Update FWMP in TPM

chrome/browser/chromeos/policy/enrollment_handler_chromeos.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_BROWSER_CHROMEOS_POLICY_ENROLLMENT_HANDLER_CHROMEOS_H_
 #define CHROME_BROWSER_CHROMEOS_POLICY_ENROLLMENT_HANDLER_CHROMEOS_H_
 
 #include <memory>
 #include <string>
 
@@ skipping 97 matching lines @@
   // explicitly to make it easier to read debug logs.)
   enum EnrollmentStep {
     STEP_PENDING = 0,             // Not started yet.
     STEP_STATE_KEYS = 1,          // Waiting for state keys to become available.
     STEP_LOADING_STORE = 2,       // Waiting for |store_| to initialize.
     STEP_REGISTRATION = 3,        // Currently registering the client.
     STEP_POLICY_FETCH = 4,        // Fetching policy.
     STEP_VALIDATION = 5,          // Policy validation.
     STEP_ROBOT_AUTH_FETCH = 6,    // Fetching device API auth code.
     STEP_ROBOT_AUTH_REFRESH = 7,  // Fetching device API refresh token.
-    STEP_AD_DOMAIN_JOIN = 8,      // Joining Active Directory domain.
-    STEP_LOCK_DEVICE = 9,         // Writing installation-time attributes.
-    STEP_STORE_TOKEN = 10,        // Encrypting and storing DM token.
-    STEP_STORE_ROBOT_AUTH = 11,   // Encrypting & writing robot refresh token.
-    STEP_STORE_POLICY = 12,       // Storing policy and API refresh token. For
+    STEP_SET_FWMP_DATA = 8,       // Setting the firmware management parameters.

[Thiemo Nagel, 2017/03/23 17:23:52]

Why not immediately before LOCK_DEVICE?  It would seem more logical to have the
TMP-related steps next to each other...

[igorcov, 2017/03/24 13:29:15]

Done.

+    STEP_AD_DOMAIN_JOIN = 9,      // Joining Active Directory domain.
+    STEP_LOCK_DEVICE = 10,        // Writing installation-time attributes.
+    STEP_STORE_TOKEN = 11,        // Encrypting and storing DM token.
+    STEP_STORE_ROBOT_AUTH = 12,   // Encrypting & writing robot refresh token.
+    STEP_STORE_POLICY = 13,       // Storing policy and API refresh token. For
                                   // AD, includes policy fetch via authpolicyd.
-    STEP_FINISHED = 13,           // Enrollment process done, no further action.
+    STEP_FINISHED = 14,           // Enrollment process done, no further action.
   };
 
   // Handles the response to a request for server-backed state keys.
   void HandleStateKeysResult(const std::vector<std::string>& state_keys);
 
   // Starts attestation based enrollment flow.
   void StartAttestationBasedEnrollmentFlow();
 
   // Handles the response to a request for a registration certificate.
   void HandleRegistrationCertificateResult(
       bool success,
       const std::string& pem_certificate_chain);
 
   // Starts registration if the store is initialized.
   void StartRegistration();
 
   // Handles the policy validation result, proceeding with device lock if
   // successful.
   void HandlePolicyValidationResult(DeviceCloudPolicyValidator* validator);
 
+  // Updates the firmware management partition from TPM, setting the data
+  // according to devmode.

[Thiemo Nagel, 2017/03/23 17:23:52]

"according to devmode" seems unclear to me.  Please clarify.

[igorcov, 2017/03/24 13:29:15]

Done.

+  void SetFirmwareManagementParametersData();
+
+  // Invoked after the firmware management partition in TPM is updated.
+  void OnFirmwareManagementParametersDataSet(
+      chromeos::DBusMethodCallStatus call_status,
+      bool result,
+      const cryptohome::BaseReply& reply);
+
+  // Returns whether block_devmode is set. Can be invoked after the policy is

[Thiemo Nagel, 2017/03/23 17:23:52]

s/Can be/Must only be/
s/is retrieved/has been retrieved/

[igorcov, 2017/03/24 13:29:15]

Done.

+  // retrieved.
+  bool GetBlockDevmode();

[Thiemo Nagel, 2017/03/23 17:23:52]

Nit: I'd suggest to make clearer that this is based on the policy.  Either by
renaming to something like GetBlockDevmodeFromPolicy() or maybe even better by
making it a free function (anonymous namespace) and passing in the
PolicyFetchResponse as a parameter.

[igorcov, 2017/03/24 13:29:15]

Done.

+
   // Start joining the Active Directory domain in case the device is enrolling
   // into Active Directory management mode.
   void StartJoinAdDomain();
 
   // Handles successful Active Directory domain join.
   void OnAdDomainJoined(const std::string& realm);
 
   // Calls InstallAttributes::LockDevice() for enterprise enrollment and
   // DeviceSettingsService::SetManagementSettings() for consumer
   // enrollment.
@@ skipping 69 matching lines @@
   int lockbox_init_duration_ = 0;
 
   base::WeakPtrFactory<EnrollmentHandlerChromeOS> weak_ptr_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(EnrollmentHandlerChromeOS);
 };
 
 }  // namespace policy
 
 #endif  // CHROME_BROWSER_CHROMEOS_POLICY_ENROLLMENT_HANDLER_CHROMEOS_H_