The file system cache is a buffer that holds data coming from or destined for disks, LANs, and other peripherals (such as CD-ROM drives). Windows NT uses a single file system cache for all cachable peripheral devices. For simplicity we'll refer primarily to the disk as the source of data, but keep in mind this is a simplification, and any time we use the word "disk" in this chapter you may substitute LAN or CD-ROM or the high speed peripheral of your choice.
Unless an application specifies the FILE_FLAG_NO_BUFFERING parameter in its call when opening a file, the file system cache is used when the disk is accessed. On reads from the device, the data is first placed into the cache. On writes, the data goes into the cache before going to the disk.
Unbuffered I/O requests have a quaint restriction; the I/O must be done in a multiple of the sector size of the disk device. Because buffering usually helps performance a lot, it is rather unusual for a file to be opened without buffering enabled. The applications that do this are typically server applications (like SQL Server, for example) that manage their own buffers. For the purposes of this chapter, we will consider all file activity to be buffered by the file system cache.
When Windows NT first opens a file, the cache maps the file into its address space, and can then read the file as if it were an array of records in memory. When an application requests file data, the file system first looks in the cache to see if the data is there, and the cache tries to copy the record to the application's buffer. If the page is not in the working set of the cache, a page fault occurs, as shown in Figure 6.1.
Figure 6.1 Cache references to absent file pages are resolved by the memory manager
If the page is in memory, it is mapped (not copied) into the cache's working set. This means a page table entry is validated to point to the correct page frame in memory. If the page is not in memory, the memory manager gets the page from the correct file on the peripheral. This is how the cache manager uses the memory manager to do its input. The cache is treated much like the working set of a process. It will grow and shrink as demand dictates.
Let's see how this looks to Performance Monitor.