prog: support AUTO args in programs

AUTO arguments can be used for:
 - consts
 - lens
 - pointers

For const's and len's AUTO is replaced with the natural value,
addresses for AUTO pointers are allocated linearly.

This greatly simplifies writing test programs by hand
as most of the time we want these natural values.

Update tests to use AUTO.

15 files changed, 194 insertions, 89 deletions

diff --git a/executor/defs.h b/executor/defs.h
index 59329f471..486a521dd 100644
--- a/executor/defs.h
+++ b/executor/defs.h
@@ -20,7 +20,7 @@
 
 #if GOARCH_amd64
 #define GOARCH "amd64"
-#define SYZ_REVISION "d990a6df2ded440a9df7303f0bfb0cddcc0d448f"
+#define SYZ_REVISION "a2e13b0f6d7d5dbce4abfd304a9e7a187eb4224e"
 #define SYZ_EXECUTOR_USES_FORK_SERVER 1
 #define SYZ_EXECUTOR_USES_SHMEM 1
 #define SYZ_PAGE_SIZE 4096
@@ -115,7 +115,7 @@
 
 #if GOARCH_amd64
 #define GOARCH "amd64"
-#define SYZ_REVISION "700e6f258d2aab7d3f9dcbb0bf34ad24dc98b899"
+#define SYZ_REVISION "a1a8ff2d3390c03118bf259766cd9af823ea9f9c"
 #define SYZ_EXECUTOR_USES_FORK_SERVER 1
 #define SYZ_EXECUTOR_USES_SHMEM 1
 #define SYZ_PAGE_SIZE 4096
@@ -130,7 +130,7 @@
 
 #if GOARCH_amd64
 #define GOARCH "amd64"
-#define SYZ_REVISION "f94278824a33df295bd09539047df0b8e25da251"
+#define SYZ_REVISION "ea9d720726fb2c8bf7bed9d5c405e627d5ce3467"
 #define SYZ_EXECUTOR_USES_FORK_SERVER 1
 #define SYZ_EXECUTOR_USES_SHMEM 1
 #define SYZ_PAGE_SIZE 4096
@@ -165,7 +165,7 @@
 
 #if GOARCH_64
 #define GOARCH "64"
-#define SYZ_REVISION "82736d421a5d52db6df0775561f1e59cc6cb9014"
+#define SYZ_REVISION "ece48c7de48771745acdea340f4c52c47e058e65"
 #define SYZ_EXECUTOR_USES_FORK_SERVER 0
 #define SYZ_EXECUTOR_USES_SHMEM 0
 #define SYZ_PAGE_SIZE 4096
diff --git a/executor/syscalls.h b/executor/syscalls.h
index e720e664c..3629d04b1 100644
--- a/executor/syscalls.h
+++ b/executor/syscalls.h
@@ -13542,6 +13542,7 @@ const call_t syscalls[] = {
     {"test$array0", 0},
     {"test$array1", 0},
     {"test$array2", 0},
+    {"test$auto0", 0},
     {"test$bf0", 0},
     {"test$bf1", 0},
     {"test$csum_encode", 0},
diff --git a/prog/encoding.go b/prog/encoding.go
index 2b4e4bf8c..9b4e9c6b6 100644
--- a/prog/encoding.go
+++ b/prog/encoding.go
@@ -201,6 +201,9 @@ func (target *Target) Deserialize(data []byte, mode DeserializeMode) (*Prog, err
 	if err := prog.validate(); err != nil {
 		return nil, err
 	}
+	if p.autos != nil {
+		p.fixupAutos(prog)
+	}
 	for _, c := range prog.Calls {
 		target.SanitizeCall(c)
 	}
@@ -340,9 +343,15 @@ func (p *parser) parseArgImpl(typ Type) (Arg, error) {
 		p.Parse('i')
 		p.Parse('l')
 		return nil, nil
+	case 'A':
+		p.Parse('A')
+		p.Parse('U')
+		p.Parse('T')
+		p.Parse('O')
+		return p.parseAuto(typ)
 	default:
-		return nil, fmt.Errorf("failed to parse argument at %v (line #%v/%v: %v)",
-			int(p.Char()), p.l, p.i, p.s)
+		return nil, fmt.Errorf("failed to parse argument at '%c' (line #%v/%v: %v)",
+			p.Char(), p.l, p.i, p.s)
 	}
 }
 
@@ -366,6 +375,15 @@ func (p *parser) parseArgInt(typ Type) (Arg, error) {
 	}
 }
 
+func (p *parser) parseAuto(typ Type) (Arg, error) {
+	switch typ.(type) {
+	case *ConstType, *LenType, *CsumType:
+		return p.auto(MakeConstArg(typ, 0)), nil
+	default:
+		return nil, fmt.Errorf("wrong type %T for AUTO", typ)
+	}
+}
+
 func (p *parser) parseArgRes(typ Type) (Arg, error) {
 	id := p.Ident()
 	var div, add uint64
@@ -409,9 +427,23 @@ func (p *parser) parseArgAddr(typ Type) (Arg, error) {
 		return typ.DefaultArg(), nil
 	}
 	p.Parse('&')
-	addr, vmaSize, err := p.parseAddr()
-	if err != nil {
-		return nil, err
+	auto := false
+	var addr, vmaSize uint64
+	if p.Char() == 'A' {
+		p.Parse('A')
+		p.Parse('U')
+		p.Parse('T')
+		p.Parse('O')
+		if typ1 == nil {
+			return nil, fmt.Errorf("vma type can't be AUTO")
+		}
+		auto = true
+	} else {
+		var err error
+		addr, vmaSize, err = p.parseAddr()
+		if err != nil {
+			return nil, err
+		}
 	}
 	var inner Arg
 	if p.Char() == '=' {
@@ -424,6 +456,7 @@ func (p *parser) parseArgAddr(typ Type) (Arg, error) {
 			typ = p.target.makeAnyPtrType(typ.Size(), typ.FieldName())
 			typ1 = p.target.any.array
 		}
+		var err error
 		inner, err = p.parseArg(typ1)
 		if err != nil {
 			return nil, err
@@ -435,7 +468,11 @@ func (p *parser) parseArgAddr(typ Type) (Arg, error) {
 	if inner == nil {
 		inner = typ1.DefaultArg()
 	}
-	return MakePointerArg(typ, addr, inner), nil
+	arg := MakePointerArg(typ, addr, inner)
+	if auto {
+		p.auto(arg)
+	}
+	return arg, nil
 }
 
 func (p *parser) parseArgString(typ Type) (Arg, error) {
@@ -801,6 +838,7 @@ type parser struct {
 	target  *Target
 	strict  bool
 	vars    map[string]*ResultArg
+	autos   map[Arg]bool
 	comment string
 
 	r *bufio.Scanner
@@ -821,6 +859,41 @@ func newParser(target *Target, data []byte, strict bool) *parser {
 	return p
 }
 
+func (p *parser) auto(arg Arg) Arg {
+	if p.autos == nil {
+		p.autos = make(map[Arg]bool)
+	}
+	p.autos[arg] = true
+	return arg
+}
+
+func (p *parser) fixupAutos(prog *Prog) {
+	s := analyze(nil, prog, nil)
+	for _, c := range prog.Calls {
+		p.target.assignSizesArray(c.Args, p.autos)
+		ForeachArg(c, func(arg Arg, _ *ArgCtx) {
+			if !p.autos[arg] {
+				return
+			}
+			delete(p.autos, arg)
+			switch typ := arg.Type().(type) {
+			case *ConstType:
+				arg.(*ConstArg).Val = typ.Val
+				_ = s
+			case *PtrType:
+				a := arg.(*PointerArg)
+				a.Address = s.ma.alloc(nil, a.Res.Size())
+			default:
+				panic(fmt.Sprintf("unsupported auto type %T", typ))
+
+			}
+		})
+	}
+	if len(p.autos) != 0 {
+		panic(fmt.Sprintf("leftoever autos: %+v", p.autos))
+	}
+}
+
 func (p *parser) Scan() bool {
 	if p.e != nil {
 		return false
diff --git a/prog/encoding_test.go b/prog/encoding_test.go
index acaf642d5..ac670a8ab 100644
--- a/prog/encoding_test.go
+++ b/prog/encoding_test.go
@@ -245,6 +245,14 @@ func TestDeserialize(t *testing.T) {
 			input:  `test$excessive_fields1(0xfffffffffffffffc)`,
 			output: `test$excessive_fields1(0xffffffffffffffff)`,
 		},
+		{
+			input:  `test$auto0(AUTO, &AUTO={AUTO, AUTO, 0x1}, AUTO, 0x0)`,
+			output: `test$auto0(0x42, &(0x7f0000000040)={0xc, 0x43, 0x1}, 0xc, 0x0)`,
+		},
+		{
+			input: `test$auto0(AUTO, &AUTO={AUTO, AUTO, AUTO}, AUTO, 0x0)`,
+			err:   regexp.MustCompile(`wrong type \*prog\.IntType for AUTO`),
+		},
 	}
 	buf := make([]byte, ExecBufferSize)
 	for _, test := range tests {
diff --git a/prog/size.go b/prog/size.go
index c16e7f647..8c95d9c6f 100644
--- a/prog/size.go
+++ b/prog/size.go
@@ -33,7 +33,7 @@ func (target *Target) generateSize(arg Arg, lenType *LenType) uint64 {
 	}
 }
 
-func (target *Target) assignSizes(args []Arg, parentsMap map[Arg]Arg) {
+func (target *Target) assignSizes(args []Arg, parentsMap map[Arg]Arg, autos map[Arg]bool) {
 	// Create a map from field names to args.
 	argsMap := make(map[string]Arg)
 	for _, arg := range args {
@@ -44,54 +44,58 @@ func (target *Target) assignSizes(args []Arg, parentsMap map[Arg]Arg) {
 	}
 
 	// Fill in size arguments.
+nextArg:
 	for _, arg := range args {
 		if arg = InnerArg(arg); arg == nil {
 			continue // Pointer to optional len field, no need to fill in value.
 		}
-		if typ, ok := arg.Type().(*LenType); ok {
-			a := arg.(*ConstArg)
-
-			buf, ok := argsMap[typ.Buf]
-			if ok {
-				a.Val = target.generateSize(InnerArg(buf), typ)
+		typ, ok := arg.Type().(*LenType)
+		if !ok {
+			continue
+		}
+		if autos != nil {
+			if !autos[arg] {
 				continue
 			}
+			delete(autos, arg)
+		}
+		a := arg.(*ConstArg)
 
-			if typ.Buf == "parent" {
-				a.Val = parentsMap[arg].Size()
-				if typ.BitSize != 0 {
-					a.Val = a.Val * 8 / typ.BitSize
-				}
-				continue
+		buf, ok := argsMap[typ.Buf]
+		if ok {
+			a.Val = target.generateSize(InnerArg(buf), typ)
+			continue
+		}
+
+		if typ.Buf == "parent" {
+			a.Val = parentsMap[arg].Size()
+			if typ.BitSize != 0 {
+				a.Val = a.Val * 8 / typ.BitSize
 			}
+			continue
+		}
 
-			sizeAssigned := false
-			for parent := parentsMap[arg]; parent != nil; parent = parentsMap[parent] {
-				parentName := parent.Type().Name()
-				if pos := strings.IndexByte(parentName, '['); pos != -1 {
-					// For template parents, strip arguments.
-					parentName = parentName[:pos]
-				}
-				if typ.Buf == parentName {
-					a.Val = parent.Size()
-					if typ.BitSize != 0 {
-						a.Val = a.Val * 8 / typ.BitSize
-					}
-					sizeAssigned = true
-					break
-				}
+		for parent := parentsMap[arg]; parent != nil; parent = parentsMap[parent] {
+			parentName := parent.Type().Name()
+			if pos := strings.IndexByte(parentName, '['); pos != -1 {
+				// For template parents, strip arguments.
+				parentName = parentName[:pos]
 			}
-			if sizeAssigned {
+			if typ.Buf != parentName {
 				continue
 			}
-
-			panic(fmt.Sprintf("len field '%v' references non existent field '%v', argsMap: %+v",
-				typ.FieldName(), typ.Buf, argsMap))
+			a.Val = parent.Size()
+			if typ.BitSize != 0 {
+				a.Val = a.Val * 8 / typ.BitSize
+			}
+			continue nextArg
 		}
+		panic(fmt.Sprintf("len field '%v' references non existent field '%v', argsMap: %+v",
+			typ.FieldName(), typ.Buf, argsMap))
 	}
 }
 
-func (target *Target) assignSizesArray(args []Arg) {
+func (target *Target) assignSizesArray(args []Arg, autos map[Arg]bool) {
 	parentsMap := make(map[Arg]Arg)
 	for _, arg := range args {
 		ForeachSubArg(arg, func(arg Arg, _ *ArgCtx) {
@@ -102,18 +106,18 @@ func (target *Target) assignSizesArray(args []Arg) {
 			}
 		})
 	}
-	target.assignSizes(args, parentsMap)
+	target.assignSizes(args, parentsMap, autos)
 	for _, arg := range args {
 		ForeachSubArg(arg, func(arg Arg, _ *ArgCtx) {
 			if _, ok := arg.Type().(*StructType); ok {
-				target.assignSizes(arg.(*GroupArg).Inner, parentsMap)
+				target.assignSizes(arg.(*GroupArg).Inner, parentsMap, autos)
 			}
 		})
 	}
 }
 
 func (target *Target) assignSizesCall(c *Call) {
-	target.assignSizesArray(c.Args)
+	target.assignSizesArray(c.Args, nil)
 }
 
 func (r *randGen) mutateSize(arg *ConstArg, parent []Arg) bool {
diff --git a/prog/target.go b/prog/target.go
index 360e2e60f..b64af0027 100644
--- a/prog/target.go
+++ b/prog/target.go
@@ -212,7 +212,7 @@ func (g *Gen) GenerateSpecialArg(typ Type, pcalls *[]*Call) Arg {
 func (g *Gen) generateArg(typ Type, pcalls *[]*Call, ignoreSpecial bool) Arg {
 	arg, calls := g.r.generateArgImpl(g.s, typ, ignoreSpecial)
 	*pcalls = append(*pcalls, calls...)
-	g.r.target.assignSizesArray([]Arg{arg})
+	g.r.target.assignSizesArray([]Arg{arg}, nil)
 	return arg
 }
 
diff --git a/sys/linux/test/binfmt b/sys/linux/test/binfmt
index 9ab905824..8998c6226 100644
--- a/sys/linux/test/binfmt
+++ b/sys/linux/test/binfmt
@@ -1,16 +1,16 @@
 # Tests for binfmt_misc.
 # Executor setups binfmt_misc with ./file0 interpreter for files with byte 0x01 at offset 0.
 
-execveat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', &(0x7f0000000100)=[0x0], &(0x7f0000000200)=[0x0], 0x0) # ENOENT
-r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x42, 0x1ff)
+execveat(0xffffffffffffff9c, &AUTO='./file1\x00', &AUTO=[0x0], &AUTO=[0x0], 0x0) # ENOENT
+r0 = openat(0xffffffffffffff9c, &AUTO='./file1\x00', 0x42, 0x1ff)
 close(r0)
-execveat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', &(0x7f0000000100)=[0x0], &(0x7f0000000200)=[0x0], 0x0) # ENOEXEC
-r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x2, 0x0)
-write(r1, &(0x7f0000000300)="01010101", 0x4)
+execveat(0xffffffffffffff9c, &AUTO='./file1\x00', &AUTO=[0x0], &AUTO=[0x0], 0x0) # ENOEXEC
+r1 = openat(0xffffffffffffff9c, &AUTO='./file1\x00', 0x2, 0x0)
+write(r1, &AUTO="01010101", 0x4)
 close(r1)
-execveat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', &(0x7f0000000100)=[0x0], &(0x7f0000000200)=[0x0], 0x0) # ENOENT
-r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x0)
+execveat(0xffffffffffffff9c, &AUTO='./file1\x00', &AUTO=[0x0], &AUTO=[0x0], 0x0) # ENOENT
+r2 = openat(0xffffffffffffff9c, &AUTO='./file0\x00', 0x42, 0x0)
 close(r2)
-execveat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', &(0x7f0000000100)=[0x0], &(0x7f0000000200)=[0x0], 0x0) # EACCES
-fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x1ff)
-execveat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', &(0x7f0000000100)=[0x0], &(0x7f0000000200)=[0x0], 0x0) # ENOEXEC
+execveat(0xffffffffffffff9c, &AUTO='./file1\x00', &AUTO=[0x0], &AUTO=[0x0], 0x0) # EACCES
+fchmodat(0xffffffffffffff9c, &AUTO='./file0\x00', 0x1ff)
+execveat(0xffffffffffffff9c, &AUTO='./file1\x00', &AUTO=[0x0], &AUTO=[0x0], 0x0) # ENOEXEC
diff --git a/sys/linux/test/cgroup b/sys/linux/test/cgroup
index db6fb7317..f06d87ac8 100644
--- a/sys/linux/test/cgroup
+++ b/sys/linux/test/cgroup
@@ -4,12 +4,12 @@
 # requires: -sandbox= -sandbox=setuid -C,norepeat
 
 r0 = getpid()
-r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/cgroup.procs\x00', 0x2, 0x0)
-read(r1, &(0x7f0000000100)="00", 0x1)
-write$cgroup_pid(r1, &(0x7f0000000100)=r0, 0x12)
+r1 = openat(0xffffffffffffff9c, &AUTO='./cgroup/cgroup.procs\x00', 0x2, 0x0)
+read(r1, &AUTO="00", AUTO)
+write$cgroup_pid(r1, &AUTO=r0, AUTO)
 close(r1)
-openat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/pids.max\x00', 0x2, 0x0)
-openat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/cgroup.procs\x00', 0x2, 0x0)
-openat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/cpuset.cpus\x00', 0x2, 0x0)
-openat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/cgroup.procs\x00', 0x2, 0x0)
-openat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/devices.allow\x00', 0x1, 0x0)
+openat(0xffffffffffffff9c, &AUTO='./cgroup/pids.max\x00', 0x2, 0x0)
+openat(0xffffffffffffff9c, &AUTO='./cgroup.cpu/cgroup.procs\x00', 0x2, 0x0)
+openat(0xffffffffffffff9c, &AUTO='./cgroup.cpu/cpuset.cpus\x00', 0x2, 0x0)
+openat(0xffffffffffffff9c, &AUTO='./cgroup.net/cgroup.procs\x00', 0x2, 0x0)
+openat(0xffffffffffffff9c, &AUTO='./cgroup.net/devices.allow\x00', 0x1, 0x0)
diff --git a/sys/linux/test/file_immutable b/sys/linux/test/file_immutable
index e6a18240b..61ad6b36a 100644
--- a/sys/linux/test/file_immutable
+++ b/sys/linux/test/file_immutable
@@ -3,8 +3,8 @@
 # It also requires root, so will fail with setuid.
 # requires: -sandbox=namespace -sandbox=setuid
 
-r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x26e1, 0x0)
-ioctl$FS_IOC_FSSETXATTR(r0, 0x40086602, &(0x7f0000000100)={0x17e})
-mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x1ff)
-r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0x0, 0x0)
-ioctl$FS_IOC_FSSETXATTR(r1, 0x40086602, &(0x7f0000000100)={0x17e})
+r0 = openat(0xffffffffffffff9c, &AUTO='./file0\x00', 0x26e1, 0x0)
+ioctl$FS_IOC_FSSETXATTR(r0, 0x40086602, &AUTO={0x17e, 0x0, 0x0, 0x0, 0x0, 0x0})
+mkdirat(0xffffffffffffff9c, &AUTO='./file1\x00', 0x1ff)
+r1 = openat(0xffffffffffffff9c, &AUTO='./file1\x00', 0x0, 0x0)
+ioctl$FS_IOC_FSSETXATTR(r1, 0x40086602, &AUTO={0x17e, 0x0, 0x0, 0x0, 0x0, 0x0})
diff --git a/sys/linux/test/fuse_deadlock b/sys/linux/test/fuse_deadlock
index 844bfe701..897977fb3 100644
--- a/sys/linux/test/fuse_deadlock
+++ b/sys/linux/test/fuse_deadlock
@@ -1,11 +1,11 @@
 # Test how we avoid fuse deadlocks in kill_and_wait.
 # requires: threaded -sandbox= -C,norepeat
 
-mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
-r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000640)='/dev/fuse\x00', 0x2, 0x0)
-mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id', 0x3d}, 0x2c, {'group_id', 0x3d}, 0x2c})
-read$FUSE(r0, &(0x7f0000002000), 0x1000)
-pread64(r0, &(0x7f0000000540)=""/236, 0xec, 0x0) # blocked
-write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1b}}, 0x50)
-mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./file0/file0\x00', 0x0) # unfinished
-write$FUSE_NOTIFY_INVAL_ENTRY(r0, &(0x7f00000000c0)={0x29, 0x3, 0x0, {0x1, 0x8, 0x0, 'group_id'}}, 0x29) # unfinished
+mkdirat(0xffffffffffffff9c, &AUTO='./file0\x00', 0x0)
+r0 = openat$fuse(0xffffffffffffff9c, &AUTO='/dev/fuse\x00', 0x2, 0x0)
+mount$fuse(0x0, &AUTO='./file0\x00', &AUTO='fuse\x00', 0x0, &AUTO={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id', 0x3d, 0x0}, 0x2c, {'group_id', 0x3d, 0x0}, 0x2c, {[], [], 0x0}})
+read$FUSE(r0, &AUTO=""/4096, AUTO)
+pread64(r0, &AUTO=""/236, AUTO, 0x0) # blocked
+write$FUSE_INIT(r0, &AUTO={AUTO, 0x0, 0x1, {AUTO, AUTO, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}, AUTO)
+mkdirat(0xffffffffffffff9c, &AUTO='./file0/file0\x00', 0x0) # unfinished
+write$FUSE_NOTIFY_INVAL_ENTRY(r0, &AUTO={AUTO, 0x3, 0x0, {0x1, AUTO, 0x0, 'group_id', 0x0}}, AUTO) # unfinished
diff --git a/sys/linux/test/vnet_tun b/sys/linux/test/vnet_tun
index bb88fc9d6..c1b08e695 100644
--- a/sys/linux/test/vnet_tun
+++ b/sys/linux/test/vnet_tun
@@ -1,2 +1,2 @@
-syz_emit_ethernet()
-syz_emit_ethernet()
+syz_emit_ethernet(0x0, 0x0, 0x0)
+syz_emit_ethernet(0x0, 0x0, 0x0)
diff --git a/sys/test/gen/64.go b/sys/test/gen/64.go
index 1abe96317..d3c24241d 100644
--- a/sys/test/gen/64.go
+++ b/sys/test/gen/64.go
@@ -65,6 +65,11 @@ var structDescs_64 = []*KeyedStruct{
 		&IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int8", FldName: "i8", TypeSize: 1}}},
 		&IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", FldName: "i32", TypeSize: 4}}},
 	}}},
+	{Key: StructKey{Name: "auto_struct0"}, Desc: &StructDesc{TypeCommon: TypeCommon{TypeName: "auto_struct0", TypeSize: 12}, Fields: []Type{
+		&LenType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "len", FldName: "f0", TypeSize: 4}}, Buf: "parent"},
+		&ConstType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "const", FldName: "f1", TypeSize: 4}}, Val: 67},
+		&IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", FldName: "f2", TypeSize: 4}}},
+	}}},
 	{Key: StructKey{Name: "compare_data"}, Desc: &StructDesc{TypeCommon: TypeCommon{TypeName: "compare_data", IsVarlen: true}, Fields: []Type{
 		&StructType{Key: StructKey{Name: "align0"}, FldName: "align0"},
 		&StructType{Key: StructKey{Name: "syz_bf_struct0"}, FldName: "bf0"},
@@ -660,6 +665,12 @@ var syscalls_64 = []*Syscall{
 	{Name: "test$array2", CallName: "test", Args: []Type{
 		&PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "a0", TypeSize: 8}, Type: &StructType{Key: StructKey{Name: "syz_array_blob"}}},
 	}},
+	{Name: "test$auto0", CallName: "test", Args: []Type{
+		&ConstType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "const", FldName: "a", TypeSize: 8}}, Val: 66},
+		&PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "b", TypeSize: 8}, Type: &StructType{Key: StructKey{Name: "auto_struct0"}}},
+		&LenType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "len", FldName: "c", TypeSize: 8}}, Buf: "b"},
+		&IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", FldName: "d", TypeSize: 4}}},
+	}},
 	{Name: "test$bf0", CallName: "test", Args: []Type{
 		&PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "a0", TypeSize: 8}, Type: &StructType{Key: StructKey{Name: "syz_bf_struct0"}}},
 	}},
@@ -929,4 +940,4 @@ var consts_64 = []ConstValue{
 	{Name: "SYS_unsupported"},
 }
 
-const revision_64 = "82736d421a5d52db6df0775561f1e59cc6cb9014"
+const revision_64 = "ece48c7de48771745acdea340f4c52c47e058e65"
diff --git a/sys/test/test.txt b/sys/test/test.txt
index aadf704b4..214c42c6c 100644
--- a/sys/test/test.txt
+++ b/sys/test/test.txt
@@ -703,3 +703,13 @@ unsupported$1(a unsupported) unsupported
 fallback$0() fd
 fallback$1(a fd)
 seccomp()
+
+# AUTO
+
+test$auto0(a const[0x42], b ptr[in, auto_struct0], c len[b], d int32)
+
+auto_struct0 {
+	f0	len[parent, int32]
+	f1	const[0x43, int32]
+	f2	int32
+}
diff --git a/sys/test/test/align0 b/sys/test/test/align0
index e2e5b9275..426b6e2de 100644
--- a/sys/test/test/align0
+++ b/sys/test/test/align0
@@ -1,3 +1,3 @@
-syz_compare(&(0x7f0000000000)="010000000200000003000400000000000500000000000000", 0x18, &(0x7f0000001000)=@align0={0x1, 0x2, 0x3, 0x4, 0x5}, 0x18)
-syz_compare(&(0x7f0000000000)="", 0x18, &(0x7f0000001000)=@align0={0x0, 0x0, 0x0, 0x0, 0x0}, 0x17) # EBADF
-syz_compare(&(0x7f0000000000)="", 0x18, &(0x7f0000001000)=@align0={0x1, 0x0, 0x0, 0x0, 0x0}, 0x18) # EINVAL
+syz_compare(&AUTO="010000000200000003000400000000000500000000000000", 0x18, &AUTO=@align0={0x1, 0x2, 0x3, 0x4, 0x5}, AUTO)
+syz_compare(&AUTO="", 0x18, &AUTO=@align0={0x0, 0x0, 0x0, 0x0, 0x0}, 0x17) # EBADF
+syz_compare(&AUTO="", 0x18, &AUTO=@align0={0x1, 0x0, 0x0, 0x0, 0x0}, AUTO) # EINVAL
diff --git a/sys/test/test/bf b/sys/test/test/bf
index bc43b1fb4..4e43b989b 100644
--- a/sys/test/test/bf
+++ b/sys/test/test/bf
@@ -1,5 +1,3 @@
-syz_compare(&(0x7f0000000000)="ab03000000000000cdcdcdcdcdcdcdcdeb070000ff7f0000ab0303abaa000000", 0x20, &(0x7f0000001000)=@bf0={0xabab, 0xcdcdcdcdcdcdcdcd, 0xabab, 0xffff, 0xffffff, 0xabab, 0xabab, 0xaaa}, 0x20)
-
-syz_compare(&(0x7f0000002000)="dcfcde563422f10e", 0x8, &(0x7f0000003000)=@bf2={0x0abc, 0x0bcd, 0xcdef, 0x123456, 0x78ef12}, 0x8)
-
-syz_compare(&(0x7f0000004000)="0ef1223456defcdc", 0x8, &(0x7f0000005000)=@bf3={0x0abc, 0x0bcd, 0xcdef, 0x123456, 0x78ef12}, 0x8)
+syz_compare(&AUTO="ab03000000000000cdcdcdcdcdcdcdcdeb070000ff7f0000ab0303abaa000000", 0x20, &AUTO=@bf0={0xabab, 0xcdcdcdcdcdcdcdcd, 0xabab, 0xffff, 0xffffff, 0xabab, 0xabab, 0xaaa}, AUTO)
+syz_compare(&AUTO="dcfcde563422f10e", 0x8, &AUTO=@bf2={0x0abc, 0x0bcd, 0xcdef, 0x123456, 0x78ef12}, AUTO)
+syz_compare(&AUTO="0ef1223456defcdc", 0x8, &AUTO=@bf3={0x0abc, 0x0bcd, 0xcdef, 0x123456, 0x78ef12}, AUTO)