updater.app, 0);

	status |= mock_expect (&updater.handler.mock, updater.handler.base.status_change,
		&updater.handler, 0, MOCK_ARG (UPDATE_STATUS_UPDATE_RECOVERY));
	status |= firmware_update_testing_flash_page_size (&updater.flash, FLASH_PAGE_SIZE);
	status |= flash_mock_expect_erase_flash_verify (&updater.flash, 0x40000, sizeof (staging_data));
	status |= flash_mock_expect_copy_flash_verify (&updater.flash, &updater.flash, 0x40000, 0x30000,
		staging_data, sizeof (staging_data));

	status |= mock_expect (&updater.handler.mock, updater.handler.base.status_change,
		&updater.handler, 0, MOCK_ARG (UPDATE_STATUS_BACKUP_ACTIVE));
	status |= mock_expect (&updater.fw.mock, updater.fw.base.load, &updater.fw, 0,
		MOCK_ARG (&updater.flash), MOCK_ARG (0x10000));
	status |= mock_expect (&updater.fw.mock, updater.fw.base.get_image_size, &updater.fw,
		sizeof (active_data));
	status |= flash_mock_expect_erase_copy_verify (&updater.flash, &updater.flash, 0x20000, 0x10000,
		active_data, sizeof (active_data));

	status |= mock_expect (&updater.handler.mock, updater.handler.base.status_change,
		&updater.handler, 0, MOCK_ARG (UPDATE_STATUS_UPDATING_IMAGE));
	status |= firmware_update_testing_flash_page_size (&updater.flash, FLASH_PAGE_SIZE);
	status |= flash_mock_expect_erase_flash_verify (&updater.flash, 0x10000, sizeof (staging_data));
	status |= flash_mock_expect_copy_flash_verify (&updater.flash, &updater.flash, 0x10000, 0x30000,
		staging_data, sizeof (staging_data));

	status |= mock_expect (&updater.handler.mock, updater.handler.base.status_change,
		&updater.handler, 0, MOCK_ARG (UPDATE_STATUS_CHECK_REVOCATION));
	status |= mock_expect (&updater.fw.mock, updater.fw.base.load, &updater.fw, 0,
		MOCK_ARG (&updater.flash), MOCK_ARG (0x10000));
	status |= mock_expect (&updater.fw.mock, updater.fw.base.get_key_manifest, &updater.fw,
		(intptr_t) &updater.manifest);
	status |= mock_expect (&updater.manifest.mock, updater.manifest.base.revokes_old_manifest,
		&updater.manifest, 0);

	status |= mock_expect (&updater.handler.mock, updater.handler.base.status_change,
		&updater.handler, 0, MOCK_ARG (UPDATE_STATUS_CHECK_RECOVERY));

	CuAssertIntEquals (test, 0, status);

	status = firmware_update_run_update (&updater.test_mock.base, &updater.handler.base);
	CuAssertIntEquals (test, 0, status);

	firmware_update_testing_validate_and_release (test, &updater);
}

static void firmware_update_test_validate_recovery_image_load_verify_bad_format (CuTest *test)
{
	struct firmware_update_testing updater;
	int status;
	uint8_t active_data[] = {0x01, 0x02, 0x03, 0x04};
	uint8_t staging_data[] = {0x11, 0x12, 0x13, 0x14, 0x15};

	TEST_START;

	firmware_update_testing_init_mock (test, &updater, 0, 0, 0);

	firmware_update_mock_enable_verify_boot_image (&updater.test_mock);

	firmware_update_set_recovery_good (&updater.test_mock.base, true);

	status = mock_expect (&updater.fw.mock, updater.fw.base.load, &updater.fw,
		FIRMWARE_IMAGE_INVALID_FORMAT, MOCK_ARG (&updater.flash), MOCK_ARG (0x40000));

	CuAssertIntEquals (test, 0, status);

	status = firmware_update_validate_recovery_image (&updater.test_mock.base);
	CuAssertIntEquals (test, 0, status);

	firmware_update_testing_validate (test, &updater);

	/* The recovery image validated as bad, so the update should update recovery first. */

	status = mock_expect (&updater.handler.mock, updater.handler.base.status_change,
		&updater.handler, 0, MOCK_ARG (UPDATE_STATUS_VERIFYING_IMAGE));
	status |= mock_expect (&updater.fw.mock, updater.fw.base.load, &updater.fw, 0,
		MOCK_ARG (&updater.flash), MOCK_ARG (0x30000));
	status |= mock_expect (&updater.fw.mock, updater.fw.base.verify, &updater.fw, 0,
		MOCK_ARG (&updater.hash), MOCK_ARG (&updater.rsa));
	status |= mock_expect (&updater.fw.mock, updater.fw.base.get_firmware_header, &updater.fw,
		(intptr_t) &updater.header);
	status |= mock_expect (&updater.fw.mock, updater.fw.base.get_image_size, &updater.fw,
		sizeof (staging_data));

	status |= mock_expect (&updater.handler.mock, updater.handler.base.status_change,
		&updater.handler, 0, MOCK_ARG (UPDATE_STATUS_SAVING_STATE));
	status |= mock_expect (&updater.app.mock, updater.app.base.save, &updater.app, 0);

	status |= mock_expect (&updater.handler.mock, updater.handler.base.status_change,
		&updater.handler, 0, MOCK_ARG (UPDATE_STATUS_UPDATE_RECOVERY));
	status |= firmware_update_testing_flash_page_size (&updater.flash, FLASH_PAGE_SIZE);
	status |= flash_mock_expect_erase_flash_verify (&updater.flash, 0x40000, sizeof (staging_data));
	status |= flash_mock_expect_copy_flash_verify (&updater.flash, &updater.flash, 0x40000, 0x30000,
		staging_data, sizeof (staging_data));

	status |= mock_expect (&updater.handler.mock, updater.handler.base.status_change,
		&updater.handler, 0, MOCK_ARG (UPDATE_STATUS_BACKUP_ACTIVE));
	status |= mock_expect (&updater.fw.mock, updater.fw.base.load, &updater.fw, 0,
		MOCK_ARG (&updater.flash), MOCK_ARG (0x10000));
	status |= mock_expect (&updater.fw.mock, updater.fw.base.get_image_size, &updater.fw,
		sizeof (active_data));
	status |= flash_mock_expect_erase_copy_verify (&updater.flash, &updater.flash, 0x20000, 0x10000,
		active_data, sizeof (active_data));

	status |= mock_expect (&updater.handler.mock, updater.handler.base.status_change,
		&updater.handler, 0, MOCK_ARG (UPDATE_STATUS_UPDATING_IMAGE));
	status |= firmware_update_testing_flash_page_size (&updater.flash, FLASH_PAGE_SIZE);
	status |= flash_mock_expect