sbl b14: S6 pop redirected to stublet 0x8062140 (was null-sled)

qemu/s6stub.S

@@ -0,0 +1,13 @@
+    .syntax unified
+    .cpu cortex-a7
+    .thumb
+    @ S6: compensation for ldmia.w sp!,{r2-r9,sl,pc} at 0x8017afc
+    @ (pc slot gets clobbered to 0 at runtime). Rebuild frame regs
+    @ from stack, return to caller 0x8013ba5.
+    .text
+    .global s6_stub
+s6_stub:
+    ldmia.w sp!, {r2-r9, sl, lr}
+    movw lr, #:lower16:0x8013ba5
+    movt lr, #:upper16:0x8013ba5
+    bx lr

qemu/saimaa.c

@@ -422,6 +422,23 @@ static void saimaa_machine_init(MachineState *machine)
             cpu_physical_memory_write(0x087c29d18, &S, 4);
             cpu_physical_memory_write(0x08050b28, &S, 4);
             cpu_physical_memory_write(0x08070000, &S, 4);
+            /* S6 stublet at 0x08062140: rebuild popped frame regs,
+             * return to 0x8013ba5 (b14 redirects 0x8017afc pop here) */
+            {
+                static const uint8_t s6[] = {
+                    0xbd, 0xe8, 0xfc, 0x47, /* ldmia.w sp!,{r2-r9,sl,lr} */
+                    0x43, 0xf6, 0xa5, 0x3e, /* movw lr,#0x3ba5 */
+                    0xc0, 0xf6, 0x01, 0x0e, /* movt lr,#0x801 */
+                    0x70, 0x47,             /* bx lr */
+                };
+                size_t k;
+                for (k = 0; k < sizeof(s6); k += 4) {
+                    uint32_t word = 0;
+                    size_t n = sizeof(s6) - k < 4 ? sizeof(s6) - k : 4;
+                    __builtin_memcpy(&word, &s6[k], n);
+                    cpu_physical_memory_write(0x08062140 + k, &word, 4);
+                }
+            }
             /* stack zone defaults to plain-stub addr: every register
              * popped from untouched stack becomes callable (returns 0). */
             {