diff --git a/pkg/abi/linux/vfio.go b/pkg/abi/linux/vfio.go
index 269a3ecf4..3e00dcbf8 100644
--- a/pkg/abi/linux/vfio.go
+++ b/pkg/abi/linux/vfio.go
@@ -30,5 +30,6 @@ const (
 // IOCTLs for VFIO file descriptor from include/uapi/linux/vfio.h.
 var (
 	VFIO_CHECK_EXTENSION     = IO(VFIO_TYPE, VFIO_BASE+1)
+	VFIO_SET_IOMMU           = IO(VFIO_TYPE, VFIO_BASE+2)
 	VFIO_GROUP_SET_CONTAINER = IO(VFIO_TYPE, VFIO_BASE+4)
 )
diff --git a/pkg/sentry/devices/tpuproxy/seccomp_filter.go b/pkg/sentry/devices/tpuproxy/seccomp_filter.go
index 21d47c9f2..e4bd40903 100644
--- a/pkg/sentry/devices/tpuproxy/seccomp_filter.go
+++ b/pkg/sentry/devices/tpuproxy/seccomp_filter.go
@@ -61,6 +61,10 @@ func Filters() seccomp.SyscallRules {
 				seccomp.NonNegativeFD{},
 				seccomp.EqualTo(linux.VFIO_CHECK_EXTENSION),
 			},
+			seccomp.PerArg{
+				seccomp.NonNegativeFD{},
+				seccomp.EqualTo(linux.VFIO_SET_IOMMU),
+			},
 		},
 	})
 }
diff --git a/pkg/sentry/devices/tpuproxy/vfio.go b/pkg/sentry/devices/tpuproxy/vfio.go
index 88268f92f..a0bc9d274 100644
--- a/pkg/sentry/devices/tpuproxy/vfio.go
+++ b/pkg/sentry/devices/tpuproxy/vfio.go
@@ -88,6 +88,8 @@ func (fd *vfioFd) Ioctl(ctx context.Context, uio usermem.IO, sysno uintptr, args
 	switch cmd {
 	case linux.VFIO_CHECK_EXTENSION:
 		return fd.checkExtension(extension(args[2].Int()))
+	case linux.VFIO_SET_IOMMU:
+		return fd.setIOMMU(extension(args[2].Int()))
 	}
 	return 0, linuxerr.ENOSYS
 }
@@ -107,6 +109,21 @@ func (fd *vfioFd) checkExtension(ext extension) (uintptr, error) {
 	return 0, linuxerr.EINVAL
 }
 
+// Set the iommu to the given type.  The type must be supported by an iommu
+// driver as verified by calling VFIO_CHECK_EXTENSION using the same type.
+func (fd *vfioFd) setIOMMU(ext extension) (uintptr, error) {
+	switch ext {
+	case linux.VFIO_TYPE1_IOMMU, linux.VFIO_SPAPR_TCE_IOMMU, linux.VFIO_TYPE1v2_IOMMU:
+		ret, err := ioctlInvoke[int32](fd.hostFd, linux.VFIO_SET_IOMMU, int32(ext))
+		if err != nil {
+			log.Warningf("set the IOMMU group to %s: %v", ext, err)
+			return 0, err
+		}
+		return ret, nil
+	}
+	return 0, linuxerr.EINVAL
+}
+
 // VFIO extension.
 type extension int32