--- /dev/null
+From 6f3f65d80dac8f2bafce2213005821fccdce194c Mon Sep 17 00:00:00 2001
+From: Lorenzo Colitti <lorenzo@google.com>
+Date: Mon, 20 Apr 2020 11:34:08 -0700
+Subject: net: bpf: Allow TC programs to call BPF_FUNC_skb_change_head
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Lorenzo Colitti <lorenzo@google.com>
+
+commit 6f3f65d80dac8f2bafce2213005821fccdce194c upstream.
+
+This allows TC eBPF programs to modify and forward (redirect) packets
+from interfaces without ethernet headers (for example cellular)
+to interfaces with (for example ethernet/wifi).
+
+The lack of this appears to simply be an oversight.
+
+Tested:
+ in active use in Android R on 4.14+ devices for ipv6
+ cellular to wifi tethering offload.
+
+Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
+Signed-off-by: Maciej Żenczykowski <maze@google.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Cc: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/filter.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -6196,6 +6196,8 @@ tc_cls_act_func_proto(enum bpf_func_id f
+ return &bpf_skb_adjust_room_proto;
+ case BPF_FUNC_skb_change_tail:
+ return &bpf_skb_change_tail_proto;
++ case BPF_FUNC_skb_change_head:
++ return &bpf_skb_change_head_proto;
+ case BPF_FUNC_skb_get_tunnel_key:
+ return &bpf_skb_get_tunnel_key_proto;
+ case BPF_FUNC_skb_set_tunnel_key:
--- /dev/null
+From 29368e09392123800e5e2bf0f3eda91f16972e52 Mon Sep 17 00:00:00 2001
+From: "Paul E. McKenney" <paulmck@kernel.org>
+Date: Tue, 20 Oct 2020 21:13:55 -0700
+Subject: x86/smpboot: Move rcu_cpu_starting() earlier
+
+From: Paul E. McKenney <paulmck@kernel.org>
+
+commit 29368e09392123800e5e2bf0f3eda91f16972e52 upstream.
+
+The call to rcu_cpu_starting() in mtrr_ap_init() is not early enough
+in the CPU-hotplug onlining process, which results in lockdep splats
+as follows:
+
+=============================
+WARNING: suspicious RCU usage
+5.9.0+ #268 Not tainted
+-----------------------------
+kernel/kprobes.c:300 RCU-list traversed in non-reader section!!
+
+other info that might help us debug this:
+
+RCU used illegally from offline CPU!
+rcu_scheduler_active = 1, debug_locks = 1
+no locks held by swapper/1/0.
+
+stack backtrace:
+CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.9.0+ #268
+Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.10.2-1ubuntu1 04/01/2014
+Call Trace:
+ dump_stack+0x77/0x97
+ __is_insn_slot_addr+0x15d/0x170
+ kernel_text_address+0xba/0xe0
+ ? get_stack_info+0x22/0xa0
+ __kernel_text_address+0x9/0x30
+ show_trace_log_lvl+0x17d/0x380
+ ? dump_stack+0x77/0x97
+ dump_stack+0x77/0x97
+ __lock_acquire+0xdf7/0x1bf0
+ lock_acquire+0x258/0x3d0
+ ? vprintk_emit+0x6d/0x2c0
+ _raw_spin_lock+0x27/0x40
+ ? vprintk_emit+0x6d/0x2c0
+ vprintk_emit+0x6d/0x2c0
+ printk+0x4d/0x69
+ start_secondary+0x1c/0x100
+ secondary_startup_64_no_verify+0xb8/0xbb
+
+This is avoided by moving the call to rcu_cpu_starting up near
+the beginning of the start_secondary() function. Note that the
+raw_smp_processor_id() is required in order to avoid calling into lockdep
+before RCU has declared the CPU to be watched for readers.
+
+Link: https://lore.kernel.org/lkml/160223032121.7002.1269740091547117869.tip-bot2@tip-bot2/
+Reported-by: Qian Cai <cai@redhat.com>
+Suggested-by: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Cc: Joel Fernandes <joel@joelfernandes.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/cpu/mtrr/mtrr.c | 2 --
+ arch/x86/kernel/smpboot.c | 1 +
+ 2 files changed, 1 insertion(+), 2 deletions(-)
+
+--- a/arch/x86/kernel/cpu/mtrr/mtrr.c
++++ b/arch/x86/kernel/cpu/mtrr/mtrr.c
+@@ -794,8 +794,6 @@ void mtrr_ap_init(void)
+ if (!use_intel() || mtrr_aps_delayed_init)
+ return;
+
+- rcu_cpu_starting(smp_processor_id());
+-
+ /*
+ * Ideally we should hold mtrr_mutex here to avoid mtrr entries
+ * changed, but this routine will be called in cpu boot time,
+--- a/arch/x86/kernel/smpboot.c
++++ b/arch/x86/kernel/smpboot.c
+@@ -224,6 +224,7 @@ static void notrace start_secondary(void
+ #endif
+ load_current_idt();
+ cpu_init();
++ rcu_cpu_starting(raw_smp_processor_id());
+ x86_cpuinit.early_percpu_clock_init();
+ preempt_disable();
+ smp_callin();