diff --git a/ChangeLog b/ChangeLog
-index cb9124e..3e1d770 100644
+index cb9124e..9740c89 100644
--- a/ChangeLog
+++ b/ChangeLog
-@@ -1,3 +1,271 @@
+@@ -1,3 +1,296 @@
++2015-10-27 Ludovic Courtès <ludo@gnu.org>
++
++ * locale/loadlocale.c (_nl_intern_locale_data): Change assertion
++ on CNT to a conditional jump to 'puntdata'.
++
++2015-08-18 Alan Modra <amodra@gmail.com>
++
++ [BZ #18421]
++ * sysdeps/hppa/start.S [SHARED]: Use .section .data.rel.ro and define
++ .Lp__global.
++ (_start): Load %dp via .Lp__global.
++ [!SHARED]: Use .section .rodata.
++
++2015-08-09 John David Anglin <danglin@gcc.gnu.org>
++
++ [BZ #18480]
++ * sysdeps/unix/sysv/linux/hppa/sysdep.h (LOAD_ARGS_0, LOAD_ARGS_1,
++ LOAD_ARGS_2, LOAD_ARGS_3, LOAD_ARGS_4, LOAD_ARGS_5, LOAD_ARGS_6):
++ Define.
++ (LOAD_REGS_0, LOAD_REGS_1, LOAD_REGS_2, LOAD_REGS_3, LOAD_REGS_4,
++ LOAD_REGS_5, LOAD_REGS_6): Update.
++ (INTERNAL_SYSCALL): Update using new LOAD defines.
++ (INTERNAL_SYSCALL_NCS): Likewise.
++ * sysdeps/unix/sysv/linux/hppa/syscall.c (syscall): Likewise.
++
+2015-09-26 Paul Pluzhnikov <ppluzhnikov@google.com>
+
+ [BZ #18985]
* version.h (RELEASE): Set to "stable".
diff --git a/NEWS b/NEWS
-index 4c31de7..5a1ebdc 100644
+index 4c31de7..99e68d2 100644
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,16 @@ See the end for copying conditions.
+
+* The following bugs are resolved with this release:
+
-+ 17905, 18589, 18743, 18778, 18781, 18787, 18796, 18870, 18887, 18921,
-+ 18928, 18969, 18985, 19018, 19058, 19174, 19178.
++ 17905, 18421, 18480, 18589, 18743, 18778, 18781, 18787, 18796, 18870,
++ 18887, 18921, 18928, 18969, 18985, 19018, 19058, 19174, 19178.
+
+* The LD_POINTER_GUARD environment variable can no longer be used to
+ disable the pointer guard feature. It is always enabled.
_NL_NUM_LC_COLLATE,
/* LC_CTYPE category: character classification.
+diff --git a/locale/loadlocale.c b/locale/loadlocale.c
+index fdba6e9..dcbb833 100644
+--- a/locale/loadlocale.c
++++ b/locale/loadlocale.c
+@@ -121,9 +121,10 @@ _nl_intern_locale_data (int category, const void *data, size_t datasize)
+ switch (category)
+ {
+ #define CATTEST(cat) \
+- case LC_##cat: \
+- assert (cnt < (sizeof (_nl_value_type_LC_##cat) \
+- / sizeof (_nl_value_type_LC_##cat[0]))); \
++ case LC_##cat: \
++ if (cnt >= (sizeof (_nl_value_type_LC_##cat) \
++ / sizeof (_nl_value_type_LC_##cat[0]))) \
++ goto puntdata; \
+ break
+ CATTEST (NUMERIC);
+ CATTEST (TIME);
diff --git a/locale/localeinfo.h b/locale/localeinfo.h
index bdab9fe..1d2ee00 100644
--- a/locale/localeinfo.h
return (void *) value;
}
+rtld_hidden_def (_dl_symbol_address)
+diff --git a/sysdeps/hppa/start.S b/sysdeps/hppa/start.S
+index 64d8c3e..cc4f243 100644
+--- a/sysdeps/hppa/start.S
++++ b/sysdeps/hppa/start.S
+@@ -42,7 +42,11 @@
+ /* Have the linker create plabel words so we get PLABEL32
+ relocs and not 21/14. The use of 21/14 relocs is only
+ supported in the latest dynamic linker. */
+- .section .rodata
++#ifdef SHARED
++ .section .data.rel.ro,"aw",@progbits
++#else
++ .section .rodata,"a",@progbits
++#endif
+ .align 4
+ .Lpmain:
+ .word P%main
+@@ -52,6 +56,10 @@
+ .word P%__libc_csu_fini
+ .Lp__libc_csu_init:
+ .word P%__libc_csu_init
++#ifdef SHARED
++.Lp__global:
++ .word $global$
++#endif
+
+ .text
+ .align 4
+@@ -122,10 +130,14 @@ _start:
+ /* void *stack_end (7th argument) */
+ stw %sp, -60(%sp)
+
++#ifdef SHARED
++ addil LT'.Lp__global, %r19
++ ldw RT'.Lp__global(%r1), %dp
++#else
+ /* load global */
+ ldil L%$global$, %dp
+ ldo R%$global$(%dp), %dp
+-
++#endif
+ bl __libc_start_main,%r2
+ nop
+ /* die horribly if it returned (it shouldn't) */
diff --git a/sysdeps/nacl/Makefile b/sysdeps/nacl/Makefile
index 6749a44..1748886 100644
--- a/sysdeps/nacl/Makefile
GLIBC_2.3
GLIBC_2.3 A
__ctype_b_loc F
+diff --git a/sysdeps/unix/sysv/linux/hppa/syscall.c b/sysdeps/unix/sysv/linux/hppa/syscall.c
+index aff67a8..958fa47 100644
+--- a/sysdeps/unix/sysv/linux/hppa/syscall.c
++++ b/sysdeps/unix/sysv/linux/hppa/syscall.c
+@@ -43,9 +43,10 @@ syscall (long int __sysno, ...)
+ va_end (args);
+
+ {
++ LOAD_ARGS_6 (arg0, arg1, arg2, arg3, arg4, arg5)
+ register unsigned long int __res asm("r28");
+ PIC_REG_DEF
+- LOAD_ARGS_6 (arg0, arg1, arg2, arg3, arg4, arg5)
++ LOAD_REGS_6
+ asm volatile (SAVE_ASM_PIC
+ " ble 0x100(%%sr2, %%r0) \n"
+ " copy %1, %%r20 \n"
+diff --git a/sysdeps/unix/sysv/linux/hppa/sysdep.h b/sysdeps/unix/sysv/linux/hppa/sysdep.h
+index d20a04b..cb1f163 100644
+--- a/sysdeps/unix/sysv/linux/hppa/sysdep.h
++++ b/sysdeps/unix/sysv/linux/hppa/sysdep.h
+@@ -400,9 +400,10 @@ L(pre_end): ASM_LINE_SEP \
+ ({ \
+ long __sys_res; \
+ { \
++ LOAD_ARGS_##nr(args) \
+ register unsigned long __res asm("r28"); \
+ PIC_REG_DEF \
+- LOAD_ARGS_##nr(args) \
++ LOAD_REGS_##nr \
+ /* FIXME: HACK save/load r19 around syscall */ \
+ asm volatile( \
+ SAVE_ASM_PIC \
+@@ -425,9 +426,10 @@ L(pre_end): ASM_LINE_SEP \
+ ({ \
+ long __sys_res; \
+ { \
++ LOAD_ARGS_##nr(args) \
+ register unsigned long __res asm("r28"); \
+ PIC_REG_DEF \
+- LOAD_ARGS_##nr(args) \
++ LOAD_REGS_##nr \
+ /* FIXME: HACK save/load r19 around syscall */ \
+ asm volatile( \
+ SAVE_ASM_PIC \
+@@ -443,27 +445,44 @@ L(pre_end): ASM_LINE_SEP \
+ __sys_res; \
+ })
+
+-
+-
+ #define LOAD_ARGS_0()
+-#define LOAD_ARGS_1(r26) \
+- register unsigned long __r26 __asm__("r26") = (unsigned long)(r26); \
++#define LOAD_REGS_0
++#define LOAD_ARGS_1(a1) \
++ register unsigned long __x26 = (unsigned long)(a1); \
+ LOAD_ARGS_0()
+-#define LOAD_ARGS_2(r26,r25) \
+- register unsigned long __r25 __asm__("r25") = (unsigned long)(r25); \
+- LOAD_ARGS_1(r26)
+-#define LOAD_ARGS_3(r26,r25,r24) \
+- register unsigned long __r24 __asm__("r24") = (unsigned long)(r24); \
+- LOAD_ARGS_2(r26,r25)
+-#define LOAD_ARGS_4(r26,r25,r24,r23) \
+- register unsigned long __r23 __asm__("r23") = (unsigned long)(r23); \
+- LOAD_ARGS_3(r26,r25,r24)
+-#define LOAD_ARGS_5(r26,r25,r24,r23,r22) \
+- register unsigned long __r22 __asm__("r22") = (unsigned long)(r22); \
+- LOAD_ARGS_4(r26,r25,r24,r23)
+-#define LOAD_ARGS_6(r26,r25,r24,r23,r22,r21) \
+- register unsigned long __r21 __asm__("r21") = (unsigned long)(r21); \
+- LOAD_ARGS_5(r26,r25,r24,r23,r22)
++#define LOAD_REGS_1 \
++ register unsigned long __r26 __asm__("r26") = __x26; \
++ LOAD_REGS_0
++#define LOAD_ARGS_2(a1,a2) \
++ register unsigned long __x25 = (unsigned long)(a2); \
++ LOAD_ARGS_1(a1)
++#define LOAD_REGS_2 \
++ register unsigned long __r25 __asm__("r25") = __x25; \
++ LOAD_REGS_1
++#define LOAD_ARGS_3(a1,a2,a3) \
++ register unsigned long __x24 = (unsigned long)(a3); \
++ LOAD_ARGS_2(a1,a2)
++#define LOAD_REGS_3 \
++ register unsigned long __r24 __asm__("r24") = __x24; \
++ LOAD_REGS_2
++#define LOAD_ARGS_4(a1,a2,a3,a4) \
++ register unsigned long __x23 = (unsigned long)(a4); \
++ LOAD_ARGS_3(a1,a2,a3)
++#define LOAD_REGS_4 \
++ register unsigned long __r23 __asm__("r23") = __x23; \
++ LOAD_REGS_3
++#define LOAD_ARGS_5(a1,a2,a3,a4,a5) \
++ register unsigned long __x22 = (unsigned long)(a5); \
++ LOAD_ARGS_4(a1,a2,a3,a4)
++#define LOAD_REGS_5 \
++ register unsigned long __r22 __asm__("r22") = __x22; \
++ LOAD_REGS_4
++#define LOAD_ARGS_6(a1,a2,a3,a4,a5,a6) \
++ register unsigned long __x21 = (unsigned long)(a6); \
++ LOAD_ARGS_5(a1,a2,a3,a4,a5)
++#define LOAD_REGS_6 \
++ register unsigned long __r21 __asm__("r21") = __x21; \
++ LOAD_REGS_5
+
+ /* Even with zero args we use r20 for the syscall number */
+ #define ASM_ARGS_0
diff --git a/sysdeps/unix/sysv/linux/microblaze/sysdep.h b/sysdeps/unix/sysv/linux/microblaze/sysdep.h
index 83c0340..9d5c542 100644
--- a/sysdeps/unix/sysv/linux/microblaze/sysdep.h