C-FFI Support for SD Create Backup and Reseal API

[rajesh-gali]

This pull request significantly extends the DDI (Device Driver Interface) layer to support new security-domain backup and attestation features, improving modularity and code reuse. It introduces out-of-band evidence transport for certificate chains and reports, adds new TBOR command implementations (SdCreateRemoteBackup, SdResealRemoteBackup), and provides a KeyReport operation for non-resident masked keys. Several utility and error-handling improvements are also included.

Security-domain backup and evidence transport

• Added new DDI modules: sd_create_remote_backup, sd_reseal_remote_backup, and sd_evidence, implementing the TBOR commands for remote SD backup creation and resealing, and shared helpers for out-of-band evidence transport. [1] [2] [3]
• Introduced descriptor_utils module to encapsulate packing of DER certificate chains and reports for out-of-band transport, replacing repeated code and improving validation. [1] [2] [3]

Key attestation improvements

• Implemented the HsmKeyReportOp trait for HsmSealingKey, allowing attestation of non-resident masked keys by their envelope using the new masked_key_report DDI helper. [1] [2] [3]

Partition queries and error handling

• Added a new DDI-internal part_info query to fetch partition identity and public key, with a corresponding internal type.
• Mapped the new TborStatus::SdAlreadyInitialized device error to a public HsmError variant. [1] [2]

Refactoring and cleanup

• Refactored part_final_ex to use the new push_cert_chain utility for certificate chain handling, improving code clarity and validation.

These changes collectively enable robust, flexible, and maintainable support for advanced security-domain backup workflows and attestation in the HSM API.

[Copilot]

Pull request overview

This PR extends the SDK’s TBOR (V2) surface with security-domain backup support (create + reseal), including out-of-band transport for attestation evidence, adds C-FFI bindings for these operations, and expands test coverage (Rust + C++ emulator integration tests).

Changes:

• Add SD backup DDI + public API (sd_create_remote_backup, sd_reseal_remote_backup) using shared out-of-band evidence descriptor packing.
• Extend C-FFI with SD evidence structs + create/reseal entrypoints, plus PartInfo-backed partition identity properties (PID + raw pubkey) and sealing-key KeyReport.
• Add emulator-backed integration tests for SD create/reseal flows across Rust and C++ tests; update TBOR error plumbing to surface typed TborStatus.

Reviewed changes

Copilot reviewed 38 out of 39 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
ddi/tbor/types/tests/hw/open_session.rs	Update TBOR error assertions to match new DdiError::TborStatus variant.
ddi/tbor/types/tests/harness/assertions.rs	Update shared FW-rejection assertion helper for typed TborStatus.
ddi/tbor/types/tests/commands/session_close.rs	Update emulator tests to expect DdiError::TborStatus.
ddi/tbor/types/tests/commands/open_session.rs	Update emulator tests to expect DdiError::TborStatus.
ddi/interface/src/error.rs	Add DdiError::TborStatus(TborStatus) and map TBOR decode FW errors into it.
api/tests/src/utils/sd_provision.rs	Expand provisioning fixture to support SD backup tests (policy edits, evidence chains, key reports).
api/tests/src/utils/mod.rs	Wire new emulator-only utility modules.
api/tests/src/utils/emu_helpers.rs	New shared emulator partition/session helpers + global lock for test serialization.
api/tests/src/session_ex_tests.rs	Update imports to new utils module layout.
api/tests/src/sd/reseal_tests.rs	New Rust emulator round-trip tests for SD reseal.
api/tests/src/sd/mod.rs	New Rust SD test module.
api/tests/src/sd/create_backup_tests.rs	New Rust emulator round-trip tests for SD create-remote-backup (+ one-shot behavior).
api/tests/src/partition_ex_tests.rs	Update imports to new utils module layout.
api/tests/src/lib.rs	Register new emulator-only SD test module; remove old standalone emu_helpers module.
api/tests/src/algo/sealing/mod.rs	Remove old sealing provision module reference.
api/tests/src/algo/sealing/key_gen_tests.rs	Switch sealing tests to use shared sd_provision finalized session helper.
api/tests/cpp/utils/sd_provision.hpp	Extend C++ test utilities with SD backing-policy provisioning + evidence holder types.
api/tests/cpp/utils/sd_provision.cpp	Implement SD provisioning/evidence generation utilities for C++ integration tests.
api/tests/cpp/sd/reseal_tests.cpp	New C++ emulator tests for SD reseal (incl. rerandomization + null-param guard).
api/tests/cpp/sd/create_backup_tests.cpp	New C++ emulator tests for SD create-remote-backup (incl. one-shot + null-param guard).
api/tests/cpp/CMakeLists.txt	Register new C++ SD test sources.
api/native/src/session_ex.rs	Add C-FFI types + entrypoints for SD create/reseal; evidence unpacking helper.
api/native/src/partition_props.rs	Add new partition property IDs for PID + raw PID pubkey.
api/native/src/key_mgmt.rs	Route sealing keys through azihsm_generate_key_report.
api/native/src/algo/sealing/key.rs	Implement sealing-key KeyReport generation via masked-envelope TBOR KeyReport.
api/native/cbindgen.toml	Export new SD evidence structs + create/reseal parameter structs to C headers.
api/lib/src/shared_types.rs	Add public SDK types for SD evidence and SD create-backup results.
api/lib/src/session.rs	Add public HsmSession::{sd_create_remote_backup, sd_reseal_remote_backup}.
api/lib/src/partition.rs	Add public HsmPartition::{pid, ex_pub_key} getters backed by PartInfo.
api/lib/src/lib.rs	Re-export SD backup wire-length constants + evidence-chain limit for callers.
api/lib/src/error.rs	Add public HsmError::SdAlreadyInitialized.
api/lib/src/ddi/sd_sealing_key_gen.rs	Add masked-envelope KeyReport helper for non-resident sealing keys.
api/lib/src/ddi/sd_reseal_remote_backup.rs	New DDI implementation for TBOR SdResealRemoteBackup.
api/lib/src/ddi/sd_evidence.rs	New shared helpers for SD evidence + policy decode and OOB push.
api/lib/src/ddi/sd_create_remote_backup.rs	New DDI implementation for TBOR SdCreateRemoteBackup.
api/lib/src/ddi/partition_ex.rs	Refactor part_final_ex to shared cert-chain descriptor helper; add DDI PartInfo query carrier.
api/lib/src/ddi/mod.rs	Wire new DDI modules + re-export constants; map SdAlreadyInitialized TBOR status to public HsmError.
api/lib/src/ddi/descriptor_utils.rs	New shared OOB descriptor packing for cert chains and reports.
api/lib/src/algo/sealing/key.rs	Implement HsmKeyReportOp for HsmSealingKey via masked-envelope KeyReport.

[Copilot]

Pull request overview

Copilot reviewed 39 out of 40 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

api/tests/src/utils/sd_provision.rs:503

• backing_part_policy encodes backup_part_pub_key as len = POLICY_MAX_KEY_LEN and copies POLICY_MAX_KEY_LEN bytes from pid_pub, even though the comment says the key is 96 bytes (RAW_PUB_LEN). This is tightly coupled to POLICY_MAX_KEY_LEN == RAW_PUB_LEN and will panic or produce an incorrect policy if the max ever diverges. Prefer using RAW_PUB_LEN for both the length field and the copied range.

[Copilot]

Pull request overview

Copilot reviewed 40 out of 41 changed files in this pull request and generated 7 comments.

[Copilot]

Pull request overview

Copilot reviewed 40 out of 41 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 40 out of 41 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 40 out of 41 changed files in this pull request and generated no new comments.