updpkg: libre/linux-libre-hardened 5.6.13.a-1

Signed-off-by: David P <megver83@parabola.nu>

6 files changed, 579 insertions, 8 deletions

diff --git a/libre/linux-libre-hardened/0001-gcc-plugins-drop-support-for-GCC-4.7.patch b/libre/linux-libre-hardened/0001-gcc-plugins-drop-support-for-GCC-4.7.patch
new file mode 100644
index 000000000..d94b356ba
--- /dev/null
+++ b/libre/linux-libre-hardened/0001-gcc-plugins-drop-support-for-GCC-4.7.patch
@@ -0,0 +1,306 @@
+From dba68a9d4df76d49d32245e4236713a43fb321da Mon Sep 17 00:00:00 2001
+From: Masahiro Yamada <masahiroy@kernel.org>
+Date: Sun, 29 Mar 2020 20:08:32 +0900
+Subject: [PATCH 1/4] gcc-plugins: drop support for GCC <= 4.7
+
+Nobody was opposed to raising minimum GCC version to 4.8 [1]
+So, we will drop GCC <= 4.7 support sooner or later.
+
+We always use C++ compiler for building plugins for GCC >= 4.8.
+
+This commit drops the plugin support for GCC <= 4.7 a bit earlier,
+which allows us to dump lots of code.
+
+[1] https://lkml.org/lkml/2020/1/23/545
+
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Acked-by: Kees Cook <keescook@chromium.org>
+---
+ scripts/Kconfig.include      |  3 --
+ scripts/Makefile.build       |  2 +-
+ scripts/Makefile.clean       |  1 -
+ scripts/Makefile.host        | 23 +--------------
+ scripts/gcc-plugin.sh        | 57 ++++--------------------------------
+ scripts/gcc-plugins/Kconfig  | 12 ++------
+ scripts/gcc-plugins/Makefile | 21 ++++---------
+ 7 files changed, 15 insertions(+), 104 deletions(-)
+
+diff --git a/scripts/Kconfig.include b/scripts/Kconfig.include
+index 496d11c92c97..033f6efd92d3 100644
+--- a/scripts/Kconfig.include
++++ b/scripts/Kconfig.include
+@@ -42,9 +42,6 @@ $(error-if,$(failure,command -v $(LD)),linker '$(LD)' not found)
+ # Fail if the linker is gold as it's not capable of linking the kernel proper
+ $(error-if,$(success, $(LD) -v | grep -q gold), gold linker '$(LD)' not supported)
+ 
+-# gcc version including patch level
+-gcc-version := $(shell,$(srctree)/scripts/gcc-version.sh $(CC))
+-
+ # machine bit flags
+ #  $(m32-flag): -m32 if the compiler supports it, or an empty string otherwise.
+ #  $(m64-flag): -m64 if the compiler supports it, or an empty string otherwise.
+diff --git a/scripts/Makefile.build b/scripts/Makefile.build
+index a1730d42e5f3..eec789d7a63a 100644
+--- a/scripts/Makefile.build
++++ b/scripts/Makefile.build
+@@ -46,7 +46,7 @@ include $(kbuild-file)
+ include scripts/Makefile.lib
+ 
+ # Do not include host rules unless needed
+-ifneq ($(hostprogs)$(hostlibs-y)$(hostlibs-m)$(hostcxxlibs-y)$(hostcxxlibs-m),)
++ifneq ($(hostprogs)$(hostcxxlibs-y)$(hostcxxlibs-m),)
+ include scripts/Makefile.host
+ endif
+ 
+diff --git a/scripts/Makefile.clean b/scripts/Makefile.clean
+index 1e4206566a82..075f0cc2d8d7 100644
+--- a/scripts/Makefile.clean
++++ b/scripts/Makefile.clean
+@@ -30,7 +30,6 @@ subdir-ymn	:= $(addprefix $(obj)/,$(subdir-ymn))
+ __clean-files	:= $(extra-y) $(extra-m) $(extra-)       \
+ 		   $(always) $(always-y) $(always-m) $(always-) $(targets) $(clean-files)   \
+ 		   $(hostprogs) $(hostprogs-y) $(hostprogs-m) $(hostprogs-) \
+-		   $(hostlibs-y) $(hostlibs-m) $(hostlibs-) \
+ 		   $(hostcxxlibs-y) $(hostcxxlibs-m)
+ 
+ __clean-files   := $(filter-out $(no-clean-files), $(__clean-files))
+diff --git a/scripts/Makefile.host b/scripts/Makefile.host
+index 3b7121d43324..2045855d0b75 100644
+--- a/scripts/Makefile.host
++++ b/scripts/Makefile.host
+@@ -39,41 +39,37 @@ $(obj)/%.tab.c $(obj)/%.tab.h: $(src)/%.y FORCE
+ # They are linked as C++ code to the executable qconf
+ 
+ __hostprogs := $(sort $(hostprogs))
+-host-cshlib := $(sort $(hostlibs-y) $(hostlibs-m))
+ host-cxxshlib := $(sort $(hostcxxlibs-y) $(hostcxxlibs-m))
+ 
+ # C code
+ # Executables compiled from a single .c file
+ host-csingle	:= $(foreach m,$(__hostprogs), \
+ 			$(if $($(m)-objs)$($(m)-cxxobjs),,$(m)))
+ 
+ # C executables linked based on several .o files
+ host-cmulti	:= $(foreach m,$(__hostprogs),\
+ 		   $(if $($(m)-cxxobjs),,$(if $($(m)-objs),$(m))))
+ 
+ # Object (.o) files compiled from .c files
+ host-cobjs	:= $(sort $(foreach m,$(__hostprogs),$($(m)-objs)))
+ 
+ # C++ code
+ # C++ executables compiled from at least one .cc file
+ # and zero or more .c files
+ host-cxxmulti	:= $(foreach m,$(__hostprogs),$(if $($(m)-cxxobjs),$(m)))
+ 
+ # C++ Object (.o) files compiled from .cc files
+ host-cxxobjs	:= $(sort $(foreach m,$(host-cxxmulti),$($(m)-cxxobjs)))
+ 
+ # Object (.o) files used by the shared libaries
+-host-cshobjs	:= $(sort $(foreach m,$(host-cshlib),$($(m:.so=-objs))))
+ host-cxxshobjs	:= $(sort $(foreach m,$(host-cxxshlib),$($(m:.so=-objs))))
+ 
+ host-csingle	:= $(addprefix $(obj)/,$(host-csingle))
+ host-cmulti	:= $(addprefix $(obj)/,$(host-cmulti))
+ host-cobjs	:= $(addprefix $(obj)/,$(host-cobjs))
+ host-cxxmulti	:= $(addprefix $(obj)/,$(host-cxxmulti))
+ host-cxxobjs	:= $(addprefix $(obj)/,$(host-cxxobjs))
+-host-cshlib	:= $(addprefix $(obj)/,$(host-cshlib))
+ host-cxxshlib	:= $(addprefix $(obj)/,$(host-cxxshlib))
+-host-cshobjs	:= $(addprefix $(obj)/,$(host-cshobjs))
+ host-cxxshobjs	:= $(addprefix $(obj)/,$(host-cxxshobjs))
+ 
+ #####
+@@ -140,42 +136,25 @@ quiet_cmd_host-cxxobjs	= HOSTCXX $@
+ $(host-cxxobjs): $(obj)/%.o: $(src)/%.cc FORCE
+ 	$(call if_changed_dep,host-cxxobjs)
+ 
+-# Compile .c file, create position independent .o file
+-# host-cshobjs -> .o
+-quiet_cmd_host-cshobjs	= HOSTCC  -fPIC $@
+-      cmd_host-cshobjs	= $(HOSTCC) $(hostc_flags) -fPIC -c -o $@ $<
+-$(host-cshobjs): $(obj)/%.o: $(src)/%.c FORCE
+-	$(call if_changed_dep,host-cshobjs)
+-
+ # Compile .c file, create position independent .o file
+ # Note that plugin capable gcc versions can be either C or C++ based
+ # therefore plugin source files have to be compilable in both C and C++ mode.
+ # This is why a C++ compiler is invoked on a .c file.
+ # host-cxxshobjs -> .o
+ quiet_cmd_host-cxxshobjs	= HOSTCXX -fPIC $@
+       cmd_host-cxxshobjs	= $(HOSTCXX) $(hostcxx_flags) -fPIC -c -o $@ $<
+ $(host-cxxshobjs): $(obj)/%.o: $(src)/%.c FORCE
+ 	$(call if_changed_dep,host-cxxshobjs)
+ 
+-# Link a shared library, based on position independent .o files
+-# *.o -> .so shared library (host-cshlib)
+-quiet_cmd_host-cshlib	= HOSTLLD -shared $@
+-      cmd_host-cshlib	= $(HOSTCC) $(KBUILD_HOSTLDFLAGS) -shared -o $@ \
+-			  $(addprefix $(obj)/, $($(target-stem)-objs)) \
+-			  $(KBUILD_HOSTLDLIBS) $(HOSTLDLIBS_$(target-stem).so)
+-$(host-cshlib): FORCE
+-	$(call if_changed,host-cshlib)
+-$(call multi_depend, $(host-cshlib), .so, -objs)
+-
+ # Link a shared library, based on position independent .o files
+ # *.o -> .so shared library (host-cxxshlib)
+ quiet_cmd_host-cxxshlib	= HOSTLLD -shared $@
+       cmd_host-cxxshlib	= $(HOSTCXX) $(KBUILD_HOSTLDFLAGS) -shared -o $@ \
+ 			  $(addprefix $(obj)/, $($(target-stem)-objs)) \
+ 			  $(KBUILD_HOSTLDLIBS) $(HOSTLDLIBS_$(target-stem).so)
+ $(host-cxxshlib): FORCE
+ 	$(call if_changed,host-cxxshlib)
+ $(call multi_depend, $(host-cxxshlib), .so, -objs)
+ 
+ targets += $(host-csingle)  $(host-cmulti) $(host-cobjs)\
+-	   $(host-cxxmulti) $(host-cxxobjs) $(host-cshlib) $(host-cshobjs) $(host-cxxshlib) $(host-cxxshobjs)
++	   $(host-cxxmulti) $(host-cxxobjs) $(host-cxxshlib) $(host-cxxshobjs)
+diff --git a/scripts/gcc-plugin.sh b/scripts/gcc-plugin.sh
+index d3caefe53eab..b79fd0bea838 100755
+--- a/scripts/gcc-plugin.sh
++++ b/scripts/gcc-plugin.sh
+@@ -1,66 +1,19 @@
+ #!/bin/sh
+ # SPDX-License-Identifier: GPL-2.0
++
++set -e
++
+ srctree=$(dirname "$0")
+ 
+-SHOW_ERROR=
+-if [ "$1" = "--show-error" ] ; then
+-	SHOW_ERROR=1
+-	shift || true
+-fi
+-
+-gccplugins_dir=$($3 -print-file-name=plugin)
+-plugincc=$($1 -E -x c++ - -o /dev/null -I"${srctree}"/gcc-plugins -I"${gccplugins_dir}"/include 2>&1 <<EOF
+-#include "gcc-common.h"
+-#if BUILDING_GCC_VERSION >= 4008 || defined(ENABLE_BUILD_WITH_CXX)
+-#warning $2 CXX
+-#else
+-#warning $1 CC
+-#endif
+-EOF
+-)
+-
+-if [ $? -ne 0 ]
+-then
+-	if [ -n "$SHOW_ERROR" ] ; then
+-		echo "${plugincc}" >&2
+-	fi
+-	exit 1
+-fi
+-
+-case "$plugincc" in
+-	*"$1 CC"*)
+-		echo "$1"
+-		exit 0
+-		;;
+-
+-	*"$2 CXX"*)
+-		# the c++ compiler needs another test, see below
+-		;;
+-
+-	*)
+-		exit 1
+-		;;
+-esac
++gccplugins_dir=$($* -print-file-name=plugin)
+ 
+ # we need a c++ compiler that supports the designated initializer GNU extension
+-plugincc=$($2 -c -x c++ -std=gnu++98 - -fsyntax-only -I"${srctree}"/gcc-plugins -I"${gccplugins_dir}"/include 2>&1 <<EOF
++$HOSTCC -c -x c++ -std=gnu++98 - -fsyntax-only -I $srctree/gcc-plugins -I $gccplugins_dir/include 2>/dev/null <<EOF
+ #include "gcc-common.h"
+ class test {
+ public:
+ 	int test;
+ } test = {
+ 	.test = 1
+ };
+ EOF
+-)
+-
+-if [ $? -eq 0 ]
+-then
+-	echo "$2"
+-	exit 0
+-fi
+-
+-if [ -n "$SHOW_ERROR" ] ; then
+-	echo "${plugincc}" >&2
+-fi
+-exit 1
+diff --git a/scripts/gcc-plugins/Kconfig b/scripts/gcc-plugins/Kconfig
+index e3569543bdac..fd31ed5b435f 100644
+--- a/scripts/gcc-plugins/Kconfig
++++ b/scripts/gcc-plugins/Kconfig
+@@ -1,23 +1,15 @@
+ # SPDX-License-Identifier: GPL-2.0-only
+-preferred-plugin-hostcc := $(if-success,[ $(gcc-version) -ge 40800 ],$(HOSTCXX),$(HOSTCC))
+-
+-config PLUGIN_HOSTCC
+-	string
+-	default "$(shell,$(srctree)/scripts/gcc-plugin.sh "$(preferred-plugin-hostcc)" "$(HOSTCXX)" "$(CC)")" if CC_IS_GCC
+-	help
+-	  Host compiler used to build GCC plugins.  This can be $(HOSTCXX),
+-	  $(HOSTCC), or a null string if GCC plugin is unsupported.
+-
+ config HAVE_GCC_PLUGINS
+ 	bool
+ 	help
+ 	  An arch should select this symbol if it supports building with
+ 	  GCC plugins.
+ 
+ menuconfig GCC_PLUGINS
+ 	bool "GCC plugins"
+ 	depends on HAVE_GCC_PLUGINS
+-	depends on PLUGIN_HOSTCC != ""
++	depends on CC_IS_GCC && GCC_VERSION >= 40800
++	depends on $(success,$(srctree)/scripts/gcc-plugin.sh $(CC))
+ 	default y
+ 	help
+ 	  GCC plugins are loadable modules that provide extra features to the
+diff --git a/scripts/gcc-plugins/Makefile b/scripts/gcc-plugins/Makefile
+index f2ee8bd7abc6..f22858b2c3d6 100644
+--- a/scripts/gcc-plugins/Makefile
++++ b/scripts/gcc-plugins/Makefile
+@@ -1,30 +1,21 @@
+ # SPDX-License-Identifier: GPL-2.0
+-PLUGINCC := $(CONFIG_PLUGIN_HOSTCC:"%"=%)
+ GCC_PLUGINS_DIR := $(shell $(CC) -print-file-name=plugin)
+ 
+-ifeq ($(PLUGINCC),$(HOSTCC))
+-  HOSTLIBS := hostlibs
+-  HOST_EXTRACFLAGS += -I$(GCC_PLUGINS_DIR)/include -I$(src) -std=gnu99 -ggdb
+-  export HOST_EXTRACFLAGS
+-else
+-  HOSTLIBS := hostcxxlibs
+-  HOST_EXTRACXXFLAGS += -I$(GCC_PLUGINS_DIR)/include -I$(src) -std=gnu++98 -fno-rtti
+-  HOST_EXTRACXXFLAGS += -fno-exceptions -fasynchronous-unwind-tables -ggdb
+-  HOST_EXTRACXXFLAGS += -Wno-narrowing -Wno-unused-variable
+-  export HOST_EXTRACXXFLAGS
+-endif
++HOST_EXTRACXXFLAGS += -I$(GCC_PLUGINS_DIR)/include -I$(src) -std=gnu++98 -fno-rtti
++HOST_EXTRACXXFLAGS += -fno-exceptions -fasynchronous-unwind-tables -ggdb
++HOST_EXTRACXXFLAGS += -Wno-narrowing -Wno-unused-variable -Wno-c++11-compat
+ 
+ $(obj)/randomize_layout_plugin.o: $(objtree)/$(obj)/randomize_layout_seed.h
+ quiet_cmd_create_randomize_layout_seed = GENSEED $@
+ cmd_create_randomize_layout_seed = \
+   $(CONFIG_SHELL) $(srctree)/$(src)/gen-random-seed.sh $@ $(objtree)/include/generated/randomize_layout_hash.h
+ $(objtree)/$(obj)/randomize_layout_seed.h: FORCE
+ 	$(call if_changed,create_randomize_layout_seed)
+ targets = randomize_layout_seed.h randomize_layout_hash.h
+ 
+-$(HOSTLIBS)-y := $(foreach p,$(GCC_PLUGIN),$(if $(findstring /,$(p)),,$(p)))
+-always-y := $($(HOSTLIBS)-y)
++hostcxxlibs-y := $(foreach p,$(GCC_PLUGIN),$(if $(findstring /,$(p)),,$(p)))
++always-y := $(hostcxxlibs-y)
+ 
+-$(foreach p,$($(HOSTLIBS)-y:%.so=%),$(eval $(p)-objs := $(p).o))
++$(foreach p,$(hostcxxlibs-y:%.so=%),$(eval $(p)-objs := $(p).o))
+ 
+ clean-files += *.so
+-- 
+2.26.2
+
diff --git a/libre/linux-libre-hardened/0002-gcc-common.h-Update-for-GCC-10.patch b/libre/linux-libre-hardened/0002-gcc-common.h-Update-for-GCC-10.patch
new file mode 100644
index 000000000..ea1357195
--- /dev/null
+++ b/libre/linux-libre-hardened/0002-gcc-common.h-Update-for-GCC-10.patch
@@ -0,0 +1,92 @@
+From 41e53fdbbf5121960fd44427c2ae7536d8fdd701 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20Pierret=20=28fepitre=29?=
+ <frederic.pierret@qubes-os.org>
+Date: Tue, 7 Apr 2020 13:32:59 +0200
+Subject: [PATCH 2/4] gcc-common.h: Update for GCC 10
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Remove "params.h" include, which has been dropped in GCC 10.
+
+Remove is_a_helper() macro, which is now defined in gimple.h, as seen
+when running './scripts/gcc-plugin.sh g++ g++ gcc':
+
+In file included from <stdin>:1:
+./gcc-plugins/gcc-common.h:852:13: error: redefinition of ‘static bool is_a_helper<T>::test(U*) [with U = const gimple; T = const ggoto*]’
+  852 | inline bool is_a_helper<const ggoto *>::test(const_gimple gs)
+      |             ^~~~~~~~~~~~~~~~~~~~~~~~~~
+In file included from ./gcc-plugins/gcc-common.h:125,
+                 from <stdin>:1:
+/usr/lib/gcc/x86_64-redhat-linux/10/plugin/include/gimple.h:1037:1: note: ‘static bool is_a_helper<T>::test(U*) [with U = const gimple; T = const ggoto*]’ previously declared here
+ 1037 | is_a_helper <const ggoto *>::test (const gimple *gs)
+      | ^~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Add -Wno-format-diag to scripts/gcc-plugins/Makefile to avoid
+meaningless warnings from error() formats used by plugins:
+
+scripts/gcc-plugins/structleak_plugin.c: In function ‘int plugin_init(plugin_name_args*, plugin_gcc_version*)’:
+scripts/gcc-plugins/structleak_plugin.c:253:12: warning: unquoted sequence of 2 consecutive punctuation characters ‘'-’ in format [-Wformat-diag]
+  253 |   error(G_("unknown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
+      |            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Signed-off-by: Frédéric Pierret (fepitre) <frederic.pierret@qubes-os.org>
+Link: https://lore.kernel.org/r/20200407113259.270172-1-frederic.pierret@qubes-os.org
+[kees: include -Wno-format-diag for plugin builds]
+Signed-off-by: Kees Cook <keescook@chromium.org>
+---
+ scripts/gcc-plugins/Makefile     | 1 +
+ scripts/gcc-plugins/gcc-common.h | 4 ++++
+ 2 files changed, 5 insertions(+)
+
+diff --git a/scripts/gcc-plugins/Makefile b/scripts/gcc-plugins/Makefile
+index f22858b2c3d6..80f354289eeb 100644
+--- a/scripts/gcc-plugins/Makefile
++++ b/scripts/gcc-plugins/Makefile
+@@ -4,6 +4,7 @@ GCC_PLUGINS_DIR := $(shell $(CC) -print-file-name=plugin)
+ HOST_EXTRACXXFLAGS += -I$(GCC_PLUGINS_DIR)/include -I$(src) -std=gnu++98 -fno-rtti
+ HOST_EXTRACXXFLAGS += -fno-exceptions -fasynchronous-unwind-tables -ggdb
+ HOST_EXTRACXXFLAGS += -Wno-narrowing -Wno-unused-variable -Wno-c++11-compat
++HOST_EXTRACXXFLAGS += -Wno-format-diag
+ 
+ $(obj)/randomize_layout_plugin.o: $(objtree)/$(obj)/randomize_layout_seed.h
+ quiet_cmd_create_randomize_layout_seed = GENSEED $@
+diff --git a/scripts/gcc-plugins/gcc-common.h b/scripts/gcc-plugins/gcc-common.h
+index 17f06079a712..9ad76b7f3f10 100644
+--- a/scripts/gcc-plugins/gcc-common.h
++++ b/scripts/gcc-plugins/gcc-common.h
+@@ -35,7 +35,9 @@
+ #include "ggc.h"
+ #include "timevar.h"
+ 
++#if BUILDING_GCC_VERSION < 10000
+ #include "params.h"
++#endif
+ 
+ #if BUILDING_GCC_VERSION <= 4009
+ #include "pointer-set.h"
+@@ -847,19 +849,21 @@ static inline gimple gimple_build_assign_with_ops(enum tree_code subcode, tree l
+ 	return gimple_build_assign(lhs, subcode, op1, op2 PASS_MEM_STAT);
+ }
+ 
++#if BUILDING_GCC_VERSION < 10000
+ template <>
+ template <>
+ inline bool is_a_helper<const ggoto *>::test(const_gimple gs)
+ {
+ 	return gs->code == GIMPLE_GOTO;
+ }
+ 
+ template <>
+ template <>
+ inline bool is_a_helper<const greturn *>::test(const_gimple gs)
+ {
+ 	return gs->code == GIMPLE_RETURN;
+ }
++#endif
+ 
+ static inline gasm *as_a_gasm(gimple stmt)
+ {
+-- 
+2.26.2
+
diff --git a/libre/linux-libre-hardened/0003-Makefile-disallow-data-races-on-gcc-10-as-well.patch b/libre/linux-libre-hardened/0003-Makefile-disallow-data-races-on-gcc-10-as-well.patch
new file mode 100644
index 000000000..a645f7547
--- /dev/null
+++ b/libre/linux-libre-hardened/0003-Makefile-disallow-data-races-on-gcc-10-as-well.patch
@@ -0,0 +1,32 @@
+From af805f5f1d2e61dd2cf907d9635f0abc66fe1197 Mon Sep 17 00:00:00 2001
+From: Sergei Trofimovich <slyfox@gentoo.org>
+Date: Tue, 17 Mar 2020 00:07:18 +0000
+Subject: [PATCH 3/4] Makefile: disallow data races on gcc-10 as well
+
+gcc-10 will rename --param=allow-store-data-races=0
+to -fno-allow-store-data-races.
+
+The flag change happened at https://gcc.gnu.org/PR92046.
+
+Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org>
+Acked-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+---
+ Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/Makefile b/Makefile
+index 5dedd6f9ad75..6899bfc9dc7b 100644
+--- a/Makefile
++++ b/Makefile
+@@ -714,6 +714,7 @@ endif
+ 
+ # Tell gcc to never replace conditional load with a non-conditional one
+ KBUILD_CFLAGS	+= $(call cc-option,--param=allow-store-data-races=0)
++KBUILD_CFLAGS	+= $(call cc-option,-fno-allow-store-data-races)
+ 
+ include scripts/Makefile.kcov
+ include scripts/Makefile.gcc-plugins
+-- 
+2.26.2
+
diff --git a/libre/linux-libre-hardened/0004-x86-Fix-early-boot-crash-on-gcc-10-next-try.patch b/libre/linux-libre-hardened/0004-x86-Fix-early-boot-crash-on-gcc-10-next-try.patch
new file mode 100644
index 000000000..50c139f1f
--- /dev/null
+++ b/libre/linux-libre-hardened/0004-x86-Fix-early-boot-crash-on-gcc-10-next-try.patch
@@ -0,0 +1,131 @@
+From 309b6eca2e2605accf7a3b02b47b5c2732dbe543 Mon Sep 17 00:00:00 2001
+From: Borislav Petkov <bp@suse.de>
+Date: Wed, 22 Apr 2020 18:11:30 +0200
+Subject: [PATCH 4/4] x86: Fix early boot crash on gcc-10, next try
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+... or the odyssey of trying to disable the stack protector for the
+function which generates the stack canary value.
+
+The whole story started with Sergei reporting a boot crash with a kernel
+built with gcc-10:
+
+  Kernel panic — not syncing: stack-protector: Kernel stack is corrupted in: start_secondary
+  CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.6.0-rc5—00235—gfffb08b37df9 #139
+  Hardware name: Gigabyte Technology Co., Ltd. To be filled by O.E.M./H77M—D3H, BIOS F12 11/14/2013
+  Call Trace:
+    dump_stack
+    panic
+    ? start_secondary
+    __stack_chk_fail
+    start_secondary
+    secondary_startup_64
+  -—-[ end Kernel panic — not syncing: stack—protector: Kernel stack is corrupted in: start_secondary
+
+This happens because gcc-10 tail-call optimizes the last function call
+in start_secondary() - cpu_startup_entry() - and thus emits a stack
+canary check which fails because the canary value changes after the
+boot_init_stack_canary() call.
+
+To fix that, the initial attempt was to mark the one function which
+generates the stack canary with:
+
+  __attribute__((optimize("-fno-stack-protector"))) ... start_secondary(void *unused)
+
+however, using the optimize attribute doesn't work cumulatively
+as the attribute does not add to but rather replaces previously
+supplied optimization options - roughly all -fxxx options.
+
+The key one among them being -fno-omit-frame-pointer and thus leading to
+not present frame pointer - frame pointer which the kernel needs.
+
+The next attempt to prevent compilers from tail-call optimizing
+the last function call cpu_startup_entry(), shy of carving out
+start_secondary() into a separate compilation unit and building it with
+-fno-stack-protector, is this one.
+
+The current solution is short and sweet, and reportedly, is supported by
+both compilers so let's see how far we'll get this time.
+
+Reported-by: Sergei Trofimovich <slyfox@gentoo.org>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Link: https://lkml.kernel.org/r/20200314164451.346497-1-slyfox@gentoo.org
+---
+ arch/x86/include/asm/stackprotector.h | 7 ++++++-
+ arch/x86/kernel/smpboot.c             | 8 ++++++++
+ arch/x86/xen/smp_pv.c                 | 1 +
+ include/linux/compiler.h              | 6 ++++++
+ 4 files changed, 21 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/include/asm/stackprotector.h b/arch/x86/include/asm/stackprotector.h
+index 91e29b6a86a5..9804a7957f4e 100644
+--- a/arch/x86/include/asm/stackprotector.h
++++ b/arch/x86/include/asm/stackprotector.h
+@@ -55,8 +55,13 @@
+ /*
+  * Initialize the stackprotector canary value.
+  *
+- * NOTE: this must only be called from functions that never return,
++ * NOTE: this must only be called from functions that never return
+  * and it must always be inlined.
++ *
++ * In addition, it should be called from a compilation unit for which
++ * stack protector is disabled. Alternatively, the caller should not end
++ * with a function call which gets tail-call optimized as that would
++ * lead to checking a modified canary value.
+  */
+ static __always_inline void boot_init_stack_canary(void)
+ {
+diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
+index 69881b2d446c..9674321ce3a3 100644
+--- a/arch/x86/kernel/smpboot.c
++++ b/arch/x86/kernel/smpboot.c
+@@ -262,6 +262,14 @@ static void notrace start_secondary(void *unused)
+ 
+ 	wmb();
+ 	cpu_startup_entry(CPUHP_AP_ONLINE_IDLE);
++
++	/*
++	 * Prevent tail call to cpu_startup_entry() because the stack protector
++	 * guard has been changed a couple of function calls up, in
++	 * boot_init_stack_canary() and must not be checked before tail calling
++	 * another function.
++	 */
++	prevent_tail_call_optimization();
+ }
+ 
+ /**
+diff --git a/arch/x86/xen/smp_pv.c b/arch/x86/xen/smp_pv.c
+index 802ee5bba66c..0cebe5db691d 100644
+--- a/arch/x86/xen/smp_pv.c
++++ b/arch/x86/xen/smp_pv.c
+@@ -92,6 +92,7 @@ asmlinkage __visible void cpu_bringup_and_idle(void)
+ 	cpu_bringup();
+ 	boot_init_stack_canary();
+ 	cpu_startup_entry(CPUHP_AP_ONLINE_IDLE);
++	prevent_tail_call_optimization();
+ }
+ 
+ void xen_smp_intr_free_pv(unsigned int cpu)
+diff --git a/include/linux/compiler.h b/include/linux/compiler.h
+index 034b0a644efc..732754d96039 100644
+--- a/include/linux/compiler.h
++++ b/include/linux/compiler.h
+@@ -356,4 +356,10 @@ static inline void *offset_to_ptr(const int *off)
+ /* &a[0] degrades to a pointer: a different type from an array */
+ #define __must_be_array(a)	BUILD_BUG_ON_ZERO(__same_type((a), &(a)[0]))
+ 
++/*
++ * This is needed in functions which generate the stack canary, see
++ * arch/x86/kernel/smpboot.c::start_secondary() for an example.
++ */
++#define prevent_tail_call_optimization()	asm("")
++
+ #endif /* __LINUX_COMPILER_H */
+-- 
+2.26.2
+
diff --git a/libre/linux-libre-hardened/PKGBUILD b/libre/linux-libre-hardened/PKGBUILD
index 8a719805a..f6cf44359 100644
--- a/libre/linux-libre-hardened/PKGBUILD
+++ b/libre/linux-libre-hardened/PKGBUILD
@@ -9,7 +9,7 @@ _replacesoldkernels=('linux-grsec' 'linux-libre-grsec') # '%' gets replaced with
 _replacesoldmodules=() # '%' gets replaced with kernel suffix
 
 pkgbase=linux-libre-hardened
-pkgver=5.6.7.a
+pkgver=5.6.13.a
 pkgrel=1
 pkgdesc='Security-Hardened Linux-libre'
 url='https://linux-libre.fsfla.org/'
@@ -35,7 +35,11 @@ source=(
   # https://labs.parabola.nu/issues/877
   # http://www.fsfla.org/pipermail/linux-libre/2015-November/003202.html
   0002-fix-Atmel-maXTouch-touchscreen-support.patch
-
+  # Arch Linux patches
+  0001-gcc-plugins-drop-support-for-GCC-4.7.patch
+  0002-gcc-common.h-Update-for-GCC-10.patch
+  0003-Makefile-disallow-data-races-on-gcc-10-as-well.patch
+  0004-x86-Fix-early-boot-crash-on-gcc-10-next-try.patch
   sphinx-workaround.patch
 )
 validpgpkeys=(
@@ -46,9 +50,9 @@ validpgpkeys=(
 )
 sha512sums=('df473a228ca2bbefbcc630aee710c78c83083269b4939adf698a9adf3a5760391b24529704bfc0b108bc67054ebed047746810e1b41be1fd9019a911a563114d'
             'SKIP'
-            '0c01eabfbd10fb5aeabcb60c9ca362576bd7b33a31b841704b3b4d3c650a2a681b208ffdeb82673286b0e8449858d399cc80f04acafa7d27ee686f2880471e6d'
+            '913c307a2dd5509d8b559223e7f4dc3e800a5030b7d401db661617a781d849a8627f09ced8e825dd0222758ef4976994d214c40b2e5eaa5f30864597859c9fb7'
             'SKIP'
-            '284c10934aa92a0943427009274fb75827d903c0ae12174b4bdbe0d849ce8c91badd37a1facffa402cba0e179f06f5c66a24847f3a7528802afb307a58d32abd'
+            'd5cc0a66546055212489fa647ae2cc4eb48571314b20c368adbb26ca8ce9fc5a7f657f0d1c9cbbe131637c776c6f19e347c9c341b8c21b08e31b57d9c8bdcff8'
             'SKIP'
             '13cb5bc42542e7b8bb104d5f68253f6609e463b6799800418af33eb0272cc269aaa36163c3e6f0aacbdaaa1d05e2827a4a7c4a08a029238439ed08b89c564bb3'
             'SKIP'
@@ -56,9 +60,13 @@ sha512sums=('df473a228ca2bbefbcc630aee710c78c83083269b4939adf698a9adf3a5760391b2
             'SKIP'
             '267295aa0cea65684968420c68b32f1a66a22d018b9d2b2c1ef14267bcf4cb68aaf7099d073cbfefe6c25c8608bdcbbd45f7ac8893fdcecbf1e621abdfe9ecc1'
             'SKIP'
-            '9b57c9302c9e89461a890a1a3b623ba25db16aad07e4bc0238cd520c43ee9c180650f620be49a9a7906c3771fb06374ce7733b99d4f1fe787cd6976d73af886b'
+            '00e18e3cf55f391723ceb398da56de4632eed32fef17fcc6cd8ca0c820e55bfc2b66d64a0c7aada3c4a64daaab656964c6d4720e16aa3a2ff1a0984494ed9f47'
             '02af4dd2a007e41db0c63822c8ab3b80b5d25646af1906dc85d0ad9bb8bbf5236f8e381d7f91cf99ed4b0978c50aee37cb9567cdeef65b7ec3d91b882852b1af'
             'b8fe56e14006ab866970ddbd501c054ae37186ddc065bb869cf7d18db8c0d455118d5bda3255fb66a0dde38b544655cfe9040ffe46e41d19830b47959b2fb168'
+            '39b98cc0889b617f052a25f4aed9b90df6907886dd890cfb26ad86c3fcc3c7af960d7422ec1ff00328507c99f681f9bc1cb174dda71eb39b99c30c595eb988a8'
+            'f3875930073b3f77c98a30eddda03548602cce80ac4c3fcccf77cf97ca53aa79ba7ef508ef80c1f3aadf7ae8769bcabfdab7ff9344ff22ca9947883afbae7bf3'
+            'ba8439195b4989b8aa562a9d91307bcc285e748ce7cdea89079866bf24f41e3a1869ec3ad1396622825c3a0900fa05c5e6c9f777fa35f02e77d062a7c801bb16'
+            'c494fea02bf5f7a325614915291d555a343332b1f0c16d942ebfd2c534cec2c0872c0a9d2db7bfeb3a9d199ecc52e95741e9b6a9a144586e78e029b17508e0c7'
             '98e97155f86bbe837d43f27ec1018b5b6fdc6c372d6f7f2a0fe29da117d53979d9f9c262f886850d92002898682781029b80d4ee923633fc068f979e6c8254be')
   
 _replacesarchkernel=("${_replacesarchkernel[@]/\%/${pkgbase#linux-libre}}")
@@ -116,7 +124,8 @@ _package() {
   optdepends=('crda: to set the correct wireless channels of your country'
               'linux-libre-firmware: firmware images needed for some devices'
               'usbctl: deny_new_usb control')
-  provides=("${_replacesarchkernel[@]/%/=${pkgver%.*}}" "LINUX-ABI_VERSION=${pkgver%.*}")
+  provides=(VIRTUALBOX-GUEST-MODULES WIREGUARD-MODULE)
+  provides+=("${_replacesarchkernel[@]/%/=${pkgver%.*}}" "LINUX-ABI_VERSION=${pkgver%.*}")
   conflicts=("${_replacesarchkernel[@]}" "${_replacesoldkernels[@]}" "${_replacesoldmodules[@]}")
   replaces=("${_replacesarchkernel[@]}" "${_replacesoldkernels[@]}" "${_replacesoldmodules[@]}")
 
diff --git a/libre/linux-libre-hardened/config b/libre/linux-libre-hardened/config
index 028a1eb64..adc88f720 100644
--- a/libre/linux-libre-hardened/config
+++ b/libre/linux-libre-hardened/config
@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86 5.6.7-gnu Kernel Configuration
+# Linux/x86 5.6.13-gnu Kernel Configuration
 #
 
 #
@@ -1133,6 +1133,7 @@ CONFIG_DEFAULT_CUBIC=y
 # CONFIG_DEFAULT_RENO is not set
 CONFIG_DEFAULT_TCP_CONG="cubic"
 CONFIG_TCP_MD5SIG=y
+# CONFIG_TCP_SIMULT_CONNECT_DEFAULT_ON is not set
 CONFIG_IPV6=y
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_IPV6_ROUTE_INFO=y
@@ -9748,7 +9749,7 @@ CONFIG_NFS_V4_SECURITY_LABEL=y
 CONFIG_NFS_FSCACHE=y
 # CONFIG_NFS_USE_LEGACY_DNS is not set
 CONFIG_NFS_USE_KERNEL_DNS=y
-CONFIG_NFS_DISABLE_UDP_SUPPORT=y
+# CONFIG_NFS_DISABLE_UDP_SUPPORT is not set
 CONFIG_NFSD=m
 CONFIG_NFSD_V2_ACL=y
 CONFIG_NFSD_V3=y