LTO firmware across the ages
Posted on Do 24 September 2026 in Reverse engineering
LTO5
This one has a completely different firmware image format from its successors, it is not based on embedded Linux yet, but it is an embedded PowerPC processor with a similar memory layout.
There are 2 distinct firmware sections like the later fcod/pcod and a large application section with LZW compressed data.
LTO6-9 - 4 Generations of similar firmware
As a long-lived business product, IBM's LTO drive firmware has not changed much since LTO6 drives came out, LTO10 marks the first firmware image format change. This is despite substantial changes to the tape, tape heads and storage interfaces which Wikipedia summarizes nicely.
SAS drive firmwares are consistently a little smaller (50 kiB) than their FC counterparts due to their smaller kernel and initrd.
The memory layout as specified in the firmware update header is identical from LTO6 to LTO9, only the sizes of some sections change slightly, mostly the Linux image vmli and its initrd ramf which grow slightly with each new generation.
For the LTO7 generation, it seems like HPE gave up on their own tape machanism and their firmare updates are now a wrapper around an IBM firmware image.
LTO10 - big changes in hardware, small changes in firmware
LTO10 (aka LTOA) moves the memory layout around, instead of starting at 0x10000000 with kmem, firmware now starts at 0x90000000, though section order stays largely the same and relative offsets change very little.
It also introduces a new 0x180-byte section called csm at 0x9FFC0000 and the ocmd section (presumably flash control) moves from 0x06000000 to 0xD0000000 and shrinks from 0x104 to 0x4.
The global and pcod header magic string is changed to IBMTpDrA to prevent issues when updating.
These changes are necessitated by IBM switching from their embedded PowerPC platform to a Synopsys ARCv2 HS38 processor, which is a synthesizable 32-bit RISC core design now owned by MIPS owned by Global Foundries; peripherals are expected to be mostly from the Synopsys DesignWare catalog. For a complete change of processor architecture and peripherals, surprisingly little has changed in the firmware image.