NFC Tag Emulation on nRF52840 with Rust — No SDK Required

Phone (Reader)              nRF52840 NFCT Hardware         Our Code
     │                              │                          │
     │── RF field ─────────────────>│                          │
     │                              │  FIELDDETECTED event     │
     │                              │─────────────────────────>│
     │                              │  TASKS_ACTIVATE          │
     │                              │<─────────────────────────│
     │<── SENS_RES (ATQA) ────────│  (automatic)             │
     │── anti-collision ──────────>│  (automatic)             │
     │<── NFCID1 (UID) ───────────│  (automatic)             │
     │── SELECT ──────────────────>│  SELECTED event          │
     │                              │─────────────────────────>│
     │── READ page 0 ────────────>│  RXFRAMEEND event        │
     │                              │─────────────────────────>│
     │                              │  (parse, prepare data)   │
     │<── 16 bytes + CRC ─────────│  TASKS_STARTTX           │
     │                              │<─────────────────────────│
     │── READ page 4 ────────────>│  ...repeat...            │
     │                              │                          │
     │── (phone removed) ─────────>│  FIELDLOST event         │

Page  Offset  Content                   Purpose
────  ──────  ─────────────────────────  ──────────────
 0    0x00    BB 5F 00 E4              UID0-2 + BCC0
 1    0x04    BE A7 BD 01              UID3-6
 2    0x08    71 48 00 00              BCC1 + Internal + Lock
 3    0x0C    E1 10 08 00              Capability Container
 4    0x10    03 10 D1 01              NDEF TLV start
 5    0x14    0C 54 02 65              Payload len + "Te"
 6    0x18    6E 42 65 61              "nBea"
 7    0x1C    74 42 75 64              "tBud"
 8    0x20    64 79 FE 00              "dy" + Terminator

const NFCID1: [u8; 7] = [0xBB, 0x5F, 0x00, 0xBE, 0xA7, 0xBD, 0x01];

fn build_tag_memory() -> [u8; 80] {
    let mut m = [0u8; 80];

    // Pages 0-2: UID header (must match NFCID1 registers)
    m[0] = NFCID1[0];
    m[1] = NFCID1[1];
    m[2] = NFCID1[2];
    m[3] = 0x88 ^ NFCID1[0] ^ NFCID1[1] ^ NFCID1[2]; // BCC0

    // Page 3: Capability Container
    m[12] = 0xE1; // NDEF magic
    m[13] = 0x10; // Version 1.0
    m[14] = 0x08; // Data size: 8 * 8 = 64 bytes
    m[15] = 0x00; // Read/write access

    // Pages 4+: NDEF text record "BeatBuddy"
    let ndef = [
        0x03, 16,                           // TLV: NDEF message, 16 bytes
        0xD1, 0x01, 0x0C, b'T',            // Record: Well-Known, Text
        0x02, b'e', b'n',                   // UTF-8, English
        b'B', b'e', b'a', b't',
        b'B', b'u', b'd', b'd', b'y',
        0xFE,                               // Terminator TLV
    ];
    m[16..16 + ndef.len()].copy_from_slice(&ndef);

    m
}

use embassy_nrf::pac;

let nfct = pac::NFCT;  // Singleton — the NFCT register block

// Bytes 0-2 in NFCID1_2ND_LAST
nfct.nfcid1_2nd_last().write(|w| {
    w.set_nfcid1_t(0xBB);  // UID byte 0
    w.set_nfcid1_u(0x5F);  // UID byte 1
    w.set_nfcid1_v(0x00);  // UID byte 2
});

// Bytes 3-6 in NFCID1_LAST
nfct.nfcid1_last().write(|w| {
    w.0 = 0xBE | (0xA7 << 8) | (0xBD << 16) | (0x01 << 24);
});

// SENSRES (ATQA): 7-byte UID, default SDD pattern
nfct.sensres().write(|w| {
    w.set_nfcidsize(Nfcidsize::NFCID1DOUBLE); // 7-byte UID
    w.set_bitframesdd(Bitframesdd::SDD00001);
});

// SELRES (SAK): Type 2 Tag — no ISO-DEP, no NFC-DEP
nfct.selres().write_value(Selres(0x00));

#[embassy_executor::task]
pub async fn nfc_task() {
    let nfct = pac::NFCT;
    let tag_mem = build_tag_memory();
    let mut rx_buf = [0u8; 16];
    let mut tx_buf = [0u8; 16];

    // ... register configuration (shown above) ...

    loop {
        // 1. Start field sensing
        nfct.tasks_sense().write_value(1);

        // 2. Wait for phone (relaxed polling — other tasks run freely)
        while nfct.events_fielddetected().read() == 0 {
            Timer::after(Duration::from_millis(50)).await;
        }

        // 3. Activate — hardware handles anti-collision
        nfct.tasks_activate().write_value(1);

        // 4. Wait for selection
        // ... (poll events_selected with 1ms Timer::after) ...

        // 5. Handle T2T commands until field lost
        loop {
            nfct.packetptr().write_value(rx_buf.as_mut_ptr() as u32);
            nfct.tasks_enablerxdata().write_value(1);

            // Wait for RXFRAMEEND or FIELDLOST
            // ...

            if rx_buf[0] == 0x30 {  // READ command
                let page = rx_buf[1] as usize;
                // Fill tx_buf with 4 pages (16 bytes), wrap-around
                for i in 0..16 {
                    tx_buf[i] = tag_mem[((page * 4) + i) % tag_mem.len()];
                }
                nfct.packetptr().write_value(tx_buf.as_ptr() as u32);
                nfct.txd().amount().write(|w| {
                    w.set_txdatabytes(16);
                    w.set_txdatabits(0);
                });
                nfct.tasks_starttx().write_value(1);
                // Wait for TXFRAMEEND...
            }
        }

        nfct.tasks_disable().write_value(1);
    }
}

// OLD svd2rust style — DOES NOT WORK with nrf-pac 0.1.0
nfct.events_fielddetected.write(|w| unsafe { w.bits(0) });

// Chiptool style — correct
nfct.events_fielddetected().write_value(0);          // u32 registers
nfct.sensres().write(|w| w.set_nfcidsize(val));      // struct registers
nfct.errorstatus().read().0                           // raw u32 from struct

#[embassy_executor::main]
async fn main(spawner: Spawner) {
    // ... HAL init, SoftDevice, BLE server ...

    spawner.spawn(ble_task(sd, server)).unwrap();
    spawner.spawn(sensor_task(/* IMU pins */)).unwrap();
    spawner.spawn(pdm_task(/* mic pins */)).unwrap();
    spawner.spawn(nfc::nfc_task()).unwrap();  // Just another task!
}