Home▸Cybersecurity▸DMA Attack Surface 2D: Page-Table Walk & TLB Locality

DMA Attack Surface 2D: Page-Table Walk & TLB Locality

Interactive 2D model of IOMMU address translation: a real two-level page-table walk plus an LRU TLB cache show why a trusted peripheral's local DMA traffic hits the TLB far more often than a malicious device scanning the full address space, and why disabling the IOMMU bypasses translation entirely.

Cybersecurity2DAdvanced60 FPS📱 Mobile-adapted⇄ 3D version

This 2D companion to the 3D DMA/IOMMU simulator keeps the same Thunderbolt attack-surface story but models the translation mechanism itself: a real two-level page-table walk (L1 index from bits 5-9, L0 index from bits 0-4 of a 10-bit device address) backed by a small LRU-managed TLB. A trusted peripheral's requests stay inside its narrow mapped window and build up strong TLB locality; a malicious device scanning the full address space gets almost no cache benefit and, whenever the IOMMU is on, is blocked outright unless it happens to land inside the mapped window. Toggle the IOMMU, switch device behavior, and resize the DMA window or the TLB itself to watch the hit-rate, table-walk count and translation latency respond in real time — turn the IOMMU off and watch a scanning device reach kernel and secret physical pages directly, with no translation at all.

⚙ Under the hood

Watch a real two-level IOMMU page-table walk and an LRU TLB cache resolve a peripheral's DMA requests: a trusted device's local traffic builds strong TLB locality while a malicious device scanning the full address space gets blocked almost every time — turn the IOMMU off and watch it reach kernel and secret memory directly instead.

cybersecuritydmaiommutlbpage-tablekernel-protection

2D · HTML5 Canvas 2D · 60 FPS target · runs fully client-side, no install