diff --git a/qemu/aarch64.h b/qemu/aarch64.h
index 22a06c32..21300719 100644
--- a/qemu/aarch64.h
+++ b/qemu/aarch64.h
@@ -4255,6 +4255,7 @@
 #define new_tmp_a64 new_tmp_a64_aarch64
 #define new_tmp_a64_zero new_tmp_a64_zero_aarch64
 #define pred_esz_masks pred_esz_masks_aarch64
+#define raise_exception raise_exception_aarch64
 #define read_cpu_reg read_cpu_reg_aarch64
 #define read_cpu_reg_sp read_cpu_reg_sp_aarch64
 #define sve_access_check sve_access_check_aarch64
diff --git a/qemu/aarch64eb.h b/qemu/aarch64eb.h
index b7edcf40..04ba3974 100644
--- a/qemu/aarch64eb.h
+++ b/qemu/aarch64eb.h
@@ -4255,6 +4255,7 @@
 #define new_tmp_a64 new_tmp_a64_aarch64eb
 #define new_tmp_a64_zero new_tmp_a64_zero_aarch64eb
 #define pred_esz_masks pred_esz_masks_aarch64eb
+#define raise_exception raise_exception_aarch64eb
 #define read_cpu_reg read_cpu_reg_aarch64eb
 #define read_cpu_reg_sp read_cpu_reg_sp_aarch64eb
 #define sve_access_check sve_access_check_aarch64eb
diff --git a/qemu/arm.h b/qemu/arm.h
index 6a0a2808..08683eb3 100644
--- a/qemu/arm.h
+++ b/qemu/arm.h
@@ -3276,6 +3276,7 @@
 #define arm_set_cpu_off arm_set_cpu_off_arm
 #define arm_set_cpu_on arm_set_cpu_on_arm
 #define fp_exception_el fp_exception_el_arm
+#define raise_exception raise_exception_arm
 #define sve_exception_el sve_exception_el_arm
 #define sve_zcr_len_for_el sve_zcr_len_for_el_arm
 #endif
diff --git a/qemu/armeb.h b/qemu/armeb.h
index 815dae32..c8ad828f 100644
--- a/qemu/armeb.h
+++ b/qemu/armeb.h
@@ -3276,6 +3276,7 @@
 #define arm_set_cpu_off arm_set_cpu_off_armeb
 #define arm_set_cpu_on arm_set_cpu_on_armeb
 #define fp_exception_el fp_exception_el_armeb
+#define raise_exception raise_exception_armeb
 #define sve_exception_el sve_exception_el_armeb
 #define sve_zcr_len_for_el sve_zcr_len_for_el_armeb
 #endif
diff --git a/qemu/header_gen.py b/qemu/header_gen.py
index 539b5742..56e68be1 100644
--- a/qemu/header_gen.py
+++ b/qemu/header_gen.py
@@ -3285,6 +3285,7 @@ arm_symbols = (
     'arm_set_cpu_off',
     'arm_set_cpu_on',
     'fp_exception_el',
+    'raise_exception',
     'sve_exception_el',
     'sve_zcr_len_for_el',
 )
@@ -4279,6 +4280,7 @@ aarch64_symbols = (
     'new_tmp_a64',
     'new_tmp_a64_zero',
     'pred_esz_masks',
+    'raise_exception',
     'read_cpu_reg',
     'read_cpu_reg_sp',
     'sve_access_check',
diff --git a/qemu/target/arm/helper.c b/qemu/target/arm/helper.c
index e8d46adb..b22d9bd5 100644
--- a/qemu/target/arm/helper.c
+++ b/qemu/target/arm/helper.c
@@ -5925,6 +5925,10 @@ void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest)
                       "BLXNS with misaligned SP is UNPREDICTABLE\n");
     }
 
+    if (sp < v7m_sp_limit(env)) {
+        raise_exception(env, EXCP_STKOF, 0, 1);
+    }
+
     saved_psr = env->v7m.exception;
     if (env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK) {
         saved_psr |= XPSR_SFPA;
diff --git a/qemu/target/arm/internals.h b/qemu/target/arm/internals.h
index 2a23c5e6..320a96eb 100644
--- a/qemu/target/arm/internals.h
+++ b/qemu/target/arm/internals.h
@@ -94,6 +94,15 @@ FIELD(V7M_EXCRET, RES1, 7, 25) /* including the must-be-1 prefix */
 #define M_FAKE_FSR_NSC_EXEC 0xf /* NS executing in S&NSC memory */
 #define M_FAKE_FSR_SFAULT 0xe /* SecureFault INVTRAN, INVEP or AUVIOL */
 
+/**
+ * raise_exception: Raise the specified exception.
+ * Raise a guest exception with the specified value, syndrome register
+ * and target exception level. This should be called from helper functions,
+ * and never returns because we will longjump back up to the CPU main loop.
+ */
+void QEMU_NORETURN raise_exception(CPUARMState *env, uint32_t excp,
+                                   uint32_t syndrome, uint32_t target_el);
+
 /*
  * For AArch64, map a given EL to an index in the banked_spsr array.
  * Note that this mapping and the AArch32 mapping defined in bank_number()
diff --git a/qemu/target/arm/op_helper.c b/qemu/target/arm/op_helper.c
index 2b0ff5f2..6b260dfe 100644
--- a/qemu/target/arm/op_helper.c
+++ b/qemu/target/arm/op_helper.c
@@ -27,8 +27,8 @@
 #define SIGNBIT (uint32_t)0x80000000
 #define SIGNBIT64 ((uint64_t)1 << 63)
 
-static void raise_exception(CPUARMState *env, uint32_t excp,
-                            uint32_t syndrome, uint32_t target_el)
+void raise_exception(CPUARMState *env, uint32_t excp,
+                     uint32_t syndrome, uint32_t target_el)
 {
     CPUState *cs = CPU(arm_env_get_cpu(env));