| /* |
| * Copyright (c) 2024 Project CHIP Authors |
| * All rights reserved. |
| * |
| * Licensed under the Apache License, Version 2.0 (the "License"); |
| * you may not use this file except in compliance with the License. |
| * You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| #include <app/codegen-data-model-provider/CodegenDataModelProvider.h> |
| |
| #include <access/AccessControl.h> |
| #include <app-common/zap-generated/attribute-type.h> |
| #include <app/AttributeAccessInterface.h> |
| #include <app/AttributeAccessInterfaceRegistry.h> |
| #include <app/RequiredPrivilege.h> |
| #include <app/codegen-data-model-provider/EmberMetadata.h> |
| #include <app/data-model/FabricScoped.h> |
| #include <app/reporting/reporting.h> |
| #include <app/util/af-types.h> |
| #include <app/util/attribute-metadata.h> |
| #include <app/util/attribute-storage-detail.h> |
| #include <app/util/attribute-storage-null-handling.h> |
| #include <app/util/attribute-storage.h> |
| #include <app/util/attribute-table-detail.h> |
| #include <app/util/attribute-table.h> |
| #include <app/util/ember-io-storage.h> |
| #include <app/util/ember-strings.h> |
| #include <app/util/odd-sized-integers.h> |
| #include <lib/core/CHIPError.h> |
| #include <lib/support/CodeUtils.h> |
| |
| #include <zap-generated/endpoint_config.h> |
| |
| namespace chip { |
| namespace app { |
| namespace { |
| |
| using namespace chip::app::Compatibility::Internal; |
| using Protocols::InteractionModel::Status; |
| |
| class ContextAttributesChangeListener : public AttributesChangedListener |
| { |
| public: |
| ContextAttributesChangeListener(const DataModel::InteractionModelContext & context) : mListener(context.dataModelChangeListener) |
| {} |
| void MarkDirty(const AttributePathParams & path) override { mListener->MarkDirty(path); } |
| |
| private: |
| DataModel::ProviderChangeListener * mListener; |
| }; |
| |
| /// Attempts to write via an attribute access interface (AAI) |
| /// |
| /// If it returns a CHIP_ERROR, then this is a FINAL result (i.e. either failure or success) |
| /// |
| /// If it returns std::nullopt, then there is no AAI to handle the given path |
| /// and processing should figure out the value otherwise (generally from other ember data) |
| std::optional<CHIP_ERROR> TryWriteViaAccessInterface(const ConcreteDataAttributePath & path, AttributeAccessInterface * aai, |
| AttributeValueDecoder & decoder) |
| { |
| // Processing can happen only if an attribute access interface actually exists.. |
| if (aai == nullptr) |
| { |
| return std::nullopt; |
| } |
| |
| CHIP_ERROR err = aai->Write(path, decoder); |
| |
| if (err != CHIP_NO_ERROR) |
| { |
| return std::make_optional(err); |
| } |
| |
| // If the decoder tried to decode, then a value should have been read for processing. |
| // - if decoding was done, assume DONE (i.e. final CHIP_NO_ERROR) |
| // - otherwise, if no decoding done, return that processing must continue via nullopt |
| return decoder.TriedDecode() ? std::make_optional(CHIP_NO_ERROR) : std::nullopt; |
| } |
| |
| /// Metadata of what a ember/pascal short string means (prepended by a u8 length) |
| struct ShortPascalString |
| { |
| using LengthType = uint8_t; |
| static constexpr LengthType kNullLength = 0xFF; |
| |
| static void SetLength(uint8_t * buffer, LengthType value) { *buffer = value; } |
| }; |
| |
| /// Metadata of what a ember/pascal LONG string means (prepended by a u16 length) |
| struct LongPascalString |
| { |
| using LengthType = uint16_t; |
| static constexpr LengthType kNullLength = 0xFFFF; |
| |
| // Encoding for ember string lengths is little-endian (see ember-strings.cpp) |
| static void SetLength(uint8_t * buffer, LengthType value) { Encoding::LittleEndian::Put16(buffer, value); } |
| }; |
| |
| // ember assumptions ... should just work |
| static_assert(sizeof(ShortPascalString::LengthType) == 1); |
| static_assert(sizeof(LongPascalString::LengthType) == 2); |
| |
| /// Convert the value stored in 'decoder' into an ember format span 'out' |
| /// |
| /// The value converted will be of type T (e.g. CharSpan or ByteSpan) and it will be converted |
| /// via the given ENCODING (i.e. ShortPascalString or LongPascalString) |
| /// |
| /// isNullable defines if the value of NULL is allowed to be converted. |
| template <typename T, class ENCODING> |
| CHIP_ERROR DecodeStringLikeIntoEmberBuffer(AttributeValueDecoder decoder, bool isNullable, MutableByteSpan & out) |
| { |
| T workingValue; |
| |
| if (isNullable) |
| { |
| typename DataModel::Nullable<T> nullableWorkingValue; |
| ReturnErrorOnFailure(decoder.Decode(nullableWorkingValue)); |
| |
| if (nullableWorkingValue.IsNull()) |
| { |
| VerifyOrReturnError(out.size() >= sizeof(typename ENCODING::LengthType), CHIP_ERROR_BUFFER_TOO_SMALL); |
| ENCODING::SetLength(out.data(), ENCODING::kNullLength); |
| out.reduce_size(sizeof(typename ENCODING::LengthType)); |
| return CHIP_NO_ERROR; |
| } |
| |
| // continue encoding non-null value |
| workingValue = nullableWorkingValue.Value(); |
| } |
| else |
| { |
| ReturnErrorOnFailure(decoder.Decode(workingValue)); |
| } |
| |
| auto len = static_cast<typename ENCODING::LengthType>(workingValue.size()); |
| VerifyOrReturnError(out.size() >= sizeof(len) + len, CHIP_ERROR_BUFFER_TOO_SMALL); |
| |
| uint8_t * output_buffer = out.data(); |
| |
| ENCODING::SetLength(output_buffer, len); |
| output_buffer += sizeof(len); |
| |
| memcpy(output_buffer, workingValue.data(), workingValue.size()); |
| output_buffer += workingValue.size(); |
| |
| out.reduce_size(static_cast<size_t>(output_buffer - out.data())); |
| return CHIP_NO_ERROR; |
| } |
| |
| /// Decodes a numeric data value of type T from the `decoder` into a ember-encoded buffer `out` |
| /// |
| /// isNullable defines if the value of NULL is allowed to be decoded. |
| template <typename T> |
| CHIP_ERROR DecodeIntoEmberBuffer(AttributeValueDecoder & decoder, bool isNullable, MutableByteSpan & out) |
| { |
| using Traits = NumericAttributeTraits<T>; |
| typename Traits::StorageType storageValue; |
| |
| if (isNullable) |
| { |
| DataModel::Nullable<typename Traits::WorkingType> workingValue; |
| ReturnErrorOnFailure(decoder.Decode(workingValue)); |
| |
| if (workingValue.IsNull()) |
| { |
| Traits::SetNull(storageValue); |
| } |
| else |
| { |
| // This guards against trying to decode something that overlaps nullable, for example |
| // Nullable<uint8_t>(0xFF) is not representable because 0xFF is the encoding of NULL in ember |
| // as well as odd-sized integers (e.g. full 32-bit value like 0x11223344 cannot be written |
| // to a 3-byte odd-sized integger). |
| VerifyOrReturnError(Traits::CanRepresentValue(isNullable, workingValue.Value()), CHIP_ERROR_INVALID_ARGUMENT); |
| Traits::WorkingToStorage(workingValue.Value(), storageValue); |
| } |
| |
| VerifyOrReturnError(out.size() >= sizeof(storageValue), CHIP_ERROR_INVALID_ARGUMENT); |
| } |
| else |
| { |
| typename Traits::WorkingType workingValue; |
| ReturnErrorOnFailure(decoder.Decode(workingValue)); |
| |
| Traits::WorkingToStorage(workingValue, storageValue); |
| |
| VerifyOrReturnError(out.size() >= sizeof(storageValue), CHIP_ERROR_INVALID_ARGUMENT); |
| |
| // Even non-nullable values may be outside range: e.g. odd-sized integers have working values |
| // that are larger than the storage values (e.g. a uint32_t being stored as a 3-byte integer) |
| VerifyOrReturnError(Traits::CanRepresentValue(isNullable, workingValue), CHIP_ERROR_INVALID_ARGUMENT); |
| } |
| |
| const uint8_t * data = Traits::ToAttributeStoreRepresentation(storageValue); |
| |
| // The decoding + ToAttributeStoreRepresentation will result in data being |
| // stored in native format/byteorder, suitable to directly be stored in the data store |
| memcpy(out.data(), data, sizeof(storageValue)); |
| out.reduce_size(sizeof(storageValue)); |
| |
| return CHIP_NO_ERROR; |
| } |
| |
| /// Read the data from "decoder" into an ember-formatted buffer "out" |
| /// |
| /// `out` is a in/out buffer: |
| /// - its initial size determines the maximum size of the buffer |
| /// - its output size reflects the actual data size |
| /// |
| /// Uses the attribute `metadata` to determine how the data is to be encoded into out. |
| CHIP_ERROR DecodeValueIntoEmberBuffer(AttributeValueDecoder & decoder, const EmberAfAttributeMetadata * metadata, |
| MutableByteSpan & out) |
| { |
| VerifyOrReturnError(metadata != nullptr, CHIP_ERROR_INVALID_ARGUMENT); |
| |
| const bool isNullable = metadata->IsNullable(); |
| |
| switch (AttributeBaseType(metadata->attributeType)) |
| { |
| case ZCL_BOOLEAN_ATTRIBUTE_TYPE: // Boolean |
| return DecodeIntoEmberBuffer<bool>(decoder, isNullable, out); |
| case ZCL_INT8U_ATTRIBUTE_TYPE: // Unsigned 8-bit integer |
| return DecodeIntoEmberBuffer<uint8_t>(decoder, isNullable, out); |
| case ZCL_INT16U_ATTRIBUTE_TYPE: // Unsigned 16-bit integer |
| return DecodeIntoEmberBuffer<uint16_t>(decoder, isNullable, out); |
| case ZCL_INT24U_ATTRIBUTE_TYPE: // Unsigned 24-bit integer |
| return DecodeIntoEmberBuffer<OddSizedInteger<3, false>>(decoder, isNullable, out); |
| case ZCL_INT32U_ATTRIBUTE_TYPE: // Unsigned 32-bit integer |
| return DecodeIntoEmberBuffer<uint32_t>(decoder, isNullable, out); |
| case ZCL_INT40U_ATTRIBUTE_TYPE: // Unsigned 40-bit integer |
| return DecodeIntoEmberBuffer<OddSizedInteger<5, false>>(decoder, isNullable, out); |
| case ZCL_INT48U_ATTRIBUTE_TYPE: // Unsigned 48-bit integer |
| return DecodeIntoEmberBuffer<OddSizedInteger<6, false>>(decoder, isNullable, out); |
| case ZCL_INT56U_ATTRIBUTE_TYPE: // Unsigned 56-bit integer |
| return DecodeIntoEmberBuffer<OddSizedInteger<7, false>>(decoder, isNullable, out); |
| case ZCL_INT64U_ATTRIBUTE_TYPE: // Unsigned 64-bit integer |
| return DecodeIntoEmberBuffer<uint64_t>(decoder, isNullable, out); |
| case ZCL_INT8S_ATTRIBUTE_TYPE: // Signed 8-bit integer |
| return DecodeIntoEmberBuffer<int8_t>(decoder, isNullable, out); |
| case ZCL_INT16S_ATTRIBUTE_TYPE: // Signed 16-bit integer |
| return DecodeIntoEmberBuffer<int16_t>(decoder, isNullable, out); |
| case ZCL_INT24S_ATTRIBUTE_TYPE: // Signed 24-bit integer |
| return DecodeIntoEmberBuffer<OddSizedInteger<3, true>>(decoder, isNullable, out); |
| case ZCL_INT32S_ATTRIBUTE_TYPE: // Signed 32-bit integer |
| return DecodeIntoEmberBuffer<int32_t>(decoder, isNullable, out); |
| case ZCL_INT40S_ATTRIBUTE_TYPE: // Signed 40-bit integer |
| return DecodeIntoEmberBuffer<OddSizedInteger<5, true>>(decoder, isNullable, out); |
| case ZCL_INT48S_ATTRIBUTE_TYPE: // Signed 48-bit integer |
| return DecodeIntoEmberBuffer<OddSizedInteger<6, true>>(decoder, isNullable, out); |
| case ZCL_INT56S_ATTRIBUTE_TYPE: // Signed 56-bit integer |
| return DecodeIntoEmberBuffer<OddSizedInteger<7, true>>(decoder, isNullable, out); |
| case ZCL_INT64S_ATTRIBUTE_TYPE: // Signed 64-bit integer |
| return DecodeIntoEmberBuffer<int64_t>(decoder, isNullable, out); |
| case ZCL_SINGLE_ATTRIBUTE_TYPE: // 32-bit float |
| return DecodeIntoEmberBuffer<float>(decoder, isNullable, out); |
| case ZCL_DOUBLE_ATTRIBUTE_TYPE: // 64-bit float |
| return DecodeIntoEmberBuffer<double>(decoder, isNullable, out); |
| case ZCL_CHAR_STRING_ATTRIBUTE_TYPE: // Char string |
| return DecodeStringLikeIntoEmberBuffer<CharSpan, ShortPascalString>(decoder, isNullable, out); |
| case ZCL_LONG_CHAR_STRING_ATTRIBUTE_TYPE: |
| return DecodeStringLikeIntoEmberBuffer<CharSpan, LongPascalString>(decoder, isNullable, out); |
| case ZCL_OCTET_STRING_ATTRIBUTE_TYPE: // Octet string |
| return DecodeStringLikeIntoEmberBuffer<ByteSpan, ShortPascalString>(decoder, isNullable, out); |
| case ZCL_LONG_OCTET_STRING_ATTRIBUTE_TYPE: |
| return DecodeStringLikeIntoEmberBuffer<ByteSpan, LongPascalString>(decoder, isNullable, out); |
| default: |
| ChipLogError(DataManagement, "Attribute type 0x%x not handled", static_cast<int>(metadata->attributeType)); |
| return CHIP_IM_GLOBAL_STATUS(Failure); |
| } |
| } |
| |
| } // namespace |
| |
| DataModel::ActionReturnStatus CodegenDataModelProvider::WriteAttribute(const DataModel::WriteAttributeRequest & request, |
| AttributeValueDecoder & decoder) |
| { |
| ChipLogDetail(DataManagement, "Writing attribute: Cluster=" ChipLogFormatMEI " Endpoint=0x%x AttributeId=" ChipLogFormatMEI, |
| ChipLogValueMEI(request.path.mClusterId), request.path.mEndpointId, ChipLogValueMEI(request.path.mAttributeId)); |
| |
| // TODO: ordering is to check writability/existence BEFORE ACL and this seems wrong, however |
| // existing unit tests (TC_AcessChecker.py) validate that we get UnsupportedWrite instead of UnsupportedAccess |
| // |
| // This should likely be fixed in spec (probably already fixed by |
| // https://github.com/CHIP-Specifications/connectedhomeip-spec/pull/9024) |
| // and tests and implementation |
| // |
| // Open issue that needs fixing: https://github.com/project-chip/connectedhomeip/issues/33735 |
| auto metadata = Ember::FindAttributeMetadata(request.path); |
| |
| // Explicit failure in finding a suitable metadata |
| if (const Status * status = std::get_if<Status>(&metadata)) |
| { |
| VerifyOrDie((*status == Status::UnsupportedEndpoint) || // |
| (*status == Status::UnsupportedCluster) || // |
| (*status == Status::UnsupportedAttribute)); |
| return *status; |
| } |
| |
| const EmberAfAttributeMetadata ** attributeMetadata = std::get_if<const EmberAfAttributeMetadata *>(&metadata); |
| |
| // All the global attributes that we do not have metadata for are |
| // read-only. Specifically only the following list-based attributes match the |
| // "global attributes not in metadata" (see GlobalAttributes.h :: GlobalAttributesNotInMetadata): |
| // - AttributeList |
| // - EventList |
| // - AcceptedCommands |
| // - GeneratedCommands |
| // |
| // Given the above, UnsupportedWrite should be correct (attempt to write to a read-only list) |
| bool isReadOnly = (attributeMetadata == nullptr) || (*attributeMetadata)->IsReadOnly(); |
| |
| // Internal is allowed to bypass timed writes and read-only. |
| if (!request.operationFlags.Has(DataModel::OperationFlags::kInternal)) |
| { |
| VerifyOrReturnError(!isReadOnly, Status::UnsupportedWrite); |
| } |
| |
| // ACL check for non-internal requests |
| bool checkAcl = !request.operationFlags.Has(DataModel::OperationFlags::kInternal); |
| |
| // For chunking, ACL check is not re-done if the previous write was successful for the exact same |
| // path. We apply this everywhere as a shortcut, although realistically this is only for AccessControl cluster |
| if (checkAcl && request.previousSuccessPath.has_value()) |
| { |
| // NOTE: explicit cast/check only for attribute path and nothing else. |
| // |
| // In particular `request.path` is a DATA path (contains a list index) |
| // and we do not want request.previousSuccessPath to be auto-cast to a |
| // data path with a empty list and fail the compare. |
| // |
| // This could be `request.previousSuccessPath != request.path` (where order |
| // is important) however that would seem more brittle (relying that a != b |
| // behaves differently than b != a due to casts). Overall Data paths are not |
| // the same as attribute paths. |
| // |
| // Also note that Concrete path have a mExpanded that is not used in compares. |
| const ConcreteAttributePath & attributePathA = request.path; |
| const ConcreteAttributePath & attributePathB = *request.previousSuccessPath; |
| |
| checkAcl = (attributePathA != attributePathB); |
| } |
| |
| if (checkAcl) |
| { |
| ReturnErrorCodeIf(!request.subjectDescriptor.has_value(), Status::UnsupportedAccess); |
| |
| Access::RequestPath requestPath{ .cluster = request.path.mClusterId, |
| .endpoint = request.path.mEndpointId, |
| .requestType = Access::RequestType::kAttributeWriteRequest, |
| .entityId = request.path.mAttributeId }; |
| CHIP_ERROR err = Access::GetAccessControl().Check(*request.subjectDescriptor, requestPath, |
| RequiredPrivilege::ForWriteAttribute(request.path)); |
| |
| if (err != CHIP_NO_ERROR) |
| { |
| VerifyOrReturnValue(err != CHIP_ERROR_ACCESS_DENIED, Status::UnsupportedAccess); |
| VerifyOrReturnValue(err != CHIP_ERROR_ACCESS_RESTRICTED_BY_ARL, Status::AccessRestricted); |
| |
| return err; |
| } |
| } |
| |
| // Internal is allowed to bypass timed writes and read-only. |
| if (!request.operationFlags.Has(DataModel::OperationFlags::kInternal)) |
| { |
| VerifyOrReturnError(!(*attributeMetadata)->MustUseTimedWrite() || request.writeFlags.Has(DataModel::WriteFlags::kTimed), |
| Status::NeedsTimedInteraction); |
| } |
| |
| // Extra check: internal requests can bypass the read only check, however global attributes |
| // have no underlying storage, so write still cannot be done |
| VerifyOrReturnError(attributeMetadata != nullptr, Status::UnsupportedWrite); |
| |
| if (request.path.mDataVersion.HasValue()) |
| { |
| std::optional<DataModel::ClusterInfo> clusterInfo = GetClusterInfo(request.path); |
| if (!clusterInfo.has_value()) |
| { |
| ChipLogError(DataManagement, "Unable to get cluster info for Endpoint 0x%x, Cluster " ChipLogFormatMEI, |
| request.path.mEndpointId, ChipLogValueMEI(request.path.mClusterId)); |
| return Status::DataVersionMismatch; |
| } |
| |
| if (request.path.mDataVersion.Value() != clusterInfo->dataVersion) |
| { |
| ChipLogError(DataManagement, "Write Version mismatch for Endpoint 0x%x, Cluster " ChipLogFormatMEI, |
| request.path.mEndpointId, ChipLogValueMEI(request.path.mClusterId)); |
| return Status::DataVersionMismatch; |
| } |
| } |
| |
| ContextAttributesChangeListener change_listener(CurrentContext()); |
| |
| AttributeAccessInterface * aai = |
| AttributeAccessInterfaceRegistry::Instance().Get(request.path.mEndpointId, request.path.mClusterId); |
| std::optional<CHIP_ERROR> aai_result = TryWriteViaAccessInterface(request.path, aai, decoder); |
| if (aai_result.has_value()) |
| { |
| if (*aai_result == CHIP_NO_ERROR) |
| { |
| // TODO: this is awkward since it provides AAI no control over this, specifically |
| // AAI may not want to increase versions for some attributes that are Q |
| emberAfAttributeChanged(request.path.mEndpointId, request.path.mClusterId, request.path.mAttributeId, &change_listener); |
| } |
| return *aai_result; |
| } |
| |
| MutableByteSpan dataBuffer = gEmberAttributeIOBufferSpan; |
| ReturnErrorOnFailure(DecodeValueIntoEmberBuffer(decoder, *attributeMetadata, dataBuffer)); |
| |
| Protocols::InteractionModel::Status status; |
| |
| if (dataBuffer.size() > (*attributeMetadata)->size) |
| { |
| ChipLogDetail(Zcl, "Data to write exceeds the attribute size claimed."); |
| return Status::InvalidValue; |
| } |
| |
| EmberAfWriteDataInput dataInput(dataBuffer.data(), (*attributeMetadata)->attributeType); |
| |
| dataInput.SetChangeListener(&change_listener); |
| // TODO: dataInput.SetMarkDirty() should be according to `ChangesOmmited` |
| |
| if (request.operationFlags.Has(DataModel::OperationFlags::kInternal)) |
| { |
| // Internal requests use the non-External interface that has less enforcement |
| // than the external version (e.g. does not check/enforce writable settings, does not |
| // validate attribute types) - see attribute-table.h documentation for details. |
| status = emberAfWriteAttribute(request.path, dataInput); |
| } |
| else |
| { |
| status = emAfWriteAttributeExternal(request.path, dataInput); |
| } |
| |
| if (status != Protocols::InteractionModel::Status::Success) |
| { |
| return status; |
| } |
| |
| return CHIP_NO_ERROR; |
| } |
| |
| } // namespace app |
| } // namespace chip |
