pvimg: Use hybrid keys

Allow the creation of SE images using headers with hybrid (=quantum safe) keys.
This results in using the headers in version 2 (0x200).

Co-developed-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Timo Keller <tkeller@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>

rust/pv/src/brcb.rs

@@ -17,6 +17,8 @@ use crate::{assert_size, request::MagicValue, static_assert, Error, Result, PAGE
 pub enum SeHdrVersion {
     /// Secure Execution header v1
     One = 0x100,
+    /// Secure Execution header v2
+    Two = 0x200,
 }
 
 /// Struct containing all SE-header tags.
@@ -241,6 +243,7 @@ impl BootHdrTags {
         // Some sanity checks
         let hdr_version = match hdr_head.version.get() {
             0x100 => SeHdrVersion::One,
+            0x200 => SeHdrVersion::Two,
             _ => {
                 debug!("Unsupported hdr-version: {:0>4x}", hdr_head.version.get());
                 return Err(Error::InvBootHdr);

rust/pv/src/lib.rs

@@ -89,14 +89,15 @@ pub use crate::error::HkdVerifyErrorType;
 
 /// Functionalities to build UV requests
 pub mod request {
-    pub use crate::brcb::{seek_se_hdr_start, BootHdrTags, SeImgMetaData};
+    pub use crate::brcb::{seek_se_hdr_start, BootHdrTags, SeHdrVersion, SeImgMetaData};
     pub use crate::crypto::{
         decrypt_aead, derive_aes256_gcm_key, encrypt_aead, gen_ec_key, random_array,
         AeadDecryptionResult, AeadEncryptionResult, Aes256GcmKey, Aes256XtsKey, SymKey, SymKeyType,
         SHA_512_HASH_LEN,
     };
     pub use crate::req::{
-        EcPubKeyCoord, Encrypt, HostKey, HybridPKey, Keyslot, ReqEncrCtx, Request,
+        EcPubKeyCoord, Encrypt, HostKey, HybridPKey, Keyslot, KeyslotV1, KeyslotV2, ReqEncrCtx,
+        Request,
     };
     pub use crate::verify::{CertVerifier, HkdVerifier, NoVerifyHkd};
 

rust/pv/src/req/mod.rs

@@ -22,6 +22,5 @@ pub use ec_coord::EcPubKeyCoord;
 pub use encrypt::{Aad, Encrypt};
 pub use header::RequestHdr;
 pub use hostkey::{HostKey, HybridPKey};
-#[expect(unused)]
 pub use keyslot::{Keyslot, KeyslotV1, KeyslotV2};
 pub use request::{BinReqValues, Request};