[Samba] samba 3 - smb2 cpu usage

[Danny]

Hi all,

At the moment we are running Debian squeeze with stock samba 3.5.6. and 
are testing some new samba installations from ubuntu 12.04, centos 6.4 
and debian wheezy. All running in a VM on a XenServer.
The samba servers are member of a 2008R2 domain, using smb1 protocol all 
are running fine and we get a constant 90MB/s (big file transfer) on our 
1GB network.
We would like to enable smb2 protocol for performance reasons, but when 
we do enable SMB2 (max protocol = SMB2) file transfer speed drops to 
50-60MB/s (one big file) instead of the 80-90MB/s we used to get before. 
We noticed when this happens the cpu is at its max instead of 60-70% 
when using smb1.
iostat doesn't show any serious load and our raid 10 setup isn't 
experience any difficulties.
Using the packages (3.6.13) from EnterpriseSamba we get simular results.

Is it known enabling smb2 requires a faster cpu and our cpu is simply 
not powerfull enough or is there another problem which we should look 
into? (Or should we just stick to smb1, because smb2 isn't worth the 
trouble?)

Some hardware specs:
IBM 3650 M3 - Xeon 2.13Ghz 4 cores (2 cores per VM)
4GB RAM (per VM)
Smartraid 5015 + bbu (4 sas disks / raid10)
1 GB network.

HP Z400 workstation + Windows 7

mount options:
/dev/mapper/vg-logical_volume on /data type ext4 
(rw,nodiratime,relatime,acl,data=ordered,barrier=0,grpquota,errors=remount-ro)

smb.conf:
[global]
	workgroup = OURDOMAIN
	realm = OURDOMAIN.EU
	server string = %h server
	security = ADS
	log file = /var/log/samba/log.%m
	max log size = 1000
	max protocol = SMB2
	client signing = required
	server signing = required
	load printers = No
	winbind separator = +
	winbind enum users = Yes
	winbind enum groups = Yes
	winbind use default domain = Yes
	idmap config OURDOMAIN:range = 20000 - 49999
	idmap config OURDOMAIN:backend = rid
	idmap config * : range = 2000-2999
	idmap config * : backend = tdb
	hide unreadable = Yes

[data1]
	path = /data/data1
	read only = No
	inherit permissions = Yes
	inherit acls = Yes


Thanks,
Danny