2 Secure Boot Tasks

To enable a secure boot system:
  1. Prepare the cryptographic material. Keys and certificates must be generated and placed in the appropriate locations.
  2. Prepare the software to be loaded, including the Linux® kernel, Linux Device Tree and bootloader programs.
  3. Encrypt the second-stage bootloader (at91bootstrap) using AES-CBC, then compute the CMAC (or RSA signature) for the encrypted image.
  4. Configure the third-stage bootloader (U-Boot), and store, encrypt and sign the public keys.
  5. Package the Linux kernel and device tree into a signed FIT file and sign it properly.
  6. Configure the SAM9X7 Series MPU to operate in Secure Boot mode.
  7. Load the keys into the MPU.
  8. Optionally, permanently program the Secure Boot mode and keys into the device OTP matrix.