AES-NI support in TrueCrypt (Sandy Bridge problem)

[Necroman]

carlicious's summary is really magic. Every step is clear and right.
After successfully unlock AES-NI on linux (my MSR[0x13C] is 0) I went on mod my BIOS. turns out 2410M shares the same CPUID hence the same microcode update with 26x0QM. And I have AMI Aptio(EFI) BIOS but the phoenixtool works fine, while amitool failed hard.

Now this is really interesting - according to Intel specs Core-i5 2410M does not support AES-NI at all, but you said the BIOS trick worked for you

Intel® Core? i5-2410M Processor (3M Cache, 2.30 GHz)

My guess is the same situation was with Core-i7 2630QM, it had the support for AES-NI from the beginning, but they "admitted" it in specs few months after the release... Strange indeed.

[K41H]

Now this is really interesting - according to Intel specs Core-i5 2410M does not support AES-NI at all, but you said the BIOS trick worked for you

Intel® Core? i5-2410M Processor (3M Cache, 2.30 GHz)

My guess is the same situation was with Core-i7 2630QM, it had the support for AES-NI from the beginning, but they "admitted" it in specs few months after the release... Strange indeed.

I think they "admitted" it in another way, at bottom of the spec page they wrote:

"Some products can support AES New Instructions with a Processor Configuration update, in particular, i7-2630QM/i7-2635QM, i7-2670QM/i7-2675QM, i5-2430M/i5-2435M, i5-2410M/i5-2415M. Please contact OEM for the BIOS that includes the latest Processor configuration update."

I assume "Processor configuration update" means "microcode update". I guess you are right, the microcode shipped with those SKUs disabled AES-NI, some days later Intel changed their mind and mercifully release new microcode update to unlock it. But they forgot to change my spec page

It will be more interesting if a certain 2310M unlocked AES-NI though, since in nowhere did Intel "admit" it.

Anyway, it's cool I get bonus feature from Intel, for free, after months of usage. Definitely the first time in my life. Huge satisfaction XD

[K41H]

I wonder how's every brand's react to the BIOS update, so I've done some digging.
Here's an incomplete and inaccurate summary of the AES-NI support status of various brands:


Brands (quietly) add support by releasing new BIOS:
HP (despite support contact denied it)
TOSHIBA
FUJITSU
Apple (by releasing new efi firmware or Lion or both. Anyway it's working)
DELL (BIOS update to SNB notebook unlock AES-NI without notice. However one BIOS upgrade on a certain server disabled AES-NI last year, which leads thome to discover the undocumented MSR for controlling AES-NI. )
MSI (one tech support kindly point out we need microcode rev 1A or higher)
Acer
thinkpad

No official support case yet:

lenovo
at least one model has microcode update but deliberately disable the feature, which gives us some initial workaround focusing on MSR 0x13c

my white brand NB OEM by Wistron
They do not update microcode in BIOS. They do not release new BIOS to end user. They hardly even make new BIOS. story end

Asus
hottest here on this post. situation is different from model to model. supports all over the world give different excuse not to enable it. some models get MSR blocking, some don't get new microcode update, no NB gets AES-NI enabled, except N73SV for now.
Once they sent one BIOS to one customer which enabled it. Later they claim it's beta and the BIOS is sent by mistake. Newly released BIOS of that model still disable it.


*********************
I'm sure I've made a lot of mistakes. Please correct me. I'll edit this post later. Thank you

[Teerex]

Asus
hottest here on this post. situation is different from model to model. supports all over the world give different excuse not to enable it. some models get MSR blocking, some don't get new microcode update, no NB gets AES-NI enabled.
Once they sent one BIOS to one customer which enabled it. Later they claim it's beta and the BIOS is sent by mistake. Newly released BIOS of that model still disable it.

Asus N73SV:

[ankhazam]

Yeah Teerex we remember, however passing that as an argument for Asus to enable it on other devices (identical N53, just smaller) had no positive result.

[Teerex]

Yeah, maybe they even did this one unintentionally.

My ASUS suprised me just the other day. This is what it says on the specs page:

3 -in-1 card reader ( SD/ MS/ MMC)

So, no 5-in-1 or 7-in-1 option, right? So just for the heck of it, I pushed and xD card inside, and hop.. it works. I mean, even their frontpage published specs are iffy.

[robwicks]

Could you see if you could work your magic on an Asus U56E?

[Necroman]

My sister got Acer Aspire 5750G with Core-i5 2410M - can anybody check the latest BIOS, if it contains similar code for enabling AES-NI?
Acer Support: Downloads & Support Documents - Notebook / Aspire / Aspire 5750G

Edit: I just updated BIOS on that notebook from 1.11 (AES-NI not enabled) to 1.16 and the new BIOS supports AES-NI by default, without any BIOS editing magic - that's so cool

[Lomax1980]

Hi @ all,

i own a ASUS G74SX Notebook with 2670qm CPU. The NB is great but i actually found out, that there is no AES enabled. Tried the step by step explanation by carlicious, but i 'm stuck in the middle. Could sb be so kind and make me an AES-enabled firmware for that notebook? The actual link to firmware 2.03 can be found here: ASUSTeK Computer Inc. - Notebooks- ASUS G74SX

Beacause of encrypting all of my data with truecrypt, i would appreciate any help. If you have a paypal account, i would spend some money for an updated firmware.

Thanks in advance!

Lomax

[K41H]

@Lomax1980
I downloaded BIOS 2.03 from that link, and it fits exactly what carlicious described, even the module names are the same. You need both microcode update and MSR unlock.

I did my best but I can't guarantee you anything. USE THIS MOD AT YOUR OWN RISK:

Download G74SxAS.203.xdelta3 from Sendspace.com - send big files the easy way

edit:above link deleted. use the working version below:
Download G74SxAES.bin.xdelta3 from Sendspace.com - send big files the easy way

It's an xdelta3 patch data represents only those bits modified so the file is tiny. You need to download xdelta3 and patch the original 2.03 BIOS directly downloaded from ASUS. xdelta3 will verify BIOS image. If you can't apply the patch, then you should not use it, because this indicates something goes wrong so it's too dangerous to flash.

Hope it works. Good luck~