Make nss/TPM integration in ChromeOS more robust.

chrome/browser/chromeos/login/user_manager.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/login/user_manager.h"
 
 #include <vector>
 
 #include "base/bind.h"
 #include "base/command_line.h"
@@ skipping 220 matching lines @@
 
 RealTPMTokenInfoDelegate::RealTPMTokenInfoDelegate() : token_ready_(false) {}
 RealTPMTokenInfoDelegate::~RealTPMTokenInfoDelegate() {}
 
 bool RealTPMTokenInfoDelegate::IsTokenAvailable() const {
   CHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   return CrosLibrary::Get()->GetCryptohomeLibrary()->TpmIsEnabled();
 }
 
 bool RealTPMTokenInfoDelegate::IsTokenReady() const {
+  if (token_ready_)
+    return true;
   CHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));

[wtc, 2012/02/15 01:41:32]

Should this CHECK be the first line of this function, or
do you intend to skip this CHECK if token_ready_ is true?
If it's intentional, a comment that explains why would be
nice.

[stevenjb, 2012/02/15 01:58:51]

Comment added.

-  if (!token_ready_) {
-    // Retrieve token_name_ and user_pin_ here since they will never change
-    // and CryptohomeLibrary calls are not thread safe.
-    if (CrosLibrary::Get()->GetCryptohomeLibrary()->Pkcs11IsTpmTokenReady()) {
-      CrosLibrary::Get()->GetCryptohomeLibrary()->Pkcs11GetTpmTokenInfo(
-          &token_name_, &user_pin_);
-      token_ready_ = true;
-    }
+  // Retrieve token_name_ and user_pin_ here since they will never change
+  // and CryptohomeLibrary calls are not thread safe.
+  if (CrosLibrary::Get()->GetCryptohomeLibrary()->Pkcs11IsTpmTokenReady()) {
+    CrosLibrary::Get()->GetCryptohomeLibrary()->Pkcs11GetTpmTokenInfo(
+        &token_name_, &user_pin_);
+    token_ready_ = true;
   }
   return token_ready_;
 }
 
 void RealTPMTokenInfoDelegate::GetTokenInfo(std::string* token_name,
                                             std::string* user_pin) const {
   // May be called from a non UI thread, but must only be called after
   // IsTokenReady() returns true.
   CHECK(token_ready_);
   if (token_name)
@@ skipping 458 matching lines @@
   }
 }
 
 void UserManager::StubUserLoggedIn() {
   logged_in_user_ = &stub_user_;
   stub_user_.SetImage(GetDefaultImage(kStubDefaultImageIndex),
                       kStubDefaultImageIndex);
 }
 
 void UserManager::NotifyOnLogin() {
+  CHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   content::NotificationService::current()->Notify(
       chrome::NOTIFICATION_LOGIN_USER_CHANGED,
       content::Source<UserManager>(this),
       content::Details<const User>(logged_in_user_));
 
   chromeos::input_method::InputMethodManager::GetInstance()->
       SetDeferImeStartup(false);
   // Shut down the IME so that it will reload the user's settings.
   chromeos::input_method::InputMethodManager::GetInstance()->
       StopInputMethodDaemon();
 
 #if defined(TOOLKIT_USES_GTK)
   // Let the window manager know that we're logged in now.
   WmIpc::instance()->SetLoggedInProperty(true);
 #endif
 
   // Ensure we've opened the real user's key/certificate database.
   crypto::OpenPersistentNSSDB();
 
   // Only load the Opencryptoki library into NSS if we have this switch.
   // TODO(gspencer): Remove this switch once cryptohomed work is finished:
   // http://crosbug.com/12295 and http://crosbug.com/12304
   if (CommandLine::ForCurrentProcess()->HasSwitch(
           switches::kLoadOpencryptoki)) {
     crypto::EnableTPMTokenForNSS(new RealTPMTokenInfoDelegate());
     CertLibrary* cert_library;
     cert_library = chromeos::CrosLibrary::Get()->GetCertLibrary();
+    // Note: this calls crypto::EnsureTPMTokenReady()
     cert_library->RequestCertificates();
   }
 
   // Schedules current user ownership check on file thread.
   BrowserThread::PostTask(BrowserThread::FILE, FROM_HERE,
                           base::Bind(&UserManager::CheckOwnership,
                                      base::Unretained(this)));
 }
 
 void UserManager::SetInitialUserImage(const std::string& username) {
@@ skipping 230 matching lines @@
 
 User* UserManager::CreateUser(const std::string& email) const {
   User* user = new User(email, email == kGuestUser);
   user->set_oauth_token_status(LoadUserOAuthStatus(email));
   // Used to determine whether user's display name is unique.
   ++display_name_count_[user->GetDisplayName()];
   return user;
 }
 
 }  // namespace chromeos