diff --git a/gdb/ChangeLog b/gdb/ChangeLog
index 15d81577cfb..1f297ff9f73 100644
--- a/gdb/ChangeLog
+++ b/gdb/ChangeLog
@@ -1,3 +1,8 @@
+2016-02-12  Yao Qi  <yao.qi@linaro.org>
+
+	* arch/arm-linux.c (arm_linux_get_next_pcs_fixup): Calculate
+	nextpc according to instruction.
+
 2016-02-12  Yao Qi  <yao.qi@linaro.org>
 
 	* arch/arm-get-next-pcs.c (arm_get_next_pcs): Call
diff --git a/gdb/arch/arm-linux.c b/gdb/arch/arm-linux.c
index 457080c27ff..7e240fe7a6a 100644
--- a/gdb/arch/arm-linux.c
+++ b/gdb/arch/arm-linux.c
@@ -68,10 +68,72 @@ arm_linux_get_next_pcs_fixup (struct arm_get_next_pcs *self,
   /* The Linux kernel offers some user-mode helpers in a high page.  We can
      not read this page (as of 2.6.23), and even if we could then we
      couldn't set breakpoints in it, and even if we could then the atomic
-     operations would fail when interrupted.  They are all called as
-     functions and return to the address in LR, so step to there
-     instead.  */
+     operations would fail when interrupted.  They are all (tail) called
+     as functions and return to the address in LR.  However, when GDB single
+     step this instruction, this instruction isn't executed yet, and LR
+     may not be updated yet.  In other words, GDB can get the target
+     address from LR if this instruction isn't BL or BLX.  */
   if (nextpc > 0xffff0000)
-    nextpc = regcache_raw_get_unsigned (self->regcache, ARM_LR_REGNUM);
+    {
+      int bl_blx_p = 0;
+      CORE_ADDR pc = regcache_read_pc (self->regcache);
+      int pc_incr = 0;
+
+      if (self->ops->is_thumb (self))
+	{
+	  unsigned short inst1
+	    = self->ops->read_mem_uint (pc, 2, self->byte_order_for_code);
+
+	  if (bits (inst1, 8, 15) == 0x47 && bit (inst1, 7))
+	    {
+	      /* BLX Rm */
+	      bl_blx_p = 1;
+	      pc_incr = 2;
+	    }
+	  else if (thumb_insn_size (inst1) == 4)
+	    {
+	      unsigned short inst2;
+
+	      inst2 = self->ops->read_mem_uint (pc + 2, 2,
+						self->byte_order_for_code);
+
+	      if ((inst1 & 0xf800) == 0xf000 && bits (inst2, 14, 15) == 0x3)
+		{
+		  /* BL <label> and BLX <label> */
+		  bl_blx_p = 1;
+		  pc_incr = 4;
+		}
+	    }
+
+	  pc_incr = MAKE_THUMB_ADDR (pc_incr);
+	}
+      else
+	{
+	  unsigned int insn
+	    = self->ops->read_mem_uint (pc, 4, self->byte_order_for_code);
+
+	  if (bits (insn, 28, 31) == INST_NV)
+	    {
+	      if (bits (insn, 25, 27) == 0x5) /* BLX <label> */
+		bl_blx_p = 1;
+	    }
+	  else
+	    {
+	      if (bits (insn, 24, 27) == 0xb  /* BL <label> */
+		  || bits (insn, 4, 27) == 0x12fff3 /* BLX Rm */)
+		bl_blx_p = 1;
+	    }
+
+	  pc_incr = 4;
+	}
+
+      /* If the instruction BL or BLX, the target address is the following
+	 instruction of BL or BLX, otherwise, the target address is in LR
+	 already.  */
+      if (bl_blx_p)
+	nextpc = pc + pc_incr;
+      else
+	nextpc = regcache_raw_get_unsigned (self->regcache, ARM_LR_REGNUM);
+    }
   return nextpc;
 }
diff --git a/gdb/testsuite/ChangeLog b/gdb/testsuite/ChangeLog
index 63d47cd4807..599119cb128 100644
--- a/gdb/testsuite/ChangeLog
+++ b/gdb/testsuite/ChangeLog
@@ -1,3 +1,8 @@
+2016-02-12  Yao Qi  <yao.qi@linaro.org>
+
+	* gdb.arch/arm-single-step-kernel-helper.c: New.
+	* gdb.arch/arm-single-step-kernel-helper.exp: New.
+
 2016-02-12  Markus Metzger  <markus.t.metzger@intel.com>
 
 	* gdb.btrace/tailcall-only.exp: New.
diff --git a/gdb/testsuite/gdb.arch/arm-single-step-kernel-helper.c b/gdb/testsuite/gdb.arch/arm-single-step-kernel-helper.c
new file mode 100644
index 00000000000..e941868d768
--- /dev/null
+++ b/gdb/testsuite/gdb.arch/arm-single-step-kernel-helper.c
@@ -0,0 +1,30 @@
+/* This testcase is part of GDB, the GNU debugger.
+
+   Copyright 2016 Free Software Foundation, Inc.
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
+
+static int *kernel_user_helper_version = (int *) 0xffff0ffc;
+
+typedef void * (kernel_user_func_t)(void);
+#define kernel_user_get_tls (*(kernel_user_func_t *) 0xffff0fe0)
+
+int
+main (void)
+{
+  int i;
+
+  for (i = 0; i < 8; i++)
+    kernel_user_get_tls ();
+}
diff --git a/gdb/testsuite/gdb.arch/arm-single-step-kernel-helper.exp b/gdb/testsuite/gdb.arch/arm-single-step-kernel-helper.exp
new file mode 100644
index 00000000000..1e7e5d4306b
--- /dev/null
+++ b/gdb/testsuite/gdb.arch/arm-single-step-kernel-helper.exp
@@ -0,0 +1,97 @@
+# Copyright (C) 2016 Free Software Foundation, Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+if { ![is_aarch32_target] } {
+    verbose "Skipping ${gdb_test_file_name}."
+    return
+}
+
+standard_testfile
+
+if { [prepare_for_testing ${testfile}.exp ${testfile} ${srcfile} \
+    [list debug]] } {
+    return -1
+}
+
+if { ![runto_main] } {
+    return -1
+}
+
+# Check kernel helpers are supported or not.
+
+set kernel_helper_supported 0
+gdb_test_multiple "p *kernel_user_helper_version" \
+    "check kernel helper version" {
+	-re " = ($decimal)\r\n$gdb_prompt $" {
+	    if { $expect_out(1,string) >= 1 } {
+		set kernel_helper_supported 1
+	    }
+	}
+    }
+
+if { !$kernel_helper_supported } {
+    unsupported "kernel doesn't have helpers"
+    return 0
+}
+
+# Get the instruction branching to kernel helper, they can be
+# blx rN or bx rN.
+set branch_to_kernel_helper 0
+set branch_insn "bl?x\[ \t\]*r${decimal}"
+set test "disassemble main"
+gdb_test_multiple $test $test {
+    -re ".*($hex) <\\+$decimal>:\[ \t\]+$branch_insn" {
+	set branch_to_kernel_helper $expect_out(1,string)
+	exp_continue
+    }
+    -re ".*$gdb_prompt $" {
+    }
+}
+
+if { ![gdb_assert $branch_to_kernel_helper \
+	   "find instruction branch to kernel helper"] } {
+    return
+}
+
+with_test_prefix "single-step" {
+    gdb_breakpoint "*${branch_to_kernel_helper}"
+    gdb_continue_to_breakpoint "branch to kernel helper"
+    gdb_test "si"
+
+    set test "bt"
+    gdb_test_multiple $test $test {
+	-re "#0  \[^\\r\\n\]*main .*\r\n$gdb_prompt $" {
+	    # Test that the program still stops in main rather than
+	    # somewhere else.
+	    pass $test
+	}
+	-re "#0  0xffff0fe0 .*\r\n$gdb_prompt $" {
+	    # AArch64 linux kernel can do hardware single step, so
+	    # the program can stop at kernel helper.
+	    pass $test
+	}
+
+    }
+
+    delete_breakpoints
+}
+
+with_test_prefix "cond-breakpoint" {
+    gdb_breakpoint "*${branch_to_kernel_helper} if i > 5"
+    gdb_continue_to_breakpoint "branch to kernel helper"
+    gdb_test "p i" " = 6"
+
+    delete_breakpoints
+}