A Complete Secure Boot, Storage, and OTA Pipeline on MYIR's i.MX93 Platform

MYIR has released the V2.0.0 software version for its NXP i.MX93 based MYD-LMX9X Development Board. This upgrade prioritizes system security by integrating the EdgeLock® Secure Enclave hardware trust root, delivering a comprehensive three-in-one protection framework encompassing secure boot (AHAB), secure storage, and secure OTA updates. Additionally, the Yocto, UBoot, and Kernel versions have been significantly enhanced, providing a robust foundation for industrial IoT, automotive, and high-security applications.

1. The Compliance Crunch

If you're shipping an industrial gateway or vehicle-mounted controller to Europe or North America, you've seen the same requirement coming up in every RFQ: IEC 62443-4-2 for industrial cybersecurity, ISO 21434 for automotive, or CRA (Cyber Resilience Act) readiness for the EU market.

The checklist typically demands:

• Secure boot — verified trust chain from ROM to OS

• Encrypted storage — data at rest protected against physical removal

• Signed firmware updates — with hardware-backed rollback protection

• SBOM — software bill of materials for customs and procurement

Most teams stitch this together with hand-patched U-Boot, custom OP-TEE key derivation, and SWUpdate scripts — six to eight weeks of integration, assuming nothing breaks.

Starting with V2.0.0, the MYD-LMX9X platform ships all of this pre-integrated and build-system-ready.

2. What's in V2.0.0

The update is a full-stack version leap, with security as the organizing principle:

Beyond the version numbers, V2.0.0 surfaces the i.MX 93's EdgeLock Secure Enclave through three production-ready subsystems:

• Secure Boot (AHAB) — immutable trust chain with containerized image signing

• Secure Storage — REE-FS + dm-crypt, keyed from hardware unique key (HUK)

• Secure OTA — A/B partitioning + signed SWUpdate with automatic rollback

3. Architecture: The EdgeLock Trust Chain

The i.MX 93's EdgeLock Enclave is a physically isolated security subsystem with its own ROM, firmware, and crypto accelerators. It runs independently of the Cortex-A55 application cores.

The trust chain (AHAB — Advanced High Assurance Boot):

ELE ROM (immutable) → ELE Firmware (signed) → SPL → U-Boot → ATF → Kernel
      ↑                       ↑
   SRK Hash in              Image containers signed
   OTP fuses                with CST (Code Signing Tool)

Once you sign the production images and lock the OTP, no third-party code will execute on the device — period.

4. Kernel Boot: Under One Second

Security usually adds boot latency. MYIR's team optimized V2.0.0 to the point where the numbers speak for themselves:

The 0.6 ms headless figure is achieved by deferring non-critical driver init and using a minimal initramfs that hands off directly to the application — practical for real-time controllers that must be operational within one control cycle.

Secure Storage — Two Layers, Hardware-Keyed

Both storage encryption layers derive from the i.MX 93's Hardware Unique Key (HUK), which never leaves the EdgeLock Enclave.

Layer 1: REE-FS (OP-TEE File Encryption)

• Applications call the GlobalPlatform TEE Internal Core API to store persistent objects

• Data is encrypted by the TEE before it lands on the Linux filesystem

• Encryption key = HUK + TA UUID — each trusted application gets isolation

• Raw plaintext never touches the non-secure world

Layer 2: dm-crypt Full-Disk Encryption

• dm-crypt + trusted key ring, key sealed by OP-TEE

• AES-CBC with hardware acceleration via i.MX 93 CAAM engine

• Works on eMMC, SD card, or loopback devices

• Resists physical flash removal — the key is derived from HUK, not stored on disk

Key Hierarchy (GlobalPlatform model)

HUK (hardware, non-extractable)
    ↓
SSK (Secure Storage Key)
    ↓
TSK (Trusted Storage Key)
    ↓
FEK (File Encryption Key) — unique per file object

An encrypted filesystem from device A cannot be mounted on device B, even if both run identical software.

Bonus: RPMB Anti-Replay

The eMMC RPMB partition stores monotonic write counters and certificates. Combined with the A/B OTA mechanism, it prevents attackers from reinstalling a valid-but-old firmware version as a downgrade attack.

Secure OTA — A/B Partitioning + SWUpdate

V2.0.0 assumes updates happen in the field, unattended, with no physical access:

1. A signed .swu package (RSA signature) is fetched from the update server

2. SWUpdate verifies the signature against the device's embedded public key

3. The update writes to the standby partition — the running partition is untouched

4. On success, U-Boot flips the bootslot variable

5. If boot fails 3 times (bootcount > bootlimit), altbootcmd automatically rolls back to the known-good partition

A utility script, swu_update_image_build.sh, generates the signed update package. On the server side, a basic HTTP server is all that's needed — the device polls for updates, verifies the signature, and applies the new slot.

5. One-Click Secure Build

In V2.0.0, enabling the full security stack is a build configuration change:

# In machine configuration, add:
DISTRO_FEATURES:append = " secure-boot"

# Build:
bitbake myir-image-emmc

This single command generates:

• AHAB-signed flash images (flash.bin, os_cntr_signed.bin)

• SRK Table and SRK Hash — ready for OTP efuse burning

• CST (Code Signing Tool) scripts and a pre-configured PKI tree

For A/B dual-partition builds, add DUAL_ROOTFS = "_dual" — two complete root filesystem images are produced with integrated SWUpdate logic.

SPDX SBOM

Every build emits an SPDX 3.0 Software Bill of Materials, listing every package version, license, and dependency. This satisfies:

• IEC 62443-4-1 SD-4 (software supply chain security)

• ISO 21434 Clause 15 (supply chain cybersecurity)

• EU Cyber Resilience Act (software transparency requirements)

6. Who This Is For

Resources

• SDK & documentation: developer.myir.cn

• Product page: MYD-LMX9X Development Board

• Technical support: support@myir.cn