diff --git a/src/core/hle/ipc_helpers.h b/src/core/hle/ipc_helpers.h
index 94bd4e0ccb..28a2b8545d 100644
--- a/src/core/hle/ipc_helpers.h
+++ b/src/core/hle/ipc_helpers.h
@@ -9,6 +9,7 @@
 #include <type_traits>
 #include <utility>
 #include "core/hle/ipc.h"
+#include "core/hle/kernel/domain.h"
 #include "core/hle/kernel/handle_table.h"
 #include "core/hle/kernel/hle_ipc.h"
 #include "core/hle/kernel/kernel.h"
@@ -80,11 +81,24 @@ public:
 
         AlignWithPadding();
 
+        if (context.IsDomain()) {
+            PushRaw(IPC::DomainMessageHeader{});
+        }
+
         IPC::DataPayloadHeader data_payload_header{};
         data_payload_header.magic = Common::MakeMagic('S', 'F', 'C', 'O');
         PushRaw(data_payload_header);
     }
 
+    template <class T>
+    void PushIpcInterface() {
+        auto& request_handlers = context->Domain()->request_handlers;
+        request_handlers.push_back(std::move(std::make_shared<T>()->shared_from_this()));
+        Push(RESULT_SUCCESS);
+        AlignWithPadding();
+        Push<u32>(static_cast<u32>(request_handlers.size()));
+    }
+
     // Validate on destruction, as there shouldn't be any case where we don't want it
     ~RequestBuilder() {
         ValidateHeader();
diff --git a/src/core/hle/kernel/handle_table.cpp b/src/core/hle/kernel/handle_table.cpp
index c7322d883f..12506e64c9 100644
--- a/src/core/hle/kernel/handle_table.cpp
+++ b/src/core/hle/kernel/handle_table.cpp
@@ -5,10 +5,12 @@
 #include <utility>
 #include "common/assert.h"
 #include "common/logging/log.h"
+#include "core/hle/kernel/client_session.h"
 #include "core/hle/kernel/errors.h"
 #include "core/hle/kernel/handle_table.h"
 #include "core/hle/kernel/kernel.h"
 #include "core/hle/kernel/process.h"
+#include "core/hle/kernel/session.h"
 #include "core/hle/kernel/thread.h"
 
 namespace Kernel {
@@ -53,6 +55,14 @@ ResultVal<Handle> HandleTable::Duplicate(Handle handle) {
     return Create(std::move(object));
 }
 
+void HandleTable::ConvertSessionToDomain(const Session& session, SharedPtr<Object> domain) {
+    for (auto& object : objects) {
+        if (DynamicObjectCast<ClientSession>(object) == session.client) {
+            object = domain;
+        }
+    }
+}
+
 ResultCode HandleTable::Close(Handle handle) {
     if (!IsValid(handle))
         return ERR_INVALID_HANDLE;
diff --git a/src/core/hle/kernel/handle_table.h b/src/core/hle/kernel/handle_table.h
index d6aaefbf7d..dba5573a80 100644
--- a/src/core/hle/kernel/handle_table.h
+++ b/src/core/hle/kernel/handle_table.h
@@ -17,6 +17,8 @@ enum KernelHandle : Handle {
     CurrentProcess = 0xFFFF8001,
 };
 
+class Session;
+
 /**
  * This class allows the creation of Handles, which are references to objects that can be tested
  * for validity and looked up. Here they are used to pass references to kernel objects to/from the
@@ -59,6 +61,11 @@ public:
      */
     ResultVal<Handle> Duplicate(Handle handle);
 
+    /**
+     * Convert all handles of the specified Session to the specified Domain.
+     */
+    void ConvertSessionToDomain(const Session& session, SharedPtr<Object> domain);
+
     /**
      * Closes a handle, removing it from the table and decreasing the object's ref-count.
      * @return `RESULT_SUCCESS` or one of the following errors:
diff --git a/src/core/hle/kernel/hle_ipc.cpp b/src/core/hle/kernel/hle_ipc.cpp
index 427642cab9..85dd801590 100644
--- a/src/core/hle/kernel/hle_ipc.cpp
+++ b/src/core/hle/kernel/hle_ipc.cpp
@@ -7,6 +7,7 @@
 #include "common/common_funcs.h"
 #include "common/common_types.h"
 #include "core/hle/ipc_helpers.h"
+#include "core/hle/kernel/domain.h"
 #include "core/hle/kernel/handle_table.h"
 #include "core/hle/kernel/hle_ipc.h"
 #include "core/hle/kernel/kernel.h"
@@ -25,8 +26,12 @@ void SessionRequestHandler::ClientDisconnected(SharedPtr<ServerSession> server_s
     boost::range::remove_erase(connected_sessions, server_session);
 }
 
-HLERequestContext::HLERequestContext(SharedPtr<ServerSession> session)
-    : session(std::move(session)) {
+HLERequestContext::HLERequestContext(SharedPtr<Kernel::Domain> domain) : domain(std::move(domain)) {
+    cmd_buf[0] = 0;
+}
+
+HLERequestContext::HLERequestContext(SharedPtr<Kernel::ServerSession> server_session)
+    : server_session(std::move(server_session)) {
     cmd_buf[0] = 0;
 }
 
@@ -66,16 +71,16 @@ void HLERequestContext::ParseCommandBuffer(u32_le* src_cmdbuf, bool incoming) {
         rp.Skip(handle_descriptor_header->num_handles_to_move, false);
     }
 
-    for (int i = 0; i < command_header->num_buf_x_descriptors; ++i) {
+    for (unsigned i = 0; i < command_header->num_buf_x_descriptors; ++i) {
         buffer_x_desciptors.push_back(rp.PopRaw<IPC::BufferDescriptorX>());
     }
-    for (int i = 0; i < command_header->num_buf_a_descriptors; ++i) {
+    for (unsigned i = 0; i < command_header->num_buf_a_descriptors; ++i) {
         buffer_a_desciptors.push_back(rp.PopRaw<IPC::BufferDescriptorABW>());
     }
-    for (int i = 0; i < command_header->num_buf_b_descriptors; ++i) {
+    for (unsigned i = 0; i < command_header->num_buf_b_descriptors; ++i) {
         buffer_b_desciptors.push_back(rp.PopRaw<IPC::BufferDescriptorABW>());
     }
-    for (int i = 0; i < command_header->num_buf_w_descriptors; ++i) {
+    for (unsigned i = 0; i < command_header->num_buf_w_descriptors; ++i) {
         buffer_w_desciptors.push_back(rp.PopRaw<IPC::BufferDescriptorABW>());
     }
     if (command_header->buf_c_descriptor_flags !=
@@ -85,6 +90,12 @@ void HLERequestContext::ParseCommandBuffer(u32_le* src_cmdbuf, bool incoming) {
 
     // Padding to align to 16 bytes
     rp.AlignWithPadding();
+
+    if (IsDomain() && (command_header->type == IPC::CommandType::Request || !incoming)) {
+        // If this is an incoming message, only CommandType "Request" has a domain header
+        // All outgoing domain messages have the domain header
+        domain_message_header =
+            std::make_unique<IPC::DomainMessageHeader>(rp.PopRaw<IPC::DomainMessageHeader>());
     }
 
     data_payload_header =
@@ -106,13 +117,6 @@ ResultCode HLERequestContext::PopulateFromIncomingCommandBuffer(u32_le* src_cmdb
     ParseCommandBuffer(src_cmdbuf, true);
     size_t untranslated_size = data_payload_offset + command_header->data_size;
     std::copy_n(src_cmdbuf, untranslated_size, cmd_buf.begin());
-
-    if (command_header->enable_handle_descriptor) {
-        if (handle_descriptor_header->num_handles_to_copy ||
-            handle_descriptor_header->num_handles_to_move) {
-            UNIMPLEMENTED();
-        }
-    }
     return RESULT_SUCCESS;
 }
 
diff --git a/src/core/hle/kernel/hle_ipc.h b/src/core/hle/kernel/hle_ipc.h
index bf8cfc2a3c..7de13b36be 100644
--- a/src/core/hle/kernel/hle_ipc.h
+++ b/src/core/hle/kernel/hle_ipc.h
@@ -20,7 +20,9 @@ class ServiceFrameworkBase;
 
 namespace Kernel {
 
+class Domain;
 class HandleTable;
+class HLERequestContext;
 class Process;
 
 /**
@@ -40,7 +42,7 @@ public:
      * this request (ServerSession, Originator thread, Translated command buffer, etc).
      * @returns ResultCode the result code of the translate operation.
      */
-    virtual ResultCode HandleSyncRequest(SharedPtr<ServerSession> server_session) = 0;
+    virtual ResultCode HandleSyncRequest(Kernel::HLERequestContext& context) = 0;
 
     /**
      * Signals that a client has just connected to this HLE handler and keeps the
@@ -84,7 +86,8 @@ protected:
  */
 class HLERequestContext {
 public:
-    HLERequestContext(SharedPtr<ServerSession> session);
+    HLERequestContext(SharedPtr<Kernel::Domain> domain);
+    HLERequestContext(SharedPtr<Kernel::ServerSession> session);
     ~HLERequestContext();
 
     /// Returns a pointer to the IPC command buffer for this request.
@@ -92,12 +95,19 @@ public:
         return cmd_buf.data();
     }
 
+    /**
+     * Returns the domain through which this request was made.
+     */
+    const SharedPtr<Kernel::Domain>& Domain() const {
+        return domain;
+    }
+
     /**
      * Returns the session through which this request was made. This can be used as a map key to
      * access per-client data on services.
      */
-    SharedPtr<ServerSession> Session() const {
-        return session;
+    const SharedPtr<Kernel::ServerSession>& ServerSession() const {
+        return server_session;
     }
 
     /**
@@ -144,9 +154,18 @@ public:
         return buffer_x_desciptors;
     }
 
+    const std::unique_ptr<IPC::DomainMessageHeader>& GetDomainMessageHeader() const {
+        return domain_message_header;
+    }
+
+    bool IsDomain() const {
+        return domain != nullptr;
+    }
+
 private:
     std::array<u32, IPC::COMMAND_BUFFER_LENGTH> cmd_buf;
-    SharedPtr<ServerSession> session;
+    SharedPtr<Kernel::Domain> domain;
+    SharedPtr<Kernel::ServerSession> server_session;
     // TODO(yuriks): Check common usage of this and optimize size accordingly
     boost::container::small_vector<SharedPtr<Object>, 8> request_handles;
 
diff --git a/src/core/hle/kernel/server_session.cpp b/src/core/hle/kernel/server_session.cpp
index 68e5cc2b78..09d02a6911 100644
--- a/src/core/hle/kernel/server_session.cpp
+++ b/src/core/hle/kernel/server_session.cpp
@@ -6,7 +6,9 @@
 
 #include "core/hle/kernel/client_port.h"
 #include "core/hle/kernel/client_session.h"
+#include "core/hle/kernel/handle_table.h"
 #include "core/hle/kernel/hle_ipc.h"
+#include "core/hle/kernel/process.h"
 #include "core/hle/kernel/server_session.h"
 #include "core/hle/kernel/session.h"
 #include "core/hle/kernel/thread.h"
@@ -66,8 +68,13 @@ ResultCode ServerSession::HandleSyncRequest(SharedPtr<Thread> thread) {
         ResultCode translate_result = TranslateHLERequest(this);
         if (translate_result.IsError())
             return translate_result;
-        result = hle_handler->HandleSyncRequest(SharedPtr<ServerSession>(this));
-        // TODO(Subv): Translate the response command buffer.
+
+        Kernel::HLERequestContext context(this);
+        u32* cmd_buf = (u32*)Memory::GetPointer(Kernel::GetCurrentThread()->GetTLSAddress());
+        context.PopulateFromIncomingCommandBuffer(cmd_buf, *Kernel::g_current_process,
+                                                  Kernel::g_handle_table);
+
+        result = hle_handler->HandleSyncRequest(context);
     } else {
         // Add the thread to the list of threads that have issued a sync request with this
         // server.
diff --git a/src/core/hle/kernel/server_session.h b/src/core/hle/kernel/server_session.h
index 78db5510d4..f4360ddf32 100644
--- a/src/core/hle/kernel/server_session.h
+++ b/src/core/hle/kernel/server_session.h
@@ -91,14 +91,6 @@ public:
     /// TODO(Subv): Find a better name for this.
     SharedPtr<Thread> currently_handling;
 
-    void ConvertToDomain() {
-        is_domain = true;
-    }
-
-    bool IsDomain() const {
-        return is_domain;
-    }
-
 private:
     ServerSession();
     ~ServerSession() override;
@@ -110,8 +102,6 @@ private:
      * @return The created server session
      */
     static ResultVal<SharedPtr<ServerSession>> Create(std::string name = "Unknown");
-
-    bool is_domain{};
 };
 
 /**
diff --git a/src/core/hle/service/service.cpp b/src/core/hle/service/service.cpp
index 0fba224e1e..3dfde8f39d 100644
--- a/src/core/hle/service/service.cpp
+++ b/src/core/hle/service/service.cpp
@@ -13,7 +13,6 @@
 #include "core/hle/kernel/handle_table.h"
 #include "core/hle/kernel/process.h"
 #include "core/hle/kernel/server_port.h"
-#include "core/hle/kernel/server_session.h"
 #include "core/hle/kernel/thread.h"
 #include "core/hle/service/am/am.h"
 #include "core/hle/service/aoc/aoc_u.h"
@@ -29,7 +28,6 @@
 
 using Kernel::ClientPort;
 using Kernel::ServerPort;
-using Kernel::ServerSession;
 using Kernel::SharedPtr;
 
 namespace Service {
@@ -124,15 +122,7 @@ void ServiceFrameworkBase::InvokeRequest(Kernel::HLERequestContext& ctx) {
     handler_invoker(this, info->handler_callback, ctx);
 }
 
-ResultCode ServiceFrameworkBase::HandleSyncRequest(SharedPtr<ServerSession> server_session) {
-    u32* cmd_buf = (u32*)Memory::GetPointer(Kernel::GetCurrentThread()->GetTLSAddress());
-
-    // TODO(yuriks): The kernel should be the one handling this as part of translation after
-    // everything else is migrated
-    Kernel::HLERequestContext context(std::move(server_session));
-    context.PopulateFromIncomingCommandBuffer(cmd_buf, *Kernel::g_current_process,
-                                              Kernel::g_handle_table);
-
+ResultCode ServiceFrameworkBase::HandleSyncRequest(Kernel::HLERequestContext& context) {
     switch (context.GetCommandType()) {
     case IPC::CommandType::Close: {
         IPC::RequestBuilder rb{context, 1};
@@ -151,6 +141,7 @@ ResultCode ServiceFrameworkBase::HandleSyncRequest(SharedPtr<ServerSession> serv
         UNIMPLEMENTED_MSG("command_type=%d", context.GetCommandType());
     }
 
+    u32* cmd_buf = (u32*)Memory::GetPointer(Kernel::GetCurrentThread()->GetTLSAddress());
     context.WriteToOutgoingCommandBuffer(cmd_buf, *Kernel::g_current_process,
                                          Kernel::g_handle_table);
 
diff --git a/src/core/hle/service/service.h b/src/core/hle/service/service.h
index ad5f952924..234a5c88d2 100644
--- a/src/core/hle/service/service.h
+++ b/src/core/hle/service/service.h
@@ -63,7 +63,7 @@ public:
 
     void InvokeRequest(Kernel::HLERequestContext& ctx);
 
-    ResultCode HandleSyncRequest(Kernel::SharedPtr<Kernel::ServerSession> server_session) override;
+    ResultCode HandleSyncRequest(Kernel::HLERequestContext& context) override;
 
 protected:
     /// Member-function pointer type of SyncRequest handlers.
diff --git a/src/core/hle/service/sm/controller.cpp b/src/core/hle/service/sm/controller.cpp
index 414a7d8091..1d7ab3a1ce 100644
--- a/src/core/hle/service/sm/controller.cpp
+++ b/src/core/hle/service/sm/controller.cpp
@@ -4,27 +4,21 @@
 
 #include "common/logging/log.h"
 #include "core/hle/ipc_helpers.h"
+#include "core/hle/kernel/domain.h"
 #include "core/hle/service/sm/controller.h"
 
 namespace Service {
 namespace SM {
 
-/**
- * Controller::ConvertSessionToDomain service function
- *  Inputs:
- *      0: 0x00000000
- *  Outputs:
- *      0: ResultCode
- *      2: Handle of domain
- */
 void Controller::ConvertSessionToDomain(Kernel::HLERequestContext& ctx) {
-    ctx.Session()->ConvertToDomain();
+    auto domain = Kernel::Domain::CreateFromSession(*ctx.ServerSession()->parent).Unwrap();
+
     IPC::RequestBuilder rb{ctx, 3};
     rb.Push(RESULT_SUCCESS);
     rb.Skip(1, true);
-    Kernel::Handle handle = Kernel::g_handle_table.Create(ctx.Session()).Unwrap();
-    rb.Push(handle);
-    LOG_DEBUG(Service, "called, handle=0x%08x", handle);
+    rb.Push<u32>(static_cast<u32>(domain->request_handlers.size()));
+
+    LOG_DEBUG(Service, "called, domain=%d", domain->GetObjectId());
 }
 
 /**