<!--This is the upstream QEMU issue tracker. If you are able to, it will greatly facilitate bug triage if you attempt to reproduce the problem with the latest qemu.git master built from source. See https://www.qemu.org/download/#source for instructions on how to do this. QEMU generally supports the last two releases advertised on https://www.qemu.org/. Problems with distro-packaged versions of QEMU older than this should be reported to the distribution instead. See https://www.qemu.org/contribute/report-a-bug/ for additional guidance. If this is a security issue, ensure this ticket is marked 'confidential' before submission. See https://www.qemu.org/contribute/security-process/ for additional guidance--> ## Host environment - Operating system: linux - OS/kernel version: <!--For POSIX hosts, use `uname -a`--> - Architecture: ARM64 - QEMU flavor: qemu-arm - QEMU version: v11.1.0-293-gfa19879df1 - QEMU command line: <!--Give the smallest, complete command line that exhibits the problem. </li> </ul> </li> </ul> </li> </ul> </li> </ul> <p data-sourcepos="40:1-41:62">If you are using libvirt, virsh, or vmm, you can likely find the QEMU command line arguments in /var/log/libvirt/qemu/$GUEST.log.--&gt;</p> <pre data-sourcepos="43:3-45:5"><code>qemu-arm -cpu arm926 ./thumb_single_nop </code></pre> <ul data-sourcepos="48:1-56:5"> <li data-sourcepos="48:1-50:7"> <p data-sourcepos="48:3-48:19">Operating system:</p> <p data-sourcepos="50:3-50:7">linux</p> </li> <li data-sourcepos="51:1-53:42"> <p data-sourcepos="51:3-51:20">OS/kernel version:</p> <!--For POSIX guests, use `uname -a`.--> - Architecture: ARM ## Description of problem ARM926EJ-S is an ARMv5TEJ Thumb-1 core. It should take an undefined-instruction exception for the later 0xbfxx Thumb hint/IT encodings, but QEMU accepts them as valid instructions with -cpu arm926. A test executing exactly one selected Thumb halfword gives: \ `                          QEMU arm926      Real ARM926EJ-S` `0x1c00  Thumb-1 control   exits 0          exits 0` `0xbf00  NOP               exits 0          SIGILL` `0xbf30  WFI.     exits 0          SIGILL` `0xbf10  YIELD             exits 0          SIGILL` `0xbf20  WFE               exits 0          SIGILL` `0xbf40  SEV               exits 0          SIGILL` `0xbf18  IT                exits 0          SIGILL` The hardware results were obtained on a SAM9X75D2G board with ARM926EJ-S. The control instruction confirms that the test reaches and executes Thumb code normally. Disclosure: OpenAI Codex (LLM agent) assisted with investigating the discrepancy and developing the test. Reported QEMU and real-hardware tests were run and verified by me. ## Steps to reproduce 1. Build the attached source: [thumb_single_nop.S](/uploads/78efe0de1da4f244f757615f6b923063/thumb_single_nop.S)   arm-linux-gnueabi-gcc -march=armv5te -nostdlib -static -no-pie \\     -Wl,-e,\_start thumb_single_nop.S -o thumb_single_nop 2. Run an ARMv5TE binary which switches to Thumb state, executes one of the raw halfwords above, switches back, and exits successfully: qemu-arm -cpu arm926 ./thumb_single_nop \ Expected for 0xbf00: SIGILL Actual: normal exit code 0 <!--Note: if this issue was discovered with the assistance of automated tooling LLM, static analysis, fuzzers), the reporter must disclose that in the description. The steps to reproduce, and any other findings, must be fully validated by the user of the tool prior to submission.--> ## Additional information <!--Attach logs, stack traces, screenshots, etc. Compress the files if necessary. If using libvirt, libvirt logs and XML domain information may be relevant. If attaching binary test cases you should describe where they were obtained from, preferably linking to the original source. We greatly prefer test cases in the form of source code that can be audited before compiling by the engineer.--> <!--The line below ensures that proper tags are added to the issue. Please do not remove it.-->