How can SSD's perform well when encrypted, or without TRIM?

Question

As I understand SSD's, they internally manage the numbered "hard drive" sectors expected by an operating system into interior pages, which are grouped into blocks. The SSD firmware is responsible for consolidating the internal pages, so that empty blocks become available for re-use. This process is slow, so it happens in the background. When a drive is close to full, the drive can feel slow to the user, because the firmware has to work to make space available, and the OS has to wait for it.

The operating system has no knowledge of the interior organization of the drive. It tells an SSD that a file system sector is available via TRIM. The SSD can then internally designate the pages representing that sector as available for re-use.

This leaves me with the following questions:

• On a drive where TRIM is not enabled, as would often be the case with external drives or RAID setups, as well as older drives and operating systems, once a drive becomes close to full, how can it know when a bunch of stuff has been deleted, so it can make available a bunch of internal pages? And if it doesn't know, how can it perform optimally?

• Why don't operating systems regularly report all of a file system's available free sectors to SSD's via TRIM, so the SSD can always have as many free internal pages/blocks as possible? (As I understand it, an OS only reports free file system sectors at the moment they become available, which means SSD pages can remain internally unavailable if TRIM was not enabled from the start, or an internal drive is temporarily accessed externally.)

• If whole-disk encryption is enabled in an OS, how is performance not badly impacted? Wouldn't every internal page be in use from the SSD's point of view?

• Why don't SSD manufacturers provide tools to restore an SSD to its original factory state, with all pages deactivated, for both security and performance reasons? (The only way I'm aware of to do this is via an esoteric Linux utility that can issue the ATA_SECURE_ERASE command to the drive firmware, and not every drive firmware can be trusted to correctly or comprehensively implement it.)

Any insight would be appreciated.

Answer 1

Why don't operating systems regularly report all of a file system's available free sectors to SSD's via TRIM, so the SSD can always have as many free internal pages/blocks as possible? (As I understand it, an OS only reports free file system sectors at the moment they become available, which means SSD pages can remain internally unavailable if TRIM was not enabled from the start, or an internal drive is temporarily accessed externally.)

They do. This is done by Windows' automatic maintenance every week or so (via Disk Defragmenter, which recognizes SSDs from HDDs), and by weekly fstrim.timer on Linux.

If whole-disk encryption is enabled in an OS, how is performance not badly impacted? Wouldn't every internal page be in use from the SSD's point of view?

That depends on whether the encryption system passes through TRIM information or not. Often it's user-configurable, lets you choose between performance and total privacy.

(Letting the SSD know which pages are empty will reveal the same information to outsiders – personally I don't think it's a problem, but some people don't want anything to be leaked.)

Why don't SSD manufacturers provide tools to restore an SSD to its original factory state, with all pages deactivated, for both security and performance reasons? (The only way I'm aware of to do this is via an esoteric Linux utility that can issue the ATA_SECURE_ERASE command to the drive firmware, and not every drive firmware can be trusted to correctly or comprehensively implement it.)

SSD manufacturers already provide tools to do so – and those tools use ATA_SECURE_ERASE.

There's no difference. If you had vendor-specific tools sending vendor-specific commands, you'd still have to trust the drive's firmware to correctly and comprehensively implement them.

And it'd be worse on the host side because all you'd have is an esoteric Windows utility, which would be quickly forgotten and often stop working with the next Windows version. (I still have a few tools which can low-level format USB flashdrives, and they all require Windows XP.)

Meanwhile, ATA_SECURE_ERASE is fairly standard – there are Windows programs to invoke it, there are Linux programs, some of them graphical, some of them command-line, and they all work regardless of the drive's make or model.

Answer 2

I don't think it's possible (by standard commands) simply because pagination, as you stated, is made exclusively by the firmware (and how pagination is done is what make huge difference across SSD vendors). The link between free-clusters and free pages is also kept by the firmware so you can have 3 'logically contiguous' sectors spread across different lines (remember an SDD has to delete a whole line just to delete a single page). This is what i was taught, but at that time SSD were not mainstream and I think it was the first time they spoke about that.