Geoff Chappell - Software Analyst
Windows has since ancient times had different types of something named a Working Set which helps with efficient management of virtual address space. The Working Set that is known best to programmers is the one that is maintained for each process. It’s modelled by an MMSUPPORT structure that is embedded in the process’s EPROCESS as its Vm member. But even version 3.10 has a separate Working Set for the system cache: its MMSUPPORT is an internal kernel variable named MmSystemCacheWs. Distinguishing this particular MMSUPPORT from any for a process was easy enough just from its having a known address (in the kernel).
Complications began with Windows 2000 and its introduction of sessions. Each session has its own Working Set, also modelled by an MMSUPPORT but now embedded in the session’s MM_SESSION_SPACE (again as its Vm member). So that kernel code can quickly distinguish whether an MMSUPPORT is for a process or a session, the MMSUPPORT was given a bit flag named SessionSpace. Opportunity was taken to organise this and some other boolean properties into the MMSUPPORT_FLAGS structure, which has since acquired many more defined bits, including by absorbing old members of the MMSUPPORT.
When Windows 7 added two more Working Sets as internal variables—MmPagedPoolWs and MmSystemPtesWs—the time perhaps had come for a formal enumeration of these Working Sets as different types. Thus did the MMSUPPORT_FLAGS gain a 3-bit WorkingSetType member. Its values are drawn from the WORKING_SET_TYPE enumeration (formally _WORKING_SET_TYPE).
Microsoft’s names for the enumeration and its defined values are all known from public symbol files for the applicable versions:
| Value | Symbol | Versions |
|---|---|---|
| 0 | WorkingSetTypeUser | 6.1 and higher |
| 1 | WorkingSetTypeSession | 6.1 and higher |
| 2 | WorkingSetTypeSystemTypes WorkingSetTypeSystemCache |
6.1 and higher |
| 3 | WorkingSetTypePagedPool | 6.1 and higher |
| 4 | WorkingSetTypeSystemViews WorkingSetTypePagableMaximum |
1803 and higher |
| 4 (6.1 to 1709); 5 |
WorkingSetTypeSystemPtes | 6.1 and higher |
| 6 | WorkingSetTypeKernelStacks | 1803 and higher |
| 7 | WorkingSetTypeNonPagedPool | 1803 and higher |
| 5 (6.1 to 1709); 8 |
WorkingSetTypeMaximum | 6.1 and higher |