[apparmor] Fwd: Re: [Patch 0/4] change accept node handling during expr tree set

John Johansen john.johansen at canonical.com
Wed Jun 24 19:27:12 UTC 2015

On 06/23/2015 10:13 AM, Jamie Strandboge wrote:
> I accidentally responded to John privately but meant to respond to the list, so
> forwarding here.
> -------- Forwarded Message --------
> Subject: Re: [apparmor] [Patch 0/4] change accept node handling during expr tree set
> Date: Mon, 22 Jun 2015 14:39:44 -0500
> From: Jamie Strandboge <jamie at canonical.com>
> To: John Johansen <john.johansen at canonical.com>
> On 06/22/2015 12:59 PM, John Johansen wrote:
>> This series of patches changes the way accept nodes are generated
>> and the expression tree is set-up around them. It is a start to the
>> backend refactoring and cleanup, and provides a nice little performance
>> boost in most cases because
>>   1. It reduces the number of accept nodes geneted and considered during
>>      simplification/factoring, and node set building (shorter node sets
>>      to construct and compare)
>>   2. It reduces the number of Alt nodes (used to combine the accept nodes)
>>      to consider during simplfication, and node set building (agin shorter
>>      node sets to construct and compare)
>>   3. It reduces the number of nodes that must be consider in any given
>>      simplification pass, by separating out node sets that can't be
>>      simplified on the right hand simplification/factoring pass.
>> The performance change is dependent on the profile being parsed, and
>> there is no guarentee that it will be faster for all profiles. With that
>> being said, I haven't seen any performance regressions+ and some fairly
>> nice performance improvements so its worth considering before the rest
>> of the backend factoring is done.
>> Eg. Using a few example profile tests from a local machine, comparing
>> against the 2.9 parser in Ubuntu 14.10 against current 2.10 with
>> these patches*
>> profile       with tree simplification      -O no-expr-simplify
>> -------       -----------------------       -------------------
>> evince              22% faster                   10% faster
>> firefox             40% faster                   11% faster
>> chromium            32% faster                   11% faster
>> cupsd               35% faster                    3% faster
>> dnsmasq             12% faster                   17% faster
>> dhclient            36% faster                    5% faster
>> klogd                0%                           8% faster
>> *Note: 2.10 is actually handicapped by a couple fixes to change_profile
>>  encoding that causes its dfa to have a few extra nodes.
>> +There was some regression, in a few cases on individual runs but when
>>  averaged over a few runs, the timing variations resulted in small net
>>  wins, in those cases.
> I'm curious how this affects Ubuntu Touch and Core policy. Attached are three
> profiles-- can you try with these (and also add these three to wherever you are
> storing the test profiles)? Also, what architecture was this on? Did you test on
> arm?
And the analysis has now been posted to the original thread

More information about the AppArmor mailing list