debian 13 SEV version 3.0

[markg-github]

Failed to Achieve a Certification Level

Certified level: none
Max certification level: 3.0.0-0
Started: 2026-09-08T15:54:21.121625+00:00
Completed: 2026-09-08T15:54:21.395550+00:00

Environment

• Host OS: Debian GNU/Linux 13 (trixie)
• Host kernel: 6.12.107+deb13-amd64
• QEMU: 10.0.11 (Debian 1:10.0.11+ds-0+deb13u1)

Level 3.0.0-0

Test	Description	Result
attestation-test	Launch an SEV-SNP guest and verify attestation report	❌

Level 3.0.0-1

Test	Description	Result
snphost-config-commit	Test SNP_CONFIG and SNP_COMMIT host commands	❌
id-block-test	Verify ID block acceptance, report field binding, and launch rejection	❌

Failure Details

attestation-test (fail)

Calculate measurement — fail
Duration: 0ms

AMD SEV-compatible OVMF is not present; cannot launch SEV-SNP guest. Tried: /usr/share/ovmf/OVMF.amdsev.fd, /usr/share/edk2/ovmf/OVMF.amdsev.fd, /usr/share/qemu/ovmf-x86_64-sev.bin

snphost-config-commit (fail)

Launch SEV-SNP guest — error
Duration: 1ms

AMD SEV-compatible OVMF is not present; cannot launch SEV-SNP guest. Tried: /usr/share/ovmf/OVMF.amdsev.fd, /usr/share/edk2/ovmf/OVMF.amdsev.fd, /usr/share/qemu/ovmf-x86_64-sev.bin

guest-report-after-lower — error
Duration: 0ms

AMD SEV-compatible OVMF is not present; cannot launch SEV-SNP guest. Tried: /usr/share/ovmf/OVMF.amdsev.fd, /usr/share/edk2/ovmf/OVMF.amdsev.fd, /usr/share/qemu/ovmf-x86_64-sev.bin

pull-report-after-lower — error
Duration: 0ms

AMD SEV-compatible OVMF is not present; cannot launch SEV-SNP guest. Tried: /usr/share/ovmf/OVMF.amdsev.fd, /usr/share/edk2/ovmf/OVMF.amdsev.fd, /usr/share/qemu/ovmf-x86_64-sev.bin

verify-guest-report-lowered — fail
Duration: 3ms

report not found: artifacts/3.0/3.0.0-1/snphost_config_commit/report.bin

verify-lowered-report-signature — fail
Duration: 1ms

report not found: artifacts/3.0/3.0.0-1/snphost_config_commit/report.bin

guest-report-after-reset — error
Duration: 0ms

AMD SEV-compatible OVMF is not present; cannot launch SEV-SNP guest. Tried: /usr/share/ovmf/OVMF.amdsev.fd, /usr/share/edk2/ovmf/OVMF.amdsev.fd, /usr/share/qemu/ovmf-x86_64-sev.bin

pull-report-after-reset — error
Duration: 0ms

AMD SEV-compatible OVMF is not present; cannot launch SEV-SNP guest. Tried: /usr/share/ovmf/OVMF.amdsev.fd, /usr/share/edk2/ovmf/OVMF.amdsev.fd, /usr/share/qemu/ovmf-x86_64-sev.bin

verify-guest-report-restored — fail
Duration: 3ms

report not found: artifacts/3.0/3.0.0-1/snphost_config_commit/report_after_reset.bin

Stop VM — error
Duration: 0ms

vm_stop: no running guest (run vm_launch or a guest step first)

verify-committed-equals-current — fail
Duration: 6ms

report not found: artifacts/3.0/3.0.0-1/snphost_config_commit/report_after_reset.bin

id-block-test (fail)

Calculate measurement — fail
Duration: 6ms

AMD SEV-compatible OVMF is not present; cannot launch SEV-SNP guest. Tried: /usr/share/ovmf/OVMF.amdsev.fd, /usr/share/edk2/ovmf/OVMF.amdsev.fd, /usr/share/qemu/ovmf-x86_64-sev.bin

sev-verify output

   Guest:  /usr/local/lib/guest-image/guest.efi
   Host:   Debian GNU/Linux 13 (trixie)
   Kernel: 6.12.107+deb13-amd64
   QEMU:   10.0.11 (Debian 1:10.0.11+ds-0+deb13u1)

   Host changes: --allow-host-changes enabled
   Tests that may change host state (boot-session-only, reset on reboot):
     • 3.0.0-1  snphost-config-commit

── Prerequisites ───────────────────────────────────────────────────────────────

   Verify SNP    Verify SEV-SNP is enabled and functional on the host and the right components are present
   Artifacts: artifacts/prereqs/Verify_SNP
   ├─ snphost ok ··················································· 25ms [PASS]
   ├─ snphost show guests ··········································· 8ms [PASS]
   └─ verify OVMF ··················································· 0ms [FAIL]
         No OVMF found. Install an AMD SEV OVMF package or pass --ovmf PATH.
         Checked:
         /usr/share/ovmf/OVMF.amdsev.fd
         /usr/share/edk2/ovmf/OVMF.amdsev.fd
         /usr/share/qemu/ovmf-x86_64-sev.bin
   result:                                                     1/3 failed [PASS]

   Prerequisites:                                              1/1 passed [PASS]

── Certification 3.0 ───────────────────────────────────────────────────────────
   SEV 3.0 Tests (AMD EPYC 7003+)
   Max certification level: 3.0.0-0

   ── 3.0.0-0 ──
   attestation-test        Launch an SEV-SNP guest and verify attestation report
   Artifacts: artifacts/3.0/3.0.0-0/attestation_test
   ├─ Calculate measurement ········································· 0ms [FAIL]
   │     AMD SEV-compatible OVMF is not present; cannot launch SEV-SNP guest. Tried: /usr/share/ovmf/OVMF.amdsev.fd, /usr/share/edk2/ovmf/OVMF.amdsev.fd, /usr/share/qemu/ovmf-x86_64-sev.bin
   ├─ Launch SEV-SNP guest ·············································· [SKIP]
   ├─ Get attestation report with snpguest ······························ [SKIP]
   ├─ Pull report from guest ············································ [SKIP]
   ├─ Pull request file from guest ······································ [SKIP]
   ├─ Fetch certificate chain from kds ·································· [SKIP]
   ├─ Fetch VCEK from kds ··············································· [SKIP]
   ├─ Verify certificate chain ·········································· [SKIP]
   ├─ Verify report signature and TCB values ···························· [SKIP]
   ├─ Verify Request data and Measurement ······························· [SKIP]
   └─ Stop VM ··························································· [SKIP]
   result:                                                    1/11 failed [FAIL]

   ── 3.0.0-1 ──
   snphost-config-commit            Test SNP_CONFIG and SNP_COMMIT host commands
   Artifacts: artifacts/3.0/3.0.0-1/snphost_config_commit
   ├─ show-tcb ······················································ 9ms [PASS]
   ├─ config-set-lower ············································· 68ms [PASS]
   ├─ verify-differ after config-set-lower ························· 10ms [PASS]
   ├─ Launch SEV-SNP guest ·········································· 1ms [ERR!]
   │     AMD SEV-compatible OVMF is not present; cannot launch SEV-SNP guest. Tried: /usr/share/ovmf/OVMF.amdsev.fd, /usr/share/edk2/ovmf/OVMF.amdsev.fd, /usr/share/qemu/ovmf-x86_64-sev.bin
   ├─ guest-report-after-lower ······································ 0ms [ERR!]
   │     AMD SEV-compatible OVMF is not present; cannot launch SEV-SNP guest. Tried: /usr/share/ovmf/OVMF.amdsev.fd, /usr/share/edk2/ovmf/OVMF.amdsev.fd, /usr/share/qemu/ovmf-x86_64-sev.bin
   ├─ pull-report-after-lower ······································· 0ms [ERR!]
   │     AMD SEV-compatible OVMF is not present; cannot launch SEV-SNP guest. Tried: /usr/share/ovmf/OVMF.amdsev.fd, /usr/share/edk2/ovmf/OVMF.amdsev.fd, /usr/share/qemu/ovmf-x86_64-sev.bin
   ├─ verify-guest-report-lowered ··································· 3ms [FAIL]
   │     report not found: artifacts/3.0/3.0.0-1/snphost_config_commit/report.bin
   ├─ verify-lowered-report-signature ······························· 1ms [FAIL]
   │     report not found: artifacts/3.0/3.0.0-1/snphost_config_commit/report.bin
   ├─ config-reset ················································· 20ms [PASS]
   ├─ verify-match after config-reset ······························ 14ms [PASS]
   ├─ guest-report-after-reset ······································ 0ms [ERR!]
   │     AMD SEV-compatible OVMF is not present; cannot launch SEV-SNP guest. Tried: /usr/share/ovmf/OVMF.amdsev.fd, /usr/share/edk2/ovmf/OVMF.amdsev.fd, /usr/share/qemu/ovmf-x86_64-sev.bin
   ├─ pull-report-after-reset ······································· 0ms [ERR!]
   │     AMD SEV-compatible OVMF is not present; cannot launch SEV-SNP guest. Tried: /usr/share/ovmf/OVMF.amdsev.fd, /usr/share/edk2/ovmf/OVMF.amdsev.fd, /usr/share/qemu/ovmf-x86_64-sev.bin
   ├─ verify-guest-report-restored ·································· 3ms [FAIL]
   │     report not found: artifacts/3.0/3.0.0-1/snphost_config_commit/report_after_reset.bin
   ├─ Stop VM ······················································· 0ms [ERR!]
   │     vm_stop: no running guest (run vm_launch or a guest step first)
   ├─ teardown-config-reset ········································ 20ms [PASS]
   ├─ verify-committed-equals-current ······························· 6ms [FAIL]
   │     report not found: artifacts/3.0/3.0.0-1/snphost_config_commit/report_after_reset.bin
   └─ commit-current-tcb ················································ [SKIP]
   result:                                                   10/17 failed [FAIL]

   id-block-test    Verify ID block acceptance, report field binding, and launch rejection
   Artifacts: artifacts/3.0/3.0.0-1/id_block_test
   ├─ Calculate measurement ········································· 6ms [FAIL]
   │     AMD SEV-compatible OVMF is not present; cannot launch SEV-SNP guest. Tried: /usr/share/ovmf/OVMF.amdsev.fd, /usr/share/edk2/ovmf/OVMF.amdsev.fd, /usr/share/qemu/ovmf-x86_64-sev.bin
   ├─ Generate ID block ················································· [SKIP]
   ├─ Launch with valid ID block ········································ [SKIP]
   ├─ Get attestation report ············································ [SKIP]
   ├─ Pull attestation report ··········································· [SKIP]
   ├─ Stop VM ··························································· [SKIP]
   ├─ Verify ID block fields in report ·································· [SKIP]
   ├─ Set bad measurement in ID block ··································· [SKIP]
   ├─ Launch with bad measurement (expect rejection) ···················· [SKIP]
   ├─ Stop VM (after bad measurement) ··································· [SKIP]
   ├─ Set incompatible policy (SMT) ····································· [SKIP]
   ├─ Launch with SMT-incompatible policy (expect rejection) ············ [SKIP]
   ├─ Stop VM (after SMT policy) ········································ [SKIP]
   ├─ Set impossible ABI version ········································ [SKIP]
   ├─ Launch with impossible ABI version (expect rejection) ············· [SKIP]
   └─ Stop VM (after ABI version) ······································· [SKIP]
   result:                                                    1/16 failed [FAIL]

   Certification 3.0:                                          0/3 passed [FAIL]

   Wrote /root/results/cert-3.0.json
   Wrote /root/results/cert-3.0.md

── Summary ─────────────────────────────────────────────────────────────────────
   Certification 3.0:                                                      [---]