Introduction
The SAM9X7 Series MPU boot sequence initializes the device and loads the second-stage bootloader for execution. The SAM9X7 Series MPU is designed to boot in one of two modes: Standard Boot or Secure Boot.
- Standard Boot mode is used to load an unencrypted and unsigned program from external Flash memory at boot time. This mode of operation is suitable for many designs and is preferred for development because it requires fewer steps between making a code modification and running the code.
- Secure Boot mode is used to load an encrypted and authenticated program from external non-volatile memory (NVM) at boot time. The ROM code first verifies the authenticity of the encrypted image and only proceeds with decryption if authentication is successful. This authenticate-then-decrypt approach ensures that tampered images are rejected without further processing. The bootstrap binary is encrypted to protect both its contents and the keys it carries for authenticating and deciphering subsequent boot stages.
This application note describes the Secure Boot mode procedure and explains how to prepare the second-stage bootloader binary by adding encryption and generating key certificates for added security. Secure boot helps prevent unauthorized software from being booted on the SAM9X7 Series MPU. This application note was written for a SAM9X75-Curiosity board but can be adapted for any SAM9X7 Series system.