sys/linux: add iommufd descriptions

3 files changed, 429 insertions, 0 deletions

diff --git a/sys/linux/dev_iommu.txt b/sys/linux/dev_iommu.txt
new file mode 100644
index 000000000..39198fc00
--- /dev/null
+++ b/sys/linux/dev_iommu.txt
@@ -0,0 +1,319 @@
+# Copyright 2022 syzkaller project authors. All rights reserved.
+# Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.
+
+# https://elixir.bootlin.com/linux/latest/source/include/uapi/linux/iommufd.h
+# https://elixir.bootlin.com/linux/latest/source/drivers/iommu/iommufd/main.c
+
+include <uapi/linux/fcntl.h>
+include <uapi/linux/iommufd.h>
+include <uapi/linux/vfio.h>
+
+resource fd_iommufd[fd]
+resource ioas_handle[int32]
+
+openat$iommufd(fd const[AT_FDCWD], file ptr[in, string["/dev/iommu"]], flags flags[open_flags], mode const[0]) fd_iommufd
+
+ioctl$IOMMU_DESTROY$ioas(fd fd_iommufd, cmd const[IOMMU_DESTROY], arg ptr[in, iommu_destroy$ioas])
+
+ioctl$IOMMU_IOAS_ALLOC(fd fd_iommufd, cmd const[IOMMU_IOAS_ALLOC], arg ptr[in, iommu_ioas_alloc])
+ioctl$IOMMU_IOAS_IOVA_RANGES(fd fd_iommufd, cmd const[IOMMU_IOAS_IOVA_RANGES], arg ptr[in, iommu_ioas_iova_ranges])
+ioctl$IOMMU_IOAS_ALLOW_IOVAS(fd fd_iommufd, cmd const[IOMMU_IOAS_ALLOW_IOVAS], arg ptr[in, iommu_ioas_allow_iovas])
+ioctl$IOMMU_IOAS_MAP(fd fd_iommufd, cmd const[IOMMU_IOAS_MAP], arg ptr[in, iommu_ioas_map])
+ioctl$IOMMU_IOAS_MAP$PAGES(fd fd_iommufd, cmd const[IOMMU_IOAS_MAP], arg ptr[in, iommu_ioas_map$PAGES])
+ioctl$IOMMU_IOAS_COPY(fd fd_iommufd, cmd const[IOMMU_IOAS_COPY], arg ptr[in, iommu_ioas_copy])
+ioctl$IOMMU_IOAS_COPY$syz(fd fd_iommufd, cmd const[IOMMU_IOAS_COPY], arg ptr[in, iommu_ioas_copy$syz])
+ioctl$IOMMU_IOAS_UNMAP(fd fd_iommufd, cmd const[IOMMU_IOAS_UNMAP], arg ptr[in, iommu_ioas_unmap])
+ioctl$IOMMU_IOAS_UNMAP$ALL(fd fd_iommufd, cmd const[IOMMU_IOAS_UNMAP], arg ptr[in, iommu_ioas_unmap$ALL])
+
+ioctl$IOMMU_OPTION$IOMMU_OPTION_RLIMIT_MODE(fd fd_iommufd, cmd const[IOMMU_OPTION], arg ptr[in, iommu_option$IOMMU_OPTION_RLIMIT_MODE])
+ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(fd fd_iommufd, cmd const[IOMMU_OPTION], arg ptr[in, iommu_option$IOMMU_OPTION_HUGE_PAGES])
+
+ioctl$IOMMU_VFIO_IOAS$GET(fd fd_iommufd, cmd const[IOMMU_VFIO_IOAS], arg ptr[in, iommu_vfio_ioas$GET])
+ioctl$IOMMU_VFIO_IOAS$SET(fd fd_iommufd, cmd const[IOMMU_VFIO_IOAS], arg ptr[in, iommu_vfio_ioas$SET])
+ioctl$IOMMU_VFIO_IOAS$CLEAR(fd fd_iommufd, cmd const[IOMMU_VFIO_IOAS], arg ptr[in, iommu_vfio_ioas$CLEAR])
+
+# VFIO compatibility ioctls
+# This shares a few structs with dev_vfio.txt
+ioctl$IOMMU_VFIO_GET_API_VERSION(fd fd_iommufd, cmd const[VFIO_GET_API_VERSION])
+ioctl$IOMMU_VFIO_SET_IOMMU(fd fd_iommufd, cmd const[VFIO_SET_IOMMU], arg flags[iommu_type])
+ioctl$IOMMU_VFIO_CHECK_EXTENSION(fd fd_iommufd, cmd const[VFIO_CHECK_EXTENSION], arg flags[iommu_extension])
+ioctl$IOMMU_VFIO_IOMMU_GET_INFO(fd fd_iommufd, cmd const[VFIO_IOMMU_GET_INFO], arg ptr[inout, vfio_iommu_type1_info])
+
+ioctl$IOMMU_VFIO_IOMMU_MAP_DMA(fd fd_iommufd, cmd const[VFIO_IOMMU_MAP_DMA], arg ptr[in, vfio_iommu_type1_dma_map])
+ioctl$IOMMU_VFIO_IOMMU_UNMAP_DMA(fd fd_iommufd, cmd const[VFIO_IOMMU_UNMAP_DMA], arg ptr[in, vfio_iommu_type1_dma_unmap])
+
+iommu_destroy$ioas {
+	size	len[parent, int32]
+	id	ioas_handle
+}
+
+iommu_ioas_alloc {
+	size		len[parent, int32]
+	flags		const[0, int32]
+	out_ioas_id	ioas_handle	(out)
+}
+
+iommu_ioas_iova_ranges {
+	size			len[parent, int32]
+	ioas_id			ioas_handle
+	num_iovas		len[allowed_iovas, int32]
+	__reserved		const[0x0, int32]
+	allowed_iovas		ptr64[out, array[iommu_iova_range]]
+	out_iova_alignment	int64	(out)
+}
+
+iommu_ioas_allow_iovas {
+	size		len[parent, int32]
+	ioas_id		ioas_handle
+	num_iovas	len[allowed_iovas, int32]
+	__reserved	const[0x0, int32]
+	allowed_iovas	ptr64[in, array[iommu_iova_range]]
+}
+
+# user_va/length is a pointer to a chunk of memory
+# iova on output is the address that memory was placed at.
+# The iova/len pair must be used as an input to unmap
+# IOMMU_IOAS_MAP_FIXED_IOVA means iova is an input
+iommu_ioas_map {
+	size		len[parent, int32]
+	flags		flags[iommufd_ioas_map_flags, int32]
+	ioas_id		ioas_handle
+	__reserved	const[0x0, int32]
+	user_va		ptr64[in, array[int8]]
+	length		len[user_va, int64]
+	iova		int64	(inout)
+}
+
+# Version that guarantees 4k alignment, has a higher chance of success
+iommu_ioas_map$PAGES {
+	size		len[parent, int32]
+	flags		flags[iommufd_ioas_map_flags, int32]
+	ioas_id		ioas_handle
+	__reserved	const[0x0, int32]
+	user_va		vma64
+	length		len[user_va, int64]
+	iova		int64	(inout)
+}
+
+iommu_ioas_copy {
+	size		len[parent, int32]
+	flags		flags[iommufd_ioas_map_flags, int32]
+	dst_ioas_id	ioas_handle
+	src_ioas_id	ioas_handle
+	length		int64
+	dst_iova	int64	(inout)
+	src_iova	int64
+}
+
+iommu_ioas_copy$syz {
+	size		len[parent, int32]
+	flags		flags[iommufd_ioas_map_flags_syz, int32]
+	dst_ioas_id	ioas_handle
+	src_ioas_id	ioas_handle
+	length		int64[0:4194304]
+	dst_iova	int64	(inout)
+# See iommufd_test_syz_conv_iova_id()
+	nth_area	int32[0:10]
+	offset		int32[0:4194304]
+}
+
+iommu_ioas_unmap {
+	size	len[parent, int32]
+	ioas_id	ioas_handle
+	iova	int64
+	length	int64
+}
+
+iommu_ioas_unmap$ALL {
+	size	len[parent, int32]
+	ioas_id	ioas_handle
+	iova	const[0x0, int64]
+	length	const[-1, int64]
+}
+
+iommu_option$IOMMU_OPTION_RLIMIT_MODE {
+	size		len[parent, int32]
+	option_id	const[IOMMU_OPTION_RLIMIT_MODE, int32]
+	op		flags[iommufd_option_ops, int16]
+	__reserved	const[0x0, int16]
+	object_id	const[0x0, int32]
+	val64		int64	(inout)
+}
+
+iommu_option$IOMMU_OPTION_HUGE_PAGES {
+	size		len[parent, int32]
+	option_id	const[IOMMU_OPTION_HUGE_PAGES, int32]
+	op		flags[iommufd_option_ops, int16]
+	__reserved	const[0x0, int16]
+	object_id	ioas_handle
+	val64		int64	(inout)
+}
+
+iommu_vfio_ioas$GET {
+	size		len[parent, int32]
+	ioas_id		ioas_handle	(out)
+	opt		const[IOMMU_VFIO_IOAS_GET, int16]
+	__reserved	const[0x0, int16]
+}
+
+iommu_vfio_ioas$SET {
+	size		len[parent, int32]
+	ioas_id		ioas_handle
+	opt		const[IOMMU_VFIO_IOAS_SET, int16]
+	__reserved	const[0x0, int16]
+}
+
+iommu_vfio_ioas$CLEAR {
+	size		len[parent, int32]
+	ioas_id		const[0x0, int32]
+	opt		const[IOMMU_VFIO_IOAS_CLEAR, int16]
+	__reserved	const[0x0, int16]
+}
+
+iommu_iova_range {
+	start	int64
+	last	int64
+}
+
+iommufd_ioas_map_flags = IOMMU_IOAS_MAP_FIXED_IOVA, IOMMU_IOAS_MAP_WRITEABLE, IOMMU_IOAS_MAP_READABLE
+iommufd_ioas_map_flags_syz = MOCK_FLAGS_ACCESS_SYZ, IOMMU_IOAS_MAP_WRITEABLE, IOMMU_IOAS_MAP_READABLE, MOCK_FLAGS_ACCESS_SYZ, IOMMU_IOAS_MAP_READABLE
+iommufd_option_ops = IOMMU_OPTION_OP_SET, IOMMU_OPTION_OP_GET
+
+iommu_type = VFIO_TYPE1_IOMMU, VFIO_TYPE1v2_IOMMU
+iommu_extension = VFIO_TYPE1_IOMMU, VFIO_TYPE1v2_IOMMU, VFIO_UNMAP_ALL, VFIO_DMA_CC_IOMMU, VFIO_TYPE1_NESTING_IOMMU, VFIO_UPDATE_VADDR
+
+# This section requires CONFIG_IOMMUFD_TEST
+# It allows the kernel to provide a mock consumer of iommufd which allows greater coverage
+
+include <../drivers/iommu/iommufd/iommufd_test.h>
+
+define IOMMU_TEST_CMD_SIZE	sizeof(struct iommu_test_cmd)
+
+resource device_handle[int32]
+resource hwpt_handle[int32]
+resource fd_access[fd]
+resource access_pages_handle[int32]
+
+ioctl$IOMMU_TEST_OP_ADD_RESERVED(fd fd_iommufd, cmd const[IOMMU_TEST_CMD], arg ptr[in, iommu_test_cmd$add_reserved])
+ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(fd fd_iommufd, cmd const[IOMMU_TEST_CMD], arg ptr[in, iommu_test_cmd$mock_domain])
+ioctl$IOMMU_TEST_OP_CREATE_ACCESS(fd fd_iommufd, cmd const[IOMMU_TEST_CMD], arg ptr[in, iommu_test_cmd$create_access])
+ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(fd fd_iommufd, cmd const[IOMMU_TEST_CMD], arg ptr[in, iommu_test_cmd$destroy_access_pages])
+ioctl$IOMMU_TEST_OP_ACCESS_PAGES(fd fd_iommufd, cmd const[IOMMU_TEST_CMD], arg ptr[in, iommu_test_cmd$access_pages])
+ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(fd fd_iommufd, cmd const[IOMMU_TEST_CMD], arg ptr[in, iommu_test_cmd$access_pages$syz])
+ioctl$IOMMU_TEST_OP_ACCESS_RW(fd fd_iommufd, cmd const[IOMMU_TEST_CMD], arg ptr[in, iommu_test_cmd$access_rw])
+ioctl$IOMMU_TEST_OP_ACCESS_RW$syz(fd fd_iommufd, cmd const[IOMMU_TEST_CMD], arg ptr[in, iommu_test_cmd$access_rw$syz])
+ioctl$IOMMU_TEST_OP_SET_TEMP_MEMORY_LIMIT(fd fd_iommufd, cmd const[IOMMU_TEST_CMD], arg ptr[in, iommu_test_cmd$memory_limit])
+
+ioctl$IOMMU_DESTROY$device(fd fd_iommufd, cmd const[IOMMU_DESTROY], arg ptr[in, iommu_destroy$device])
+ioctl$IOMMU_DESTROY$hwpt(fd fd_iommufd, cmd const[IOMMU_DESTROY], arg ptr[in, iommu_destroy$hwpt])
+
+iommu_test_cmd$add_reserved {
+	size		len[parent, int32]
+	op		const[IOMMU_TEST_OP_ADD_RESERVED, int32]
+	id		ioas_handle
+	__reserved	const[0x0, int32]
+	start		int64
+	length		int64
+} [size[IOMMU_TEST_CMD_SIZE]]
+
+iommu_test_cmd$mock_domain {
+	size		len[parent, int32]
+	op		const[IOMMU_TEST_OP_MOCK_DOMAIN, int32]
+	id		ioas_handle
+	__reserved	const[0x0, int32]
+	out_device_id	device_handle	(out)
+	out_hwpt_id	hwpt_handle	(out)
+} [size[IOMMU_TEST_CMD_SIZE]]
+
+iommu_test_cmd$create_access {
+	size		len[parent, int32]
+	op		const[IOMMU_TEST_OP_CREATE_ACCESS, int32]
+	id		ioas_handle
+	__reserved	const[0x0, int32]
+	out_access_fd	fd_access	(out)
+	flags		flags[iommu_test_cmd_create_access_flags, int32]
+} [size[IOMMU_TEST_CMD_SIZE]]
+
+iommu_test_cmd$destroy_access_pages {
+	size		len[parent, int32]
+	op		const[IOMMU_TEST_OP_DESTROY_ACCESS_PAGES, int32]
+	id		ioas_handle
+	__reserved	const[0x0, int32]
+	access_pages_id	access_pages_handle
+} [size[IOMMU_TEST_CMD_SIZE]]
+
+iommu_test_cmd$access_pages {
+	size			len[parent, int32]
+	op			const[IOMMU_TEST_OP_ACCESS_PAGES, int32]
+	id			fd_access
+	__reserved		const[0x0, int32]
+	flags			flags[iommu_test_cmd_acess_pages_flags, int32]
+	out_access_pages_id	access_pages_handle	(out)
+	iova			int64
+	length			int64
+# The test suite uses uptr to confirm the pages are the right pages, 0 will disable the check
+	uptr			const[0x0, int64]
+} [size[IOMMU_TEST_CMD_SIZE]]
+
+iommu_test_cmd$access_pages$syz {
+	size			len[parent, int32]
+	op			const[IOMMU_TEST_OP_ACCESS_PAGES, int32]
+	id			fd_access
+	__reserved		const[0x0, int32]
+	flags			flags[iommu_test_cmd_acess_pages_flags_syz, int32]
+	out_access_pages_id	access_pages_handle	(out)
+# See iommufd_test_syz_conv_iova_id()
+	nth_area		int32[0:10]
+	offset			int32[0:4194304]
+	length			int64[0:4194304]
+# The test suite uses uptr to confirm the pages are the right pages, 0 will disable the check
+	uptr			const[0x0, int64]
+} [size[IOMMU_TEST_CMD_SIZE]]
+
+iommu_test_cmd$access_rw {
+	size		len[parent, int32]
+	op		const[IOMMU_TEST_OP_ACCESS_RW, int32]
+	id		fd_access
+	__reserved	const[0x0, int32]
+	iova		int64
+	length		len[uptr, int64]
+	uptr		ptr64[in, array[int8]]
+	flags		flags[iommu_test_cmd_acess_rw_flags, int32]
+} [size[IOMMU_TEST_CMD_SIZE]]
+
+iommu_test_cmd$access_rw$syz {
+	size		len[parent, int32]
+	op		const[IOMMU_TEST_OP_ACCESS_RW, int32]
+	id		fd_access
+	__reserved	const[0x0, int32]
+# See iommufd_test_syz_conv_iova_id()
+	nth_area	int32[0:10]
+	offset		int32[0:4194304]
+	length		len[uptr, int64]
+	uptr		ptr64[in, array[int8]]
+	flags		flags[iommu_test_cmd_acess_rw_flags_syz, int32]
+} [size[IOMMU_TEST_CMD_SIZE]]
+
+iommu_test_cmd$memory_limit {
+	size		len[parent, int32]
+	op		const[IOMMU_TEST_OP_SET_TEMP_MEMORY_LIMIT, int32]
+	id		const[0x0, int32]
+	__reserved	const[0x0, int32]
+	limit		int32
+} [size[IOMMU_TEST_CMD_SIZE]]
+
+iommu_destroy$device {
+	size	len[parent, int32]
+	id	device_handle
+}
+
+iommu_destroy$hwpt {
+	size	len[parent, int32]
+	id	hwpt_handle
+}
+
+iommu_test_cmd_create_access_flags = MOCK_FLAGS_ACCESS_CREATE_NEEDS_PIN_PAGES
+iommu_test_cmd_acess_pages_flags = MOCK_FLAGS_ACCESS_WRITE
+iommu_test_cmd_acess_pages_flags_syz = MOCK_FLAGS_ACCESS_SYZ, MOCK_FLAGS_ACCESS_WRITE
+iommu_test_cmd_acess_rw_flags = MOCK_ACCESS_RW_WRITE, MOCK_ACCESS_RW_SLOW_PATH
+iommu_test_cmd_acess_rw_flags_syz = MOCK_FLAGS_ACCESS_SYZ, MOCK_ACCESS_RW_WRITE, MOCK_ACCESS_RW_SLOW_PATH
diff --git a/sys/linux/dev_iommu.txt.const b/sys/linux/dev_iommu.txt.const
new file mode 100644
index 000000000..d80d36bb3
--- /dev/null
+++ b/sys/linux/dev_iommu.txt.const
@@ -0,0 +1,50 @@
+# Code generated by syz-sysgen. DO NOT EDIT.
+arches = 386, amd64, arm, arm64, mips64le, ppc64le, riscv64, s390x
+AT_FDCWD = 18446744073709551516
+IOMMU_DESTROY = 15232, mips64le:ppc64le:536886144
+IOMMU_IOAS_ALLOC = 15233, mips64le:ppc64le:536886145
+IOMMU_IOAS_ALLOW_IOVAS = 15234, mips64le:ppc64le:536886146
+IOMMU_IOAS_COPY = 15235, mips64le:ppc64le:536886147
+IOMMU_IOAS_IOVA_RANGES = 15236, mips64le:ppc64le:536886148
+IOMMU_IOAS_MAP = 15237, mips64le:ppc64le:536886149
+IOMMU_IOAS_MAP_FIXED_IOVA = 1
+IOMMU_IOAS_MAP_READABLE = 4
+IOMMU_IOAS_MAP_WRITEABLE = 2
+IOMMU_IOAS_UNMAP = 15238, mips64le:ppc64le:536886150
+IOMMU_OPTION = 15239, mips64le:ppc64le:536886151
+IOMMU_OPTION_HUGE_PAGES = 1
+IOMMU_OPTION_OP_GET = 1
+IOMMU_OPTION_OP_SET = 0
+IOMMU_OPTION_RLIMIT_MODE = 0
+IOMMU_TEST_CMD = 15264, mips64le:ppc64le:536886176
+IOMMU_TEST_CMD_SIZE = 56
+IOMMU_TEST_OP_ACCESS_PAGES = 7
+IOMMU_TEST_OP_ACCESS_RW = 8
+IOMMU_TEST_OP_ADD_RESERVED = 1
+IOMMU_TEST_OP_CREATE_ACCESS = 5
+IOMMU_TEST_OP_DESTROY_ACCESS_PAGES = 6
+IOMMU_TEST_OP_MOCK_DOMAIN = 2
+IOMMU_TEST_OP_SET_TEMP_MEMORY_LIMIT = 9
+IOMMU_VFIO_IOAS = 15240, mips64le:ppc64le:536886152
+IOMMU_VFIO_IOAS_CLEAR = 2
+IOMMU_VFIO_IOAS_GET = 0
+IOMMU_VFIO_IOAS_SET = 1
+MOCK_ACCESS_RW_SLOW_PATH = 4
+MOCK_ACCESS_RW_WRITE = 1
+MOCK_FLAGS_ACCESS_CREATE_NEEDS_PIN_PAGES = 1
+MOCK_FLAGS_ACCESS_SYZ = 65536
+MOCK_FLAGS_ACCESS_WRITE = 1
+VFIO_CHECK_EXTENSION = 15205, mips64le:ppc64le:536886117
+VFIO_DMA_CC_IOMMU = 4
+VFIO_GET_API_VERSION = 15204, mips64le:ppc64le:536886116
+VFIO_IOMMU_GET_INFO = 15216, mips64le:ppc64le:536886128
+VFIO_IOMMU_MAP_DMA = 15217, mips64le:ppc64le:536886129
+VFIO_IOMMU_UNMAP_DMA = 15218, mips64le:ppc64le:536886130
+VFIO_SET_IOMMU = 15206, mips64le:ppc64le:536886118
+VFIO_TYPE1_IOMMU = 1
+VFIO_TYPE1_NESTING_IOMMU = 6
+VFIO_TYPE1v2_IOMMU = 3
+VFIO_UNMAP_ALL = 9
+VFIO_UPDATE_VADDR = 10
+__NR_ioctl = 54, amd64:16, arm64:riscv64:29, mips64le:5015
+__NR_openat = 56, 386:295, amd64:257, arm:322, mips64le:5247, ppc64le:286, s390x:288
diff --git a/sys/linux/test/dev_iommu b/sys/linux/test/dev_iommu
new file mode 100644
index 000000000..57e4abe46
--- /dev/null
+++ b/sys/linux/test/dev_iommu
@@ -0,0 +1,60 @@
+r0 = openat$iommufd(0xffffffffffffff9c, &AUTO='/dev/iommu\x00', 0x0, 0x0)
+
+ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &AUTO={0xc, 0x0, <r1=>0x0})
+
+ioctl$IOMMU_IOAS_IOVA_RANGES(r0, 0x3b84, &AUTO={0x20, r1, 0x2, 0x0, &AUTO=[{0x0,0x0},{0x0,0x0}], 0x0})
+ioctl$IOMMU_IOAS_ALLOW_IOVAS(r0, 0x3b82, &AUTO={0x20, r1, 0x2, 0x0, &AUTO=[{0x0,0x1},{0x3,0x5}]})
+
+ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &AUTO={0x28, 0x7, r1, 0x0, &AUTO='LLLLLLLLLLLLLLLLLLLLLLLLLLLL', 0x1c, 0x1c})
+ioctl$IOMMU_IOAS_UNMAP$ALL(r0, 0x3b86, &AUTO={0x18, r1, 0, 0xFFFFFFFFFFFFFFFF})
+
+ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &AUTO={0x28, 0x7, r1, 0x0, &AUTO='LLLLLLLLLLLLLLLLLLLLLLLLLLLL', 0x1c, 0x2})
+ioctl$IOMMU_IOAS_UNMAP(r0, 0x3b86, &AUTO={0x18, r1, 0x2, 0x1c})
+
+ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &AUTO={0x28, 0x7, r1, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0})
+ioctl$IOMMU_IOAS_UNMAP$ALL(r0, 0x3b86, &AUTO={0x18, r1, 0, 0xFFFFFFFFFFFFFFFF})
+
+ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &AUTO={0xc, 0x0, <r2=>0x0})
+ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &AUTO={0x28, 0x7, r1, 0x0, &AUTO='LLLLLLLLLLLLLLLLLLLLLLLLLLLL', 0x1c, 0x2})
+ioctl$IOMMU_IOAS_COPY(r0, 0x3b83, &AUTO={0x28, 0x7, r2, r1, 0x1c, 0x3, 0x2})
+ioctl$IOMMU_IOAS_UNMAP(r0, 0x3b86, &AUTO={0x18, r2, 0x3, 0x1c})
+ioctl$IOMMU_DESTROY$ioas(r0, 0x3b80, &AUTO={0x8, r2})
+ioctl$IOMMU_IOAS_UNMAP$ALL(r0, 0x3b86, &AUTO={0x18, r1, 0, 0xFFFFFFFFFFFFFFFF})
+
+ioctl$IOMMU_OPTION$IOMMU_OPTION_RLIMIT_MODE(r0, 0x3b87, &AUTO={0x18, 0x0, 0x1, 0x0, 0x0, 0x0})
+ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r0, 0x3b87, &AUTO={0x18, 0x1, 0x1, 0x0, r1, 0x0})
+
+ioctl$IOMMU_VFIO_IOAS$SET(r0, 0x3b88, &AUTO={0xc, r1, 0x1, 0x0})
+ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &AUTO={0xc, 0x0, 0x0, 0x0})
+ioctl$IOMMU_VFIO_IOAS$CLEAR(r0, 0x3b88, &AUTO={0xc, 0x0, 0x2, 0x0})
+
+ioctl$IOMMU_IOAS_ALLOW_IOVAS(r0, 0x3b82, &AUTO={0x20, r1, 0x0, 0x0, &AUTO=[]})
+
+ioctl$IOMMU_VFIO_IOAS$SET(r0, 0x3b88, &AUTO={0xc, r1, 0x1, 0x0})
+ioctl$IOMMU_VFIO_GET_API_VERSION(r0, 0x3b64)
+ioctl$IOMMU_VFIO_SET_IOMMU(r0, 0x3b66, 0x3)
+ioctl$IOMMU_VFIO_CHECK_EXTENSION(r0, 0x3b65, 0x9)
+ioctl$IOMMU_VFIO_IOMMU_GET_INFO(r0, 0x3b70, &AUTO={0x70, 0x0, 0x0, 0x0, {{0x0, 0x0, 0x0}, 0x0}, {{0x0, 0x0, 0x0}, 0x0, 0x0, [{0x0, 0x0}]}})
+ioctl$IOMMU_VFIO_IOMMU_MAP_DMA(r0, 0x3b71, &AUTO={0x20, 0x0, &AUTO='LLLLLLLLLLLLLLLLLLLLLLLLLLLL', 0x1c, 0x1c})
+ioctl$IOMMU_VFIO_IOMMU_UNMAP_DMA(r0, 0x3b72, &AUTO={0x18, 0x0, 0x1c, 0x1c, ''})
+ioctl$IOMMU_IOAS_UNMAP$ALL(r0, 0x3b86, &AUTO={0x18, r1, 0, 0xFFFFFFFFFFFFFFFF})
+
+ioctl$IOMMU_TEST_OP_ADD_RESERVED(r0, 0x3ba0, &AUTO={0x38, 0x1, r1, 0x0, 0x1000, 0x2000})
+
+ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &AUTO={0x38, 0x2, r1, 0x0, <r2=>0x0, <r3=>0x0})
+ioctl$IOMMU_DESTROY$device(r0, 0x3b80, &AUTO={0x8, r2})
+ioctl$IOMMU_DESTROY$hwpt(r0, 0x3b80, &AUTO={0x8, r3})
+
+ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &AUTO={0x38, 0x5, r1, 0x0, <r2=>0x0, 0x1})
+
+ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &AUTO={0x28, 0x7, r1, 0x0, &(0x7f00000a0000)='LLLLLLLLLLLLLLLLLLLLLLLLLLLL', 0x1000, 0x0})
+ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r0, 0x3ba0, &AUTO={0x38, 0x7, r2, 0x0, 0x0, <r3=>0x0, 0x0, 0x1000, 0x0})
+ioctl$IOMMU_TEST_OP_ACCESS_RW(r0, 0x3ba0, &AUTO={0x38, 0x8, r2, 0x0, 0x0, 0x10, &AUTO='LLLLLLLLLLLLLLLLLLLLLLLLLLLL', 0x0})
+ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &AUTO={0x38, 0x6, r2, 0x0, r3})
+close(r2)
+
+ioctl$IOMMU_TEST_OP_SET_TEMP_MEMORY_LIMIT(r0, 0x3ba0, &AUTO={0x38, 0x9, 0x0, 0x0, 0x10})
+
+ioctl$IOMMU_DESTROY$ioas(r0, 0x3b80, &AUTO={0x8, r1})
+
+close(r0)