0001-linux-v6.11-rc3-bao-io-dispatcher.patch

diff --git a/Documentation/userspace-api/ioctl/ioctl-number.rst b/Documentation/userspace-api/ioctl/ioctl-number.rst
index e91c0376e..3116fe1ce 100644
--- a/Documentation/userspace-api/ioctl/ioctl-number.rst
+++ b/Documentation/userspace-api/ioctl/ioctl-number.rst
@@ -340,6 +340,7 @@ Code  Seq#    Include File                                           Comments
                                                                      <mailto:luzmaximilian@gmail.com>
 0xA5  20-2F  linux/surface_aggregator/dtx.h                          Microsoft Surface DTX driver
                                                                      <mailto:luzmaximilian@gmail.com>
+0xA6  all    uapi/linux/bao.h                                        Bao hypervisor
 0xAA  00-3F  linux/uapi/linux/userfaultfd.h
 0xAB  00-1F  linux/nbd.h
 0xAC  00-1F  linux/raw.h
diff --git a/arch/arm/include/asm/bao.h b/arch/arm/include/asm/bao.h
new file mode 100644
index 000000000..957330d9d
--- /dev/null
+++ b/arch/arm/include/asm/bao.h
@@ -0,0 +1,65 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Hypercall for Bao Hypervisor on ARM
+ *
+ * Copyright (c) Bao Project and Contributors. All rights reserved.
+ *
+ * Authors:
+ *	João Peixoto <joaopeixotooficial@gmail.com>
+ */
+
+#ifndef __ASM_ARM_BAO_H
+#define __ASM_ARM_BAO_H
+
+#include <asm/bao.h>
+#include <linux/bao.h>
+#include <linux/arm-smccc.h>
+
+/**
+ * asm_bao_hypercall_remio() - Performs a Remote I/O Hypercall
+ * @remio_hc_id: VirtIO Hypercall ID
+ * @dm_id: Device Model ID
+ * @addr: Access address
+ * @op:	Write, Read, Ask or Notify operation
+ * @value: Value to write or read
+ * @cpu_id: CPU ID
+ * @vcpu_id: VCPU ID
+ *
+ * @return: The VirtIO request structure
+ */
+static inline struct bao_virtio_request
+asm_bao_hypercall_remio(u64 remio_hc_id, u64 dm_id, u64 addr, u64 op,
+			 u64 value, u64 cpu_id, u64 vcpu_id)
+{
+	register int x0 asm("r0") =
+		ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, ARM_SMCCC_SMC_64,
+				   ARM_SMCCC_OWNER_VENDOR_HYP, remio_hc_id);
+	register u32 x1 asm("r1") = dm_id;
+	register u32 x2 asm("r2") = addr;
+	register u32 x3 asm("r3") = op;
+	register u32 x4 asm("r4") = value;
+	register u32 x5 asm("r5") = cpu_id;
+	register u32 x6 asm("r6") = vcpu_id;
+
+	struct bao_virtio_request ret;
+
+	asm volatile("hvc 0\n\t"
+		     : "=r"(x0), "=r"(x1), "=r"(x2), "=r"(x3), "=r"(x4),
+		       "=r"(x5), "=r"(x6)
+		     : "r"(x0), "r"(x1), "r"(x2), "r"(x3), "r"(x4), "r"(x5),
+		       "r"(x6)
+		     : "memory");
+
+	ret.ret = x0;
+	ret.dm_id = dm_id;
+	ret.addr = x1;
+	ret.op = x2;
+	ret.value = x3;
+	ret.access_width = x4;
+	ret.cpu_id = x5;
+	ret.vcpu_id = x6;
+
+	return ret;
+}
+
+#endif /* __ASM_ARM_BAO_H */
diff --git a/arch/arm64/include/asm/bao.h b/arch/arm64/include/asm/bao.h
new file mode 100644
index 000000000..4a42c0bce
--- /dev/null
+++ b/arch/arm64/include/asm/bao.h
@@ -0,0 +1,65 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Hypercall for Bao Hypervisor on ARM64
+ *
+ * Copyright (c) Bao Project and Contributors. All rights reserved.
+ *
+ * Authors:
+ *	João Peixoto <joaopeixotooficial@gmail.com>
+ */
+
+#ifndef __ASM_ARM64_BAO_H
+#define __ASM_ARM64_BAO_H
+
+#include <asm/bao.h>
+#include <linux/bao.h>
+#include <linux/arm-smccc.h>
+
+/**
+ * asm_bao_hypercall_remio() - Performs a Remote I/O Hypercall
+ * @remio_hc_id: VirtIO Hypercall ID
+ * @dm_id: Device Model ID
+ * @addr: Access address
+ * @op:	Write, Read, Ask or Notify operation
+ * @value: Value to write or read
+ * @cpu_id: CPU ID
+ * @vcpu_id: VCPU ID
+ *
+ * @return: The VirtIO request structure
+ */
+static inline struct bao_virtio_request
+asm_bao_hypercall_remio(u64 remio_hc_id, u64 dm_id, u64 addr, u64 op,
+			 u64 value, u64 cpu_id, u64 vcpu_id)
+{
+	register int x0 asm("x0") =
+		ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, ARM_SMCCC_SMC_64,
+				   ARM_SMCCC_OWNER_VENDOR_HYP, remio_hc_id);
+	register u64 x1 asm("x1") = dm_id;
+	register u64 x2 asm("x2") = addr;
+	register u64 x3 asm("x3") = op;
+	register u64 x4 asm("x4") = value;
+	register u64 x5 asm("x5") = cpu_id;
+	register u64 x6 asm("x6") = vcpu_id;
+
+	struct bao_virtio_request ret;
+
+	asm volatile("hvc 0\n\t"
+		     : "=r"(x0), "=r"(x1), "=r"(x2), "=r"(x3), "=r"(x4),
+		       "=r"(x5), "=r"(x6)
+		     : "r"(x0), "r"(x1), "r"(x2), "r"(x3), "r"(x4), "r"(x5),
+		       "r"(x6)
+		     : "memory");
+
+	ret.ret = x0;
+	ret.dm_id = dm_id;
+	ret.addr = x1;
+	ret.op = x2;
+	ret.value = x3;
+	ret.access_width = x4;
+	ret.cpu_id = x5;
+	ret.vcpu_id = x6;
+
+	return ret;
+}
+
+#endif /* __ASM_ARM64_BAO_H */
diff --git a/arch/riscv/include/asm/bao.h b/arch/riscv/include/asm/bao.h
new file mode 100644
index 000000000..f2492acc7
--- /dev/null
+++ b/arch/riscv/include/asm/bao.h
@@ -0,0 +1,63 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Hypercall for Bao Hypervisor on RISC-V
+ *
+ * Copyright (c) Bao Project and Contributors. All rights reserved.
+ *
+ * Authors:
+ *	João Peixoto <joaopeixotooficial@gmail.com>
+ */
+
+#ifndef __ASM_RISCV_BAO_H
+#define __ASM_RISCV_BAO_H
+
+#include <asm/sbi.h>
+#include <linux/bao.h>
+
+/**
+ * asm_bao_hypercall_remio() - Performs a Remote I/O Hypercall
+ * @remio_hc_id: VirtIO Hypercall ID
+ * @dm_id: Device Model ID
+ * @addr: Access address
+ * @op:	Write, Read, Ask or Notify operation
+ * @value: Value to write or read
+ * @cpu_id: CPU ID
+ * @vcpu_id: VCPU ID
+ *
+ * @return: The VirtIO request structure
+ */
+static inline struct bao_virtio_request
+asm_bao_hypercall_remio(u64 remio_hc_id, u64 dm_id, u64 addr, u64 op,
+			 u64 value, u64 cpu_id, u64 vcpu_id)
+{
+	struct bao_virtio_request ret;
+
+	register uintptr_t a0 asm("a0") = (uintptr_t)(dm_id);
+	register uintptr_t a1 asm("a1") = (uintptr_t)(addr);
+	register uintptr_t a2 asm("a2") = (uintptr_t)(op);
+	register uintptr_t a3 asm("a3") = (uintptr_t)(value);
+	register uintptr_t a4 asm("a4") = (uintptr_t)(cpu_id);
+	register uintptr_t a5 asm("a5") = (uintptr_t)(vcpu_id);
+	register uintptr_t a6 asm("a6") = (uintptr_t)(remio_hc_id);
+	register uintptr_t a7 asm("a7") = (uintptr_t)(0x08000ba0);
+
+	asm volatile("ecall"
+		     : "+r"(a0), "+r"(a1), "+r"(a2), "+r"(a3), "+r"(a4),
+		       "+r"(a5), "+r"(a6)
+		     : "r"(a0), "r"(a1), "r"(a2), "r"(a3), "r"(a4), "r"(a5),
+		       "r"(a6), "r"(a7)
+		     : "memory");
+
+	ret.ret = a0;
+	ret.dm_id = dm_id;
+	ret.addr = a1;
+	ret.op = a2;
+	ret.value = a3;
+	ret.access_width = a4;
+	ret.cpu_id = a5;
+	ret.vcpu_id = a6;
+
+	return ret;
+}
+
+#endif /* __ASM_RISCV_BAO_H */
diff --git a/drivers/Kconfig b/drivers/Kconfig
index 7bdad836f..f6906c8f7 100644
--- a/drivers/Kconfig
+++ b/drivers/Kconfig
@@ -147,6 +147,8 @@ source "drivers/hv/Kconfig"
 
 source "drivers/xen/Kconfig"
 
+source "drivers/bao/Kconfig"
+
 source "drivers/greybus/Kconfig"
 
 source "drivers/comedi/Kconfig"
diff --git a/drivers/Makefile b/drivers/Makefile
index fe9ceb0d2..986b0db67 100644
--- a/drivers/Makefile
+++ b/drivers/Makefile
@@ -160,6 +160,7 @@ obj-$(CONFIG_SOUNDWIRE)		+= soundwire/
 obj-$(CONFIG_VIRT_DRIVERS)	+= virt/
 obj-$(subst m,y,$(CONFIG_HYPERV))	+= hv/
 
+obj-$(CONFIG_BAO_SHMEM) += bao/
 obj-$(CONFIG_PM_DEVFREQ)	+= devfreq/
 obj-$(CONFIG_EXTCON)		+= extcon/
 obj-$(CONFIG_MEMORY)		+= memory/
diff --git a/drivers/bao/Kconfig b/drivers/bao/Kconfig
new file mode 100644
index 000000000..c99d163eb
--- /dev/null
+++ b/drivers/bao/Kconfig
@@ -0,0 +1,5 @@
+config BAO_SHMEM
+	tristate "Bao shared memory support"
+
+	help
+	  This implements an interface to communicate with bao hosted guests.
\ No newline at end of file
diff --git a/drivers/bao/Makefile b/drivers/bao/Makefile
new file mode 100644
index 000000000..d35c18fd3
--- /dev/null
+++ b/drivers/bao/Makefile
@@ -0,0 +1,3 @@
+# SPDX-License-Identifier: GPL-2.0
+obj-$(CONFIG_BAO_SHMEM) += bao.o
+bao-objs += bao-ipcshmem.o
\ No newline at end of file
diff --git a/drivers/bao/bao-ipcshmem.c b/drivers/bao/bao-ipcshmem.c
new file mode 100644
index 000000000..475ac5b1c
--- /dev/null
+++ b/drivers/bao/bao-ipcshmem.c
@@ -0,0 +1,332 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Bao Hypervisor IPC Through Shared-memory Sample Driver
+ *
+ * Copyright (c) Bao Project and Contributors. All rights reserved.
+ *
+ * Authors:
+ *	David Cerdeira and José Martins
+ */
+
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/uaccess.h>
+#include <linux/fs.h>
+#include <linux/io.h>
+#include <linux/ioport.h>
+#include <linux/interrupt.h>
+#include <linux/of.h>
+#include <asm/io.h>
+#include <linux/mutex.h>
+#include <linux/poll.h>
+#include <linux/platform_device.h>
+#include <linux/ioctl.h>
+#include <linux/cdev.h>
+#include <linux/device.h>
+#include <linux/spinlock.h>
+#include <linux/mutex.h>
+#include <linux/wait.h>
+#include <linux/mm.h>
+
+#if defined(CONFIG_ARM64) || defined(CONFIG_ARM)
+#include <linux/arm-smccc.h>
+#include <asm/memory.h>
+#elif CONFIG_RISCV
+#include <asm/sbi.h>
+#endif
+
+#define DEV_NAME "baoipc"
+#define MAX_DEVICES 16
+#define NAME_LEN 32
+
+static dev_t bao_ipcshmem_devt;
+struct class *cl;
+
+struct bao_ipcshmem
+{
+    struct cdev cdev;
+    struct device *dev;
+
+    int id;
+    char label[NAME_LEN];
+    void* read_base;
+    size_t read_size;
+    void* write_base;
+    size_t write_size;
+    void* physical_base;
+    size_t shmem_size;
+};
+
+#ifdef CONFIG_ARM64
+static uint64_t bao_ipcshmem_notify(struct bao_ipcshmem *dev) {
+    register uint64_t x0 asm("x0") = ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL,
+                ARM_SMCCC_SMC_64, ARM_SMCCC_OWNER_VENDOR_HYP, 1);
+    register uint64_t x1 asm("x1") = dev->id;
+    register uint64_t x2 asm("x2") = 0;
+
+    asm volatile(
+        "hvc 0\t\n"
+        : "=r"(x0)
+        : "r"(x0), "r"(x1), "r"(x2)
+    );
+
+    return x0;
+}
+#elif CONFIG_ARM
+static uint32_t bao_ipcshmem_notify(struct bao_ipcshmem *dev) {
+    register uint32_t r0 asm("r0") = ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL,
+                ARM_SMCCC_SMC_32, ARM_SMCCC_OWNER_VENDOR_HYP, 1);
+    register uint32_t r1 asm("r1") = dev->id;
+    register uint32_t r2 asm("r2") = 0;
+
+    asm volatile(
+        "hvc #0\t\n"
+        : "=r"(r0)
+        : "r"(r0), "r"(r1), "r"(r2)
+    );
+
+    return r0;
+}
+#elif CONFIG_RISCV
+static uint64_t bao_ipcshmem_notify(struct bao_ipcshmem *dev) {
+
+	struct sbiret ret =
+		sbi_ecall(0x08000ba0, 1, dev->id, 0, 0, 0, 0, 0);
+
+	return ret.error;
+}
+#endif
+
+static int bao_ipcshmem_mmap_fops(struct file *filp, struct vm_area_struct *vma)
+{
+    struct bao_ipcshmem *bao = filp->private_data;
+
+    unsigned long vsize = vma->vm_end - vma->vm_start;
+
+    if (remap_pfn_range(vma, vma->vm_start,
+            (unsigned long)bao->physical_base >> PAGE_SHIFT, vsize,
+            vma->vm_page_prot)) {
+        return -EFAULT;
+    }
+
+    return 0;
+}
+
+static ssize_t bao_ipcshmem_read_fops(struct file *filp,
+                           char *buf, size_t count, loff_t *ppos)
+{
+    struct bao_ipcshmem *bao_ipcshmem = filp->private_data;
+    unsigned long missing = 0;
+    size_t len = 0;
+
+    len = strnlen(bao_ipcshmem->read_base, bao_ipcshmem->read_size);
+
+    if (*ppos >= len) return 0;
+    if ((len - *ppos) < count) count = len - *ppos;
+
+    missing =
+        copy_to_user(buf, bao_ipcshmem->read_base + *ppos, count);
+    if(missing != 0) count = count - missing;
+    *ppos += count;
+
+    return count;
+}
+
+static ssize_t bao_ipcshmem_write_fops(struct file *filp,
+                            const char *buf, size_t count, loff_t *ppos)
+{
+    struct bao_ipcshmem *bao_ipcshmem = filp->private_data;
+    unsigned long missing = 0;
+
+    if (*ppos >= bao_ipcshmem->write_size)
+        return 0;
+    if(count > bao_ipcshmem->write_size)
+        count = bao_ipcshmem->write_size;
+    if((*ppos + count) > bao_ipcshmem->write_size)
+        count = bao_ipcshmem->write_size - *ppos;
+
+    missing =
+        copy_from_user(bao_ipcshmem->write_base + *ppos, buf, count);
+    if (missing != 0) count = count - missing;
+    *ppos += count;
+
+    bao_ipcshmem_notify(bao_ipcshmem);
+
+    return count;
+}
+
+static int bao_ipcshmem_open_fops(struct inode *inode, struct file *filp)
+{
+    struct bao_ipcshmem *bao_ipcshmem = container_of(inode->i_cdev,
+                                             struct bao_ipcshmem, cdev);
+    filp->private_data = bao_ipcshmem;
+
+    kobject_get(&bao_ipcshmem->dev->kobj);
+
+    return 0;
+}
+
+static int bao_ipcshmem_release_fops(struct inode *inode, struct file *filp)
+{
+    struct bao_ipcshmem *bao_ipcshmem = container_of(inode->i_cdev,
+                                             struct bao_ipcshmem, cdev);
+    filp->private_data = NULL;
+
+    kobject_put(&bao_ipcshmem->dev->kobj);
+
+    return 0;
+}
+
+static struct file_operations bao_ipcshmem_fops = {
+    .owner = THIS_MODULE,
+    .read = bao_ipcshmem_read_fops,
+    .write = bao_ipcshmem_write_fops,
+    .mmap = bao_ipcshmem_mmap_fops,
+    .open = bao_ipcshmem_open_fops,
+    .release = bao_ipcshmem_release_fops
+};
+
+int bao_ipcshmem_register(struct platform_device *pdev)
+{
+    int ret = 0;
+    struct device *dev = &(pdev->dev);
+    struct device_node *np = dev->of_node;
+    struct module *owner = THIS_MODULE;
+    struct resource *r;
+    dev_t devt;
+	resource_size_t shmem_size;
+    u32 write_offset, read_offset, write_size, read_size;
+    bool rd_in_range, wr_in_range, disjoint;
+    void* shmem_base_addr = NULL;
+    int id = -1;
+    struct bao_ipcshmem *bao;
+
+    r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	if(r == NULL)
+		return -EINVAL;
+    of_property_read_u32_index(np, "read-channel", 0, &read_offset);
+    of_property_read_u32_index(np, "read-channel", 1, &read_size);
+    of_property_read_u32_index(np, "write-channel", 0, &write_offset);
+    of_property_read_u32_index(np, "write-channel", 1, &write_size);
+
+    rd_in_range = (r->start + read_offset + read_size) < r->end;
+    wr_in_range =  (r->start + write_offset + write_size) < r->end;
+    disjoint = ((read_offset + read_size) <= write_offset) ||
+        ((write_offset + write_size) <= read_offset);
+
+    if(!rd_in_range || !wr_in_range || !disjoint) {
+        dev_err(&pdev->dev,"invalid channel layout\n");
+        dev_err(&pdev->dev,"rd_in_range = %d, wr_in_range = %d, disjoint = %d\n",
+            rd_in_range, wr_in_range, disjoint);
+        return -EINVAL;
+    }
+
+    shmem_size = r->end - r->start + 1;
+	shmem_base_addr = memremap(r->start, shmem_size, MEMREMAP_WB);
+	if(shmem_base_addr == NULL)
+		return -ENOMEM;
+
+    of_property_read_u32(np, "id", &id);
+    if (id >= MAX_DEVICES) {
+        dev_err(&pdev->dev,"invalid id %d\n", id);
+        ret = -EINVAL;
+        goto err_unmap;
+    }
+
+    bao = devm_kzalloc(&pdev->dev, sizeof(struct bao_ipcshmem), GFP_KERNEL);
+    if(bao == NULL) {
+        ret = -ENOMEM;
+        goto err_unmap;
+    }
+    snprintf(bao->label, NAME_LEN, "%s%d", DEV_NAME, id);
+    bao->id = id;
+    bao->read_size = read_size;
+    bao->write_size = write_size;
+    bao->read_base = shmem_base_addr + read_offset;
+    bao->write_base = shmem_base_addr + write_offset;
+    bao->physical_base = (void *)r->start;
+    bao->shmem_size = shmem_size;
+
+    cdev_init(&bao->cdev, &bao_ipcshmem_fops);
+    bao->cdev.owner = owner;
+
+    devt = MKDEV(MAJOR(bao_ipcshmem_devt), id);
+    ret = cdev_add(&bao->cdev, devt, 1);
+    if (ret) {
+        goto err_unmap;
+    }
+
+    bao->dev = device_create(cl, &pdev->dev, devt, bao, bao->label);
+    if (IS_ERR(bao->dev)) {
+        ret = PTR_ERR(bao->dev);
+        goto err_cdev;
+    }
+    dev_set_drvdata(bao->dev, bao);
+
+    return 0;
+
+err_cdev:
+    cdev_del(&bao->cdev);
+err_unmap:
+    memunmap(shmem_base_addr);
+
+    dev_err(&pdev->dev,"failed initialization\n");
+    return ret;
+}
+
+static void bao_ipcshmem_unregister(struct platform_device *pdev)
+{
+    /* TODO */
+    return;
+}
+
+static const struct of_device_id of_bao_ipcshmem_match[] = {
+    {
+        .compatible = "bao,ipcshmem",
+    },
+    {/* sentinel */}};
+MODULE_DEVICE_TABLE(of, of_bao_ipcshmem_match);
+
+static struct platform_driver bao_ipcshmem_driver = {
+    .probe = bao_ipcshmem_register,
+    .remove = bao_ipcshmem_unregister,
+    .driver = {
+        .name = DEV_NAME,
+        .of_match_table = of_bao_ipcshmem_match,
+    },
+};
+
+static int __init bao_ipcshmem_init(void)
+{
+    int ret;
+
+    if ((cl = class_create(DEV_NAME)) == NULL) {
+        ret = -1;
+        pr_err("unable to class_create " DEV_NAME " device\n");
+        return ret;
+    }
+
+    ret = alloc_chrdev_region(&bao_ipcshmem_devt, 0, MAX_DEVICES, DEV_NAME);
+    if (ret < 0) {
+        pr_err("unable to alloc_chrdev_region " DEV_NAME " device\n");
+        return ret;
+    }
+
+    return platform_driver_register(&bao_ipcshmem_driver);
+}
+
+static void __exit bao_ipcshmem_exit(void)
+{
+    platform_driver_unregister(&bao_ipcshmem_driver);
+    unregister_chrdev(bao_ipcshmem_devt, DEV_NAME);
+    class_destroy(cl);
+}
+
+module_init(bao_ipcshmem_init);
+module_exit(bao_ipcshmem_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("David Cerdeira");
+MODULE_AUTHOR("José Martins");
+MODULE_DESCRIPTION("bao ipc through shared-memory sample driver");
\ No newline at end of file
diff --git a/drivers/virt/Kconfig b/drivers/virt/Kconfig
index d8c848cf0..33f9f4243 100644
--- a/drivers/virt/Kconfig
+++ b/drivers/virt/Kconfig
@@ -41,6 +41,8 @@ config FSL_HV_MANAGER
           4) A kernel interface for receiving callbacks when a managed
 	     partition shuts down.
 
+source "drivers/virt/bao/Kconfig"
+
 source "drivers/virt/vboxguest/Kconfig"
 
 source "drivers/virt/nitro_enclaves/Kconfig"
diff --git a/drivers/virt/Makefile b/drivers/virt/Makefile
index f29901bd7..f6733a98e 100644
--- a/drivers/virt/Makefile
+++ b/drivers/virt/Makefile
@@ -3,6 +3,7 @@
 # Makefile for drivers that support virtualization
 #
 
+obj-$(CONFIG_BAO_IO_DISPATCHER)	+= bao/
 obj-$(CONFIG_FSL_HV_MANAGER)	+= fsl_hypervisor.o
 obj-$(CONFIG_VMGENID)		+= vmgenid.o
 obj-y				+= vboxguest/
diff --git a/drivers/virt/bao/Kconfig b/drivers/virt/bao/Kconfig
new file mode 100644
index 000000000..b7caa3786
--- /dev/null
+++ b/drivers/virt/bao/Kconfig
@@ -0,0 +1,47 @@
+# SPDX-License-Identifier: GPL-2.0
+config BAO_IO_DISPATCHER
+	tristate "Bao Hypervisor I/O Dispatcher"
+	help
+	  The Bao I/O Dispatcher system is a kernel module that can be loaded
+	  into the Linux kernel of the backend VMs. It is responsible for
+	  establishing the connection between the Remote I/O system and the
+	  Frontend Device Model, offering a unified API to support various
+	  VirtIO backends.
+
+	  To compile as a module, choose M, the module will be called
+	  bao_io_dispatcher. If unsure, say N.
+
+choice
+    prompt "Bao Hypervisor I/O Dispatcher Mode"
+    default BAO_IO_DISPATCHER_INTERRUPT_MODE
+	depends on BAO_IO_DISPATCHER
+    help
+      Choose between interrupt mode and pooling mode.
+
+config BAO_IO_DISPATCHER_INTERRUPT_MODE
+	bool "Interrupt Mode"
+	help
+	  Say Y here to enable the I/O Dispatcher System Interrupt Mode.
+
+	  If you say N, the I/O Dispatcher System will dispatch the I/O requests
+	  on a periodic form, resulting in a potential degradation of
+	  performance.
+
+config BAO_IO_DISPATCHER_POOLING_MODE
+	bool "Pooling Mode"
+	help
+	  Say Y here to enable the I/O Dispatcher System Pooling Mode.
+
+	  If you say N, the I/O Dispatcher System will dispatch the I/O requests
+	  though interrupts, resulting in a potential improvement of
+	  performance.
+
+endchoice
+
+config BAO_IO_DISPATCHER_POOLING_INTERVAL
+	int "Interval in nanoseconds"
+	default 1000000
+	depends on BAO_IO_DISPATCHER
+	depends on BAO_IO_DISPATCHER_POOLING_MODE
+	help
+      Set the interval in nanoseconds for the pooling mode. Adjust this value according to your needs.
\ No newline at end of file
diff --git a/drivers/virt/bao/Makefile b/drivers/virt/bao/Makefile
new file mode 100644
index 000000000..caeef8fdd
--- /dev/null
+++ b/drivers/virt/bao/Makefile
@@ -0,0 +1,3 @@
+# SPDX-License-Identifier: GPL-2.0
+obj-$(CONFIG_BAO_IO_DISPATCHER) := bao.o
+bao-y := ioctls.o ioeventfd.o io_client.o io_dispatcher.o irqfd.o dm.o intc.o driver.o
\ No newline at end of file
diff --git a/drivers/virt/bao/bao_drv.h b/drivers/virt/bao/bao_drv.h
new file mode 100644
index 000000000..4f78965df
--- /dev/null
+++ b/drivers/virt/bao/bao_drv.h
@@ -0,0 +1,369 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Provides some definitions for the Bao Hypervisor modules
+ *
+ * Copyright (c) Bao Project and Contributors. All rights reserved.
+ *
+ * Authors:
+ *	João Peixoto <joaopeixotooficial@gmail.com>
+ */
+
+#ifndef __BAO_DRV_H
+#define __BAO_DRV_H
+
+#include <linux/bao.h>
+#include <linux/types.h>
+#include <linux/spinlock.h>
+#include <linux/wait.h>
+#include <linux/mutex.h>
+#include <linux/fs.h>
+#include <linux/file.h>
+#include <linux/interrupt.h>
+#include <linux/cdev.h>
+#include <linux/device.h>
+
+#define BAO_IOEVENTFD_FLAG_DATAMATCH (1 << 1)
+#define BAO_IOEVENTFD_FLAG_DEASSIGN (1 << 2)
+#define BAO_IRQFD_FLAG_DEASSIGN 1U
+
+#define BAO_IO_CLIENT_DESTROYING 0U
+
+#define BAO_DM_FLAG_DESTROYING 0U
+#define BAO_DM_FLAG_CLEARING_IOREQ 1U
+
+struct bao_dm;
+struct bao_io_client;
+
+typedef int (*bao_io_client_handler_t)(struct bao_io_client *client,
+			    struct bao_virtio_request *req);
+
+/**
+ * Bao I/O client
+ * @name: Client name
+ * @dm:	The DM that the client belongs to
+ * @list: List node for this bao_io_client
+ * @is_control:	If this client is the control client
+ * @flags: Flags (BAO_IO_CLIENT_*)
+ * @virtio_requests: Array of all I/O requests that are free to process
+ * @virtio_requests_lock: Lock to protect virtio_requests list
+ * @range_list:	I/O ranges
+ * @range_lock:	Semaphore to protect range_list
+ * @handler: I/O requests handler of this client
+ * @thread:	The thread which executes the handler
+ * @wq:	The wait queue for the handler thread parking
+ * @priv: Data for the thread
+ */
+struct bao_io_client {
+	char name[BAO_NAME_MAX_LEN];
+	struct bao_dm *dm;
+	struct list_head list;
+	bool is_control;
+	unsigned long flags;
+	struct list_head virtio_requests;
+	struct mutex virtio_requests_lock;
+	struct list_head range_list;
+	struct rw_semaphore range_lock;
+	bao_io_client_handler_t handler;
+	struct task_struct *thread;
+	wait_queue_head_t wq;
+	void *priv;
+};
+
+/**
+ * Bao backend device model (DM)
+ * @list: Entry within global list of all DMs
+ * @info: DM information (id, shmem_addr, shmem_size, irq, fd)
+ * @shmem_base_addr: The base address of the shared memory (only used for unmapping purposes)
+ * @flags: Flags (BAO_IO_DISPATCHER_DM_*)
+ * @ioeventfds: List to link all bao_ioeventfd
+ * @ioeventfds_lock: Lock to protect ioeventfds list
+ * @ioeventfd_client: Ioevenfd client
+ * @irqfds: List to link all bao_irqfd
+ * @irqfds_lock: Lock to protect irqfds list
+ * @irqfd_server: Irqfd server
+ * @io_clients_lock: Semaphore to protect io_clients
+ * @io_clients:	List to link all bao_io_client
+ * @control_client:	Control client
+ */
+struct bao_dm {
+	struct list_head list;
+	struct bao_dm_info info;
+	void *shmem_base_addr;
+	unsigned long flags;
+	struct list_head ioeventfds;
+	struct mutex ioeventfds_lock;
+	struct bao_io_client *ioeventfd_client;
+	struct list_head irqfds;
+	struct mutex irqfds_lock;
+	struct workqueue_struct *irqfd_server;
+	struct rw_semaphore io_clients_lock;
+	struct list_head io_clients;
+	struct bao_io_client *control_client;
+};
+
+/**
+ * Bao I/O request range
+ * @list: List node for this range
+ * @start: The start address of the range
+ * @end: The end address of the range
+ *
+ */
+struct bao_io_range {
+	struct list_head list;
+	u64 start;
+	u64 end;
+};
+
+extern struct list_head bao_dm_list;
+extern rwlock_t bao_dm_list_lock;
+
+/************************************************************************************************************/
+/*                                    Backend Device Model (DM) API                                         */
+/************************************************************************************************************/
+
+/**
+ * Create the backend DM
+ * @info: The DM information (id, shmem_addr, shmem_size, irq, fd)
+ * @return dm on success, NULL on error
+ */
+struct bao_dm* bao_dm_create(struct bao_dm_info *info);
+
+/**
+ * Destroy the backend DM
+ * @dm: The DM to be destroyed
+ */
+void bao_dm_destroy(struct bao_dm *dm);
+
+/**
+ * Get the DM information
+ * @info: The DM information to be filled (id field contains the DM ID)
+ * @return true on success, false on error
+ */
+bool bao_dm_get_info(struct bao_dm_info *info);
+
+/**
+ * DM ioctls handler
+ * @filp: The open file pointer
+ * @cmd: The ioctl command
+ * @ioctl_param: The ioctl parameter
+ */
+long bao_dm_ioctl(struct file *filp, unsigned int cmd,
+		  unsigned long ioctl_param);
+
+/************************************************************************************************************/
+/*                                             I/O Clients API                                              */
+/************************************************************************************************************/
+
+/**
+ * Create an I/O client
+ * @dm:	The DM that this client belongs to
+ * @handler: The I/O client handler for the I/O requests
+ * @data: Private data for the handler
+ * @is_control:	If it is the control client
+ * @name: The name of I/O client
+ */
+struct bao_io_client *
+bao_io_client_create(struct bao_dm *dm, bao_io_client_handler_t handler,
+				void *data, bool is_control, const char *name);
+
+/**
+ * Destroy the I/O clients of the DM
+ * @dm: The DM that the I/O clients belong to
+ */
+void bao_io_clients_destroy(struct bao_dm *dm);
+
+/**
+ * Attach the thread to the I/O client to wait for I/O requests
+ * @client: The I/O client to handle the I/O request
+ */
+int bao_io_client_attach(struct bao_io_client *client);
+
+/**
+ * Add an I/O range monitor into an I/O client
+ * @client: The I/O client that the range will be added
+ * @start: The start address of the range
+ * @end: The end address of the range
+ */
+int bao_io_client_range_add(struct bao_io_client *client, u64 start,
+				u64 end);
+
+/**
+ * Delete an I/O range monitor from an I/O client
+ * @client: The I/O client that the range will be deleted
+ * @start: The start address of the range
+ * @end: The end address of the range
+ */
+void bao_io_client_range_del(struct bao_io_client *client, u64 start,
+				 u64 end);
+
+/**
+ * Retrieve the oldest I/O request from the I/O client
+ * @client: The I/O client
+ * @req: The virtio request to be retrieved
+ */
+int bao_io_client_request(struct bao_io_client *client,
+			      struct bao_virtio_request *req);
+
+/**
+ * Push an I/O request into the I/O client request list
+ * @client: The I/O Client that the I/O request belongs to
+ * @req: The I/O request to be pushed
+ */
+void bao_io_client_push_request(struct bao_io_client *client, 
+						struct bao_virtio_request *req);
+
+/**
+ * Pop an I/O request from the I/O client request list
+ * @client: The I/O client that the I/O request belongs to
+ * @return The I/O request
+ */
+struct bao_virtio_request bao_io_client_pop_request(struct bao_io_client *client);
+
+/**
+ * Find the I/O client that the I/O request belongs to
+ * @dm: The DM that the I/O request belongs to
+ * @req: The I/O request
+ * @return The I/O client that the I/O request belongs to, or NULL if there is no client
+ */
+struct bao_io_client *bao_io_client_find(struct bao_dm *dm, struct bao_virtio_request *req);
+
+/************************************************************************************************************/
+/*                                        Ioeventfd Client API                                              */
+/************************************************************************************************************/
+
+/**
+ * Initialize the Ioeventfd client
+ * @dm: The DM that the Ioeventfd client belongs to
+ */
+int bao_ioeventfd_client_init(struct bao_dm *dm);
+
+/**
+ * Destroy the Ioeventfd client
+ * @dm: The DM that the Ioeventfd client belongs to
+ */
+void bao_ioeventfd_client_destroy(struct bao_dm *dm);
+
+/**
+ * Configure the Ioeventfd client
+ * @dm: The DM that the Ioeventfd client belongs to
+ * @config: The ioeventfd configuration
+ */
+int bao_ioeventfd_client_config(struct bao_dm *dm,
+			 struct bao_ioeventfd *config);
+
+/************************************************************************************************************/
+/*                                           Irqfd Server API                                               */
+/************************************************************************************************************/
+
+/**
+ * Initialize the Irqfd server
+ * @dm: The DM that the Irqfd server belongs to
+ */
+int bao_irqfd_server_init(struct bao_dm *dm);
+
+/**
+ * Destroy the Irqfd server
+ * @dm: The DM that the Irqfd server belongs to
+ */
+void bao_irqfd_server_destroy(struct bao_dm *dm);
+
+/**
+ * Configure the Irqfd server
+ * @dm: The DM that the Irqfd server belongs to
+ * @config: The irqfd configuration
+ */
+int bao_irqfd_server_config(struct bao_dm *dm, struct bao_irqfd *config);
+
+/************************************************************************************************************/
+/*                                         I/O Dispatcher API                                               */
+/************************************************************************************************************/
+
+/**
+ * Initialize the I/O Dispatcher
+ * @dm: The DM to be initialized on the I/O Dispatcher
+ */
+int bao_io_dispatcher_init(struct bao_dm *dm);
+
+/**
+ * Destroy the I/O Dispatcher
+ * @dm: The DM to be destroyed on the I/O Dispatcher
+ */
+void bao_io_dispatcher_destroy(struct bao_dm *dm);
+
+/**
+ * Setup the I/O Dispatcher
+ */
+int bao_io_dispatcher_setup(void);
+
+/**
+ * Remove the I/O Dispatcher
+ */
+void bao_io_dispatcher_remove(void);
+
+/**
+ * Acquires the I/O requests from the Bao Hypervisor and dispatches them to the respective I/O client
+ * @dm: The DM that the I/O clients belongs to
+ * @return: 0 on success, <0 on failure
+ */
+int bao_dispatch_io(struct bao_dm *dm);
+
+/**
+ * Pause the I/O Dispatcher
+ * @dm: The DM that will be paused
+ */
+void bao_io_dispatcher_pause(struct bao_dm *dm);
+
+/**
+ * Resume the I/O Dispatcher
+ * @dm: The DM that will be resumed
+ */
+void bao_io_dispatcher_resume(struct bao_dm *dm);
+
+/**
+ * Issue a Remote I/O Hypercall
+ * @req: The I/O request information (hypercall input and output data)
+ * @return >=0 on success, <0 on failure
+ */
+int bao_io_dispatcher_remio_hypercall(struct bao_virtio_request *req);
+
+/************************************************************************************************************/
+/*                                      Interrupt Controller API                                            */
+/************************************************************************************************************/
+
+/**
+ * Register the interrupt controller
+ * @dm: The DM that the interrupt controller belongs to
+ */
+int bao_intc_register(struct bao_dm *dm);
+
+/**
+ * Unregister the interrupt controller
+ * @dm: The DM that the interrupt controller belongs to
+ */
+void bao_intc_unregister(struct bao_dm *dm);
+
+/**
+ * Setup the interrupt controller handler
+ * @handler: The interrupt handler
+ * @dm: The DM that the interrupt controller belongs to
+ */
+void bao_intc_setup_handler(void (*handler)(struct bao_dm *dm));
+
+/**
+ * Remove the interrupt controller handler
+ */
+void bao_intc_remove_handler(void);
+
+/************************************************************************************************************/
+/*                                    			Driver API                                                  */
+/************************************************************************************************************/
+
+/**
+ * I/O Dispatcher kernel module ioctls handler
+ * @filp: The open file pointer
+ * @cmd: The ioctl command
+ * @ioctl_param: The ioctl parameter
+ */
+long bao_io_dispatcher_driver_ioctl(struct file *filp, unsigned int cmd, unsigned long ioctl_param);
+
+#endif /* __BAO_DRV_H */
\ No newline at end of file
diff --git a/drivers/virt/bao/dm.c b/drivers/virt/bao/dm.c
new file mode 100644
index 000000000..90299c722
--- /dev/null
+++ b/drivers/virt/bao/dm.c
@@ -0,0 +1,267 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Bao Hypervisor Backend Device Model (DM)
+ *
+ * Copyright (c) Bao Project and Contributors. All rights reserved.
+ *
+ * Authors:
+ *	João Peixoto <joaopeixotooficial@gmail.com>
+ */
+
+#include "bao_drv.h"
+#include <linux/io.h>
+#include <linux/module.h>
+#include <linux/mm.h>
+#include <linux/slab.h>
+#include <linux/device.h>
+#include <linux/anon_inodes.h>
+#include <linux/miscdevice.h>
+#include "hypercall.h"
+
+/* List of all Backend DMs */
+LIST_HEAD(bao_dm_list);
+
+/*
+ * bao_dm_list is read in a worker thread which dispatch I/O requests and
+ * is wrote in DM creation ioctl. This rwlock mechanism is used to protect it.
+ */
+DEFINE_RWLOCK(bao_dm_list_lock);
+
+static int bao_dm_open(struct inode *inode, struct file *filp)
+{
+	return 0;
+}
+
+static int bao_dm_release(struct inode *inode, struct file *filp)
+{
+	struct bao_dm *dm = filp->private_data;
+	kfree(dm);
+	return 0;
+}
+
+/**
+ * @brief IOCTL handler for the backend DM mmap operation
+ * @note This function is used to map the previosuly allocated kernel memory region
+ * of the backend DM to the userspace virtual address space
+ * @filp: The file pointer of the DM
+ * @vma: Contains the information about the virtual address range that is used to access
+ * @return: 0 on success, <0 on failure
+ */
+static int bao_dm_mmap(struct file *filp, struct vm_area_struct *vma)
+{
+	struct bao_dm *dm = filp->private_data;
+
+    unsigned long vsize = vma->vm_end - vma->vm_start;
+
+    if (remap_pfn_range(vma, vma->vm_start, dm->info.shmem_addr >> PAGE_SHIFT, vsize, vma->vm_page_prot)) {
+        return -EFAULT;
+    }
+
+    return 0;
+}
+
+/**
+ * @brief IOCTL handler for the backend DM llseek operation
+ * @file: The file pointer of the DM
+ * @offset: The offset to seek
+ * @whence: The seek operation
+ * @return: >=0 on success, <0 on failure
+ */
+static loff_t bao_dm_llseek(struct file *file, loff_t offset, int whence)
+{
+    struct bao_dm *bao = file->private_data;
+    loff_t new_pos;
+
+    switch (whence) {
+    case SEEK_SET:
+        new_pos = offset;
+        break;
+    case SEEK_CUR:
+        new_pos = file->f_pos + offset;
+        break;
+    case SEEK_END:
+        new_pos = bao->info.shmem_addr + bao->info.shmem_size + offset;
+        break;
+    default:
+        return -EINVAL;
+    }
+
+    // Ensure new_pos is within the valid range of the total shared memory
+    if (new_pos < 0 || (new_pos > (bao->info.shmem_addr + bao->info.shmem_size + offset)))
+        return -EINVAL;
+
+    file->f_pos = new_pos;
+
+    return new_pos;
+}
+
+static struct file_operations bao_dm_fops = {
+	.owner = THIS_MODULE,
+	.open = bao_dm_open,
+	.release = bao_dm_release,
+	.unlocked_ioctl = bao_dm_ioctl,
+	.llseek = bao_dm_llseek,
+	.mmap = bao_dm_mmap,
+};
+
+struct bao_dm* bao_dm_create(struct bao_dm_info *info)
+{
+	struct bao_dm *dm;
+	char name[BAO_NAME_MAX_LEN];
+
+	// verify if already exists a DM with the same virtual ID
+	read_lock(&bao_dm_list_lock);
+	list_for_each_entry(dm, &bao_dm_list, list) {
+		if (dm->info.id == info->id) {
+			read_unlock(&bao_dm_list_lock);
+			return NULL;
+		}
+	}
+	read_unlock(&bao_dm_list_lock);
+
+	// allocate memory for the DM
+	dm = kzalloc(sizeof(struct bao_dm), GFP_KERNEL);
+	if (!dm) {
+		pr_err("%s: kzalloc failed\n", __FUNCTION__);
+		return NULL;
+	}
+
+	// initialize the DM structure
+	INIT_LIST_HEAD(&dm->io_clients);
+	init_rwsem(&dm->io_clients_lock);
+
+	// set the DM fields
+	dm->info = *info;
+
+	// initialize the I/O request client
+	bao_io_dispatcher_init(dm);
+
+	// add the DM to the list
+	write_lock_bh(&bao_dm_list_lock);
+	list_add(&dm->list, &bao_dm_list);
+	write_unlock_bh(&bao_dm_list_lock);
+
+	// create the Control client
+	snprintf(name, sizeof(name), "bao-ioctlc%u", dm->info.id);
+	dm->control_client = bao_io_client_create(dm, NULL, NULL, true, name);
+
+	// initialize the Ioeventfd client
+	bao_ioeventfd_client_init(dm);
+
+	// initialize the Irqfd server
+	bao_irqfd_server_init(dm);
+
+	// map the memory region to the kernel virtual address space
+	dm->shmem_base_addr = memremap(dm->info.shmem_addr, dm->info.shmem_size, MEMREMAP_WB);
+	if (dm->shmem_base_addr == NULL) {
+		pr_err("%s: failed to map memory region for dm %d\n", __FUNCTION__, dm->info.id);
+		return NULL;
+	}
+
+	return dm;
+}
+
+void bao_dm_destroy(struct bao_dm *dm)
+{
+	// mark as destroying
+	set_bit(BAO_DM_FLAG_DESTROYING, &dm->flags);
+
+	// remove the DM from the list
+	write_lock_bh(&bao_dm_list_lock);
+	list_del_init(&dm->list);
+	write_unlock_bh(&bao_dm_list_lock);
+
+	// clear the global fields
+	dm->info.id = 0;
+	dm->info.shmem_addr = 0;
+	dm->info.shmem_size = 0;
+	dm->info.irq = 0;
+
+	// unmap the memory region
+	memunmap(dm->shmem_base_addr);
+
+	// release the DM file descriptor
+	put_unused_fd(dm->info.fd);
+
+	// destroy the Irqfd server
+	bao_irqfd_server_destroy(dm);
+
+	// destroy the I/O clients
+	bao_io_clients_destroy(dm);
+
+	// destroy the I/O dispatcher
+	bao_io_dispatcher_destroy(dm);
+
+	// clear the destroying flag
+	clear_bit(BAO_DM_FLAG_DESTROYING, &dm->flags);
+
+	// free the DM
+	kfree(dm);
+}
+
+/**
+ * Create an anonymous inode for the DM abstraction
+ * @note: The anonymous inode is used to expose the DM to userspace
+ * 	  	  and allow the frontend DM to request services from the backend DM
+ * 	      directly through the file descriptor
+ *        This function should be called after the DM is created and invoked
+ * 		  by the frontend DM (userspace process) to create the anonymous inode 
+ * 		  inside the process file descriptor table
+ * @dm: The DM to create the anonymous inode
+ * @return: >=0 on success, <0 on failure
+ */
+static int bao_dm_create_anonymous_inode(struct bao_dm *dm)
+{
+	char name[BAO_NAME_MAX_LEN];
+	struct file *file;
+	int rc = 0;
+
+	// create a new file descriptor for the DM
+	rc = get_unused_fd_flags(O_CLOEXEC);
+	if (rc < 0) {
+		pr_err("%s: get_unused_fd_flags failed\n", __FUNCTION__);
+		return rc;
+	}
+
+	// create a name for the DM file descriptor
+	snprintf(name, sizeof(name), "bao-dm%u", dm->info.id);
+
+	// create a new anonymous inode for the DM abstraction
+	// the `bao_dm_fops` defines the behavior of this "file" and
+	// the `dm` is the private data
+	file = anon_inode_getfile(name, &bao_dm_fops, dm, O_RDWR);
+	if (IS_ERR(file)) {
+		pr_err("%s: anon_inode_getfile failed\n", __FUNCTION__);
+		put_unused_fd(rc);
+		return rc;
+	}
+
+	// associate the file descriptor `rc` with the struct file object `file`
+	// in the file descriptor table of the current process
+	// (expose the file descriptor `rc` to userspace)
+	fd_install(rc, file);
+
+	// update the DM file descriptor
+	dm->info.fd = rc;
+
+	return rc;
+}
+
+bool bao_dm_get_info(struct bao_dm_info *info)
+{
+	struct bao_dm *dm;
+	bool rc = false;
+
+	list_for_each_entry(dm, &bao_dm_list, list) {
+		if (dm->info.id == info->id) {
+			info->shmem_addr = dm->info.shmem_addr;
+			info->shmem_size = dm->info.shmem_size;
+			info->irq = dm->info.irq;
+			info->fd = bao_dm_create_anonymous_inode(dm);
+			rc = true;
+			break;
+		}
+	}
+
+	return rc;
+}
\ No newline at end of file
diff --git a/drivers/virt/bao/driver.c b/drivers/virt/bao/driver.c
new file mode 100644
index 000000000..c99742778
--- /dev/null
+++ b/drivers/virt/bao/driver.c
@@ -0,0 +1,262 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Bao Hypervisor I/O Dispatcher Kernel Driver
+ *
+ * Copyright (c) Bao Project and Contributors. All rights reserved.
+ *
+ * Authors:
+ *	João Peixoto <joaopeixotooficial@gmail.com>
+ */
+
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/of_irq.h>
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/uaccess.h>
+#include <linux/fs.h>
+#include <linux/io.h>
+#include <linux/ioport.h>
+#include <asm/io.h>
+#include <linux/mutex.h>
+#include <linux/poll.h>
+#include <linux/cdev.h>
+#include <linux/device.h>
+#include <linux/spinlock.h>
+#include <linux/wait.h>
+#include <linux/mm.h>
+#include "bao_drv.h"
+
+#define DEV_NAME "bao-io-dispatcher"
+
+static dev_t bao_iodispatcher_devt;
+struct class *bao_iodispatcher_cl;
+
+/**
+ * Bao I/O Dispatcher driver structure
+ * @cdev: The character device
+ * @dev: The device
+ */
+struct bao_iodispatcher_drv
+{
+    struct cdev cdev;
+    struct device *dev;
+};
+
+/**
+ * Open the I/O Dispatcher device
+ * @inode: The inode of the I/O Dispatcher
+ * @filp: The file pointer of the I/O Dispatcher
+ */
+static int bao_io_dispatcher_driver_open_fops(struct inode *inode, struct file *filp)
+{
+	struct bao_iodispatcher_drv *bao_iodispatcher_drv = container_of(inode->i_cdev, struct bao_iodispatcher_drv, cdev);
+    filp->private_data = bao_iodispatcher_drv;
+
+    kobject_get(&bao_iodispatcher_drv->dev->kobj);
+
+    return 0;
+}
+
+/**
+ * Release the I/O Dispatcher device
+ * @inode: The inode of the I/O Dispatcher
+ * @filp: The file pointer of the I/O Dispatcher
+ */
+static int bao_io_dispatcher_driver_release_fops(struct inode *inode, struct file *filp)
+{
+	struct bao_iodispatcher_drv *bao_iodispatcher_drv = container_of(inode->i_cdev, struct bao_iodispatcher_drv, cdev);
+    filp->private_data = NULL;
+
+    kobject_put(&bao_iodispatcher_drv->dev->kobj);
+
+    return 0;
+}
+
+static long bao_io_dispatcher_driver_ioctl_fops(struct file *filp, unsigned int cmd, unsigned long ioctl_param)
+{
+	return bao_io_dispatcher_driver_ioctl(filp, cmd, ioctl_param);
+}
+
+static struct file_operations bao_io_dispatcher_driver_fops = {
+    .owner = THIS_MODULE,
+	.open = bao_io_dispatcher_driver_open_fops,
+    .release = bao_io_dispatcher_driver_release_fops,
+	.unlocked_ioctl = bao_io_dispatcher_driver_ioctl_fops,
+};
+
+/**
+ * Register the driver with the kernel
+ * @pdev: Platform device pointer
+ */
+static int bao_io_dispatcher_driver_register(struct platform_device *pdev)
+{
+	int ret, irq;
+	struct module *owner = THIS_MODULE;
+    struct resource *r;
+	dev_t devt;
+	resource_size_t reg_size;
+	struct bao_iodispatcher_drv *bao_io_dispatcher_drv;
+	struct bao_dm *dm;
+	struct bao_dm_info dm_info;
+
+	// setup the I/O Dispatcher system
+	ret = bao_io_dispatcher_setup();
+	if (ret) {
+		dev_err(&pdev->dev, "setup I/O Dispatcher failed!\n");
+		return ret;
+	}
+
+	// allocate memory for the Bao I/O Dispatcher structure
+	bao_io_dispatcher_drv = devm_kzalloc(&pdev->dev, sizeof(struct bao_iodispatcher_drv), GFP_KERNEL);
+	
+	if(bao_io_dispatcher_drv == NULL) {
+		ret = -ENOMEM;
+		goto err_io_dispatcher;
+	}
+
+	for (int i = 0; i < BAO_IO_MAX_DMS; i++) {
+		// get the memory region from the device tree
+		r = platform_get_resource(pdev, IORESOURCE_MEM, i);
+		if (!r)
+			break;
+		
+		// get the interrupt number from the device tree
+		irq = platform_get_irq(pdev, i);
+		if (irq < 0) {
+			dev_err(&pdev->dev, "Failed to read interrupt number at index %d\n", i);
+			ret = irq;
+			goto err_io_dispatcher;
+		}
+
+		// get the memory region size
+		reg_size = resource_size(r);
+
+		// set the device model information
+		dm_info.id = i;
+		dm_info.shmem_addr = (unsigned long)r->start;
+		dm_info.shmem_size = (unsigned long)reg_size;
+		dm_info.irq = irq;
+		dm_info.fd = 0;
+
+		// create the device model
+		dm = bao_dm_create(&dm_info);
+		if (dm == NULL) {
+			dev_err(&pdev->dev, "failed to create Bao I/O Dispatcher device model %d\n", i);
+			ret = -ENOMEM;
+			goto err_io_dispatcher;
+		}
+
+		// register the interrupt
+		ret = bao_intc_register(dm);
+		if (ret) {
+			dev_err(&pdev->dev, "failed to register interrupt %d\n", irq);
+			goto err_unregister_dms;
+		}
+	}
+
+	cdev_init(&bao_io_dispatcher_drv->cdev, &bao_io_dispatcher_driver_fops);
+	bao_io_dispatcher_drv->cdev.owner = owner;
+
+	devt = MKDEV(MAJOR(bao_iodispatcher_devt), 0);
+	ret = cdev_add(&bao_io_dispatcher_drv->cdev, devt, 1);
+	if (ret) {
+		goto err_unregister_irqs;
+	}
+
+	bao_io_dispatcher_drv->dev = device_create(bao_iodispatcher_cl, &pdev->dev, devt, bao_io_dispatcher_drv, DEV_NAME);
+	if (IS_ERR(bao_io_dispatcher_drv->dev)) {
+		ret = PTR_ERR(bao_io_dispatcher_drv->dev);
+		goto err_cdev;
+	}
+	dev_set_drvdata(bao_io_dispatcher_drv->dev, bao_io_dispatcher_drv);
+
+	return 0;
+
+err_cdev:
+	cdev_del(&bao_io_dispatcher_drv->cdev);
+err_unregister_irqs: {
+	list_for_each_entry(dm, &bao_dm_list, list) {
+		bao_intc_unregister(dm);
+	}
+}
+err_unregister_dms: {
+	list_for_each_entry(dm, &bao_dm_list, list) {
+		bao_dm_destroy(dm);
+	}
+}
+err_io_dispatcher:
+	bao_io_dispatcher_remove();
+
+	dev_err(&pdev->dev,"failed initialization\n");
+	return ret;
+}
+
+/**
+ * Unregister the driver from the kernel
+ * @pdev: Platform device pointer
+ */
+static void bao_io_dispatcher_driver_unregister(struct platform_device *pdev)
+{
+	struct bao_dm *dm;
+
+	// remove the I/O Dispatcher system
+	bao_io_dispatcher_remove();
+
+	list_for_each_entry(dm, &bao_dm_list, list) {
+		// destroy the device model
+		bao_dm_destroy(dm);
+		// unregister the interrupt
+		bao_intc_unregister(dm);
+	}
+}
+
+static const struct of_device_id bao_io_dispatcher_driver_dt_ids[] = {
+	{ .compatible = "bao,io-dispatcher" },
+	{ /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(of, bao_io_dispatcher_driver_dt_ids);
+
+static struct platform_driver bao_io_dispatcher_driver = {
+    .probe = bao_io_dispatcher_driver_register,
+    .remove = bao_io_dispatcher_driver_unregister,
+    .driver = {
+        .name = "bao-io-dispatcher",
+        .of_match_table = of_match_ptr(bao_io_dispatcher_driver_dt_ids),
+        .owner = THIS_MODULE,
+    },
+};
+
+static int __init bao_io_dispatcher_driver_init(void)
+{
+    int ret;
+
+    if ((bao_iodispatcher_cl = class_create(DEV_NAME)) == NULL) {
+        ret = -1;
+        pr_err("unable to class_create " DEV_NAME " device\n");
+        return ret;
+    }
+
+    ret = alloc_chrdev_region(&bao_iodispatcher_devt, 0, BAO_IO_MAX_DMS, DEV_NAME);
+    if (ret < 0) {
+        pr_err("unable to alloc_chrdev_region " DEV_NAME " device\n");
+        return ret;
+    }
+
+    return platform_driver_register(&bao_io_dispatcher_driver);
+}
+
+static void __exit bao_io_dispatcher_driver_exit(void)
+{
+    platform_driver_unregister(&bao_io_dispatcher_driver);
+    unregister_chrdev(bao_iodispatcher_devt, DEV_NAME);
+    class_destroy(bao_iodispatcher_cl);
+}
+
+module_init(bao_io_dispatcher_driver_init);
+module_exit(bao_io_dispatcher_driver_exit);
+
+MODULE_AUTHOR("João Peixoto <joaopeixotooficial@gmail.com>");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Bao Hypervisor I/O Dispatcher Kernel Driver");
diff --git a/drivers/virt/bao/hypercall.h b/drivers/virt/bao/hypercall.h
new file mode 100644
index 000000000..a7e9219f3
--- /dev/null
+++ b/drivers/virt/bao/hypercall.h
@@ -0,0 +1,39 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Hypercall API for Bao Hypervisor
+ *
+ * Copyright (c) Bao Project and Contributors. All rights reserved.
+ *
+ * Authors:
+ *	João Peixoto <joaopeixotooficial@gmail.com>
+ */
+
+#ifndef __BAO_HYPERCALL_H
+#define __BAO_HYPERCALL_H
+
+#include <asm/bao.h>
+#include <linux/bao.h>
+
+/* Remote I/O Hypercall ID */
+#define REMIO_HC_ID 0x2
+
+/**
+ * bao_hypercall_remio() - Performs a Remote I/O Hypercall
+ * @dm_id:	Device Model ID
+ * @addr: Access address
+ * @op:		Write, Read, Ask or Notify operation
+ * @value:	Value to write or read
+ * @cpu_id:	Frontend CPU ID of the I/O request
+ * @vcpu_id:	Frontend vCPU ID of the I/O request
+ *
+ * @return: The VirtIO request structure
+ */
+static inline struct bao_virtio_request
+bao_hypercall_remio(u64 dm_id, u64 addr, u64 op, u64 value, u64 cpu_id,
+		     u64 vcpu_id)
+{
+	return asm_bao_hypercall_remio(REMIO_HC_ID, dm_id, addr, op,
+					value, cpu_id, vcpu_id);
+}
+
+#endif /* __BAO_HYPERCALL_H */
\ No newline at end of file
diff --git a/drivers/virt/bao/intc.c b/drivers/virt/bao/intc.c
new file mode 100644
index 000000000..74c44db37
--- /dev/null
+++ b/drivers/virt/bao/intc.c
@@ -0,0 +1,52 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Bao Hypervisor I/O Dispatcher Interrupt Controller
+ *
+ * Copyright (c) Bao Project and Contributors. All rights reserved.
+ *
+ * Authors:
+ *	João Peixoto <joaopeixotooficial@gmail.com>
+ */
+
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/interrupt.h>
+#include <linux/of_irq.h>
+#include "bao_drv.h"
+
+// handler for the interrupt
+static void (*bao_intc_handler)(struct bao_dm *dm);
+
+static irqreturn_t bao_interrupt_handler(int irq, void *dev)
+{
+	struct bao_dm *dm = (struct bao_dm *)dev;
+
+	// if the handler is set, call it
+	if (bao_intc_handler)
+		bao_intc_handler(dm);
+
+	return IRQ_HANDLED;
+}
+
+void bao_intc_setup_handler(void (*handler)(struct bao_dm *dm))
+{
+	bao_intc_handler = handler;
+}
+
+void bao_intc_remove_handler(void)
+{
+	bao_intc_handler = NULL;
+}
+
+int bao_intc_register(struct bao_dm *dm)
+{
+    char name[BAO_NAME_MAX_LEN];
+    snprintf(name, BAO_NAME_MAX_LEN, "bao-iodintc%d", dm->info.id);
+	return request_irq(dm->info.irq, bao_interrupt_handler, 0, name, dm);
+}
+
+void bao_intc_unregister(struct bao_dm *dm)
+{
+    free_irq(dm->info.irq, dm);
+}
\ No newline at end of file
diff --git a/drivers/virt/bao/io_client.c b/drivers/virt/bao/io_client.c
new file mode 100644
index 000000000..1f18c061f
--- /dev/null
+++ b/drivers/virt/bao/io_client.c
@@ -0,0 +1,379 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Bao Hypervisor I/O Client
+ *
+ * Copyright (c) Bao Project and Contributors. All rights reserved.
+ *
+ * Authors:
+ *	João Peixoto <joaopeixotooficial@gmail.com>
+ */
+
+#include "bao_drv.h"
+#include <linux/slab.h>
+#include <linux/kthread.h>
+#include <linux/io.h>
+
+/**
+ * Contains the specific parameters of a Bao I/O request
+ * @list: List node for this request
+ * @virtio_request: The I/O request
+*/
+struct bao_io_request {
+	struct list_head list;
+	struct bao_virtio_request virtio_request;
+};
+
+/**
+ * Check if there are pending requests
+ * @client: The I/O client
+ * @return: True if there are pending requests, false otherwise
+*/
+static inline bool bao_io_client_has_pending_requests(struct bao_io_client *client)
+{
+    return !list_empty(&client->virtio_requests);
+}
+
+/**
+ * Check if the I/O client is being destroyed
+ * @client: The I/O client
+ * @return: bool
+*/
+static inline bool bao_io_client_is_destroying(struct bao_io_client *client)
+{
+	return test_bit(BAO_IO_CLIENT_DESTROYING, &client->flags);
+}
+
+void bao_io_client_push_request(struct bao_io_client *client,
+				struct bao_virtio_request *req)
+{
+    struct bao_io_request *io_req;
+
+    // allocate the I/O request object
+    io_req = kzalloc(sizeof(*io_req), GFP_KERNEL);
+
+    // copy the request to the I/O request object
+    io_req->virtio_request = *req;
+
+	// add the request to the end of the requests list
+	mutex_lock(&client->virtio_requests_lock);
+	list_add_tail(&io_req->list, &client->virtio_requests);
+	mutex_unlock(&client->virtio_requests_lock);
+}
+
+struct bao_virtio_request bao_io_client_pop_request(struct bao_io_client *client)
+{
+	struct bao_io_request *req;
+    struct bao_virtio_request ret;
+
+    // initialize the return value with an error
+    ret.ret = -EINVAL;
+
+	// pop the first request from the list
+	mutex_lock(&client->virtio_requests_lock);
+	req = list_first_entry_or_null(&client->virtio_requests,
+				       struct bao_io_request, list);
+	mutex_unlock(&client->virtio_requests_lock);
+
+	if (req == NULL) {
+		return ret;
+	}
+
+	// copy the request to the return value
+	ret = req->virtio_request;
+
+	// delete the request from the list
+	mutex_lock(&client->virtio_requests_lock);
+	list_del(&req->list);
+	mutex_unlock(&client->virtio_requests_lock);
+
+	// free the request
+	kfree(req);
+
+	return ret;
+}
+
+/**
+ * Destroy an I/O client
+ * @client: The I/O client to be destroyed
+ */
+static void bao_io_client_destroy(struct bao_io_client *client)
+{
+	struct bao_io_client *range, *next;
+	struct bao_dm *dm = client->dm;
+
+	// pause the I/O requests dispatcher
+	bao_io_dispatcher_pause(dm);
+
+	// set the destroying flag
+	set_bit(BAO_IO_CLIENT_DESTROYING, &client->flags);
+
+	// stop the client
+	if (client->is_control)
+		wake_up_interruptible(&client->wq);
+	else {
+		bao_ioeventfd_client_destroy(dm);
+		kthread_stop(client->thread);
+	}
+
+	// remove the I/O ranges
+	down_write(&client->range_lock);
+	list_for_each_entry_safe(range, next, &client->range_list, list) {
+		list_del(&range->list);
+		kfree(range);
+	}
+	up_write(&client->range_lock);
+
+	// remove the I/O client
+	down_write(&dm->io_clients_lock);
+	if (client->is_control)
+		dm->control_client = NULL;
+	else
+		dm->ioeventfd_client = NULL;
+	list_del(&client->list);
+	up_write(&dm->io_clients_lock);
+
+	// resume the I/O requests dispatcher
+	bao_io_dispatcher_resume(dm);
+
+	// free the allocated I/O client object
+	kfree(client);
+}
+
+void bao_io_clients_destroy(struct bao_dm *dm)
+{
+	struct bao_io_client *client, *next;
+
+	// destroy all the I/O clients
+	list_for_each_entry_safe(client, next, &dm->io_clients, list) {
+		bao_io_client_destroy(client);
+	}
+}
+
+int bao_io_client_attach(struct bao_io_client *client)
+{
+	if (client->is_control) {
+		/*
+		 * In the Control client, a user space thread waits on the waitqueue.
+		 * The thread should wait until:
+		 * - there are pending I/O requests to be processed
+		 * - the I/O client is going to be destroyed
+		 */
+		wait_event_interruptible(client->wq,
+					 bao_io_client_has_pending_requests(client) ||
+						 bao_io_client_is_destroying(client));
+		if (bao_io_client_is_destroying(client))
+			return -EPERM;
+	} else {
+		/*
+		 * In the non-control client (e.g., Ioeventfd Client), a kernel space thread waits on the waitqueue.
+		 * The thread should wait until:
+		 * - there are pending I/O requests to be processed
+		 * - the I/O client is going to be destroyed
+		 * - the kernel thread is going to be stopped
+		 */
+		wait_event_interruptible(client->wq,
+					 bao_io_client_has_pending_requests(client) ||
+						 bao_io_client_is_destroying(client) ||
+							 kthread_should_stop());
+		if (bao_io_client_is_destroying(client) || kthread_should_stop()) {
+			if (kthread_should_stop()) {
+				bao_io_client_destroy(client);
+			}
+			return -EPERM;
+		}
+	}
+
+	return 0;
+}
+
+/**
+ * Execution entity thread for a kernel I/O client (e.g., Ioeventfd client)
+ * @data: The I/O client
+ */
+static int bao_io_client_kernel_thread(void *data)
+{
+	struct bao_io_client *client = data;
+	struct bao_virtio_request req;
+	int ret = -EINVAL;
+	int stop = false;
+
+	while (!stop) {
+		// attach the client
+		stop = bao_io_client_attach(client);
+		while (bao_io_client_has_pending_requests(client) && !stop) {
+			// get the first kernel handled I/O request
+            req = bao_io_client_pop_request(client);
+			if (req.ret < 0) {
+				return -EFAULT;
+			}
+			// call the handler callback of the I/O client
+			// (e.g bao_ioeventfd_handler() for an ioeventfd client)
+			ret = client->handler(client, &req);
+			if (ret < 0) {
+				break;
+			}
+			// complete the request
+			else {
+				bao_io_dispatcher_remio_hypercall(&req);
+			}
+		}
+	}
+
+	return 0;
+}
+
+struct bao_io_client *bao_io_client_create(struct bao_dm *dm,
+					   bao_io_client_handler_t handler, void *data,
+					   bool is_control, const char *name)
+{
+	struct bao_io_client *client;
+
+	// if the I/O client is implemenmted in the kernel, it must have a kernel handler (e.g., Ioevendfd client)
+	if (!handler && !is_control) {
+		return NULL;
+	}
+
+	// allocate the I/O client object
+	client = kzalloc(sizeof(*client), GFP_KERNEL);
+	if (!client)
+		return NULL;
+
+	// initialize the I/O client
+	client->handler = handler;
+	client->dm = dm;
+	client->priv = data;
+	client->is_control = is_control;
+	if (name)
+		strncpy(client->name, name, sizeof(client->name) - 1);
+	INIT_LIST_HEAD(&client->virtio_requests);
+	init_rwsem(&client->range_lock);
+	INIT_LIST_HEAD(&client->range_list);
+	init_waitqueue_head(&client->wq);
+
+	// if the I/O client is implemented in the kernel, create the kernel thread
+	if (client->handler) {
+		client->thread = kthread_run(bao_io_client_kernel_thread, client,
+					     "%s-kthread", client->name);
+		if (IS_ERR(client->thread)) {
+			kfree(client);
+			return NULL;
+		}
+	}
+
+	// add the I/O client to the I/O clients list
+	down_write(&dm->io_clients_lock);
+	if (is_control)
+		dm->control_client = client;
+	else
+		dm->ioeventfd_client = client;
+	list_add(&client->list, &dm->io_clients);
+	up_write(&dm->io_clients_lock);
+
+	// back up any pending requests that could potentially be lost
+	// (e.g., if the backend VM is initialized after the frontend VM)
+	if (is_control) {
+		while (bao_dispatch_io(dm) > 0)
+			;
+	} 
+
+	return client;
+}
+
+int bao_io_client_request(struct bao_io_client *client,
+			  struct bao_virtio_request *req)
+{
+	// check if the Control client exists
+	if (!client) {
+		return -EEXIST;
+	}
+
+    // pop the first request from the list
+    *req = bao_io_client_pop_request(client);
+
+    // return the request return value
+	return req->ret;
+}
+
+int bao_io_client_range_add(struct bao_io_client *client, u64 start, u64 end)
+{
+	struct bao_io_range *range;
+
+	// check if the range is valid
+	if (end < start) {
+		return -EINVAL;
+	}
+
+	// allocate the range object
+	range = kzalloc(sizeof(*range), GFP_KERNEL);
+	if (!range)
+		return -ENOMEM;
+
+	// initialize the range
+	range->start = start;
+	range->end = end;
+
+	// add the range to the list
+	down_write(&client->range_lock);
+	list_add(&range->list, &client->range_list);
+	up_write(&client->range_lock);
+
+	return 0;
+}
+
+void bao_io_client_range_del(struct bao_io_client *client, u64 start, u64 end)
+{
+	struct bao_io_range *range;
+
+	// delete the range from the list
+	down_write(&client->range_lock);
+	list_for_each_entry(range, &client->range_list, list) {
+		if (start == range->start && end == range->end) {
+			list_del(&range->list);
+			kfree(range);
+			break;
+		}
+	}
+	up_write(&client->range_lock);
+}
+
+/**
+ * Check if the I/O request is in the range
+ * @range: The I/O request range
+ * @req: The I/O request to be checked
+ * @return True if the I/O request is in the range, False otherwise
+*/
+static bool bao_io_request_in_range(struct bao_io_range *range, struct bao_virtio_request *req)
+{
+	// check if the I/O request is in the range
+	if ((req->addr >= range->start) && ((req->addr + req->access_width - 1) <= range->end))
+		return true;
+
+	return false;
+}
+
+
+struct bao_io_client *bao_io_client_find(struct bao_dm *dm, struct bao_virtio_request *req)
+{
+	struct bao_io_client *client, *found = NULL;
+	struct bao_io_range *range;
+
+	// for all the I/O clients
+	list_for_each_entry(client, &dm->io_clients, list) {
+		down_read(&client->range_lock);
+		// for all the ranges
+		list_for_each_entry(range, &client->range_list, list) {
+			// check if the I/O request is in the range of a given client
+			if (bao_io_request_in_range(range, req)) {
+				found = client;
+				break;
+			}
+		}
+		up_read(&client->range_lock);
+		if (found)
+			break;
+	}
+
+	// if the I/O request is not in the range of any client, return the Control client
+	// otherwise, return the client that the I/O request belongs to (e.g., Ioeventfd client)
+	return found ? found : dm->control_client;
+}
\ No newline at end of file
diff --git a/drivers/virt/bao/io_dispatcher.c b/drivers/virt/bao/io_dispatcher.c
new file mode 100644
index 000000000..d8c79dd0c
--- /dev/null
+++ b/drivers/virt/bao/io_dispatcher.c
@@ -0,0 +1,235 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Bao Hypervisor I/O Dispatcher
+ *
+ * Copyright (c) Bao Project and Contributors. All rights reserved.
+ *
+ * Authors:
+ *	João Peixoto <joaopeixotooficial@gmail.com>
+ */
+
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/kthread.h>
+#include <linux/mm.h>
+#include <linux/slab.h>
+#include <linux/eventfd.h>
+#include <linux/workqueue.h>
+#include <linux/delay.h>
+
+#include <linux/bao.h>
+#include "bao_drv.h"
+#include "hypercall.h"
+
+#ifndef CONFIG_BAO_IO_DISPATCHER_INTERRUPT_MODE
+#include <time.h>
+#define INTERVAL_NS CONFIG_BAO_IO_DISPATCHER_POOLING_INTERVAL
+static timer_t timerids[BAO_IO_MAX_DMS];
+#endif
+
+// Define a wrapper structure that contains both work_struct and the private data (bao_dm)
+struct bao_io_dispatcher_work {
+    struct work_struct work;
+    struct bao_dm *dm;
+};
+
+static struct bao_io_dispatcher_work io_dispatcher_work[BAO_IO_MAX_DMS];
+
+/**
+ * Responsible for dispatching I/O requests for all I/O DMs
+ * This function is called by the workqueue
+ * @work: The work struct
+ */
+static void io_dispatcher(struct work_struct *work);
+// Workqueue for the I/O requests
+static struct workqueue_struct *bao_io_dispatcher_wq[BAO_IO_MAX_DMS];
+
+void bao_io_dispatcher_destroy(struct bao_dm *dm)
+{
+	// if the workqueue exists
+	if (bao_io_dispatcher_wq[dm->info.id]) {
+		// pause the I/O Dispatcher
+		bao_io_dispatcher_pause(dm);
+		// destroy the I/O Dispatcher workqueue
+		destroy_workqueue(bao_io_dispatcher_wq[dm->info.id]);
+#ifdef CONFIG_BAO_IO_DISPATCHER_INTERRUPT_MODE
+		// remove the interrupt handler
+		bao_intc_remove_handler();
+#else
+		// stop the pooling timer
+		timer_delete(timerids[dm->info.id]);
+#endif
+	}
+}
+
+int bao_io_dispatcher_remio_hypercall(struct bao_virtio_request *req)
+{
+	// notify the Hypervisor that the request was completed
+	*req = bao_hypercall_remio(req->dm_id, req->addr, req->op, req->value, req->cpu_id, req->vcpu_id);
+
+	return req->ret;
+}
+
+int bao_dispatch_io(struct bao_dm *dm)
+{
+	struct bao_io_client *client;
+	struct bao_virtio_request req;
+	int rc = 0;
+
+	// update the request
+	// the dm_id is the Virtual Remote I/O ID
+	req.dm_id = dm->info.id;
+	// BAO_IO_ASK will extract the I/O request from the Remote I/O system
+	req.op = BAO_IO_ASK;
+	// clear the other fields (convention)
+	req.addr = 0;
+	req.value = 0;
+	req.cpu_id = 0;
+	req.vcpu_id = 0;
+
+	// perform a Hypercall to get the I/O request from the Remote I/O system
+	// the rc value holds the number of requests that still need to be processed
+	rc = bao_io_dispatcher_remio_hypercall(&req);
+
+	if (rc < 0) {
+		return rc;
+	}
+
+	// find the I/O client that the I/O request belongs to
+	down_read(&dm->io_clients_lock);
+	client = bao_io_client_find(dm, &req);
+	if (!client) {
+		up_read(&dm->io_clients_lock);
+		return rc;
+	}
+
+	// add the request to the end of the virtio_request list
+	bao_io_client_push_request(client, &req);
+
+	// wake up the handler thread which is waiting for requests on the wait queue
+	wake_up_interruptible(&client->wq);
+	up_read(&dm->io_clients_lock);
+
+	// return the number of request that still need to be processed
+	return rc;
+}
+
+static void io_dispatcher(struct work_struct *work)
+{
+	struct bao_io_dispatcher_work *bao_dm_work = container_of(work, struct bao_io_dispatcher_work, work);
+    struct bao_dm *dm = bao_dm_work->dm;
+
+	// dispatch the I/O request for the device model
+	while (bao_dispatch_io(dm) > 0)
+		; // while there are requests to be processed
+}
+
+/**
+ * Interrupt Controller handler for the I/O requests
+ * @note: This function is called by the interrupt controller
+ * when an interrupt is triggered (when a new I/O request is available)
+ * @dm: The DM that triggered the interrupt
+ */
+static void io_dispatcher_intc_handler(struct bao_dm *dm)
+{
+	// add the work to the workqueue
+	queue_work(bao_io_dispatcher_wq[dm->info.id], &io_dispatcher_work[dm->info.id].work);
+}
+
+void bao_io_dispatcher_pause(struct bao_dm *dm)
+{
+#ifdef CONFIG_BAO_IO_DISPATCHER_INTERRUPT_MODE
+	// remove the interrupt handler
+	bao_intc_remove_handler();
+#endif
+	// drain the workqueue (wait for all the work to finish)
+	drain_workqueue(bao_io_dispatcher_wq[dm->info.id]);
+}
+
+void bao_io_dispatcher_resume(struct bao_dm *dm)
+{
+#ifdef CONFIG_BAO_IO_DISPATCHER_INTERRUPT_MODE
+	// setup the interrupt handler
+	bao_intc_setup_handler(io_dispatcher_intc_handler);
+#endif
+	// add the work to the workqueue
+	queue_work(bao_io_dispatcher_wq[dm->info.id], &io_dispatcher_work[dm->info.id].work);
+}
+
+/**
+ * Responsible for dispatching I/O requests for all DMs
+ * if selected the pooling mode
+ */
+#ifndef CONFIG_BAO_IO_DISPATCHER_INTERRUPT_MODE
+int bao_io_dispatcher_pooling_handler(void *data)
+{
+	struct bao_dm *dm = (struct bao_dm *)data;
+	// resume the I/O requests dispatcher
+	bao_io_dispatcher_resume(dm);
+}
+#endif
+
+int bao_io_dispatcher_init(struct bao_dm *dm)
+{
+	char name[BAO_NAME_MAX_LEN];
+    snprintf(name, BAO_NAME_MAX_LEN, "bao-iodwq%u", dm->info.id);
+
+	// Create the I/O Dispatcher workqueue with high priority
+	bao_io_dispatcher_wq[dm->info.id] = alloc_workqueue(name, WQ_HIGHPRI | WQ_MEM_RECLAIM, 1);
+	if (!bao_io_dispatcher_wq[dm->info.id]) {
+		return -ENOMEM;
+	}
+
+	// Assign the custom data to the work
+	io_dispatcher_work[dm->info.id].dm = dm;
+
+	// Initialize the work_struct
+	INIT_WORK(&io_dispatcher_work[dm->info.id].work, io_dispatcher);
+
+#ifdef CONFIG_BAO_IO_DISPATCHER_INTERRUPT_MODE
+	// setup the interrupt handler
+	bao_intc_setup_handler(io_dispatcher_intc_handler);
+#else
+	struct sigevent sev;
+
+	// Create timer
+	sev.sigev_notify = SIGEV_THREAD; // Notify via thread
+	sev.sigev_notify_function =
+		bao_io_dispatcher_pooling_handler; // Callback function
+	sev.sigev_notify_attributes = dm; // Pass DM to callback
+	sev.sigev_value.sival_ptr = &timerids[dm->info.id]; // Pass timer ID to callback
+
+	if (timer_create(CLOCK_REALTIME, &sev, &timerids[dm->info.id]) == -1) {
+		perror("Bao I/O Dispatcher pooling mode: timer_create");
+		return -1;
+	}
+
+	// Configure timer
+	struct itimerspec its;
+	its.it_value.tv_sec = 0; // Initial expiration time (seconds)
+	its.it_value.tv_nsec =
+		INTERVAL_NS; // Initial expiration time (nanoseconds)
+	its.it_interval.tv_sec = 0; // Interval for periodic timer (seconds)
+	its.it_interval.tv_nsec =
+		INTERVAL_NS; // Interval for periodic timer (nanoseconds)
+
+	// Start timer
+	if (timer_settime(timerids[dm->info.id], 0, &its, NULL) == -1) {
+		perror("Bao I/O Dispatcher pooling mode for DM %s: timer_settime", dm->info.id);
+		return -1;
+	}
+#endif
+
+	return 0;
+}
+
+int bao_io_dispatcher_setup(void)
+{
+	// Do nothing
+	return 0;
+}
+
+void bao_io_dispatcher_remove(void)
+{
+	// Do nothing
+}
\ No newline at end of file
diff --git a/drivers/virt/bao/ioctls.c b/drivers/virt/bao/ioctls.c
new file mode 100644
index 000000000..e7f0a1edc
--- /dev/null
+++ b/drivers/virt/bao/ioctls.c
@@ -0,0 +1,123 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Bao Hypervisor IOCTLs Handler for the I/O Dispatcher kernel module
+ *
+ * Copyright (c) Bao Project and Contributors. All rights reserved.
+ *
+ * Authors:
+ *	João Peixoto <joaopeixotooficial@gmail.com>
+ */
+
+#include <linux/io.h>
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/device.h>
+#include <linux/file.h>
+#include <linux/cpu.h>
+#include <linux/mm.h>
+#include <linux/miscdevice.h>
+#include <linux/anon_inodes.h>
+
+#include <linux/bao.h>
+#include "bao_drv.h"
+
+long bao_io_dispatcher_driver_ioctl(struct file *filp, unsigned int cmd, unsigned long ioctl_param)
+{
+	int rc = -EINVAL;
+	struct bao_dm_info *info;
+
+	switch (cmd) {
+	case BAO_IOCTL_DM_GET_INFO:
+		info = memdup_user((void __user *)ioctl_param,
+				  sizeof(struct bao_dm_info));
+		if (IS_ERR(info)) {
+			pr_err("%s: memdup_user failed\n", __FUNCTION__);
+			return PTR_ERR(info);
+		}
+		rc = bao_dm_get_info(info);
+		if (!rc) {
+			pr_err("%s: DM with id [%d] not found\n", __FUNCTION__, info->id);
+			kfree(info);
+			return -EINVAL;
+		}
+		if (copy_to_user((void __user *)ioctl_param, info,
+				 sizeof(struct bao_dm_info))) {
+			pr_err("%s: copy_to_user failed\n", __FUNCTION__);
+			kfree(info);
+			return -EFAULT;
+		}
+		break;
+	default:
+		pr_err("%s: unknown ioctl cmd [%d]\n", __FUNCTION__, cmd);
+		return -ENOTTY;
+	}
+	return rc;
+}
+
+long bao_dm_ioctl(struct file *filp, unsigned int cmd,
+		  unsigned long ioctl_param)
+{
+	struct bao_virtio_request *req;
+	int rc = -EINVAL;
+
+	// get the backend DM pointer from the file pointer private data
+	struct bao_dm *dm = filp->private_data;
+
+	switch (cmd) {
+	case BAO_IOCTL_IO_CLIENT_ATTACH:
+		req = memdup_user((void __user *)ioctl_param,
+				  sizeof(struct bao_virtio_request));
+		if (IS_ERR(req)) {
+			pr_err("%s: memdup_user failed\n", __FUNCTION__);
+			return PTR_ERR(req);
+		}
+		if (!dm->control_client) {
+			pr_err("%s: control client does not exist\n",
+			       __FUNCTION__);
+			return -EINVAL;
+		}
+		rc = bao_io_client_attach(dm->control_client);
+		if (rc == 0) {
+			rc = bao_io_client_request(dm->control_client, req);
+			if (copy_to_user((void __user *)ioctl_param, req,
+					 sizeof(struct bao_virtio_request))) {
+				pr_err("%s: copy_to_user failed\n", __FUNCTION__);
+				return -EFAULT;
+			}
+		}
+		kfree(req);
+		break;
+	case BAO_IOCTL_IO_REQUEST_NOTIFY_COMPLETED:
+		req = memdup_user((void __user *)ioctl_param,
+				  sizeof(struct bao_virtio_request));
+		if (IS_ERR(req)) {
+			pr_err("%s: memdup_user failed\n", __FUNCTION__);
+			return PTR_ERR(req);
+		}
+		rc = bao_io_dispatcher_remio_hypercall(req);
+		break;
+	case BAO_IOCTL_IOEVENTFD:
+		struct bao_ioeventfd ioeventfd;
+		if (copy_from_user(&ioeventfd, (void __user *)ioctl_param,
+				   sizeof(struct bao_ioeventfd))) {
+			pr_err("%s: copy_from_user failed\n", __FUNCTION__);
+			return -EFAULT;
+		}
+		rc = bao_ioeventfd_client_config(dm, &ioeventfd);
+		break;
+	case BAO_IOCTL_IRQFD:
+		struct bao_irqfd irqfd;
+		if (copy_from_user(&irqfd, (void __user *)ioctl_param,
+				   sizeof(struct bao_irqfd))) {
+			pr_err("%s: copy_from_user failed\n", __FUNCTION__);
+			return -EFAULT;
+		}
+		rc = bao_irqfd_server_config(dm, &irqfd);
+		break;
+	default:
+		pr_err("%s: unknown ioctl cmd [%d]\n", __FUNCTION__, cmd);
+		rc = -ENOTTY;
+		break;
+	}
+	return rc;
+}
\ No newline at end of file
diff --git a/drivers/virt/bao/ioeventfd.c b/drivers/virt/bao/ioeventfd.c
new file mode 100644
index 000000000..7a719154c
--- /dev/null
+++ b/drivers/virt/bao/ioeventfd.c
@@ -0,0 +1,311 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Bao Hypervisor Ioeventfd Client
+ *
+ * Copyright (c) Bao Project and Contributors. All rights reserved.
+ *
+ * Authors:
+ *	João Peixoto <joaopeixotooficial@gmail.com>
+ */
+
+#include "bao_drv.h"
+#include <linux/eventfd.h>
+
+/**
+ * Properties of a ioeventfd
+ * @list: List node of the ioeventfd
+ * @eventfd: Eventfd of the ioeventfd
+ * @addr: Address of I/O range
+ * @data: Data for matching
+ * @length:	Length of I/O range
+ * @wildcard: Data matching or not
+ */
+struct ioeventfd {
+	struct list_head list;
+	struct eventfd_ctx *eventfd;
+	u64 addr;
+	u64 data;
+	int length;
+	bool wildcard;
+};
+
+/**
+ * Shutdown the ioeventfd
+ * @dm:	The DM that the ioeventfd belongs to
+ * @p: The ioeventfd to shutdown
+ */
+static void bao_ioeventfd_shutdown(struct bao_dm *dm,
+				   struct ioeventfd *p)
+{
+	lockdep_assert_held(&dm->ioeventfds_lock);
+
+	// unregister the ioeventfd
+	eventfd_ctx_put(p->eventfd);
+	// remove the ioeventfd from the list
+	list_del(&p->list);
+	// free the ioeventfd
+	kfree(p);
+}
+
+/**
+ * Check if the configuration of ioeventfd is valid
+ * @config: The configuration of ioeventfd
+ * @return: bool
+ */
+static bool bao_ioeventfd_config_valid(struct bao_ioeventfd *config)
+{
+	// check if the configuration is valid
+	if (!config)
+		return false;
+
+	// check for overflow
+	if (config->addr + config->len < config->addr)
+		return false;
+
+	// vhost supports 1, 2, 4 and 8 bytes access
+	if (!(config->len == 1 || config->len == 2 || config->len == 4 ||
+	      config->len == 8))
+		return false;
+
+	return true;
+}
+
+/**
+ * Check if the ioeventfd is conflict with other ioeventfds
+ * @dm: The DM that the ioeventfd belongs to
+ * @ioeventfd: The ioeventfd to check
+ * @return: bool
+ */
+static bool bao_ioeventfd_is_conflict(struct bao_dm *dm,
+				      struct ioeventfd *ioeventfd)
+{
+	struct ioeventfd *p;
+
+	lockdep_assert_held(&dm->ioeventfds_lock);
+
+	// either one is wildcard, the data matching will be skipped
+	list_for_each_entry(p, &dm->ioeventfds, list)
+		if (p->eventfd == ioeventfd->eventfd &&
+		    p->addr == ioeventfd->addr &&
+		    (p->wildcard || ioeventfd->wildcard ||
+		     p->data == ioeventfd->data))
+			return true;
+
+	return false;
+}
+
+/**
+ * Return the matched ioeventfd
+ * @dm: The DM to check
+ * @addr: The address of I/O request
+ * @data: The data of I/O request
+ * @len: The length of I/O request
+ * @return: The matched ioeventfd or NULL
+ */
+static struct ioeventfd *bao_ioeventfd_match(struct bao_dm *dm, u64 addr,
+					 u64 data, int len)
+{
+	struct ioeventfd *p = NULL;
+
+	lockdep_assert_held(&dm->ioeventfds_lock);
+
+	list_for_each_entry(p, &dm->ioeventfds, list) {
+		if (p->addr == addr && p->length >= len &&
+		    (p->wildcard || p->data == data))
+			return p;
+	}
+
+	return NULL;
+}
+
+/**
+ * Assign an eventfd to a DM and create a ioeventfd associated with the eventfd
+ * @dm:	The DM to assign the eventfd to
+ * @config:	The configuration of the eventfd
+ */
+static int bao_ioeventfd_assign(struct bao_dm *dm,
+				struct bao_ioeventfd *config)
+{
+	struct eventfd_ctx *eventfd;
+	struct ioeventfd *new;
+	int rc = 0;
+
+	// check if the configuration is valid
+	if (!bao_ioeventfd_config_valid(config)) {
+		return -EINVAL;
+	}
+
+	// get the eventfd from the file descriptor
+	eventfd = eventfd_ctx_fdget(config->fd);
+	if (IS_ERR(eventfd))
+		return PTR_ERR(eventfd);
+
+	// allocate a new ioeventfd object
+	new = kzalloc(sizeof(*new), GFP_KERNEL);
+	if (!new) {
+		rc = -ENOMEM;
+		goto err;
+	}
+
+	// initialize the ioeventfd
+	INIT_LIST_HEAD(&new->list);
+	new->addr = config->addr;
+	new->length = config->len;
+	new->eventfd = eventfd;
+
+	/*
+	 * BAO_IOEVENTFD_FLAG_DATAMATCH flag is set in virtio 1.0 support, the
+	 * writing of notification register of each virtqueue may trigger the
+	 * notification. There is no data matching requirement.
+	 */
+	if (config->flags & BAO_IOEVENTFD_FLAG_DATAMATCH)
+		new->data = config->data;
+	else
+		new->wildcard = true;
+
+	mutex_lock(&dm->ioeventfds_lock);
+
+	// check if the ioeventfd is conflict with other ioeventfds
+	if (bao_ioeventfd_is_conflict(dm, new)) {
+		rc = -EEXIST;
+		goto err_unlock;
+	}
+
+	// register the I/O range monitor into the Ioeventfd client
+	rc = bao_io_client_range_add(dm->ioeventfd_client, new->addr,
+					 new->addr + new->length - 1);
+	if (rc < 0)
+		goto err_unlock;
+
+	// add the ioeventfd to the list
+	list_add_tail(&new->list, &dm->ioeventfds);
+	mutex_unlock(&dm->ioeventfds_lock);
+
+	return rc;
+
+err_unlock:
+	mutex_unlock(&dm->ioeventfds_lock);
+	kfree(new);
+err:
+	eventfd_ctx_put(eventfd);
+	return rc;
+}
+
+/**
+ * Deassign an eventfd from a DM and destroy the ioeventfd associated with
+ * the eventfd.
+ * @dm:	The DM to deassign the eventfd from
+ * @config:	The configuration of the eventfd
+ */
+static int bao_ioeventfd_deassign(struct bao_dm *dm,
+				  struct bao_ioeventfd *config)
+{
+	struct ioeventfd *p;
+	struct eventfd_ctx *eventfd;
+
+	// get the eventfd from the file descriptor
+	eventfd = eventfd_ctx_fdget(config->fd);
+	if (IS_ERR(eventfd))
+		return PTR_ERR(eventfd);
+
+	mutex_lock(&dm->ioeventfds_lock);
+	list_for_each_entry(p, &dm->ioeventfds, list) {
+		if (p->eventfd != eventfd)
+			continue;
+		// delete the I/O range monitor from the Ioeventfd client
+		bao_io_client_range_del(dm->ioeventfd_client, p->addr,
+					    p->addr + p->length - 1);
+		// shutdown the ioeventfd
+		bao_ioeventfd_shutdown(dm, p);
+		break;
+	}
+	mutex_unlock(&dm->ioeventfds_lock);
+
+	// unregister the eventfd
+	eventfd_ctx_put(eventfd);
+	return 0;
+}
+
+/**
+ * Handle the Ioeventfd client I/O request
+ * This function is called by the I/O client kernel thread (bao_io_client_kernel_thread)
+ * @client: The Ioeventfd client that the I/O request belongs to
+ * @req: The I/O request to be handled
+ */
+static int bao_ioeventfd_handler(struct bao_io_client *client,
+				 struct bao_virtio_request *req)
+{
+	struct ioeventfd *p;
+
+	/*
+	* I/O requests are dispatched by range check only, so a
+	* bao_io_client need process both READ and WRITE accesses
+	* of same range. READ accesses are safe to be ignored here
+	* because virtio MMIO drivers only write into the notify
+	* register (`QueueNotify` field) for notification.
+	* In fact, the read request won't exist since
+	* the `QueueNotify` field is WRITE ONLY from the driver
+	* and read only from the device.
+	*/
+	if (req->op == BAO_IO_READ) {
+		req->value = 0;
+		return 0;
+	}
+
+	mutex_lock(&client->dm->ioeventfds_lock);
+
+	// find the matched ioeventfd
+	p = bao_ioeventfd_match(client->dm, req->addr, req->value, req->access_width);
+
+	// if matched, signal the eventfd
+	if (p)
+		eventfd_signal(p->eventfd);
+	mutex_unlock(&client->dm->ioeventfds_lock);
+
+	return 0;
+}
+
+int bao_ioeventfd_client_config(struct bao_dm *dm, struct bao_ioeventfd *config)
+{
+	// check if the DM and configuration are valid
+	if (WARN_ON(!dm || !config))
+		return -EINVAL;
+
+	// deassign the eventfd from the DM
+	if (config->flags & BAO_IOEVENTFD_FLAG_DEASSIGN)
+		bao_ioeventfd_deassign(dm, config);
+
+	// assign the eventfd to the DM
+	return bao_ioeventfd_assign(dm, config);
+}
+
+int bao_ioeventfd_client_init(struct bao_dm *dm)
+{
+	char name[BAO_NAME_MAX_LEN];
+
+	mutex_init(&dm->ioeventfds_lock);
+	INIT_LIST_HEAD(&dm->ioeventfds);
+
+	// create a new name for the Ioeventfd client based on type and DM ID
+	snprintf(name, sizeof(name), "bao-ioevfdc%u", dm->info.id);
+
+	// create a new I/O client (Ioeventfd client)
+	dm->ioeventfd_client = bao_io_client_create(
+		dm, bao_ioeventfd_handler, NULL, false, name);
+	if (!dm->ioeventfd_client) {
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+void bao_ioeventfd_client_destroy(struct bao_dm *dm)
+{
+	struct ioeventfd *p, *next;
+
+	mutex_lock(&dm->ioeventfds_lock);
+	// shutdown all the ioeventfds
+	list_for_each_entry_safe(p, next, &dm->ioeventfds, list)
+		bao_ioeventfd_shutdown(dm, p);
+	mutex_unlock(&dm->ioeventfds_lock);
+}
\ No newline at end of file
diff --git a/drivers/virt/bao/irqfd.c b/drivers/virt/bao/irqfd.c
new file mode 100644
index 000000000..1cd14f5bb
--- /dev/null
+++ b/drivers/virt/bao/irqfd.c
@@ -0,0 +1,303 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Bao Hypervisor Irqfd Server
+ *
+ * Copyright (c) Bao Project and Contributors. All rights reserved.
+ *
+ * Authors:
+ *	João Peixoto <joaopeixotooficial@gmail.com>
+ */
+
+#include <linux/eventfd.h>
+#include <linux/file.h>
+#include <linux/poll.h>
+#include <linux/slab.h>
+#include "hypercall.h"
+
+#include "bao_drv.h"
+
+/**
+ * struct irqfd - Properties of irqfd
+ * @dm:	Associated DM pointer
+ * @wait: Entry of wait-queue
+ * @shutdown: Async shutdown work
+ * @eventfd: Associated eventfd to poll
+ * @list: Entry within &bao_dm.irqfds of irqfds of a DM
+ * @pt:	Structure for select/poll on the associated eventfd
+ */
+struct irqfd {
+	struct bao_dm *dm;
+	wait_queue_entry_t wait;
+	struct work_struct shutdown;
+	struct eventfd_ctx *eventfd;
+	struct list_head list;
+	poll_table pt;
+};
+
+/**
+ * Shutdown a irqfd
+ * @irqfd: The irqfd to shutdown
+ */
+static void bao_irqfd_shutdown(struct irqfd *irqfd)
+{
+	u64 cnt;
+	lockdep_assert_held(&irqfd->dm->irqfds_lock);
+
+	// delete the irqfd from the list of irqfds
+	list_del_init(&irqfd->list);
+
+	// remove the irqfd from the wait queue
+	eventfd_ctx_remove_wait_queue(irqfd->eventfd, &irqfd->wait, &cnt);
+
+	// release the eventfd
+	eventfd_ctx_put(irqfd->eventfd);
+
+	// free the irqfd
+	kfree(irqfd);
+}
+
+/**
+ * Inject a notify hypercall into the Bao Hypervisor
+ * @id: The DM ID
+ */
+static int bao_irqfd_inject(int id)
+{
+	// notify the Hypervisor about the event
+	struct bao_virtio_request ret = bao_hypercall_remio(id, 0, BAO_IO_NOTIFY, 0, 0, 0);
+
+	if (ret.ret != 0) {
+		return -EFAULT;
+	}
+	return 0;
+}
+
+/**
+ * Custom wake-up handling to be notified whenever underlying eventfd is signaled.
+ * @note: This function will be called by Linux kernel poll table (irqfd->pt) whenever the eventfd is signaled.
+ * @wait: Entry of wait-queue
+ * @mode: Mode
+ * @sync: Sync
+ * @key: Poll bits
+ * @return int
+ */
+static int bao_irqfd_wakeup(wait_queue_entry_t *wait, unsigned int mode,
+			    int sync, void *key)
+{
+	unsigned long poll_bits = (unsigned long)key;
+	struct irqfd *irqfd;
+	struct bao_dm *dm;
+
+	// get the irqfd object from the wait queue
+	irqfd = container_of(wait, struct irqfd, wait);
+
+	// get the DM from the irqfd
+	dm = irqfd->dm;
+
+	// check if the event is signaled
+	if (poll_bits & POLLIN)
+		// an event has been signaled, inject a irqfd
+		bao_irqfd_inject(dm->info.id);
+
+	if (poll_bits & POLLHUP)
+		// do shutdown work in thread to hold wqh->lock
+		queue_work(dm->irqfd_server, &irqfd->shutdown);
+
+	return 0;
+}
+
+/**
+ * Register the file descriptor with the poll table and associate it with a wait queue
+ * that the kernel will monitor for events
+ * @file: The file to poll
+ * @wqh: The wait queue head
+ * @pt: The poll table
+ */
+static void bao_irqfd_poll_func(struct file *file, wait_queue_head_t *wqh,
+				poll_table *pt)
+{
+	struct irqfd *irqfd;
+
+	// get the irqfd from the file
+	irqfd = container_of(pt, struct irqfd, pt);
+	// add the irqfd wait queue entry to the wait queue
+	add_wait_queue(wqh, &irqfd->wait);
+}
+
+/**
+ * Shutdown a irqfd
+ * @work: The work to shutdown the irqfd
+ */
+static void irqfd_shutdown_work(struct work_struct *work)
+{
+	struct irqfd *irqfd;
+	struct bao_dm *dm;
+
+	// get the irqfd from the work
+	irqfd = container_of(work, struct irqfd, shutdown);
+
+	// get the DM from the irqfd
+	dm = irqfd->dm;
+
+	// shutdown the irqfd
+	mutex_lock(&dm->irqfds_lock);
+	if (!list_empty(&irqfd->list))
+		bao_irqfd_shutdown(irqfd);
+	mutex_unlock(&dm->irqfds_lock);
+}
+
+/**
+ * Assign an eventfd to a DM and create the associated irqfd.
+ * @dm: The DM to assign the eventfd
+ * @args: The &struct bao_irqfd to assign
+ */
+static int bao_irqfd_assign(struct bao_dm *dm, struct bao_irqfd *args)
+{
+	struct eventfd_ctx *eventfd = NULL;
+	struct irqfd *irqfd, *tmp;
+	__poll_t events;
+	struct fd f;
+	int ret = 0;
+
+	// allocate a new irqfd object
+	irqfd = kzalloc(sizeof(*irqfd), GFP_KERNEL);
+	if (!irqfd)
+		return -ENOMEM;
+
+	// initialize the irqfd
+	irqfd->dm = dm;
+	INIT_LIST_HEAD(&irqfd->list);
+	INIT_WORK(&irqfd->shutdown, irqfd_shutdown_work);
+
+	// get a reference to the file descriptor
+	f = fdget(args->fd);
+	if (!f.file) {
+		ret = -EBADF;
+		goto out;
+	}
+
+	// get the eventfd from the file descriptor
+	eventfd = eventfd_ctx_fileget(f.file);
+	if (IS_ERR(eventfd)) {
+		ret = PTR_ERR(eventfd);
+		goto fail;
+	}
+
+	// assign the eventfd to the irqfd
+	irqfd->eventfd = eventfd;
+
+	// define the custom callback for the wait queue to be notified whenever underlying eventfd is signaled
+	// (in this case we don't need to wake-up any task, just to be notified when the eventfd is signaled)
+	init_waitqueue_func_entry(&irqfd->wait, bao_irqfd_wakeup);
+
+	// define the custom poll function behavior
+	init_poll_funcptr(&irqfd->pt, bao_irqfd_poll_func);
+
+	// add the irqfd to the list of irqfds of the DM
+	mutex_lock(&dm->irqfds_lock);
+	list_for_each_entry(tmp, &dm->irqfds, list) {
+		if (irqfd->eventfd != tmp->eventfd)
+			continue;
+		ret = -EBUSY;
+		mutex_unlock(&dm->irqfds_lock);
+		goto fail;
+	}
+	list_add_tail(&irqfd->list, &dm->irqfds);
+	mutex_unlock(&dm->irqfds_lock);
+
+	// check the pending event in this stage by calling vfs_poll function
+	// (this function will internally call the custom poll function already defined)
+	// any event signaled upon this stage will be handled by the custom poll function
+	events = vfs_poll(f.file, &irqfd->pt);
+
+	// if the event is signaled, signal Bao Hypervisor
+	if (events & EPOLLIN)
+		bao_irqfd_inject(dm->info.id);
+
+	// release the file descriptor reference
+	fdput(f);
+	return 0;
+fail:
+	if (eventfd && !IS_ERR(eventfd))
+		eventfd_ctx_put(eventfd);
+
+	fdput(f);
+out:
+	kfree(irqfd);
+	return ret;
+}
+
+/**
+ * Deassign an eventfd from a DM and destroy the associated irqfd.
+ * @dm: The DM to deassign the eventfd
+ * @args: The &struct bao_irqfd to deassign
+ */
+static int bao_irqfd_deassign(struct bao_dm *dm, struct bao_irqfd *args)
+{
+	struct irqfd *irqfd, *tmp;
+	struct eventfd_ctx *eventfd;
+
+	// get the eventfd from the file descriptor
+	eventfd = eventfd_ctx_fdget(args->fd);
+	if (IS_ERR(eventfd))
+		return PTR_ERR(eventfd);
+
+	// find the irqfd associated with the eventfd and shutdown it
+	mutex_lock(&dm->irqfds_lock);
+	list_for_each_entry_safe(irqfd, tmp, &dm->irqfds, list) {
+		if (irqfd->eventfd == eventfd) {
+			bao_irqfd_shutdown(irqfd);
+			break;
+		}
+	}
+	mutex_unlock(&dm->irqfds_lock);
+
+	// release the eventfd
+	eventfd_ctx_put(eventfd);
+
+	return 0;
+}
+
+int bao_irqfd_server_config(struct bao_dm *dm, struct bao_irqfd *config)
+{
+	// check if the DM and configuration are valid
+	if (WARN_ON(!dm || !config))
+		return -EINVAL;
+
+	// deassign the eventfd
+	if (config->flags & BAO_IRQFD_FLAG_DEASSIGN)
+		return bao_irqfd_deassign(dm, config);
+
+	// assign the eventfd
+	return bao_irqfd_assign(dm, config);
+}
+
+int bao_irqfd_server_init(struct bao_dm *dm)
+{
+	char name[BAO_NAME_MAX_LEN];
+
+	mutex_init(&dm->irqfds_lock);
+	INIT_LIST_HEAD(&dm->irqfds);
+
+	// create a new name for the irqfd server based on type and DM ID
+	snprintf(name, sizeof(name), "bao-ioirqfds%u", dm->info.id);
+
+	// allocate a new workqueue for the irqfd
+	dm->irqfd_server = alloc_workqueue(name, 0, 0);
+	if (!dm->irqfd_server)
+		return -ENOMEM;
+
+	return 0;
+}
+
+void bao_irqfd_server_destroy(struct bao_dm *dm)
+{
+	struct irqfd *irqfd, *next;
+
+	// destroy the workqueue
+	destroy_workqueue(dm->irqfd_server);
+	mutex_lock(&dm->irqfds_lock);
+	// shutdown all the irqfds
+	list_for_each_entry_safe(irqfd, next, &dm->irqfds, list)
+		bao_irqfd_shutdown(irqfd);
+	mutex_unlock(&dm->irqfds_lock);
+}
\ No newline at end of file
diff --git a/include/uapi/linux/bao.h b/include/uapi/linux/bao.h
new file mode 100644
index 000000000..1393281cb
--- /dev/null
+++ b/include/uapi/linux/bao.h
@@ -0,0 +1,108 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/*
+ * Provides the Bao Hypervisor IOCTLs and global structures
+ *
+ * Copyright (c) Bao Project and Contributors. All rights reserved.
+ *
+ * Authors:
+ *	João Peixoto <joaopeixotooficial@gmail.com>
+ */
+
+#ifndef _UAPI_BAO_H
+#define _UAPI_BAO_H
+
+#include <linux/types.h>
+#include <linux/uuid.h>
+#include <linux/list.h>
+
+#define BAO_IO_WRITE 0x0
+#define BAO_IO_READ 0x1
+#define BAO_IO_ASK 0x2
+#define BAO_IO_NOTIFY 0x3
+
+#define BAO_NAME_MAX_LEN 16
+#define BAO_IO_REQUEST_MAX 64
+#define BAO_IO_MAX_DMS 16
+
+/**
+ * Contains the specific parameters of a Bao VirtIO request
+ * @dm_id: Device Model ID
+ * @addr: Gives the MMIO register address that was accessed
+ * @op: Write, Read, Ask or Notify operation
+ * @value: Value to write or read
+ * @access_width: Access width (VirtIO MMIO only allows 4-byte wide and alligned accesses)
+ * @cpu_id: Frontend CPU ID of the I/O request
+ * @vcpu_id: Frontend vCPU ID of the I/O request
+ * @ret: Return value
+*/
+struct bao_virtio_request {
+	__u64 dm_id;
+	__u64 addr;
+	__u64 op;
+	__u64 value;
+	__u64 access_width;
+	__u64 cpu_id;
+	__u64 vcpu_id;
+	__s32 ret;
+};
+
+/**
+ * Contains the specific parameters of a ioeventfd request
+ * @fd:		The fd of eventfd associated with a hsm_ioeventfd
+ * @flags:	Logical-OR of BAO_IOEVENTFD_FLAG_*
+ * @addr:	The start address of IO range of ioeventfd
+ * @len:	The length of IO range of ioeventfd
+ * @reserved:	Reserved and should be 0
+ * @data:	Data for data matching
+ */
+struct bao_ioeventfd {
+	__u32 fd;
+	__u32 flags;
+	__u64 addr;
+	__u32 len;
+	__u32 reserved;
+	__u64 data;
+};
+
+/**
+ * Contains the specific parameters of a irqfd request
+ * @fd: The file descriptor of the eventfd
+ * @flags: The flags of the eventfd
+ */
+struct bao_irqfd {
+	__s32 fd;
+	__u32 flags;
+};
+
+/**
+ * Contains the specific parameters of a Bao DM
+ * @id: The virtual ID of the DM
+ * @shmem_addr: The base address of the shared memory
+ * @shmem_size: The size of the shared memory
+ * @irq: The IRQ number
+ * @fd: The file descriptor of the DM
+ */
+struct bao_dm_info {
+	__u32 id;
+	__u64 shmem_addr;
+	__u64 shmem_size;
+	__u32 irq;
+	__s32 fd;
+};
+
+/* The ioctl type, listed in Documentation/userspace-api/ioctl/ioctl-number.rst */
+#define BAO_IOCTL_TYPE 0xA6
+
+/*
+ * Common IOCTL IDs definition for Bao userspace
+ * Follows the convention of the Linux kernel, listed in Documentation/driver-api/ioctl.rst
+ */
+#define BAO_IOCTL_DM_GET_INFO _IOWR(BAO_IOCTL_TYPE, 0x01, struct bao_dm_info)
+#define BAO_IOCTL_IO_CLIENT_ATTACH \
+	_IOWR(BAO_IOCTL_TYPE, 0x02, struct bao_virtio_request)
+#define BAO_IOCTL_IO_REQUEST_NOTIFY_COMPLETED \
+	_IOW(BAO_IOCTL_TYPE, 0x03, struct bao_virtio_request)
+#define BAO_IOCTL_IOEVENTFD _IOW(BAO_IOCTL_TYPE, 0x04, struct bao_ioeventfd)
+#define BAO_IOCTL_IRQFD _IOW(BAO_IOCTL_TYPE, 0x05, struct bao_irqfd)
+
+#endif /* _UAPI_BAO_H */
\ No newline at end of file