instruction: 0.919 runtime: 0.057 syscall: 0.024 UNDEFINED case for instruction BLX Hi I refer to the instruction BLX imm (T2 encoding) in ARMv7 (Thumb mode). 11110 S imm10H 11 J1 0 J2 imm10L H if H == '1' then UNDEFINED; I1 = NOT(J1 EOR S); I2 = NOT(J2 EOR S); imm32 = SignExtend(S:I1:I2:imm10H:imm10L:'00', 32); targetInstrSet = InstrSet_A32; if InITBlock() && !LastInITBlock() then UNPREDICTABLE; According to the manual, if H equals to 1, this instruction should be an UNDEFINED instruction. However, it seems QEMU does not check this constraint in function trans_BLX_i. Thanks Regards Muhui