ubuntu 25.10 SEV version 3.0

[markg-github]

Failed to Achieve a Certification Level

Certified level: none
Max certification level: 3.0.0-0
Started: 2026-09-09T01:43:40.088958+00:00
Completed: 2026-09-09T01:44:47.971391+00:00

Environment

• Host OS: Ubuntu 25.10
• Host kernel: 6.17.0-41-generic
• Guest OS: Ubuntu 25.10
• QEMU: 10.1.0 (Debian 1:10.1.0+ds-5ubuntu2.7)
• OVMF: 2025.02-8ubuntu3.2 (ovmf)

Level 3.0.0-0

Test	Description	Result
attestation-test	Launch an SEV-SNP guest and verify attestation report	❌

Level 3.0.0-1

Test	Description	Result
snphost-config-commit	Test SNP_CONFIG and SNP_COMMIT host commands	✅
key-derivation	Launch SEV-SNP guest and run key derivation tests	✅

Failure Details

attestation-test (fail)

Fetch VCEK from kds — fail
Duration: 246ms

ERROR: Unable to fetch VCEK from URL: 429
Error: Unable to fetch VCEK from URL: 429

sev-verify output

   Guest:  /usr/local/lib/guest-image/guest.efi
   Host:   Ubuntu 25.10
   Kernel: 6.17.0-41-generic
   QEMU:   10.1.0 (Debian 1:10.1.0+ds-5ubuntu2.7)
   OVMF:   2025.02-8ubuntu3.2 (ovmf)

   Host changes: --allow-host-changes enabled
   Tests that may change host state (boot-session-only, reset on reboot):
     • 3.0.0-1  snphost-config-commit

── Prerequisites ───────────────────────────────────────────────────────────────

   Verify SNP    Verify SEV-SNP is enabled and functional on the host and the right components are present
   Artifacts: artifacts/prereqs/Verify_SNP
   ├─ snphost ok ··················································· 26ms [PASS]
   ├─ snphost show guests ··········································· 8ms [PASS]
   └─ verify OVMF ··················································· 0ms [PASS]
   result:                                                     3/3 passed [PASS]

   Prerequisites:                                              1/1 passed [PASS]

── Certification 3.0 ───────────────────────────────────────────────────────────
   SEV 3.0 Tests (AMD EPYC 7003+)
   Max certification level: 3.0.0-0

   ── 3.0.0-0 ──
   attestation-test        Launch an SEV-SNP guest and verify attestation report
   Artifacts: artifacts/3.0/3.0.0-0/attestation_test
   ├─ Calculate measurement ······································· 277ms [PASS]
   ├─ Launch SEV-SNP guest ········································ 16.1s [PASS]
   ├─ Get attestation report with snpguest ························· 16ms [PASS]
   ├─ Pull report from guest ······································· 10ms [PASS]
   ├─ Pull request file from guest ·································· 3ms [PASS]
   ├─ Fetch certificate chain from kds ···························· 270ms [PASS]
   ├─ Fetch VCEK from kds ········································· 246ms [FAIL]
   │     ERROR: Unable to fetch VCEK from URL: 429
   │     Error: Unable to fetch VCEK from URL: 429
   │     [Hint] Rate limited by KDS, re-run in a minute
   ├─ Verify certificate chain ·········································· [SKIP]
   ├─ Verify report signature and TCB values ···························· [SKIP]
   ├─ Verify Request data and Measurement ······························· [SKIP]
   └─ Stop VM ··························································· [SKIP]
   result:                                                    1/11 failed [FAIL]

   ── 3.0.0-1 ──
   snphost-config-commit            Test SNP_CONFIG and SNP_COMMIT host commands
   Artifacts: artifacts/3.0/3.0.0-1/snphost_config_commit
   ├─ show-tcb ······················································ 8ms [PASS]
   ├─ config-set-lower ············································· 68ms [PASS]
   ├─ verify-differ after config-set-lower ·························· 8ms [PASS]
   ├─ Launch SEV-SNP guest ········································ 12.1s [PASS]
   ├─ guest-report-after-lower ····································· 10ms [PASS]
   ├─ pull-report-after-lower ······································· 5ms [PASS]
   ├─ verify-guest-report-lowered ·································· 13ms [PASS]
   ├─ verify-lowered-report-signature ····························· 273ms [PASS]
   ├─ config-reset ················································· 14ms [PASS]
   ├─ verify-match after config-reset ······························ 10ms [PASS]
   ├─ guest-report-after-reset ····································· 11ms [PASS]
   ├─ pull-report-after-reset ······································· 5ms [PASS]
   ├─ verify-guest-report-restored ································· 12ms [PASS]
   ├─ Stop VM ····················································· 965ms [PASS]
   ├─ teardown-config-reset ········································ 14ms [PASS]
   ├─ verify-committed-equals-current ······························· 5ms [PASS]
   └─ commit-current-tcb ············································ 5ms [PASS]
   result:                                                   17/17 passed [PASS]

   key-derivation              Launch SEV-SNP guest and run key derivation tests
   Artifacts: artifacts/3.0/3.0.0-1/key_derivation
   ├─ Calculate measurement ······································· 289ms [PASS]
   ├─ Launch SEV-SNP guest ········································ 12.1s [PASS]
   ├─ Get attestation report ······································· 10ms [PASS]
   ├─ Pull attestation report ······································· 6ms [PASS]
   ├─ Parse attestation report ······································ 5ms [PASS]
   ├─ Test determinism ············································· 20ms [PASS]
   ├─ Test VMPL isolation ·········································· 21ms [PASS]
   ├─ Test root key difference ····································· 17ms [PASS]
   ├─ Test SVN bound enforcement and sensitivity ··················· 14ms [PASS]
   ├─ Test TCB bound enforcement and sensitivity ··················· 9.1s [PASS]
   ├─ Test GFS sensitivity ········································· 17ms [PASS]
   ├─ Test GFS field mixing ······································· 112ms [PASS]
   ├─ Save reference key from CVM 1 ································ 10ms [PASS]
   ├─ Stop CVM 1 ·················································· 967ms [PASS]
   ├─ Launch CVM 2 ················································ 12.1s [PASS]
   ├─ Verify key matches across CVMs ······························· 11ms [PASS]
   └─ Stop CVM 2 ··················································· 1.0s [PASS]
   result:                                                   17/17 passed [PASS]

   Certification 3.0:                                          2/3 passed [FAIL]

   Wrote /root/results/cert-3.0.json
   Wrote /root/results/cert-3.0.md

── Summary ─────────────────────────────────────────────────────────────────────
   Certification 3.0:                                                      [---]