"""Who touches SMN 0x215C0 / 0x2161C, and does anything READ them after boot?

Previous owner() lookups in this project were buggy (they returned the last function
whose start <= va, ignoring the end, or required the literal to be strictly inside the
function). Literal pools usually sit just past a function's code, so this version
reports the nearest PRECEDING function start plus the distance, and flags whether the
literal is inside the function's [start,end) range.
"""
import struct, json, sys

BASE = '/Users/user/dev/amd-psp-re/psp_out/handover/'
MODS = ('sos', 'sys_drv', 'asd', 'hdcp', 'dtm', 'ras')
TARGETS = [0x215C0, 0x2161C]
WINDOW = (0x21500, 0x21B78)

def load(mod):
    raw = open(BASE + 'elf/%s2.elf' % mod, 'rb').read()
    ph = struct.unpack('<I', raw[28:32])[0]
    o, v, pa, f = struct.unpack('<IIII', raw[ph+4:ph+20])
    d = json.load(open(BASE + 'symbols/%s.json' % mod))
    funcs = sorted((int(k, 16), val) for k, val in d['functions'].items())
    return raw[o:o+f], v, funcs

def owner(funcs, va):
    lo, hi = 0, len(funcs)
    while lo < hi:
        mid = (lo + hi) // 2
        if funcs[mid][0] <= va: lo = mid + 1
        else: hi = mid
    if lo == 0: return None, None, None
    fa, fv = funcs[lo-1]
    inside = va < fv.get('end', fa)
    return fv['name'], va - fa, inside

print("=== exact-literal references ===")
for mod in MODS:
    body, v, funcs = load(mod)
    for i in range(0, len(body)-4, 4):
        w = struct.unpack('<I', body[i:i+4])[0]
        if w in TARGETS:
            nm, off, inside = owner(funcs, v+i)
            print("  %-8s %#010x at %#08x  -> %s (+%#x, inside=%s)"
                  % (mod, w, v+i, nm, off or 0, inside))

print("\n=== ANY literal inside the Route C window, all modules ===")
for mod in MODS:
    body, v, funcs = load(mod)
    hits = []
    for i in range(0, len(body)-4, 4):
        w = struct.unpack('<I', body[i:i+4])[0]
        if WINDOW[0] <= w <= WINDOW[1]:
            nm, off, inside = owner(funcs, v+i)
            hits.append((w, v+i, nm, inside))
    print("  %-8s : %d" % (mod, len(hits)))
    for w, at, nm, inside in hits:
        print("      %#08x at %#08x -> %s (inside=%s)" % (w, at, nm, inside))