Dear List, I have encountered a performance issue with dm-crypt, for which the algorithms at Google could not point me to a solution. I am running dm-crypt on a RAID 5 md device. The RAID is capable of sustained read rates of around 150MB/s. Using dm-crypt I am able to get up to slightly more than 20MB/s read performance. Now, this would not surprise me all that much, but cryptoloop on another RAID (capable of 30-35 MB/s sustained read) is giving me 30MB/s. The interesting issue is that during a read from the mapped/crypted device top reports around 20-30% CPU usage by kcryptd, and a whopping 70-80% iowait cycles. Now, I don't quite understand what is summed up under iowait. If this extends to the memory subsystem, I may just be memory/cache starved (sempron 3200: 1800Mhz, 128kB L2 cache, DDR2 533). If it doesn't, then I am completely clueless, as clearly the underlying I/O-subsystem is readily capable of sustaining higher datarates. Even worse than reads are writes. I get an initial burst of about 80-100MB (each disk in the 4 disk array has only 16MB cache) at 25 MB/s, then throughput falls to 8MB/s. One possibility that I just came up with is that this performance drop may be due to mapper-requests being non-sequential, where raw device requests are perfectly sequential - but nobody else has mentioned similar issues, so this seems strange. On to the boring part: /dev/mapper//dev/mapper/0 is active: cipher: aes-cbc-plain keysize: 256 bits device: /dev/md0 offset: 0 sectors size: 2344252416 sectors mode: read/write cryptsetup is at version 1.0.6-r2 according to Portage. Linux Skeletor 2.6.25-hardened-r8 #1 Sat Nov 22 23:22:01 CET 2008 i686 AMD Sempron(tm) Processor 3200+ AuthenticAMD GNU/Linux There's a whole lot of PAX and GRSec going on, like adress space randomization, in case that is of interest. I'd be hugely thankful if anyone could check performance on low-cache machines and performance versus cryptoloop. I'm currently not willing to upgrade the kernel, waiting for version 2.6.29 to be declared stable by the Gentoo hardened team. Any tips would als be appreciated. Thanks all! Rick _______________________________________________ dm-crypt mailing list dm-crypt@xxxxxxxx http://www.saout.de/mailman/listinfo/dm-crypt
