IBM LTO5 firmware

Posted on Mi 30 September 2026 in Reverse engineering

Update file sectioning

There is a global header and 3 discernable sections, the header is 0x30 bytes, the chunks are 0x30 - 0x2002f, 0x20030 - 0x4002f and 0x40030 - EOF @ 0x4c112.

Section 2 looks like 2 sections, as the exact second half is pretty empty and contains a series chained headers across most of the mostly-zero part.

Lots of header entries are duplicate, so there may be an A/B redundancy scheme going on.

0x30030 - 0x4002f looks like its own section with its own encoding scheme, but it is included in the header of section 2.

Section 3 has two flash to memory mapping tables at 0x200 and 0xA10, including duplicate reset vector descriptions and copyright notices.

summary

Section 1 contains a bootloader that does a little bit of setup and then jumps to the next stage.

Section 2 is more elaborate, TBD.

Section 3 is the "application" section, lots of code, complicated memory map and debug output strings for tape drive setup and debugging. Most of its subsections are LZW-compressed.

Memory/flash maps

mem map

offset size description
100 0000 a peripheral ?
FFC 0000 32MiB boot flash?
1000 0000 400 0000 64 MiB SDRAM
a000 0000 OPB bus controller ?
ef00 0000 peripherals ?
ef60 0300 8 N16550 serial controller
fe00 0000 200 0000 32 MiB NOR flash, maype upper part of 0xf800 128MiB NOR like later
ffff fffc 4 PPC reset vector

flash map from application section header

There are two flash maps, the uncompressed image stored at 0xFE00_0000, where stored size and offsets match memory target size, and the compressed image stored at 0xFE80_0000 where the stored size is smaller than the target memory size.

The headers for both are very similar, only stored addresses and sizes differ besides a small extra block of extra info about stored-only sections in the compressed image header.

This is the compresed flash map:

file offset stored size mem offset mem size description
fe80 0000 800 header
fe80 0800 32 1F25 1020 0000 42 A63C
feb2 2730 8 1AEF 1070 0000 D 7AC4
feba 4220 4 146A 1080 0000 8 CC58
febe 5690 2 D097 1014 0000 3 AA74
fec1 2730 1FF8 100 8000 3744
fec1 4730 229 100 0000 298 system configuration block
fec1 4960 A BE90
fecc 07f0 110
fe7f f7f0
1088 D000 12E2 CF44
100 0400 100 39E0
12F0 0000 137B 4EB0
100 3C00 100 3C20

memory map from TLB setup

device end device start
fe00 03c0 fe00 0005
ff00 03c0 ff00 0005
7000 0040 7000 0105
a000 03c0 a000 0105
b000 03c0 b000 0105
ef60 0340 ef60 0105
100 0140 100 0104
100 4140 100 4104
100 8140 100 8104
ffc 0240 ffc 0204
1014 0240 1014 0000
ram start ram end
1020 0000 1070 0000
1070 0000 1080 0000
1080 0000 12e4 0000
12f0 0000 1380 0000
1380 0000 13ec 0000
13ec 0000 13f0 0000
1000 0000 1000 4000
1000 4000 1000 8000
1000 8000 1000 c000
1000 c000 1001 0000
1001 0000 1001 c000
1001 c000 1002 0000
1002 0000 1014 0000
device end device start
4000 03c0 4000 0105
100 09b0 100 09b4