55 files changed, 2040 insertions, 209 deletions

diff --git a/tools/testing/nvdimm/dimm_devs.c b/tools/testing/nvdimm/dimm_devs.c
index e75238404555..2d4baf57822f 100644
--- a/tools/testing/nvdimm/dimm_devs.c
+++ b/tools/testing/nvdimm/dimm_devs.c
@@ -18,8 +18,8 @@ ssize_t security_show(struct device *dev,
          * For the test version we need to poll the "hardware" in order
          * to get the updated status for unlock testing.
          */
-        nvdimm->sec.state = nvdimm_security_state(nvdimm, false);
-        nvdimm->sec.ext_state = nvdimm_security_state(nvdimm, true);
+        nvdimm->sec.state = nvdimm_security_state(nvdimm, NVDIMM_USER);
+        nvdimm->sec.ext_state = nvdimm_security_state(nvdimm, NVDIMM_MASTER);
 
         switch (nvdimm->sec.state) {
         case NVDIMM_SECURITY_DISABLED:
diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
index 1a2bd15c5b6e..400ee81a3043 100644
--- a/tools/testing/selftests/Makefile
+++ b/tools/testing/selftests/Makefile
@@ -10,6 +10,7 @@ TARGETS += drivers/dma-buf
 TARGETS += efivarfs
 TARGETS += exec
 TARGETS += filesystems
+TARGETS += filesystems/binderfs
 TARGETS += firmware
 TARGETS += ftrace
 TARGETS += futex
diff --git a/tools/testing/selftests/bpf/.gitignore b/tools/testing/selftests/bpf/.gitignore
index 4a9785043a39..dd093bd91aa9 100644
--- a/tools/testing/selftests/bpf/.gitignore
+++ b/tools/testing/selftests/bpf/.gitignore
@@ -28,3 +28,4 @@ flow_dissector_load
 test_netcnt
 test_section_names
 test_tcpnotify_user
+test_libbpf
diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
index 73aa6d8f4a2f..41ab7a3668b3 100644
--- a/tools/testing/selftests/bpf/Makefile
+++ b/tools/testing/selftests/bpf/Makefile
@@ -55,7 +55,10 @@ TEST_PROGS := test_kmod.sh \
         test_flow_dissector.sh \
         test_xdp_vlan.sh
 
-TEST_PROGS_EXTENDED := with_addr.sh
+TEST_PROGS_EXTENDED := with_addr.sh \
+        with_tunnels.sh \
+        tcp_client.py \
+        tcp_server.py
 
 # Compile but not part of 'make run_tests'
 TEST_GEN_PROGS_EXTENDED = test_libbpf_open test_sock_addr test_skb_cgroup_id_user \
diff --git a/tools/testing/selftests/bpf/bpf_util.h b/tools/testing/selftests/bpf/bpf_util.h
index 315a44fa32af..84fd6f1bf33e 100644
--- a/tools/testing/selftests/bpf/bpf_util.h
+++ b/tools/testing/selftests/bpf/bpf_util.h
@@ -13,7 +13,7 @@ static inline unsigned int bpf_num_possible_cpus(void)
         unsigned int start, end, possible_cpus = 0;
         char buff[128];
         FILE *fp;
-        int n;
+        int len, n, i, j = 0;
 
         fp = fopen(fcpu, "r");
         if (!fp) {
@@ -21,17 +21,27 @@ static inline unsigned int bpf_num_possible_cpus(void)
                 exit(1);
         }
 
-        while (fgets(buff, sizeof(buff), fp)) {
-                n = sscanf(buff, "%u-%u", &start, &end);
-                if (n == 0) {
-                        printf("Failed to retrieve # possible CPUs!\n");
-                        exit(1);
-                } else if (n == 1) {
-                        end = start;
+        if (!fgets(buff, sizeof(buff), fp)) {
+                printf("Failed to read %s!\n", fcpu);
+                exit(1);
+        }
+
+        len = strlen(buff);
+        for (i = 0; i <= len; i++) {
+                if (buff[i] == ',' || buff[i] == '\0') {
+                        buff[i] = '\0';
+                        n = sscanf(&buff[j], "%u-%u", &start, &end);
+                        if (n <= 0) {
+                                printf("Failed to retrieve # possible CPUs!\n");
+                                exit(1);
+                        } else if (n == 1) {
+                                end = start;
+                        }
+                        possible_cpus += end - start + 1;
+                        j = i + 1;
                 }
-                possible_cpus = start == 0 ? end + 1 : 0;
-                break;
         }
+
         fclose(fp);
 
         return possible_cpus;
diff --git a/tools/testing/selftests/bpf/cgroup_helpers.c b/tools/testing/selftests/bpf/cgroup_helpers.c
index cf16948aad4a..6692a40a6979 100644
--- a/tools/testing/selftests/bpf/cgroup_helpers.c
+++ b/tools/testing/selftests/bpf/cgroup_helpers.c
@@ -155,7 +155,7 @@ void cleanup_cgroup_environment(void)
  * This function creates a cgroup under the top level workdir and returns the
  * file descriptor. It is idempotent.
  *
- * On success, it returns the file descriptor. On failure it returns 0.
+ * On success, it returns the file descriptor. On failure it returns -1.
  * If there is a failure, it prints the error to stderr.
  */
 int create_and_get_cgroup(const char *path)
@@ -166,13 +166,13 @@ int create_and_get_cgroup(const char *path)
         format_cgroup_path(cgroup_path, path);
         if (mkdir(cgroup_path, 0777) && errno != EEXIST) {
                 log_err("mkdiring cgroup %s .. %s", path, cgroup_path);
-                return 0;
+                return -1;
         }
 
         fd = open(cgroup_path, O_RDONLY);
         if (fd < 0) {
                 log_err("Opening Cgroup");
-                return 0;
+                return -1;
         }
 
         return fd;
diff --git a/tools/testing/selftests/bpf/test_btf.c b/tools/testing/selftests/bpf/test_btf.c
index 8bcd38010582..91420fa83b08 100644
--- a/tools/testing/selftests/bpf/test_btf.c
+++ b/tools/testing/selftests/bpf/test_btf.c
@@ -1881,13 +1881,12 @@ static struct btf_raw_test raw_tests[] = {
 },
 
 {
-        .descr = "func proto (CONST=>TYPEDEF=>FUNC_PROTO)",
+        .descr = "func proto (TYPEDEF=>FUNC_PROTO)",
         .raw_types = {
                 BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),  /* [1] */
                 BTF_TYPE_INT_ENC(0, 0, 0, 32, 4),               /* [2] */
-                BTF_CONST_ENC(4),                               /* [3] */
-                BTF_TYPEDEF_ENC(NAME_TBD, 5),                   /* [4] */
-                BTF_FUNC_PROTO_ENC(0, 2),                       /* [5] */
+                BTF_TYPEDEF_ENC(NAME_TBD, 4),                   /* [3] */
+                BTF_FUNC_PROTO_ENC(0, 2),                       /* [4] */
                         BTF_FUNC_PROTO_ARG_ENC(0, 1),
                         BTF_FUNC_PROTO_ARG_ENC(0, 2),
                 BTF_END_RAW,
@@ -1901,8 +1900,6 @@ static struct btf_raw_test raw_tests[] = {
         .key_type_id = 1,
         .value_type_id = 1,
         .max_entries = 4,
-        .btf_load_err = true,
-        .err_str = "Invalid type_id",
 },
 
 {
@@ -3526,6 +3523,8 @@ struct pprint_mapv {
                 ENUM_TWO,
                 ENUM_THREE,
         } aenum;
+        uint32_t ui32b;
+        uint32_t bits2c:2;
 };
 
 static struct btf_raw_test pprint_test_template[] = {
@@ -3568,7 +3567,7 @@ static struct btf_raw_test pprint_test_template[] = {
                 BTF_ENUM_ENC(NAME_TBD, 2),
                 BTF_ENUM_ENC(NAME_TBD, 3),
                 /* struct pprint_mapv */                /* [16] */
-                BTF_TYPE_ENC(NAME_TBD, BTF_INFO_ENC(BTF_KIND_STRUCT, 0, 8), 32),
+                BTF_TYPE_ENC(NAME_TBD, BTF_INFO_ENC(BTF_KIND_STRUCT, 0, 10), 40),
                 BTF_MEMBER_ENC(NAME_TBD, 11, 0),        /* uint32_t ui32 */
                 BTF_MEMBER_ENC(NAME_TBD, 10, 32),       /* uint16_t ui16 */
                 BTF_MEMBER_ENC(NAME_TBD, 12, 64),       /* int32_t si32 */
@@ -3577,9 +3576,11 @@ static struct btf_raw_test pprint_test_template[] = {
                 BTF_MEMBER_ENC(NAME_TBD, 6, 126),       /* unused_bits2b */
                 BTF_MEMBER_ENC(0, 14, 128),             /* union (anon) */
                 BTF_MEMBER_ENC(NAME_TBD, 15, 192),      /* aenum */
+                BTF_MEMBER_ENC(NAME_TBD, 11, 224),      /* uint32_t ui32b */
+                BTF_MEMBER_ENC(NAME_TBD, 6, 256),       /* bits2c */
                 BTF_END_RAW,
         },
-        BTF_STR_SEC("\0unsigned char\0unsigned short\0unsigned int\0int\0unsigned long long\0uint8_t\0uint16_t\0uint32_t\0int32_t\0uint64_t\0ui64\0ui8a\0ENUM_ZERO\0ENUM_ONE\0ENUM_TWO\0ENUM_THREE\0pprint_mapv\0ui32\0ui16\0si32\0unused_bits2a\0bits28\0unused_bits2b\0aenum"),
+        BTF_STR_SEC("\0unsigned char\0unsigned short\0unsigned int\0int\0unsigned long long\0uint8_t\0uint16_t\0uint32_t\0int32_t\0uint64_t\0ui64\0ui8a\0ENUM_ZERO\0ENUM_ONE\0ENUM_TWO\0ENUM_THREE\0pprint_mapv\0ui32\0ui16\0si32\0unused_bits2a\0bits28\0unused_bits2b\0aenum\0ui32b\0bits2c"),
         .key_size = sizeof(unsigned int),
         .value_size = sizeof(struct pprint_mapv),
         .key_type_id = 3,       /* unsigned int */
@@ -3628,7 +3629,7 @@ static struct btf_raw_test pprint_test_template[] = {
                 BTF_ENUM_ENC(NAME_TBD, 2),
                 BTF_ENUM_ENC(NAME_TBD, 3),
                 /* struct pprint_mapv */                /* [16] */
-                BTF_TYPE_ENC(NAME_TBD, BTF_INFO_ENC(BTF_KIND_STRUCT, 1, 8), 32),
+                BTF_TYPE_ENC(NAME_TBD, BTF_INFO_ENC(BTF_KIND_STRUCT, 1, 10), 40),
                 BTF_MEMBER_ENC(NAME_TBD, 11, BTF_MEMBER_OFFSET(0, 0)),  /* uint32_t ui32 */
                 BTF_MEMBER_ENC(NAME_TBD, 10, BTF_MEMBER_OFFSET(0, 32)), /* uint16_t ui16 */
                 BTF_MEMBER_ENC(NAME_TBD, 12, BTF_MEMBER_OFFSET(0, 64)), /* int32_t si32 */
@@ -3637,9 +3638,11 @@ static struct btf_raw_test pprint_test_template[] = {
                 BTF_MEMBER_ENC(NAME_TBD, 6, BTF_MEMBER_OFFSET(2, 126)), /* unused_bits2b */
                 BTF_MEMBER_ENC(0, 14, BTF_MEMBER_OFFSET(0, 128)),       /* union (anon) */
                 BTF_MEMBER_ENC(NAME_TBD, 15, BTF_MEMBER_OFFSET(0, 192)),        /* aenum */
+                BTF_MEMBER_ENC(NAME_TBD, 11, BTF_MEMBER_OFFSET(0, 224)),        /* uint32_t ui32b */
+                BTF_MEMBER_ENC(NAME_TBD, 6, BTF_MEMBER_OFFSET(2, 256)), /* bits2c */
                 BTF_END_RAW,
         },
-        BTF_STR_SEC("\0unsigned char\0unsigned short\0unsigned int\0int\0unsigned long long\0uint8_t\0uint16_t\0uint32_t\0int32_t\0uint64_t\0ui64\0ui8a\0ENUM_ZERO\0ENUM_ONE\0ENUM_TWO\0ENUM_THREE\0pprint_mapv\0ui32\0ui16\0si32\0unused_bits2a\0bits28\0unused_bits2b\0aenum"),
+        BTF_STR_SEC("\0unsigned char\0unsigned short\0unsigned int\0int\0unsigned long long\0uint8_t\0uint16_t\0uint32_t\0int32_t\0uint64_t\0ui64\0ui8a\0ENUM_ZERO\0ENUM_ONE\0ENUM_TWO\0ENUM_THREE\0pprint_mapv\0ui32\0ui16\0si32\0unused_bits2a\0bits28\0unused_bits2b\0aenum\0ui32b\0bits2c"),
         .key_size = sizeof(unsigned int),
         .value_size = sizeof(struct pprint_mapv),
         .key_type_id = 3,       /* unsigned int */
@@ -3690,7 +3693,7 @@ static struct btf_raw_test pprint_test_template[] = {
                 BTF_ENUM_ENC(NAME_TBD, 2),
                 BTF_ENUM_ENC(NAME_TBD, 3),
                 /* struct pprint_mapv */                /* [16] */
-                BTF_TYPE_ENC(NAME_TBD, BTF_INFO_ENC(BTF_KIND_STRUCT, 1, 8), 32),
+                BTF_TYPE_ENC(NAME_TBD, BTF_INFO_ENC(BTF_KIND_STRUCT, 1, 10), 40),
                 BTF_MEMBER_ENC(NAME_TBD, 11, BTF_MEMBER_OFFSET(0, 0)),  /* uint32_t ui32 */
                 BTF_MEMBER_ENC(NAME_TBD, 10, BTF_MEMBER_OFFSET(0, 32)), /* uint16_t ui16 */
                 BTF_MEMBER_ENC(NAME_TBD, 12, BTF_MEMBER_OFFSET(0, 64)), /* int32_t si32 */
@@ -3699,13 +3702,15 @@ static struct btf_raw_test pprint_test_template[] = {
                 BTF_MEMBER_ENC(NAME_TBD, 19, BTF_MEMBER_OFFSET(2, 126)),/* unused_bits2b */
                 BTF_MEMBER_ENC(0, 14, BTF_MEMBER_OFFSET(0, 128)),       /* union (anon) */
                 BTF_MEMBER_ENC(NAME_TBD, 15, BTF_MEMBER_OFFSET(0, 192)),        /* aenum */
+                BTF_MEMBER_ENC(NAME_TBD, 11, BTF_MEMBER_OFFSET(0, 224)),        /* uint32_t ui32b */
+                BTF_MEMBER_ENC(NAME_TBD, 17, BTF_MEMBER_OFFSET(2, 256)),        /* bits2c */
                 /* typedef unsigned int ___int */       /* [17] */
                 BTF_TYPEDEF_ENC(NAME_TBD, 18),
                 BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_VOLATILE, 0, 0), 6),      /* [18] */
                 BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_CONST, 0, 0), 15),        /* [19] */
                 BTF_END_RAW,
         },
-        BTF_STR_SEC("\0unsigned char\0unsigned short\0unsigned int\0int\0unsigned long long\0uint8_t\0uint16_t\0uint32_t\0int32_t\0uint64_t\0ui64\0ui8a\0ENUM_ZERO\0ENUM_ONE\0ENUM_TWO\0ENUM_THREE\0pprint_mapv\0ui32\0ui16\0si32\0unused_bits2a\0bits28\0unused_bits2b\0aenum\0___int"),
+        BTF_STR_SEC("\0unsigned char\0unsigned short\0unsigned int\0int\0unsigned long long\0uint8_t\0uint16_t\0uint32_t\0int32_t\0uint64_t\0ui64\0ui8a\0ENUM_ZERO\0ENUM_ONE\0ENUM_TWO\0ENUM_THREE\0pprint_mapv\0ui32\0ui16\0si32\0unused_bits2a\0bits28\0unused_bits2b\0aenum\0ui32b\0bits2c\0___int"),
         .key_size = sizeof(unsigned int),
         .value_size = sizeof(struct pprint_mapv),
         .key_type_id = 3,       /* unsigned int */
@@ -3793,6 +3798,8 @@ static void set_pprint_mapv(struct pprint_mapv *v, uint32_t i,
                 v->unused_bits2b = 3;
                 v->ui64 = i;
                 v->aenum = i & 0x03;
+                v->ui32b = 4;
+                v->bits2c = 1;
                 v = (void *)v + rounded_value_size;
         }
 }
@@ -3955,7 +3962,8 @@ static int do_test_pprint(int test_num)
 
                         nexpected_line = snprintf(expected_line, sizeof(expected_line),
                                                   "%s%u: {%u,0,%d,0x%x,0x%x,0x%x,"
-                                                  "{%lu|[%u,%u,%u,%u,%u,%u,%u,%u]},%s}\n",
+                                                  "{%lu|[%u,%u,%u,%u,%u,%u,%u,%u]},%s,"
+                                                  "%u,0x%x}\n",
                                                   percpu_map ? "\tcpu" : "",
                                                   percpu_map ? cpu : next_key,
                                                   cmapv->ui32, cmapv->si32,
@@ -3967,7 +3975,9 @@ static int do_test_pprint(int test_num)
                                                   cmapv->ui8a[2], cmapv->ui8a[3],
                                                   cmapv->ui8a[4], cmapv->ui8a[5],
                                                   cmapv->ui8a[6], cmapv->ui8a[7],
-                                                  pprint_enum_str[cmapv->aenum]);
+                                                  pprint_enum_str[cmapv->aenum],
+                                                  cmapv->ui32b,
+                                                  cmapv->bits2c);
 
                         err = check_line(expected_line, nexpected_line,
                                          sizeof(expected_line), line);
diff --git a/tools/testing/selftests/bpf/test_cgroup_storage.c b/tools/testing/selftests/bpf/test_cgroup_storage.c
index f44834155f25..2fc4625c1a15 100644
--- a/tools/testing/selftests/bpf/test_cgroup_storage.c
+++ b/tools/testing/selftests/bpf/test_cgroup_storage.c
@@ -81,7 +81,7 @@ int main(int argc, char **argv)
 
         /* Create a cgroup, get fd, and join it */
         cgroup_fd = create_and_get_cgroup(TEST_CGROUP);
-        if (!cgroup_fd) {
+        if (cgroup_fd < 0) {
                 printf("Failed to create test cgroup\n");
                 goto err;
         }
diff --git a/tools/testing/selftests/bpf/test_dev_cgroup.c b/tools/testing/selftests/bpf/test_dev_cgroup.c
index 9c8b50bac7e0..76e4993b7c16 100644
--- a/tools/testing/selftests/bpf/test_dev_cgroup.c
+++ b/tools/testing/selftests/bpf/test_dev_cgroup.c
@@ -43,7 +43,7 @@ int main(int argc, char **argv)
 
         /* Create a cgroup, get fd, and join it */
         cgroup_fd = create_and_get_cgroup(TEST_CGROUP);
-        if (!cgroup_fd) {
+        if (cgroup_fd < 0) {
                 printf("Failed to create test cgroup\n");
                 goto err;
         }
diff --git a/tools/testing/selftests/bpf/test_lpm_map.c b/tools/testing/selftests/bpf/test_lpm_map.c
index 147e34cfceb7..02d7c871862a 100644
--- a/tools/testing/selftests/bpf/test_lpm_map.c
+++ b/tools/testing/selftests/bpf/test_lpm_map.c
@@ -474,6 +474,16 @@ static void test_lpm_delete(void)
         assert(bpf_map_lookup_elem(map_fd, key, &value) == -1 &&
                 errno == ENOENT);
 
+        key->prefixlen = 30; // unused prefix so far
+        inet_pton(AF_INET, "192.255.0.0", key->data);
+        assert(bpf_map_delete_elem(map_fd, key) == -1 &&
+                errno == ENOENT);
+
+        key->prefixlen = 16; // same prefix as the root node
+        inet_pton(AF_INET, "192.255.0.0", key->data);
+        assert(bpf_map_delete_elem(map_fd, key) == -1 &&
+                errno == ENOENT);
+
         /* assert initial lookup */
         key->prefixlen = 32;
         inet_pton(AF_INET, "192.168.0.1", key->data);
diff --git a/tools/testing/selftests/bpf/test_netcnt.c b/tools/testing/selftests/bpf/test_netcnt.c
index 44ed7f29f8ab..c1da5404454a 100644
--- a/tools/testing/selftests/bpf/test_netcnt.c
+++ b/tools/testing/selftests/bpf/test_netcnt.c
@@ -65,7 +65,7 @@ int main(int argc, char **argv)
 
         /* Create a cgroup, get fd, and join it */
         cgroup_fd = create_and_get_cgroup(TEST_CGROUP);
-        if (!cgroup_fd) {
+        if (cgroup_fd < 0) {
                 printf("Failed to create test cgroup\n");
                 goto err;
         }
diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
index 126fc624290d..25f0083a9b2e 100644
--- a/tools/testing/selftests/bpf/test_progs.c
+++ b/tools/testing/selftests/bpf/test_progs.c
@@ -1188,7 +1188,9 @@ static void test_stacktrace_build_id(void)
         int i, j;
         struct bpf_stack_build_id id_offs[PERF_MAX_STACK_DEPTH];
         int build_id_matches = 0;
+        int retry = 1;
 
+retry:
         err = bpf_prog_load(file, BPF_PROG_TYPE_TRACEPOINT, &obj, &prog_fd);
         if (CHECK(err, "prog_load", "err %d errno %d\n", err, errno))
                 goto out;
@@ -1301,6 +1303,19 @@ static void test_stacktrace_build_id(void)
                 previous_key = key;
         } while (bpf_map_get_next_key(stackmap_fd, &previous_key, &key) == 0);
 
+        /* stack_map_get_build_id_offset() is racy and sometimes can return
+         * BPF_STACK_BUILD_ID_IP instead of BPF_STACK_BUILD_ID_VALID;
+         * try it one more time.
+         */
+        if (build_id_matches < 1 && retry--) {
+                ioctl(pmu_fd, PERF_EVENT_IOC_DISABLE);
+                close(pmu_fd);
+                bpf_object__close(obj);
+                printf("%s:WARN:Didn't find expected build ID from the map, retrying\n",
+                       __func__);
+                goto retry;
+        }
+
         if (CHECK(build_id_matches < 1, "build id match",
                   "Didn't find expected build ID from the map\n"))
                 goto disable_pmu;
@@ -1341,7 +1356,9 @@ static void test_stacktrace_build_id_nmi(void)
         int i, j;
         struct bpf_stack_build_id id_offs[PERF_MAX_STACK_DEPTH];
         int build_id_matches = 0;
+        int retry = 1;
 
+retry:
         err = bpf_prog_load(file, BPF_PROG_TYPE_PERF_EVENT, &obj, &prog_fd);
         if (CHECK(err, "prog_load", "err %d errno %d\n", err, errno))
                 return;
@@ -1436,6 +1453,19 @@ static void test_stacktrace_build_id_nmi(void)
                 previous_key = key;
         } while (bpf_map_get_next_key(stackmap_fd, &previous_key, &key) == 0);
 
+        /* stack_map_get_build_id_offset() is racy and sometimes can return
+         * BPF_STACK_BUILD_ID_IP instead of BPF_STACK_BUILD_ID_VALID;
+         * try it one more time.
+         */
+        if (build_id_matches < 1 && retry--) {
+                ioctl(pmu_fd, PERF_EVENT_IOC_DISABLE);
+                close(pmu_fd);
+                bpf_object__close(obj);
+                printf("%s:WARN:Didn't find expected build ID from the map, retrying\n",
+                       __func__);
+                goto retry;
+        }
+
         if (CHECK(build_id_matches < 1, "build id match",
                   "Didn't find expected build ID from the map\n"))
                 goto disable_pmu;
diff --git a/tools/testing/selftests/bpf/test_skb_cgroup_id_user.c b/tools/testing/selftests/bpf/test_skb_cgroup_id_user.c
index c121cc59f314..9220747c069d 100644
--- a/tools/testing/selftests/bpf/test_skb_cgroup_id_user.c
+++ b/tools/testing/selftests/bpf/test_skb_cgroup_id_user.c
@@ -164,7 +164,7 @@ int main(int argc, char **argv)
                 goto err;
 
         cgfd = create_and_get_cgroup(CGROUP_PATH);
-        if (!cgfd)
+        if (cgfd < 0)
                 goto err;
 
         if (join_cgroup(CGROUP_PATH))
diff --git a/tools/testing/selftests/bpf/test_sock.c b/tools/testing/selftests/bpf/test_sock.c
index b8ebe2f58074..561ffb6d6433 100644
--- a/tools/testing/selftests/bpf/test_sock.c
+++ b/tools/testing/selftests/bpf/test_sock.c
@@ -458,7 +458,7 @@ int main(int argc, char **argv)
                 goto err;
 
         cgfd = create_and_get_cgroup(CG_PATH);
-        if (!cgfd)
+        if (cgfd < 0)
                 goto err;
 
         if (join_cgroup(CG_PATH))
diff --git a/tools/testing/selftests/bpf/test_sock_addr.c b/tools/testing/selftests/bpf/test_sock_addr.c
index 73b7493d4120..3f110eaaf29c 100644
--- a/tools/testing/selftests/bpf/test_sock_addr.c
+++ b/tools/testing/selftests/bpf/test_sock_addr.c
@@ -44,6 +44,7 @@
 #define SERV6_V4MAPPED_IP       "::ffff:192.168.0.4"
 #define SRC6_IP                 "::1"
 #define SRC6_REWRITE_IP         "::6"
+#define WILDCARD6_IP            "::"
 #define SERV6_PORT              6060
 #define SERV6_REWRITE_PORT      6666
 
@@ -85,12 +86,14 @@ static int bind4_prog_load(const struct sock_addr_test *test);
 static int bind6_prog_load(const struct sock_addr_test *test);
 static int connect4_prog_load(const struct sock_addr_test *test);
 static int connect6_prog_load(const struct sock_addr_test *test);
+static int sendmsg_allow_prog_load(const struct sock_addr_test *test);
 static int sendmsg_deny_prog_load(const struct sock_addr_test *test);
 static int sendmsg4_rw_asm_prog_load(const struct sock_addr_test *test);
 static int sendmsg4_rw_c_prog_load(const struct sock_addr_test *test);
 static int sendmsg6_rw_asm_prog_load(const struct sock_addr_test *test);
 static int sendmsg6_rw_c_prog_load(const struct sock_addr_test *test);
 static int sendmsg6_rw_v4mapped_prog_load(const struct sock_addr_test *test);
+static int sendmsg6_rw_wildcard_prog_load(const struct sock_addr_test *test);
 
 static struct sock_addr_test tests[] = {
         /* bind */
@@ -463,6 +466,34 @@ static struct sock_addr_test tests[] = {
                 SYSCALL_ENOTSUPP,
         },
         {
+                "sendmsg6: set dst IP = [::] (BSD'ism)",
+                sendmsg6_rw_wildcard_prog_load,
+                BPF_CGROUP_UDP6_SENDMSG,
+                BPF_CGROUP_UDP6_SENDMSG,
+                AF_INET6,
+                SOCK_DGRAM,
+                SERV6_IP,
+                SERV6_PORT,
+                SERV6_REWRITE_IP,
+                SERV6_REWRITE_PORT,
+                SRC6_REWRITE_IP,
+                SUCCESS,
+        },
+        {
+                "sendmsg6: preserve dst IP = [::] (BSD'ism)",
+                sendmsg_allow_prog_load,
+                BPF_CGROUP_UDP6_SENDMSG,
+                BPF_CGROUP_UDP6_SENDMSG,
+                AF_INET6,
+                SOCK_DGRAM,
+                WILDCARD6_IP,
+                SERV6_PORT,
+                SERV6_REWRITE_IP,
+                SERV6_PORT,
+                SRC6_IP,
+                SUCCESS,
+        },
+        {
                 "sendmsg6: deny call",
                 sendmsg_deny_prog_load,
                 BPF_CGROUP_UDP6_SENDMSG,
@@ -734,16 +765,27 @@ static int connect6_prog_load(const struct sock_addr_test *test)
         return load_path(test, CONNECT6_PROG_PATH);
 }
 
-static int sendmsg_deny_prog_load(const struct sock_addr_test *test)
+static int sendmsg_ret_only_prog_load(const struct sock_addr_test *test,
+                                      int32_t rc)
 {
         struct bpf_insn insns[] = {
-                /* return 0 */
-                BPF_MOV64_IMM(BPF_REG_0, 0),
+                /* return rc */
+                BPF_MOV64_IMM(BPF_REG_0, rc),
                 BPF_EXIT_INSN(),
         };
         return load_insns(test, insns, sizeof(insns) / sizeof(struct bpf_insn));
 }
 
+static int sendmsg_allow_prog_load(const struct sock_addr_test *test)
+{
+        return sendmsg_ret_only_prog_load(test, /*rc*/ 1);
+}
+
+static int sendmsg_deny_prog_load(const struct sock_addr_test *test)
+{
+        return sendmsg_ret_only_prog_load(test, /*rc*/ 0);
+}
+
 static int sendmsg4_rw_asm_prog_load(const struct sock_addr_test *test)
 {
         struct sockaddr_in dst4_rw_addr;
@@ -864,6 +906,11 @@ static int sendmsg6_rw_v4mapped_prog_load(const struct sock_addr_test *test)
         return sendmsg6_rw_dst_asm_prog_load(test, SERV6_V4MAPPED_IP);
 }
 
+static int sendmsg6_rw_wildcard_prog_load(const struct sock_addr_test *test)
+{
+        return sendmsg6_rw_dst_asm_prog_load(test, WILDCARD6_IP);
+}
+
 static int sendmsg6_rw_c_prog_load(const struct sock_addr_test *test)
 {
         return load_path(test, SENDMSG6_PROG_PATH);
@@ -1395,7 +1442,7 @@ int main(int argc, char **argv)
                 goto err;
 
         cgfd = create_and_get_cgroup(CG_PATH);
-        if (!cgfd)
+        if (cgfd < 0)
                 goto err;
 
         if (join_cgroup(CG_PATH))
diff --git a/tools/testing/selftests/bpf/test_socket_cookie.c b/tools/testing/selftests/bpf/test_socket_cookie.c
index b6c2c605d8c0..fc7832ee566b 100644
--- a/tools/testing/selftests/bpf/test_socket_cookie.c
+++ b/tools/testing/selftests/bpf/test_socket_cookie.c
@@ -202,7 +202,7 @@ int main(int argc, char **argv)
                 goto err;
 
         cgfd = create_and_get_cgroup(CG_PATH);
-        if (!cgfd)
+        if (cgfd < 0)
                 goto err;
 
         if (join_cgroup(CG_PATH))
diff --git a/tools/testing/selftests/bpf/test_tcpbpf_user.c b/tools/testing/selftests/bpf/test_tcpbpf_user.c
index e6eebda7d112..716b4e3be581 100644
--- a/tools/testing/selftests/bpf/test_tcpbpf_user.c
+++ b/tools/testing/selftests/bpf/test_tcpbpf_user.c
@@ -103,7 +103,7 @@ int main(int argc, char **argv)
                 goto err;
 
         cg_fd = create_and_get_cgroup(cg_path);
-        if (!cg_fd)
+        if (cg_fd < 0)
                 goto err;
 
         if (join_cgroup(cg_path))
diff --git a/tools/testing/selftests/bpf/test_tcpnotify_user.c b/tools/testing/selftests/bpf/test_tcpnotify_user.c
index ff3c4522aed6..4e4353711a86 100644
--- a/tools/testing/selftests/bpf/test_tcpnotify_user.c
+++ b/tools/testing/selftests/bpf/test_tcpnotify_user.c
@@ -115,7 +115,7 @@ int main(int argc, char **argv)
                 goto err;
 
         cg_fd = create_and_get_cgroup(cg_path);
-        if (!cg_fd)
+        if (cg_fd < 0)
                 goto err;
 
         if (join_cgroup(cg_path))
diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
index 10d44446e801..2fd90d456892 100644
--- a/tools/testing/selftests/bpf/test_verifier.c
+++ b/tools/testing/selftests/bpf/test_verifier.c
@@ -6934,6 +6934,126 @@ static struct bpf_test tests[] = {
                 .retval = 1,
         },
         {
+                "map access: mixing value pointer and scalar, 1",
+                .insns = {
+                        // load map value pointer into r0 and r2
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_LD_MAP_FD(BPF_REG_ARG1, 0),
+                        BPF_MOV64_REG(BPF_REG_ARG2, BPF_REG_FP),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_ARG2, -16),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_FP, -16, 0),
+                        BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
+                        BPF_EXIT_INSN(),
+                        // load some number from the map into r1
+                        BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+                        // depending on r1, branch:
+                        BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 3),
+                        // branch A
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
+                        BPF_MOV64_IMM(BPF_REG_3, 0),
+                        BPF_JMP_A(2),
+                        // branch B
+                        BPF_MOV64_IMM(BPF_REG_2, 0),
+                        BPF_MOV64_IMM(BPF_REG_3, 0x100000),
+                        // common instruction
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
+                        // depending on r1, branch:
+                        BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
+                        // branch A
+                        BPF_JMP_A(4),
+                        // branch B
+                        BPF_MOV64_IMM(BPF_REG_0, 0x13371337),
+                        // verifier follows fall-through
+                        BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0x100000, 2),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                        // fake-dead code; targeted from branch A to
+                        // prevent dead code sanitization
+                        BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map_array_48b = { 1 },
+                .result = ACCEPT,
+                .result_unpriv = REJECT,
+                .errstr_unpriv = "R2 tried to add from different pointers or scalars",
+                .retval = 0,
+        },
+        {
+                "map access: mixing value pointer and scalar, 2",
+                .insns = {
+                        // load map value pointer into r0 and r2
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_LD_MAP_FD(BPF_REG_ARG1, 0),
+                        BPF_MOV64_REG(BPF_REG_ARG2, BPF_REG_FP),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_ARG2, -16),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_FP, -16, 0),
+                        BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
+                        BPF_EXIT_INSN(),
+                        // load some number from the map into r1
+                        BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+                        // depending on r1, branch:
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
+                        // branch A
+                        BPF_MOV64_IMM(BPF_REG_2, 0),
+                        BPF_MOV64_IMM(BPF_REG_3, 0x100000),
+                        BPF_JMP_A(2),
+                        // branch B
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
+                        BPF_MOV64_IMM(BPF_REG_3, 0),
+                        // common instruction
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
+                        // depending on r1, branch:
+                        BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
+                        // branch A
+                        BPF_JMP_A(4),
+                        // branch B
+                        BPF_MOV64_IMM(BPF_REG_0, 0x13371337),
+                        // verifier follows fall-through
+                        BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0x100000, 2),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                        // fake-dead code; targeted from branch A to
+                        // prevent dead code sanitization
+                        BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map_array_48b = { 1 },
+                .result = ACCEPT,
+                .result_unpriv = REJECT,
+                .errstr_unpriv = "R2 tried to add from different maps or paths",
+                .retval = 0,
+        },
+        {
+                "sanitation: alu with different scalars",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_LD_MAP_FD(BPF_REG_ARG1, 0),
+                        BPF_MOV64_REG(BPF_REG_ARG2, BPF_REG_FP),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_ARG2, -16),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_FP, -16, 0),
+                        BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
+                        BPF_EXIT_INSN(),
+                        BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
+                        BPF_MOV64_IMM(BPF_REG_2, 0),
+                        BPF_MOV64_IMM(BPF_REG_3, 0x100000),
+                        BPF_JMP_A(2),
+                        BPF_MOV64_IMM(BPF_REG_2, 42),
+                        BPF_MOV64_IMM(BPF_REG_3, 0x100001),
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map_array_48b = { 1 },
+                .result = ACCEPT,
+                .retval = 0x100000,
+        },
+        {
                 "map access: value_ptr += known scalar, upper oob arith, test 1",
                 .insns = {
                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
diff --git a/tools/testing/selftests/cpu-hotplug/cpu-on-off-test.sh b/tools/testing/selftests/cpu-hotplug/cpu-on-off-test.sh
index bab13dd025a6..0d26b5e3f966 100755
--- a/tools/testing/selftests/cpu-hotplug/cpu-on-off-test.sh
+++ b/tools/testing/selftests/cpu-hotplug/cpu-on-off-test.sh
@@ -37,6 +37,10 @@ prerequisite()
                 exit $ksft_skip
         fi
 
+        present_cpus=`cat $SYSFS/devices/system/cpu/present`
+        present_max=${present_cpus##*-}
+        echo "present_cpus = $present_cpus present_max = $present_max"
+
         echo -e "\t Cpus in online state: $online_cpus"
 
         offline_cpus=`cat $SYSFS/devices/system/cpu/offline`
@@ -151,6 +155,8 @@ online_cpus=0
 online_max=0
 offline_cpus=0
 offline_max=0
+present_cpus=0
+present_max=0
 
 while getopts e:ahp: opt; do
         case $opt in
@@ -190,9 +196,10 @@ if [ $allcpus -eq 0 ]; then
         online_cpu_expect_success $online_max
 
         if [[ $offline_cpus -gt 0 ]]; then
-                echo -e "\t offline to online to offline: cpu $offline_max"
-                online_cpu_expect_success $offline_max
-                offline_cpu_expect_success $offline_max
+                echo -e "\t offline to online to offline: cpu $present_max"
+                online_cpu_expect_success $present_max
+                offline_cpu_expect_success $present_max
+                online_cpu $present_max
         fi
         exit 0
 else
diff --git a/tools/testing/selftests/drivers/net/mlxsw/rtnetlink.sh b/tools/testing/selftests/drivers/net/mlxsw/rtnetlink.sh
index 94fdbf215c14..c4cf6e6d800e 100755
--- a/tools/testing/selftests/drivers/net/mlxsw/rtnetlink.sh
+++ b/tools/testing/selftests/drivers/net/mlxsw/rtnetlink.sh
@@ -25,6 +25,7 @@ ALL_TESTS="
         lag_unlink_slaves_test
         lag_dev_deletion_test
         vlan_interface_uppers_test
+        bridge_extern_learn_test
         devlink_reload_test
 "
 NUM_NETIFS=2
@@ -541,6 +542,25 @@ vlan_interface_uppers_test()
         ip link del dev br0
 }
 
+bridge_extern_learn_test()
+{
+        # Test that externally learned entries added from user space are
+        # marked as offloaded
+        RET=0
+
+        ip link add name br0 type bridge
+        ip link set dev $swp1 master br0
+
+        bridge fdb add de:ad:be:ef:13:37 dev $swp1 master extern_learn
+
+        bridge fdb show brport $swp1 | grep de:ad:be:ef:13:37 | grep -q offload
+        check_err $? "fdb entry not marked as offloaded when should"
+
+        log_test "externally learned fdb entry"
+
+        ip link del dev br0
+}
+
 devlink_reload_test()
 {
         # Test that after executing all the above configuration tests, a
diff --git a/tools/testing/selftests/drivers/net/mlxsw/vxlan.sh b/tools/testing/selftests/drivers/net/mlxsw/vxlan.sh
index dcf9f4e913e0..ae6146ec5afd 100755
--- a/tools/testing/selftests/drivers/net/mlxsw/vxlan.sh
+++ b/tools/testing/selftests/drivers/net/mlxsw/vxlan.sh
@@ -847,6 +847,24 @@ sanitization_vlan_aware_test()
 
         log_test "vlan-aware - failed enslavement to vlan-aware bridge"
 
+        bridge vlan del vid 10 dev vxlan20
+        bridge vlan add vid 20 dev vxlan20 pvid untagged
+
+        # Test that offloading of an unsupported tunnel fails when it is
+        # triggered by addition of VLAN to a local port
+        RET=0
+
+        # TOS must be set to inherit
+        ip link set dev vxlan10 type vxlan tos 42
+
+        ip link set dev $swp1 master br0
+        bridge vlan add vid 10 dev $swp1 &> /dev/null
+        check_fail $?
+
+        log_test "vlan-aware - failed vlan addition to a local port"
+
+        ip link set dev vxlan10 type vxlan tos inherit
+
         ip link del dev vxlan20
         ip link del dev vxlan10
         ip link del dev br0
diff --git a/tools/testing/selftests/filesystems/binderfs/.gitignore b/tools/testing/selftests/filesystems/binderfs/.gitignore
new file mode 100644
index 000000000000..8a5d9bf63dd4
--- /dev/null
+++ b/tools/testing/selftests/filesystems/binderfs/.gitignore
@@ -0,0 +1 @@
+binderfs_test
diff --git a/tools/testing/selftests/filesystems/binderfs/Makefile b/tools/testing/selftests/filesystems/binderfs/Makefile
new file mode 100644
index 000000000000..58cb659b56b4
--- /dev/null
+++ b/tools/testing/selftests/filesystems/binderfs/Makefile
@@ -0,0 +1,6 @@
+# SPDX-License-Identifier: GPL-2.0
+
+CFLAGS += -I../../../../../usr/include/
+TEST_GEN_PROGS := binderfs_test
+
+include ../../lib.mk
diff --git a/tools/testing/selftests/filesystems/binderfs/binderfs_test.c b/tools/testing/selftests/filesystems/binderfs/binderfs_test.c
new file mode 100644
index 000000000000..8c2ed962e1c7
--- /dev/null
+++ b/tools/testing/selftests/filesystems/binderfs/binderfs_test.c
@@ -0,0 +1,275 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#define _GNU_SOURCE
+#include <errno.h>
+#include <fcntl.h>
+#include <sched.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/ioctl.h>
+#include <sys/mount.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <unistd.h>
+#include <linux/android/binder.h>
+#include <linux/android/binderfs.h>
+#include "../../kselftest.h"
+
+static ssize_t write_nointr(int fd, const void *buf, size_t count)
+{
+        ssize_t ret;
+again:
+        ret = write(fd, buf, count);
+        if (ret < 0 && errno == EINTR)
+                goto again;
+
+        return ret;
+}
+
+static void write_to_file(const char *filename, const void *buf, size_t count,
+                          int allowed_errno)
+{
+        int fd, saved_errno;
+        ssize_t ret;
+
+        fd = open(filename, O_WRONLY | O_CLOEXEC);
+        if (fd < 0)
+                ksft_exit_fail_msg("%s - Failed to open file %s\n",
+                                   strerror(errno), filename);
+
+        ret = write_nointr(fd, buf, count);
+        if (ret < 0) {
+                if (allowed_errno && (errno == allowed_errno)) {
+                        close(fd);
+                        return;
+                }
+
+                goto on_error;
+        }
+
+        if ((size_t)ret != count)
+                goto on_error;
+
+        close(fd);
+        return;
+
+on_error:
+        saved_errno = errno;
+        close(fd);
+        errno = saved_errno;
+
+        if (ret < 0)
+                ksft_exit_fail_msg("%s - Failed to write to file %s\n",
+                                   strerror(errno), filename);
+
+        ksft_exit_fail_msg("Failed to write to file %s\n", filename);
+}
+
+static void change_to_userns(void)
+{
+        int ret;
+        uid_t uid;
+        gid_t gid;
+        /* {g,u}id_map files only allow a max of 4096 bytes written to them */
+        char idmap[4096];
+
+        uid = getuid();
+        gid = getgid();
+
+        ret = unshare(CLONE_NEWUSER);
+        if (ret < 0)
+                ksft_exit_fail_msg("%s - Failed to unshare user namespace\n",
+                                   strerror(errno));
+
+        write_to_file("/proc/self/setgroups", "deny", strlen("deny"), ENOENT);
+
+        ret = snprintf(idmap, sizeof(idmap), "0 %d 1", uid);
+        if (ret < 0 || (size_t)ret >= sizeof(idmap))
+                ksft_exit_fail_msg("%s - Failed to prepare uid mapping\n",
+                                   strerror(errno));
+
+        write_to_file("/proc/self/uid_map", idmap, strlen(idmap), 0);
+
+        ret = snprintf(idmap, sizeof(idmap), "0 %d 1", gid);
+        if (ret < 0 || (size_t)ret >= sizeof(idmap))
+                ksft_exit_fail_msg("%s - Failed to prepare uid mapping\n",
+                                   strerror(errno));
+
+        write_to_file("/proc/self/gid_map", idmap, strlen(idmap), 0);
+
+        ret = setgid(0);
+        if (ret)
+                ksft_exit_fail_msg("%s - Failed to setgid(0)\n",
+                                   strerror(errno));
+
+        ret = setuid(0);
+        if (ret)
+                ksft_exit_fail_msg("%s - Failed to setgid(0)\n",
+                                   strerror(errno));
+}
+
+static void change_to_mountns(void)
+{
+        int ret;
+
+        ret = unshare(CLONE_NEWNS);
+        if (ret < 0)
+                ksft_exit_fail_msg("%s - Failed to unshare mount namespace\n",
+                                   strerror(errno));
+
+        ret = mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, 0);
+        if (ret < 0)
+                ksft_exit_fail_msg("%s - Failed to mount / as private\n",
+                                   strerror(errno));
+}
+
+static void rmdir_protect_errno(const char *dir)
+{
+        int saved_errno = errno;
+        (void)rmdir(dir);
+        errno = saved_errno;
+}
+
+static void __do_binderfs_test(void)
+{
+        int fd, ret, saved_errno;
+        size_t len;
+        ssize_t wret;
+        bool keep = false;
+        struct binderfs_device device = { 0 };
+        struct binder_version version = { 0 };
+
+        change_to_mountns();
+
+        ret = mkdir("/dev/binderfs", 0755);
+        if (ret < 0) {
+                if (errno != EEXIST)
+                        ksft_exit_fail_msg(
+                                "%s - Failed to create binderfs mountpoint\n",
+                                strerror(errno));
+
+                keep = true;
+        }
+
+        ret = mount(NULL, "/dev/binderfs", "binder", 0, 0);
+        if (ret < 0) {
+                if (errno != ENODEV)
+                        ksft_exit_fail_msg("%s - Failed to mount binderfs\n",
+                                           strerror(errno));
+
+                keep ? : rmdir_protect_errno("/dev/binderfs");
+                ksft_exit_skip(
+                        "The Android binderfs filesystem is not available\n");
+        }
+
+        /* binderfs mount test passed */
+        ksft_inc_pass_cnt();
+
+        memcpy(device.name, "my-binder", strlen("my-binder"));
+
+        fd = open("/dev/binderfs/binder-control", O_RDONLY | O_CLOEXEC);
+        if (fd < 0)
+                ksft_exit_fail_msg(
+                        "%s - Failed to open binder-control device\n",
+                        strerror(errno));
+
+        ret = ioctl(fd, BINDER_CTL_ADD, &device);
+        saved_errno = errno;
+        close(fd);
+        errno = saved_errno;
+        if (ret < 0) {
+                keep ? : rmdir_protect_errno("/dev/binderfs");
+                ksft_exit_fail_msg(
+                        "%s - Failed to allocate new binder device\n",
+                        strerror(errno));
+        }
+
+        ksft_print_msg(
+                "Allocated new binder device with major %d, minor %d, and name %s\n",
+                device.major, device.minor, device.name);
+
+        /* binder device allocation test passed */
+        ksft_inc_pass_cnt();
+
+        fd = open("/dev/binderfs/my-binder", O_CLOEXEC | O_RDONLY);
+        if (fd < 0) {
+                keep ? : rmdir_protect_errno("/dev/binderfs");
+                ksft_exit_fail_msg("%s - Failed to open my-binder device\n",
+                                   strerror(errno));
+        }
+
+        ret = ioctl(fd, BINDER_VERSION, &version);
+        saved_errno = errno;
+        close(fd);
+        errno = saved_errno;
+        if (ret < 0) {
+                keep ? : rmdir_protect_errno("/dev/binderfs");
+                ksft_exit_fail_msg(
+                        "%s - Failed to open perform BINDER_VERSION request\n",
+                        strerror(errno));
+        }
+
+        ksft_print_msg("Detected binder version: %d\n",
+                       version.protocol_version);
+
+        /* binder transaction with binderfs binder device passed */
+        ksft_inc_pass_cnt();
+
+        ret = unlink("/dev/binderfs/my-binder");
+        if (ret < 0) {
+                keep ? : rmdir_protect_errno("/dev/binderfs");
+                ksft_exit_fail_msg("%s - Failed to delete binder device\n",
+                                   strerror(errno));
+        }
+
+        /* binder device removal passed */
+        ksft_inc_pass_cnt();
+
+        ret = unlink("/dev/binderfs/binder-control");
+        if (!ret) {
+                keep ? : rmdir_protect_errno("/dev/binderfs");
+                ksft_exit_fail_msg("Managed to delete binder-control device\n");
+        } else if (errno != EPERM) {
+                keep ? : rmdir_protect_errno("/dev/binderfs");
+                ksft_exit_fail_msg(
+                        "%s - Failed to delete binder-control device but exited with unexpected error code\n",
+                        strerror(errno));
+        }
+
+        /* binder-control device removal failed as expected */
+        ksft_inc_xfail_cnt();
+
+on_error:
+        ret = umount2("/dev/binderfs", MNT_DETACH);
+        keep ?: rmdir_protect_errno("/dev/binderfs");
+        if (ret < 0)
+                ksft_exit_fail_msg("%s - Failed to unmount binderfs\n",
+                                   strerror(errno));
+
+        /* binderfs unmount test passed */
+        ksft_inc_pass_cnt();
+}
+
+static void binderfs_test_privileged()
+{
+        if (geteuid() != 0)
+                ksft_print_msg(
+                        "Tests are not run as root. Skipping privileged tests\n");
+        else
+                __do_binderfs_test();
+}
+
+static void binderfs_test_unprivileged()
+{
+        change_to_userns();
+        __do_binderfs_test();
+}
+
+int main(int argc, char *argv[])
+{
+        binderfs_test_privileged();
+        binderfs_test_unprivileged();
+        ksft_exit_pass();
+}
diff --git a/tools/testing/selftests/filesystems/binderfs/config b/tools/testing/selftests/filesystems/binderfs/config
new file mode 100644
index 000000000000..02dd6cc9cf99
--- /dev/null
+++ b/tools/testing/selftests/filesystems/binderfs/config
@@ -0,0 +1,3 @@
+CONFIG_ANDROID=y
+CONFIG_ANDROID_BINDERFS=y
+CONFIG_ANDROID_BINDER_IPC=y
diff --git a/tools/testing/selftests/gpio/gpio-mockup-chardev.c b/tools/testing/selftests/gpio/gpio-mockup-chardev.c
index f8d468f54e98..aaa1e9f083c3 100644
--- a/tools/testing/selftests/gpio/gpio-mockup-chardev.c
+++ b/tools/testing/selftests/gpio/gpio-mockup-chardev.c
@@ -37,7 +37,7 @@ static int get_debugfs(char **path)
         struct libmnt_table *tb;
         struct libmnt_iter *itr = NULL;
         struct libmnt_fs *fs;
-        int found = 0;
+        int found = 0, ret;
 
         cxt = mnt_new_context();
         if (!cxt)
@@ -58,8 +58,11 @@ static int get_debugfs(char **path)
                         break;
                 }
         }
-        if (found)
-                asprintf(path, "%s/gpio", mnt_fs_get_target(fs));
+        if (found) {
+                ret = asprintf(path, "%s/gpio", mnt_fs_get_target(fs));
+                if (ret < 0)
+                        err(EXIT_FAILURE, "failed to format string");
+        }
 
         mnt_free_iter(itr);
         mnt_free_context(cxt);
diff --git a/tools/testing/selftests/ir/Makefile b/tools/testing/selftests/ir/Makefile
index f4ba8eb84b95..ad06489c22a5 100644
--- a/tools/testing/selftests/ir/Makefile
+++ b/tools/testing/selftests/ir/Makefile
@@ -1,5 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 TEST_PROGS := ir_loopback.sh
 TEST_GEN_PROGS_EXTENDED := ir_loopback
+APIDIR := ../../../include/uapi
+CFLAGS += -Wall -O2 -I$(APIDIR)
 
 include ../lib.mk
diff --git a/tools/testing/selftests/kvm/lib/kvm_util.c b/tools/testing/selftests/kvm/lib/kvm_util.c
index 23022e9d32eb..b52cfdefecbf 100644
--- a/tools/testing/selftests/kvm/lib/kvm_util.c
+++ b/tools/testing/selftests/kvm/lib/kvm_util.c
@@ -571,7 +571,7 @@ void vm_userspace_mem_region_add(struct kvm_vm *vm,
          * already exist.
          */
         region = (struct userspace_mem_region *) userspace_mem_region_find(
-                vm, guest_paddr, guest_paddr + npages * vm->page_size);
+                vm, guest_paddr, (guest_paddr + npages * vm->page_size) - 1);
         if (region != NULL)
                 TEST_ASSERT(false, "overlapping userspace_mem_region already "
                         "exists\n"
@@ -587,15 +587,10 @@ void vm_userspace_mem_region_add(struct kvm_vm *vm,
                 region = region->next) {
                 if (region->region.slot == slot)
                         break;
-                if ((guest_paddr <= (region->region.guest_phys_addr
-                                + region->region.memory_size))
-                        && ((guest_paddr + npages * vm->page_size)
-                                >= region->region.guest_phys_addr))
-                        break;
         }
         if (region != NULL)
                 TEST_ASSERT(false, "A mem region with the requested slot "
-                        "or overlapping physical memory range already exists.\n"
+                        "already exists.\n"
                         "  requested slot: %u paddr: 0x%lx npages: 0x%lx\n"
                         "  existing slot: %u paddr: 0x%lx size: 0x%lx",
                         slot, guest_paddr, npages,
diff --git a/tools/testing/selftests/kvm/x86_64/evmcs_test.c b/tools/testing/selftests/kvm/x86_64/evmcs_test.c
index ea3c73e8f4f6..c49c2a28b0eb 100644
--- a/tools/testing/selftests/kvm/x86_64/evmcs_test.c
+++ b/tools/testing/selftests/kvm/x86_64/evmcs_test.c
@@ -103,6 +103,12 @@ int main(int argc, char *argv[])
 
         vcpu_ioctl(vm, VCPU_ID, KVM_ENABLE_CAP, &enable_evmcs_cap);
 
+        /* KVM should return supported EVMCS version range */
+        TEST_ASSERT(((evmcs_ver >> 8) >= (evmcs_ver & 0xff)) &&
+                    (evmcs_ver & 0xff) > 0,
+                    "Incorrect EVMCS version range: %x:%x\n",
+                    evmcs_ver & 0xff, evmcs_ver >> 8);
+
         run = vcpu_state(vm, VCPU_ID);
 
         vcpu_regs_get(vm, VCPU_ID, &regs1);
diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests/net/Makefile
index f8f3e90700c0..1e6d14d2825c 100644
--- a/tools/testing/selftests/net/Makefile
+++ b/tools/testing/selftests/net/Makefile
@@ -21,6 +21,6 @@ TEST_GEN_PROGS += reuseport_dualstack reuseaddr_conflict tls
 KSFT_KHDR_INSTALL := 1
 include ../lib.mk
 
-$(OUTPUT)/reuseport_bpf_numa: LDFLAGS += -lnuma
+$(OUTPUT)/reuseport_bpf_numa: LDLIBS += -lnuma
 $(OUTPUT)/tcp_mmap: LDFLAGS += -lpthread
 $(OUTPUT)/tcp_inq: LDFLAGS += -lpthread
diff --git a/tools/testing/selftests/net/fib_tests.sh b/tools/testing/selftests/net/fib_tests.sh
index 802b4af18729..1080ff55a788 100755
--- a/tools/testing/selftests/net/fib_tests.sh
+++ b/tools/testing/selftests/net/fib_tests.sh
@@ -388,6 +388,7 @@ fib_carrier_unicast_test()
 
         set -e
         $IP link set dev dummy0 carrier off
+        sleep 1
         set +e
 
         echo "    Carrier down"
diff --git a/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh b/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh
index d8313d0438b7..b90dff8d3a94 100755
--- a/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh
+++ b/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 # SPDX-License-Identifier: GPL-2.0
 
-ALL_TESTS="ping_ipv4 ping_ipv6 learning flooding"
+ALL_TESTS="ping_ipv4 ping_ipv6 learning flooding vlan_deletion extern_learn"
 NUM_NETIFS=4
 CHECK_TC="yes"
 source lib.sh
@@ -96,6 +96,51 @@ flooding()
         flood_test $swp2 $h1 $h2
 }
 
+vlan_deletion()
+{
+        # Test that the deletion of a VLAN on a bridge port does not affect
+        # the PVID VLAN
+        log_info "Add and delete a VLAN on bridge port $swp1"
+
+        bridge vlan add vid 10 dev $swp1
+        bridge vlan del vid 10 dev $swp1
+
+        ping_ipv4
+        ping_ipv6
+}
+
+extern_learn()
+{
+        local mac=de:ad:be:ef:13:37
+        local ageing_time
+
+        # Test that externally learned FDB entries can roam, but not age out
+        RET=0
+
+        bridge fdb add de:ad:be:ef:13:37 dev $swp1 master extern_learn vlan 1
+
+        bridge fdb show brport $swp1 | grep -q de:ad:be:ef:13:37
+        check_err $? "Did not find FDB entry when should"
+
+        # Wait for 10 seconds after the ageing time to make sure the FDB entry
+        # was not aged out
+        ageing_time=$(bridge_ageing_time_get br0)
+        sleep $((ageing_time + 10))
+
+        bridge fdb show brport $swp1 | grep -q de:ad:be:ef:13:37
+        check_err $? "FDB entry was aged out when should not"
+
+        $MZ $h2 -c 1 -p 64 -a $mac -t ip -q
+
+        bridge fdb show brport $swp2 | grep -q de:ad:be:ef:13:37
+        check_err $? "FDB entry did not roam when should"
+
+        log_test "Externally learned FDB entry - ageing & roaming"
+
+        bridge fdb del de:ad:be:ef:13:37 dev $swp2 master vlan 1 &> /dev/null
+        bridge fdb del de:ad:be:ef:13:37 dev $swp1 master vlan 1 &> /dev/null
+}
+
 trap cleanup EXIT
 
 setup_prepare
diff --git a/tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh b/tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh
index 56cef3b1c194..bb10e33690b2 100755
--- a/tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh
+++ b/tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh
@@ -629,7 +629,7 @@ __test_ecn_decap()
         RET=0
 
         tc filter add dev $h1 ingress pref 77 prot ip \
-                flower ip_tos $decapped_tos action pass
+                flower ip_tos $decapped_tos action drop
         sleep 1
         vxlan_encapped_ping_test v2 v1 192.0.2.17 \
                                  $orig_inner_tos $orig_outer_tos \
diff --git a/tools/testing/selftests/net/ip_defrag.c b/tools/testing/selftests/net/ip_defrag.c
index 61ae2782388e..5d56cc0838f6 100644
--- a/tools/testing/selftests/net/ip_defrag.c
+++ b/tools/testing/selftests/net/ip_defrag.c
@@ -203,6 +203,7 @@ static void send_udp_frags(int fd_raw, struct sockaddr *addr,
 {
         struct ip *iphdr = (struct ip *)ip_frame;
         struct ip6_hdr *ip6hdr = (struct ip6_hdr *)ip_frame;
+        const bool ipv4 = !ipv6;
         int res;
         int offset;
         int frag_len;
@@ -239,19 +240,53 @@ static void send_udp_frags(int fd_raw, struct sockaddr *addr,
                 iphdr->ip_sum = 0;
         }
 
+        /* Occasionally test in-order fragments. */
+        if (!cfg_overlap && (rand() % 100 < 15)) {
+                offset = 0;
+                while (offset < (UDP_HLEN + payload_len)) {
+                        send_fragment(fd_raw, addr, alen, offset, ipv6);
+                        offset += max_frag_len;
+                }
+                return;
+        }
+
+        /* Occasionally test IPv4 "runs" (see net/ipv4/ip_fragment.c) */
+        if (ipv4 && !cfg_overlap && (rand() % 100 < 20) &&
+                        (payload_len > 9 * max_frag_len)) {
+                offset = 6 * max_frag_len;
+                while (offset < (UDP_HLEN + payload_len)) {
+                        send_fragment(fd_raw, addr, alen, offset, ipv6);
+                        offset += max_frag_len;
+                }
+                offset = 3 * max_frag_len;
+                while (offset < 6 * max_frag_len) {
+                        send_fragment(fd_raw, addr, alen, offset, ipv6);
+                        offset += max_frag_len;
+                }
+                offset = 0;
+                while (offset < 3 * max_frag_len) {
+                        send_fragment(fd_raw, addr, alen, offset, ipv6);
+                        offset += max_frag_len;
+                }
+                return;
+        }
+
         /* Odd fragments. */
         offset = max_frag_len;
         while (offset < (UDP_HLEN + payload_len)) {
                 send_fragment(fd_raw, addr, alen, offset, ipv6);
+                /* IPv4 ignores duplicates, so randomly send a duplicate. */
+                if (ipv4 && (1 == rand() % 100))
+                        send_fragment(fd_raw, addr, alen, offset, ipv6);
                 offset += 2 * max_frag_len;
         }
 
         if (cfg_overlap) {
                 /* Send an extra random fragment. */
-                offset = rand() % (UDP_HLEN + payload_len - 1);
-                /* sendto() returns EINVAL if offset + frag_len is too small. */
                 if (ipv6) {
                         struct ip6_frag *fraghdr = (struct ip6_frag *)(ip_frame + IP6_HLEN);
+                        /* sendto() returns EINVAL if offset + frag_len is too small. */
+                        offset = rand() % (UDP_HLEN + payload_len - 1);
                         frag_len = max_frag_len + rand() % 256;
                         /* In IPv6 if !!(frag_len % 8), the fragment is dropped. */
                         frag_len &= ~0x7;
@@ -259,13 +294,29 @@ static void send_udp_frags(int fd_raw, struct sockaddr *addr,
                         ip6hdr->ip6_plen = htons(frag_len);
                         frag_len += IP6_HLEN;
                 } else {
-                        frag_len = IP4_HLEN + UDP_HLEN + rand() % 256;
+                        /* In IPv4, duplicates and some fragments completely inside
+                         * previously sent fragments are dropped/ignored. So
+                         * random offset and frag_len can result in a dropped
+                         * fragment instead of a dropped queue/packet. So we
+                         * hard-code offset and frag_len.
+                         *
+                         * See ade446403bfb ("net: ipv4: do not handle duplicate
+                         * fragments as overlapping").
+                         */
+                        if (max_frag_len * 4 < payload_len || max_frag_len < 16) {
+                                /* not enough payload to play with random offset and frag_len. */
+                                offset = 8;
+                                frag_len = IP4_HLEN + UDP_HLEN + max_frag_len;
+                        } else {
+                                offset = rand() % (payload_len / 2);
+                                frag_len = 2 * max_frag_len + 1 + rand() % 256;
+                        }
                         iphdr->ip_off = htons(offset / 8 | IP4_MF);
                         iphdr->ip_len = htons(frag_len);
                 }
                 res = sendto(fd_raw, ip_frame, frag_len, 0, addr, alen);
                 if (res < 0)
-                        error(1, errno, "sendto overlap");
+                        error(1, errno, "sendto overlap: %d", frag_len);
                 if (res != frag_len)
                         error(1, 0, "sendto overlap: %d vs %d", (int)res, frag_len);
                 frag_counter++;
@@ -275,6 +326,9 @@ static void send_udp_frags(int fd_raw, struct sockaddr *addr,
         offset = 0;
         while (offset < (UDP_HLEN + payload_len)) {
                 send_fragment(fd_raw, addr, alen, offset, ipv6);
+                /* IPv4 ignores duplicates, so randomly send a duplicate. */
+                if (ipv4 && (1 == rand() % 100))
+                        send_fragment(fd_raw, addr, alen, offset, ipv6);
                 offset += 2 * max_frag_len;
         }
 }
@@ -282,7 +336,11 @@ static void send_udp_frags(int fd_raw, struct sockaddr *addr,
 static void run_test(struct sockaddr *addr, socklen_t alen, bool ipv6)
 {
         int fd_tx_raw, fd_rx_udp;
-        struct timeval tv = { .tv_sec = 0, .tv_usec = 10 * 1000 };
+        /* Frag queue timeout is set to one second in the calling script;
+         * socket timeout should be just a bit longer to avoid tests interfering
+         * with each other.
+         */
+        struct timeval tv = { .tv_sec = 1, .tv_usec = 10 };
         int idx;
         int min_frag_len = ipv6 ? 1280 : 8;
 
@@ -308,12 +366,32 @@ static void run_test(struct sockaddr *addr, socklen_t alen, bool ipv6)
                         payload_len += (rand() % 4096)) {
                 if (cfg_verbose)
                         printf("payload_len: %d\n", payload_len);
-                max_frag_len = min_frag_len;
-                do {
+
+                if (cfg_overlap) {
+                        /* With overlaps, one send/receive pair below takes
+                         * at least one second (== timeout) to run, so there
+                         * is not enough test time to run a nested loop:
+                         * the full overlap test takes 20-30 seconds.
+                         */
+                        max_frag_len = min_frag_len +
+                                rand() % (1500 - FRAG_HLEN - min_frag_len);
                         send_udp_frags(fd_tx_raw, addr, alen, ipv6);
                         recv_validate_udp(fd_rx_udp);
-                        max_frag_len += 8 * (rand() % 8);
-                } while (max_frag_len < (1500 - FRAG_HLEN) && max_frag_len <= payload_len);
+                } else {
+                        /* Without overlaps, each packet reassembly (== one
+                         * send/receive pair below) takes very little time to
+                         * run, so we can easily afford more thourough testing
+                         * with a nested loop: the full non-overlap test takes
+                         * less than one second).
+                         */
+                        max_frag_len = min_frag_len;
+                        do {
+                                send_udp_frags(fd_tx_raw, addr, alen, ipv6);
+                                recv_validate_udp(fd_rx_udp);
+                                max_frag_len += 8 * (rand() % 8);
+                        } while (max_frag_len < (1500 - FRAG_HLEN) &&
+                                 max_frag_len <= payload_len);
+                }
         }
 
         /* Cleanup. */
diff --git a/tools/testing/selftests/net/ip_defrag.sh b/tools/testing/selftests/net/ip_defrag.sh
index f34672796044..7dd79a9efb17 100755
--- a/tools/testing/selftests/net/ip_defrag.sh
+++ b/tools/testing/selftests/net/ip_defrag.sh
@@ -11,10 +11,17 @@ readonly NETNS="ns-$(mktemp -u XXXXXX)"
 setup() {
         ip netns add "${NETNS}"
         ip -netns "${NETNS}" link set lo up
+
         ip netns exec "${NETNS}" sysctl -w net.ipv4.ipfrag_high_thresh=9000000 >/dev/null 2>&1
         ip netns exec "${NETNS}" sysctl -w net.ipv4.ipfrag_low_thresh=7000000 >/dev/null 2>&1
+        ip netns exec "${NETNS}" sysctl -w net.ipv4.ipfrag_time=1 >/dev/null 2>&1
+
         ip netns exec "${NETNS}" sysctl -w net.ipv6.ip6frag_high_thresh=9000000 >/dev/null 2>&1
         ip netns exec "${NETNS}" sysctl -w net.ipv6.ip6frag_low_thresh=7000000 >/dev/null 2>&1
+        ip netns exec "${NETNS}" sysctl -w net.ipv6.ip6frag_time=1 >/dev/null 2>&1
+
+        # DST cache can get full with a lot of frags, with GC not keeping up with the test.
+        ip netns exec "${NETNS}" sysctl -w net.ipv6.route.max_size=65536 >/dev/null 2>&1
 }
 
 cleanup() {
@@ -27,7 +34,6 @@ setup
 echo "ipv4 defrag"
 ip netns exec "${NETNS}" ./ip_defrag -4
 
-
 echo "ipv4 defrag with overlaps"
 ip netns exec "${NETNS}" ./ip_defrag -4o
 
@@ -37,3 +43,4 @@ ip netns exec "${NETNS}" ./ip_defrag -6
 echo "ipv6 defrag with overlaps"
 ip netns exec "${NETNS}" ./ip_defrag -6o
 
+echo "all tests done"
diff --git a/tools/testing/selftests/net/xfrm_policy.sh b/tools/testing/selftests/net/xfrm_policy.sh
index 8db35b99457c..71d7fdc513c1 100755
--- a/tools/testing/selftests/net/xfrm_policy.sh
+++ b/tools/testing/selftests/net/xfrm_policy.sh
@@ -28,6 +28,19 @@ KEY_AES=0x0123456789abcdef0123456789012345
 SPI1=0x1
 SPI2=0x2
 
+do_esp_policy() {
+    local ns=$1
+    local me=$2
+    local remote=$3
+    local lnet=$4
+    local rnet=$5
+
+    # to encrypt packets as they go out (includes forwarded packets that need encapsulation)
+    ip -net $ns xfrm policy add src $lnet dst $rnet dir out tmpl src $me dst $remote proto esp mode tunnel priority 100 action allow
+    # to fwd decrypted packets after esp processing:
+    ip -net $ns xfrm policy add src $rnet dst $lnet dir fwd tmpl src $remote dst $me proto esp mode tunnel priority 100 action allow
+}
+
 do_esp() {
     local ns=$1
     local me=$2
@@ -40,10 +53,59 @@ do_esp() {
     ip -net $ns xfrm state add src $remote dst $me proto esp spi $spi_in  enc aes $KEY_AES  auth sha1 $KEY_SHA  mode tunnel sel src $rnet dst $lnet
     ip -net $ns xfrm state add src $me  dst $remote proto esp spi $spi_out enc aes $KEY_AES auth sha1 $KEY_SHA mode tunnel sel src $lnet dst $rnet
 
-    # to encrypt packets as they go out (includes forwarded packets that need encapsulation)
-    ip -net $ns xfrm policy add src $lnet dst $rnet dir out tmpl src $me dst $remote proto esp mode tunnel priority 100 action allow
-    # to fwd decrypted packets after esp processing:
-    ip -net $ns xfrm policy add src $rnet dst $lnet dir fwd tmpl src $remote dst $me proto esp mode tunnel priority 100 action allow
+    do_esp_policy $ns $me $remote $lnet $rnet
+}
+
+# add policies with different netmasks, to make sure kernel carries
+# the policies contained within new netmask over when search tree is
+# re-built.
+# peer netns that are supposed to be encapsulated via esp have addresses
+# in the 10.0.1.0/24 and 10.0.2.0/24 subnets, respectively.
+#
+# Adding a policy for '10.0.1.0/23' will make it necessary to
+# alter the prefix of 10.0.1.0 subnet.
+# In case new prefix overlaps with existing node, the node and all
+# policies it carries need to be merged with the existing one(s).
+#
+# Do that here.
+do_overlap()
+{
+    local ns=$1
+
+    # adds new nodes to tree (neither network exists yet in policy database).
+    ip -net $ns xfrm policy add src 10.1.0.0/24 dst 10.0.0.0/24 dir fwd priority 200 action block
+
+    # adds a new node in the 10.0.0.0/24 tree (dst node exists).
+    ip -net $ns xfrm policy add src 10.2.0.0/24 dst 10.0.0.0/24 dir fwd priority 200 action block
+
+    # adds a 10.2.0.0/23 node, but for different dst.
+    ip -net $ns xfrm policy add src 10.2.0.0/23 dst 10.0.1.0/24 dir fwd priority 200 action block
+
+    # dst now overlaps with the 10.0.1.0/24 ESP policy in fwd.
+    # kernel must 'promote' existing one (10.0.0.0/24) to 10.0.0.0/23.
+    # But 10.0.0.0/23 also includes existing 10.0.1.0/24, so that node
+    # also has to be merged too, including source-sorted subtrees.
+    # old:
+    # 10.0.0.0/24 (node 1 in dst tree of the bin)
+    #    10.1.0.0/24 (node in src tree of dst node 1)
+    #    10.2.0.0/24 (node in src tree of dst node 1)
+    # 10.0.1.0/24 (node 2 in dst tree of the bin)
+    #    10.0.2.0/24 (node in src tree of dst node 2)
+    #    10.2.0.0/24 (node in src tree of dst node 2)
+    #
+    # The next 'policy add' adds dst '10.0.0.0/23', which means
+    # that dst node 1 and dst node 2 have to be merged including
+    # the sub-tree.  As no duplicates are allowed, policies in
+    # the two '10.0.2.0/24' are also merged.
+    #
+    # after the 'add', internal search tree should look like this:
+    # 10.0.0.0/23 (node in dst tree of bin)
+    #     10.0.2.0/24 (node in src tree of dst node)
+    #     10.1.0.0/24 (node in src tree of dst node)
+    #     10.2.0.0/24 (node in src tree of dst node)
+    #
+    # 10.0.0.0/24 and 10.0.1.0/24 nodes have been merged as 10.0.0.0/23.
+    ip -net $ns xfrm policy add src 10.1.0.0/24 dst 10.0.0.0/23 dir fwd priority 200 action block
 }
 
 do_esp_policy_get_check() {
@@ -160,6 +222,41 @@ check_xfrm() {
         return $lret
 }
 
+check_exceptions()
+{
+        logpostfix="$1"
+        local lret=0
+
+        # ping to .254 should be excluded from the tunnel (exception is in place).
+        check_xfrm 0 254
+        if [ $? -ne 0 ]; then
+                echo "FAIL: expected ping to .254 to fail ($logpostfix)"
+                lret=1
+        else
+                echo "PASS: ping to .254 bypassed ipsec tunnel ($logpostfix)"
+        fi
+
+        # ping to .253 should use use ipsec due to direct policy exception.
+        check_xfrm 1 253
+        if [ $? -ne 0 ]; then
+                echo "FAIL: expected ping to .253 to use ipsec tunnel ($logpostfix)"
+                lret=1
+        else
+                echo "PASS: direct policy matches ($logpostfix)"
+        fi
+
+        # ping to .2 should use ipsec.
+        check_xfrm 1 2
+        if [ $? -ne 0 ]; then
+                echo "FAIL: expected ping to .2 to use ipsec tunnel ($logpostfix)"
+                lret=1
+        else
+                echo "PASS: policy matches ($logpostfix)"
+        fi
+
+        return $lret
+}
+
 #check for needed privileges
 if [ "$(id -u)" -ne 0 ];then
         echo "SKIP: Need root privileges"
@@ -270,33 +367,45 @@ do_exception ns4 10.0.3.10 10.0.3.1 10.0.1.253 10.0.1.240/28
 do_exception ns3 dead:3::1 dead:3::10 dead:2::fd  dead:2:f0::/96
 do_exception ns4 dead:3::10 dead:3::1 dead:1::fd  dead:1:f0::/96
 
-# ping to .254 should now be excluded from the tunnel
-check_xfrm 0 254
+check_exceptions "exceptions"
 if [ $? -ne 0 ]; then
-        echo "FAIL: expected ping to .254 to fail"
         ret=1
-else
-        echo "PASS: ping to .254 bypassed ipsec tunnel"
 fi
 
-# ping to .253 should use use ipsec due to direct policy exception.
-check_xfrm 1 253
-if [ $? -ne 0 ]; then
-        echo "FAIL: expected ping to .253 to use ipsec tunnel"
-        ret=1
-else
-        echo "PASS: direct policy matches"
-fi
+# insert block policies with adjacent/overlapping netmasks
+do_overlap ns3
 
-# ping to .2 should use ipsec.
-check_xfrm 1 2
+check_exceptions "exceptions and block policies"
 if [ $? -ne 0 ]; then
-        echo "FAIL: expected ping to .2 to use ipsec tunnel"
         ret=1
-else
-        echo "PASS: policy matches"
 fi
 
+for n in ns3 ns4;do
+        ip -net $n xfrm policy set hthresh4 28 24 hthresh6 126 125
+        sleep $((RANDOM%5))
+done
+
+check_exceptions "exceptions and block policies after hresh changes"
+
+# full flush of policy db, check everything gets freed incl. internal meta data
+ip -net ns3 xfrm policy flush
+
+do_esp_policy ns3 10.0.3.1 10.0.3.10 10.0.1.0/24 10.0.2.0/24
+do_exception ns3 10.0.3.1 10.0.3.10 10.0.2.253 10.0.2.240/28
+
+# move inexact policies to hash table
+ip -net ns3 xfrm policy set hthresh4 16 16
+
+sleep $((RANDOM%5))
+check_exceptions "exceptions and block policies after hthresh change in ns3"
+
+# restore original hthresh settings -- move policies back to tables
+for n in ns3 ns4;do
+        ip -net $n xfrm policy set hthresh4 32 32 hthresh6 128 128
+        sleep $((RANDOM%5))
+done
+check_exceptions "exceptions and block policies after hresh change to normal"
+
 for i in 1 2 3 4;do ip netns del ns$i;done
 
 exit $ret
diff --git a/tools/testing/selftests/netfilter/Makefile b/tools/testing/selftests/netfilter/Makefile
index 47ed6cef93fb..c9ff2b47bd1c 100644
--- a/tools/testing/selftests/netfilter/Makefile
+++ b/tools/testing/selftests/netfilter/Makefile
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0
 # Makefile for netfilter selftests
 
-TEST_PROGS := nft_trans_stress.sh
+TEST_PROGS := nft_trans_stress.sh nft_nat.sh
 
 include ../lib.mk
diff --git a/tools/testing/selftests/netfilter/config b/tools/testing/selftests/netfilter/config
index 1017313e41a8..59caa8f71cd8 100644
--- a/tools/testing/selftests/netfilter/config
+++ b/tools/testing/selftests/netfilter/config
@@ -1,2 +1,2 @@
 CONFIG_NET_NS=y
-NF_TABLES_INET=y
+CONFIG_NF_TABLES_INET=y
diff --git a/tools/testing/selftests/netfilter/nft_nat.sh b/tools/testing/selftests/netfilter/nft_nat.sh
new file mode 100755
index 000000000000..8ec76681605c
--- /dev/null
+++ b/tools/testing/selftests/netfilter/nft_nat.sh
@@ -0,0 +1,762 @@
+#!/bin/bash
+#
+# This test is for basic NAT functionality: snat, dnat, redirect, masquerade.
+#
+
+# Kselftest framework requirement - SKIP code is 4.
+ksft_skip=4
+ret=0
+
+nft --version > /dev/null 2>&1
+if [ $? -ne 0 ];then
+        echo "SKIP: Could not run test without nft tool"
+        exit $ksft_skip
+fi
+
+ip -Version > /dev/null 2>&1
+if [ $? -ne 0 ];then
+        echo "SKIP: Could not run test without ip tool"
+        exit $ksft_skip
+fi
+
+ip netns add ns0
+ip netns add ns1
+ip netns add ns2
+
+ip link add veth0 netns ns0 type veth peer name eth0 netns ns1
+ip link add veth1 netns ns0 type veth peer name eth0 netns ns2
+
+ip -net ns0 link set lo up
+ip -net ns0 link set veth0 up
+ip -net ns0 addr add 10.0.1.1/24 dev veth0
+ip -net ns0 addr add dead:1::1/64 dev veth0
+
+ip -net ns0 link set veth1 up
+ip -net ns0 addr add 10.0.2.1/24 dev veth1
+ip -net ns0 addr add dead:2::1/64 dev veth1
+
+for i in 1 2; do
+  ip -net ns$i link set lo up
+  ip -net ns$i link set eth0 up
+  ip -net ns$i addr add 10.0.$i.99/24 dev eth0
+  ip -net ns$i route add default via 10.0.$i.1
+  ip -net ns$i addr add dead:$i::99/64 dev eth0
+  ip -net ns$i route add default via dead:$i::1
+done
+
+bad_counter()
+{
+        local ns=$1
+        local counter=$2
+        local expect=$3
+
+        echo "ERROR: $counter counter in $ns has unexpected value (expected $expect)" 1>&2
+        ip netns exec $ns nft list counter inet filter $counter 1>&2
+}
+
+check_counters()
+{
+        ns=$1
+        local lret=0
+
+        cnt=$(ip netns exec $ns nft list counter inet filter ns0in | grep -q "packets 1 bytes 84")
+        if [ $? -ne 0 ]; then
+                bad_counter $ns ns0in "packets 1 bytes 84"
+                lret=1
+        fi
+        cnt=$(ip netns exec $ns nft list counter inet filter ns0out | grep -q "packets 1 bytes 84")
+        if [ $? -ne 0 ]; then
+                bad_counter $ns ns0out "packets 1 bytes 84"
+                lret=1
+        fi
+
+        expect="packets 1 bytes 104"
+        cnt=$(ip netns exec $ns nft list counter inet filter ns0in6 | grep -q "$expect")
+        if [ $? -ne 0 ]; then
+                bad_counter $ns ns0in6 "$expect"
+                lret=1
+        fi
+        cnt=$(ip netns exec $ns nft list counter inet filter ns0out6 | grep -q "$expect")
+        if [ $? -ne 0 ]; then
+                bad_counter $ns ns0out6 "$expect"
+                lret=1
+        fi
+
+        return $lret
+}
+
+check_ns0_counters()
+{
+        local ns=$1
+        local lret=0
+
+        cnt=$(ip netns exec ns0 nft list counter inet filter ns0in | grep -q "packets 0 bytes 0")
+        if [ $? -ne 0 ]; then
+                bad_counter ns0 ns0in "packets 0 bytes 0"
+                lret=1
+        fi
+
+        cnt=$(ip netns exec ns0 nft list counter inet filter ns0in6 | grep -q "packets 0 bytes 0")
+        if [ $? -ne 0 ]; then
+                bad_counter ns0 ns0in6 "packets 0 bytes 0"
+                lret=1
+        fi
+
+        cnt=$(ip netns exec ns0 nft list counter inet filter ns0out | grep -q "packets 0 bytes 0")
+        if [ $? -ne 0 ]; then
+                bad_counter ns0 ns0out "packets 0 bytes 0"
+                lret=1
+        fi
+        cnt=$(ip netns exec ns0 nft list counter inet filter ns0out6 | grep -q "packets 0 bytes 0")
+        if [ $? -ne 0 ]; then
+                bad_counter ns0 ns0out6 "packets 0 bytes 0"
+                lret=1
+        fi
+
+        for dir in "in" "out" ; do
+                expect="packets 1 bytes 84"
+                cnt=$(ip netns exec ns0 nft list counter inet filter ${ns}${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns0 $ns$dir "$expect"
+                        lret=1
+                fi
+
+                expect="packets 1 bytes 104"
+                cnt=$(ip netns exec ns0 nft list counter inet filter ${ns}${dir}6 | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns0 $ns$dir6 "$expect"
+                        lret=1
+                fi
+        done
+
+        return $lret
+}
+
+reset_counters()
+{
+        for i in 0 1 2;do
+                ip netns exec ns$i nft reset counters inet > /dev/null
+        done
+}
+
+test_local_dnat6()
+{
+        local lret=0
+ip netns exec ns0 nft -f - <<EOF
+table ip6 nat {
+        chain output {
+                type nat hook output priority 0; policy accept;
+                ip6 daddr dead:1::99 dnat to dead:2::99
+        }
+}
+EOF
+        if [ $? -ne 0 ]; then
+                echo "SKIP: Could not add add ip6 dnat hook"
+                return $ksft_skip
+        fi
+
+        # ping netns1, expect rewrite to netns2
+        ip netns exec ns0 ping -q -c 1 dead:1::99 > /dev/null
+        if [ $? -ne 0 ]; then
+                lret=1
+                echo "ERROR: ping6 failed"
+                return $lret
+        fi
+
+        expect="packets 0 bytes 0"
+        for dir in "in6" "out6" ; do
+                cnt=$(ip netns exec ns0 nft list counter inet filter ns1${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns0 ns1$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        expect="packets 1 bytes 104"
+        for dir in "in6" "out6" ; do
+                cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns0 ns2$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        # expect 0 count in ns1
+        expect="packets 0 bytes 0"
+        for dir in "in6" "out6" ; do
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns0$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        # expect 1 packet in ns2
+        expect="packets 1 bytes 104"
+        for dir in "in6" "out6" ; do
+                cnt=$(ip netns exec ns2 nft list counter inet filter ns0${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns2 ns0$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        test $lret -eq 0 && echo "PASS: ipv6 ping to ns1 was NATted to ns2"
+        ip netns exec ns0 nft flush chain ip6 nat output
+
+        return $lret
+}
+
+test_local_dnat()
+{
+        local lret=0
+ip netns exec ns0 nft -f - <<EOF
+table ip nat {
+        chain output {
+                type nat hook output priority 0; policy accept;
+                ip daddr 10.0.1.99 dnat to 10.0.2.99
+        }
+}
+EOF
+        # ping netns1, expect rewrite to netns2
+        ip netns exec ns0 ping -q -c 1 10.0.1.99 > /dev/null
+        if [ $? -ne 0 ]; then
+                lret=1
+                echo "ERROR: ping failed"
+                return $lret
+        fi
+
+        expect="packets 0 bytes 0"
+        for dir in "in" "out" ; do
+                cnt=$(ip netns exec ns0 nft list counter inet filter ns1${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns0 ns1$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        expect="packets 1 bytes 84"
+        for dir in "in" "out" ; do
+                cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns0 ns2$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        # expect 0 count in ns1
+        expect="packets 0 bytes 0"
+        for dir in "in" "out" ; do
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns0$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        # expect 1 packet in ns2
+        expect="packets 1 bytes 84"
+        for dir in "in" "out" ; do
+                cnt=$(ip netns exec ns2 nft list counter inet filter ns0${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns2 ns0$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        test $lret -eq 0 && echo "PASS: ping to ns1 was NATted to ns2"
+
+        ip netns exec ns0 nft flush chain ip nat output
+
+        reset_counters
+        ip netns exec ns0 ping -q -c 1 10.0.1.99 > /dev/null
+        if [ $? -ne 0 ]; then
+                lret=1
+                echo "ERROR: ping failed"
+                return $lret
+        fi
+
+        expect="packets 1 bytes 84"
+        for dir in "in" "out" ; do
+                cnt=$(ip netns exec ns0 nft list counter inet filter ns1${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns1$dir "$expect"
+                        lret=1
+                fi
+        done
+        expect="packets 0 bytes 0"
+        for dir in "in" "out" ; do
+                cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns0 ns2$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        # expect 1 count in ns1
+        expect="packets 1 bytes 84"
+        for dir in "in" "out" ; do
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns0 ns0$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        # expect 0 packet in ns2
+        expect="packets 0 bytes 0"
+        for dir in "in" "out" ; do
+                cnt=$(ip netns exec ns2 nft list counter inet filter ns0${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns2 ns2$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        test $lret -eq 0 && echo "PASS: ping to ns1 OK after nat output chain flush"
+
+        return $lret
+}
+
+
+test_masquerade6()
+{
+        local lret=0
+
+        ip netns exec ns0 sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
+
+        ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
+        if [ $? -ne 0 ] ; then
+                echo "ERROR: cannot ping ns1 from ns2 via ipv6"
+                return 1
+                lret=1
+        fi
+
+        expect="packets 1 bytes 104"
+        for dir in "in6" "out6" ; do
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns2$dir "$expect"
+                        lret=1
+                fi
+
+                cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns2 ns1$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        reset_counters
+
+# add masquerading rule
+ip netns exec ns0 nft -f - <<EOF
+table ip6 nat {
+        chain postrouting {
+                type nat hook postrouting priority 0; policy accept;
+                meta oif veth0 masquerade
+        }
+}
+EOF
+        ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
+        if [ $? -ne 0 ] ; then
+                echo "ERROR: cannot ping ns1 from ns2 with active ipv6 masquerading"
+                lret=1
+        fi
+
+        # ns1 should have seen packets from ns0, due to masquerade
+        expect="packets 1 bytes 104"
+        for dir in "in6" "out6" ; do
+
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns0$dir "$expect"
+                        lret=1
+                fi
+
+                cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns2 ns1$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        # ns1 should not have seen packets from ns2, due to masquerade
+        expect="packets 0 bytes 0"
+        for dir in "in6" "out6" ; do
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns0$dir "$expect"
+                        lret=1
+                fi
+
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns2 ns1$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        ip netns exec ns0 nft flush chain ip6 nat postrouting
+        if [ $? -ne 0 ]; then
+                echo "ERROR: Could not flush ip6 nat postrouting" 1>&2
+                lret=1
+        fi
+
+        test $lret -eq 0 && echo "PASS: IPv6 masquerade for ns2"
+
+        return $lret
+}
+
+test_masquerade()
+{
+        local lret=0
+
+        ip netns exec ns0 sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null
+        ip netns exec ns0 sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null
+
+        ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
+        if [ $? -ne 0 ] ; then
+                echo "ERROR: canot ping ns1 from ns2"
+                lret=1
+        fi
+
+        expect="packets 1 bytes 84"
+        for dir in "in" "out" ; do
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns2$dir "$expect"
+                        lret=1
+                fi
+
+                cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns2 ns1$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        reset_counters
+
+# add masquerading rule
+ip netns exec ns0 nft -f - <<EOF
+table ip nat {
+        chain postrouting {
+                type nat hook postrouting priority 0; policy accept;
+                meta oif veth0 masquerade
+        }
+}
+EOF
+        ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
+        if [ $? -ne 0 ] ; then
+                echo "ERROR: cannot ping ns1 from ns2 with active ip masquerading"
+                lret=1
+        fi
+
+        # ns1 should have seen packets from ns0, due to masquerade
+        expect="packets 1 bytes 84"
+        for dir in "in" "out" ; do
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns0$dir "$expect"
+                        lret=1
+                fi
+
+                cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns2 ns1$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        # ns1 should not have seen packets from ns2, due to masquerade
+        expect="packets 0 bytes 0"
+        for dir in "in" "out" ; do
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns0$dir "$expect"
+                        lret=1
+                fi
+
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns2 ns1$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        ip netns exec ns0 nft flush chain ip nat postrouting
+        if [ $? -ne 0 ]; then
+                echo "ERROR: Could not flush nat postrouting" 1>&2
+                lret=1
+        fi
+
+        test $lret -eq 0 && echo "PASS: IP masquerade for ns2"
+
+        return $lret
+}
+
+test_redirect6()
+{
+        local lret=0
+
+        ip netns exec ns0 sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
+
+        ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
+        if [ $? -ne 0 ] ; then
+                echo "ERROR: cannnot ping ns1 from ns2 via ipv6"
+                lret=1
+        fi
+
+        expect="packets 1 bytes 104"
+        for dir in "in6" "out6" ; do
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns2$dir "$expect"
+                        lret=1
+                fi
+
+                cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns2 ns1$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        reset_counters
+
+# add redirect rule
+ip netns exec ns0 nft -f - <<EOF
+table ip6 nat {
+        chain prerouting {
+                type nat hook prerouting priority 0; policy accept;
+                meta iif veth1 meta l4proto icmpv6 ip6 saddr dead:2::99 ip6 daddr dead:1::99 redirect
+        }
+}
+EOF
+        ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
+        if [ $? -ne 0 ] ; then
+                echo "ERROR: cannot ping ns1 from ns2 with active ip6 redirect"
+                lret=1
+        fi
+
+        # ns1 should have seen no packets from ns2, due to redirection
+        expect="packets 0 bytes 0"
+        for dir in "in6" "out6" ; do
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns0$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        # ns0 should have seen packets from ns2, due to masquerade
+        expect="packets 1 bytes 104"
+        for dir in "in6" "out6" ; do
+                cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns0$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        ip netns exec ns0 nft delete table ip6 nat
+        if [ $? -ne 0 ]; then
+                echo "ERROR: Could not delete ip6 nat table" 1>&2
+                lret=1
+        fi
+
+        test $lret -eq 0 && echo "PASS: IPv6 redirection for ns2"
+
+        return $lret
+}
+
+test_redirect()
+{
+        local lret=0
+
+        ip netns exec ns0 sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null
+        ip netns exec ns0 sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null
+
+        ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
+        if [ $? -ne 0 ] ; then
+                echo "ERROR: cannot ping ns1 from ns2"
+                lret=1
+        fi
+
+        expect="packets 1 bytes 84"
+        for dir in "in" "out" ; do
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns2$dir "$expect"
+                        lret=1
+                fi
+
+                cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns2 ns1$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        reset_counters
+
+# add redirect rule
+ip netns exec ns0 nft -f - <<EOF
+table ip nat {
+        chain prerouting {
+                type nat hook prerouting priority 0; policy accept;
+                meta iif veth1 ip protocol icmp ip saddr 10.0.2.99 ip daddr 10.0.1.99 redirect
+        }
+}
+EOF
+        ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
+        if [ $? -ne 0 ] ; then
+                echo "ERROR: cannot ping ns1 from ns2 with active ip redirect"
+                lret=1
+        fi
+
+        # ns1 should have seen no packets from ns2, due to redirection
+        expect="packets 0 bytes 0"
+        for dir in "in" "out" ; do
+
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns0$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        # ns0 should have seen packets from ns2, due to masquerade
+        expect="packets 1 bytes 84"
+        for dir in "in" "out" ; do
+                cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns0$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        ip netns exec ns0 nft delete table ip nat
+        if [ $? -ne 0 ]; then
+                echo "ERROR: Could not delete nat table" 1>&2
+                lret=1
+        fi
+
+        test $lret -eq 0 && echo "PASS: IP redirection for ns2"
+
+        return $lret
+}
+
+
+# ip netns exec ns0 ping -c 1 -q 10.0.$i.99
+for i in 0 1 2; do
+ip netns exec ns$i nft -f - <<EOF
+table inet filter {
+        counter ns0in {}
+        counter ns1in {}
+        counter ns2in {}
+
+        counter ns0out {}
+        counter ns1out {}
+        counter ns2out {}
+
+        counter ns0in6 {}
+        counter ns1in6 {}
+        counter ns2in6 {}
+
+        counter ns0out6 {}
+        counter ns1out6 {}
+        counter ns2out6 {}
+
+        map nsincounter {
+                type ipv4_addr : counter
+                elements = { 10.0.1.1 : "ns0in",
+                             10.0.2.1 : "ns0in",
+                             10.0.1.99 : "ns1in",
+                             10.0.2.99 : "ns2in" }
+        }
+
+        map nsincounter6 {
+                type ipv6_addr : counter
+                elements = { dead:1::1 : "ns0in6",
+                             dead:2::1 : "ns0in6",
+                             dead:1::99 : "ns1in6",
+                             dead:2::99 : "ns2in6" }
+        }
+
+        map nsoutcounter {
+                type ipv4_addr : counter
+                elements = { 10.0.1.1 : "ns0out",
+                             10.0.2.1 : "ns0out",
+                             10.0.1.99: "ns1out",
+                             10.0.2.99: "ns2out" }
+        }
+
+        map nsoutcounter6 {
+                type ipv6_addr : counter
+                elements = { dead:1::1 : "ns0out6",
+                             dead:2::1 : "ns0out6",
+                             dead:1::99 : "ns1out6",
+                             dead:2::99 : "ns2out6" }
+        }
+
+        chain input {
+                type filter hook input priority 0; policy accept;
+                counter name ip saddr map @nsincounter
+                icmpv6 type { "echo-request", "echo-reply" } counter name ip6 saddr map @nsincounter6
+        }
+        chain output {
+                type filter hook output priority 0; policy accept;
+                counter name ip daddr map @nsoutcounter
+                icmpv6 type { "echo-request", "echo-reply" } counter name ip6 daddr map @nsoutcounter6
+        }
+}
+EOF
+done
+
+sleep 3
+# test basic connectivity
+for i in 1 2; do
+  ip netns exec ns0 ping -c 1 -q 10.0.$i.99 > /dev/null
+  if [ $? -ne 0 ];then
+        echo "ERROR: Could not reach other namespace(s)" 1>&2
+        ret=1
+  fi
+
+  ip netns exec ns0 ping -c 1 -q dead:$i::99 > /dev/null
+  if [ $? -ne 0 ];then
+        echo "ERROR: Could not reach other namespace(s) via ipv6" 1>&2
+        ret=1
+  fi
+  check_counters ns$i
+  if [ $? -ne 0 ]; then
+        ret=1
+  fi
+
+  check_ns0_counters ns$i
+  if [ $? -ne 0 ]; then
+        ret=1
+  fi
+  reset_counters
+done
+
+if [ $ret -eq 0 ];then
+        echo "PASS: netns routing/connectivity: ns0 can reach ns1 and ns2"
+fi
+
+reset_counters
+test_local_dnat
+test_local_dnat6
+
+reset_counters
+test_masquerade
+test_masquerade6
+
+reset_counters
+test_redirect
+test_redirect6
+
+for i in 0 1 2; do ip netns del ns$i;done
+
+exit $ret
diff --git a/tools/testing/selftests/networking/timestamping/Makefile b/tools/testing/selftests/networking/timestamping/Makefile
index 9050eeea5f5f..1de8bd8ccf5d 100644
--- a/tools/testing/selftests/networking/timestamping/Makefile
+++ b/tools/testing/selftests/networking/timestamping/Makefile
@@ -9,6 +9,3 @@ all: $(TEST_PROGS)
 top_srcdir = ../../../../..
 KSFT_KHDR_INSTALL := 1
 include ../../lib.mk
-
-clean:
-        rm -fr $(TEST_GEN_FILES)
diff --git a/tools/testing/selftests/networking/timestamping/txtimestamp.c b/tools/testing/selftests/networking/timestamping/txtimestamp.c
index 2e563d17cf0c..d1bbafb16f47 100644
--- a/tools/testing/selftests/networking/timestamping/txtimestamp.c
+++ b/tools/testing/selftests/networking/timestamping/txtimestamp.c
@@ -240,7 +240,7 @@ static void __recv_errmsg_cmsg(struct msghdr *msg, int payload_len)
                             cm->cmsg_type == IP_RECVERR) ||
                            (cm->cmsg_level == SOL_IPV6 &&
                             cm->cmsg_type == IPV6_RECVERR) ||
-                           (cm->cmsg_level = SOL_PACKET &&
+                           (cm->cmsg_level == SOL_PACKET &&
                             cm->cmsg_type == PACKET_TX_TIMESTAMP)) {
                         serr = (void *) CMSG_DATA(cm);
                         if (serr->ee_errno != ENOMSG ||
diff --git a/tools/testing/selftests/proc/.gitignore b/tools/testing/selftests/proc/.gitignore
index 82121a81681f..29bac5ef9a93 100644
--- a/tools/testing/selftests/proc/.gitignore
+++ b/tools/testing/selftests/proc/.gitignore
@@ -10,4 +10,5 @@
 /proc-uptime-002
 /read
 /self
+/setns-dcache
 /thread-self
diff --git a/tools/testing/selftests/proc/Makefile b/tools/testing/selftests/proc/Makefile
index 1c12c34cf85d..434d033ee067 100644
--- a/tools/testing/selftests/proc/Makefile
+++ b/tools/testing/selftests/proc/Makefile
@@ -14,6 +14,7 @@ TEST_GEN_PROGS += proc-uptime-001
 TEST_GEN_PROGS += proc-uptime-002
 TEST_GEN_PROGS += read
 TEST_GEN_PROGS += self
+TEST_GEN_PROGS += setns-dcache
 TEST_GEN_PROGS += thread-self
 
 include ../lib.mk
diff --git a/tools/testing/selftests/proc/setns-dcache.c b/tools/testing/selftests/proc/setns-dcache.c
new file mode 100644
index 000000000000..60ab197a73fc
--- /dev/null
+++ b/tools/testing/selftests/proc/setns-dcache.c
@@ -0,0 +1,129 @@
+/*
+ * Copyright © 2019 Alexey Dobriyan <adobriyan@gmail.com>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+/*
+ * Test that setns(CLONE_NEWNET) points to new /proc/net content even
+ * if old one is in dcache.
+ *
+ * FIXME /proc/net/unix is under CONFIG_UNIX which can be disabled.
+ */
+#undef NDEBUG
+#include <assert.h>
+#include <errno.h>
+#include <sched.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <sys/socket.h>
+
+static pid_t pid = -1;
+
+static void f(void)
+{
+        if (pid > 0) {
+                kill(pid, SIGTERM);
+        }
+}
+
+int main(void)
+{
+        int fd[2];
+        char _ = 0;
+        int nsfd;
+
+        atexit(f);
+
+        /* Check for priviledges and syscall availability straight away. */
+        if (unshare(CLONE_NEWNET) == -1) {
+                if (errno == ENOSYS || errno == EPERM) {
+                        return 4;
+                }
+                return 1;
+        }
+        /* Distinguisher between two otherwise empty net namespaces. */
+        if (socket(AF_UNIX, SOCK_STREAM, 0) == -1) {
+                return 1;
+        }
+
+        if (pipe(fd) == -1) {
+                return 1;
+        }
+
+        pid = fork();
+        if (pid == -1) {
+                return 1;
+        }
+
+        if (pid == 0) {
+                if (unshare(CLONE_NEWNET) == -1) {
+                        return 1;
+                }
+
+                if (write(fd[1], &_, 1) != 1) {
+                        return 1;
+                }
+
+                pause();
+
+                return 0;
+        }
+
+        if (read(fd[0], &_, 1) != 1) {
+                return 1;
+        }
+
+        {
+                char buf[64];
+                snprintf(buf, sizeof(buf), "/proc/%u/ns/net", pid);
+                nsfd = open(buf, O_RDONLY);
+                if (nsfd == -1) {
+                        return 1;
+                }
+        }
+
+        /* Reliably pin dentry into dcache. */
+        (void)open("/proc/net/unix", O_RDONLY);
+
+        if (setns(nsfd, CLONE_NEWNET) == -1) {
+                return 1;
+        }
+
+        kill(pid, SIGTERM);
+        pid = 0;
+
+        {
+                char buf[4096];
+                ssize_t rv;
+                int fd;
+
+                fd = open("/proc/net/unix", O_RDONLY);
+                if (fd == -1) {
+                        return 1;
+                }
+
+#define S "Num       RefCount Protocol Flags    Type St Inode Path\n"
+                rv = read(fd, buf, sizeof(buf));
+
+                assert(rv == strlen(S));
+                assert(memcmp(buf, S, strlen(S)) == 0);
+        }
+
+        return 0;
+}
diff --git a/tools/testing/selftests/rtc/rtctest.c b/tools/testing/selftests/rtc/rtctest.c
index e20b017e7073..b2065536d407 100644
--- a/tools/testing/selftests/rtc/rtctest.c
+++ b/tools/testing/selftests/rtc/rtctest.c
@@ -145,15 +145,12 @@ TEST_F(rtc, alarm_alm_set) {
 
         rc = select(self->fd + 1, &readfds, NULL, NULL, &tv);
         ASSERT_NE(-1, rc);
-        EXPECT_NE(0, rc);
+        ASSERT_NE(0, rc);
 
         /* Disable alarm interrupts */
         rc = ioctl(self->fd, RTC_AIE_OFF, 0);
         ASSERT_NE(-1, rc);
 
-        if (rc == 0)
-                return;
-
         rc = read(self->fd, &data, sizeof(unsigned long));
         ASSERT_NE(-1, rc);
         TH_LOG("data: %lx", data);
@@ -202,7 +199,109 @@ TEST_F(rtc, alarm_wkalm_set) {
 
         rc = select(self->fd + 1, &readfds, NULL, NULL, &tv);
         ASSERT_NE(-1, rc);
-        EXPECT_NE(0, rc);
+        ASSERT_NE(0, rc);
+
+        rc = read(self->fd, &data, sizeof(unsigned long));
+        ASSERT_NE(-1, rc);
+
+        rc = ioctl(self->fd, RTC_RD_TIME, &tm);
+        ASSERT_NE(-1, rc);
+
+        new = timegm((struct tm *)&tm);
+        ASSERT_EQ(new, secs);
+}
+
+TEST_F(rtc, alarm_alm_set_minute) {
+        struct timeval tv = { .tv_sec = 62 };
+        unsigned long data;
+        struct rtc_time tm;
+        fd_set readfds;
+        time_t secs, new;
+        int rc;
+
+        rc = ioctl(self->fd, RTC_RD_TIME, &tm);
+        ASSERT_NE(-1, rc);
+
+        secs = timegm((struct tm *)&tm) + 60 - tm.tm_sec;
+        gmtime_r(&secs, (struct tm *)&tm);
+
+        rc = ioctl(self->fd, RTC_ALM_SET, &tm);
+        if (rc == -1) {
+                ASSERT_EQ(EINVAL, errno);
+                TH_LOG("skip alarms are not supported.");
+                return;
+        }
+
+        rc = ioctl(self->fd, RTC_ALM_READ, &tm);
+        ASSERT_NE(-1, rc);
+
+        TH_LOG("Alarm time now set to %02d:%02d:%02d.",
+               tm.tm_hour, tm.tm_min, tm.tm_sec);
+
+        /* Enable alarm interrupts */
+        rc = ioctl(self->fd, RTC_AIE_ON, 0);
+        ASSERT_NE(-1, rc);
+
+        FD_ZERO(&readfds);
+        FD_SET(self->fd, &readfds);
+
+        rc = select(self->fd + 1, &readfds, NULL, NULL, &tv);
+        ASSERT_NE(-1, rc);
+        ASSERT_NE(0, rc);
+
+        /* Disable alarm interrupts */
+        rc = ioctl(self->fd, RTC_AIE_OFF, 0);
+        ASSERT_NE(-1, rc);
+
+        rc = read(self->fd, &data, sizeof(unsigned long));
+        ASSERT_NE(-1, rc);
+        TH_LOG("data: %lx", data);
+
+        rc = ioctl(self->fd, RTC_RD_TIME, &tm);
+        ASSERT_NE(-1, rc);
+
+        new = timegm((struct tm *)&tm);
+        ASSERT_EQ(new, secs);
+}
+
+TEST_F(rtc, alarm_wkalm_set_minute) {
+        struct timeval tv = { .tv_sec = 62 };
+        struct rtc_wkalrm alarm = { 0 };
+        struct rtc_time tm;
+        unsigned long data;
+        fd_set readfds;
+        time_t secs, new;
+        int rc;
+
+        rc = ioctl(self->fd, RTC_RD_TIME, &alarm.time);
+        ASSERT_NE(-1, rc);
+
+        secs = timegm((struct tm *)&alarm.time) + 60 - alarm.time.tm_sec;
+        gmtime_r(&secs, (struct tm *)&alarm.time);
+
+        alarm.enabled = 1;
+
+        rc = ioctl(self->fd, RTC_WKALM_SET, &alarm);
+        if (rc == -1) {
+                ASSERT_EQ(EINVAL, errno);
+                TH_LOG("skip alarms are not supported.");
+                return;
+        }
+
+        rc = ioctl(self->fd, RTC_WKALM_RD, &alarm);
+        ASSERT_NE(-1, rc);
+
+        TH_LOG("Alarm time now set to %02d/%02d/%02d %02d:%02d:%02d.",
+               alarm.time.tm_mday, alarm.time.tm_mon + 1,
+               alarm.time.tm_year + 1900, alarm.time.tm_hour,
+               alarm.time.tm_min, alarm.time.tm_sec);
+
+        FD_ZERO(&readfds);
+        FD_SET(self->fd, &readfds);
+
+        rc = select(self->fd + 1, &readfds, NULL, NULL, &tv);
+        ASSERT_NE(-1, rc);
+        ASSERT_NE(0, rc);
 
         rc = read(self->fd, &data, sizeof(unsigned long));
         ASSERT_NE(-1, rc);
diff --git a/tools/testing/selftests/seccomp/Makefile b/tools/testing/selftests/seccomp/Makefile
index fce7f4ce0692..1760b3e39730 100644
--- a/tools/testing/selftests/seccomp/Makefile
+++ b/tools/testing/selftests/seccomp/Makefile
@@ -9,7 +9,7 @@ BINARIES := seccomp_bpf seccomp_benchmark
 CFLAGS += -Wl,-no-as-needed -Wall
 
 seccomp_bpf: seccomp_bpf.c ../kselftest_harness.h
-        $(CC) $(CFLAGS) $(LDFLAGS) -lpthread $< -o $@
+        $(CC) $(CFLAGS) $(LDFLAGS) $< -lpthread -o $@
 
 TEST_PROGS += $(BINARIES)
 EXTRA_CLEAN := $(BINARIES)
diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c
index 067cb4607d6c..7e632b465ab4 100644
--- a/tools/testing/selftests/seccomp/seccomp_bpf.c
+++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
@@ -1608,7 +1608,16 @@ TEST_F(TRACE_poke, getpid_runs_normally)
 #ifdef SYSCALL_NUM_RET_SHARE_REG
 # define EXPECT_SYSCALL_RETURN(val, action)     EXPECT_EQ(-1, action)
 #else
-# define EXPECT_SYSCALL_RETURN(val, action)     EXPECT_EQ(val, action)
+# define EXPECT_SYSCALL_RETURN(val, action)             \
+        do {                                            \
+                errno = 0;                              \
+                if (val < 0) {                          \
+                        EXPECT_EQ(-1, action);          \
+                        EXPECT_EQ(-(val), errno);       \
+                } else {                                \
+                        EXPECT_EQ(val, action);         \
+                }                                       \
+        } while (0)
 #endif
 
 /* Use PTRACE_GETREGS and PTRACE_SETREGS when available. This is useful for
@@ -1647,7 +1656,7 @@ int get_syscall(struct __test_metadata *_metadata, pid_t tracee)
 
 /* Architecture-specific syscall changing routine. */
 void change_syscall(struct __test_metadata *_metadata,
-                    pid_t tracee, int syscall)
+                    pid_t tracee, int syscall, int result)
 {
         int ret;
         ARCH_REGS regs;
@@ -1706,7 +1715,7 @@ void change_syscall(struct __test_metadata *_metadata,
 #ifdef SYSCALL_NUM_RET_SHARE_REG
                 TH_LOG("Can't modify syscall return on this architecture");
 #else
-                regs.SYSCALL_RET = EPERM;
+                regs.SYSCALL_RET = result;
 #endif
 
 #ifdef HAVE_GETREGS
@@ -1734,14 +1743,19 @@ void tracer_syscall(struct __test_metadata *_metadata, pid_t tracee,
         case 0x1002:
                 /* change getpid to getppid. */
                 EXPECT_EQ(__NR_getpid, get_syscall(_metadata, tracee));
-                change_syscall(_metadata, tracee, __NR_getppid);
+                change_syscall(_metadata, tracee, __NR_getppid, 0);
                 break;
         case 0x1003:
-                /* skip gettid. */
+                /* skip gettid with valid return code. */
                 EXPECT_EQ(__NR_gettid, get_syscall(_metadata, tracee));
-                change_syscall(_metadata, tracee, -1);
+                change_syscall(_metadata, tracee, -1, 45000);
                 break;
         case 0x1004:
+                /* skip openat with error. */
+                EXPECT_EQ(__NR_openat, get_syscall(_metadata, tracee));
+                change_syscall(_metadata, tracee, -1, -ESRCH);
+                break;
+        case 0x1005:
                 /* do nothing (allow getppid) */
                 EXPECT_EQ(__NR_getppid, get_syscall(_metadata, tracee));
                 break;
@@ -1774,9 +1788,11 @@ void tracer_ptrace(struct __test_metadata *_metadata, pid_t tracee,
         nr = get_syscall(_metadata, tracee);
 
         if (nr == __NR_getpid)
-                change_syscall(_metadata, tracee, __NR_getppid);
+                change_syscall(_metadata, tracee, __NR_getppid, 0);
+        if (nr == __NR_gettid)
+                change_syscall(_metadata, tracee, -1, 45000);
         if (nr == __NR_openat)
-                change_syscall(_metadata, tracee, -1);
+                change_syscall(_metadata, tracee, -1, -ESRCH);
 }
 
 FIXTURE_DATA(TRACE_syscall) {
@@ -1793,8 +1809,10 @@ FIXTURE_SETUP(TRACE_syscall)
                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1002),
                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_gettid, 0, 1),
                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1003),
-                BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1),
+                BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_openat, 0, 1),
                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1004),
+                BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1),
+                BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1005),
                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
         };
 
@@ -1842,15 +1860,26 @@ TEST_F(TRACE_syscall, ptrace_syscall_redirected)
         EXPECT_NE(self->mypid, syscall(__NR_getpid));
 }
 
-TEST_F(TRACE_syscall, ptrace_syscall_dropped)
+TEST_F(TRACE_syscall, ptrace_syscall_errno)
+{
+        /* Swap SECCOMP_RET_TRACE tracer for PTRACE_SYSCALL tracer. */
+        teardown_trace_fixture(_metadata, self->tracer);
+        self->tracer = setup_trace_fixture(_metadata, tracer_ptrace, NULL,
+                                           true);
+
+        /* Tracer should skip the open syscall, resulting in ESRCH. */
+        EXPECT_SYSCALL_RETURN(-ESRCH, syscall(__NR_openat));
+}
+
+TEST_F(TRACE_syscall, ptrace_syscall_faked)
 {
         /* Swap SECCOMP_RET_TRACE tracer for PTRACE_SYSCALL tracer. */
         teardown_trace_fixture(_metadata, self->tracer);
         self->tracer = setup_trace_fixture(_metadata, tracer_ptrace, NULL,
                                            true);
 
-        /* Tracer should skip the open syscall, resulting in EPERM. */
-        EXPECT_SYSCALL_RETURN(EPERM, syscall(__NR_openat));
+        /* Tracer should skip the gettid syscall, resulting fake pid. */
+        EXPECT_SYSCALL_RETURN(45000, syscall(__NR_gettid));
 }
 
 TEST_F(TRACE_syscall, syscall_allowed)
@@ -1883,7 +1912,21 @@ TEST_F(TRACE_syscall, syscall_redirected)
         EXPECT_NE(self->mypid, syscall(__NR_getpid));
 }
 
-TEST_F(TRACE_syscall, syscall_dropped)
+TEST_F(TRACE_syscall, syscall_errno)
+{
+        long ret;
+
+        ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
+        ASSERT_EQ(0, ret);
+
+        ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0);
+        ASSERT_EQ(0, ret);
+
+        /* openat has been skipped and an errno return. */
+        EXPECT_SYSCALL_RETURN(-ESRCH, syscall(__NR_openat));
+}
+
+TEST_F(TRACE_syscall, syscall_faked)
 {
         long ret;
 
@@ -1894,8 +1937,7 @@ TEST_F(TRACE_syscall, syscall_dropped)
         ASSERT_EQ(0, ret);
 
         /* gettid has been skipped and an altered return value stored. */
-        EXPECT_SYSCALL_RETURN(EPERM, syscall(__NR_gettid));
-        EXPECT_NE(self->mytid, syscall(__NR_gettid));
+        EXPECT_SYSCALL_RETURN(45000, syscall(__NR_gettid));
 }
 
 TEST_F(TRACE_syscall, skip_after_RET_TRACE)
@@ -3044,7 +3086,7 @@ TEST(user_notification_basic)
         /* Check that the basic notification machinery works */
         listener = user_trap_syscall(__NR_getpid,
                                      SECCOMP_FILTER_FLAG_NEW_LISTENER);
-        EXPECT_GE(listener, 0);
+        ASSERT_GE(listener, 0);
 
         /* Installing a second listener in the chain should EBUSY */
         EXPECT_EQ(user_trap_syscall(__NR_getpid,
@@ -3103,7 +3145,7 @@ TEST(user_notification_kill_in_middle)
 
         listener = user_trap_syscall(__NR_getpid,
                                      SECCOMP_FILTER_FLAG_NEW_LISTENER);
-        EXPECT_GE(listener, 0);
+        ASSERT_GE(listener, 0);
 
         /*
          * Check that nothing bad happens when we kill the task in the middle
@@ -3152,7 +3194,7 @@ TEST(user_notification_signal)
 
         listener = user_trap_syscall(__NR_gettid,
                                      SECCOMP_FILTER_FLAG_NEW_LISTENER);
-        EXPECT_GE(listener, 0);
+        ASSERT_GE(listener, 0);
 
         pid = fork();
         ASSERT_GE(pid, 0);
@@ -3215,7 +3257,7 @@ TEST(user_notification_closed_listener)
 
         listener = user_trap_syscall(__NR_getpid,
                                      SECCOMP_FILTER_FLAG_NEW_LISTENER);
-        EXPECT_GE(listener, 0);
+        ASSERT_GE(listener, 0);
 
         /*
          * Check that we get an ENOSYS when the listener is closed.
@@ -3376,7 +3418,7 @@ TEST(seccomp_get_notif_sizes)
 {
         struct seccomp_notif_sizes sizes;
 
-        EXPECT_EQ(seccomp(SECCOMP_GET_NOTIF_SIZES, 0, &sizes), 0);
+        ASSERT_EQ(seccomp(SECCOMP_GET_NOTIF_SIZES, 0, &sizes), 0);
         EXPECT_EQ(sizes.seccomp_notif, sizeof(struct seccomp_notif));
         EXPECT_EQ(sizes.seccomp_notif_resp, sizeof(struct seccomp_notif_resp));
 }
diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/ife.json b/tools/testing/selftests/tc-testing/tc-tests/actions/ife.json
index 637ea0219617..0da3545cabdb 100644
--- a/tools/testing/selftests/tc-testing/tc-tests/actions/ife.json
+++ b/tools/testing/selftests/tc-testing/tc-tests/actions/ife.json
@@ -17,7 +17,7 @@
         "cmdUnderTest": "$TC actions add action ife encode allow mark pass index 2",
         "expExitCode": "0",
         "verifyCmd": "$TC actions get action ife index 2",
-        "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow mark.*index 2",
+        "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow mark.*index 2",
         "matchCount": "1",
         "teardown": [
             "$TC actions flush action ife"
@@ -41,7 +41,7 @@
         "cmdUnderTest": "$TC actions add action ife encode use mark 10 pipe index 2",
         "expExitCode": "0",
         "verifyCmd": "$TC actions get action ife index 2",
-        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use mark.*index 2",
+        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use mark.*index 2",
         "matchCount": "1",
         "teardown": [
             "$TC actions flush action ife"
@@ -65,7 +65,7 @@
         "cmdUnderTest": "$TC actions add action ife encode allow mark continue index 2",
         "expExitCode": "0",
         "verifyCmd": "$TC actions get action ife index 2",
-        "matchPattern": "action order [0-9]*: ife encode action continue.*type 0xED3E.*allow mark.*index 2",
+        "matchPattern": "action order [0-9]*: ife encode action continue.*type 0[xX]ED3E.*allow mark.*index 2",
         "matchCount": "1",
         "teardown": [
             "$TC actions flush action ife"
@@ -89,7 +89,7 @@
         "cmdUnderTest": "$TC actions add action ife encode use mark 789 drop index 2",
         "expExitCode": "0",
         "verifyCmd": "$TC actions get action ife index 2",
-        "matchPattern": "action order [0-9]*: ife encode action drop.*type 0xED3E.*use mark 789.*index 2",
+        "matchPattern": "action order [0-9]*: ife encode action drop.*type 0[xX]ED3E.*use mark 789.*index 2",
         "matchCount": "1",
         "teardown": [
             "$TC actions flush action ife"
@@ -113,7 +113,7 @@
         "cmdUnderTest": "$TC actions add action ife encode use mark 656768 reclassify index 2",
         "expExitCode": "0",
         "verifyCmd": "$TC actions get action ife index 2",
-        "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*use mark 656768.*index 2",
+        "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*use mark 656768.*index 2",
         "matchCount": "1",
         "teardown": [
             "$TC actions flush action ife"
@@ -137,7 +137,7 @@
         "cmdUnderTest": "$TC actions add action ife encode use mark 65 jump 1 index 2",
         "expExitCode": "0",
         "verifyCmd": "$TC actions get action ife index 2",
-        "matchPattern": "action order [0-9]*: ife encode action jump 1.*type 0xED3E.*use mark 65.*index 2",
+        "matchPattern": "action order [0-9]*: ife encode action jump 1.*type 0[xX]ED3E.*use mark 65.*index 2",
         "matchCount": "1",
         "teardown": [
             "$TC actions flush action ife"
@@ -161,7 +161,7 @@
         "cmdUnderTest": "$TC actions add action ife encode use mark 4294967295 reclassify index 90",
         "expExitCode": "0",
         "verifyCmd": "$TC actions get action ife index 90",
-        "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*use mark 4294967295.*index 90",
+        "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*use mark 4294967295.*index 90",
         "matchCount": "1",
         "teardown": [
             "$TC actions flush action ife"
@@ -185,7 +185,7 @@
         "cmdUnderTest": "$TC actions add action ife encode use mark 4294967295999 pipe index 90",
         "expExitCode": "255",
         "verifyCmd": "$TC actions get action ife index 90",
-        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use mark 4294967295999.*index 90",
+        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use mark 4294967295999.*index 90",
         "matchCount": "0",
         "teardown": []
     },
@@ -207,7 +207,7 @@
         "cmdUnderTest": "$TC actions add action ife encode allow prio pass index 9",
         "expExitCode": "0",
         "verifyCmd": "$TC actions get action ife index 9",
-        "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow prio.*index 9",
+        "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow prio.*index 9",
         "matchCount": "1",
         "teardown": [
             "$TC actions flush action ife"
@@ -231,7 +231,7 @@
         "cmdUnderTest": "$TC actions add action ife encode use prio 7 pipe index 9",
         "expExitCode": "0",
         "verifyCmd": "$TC actions get action ife index 9",
-        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use prio 7.*index 9",
+        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use prio 7.*index 9",
         "matchCount": "1",
         "teardown": [
             "$TC actions flush action ife"
@@ -255,7 +255,7 @@
         "cmdUnderTest": "$TC actions add action ife encode use prio 3 continue index 9",
         "expExitCode": "0",
         "verifyCmd": "$TC actions get action ife index 9",
-        "matchPattern": "action order [0-9]*: ife encode action continue.*type 0xED3E.*use prio 3.*index 9",
+        "matchPattern": "action order [0-9]*: ife encode action continue.*type 0[xX]ED3E.*use prio 3.*index 9",
         "matchCount": "1",
         "teardown": [
             "$TC actions flush action ife"
@@ -279,7 +279,7 @@
         "cmdUnderTest": "$TC actions add action ife encode allow prio drop index 9",
         "expExitCode": "0",
         "verifyCmd": "$TC actions get action ife index 9",
-        "matchPattern": "action order [0-9]*: ife encode action drop.*type 0xED3E.*allow prio.*index 9",
+        "matchPattern": "action order [0-9]*: ife encode action drop.*type 0[xX]ED3E.*allow prio.*index 9",
         "matchCount": "1",
         "teardown": [
             "$TC actions flush action ife"
@@ -303,7 +303,7 @@
         "cmdUnderTest": "$TC actions add action ife encode use prio 998877 reclassify index 9",
         "expExitCode": "0",
         "verifyCmd": "$TC actions get action ife index 9",
-        "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*use prio 998877.*index 9",
+        "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*use prio 998877.*index 9",
         "matchCount": "1",
         "teardown": [
             "$TC actions flush action ife"
@@ -327,7 +327,7 @@
         "cmdUnderTest": "$TC actions add action ife encode use prio 998877 jump 10 index 9",
         "expExitCode": "0",
         "verifyCmd": "$TC actions get action ife index 9",
-        "matchPattern": "action order [0-9]*: ife encode action jump 10.*type 0xED3E.*use prio 998877.*index 9",
+        "matchPattern": "action order [0-9]*: ife encode action jump 10.*type 0[xX]ED3E.*use prio 998877.*index 9",
         "matchCount": "1",
         "teardown": [
             "$TC actions flush action ife"
@@ -351,7 +351,7 @@
         "cmdUnderTest": "$TC actions add action ife encode use prio 4294967295 reclassify index 99",
         "expExitCode": "0",
         "verifyCmd": "$TC actions get action ife index 99",
-        "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*use prio 4294967295.*index 99",
+        "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*use prio 4294967295.*index 99",
         "matchCount": "1",
         "teardown": [
             "$TC actions flush action ife"
@@ -375,7 +375,7 @@
         "cmdUnderTest": "$TC actions add action ife encode use prio 4294967298 pipe index 99",
         "expExitCode": "255",
         "verifyCmd": "$TC actions get action ife index 99",
-        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use prio 4294967298.*index 99",
+        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use prio 4294967298.*index 99",
         "matchCount": "0",
         "teardown": []
     },
@@ -397,7 +397,7 @@
         "cmdUnderTest": "$TC actions add action ife encode allow tcindex pass index 1",
         "expExitCode": "0",
         "verifyCmd": "$TC actions get action ife index 1",
-        "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow tcindex.*index 1",
+        "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow tcindex.*index 1",
         "matchCount": "1",
         "teardown": [
             "$TC actions flush action ife"
@@ -421,7 +421,7 @@
         "cmdUnderTest": "$TC actions add action ife encode use tcindex 111 pipe index 1",
         "expExitCode": "0",
         "verifyCmd": "$TC actions get action ife index 1",
-        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use tcindex 111.*index 1",
+        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use tcindex 111.*index 1",
         "matchCount": "1",
         "teardown": [
             "$TC actions flush action ife"
@@ -445,7 +445,7 @@
         "cmdUnderTest": "$TC actions add action ife encode use tcindex 1 continue index 1",
         "expExitCode": "0",
         "verifyCmd": "$TC actions get action ife index 1",
-        "matchPattern": "action order [0-9]*: ife encode action continue.*type 0xED3E.*use tcindex 1.*index 1",
+        "matchPattern": "action order [0-9]*: ife encode action continue.*type 0[xX]ED3E.*use tcindex 1.*index 1",
         "matchCount": "1",
         "teardown": [
             "$TC actions flush action ife"
@@ -469,7 +469,7 @@
         "cmdUnderTest": "$TC actions add action ife encode use tcindex 1 continue index 1",
         "expExitCode": "0",
         "verifyCmd": "$TC actions get action ife index 1",
-        "matchPattern": "action order [0-9]*: ife encode action continue.*type 0xED3E.*use tcindex 1.*index 1",
+        "matchPattern": "action order [0-9]*: ife encode action continue.*type 0[xX]ED3E.*use tcindex 1.*index 1",
         "matchCount": "1",
         "teardown": [
             "$TC actions flush action ife"
@@ -493,7 +493,7 @@
         "cmdUnderTest": "$TC actions add action ife encode allow tcindex drop index 77",
         "expExitCode": "0",
         "verifyCmd": "$TC actions get action ife index 77",
-        "matchPattern": "action order [0-9]*: ife encode action drop.*type 0xED3E.*allow tcindex.*index 77",
+        "matchPattern": "action order [0-9]*: ife encode action drop.*type 0[xX]ED3E.*allow tcindex.*index 77",
         "matchCount": "1",
         "teardown": [
             "$TC actions flush action ife"
@@ -517,7 +517,7 @@
         "cmdUnderTest": "$TC actions add action ife encode allow tcindex reclassify index 77",
         "expExitCode": "0",
         "verifyCmd": "$TC actions get action ife index 77",
-        "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*allow tcindex.*index 77",
+        "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*allow tcindex.*index 77",
         "matchCount": "1",
         "teardown": [
             "$TC actions flush action ife"
@@ -541,7 +541,7 @@
         "cmdUnderTest": "$TC actions add action ife encode allow tcindex jump 999 index 77",
         "expExitCode": "0",
         "verifyCmd": "$TC actions get action ife index 77",
-        "matchPattern": "action order [0-9]*: ife encode action jump 999.*type 0xED3E.*allow tcindex.*index 77",
+        "matchPattern": "action order [0-9]*: ife encode action jump 999.*type 0[xX]ED3E.*allow tcindex.*index 77",
         "matchCount": "1",
         "teardown": [
             "$TC actions flush action ife"
@@ -565,7 +565,7 @@
         "cmdUnderTest": "$TC actions add action ife encode use tcindex 65535 pass index 1",
         "expExitCode": "0",
         "verifyCmd": "$TC actions get action ife index 1",
-        "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*use tcindex 65535.*index 1",
+        "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*use tcindex 65535.*index 1",
         "matchCount": "1",
         "teardown": [
             "$TC actions flush action ife"
@@ -589,7 +589,7 @@
         "cmdUnderTest": "$TC actions add action ife encode use tcindex 65539 pipe index 1",
         "expExitCode": "255",
         "verifyCmd": "$TC actions get action ife index 1",
-        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use tcindex 65539.*index 1",
+        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use tcindex 65539.*index 1",
         "matchCount": "0",
         "teardown": []
     },
@@ -611,7 +611,7 @@
         "cmdUnderTest": "$TC actions add action ife encode allow mark src 00:11:22:33:44:55 pipe index 1",
         "expExitCode": "0",
         "verifyCmd": "$TC actions get action ife index 1",
-        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*allow mark src 00:11:22:33:44:55.*index 1",
+        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*allow mark src 00:11:22:33:44:55.*index 1",
         "matchCount": "1",
         "teardown": [
             "$TC actions flush action ife"
@@ -635,7 +635,7 @@
         "cmdUnderTest": "$TC actions add action ife encode use prio 9876 dst 00:11:22:33:44:55 reclassify index 1",
         "expExitCode": "0",
         "verifyCmd": "$TC actions get action ife index 1",
-        "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*use prio 9876 dst 00:11:22:33:44:55.*index 1",
+        "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*use prio 9876 dst 00:11:22:33:44:55.*index 1",
         "matchCount": "1",
         "teardown": [
             "$TC actions flush action ife"
@@ -659,7 +659,7 @@
         "cmdUnderTest": "$TC actions add action ife encode allow tcindex src 00:aa:bb:cc:dd:ee dst 00:11:22:33:44:55 pass index 11",
         "expExitCode": "0",
         "verifyCmd": "$TC actions get action ife index 11",
-        "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow tcindex dst 00:11:22:33:44:55 src 00:aa:bb:cc:dd:ee .*index 11",
+        "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow tcindex dst 00:11:22:33:44:55 src 00:aa:bb:cc:dd:ee .*index 11",
         "matchCount": "1",
         "teardown": [
             "$TC actions flush action ife"
@@ -683,7 +683,7 @@
         "cmdUnderTest": "$TC actions add action ife encode use mark 7 type 0xfefe pass index 1",
         "expExitCode": "0",
         "verifyCmd": "$TC actions get action ife index 1",
-        "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xFEFE.*use mark 7.*index 1",
+        "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]FEFE.*use mark 7.*index 1",
         "matchCount": "1",
         "teardown": [
             "$TC actions flush action ife"
@@ -707,7 +707,7 @@
         "cmdUnderTest": "$TC actions add action ife encode use prio 444 type 0xabba pipe index 21",
         "expExitCode": "0",
         "verifyCmd": "$TC actions get action ife index 21",
-        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xABBA.*use prio 444.*index 21",
+        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ABBA.*use prio 444.*index 21",
         "matchCount": "1",
         "teardown": [
             "$TC actions flush action ife"
@@ -731,7 +731,7 @@
         "cmdUnderTest": "$TC actions add action ife encode use tcindex 5000 type 0xabcd reclassify index 21",
         "expExitCode": "0",
         "verifyCmd": "$TC actions get action ife index 21",
-        "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xABCD.*use tcindex 5000.*index 21",
+        "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ABCD.*use tcindex 5000.*index 21",
         "matchCount": "1",
         "teardown": [
             "$TC actions flush action ife"
@@ -739,7 +739,7 @@
     },
     {
         "id": "fac3",
-        "name": "Create valid ife encode action with index at 32-bit maximnum",
+        "name": "Create valid ife encode action with index at 32-bit maximum",
         "category": [
             "actions",
             "ife"
@@ -755,7 +755,7 @@
         "cmdUnderTest": "$TC actions add action ife encode allow mark pass index 4294967295",
         "expExitCode": "0",
         "verifyCmd": "$TC actions get action ife index 4294967295",
-        "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow mark.*index 4294967295",
+        "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow mark.*index 4294967295",
         "matchCount": "1",
         "teardown": [
             "$TC actions flush action ife"
@@ -779,7 +779,7 @@
         "cmdUnderTest": "$TC actions add action ife decode pass index 1",
         "expExitCode": "0",
         "verifyCmd": "$TC actions get action ife index 1",
-        "matchPattern": "action order [0-9]*: ife decode action pass.*type 0x0.*allow mark allow tcindex allow prio.*index 1",
+        "matchPattern": "action order [0-9]*: ife decode action pass.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1",
         "matchCount": "1",
         "teardown": [
             "$TC actions flush action ife"
@@ -803,7 +803,7 @@
         "cmdUnderTest": "$TC actions add action ife decode pipe index 1",
         "expExitCode": "0",
         "verifyCmd": "$TC actions get action ife index 1",
-        "matchPattern": "action order [0-9]*: ife decode action pipe.*type 0x0.*allow mark allow tcindex allow prio.*index 1",
+        "matchPattern": "action order [0-9]*: ife decode action pipe.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1",
         "matchCount": "1",
         "teardown": [
             "$TC actions flush action ife"
@@ -827,7 +827,7 @@
         "cmdUnderTest": "$TC actions add action ife decode continue index 1",
         "expExitCode": "0",
         "verifyCmd": "$TC actions get action ife index 1",
-        "matchPattern": "action order [0-9]*: ife decode action continue.*type 0x0.*allow mark allow tcindex allow prio.*index 1",
+        "matchPattern": "action order [0-9]*: ife decode action continue.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1",
         "matchCount": "1",
         "teardown": [
             "$TC actions flush action ife"
@@ -851,7 +851,7 @@
         "cmdUnderTest": "$TC actions add action ife decode drop index 1",
         "expExitCode": "0",
         "verifyCmd": "$TC actions get action ife index 1",
-        "matchPattern": "action order [0-9]*: ife decode action drop.*type 0x0.*allow mark allow tcindex allow prio.*index 1",
+        "matchPattern": "action order [0-9]*: ife decode action drop.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1",
         "matchCount": "1",
         "teardown": [
             "$TC actions flush action ife"
@@ -875,7 +875,7 @@
         "cmdUnderTest": "$TC actions add action ife decode reclassify index 1",
         "expExitCode": "0",
         "verifyCmd": "$TC actions get action ife index 1",
-        "matchPattern": "action order [0-9]*: ife decode action reclassify.*type 0x0.*allow mark allow tcindex allow prio.*index 1",
+        "matchPattern": "action order [0-9]*: ife decode action reclassify.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1",
         "matchCount": "1",
         "teardown": [
             "$TC actions flush action ife"
@@ -899,7 +899,7 @@
         "cmdUnderTest": "$TC actions add action ife decode jump 10 index 1",
         "expExitCode": "0",
         "verifyCmd": "$TC actions get action ife index 1",
-        "matchPattern": "action order [0-9]*: ife decode action jump 10.*type 0x0.*allow mark allow tcindex allow prio.*index 1",
+        "matchPattern": "action order [0-9]*: ife decode action jump 10.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1",
         "matchCount": "1",
         "teardown": [
             "$TC actions flush action ife"
@@ -923,7 +923,7 @@
         "cmdUnderTest": "$TC actions add action ife encode allow mark pass index 4294967295999",
         "expExitCode": "255",
         "verifyCmd": "$TC actions get action ife index 4294967295999",
-        "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow mark.*index 4294967295999",
+        "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow mark.*index 4294967295999",
         "matchCount": "0",
         "teardown": []
     },
@@ -945,7 +945,7 @@
         "cmdUnderTest": "$TC actions add action ife encode allow mark kuka index 4",
         "expExitCode": "255",
         "verifyCmd": "$TC actions get action ife index 4",
-        "matchPattern": "action order [0-9]*: ife encode action kuka.*type 0xED3E.*allow mark.*index 4",
+        "matchPattern": "action order [0-9]*: ife encode action kuka.*type 0[xX]ED3E.*allow mark.*index 4",
         "matchCount": "0",
         "teardown": []
     },
@@ -967,7 +967,7 @@
         "cmdUnderTest": "$TC actions add action ife encode allow prio pipe index 4 cookie aabbccddeeff112233445566778800a1",
         "expExitCode": "0",
         "verifyCmd": "$TC actions get action ife index 4",
-        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*allow prio.*index 4.*cookie aabbccddeeff112233445566778800a1",
+        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*allow prio.*index 4.*cookie aabbccddeeff112233445566778800a1",
         "matchCount": "1",
         "teardown": [
            "$TC actions flush action ife"
@@ -991,7 +991,7 @@
         "cmdUnderTest": "$TC actions add action ife encode allow foo pipe index 4",
         "expExitCode": "255",
         "verifyCmd": "$TC actions get action ife index 4",
-        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*allow foo.*index 4",
+        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*allow foo.*index 4",
         "matchCount": "0",
         "teardown": []
     },
@@ -1013,7 +1013,7 @@
         "cmdUnderTest": "$TC actions add action ife encode allow prio type 70000 pipe index 4",
         "expExitCode": "255",
         "verifyCmd": "$TC actions get action ife index 4",
-        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0x11170.*allow prio.*index 4",
+        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]11170.*allow prio.*index 4",
         "matchCount": "0",
         "teardown": []
     },
diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json b/tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json
index 10b2d894e436..e7e15a7336b6 100644
--- a/tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json
+++ b/tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json
@@ -82,35 +82,6 @@
         ]
     },
     {
-        "id": "ba4e",
-        "name": "Add tunnel_key set action with missing mandatory id parameter",
-        "category": [
-            "actions",
-            "tunnel_key"
-        ],
-        "setup": [
-            [
-                "$TC actions flush action tunnel_key",
-                0,
-                1,
-                255
-            ]
-        ],
-        "cmdUnderTest": "$TC actions add action tunnel_key set src_ip 10.10.10.1 dst_ip 20.20.20.2",
-        "expExitCode": "255",
-        "verifyCmd": "$TC actions list action tunnel_key",
-        "matchPattern": "action order [0-9]+: tunnel_key set.*src_ip 10.10.10.1.*dst_ip 20.20.20.2",
-        "matchCount": "0",
-        "teardown": [
-            [
-                "$TC actions flush action tunnel_key",
-                0,
-                1,
-                255
-            ]
-        ]
-    },
-    {
         "id": "a5e0",
         "name": "Add tunnel_key set action with invalid src_ip parameter",
         "category": [
@@ -634,7 +605,7 @@
         "cmdUnderTest": "$TC actions add action tunnel_key set src_ip 10.10.10.1 dst_ip 10.10.10.2 id 7 index 4 cookie aa11bb22cc33dd44ee55ff66aa11b1b2",
         "expExitCode": "0",
         "verifyCmd": "$TC actions get action tunnel_key index 4",
-        "matchPattern": "action order [0-9]+: tunnel_key.*set.*src_ip 10.10.10.1.*dst_ip 10.10.10.2.*key_id 7.*dst_port 0.*csum pipe.*index 4 ref.*cookie aa11bb22cc33dd44ee55ff66aa11b1b2",
+        "matchPattern": "action order [0-9]+: tunnel_key.*set.*src_ip 10.10.10.1.*dst_ip 10.10.10.2.*key_id 7.*csum pipe.*index 4 ref.*cookie aa11bb22cc33dd44ee55ff66aa11b1b2",
         "matchCount": "1",
         "teardown": [
             "$TC actions flush action tunnel_key"
diff --git a/tools/testing/selftests/timers/Makefile b/tools/testing/selftests/timers/Makefile
index c02683cfb6c9..7656c7ce79d9 100644
--- a/tools/testing/selftests/timers/Makefile
+++ b/tools/testing/selftests/timers/Makefile
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0
 CFLAGS += -O3 -Wl,-no-as-needed -Wall
-LDFLAGS += -lrt -lpthread -lm
+LDLIBS += -lrt -lpthread -lm
 
 # these are all "safe" tests that don't modify
 # system time or require escalated privileges
diff --git a/tools/testing/selftests/vm/gup_benchmark.c b/tools/testing/selftests/vm/gup_benchmark.c
index 880b96fc80d4..c0534e298b51 100644
--- a/tools/testing/selftests/vm/gup_benchmark.c
+++ b/tools/testing/selftests/vm/gup_benchmark.c
@@ -25,6 +25,7 @@ struct gup_benchmark {
         __u64 size;
         __u32 nr_pages_per_call;
         __u32 flags;
+        __u64 expansion[10];    /* For future use */
 };
 
 int main(int argc, char **argv)
diff --git a/tools/testing/selftests/x86/mpx-mini-test.c b/tools/testing/selftests/x86/mpx-mini-test.c
index 50f7e9272481..bf1bb15b6fbe 100644
--- a/tools/testing/selftests/x86/mpx-mini-test.c
+++ b/tools/testing/selftests/x86/mpx-mini-test.c
@@ -1503,7 +1503,7 @@ exit:
                 exit(20);
         }
         if (successes != total_nr_tests) {
-                eprintf("ERROR: succeded fewer than number of tries (%d != %d)\n",
+                eprintf("ERROR: succeeded fewer than number of tries (%d != %d)\n",
                                 successes, total_nr_tests);
                 exit(21);
         }
diff --git a/tools/testing/selftests/x86/protection_keys.c b/tools/testing/selftests/x86/protection_keys.c
index 460b4bdf4c1e..5d546dcdbc80 100644
--- a/tools/testing/selftests/x86/protection_keys.c
+++ b/tools/testing/selftests/x86/protection_keys.c
@@ -1133,6 +1133,21 @@ void test_pkey_syscalls_bad_args(int *ptr, u16 pkey)
         pkey_assert(err);
 }
 
+void become_child(void)
+{
+        pid_t forkret;
+
+        forkret = fork();
+        pkey_assert(forkret >= 0);
+        dprintf3("[%d] fork() ret: %d\n", getpid(), forkret);
+
+        if (!forkret) {
+                /* in the child */
+                return;
+        }
+        exit(0);
+}
+
 /* Assumes that all pkeys other than 'pkey' are unallocated */
 void test_pkey_alloc_exhaust(int *ptr, u16 pkey)
 {
@@ -1141,7 +1156,7 @@ void test_pkey_alloc_exhaust(int *ptr, u16 pkey)
         int nr_allocated_pkeys = 0;
         int i;
 
-        for (i = 0; i < NR_PKEYS*2; i++) {
+        for (i = 0; i < NR_PKEYS*3; i++) {
                 int new_pkey;
                 dprintf1("%s() alloc loop: %d\n", __func__, i);
                 new_pkey = alloc_pkey();
@@ -1152,21 +1167,27 @@ void test_pkey_alloc_exhaust(int *ptr, u16 pkey)
                 if ((new_pkey == -1) && (errno == ENOSPC)) {
                         dprintf2("%s() failed to allocate pkey after %d tries\n",
                                 __func__, nr_allocated_pkeys);
-                        break;
+                } else {
+                        /*
+                         * Ensure the number of successes never
+                         * exceeds the number of keys supported
+                         * in the hardware.
+                         */
+                        pkey_assert(nr_allocated_pkeys < NR_PKEYS);
+                        allocated_pkeys[nr_allocated_pkeys++] = new_pkey;
                 }
-                pkey_assert(nr_allocated_pkeys < NR_PKEYS);
-                allocated_pkeys[nr_allocated_pkeys++] = new_pkey;
+
+                /*
+                 * Make sure that allocation state is properly
+                 * preserved across fork().
+                 */
+                if (i == NR_PKEYS*2)
+                        become_child();
         }
 
         dprintf3("%s()::%d\n", __func__, __LINE__);
 
         /*
-         * ensure it did not reach the end of the loop without
-         * failure:
-         */
-        pkey_assert(i < NR_PKEYS*2);
-
-        /*
          * There are 16 pkeys supported in hardware.  Three are
          * allocated by the time we get here:
          *   1. The default key (0)
diff --git a/tools/testing/selftests/x86/unwind_vdso.c b/tools/testing/selftests/x86/unwind_vdso.c
index 00a26a82fa98..97311333700e 100644
--- a/tools/testing/selftests/x86/unwind_vdso.c
+++ b/tools/testing/selftests/x86/unwind_vdso.c
@@ -44,7 +44,6 @@ int main()
 #include <stdbool.h>
 #include <sys/ptrace.h>
 #include <sys/user.h>
-#include <sys/ucontext.h>
 #include <link.h>
 #include <sys/auxv.h>
 #include <dlfcn.h>