From ed74e848621739b5a4c06b4ad3a39efabf7993a2 Mon Sep 17 00:00:00 2001
From: Marc Hartmayer <marc@linux.ibm.com>
Date: Tue, 28 Jul 2026 18:05:39 +0200
Subject: [PATCH] pvimg: Report host-key document type mismatches

Report host-key document type mismatches before hash verification.

For example, when testing a v2 Secure Execution header with a classical
host-key document, report that a hybrid host-key document is required
instead of failing with a generic header validation error.

Before:

$ pvimg -- test --host-key-document v1.hkd se.v2.img
error: Invalid Secure Execution header

After:

$ pvimg -- test --host-key-document v1.hkd se.v2.img
Host-key document 'v1.hkd' is not a hybrid host-key document.
error: The provided host key document in v1.hkd contains the wrong number of keys!

Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
---
 rust/pvimg/src/cmd/test.rs            |  6 +++++-
 rust/pvimg/src/pv_utils/se_hdr/brb.rs | 11 ++++++++++-
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/rust/pvimg/src/cmd/test.rs b/rust/pvimg/src/cmd/test.rs
index 9a227dc3..c228d8e0 100644
--- a/rust/pvimg/src/cmd/test.rs
+++ b/rust/pvimg/src/cmd/test.rs
@@ -74,7 +74,11 @@ where
 
     let mut result = false;
     for path in host_key_documents {
-        let hkd = HkdLoader::load_and_verify(path, &NoVerifyHkd, HkdVersionSelection::Auto)?;
+        let hkd = HkdLoader::load_and_verify(
+            path,
+            &NoVerifyHkd,
+            HkdVersionSelection::Explicit(hdr.common.version.into()),
+        )?;
         if hdr.contains(hkd)? {
             result = true;
             log_println!(
diff --git a/rust/pvimg/src/pv_utils/se_hdr/brb.rs b/rust/pvimg/src/pv_utils/se_hdr/brb.rs
index 41c791c5..f8dcf899 100644
--- a/rust/pvimg/src/pv_utils/se_hdr/brb.rs
+++ b/rust/pvimg/src/pv_utils/se_hdr/brb.rs
@@ -12,7 +12,7 @@ use pv::request::openssl::pkey::{PKey, Private, Public};
 use pv::request::{seek_se_hdr_start, Aes256XtsKey, Confidential, SymKey, SymKeyType};
 use pv::static_assert;
 use serde::{Deserialize, Serialize};
-use utils::S390ToolsMetaData;
+use utils::{HkdVersion, S390ToolsMetaData};
 
 pub use super::hdr_v1::{SeHdrBinV1, SeHdrDataV1};
 pub use super::hdr_v2::{SeHdrBinV2, SeHdrDataV2};
@@ -65,6 +65,15 @@ pub enum SeHdrVersion {
     V2 = 0x200,
 }
 
+impl From<SeHdrVersion> for HkdVersion {
+    fn from(val: SeHdrVersion) -> Self {
+        match val {
+            SeHdrVersion::V1 => Self::Classical,
+            SeHdrVersion::V2 => Self::Hybrid,
+        }
+    }
+}
+
 impl Display for SeHdrVersion {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         write!(