debian forky SEV version 3.0

# Failed to Achieve a Certification Level

**Certified level:** none
**Max certification level:** 3.0.0-0
**Started:** 2026-07-17T04:54:31.270232+00:00
**Completed:** 2026-07-17T04:54:33.745286+00:00

## Environment

- **Host OS:** Debian GNU/Linux forky/sid
- **Host kernel:** 7.1.3+deb14-amd64
- **QEMU:** 11.0.2 (Debian 1:11.0.2+ds-2)
- **OVMF:** 2025.11-5 (ovmf-amdsev)

### Level 3.0.0-0

| Test | Description | Result |
|------|-------------|--------|
| attestation-test | Launch an SEV-SNP guest and verify attestation report | :x: |

### Level 3.0.0-1

| Test | Description | Result |
|------|-------------|--------|
| snphost-config-commit | Test SNP_CONFIG and SNP_COMMIT host commands | :white_check_mark: |

### Failure Details

attestation-test (fail)

**Launch SEV-SNP guest** — error
Duration: 2.0s
```
QEMU exited immediately with code -6: qemu-system-x86_64: kvm_set_user_memory_region: KVM_SET_USER_MEMORY_REGION2 failed, slot=2, start=0xfeda0000, size=0x20000, flags=0x4, guest_memfd=13, guest_memfd_offset=0xa0000: Invalid argument
kvm_set_phys_mem: error registering slot: Invalid argument
```

### sev-verify output
```
Guest: /usr/local/lib/guest-image/guest.efi
Host: Debian GNU/Linux forky/sid
Kernel: 7.1.3+deb14-amd64
QEMU: 11.0.2 (Debian 1:11.0.2+ds-2)
OVMF: 2025.11-5 (ovmf-amdsev)

── Prerequisites ───────────────────────────────────────────────────────────────

Verify SNP Verify SEV-SNP is enabled and functional on the host and the right components are present
Artifacts: artifacts/prereqs/Verify_SNP
├─ snphost ok ··················································· 63ms [PASS]
├─ snphost show guests ··········································· 9ms [PASS]
└─ verify OVMF ··················································· 1ms [PASS]
result: 3/3 passed [PASS]

Prerequisites: 1/1 passed [PASS]

── Certification 3.0 ───────────────────────────────────────────────────────────
SEV 3.0 Tests (AMD EPYC 7003+)
Max certification level: 3.0.0-0

── 3.0.0-0 ──
attestation-test Launch an SEV-SNP guest and verify attestation report
Artifacts: artifacts/3.0/3.0.0-0/attestation_test
├─ Calculate measurement ······································· 185ms [PASS]
├─ Launch SEV-SNP guest ········································· 2.0s [ERR!]
│ QEMU exited immediately with code -6: qemu-system-x86_64: kvm_set_user_memory_region: KVM_SET_USER_MEMORY_REGION2 failed, slot=2, start=0xfeda0000, size=0x20000, flags=0x4, guest_memfd=13, guest_memfd_offset=0xa0000: Invalid argument
│ kvm_set_phys_mem: error registering slot: Invalid argument
├─ Get attestation report with snpguest ······························ [SKIP]
├─ Pull report from guest ············································ [SKIP]
├─ Pull request file from guest ······································ [SKIP]
├─ Fetch certificate chain from kds ·································· [SKIP]
├─ Fetch VCEK from kds ··············································· [SKIP]
├─ Verify certificate chain ·········································· [SKIP]
├─ Verify report signature and TCB values ···························· [SKIP]
├─ Verify Request data and Measurement ······························· [SKIP]
└─ Stop VM ··························································· [SKIP]
result: 1/11 failed [FAIL]

── 3.0.0-1 ──
snphost-config-commit Test SNP_CONFIG and SNP_COMMIT host commands
Artifacts: artifacts/3.0/3.0.0-1/snphost_config_commit
├─ show-tcb ····················································· 10ms [PASS]
├─ config-set-lower ············································ 106ms [PASS]
├─ verify-differ after config-set-lower ·························· 9ms [PASS]
├─ config-reset ·················································· 9ms [PASS]
├─ verify-match after config-reset ······························ 45ms [PASS]
├─ config-set-mask-chip-id ······································· 8ms [PASS]
├─ config-set-mask-chip-key ······································ 8ms [PASS]
├─ config-set-mask-both ········································· 45ms [PASS]
├─ config-reset-masks ············································ 8ms [PASS]
├─ verify-match after config-reset-masks ························· 8ms [PASS]
└─ commit ························································ 4ms [PASS]
result: 11/11 passed [PASS]

Certification 3.0: 1/2 passed [FAIL]

Wrote /root/results/cert-3.0.json
Wrote /root/results/cert-3.0.md

── Summary ─────────────────────────────────────────────────────────────────────
Certification 3.0: [---]

```