sbl b16: banner blx redirected to print stublet 0x8062150

qemu/banner.S

@@ -0,0 +1,18 @@
+    .syntax unified
+    .cpu cortex-a7
+    .thumb
+    @ Banner stub for SBL1 logger call at 0x802f690 (blx r3 patched to bl here).
+    @ r0 = string. Print raw bytes via UARTDM until NUL (cap 256), return 0.
+    .text
+    .global banner_stub
+banner_stub:
+    movw r3, #0xf000
+    movt r3, #0x78a
+bn_loop:
+    ldrb r1, [r0], #1
+    cbz r1, bn_done
+    str r1, [r3, #0x70]
+    b bn_loop
+bn_done:
+    movs r0, #0
+    bx lr

qemu/saimaa.c

@@ -439,6 +439,27 @@ static void saimaa_machine_init(MachineState *machine)
                     cpu_physical_memory_write(0x08062140 + k, &word, 4);
                 }
             }
+            /* Banner stub at 0x08062150: print r0 string via UARTDM
+             * (b16 redirects 0x802f690 blx here). Built from qemu/banner.S */
+            {
+                static const uint8_t bn[] = {
+                    0x4f, 0xf2, 0x00, 0x03, /* movw r3,#0xf000 */
+                    0xc0, 0xf2, 0x8a, 0x73, /* movt r3,#0x78a */
+                    0x10, 0xf8, 0x01, 0x1b, /* ldrb r1,[r0],#1 */
+                    0x09, 0xb1,             /* cbz r1,done */
+                    0x19, 0x67,             /* str r1,[r3,#0x70] */
+                    0xfa, 0xe7,             /* b loop */
+                    0x00, 0x20,             /* movs r0,#0 */
+                    0x70, 0x47,             /* bx lr */
+                };
+                size_t k;
+                for (k = 0; k < sizeof(bn); k += 4) {
+                    uint32_t word = 0;
+                    size_t n = sizeof(bn) - k < 4 ? sizeof(bn) - k : 4;
+                    __builtin_memcpy(&word, &bn[k], n);
+                    cpu_physical_memory_write(0x08062150 + k, &word, 4);
+                }
+            }
             /* stack zone defaults to plain-stub addr: every register
              * popped from untouched stack becomes callable (returns 0). */
             {