Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    dell optiplex 3040 issues with aes-ni ?

    Scheduled Pinned Locked Moved General pfSense Questions
    24 Posts 3 Posters 1.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • W
      wheelhouse20
      last edited by

      im having issues trying to get AES-NI to work with dell optiplex 3040 SFF ,does any one else use one of these ?

      Intel(R) Core(TM) i5-6500 CPU @ 3.20GHz
      4 CPUs: 1 package(s) x 4 core(s)
      AES-NI CPU Crypto: Yes (inactive)
      QAT Crypto: No

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        How are you trying?

        It looks like the CPU supports it and pfSense recognises that.

        You probably just need to select it in System > Advanced > Miscellaneous in the 'Cryptographic Hardware' setting.

        Steve

        1 Reply Last reply Reply Quote 0
        • W
          wheelhouse20
          last edited by

          no matter what i change it states as Yes (inactive). i dont see any thing in the bios reguarding AES-NI so would of thought it would of been active maybe an defective motherboard .

          1 Reply Last reply Reply Quote 0
          • CybermazeC
            Cybermaze
            last edited by

            I am also running pfSense on an Dell OptiPlex 3040 SFF. My Dashboard lists the following:

            CPU Type
            Intel(R) Core(TM) i3-6100 CPU @ 3.70GHz
            Current: 1000 MHz, Max: 3700 MHz
            4 CPUs: 1 package(s) x 2 core(s) x 2 hardware threads
            AES-NI CPU Crypto: Yes (active)
            QAT Crypto: No

            Hardware crypto
            AES-CBC,AES-CCM,AES-GCM,AES-ICM,AES-XTS

            Please note, I'm not actively using encryption over a VPN or similar, so I can only tell you, what the Dashboard reports.

            W 1 Reply Last reply Reply Quote 0
            • W
              wheelhouse20 @Cybermaze
              last edited by

              @cybermaze which bios is your motherboard using ?

              CybermazeC 1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by

                You can check to see if the module loaded with kldstat.

                If it's loaded and attached you should see in the system log something like:

                Feb 22 01:51:50 	kernel 		aesni0: <AES-CBC,AES-CCM,AES-GCM,AES-ICM,AES-XTS,SHA1,SHA256> on motherboard

                If not you might see an error in the boot log where it failed to attach.

                Just disabling it in the BIOS will produce exactly what you're seeing though.

                Steve

                W 1 Reply Last reply Reply Quote 0
                • W
                  wheelhouse20 @stephenw10
                  last edited by

                  @stephenw10 said in dell optiplex 3040 issues with aes-ni ?:

                  Feb 22 01:51:50 kernel aesni0: <AES-CBC,AES-CCM,AES-GCM,AES-ICM,AES-XTS,SHA1,SHA256> on motherboard

                  where do i see this> Feb 22 01:51:50 kernel aesni0: <AES-CBC,AES-CCM,AES-GCM,AES-ICM,AES-XTS,SHA1,SHA256> on motherboard

                  1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    In the system log when the driver attaches to the device (though really it's not a device!).
                    That's usually during boot but it will appear there after enabling AES-NI at runtime if it wasn't at boot.

                    Steve

                    W 1 Reply Last reply Reply Quote 0
                    • W
                      wheelhouse20 @stephenw10
                      last edited by stephenw10

                      @stephenw10

                      The only place i see AES-NI is in the Features2 part.

                      cd0: Attempt to query device size failed: NOT READY, Medium not present - tray closed
cd0: 150.000MB/s transfers (SATA 1.x, UDMA6, ATAPI 12bytes, PIO 8192bytes)
cd0: Serial Number 
cd0: <PLDS DVD+-RW DU-8A5LH DD11> Removable CD-ROM SCSI device
cd0 at ahcich0 bus 0 scbus0 target 0 lun 0
ses0: ada0,pass1 in 'Slot 01', SATA Slot: scbus1 target 0
ses0: pass0,cd0 in 'Slot 00', SATA Slot: scbus0 target 0
ses0: SEMB SES Device
ses0: <AHCI SGPIO Enclosure 2.00 0001> SEMB S-E-S 2.00 device
ses0 at ahciem0 bus 0 scbus4 target 0 lun 0
ada0: 238475MB (488397168 512 byte sectors)
ada0: Command Queueing enabled
ada0: 300.000MB/s transfers (SATA 2.x, UDMA6, PIO 8192bytes)
ada0: Serial Number WD-WX11A51Z0729
ada0: <WDC WD2500BEVT-08A23T1 02.01A02> ATA8-ACS SATA 2.x device
ada0 at ahcich1 bus 0 scbus1 target 0 lun 0
Root mount waiting for: CAM
Root mount waiting for: CAM
Root mount waiting for: CAM
Root mount waiting for: CAM
Root mount waiting for: CAM
Root mount waiting for: CAM
Root mount waiting for: CAM
Root mount waiting for: CAM
uhub0: 20 ports with 20 removable, self powered
Root mount waiting for: usbus0 CAM
uhub0: <0x8086 XHCI root HUB, class 9/0, rev 3.00/1.00, addr 1> on usbus0
ugen0.1: <0x8086 XHCI root HUB> at usbus0
Root mount waiting for: usbus0 CAM
Trying to mount root from zfs:pfSense/ROOT/default []...
Timecounters tick every 1.000 msec
ZFS storage pool version: features support (5000)
ZFS filesystem version: 5
est0: <Enhanced SpeedStep Frequency Control> on cpu0
orm0: <ISA Option ROM> at iomem 0xc0000-0xcffff pnpid ORM0000 on isa0
driver bug: Unable to set devclass (class: atkbdc devname: (unknown))
atkbd0: [GIANT-LOCKED]
kbd0 at atkbd0
atkbd0: <AT Keyboard> irq 1 on atkbdc0
atkbdc0: <Keyboard controller (i8042)> port 0x60,0x64 irq 1 on acpi0
acpi_tz1: <Thermal Zone> on acpi0
acpi_tz0: <Thermal Zone> on acpi0
acpi_button1: <Power Button> on acpi0
acpi_button0: <Sleep Button> on acpi0
pci0: <memory> at device 31.2 (no driver attached)
isa0: <ISA bus> on isab0
isab0: <PCI-ISA bridge> at device 31.0 on pci0
ahciem0: <AHCI enclosure management bridge> on ahci0
ahcich3: <AHCI channel> at channel 3 on ahci0
ahcich2: <AHCI channel> at channel 2 on ahci0
ahcich1: <AHCI channel> at channel 1 on ahci0
ahcich0: <AHCI channel> at channel 0 on ahci0
ahci0: AHCI v1.31 with 4 6Gbps ports, Port Multiplier not supported
ahci0: <Intel Sunrise Point AHCI SATA controller> port 0xf090-0xf097,0xf080-0xf083,0xf060-0xf07f mem 0xf7414000-0xf7415fff,0xf7418000-0xf74180ff,0xf7417000-0xf74177ff irq 18 at device 23.0 on pci0
pci0: <simple comms> at device 22.0 (no driver attached)
usbus0: 5.0Gbps Super Speed USB v3.0
usbus0 on xhci0
usbus0: waiting for BIOS to give up control
xhci0: 32 bytes context size, 64-bit DMA
xhci0: <Intel Sunrise Point USB 3.0 controller> mem 0xf7400000-0xf740ffff irq 16 at device 20.0 on pci0
vgapci0: Boot video device
vgapci0: <VGA-compatible display> port 0xf000-0xf03f mem 0xf6000000-0xf6ffffff,0xe0000000-0xefffffff irq 17 at device 2.0 on pci0
em3: netmap queues/slots: TX 1/1024, RX 1/1024
em3: Ethernet address: 00:26:55:d8:ff:f2
em3: Using an MSI interrupt
em3: Using 1024 TX descriptors and 1024 RX descriptors
em3: EEPROM V5.12-2
em3: <Intel(R) PRO/1000 PT 82571EB/82571GB (Quad Copper)> port 0xd000-0xd01f mem 0xf7100000-0xf711ffff,0xf7000000-0xf707ffff irq 16 at device 0.1 on pci4
em2: netmap queues/slots: TX 1/1024, RX 1/1024
em2: Ethernet address: 00:26:55:d8:ff:f3
em2: Using an MSI interrupt
em2: Using 1024 TX descriptors and 1024 RX descriptors
em2: EEPROM V5.12-2
em2: <Intel(R) PRO/1000 PT 82571EB/82571GB (Quad Copper)> port 0xd020-0xd03f mem 0xf7120000-0xf713ffff,0xf7080000-0xf70fffff irq 17 at device 0.0 on pci4
pci4: <PCI bus> on pcib4
pcib4: <PCI-PCI bridge> at device 4.0 on pci2
em1: netmap queues/slots: TX 1/1024, RX 1/1024
em1: Ethernet address: 00:26:55:d8:ff:f0
em1: Using an MSI interrupt
em1: Using 1024 TX descriptors and 1024 RX descriptors
em1: EEPROM V5.12-2
em1: <Intel(R) PRO/1000 PT 82571EB/82571GB (Quad Copper)> port 0xe000-0xe01f mem 0xf7300000-0xf731ffff,0xf7200000-0xf727ffff irq 18 at device 0.1 on pci3
em0: netmap queues/slots: TX 1/1024, RX 1/1024
em0: Ethernet address: 00:26:55:d8:ff:f1
em0: Using an MSI interrupt
em0: Using 1024 TX descriptors and 1024 RX descriptors
em0: EEPROM V5.12-2
em0: <Intel(R) PRO/1000 PT 82571EB/82571GB (Quad Copper)> port 0xe020-0xe03f mem 0xf7320000-0xf733ffff,0xf7280000-0xf72fffff irq 19 at device 0.0 on pci3
pci3: <PCI bus> on pcib3
pcib3: <PCI-PCI bridge> at device 2.0 on pci2
pci2: <ACPI PCI bus> on pcib2
pcib2: <ACPI PCI-PCI bridge> at device 0.0 on pci1
pci1: <ACPI PCI bus> on pcib1
pcib1: <ACPI PCI-PCI bridge> irq 16 at device 1.0 on pci0
pci0: <ACPI PCI bus> on pcib0
pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0
acpi_timer0: <24-bit timer at 3.579545MHz> port 0x1808-0x180b on acpi0
Timecounter "ACPI-fast" frequency 3579545 Hz quality 900
Event timer "i8254" frequency 1193182 Hz quality 100
Timecounter "i8254" frequency 1193182 Hz quality 0
attimer0: <AT timer> port 0x40-0x43,0x50-0x53 irq 0 on acpi0
Event timer "RTC" frequency 32768 Hz quality 0
atrtc0: registered as a time-of-day clock, resolution 1.000000s
atrtc0: Warning: Couldn't map I/O.
atrtc0: <AT realtime clock> port 0x70-0x77 irq 8 on acpi0
Event timer "HPET4" frequency 24000000 Hz quality 440
Event timer "HPET3" frequency 24000000 Hz quality 440
Event timer "HPET2" frequency 24000000 Hz quality 440
Event timer "HPET1" frequency 24000000 Hz quality 440
Event timer "HPET" frequency 24000000 Hz quality 550
Timecounter "HPET" frequency 24000000 Hz quality 950
hpet0: <High Precision Event Timer> iomem 0xfed00000-0xfed003ff on acpi0
cpu0: <ACPI CPU> on acpi0
unknown: memory range not supported
acpi0: Power Button (fixed)
acpi0: <DELL CBX3 > on motherboard
cryptosoft0: <software crypto> on motherboard
vtvga0: <VT VGA driver> on motherboard
nexus0
mlx5en: Mellanox Ethernet driver 3.6.0 (December 2020)
000.000056 [4344] netmap_init netmap: loaded module
WARNING: Device "spkr" is Giant locked and may be deleted before FreeBSD 14.0.
random: fast provider: "Intel Secure Key RNG"
random: registering fast source Intel Secure Key RNG
[ath_hal] loaded
kbd1 at kbdmux0
WARNING: Device "kbd" is Giant locked and may be deleted before FreeBSD 14.0.
module_register_init: MOD_LOAD (vesa, 0xffffffff8140a210, 0) error 19
WARNING: Device "pci" is Giant locked and may be deleted before FreeBSD 14.0.
WARNING: Device "g_ctl" is Giant locked and may be deleted before FreeBSD 14.0.
wlan: mac acl policy registered
module_register_init: MOD_LOAD (iwi_monitor_fw, 0xffffffff80760b50, 0) error 1
iwi_monitor: If you agree with the license, set legal.intel_iwi.license_ack=1 in /boot/loader.conf.
iwi_monitor: You need to read the LICENSE file in /usr/share/doc/legal/intel_iwi.LICENSE.
module_register_init: MOD_LOAD (iwi_ibss_fw, 0xffffffff80760aa0, 0) error 1
iwi_ibss: If you agree with the license, set legal.intel_iwi.license_ack=1 in /boot/loader.conf.
iwi_ibss: You need to read the LICENSE file in /usr/share/doc/legal/intel_iwi.LICENSE.
module_register_init: MOD_LOAD (iwi_bss_fw, 0xffffffff807609f0, 0) error 1
iwi_bss: If you agree with the license, set legal.intel_iwi.license_ack=1 in /boot/loader.conf.
iwi_bss: You need to read the LICENSE file in /usr/share/doc/legal/intel_iwi.LICENSE.
module_register_init: MOD_LOAD (ipw_monitor_fw, 0xffffffff80739160, 0) error 1
ipw_monitor: If you agree with the license, set legal.intel_ipw.license_ack=1 in /boot/loader.conf.
ipw_monitor: You need to read the LICENSE file in /usr/share/doc/legal/intel_ipw.LICENSE.
module_register_init: MOD_LOAD (ipw_ibss_fw, 0xffffffff807390b0, 0) error 1
ipw_ibss: If you agree with the license, set legal.intel_ipw.license_ack=1 in /boot/loader.conf.
ipw_ibss: You need to read the LICENSE file in /usr/share/doc/legal/intel_ipw.LICENSE.
module_register_init: MOD_LOAD (ipw_bss_fw, 0xffffffff80739000, 0) error 1
ipw_bss: If you agree with the license, set legal.intel_ipw.license_ack=1 in /boot/loader.conf.
ipw_bss: You need to read the LICENSE file in /usr/share/doc/legal/intel_ipw.LICENSE.
random: entropy device external interface
Timecounter "TSC-low" frequency 1596079057 Hz quality 1000
Launching APs: 1 3 2
ioapic0 <Version 2.0> irqs 0-119 on motherboard
random: unblocking device.
FreeBSD/SMP: 1 package(s) x 4 core(s)
FreeBSD/SMP: Multiprocessor System Detected: 4 CPUs
ACPI APIC Table: <DELL CBX3 >
Event timer "LAPIC" quality 600
avail memory = 8021995520 (7650 MB)
real memory = 8589934592 (8192 MB)
TSC: P-state invariant, performance statistics
VT-x: PAT,HLT,MTF,PAUSE,EPT,UG,VPID
IA32_ARCH_CAPS=0xc04<RSBA>
XSAVE Features=0xf<XSAVEOPT,XSAVEC,XINUSE,XSAVES>
Structured Extended Features3=0xbc002e00<MCUOPT,MD_CLEAR,TSXFA,IBPB,STIBP,L1DFL,ARCH_CAP,SSBD>
Structured Extended Features=0x29c6fbf<FSGSBASE,TSCADJ,SGX,BMI1,HLE,AVX2,SMEP,BMI2,ERMS,INVPCID,RTM,NFPUSG,MPX,RDSEED,ADX,SMAP,CLFLUSHOPT,PROCTRACE>
AMD Features2=0x121<LAHF,ABM,Prefetch>
AMD Features=0x2c100800<SYSCALL,NX,Page1GB,RDTSCP,LM>
Features2=0x7ffafbff<SSE3,PCLMULQDQ,DTES64,MON,DS_CPL,VMX,SMX,EST,TM2,SSSE3,SDBG,FMA,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,TSCDLT,AESNI,XSAVE,OSXSAVE,AVX,F16C,RDRAND>
Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
Origin="GenuineIntel" Id=0x506e3 Family=0x6 Model=0x5e Stepping=3
CPU: Intel(R) Core(TM) i5-6500 CPU @ 3.20GHz (3192.16-MHz K8-class CPU)
VT(vga): resolution 640x480
FreeBSD clang version 10.0.1 (git@github.com:llvm/llvm-project.git llvmorg-10.0.1-0-gef32c611aa2)
FreeBSD 12.3-STABLE RELENG_2_6_0-n226742-1285d6d205f pfSense amd64
FreeBSD is a registered trademark of The FreeBSD Foundation.
The Regents of the University of California. All rights reserved.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
Copyright (c) 1992-2021 The FreeBSD Project.
                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        Mmm, the most likely thing is it's disabled in the BIOS but you say there's no setting for it?

                        You see the module loaded i the kldstat output? There's nothing else required on the pfSense end.

                        Steve

                        W 1 Reply Last reply Reply Quote 0
                        • W
                          wheelhouse20 @stephenw10
                          last edited by

                          @stephenw10 sorry im still learning, where do i need to look for the kldstat output ?

                          stephenw10S 1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator @wheelhouse20
                            last edited by

                            You can run kldstat from the webgui in Diag > Command Prompt.

                            Or you can run it from the command line like:

                            [22.01-RELEASE][admin@5100.stevew.lan]/root: kldstat
Id Refs Address                Size Name
 1   36 0xffffffff80200000  3aefff8 kernel
 2    1 0xffffffff83cf1000     1d00 sg5100.ko
 3    1 0xffffffff83cf3000   39ae70 zfs.ko
 4    2 0xffffffff8408e000     9860 opensolaris.ko
 5    1 0xffffffff84098000     3980 wbwd.ko
 6    2 0xffffffff8409c000     5d98 superio.ko
 7    1 0xffffffff84321000     1000 cpuctl.ko
 8    1 0xffffffff84322000     8e10 aesni.ko
 9    1 0xffffffff8432b000      bf8 coretemp.ko
10    1 0xffffffff8432c000    275c8 ipfw.ko
11    1 0xffffffff84354000    11aa8 dummynet.ko

                            Steve

                            W 1 Reply Last reply Reply Quote 0
                            • W
                              wheelhouse20 @stephenw10
                              last edited by

                              @stephenw10 said in dell optiplex 3040 issues with aes-ni ?:

                              kldstat

                              this is what it gave me.

                              Id Refs Address Size Name
                              1 10 0xffffffff80200000 3aed878 kernel
                              2 1 0xffffffff83cee000 39adb0 zfs.ko
                              3 2 0xffffffff84089000 9860 opensolaris.ko

                              1 Reply Last reply Reply Quote 0
                              • stephenw10S
                                stephenw10 Netgate Administrator
                                last edited by

                                Hmm, so it's not loaded. What do you have set in Sys > Adv > Misc for crypto hardware?

                                Steve

                                W 1 Reply Last reply Reply Quote 0
                                • W
                                  wheelhouse20 @stephenw10
                                  last edited by

                                  @stephenw10 i have it set to AES-NI cpu based acceleration.

                                  1 Reply Last reply Reply Quote 0
                                  • stephenw10S
                                    stephenw10 Netgate Administrator
                                    last edited by

                                    Hmm, OK try this:

                                    cat /boot/loader.conf

                                    You should see see the loader line that cause aes-ni to be loaded at boot.

                                    You can also try manually loading it:

                                    kldload aesni.ko

                                    Steve

                                    W 1 Reply Last reply Reply Quote 0
                                    • W
                                      wheelhouse20 @stephenw10
                                      last edited by

                                      @stephenw10
                                      Shell Output - cat /boot/loader.conf
                                      autoboot_delay="3"
                                      net.link.ifqmaxlen="128"

                                      Shell Output - kldload aesni.ko
                                      kldload: can't load aesni.ko: No such file or directory

                                      maybe its some thing to do with dells bios or not supported.

                                      1 Reply Last reply Reply Quote 0
                                      • stephenw10S
                                        stephenw10 Netgate Administrator
                                        last edited by

                                        Hmm try the full path:

                                        kldload /boot/kernel/aesni.ko

                                        You are running 2.5.2 or 2.6 I assume?

                                        Steve

                                        W 2 Replies Last reply Reply Quote 0
                                        • W
                                          wheelhouse20 @stephenw10
                                          last edited by

                                          @stephenw10 Hello im running 2.6 i tried kldload /boot/kernel/aesni.ko and got this kldload: can't load /boot/kernel/aesni.ko: No such file or directory.
                                          should i do a reinstall to see if it fixes the issue ?

                                          thanks for you help

                                          Paul

                                          1 Reply Last reply Reply Quote 0
                                          • W
                                            wheelhouse20 @stephenw10
                                            last edited by

                                            @stephenw10 i did a reinstall of 2.5.2 on a samsung ssd after playing a round in the bios and it cam up as active in the end , i ve now updated to 2.6 and still is showing as active.

                                            Id Refs Address Size Name
                                            1 20 0xffffffff80200000 3aed878 kernel
                                            2 1 0xffffffff83cee000 3bd370 zfs.ko
                                            3 2 0xffffffff840ac000 a448 opensolaris.ko
                                            4 1 0xffffffff84321000 1000 cpuctl.ko
                                            5 1 0xffffffff84322000 2150 acpi_wmi.ko
                                            6 1 0xffffffff84325000 8e10 aesni.ko
                                            7 1 0xffffffff8432e000 bf8 coretemp.ko

                                            Thank you for your help

                                            Paul

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.