diff --git a/gcc/ChangeLog b/gcc/ChangeLog
index 2287ff97ea1fbee32705bca9a9d9972a272007af..67417932afc69b2b3a5138fea1a193948b4816a9 100644
--- a/gcc/ChangeLog
+++ b/gcc/ChangeLog
@@ -1,3 +1,12 @@
+2020-04-29  H.J. Lu  <hongjiu.lu@intel.com>
+
+	PR target/93654
+	* config/i386/i386-options.c (ix86_set_indirect_branch_type):
+	Allow -fcf-protection with -mindirect-branch=thunk-extern and
+	-mfunction-return=thunk-extern.
+	* doc/invoke.texi: Update notes for -fcf-protection=branch with
+	-mindirect-branch=thunk-extern and -mindirect-return=thunk-extern.
+
 2020-04-29  Richard Sandiford  <richard.sandiford@arm.com>
 
 	* doc/sourcebuild.texi: Add missing arm_arch_v8a_hard_ok anchor.
diff --git a/gcc/config/i386/i386-options.c b/gcc/config/i386/i386-options.c
index e0be493253411939843c1f6d1f67c4bf64d27147..5c21fce06a4c2a650293bf8cc970ec7c1a7b5f6a 100644
--- a/gcc/config/i386/i386-options.c
+++ b/gcc/config/i386/i386-options.c
@@ -3083,6 +3083,8 @@ ix86_set_indirect_branch_type (tree fndecl)
 		? "thunk-extern" : "thunk"));
 
       if (cfun->machine->indirect_branch_type != indirect_branch_keep
+	  && (cfun->machine->indirect_branch_type
+	      != indirect_branch_thunk_extern)
 	  && (flag_cf_protection & CF_RETURN))
 	error ("%<-mindirect-branch%> and %<-fcf-protection%> are not "
 	       "compatible");
@@ -3126,6 +3128,8 @@ ix86_set_indirect_branch_type (tree fndecl)
 		? "thunk-extern" : "thunk"));
 
       if (cfun->machine->function_return_type != indirect_branch_keep
+	  && (cfun->machine->function_return_type
+	      != indirect_branch_thunk_extern)
 	  && (flag_cf_protection & CF_RETURN))
 	error ("%<-mfunction-return%> and %<-fcf-protection%> are not "
 	       "compatible");
diff --git a/gcc/doc/invoke.texi b/gcc/doc/invoke.texi
index fed38e88ae55d6d355c0317555803de5ee5c6c5e..5bb7d94833e52ce7023434188fbb9a38da20baaf 100644
--- a/gcc/doc/invoke.texi
+++ b/gcc/doc/invoke.texi
@@ -30097,9 +30097,9 @@ Note that @option{-mcmodel=large} is incompatible with
 @option{-mindirect-branch=thunk-extern} since the thunk function may
 not be reachable in the large code model.
 
-Note that @option{-mindirect-branch=thunk-extern} is incompatible with
-@option{-fcf-protection=branch} since the external thunk cannot be modified
-to disable control-flow check.
+Note that @option{-mindirect-branch=thunk-extern} is compatible with
+@option{-fcf-protection=branch} since the external thunk can be made
+to enable control-flow check.
 
 @item -mfunction-return=@var{choice}
 @opindex mfunction-return
@@ -30112,6 +30112,10 @@ object file.  You can control this behavior for a specific function by
 using the function attribute @code{function_return}.
 @xref{Function Attributes}.
 
+Note that @option{-mindirect-return=thunk-extern} is compatible with
+@option{-fcf-protection=branch} since the external thunk can be made
+to enable control-flow check.
+
 Note that @option{-mcmodel=large} is incompatible with
 @option{-mfunction-return=thunk} and
 @option{-mfunction-return=thunk-extern} since the thunk function may
diff --git a/gcc/testsuite/ChangeLog b/gcc/testsuite/ChangeLog
index b4d1ee2b8c21784a35c658f1abcca49678696fec..b635ce1939d698ac977e8948c0dbd42b7264faa3 100644
--- a/gcc/testsuite/ChangeLog
+++ b/gcc/testsuite/ChangeLog
@@ -1,3 +1,8 @@
+2020-04-29  H.J. Lu  <hongjiu.lu@intel.com>
+
+	PR target/93654
+	* gcc.target/i386/pr93654.c: New test.
+
 2020-04-29  Richard Sandiford  <richard.sandiford@arm.com>
 
 	* lib/target-supports.exp: Add v8a_hard to the list of arm_arch_*
diff --git a/gcc/testsuite/gcc.target/i386/pr93654.c b/gcc/testsuite/gcc.target/i386/pr93654.c
new file mode 100644
index 0000000000000000000000000000000000000000..ec5bdce86a6bfc763cea94f95d00b44a16f9eda1
--- /dev/null
+++ b/gcc/testsuite/gcc.target/i386/pr93654.c
@@ -0,0 +1,9 @@
+/* { dg-do compile } */
+/* { dg-options "-O2 -fcf-protection -mfunction-return=thunk-extern -mindirect-branch=thunk-extern" } */
+
+int
+bar (void (*foo) (void))
+{
+  foo (); 
+  return 0;
+}