Performance woes as RPI CM4 lacks AES license

[tenox7]

I'm aware that there is absolutely nothing you can do about it but I just wanted everyone know about this problem.

Raspberry PI CM4 and therefore PiBox is lacking hardware AES offload in the ARM CPU making it EXTREMELY slow for any workload that uses encryption. For example SSL/TLS/HTTPS, Disk Encryption, even SSH/SCP, SMB is dog slow. We are talking 5 to 10 times slower than any ARM SBC that has AES support. For large block sizes it can be even 30x slower!

I tried to use PiBox LUKS and ZFS encrypted SSD to host HTTPS based site and the performance is just unacceptable.

Here are some benchmarks:

cryptsetup benchmark

Raspberry PI CM4 (BCM2711):
Algorithm |       Key |      Encryption |      Decryption
  aes-cbc        128b        76.1 MiB/s        79.8 MiB/s
  aes-cbc        256b        62.1 MiB/s        63.3 MiB/s
  aes-xts        256b        85.8 MiB/s        89.3 MiB/s
  aes-xts        512b        68.1 MiB/s        69.2 MiB/s
 
StationPC P2 (RK3568):
Algorithm |       Key |      Encryption |      Decryption
  aes-cbc        128b       458.0 MiB/s       504.3 MiB/s
  aes-cbc        256b       398.5 MiB/s       468.1 MiB/s
  aes-xts        256b       481.8 MiB/s       475.3 MiB/s
  aes-xts        512b       446.6 MiB/s       448.0 MiB/s

Odroid HC4 (S905X3):
Algorithm |       Key |      Encryption |      Decryption
  aes-cbc        128b       508.8 MiB/s       597.4 MiB/s
  aes-cbc        256b       464.4 MiB/s       553.3 MiB/s
  aes-xts        256b       565.5 MiB/s       565.4 MiB/s
  aes-xts        512b       530.0 MiB/s       529.7 MiB/s

openssl speed

Raspberry PI CM4 (BCM2711):
Doing aes-256-cbc for 3s on 16 size blocks: 5219219 aes-256-cbc's in 3.00s
Doing aes-256-cbc for 3s on 64 size blocks: 1378146 aes-256-cbc's in 3.00s
Doing aes-256-cbc for 3s on 256 size blocks: 351038 aes-256-cbc's in 3.00s
Doing aes-256-cbc for 3s on 1024 size blocks: 88302 aes-256-cbc's in 3.00s
Doing aes-256-cbc for 3s on 8192 size blocks: 11052 aes-256-cbc's in 3.00s
Doing aes-256-cbc for 3s on 16384 size blocks: 5527 aes-256-cbc's in 3.00s

StationPC P2 (RK3568):
Doing aes-256-cbc for 3s on 16 size blocks: 29294759 aes-256-cbc's in 3.00s
Doing aes-256-cbc for 3s on 64 size blocks: 19274093 aes-256-cbc's in 3.00s
Doing aes-256-cbc for 3s on 256 size blocks: 8054761 aes-256-cbc's in 3.00s
Doing aes-256-cbc for 3s on 1024 size blocks: 2424035 aes-256-cbc's in 3.00s
Doing aes-256-cbc for 3s on 8192 size blocks: 322121 aes-256-cbc's in 3.00s
Doing aes-256-cbc for 3s on 16384 size blocks: 161748 aes-256-cbc's in 3.00s

Odroid HC4 (S905X3):
Doing aes-256-cbc for 3s on 16 size blocks: 32061333 aes-256-cbc's in 3.00s
Doing aes-256-cbc for 3s on 64 size blocks: 21391789 aes-256-cbc's in 3.00s
Doing aes-256-cbc for 3s on 256 size blocks: 8929899 aes-256-cbc's in 3.00s
Doing aes-256-cbc for 3s on 1024 size blocks: 2693507 aes-256-cbc's in 3.00s
Doing aes-256-cbc for 3s on 8192 size blocks: 357950 aes-256-cbc's in 3.00s
Doing aes-256-cbc for 3s on 16384 size blocks: 179781 aes-256-cbc's in 3.00s

There is the licensing problem for reference: https://forums.raspberrypi.com/viewtopic.php?f=63&t=207888