fingerprintd/implementations/main.cpp

// SPDX-License-Identifier: GPL-3.0-only
// SPDX-FileCopyrightText: Copyright (C) 2026 Catcrafts®

// lint-disable-file fixed-width-types
// lint-disable-file no-char-pointer
/*
fingerprintd — the daemon shell.

Everything that touches hardware lives here; the decisions live in
fingerprintd-core, which is tested without a phone. Right now this reaches QTEE
and stops: root object, credentials, client env, the QSEECOM-compat loader.
Enough to prove the transport, not yet to drive the sensor.

Why the process must be long-lived, once it does more: a listener registration
is held for as long as the process lives and QTEE's listener table is global to
the boot, and one sensor reset buys exactly one trustlet init. So the process
that powers the sensor has to be the process that holds the session.
*/
// libqcomtee is a C library and its headers carry no extern "C" guard -- it
// has only ever been consumed from C. Without one every symbol would be
// C++-mangled and none would link.
//
// The headers pull in <stdarg.h>, <stdatomic.h> and <stdio.h>, and under
// libc++ those drag in C++ templates, which may not appear inside an
// extern "C" block. Including them first makes the nested includes no-ops.
#include <stdarg.h>
#include <stdio.h>
#include <stdatomic.h>
extern "C" {
#include <qcomtee_object.h>
#include <qcomtee_object_types.h>
#include <qcomtee_errno.h>
}

#include <linux/gpio.h>
#include <pthread.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <sys/time.h>
#include <unistd.h>
#include <errno.h>
#include <string.h>
#include <stdarg.h>

import std;
import Fingerprintd;

namespace {

constexpr const char* Version = "0.0.3";

bool g_verbose = false;
std::string g_taPath = "/lib/firmware/focal64.mbn";
std::string g_cfgPath = "/lib/firmware/fingerprintd.json";

qcomtee_object* g_root = QCOMTEE_OBJECT_NULL;

// The ioctl trampoline libqcomtee calls. Cancellation is made asynchronous
// around it so the supplicant thread can be stopped while blocked in the
// kernel waiting for QTEE.
//
// tee_call_t's second parameter is `unsigned long` on glibc and `int` on musl
// (qcomtee_object.h keys it off __GLIBC__), so the signature has to match or
// the function pointer will not convert. The native build is glibc and the
// phone is musl, so both forms are compiled here.
#ifdef __GLIBC__
int TeeCall(int fd, unsigned long op, ...) {
#else
int TeeCall(int fd, int op, ...) {
#endif
    va_list ap;
    va_start(ap, op);
    void* arg = va_arg(ap, void*);
    va_end(ap);
    pthread_setcanceltype(PTHREAD_CANCEL_ASYNCHRONOUS, nullptr);
    int ret = ::ioctl(fd, static_cast<unsigned long>(op), arg);
    pthread_setcanceltype(PTHREAD_CANCEL_DEFERRED, nullptr);
    return ret;
}

// QTEE's callbacks are serviced here. Nothing QTEE asks of us happens without
// this running.
void* Supplicant(void*) {
    for (;;) {
        pthread_testcancel();
        if (qcomtee_object_process_one(g_root))
            break;
    }
    return nullptr;
}

std::uint64_t NowMs() {
    timeval tv{};
    ::gettimeofday(&tv, nullptr);
    return static_cast<std::uint64_t>(tv.tv_sec) * 1000
         + static_cast<std::uint64_t>(tv.tv_usec) / 1000;
}

// ---- The credentials object
//
// QTEE will not take the credentials blob directly on the Register path: it
// takes an object and calls back into it, twice, while our invoke is still in
// flight. Two ops, GET_LENGTH then READ_AT_OFFSET.
//
// libqcomtee ships one of these, but only by pulling in QCBOR to build the
// map. The map is thirteen bytes and lives in Fingerprintd:Tee under test, so
// this serves it and the library needs no dependency beyond libc.
struct CredentialsObject {
    qcomtee_object object;              // must be first: we cast between them
    std::vector<std::byte> blob;
    std::uint64_t lenStorage = 0;       // op 0's answer, pointed at not copied
};

void CredentialsRelease(qcomtee_object* object) {
    delete reinterpret_cast<CredentialsObject*>(object);
}

qcomtee_result_t CredentialsDispatch(qcomtee_object* object, qcomtee_op_t op,
                                     qcomtee_param* params, int num) {
    auto* self = reinterpret_cast<CredentialsObject*>(object);

    // On the CALLBACK path a QCOMTEE_UBUF_OUTPUT param arrives with
    // addr = NULL and size = the capacity QTEE will accept: the dispatcher
    // supplies the buffer, so the handler POINTS the param at storage of its
    // own and lets the framework marshal it. Writing through the incoming addr
    // is a null dereference, which is exactly how this crashed the first time
    // it ran against real QTEE.
    if (op == static_cast<qcomtee_op_t>(fingerprintd::tee::CredOp::GetLength)) {
        if (num != 1 || params[0].attr != QCOMTEE_UBUF_OUTPUT)
            return QCOMTEE_ERROR_INVALID;
        if (params[0].ubuf.size < fingerprintd::tee::CredLengthReplySize)
            return QCOMTEE_ERROR_INVALID;
        self->lenStorage = static_cast<std::uint64_t>(self->blob.size());
        params[0].ubuf.addr = &self->lenStorage;
        params[0].ubuf.size = sizeof(self->lenStorage);
        return QCOMTEE_OK;
    }

    if (op == static_cast<qcomtee_op_t>(fingerprintd::tee::CredOp::ReadAtOffset)) {
        if (num != 2 || params[0].attr != QCOMTEE_UBUF_INPUT
                     || params[1].attr != QCOMTEE_UBUF_OUTPUT)
            return QCOMTEE_ERROR_INVALID;
        // An INPUT param does carry a real address; only outputs arrive NULL.
        if (params[0].ubuf.size < sizeof(std::uint64_t) || !params[0].ubuf.addr)
            return QCOMTEE_ERROR_INVALID;
        std::uint64_t offset = 0;
        ::memcpy(&offset, params[0].ubuf.addr, sizeof(offset));

        auto plan = fingerprintd::tee::PlanRead(self->blob.size(), offset,
                                                params[1].ubuf.size);
        if (!plan.valid)
            return QCOMTEE_ERROR_INVALID;
        // Same again: point at the blob, do not copy into QTEE's buffer. The
        // storage has to outlive the dispatch, which the object owns.
        params[1].ubuf.addr = self->blob.data() + plan.offset;
        params[1].ubuf.size = plan.count;
        return QCOMTEE_OK;
    }

    return QCOMTEE_ERROR_INVALID;
}

qcomtee_object_ops g_credOps = {
    /* release   */ CredentialsRelease,
    /* dispatch  */ CredentialsDispatch,
    /* error     */ nullptr,
    /* supported */ nullptr,
};

qcomtee_object* MakeCredentials(std::uint32_t uid) {
    auto* c = new CredentialsObject{};
    c->blob = fingerprintd::tee::BuildCredentials(uid, NowMs());
    if (qcomtee_object_cb_init(&c->object, &g_credOps, g_root)) {
        delete c;
        return QCOMTEE_OBJECT_NULL;
    }
    return &c->object;
}

// ROOT op 2: hand QTEE a live credentials object and get a client env back.
// QTEE calls into the object while this invoke is outstanding, which is why
// the supplicant has to be running first.
qcomtee_object* GetClientEnv(std::uint32_t uid) {
    qcomtee_object* creds = MakeCredentials(uid);
    if (creds == QCOMTEE_OBJECT_NULL) {
        std::println(std::cerr, "credentials object init failed");
        return QCOMTEE_OBJECT_NULL;
    }
    qcomtee_param p[2] = {};
    p[0].attr = QCOMTEE_OBJREF_INPUT;
    p[0].object = creds;
    p[1].attr = QCOMTEE_OBJREF_OUTPUT;
    qcomtee_result_t result = 0;
    if (qcomtee_object_invoke(g_root,
                              static_cast<qcomtee_op_t>(fingerprintd::tee::ClientEnvOp),
                              p, 2, &result) || result) {
        std::println(std::cerr, "ROOT op {} failed, result={}",
                     static_cast<unsigned>(fingerprintd::tee::ClientEnvOp),
                     static_cast<int>(result));
        return QCOMTEE_OBJECT_NULL;
    }
    return p[1].object;
}

// IClientEnv op 0: open a service by UID on the env.
qcomtee_object* OpenService(qcomtee_object* env, std::uint32_t uid) {
    qcomtee_param p[2] = {};
    p[0].attr = QCOMTEE_UBUF_INPUT;
    p[0].ubuf.addr = &uid;
    p[0].ubuf.size = sizeof(uid);
    p[1].attr = QCOMTEE_OBJREF_OUTPUT;
    qcomtee_result_t result = 0;
    if (qcomtee_object_invoke(env, 0, p, 2, &result) || result) {
        std::println(std::cerr, "IClientEnv.open({}) failed, result={}", uid,
                     static_cast<int>(result));
        return QCOMTEE_OBJECT_NULL;
    }
    return p[1].object;
}

// ---- The sensor rail
//
// GPIO v2 chardev ioctls directly: libgpiod is not on the phone and this is
// three lines. The chip is found by LABEL, never by index -- /dev/gpiochipN
// ordering is not stable and driving the wrong controller's pins is the kind
// of mistake that is not recoverable over ssh.
class Sensor {
public:
    ~Sensor() { PowerOff(); }

    bool Open() {
        namespace sn = fingerprintd::sensor;
        chip_ = FindChip(sn::ChipLabel);
        if (chip_ < 0) {
            std::println(std::cerr, "no gpiochip labelled '{}'", sn::ChipLabel);
            return false;
        }
        power_ = RequestLine(sn::PowerLine, GPIO_V2_LINE_FLAG_OUTPUT, "fpd-pwr");
        reset_ = RequestLine(sn::ResetLine, GPIO_V2_LINE_FLAG_OUTPUT, "fpd-rst");
        irq_   = RequestLine(sn::IrqLine,   GPIO_V2_LINE_FLAG_INPUT,  "fpd-irq");
        return power_ >= 0 && reset_ >= 0 && irq_ >= 0;
    }

    // Rail up, settle, release reset, settle. Both lines are driven low first
    // so a warm restart starts where a cold one does.
    bool PowerOn() {
        namespace sn = fingerprintd::sensor;
        if (!Set(power_, 0) || !Set(reset_, 0)) return false;
        if (!Set(power_, 1)) return false;
        std::this_thread::sleep_for(sn::PowerSettle);
        if (!Set(reset_, 1)) return false;
        std::this_thread::sleep_for(sn::ResetSettle);
        on_ = true;
        return true;
    }

    void PowerOff() {
        if (!on_) return;
        Set(reset_, 0);
        Set(power_, 0);
        on_ = false;
    }

    std::optional<int> ReadIrq() const { return Get(irq_); }

private:
    static int FindChip(std::string_view label) {
        for (int i = 0; i < 32; i++) {
            std::string path = std::format("/dev/gpiochip{}", i);
            int fd = ::open(path.c_str(), O_RDWR | O_CLOEXEC);
            if (fd < 0) continue;
            gpiochip_info info{};
            if (::ioctl(fd, GPIO_GET_CHIPINFO_IOCTL, &info) == 0
                && label == info.label
                && info.lines >= fingerprintd::sensor::MinChipLines) {
                std::println("gpiochip '{}' is {} ({} lines)", info.label, path,
                             info.lines);
                return fd;
            }
            ::close(fd);
        }
        return -1;
    }

    int RequestLine(unsigned line, std::uint64_t flags, const char* consumer) {
        // The guard, enforced where the line is actually opened rather than
        // only asserted in the core. gpio8-11 are XPU-protected and touching
        // one is an immediate SError, not an error return.
        if (!fingerprintd::sensor::IsSafeLine(line)) {
            std::println(std::cerr,
                         "REFUSING to open gpio{}: XPU-protected fingerprint SPI", line);
            return -1;
        }
        gpio_v2_line_request req{};
        req.offsets[0] = line;
        req.num_lines = 1;
        req.config.flags = flags;
        std::snprintf(req.consumer, sizeof(req.consumer), "%s", consumer);
        if (::ioctl(chip_, GPIO_V2_GET_LINE_IOCTL, &req) < 0) {
            std::println(std::cerr, "gpio{} request failed: {}", line, ::strerror(errno));
            return -1;
        }
        return req.fd;
    }

    static bool Set(int fd, int v) {
        if (fd < 0) return false;
        gpio_v2_line_values vals{};
        vals.mask = 1;
        vals.bits = v ? 1 : 0;
        return ::ioctl(fd, GPIO_V2_LINE_SET_VALUES_IOCTL, &vals) == 0;
    }

    static std::optional<int> Get(int fd) {
        if (fd < 0) return std::nullopt;
        gpio_v2_line_values vals{};
        vals.mask = 1;
        if (::ioctl(fd, GPIO_V2_LINE_GET_VALUES_IOCTL, &vals) < 0) return std::nullopt;
        return static_cast<int>(vals.bits & 1);
    }

    int chip_ = -1, power_ = -1, reset_ = -1, irq_ = -1;
    bool on_ = false;
};

// ---- The trustlet
//
// The loader is IQSEEComCompatAppLoader (UID 122): op 1 loadFromBuffer, op 2
// lookupTA. A stale instance from a crashed run is unloaded first, which is
// what stops a bad experiment costing a reboot.
constexpr const char* TaName = "focal64";

void UnloadStale(qcomtee_object* loader) {
    qcomtee_param p[3] = {};
    std::array<std::byte, 4> ob{};
    p[0].attr = QCOMTEE_UBUF_INPUT;
    p[0].ubuf.addr = const_cast<char*>(TaName);
    p[0].ubuf.size = std::strlen(TaName);
    p[1].attr = QCOMTEE_UBUF_OUTPUT;
    p[1].ubuf.addr = ob.data();
    p[1].ubuf.size = ob.size();
    p[2].attr = QCOMTEE_OBJREF_OUTPUT;
    qcomtee_result_t result = 0;
    if (qcomtee_object_invoke(loader, 2, p, 3, &result) || result) {
        std::println("lookupTA('{}') -> result={} (nothing to unload)", TaName,
                     static_cast<int>(result));
        return;
    }
    if (!qcomtee_object_invoke(p[2].object, 2, nullptr, 0, &result))
        std::println("unloaded a stale '{}' -> result={}", TaName, static_cast<int>(result));
    qcomtee_object_refs_dec(p[2].object);
}

qcomtee_object* LoadTrustlet(qcomtee_object* loader, const std::string& path) {
    UnloadStale(loader);

    std::ifstream f(path, std::ios::binary);
    if (!f) {
        std::println(std::cerr, "cannot open {}", path);
        return QCOMTEE_OBJECT_NULL;
    }
    std::vector<char> image((std::istreambuf_iterator<char>(f)),
                            std::istreambuf_iterator<char>());
    if (image.empty()) {
        std::println(std::cerr, "{} is empty", path);
        return QCOMTEE_OBJECT_NULL;
    }

    std::array<char, 128> distName{};
    qcomtee_param p[4] = {};
    p[0].attr = QCOMTEE_UBUF_INPUT;
    p[0].ubuf.addr = image.data();
    p[0].ubuf.size = image.size();
    p[1].attr = QCOMTEE_UBUF_INPUT;
    p[1].ubuf.addr = const_cast<char*>(TaName);
    p[1].ubuf.size = std::strlen(TaName);
    p[2].attr = QCOMTEE_UBUF_OUTPUT;
    p[2].ubuf.addr = distName.data();
    p[2].ubuf.size = distName.size();
    p[3].attr = QCOMTEE_OBJREF_OUTPUT;
    qcomtee_result_t result = 0;
    if (qcomtee_object_invoke(loader, 1, p, 4, &result) || result) {
        std::println(std::cerr, "loadFromBuffer failed, result={}",
                     static_cast<int>(result));
        return QCOMTEE_OBJECT_NULL;
    }
    std::println("trustlet loaded from {} ({} bytes), distName='{}'", path,
                 image.size(), distName.data());
    return p[3].object;
}

// sendRequest is op 0 with arity 0x0424: four input buffers, two output, four
// object slots. The request and response buffers go in and come back out; the
// trustlet's own return code rides in the returned request's header.
struct CommandResult { bool invoked = false; qcomtee_result_t result = 0; std::int32_t rc = 0; std::int32_t metric = 0; };

CommandResult SendCommand(qcomtee_object* app, fingerprintd::ta::Cmd cmd,
                          std::span<const std::byte> payload) {
    namespace ta = fingerprintd::ta;
    namespace tee = fingerprintd::tee;
    static std::vector<std::byte> req(8192), rsp(16384), reqOut(8192), rspOut(16384);
    std::ranges::fill(rsp, std::byte{0});
    std::ranges::fill(reqOut, std::byte{0});
    std::ranges::fill(rspOut, std::byte{0});
    ta::BuildRequest(req, cmd, payload);

    // CAPTURE_IMAGE's flags word sits at payload+0x18, PAST the declared
    // length of 0x14 -- the trustlet range-checks the length to exactly that
    // and reads the flags anyway. Without bit 1 or bit 30 it skips
    // preprocessing, the classifier and the enrol grouper entirely and returns
    // success having done nothing but a raw scan.
    if (cmd == ta::Cmd::CaptureImage) {
        for (std::size_t i = 0; i < 4; i++)
            req[ta::ReqPayloadOff + ta::CaptureFlagsOff + i] =
                static_cast<std::byte>((ta::CaptureFlagsEnrol >> (8 * i)) & 0xFF);
    }

    std::uint32_t is64 = 1;
    qcomtee_param p[10] = {};
    p[0].attr = QCOMTEE_UBUF_INPUT;  p[0].ubuf.addr = req.data();    p[0].ubuf.size = req.size();
    p[1].attr = QCOMTEE_UBUF_INPUT;  p[1].ubuf.addr = rsp.data();    p[1].ubuf.size = rsp.size();
    p[2].attr = QCOMTEE_UBUF_INPUT;  p[2].ubuf.addr = nullptr;       p[2].ubuf.size = 0;
    p[3].attr = QCOMTEE_UBUF_INPUT;  p[3].ubuf.addr = &is64;         p[3].ubuf.size = sizeof(is64);
    p[4].attr = QCOMTEE_UBUF_OUTPUT; p[4].ubuf.addr = reqOut.data(); p[4].ubuf.size = reqOut.size();
    p[5].attr = QCOMTEE_UBUF_OUTPUT; p[5].ubuf.addr = rspOut.data(); p[5].ubuf.size = rspOut.size();
    for (int i = 6; i < 10; i++) {
        p[i].attr = QCOMTEE_OBJREF_INPUT;
        p[i].object = QCOMTEE_OBJECT_NULL;
    }

    // A capture needs a real shared memory REGION or the trustlet answers
    // -201: it reads an output-buffer pointer out of payload+0x00, and QTEE
    // only patches an address in there if we name the location in
    // embeddedBufOffsets (IB2) and hand it the region in an object slot.
    // Without that the pointer is NULL. This is the whole difference between a
    // flat metric and a real scan.
    //
    // Two traps: the offsets array applies to EVERY command in a run, so it is
    // scoped to this one command -- patching a pointer into SYNC_CONFIG's
    // request breaks it. And an invoke CONSUMES its input objects, so the
    // region is allocated fresh each time.
    qcomtee_object* region = QCOMTEE_OBJECT_NULL;
    std::uint32_t offsets = tee::EmbeddedBufOffsetValue;
    if (cmd == static_cast<ta::Cmd>(tee::RegionScopedToCommand)) {
        if (qcomtee_memory_object_alloc(tee::CaptureRegionSize, g_root, &region)) {
            std::println(std::cerr, "  memory region alloc failed");
            region = QCOMTEE_OBJECT_NULL;
        } else {
            void* addr = qcomtee_memory_object_addr(region);
            std::size_t sz = qcomtee_memory_object_size(region);
            if (g_verbose)
                std::println("    region: addr={} size={} offsets=[0x{:x}] slot=IO0",
                             addr, sz, offsets);
            std::memset(addr, 0, sz);
            p[2].ubuf.addr = &offsets;
            p[2].ubuf.size = sizeof(offsets);
            p[6].object = region;
        }
    }

    CommandResult out;
    if (qcomtee_object_invoke(app, tee::AppSendRequestOp, p, 10, &out.result)) {
        if (region != QCOMTEE_OBJECT_NULL)
            qcomtee_memory_object_release(region);
        return out;
    }
    out.invoked = true;
    out.rc = ta::ResultCode(reqOut);
    out.metric = ta::CaptureMetric(reqOut);
    if (g_verbose && cmd == ta::Cmd::CaptureImage) {
        std::string hex;
        for (std::size_t i = 0; i < 0x30; i++)
            hex += std::format("{:02x}{}", std::to_integer<unsigned>(reqOut[i]),
                               (i % 16 == 15) ? "\n      " : " ");
        std::println("    reqOut[0x00..0x2f]:\n      {}", hex);
    }
    return out;
}

void Report(fingerprintd::ta::Cmd cmd, const CommandResult& r) {
    namespace ta = fingerprintd::ta;
    if (!r.invoked) {
        std::println("  CMD 0x{:04x} -> INVOKE FAILED", static_cast<unsigned>(cmd));
        return;
    }
    std::println("  CMD 0x{:04x} -> result={} rc={} ({})", static_cast<unsigned>(cmd),
                 static_cast<int>(r.result), r.rc, ta::StrError(r.rc));
}

int Probe() {
    namespace tee = fingerprintd::tee;

    std::string dev(tee::DevTee);
    g_root = qcomtee_object_root_init(dev.c_str(), TeeCall, nullptr, nullptr);
    if (g_root == QCOMTEE_OBJECT_NULL) {
        std::println(std::cerr, "root object on {}: {}", tee::DevTee,
                     ::strerror(errno));
        return 1;
    }
    std::println("root object on {}", tee::DevTee);

    pthread_t th{};
    if (pthread_create(&th, nullptr, Supplicant, nullptr) != 0) {
        std::println(std::cerr, "supplicant thread failed to start");
        return 1;
    }

    std::uint32_t uid = ::getuid();
    qcomtee_object* env = GetClientEnv(uid);
    if (env == QCOMTEE_OBJECT_NULL)
        return 1;
    std::println("client env obtained (uid {}, {}-byte credentials)", uid,
                 tee::BuildCredentials(uid, 0).size());

    qcomtee_object* loader = OpenService(env, tee::UidQseecomCompatAppLoader);
    if (loader == QCOMTEE_OBJECT_NULL)
        return 1;
    std::println("QSEECOM-compat app loader (UID {}) opened",
                 tee::UidQseecomCompatAppLoader);

    qcomtee_object* app = LoadTrustlet(loader, g_taPath);
    if (app == QCOMTEE_OBJECT_NULL)
        return 1;

    // SYNC_CONFIG first, always. The trustlet reads its whole configuration
    // from this one JSON payload, and two keys in it are load-bearing:
    // algorithm.enrolling_overlap_intervals must be PRESENT (its default is
    // the empty string, which faults the trustlet's own sscanf), and
    // device.preferred_device_id selects the chip driver.
    std::ifstream cf(g_cfgPath);
    if (!cf) {
        std::println(std::cerr, "cannot open config {}", g_cfgPath);
        return 1;
    }
    std::string json((std::istreambuf_iterator<char>(cf)),
                     std::istreambuf_iterator<char>());
    // The trustlet wants the terminating NUL counted.
    std::vector<std::byte> cfg(json.size() + 1, std::byte{0});
    for (std::size_t i = 0; i < json.size(); i++)
        cfg[i] = static_cast<std::byte>(json[i]);
    std::println("config {}: {} bytes", g_cfgPath, cfg.size());

    auto r = SendCommand(app, fingerprintd::ta::Cmd::SyncConfig, cfg);
    Report(fingerprintd::ta::Cmd::SyncConfig, r);
    if (!r.invoked || r.result != 0 || r.rc != 0) {
        std::println(std::cerr, "SYNC_CONFIG did not succeed; stopping here");
        return 1;
    }

    // A storage read needs no sensor. It exercises the whole SFS listener path
    // if listeners are registered, and answers with no templates when they are
    // not.
    auto e = SendCommand(app, fingerprintd::ta::Cmd::Enumerate, {});
    Report(fingerprintd::ta::Cmd::Enumerate, e);

    // ---- The sensor, and the init chain that needs it powered
    Sensor sensor;
    if (!sensor.Open()) {
        std::println(std::cerr, "sensor lines unavailable; stopping before init");
        return 1;
    }
    if (!sensor.PowerOn()) {
        std::println(std::cerr, "sensor power-up failed");
        return 1;
    }
    auto irq = sensor.ReadIrq();
    std::println("sensor powered, reset released, irq={}",
                 irq ? std::to_string(*irq) : std::string("?"));

    // The chain, in order. Every step answers rc=0 on a healthy sensor and the
    // last one is not optional: without SYNC_STATISTICS the trustlet's
    // g_statistics stays NULL and the first enrol frame that gets far enough
    // writes through it.
    //
    // One reset buys one init. If this fails, the rail has to go down and come
    // back up -- re-running the chain answers -205.
    bool ok = true;
    for (fingerprintd::ta::Cmd c : fingerprintd::ta::InitChain) {
        std::vector<std::byte> payload;
        if (c == fingerprintd::ta::Cmd::WorkMode) {
            // WORK_MODE takes a u32 mode; 1 = WAIT_TOUCH.
            payload.assign(0x10, std::byte{0});
            payload[0] = static_cast<std::byte>(
                static_cast<std::uint32_t>(fingerprintd::ta::WorkMode::WaitTouch));
        } else if (c == fingerprintd::ta::Cmd::SyncStatistics) {
            payload.assign(fingerprintd::ta::SyncStatisticsPayloadSize, std::byte{0});
        }
        auto ir = SendCommand(app, c, payload);
        Report(c, ir);
        if (!ir.invoked || ir.result != 0 || ir.rc != 0) {
            ok = false;
            if (ir.rc == fingerprintd::sensor::RcDeviceNotFound)
                std::println(std::cerr,
                             "  -205: a second init in one power cycle. "
                             "Power-cycle the rail, do not retry.");
            break;
        }
    }
    if (!ok) {
        std::println(std::cerr, "init chain did not complete");
        return 1;
    }

    // With the sensor initialised and a region supplied, a capture returns a
    // real metric. No finger is needed to establish the idle floor, and the
    // floor is the only meaningful reference: the metric is per frame and
    // drifts, so a fixed threshold is wrong by construction.
    fingerprintd::engine::Baseline baseline;
    std::println("calibrating the idle floor ({} samples)",
                 fingerprintd::engine::Baseline::DefaultSamples);
    for (std::size_t i = 0; i < fingerprintd::engine::Baseline::DefaultSamples; i++) {
        std::vector<std::byte> cap(fingerprintd::ta::CaptureDeclaredLen);
        fingerprintd::ta::BuildCapturePayload(cap);
        auto c = SendCommand(app, fingerprintd::ta::Cmd::CaptureImage, cap);
        if (!c.invoked || c.result != 0) {
            Report(fingerprintd::ta::Cmd::CaptureImage, c);
            std::println(std::cerr, "capture failed during calibration");
            return 1;
        }
        std::println("  idle {}/{}: rc={} metric={}", i + 1,
                     fingerprintd::engine::Baseline::DefaultSamples, c.rc, c.metric);
        baseline.Observe(c.metric);
    }
    if (!baseline.Ready()) {
        std::println(std::cerr, "baseline did not calibrate (floor stayed 0)");
        return 1;
    }
    std::println("idle floor = {}, finger threshold = {}", baseline.Floor(),
                 baseline.Threshold());

    std::println("\ntrustlet initialised against a powered sensor.");
    pthread_cancel(th);
    pthread_join(th, nullptr);
    return 0;
}

}  // namespace

int main(int argc, char** argv) {
    std::span<char*> args(argv, static_cast<std::size_t>(argc));
    bool probe = false;
    for (std::string_view a : args.subspan(1)) {
        if (a == "--version") {
            std::println("fingerprintd {}", Version);
            return 0;
        }
        if (a == "--probe-tee") probe = true;
        if (a.starts_with("--ta=")) g_taPath = a.substr(5);
        if (a.starts_with("--config=")) g_cfgPath = a.substr(9);
        if (a == "--verbose") g_verbose = true;
    }
    if (probe)
        return Probe();

    std::println(std::cerr,
                 "fingerprintd {}: no runtime yet. --probe-tee reaches QTEE; "
                 "`crafter-build test` covers the core.", Version);
    return 1;
}