iPod nano 2nd Generation Port

Summary

Rockbox currently can now (as of October 2009) boot and run on the 2nd generation iPod nano. This includes a read/write NAND (disk) driver and working plugins. Audio works, but there are many other unimplemented features.

Installation

Rockbox installation consists of two parts - installing the Rockbox bootloader to your ipod, and installing Rockbox itself. The Rockbox bootloader is installed by running the ipodpatcher tool, and just needs to be done once. After you've done this, you can still use the Apple firmware by turning on the hold switch when powering on your Nano.

Rockbox itself is installed by downloading http://build.rockbox.org/data/rockbox-ipodnano2g.zip and extracting the contents to the root (i.e. top-level) of your ipod. This URL always points to the most recent "current build" of Rockbox, updated automatically a few minutes after every change to the Rockbox source code.

The Rockbox manual has full installation instructions - see the "manual installation" part of the Installation chapter (the "automatic installation" - using Rockbox Utility - does not yet work for the 2nd generation Nano).

The current release of Rockbox's graphical installer, RockboxUtility, does not support the 2nd Generation Nano, but support has been added to SVN and you can use RockboxUtility if you compile it yourself from the latest source code.

Port Status

In mid-2009, a vulnerability in the iPod's original firmware was discovered in its "Notes" application. This was exploited and used to dump the Boot ROM from within the Samsung SOC. This then allowed decrypting and dumping of the contents of the NOR flash (containing the iPod's bootloader, disk mode and diagnostic mode), which in turn allowed the encryption of the main firmware partition to be understood.

It is now possible to encrypt (using the AES hardware crypto unit inside the Samsung SoC) a bootloader and install it onto an iPod Nano 2G's firmware partition using ipodpatcher. Bootloader binaries are encrypted on an ipod using the crypt_firmware viewer plugin.

Known bugs

The following is a list of known bugs in the Nano 2G port:

• The Rockbox Info screen shows the wrong disk size (due to the 2048-byte sectors). Fixed in r23596.
• After an unclean shutdown (menu+select reset or a crash), it may sometimes lose all contents on the data flash.

Driver status

The following table shows the current status in Rockbox SVN of the various drivers required to be implemented before Rockbox is fully functional on the 2nd gen Nano.

Device	Status
Kernel (core sleep, timers)	Done
Interrupt handling core code	Done
LCD driver	95% Full functionality implemented, but needs benchmarking and (if possible) optimising.
Backlight	Done
NAND/FTL driver	90% Read/write driver implemented, seems to be mostly stable. Needs performance improvements though.
ADC driver	50% Battery ADC seems to work, but fuel gauge needs calibrating
Button driver	Done Shares the same clickwheel driver as earlier ipods. Clickwheel acceleration enabled since r23748.
USB handler	90% Mostly works, but there are some minor problems
Power handling	50% Currently switching 100mA/500mA based on "Car adapter mode", not based on USB enumeration.
RTC driver	Done
I2C driver	Done
I2S driver	Done
CPU frequency changing	50% No undervolting yet
Audio ADC/DAC driver	80% Playback-only right now

Todo List

• Recording
• Accessory Protocol
• Undervolting
• Calibrate battery measurements
• Parallelize FTL
• Fix HID
• Implement RTC alarm
• Implement missing LCD features

Hardware

(table needs to be reinserted)

Entering DFU Mode

Entering DFU Mode on the nano is a little tricky. I had done so by doing the following:

1. Connect the iPod to a PC running Linux.
2. dd the firmware partition and the MBR to backup files (dd if=/dev/sdX1 (replace X with the letter assigned to the device) of=nano-of.bin; dd if=/dev/sdX1 of=mbr.bin count=1)
3. dd some random data to the firmware partition to trash it (dd=/dev/urandom of=/dev/sdX1); let it run until it can't anymore.
4. Disconnect, reset (MENU+SELECT), then reattach it to the PC.
5. Reset it again while it's still connected, then immediately hit BACK+PLAY.

A picture of the dock connector cable should appear, along with the Apple support URL. This is DFU mode.

(Note: I attempted to enter DFU mode on a nano with a working firmware. However, the key combination didn't work, confirming that DFU mode is only accessible when the iPod's firmware is damaged in some way.)

Some tools that may be useful to try out on the nano's DFU mode:

• xpwn, used to generate custom iPhone firmwares, but may do something on the nano as well.