Cache Size

In the following sections, we'll explain how Windows computes the size of the system cache, both virtually and physically. As with most calculations related to memory management, the size of the system cache depends on a number of factors, including memory size and which version of Windows is running.

LargeSystemCache

As you'll see, the registry value HKLM\SYSTEM\CurrentControlSet\Control\SessionManager\Memory Management\LargeSystemCache influences both the virtual and physical sizes of the cache. The value is 0 by default on Windows 2000 Professional and Windows XP and 1 on Windows Server systems. You can adjust this value through the GUI on Windows 2000 Server systems by modifying the properties of the file server service. (Bring up the properties for a network connection, and double-click File And Printer Sharing For Microsoft Networks.) Even though this service exists on Windows 2000 Professional, its parameters can't be adjusted. Figure 11-4 shows the dialog box you use on Windows 2000 Server systems when modifying the amount of memory allocated for local and network applications in the Server network service.

Figure 11-4. File And Printer Sharing For Microsoft Networks Properties dialog box, which is used to modify the properties of the Windows 2000 Server network service

The setting shown in Figure 11-4, Maximize Data Throughput For File Sharing, is the default for Server systems running with Terminal Services installed the LargeSystemCache value is 1.

Choosing any of the other settings will set the LargeSystemCache value to 0. Although each of the four settings in the Optimization section of the File And Printer Sharing For Microsoft Networks Properties dialog box affect the behavior of the system cache, they also modify the behavior of the file server service.

On Windows XP and Windows Server 2003, you can modify LargeSystemCache in the Performance Options dialog box that you access by clicking the Settings button on the Advanced page of the System control panel applet, as shown in Figure 11-5. Selecting System Cache in the Memory Usage area of the Advanced tab sets the LargeSystemCache value to 1, while choosing Programs sets it to 0.

Figure 11-5. LargeSystemCache setting on Windows XP and Windows Server 2003

Cache Virtual Size

The virtual size of the system cache is a function of the amount of physical memory installed. The default size is 64 MB. If the system has more than 4032 pages (16 MB) of physical memory, the cache size is set to 128 MB plus 64 MB for each additional 4 MB of physical memory. Using this algorithm, the virtual size of the system cache for a computer with 64 MB of physical memory will be:

128 MB + (64 MB - 16 MB) / 4 MB * 64 MB = 896 MB

Table 11-1 shows the minimum and maximum virtual size of the system cache on different systems, along with the start and end addresses. If it's running on an x86 system and the system calculates a cache virtual size that is greater than 512 MB, the virtual size is limited to 512 MB unless the LargeSystemCache registry value is 1, in which case the cache is assigned up to 960 MB of virtual memory that includes an additional address range known as cache extra memory. The benefit of assigning more virtual memory to the cache is that, in general, it results in fewer view unmaps and remap operations as different files and different views of files are accessed.

Table 11-1. Size and Location of System Data Cache

Platform	Address Range	Minimum/Maximum Virtual Size
x86 2-GB system space	0xC1000000 E0FFFFFF,0xA4000000 BFFFFFFF	64 960 MB
x86 1-GB system space	0xC1000000 DBFFFFFF	64 432 MB
x86 1-GB system space with Terminal Services	0xC1000000 DCFFFFFF	64 448 MB
IA64	0xE000000600000000 E000010600000000	64 MB 1024 GB
x64	0xFFFFF98000000000 FFFFFA8000000000	64 MB 1024 GB

Table 11-2. lists the system variables that contain the virtual size and address of the system cache.

Table 11-2. System Variables for the Virtual Size and Address of the System Cache

System Variable	Description
MmSystemCacheStart	Starting virtual address of cache
MmSystemCacheEnd	Ending virtual address of cache
MiSystemCacheStartExtra	Starting virtual address of cache extra memory if cache size is greater than 512 MB (x86 systems only)
MiSystemCacheEndExtra	Ending virtual address of cache extra memory if cache size is greater than 512 MB (x86 systems only)
MmSizeOfSystemCacheInPages	Virtual size of cache in pages

EXPERIMENT: Viewing the Cache Virtual Size

The cache's virtual size isn't revealed through any performance counters, so the only way to know its value is to examine the kernel variable that stores it, MmSizeOfSystem- CacheInPages:

kd> dd MmSizeOfSystemCacheInPages l 1 80539a8c 00020000

In this example, taken from an x86 system running Windows XP with LargeSystem- Cache having a value of 0, the cache is 0x20000 virtual pages in size. Because a page on x86 is 4 KB, the virtual cache is assigned 512 MB of the 2 GB of the system's virtual address space.

Cache Working Set Size

As mentioned earlier, one of the key differences in the design of the cache manager from that of other operating systems is the delegation of physical memory management to the global memory manager. Because of this, the existing code that handles working set expansion and trimming as well as managing the modified and standby list is also used to control the size of the system cache, dynamically balancing demands for physical memory between processes and the operating system.

The system cache doesn't have its own working set but rather shares a single system set that includes cache data, paged pool, pageable Ntoskrnl code, and pageable driver code. As explained in the section "System Working Set" in Chapter 7, this single working set is called internally the system cache working set even though the system cache is just one of the components that contribute to it. For the purposes of this book, we'll refer to this working set simply as the system working set. Also explained in Chapter 7 is the fact that if the LargeSystemCache registry value is 1, the memory manager favors the system working set over that of processes running on the system.

You can examine the physical size of the system cache compared to that of the total system working set as well as page fault information on the system working set by examining the performance counters or system variables listed in Table 11-3.

Table 11-3. System Variables for the Physical Size of the System Cache and Page Fault Information

Performance Counter (in bytes)	System Variable (in pages)	Description
Memory: System Cache Resident Bytes	MmSystemCachePage	Physical memory consumed by the system cache.
Memory: Cache Bytes	MmSystemCacheWs.WorkingSetSize	Total size of the system working set (including the cache, paged pool, pageable code, and system mapped views). This is not the size of the cache (as the name implies)!
Memory: Cache Bytes Peak	MmSystemCacheWs.Peak	Peak system working set size.
Memory: Cache Faults/ Sec	MmSystemCacheWs.PageFaultCount	Page faults in the system working set (not just the cache).

EXPERIMENT: Looking at the Cache's Working Set

The !filecache debugger command dumps information about the physical memory the cache is using, the current and peak working set sizes, the number of valid pages associated with views, and the names of files mapped into views, where applicable, as you can see in the following output. (File system drivers cache metadata, such as directory structures and volume bitmaps, by using unnamed file streams.)

lkd> !filecache ***** Dump          file cache******   Reading and sorting VACBs...   Removed 657 nonactive VACBs, processing 1389 active VACBs... FileCache Information   Currentsize  132308 kb   Peak size    145764 kb   1389 Control Areas Skipping view @ c1040000 - no VACB, but PTE is valid!   Loading file cache database (100% of 1310 72 PTEs)   SkippedPageTableReads = 0   File cache has 21510 valid pages   Usage Summary (in Kb): Control  Valid  Standby/Dirty Shared Locked Name 89be09c8    272       0     0     0  default_message_database.db 8a267ad8      4       0     0     0  $Directory 8a37d140   3504    1196     0     0  $Mft 8a35c928   4320    1676     0     0  outlook.pst 8a2acbb8      4       0     0     0  $Directory 8a42c908    564       0     0     0  $BitMap 8a42bd28     12       0     0     0  $Mft 8a29ed88      4       0     0     0  $Directory 8a467008     48       0     0     0  $Directory 8a42b828    124       0     0     0    No NameforFile 8a467c58      8       0     0     0  $Directory 8a357f18    136      20     0     0  archive.pst 8a4a7248     52       0     0     0  $Directory 8a42a928    388       0     0     0  $Directory 8a457a10      4       0     0     0  $Directory 8a3f17a8      4       0     0     0  WIASERVC.LOG 89ede0e8      4       0     0     0  $Directory 8a491708  11900     136     0     0  $Mft 8a429fa0      4       0     0     0  $Directory 8a4318d8   2304   26624     0     0  $LogFile 8a438bc0      4       0     0     0  $Directory 8a4286a8      4       0     0     0  $Directory 8a491c50      8       0     0     0  $Directory 8a455de0      4       0     0     0  $Directory 8a3d0f00      4       0     0     0  $Directory 8a44d7a0   3420       0     0     0  $Mft 8a35ba10   1312       0    16     0  SHDOCVW.DLL 8a324130      4       0     0     0  $Directory 8a42c110      4       0     0     0  $Directory 8a41dd80      4       0     0     0  $Directory 88dfff38      4       0     0     0  $Directory 8a4a7640      4       0     0     0  $Directory 8a464d00      4       0     0     0  $Directory

Cache Physical Size

While the system working set includes the amount of physical memory that is mapped into views in the cache's virtual address space, it does not necessarily reflect the total amount of file data that is cached in physical memory. There can be a discrepancy between the two values because additional file data might be in the memory manager's standby or modified page lists.

Recall from Chapter 7 that during the course of working set trimming or page replacement the memory manager can move dirty pages from a working set to either the standby list or modified page list, depending on whether the page contains data that needs to be written to the paging file or other file before the page can be reused. If the memory manager didn't implement these lists, any time a process accessed data previously removed from its working set the memory manager would have to hard-fault it in from disk. Instead, if the accessed data is present on either of these lists, the memory manager simply soft-faults the page back into the process's working set. Thus, the lists serve as in-memory caches of data that's stored in the paging file, executable images, or data files. Thus, the total amount of file data cached on a system includes not only the system working set, but the combined sizes of the standby and modified page lists as well.

An example illustrates how the cache manager can cause much more file data than that containable in the system working set to be cached in physical memory. Consider a system that acts as a dedicated file server. The system has 8 GB of physical memory and the cache virtual size is 960 MB (the maximum on x86 systems). The maximum amount of file data that can be directly mapped in the cache's virtual memory is therefore 960 MB. A client application accesses file data from across the network and server, the file server driver (\Windows\ System32\Drivers\Srv.sys, described in Chapter 12), uses cache manager interfaces to read and write file data on behalf of the client. If the client reads through several thousand files of 1 MB each, the cache manager will have to start reusing views when mapping the 961st file. For each file read thereafter, the cache manager unmaps views and remaps them for new files. When the cache manager unmaps a view, the memory manager doesn't discard the file data in the cache's working set that correspond to the view, it moves the data to the standby list. In the absence of any other demand for physical memory, the standby list can consume almost all the physical memory that remains outside the system working set. In other words, virtually the entire 8 GB of the server's physical memory will be used to cache file data, as shown in Figure 11-6.

Figure 11-6. Example of where most of physical memory is file cache

Because the total amount of file data cached includes the system working set, modified page list, and standby list the sizes of which are all controlled by the memory manager it is in a sense the real cache manager. The cache manager subsystem simply provides convenient interfaces for accessing file data through the memory manager, and it plays an important role with its read-ahead and write-behind policies in influencing what data the memory manager keeps present in physical memory.

To try and accurately reflect the total amount of file data that's cache on a system, both Task Manager and Process Explorer show a value named System Cache in their performance view that reflects the combined sizes of the system working set, standby list, and modified page list. Figure 11-7 shows the system information view in Process Explorer and the System Cache value in the Physical Memory area in the middle of the figure.

Figure 11-7. Process Explorer's System Information dialog box