Compiled from many sources including Linux and NetBSD kernel source, Guide to the Macintosh Family Hardware 1st and 2nd editions, Designing Cards and Drivers for the Macintosh Family 3rd edition, Apple hardware notes (archive), even more Apple hardware notes, and good old fashioned reverse-engineering.

This concentrates mostly on Mac II and later machines since the Plus/SE/Classic are fairly well understood. Please contact messdrivers [at] gmail [dot] com if you have any further information on any Mac models.

On most Mac II and later machines, it's like this:

• 0x00000000-0x3fffffff = RAM
• 0x40000000-0x4fffffff = ROM
• 0x50000000-0x5fffffff = I/O
• 0x60000000-0xefffffff = NuBus “super slot” space
• 0xf1000000-0xffffffff = NuBus “standard slot” space

• 0xfe000000 = VRAM (SE/30 only)
• 0xfeff0000 = VROM (SE/30) (note that while the main ROM has a valid driver at the end, SE/30 has a separate 64 kbit VROM on the board which I dumped. The actual driver is very small, it contains mostly hardware credits for the SE/30)

Note that Macs with on board video except for the SE/30 typically contain one or more valid video drivers in ROM; the correct one is used when the machine type is identified.

I/O devices are given as offsets from 0x50000000. Each device is mapped across 0x2000 bytes unless noted otherwise.

• VIA1 at offset 0. May also be mirrored at 0x20000 and 0x40000.
• VIA2 at offset 0x2000 on II, IIx, IIcx, and SE/30
• SCC (Z8530) at offset 0x4000
• SCSI (pseudo-DMA w/DRQ on II, handshake on SE/30) at offset 0x6000
• SCSI (normal) at 0x10000
• SCSI (pseudo-DMA, no DRQ) at offset 0x12000
• ASC (Apple Sound Chip) at 0x14000
• IWM/SWIM (floppy) at 0x16000

• VDAC (palette) at 0x24000 (IIci, IIsi, LC series, Color Classic)
• RBV/V8/etc registers (partially emulates VIA2, also video registers) at 0x26000 (IIci & IIsi, LC series, Color Classic)
• RBV VRAM at 0x1000000 (IIci)

The entire I/O space mirrors every 0x20000 on Mac II, IIx, IIcx, and SE/30. IIsi and IIfx mirror every 0x40000. IIci and Color Classic (and LC series?) do not mirror. The ROMs use this mirroring behavior along with other markers to determine the model they're running on.

The bottom 8k or so of RAM contains significant system data on these Macs. See Low Memory Globals and Mac Almanac for lists. Note that on the IIci/IIsi the video frame buffer is at physical address 0; the 68030 MMU is used to remap addresses so software sees address 0 elsewhere and thus the low-memory globals work as usual.

Data register A for the Mac 128/512/512e/Plus

• bit 7 = SCC Wait/Request input
• bit 6 = Alternate screen buffer output
• bit 5 = Floppy disk head select output
• bit 4 = output: overlay ROM at 0 when 1 (enabled at reset)
• bit 3 = Alternate sound buffer output
• bits 0-2 = Sound volume output

On the SE, bit 4 changes to select upper/lower internal floppy drive (the ROM overlay is enabled at reset and disabled by the first instruction fetch at 0x4xxxxx).

Data register A for the SE/30, II, IIx, and IIcx:

• bit 7 = SCC Wait/Request input
• bit 6 = Alternate screen buffer output on SE/30, model number input on others
• bit 5 = Floppy disk head select output
• bit 4 = output: overlay ROM at 0 when 1 (enabled at reset)
• bit 3 = output: 1 to enable synchronous modem support on port A
• bits 0-2 = reserved (bit 0 must be 1 to avoid forced diagnostic boot over AppleTalk)

Data register A for the IIci / IIfx:

• bit 7 = SCC Wait/Request input
• bit 6 = model ID bit 3 (1 for IIci or IIfx)
• bit 5 = Floppy disk head select output
• bit 4 = model ID bit 2 (1 for IIfx or IIci with parity option)
• bit 3 = output: 1 to enable synchronous modem support on port A
• bit 2 = model ID bit 1 (1 for IIci, 0 for IIfx)
• bit 1 = model ID bit 0 (1 for IIci or IIfx)
• bit 0 = reserved (must be 1 to avoid forced diagnostic boot over AppleTalk)

Data register B for the Mac 128/512/512e/Plus:

• bit 7 = output: 0 to enable sound, 1 to disable
• bit 6 = input: 0 = video in display portion of scanline, 1 = hblank or vblank
• bit 5 = input: mouse Y2
• bit 4 = input: mouse X2
• bit 3 = input: mouse button (0 = pressed)
• bit 2 = output: 0 = enable RTC chip select
• bit 1 = output: RTC clock line
• bit 0 = output: RTC data line

Data register B in the SE/30, II, IIx, IIfx, IIcx, and IIci:

• bit 7 = input on IIci (parity error), output otherwise (sound enable, but ignored by h/w)
• bit 6 = output: 0 to enable parity checking on IIci, 0 to enable vsync IRQ on SE/30, unused otherwise
• bit 5 = output: ADB state 1 (except IIfx)
• bit 4 = output: ADB state 0 (except IIfx)
• bit 3 = input: ADB interrupt (except IIfx)
• bit 2 = output: 0 = enable RTC chip select
• bit 1 = output: RTC clock line
• bit 0 = output: RTC data line

Separate pages are in progress discussing technical features of each of the co-processors used on various Macs. These typically handle ADB, clock, and PRAM, plus power management features on portables and power on/off on some desktops.

M50753 PMUs (Mac Portable, PowerBook 100, 140/170, 145(B), 160/180)

68HC05-based PMU (PowerBook 150, 190, all Duos, 5xx)

68HC05-based Egret (LC, LC II, LC III, Classic II, IIsi, IIvx/IIvi), Caboose (some Quadras), and Cuda (Color Classic, most 68040 machines, all PowerPC 601, 603, 604, and most G3).

There are 3 ID schemes used on the various 68020/030/040 Macs. The first uses bit 6 of port A on VIA1 (PA6) and bit 3 of port B on VIA 2 (PB3) and works like this:

The second uses 4 bits in VIA1 port A: bits 6, 4, 2, and 1 (PA6, PA4, PA2, and PA1, respectively).

This second scheme is further indexed by the core ASIC type detected by the Universal ROM. The PowerBook 170 and Classic II have the same ID bits, but that works because the PB170 and Classic II have very different core ASICs that are easily detected as different. These bits also are used to differentiate machines with the same ID word such as the Quadra and Centris 610/650/800.

The third and most scalable is a machine ID register at 0x5ffffffc. The top word must be 0xa55a to be valid. Then bits 15-11 are 0 for consumer Macs, 1 for portables, 2 for high-end 68k, and 3 for high-end PowerPC. Bit 10 is 1 if additional ID bits appear elsewhere (e.g. in VIA1). The rest of the bits are a per-model identifier. Updated and corrected January 2, 2012: confusion between “Blackbird” the IIfx codename and “Blackbird” the PowerBook 5×0 codename resolved, and many new ID values added on through the end of the Old World.

All Mac ROMs contain a checksum in the first 4 bytes of the image. This is what the “Apple checksum” below is referring to, and not the CRC32 of the entire file. The Apple checksum is calculated by taking the low 32 bits of the sum of every unsigned 16 bit word in the rom, except for the first 4 bytes.

“Release date” is sometimes the ROM's internal release date rather than when the system was introduced to the public.

“Major Version” is the word at offset 0x8. “Minor Version” is the word at offset 0x12. “Sub Release” is the word at offset 0x4c.

• IWM (Integrated Woz Machine) - original controller, simply a small ASIC encapsulating a slightly enhanced version of Woz's original Disk II state machine. Used in Apple IIs, the Lisa, and the Mac 128/512/Plus/SE/II.
• SWIM (Sander/Woz Integrated Machine) - IWM with significant additional capabilities for MFM disks. 100% back-compatible with the IWM (actually contains 2 complete controllers: an original IWM and the new MFM-capable Integrated Sander Machine, or ISM. A crossbar switch inside the chip determines which of the cores is connected to the inputs and outputs). Even in MFM and 1.44M modes, requires the CPU to do all the low-level timing-intensive work of disk I/O, just like the original Disk II.
• SWIM2 - Cost-reduced SWIM. Apple figured out how to use the ISM side to read/write GCR disks as well so there's no IWM or crossbar switch, and the GCR-side software drivers are very different as a result (MFM is the same). Some ISM-side advanced features that were never actually used went away also.
• New Age - Apple/NEC co-designed controller based on the PC standard NEC765 controller with GCR capability added. Was used in only a few machines and quickly replaced by SWIM3.
• SWIM3 - SWIM2 with a state machine front end and DMA capability. Similar overall capability to New Age, but a very different programming model (and probably a lot cheaper).