SI1Security for EFR32MG2x Wireless SoCs
TrustZone, Secure Vault, Secure Boot and OTA security on Silicon Labs Series 2
Objectives
|
- Target: EFR32MG2x Series 2 board
- OS context: bare-metal / Micrium, Zephyr paths mentioned as reference only
- Embedded firmware developers and technical leads with a working knowledge of C/C++.
- Working knowledge of C programming (functions, pointers, memory management)
- Basic familiarity with embedded systems concepts (MCU, firmware, cross-compilation)
- No prior security expertise required
- Prerequisites are checked before the training.
- Progress is assessed by the trainer through the practical exercises, and by quizzes for sections without exercises.
- Each trainee receives a completion certificate.
- If a prerequisite gap appears, alternative or additional training is offered.
Course Outline
- EFR32MG21/MG24 core
- Secure Engine (SE)
- Security building blocks on Series 2
- Secure Vault
- Series 2 SE Firmware
- Cyber Resilience ACT Mapping
- TrustZone for ARMv8-M
- Operation states and modes
- Register banking between security states
- Memory model in TrustZone
- System Private Peripheral Bus (PPB)
- Secure and Non-Secure MPU
- Exception handling and the Security Extension
| Exercise: | • | MPU |
| • | Secure App |
- SAU (Security Attribution Unit)
- IDAU / ESAU
- SMU (Security Management Unit)
- Memory partitioning on EFR32MG2x
- Peripheral security attribution
- System Security Controller and wrapper components
- Debug access and TrustZone
| Exercise: | Configure SAU and SMU | |
- Two-image project structure
- NSC (Non-Secure Callable) veneer functions
- Calling conventions across the security boundary
- Secure world services
- TF-M (Trusted Firmware-M)
| Exercise: | Implement a minimal Secure monitor | |
- Purpose of Secure Boot
- Root of Trust and Secure Loader (RTSL)
- Boot chain on Series 2 HSE/VSE devices
- Signature algorithm
- Certificate-based Secure Boot
- OTP memory on Series 2
- Public Sign Key
- Secure Boot Enable flag
- Anti-Rollback Enable flag
- Flash page lock settings
- SE OTP provisioning workflow
- Custom Part Manufacturing Service (CPMS)
| Exercise: | Read current SE OTP configuration with sl_se_read_otp() | |
- Gecko Bootloader architecture
- GBL (Gecko Bootloader image format)
- Enabling Secure Boot in the SSB
- Generating the ECDSA key pair
- Signing an application image
- Signing a GBL upgrade file
- Bootloader version and anti-rollback
- Upgrading a bootloader without Secure Boot to a bootloader with Secure Boot
| Exercise: | Build a Gecko Bootloader with Secure Boot | |
| Exercise: | Anti-rollback | |
- Debug access port
- Three debug lock properties
- Standard debug lock
- Secure debug unlock
- TrustZone debug authentication
- Production lockdown checklist
- Secure OTA pipeline
- GBL file integrity
- OTA path vs Gecko Bootloader integration
- Staged slots
- Encrypted firmware images
- Vulnerability Management (CRA)
More
To book a training session or for more information, please contact us on info@ac6-training.com.
Registrations are accepted till one week before the start date for scheduled classes. For late registrations, please consult us.
You can also fill and send us the registration form
This course can be provided either remotely, in our Paris training center or worldwide on your premises.
Scheduled classes are confirmed as soon as there is two confirmed bookings. Bookings are accepted until 1 week before the course start.
Last update of course schedule: 27 June 2026
Booking one of our trainings is subject to our General Terms of Sales