For M-profile CPUs, the BXJ instruction does not exist at all, and
the encoding should always UNDEF. We were accidentally implementing
it to behave like A-profile BXJ; correct the error.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index e32e38c..fe3f442 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -10485,7 +10485,12 @@ static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw
                         }
                         break;
                     case 4: /* bxj */
-                        /* Trivial implementation equivalent to bx.  */
+                        /* Trivial implementation equivalent to bx.
+                         * This instruction doesn't exist at all for M-profile.
+                         */
+                        if (arm_dc_feature(s, ARM_FEATURE_M)) {
+                            goto illegal_op;
+                        }
                         tmp = load_reg(s, rn);
                         gen_bx(s, tmp);
                         break;
-- 
2.7.4

On 04/10/2017 07:39 AM, Peter Maydell wrote:
> For M-profile CPUs, the BXJ instruction does not exist at all, and
> the encoding should always UNDEF. We were accidentally implementing
> it to behave like A-profile BXJ; correct the error.
>
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

> ---
>  target/arm/translate.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/target/arm/translate.c b/target/arm/translate.c
> index e32e38c..fe3f442 100644
> --- a/target/arm/translate.c
> +++ b/target/arm/translate.c
> @@ -10485,7 +10485,12 @@ static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw
>                          }
>                          break;
>                      case 4: /* bxj */
> -                        /* Trivial implementation equivalent to bx.  */
> +                        /* Trivial implementation equivalent to bx.
> +                         * This instruction doesn't exist at all for M-profile.
> +                         */
> +                        if (arm_dc_feature(s, ARM_FEATURE_M)) {
> +                            goto illegal_op;
> +                        }
>                          tmp = load_reg(s, rn);
>                          gen_bx(s, tmp);
>                          break;
>