Other Parts Discussed in Thread: BQSTUDIO
Hello, we've been trying to put our BQ chips into FULLACCESS mode so that we can write to the OTP flash but we're having issues. We're using the default keys (this was confirmed by reading their values from the BQ) and following the procedure on page 71 of the Technical Reference Manual:
When using the codes by writing them to 0x3E and 0x3F, they must be sent in little endian order; therefore, if 0x1234 and 0x5678 are written as the unseal codes to 0x0035 SECURITY_KEYS(), then to unseal requires writing 0x34 and 0x12 to 0x3E and 0x3F, followed by writing 0x78 and 0x56 to 0x3E and 0x3F. The two codes must be written within 4 s of each other to succeed.
We're verifying the mode of the BQ by reading the SEC 1:0 bits in the Battery Status (0x12) register. We are writing 0x14 to 0x3E (actually 0xBE with the write bit) and 0x04 to 0x3F, then we write the CRC and data length. We then repeat this with 0x72 going to 0x3E and 0x36 to 0x3F within around 40 ms. When we read the SEC 1:0 bits again, there's no change and it shows that we're still in SEALED mode.
Do you think there's anything we could be missing?
