current_pid, "Sending PID is not implemented");
+
+        ASSERT_MSG(copy_objects.size() == handle_descriptor_header->num_handles_to_copy);
+        ASSERT_MSG(move_objects.size() == handle_descriptor_header->num_handles_to_move);
+
+        // We don't make a distinction between copy and move handles when translating since HLE
+        // services don't deal with handles directly. However, the guest applications might check
+        // for specific values in each of these descriptors.
+        for (auto& object : copy_objects) {
+            ASSERT(object != nullptr);
+            dst_cmdbuf[current_offset++] = Kernel::g_handle_table.Create(object).Unwrap();
+        }
+
+        for (auto& object : move_objects) {
+            ASSERT(object != nullptr);
+            dst_cmdbuf[current_offset++] = Kernel::g_handle_table.Create(object).Unwrap();
         }
     }
 
+    // TODO(Subv): Translate the X/A/B/W buffers.
+
+    if (IsDomain()) {
+        ASSERT(domain_message_header->num_objects == domain_objects.size());
+        // Write the domain objects to the command buffer, these go after the raw untranslated data.
+        // TODO(Subv): This completely ignores C buffers.
+        size_t domain_offset = size - domain_message_header->num_objects;
+        auto& request_handlers = domain->request_handlers;
+
+        for (auto& object : domain_objects) {
+            request_handlers.emplace_back(object);
+            dst_cmdbuf[domain_offset++] = request_handlers.size();
+        }
+    }
     return RESULT_SUCCESS;
 }
 
diff --git a/src/core/hle/kernel/hle_ipc.h b/src/core/hle/kernel/hle_ipc.h
index b5649931d..48730a2b2 100644
--- a/src/core/hle/kernel/hle_ipc.h
+++ b/src/core/hle/kernel/hle_ipc.h
@@ -110,25 +110,6 @@ public:
         return server_session;
     }
 
-    /**
-     * Resolves a object id from the request command buffer into a pointer to an object. See the
-     * "HLE handle protocol" section in the class documentation for more details.
-     */
-    SharedPtr<Object> GetIncomingHandle(u32 id_from_cmdbuf) const;
-
-    /**
-     * Adds an outgoing object to the response, returning the id which should be used to reference
-     * it. See the "HLE handle protocol" section in the class documentation for more details.
-     */
-    u32 AddOutgoingHandle(SharedPtr<Object> object);
-
-    /**
-     * Discards all Objects from the context, invalidating all ids. This may be called after reading
-     * out all incoming objects, so that the buffer memory can be re-used for outgoing handles, but
-     * this is not required.
-     */
-    void ClearIncomingObjects();
-
     void ParseCommandBuffer(u32_le* src_cmdbuf, bool incoming);
 
     /// Populates this context with data from the requesting process/thread.
@@ -158,7 +139,7 @@ public:
         return buffer_a_desciptors;
     }
 
-    const std::unique_ptr<IPC::DomainRequestMessageHeader>& GetDomainMessageHeader() const {
+    const std::unique_ptr<IPC::DomainMessageHeader>& GetDomainMessageHeader() const {
         return domain_message_header;
     }
 
@@ -166,17 +147,31 @@ public:
         return domain != nullptr;
     }
 
+    void AddMoveObject(SharedPtr<Object> object) {
+        move_objects.emplace_back(std::move(object));
+    }
+
+    void AddCopyObject(SharedPtr<Object> object) {
+        copy_objects.emplace_back(std::move(object));
+    }
+
+    void AddDomainObject(std::shared_ptr<SessionRequestHandler> object) {
+        domain_objects.emplace_back(std::move(object));
+    }
+
 private:
     std::array<u32, IPC::COMMAND_BUFFER_LENGTH> cmd_buf;
     SharedPtr<Kernel::Domain> domain;
     SharedPtr<Kernel::ServerSession> server_session;
     // TODO(yuriks): Check common usage of this and optimize size accordingly
-    boost::container::small_vector<SharedPtr<Object>, 8> request_handles;
+    boost::container::small_vector<SharedPtr<Object>, 8> move_objects;
+    boost::container::small_vector<SharedPtr<Object>, 8> copy_objects;
+    boost::container::small_vector<std::shared_ptr<SessionRequestHandler>, 8> domain_objects;
 
     std::unique_ptr<IPC::CommandHeader> command_header;
     std::unique_ptr<IPC::HandleDescriptorHeader> handle_descriptor_header;
     std::unique_ptr<IPC::DataPayloadHeader> data_payload_header;
-    std::unique_ptr<IPC::DomainRequestMessageHeader> domain_message_header;
+    std::unique_ptr<IPC::DomainMessageHeader> domain_message_header;
     std::vector<IPC::BufferDescriptorX> buffer_x_desciptors;
     std::vector<IPC::BufferDescriptorABW> buffer_a_desciptors;
     std::vector<IPC::BufferDescriptorABW> buffer_b_desciptors;
diff --git a/src/core/hle/service/am/applet_oe.cpp b/src/core/hle/service/am/applet_oe.cpp
index 6fe7bdce5..34cc67f34 100644
--- a/src/core/hle/service/am/applet_oe.cpp
+++ b/src/core/hle/service/am/applet_oe.cpp
@@ -73,7 +73,7 @@ private:
 
         IPC::RequestBuilder rb{ctx, 2, 1};
         rb.Push(RESULT_SUCCESS);
-        rb.PushObjects(event);
+        rb.PushCopyObjects(event);
 
         LOG_WARNING(Service, "(STUBBED) called");
     }
diff --git a/src/core/hle/service/lm/lm.cpp b/src/core/hle/service/lm/lm.cpp
index bf9e98bb5..edbee39f5 100644
--- a/src/core/hle/service/lm/lm.cpp
+++ b/src/core/hle/service/lm/lm.cpp
@@ -150,7 +150,7 @@ void LM::Initialize(Kernel::HLERequestContext& ctx) {
                   (*session)->GetObjectId());
         IPC::RequestBuilder rb{ctx, 1, 0, 1};
         rb.Push(RESULT_SUCCESS);
-        rb.PushObjects(std::move(session).Unwrap());
+        rb.PushMoveObjects(std::move(session).Unwrap());
         registered_loggers.emplace_back(std::move(client_port));
     } else {
         UNIMPLEMENTED();
diff --git a/src/core/hle/service/sm/controller.cpp b/src/core/hle/service/sm/controller.cpp
index 8d17e0ef6..7acc5c3b2 100644
--- a/src/core/hle/service/sm/controller.cpp
+++ b/src/core/hle/service/sm/controller.cpp
@@ -24,7 +24,7 @@ void Controller::ConvertSessionToDomain(Kernel::HLERequestContext& ctx) {
 void Controller::DuplicateSession(Kernel::HLERequestContext& ctx) {
     IPC::RequestBuilder rb{ctx, 1, 0, 1};
     rb.Push(RESULT_SUCCESS);
-    rb.PushObjects(ctx.ServerSession());
+    rb.PushMoveObjects(ctx.ServerSession());
 
     LOG_DEBUG(Service, "called");
 }
diff --git a/src/core/hle/service/sm/sm.cpp b/src/core/hle/service/sm/sm.cpp
index 279908cae..f1d93ea2b 100644
--- a/src/core/hle/service/sm/sm.cpp
+++ b/src/core/hle/service/sm/sm.cpp
@@ -121,7 +121,7 @@ void SM::GetService(Kernel::HLERequestContext& ctx) {
                   (*session)->GetObjectId());
         IPC::RequestBuilder rb = rp.MakeBuilder(2, 0, 1);
         rb.Push<u64>(0);
-        rb.PushObjects(std::move(session).Unwrap());
+        rb.PushMoveObjects(std::move(session).Unwrap());
     }
 }