calculateManeuvers — ManeuverGeneratorManager::calculateManeuvers

Part of Firmware Reversing.

• Naive symbol-table address: 0x5b9bc0 (VA 0xf6e478b4)
• True prologue start: 0x5b9970 (VA 0xf6e47664)
• Status: 🟡* Partially traced — real call-target evidence confirmed, carefully bounds-checked against a real neighboring function to avoid misattribution (see "A methodological catch" below). Confirmed minimum real size: 0xc00 (3,072) bytes (0x5b9970-0x5ba570, where a genuinely different function's own clean prologue begins) — likely larger still; its own real end was not found. A full line-by-line trace wasn't pursued, see Firmware Reversing.
• Full mangled name: calculateManeuvers__24ManeuverGeneratorManagerP19CfcJourneyInterfaceP17CfcRouteInterfaceP19CfcTypeRouteSectionP9RoutePathP10CfcTypeJobP13RouteManeuver

The real entry point for the maneuver-generator subsystem (the mv_* functions elsewhere on this wiki are its internals).

A methodological catch worth recording

A first wide scan (out to 0x5bb170) found many more plausible call targets, but cross-checking found a real blr at 0x5ba5cc whose epilogue restores only a 0x20-byte frame — NOT this function's own 0x310-byte frame — proving it belongs to a different, small function whose own prologue starts at 0x5ba570. Confirmed directly: scanning 0x5b9970-0x5ba570 finds exactly ONE stwu (this function's own, at the very start), so everything in that range is safely, confidently this function's own body; call targets found past 0x5ba570 were discarded as likely belonging to that other function (itself substantial and real — ReceiveNavGraphSync, addRampSegments on DYNA_SegmentList, UpdateMapPosition, MDCacheWeatherShapes — but out of scope here, not yet given its own page). Recorded as a general lesson: a long scan across a large function can silently cross into a neighbor's body, and the real test is whether an epilogue's frame size matches the function's own prologue, not just "a blr appeared."

Real, confirmed structure

A 0x310 (784)-byte stack frame — a genuinely large function, matching its role as the top-level entry point for the whole subsystem. The traced portion is a real loop over fixed-size, 0x34 (52)-byte route- section entries (mulli r11, r11, 0x34), bounds-checked per iteration against a count read from the route-section array header, consistent with "for each section of the route, build its maneuver(s)".

Real, confirmed call targets (all verified within the safe 0xc00-byte range)

Target	What it suggests
getTypeDescriptor__C28CfcTypeDestinationDescriptor	Real accessor on a CfcTypeDestinationDescriptor — queries the real type/kind of the route's destination early in the loop
clone__C20CfcMsgGenericMessage	Clones a real, generic internal message object (CfcMsgGenericMessage) — this function builds its output as messages, not just a maneuver data structure directly
__nw__27CfcSvcMessageHandlerFactoryUi	Operator new for a real CfcSvcMessageHandlerFactory — confirms a real internal service/message-handler-factory pattern backs maneuver generation
__vd__21CfcUtilRunlevelSwitchPv	Destructor of a real CfcUtilRunlevelSwitch — ties maneuver generation to a real system-runlevel/state-switch utility
__nw__18CfcMediaVoidFutureUi (3 call sites)	Operator new for a real CfcMediaVoidFuture — an asynchronous media-operation future, used repeatedly
releaseSpeller__19LocationManagerImplQ222CfcTypeTranslationType16Translationt	Real accessor on LocationManagerImpl — releases a real spelling/search-input resource, tying maneuver generation to the address-entry/search subsystem
getName__24CfcMsgDirectServicePoint	Real accessor on a direct (non-streamed) service point
addRampSegments__19DYNA_segmentMatcherP17DYNA_locationDatabT2UcT2P16DYNA_SegmentListRUi	Real function on a DYNA_segmentMatcher — adds ramp segments to a DYNA_SegmentList, the SAME dynamic-segment-list class as addSegmentData
sendString__Q24edal18PredStDebuggerImpl	Real debug/diagnostic string-send call on the EDB (edal) layer's own PredStDebuggerImpl
setJunctionId__16CfcTypeNavDBInfoi	Same shared primitive seen throughout the mv_*/ADAS functions
Real type-descriptor symbols (__tf*) for CfcIoCodecFactory, CfcTypeMapTrafficInformation, MDCacheTIIconRTree, CfcTypePossibleLocation	Confirm 4 more real classes touched here — a codec factory, live traffic information, an MDCache icon R-tree, and the same map-matching certainty class seen elsewhere

Net read

Confirms this is the real top-level function that walks the route's section list and, per section, resolves a destination-type descriptor, clones a generic message, and builds it via a message-handler factory — i.e. maneuver generation in this codebase is implemented as message production/dispatch through the same generic Cfc*/JR_* messaging infrastructure used elsewhere (gateway/MOST messaging, journey/route clients), not a standalone geometry-only algorithm. The additional confirmed calls show it also touches dynamic ramp-segment insertion (the same DYNA_* family as addSegmentData), live traffic information, media futures, spelling/search resources, and runlevel switching — a genuinely broad orchestrator, not a narrow geometry routine. The individual mv_* helper functions elsewhere on this wiki are very likely called from deeper inside this same function, not yet confirmed by direct call-site evidence.