diff --git a/.github/actions/veristat_baseline_compare/action.yml b/.github/actions/veristat_baseline_compare/action.yml
new file mode 100644
index 0000000000000..f6dd81d19e4b3
--- /dev/null
+++ b/.github/actions/veristat_baseline_compare/action.yml
@@ -0,0 +1,49 @@
+name: 'run-veristat'
+description: 'Run veristat benchmark'
+inputs:
+  veristat_output:
+    description: 'Veristat output filepath'
+    required: true
+  baseline_name:
+    description: 'Veristat baseline cache name'
+    required: true
+runs:
+  using: "composite"
+  steps:
+    - uses: actions/upload-artifact@v4
+      with:
+        name: ${{ inputs.baseline_name }}
+        if-no-files-found: error
+        path: ${{ github.workspace }}/${{ inputs.veristat_output }}
+
+    # For pull request:
+    # - get baseline log from cache
+    # - compare it to current run
+    - if: ${{ github.event_name == 'pull_request' }}
+      uses: actions/cache/restore@v4
+      with:
+        key: ${{ github.base_ref }}-${{ inputs.baseline_name }}-
+        restore-keys: |
+          ${{ github.base_ref }}-${{ inputs.baseline_name }}
+        path: '${{ github.workspace }}/${{ inputs.baseline_name }}'
+
+    - if: ${{ github.event_name == 'pull_request' }}
+      name: Show veristat comparison
+      shell: bash
+      run: ./.github/scripts/compare-veristat-results.sh
+      env:
+        BASELINE_PATH: ${{ github.workspace }}/${{ inputs.baseline_name }}
+        VERISTAT_OUTPUT: ${{ inputs.veristat_output }}
+
+    # For push: just put baseline log to cache
+    - if: ${{ github.event_name == 'push' }}
+      shell: bash
+      run: |
+        mv "${{ github.workspace }}/${{ inputs.veristat_output }}" \
+           "${{ github.workspace }}/${{ inputs.baseline_name }}"
+
+    - if: ${{ github.event_name == 'push' }}
+      uses: actions/cache/save@v4
+      with:
+        key: ${{ github.ref_name }}-${{ inputs.baseline_name }}-${{ github.run_id }}
+        path: '${{ github.workspace }}/${{ inputs.baseline_name }}'
diff --git a/.github/scripts/collect-scx-bpf-progs.sh b/.github/scripts/collect-scx-bpf-progs.sh
new file mode 100755
index 0000000000000..60a86c84e6387
--- /dev/null
+++ b/.github/scripts/collect-scx-bpf-progs.sh
@@ -0,0 +1,13 @@
+#!/bin/bash
+
+set -euo pipefail
+
+PROGS_DIR=$1
+
+mkdir -p "${PROGS_DIR}"
+
+find "${SCX_BUILD_OUTPUT}" -type f -name "*.bpf.o" -printf '%P\0' | \
+while IFS= read -r -d '' prog; do
+    obj_name=$(echo "${prog}" | tr / _)
+    cp -v "${SCX_BUILD_OUTPUT}/$prog" "${PROGS_DIR}/${obj_name}"
+done
diff --git a/.github/scripts/compare-veristat-results.sh b/.github/scripts/compare-veristat-results.sh
new file mode 100755
index 0000000000000..5bc761a9f8792
--- /dev/null
+++ b/.github/scripts/compare-veristat-results.sh
@@ -0,0 +1,42 @@
+#!/bin/bash
+
+if [[ ! -f "${BASELINE_PATH}" ]]; then
+    echo "# No ${BASELINE_PATH} available" >> "${GITHUB_STEP_SUMMARY}"
+
+    echo "No ${BASELINE_PATH} available"
+    echo "Printing veristat results"
+    cat "${VERISTAT_OUTPUT}"
+
+    exit 0
+fi
+
+veristat=$(realpath selftests/bpf/veristat)
+cmp_out=$(mktemp veristate_compare_out_XXXXXX.csv)
+
+$veristat \
+    --output-format csv \
+    --emit file,prog,verdict,states \
+    --compare "${BASELINE_PATH}" "${VERISTAT_OUTPUT}" > $cmp_out
+
+python3 ./.github/scripts/veristat_compare.py $cmp_out
+exit_code=$?
+
+echo
+# if comparison failed, print verifier log for failure mismatches
+if [[ -n "$VERISTAT_DUMP_LOG_ON_FAILURE" && $exit_code -ne 0 ]]; then
+    cat $cmp_out | tail -n +1 | \
+    while read -r line; do
+        verdict=$(echo $line | cut -d',' -f4)
+        verdict_diff=$(echo $line | cut -d',' -f5)
+        if [[ "$verdict" == "failure" && "$verdict_diff" == "MISMATCH" ]]; then
+            file=$(echo $line | cut -d',' -f1)
+            prog=$(echo $line | cut -d',' -f2)
+            echo "VERIFIER LOG FOR $file/$prog:"
+            echo "=================================================================="
+            $veristat -v $VERISTAT_OBJECTS_DIR/$file -f $prog 2>&1
+            echo "=================================================================="
+        fi
+    done
+fi
+
+exit $exit_code
diff --git a/.github/scripts/download-gcc-bpf.sh b/.github/scripts/download-gcc-bpf.sh
new file mode 100755
index 0000000000000..894584a01b2ec
--- /dev/null
+++ b/.github/scripts/download-gcc-bpf.sh
@@ -0,0 +1,30 @@
+#!/bin/bash
+
+set -euo pipefail
+
+GCC_BPF_RELEASE_GH_REPO=$1
+INSTALL_DIR=$(realpath $2)
+
+cd /tmp
+
+tag=$(gh release list -L 1 -R ${GCC_BPF_RELEASE_GH_REPO} --json tagName -q .[].tagName)
+if [[ -z "$tag" ]]; then
+    echo "Could not find latest GCC BPF release at ${GCC_BPF_RELEASE_GH_REPO}"
+    exit 1
+fi
+
+url="https://github.com/${GCC_BPF_RELEASE_GH_REPO}/releases/download/${tag}/${tag}.tar.zst"
+echo "Downloading $url"
+wget -q "$url"
+
+tarball=${tag}.tar.zst
+dir=$(tar tf $tarball | head -1 || true)
+
+echo "Extracting $tarball ..."
+tar -I zstd -xf $tarball && rm -f $tarball
+
+rm -rf $INSTALL_DIR
+mv -v $dir $INSTALL_DIR
+
+cd -
+
diff --git a/.github/scripts/matrix.py b/.github/scripts/matrix.py
new file mode 100644
index 0000000000000..2c9e8aff3feee
--- /dev/null
+++ b/.github/scripts/matrix.py
@@ -0,0 +1,275 @@
+#!/usr/bin/env python3
+
+import dataclasses
+import json
+import os
+
+from enum import Enum
+from typing import Any, Dict, Final, List, Optional, Set, Union
+
+import requests
+import requests.utils
+
+MANAGED_OWNER: Final[str] = "kernel-patches"
+MANAGED_REPOS: Final[Set[str]] = {
+    f"{MANAGED_OWNER}/bpf",
+    f"{MANAGED_OWNER}/vmtest",
+}
+
+DEFAULT_SELF_HOSTED_RUNNER_TAGS: Final[List[str]] = ["self-hosted", "docker-noble-main"]
+DEFAULT_GITHUB_HOSTED_RUNNER: Final[str] = "ubuntu-24.04"
+DEFAULT_GCC_VERSION: Final[int] = 15
+DEFAULT_LLVM_VERSION: Final[int] = 21
+
+RUNNERS_BUSY_THRESHOLD: Final[float] = 0.8
+
+
+class Arch(str, Enum):
+    """
+    CPU architecture supported by CI.
+    """
+
+    AARCH64 = "aarch64"
+    S390X = "s390x"
+    X86_64 = "x86_64"
+
+
+class Compiler(str, Enum):
+    GCC = "gcc"
+    LLVM = "llvm"
+
+
+def query_runners_from_github() -> List[Dict[str, Any]]:
+    if "GITHUB_TOKEN" not in os.environ:
+        return []
+    token = os.environ["GITHUB_TOKEN"]
+    headers = {
+        "Authorization": f"token {token}",
+        "Accept": "application/vnd.github.v3+json",
+    }
+    owner = os.environ["GITHUB_REPOSITORY_OWNER"]
+    url: Optional[str] = f"https://api.github.com/orgs/{owner}/actions/runners"
+    # GitHub returns 30 runners per page, fetch all
+    all_runners = []
+    try:
+        while url is not None:
+            response = requests.get(url, headers=headers)
+            if response.status_code != 200:
+                print(f"Failed to query runners: {response.status_code}")
+                print(f"response: {response.text}")
+                return []
+            data = response.json()
+            all_runners.extend(data.get("runners", []))
+            # Check for next page URL in Link header
+            url = None
+            if "Link" in response.headers:
+                links = requests.utils.parse_header_links(response.headers["Link"])
+                for link in links:
+                    if link["rel"] == "next":
+                        url = link["url"]
+                        break
+        return all_runners
+    except Exception as e:
+        print(f"Warning: Failed to query runner status due to exception: {e}")
+        return []
+
+
+all_runners_cached: Optional[List[Dict[str, Any]]] = None
+
+
+def all_runners() -> List[Dict[str, Any]]:
+    global all_runners_cached
+    if all_runners_cached is None:
+        print("Querying runners from GitHub...")
+        all_runners_cached = query_runners_from_github()
+        print(f"Github returned {len(all_runners_cached)} runners")
+        counts = count_by_status(all_runners_cached)
+        print(
+            f"Busy: {counts['busy']}, Idle: {counts['idle']}, Offline: {counts['offline']}"
+        )
+    return all_runners_cached
+
+
+def runner_labels(runner: Dict[str, Any]) -> List[str]:
+    return [label["name"] for label in runner["labels"]]
+
+
+def is_self_hosted_runner(runner: Dict[str, Any]) -> bool:
+    labels = runner_labels(runner)
+    for label in DEFAULT_SELF_HOSTED_RUNNER_TAGS:
+        if label not in labels:
+            return False
+    return True
+
+
+def self_hosted_runners() -> List[Dict[str, Any]]:
+    runners = all_runners()
+    return [r for r in runners if is_self_hosted_runner(r)]
+
+
+def runners_by_arch(arch: Arch) -> List[Dict[str, Any]]:
+    runners = self_hosted_runners()
+    return [r for r in runners if arch.value in runner_labels(r)]
+
+
+def count_by_status(runners: List[Dict[str, Any]]) -> Dict[str, int]:
+    result = {"busy": 0, "idle": 0, "offline": 0}
+    for runner in runners:
+        if runner["status"] == "online":
+            if runner["busy"]:
+                result["busy"] += 1
+            else:
+                result["idle"] += 1
+        else:
+            result["offline"] += 1
+    return result
+
+
+@dataclasses.dataclass
+class BuildConfig:
+    arch: Arch
+    kernel_compiler: Compiler = Compiler.GCC
+    gcc_version: int = DEFAULT_GCC_VERSION
+    llvm_version: int = DEFAULT_LLVM_VERSION
+    kernel: str = "LATEST"
+    run_veristat: bool = False
+    parallel_tests: bool = False
+    build_release: bool = False
+
+    @property
+    def runs_on(self) -> List[str]:
+        if is_managed_repo():
+            return DEFAULT_SELF_HOSTED_RUNNER_TAGS + [self.arch.value]
+        else:
+            return [DEFAULT_GITHUB_HOSTED_RUNNER]
+
+    @property
+    def build_runs_on(self) -> List[str]:
+        if not is_managed_repo():
+            return [DEFAULT_GITHUB_HOSTED_RUNNER]
+
+        # @Temporary: disable codebuild runners for cross-compilation jobs
+        match self.arch:
+            case Arch.S390X:
+                return DEFAULT_SELF_HOSTED_RUNNER_TAGS + [Arch.X86_64.value]
+            case Arch.AARCH64:
+                return DEFAULT_SELF_HOSTED_RUNNER_TAGS + [Arch.X86_64.value]
+
+        # For managed repos, check the busyness of relevant self-hosted runners
+        # If they are too busy, use codebuild
+        runner_arch = self.arch
+        runners = runners_by_arch(runner_arch)
+        counts = count_by_status(runners)
+        online = counts["idle"] + counts["busy"]
+        busy = counts["busy"]
+        # if online <= 0, then something is wrong, don't use codebuild
+        if online > 0 and busy / online > RUNNERS_BUSY_THRESHOLD:
+            return ["codebuild"]
+        else:
+            return DEFAULT_SELF_HOSTED_RUNNER_TAGS + [runner_arch.value]
+
+    @property
+    def tests(self) -> Dict[str, Any]:
+        tests_list = [
+            "test_progs",
+            "test_progs_parallel",
+            "test_progs_no_alu32",
+            "test_progs_no_alu32_parallel",
+            "test_verifier",
+        ]
+
+        if self.arch.value != "s390x":
+            tests_list.append("test_maps")
+
+        if self.llvm_version >= 18:
+            tests_list.append("test_progs_cpuv4")
+
+        if self.arch in [Arch.X86_64, Arch.AARCH64]:
+            tests_list.append("sched_ext")
+
+        # Don't run GCC BPF runner, because too many tests are failing
+        # See: https://lore.kernel.org/bpf/87bjw6qpje.fsf@oracle.com/
+        # if self.arch == Arch.X86_64:
+        #    tests_list.append("test_progs-bpf_gcc")
+
+        if not self.parallel_tests:
+            tests_list = [test for test in tests_list if not test.endswith("parallel")]
+
+        return {"include": [generate_test_config(test) for test in tests_list]}
+
+    def to_dict(self) -> Dict[str, Any]:
+        return {
+            "arch": self.arch.value,
+            "kernel_compiler": self.kernel_compiler.value,
+            "gcc_version": DEFAULT_GCC_VERSION,
+            "llvm_version": DEFAULT_LLVM_VERSION,
+            "kernel": self.kernel,
+            "run_veristat": self.run_veristat,
+            "parallel_tests": self.parallel_tests,
+            "build_release": self.build_release,
+            "runs_on": self.runs_on,
+            "tests": self.tests,
+            "build_runs_on": self.build_runs_on,
+        }
+
+
+def is_managed_repo() -> bool:
+    return (
+        os.environ["GITHUB_REPOSITORY_OWNER"] == MANAGED_OWNER
+        and os.environ["GITHUB_REPOSITORY"] in MANAGED_REPOS
+    )
+
+
+def set_output(name, value):
+    """Write an output variable to the GitHub output file."""
+    with open(os.getenv("GITHUB_OUTPUT"), "a", encoding="utf-8") as file:
+        file.write(f"{name}={value}\n")
+
+
+def generate_test_config(test: str) -> Dict[str, Union[str, int]]:
+    """Create the configuration for the provided test."""
+    is_parallel = test.endswith("_parallel")
+    config = {
+        "test": test,
+        "continue_on_error": is_parallel,
+        # While in experimental mode, parallel jobs may get stuck
+        # anywhere, including in user space where the kernel won't detect
+        # a problem and panic. We add a second layer of (smaller) timeouts
+        # here such that if we get stuck in a parallel run, we hit this
+        # timeout and fail without affecting the overall job success (as
+        # would be the case if we hit the job-wide timeout). For
+        # non-experimental jobs, 360 is the default which will be
+        # superseded by the overall workflow timeout (but we need to
+        # specify something).
+        "timeout_minutes": 30 if is_parallel else 360,
+    }
+    return config
+
+
+if __name__ == "__main__":
+    matrix = [
+        BuildConfig(
+            arch=Arch.X86_64,
+            run_veristat=True,
+            parallel_tests=True,
+        ),
+        BuildConfig(
+            arch=Arch.X86_64,
+            kernel_compiler=Compiler.LLVM,
+            build_release=True,
+        ),
+        BuildConfig(
+            arch=Arch.AARCH64,
+        ),
+        BuildConfig(
+            arch=Arch.S390X,
+        ),
+    ]
+
+    # Outside of managed repositories only run on x86_64
+    if not is_managed_repo():
+        matrix = [config for config in matrix if config.arch == Arch.X86_64]
+
+    json_matrix = json.dumps({"include": [config.to_dict() for config in matrix]})
+    print(json.dumps(json.loads(json_matrix), indent=4))
+    set_output("build_matrix", json_matrix)
diff --git a/.github/scripts/tests/test_veristat_compare.py b/.github/scripts/tests/test_veristat_compare.py
new file mode 100644
index 0000000000000..b65b69295235d
--- /dev/null
+++ b/.github/scripts/tests/test_veristat_compare.py
@@ -0,0 +1,75 @@
+#!/usr/bin/env python3
+
+import unittest
+from typing import Iterable, List
+
+from ..veristat_compare import parse_table, VeristatFields
+
+
+def gen_csv_table(records: Iterable[str]) -> List[str]:
+    return [
+        ",".join(VeristatFields.headers()),
+        *records,
+    ]
+
+
+class TestVeristatCompare(unittest.TestCase):
+    def test_parse_table_ignore_new_prog(self):
+        table = gen_csv_table(
+            [
+                "prog_file.bpf.o,prog_name,N/A,success,N/A,N/A,1,N/A",
+            ]
+        )
+        veristat_info = parse_table(table)
+        self.assertEqual(veristat_info.table, [])
+        self.assertFalse(veristat_info.changes)
+        self.assertFalse(veristat_info.new_failures)
+
+    def test_parse_table_ignore_removed_prog(self):
+        table = gen_csv_table(
+            [
+                "prog_file.bpf.o,prog_name,success,N/A,N/A,1,N/A,N/A",
+            ]
+        )
+        veristat_info = parse_table(table)
+        self.assertEqual(veristat_info.table, [])
+        self.assertFalse(veristat_info.changes)
+        self.assertFalse(veristat_info.new_failures)
+
+    def test_parse_table_new_failure(self):
+        table = gen_csv_table(
+            [
+                "prog_file.bpf.o,prog_name,success,failure,MISMATCH,1,1,+0 (+0.00%)",
+            ]
+        )
+        veristat_info = parse_table(table)
+        self.assertEqual(
+            veristat_info.table,
+            [["prog_file.bpf.o", "prog_name", "success -> failure (!!)", "+0.00 %"]],
+        )
+        self.assertTrue(veristat_info.changes)
+        self.assertTrue(veristat_info.new_failures)
+
+    def test_parse_table_new_changes(self):
+        table = gen_csv_table(
+            [
+                "prog_file.bpf.o,prog_name,failure,success,MISMATCH,0,0,+0 (+0.00%)",
+                "prog_file.bpf.o,prog_name_increase,failure,failure,MATCH,1,2,+1 (+100.00%)",
+                "prog_file.bpf.o,prog_name_decrease,success,success,MATCH,1,1,-1 (-100.00%)",
+            ]
+        )
+        veristat_info = parse_table(table)
+        self.assertEqual(
+            veristat_info.table,
+            [
+                ["prog_file.bpf.o", "prog_name", "failure -> success", "+0.00 %"],
+                ["prog_file.bpf.o", "prog_name_increase", "failure", "+100.00 %"],
+                ["prog_file.bpf.o", "prog_name_decrease", "success", "-100.00 %"],
+            ],
+        )
+        self.assertTrue(veristat_info.changes)
+        self.assertFalse(veristat_info.new_failures)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/.github/scripts/tmpfsify-workspace.sh b/.github/scripts/tmpfsify-workspace.sh
new file mode 100755
index 0000000000000..6fd62b4ad2a49
--- /dev/null
+++ b/.github/scripts/tmpfsify-workspace.sh
@@ -0,0 +1,21 @@
+#!/bin/bash
+
+set -x -euo pipefail
+
+TMPFS_SIZE=20 # GB
+MEM_TOTAL=$(awk '/MemTotal/ {print int($2/1024)}' /proc/meminfo)
+
+# sanity check: total mem is at least double TMPFS_SIZE
+if [ $MEM_TOTAL -lt $(($TMPFS_SIZE*1024*2)) ]; then
+    echo "tmpfsify-workspace.sh: will not allocate tmpfs, total memory is too low (${MEM_TOTAL}MB)"
+    exit 0
+fi
+
+dir="$(basename "$GITHUB_WORKSPACE")"
+cd "$(dirname "$GITHUB_WORKSPACE")"
+mv "${dir}" "${dir}.backup"
+mkdir "${dir}"
+sudo mount -t tmpfs -o size=${TMPFS_SIZE}G tmpfs "${dir}"
+rsync -a "${dir}.backup/" "${dir}"
+cd -
+
diff --git a/.github/scripts/veristat_compare.py b/.github/scripts/veristat_compare.py
new file mode 100644
index 0000000000000..07271b8cbd3aa
--- /dev/null
+++ b/.github/scripts/veristat_compare.py
@@ -0,0 +1,263 @@
+#!/usr/bin/env python3
+
+# This script reads a CSV file produced by the following invocation:
+#
+#   veristat --emit file,prog,verdict,states \
+#            --output-format csv \
+#            --compare ...
+#
+# And produces a markdown summary for the file.
+# The summary is printed to standard output and appended to a file
+# pointed to by GITHUB_STEP_SUMMARY variable.
+#
+# Script exits with return code 1 if there are new failures in the
+# veristat results.
+#
+# For testing purposes invoke as follows:
+#
+#  GITHUB_STEP_SUMMARY=/dev/null python3 veristat-compare.py test.csv
+#
+# File format (columns):
+#  0. file_name
+#  1. prog_name
+#  2. verdict_base
+#  3. verdict_comp
+#  4. verdict_diff
+#  5. total_states_base
+#  6. total_states_comp
+#  7. total_states_diff
+#
+# Records sample:
+#  file-a,a,success,failure,MISMATCH,12,12,+0 (+0.00%)
+#  file-b,b,success,success,MATCH,67,67,+0 (+0.00%)
+#
+# For better readability suffixes '_OLD' and '_NEW'
+# are used instead of '_base' and '_comp' for variable
+# names etc.
+
+import io
+import os
+import sys
+import re
+import csv
+import logging
+import argparse
+import enum
+from dataclasses import dataclass
+from typing import Dict, Iterable, List, Final
+
+
+TRESHOLD_PCT: Final[int] = 0
+
+SUMMARY_HEADERS = ["File", "Program", "Verdict", "States Diff (%)"]
+
+# expected format: +0 (+0.00%) / -0 (-0.00%)
+TOTAL_STATES_DIFF_REGEX = (
+    r"(?P<absolute_diff>[+-]\d+) \((?P<percentage_diff>[+-]\d+\.\d+)\%\)"
+)
+
+
+TEXT_SUMMARY_TEMPLATE: Final[str] = (
+    """
+# {title}
+
+{table}
+""".strip()
+)
+
+HTML_SUMMARY_TEMPLATE: Final[str] = (
+    """
+# {title}
+
+<details>
+<summary>Click to expand</summary>
+
+{table}
+</details>
+""".strip()
+)
+
+GITHUB_MARKUP_REPLACEMENTS: Final[Dict[str, str]] = {
+    "->": "&rarr;",
+    "(!!)": ":bangbang:",
+}
+
+NEW_FAILURE_SUFFIX: Final[str] = "(!!)"
+
+
+class VeristatFields(str, enum.Enum):
+    FILE_NAME = "file_name"
+    PROG_NAME = "prog_name"
+    VERDICT_OLD = "verdict_base"
+    VERDICT_NEW = "verdict_comp"
+    VERDICT_DIFF = "verdict_diff"
+    TOTAL_STATES_OLD = "total_states_base"
+    TOTAL_STATES_NEW = "total_states_comp"
+    TOTAL_STATES_DIFF = "total_states_diff"
+
+    @classmethod
+    def headers(cls) -> List[str]:
+        return [
+            cls.FILE_NAME,
+            cls.PROG_NAME,
+            cls.VERDICT_OLD,
+            cls.VERDICT_NEW,
+            cls.VERDICT_DIFF,
+            cls.TOTAL_STATES_OLD,
+            cls.TOTAL_STATES_NEW,
+            cls.TOTAL_STATES_DIFF,
+        ]
+
+
+@dataclass
+class VeristatInfo:
+    table: list
+    changes: bool
+    new_failures: bool
+
+    def get_results_title(self) -> str:
+        if self.new_failures:
+            return "There are new veristat failures"
+
+        if self.changes:
+            return "There are changes in verification performance"
+
+        return "No changes in verification performance"
+
+    def get_results_summary(self, markup: bool = False) -> str:
+        title = self.get_results_title()
+        if not self.table:
+            return f"# {title}\n"
+
+        template = TEXT_SUMMARY_TEMPLATE
+        table = format_table(headers=SUMMARY_HEADERS, rows=self.table)
+
+        if markup:
+            template = HTML_SUMMARY_TEMPLATE
+            table = github_markup_decorate(table)
+
+        return template.format(title=title, table=table)
+
+
+def get_state_diff(value: str) -> float:
+    if value == "N/A":
+        return 0.0
+
+    matches = re.match(TOTAL_STATES_DIFF_REGEX, value)
+    if not matches:
+        raise ValueError(f"Failed to parse total states diff field value '{value}'")
+
+    if percentage_diff := matches.group("percentage_diff"):
+        return float(percentage_diff)
+
+    raise ValueError(f"Invalid {VeristatFields.TOTAL_STATES_DIFF} field value: {value}")
+
+
+def parse_table(csv_file: Iterable[str]) -> VeristatInfo:
+    reader = csv.DictReader(csv_file)
+    assert reader.fieldnames == VeristatFields.headers()
+
+    new_failures = False
+    changes = False
+    table = []
+
+    for record in reader:
+        add = False
+
+        verdict_old, verdict_new = (
+            record[VeristatFields.VERDICT_OLD],
+            record[VeristatFields.VERDICT_NEW],
+        )
+
+        # Ignore results from completely new and removed programs
+        if "N/A" in [verdict_new, verdict_old]:
+            continue
+
+        if record[VeristatFields.VERDICT_DIFF] == "MISMATCH":
+            changes = True
+            add = True
+            verdict = f"{verdict_old} -> {verdict_new}"
+            if verdict_new == "failure":
+                new_failures = True
+                verdict += f" {NEW_FAILURE_SUFFIX}"
+        else:
+            verdict = record[VeristatFields.VERDICT_NEW]
+
+        diff = get_state_diff(record[VeristatFields.TOTAL_STATES_DIFF])
+        if abs(diff) > TRESHOLD_PCT:
+            changes = True
+            add = True
+
+        if not add:
+            continue
+
+        table.append(
+            [
+                record[VeristatFields.FILE_NAME],
+                record[VeristatFields.PROG_NAME],
+                verdict,
+                f"{diff:+.2f} %",
+            ]
+        )
+
+    return VeristatInfo(table=table, changes=changes, new_failures=new_failures)
+
+
+def github_markup_decorate(input_str: str) -> str:
+    for text, markup in GITHUB_MARKUP_REPLACEMENTS.items():
+        input_str = input_str.replace(text, markup)
+    return input_str
+
+
+def format_table(headers: List[str], rows: List[List[str]]) -> str:
+    column_width = [
+        max(len(row[column_idx]) for row in [headers] + rows)
+        for column_idx in range(len(headers))
+    ]
+
+    # Row template string in the following format:
+    # "{0:8}|{1:10}|{2:15}|{3:7}|{4:10}"
+    row_template = "|".join(
+        f"{{{idx}:{width}}}" for idx, width in enumerate(column_width)
+    )
+    row_template_nl = f"|{row_template}|\n"
+
+    with io.StringIO() as out:
+        out.write(row_template_nl.format(*headers))
+
+        separator_row = ["-" * width for width in column_width]
+        out.write(row_template_nl.format(*separator_row))
+
+        for row in rows:
+            row_str = row_template_nl.format(*row)
+            out.write(row_str)
+
+        return out.getvalue()
+
+
+def main(compare_csv_filename: os.PathLike, output_filename: os.PathLike) -> None:
+    with open(compare_csv_filename, newline="", encoding="utf-8") as csv_file:
+        veristat_results = parse_table(csv_file)
+
+    sys.stdout.write(veristat_results.get_results_summary())
+
+    with open(output_filename, encoding="utf-8", mode="a") as file:
+        file.write(veristat_results.get_results_summary(markup=True))
+
+    if veristat_results.new_failures:
+        return 1
+
+    return 0
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(
+        description="Print veristat comparison output as markdown step summary"
+    )
+    parser.add_argument("filename")
+    args = parser.parse_args()
+    summary_filename = os.getenv("GITHUB_STEP_SUMMARY")
+    if not summary_filename:
+        logging.error("GITHUB_STEP_SUMMARY environment variable is not set")
+        sys.exit(1)
+    sys.exit(main(args.filename, summary_filename))
diff --git a/.github/workflows/ai-code-review.yml b/.github/workflows/ai-code-review.yml
new file mode 100644
index 0000000000000..1e06d2d44abf6
--- /dev/null
+++ b/.github/workflows/ai-code-review.yml
@@ -0,0 +1,132 @@
+name: AI Code Review
+
+permissions:
+  contents: read
+  id-token: write
+  issues: write
+  pull-requests: write
+
+on:
+  pull_request:
+    types: [opened, review_requested]
+
+jobs:
+  get-commits:
+    # This codition is an indicator that we are running in a context of PR owned by kernel-patches org
+    if: ${{ github.repository == 'kernel-patches/bpf' && vars.AWS_REGION }}
+    runs-on: 'ubuntu-latest'
+    continue-on-error: true
+    outputs:
+      commits: ${{ steps.get-commits.outputs.commits }}
+    steps:
+      - name: Checkout Linux source tree
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 32
+
+      # Get the list of commits and trigger a review job for each separate commit
+      # As a safeguard, check no more than the first 50 commits
+      - name: Get PR commits
+        id: get-commits
+        run: |
+          tmp=$(mktemp)
+          git rev-list ${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }} | head -n 50 > pr_commits.txt
+          cat pr_commits.txt | jq -R -s -c 'split("\n")[:-1]' > $tmp
+          echo "commits=$(cat $tmp)" >> $GITHUB_OUTPUT
+
+
+  ai-review:
+    needs: get-commits
+    runs-on: 'ubuntu-latest'
+    strategy:
+      matrix:
+        commit: ${{ fromJson(needs.get-commits.outputs.commits) }}
+      fail-fast: false
+    env:
+      AWS_REGION: us-west-2
+    steps:
+      - name: Checkout CI code
+        uses: actions/checkout@v5
+        with:
+          sparse-checkout: |
+            .github
+            ci
+
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.KP_REVIEW_BOT_APP_ID }}
+          private-key: ${{ secrets.KP_REVIEW_BOT_APP_PRIVATE_KEY }}
+
+      - name: Configure AWS Credentials (OIDC)
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_BEDROCK_ROLE }}
+          aws-region: us-west-2
+
+      - name: Set up .claude/settings.json
+        shell: bash
+        run: |
+          mkdir -p ~/.claude
+          cp ci/claude/settings.json ~/.claude/settings.json
+
+      - name: Checkout Linux source tree
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 32
+          ref: ${{ matrix.commit }}
+
+      - name: Get patch subject
+        id: get-patch-subject
+        shell: bash
+        run: |
+          subject=$(git log -1 --pretty=format:"%s" ${{ matrix.commit }})
+          echo "subject=$subject" >> $GITHUB_OUTPUT
+
+      - name: Checkout prompts repo
+        uses: actions/checkout@v5
+        with:
+          repository: 'masoncl/review-prompts'
+          path: 'review'
+
+      - uses: anthropics/claude-code-action@v1
+        with:
+          github_token: ${{ steps.app-token.outputs.token }}
+          use_bedrock: "true"
+          claude_args: '--max-turns 100'
+          prompt: |
+            Current directory is the root of a Linux Kernel git repository.
+            Using the prompt `review/review-core.md` and the prompt directory `review`
+            do a code review of the top commit in the Linux repository.
+
+      # If Claude produced review-inline.txt then it found something
+      # Post a comment on PR and fail the job
+      - name: Check review-inline.txt
+        id: check_review
+        shell: bash
+        run: |
+          review_file=$(find ${{ github.workspace }} -name review-inline.txt)
+          if [ -s "$review_file" ]; then
+              cat $review_file || true
+              echo "review_file=$review_file" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Comment on PR
+        if: steps.check_review.outputs.review_file != ''
+        uses: actions/github-script@v8
+        env:
+          REVIEW_FILE: ${{ steps.check_review.outputs.review_file }}
+          PATCH_SUBJECT: ${{ steps.get-patch-subject.outputs.subject }}
+        with:
+          github-token: ${{ steps.app-token.outputs.token }}
+          script: |
+            const commentScript = require('./ci/claude/post-pr-comment.js');
+            await commentScript({github, context});
+
+      - name: Fail CI job if review file exists
+        if: steps.check_review.outputs.review_file != ''
+        run: |
+          echo "Review file found - failing the CI job"
+          exit 42
+
diff --git a/.github/workflows/gcc-bpf.yml b/.github/workflows/gcc-bpf.yml
new file mode 100644
index 0000000000000..5f05234399d33
--- /dev/null
+++ b/.github/workflows/gcc-bpf.yml
@@ -0,0 +1,103 @@
+name: Testing GCC BPF compiler
+
+on:
+  workflow_call:
+    inputs:
+      runs_on:
+        required: true
+        type: string
+      arch:
+        required: true
+        type: string
+      gcc_version:
+        required: true
+        type: string
+      llvm_version:
+        required: true
+        type: string
+      toolchain:
+        required: true
+        type: string
+      toolchain_full:
+        required: true
+        type: string
+      download_sources:
+        required: true
+        type: boolean
+
+jobs:
+  test:
+    name: GCC BPF
+    runs-on: >-
+      ${{
+          contains(fromJSON(inputs.runs_on), 'codebuild')
+          && format('codebuild-bpf-ci-{0}-{1}', github.run_id, github.run_attempt)
+          || fromJSON(inputs.runs_on)
+      }}
+    env:
+      ARCH: ${{ inputs.arch }}
+      BPF_NEXT_BASE_BRANCH: 'master'
+      GCC_BPF_INSTALL_DIR: ${{ github.workspace }}/gcc-bpf
+      GCC_BPF_RELEASE_REPO: 'theihor/gcc-bpf'
+      KBUILD_OUTPUT: ${{ github.workspace }}/src/kbuild-output
+      REPO_ROOT: ${{ github.workspace }}/src
+
+    steps:
+
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: |
+            .github
+            ci
+
+      - if: ${{ inputs.download_sources }}
+        name: Download bpf-next tree
+        uses: libbpf/ci/get-linux-source@v3
+        with:
+          dest: ${{ env.REPO_ROOT }}
+          rev: ${{ env.BPF_NEXT_BASE_BRANCH }}
+
+      - if: ${{ ! inputs.download_sources }}
+        name: Checkout ${{ github.repository }} to ./src
+        uses: actions/checkout@v4
+        with:
+          path: 'src'
+
+      - uses:  libbpf/ci/patch-kernel@v3
+        with:
+          patches-root: '${{ github.workspace }}/ci/diffs'
+          repo-root: ${{ env.REPO_ROOT }}
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: vmlinux-${{ inputs.arch }}-${{ inputs.toolchain_full }}
+          path: ${{ env.REPO_ROOT }}
+
+      - name: Untar artifacts
+        working-directory: ${{ env.REPO_ROOT }}
+        run: zstd -d -T0 vmlinux-${{ inputs.arch }}-${{ inputs.toolchain_full }}.tar.zst --stdout | tar -xf -
+
+      - name: Setup build environment
+        uses: libbpf/ci/setup-build-env@v3
+        with:
+          arch: ${{ inputs.arch }}
+          gcc-version: ${{ inputs.gcc_version }}
+          llvm-version: ${{ inputs.llvm_version }}
+
+      - name: Download GCC BPF compiler
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: .github/scripts/download-gcc-bpf.sh ${{ env.GCC_BPF_RELEASE_REPO }} ${{ env.GCC_BPF_INSTALL_DIR }}
+
+      - name: Build selftests/bpf/test_progs-bpf_gcc
+        uses: libbpf/ci/build-selftests@v3
+        env:
+          BPF_GCC: ${{ env.GCC_BPF_INSTALL_DIR }}
+          MAX_MAKE_JOBS: 32
+          SELFTESTS_BPF_TARGETS: 'test_progs-bpf_gcc'
+        with:
+          arch: ${{ inputs.arch }}
+          kernel-root: ${{ env.REPO_ROOT }}
+          llvm-version: ${{ inputs.llvm_version }}
+          toolchain: ${{ inputs.toolchain }}
diff --git a/.github/workflows/kernel-build-test.yml b/.github/workflows/kernel-build-test.yml
new file mode 100644
index 0000000000000..ceb47761e905b
--- /dev/null
+++ b/.github/workflows/kernel-build-test.yml
@@ -0,0 +1,167 @@
+name: Reusable Build/Test/Veristat workflow
+
+on:
+  workflow_call:
+    inputs:
+      arch:
+        required: true
+        type: string
+        description: The architecture to build against, e.g x86_64, aarch64, s390x...
+      toolchain_full:
+        required: true
+        type: string
+        description: The toolchain and for llvm, its version, e.g gcc, llvm-15
+      toolchain:
+        required: true
+        type: string
+        description: The toolchain, e.g gcc, llvm
+      runs_on:
+        required: true
+        type: string
+        description: The runners to run the test on. This is a json string representing an array of labels.
+      build_runs_on:
+        required: true
+        type: string
+        description: The runners to run the builds on. This is a json string representing an array of labels.
+      gcc_version:
+        required: true
+        type: string
+        description: GCC version to install
+      llvm_version:
+        required: true
+        type: string
+        description: LLVM version to install
+      kernel:
+        required: true
+        type: string
+        description: The kernel to run the test against. For KPD this is always LATEST, which runs against a newly built kernel.
+      tests:
+        required: true
+        type: string
+        description: A serialized json array with the tests to be running, it must follow the json-matrix format, https://www.jitsejan.com/use-github-actions-with-json-file-as-matrix
+      run_veristat:
+        required: true
+        type: boolean
+        description: Whether or not to run the veristat job.
+      run_tests:
+        required: true
+        type: boolean
+        description: Whether or not to run the test job.
+      download_sources:
+        required: true
+        type: boolean
+        description: Whether to download the linux sources into the working directory.
+        default: false
+      build_release:
+        required: true
+        type: boolean
+        description: Build selftests with -O2 optimization in addition to non-optimized build.
+        default: false
+    secrets:
+      AWS_ROLE_ARN:
+        required: true
+
+jobs:
+
+  # Build kernel and selftest
+  build:
+    uses: ./.github/workflows/kernel-build.yml
+    with:
+      arch: ${{ inputs.arch }}
+      toolchain_full: ${{ inputs.toolchain_full }}
+      toolchain: ${{ inputs.toolchain }}
+      runs_on: ${{ inputs.build_runs_on }}
+      gcc_version: ${{ inputs.gcc_version }}
+      llvm_version: ${{ inputs.llvm_version }}
+      kernel: ${{ inputs.kernel }}
+      download_sources: ${{ inputs.download_sources }}
+
+  build-release:
+    if: ${{ inputs.build_release }}
+    uses: ./.github/workflows/kernel-build.yml
+    with:
+      arch: ${{ inputs.arch }}
+      toolchain_full: ${{ inputs.toolchain_full }}
+      toolchain: ${{ inputs.toolchain }}
+      runs_on: ${{ inputs.build_runs_on }}
+      gcc_version: ${{ inputs.gcc_version }}
+      llvm_version: ${{ inputs.llvm_version }}
+      kernel: ${{ inputs.kernel }}
+      download_sources: ${{ inputs.download_sources }}
+      release: true
+
+  test:
+    if: ${{ inputs.run_tests }}
+    uses: ./.github/workflows/kernel-test.yml
+    # Setting name to test here to avoid lengthy autogenerated names due to matrix
+    # e.g build-and-test x86_64-gcc / test (test_progs_parallel, true, 30) / test_progs_parallel on x86_64 with gcc
+    name: "test"
+    needs: [build]
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJSON(inputs.tests) }}
+    with:
+      arch: ${{ inputs.arch }}
+      toolchain_full: ${{ inputs.toolchain_full }}
+      runs_on: ${{ inputs.runs_on }}
+      kernel: ${{ inputs.kernel }}
+      test: ${{ matrix.test }}
+      continue_on_error: ${{ toJSON(matrix.continue_on_error) }}
+      timeout_minutes: ${{ matrix.timeout_minutes }}
+
+  veristat-kernel:
+    if: ${{ inputs.run_veristat }}
+    uses: ./.github/workflows/veristat-kernel.yml
+    needs: [build]
+    permissions:
+      id-token: write
+      contents: read
+    with:
+      arch: ${{ inputs.arch }}
+      toolchain_full: ${{ inputs.toolchain_full }}
+      runs_on: ${{ inputs.runs_on }}
+
+  veristat-meta:
+    # Check for vars.AWS_REGION is necessary to skip this job in case of a PR from a fork.
+    if: ${{ inputs.run_veristat && github.repository_owner == 'kernel-patches' && vars.AWS_REGION }}
+    uses: ./.github/workflows/veristat-meta.yml
+    needs: [build]
+    permissions:
+      id-token: write
+      contents: read
+    with:
+      arch: ${{ inputs.arch }}
+      toolchain_full: ${{ inputs.toolchain_full }}
+      aws_region: ${{ vars.AWS_REGION }}
+      runs_on: ${{ inputs.runs_on }}
+    secrets:
+      AWS_ROLE_ARN: ${{ secrets.AWS_ROLE_ARN }}
+
+  veristat-scx:
+    if: ${{ inputs.run_veristat }}
+    uses: ./.github/workflows/veristat-scx.yml
+    needs: [build]
+    permissions:
+      id-token: write
+      contents: read
+    with:
+      arch: ${{ inputs.arch }}
+      toolchain_full: ${{ inputs.toolchain_full }}
+      runs_on: ${{ inputs.runs_on }}
+      llvm_version: ${{ inputs.llvm_version }}
+
+  gcc-bpf:
+    name: 'GCC BPF'
+    if: ${{ inputs.arch == 'x86_64' }}
+    uses: ./.github/workflows/gcc-bpf.yml
+    needs: [build]
+    with:
+      # GCC BPF does not need /dev/kvm, so use the "build" runners
+      runs_on: ${{ inputs.build_runs_on }}
+      arch: ${{ inputs.arch }}
+      gcc_version: ${{ inputs.gcc_version }}
+      llvm_version: ${{ inputs.llvm_version }}
+      toolchain: ${{ inputs.toolchain }}
+      toolchain_full: ${{ inputs.toolchain_full }}
+      download_sources: ${{ inputs.download_sources }}
+
diff --git a/.github/workflows/kernel-build.yml b/.github/workflows/kernel-build.yml
new file mode 100644
index 0000000000000..296f5df43f696
--- /dev/null
+++ b/.github/workflows/kernel-build.yml
@@ -0,0 +1,231 @@
+
+name: Reusable build workflow
+
+on:
+  workflow_call:
+    inputs:
+      arch:
+        required: true
+        type: string
+        description: The architecture to build against, e.g x86_64, aarch64, s390x...
+      toolchain_full:
+        required: true
+        type: string
+        description: The toolchain and for llvm, its version, e.g gcc, llvm-15
+      toolchain:
+        required: true
+        type: string
+        description: The toolchain, e.g gcc, llvm
+      runs_on:
+        required: true
+        type: string
+        description: The runners to run the test on. This is a json string representing an array of labels.
+      gcc_version:
+        required: true
+        type: string
+        description: GCC version to install
+      llvm_version:
+        required: true
+        type: string
+        description: LLVM version to install
+      kernel:
+        required: true
+        type: string
+        description: The kernel to run the test against. For KPD this is always LATEST, which runs against a newly built kernel.
+      download_sources:
+        required: true
+        type: boolean
+        description: Whether to download the linux sources into the working directory.
+        default: false
+      release:
+        required: false
+        type: boolean
+        description: Build selftest with -O2 optimization
+        default: false
+
+jobs:
+  build:
+    name: build kernel and selftests ${{ inputs.release && '-O2' || '' }}
+    # To run on CodeBuild, runs-on value must correspond to the AWS
+    # CodeBuild project associated with the kernel-patches webhook
+    # However matrix.py passes just a 'codebuild' string
+    runs-on: >-
+      ${{
+          contains(fromJSON(inputs.runs_on), 'codebuild')
+          && format('codebuild-bpf-ci-{0}-{1}', github.run_id, github.run_attempt)
+          || fromJSON(inputs.runs_on)
+      }}
+    env:
+        ARTIFACTS_ARCHIVE: "vmlinux-${{ inputs.arch }}-${{ inputs.toolchain_full }}.tar.zst"
+        BPF_NEXT_BASE_BRANCH: 'master'
+        BPF_NEXT_FETCH_DEPTH: 64 # A bit of history is needed to facilitate incremental builds
+        CROSS_COMPILE: ${{ inputs.arch != 'x86_64' && 'true' || '' }}
+        BUILD_SCHED_EXT_SELFTESTS: ${{ inputs.arch == 'x86_64' || inputs.arch == 'aarch64' && 'true' || '' }}
+        KBUILD_OUTPUT: ${{ github.workspace }}/kbuild-output
+        KERNEL: ${{ inputs.kernel }}
+        KERNEL_ROOT: ${{ github.workspace }}
+        REFERENCE_REPO_PATH: /libbpfci/mirrors/linux
+        REPO_PATH: ""
+        REPO_ROOT: ${{ github.workspace }}
+        RUNNER_TYPE: ${{ contains(fromJSON(inputs.runs_on), 'codebuild') && 'codebuild' || 'default' }}
+    steps:
+
+      # git version 2.43.0 (current Ubuntu 24 installation)
+      # does not support git clone --revision option
+      # so make sure latest git is installed
+      - name: Install latest git
+        shell: bash
+        run: |
+            sudo apt-get update
+            sudo apt-get install -y software-properties-common
+            sudo add-apt-repository -y ppa:git-core/ppa
+            sudo apt-get update
+            sudo apt-get install -y git
+            git --version
+
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: |
+            .github
+            ci
+
+      - if: ${{ env.RUNNER_TYPE == 'codebuild' }}
+        shell: bash
+        run: .github/scripts/tmpfsify-workspace.sh
+
+      - if: ${{ ! inputs.download_sources }}
+        name: git clone ${{ github.repository }}@${{ github.sha }}
+        shell: bash
+        run: |
+          if [ -d "${{ env.REFERENCE_REPO_PATH }}" ]; then
+            git clone \
+              --revision ${{ github.sha }} \
+              --reference-if-able ${{ env.REFERENCE_REPO_PATH }} \
+              https://github.com/${{ github.repository }}.git .kernel
+          else
+            git clone \
+              --revision ${{ github.sha }} \
+              --depth ${{ inputs.download_sources && 1 || env.BPF_NEXT_FETCH_DEPTH }} \
+              https://github.com/${{ github.repository }}.git .kernel
+          fi
+
+      - if: ${{ inputs.download_sources }}
+        name: Download bpf-next tree
+        env:
+          FETCH_DEPTH: ${{ env.BPF_NEXT_FETCH_DEPTH }}
+        uses: libbpf/ci/get-linux-source@v3
+        with:
+          dest: '.kernel'
+          rev: ${{ env.BPF_NEXT_BASE_BRANCH }}
+
+      - uses: libbpf/ci/prepare-incremental-build@v3
+        with:
+          repo-root: '.kernel'
+          base-branch: >-
+            ${{    inputs.download_sources && env.BPF_NEXT_BASE_BRANCH
+                || github.event_name == 'pull_request' && github.base_ref
+                || github.ref_name
+             }}
+          arch: ${{ inputs.arch }}
+          toolchain_full: ${{ inputs.toolchain_full }}
+          kbuild-output: ${{ env.KBUILD_OUTPUT }}
+
+      - name: Move linux source in place
+        shell: bash
+        run: |
+          cd .kernel
+          rm -rf .git .github ci
+          mv -t .. $(ls -A)
+          cd ..
+          rmdir .kernel
+
+      - uses:  libbpf/ci/patch-kernel@v3
+        with:
+          patches-root: '${{ github.workspace }}/ci/diffs'
+          repo-root: ${{ env.REPO_ROOT }}
+
+      - name: Setup build environment
+        uses: libbpf/ci/setup-build-env@v3
+        with:
+          arch: ${{ inputs.arch }}
+          gcc-version: ${{ inputs.gcc_version }}
+          llvm-version: ${{ inputs.llvm_version }}
+          pahole: master
+
+        # We have to setup qemu+binfmt in order to enable cross-compation of selftests.
+        # During selftests build, freshly built bpftool is executed.
+        # On self-hosted bare-metal hosts binfmt is pre-configured.
+      - if: ${{ env.RUNNER_TYPE == 'codebuild' && env.CROSS_COMPILE }}
+        name: Set up docker
+        uses: docker/setup-docker-action@v4
+      - if: ${{ env.RUNNER_TYPE == 'codebuild' && env.CROSS_COMPILE }}
+        name: Setup binfmt and qemu
+        uses: docker/setup-qemu-action@v3
+        with:
+          image: tonistiigi/binfmt:qemu-v9.2.0
+
+      - name: Build kernel image
+        uses: libbpf/ci/build-linux@v3
+        with:
+          arch: ${{ inputs.arch }}
+          toolchain: ${{ inputs.toolchain }}
+          kbuild-output: ${{ env.KBUILD_OUTPUT }}
+          max-make-jobs: 32
+          llvm-version: ${{ inputs.llvm_version }}
+
+      - name: Build selftests/bpf
+        uses: libbpf/ci/build-selftests@v3
+        env:
+          MAX_MAKE_JOBS: 32
+          RELEASE: ${{ inputs.release && '1' || '' }}
+        with:
+          arch: ${{ inputs.arch }}
+          kernel-root: ${{ env.KERNEL_ROOT }}
+          llvm-version: ${{ inputs.llvm_version }}
+          toolchain: ${{ inputs.toolchain }}
+
+      - if: ${{ env.BUILD_SCHED_EXT_SELFTESTS }}
+        name: Build selftests/sched_ext
+        uses: libbpf/ci/build-scx-selftests@v3
+        with:
+          kbuild-output: ${{ env.KBUILD_OUTPUT }}
+          repo-root: ${{ env.REPO_ROOT }}
+          arch: ${{ inputs.arch }}
+          toolchain: ${{ inputs.toolchain }}
+          llvm-version: ${{ inputs.llvm_version }}
+          max-make-jobs: 32
+
+      - if: ${{ github.event_name != 'push' }}
+        name: Build samples
+        uses: libbpf/ci/build-samples@v3
+        with:
+          arch: ${{ inputs.arch }}
+          toolchain: ${{ inputs.toolchain }}
+          kbuild-output: ${{ env.KBUILD_OUTPUT }}
+          max-make-jobs: 32
+          llvm-version: ${{ inputs.llvm_version }}
+      - name: Tar artifacts
+        id: tar-artifacts
+        uses: libbpf/ci/tar-artifacts@v3
+        env:
+          ARCHIVE_BPF_SELFTESTS: 'true'
+          ARCHIVE_MAKE_HELPERS: 'true'
+          ARCHIVE_SCHED_EXT_SELFTESTS: ${{ env.BUILD_SCHED_EXT_SELFTESTS }}
+        with:
+          arch: ${{ inputs.arch }}
+          archive: ${{ env.ARTIFACTS_ARCHIVE }}
+          kbuild-output: ${{ env.KBUILD_OUTPUT }}
+          repo-root: ${{ env.REPO_ROOT }}
+      - if: ${{ github.event_name != 'push' }}
+        name: Remove KBUILD_OUTPUT content
+        shell: bash
+        run: |
+          # Remove $KBUILD_OUTPUT to prevent cache creation for pull requests.
+          # Only on pushed changes are build artifacts actually cached, because
+          # of github.com/actions/cache's cache isolation logic.
+          rm -rf "${KBUILD_OUTPUT}"
+      - uses: actions/upload-artifact@v4
+        with:
+          name: vmlinux-${{ inputs.arch }}-${{ inputs.toolchain_full }}${{ inputs.release && '-release' || '' }}
+          if-no-files-found: error
+          path: ${{ env.ARTIFACTS_ARCHIVE }}
diff --git a/.github/workflows/kernel-test.yml b/.github/workflows/kernel-test.yml
new file mode 100644
index 0000000000000..2885f2759de4a
--- /dev/null
+++ b/.github/workflows/kernel-test.yml
@@ -0,0 +1,96 @@
+name: Reusable test workflow
+
+on:
+  workflow_call:
+    inputs:
+      arch:
+        required: true
+        type: string
+        description: The architecture to build against, e.g x86_64, aarch64, s390x...
+      toolchain_full:
+        required: true
+        type: string
+        description: The toolchain and for llvm, its version, e.g gcc, llvm-15
+      runs_on:
+        required: true
+        type: string
+        description: The runners to run the test on. This is a json string representing an array of labels.
+      kernel:
+        required: true
+        type: string
+        description: The kernel to run the test against. For KPD this is always LATEST, which runs against a newly built kernel.
+      test:
+        required: true
+        type: string
+        description: The test to run in the vm, e.g test_progs, test_maps, test_progs_no_alu32...
+      continue_on_error:
+        required: true
+        type: string
+        description: Whether to continue on error. This is typically set to true for parallel tests which are currently known to fail, but we don't want to fail the whole CI because of that.
+      timeout_minutes:
+        required: true
+        type: number
+        description: In case a test runs for too long, after how many seconds shall we timeout and error.
+
+jobs:
+  test:
+    name: ${{ inputs.test }} on ${{ inputs.arch }} with ${{ inputs.toolchain_full }}
+    runs-on: ${{ fromJSON(inputs.runs_on) }}
+    timeout-minutes: 100
+    env:
+      ARCH: ${{ inputs.arch }}
+      KERNEL: ${{ inputs.kernel }}
+      REPO_ROOT: ${{ github.workspace }}
+      REPO_PATH: ""
+      # https://github.com/actions/runner/issues/1483#issuecomment-1031671517
+      # booleans are weird in GH.
+      CONTINUE_ON_ERROR: ${{ inputs.continue_on_error }}
+      DEPLOYMENT: ${{ github.repository == 'kernel-patches/bpf' && 'prod' || 'rc' }}
+      ALLOWLIST_FILE: /tmp/allowlist
+      DENYLIST_FILE: /tmp/denylist
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: |
+            .github
+            ci
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: vmlinux-${{ inputs.arch }}-${{ inputs.toolchain_full }}
+          path: .
+
+      - name: Untar artifacts
+        # zstd is installed by default in the runner images.
+        run: zstd -d -T0  vmlinux-${{ inputs.arch }}-${{ inputs.toolchain_full }}.tar.zst --stdout | tar -xf -
+
+      - name: Run selftests
+        uses: libbpf/ci/run-vmtest@v3
+        # https://github.com/actions/runner/issues/1483#issuecomment-1031671517
+        # booleans are weird in GH.
+        continue-on-error: ${{ fromJSON(env.CONTINUE_ON_ERROR) }}
+        timeout-minutes: ${{ inputs.timeout_minutes }}
+        env:
+          ARCH: ${{ inputs.arch }}
+          DEPLOYMENT: ${{ env.DEPLOYMENT }}
+          KERNEL_TEST: ${{ inputs.test }}
+          SELFTESTS_BPF: ${{ github.workspace }}/selftests/bpf
+          VMTEST_CONFIGS: ${{ github.workspace }}/ci/vmtest/configs
+          TEST_PROGS_TRAFFIC_MONITOR: ${{ inputs.arch == 'x86_64' && 'true' || '' }}
+          TEST_PROGS_WATCHDOG_TIMEOUT: 600
+        with:
+          arch: ${{ inputs.arch }}
+          vmlinuz: '${{ github.workspace }}/vmlinuz'
+          kernel-root: ${{ env.REPO_ROOT }}
+          max-cpu: 8
+          kernel-test: ${{ inputs.test }}
+          # Here we must use kbuild-output local to the repo, because
+          # it was extracted from the artifacts.
+          kbuild-output: ${{ env.REPO_ROOT }}/kbuild-output
+
+      - if: ${{ always() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: tmon-logs-${{ inputs.arch }}-${{ inputs.toolchain_full }}-${{ inputs.test }}
+          if-no-files-found: ignore
+          path: /tmp/tmon_pcap/*
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
new file mode 100644
index 0000000000000..1c910fd297309
--- /dev/null
+++ b/.github/workflows/lint.yml
@@ -0,0 +1,65 @@
+name: "lint"
+
+on:
+  pull_request:
+  push:
+    branches:
+      - master
+
+jobs:
+  shellcheck:
+    # This workflow gets injected into other Linux repositories, but we don't
+    # want it to run there.
+    if: ${{ github.repository == 'kernel-patches/vmtest' }}
+    name: ShellCheck
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Run ShellCheck
+        uses: ludeeus/action-shellcheck@master
+        env:
+          SHELLCHECK_OPTS: --severity=warning --exclude=SC1091
+
+  # Ensure some consistency in the formatting.
+  lint:
+    if: ${{ github.repository == 'kernel-patches/vmtest' }}
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Run black
+        uses: psf/black@stable
+        with:
+          src: ./.github/scripts
+
+  validate_matrix:
+    if: ${{ github.repository == 'kernel-patches/vmtest' }}
+    name: Validate matrix.py
+    runs-on: ubuntu-latest
+    env:
+      GITHUB_REPOSITORY_OWNER: ${{ matrix.owner }}
+      GITHUB_REPOSITORY: ${{ matrix.repository }}
+      GITHUB_OUTPUT: /dev/stdout
+    strategy:
+      matrix:
+        owner: ['kernel-patches', 'foo']
+        repository: ['bpf', 'vmtest', 'bar']
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: run script
+        run: |
+          python3 .github/scripts/matrix.py
+
+  unittests:
+    if: ${{ github.repository == 'kernel-patches/vmtest' }}
+    name: Unittests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Run unittests
+        run: python3 -m unittest scripts/tests/*.py
+        working-directory: .github
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
new file mode 100644
index 0000000000000..24773459a252d
--- /dev/null
+++ b/.github/workflows/test.yml
@@ -0,0 +1,73 @@
+name: bpf-ci
+
+on:
+  pull_request:
+  push:
+    branches:
+      - bpf_base
+      - bpf-next_base
+      - bpf-net_base
+      - for-next_base
+
+concurrency:
+  group: ci-test-${{ github.ref_name }}
+  cancel-in-progress: true
+
+jobs:
+  set-matrix:
+    # FIXME: set-matrix is lightweight, run it on any self-hosted machines for kernel-patches org
+    # so we do not wait for GH hosted runners when there potentially all are busy because of bpf-rc
+    # repo for instance.
+    # This could be somehow fixed long term by making this action/workflow re-usable and letting the called
+    # specify what to run on.
+    runs-on: ${{ github.repository_owner == 'kernel-patches' && 'x86_64' || 'ubuntu-latest' }}
+    permissions: read-all
+    outputs:
+      build-matrix: ${{ steps.set-matrix-impl.outputs.build_matrix }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: |
+            .github
+            ci
+      - name: Install script dependencies
+        shell: bash
+        run: |
+          sudo apt-get -y update
+          sudo apt-get -y install python3-requests
+      - id: set-matrix-impl
+        env:
+          GITHUB_TOKEN: ${{ secrets.GH_PAT_READ_RUNNERS }}
+        run: |
+          python3 .github/scripts/matrix.py
+
+  build-and-test:
+    # Setting name to arch-compiler here to avoid lengthy autogenerated names due to matrix
+    # e.g build-and-test x86_64-gcc / test (test_progs_parallel, true, 30) / test_progs_parallel on x86_64 with gcc
+    name: ${{ matrix.arch }} ${{ matrix.kernel_compiler }}-${{ matrix.kernel_compiler == 'gcc' && matrix.gcc_version || matrix.llvm_version }}
+    uses: ./.github/workflows/kernel-build-test.yml
+    needs: [set-matrix]
+    permissions:
+      id-token: write
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJSON(needs.set-matrix.outputs.build-matrix) }}
+    with:
+      arch: ${{ matrix.arch }}
+      toolchain: ${{ matrix.kernel_compiler }}
+      toolchain_full: ${{ matrix.kernel_compiler }}-${{ matrix.kernel_compiler == 'gcc' && matrix.gcc_version || matrix.llvm_version }}
+      runs_on: ${{ toJSON(matrix.runs_on) }}
+      build_runs_on: ${{ toJSON(matrix.build_runs_on) }}
+      gcc_version: ${{ matrix.gcc_version }}
+      llvm_version: ${{ matrix.llvm_version }}
+      kernel: ${{ matrix.kernel }}
+      tests: ${{ toJSON(matrix.tests) }}
+      run_veristat: ${{ matrix.run_veristat }}
+      # We only run tests on pull requests.
+      run_tests: ${{ github.event_name != 'push' }}
+      # Download sources
+      download_sources: ${{ github.repository == 'kernel-patches/vmtest' }}
+      build_release: ${{ matrix.build_release }}
+    secrets:
+      AWS_ROLE_ARN: ${{ secrets.AWS_ROLE_ARN }}
diff --git a/.github/workflows/veristat-kernel.yml b/.github/workflows/veristat-kernel.yml
new file mode 100644
index 0000000000000..8c9ba715bf277
--- /dev/null
+++ b/.github/workflows/veristat-kernel.yml
@@ -0,0 +1,66 @@
+name: veristat_kernel
+
+on:
+  workflow_call:
+    inputs:
+      arch:
+        required: true
+        type: string
+        description: The architecture to build against, e.g x86_64, aarch64, s390x...
+      toolchain_full:
+        required: true
+        type: string
+        description: Toolchain identifier, such as llvm-20
+      runs_on:
+        required: true
+        type: string
+        description: The runners to run the test on. This is a json string representing an array of labels.
+
+jobs:
+  veristat:
+    name: veristat-kernel
+    runs-on: ${{ fromJSON(inputs.runs_on) }}
+    timeout-minutes: 100
+    permissions:
+        id-token: write
+        contents: read
+    env:
+      KERNEL: LATEST
+      REPO_ROOT: ${{ github.workspace }}
+      REPO_PATH: ""
+      KBUILD_OUTPUT: kbuild-output/
+      ARCH_AND_TOOL: ${{ inputs.arch }}-${{ inputs.toolchain_full }}
+      VERISTAT_DUMP_LOG_ON_FAILURE: 'true'
+      VERISTAT_TARGET: kernel
+
+    steps:
+
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: |
+            .github
+            ci
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: vmlinux-${{ env.ARCH_AND_TOOL }}
+          path: .
+
+      - name: Untar artifacts
+        run: zstd -d -T0  vmlinux-${{ env.ARCH_AND_TOOL }}.tar.zst --stdout | tar -xf -
+
+      - name: Run veristat
+        uses: libbpf/ci/run-vmtest@v3
+        with:
+          arch: x86_64
+          vmlinuz: '${{ github.workspace }}/vmlinuz'
+          kernel-root: '.'
+          max-cpu: 8
+          kernel-test: 'run_veristat'
+          output-dir: '${{ github.workspace }}'
+
+      - name: Compare and save veristat.kernel.csv
+        uses: ./.github/actions/veristat_baseline_compare
+        with:
+          veristat_output: veristat-kernel
+          baseline_name: ${{ env.ARCH_AND_TOOL}}-baseline-veristat-kernel
diff --git a/.github/workflows/veristat-meta.yml b/.github/workflows/veristat-meta.yml
new file mode 100644
index 0000000000000..675127d322491
--- /dev/null
+++ b/.github/workflows/veristat-meta.yml
@@ -0,0 +1,88 @@
+name: veristat_meta
+
+on:
+  workflow_call:
+    inputs:
+      arch:
+        required: true
+        type: string
+        description: The architecture to build against, e.g x86_64, aarch64, s390x...
+      toolchain_full:
+        required: true
+        type: string
+        description: Toolchain identifier, such as llvm-20
+      runs_on:
+        required: true
+        type: string
+        description: The runners to run the test on. This is a json string representing an array of labels.
+      aws_region:
+        required: true
+        type: string
+        description: The AWS region where we pull bpf objects to run against veristat.
+    secrets:
+        AWS_ROLE_ARN:
+            required: true
+            description: The AWS role used by GH to pull BPF objects from AWS.
+
+jobs:
+  veristat:
+    name: veristat-meta
+    runs-on: ${{ fromJSON(inputs.runs_on) }}
+    timeout-minutes: 100
+    permissions:
+        id-token: write
+        contents: read
+    env:
+      KERNEL: LATEST
+      REPO_ROOT: ${{ github.workspace }}
+      REPO_PATH: ""
+      KBUILD_OUTPUT: kbuild-output/
+      ARCH_AND_TOOL: ${{ inputs.arch }}-${{ inputs.toolchain_full }}
+      VERISTAT_TARGET: meta
+
+    steps:
+
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: |
+            .github
+            ci
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: vmlinux-${{ env.ARCH_AND_TOOL }}
+          path: .
+
+      - name: Untar artifacts
+        run: zstd -d -T0  vmlinux-${{ env.ARCH_AND_TOOL }}.tar.zst --stdout | tar -xf -
+
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v3
+        with:
+          aws-region: ${{ inputs.aws_region }}
+          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
+          role-session-name: github-action-bpf-ci
+
+      - name: Download BPF objects
+        run: |
+          mkdir ./bpf_objects
+          aws s3 sync s3://veristat-bpf-binaries ./bpf_objects
+        env:
+          AWS_ROLE_ARN: ${{ secrets.AWS_ROLE_ARN }}
+
+      - name: Run veristat
+        uses: libbpf/ci/run-vmtest@v3
+        with:
+          arch: x86_64
+          vmlinuz: '${{ github.workspace }}/vmlinuz'
+          kernel-root: '.'
+          max-cpu: 8
+          kernel-test: 'run_veristat'
+          output-dir: '${{ github.workspace }}'
+
+      - name: Compare and save veristat.meta.csv
+        uses: ./.github/actions/veristat_baseline_compare
+        with:
+          veristat_output: veristat-meta
+          baseline_name: ${{ env.ARCH_AND_TOOL}}-baseline-veristat-meta
+
diff --git a/.github/workflows/veristat-scx.yml b/.github/workflows/veristat-scx.yml
new file mode 100644
index 0000000000000..641c142e58274
--- /dev/null
+++ b/.github/workflows/veristat-scx.yml
@@ -0,0 +1,103 @@
+name: veristat_kernel
+
+on:
+  workflow_call:
+    inputs:
+      arch:
+        required: true
+        type: string
+        description: The architecture to build against, e.g x86_64, aarch64, s390x...
+      toolchain_full:
+        required: true
+        type: string
+        description: Toolchain identifier, such as llvm-20
+      runs_on:
+        required: true
+        type: string
+        description: The runners to run the test on. This is a json string representing an array of labels.
+      llvm_version:
+        required: true
+        type: string
+
+jobs:
+
+  build-scheds:
+    name: build sched-ext/scx
+    runs-on: ${{ fromJSON(inputs.runs_on) }}
+    env:
+      LLVM_VERSION: ${{ inputs.llvm_version }}
+      SCX_BUILD_OUTPUT: ${{ github.workspace }}/scx-build-output
+      SCX_PROGS: ${{ github.workspace }}/scx-progs
+      SCX_REVISION: 737b9b13ccd15e44efb8cdba507f89e595ad3af6
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: |
+            .github
+            ci
+      - uses: libbpf/ci/build-scx-scheds@v3
+        with:
+          output-dir: ${{ env.SCX_BUILD_OUTPUT }}
+      - name: Collect scx progs
+        run: ${{ github.workspace }}/.github/scripts/collect-scx-bpf-progs.sh ${{ env.SCX_PROGS }}
+      - name: Upload scx progs
+        uses: actions/upload-artifact@v4
+        with:
+          name: scx-progs-${{ inputs.arch }}-${{ inputs.toolchain_full }}
+          if-no-files-found: error
+          path: ${{ env.SCX_PROGS }}
+
+  veristat:
+    name: veristat-scx
+    runs-on: ${{ fromJSON(inputs.runs_on) }}
+    needs: [build-scheds]
+    permissions:
+        id-token: write
+        contents: read
+    env:
+      KERNEL: LATEST
+      REPO_ROOT: ${{ github.workspace }}
+      REPO_PATH: ""
+      KBUILD_OUTPUT: kbuild-output/
+      ARCH_AND_TOOL: ${{ inputs.arch }}-${{ inputs.toolchain_full }}
+      VERISTAT_DUMP_LOG_ON_FAILURE: 'true'
+      VERISTAT_TARGET: scx
+      SCX_PROGS: ${{ github.workspace }}/scx-progs
+
+    steps:
+
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: |
+            .github
+            ci
+
+      - name: Download kernel build artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: vmlinux-${{ env.ARCH_AND_TOOL }}
+          path: .
+
+      - name: Untar kernel build artifacts
+        run: zstd -d -T0  vmlinux-${{ env.ARCH_AND_TOOL }}.tar.zst --stdout | tar -xf -
+
+      - name: Download scx progs
+        uses: actions/download-artifact@v4
+        with:
+          name: scx-progs-${{ inputs.arch }}-${{ inputs.toolchain_full }}
+          path: ${{ env.SCX_PROGS }}
+
+      - name: Run veristat
+        uses: libbpf/ci/run-vmtest@v3
+        with:
+          arch: x86_64
+          vmlinuz: '${{ github.workspace }}/vmlinuz'
+          kernel-root: '.'
+          kernel-test: 'run_veristat'
+          output-dir: '${{ github.workspace }}'
+
+      - name: Compare and save veristat.scx.csv
+        uses: ./.github/actions/veristat_baseline_compare
+        with:
+          veristat_output: veristat-scx
+          baseline_name: ${{ env.ARCH_AND_TOOL}}-baseline-veristat-scx
diff --git a/README.md b/README.md
new file mode 100644
index 0000000000000..81a0c1a644b0f
--- /dev/null
+++ b/README.md
@@ -0,0 +1,22 @@
+# BPF CI GitHub Actions worfklows
+
+This repository contains GitHub Actions workflow definitions, scripts and configuration files used by those workflows.
+
+You can check the workflow runs on [kernel-patches/bpf actions page](https://github.com/kernel-patches/bpf/actions/workflows/test.yml). 
+
+**"BPF CI"** refers to a continuous integration testing system targeting [BPF subsystem of the Linux Kernel](https://ebpf.io/what-is-ebpf/).
+
+BPF CI consists of a number of components:
+- [kernel-patches/bpf](https://github.com/kernel-patches/bpf) - a copy of Linux Kernel source repository tracking [upstream bpf trees](https://web.git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/)
+- [Kernel Patches Daemon](https://github.com/kernel-patches/kernel-patches-daemon) instance - a service connecting [Patchwork](https://patchwork.kernel.org/project/netdevbpf/list/) with the GitHub repository
+- [kernel-patches/vmtest](https://github.com/kernel-patches/vmtest) (this repository) - GitHub Actions workflows
+- [libbpf/ci](https://github.com/libbpf/ci) - custom reusable GitHub Actions
+- [kernel-patches/runner](https://github.com/kernel-patches/runner) - self-hosted GitHub Actions runners
+
+Of course BPF CI also has important dependencies such as:
+- [selftests/bpf](https://web.git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/tree/tools/testing/selftests/bpf) - the main test suite of BPF CI
+- [selftests/sched_ext](https://web.git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/tree/tools/testing/selftests/sched_ext) - in-kernel sched_ext test suite
+- [veristat](https://web.git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/tree/tools/testing/selftests/bpf/veristat.c) - used to catch performance and BPF verification regressions on a suite of complex BPF programs
+- [vmtest](https://github.com/danobi/vmtest) - a QEMU wrapper, used to execute tests in a VM
+- [GCC BPF backend](https://gcc.gnu.org/wiki/BPFBackEnd)
+- Above-mentioned [Patchwork](https://patchwork.kernel.org/) instance, maintained by the Linux Foundation
diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
index de5083cb1d374..36a0d4db9f686 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -660,24 +660,38 @@ int bpf_arch_text_poke(void *ip, enum bpf_text_poke_type t,
 
 #define EMIT_LFENCE()	EMIT3(0x0F, 0xAE, 0xE8)
 
-static void emit_indirect_jump(u8 **pprog, int reg, u8 *ip)
+static void __emit_indirect_jump(u8 **pprog, int reg, bool ereg)
 {
 	u8 *prog = *pprog;
 
+	if (ereg)
+		EMIT1(0x41);
+
+	EMIT2(0xFF, 0xE0 + reg);
+
+	*pprog = prog;
+}
+
+static void emit_indirect_jump(u8 **pprog, int bpf_reg, u8 *ip)
+{
+	u8 *prog = *pprog;
+	int reg = reg2hex[bpf_reg];
+	bool ereg = is_ereg(bpf_reg);
+
 	if (cpu_feature_enabled(X86_FEATURE_INDIRECT_THUNK_ITS)) {
 		OPTIMIZER_HIDE_VAR(reg);
-		emit_jump(&prog, its_static_thunk(reg), ip);
+		emit_jump(&prog, its_static_thunk(reg + 8*ereg), ip);
 	} else if (cpu_feature_enabled(X86_FEATURE_RETPOLINE_LFENCE)) {
 		EMIT_LFENCE();
-		EMIT2(0xFF, 0xE0 + reg);
+		__emit_indirect_jump(&prog, reg, ereg);
 	} else if (cpu_feature_enabled(X86_FEATURE_RETPOLINE)) {
 		OPTIMIZER_HIDE_VAR(reg);
 		if (cpu_feature_enabled(X86_FEATURE_CALL_DEPTH))
-			emit_jump(&prog, &__x86_indirect_jump_thunk_array[reg], ip);
+			emit_jump(&prog, &__x86_indirect_jump_thunk_array[reg + 8*ereg], ip);
 		else
-			emit_jump(&prog, &__x86_indirect_thunk_array[reg], ip);
+			emit_jump(&prog, &__x86_indirect_thunk_array[reg + 8*ereg], ip);
 	} else {
-		EMIT2(0xFF, 0xE0 + reg);	/* jmp *%\reg */
+		__emit_indirect_jump(&prog, reg, ereg);
 		if (IS_ENABLED(CONFIG_MITIGATION_RETPOLINE) || IS_ENABLED(CONFIG_MITIGATION_SLS))
 			EMIT1(0xCC);		/* int3 */
 	}
@@ -797,7 +811,7 @@ static void emit_bpf_tail_call_indirect(struct bpf_prog *bpf_prog,
 	 * rdi == ctx (1st arg)
 	 * rcx == prog->bpf_func + X86_TAIL_CALL_OFFSET
 	 */
-	emit_indirect_jump(&prog, 1 /* rcx */, ip + (prog - start));
+	emit_indirect_jump(&prog, BPF_REG_4 /* R4 -> rcx */, ip + (prog - start));
 
 	/* out: */
 	ctx->tail_call_indirect_label = prog - start;
@@ -2614,6 +2628,9 @@ st:			if (is_imm8(insn->off))
 
 			break;
 
+		case BPF_JMP | BPF_JA | BPF_X:
+			emit_indirect_jump(&prog, insn->dst_reg, image + addrs[i - 1]);
+			break;
 		case BPF_JMP | BPF_JA:
 		case BPF_JMP32 | BPF_JA:
 			if (BPF_CLASS(insn->code) == BPF_JMP) {
@@ -3543,7 +3560,7 @@ static int emit_bpf_dispatcher(u8 **pprog, int a, int b, s64 *progs, u8 *image,
 		if (err)
 			return err;
 
-		emit_indirect_jump(&prog, 2 /* rdx */, image + (prog - buf));
+		emit_indirect_jump(&prog, BPF_REG_3 /* R3 -> rdx */, image + (prog - buf));
 
 		*pprog = prog;
 		return 0;
@@ -3827,6 +3844,15 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
 			jit_data->header = header;
 			jit_data->rw_header = rw_header;
 		}
+
+		/*
+		 * The bpf_prog_update_insn_ptrs function expects addrs to
+		 * point to the first byte of the jitted instruction (unlike
+		 * the bpf_prog_fill_jited_linfo below, which, for historical
+		 * reasons, expects to point to the next instruction)
+		 */
+		bpf_prog_update_insn_ptrs(prog, addrs, image);
+
 		/*
 		 * ctx.prog_offset is used when CFI preambles put code *before*
 		 * the function. See emit_cfi(). For FineIBT specifically this code
diff --git a/ci/claude/README.md b/ci/claude/README.md
new file mode 100644
index 0000000000000..669b942d0c15e
--- /dev/null
+++ b/ci/claude/README.md
@@ -0,0 +1,67 @@
+# AI Code Reviews in BPF CI
+
+## TL;DR
+- **Please make sure AI is actually wrong before dismissing the review**
+  - An email response explaining why AI is wrong would be very helpful
+- BPF CI includes [a workflow](https://github.com/kernel-patches/vmtest/blob/master/.github/workflows/ai-code-review.yml) running AI code review
+- The reviews are posted as comments on [kernel-patches/bpf PRs](https://github.com/kernel-patches/bpf/pulls)
+- The review comments are forwarded to the patch recipients via email by [KPD](https://github.com/kernel-patches/kernel-patches-daemon)
+- Prompts are here: https://github.com/masoncl/review-prompts
+
+If you received an AI review for your patch submission, please try to evaluate it in the same way you would if it was written by a person, and respond.
+Your response is for humans, not for AI.
+
+## How does it work?
+
+BPF CI is processing every patch series submitted to the [Linux Kernel BPF mailing list](https://lore.kernel.org/bpf/).
+Against each patch the system executes various tests, such as [selftests/bpf](https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/tree/tools/testing/selftests/bpf), and since recently it also executes automated code reviews performed by LLM-based AI.
+
+BPF CI runs on [Github Actions](https://docs.github.com/en/actions) workflows orchestrated by [KPD](https://github.com/kernel-patches/kernel-patches-daemon).
+
+The AI review is implemented with [Claude Code GitHub Action](https://github.com/anthropics/claude-code-action), which essentially installs Claude Code command-line app and a MCP server with a number of common tools available to it.
+
+LLMs are accessed via [AWS Bedrock](https://aws.amazon.com/bedrock), the GitHub Actions workflow authenticates to AWS account with [OIDC](https://docs.github.com/en/actions/how-tos/secure-your-work/security-harden-deployments/oidc-in-aws).
+
+To achieve the output that might have led you to this page, [a set of elaborate prompts](https://github.com/masoncl/review-prompts) were developed specifically targeting the Linux Kernel source code.
+The workflow checks out the Linux and prompts repository and initiates the review with a trivial [trigger prompt](https://github.com/kernel-patches/vmtest/blob/master/.github/workflows/ai-code-review.yml#L91-L94).
+
+### Are the reviews even accurate?
+
+We make every effort for AI reviews to be high-signal messages. Although the nature of LLMs makes them prone to mistakes.
+
+At this point this is still an experiment, but the results so far have been promising.
+For example, AI is pretty good at catching dumb mistakes (e.g. use-after-free) that humans can easily miss.
+At the same time AI can miss context obvious to a human, such as relationships between newer and older changes.
+
+If you'd like to suggest an improvement to the prompts, open a PR to [review-prompts](https://github.com/masoncl/review-prompts) repository.
+
+### Will my patch get nacked because of the AI review?
+
+Paraphrasing IBM training manual:
+> "A LLM can never be held accountable, therefore a LLM must never make an Ack/Nack decision"
+
+The review prompts are designed such that AI is only searching for the regressions it can provide evidence for.
+For the majority of patches a review is not generated, so if you received one it's worth evaluating.
+
+It's unlikely that your patch gets discarded *just* because AI found something, especially if you address it or explain why AI is wrong.
+
+But if you ignore an AI review, human reviewers will likely ask for a reason.
+
+### What if I don't like it?
+
+Bring it up with the maintainers on the mailing list and elaborate.
+
+It is expected that AI may be mistaken. However it is also expected that the patch authors answer reasonable questions about the code changes they propose.
+
+If there is a technical issue (say with email notifications, formatting etc.), open an issue in [this repository](https://github.com/kernel-patches/vmtest/issues).
+
+### Who pays for the tokens?
+
+[Meta Platforms, Inc.](https://www.meta.com/)
+
+BPF CI in its current form has been developed and maintained by the Linux Kernel team at Meta. Most of the relevant hardware is also provided by Meta.
+
+### Who set this up?
+
+- [Chris Mason](https://github.com/masoncl) is the prompt engineer
+- [Ihor Solodrai](https://github.com/theihor) is the infra plumber
diff --git a/ci/claude/post-pr-comment.js b/ci/claude/post-pr-comment.js
new file mode 100644
index 0000000000000..218b7709c26c5
--- /dev/null
+++ b/ci/claude/post-pr-comment.js
@@ -0,0 +1,33 @@
+module.exports = async ({github, context}) => {
+  const fs = require('fs');
+
+  const jobSummaryUrl = `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}`;
+  const reviewContent = fs.readFileSync(process.env.REVIEW_FILE, 'utf8');
+  const subject = process.env.PATCH_SUBJECT || 'Could not determine patch subject';
+  const commentBody = `
+\`\`\`
+${reviewContent}
+\`\`\`
+
+---
+AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
+See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
+
+In-Reply-To-Subject: \`${subject}\`
+CI run summary: ${jobSummaryUrl}
+`;
+
+  await github.rest.issues.createComment({
+    issue_number: context.issue.number,
+    owner: context.repo.owner,
+    repo: context.repo.repo,
+    body: commentBody
+  });
+
+  await github.rest.issues.addLabels({
+    issue_number: context.issue.number,
+    owner: context.repo.owner,
+    repo: context.repo.repo,
+    labels: ["ai-review"],
+  });
+};
diff --git a/ci/claude/settings.json b/ci/claude/settings.json
new file mode 100644
index 0000000000000..06717188a9631
--- /dev/null
+++ b/ci/claude/settings.json
@@ -0,0 +1,7 @@
+{
+  "model": "us.anthropic.claude-sonnet-4-5-20250929-v1:0",
+  "permissions": {
+    "allow": ["Bash", "Edit", "MultiEdit", "Write"],
+    "defaultMode": "acceptEdits"
+  }
+}
diff --git a/ci/diffs/.keep b/ci/diffs/.keep
new file mode 100644
index 0000000000000..e69de29bb2d1d
diff --git a/ci/diffs/0001-selftests-bpf-disable-detection-of-llvm-when-buildin.patch b/ci/diffs/0001-selftests-bpf-disable-detection-of-llvm-when-buildin.patch
new file mode 100644
index 0000000000000..6497a6cc38c90
--- /dev/null
+++ b/ci/diffs/0001-selftests-bpf-disable-detection-of-llvm-when-buildin.patch
@@ -0,0 +1,41 @@
+From 42839864a62ee244ec280b09149b1cb439f681db Mon Sep 17 00:00:00 2001
+From: Manu Bretelle <chantr4@gmail.com>
+Date: Fri, 27 Oct 2023 18:25:39 -0700
+Subject: [PATCH bpf-next] selftests/bpf: disable detection of llvm when
+ building bpftool
+
+The VMs in which we run the selftests do not have llvm installed.
+We build selftests/bpftool in a host that have llvm.
+bpftool currently will use llvm first and fallback to libbfd but there
+is no way to disable detection from the command line.
+
+Removing it from the feature detection should force us to use libbfd.
+
+Signed-off-by: Manu Bretelle <chantr4@gmail.com>
+---
+ tools/bpf/bpftool/Makefile | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/tools/bpf/bpftool/Makefile b/tools/bpf/bpftool/Makefile
+index e9154ace80ff..01314458e25e 100644
+--- a/tools/bpf/bpftool/Makefile
++++ b/tools/bpf/bpftool/Makefile
+@@ -95,7 +95,6 @@ RM ?= rm -f
+ FEATURE_USER = .bpftool
+ 
+ FEATURE_TESTS := clang-bpf-co-re
+-FEATURE_TESTS += llvm
+ FEATURE_TESTS += libcap
+ FEATURE_TESTS += libbfd
+ FEATURE_TESTS += libbfd-liberty
+@@ -104,7 +103,6 @@ FEATURE_TESTS += disassembler-four-args
+ FEATURE_TESTS += disassembler-init-styled
+ 
+ FEATURE_DISPLAY := clang-bpf-co-re
+-FEATURE_DISPLAY += llvm
+ FEATURE_DISPLAY += libcap
+ FEATURE_DISPLAY += libbfd
+ FEATURE_DISPLAY += libbfd-liberty
+-- 
+2.39.3
+
diff --git a/ci/diffs/0001-selftests-bpf-work-around-latest-Clang-smartness.patch b/ci/diffs/0001-selftests-bpf-work-around-latest-Clang-smartness.patch
new file mode 100644
index 0000000000000..ec1e29a8ab974
--- /dev/null
+++ b/ci/diffs/0001-selftests-bpf-work-around-latest-Clang-smartness.patch
@@ -0,0 +1,31 @@
+From d31a7125891994681503770cff46a119692fb2b9 Mon Sep 17 00:00:00 2001
+From: Andrii Nakryiko <andrii@kernel.org>
+Date: Mon, 11 Dec 2023 17:09:38 -0800
+Subject: [PATCH 1/1] selftests/bpf: work around latest Clang smartness
+
+Work around the issue while we deal with it in the Clang itself.
+See [0].
+
+  [0] https://github.com/llvm/llvm-project/pull/73662#issuecomment-1849281758
+
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+---
+ tools/testing/selftests/bpf/progs/iters.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/progs/iters.c b/tools/testing/selftests/bpf/progs/iters.c
+index 3aca3dc145b5..929ba6fa2105 100644
+--- a/tools/testing/selftests/bpf/progs/iters.c
++++ b/tools/testing/selftests/bpf/progs/iters.c
+@@ -1420,7 +1420,7 @@ SEC("raw_tp")
+ __success
+ int iter_arr_with_actual_elem_count(const void *ctx)
+ {
+-	int i, n = loop_data.n, sum = 0;
++	unsigned i, n = loop_data.n, sum = 0;
+ 
+ 	if (n > ARRAY_SIZE(loop_data.data))
+ 		return 0;
+-- 
+2.34.1
+
diff --git a/ci/diffs/20251014-selftests-arg_parsing-Ensure-data-is-flushed-to-.patch b/ci/diffs/20251014-selftests-arg_parsing-Ensure-data-is-flushed-to-.patch
new file mode 100644
index 0000000000000..efcdbeed208fc
--- /dev/null
+++ b/ci/diffs/20251014-selftests-arg_parsing-Ensure-data-is-flushed-to-.patch
@@ -0,0 +1,33 @@
+From 423112d2e9b591999efa4ad74000f8f6f3f381ea Mon Sep 17 00:00:00 2001
+From: Xing Guo <higuoxing@gmail.com>
+Date: Tue, 14 Oct 2025 16:03:23 +0800
+Subject: [PATCH 20251015/20251015] selftests: arg_parsing: Ensure data is
+ flushed to disk before reading.
+
+Recently, I noticed a selftest failure in my local environment. The
+test_parse_test_list_file writes some data to
+/tmp/bpf_arg_parsing_test.XXXXXX and parse_test_list_file() will read
+the data back.  However, after writing data to that file, we forget to
+call fsync() and it's causing testing failure in my laptop.  This patch
+helps fix it by adding the missing fsync() call.
+
+Signed-off-by: Xing Guo <higuoxing@gmail.com>
+---
+ tools/testing/selftests/bpf/prog_tests/arg_parsing.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/arg_parsing.c b/tools/testing/selftests/bpf/prog_tests/arg_parsing.c
+index fbf0d9c2f58b..d9fcbfb72aaa 100644
+--- a/tools/testing/selftests/bpf/prog_tests/arg_parsing.c
++++ b/tools/testing/selftests/bpf/prog_tests/arg_parsing.c
+@@ -140,6 +140,7 @@ static void test_parse_test_list_file(void)
+ 	fprintf(fp, "testA/subtest2\n");
+ 	fprintf(fp, "testC_no_eof_newline");
+ 	fflush(fp);
++	fsync(fd);
+ 
+ 	if (!ASSERT_OK(ferror(fp), "prepare tmp"))
+ 		goto out_fclose;
+-- 
+2.51.0
+
diff --git a/ci/diffs/20251014-selftests-bpf-make-arg_parsing.c-more-robust-to-.patch b/ci/diffs/20251014-selftests-bpf-make-arg_parsing.c-more-robust-to-.patch
new file mode 100644
index 0000000000000..34104b3fc9ad8
--- /dev/null
+++ b/ci/diffs/20251014-selftests-bpf-make-arg_parsing.c-more-robust-to-.patch
@@ -0,0 +1,56 @@
+From 8a03969566c5447aa72469e8f09b8158e3dad8f9 Mon Sep 17 00:00:00 2001
+From: Andrii Nakryiko <andrii@kernel.org>
+Date: Tue, 14 Oct 2025 13:20:37 -0700
+Subject: [PATCH 20251014/20251015] selftests/bpf: make arg_parsing.c more
+ robust to crashes
+
+We started getting a crash in BPF CI, which seems to originate from
+test_parse_test_list_file() test and is happening at this line:
+
+  ASSERT_OK(strcmp("test_with_spaces", set.tests[0].name), "test 0 name");
+
+One way we can crash there is if set.cnt zero, which is checked for with
+ASSERT_EQ() above, but we proceed after this regardless of the outcome.
+Instead of crashing, we should bail out with test failure early.
+
+Similarly, if parse_test_list_file() fails, we shouldn't be even looking
+at set, so bail even earlier if ASSERT_OK() fails.
+
+Fixes: 64276f01dce8 ("selftests/bpf: Test_progs can read test lists from file")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+---
+ tools/testing/selftests/bpf/prog_tests/arg_parsing.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/arg_parsing.c b/tools/testing/selftests/bpf/prog_tests/arg_parsing.c
+index bb143de68875..fbf0d9c2f58b 100644
+--- a/tools/testing/selftests/bpf/prog_tests/arg_parsing.c
++++ b/tools/testing/selftests/bpf/prog_tests/arg_parsing.c
+@@ -146,9 +146,12 @@ static void test_parse_test_list_file(void)
+ 
+ 	init_test_filter_set(&set);
+ 
+-	ASSERT_OK(parse_test_list_file(tmpfile, &set, true), "parse file");
++	if (!ASSERT_OK(parse_test_list_file(tmpfile, &set, true), "parse file"))
++		goto out_fclose;
++
++	if (!ASSERT_EQ(set.cnt, 4, "test  count"))
++		goto out_free_set;
+ 
+-	ASSERT_EQ(set.cnt, 4, "test  count");
+ 	ASSERT_OK(strcmp("test_with_spaces", set.tests[0].name), "test 0 name");
+ 	ASSERT_EQ(set.tests[0].subtest_cnt, 0, "test 0 subtest count");
+ 	ASSERT_OK(strcmp("testA", set.tests[1].name), "test 1 name");
+@@ -158,8 +161,8 @@ static void test_parse_test_list_file(void)
+ 	ASSERT_OK(strcmp("testB", set.tests[2].name), "test 2 name");
+ 	ASSERT_OK(strcmp("testC_no_eof_newline", set.tests[3].name), "test 3 name");
+ 
++out_free_set:
+ 	free_test_filter_set(&set);
+-
+ out_fclose:
+ 	fclose(fp);
+ out_remove:
+-- 
+2.51.0
+
diff --git a/ci/vmtest/configs/DENYLIST b/ci/vmtest/configs/DENYLIST
new file mode 100644
index 0000000000000..20a090295a607
--- /dev/null
+++ b/ci/vmtest/configs/DENYLIST
@@ -0,0 +1,17 @@
+# TEMPORARY
+btf_dump/btf_dump: syntax
+kprobe_multi_bench_attach
+core_reloc/enum64val
+core_reloc/size___diff_sz
+core_reloc/type_based___diff_sz
+test_ima	# All of CI is broken on it following 6.3-rc1 merge
+lwt_reroute      # crashes kernel after netnext merge from 2ab1efad60ad "net/sched: cls_api: complement tcf_tfilter_dump_policy"
+tc_links_ingress # started failing after net-next merge from 2ab1efad60ad "net/sched: cls_api: complement tcf_tfilter_dump_policy"
+xdp_bonding/xdp_bonding_features     # started failing after net merge from 359e54a93ab4 "l2tp: pass correct message length to ip6_append_data"
+tc_redirect/tc_redirect_dtime # uapi breakage after net-next commit 885c36e59f46 ("net: Re-use and set mono_delivery_time bit for userspace tstamp packets")
+migrate_reuseport/IPv4 TCP_NEW_SYN_RECV reqsk_timer_handler # flaky, under investigation
+migrate_reuseport/IPv6 TCP_NEW_SYN_RECV reqsk_timer_handler # flaky, under investigation
+connect_force_port # unreliably fails
+sockmap_ktls/sockmap_ktls disconnect_after_delete* # https://lore.kernel.org/bpf/20250415163332.1836826-1-ihor.solodrai@linux.dev/
+verif_scale_pyperf600 # llvm 20 generates code that fails verification
+arena_spin_lock # llvm 20 generates code that fails verification
diff --git a/ci/vmtest/configs/DENYLIST.aarch64 b/ci/vmtest/configs/DENYLIST.aarch64
new file mode 100644
index 0000000000000..bdce99f3855ec
--- /dev/null
+++ b/ci/vmtest/configs/DENYLIST.aarch64
@@ -0,0 +1,5 @@
+cgrp_local_storage                  # libbpf: prog 'update_cookie_tracing': failed to attach: ERROR: strerror_r(-524)=22
+core_reloc_btfgen                   # run_core_reloc_tests:FAIL:run_btfgen unexpected error: 32512 (errno 22)
+usdt/multispec                      # usdt_300_bad_attach unexpected pointer: 0x558c63d8f0
+xdp_bonding                         # whole test suite is very unstable on aarch64
+res_spin_lock_success               # flaky
diff --git a/ci/vmtest/configs/DENYLIST.rc b/ci/vmtest/configs/DENYLIST.rc
new file mode 100644
index 0000000000000..8aa33e6b71443
--- /dev/null
+++ b/ci/vmtest/configs/DENYLIST.rc
@@ -0,0 +1,3 @@
+send_signal/send_signal_nmi            # PMU events configure correctly but don't trigger NMI's for some reason (AMD nested virt)
+send_signal/send_signal_nmi_thread     # Same as above
+token/obj_priv_implicit_token_envvar   # Unknown root cause, but reliably fails
diff --git a/ci/vmtest/configs/DENYLIST.s390x b/ci/vmtest/configs/DENYLIST.s390x
new file mode 100644
index 0000000000000..9b90b615aea55
--- /dev/null
+++ b/ci/vmtest/configs/DENYLIST.s390x
@@ -0,0 +1,11 @@
+deny_namespace                           # not yet in bpf denylist
+tc_redirect/tc_redirect_dtime            # very flaky
+lru_bug                                  # not yet in bpf-next denylist
+# Disabled temporarily for a crash.
+# https://lore.kernel.org/bpf/c9923c1d-971d-4022-8dc8-1364e929d34c@gmail.com/
+dummy_st_ops/dummy_init_ptr_arg
+fexit_bpf2bpf
+tailcalls
+trace_ext
+xdp_bpf2bpf
+xdp_metadata
diff --git a/ci/vmtest/configs/DENYLIST.test_progs-bpf_gcc b/ci/vmtest/configs/DENYLIST.test_progs-bpf_gcc
new file mode 100644
index 0000000000000..a3c745d1f5b52
--- /dev/null
+++ b/ci/vmtest/configs/DENYLIST.test_progs-bpf_gcc
@@ -0,0 +1,904 @@
+arena_htab
+async_stack_depth
+bad_struct_ops/invalid_prog_reuse
+bpf_cookie
+bpf_iter/bpf_hash_map
+bpf_iter/ksym
+bpf_iter/tcp4
+bpf_iter/tcp6
+bpf_iter/udp4
+bpf_iter/udp6
+bpf_iter/unix
+bpf_iter_setsockopt
+bpf_iter_setsockopt_unix
+bpf_mod_race
+bpf_nf/tc-bpf-ct
+bpf_nf/xdp-ct
+bpf_tcp_ca/cubic
+btf_dump/btf_dump: bitfields
+btf_dump/btf_dump: packing
+btf_dump/btf_dump: padding
+btf_dump/btf_dump: syntax
+btf_map_in_map
+cb_refs
+cgroup_get_current_cgroup_id
+cgroup_iter/cgroup_iter__self_only_css_task
+cgroup_tcp_skb
+cgrp_kfunc
+cls_redirect/cls_redirect_dynptr
+connect_force_port
+core_autosize
+core_read_macros
+core_reloc/type_id
+core_reloc/type_id___missing_targets
+core_reloc_btfgen/type_id
+core_reloc_btfgen/type_id___missing_targets
+cpumask/test_acquire_wrong_cpumask
+cpumask/test_alloc_double_release
+cpumask/test_alloc_free_cpumask
+cpumask/test_alloc_no_release
+cpumask/test_and_or_xor
+cpumask/test_copy_any_anyand
+cpumask/test_cpumask_null
+cpumask/test_cpumask_weight
+cpumask/test_first_firstzero_cpu
+cpumask/test_firstand_nocpu
+cpumask/test_global_mask_array_l2_rcu
+cpumask/test_global_mask_array_one_rcu
+cpumask/test_global_mask_array_rcu
+cpumask/test_global_mask_nested_deep_array_rcu
+cpumask/test_global_mask_nested_deep_rcu
+cpumask/test_global_mask_nested_rcu
+cpumask/test_global_mask_no_null_check
+cpumask/test_global_mask_out_of_rcu
+cpumask/test_global_mask_rcu
+cpumask/test_global_mask_rcu_no_null_check
+cpumask/test_insert_leave
+cpumask/test_insert_remove_no_release
+cpumask/test_insert_remove_release
+cpumask/test_intersects_subset
+cpumask/test_invalid_nested_array
+cpumask/test_mutate_cpumask
+cpumask/test_set_clear_cpu
+cpumask/test_setall_clear_cpu
+cpumask/test_test_and_set_clear
+crypto_basic/crypto_acquire
+crypto_sanity
+deny_namespace
+dummy_st_ops/test_unsupported_field_sleepable
+dynptr/add_dynptr_to_map1
+dynptr/add_dynptr_to_map2
+dynptr/clone_invalid1
+dynptr/clone_invalid2
+dynptr/clone_invalidate1
+dynptr/clone_invalidate2
+dynptr/clone_invalidate3
+dynptr/clone_invalidate4
+dynptr/clone_invalidate5
+dynptr/clone_invalidate6
+dynptr/clone_skb_packet_data
+dynptr/clone_xdp_packet_data
+dynptr/data_slice_missing_null_check1
+dynptr/data_slice_missing_null_check2
+dynptr/data_slice_out_of_bounds_map_value
+dynptr/data_slice_out_of_bounds_ringbuf
+dynptr/data_slice_out_of_bounds_skb
+dynptr/data_slice_use_after_release1
+dynptr/data_slice_use_after_release2
+dynptr/dynptr_adjust_invalid
+dynptr/dynptr_from_mem_invalid_api
+dynptr/dynptr_invalidate_slice_failure
+dynptr/dynptr_invalidate_slice_or_null
+dynptr/dynptr_invalidate_slice_reinit
+dynptr/dynptr_is_null_invalid
+dynptr/dynptr_is_rdonly_invalid
+dynptr/dynptr_overwrite_ref
+dynptr/dynptr_partial_slot_invalidate
+dynptr/dynptr_pruning_overwrite
+dynptr/dynptr_pruning_type_confusion
+dynptr/dynptr_read_into_slot
+dynptr/dynptr_size_invalid
+dynptr/dynptr_slice_var_len1
+dynptr/dynptr_slice_var_len2
+dynptr/dynptr_var_off_overwrite
+dynptr/global
+dynptr/invalid_data_slices
+dynptr/invalid_helper1
+dynptr/invalid_helper2
+dynptr/invalid_offset
+dynptr/invalid_read1
+dynptr/invalid_read2
+dynptr/invalid_read3
+dynptr/invalid_read4
+dynptr/invalid_slice_rdwr_rdonly
+dynptr/invalid_write1
+dynptr/invalid_write2
+dynptr/invalid_write3
+dynptr/invalid_write4
+dynptr/release_twice
+dynptr/release_twice_callback
+dynptr/ringbuf_invalid_api
+dynptr/ringbuf_missing_release1
+dynptr/ringbuf_missing_release2
+dynptr/ringbuf_missing_release_callback
+dynptr/ringbuf_release_uninit_dynptr
+dynptr/skb_invalid_ctx
+dynptr/skb_invalid_ctx_fentry
+dynptr/skb_invalid_ctx_fexit
+dynptr/skb_invalid_data_slice1
+dynptr/skb_invalid_data_slice2
+dynptr/skb_invalid_data_slice3
+dynptr/skb_invalid_data_slice4
+dynptr/skb_invalid_slice_write
+dynptr/test_dynptr_reg_type
+dynptr/test_dynptr_skb_no_buff
+dynptr/test_dynptr_skb_small_buff
+dynptr/test_dynptr_skb_tp_btf
+dynptr/test_read_write
+dynptr/uninit_write_into_slot
+dynptr/use_after_invalid
+dynptr/xdp_invalid_ctx
+dynptr/xdp_invalid_data_slice1
+dynptr/xdp_invalid_data_slice2
+exceptions/check_assert_eq_int_max
+exceptions/check_assert_eq_int_min
+exceptions/check_assert_eq_llong_max
+exceptions/check_assert_eq_llong_min
+exceptions/check_assert_eq_zero
+exceptions/check_assert_ge_neg
+exceptions/check_assert_ge_pos
+exceptions/check_assert_ge_zero
+exceptions/check_assert_generic
+exceptions/check_assert_gt_neg
+exceptions/check_assert_gt_pos
+exceptions/check_assert_gt_zero
+exceptions/check_assert_le_neg
+exceptions/check_assert_le_pos
+exceptions/check_assert_le_zero
+exceptions/check_assert_lt_neg
+exceptions/check_assert_lt_pos
+exceptions/check_assert_lt_zero
+exceptions/check_assert_range_s64
+exceptions/check_assert_range_u64
+exceptions/check_assert_single_range_s64
+exceptions/check_assert_single_range_u64
+exceptions/check_assert_with_return
+exceptions/exception_ext
+exceptions/exception_ext_mod_cb_runtime
+exceptions/non-throwing extension -> non-throwing subprog
+exceptions/non-throwing extension -> throwing global subprog
+exceptions/non-throwing fentry -> exception_cb
+exceptions/non-throwing fexit -> exception_cb
+exceptions/non-throwing fmod_ret -> non-throwing global subprog
+exceptions/reject_async_callback_throw
+exceptions/reject_exception_throw_cb
+exceptions/reject_exception_throw_cb_diff
+exceptions/reject_set_exception_cb_bad_ret2
+exceptions/reject_subprog_with_lock
+exceptions/reject_subprog_with_rcu_read_lock
+exceptions/reject_with_cb
+exceptions/reject_with_cb_reference
+exceptions/reject_with_lock
+exceptions/reject_with_rbtree_add_throw
+exceptions/reject_with_rcu_read_lock
+exceptions/reject_with_reference
+exceptions/reject_with_subprog_reference
+exceptions/throwing extension (with custom cb) -> exception_cb
+exceptions/throwing extension -> global func in exception_cb
+exceptions/throwing extension -> non-throwing global subprog
+exceptions/throwing extension -> throwing global subprog
+exceptions/throwing fentry -> exception_cb
+exceptions/throwing fexit -> exception_cb
+failures_wq
+fexit_bpf2bpf/fmod_ret_freplace
+fexit_bpf2bpf/func_replace
+fexit_bpf2bpf/func_replace_global_func
+fexit_bpf2bpf/func_replace_multi
+fexit_bpf2bpf/func_sockmap_update
+fexit_bpf2bpf/target_yes_callees
+global_func_dead_code
+global_map_resize
+inner_array_lookup
+irq/irq_flag_overwrite
+irq/irq_flag_overwrite_partial
+irq/irq_global_subprog
+irq/irq_ooo_refs_array
+irq/irq_restore_4_subprog
+irq/irq_restore_bad_arg
+irq/irq_restore_invalid
+irq/irq_restore_iter
+irq/irq_restore_missing_1_subprog
+irq/irq_restore_missing_2
+irq/irq_restore_missing_2_subprog
+irq/irq_restore_missing_3
+irq/irq_restore_missing_3_minus_2
+irq/irq_restore_missing_3_minus_2_subprog
+irq/irq_restore_missing_3_subprog
+irq/irq_restore_ooo
+irq/irq_restore_ooo_3
+irq/irq_restore_ooo_3_subprog
+irq/irq_save_bad_arg
+irq/irq_save_invalid
+irq/irq_save_iter
+irq/irq_sleepable_helper
+irq/irq_sleepable_kfunc
+iters/compromise_iter_w_direct_write_and_skip_destroy_fail
+iters/compromise_iter_w_direct_write_fail
+iters/compromise_iter_w_helper_write_fail
+iters/create_and_forget_to_destroy_fail
+iters/css_task
+iters/delayed_precision_mark
+iters/delayed_read_mark
+iters/destroy_without_creating_fail
+iters/double_create_fail
+iters/double_destroy_fail
+iters/iter_css_lock_and_unlock
+iters/iter_css_task_for_each
+iters/iter_css_without_lock
+iters/iter_destroy_bad_arg
+iters/iter_err_too_permissive1
+iters/iter_err_too_permissive2
+iters/iter_err_too_permissive3
+iters/iter_err_unsafe_asm_loop
+iters/iter_err_unsafe_c_loop
+iters/iter_nested_iters
+iters/iter_new_bad_arg
+iters/iter_next_bad_arg
+iters/iter_next_ptr_mem_not_trusted
+iters/iter_next_rcu_not_trusted
+iters/iter_next_rcu_or_null
+iters/iter_next_trusted_or_null
+iters/iter_obfuscate_counter
+iters/iter_subprog_iters
+iters/iter_tasks_lock_and_unlock
+iters/iter_tasks_without_lock
+iters/leak_iter_from_subprog_fail
+iters/loop_state_deps1
+iters/loop_state_deps2
+iters/missing_null_check_fail
+iters/next_after_destroy_fail
+iters/next_without_new_fail
+iters/read_from_iter_slot_fail
+iters/stacksafe_should_not_conflate_stack_spill_and_iter
+iters/testmod_seq_getter_after_bad
+iters/testmod_seq_getter_before_bad
+iters/wrong_sized_read_fail
+jeq_infer_not_null
+jit_probe_mem
+kfree_skb
+kfunc_call/kfunc_call_ctx
+kfunc_call/kfunc_call_test1
+kfunc_call/kfunc_call_test2
+kfunc_call/kfunc_call_test4
+kfunc_call/kfunc_call_test_get_mem
+kfunc_call/kfunc_call_test_ref_btf_id
+kfunc_call/kfunc_call_test_static_unused_arg
+kfunc_call/kfunc_syscall_test
+kfunc_call/kfunc_syscall_test_null
+kfunc_dynptr_param/not_ptr_to_stack
+kfunc_dynptr_param/not_valid_dynptr
+kfunc_param_nullable/kfunc_dynptr_nullable_test3
+kprobe_multi_test/kprobe_session_return_2
+kptr_xchg_inline
+l4lb_all/l4lb_noinline
+l4lb_all/l4lb_noinline_dynptr
+linked_list
+local_kptr_stash/drop_rb_node_off
+local_kptr_stash/local_kptr_stash_local_with_root
+local_kptr_stash/local_kptr_stash_plain
+local_kptr_stash/local_kptr_stash_simple
+local_kptr_stash/local_kptr_stash_unstash
+local_kptr_stash/refcount_acquire_without_unstash
+local_kptr_stash/stash_rb_nodes
+log_buf/obj_load_log_buf
+log_fixup/bad_core_relo_subprog
+log_fixup/bad_core_relo_trunc_full
+lru_bug
+map_btf
+map_in_map/acc_map_in_array
+map_in_map/acc_map_in_htab
+map_in_map/sleepable_acc_map_in_array
+map_in_map/sleepable_acc_map_in_htab
+map_kptr/correct_btf_id_check_size
+map_kptr/inherit_untrusted_on_walk
+map_kptr/kptr_xchg_possibly_null
+map_kptr/kptr_xchg_ref_state
+map_kptr/mark_ref_as_untrusted_or_null
+map_kptr/marked_as_untrusted_or_null
+map_kptr/non_const_var_off
+map_kptr/non_const_var_off_kptr_xchg
+map_kptr/reject_bad_type_xchg
+map_kptr/reject_kptr_xchg_on_unref
+map_kptr/reject_member_of_ref_xchg
+map_kptr/reject_untrusted_xchg
+map_kptr/success-map
+map_ptr
+nested_trust/test_invalid_nested_user_cpus
+nested_trust/test_invalid_skb_field
+percpu_alloc/array
+percpu_alloc/array_sleepable
+percpu_alloc/cgrp_local_storage
+percpu_alloc/test_array_map_1
+percpu_alloc/test_array_map_2
+percpu_alloc/test_array_map_3
+percpu_alloc/test_array_map_4
+percpu_alloc/test_array_map_5
+percpu_alloc/test_array_map_6
+percpu_alloc/test_array_map_7
+percpu_alloc/test_array_map_8
+perf_branches/perf_branches_no_hw
+pkt_access
+preempt_lock/preempt_global_subprog_test
+preempt_lock/preempt_lock_missing_1
+preempt_lock/preempt_lock_missing_1_subprog
+preempt_lock/preempt_lock_missing_2
+preempt_lock/preempt_lock_missing_2_minus_1_subprog
+preempt_lock/preempt_lock_missing_2_subprog
+preempt_lock/preempt_lock_missing_3
+preempt_lock/preempt_lock_missing_3_minus_2
+preempt_lock/preempt_sleepable_helper
+preempt_lock/preempt_sleepable_kfunc
+preempted_bpf_ma_op
+prog_run_opts
+prog_tests_framework
+raw_tp_null
+rbtree_fail
+rbtree_success
+recursion
+refcounted_kptr
+refcounted_kptr_fail
+refcounted_kptr_wrong_owner
+reference_tracking/sk_lookup_success
+ringbuf_multi
+setget_sockopt
+sk_lookup
+skc_to_unix_sock
+sock_addr/recvmsg4: attach prog with wrong attach type
+sock_addr/recvmsg4: recvfrom (dgram)
+sock_addr/recvmsg6: attach prog with wrong attach type
+sock_addr/recvmsg6: recvfrom (dgram)
+sock_addr/sendmsg4: attach prog with wrong attach type
+sock_addr/sendmsg4: kernel_sendmsg (dgram)
+sock_addr/sendmsg4: kernel_sendmsg deny (dgram)
+sock_addr/sendmsg4: sendmsg (dgram)
+sock_addr/sendmsg4: sendmsg deny (dgram)
+sock_addr/sendmsg4: sock_sendmsg (dgram)
+sock_addr/sendmsg4: sock_sendmsg deny (dgram)
+sock_addr/sendmsg6: attach prog with wrong attach type
+sock_addr/sendmsg6: kernel_sendmsg (dgram)
+sock_addr/sendmsg6: kernel_sendmsg [::] (BSD'ism) (dgram)
+sock_addr/sendmsg6: kernel_sendmsg deny (dgram)
+sock_addr/sendmsg6: sendmsg (dgram)
+sock_addr/sendmsg6: sendmsg IPv4-mapped IPv6 (dgram)
+sock_addr/sendmsg6: sendmsg [::] (BSD'ism) (dgram)
+sock_addr/sendmsg6: sendmsg deny (dgram)
+sock_addr/sendmsg6: sendmsg dst IP = [::] (BSD'ism) (dgram)
+sock_addr/sendmsg6: sock_sendmsg (dgram)
+sock_addr/sendmsg6: sock_sendmsg [::] (BSD'ism) (dgram)
+sock_addr/sendmsg6: sock_sendmsg deny (dgram)
+sock_destroy/trace_tcp_destroy_sock
+sock_fields
+sockmap_listen/sockhash IPv4 TCP test_reuseport_mixed_groups
+sockmap_listen/sockhash IPv4 TCP test_reuseport_select_connected
+sockmap_listen/sockhash IPv4 UDP test_reuseport_mixed_groups
+sockmap_listen/sockhash IPv4 UDP test_reuseport_select_connected
+sockmap_listen/sockhash IPv6 TCP test_reuseport_mixed_groups
+sockmap_listen/sockhash IPv6 TCP test_reuseport_select_connected
+sockmap_listen/sockhash IPv6 UDP test_reuseport_mixed_groups
+sockmap_listen/sockhash IPv6 UDP test_reuseport_select_connected
+sockmap_listen/sockmap IPv4 TCP test_reuseport_mixed_groups
+sockmap_listen/sockmap IPv4 TCP test_reuseport_select_connected
+sockmap_listen/sockmap IPv4 UDP test_reuseport_mixed_groups
+sockmap_listen/sockmap IPv4 UDP test_reuseport_select_connected
+sockmap_listen/sockmap IPv6 TCP test_reuseport_mixed_groups
+sockmap_listen/sockmap IPv6 TCP test_reuseport_select_connected
+sockmap_listen/sockmap IPv6 UDP test_reuseport_mixed_groups
+sockmap_listen/sockmap IPv6 UDP test_reuseport_select_connected
+spin_lock
+struct_ops_module/unsupported_ops
+syscall
+tailcalls/classifier_0
+tailcalls/classifier_1
+tailcalls/reject_tail_call_preempt_lock
+tailcalls/reject_tail_call_rcu_lock
+tailcalls/reject_tail_call_ref
+tailcalls/reject_tail_call_spin_lock
+tailcalls/tailcall_6
+tailcalls/tailcall_bpf2bpf_2
+tailcalls/tailcall_bpf2bpf_3
+tailcalls/tailcall_bpf2bpf_fentry
+tailcalls/tailcall_bpf2bpf_fentry_entry
+tailcalls/tailcall_bpf2bpf_fentry_fexit
+tailcalls/tailcall_bpf2bpf_fexit
+tailcalls/tailcall_bpf2bpf_hierarchy_2
+tailcalls/tailcall_bpf2bpf_hierarchy_3
+task_kfunc
+task_local_storage/uptr_across_pages
+task_local_storage/uptr_basic
+task_local_storage/uptr_kptr_xchg
+task_local_storage/uptr_map_failure_e2big
+task_local_storage/uptr_map_failure_kstruct
+task_local_storage/uptr_map_failure_size0
+task_local_storage/uptr_no_null_check
+task_local_storage/uptr_obj_new
+task_local_storage/uptr_update_failure
+tc_bpf/tc_bpf_non_root
+tc_redirect/tc_redirect_dtime
+tcp_custom_syncookie
+tcp_hdr_options
+test_bpf_ma
+test_global_funcs/arg_tag_ctx_kprobe
+test_global_funcs/arg_tag_ctx_perf
+test_global_funcs/arg_tag_ctx_raw_tp
+test_global_funcs/global_func1
+test_global_funcs/global_func10
+test_global_funcs/global_func11
+test_global_funcs/global_func12
+test_global_funcs/global_func13
+test_global_funcs/global_func14
+test_global_funcs/global_func15
+test_global_funcs/global_func15_tricky_pruning
+test_global_funcs/global_func17
+test_global_funcs/global_func3
+test_global_funcs/global_func5
+test_global_funcs/global_func6
+test_global_funcs/global_func7
+test_lsm/lsm_basic
+test_profiler
+test_strncmp/strncmp_bad_not_null_term_target
+timer
+timer_mim
+token
+tp_btf_nullable/handle_tp_btf_nullable_bare1
+tunnel
+uprobe_multi_test/uprobe_sesison_return_2
+user_ringbuf/user_ringbuf_callback_bad_access1
+user_ringbuf/user_ringbuf_callback_bad_access2
+user_ringbuf/user_ringbuf_callback_const_ptr_to_dynptr_reg_off
+user_ringbuf/user_ringbuf_callback_discard_dynptr
+user_ringbuf/user_ringbuf_callback_invalid_return
+user_ringbuf/user_ringbuf_callback_null_context_read
+user_ringbuf/user_ringbuf_callback_null_context_write
+user_ringbuf/user_ringbuf_callback_reinit_dynptr_mem
+user_ringbuf/user_ringbuf_callback_reinit_dynptr_ringbuf
+user_ringbuf/user_ringbuf_callback_submit_dynptr
+user_ringbuf/user_ringbuf_callback_write_forbidden
+verif_scale_pyperf100
+verif_scale_pyperf180
+verif_scale_pyperf600
+verif_scale_pyperf600_nounroll
+verif_scale_seg6_loop
+verif_scale_strobemeta
+verif_scale_strobemeta_nounroll1
+verif_scale_strobemeta_nounroll2
+verif_scale_strobemeta_subprogs
+verif_scale_sysctl_loop1
+verif_scale_sysctl_loop2
+verif_scale_xdp_loop
+verifier_and/invalid_and_of_negative_number
+verifier_and/invalid_range_check
+verifier_arena/iter_maps2
+verifier_arena/iter_maps3
+verifier_array_access/a_read_only_array_1_2
+verifier_array_access/a_read_only_array_2_2
+verifier_array_access/a_write_only_array_1_2
+verifier_array_access/a_write_only_array_2_2
+verifier_array_access/an_array_with_a_constant_2
+verifier_array_access/an_array_with_a_register_2
+verifier_array_access/an_array_with_a_variable_2
+verifier_array_access/array_with_no_floor_check
+verifier_array_access/with_a_invalid_max_check_1
+verifier_array_access/with_a_invalid_max_check_2
+verifier_basic_stack/invalid_fp_arithmetic
+verifier_basic_stack/misaligned_read_from_stack
+verifier_basic_stack/stack_out_of_bounds
+verifier_bitfield_write
+verifier_bits_iter/destroy_uninit
+verifier_bits_iter/next_uninit
+verifier_bits_iter/no_destroy
+verifier_bounds/bounds_map_value_variant_1
+verifier_bounds/bounds_map_value_variant_2
+verifier_bounds/of_boundary_crossing_range_1
+verifier_bounds/of_boundary_crossing_range_2
+verifier_bounds/on_sign_extended_mov_test1
+verifier_bounds/on_sign_extended_mov_test2
+verifier_bounds/reg32_any_reg32_xor_3
+verifier_bounds/reg_any_reg_xor_3
+verifier_bounds/shift_of_maybe_negative_number
+verifier_bounds/shift_with_64_bit_input
+verifier_bounds/shift_with_oversized_count_operand
+verifier_bounds/size_signed_32bit_overflow_test1
+verifier_bounds/size_signed_32bit_overflow_test2
+verifier_bounds/size_signed_32bit_overflow_test3
+verifier_bounds/size_signed_32bit_overflow_test4
+verifier_bounds/var_off_insn_off_test1
+verifier_bounds/var_off_insn_off_test2
+verifier_bounds_deduction/deducing_bounds_from_const_1
+verifier_bounds_deduction/deducing_bounds_from_const_10
+verifier_bounds_deduction/deducing_bounds_from_const_3
+verifier_bounds_deduction/deducing_bounds_from_const_5
+verifier_bounds_deduction/deducing_bounds_from_const_6
+verifier_bounds_deduction/deducing_bounds_from_const_7
+verifier_bounds_deduction/deducing_bounds_from_const_8
+verifier_bounds_deduction/deducing_bounds_from_const_9
+verifier_bounds_mix_sign_unsign/checks_mixing_signed_and_unsigned
+verifier_bounds_mix_sign_unsign/signed_and_unsigned_positive_bounds
+verifier_bounds_mix_sign_unsign/signed_and_unsigned_variant_10
+verifier_bounds_mix_sign_unsign/signed_and_unsigned_variant_11
+verifier_bounds_mix_sign_unsign/signed_and_unsigned_variant_12
+verifier_bounds_mix_sign_unsign/signed_and_unsigned_variant_13
+verifier_bounds_mix_sign_unsign/signed_and_unsigned_variant_14
+verifier_bounds_mix_sign_unsign/signed_and_unsigned_variant_15
+verifier_bounds_mix_sign_unsign/signed_and_unsigned_variant_2
+verifier_bounds_mix_sign_unsign/signed_and_unsigned_variant_3
+verifier_bounds_mix_sign_unsign/signed_and_unsigned_variant_5
+verifier_bounds_mix_sign_unsign/signed_and_unsigned_variant_6
+verifier_bounds_mix_sign_unsign/signed_and_unsigned_variant_8
+verifier_btf_ctx_access/ctx_access_u32_pointer_reject_16
+verifier_btf_ctx_access/ctx_access_u32_pointer_reject_32
+verifier_btf_ctx_access/ctx_access_u32_pointer_reject_8
+verifier_cfg/conditional_loop
+verifier_cfg/loop2_back_edge
+verifier_cfg/loop_back_edge
+verifier_cfg/out_of_range_jump
+verifier_cfg/out_of_range_jump2
+verifier_cfg/uncond_loop_after_cond_jmp
+verifier_cfg/uncond_loop_in_subprog_after_cond_jmp
+verifier_cfg/unreachable
+verifier_cfg/unreachable2
+verifier_cgroup_inv_retcode/with_invalid_return_code_test1
+verifier_cgroup_inv_retcode/with_invalid_return_code_test3
+verifier_cgroup_inv_retcode/with_invalid_return_code_test5
+verifier_cgroup_inv_retcode/with_invalid_return_code_test6
+verifier_cgroup_inv_retcode/with_invalid_return_code_test7
+verifier_cgroup_skb/data_meta_for_cgroup_skb
+verifier_cgroup_skb/flow_keys_for_cgroup_skb
+verifier_cgroup_skb/napi_id_for_cgroup_skb
+verifier_cgroup_skb/tc_classid_for_cgroup_skb
+verifier_cgroup_storage/cpu_cgroup_storage_access_1
+verifier_cgroup_storage/cpu_cgroup_storage_access_2
+verifier_cgroup_storage/cpu_cgroup_storage_access_3
+verifier_cgroup_storage/cpu_cgroup_storage_access_4
+verifier_cgroup_storage/cpu_cgroup_storage_access_5
+verifier_cgroup_storage/cpu_cgroup_storage_access_6
+verifier_cgroup_storage/invalid_cgroup_storage_access_1
+verifier_cgroup_storage/invalid_cgroup_storage_access_2
+verifier_cgroup_storage/invalid_cgroup_storage_access_3
+verifier_cgroup_storage/invalid_cgroup_storage_access_4
+verifier_cgroup_storage/invalid_cgroup_storage_access_5
+verifier_cgroup_storage/invalid_cgroup_storage_access_6
+verifier_const/bprm
+verifier_const/tcx1
+verifier_const/tcx4
+verifier_const/tcx7
+verifier_const_or/not_bypass_stack_boundary_checks_1
+verifier_const_or/not_bypass_stack_boundary_checks_2
+verifier_ctx/context_stores_via_bpf_atomic
+verifier_ctx/ctx_pointer_to_helper_1
+verifier_ctx/ctx_pointer_to_helper_2
+verifier_ctx/ctx_pointer_to_helper_3
+verifier_ctx/make_ptr_to_ctx_unusable
+verifier_ctx/null_check_4_ctx_const
+verifier_ctx/null_check_8_null_bind
+verifier_ctx/or_null_check_3_1
+verifier_ctx_sk_msg/of_size_in_sk_msg
+verifier_ctx_sk_msg/past_end_of_sk_msg
+verifier_ctx_sk_msg/read_offset_in_sk_msg
+verifier_d_path/d_path_reject
+verifier_direct_packet_access/access_test15_spill_with_xadd
+verifier_direct_packet_access/direct_packet_access_test3
+verifier_direct_packet_access/id_in_regsafe_bad_access
+verifier_direct_packet_access/packet_access_test10_write_invalid
+verifier_direct_packet_access/pkt_end_reg_bad_access
+verifier_direct_packet_access/pkt_end_reg_both_accesses
+verifier_direct_packet_access/test16_arith_on_data_end
+verifier_direct_packet_access/test23_x_pkt_ptr_4
+verifier_direct_packet_access/test26_marking_on_bad_access
+verifier_direct_packet_access/test28_marking_on_bad_access
+verifier_direct_stack_access_wraparound
+verifier_global_ptr_args
+verifier_global_subprogs
+verifier_helper_access_var_len/bitwise_and_jmp_wrong_max
+verifier_helper_access_var_len/jmp_signed_no_min_check
+verifier_helper_access_var_len/map_adjusted_jmp_wrong_max
+verifier_helper_access_var_len/memory_map_jmp_wrong_max
+verifier_helper_access_var_len/memory_stack_jmp_bounds_offset
+verifier_helper_access_var_len/memory_stack_jmp_wrong_max
+verifier_helper_access_var_len/ptr_to_mem_or_null_2
+verifier_helper_access_var_len/ptr_to_mem_or_null_8
+verifier_helper_access_var_len/ptr_to_mem_or_null_9
+verifier_helper_access_var_len/stack_jmp_no_max_check
+verifier_helper_packet_access/cls_helper_fail_range_1
+verifier_helper_packet_access/cls_helper_fail_range_2
+verifier_helper_packet_access/cls_helper_fail_range_3
+verifier_helper_packet_access/packet_ptr_with_bad_range_1
+verifier_helper_packet_access/packet_ptr_with_bad_range_2
+verifier_helper_packet_access/packet_test2_unchecked_packet_ptr
+verifier_helper_packet_access/ptr_with_too_short_range_1
+verifier_helper_packet_access/ptr_with_too_short_range_2
+verifier_helper_packet_access/test11_cls_unsuitable_helper_1
+verifier_helper_packet_access/test12_cls_unsuitable_helper_2
+verifier_helper_packet_access/test15_cls_helper_fail_sub
+verifier_helper_packet_access/test20_pkt_end_as_input
+verifier_helper_packet_access/test7_cls_unchecked_packet_ptr
+verifier_helper_packet_access/to_packet_test21_wrong_reg
+verifier_helper_restricted
+verifier_helper_value_access/access_to_map_empty_range
+verifier_helper_value_access/access_to_map_negative_range
+verifier_helper_value_access/access_to_map_possibly_empty_range
+verifier_helper_value_access/access_to_map_wrong_size
+verifier_helper_value_access/bounds_check_using_bad_access_1
+verifier_helper_value_access/bounds_check_using_bad_access_2
+verifier_helper_value_access/check_using_s_bad_access_1
+verifier_helper_value_access/check_using_s_bad_access_2
+verifier_helper_value_access/const_imm_negative_range_adjustment_1
+verifier_helper_value_access/const_imm_negative_range_adjustment_2
+verifier_helper_value_access/const_reg_negative_range_adjustment_1
+verifier_helper_value_access/const_reg_negative_range_adjustment_2
+verifier_helper_value_access/imm_out_of_bound_1
+verifier_helper_value_access/imm_out_of_bound_2
+verifier_helper_value_access/imm_out_of_bound_range
+verifier_helper_value_access/map_out_of_bound_range
+verifier_helper_value_access/map_via_variable_empty_range
+verifier_helper_value_access/reg_out_of_bound_1
+verifier_helper_value_access/reg_out_of_bound_2
+verifier_helper_value_access/reg_out_of_bound_range
+verifier_helper_value_access/via_const_imm_empty_range
+verifier_helper_value_access/via_const_reg_empty_range
+verifier_helper_value_access/via_variable_no_max_check_1
+verifier_helper_value_access/via_variable_no_max_check_2
+verifier_helper_value_access/via_variable_wrong_max_check_1
+verifier_helper_value_access/via_variable_wrong_max_check_2
+verifier_int_ptr/arg_ptr_to_long_misaligned
+verifier_int_ptr/to_long_size_sizeof_long
+verifier_iterating_callbacks/bpf_loop_iter_limit_overflow
+verifier_iterating_callbacks/check_add_const_3regs
+verifier_iterating_callbacks/check_add_const_3regs_2if
+verifier_iterating_callbacks/check_add_const_regsafe_off
+verifier_iterating_callbacks/iter_limit_bug
+verifier_iterating_callbacks/jgt_imm64_and_may_goto
+verifier_iterating_callbacks/loop_detection
+verifier_iterating_callbacks/may_goto_self
+verifier_iterating_callbacks/unsafe_find_vma
+verifier_iterating_callbacks/unsafe_for_each_map_elem
+verifier_iterating_callbacks/unsafe_on_2nd_iter
+verifier_iterating_callbacks/unsafe_on_zero_iter
+verifier_iterating_callbacks/unsafe_ringbuf_drain
+verifier_jeq_infer_not_null/unchanged_for_jeq_false_branch
+verifier_jeq_infer_not_null/unchanged_for_jne_true_branch
+verifier_kfunc_prog_types/cgrp_kfunc_raw_tp
+verifier_kfunc_prog_types/cpumask_kfunc_raw_tp
+verifier_kfunc_prog_types/task_kfunc_raw_tp
+verifier_ld_ind/ind_check_calling_conv_r1
+verifier_ld_ind/ind_check_calling_conv_r2
+verifier_ld_ind/ind_check_calling_conv_r3
+verifier_ld_ind/ind_check_calling_conv_r4
+verifier_ld_ind/ind_check_calling_conv_r5
+verifier_leak_ptr/leak_pointer_into_ctx_1
+verifier_leak_ptr/leak_pointer_into_ctx_2
+verifier_linked_scalars
+verifier_loops1/bounded_recursion
+verifier_loops1/infinite_loop_in_two_jumps
+verifier_loops1/infinite_loop_three_jump_trick
+verifier_loops1/loop_after_a_conditional_jump
+verifier_lsm/bool_retval_test3
+verifier_lsm/bool_retval_test4
+verifier_lsm/disabled_hook_test1
+verifier_lsm/disabled_hook_test2
+verifier_lsm/disabled_hook_test3
+verifier_lsm/errno_zero_retval_test4
+verifier_lsm/errno_zero_retval_test5
+verifier_lsm/errno_zero_retval_test6
+verifier_lwt/not_permitted_for_lwt_prog
+verifier_lwt/packet_write_for_lwt_in
+verifier_lwt/packet_write_for_lwt_out
+verifier_lwt/tc_classid_for_lwt_in
+verifier_lwt/tc_classid_for_lwt_out
+verifier_lwt/tc_classid_for_lwt_xmit
+verifier_map_in_map/invalid_inner_map_pointer
+verifier_map_in_map/on_the_inner_map_pointer
+verifier_map_ptr/bpf_map_ptr_write_rejected
+verifier_map_ptr/read_non_existent_field_rejected
+verifier_map_ptr/read_with_negative_offset_rejected
+verifier_map_ptr_mixing
+verifier_map_ret_val
+verifier_meta_access/meta_access_test10
+verifier_meta_access/meta_access_test2
+verifier_meta_access/meta_access_test3
+verifier_meta_access/meta_access_test4
+verifier_meta_access/meta_access_test5
+verifier_meta_access/meta_access_test6
+verifier_meta_access/meta_access_test9
+verifier_netfilter_ctx/with_invalid_ctx_access_test1
+verifier_netfilter_ctx/with_invalid_ctx_access_test2
+verifier_netfilter_ctx/with_invalid_ctx_access_test3
+verifier_netfilter_ctx/with_invalid_ctx_access_test4
+verifier_netfilter_ctx/with_invalid_ctx_access_test5
+verifier_netfilter_retcode/with_invalid_return_code_test1
+verifier_netfilter_retcode/with_invalid_return_code_test4
+verifier_or_jmp32_k
+verifier_prevent_map_lookup
+verifier_raw_stack/bytes_spilled_regs_corruption_2
+verifier_raw_stack/load_bytes_invalid_access_1
+verifier_raw_stack/load_bytes_invalid_access_2
+verifier_raw_stack/load_bytes_invalid_access_3
+verifier_raw_stack/load_bytes_invalid_access_4
+verifier_raw_stack/load_bytes_invalid_access_5
+verifier_raw_stack/load_bytes_invalid_access_6
+verifier_raw_stack/load_bytes_negative_len_2
+verifier_raw_stack/load_bytes_spilled_regs_corruption
+verifier_raw_stack/skb_load_bytes_negative_len
+verifier_raw_stack/skb_load_bytes_zero_len
+verifier_raw_tp_writable
+verifier_ref_tracking
+verifier_reg_equal/subreg_equality_2
+verifier_regalloc/regalloc_and_spill_negative
+verifier_regalloc/regalloc_negative
+verifier_regalloc/regalloc_src_reg_negative
+verifier_ringbuf/ringbuf_invalid_reservation_offset_1
+verifier_ringbuf/ringbuf_invalid_reservation_offset_2
+verifier_runtime_jit
+verifier_scalar_ids/check_ids_in_regsafe
+verifier_scalar_ids/check_ids_in_regsafe_2
+verifier_scalar_ids/linked_regs_broken_link_2
+verifier_search_pruning/for_u32_spills_u64_fill
+verifier_search_pruning/liveness_pruning_and_write_screening
+verifier_search_pruning/short_loop1
+verifier_search_pruning/should_be_verified_nop_operation
+verifier_search_pruning/tracking_for_u32_spill_fill
+verifier_search_pruning/varlen_map_value_access_pruning
+verifier_sock/bpf_sk_fullsock_skb_sk
+verifier_sock/bpf_sk_release_skb_sk
+verifier_sock/bpf_tcp_sock_skb_sk
+verifier_sock/dst_port_byte_load_invalid
+verifier_sock/dst_port_half_load_invalid_1
+verifier_sock/dst_port_half_load_invalid_2
+verifier_sock/invalidate_pkt_pointers_by_tail_call
+verifier_sock/invalidate_pkt_pointers_from_global_func
+verifier_sock/map_lookup_elem_smap_key
+verifier_sock/map_lookup_elem_sockhash_key
+verifier_sock/map_lookup_elem_sockmap_key
+verifier_sock/no_null_check_on_ret_1
+verifier_sock/no_null_check_on_ret_2
+verifier_sock/of_bpf_skc_to_helpers
+verifier_sock/post_bind4_read_mark
+verifier_sock/post_bind4_read_src_ip6
+verifier_sock/post_bind6_read_src_ip4
+verifier_sock/sk_1_1_value_1
+verifier_sock/sk_no_skb_sk_check_1
+verifier_sock/sk_no_skb_sk_check_2
+verifier_sock/sk_sk_type_fullsock_field_1
+verifier_sock/skb_sk_beyond_last_field_1
+verifier_sock/skb_sk_beyond_last_field_2
+verifier_sock/skb_sk_no_null_check
+verifier_sock/sock_create_read_src_port
+verifier_sock_addr/bind4_bad_return_code
+verifier_sock_addr/bind6_bad_return_code
+verifier_sock_addr/connect4_bad_return_code
+verifier_sock_addr/connect6_bad_return_code
+verifier_sock_addr/connect_unix_bad_return_code
+verifier_sock_addr/getpeername4_bad_return_code
+verifier_sock_addr/getpeername6_bad_return_code
+verifier_sock_addr/getpeername_unix_bad_return_code
+verifier_sock_addr/getsockname4_bad_return_code
+verifier_sock_addr/getsockname6_bad_return_code
+verifier_sock_addr/getsockname_unix_unix_bad_return_code
+verifier_sock_addr/recvmsg4_bad_return_code
+verifier_sock_addr/recvmsg6_bad_return_code
+verifier_sock_addr/recvmsg_unix_bad_return_code
+verifier_sock_addr/sendmsg4_bad_return_code
+verifier_sock_addr/sendmsg6_bad_return_code
+verifier_sock_addr/sendmsg_unix_bad_return_code
+verifier_sockmap_mutate/test_flow_dissector_update
+verifier_sockmap_mutate/test_raw_tp_delete
+verifier_sockmap_mutate/test_raw_tp_update
+verifier_sockmap_mutate/test_sockops_update
+verifier_spill_fill/_6_offset_to_skb_data
+verifier_spill_fill/addr_offset_to_skb_data
+verifier_spill_fill/check_corrupted_spill_fill
+verifier_spill_fill/fill_32bit_after_spill_64bit_clear_id
+verifier_spill_fill/spill_16bit_of_32bit_fail
+verifier_spill_fill/spill_32bit_of_64bit_fail
+verifier_spill_fill/u64_offset_to_skb_data
+verifier_spill_fill/with_invalid_reg_offset_0
+verifier_spin_lock/call_within_a_locked_region
+verifier_spin_lock/lock_test2_direct_ld_st
+verifier_spin_lock/lock_test3_direct_ld_st
+verifier_spin_lock/lock_test4_direct_ld_st
+verifier_spin_lock/lock_test7_unlock_without_lock
+verifier_spin_lock/reg_id_for_map_value
+verifier_spin_lock/spin_lock_test6_missing_unlock
+verifier_spin_lock/spin_lock_test8_double_lock
+verifier_spin_lock/spin_lock_test9_different_lock
+verifier_spin_lock/test11_ld_abs_under_lock
+verifier_stack_ptr/load_bad_alignment_on_off
+verifier_stack_ptr/load_bad_alignment_on_reg
+verifier_stack_ptr/load_out_of_bounds_high
+verifier_stack_ptr/load_out_of_bounds_low
+verifier_stack_ptr/to_stack_check_high_4
+verifier_stack_ptr/to_stack_check_high_5
+verifier_stack_ptr/to_stack_check_high_6
+verifier_stack_ptr/to_stack_check_high_7
+verifier_stack_ptr/to_stack_check_low_3
+verifier_stack_ptr/to_stack_check_low_4
+verifier_stack_ptr/to_stack_check_low_5
+verifier_stack_ptr/to_stack_check_low_6
+verifier_stack_ptr/to_stack_check_low_7
+verifier_subprog_precision/callback_precise_return_fail
+verifier_tailcall_jit
+verifier_uninit
+verifier_unpriv
+verifier_unpriv_perf
+verifier_value/store_of_cleared_call_register
+verifier_value_illegal_alu
+verifier_value_or_null/map_access_from_else_condition
+verifier_value_or_null/map_value_or_null_1
+verifier_value_or_null/map_value_or_null_2
+verifier_value_or_null/map_value_or_null_3
+verifier_value_or_null/multiple_map_lookup_elem_calls
+verifier_value_or_null/null_check_ids_in_regsafe
+verifier_value_ptr_arith/access_known_scalar_value_ptr_2
+verifier_value_ptr_arith/access_unknown_scalar_value_ptr
+verifier_value_ptr_arith/access_value_ptr_known_scalar
+verifier_value_ptr_arith/access_value_ptr_unknown_scalar
+verifier_value_ptr_arith/access_value_ptr_value_ptr_1
+verifier_value_ptr_arith/access_value_ptr_value_ptr_2
+verifier_value_ptr_arith/lower_oob_arith_test_1
+verifier_value_ptr_arith/to_leak_tainted_dst_reg
+verifier_value_ptr_arith/unknown_scalar_value_ptr_4
+verifier_value_ptr_arith/value_ptr_known_scalar_2_1
+verifier_value_ptr_arith/value_ptr_known_scalar_3
+verifier_var_off/access_max_out_of_bound
+verifier_var_off/access_min_out_of_bound
+verifier_var_off/stack_write_clobbers_spilled_regs
+verifier_var_off/variable_offset_ctx_access
+verifier_var_off/variable_offset_stack_access_unbounded
+verifier_var_off/zero_sized_access_max_out_of_bound
+verifier_vfs_reject
+verifier_xadd/xadd_w_check_unaligned_map
+verifier_xadd/xadd_w_check_unaligned_pkt
+verifier_xadd/xadd_w_check_unaligned_stack
+verifier_xdp_direct_packet_access/corner_case_1_bad_access_1
+verifier_xdp_direct_packet_access/corner_case_1_bad_access_10
+verifier_xdp_direct_packet_access/corner_case_1_bad_access_11
+verifier_xdp_direct_packet_access/corner_case_1_bad_access_12
+verifier_xdp_direct_packet_access/corner_case_1_bad_access_13
+verifier_xdp_direct_packet_access/corner_case_1_bad_access_14
+verifier_xdp_direct_packet_access/corner_case_1_bad_access_15
+verifier_xdp_direct_packet_access/corner_case_1_bad_access_16
+verifier_xdp_direct_packet_access/corner_case_1_bad_access_2
+verifier_xdp_direct_packet_access/corner_case_1_bad_access_3
+verifier_xdp_direct_packet_access/corner_case_1_bad_access_4
+verifier_xdp_direct_packet_access/corner_case_1_bad_access_5
+verifier_xdp_direct_packet_access/corner_case_1_bad_access_6
+verifier_xdp_direct_packet_access/corner_case_1_bad_access_7
+verifier_xdp_direct_packet_access/corner_case_1_bad_access_8
+verifier_xdp_direct_packet_access/corner_case_1_bad_access_9
+verifier_xdp_direct_packet_access/end_mangling_bad_access_1
+verifier_xdp_direct_packet_access/end_mangling_bad_access_2
+verifier_xdp_direct_packet_access/pkt_data_bad_access_1_1
+verifier_xdp_direct_packet_access/pkt_data_bad_access_1_2
+verifier_xdp_direct_packet_access/pkt_data_bad_access_1_3
+verifier_xdp_direct_packet_access/pkt_data_bad_access_1_4
+verifier_xdp_direct_packet_access/pkt_data_bad_access_2_1
+verifier_xdp_direct_packet_access/pkt_data_bad_access_2_2
+verifier_xdp_direct_packet_access/pkt_data_bad_access_2_3
+verifier_xdp_direct_packet_access/pkt_data_bad_access_2_4
+verifier_xdp_direct_packet_access/pkt_data_bad_access_2_5
+verifier_xdp_direct_packet_access/pkt_data_bad_access_2_6
+verifier_xdp_direct_packet_access/pkt_data_bad_access_2_7
+verifier_xdp_direct_packet_access/pkt_data_bad_access_2_8
+verifier_xdp_direct_packet_access/pkt_end_bad_access_1_1
+verifier_xdp_direct_packet_access/pkt_end_bad_access_1_2
+verifier_xdp_direct_packet_access/pkt_end_bad_access_2_1
+verifier_xdp_direct_packet_access/pkt_end_bad_access_2_2
+verifier_xdp_direct_packet_access/pkt_end_bad_access_2_3
+verifier_xdp_direct_packet_access/pkt_end_bad_access_2_4
+verifier_xdp_direct_packet_access/pkt_meta_bad_access_1_1
+verifier_xdp_direct_packet_access/pkt_meta_bad_access_1_2
+verifier_xdp_direct_packet_access/pkt_meta_bad_access_2_1
+verifier_xdp_direct_packet_access/pkt_meta_bad_access_2_2
+verifier_xdp_direct_packet_access/pkt_meta_bad_access_2_3
+verifier_xdp_direct_packet_access/pkt_meta_bad_access_2_4
+verify_pkcs7_sig
+xdp_synproxy
diff --git a/ci/vmtest/configs/DENYLIST.test_progs_cpuv4 b/ci/vmtest/configs/DENYLIST.test_progs_cpuv4
new file mode 100644
index 0000000000000..0c02eae8f5cd1
--- /dev/null
+++ b/ci/vmtest/configs/DENYLIST.test_progs_cpuv4
@@ -0,0 +1 @@
+verifier_arena/basic_alloc2
diff --git a/ci/vmtest/configs/DENYLIST.x86_64 b/ci/vmtest/configs/DENYLIST.x86_64
new file mode 100644
index 0000000000000..6fc3413daab9f
--- /dev/null
+++ b/ci/vmtest/configs/DENYLIST.x86_64
@@ -0,0 +1 @@
+netcnt              # with kvm enabled, fail with packets unexpected packets: actual 10001 != expected 10000
diff --git a/ci/vmtest/configs/config b/ci/vmtest/configs/config
new file mode 100644
index 0000000000000..7a2427b22553c
--- /dev/null
+++ b/ci/vmtest/configs/config
@@ -0,0 +1,7 @@
+CONFIG_KASAN=y
+CONFIG_KASAN_GENERIC=y
+CONFIG_KASAN_VMALLOC=y
+CONFIG_LIVEPATCH=y
+CONFIG_SAMPLES=y
+CONFIG_SAMPLE_LIVEPATCH=m
+# CONFIG_UBSAN=y
diff --git a/ci/vmtest/configs/run-vmtest.env b/ci/vmtest/configs/run-vmtest.env
new file mode 100644
index 0000000000000..c60f1db6673c7
--- /dev/null
+++ b/ci/vmtest/configs/run-vmtest.env
@@ -0,0 +1,42 @@
+#!/bin/bash
+
+# This file is sourced by libbpf/ci/run-vmtest Github Action scripts.
+#
+# The primary reason it exists is that assembling ALLOWLIST and
+# DENYLIST for a particular test run is not a trivial operation.
+#
+# Users of libbpf/ci/run-vmtest action need to be able to specify a
+# list of allow/denylist **files**, that later has to be correctly
+# merged into a single allow/denylist passed to a test runner.
+#
+# Obviously it's perferrable for the scripts merging many lists into
+# one to be reusable, and not copy-pasted between repositories which
+# use libbpf/ci actions. And specifying the lists should be trivial.
+# This file is a solution to that.
+
+# $SELFTESTS_BPF and $VMTEST_CONFIGS are set in the workflow, before
+# libbpf/ci/run-vmtest action is called
+# See .github/workflows/kernel-test.yml
+
+ALLOWLIST_FILES=(
+    "${SELFTESTS_BPF}/ALLOWLIST"
+    "${SELFTESTS_BPF}/ALLOWLIST.${ARCH}"
+    "${VMTEST_CONFIGS}/ALLOWLIST"
+    "${VMTEST_CONFIGS}/ALLOWLIST.${ARCH}"
+    "${VMTEST_CONFIGS}/ALLOWLIST.${DEPLOYMENT}"
+    "${VMTEST_CONFIGS}/ALLOWLIST.${KERNEL_TEST}"
+)
+
+DENYLIST_FILES=(
+    "${SELFTESTS_BPF}/DENYLIST"
+    "${SELFTESTS_BPF}/DENYLIST.${ARCH}"
+    "${VMTEST_CONFIGS}/DENYLIST"
+    "${VMTEST_CONFIGS}/DENYLIST.${ARCH}"
+    "${VMTEST_CONFIGS}/DENYLIST.${DEPLOYMENT}"
+    "${VMTEST_CONFIGS}/DENYLIST.${KERNEL_TEST}"
+)
+
+# Export pipe-separated strings, because bash doesn't support array export
+export SELFTESTS_BPF_ALLOWLIST_FILES=$(IFS="|"; echo "${ALLOWLIST_FILES[*]}")
+export SELFTESTS_BPF_DENYLIST_FILES=$(IFS="|"; echo "${DENYLIST_FILES[*]}")
+
diff --git a/ci/vmtest/configs/run_veristat.kernel.cfg b/ci/vmtest/configs/run_veristat.kernel.cfg
new file mode 100644
index 0000000000000..807efc251073f
--- /dev/null
+++ b/ci/vmtest/configs/run_veristat.kernel.cfg
@@ -0,0 +1,4 @@
+VERISTAT_OBJECTS_DIR="${SELFTESTS_BPF}"
+VERISTAT_OBJECTS_GLOB="*.bpf.o"
+VERISTAT_CFG_FILE="${SELFTESTS_BPF}/veristat.cfg"
+VERISTAT_OUTPUT="veristat-kernel"
diff --git a/ci/vmtest/configs/run_veristat.meta.cfg b/ci/vmtest/configs/run_veristat.meta.cfg
new file mode 100644
index 0000000000000..14f08d241d206
--- /dev/null
+++ b/ci/vmtest/configs/run_veristat.meta.cfg
@@ -0,0 +1,4 @@
+VERISTAT_OBJECTS_DIR="${WORKING_DIR}/bpf_objects"
+VERISTAT_OBJECTS_GLOB="*.o"
+VERISTAT_OUTPUT="veristat-meta"
+VERISTAT_CFG_FILE="${VERISTAT_CONFIGS}/veristat_meta.cfg"
diff --git a/ci/vmtest/configs/run_veristat.scx.cfg b/ci/vmtest/configs/run_veristat.scx.cfg
new file mode 100644
index 0000000000000..740cf8e960b32
--- /dev/null
+++ b/ci/vmtest/configs/run_veristat.scx.cfg
@@ -0,0 +1,3 @@
+VERISTAT_OBJECTS_DIR="${SCX_PROGS}"
+VERISTAT_OBJECTS_GLOB="*.bpf.o"
+VERISTAT_OUTPUT="veristat-scx"
diff --git a/ci/vmtest/configs/veristat_meta.cfg b/ci/vmtest/configs/veristat_meta.cfg
new file mode 100644
index 0000000000000..5ee6db25736d9
--- /dev/null
+++ b/ci/vmtest/configs/veristat_meta.cfg
@@ -0,0 +1,46 @@
+# List of exceptions we know about that are not going to work with veristat.
+
+# libbpf-tools, maintained outside of fbcode
+!bcc-libbpf-tools-*
+
+# missing kernel function 'bictcp_cong_avoid'
+!ti-tcpevent-tcp_bpf_state_fentry-tcp_bpf_state_fentry.bpf.o/bictcp_cong_avoid
+# missing kernel function 'bictcp_state'
+!ti-tcpevent-tcp_bpf_tracer_fentry-tcp_bpf_tracer_fentry.bpf.o/bictcp_state
+# missing kernel function 'tcp_drop'
+!ti-tcpevent-tcp_bpf_tracer_fentry-tcp_bpf_tracer_fentry.bpf.o/tcp_drop
+
+# outdated (and abandoned ?) BPF programs, can't work with modern libbpf
+!schedulers-tangram-agent-bpf-blacklist-bpf_device_cgroup-device_cgroup_filter.bpf.o
+!schedulers-tangram-agent-bpf-netstat-bpf_cgroup_egress-bpf_cgroup_egress.bpf.o
+!schedulers-tangram-agent-bpf-netstat-bpf_cgroup_ingress-bpf_cgroup_ingress.bpf.o
+
+# invalid usage of global functions, seems abandoned as well
+!neteng-urgd-urgd_bpf_prog-urgd_bpf_prog.o
+
+# missing kernel function '__send_signal'
+!cea-object-introspection-OIVT-signal_bpf-signal.bpf.o/__send_signal
+
+# Strobelight program not passing validation properly
+!strobelight-server-bpf_program-hhvm_stacks-hhvm_stacks.o/hhvm_stack
+
+# RDMA functionality is expected which we don't have in default kernel flavor
+!neteng-netedit-bpf-ftrace-be_audit-be_audit-be_audit.bpf.o
+
+# Strobelight programs with >1mln instructions
+!strobelight-server-bpf_program-strobelight_process_monitor_libbpf-strobelight_process_monitor_libbpf.o
+
+# infiniband only, doesn't work on other hardware
+!neteng-netnorad-common-cpp-bpf-qp_ah_list-qp_ah_list.bpf.o/ret_query_qp
+
+# Droplet with >1mln instructions
+!ti-droplet-bpf-vip_filter_v2_xdp-vip_filter_v2_xdp.bpf.o/vip_filter
+
+# sched_ext bpf_lib objects don't need to be verified separately
+!third-party-scx*bpf_lib.bpf.o
+
+# These cause segfault in veristat due to a bug in libbpf
+# Link: https://lore.kernel.org/bpf/20250718001009.610955-1-andrii@kernel.org/
+# We can include them back after a veristat release with fixed libbpf
+!third-party-scx-__scx_chaos_bpf_skel_genskel-bpf.bpf.o
+!third-party-scx-__scx_p2dq_bpf_skel_genskel-bpf.bpf.o
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index a47d67db3be5a..09d5dc541d1ce 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -1001,6 +1001,7 @@ enum bpf_reg_type {
 	PTR_TO_ARENA,
 	PTR_TO_BUF,		 /* reg points to a read/write buffer */
 	PTR_TO_FUNC,		 /* reg points to a bpf program function */
+	PTR_TO_INSN,		 /* reg points to a bpf program instruction */
 	CONST_PTR_TO_DYNPTR,	 /* reg points to a const struct bpf_dynptr */
 	__BPF_REG_TYPE_MAX,
 
@@ -3797,4 +3798,19 @@ int bpf_prog_get_file_line(struct bpf_prog *prog, unsigned long ip, const char *
 			   const char **linep, int *nump);
 struct bpf_prog *bpf_prog_find_from_stack(void);
 
+int bpf_insn_array_init(struct bpf_map *map, const struct bpf_prog *prog);
+int bpf_insn_array_ready(struct bpf_map *map);
+void bpf_insn_array_release(struct bpf_map *map);
+void bpf_insn_array_adjust(struct bpf_map *map, u32 off, u32 len);
+void bpf_insn_array_adjust_after_remove(struct bpf_map *map, u32 off, u32 len);
+
+#ifdef CONFIG_BPF_SYSCALL
+void bpf_prog_update_insn_ptrs(struct bpf_prog *prog, u32 *offsets, void *image);
+#else
+static inline void
+bpf_prog_update_insn_ptrs(struct bpf_prog *prog, u32 *offsets, void *image)
+{
+}
+#endif
+
 #endif /* _LINUX_BPF_H */
diff --git a/include/linux/bpf_types.h b/include/linux/bpf_types.h
index fa78f49d4a9a6..b13de31e163f8 100644
--- a/include/linux/bpf_types.h
+++ b/include/linux/bpf_types.h
@@ -133,6 +133,7 @@ BPF_MAP_TYPE(BPF_MAP_TYPE_RINGBUF, ringbuf_map_ops)
 BPF_MAP_TYPE(BPF_MAP_TYPE_BLOOM_FILTER, bloom_filter_map_ops)
 BPF_MAP_TYPE(BPF_MAP_TYPE_USER_RINGBUF, user_ringbuf_map_ops)
 BPF_MAP_TYPE(BPF_MAP_TYPE_ARENA, arena_map_ops)
+BPF_MAP_TYPE(BPF_MAP_TYPE_INSN_ARRAY, insn_array_map_ops)
 
 BPF_LINK_TYPE(BPF_LINK_TYPE_RAW_TRACEPOINT, raw_tracepoint)
 BPF_LINK_TYPE(BPF_LINK_TYPE_TRACING, tracing)
diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
index c6eb68b6389c2..5441341f1ab93 100644
--- a/include/linux/bpf_verifier.h
+++ b/include/linux/bpf_verifier.h
@@ -527,6 +527,7 @@ struct bpf_insn_aux_data {
 		struct {
 			u32 map_index;		/* index into used_maps[] */
 			u32 map_off;		/* offset from value base address */
+			struct bpf_iarray *jt;	/* jump table for gotox instruction */
 		};
 		struct {
 			enum bpf_reg_type reg_type;	/* type of pseudo_btf_id */
@@ -754,8 +755,10 @@ struct bpf_verifier_env {
 	struct list_head free_list;	/* list of struct bpf_verifier_state_list */
 	struct bpf_map *used_maps[MAX_USED_MAPS]; /* array of map's used by eBPF program */
 	struct btf_mod_pair used_btfs[MAX_USED_BTFS]; /* array of BTF's used by BPF program */
+	struct bpf_map *insn_array_maps[MAX_USED_MAPS]; /* array of INSN_ARRAY map's to be relocated */
 	u32 used_map_cnt;		/* number of used maps */
 	u32 used_btf_cnt;		/* number of used BTF objects */
+	u32 insn_array_map_cnt;		/* number of used maps of type BPF_MAP_TYPE_INSN_ARRAY */
 	u32 id_gen;			/* used to generate unique reg IDs */
 	u32 hidden_subprog_cnt;		/* number of hidden subprogs */
 	int exception_callback_subprog;
@@ -838,6 +841,7 @@ struct bpf_verifier_env {
 	struct bpf_scc_info **scc_info;
 	u32 scc_cnt;
 	struct bpf_iarray *succ;
+	struct bpf_iarray *gotox_tmp_buf;
 };
 
 static inline struct bpf_func_info_aux *subprog_aux(struct bpf_verifier_env *env, int subprog)
@@ -1048,6 +1052,13 @@ static inline bool bpf_stack_narrow_access_ok(int off, int fill_size, int spill_
 	return !(off % BPF_REG_SIZE);
 }
 
+static inline bool insn_is_gotox(struct bpf_insn *insn)
+{
+	return BPF_CLASS(insn->code) == BPF_JMP &&
+	       BPF_OP(insn->code) == BPF_JA &&
+	       BPF_SRC(insn->code) == BPF_X;
+}
+
 const char *reg_type_str(struct bpf_verifier_env *env, enum bpf_reg_type type);
 const char *dynptr_type_str(enum bpf_dynptr_type type);
 const char *iter_type_str(const struct btf *btf, u32 btf_id);
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 1d73f165394d0..f5713f59ac10a 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -1026,6 +1026,7 @@ enum bpf_map_type {
 	BPF_MAP_TYPE_USER_RINGBUF,
 	BPF_MAP_TYPE_CGRP_STORAGE,
 	BPF_MAP_TYPE_ARENA,
+	BPF_MAP_TYPE_INSN_ARRAY,
 	__MAX_BPF_MAP_TYPE
 };
 
@@ -7649,4 +7650,24 @@ enum bpf_kfunc_flags {
 	BPF_F_PAD_ZEROS = (1ULL << 0),
 };
 
+/*
+ * Values of a BPF_MAP_TYPE_INSN_ARRAY entry must be of this type.
+ *
+ * Before the map is used the orig_off field should point to an
+ * instruction inside the program being loaded. The other fields
+ * must be set to 0.
+ *
+ * After the program is loaded, the xlated_off will be adjusted
+ * by the verifier to point to the index of the original instruction
+ * in the xlated program. If the instruction is deleted, it will
+ * be set to (u32)-1. The jitted_off will be set to the corresponding
+ * offset in the jitted image of the program.
+ */
+struct bpf_insn_array_value {
+	__u32 orig_off;
+	__u32 xlated_off;
+	__u32 jitted_off;
+	__u32 :32;
+};
+
 #endif /* _UAPI__LINUX_BPF_H__ */
diff --git a/kernel/bpf/Makefile b/kernel/bpf/Makefile
index 7fd0badfacb12..232cbc97434db 100644
--- a/kernel/bpf/Makefile
+++ b/kernel/bpf/Makefile
@@ -9,7 +9,7 @@ CFLAGS_core.o += -Wno-override-init $(cflags-nogcse-yy)
 obj-$(CONFIG_BPF_SYSCALL) += syscall.o verifier.o inode.o helpers.o tnum.o log.o token.o liveness.o
 obj-$(CONFIG_BPF_SYSCALL) += bpf_iter.o map_iter.o task_iter.o prog_iter.o link_iter.o
 obj-$(CONFIG_BPF_SYSCALL) += hashtab.o arraymap.o percpu_freelist.o bpf_lru_list.o lpm_trie.o map_in_map.o bloom_filter.o
-obj-$(CONFIG_BPF_SYSCALL) += local_storage.o queue_stack_maps.o ringbuf.o
+obj-$(CONFIG_BPF_SYSCALL) += local_storage.o queue_stack_maps.o ringbuf.o bpf_insn_array.o
 obj-$(CONFIG_BPF_SYSCALL) += bpf_local_storage.o bpf_task_storage.o
 obj-${CONFIG_BPF_LSM}	  += bpf_inode_storage.o
 obj-$(CONFIG_BPF_SYSCALL) += disasm.o mprog.o
diff --git a/kernel/bpf/bpf_insn_array.c b/kernel/bpf/bpf_insn_array.c
new file mode 100644
index 0000000000000..61ce528826328
--- /dev/null
+++ b/kernel/bpf/bpf_insn_array.c
@@ -0,0 +1,301 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/* Copyright (c) 2025 Isovalent */
+
+#include <linux/bpf.h>
+
+struct bpf_insn_array {
+	struct bpf_map map;
+	atomic_t used;
+	long *ips;
+	DECLARE_FLEX_ARRAY(struct bpf_insn_array_value, values);
+};
+
+#define cast_insn_array(MAP_PTR) \
+	container_of((MAP_PTR), struct bpf_insn_array, map)
+
+#define INSN_DELETED ((u32)-1)
+
+static inline u64 insn_array_alloc_size(u32 max_entries)
+{
+	const u64 base_size = sizeof(struct bpf_insn_array);
+	const u64 entry_size = sizeof(struct bpf_insn_array_value);
+
+	return base_size + max_entries * (entry_size + sizeof(long));
+}
+
+static int insn_array_alloc_check(union bpf_attr *attr)
+{
+	u32 value_size = sizeof(struct bpf_insn_array_value);
+
+	if (attr->max_entries == 0 || attr->key_size != 4 ||
+	    attr->value_size != value_size || attr->map_flags != 0)
+		return -EINVAL;
+
+	return 0;
+}
+
+static void insn_array_free(struct bpf_map *map)
+{
+	struct bpf_insn_array *insn_array = cast_insn_array(map);
+
+	bpf_map_area_free(insn_array);
+}
+
+static struct bpf_map *insn_array_alloc(union bpf_attr *attr)
+{
+	u64 size = insn_array_alloc_size(attr->max_entries);
+	struct bpf_insn_array *insn_array;
+
+	insn_array = bpf_map_area_alloc(size, NUMA_NO_NODE);
+	if (!insn_array)
+		return ERR_PTR(-ENOMEM);
+
+	/* ips are allocated right after the insn_array->values[] array */
+	insn_array->ips = (void *)&insn_array->values[attr->max_entries];
+
+	bpf_map_init_from_attr(&insn_array->map, attr);
+
+	return &insn_array->map;
+}
+
+static void *insn_array_lookup_elem(struct bpf_map *map, void *key)
+{
+	struct bpf_insn_array *insn_array = cast_insn_array(map);
+	u32 index = *(u32 *)key;
+
+	if (unlikely(index >= insn_array->map.max_entries))
+		return NULL;
+
+	return &insn_array->values[index];
+}
+
+static long insn_array_update_elem(struct bpf_map *map, void *key, void *value, u64 map_flags)
+{
+	struct bpf_insn_array *insn_array = cast_insn_array(map);
+	u32 index = *(u32 *)key;
+	struct bpf_insn_array_value val = {};
+
+	if (unlikely(index >= insn_array->map.max_entries))
+		return -E2BIG;
+
+	if (unlikely(map_flags & BPF_NOEXIST))
+		return -EEXIST;
+
+	copy_map_value(map, &val, value);
+	if (val.jitted_off || val.xlated_off)
+		return -EINVAL;
+
+	insn_array->values[index].orig_off = val.orig_off;
+
+	return 0;
+}
+
+static long insn_array_delete_elem(struct bpf_map *map, void *key)
+{
+	return -EINVAL;
+}
+
+static int insn_array_check_btf(const struct bpf_map *map,
+			      const struct btf *btf,
+			      const struct btf_type *key_type,
+			      const struct btf_type *value_type)
+{
+	if (!btf_type_is_i32(key_type))
+		return -EINVAL;
+
+	if (!btf_type_is_i64(value_type))
+		return -EINVAL;
+
+	return 0;
+}
+
+static u64 insn_array_mem_usage(const struct bpf_map *map)
+{
+	return insn_array_alloc_size(map->max_entries);
+}
+
+static int insn_array_map_direct_value_addr(const struct bpf_map *map, u64 *imm, u32 off)
+{
+	struct bpf_insn_array *insn_array = cast_insn_array(map);
+
+	if ((off % sizeof(long)) != 0 ||
+	    (off / sizeof(long)) >= map->max_entries)
+		return -EINVAL;
+
+	/* from BPF's point of view, this map is a jump table */
+	*imm = (unsigned long)insn_array->ips + off;
+
+	return 0;
+}
+
+BTF_ID_LIST_SINGLE(insn_array_btf_ids, struct, bpf_insn_array)
+
+const struct bpf_map_ops insn_array_map_ops = {
+	.map_alloc_check = insn_array_alloc_check,
+	.map_alloc = insn_array_alloc,
+	.map_free = insn_array_free,
+	.map_get_next_key = bpf_array_get_next_key,
+	.map_lookup_elem = insn_array_lookup_elem,
+	.map_update_elem = insn_array_update_elem,
+	.map_delete_elem = insn_array_delete_elem,
+	.map_check_btf = insn_array_check_btf,
+	.map_mem_usage = insn_array_mem_usage,
+	.map_direct_value_addr = insn_array_map_direct_value_addr,
+	.map_btf_id = &insn_array_btf_ids[0],
+};
+
+static inline bool is_frozen(struct bpf_map *map)
+{
+	guard(mutex)(&map->freeze_mutex);
+
+	return map->frozen;
+}
+
+static bool is_insn_array(const struct bpf_map *map)
+{
+	return map->map_type == BPF_MAP_TYPE_INSN_ARRAY;
+}
+
+static inline bool valid_offsets(const struct bpf_insn_array *insn_array,
+				 const struct bpf_prog *prog)
+{
+	u32 off;
+	int i;
+
+	for (i = 0; i < insn_array->map.max_entries; i++) {
+		off = insn_array->values[i].orig_off;
+
+		if (off >= prog->len)
+			return false;
+
+		if (off > 0) {
+			if (prog->insnsi[off-1].code == (BPF_LD | BPF_DW | BPF_IMM))
+				return false;
+		}
+	}
+
+	return true;
+}
+
+int bpf_insn_array_init(struct bpf_map *map, const struct bpf_prog *prog)
+{
+	struct bpf_insn_array *insn_array = cast_insn_array(map);
+	struct bpf_insn_array_value *values = insn_array->values;
+	int i;
+
+	if (!is_frozen(map))
+		return -EINVAL;
+
+	if (!valid_offsets(insn_array, prog))
+		return -EINVAL;
+
+	/*
+	 * There can be only one program using the map
+	 */
+	if (atomic_xchg(&insn_array->used, 1))
+		return -EBUSY;
+
+	/*
+	 * Reset all the map indexes to the original values.  This is needed,
+	 * e.g., when a replay of verification with different log level should
+	 * be performed.
+	 */
+	for (i = 0; i < map->max_entries; i++)
+		values[i].xlated_off = values[i].orig_off;
+
+	return 0;
+}
+
+int bpf_insn_array_ready(struct bpf_map *map)
+{
+	struct bpf_insn_array *insn_array = cast_insn_array(map);
+	int i;
+
+	for (i = 0; i < map->max_entries; i++) {
+		if (insn_array->values[i].xlated_off == INSN_DELETED)
+			continue;
+		if (!insn_array->ips[i])
+			return -EFAULT;
+	}
+
+	return 0;
+}
+
+void bpf_insn_array_release(struct bpf_map *map)
+{
+	struct bpf_insn_array *insn_array = cast_insn_array(map);
+
+	atomic_set(&insn_array->used, 0);
+}
+
+void bpf_insn_array_adjust(struct bpf_map *map, u32 off, u32 len)
+{
+	struct bpf_insn_array *insn_array = cast_insn_array(map);
+	int i;
+
+	if (len <= 1)
+		return;
+
+	for (i = 0; i < map->max_entries; i++) {
+		if (insn_array->values[i].xlated_off <= off)
+			continue;
+		if (insn_array->values[i].xlated_off == INSN_DELETED)
+			continue;
+		insn_array->values[i].xlated_off += len - 1;
+	}
+}
+
+void bpf_insn_array_adjust_after_remove(struct bpf_map *map, u32 off, u32 len)
+{
+	struct bpf_insn_array *insn_array = cast_insn_array(map);
+	int i;
+
+	for (i = 0; i < map->max_entries; i++) {
+		if (insn_array->values[i].xlated_off < off)
+			continue;
+		if (insn_array->values[i].xlated_off == INSN_DELETED)
+			continue;
+		if (insn_array->values[i].xlated_off < off + len)
+			insn_array->values[i].xlated_off = INSN_DELETED;
+		else
+			insn_array->values[i].xlated_off -= len;
+	}
+}
+
+/*
+ * This function is called by JITs. The image is the real program
+ * image, the offsets array set up the xlated -> jitted mapping.
+ * The offsets[xlated] offset should point to the beginning of
+ * the jitted instruction.
+ */
+void bpf_prog_update_insn_ptrs(struct bpf_prog *prog, u32 *offsets, void *image)
+{
+	struct bpf_insn_array *insn_array;
+	struct bpf_map *map;
+	u32 xlated_off;
+	int i, j;
+
+	if (!offsets || !image)
+		return;
+
+	for (i = 0; i < prog->aux->used_map_cnt; i++) {
+		map = prog->aux->used_maps[i];
+		if (!is_insn_array(map))
+			continue;
+
+		insn_array = cast_insn_array(map);
+		for (j = 0; j < map->max_entries; j++) {
+			xlated_off = insn_array->values[j].xlated_off;
+			if (xlated_off == INSN_DELETED)
+				continue;
+			if (xlated_off < prog->aux->subprog_start)
+				continue;
+			xlated_off -= prog->aux->subprog_start;
+			if (xlated_off >= prog->len)
+				continue;
+
+			insn_array->values[j].jitted_off = offsets[xlated_off];
+			insn_array->ips[j] = (long)(image + offsets[xlated_off]);
+		}
+	}
+}
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index d595fe512498c..ef4448f18aad2 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -1450,6 +1450,23 @@ void bpf_jit_prog_release_other(struct bpf_prog *fp, struct bpf_prog *fp_other)
 	bpf_prog_clone_free(fp_other);
 }
 
+static void adjust_insn_arrays(struct bpf_prog *prog, u32 off, u32 len)
+{
+#ifdef CONFIG_BPF_SYSCALL
+	struct bpf_map *map;
+	int i;
+
+	if (len <= 1)
+		return;
+
+	for (i = 0; i < prog->aux->used_map_cnt; i++) {
+		map = prog->aux->used_maps[i];
+		if (map->map_type == BPF_MAP_TYPE_INSN_ARRAY)
+			bpf_insn_array_adjust(map, off, len);
+	}
+#endif
+}
+
 struct bpf_prog *bpf_jit_blind_constants(struct bpf_prog *prog)
 {
 	struct bpf_insn insn_buff[16], aux[2];
@@ -1505,6 +1522,9 @@ struct bpf_prog *bpf_jit_blind_constants(struct bpf_prog *prog)
 		clone = tmp;
 		insn_delta = rewritten - 1;
 
+		/* Instructions arrays must be updated using absolute xlated offsets */
+		adjust_insn_arrays(clone, prog->aux->subprog_start + i, rewritten);
+
 		/* Walk new program and skip insns we just inserted. */
 		insn = clone->insnsi + i + insn_delta;
 		insn_cnt += insn_delta;
@@ -1688,6 +1708,7 @@ bool bpf_opcode_in_insntable(u8 code)
 		[BPF_LD | BPF_IND | BPF_B] = true,
 		[BPF_LD | BPF_IND | BPF_H] = true,
 		[BPF_LD | BPF_IND | BPF_W] = true,
+		[BPF_JMP | BPF_JA | BPF_X] = true,
 		[BPF_JMP | BPF_JCOND] = true,
 	};
 #undef BPF_INSN_3_TBL
diff --git a/kernel/bpf/disasm.c b/kernel/bpf/disasm.c
index 20883c6b1546c..f8a3c7eb451e4 100644
--- a/kernel/bpf/disasm.c
+++ b/kernel/bpf/disasm.c
@@ -358,6 +358,9 @@ void print_bpf_insn(const struct bpf_insn_cbs *cbs,
 		} else if (insn->code == (BPF_JMP | BPF_JA)) {
 			verbose(cbs->private_data, "(%02x) goto pc%+d\n",
 				insn->code, insn->off);
+		} else if (insn->code == (BPF_JMP | BPF_JA | BPF_X)) {
+			verbose(cbs->private_data, "(%02x) gotox r%d\n",
+				insn->code, insn->dst_reg);
 		} else if (insn->code == (BPF_JMP | BPF_JCOND) &&
 			   insn->src_reg == BPF_MAY_GOTO) {
 			verbose(cbs->private_data, "(%02x) may_goto pc%+d\n",
diff --git a/kernel/bpf/liveness.c b/kernel/bpf/liveness.c
index bffb495bc9333..a7240013fd9d9 100644
--- a/kernel/bpf/liveness.c
+++ b/kernel/bpf/liveness.c
@@ -485,6 +485,9 @@ bpf_insn_successors(struct bpf_verifier_env *env, u32 idx)
 	struct bpf_iarray *succ;
 	int insn_sz;
 
+	if (unlikely(insn_is_gotox(insn)))
+		return env->insn_aux_data[idx].jt;
+
 	/* pre-allocated array of size up to 2; reset cnt, as it may have been used already */
 	succ = env->succ;
 	succ->cnt = 0;
diff --git a/kernel/bpf/log.c b/kernel/bpf/log.c
index 70221aafc35c0..a0c3b35de2ce6 100644
--- a/kernel/bpf/log.c
+++ b/kernel/bpf/log.c
@@ -461,6 +461,7 @@ const char *reg_type_str(struct bpf_verifier_env *env, enum bpf_reg_type type)
 		[PTR_TO_ARENA]		= "arena",
 		[PTR_TO_BUF]		= "buf",
 		[PTR_TO_FUNC]		= "func",
+		[PTR_TO_INSN]		= "insn",
 		[PTR_TO_MAP_KEY]	= "map_key",
 		[CONST_PTR_TO_DYNPTR]	= "dynptr_ptr",
 	};
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 8a129746bd6cc..f62d61b6730a2 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -1493,6 +1493,7 @@ static int map_create(union bpf_attr *attr, bpfptr_t uattr)
 	case BPF_MAP_TYPE_STRUCT_OPS:
 	case BPF_MAP_TYPE_CPUMAP:
 	case BPF_MAP_TYPE_ARENA:
+	case BPF_MAP_TYPE_INSN_ARRAY:
 		if (!bpf_token_capable(token, CAP_BPF))
 			goto put_token;
 		break;
@@ -2853,6 +2854,23 @@ static int bpf_prog_verify_signature(struct bpf_prog *prog, union bpf_attr *attr
 	return err;
 }
 
+static int bpf_prog_mark_insn_arrays_ready(struct bpf_prog *prog)
+{
+	int err;
+	int i;
+
+	for (i = 0; i < prog->aux->used_map_cnt; i++) {
+		if (prog->aux->used_maps[i]->map_type != BPF_MAP_TYPE_INSN_ARRAY)
+			continue;
+
+		err = bpf_insn_array_ready(prog->aux->used_maps[i]);
+		if (err)
+			return err;
+	}
+
+	return 0;
+}
+
 /* last field in 'union bpf_attr' used by this command */
 #define BPF_PROG_LOAD_LAST_FIELD keyring_id
 
@@ -3082,6 +3100,10 @@ static int bpf_prog_load(union bpf_attr *attr, bpfptr_t uattr, u32 uattr_size)
 	if (err < 0)
 		goto free_used_maps;
 
+	err = bpf_prog_mark_insn_arrays_ready(prog);
+	if (err < 0)
+		goto free_used_maps;
+
 	err = bpf_prog_alloc_id(prog);
 	if (err)
 		goto free_used_maps;
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index e4928846e7637..1268fa075d4c2 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -6006,6 +6006,18 @@ static int check_map_kptr_access(struct bpf_verifier_env *env, u32 regno,
 	return 0;
 }
 
+/*
+ * Return the size of the memory region accessible from a pointer to map value.
+ * For INSN_ARRAY maps whole bpf_insn_array->ips array is accessible.
+ */
+static u32 map_mem_size(const struct bpf_map *map)
+{
+	if (map->map_type == BPF_MAP_TYPE_INSN_ARRAY)
+		return map->max_entries * sizeof(long);
+
+	return map->value_size;
+}
+
 /* check read/write into a map element with possible variable offset */
 static int check_map_access(struct bpf_verifier_env *env, u32 regno,
 			    int off, int size, bool zero_size_allowed,
@@ -6015,11 +6027,11 @@ static int check_map_access(struct bpf_verifier_env *env, u32 regno,
 	struct bpf_func_state *state = vstate->frame[vstate->curframe];
 	struct bpf_reg_state *reg = &state->regs[regno];
 	struct bpf_map *map = reg->map_ptr;
+	u32 mem_size = map_mem_size(map);
 	struct btf_record *rec;
 	int err, i;
 
-	err = check_mem_region_access(env, regno, off, size, map->value_size,
-				      zero_size_allowed);
+	err = check_mem_region_access(env, regno, off, size, mem_size, zero_size_allowed);
 	if (err)
 		return err;
 
@@ -7481,6 +7493,8 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
 {
 	struct bpf_reg_state *regs = cur_regs(env);
 	struct bpf_reg_state *reg = regs + regno;
+	bool insn_array = reg->type == PTR_TO_MAP_VALUE &&
+			  reg->map_ptr->map_type == BPF_MAP_TYPE_INSN_ARRAY;
 	int size, err = 0;
 
 	size = bpf_size_to_bytes(bpf_size);
@@ -7488,7 +7502,7 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
 		return size;
 
 	/* alignment checks will add in reg->off themselves */
-	err = check_ptr_alignment(env, reg, off, size, strict_alignment_once);
+	err = check_ptr_alignment(env, reg, off, size, strict_alignment_once || insn_array);
 	if (err)
 		return err;
 
@@ -7515,6 +7529,11 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
 			verbose(env, "R%d leaks addr into map\n", value_regno);
 			return -EACCES;
 		}
+		if (t == BPF_WRITE && insn_array) {
+			verbose(env, "writes into insn_array not allowed\n");
+			return -EACCES;
+		}
+
 		err = check_map_access_type(env, regno, off, size, t);
 		if (err)
 			return err;
@@ -7543,6 +7562,14 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
 
 				regs[value_regno].type = SCALAR_VALUE;
 				__mark_reg_known(&regs[value_regno], val);
+			} else if (map->map_type == BPF_MAP_TYPE_INSN_ARRAY) {
+				if (bpf_size != BPF_DW) {
+					verbose(env, "Invalid read of %d bytes from insn_array\n",
+						     size);
+					return -EACCES;
+				}
+				copy_register_state(&regs[value_regno], reg);
+				regs[value_regno].type = PTR_TO_INSN;
 			} else {
 				mark_reg_unknown(env, regs, value_regno);
 			}
@@ -10086,6 +10113,8 @@ static int check_map_func_compatibility(struct bpf_verifier_env *env,
 		    func_id != BPF_FUNC_map_push_elem)
 			goto error;
 		break;
+	case BPF_MAP_TYPE_INSN_ARRAY:
+		goto error;
 	default:
 		break;
 	}
@@ -17094,7 +17123,8 @@ static int check_ld_imm(struct bpf_verifier_env *env, struct bpf_insn *insn)
 		}
 		dst_reg->type = PTR_TO_MAP_VALUE;
 		dst_reg->off = aux->map_off;
-		WARN_ON_ONCE(map->max_entries != 1);
+		WARN_ON_ONCE(map->map_type != BPF_MAP_TYPE_INSN_ARRAY &&
+			     map->max_entries != 1);
 		/* We want reg->id to be same (0) as map_value is not distinct */
 	} else if (insn->src_reg == BPF_PSEUDO_MAP_FD ||
 		   insn->src_reg == BPF_PSEUDO_MAP_IDX) {
@@ -17862,6 +17892,206 @@ static struct bpf_iarray *iarray_realloc(struct bpf_iarray *old, size_t n_elem)
 	return new;
 }
 
+static int copy_insn_array(struct bpf_map *map, u32 start, u32 end, u32 *items)
+{
+	struct bpf_insn_array_value *value;
+	u32 i;
+
+	for (i = start; i <= end; i++) {
+		value = map->ops->map_lookup_elem(map, &i);
+		if (!value)
+			return -EINVAL;
+		items[i - start] = value->xlated_off;
+	}
+	return 0;
+}
+
+static int cmp_ptr_to_u32(const void *a, const void *b)
+{
+	return *(u32 *)a - *(u32 *)b;
+}
+
+static int sort_insn_array_uniq(u32 *items, int cnt)
+{
+	int unique = 1;
+	int i;
+
+	sort(items, cnt, sizeof(items[0]), cmp_ptr_to_u32, NULL);
+
+	for (i = 1; i < cnt; i++)
+		if (items[i] != items[unique - 1])
+			items[unique++] = items[i];
+
+	return unique;
+}
+
+/*
+ * sort_unique({map[start], ..., map[end]}) into off
+ */
+static int copy_insn_array_uniq(struct bpf_map *map, u32 start, u32 end, u32 *off)
+{
+	u32 n = end - start + 1;
+	int err;
+
+	err = copy_insn_array(map, start, end, off);
+	if (err)
+		return err;
+
+	return sort_insn_array_uniq(off, n);
+}
+
+/*
+ * Copy all unique offsets from the map
+ */
+static struct bpf_iarray *jt_from_map(struct bpf_map *map)
+{
+	struct bpf_iarray *jt;
+	int err;
+	int n;
+
+	jt = iarray_realloc(NULL, map->max_entries);
+	if (!jt)
+		return ERR_PTR(-ENOMEM);
+
+	n = copy_insn_array_uniq(map, 0, map->max_entries - 1, jt->items);
+	if (n < 0) {
+		err = n;
+		goto err_free;
+	}
+	if (n == 0) {
+		err = -EINVAL;
+		goto err_free;
+	}
+	jt->cnt = n;
+	return jt;
+
+err_free:
+	kvfree(jt);
+	return ERR_PTR(err);
+}
+
+/*
+ * Find and collect all maps which fit in the subprog. Return the result as one
+ * combined jump table in jt->items (allocated with kvcalloc)
+ */
+static struct bpf_iarray *jt_from_subprog(struct bpf_verifier_env *env,
+					  int subprog_start, int subprog_end)
+{
+	struct bpf_iarray *jt = NULL;
+	struct bpf_map *map;
+	struct bpf_iarray *jt_cur;
+	int i;
+
+	for (i = 0; i < env->insn_array_map_cnt; i++) {
+		/*
+		 * TODO (when needed): collect only jump tables, not static keys
+		 * or maps for indirect calls
+		 */
+		map = env->insn_array_maps[i];
+
+		jt_cur = jt_from_map(map);
+		if (IS_ERR(jt_cur)) {
+			kvfree(jt);
+			return jt_cur;
+		}
+
+		/*
+		 * This is enough to check one element. The full table is
+		 * checked to fit inside the subprog later in create_jt()
+		 */
+		if (jt_cur->items[0] >= subprog_start && jt_cur->items[0] < subprog_end) {
+			u32 old_cnt = jt ? jt->cnt : 0;
+			jt = iarray_realloc(jt, old_cnt + jt_cur->cnt);
+			if (!jt) {
+				kvfree(jt_cur);
+				return ERR_PTR(-ENOMEM);
+			}
+			memcpy(jt->items + old_cnt, jt_cur->items, jt_cur->cnt << 2);
+		}
+
+		kvfree(jt_cur);
+	}
+
+	if (!jt) {
+		verbose(env, "no jump tables found for subprog starting at %u\n", subprog_start);
+		return ERR_PTR(-EINVAL);
+	}
+
+	jt->cnt = sort_insn_array_uniq(jt->items, jt->cnt);
+	return jt;
+}
+
+static struct bpf_iarray *
+create_jt(int t, struct bpf_verifier_env *env)
+{
+	static struct bpf_subprog_info *subprog;
+	int subprog_start, subprog_end;
+	struct bpf_iarray *jt;
+	int i;
+
+	subprog = bpf_find_containing_subprog(env, t);
+	subprog_start = subprog->start;
+	subprog_end = (subprog + 1)->start;
+	jt = jt_from_subprog(env, subprog_start, subprog_end);
+	if (IS_ERR(jt))
+		return jt;
+
+	/* Check that the every element of the jump table fits within the given subprogram */
+	for (i = 0; i < jt->cnt; i++) {
+		if (jt->items[i] < subprog_start || jt->items[i] >= subprog_end) {
+			verbose(env, "jump table for insn %d points outside of the subprog [%u,%u]\n",
+					t, subprog_start, subprog_end);
+			kvfree(jt);
+			return ERR_PTR(-EINVAL);
+		}
+	}
+
+	return jt;
+}
+
+/* "conditional jump with N edges" */
+static int visit_gotox_insn(int t, struct bpf_verifier_env *env)
+{
+	int *insn_stack = env->cfg.insn_stack;
+	int *insn_state = env->cfg.insn_state;
+	bool keep_exploring = false;
+	struct bpf_iarray *jt;
+	int i, w;
+
+	jt = env->insn_aux_data[t].jt;
+	if (!jt) {
+		jt = create_jt(t, env);
+		if (IS_ERR(jt))
+			return PTR_ERR(jt);
+
+		env->insn_aux_data[t].jt = jt;
+	}
+
+	mark_prune_point(env, t);
+	for (i = 0; i < jt->cnt; i++) {
+		w = jt->items[i];
+		if (w < 0 || w >= env->prog->len) {
+			verbose(env, "indirect jump out of range from insn %d to %d\n", t, w);
+			return -EINVAL;
+		}
+
+		mark_jmp_point(env, w);
+
+		/* EXPLORED || DISCOVERED */
+		if (insn_state[w])
+			continue;
+
+		if (env->cfg.cur_stack >= env->prog->len)
+			return -E2BIG;
+
+		insn_stack[env->cfg.cur_stack++] = w;
+		insn_state[w] |= DISCOVERED;
+		keep_exploring = true;
+	}
+
+	return keep_exploring ? KEEP_EXPLORING : DONE_EXPLORING;
+}
+
 /* Visits the instruction at index t and returns one of the following:
  *  < 0 - an error occurred
  *  DONE_EXPLORING - the instruction was fully explored
@@ -17954,8 +18184,8 @@ static int visit_insn(int t, struct bpf_verifier_env *env)
 		return visit_func_call_insn(t, insns, env, insn->src_reg == BPF_PSEUDO_CALL);
 
 	case BPF_JA:
-		if (BPF_SRC(insn->code) != BPF_K)
-			return -EINVAL;
+		if (BPF_SRC(insn->code) == BPF_X)
+			return visit_gotox_insn(t, env);
 
 		if (BPF_CLASS(insn->code) == BPF_JMP)
 			off = insn->off;
@@ -18884,6 +19114,10 @@ static bool regsafe(struct bpf_verifier_env *env, struct bpf_reg_state *rold,
 		return regs_exact(rold, rcur, idmap) && rold->frameno == rcur->frameno;
 	case PTR_TO_ARENA:
 		return true;
+	case PTR_TO_INSN:
+		return memcmp(rold, rcur, offsetof(struct bpf_reg_state, var_off)) == 0 &&
+			rold->off == rcur->off && range_within(rold, rcur) &&
+			tnum_in(rold->var_off, rcur->var_off);
 	default:
 		return regs_exact(rold, rcur, idmap);
 	}
@@ -19893,6 +20127,99 @@ static int process_bpf_exit_full(struct bpf_verifier_env *env,
 	return PROCESS_BPF_EXIT;
 }
 
+static int indirect_jump_min_max_index(struct bpf_verifier_env *env,
+				       int regno,
+				       struct bpf_map *map,
+				       u32 *pmin_index, u32 *pmax_index)
+{
+	struct bpf_reg_state *reg = reg_state(env, regno);
+	u64 min_index, max_index;
+	const u32 size = 8;
+
+	if (check_add_overflow(reg->umin_value, reg->off, &min_index) ||
+		(min_index > (u64) U32_MAX * size)) {
+		verbose(env, "the sum of R%u umin_value %llu and off %u is too big\n",
+			     regno, reg->umin_value, reg->off);
+		return -ERANGE;
+	}
+	if (check_add_overflow(reg->umax_value, reg->off, &max_index) ||
+		(max_index > (u64) U32_MAX * size)) {
+		verbose(env, "the sum of R%u umax_value %llu and off %u is too big\n",
+			     regno, reg->umax_value, reg->off);
+		return -ERANGE;
+	}
+
+	min_index /= size;
+	max_index /= size;
+
+	if (max_index >= map->max_entries) {
+		verbose(env, "R%u points to outside of jump table: [%llu,%llu] max_entries %u\n",
+			     regno, min_index, max_index, map->max_entries);
+		return -EINVAL;
+	}
+
+	*pmin_index = min_index;
+	*pmax_index = max_index;
+	return 0;
+}
+
+/* gotox *dst_reg */
+static int check_indirect_jump(struct bpf_verifier_env *env, struct bpf_insn *insn)
+{
+	struct bpf_verifier_state *other_branch;
+	struct bpf_reg_state *dst_reg;
+	struct bpf_map *map;
+	u32 min_index, max_index;
+	int err = 0;
+	int n;
+	int i;
+
+	dst_reg = reg_state(env, insn->dst_reg);
+	if (dst_reg->type != PTR_TO_INSN) {
+		verbose(env, "R%d has type %s, expected PTR_TO_INSN\n",
+			     insn->dst_reg, reg_type_str(env, dst_reg->type));
+		return -EINVAL;
+	}
+
+	map = dst_reg->map_ptr;
+	if (verifier_bug_if(!map, env, "R%d has an empty map pointer", insn->dst_reg))
+		return -EFAULT;
+
+	if (verifier_bug_if(map->map_type != BPF_MAP_TYPE_INSN_ARRAY, env,
+			    "R%d has incorrect map type %d", insn->dst_reg, map->map_type))
+		return -EFAULT;
+
+	err = indirect_jump_min_max_index(env, insn->dst_reg, map, &min_index, &max_index);
+	if (err)
+		return err;
+
+	/* Ensure that the buffer is large enough */
+	if (!env->gotox_tmp_buf || env->gotox_tmp_buf->cnt < max_index - min_index + 1) {
+		env->gotox_tmp_buf = iarray_realloc(env->gotox_tmp_buf,
+						    max_index - min_index + 1);
+		if (!env->gotox_tmp_buf)
+			return -ENOMEM;
+	}
+
+	n = copy_insn_array_uniq(map, min_index, max_index, env->gotox_tmp_buf->items);
+	if (n < 0)
+		return n;
+	if (n == 0) {
+		verbose(env, "register R%d doesn't point to any offset in map id=%d\n",
+			     insn->dst_reg, map->id);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < n - 1; i++) {
+		other_branch = push_stack(env, env->gotox_tmp_buf->items[i],
+					  env->insn_idx, env->cur_state->speculative);
+		if (IS_ERR(other_branch))
+			return PTR_ERR(other_branch);
+	}
+	env->insn_idx = env->gotox_tmp_buf->items[n-1];
+	return 0;
+}
+
 static int do_check_insn(struct bpf_verifier_env *env, bool *do_print_state)
 {
 	int err;
@@ -19995,6 +20322,15 @@ static int do_check_insn(struct bpf_verifier_env *env, bool *do_print_state)
 
 			mark_reg_scratched(env, BPF_REG_0);
 		} else if (opcode == BPF_JA) {
+			if (BPF_SRC(insn->code) == BPF_X) {
+				if (insn->src_reg != BPF_REG_0 ||
+				    insn->imm != 0 || insn->off != 0) {
+					verbose(env, "BPF_JA|BPF_X uses reserved fields\n");
+					return -EINVAL;
+				}
+				return check_indirect_jump(env, insn);
+			}
+
 			if (BPF_SRC(insn->code) != BPF_K ||
 			    insn->src_reg != BPF_REG_0 ||
 			    insn->dst_reg != BPF_REG_0 ||
@@ -20511,6 +20847,7 @@ static int check_map_prog_compatibility(struct bpf_verifier_env *env,
 		case BPF_MAP_TYPE_QUEUE:
 		case BPF_MAP_TYPE_STACK:
 		case BPF_MAP_TYPE_ARENA:
+		case BPF_MAP_TYPE_INSN_ARRAY:
 			break;
 		default:
 			verbose(env,
@@ -20582,6 +20919,15 @@ static int __add_used_map(struct bpf_verifier_env *env, struct bpf_map *map)
 
 	env->used_maps[env->used_map_cnt++] = map;
 
+	if (map->map_type == BPF_MAP_TYPE_INSN_ARRAY) {
+		err = bpf_insn_array_init(map, env->prog);
+		if (err) {
+			verbose(env, "Failed to properly initialize insn array\n");
+			return err;
+		}
+		env->insn_array_maps[env->insn_array_map_cnt++] = map;
+	}
+
 	return env->used_map_cnt - 1;
 }
 
@@ -20828,6 +21174,33 @@ static void adjust_subprog_starts(struct bpf_verifier_env *env, u32 off, u32 len
 	}
 }
 
+static void release_insn_arrays(struct bpf_verifier_env *env)
+{
+	int i;
+
+	for (i = 0; i < env->insn_array_map_cnt; i++)
+		bpf_insn_array_release(env->insn_array_maps[i]);
+}
+
+static void adjust_insn_arrays(struct bpf_verifier_env *env, u32 off, u32 len)
+{
+	int i;
+
+	if (len == 1)
+		return;
+
+	for (i = 0; i < env->insn_array_map_cnt; i++)
+		bpf_insn_array_adjust(env->insn_array_maps[i], off, len);
+}
+
+static void adjust_insn_arrays_after_remove(struct bpf_verifier_env *env, u32 off, u32 len)
+{
+	int i;
+
+	for (i = 0; i < env->insn_array_map_cnt; i++)
+		bpf_insn_array_adjust_after_remove(env->insn_array_maps[i], off, len);
+}
+
 static void adjust_poke_descs(struct bpf_prog *prog, u32 off, u32 len)
 {
 	struct bpf_jit_poke_descriptor *tab = prog->aux->poke_tab;
@@ -20869,6 +21242,7 @@ static struct bpf_prog *bpf_patch_insn_data(struct bpf_verifier_env *env, u32 of
 	}
 	adjust_insn_aux_data(env, new_prog, off, len);
 	adjust_subprog_starts(env, off, len);
+	adjust_insn_arrays(env, off, len);
 	adjust_poke_descs(new_prog, off, len);
 	return new_prog;
 }
@@ -21031,6 +21405,27 @@ static int bpf_adj_linfo_after_remove(struct bpf_verifier_env *env, u32 off,
 	return 0;
 }
 
+/*
+ * Clean up dynamically allocated fields of aux data for instructions [start, ...]
+ */
+static void clear_insn_aux_data(struct bpf_verifier_env *env, int start, int len)
+{
+	struct bpf_insn_aux_data *aux_data = env->insn_aux_data;
+	struct bpf_insn *insns = env->prog->insnsi;
+	int end = start + len;
+	int i;
+
+	for (i = start; i < end; i++) {
+		if (insn_is_gotox(&insns[i])) {
+			kvfree(aux_data[i].jt);
+			aux_data[i].jt = NULL;
+		}
+
+		if (bpf_is_ldimm64(&insns[i]))
+			i++;
+	}
+}
+
 static int verifier_remove_insns(struct bpf_verifier_env *env, u32 off, u32 cnt)
 {
 	struct bpf_insn_aux_data *aux_data = env->insn_aux_data;
@@ -21040,6 +21435,9 @@ static int verifier_remove_insns(struct bpf_verifier_env *env, u32 off, u32 cnt)
 	if (bpf_prog_is_offloaded(env->prog->aux))
 		bpf_prog_offload_remove_insns(env, off, cnt);
 
+	/* Should be called before bpf_remove_insns, as it uses prog->insnsi */
+	clear_insn_aux_data(env, off, cnt);
+
 	err = bpf_remove_insns(env->prog, off, cnt);
 	if (err)
 		return err;
@@ -21052,6 +21450,8 @@ static int verifier_remove_insns(struct bpf_verifier_env *env, u32 off, u32 cnt)
 	if (err)
 		return err;
 
+	adjust_insn_arrays_after_remove(env, off, cnt);
+
 	memmove(aux_data + off,	aux_data + off + cnt,
 		sizeof(*aux_data) * (orig_prog_len - off - cnt));
 
@@ -21591,6 +21991,7 @@ static int jit_subprogs(struct bpf_verifier_env *env)
 	struct bpf_insn *insn;
 	void *old_bpf_func;
 	int err, num_exentries;
+	int old_len, subprog_start_adjustment = 0;
 
 	if (env->subprog_cnt <= 1)
 		return 0;
@@ -21665,7 +22066,7 @@ static int jit_subprogs(struct bpf_verifier_env *env)
 		func[i]->aux->func_idx = i;
 		/* Below members will be freed only at prog->aux */
 		func[i]->aux->btf = prog->aux->btf;
-		func[i]->aux->subprog_start = subprog_start;
+		func[i]->aux->subprog_start = subprog_start + subprog_start_adjustment;
 		func[i]->aux->func_info = prog->aux->func_info;
 		func[i]->aux->func_info_cnt = prog->aux->func_info_cnt;
 		func[i]->aux->poke_tab = prog->aux->poke_tab;
@@ -21695,6 +22096,8 @@ static int jit_subprogs(struct bpf_verifier_env *env)
 		func[i]->aux->jited_linfo = prog->aux->jited_linfo;
 		func[i]->aux->linfo_idx = env->subprog_info[i].linfo_idx;
 		func[i]->aux->arena = prog->aux->arena;
+		func[i]->aux->used_maps = env->used_maps;
+		func[i]->aux->used_map_cnt = env->used_map_cnt;
 		num_exentries = 0;
 		insn = func[i]->insnsi;
 		for (j = 0; j < func[i]->len; j++, insn++) {
@@ -21719,7 +22122,15 @@ static int jit_subprogs(struct bpf_verifier_env *env)
 		func[i]->aux->might_sleep = env->subprog_info[i].might_sleep;
 		if (!i)
 			func[i]->aux->exception_boundary = env->seen_exception;
+
+		/*
+		 * To properly pass the absolute subprog start to jit
+		 * all instruction adjustments should be accumulated
+		 */
+		old_len = func[i]->len;
 		func[i] = bpf_int_jit_compile(func[i]);
+		subprog_start_adjustment += func[i]->len - old_len;
+
 		if (!func[i]->jited) {
 			err = -ENOTSUPP;
 			goto out_free;
@@ -24871,6 +25282,8 @@ int bpf_check(struct bpf_prog **prog, union bpf_attr *attr, bpfptr_t uattr, __u3
 	adjust_btf_func(env);
 
 err_release_maps:
+	if (ret)
+		release_insn_arrays(env);
 	if (!env->prog->aux->used_maps)
 		/* if we didn't copy map pointers into bpf_prog_info, release
 		 * them now. Otherwise free_used_maps() will release them.
@@ -24891,12 +25304,14 @@ int bpf_check(struct bpf_prog **prog, union bpf_attr *attr, bpfptr_t uattr, __u3
 err_unlock:
 	if (!is_priv)
 		mutex_unlock(&bpf_verifier_lock);
+	clear_insn_aux_data(env, 0, env->prog->len);
 	vfree(env->insn_aux_data);
 err_free_env:
 	bpf_stack_liveness_free(env);
 	kvfree(env->cfg.insn_postorder);
 	kvfree(env->scc_info);
 	kvfree(env->succ);
+	kvfree(env->gotox_tmp_buf);
 	kvfree(env);
 	return ret;
 }
diff --git a/tools/bpf/bpftool/Documentation/bpftool-map.rst b/tools/bpf/bpftool/Documentation/bpftool-map.rst
index 252e4c538edb7..1af3305ea2b2e 100644
--- a/tools/bpf/bpftool/Documentation/bpftool-map.rst
+++ b/tools/bpf/bpftool/Documentation/bpftool-map.rst
@@ -55,7 +55,8 @@ MAP COMMANDS
 |     | **devmap** | **devmap_hash** | **sockmap** | **cpumap** | **xskmap** | **sockhash**
 |     | **cgroup_storage** | **reuseport_sockarray** | **percpu_cgroup_storage**
 |     | **queue** | **stack** | **sk_storage** | **struct_ops** | **ringbuf** | **inode_storage**
-|     | **task_storage** | **bloom_filter** | **user_ringbuf** | **cgrp_storage** | **arena** }
+|     | **task_storage** | **bloom_filter** | **user_ringbuf** | **cgrp_storage** | **arena**
+|     | **insn_array** }
 
 DESCRIPTION
 ===========
diff --git a/tools/bpf/bpftool/map.c b/tools/bpf/bpftool/map.c
index c9de44a45778b..7ebf7dbcfba4f 100644
--- a/tools/bpf/bpftool/map.c
+++ b/tools/bpf/bpftool/map.c
@@ -1477,7 +1477,8 @@ static int do_help(int argc, char **argv)
 		"                 devmap | devmap_hash | sockmap | cpumap | xskmap | sockhash |\n"
 		"                 cgroup_storage | reuseport_sockarray | percpu_cgroup_storage |\n"
 		"                 queue | stack | sk_storage | struct_ops | ringbuf | inode_storage |\n"
-		"                 task_storage | bloom_filter | user_ringbuf | cgrp_storage | arena }\n"
+		"                 task_storage | bloom_filter | user_ringbuf | cgrp_storage | arena |\n"
+		"                 insn_array }\n"
 		"       " HELP_SPEC_OPTIONS " |\n"
 		"                    {-f|--bpffs} | {-n|--nomount} }\n"
 		"",
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index 1d73f165394d0..f5713f59ac10a 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -1026,6 +1026,7 @@ enum bpf_map_type {
 	BPF_MAP_TYPE_USER_RINGBUF,
 	BPF_MAP_TYPE_CGRP_STORAGE,
 	BPF_MAP_TYPE_ARENA,
+	BPF_MAP_TYPE_INSN_ARRAY,
 	__MAX_BPF_MAP_TYPE
 };
 
@@ -7649,4 +7650,24 @@ enum bpf_kfunc_flags {
 	BPF_F_PAD_ZEROS = (1ULL << 0),
 };
 
+/*
+ * Values of a BPF_MAP_TYPE_INSN_ARRAY entry must be of this type.
+ *
+ * Before the map is used the orig_off field should point to an
+ * instruction inside the program being loaded. The other fields
+ * must be set to 0.
+ *
+ * After the program is loaded, the xlated_off will be adjusted
+ * by the verifier to point to the index of the original instruction
+ * in the xlated program. If the instruction is deleted, it will
+ * be set to (u32)-1. The jitted_off will be set to the corresponding
+ * offset in the jitted image of the program.
+ */
+struct bpf_insn_array_value {
+	__u32 orig_off;
+	__u32 xlated_off;
+	__u32 jitted_off;
+	__u32 :32;
+};
+
 #endif /* _UAPI__LINUX_BPF_H__ */
diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index 27a07782bd726..706e7481bdf6b 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -190,6 +190,7 @@ static const char * const map_type_name[] = {
 	[BPF_MAP_TYPE_USER_RINGBUF]             = "user_ringbuf",
 	[BPF_MAP_TYPE_CGRP_STORAGE]		= "cgrp_storage",
 	[BPF_MAP_TYPE_ARENA]			= "arena",
+	[BPF_MAP_TYPE_INSN_ARRAY]		= "insn_array",
 };
 
 static const char * const prog_type_name[] = {
@@ -369,6 +370,7 @@ enum reloc_type {
 	RELO_EXTERN_CALL,
 	RELO_SUBPROG_ADDR,
 	RELO_CORE,
+	RELO_INSN_ARRAY,
 };
 
 struct reloc_desc {
@@ -379,7 +381,16 @@ struct reloc_desc {
 		struct {
 			int map_idx;
 			int sym_off;
-			int ext_idx;
+			/*
+			 * The following two fields can be unionized, as the
+			 * ext_idx field is used for extern symbols, and the
+			 * sym_size is used for jump tables, which are never
+			 * extern
+			 */
+			union {
+				int ext_idx;
+				int sym_size;
+			};
 		};
 	};
 };
@@ -421,6 +432,11 @@ struct bpf_sec_def {
 	libbpf_prog_attach_fn_t prog_attach_fn;
 };
 
+struct bpf_light_subprog {
+	__u32 sec_insn_off;
+	__u32 sub_insn_off;
+};
+
 /*
  * bpf_prog should be a better name but it has been used in
  * linux/filter.h.
@@ -494,6 +510,9 @@ struct bpf_program {
 	__u32 line_info_cnt;
 	__u32 prog_flags;
 	__u8  hash[SHA256_DIGEST_LENGTH];
+
+	struct bpf_light_subprog *subprogs;
+	__u32 subprog_cnt;
 };
 
 struct bpf_struct_ops {
@@ -667,6 +686,7 @@ struct elf_state {
 	int symbols_shndx;
 	bool has_st_ops;
 	int arena_data_shndx;
+	int jumptables_data_shndx;
 };
 
 struct usdt_manager;
@@ -738,6 +758,16 @@ struct bpf_object {
 	void *arena_data;
 	size_t arena_data_sz;
 
+	void *jumptables_data;
+	size_t jumptables_data_sz;
+
+	struct {
+		struct bpf_program *prog;
+		int sym_off;
+		int fd;
+	} *jumptable_maps;
+	size_t jumptable_map_cnt;
+
 	struct kern_feature_cache *feat_cache;
 	char *token_path;
 	int token_fd;
@@ -764,6 +794,7 @@ void bpf_program__unload(struct bpf_program *prog)
 
 	zfree(&prog->func_info);
 	zfree(&prog->line_info);
+	zfree(&prog->subprogs);
 }
 
 static void bpf_program__exit(struct bpf_program *prog)
@@ -3942,6 +3973,13 @@ static int bpf_object__elf_collect(struct bpf_object *obj)
 			} else if (strcmp(name, ARENA_SEC) == 0) {
 				obj->efile.arena_data = data;
 				obj->efile.arena_data_shndx = idx;
+			} else if (strcmp(name, JUMPTABLES_SEC) == 0) {
+				obj->jumptables_data = malloc(data->d_size);
+				if (!obj->jumptables_data)
+					return -ENOMEM;
+				memcpy(obj->jumptables_data, data->d_buf, data->d_size);
+				obj->jumptables_data_sz = data->d_size;
+				obj->efile.jumptables_data_shndx = idx;
 			} else {
 				pr_info("elf: skipping unrecognized data section(%d) %s\n",
 					idx, name);
@@ -4634,6 +4672,16 @@ static int bpf_program__record_reloc(struct bpf_program *prog,
 		return 0;
 	}
 
+	/* jump table data relocation */
+	if (shdr_idx == obj->efile.jumptables_data_shndx) {
+		reloc_desc->type = RELO_INSN_ARRAY;
+		reloc_desc->insn_idx = insn_idx;
+		reloc_desc->map_idx = -1;
+		reloc_desc->sym_off = sym->st_value;
+		reloc_desc->sym_size = sym->st_size;
+		return 0;
+	}
+
 	/* generic map reference relocation */
 	if (type == LIBBPF_MAP_UNSPEC) {
 		if (!bpf_object__shndx_is_maps(obj, shdr_idx)) {
@@ -6144,6 +6192,157 @@ static void poison_kfunc_call(struct bpf_program *prog, int relo_idx,
 	insn->imm = POISON_CALL_KFUNC_BASE + ext_idx;
 }
 
+static int find_jt_map(struct bpf_object *obj, struct bpf_program *prog, int sym_off)
+{
+	size_t i;
+
+	for (i = 0; i < obj->jumptable_map_cnt; i++) {
+		/*
+		 * This might happen that same offset is used for two different
+		 * programs (as jump tables can be the same). However, for
+		 * different programs different maps should be created.
+		 */
+		if (obj->jumptable_maps[i].sym_off == sym_off &&
+		    obj->jumptable_maps[i].prog == prog)
+			return obj->jumptable_maps[i].fd;
+	}
+
+	return -ENOENT;
+}
+
+static int add_jt_map(struct bpf_object *obj, struct bpf_program *prog, int sym_off, int map_fd)
+{
+	size_t cnt = obj->jumptable_map_cnt;
+	size_t size = sizeof(obj->jumptable_maps[0]);
+	void *tmp;
+
+	tmp = libbpf_reallocarray(obj->jumptable_maps, cnt + 1, size);
+	if (!tmp)
+		return -ENOMEM;
+
+	obj->jumptable_maps = tmp;
+	obj->jumptable_maps[cnt].prog = prog;
+	obj->jumptable_maps[cnt].sym_off = sym_off;
+	obj->jumptable_maps[cnt].fd = map_fd;
+	obj->jumptable_map_cnt++;
+
+	return 0;
+}
+
+static int find_subprog_idx(struct bpf_program *prog, int insn_idx)
+{
+	int i;
+
+	for (i = prog->subprog_cnt - 1; i >= 0; i--) {
+		if (insn_idx >= prog->subprogs[i].sub_insn_off)
+			return i;
+	}
+
+	return -1;
+}
+
+static int create_jt_map(struct bpf_object *obj, struct bpf_program *prog, struct reloc_desc *relo)
+{
+	const __u32 jt_entry_size = 8;
+	int sym_off = relo->sym_off;
+	int jt_size = relo->sym_size;
+	__u32 max_entries = jt_size / jt_entry_size;
+	__u32 value_size = sizeof(struct bpf_insn_array_value);
+	struct bpf_insn_array_value val = {};
+	int subprog_idx;
+	int map_fd, err;
+	__u64 insn_off;
+	__u64 *jt;
+	__u32 i;
+
+	map_fd = find_jt_map(obj, prog, sym_off);
+	if (map_fd >= 0)
+		return map_fd;
+
+	if (sym_off % jt_entry_size) {
+		pr_warn("map '.jumptables': jumptable start %d should be multiple of %u\n",
+			sym_off, jt_entry_size);
+		return -EINVAL;
+	}
+
+	if (jt_size % jt_entry_size) {
+		pr_warn("map '.jumptables': jumptable size %d should be multiple of %u\n",
+			jt_size, jt_entry_size);
+		return -EINVAL;
+	}
+
+	map_fd = bpf_map_create(BPF_MAP_TYPE_INSN_ARRAY, ".jumptables",
+				4, value_size, max_entries, NULL);
+	if (map_fd < 0)
+		return map_fd;
+
+	if (!obj->jumptables_data) {
+		pr_warn("map '.jumptables': ELF file is missing jump table data\n");
+		err = -EINVAL;
+		goto err_close;
+	}
+	if (sym_off + jt_size > obj->jumptables_data_sz) {
+		pr_warn("map '.jumptables': jumptables_data size is %zd, trying to access %d\n",
+			obj->jumptables_data_sz, sym_off + jt_size);
+		err = -EINVAL;
+		goto err_close;
+	}
+
+	subprog_idx = -1; /* main program */
+	if (relo->insn_idx < 0 || relo->insn_idx >= prog->insns_cnt) {
+		pr_warn("map '.jumptables': invalid instruction index %d\n", relo->insn_idx);
+		err = -EINVAL;
+		goto err_close;
+	}
+	if (prog->subprogs)
+		subprog_idx = find_subprog_idx(prog, relo->insn_idx);
+
+	jt = (__u64 *)(obj->jumptables_data + sym_off);
+	for (i = 0; i < max_entries; i++) {
+		/*
+		 * The offset should be made to be relative to the beginning of
+		 * the main function, not the subfunction.
+		 */
+		insn_off = jt[i]/sizeof(struct bpf_insn);
+		if (subprog_idx >= 0) {
+			insn_off -= prog->subprogs[subprog_idx].sec_insn_off;
+			insn_off += prog->subprogs[subprog_idx].sub_insn_off;
+		} else {
+			insn_off -= prog->sec_insn_off;
+		}
+
+		/*
+		 * LLVM-generated jump tables contain u64 records, however
+		 * should contain values that fit in u32.
+		 */
+		if (insn_off > UINT32_MAX) {
+			pr_warn("map '.jumptables': invalid jump table value 0x%llx at offset %d\n",
+				(long long)jt[i], sym_off + i * jt_entry_size);
+			err = -EINVAL;
+			goto err_close;
+		}
+
+		val.orig_off = insn_off;
+		err = bpf_map_update_elem(map_fd, &i, &val, 0);
+		if (err)
+			goto err_close;
+	}
+
+	err = bpf_map_freeze(map_fd);
+	if (err)
+		goto err_close;
+
+	err = add_jt_map(obj, prog, sym_off, map_fd);
+	if (err)
+		goto err_close;
+
+	return map_fd;
+
+err_close:
+	close(map_fd);
+	return err;
+}
+
 /* Relocate data references within program code:
  *  - map references;
  *  - global variable references;
@@ -6235,6 +6434,20 @@ bpf_object__relocate_data(struct bpf_object *obj, struct bpf_program *prog)
 		case RELO_CORE:
 			/* will be handled by bpf_program_record_relos() */
 			break;
+		case RELO_INSN_ARRAY: {
+			int map_fd;
+
+			map_fd = create_jt_map(obj, prog, relo);
+			if (map_fd < 0) {
+				pr_warn("prog '%s': relo #%d: can't create jump table: sym_off %u\n",
+					prog->name, i, relo->sym_off);
+				return map_fd;
+			}
+			insn[0].src_reg = BPF_PSEUDO_MAP_VALUE;
+			insn->imm = map_fd;
+			insn->off = 0;
+		}
+			break;
 		default:
 			pr_warn("prog '%s': relo #%d: bad relo type %d\n",
 				prog->name, i, relo->type);
@@ -6432,6 +6645,24 @@ static int append_subprog_relos(struct bpf_program *main_prog, struct bpf_progra
 	return 0;
 }
 
+static int save_subprog_offsets(struct bpf_program *main_prog, struct bpf_program *subprog)
+{
+	size_t size = sizeof(main_prog->subprogs[0]);
+	int cnt = main_prog->subprog_cnt;
+	void *tmp;
+
+	tmp = libbpf_reallocarray(main_prog->subprogs, cnt + 1, size);
+	if (!tmp)
+		return -ENOMEM;
+
+	main_prog->subprogs = tmp;
+	main_prog->subprogs[cnt].sec_insn_off = subprog->sec_insn_off;
+	main_prog->subprogs[cnt].sub_insn_off = subprog->sub_insn_off;
+	main_prog->subprog_cnt++;
+
+	return 0;
+}
+
 static int
 bpf_object__append_subprog_code(struct bpf_object *obj, struct bpf_program *main_prog,
 				struct bpf_program *subprog)
@@ -6461,6 +6692,14 @@ bpf_object__append_subprog_code(struct bpf_object *obj, struct bpf_program *main
 	err = append_subprog_relos(main_prog, subprog);
 	if (err)
 		return err;
+
+	err = save_subprog_offsets(main_prog, subprog);
+	if (err) {
+		pr_warn("prog '%s': failed to add subprog offsets: %s\n",
+			main_prog->name, errstr(err));
+		return err;
+	}
+
 	return 0;
 }
 
@@ -9228,6 +9467,13 @@ void bpf_object__close(struct bpf_object *obj)
 
 	zfree(&obj->arena_data);
 
+	zfree(&obj->jumptables_data);
+	obj->jumptables_data_sz = 0;
+
+	for (i = 0; i < obj->jumptable_map_cnt; i++)
+		close(obj->jumptable_maps[i].fd);
+	zfree(&obj->jumptable_maps);
+
 	free(obj);
 }
 
diff --git a/tools/lib/bpf/libbpf_internal.h b/tools/lib/bpf/libbpf_internal.h
index 35b2527bedecb..fc59b21b51b5e 100644
--- a/tools/lib/bpf/libbpf_internal.h
+++ b/tools/lib/bpf/libbpf_internal.h
@@ -74,6 +74,8 @@
 #define ELF64_ST_VISIBILITY(o) ((o) & 0x03)
 #endif
 
+#define JUMPTABLES_SEC ".jumptables"
+
 #define BTF_INFO_ENC(kind, kind_flag, vlen) \
 	((!!(kind_flag) << 31) | ((kind) << 24) | ((vlen) & BTF_MAX_VLEN))
 #define BTF_TYPE_ENC(name, info, size_or_type) (name), (info), (size_or_type)
diff --git a/tools/lib/bpf/libbpf_probes.c b/tools/lib/bpf/libbpf_probes.c
index 9dfbe7750f564..bccf4bb747e1d 100644
--- a/tools/lib/bpf/libbpf_probes.c
+++ b/tools/lib/bpf/libbpf_probes.c
@@ -364,6 +364,10 @@ static int probe_map_create(enum bpf_map_type map_type)
 	case BPF_MAP_TYPE_SOCKHASH:
 	case BPF_MAP_TYPE_REUSEPORT_SOCKARRAY:
 		break;
+	case BPF_MAP_TYPE_INSN_ARRAY:
+		key_size	= sizeof(__u32);
+		value_size	= sizeof(struct bpf_insn_array_value);
+		break;
 	case BPF_MAP_TYPE_UNSPEC:
 	default:
 		return -EOPNOTSUPP;
diff --git a/tools/lib/bpf/linker.c b/tools/lib/bpf/linker.c
index 56ae77047bc36..f4403e3cf9946 100644
--- a/tools/lib/bpf/linker.c
+++ b/tools/lib/bpf/linker.c
@@ -2025,6 +2025,9 @@ static int linker_append_elf_sym(struct bpf_linker *linker, struct src_obj *obj,
 			obj->sym_map[src_sym_idx] = dst_sec->sec_sym_idx;
 			return 0;
 		}
+
+		if (strcmp(src_sec->sec_name, JUMPTABLES_SEC) == 0)
+			goto add_sym;
 	}
 
 	if (sym_bind == STB_LOCAL)
diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
index 93dbafa050c97..34ea23c63bd5d 100644
--- a/tools/testing/selftests/bpf/Makefile
+++ b/tools/testing/selftests/bpf/Makefile
@@ -453,7 +453,9 @@ BPF_CFLAGS = -g -Wall -Werror -D__TARGET_ARCH_$(SRCARCH) $(MENDIAN)	\
 	     -I$(abspath $(OUTPUT)/../usr/include)			\
 	     -std=gnu11		 					\
 	     -fno-strict-aliasing 					\
-	     -Wno-compare-distinct-pointer-types
+	     -Wno-compare-distinct-pointer-types			\
+	     -Wno-initializer-overrides					\
+	     #
 # TODO: enable me -Wsign-compare
 
 CLANG_CFLAGS = $(CLANG_SYS_INCLUDES)
diff --git a/tools/testing/selftests/bpf/prog_tests/bpf_gotox.c b/tools/testing/selftests/bpf/prog_tests/bpf_gotox.c
new file mode 100644
index 0000000000000..ea1cd3cda1560
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/bpf_gotox.c
@@ -0,0 +1,292 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include <test_progs.h>
+
+#include <linux/if_ether.h>
+#include <linux/in.h>
+#include <linux/ip.h>
+#include <linux/ipv6.h>
+#include <linux/in6.h>
+#include <linux/udp.h>
+#include <linux/tcp.h>
+
+#include <sys/syscall.h>
+#include <bpf/bpf.h>
+
+#include "bpf_gotox.skel.h"
+
+static void __test_run(struct bpf_program *prog, void *ctx_in, size_t ctx_size_in)
+{
+	LIBBPF_OPTS(bpf_test_run_opts, topts,
+			    .ctx_in = ctx_in,
+			    .ctx_size_in = ctx_size_in,
+		   );
+	int err, prog_fd;
+
+	prog_fd = bpf_program__fd(prog);
+	err = bpf_prog_test_run_opts(prog_fd, &topts);
+	ASSERT_OK(err, "test_run_opts err");
+}
+
+static void __subtest(struct bpf_gotox *skel, void (*check)(struct bpf_gotox *))
+{
+	if (skel->data->skip)
+		test__skip();
+	else
+		check(skel);
+}
+
+static void check_simple(struct bpf_gotox *skel,
+			 struct bpf_program *prog,
+			 __u64 ctx_in,
+			 __u64 expected)
+{
+	skel->bss->ret_user = 0;
+
+	__test_run(prog, &ctx_in, sizeof(ctx_in));
+
+	if (!ASSERT_EQ(skel->bss->ret_user, expected, "skel->bss->ret_user"))
+		return;
+}
+
+static void check_simple_fentry(struct bpf_gotox *skel,
+				struct bpf_program *prog,
+				__u64 ctx_in,
+				__u64 expected)
+{
+	skel->bss->in_user = ctx_in;
+	skel->bss->ret_user = 0;
+
+	/* trigger */
+	usleep(1);
+
+	if (!ASSERT_EQ(skel->bss->ret_user, expected, "skel->bss->ret_user"))
+		return;
+}
+
+/* validate that for two loads of the same jump table libbpf generates only one map */
+static void check_one_map_two_jumps(struct bpf_gotox *skel)
+{
+	struct bpf_prog_info prog_info;
+	struct bpf_map_info map_info;
+	__u32 len;
+	__u32 map_ids[16];
+	int prog_fd, map_fd;
+	int ret;
+	int i;
+	bool seen = false;
+
+	memset(&prog_info, 0, sizeof(prog_info));
+	prog_info.map_ids = (long)map_ids;
+	prog_info.nr_map_ids = ARRAY_SIZE(map_ids);
+	prog_fd = bpf_program__fd(skel->progs.one_map_two_jumps);
+	if (!ASSERT_GE(prog_fd, 0, "bpf_program__fd(one_map_two_jumps)"))
+		return;
+
+	len = sizeof(prog_info);
+	ret = bpf_obj_get_info_by_fd(prog_fd, &prog_info, &len);
+	if (!ASSERT_OK(ret, "bpf_obj_get_info_by_fd(prog_fd)"))
+		return;
+
+	for (i = 0; i < prog_info.nr_map_ids; i++) {
+		map_fd  = bpf_map_get_fd_by_id(map_ids[i]);
+		if (!ASSERT_GE(map_fd, 0, "bpf_program__fd(one_map_two_jumps)"))
+			return;
+
+		len = sizeof(map_info);
+		memset(&map_info, 0, len);
+		ret = bpf_obj_get_info_by_fd(map_fd, &map_info, &len);
+		if (!ASSERT_OK(ret, "bpf_obj_get_info_by_fd(map_fd)")) {
+			close(map_fd);
+			return;
+		}
+
+		if (map_info.type == BPF_MAP_TYPE_INSN_ARRAY) {
+			if (!ASSERT_EQ(seen, false, "more than one INSN_ARRAY map")) {
+				close(map_fd);
+				return;
+			}
+			seen = true;
+		}
+		close(map_fd);
+	}
+
+	ASSERT_EQ(seen, true, "no INSN_ARRAY map");
+}
+
+static void check_one_switch(struct bpf_gotox *skel)
+{
+	__u64 in[]   = {0, 1, 2, 3, 4,  5, 77};
+	__u64 out[]  = {2, 3, 4, 5, 7, 19, 19};
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(in); i++)
+		check_simple(skel, skel->progs.one_switch, in[i], out[i]);
+}
+
+static void check_one_switch_non_zero_sec_off(struct bpf_gotox *skel)
+{
+	__u64 in[]   = {0, 1, 2, 3, 4,  5, 77};
+	__u64 out[]  = {2, 3, 4, 5, 7, 19, 19};
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(in); i++)
+		check_simple(skel, skel->progs.one_switch_non_zero_sec_off, in[i], out[i]);
+}
+
+static void check_two_switches(struct bpf_gotox *skel)
+{
+	__u64 in[]   = {0, 1, 2, 3, 4,  5, 77};
+	__u64 out[] = {103, 104, 107, 205, 115, 1019, 1019};
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(in); i++)
+		check_simple(skel, skel->progs.two_switches, in[i], out[i]);
+}
+
+static void check_big_jump_table(struct bpf_gotox *skel)
+{
+	__u64 in[]  = {0, 11, 27, 31, 22, 45, 99};
+	__u64 out[] = {2,  3,  4,  5, 19, 19, 19};
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(in); i++)
+		check_simple(skel, skel->progs.big_jump_table, in[i], out[i]);
+}
+
+static void check_one_jump_two_maps(struct bpf_gotox *skel)
+{
+	__u64 in[]  = {0, 1, 2, 3, 4,  5, 77};
+	__u64 out[] = {12, 15, 7 , 15, 12, 15, 15};
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(in); i++)
+		check_simple(skel, skel->progs.one_jump_two_maps, in[i], out[i]);
+}
+
+static void check_static_global(struct bpf_gotox *skel)
+{
+	__u64 in[]   = {0, 1, 2, 3, 4,  5, 77};
+	__u64 out[]  = {2, 3, 4, 5, 7, 19, 19};
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(in); i++)
+		check_simple(skel, skel->progs.use_static_global1, in[i], out[i]);
+	for (i = 0; i < ARRAY_SIZE(in); i++)
+		check_simple(skel, skel->progs.use_static_global2, in[i], out[i]);
+}
+
+static void check_nonstatic_global(struct bpf_gotox *skel)
+{
+	__u64 in[]   = {0, 1, 2, 3, 4,  5, 77};
+	__u64 out[]  = {2, 3, 4, 5, 7, 19, 19};
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(in); i++)
+		check_simple(skel, skel->progs.use_nonstatic_global1, in[i], out[i]);
+
+	for (i = 0; i < ARRAY_SIZE(in); i++)
+		check_simple(skel, skel->progs.use_nonstatic_global2, in[i], out[i]);
+}
+
+static void check_other_sec(struct bpf_gotox *skel)
+{
+	struct bpf_link *link;
+	__u64 in[]   = {0, 1, 2, 3, 4,  5, 77};
+	__u64 out[]  = {2, 3, 4, 5, 7, 19, 19};
+	int i;
+
+	link = bpf_program__attach(skel->progs.simple_test_other_sec);
+	if (!ASSERT_OK_PTR(link, "link"))
+		return;
+
+	for (i = 0; i < ARRAY_SIZE(in); i++)
+		check_simple_fentry(skel, skel->progs.simple_test_other_sec, in[i], out[i]);
+
+	bpf_link__destroy(link);
+}
+
+static void check_static_global_other_sec(struct bpf_gotox *skel)
+{
+	struct bpf_link *link;
+	__u64 in[]   = {0, 1, 2, 3, 4,  5, 77};
+	__u64 out[]  = {2, 3, 4, 5, 7, 19, 19};
+	int i;
+
+	link = bpf_program__attach(skel->progs.use_static_global_other_sec);
+	if (!ASSERT_OK_PTR(link, "link"))
+		return;
+
+	for (i = 0; i < ARRAY_SIZE(in); i++)
+		check_simple_fentry(skel, skel->progs.use_static_global_other_sec, in[i], out[i]);
+
+	bpf_link__destroy(link);
+}
+
+static void check_nonstatic_global_other_sec(struct bpf_gotox *skel)
+{
+	struct bpf_link *link;
+	__u64 in[]   = {0, 1, 2, 3, 4,  5, 77};
+	__u64 out[]  = {2, 3, 4, 5, 7, 19, 19};
+	int i;
+
+	link = bpf_program__attach(skel->progs.use_nonstatic_global_other_sec);
+	if (!ASSERT_OK_PTR(link, "link"))
+		return;
+
+	for (i = 0; i < ARRAY_SIZE(in); i++)
+		check_simple_fentry(skel, skel->progs.use_nonstatic_global_other_sec, in[i], out[i]);
+
+	bpf_link__destroy(link);
+}
+
+void test_bpf_gotox(void)
+{
+	struct bpf_gotox *skel;
+	int ret;
+
+	skel = bpf_gotox__open();
+	if (!ASSERT_NEQ(skel, NULL, "bpf_gotox__open"))
+		return;
+
+	ret = bpf_gotox__load(skel);
+	if (!ASSERT_OK(ret, "bpf_gotox__load"))
+		return;
+
+	skel->bss->pid = getpid();
+
+	if (test__start_subtest("one-switch"))
+		__subtest(skel, check_one_switch);
+
+	if (test__start_subtest("one-switch-non-zero-sec-offset"))
+		__subtest(skel, check_one_switch_non_zero_sec_off);
+
+	if (test__start_subtest("two-switches"))
+		__subtest(skel, check_two_switches);
+
+	if (test__start_subtest("big-jump-table"))
+		__subtest(skel, check_big_jump_table);
+
+	if (test__start_subtest("static-global"))
+		__subtest(skel, check_static_global);
+
+	if (test__start_subtest("nonstatic-global"))
+		__subtest(skel, check_nonstatic_global);
+
+	if (test__start_subtest("other-sec"))
+		__subtest(skel, check_other_sec);
+
+	if (test__start_subtest("static-global-other-sec"))
+		__subtest(skel, check_static_global_other_sec);
+
+	if (test__start_subtest("nonstatic-global-other-sec"))
+		__subtest(skel, check_nonstatic_global_other_sec);
+
+	if (test__start_subtest("one-jump-two-maps"))
+		__subtest(skel, check_one_jump_two_maps);
+
+	if (test__start_subtest("one-map-two-jumps"))
+		__subtest(skel, check_one_map_two_jumps);
+
+	bpf_gotox__destroy(skel);
+}
diff --git a/tools/testing/selftests/bpf/prog_tests/bpf_insn_array.c b/tools/testing/selftests/bpf/prog_tests/bpf_insn_array.c
new file mode 100644
index 0000000000000..cf852318eeb29
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/bpf_insn_array.c
@@ -0,0 +1,504 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include <bpf/bpf.h>
+#include <test_progs.h>
+
+#ifdef __x86_64__
+static int map_create(__u32 map_type, __u32 max_entries)
+{
+	const char *map_name = "insn_array";
+	__u32 key_size = 4;
+	__u32 value_size = sizeof(struct bpf_insn_array_value);
+
+	return bpf_map_create(map_type, map_name, key_size, value_size, max_entries, NULL);
+}
+
+static int prog_load(struct bpf_insn *insns, __u32 insn_cnt, int *fd_array, __u32 fd_array_cnt)
+{
+	LIBBPF_OPTS(bpf_prog_load_opts, opts);
+
+	opts.fd_array = fd_array;
+	opts.fd_array_cnt = fd_array_cnt;
+
+	return bpf_prog_load(BPF_PROG_TYPE_XDP, NULL, "GPL", insns, insn_cnt, &opts);
+}
+
+static void __check_success(struct bpf_insn *insns, __u32 insn_cnt, __u32 *map_in, __u32 *map_out)
+{
+	struct bpf_insn_array_value val = {};
+	int prog_fd = -1, map_fd, i;
+
+	map_fd = map_create(BPF_MAP_TYPE_INSN_ARRAY, insn_cnt);
+	if (!ASSERT_GE(map_fd, 0, "map_create"))
+		return;
+
+	for (i = 0; i < insn_cnt; i++) {
+		val.orig_off = map_in[i];
+		if (!ASSERT_EQ(bpf_map_update_elem(map_fd, &i, &val, 0), 0, "bpf_map_update_elem"))
+			goto cleanup;
+	}
+
+	if (!ASSERT_EQ(bpf_map_freeze(map_fd), 0, "bpf_map_freeze"))
+		goto cleanup;
+
+	prog_fd = prog_load(insns, insn_cnt, &map_fd, 1);
+	if (!ASSERT_GE(prog_fd, 0, "bpf(BPF_PROG_LOAD)"))
+		goto cleanup;
+
+	for (i = 0; i < insn_cnt; i++) {
+		char buf[64];
+
+		if (!ASSERT_EQ(bpf_map_lookup_elem(map_fd, &i, &val), 0, "bpf_map_lookup_elem"))
+			goto cleanup;
+
+		snprintf(buf, sizeof(buf), "val.xlated_off should be equal map_out[%d]", i);
+		ASSERT_EQ(val.xlated_off, map_out[i], buf);
+	}
+
+cleanup:
+	close(prog_fd);
+	close(map_fd);
+}
+
+/*
+ * Load a program, which will not be anyhow mangled by the verifier.  Add an
+ * insn_array map pointing to every instruction. Check that it hasn't changed
+ * after the program load.
+ */
+static void check_one_to_one_mapping(void)
+{
+	struct bpf_insn insns[] = {
+		BPF_MOV64_IMM(BPF_REG_0, 4),
+		BPF_MOV64_IMM(BPF_REG_0, 3),
+		BPF_MOV64_IMM(BPF_REG_0, 2),
+		BPF_MOV64_IMM(BPF_REG_0, 1),
+		BPF_MOV64_IMM(BPF_REG_0, 0),
+		BPF_EXIT_INSN(),
+	};
+	__u32 map_in[] = {0, 1, 2, 3, 4, 5};
+	__u32 map_out[] = {0, 1, 2, 3, 4, 5};
+
+	__check_success(insns, ARRAY_SIZE(insns), map_in, map_out);
+}
+
+/*
+ * Load a program with two patches (get jiffies, for simplicity). Add an
+ * insn_array map pointing to every instruction. Check how it was changed
+ * after the program load.
+ */
+static void check_simple(void)
+{
+	struct bpf_insn insns[] = {
+		BPF_MOV64_IMM(BPF_REG_0, 2),
+		BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_jiffies64),
+		BPF_MOV64_IMM(BPF_REG_0, 1),
+		BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_jiffies64),
+		BPF_MOV64_IMM(BPF_REG_0, 0),
+		BPF_EXIT_INSN(),
+	};
+	__u32 map_in[] = {0, 1, 2, 3, 4, 5};
+	__u32 map_out[] = {0, 1, 4, 5, 8, 9};
+
+	__check_success(insns, ARRAY_SIZE(insns), map_in, map_out);
+}
+
+/*
+ * Verifier can delete code in two cases: nops & dead code. From insn
+ * array's point of view, the two cases are the same, so test using
+ * the simplest method: by loading some nops
+ */
+static void check_deletions(void)
+{
+	struct bpf_insn insns[] = {
+		BPF_MOV64_IMM(BPF_REG_0, 2),
+		BPF_JMP_IMM(BPF_JA, 0, 0, 0), /* nop */
+		BPF_MOV64_IMM(BPF_REG_0, 1),
+		BPF_JMP_IMM(BPF_JA, 0, 0, 0), /* nop */
+		BPF_MOV64_IMM(BPF_REG_0, 0),
+		BPF_EXIT_INSN(),
+	};
+	__u32 map_in[] = {0, 1, 2, 3, 4, 5};
+	__u32 map_out[] = {0, -1, 1, -1, 2, 3};
+
+	__check_success(insns, ARRAY_SIZE(insns), map_in, map_out);
+}
+
+/*
+ * Same test as check_deletions, but also add code which adds instructions
+ */
+static void check_deletions_with_functions(void)
+{
+	struct bpf_insn insns[] = {
+		BPF_JMP_IMM(BPF_JA, 0, 0, 0), /* nop */
+		BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_jiffies64),
+		BPF_JMP_IMM(BPF_JA, 0, 0, 0), /* nop */
+		BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
+		BPF_MOV64_IMM(BPF_REG_0, 1),
+		BPF_EXIT_INSN(),
+		BPF_JMP_IMM(BPF_JA, 0, 0, 0), /* nop */
+		BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_jiffies64),
+		BPF_JMP_IMM(BPF_JA, 0, 0, 0), /* nop */
+		BPF_MOV64_IMM(BPF_REG_0, 2),
+		BPF_EXIT_INSN(),
+	};
+	__u32 map_in[] =  { 0, 1,  2, 3, 4, 5, /* func */  6, 7,  8, 9, 10};
+	__u32 map_out[] = {-1, 0, -1, 3, 4, 5, /* func */ -1, 6, -1, 9, 10};
+
+	__check_success(insns, ARRAY_SIZE(insns), map_in, map_out);
+}
+
+/*
+ * Try to load a program with a map which points to outside of the program
+ */
+static void check_out_of_bounds_index(void)
+{
+	struct bpf_insn insns[] = {
+		BPF_MOV64_IMM(BPF_REG_0, 4),
+		BPF_MOV64_IMM(BPF_REG_0, 3),
+		BPF_MOV64_IMM(BPF_REG_0, 2),
+		BPF_MOV64_IMM(BPF_REG_0, 1),
+		BPF_MOV64_IMM(BPF_REG_0, 0),
+		BPF_EXIT_INSN(),
+	};
+	int prog_fd, map_fd;
+	struct bpf_insn_array_value val = {};
+	int key;
+
+	map_fd = map_create(BPF_MAP_TYPE_INSN_ARRAY, 1);
+	if (!ASSERT_GE(map_fd, 0, "map_create"))
+		return;
+
+	key = 0;
+	val.orig_off = ARRAY_SIZE(insns); /* too big */
+	if (!ASSERT_EQ(bpf_map_update_elem(map_fd, &key, &val, 0), 0, "bpf_map_update_elem"))
+		goto cleanup;
+
+	if (!ASSERT_EQ(bpf_map_freeze(map_fd), 0, "bpf_map_freeze"))
+		goto cleanup;
+
+	prog_fd = prog_load(insns, ARRAY_SIZE(insns), &map_fd, 1);
+	if (!ASSERT_EQ(prog_fd, -EINVAL, "program should have been rejected (prog_fd != -EINVAL)")) {
+		close(prog_fd);
+		goto cleanup;
+	}
+
+cleanup:
+	close(map_fd);
+}
+
+/*
+ * Try to load a program with a map which points to the middle of 16-bit insn
+ */
+static void check_mid_insn_index(void)
+{
+	struct bpf_insn insns[] = {
+		BPF_LD_IMM64(BPF_REG_0, 0), /* 2 x 8 */
+		BPF_EXIT_INSN(),
+	};
+	int prog_fd, map_fd;
+	struct bpf_insn_array_value val = {};
+	int key;
+
+	map_fd = map_create(BPF_MAP_TYPE_INSN_ARRAY, 1);
+	if (!ASSERT_GE(map_fd, 0, "map_create"))
+		return;
+
+	key = 0;
+	val.orig_off = 1; /* middle of 16-byte instruction */
+	if (!ASSERT_EQ(bpf_map_update_elem(map_fd, &key, &val, 0), 0, "bpf_map_update_elem"))
+		goto cleanup;
+
+	if (!ASSERT_EQ(bpf_map_freeze(map_fd), 0, "bpf_map_freeze"))
+		goto cleanup;
+
+	prog_fd = prog_load(insns, ARRAY_SIZE(insns), &map_fd, 1);
+	if (!ASSERT_EQ(prog_fd, -EINVAL, "program should have been rejected (prog_fd != -EINVAL)")) {
+		close(prog_fd);
+		goto cleanup;
+	}
+
+cleanup:
+	close(map_fd);
+}
+
+static void check_incorrect_index(void)
+{
+	check_out_of_bounds_index();
+	check_mid_insn_index();
+}
+
+static int set_bpf_jit_harden(char *level)
+{
+	char old_level;
+	int err = -1;
+	int fd = -1;
+
+	fd = open("/proc/sys/net/core/bpf_jit_harden", O_RDWR | O_NONBLOCK);
+	if (fd < 0) {
+		ASSERT_FAIL("open .../bpf_jit_harden returned %d (errno=%d)", fd, errno);
+		return -1;
+	}
+
+	err = read(fd, &old_level, 1);
+	if (err != 1) {
+		ASSERT_FAIL("read from .../bpf_jit_harden returned %d (errno=%d)", err, errno);
+		err = -1;
+		goto end;
+	}
+
+	lseek(fd, 0, SEEK_SET);
+
+	err = write(fd, level, 1);
+	if (err != 1) {
+		ASSERT_FAIL("write to .../bpf_jit_harden returned %d (errno=%d)", err, errno);
+		err = -1;
+		goto end;
+	}
+
+	err = 0;
+	*level = old_level;
+end:
+	if (fd >= 0)
+		close(fd);
+	return err;
+}
+
+static void check_blindness(void)
+{
+	struct bpf_insn insns[] = {
+		BPF_MOV64_IMM(BPF_REG_0, 4),
+		BPF_MOV64_IMM(BPF_REG_0, 3),
+		BPF_MOV64_IMM(BPF_REG_0, 2),
+		BPF_MOV64_IMM(BPF_REG_0, 1),
+		BPF_EXIT_INSN(),
+	};
+	int prog_fd = -1, map_fd;
+	struct bpf_insn_array_value val = {};
+	char bpf_jit_harden = '@'; /* non-exizsting value */
+	int i;
+
+	map_fd = map_create(BPF_MAP_TYPE_INSN_ARRAY, ARRAY_SIZE(insns));
+	if (!ASSERT_GE(map_fd, 0, "map_create"))
+		return;
+
+	for (i = 0; i < ARRAY_SIZE(insns); i++) {
+		val.orig_off = i;
+		if (!ASSERT_EQ(bpf_map_update_elem(map_fd, &i, &val, 0), 0, "bpf_map_update_elem"))
+			goto cleanup;
+	}
+
+	if (!ASSERT_EQ(bpf_map_freeze(map_fd), 0, "bpf_map_freeze"))
+		goto cleanup;
+
+	bpf_jit_harden = '2';
+	if (set_bpf_jit_harden(&bpf_jit_harden)) {
+		bpf_jit_harden = '@'; /* open, read or write failed => no write was done */
+		goto cleanup;
+	}
+
+	prog_fd = prog_load(insns, ARRAY_SIZE(insns), &map_fd, 1);
+	if (!ASSERT_GE(prog_fd, 0, "bpf(BPF_PROG_LOAD)"))
+		goto cleanup;
+
+	for (i = 0; i < ARRAY_SIZE(insns); i++) {
+		char fmt[32];
+
+		if (!ASSERT_EQ(bpf_map_lookup_elem(map_fd, &i, &val), 0, "bpf_map_lookup_elem"))
+			goto cleanup;
+
+		snprintf(fmt, sizeof(fmt), "val should be equal 3*%d", i);
+		ASSERT_EQ(val.xlated_off, i * 3, fmt);
+	}
+
+cleanup:
+	/* restore the old one */
+	if (bpf_jit_harden != '@')
+		set_bpf_jit_harden(&bpf_jit_harden);
+
+	close(prog_fd);
+	close(map_fd);
+}
+
+/* Once map was initialized, it should be frozen */
+static void check_load_unfrozen_map(void)
+{
+	struct bpf_insn insns[] = {
+		BPF_MOV64_IMM(BPF_REG_0, 0),
+		BPF_EXIT_INSN(),
+	};
+	int prog_fd = -1, map_fd;
+	struct bpf_insn_array_value val = {};
+	int i;
+
+	map_fd = map_create(BPF_MAP_TYPE_INSN_ARRAY, ARRAY_SIZE(insns));
+	if (!ASSERT_GE(map_fd, 0, "map_create"))
+		return;
+
+	for (i = 0; i < ARRAY_SIZE(insns); i++) {
+		val.orig_off = i;
+		if (!ASSERT_EQ(bpf_map_update_elem(map_fd, &i, &val, 0), 0, "bpf_map_update_elem"))
+			goto cleanup;
+	}
+
+	prog_fd = prog_load(insns, ARRAY_SIZE(insns), &map_fd, 1);
+	if (!ASSERT_EQ(prog_fd, -EINVAL, "program should have been rejected (prog_fd != -EINVAL)"))
+		goto cleanup;
+
+	/* correctness: now freeze the map, the program should load fine */
+
+	if (!ASSERT_EQ(bpf_map_freeze(map_fd), 0, "bpf_map_freeze"))
+		goto cleanup;
+
+	prog_fd = prog_load(insns, ARRAY_SIZE(insns), &map_fd, 1);
+	if (!ASSERT_GE(prog_fd, 0, "bpf(BPF_PROG_LOAD)"))
+		goto cleanup;
+
+	for (i = 0; i < ARRAY_SIZE(insns); i++) {
+		if (!ASSERT_EQ(bpf_map_lookup_elem(map_fd, &i, &val), 0, "bpf_map_lookup_elem"))
+			goto cleanup;
+
+		ASSERT_EQ(val.xlated_off, i, "val should be equal i");
+	}
+
+cleanup:
+	close(prog_fd);
+	close(map_fd);
+}
+
+/* Map can be used only by one BPF program */
+static void check_no_map_reuse(void)
+{
+	struct bpf_insn insns[] = {
+		BPF_MOV64_IMM(BPF_REG_0, 0),
+		BPF_EXIT_INSN(),
+	};
+	int prog_fd = -1, map_fd, extra_fd = -1;
+	struct bpf_insn_array_value val = {};
+	int i;
+
+	map_fd = map_create(BPF_MAP_TYPE_INSN_ARRAY, ARRAY_SIZE(insns));
+	if (!ASSERT_GE(map_fd, 0, "map_create"))
+		return;
+
+	for (i = 0; i < ARRAY_SIZE(insns); i++) {
+		val.orig_off = i;
+		if (!ASSERT_EQ(bpf_map_update_elem(map_fd, &i, &val, 0), 0, "bpf_map_update_elem"))
+			goto cleanup;
+	}
+
+	if (!ASSERT_EQ(bpf_map_freeze(map_fd), 0, "bpf_map_freeze"))
+		goto cleanup;
+
+	prog_fd = prog_load(insns, ARRAY_SIZE(insns), &map_fd, 1);
+	if (!ASSERT_GE(prog_fd, 0, "bpf(BPF_PROG_LOAD)"))
+		goto cleanup;
+
+	for (i = 0; i < ARRAY_SIZE(insns); i++) {
+		if (!ASSERT_EQ(bpf_map_lookup_elem(map_fd, &i, &val), 0, "bpf_map_lookup_elem"))
+			goto cleanup;
+
+		ASSERT_EQ(val.xlated_off, i, "val should be equal i");
+	}
+
+	extra_fd = prog_load(insns, ARRAY_SIZE(insns), &map_fd, 1);
+	if (!ASSERT_EQ(extra_fd, -EBUSY, "program should have been rejected (extra_fd != -EBUSY)"))
+		goto cleanup;
+
+	/* correctness: check that prog is still loadable without fd_array */
+	extra_fd = prog_load(insns, ARRAY_SIZE(insns), NULL, 0);
+	if (!ASSERT_GE(prog_fd, 0, "bpf(BPF_PROG_LOAD): expected no error"))
+		goto cleanup;
+
+cleanup:
+	close(extra_fd);
+	close(prog_fd);
+	close(map_fd);
+}
+
+static void check_bpf_no_lookup(void)
+{
+	struct bpf_insn insns[] = {
+		BPF_LD_MAP_FD(BPF_REG_1, 0),
+		BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+		BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+		BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+		BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+		BPF_EXIT_INSN(),
+	};
+	int prog_fd = -1, map_fd;
+
+	map_fd = map_create(BPF_MAP_TYPE_INSN_ARRAY, 1);
+	if (!ASSERT_GE(map_fd, 0, "map_create"))
+		return;
+
+	insns[0].imm = map_fd;
+
+	if (!ASSERT_EQ(bpf_map_freeze(map_fd), 0, "bpf_map_freeze"))
+		goto cleanup;
+
+	prog_fd = prog_load(insns, ARRAY_SIZE(insns), NULL, 0);
+	if (!ASSERT_EQ(prog_fd, -EINVAL, "program should have been rejected (prog_fd != -EINVAL)"))
+		goto cleanup;
+
+	/* correctness: check that prog is still loadable with normal map */
+	close(map_fd);
+	map_fd = map_create(BPF_MAP_TYPE_ARRAY, 1);
+	insns[0].imm = map_fd;
+	prog_fd = prog_load(insns, ARRAY_SIZE(insns), NULL, 0);
+	if (!ASSERT_GE(prog_fd, 0, "bpf(BPF_PROG_LOAD)"))
+		goto cleanup;
+
+cleanup:
+	close(prog_fd);
+	close(map_fd);
+}
+
+static void check_bpf_side(void)
+{
+	check_bpf_no_lookup();
+}
+
+static void __test_bpf_insn_array(void)
+{
+	/* Test if offsets are adjusted properly */
+
+	if (test__start_subtest("one2one"))
+		check_one_to_one_mapping();
+
+	if (test__start_subtest("simple"))
+		check_simple();
+
+	if (test__start_subtest("deletions"))
+		check_deletions();
+
+	if (test__start_subtest("deletions-with-functions"))
+		check_deletions_with_functions();
+
+	if (test__start_subtest("blindness"))
+		check_blindness();
+
+	/* Check all kinds of operations and related restrictions */
+
+	if (test__start_subtest("incorrect-index"))
+		check_incorrect_index();
+
+	if (test__start_subtest("load-unfrozen-map"))
+		check_load_unfrozen_map();
+
+	if (test__start_subtest("no-map-reuse"))
+		check_no_map_reuse();
+
+	if (test__start_subtest("bpf-side-ops"))
+		check_bpf_side();
+}
+#else
+static void __test_bpf_insn_array(void)
+{
+	test__skip();
+}
+#endif
+
+void test_bpf_insn_array(void)
+{
+	__test_bpf_insn_array();
+}
diff --git a/tools/testing/selftests/bpf/prog_tests/verifier.c b/tools/testing/selftests/bpf/prog_tests/verifier.c
index c0e8ffdaa4841..4b4b081b46ccc 100644
--- a/tools/testing/selftests/bpf/prog_tests/verifier.c
+++ b/tools/testing/selftests/bpf/prog_tests/verifier.c
@@ -35,6 +35,7 @@
 #include "verifier_global_subprogs.skel.h"
 #include "verifier_global_ptr_args.skel.h"
 #include "verifier_gotol.skel.h"
+#include "verifier_gotox.skel.h"
 #include "verifier_helper_access_var_len.skel.h"
 #include "verifier_helper_packet_access.skel.h"
 #include "verifier_helper_restricted.skel.h"
@@ -173,6 +174,7 @@ void test_verifier_div_overflow(void)         { RUN(verifier_div_overflow); }
 void test_verifier_global_subprogs(void)      { RUN(verifier_global_subprogs); }
 void test_verifier_global_ptr_args(void)      { RUN(verifier_global_ptr_args); }
 void test_verifier_gotol(void)                { RUN(verifier_gotol); }
+void test_verifier_gotox(void)                { RUN(verifier_gotox); }
 void test_verifier_helper_access_var_len(void) { RUN(verifier_helper_access_var_len); }
 void test_verifier_helper_packet_access(void) { RUN(verifier_helper_packet_access); }
 void test_verifier_helper_restricted(void)    { RUN(verifier_helper_restricted); }
diff --git a/tools/testing/selftests/bpf/progs/bpf_gotox.c b/tools/testing/selftests/bpf/progs/bpf_gotox.c
new file mode 100644
index 0000000000000..216c71b94c644
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/bpf_gotox.c
@@ -0,0 +1,448 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include "vmlinux.h"
+#include <bpf/bpf_helpers.h>
+#include <bpf/bpf_tracing.h>
+#include <bpf/bpf_core_read.h>
+#include "bpf_misc.h"
+
+__u64 in_user;
+__u64 ret_user;
+
+int pid;
+
+/*
+ * Skip all the tests if compiler doesn't support indirect jumps.
+ *
+ * If tests are skipped, then all functions below are compiled as
+ * dummy, such that the skeleton looks the same, and the userspace
+ * program can avoid any checks rather than if data->skip is set.
+ */
+#ifdef __BPF_FEATURE_GOTOX
+__u64 skip SEC(".data") = 0;
+#else
+__u64 skip = 1;
+#endif
+
+struct simple_ctx {
+	__u64 x;
+};
+
+#ifdef __BPF_FEATURE_GOTOX
+__u64 some_var;
+
+/*
+ * This function adds code which will be replaced by a different
+ * number of instructions by the verifier. This adds additional
+ * stress on testing the insn_array maps corresponding to indirect jumps.
+ */
+static __always_inline void adjust_insns(__u64 x)
+{
+	some_var ^= x + bpf_jiffies64();
+}
+
+SEC("syscall")
+int one_switch(struct simple_ctx *ctx)
+{
+	switch (ctx->x) {
+	case 0:
+		adjust_insns(ctx->x + 1);
+		ret_user = 2;
+		break;
+	case 1:
+		adjust_insns(ctx->x + 7);
+		ret_user = 3;
+		break;
+	case 2:
+		adjust_insns(ctx->x + 9);
+		ret_user = 4;
+		break;
+	case 3:
+		adjust_insns(ctx->x + 11);
+		ret_user = 5;
+		break;
+	case 4:
+		adjust_insns(ctx->x + 17);
+		ret_user = 7;
+		break;
+	default:
+		adjust_insns(ctx->x + 177);
+		ret_user = 19;
+		break;
+	}
+
+	return 0;
+}
+
+SEC("syscall")
+int one_switch_non_zero_sec_off(struct simple_ctx *ctx)
+{
+	switch (ctx->x) {
+	case 0:
+		adjust_insns(ctx->x + 1);
+		ret_user = 2;
+		break;
+	case 1:
+		adjust_insns(ctx->x + 7);
+		ret_user = 3;
+		break;
+	case 2:
+		adjust_insns(ctx->x + 9);
+		ret_user = 4;
+		break;
+	case 3:
+		adjust_insns(ctx->x + 11);
+		ret_user = 5;
+		break;
+	case 4:
+		adjust_insns(ctx->x + 17);
+		ret_user = 7;
+		break;
+	default:
+		adjust_insns(ctx->x + 177);
+		ret_user = 19;
+		break;
+	}
+
+	return 0;
+}
+
+SEC("fentry/" SYS_PREFIX "sys_nanosleep")
+int simple_test_other_sec(struct pt_regs *ctx)
+{
+	__u64 x = in_user;
+
+	if (bpf_get_current_pid_tgid() >> 32 != pid)
+		return 0;
+
+	switch (x) {
+	case 0:
+		adjust_insns(x + 1);
+		ret_user = 2;
+		break;
+	case 1:
+		adjust_insns(x + 7);
+		ret_user = 3;
+		break;
+	case 2:
+		adjust_insns(x + 9);
+		ret_user = 4;
+		break;
+	case 3:
+		adjust_insns(x + 11);
+		ret_user = 5;
+		break;
+	case 4:
+		adjust_insns(x + 17);
+		ret_user = 7;
+		break;
+	default:
+		adjust_insns(x + 177);
+		ret_user = 19;
+		break;
+	}
+
+	return 0;
+}
+
+SEC("syscall")
+int two_switches(struct simple_ctx *ctx)
+{
+	switch (ctx->x) {
+	case 0:
+		adjust_insns(ctx->x + 1);
+		ret_user = 2;
+		break;
+	case 1:
+		adjust_insns(ctx->x + 7);
+		ret_user = 3;
+		break;
+	case 2:
+		adjust_insns(ctx->x + 9);
+		ret_user = 4;
+		break;
+	case 3:
+		adjust_insns(ctx->x + 11);
+		ret_user = 5;
+		break;
+	case 4:
+		adjust_insns(ctx->x + 17);
+		ret_user = 7;
+		break;
+	default:
+		adjust_insns(ctx->x + 177);
+		ret_user = 19;
+		break;
+	}
+
+	switch (ctx->x + !!ret_user) {
+	case 1:
+		adjust_insns(ctx->x + 7);
+		ret_user = 103;
+		break;
+	case 2:
+		adjust_insns(ctx->x + 9);
+		ret_user = 104;
+		break;
+	case 3:
+		adjust_insns(ctx->x + 11);
+		ret_user = 107;
+		break;
+	case 4:
+		adjust_insns(ctx->x + 11);
+		ret_user = 205;
+		break;
+	case 5:
+		adjust_insns(ctx->x + 11);
+		ret_user = 115;
+		break;
+	default:
+		adjust_insns(ctx->x + 177);
+		ret_user = 1019;
+		break;
+	}
+
+	return 0;
+}
+
+SEC("syscall")
+int big_jump_table(struct simple_ctx *ctx __attribute__((unused)))
+{
+	const void *const jt[256] = {
+		[0 ... 255] = &&default_label,
+		[0] = &&l0,
+		[11] = &&l11,
+		[27] = &&l27,
+		[31] = &&l31,
+	};
+
+	goto *jt[ctx->x & 0xff];
+
+l0:
+	adjust_insns(ctx->x + 1);
+	ret_user = 2;
+	return 0;
+
+l11:
+	adjust_insns(ctx->x + 7);
+	ret_user = 3;
+	return 0;
+
+l27:
+	adjust_insns(ctx->x + 9);
+	ret_user = 4;
+	return 0;
+
+l31:
+	adjust_insns(ctx->x + 11);
+	ret_user = 5;
+	return 0;
+
+default_label:
+	adjust_insns(ctx->x + 177);
+	ret_user = 19;
+	return 0;
+}
+
+SEC("syscall")
+int one_jump_two_maps(struct simple_ctx *ctx __attribute__((unused)))
+{
+	__label__ l1, l2, l3, l4;
+	void *jt1[2] = { &&l1, &&l2 };
+	void *jt2[2] = { &&l3, &&l4 };
+	unsigned int a = ctx->x % 2;
+	unsigned int b = (ctx->x / 2) % 2;
+	volatile int ret = 0;
+
+	if (!(a < 2 && b < 2))
+		return 19;
+
+	if (ctx->x % 2)
+		goto *jt1[a];
+	else
+		goto *jt2[b];
+
+	l1: ret += 1;
+	l2: ret += 3;
+	l3: ret += 5;
+	l4: ret += 7;
+
+	ret_user = ret;
+	return ret;
+}
+
+SEC("syscall")
+int one_map_two_jumps(struct simple_ctx *ctx __attribute__((unused)))
+{
+	__label__ l1, l2, l3;
+	void *jt[3] = { &&l1, &&l2, &&l3 };
+	unsigned int a = (ctx->x >> 2) & 1;
+	unsigned int b = (ctx->x >> 3) & 1;
+	volatile int ret = 0;
+
+	if (ctx->x % 2)
+		goto *jt[a];
+
+	if (ctx->x % 3)
+		goto *jt[a + b];
+
+	l1: ret += 3;
+	l2: ret += 5;
+	l3: ret += 7;
+
+	ret_user = ret;
+	return ret;
+}
+
+/* Just to introduce some non-zero offsets in .text */
+static __noinline int f0(volatile struct simple_ctx *ctx __arg_ctx)
+{
+	if (ctx)
+		return 1;
+	else
+		return 13;
+}
+
+SEC("syscall") int f1(struct simple_ctx *ctx)
+{
+	ret_user = 0;
+	return f0(ctx);
+}
+
+static __noinline int __static_global(__u64 x)
+{
+	switch (x) {
+	case 0:
+		adjust_insns(x + 1);
+		ret_user = 2;
+		break;
+	case 1:
+		adjust_insns(x + 7);
+		ret_user = 3;
+		break;
+	case 2:
+		adjust_insns(x + 9);
+		ret_user = 4;
+		break;
+	case 3:
+		adjust_insns(x + 11);
+		ret_user = 5;
+		break;
+	case 4:
+		adjust_insns(x + 17);
+		ret_user = 7;
+		break;
+	default:
+		adjust_insns(x + 177);
+		ret_user = 19;
+		break;
+	}
+
+	return 0;
+}
+
+SEC("syscall")
+int use_static_global1(struct simple_ctx *ctx)
+{
+	ret_user = 0;
+	return __static_global(ctx->x);
+}
+
+SEC("syscall")
+int use_static_global2(struct simple_ctx *ctx)
+{
+	ret_user = 0;
+	adjust_insns(ctx->x + 1);
+	return __static_global(ctx->x);
+}
+
+SEC("fentry/" SYS_PREFIX "sys_nanosleep")
+int use_static_global_other_sec(void *ctx)
+{
+	if (bpf_get_current_pid_tgid() >> 32 != pid)
+		return 0;
+
+	return __static_global(in_user);
+}
+
+__noinline int __nonstatic_global(__u64 x)
+{
+	switch (x) {
+	case 0:
+		adjust_insns(x + 1);
+		ret_user = 2;
+		break;
+	case 1:
+		adjust_insns(x + 7);
+		ret_user = 3;
+		break;
+	case 2:
+		adjust_insns(x + 9);
+		ret_user = 4;
+		break;
+	case 3:
+		adjust_insns(x + 11);
+		ret_user = 5;
+		break;
+	case 4:
+		adjust_insns(x + 17);
+		ret_user = 7;
+		break;
+	default:
+		adjust_insns(x + 177);
+		ret_user = 19;
+		break;
+	}
+
+	return 0;
+}
+
+SEC("syscall")
+int use_nonstatic_global1(struct simple_ctx *ctx)
+{
+	ret_user = 0;
+	return __nonstatic_global(ctx->x);
+}
+
+SEC("syscall")
+int use_nonstatic_global2(struct simple_ctx *ctx)
+{
+	ret_user = 0;
+	adjust_insns(ctx->x + 1);
+	return __nonstatic_global(ctx->x);
+}
+
+SEC("fentry/" SYS_PREFIX "sys_nanosleep")
+int use_nonstatic_global_other_sec(void *ctx)
+{
+	if (bpf_get_current_pid_tgid() >> 32 != pid)
+		return 0;
+
+	return __nonstatic_global(in_user);
+}
+
+#else /* __BPF_FEATURE_GOTOX */
+
+#define SKIP_TEST(TEST_NAME)				\
+	SEC("syscall") int TEST_NAME(void *ctx)		\
+	{						\
+		return 0;				\
+	}
+
+SKIP_TEST(one_switch);
+SKIP_TEST(one_switch_non_zero_sec_off);
+SKIP_TEST(simple_test_other_sec);
+SKIP_TEST(two_switches);
+SKIP_TEST(big_jump_table);
+SKIP_TEST(one_jump_two_maps);
+SKIP_TEST(one_map_two_jumps);
+SKIP_TEST(use_static_global1);
+SKIP_TEST(use_static_global2);
+SKIP_TEST(use_static_global_other_sec);
+SKIP_TEST(use_nonstatic_global1);
+SKIP_TEST(use_nonstatic_global2);
+SKIP_TEST(use_nonstatic_global_other_sec);
+
+#endif /* __BPF_FEATURE_GOTOX */
+
+char _license[] SEC("license") = "GPL";
diff --git a/tools/testing/selftests/bpf/progs/verifier_gotox.c b/tools/testing/selftests/bpf/progs/verifier_gotox.c
new file mode 100644
index 0000000000000..b6710f134a1d3
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/verifier_gotox.c
@@ -0,0 +1,389 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2025 Isovalent */
+
+#include <linux/bpf.h>
+#include <bpf/bpf_helpers.h>
+#include "bpf_misc.h"
+#include "../../../include/linux/filter.h"
+
+#ifdef __TARGET_ARCH_x86
+
+#define DEFINE_SIMPLE_JUMP_TABLE_PROG(NAME, SRC_REG, OFF, IMM, OUTCOME)	\
+									\
+	SEC("socket")							\
+	OUTCOME								\
+	__naked void jump_table_ ## NAME(void)				\
+	{								\
+		asm volatile ("						\
+		.pushsection .jumptables,\"\",@progbits;		\
+	jt0_%=:								\
+		.quad ret0_%= - socket;					\
+		.quad ret1_%= - socket;					\
+		.size jt0_%=, 16;					\
+		.global jt0_%=;						\
+		.popsection;						\
+									\
+		r0 = jt0_%= ll;						\
+		r0 += 8;						\
+		r0 = *(u64 *)(r0 + 0);					\
+		.8byte %[gotox_r0];					\
+		ret0_%=:						\
+		r0 = 0;							\
+		exit;							\
+		ret1_%=:						\
+		r0 = 1;							\
+		exit;							\
+	"	:							\
+		: __imm_insn(gotox_r0, BPF_RAW_INSN(BPF_JMP | BPF_JA | BPF_X, BPF_REG_0, (SRC_REG), (OFF) , (IMM))) \
+		: __clobber_all);					\
+	}
+
+/*
+ * The first program which doesn't use reserved fields
+ * loads and works properly. The rest fail to load.
+ */
+DEFINE_SIMPLE_JUMP_TABLE_PROG(ok,                          BPF_REG_0, 0, 0, __success __retval(1))
+DEFINE_SIMPLE_JUMP_TABLE_PROG(reserved_field_src_reg,      BPF_REG_1, 0, 0, __failure __msg("BPF_JA|BPF_X uses reserved fields"))
+DEFINE_SIMPLE_JUMP_TABLE_PROG(reserved_field_non_zero_off, BPF_REG_0, 1, 0, __failure __msg("BPF_JA|BPF_X uses reserved fields"))
+DEFINE_SIMPLE_JUMP_TABLE_PROG(reserved_field_non_zero_imm, BPF_REG_0, 0, 1, __failure __msg("BPF_JA|BPF_X uses reserved fields"))
+
+/*
+ * Gotox is forbidden when there is no jump table loaded
+ * which points to the sub-function where the gotox is used
+ */
+SEC("socket")
+__failure __msg("no jump tables found for subprog starting at 0")
+__naked void jump_table_no_jump_table(void)
+{
+	asm volatile ("						\
+	.8byte %[gotox_r0];					\
+	r0 = 1;							\
+	exit;							\
+"	:							\
+	: __imm_insn(gotox_r0, BPF_RAW_INSN(BPF_JMP | BPF_JA | BPF_X, BPF_REG_0, 0, 0 , 0))
+	: __clobber_all);
+}
+
+/*
+ * Incorrect type of the target register, only PTR_TO_INSN allowed
+ */
+SEC("socket")
+__failure __msg("R1 has type scalar, expected PTR_TO_INSN")
+__naked void jump_table_incorrect_dst_reg_type(void)
+{
+	asm volatile ("						\
+	.pushsection .jumptables,\"\",@progbits;		\
+jt0_%=:								\
+	.quad ret0_%= - socket;					\
+	.quad ret1_%= - socket;					\
+	.size jt0_%=, 16;					\
+	.global jt0_%=;						\
+	.popsection;						\
+								\
+	r0 = jt0_%= ll;						\
+	r0 += 8;						\
+	r0 = *(u64 *)(r0 + 0);					\
+	r1 = 42;						\
+	.8byte %[gotox_r1];					\
+	ret0_%=:						\
+	r0 = 0;							\
+	exit;							\
+	ret1_%=:						\
+	r0 = 1;							\
+	exit;							\
+"	:							\
+	: __imm_insn(gotox_r1, BPF_RAW_INSN(BPF_JMP | BPF_JA | BPF_X, BPF_REG_1, 0, 0 , 0))
+	: __clobber_all);
+}
+
+#define DEFINE_INVALID_SIZE_PROG(READ_SIZE, OUTCOME)			\
+									\
+	SEC("socket")							\
+	OUTCOME								\
+	__naked void jump_table_invalid_read_size_ ## READ_SIZE(void)	\
+	{								\
+		asm volatile ("						\
+		.pushsection .jumptables,\"\",@progbits;		\
+	jt0_%=:								\
+		.quad ret0_%= - socket;					\
+		.quad ret1_%= - socket;					\
+		.size jt0_%=, 16;					\
+		.global jt0_%=;						\
+		.popsection;						\
+									\
+		r0 = jt0_%= ll;						\
+		r0 += 8;						\
+		r0 = *(" #READ_SIZE " *)(r0 + 0);			\
+		.8byte %[gotox_r0];					\
+		ret0_%=:						\
+		r0 = 0;							\
+		exit;							\
+		ret1_%=:						\
+		r0 = 1;							\
+		exit;							\
+	"	:							\
+		: __imm_insn(gotox_r0, BPF_RAW_INSN(BPF_JMP | BPF_JA | BPF_X, BPF_REG_0, 0, 0 , 0)) \
+		: __clobber_all);					\
+	}
+
+DEFINE_INVALID_SIZE_PROG(u32, __failure __msg("Invalid read of 4 bytes from insn_array"))
+DEFINE_INVALID_SIZE_PROG(u16, __failure __msg("Invalid read of 2 bytes from insn_array"))
+DEFINE_INVALID_SIZE_PROG(u8,  __failure __msg("Invalid read of 1 bytes from insn_array"))
+
+SEC("socket")
+__failure __msg("misaligned value access off 0+1+0 size 8")
+__naked void jump_table_misaligned_access(void)
+{
+	asm volatile ("						\
+	.pushsection .jumptables,\"\",@progbits;		\
+jt0_%=:								\
+	.quad ret0_%= - socket;					\
+	.quad ret1_%= - socket;					\
+	.size jt0_%=, 16;					\
+	.global jt0_%=;						\
+	.popsection;						\
+								\
+	r0 = jt0_%= ll;						\
+	r0 += 1;						\
+	r0 = *(u64 *)(r0 + 0);					\
+	.8byte %[gotox_r0];					\
+	ret0_%=:						\
+	r0 = 0;							\
+	exit;							\
+	ret1_%=:						\
+	r0 = 1;							\
+	exit;							\
+"	:							\
+	: __imm_insn(gotox_r0, BPF_RAW_INSN(BPF_JMP | BPF_JA | BPF_X, BPF_REG_0, 0, 0 , 0))
+	: __clobber_all);
+}
+
+SEC("socket")
+__failure __msg("invalid access to map value, value_size=16 off=24 size=8")
+__naked void jump_table_invalid_mem_acceess_pos(void)
+{
+	asm volatile ("						\
+	.pushsection .jumptables,\"\",@progbits;		\
+jt0_%=:								\
+	.quad ret0_%= - socket;					\
+	.quad ret1_%= - socket;					\
+	.size jt0_%=, 16;					\
+	.global jt0_%=;						\
+	.popsection;						\
+								\
+	r0 = jt0_%= ll;						\
+	r0 += 24;						\
+	r0 = *(u64 *)(r0 + 0);					\
+	.8byte %[gotox_r0];					\
+	ret0_%=:						\
+	r0 = 0;							\
+	exit;							\
+	ret1_%=:						\
+	r0 = 1;							\
+	exit;							\
+"	:							\
+	: __imm_insn(gotox_r0, BPF_RAW_INSN(BPF_JMP | BPF_JA | BPF_X, BPF_REG_0, 0, 0 , 0))
+	: __clobber_all);
+}
+
+SEC("socket")
+__failure __msg("invalid access to map value, value_size=16 off=-24 size=8")
+__naked void jump_table_invalid_mem_acceess_neg(void)
+{
+	asm volatile ("						\
+	.pushsection .jumptables,\"\",@progbits;		\
+jt0_%=:								\
+	.quad ret0_%= - socket;					\
+	.quad ret1_%= - socket;					\
+	.size jt0_%=, 16;					\
+	.global jt0_%=;						\
+	.popsection;						\
+								\
+	r0 = jt0_%= ll;						\
+	r0 -= 24;						\
+	r0 = *(u64 *)(r0 + 0);					\
+	.8byte %[gotox_r0];					\
+	ret0_%=:						\
+	r0 = 0;							\
+	exit;							\
+	ret1_%=:						\
+	r0 = 1;							\
+	exit;							\
+"	:							\
+	: __imm_insn(gotox_r0, BPF_RAW_INSN(BPF_JMP | BPF_JA | BPF_X, BPF_REG_0, 0, 0 , 0))
+	: __clobber_all);
+}
+
+SEC("socket")
+__success __retval(1)
+__naked void jump_table_add_sub_ok(void)
+{
+	asm volatile ("						\
+	.pushsection .jumptables,\"\",@progbits;		\
+jt0_%=:								\
+	.quad ret0_%= - socket;					\
+	.quad ret1_%= - socket;					\
+	.size jt0_%=, 16;					\
+	.global jt0_%=;						\
+	.popsection;						\
+								\
+	r0 = jt0_%= ll;						\
+	r0 -= 24;						\
+	r0 += 32;						\
+	r0 = *(u64 *)(r0 + 0);					\
+	.8byte %[gotox_r0];					\
+	ret0_%=:						\
+	r0 = 0;							\
+	exit;							\
+	ret1_%=:						\
+	r0 = 1;							\
+	exit;							\
+"	:							\
+	: __imm_insn(gotox_r0, BPF_RAW_INSN(BPF_JMP | BPF_JA | BPF_X, BPF_REG_0, 0, 0 , 0))
+	: __clobber_all);
+}
+
+SEC("socket")
+__failure __msg("writes into insn_array not allowed")
+__naked void jump_table_no_writes(void)
+{
+	asm volatile ("						\
+	.pushsection .jumptables,\"\",@progbits;		\
+jt0_%=:								\
+	.quad ret0_%= - socket;					\
+	.quad ret1_%= - socket;					\
+	.size jt0_%=, 16;					\
+	.global jt0_%=;						\
+	.popsection;						\
+								\
+	r0 = jt0_%= ll;						\
+	r0 += 8;						\
+	r1 = 0xbeef;						\
+	*(u64 *)(r0 + 0) = r1;					\
+	.8byte %[gotox_r0];					\
+	ret0_%=:						\
+	r0 = 0;							\
+	exit;							\
+	ret1_%=:						\
+	r0 = 1;							\
+	exit;							\
+"	:							\
+	: __imm_insn(gotox_r0, BPF_RAW_INSN(BPF_JMP | BPF_JA | BPF_X, BPF_REG_0, 0, 0 , 0))
+	: __clobber_all);
+}
+
+#define DEFINE_JUMP_TABLE_USE_REG(REG)					\
+	SEC("socket")							\
+	__success __retval(1)						\
+	__naked void jump_table_use_reg_r ## REG(void)			\
+	{								\
+		asm volatile ("						\
+		.pushsection .jumptables,\"\",@progbits;		\
+	jt0_%=:								\
+		.quad ret0_%= - socket;					\
+		.quad ret1_%= - socket;					\
+		.size jt0_%=, 16;					\
+		.global jt0_%=;						\
+		.popsection;						\
+									\
+		r0 = jt0_%= ll;						\
+		r0 += 8;						\
+		r" #REG " = *(u64 *)(r0 + 0);				\
+		.8byte %[gotox_rX];					\
+		ret0_%=:						\
+		r0 = 0;							\
+		exit;							\
+		ret1_%=:						\
+		r0 = 1;							\
+		exit;							\
+	"	:							\
+		: __imm_insn(gotox_rX, BPF_RAW_INSN(BPF_JMP | BPF_JA | BPF_X, BPF_REG_ ## REG, 0, 0 , 0)) \
+		: __clobber_all);					\
+	}
+
+DEFINE_JUMP_TABLE_USE_REG(0)
+DEFINE_JUMP_TABLE_USE_REG(1)
+DEFINE_JUMP_TABLE_USE_REG(2)
+DEFINE_JUMP_TABLE_USE_REG(3)
+DEFINE_JUMP_TABLE_USE_REG(4)
+DEFINE_JUMP_TABLE_USE_REG(5)
+DEFINE_JUMP_TABLE_USE_REG(6)
+DEFINE_JUMP_TABLE_USE_REG(7)
+DEFINE_JUMP_TABLE_USE_REG(8)
+DEFINE_JUMP_TABLE_USE_REG(9)
+
+__used static int test_subprog(void)
+{
+	return 0;
+}
+
+SEC("socket")
+__failure __msg("jump table for insn 4 points outside of the subprog [0,10]")
+__naked void jump_table_outside_subprog(void)
+{
+	asm volatile ("						\
+	.pushsection .jumptables,\"\",@progbits;		\
+jt0_%=:								\
+	.quad ret0_%= - socket;					\
+	.quad ret1_%= - socket;					\
+	.quad ret_out_%= - socket;				\
+	.size jt0_%=, 24;					\
+	.global jt0_%=;						\
+	.popsection;						\
+								\
+	r0 = jt0_%= ll;						\
+	r0 += 8;						\
+	r0 = *(u64 *)(r0 + 0);					\
+	.8byte %[gotox_r0];					\
+	ret0_%=:						\
+	r0 = 0;							\
+	exit;							\
+	ret1_%=:						\
+	r0 = 1;							\
+	call test_subprog;					\
+	exit;							\
+	ret_out_%=:						\
+"	:							\
+	: __imm_insn(gotox_r0, BPF_RAW_INSN(BPF_JMP | BPF_JA | BPF_X, BPF_REG_0, 0, 0 , 0))
+	: __clobber_all);
+}
+
+SEC("socket")
+__success __retval(1)
+__naked void jump_table_contains_non_unique_values(void)
+{
+	asm volatile ("						\
+	.pushsection .jumptables,\"\",@progbits;		\
+jt0_%=:								\
+	.quad ret0_%= - socket;					\
+	.quad ret1_%= - socket;					\
+	.quad ret0_%= - socket;					\
+	.quad ret1_%= - socket;					\
+	.quad ret0_%= - socket;					\
+	.quad ret1_%= - socket;					\
+	.quad ret0_%= - socket;					\
+	.quad ret1_%= - socket;					\
+	.quad ret0_%= - socket;					\
+	.quad ret1_%= - socket;					\
+	.size jt0_%=, 80;					\
+	.global jt0_%=;						\
+	.popsection;						\
+								\
+	r0 = jt0_%= ll;						\
+	r0 += 8;						\
+	r0 = *(u64 *)(r0 + 0);					\
+	.8byte %[gotox_r0];					\
+	ret0_%=:						\
+	r0 = 0;							\
+	exit;							\
+	ret1_%=:						\
+	r0 = 1;							\
+	exit;							\
+"	:							\
+	: __imm_insn(gotox_r0, BPF_RAW_INSN(BPF_JMP | BPF_JA | BPF_X, BPF_REG_0, 0, 0 , 0))
+	: __clobber_all);
+}
+
+#endif /* __TARGET_ARCH_x86 */
+
+char _license[] SEC("license") = "GPL";