maze stub logs lr/sp to mailbox

qemu/maze.S

@@ -0,0 +1,13 @@
+    .syntax unified
+    .cpu cortex-a7
+    .thumb
+    @ maze entry logger: record lr/sp to mailbox 0x08062200, return 0.
+    .text
+    .global maze_stub
+maze_stub:
+    movw r12, #:lower16:0x08062200
+    movt r12, #:upper16:0x08062200
+    str lr, [r12]
+    str sp, [r12, #4]
+    movs r0, #0
+    bx lr

qemu/saimaa.c

@@ -421,12 +421,27 @@ static void saimaa_machine_init(MachineState *machine)
             uint32_t w;
             uint16_t h0 = 0x2000, h1 = 0x4770; /* movs r0,#0; bx lr */
             uint32_t v;
-            /* pointer maze in owned RAM for SBL1 struct chains */
+            /* pointer maze in owned RAM for SBL1 struct chains.
+             * STUB = mailbox logger + return-0: records lr/sp at entry
+             * to 0x08062200 for post-mortem, then movs r0,#0; bx lr. */
             w = S + 8;
             cpu_physical_memory_write(S, &w, 4);
-            cpu_physical_memory_write(S + 8, &STUBV, 4);
+            cpu_physical_memory_write(S + 8, &STUB, 4);
-            cpu_physical_memory_write(STUB, &h0, 2);
+            {
-            cpu_physical_memory_write(STUB + 2, &h1, 2);
+                /* from qemu/maze.S: movw/movt r12; str lr/sp; movs; bx */
+                static const uint8_t mb[] = {
+                    0x42, 0xf2, 0x00, 0x2c, 0xc0, 0xf6, 0x06, 0x0c,
+                    0xcc, 0xf8, 0x00, 0xe0, 0xcc, 0xf8, 0x04, 0xd0,
+                    0x00, 0x20, 0x70, 0x47,
+                };
+                size_t k;
+                for (k = 0; k < sizeof(mb); k += 4) {
+                    uint32_t word = 0;
+                    size_t n = sizeof(mb) - k < 4 ? sizeof(mb) - k : 4;
+                    __builtin_memcpy(&word, &mb[k], n);
+                    cpu_physical_memory_write(STUB + k, &word, 4);
+                }
+            }
             cpu_physical_memory_write(STUB + 4, &STUBV, 4);
             cpu_physical_memory_write(0x087c29d18, &S, 4);
             cpu_physical_memory_write(0x08050b28, &S, 4);