Project Frankenstein: Volume XVI

DMA Controller & High-Speed Data Transfer

This volume provides the technical specification for the Direct Memory Access (DMA) controller within the Matsushita MN103S CPU of the GCC-4241N. Mastering DMA is essential for high-speed data movement between the SCSI bus, DRAM buffers, and internal SRAM without CPU overhead—critical for the 2,048-byte Xbox Security Sector response [cite: User Summary, 129_perfect_trampoline_v18.py, gcc_hitachi_flasher.c].

1. The DMA Hardware Profile

The MN103S utilizes a multi-channel DMA controller to offload bulk data transfers. In the context of the GCC-4241N, DMA channels are hardwired to the SCSI interface and the optical drive's main data path [cite: User Summary].

Theory: Direct Memory Access

DMA allows the hardware to move data blocks directly between memory VMAs (e.g., from SDRAM to the SCSI transceiver) [cite: User Summary]. This ensures the CPU remains free to process the SHA1/RC4 cryptographic handshakes while the response payload is physically streamed to the host [cite: Volume X: Crypto Engine Analysis].

2. DMA Register Map (MN103S Peripheral Space)

DMA operations are controlled via a set of registers typically located in the peripheral I/O space [cite: User Summary].

Register	Typical VMA Range	Function
`DMASx`	`0x9000C000`	Source Address: The VMA where the data transfer begins.
`DMADx`	`0x9000C004`	Destination Address: The VMA where the data is written.
`DMACx`	`0x9000C008`	Transfer Count: The number of bytes or words to move.
`DMAVx`	`0x9000C00C`	Control/Mode: Defines transfer direction, width (byte/word), and priority.

3. Practical Hybrid Use-Case: Security Sector Streaming

When the Xbox console requests Format Code 0xC0 via Read DVD Struct ($AD), the drive must return 2,048 bytes of security data [cite: 129_perfect_trampoline_v18.py]. Using the CPU for this would be inefficient [cite: User Summary].

DMA Implementation (Pseudo-Code)

void Execute_Security_Stream_DMA() {
    // 1. Point Source to the DRAM Security Mirror
    Set_DMA_Source(0x10C80040); // [cite: Project_Frankenstein_Vol_VI_Addendum.html]
    
    // 2. Point Destination to the SCSI Output Register
    Set_DMA_Destination(SCSI_DATA_OUT_REG);
    
    // 3. Set Count to 2048 Bytes
    Set_DMA_Count(2048);
    
    // 4. Trigger Transfer
    Start_DMA_Transfer(MODE_AUTO_INCREMENT | PRIORITY_HIGH);
}

4. DMA & Flash Finalization

During the Windows Flashing Routine, the drive's internal bootloader uses DMA to move incoming 2048-byte firmware chunks from the SCSI buffer into the flash programming registers [cite: gcc_hitachi_flasher.c].

Critical Alignment Requirement

DMA transfers in the MN103S often require the Source and Destination addresses to be word-aligned (4-byte boundaries). Our RAM Cave at 0x4000807A is offset by 2 bytes from a word boundary (0x40008078 + 2), so any DMA movement out of the cave must use byte-mode transfers to avoid bus errors [cite: 129_perfect_trampoline_v18.py].