    return MCDisassembler::Success;
  }
  
-@@ -3271,7 +3321,9 @@
+@@ -3162,10 +3218,25 @@
+ 
+ static DecodeStatus DecodeThumbBLXOffset(llvm::MCInst &Inst, unsigned Val,
+                                  uint64_t Address, const void *Decoder) {
++  // Val is passed in as S:J1:J2:imm10H:imm10L:’0’
++  // Note only one trailing zero not two.  Also the J1 and J2 values are from
++  // the encoded instruction.  So here change to I1 and I2 values via:
++  // I1 = NOT(J1 EOR S);
++  // I2 = NOT(J2 EOR S);
++  // and build the imm32 with two trailing zeros as documented:
++  // imm32 = SignExtend(S:I1:I2:imm10H:imm10L:’00’, 32);
++  unsigned S = (Val >> 23) & 1;
++  unsigned J1 = (Val >> 22) & 1;
++  unsigned J2 = (Val >> 21) & 1;
++  unsigned I1 = !(J1 ^ S);
++  unsigned I2 = !(J2 ^ S);
++  unsigned tmp = (Val & ~0x600000) | (I1 << 22) | (I2 << 21);
++  int imm32 = SignExtend32<25>(tmp << 1);
++
+   if (!tryAddingSymbolicOperand(Address,
+-                                (Address & ~2u) + SignExtend32<22>(Val << 1) + 4,
++                                (Address & ~2u) + imm32 + 4,
+                                 true, 4, Inst, Decoder))
+-    Inst.addOperand(MCOperand::CreateImm(SignExtend32<22>(Val << 1)));
++    Inst.addOperand(MCOperand::CreateImm(imm32));
+   return MCDisassembler::Success;
+ }
+ 
+@@ -3271,15 +3342,32 @@
  static DecodeStatus
  DecodeThumbBCCTargetOperand(llvm::MCInst &Inst, unsigned Val,
                              uint64_t Address, const void *Decoder){

 }
 
 let isNotDuplicable = 1, isIndirectBranch = 1 in {
Index: lib/Target/ARM/Disassembler/ARMDisassembler.cpp
===================================================================
--- lib/Target/ARM/Disassembler/ARMDisassembler.cpp	(revision 152265)

                      []>;
 
 // Vector Move Operations.
Index: lib/Target/ARM/ARMInstrThumb2.td
===================================================================
--- lib/Target/ARM/ARMInstrThumb2.td	(revision 152265)
