The BLX immediate insn in the Thumb encoding always performs a switch from Thumb to Arm state. This would be totally useless in M-profile which has no Arm decoder, and so the instruction does not exist at all there. Make the encoding UNDEF for M-profile.
(This part of the encoding space is used for the branch-future and low-overhead-loop insns in v8.1M.) Reviewed-by: Richard Henderson <richard.hender...@linaro.org> Signed-off-by: Peter Maydell <peter.mayd...@linaro.org> --- target/arm/translate.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/target/arm/translate.c b/target/arm/translate.c index c145775438e..613bc0b9f1e 100644 --- a/target/arm/translate.c +++ b/target/arm/translate.c @@ -7880,6 +7880,14 @@ static bool trans_BLX_i(DisasContext *s, arg_BLX_i *a) { TCGv_i32 tmp; + /* + * BLX <imm> would be useless on M-profile; the encoding space + * is used for other insns from v8.1M onward, and UNDEFs before that. + */ + if (arm_dc_feature(s, ARM_FEATURE_M)) { + return false; + } + /* For A32, ARM_FEATURE_V5 is checked near the start of the uncond block. */ if (s->thumb && (a->imm & 2)) { return false; -- 2.20.1