# US 11,030,112 B2 · Enhanced address space layout randomization

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,030,112 B2
- Document ID: US11030112B2
- Status: Granted
- Kind: B2
- Application number: 15/989,972
- Filed: 2018-05-25
- Published: 2019-11-28
- Granted: 2021-06-08
- Earliest claimed: 2018-05-25
- Assignees: Red Hat, Inc.
- Applicants: Red Hat, Inc.
- Inventors: Michael Tsirkin
- Web page: https://patentgrep.com/patent/US11030112B2

## CPC

- G06F 12/1009: using page tables, e.g. page table structures
- G06F 12/1027: using associative or pseudo-associative address translation means, e.g. translation look-aside buffer [TLB]
- G06F 12/1036: for multiple virtual address spaces, e.g. segmentation (G06F12/1045 takes precedence)
- G06F 12/1441: {for a range}
- G06F 12/1491: {in a hierarchical protection system, e.g. privilege levels, memory rings}
- G06F 2212/1008: Correctness of operation, e.g. memory ordering
- G06F 2212/1024: Latency reduction
- G06F 2212/1052: Security improvement
- G06F 2212/151: Emulated environment, e.g. virtual machine
- G06F 2212/657: Virtual address space management
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Enhanced address space layout randomization is disclosed. For example, a memory includes first and second memory addresses of a plurality of memory addresses, where at least one of the plurality of memory addresses is a decoy address. A memory manager executes on a processors to generate a page table associated with the memory, which includes a plurality of page table entries. Each page table entry in the plurality of page table entries is flagged as in a valid state. The page table is instantiated with first and second page table entries of the plurality of page table entries associated with the first and second memory addresses respectively. A plurality of unused page table entries of the plurality of page table entries, including a decoy page table entry, is associated with a decoy address.

## Claims

### Claim 1

A system comprising:
a memory including a first memory address and a second memory address of a plurality of memory addresses, wherein at least one of the plurality of memory addresses is a decoy address; and
a memory manager on one or more processors executing to:
generate a page table associated with the memory, wherein the page table includes a plurality of page table entries;
flag each page table entry in the plurality of page table entries as in a valid state;
instantiate the page table with a first page table entry and a second page table entry of the plurality of page table entries associated with the first memory address and the second memory address respectively such that the first memory address and the second memory address are allocated;
flag the first memory address's and the second memory address's access rights as accessible;
associate a plurality of unused page table entries of the plurality of page table entries, including a decoy page table entry, with the decoy address;
write first data to the first memory address; and
after writing the first data to the first memory address, and while the first page table entry remains flagged as valid and also remains flagged as accessible;
deallocate the first memory address; and
update the first page table entry to reference the decoy address such that an access timing of the decoy address is the same as an access timing of the second memory address, wherein the decoy address comprises an address that returns a page fault.

### Claim 2 (depends on 1)

The system of claim 1, wherein the second page table entry references kernel space data, and the first memory address is non-contiguous with the second memory address.

### Claim 3 (depends on 2)

The system of claim 2, wherein the second page table entry is subsequently unassociated with the second memory address and associated to the decoy address.

### Claim 4 (depends on 1)

The system of claim 1, wherein a first virtual memory address is randomly selected and the first virtual memory address is associated with the first page table entry and with the first memory address, and wherein upon reinitialization of the page table, the first page table entry is associated with a different second virtual memory address.

### Claim 5 (depends on 1)

The system of claim 1, wherein the plurality of page table entries is generated based on a request to allocate a virtual memory address.

### Claim 6 (depends on 1)

The system of claim 1, wherein accessing an unused page table entry referencing the decoy address triggers an error and access to the decoy address is protected from at least one of read access, write access, execute access, and unprivileged access.

### Claim 7 (depends on 1)

The system of claim 1, wherein both the first memory address and the decoy address are cached in a translation cache and a first time elapsed accessing the first page table entry and a second time elapsed accessing an unused page table entry are both within a cache return time frame.

### Claim 8

A method comprising:
generating a page table associated with a memory, wherein the page table includes a plurality of page table entries;
flagging each page table entry in the plurality of page table entries as in a valid state;
instantiating the page table with a first page table entry and a second page table entry of the plurality of page table entries associated with a first memory address of a plurality of memory addresses and a second memory address of the plurality of memory addresses respectively such that the first memory address and the second memory address are allocated;
flagging the first memory address's and the second memory address's access rights as accessible;
associating a plurality of unused page table entries of the plurality of page table entries, including a decoy page table entry, to a decoy address of the plurality of memory addresses;
writing first data to the first memory address; and
after writing the first data to the first memory address, and while the first page table entry remains flagged as valid and also remains flagged as accessible:
deallocating the first memory address; and
updating the first page table entry to reference the decoy address such that an access timing of the decoy address is the same as an access timing of the second memory address, wherein the decoy address comprises an address that returns a page fault.

### Claim 9 (depends on 8)

The method of claim 8, further comprising:
associating the second page table entry to the decoy address.

### Claim 10 (depends on 8)

The method of claim 8, wherein a first virtual memory address is randomly selected and the first virtual memory address is associated with the first page table entry and with the first memory address, the method further comprising:
reinitializing the page table; and
associating the first page table entry with a different second virtual memory address.

### Claim 11 (depends on 8)

The method of claim 8, further comprising:
triggering an error based on accessing one of an unused page table entry and the decoy page table entry.

### Claim 12 (depends on 8)

The method of claim 8, wherein both the first memory address and the decoy address are cached in a translation cache and a first time elapsed accessing the first page table entry and a second time elapsed accessing an unused page table entry are both within a cache return time frame.

### Claim 13

A system comprising:
a memory including a plurality of memory addresses, wherein at least one of the plurality of memory addresses is a decoy address;
a page table including a plurality of page table entries, wherein each page table entry in the page table is flagged as valid and each page table entry is associated with a memory address of the plurality of memory addresses;
a memory manager on one or more processors executing to:
create a first page table entry of the plurality of page table entries referencing a first memory address of the plurality of memory addresses such that the first memory address is allocated;
flag the first memory address's access rights as accessible;
write first data to the first memory address, and after writing the first data to the first memory address, and while the first page table entry remains flagged as valid and also remains flagged as accessible:
receive a command to delete the first data;
deallocate the first memory address;
update the first page table entry to reference the decoy address of the plurality of memory addresses such that an access timing of the decoy address is the same as an access timing of a second memory address, wherein the decoy address comprises an address that returns a page fault;
receive a request to access the first page table entry; and
respond to the request with a rejection.

### Claim 14 (depends on 13)

The system of claim 13, wherein the first page table entry references kernel space data, a second page table entry of the plurality of page table entries references user space data, and accessing the first page table entry from a user space generates an error.

### Claim 15 (depends on 13)

The system of claim 13, wherein each page table entry of the plurality of page table entries is associated with one of a respective data address and a respective decoy address.

### Claim 16 (depends on 13)

The system of claim 13, wherein a first virtual memory address is randomly selected, the first virtual memory address is associated with the first page table entry and with the first memory address, and a second virtual memory address associated with a second page table entry of the plurality of page table entries is non-contiguous with the first virtual memory address.

### Claim 17 (depends on 13)

The system of claim 13, wherein accessing an unused page table entry referencing the decoy address triggers an error.

### Claim 18 (depends on 13)

The system of claim 13, wherein access to the decoy address is protected by access credentials controlling at least one of read access, write access, execute access, and unprivileged access.

### Claim 19 (depends on 13)

The system of claim 13, wherein both the first memory address and the decoy address are cached in a translation cache, and wherein the decoy address is permanently cached in the translation cache.

### Claim 20 (depends on 13)

The system of claim 13, wherein a first time elapsed accessing the first page table entry and a second time elapsed accessing an unused page table entry are both within a cache return time frame.