[nrf toup][nrfconnect] Improve NFC Commissioning

Prevent a second NFC tap from starting a new transport session
during fail-safe rollback, which could crash the NFC stack after
field loss.

kServerReady does not always fire when IPv6 mDNS is not ready at
boot, so defer NFC tag emulation until the fabric table is loaded
and only report active NFC commissioning when emulation is actually
running.

Signed-off-by: Arkadiusz Balys <arkadiusz.balys@nordicsemi.no>

Author: ArekBalysNordic

src/platform/nrfconnect/NFCCommissioningManagerImpl.cpp

@@ -18,6 +18,10 @@
 #include <platform/internal/CHIPDeviceLayerInternal.h>
 #include <platform/internal/NFCCommissioningManager.h>
 
+#include <app/server/Server.h>         // nogncheck
+#include <transport/SecureSession.h>   // nogncheck
+#include <transport/raw/PeerAddress.h> // nogncheck
+
 #include <platform/nrfconnect/NFCCommissioningManagerImpl.h>
 
 #include <lib/support/CHIPMem.h>
@@ -153,27 +157,105 @@ CHIP_ERROR NFCCommissioningManagerImpl::_Init()
     ChipLogDetail(DeviceLayer, "Initializing NFC Commissioning Manager");
 
     ResetSession();
-    StartRawIsoDepTagEmulation();
     ReturnErrorOnFailure(PlatformMgr().AddEventHandler(OnPlatformEvent, reinterpret_cast<intptr_t>(this)));
 
-    return mRawIsoDepStarted ? CHIP_NO_ERROR : CHIP_ERROR_INTERNAL;
+    return CHIP_NO_ERROR;
 }
 
 void NFCCommissioningManagerImpl::OnPlatformEvent(const ChipDeviceEvent * event, intptr_t arg)
 {
-    if (event->Type == DeviceEventType::kCommissioningComplete)
+    auto * self = reinterpret_cast<NFCCommissioningManagerImpl *>(arg);
+
+    switch (event->Type)
     {
-        reinterpret_cast<NFCCommissioningManagerImpl *>(arg)->HandleCommissioningComplete();
+    case DeviceEventType::kServerReady:
+    case DeviceEventType::kDnssdInitialized:
+        self->StartNfcCommissioning();
+        break;
+    case DeviceEventType::kCommissioningComplete:
+        self->HandleCommissioningComplete();
+        break;
+    case DeviceEventType::kFailSafeTimerExpired:
+        self->HandleFailSafeTimerExpired();
+        break;
+    case DeviceEventType::kSecureSessionEstablished:
+        self->HandleSecureSessionEstablished(event);
+        break;
+    default:
+        break;
+    }
+}
+
+void NFCCommissioningManagerImpl::ScheduledStartNfcCommissioning(intptr_t arg)
+{
+    auto * self = reinterpret_cast<NFCCommissioningManagerImpl *>(arg);
+    VerifyOrReturn(self != nullptr);
+    self->StartNfcCommissioning();
+}
+
+void NFCCommissioningManagerImpl::StartNfcCommissioning()
+{
+    VerifyOrReturn(!mRawIsoDepStarted);
+
+    if (Server::GetInstance().GetFabricTable().FabricCount() != 0)
+    {
+        ChipLogProgress(DeviceLayer, "Device already commissioned: NFC commissioning will stay disabled");
+        return;
+    }
+
+    StartRawIsoDepTagEmulation();
+    if (!mRawIsoDepStarted)
+    {
+        ChipLogError(DeviceLayer, "Failed to start NFC tag emulation for commissioning");
     }
 }
 
 void NFCCommissioningManagerImpl::HandleCommissioningComplete()
 {
+    mBlockMatterAidSelection       = false;
+    mNfcEmulationPausedForFailSafe = false;
     ChipLogProgress(DeviceLayer, "Commissioning complete: stopping NFC commissioning");
-    PlatformMgr().RemoveEventHandler(OnPlatformEvent, reinterpret_cast<intptr_t>(this));
     NFCCommissioningMgr().Shutdown();
 }
 
+void NFCCommissioningManagerImpl::HandleFailSafeTimerExpired()
+{
+    VerifyOrReturn(mBlockMatterAidSelection || mNfcEmulationPausedForFailSafe);
+
+    mBlockMatterAidSelection       = false;
+    mNfcEmulationPausedForFailSafe = false;
+
+    if (Server::GetInstance().GetFabricTable().FabricCount() != 0)
+    {
+        return;
+    }
+
+    TEMPORARY_RETURN_IGNORED ConfigureOnboardingPayload();
+    ChipLogProgress(DeviceLayer, "Fail-safe expired: NFC commissioning is available again");
+}
+
+void NFCCommissioningManagerImpl::HandleSecureSessionEstablished(const ChipDeviceEvent * event)
+{
+    VerifyOrReturn(event != nullptr);
+
+    const auto & sessionEstablished = event->SecureSessionEstablished;
+    if (sessionEstablished.TransportType != static_cast<uint8_t>(Transport::Type::kNfc))
+    {
+        return;
+    }
+
+    if (sessionEstablished.SecureSessionType != static_cast<uint8_t>(Transport::SecureSession::Type::kPASE))
+    {
+        return;
+    }
+
+    SessionLock lock;
+    mBlockMatterAidSelection = true;
+    TEMPORARY_RETURN_IGNORED ClearOnboardingPayload();
+    ChipLogProgress(DeviceLayer,
+                    "NFC PASE session established: blocking NFC commissioning until fail-safe completes or commissioning succeeds");
+}
+
 CHIP_ERROR NFCCommissioningManagerImpl::ConfigureOnboardingPayload()
 {
     PayloadContents payload;
@@ -193,7 +275,14 @@ CHIP_ERROR NFCCommissioningManagerImpl::ConfigureOnboardingPayload()
     MutableCharSpan qrCode(qrCodeBuffer);
     ReturnErrorOnFailure(QRCodeBasicSetupPayloadGenerator(payload).payloadBase38Representation(qrCode));
 
-    return SetOnboardingPayload(qrCode.data(), qrCode.size());
+    ReturnErrorOnFailure(SetOnboardingPayload(qrCode.data(), qrCode.size()));
+
+    // ConfigureOnboardingPayload() runs before Server::Init(); defer NFC start until the fabric
+    // table is loaded. kServerReady is not reliable on all networking paths (e.g. Wi-Fi builds
+    // without an IPv6 mDNS listener at boot), so schedule an explicit start attempt as well.
+    TEMPORARY_RETURN_IGNORED PlatformMgr().ScheduleWork(ScheduledStartNfcCommissioning, reinterpret_cast<intptr_t>(this));
+
+    return CHIP_NO_ERROR;
 }
 
 void NFCCommissioningManagerImpl::StartRawIsoDepTagEmulation()
@@ -219,15 +308,35 @@ void NFCCommissioningManagerImpl::StartRawIsoDepTagEmulation()
     ChipLogProgress(DeviceLayer, "NFC NDEF Tag emulation started");
 }
 
+void NFCCommissioningManagerImpl::StopRawIsoDepTagEmulation()
+{
+    VerifyOrReturn(mRawIsoDepStarted);
+
+    nfc_t4t_emulation_stop();
+    nfc_t4t_done();
+    mRawIsoDepStarted = false;
+}
+
+void NFCCommissioningManagerImpl::PauseNfcTagEmulationForFailSafe()
+{
+    VerifyOrReturn(!mNfcEmulationPausedForFailSafe);
+
+    mNfcEmulationPausedForFailSafe = true;
+    StopRawIsoDepTagEmulation();
+    ChipLogProgress(DeviceLayer, "NFC tag emulation paused until fail-safe completes");
+}
+
+bool NFCCommissioningManagerImpl::IsSessionIdle() const
+{
+    return mSelectedApplication == SelectedApplication::kNone && !mOutgoingContinuationPending && mApduLength == 0 &&
+        mApduFragmentCount == 0 && !mAwaitingApplicationResponse && mOutgoingMessage.IsNull();
+}
+
 void NFCCommissioningManagerImpl::_Shutdown()
 {
     ChipLogDetail(DeviceLayer, "Shutting down NFC Commissioning Manager");
-    if (mRawIsoDepStarted)
-    {
-        nfc_t4t_emulation_stop();
-        nfc_t4t_done();
-        mRawIsoDepStarted = false;
-    }
+    PlatformMgr().RemoveEventHandler(OnPlatformEvent, reinterpret_cast<intptr_t>(this));
+    StopRawIsoDepTagEmulation();
     ResetSession(/* notifyAborted = */ true);
 }
 
@@ -378,6 +487,11 @@ void NFCCommissioningManagerImpl::OnT4TEvent(void * context, nfc_t4t_event_t eve
         return;
     }
 
+    if (self->mNfcEmulationPausedForFailSafe)
+    {
+        return;
+    }
+
     switch (event)
     {
     case NFC_T4T_EVENT_FIELD_ON:
@@ -399,17 +513,46 @@ void NFCCommissioningManagerImpl::OnT4TEvent(void * context, nfc_t4t_event_t eve
 
 void NFCCommissioningManagerImpl::HandleFieldOn()
 {
+    SessionLock lock;
+
+    if (mNfcEmulationPausedForFailSafe)
+    {
+        ChipLogProgress(DeviceLayer, "NFC field detected while fail-safe pause is active: ignoring");
+        return;
+    }
+
+    if (mBlockMatterAidSelection && IsSessionIdle())
+    {
+        ChipLogProgress(DeviceLayer, "NFC field detected while fail-safe is active: pausing tag emulation");
+        ResetSessionState();
+        PauseNfcTagEmulationForFailSafe();
+        return;
+    }
+
     ChipLogDetail(DeviceLayer, "NFC field detected: an NFC Reader/Writer is polling");
     // A field-on event always precedes a fresh ISO-DEP activation: start with a clean slate.
-    SessionLock lock;
     ResetSessionState();
 }
 
 void NFCCommissioningManagerImpl::HandleFieldOff()
 {
-    ChipLogDetail(DeviceLayer, "NFC field lost: the NFC Reader/Writer moved away");
     SessionLock lock;
+
+    if (IsSessionIdle())
+    {
+        if (mNfcEmulationPausedForFailSafe || !mBlockMatterAidSelection)
+        {
+            return;
+        }
+    }
+
+    ChipLogProgress(DeviceLayer, "NFC field lost: the NFC Reader/Writer moved away");
     ResetSessionState(/* notifyAborted = */ true);
+
+    if (mBlockMatterAidSelection && mRawIsoDepStarted)
+    {
+        PauseNfcTagEmulationForFailSafe();
+    }
 }
 
 void NFCCommissioningManagerImpl::HandleDataTransmitted()
@@ -553,6 +696,17 @@ void NFCCommissioningManagerImpl::HandleSelectByNameCommand(const uint8_t * aid,
 
     if (aidLength == sizeof(kNdefAid) && memcmp(aid, kNdefAid, sizeof(kNdefAid)) == 0)
     {
+        if (mBlockMatterAidSelection)
+        {
+            mSelectedApplication = SelectedApplication::kNone;
+            mSelectedFile        = SelectedFile::kNone;
+            SendStatusResponse(kSwConditionsNotSatisfied1, kSwConditionsNotSatisfied2);
+            ChipLogProgress(DeviceLayer,
+                            "Rejecting NDEF Tag Application selection: commissioning fail-safe is active, waiting for fail-safe "
+                            "to complete");
+            return;
+        }
+
         mSelectedApplication = SelectedApplication::kNdef;
         SendStatusResponse(kSwSuccess1, kSwSuccess2);
         ChipLogProgress(DeviceLayer, "NDEF Tag Application selected");
@@ -594,6 +748,16 @@ void NFCCommissioningManagerImpl::HandleSelectByFileIdCommand(const uint8_t * fi
 
 void NFCCommissioningManagerImpl::HandleMatterAidSelected()
 {
+    if (mBlockMatterAidSelection)
+    {
+        mSelectedApplication = SelectedApplication::kNone;
+        mSelectedFile        = SelectedFile::kNone;
+        SendStatusResponse(kSwConditionsNotSatisfied1, kSwConditionsNotSatisfied2);
+        ChipLogProgress(DeviceLayer,
+                        "Rejecting Matter AID selection: commissioning fail-safe is active, waiting for fail-safe to complete");
+        return;
+    }
+
     mSelectedApplication = SelectedApplication::kMatter;
 
     uint16_t discriminator = 0;
@@ -634,6 +798,13 @@ void NFCCommissioningManagerImpl::HandleMatterAidSelected()
 
 void NFCCommissioningManagerImpl::HandleReadBinaryCommand(const uint8_t * apdu, size_t apduLength)
 {
+    if (mBlockMatterAidSelection)
+    {
+        SendStatusResponse(kSwConditionsNotSatisfied1, kSwConditionsNotSatisfied2);
+        ChipLogProgress(DeviceLayer, "Rejecting READ BINARY: commissioning fail-safe is active, waiting for fail-safe to complete");
+        return;
+    }
+
     if (mSelectedApplication != SelectedApplication::kNdef || mSelectedFile == SelectedFile::kNone)
     {
         SendStatusResponse(kSwConditionsNotSatisfied1, kSwConditionsNotSatisfied2);

src/platform/nrfconnect/NFCCommissioningManagerImpl.h

@@ -61,7 +61,10 @@ class NFCCommissioningManagerImpl final : public NFCCommissioningManager, privat
     void SetNFCBase(Transport::NFCBase * nfcBase) override;
     bool CanSendToPeer(const Transport::PeerAddress & address) override;
     CHIP_ERROR SendToNfcTag(const Transport::PeerAddress & address, System::PacketBufferHandle && msgBuf) override;
-    bool HasOnboardingPayload() const { return mHasOnboardingPayload; }
+    bool HasOnboardingPayload() const
+    {
+        return mHasOnboardingPayload && mRawIsoDepStarted && !mBlockMatterAidSelection && !mNfcEmulationPausedForFailSafe;
+    }
     CHIP_ERROR ConfigureOnboardingPayload();
 
     // Maximum size of the NDEF message (URI record) served by the NDEF Tag Application's NDEF
@@ -89,6 +92,17 @@ class NFCCommissioningManagerImpl final : public NFCCommissioningManager, privat
     /** Stops NFC tag emulation once the device has been successfully commissioned. */
     void HandleCommissioningComplete();
 
+    /** Starts NFC tag emulation once the server is up and the device has no fabrics yet. */
+    void StartNfcCommissioning();
+
+    static void ScheduledStartNfcCommissioning(intptr_t arg);
+
+    /** Logs that NFC Matter transport can accept a new session after fail-safe expiry. */
+    void HandleFailSafeTimerExpired();
+
+    /** Blocks new Matter AID selection once an NFC PASE session is established. */
+    void HandleSecureSessionEstablished(const ChipDeviceEvent * event);
+
     // Grant header-local singleton accessors access to sInstance.
     friend NFCCommissioningManager & NFCCommissioningMgr();
     friend NFCCommissioningManagerImpl & NFCCommissioningMgrImpl();
@@ -123,6 +137,15 @@ class NFCCommissioningManagerImpl final : public NFCCommissioningManager, privat
      */
     void StartRawIsoDepTagEmulation();
 
+    /** Stops raw ISO-DEP tag emulation without removing the platform event handler. */
+    void StopRawIsoDepTagEmulation();
+
+    /** Stops tag emulation while fail-safe rollback is in progress. */
+    void PauseNfcTagEmulationForFailSafe();
+
+    /** Returns true when there is no in-flight ISO-DEP/Matter session state. */
+    bool IsSessionIdle() const;
+
     /**
      * Handles the event indicating that an NFC polling device (reader) field is present.
      * Typically used to prepare for communication when a reader initiates contact.
@@ -315,6 +338,15 @@ class NFCCommissioningManagerImpl final : public NFCCommissioningManager, privat
 
     // Set once an incoming message has been fully reassembled and handed off to the Matter stack.
     bool mAwaitingApplicationResponse = false;
+
+    // While set, NDEF reads and new Matter AID selections are rejected, and the
+    // onboarding payload is cleared, so a second NFC tap cannot restart commissioning
+    // during fail-safe rollback.
+    bool mBlockMatterAidSelection = false;
+
+    // Set when tag emulation is stopped during fail-safe rollback. While set, all NFC
+    // callbacks are ignored to avoid corrupting the NFC platform ring buffer on re-tap.
+    bool mNfcEmulationPausedForFailSafe = false;
 };
 
 /**