From 047cfd6b7ca06c3f9522e76feeff413374b2b61d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tobias=20Frauenschl=C3=A4ger?= <tobias@wolfssl.com>
Date: Thu, 10 Sep 2026 20:09:01 +0200
Subject: [PATCH] Give the white-box smoke run the library's own target flags

The compile line was fixed at -O0 -g and carried no architecture flags, while
--enable-all on x86_64 puts -maes in AM_CFLAGS. test_aes_whitebox therefore
failed to build on _mm_aesimc_si128 and was filed as a configuration skip,
on the only platform where its AESNI rows exist at all. Take every -m flag
from the build's own AM_CFLAGS; aarch64 has none and is unchanged.

A run with no passes could not report itself either: printf '%s\n'
"${pass[@]}" aborts under set -u on bash 3.2 and emits a blank line on bash 5,
so the empty-array case is now guarded.

Measured with gcc 13.3 on x86_64 Ubuntu 24.04, the configuration the workflow
runs: 92 pass, 12 not built and 3 needing a narrower build, against 91, 13 and
3, with none failing either way. smoke-expected.txt is regenerated on that box
and gains exactly the one entry, which is not a vacuous pass: the translation
unit exercises 8 of its 15 rows, among them the AES-NI internal ptr-guard
pairs and the wc_AesCcmEncrypt use_aesni dispatch pair, neither of which any
other platform compiles.
---
 tests/unit-mcdc/run-whitebox-smoke.sh | 14 ++++++++++----
 tests/unit-mcdc/smoke-expected.txt    |  1 +
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/tests/unit-mcdc/run-whitebox-smoke.sh b/tests/unit-mcdc/run-whitebox-smoke.sh
index 123bf88093..a566b5636f 100755
--- a/tests/unit-mcdc/run-whitebox-smoke.sh
+++ b/tests/unit-mcdc/run-whitebox-smoke.sh
@@ -45,6 +45,10 @@ CC_=${CC:-cc}
 LDEXTRA=""
 [ "$(uname -s)" = "Darwin" ] &&
     LDEXTRA="-framework CoreFoundation -framework Security"
+# aes.c's AESNI intrinsics do not compile without the -maes that configure
+# puts in AM_CFLAGS, so take the build's own target flags.
+TARGETFLAGS=$(sed -n 's/^AM_CFLAGS *= *//p' "$BUILD/Makefile" 2>/dev/null |
+                  tr ' ' '\n' | grep -E '^-m' | tr '\n' ' ')
 work=$(mktemp -d); trap 'rm -rf "$work"' EXIT
 
 pass=(); skip=(); fail=(); unsupported=()
@@ -61,7 +65,7 @@ for tu in "$HERE"/*_whitebox.c; do
     if ! ( cd "$BUILD" && $CC_ -O0 -g -I"$BUILD" -I"$SRC" -I"$SRC/tests" \
              -DWOLFSSL_TEST_STATIC_BUILD -DHAVE_CONFIG_H \
              -DWOLFSSL_USE_OPTIONS_H \
-             -DUSE_CERT_BUFFERS_2048 -DUSE_CERT_BUFFERS_256 \
+             -DUSE_CERT_BUFFERS_2048 -DUSE_CERT_BUFFERS_256 $TARGETFLAGS \
              -o "$work/$name.bin" "$tu" "$work/t.a" -lm -lpthread $LDEXTRA ) \
              >"$work/$name.log" 2>&1; then
         skip+=("$name"); continue
@@ -79,13 +83,15 @@ for tu in "$HERE"/*_whitebox.c; do
         fail+=("$name")
     else
         # Builds against this configuration but does not run clean under it.
-        # Thesewhite-boxes target a narrower build; not a finding here.
+        # These white-boxes target a narrower build; not a finding here.
         unsupported+=("$name")
     fi
 done
 
+list_pass() { [ ${#pass[@]} -eq 0 ] || printf '%s\n' "${pass[@]}"; }
+
 if [ "$UPDATE" = 1 ]; then
-    printf '%s\n' "${pass[@]}" | sort > "$EXPECTED"
+    list_pass | sort > "$EXPECTED"
     echo "wrote $(wc -l < "$EXPECTED") entries to ${EXPECTED#$SRC/}"
     exit 0
 fi
@@ -95,7 +101,7 @@ echo "white-box smoke: ${#pass[@]} passed, ${#skip[@]} not built here, ${#unsupp
 rc=0
 [ ${#fail[@]} -eq 0 ] || rc=1
 if [ -f "$EXPECTED" ]; then
-    printf '%s\n' "${pass[@]}" | sort > "$work/got.txt"
+    list_pass | sort > "$work/got.txt"
     missing=$(comm -23 "$EXPECTED" "$work/got.txt")
     if [ -n "$missing" ]; then
         echo "REGRESSION: these built and passed before and do not now:"
diff --git a/tests/unit-mcdc/smoke-expected.txt b/tests/unit-mcdc/smoke-expected.txt
index 0750da7c98..b5ba23e2f2 100644
--- a/tests/unit-mcdc/smoke-expected.txt
+++ b/tests/unit-mcdc/smoke-expected.txt
@@ -1,3 +1,4 @@
+test_aes_whitebox
 test_asn_cert_whitebox
 test_asn_ext_whitebox
 test_asn_fault_whitebox