Changes in ESXi Transparent Page Sharing (TPS) behaviour

TPS makes it possible for ESXi to share (read access) physical RAM between virtual machines to increase the virtual machine consolidation ratio.

This is to increase security even further VMware will start shipping ESXi without TPS enabled by default according to the following schedule:

• ESXi 5.5 Update release – Q1 2015
• ESXi 5.1 Update release – Q4 2014
• ESXi 5.0 Update release – Q1 2015
• The next major version of ESXi

When small memory pages of 4 KB were used in operating systems, TSP could increase the consolidation ratio a lot. Today, most operating systems uses large memory pages of 2 MB (including ESXi) and TPS does not share large memory pages. Memory pages can be shared during e.g. when memory contention occur.

Patches to enforce the new TPS behaviour will be enabled before the new releases according to the following schedule:

• ESXi 5.5 Patch 3 available here.
• ESXi 5.1 patch planned for Q4, 2014
• ESXi 5.0 patch planned for Q4, 2014

See the following links for additional information about the change:

• VMware Security & Compliance Blog
• VMware KB 2080735
• VMware KB 2091682
• VMware KB 1021095

You can manually enable TPS if you want after the new patches and/or releases are applied and there are two options:

• For all virtual machines running on a specific ESXi host by setting the configuration “Mem.ShareScanGHz” to its default value of 4.
• For X number of virtual machines on a specific ESXi host by setting the configuration “Mem.ShareScanGHz” to its default value of 4 plus using the new concept of salting that means you can control what virtual machines you want to participate in TPS. Two salting configurations are required:
  • One the ESXi host level set “Mem.ShareForceSalting=1”
    • Default value is 0 meaning salting is off and the normal TPS behaviour is used.
  • Manually configure the same sched.mem.pshare.salt value for the virtual machines you want to participate in TPS.
    • By default the salt value for each virtual machine is unique. It is generated using the per virtual machine vc.uuid value.