e87b9f1933
20+ commands audited, gaps identified and prioritized. Must-haves: GET NXP SYSTEM INFO, READ SIGNATURE, ENABLE PRIVACY, EAS/AFI password, PROTECT PAGE. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
85 lines
4.2 KiB
Markdown
85 lines
4.2 KiB
Markdown
# ICODE SLIX2 Command Audit
|
|
|
|
**Date:** 2026-03-17
|
|
**Source:** SL2S2602 datasheet Rev 4.2, AN11809 Rev 1.2, SL2S2002 datasheet Rev 3.4
|
|
|
|
## Status
|
|
|
|
Commands marked OK are implemented in firmware native handler or response table.
|
|
Commands marked MISSING need implementation in the Python transponder model + table compiler.
|
|
|
|
### Standard ISO 15693 (firmware native handler)
|
|
|
|
| Cmd | Name | Status |
|
|
|-----|------|--------|
|
|
| 0x01 | INVENTORY | OK |
|
|
| 0x02 | STAY QUIET | OK |
|
|
| 0x20 | READ SINGLE BLOCK | OK (with lock_mode access control) |
|
|
| 0x21 | WRITE SINGLE BLOCK | OK (with lock_mode access control) |
|
|
| 0x22 | LOCK BLOCK | OK (firmware native) |
|
|
| 0x23 | READ MULTIPLE BLOCKS | OK |
|
|
| 0x25 | SELECT | OK |
|
|
| 0x26 | RESET TO READY | OK |
|
|
| 0x27 | WRITE AFI | OK (firmware native) |
|
|
| 0x28 | LOCK AFI | OK (firmware native) |
|
|
| 0x29 | WRITE DSFID | OK (firmware native) |
|
|
| 0x2A | LOCK DSFID | OK (firmware native) |
|
|
| 0x2B | GET SYSTEM INFO | OK |
|
|
| 0x2C | GET MULTIPLE BLOCK SECURITY | OK |
|
|
|
|
### NXP Custom Commands (table entries)
|
|
|
|
| Code | Name | Status | Priority | Notes |
|
|
|------|------|--------|----------|-------|
|
|
| 0xA0 | INVENTORY READ | MISSING | Nice to have | Like inventory but returns data blocks |
|
|
| 0xA1 | FAST INVENTORY READ | MISSING | Nice to have | Same as A0 at double data rate |
|
|
| 0xA2 | SET EAS | MISSING | Nice to have | Enables EAS mode (password protected) |
|
|
| 0xA3 | RESET EAS | MISSING | Nice to have | Disables EAS mode |
|
|
| 0xA4 | LOCK EAS | MISSING | Nice to have | Permanently locks EAS state |
|
|
| 0xA5 | EAS ALARM | MISSING | Nice to have | Returns 256-bit EAS sequence |
|
|
| 0xA6 | PASSWORD PROTECT EAS/AFI | MISSING | Nice to have | Enables password protection for EAS/AFI |
|
|
| 0xA7 | WRITE EAS ID | MISSING | Nice to have | Writes 16-bit EAS identifier |
|
|
| 0xAB | GET NXP SYSTEM INFO | MISSING | **Must have** | Returns PP, PP conditions, lock bits, feature flags |
|
|
| 0xB2 | GET RANDOM NUMBER | OK | - | Firmware native handler |
|
|
| 0xB3 | SET PASSWORD | OK | - | Firmware native + table entries |
|
|
| 0xB4 | WRITE PASSWORD | MISSING | Should have | Changes password value (requires prior SET PASSWORD) |
|
|
| 0xB5 | LOCK PASSWORD | MISSING | Should have | Permanently locks a password |
|
|
| 0xB6 | PROTECT PAGE | MISSING | **Must have** | Sets protection pointer + access conditions |
|
|
| 0xB7 | LOCK PAGE PROTECTION | MISSING | Should have | Permanently locks protection config |
|
|
| 0xB9 | DESTROY | MISSING | Should have | Irreversibly kills tag (XOR password) |
|
|
| 0xBA | ENABLE PRIVACY | MISSING | **Must have** | Enters privacy mode (separate from SET PASSWORD) |
|
|
| 0xBB | 64-BIT PASSWORD PROTECTION | MISSING | Should have | Requires both R+W passwords |
|
|
| 0xBC | STAY QUIET PERSISTENT | MISSING | Nice to have | Persistent quiet survives power cycles |
|
|
| 0xBD | READ SIGNATURE | MISSING | **Must have** | Returns 32-byte ECC originality signature |
|
|
|
|
### Model Issues
|
|
|
|
1. **Password ID 0x10 (EAS/AFI) missing** — datasheet lists 5 IDs: 0x01=Read, 0x02=Write, 0x04=Privacy, 0x08=Destroy, 0x10=EAS/AFI. Model only has 4.
|
|
|
|
2. **Privacy mode behavior** — datasheet says tag responds to GET RANDOM NUMBER AND SET PASSWORD in privacy mode. Model only allows SET PASSWORD.
|
|
|
|
3. **ENABLE PRIVACY (0xBA) is separate** from SET PASSWORD — uses XOR'd password, specifically enters privacy mode. Model conflates with SET PASSWORD pwd_id=privacy.
|
|
|
|
4. **16-bit counter (block 79)** has special increment-only semantics via WRITE with specific data format. Not modeled.
|
|
|
|
5. **Protection pointer access conditions** — datasheet defines Page L / Page H with separate read/write protection bits (Extended Protection Status byte). Model uses simpler `protection_pointer` integer.
|
|
|
|
### Implementation Priority
|
|
|
|
**Next session — must haves:**
|
|
1. GET NXP SYSTEM INFO (0xAB) — static response from tag config
|
|
2. READ SIGNATURE (0xBD) — static 32-byte signature
|
|
3. ENABLE PRIVACY (0xBA) — XOR password, enter privacy mode
|
|
4. EAS/AFI password (pwd_id 0x10) — add to model
|
|
5. PROTECT PAGE (0xB6) — set protection pointer via RF
|
|
|
|
**After that — should haves:**
|
|
6. WRITE PASSWORD (0xB4)
|
|
7. LOCK PASSWORD (0xB5)
|
|
8. DESTROY (0xB9)
|
|
9. LOCK PAGE PROTECTION (0xB7)
|
|
10. 64-BIT PASSWORD PROTECTION (0xBB)
|
|
|
|
**Later — nice to haves:**
|
|
11-16. EAS subsystem, INVENTORY READ, STAY QUIET PERSISTENT, counter handling
|