fix(legacy): don't erase firmware and storage in intermediate firmware ... #1600
Conversation
|
Switching back to draft - we need to polish the details before merging this one in. |
prusnak
force-pushed
the
legacy-interim-dont-erase
branch
from
24859f4 to
044cda4
Compare
prusnak
changed the title
prusnak
changed the title
legacy/intermediate_fw/trezor.c
Outdated
| @@ -67,16 +74,15 @@ erase_firmware_and_storage(void) { | |||
| FLASH_KEYR = FLASH_KEYR_KEY1; | |||
| FLASH_KEYR = FLASH_KEYR_KEY2; | |||
|
|
|||
| // Erase storage sectors to prevent firmware downgrade to vulnerable version | |||
| // Erase storage sectors | |||
There was a problem hiding this comment.
I changed the comment - downgrade is already prevented, because the firmware has a whitelist of recognized bootloaders (in check_and_replace_bootloader below), so it halts before proceeding if an unknown bootloader is found (a bootloader from the future would be unknown).
Open question is - do we event want to delete the storage here? Bootloader will take care of deletion when an unofficial firmware (or a non-firmware) is found during the firmware update. I guess this does not hurt, but probably causes the storage erasure twice (once here and once the bootloader performs a firmware update).
There was a problem hiding this comment.
I think you are correct that we don't need to erase the storage here.
There was a problem hiding this comment.
Ok, addressed in another fixup - b4c7d22
if the storage has been already initialized
prusnak
force-pushed
the
legacy-interim-dont-erase
branch
from
b4c7d22 to
b1f5c49
Compare
... if the storage has been already initialized
Possible fix for #1597