From e87b9f19330642723d23ba1a254b6715af28a017 Mon Sep 17 00:00:00 2001 From: michael Date: Tue, 17 Mar 2026 19:49:34 -0700 Subject: [PATCH] docs: SLIX2 command audit against SL2S2602 datasheet 20+ commands audited, gaps identified and prioritized. Must-haves: GET NXP SYSTEM INFO, READ SIGNATURE, ENABLE PRIVACY, EAS/AFI password, PROTECT PAGE. Co-Authored-By: Claude Opus 4.6 (1M context) --- docs/SLIX2_COMMAND_AUDIT.md | 84 +++++++++++++++++++++++++++++++++++++ 1 file changed, 84 insertions(+) create mode 100644 docs/SLIX2_COMMAND_AUDIT.md diff --git a/docs/SLIX2_COMMAND_AUDIT.md b/docs/SLIX2_COMMAND_AUDIT.md new file mode 100644 index 0000000..96e8c6e --- /dev/null +++ b/docs/SLIX2_COMMAND_AUDIT.md @@ -0,0 +1,84 @@ +# ICODE SLIX2 Command Audit + +**Date:** 2026-03-17 +**Source:** SL2S2602 datasheet Rev 4.2, AN11809 Rev 1.2, SL2S2002 datasheet Rev 3.4 + +## Status + +Commands marked OK are implemented in firmware native handler or response table. +Commands marked MISSING need implementation in the Python transponder model + table compiler. + +### Standard ISO 15693 (firmware native handler) + +| Cmd | Name | Status | +|-----|------|--------| +| 0x01 | INVENTORY | OK | +| 0x02 | STAY QUIET | OK | +| 0x20 | READ SINGLE BLOCK | OK (with lock_mode access control) | +| 0x21 | WRITE SINGLE BLOCK | OK (with lock_mode access control) | +| 0x22 | LOCK BLOCK | OK (firmware native) | +| 0x23 | READ MULTIPLE BLOCKS | OK | +| 0x25 | SELECT | OK | +| 0x26 | RESET TO READY | OK | +| 0x27 | WRITE AFI | OK (firmware native) | +| 0x28 | LOCK AFI | OK (firmware native) | +| 0x29 | WRITE DSFID | OK (firmware native) | +| 0x2A | LOCK DSFID | OK (firmware native) | +| 0x2B | GET SYSTEM INFO | OK | +| 0x2C | GET MULTIPLE BLOCK SECURITY | OK | + +### NXP Custom Commands (table entries) + +| Code | Name | Status | Priority | Notes | +|------|------|--------|----------|-------| +| 0xA0 | INVENTORY READ | MISSING | Nice to have | Like inventory but returns data blocks | +| 0xA1 | FAST INVENTORY READ | MISSING | Nice to have | Same as A0 at double data rate | +| 0xA2 | SET EAS | MISSING | Nice to have | Enables EAS mode (password protected) | +| 0xA3 | RESET EAS | MISSING | Nice to have | Disables EAS mode | +| 0xA4 | LOCK EAS | MISSING | Nice to have | Permanently locks EAS state | +| 0xA5 | EAS ALARM | MISSING | Nice to have | Returns 256-bit EAS sequence | +| 0xA6 | PASSWORD PROTECT EAS/AFI | MISSING | Nice to have | Enables password protection for EAS/AFI | +| 0xA7 | WRITE EAS ID | MISSING | Nice to have | Writes 16-bit EAS identifier | +| 0xAB | GET NXP SYSTEM INFO | MISSING | **Must have** | Returns PP, PP conditions, lock bits, feature flags | +| 0xB2 | GET RANDOM NUMBER | OK | - | Firmware native handler | +| 0xB3 | SET PASSWORD | OK | - | Firmware native + table entries | +| 0xB4 | WRITE PASSWORD | MISSING | Should have | Changes password value (requires prior SET PASSWORD) | +| 0xB5 | LOCK PASSWORD | MISSING | Should have | Permanently locks a password | +| 0xB6 | PROTECT PAGE | MISSING | **Must have** | Sets protection pointer + access conditions | +| 0xB7 | LOCK PAGE PROTECTION | MISSING | Should have | Permanently locks protection config | +| 0xB9 | DESTROY | MISSING | Should have | Irreversibly kills tag (XOR password) | +| 0xBA | ENABLE PRIVACY | MISSING | **Must have** | Enters privacy mode (separate from SET PASSWORD) | +| 0xBB | 64-BIT PASSWORD PROTECTION | MISSING | Should have | Requires both R+W passwords | +| 0xBC | STAY QUIET PERSISTENT | MISSING | Nice to have | Persistent quiet survives power cycles | +| 0xBD | READ SIGNATURE | MISSING | **Must have** | Returns 32-byte ECC originality signature | + +### Model Issues + +1. **Password ID 0x10 (EAS/AFI) missing** — datasheet lists 5 IDs: 0x01=Read, 0x02=Write, 0x04=Privacy, 0x08=Destroy, 0x10=EAS/AFI. Model only has 4. + +2. **Privacy mode behavior** — datasheet says tag responds to GET RANDOM NUMBER AND SET PASSWORD in privacy mode. Model only allows SET PASSWORD. + +3. **ENABLE PRIVACY (0xBA) is separate** from SET PASSWORD — uses XOR'd password, specifically enters privacy mode. Model conflates with SET PASSWORD pwd_id=privacy. + +4. **16-bit counter (block 79)** has special increment-only semantics via WRITE with specific data format. Not modeled. + +5. **Protection pointer access conditions** — datasheet defines Page L / Page H with separate read/write protection bits (Extended Protection Status byte). Model uses simpler `protection_pointer` integer. + +### Implementation Priority + +**Next session — must haves:** +1. GET NXP SYSTEM INFO (0xAB) — static response from tag config +2. READ SIGNATURE (0xBD) — static 32-byte signature +3. ENABLE PRIVACY (0xBA) — XOR password, enter privacy mode +4. EAS/AFI password (pwd_id 0x10) — add to model +5. PROTECT PAGE (0xB6) — set protection pointer via RF + +**After that — should haves:** +6. WRITE PASSWORD (0xB4) +7. LOCK PASSWORD (0xB5) +8. DESTROY (0xB9) +9. LOCK PAGE PROTECTION (0xB7) +10. 64-BIT PASSWORD PROTECTION (0xBB) + +**Later — nice to haves:** +11-16. EAS subsystem, INVENTORY READ, STAY QUIET PERSISTENT, counter handling