TSME was the thing that actually defended your unlocked-but-screensavered laptop from a cold-boot attack and from a malicious PCIe peripheral DMAing RAM (think a hostile Thunderbolt dock or evil-maid USB4 device). Without it, encrypted disk keys, browser session tokens, and any in-memory wallet seed are sitting in DDR in cleartext between the moment your screen locks and the moment power actually drops to zero on the DIMM.
The really frustrating part is TSME has roughly zero performance cost — it is line-rate AES in the memory controller — and it was on by default. So the only plausible reason to silently flip it off on consumer parts is product segmentation: SME / SEV stay as a Pro/Epyc feature, and consumer chips are deliberately downgraded so the enterprise SKUs look better. The non-response from AMD engineering is consistent with that — there is no good technical answer to give.
For anyone on an affected board: check after a BIOS update. If your firmware quietly dropped it you will see it gone in the boot log.
TSME was the thing that actually defended your unlocked-but-screensavered laptop from a cold-boot attack and from a malicious PCIe peripheral DMAing RAM (think a hostile Thunderbolt dock or evil-maid USB4 device). Without it, encrypted disk keys, browser session tokens, and any in-memory wallet seed are sitting in DDR in cleartext between the moment your screen locks and the moment power actually drops to zero on the DIMM.
The really frustrating part is TSME has roughly zero performance cost — it is line-rate AES in the memory controller — and it was on by default. So the only plausible reason to silently flip it off on consumer parts is product segmentation: SME / SEV stay as a Pro/Epyc feature, and consumer chips are deliberately downgraded so the enterprise SKUs look better. The non-response from AMD engineering is consistent with that — there is no good technical answer to give.
For anyone on an affected board: check after a BIOS update. If your firmware quietly dropped it you will see it gone in the boot log.