diff --git a/.github/actions/veristat_baseline_compare/action.yml b/.github/actions/veristat_baseline_compare/action.yml
new file mode 100644
index 0000000000000..f6dd81d19e4b3
--- /dev/null
+++ b/.github/actions/veristat_baseline_compare/action.yml
@@ -0,0 +1,49 @@
+name: 'run-veristat'
+description: 'Run veristat benchmark'
+inputs:
+  veristat_output:
+    description: 'Veristat output filepath'
+    required: true
+  baseline_name:
+    description: 'Veristat baseline cache name'
+    required: true
+runs:
+  using: "composite"
+  steps:
+    - uses: actions/upload-artifact@v4
+      with:
+        name: ${{ inputs.baseline_name }}
+        if-no-files-found: error
+        path: ${{ github.workspace }}/${{ inputs.veristat_output }}
+
+    # For pull request:
+    # - get baseline log from cache
+    # - compare it to current run
+    - if: ${{ github.event_name == 'pull_request' }}
+      uses: actions/cache/restore@v4
+      with:
+        key: ${{ github.base_ref }}-${{ inputs.baseline_name }}-
+        restore-keys: |
+          ${{ github.base_ref }}-${{ inputs.baseline_name }}
+        path: '${{ github.workspace }}/${{ inputs.baseline_name }}'
+
+    - if: ${{ github.event_name == 'pull_request' }}
+      name: Show veristat comparison
+      shell: bash
+      run: ./.github/scripts/compare-veristat-results.sh
+      env:
+        BASELINE_PATH: ${{ github.workspace }}/${{ inputs.baseline_name }}
+        VERISTAT_OUTPUT: ${{ inputs.veristat_output }}
+
+    # For push: just put baseline log to cache
+    - if: ${{ github.event_name == 'push' }}
+      shell: bash
+      run: |
+        mv "${{ github.workspace }}/${{ inputs.veristat_output }}" \
+           "${{ github.workspace }}/${{ inputs.baseline_name }}"
+
+    - if: ${{ github.event_name == 'push' }}
+      uses: actions/cache/save@v4
+      with:
+        key: ${{ github.ref_name }}-${{ inputs.baseline_name }}-${{ github.run_id }}
+        path: '${{ github.workspace }}/${{ inputs.baseline_name }}'
diff --git a/.github/scripts/collect-scx-bpf-progs.sh b/.github/scripts/collect-scx-bpf-progs.sh
new file mode 100755
index 0000000000000..60a86c84e6387
--- /dev/null
+++ b/.github/scripts/collect-scx-bpf-progs.sh
@@ -0,0 +1,13 @@
+#!/bin/bash
+
+set -euo pipefail
+
+PROGS_DIR=$1
+
+mkdir -p "${PROGS_DIR}"
+
+find "${SCX_BUILD_OUTPUT}" -type f -name "*.bpf.o" -printf '%P\0' | \
+while IFS= read -r -d '' prog; do
+    obj_name=$(echo "${prog}" | tr / _)
+    cp -v "${SCX_BUILD_OUTPUT}/$prog" "${PROGS_DIR}/${obj_name}"
+done
diff --git a/.github/scripts/compare-veristat-results.sh b/.github/scripts/compare-veristat-results.sh
new file mode 100755
index 0000000000000..5bc761a9f8792
--- /dev/null
+++ b/.github/scripts/compare-veristat-results.sh
@@ -0,0 +1,42 @@
+#!/bin/bash
+
+if [[ ! -f "${BASELINE_PATH}" ]]; then
+    echo "# No ${BASELINE_PATH} available" >> "${GITHUB_STEP_SUMMARY}"
+
+    echo "No ${BASELINE_PATH} available"
+    echo "Printing veristat results"
+    cat "${VERISTAT_OUTPUT}"
+
+    exit 0
+fi
+
+veristat=$(realpath selftests/bpf/veristat)
+cmp_out=$(mktemp veristate_compare_out_XXXXXX.csv)
+
+$veristat \
+    --output-format csv \
+    --emit file,prog,verdict,states \
+    --compare "${BASELINE_PATH}" "${VERISTAT_OUTPUT}" > $cmp_out
+
+python3 ./.github/scripts/veristat_compare.py $cmp_out
+exit_code=$?
+
+echo
+# if comparison failed, print verifier log for failure mismatches
+if [[ -n "$VERISTAT_DUMP_LOG_ON_FAILURE" && $exit_code -ne 0 ]]; then
+    cat $cmp_out | tail -n +1 | \
+    while read -r line; do
+        verdict=$(echo $line | cut -d',' -f4)
+        verdict_diff=$(echo $line | cut -d',' -f5)
+        if [[ "$verdict" == "failure" && "$verdict_diff" == "MISMATCH" ]]; then
+            file=$(echo $line | cut -d',' -f1)
+            prog=$(echo $line | cut -d',' -f2)
+            echo "VERIFIER LOG FOR $file/$prog:"
+            echo "=================================================================="
+            $veristat -v $VERISTAT_OBJECTS_DIR/$file -f $prog 2>&1
+            echo "=================================================================="
+        fi
+    done
+fi
+
+exit $exit_code
diff --git a/.github/scripts/download-gcc-bpf.sh b/.github/scripts/download-gcc-bpf.sh
new file mode 100755
index 0000000000000..894584a01b2ec
--- /dev/null
+++ b/.github/scripts/download-gcc-bpf.sh
@@ -0,0 +1,30 @@
+#!/bin/bash
+
+set -euo pipefail
+
+GCC_BPF_RELEASE_GH_REPO=$1
+INSTALL_DIR=$(realpath $2)
+
+cd /tmp
+
+tag=$(gh release list -L 1 -R ${GCC_BPF_RELEASE_GH_REPO} --json tagName -q .[].tagName)
+if [[ -z "$tag" ]]; then
+    echo "Could not find latest GCC BPF release at ${GCC_BPF_RELEASE_GH_REPO}"
+    exit 1
+fi
+
+url="https://github.com/${GCC_BPF_RELEASE_GH_REPO}/releases/download/${tag}/${tag}.tar.zst"
+echo "Downloading $url"
+wget -q "$url"
+
+tarball=${tag}.tar.zst
+dir=$(tar tf $tarball | head -1 || true)
+
+echo "Extracting $tarball ..."
+tar -I zstd -xf $tarball && rm -f $tarball
+
+rm -rf $INSTALL_DIR
+mv -v $dir $INSTALL_DIR
+
+cd -
+
diff --git a/.github/scripts/matrix.py b/.github/scripts/matrix.py
new file mode 100644
index 0000000000000..2c9e8aff3feee
--- /dev/null
+++ b/.github/scripts/matrix.py
@@ -0,0 +1,275 @@
+#!/usr/bin/env python3
+
+import dataclasses
+import json
+import os
+
+from enum import Enum
+from typing import Any, Dict, Final, List, Optional, Set, Union
+
+import requests
+import requests.utils
+
+MANAGED_OWNER: Final[str] = "kernel-patches"
+MANAGED_REPOS: Final[Set[str]] = {
+    f"{MANAGED_OWNER}/bpf",
+    f"{MANAGED_OWNER}/vmtest",
+}
+
+DEFAULT_SELF_HOSTED_RUNNER_TAGS: Final[List[str]] = ["self-hosted", "docker-noble-main"]
+DEFAULT_GITHUB_HOSTED_RUNNER: Final[str] = "ubuntu-24.04"
+DEFAULT_GCC_VERSION: Final[int] = 15
+DEFAULT_LLVM_VERSION: Final[int] = 21
+
+RUNNERS_BUSY_THRESHOLD: Final[float] = 0.8
+
+
+class Arch(str, Enum):
+    """
+    CPU architecture supported by CI.
+    """
+
+    AARCH64 = "aarch64"
+    S390X = "s390x"
+    X86_64 = "x86_64"
+
+
+class Compiler(str, Enum):
+    GCC = "gcc"
+    LLVM = "llvm"
+
+
+def query_runners_from_github() -> List[Dict[str, Any]]:
+    if "GITHUB_TOKEN" not in os.environ:
+        return []
+    token = os.environ["GITHUB_TOKEN"]
+    headers = {
+        "Authorization": f"token {token}",
+        "Accept": "application/vnd.github.v3+json",
+    }
+    owner = os.environ["GITHUB_REPOSITORY_OWNER"]
+    url: Optional[str] = f"https://api.github.com/orgs/{owner}/actions/runners"
+    # GitHub returns 30 runners per page, fetch all
+    all_runners = []
+    try:
+        while url is not None:
+            response = requests.get(url, headers=headers)
+            if response.status_code != 200:
+                print(f"Failed to query runners: {response.status_code}")
+                print(f"response: {response.text}")
+                return []
+            data = response.json()
+            all_runners.extend(data.get("runners", []))
+            # Check for next page URL in Link header
+            url = None
+            if "Link" in response.headers:
+                links = requests.utils.parse_header_links(response.headers["Link"])
+                for link in links:
+                    if link["rel"] == "next":
+                        url = link["url"]
+                        break
+        return all_runners
+    except Exception as e:
+        print(f"Warning: Failed to query runner status due to exception: {e}")
+        return []
+
+
+all_runners_cached: Optional[List[Dict[str, Any]]] = None
+
+
+def all_runners() -> List[Dict[str, Any]]:
+    global all_runners_cached
+    if all_runners_cached is None:
+        print("Querying runners from GitHub...")
+        all_runners_cached = query_runners_from_github()
+        print(f"Github returned {len(all_runners_cached)} runners")
+        counts = count_by_status(all_runners_cached)
+        print(
+            f"Busy: {counts['busy']}, Idle: {counts['idle']}, Offline: {counts['offline']}"
+        )
+    return all_runners_cached
+
+
+def runner_labels(runner: Dict[str, Any]) -> List[str]:
+    return [label["name"] for label in runner["labels"]]
+
+
+def is_self_hosted_runner(runner: Dict[str, Any]) -> bool:
+    labels = runner_labels(runner)
+    for label in DEFAULT_SELF_HOSTED_RUNNER_TAGS:
+        if label not in labels:
+            return False
+    return True
+
+
+def self_hosted_runners() -> List[Dict[str, Any]]:
+    runners = all_runners()
+    return [r for r in runners if is_self_hosted_runner(r)]
+
+
+def runners_by_arch(arch: Arch) -> List[Dict[str, Any]]:
+    runners = self_hosted_runners()
+    return [r for r in runners if arch.value in runner_labels(r)]
+
+
+def count_by_status(runners: List[Dict[str, Any]]) -> Dict[str, int]:
+    result = {"busy": 0, "idle": 0, "offline": 0}
+    for runner in runners:
+        if runner["status"] == "online":
+            if runner["busy"]:
+                result["busy"] += 1
+            else:
+                result["idle"] += 1
+        else:
+            result["offline"] += 1
+    return result
+
+
+@dataclasses.dataclass
+class BuildConfig:
+    arch: Arch
+    kernel_compiler: Compiler = Compiler.GCC
+    gcc_version: int = DEFAULT_GCC_VERSION
+    llvm_version: int = DEFAULT_LLVM_VERSION
+    kernel: str = "LATEST"
+    run_veristat: bool = False
+    parallel_tests: bool = False
+    build_release: bool = False
+
+    @property
+    def runs_on(self) -> List[str]:
+        if is_managed_repo():
+            return DEFAULT_SELF_HOSTED_RUNNER_TAGS + [self.arch.value]
+        else:
+            return [DEFAULT_GITHUB_HOSTED_RUNNER]
+
+    @property
+    def build_runs_on(self) -> List[str]:
+        if not is_managed_repo():
+            return [DEFAULT_GITHUB_HOSTED_RUNNER]
+
+        # @Temporary: disable codebuild runners for cross-compilation jobs
+        match self.arch:
+            case Arch.S390X:
+                return DEFAULT_SELF_HOSTED_RUNNER_TAGS + [Arch.X86_64.value]
+            case Arch.AARCH64:
+                return DEFAULT_SELF_HOSTED_RUNNER_TAGS + [Arch.X86_64.value]
+
+        # For managed repos, check the busyness of relevant self-hosted runners
+        # If they are too busy, use codebuild
+        runner_arch = self.arch
+        runners = runners_by_arch(runner_arch)
+        counts = count_by_status(runners)
+        online = counts["idle"] + counts["busy"]
+        busy = counts["busy"]
+        # if online <= 0, then something is wrong, don't use codebuild
+        if online > 0 and busy / online > RUNNERS_BUSY_THRESHOLD:
+            return ["codebuild"]
+        else:
+            return DEFAULT_SELF_HOSTED_RUNNER_TAGS + [runner_arch.value]
+
+    @property
+    def tests(self) -> Dict[str, Any]:
+        tests_list = [
+            "test_progs",
+            "test_progs_parallel",
+            "test_progs_no_alu32",
+            "test_progs_no_alu32_parallel",
+            "test_verifier",
+        ]
+
+        if self.arch.value != "s390x":
+            tests_list.append("test_maps")
+
+        if self.llvm_version >= 18:
+            tests_list.append("test_progs_cpuv4")
+
+        if self.arch in [Arch.X86_64, Arch.AARCH64]:
+            tests_list.append("sched_ext")
+
+        # Don't run GCC BPF runner, because too many tests are failing
+        # See: https://lore.kernel.org/bpf/87bjw6qpje.fsf@oracle.com/
+        # if self.arch == Arch.X86_64:
+        #    tests_list.append("test_progs-bpf_gcc")
+
+        if not self.parallel_tests:
+            tests_list = [test for test in tests_list if not test.endswith("parallel")]
+
+        return {"include": [generate_test_config(test) for test in tests_list]}
+
+    def to_dict(self) -> Dict[str, Any]:
+        return {
+            "arch": self.arch.value,
+            "kernel_compiler": self.kernel_compiler.value,
+            "gcc_version": DEFAULT_GCC_VERSION,
+            "llvm_version": DEFAULT_LLVM_VERSION,
+            "kernel": self.kernel,
+            "run_veristat": self.run_veristat,
+            "parallel_tests": self.parallel_tests,
+            "build_release": self.build_release,
+            "runs_on": self.runs_on,
+            "tests": self.tests,
+            "build_runs_on": self.build_runs_on,
+        }
+
+
+def is_managed_repo() -> bool:
+    return (
+        os.environ["GITHUB_REPOSITORY_OWNER"] == MANAGED_OWNER
+        and os.environ["GITHUB_REPOSITORY"] in MANAGED_REPOS
+    )
+
+
+def set_output(name, value):
+    """Write an output variable to the GitHub output file."""
+    with open(os.getenv("GITHUB_OUTPUT"), "a", encoding="utf-8") as file:
+        file.write(f"{name}={value}\n")
+
+
+def generate_test_config(test: str) -> Dict[str, Union[str, int]]:
+    """Create the configuration for the provided test."""
+    is_parallel = test.endswith("_parallel")
+    config = {
+        "test": test,
+        "continue_on_error": is_parallel,
+        # While in experimental mode, parallel jobs may get stuck
+        # anywhere, including in user space where the kernel won't detect
+        # a problem and panic. We add a second layer of (smaller) timeouts
+        # here such that if we get stuck in a parallel run, we hit this
+        # timeout and fail without affecting the overall job success (as
+        # would be the case if we hit the job-wide timeout). For
+        # non-experimental jobs, 360 is the default which will be
+        # superseded by the overall workflow timeout (but we need to
+        # specify something).
+        "timeout_minutes": 30 if is_parallel else 360,
+    }
+    return config
+
+
+if __name__ == "__main__":
+    matrix = [
+        BuildConfig(
+            arch=Arch.X86_64,
+            run_veristat=True,
+            parallel_tests=True,
+        ),
+        BuildConfig(
+            arch=Arch.X86_64,
+            kernel_compiler=Compiler.LLVM,
+            build_release=True,
+        ),
+        BuildConfig(
+            arch=Arch.AARCH64,
+        ),
+        BuildConfig(
+            arch=Arch.S390X,
+        ),
+    ]
+
+    # Outside of managed repositories only run on x86_64
+    if not is_managed_repo():
+        matrix = [config for config in matrix if config.arch == Arch.X86_64]
+
+    json_matrix = json.dumps({"include": [config.to_dict() for config in matrix]})
+    print(json.dumps(json.loads(json_matrix), indent=4))
+    set_output("build_matrix", json_matrix)
diff --git a/.github/scripts/tests/test_veristat_compare.py b/.github/scripts/tests/test_veristat_compare.py
new file mode 100644
index 0000000000000..b65b69295235d
--- /dev/null
+++ b/.github/scripts/tests/test_veristat_compare.py
@@ -0,0 +1,75 @@
+#!/usr/bin/env python3
+
+import unittest
+from typing import Iterable, List
+
+from ..veristat_compare import parse_table, VeristatFields
+
+
+def gen_csv_table(records: Iterable[str]) -> List[str]:
+    return [
+        ",".join(VeristatFields.headers()),
+        *records,
+    ]
+
+
+class TestVeristatCompare(unittest.TestCase):
+    def test_parse_table_ignore_new_prog(self):
+        table = gen_csv_table(
+            [
+                "prog_file.bpf.o,prog_name,N/A,success,N/A,N/A,1,N/A",
+            ]
+        )
+        veristat_info = parse_table(table)
+        self.assertEqual(veristat_info.table, [])
+        self.assertFalse(veristat_info.changes)
+        self.assertFalse(veristat_info.new_failures)
+
+    def test_parse_table_ignore_removed_prog(self):
+        table = gen_csv_table(
+            [
+                "prog_file.bpf.o,prog_name,success,N/A,N/A,1,N/A,N/A",
+            ]
+        )
+        veristat_info = parse_table(table)
+        self.assertEqual(veristat_info.table, [])
+        self.assertFalse(veristat_info.changes)
+        self.assertFalse(veristat_info.new_failures)
+
+    def test_parse_table_new_failure(self):
+        table = gen_csv_table(
+            [
+                "prog_file.bpf.o,prog_name,success,failure,MISMATCH,1,1,+0 (+0.00%)",
+            ]
+        )
+        veristat_info = parse_table(table)
+        self.assertEqual(
+            veristat_info.table,
+            [["prog_file.bpf.o", "prog_name", "success -> failure (!!)", "+0.00 %"]],
+        )
+        self.assertTrue(veristat_info.changes)
+        self.assertTrue(veristat_info.new_failures)
+
+    def test_parse_table_new_changes(self):
+        table = gen_csv_table(
+            [
+                "prog_file.bpf.o,prog_name,failure,success,MISMATCH,0,0,+0 (+0.00%)",
+                "prog_file.bpf.o,prog_name_increase,failure,failure,MATCH,1,2,+1 (+100.00%)",
+                "prog_file.bpf.o,prog_name_decrease,success,success,MATCH,1,1,-1 (-100.00%)",
+            ]
+        )
+        veristat_info = parse_table(table)
+        self.assertEqual(
+            veristat_info.table,
+            [
+                ["prog_file.bpf.o", "prog_name", "failure -> success", "+0.00 %"],
+                ["prog_file.bpf.o", "prog_name_increase", "failure", "+100.00 %"],
+                ["prog_file.bpf.o", "prog_name_decrease", "success", "-100.00 %"],
+            ],
+        )
+        self.assertTrue(veristat_info.changes)
+        self.assertFalse(veristat_info.new_failures)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/.github/scripts/tmpfsify-workspace.sh b/.github/scripts/tmpfsify-workspace.sh
new file mode 100755
index 0000000000000..6fd62b4ad2a49
--- /dev/null
+++ b/.github/scripts/tmpfsify-workspace.sh
@@ -0,0 +1,21 @@
+#!/bin/bash
+
+set -x -euo pipefail
+
+TMPFS_SIZE=20 # GB
+MEM_TOTAL=$(awk '/MemTotal/ {print int($2/1024)}' /proc/meminfo)
+
+# sanity check: total mem is at least double TMPFS_SIZE
+if [ $MEM_TOTAL -lt $(($TMPFS_SIZE*1024*2)) ]; then
+    echo "tmpfsify-workspace.sh: will not allocate tmpfs, total memory is too low (${MEM_TOTAL}MB)"
+    exit 0
+fi
+
+dir="$(basename "$GITHUB_WORKSPACE")"
+cd "$(dirname "$GITHUB_WORKSPACE")"
+mv "${dir}" "${dir}.backup"
+mkdir "${dir}"
+sudo mount -t tmpfs -o size=${TMPFS_SIZE}G tmpfs "${dir}"
+rsync -a "${dir}.backup/" "${dir}"
+cd -
+
diff --git a/.github/scripts/veristat_compare.py b/.github/scripts/veristat_compare.py
new file mode 100644
index 0000000000000..07271b8cbd3aa
--- /dev/null
+++ b/.github/scripts/veristat_compare.py
@@ -0,0 +1,263 @@
+#!/usr/bin/env python3
+
+# This script reads a CSV file produced by the following invocation:
+#
+#   veristat --emit file,prog,verdict,states \
+#            --output-format csv \
+#            --compare ...
+#
+# And produces a markdown summary for the file.
+# The summary is printed to standard output and appended to a file
+# pointed to by GITHUB_STEP_SUMMARY variable.
+#
+# Script exits with return code 1 if there are new failures in the
+# veristat results.
+#
+# For testing purposes invoke as follows:
+#
+#  GITHUB_STEP_SUMMARY=/dev/null python3 veristat-compare.py test.csv
+#
+# File format (columns):
+#  0. file_name
+#  1. prog_name
+#  2. verdict_base
+#  3. verdict_comp
+#  4. verdict_diff
+#  5. total_states_base
+#  6. total_states_comp
+#  7. total_states_diff
+#
+# Records sample:
+#  file-a,a,success,failure,MISMATCH,12,12,+0 (+0.00%)
+#  file-b,b,success,success,MATCH,67,67,+0 (+0.00%)
+#
+# For better readability suffixes '_OLD' and '_NEW'
+# are used instead of '_base' and '_comp' for variable
+# names etc.
+
+import io
+import os
+import sys
+import re
+import csv
+import logging
+import argparse
+import enum
+from dataclasses import dataclass
+from typing import Dict, Iterable, List, Final
+
+
+TRESHOLD_PCT: Final[int] = 0
+
+SUMMARY_HEADERS = ["File", "Program", "Verdict", "States Diff (%)"]
+
+# expected format: +0 (+0.00%) / -0 (-0.00%)
+TOTAL_STATES_DIFF_REGEX = (
+    r"(?P<absolute_diff>[+-]\d+) \((?P<percentage_diff>[+-]\d+\.\d+)\%\)"
+)
+
+
+TEXT_SUMMARY_TEMPLATE: Final[str] = (
+    """
+# {title}
+
+{table}
+""".strip()
+)
+
+HTML_SUMMARY_TEMPLATE: Final[str] = (
+    """
+# {title}
+
+<details>
+<summary>Click to expand</summary>
+
+{table}
+</details>
+""".strip()
+)
+
+GITHUB_MARKUP_REPLACEMENTS: Final[Dict[str, str]] = {
+    "->": "&rarr;",
+    "(!!)": ":bangbang:",
+}
+
+NEW_FAILURE_SUFFIX: Final[str] = "(!!)"
+
+
+class VeristatFields(str, enum.Enum):
+    FILE_NAME = "file_name"
+    PROG_NAME = "prog_name"
+    VERDICT_OLD = "verdict_base"
+    VERDICT_NEW = "verdict_comp"
+    VERDICT_DIFF = "verdict_diff"
+    TOTAL_STATES_OLD = "total_states_base"
+    TOTAL_STATES_NEW = "total_states_comp"
+    TOTAL_STATES_DIFF = "total_states_diff"
+
+    @classmethod
+    def headers(cls) -> List[str]:
+        return [
+            cls.FILE_NAME,
+            cls.PROG_NAME,
+            cls.VERDICT_OLD,
+            cls.VERDICT_NEW,
+            cls.VERDICT_DIFF,
+            cls.TOTAL_STATES_OLD,
+            cls.TOTAL_STATES_NEW,
+            cls.TOTAL_STATES_DIFF,
+        ]
+
+
+@dataclass
+class VeristatInfo:
+    table: list
+    changes: bool
+    new_failures: bool
+
+    def get_results_title(self) -> str:
+        if self.new_failures:
+            return "There are new veristat failures"
+
+        if self.changes:
+            return "There are changes in verification performance"
+
+        return "No changes in verification performance"
+
+    def get_results_summary(self, markup: bool = False) -> str:
+        title = self.get_results_title()
+        if not self.table:
+            return f"# {title}\n"
+
+        template = TEXT_SUMMARY_TEMPLATE
+        table = format_table(headers=SUMMARY_HEADERS, rows=self.table)
+
+        if markup:
+            template = HTML_SUMMARY_TEMPLATE
+            table = github_markup_decorate(table)
+
+        return template.format(title=title, table=table)
+
+
+def get_state_diff(value: str) -> float:
+    if value == "N/A":
+        return 0.0
+
+    matches = re.match(TOTAL_STATES_DIFF_REGEX, value)
+    if not matches:
+        raise ValueError(f"Failed to parse total states diff field value '{value}'")
+
+    if percentage_diff := matches.group("percentage_diff"):
+        return float(percentage_diff)
+
+    raise ValueError(f"Invalid {VeristatFields.TOTAL_STATES_DIFF} field value: {value}")
+
+
+def parse_table(csv_file: Iterable[str]) -> VeristatInfo:
+    reader = csv.DictReader(csv_file)
+    assert reader.fieldnames == VeristatFields.headers()
+
+    new_failures = False
+    changes = False
+    table = []
+
+    for record in reader:
+        add = False
+
+        verdict_old, verdict_new = (
+            record[VeristatFields.VERDICT_OLD],
+            record[VeristatFields.VERDICT_NEW],
+        )
+
+        # Ignore results from completely new and removed programs
+        if "N/A" in [verdict_new, verdict_old]:
+            continue
+
+        if record[VeristatFields.VERDICT_DIFF] == "MISMATCH":
+            changes = True
+            add = True
+            verdict = f"{verdict_old} -> {verdict_new}"
+            if verdict_new == "failure":
+                new_failures = True
+                verdict += f" {NEW_FAILURE_SUFFIX}"
+        else:
+            verdict = record[VeristatFields.VERDICT_NEW]
+
+        diff = get_state_diff(record[VeristatFields.TOTAL_STATES_DIFF])
+        if abs(diff) > TRESHOLD_PCT:
+            changes = True
+            add = True
+
+        if not add:
+            continue
+
+        table.append(
+            [
+                record[VeristatFields.FILE_NAME],
+                record[VeristatFields.PROG_NAME],
+                verdict,
+                f"{diff:+.2f} %",
+            ]
+        )
+
+    return VeristatInfo(table=table, changes=changes, new_failures=new_failures)
+
+
+def github_markup_decorate(input_str: str) -> str:
+    for text, markup in GITHUB_MARKUP_REPLACEMENTS.items():
+        input_str = input_str.replace(text, markup)
+    return input_str
+
+
+def format_table(headers: List[str], rows: List[List[str]]) -> str:
+    column_width = [
+        max(len(row[column_idx]) for row in [headers] + rows)
+        for column_idx in range(len(headers))
+    ]
+
+    # Row template string in the following format:
+    # "{0:8}|{1:10}|{2:15}|{3:7}|{4:10}"
+    row_template = "|".join(
+        f"{{{idx}:{width}}}" for idx, width in enumerate(column_width)
+    )
+    row_template_nl = f"|{row_template}|\n"
+
+    with io.StringIO() as out:
+        out.write(row_template_nl.format(*headers))
+
+        separator_row = ["-" * width for width in column_width]
+        out.write(row_template_nl.format(*separator_row))
+
+        for row in rows:
+            row_str = row_template_nl.format(*row)
+            out.write(row_str)
+
+        return out.getvalue()
+
+
+def main(compare_csv_filename: os.PathLike, output_filename: os.PathLike) -> None:
+    with open(compare_csv_filename, newline="", encoding="utf-8") as csv_file:
+        veristat_results = parse_table(csv_file)
+
+    sys.stdout.write(veristat_results.get_results_summary())
+
+    with open(output_filename, encoding="utf-8", mode="a") as file:
+        file.write(veristat_results.get_results_summary(markup=True))
+
+    if veristat_results.new_failures:
+        return 1
+
+    return 0
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(
+        description="Print veristat comparison output as markdown step summary"
+    )
+    parser.add_argument("filename")
+    args = parser.parse_args()
+    summary_filename = os.getenv("GITHUB_STEP_SUMMARY")
+    if not summary_filename:
+        logging.error("GITHUB_STEP_SUMMARY environment variable is not set")
+        sys.exit(1)
+    sys.exit(main(args.filename, summary_filename))
diff --git a/.github/workflows/ai-code-review.yml b/.github/workflows/ai-code-review.yml
new file mode 100644
index 0000000000000..1e06d2d44abf6
--- /dev/null
+++ b/.github/workflows/ai-code-review.yml
@@ -0,0 +1,132 @@
+name: AI Code Review
+
+permissions:
+  contents: read
+  id-token: write
+  issues: write
+  pull-requests: write
+
+on:
+  pull_request:
+    types: [opened, review_requested]
+
+jobs:
+  get-commits:
+    # This codition is an indicator that we are running in a context of PR owned by kernel-patches org
+    if: ${{ github.repository == 'kernel-patches/bpf' && vars.AWS_REGION }}
+    runs-on: 'ubuntu-latest'
+    continue-on-error: true
+    outputs:
+      commits: ${{ steps.get-commits.outputs.commits }}
+    steps:
+      - name: Checkout Linux source tree
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 32
+
+      # Get the list of commits and trigger a review job for each separate commit
+      # As a safeguard, check no more than the first 50 commits
+      - name: Get PR commits
+        id: get-commits
+        run: |
+          tmp=$(mktemp)
+          git rev-list ${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }} | head -n 50 > pr_commits.txt
+          cat pr_commits.txt | jq -R -s -c 'split("\n")[:-1]' > $tmp
+          echo "commits=$(cat $tmp)" >> $GITHUB_OUTPUT
+
+
+  ai-review:
+    needs: get-commits
+    runs-on: 'ubuntu-latest'
+    strategy:
+      matrix:
+        commit: ${{ fromJson(needs.get-commits.outputs.commits) }}
+      fail-fast: false
+    env:
+      AWS_REGION: us-west-2
+    steps:
+      - name: Checkout CI code
+        uses: actions/checkout@v5
+        with:
+          sparse-checkout: |
+            .github
+            ci
+
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.KP_REVIEW_BOT_APP_ID }}
+          private-key: ${{ secrets.KP_REVIEW_BOT_APP_PRIVATE_KEY }}
+
+      - name: Configure AWS Credentials (OIDC)
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_BEDROCK_ROLE }}
+          aws-region: us-west-2
+
+      - name: Set up .claude/settings.json
+        shell: bash
+        run: |
+          mkdir -p ~/.claude
+          cp ci/claude/settings.json ~/.claude/settings.json
+
+      - name: Checkout Linux source tree
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 32
+          ref: ${{ matrix.commit }}
+
+      - name: Get patch subject
+        id: get-patch-subject
+        shell: bash
+        run: |
+          subject=$(git log -1 --pretty=format:"%s" ${{ matrix.commit }})
+          echo "subject=$subject" >> $GITHUB_OUTPUT
+
+      - name: Checkout prompts repo
+        uses: actions/checkout@v5
+        with:
+          repository: 'masoncl/review-prompts'
+          path: 'review'
+
+      - uses: anthropics/claude-code-action@v1
+        with:
+          github_token: ${{ steps.app-token.outputs.token }}
+          use_bedrock: "true"
+          claude_args: '--max-turns 100'
+          prompt: |
+            Current directory is the root of a Linux Kernel git repository.
+            Using the prompt `review/review-core.md` and the prompt directory `review`
+            do a code review of the top commit in the Linux repository.
+
+      # If Claude produced review-inline.txt then it found something
+      # Post a comment on PR and fail the job
+      - name: Check review-inline.txt
+        id: check_review
+        shell: bash
+        run: |
+          review_file=$(find ${{ github.workspace }} -name review-inline.txt)
+          if [ -s "$review_file" ]; then
+              cat $review_file || true
+              echo "review_file=$review_file" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Comment on PR
+        if: steps.check_review.outputs.review_file != ''
+        uses: actions/github-script@v8
+        env:
+          REVIEW_FILE: ${{ steps.check_review.outputs.review_file }}
+          PATCH_SUBJECT: ${{ steps.get-patch-subject.outputs.subject }}
+        with:
+          github-token: ${{ steps.app-token.outputs.token }}
+          script: |
+            const commentScript = require('./ci/claude/post-pr-comment.js');
+            await commentScript({github, context});
+
+      - name: Fail CI job if review file exists
+        if: steps.check_review.outputs.review_file != ''
+        run: |
+          echo "Review file found - failing the CI job"
+          exit 42
+
diff --git a/.github/workflows/gcc-bpf.yml b/.github/workflows/gcc-bpf.yml
new file mode 100644
index 0000000000000..5f05234399d33
--- /dev/null
+++ b/.github/workflows/gcc-bpf.yml
@@ -0,0 +1,103 @@
+name: Testing GCC BPF compiler
+
+on:
+  workflow_call:
+    inputs:
+      runs_on:
+        required: true
+        type: string
+      arch:
+        required: true
+        type: string
+      gcc_version:
+        required: true
+        type: string
+      llvm_version:
+        required: true
+        type: string
+      toolchain:
+        required: true
+        type: string
+      toolchain_full:
+        required: true
+        type: string
+      download_sources:
+        required: true
+        type: boolean
+
+jobs:
+  test:
+    name: GCC BPF
+    runs-on: >-
+      ${{
+          contains(fromJSON(inputs.runs_on), 'codebuild')
+          && format('codebuild-bpf-ci-{0}-{1}', github.run_id, github.run_attempt)
+          || fromJSON(inputs.runs_on)
+      }}
+    env:
+      ARCH: ${{ inputs.arch }}
+      BPF_NEXT_BASE_BRANCH: 'master'
+      GCC_BPF_INSTALL_DIR: ${{ github.workspace }}/gcc-bpf
+      GCC_BPF_RELEASE_REPO: 'theihor/gcc-bpf'
+      KBUILD_OUTPUT: ${{ github.workspace }}/src/kbuild-output
+      REPO_ROOT: ${{ github.workspace }}/src
+
+    steps:
+
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: |
+            .github
+            ci
+
+      - if: ${{ inputs.download_sources }}
+        name: Download bpf-next tree
+        uses: libbpf/ci/get-linux-source@v3
+        with:
+          dest: ${{ env.REPO_ROOT }}
+          rev: ${{ env.BPF_NEXT_BASE_BRANCH }}
+
+      - if: ${{ ! inputs.download_sources }}
+        name: Checkout ${{ github.repository }} to ./src
+        uses: actions/checkout@v4
+        with:
+          path: 'src'
+
+      - uses:  libbpf/ci/patch-kernel@v3
+        with:
+          patches-root: '${{ github.workspace }}/ci/diffs'
+          repo-root: ${{ env.REPO_ROOT }}
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: vmlinux-${{ inputs.arch }}-${{ inputs.toolchain_full }}
+          path: ${{ env.REPO_ROOT }}
+
+      - name: Untar artifacts
+        working-directory: ${{ env.REPO_ROOT }}
+        run: zstd -d -T0 vmlinux-${{ inputs.arch }}-${{ inputs.toolchain_full }}.tar.zst --stdout | tar -xf -
+
+      - name: Setup build environment
+        uses: libbpf/ci/setup-build-env@v3
+        with:
+          arch: ${{ inputs.arch }}
+          gcc-version: ${{ inputs.gcc_version }}
+          llvm-version: ${{ inputs.llvm_version }}
+
+      - name: Download GCC BPF compiler
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: .github/scripts/download-gcc-bpf.sh ${{ env.GCC_BPF_RELEASE_REPO }} ${{ env.GCC_BPF_INSTALL_DIR }}
+
+      - name: Build selftests/bpf/test_progs-bpf_gcc
+        uses: libbpf/ci/build-selftests@v3
+        env:
+          BPF_GCC: ${{ env.GCC_BPF_INSTALL_DIR }}
+          MAX_MAKE_JOBS: 32
+          SELFTESTS_BPF_TARGETS: 'test_progs-bpf_gcc'
+        with:
+          arch: ${{ inputs.arch }}
+          kernel-root: ${{ env.REPO_ROOT }}
+          llvm-version: ${{ inputs.llvm_version }}
+          toolchain: ${{ inputs.toolchain }}
diff --git a/.github/workflows/kernel-build-test.yml b/.github/workflows/kernel-build-test.yml
new file mode 100644
index 0000000000000..ceb47761e905b
--- /dev/null
+++ b/.github/workflows/kernel-build-test.yml
@@ -0,0 +1,167 @@
+name: Reusable Build/Test/Veristat workflow
+
+on:
+  workflow_call:
+    inputs:
+      arch:
+        required: true
+        type: string
+        description: The architecture to build against, e.g x86_64, aarch64, s390x...
+      toolchain_full:
+        required: true
+        type: string
+        description: The toolchain and for llvm, its version, e.g gcc, llvm-15
+      toolchain:
+        required: true
+        type: string
+        description: The toolchain, e.g gcc, llvm
+      runs_on:
+        required: true
+        type: string
+        description: The runners to run the test on. This is a json string representing an array of labels.
+      build_runs_on:
+        required: true
+        type: string
+        description: The runners to run the builds on. This is a json string representing an array of labels.
+      gcc_version:
+        required: true
+        type: string
+        description: GCC version to install
+      llvm_version:
+        required: true
+        type: string
+        description: LLVM version to install
+      kernel:
+        required: true
+        type: string
+        description: The kernel to run the test against. For KPD this is always LATEST, which runs against a newly built kernel.
+      tests:
+        required: true
+        type: string
+        description: A serialized json array with the tests to be running, it must follow the json-matrix format, https://www.jitsejan.com/use-github-actions-with-json-file-as-matrix
+      run_veristat:
+        required: true
+        type: boolean
+        description: Whether or not to run the veristat job.
+      run_tests:
+        required: true
+        type: boolean
+        description: Whether or not to run the test job.
+      download_sources:
+        required: true
+        type: boolean
+        description: Whether to download the linux sources into the working directory.
+        default: false
+      build_release:
+        required: true
+        type: boolean
+        description: Build selftests with -O2 optimization in addition to non-optimized build.
+        default: false
+    secrets:
+      AWS_ROLE_ARN:
+        required: true
+
+jobs:
+
+  # Build kernel and selftest
+  build:
+    uses: ./.github/workflows/kernel-build.yml
+    with:
+      arch: ${{ inputs.arch }}
+      toolchain_full: ${{ inputs.toolchain_full }}
+      toolchain: ${{ inputs.toolchain }}
+      runs_on: ${{ inputs.build_runs_on }}
+      gcc_version: ${{ inputs.gcc_version }}
+      llvm_version: ${{ inputs.llvm_version }}
+      kernel: ${{ inputs.kernel }}
+      download_sources: ${{ inputs.download_sources }}
+
+  build-release:
+    if: ${{ inputs.build_release }}
+    uses: ./.github/workflows/kernel-build.yml
+    with:
+      arch: ${{ inputs.arch }}
+      toolchain_full: ${{ inputs.toolchain_full }}
+      toolchain: ${{ inputs.toolchain }}
+      runs_on: ${{ inputs.build_runs_on }}
+      gcc_version: ${{ inputs.gcc_version }}
+      llvm_version: ${{ inputs.llvm_version }}
+      kernel: ${{ inputs.kernel }}
+      download_sources: ${{ inputs.download_sources }}
+      release: true
+
+  test:
+    if: ${{ inputs.run_tests }}
+    uses: ./.github/workflows/kernel-test.yml
+    # Setting name to test here to avoid lengthy autogenerated names due to matrix
+    # e.g build-and-test x86_64-gcc / test (test_progs_parallel, true, 30) / test_progs_parallel on x86_64 with gcc
+    name: "test"
+    needs: [build]
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJSON(inputs.tests) }}
+    with:
+      arch: ${{ inputs.arch }}
+      toolchain_full: ${{ inputs.toolchain_full }}
+      runs_on: ${{ inputs.runs_on }}
+      kernel: ${{ inputs.kernel }}
+      test: ${{ matrix.test }}
+      continue_on_error: ${{ toJSON(matrix.continue_on_error) }}
+      timeout_minutes: ${{ matrix.timeout_minutes }}
+
+  veristat-kernel:
+    if: ${{ inputs.run_veristat }}
+    uses: ./.github/workflows/veristat-kernel.yml
+    needs: [build]
+    permissions:
+      id-token: write
+      contents: read
+    with:
+      arch: ${{ inputs.arch }}
+      toolchain_full: ${{ inputs.toolchain_full }}
+      runs_on: ${{ inputs.runs_on }}
+
+  veristat-meta:
+    # Check for vars.AWS_REGION is necessary to skip this job in case of a PR from a fork.
+    if: ${{ inputs.run_veristat && github.repository_owner == 'kernel-patches' && vars.AWS_REGION }}
+    uses: ./.github/workflows/veristat-meta.yml
+    needs: [build]
+    permissions:
+      id-token: write
+      contents: read
+    with:
+      arch: ${{ inputs.arch }}
+      toolchain_full: ${{ inputs.toolchain_full }}
+      aws_region: ${{ vars.AWS_REGION }}
+      runs_on: ${{ inputs.runs_on }}
+    secrets:
+      AWS_ROLE_ARN: ${{ secrets.AWS_ROLE_ARN }}
+
+  veristat-scx:
+    if: ${{ inputs.run_veristat }}
+    uses: ./.github/workflows/veristat-scx.yml
+    needs: [build]
+    permissions:
+      id-token: write
+      contents: read
+    with:
+      arch: ${{ inputs.arch }}
+      toolchain_full: ${{ inputs.toolchain_full }}
+      runs_on: ${{ inputs.runs_on }}
+      llvm_version: ${{ inputs.llvm_version }}
+
+  gcc-bpf:
+    name: 'GCC BPF'
+    if: ${{ inputs.arch == 'x86_64' }}
+    uses: ./.github/workflows/gcc-bpf.yml
+    needs: [build]
+    with:
+      # GCC BPF does not need /dev/kvm, so use the "build" runners
+      runs_on: ${{ inputs.build_runs_on }}
+      arch: ${{ inputs.arch }}
+      gcc_version: ${{ inputs.gcc_version }}
+      llvm_version: ${{ inputs.llvm_version }}
+      toolchain: ${{ inputs.toolchain }}
+      toolchain_full: ${{ inputs.toolchain_full }}
+      download_sources: ${{ inputs.download_sources }}
+
diff --git a/.github/workflows/kernel-build.yml b/.github/workflows/kernel-build.yml
new file mode 100644
index 0000000000000..296f5df43f696
--- /dev/null
+++ b/.github/workflows/kernel-build.yml
@@ -0,0 +1,231 @@
+
+name: Reusable build workflow
+
+on:
+  workflow_call:
+    inputs:
+      arch:
+        required: true
+        type: string
+        description: The architecture to build against, e.g x86_64, aarch64, s390x...
+      toolchain_full:
+        required: true
+        type: string
+        description: The toolchain and for llvm, its version, e.g gcc, llvm-15
+      toolchain:
+        required: true
+        type: string
+        description: The toolchain, e.g gcc, llvm
+      runs_on:
+        required: true
+        type: string
+        description: The runners to run the test on. This is a json string representing an array of labels.
+      gcc_version:
+        required: true
+        type: string
+        description: GCC version to install
+      llvm_version:
+        required: true
+        type: string
+        description: LLVM version to install
+      kernel:
+        required: true
+        type: string
+        description: The kernel to run the test against. For KPD this is always LATEST, which runs against a newly built kernel.
+      download_sources:
+        required: true
+        type: boolean
+        description: Whether to download the linux sources into the working directory.
+        default: false
+      release:
+        required: false
+        type: boolean
+        description: Build selftest with -O2 optimization
+        default: false
+
+jobs:
+  build:
+    name: build kernel and selftests ${{ inputs.release && '-O2' || '' }}
+    # To run on CodeBuild, runs-on value must correspond to the AWS
+    # CodeBuild project associated with the kernel-patches webhook
+    # However matrix.py passes just a 'codebuild' string
+    runs-on: >-
+      ${{
+          contains(fromJSON(inputs.runs_on), 'codebuild')
+          && format('codebuild-bpf-ci-{0}-{1}', github.run_id, github.run_attempt)
+          || fromJSON(inputs.runs_on)
+      }}
+    env:
+        ARTIFACTS_ARCHIVE: "vmlinux-${{ inputs.arch }}-${{ inputs.toolchain_full }}.tar.zst"
+        BPF_NEXT_BASE_BRANCH: 'master'
+        BPF_NEXT_FETCH_DEPTH: 64 # A bit of history is needed to facilitate incremental builds
+        CROSS_COMPILE: ${{ inputs.arch != 'x86_64' && 'true' || '' }}
+        BUILD_SCHED_EXT_SELFTESTS: ${{ inputs.arch == 'x86_64' || inputs.arch == 'aarch64' && 'true' || '' }}
+        KBUILD_OUTPUT: ${{ github.workspace }}/kbuild-output
+        KERNEL: ${{ inputs.kernel }}
+        KERNEL_ROOT: ${{ github.workspace }}
+        REFERENCE_REPO_PATH: /libbpfci/mirrors/linux
+        REPO_PATH: ""
+        REPO_ROOT: ${{ github.workspace }}
+        RUNNER_TYPE: ${{ contains(fromJSON(inputs.runs_on), 'codebuild') && 'codebuild' || 'default' }}
+    steps:
+
+      # git version 2.43.0 (current Ubuntu 24 installation)
+      # does not support git clone --revision option
+      # so make sure latest git is installed
+      - name: Install latest git
+        shell: bash
+        run: |
+            sudo apt-get update
+            sudo apt-get install -y software-properties-common
+            sudo add-apt-repository -y ppa:git-core/ppa
+            sudo apt-get update
+            sudo apt-get install -y git
+            git --version
+
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: |
+            .github
+            ci
+
+      - if: ${{ env.RUNNER_TYPE == 'codebuild' }}
+        shell: bash
+        run: .github/scripts/tmpfsify-workspace.sh
+
+      - if: ${{ ! inputs.download_sources }}
+        name: git clone ${{ github.repository }}@${{ github.sha }}
+        shell: bash
+        run: |
+          if [ -d "${{ env.REFERENCE_REPO_PATH }}" ]; then
+            git clone \
+              --revision ${{ github.sha }} \
+              --reference-if-able ${{ env.REFERENCE_REPO_PATH }} \
+              https://github.com/${{ github.repository }}.git .kernel
+          else
+            git clone \
+              --revision ${{ github.sha }} \
+              --depth ${{ inputs.download_sources && 1 || env.BPF_NEXT_FETCH_DEPTH }} \
+              https://github.com/${{ github.repository }}.git .kernel
+          fi
+
+      - if: ${{ inputs.download_sources }}
+        name: Download bpf-next tree
+        env:
+          FETCH_DEPTH: ${{ env.BPF_NEXT_FETCH_DEPTH }}
+        uses: libbpf/ci/get-linux-source@v3
+        with:
+          dest: '.kernel'
+          rev: ${{ env.BPF_NEXT_BASE_BRANCH }}
+
+      - uses: libbpf/ci/prepare-incremental-build@v3
+        with:
+          repo-root: '.kernel'
+          base-branch: >-
+            ${{    inputs.download_sources && env.BPF_NEXT_BASE_BRANCH
+                || github.event_name == 'pull_request' && github.base_ref
+                || github.ref_name
+             }}
+          arch: ${{ inputs.arch }}
+          toolchain_full: ${{ inputs.toolchain_full }}
+          kbuild-output: ${{ env.KBUILD_OUTPUT }}
+
+      - name: Move linux source in place
+        shell: bash
+        run: |
+          cd .kernel
+          rm -rf .git .github ci
+          mv -t .. $(ls -A)
+          cd ..
+          rmdir .kernel
+
+      - uses:  libbpf/ci/patch-kernel@v3
+        with:
+          patches-root: '${{ github.workspace }}/ci/diffs'
+          repo-root: ${{ env.REPO_ROOT }}
+
+      - name: Setup build environment
+        uses: libbpf/ci/setup-build-env@v3
+        with:
+          arch: ${{ inputs.arch }}
+          gcc-version: ${{ inputs.gcc_version }}
+          llvm-version: ${{ inputs.llvm_version }}
+          pahole: master
+
+        # We have to setup qemu+binfmt in order to enable cross-compation of selftests.
+        # During selftests build, freshly built bpftool is executed.
+        # On self-hosted bare-metal hosts binfmt is pre-configured.
+      - if: ${{ env.RUNNER_TYPE == 'codebuild' && env.CROSS_COMPILE }}
+        name: Set up docker
+        uses: docker/setup-docker-action@v4
+      - if: ${{ env.RUNNER_TYPE == 'codebuild' && env.CROSS_COMPILE }}
+        name: Setup binfmt and qemu
+        uses: docker/setup-qemu-action@v3
+        with:
+          image: tonistiigi/binfmt:qemu-v9.2.0
+
+      - name: Build kernel image
+        uses: libbpf/ci/build-linux@v3
+        with:
+          arch: ${{ inputs.arch }}
+          toolchain: ${{ inputs.toolchain }}
+          kbuild-output: ${{ env.KBUILD_OUTPUT }}
+          max-make-jobs: 32
+          llvm-version: ${{ inputs.llvm_version }}
+
+      - name: Build selftests/bpf
+        uses: libbpf/ci/build-selftests@v3
+        env:
+          MAX_MAKE_JOBS: 32
+          RELEASE: ${{ inputs.release && '1' || '' }}
+        with:
+          arch: ${{ inputs.arch }}
+          kernel-root: ${{ env.KERNEL_ROOT }}
+          llvm-version: ${{ inputs.llvm_version }}
+          toolchain: ${{ inputs.toolchain }}
+
+      - if: ${{ env.BUILD_SCHED_EXT_SELFTESTS }}
+        name: Build selftests/sched_ext
+        uses: libbpf/ci/build-scx-selftests@v3
+        with:
+          kbuild-output: ${{ env.KBUILD_OUTPUT }}
+          repo-root: ${{ env.REPO_ROOT }}
+          arch: ${{ inputs.arch }}
+          toolchain: ${{ inputs.toolchain }}
+          llvm-version: ${{ inputs.llvm_version }}
+          max-make-jobs: 32
+
+      - if: ${{ github.event_name != 'push' }}
+        name: Build samples
+        uses: libbpf/ci/build-samples@v3
+        with:
+          arch: ${{ inputs.arch }}
+          toolchain: ${{ inputs.toolchain }}
+          kbuild-output: ${{ env.KBUILD_OUTPUT }}
+          max-make-jobs: 32
+          llvm-version: ${{ inputs.llvm_version }}
+      - name: Tar artifacts
+        id: tar-artifacts
+        uses: libbpf/ci/tar-artifacts@v3
+        env:
+          ARCHIVE_BPF_SELFTESTS: 'true'
+          ARCHIVE_MAKE_HELPERS: 'true'
+          ARCHIVE_SCHED_EXT_SELFTESTS: ${{ env.BUILD_SCHED_EXT_SELFTESTS }}
+        with:
+          arch: ${{ inputs.arch }}
+          archive: ${{ env.ARTIFACTS_ARCHIVE }}
+          kbuild-output: ${{ env.KBUILD_OUTPUT }}
+          repo-root: ${{ env.REPO_ROOT }}
+      - if: ${{ github.event_name != 'push' }}
+        name: Remove KBUILD_OUTPUT content
+        shell: bash
+        run: |
+          # Remove $KBUILD_OUTPUT to prevent cache creation for pull requests.
+          # Only on pushed changes are build artifacts actually cached, because
+          # of github.com/actions/cache's cache isolation logic.
+          rm -rf "${KBUILD_OUTPUT}"
+      - uses: actions/upload-artifact@v4
+        with:
+          name: vmlinux-${{ inputs.arch }}-${{ inputs.toolchain_full }}${{ inputs.release && '-release' || '' }}
+          if-no-files-found: error
+          path: ${{ env.ARTIFACTS_ARCHIVE }}
diff --git a/.github/workflows/kernel-test.yml b/.github/workflows/kernel-test.yml
new file mode 100644
index 0000000000000..2885f2759de4a
--- /dev/null
+++ b/.github/workflows/kernel-test.yml
@@ -0,0 +1,96 @@
+name: Reusable test workflow
+
+on:
+  workflow_call:
+    inputs:
+      arch:
+        required: true
+        type: string
+        description: The architecture to build against, e.g x86_64, aarch64, s390x...
+      toolchain_full:
+        required: true
+        type: string
+        description: The toolchain and for llvm, its version, e.g gcc, llvm-15
+      runs_on:
+        required: true
+        type: string
+        description: The runners to run the test on. This is a json string representing an array of labels.
+      kernel:
+        required: true
+        type: string
+        description: The kernel to run the test against. For KPD this is always LATEST, which runs against a newly built kernel.
+      test:
+        required: true
+        type: string
+        description: The test to run in the vm, e.g test_progs, test_maps, test_progs_no_alu32...
+      continue_on_error:
+        required: true
+        type: string
+        description: Whether to continue on error. This is typically set to true for parallel tests which are currently known to fail, but we don't want to fail the whole CI because of that.
+      timeout_minutes:
+        required: true
+        type: number
+        description: In case a test runs for too long, after how many seconds shall we timeout and error.
+
+jobs:
+  test:
+    name: ${{ inputs.test }} on ${{ inputs.arch }} with ${{ inputs.toolchain_full }}
+    runs-on: ${{ fromJSON(inputs.runs_on) }}
+    timeout-minutes: 100
+    env:
+      ARCH: ${{ inputs.arch }}
+      KERNEL: ${{ inputs.kernel }}
+      REPO_ROOT: ${{ github.workspace }}
+      REPO_PATH: ""
+      # https://github.com/actions/runner/issues/1483#issuecomment-1031671517
+      # booleans are weird in GH.
+      CONTINUE_ON_ERROR: ${{ inputs.continue_on_error }}
+      DEPLOYMENT: ${{ github.repository == 'kernel-patches/bpf' && 'prod' || 'rc' }}
+      ALLOWLIST_FILE: /tmp/allowlist
+      DENYLIST_FILE: /tmp/denylist
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: |
+            .github
+            ci
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: vmlinux-${{ inputs.arch }}-${{ inputs.toolchain_full }}
+          path: .
+
+      - name: Untar artifacts
+        # zstd is installed by default in the runner images.
+        run: zstd -d -T0  vmlinux-${{ inputs.arch }}-${{ inputs.toolchain_full }}.tar.zst --stdout | tar -xf -
+
+      - name: Run selftests
+        uses: libbpf/ci/run-vmtest@v3
+        # https://github.com/actions/runner/issues/1483#issuecomment-1031671517
+        # booleans are weird in GH.
+        continue-on-error: ${{ fromJSON(env.CONTINUE_ON_ERROR) }}
+        timeout-minutes: ${{ inputs.timeout_minutes }}
+        env:
+          ARCH: ${{ inputs.arch }}
+          DEPLOYMENT: ${{ env.DEPLOYMENT }}
+          KERNEL_TEST: ${{ inputs.test }}
+          SELFTESTS_BPF: ${{ github.workspace }}/selftests/bpf
+          VMTEST_CONFIGS: ${{ github.workspace }}/ci/vmtest/configs
+          TEST_PROGS_TRAFFIC_MONITOR: ${{ inputs.arch == 'x86_64' && 'true' || '' }}
+          TEST_PROGS_WATCHDOG_TIMEOUT: 600
+        with:
+          arch: ${{ inputs.arch }}
+          vmlinuz: '${{ github.workspace }}/vmlinuz'
+          kernel-root: ${{ env.REPO_ROOT }}
+          max-cpu: 8
+          kernel-test: ${{ inputs.test }}
+          # Here we must use kbuild-output local to the repo, because
+          # it was extracted from the artifacts.
+          kbuild-output: ${{ env.REPO_ROOT }}/kbuild-output
+
+      - if: ${{ always() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: tmon-logs-${{ inputs.arch }}-${{ inputs.toolchain_full }}-${{ inputs.test }}
+          if-no-files-found: ignore
+          path: /tmp/tmon_pcap/*
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
new file mode 100644
index 0000000000000..1c910fd297309
--- /dev/null
+++ b/.github/workflows/lint.yml
@@ -0,0 +1,65 @@
+name: "lint"
+
+on:
+  pull_request:
+  push:
+    branches:
+      - master
+
+jobs:
+  shellcheck:
+    # This workflow gets injected into other Linux repositories, but we don't
+    # want it to run there.
+    if: ${{ github.repository == 'kernel-patches/vmtest' }}
+    name: ShellCheck
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Run ShellCheck
+        uses: ludeeus/action-shellcheck@master
+        env:
+          SHELLCHECK_OPTS: --severity=warning --exclude=SC1091
+
+  # Ensure some consistency in the formatting.
+  lint:
+    if: ${{ github.repository == 'kernel-patches/vmtest' }}
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Run black
+        uses: psf/black@stable
+        with:
+          src: ./.github/scripts
+
+  validate_matrix:
+    if: ${{ github.repository == 'kernel-patches/vmtest' }}
+    name: Validate matrix.py
+    runs-on: ubuntu-latest
+    env:
+      GITHUB_REPOSITORY_OWNER: ${{ matrix.owner }}
+      GITHUB_REPOSITORY: ${{ matrix.repository }}
+      GITHUB_OUTPUT: /dev/stdout
+    strategy:
+      matrix:
+        owner: ['kernel-patches', 'foo']
+        repository: ['bpf', 'vmtest', 'bar']
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: run script
+        run: |
+          python3 .github/scripts/matrix.py
+
+  unittests:
+    if: ${{ github.repository == 'kernel-patches/vmtest' }}
+    name: Unittests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Run unittests
+        run: python3 -m unittest scripts/tests/*.py
+        working-directory: .github
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
new file mode 100644
index 0000000000000..24773459a252d
--- /dev/null
+++ b/.github/workflows/test.yml
@@ -0,0 +1,73 @@
+name: bpf-ci
+
+on:
+  pull_request:
+  push:
+    branches:
+      - bpf_base
+      - bpf-next_base
+      - bpf-net_base
+      - for-next_base
+
+concurrency:
+  group: ci-test-${{ github.ref_name }}
+  cancel-in-progress: true
+
+jobs:
+  set-matrix:
+    # FIXME: set-matrix is lightweight, run it on any self-hosted machines for kernel-patches org
+    # so we do not wait for GH hosted runners when there potentially all are busy because of bpf-rc
+    # repo for instance.
+    # This could be somehow fixed long term by making this action/workflow re-usable and letting the called
+    # specify what to run on.
+    runs-on: ${{ github.repository_owner == 'kernel-patches' && 'x86_64' || 'ubuntu-latest' }}
+    permissions: read-all
+    outputs:
+      build-matrix: ${{ steps.set-matrix-impl.outputs.build_matrix }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: |
+            .github
+            ci
+      - name: Install script dependencies
+        shell: bash
+        run: |
+          sudo apt-get -y update
+          sudo apt-get -y install python3-requests
+      - id: set-matrix-impl
+        env:
+          GITHUB_TOKEN: ${{ secrets.GH_PAT_READ_RUNNERS }}
+        run: |
+          python3 .github/scripts/matrix.py
+
+  build-and-test:
+    # Setting name to arch-compiler here to avoid lengthy autogenerated names due to matrix
+    # e.g build-and-test x86_64-gcc / test (test_progs_parallel, true, 30) / test_progs_parallel on x86_64 with gcc
+    name: ${{ matrix.arch }} ${{ matrix.kernel_compiler }}-${{ matrix.kernel_compiler == 'gcc' && matrix.gcc_version || matrix.llvm_version }}
+    uses: ./.github/workflows/kernel-build-test.yml
+    needs: [set-matrix]
+    permissions:
+      id-token: write
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJSON(needs.set-matrix.outputs.build-matrix) }}
+    with:
+      arch: ${{ matrix.arch }}
+      toolchain: ${{ matrix.kernel_compiler }}
+      toolchain_full: ${{ matrix.kernel_compiler }}-${{ matrix.kernel_compiler == 'gcc' && matrix.gcc_version || matrix.llvm_version }}
+      runs_on: ${{ toJSON(matrix.runs_on) }}
+      build_runs_on: ${{ toJSON(matrix.build_runs_on) }}
+      gcc_version: ${{ matrix.gcc_version }}
+      llvm_version: ${{ matrix.llvm_version }}
+      kernel: ${{ matrix.kernel }}
+      tests: ${{ toJSON(matrix.tests) }}
+      run_veristat: ${{ matrix.run_veristat }}
+      # We only run tests on pull requests.
+      run_tests: ${{ github.event_name != 'push' }}
+      # Download sources
+      download_sources: ${{ github.repository == 'kernel-patches/vmtest' }}
+      build_release: ${{ matrix.build_release }}
+    secrets:
+      AWS_ROLE_ARN: ${{ secrets.AWS_ROLE_ARN }}
diff --git a/.github/workflows/veristat-kernel.yml b/.github/workflows/veristat-kernel.yml
new file mode 100644
index 0000000000000..8c9ba715bf277
--- /dev/null
+++ b/.github/workflows/veristat-kernel.yml
@@ -0,0 +1,66 @@
+name: veristat_kernel
+
+on:
+  workflow_call:
+    inputs:
+      arch:
+        required: true
+        type: string
+        description: The architecture to build against, e.g x86_64, aarch64, s390x...
+      toolchain_full:
+        required: true
+        type: string
+        description: Toolchain identifier, such as llvm-20
+      runs_on:
+        required: true
+        type: string
+        description: The runners to run the test on. This is a json string representing an array of labels.
+
+jobs:
+  veristat:
+    name: veristat-kernel
+    runs-on: ${{ fromJSON(inputs.runs_on) }}
+    timeout-minutes: 100
+    permissions:
+        id-token: write
+        contents: read
+    env:
+      KERNEL: LATEST
+      REPO_ROOT: ${{ github.workspace }}
+      REPO_PATH: ""
+      KBUILD_OUTPUT: kbuild-output/
+      ARCH_AND_TOOL: ${{ inputs.arch }}-${{ inputs.toolchain_full }}
+      VERISTAT_DUMP_LOG_ON_FAILURE: 'true'
+      VERISTAT_TARGET: kernel
+
+    steps:
+
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: |
+            .github
+            ci
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: vmlinux-${{ env.ARCH_AND_TOOL }}
+          path: .
+
+      - name: Untar artifacts
+        run: zstd -d -T0  vmlinux-${{ env.ARCH_AND_TOOL }}.tar.zst --stdout | tar -xf -
+
+      - name: Run veristat
+        uses: libbpf/ci/run-vmtest@v3
+        with:
+          arch: x86_64
+          vmlinuz: '${{ github.workspace }}/vmlinuz'
+          kernel-root: '.'
+          max-cpu: 8
+          kernel-test: 'run_veristat'
+          output-dir: '${{ github.workspace }}'
+
+      - name: Compare and save veristat.kernel.csv
+        uses: ./.github/actions/veristat_baseline_compare
+        with:
+          veristat_output: veristat-kernel
+          baseline_name: ${{ env.ARCH_AND_TOOL}}-baseline-veristat-kernel
diff --git a/.github/workflows/veristat-meta.yml b/.github/workflows/veristat-meta.yml
new file mode 100644
index 0000000000000..675127d322491
--- /dev/null
+++ b/.github/workflows/veristat-meta.yml
@@ -0,0 +1,88 @@
+name: veristat_meta
+
+on:
+  workflow_call:
+    inputs:
+      arch:
+        required: true
+        type: string
+        description: The architecture to build against, e.g x86_64, aarch64, s390x...
+      toolchain_full:
+        required: true
+        type: string
+        description: Toolchain identifier, such as llvm-20
+      runs_on:
+        required: true
+        type: string
+        description: The runners to run the test on. This is a json string representing an array of labels.
+      aws_region:
+        required: true
+        type: string
+        description: The AWS region where we pull bpf objects to run against veristat.
+    secrets:
+        AWS_ROLE_ARN:
+            required: true
+            description: The AWS role used by GH to pull BPF objects from AWS.
+
+jobs:
+  veristat:
+    name: veristat-meta
+    runs-on: ${{ fromJSON(inputs.runs_on) }}
+    timeout-minutes: 100
+    permissions:
+        id-token: write
+        contents: read
+    env:
+      KERNEL: LATEST
+      REPO_ROOT: ${{ github.workspace }}
+      REPO_PATH: ""
+      KBUILD_OUTPUT: kbuild-output/
+      ARCH_AND_TOOL: ${{ inputs.arch }}-${{ inputs.toolchain_full }}
+      VERISTAT_TARGET: meta
+
+    steps:
+
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: |
+            .github
+            ci
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: vmlinux-${{ env.ARCH_AND_TOOL }}
+          path: .
+
+      - name: Untar artifacts
+        run: zstd -d -T0  vmlinux-${{ env.ARCH_AND_TOOL }}.tar.zst --stdout | tar -xf -
+
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v3
+        with:
+          aws-region: ${{ inputs.aws_region }}
+          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
+          role-session-name: github-action-bpf-ci
+
+      - name: Download BPF objects
+        run: |
+          mkdir ./bpf_objects
+          aws s3 sync s3://veristat-bpf-binaries ./bpf_objects
+        env:
+          AWS_ROLE_ARN: ${{ secrets.AWS_ROLE_ARN }}
+
+      - name: Run veristat
+        uses: libbpf/ci/run-vmtest@v3
+        with:
+          arch: x86_64
+          vmlinuz: '${{ github.workspace }}/vmlinuz'
+          kernel-root: '.'
+          max-cpu: 8
+          kernel-test: 'run_veristat'
+          output-dir: '${{ github.workspace }}'
+
+      - name: Compare and save veristat.meta.csv
+        uses: ./.github/actions/veristat_baseline_compare
+        with:
+          veristat_output: veristat-meta
+          baseline_name: ${{ env.ARCH_AND_TOOL}}-baseline-veristat-meta
+
diff --git a/.github/workflows/veristat-scx.yml b/.github/workflows/veristat-scx.yml
new file mode 100644
index 0000000000000..4c6c42dea1872
--- /dev/null
+++ b/.github/workflows/veristat-scx.yml
@@ -0,0 +1,103 @@
+name: veristat_kernel
+
+on:
+  workflow_call:
+    inputs:
+      arch:
+        required: true
+        type: string
+        description: The architecture to build against, e.g x86_64, aarch64, s390x...
+      toolchain_full:
+        required: true
+        type: string
+        description: Toolchain identifier, such as llvm-20
+      runs_on:
+        required: true
+        type: string
+        description: The runners to run the test on. This is a json string representing an array of labels.
+      llvm_version:
+        required: true
+        type: string
+
+jobs:
+
+  build-scheds:
+    name: build sched-ext/scx
+    runs-on: ${{ fromJSON(inputs.runs_on) }}
+    env:
+      LLVM_VERSION: ${{ inputs.llvm_version }}
+      SCX_BUILD_OUTPUT: ${{ github.workspace }}/scx-build-output
+      SCX_PROGS: ${{ github.workspace }}/scx-progs
+      SCX_REVISION: 5c4575195fe1
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: |
+            .github
+            ci
+      - uses: libbpf/ci/build-scx-scheds@v3
+        with:
+          output-dir: ${{ env.SCX_BUILD_OUTPUT }}
+      - name: Collect scx progs
+        run: ${{ github.workspace }}/.github/scripts/collect-scx-bpf-progs.sh ${{ env.SCX_PROGS }}
+      - name: Upload scx progs
+        uses: actions/upload-artifact@v4
+        with:
+          name: scx-progs-${{ inputs.arch }}-${{ inputs.toolchain_full }}
+          if-no-files-found: error
+          path: ${{ env.SCX_PROGS }}
+
+  veristat:
+    name: veristat-scx
+    runs-on: ${{ fromJSON(inputs.runs_on) }}
+    needs: [build-scheds]
+    permissions:
+        id-token: write
+        contents: read
+    env:
+      KERNEL: LATEST
+      REPO_ROOT: ${{ github.workspace }}
+      REPO_PATH: ""
+      KBUILD_OUTPUT: kbuild-output/
+      ARCH_AND_TOOL: ${{ inputs.arch }}-${{ inputs.toolchain_full }}
+      VERISTAT_DUMP_LOG_ON_FAILURE: 'true'
+      VERISTAT_TARGET: scx
+      SCX_PROGS: ${{ github.workspace }}/scx-progs
+
+    steps:
+
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: |
+            .github
+            ci
+
+      - name: Download kernel build artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: vmlinux-${{ env.ARCH_AND_TOOL }}
+          path: .
+
+      - name: Untar kernel build artifacts
+        run: zstd -d -T0  vmlinux-${{ env.ARCH_AND_TOOL }}.tar.zst --stdout | tar -xf -
+
+      - name: Download scx progs
+        uses: actions/download-artifact@v4
+        with:
+          name: scx-progs-${{ inputs.arch }}-${{ inputs.toolchain_full }}
+          path: ${{ env.SCX_PROGS }}
+
+      - name: Run veristat
+        uses: libbpf/ci/run-vmtest@v3
+        with:
+          arch: x86_64
+          vmlinuz: '${{ github.workspace }}/vmlinuz'
+          kernel-root: '.'
+          kernel-test: 'run_veristat'
+          output-dir: '${{ github.workspace }}'
+
+      - name: Compare and save veristat.scx.csv
+        uses: ./.github/actions/veristat_baseline_compare
+        with:
+          veristat_output: veristat-scx
+          baseline_name: ${{ env.ARCH_AND_TOOL}}-baseline-veristat-scx
diff --git a/README.md b/README.md
new file mode 100644
index 0000000000000..81a0c1a644b0f
--- /dev/null
+++ b/README.md
@@ -0,0 +1,22 @@
+# BPF CI GitHub Actions worfklows
+
+This repository contains GitHub Actions workflow definitions, scripts and configuration files used by those workflows.
+
+You can check the workflow runs on [kernel-patches/bpf actions page](https://github.com/kernel-patches/bpf/actions/workflows/test.yml). 
+
+**"BPF CI"** refers to a continuous integration testing system targeting [BPF subsystem of the Linux Kernel](https://ebpf.io/what-is-ebpf/).
+
+BPF CI consists of a number of components:
+- [kernel-patches/bpf](https://github.com/kernel-patches/bpf) - a copy of Linux Kernel source repository tracking [upstream bpf trees](https://web.git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/)
+- [Kernel Patches Daemon](https://github.com/kernel-patches/kernel-patches-daemon) instance - a service connecting [Patchwork](https://patchwork.kernel.org/project/netdevbpf/list/) with the GitHub repository
+- [kernel-patches/vmtest](https://github.com/kernel-patches/vmtest) (this repository) - GitHub Actions workflows
+- [libbpf/ci](https://github.com/libbpf/ci) - custom reusable GitHub Actions
+- [kernel-patches/runner](https://github.com/kernel-patches/runner) - self-hosted GitHub Actions runners
+
+Of course BPF CI also has important dependencies such as:
+- [selftests/bpf](https://web.git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/tree/tools/testing/selftests/bpf) - the main test suite of BPF CI
+- [selftests/sched_ext](https://web.git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/tree/tools/testing/selftests/sched_ext) - in-kernel sched_ext test suite
+- [veristat](https://web.git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/tree/tools/testing/selftests/bpf/veristat.c) - used to catch performance and BPF verification regressions on a suite of complex BPF programs
+- [vmtest](https://github.com/danobi/vmtest) - a QEMU wrapper, used to execute tests in a VM
+- [GCC BPF backend](https://gcc.gnu.org/wiki/BPFBackEnd)
+- Above-mentioned [Patchwork](https://patchwork.kernel.org/) instance, maintained by the Linux Foundation
diff --git a/ci/claude/README.md b/ci/claude/README.md
new file mode 100644
index 0000000000000..669b942d0c15e
--- /dev/null
+++ b/ci/claude/README.md
@@ -0,0 +1,67 @@
+# AI Code Reviews in BPF CI
+
+## TL;DR
+- **Please make sure AI is actually wrong before dismissing the review**
+  - An email response explaining why AI is wrong would be very helpful
+- BPF CI includes [a workflow](https://github.com/kernel-patches/vmtest/blob/master/.github/workflows/ai-code-review.yml) running AI code review
+- The reviews are posted as comments on [kernel-patches/bpf PRs](https://github.com/kernel-patches/bpf/pulls)
+- The review comments are forwarded to the patch recipients via email by [KPD](https://github.com/kernel-patches/kernel-patches-daemon)
+- Prompts are here: https://github.com/masoncl/review-prompts
+
+If you received an AI review for your patch submission, please try to evaluate it in the same way you would if it was written by a person, and respond.
+Your response is for humans, not for AI.
+
+## How does it work?
+
+BPF CI is processing every patch series submitted to the [Linux Kernel BPF mailing list](https://lore.kernel.org/bpf/).
+Against each patch the system executes various tests, such as [selftests/bpf](https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/tree/tools/testing/selftests/bpf), and since recently it also executes automated code reviews performed by LLM-based AI.
+
+BPF CI runs on [Github Actions](https://docs.github.com/en/actions) workflows orchestrated by [KPD](https://github.com/kernel-patches/kernel-patches-daemon).
+
+The AI review is implemented with [Claude Code GitHub Action](https://github.com/anthropics/claude-code-action), which essentially installs Claude Code command-line app and a MCP server with a number of common tools available to it.
+
+LLMs are accessed via [AWS Bedrock](https://aws.amazon.com/bedrock), the GitHub Actions workflow authenticates to AWS account with [OIDC](https://docs.github.com/en/actions/how-tos/secure-your-work/security-harden-deployments/oidc-in-aws).
+
+To achieve the output that might have led you to this page, [a set of elaborate prompts](https://github.com/masoncl/review-prompts) were developed specifically targeting the Linux Kernel source code.
+The workflow checks out the Linux and prompts repository and initiates the review with a trivial [trigger prompt](https://github.com/kernel-patches/vmtest/blob/master/.github/workflows/ai-code-review.yml#L91-L94).
+
+### Are the reviews even accurate?
+
+We make every effort for AI reviews to be high-signal messages. Although the nature of LLMs makes them prone to mistakes.
+
+At this point this is still an experiment, but the results so far have been promising.
+For example, AI is pretty good at catching dumb mistakes (e.g. use-after-free) that humans can easily miss.
+At the same time AI can miss context obvious to a human, such as relationships between newer and older changes.
+
+If you'd like to suggest an improvement to the prompts, open a PR to [review-prompts](https://github.com/masoncl/review-prompts) repository.
+
+### Will my patch get nacked because of the AI review?
+
+Paraphrasing IBM training manual:
+> "A LLM can never be held accountable, therefore a LLM must never make an Ack/Nack decision"
+
+The review prompts are designed such that AI is only searching for the regressions it can provide evidence for.
+For the majority of patches a review is not generated, so if you received one it's worth evaluating.
+
+It's unlikely that your patch gets discarded *just* because AI found something, especially if you address it or explain why AI is wrong.
+
+But if you ignore an AI review, human reviewers will likely ask for a reason.
+
+### What if I don't like it?
+
+Bring it up with the maintainers on the mailing list and elaborate.
+
+It is expected that AI may be mistaken. However it is also expected that the patch authors answer reasonable questions about the code changes they propose.
+
+If there is a technical issue (say with email notifications, formatting etc.), open an issue in [this repository](https://github.com/kernel-patches/vmtest/issues).
+
+### Who pays for the tokens?
+
+[Meta Platforms, Inc.](https://www.meta.com/)
+
+BPF CI in its current form has been developed and maintained by the Linux Kernel team at Meta. Most of the relevant hardware is also provided by Meta.
+
+### Who set this up?
+
+- [Chris Mason](https://github.com/masoncl) is the prompt engineer
+- [Ihor Solodrai](https://github.com/theihor) is the infra plumber
diff --git a/ci/claude/post-pr-comment.js b/ci/claude/post-pr-comment.js
new file mode 100644
index 0000000000000..218b7709c26c5
--- /dev/null
+++ b/ci/claude/post-pr-comment.js
@@ -0,0 +1,33 @@
+module.exports = async ({github, context}) => {
+  const fs = require('fs');
+
+  const jobSummaryUrl = `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}`;
+  const reviewContent = fs.readFileSync(process.env.REVIEW_FILE, 'utf8');
+  const subject = process.env.PATCH_SUBJECT || 'Could not determine patch subject';
+  const commentBody = `
+\`\`\`
+${reviewContent}
+\`\`\`
+
+---
+AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
+See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
+
+In-Reply-To-Subject: \`${subject}\`
+CI run summary: ${jobSummaryUrl}
+`;
+
+  await github.rest.issues.createComment({
+    issue_number: context.issue.number,
+    owner: context.repo.owner,
+    repo: context.repo.repo,
+    body: commentBody
+  });
+
+  await github.rest.issues.addLabels({
+    issue_number: context.issue.number,
+    owner: context.repo.owner,
+    repo: context.repo.repo,
+    labels: ["ai-review"],
+  });
+};
diff --git a/ci/claude/settings.json b/ci/claude/settings.json
new file mode 100644
index 0000000000000..06717188a9631
--- /dev/null
+++ b/ci/claude/settings.json
@@ -0,0 +1,7 @@
+{
+  "model": "us.anthropic.claude-sonnet-4-5-20250929-v1:0",
+  "permissions": {
+    "allow": ["Bash", "Edit", "MultiEdit", "Write"],
+    "defaultMode": "acceptEdits"
+  }
+}
diff --git a/ci/diffs/.keep b/ci/diffs/.keep
new file mode 100644
index 0000000000000..e69de29bb2d1d
diff --git a/ci/diffs/0001-selftests-bpf-disable-detection-of-llvm-when-buildin.patch b/ci/diffs/0001-selftests-bpf-disable-detection-of-llvm-when-buildin.patch
new file mode 100644
index 0000000000000..6497a6cc38c90
--- /dev/null
+++ b/ci/diffs/0001-selftests-bpf-disable-detection-of-llvm-when-buildin.patch
@@ -0,0 +1,41 @@
+From 42839864a62ee244ec280b09149b1cb439f681db Mon Sep 17 00:00:00 2001
+From: Manu Bretelle <chantr4@gmail.com>
+Date: Fri, 27 Oct 2023 18:25:39 -0700
+Subject: [PATCH bpf-next] selftests/bpf: disable detection of llvm when
+ building bpftool
+
+The VMs in which we run the selftests do not have llvm installed.
+We build selftests/bpftool in a host that have llvm.
+bpftool currently will use llvm first and fallback to libbfd but there
+is no way to disable detection from the command line.
+
+Removing it from the feature detection should force us to use libbfd.
+
+Signed-off-by: Manu Bretelle <chantr4@gmail.com>
+---
+ tools/bpf/bpftool/Makefile | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/tools/bpf/bpftool/Makefile b/tools/bpf/bpftool/Makefile
+index e9154ace80ff..01314458e25e 100644
+--- a/tools/bpf/bpftool/Makefile
++++ b/tools/bpf/bpftool/Makefile
+@@ -95,7 +95,6 @@ RM ?= rm -f
+ FEATURE_USER = .bpftool
+ 
+ FEATURE_TESTS := clang-bpf-co-re
+-FEATURE_TESTS += llvm
+ FEATURE_TESTS += libcap
+ FEATURE_TESTS += libbfd
+ FEATURE_TESTS += libbfd-liberty
+@@ -104,7 +103,6 @@ FEATURE_TESTS += disassembler-four-args
+ FEATURE_TESTS += disassembler-init-styled
+ 
+ FEATURE_DISPLAY := clang-bpf-co-re
+-FEATURE_DISPLAY += llvm
+ FEATURE_DISPLAY += libcap
+ FEATURE_DISPLAY += libbfd
+ FEATURE_DISPLAY += libbfd-liberty
+-- 
+2.39.3
+
diff --git a/ci/diffs/0001-selftests-bpf-work-around-latest-Clang-smartness.patch b/ci/diffs/0001-selftests-bpf-work-around-latest-Clang-smartness.patch
new file mode 100644
index 0000000000000..ec1e29a8ab974
--- /dev/null
+++ b/ci/diffs/0001-selftests-bpf-work-around-latest-Clang-smartness.patch
@@ -0,0 +1,31 @@
+From d31a7125891994681503770cff46a119692fb2b9 Mon Sep 17 00:00:00 2001
+From: Andrii Nakryiko <andrii@kernel.org>
+Date: Mon, 11 Dec 2023 17:09:38 -0800
+Subject: [PATCH 1/1] selftests/bpf: work around latest Clang smartness
+
+Work around the issue while we deal with it in the Clang itself.
+See [0].
+
+  [0] https://github.com/llvm/llvm-project/pull/73662#issuecomment-1849281758
+
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+---
+ tools/testing/selftests/bpf/progs/iters.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/progs/iters.c b/tools/testing/selftests/bpf/progs/iters.c
+index 3aca3dc145b5..929ba6fa2105 100644
+--- a/tools/testing/selftests/bpf/progs/iters.c
++++ b/tools/testing/selftests/bpf/progs/iters.c
+@@ -1420,7 +1420,7 @@ SEC("raw_tp")
+ __success
+ int iter_arr_with_actual_elem_count(const void *ctx)
+ {
+-	int i, n = loop_data.n, sum = 0;
++	unsigned i, n = loop_data.n, sum = 0;
+ 
+ 	if (n > ARRAY_SIZE(loop_data.data))
+ 		return 0;
+-- 
+2.34.1
+
diff --git a/ci/diffs/20251014-selftests-arg_parsing-Ensure-data-is-flushed-to-.patch b/ci/diffs/20251014-selftests-arg_parsing-Ensure-data-is-flushed-to-.patch
new file mode 100644
index 0000000000000..efcdbeed208fc
--- /dev/null
+++ b/ci/diffs/20251014-selftests-arg_parsing-Ensure-data-is-flushed-to-.patch
@@ -0,0 +1,33 @@
+From 423112d2e9b591999efa4ad74000f8f6f3f381ea Mon Sep 17 00:00:00 2001
+From: Xing Guo <higuoxing@gmail.com>
+Date: Tue, 14 Oct 2025 16:03:23 +0800
+Subject: [PATCH 20251015/20251015] selftests: arg_parsing: Ensure data is
+ flushed to disk before reading.
+
+Recently, I noticed a selftest failure in my local environment. The
+test_parse_test_list_file writes some data to
+/tmp/bpf_arg_parsing_test.XXXXXX and parse_test_list_file() will read
+the data back.  However, after writing data to that file, we forget to
+call fsync() and it's causing testing failure in my laptop.  This patch
+helps fix it by adding the missing fsync() call.
+
+Signed-off-by: Xing Guo <higuoxing@gmail.com>
+---
+ tools/testing/selftests/bpf/prog_tests/arg_parsing.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/arg_parsing.c b/tools/testing/selftests/bpf/prog_tests/arg_parsing.c
+index fbf0d9c2f58b..d9fcbfb72aaa 100644
+--- a/tools/testing/selftests/bpf/prog_tests/arg_parsing.c
++++ b/tools/testing/selftests/bpf/prog_tests/arg_parsing.c
+@@ -140,6 +140,7 @@ static void test_parse_test_list_file(void)
+ 	fprintf(fp, "testA/subtest2\n");
+ 	fprintf(fp, "testC_no_eof_newline");
+ 	fflush(fp);
++	fsync(fd);
+ 
+ 	if (!ASSERT_OK(ferror(fp), "prepare tmp"))
+ 		goto out_fclose;
+-- 
+2.51.0
+
diff --git a/ci/diffs/20251014-selftests-bpf-make-arg_parsing.c-more-robust-to-.patch b/ci/diffs/20251014-selftests-bpf-make-arg_parsing.c-more-robust-to-.patch
new file mode 100644
index 0000000000000..34104b3fc9ad8
--- /dev/null
+++ b/ci/diffs/20251014-selftests-bpf-make-arg_parsing.c-more-robust-to-.patch
@@ -0,0 +1,56 @@
+From 8a03969566c5447aa72469e8f09b8158e3dad8f9 Mon Sep 17 00:00:00 2001
+From: Andrii Nakryiko <andrii@kernel.org>
+Date: Tue, 14 Oct 2025 13:20:37 -0700
+Subject: [PATCH 20251014/20251015] selftests/bpf: make arg_parsing.c more
+ robust to crashes
+
+We started getting a crash in BPF CI, which seems to originate from
+test_parse_test_list_file() test and is happening at this line:
+
+  ASSERT_OK(strcmp("test_with_spaces", set.tests[0].name), "test 0 name");
+
+One way we can crash there is if set.cnt zero, which is checked for with
+ASSERT_EQ() above, but we proceed after this regardless of the outcome.
+Instead of crashing, we should bail out with test failure early.
+
+Similarly, if parse_test_list_file() fails, we shouldn't be even looking
+at set, so bail even earlier if ASSERT_OK() fails.
+
+Fixes: 64276f01dce8 ("selftests/bpf: Test_progs can read test lists from file")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+---
+ tools/testing/selftests/bpf/prog_tests/arg_parsing.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/arg_parsing.c b/tools/testing/selftests/bpf/prog_tests/arg_parsing.c
+index bb143de68875..fbf0d9c2f58b 100644
+--- a/tools/testing/selftests/bpf/prog_tests/arg_parsing.c
++++ b/tools/testing/selftests/bpf/prog_tests/arg_parsing.c
+@@ -146,9 +146,12 @@ static void test_parse_test_list_file(void)
+ 
+ 	init_test_filter_set(&set);
+ 
+-	ASSERT_OK(parse_test_list_file(tmpfile, &set, true), "parse file");
++	if (!ASSERT_OK(parse_test_list_file(tmpfile, &set, true), "parse file"))
++		goto out_fclose;
++
++	if (!ASSERT_EQ(set.cnt, 4, "test  count"))
++		goto out_free_set;
+ 
+-	ASSERT_EQ(set.cnt, 4, "test  count");
+ 	ASSERT_OK(strcmp("test_with_spaces", set.tests[0].name), "test 0 name");
+ 	ASSERT_EQ(set.tests[0].subtest_cnt, 0, "test 0 subtest count");
+ 	ASSERT_OK(strcmp("testA", set.tests[1].name), "test 1 name");
+@@ -158,8 +161,8 @@ static void test_parse_test_list_file(void)
+ 	ASSERT_OK(strcmp("testB", set.tests[2].name), "test 2 name");
+ 	ASSERT_OK(strcmp("testC_no_eof_newline", set.tests[3].name), "test 3 name");
+ 
++out_free_set:
+ 	free_test_filter_set(&set);
+-
+ out_fclose:
+ 	fclose(fp);
+ out_remove:
+-- 
+2.51.0
+
diff --git a/ci/vmtest/configs/DENYLIST b/ci/vmtest/configs/DENYLIST
new file mode 100644
index 0000000000000..20a090295a607
--- /dev/null
+++ b/ci/vmtest/configs/DENYLIST
@@ -0,0 +1,17 @@
+# TEMPORARY
+btf_dump/btf_dump: syntax
+kprobe_multi_bench_attach
+core_reloc/enum64val
+core_reloc/size___diff_sz
+core_reloc/type_based___diff_sz
+test_ima	# All of CI is broken on it following 6.3-rc1 merge
+lwt_reroute      # crashes kernel after netnext merge from 2ab1efad60ad "net/sched: cls_api: complement tcf_tfilter_dump_policy"
+tc_links_ingress # started failing after net-next merge from 2ab1efad60ad "net/sched: cls_api: complement tcf_tfilter_dump_policy"
+xdp_bonding/xdp_bonding_features     # started failing after net merge from 359e54a93ab4 "l2tp: pass correct message length to ip6_append_data"
+tc_redirect/tc_redirect_dtime # uapi breakage after net-next commit 885c36e59f46 ("net: Re-use and set mono_delivery_time bit for userspace tstamp packets")
+migrate_reuseport/IPv4 TCP_NEW_SYN_RECV reqsk_timer_handler # flaky, under investigation
+migrate_reuseport/IPv6 TCP_NEW_SYN_RECV reqsk_timer_handler # flaky, under investigation
+connect_force_port # unreliably fails
+sockmap_ktls/sockmap_ktls disconnect_after_delete* # https://lore.kernel.org/bpf/20250415163332.1836826-1-ihor.solodrai@linux.dev/
+verif_scale_pyperf600 # llvm 20 generates code that fails verification
+arena_spin_lock # llvm 20 generates code that fails verification
diff --git a/ci/vmtest/configs/DENYLIST.aarch64 b/ci/vmtest/configs/DENYLIST.aarch64
new file mode 100644
index 0000000000000..bdce99f3855ec
--- /dev/null
+++ b/ci/vmtest/configs/DENYLIST.aarch64
@@ -0,0 +1,5 @@
+cgrp_local_storage                  # libbpf: prog 'update_cookie_tracing': failed to attach: ERROR: strerror_r(-524)=22
+core_reloc_btfgen                   # run_core_reloc_tests:FAIL:run_btfgen unexpected error: 32512 (errno 22)
+usdt/multispec                      # usdt_300_bad_attach unexpected pointer: 0x558c63d8f0
+xdp_bonding                         # whole test suite is very unstable on aarch64
+res_spin_lock_success               # flaky
diff --git a/ci/vmtest/configs/DENYLIST.rc b/ci/vmtest/configs/DENYLIST.rc
new file mode 100644
index 0000000000000..8aa33e6b71443
--- /dev/null
+++ b/ci/vmtest/configs/DENYLIST.rc
@@ -0,0 +1,3 @@
+send_signal/send_signal_nmi            # PMU events configure correctly but don't trigger NMI's for some reason (AMD nested virt)
+send_signal/send_signal_nmi_thread     # Same as above
+token/obj_priv_implicit_token_envvar   # Unknown root cause, but reliably fails
diff --git a/ci/vmtest/configs/DENYLIST.s390x b/ci/vmtest/configs/DENYLIST.s390x
new file mode 100644
index 0000000000000..2203f3f1b3e26
--- /dev/null
+++ b/ci/vmtest/configs/DENYLIST.s390x
@@ -0,0 +1,12 @@
+deny_namespace                           # not yet in bpf denylist
+tc_redirect/tc_redirect_dtime            # very flaky
+lru_bug                                  # not yet in bpf-next denylist
+# Disabled temporarily for a crash.
+# https://lore.kernel.org/bpf/c9923c1d-971d-4022-8dc8-1364e929d34c@gmail.com/
+dummy_st_ops/dummy_init_ptr_arg
+fexit_bpf2bpf
+tailcalls
+trace_ext
+xdp_bpf2bpf
+xdp_metadata
+log_buf # fails with segfault, needs investigation
diff --git a/ci/vmtest/configs/DENYLIST.test_progs-bpf_gcc b/ci/vmtest/configs/DENYLIST.test_progs-bpf_gcc
new file mode 100644
index 0000000000000..a3c745d1f5b52
--- /dev/null
+++ b/ci/vmtest/configs/DENYLIST.test_progs-bpf_gcc
@@ -0,0 +1,904 @@
+arena_htab
+async_stack_depth
+bad_struct_ops/invalid_prog_reuse
+bpf_cookie
+bpf_iter/bpf_hash_map
+bpf_iter/ksym
+bpf_iter/tcp4
+bpf_iter/tcp6
+bpf_iter/udp4
+bpf_iter/udp6
+bpf_iter/unix
+bpf_iter_setsockopt
+bpf_iter_setsockopt_unix
+bpf_mod_race
+bpf_nf/tc-bpf-ct
+bpf_nf/xdp-ct
+bpf_tcp_ca/cubic
+btf_dump/btf_dump: bitfields
+btf_dump/btf_dump: packing
+btf_dump/btf_dump: padding
+btf_dump/btf_dump: syntax
+btf_map_in_map
+cb_refs
+cgroup_get_current_cgroup_id
+cgroup_iter/cgroup_iter__self_only_css_task
+cgroup_tcp_skb
+cgrp_kfunc
+cls_redirect/cls_redirect_dynptr
+connect_force_port
+core_autosize
+core_read_macros
+core_reloc/type_id
+core_reloc/type_id___missing_targets
+core_reloc_btfgen/type_id
+core_reloc_btfgen/type_id___missing_targets
+cpumask/test_acquire_wrong_cpumask
+cpumask/test_alloc_double_release
+cpumask/test_alloc_free_cpumask
+cpumask/test_alloc_no_release
+cpumask/test_and_or_xor
+cpumask/test_copy_any_anyand
+cpumask/test_cpumask_null
+cpumask/test_cpumask_weight
+cpumask/test_first_firstzero_cpu
+cpumask/test_firstand_nocpu
+cpumask/test_global_mask_array_l2_rcu
+cpumask/test_global_mask_array_one_rcu
+cpumask/test_global_mask_array_rcu
+cpumask/test_global_mask_nested_deep_array_rcu
+cpumask/test_global_mask_nested_deep_rcu
+cpumask/test_global_mask_nested_rcu
+cpumask/test_global_mask_no_null_check
+cpumask/test_global_mask_out_of_rcu
+cpumask/test_global_mask_rcu
+cpumask/test_global_mask_rcu_no_null_check
+cpumask/test_insert_leave
+cpumask/test_insert_remove_no_release
+cpumask/test_insert_remove_release
+cpumask/test_intersects_subset
+cpumask/test_invalid_nested_array
+cpumask/test_mutate_cpumask
+cpumask/test_set_clear_cpu
+cpumask/test_setall_clear_cpu
+cpumask/test_test_and_set_clear
+crypto_basic/crypto_acquire
+crypto_sanity
+deny_namespace
+dummy_st_ops/test_unsupported_field_sleepable
+dynptr/add_dynptr_to_map1
+dynptr/add_dynptr_to_map2
+dynptr/clone_invalid1
+dynptr/clone_invalid2
+dynptr/clone_invalidate1
+dynptr/clone_invalidate2
+dynptr/clone_invalidate3
+dynptr/clone_invalidate4
+dynptr/clone_invalidate5
+dynptr/clone_invalidate6
+dynptr/clone_skb_packet_data
+dynptr/clone_xdp_packet_data
+dynptr/data_slice_missing_null_check1
+dynptr/data_slice_missing_null_check2
+dynptr/data_slice_out_of_bounds_map_value
+dynptr/data_slice_out_of_bounds_ringbuf
+dynptr/data_slice_out_of_bounds_skb
+dynptr/data_slice_use_after_release1
+dynptr/data_slice_use_after_release2
+dynptr/dynptr_adjust_invalid
+dynptr/dynptr_from_mem_invalid_api
+dynptr/dynptr_invalidate_slice_failure
+dynptr/dynptr_invalidate_slice_or_null
+dynptr/dynptr_invalidate_slice_reinit
+dynptr/dynptr_is_null_invalid
+dynptr/dynptr_is_rdonly_invalid
+dynptr/dynptr_overwrite_ref
+dynptr/dynptr_partial_slot_invalidate
+dynptr/dynptr_pruning_overwrite
+dynptr/dynptr_pruning_type_confusion
+dynptr/dynptr_read_into_slot
+dynptr/dynptr_size_invalid
+dynptr/dynptr_slice_var_len1
+dynptr/dynptr_slice_var_len2
+dynptr/dynptr_var_off_overwrite
+dynptr/global
+dynptr/invalid_data_slices
+dynptr/invalid_helper1
+dynptr/invalid_helper2
+dynptr/invalid_offset
+dynptr/invalid_read1
+dynptr/invalid_read2
+dynptr/invalid_read3
+dynptr/invalid_read4
+dynptr/invalid_slice_rdwr_rdonly
+dynptr/invalid_write1
+dynptr/invalid_write2
+dynptr/invalid_write3
+dynptr/invalid_write4
+dynptr/release_twice
+dynptr/release_twice_callback
+dynptr/ringbuf_invalid_api
+dynptr/ringbuf_missing_release1
+dynptr/ringbuf_missing_release2
+dynptr/ringbuf_missing_release_callback
+dynptr/ringbuf_release_uninit_dynptr
+dynptr/skb_invalid_ctx
+dynptr/skb_invalid_ctx_fentry
+dynptr/skb_invalid_ctx_fexit
+dynptr/skb_invalid_data_slice1
+dynptr/skb_invalid_data_slice2
+dynptr/skb_invalid_data_slice3
+dynptr/skb_invalid_data_slice4
+dynptr/skb_invalid_slice_write
+dynptr/test_dynptr_reg_type
+dynptr/test_dynptr_skb_no_buff
+dynptr/test_dynptr_skb_small_buff
+dynptr/test_dynptr_skb_tp_btf
+dynptr/test_read_write
+dynptr/uninit_write_into_slot
+dynptr/use_after_invalid
+dynptr/xdp_invalid_ctx
+dynptr/xdp_invalid_data_slice1
+dynptr/xdp_invalid_data_slice2
+exceptions/check_assert_eq_int_max
+exceptions/check_assert_eq_int_min
+exceptions/check_assert_eq_llong_max
+exceptions/check_assert_eq_llong_min
+exceptions/check_assert_eq_zero
+exceptions/check_assert_ge_neg
+exceptions/check_assert_ge_pos
+exceptions/check_assert_ge_zero
+exceptions/check_assert_generic
+exceptions/check_assert_gt_neg
+exceptions/check_assert_gt_pos
+exceptions/check_assert_gt_zero
+exceptions/check_assert_le_neg
+exceptions/check_assert_le_pos
+exceptions/check_assert_le_zero
+exceptions/check_assert_lt_neg
+exceptions/check_assert_lt_pos
+exceptions/check_assert_lt_zero
+exceptions/check_assert_range_s64
+exceptions/check_assert_range_u64
+exceptions/check_assert_single_range_s64
+exceptions/check_assert_single_range_u64
+exceptions/check_assert_with_return
+exceptions/exception_ext
+exceptions/exception_ext_mod_cb_runtime
+exceptions/non-throwing extension -> non-throwing subprog
+exceptions/non-throwing extension -> throwing global subprog
+exceptions/non-throwing fentry -> exception_cb
+exceptions/non-throwing fexit -> exception_cb
+exceptions/non-throwing fmod_ret -> non-throwing global subprog
+exceptions/reject_async_callback_throw
+exceptions/reject_exception_throw_cb
+exceptions/reject_exception_throw_cb_diff
+exceptions/reject_set_exception_cb_bad_ret2
+exceptions/reject_subprog_with_lock
+exceptions/reject_subprog_with_rcu_read_lock
+exceptions/reject_with_cb
+exceptions/reject_with_cb_reference
+exceptions/reject_with_lock
+exceptions/reject_with_rbtree_add_throw
+exceptions/reject_with_rcu_read_lock
+exceptions/reject_with_reference
+exceptions/reject_with_subprog_reference
+exceptions/throwing extension (with custom cb) -> exception_cb
+exceptions/throwing extension -> global func in exception_cb
+exceptions/throwing extension -> non-throwing global subprog
+exceptions/throwing extension -> throwing global subprog
+exceptions/throwing fentry -> exception_cb
+exceptions/throwing fexit -> exception_cb
+failures_wq
+fexit_bpf2bpf/fmod_ret_freplace
+fexit_bpf2bpf/func_replace
+fexit_bpf2bpf/func_replace_global_func
+fexit_bpf2bpf/func_replace_multi
+fexit_bpf2bpf/func_sockmap_update
+fexit_bpf2bpf/target_yes_callees
+global_func_dead_code
+global_map_resize
+inner_array_lookup
+irq/irq_flag_overwrite
+irq/irq_flag_overwrite_partial
+irq/irq_global_subprog
+irq/irq_ooo_refs_array
+irq/irq_restore_4_subprog
+irq/irq_restore_bad_arg
+irq/irq_restore_invalid
+irq/irq_restore_iter
+irq/irq_restore_missing_1_subprog
+irq/irq_restore_missing_2
+irq/irq_restore_missing_2_subprog
+irq/irq_restore_missing_3
+irq/irq_restore_missing_3_minus_2
+irq/irq_restore_missing_3_minus_2_subprog
+irq/irq_restore_missing_3_subprog
+irq/irq_restore_ooo
+irq/irq_restore_ooo_3
+irq/irq_restore_ooo_3_subprog
+irq/irq_save_bad_arg
+irq/irq_save_invalid
+irq/irq_save_iter
+irq/irq_sleepable_helper
+irq/irq_sleepable_kfunc
+iters/compromise_iter_w_direct_write_and_skip_destroy_fail
+iters/compromise_iter_w_direct_write_fail
+iters/compromise_iter_w_helper_write_fail
+iters/create_and_forget_to_destroy_fail
+iters/css_task
+iters/delayed_precision_mark
+iters/delayed_read_mark
+iters/destroy_without_creating_fail
+iters/double_create_fail
+iters/double_destroy_fail
+iters/iter_css_lock_and_unlock
+iters/iter_css_task_for_each
+iters/iter_css_without_lock
+iters/iter_destroy_bad_arg
+iters/iter_err_too_permissive1
+iters/iter_err_too_permissive2
+iters/iter_err_too_permissive3
+iters/iter_err_unsafe_asm_loop
+iters/iter_err_unsafe_c_loop
+iters/iter_nested_iters
+iters/iter_new_bad_arg
+iters/iter_next_bad_arg
+iters/iter_next_ptr_mem_not_trusted
+iters/iter_next_rcu_not_trusted
+iters/iter_next_rcu_or_null
+iters/iter_next_trusted_or_null
+iters/iter_obfuscate_counter
+iters/iter_subprog_iters
+iters/iter_tasks_lock_and_unlock
+iters/iter_tasks_without_lock
+iters/leak_iter_from_subprog_fail
+iters/loop_state_deps1
+iters/loop_state_deps2
+iters/missing_null_check_fail
+iters/next_after_destroy_fail
+iters/next_without_new_fail
+iters/read_from_iter_slot_fail
+iters/stacksafe_should_not_conflate_stack_spill_and_iter
+iters/testmod_seq_getter_after_bad
+iters/testmod_seq_getter_before_bad
+iters/wrong_sized_read_fail
+jeq_infer_not_null
+jit_probe_mem
+kfree_skb
+kfunc_call/kfunc_call_ctx
+kfunc_call/kfunc_call_test1
+kfunc_call/kfunc_call_test2
+kfunc_call/kfunc_call_test4
+kfunc_call/kfunc_call_test_get_mem
+kfunc_call/kfunc_call_test_ref_btf_id
+kfunc_call/kfunc_call_test_static_unused_arg
+kfunc_call/kfunc_syscall_test
+kfunc_call/kfunc_syscall_test_null
+kfunc_dynptr_param/not_ptr_to_stack
+kfunc_dynptr_param/not_valid_dynptr
+kfunc_param_nullable/kfunc_dynptr_nullable_test3
+kprobe_multi_test/kprobe_session_return_2
+kptr_xchg_inline
+l4lb_all/l4lb_noinline
+l4lb_all/l4lb_noinline_dynptr
+linked_list
+local_kptr_stash/drop_rb_node_off
+local_kptr_stash/local_kptr_stash_local_with_root
+local_kptr_stash/local_kptr_stash_plain
+local_kptr_stash/local_kptr_stash_simple
+local_kptr_stash/local_kptr_stash_unstash
+local_kptr_stash/refcount_acquire_without_unstash
+local_kptr_stash/stash_rb_nodes
+log_buf/obj_load_log_buf
+log_fixup/bad_core_relo_subprog
+log_fixup/bad_core_relo_trunc_full
+lru_bug
+map_btf
+map_in_map/acc_map_in_array
+map_in_map/acc_map_in_htab
+map_in_map/sleepable_acc_map_in_array
+map_in_map/sleepable_acc_map_in_htab
+map_kptr/correct_btf_id_check_size
+map_kptr/inherit_untrusted_on_walk
+map_kptr/kptr_xchg_possibly_null
+map_kptr/kptr_xchg_ref_state
+map_kptr/mark_ref_as_untrusted_or_null
+map_kptr/marked_as_untrusted_or_null
+map_kptr/non_const_var_off
+map_kptr/non_const_var_off_kptr_xchg
+map_kptr/reject_bad_type_xchg
+map_kptr/reject_kptr_xchg_on_unref
+map_kptr/reject_member_of_ref_xchg
+map_kptr/reject_untrusted_xchg
+map_kptr/success-map
+map_ptr
+nested_trust/test_invalid_nested_user_cpus
+nested_trust/test_invalid_skb_field
+percpu_alloc/array
+percpu_alloc/array_sleepable
+percpu_alloc/cgrp_local_storage
+percpu_alloc/test_array_map_1
+percpu_alloc/test_array_map_2
+percpu_alloc/test_array_map_3
+percpu_alloc/test_array_map_4
+percpu_alloc/test_array_map_5
+percpu_alloc/test_array_map_6
+percpu_alloc/test_array_map_7
+percpu_alloc/test_array_map_8
+perf_branches/perf_branches_no_hw
+pkt_access
+preempt_lock/preempt_global_subprog_test
+preempt_lock/preempt_lock_missing_1
+preempt_lock/preempt_lock_missing_1_subprog
+preempt_lock/preempt_lock_missing_2
+preempt_lock/preempt_lock_missing_2_minus_1_subprog
+preempt_lock/preempt_lock_missing_2_subprog
+preempt_lock/preempt_lock_missing_3
+preempt_lock/preempt_lock_missing_3_minus_2
+preempt_lock/preempt_sleepable_helper
+preempt_lock/preempt_sleepable_kfunc
+preempted_bpf_ma_op
+prog_run_opts
+prog_tests_framework
+raw_tp_null
+rbtree_fail
+rbtree_success
+recursion
+refcounted_kptr
+refcounted_kptr_fail
+refcounted_kptr_wrong_owner
+reference_tracking/sk_lookup_success
+ringbuf_multi
+setget_sockopt
+sk_lookup
+skc_to_unix_sock
+sock_addr/recvmsg4: attach prog with wrong attach type
+sock_addr/recvmsg4: recvfrom (dgram)
+sock_addr/recvmsg6: attach prog with wrong attach type
+sock_addr/recvmsg6: recvfrom (dgram)
+sock_addr/sendmsg4: attach prog with wrong attach type
+sock_addr/sendmsg4: kernel_sendmsg (dgram)
+sock_addr/sendmsg4: kernel_sendmsg deny (dgram)
+sock_addr/sendmsg4: sendmsg (dgram)
+sock_addr/sendmsg4: sendmsg deny (dgram)
+sock_addr/sendmsg4: sock_sendmsg (dgram)
+sock_addr/sendmsg4: sock_sendmsg deny (dgram)
+sock_addr/sendmsg6: attach prog with wrong attach type
+sock_addr/sendmsg6: kernel_sendmsg (dgram)
+sock_addr/sendmsg6: kernel_sendmsg [::] (BSD'ism) (dgram)
+sock_addr/sendmsg6: kernel_sendmsg deny (dgram)
+sock_addr/sendmsg6: sendmsg (dgram)
+sock_addr/sendmsg6: sendmsg IPv4-mapped IPv6 (dgram)
+sock_addr/sendmsg6: sendmsg [::] (BSD'ism) (dgram)
+sock_addr/sendmsg6: sendmsg deny (dgram)
+sock_addr/sendmsg6: sendmsg dst IP = [::] (BSD'ism) (dgram)
+sock_addr/sendmsg6: sock_sendmsg (dgram)
+sock_addr/sendmsg6: sock_sendmsg [::] (BSD'ism) (dgram)
+sock_addr/sendmsg6: sock_sendmsg deny (dgram)
+sock_destroy/trace_tcp_destroy_sock
+sock_fields
+sockmap_listen/sockhash IPv4 TCP test_reuseport_mixed_groups
+sockmap_listen/sockhash IPv4 TCP test_reuseport_select_connected
+sockmap_listen/sockhash IPv4 UDP test_reuseport_mixed_groups
+sockmap_listen/sockhash IPv4 UDP test_reuseport_select_connected
+sockmap_listen/sockhash IPv6 TCP test_reuseport_mixed_groups
+sockmap_listen/sockhash IPv6 TCP test_reuseport_select_connected
+sockmap_listen/sockhash IPv6 UDP test_reuseport_mixed_groups
+sockmap_listen/sockhash IPv6 UDP test_reuseport_select_connected
+sockmap_listen/sockmap IPv4 TCP test_reuseport_mixed_groups
+sockmap_listen/sockmap IPv4 TCP test_reuseport_select_connected
+sockmap_listen/sockmap IPv4 UDP test_reuseport_mixed_groups
+sockmap_listen/sockmap IPv4 UDP test_reuseport_select_connected
+sockmap_listen/sockmap IPv6 TCP test_reuseport_mixed_groups
+sockmap_listen/sockmap IPv6 TCP test_reuseport_select_connected
+sockmap_listen/sockmap IPv6 UDP test_reuseport_mixed_groups
+sockmap_listen/sockmap IPv6 UDP test_reuseport_select_connected
+spin_lock
+struct_ops_module/unsupported_ops
+syscall
+tailcalls/classifier_0
+tailcalls/classifier_1
+tailcalls/reject_tail_call_preempt_lock
+tailcalls/reject_tail_call_rcu_lock
+tailcalls/reject_tail_call_ref
+tailcalls/reject_tail_call_spin_lock
+tailcalls/tailcall_6
+tailcalls/tailcall_bpf2bpf_2
+tailcalls/tailcall_bpf2bpf_3
+tailcalls/tailcall_bpf2bpf_fentry
+tailcalls/tailcall_bpf2bpf_fentry_entry
+tailcalls/tailcall_bpf2bpf_fentry_fexit
+tailcalls/tailcall_bpf2bpf_fexit
+tailcalls/tailcall_bpf2bpf_hierarchy_2
+tailcalls/tailcall_bpf2bpf_hierarchy_3
+task_kfunc
+task_local_storage/uptr_across_pages
+task_local_storage/uptr_basic
+task_local_storage/uptr_kptr_xchg
+task_local_storage/uptr_map_failure_e2big
+task_local_storage/uptr_map_failure_kstruct
+task_local_storage/uptr_map_failure_size0
+task_local_storage/uptr_no_null_check
+task_local_storage/uptr_obj_new
+task_local_storage/uptr_update_failure
+tc_bpf/tc_bpf_non_root
+tc_redirect/tc_redirect_dtime
+tcp_custom_syncookie
+tcp_hdr_options
+test_bpf_ma
+test_global_funcs/arg_tag_ctx_kprobe
+test_global_funcs/arg_tag_ctx_perf
+test_global_funcs/arg_tag_ctx_raw_tp
+test_global_funcs/global_func1
+test_global_funcs/global_func10
+test_global_funcs/global_func11
+test_global_funcs/global_func12
+test_global_funcs/global_func13
+test_global_funcs/global_func14
+test_global_funcs/global_func15
+test_global_funcs/global_func15_tricky_pruning
+test_global_funcs/global_func17
+test_global_funcs/global_func3
+test_global_funcs/global_func5
+test_global_funcs/global_func6
+test_global_funcs/global_func7
+test_lsm/lsm_basic
+test_profiler
+test_strncmp/strncmp_bad_not_null_term_target
+timer
+timer_mim
+token
+tp_btf_nullable/handle_tp_btf_nullable_bare1
+tunnel
+uprobe_multi_test/uprobe_sesison_return_2
+user_ringbuf/user_ringbuf_callback_bad_access1
+user_ringbuf/user_ringbuf_callback_bad_access2
+user_ringbuf/user_ringbuf_callback_const_ptr_to_dynptr_reg_off
+user_ringbuf/user_ringbuf_callback_discard_dynptr
+user_ringbuf/user_ringbuf_callback_invalid_return
+user_ringbuf/user_ringbuf_callback_null_context_read
+user_ringbuf/user_ringbuf_callback_null_context_write
+user_ringbuf/user_ringbuf_callback_reinit_dynptr_mem
+user_ringbuf/user_ringbuf_callback_reinit_dynptr_ringbuf
+user_ringbuf/user_ringbuf_callback_submit_dynptr
+user_ringbuf/user_ringbuf_callback_write_forbidden
+verif_scale_pyperf100
+verif_scale_pyperf180
+verif_scale_pyperf600
+verif_scale_pyperf600_nounroll
+verif_scale_seg6_loop
+verif_scale_strobemeta
+verif_scale_strobemeta_nounroll1
+verif_scale_strobemeta_nounroll2
+verif_scale_strobemeta_subprogs
+verif_scale_sysctl_loop1
+verif_scale_sysctl_loop2
+verif_scale_xdp_loop
+verifier_and/invalid_and_of_negative_number
+verifier_and/invalid_range_check
+verifier_arena/iter_maps2
+verifier_arena/iter_maps3
+verifier_array_access/a_read_only_array_1_2
+verifier_array_access/a_read_only_array_2_2
+verifier_array_access/a_write_only_array_1_2
+verifier_array_access/a_write_only_array_2_2
+verifier_array_access/an_array_with_a_constant_2
+verifier_array_access/an_array_with_a_register_2
+verifier_array_access/an_array_with_a_variable_2
+verifier_array_access/array_with_no_floor_check
+verifier_array_access/with_a_invalid_max_check_1
+verifier_array_access/with_a_invalid_max_check_2
+verifier_basic_stack/invalid_fp_arithmetic
+verifier_basic_stack/misaligned_read_from_stack
+verifier_basic_stack/stack_out_of_bounds
+verifier_bitfield_write
+verifier_bits_iter/destroy_uninit
+verifier_bits_iter/next_uninit
+verifier_bits_iter/no_destroy
+verifier_bounds/bounds_map_value_variant_1
+verifier_bounds/bounds_map_value_variant_2
+verifier_bounds/of_boundary_crossing_range_1
+verifier_bounds/of_boundary_crossing_range_2
+verifier_bounds/on_sign_extended_mov_test1
+verifier_bounds/on_sign_extended_mov_test2
+verifier_bounds/reg32_any_reg32_xor_3
+verifier_bounds/reg_any_reg_xor_3
+verifier_bounds/shift_of_maybe_negative_number
+verifier_bounds/shift_with_64_bit_input
+verifier_bounds/shift_with_oversized_count_operand
+verifier_bounds/size_signed_32bit_overflow_test1
+verifier_bounds/size_signed_32bit_overflow_test2
+verifier_bounds/size_signed_32bit_overflow_test3
+verifier_bounds/size_signed_32bit_overflow_test4
+verifier_bounds/var_off_insn_off_test1
+verifier_bounds/var_off_insn_off_test2
+verifier_bounds_deduction/deducing_bounds_from_const_1
+verifier_bounds_deduction/deducing_bounds_from_const_10
+verifier_bounds_deduction/deducing_bounds_from_const_3
+verifier_bounds_deduction/deducing_bounds_from_const_5
+verifier_bounds_deduction/deducing_bounds_from_const_6
+verifier_bounds_deduction/deducing_bounds_from_const_7
+verifier_bounds_deduction/deducing_bounds_from_const_8
+verifier_bounds_deduction/deducing_bounds_from_const_9
+verifier_bounds_mix_sign_unsign/checks_mixing_signed_and_unsigned
+verifier_bounds_mix_sign_unsign/signed_and_unsigned_positive_bounds
+verifier_bounds_mix_sign_unsign/signed_and_unsigned_variant_10
+verifier_bounds_mix_sign_unsign/signed_and_unsigned_variant_11
+verifier_bounds_mix_sign_unsign/signed_and_unsigned_variant_12
+verifier_bounds_mix_sign_unsign/signed_and_unsigned_variant_13
+verifier_bounds_mix_sign_unsign/signed_and_unsigned_variant_14
+verifier_bounds_mix_sign_unsign/signed_and_unsigned_variant_15
+verifier_bounds_mix_sign_unsign/signed_and_unsigned_variant_2
+verifier_bounds_mix_sign_unsign/signed_and_unsigned_variant_3
+verifier_bounds_mix_sign_unsign/signed_and_unsigned_variant_5
+verifier_bounds_mix_sign_unsign/signed_and_unsigned_variant_6
+verifier_bounds_mix_sign_unsign/signed_and_unsigned_variant_8
+verifier_btf_ctx_access/ctx_access_u32_pointer_reject_16
+verifier_btf_ctx_access/ctx_access_u32_pointer_reject_32
+verifier_btf_ctx_access/ctx_access_u32_pointer_reject_8
+verifier_cfg/conditional_loop
+verifier_cfg/loop2_back_edge
+verifier_cfg/loop_back_edge
+verifier_cfg/out_of_range_jump
+verifier_cfg/out_of_range_jump2
+verifier_cfg/uncond_loop_after_cond_jmp
+verifier_cfg/uncond_loop_in_subprog_after_cond_jmp
+verifier_cfg/unreachable
+verifier_cfg/unreachable2
+verifier_cgroup_inv_retcode/with_invalid_return_code_test1
+verifier_cgroup_inv_retcode/with_invalid_return_code_test3
+verifier_cgroup_inv_retcode/with_invalid_return_code_test5
+verifier_cgroup_inv_retcode/with_invalid_return_code_test6
+verifier_cgroup_inv_retcode/with_invalid_return_code_test7
+verifier_cgroup_skb/data_meta_for_cgroup_skb
+verifier_cgroup_skb/flow_keys_for_cgroup_skb
+verifier_cgroup_skb/napi_id_for_cgroup_skb
+verifier_cgroup_skb/tc_classid_for_cgroup_skb
+verifier_cgroup_storage/cpu_cgroup_storage_access_1
+verifier_cgroup_storage/cpu_cgroup_storage_access_2
+verifier_cgroup_storage/cpu_cgroup_storage_access_3
+verifier_cgroup_storage/cpu_cgroup_storage_access_4
+verifier_cgroup_storage/cpu_cgroup_storage_access_5
+verifier_cgroup_storage/cpu_cgroup_storage_access_6
+verifier_cgroup_storage/invalid_cgroup_storage_access_1
+verifier_cgroup_storage/invalid_cgroup_storage_access_2
+verifier_cgroup_storage/invalid_cgroup_storage_access_3
+verifier_cgroup_storage/invalid_cgroup_storage_access_4
+verifier_cgroup_storage/invalid_cgroup_storage_access_5
+verifier_cgroup_storage/invalid_cgroup_storage_access_6
+verifier_const/bprm
+verifier_const/tcx1
+verifier_const/tcx4
+verifier_const/tcx7
+verifier_const_or/not_bypass_stack_boundary_checks_1
+verifier_const_or/not_bypass_stack_boundary_checks_2
+verifier_ctx/context_stores_via_bpf_atomic
+verifier_ctx/ctx_pointer_to_helper_1
+verifier_ctx/ctx_pointer_to_helper_2
+verifier_ctx/ctx_pointer_to_helper_3
+verifier_ctx/make_ptr_to_ctx_unusable
+verifier_ctx/null_check_4_ctx_const
+verifier_ctx/null_check_8_null_bind
+verifier_ctx/or_null_check_3_1
+verifier_ctx_sk_msg/of_size_in_sk_msg
+verifier_ctx_sk_msg/past_end_of_sk_msg
+verifier_ctx_sk_msg/read_offset_in_sk_msg
+verifier_d_path/d_path_reject
+verifier_direct_packet_access/access_test15_spill_with_xadd
+verifier_direct_packet_access/direct_packet_access_test3
+verifier_direct_packet_access/id_in_regsafe_bad_access
+verifier_direct_packet_access/packet_access_test10_write_invalid
+verifier_direct_packet_access/pkt_end_reg_bad_access
+verifier_direct_packet_access/pkt_end_reg_both_accesses
+verifier_direct_packet_access/test16_arith_on_data_end
+verifier_direct_packet_access/test23_x_pkt_ptr_4
+verifier_direct_packet_access/test26_marking_on_bad_access
+verifier_direct_packet_access/test28_marking_on_bad_access
+verifier_direct_stack_access_wraparound
+verifier_global_ptr_args
+verifier_global_subprogs
+verifier_helper_access_var_len/bitwise_and_jmp_wrong_max
+verifier_helper_access_var_len/jmp_signed_no_min_check
+verifier_helper_access_var_len/map_adjusted_jmp_wrong_max
+verifier_helper_access_var_len/memory_map_jmp_wrong_max
+verifier_helper_access_var_len/memory_stack_jmp_bounds_offset
+verifier_helper_access_var_len/memory_stack_jmp_wrong_max
+verifier_helper_access_var_len/ptr_to_mem_or_null_2
+verifier_helper_access_var_len/ptr_to_mem_or_null_8
+verifier_helper_access_var_len/ptr_to_mem_or_null_9
+verifier_helper_access_var_len/stack_jmp_no_max_check
+verifier_helper_packet_access/cls_helper_fail_range_1
+verifier_helper_packet_access/cls_helper_fail_range_2
+verifier_helper_packet_access/cls_helper_fail_range_3
+verifier_helper_packet_access/packet_ptr_with_bad_range_1
+verifier_helper_packet_access/packet_ptr_with_bad_range_2
+verifier_helper_packet_access/packet_test2_unchecked_packet_ptr
+verifier_helper_packet_access/ptr_with_too_short_range_1
+verifier_helper_packet_access/ptr_with_too_short_range_2
+verifier_helper_packet_access/test11_cls_unsuitable_helper_1
+verifier_helper_packet_access/test12_cls_unsuitable_helper_2
+verifier_helper_packet_access/test15_cls_helper_fail_sub
+verifier_helper_packet_access/test20_pkt_end_as_input
+verifier_helper_packet_access/test7_cls_unchecked_packet_ptr
+verifier_helper_packet_access/to_packet_test21_wrong_reg
+verifier_helper_restricted
+verifier_helper_value_access/access_to_map_empty_range
+verifier_helper_value_access/access_to_map_negative_range
+verifier_helper_value_access/access_to_map_possibly_empty_range
+verifier_helper_value_access/access_to_map_wrong_size
+verifier_helper_value_access/bounds_check_using_bad_access_1
+verifier_helper_value_access/bounds_check_using_bad_access_2
+verifier_helper_value_access/check_using_s_bad_access_1
+verifier_helper_value_access/check_using_s_bad_access_2
+verifier_helper_value_access/const_imm_negative_range_adjustment_1
+verifier_helper_value_access/const_imm_negative_range_adjustment_2
+verifier_helper_value_access/const_reg_negative_range_adjustment_1
+verifier_helper_value_access/const_reg_negative_range_adjustment_2
+verifier_helper_value_access/imm_out_of_bound_1
+verifier_helper_value_access/imm_out_of_bound_2
+verifier_helper_value_access/imm_out_of_bound_range
+verifier_helper_value_access/map_out_of_bound_range
+verifier_helper_value_access/map_via_variable_empty_range
+verifier_helper_value_access/reg_out_of_bound_1
+verifier_helper_value_access/reg_out_of_bound_2
+verifier_helper_value_access/reg_out_of_bound_range
+verifier_helper_value_access/via_const_imm_empty_range
+verifier_helper_value_access/via_const_reg_empty_range
+verifier_helper_value_access/via_variable_no_max_check_1
+verifier_helper_value_access/via_variable_no_max_check_2
+verifier_helper_value_access/via_variable_wrong_max_check_1
+verifier_helper_value_access/via_variable_wrong_max_check_2
+verifier_int_ptr/arg_ptr_to_long_misaligned
+verifier_int_ptr/to_long_size_sizeof_long
+verifier_iterating_callbacks/bpf_loop_iter_limit_overflow
+verifier_iterating_callbacks/check_add_const_3regs
+verifier_iterating_callbacks/check_add_const_3regs_2if
+verifier_iterating_callbacks/check_add_const_regsafe_off
+verifier_iterating_callbacks/iter_limit_bug
+verifier_iterating_callbacks/jgt_imm64_and_may_goto
+verifier_iterating_callbacks/loop_detection
+verifier_iterating_callbacks/may_goto_self
+verifier_iterating_callbacks/unsafe_find_vma
+verifier_iterating_callbacks/unsafe_for_each_map_elem
+verifier_iterating_callbacks/unsafe_on_2nd_iter
+verifier_iterating_callbacks/unsafe_on_zero_iter
+verifier_iterating_callbacks/unsafe_ringbuf_drain
+verifier_jeq_infer_not_null/unchanged_for_jeq_false_branch
+verifier_jeq_infer_not_null/unchanged_for_jne_true_branch
+verifier_kfunc_prog_types/cgrp_kfunc_raw_tp
+verifier_kfunc_prog_types/cpumask_kfunc_raw_tp
+verifier_kfunc_prog_types/task_kfunc_raw_tp
+verifier_ld_ind/ind_check_calling_conv_r1
+verifier_ld_ind/ind_check_calling_conv_r2
+verifier_ld_ind/ind_check_calling_conv_r3
+verifier_ld_ind/ind_check_calling_conv_r4
+verifier_ld_ind/ind_check_calling_conv_r5
+verifier_leak_ptr/leak_pointer_into_ctx_1
+verifier_leak_ptr/leak_pointer_into_ctx_2
+verifier_linked_scalars
+verifier_loops1/bounded_recursion
+verifier_loops1/infinite_loop_in_two_jumps
+verifier_loops1/infinite_loop_three_jump_trick
+verifier_loops1/loop_after_a_conditional_jump
+verifier_lsm/bool_retval_test3
+verifier_lsm/bool_retval_test4
+verifier_lsm/disabled_hook_test1
+verifier_lsm/disabled_hook_test2
+verifier_lsm/disabled_hook_test3
+verifier_lsm/errno_zero_retval_test4
+verifier_lsm/errno_zero_retval_test5
+verifier_lsm/errno_zero_retval_test6
+verifier_lwt/not_permitted_for_lwt_prog
+verifier_lwt/packet_write_for_lwt_in
+verifier_lwt/packet_write_for_lwt_out
+verifier_lwt/tc_classid_for_lwt_in
+verifier_lwt/tc_classid_for_lwt_out
+verifier_lwt/tc_classid_for_lwt_xmit
+verifier_map_in_map/invalid_inner_map_pointer
+verifier_map_in_map/on_the_inner_map_pointer
+verifier_map_ptr/bpf_map_ptr_write_rejected
+verifier_map_ptr/read_non_existent_field_rejected
+verifier_map_ptr/read_with_negative_offset_rejected
+verifier_map_ptr_mixing
+verifier_map_ret_val
+verifier_meta_access/meta_access_test10
+verifier_meta_access/meta_access_test2
+verifier_meta_access/meta_access_test3
+verifier_meta_access/meta_access_test4
+verifier_meta_access/meta_access_test5
+verifier_meta_access/meta_access_test6
+verifier_meta_access/meta_access_test9
+verifier_netfilter_ctx/with_invalid_ctx_access_test1
+verifier_netfilter_ctx/with_invalid_ctx_access_test2
+verifier_netfilter_ctx/with_invalid_ctx_access_test3
+verifier_netfilter_ctx/with_invalid_ctx_access_test4
+verifier_netfilter_ctx/with_invalid_ctx_access_test5
+verifier_netfilter_retcode/with_invalid_return_code_test1
+verifier_netfilter_retcode/with_invalid_return_code_test4
+verifier_or_jmp32_k
+verifier_prevent_map_lookup
+verifier_raw_stack/bytes_spilled_regs_corruption_2
+verifier_raw_stack/load_bytes_invalid_access_1
+verifier_raw_stack/load_bytes_invalid_access_2
+verifier_raw_stack/load_bytes_invalid_access_3
+verifier_raw_stack/load_bytes_invalid_access_4
+verifier_raw_stack/load_bytes_invalid_access_5
+verifier_raw_stack/load_bytes_invalid_access_6
+verifier_raw_stack/load_bytes_negative_len_2
+verifier_raw_stack/load_bytes_spilled_regs_corruption
+verifier_raw_stack/skb_load_bytes_negative_len
+verifier_raw_stack/skb_load_bytes_zero_len
+verifier_raw_tp_writable
+verifier_ref_tracking
+verifier_reg_equal/subreg_equality_2
+verifier_regalloc/regalloc_and_spill_negative
+verifier_regalloc/regalloc_negative
+verifier_regalloc/regalloc_src_reg_negative
+verifier_ringbuf/ringbuf_invalid_reservation_offset_1
+verifier_ringbuf/ringbuf_invalid_reservation_offset_2
+verifier_runtime_jit
+verifier_scalar_ids/check_ids_in_regsafe
+verifier_scalar_ids/check_ids_in_regsafe_2
+verifier_scalar_ids/linked_regs_broken_link_2
+verifier_search_pruning/for_u32_spills_u64_fill
+verifier_search_pruning/liveness_pruning_and_write_screening
+verifier_search_pruning/short_loop1
+verifier_search_pruning/should_be_verified_nop_operation
+verifier_search_pruning/tracking_for_u32_spill_fill
+verifier_search_pruning/varlen_map_value_access_pruning
+verifier_sock/bpf_sk_fullsock_skb_sk
+verifier_sock/bpf_sk_release_skb_sk
+verifier_sock/bpf_tcp_sock_skb_sk
+verifier_sock/dst_port_byte_load_invalid
+verifier_sock/dst_port_half_load_invalid_1
+verifier_sock/dst_port_half_load_invalid_2
+verifier_sock/invalidate_pkt_pointers_by_tail_call
+verifier_sock/invalidate_pkt_pointers_from_global_func
+verifier_sock/map_lookup_elem_smap_key
+verifier_sock/map_lookup_elem_sockhash_key
+verifier_sock/map_lookup_elem_sockmap_key
+verifier_sock/no_null_check_on_ret_1
+verifier_sock/no_null_check_on_ret_2
+verifier_sock/of_bpf_skc_to_helpers
+verifier_sock/post_bind4_read_mark
+verifier_sock/post_bind4_read_src_ip6
+verifier_sock/post_bind6_read_src_ip4
+verifier_sock/sk_1_1_value_1
+verifier_sock/sk_no_skb_sk_check_1
+verifier_sock/sk_no_skb_sk_check_2
+verifier_sock/sk_sk_type_fullsock_field_1
+verifier_sock/skb_sk_beyond_last_field_1
+verifier_sock/skb_sk_beyond_last_field_2
+verifier_sock/skb_sk_no_null_check
+verifier_sock/sock_create_read_src_port
+verifier_sock_addr/bind4_bad_return_code
+verifier_sock_addr/bind6_bad_return_code
+verifier_sock_addr/connect4_bad_return_code
+verifier_sock_addr/connect6_bad_return_code
+verifier_sock_addr/connect_unix_bad_return_code
+verifier_sock_addr/getpeername4_bad_return_code
+verifier_sock_addr/getpeername6_bad_return_code
+verifier_sock_addr/getpeername_unix_bad_return_code
+verifier_sock_addr/getsockname4_bad_return_code
+verifier_sock_addr/getsockname6_bad_return_code
+verifier_sock_addr/getsockname_unix_unix_bad_return_code
+verifier_sock_addr/recvmsg4_bad_return_code
+verifier_sock_addr/recvmsg6_bad_return_code
+verifier_sock_addr/recvmsg_unix_bad_return_code
+verifier_sock_addr/sendmsg4_bad_return_code
+verifier_sock_addr/sendmsg6_bad_return_code
+verifier_sock_addr/sendmsg_unix_bad_return_code
+verifier_sockmap_mutate/test_flow_dissector_update
+verifier_sockmap_mutate/test_raw_tp_delete
+verifier_sockmap_mutate/test_raw_tp_update
+verifier_sockmap_mutate/test_sockops_update
+verifier_spill_fill/_6_offset_to_skb_data
+verifier_spill_fill/addr_offset_to_skb_data
+verifier_spill_fill/check_corrupted_spill_fill
+verifier_spill_fill/fill_32bit_after_spill_64bit_clear_id
+verifier_spill_fill/spill_16bit_of_32bit_fail
+verifier_spill_fill/spill_32bit_of_64bit_fail
+verifier_spill_fill/u64_offset_to_skb_data
+verifier_spill_fill/with_invalid_reg_offset_0
+verifier_spin_lock/call_within_a_locked_region
+verifier_spin_lock/lock_test2_direct_ld_st
+verifier_spin_lock/lock_test3_direct_ld_st
+verifier_spin_lock/lock_test4_direct_ld_st
+verifier_spin_lock/lock_test7_unlock_without_lock
+verifier_spin_lock/reg_id_for_map_value
+verifier_spin_lock/spin_lock_test6_missing_unlock
+verifier_spin_lock/spin_lock_test8_double_lock
+verifier_spin_lock/spin_lock_test9_different_lock
+verifier_spin_lock/test11_ld_abs_under_lock
+verifier_stack_ptr/load_bad_alignment_on_off
+verifier_stack_ptr/load_bad_alignment_on_reg
+verifier_stack_ptr/load_out_of_bounds_high
+verifier_stack_ptr/load_out_of_bounds_low
+verifier_stack_ptr/to_stack_check_high_4
+verifier_stack_ptr/to_stack_check_high_5
+verifier_stack_ptr/to_stack_check_high_6
+verifier_stack_ptr/to_stack_check_high_7
+verifier_stack_ptr/to_stack_check_low_3
+verifier_stack_ptr/to_stack_check_low_4
+verifier_stack_ptr/to_stack_check_low_5
+verifier_stack_ptr/to_stack_check_low_6
+verifier_stack_ptr/to_stack_check_low_7
+verifier_subprog_precision/callback_precise_return_fail
+verifier_tailcall_jit
+verifier_uninit
+verifier_unpriv
+verifier_unpriv_perf
+verifier_value/store_of_cleared_call_register
+verifier_value_illegal_alu
+verifier_value_or_null/map_access_from_else_condition
+verifier_value_or_null/map_value_or_null_1
+verifier_value_or_null/map_value_or_null_2
+verifier_value_or_null/map_value_or_null_3
+verifier_value_or_null/multiple_map_lookup_elem_calls
+verifier_value_or_null/null_check_ids_in_regsafe
+verifier_value_ptr_arith/access_known_scalar_value_ptr_2
+verifier_value_ptr_arith/access_unknown_scalar_value_ptr
+verifier_value_ptr_arith/access_value_ptr_known_scalar
+verifier_value_ptr_arith/access_value_ptr_unknown_scalar
+verifier_value_ptr_arith/access_value_ptr_value_ptr_1
+verifier_value_ptr_arith/access_value_ptr_value_ptr_2
+verifier_value_ptr_arith/lower_oob_arith_test_1
+verifier_value_ptr_arith/to_leak_tainted_dst_reg
+verifier_value_ptr_arith/unknown_scalar_value_ptr_4
+verifier_value_ptr_arith/value_ptr_known_scalar_2_1
+verifier_value_ptr_arith/value_ptr_known_scalar_3
+verifier_var_off/access_max_out_of_bound
+verifier_var_off/access_min_out_of_bound
+verifier_var_off/stack_write_clobbers_spilled_regs
+verifier_var_off/variable_offset_ctx_access
+verifier_var_off/variable_offset_stack_access_unbounded
+verifier_var_off/zero_sized_access_max_out_of_bound
+verifier_vfs_reject
+verifier_xadd/xadd_w_check_unaligned_map
+verifier_xadd/xadd_w_check_unaligned_pkt
+verifier_xadd/xadd_w_check_unaligned_stack
+verifier_xdp_direct_packet_access/corner_case_1_bad_access_1
+verifier_xdp_direct_packet_access/corner_case_1_bad_access_10
+verifier_xdp_direct_packet_access/corner_case_1_bad_access_11
+verifier_xdp_direct_packet_access/corner_case_1_bad_access_12
+verifier_xdp_direct_packet_access/corner_case_1_bad_access_13
+verifier_xdp_direct_packet_access/corner_case_1_bad_access_14
+verifier_xdp_direct_packet_access/corner_case_1_bad_access_15
+verifier_xdp_direct_packet_access/corner_case_1_bad_access_16
+verifier_xdp_direct_packet_access/corner_case_1_bad_access_2
+verifier_xdp_direct_packet_access/corner_case_1_bad_access_3
+verifier_xdp_direct_packet_access/corner_case_1_bad_access_4
+verifier_xdp_direct_packet_access/corner_case_1_bad_access_5
+verifier_xdp_direct_packet_access/corner_case_1_bad_access_6
+verifier_xdp_direct_packet_access/corner_case_1_bad_access_7
+verifier_xdp_direct_packet_access/corner_case_1_bad_access_8
+verifier_xdp_direct_packet_access/corner_case_1_bad_access_9
+verifier_xdp_direct_packet_access/end_mangling_bad_access_1
+verifier_xdp_direct_packet_access/end_mangling_bad_access_2
+verifier_xdp_direct_packet_access/pkt_data_bad_access_1_1
+verifier_xdp_direct_packet_access/pkt_data_bad_access_1_2
+verifier_xdp_direct_packet_access/pkt_data_bad_access_1_3
+verifier_xdp_direct_packet_access/pkt_data_bad_access_1_4
+verifier_xdp_direct_packet_access/pkt_data_bad_access_2_1
+verifier_xdp_direct_packet_access/pkt_data_bad_access_2_2
+verifier_xdp_direct_packet_access/pkt_data_bad_access_2_3
+verifier_xdp_direct_packet_access/pkt_data_bad_access_2_4
+verifier_xdp_direct_packet_access/pkt_data_bad_access_2_5
+verifier_xdp_direct_packet_access/pkt_data_bad_access_2_6
+verifier_xdp_direct_packet_access/pkt_data_bad_access_2_7
+verifier_xdp_direct_packet_access/pkt_data_bad_access_2_8
+verifier_xdp_direct_packet_access/pkt_end_bad_access_1_1
+verifier_xdp_direct_packet_access/pkt_end_bad_access_1_2
+verifier_xdp_direct_packet_access/pkt_end_bad_access_2_1
+verifier_xdp_direct_packet_access/pkt_end_bad_access_2_2
+verifier_xdp_direct_packet_access/pkt_end_bad_access_2_3
+verifier_xdp_direct_packet_access/pkt_end_bad_access_2_4
+verifier_xdp_direct_packet_access/pkt_meta_bad_access_1_1
+verifier_xdp_direct_packet_access/pkt_meta_bad_access_1_2
+verifier_xdp_direct_packet_access/pkt_meta_bad_access_2_1
+verifier_xdp_direct_packet_access/pkt_meta_bad_access_2_2
+verifier_xdp_direct_packet_access/pkt_meta_bad_access_2_3
+verifier_xdp_direct_packet_access/pkt_meta_bad_access_2_4
+verify_pkcs7_sig
+xdp_synproxy
diff --git a/ci/vmtest/configs/DENYLIST.test_progs_cpuv4 b/ci/vmtest/configs/DENYLIST.test_progs_cpuv4
new file mode 100644
index 0000000000000..0c02eae8f5cd1
--- /dev/null
+++ b/ci/vmtest/configs/DENYLIST.test_progs_cpuv4
@@ -0,0 +1 @@
+verifier_arena/basic_alloc2
diff --git a/ci/vmtest/configs/DENYLIST.x86_64 b/ci/vmtest/configs/DENYLIST.x86_64
new file mode 100644
index 0000000000000..6fc3413daab9f
--- /dev/null
+++ b/ci/vmtest/configs/DENYLIST.x86_64
@@ -0,0 +1 @@
+netcnt              # with kvm enabled, fail with packets unexpected packets: actual 10001 != expected 10000
diff --git a/ci/vmtest/configs/config b/ci/vmtest/configs/config
new file mode 100644
index 0000000000000..7a2427b22553c
--- /dev/null
+++ b/ci/vmtest/configs/config
@@ -0,0 +1,7 @@
+CONFIG_KASAN=y
+CONFIG_KASAN_GENERIC=y
+CONFIG_KASAN_VMALLOC=y
+CONFIG_LIVEPATCH=y
+CONFIG_SAMPLES=y
+CONFIG_SAMPLE_LIVEPATCH=m
+# CONFIG_UBSAN=y
diff --git a/ci/vmtest/configs/run-vmtest.env b/ci/vmtest/configs/run-vmtest.env
new file mode 100644
index 0000000000000..c60f1db6673c7
--- /dev/null
+++ b/ci/vmtest/configs/run-vmtest.env
@@ -0,0 +1,42 @@
+#!/bin/bash
+
+# This file is sourced by libbpf/ci/run-vmtest Github Action scripts.
+#
+# The primary reason it exists is that assembling ALLOWLIST and
+# DENYLIST for a particular test run is not a trivial operation.
+#
+# Users of libbpf/ci/run-vmtest action need to be able to specify a
+# list of allow/denylist **files**, that later has to be correctly
+# merged into a single allow/denylist passed to a test runner.
+#
+# Obviously it's perferrable for the scripts merging many lists into
+# one to be reusable, and not copy-pasted between repositories which
+# use libbpf/ci actions. And specifying the lists should be trivial.
+# This file is a solution to that.
+
+# $SELFTESTS_BPF and $VMTEST_CONFIGS are set in the workflow, before
+# libbpf/ci/run-vmtest action is called
+# See .github/workflows/kernel-test.yml
+
+ALLOWLIST_FILES=(
+    "${SELFTESTS_BPF}/ALLOWLIST"
+    "${SELFTESTS_BPF}/ALLOWLIST.${ARCH}"
+    "${VMTEST_CONFIGS}/ALLOWLIST"
+    "${VMTEST_CONFIGS}/ALLOWLIST.${ARCH}"
+    "${VMTEST_CONFIGS}/ALLOWLIST.${DEPLOYMENT}"
+    "${VMTEST_CONFIGS}/ALLOWLIST.${KERNEL_TEST}"
+)
+
+DENYLIST_FILES=(
+    "${SELFTESTS_BPF}/DENYLIST"
+    "${SELFTESTS_BPF}/DENYLIST.${ARCH}"
+    "${VMTEST_CONFIGS}/DENYLIST"
+    "${VMTEST_CONFIGS}/DENYLIST.${ARCH}"
+    "${VMTEST_CONFIGS}/DENYLIST.${DEPLOYMENT}"
+    "${VMTEST_CONFIGS}/DENYLIST.${KERNEL_TEST}"
+)
+
+# Export pipe-separated strings, because bash doesn't support array export
+export SELFTESTS_BPF_ALLOWLIST_FILES=$(IFS="|"; echo "${ALLOWLIST_FILES[*]}")
+export SELFTESTS_BPF_DENYLIST_FILES=$(IFS="|"; echo "${DENYLIST_FILES[*]}")
+
diff --git a/ci/vmtest/configs/run_veristat.kernel.cfg b/ci/vmtest/configs/run_veristat.kernel.cfg
new file mode 100644
index 0000000000000..807efc251073f
--- /dev/null
+++ b/ci/vmtest/configs/run_veristat.kernel.cfg
@@ -0,0 +1,4 @@
+VERISTAT_OBJECTS_DIR="${SELFTESTS_BPF}"
+VERISTAT_OBJECTS_GLOB="*.bpf.o"
+VERISTAT_CFG_FILE="${SELFTESTS_BPF}/veristat.cfg"
+VERISTAT_OUTPUT="veristat-kernel"
diff --git a/ci/vmtest/configs/run_veristat.meta.cfg b/ci/vmtest/configs/run_veristat.meta.cfg
new file mode 100644
index 0000000000000..14f08d241d206
--- /dev/null
+++ b/ci/vmtest/configs/run_veristat.meta.cfg
@@ -0,0 +1,4 @@
+VERISTAT_OBJECTS_DIR="${WORKING_DIR}/bpf_objects"
+VERISTAT_OBJECTS_GLOB="*.o"
+VERISTAT_OUTPUT="veristat-meta"
+VERISTAT_CFG_FILE="${VERISTAT_CONFIGS}/veristat_meta.cfg"
diff --git a/ci/vmtest/configs/run_veristat.scx.cfg b/ci/vmtest/configs/run_veristat.scx.cfg
new file mode 100644
index 0000000000000..740cf8e960b32
--- /dev/null
+++ b/ci/vmtest/configs/run_veristat.scx.cfg
@@ -0,0 +1,3 @@
+VERISTAT_OBJECTS_DIR="${SCX_PROGS}"
+VERISTAT_OBJECTS_GLOB="*.bpf.o"
+VERISTAT_OUTPUT="veristat-scx"
diff --git a/ci/vmtest/configs/veristat_meta.cfg b/ci/vmtest/configs/veristat_meta.cfg
new file mode 100644
index 0000000000000..5ee6db25736d9
--- /dev/null
+++ b/ci/vmtest/configs/veristat_meta.cfg
@@ -0,0 +1,46 @@
+# List of exceptions we know about that are not going to work with veristat.
+
+# libbpf-tools, maintained outside of fbcode
+!bcc-libbpf-tools-*
+
+# missing kernel function 'bictcp_cong_avoid'
+!ti-tcpevent-tcp_bpf_state_fentry-tcp_bpf_state_fentry.bpf.o/bictcp_cong_avoid
+# missing kernel function 'bictcp_state'
+!ti-tcpevent-tcp_bpf_tracer_fentry-tcp_bpf_tracer_fentry.bpf.o/bictcp_state
+# missing kernel function 'tcp_drop'
+!ti-tcpevent-tcp_bpf_tracer_fentry-tcp_bpf_tracer_fentry.bpf.o/tcp_drop
+
+# outdated (and abandoned ?) BPF programs, can't work with modern libbpf
+!schedulers-tangram-agent-bpf-blacklist-bpf_device_cgroup-device_cgroup_filter.bpf.o
+!schedulers-tangram-agent-bpf-netstat-bpf_cgroup_egress-bpf_cgroup_egress.bpf.o
+!schedulers-tangram-agent-bpf-netstat-bpf_cgroup_ingress-bpf_cgroup_ingress.bpf.o
+
+# invalid usage of global functions, seems abandoned as well
+!neteng-urgd-urgd_bpf_prog-urgd_bpf_prog.o
+
+# missing kernel function '__send_signal'
+!cea-object-introspection-OIVT-signal_bpf-signal.bpf.o/__send_signal
+
+# Strobelight program not passing validation properly
+!strobelight-server-bpf_program-hhvm_stacks-hhvm_stacks.o/hhvm_stack
+
+# RDMA functionality is expected which we don't have in default kernel flavor
+!neteng-netedit-bpf-ftrace-be_audit-be_audit-be_audit.bpf.o
+
+# Strobelight programs with >1mln instructions
+!strobelight-server-bpf_program-strobelight_process_monitor_libbpf-strobelight_process_monitor_libbpf.o
+
+# infiniband only, doesn't work on other hardware
+!neteng-netnorad-common-cpp-bpf-qp_ah_list-qp_ah_list.bpf.o/ret_query_qp
+
+# Droplet with >1mln instructions
+!ti-droplet-bpf-vip_filter_v2_xdp-vip_filter_v2_xdp.bpf.o/vip_filter
+
+# sched_ext bpf_lib objects don't need to be verified separately
+!third-party-scx*bpf_lib.bpf.o
+
+# These cause segfault in veristat due to a bug in libbpf
+# Link: https://lore.kernel.org/bpf/20250718001009.610955-1-andrii@kernel.org/
+# We can include them back after a veristat release with fixed libbpf
+!third-party-scx-__scx_chaos_bpf_skel_genskel-bpf.bpf.o
+!third-party-scx-__scx_p2dq_bpf_skel_genskel-bpf.bpf.o
diff --git a/include/linux/bpf-cgroup.h b/include/linux/bpf-cgroup.h
index aedf573bdb426..013f4db9903fd 100644
--- a/include/linux/bpf-cgroup.h
+++ b/include/linux/bpf-cgroup.h
@@ -172,7 +172,7 @@ void bpf_cgroup_storage_link(struct bpf_cgroup_storage *storage,
 void bpf_cgroup_storage_unlink(struct bpf_cgroup_storage *storage);
 int bpf_cgroup_storage_assign(struct bpf_prog_aux *aux, struct bpf_map *map);
 
-int bpf_percpu_cgroup_storage_copy(struct bpf_map *map, void *key, void *value);
+int bpf_percpu_cgroup_storage_copy(struct bpf_map *map, void *key, void *value, u64 flags);
 int bpf_percpu_cgroup_storage_update(struct bpf_map *map, void *key,
 				     void *value, u64 flags);
 
@@ -467,7 +467,7 @@ static inline struct bpf_cgroup_storage *bpf_cgroup_storage_alloc(
 static inline void bpf_cgroup_storage_free(
 	struct bpf_cgroup_storage *storage) {}
 static inline int bpf_percpu_cgroup_storage_copy(struct bpf_map *map, void *key,
-						 void *value) {
+						 void *value, u64 flags) {
 	return 0;
 }
 static inline int bpf_percpu_cgroup_storage_update(struct bpf_map *map,
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index a9b788c7b4aa4..9e756db5e132b 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -2761,8 +2761,8 @@ int map_set_for_each_callback_args(struct bpf_verifier_env *env,
 				   struct bpf_func_state *caller,
 				   struct bpf_func_state *callee);
 
-int bpf_percpu_hash_copy(struct bpf_map *map, void *key, void *value);
-int bpf_percpu_array_copy(struct bpf_map *map, void *key, void *value);
+int bpf_percpu_hash_copy(struct bpf_map *map, void *key, void *value, u64 flags);
+int bpf_percpu_array_copy(struct bpf_map *map, void *key, void *value, u64 flags);
 int bpf_percpu_hash_update(struct bpf_map *map, void *key, void *value,
 			   u64 flags);
 int bpf_percpu_array_update(struct bpf_map *map, void *key, void *value,
@@ -3829,4 +3829,44 @@ bpf_prog_update_insn_ptrs(struct bpf_prog *prog, u32 *offsets, void *image)
 }
 #endif
 
+static inline bool bpf_map_supports_cpu_flags(enum bpf_map_type map_type)
+{
+	switch (map_type) {
+	case BPF_MAP_TYPE_PERCPU_ARRAY:
+	case BPF_MAP_TYPE_PERCPU_HASH:
+	case BPF_MAP_TYPE_LRU_PERCPU_HASH:
+	case BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE:
+		return true;
+	default:
+		return false;
+	}
+}
+
+static inline int bpf_map_check_op_flags(struct bpf_map *map, u64 flags, u64 allowed_flags)
+{
+	u32 cpu;
+
+	if ((u32)flags & ~allowed_flags)
+		return -EINVAL;
+
+	if ((flags & BPF_F_LOCK) && !btf_record_has_field(map->record, BPF_SPIN_LOCK))
+		return -EINVAL;
+
+	if (!(flags & BPF_F_CPU) && flags >> 32)
+		return -EINVAL;
+
+	if (flags & (BPF_F_CPU | BPF_F_ALL_CPUS)) {
+		if (!bpf_map_supports_cpu_flags(map->map_type))
+			return -EINVAL;
+		if ((flags & BPF_F_CPU) && (flags & BPF_F_ALL_CPUS))
+			return -EINVAL;
+
+		cpu = flags >> 32;
+		if ((flags & BPF_F_CPU) && cpu >= num_possible_cpus())
+			return -ERANGE;
+	}
+
+	return 0;
+}
+
 #endif /* _LINUX_BPF_H */
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index f5713f59ac10a..8b6279ca6e662 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -1373,6 +1373,8 @@ enum {
 	BPF_NOEXIST	= 1, /* create new element if it didn't exist */
 	BPF_EXIST	= 2, /* update existing element */
 	BPF_F_LOCK	= 4, /* spin_lock-ed map_lookup/map_update */
+	BPF_F_CPU	= 8, /* cpu flag for percpu maps, upper 32-bit of flags is a cpu number */
+	BPF_F_ALL_CPUS	= 16, /* update value across all CPUs for percpu maps */
 };
 
 /* flags for BPF_MAP_CREATE command */
diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c
index 1eeb31c5b317d..241f11d4d62a3 100644
--- a/kernel/bpf/arraymap.c
+++ b/kernel/bpf/arraymap.c
@@ -307,7 +307,7 @@ static void *percpu_array_map_lookup_percpu_elem(struct bpf_map *map, void *key,
 	return per_cpu_ptr(array->pptrs[index & array->index_mask], cpu);
 }
 
-int bpf_percpu_array_copy(struct bpf_map *map, void *key, void *value)
+int bpf_percpu_array_copy(struct bpf_map *map, void *key, void *value, u64 map_flags)
 {
 	struct bpf_array *array = container_of(map, struct bpf_array, map);
 	u32 index = *(u32 *)key;
@@ -325,11 +325,18 @@ int bpf_percpu_array_copy(struct bpf_map *map, void *key, void *value)
 	size = array->elem_size;
 	rcu_read_lock();
 	pptr = array->pptrs[index & array->index_mask];
+	if (map_flags & BPF_F_CPU) {
+		cpu = map_flags >> 32;
+		copy_map_value(map, value, per_cpu_ptr(pptr, cpu));
+		check_and_init_map_value(map, value);
+		goto unlock;
+	}
 	for_each_possible_cpu(cpu) {
 		copy_map_value_long(map, value + off, per_cpu_ptr(pptr, cpu));
 		check_and_init_map_value(map, value + off);
 		off += size;
 	}
+unlock:
 	rcu_read_unlock();
 	return 0;
 }
@@ -398,18 +405,18 @@ int bpf_percpu_array_update(struct bpf_map *map, void *key, void *value,
 	struct bpf_array *array = container_of(map, struct bpf_array, map);
 	u32 index = *(u32 *)key;
 	void __percpu *pptr;
-	int cpu, off = 0;
+	void *ptr, *val;
 	u32 size;
+	int cpu;
 
-	if (unlikely(map_flags > BPF_EXIST))
-		/* unknown flags */
+	if (unlikely(map_flags & BPF_F_LOCK))
 		return -EINVAL;
 
 	if (unlikely(index >= array->map.max_entries))
 		/* all elements were pre-allocated, cannot insert a new one */
 		return -E2BIG;
 
-	if (unlikely(map_flags == BPF_NOEXIST))
+	if (unlikely(map_flags & BPF_NOEXIST))
 		/* all elements already exist */
 		return -EEXIST;
 
@@ -422,11 +429,20 @@ int bpf_percpu_array_update(struct bpf_map *map, void *key, void *value,
 	size = array->elem_size;
 	rcu_read_lock();
 	pptr = array->pptrs[index & array->index_mask];
+	if (map_flags & BPF_F_CPU) {
+		cpu = map_flags >> 32;
+		ptr = per_cpu_ptr(pptr, cpu);
+		copy_map_value(map, ptr, value);
+		bpf_obj_free_fields(array->map.record, ptr);
+		goto unlock;
+	}
 	for_each_possible_cpu(cpu) {
-		copy_map_value_long(map, per_cpu_ptr(pptr, cpu), value + off);
-		bpf_obj_free_fields(array->map.record, per_cpu_ptr(pptr, cpu));
-		off += size;
+		ptr = per_cpu_ptr(pptr, cpu);
+		val = (map_flags & BPF_F_ALL_CPUS) ? value : value + size * cpu;
+		copy_map_value(map, ptr, val);
+		bpf_obj_free_fields(array->map.record, ptr);
 	}
+unlock:
 	rcu_read_unlock();
 	return 0;
 }
diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
index c8a9b27f8663b..c768bf71d60f0 100644
--- a/kernel/bpf/hashtab.c
+++ b/kernel/bpf/hashtab.c
@@ -932,7 +932,7 @@ static void free_htab_elem(struct bpf_htab *htab, struct htab_elem *l)
 }
 
 static void pcpu_copy_value(struct bpf_htab *htab, void __percpu *pptr,
-			    void *value, bool onallcpus)
+			    void *value, bool onallcpus, u64 map_flags)
 {
 	void *ptr;
 
@@ -943,19 +943,28 @@ static void pcpu_copy_value(struct bpf_htab *htab, void __percpu *pptr,
 		bpf_obj_free_fields(htab->map.record, ptr);
 	} else {
 		u32 size = round_up(htab->map.value_size, 8);
-		int off = 0, cpu;
+		void *val;
+		int cpu;
+
+		if (map_flags & BPF_F_CPU) {
+			cpu = map_flags >> 32;
+			ptr = per_cpu_ptr(pptr, cpu);
+			copy_map_value(&htab->map, ptr, value);
+			bpf_obj_free_fields(htab->map.record, ptr);
+			return;
+		}
 
 		for_each_possible_cpu(cpu) {
 			ptr = per_cpu_ptr(pptr, cpu);
-			copy_map_value_long(&htab->map, ptr, value + off);
+			val = (map_flags & BPF_F_ALL_CPUS) ? value : value + size * cpu;
+			copy_map_value(&htab->map, ptr, val);
 			bpf_obj_free_fields(htab->map.record, ptr);
-			off += size;
 		}
 	}
 }
 
 static void pcpu_init_value(struct bpf_htab *htab, void __percpu *pptr,
-			    void *value, bool onallcpus)
+			    void *value, bool onallcpus, u64 map_flags)
 {
 	/* When not setting the initial value on all cpus, zero-fill element
 	 * values for other cpus. Otherwise, bpf program has no way to ensure
@@ -973,7 +982,7 @@ static void pcpu_init_value(struct bpf_htab *htab, void __percpu *pptr,
 				zero_map_value(&htab->map, per_cpu_ptr(pptr, cpu));
 		}
 	} else {
-		pcpu_copy_value(htab, pptr, value, onallcpus);
+		pcpu_copy_value(htab, pptr, value, onallcpus, map_flags);
 	}
 }
 
@@ -985,7 +994,7 @@ static bool fd_htab_map_needs_adjust(const struct bpf_htab *htab)
 static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key,
 					 void *value, u32 key_size, u32 hash,
 					 bool percpu, bool onallcpus,
-					 struct htab_elem *old_elem)
+					 struct htab_elem *old_elem, u64 map_flags)
 {
 	u32 size = htab->map.value_size;
 	bool prealloc = htab_is_prealloc(htab);
@@ -1043,7 +1052,7 @@ static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key,
 			pptr = *(void __percpu **)ptr;
 		}
 
-		pcpu_init_value(htab, pptr, value, onallcpus);
+		pcpu_init_value(htab, pptr, value, onallcpus, map_flags);
 
 		if (!prealloc)
 			htab_elem_set_ptr(l_new, key_size, pptr);
@@ -1147,7 +1156,7 @@ static long htab_map_update_elem(struct bpf_map *map, void *key, void *value,
 	}
 
 	l_new = alloc_htab_elem(htab, key, value, key_size, hash, false, false,
-				l_old);
+				l_old, map_flags);
 	if (IS_ERR(l_new)) {
 		/* all pre-allocated elements are in use or memory exhausted */
 		ret = PTR_ERR(l_new);
@@ -1249,6 +1258,15 @@ static long htab_lru_map_update_elem(struct bpf_map *map, void *key, void *value
 	return ret;
 }
 
+static int htab_map_check_update_flags(bool onallcpus, u64 map_flags)
+{
+	if (unlikely(!onallcpus && map_flags > BPF_EXIST))
+		return -EINVAL;
+	if (unlikely(onallcpus && (map_flags & BPF_F_LOCK)))
+		return -EINVAL;
+	return 0;
+}
+
 static long htab_map_update_elem_in_place(struct bpf_map *map, void *key,
 					  void *value, u64 map_flags,
 					  bool percpu, bool onallcpus)
@@ -1262,9 +1280,9 @@ static long htab_map_update_elem_in_place(struct bpf_map *map, void *key,
 	u32 key_size, hash;
 	int ret;
 
-	if (unlikely(map_flags > BPF_EXIST))
-		/* unknown flags */
-		return -EINVAL;
+	ret = htab_map_check_update_flags(onallcpus, map_flags);
+	if (unlikely(ret))
+		return ret;
 
 	WARN_ON_ONCE(!bpf_rcu_lock_held());
 
@@ -1289,7 +1307,7 @@ static long htab_map_update_elem_in_place(struct bpf_map *map, void *key,
 		/* Update value in-place */
 		if (percpu) {
 			pcpu_copy_value(htab, htab_elem_get_ptr(l_old, key_size),
-					value, onallcpus);
+					value, onallcpus, map_flags);
 		} else {
 			void **inner_map_pptr = htab_elem_value(l_old, key_size);
 
@@ -1298,7 +1316,7 @@ static long htab_map_update_elem_in_place(struct bpf_map *map, void *key,
 		}
 	} else {
 		l_new = alloc_htab_elem(htab, key, value, key_size,
-					hash, percpu, onallcpus, NULL);
+					hash, percpu, onallcpus, NULL, map_flags);
 		if (IS_ERR(l_new)) {
 			ret = PTR_ERR(l_new);
 			goto err;
@@ -1324,9 +1342,9 @@ static long __htab_lru_percpu_map_update_elem(struct bpf_map *map, void *key,
 	u32 key_size, hash;
 	int ret;
 
-	if (unlikely(map_flags > BPF_EXIST))
-		/* unknown flags */
-		return -EINVAL;
+	ret = htab_map_check_update_flags(onallcpus, map_flags);
+	if (unlikely(ret))
+		return ret;
 
 	WARN_ON_ONCE(!bpf_rcu_lock_held());
 
@@ -1342,7 +1360,7 @@ static long __htab_lru_percpu_map_update_elem(struct bpf_map *map, void *key,
 	 * to remove older elem from htab and this removal
 	 * operation will need a bucket lock.
 	 */
-	if (map_flags != BPF_EXIST) {
+	if (!(map_flags & BPF_EXIST)) {
 		l_new = prealloc_lru_pop(htab, key, hash);
 		if (!l_new)
 			return -ENOMEM;
@@ -1363,10 +1381,10 @@ static long __htab_lru_percpu_map_update_elem(struct bpf_map *map, void *key,
 
 		/* per-cpu hash map can update value in-place */
 		pcpu_copy_value(htab, htab_elem_get_ptr(l_old, key_size),
-				value, onallcpus);
+				value, onallcpus, map_flags);
 	} else {
 		pcpu_init_value(htab, htab_elem_get_ptr(l_new, key_size),
-				value, onallcpus);
+				value, onallcpus, map_flags);
 		hlist_nulls_add_head_rcu(&l_new->hash_node, head);
 		l_new = NULL;
 	}
@@ -1678,9 +1696,9 @@ __htab_map_lookup_and_delete_batch(struct bpf_map *map,
 	void __user *ukeys = u64_to_user_ptr(attr->batch.keys);
 	void __user *ubatch = u64_to_user_ptr(attr->batch.in_batch);
 	u32 batch, max_count, size, bucket_size, map_id;
+	u64 elem_map_flags, map_flags, allowed_flags;
 	u32 bucket_cnt, total, key_size, value_size;
 	struct htab_elem *node_to_free = NULL;
-	u64 elem_map_flags, map_flags;
 	struct hlist_nulls_head *head;
 	struct hlist_nulls_node *n;
 	unsigned long flags = 0;
@@ -1690,9 +1708,12 @@ __htab_map_lookup_and_delete_batch(struct bpf_map *map,
 	int ret = 0;
 
 	elem_map_flags = attr->batch.elem_flags;
-	if ((elem_map_flags & ~BPF_F_LOCK) ||
-	    ((elem_map_flags & BPF_F_LOCK) && !btf_record_has_field(map->record, BPF_SPIN_LOCK)))
-		return -EINVAL;
+	allowed_flags = BPF_F_LOCK;
+	if (!do_delete && is_percpu)
+		allowed_flags |= BPF_F_CPU;
+	ret = bpf_map_check_op_flags(map, elem_map_flags, allowed_flags);
+	if (ret)
+		return ret;
 
 	map_flags = attr->batch.flags;
 	if (map_flags)
@@ -1715,7 +1736,7 @@ __htab_map_lookup_and_delete_batch(struct bpf_map *map,
 	key_size = htab->map.key_size;
 	value_size = htab->map.value_size;
 	size = round_up(value_size, 8);
-	if (is_percpu)
+	if (is_percpu && !(elem_map_flags & BPF_F_CPU))
 		value_size = size * num_possible_cpus();
 	total = 0;
 	/* while experimenting with hash tables with sizes ranging from 10 to
@@ -1798,10 +1819,17 @@ __htab_map_lookup_and_delete_batch(struct bpf_map *map,
 			void __percpu *pptr;
 
 			pptr = htab_elem_get_ptr(l, map->key_size);
-			for_each_possible_cpu(cpu) {
-				copy_map_value_long(&htab->map, dst_val + off, per_cpu_ptr(pptr, cpu));
-				check_and_init_map_value(&htab->map, dst_val + off);
-				off += size;
+			if (elem_map_flags & BPF_F_CPU) {
+				cpu = elem_map_flags >> 32;
+				copy_map_value(&htab->map, dst_val, per_cpu_ptr(pptr, cpu));
+				check_and_init_map_value(&htab->map, dst_val);
+			} else {
+				for_each_possible_cpu(cpu) {
+					copy_map_value_long(&htab->map, dst_val + off,
+							    per_cpu_ptr(pptr, cpu));
+					check_and_init_map_value(&htab->map, dst_val + off);
+					off += size;
+				}
 			}
 		} else {
 			value = htab_elem_value(l, key_size);
@@ -2357,7 +2385,7 @@ static void *htab_lru_percpu_map_lookup_percpu_elem(struct bpf_map *map, void *k
 	return NULL;
 }
 
-int bpf_percpu_hash_copy(struct bpf_map *map, void *key, void *value)
+int bpf_percpu_hash_copy(struct bpf_map *map, void *key, void *value, u64 map_flags)
 {
 	struct htab_elem *l;
 	void __percpu *pptr;
@@ -2374,16 +2402,22 @@ int bpf_percpu_hash_copy(struct bpf_map *map, void *key, void *value)
 	l = __htab_map_lookup_elem(map, key);
 	if (!l)
 		goto out;
+	ret = 0;
 	/* We do not mark LRU map element here in order to not mess up
 	 * eviction heuristics when user space does a map walk.
 	 */
 	pptr = htab_elem_get_ptr(l, map->key_size);
+	if (map_flags & BPF_F_CPU) {
+		cpu = map_flags >> 32;
+		copy_map_value(map, value, per_cpu_ptr(pptr, cpu));
+		check_and_init_map_value(map, value);
+		goto out;
+	}
 	for_each_possible_cpu(cpu) {
 		copy_map_value_long(map, value + off, per_cpu_ptr(pptr, cpu));
 		check_and_init_map_value(map, value + off);
 		off += size;
 	}
-	ret = 0;
 out:
 	rcu_read_unlock();
 	return ret;
diff --git a/kernel/bpf/local_storage.c b/kernel/bpf/local_storage.c
index c93a756e035c0..1ccbf28b2ad9f 100644
--- a/kernel/bpf/local_storage.c
+++ b/kernel/bpf/local_storage.c
@@ -180,7 +180,7 @@ static long cgroup_storage_update_elem(struct bpf_map *map, void *key,
 }
 
 int bpf_percpu_cgroup_storage_copy(struct bpf_map *_map, void *key,
-				   void *value)
+				   void *value, u64 map_flags)
 {
 	struct bpf_cgroup_storage_map *map = map_to_storage(_map);
 	struct bpf_cgroup_storage *storage;
@@ -198,12 +198,17 @@ int bpf_percpu_cgroup_storage_copy(struct bpf_map *_map, void *key,
 	 * access 'value_size' of them, so copying rounded areas
 	 * will not leak any kernel data
 	 */
+	if (map_flags & BPF_F_CPU) {
+		cpu = map_flags >> 32;
+		copy_map_value(_map, value, per_cpu_ptr(storage->percpu_buf, cpu));
+		goto unlock;
+	}
 	size = round_up(_map->value_size, 8);
 	for_each_possible_cpu(cpu) {
-		bpf_long_memcpy(value + off,
-				per_cpu_ptr(storage->percpu_buf, cpu), size);
+		copy_map_value_long(_map, value + off, per_cpu_ptr(storage->percpu_buf, cpu));
 		off += size;
 	}
+unlock:
 	rcu_read_unlock();
 	return 0;
 }
@@ -213,10 +218,11 @@ int bpf_percpu_cgroup_storage_update(struct bpf_map *_map, void *key,
 {
 	struct bpf_cgroup_storage_map *map = map_to_storage(_map);
 	struct bpf_cgroup_storage *storage;
-	int cpu, off = 0;
+	void *val;
 	u32 size;
+	int cpu;
 
-	if (map_flags != BPF_ANY && map_flags != BPF_EXIST)
+	if ((u32)map_flags & ~(BPF_ANY | BPF_EXIST | BPF_F_CPU | BPF_F_ALL_CPUS))
 		return -EINVAL;
 
 	rcu_read_lock();
@@ -232,12 +238,17 @@ int bpf_percpu_cgroup_storage_update(struct bpf_map *_map, void *key,
 	 * returned or zeros which were zero-filled by percpu_alloc,
 	 * so no kernel data leaks possible
 	 */
+	if (map_flags & BPF_F_CPU) {
+		cpu = map_flags >> 32;
+		copy_map_value(_map, per_cpu_ptr(storage->percpu_buf, cpu), value);
+		goto unlock;
+	}
 	size = round_up(_map->value_size, 8);
 	for_each_possible_cpu(cpu) {
-		bpf_long_memcpy(per_cpu_ptr(storage->percpu_buf, cpu),
-				value + off, size);
-		off += size;
+		val = (map_flags & BPF_F_ALL_CPUS) ? value : value + size * cpu;
+		copy_map_value(_map, per_cpu_ptr(storage->percpu_buf, cpu), val);
 	}
+unlock:
 	rcu_read_unlock();
 	return 0;
 }
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 792623a7c90b5..d64567c6ef50d 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -133,12 +133,14 @@ bool bpf_map_write_active(const struct bpf_map *map)
 	return atomic64_read(&map->writecnt) != 0;
 }
 
-static u32 bpf_map_value_size(const struct bpf_map *map)
-{
-	if (map->map_type == BPF_MAP_TYPE_PERCPU_HASH ||
-	    map->map_type == BPF_MAP_TYPE_LRU_PERCPU_HASH ||
-	    map->map_type == BPF_MAP_TYPE_PERCPU_ARRAY ||
-	    map->map_type == BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE)
+static u32 bpf_map_value_size(const struct bpf_map *map, u64 flags)
+{
+	if (flags & (BPF_F_CPU | BPF_F_ALL_CPUS))
+		return map->value_size;
+	else if (map->map_type == BPF_MAP_TYPE_PERCPU_HASH ||
+		 map->map_type == BPF_MAP_TYPE_LRU_PERCPU_HASH ||
+		 map->map_type == BPF_MAP_TYPE_PERCPU_ARRAY ||
+		 map->map_type == BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE)
 		return round_up(map->value_size, 8) * num_possible_cpus();
 	else if (IS_FD_MAP(map))
 		return sizeof(u32);
@@ -314,11 +316,11 @@ static int bpf_map_copy_value(struct bpf_map *map, void *key, void *value,
 	bpf_disable_instrumentation();
 	if (map->map_type == BPF_MAP_TYPE_PERCPU_HASH ||
 	    map->map_type == BPF_MAP_TYPE_LRU_PERCPU_HASH) {
-		err = bpf_percpu_hash_copy(map, key, value);
+		err = bpf_percpu_hash_copy(map, key, value, flags);
 	} else if (map->map_type == BPF_MAP_TYPE_PERCPU_ARRAY) {
-		err = bpf_percpu_array_copy(map, key, value);
+		err = bpf_percpu_array_copy(map, key, value, flags);
 	} else if (map->map_type == BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE) {
-		err = bpf_percpu_cgroup_storage_copy(map, key, value);
+		err = bpf_percpu_cgroup_storage_copy(map, key, value, flags);
 	} else if (map->map_type == BPF_MAP_TYPE_STACK_TRACE) {
 		err = bpf_stackmap_extract(map, key, value, false);
 	} else if (IS_FD_ARRAY(map) || IS_FD_PROG_ARRAY(map)) {
@@ -1725,9 +1727,6 @@ static int map_lookup_elem(union bpf_attr *attr)
 	if (CHECK_ATTR(BPF_MAP_LOOKUP_ELEM))
 		return -EINVAL;
 
-	if (attr->flags & ~BPF_F_LOCK)
-		return -EINVAL;
-
 	CLASS(fd, f)(attr->map_fd);
 	map = __bpf_map_get(f);
 	if (IS_ERR(map))
@@ -1735,15 +1734,15 @@ static int map_lookup_elem(union bpf_attr *attr)
 	if (!(map_get_sys_perms(map, f) & FMODE_CAN_READ))
 		return -EPERM;
 
-	if ((attr->flags & BPF_F_LOCK) &&
-	    !btf_record_has_field(map->record, BPF_SPIN_LOCK))
-		return -EINVAL;
+	err = bpf_map_check_op_flags(map, attr->flags, BPF_F_LOCK | BPF_F_CPU);
+	if (err)
+		return err;
 
 	key = __bpf_copy_key(ukey, map->key_size);
 	if (IS_ERR(key))
 		return PTR_ERR(key);
 
-	value_size = bpf_map_value_size(map);
+	value_size = bpf_map_value_size(map, attr->flags);
 
 	err = -ENOMEM;
 	value = kvmalloc(value_size, GFP_USER | __GFP_NOWARN);
@@ -1784,6 +1783,7 @@ static int map_update_elem(union bpf_attr *attr, bpfptr_t uattr)
 	bpfptr_t uvalue = make_bpfptr(attr->value, uattr.is_kernel);
 	struct bpf_map *map;
 	void *key, *value;
+	u64 allowed_flags;
 	u32 value_size;
 	int err;
 
@@ -1800,11 +1800,10 @@ static int map_update_elem(union bpf_attr *attr, bpfptr_t uattr)
 		goto err_put;
 	}
 
-	if ((attr->flags & BPF_F_LOCK) &&
-	    !btf_record_has_field(map->record, BPF_SPIN_LOCK)) {
-		err = -EINVAL;
+	allowed_flags = (BPF_F_ALL_CPUS << 1) - 1;
+	err = bpf_map_check_op_flags(map, attr->flags, allowed_flags);
+	if (err)
 		goto err_put;
-	}
 
 	key = ___bpf_copy_key(ukey, map->key_size);
 	if (IS_ERR(key)) {
@@ -1812,7 +1811,7 @@ static int map_update_elem(union bpf_attr *attr, bpfptr_t uattr)
 		goto err_put;
 	}
 
-	value_size = bpf_map_value_size(map);
+	value_size = bpf_map_value_size(map, attr->flags);
 	value = kvmemdup_bpfptr(uvalue, value_size);
 	if (IS_ERR(value)) {
 		err = PTR_ERR(value);
@@ -2006,17 +2005,15 @@ int generic_map_update_batch(struct bpf_map *map, struct file *map_file,
 	void __user *keys = u64_to_user_ptr(attr->batch.keys);
 	u32 value_size, cp, max_count;
 	void *key, *value;
+	u64 allowed_flags;
 	int err = 0;
 
-	if (attr->batch.elem_flags & ~BPF_F_LOCK)
-		return -EINVAL;
-
-	if ((attr->batch.elem_flags & BPF_F_LOCK) &&
-	    !btf_record_has_field(map->record, BPF_SPIN_LOCK)) {
-		return -EINVAL;
-	}
+	allowed_flags = BPF_EXIST | BPF_F_LOCK | BPF_F_CPU | BPF_F_ALL_CPUS;
+	err = bpf_map_check_op_flags(map, attr->batch.elem_flags, allowed_flags);
+	if (err)
+		return err;
 
-	value_size = bpf_map_value_size(map);
+	value_size = bpf_map_value_size(map, attr->batch.elem_flags);
 
 	max_count = attr->batch.count;
 	if (!max_count)
@@ -2071,14 +2068,11 @@ int generic_map_lookup_batch(struct bpf_map *map,
 	u32 value_size, cp, max_count;
 	int err;
 
-	if (attr->batch.elem_flags & ~BPF_F_LOCK)
-		return -EINVAL;
-
-	if ((attr->batch.elem_flags & BPF_F_LOCK) &&
-	    !btf_record_has_field(map->record, BPF_SPIN_LOCK))
-		return -EINVAL;
+	err = bpf_map_check_op_flags(map, attr->batch.elem_flags, BPF_F_LOCK | BPF_F_CPU);
+	if (err)
+		return err;
 
-	value_size = bpf_map_value_size(map);
+	value_size = bpf_map_value_size(map, attr->batch.elem_flags);
 
 	max_count = attr->batch.count;
 	if (!max_count)
@@ -2200,7 +2194,7 @@ static int map_lookup_and_delete_elem(union bpf_attr *attr)
 		goto err_put;
 	}
 
-	value_size = bpf_map_value_size(map);
+	value_size = bpf_map_value_size(map, 0);
 
 	err = -ENOMEM;
 	value = kvmalloc(value_size, GFP_USER | __GFP_NOWARN);
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index f5713f59ac10a..8b6279ca6e662 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -1373,6 +1373,8 @@ enum {
 	BPF_NOEXIST	= 1, /* create new element if it didn't exist */
 	BPF_EXIST	= 2, /* update existing element */
 	BPF_F_LOCK	= 4, /* spin_lock-ed map_lookup/map_update */
+	BPF_F_CPU	= 8, /* cpu flag for percpu maps, upper 32-bit of flags is a cpu number */
+	BPF_F_ALL_CPUS	= 16, /* update value across all CPUs for percpu maps */
 };
 
 /* flags for BPF_MAP_CREATE command */
diff --git a/tools/lib/bpf/bpf.h b/tools/lib/bpf/bpf.h
index e983a3e40d612..ffd93feffd71d 100644
--- a/tools/lib/bpf/bpf.h
+++ b/tools/lib/bpf/bpf.h
@@ -289,6 +289,14 @@ LIBBPF_API int bpf_map_lookup_and_delete_batch(int fd, void *in_batch,
  *    Update spin_lock-ed map elements. This must be
  *    specified if the map value contains a spinlock.
  *
+ * **BPF_F_CPU**
+ *    As for percpu maps, update value on the specified CPU. And the cpu
+ *    info is embedded into the high 32 bits of **opts->elem_flags**.
+ *
+ * **BPF_F_ALL_CPUS**
+ *    As for percpu maps, update value across all CPUs. This flag cannot
+ *    be used with BPF_F_CPU at the same time.
+ *
  * @param fd BPF map file descriptor
  * @param keys pointer to an array of *count* keys
  * @param values pointer to an array of *count* values
diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index 706e7481bdf6b..65b9b5e955449 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -10913,7 +10913,7 @@ bpf_object__find_map_fd_by_name(const struct bpf_object *obj, const char *name)
 }
 
 static int validate_map_op(const struct bpf_map *map, size_t key_sz,
-			   size_t value_sz, bool check_value_sz)
+			   size_t value_sz, bool check_value_sz, __u64 flags)
 {
 	if (!map_is_created(map)) /* map is not yet created */
 		return -ENOENT;
@@ -10940,6 +10940,20 @@ static int validate_map_op(const struct bpf_map *map, size_t key_sz,
 		int num_cpu = libbpf_num_possible_cpus();
 		size_t elem_sz = roundup(map->def.value_size, 8);
 
+		if (flags & (BPF_F_CPU | BPF_F_ALL_CPUS)) {
+			if ((flags & BPF_F_CPU) && (flags & BPF_F_ALL_CPUS)) {
+				pr_warn("map '%s': BPF_F_CPU and BPF_F_ALL_CPUS are mutually exclusive\n",
+					map->name);
+				return -EINVAL;
+			}
+			if (map->def.value_size != value_sz) {
+				pr_warn("map '%s': unexpected value size %zu provided for either BPF_F_CPU or BPF_F_ALL_CPUS, expected %u\n",
+					map->name, value_sz, map->def.value_size);
+				return -EINVAL;
+			}
+			break;
+		}
+
 		if (value_sz != num_cpu * elem_sz) {
 			pr_warn("map '%s': unexpected value size %zu provided for per-CPU map, expected %d * %zu = %zd\n",
 				map->name, value_sz, num_cpu, elem_sz, num_cpu * elem_sz);
@@ -10964,7 +10978,7 @@ int bpf_map__lookup_elem(const struct bpf_map *map,
 {
 	int err;
 
-	err = validate_map_op(map, key_sz, value_sz, true);
+	err = validate_map_op(map, key_sz, value_sz, true, flags);
 	if (err)
 		return libbpf_err(err);
 
@@ -10977,7 +10991,7 @@ int bpf_map__update_elem(const struct bpf_map *map,
 {
 	int err;
 
-	err = validate_map_op(map, key_sz, value_sz, true);
+	err = validate_map_op(map, key_sz, value_sz, true, flags);
 	if (err)
 		return libbpf_err(err);
 
@@ -10989,7 +11003,7 @@ int bpf_map__delete_elem(const struct bpf_map *map,
 {
 	int err;
 
-	err = validate_map_op(map, key_sz, 0, false /* check_value_sz */);
+	err = validate_map_op(map, key_sz, 0, false /* check_value_sz */, flags);
 	if (err)
 		return libbpf_err(err);
 
@@ -11002,7 +11016,7 @@ int bpf_map__lookup_and_delete_elem(const struct bpf_map *map,
 {
 	int err;
 
-	err = validate_map_op(map, key_sz, value_sz, true);
+	err = validate_map_op(map, key_sz, value_sz, true, flags);
 	if (err)
 		return libbpf_err(err);
 
@@ -11014,7 +11028,7 @@ int bpf_map__get_next_key(const struct bpf_map *map,
 {
 	int err;
 
-	err = validate_map_op(map, key_sz, 0, false /* check_value_sz */);
+	err = validate_map_op(map, key_sz, 0, false /* check_value_sz */, 0);
 	if (err)
 		return libbpf_err(err);
 
diff --git a/tools/lib/bpf/libbpf.h b/tools/lib/bpf/libbpf.h
index 5118d0a90e243..7c38b2e546080 100644
--- a/tools/lib/bpf/libbpf.h
+++ b/tools/lib/bpf/libbpf.h
@@ -1196,12 +1196,13 @@ LIBBPF_API struct bpf_map *bpf_map__inner_map(struct bpf_map *map);
  * @param key_sz size in bytes of key data, needs to match BPF map definition's **key_size**
  * @param value pointer to memory in which looked up value will be stored
  * @param value_sz size in byte of value data memory; it has to match BPF map
- * definition's **value_size**. For per-CPU BPF maps value size has to be
- * a product of BPF map value size and number of possible CPUs in the system
- * (could be fetched with **libbpf_num_possible_cpus()**). Note also that for
- * per-CPU values value size has to be aligned up to closest 8 bytes for
- * alignment reasons, so expected size is: `round_up(value_size, 8)
- * * libbpf_num_possible_cpus()`.
+ * definition's **value_size**. For per-CPU BPF maps, value size can be
+ * `value_size` if either **BPF_F_CPU** or **BPF_F_ALL_CPUS** is specified
+ * in **flags**, otherwise a product of BPF map value size and number of
+ * possible CPUs in the system (could be fetched with
+ * **libbpf_num_possible_cpus()**). Note also that for per-CPU values value
+ * size has to be aligned up to closest 8 bytes, so expected size is:
+ * `round_up(value_size, 8) * libbpf_num_possible_cpus()`.
  * @flags extra flags passed to kernel for this operation
  * @return 0, on success; negative error, otherwise
  *
@@ -1219,13 +1220,7 @@ LIBBPF_API int bpf_map__lookup_elem(const struct bpf_map *map,
  * @param key pointer to memory containing bytes of the key
  * @param key_sz size in bytes of key data, needs to match BPF map definition's **key_size**
  * @param value pointer to memory containing bytes of the value
- * @param value_sz size in byte of value data memory; it has to match BPF map
- * definition's **value_size**. For per-CPU BPF maps value size has to be
- * a product of BPF map value size and number of possible CPUs in the system
- * (could be fetched with **libbpf_num_possible_cpus()**). Note also that for
- * per-CPU values value size has to be aligned up to closest 8 bytes for
- * alignment reasons, so expected size is: `round_up(value_size, 8)
- * * libbpf_num_possible_cpus()`.
+ * @param value_sz refer to **bpf_map__lookup_elem**'s description.'
  * @flags extra flags passed to kernel for this operation
  * @return 0, on success; negative error, otherwise
  *
diff --git a/tools/testing/selftests/bpf/prog_tests/percpu_alloc.c b/tools/testing/selftests/bpf/prog_tests/percpu_alloc.c
index 343da65864d6d..ff31107434d74 100644
--- a/tools/testing/selftests/bpf/prog_tests/percpu_alloc.c
+++ b/tools/testing/selftests/bpf/prog_tests/percpu_alloc.c
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
 #include <test_progs.h>
+#include "cgroup_helpers.h"
 #include "percpu_alloc_array.skel.h"
 #include "percpu_alloc_cgrp_local_storage.skel.h"
 #include "percpu_alloc_fail.skel.h"
@@ -115,6 +116,328 @@ static void test_failure(void) {
 	RUN_TESTS(percpu_alloc_fail);
 }
 
+static void test_percpu_map_op_cpu_flag(struct bpf_map *map, void *keys, size_t key_sz,
+					u32 max_entries, bool test_batch)
+{
+	size_t value_sz = sizeof(u32), value_sz_total;
+	u32 *values = NULL, *values_percpu = NULL;
+	int i, j, cpu, map_fd, nr_cpus, err;
+	const u32 value = 0xDEADC0DE;
+	u64 batch = 0, flags;
+	void *values_row;
+	u32 count, v;
+	LIBBPF_OPTS(bpf_map_batch_opts, batch_opts);
+
+	nr_cpus = libbpf_num_possible_cpus();
+	if (!ASSERT_GT(nr_cpus, 0, "libbpf_num_possible_cpus"))
+		return;
+
+	values = calloc(max_entries, value_sz * nr_cpus);
+	if (!ASSERT_OK_PTR(values, "calloc values"))
+		return;
+
+	values_percpu = calloc(max_entries, roundup(value_sz, 8) * nr_cpus);
+	if (!ASSERT_OK_PTR(values_percpu, "calloc values_percpu")) {
+		free(values);
+		return;
+	}
+	memset(values_percpu, 0, roundup(value_sz, 8) * nr_cpus * max_entries);
+
+	value_sz_total = value_sz * nr_cpus * max_entries;
+	memset(values, 0, value_sz_total);
+
+	map_fd = bpf_map__fd(map);
+	flags = BPF_F_CPU | BPF_F_ALL_CPUS;
+	err = bpf_map_lookup_elem_flags(map_fd, keys, values, flags);
+	if (!ASSERT_ERR(err, "bpf_map_lookup_elem_flags cpu|all_cpus"))
+		goto out;
+
+	err = bpf_map_update_elem(map_fd, keys, values, flags);
+	if (!ASSERT_ERR(err, "bpf_map_update_elem cpu|all_cpus"))
+		goto out;
+
+	flags = BPF_F_ALL_CPUS;
+	err = bpf_map_lookup_elem_flags(map_fd, keys, values, flags);
+	if (!ASSERT_ERR(err, "bpf_map_lookup_elem_flags all_cpus"))
+		goto out;
+
+	flags = BPF_F_LOCK | BPF_F_CPU;
+	err = bpf_map_lookup_elem_flags(map_fd, keys, values, flags);
+	if (!ASSERT_ERR(err, "bpf_map_lookup_elem_flags BPF_F_LOCK"))
+		goto out;
+
+	flags = BPF_F_LOCK | BPF_F_ALL_CPUS;
+	err = bpf_map_update_elem(map_fd, keys, values, flags);
+	if (!ASSERT_ERR(err, "bpf_map_update_elem BPF_F_LOCK"))
+		goto out;
+
+	flags = (u64)nr_cpus << 32 | BPF_F_CPU;
+	err = bpf_map_update_elem(map_fd, keys, values, flags);
+	if (!ASSERT_EQ(err, -ERANGE, "bpf_map_update_elem -ERANGE"))
+		goto out;
+
+	err = bpf_map__update_elem(map, keys, key_sz, values, value_sz, flags);
+	if (!ASSERT_EQ(err, -ERANGE, "bpf_map__update_elem -ERANGE"))
+		goto out;
+
+	err = bpf_map_lookup_elem_flags(map_fd, keys, values, flags);
+	if (!ASSERT_EQ(err, -ERANGE, "bpf_map_lookup_elem_flags -ERANGE"))
+		goto out;
+
+	err = bpf_map__lookup_elem(map, keys, key_sz, values, value_sz, flags);
+	if (!ASSERT_EQ(err, -ERANGE, "bpf_map__lookup_elem -ERANGE"))
+		goto out;
+
+
+	flags = BPF_ANY;
+	for (i = 0; i < max_entries; i++) {
+		err = bpf_map__update_elem(map, keys + i * key_sz, key_sz, values_percpu,
+					   roundup(value_sz, 8) * nr_cpus, flags);
+		if (!ASSERT_OK(err, "bpf_map__update_elem init"))
+			goto out;
+	}
+
+	for (cpu = 0; cpu < nr_cpus; cpu++) {
+		/* clear value on all cpus */
+		values[0] = 0;
+		flags = BPF_F_ALL_CPUS | BPF_EXIST;
+		for (i = 0; i < max_entries; i++) {
+			err = bpf_map__update_elem(map, keys + i * key_sz, key_sz, values,
+						   value_sz, flags);
+			if (!ASSERT_OK(err, "bpf_map__update_elem all_cpus"))
+				goto out;
+		}
+
+		/* update value on specified cpu */
+		for (i = 0; i < max_entries; i++) {
+			values[0] = value;
+			flags = (u64)cpu << 32 | BPF_F_CPU | BPF_EXIST;
+			err = bpf_map__update_elem(map, keys + i * key_sz, key_sz, values,
+						   value_sz, flags);
+			if (!ASSERT_OK(err, "bpf_map__update_elem specified cpu"))
+				goto out;
+
+			/* lookup then check value on CPUs */
+			for (j = 0; j < nr_cpus; j++) {
+				flags = (u64)j << 32 | BPF_F_CPU;
+				err = bpf_map__lookup_elem(map, keys + i * key_sz, key_sz, values,
+							   value_sz, flags);
+				if (!ASSERT_OK(err, "bpf_map__lookup_elem specified cpu"))
+					goto out;
+				if (!ASSERT_EQ(values[0], j != cpu ? 0 : value,
+					       "bpf_map__lookup_elem value on specified cpu"))
+					goto out;
+			}
+		}
+	}
+
+	if (!test_batch)
+		goto out;
+
+	count = max_entries;
+	batch_opts.elem_flags = (u64)nr_cpus << 32 | BPF_F_CPU;
+	err = bpf_map_update_batch(map_fd, keys, values, &count, &batch_opts);
+	if (!ASSERT_EQ(err, -ERANGE, "bpf_map_update_batch -ERANGE"))
+		goto out;
+
+	for (cpu = 0; cpu < nr_cpus; cpu++) {
+		memset(values, 0, value_sz_total);
+
+		/* clear values across all CPUs */
+		count = max_entries;
+		batch_opts.elem_flags = BPF_F_ALL_CPUS | BPF_EXIST;
+		err = bpf_map_update_batch(map_fd, keys, values, &count, &batch_opts);
+		if (!ASSERT_OK(err, "bpf_map_update_batch all_cpus"))
+			goto out;
+
+		/* update values on specified CPU */
+		for (i = 0; i < max_entries; i++)
+			values[i] = value;
+
+		count = max_entries;
+		batch_opts.elem_flags = (u64)cpu << 32 | BPF_F_CPU | BPF_EXIST;
+		err = bpf_map_update_batch(map_fd, keys, values, &count, &batch_opts);
+		if (!ASSERT_OK(err, "bpf_map_update_batch specified cpu"))
+			goto out;
+
+		/* lookup values on specified CPU */
+		count = max_entries;
+		memset(values, 0, max_entries * value_sz);
+		batch_opts.elem_flags = (u64)cpu << 32 | BPF_F_CPU;
+		err = bpf_map_lookup_batch(map_fd, NULL, &batch, keys, values, &count, &batch_opts);
+		if (!ASSERT_TRUE(!err || err == -ENOENT, "bpf_map_lookup_batch specified cpu"))
+			goto out;
+
+		for (i = 0; i < max_entries; i++)
+			if (!ASSERT_EQ(values[i], value,
+				       "bpf_map_lookup_batch value on specified cpu"))
+				goto out;
+
+		/* lookup values from all CPUs */
+		batch = 0;
+		count = max_entries;
+		batch_opts.elem_flags = 0;
+		memset(values_percpu, 0, roundup(value_sz, 8) * nr_cpus * max_entries);
+		err = bpf_map_lookup_batch(map_fd, NULL, &batch, keys, values_percpu, &count,
+					   &batch_opts);
+		if (!ASSERT_TRUE(!err || err == -ENOENT, "bpf_map_lookup_batch all_cpus"))
+			goto out;
+
+		for (i = 0; i < max_entries; i++) {
+			values_row = (void *) values_percpu +
+				     roundup(value_sz, 8) * i * nr_cpus;
+			for (j = 0; j < nr_cpus; j++) {
+				v = *(u32 *) (values_row + roundup(value_sz, 8) * j);
+				if (!ASSERT_EQ(v, j != cpu ? 0 : value,
+					       "bpf_map_lookup_batch value all_cpus"))
+					goto out;
+			}
+		}
+	}
+
+out:
+	free(values_percpu);
+	free(values);
+}
+
+static void test_percpu_map_cpu_flag(enum bpf_map_type map_type, u32 max_entries)
+{
+	struct percpu_alloc_array *skel;
+	size_t key_sz = sizeof(int);
+	struct bpf_map *map;
+	int *keys, i, err;
+
+	keys = calloc(max_entries, key_sz);
+	if (!ASSERT_OK_PTR(keys, "calloc keys"))
+		return;
+
+	for (i = 0; i < max_entries; i++)
+		keys[i] = i;
+
+	skel = percpu_alloc_array__open();
+	if (!ASSERT_OK_PTR(skel, "percpu_alloc_array__open")) {
+		free(keys);
+		return;
+	}
+
+	map = skel->maps.percpu;
+	bpf_map__set_type(map, map_type);
+	bpf_map__set_max_entries(map, max_entries);
+
+	err = percpu_alloc_array__load(skel);
+	if (!ASSERT_OK(err, "test_percpu_alloc__load"))
+		goto out;
+
+	test_percpu_map_op_cpu_flag(map, keys, key_sz, max_entries, true);
+out:
+	percpu_alloc_array__destroy(skel);
+	free(keys);
+}
+
+static void test_percpu_array_cpu_flag(void)
+{
+	test_percpu_map_cpu_flag(BPF_MAP_TYPE_PERCPU_ARRAY, 2);
+}
+
+static void test_percpu_hash_cpu_flag(void)
+{
+	test_percpu_map_cpu_flag(BPF_MAP_TYPE_PERCPU_HASH, 2);
+}
+
+static void test_lru_percpu_hash_cpu_flag(void)
+{
+	int nr_cpus = libbpf_num_possible_cpus();
+
+	if (!ASSERT_GT(nr_cpus, 0, "libbpf_num_possible_cpus"))
+		return;
+
+	test_percpu_map_cpu_flag(BPF_MAP_TYPE_LRU_PERCPU_HASH, nr_cpus);
+}
+
+static void test_percpu_cgroup_storage_cpu_flag(void)
+{
+	struct percpu_alloc_array *skel = NULL;
+	struct bpf_cgroup_storage_key key;
+	int cgroup, prog_fd, err;
+	struct bpf_map *map;
+
+	err = setup_cgroup_environment();
+	if (!ASSERT_OK(err, "setup_cgroup_environment"))
+		return;
+
+	cgroup = create_and_get_cgroup("/cg_percpu");
+	if (!ASSERT_GE(cgroup, 0, "create_and_get_cgroup")) {
+		cleanup_cgroup_environment();
+		return;
+	}
+
+	err = join_cgroup("/cg_percpu");
+	if (!ASSERT_OK(err, "join_cgroup"))
+		goto out;
+
+	skel = percpu_alloc_array__open_and_load();
+	if (!ASSERT_OK_PTR(skel, "percpu_alloc_array__open_and_load"))
+		goto out;
+
+	prog_fd = bpf_program__fd(skel->progs.cgroup_egress);
+	err = bpf_prog_attach(prog_fd, cgroup, BPF_CGROUP_INET_EGRESS, 0);
+	if (!ASSERT_OK(err, "bpf_prog_attach"))
+		goto out;
+
+	map = skel->maps.percpu_cgroup_storage;
+	err = bpf_map_get_next_key(bpf_map__fd(map), NULL, &key);
+	if (!ASSERT_OK(err, "bpf_map_get_next_key"))
+		goto out;
+
+	test_percpu_map_op_cpu_flag(map, &key, sizeof(key), 1, false);
+out:
+	bpf_prog_detach2(-1, cgroup, BPF_CGROUP_INET_EGRESS);
+	close(cgroup);
+	cleanup_cgroup_environment();
+	percpu_alloc_array__destroy(skel);
+}
+
+static void test_map_op_cpu_flag(enum bpf_map_type map_type)
+{
+	u32 max_entries = 1, count = max_entries;
+	u64 flags, batch = 0, val = 0;
+	int err, map_fd, key = 0;
+	LIBBPF_OPTS(bpf_map_batch_opts, batch_opts);
+
+	map_fd = bpf_map_create(map_type, "test_cpu_flag", sizeof(int), sizeof(u64), max_entries,
+				NULL);
+	if (!ASSERT_GE(map_fd, 0, "bpf_map_create"))
+		return;
+
+	flags = BPF_F_ALL_CPUS;
+	err = bpf_map_update_elem(map_fd, &key, &val, flags);
+	ASSERT_ERR(err, "bpf_map_update_elem all_cpus");
+
+	batch_opts.elem_flags = BPF_F_ALL_CPUS;
+	err = bpf_map_update_batch(map_fd, &key, &val, &count, &batch_opts);
+	ASSERT_ERR(err, "bpf_map_update_batch all_cpus");
+
+	flags = BPF_F_CPU;
+	err = bpf_map_lookup_elem_flags(map_fd, &key, &val, flags);
+	ASSERT_ERR(err, "bpf_map_lookup_elem_flags cpu");
+
+	batch_opts.elem_flags = BPF_F_CPU;
+	err = bpf_map_lookup_batch(map_fd, NULL, &batch, &key, &val, &count, &batch_opts);
+	ASSERT_ERR(err, "bpf_map_lookup_batch cpu");
+
+	close(map_fd);
+}
+
+static void test_array_cpu_flag(void)
+{
+	test_map_op_cpu_flag(BPF_MAP_TYPE_ARRAY);
+}
+
+static void test_hash_cpu_flag(void)
+{
+	test_map_op_cpu_flag(BPF_MAP_TYPE_HASH);
+}
+
 void test_percpu_alloc(void)
 {
 	if (test__start_subtest("array"))
@@ -125,4 +448,16 @@ void test_percpu_alloc(void)
 		test_cgrp_local_storage();
 	if (test__start_subtest("failure_tests"))
 		test_failure();
+	if (test__start_subtest("cpu_flag_percpu_array"))
+		test_percpu_array_cpu_flag();
+	if (test__start_subtest("cpu_flag_percpu_hash"))
+		test_percpu_hash_cpu_flag();
+	if (test__start_subtest("cpu_flag_lru_percpu_hash"))
+		test_lru_percpu_hash_cpu_flag();
+	if (test__start_subtest("cpu_flag_percpu_cgroup_storage"))
+		test_percpu_cgroup_storage_cpu_flag();
+	if (test__start_subtest("cpu_flag_array"))
+		test_array_cpu_flag();
+	if (test__start_subtest("cpu_flag_hash"))
+		test_hash_cpu_flag();
 }
diff --git a/tools/testing/selftests/bpf/progs/percpu_alloc_array.c b/tools/testing/selftests/bpf/progs/percpu_alloc_array.c
index 37c2d2608ec0b..ed6a2a93d5a51 100644
--- a/tools/testing/selftests/bpf/progs/percpu_alloc_array.c
+++ b/tools/testing/selftests/bpf/progs/percpu_alloc_array.c
@@ -187,4 +187,36 @@ int BPF_PROG(test_array_map_10)
 	return 0;
 }
 
+struct {
+	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
+	__uint(max_entries, 2);
+	__type(key, int);
+	__type(value, u32);
+} percpu SEC(".maps");
+
+SEC("?fentry/bpf_fentry_test1")
+int BPF_PROG(test_percpu_array, int x)
+{
+	u64 value = 0xDEADC0DE;
+	int key = 0;
+
+	bpf_map_update_elem(&percpu, &key, &value, BPF_ANY);
+	return 0;
+}
+
+struct {
+	__uint(type, BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE);
+	__type(key, struct bpf_cgroup_storage_key);
+	__type(value, u32);
+} percpu_cgroup_storage SEC(".maps");
+
+SEC("cgroup_skb/egress")
+int cgroup_egress(struct __sk_buff *skb)
+{
+	u32 *val = bpf_get_local_storage(&percpu_cgroup_storage, 0);
+
+	*val = 1;
+	return 1;
+}
+
 char _license[] SEC("license") = "GPL";