My assumption (which seems to be incorrect) was that ecryptfs (FUSE filesystems in general) used the following stacking mechanism:
- User code issues
- Kernel attempts to satisfy request from existing (unencrypted) buffer
- Buffer doesn't exist, kernel asks ecryptfs to load block
- ecryptfs asks kernel to load physical (encrypted) block, kernel does this and stores it in buffer cache
- ecryptfs decrypts physical block
- kernel stores decrypted block in buffer cache
- subsequent reads are fulfilled from decrypted block in cache
However, comparing the "sys" times for identical operations on encrypted and non-encrypted filesystems, it appears that the only buffer in the cache is the encrypted one, and ecryptfs decrypts on every
read(). The diagram on the FUSE homepage doesn't mention buffer cache, but seems to indicate that operations take place at the syscall level, not the block level.
Could someone who is familiar with either the internals of ecryptfs (Dustin?) or FUSE in general answer this?