ZFS, SSD and encryption

[Nikos Kastanas]

I have a Lenovo X220 laptop running FreeBSD 10.3-RELEASE with ZFS and
encryption on a plain HDD. I am considering buying a Samsung Pro 850 SSD to
boost performance but I am not sure if TRIM and ZFS+Encryption work well
together. After some research online, I found *this page*
<https://www.freebsd.org/doc/faq/all-about-zfs.html>which states the
following:

*Note: *
ZFS TRIM may not work with all configurations, such as a ZFS filesystem on
a GELI-backed device.

From what I can understand from the above note, I should not use the
encryption option when installing FreeBSD with ZFS on an SSD. TRIM will not
work correctly and therefore the SSD performace will be impacted.

Do I understand it correctly? Or is there something that I miss?

After asking in the community forums
<https://forums.freebsd.org/threads/57011/> a member suggested that i
should instead ask here.

Sorry if this is a stupid question, but I really want to be sure, since
SSDs are expensive and I don't want to make a mistake that will affect its
performance.

Thank you in advance.
_______________________________________________
freeb...@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-fs
To unsubscribe, send any mail to "freebsd-fs-...@freebsd.org"

[Nikos Kastanas]

>On 7/22/2016 07:48, Nikos Kastanas wrote:

>> I have a Lenovo X220 laptop running FreeBSD 10.3-RELEASE with ZFS and

> >encryption on a plain HDD. I am considering buying a Samsung Pro 850 SSD
to

> >boost performance but I am not sure if TRIM and ZFS+Encryption work well

>> together. After some research online, I found *this page*

> ><https://www.freebsd.org/doc/faq/all-about-zfs.html>which states the

> >following:

>>

> >*Note: *

> >ZFS TRIM may not work with all configurations, such as a ZFS filesystem
on

> >a GELI-backed device.

>>

> >From what I can understand from the above note, I should not use the

> >encryption option when installing FreeBSD with ZFS on an SSD. TRIM will
not

> >work correctly and therefore the SSD performace will be impacted.

>Meh. Simply not true. The reason for the "supported feature" flag here

>is that this machine was recently rolled forward to 11.0-BETA1, but I

>have not upgraded the pools yet from the feature set of 10.2.

>

>[karl@NewFS ~]$ zpool status zsr

> pool: zsr

>state: ONLINE

>status: Some supported features are not enabled on the pool. The pool can

> still be used, but some features are unavailable.

>action: Enable all features using 'zpool upgrade'. Once this is done,

> the pool may no longer be accessible by software that does not

>support

> the features. See zpool-features(7) for details.

> scan: scrub repaired 0 in 0h6m with 0 errors on Sun Jul 17 03:12:01 2016

>config:

>

> NAME STATE READ WRITE CKSUM

> zsr ONLINE 0 0 0

> mirror-0 ONLINE 0 0 0

> da8p4.eli ONLINE 0 0 0

> da9p4.eli ONLINE 0 0 0

>

>errors: No known data errors

>

>[karl@NewFS ~]$ gpart show da8

>=> 34 468862061 da8 GPT (224G)

> 34 2014 - free - (1.0M)

> 2048 1024 1 freebsd-boot (512K)

> 3072 1024 - free - (512K)

> 4096 20971520 2 freebsd-zfs [bootme] (10G)

> 20975616 134217728 3 freebsd-swap (64G)

> 155193344 313667584 4 freebsd-zfs (150G)

> 468860928 1167 - free - (584K)

>

>da8: <ATA INTEL SSDSC2BP24 0420> Fixed Direct Access SPC-4 SCSI device

>da8: Serial Number BTJR41210025240AGN

>da8: 600.000MB/s transfers

>da8: Command Queueing enabled

>da8: 228936MB (468862128 512 byte sectors)

>

>

>

>root@NewFS:/var/log # sysctl -a|grep trim

>vfs.zfs.trim.max_interval: 1

>vfs.zfs.trim.timeout: 30

>vfs.zfs.trim.txg_delay: 32

>vfs.zfs.trim.enabled: 1

>vfs.zfs.vdev.trim_max_pending: 10000

>vfs.zfs.vdev.trim_max_active: 64

>vfs.zfs.vdev.trim_min_active: 1

>vfs.zfs.vdev.trim_on_init: 1

>kstat.zfs.misc.zio_trim.failed: 0

>kstat.zfs.misc.zio_trim.unsupported: 25748

>kstat.zfs.misc.zio_trim.success: 6120223

>kstat.zfs.misc.zio_trim.bytes: 295371051008

>

>

>And as you can see, TRIM is definitely working (on the devices that can

>handle it); there are also spinning rust disks in this machine, thus the

>"unsupported" reports as well.

>

>HOWEVER, I do suggest (strongly!) that you NOT use the particular SSD

>you are intending to buy as it has no power-loss protection. Instead,

>buy an Intel 730-series drive (that's what's in this machine); it has

>that protection and it is *EXTREMELY IMPORTANT* as otherwise any power

>event has the potential of silent corruption which is catastrophic --

>especially on an encrypted volume!

>

>That same machine has two other 730s running a Postgresql database (also

>Geli-encrypted) and they're just fine in terms of their wear leveling

>and such; the media "wearout" indicator shows that 95% of the device's

>life remains and they currently have 10,000 power-on-hours.

>

>They'll wear out in something like another 20 years at present use

>rates.... :)

>

>The 480MB version of that drive is currently available for roughly

>$250. It is not the fastest SSD out there but the differences between

>it and others are small and I have *verified* that the power-loss data

>protection works on these units. IMHO they're the only "consumer" style

>priced devices that I find acceptable for this reason; the S3500/S3700s

>are good too, but a hell of a lot more money and unless you need the

>write endurance IMHO not worth it.

>

>The 730 series hits the sweet spot in that it has power-loss protection

>that *works* and yet they're reasonably priced. I own a bunch of them;

>they're in my production servers under FreeBSD and also on my Win10

>desktop machine.

>

>--

>Karl Denninger

>ka...@denninger.net <mailto:ka...@denninger.net <ka...@denninger.net>>

>/The Market Ticker/

>/[S/MIME encrypted email preferred]/


Thank you for your answer. So I guess the warning in the FAQ is probably

outdated.

I will seriously consider your suggestion considering the Intel SSD.

Thank you for your help

[Eric A. Borisch]

On Friday, July 22, 2016, Karl Denninger <ka...@denninger.net> wrote:

>
> On 7/22/2016 07:48, Nikos Kastanas wrote:
> > I have a Lenovo X220 laptop running FreeBSD 10.3-RELEASE with ZFS and
> > encryption on a plain HDD. I am considering buying a Samsung Pro 850 SSD
> to
> > boost performance but I am not sure if TRIM and ZFS+Encryption work well
> > together. After some research online, I found *this page*
> > <https://www.freebsd.org/doc/faq/all-about-zfs.html>which states the
> > following:
> >
> > *Note: *
> > ZFS TRIM may not work with all configurations, such as a ZFS filesystem
> on
> > a GELI-backed device.
> >
> > From what I can understand from the above note, I should not use the
> > encryption option when installing FreeBSD with ZFS on an SSD. TRIM will
> not
> > work correctly and therefore the SSD performace will be impacted.
> Meh. Simply not true.
>

It will not work on 10.3, but will work (as Karl demonstrates) on
11.x. Here's the commit to head enabling it:

https://svnweb.freebsd.org/base?view=revision&revision=286444

And here's what is in 10.3 (BIO_DELETE case returns EOPNOTSUPP):

https://svnweb.freebsd.org/base/releng/10.3/sys/geom/eli/g_eli.c?revision=296373&view=markup#l319

- Eric

[Nikos Kastanas]

Thank you for your answer and the clarification.

[Eric A. Borisch]

On Fri, Jul 22, 2016 at 2:27 PM, Karl Denninger <ka...@denninger.net> wrote:

> On 7/22/2016 14:02, Eric A. Borisch wrote:
>> On Friday, July 22, 2016, Karl Denninger <ka...@denninger.net

> Note that the system in question (from which the stats were pulled) was
> on 10.2 for an extended period of time, with SSDs, and with
> Geli-encrypted disks. It was fine with no performance issues; whether
> there is a problem with earlier releases has much to do with the disks
> in question.
>
> In the case of the Intel 730s it works perfectly well even though TRIM
> is not passed through in that case.

Fair, but the original question was if "TRIM will not work correctly
and therefore the SSD performace will be impacted" -- and the answer
is that TRIM+GELI does not "work correctly" for 10.3, but it does for
11.x. This is only a performance (and not "is my data safe")
statement.

As you allude to, how much this impacts performance depends on the
drive, partitioning / provisioning, and workload.

- Eric