Full disk encryption performance can be really improved in NVMe and SSD devices

Project Discussion
,
21

The bigger improvement is using 4k sector size. [1] [2]
However I think most consumer SSDs ship with 512B emulation by default, which means 4k will not be used despite the change. Here is what it says on a fresh F41 install:

$ sudo blockdev --getpbsz /dev/nvme0n1
512

$ sudo cryptsetup luksDump /dev/nvme0n1p3
Data segments:
  0: crypt
    ...
    sector: 512 [bytes]

$ sudo fdisk -l
(same for both LUKS device and the partition)
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes

Even though 4k native is available

$ sudo nvme id-ns -H /dev/nvme0n1
...
LBA Format  0 : Metadata Size: 0   bytes - Data Size: 512 bytes - Relative Performance: 0x2 Good (in use)
LBA Format  1 : Metadata Size: 0   bytes - Data Size: 4096 bytes - Relative Performance: 0x1 Better

To switch, a reformat is needed[3]:

$ sudo nvme format --lbaf=1 /dev/nvme0n1

  1. https://fedoraproject.org/wiki/Changes/LUKSEncryptionSectorSize ↩︎

  2. https://www.reddit.com/r/Fedora/comments/rzvhyg/default_luks_encryption_settings_on_fedora_can_be/ ↩︎

  3. https://wiki.archlinux.org/title/Advanced_Format#NVMe_solid_state_drives ↩︎

1 Like
22

This is really good to know!

1 Like
23

"The latest cryptsetup release added an option to let cryptsetup automatically detect the optimal sector size based on the (physical) sector size of the backing device.

By using this new option we can make sure that Anaconda uses the optimal sector size for newly created LUKS devices during installation. This means we will use sector size of 4096 for devices with 4k physical sector size increasing IO performance with these devices."

It looks like upstream cryptsetup should be patched to select the highest/appropriate block size when multiple blocksizes are available.

2 Likes