We get the correct instruction from *(unsigned int*)(va_to_pa(_state->ip))=e5930080.
The issue was wrong instruction decoding at http://armconverter.com/hextoarm/. e5930080 gave (1) in ARMv7 ARM mode ANDHI SB, R0, R5, ROR #7 , and (2) in ARMv7 Thumb mode 0xE5930080: STR R3, [SP, #0x394] 0xE5930082: STRH R0, [R0]
Decoding by hand using encoding rules at "ARM® Architecture Reference Manual - ARMv7-A and ARMv7-R edition" gives ldr r0, [r3,#128] in ARMv7 ARM mode.
This should be the mode as va_to_pa(_state->ip) is an even address. r3(53fbc000)+128 exactly matches the DFAR(53fbc080) and ldr matches the dfsr error that "read" gave "AXI Slave error" causing "precise external abort, nontranslation".
https://github.com/jbremer/darm gives the correct decoding. We have ported this to genode, to have inline decoding of faulting instruction and are able to emulate the decoded instruction.
Thanks Stefan for your patient and constant help.
Riju