diff --git a/src/mame/audio/t5182.c b/src/mame/audio/t5182.c index 4b2e43d0c66..814b157bddc 100644 --- a/src/mame/audio/t5182.c +++ b/src/mame/audio/t5182.c @@ -1,6 +1,6 @@ /*************************************************************************** -Toshiba T5182 die map, by Jonathan Gevaryahu AKA Lord Nightmare, +Toshiba T5182 die map, by Jonathan Gevaryahu AKA Lord Nightmare, with assistance from Kevin Horton. T5182 supplied by Tomasz 'Dox' Slanina @@ -20,9 +20,22 @@ Subdie D is a 74245 bidirectional bus transciever Subdie E is a 74138 1 to 8 decoder/demultiplexer with active low outputs Subdie F is a 74138 1 to 8 decoder/demultiplexer with active low outputs Subdie G is a 7408 quad AND gate -Thanks to Kevin Horton for working out most of the logic gate types +Thanks to Kevin Horton for working out most of the logic gate types from the diagram. +The color coding in the diagram is simple: +* a pad with an outside connection to a t5182 edge pin is shown as red text with a red border, with that outside pin's number as its text +* a pad with no outside connection but a connection to an obvious internal component, is shown as green text with a green border, with that component's function as its text. (/EN is for the data line related 74245 'D', most of the rest are for the z80) +* pads connected to VCC +5V are shown in gold, with no text. The +5V input pins' numbers are red striped with gold +* pads connected to GND are shown in blue, with no text. The GND input pins' numbers are red striped with blue +* pads not directly connected but PULLED to +5v by one of the 5 internal resistors are shown in lemon yellow/greenish yellow, with text describing their function. (DIR on the 74245 is such a pad) +* pads which are internal, and have no immediately obvious function connected to (but still serve a purpose) are shown as red numbers with a green border. The numbering order was the order they were traced in. +* the two unbonded pins (/HALT and /RFSH) on the z80 are marked in dark blue on the die +* all the z80 pin functions are marked outside the z80 diespace in red. this was done to help trace the pins. +* note that /NMI is pulled high but is not listed in lemon yellow. This is because it connects to an external pin also. + +An updated version of Dox's t5182 pinout (originally from mustache.c) follows: + ______________________ _|* |_ GND |_|1 50|_| Vcc @@ -65,7 +78,7 @@ from the diagram. _| |_ Z80 /NMI |_|20 31|_| Z80 /BUSRQ Test pin _| |_ - Shorted to pin 22 |_|21 30|_| 74245 'A'+'B' DIR Test pin + Internal ROM /EN |_|21 30|_| 74245 'A'+'B' DIR Test pin _| |_ /EN 0x0000-0x1fff |_|22 29|_| Z80 /BUSAK Test pin _| |_ @@ -78,13 +91,13 @@ Z80 /IORQ Test pin |_|24 27|_| Z80 /RD Based on sketch made by Tormod Note: all pins marked as 'Test pin' are disabled internally and cannot be used without removing the chip cover and soldering together test pads. -Note: pins 21 and 22 are both shorted together, and go active (low) while the internal rom is being read. The internal rom can be disabled by pulling /IORQ or /MREQ low, - but both of those test pins are disabled, and also one would have to use the DIR test pin at the same time to feed the z80 a new internal rom (this is PROBABLY how - seibu prototyped the rom, they had an external rom connected to this enable, and the internal rom disabled somehow) This pin CAN however be used as an indicator as - to when the internal rom is being read, allowing one to snoop the address and data busses without fear of getting ram data as opposed to rom. +Note: pins 21 and 22 are both shorted together, and go active (low) while the internal rom is being read. The internal rom can be disabled by pulling /IORQ or /MREQ low, but both of those test pins are disabled, and also one would have to use the DIR test pin at the same time to feed the z80 a new internal rom (this is PROBABLY how seibu prototyped the rom, they had an external rom connected to this enable, and the internal rom disabled somehow) This pin CAN however be used as an indicator as to when the internal rom is being read, allowing one to snoop the address and data busses without fear of getting ram data as opposed to rom. + +UPDATE: after removing the t5182 from the board, I realized pins 21 and 22 were shorted together on the board itself, and not inside the chip! After figuring out the difference between the two, I realized this blows open a HUGE backdoor to allow the internal rom to be read via a trojan! Its relatively easy, through creative external manipulation, without EVER opening the chip, to have a trojan program run at 0x0000-0x1fff, internal ram at and map the INTERNAL ROM at location 0x4000-0x7fff! Just connect the internal rom /enable to pin 34 instead of pin 22, and use pin 22 for your external trojan rom /enable! + Z80 Memory Map: -0x0000-0x1FFF - Internal ROM, also external space 0 (which is effectively disabled) +0x0000-0x1FFF - external space 0 (connected to internal rom /enable outside the chip) 0x2000-0x3fff - Internal RAM, repeated/mirrored 4 times 0x4000-0x7fff - external space 1 (used for communication shared memory?) 0x8000-0xFFFF - external space 2 (used for sound rom)