Represent detected CPU features as an object.

src/aead.rs

@@ -225,7 +225,7 @@ enum KeyInner {
 
 impl Key {
     fn new(algorithm: &'static Algorithm, key_bytes: &[u8]) -> Result<Self, error::Unspecified> {
-        cpu::cache_detected_features();
+        let _ = cpu::features();
         Ok(Key {
             inner: (algorithm.init)(key_bytes)?,
             algorithm,

src/aead/quic.rs

@@ -41,7 +41,7 @@ impl HeaderProtectionKey {
     pub fn new(
         algorithm: &'static Algorithm, key_bytes: &[u8],
     ) -> Result<Self, error::Unspecified> {
-        cpu::cache_detected_features();
+        let _ = cpu::features();
         Ok(HeaderProtectionKey {
             inner: (algorithm.init)(key_bytes)?,
             algorithm,

src/bssl.rs

@@ -51,7 +51,7 @@ macro_rules! bssl_test {
                 fn $bssl_test_main_fn_name() -> c::int;
             }
 
-            cpu::cache_detected_features();
+            let _ = cpu::features();
             ::std::env::set_current_dir(crate::test::ring_src_path()).unwrap();
 
             let result = unsafe { $bssl_test_main_fn_name() };

src/cpu.rs

@@ -12,8 +12,18 @@
 // OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
 // CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
+/// A witness indicating that CPU features have been detected and cached.
+///
+/// TODO: Eventually all feature detection logic should be done through
+/// functions that accept a `Features` parameter, to guarantee that nothing
+/// tries to read the cached values before they are written.
+///
+/// This is a zero-sized type so that it can be "stored" wherever convenient.
+#[derive(Copy, Clone)]
+pub(crate) struct Features(());
+
 #[inline(always)]
-pub fn cache_detected_features() {
+pub(crate) fn features() -> Features {
     #[cfg(not(target_os = "ios"))]
     {
         use std;
@@ -23,4 +33,6 @@ pub fn cache_detected_features() {
         static INIT: std::sync::Once = std::sync::ONCE_INIT;
         INIT.call_once(|| unsafe { GFp_cpuid_setup() });
     }
+
+    Features(())
 }

src/digest.rs

@@ -66,7 +66,7 @@ pub struct Context {
 impl Context {
     /// Constructs a new context.
     pub fn new(algorithm: &'static Algorithm) -> Context {
-        cpu::cache_detected_features();
+        let _ = cpu::features();
 
         Context {
             algorithm,

src/ec/keys.rs

@@ -25,7 +25,7 @@ impl Seed {
     pub fn generate(
         curve: &'static Curve, rng: &rand::SecureRandom,
     ) -> Result<Seed, error::Unspecified> {
-        cpu::cache_detected_features();
+        let _ = cpu::features();
         let mut r = Self {
             bytes: [0u8; SEED_MAX_BYTES],
             curve,
@@ -37,7 +37,7 @@ impl Seed {
     pub fn from_bytes(
         curve: &'static Curve, bytes: untrusted::Input,
     ) -> Result<Seed, error::Unspecified> {
-        cpu::cache_detected_features();
+        let _ = cpu::features();
         let bytes = bytes.as_slice_less_safe();
         if curve.elem_scalar_seed_len != bytes.len() {
             return Err(error::Unspecified);

src/rsa/verification.rs

@@ -204,7 +204,7 @@ pub fn verify_rsa(
     params: &Parameters, (n, e): (untrusted::Input, untrusted::Input), msg: untrusted::Input,
     signature: untrusted::Input,
 ) -> Result<(), error::Unspecified> {
-    cpu::cache_detected_features();
+    let _ = cpu::features();
     verify_rsa_(params, (n, e), msg, signature)
 }
 

src/signature.rs

@@ -401,6 +401,6 @@ pub fn verify(
     alg: &VerificationAlgorithm, public_key: untrusted::Input, msg: untrusted::Input,
     signature: untrusted::Input,
 ) -> Result<(), error::Unspecified> {
-    cpu::cache_detected_features();
+    let _ = cpu::features();
     alg.verify(public_key, msg, signature)
 }