coldcard/firmware
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Flash ECC note

Browse Source
This commit is contained in:
Peter D. Gray 2022-02-23 13:23:08 -05:00
parent ae988abcae
commit 322c6e669c
No known key found for this signature in database
GPG Key ID: F0E6CC6AFC16CF7B
1 changed files with 22 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
docs/mk4-security-model.md
View File

@ -256,3 +256,25 @@ If any other parts of flash---beyond the normal upgradable firmware
area---have also been corrupted, this process will not work and the
unit will be a brick.
## Flash ECC (Error Detection/Correction Codes)
Flash memory cells in this MCU are protected by ECC bits. An
additional 8 bits are calculated and stored alongside each 64-bit
value. This allows detecting any 2-bits changing and correction of
up to 1-bit error per 64 bits.
When a corrupted flash memory word is detected, an NMI (non maskable
interrupt) is caused which will crash the microprocessor. This
typically happens during boot-up when the checksum over flash memory
is performed.
We know of no legitimate way for this to occur, so we will assume
that it's an attack, such as exposing the bare die to targeted UV-C
radiation. If the attacker is able to flip 2 or more bits, then
this will effectively brick the COLDCARD once the ECC error is detected.
Critical flash cells, such as those that prevent both JTAG access,
are not a single bit (it's a special bit pattern), and regardless
are protected via ECC the same as other flash cells.