7.1.8 OTP Matrix

Once the at91bootstrap program works successfully in Secure mode, the secure-mode bit can be permanently set in the device OTP matrix using the following commands:

Disable emulation if it was enabled earlier:

$ sam-ba -p serial -d sam9x7 -a bootconfig -c writecfg:bscr:EMULATION_DISABLED

Invalidate the Secure Boot Configuration Packet if it was previously written in Secure mode:
```
$ sam-ba -p secure -d sam9x7 -a bootconfig -c invalidatecfg:sbcp-otp
```

Refresh the Boot Configuration Packet:

$ sam-ba -p serial -d sam9x7 -a bootconfig -c refreshcfg:otp

Enable Secure Boot mode:

$ sam-ba -p serial -d sam9x7 -a bootconfig -c writecfg:sbcp-otp:SECURE_BOOT_ENABLED

After running the secure-mode command, the following prompt should appear after reset:

Secure Boot Mode

Finally, load the customer key into the SAM9X7 Series MPU:

$ sam-ba -p secure -d sam9x7 -m write_customer_key_payload:customer-key.cip