# Project Frankenstein: Volume XVI

## DMA Controller & High-Speed Data Transfer

This volume provides the technical specification for the Direct Memory Access (DMA) controller within the Matsushita MN103S CPU of the GCC-4241N. Mastering DMA is essential for high-speed data movement between the SCSI bus, DRAM buffers, and internal SRAM without CPU overhead—critical for the 2,048-byte Xbox Security Sector response [cite: User Summary, 129_perfect_trampoline_v18.py, gcc_hitachi_flasher.c].

## 1. The DMA Hardware Profile

The MN103S utilizes a multi-channel DMA controller to offload bulk data transfers. In the context of the GCC-4241N, DMA channels are hardwired to the SCSI interface and the optical drive's main data path [cite: User Summary].

### Theory: Direct Memory Access

DMA allows the hardware to move data blocks directly between memory VMAs (e.g., from SDRAM to the SCSI transceiver) [cite: User Summary]. This ensures the CPU remains free to process the SHA1/RC4 cryptographic handshakes while the response payload is physically streamed to the host [cite: Volume X: Crypto Engine Analysis].

## 2. DMA Register Map (MN103S Peripheral Space)

DMA operations are controlled via a set of registers typically located in the peripheral I/O space [cite: User Summary].

Register | Typical VMA Range | Function
--- | --- | ---
`DMASx` | `0x9000C000` | Source Address: The VMA where the data transfer begins.
`DMADx` | `0x9000C004` | Destination Address: The VMA where the data is written.
`DMACx` | `0x9000C008` | Transfer Count: The number of bytes or words to move.
`DMAVx` | `0x9000C00C` | Control/Mode: Defines transfer direction, width (byte/word), and priority.

## 3. Practical Hybrid Use-Case: Security Sector Streaming

When the Xbox console requests Format Code `0xC0` via Read DVD Struct ($AD), the drive must return 2,048 bytes of security data [cite: 129_perfect_trampoline_v18.py]. Using the CPU for this would be inefficient [cite: User Summary].

### DMA Implementation (Pseudo-Code)

    void Execute_Security_Stream_DMA() {
        // 1. Point Source to the DRAM Security Mirror
        Set_DMA_Source(0x10C80040); // [cite: Project_Frankenstein_Vol_VI_Addendum.html]

        // 2. Point Destination to the SCSI Output Register
        Set_DMA_Destination(SCSI_DATA_OUT_REG);

        // 3. Set Count to 2048 Bytes
        Set_DMA_Count(2048);

        // 4. Trigger Transfer
        Start_DMA_Transfer(MODE_AUTO_INCREMENT | PRIORITY_HIGH);
    }

## 4. DMA & Flash Finalization

During the Windows Flashing Routine, the drive's internal bootloader uses DMA to move incoming 2048-byte firmware chunks from the SCSI buffer into the flash programming registers [cite: gcc_hitachi_flasher.c].

### Critical Alignment Requirement

DMA transfers in the MN103S often require the Source and Destination addresses to be word-aligned (4-byte boundaries). Our RAM Cave at `0x4000807A` is offset by 2 bytes from a word boundary (`0x40008078 + 2`), so any DMA movement out of the cave must use byte-mode transfers to avoid bus errors [cite: 129_perfect_trampoline_v18.py].