Merge remote-tracking branch 'upstream/master' into apdu-parser-kk

libraries/persistent_store/fuzz/Cargo.toml

@@ -11,6 +11,8 @@ cargo-fuzz = true
 [dependencies]
 libfuzzer-sys = "0.3"
 persistent_store = { path = "..", features = ["std"] }
+rand_core = "0.5"
+rand_pcg = "0.2"
 strum = { version = "0.19", features = ["derive"] }
 
 # Prevent this from interfering with workspaces

libraries/persistent_store/fuzz/examples/store.rs

@@ -0,0 +1,116 @@
+// Copyright 2019-2020 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use fuzz_store::{fuzz, StatKey, Stats};
+use std::io::Write;
+use std::io::{stdout, Read};
+use std::path::Path;
+
+fn usage(program: &str) {
+    println!(
+        r#"Usage: {} {{ [<artifact_file>] | <corpus_directory> <bucket_predicate>.. }}
+
+If <artifact_file> is not provided, it is read from standard input.
+
+When <bucket_predicate>.. are provided, only runs matching all predicates are shown. The format of
+each <bucket_predicate> is <bucket_key>=<bucket_value>."#,
+        program
+    );
+}
+
+fn debug(data: &[u8]) {
+    println!("{:02x?}", data);
+    fuzz(data, true, None);
+}
+
+/// Bucket predicate.
+struct Predicate {
+    /// Bucket key.
+    key: StatKey,
+
+    /// Bucket value.
+    value: usize,
+}
+
+impl std::str::FromStr for Predicate {
+    type Err = String;
+
+    fn from_str(input: &str) -> Result<Self, Self::Err> {
+        let predicate: Vec<&str> = input.split('=').collect();
+        if predicate.len() != 2 {
+            return Err("Predicate should have exactly one equal sign.".to_string());
+        }
+        let key = predicate[0]
+            .parse()
+            .map_err(|_| format!("Predicate key `{}` is not recognized.", predicate[0]))?;
+        let value: usize = predicate[1]
+            .parse()
+            .map_err(|_| format!("Predicate value `{}` is not a number.", predicate[1]))?;
+        if value != 0 && !value.is_power_of_two() {
+            return Err(format!(
+                "Predicate value `{}` is not a bucket.",
+                predicate[1]
+            ));
+        }
+        Ok(Predicate { key, value })
+    }
+}
+
+fn analyze(corpus: &Path, predicates: Vec<Predicate>) {
+    let mut stats = Stats::default();
+    let mut count = 0;
+    let total = std::fs::read_dir(corpus).unwrap().count();
+    for entry in std::fs::read_dir(corpus).unwrap() {
+        let data = std::fs::read(entry.unwrap().path()).unwrap();
+        let mut stat = Stats::default();
+        fuzz(&data, false, Some(&mut stat));
+        if predicates
+            .iter()
+            .all(|p| stat.get_count(p.key, p.value).is_some())
+        {
+            stats.merge(&stat);
+        }
+        count += 1;
+        print!("\u{1b}[K{} / {}\r", count, total);
+        stdout().flush().unwrap();
+    }
+    // NOTE: To avoid reloading the corpus each time we want to check a different filter, we can
+    // start an interactive loop here taking filters as input and printing the filtered stats. We
+    // would keep all individual stats for each run in a vector.
+    print!("{}", stats);
+}
+
+fn main() {
+    let args: Vec<String> = std::env::args().collect();
+    // No arguments reads from stdin.
+    if args.len() <= 1 {
+        let stdin = std::io::stdin();
+        let mut data = Vec::new();
+        stdin.lock().read_to_end(&mut data).unwrap();
+        return debug(&data);
+    }
+    let path = Path::new(&args[1]);
+    // File argument assumes artifact.
+    if path.is_file() && args.len() == 2 {
+        return debug(&std::fs::read(path).unwrap());
+    }
+    // Directory argument assumes corpus.
+    if path.is_dir() {
+        match args[2..].iter().map(|x| x.parse()).collect() {
+            Ok(predicates) => return analyze(path, predicates),
+            Err(error) => eprintln!("Error: {}", error),
+        }
+    }
+    usage(&args[0]);
+}

libraries/persistent_store/fuzz/fuzz_targets/store.rs

@@ -17,5 +17,5 @@
 use libfuzzer_sys::fuzz_target;
 
 fuzz_target!(|data: &[u8]| {
-    // TODO(ia0): Call fuzzing when implemented.
+    fuzz_store::fuzz(data, false, None);
 });

libraries/persistent_store/fuzz/src/lib.rs

@@ -25,13 +25,12 @@
 //!   situation where coverage takes precedence over surjectivity is for the value of insert updates
 //!   where a pseudo-random generator is used to avoid wasting entropy.
 
-// TODO(ia0): Remove when used.
-#![allow(dead_code)]
-
 mod histogram;
 mod stats;
+mod store;
 
 pub use stats::{StatKey, Stats};
+pub use store::fuzz;
 
 /// Bit-level entropy source based on a byte slice shared reference.
 ///

libraries/persistent_store/fuzz/src/store.rs

@@ -0,0 +1,544 @@
+// Copyright 2019-2020 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use crate::stats::{StatKey, Stats};
+use crate::Entropy;
+use persistent_store::{
+    BufferOptions, BufferStorage, Store, StoreDriver, StoreDriverOff, StoreDriverOn,
+    StoreInterruption, StoreInvariant, StoreOperation, StoreUpdate,
+};
+use rand_core::{RngCore, SeedableRng};
+use rand_pcg::Pcg32;
+use std::collections::HashMap;
+use std::convert::TryInto;
+
+// NOTE: We should be able to improve coverage by only checking the last operation. Because
+// operations before the last could be checked with a shorter entropy.
+
+/// Checks the store against a sequence of manipulations.
+///
+/// The entropy to generate the sequence of manipulation should be provided in `data`. Debugging
+/// information is printed if `debug` is set. Statistics are gathered if `stats` is set.
+pub fn fuzz(data: &[u8], debug: bool, stats: Option<&mut Stats>) {
+    let mut fuzzer = Fuzzer::new(data, debug, stats);
+    let mut driver = fuzzer.init();
+    let store = loop {
+        if fuzzer.debug {
+            print!("{}", driver.storage());
+        }
+        if let StoreDriver::On(driver) = &driver {
+            if !fuzzer.init.is_dirty() {
+                driver.check().unwrap();
+            }
+            if fuzzer.debug {
+                println!("----------------------------------------------------------------------");
+            }
+        }
+        if fuzzer.entropy.is_empty() {
+            if fuzzer.debug {
+                println!("No more entropy.");
+            }
+            if fuzzer.init.is_dirty() {
+                return;
+            }
+            fuzzer.record(StatKey::FinishedLifetime, 0);
+            break driver.power_on().unwrap().extract_store();
+        }
+        driver = match driver {
+            StoreDriver::On(driver) => match fuzzer.apply(driver) {
+                Ok(x) => x,
+                Err(store) => {
+                    if fuzzer.debug {
+                        println!("No more lifetime.");
+                    }
+                    if fuzzer.init.is_dirty() {
+                        return;
+                    }
+                    fuzzer.record(StatKey::FinishedLifetime, 1);
+                    break store;
+                }
+            },
+            StoreDriver::Off(driver) => fuzzer.power_on(driver),
+        }
+    };
+    let virt_window = (store.format().num_pages() * store.format().virt_page_size()) as usize;
+    let init_lifetime = fuzzer.init.used_cycles() * virt_window;
+    let lifetime = store.lifetime().unwrap().used() - init_lifetime;
+    fuzzer.record(StatKey::UsedLifetime, lifetime);
+    fuzzer.record(StatKey::NumCompactions, lifetime / virt_window);
+    fuzzer.record_counters();
+}
+
+/// Fuzzing state.
+struct Fuzzer<'a> {
+    /// Remaining fuzzing entropy.
+    entropy: Entropy<'a>,
+
+    /// Unlimited pseudo entropy.
+    ///
+    /// This source is only used to generate the values of entries. This is a compromise to avoid
+    /// consuming fuzzing entropy for low additional coverage.
+    values: Pcg32,
+
+    /// The fuzzing mode.
+    init: Init,
+
+    /// Whether debugging is enabled.
+    debug: bool,
+
+    /// Whether statistics should be gathered.
+    stats: Option<&'a mut Stats>,
+
+    /// Statistics counters (only used when gathering statistics).
+    ///
+    /// The counters are written to the statistics at the end of the fuzzing run, when their value
+    /// is final.
+    counters: HashMap<StatKey, usize>,
+}
+
+impl<'a> Fuzzer<'a> {
+    /// Creates an initial fuzzing state.
+    fn new(data: &'a [u8], debug: bool, stats: Option<&'a mut Stats>) -> Fuzzer<'a> {
+        let mut entropy = Entropy::new(data);
+        let seed = entropy.read_slice(16);
+        let values = Pcg32::from_seed(seed[..].try_into().unwrap());
+        let mut fuzzer = Fuzzer {
+            entropy,
+            values,
+            init: Init::Clean,
+            debug,
+            stats,
+            counters: HashMap::new(),
+        };
+        fuzzer.init_counters();
+        fuzzer.record(StatKey::Entropy, data.len());
+        fuzzer
+    }
+
+    /// Initializes the fuzzing state and returns the store driver.
+    fn init(&mut self) -> StoreDriver {
+        let mut options = BufferOptions {
+            word_size: 4,
+            page_size: 1 << self.entropy.read_range(5, 12),
+            max_word_writes: 2,
+            max_page_erases: self.entropy.read_range(0, 50000),
+            strict_mode: true,
+        };
+        let num_pages = self.entropy.read_range(3, 64);
+        self.record(StatKey::PageSize, options.page_size);
+        self.record(StatKey::MaxPageErases, options.max_page_erases);
+        self.record(StatKey::NumPages, num_pages);
+        if self.debug {
+            println!("page_size: {}", options.page_size);
+            println!("num_pages: {}", num_pages);
+            println!("max_cycle: {}", options.max_page_erases);
+        }
+        let storage_size = num_pages * options.page_size;
+        if self.entropy.read_bit() {
+            self.init = Init::Dirty;
+            let mut storage = vec![0xff; storage_size].into_boxed_slice();
+            let length = self.entropy.read_range(0, storage_size);
+            self.record(StatKey::DirtyLength, length);
+            for byte in &mut storage[0..length] {
+                *byte = self.entropy.read_byte();
+            }
+            if self.debug {
+                println!("Start with dirty storage.");
+            }
+            options.strict_mode = false;
+            let storage = BufferStorage::new(storage, options);
+            StoreDriver::Off(StoreDriverOff::new_dirty(storage))
+        } else if self.entropy.read_bit() {
+            let cycle = self.entropy.read_range(0, options.max_page_erases);
+            self.init = Init::Used { cycle };
+            if self.debug {
+                println!("Start with {} consumed erase cycles.", cycle);
+            }
+            self.record(StatKey::InitCycles, cycle);
+            let storage = vec![0xff; storage_size].into_boxed_slice();
+            let mut storage = BufferStorage::new(storage, options);
+            Store::init_with_cycle(&mut storage, cycle);
+            StoreDriver::Off(StoreDriverOff::new_dirty(storage))
+        } else {
+            StoreDriver::Off(StoreDriverOff::new(options, num_pages))
+        }
+    }
+
+    /// Powers a driver with possible interruption.
+    fn power_on(&mut self, driver: StoreDriverOff) -> StoreDriver {
+        if self.debug {
+            println!("Power on the store.");
+        }
+        self.increment(StatKey::PowerOnCount);
+        let interruption = self.interruption(driver.delay_map());
+        match driver.partial_power_on(interruption) {
+            Err((storage, _)) if self.init.is_dirty() => {
+                self.entropy.consume_all();
+                StoreDriver::Off(StoreDriverOff::new_dirty(storage))
+            }
+            Err(error) => self.crash(error),
+            Ok(driver) => driver,
+        }
+    }
+
+    /// Generates and applies an operation with possible interruption.
+    fn apply(&mut self, driver: StoreDriverOn) -> Result<StoreDriver, Store<BufferStorage>> {
+        let operation = self.operation(&driver);
+        if self.debug {
+            println!("{:?}", operation);
+        }
+        let interruption = self.interruption(driver.delay_map(&operation));
+        match driver.partial_apply(operation, interruption) {
+            Err((store, _)) if self.init.is_dirty() => {
+                self.entropy.consume_all();
+                Err(store)
+            }
+            Err((store, StoreInvariant::NoLifetime)) => Err(store),
+            Err((store, error)) => self.crash((store.extract_storage(), error)),
+            Ok((error, driver)) => {
+                if self.debug {
+                    if let Some(error) = error {
+                        println!("{:?}", error);
+                    }
+                }
+                Ok(driver)
+            }
+        }
+    }
+
+    /// Reports a broken invariant and terminates fuzzing.
+    fn crash(&self, error: (BufferStorage, StoreInvariant)) -> ! {
+        let (storage, invariant) = error;
+        if self.debug {
+            print!("{}", storage);
+        }
+        panic!("{:?}", invariant);
+    }
+
+    /// Records a statistics if enabled.
+    fn record(&mut self, key: StatKey, value: usize) {
+        if let Some(stats) = &mut self.stats {
+            stats.add(key, value);
+        }
+    }
+
+    /// Increments a counter if statistics are enabled.
+    fn increment(&mut self, key: StatKey) {
+        if self.stats.is_some() {
+            *self.counters.get_mut(&key).unwrap() += 1;
+        }
+    }
+
+    /// Initializes all counters if statistics are enabled.
+    fn init_counters(&mut self) {
+        if self.stats.is_some() {
+            use StatKey::*;
+            self.counters.insert(PowerOnCount, 0);
+            self.counters.insert(TransactionCount, 0);
+            self.counters.insert(ClearCount, 0);
+            self.counters.insert(PrepareCount, 0);
+            self.counters.insert(InsertCount, 0);
+            self.counters.insert(RemoveCount, 0);
+            self.counters.insert(InterruptionCount, 0);
+        }
+    }
+
+    /// Records all counters if statistics are enabled.
+    fn record_counters(&mut self) {
+        if let Some(stats) = &mut self.stats {
+            for (&key, &value) in self.counters.iter() {
+                stats.add(key, value);
+            }
+        }
+    }
+
+    /// Generates a possibly invalid operation.
+    fn operation(&mut self, driver: &StoreDriverOn) -> StoreOperation {
+        let format = driver.model().format();
+        match self.entropy.read_range(0, 2) {
+            0 => {
+                // We also generate an invalid count (one past the maximum value) to test the error
+                // scenario. Since the test for the error scenario is monotonic, this is a good
+                // compromise to keep entropy bounded.
+                let count = self
+                    .entropy
+                    .read_range(0, format.max_updates() as usize + 1);
+                let mut updates = Vec::with_capacity(count);
+                for _ in 0..count {
+                    updates.push(self.update());
+                }
+                self.increment(StatKey::TransactionCount);
+                StoreOperation::Transaction { updates }
+            }
+            1 => {
+                let min_key = self.key();
+                self.increment(StatKey::ClearCount);
+                StoreOperation::Clear { min_key }
+            }
+            2 => {
+                // We also generate an invalid length (one past the total capacity) to test the
+                // error scenario. See the explanation for transactions above for why it's enough.
+                let length = self
+                    .entropy
+                    .read_range(0, format.total_capacity() as usize + 1);
+                self.increment(StatKey::PrepareCount);
+                StoreOperation::Prepare { length }
+            }
+            _ => unreachable!(),
+        }
+    }
+
+    /// Generates a possibly invalid update.
+    fn update(&mut self) -> StoreUpdate {
+        match self.entropy.read_range(0, 1) {
+            0 => {
+                let key = self.key();
+                let value = self.value();
+                self.increment(StatKey::InsertCount);
+                StoreUpdate::Insert { key, value }
+            }
+            1 => {
+                let key = self.key();
+                self.increment(StatKey::RemoveCount);
+                StoreUpdate::Remove { key }
+            }
+            _ => unreachable!(),
+        }
+    }
+
+    /// Generates a possibly invalid key.
+    fn key(&mut self) -> usize {
+        // Use 4096 as the canonical invalid key.
+        self.entropy.read_range(0, 4096)
+    }
+
+    /// Generates a possibly invalid value.
+    fn value(&mut self) -> Vec<u8> {
+        // Use 1024 as the canonical invalid length.
+        let length = self.entropy.read_range(0, 1024);
+        let mut value = vec![0; length];
+        self.values.fill_bytes(&mut value);
+        value
+    }
+
+    /// Generates an interruption.
+    ///
+    /// The `delay_map` describes the number of modified bits by the upcoming sequence of store
+    /// operations.
+    // TODO(ia0): We use too much CPU to compute the delay map. We should be able to just count the
+    // number of storage operations by checking the remaining delay. We can then use the entropy
+    // directly from the corruption function because it's called at most once.
+    fn interruption(
+        &mut self,
+        delay_map: Result<Vec<usize>, (usize, BufferStorage)>,
+    ) -> StoreInterruption {
+        if self.init.is_dirty() {
+            // We only test that the store can power on without crashing. If it would get
+            // interrupted then it's like powering up with a different initial state, which would be
+            // tested with another fuzzing input.
+            return StoreInterruption::none();
+        }
+        let delay_map = match delay_map {
+            Ok(x) => x,
+            Err((delay, storage)) => {
+                print!("{}", storage);
+                panic!("delay={}", delay);
+            }
+        };
+        let delay = self.entropy.read_range(0, delay_map.len() - 1);
+        let mut complete_bits = BitStack::default();
+        for _ in 0..delay_map[delay] {
+            complete_bits.push(self.entropy.read_bit());
+        }
+        if self.debug {
+            if delay == delay_map.len() - 1 {
+                assert!(complete_bits.is_empty());
+                println!("Do not interrupt.");
+            } else {
+                println!(
+                    "Interrupt after {} operations with complete mask {}.",
+                    delay, complete_bits
+                );
+            }
+        }
+        if delay < delay_map.len() - 1 {
+            self.increment(StatKey::InterruptionCount);
+        }
+        let corrupt = Box::new(move |old: &mut [u8], new: &[u8]| {
+            for (old, new) in old.iter_mut().zip(new.iter()) {
+                for bit in 0..8 {
+                    let mask = 1 << bit;
+                    if *old & mask == *new & mask {
+                        continue;
+                    }
+                    if complete_bits.pop().unwrap() {
+                        *old ^= mask;
+                    }
+                }
+            }
+        });
+        StoreInterruption { delay, corrupt }
+    }
+}
+
+/// The initial fuzzing mode.
+enum Init {
+    /// Fuzzing starts from a clean storage.
+    ///
+    /// All invariants are checked.
+    Clean,
+
+    /// Fuzzing starts from a dirty storage.
+    ///
+    /// Only crashing is checked.
+    Dirty,
+
+    /// Fuzzing starts from a simulated old storage.
+    ///
+    /// All invariants are checked.
+    Used {
+        /// Number of simulated used cycles.
+        cycle: usize,
+    },
+}
+
+impl Init {
+    /// Returns whether fuzzing is in dirty mode.
+    fn is_dirty(&self) -> bool {
+        match self {
+            Init::Dirty => true,
+            _ => false,
+        }
+    }
+
+    /// Returns the number of used cycles.
+    ///
+    /// This is zero if the storage was not artificially aged.
+    fn used_cycles(&self) -> usize {
+        match self {
+            Init::Used { cycle } => *cycle,
+            _ => 0,
+        }
+    }
+}
+
+/// Compact stack of bits.
+// NOTE: This would probably go away once the delay map is simplified.
+#[derive(Default, Clone, Debug)]
+struct BitStack {
+    /// Bits stored in little-endian (for bytes and bits).
+    ///
+    /// The last byte only contains `len` bits.
+    data: Vec<u8>,
+
+    /// Number of bits stored in the last byte.
+    ///
+    /// It is 0 if the last byte is full, not 8.
+    len: usize,
+}
+
+impl BitStack {
+    /// Returns whether the stack is empty.
+    fn is_empty(&self) -> bool {
+        self.len() == 0
+    }
+
+    /// Returns the length of the stack.
+    fn len(&self) -> usize {
+        if self.len == 0 {
+            8 * self.data.len()
+        } else {
+            8 * (self.data.len() - 1) + self.len
+        }
+    }
+
+    /// Pushes a bit to the stack.
+    fn push(&mut self, value: bool) {
+        if self.len == 0 {
+            self.data.push(0);
+        }
+        if value {
+            *self.data.last_mut().unwrap() |= 1 << self.len;
+        }
+        self.len += 1;
+        if self.len == 8 {
+            self.len = 0;
+        }
+    }
+
+    /// Pops a bit from the stack.
+    fn pop(&mut self) -> Option<bool> {
+        if self.len == 0 {
+            if self.data.is_empty() {
+                return None;
+            }
+            self.len = 8;
+        }
+        self.len -= 1;
+        let result = self.data.last().unwrap() & 1 << self.len;
+        if self.len == 0 {
+            self.data.pop().unwrap();
+        }
+        Some(result != 0)
+    }
+}
+
+impl std::fmt::Display for BitStack {
+    fn fmt(&self, f: &mut std::fmt::Formatter) -> Result<(), std::fmt::Error> {
+        let mut bits = self.clone();
+        while let Some(bit) = bits.pop() {
+            write!(f, "{}", bit as usize)?;
+        }
+        write!(f, " ({} bits)", self.len())?;
+        Ok(())
+    }
+}
+
+#[test]
+fn bit_stack_ok() {
+    let mut bits = BitStack::default();
+
+    assert_eq!(bits.pop(), None);
+
+    bits.push(true);
+    assert_eq!(bits.pop(), Some(true));
+    assert_eq!(bits.pop(), None);
+
+    bits.push(false);
+    assert_eq!(bits.pop(), Some(false));
+    assert_eq!(bits.pop(), None);
+
+    bits.push(true);
+    bits.push(false);
+    assert_eq!(bits.pop(), Some(false));
+    assert_eq!(bits.pop(), Some(true));
+    assert_eq!(bits.pop(), None);
+
+    bits.push(false);
+    bits.push(true);
+    assert_eq!(bits.pop(), Some(true));
+    assert_eq!(bits.pop(), Some(false));
+    assert_eq!(bits.pop(), None);
+
+    let n = 27;
+    for i in 0..n {
+        assert_eq!(bits.len(), i);
+        bits.push(true);
+    }
+    for i in (0..n).rev() {
+        assert_eq!(bits.pop(), Some(true));
+        assert_eq!(bits.len(), i);
+    }
+    assert_eq!(bits.pop(), None);
+}

libraries/persistent_store/src/buffer.rs

@@ -23,9 +23,9 @@ use alloc::vec;
 /// for tests and fuzzing, for which it has dedicated functionalities.
 ///
 /// This storage tracks how many times words are written between page erase cycles, how many times
-/// pages are erased, and whether an operation flips bits in the wrong direction (optional).
-/// Operations panic if those conditions are broken. This storage also permits to interrupt
-/// operations for inspection or to corrupt the operation.
+/// pages are erased, and whether an operation flips bits in the wrong direction. Operations panic
+/// if those conditions are broken (optional). This storage also permits to interrupt operations for
+/// inspection or to corrupt the operation.
 #[derive(Clone)]
 pub struct BufferStorage {
     /// Content of the storage.
@@ -59,8 +59,13 @@ pub struct BufferOptions {
     /// How many times a page can be erased.
     pub max_page_erases: usize,
 
-    /// Whether bits cannot be written from 0 to 1.
-    pub strict_write: bool,
+    /// Whether the storage should check the flash invariant.
+    ///
+    /// When set, the following conditions would panic:
+    /// - A bit is written from 0 to 1.
+    /// - A word is written more than `max_word_writes`.
+    /// - A page is erased more than `max_page_erases`.
+    pub strict_mode: bool,
 }
 
 /// Corrupts a slice given actual and expected value.
@@ -214,7 +219,10 @@ impl BufferStorage {
     ///
     /// Panics if the maximum number of erase cycles per page is reached.
     fn incr_page_erases(&mut self, page: usize) {
-        assert!(self.page_erases[page] < self.max_page_erases());
+        // Check that pages are not erased too many times.
+        if self.options.strict_mode {
+            assert!(self.page_erases[page] < self.max_page_erases());
+        }
         self.page_erases[page] += 1;
         let num_words = self.page_size() / self.word_size();
         for word in 0..num_words {
@@ -252,7 +260,10 @@ impl BufferStorage {
                 continue;
             }
             let word = index / word_size + i;
-            assert!(self.word_writes[word] < self.max_word_writes());
+            // Check that words are not written too many times.
+            if self.options.strict_mode {
+                assert!(self.word_writes[word] < self.max_word_writes());
+            }
             self.word_writes[word] += 1;
         }
     }
@@ -306,8 +317,8 @@ impl Storage for BufferStorage {
         self.interruption.tick(&operation)?;
         // Check and update counters.
         self.incr_word_writes(range.start, value, value);
-        // Check strict write.
-        if self.options.strict_write {
+        // Check that bits are correctly flipped.
+        if self.options.strict_mode {
             for (byte, &val) in range.clone().zip(value.iter()) {
                 assert_eq!(self.storage[byte] & val, val);
             }
@@ -472,7 +483,7 @@ mod tests {
         page_size: 16,
         max_word_writes: 2,
         max_page_erases: 3,
-        strict_write: true,
+        strict_mode: true,
     };
     // Those words are decreasing bit patterns. Bits are only changed from 1 to 0 and at least one
     // bit is changed.

libraries/persistent_store/src/store.rs

@@ -1257,7 +1257,7 @@ mod tests {
                 page_size: self.page_size,
                 max_word_writes: self.max_word_writes,
                 max_page_erases: self.max_page_erases,
-                strict_write: true,
+                strict_mode: true,
             };
             StoreDriverOff::new(options, self.num_pages)
         }