Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm not quite sure if this is the right place to ask this, if not, feel free to migrate it to wherever it fits in.

I'm testing the encryption feature in ZFS v31 in a Solaris 11.11.11 VM under ESXi 5.0 on my lab box. I'm getting terrible results when benching my encrypted folder with dd on an 11-disk RAIDZ3.

dd benchmark:

# time dd if=/dev/zero of=/mypool/storage/dd.tst bs=1024000 count=10000
10000+0 records in
10000+0 records out

real    1m52.604s
user    0m0.010s
sys     0m2.715s
# time dd if=/mypool/storage/dd.tst of=/dev/null bs=1024000
10000+0 records in
10000+0 records out

real    3m15.547s
user    0m0.015s
sys     0m4.768s

Which translates to:

Write: 90.94 MB/s
Read: 52.366 MB/s

While using 100% CPU.

In contrast, with no encryption, I'm getting writes at almost 700 MB/s and reads at around 900 MB/s.

As isainfo -v shows, aes is passed through to the VM.

# isainfo -v
64-bit amd64 applications
        xsave pclmulqdq aes sse4.2 sse4.1 ssse3 popcnt tscp cx16 sse3 sse2 sse
        fxsr mmx cmov amd_sysc cx8 tsc fpu
32-bit i386 applications
        xsave pclmulqdq aes sse4.2 sse4.1 ssse3 popcnt tscp ahf cx16 sse3 sse2
        sse fxsr mmx cmov sep cx8 tsc fpu

Yes, I know what you're thinking. I should try it bare metal - and I actually have. I'm getting the same results running bare metal. The reason I'm even mentioning that it's in a VM is because AES-NI actually works and is giving me almost full speed using TrueCrypt in my Windows 7 64-bit VM under ESXi 5.0 using the exact same specs for the virtual machine.

VM specs:

  • CPU: 2 cores (of Intel Xeon E3-1235 @ 3.2GHz)
  • Memory: 8GB
  • SAS-controller (via Vt-d & PCI-passthrough): 2x IBM M1015 (flashed with IT firmware)
  • HDD: 11x 2TB Samsung F4EG (via IBM M1015)

Where should I start troubleshooting? Has anyone successfully used AES-NI accelerated encryption in Solaris 11 - if so, how is your setup, and did you have to do anything special?

share|improve this question
add comment

1 Answer

AES-NI will be used by default and there is no configuration required. ZFS uses the Solaris Kernel Cryptographic Framework interfaces. So a very simple bit of DTrace will tell you if the functions that use the Intel aesenc instructions are been called:

#!/usr/sbin/dtrace -Fs

fbt::aes_encrypt_intel:entry { }

fbt::aes_encrypt_intel:return { }

Note that when we enabled encryption is enabled for ZFS we also switch the checksum to sha256-mac automatically. So a fairer comparison would be against a ZFS dataset that has checksum=sha256 rather than checksum=on (which is fletcher4).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.