Add final sanity check after boot hook

F/3302

src/update_flash.c

@@ -1594,6 +1594,9 @@ void RAMFUNCTION wolfBoot_start(void)
 
 #ifdef WOLFBOOT_HOOK_BOOT
     wolfBoot_hook_boot(&boot);
+#endif
+#ifndef WOLFBOOT_SKIP_BOOT_VERIFY
+    PART_SANITY_CHECK(&boot);
 #endif
     do_boot((void *)boot.fw_base);
 }

tools/unit-tests/Makefile

@@ -49,6 +49,7 @@ TESTS:=unit-parser unit-fdt unit-extflash unit-string unit-spi-flash unit-aes128
        unit-max-space \
        unit-image unit-image-rsa unit-nvm unit-nvm-flagshome unit-enc-nvm \
        unit-enc-nvm-flagshome unit-delta unit-update-flash unit-update-flash-delta \
+       unit-update-flash-hook \
        unit-update-flash-self-update \
        unit-update-flash-enc unit-update-ram unit-update-ram-nofixed unit-pkcs11_store unit-psa_store unit-disk \
        unit-update-disk unit-multiboot unit-boot-x86-fsp unit-loader-tpm-init unit-qspi-flash unit-fwtpm-stub unit-tpm-rsa-exp \
@@ -106,6 +107,10 @@ unit-psa_store:CFLAGS+=-I$(WOLFBOOT_LIB_WOLFPSA) -DMOCK_PARTITIONS -DMOCK_KEYVAU
 unit-update-flash:CFLAGS+=-DMOCK_PARTITIONS -DWOLFBOOT_NO_SIGN -DUNIT_TEST_AUTH \
 	-DWOLFBOOT_HASH_SHA256 -DPRINTF_ENABLED -DEXT_FLASH -DPART_UPDATE_EXT -DPART_SWAP_EXT \
 	-DWOLFBOOT_ORIGIN=MOCK_ADDRESS_BOOT -DBOOTLOADER_PARTITION_SIZE=WOLFBOOT_PARTITION_SIZE
+unit-update-flash-hook:CFLAGS+=-DMOCK_PARTITIONS -DWOLFBOOT_NO_SIGN -DUNIT_TEST_AUTH \
+	-DWOLFBOOT_HASH_SHA256 -DPRINTF_ENABLED -DEXT_FLASH -DPART_UPDATE_EXT -DPART_SWAP_EXT \
+	-DWOLFBOOT_HOOK_BOOT -DWOLFBOOT_ORIGIN=MOCK_ADDRESS_BOOT \
+	-DBOOTLOADER_PARTITION_SIZE=WOLFBOOT_PARTITION_SIZE
 unit-update-flash-delta:CFLAGS+=-DMOCK_PARTITIONS -DWOLFBOOT_NO_SIGN -DUNIT_TEST_AUTH \
 	-DWOLFBOOT_HASH_SHA256 -DPRINTF_ENABLED -DEXT_FLASH -DPART_UPDATE_EXT -DPART_SWAP_EXT \
 	-DDELTA_UPDATES -DDELTA_BLOCK_SIZE=512 -D__WOLFBOOT \
@@ -311,6 +316,9 @@ unit-delta: ../../include/target.h unit-delta.c
 unit-update-flash: ../../include/target.h unit-update-flash.c
 	gcc -o $@ unit-update-flash.c ../../src/image.c $(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/sha256.c $(CFLAGS) $(LDFLAGS)
 
+unit-update-flash-hook: ../../include/target.h unit-update-flash.c
+	gcc -o $@ unit-update-flash.c ../../src/image.c $(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/sha256.c $(CFLAGS) $(LDFLAGS)
+
 unit-update-flash-delta: ../../include/target.h unit-update-flash.c
 	gcc -o $@ unit-update-flash.c ../../src/image.c ../../src/delta.c \
 	$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/sha256.c $(CFLAGS) $(LDFLAGS)

tools/unit-tests/unit-update-flash.c

@@ -187,6 +187,9 @@ Suite *wolfboot_suite(void);
 
 int wolfBoot_staged_ok = 0;
 const uint32_t *wolfBoot_stage_address = (uint32_t *) 0xFFFFFFFF;
+#ifdef WOLFBOOT_HOOK_BOOT
+static int mock_hook_corrupt_signature = 0;
+#endif
 #ifdef RAM_CODE
 static int arch_reboot_called = 0;
 unsigned int _start_text = MOCK_ADDRESS_BOOT;
@@ -211,6 +214,14 @@ int hal_flash_protect(haladdr_t address, int len)
     return 0;
 }
 
+#ifdef WOLFBOOT_HOOK_BOOT
+void wolfBoot_hook_boot(struct wolfBoot_image *boot_img)
+{
+    if (mock_hook_corrupt_signature != 0)
+        boot_img->signature_ok = 0;
+}
+#endif
+
 static void reset_mock_stats(void)
 {
     wolfBoot_staged_ok = 0;
@@ -237,6 +248,9 @@ static void reset_mock_stats(void)
     mock_wb_patch_init_patch = NULL;
     mock_wb_patch_init_psz = 0;
 #endif
+#ifdef WOLFBOOT_HOOK_BOOT
+    mock_hook_corrupt_signature = 0;
+#endif
 }
 
 static void clear_erase_stats(void)
@@ -715,6 +729,23 @@ START_TEST (test_sunnyday_noupdate)
 }
 END_TEST
 
+#ifdef WOLFBOOT_HOOK_BOOT
+START_TEST (test_hook_mutation_triggers_final_sanity_check)
+{
+    reset_mock_stats();
+    prepare_flash();
+    add_payload(PART_BOOT, 1, TEST_SIZE_SMALL);
+
+    mock_hook_corrupt_signature = 1;
+    wolfBoot_start();
+
+    ck_assert(wolfBoot_panicked);
+    ck_assert(!wolfBoot_staged_ok);
+    cleanup_flash();
+}
+END_TEST
+#endif
+
 START_TEST (test_forward_update_samesize_notrigger) {
     reset_mock_stats();
     prepare_flash();
@@ -1388,6 +1419,9 @@ Suite *wolfboot_suite(void)
     tcase_add_test(empty_panic, test_empty_panic);
     tcase_add_test(empty_panic, test_part_sanity_check_panics_on_sha_mismatch);
     tcase_add_test(empty_panic, test_part_sanity_check_panics_on_signature_mismatch);
+#ifdef WOLFBOOT_HOOK_BOOT
+    tcase_add_test(empty_panic, test_hook_mutation_triggers_final_sanity_check);
+#endif
     tcase_add_test(sunnyday_noupdate, test_sunnyday_noupdate);
     tcase_add_test(forward_update_samesize, test_forward_update_samesize);
     tcase_add_test(forward_update_tolarger, test_forward_update_tolarger);