MMSUPPORT

Though it’s hardly clear from its name, the MMSUPPORT structure (formally _MMSUPPORT) is the Memory Manager’s highest-level implementation of a Working Set. It may best be thought of as an organising container. The main work is implemented in the MMWSL (Working Set List) structure and its potentially large array of MMWSLE (Working Set List Entry) structures.

Working sets come in five types. An MMSUPPORT for a process working set is embedded in each EPROCESS as the Vm member. A session working set is represented by an MMSUPPORT structure in the session’s MM_SESSION_SPACE (again as a member named Vm). Three system-wide working sets have MMSUPPORT structures in the kernel’s data section, as the internal variables that symbol files for the kernel used to name MmSystemCacheWs, MmPagedPoolWs and MmSystemPtesWs.

The 1607 release of Windows 10 discontinues the MMSUPPORT structure with exactly this name. The structure survives but is named MMSUPPORT_FULL and combines new MMSUPPORT_INSTANCE and MMSUPPORT_SHARED structures which each have a different selection of the old MMSUPPORT members.

Variability

As an internal structure with little, if any, visibility outside the kernel, the MMSUPPORT varies greatly between versions and even between builds. In the following table of sizes, different builds of the same version are distinguished as early and late because they are known to vary the structure even if they don’t change the size. These descriptions, as early and late, are then used throughout the article as a shorthand.

Layout

These sizes, and the names, offsets and types in the tables that follow, are from Microsoft’s symbol files for the kernel starting with Windows 2000 SP3.

Windows 7 and Higher

The MMSUPPORT varies enough between versions that it seems simpler to present its current form and then a separate history. Windows 7 is here taken as a convenient break. Much of the structure was reordered for Windows 7, both on a large scale and small. For instance, the first three members were at the very end of the structure when version 6.0 introduced them, but version 6.1 doesn’t move them as one block: it also swaps two of them. On the plus side for presentation, although there have since been insertions, deletions and changes of type (notably because support in 64-bit Windows 8.1 for more than 4G pages requires the widening of many members from 32 bits), those reorderings for Windows 7 were the last until the structure was split.

EX_PUSH_LOCK WorkingSetMutex;

LONG volatile WorkingSetLock;

KGATE *ExitGate;

KGATE *ExitOutswapGate;

PVOID AccessLog;

LIST_ENTRY WorkingSetExpansionLinks;

ULONG AgeDistribution [7];

ULONG_PTR AgeDistribution [7];

ULONG MinimumWorkingSetSize;

ULONG_PTR MinimumWorkingSetSize;

ULONG_PTR WorkingSetLeafSize;

ULONG_PTR WorkingSetLeafPrivateSize;

ULONG WorkingSetSize;

ULONG_PTR WorkingSetSize;

ULONG WorkingSetPrivateSize;

ULONG_PTR WorkingSetPrivateSize;

ULONG MaximumWorkingSetSize;

ULONG_PTR MaximumWorkingSetSize;

ULONG ChargedWslePages;

ULONG_PTR ChargedWslePages;

ULONG ActualWslePages;

ULONG_PTR ActualWslePages;

ULONG WorkingSetSizeOverhead;

ULONG_PTR WorkingSetSizeOverhead;

ULONG PeakWorkingSetSize;

ULONG_PTR PeakWorkingSetSize;

ULONG HardFaultCount;

USHORT PartitionId;

USHORT Pad0;

MMWSL *VmWorkingSetList;

USHORT NextPageColor;

USHORT LastTrimStamp;

ULONG PageFaultCount;

ULONG RepurposeCount;

ULONG TrimmedPageCount;

ULONG_PTR TrimmedPageCount;

ULONG Spare [1];

ULONG Spare [2];

ULONG Spare;

ULONG ForceTrimPages;

ULONG_PTR ForceTrimPages;

MMSUPPORT_FLAGS Flags;

ULONG_PTR ReleasedCommitDebt;

PVOID WsSwapSupport;

PVOID CommitReAcquireFailSupport;

Original

Very many of the members have an earlier history, often all the way back to version 3.10, but with such extensive reordering for version 6.1 that separate presentation is all but necessary. Versions 5.1 and 5.2 reorder MMSUPPORT members too, so that the following table necessarily lists some members twice.

For versions that predate the availability of type information in public symbol files, what’s known of Microsoft’s names and types is something of a guess. Where use of a member corresponds closely with that of a version for which Microsoft’s symbols are available, it seems reasonable to suppose continuity. Some use, however, has no correspondence, the code having changed too much. Even where the use hasn’t changed, tracking it down exhaustively would be difficult, if not impossible, even with source code.

LIST_ENTRY WorkingSetExpansionLinks;

LARGE_INTEGER LastTrimTime;

ULONG LastTrimFaultCount;

USHORT LastTrimStamp;

USHORT NextPageColor;

MMSUPPORT_FLAGS Flags;

ULONG PageFaultCount;

ULONG PeakWorkingSetSize;

ULONG WorkingSetSize;

ULONG GrowthSinceLastEstimate;

ULONG Spare0;

ULONG ChargedWslePages;

ULONG MinimumWorkingSetSize;

USHORT MinimumWorkingSetSize;

ULONG MinimumWorkingSetSize;

ULONG MaximumWorkingSetSize;

USHORT MaximumWorkingSetSize;

ULONG MaximumWorkingSetSize;

For the several members whose names tell of a size, the size is a count of pages. All are 32-bit counts, except that version 3.50 reduces the MinimumWorkingSetSize and MaximumWorkingSetSize to allow only 16 bits (but still counting pages). The reason is not known. The immediately adjacent change is the squeezing in of the VmWorkingSetList (next). This has the the merit of making no other rearrangement, but since the structure had otherwise unused alignment space at offset 0x2C, the new member could have been added without any rearrangement at all. More archaeology is required!

MMWSL *VmWorkingSetList;

LIST_ENTRY WorkingSetExpansionLinks;

UCHAR AllowWorkingSetAdjustment;

BOOLEAN AddressSpaceBeingDeleted;

UCHAR ForegroundSwitchCount;

UCHAR MemoryPriority;

union {
    ULONG LongFlags;
    MMSUPPORT_FLAGS Flags;
} u;

ULONG Claim;

ULONG Spare [1];

ULONG ActualWslePages;

ULONG NextEstimationSlot;

ULONG NextAgingSlot;

ULONG EstimatedAvailable;

ULONG GrowthSinceLastEstimate;

ULONG WorkingSetPrivateSize;

ULONG WorkingSetSizeOverhead;

ULONG WorkingSetSize;

KEVENT *ExitEvent;

KGATE *ExitGate;

KGUARDED_MUTEX WorkingSetMutex;

EX_PUSH_LOCK WorkingSetMutex;

PVOID AccessLog;