7.2.7 Provision the Board Using the SAM-BA® Tool

Previously, the secure_sam_ba_cipher program was used to prepare the following encrypted/signed files:

u-boot.cip: encrypted and signed U-Boot
boot.cip: encrypted and signed at91bootstrap program
customer-key.cip: encrypted and signed customer key

The u-boot.cip and boot.cip files are copied to the boot media, which, in this case, is the SD card. The customer-key.cip and cert-hash.cip files are provisioned into the SAM9X7 Series MPU via the SAM-BA Secure Monitor and must not be stored on the boot media.

The MPU should be placed into Secure mode using SAM-BA. Before running the command, make sure the end device is running the SAM-BA Monitor and that a USB cable is connected to the host. Note the device name that is enumerated when the USB cable is plugged in. In this case, the console is /dev/ttyUSB0, and the SAM-BA interface is /dev/ttyACM0.

When the RomBOOT prompt appears, use SAM-BA to place the MPU into Secure Boot mode:

Enable emulation:

$ sam-ba -p serial -d sam9x7 -a bootconfig -c writecfg:bscr:EMULATION_ENABLED

Reset emulation:

$ sam-ba -p serial -d sam9x7 -a bootconfig -c resetemul

Refresh emulation:

$ sam-ba -p serial -d sam9x7 -a bootconfig -c refreshcfg:emul

Enable Secure Boot mode:

$ sam-ba -p serial -d sam9x7 -a bootconfig -c writecfg:sbcp-emul:SECURE_BOOT_ENABLED

After running the secure-mode command, the following prompt should appear after reset:

Secure Boot Mode

Finally, load the customer key into the SAM9X7 Series MPU:

$ sam-ba -p secure -d sam9x7 -m write_customer_key_payload:customer-key.cip