Intermediary firmware deletes seed

[tsusanka]

Describe the bug
Intermediary FW works fine but we completely forgot we also want to give it to to users that have their device initialized. In this case Intermediary FW wipes the device completely along with seed.

Firmware version and revision
Both intermediary 1.10.0 and 1.8.0.

To Reproduce
Steps to reproduce the behavior:

1. Get device with old bootloader.
2. Initialize.
3. Upload Intermediary firmware.
4. Observe the seed is gone.

Expected behavior
Seed is kept. The Intermediary firmware wipes it which is not what we want.

[prusnak]

The fact we erase the old firmware and storage is not an oversight, but rather a feature -

trezor-firmware/legacy/intermediate_fw/trezor.c

Line 95 in 6257584

erase_firmware_and_storage();

However, this does not fit our user story when we'd like to use interim firmware also for people with initialized devices.

From my POV the only thing we need to change is to remove the call to erase_firmware_and_storage and the function itself.

This theoretically could open a possibility for an attacker to user interim FW to downgrade to possibly vulnerable bootloader version it is shipping. However, this is circumvented by calling check_and_replace_bootloader which bails out if we hit an unknown bootloader (possibly from the future):

trezor-firmware/legacy/intermediate_fw/trezor.c

Line 115 in 6257584

check_bootloader(false);

[prusnak]

Possible fix in #1600

[tsusanka]

It also removes this scary screen right?

[andrewkozlik]

As I understand it, there was a valid reason why the interim firmware deleted itself and the storage and that was to remove the need for user confirmation, see #4 (comment). Perhaps we could check whether the storage is initialized and delete the firmware and storage only if it's not. The check doesn't need to be complicated, we just need to look at the first word of the norcow sectors. On the other hand this behavior could create some complexity for Suite. Not sure.

[tsusanka]

We have agreed that we will check the storage and:

• If the storage is initialized do nothing.
• If the storage is not initialized erase both firmware and storage.

[prusnak]

Closed via #1600