Merge branch 'master' into telink_zephyr_sdk_update

.github/workflows/check-data-model-directory-updates.yaml

@@ -36,4 +36,25 @@ jobs:
           python3 scripts/dm_xml_ci_change_enforcement.py data_model/1.3
       - name: Check for changes to 1.4 data_model directory without a SHA update
         run: |
-          python3 scripts/dm_xml_ci_change_enforcement.py data_model/1.4
+          python3 scripts/dm_xml_ci_change_enforcement.py data_model/1.4
+
+  check-data_model-build-file:
+    name: Check that all data_model files are listed in the data_model_xmls.gni build file
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/project-chip/chip-build
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Setup pip modules we use
+        run: |
+            python3 -m venv out/venv
+            out/venv/bin/pip3 install \
+                jinja2
+      - name: Generate build file (data_model_xmls.gni)
+        run: out/venv/bin/python3 src/python_testing/matter_testing_infrastructure/generate_data_model_xmls_gni.py
+      - name: Ensure git works in current working directory
+        run: git config --global --add safe.directory `pwd`
+      - name: Check for uncommited changes
+        run: |
+          git diff --exit-code HEAD -- src/python_testing/matter_testing_infrastructure/data_model_xmls.gni

docs/platforms/esp32/config_options.md

@@ -15,14 +15,12 @@ CONFIG_LWIP_IPV4=n
 ### Executable component not in "main" component
 
 The ESP-IDF framework allows renaming the main component, which can be useful if
-you want to place the app_main() function in a different component.
+you want to place the `app_main()` function in a different component.
 
 For required changes in the executable component, please refer to the
 [esp-idf documentation](https://docs.espressif.com/projects/esp-idf/en/stable/esp32/api-guides/build-system.html#renaming-main-component).
 
-If you're building applications that support Matter and want to place app_main()
-in a component other than main, use the following command:
-
-```
-idf.py -DEXECUTABLE_COMPONENT_NAME="your_component" build
-```
+You need to list the required components in `idf_component_register()`. If this
+module contains Matter related code, you may need to include
+`chip, app_update, spi_flash, and nvs_flash` as `PRIV_REQUIRES`, along with any
+other necessary dependencies.

examples/chip-tool/commands/clusters/ModelCommand.h

@@ -28,8 +28,10 @@
 class ModelCommand : public CHIPCommand
 {
 public:
-    ModelCommand(const char * commandName, CredentialIssuerCommands * credsIssuerConfig, bool supportsMultipleEndpoints = false) :
-        CHIPCommand(commandName, credsIssuerConfig), mOnDeviceConnectedCallback(OnDeviceConnectedFn, this),
+    ModelCommand(const char * commandName, CredentialIssuerCommands * credsIssuerConfig, bool supportsMultipleEndpoints = false,
+                 const char * helpText = nullptr) :
+        CHIPCommand(commandName, credsIssuerConfig, helpText),
+        mOnDeviceConnectedCallback(OnDeviceConnectedFn, this),
         mOnDeviceConnectionFailureCallback(OnDeviceConnectionFailureFn, this), mSupportsMultipleEndpoints(supportsMultipleEndpoints)
     {}
 

examples/chip-tool/commands/clusters/ReportCommand.h

@@ -26,8 +26,9 @@
 class ReportCommand : public InteractionModelReports, public ModelCommand, public chip::app::ReadClient::Callback
 {
 public:
-    ReportCommand(const char * commandName, CredentialIssuerCommands * credsIssuerConfig) :
-        InteractionModelReports(this), ModelCommand(commandName, credsIssuerConfig, /* supportsMultipleEndpoints = */ true)
+    ReportCommand(const char * commandName, CredentialIssuerCommands * credsIssuerConfig, const char * helpText = nullptr) :
+        InteractionModelReports(this),
+        ModelCommand(commandName, credsIssuerConfig, /* supportsMultipleEndpoints = */ true, helpText)
     {}
 
     /////////// ReadClient Callback Interface /////////
@@ -133,8 +134,8 @@ class ReportCommand : public InteractionModelReports, public ModelCommand, publi
 class ReadCommand : public ReportCommand
 {
 protected:
-    ReadCommand(const char * commandName, CredentialIssuerCommands * credsIssuerConfig) :
-        ReportCommand(commandName, credsIssuerConfig)
+    ReadCommand(const char * commandName, CredentialIssuerCommands * credsIssuerConfig, const char * helpText = nullptr) :
+        ReportCommand(commandName, credsIssuerConfig, helpText)
     {}
 
     void OnDone(chip::app::ReadClient * aReadClient) override
@@ -147,8 +148,8 @@ class ReadCommand : public ReportCommand
 class SubscribeCommand : public ReportCommand
 {
 protected:
-    SubscribeCommand(const char * commandName, CredentialIssuerCommands * credsIssuerConfig) :
-        ReportCommand(commandName, credsIssuerConfig)
+    SubscribeCommand(const char * commandName, CredentialIssuerCommands * credsIssuerConfig, const char * helpText = nullptr) :
+        ReportCommand(commandName, credsIssuerConfig, helpText)
     {}
 
     void OnSubscriptionEstablished(chip::SubscriptionId subscriptionId) override
@@ -187,7 +188,8 @@ class SubscribeCommand : public ReportCommand
 class ReadAttribute : public ReadCommand
 {
 public:
-    ReadAttribute(CredentialIssuerCommands * credsIssuerConfig) : ReadCommand("read-by-id", credsIssuerConfig)
+    ReadAttribute(CredentialIssuerCommands * credsIssuerConfig) :
+        ReadCommand("read-by-id", credsIssuerConfig, "Read attributes for the given attribute path (which may include wildcards).")
     {
         AddArgument("cluster-ids", 0, UINT32_MAX, &mClusterIds,
                     "Comma-separated list of cluster ids to read from (e.g. \"6\" or \"8,0x201\").\n  Allowed to be 0xFFFFFFFF to "
@@ -198,7 +200,8 @@ class ReadAttribute : public ReadCommand
     }
 
     ReadAttribute(chip::ClusterId clusterId, CredentialIssuerCommands * credsIssuerConfig) :
-        ReadCommand("read-by-id", credsIssuerConfig), mClusterIds(1, clusterId)
+        ReadCommand("read-by-id", credsIssuerConfig, "Read attributes from this cluster; allows wildcard endpoint and attribute."),
+        mClusterIds(1, clusterId)
     {
         AddAttributeIdArgument();
         AddCommonArguments();
@@ -245,7 +248,9 @@ class ReadAttribute : public ReadCommand
 class SubscribeAttribute : public SubscribeCommand
 {
 public:
-    SubscribeAttribute(CredentialIssuerCommands * credsIssuerConfig) : SubscribeCommand("subscribe-by-id", credsIssuerConfig)
+    SubscribeAttribute(CredentialIssuerCommands * credsIssuerConfig) :
+        SubscribeCommand("subscribe-by-id", credsIssuerConfig,
+                         "Subscribe to attributes for the given attribute path (which may include wildcards).")
     {
         AddArgument("cluster-ids", 0, UINT32_MAX, &mClusterIds,
                     "Comma-separated list of cluster ids to subscribe to (e.g. \"6\" or \"8,0x201\").\n  Allowed to be 0xFFFFFFFF "
@@ -256,7 +261,9 @@ class SubscribeAttribute : public SubscribeCommand
     }
 
     SubscribeAttribute(chip::ClusterId clusterId, CredentialIssuerCommands * credsIssuerConfig) :
-        SubscribeCommand("subscribe-by-id", credsIssuerConfig), mClusterIds(1, clusterId)
+        SubscribeCommand("subscribe-by-id", credsIssuerConfig,
+                         "Subscribe to attributes from this cluster; allows wildcard endpoint and attribute."),
+        mClusterIds(1, clusterId)
     {
         AddAttributeIdArgument();
         AddCommonArguments();
@@ -312,7 +319,8 @@ class SubscribeAttribute : public SubscribeCommand
 class ReadEvent : public ReadCommand
 {
 public:
-    ReadEvent(CredentialIssuerCommands * credsIssuerConfig) : ReadCommand("read-event-by-id", credsIssuerConfig)
+    ReadEvent(CredentialIssuerCommands * credsIssuerConfig) :
+        ReadCommand("read-event-by-id", credsIssuerConfig, "Read events for the given event path (which may include wildcards).")
     {
         AddArgument("cluster-id", 0, UINT32_MAX, &mClusterIds);
         AddArgument("event-id", 0, UINT32_MAX, &mEventIds);
@@ -322,7 +330,8 @@ class ReadEvent : public ReadCommand
     }
 
     ReadEvent(chip::ClusterId clusterId, CredentialIssuerCommands * credsIssuerConfig) :
-        ReadCommand("read-event-by-id", credsIssuerConfig), mClusterIds(1, clusterId)
+        ReadCommand("read-event-by-id", credsIssuerConfig, "Read events from this cluster; allows wildcard endpoint and event."),
+        mClusterIds(1, clusterId)
     {
         AddArgument("event-id", 0, UINT32_MAX, &mEventIds);
         AddArgument("fabric-filtered", 0, 1, &mFabricFiltered);
@@ -356,7 +365,9 @@ class ReadEvent : public ReadCommand
 class SubscribeEvent : public SubscribeCommand
 {
 public:
-    SubscribeEvent(CredentialIssuerCommands * credsIssuerConfig) : SubscribeCommand("subscribe-event-by-id", credsIssuerConfig)
+    SubscribeEvent(CredentialIssuerCommands * credsIssuerConfig) :
+        SubscribeCommand("subscribe-event-by-id", credsIssuerConfig,
+                         "Subscribe to events for the given event path (which may include wildcards).")
     {
         AddArgument("cluster-id", 0, UINT32_MAX, &mClusterIds);
         AddArgument("event-id", 0, UINT32_MAX, &mEventIds);
@@ -365,7 +376,9 @@ class SubscribeEvent : public SubscribeCommand
     }
 
     SubscribeEvent(chip::ClusterId clusterId, CredentialIssuerCommands * credsIssuerConfig) :
-        SubscribeCommand("subscribe-event-by-id", credsIssuerConfig), mClusterIds(1, clusterId)
+        SubscribeCommand("subscribe-event-by-id", credsIssuerConfig,
+                         "Subscribe to events from this cluster; allows wildcard endpoint and event."),
+        mClusterIds(1, clusterId)
     {
         AddArgument("event-id", 0, UINT32_MAX, &mEventIds);
         AddCommonArguments();
@@ -447,7 +460,8 @@ class ReadNone : public ReadCommand
 class ReadAll : public ReadCommand
 {
 public:
-    ReadAll(CredentialIssuerCommands * credsIssuerConfig) : ReadCommand("read-all", credsIssuerConfig)
+    ReadAll(CredentialIssuerCommands * credsIssuerConfig) :
+        ReadCommand("read-all", credsIssuerConfig, "Read attributes and events for the given paths (which may include wildcards).")
     {
         AddArgument("cluster-ids", 0, UINT32_MAX, &mClusterIds,
                     "Comma-separated list of cluster ids to read from (e.g. \"6\" or \"8,0x201\").\n  Allowed to be 0xFFFFFFFF to "
@@ -513,7 +527,9 @@ class SubscribeNone : public SubscribeCommand
 class SubscribeAll : public SubscribeCommand
 {
 public:
-    SubscribeAll(CredentialIssuerCommands * credsIssuerConfig) : SubscribeCommand("subscribe-all", credsIssuerConfig)
+    SubscribeAll(CredentialIssuerCommands * credsIssuerConfig) :
+        SubscribeCommand("subscribe-all", credsIssuerConfig,
+                         "Subscribe to attributes and events for the given paths (which may include wildcards).")
     {
         AddArgument("cluster-ids", 0, UINT32_MAX, &mClusterIds,
                     "Comma-separated list of cluster ids to read from (e.g. \"6\" or \"8,0x201\").\n  Allowed to be 0xFFFFFFFF to "

examples/common/pigweed/rpc_services/Attributes.h

@@ -192,7 +192,7 @@ class Attributes : public pw_rpc::nanopb::Attributes::Service<Attributes>
             return ::pw::Status::NotFound();
         }
 
-        Access::SubjectDescriptor subjectDescriptor{ .authMode = chip::Access::AuthMode::kPase };
+        Access::SubjectDescriptor subjectDescriptor{ .authMode = chip::Access::AuthMode::kInternalDeviceAccess };
         app::DataModel::WriteAttributeRequest write_request;
         write_request.path = path;
         write_request.operationFlags.Set(app::DataModel::OperationFlags::kInternal);
@@ -343,7 +343,7 @@ class Attributes : public pw_rpc::nanopb::Attributes::Service<Attributes>
 
     ::pw::Status ReadAttributeIntoTlvBuffer(const app::ConcreteAttributePath & path, MutableByteSpan & tlvBuffer)
     {
-        Access::SubjectDescriptor subjectDescriptor{ .authMode = chip::Access::AuthMode::kPase };
+        Access::SubjectDescriptor subjectDescriptor{ .authMode = chip::Access::AuthMode::kInternalDeviceAccess };
         app::AttributeReportIBs::Builder attributeReports;
         TLV::TLVWriter writer;
         TLV::TLVType outer;

examples/platform/silabs/FreeRTOSConfig.h

@@ -174,11 +174,8 @@ extern uint32_t SystemCoreClock;
 
 /* Software timer related definitions. */
 #define configUSE_TIMERS (1)
-#ifdef SLI_SI917
+// Keep the timerTask at the highest prio as some of our stacks tasks leverage eventing with timers.
 #define configTIMER_TASK_PRIORITY (55) /* Highest priority */
-#else
-#define configTIMER_TASK_PRIORITY (40) /* Highest priority */
-#endif                                 // SLI_SI917
 #define configTIMER_QUEUE_LENGTH (10)
 #define configTIMER_TASK_STACK_DEPTH (1024)
 
@@ -313,7 +310,7 @@ standard names. */
 /* Thread local storage pointers used by the SDK */
 
 #ifndef configNUM_USER_THREAD_LOCAL_STORAGE_POINTERS
-#define configNUM_USER_THREAD_LOCAL_STORAGE_POINTERS 2
+#define configNUM_USER_THREAD_LOCAL_STORAGE_POINTERS 0
 #endif
 
 #ifndef configNUM_SDK_THREAD_LOCAL_STORAGE_POINTERS

integrations/docker/images/base/chip-build/version

@@ -1 +1 @@
-105 : [Telink] Update Docker image (Zephyr SDK update)
+107 : [Telink] Update Docker image (Zephyr SDK update)

integrations/docker/images/stage-2/chip-build-java/Dockerfile

@@ -6,7 +6,7 @@ LABEL org.opencontainers.image.source https://github.com/project-chip/connectedh
 RUN set -x \
     && apt-get update \
     && DEBIAN_FRONTEND=noninteractive apt-get install -fy \
-    openjdk-11-jdk \
+    openjdk-17-jdk \
     && rm -rf /var/lib/apt/lists/ \
     && : # last line
 
@@ -20,4 +20,4 @@ RUN set -x \
     && : # last line
 
 ENV PATH $PATH:/usr/lib/kotlinc/bin
-ENV JAVA_PATH=/usr/lib/jvm/java-11-openjdk-amd64
+ENV JAVA_PATH=/usr/lib/jvm/java-17-openjdk-amd64

integrations/docker/images/stage-3/chip-build-android/Dockerfile

@@ -27,12 +27,17 @@ RUN set -x \
     && : # last line
 
 # Download and install android command line tool (for installing `sdkmanager`)
+# We need create latest folder inide cmdline-tools, since latest android commandline tool looks for this latest folder
+# when running sdkmanager --licenses
 RUN set -x \
-    && wget -O /tmp/android-tools.zip https://dl.google.com/android/repository/sdk-tools-linux-3859397.zip \
+    && wget -O /tmp/cmdline-tools.zip https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip \
     && cd /opt/android/sdk \
-    && unzip /tmp/android-tools.zip \
-    && rm -f /tmp/android-tools.zip \
-    && test -d /opt/android/sdk/tools \
+    && mkdir -p temp \
+    && unzip /tmp/cmdline-tools.zip -d temp \
+    && mkdir -p cmdline-tools/latest \
+    && cp -rf temp/cmdline-tools/* cmdline-tools/latest \
+    && rm -rf temp \
+    && test -d /opt/android/sdk/cmdline-tools \
     && : # last line
 
 # Download and install android NDK

scripts/tests/chiptest/__init__.py

@@ -207,7 +207,6 @@ def _GetDarwinFrameworkToolUnsupportedTests() -> Set[str]:
         "Test_TC_DGTHREAD_2_2",  # Thread Network Diagnostics is not implemented under darwin.
         "Test_TC_DGTHREAD_2_3",  # Thread Network Diagnostics is not implemented under darwin.
         "Test_TC_DGTHREAD_2_4",  # Thread Network Diagnostics is not implemented under darwin.
-        "Test_TC_FLABEL_2_1",  # darwin-framework-tool does not support writing readonly attributes by name
         "Test_TC_GRPKEY_2_1",  # darwin-framework-tool does not support writing readonly attributes by name
         "Test_TC_LCFG_2_1",  # darwin-framework-tool does not support writing readonly attributes by name
         "Test_TC_OPCREDS_3_7",  # darwin-framework-tool does not support the GetCommissionerRootCertificate command.

src/access/AccessControl.cpp

@@ -98,6 +98,8 @@ char GetAuthModeStringForLogging(AuthMode authMode)
     {
     case AuthMode::kNone:
         return 'n';
+    case AuthMode::kInternalDeviceAccess:
+        return 'i';
     case AuthMode::kPase:
         return 'p';
     case AuthMode::kCase:

src/access/AuthMode.h

@@ -27,10 +27,11 @@ namespace Access {
 // Auth mode should have only one value expressed, which should not be None.
 enum class AuthMode : uint8_t
 {
-    kNone  = 0,
-    kPase  = 1 << 5,
-    kCase  = 1 << 6,
-    kGroup = 1 << 7
+    kNone                 = 0,
+    kInternalDeviceAccess = 1 << 4, // Not part of an external interaction
+    kPase                 = 1 << 5,
+    kCase                 = 1 << 6,
+    kGroup                = 1 << 7
 };
 
 } // namespace Access

src/app/data-model-provider/Provider.h

@@ -85,6 +85,16 @@ class Provider : public ProviderMetadataTree
     ///      This includes cases where command handling and value return will be done asynchronously.
     ///    - returning a value other than Success implies an error reply (error and data are mutually exclusive)
     ///
+    /// Preconditions:
+    ///    - `request.path` MUST be valid: Invoke` is only guaranteed to function correctly for
+    ///      VALID paths (i.e. use `ProviderMetadataTree::AcceptedCommands` to check). This is
+    ///      because we assume ACL or flags (like timed invoke) have to happen before invoking
+    ///      this command.
+    ///    - TODO: as interfaces are updated, we may want to make the above requirement more
+    ///            relaxed, as it seems desirable for users of this interface to have guaranteed
+    ///            behavior (like error on invalid paths) where as today this seems unclear as some
+    ///            command intercepts do not validate if the path is valid per endpoints.
+    ///
     /// Return value expectations:
     ///   - if a response has been placed into `handler` then std::nullopt MUST be returned. In particular
     ///     note that CHIP_NO_ERROR is NOT the same as std::nullopt:

src/app/dynamic_server/AccessControl.cpp

@@ -63,7 +63,8 @@ class AccessControlDelegate : public Access::AccessControl::Delegate
             return CHIP_ERROR_ACCESS_DENIED;
         }
 
-        if (subjectDescriptor.authMode != AuthMode::kCase && subjectDescriptor.authMode != AuthMode::kPase)
+        if (subjectDescriptor.authMode != AuthMode::kCase && subjectDescriptor.authMode != AuthMode::kPase &&
+            subjectDescriptor.authMode != AuthMode::kInternalDeviceAccess)
         {
             // No idea who is asking; deny for now.
             return CHIP_ERROR_ACCESS_DENIED;