The question of timings came up in this thread before, below are the
results of some tests I ran on a Pentium Mobile machine 2Ghz
processor, 1Gig of ram (my fujitsu S7020 laptop to be precise)

I ran 3 sets of tests one kernel with no fingerprints loaded, one with
ordinary fingerprints loaded and finally one with per-page
fingerprints applied to all executables and libraries.  I ran four
tests per set up, the test was running "time firefox" and manually
quitting firefox, so don't read too much into the sub second
variances.

                        | run   | run   | run   | run
                        |  1    |  2    |  3    |  4
------------------------+-------+-------+-------+-------
no fingerprint   real   | 11.8s | 5.7s  | 5.7s  | 6.5s
                 user   | 3.2s  | 2.0s  | 2.1s  | 2.4s
                 sys    | 0.2s  | 0.1s  | 0.1s  | 0.1s
                        |       |       |       |
------------------------+-------+-------+-------+-------
fingerprints     real   | 9.4s  | 6.3s  | 6.0s  | 6.0s
                 user   | 2.4s  | 2.3s  | 1.9s  | 2.2s
                 sys    | 0.6s  | 0.1s  | 0.2s  | 0.1s
                        |       |       |       |
------------------------+-------+-------+-------+-------
per page         real   | 11.3s | 6.3s  | 6.2s  | 6.0s
                 user   | 2.7s  | 1.6s  | 1.7s  | 1.7s
                 sys    | 1.2s  | 1.0s  | 1.0s  | 1.0s

I am a bit mystified by the timing for the no fingerprint case on the
initial run, so much so I repeated it with a kernel that did not have
verified exec configured in and measured pretty much the same result.
The only explanation I can come up with is perhaps the slow disk in my
laptop is slower to serve up the pages when demand paging whereas all
the pages get forced into memory the first time something is run by
the veriexec fingerprint operation - perhaps that sustained read makes
things faster.

-- 
Brett Lymn