AES-NI support in TrueCrypt (Sandy Bridge problem)

glaufan - thanks a lot for the screenshot and information. I'll update the top post.

 

I just sent question to ASUS about N53SN notebooks and AES-NI support on 2630QM processors, so let's wait for the outcome

 

I've sent a report to asus about g73sw AES-NI support, feels like a waste of time tbh. But Im sure it helps at least a little.

 

Local TSD informed me that the BIOS for the K53E was a beta version and the AES-NI will not be available in the final version. I tried to obtain a beta for G73SW.

 

I think the only thing that can sum that up is "what the ***?" It doesn't exactly cost them anything to have it enabled.

Hopefully you can get us a G73SW beta version with it enabled - it really is the last thing needed for it to be the perfect laptop for me.

 

Or somebody should try to find the right CMOS modification by himself - I remember, how was I solving similar issue with enabling HW virtualization on my old notebook - editing CMOS helped and it worked since then
http://forum.notebookreview.com/compal/237988-hardware-virtualization-hel80-81-a.html

 

Show me a tool that lets me edit the bios on my G73SW to enable it, and I'll do it. It uses an Aptio AMI bios, and no one's leakeda version of mmtool yet that supports it. Or at least that I know of.

 

Skywise, post an Asus link to the BIOS you want and I'll have a look.

 

Hi, I'm not Skywise, but this is the latest available bios for G73SW:
ASUSTeK Computer Inc. - Notebooks- ASUS G73SW
BIOS, Version 205

 

Yeah that's the one.

 

PM sent, GL

 

I'm owning an Asus X7BSV (equal to N73SV) with a 2630QM processor.
After reading this thread I contacted ASUS Support Germany and asked for a biosupdate.

The answer given was a little surprise.

"Guten Tag Herr *********,

vielen Dank für Ihre Email!

Es ist nicht geplant dies Feature in Zukunft zu nutzen, da auch für viele Zusatzsachen, welche Intel anbiette, diese gesondert freigeschaltet und dafür auch teilweise bezahlt werden muss und / oder instabilitätet auftreten können.
(...)"

For those of you who could not understand german:
The supportguy told me, that the AES-NI is a feature which won't be enabled because it's to expensive for ASUS to get a license from INTEL OR it may causes instabilities.

Today I wrote back, that I'm not satisfied with this answer, because i bought this notebook with this processor especially because of the AES-NI. There has been no answer, yet.

I will report every progress.

Earlgrey

 

The support guy informed me that they will not release any beta version BIOSes with enabled AES-NI support and the engineer who gave out the beta version BIOS for K53E made a mistake. He was not allowed to do so. So I guess we have to solve this for ourselves.

Is there any failsafe in the notebook's BIOS? Is it possible to recover it to a working state in case of failure?

 

Dufus, thank you - it worked!

 

Wow. Could you please send me the fixed BIOS or share it somehow?

 

I need to check with Dufus first to make sure that's okay, but I figure it shouldn't be an issue.

 

Ok. Thank you in advance.

 

Good to hear.

You should thank thome as the disabling of AES-NI is undocumented and I would not have known otherwise. I tried this first on my Asus P8P67 desktop to check by using it the other way round, to disable AES-NI. It's a per core setting which seems a bit strange.

One thing I like about EFI is that it's usually easy to hack without propriety tools, the hard and tedious bit is understanding the underlying code. In your case a simple mod, only 2 bytes needed to be changed in the BIOS.

Pet4r, if your using the same laptop as Skywise and also have a CPU with AES-NI that should be okay. My main concern is if people try to flash with a CPU that actually doesn't support AES-NI. As it's an undocumented feature I'm not sure what would happen, if anything, but better safe than sorry.

 

That's amusing. Sounds like they're lying to you.

 

The G73SW only uses AES-NI capable CPUs, so that shouldn't be an issue in this case. I'll upload the file in a moment after adding some disclaimers.

EDIT: On second thought - I'll see if I can get my contact over at Xotic to try it out first, in case it breaks on the 2630QMs. At least it's possible for them to easily swap CPUs or do a recovery flash.

 

I got another answer from Asus Germany Support:

"Sehr geehrter Herr ******,

von einem solchen Bios ist uns nichts bekannt und das aufspielen eines nicht offiziell freigegebenen Bios führt auch zum Garantieverlust weswegen wir diesbezüglich abraten.

Da das Notebook nicht mit dieser Funktion beworben wurde ist es unwahrscheinlich das wir diesbezüglich noch ein Biosupdate veröffentlichen werden um diese Funktion zu aktivieren.
(...)"

This time they told me that they don't know anything about this special bios and flashing the bios with an unofficial version will let me loose my warranty.
Furthermore they say that the notebook wasn't explicit promoted with this [AES-NI] feature and there will be no official update.

Those lazy people .

 

But they did not mentioned any restrictions regarding the CPU either...

 

Great! Thank you!

 

You guys might be interested in this thread.

AES support disabled by Asus?

Also might be an idea moving this thread to the NBR Asus one for more coverage to Asus users.

 

This isn't just an Asus issue though, at least now that it's been revealed that the 2630QM supports AES-NI. If you read through the thread you'll notice reports from several other laptop brands not enabling it.

 

No, I didn't read the whole thread. Maybe under hardware then. Windows OS and Software just doesn't seem to be the right place for a BIOS problem.

 

OK guys, I got another answer from official ASUS support in Czech Republic:

"Dobry den,
Tak bohuzel jsem dostal negativni a také hodne pozvmenou odpoved.
Veskere notebooky ASUS tuto funkci nemohou podporovat ,z duvodu politiky exportu/importu. Jedna se o prohlaseni US Export Administration Regulations a konkretne klasifikace ECCN 5A002.
Jelikoz kazda země muze mit sve podminky exportu/importu , je tato funkce u notebook ASUS vždy vypnuta.
Omlouvam se za predchozi ne zcela presnou informaci, avsak takto mi dorazila z Taiwanu. Az na naslednou urgenci mi prisla tato odpoved."

in English it says something like:
I received negative answer for your question [edit: about BIOS supporting AES-NI in Asus N53SN notebook].
All ASUS notebooks can't support this function because of import/export regulations/politics. It's based on US Export Administration Regulations, to be more specific: classification ECCN 5A002.
Because different countries may have different import/export politics, this function is by default disabled for all notebooks.
... this is the official statement I received from Taiwan.

The question is - there is no regulation about AES-NI support in processors in Czech Republic, as far as I know, so should I contact them again or what

Edit: anybody skilled in laws and regulations: what does this says?
http://www.uptodateregs.com/_eccn/ECCN.asp?ECCN=5A002

 

lol, then you should ask them why is it allowed for Asus Desktops

 

Are you saying branded Asus desktops with AES-NI enabled are shipped to the same countries, where Asus notebooks with disabled AES-NI are sold as well, now that is interesting.
It looks like every single answer from Asus support about AES-NI is different

 

It's already been shown that the problem is in the BIOS. The BIOS is the same for all countries. Ask one of the locals with SNB P67/H67/Z68 Asus boards to make a CPU-z SS.

Not sure but how about here..

PCTuning • Zobrazit téma - ASUS P8P67 (1155, P67) - doporuceni?

 

My guess is they just weren't sure about this feature or maybe they ran into some problems, instabilities and stuff, or maybe they don't want to pay/handle some license fees, so they made up all these "reasons" why it's not possible to ship BIOS with AES-Ni enabled.
I just sent another email to the Asus guy saying something like "this regulation is not related to our country, you're shipping PCs anf MoBos with AES-NI enabled so I still want the updated BIOS with AES-NI". I'm also leaveing for a wekk, good luck contacting more support guys and getting more info

If anybody is interested - this is my notebook with link to current BIOS, could you modify the latest one to support AES-NI?
http://www.asus.com/Notebooks/Multimedia_Entertainment/N53SN/#download

 

This threads seems to be 90% Asus, but Dell has just released a bios update which enables AES support on XPS 15.

 

@Necroman

The regulation does not apply to any device or code that speeds up encryption. It only applies to devices that use a level of encryption that is for governmental use or for devices that provide government level communication and national level security.

In other words, you can distribute something that makes it easier to use something else that makes encryption possible, but you cannot distribute the something that actually does the encryption.

 

Well I'm not really interested as such but can try to do for you if you want it. However be aware that,

1. Flashing has some risk of things going badly, even more so with a BIOS mod.

2. Asus could possibly void your warranty if they find out your using a modded BIOS.

 

I can attest to the first one - my G73SW is now a brick. Ironically it happened when I was trying to flash back to the original BIOS, not the modded one, because I was troubleshooting an Ethernet issue. (don't use EasyFlash to load a bios file from an NTFS drive)

 

That sucks, hope you can get it sorted out quickly.

One good thing about Asus DT boards is that they have a socketed BIOS chip but I would think with laptops it's probably soldered in.

 

Doesn't it have a failsafe? Like reading BIOS image from optical drive in case of error?

What about the warranty? I guess they won't be able to find that the BIOS was modified, but is the warranty valid in case of BIOS flash? What if you don't tell them that you had tried to flash the BIOS?

Hopefully they'll fix it soon.

 

I don't really understand. The notebook can do the AES encryption even without the AES-NI instruction set. The AES-NI simply makes the encryption about 10 times faster.

My college has a Eurocom (Clevo) notebook which has enabled AES-NI instruction set enabled. So this regulation does not apply to all notebook manufacturers?

 

It may, but that only works if the laptop turns on. In this case it's completely dead. People have been able to recover bad flashes in some cases on other models where the computer actually turns on, but in this case I think it's a lost cause. Pulling the cmos battery would be a hail mary pass at fixing it, but I'd have to completely disassemble the computer and due to the sticky tape keeping the keyboard in place, that would be noticeable by any warranty repair tech.

If you tell them you tried to flash an unsupported BIOS, then the warranty is not valid. If you tell them you were flashing an official BIOS you may be covered, but the guy I talked to say it's a bit of a grey area - Asus doesn't want to be responsible for something that's not their fault. Asus US does have an accidental damage warranty included with some laptops you can use once though, no questions asked, but it's only usable in the US. The other option is to simply say "the computer doesn't work" and chances are the tech will probably just figure out the motherboard is the problem and swap that.

So would I, but since I'll be travelling to Japan early next week (and stay there for a while), there's no time for me to get it fixed yet. I'll have to do it while there instead. Time to test if the global warranty really works...

PS. I don't know much a motherboard replacement outside warranty would cost, but anyone doing any kind of BIOS flashing, official or not, should be prepared to have to pay for it in case things go wrong. After all, It is an unnecessary risk you take in most cases. Laptops generally don't have dual bioses that would let you easily recover in case things really go wrong.

 

Do you think it has to do something with the modified BIOS? Or was it just bad luck?

I think disassembling your notebook does not make your warranty void. It does not have any warning seals on it. Furthermore unfortunately my notebook is a modified one. The HDDs and the RAM are not from ASUS, they have been replaced by the reseller. I talked to the local ASUS service and they said that the warranty is still valid for every parts that was provided by ASUS (not the RAM and the HDDs). But it is still pretty complicated to disassemble the notebook.

 

I don't think it was related to modified BIOS at all, but more a case of using the BIOS's own flash utility to flash from a file stored on an NTFS drive. That's apparently been known to be glitchy in some cases. Next time it's USB and FAT32 for me.

While you can swap the HDDs and RAM, the rest is essentially non-user serviceable parts. When you buy a customized build from a dealer, they are authorized to replace other things such as CPU etc. and they will handle the warranty on that. In this case they'll send me a RMA form that contains information on which components have been upgraded and contact information etc. I can hand-in with the laptop.

 

The following is an email thread with Asus on this issue:

Indeed I have a problem.

I'm an Intel Corporation employee and this laptop was purchased under the terms of Intel chip loaner program that was agreed between Intel and Asus distributor/represenatative in Israel (VISUAL TECHNOLOGIES D.G. LTD).
There is no mention of absence of AES-NI support in N53SV notebooks in any publically available documentation. Since Intel Core i7-2820QM and Intel® Core™ i7 2630QM processors are stated in documentation as fully supported, this is misleading advertisement and against goverment regulations in most countries. The AES-NI support was one of the most important factors for purchasing this laptop and processor.

When Asus is going to provide me with updated BIOS alowing to enable AES-NI instruction set?

Thanks in advance,

XXXXX XXXXXXXX
Intel Israel (74) LTD. P.O.BOX 1659. Haifa 31015 Israel
Office: +972-XXXXXXXX
Mobile: +972-XXXXXXXX
---------- Original Message ----------
From:ASUS TSD
To:XXXXXXXX@XXXXXXcom
Date:2011-08-03 06:24:17

Dear Valued Customer,

For this issue, this feature is disabled in ASUS laptops. Sorry for the inconvenience and thanks for your understanding!
If having any problems, please don't hesitate to contact us.

Best Regards,
May
ASUS Customer Service Center
---------- Original Message ----------
From : [email protected]
Sent : 2011-8-2 9:01:28
To : "[email protected]"
Subject : Notebook N53SV
[CASEID=XXXXXXXXXXXXXX]
Apply date : 8/2/2011 7:48:46 AM(UTC Time)

[Contact Information]
*Name : XXXXXXXXXX
*Email Address : [email protected]
Phone Number : XXXXXXXXX
City : Haifa
*Country : Israel[מְדִינַת יִשְׂרָאֵל / دَوْلَةُ إِسْرَائِيلَ]

[Product Information]
*Product Type : Notebook
*Product Model : N53SV
*Product S/N : XXXXXXXXXXXXX
Place of Purchase : Visual
*Date of Purchase : 2011/7/29

*Operating System : Windows 7 64bit

[Problem Description]
My notebook has Intel SandyBridge 2820QM processor. This processor supports AES-NI instruction set. For some reason, notebook BIOS disables AES-NI. How can I enable it?

 

Hi all, I've been reading this whole thread and have also sent a support request to ASUS about an updated BIOS. I have an ASUS G73SW with a i7-2630QM processor that according to Intel should have AES-NI, but like all others here, it doesn't show up.

I have the same setup as Skywise, except his processor was i7-2720QM and has double the memory I do. We use the same BIOS (v.205) and I was hoping I could persuade Dufus or Skywise to send me the modded BIOS, as I would like to try it. I understand of course that you are not liable for what happens if I try to flash my BIOS and it becomes... a brick.

I felt it was better posting in the thread then to PM said users, and I realise a request as a first post might not sit well, but I'm hoping I won't get in trouble for it.

I will post back here when/if I get a response from ASUS in any case.

Regards

Teazle


edit: Corrected names, sorry Skywise. Also, PMs enabled...

Also an update: on the ASUS webpage you can now download a BIOS for K53E (Glaufan's model) released 2011.08.01 which is a later date then the post made by Glaufan - possible official update and not a "leaked beta"?

 

Skywise, not Skydrive .

You have a PM - well, you would have if you allowed PMs . Turn it on in your settings.

 

Still says "Teazle has chosen not to receive private messages or may not be allowed to receive private messages. " Maybe it's because you only have one post so far?

 

It could very well be that my postcount is too low I guess, seeing as the statement "may not be allowed to receive private messages." Exists. Well, I guess I will have to post more (though of course, no rubbish)

edit: I cannot access the private messaging part of this site, so most likely it is either Admin-disabled (My account is after all just 2 hours old) so, I guess I will wait and see

 

Just post more and send me a PM then when it works - I'd rather not post the files in public yet due to the damage potential if there's an issue with the regular G73SW configuration.

 

Previously I had tried both CPU-Z and Intel Processor Identification Utility to try to verify if AES-NI is avaible. I thought that maybe IPIU would use some nifty tricks to talk to the CPU "directly" and thusly get the AES-NI information correctly, however, such seemed not to be the case.

I then took contact with Intel using their LiveChat (nifty stuff I must say) and according to the operator, if the BIOS has AES-NI disabled, IPIU would not be able to tell you that AES-NI exists on CPU.

I thought this might be relevant information, as I've seen someone (Zero989) posting a IPIU screenshot that showed AES-NI to be supported - however, this was taken from another hardware platform then my ASUS G73SW - and it would seem with a BIOS with AES-NI enabled.

In conclusion, this might be obvious to some, but not to me: CPU-Z or Intel Processor Identification Utility cannot tell you AES-NI is supported if BIOS silently has it disabled.

 

If you mean support for AES-NI then no.

 

We already know from Skywise that Dufus' modified BIOS for G73SW works with a 2720QM processor. Teazle, please let us know if it works with the 2630QM processor too!

Skywise, have you received any news or testing results from Xotic guys? I really want to install and use it, if possible.