memory resource management in vmware esx...
TRANSCRIPT
Memory Resource Management in VMware ESX Server
Carl A. Waldspurger
VMware, Inc.Palo Alto, CA 94304 USA
Abstract
VMware ESX Server is a thin software layer designed tomultiplex hardware resources efficiently among virtual ma-chines running unmodified commodity operating systems.This paper introduces several novel ESX Server mechanismsand policies for managing memory. A ballooning techniquereclaims the pages considered least valuable by the operat-ing system running in a virtual machine. An idle memory taxachieves efficient memory utilization while maintaining per-formance isolation guarantees. Content-based page sharingand hot I/O page remapping exploit transparent page remap-ping to eliminate redundancy and reduce copying overheads.These techniques are combined to efficiently support virtualmachine workloads that overcommit memory.
1 Introduction
Recent industry trends, such as server consolida-tion and the proliferation of inexpensive shared-memorymultiprocessors, have fueled a resurgence of interest inserver virtualization techniques. Virtual machines areparticularly attractive for server virtualization. Eachvirtual machine (VM) is given the illusion of being a ded-icated physical machine that is fully protected and iso-lated from other virtual machines. Virtual machines arealso convenient abstractions of server workloads, sincethey cleanly encapsulate the entire state of a running sys-tem, including both user-level applications and kernel-mode operating system services.
In many computing environments, individual serversare underutilized, allowing them to be consolidated asvirtual machines on a single physical server with little orno performance penalty. Similarly, many small serverscan be consolidated onto fewer larger machines to sim-plify management and reduce costs. Ideally, system ad-ministrators should be able to flexibly overcommitmem-ory, processor, and other resources in order to reap thebenefits of statistical multiplexing, while still providingresource guarantees to VMs of varying importance.
Virtual machines have been used for decades to al-low multiple copies of potentially different operatingsystems to run concurrently on a single hardware plat-form [8]. A virtual machine monitor (VMM) is a soft-ware layer that virtualizes hardware resources, export-ing a virtual hardware interface that reflects the under-lying machine architecture. For example, the influentialVM/370 virtual machine system [6] supported multipleconcurrent virtual machines, each of which believed itwas running natively on the IBM System/370 hardwarearchitecture [10]. More recent research, exemplifiedby Disco [3, 9], has focused on using virtual machinesto provide scalability and fault containment for com-modity operating systems running on large-scale shared-memory multiprocessors.
VMware ESX Server is a thin software layer designedto multiplex hardware resources efficiently among vir-tual machines. The current system virtualizes the IntelIA-32 architecture [13]. It is in production use on serversrunning multiple instances of unmodified operating sys-tems such as MicrosoftWindows 2000 Advanced Serverand Red Hat Linux 7.2. The design of ESX Server dif-fers significantly fromVMwareWorkstation, which usesa hosted virtual machine architecture [23] that takes ad-vantage of a pre-existing operating system for portableI/O device support. For example, a Linux-hosted VMMintercepts attempts by a VM to read sectors from its vir-tual disk, and issues a read() system call to the under-lying Linux host OS to retrieve the corresponding data.In contrast, ESX Server manages system hardware di-rectly, providing significantly higher I/O performanceand complete control over resource management.
The need to run existing operating systems withoutmodification presented a number of interesting chal-lenges. Unlike IBM’s mainframe division, we were un-able to influence the design of the guest operating sys-tems running within virtual machines. Even the Discoprototypes [3, 9], designed to run unmodified operat-ing systems, resorted to minor modifications in the IRIXkernel sources.
This paper introduces several novel mechanisms andpolicies that ESX Server 1.5 [29] uses to manage mem-ory. High-level resource management policies computea target memory allocation for each VM based on spec-ified parameters and system load. These allocations areachieved by invoking lower-level mechanisms to reclaimmemory from virtual machines. In addition, a back-ground activity exploits opportunities to share identicalpages between VMs, reducing overall memory pressureon the system.
In the following sections, we present the key aspectsof memory resource management using a bottom-upapproach, describing low-level mechanisms before dis-cussing the high-level algorithms and policies that co-ordinate them. Section 2 describes low-level memoryvirtualization. Section 3 discusses mechanisms for re-claiming memory to support dynamic resizing of virtualmachines. A general technique for conserving memoryby sharing identical pages between VMs is presentedin Section 4. Section 5 discusses the integration ofworking-set estimates into a proportional-share alloca-tion algorithm. Section 6 describes the high-level al-location policy that coordinates these techniques. Sec-tion 7 presents a remapping optimization that reducesI/O copying overheads in large-memory systems. Sec-tion 8 examines related work. Finally, we summarize ourconclusions and highlight opportunities for future workin Section 9.
2 Memory Virtualization
A guest operating system that executes within a vir-tual machine expects a zero-based physical addressspace, as provided by real hardware. ESX Server giveseach VM this illusion, virtualizing physical memory byadding an extra level of address translation. Borrowingterminology from Disco [3], a machine address refers toactual hardware memory, while a physical address is asoftware abstraction used to provide the illusion of hard-ware memory to a virtual machine. We will often use“physical” in quotes to highlight this deviation from itsusual meaning.
ESX Server maintains a pmap data structure for eachVM to translate “physical” page numbers (PPNs) tomachine page numbers (MPNs). VM instructions thatmanipulate guest OS page tables or TLB contents areintercepted, preventing updates to actual MMU state.Separate shadow page tables, which contain virtual-to-machine page mappings, are maintained for use by theprocessor and are kept consistent with the physical-to-
machine mappings in the pmap.1 This approach per-mits ordinary memory references to execute without ad-ditional overhead, since the hardware TLB will cachedirect virtual-to-machine address translations read fromthe shadow page table.
The extra level of indirection in the memory systemis extremely powerful. The server can remap a “phys-ical” page by changing its PPN-to-MPN mapping, in amanner that is completely transparent to the VM. Theserver may also monitor or interpose on guest memoryaccesses.
3 Reclamation Mechanisms
ESX Server supports overcommitment of memory tofacilitate a higher degree of server consolidation thanwould be possible with simple static partitioning. Over-commitment means that the total size configured for allrunning virtual machines exceeds the total amount of ac-tual machine memory. The system manages the alloca-tion of memory to VMs automatically based on config-uration parameters and system load.
Each virtual machine is given the illusion of havinga fixed amount of physical memory. This max size isa configuration parameter that represents the maximumamount of machine memory it can be allocated. Sincecommodity operating systems do not yet support dy-namic changes to physical memory sizes, this size re-mains constant after booting a guest OS. A VM will beallocated its maximum size when memory is not over-committed.
3.1 Page Replacement Issues
When memory is overcommitted, ESX Server mustemploy some mechanism to reclaim space from one ormore virtual machines. The standard approach used byearlier virtual machine systems is to introduce anotherlevel of paging [9, 20], moving some VM “physical”pages to a swap area on disk. Unfortunately, an extralevel of paging requires a meta-level page replacementpolicy: the virtual machine system must choose not onlythe VM from which to revoke memory, but also whichof its particular pages to reclaim.
In general, a meta-level page replacement policy mustmake relatively uninformed resource management deci-sions. The best information about which pages are least
1The IA-32 architecture has hardware mechanisms that walk in-memory page tables and reload the TLB [13].
valuable is known only by the guest operating systemwithin each VM. Although there is no shortage of cleverpage replacement algorithms [26], this is actually thecrux of the problem. A sophisticated meta-level policyis likely to introduce performance anomalies due to un-intended interactions with native memory managementpolicies in guest operating systems. This situation isexacerbated by diverse and often undocumented guestOS policies [1], which may vary across OS versions andmay even depend on performance hints from applica-tions [4].
The fact that paging is transparent to the guest OS canalso result in a double paging problem, even when themeta-level policy is able to select the same page that thenative guest OS policy would choose [9, 20]. Supposethe meta-level policy selects a page to reclaim and pagesit out. If the guest OS is under memory pressure, it maychoose the very same page to write to its own virtualpaging device. This will cause the page contents to befaulted in from the system paging device, only to be im-mediately written out to the virtual paging device.
3.2 Ballooning
Ideally, a VM from which memory has been re-claimed should perform as if it had been configured withless memory. ESX Server uses a ballooning techniqueto achieve such predictable performance by coaxing theguest OS into cooperating with it when possible. Thisprocess is depicted in Figure 1.
A small balloon module is loaded into the guest OSas a pseudo-device driver or kernel service. It has noexternal interface within the guest, and communicateswith ESX Server via a private channel. When the serverwants to reclaim memory, it instructs the driver to “in-flate” by allocating pinned physical pages within theVM, using appropriate native interfaces. Similarly, theserver may “deflate” the balloon by instructing it to deal-locate previously-allocated pages.
Inflating the balloon increases memory pressure in theguest OS, causing it to invoke its own native memorymanagement algorithms. When memory is plentiful, theguest OS will return memory from its free list. Whenmemory is scarce, it must reclaim space to satisfy thedriver allocation request. The guest OS decides whichparticular pages to reclaim and, if necessary, pages themout to its own virtual disk. The balloon driver com-municates the physical page number for each allocatedpage to ESX Server, which may then reclaim the corre-sponding machine page. Deflating the balloon frees up
Guest Memory
.balloon
......
......
......balloon
....
....balloon
Guest Memory
Guest Memory
inflate
deflate
maypage out
maypage in
Figure 1: Ballooning. ESX Server controls a balloon mod-ule running within the guest, directing it to allocate guest pagesand pin them in “physical” memory. The machine pages back-ing this memory can then be reclaimed by ESX Server. Inflat-ing the balloon increases memory pressure, forcing the guestOS to invoke its own memory management algorithms. Theguest OS may page out to its virtual disk when memory isscarce. Deflating the balloon decreases pressure, freeing guestmemory.
memory for general use within the guest OS.
Although a guest OS should not touch any physicalmemory it allocates to a driver, ESX Server does notdepend on this property for correctness. When a guestPPN is ballooned, the system annotates its pmap entryand deallocates the associated MPN. Any subsequent at-tempt to access the PPN will generate a fault that is han-dled by the server; this situation is rare, and most likelythe result of complete guest failure, such as a rebootor crash. The server effectively “pops” the balloon, sothat the next interaction with (any instance of) the guestdriver will first reset its state. The fault is then handledby allocating a new MPN to back the PPN, just as if thepage was touched for the first time.2
Our balloon drivers for the Linux, FreeBSD, andWin-dows operating systems poll the server once per sec-ond to obtain a target balloon size, and they limit theirallocation rates adaptively to avoid stressing the guestOS. Standard kernel interfaces are used to allocate phys-ical pages, such as get free page() in Linux, andMmAllocatePagesForMdl() or MmProbeAndLock-Pages() in Windows.
Future guest OS support for hot-pluggable memorycards would enable an additional form of coarse-grainedballooning. Virtual memory cards could be inserted into
2ESX Server zeroes the contents of newly-allocated machine pagesto avoid leaking information between VMs. Allocation also respectscache coloring by the guest OS; when possible, distinct PPN colors aremapped to distinct MPN colors.
128 160 192 224 256VM Size (MB)
0
5
10
15
20
Thro
ughp
ut (M
B/s
ec)
Figure 2: Balloon Performance. Throughput of singleLinux VM running dbench with 40 clients. The black barsplot the performance when the VM is configured with mainmemory sizes ranging from 128 MB to 256 MB. The gray barsplot the performance of the same VM configured with 256 MB,ballooned down to the specified size.
or removed from a VM in order to rapidly adjust itsphysical memory size.
To demonstrate the effectiveness of ballooning, weused the synthetic dbench benchmark [28] to simulatefileserver performance under load from 40 clients. Thisworkload benefits significantly from additional memory,since a larger buffer cache can absorb more disk traffic.For this experiment, ESX Server was running on a dual-processor Dell Precision 420, configured to execute oneVM running Red Hat Linux 7.2 on a single 800 MHzPentium III CPU.
Figure 2 presents dbench throughput as a functionof VM size, using the average of three consecutive runsfor each data point. The ballooned VM tracks non-ballooned performance closely, with an observed over-head ranging from 4.4% at 128 MB (128 MB balloon)down to 1.4% at 224 MB (32 MB balloon). This over-head is primarily due to guest OS data structures that aresized based on the amount of “physical” memory; theLinux kernel uses more space in a 256 MB system thanin a 128 MB system. Thus, a 256 MB VM ballooneddown to 128 MB has slightly less free space than a VMconfigured with exactly 128 MB.
Despite its advantages, ballooning does have limita-tions. The balloon driver may be uninstalled, disabledexplicitly, unavailable while a guest OS is booting, ortemporarily unable to reclaim memory quickly enoughto satisfy current system demands. Also, upper boundson reasonable balloon sizes may be imposed by variousguest OS limitations.
3.3 Demand Paging
ESX Server preferentially uses ballooning to reclaimmemory, treating it as a common-case optimization.When ballooning is not possible or insufficient, the sys-tem falls back to a paging mechanism. Memory is re-claimed by paging out to an ESX Server swap area ondisk, without any guest involvement.
The ESX Server swap daemon receives informationabout target swap levels for each VM from a higher-level policy module. It manages the selection of candi-date pages and coordinates asynchronous page outs to aswap area on disk. Conventional optimizations are usedto maintain free slots and cluster disk writes.
A randomized page replacement policy is used to pre-vent the types of pathological interference with nativeguest OS memory management algorithms described inSection 3.1. This choice was also guided by the ex-pectation that paging will be a fairly uncommon oper-ation. Nevertheless, we are investigating more sophisti-cated page replacement algorithms, as well policies thatmay be customized on a per-VM basis.
4 Sharing Memory
Server consolidation presents numerous opportunitiesfor sharing memory between virtual machines. For ex-ample, several VMs may be running instances of thesame guest OS, have the same applications or compo-nents loaded, or contain common data. ESX Server ex-ploits these sharing opportunities, so that server work-loads running in VMs on a single machine often con-sume less memory than they would running on separatephysical machines. As a result, higher levels of over-commitment can be supported efficiently.
4.1 Transparent Page Sharing
Disco [3] introduced transparent page sharing as amethod for eliminating redundant copies of pages, suchas code or read-only data, across virtual machines. Oncecopies are identified, multiple guest “physical” pages aremapped to the same machine page, and marked copy-on-write. Writing to a shared page causes a fault thatgenerates a private copy.
Unfortunately, Disco required several guest OS mod-ifications to identify redundant copies as they were cre-ated. For example, the bcopy() routine was hooked to
enable file buffer cache sharing across virtual machines.Some sharing also required the use of non-standard orrestricted interfaces. A special network interface withsupport for large packets facilitated sharing data com-municated between VMs on a virtual subnet. Interpo-sition on disk accesses allowed data from shared, non-persistent disks to be shared across multiple guests.
4.2 Content-Based Page Sharing
Because modifications to guest operating system in-ternals are not possible in our environment, and changesto application programming interfaces are not accept-able, ESX Server takes a completely different approachto page sharing. The basic idea is to identify page copiesby their contents. Pages with identical contents can beshared regardless of when, where, or how those contentswere generated. This general-purpose approach has twokey advantages. First, it eliminates the need to mod-ify, hook, or even understand guest OS code. Second,it can identify more opportunities for sharing; by defini-tion, all potentially shareable pages can be identified bytheir contents.
The cost for this unobtrusive generality is that workmust be performed to scan for sharing opportunities.Clearly, comparing the contents of each page with ev-ery other page in the system would be prohibitively ex-pensive; naive matching would require O( ) page com-parisons. Instead, hashing is used to identify pages withpotentially-identical contents efficiently.
A hash value that summarizes a page’s contents isused as a lookup key into a hash table containing entriesfor other pages that have already been marked copy-on-write (COW). If the hash value for the new page matchesan existing entry, it is very likely that the pages are iden-tical, although false matches are possible. A successfulmatch is followed by a full comparison of the page con-tents to verify that the pages are identical.
Once a match has been found with an existing sharedpage, a standard copy-on-write technique can be usedto share the pages, and the redundant copy can be re-claimed. Any subsequent attempt to write to the sharedpage will generate a fault, transparently creating a pri-vate copy of the page for the writer.
If no match is found, one option is to mark the pageCOW in anticipation of some future match. However,this simplistic approach has the undesirable side-effectof marking every scanned page copy-on-write, incurringunnecessary overhead on subsequent writes. As an op-
...2bd806afhashcontents
011010110101010110101100
hash: ...07d8MPN: 8f44refs: 4
hash: ...06afMPN: 123bVM: 3PPN: 43f8
hint frame
shared frame
hashtable
VM 1 VM 2 VM 3
MachineMemory
PPN 2868MPN 1096
Figure 3: Content-Based Page Sharing. ESX Serverscans for sharing opportunities, hashing the contents of can-didate PPN 0x2868 in VM 2. The hash is used to index into atable containing other scanned pages, where a match is foundwith a hint frame associated with PPN 0x43f8 in VM 3. If afull comparison confirms the pages are identical, the PPN-to-MPNmapping for PPN 0x2868 in VM 2 is changed fromMPN0x1096 to MPN 0x123b, both PPNs are marked COW, and theredundant MPN is reclaimed.
timization, an unshared page is not marked COW, butinstead tagged as a special hint entry. On any futurematch with another page, the contents of the hint pageare rehashed. If the hash has changed, then the hint pagehas been modified, and the stale hint is removed. If thehash is still valid, a full comparison is performed, andthe pages are shared if it succeeds.
Higher-level page sharing policies control when andwhere to scan for copies. One simple option is to scanpages incrementally at some fixed rate. Pages could beconsidered sequentially, randomly, or using heuristics tofocus on the most promising candidates, such as pagesmarked read-only by the guest OS, or pages from whichcode has been executed. Various policies can be usedto limit CPU overhead, such as scanning only duringotherwise-wasted idle cycles.
4.3 Implementation
The ESX Server implementation of content-basedpage sharing is illustrated in Figure 3. A single globalhash table contains frames for all scanned pages, andchaining is used to handle collisions. Each frame is en-coded compactly in 16 bytes. A shared frame consistsof a hash value, the machine page number (MPN) forthe shared page, a reference count, and a link for chain-ing. A hint frame is similar, but encodes a truncated
hash value to make room for a reference back to the cor-responding guest page, consisting of a VM identifier anda physical page number (PPN). The total space overheadfor page sharing is less than 0.5% of system memory.
Unlike the Disco page sharing implementation, whichmaintained a backmap for each shared page, ESX Serveruses a simple reference count. A small 16-bit count isstored in each frame, and a separate overflow table isused to store any extended frames with larger counts.This allows highly-shared pages to be represented com-pactly. For example, the empty zero page filled com-pletely with zero bytes is typically shared with a largereference count. A similar overflow technique for largereference counts was used to save space in the earlyOOZE virtual memory system [15].
A fast, high-quality hash function [14] is used togenerate a 64-bit hash value for each scanned page.Since the chance of encountering a false match due tohash aliasing is incredibly small3 the system can makethe simplifying assumption that all shared pages haveunique hash values. Any page that happens to yield afalse match is considered ineligible for sharing.
The current ESX Server page sharing implementationscans guest pages randomly. Although more sophisti-cated approaches are possible, this policy is simple andeffective. Configuration options control maximum per-VM and system-wide page scanning rates. Typically,these values are set to ensure that page sharing incursnegligible CPU overhead. As an additional optimiza-tion, the system always attempts to share a page beforepaging it out to disk.
To evaluate the ESX Server page sharing implemen-tation, we conducted experiments to quantify its effec-tiveness at reclaiming memory and its overhead on sys-tem performance. We first analyze a “best case” work-load consisting of many homogeneous VMs, in order todemonstrate that ESX Server is able to reclaim a largefraction of memorywhen the potential for sharing exists.We then present additional data collected from produc-tion deployments serving real users.
We performed a series of controlled experiments us-ing identically-configured virtual machines, each run-ning Red Hat Linux 7.2 with 40 MB of “physical” mem-ory. Each experiment consisted of between one and ten
3Assuming page contents are randomly mapped to 64-bit hash val-ues, the probability of a single collision doesn’t exceed 50% until ap-proximately distinct pages are hashed [14]. For a staticsnapshot of the largest possible IA-32 memory configuration withpages (64 GB), the collision probability is less than 0.01%.
1 2 3 4 5 6 7 8 9 100
100
200
300
400
Mem
ory
(MB
)
VM MemoryShared (COW)ReclaimedZero Pages
1 2 3 4 5 6 7 8 9 10Number of VMs
0
10
20
30
40
50
60
70
% V
M M
emor
y
Shared (COW)ReclaimedShared - Reclaimed
Figure 4: Page Sharing Performance. Sharing metricsfor a series of experiments consisting of identical Linux VMsrunning SPEC95 benchmarks. The top graph indicates the ab-solute amounts of memory shared and saved increase smoothlywith the number of concurrent VMs. The bottom graph plotsthese metrics as a percentage of aggregate VM memory. Forlarge numbers of VMs, sharing approaches 67% and nearly60% of all VM memory is reclaimed.
concurrent VMs running SPEC95 benchmarks for thirtyminutes. For these experiments, ESX Server was run-ning on a Dell PowerEdge 1400SC multiprocessor withtwo 933 MHz Pentium III CPUs.
Figure 4 presents several sharing metrics plotted asa function of the number of concurrent VMs. Surpris-ingly, some sharing is achieved with only a single VM.Nearly 5 MB of memory was reclaimed from a singleVM, of which about 55% was due to shared copies ofthe zero page. The top graph shows that after an initialjump in sharing between the first and second VMs, thetotal amount of memory shared increases linearly withthe number of VMs, as expected. Little sharing is at-tributed to zero pages, indicating that most sharing isdue to redundant code and read-only data pages. Thebottom graph plots these metrics as a percentage of ag-gregate VM memory. As the number of VMs increases,the sharing level approaches 67%, revealing an over-lap of approximately two-thirds of all memory betweenthe VMs. The amount of memory required to containthe single copy of each common shared page (labelledShared – Reclaimed), remains nearly constant, decreasingas a percentage of overall VM memory.
Total Shared ReclaimedGuest Types MB MB % MB %
A 10 WinNT 2048 880 42.9 673 32.9B 9 Linux 1846 539 29.2 345 18.7C 5 Linux 1658 165 10.0 120 7.2
Figure 5: Real-World Page Sharing. Sharing metricsfrom production deployments of ESX Server. (a) TenWindowsNT VMs serving users at a Fortune 50 company, running a va-riety of database (Oracle, SQL Server), web (IIS, Websphere),development (Java, VB), and other applications. (b) NineLinux VMs serving a large user community for a nonprofitorganization, executing a mix of web (Apache), mail (Major-domo, Postfix, POP/IMAP, MailArmor), and other servers. (c)Five Linux VMs providing web proxy (Squid), mail (Postfix,RAV), and remote access (ssh) services to VMware employees.
The CPU overhead due to page sharing was negligi-ble. We ran an identical set of experiments with pagesharing disabled, and measured no significant differencein the aggregate throughput reported by the CPU-boundbenchmarks running in the VMs. Over all runs, the ag-gregate throughput was actually 0.5% higher with pagesharing enabled, and ranged from 1.6% lower to 1.8%higher. Although the effect is generally small, page shar-ing does improve memory locality, and may thereforeincrease hit rates in physically-indexed caches.
These experiments demonstrate that ESX Server isable to exploit sharing opportunities effectively. Ofcourse, more diverse workloads will typically exhibitlower degrees of sharing. Nevertheless, many real-worldserver consolidation workloads do consist of numerousVMs running the same guest OS with similar applica-tions. Since the amount of memory reclaimed by pagesharing is very workload-dependent, we collected mem-ory sharing statistics from several ESX Server systemsin production use.
Figure 5 presents page sharing metrics collected fromthree different production deployments of ESX Server.Workload , from a corporate IT department at a For-tune 50 company, consists of ten Windows NT 4.0 VMsrunning a wide variety of database, web, and otherservers. Page sharing reclaimed nearly a third of all VMmemory, saving 673 MB. Workload , from a nonprofitorganization’s Internet server, consists of nine LinuxVMs ranging in size from 64 MB to 768 MB, runninga mix of mail, web, and other servers. In this case, pagesharing was able to reclaim 18.7% of VM memory, sav-ing 345 MB, of which 70 MB was attributed to zeropages. Finally, workload is from VMware’s own ITdepartment, and provides web proxy, mail, and remoteaccess services to our employees using five Linux VMs
ranging in size from 32 MB to 512 MB. Page sharingreclaimed about 7% of VM memory, for a savings of120 MB, of which 25 MB was due to zero pages.
5 Shares vs. Working Sets
Traditional operating systems adjust memory alloca-tions to improve some aggregate, system-wide perfor-mance metric. While this is usually a desirable goal,it often conflicts with the need to provide quality-of-service guarantees to clients of varying importance.Such guarantees are critical for server consolidation,where each VM may be entitled to different amountsof resources based on factors such as importance, own-ership, administrative domains, or even the amount ofmoney paid to a service provider for executing the VM.In such cases, it can be preferable to penalize a less im-portant VM, even when that VMwould derive the largestperformance benefit from additional memory.
ESX Server employs a new allocation algorithm thatis able to achieve efficient memory utilization whilemaintaining memory performance isolation guarantees.In addition, an explicit parameter is introduced that al-lows system administrators to control the relative impor-tance of these conflicting goals.
5.1 Share-Based Allocation
In proportional-share frameworks, resource rights areencapsulated by shares, which are owned by clients thatconsume resources.4 A client is entitled to consume re-sources proportional to its share allocation; it is guaran-teed a minimum resource fraction equal to its fraction ofthe total shares in the system. Shares represent relativeresource rights that depend on the total number of sharescontending for a resource. Client allocations degradegracefully in overload situations, and clients proportion-ally benefit from extra resources when some allocationsare underutilized.
Both randomized and deterministic algorithms havebeen proposed for proportional-share allocation ofspace-shared resources. The dynamic min-funding revo-cation algorithm [31, 32] is simple and effective. Whenone client demands more space, a replacement algo-rithm selects a victim client that relinquishes some of itspreviously-allocated space. Memory is revoked from the
4Shares are alternatively referred to as tickets or weights in the lit-erature. The term clients is used to abstractly refer to entities such asthreads, processes, VMs, users, or groups.
client that owns the fewest shares per allocated page. Us-ing an economic analogy, the shares-per-page ratio canbe interpreted as a price; revocation reallocates memoryaway from clients paying a lower price to those willingto pay a higher price.
5.2 Reclaiming Idle Memory
A significant limitation of pure proportional-share al-gorithms is that they do not incorporate any informa-tion about active memory usage or working sets. Mem-ory is effectively partitioned to maintain specified ratios.However, idle clients with many shares can hoard mem-ory unproductively, while active clients with few sharessuffer under severe memory pressure. In general, thegoals of performance isolation and efficient memory uti-lization often conflict. Previous attempts to cross-applytechniques from proportional-share CPU resource man-agement to compensate for idleness have not been suc-cessful [25].
ESX Server resolves this problem by introducing anidle memory tax. The basic idea is to charge a clientmore for an idle page than for one it is actively using.When memory is scarce, pages will be reclaimed prefer-entially from clients that are not actively using their fullallocations. The tax rate specifies the maximum fractionof idle pages that may be reclaimed from a client. If theclient later starts using a larger portion of its allocatedmemory, its allocation will increase, up to its full share.
Min-funding revocation is extended to use an adjustedshares-per-page ratio. For a client with shares and anallocation of pages, of which a fraction are active,the adjusted shares-per-page ratio is
where the idle page cost for a given taxrate .
The tax rate provides explicit control over the de-sired policy for reclaiming idle memory. At one ex-treme, specifies pure share-based isolation. Atthe other, specifies a policy that allows all of aclient’s idle memory to be reclaimed for more produc-tive uses.
The ESX Server idle memory tax rate is a config-urable parameter that defaults to 75%. This allows mostidle memory in the system to be reclaimed, while stillproviding a buffer against rapid working set increases,
masking the latency of system reclamation activity suchas ballooning and swapping.5
5.3 Measuring Idle Memory
For the idle memory tax to be effective, the serverneeds an efficient mechanism to estimate the fraction ofmemory in active use by each virtual machine. How-ever, specific active and idle pages need not be identifiedindividually.
One option is to extract information using native in-terfaces within each guest OS. However, this is impracti-cal, since diverse activity metrics are used across variousguests, and those metrics tend to focus on per-processworking sets. Also, guest OS monitoring typically relieson access bits associated with page table entries, whichare bypassed by DMA for device I/O.
ESX Server uses a statistical sampling approach to ob-tain aggregate VM working set estimates directly, with-out any guest involvement. Each VM is sampled inde-pendently, using a configurable sampling period definedin units of VM execution time. At the start of each sam-pling period, a small number of the virtual machine’s“physical” pages are selected randomly using a uniformdistribution. Each sampled page is tracked by invalidat-ing any cached mappings associated with its PPN, suchas hardware TLB entries and virtualized MMU state.The next guest access to a sampled page will be inter-cepted to re-establish these mappings, at which time atouched page count is incremented. At the end of thesampling period, a statistical estimate of the fractionof memory actively accessed by the VM is .
The sampling rate may be controlled to tradeoff over-head and accuracy. By default, ESX Server samples100 pages for each 30 second period. This results in atmost 100 minor page faults per period, incurring negli-gible overhead while still producing reasonably accurateworking set estimates.
Estimates are smoothed across multiple sampling pe-riods. Inspired by work on balancing stability and agilityfrom the networking domain [16], we maintain separateexponentially-weighted moving averages with differentgain parameters. A slow moving average is used to pro-duce a smooth, stable estimate. A fast moving average
5The configured tax rate applies uniformly to all VMs. While theunderlying implementation supports separate, per-VM tax rates, thiscapability is not currently exposed to users. Customized or graduatedtax rates may be useful for more sophisticated control over relativeallocations and responsiveness.
0 10 20 30 40Time (min)
0
100
200
300
Mem
ory
(MB
)
Slow FastMaxToucher
ZPT
Figure 6: Active Memory Sampling. A Windows VMexecutes a simple memory toucher application. The solidblack line indicates the amount of memory repeatedly touched,which is varied over time. The dotted black line is thesampling-based statistical estimate of overall VM memory us-age, including background Windows activities. The estimate iscomputed as the max of fast (gray dashed line) and slow (graydotted line) moving averages. The spike labelled ZPT is due tothe Windows “zero page thread.”
adapts quickly to working set changes. Finally, a versionof the fast average that incorporates counts from the cur-rent sampling period is updated incrementally to reflectrapid intra-period changes.
The server uses the maximum of these three values toestimate the amount of memory being actively used bythe guest. This causes the system to respond rapidly toincreases in memory usage and more gradually to de-creases in memory usage, which is the desired behavior.A VM that had been idle and starts using memory is al-lowed to ramp up to its share-based allocation quickly,while a VM that had been active and decreases its work-ing set has its idle memory reclaimed slowly via the idlememory tax.
5.4 Experimental Results
This section presents quantitative experiments thatdemonstrate the effectiveness of memory sampling andidle memory taxation. Memory sampling is used to es-timate the fraction of memory actively used by eachVM. These estimates are then incorporated into the idlememory tax computations performed by the share-basedmemory allocation algorithm.
Figure 6 presents the results of an experiment de-signed to illustrate the memory sampling technique. Forthis experiment, ESX Server was running on a dual-processor Dell Precision 420, configured to execute one
0 10 20 30 40 50 60Time (min)
0
50
100
150
200
250
Mem
ory
(MB
)
VM1 allocVM1 usedVM2 allocVM2 used
τ = 75%τ = 0%
Figure 7: Idle Memory Tax. Two VMs with identicalshare allocations are each configured with 256 MB in an over-committed system. VM1 (gray) runs Windows, and remainsidle after booting. VM2 (black) executes a memory-intensiveLinux workload. For each VM, ESX Server allocations areplotted as solid lines, and estimated memory usage is indicatedby dotted lines. With an initial tax rate of 0%, the VMs eachconverge on the same 179 MB allocation. When the tax rateis increased to 75%, idle memory is reclaimed from VM1 andreallocated to VM2, boosting its performance by over 30%.
VM running Windows 2000 Advanced Server on a sin-gle 800 MHz Pentium III CPU.
A user-level toucher application allocates and repeat-edly accesses a controlled amount of memory that is var-ied between 50 MB and 250 MB. An additional 10–20 MB is accessed by standard Windows backgroundactivities. As expected, the statistical estimate of ac-tive memory usage responds quickly as more memoryis touched, tracking the fast moving average, and moreslowly as less memory is touched, tracking the slowmoving average.
We were originally surprised by the unexpected spikeimmediately after the toucher application terminates, aneffect that does not occur when the same experiment isrun under Linux. This is caused by the Windows “zeropage thread” that runs only when no other threads arerunnable, clearing the contents of pages it moves fromthe free page list to the zeroed page list [22].
Figure 7 presents experimental results that demon-strate the effectiveness of imposing a tax on idle mem-ory. For this experiment, ESX Server was running ona Dell Precision 420 multiprocessor with two 800 MHzPentium III CPUs and 512 MB RAM, of which approx-imately 360 MB was available for executing VMs.6
6Some memory is required for per-VM virtualization overheads,which are discussed in Section 6.2. Additional memory is required forESX Server itself; the smallest recommended configuration is 512 MB.
Two VMs with identical share allocations are eachconfigured with 256 MB “physical” memory. Thefirst VM that powers on runs Windows 2000 AdvancedServer, and remains idle after booting. A few min-utes later, a second VM is started, running a memory-intensive dbench workload [28] under Red Hat Linux7.2. The initial tax rate is set to , resulting in apure share-based allocation. Despite the large differencein actual memory usage, each VM receives the same179 MB allocation from ESX Server. In the middle ofthe experiment, the tax rate is increased to ,causing memory to be reclaimed from the idle WindowsVM and reallocated to the active Linux VM runningdbench. The dbench workload benefits significantlyfrom the additional memory, increasing throughput byover 30% after the tax rate change.
6 Allocation Policies
ESX Server computes a target memory allocation foreach VM based on both its share-based entitlement andan estimate of its working set, using the algorithm pre-sented in Section 5. These targets are achieved via theballooning and paging mechanisms presented in Sec-tion 3. Page sharing runs as an additional backgroundactivity that reduces overall memory pressure on the sys-tem. This section describes how these various mecha-nisms are coordinated in response to specified allocationparameters and system load.
6.1 Parameters
System administrators use three basic parameters tocontrol the allocation of memory to each VM: a minsize, a max size, and memory shares. The min size is aguaranteed lower bound on the amount of memory thatwill be allocated to the VM, even when memory is over-committed. The max size is the amount of “physical”memory configured for use by the guest OS running inthe VM. Unless memory is overcommitted, VMs will beallocated their max size.
Memory shares entitle a VM to a fraction of physicalmemory, based on a proportional-share allocation pol-icy. For example, a VM that has twice as many shares asanother is generally entitled to consume twice as muchmemory, subject to their respective min and max con-straints, provided they are both actively using their allo-cated memory.
6.2 Admission Control
An admission control policy ensures that sufficientunreserved memory and server swap space is availablebefore a VM is allowed to power on. Machine memorymust be reserved for the guaranteed min size, as wellas additional overhead memory required for virtualiza-tion, for a total of min + overhead. Overhead mem-ory includes space for the VM graphics frame bufferand various virtualization data structures such as thepmap and shadow page tables (see Section 2). Typi-cal VMs reserve 32 MB for overhead, of which 4 to8 MB is devoted to the frame buffer, and the remaindercontains implementation-specific data structures. Addi-tional memory is required for VMs larger than 1 GB.
Disk swap space must be reserved for the remainingVM memory; i.e. max min. This reservation ensuresthe system is able to preserveVMmemory under any cir-cumstances; in practice, only a small fraction of this diskspace is typically used. Similarly, while memory reser-vations are used for admission control, actual memoryallocations vary dynamically, and unused reservationsare not wasted.
6.3 Dynamic Reallocation
ESX Server recomputes memory allocations dynami-cally in response to various events: changes to system-wide or per-VM allocation parameters by a system ad-ministrator, the addition or removal of a VM from thesystem, and changes in the amount of free memory thatcross predefined thresholds. Additional rebalancing isperformed periodically to reflect changes in idle mem-ory estimates for each VM.
Most operating systems attempt to maintain a mini-mum amount of free memory. For example, BSD Unixnormally starts reclaiming memory when the percentageof free memory drops below 5% and continues reclaim-ing until the free memory percentage reaches 7% [18].ESX Server employs a similar approach, but uses fourthresholds to reflect different reclamation states: high,soft, hard, and low, which default to 6%, 4%, 2%, and1% of system memory, respectively.
In the the high state, free memory is sufficient and noreclamation is performed. In the soft state, the systemreclaims memory using ballooning, and resorts to pag-ing only in cases where ballooning is not possible. Inthe hard state, the system relies on paging to forcibly re-claim memory. In the rare event that free memory tran-siently falls below the low threshold, the system con-
tinues to reclaim memory via paging, and additionallyblocks the execution of all VMs that are above their tar-get allocations.
In all memory reclamation states, the system com-putes target allocations for VMs to drive the aggregateamount of free space above the high threshold. A transi-tion to a lower reclamation state occurs when the amountof free memory drops below the lower threshold. Af-ter reclaiming memory, the system transitions back tothe next higher state only after significantly exceedingthe higher threshold; this hysteresis prevents rapid statefluctuations.
To demonstrate dynamic reallocation we ran a work-load consisting of five virtual machines. A pair of VMsexecuted a Microsoft Exchange benchmark; one VM ranan Exchange Server under Windows 2000 Server, anda second VM ran a load generator client under Win-dows 2000 Professional. A different pair executed a Cit-rix MetaFrame benchmark; one VM ran a MetaFrameServer under Windows 2000 Advanced Server, and asecond VM ran a load generator client under Windows2000 Server. A final VM executed database queries withMicrosoft SQL Server under Windows 2000 AdvancedServer. The Exchange VMs were each configured with256 MB memory; the other three VMs were each con-figured with 320 MB. The min size for each VM was setto half of its configured max size, and memory shareswere allocated proportional to the max size of each VM.
For this experiment, ESX Server was running onan IBM Netfinity 8500R multiprocessor with eight550 MHz Pentium III CPUs. To facilitate demonstrat-ing the effects of memory pressure, machine memorywas deliberately limited so that only 1 GB was avail-able for executing VMs. The aggregate VM workloadwas configured to use a total of 1472 MB; with the addi-tional 160 MB required for overhead memory, memorywas overcommitted by more than 60%.
Figure 8(a) presents ESX Server allocation states dur-ing the experiment. Except for brief transitions early inthe run, nearly all time is spent in the high and soft states.Figure 8(b) plots several allocation metrics over time.When the experiment is started, all five VMs boot con-currently. Windows zeroes the contents of all pages in“physical” memory while booting. This causes the sys-tem to become overcommitted almost immediately, aseach VM accesses all of its memory. Since the Windowsballoon drivers are not started until late in the boot se-quence, ESX Server is forced to start paging to disk. For-tunately, the “share before swap” optimization describedin Section 4.3 is very effective: 325 MB of zero pages
0 10 20 30 40 50 60 70 80 90
low
hard
soft
high
Allo
c St
ate
(a) State Transitions
0 10 20 30 40 50 60 70 80 900
500
1000
Mem
ory
(MB
) AllocActiveBalloonShared
(b) All VMs
0 10 20 30 40 50 60 70 80 900
100
200
300
Mem
ory
(MB
)
(c) Citrix Server
0 10 20 30 40 50 60 70 80 90Time (min)
0
100
200
300
Mem
ory
(MB
)
(d) SQL Server
Figure 8: Dynamic Reallocation. Memory allocationmetrics over time for a consolidated workload consisting offive Windows VMs: Microsoft Exchange (separate server andclient load generator VMs), Citrix MetaFrame (separate serverand client load generator VMs), and Microsoft SQL Server.(a) ESX Server allocation state transitions. (b) Aggregate al-location metrics summed over all five VMs. (c) Allocationmetrics for MetaFrame Server VM. (d) Allocation metrics forSQL Server VM.
are reclaimed via page sharing, while only 35 MB ofnon-zero data is actually written to disk.7 As a result ofsharing, the aggregate allocation to all VMs approaches1200 MB, exceeding the total amount of machine mem-ory. Soon after booting, the VMs start executing theirapplication benchmarks, the amount of shared memorydrops rapidly, and ESX Server compensates by usingballooning to reclaim memory. Page sharing continuesto exploit sharing opportunities over the run, saving ap-proximately 200 MB.
Figures 8(c) and 8(d) show the same memory al-location data for the Citrix MetaFrame Server VMand the Microsoft SQL Server VM, respectively. TheMetaFrame Server allocation tracks its active memoryusage, and also grows slowly over time as page sharingreduces overall memory pressure. The SQL Server allo-cation starts high as it processes queries, then drops to160 MB as it idles, the lower bound imposed by its minsize. When a long-running query is issued later, its ac-tive memory increases rapidly, and memory is quicklyreallocated from other VMs.
7 I/O Page Remapping
Modern IA-32 processors support a physical addressextension (PAE) mode that allows the hardware to ad-dress up to 64 GB of memory with 36-bit addresses [13].However, many devices that use DMA for I/O transferscan address only a subset of this memory. For example,some network interface cards with 32-bit PCI interfacescan address only the lowest 4 GB of memory.
Some high-end systems provide hardware support thatcan be used to remap memory for data transfers using aseparate I/O MMU. More commonly, support for I/O in-volving “high” memory above the 4 GB boundary in-volves copying the data through a temporary bouncebuffer in “low” memory. Unfortunately, copying can im-pose significant overhead resulting in increased latency,reduced throughput, or increased CPU load.
This problem is exacerbated by virtualization, sinceeven pages from virtual machines configured with lessthan 4 GB of “physical” memory may be mapped to ma-chine pages residing in high memory. Fortunately, thissame level of indirection in the virtualized memory sys-tem can be exploited to transparently remap guest pagesbetween high and low memory.
7This is the peak amount of memory paged to disk over the entirerun. To avoid clutter, paging metrics were omitted from the graphs; theamount of data swapped to disk was less than 20 MB for the remainderof the experiment.
ESX Server maintains statistics to track “hot” pagesin high memory that are involved in repeated I/O op-erations. For example, a software cache of physical-to-machine page mappings (PPN-to-MPN) associatedwith network transmits is augmented to count the num-ber of times each page has been copied. When thecount exceeds a specified threshold, the page is trans-parently remapped into low memory. This scheme hasproved very effective with guest operating systems thatuse a limited number of pages as network buffers. Forsome network-intensiveworkloads, the number of pagescopied is reduced by several orders of magnitude.
The decision to remap a page into low memory in-creases the demand for low pages, which may become ascarce resource. It may be desirable to remap some lowpages into high memory, in order to free up sufficientlow pages for remapping I/O pages that are currently“hot.” We are currently exploring various techniques,ranging from simple random replacement to adaptive ap-proaches based on cost-benefit tradeoffs.
8 Related Work
Virtual machines have been used in numerous re-search projects [3, 7, 8, 9] and commercial products[20, 23] over the past several decades. ESX Serverwas inspired by recent work on Disco [3] and CellularDisco [9], which virtualized shared-memory multipro-cessor servers to run multiple instances of IRIX.
ESX Server uses many of the same virtualization tech-niques as other VMware products. One key distinctionis that VMware Workstation uses a hosted architecturefor maximum portability across diverse desktop systems[23], while ESX Server manages server hardware di-rectly for complete control over resource managementand improved I/O performance.
Many of the mechanisms and policies we developedwere motivated by the need to run existing commodityoperating systems without any modifications. This en-ables ESX Server to run proprietary operating systemssuch as Microsoft Windows and standard distributionsof open-source systems such as Linux.
Ballooning implicitly coaxes a guest OS into reclaim-ing memory using its own native page replacement algo-rithms. It has some similarity to the “self-paging” tech-nique used in the Nemesis system [11], which requiresapplications to handle their own virtual memory opera-tions, including revocation. However, few applicationsare capable of making their own page replacement deci-sions, and applicationsmust be modified to participate in
an explicit revocation protocol. In contrast, guest operat-ing systems already implement page replacement algo-rithms and are oblivious to ballooning details. Since theyoperate at different levels, ballooning and self-pagingcould be used together, allowing applications to maketheir own decisions in response to reclamation requeststhat originate at a much higher level.
Content-based page sharing was directly influencedby the transparent page sharing work in Disco [3]. How-ever, the content-based approach used in ESX Serveravoids the need to modify, hook, or even understandguest OS code. It also exploits many opportunities forsharing missed by both Disco and the standard copy-on-write techniques used in conventional operating systems.
IBM’s MXT memory compression technology [27],which achieves substantial memory savings on serverworkloads, provided additional motivation for pagesharing. Although this hardware approach eliminates re-dundancy at a sub-page granularity, its gains from com-pression of large zero-filled regions and other patternscan also be achieved via page sharing.
ESX Server exploits the ability to transparently remap“physical” pages for both page sharing and I/O pageremapping. Disco employed similar techniques forreplication and migration to improve locality and faultcontainment in NUMA multiprocessors [3, 9]. In gen-eral, page remapping is a well-known approach that iscommonly used to change virtual-to-physical mappingsin systems that do not have an extra level of “virtualizedphysical” addressing. For example, remapping and pagecoloring have been used to improve cache performanceand isolation [17, 19, 21].
The ESX Server mechanism for working-set estima-tion is related to earlier uses of page faults to main-tain per-page reference bits in software on architectureslacking direct hardware support [2]. However, we com-bine this technique with a unique statistical sampling ap-proach. Instead of tracking references to all pages indi-vidually, an aggregate estimate of idleness is computedby sampling a small subset.
Our allocation algorithm extends previous research onproportional-share allocation of space-shared resources[31, 32]. The introduction of a “tax” on idle mem-ory solves a significant known problem with pure share-based approaches [25], enabling efficient memory uti-lization while still maintaining share-based isolation.The use of economic metaphors is also related to moreexplicit market-based approaches designed to facilitatedecentralized application-level optimization [12].
9 Conclusions
We have presented the core mechanisms and policiesused to manage memory resources in ESX Server [29],a commercially-available product. Our contributions in-clude several novel techniques and algorithms for allo-cating memory across virtual machines running unmod-ified commodity operating systems.
A new ballooning technique reclaims memory froma VM by implicitly causing the guest OS to invoke itsown memorymanagement routines. An idle memory taxwas introduced to solve an open problem in share-basedmanagement of space-shared resources, enabling bothperformance isolation and efficient memory utilization.Idleness is measured via a statistical working set esti-mator. Content-based transparent page sharing exploitssharing opportunities within and between VMs withoutany guest OS involvement. Page remapping is also lever-aged to reduce I/O copying overheads in large-memorysystems. A higher-level dynamic reallocation policy co-ordinates these diverse techniques to efficiently supportvirtual machine workloads that overcommit memory.
We are currently exploring a variety of issues re-lated to memory management in virtual machine sys-tems. Transparent page remapping can be exploited toimprove locality and fault containment on NUMA hard-ware [3, 9] and to manage the allocation of cache mem-ory to VMs by controlling page colors [17]. Additionalwork is focused on higher-level grouping abstractions[30, 31], multi-resource tradeoffs [24, 31], and adaptivefeedback-driven workload management techniques [5].
Acknowledgements
Mahesh Patil designed and implemented the ESXServer paging mechanism. Mike Nelson and KinshukGovil helped develop the hot I/O page remapping tech-nique. Vikram Makhija and Mahesh Patil provided in-valuable assistance with quantitative experiments. Wewould also like to thank Keith Adams, Ole Agesen, Jen-nifer Anderson, Ed Bugnion, Andrew Lambeth, Beng-Hong Lim, Tim Mann, Michael Mullany, Paige Parsons,Mendel Rosenblum, Jeff Slusher, John Spragens, PratapSubrahmanyam, Chandu Thekkath, Satyam Vaghani,DebbyWallach, John Zedlewski, and the anonymous re-viewers for their comments and helpful suggestions.
VMware and ESX Server are trademarks of VMware,Inc. Windows and Windows NT are trademarks of Mi-crosoft Corp. Pentium is a trademark of Intel Corp. Allother marks and names mentioned in this paper may betrademarks of their respective companies.
References
[1] Andrea C. Arpaci-Dusseau and Remzi H. Arpaci-Dusseau. “Information and Control in Gray-Box Sys-tems,” Proc. Symposium on Operating System Principles,October 2001.
[2] Ozalp Babaoglu and William Joy. “Converting a Swap-Based System to do Paging in an Architecture LackingPage-Reference Bits,” Proc. Symposium on OperatingSystem Principles, December 1981.
[3] Edouard Bugnion, Scott Devine, Kinshuk Govil, andMendel Rosenblum. “Disco: Running Commodity Oper-ating Systems on Scalable Multiprocessors,” ACMTrans-actions on Computer Systems, 15(4), November 1997.
[4] Pei Cao, Edward W. Felten, and Kai Li. “Implemen-tation and Performance of Application-Controlled FileCaching,” Proc. Symposium on Operating System Designand Implementation, November 1994.
[5] Jeffrey S. Chase, Darrell C. Anderson, Prachi N. Thakar,and Amin M. Vahdat. “Managing Energy and Server Re-sources in Hosting Centers,” Proc. Symposium on Oper-ating System Principles, October 2001.
[6] R. J. Creasy. “The Origin of the VM/370 Time-SharingSystem,” IBM Journal of Research and Development,25(5), September 1981.
[7] Bryan Ford, Mike Hibler, Jay Lepreau, Patrick Tull-man, Godmar Back, and Stephen Clawson. “Microker-nels Meet Recursive Virtual Machines,” Proc. Sympo-sium on Operating System Design and Implementation,October 1996.
[8] Robert P. Goldberg. “Survey of Virtual Machine Re-search,” IEEE Computer, 7(6), June 1974.
[9] Kinshuk Govil, Dan Teodosiu, Yongqiang Huang, andMendel Rosenblum. “Cellular Disco: Resource Manage-ment Using Virtual Clusters on Shared-Memory Mul-tiprocessors,” Proc. Symposium on Operating SystemPrinciples, December 1999.
[10] Peter H. Gum. “System/370 Extended Architecture: Fa-cilities for Virtual Machines,” IBM Journal of Researchand Development’, 27(6), November 1983.
[11] Steven M. Hand. “Self-Paging in the Nemesis OperatingSystem,” Proc. Symposium on Operating Systems Designand Implementation, February 1999.
[12] Kieran Harty and David R. Cheriton. “Application-Controlled Physical Memory using External Page-CacheManagement,” Proc. Fifth International Conference onArchitectural Support for Programming Languages andOperating Systems, October 1992.
[13] Intel Corporation. IA-32 Intel Architecture Software De-veloper’s Manual. Volumes I, II, and III, 2001.
[14] Bob Jenkins. “Algorithm Alley,” Dr. Dobbs Jour-nal, September 1997. Source code available fromhttp://burtleburtle.net/bob/hash/
[15] Ted Kaehler. “Virtual Memory for an Object-OrientedLanguage,” Byte, August 1981.
[16] Minkyong Kim and Brian Noble. “Mobile Network Esti-mation,” Proc. Seventh Annual International Conferenceon Mobile Computing and Networking, July 2001.
[17] Jochen Liedtke, Hermann Hartig, and Michael Hohmuth.“OS-Controlled Cache Predictability for Real-Time Sys-tems,” Proc. Third IEEE Real-Time Technology and Ap-plications Symposium, June 1997.
[18] Marshall K. McKusick, Keith Bostic, Michael J. Karels,and John S. Quaterman. The Design and Implementationof the 4.4 BSD Operating System, Addison-Wesley, 1996.
[19] Theodore H. Romer, Dennis Lee, Brian N. Bershad andJ. Bradley Chen. “Dynamic Page Mapping Policies forCache Conflict Resolution on Standard Hardware,” Proc.Symposium on Operating System Design and Implemen-tation, November 1994.
[20] L. H. Seawright and R. A. McKinnon. “VM/370: AStudy of Multiplicity and Usefulness,” IBM SystemsJournal, 18(1), 1979.
[21] Timothy Sherwood, Brad Calder and Joel S. Emer. “Re-ducing Cache Misses Using Hardware and Software PagePlacement,” Proc. International Conference on Super-computing, June 1999.
[22] David A. Solomon and Mark Russinovich. Inside Mi-crosoft Windows 2000, Third Ed., Microsoft Press, 2001.
[23] Jeremy Sugerman, Ganesh Venkitachalam, and Beng-Hong Lim. “Virtualizing I/O Devices on VMware Work-station’s Hosted Virtual Machine Monitor,” Proc. UsenixAnnual Technical Conference, June 2001.
[24] David G. Sullivan, Robert Haas, and Margo I. Seltzer.“Tickets and Currencies Revisited: Extensions to Multi-Resource Lottery Scheduling,” Proc. Seventh Workshopon Hot Topics in Operating Systems, March 1999.
[25] David G. Sullivan and Margo I. Seltzer. “Isolation withFlexibility: A Resource Management Framework forCentral Servers,” Proc. Usenix Annual Technical Confer-ence, June 2000.
[26] Andrew S. Tanenbaum. Modern Operating Systems,Prentice Hall, 1992.
[27] R. Tremaine, P. Franaszek, J. Robinson, C. Schulz, T.Smith, M. Wazlowski, and P. Bland. “IBM Memory Ex-pansion Technology (MXT),” IBM Journal of Researchand Development’, 45(2), March 2001.
[28] Andrew Tridgell. “dbench” benchmark. Available fromftp://samba.org/pub/tridge/dbench/, Septem-ber 2001.
[29] VMware, Inc. VMware ESX Server User’s Manual Ver-sion 1.5, Palo Alto, CA, April 2002.
[30] Carl A. Waldspurger and William E. Weihl. “LotteryScheduling: Flexible Proportional-Share Resource Man-agement,” Proc. Symposium on Operating System Designand Implementation, November 1994.
[31] Carl A. Waldspurger. Lottery and Stride Scheduling:Flexible Proportional-Share Resource Management,Ph.D. thesis, Technical Report MIT/LCS/TR-667,September 1995.
[32] Carl A. Waldspurger and William E. Weihl. “An Object-Oriented Framework for Modular Resource Manage-ment,” Proc. Fifth Workshop on Object-Orientation inOperating Systems, October 1996.