Reverse-engineering the iPod Classic's undocumented Mikey chip

The inline remote on Apple's wired earbuds never worked on an iPod Classic running Rockbox: the centre play/pause button and the volume clicker do nothing on this whole family of players. The project's audio driver admitted as much in a comment, leaving accessory detection and remote button support as open tasks. A hobbyist with a 7th-generation iPod Classic decided to close both.

A chip named Mikey

The headphone jack is served by a small dedicated chip that Apple's firmware calls Mikey. It sits on I2C bus 0 at address 0x72, exposes 8 registers and does two jobs: powering the headset microphone and decoding the buttons of the inline remote. Rockbox knew it existed, but used it only to raise the microphone bias so that recording through the jack works. Nothing else was ever written down: the freemyipod community has no Mikey driver and no register tables, Rockbox's Gerrit holds no abandoned attempts.

Notes from 2010, and a register sweep

The only prior art was a 2010 write-up by David Carne on the headphone remote of the iPod shuffle 3G, which uses the same accessory hardware. Carne's measurements killed the idea that the remote speaks a serial protocol: the centre button is a dead short of the microphone line, while volume up and down are fixed resistive loads that drag that line from about 2.08 V down to 1.68 V and 1.52 V. The only clever part is an ultrasonic identification chirp 8.1 ms after power-up, answered by a 4.8 ms pulse from the player.

No debugger can be attached to a jack controller, so the author built a screen of his own inside Rockbox: it polls all 8 registers every 20 ms, logs every change to /.rockbox/mikey.log, and an auto-sweep mode steps register 0 through all 256 values. The answer was 0x2f: its low three bits carry the recording path's microphone bias, while 0x28 arms the detector, and the volume and centre-button events surface as defined levels in registers 5 and 4.

The hardware lies

Everyday use exposed something stranger than a bouncing contact. After about five seconds without button activity, the chip's event engine falls asleep: a press still raises register 4 immediately, but the release is reported 1.7 to 1.8 seconds late.

The driver therefore treats the centre button as click-only, sending a fixed 60 ms pulse per press. The work went upstream as Gerrit change 7677, "ipod6g: Add inline earphone remote support": one commit, 8 files, 318 insertions, still under review. A prebuilt Rockbox image with the driver, ipod6g-mikey-v1, works on the Classic 6G and 7th generation.