On Sun, Sep 13, 2026 at 12:43:20PM +0200, stolen data wrote: > Ah, hm. Both OpenBSD and Linux enumerate SEV and SEV-ES among the > supported CPU features. > > OpenBSD: "cpu0: cpuid 8000001F eax=f<SME,SEV,PFLUSH_MSR,SEVES> ecx=f" > > Linux /proc/cpuinfo: "... sev sev_es ..." > > Are the PRO models simply missing the necessary parts from the PSP > in order to support SEV all the way? > > On 2026-09-13 01:59:15 Mike Larkin wrote: > > this cpu does not support SEV
yeah, google says: While your CPUID readout shows that the processor hardware capability exists at a silicon level, the crucial missing element is the SEV/SEV-ES firmware inside the AMD Secure Processor (ASP/PSP). AMD strictly limits and compiles the SEV firmware stack for its EPYC enterprise server processors. [1] (https://github.com/AMDESE/AMDSEV/issues/1) [2] (https://projectzero.google/2022/05/release-of-technical-report-into-amd.html) [3] (https://www.amd.com/content/dam/amd/en/documents/epyc-business-docs/other/protecting-the-public-sector-with-confidential-computing.pdf) Here is exactly what is missing and how the features are partitioned on your APU: The Missing PSP/CCP Features No SEV Firmware API: The Platform Security Processor (PSP) requires a dedicated software layer (the SEV firmware API) to manage the lifecycles, key generation, and cryptographic backing of isolated guest virtual machines. This firmware is completely stripped out of the AGESA / BIOS microcode for consumer and client PRO lines. [1] (https://medium.com/@sekyourityblog/confidential-vms-are-missing-everything-and-i-love-it-87397bf1babd) [2] (https://github.com/AMDESE/AMDSEV/issues/1) No ASID Tagging for VMs: SEV requires Address Space Identifier (ASID) tags tied directly to memory encryption keys to isolate different virtual machines. On client APUs, the PSP only supports a single key context meant for the host operating system. [1] (https://medium.com/@sekyourityblog/confidential-vms-are-missing-everything-and-i-love-it-87397bf1babd)0
