Skip to content

Status

Last updated 2026-08-15. This page is written the same way the rest of the project is: what is claimed here has a gate behind it, and what does not work is listed beside what does.

The target device is the iPod classic 6G, S5L8702. Nothing here has been tried on any other model.

Works, with a gate

Each of these has a test or a measurement that fails if the behaviour changes. The full table, with the gate for every row, is retailos_re/ROADMAP.md in the repository.

Kernel. The firmware's own RTXC design, not a stand-in: tasks, priorities, preemption, mutexes with priority inheritance, timers, slots and events, a heap with boundary tags, and the service dispatch. All 49 dispatch slots are read and classified. The 34 tasks carry the firmware's own names, ids and priorities -- 32 of them recovered from the image's own strings, with two independent naming mechanisms agreeing on the 20 they share.

Storage. ATA (LBA28/48), a partition layer, FAT16 and the HFS+ reader. The filesystem does not call the disk directly: it posts to a queue and blocks, because that is what the ATAWorkLoopTask / ATAWorkLoopIRQTask pair in the image does.

Display. The real LCD pipe, driven with the firmware's own register values, including the panel tear-effect interrupt and the second hardware window that composites album art under a hole in the UI surface.

UI, built from the archive. Screens are not constructed in code. A screen names its controller through the archive's SCST record; its rows, labels and value properties come from ITEM and SORC; its key and event bindings come from CEVT and SEVT. All eight navigator verbs dispatch on the archive's own bindings -- including the two dead bindings the device also ignores. Text renders through FreeType, taken from upstream.

Menus that go somewhere. Home, Settings, Music, and the media lists drilling down Artists → Albums → Songs → Now Playing, with the browse scope kept on the model the way the firmware keeps it. MENU walks back up and restores the level you left.

Audio. Music plays. The sm1 block at 0x38500000 is a bus-mastering hardware decoder -- packets in over a DRAM descriptor chain, PCM out into fixed SRAM buffers -- so there is no Apple codec in the image to recover, and the specification is written down. The feeder blocks on the DMA terminal count instead of spinning, which is what lets the window manager keep painting while a track plays: Now Playing shows title, album, position, progress and cover with playback running.

Video. Both test films decode with zero errors, including the two-layer GOP, after the model was corrected to start on the run-bit 0→1 edge the way the hardware does.

Artwork. The ArtworkDB → .ithmb join runs on the device, cells are cached, and album rows draw with the correct split, separator and stride.

Fidelity checking. The retail firmware and Chikuma boot the same disk on the same emulated machine, so screens are compared by subtraction. Several screens are byte-identical to the original; where they are not, the differing pixel count is the number that gets quoted.

Does not work yet

  • Extras is unreachable. Clock, Alarms, Calendar, Contacts, Notes and Stopwatch all sit in a span of the firmware's name table that the current extraction cuts off, so those pushes fail silently. Known cause, not a mystery.
  • Most screens are unserved. Of 114 push targets in the archive, 17 are registered and 13 are served by the generic menu list. 56 are unserved and 28 have names that do not resolve at all.
  • Playlists, Compilations, Audiobooks and Genius are unbound actions on the Music menu.
  • No preview pane follows a highlight below Home -- every *Hilited binding on those menus is still unbound.
  • Photos: the database is read and the controllers are named, but nothing is reproduced yet.
  • USB is not started. Five USB tasks exist in the image. Mass storage is the goal (a car head unit playing from the device needs MSC, not iAP), and it is a reproduction job because USB MSC is already a task there.
  • Disk writes. The emulator's ATA model is read-only, so firmware writes are dropped. This blocks a whole subsystem rather than a screen, and it is the first emulator gap worth closing.
  • No installable release. See below.

Deliberately out of scope

  • Games. /Resources/Games is most of the resource volume and none of it matters for the intended use.
  • Byte-matching Apple's compiler output. Fidelity is to behaviour. Chikuma is meant to be recompilable and changeable, which a byte-match would forbid.
  • Re-typing published libraries. FreeType, SQLite, zlib and the Vincent OpenGL ES implementation are used from upstream at the version the image advertises. What Apple grew onto them -- a vendor extension like GL_APPLE_binary_shader, for instance -- is recovered, because that could have been different.

Wanted, once music is solid

A night mode: a time-based dark theme, because the stock UI's white backgrounds at night are painful. It is the first feature that is Chikuma's rather than Apple's, and it lands as data rather than code -- the firmware's string table already carries 51 *_Color resources.

Installing it

There isn't a release. The install path exists -- a two-stage payload, a DFU upload path, and a bundle format -- but it is developer plumbing and it touches flash on a device that is no longer manufactured. On the device says what the path is and why you should think twice.