The 3D version shows a single flat grid of physical pages a peripheral's DMA request either reaches or doesn't. This 2D companion instead simulates the actual translation mechanism real IOMMUs (Intel VT-d / AMD-Vi) use: a two-level page-table walk backed by a small TLB (translation lookaside buffer), so the device's own IOVA (I/O virtual address) space is a separate line from physical memory, joined only by translation.
va (10 bit) → L1 index = va >> 5 (32 entries)
L0 index = va & 31 (32 entries per L1 table)
present(va) ⇔ va ∈ [win_start, win_start + win_size) (OS-programmed)
phys(va) = safe_base + (va − win_start), safe_base chosen away
from kernel/secret pages by the OS, never inside them
TLB: cached translations, size C, LRU-evicted.
hit → 1 cycle (skips the walk entirely)
miss → 4 cycles (root fetch + L1 fetch + L0 fetch + finish)
not present → walk still needed to discover the fault, then blocked
Because a trusted peripheral only ever addresses its own small mapped window, the same handful of pages recur constantly — exactly the locality of reference a TLB is built to exploit. A malicious device scanning the full 1024-page IOVA space has almost no locality, so nearly every request misses the TLB and most miss the page table too (not present ⇒ blocked). A verified simulation of this exact algorithm (500,000 requests) measured a TLB hit rate of ~25% for a trusted device (window = 32, TLB = 8 — matching the C/W≈0.25 locality prediction) against ~0.8% for a scanning malicious device (matching C/N≈0.008) — a 32× difference driven purely by access pattern, with average translation latency dropping from ~4.0 to ~3.25 cycles as the hit rate rises.
- IOMMU toggle — off means every request bypasses translation entirely: device address = physical address, unchecked, so a malicious device scanning IOVA space directly indexes physical RAM, kernel pages included.
- Device: Trusted / Malicious — trusted stays inside its assigned window (high TLB locality); malicious samples uniformly across the whole IOVA space (near-zero locality, mostly blocked when IOMMU is on).
- DMA buffer window — the OS-mapped region; wider windows still keep pages away from kernel/secret memory, but shrink the TLB's relative coverage (lower hit rate for the same TLB size).
- TLB size — more cached translations directly raise the hit rate for a localized (trusted) stream; a scanning device barely benefits at all, since it revisits pages far less often than the cache can hold onto them.
Real-world relevance: this is the same architecture Windows' Kernel DMA Protection and macOS's Thunderbolt access controls rely on — an IOMMU walk gates every DMA request, and only a request that lands inside an OS-approved window ever resolves to a physical address at all.