IBM LTO5 firmware
Posted on Mi 30 September 2026 in Reverse engineering
Update file sectioning
There is a global header and 3 discernable sections, the header is 0x30 bytes, the chunks are 0x30 - 0x2002f, 0x20030 - 0x4002f and 0x40030 - EOF @ 0x4c112.
Section 2 looks like 2 sections, as the exact second half is pretty empty and contains a series chained headers across most of the mostly-zero part.
Lots of header entries are duplicate, so there may be an A/B redundancy scheme going on.
0x30030 - 0x4002f looks like its own section with its own encoding scheme, but it is included in the header of section 2.
Section 3 has two flash to memory mapping tables at 0x200 and 0xA10, including duplicate reset vector descriptions and copyright notices.
summary
Section 1 contains a bootloader that does a little bit of setup and then jumps to the next stage.
Section 2 is more elaborate, TBD.
Section 3 is the "application" section, lots of code, complicated memory map and debug output strings for tape drive setup and debugging. Most of its subsections are LZW-compressed.
Memory/flash maps
mem map
| offset | size | description |
|---|---|---|
| 100 0000 | a peripheral ? | |
| FFC 0000 | 32MiB boot flash? | |
| 1000 0000 | 400 0000 | 64 MiB SDRAM |
| a000 0000 | OPB bus controller ? | |
| ef00 0000 | peripherals ? | |
| ef60 0300 | 8 | N16550 serial controller |
| fe00 0000 | 200 0000 | 32 MiB NOR flash, maype upper part of 0xf800 128MiB NOR like later |
| ffff fffc | 4 | PPC reset vector |
flash map from application section header
There are two flash maps, the uncompressed image stored at 0xFE00_0000, where stored size and offsets match memory target size, and the compressed image stored at 0xFE80_0000 where the stored size is smaller than the target memory size.
The headers for both are very similar, only stored addresses and sizes differ besides a small extra block of extra info about stored-only sections in the compressed image header.
This is the compresed flash map:
| file offset | stored size | mem offset | mem size | description |
|---|---|---|---|---|
| fe80 0000 | 800 | header | ||
| fe80 0800 | 32 1F25 | 1020 0000 | 42 A63C | |
| feb2 2730 | 8 1AEF | 1070 0000 | D 7AC4 | |
| feba 4220 | 4 146A | 1080 0000 | 8 CC58 | |
| febe 5690 | 2 D097 | 1014 0000 | 3 AA74 | |
| fec1 2730 | 1FF8 | 100 8000 | 3744 | |
| fec1 4730 | 229 | 100 0000 | 298 | system configuration block |
| fec1 4960 | A BE90 | |||
| fecc 07f0 | 110 | |||
| fe7f f7f0 | ||||
| 1088 D000 | 12E2 CF44 | |||
| 100 0400 | 100 39E0 | |||
| 12F0 0000 | 137B 4EB0 | |||
| 100 3C00 | 100 3C20 |
memory map from TLB setup
| device end | device start |
|---|---|
| fe00 03c0 | fe00 0005 |
| ff00 03c0 | ff00 0005 |
| 7000 0040 | 7000 0105 |
| a000 03c0 | a000 0105 |
| b000 03c0 | b000 0105 |
| ef60 0340 | ef60 0105 |
| 100 0140 | 100 0104 |
| 100 4140 | 100 4104 |
| 100 8140 | 100 8104 |
| ffc 0240 | ffc 0204 |
| 1014 0240 | 1014 0000 |
| ram start | ram end |
|---|---|
| 1020 0000 | 1070 0000 |
| 1070 0000 | 1080 0000 |
| 1080 0000 | 12e4 0000 |
| 12f0 0000 | 1380 0000 |
| 1380 0000 | 13ec 0000 |
| 13ec 0000 | 13f0 0000 |
| 1000 0000 | 1000 4000 |
| 1000 4000 | 1000 8000 |
| 1000 8000 | 1000 c000 |
| 1000 c000 | 1001 0000 |
| 1001 0000 | 1001 c000 |
| 1001 c000 | 1002 0000 |
| 1002 0000 | 1014 0000 |
| device end | device start |
|---|---|
| 4000 03c0 | 4000 0105 |
| 100 09b0 | 100 09b4 |