1 // license:BSD-3-Clause
2 // copyright-holders:Jonathan Gevaryahu
3 /***************************************************************************
4
5 Toshiba T5182 die map, by Jonathan Gevaryahu AKA Lord Nightmare,
6 with assistance from Kevin Horton.
7 T5182 supplied by Tomasz 'Dox' Slanina which came from a Dark Mist PCB bought by Guru
8
9 Die Diagram:
10 |------------------------|
11 \ ROM RAM Z80 A |
12 / B C D E F G |
13 |------------------------|
14
15 The ROM is a 23128 wired as a 2364 by tying a13 to /ce
16 The RAM is a 2016
17 The Z80 is an NMOS Z80
18 Subdie A is a 7408 quad AND gate
19 Subdie B is a 74245 bidirectional bus transciever
20 Subdie C is a 74245 bidirectional bus transciever
21 Subdie D is a 74245 bidirectional bus transciever
22 Subdie E is a 74138 1 to 8 decoder/demultiplexer with active low outputs
23 Subdie F is a 74138 1 to 8 decoder/demultiplexer with active low outputs
24 Subdie G is a 7408 quad AND gate
25 Thanks to Kevin Horton for working out most of the logic gate types
26 from the diagram.
27
28
29 An updated version of Dox's t5182 pinout (originally from mustache.c) follows:
30
31 ______________________
32 _|* |_
33 GND |_|1 50|_| Vcc
34 _| |_
35 A8 |_|2 49|_| A7
36 _| |_
37 A9 |_|3 48|_| A6
38 _| |_
39 A10 |_|4 47|_| A5
40 _| |_
41 A11 |_|5 46|_| A4
42 _| TOSHIBA |_
43 A12 |_|6 T5182 45|_| A3
44 _| |_
45 A13 |_|7 44|_| A2
46 _| JAPAN 8612 |_
47 A14 |_|8 43|_| A1
48 _| |_
49 A15 |_|9 42|_| A0
50 _| |_
51 D4 |_|10 41|_| D3
52 _| |_
53 D5 |_|11 40|_| D2
54 _| |_
55 D6 |_|12 39|_| D1
56 _| |_
57 D7 |_|13 38|_| D0
58 _| |_
59 I/O /EN 2 |_|14 37|_| I/O /EN 1
60 _| |_
61 I/O /EN 3 |_|15 36|_| I/O /EN 0
62 _| |_
63 I/O /EN 4 |_|16 35|_| /EN 0x8000-0xFFFF
64 _| |_
65 I/O /EN 5 |_|17 34|_| /EN 0x4000-0x7FFF
66 _| |_
67 Z80 phi clock in |_|18 33|_| N/C
68 _| |_
69 Z80 /INT |_|19 32|_| Z80 /RESET
70 _| |_
71 Z80 /NMI |_|20 31|_| Z80 /BUSRQ Test pin
72 _| |_
73 Internal ROM /EN |_|21 30|_| 74245 'A'+'B' DIR Test pin
74 _| |_
75 /EN 0x0000-0x1fff |_|22 29|_| Z80 /BUSAK Test pin
76 _| |_
77 Z80 /MREQ Test pin |_|23 28|_| Z80 /WR
78 _| |_
79 Z80 /IORQ Test pin |_|24 27|_| Z80 /RD
80 _| |_
81 GND |_|25 26|_| Vcc
82 |______________________|
83
84 Based on sketch made by Tormod
85
86 Note: all pins marked as 'Test pin' are disabled internally and cannot be used
87 without removing the chip cover and soldering together test pads.
88 Note: pins 21 and 22 are both shorted together on the pcb, and go active (low)
89 while the internal rom is being read. The internal rom can be disabled by
90 pulling /IORQ or /MREQ low, but both of those test pins are disabled, and
91 also one would have to use the DIR test pin at the same time to feed the
92 z80 a new internal rom. This is PROBABLY how Toshiba intended the t5182
93 to be prototyped: a special t5182 with the internal jumpers all connected
94 (except for the one between pins 21 and 22) would be given to a company
95 who wanted to prototype the internal rom, allowing an external rom to be
96 used instead of the internal one by using the test pins.
97
98 However, the fact that pins 21 and 22 were NOT internally connected
99 together by Toshiba on the *production* seibu t5182 means a huge
100 security hole is opened:
101
102 It is trivial, through external connections, without EVER opening the
103 chip, to connect pin 22 to a trojan rom /CE and hence have a user trojan
104 program run at 0x0000-0x1fff. Then, connect pin 21 to pin 34 to map the
105 internal rom at 0x4000-0x7fff so it can be serially bit-banged out, or,
106 even more easily, copied to an nvram chip attached to pin 35. Only 11
107 bytes of code in the trojan rom are needed to do this.
108
109 There is no internal protection in the chip at all which prevents the
110 internal rom from being connected to an enable other than pin 22, which
111 would have prevented this theoretical attack from working
112
113
114 Z80 Memory Map:
115 0x0000-0x1FFF - external space 0 (connected to internal rom /enable outside the
116 chip)
117 0x2000-0x3fff - Internal RAM, repeated/mirrored 4 times
118 0x4000-0x7fff - external space 1 (used for communication shared memory?)
119 0x8000-0xFFFF - external space 2 (used for sound rom)
120
121 I/O map:
122 FEDCBA9876543210
123 xxxxxxxxx000xxxx i/o /EN 0 goes low
124 xxxxxxxxx001xxxx i/o /EN 1 goes low
125 xxxxxxxxx010xxxx i/o /EN 2 goes low
126 xxxxxxxxx011xxxx i/o /EN 3 goes low
127 xxxxxxxxx100xxxx i/o /EN 4 goes low
128 xxxxxxxxx101xxxx i/o /EN 5 goes low
129 xxxxxxxxx110xxxx i/o /EN 6\__ these two are unbonded pins, so are useless.
130 xxxxxxxxx111xxxx i/o /EN 7/
131
132 IMPORTANT: the data lines for the external rom on darkmist are scrambled on the
133 SEI8608B board as such:
134 CPU: ROM:
135 D0 D0
136 D1 D6
137 D2 D5
138 D3 D4
139 D4 D3
140 D5 D2
141 D6 D1
142 D7 D7
143 Only the data lines are scrambled, the address lines are not.
144 These lines are NOT scrambled to the ym2151 or anything else, just the external
145 rom.
146
147 ***************************************************************************/
148
149 #include "emu.h"
150 #include "t5182.h"
151
152 #define T5182_CLOCK XTAL(14'318'181)/4
153
154 DEFINE_DEVICE_TYPE(T5182, t5182_device, "t5182", "T5182 MCU")
155
t5182_device(const machine_config & mconfig,const char * tag,device_t * owner,uint32_t clock)156 t5182_device::t5182_device(const machine_config &mconfig, const char *tag, device_t *owner, uint32_t clock)
157 : device_t(mconfig, T5182, tag, owner, clock),
158 m_ourcpu(*this, "t5182_z80"),
159 m_sharedram(*this, "sharedram"),
160 m_irqstate(0),
161 m_semaphore_main(0),
162 m_semaphore_snd(0)
163 {
164 }
165
166
167 //-------------------------------------------------
168 // device_start - device-specific startup
169 //-------------------------------------------------
170
device_start()171 void t5182_device::device_start()
172 {
173 m_setirq_cb = timer_alloc(SETIRQ_CB);
174
175 save_item(NAME(m_irqstate));
176 save_item(NAME(m_semaphore_main));
177 save_item(NAME(m_semaphore_snd));
178 }
179
sharedram_r(offs_t offset)180 uint8_t t5182_device::sharedram_r(offs_t offset)
181 {
182 return m_sharedram[offset];
183 }
184
sharedram_w(offs_t offset,uint8_t data)185 void t5182_device::sharedram_w(offs_t offset, uint8_t data)
186 {
187 m_sharedram[offset] = data;
188 }
189
TIMER_CALLBACK_MEMBER(t5182_device::setirq_callback)190 TIMER_CALLBACK_MEMBER( t5182_device::setirq_callback )
191 {
192 switch(param)
193 {
194 case YM2151_ASSERT:
195 m_irqstate |= 1|4;
196 break;
197
198 case YM2151_CLEAR:
199 m_irqstate &= ~1;
200 break;
201
202 case YM2151_ACK:
203 m_irqstate &= ~4;
204 break;
205
206 case CPU_ASSERT:
207 m_irqstate |= 2; // also used by t5182_sharedram_semaphore_main_r
208 break;
209
210 case CPU_CLEAR:
211 m_irqstate &= ~2;
212 break;
213 }
214
215 if (m_ourcpu == nullptr)
216 return;
217
218 if (m_irqstate == 0) /* no IRQs pending */
219 m_ourcpu->set_input_line(0,CLEAR_LINE);
220 else /* IRQ pending */
221 m_ourcpu->set_input_line(0,ASSERT_LINE);
222 }
223
device_timer(emu_timer & timer,device_timer_id id,int param,void * ptr)224 void t5182_device::device_timer(emu_timer &timer, device_timer_id id, int param, void *ptr)
225 {
226 switch (id)
227 {
228 case SETIRQ_CB:
229 setirq_callback(ptr, param);
230 break;
231 default:
232 throw emu_fatalerror("Unknown id in t5182_device::device_timer");
233 }
234 }
235
sound_irq_w(uint8_t data)236 void t5182_device::sound_irq_w(uint8_t data)
237 {
238 synchronize(SETIRQ_CB, CPU_ASSERT);
239 }
240
ym2151_irq_ack_w(uint8_t data)241 void t5182_device::ym2151_irq_ack_w(uint8_t data)
242 {
243 synchronize(SETIRQ_CB, YM2151_ACK);
244 }
245
cpu_irq_ack_w(uint8_t data)246 void t5182_device::cpu_irq_ack_w(uint8_t data)
247 {
248 synchronize(SETIRQ_CB, CPU_CLEAR);
249 }
250
WRITE_LINE_MEMBER(t5182_device::ym2151_irq_handler)251 WRITE_LINE_MEMBER(t5182_device::ym2151_irq_handler)
252 {
253 if (state)
254 synchronize(SETIRQ_CB, YM2151_ASSERT);
255 else
256 synchronize(SETIRQ_CB, YM2151_CLEAR);
257 }
258
sharedram_semaphore_snd_r()259 uint8_t t5182_device::sharedram_semaphore_snd_r()
260 {
261 return m_semaphore_snd;
262 }
263
sharedram_semaphore_main_acquire_w(uint8_t data)264 void t5182_device::sharedram_semaphore_main_acquire_w(uint8_t data)
265 {
266 m_semaphore_main = 1;
267 }
268
sharedram_semaphore_main_release_w(uint8_t data)269 void t5182_device::sharedram_semaphore_main_release_w(uint8_t data)
270 {
271 m_semaphore_main = 0;
272 }
273
sharedram_semaphore_snd_acquire_w(uint8_t data)274 void t5182_device::sharedram_semaphore_snd_acquire_w(uint8_t data)
275 {
276 m_semaphore_snd = 1;
277 }
278
sharedram_semaphore_snd_release_w(uint8_t data)279 void t5182_device::sharedram_semaphore_snd_release_w(uint8_t data)
280 {
281 m_semaphore_snd = 0;
282 }
283
sharedram_semaphore_main_r()284 uint8_t t5182_device::sharedram_semaphore_main_r()
285 {
286 return m_semaphore_main | (m_irqstate & 2);
287 }
288
289 // ROM definition for the Toshiba T5182 Custom CPU internal program ROM
290 ROM_START( t5182 )
291 ROM_REGION( 0x2000, "cpu", 0 )
CRC(d354c8fc)292 ROM_LOAD( "t5182.rom", 0x0000, 0x2000, CRC(d354c8fc) SHA1(a1c9e1ac293f107f69cc5788cf6abc3db1646e33) )
293 ROM_END
294
295 //-------------------------------------------------
296 // rom_region - return a pointer to the device's
297 // internal ROM region
298 //-------------------------------------------------
299 const tiny_rom_entry *t5182_device::device_rom_region() const
300 {
301 return ROM_NAME( t5182 );
302 }
303
304 INPUT_PORTS_START(t5182)
305 PORT_START("T5182_COIN")
306 PORT_BIT( 0x01, IP_ACTIVE_HIGH, IPT_COIN1 ) PORT_IMPULSE(2)
307 PORT_BIT( 0x02, IP_ACTIVE_HIGH, IPT_COIN2 ) PORT_IMPULSE(2)
308 INPUT_PORTS_END
309
310 //-------------------------------------------------
311 // input_ports - return a pointer to the implicit
312 // input ports description for this device
313 //-------------------------------------------------
314
device_input_ports() const315 ioport_constructor t5182_device::device_input_ports() const
316 {
317 return INPUT_PORTS_NAME(t5182);
318 }
319
320
321 // 4000-407F RAM shared with main CPU
322 // 4000 output queue length
323 // 4001-4020 output queue
324 // answers:
325 // 80XX finished playing sound XX
326 // A0XX short contact on coin slot XX (coin error)
327 // A1XX inserted coin in slot XX
328 // 4021 input queue length
329 // 4022-4041 input queue
330 // commands:
331 // 80XX play sound XX
332 // 81XX stop sound XX
333 // 82XX stop all voices associated with timer A/B/both where XX = 01/02/03
334 // 84XX play sound XX if it isn't already playing
335 // 90XX reset
336 // A0XX
337 // rest unused
t5182_map(address_map & map)338 void t5182_device::t5182_map(address_map &map)
339 {
340 map(0x0000, 0x1fff).rom().region("cpu", 0); // internal ROM
341 map(0x2000, 0x27ff).ram().mirror(0x1800); // internal RAM
342 map(0x4000, 0x40ff).ram().mirror(0x3F00).share("sharedram"); // 2016 with four 74ls245s, one each for main and t5182 address and data. pins 23, 22, 20, 19, 18 are all tied low so only 256 bytes are usable
343 map(0x8000, 0xffff).rom().region(":t5182_z80", 0); // external ROM
344 }
345
346
347 // 00 W YM2151 address
348 // 01 RW YM2151 data
349 // 10 W semaphore for shared RAM: set as in use
350 // 11 W semaphore for shared RAM: set as not in use
351 // 12 W clear IRQ from YM2151
352 // 13 W clear IRQ from main CPU
353 // 20 R flags bit 0 = main CPU is accessing shared RAM???? bit 1 = main CPU generated IRQ
354 // 30 R coin inputs (bits 0 and 1, active high)
355 // 40 W external ROM banking? (the only 0 bit enables a ROM)
356 // 50 W test mode status flags (bit 0 = ROM test fail, bit 1 = RAM test fail, bit 2 = YM2151 IRQ not received)
t5182_io(address_map & map)357 void t5182_device::t5182_io(address_map &map)
358 {
359 map.global_mask(0xff);
360 map(0x00, 0x01).rw(":ymsnd", FUNC(ym2151_device::read), FUNC(ym2151_device::write));
361 map(0x10, 0x10).w(FUNC(t5182_device::sharedram_semaphore_snd_acquire_w));
362 map(0x11, 0x11).w(FUNC(t5182_device::sharedram_semaphore_snd_release_w));
363 map(0x12, 0x12).w(FUNC(t5182_device::ym2151_irq_ack_w));
364 map(0x13, 0x13).w(FUNC(t5182_device::cpu_irq_ack_w));
365 map(0x20, 0x20).r(FUNC(t5182_device::sharedram_semaphore_main_r));
366 map(0x30, 0x30).portr("T5182_COIN");
367 }
368
369
370 //-------------------------------------------------
371 // device_add_mconfig - add device configuration
372 //-------------------------------------------------
373
device_add_mconfig(machine_config & config)374 void t5182_device::device_add_mconfig(machine_config &config)
375 {
376 Z80(config, m_ourcpu, T5182_CLOCK);
377 m_ourcpu->set_addrmap(AS_PROGRAM, &t5182_device::t5182_map);
378 m_ourcpu->set_addrmap(AS_IO, &t5182_device::t5182_io);
379 }
380