AES-NI shows Disabled

Hi dell3237,

Was the BIOS recently upgraded? There was an issue with an older BIOS version that was resolved in 2.2.9 where the AES-NI feature would not report correctly and would always show disabled, however this should have been fixed with the BIOS update. If you can verify that the feature is working with the following steps we can determine if it is just a cosmetic issue or if there is another reason why it is showing disabled.

A free web utility (Truecrypt) can be used to verify this functionality in the processor from within Windows-

www.truecrypt.org/downloads

Use the following steps to verify the Intel AES-NI setting on a system:

TrueCrypt Application >> Settings menu >> Performance

Hi Josh,

Thanks for your reply. The reason I started investigating this is that most of the blades are in a vSphere cluster and vMotion cannot occur on and off of this host because of CPU flag incompatibilities, specifically AES-NI instructions. All the other hosts can vMotion between each other fine and show 'Enabled' in the BIOS. I'd prefer not to have to install a different OS to test if AES-NI is enabled or not.

Hi Josh,

I have a CentOS 5 guest OS on the server. /proc/cpuinfo does not include 'aes' in the flags line.

What are the Guest OSes on the server? AES-NI will pass through to the guest, so if you are running Windows on the VMs you can use the previously mentioned method, or if you are running Linux VMs you can use the following command to see if it passing to the OS.

dmesg | grep –i aes

I noticed that CentOS 5 didn't show it for the other hosts either so I deployed a CentOS 6 guest OS. It shows AES for the other hosts but not the host that shows Disabled in the BIOS.

Hi Josh,

Nope EVC is not enabled on the cluster. We are using ESXi 5.1. I'll try resetting the BIOS and seeing if that fixes it.

Thanks for checking that. It does look like it is disabled for some reason and it is not a reporting issue. What version of VSphere are you running? Is EVC enabled on the cluster? Can you have downtime to try and reset one of the motherboards to default with the NVRAM reset jumper.

ftp.dell.com/.../poweredge-m610_Owner%27s%20Manual_en-us.pdf

page 336,338

I performed a BIOS reset and no change. Which I'm surprised at! I did have to enable virtualization in the BIOS again so it definitely reset.

What we are going to want to do is run a DSET on one of the servers so that we can look at the configuration. The easiest way to do this is to download out Linux LiveDVD and mount the image in the iDRAC virtual media and boot to that. Once booted run dellsysteminfo from console.

http://linux.dell.com/files/openmanage-contributions/omsa-71-live/OMSA71-CentOS6-x86_64-LiveDVD.iso

How to configure virtual media:

ftp://ftp.dell.com/Manuals/all-products/esuprt_electronics/esuprt_software/esuprt_remote_ent_sys_mgmt/integrated-dell-remote-access-cntrllr-6-for-monolithic-srvr-v1.0_User%27s%20Guide_en-us.pdf page 185

OK I have the report - what should I look for?

Can you email it to me, I am going to have it reviewed by our server escalations group.

edit:

xxxx@dell.com

Was there ever any update on this? I have a Dell R710 and I cannot change the AES setting? I am running BIOS version 6.4. I have revered to 2.9, 2.10, 6.1, and 6.3 without any change. I have tried resetting the both jumpers on the motherboard and doing ALT E, ALT F, and ALT B on in the BIOS to no avail. 

Same issue here.  R710, reports no AES-NI, no SSE4.1, no SSE4.2.

I had a bad motherboard. Got it replaced and all was well.