AES-NI support in TrueCrypt (Sandy Bridge problem)

My patched BIOS with MSR 0x13c set to 1 on ASUS G73SW with i7-2630QM does not enable AES-NI, like Dufus said. I have sent an inquiry to Intel, but has of yet recieved no answer.

I'm patiently awaiting a response.

edit: Bought my ASUS G73SW in August 2011

edit2: I gave the tutorial a go, and in the case of Bios rev. 205 for ASUS G73SW you need to patch offset 2465 in 2BB5AFA9-FF33-417B-8497-CB773C2B93BF_1_470.ROM - However, this does not seem to do anything for me...

edit3: Have successfully flashed ASUS G73SW to enable AES. Thanks to carlicious - microcode needed to be updated and MSR 0x13c set to 1

 

If you've had your question escalated, Intel can take quite a bit of time to answer.

You could also try posting here if you haven't done so already and include a ss of the Intel® Processor Identification Utility showing AES-NI disabled along with a utility showing MSR 0x13c value.

I'm not sure if the new revision Gh0st01 mentioned might not be the sata problem early this year but if you ask him nicely you should be able to get your CPU revision from the Intel utility and check it against what Gh0st01 gets.

Intel Utility

 

How would I go about retrieving the MSR value? Showing a hexdump of the BIOS (dissassembled or not) I don't think they will consider be evidence of me setting it correctly.

 

Here are the screenshots!






Dufus: You're right. The new revision is related to the motherboard, not the processor.

 

btw is it possible to get back to stock BIOS after flashing the AES one for N53*N?

 

HP is lying to you. As far as I know all the 2630QM around were produced in volume between October and January. Mine was assembled in June and it still has the ''old'' 2630 QM. ASUS enabled AES-NI in BIOS.

There is an AES-NI demo by Intel.

 

HP enabled AES-NI in dv7-6059 with F.1A BIOS update. I don't know if they did it by mistake or something, but before F.1A cpu-z didn't show AES and now with F.1A it does.

 

There are a couple of utilities you could try that IIRC should be acceptable by Intel.

CrystalCPUID
This has an MSR editor and MSR walker that could be used to display MSR 0x13c.

RWEverything
This provides a custom list to add MSRs and displays the MSR for each core. Last time I used RWEverything the exception handling didn't work too well. For instance if you tried to read an MSR that didn't exist it would cause an exception to be generated and without trapping that exception a BSOD so be careful and make sure you have everything saved before using it.

Thanks for the screenies gh0st01, good to see your getting the AES HW boost that was originally denied to you.

 

First of all, have really flashed your BIOS? If the new one has same version as the previous, maybe the flashing process was canceled. Second, have you tried full shut down, remove battery, replug battery and turn on? When I was modifying my BIOS on Compal HEL80 to enable HW Virtualization this was a necessary step.

 

I'm very glad to hear that others can benefit from my afternoon of disassembling as well

Yes I can confirm this, as can wrathchild_67. Check out his 'proof' in the first post after my tutorial.

This sounds really odd since you did the exact same thing as I did. Maybe this is why the bit 0 (the write lock) is tested first. If it is set, writing to MSR 0x13c is skipped. Maybe Intel also ships variants of this CPU with this value pre-set.
Also, I read somewhere that modern CPU microcode can be upgraded. Maybe some initialization microcode sets the MSR in your CPU (just speculating here).
Although these scenarios are possible, I find them very unlikely. Are you absolutely sure you flashed your bios correctly? WinFlash denies downgrading or flashing the same version by default.

As long as your system remains bootable you're also able to flash the stock bios. I am, however, in no way responsible if you perform the mod incorrectly and your system becomes unbootable.

 

@carlicious

Good work.

I try to change my BIOS for the Asus X93SV (K93SV)
The phoenixtool and MinGW works fine.

I also get a file with $0x13c

2BB5AFA9-FF33-417B-8497-CB773C2B93BF_1_786.ROM.asm
2657: be 3c 01 00 00 mov $0x13c,%esi

But i did not found something like
"or $0x3,%eax"

My assembler skill is not good enough to understand what happend in the code.
Could you please have a look what is to change in this case.

BIOS.205
ASUSTeK Computer Inc. -Support- Drivers and Download X93SV

 

Can this custom BIOS be flashed with EzFlash? I don't trust winflash solution...

 

Hmm the section id is, again, exactly the same as mine (except for the last number). As far as I can tell it implements approximately the same functionality. The implementation is, however, quite different. I don't have the skills to figure out what it does exactly but it seems to write *SOMETHING* to MSR 0x13c:

Code:

    2657:       be 3c 01 00 00          mov    $0x13c,%esi ; sets ESI to 0x13c
    265c:       56                      push   %esi
    265d:       e8 ae 06 00 00          call   0x2d10 ; reads values from MSR 0x13c and puts them in EAX and EDX
    2662:       59                      pop    %ecx
    2663:       a8 01                   test   $0x1,%al
    2665:       75 0f                   jne    0x2676 ; skip writing if MSR is locked
    2667:       6a ff                   push   $0xffffffff
    2669:       6a ff                   push   $0xffffffff
    266b:       53                      push   %ebx
    266c:       57                      push   %edi
    266d:       56                      push   %esi
    266e:       e8 48 0a 00 00          call   0x30bb ; reads MSR, ANDs values with first two arguments and ORs them with the second two. then writes them back to the MSR
    2673:       83 c4 14                add    $0x14,%esp

I'm not an expert so I couldn't find out exactly which values are used to OR the values with, but you can simply patch out the entire write call altogether by going to offset 0x266e and replacing e8 48 0a 00 00 with 90 90 90 90 90.
I'd find it extremely unlikely that your cpu REQUIRES you to write something to MSR 0x13c in order to boot, especially since its values are read beforehand. Therefore you should be fine if you do this.

Tell me if it works out for you.

I never used EzFlash but if it allows you to flash stock BIOSes there is no reason it would not flash a custom one. WinFlash is provided on the ASUS website so I used that to be sure the flashing software knows how to handle my EEPROM.

 

Jozy, I think you should check the value of MSR 0x13c using one of the utilities I posted earlier before you try to modify the BIOS.

Which CPU are you using?

 

EasyFlash is the flash utitility within BIOS

 

The 2630QM on my Toshiba P750 has AES enabled.

 

Tinderbox (UK): It was by default enabled or you have successfully modified the BIOS using this guide?

 

It was enabled by default, no mod needed.

 

@Dufus:
The Asus X93SV has a 2630QM.
CPU-Z shows the same data as Tinderbox(UK) but without AES

I tried CrystalCPUID: 0x0000013C: 0x00000000 0x00000000

RWEverything: If I add 0x13C, I got a bluescreen.

@carlicious:
Thanks for your analyse.
But at the moment it's too risky for me
to change the code without enough understanding.
I become scared to brick my notebook.

I try to introduce myself in assembler to understand the code,
then maybe I gave the modify a try.

 

Now that's interesting. It looks to me as your BIOS is AES-NI ready but your 2630QM doesn't support MSR 0x13c hence the BSOD in RWEverything and therefore your cpu doesn't support AES-NI. CPUID is returning 0 which is wrong really. Probably what it defaults to if there is no MSR.

If the BIOS enables AES-NI MSR 0x13c should be 1, if it disables AES-NI it should be 3. If you would like to double check I can link one of my own MSR readers.

 

@Dufus
If you post the link, I will test.

 

I don't see your bios doing anything to explicitly disable AES-NI so perhaps it can be hardware locked.
If you happen to have a linux live cd laying around (preferably ubuntu or any other debian-based distro) you can try this in a console:

Code:

sudo su
apt-get install msr-tools
modprobe msr
rdmsr 0x13c

This outputs 1 on my machine (and so I'm sure this method of reading the MSR works). If it returns 0 this could also mean the MSR is not locked. If so, you should be able to write a value to it:

Code:

wrmsr 0x13c 1

Mine says:

Code:

wrmsr: CPU 0 cannot set MSR 0x0000013c to 0x0000000000000001

Which is to be expected.

Please tell me your experiences.

 

Ubuntu11 says:
rdmsr 0x13c
rdmsr: CPU 0 cannot read MSR 0x0000013c

wrmsr 0x13c 1
wrmsr: CPU 0 cannot set MSR 0x0000013c to 0x0000000000000001

The Package work:
rdmsr 0x10
1c8d3bf9f94

 

I think that is to be expected Jozy, your 2630QM doesn't have a MSR 0x13c so you can not read what you haven't got. At least we now know of one way to test for 2630QM that have a chance of AES-NI or not. Sorry for the bad news. You could take it up with Intel and ask nicely why your processor doesn't support AES-NI when others do. Maybe if they are in a good mood they might let you RMA the cpu.

I'm curious as to what does the Intel Processor ID Utility shows for your CPU revision. Utility download link can be found a few posts before. If you have time would you mind posting a screenshot. Thanks.

 

Intel(R) Processor Identification Utility
Version: 4.32.20110608
Time Stamp: 2011/10/30 11:44:45
Operating System: 6.1-7601-Service Pack 1
Number of processors in system: 1
Current processor: #1
Active cores per processor: 4
Disabled cores per processor: 0
Processor Name: Intel(R) Core(TM) i7-2630QM CPU @ 2.00GHz
Type: 0
Family: 6
Model: 2A
Stepping: 7
Revision: 15
Maximum CPUID Level: D
L1 Instruction Cache: 4 x 32 KB
L1 Data Cache: 4 x 32 KB
L2 Cache: 4 x 256 KB
L3 Cache: 6 MB
Packaging: LGA1155
Enhanced Intel SpeedStep(R) Technology: Yes
MMX(TM): Yes
Intel(R) SSE: Yes
Intel(R) SSE2: Yes
Intel(R) SSE3: Yes
Intel(R) SSE4: Yes
Intel(R) AES-NI: No
Intel(R) AVX: Yes
Enhanced Halt State: Yes
Execute Disable Bit: Yes
Intel(R) Hyper-Threading Technology: Yes
Intel(R) 64 Architecture: Yes
Intel(R) Virtualization Technology: Yes
Chipset ID: 1C49
System Graphics: Intel(R) HD Graphics 3000
Expected Processor Frequency: 2.0 GHz
Reported Processor Frequency: 2.59 GHz
Expected System Bus Frequency: 100 MHz
Reported System Bus Frequency: 100 MHz
*************************************************************

 

@JoZy
I ran the intel cpu identification software and the only two differences between my output and yours are (apart from AES-NI support):

Revision: 15 (mine says 1A)
Chipset ID: 1C49 (mine doesn't anything about the chipset)

The rest is identical. Even the stepping.

update:
I found this: http://www.msi.com/service/faq/2204.html
The revision listed above is the microcode revision. You need to update the CPU microcode. That will enable AES-NI.

 

Yes, the revision is the ucode update revision, excellent find with the MSI link carlicious.

 

That's the reason why.

How is it possible to update the CPU mircrocode?
I read that a BIOS update could do that.
So I could wait for a new BIOS from ASUS, that hopefully include a newer revision.

Can there be another possibility?

 

Indeed, for the N53SN Asus released a bios that did update the HD3000 firmware within the CPU

 

If ASUS updates your BIOS, it will definitely contain a microcode update for your cpu. For now you can try searching for a model that had a recent BIOS update and check if it contains a section F3331DE6-4A55-44E4-B767-7453F7A1A021 (MicrocodeUpdate) with the same size as yours. If so you should be able to swap them.

Note that you can also patch the microcode from within the OS but it will disappear on reboot.
Windows will also automatically apply microcode updates on every startup. Have you updated recently? Be sure to also install the optional updates as they most likely contain updates like these.
If you're on linux you can install microcode.ctl and intel-microcode packages and the microcode is automatically updated on startup as well.

If you plan on using the truecrypt bootloader for full system encryption this is useless since the encryption kicks in before the microcode update does.

 

carlicious, that is not what needs changing, it is the microcode update itself not the Microcodeupdate efi. Looks like it's in GUID 17088572-377f-44ef-8f4e-b09fff46a070. Note that it contains updates for two different families.

Microcode updates can be downloaded from Intel. Last time I looked, which was a few months ago, they were at 1B for that cpu.

 

I use win7 home premium sp1. All updates are installed.
I will wait for a new BIOS version from ASUS.

 

You are right about that.

I checked out section 17088572-377f-44ef-8f4e-b09fff46a070 in my BIOS and it indeed looks like a couple of microcode images put beneath each other. The first one reported version 1A. It was the only one with that version. Out of curiosity I downloaded version 1B (the latest) from the Intel website, converted it to binary and used it to replace the image in the section and flashed it (I know, livin' on the edge..).
Now the Intel CPU identification software shows revision 1B so it worked exactly as I expected.

I went through the effort of patching your BIOS as well and uploaded it: K93SV_REV1B.BIN
Since I tested this method and can confirm it works there is almost no risk in flashing this.

 

Way to go carlicious, that's a very generous thing to do.

 

Have anybody tested the modded BIOS for N53SN? What were the results?

 

@carlicious
First of all thank you very much for all your efforts.

I downloaded your K93SV_REV1B.BIN
Then I used WinFlash from the ASUS website with the /nodate option.
My heart was in my mouth as my X93SV don't want to boot.
But it was still the boot order I had to change.

Then the first check with Intel Processor ID Utility.
It says revision 1B. That is really not bad!

Then I checked with CrystalCPUID the MSR 0x13C. It says 0000013C : 00000000 00000001
Also CPU-Z said: I have AES enabled.

A last test with TrueCrypt Benchmark put a smile on my face.
2.5 GB/s

carlicious, YOU ARE A HERO!!!
Also many thanks to Dufus for the good advice.

summarizing for a X93SV (K93SV) with BIOS.205:
- the code for the MSC 0x13c does already the right value.
- revision 15 is too old for aes
- with the new revision 1b aes works as is should.

And I think there a lot of enhancements between revision 15 and 1b.

 

I'm very glad it all worked out well for you For me it was a very welcome distraction from having to study for exams so we both benefited from this
The only thing that puts me to think is the MSR value reporting 1, as I expected it to be 0. But it works so I could care less.

Many thanks to Dufus. If it wasn't for him I would have never found out about the microcode issue. Also many props for pointing me to the right section containing the microcode images.

We haven't seen anyone brave enough to flash it and confirm it actually works but don't worry, it contains the exact same section as mine and the same patch works as expected on the N53SV so the risk is very very low, relatively speaking. I just checked and this BIOS holds microcode version 1A so it will definitely enable AES-NI for you.

I will summarize the our findings for everyone who didn't read the entire topic.
Summary:
If your cpu is listed on the Intel cpus supporting AES-NI page your cpu DOES support AES-NI, no matter what your notebook manufacturer says.
If AES-NI is unavailable this can have two causes:

• The cpu's microcode is too old and needs an update
• Your notebook manufacturer disabled it

It is fairly easy to check which of the two causes AES-NI to be unavailable: fire up CrystalCPUID and read MSR 0x13c. If it reports 3 then your manufacturer disabled it. If it reports 0 or gives you a read error then the microcode is outdated. The Core i7-2630QM supports AES-NI since microcode revision 1A (or 26, depending on the representation). If you have a different cpu then this probably still applies. You can check your microcode revision using the Intel cpu identification utility.

What to do if the microcode is outdated:
Microcodes cannot be permanently updated. If you update it will return to its old state on reboot. You can, however, update the microcode at runtime. This is what most BIOSes do at startup so it's still semi-permanently updated. The easiest way to update the microcode is to update your BIOS. However, if you're already using the latest version, you can swap the microcode image contained in your BIOS with a newer one. The safer alternative is to update the microcode from within the OS on every startup (but you will not be able to use the truecrypt bootloader with AES-NI). Windows does this automatically for you. However, at the time of writing, we haven't seen any updates for the Core i7-2630QM microcode that enable AES-NI in windows update yet so that makes patching your BIOS the only option.
If you are on linux then you're lucky, if you install the microcode.ctl and intel-microcode packages the microcode is updated on every startup.

How to swap the microcode image with another one:

1. Download the latest microcode data file here
2. Download the latest phoenixtool here
3. Download the latest BIOS image from your manufacturer
4. Load the bios image with phoenixtool, select your manufacturer and click the 'Advanced' button.
5. Tick the following boxes:
   • Ask prior to each modification
   • Allow user modification of modules
   • Always allow user modification of modules
   • Allow user to modify other modules
   • Extract modules when verifying
   • No SLIC
   • Process all compressed modules (EFI)
6. Click done and click Go.
7. After a while it will prompt "You can now make manual alterations to any module in the DUMP directory", DON'T click OK yet!
8. One of the sections in the DUMP directory should contain the microcode images, on my ASUS N53SV it is 17088572-377f-44ef-8f4e-b09fff46a070. If it exists, open it up with a hex editor.
9. Verify that byte offset 4-7 indeed equal to your current microcode version in little endian byte order.
10. If not, skip to the next microcode image. The image length is given in byte 0x20-0x23 in little endian order.
11. The model id of your cpu is reported in offset 0xb-0xf, you can use that to find the correct image in microcode.dat (for the i7-2630QM this is 0x000206a7), again in little endian.
12. When you found the image that corresponds to your model you copy-paste it to a new file and convert it to binary. I assume you know how to do this. Remember to pay attention to the endianess.
13. Now you use a hex editor to replace the microcode image in the BIOS section with the one you just created. If the two versions differ in size it is perfectly fine to delete the old one and insert the new one (so the images that come after it will shift). However, I recommend removing (or adding) the difference in size in the padding at the end of the section so the section size remains the same (I don't know if this is required but I'm not taking any chances here).
14. Go back to phoenixtool and click OK.
15. Flash the newly created BIOS image. For ASUS BIOSes you'll need to launch WinFlash with /nodate as a command line argument (as administrator) otherwise it will refuse to flash a bios with the same version.
16. Reboot and enjoy!

Disclaimer: You are about to modify your BIOS, which is a crucial part of your system. If you don't follow this guide EXACTLY or if you are UNSURE if you followed the steps correctly, I CANNOT guarantee your system won't become permanently disfunctional and I recommend you do NOT proceed with the mod.

How to re-enable AES-NI if your manufacturer disabled it:
Refer to my tutorial on page 15 of this topic.

 

Hi,

I just want to add a little bit. For the no. 9 to 11, better show how they look like, like this (show the first 16 bytes of Microcode header):-

The important fields are:-
- the second 4 bytes is Microcode Update Revision
- the fourth 4 bytes is CPUID

I recommend using AIDA64 or HWiNFO32 to get the CPUID & the microcode revision number. When you know the CPUID, just need to search it in the Microcode module. Then just need to replace the existing Microcode for that CPUID with new one. The size of the new microcode should be identical with the old one.

 

No this wasn't the case with JoZy's BIOS. Revision 15 is 0x2000 bytes in size and rev 1B is 0x2400 bytes.

 

I stand corrected. The new microcode size usually not change but in this case it does (AES-NI data is added in the update data field).

 

IIRC EBX is set to 0 and EDI to 1 so when the sub is called the 2 AND's do nothing as they are set to 0xFFFFFFFF, the EBX 'OR' does nothing because it is set to 0 but EDI 'OR" sets bit 0 of EAX to be written to the MSR.

Very nice work carlicious, hope your exams go well.

 

Since there seems to be a great demand for an AES cabable G73SW BIOS and modding it is still a bit involved, I decided to patch the image for this model as well.

You can get it here: G73SwAS_AES.205

The mod required both a microcode update and an MSR patch. This must be the reason the MSR-patched version from Dufus didn't work for everyone. Microcode version for CPUID 0x0002067a (i7-2630QM, maybe others) in this version is at 1B so it should work for all of you.

Right again. Guess I was too obsessed with finding where bit 1 of EDI is set. But we now know it isn't.

 

That is bloody awesome! I was in the process of making it myself, but I'll go ahead and use this one, will post back here after flashing.

On a semi-related note: All these modded BIOS should really be uploaded together with CRC/MD5/SHA1 or something to ensure that you do not download and try to flash a corrupt file (for ex. corrupted in transfer or in writing, or just later on) - but maybe this is checked by EzFlash and WinFlash already?

edit: And I'm back. That worked splendidly: TrueCrypt reporting a 1.8GB/s en/de-crypting time for AES, CPU-Z reports AES now.

related note: WinFlash does not like the filename G73SwAS_AES.205, it seems to fail trying to find it. It would appear WinFlash only likes files in the 8.3 format, so I renamed it to G73SwAES.205 to get it to work.

Thank you so very much carlicious!

I am now heading over to Intel forums to update my thread and show a solution has been found.

 

All the carlicious-made BIOSes should be made sticky in first post and uploaded with MD5 . Carlicious link also your paypal, we owe You many beers

 

The TCP file transfer will take care of that. Also the BIOS image itself contains checksums that are being checked by the flashing utility (and also verified after writing) so I don't think it's necessary to post them together with a hash, unless you suspect sendspace of putting a backdoor in the BIOS image but that sounds really overly paranoid, even to me

Great to hear it worked for you as well

Haha that's cool. If you want to send me a beer, please do

 

I just bought a N53SV with brand new Core i7-2670QM and the AES-NI is not recognized. I pushed a request for firmware upgrade to ASUS. Hope they fix this soon.

 

Beer on its way, well deserved (happy N53SN user here 2.1gbps average )
EDIT: Carlicious, your link does not work

Don't worry, they won't

 

Thanks for letting me know, the link is fixed now

Indeed, they won't. The most plausible explanation we've heard so far is the US export regulations.

 

Beer sent (329918...), keep up the good work please (in case new bioses come for N53SN)

 

Did you try the modded BIOS?