diff --git a/.github/actions/veristat_baseline_compare/action.yml b/.github/actions/veristat_baseline_compare/action.yml
new file mode 100644
index 0000000000000..7ea487af61b8d
--- /dev/null
+++ b/.github/actions/veristat_baseline_compare/action.yml
@@ -0,0 +1,49 @@
+name: 'run-veristat'
+description: 'Run veristat benchmark'
+inputs:
+  veristat_output:
+    description: 'Veristat output filepath'
+    required: true
+  baseline_name:
+    description: 'Veristat baseline cache name'
+    required: true
+runs:
+  using: "composite"
+  steps:
+    - uses: actions/upload-artifact@v3
+      with:
+        name: ${{ inputs.baseline_name }}
+        if-no-files-found: error
+        path: ${{ github.workspace }}/${{ inputs.veristat_output }}
+
+    # For pull request:
+    # - get baseline log from cache
+    # - compare it to current run
+    - if: ${{ github.event_name == 'pull_request' }}
+      uses: actions/cache/restore@v3
+      with:
+        key: ${{ inputs.baseline_name }}
+        restore-keys: |
+          ${{ inputs.baseline_name }}-
+        path: '${{ github.workspace }}/${{ inputs.baseline_name }}'
+
+    - if: ${{ github.event_name == 'pull_request' }}
+      name: Show veristat comparison
+      shell: bash
+      run: ./.github/scripts/compare-veristat-results.sh
+      env:
+        BASELINE_PATH: ${{ github.workspace }}/${{ inputs.baseline_name }}
+        VERISTAT_OUTPUT: ${{ inputs.veristat_output }}
+
+    # For push: just put baseline log to cache
+    - if: ${{ github.event_name == 'push' }}
+      shell: bash
+      run: |
+        mv "${{ github.workspace }}/${{ inputs.veristat_output }}" \
+           "${{ github.workspace }}/${{ inputs.baseline_name }}"
+
+    - if: ${{ github.event_name == 'push' }}
+      uses: actions/cache/save@v3
+      with:
+        key: ${{ inputs.baseline_name }}-${{ github.run_id }}
+        path: '${{ github.workspace }}/${{ inputs.baseline_name }}'
diff --git a/.github/scripts/bpf-objects-rootfs.sh b/.github/scripts/bpf-objects-rootfs.sh
new file mode 100755
index 0000000000000..223e3ee350777
--- /dev/null
+++ b/.github/scripts/bpf-objects-rootfs.sh
@@ -0,0 +1,12 @@
+#!/bin/bash
+
+eval "$(guestfish --listen)"
+
+guestfish --verbose --remote \
+    add /tmp/root.img label:img : \
+    launch : \
+    mount /dev/disk/guestfs/img / : \
+    copy-in /tmp/bpf_objects / : \
+    chmod 0755 /bpf_objects
+
+guestfish --remote exit
diff --git a/.github/scripts/compare-veristat-results.sh b/.github/scripts/compare-veristat-results.sh
new file mode 100755
index 0000000000000..f15e759f53b5c
--- /dev/null
+++ b/.github/scripts/compare-veristat-results.sh
@@ -0,0 +1,18 @@
+#!/bin/bash
+
+if [[ ! -f "${BASELINE_PATH}" ]]; then
+    echo "# No ${BASELINE_PATH} available" >> "${GITHUB_STEP_SUMMARY}"
+
+    echo "No ${BASELINE_PATH} available"
+    echo "Printing veristat results"
+    cat "${VERISTAT_OUTPUT}"
+
+    exit
+fi
+
+selftests/bpf/veristat \
+    --output-format csv \
+    --emit file,prog,verdict,states \
+    --compare "${BASELINE_PATH}" "${VERISTAT_OUTPUT}" > compare.csv
+
+python3 ./.github/scripts/veristat-compare.py compare.csv
diff --git a/.github/scripts/get-commit-metadata.sh b/.github/scripts/get-commit-metadata.sh
new file mode 100644
index 0000000000000..f178786e4e58a
--- /dev/null
+++ b/.github/scripts/get-commit-metadata.sh
@@ -0,0 +1,23 @@
+#!/bin/bash
+
+branch="${GITHUB_BASE_REF}"
+
+if [ "${GITHUB_EVENT_NAME}" = 'push' ]; then
+  branch="${GITHUB_REF_NAME}"
+fi
+
+echo "branch=${branch}" >> "${GITHUB_OUTPUT}"
+
+upstream="${branch//_base/}"
+commit="$(
+  git rev-parse "origin/${upstream}" &> /dev/null \
+    || (
+      git fetch --quiet --prune --no-tags --depth=1 --no-recurse-submodules origin "+refs/heads/${upstream}:refs/remotes/origin/${upstream}" && \
+      git rev-parse "origin/${upstream}"
+    )
+)"
+timestamp_utc="$(TZ=utc git show --format='%cd' --no-patch --date=iso-strict-local "${commit}")"
+
+echo "timestamp=${timestamp_utc}" >> "${GITHUB_OUTPUT}"
+echo "commit=${commit}" >> "${GITHUB_OUTPUT}"
+echo "Most recent upstream commit is ${commit}"
diff --git a/.github/scripts/matrix.py b/.github/scripts/matrix.py
new file mode 100644
index 0000000000000..d7aa1e19b3425
--- /dev/null
+++ b/.github/scripts/matrix.py
@@ -0,0 +1,137 @@
+#!/usr/bin/env python3
+
+from copy import deepcopy
+from json import dumps
+from enum import Enum
+import os
+
+
+class Arch(Enum):
+    """
+    CPU architecture supported by CI.
+    """
+
+    AARCH64 = "aarch64"
+    S390X = "s390x"
+    X86_64 = "x86_64"
+
+
+def set_output(name, value):
+    """Write an output variable to the GitHub output file."""
+    with open(os.getenv("GITHUB_OUTPUT"), "a", encoding="utf-8") as file:
+        file.write(f"{name}={value}\n")
+
+
+def generate_test_config(test):
+    """Create the configuration for the provided test."""
+    experimental = test.endswith("_parallel")
+    config = {
+        "test": test,
+        "continue_on_error": experimental,
+        # While in experimental mode, parallel jobs may get stuck
+        # anywhere, including in user space where the kernel won't detect
+        # a problem and panic. We add a second layer of (smaller) timeouts
+        # here such that if we get stuck in a parallel run, we hit this
+        # timeout and fail without affecting the overall job success (as
+        # would be the case if we hit the job-wide timeout). For
+        # non-experimental jobs, 360 is the default which will be
+        # superseded by the overall workflow timeout (but we need to
+        # specify something).
+        "timeout_minutes": 30 if experimental else 360,
+    }
+    return config
+
+
+def get_tests(config):
+    tests = [
+        "test_progs",
+        "test_progs_parallel",
+        "test_progs_no_alu32",
+        "test_progs_no_alu32_parallel",
+        "test_maps",
+        "test_verifier",
+    ]
+    if config.get("parallel_tests", False):
+        return tests
+    return [test for test in tests if not test.endswith("parallel")]
+
+
+matrix = [
+    {
+        "kernel": "LATEST",
+        "runs_on": [],
+        "arch": Arch.X86_64.value,
+        "toolchain": "gcc",
+        "llvm-version": "16",
+        "run_veristat": True,
+        "parallel_tests": True,
+    },
+    {
+        "kernel": "LATEST",
+        "runs_on": [],
+        "arch": Arch.X86_64.value,
+        "toolchain": "llvm",
+        "llvm-version": "16",
+    },
+    {
+        "kernel": "LATEST",
+        "runs_on": [],
+        "arch": Arch.AARCH64.value,
+        "toolchain": "gcc",
+        "llvm-version": "16",
+    },
+    # {
+    #     "kernel": "LATEST",
+    #     "runs_on": [],
+    #     "arch": Arch.AARCH64.value,
+    #     "toolchain": "llvm",
+    #     "llvm-version": "16",
+    # },
+    {
+        "kernel": "LATEST",
+        "runs_on": [],
+        "arch": Arch.S390X.value,
+        "toolchain": "gcc",
+        "llvm-version": "16",
+    },
+]
+self_hosted_repos = [
+    "kernel-patches/bpf",
+    "kernel-patches/vmtest",
+]
+
+for idx in range(len(matrix) - 1, -1, -1):
+    if matrix[idx]["toolchain"] == "gcc":
+        matrix[idx]["toolchain_full"] = "gcc"
+    else:
+        matrix[idx]["toolchain_full"] = "llvm-" + matrix[idx]["llvm-version"]
+
+    # Set run_veristat to false by default.
+    matrix[idx]["run_veristat"] = matrix[idx].get("run_veristat", False)
+    # Feel in the tests
+    matrix[idx]["tests"] = {
+        "include": [generate_test_config(test) for test in get_tests(matrix[idx])]
+    }
+
+# Only a few repository within "kernel-patches" use self-hosted runners.
+if (
+    os.environ["GITHUB_REPOSITORY_OWNER"] != "kernel-patches"
+    or os.environ["GITHUB_REPOSITORY"] not in self_hosted_repos
+):
+    # Outside of those repositories, we only run on x86_64 GH hosted runners (ubuntu-20.04)
+    # We need to run on ubuntu 20.04 because our rootfs is based on debian buster and we
+    # otherwise get library versioning issue such as
+    # `./test_verifier: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.34' not found (required by ./test_verifier)`
+    for idx in range(len(matrix) - 1, -1, -1):
+        if matrix[idx]["arch"] != Arch.X86_64.value:
+            del matrix[idx]
+        else:
+            matrix[idx]["runs_on"] = ["ubuntu-20.04"]
+else:
+    # Otherwise, run on (self-hosted, arch) runners
+    for idx in range(len(matrix) - 1, -1, -1):
+        matrix[idx]["runs_on"].extend(["self-hosted", matrix[idx]["arch"]])
+
+build_matrix = {"include": matrix}
+
+set_output("build_matrix", dumps(build_matrix))
diff --git a/.github/scripts/prepare-incremental-builds.sh b/.github/scripts/prepare-incremental-builds.sh
new file mode 100644
index 0000000000000..17f825480ff47
--- /dev/null
+++ b/.github/scripts/prepare-incremental-builds.sh
@@ -0,0 +1,63 @@
+#!/bin/bash
+
+set -eu
+
+commit_id="${1}"
+
+# $1 - the SHA-1 to fetch and check out
+fetch_and_checkout() {
+  local build_base_sha
+
+  build_base_sha="${1}"
+  # If cached artifacts became stale for one reason or another, we
+  # may not have the build base SHA available. Fetch it and retry.
+  git fetch origin "${build_base_sha}" && git checkout --quiet "${build_base_sha}"
+}
+
+# $1 - value of KBUILD_OUTPUT
+clear_cache_artifacts() {
+  local output_dir
+
+  output_dir="${1}"
+  echo "Unable to find earlier upstream ref. Discarding KBUILD_OUTPUT contents..."
+  rm --recursive --force "${output_dir}"
+  mkdir "${output_dir}"
+  false
+}
+
+# $1 - value of KBUILD_OUTPUT
+# $2 - current time in ISO 8601 format
+restore_source_code_times() {
+  local build_output
+  local current_time
+  local src_time
+  local obj_time
+
+  build_output="${1}"
+  current_time="${2}"
+  src_time="$(date --iso-8601=ns --date="${current_time} - 2 minutes")"
+  obj_time="$(date --iso-8601=ns --date="${current_time} - 1 minute")"
+
+  git ls-files | xargs --max-args=10000 touch -m --no-create --date="${src_time}"
+  find "${build_output}" -type f | xargs --max-args=10000 touch -m --no-create --date="${obj_time}"
+  git checkout --quiet -
+  echo "Adjusted src and obj time stamps relative to system time"
+}
+
+mkdir --parents "${KBUILD_OUTPUT}"
+current_time="$(date --iso-8601=ns)"
+
+if [ -f "${KBUILD_OUTPUT}/.build-base-sha" ]; then
+  build_base_sha="$(cat "${KBUILD_OUTPUT}/.build-base-sha")"
+  echo "Setting up base build state for ${build_base_sha}"
+
+  (
+    git checkout --quiet "${build_base_sha}" \
+      || fetch_and_checkout "${build_base_sha}" \
+      || clear_cache_artifacts "${KBUILD_OUTPUT}"
+  ) && restore_source_code_times "${KBUILD_OUTPUT}" "${current_time}"
+else
+  echo "No previous build data found"
+fi
+
+echo -n "${commit_id}" > "${KBUILD_OUTPUT}/.build-base-sha"
diff --git a/.github/scripts/tar-artifact.sh b/.github/scripts/tar-artifact.sh
new file mode 100644
index 0000000000000..cd88f9e84ba46
--- /dev/null
+++ b/.github/scripts/tar-artifact.sh
@@ -0,0 +1,46 @@
+#!/bin/bash
+
+set -eux
+
+arch="${1}"
+toolchain="${2}"
+
+# Remove intermediate object files that we have no use for. Ideally
+# we'd just exclude them from tar below, but it does not provide
+# options to express the precise constraints.
+find selftests/ -name "*.o" -a ! -name "*.bpf.o" -print0 | \
+  xargs --null --max-args=10000 rm
+
+# Strip debug information, which is excessively large (consuming
+# bandwidth) while not actually being used (the kernel does not use
+# DWARF to symbolize stacktraces).
+strip --strip-debug "${KBUILD_OUTPUT}"/vmlinux
+
+additional_file_list=()
+if [ "${GITHUB_REPOSITORY}" == "kernel-patches/vmtest" ]; then
+  # Package up a bunch of additional infrastructure to support running
+  # 'make kernelrelease' and bpf tool checks later on.
+  mapfile -t additional_file_list < <(find . -iname Makefile)
+  additional_file_list+=(
+    "scripts/" 
+    "tools/testing/selftests/bpf/" 
+    "tools/include/" 
+    "tools/bpf/bpftool/"
+  )
+fi
+
+image_name=$(make -s image_name)
+
+# zstd is installed by default in the runner images.
+tar -cf - \
+  "${KBUILD_OUTPUT}/.config" \
+  "${KBUILD_OUTPUT}/${image_name}" \
+  "${KBUILD_OUTPUT}/include/config/auto.conf" \
+  "${KBUILD_OUTPUT}/include/generated/autoconf.h" \
+  "${KBUILD_OUTPUT}/vmlinux" \
+  "${additional_file_list[@]}" \
+  --exclude '*.cmd' \
+  --exclude '*.d' \
+  --exclude '*.h' \
+  --exclude '*.output' \
+  selftests/bpf/ | zstd -T0 -19 -o "vmlinux-${arch}-${toolchain}.tar.zst"
diff --git a/.github/scripts/veristat-compare.py b/.github/scripts/veristat-compare.py
new file mode 100644
index 0000000000000..1e38616d5d65f
--- /dev/null
+++ b/.github/scripts/veristat-compare.py
@@ -0,0 +1,263 @@
+#!/usr/bin/env python3
+
+# This script reads a CSV file produced by the following invocation:
+#
+#   veristat --emit file,prog,verdict,states \
+#            --output-format csv \
+#            --compare ...
+#
+# And produces a markdown summary for the file.
+# The summary is printed to standard output and appended to a file
+# pointed to by GITHUB_STEP_SUMMARY variable.
+#
+# Script exits with return code 1 if there are new failures in the
+# veristat results.
+#
+# For testing purposes invoke as follows:
+#
+#  GITHUB_STEP_SUMMARY=/dev/null python3 veristat-compare.py test.csv
+#
+# File format (columns):
+#  0. file_name
+#  1. prog_name
+#  2. verdict_base
+#  3. verdict_comp
+#  4. verdict_diff
+#  5. total_states_base
+#  6. total_states_comp
+#  7. total_states_diff
+#
+# Records sample:
+#  file-a,a,success,failure,MISMATCH,12,12,+0 (+0.00%)
+#  file-b,b,success,success,MATCH,67,67,+0 (+0.00%)
+#
+# For better readability suffixes '_OLD' and '_NEW'
+# are used instead of '_base' and '_comp' for variable
+# names etc.
+
+import io
+import os
+import sys
+import re
+import csv
+import logging
+import argparse
+import enum
+from dataclasses import dataclass
+from typing import Dict, List, Final
+
+
+TRESHOLD_PCT: Final[int] = 0
+
+SUMMARY_HEADERS = ["File", "Program", "Verdict", "States Diff (%)"]
+
+# expected format: +0 (+0.00%) / -0 (-0.00%)
+TOTAL_STATES_DIFF_REGEX = (
+    r"(?P<absolute_diff>[+-]\d+) \((?P<percentage_diff>[+-]\d+\.\d+)\%\)"
+)
+
+
+TEXT_SUMMARY_TEMPLATE: Final[
+    str
+] = """
+# {title}
+
+{table}
+""".strip()
+
+HTML_SUMMARY_TEMPLATE: Final[
+    str
+] = """
+# {title}
+
+<details>
+<summary>Click to expand</summary>
+
+{table}
+</details>
+""".strip()
+
+GITHUB_MARKUP_REPLACEMENTS: Final[Dict[str, str]] = {
+    "->": "&rarr;",
+    "(!!)": ":bangbang:",
+}
+
+NEW_FAILURE_SUFFIX: Final[str] = "(!!)"
+
+
+class VeristatFields(str, enum.Enum):
+    FILE_NAME = "file_name"
+    PROG_NAME = "prog_name"
+    VERDICT_OLD = "verdict_base"
+    VERDICT_NEW = "verdict_comp"
+    VERDICT_DIFF = "verdict_diff"
+    TOTAL_STATES_OLD = "total_states_base"
+    TOTAL_STATES_NEW = "total_states_comp"
+    TOTAL_STATES_DIFF = "total_states_diff"
+
+    @classmethod
+    def headers(cls) -> List[str]:
+        return [
+            cls.FILE_NAME,
+            cls.PROG_NAME,
+            cls.VERDICT_OLD,
+            cls.VERDICT_NEW,
+            cls.VERDICT_DIFF,
+            cls.TOTAL_STATES_OLD,
+            cls.TOTAL_STATES_NEW,
+            cls.TOTAL_STATES_DIFF,
+        ]
+
+
+@dataclass
+class VeristatInfo:
+    table: list
+    changes: bool
+    new_failures: bool
+
+    def get_results_title(self) -> str:
+        if self.new_failures:
+            return "There are new veristat failures"
+
+        if self.changes:
+            return "There are changes in verification performance"
+
+        return "No changes in verification performance"
+
+    def get_results_summary(self, markup: bool = False) -> str:
+        title = self.get_results_title()
+        if not self.table:
+            return f"# {title}\n"
+
+        template = TEXT_SUMMARY_TEMPLATE
+        table = format_table(headers=SUMMARY_HEADERS, rows=self.table)
+
+        if markup:
+            template = HTML_SUMMARY_TEMPLATE
+            table = github_markup_decorate(table)
+
+        return template.format(title=title, table=table)
+
+
+def get_state_diff(value: str) -> float:
+    if value == "N/A":
+        return 0.0
+
+    matches = re.match(TOTAL_STATES_DIFF_REGEX, value)
+    if not matches:
+        raise ValueError(f"Failed to parse total states diff field value '{value}'")
+
+    if percentage_diff := matches.group("percentage_diff"):
+        return float(percentage_diff)
+
+    raise ValueError(f"Invalid {VeristatFields.TOTAL_STATES_DIFF} field value: {value}")
+
+
+def parse_table(csv_file):
+    reader = csv.DictReader(csv_file)
+    assert reader.fieldnames == VeristatFields.headers()
+
+    new_failures = False
+    changes = False
+    table = []
+
+    for record in reader:
+        add = False
+
+        verdict_old, verdict_new = (
+            record[VeristatFields.VERDICT_OLD],
+            record[VeristatFields.VERDICT_NEW],
+        )
+
+        # Ignore results from completely new and removed programs
+        if "N/A" in [verdict_new, verdict_old]:
+            continue
+
+        if record[VeristatFields.VERDICT_DIFF] == "MISMATCH":
+            changes = True
+            add = True
+            verdict = f"{verdict_old} -> {verdict_new}"
+            if verdict_new == "failure":
+                new_failures = True
+                verdict += f" {NEW_FAILURE_SUFFIX}"
+        else:
+            verdict = record[VeristatFields.VERDICT_NEW]
+
+        diff = get_state_diff(record[VeristatFields.TOTAL_STATES_DIFF])
+        if abs(diff) > TRESHOLD_PCT:
+            changes = True
+            add = True
+
+        if not add:
+            continue
+
+        table.append(
+            [
+                record[VeristatFields.FILE_NAME],
+                record[VeristatFields.PROG_NAME],
+                verdict,
+                f"{diff:+.2f} %",
+            ]
+        )
+
+    return VeristatInfo(table=table, changes=changes, new_failures=new_failures)
+
+
+def github_markup_decorate(input_str: str) -> str:
+    for text, markup in GITHUB_MARKUP_REPLACEMENTS.items():
+        input_str = input_str.replace(text, markup)
+    return input_str
+
+
+def format_table(headers: List[str], rows: List[List[str]]) -> str:
+    column_width = [
+        max(len(row[column_idx]) for row in [headers] + rows)
+        for column_idx in range(len(headers))
+    ]
+
+    # Row template string in the following format:
+    # "{0:8}|{1:10}|{2:15}|{3:7}|{4:10}"
+    row_template = "|".join(
+        f"{{{idx}:{width}}}" for idx, width in enumerate(column_width)
+    )
+    row_template_nl = f"|{row_template}|\n"
+
+    with io.StringIO() as out:
+        out.write(row_template_nl.format(*headers))
+
+        separator_row = ["-" * width for width in column_width]
+        out.write(row_template_nl.format(*separator_row))
+
+        for row in rows:
+            row_str = row_template_nl.format(*row)
+            out.write(row_str)
+
+        return out.getvalue()
+
+
+def main(compare_csv_filename: os.PathLike, output_filename: os.PathLike) -> None:
+    with open(compare_csv_filename, newline="", encoding="utf-8") as csv_file:
+        veristat_results = parse_table(csv_file)
+
+    sys.stdout.write(veristat_results.get_results_summary())
+
+    with open(output_filename, encoding="utf-8", mode="a") as file:
+        file.write(veristat_results.get_results_summary(markup=True))
+
+    if veristat_results.new_failures:
+        return 1
+
+    return 0
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(
+        description="Print veristat comparison output as markdown step summary"
+    )
+    parser.add_argument("filename")
+    args = parser.parse_args()
+    summary_filename = os.getenv("GITHUB_STEP_SUMMARY")
+    if not summary_filename:
+        logging.error("GITHUB_STEP_SUMMARY environment variable is not set")
+        sys.exit(1)
+    sys.exit(main(args.filename, summary_filename))
diff --git a/.github/workflows/kernel-build-test.yml b/.github/workflows/kernel-build-test.yml
new file mode 100644
index 0000000000000..2bc3b9cc7449e
--- /dev/null
+++ b/.github/workflows/kernel-build-test.yml
@@ -0,0 +1,96 @@
+name: Reusable Build/Test/Veristat workflow
+
+on:
+  workflow_call:
+    inputs:
+      arch:
+        required: true
+        type: string
+        description: The architecture to build against, e.g x86_64, aarch64, s390x...
+      toolchain_full:
+        required: true
+        type: string
+        description: The toolchain and for llvm, its version, e.g gcc, llvm-15
+      toolchain:
+        required: true
+        type: string
+        description: The toolchain, e.g gcc, llvm
+      runs_on:
+        required: true
+        type: string
+        description: The runners to run the test on. This is a json string representing an array of labels.
+      llvm-version:
+        required: true
+        type: string
+        description: The version of LLVM used to build selftest.... for llvm toolchain, this should match the one from toolchain_full, for gcc it is an arbritrary version we decide to build selftests against.
+      kernel:
+        required: true
+        type: string
+        description: The kernel to run the test against. For KPD this is always LATEST, which runs against a newly built kernel.
+      tests:
+        required: true
+        type: string
+        description: A serialized json array with the tests to be running, it must follow the json-matrix format, https://www.jitsejan.com/use-github-actions-with-json-file-as-matrix
+      run_veristat:
+        required: true
+        type: boolean
+        description: Whether or not to run the veristat job.
+      run_tests:
+        required: true
+        type: boolean
+        description: Whether or not to run the test job.
+      download_sources:
+        required: true
+        type: boolean
+        description: Whether to download the linux sources into the working directory.
+        default: false
+    secrets:
+      AWS_ROLE_ARN:
+        required: true
+
+jobs:
+  # Build kernel and selftest
+  build:
+    uses: ./.github/workflows/kernel-build.yml
+    with:
+      arch: ${{ inputs.arch }}
+      toolchain_full: ${{ inputs.toolchain_full }}
+      toolchain: ${{ inputs.toolchain }}
+      runs_on: ${{ inputs.runs_on }}
+      llvm-version: ${{ inputs.llvm-version }}
+      kernel: ${{ inputs.kernel }}
+      download_sources: ${{ inputs.download_sources }}
+
+  test:
+    if: ${{ inputs.run_tests }}
+    uses: ./.github/workflows/kernel-test.yml
+    # Setting name to test here to avoid lengthy autogenerated names due to matrix
+    # e.g build-and-test x86_64-gcc / test (test_progs_parallel, true, 30) / test_progs_parallel on x86_64 with gcc
+    name: "test"
+    needs: [build]
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJSON(inputs.tests) }}
+    with:
+      arch: ${{ inputs.arch }}
+      toolchain_full: ${{ inputs.toolchain_full }}
+      runs_on: ${{ inputs.runs_on }}
+      kernel: ${{ inputs.kernel }}
+      test: ${{ matrix.test }}
+      continue_on_error: ${{ toJSON(matrix.continue_on_error) }}
+      timeout_minutes: ${{ matrix.timeout_minutes }}
+
+  veristat:
+    if: ${{ inputs.run_veristat }}
+    uses: ./.github/workflows/kernel-veristat.yml
+    needs: [build]
+    permissions:
+      id-token: write
+      contents: read
+    with:
+      arch: ${{ inputs.arch }}
+      toolchain: ${{ inputs.toolchain }}
+      aws_region: ${{ vars.AWS_REGION }}
+      runs_on: ${{ inputs.runs_on }}
+    secrets:
+      AWS_ROLE_ARN: ${{ secrets.AWS_ROLE_ARN }}
\ No newline at end of file
diff --git a/.github/workflows/kernel-build.yml b/.github/workflows/kernel-build.yml
new file mode 100644
index 0000000000000..f12014d0f520e
--- /dev/null
+++ b/.github/workflows/kernel-build.yml
@@ -0,0 +1,129 @@
+
+name: Reusable build workflow
+
+on:
+  workflow_call:
+    inputs:
+      arch:
+        required: true
+        type: string
+        description: The architecture to build against, e.g x86_64, aarch64, s390x...
+      toolchain_full:
+        required: true
+        type: string
+        description: The toolchain and for llvm, its version, e.g gcc, llvm-15
+      toolchain:
+        required: true
+        type: string
+        description: The toolchain, e.g gcc, llvm
+      runs_on:
+        required: true
+        type: string
+        description: The runners to run the test on. This is a json string representing an array of labels.
+      llvm-version:
+        required: true
+        type: string
+        description: The version of LLVM used to build selftest.... for llvm toolchain, this should match the one from toolchain_full, for gcc it is an arbritrary version we decide to build selftests against.
+      kernel:
+        required: true
+        type: string
+        description: The kernel to run the test against. For KPD this is always LATEST, which runs against a newly built kernel.
+      download_sources:
+        required: true
+        type: boolean
+        description: Whether to download the linux sources into the working directory.
+        default: false
+
+ 
+jobs:
+  build:
+    name: build for ${{ inputs.arch }} with ${{ inputs.toolchain_full }}
+    runs-on: ${{ fromJSON(inputs.runs_on) }}
+    timeout-minutes: 100
+    env:
+        KERNEL: ${{ inputs.kernel }}
+        REPO_ROOT: ${{ github.workspace }}
+        REPO_PATH: ""
+        KBUILD_OUTPUT: kbuild-output/
+    steps:
+      - uses: actions/checkout@v3
+        # We fetch an actual bit of history here to facilitate incremental
+        # builds (which may check out some earlier upstream change).
+        with:
+          fetch-depth: 50
+      - if: ${{ inputs.download_sources }}
+        name: Download bpf-next tree
+        uses: libbpf/ci/get-linux-source@main
+        with:
+          dest: '.kernel'
+      - if: ${{ inputs.download_sources }}
+        name: Move linux source in place
+        shell: bash
+        run: |
+          rm -rf .kernel/.git
+          cp -rf .kernel/. .
+          rm -rf .kernel
+      - name: Get commit meta-data
+        id: get-commit-metadata
+        run: |
+          bash .github/scripts/get-commit-metadata.sh
+      - name: Pull recent KBUILD_OUTPUT contents
+        uses: actions/cache@v3
+        with:
+          path: ${{ env.KBUILD_OUTPUT }}
+          key: kbuild-output-${{ inputs.arch }}-${{ inputs.toolchain_full }}-${{ steps.get-commit-metadata.outputs.branch }}-${{ steps.get-commit-metadata.outputs.timestamp }}-${{ steps.get-commit-metadata.outputs.commit }}
+          restore-keys: |
+            kbuild-output-${{ inputs.arch }}-${{ inputs.toolchain_full }}-${{ steps.get-commit-metadata.outputs.branch }}-${{ steps.get-commit-metadata.outputs.timestamp }}-
+            kbuild-output-${{ inputs.arch }}-${{ inputs.toolchain_full }}-${{ steps.get-commit-metadata.outputs.branch }}-
+            kbuild-output-${{ inputs.arch }}-${{ inputs.toolchain_full }}-
+      - name: Prepare incremental build
+        shell: bash
+        run: |
+          bash .github/scripts/prepare-incremental-builds.sh ${{ steps.get-commit-metadata.outputs.commit }}
+      - uses: libbpf/ci/patch-kernel@main
+        with:
+          patches-root: '${{ github.workspace }}/ci/diffs'
+          repo-root: '${{ github.workspace }}'
+      - name: Setup build environment
+        uses: libbpf/ci/setup-build-env@main
+        with:
+          llvm-version: ${{ inputs.llvm-version }}
+      - name: Build kernel image
+        uses: libbpf/ci/build-linux@main
+        with:
+          arch: ${{ inputs.arch }}
+          toolchain: ${{ inputs.toolchain }}
+          kbuild-output: ${{ env.KBUILD_OUTPUT }}
+          max-make-jobs: 32
+          llvm-version: ${{ inputs.llvm-version }}
+      - name: Build selftests
+        uses: libbpf/ci/build-selftests@main
+        with:
+          toolchain: ${{ inputs.toolchain }}
+          kbuild-output: ${{ env.KBUILD_OUTPUT }}
+          max-make-jobs: 32
+          llvm-version: ${{ inputs.llvm-version }}
+      - if: ${{ github.event_name != 'push' }}
+        name: Build samples
+        uses: libbpf/ci/build-samples@main
+        with:
+          toolchain: ${{ inputs.toolchain }}
+          kbuild-output: ${{ env.KBUILD_OUTPUT }}
+          max-make-jobs: 32
+          llvm-version: ${{ inputs.llvm-version }}
+      - name: Tar artifacts
+        run: |
+          bash .github/scripts/tar-artifact.sh ${{ inputs.arch }} ${{ inputs.toolchain_full }}
+      - if: ${{ github.event_name != 'push' }}
+        name: Remove KBUILD_OUTPUT content
+        shell: bash
+        run: |
+          # Remove $KBUILD_OUTPUT to prevent cache creation for pull requests.
+          # Only on pushed changes are build artifacts actually cached, because
+          # of github.com/actions/cache's cache isolation logic.
+          rm -rf "${KBUILD_OUTPUT}"
+      - uses: actions/upload-artifact@v3
+        with:
+          name: vmlinux-${{ inputs.arch }}-${{ inputs.toolchain_full }}
+          if-no-files-found: error
+          path: vmlinux-${{ inputs.arch }}-${{ inputs.toolchain_full }}.tar.zst
\ No newline at end of file
diff --git a/.github/workflows/kernel-test.yml b/.github/workflows/kernel-test.yml
new file mode 100644
index 0000000000000..9555c6f1c58e9
--- /dev/null
+++ b/.github/workflows/kernel-test.yml
@@ -0,0 +1,79 @@
+name: Reusable test workflow
+
+on:
+  workflow_call:
+    inputs:
+      arch:
+        required: true
+        type: string
+        description: The architecture to build against, e.g x86_64, aarch64, s390x...
+      toolchain_full:
+        required: true
+        type: string
+        description: The toolchain and for llvm, its version, e.g gcc, llvm-15
+      runs_on:
+        required: true
+        type: string
+        description: The runners to run the test on. This is a json string representing an array of labels.
+      kernel:
+        required: true
+        type: string
+        description: The kernel to run the test against. For KPD this is always LATEST, which runs against a newly built kernel.
+      test:
+        required: true
+        type: string
+        description: The test to run in the vm, e.g test_progs, test_maps, test_progs_no_alu32...
+      continue_on_error:
+        required: true
+        type: string
+        description: Whether to continue on error. This is typically set to true for parallel tests which are currently known to fail, but we don't want to fail the whole CI because of that.
+      timeout_minutes:
+        required: true
+        type: number
+        description: In case a test runs for too long, after how many seconds shall we timeout and error.
+
+jobs:
+  test:
+    name: ${{ inputs.test }} on ${{ inputs.arch }} with ${{ inputs.toolchain_full }}
+    runs-on: ${{ fromJSON(inputs.runs_on) }}
+    timeout-minutes: 100
+    env:
+      KERNEL: ${{ inputs.kernel }}
+      REPO_ROOT: ${{ github.workspace }}
+      REPO_PATH: ""
+      KBUILD_OUTPUT: kbuild-output/
+      # https://github.com/actions/runner/issues/1483#issuecomment-1031671517
+      # booleans are weird in GH.
+      CONTINUE_ON_ERROR: ${{ inputs.continue_on_error }}
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/download-artifact@v3
+        with:
+          name: vmlinux-${{ inputs.arch }}-${{ inputs.toolchain_full }}
+          path: .
+      - name: Untar artifacts
+        # zstd is installed by default in the runner images.
+        run: zstd -d -T0  vmlinux-${{ inputs.arch }}-${{ inputs.toolchain_full }}.tar.zst --stdout | tar -xf -
+      - name: Prepare rootfs
+        uses: libbpf/ci/prepare-rootfs@main
+        with:
+          project-name: 'libbpf'
+          arch: ${{ inputs.arch }}
+          kernel: ${{ inputs.kernel }}
+          kernel-root: '.'
+          kbuild-output: ${{ env.KBUILD_OUTPUT }}
+          image-output: '/tmp/root.img'
+          test: ${{ inputs.test }}
+      - name: Run selftests
+        uses: libbpf/ci/run-qemu@main
+        # https://github.com/actions/runner/issues/1483#issuecomment-1031671517
+        # booleans are weird in GH.
+        continue-on-error: ${{ fromJSON(env.CONTINUE_ON_ERROR) }}
+        timeout-minutes: ${{ inputs.timeout_minutes }}
+        with:
+          arch: ${{ inputs.arch}}
+          img: '/tmp/root.img'
+          vmlinuz: '${{ github.workspace }}/vmlinuz'
+          kernel-root: '.'
+          max-cpu: 8
+          kernel-test: ${{ inputs.test }}
\ No newline at end of file
diff --git a/.github/workflows/kernel-veristat.yml b/.github/workflows/kernel-veristat.yml
new file mode 100644
index 0000000000000..8df27b7400fd7
--- /dev/null
+++ b/.github/workflows/kernel-veristat.yml
@@ -0,0 +1,110 @@
+name: Reusable veristat workflow
+
+on:
+  workflow_call:
+    inputs:
+      arch:
+        required: true
+        type: string
+        description: The architecture to build against, e.g x86_64, aarch64, s390x...
+      toolchain:
+        required: true
+        type: string
+        description: The toolchain, e.g gcc, llvm
+      runs_on:
+        required: true
+        type: string
+        description: The runners to run the test on. This is a json string representing an array of labels.
+      aws_region:
+        required: true
+        type: string
+        description: The AWS region where we pull bpf objects to run against veristat.
+    secrets:
+        AWS_ROLE_ARN:
+            required: true
+            description: The AWS role used by GH to pull BPF objects from AWS.
+
+jobs:
+  veristat:
+    name: veristat on ${{ inputs.arch }} with ${{ inputs.toolchain }}
+    runs-on: ${{ fromJSON(inputs.runs_on) }}
+    timeout-minutes: 100
+    permissions:
+        id-token: write
+        contents: read
+    env:
+      KERNEL: LATEST
+      REPO_ROOT: ${{ github.workspace }}
+      REPO_PATH: ""
+      KBUILD_OUTPUT: kbuild-output/
+      ARCH_AND_TOOL: ${{ inputs.arch }}-${{ inputs.toolchain }}
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/download-artifact@v3
+        with:
+          name: vmlinux-${{ env.ARCH_AND_TOOL }}
+          path: .
+      - name: Untar artifacts
+        # zstd is installed by default in the runner images.
+        run: zstd -d -T0  vmlinux-${{ env.ARCH_AND_TOOL }}.tar.zst --stdout | tar -xf -
+
+      - name: Prepare rootfs
+        uses: libbpf/ci/prepare-rootfs@main
+        with:
+          project-name: 'libbpf'
+          arch: x86_64
+          kernel: LATEST
+          kernel-root: '.'
+          kbuild-output: ${{ env.KBUILD_OUTPUT }}
+          image-output: '/tmp/root.img'
+
+      - name: Configure AWS Credentials
+        # Disabling BPF objects download and veristat-meta benchmark for PRs
+        # created from fork repositories. These won't have access to required
+        # enviroment variables and secrets, and otherwise would consistently fail
+        if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
+        uses: aws-actions/configure-aws-credentials@v2
+        with:
+          aws-region: ${{ inputs.aws_region }}
+          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
+          role-session-name: github-action-bpf-ci
+
+      - name: Download BPF objects
+        if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
+        run: |
+          set -eux
+          if [ -n "$AWS_ROLE_ARN" ]; then
+            mkdir /tmp/bpf_objects
+            aws s3 sync s3://veristat-bpf-binaries /tmp/bpf_objects
+          fi
+        env:
+          AWS_ROLE_ARN: ${{ secrets.AWS_ROLE_ARN }}
+
+      - name: Add BPF objects to rootfs
+        if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
+        shell: bash
+        run: ./.github/scripts/bpf-objects-rootfs.sh
+
+      - name: Run veristat
+        uses: libbpf/ci/run-qemu@main
+        with:
+          arch: x86_64
+          img: '/tmp/root.img'
+          vmlinuz: '${{ github.workspace }}/vmlinuz'
+          kernel-root: '.'
+          max-cpu: 8
+          kernel-test: run_veristat_kernel,run_veristat_meta
+          output-dir: '${{ github.workspace }}'
+
+      - name: Compare and save veristat.kernel.csv
+        uses: ./.github/actions/veristat_baseline_compare
+        with:
+          veristat_output: veristat-kernel
+          baseline_name: ${{ env.ARCH_AND_TOOL}}-baseline-veristat-kernel
+
+      - name: Compare and save veristat.meta.csv
+        if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
+        uses: ./.github/actions/veristat_baseline_compare
+        with:
+          veristat_output: veristat-meta
+          baseline_name: ${{ env.ARCH_AND_TOOL}}-baseline-veristat-meta
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
new file mode 100644
index 0000000000000..f9a51a241c4cb
--- /dev/null
+++ b/.github/workflows/lint.yml
@@ -0,0 +1,55 @@
+name: "lint"
+
+on:
+  pull_request:
+  push:
+    branches:
+      - master
+
+jobs:
+  shellcheck:
+    # This workflow gets injected into other Linux repositories, but we don't
+    # want it to run there.
+    if: ${{ github.repository == 'kernel-patches/vmtest' }}
+    name: ShellCheck
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+      - name: Run ShellCheck
+        uses: ludeeus/action-shellcheck@master
+        env:
+          SHELLCHECK_OPTS: --severity=warning --exclude=SC1091
+
+  # Ensure some consistency in the formatting.
+  lint:
+    if: ${{ github.repository == 'kernel-patches/vmtest' }}
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+      - name: Run black
+        uses: psf/black@stable
+        with:
+          src: ./.github/scripts
+
+  validate_matrix:
+    if: ${{ github.repository == 'kernel-patches/vmtest' }}
+    name: Validate matrix.py
+    runs-on: ubuntu-latest
+    env:
+      GITHUB_REPOSITORY_OWNER: ${{ matrix.owner }}
+      GITHUB_REPOSITORY: ${{ matrix.repository }}
+      GITHUB_OUTPUT: /dev/stdout
+    strategy:
+      matrix:
+        owner: ['kernel-patches', 'foo']
+        repository: ['bpf', 'vmtest', 'bar']
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+      - name: run script
+        run: |
+          python3 .github/scripts/matrix.py
+
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
new file mode 100644
index 0000000000000..2a1f5b93ae45f
--- /dev/null
+++ b/.github/workflows/test.yml
@@ -0,0 +1,56 @@
+name: bpf-ci
+
+on:
+  pull_request:
+  push:
+    branches:
+      - bpf_base
+      - bpf-next_base
+
+concurrency:
+  group: ci-test-${{ github.ref_name }}
+  cancel-in-progress: true
+
+jobs:
+  set-matrix:
+    # FIXME: set-matrix is lightweight, run it on any self-hosted machines for kernel-patches org
+    # so we do not wait for GH hosted runners when there potentially all are busy because of bpf-rc
+    # repo for instance.
+    # This could be somehow fixed long term by making this action/workflow re-usable and letting the called
+    # specify what to run on.
+    runs-on: ${{ github.repository_owner == 'kernel-patches' && 'x86_64' || 'ubuntu-latest' }}
+    outputs:
+      build-matrix: ${{ steps.set-matrix-impl.outputs.build_matrix }}
+    steps:
+      - uses: actions/checkout@v3
+      - id: set-matrix-impl
+        run: |
+          python3 .github/scripts/matrix.py
+
+  build-and-test:
+    # Setting name to arch-compiler here to avoid lengthy autogenerated names due to matrix
+    # e.g build-and-test x86_64-gcc / test (test_progs_parallel, true, 30) / test_progs_parallel on x86_64 with gcc
+    name: "${{ matrix.arch }}-${{ matrix.toolchain_full }}"
+    uses: ./.github/workflows/kernel-build-test.yml
+    needs: [set-matrix]
+    permissions:
+      id-token: write
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJSON(needs.set-matrix.outputs.build-matrix) }}
+    with:
+      arch: ${{ matrix.arch }}
+      toolchain_full: ${{ matrix.toolchain_full }}
+      toolchain: ${{ matrix.toolchain }}
+      runs_on: ${{ toJSON(matrix.runs_on) }}
+      llvm-version: ${{ matrix.llvm-version }}
+      kernel: ${{ matrix.kernel }}
+      tests: ${{ toJSON(matrix.tests) }}
+      run_veristat: ${{ matrix.run_veristat }}
+      # We only run tests on pull requests.
+      run_tests: ${{ github.event_name != 'push' }}
+      # Download sources
+      download_sources: ${{ github.repository == 'kernel-patches/vmtest' }}
+    secrets:
+      AWS_ROLE_ARN: ${{ secrets.AWS_ROLE_ARN }}
diff --git a/README b/README
index 669ac7c322927..e69de29bb2d1d 100644
--- a/README
+++ b/README
@@ -1,18 +0,0 @@
-Linux kernel
-============
-
-There are several guides for kernel developers and users. These guides can
-be rendered in a number of formats, like HTML and PDF. Please read
-Documentation/admin-guide/README.rst first.
-
-In order to build the documentation, use ``make htmldocs`` or
-``make pdfdocs``.  The formatted documentation can also be read online at:
-
-    https://www.kernel.org/doc/html/latest/
-
-There are various text files in the Documentation/ subdirectory,
-several of them using the Restructured Text markup notation.
-
-Please read the Documentation/process/changes.rst file, as it contains the
-requirements for building and running the kernel, and information about
-the problems which may result by upgrading your kernel.
diff --git a/ci/diffs/.keep b/ci/diffs/.keep
new file mode 100644
index 0000000000000..e69de29bb2d1d
diff --git a/ci/diffs/0001-Revert-bpf-Avoid-unnecessary-audit-log-for-CPU-secur.patch b/ci/diffs/0001-Revert-bpf-Avoid-unnecessary-audit-log-for-CPU-secur.patch
new file mode 100644
index 0000000000000..3b6139225e7bf
--- /dev/null
+++ b/ci/diffs/0001-Revert-bpf-Avoid-unnecessary-audit-log-for-CPU-secur.patch
@@ -0,0 +1,33 @@
+From 5440a12ac8fb2a8e051c597fcf5d85b427fe612a Mon Sep 17 00:00:00 2001
+From: Andrii Nakryiko <andrii@kernel.org>
+Date: Fri, 13 Oct 2023 12:44:34 -0700
+Subject: [PATCH] Revert "bpf: Avoid unnecessary audit log for CPU security
+ mitigations"
+
+This reverts commit 236334aeec0f93217cf9235f2004e61a0a1a5985.
+---
+ include/linux/bpf.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/bpf.h b/include/linux/bpf.h
+index f0891ba24cb1..61bde4520f5c 100644
+--- a/include/linux/bpf.h
++++ b/include/linux/bpf.h
+@@ -2164,12 +2164,12 @@ static inline bool bpf_allow_uninit_stack(void)
+ 
+ static inline bool bpf_bypass_spec_v1(void)
+ {
+-	return cpu_mitigations_off() || perfmon_capable();
++	return perfmon_capable() || cpu_mitigations_off();
+ }
+ 
+ static inline bool bpf_bypass_spec_v4(void)
+ {
+-	return cpu_mitigations_off() || perfmon_capable();
++	return perfmon_capable() || cpu_mitigations_off();
+ }
+ 
+ int bpf_map_new_fd(struct bpf_map *map, int flags);
+-- 
+2.34.1
+
diff --git a/ci/diffs/0001-net-bpf-Use-sockopt_lock_sock-in-ip_sock_set_tos.patch b/ci/diffs/0001-net-bpf-Use-sockopt_lock_sock-in-ip_sock_set_tos.patch
new file mode 100644
index 0000000000000..bd12bd9b3fba5
--- /dev/null
+++ b/ci/diffs/0001-net-bpf-Use-sockopt_lock_sock-in-ip_sock_set_tos.patch
@@ -0,0 +1,99 @@
+From c8268f8e9fa33c32e1f2f86fc7b703408a396c70 Mon Sep 17 00:00:00 2001
+From: Yonghong Song <yonghong.song@linux.dev>
+Date: Fri, 27 Oct 2023 11:24:24 -0700
+Subject: [PATCH] net: bpf: Use sockopt_lock_sock() in ip_sock_set_tos()
+
+With latest sync from net-next tree, bpf-next has a bpf selftest failure:
+  [root@arch-fb-vm1 bpf]# ./test_progs -t setget_sockopt
+  ...
+  [   76.194349] ============================================
+  [   76.194682] WARNING: possible recursive locking detected
+  [   76.195039] 6.6.0-rc7-g37884503df08-dirty #67 Tainted: G        W  OE
+  [   76.195518] --------------------------------------------
+  [   76.195852] new_name/154 is trying to acquire lock:
+  [   76.196159] ffff8c3e06ad8d30 (sk_lock-AF_INET){+.+.}-{0:0}, at: ip_sock_set_tos+0x19/0x30
+  [   76.196669]
+  [   76.196669] but task is already holding lock:
+  [   76.197028] ffff8c3e06ad8d30 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_listen+0x21/0x70
+  [   76.197517]
+  [   76.197517] other info that might help us debug this:
+  [   76.197919]  Possible unsafe locking scenario:
+  [   76.197919]
+  [   76.198287]        CPU0
+  [   76.198444]        ----
+  [   76.198600]   lock(sk_lock-AF_INET);
+  [   76.198831]   lock(sk_lock-AF_INET);
+  [   76.199062]
+  [   76.199062]  *** DEADLOCK ***
+  [   76.199062]
+  [   76.199420]  May be due to missing lock nesting notation
+  [   76.199420]
+  [   76.199879] 2 locks held by new_name/154:
+  [   76.200131]  #0: ffff8c3e06ad8d30 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_listen+0x21/0x70
+  [   76.200644]  #1: ffffffff90f96a40 (rcu_read_lock){....}-{1:2}, at: __cgroup_bpf_run_filter_sock_ops+0x55/0x290
+  [   76.201268]
+  [   76.201268] stack backtrace:
+  [   76.201538] CPU: 4 PID: 154 Comm: new_name Tainted: G        W  OE      6.6.0-rc7-g37884503df08-dirty #67
+  [   76.202134] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
+  [   76.202699] Call Trace:
+  [   76.202858]  <TASK>
+  [   76.203002]  dump_stack_lvl+0x4b/0x80
+  [   76.203239]  __lock_acquire+0x740/0x1ec0
+  [   76.203503]  lock_acquire+0xc1/0x2a0
+  [   76.203766]  ? ip_sock_set_tos+0x19/0x30
+  [   76.204050]  ? sk_stream_write_space+0x12a/0x230
+  [   76.204389]  ? lock_release+0xbe/0x260
+  [   76.204661]  lock_sock_nested+0x32/0x80
+  [   76.204942]  ? ip_sock_set_tos+0x19/0x30
+  [   76.205208]  ip_sock_set_tos+0x19/0x30
+  [   76.205452]  do_ip_setsockopt+0x4b3/0x1580
+  [   76.205719]  __bpf_setsockopt+0x62/0xa0
+  [   76.205963]  bpf_sock_ops_setsockopt+0x11/0x20
+  [   76.206247]  bpf_prog_630217292049c96e_bpf_test_sockopt_int+0xbc/0x123
+  [   76.206660]  bpf_prog_493685a3bae00bbd_bpf_test_ip_sockopt+0x49/0x4b
+  [   76.207055]  bpf_prog_b0bcd27f269aeea0_skops_sockopt+0x44c/0xec7
+  [   76.207437]  __cgroup_bpf_run_filter_sock_ops+0xda/0x290
+  [   76.207829]  __inet_listen_sk+0x108/0x1b0
+  [   76.208122]  inet_listen+0x48/0x70
+  [   76.208373]  __sys_listen+0x74/0xb0
+  [   76.208630]  __x64_sys_listen+0x16/0x20
+  [   76.208911]  do_syscall_64+0x3f/0x90
+  [   76.209174]  entry_SYSCALL_64_after_hwframe+0x6e/0xd8
+  ...
+
+Both ip_sock_set_tos() and inet_listen() calls lock_sock(sk) which
+caused a dead lock.
+
+To fix the issue, use sockopt_lock_sock() in ip_sock_set_tos()
+instead. sockopt_lock_sock() will avoid lock_sock() if it is in bpf
+context.
+
+Fixes: 878d951c6712 ("inet: lock the socket in ip_sock_set_tos()")
+Suggested-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Link: https://lore.kernel.org/bpf/20231027182424.1444845-1-yonghong.song@linux.dev
+---
+ net/ipv4/ip_sockglue.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
+index 9c68b6b74d9f..2efc53526a38 100644
+--- a/net/ipv4/ip_sockglue.c
++++ b/net/ipv4/ip_sockglue.c
+@@ -602,9 +602,9 @@ void __ip_sock_set_tos(struct sock *sk, int val)
+ 
+ void ip_sock_set_tos(struct sock *sk, int val)
+ {
+-	lock_sock(sk);
++	sockopt_lock_sock(sk);
+ 	__ip_sock_set_tos(sk, val);
+-	release_sock(sk);
++	sockopt_release_sock(sk);
+ }
+ EXPORT_SYMBOL(ip_sock_set_tos);
+ 
+-- 
+2.34.1
+
diff --git a/ci/diffs/0001-selftests-bpf-disable-detection-of-llvm-when-buildin.patch b/ci/diffs/0001-selftests-bpf-disable-detection-of-llvm-when-buildin.patch
new file mode 100644
index 0000000000000..6497a6cc38c90
--- /dev/null
+++ b/ci/diffs/0001-selftests-bpf-disable-detection-of-llvm-when-buildin.patch
@@ -0,0 +1,41 @@
+From 42839864a62ee244ec280b09149b1cb439f681db Mon Sep 17 00:00:00 2001
+From: Manu Bretelle <chantr4@gmail.com>
+Date: Fri, 27 Oct 2023 18:25:39 -0700
+Subject: [PATCH bpf-next] selftests/bpf: disable detection of llvm when
+ building bpftool
+
+The VMs in which we run the selftests do not have llvm installed.
+We build selftests/bpftool in a host that have llvm.
+bpftool currently will use llvm first and fallback to libbfd but there
+is no way to disable detection from the command line.
+
+Removing it from the feature detection should force us to use libbfd.
+
+Signed-off-by: Manu Bretelle <chantr4@gmail.com>
+---
+ tools/bpf/bpftool/Makefile | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/tools/bpf/bpftool/Makefile b/tools/bpf/bpftool/Makefile
+index e9154ace80ff..01314458e25e 100644
+--- a/tools/bpf/bpftool/Makefile
++++ b/tools/bpf/bpftool/Makefile
+@@ -95,7 +95,6 @@ RM ?= rm -f
+ FEATURE_USER = .bpftool
+ 
+ FEATURE_TESTS := clang-bpf-co-re
+-FEATURE_TESTS += llvm
+ FEATURE_TESTS += libcap
+ FEATURE_TESTS += libbfd
+ FEATURE_TESTS += libbfd-liberty
+@@ -104,7 +103,6 @@ FEATURE_TESTS += disassembler-four-args
+ FEATURE_TESTS += disassembler-init-styled
+ 
+ FEATURE_DISPLAY := clang-bpf-co-re
+-FEATURE_DISPLAY += llvm
+ FEATURE_DISPLAY += libcap
+ FEATURE_DISPLAY += libbfd
+ FEATURE_DISPLAY += libbfd-liberty
+-- 
+2.39.3
+
diff --git a/ci/diffs/0001-tracing-kprobes-Fix-symbol-counting-logic-by-looking.patch b/ci/diffs/0001-tracing-kprobes-Fix-symbol-counting-logic-by-looking.patch
new file mode 100644
index 0000000000000..24ebc231056cb
--- /dev/null
+++ b/ci/diffs/0001-tracing-kprobes-Fix-symbol-counting-logic-by-looking.patch
@@ -0,0 +1,65 @@
+From 08969a676d234a178ff9f8c67936a2ad98a741eb Mon Sep 17 00:00:00 2001
+From: Andrii Nakryiko <andrii@kernel.org>
+Date: Fri, 27 Oct 2023 16:22:24 -0700
+Subject: [PATCH] tracing/kprobes: Fix symbol counting logic by looking at
+ modules as well
+
+Recent changes to count number of matching symbols when creating
+a kprobe event failed to take into account kernel modules. As such, it
+breaks kprobes on kernel module symbols, by assuming there is no match.
+
+Fix this my calling module_kallsyms_on_each_symbol() in addition to
+kallsyms_on_each_match_symbol() to perform a proper counting.
+
+Cc: Francis Laniel <flaniel@linux.microsoft.com>
+Cc: stable@vger.kernel.org
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Fixes: b022f0c7e404 ("tracing/kprobes: Return EADDRNOTAVAIL when func matches several symbols")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+---
+ kernel/trace/trace_kprobe.c | 24 ++++++++++++++++++++----
+ 1 file changed, 20 insertions(+), 4 deletions(-)
+
+diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
+index effcaede4759..1efb27f35963 100644
+--- a/kernel/trace/trace_kprobe.c
++++ b/kernel/trace/trace_kprobe.c
+@@ -714,14 +714,30 @@ static int count_symbols(void *data, unsigned long unused)
+ 	return 0;
+ }
+ 
++struct sym_count_ctx {
++	unsigned int count;
++	const char *name;
++};
++
++static int count_mod_symbols(void *data, const char *name, unsigned long unused)
++{
++	struct sym_count_ctx *ctx = data;
++
++	if (strcmp(name, ctx->name) == 0)
++		ctx->count++;
++
++	return 0;
++}
++
+ static unsigned int number_of_same_symbols(char *func_name)
+ {
+-	unsigned int count;
++	struct sym_count_ctx ctx = { .count = 0, .name = func_name };
++
++	kallsyms_on_each_match_symbol(count_symbols, func_name, &ctx.count);
+ 
+-	count = 0;
+-	kallsyms_on_each_match_symbol(count_symbols, func_name, &count);
++	module_kallsyms_on_each_symbol(NULL, count_mod_symbols, &ctx);
+ 
+-	return count;
++	return ctx.count;
+ }
+ 
+ static int __trace_kprobe_create(int argc, const char *argv[])
+-- 
+2.34.1
+
diff --git a/ci/vmtest/configs/DENYLIST b/ci/vmtest/configs/DENYLIST
new file mode 100644
index 0000000000000..e53b4640180e8
--- /dev/null
+++ b/ci/vmtest/configs/DENYLIST
@@ -0,0 +1,7 @@
+# TEMPORARY
+btf_dump/btf_dump: syntax
+kprobe_multi_bench_attach
+core_reloc/enum64val
+core_reloc/size___diff_sz
+core_reloc/type_based___diff_sz
+test_ima	# All of CI is broken on it following 6.3-rc1 merge
diff --git a/ci/vmtest/configs/DENYLIST.aarch64 b/ci/vmtest/configs/DENYLIST.aarch64
new file mode 100644
index 0000000000000..487b19ede4b61
--- /dev/null
+++ b/ci/vmtest/configs/DENYLIST.aarch64
@@ -0,0 +1,4 @@
+cgrp_local_storage                  # libbpf: prog 'update_cookie_tracing': failed to attach: ERROR: strerror_r(-524)=22
+core_reloc_btfgen                   # run_core_reloc_tests:FAIL:run_btfgen unexpected error: 32512 (errno 22)
+usdt/multispec                      # usdt_300_bad_attach unexpected pointer: 0x558c63d8f0
+xdp_bonding                         # whole test suite is very unstable on aarch64
diff --git a/ci/vmtest/configs/DENYLIST.s390x b/ci/vmtest/configs/DENYLIST.s390x
new file mode 100644
index 0000000000000..e6829c94bdaae
--- /dev/null
+++ b/ci/vmtest/configs/DENYLIST.s390x
@@ -0,0 +1,5 @@
+deny_namespace                           # not yet in bpf denylist
+tc_redirect/tc_redirect_dtime            # very flaky
+lru_bug                                  # not yet in bpf-next denylist
+usdt/basic                               # failing verifier due to bounds check after LLVM update
+usdt/multispec                           # same as above
diff --git a/ci/vmtest/configs/DENYLIST.x86_64 b/ci/vmtest/configs/DENYLIST.x86_64
new file mode 100644
index 0000000000000..6fc3413daab9f
--- /dev/null
+++ b/ci/vmtest/configs/DENYLIST.x86_64
@@ -0,0 +1 @@
+netcnt              # with kvm enabled, fail with packets unexpected packets: actual 10001 != expected 10000
diff --git a/ci/vmtest/configs/run_veristat.kernel.cfg b/ci/vmtest/configs/run_veristat.kernel.cfg
new file mode 100644
index 0000000000000..6ac3940672d91
--- /dev/null
+++ b/ci/vmtest/configs/run_veristat.kernel.cfg
@@ -0,0 +1,3 @@
+VERISTAT_OBJECTS_DIR="/${PROJECT_NAME}/selftests/bpf"
+VERISTAT_OBJECTS_GLOB=$(awk '/^#/ { next; } { print $0 ".bpf.o"; }' "${BPF_SELFTESTS_DIR}/veristat.cfg")
+VERISTAT_OUTPUT="veristat-kernel"
diff --git a/ci/vmtest/configs/run_veristat.meta.cfg b/ci/vmtest/configs/run_veristat.meta.cfg
new file mode 100644
index 0000000000000..3b40d25d048fb
--- /dev/null
+++ b/ci/vmtest/configs/run_veristat.meta.cfg
@@ -0,0 +1,3 @@
+VERISTAT_OBJECTS_DIR="/bpf_objects"
+VERISTAT_OBJECTS_GLOB="*.o"
+VERISTAT_OUTPUT="veristat-meta"
diff --git a/ci/vmtest/helpers.sh b/ci/vmtest/helpers.sh
new file mode 100755
index 0000000000000..c44d0983156d0
--- /dev/null
+++ b/ci/vmtest/helpers.sh
@@ -0,0 +1,38 @@
+# shellcheck shell=bash
+
+# $1 - start or end
+# $2 - fold identifier, no spaces
+# $3 - fold section description
+foldable() {
+  local YELLOW='\033[1;33m'
+  local NOCOLOR='\033[0m'
+  if [ $1 = "start" ]; then
+    line="::group::$2"
+    if [ ! -z "${3:-}" ]; then
+      line="$line - ${YELLOW}$3${NOCOLOR}"
+    fi
+  else
+    line="::endgroup::"
+  fi
+  echo -e "$line"
+}
+
+__print() {
+  local TITLE=""
+  if [[ -n $2 ]]; then
+      TITLE=" title=$2"
+  fi
+  echo "::$1${TITLE}::$3"
+}
+
+# $1 - title
+# $2 - message
+print_error() {
+  __print error $1 $2
+}
+
+# $1 - title
+# $2 - message
+print_notice() {
+  __print notice $1 $2
+}
diff --git a/ci/vmtest/run_selftests.sh b/ci/vmtest/run_selftests.sh
new file mode 100755
index 0000000000000..8d0f9e02eb2b4
--- /dev/null
+++ b/ci/vmtest/run_selftests.sh
@@ -0,0 +1,189 @@
+#!/bin/bash
+
+# run_selftest.sh will run the tests within /${PROJECT_NAME}/selftests/bpf
+# If no specific test names are given, all test will be ran, otherwise, it will
+# run the test passed as parameters.
+# There is 2 ways to pass test names.
+# 1) command-line arguments to this script
+# 2) a comma-separated list of test names passed as `run_tests` boot parameters.
+# test names passed as any of those methods will be ran.
+
+set -euo pipefail
+
+source "$(cd "$(dirname "$0")" && pwd)/helpers.sh"
+
+ARCH=$(uname -m)
+
+STATUS_FILE=/exitstatus
+OUTPUT_DIR=/command_output
+
+BPF_SELFTESTS_DIR="/${PROJECT_NAME}/selftests/bpf"
+VMTEST_CONFIGS_PATH="/${PROJECT_NAME}/vmtest/configs"
+
+read_lists() {
+	(for path in "$@"; do
+		if [[ -s "$path" ]]; then
+			cat "$path"
+		fi;
+	done) | cut -d'#' -f1 | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//' | tr -s '\n' ','
+}
+
+DENYLIST=$(read_lists \
+	"$BPF_SELFTESTS_DIR/DENYLIST" \
+	"$BPF_SELFTESTS_DIR/DENYLIST.${ARCH}" \
+	"$VMTEST_CONFIGS_PATH/DENYLIST" \
+	"$VMTEST_CONFIGS_PATH/DENYLIST.${ARCH}" \
+)
+ALLOWLIST=$(read_lists \
+	"$BPF_SELFTESTS_DIR/ALLOWLIST" \
+	"$BPF_SELFTESTS_DIR/ALLOWLIST.${ARCH}" \
+	"$VMTEST_CONFIGS_PATH/ALLOWLIST" \
+	"$VMTEST_CONFIGS_PATH/ALLOWLIST.${ARCH}" \
+)
+
+declare -a TEST_NAMES=()
+
+read_test_names() {
+    foldable start read_test_names "Reading test names from boot parameters and command line arguments"
+    # Check if test names were passed as boot parameter.
+    # We expect `run_tests` to be a comma-separated list of test names.
+    IFS=',' read -r -a test_names_from_boot <<< \
+        "$(sed -n 's/.*run_tests=\([^ ]*\).*/\1/p' /proc/cmdline)"
+
+    echo "${#test_names_from_boot[@]} tests extracted from boot parameters: ${test_names_from_boot[*]}"
+    # Sort and only keep unique test names from both boot params and arguments
+    # TEST_NAMES will contain a sorted list of uniq tests to be ran.
+    # Only do this if any of $test_names_from_boot[@] or $@ has elements as
+    # "printf '%s\0'" will otherwise generate an empty element.
+    if [[ ${#test_names_from_boot[@]} -gt 0 || $# -gt 0 ]]
+    then
+        readarray -t TEST_NAMES < \
+            <(printf '%s\0' "${test_names_from_boot[@]}" "$@" | \
+                sort --zero-terminated --unique | \
+                xargs --null --max-args=1)
+    fi
+    foldable end read_test_names
+}
+
+test_progs_helper() {
+  local selftest="test_progs${1}"
+  local args="$2"
+
+  json_file=${selftest/-/_}
+  if [ "$2" == "-j" ]
+  then
+    json_file+="_parallel"
+  fi
+  json_file="/${json_file}.json"
+
+  foldable start ${selftest} "Testing ${selftest}"
+  # "&& true" does not change the return code (it is not executed
+  # if the Python script fails), but it prevents exiting on a
+  # failure due to the "set -e".
+  ./${selftest} ${args} ${DENYLIST:+-d"$DENYLIST"} ${ALLOWLIST:+-a"$ALLOWLIST"} --json-summary "${json_file}" && true
+  echo "${selftest}:$?" >>"${STATUS_FILE}"
+  foldable end ${selftest}
+}
+
+test_progs() {
+  test_progs_helper "" ""
+}
+
+test_progs_parallel() {
+  test_progs_helper "" "-j"
+}
+
+test_progs_no_alu32() {
+  test_progs_helper "-no_alu32" ""
+}
+
+test_progs_no_alu32_parallel() {
+  test_progs_helper "-no_alu32" "-j"
+}
+
+test_maps() {
+  foldable start test_maps "Testing test_maps"
+  taskset 0xF ./test_maps && true
+  echo "test_maps:$?" >>"${STATUS_FILE}"
+  foldable end test_maps
+}
+
+test_verifier() {
+  foldable start test_verifier "Testing test_verifier"
+  ./test_verifier && true
+  echo "test_verifier:$?" >>"${STATUS_FILE}"
+  foldable end test_verifier
+}
+
+run_veristat_helper() {
+  local mode="${1}"
+
+  # Make veristat commands visible in the log
+  if [ -o xtrace ]; then
+      xtrace_was_on="1"
+  else
+      xtrace_was_on=""
+      set -x
+  fi
+
+  (
+    # shellcheck source=ci/vmtest/configs/run_veristat.default.cfg
+    # shellcheck source=ci/vmtest/configs/run_veristat.meta.cfg
+    source "${VMTEST_CONFIGS_PATH}/run_veristat.${mode}.cfg"
+    mkdir -p ${OUTPUT_DIR}
+    pushd "${VERISTAT_OBJECTS_DIR}"
+
+    "${BPF_SELFTESTS_DIR}/veristat" -o csv -q -e file,prog,verdict,states ${VERISTAT_OBJECTS_GLOB} > \
+      "${OUTPUT_DIR}/${VERISTAT_OUTPUT}"
+
+    echo "run_veristat_${mode}:$?" >> ${STATUS_FILE}
+    popd
+  )
+
+  # Hide commands again
+  if [ -z "$xtrace_was_on" ]; then
+      set +x
+  fi
+
+}
+
+run_veristat_kernel() {
+  foldable start run_veristat_kernel "Running veristat.kernel"
+  run_veristat_helper "kernel"
+  foldable end run_veristat_kernel
+}
+
+run_veristat_meta() {
+  foldable start run_veristat_meta "Running veristat.meta"
+  run_veristat_helper "meta"
+  foldable end run_veristat_meta
+}
+
+foldable end vm_init
+
+foldable start kernel_config "Kconfig"
+
+zcat /proc/config.gz
+
+foldable end kernel_config
+
+echo "DENYLIST: ${DENYLIST}"
+echo "ALLOWLIST: ${ALLOWLIST}"
+
+cd ${PROJECT_NAME}/selftests/bpf
+
+# populate TEST_NAMES
+read_test_names "$@"
+# if we don't have any test name provided to the script, we run all tests.
+if [ ${#TEST_NAMES[@]} -eq 0 ]; then
+	test_progs
+	test_progs_no_alu32
+	test_maps
+	test_verifier
+else
+	# else we run the tests passed as command-line arguments and through boot
+	# parameter.
+	for test_name in "${TEST_NAMES[@]}"; do
+		"${test_name}"
+	done
+fi