SD Create Remote Backup host layer API support

[rajesh-gali]

This pull request introduces a new set of security-domain backup APIs, including support for remote backup creation and resealing, and adds attestation support for non-resident masked keys. It also exposes new partition identity queries and error handling for security-domain initialization. These changes add core functionality for managing security-domain backups and key attestation, and extend the public API for use in higher-level workflows.

Security-domain backup APIs:

• Added the sd_backup module implementing the TBOR SdCreateRemoteBackup and SdResealRemoteBackup commands, including helpers for handling out-of-band attestation evidence and policy decoding (api/lib/src/ddi/sd_backup.rs).
• Exposed new session methods sd_create_remote_backup and sd_reseal_remote_backup to issue these commands on V2 sessions, returning backup results or resealed backups (api/lib/src/session.rs).
• Introduced the HsmSdEvidence struct for describing attestation evidence and the HsmSdRemoteBackupResult struct for backup results (api/lib/src/shared_types.rs).

Key attestation improvements:

• Implemented HsmKeyReportOp for HsmSealingKey, allowing attestation of non-resident masked keys via the new masked_key_report function (api/lib/src/algo/sealing/key.rs, api/lib/src/ddi/sd_sealing_key_gen.rs). [1] [2]

Partition identity queries:

• Added public methods pid and ex_pub_key to HsmPartition for retrieving the partition's stable identity and raw public key, using a new internal part_info query and HsmPartInfo struct (api/lib/src/partition.rs, api/lib/src/ddi/partition_ex.rs). [1] [2]

Error handling:

• Added a new error variant SdAlreadyInitialized to HsmError and mapped the corresponding TBOR status code in DDI error handling (api/lib/src/error.rs, api/lib/src/ddi/mod.rs). [1] [2]

Internal API and module updates:

• Registered the new sd_backup module and imported supporting types in the DDI layer (api/lib/src/ddi/mod.rs). [1] [2] [3]

These changes collectively enable secure backup and attestation workflows for security domains, improve error reporting, and extend the SDK's public API surface.

[Copilot]

Pull request overview

This PR extends the AZIHSM SDK host layer to support Security Domain (SD) remote backup creation and resealing over TBOR, adds attestation support for non-resident (masked) SD sealing keys, and exposes partition identity queries needed to build backing-partition policies. It also tightens error typing for TBOR firmware rejections and adds emulator-backed integration tests covering the new SD flows.

Changes:

• Added DDI + public session APIs for SdCreateRemoteBackup and SdResealRemoteBackup, plus new shared public types for SD attestation evidence and backup results.
• Added PartInfo host support and exposed HsmPartition::{pid, ex_pub_key} for policy construction workflows.
• Introduced typed TBOR firmware rejection error propagation (DdiError::TborStatus) and expanded emulator-backed tests for SD backup/reseal and related provisioning fixtures.

Reviewed changes

Copilot reviewed 24 out of 25 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
ddi/tbor/types/tests/hw/open_session.rs	Updates HW tests to expect typed TBOR status errors.
ddi/tbor/types/tests/harness/assertions.rs	Updates FW-rejection assertion helper to match DdiError::TborStatus.
ddi/tbor/types/tests/commands/session_close.rs	Updates emu tests to expect typed TBOR status errors.
ddi/tbor/types/tests/commands/open_session.rs	Updates emu tests to expect typed TBOR status errors.
ddi/interface/src/error.rs	Adds DdiError::TborStatus(TborStatus) and maps TBOR FW errors into it.
api/tests/src/utils/sd_provision.rs	Expands SD provisioning fixture to support backup tests and evidence construction.
api/tests/src/utils/mod.rs	Registers new emu-only helper modules in the test utils module tree.
api/tests/src/utils/emu_helpers.rs	Adds emu partition reset + locking helpers for stable integration tests.
api/tests/src/session_ex_tests.rs	Adjusts imports to new emu helper location.
api/tests/src/sd/reseal_tests.rs	Adds emulator round-trip tests for sd_reseal_remote_backup.
api/tests/src/sd/mod.rs	Adds SD test module wiring for emulator-backed tests.
api/tests/src/sd/create_backup_tests.rs	Adds emulator round-trip tests for sd_create_remote_backup (+ one-shot behavior).
api/tests/src/partition_ex_tests.rs	Adjusts imports to new emu helper location.
api/tests/src/lib.rs	Wires in the new SD test module under the emu feature.
api/tests/src/algo/sealing/mod.rs	Removes old sealing provisioning module hook (replaced by shared fixture).
api/tests/src/algo/sealing/key_gen_tests.rs	Updates sealing tests to use shared sd_provision fixture paths.
api/lib/src/shared_types.rs	Introduces HsmSdEvidence and HsmSdRemoteBackupResult public API types.
api/lib/src/session.rs	Adds public session methods sd_create_remote_backup / sd_reseal_remote_backup.
api/lib/src/partition.rs	Exposes pid() / ex_pub_key() via a new PartInfo query.
api/lib/src/error.rs	Adds HsmError::SdAlreadyInitialized.
api/lib/src/ddi/sd_sealing_key_gen.rs	Adds masked_key_report dispatch for attesting non-resident masked keys.
api/lib/src/ddi/sd_backup.rs	Adds host-side TBOR dispatch for SD create/reseal remote backup + OOB evidence packing.
api/lib/src/ddi/partition_ex.rs	Implements PartInfo DDI query and conversion into owned HsmPartInfo.
api/lib/src/ddi/mod.rs	Registers SD backup module and maps TborStatus::SdAlreadyInitialized to HsmError.
api/lib/src/algo/sealing/key.rs	Implements HsmKeyReportOp for HsmSealingKey via masked-key KeyReport.

[Copilot]

Pull request overview

Copilot reviewed 24 out of 25 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

api/tests/src/utils/sd_provision.rs:59

• These policy field offsets are hard-coded magic numbers. Since PartPolicy/PolicyPubKey are available as #[repr(C)] wire-layout types, you can compute the offsets via core::mem::offset_of! so the tests stay correct if the policy layout ever changes (and avoid having to manually mirror offsets from firmware sources).

[Copilot]

Pull request overview

Copilot reviewed 27 out of 28 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (2)

api/tests/src/utils/sd_provision.rs:497

• pid is accepted as a dynamically-sized slice, but it’s copied into a fixed-size window. If a future call site accidentally passes the wrong length, this will panic inside copy_from_slice, making the failure harder to diagnose. Add an explicit length assertion (or change the parameter to &[u8; BACKUP_PART_ID_LEN]).
  api/tests/src/utils/sd_provision.rs:503
• pid_pub is accepted as a dynamically-sized slice but is copied into a fixed-size window (POLICY_MAX_KEY_LEN). If a future call site passes the wrong length, this will panic. Add an explicit assertion (or take &[u8; RAW_PUB_LEN] / &[u8; POLICY_MAX_KEY_LEN]) so failures are immediate and self-explanatory.

[Copilot]

Pull request overview

Copilot reviewed 27 out of 28 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

ddi/interface/src/error.rs:65

• DdiError::TborStatus is meant to carry a specific firmware status, but its #[error(...)] message drops the status value, making logs and surfaced error strings much less actionable than they could be.

    /// Firmware-signalled TBOR command rejection, carrying the typed
    /// [`TborStatus`].
    #[error("TBOR device error")]
    TborStatus(TborStatus),

api/tests/src/utils/sd_provision.rs:64

• These hard-coded PartPolicy byte offsets are brittle and can silently drift if the wire layout changes. Since this file already depends on the typed PartPolicy/PolicyPubKey definitions, add const-time offset assertions so any drift fails the build immediately.