diff --git a/debian/.gitignore b/debian/.gitignore
index 9df6faf1e..597471e07 100644
--- a/debian/.gitignore
+++ b/debian/.gitignore
@@ -15,4 +15,5 @@
 /po/
 /rules.gen
 /stamps/
+/tests/control
 /xen-linux-system-*
diff --git a/debian/bin/gencontrol.py b/debian/bin/gencontrol.py
index 71fcd08fd..a7dea7d92 100755
--- a/debian/bin/gencontrol.py
+++ b/debian/bin/gencontrol.py
@@ -78,6 +78,9 @@ class Gencontrol(Base):
                         '# Translators should edit %s instead.\n'
                         '#\n' % path)
 
+        # Prepare to generate debian/tests/control
+        self.tests_control = None
+
     def do_main_makefile(self, makefile, makeflags, extra):
         fs_enabled = [featureset
                       for featureset in self.config['base', ]['featuresets']
@@ -329,7 +332,8 @@ class Gencontrol(Base):
 
         vars.setdefault('desc', None)
 
-        packages_own.append(self.process_real_image(image[0], image_fields, vars))
+        image_main = self.process_real_image(image[0], image_fields, vars)
+        packages_own.append(image_main)
         packages_own.extend(self.process_packages(image[1:], vars))
 
         if config_entry_build.get('modules', True):
@@ -355,6 +359,16 @@ class Gencontrol(Base):
 
         self.merge_packages(packages, packages_own + packages_dummy, arch)
 
+        tests_control = self.process_package(
+            self.templates['tests-control.main'][0], vars)
+        tests_control['Depends'].append(
+            PackageRelationGroup(image_main['Package'],
+                                 override_arches=(arch,)))
+        if self.tests_control:
+            self.tests_control['Depends'].extend(tests_control['Depends'])
+        else:
+            self.tests_control = tests_control
+
         def get_config(*entry_name):
             entry_real = ('image',) + entry_name
             entry = self.config.get(entry_real, None)
@@ -513,11 +527,16 @@ class Gencontrol(Base):
     def write(self, packages, makefile):
         self.write_config()
         super(Gencontrol, self).write(packages, makefile)
+        self.write_tests_control()
 
     def write_config(self):
         f = open("debian/config.defines.dump", 'wb')
         self.config.dump(f)
         f.close()
 
+    def write_tests_control(self):
+        self.write_rfc822(codecs.open("debian/tests/control", 'w', 'utf-8'),
+                          [self.tests_control])
+
 if __name__ == '__main__':
     Gencontrol()()
diff --git a/debian/changelog b/debian/changelog
index a96bb7f99..75a997346 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -2,6 +2,7 @@ linux (4.3~rc7-1~exp2) UNRELEASED; urgency=medium
 
   [ Ben Hutchings ]
   * netfilter: Enable NFT_DUP_IPV4, NFT_DUP_IPV6 as modules (Closes: #803370)
+  * tests: Add autopkgtest support
 
   [ Salvatore Bonaccorso ]
   * Fix typo in image.plain.postinst template.
diff --git a/debian/templates/tests-control.main.in b/debian/templates/tests-control.main.in
new file mode 100644
index 000000000..511c10e89
--- /dev/null
+++ b/debian/templates/tests-control.main.in
@@ -0,0 +1,3 @@
+Tests: selftests
+Restrictions: breaks-testbed, needs-root, isolation-machine
+Depends: kexec-tools, python3
diff --git a/debian/tests/selftests b/debian/tests/selftests
new file mode 100644
index 000000000..734a6de9b
--- /dev/null
+++ b/debian/tests/selftests
@@ -0,0 +1,55 @@
+#!/bin/bash -eu
+
+PATH=/usr/sbin:/sbin:/usr/bin:/bin
+
+getconfig() {
+    debian/bin/getconfig.py "$@"
+}
+
+# Look up current ABI name and 'localversion' (featureset/flavour) suffixes
+abiname=$(getconfig version abiname)
+arch=$(dpkg --print-architecture)
+localversion=()
+for featureset in $(getconfig base $arch featuresets); do
+    if [ "$(getconfig base '' $featureset enabled || echo True)" = True ]; then
+	for flavour in $(getconfig base $arch $featureset flavours); do
+	    if [ "$featureset" = none ]; then
+		localversion+=(-$flavour)
+	    else
+		localversion+=(-$featureset-$flavour)
+	    fi
+	done
+    fi
+done
+steps=${#localversion[*]}
+
+case "${ADT_REBOOT_MARK:-}" in
+    "")
+	step=-1
+	;;
+    step*)
+	step=${ADT_REBOOT_MARK#step}
+	;;
+esac
+
+if [ "$step" -ge 0 ]; then
+    ver=$abiname${localversion[$step]}
+
+    if [ "$(uname -r)" != "$ver" ]; then
+	echo >&2 "Should be running: $ver"
+	echo >&2 "Actually running: $(uname -r)"
+    fi
+fi
+
+# TODO: build and run tests
+
+step=$((step + 1))
+
+if [ "$step" -lt "$steps" ]; then
+    # Load the next kernel
+    ver=$abiname${localversion[$step]}
+    kexec -l /boot/vmlinuz-$ver --initrd /boot/initrd.img-$ver --reuse-cmdline
+    /tmp/autopkgtest-reboot step$step
+fi
+
+exit 0