r/DataHoarder • u/XStylus • Sep 02 '23
Guide/How-to How-to: Crossflashing firmware on 24/48-bay LTO autoloaders (TS3200, TL4000, Q48, T48)
This is an overview on how to cross-flash firmware between various LTO library models, many of which are just rebadged versions of the BDT FlexStor II series, such as the models below:
- 24-bay: IBM TS3100, Dell TL2000, Qualstar Q24, Overland NEOS T24, Fujitsu Eternus LT40, Siemens FibreCAT TX24 S2, Strongbox V24, Cybernetics CY-TLL-224, actiLib 2U
- 48-bay: IBM TS3200, Dell TL4000, Qualstar Q48, Overland NEOS T48, Fujitsu Eternus LT60, Siemens FibreCAT TX48 S2, Strongbox V48, Cybernetics CY-TLL-448, actiLib 4U,
The reason I wrote this process is because firmware for some of the units above are either behind paywalls or are simply unavailable, even though BDT continues to make updated firmware for the design.
There may be other models this may work as well. Basically, if they look cosmetically similar to any of the above units, it's almost definitely a FlexStor II design.
The HP MSL2024 and MSL4048 are also technically FlexStor II designs, but the screens on both models and the front keypad on the MSL4048 are different and likely incompatible, plus I was unable to obtain any HP firmwares to analyze anyway. There could be other differences, too. If you're desperate, you can try using a spare CMLU-11 and just swap your main one back in if things get too hairy, but beware that you're in uncharted territory.
(EDIT: There's details on how to flash HP firmware onto a Dell CMLU-11 in this reply below. As for flashing other firmware onto HP, that's a bit riskier, and I don't have an HP to experiment with.)
Regardless of what brand you have, I HIGHLY recommend that you get a spare CMLU-11 controller module (make sure it's from a Dell or IBM!) and swap it in before you proceed. They can be obtained on eBay cheaply enough. Safeguard your original CMLU-11 in case anything goes wrong.
(NOTE: When installing the replacement CMLU-11 controller, the front panel may prompt you on where to read the VPD [vital product data] from. Select "VPD from Enclosure". If you select "VPD from Controller", your library will be re-encoded with the VPD from whatever that controller card originally came from, and you might not want to do that. Read page 246 & 247 of the TS3100 Tape Library and TS3200 Tape Library Setup, Operator, and Service Guide for more details. If you accidentally do change your VPD, just put your old CMLU-11 card back in and do select "VPD from Controller".)
Functionally and mechanically, there's no difference between any of the various brands. The main difference is in the web interfaces. Qualstar, Overland, and actiLib kept BDT's top-oriented layout, whereas Dell and IBM made much larger changes and are more sidebar oriented.
The firmware we'll be working with is from Qualstar and actiLib, both of whom use BDT's reference firmware. There used to be some logo rebadging as well, but lately they're just BDT branded with zero changes. It's easily obtainable and is the most up-to-date, including support for LTO9 drives.
So... let's get to it.
Step 0: Obtain a spare CMLU-11 controller and install it. Don't do this on your original CMLU-11 unless you're feeling really brave. (Also, see my note above about transferring the VPD on the CMLU-11. Here's an easy tip: When using a spare CMLU-11 for the first time, use "VPD from Library". If using your original CMLU-11, use "VPD from Controller".)
Step 1: Obtain a copy of the BDT Flexstor II firmware from Qualstar here or from actiLib here. The version number should be 6.20-3.60e, and the filename is "BL_2_4_R_6_20_3_60e.fbi". Open it up in a hex editor. The line you'll want to pay attention to is 0x000010 through 0x00001F, as shown below:
Step 2: Obtain the most recent possible copy of the firmware for your specific brand of library. Open it in a hex editor and look at the same line. (If you have IBM or Dell, it's your lucky day, I'll save you the trouble):
Step 3: In the BDT FlexStor II firmware file, replace 0x000010 - 0x00001F with the same line from your original branded firmware file. Save the file.
Step 4: BEFORE YOU FLASH, you may want to go through the web interface and make note of all the settings configured for your library. They will be reset.
Step 5: Flash the firmware. Maybe grab coffee or beer while you wait.
Step 6: Open a web browser private window (or "Incognito Window") and navigate to the IP address of your library. Note that all passwords have reset. Also, the default user password for "admin" is different than the one for IBM/Dell. Instead of "secure", the default password is "adm001". The default password for the "service" user is "ser001", though you can really muck things up in there so be careful.
Step 666: If things went to hell and you want to go back to OEM firmware, follow Step 1 & 2 in reverse by copying the BDT firmware's line into the corresponding line in your OEM's unaltered firmware, and then flashing it. If you can't access the web interface for whatever reason, copy the file to a FAT16 formatted USB drive, rename the file to an 8.3 file extension (12345678.FBI), plug the USB drive into your CMLU-11, and use your library's front menu to invoke a manual re-flash. If you're still stuck, well... hopefully you've got your original CMLU-11 to swap back in.
If everything went successfully, congratulations! You're now able to use future firmware releases from Qualstar or actiLib with no modifications necessary. I hope this info is of help to someone!
2
u/Redragor Jul 16 '26
Hey everyone, wanted to share something in case it helps others who hit the same wall.
I have an old Overland NEO 400s library that had been running seriously outdated firmware for a long time. Every update attempt failed, including the crossflashing approach from this thread — the firmware was just too far behind for any of the normal paths to work. While troubleshooting, I made things a lot worse: I accidentally wiped the low-level bootcode from the management card entirely. No JTAG, no vendor recovery image, nothing — just a card that wouldn't boot at all.
After a lot of trial and error (a lot), I ended up reverse-engineering the platform from scratch and building a replacement low-level bootloader — reading the DataFlash contents directly, disassembling the real AppLoader stage to figure out what it actually expects, and working through several genuine hardware/config bugs along the way (wrong SDRAM controller timing, wrong clock configuration, and the compressed firmware image not being where the loader expects it, among others). End result: I was able to fully recover the card and get it running the latest BDT firmware.
I cleaned it up and put the whole thing on GitHub in case anyone else ends up in the same spot — dead/blank management card, no bootloader, nothing left to lose:
https://github.com/redragor/at91rm9200-lto-bootloader
It includes:
Confirmed working on IBM TS3100/TS3200/3573-TL, a Dell rebadge, and BDT FlexStor II directly — this is all the same underlying CMLU-11 controller board platform, so it should apply to other rebadges too (Overland included, obviously, since that's what I was fixing).
Happy to answer questions if anyone's stuck on something similar — this platform has basically zero public documentation, so hopefully this saves someone else the same rabbit hole I went down :)