If you like BoxMatrix then please contribute Supportdata-Probes, Firmware-Probes and/or Hardware-Probes (get in touch).
My metamonk@yahoo.com is not reachable by me since september. Please use hippie2000@webnmail.de instead.
Bootloader-Environment
From BoxMatrix
| BoxMatrix >> Environment >> Bootloader-Environment | @ BoxMatrix - IRC-Chat - Translate: de es fr it nl pl |
| News | Selectors | Models | Accessories | Components | Environment | Config | Commands | System | Webif | Software | Develop | Lexicon | Community | Project | Gallery |
| Bootloader-Env | Brandings | TIATM-Env | Linux-Env | AVM-Env | Config-Env | CGI-Env | WebCM-Env | Kernel-Cfg | Research |
 |
The Bootloader-Environment stores factory settings describing a model. This includes info about the hardware (HWRevision, ProductID), branding and internationalisation (annex, country, language, firmware_version), partition tables (mtd0++), MAC addresses, default keys for WLAN, and much more. It is stored in the AVM developed TFFS filesystem, with factory defaults stored in the Bootloader image. To access the TFFS filesystem the Bootloader ADAM2 or EVA and the Kernel contain TFFS drivers, which contain a list with all possible variable names and their IDs. This list is used to create the TFFS and to access a variable by its ID. A Recovery.exe also contains this list, to clean the TFFS partitions with a new filesystem.
|
Bootloader-Environment[edit]
This list shows all variables of the TFFS name tables of all unpacked Kernels and Recovery.exe files of the Firmware-History and their IDs,
plus some manual additions. The variables modulation and oam_lb_timeout, which belong to the TIATM-Environment, are repeated here to list their IDs.
Like the TFFS drivers the name tables are open source and could be found in AVM's release kernel source at drivers/char/tffs/*linux_tffs.h.
Each article listed below shows per model sample values, if the respective variable was used in any of the scanned Supportdata-Probes.
Daily updated index of all bootloader variables found scanning Supportdata-Probes and Firmware-Probes. Last update: 2022-01-26 06:22 GMT.
The label (bootenv) in the Variable column shows there are other objects in this wiki using this name.
The Mod.supp and Firmw.supp columns show the amount of models using the respective variable in supportdata, and their firmware range.
The Mod.kern and Firmw.kern columns show the amount of models using the respective variable in kernel tffs tables, and their firmware range.
The label (anon) in the Description column shows that the sample values of the respective variable are anonymized.
The TFFS-IDs column shows the IDs of the respective variable in hex and deximal format. ADAM2 IDs range from 0x0100 to 0x01FF.
Goto: A - B - C - D - E - F - G - H - I - J - K - L - M - N - O - P - Q - R - S - T - U - V - W - X - Y - Z - Index
| Variable | Mod supp |
Firmw supp |
Mod kern |
Firmw kern |
Description | TFFS IDs |
Origin |
|---|---|---|---|---|---|---|---|
| annex | 129 | 4.07 - 7.30 | 146 | 1.120 - 7.39 | The ADSL-Annex of the current Firmware or the initial setting | 0x01A9=425 | TI |
| autoload | 129 | 4.07 - 7.30 | 146 | 1.63 - 7.39 | Whether to start the Kernel automatically (yes) or to stop in ADAM2 Shell prompt. | 0x0181=385 | TI |
| AutoMDIX | 146 | 3.14 - 7.39 | TODO | 0x01AF=431 | TI | ||
| bb0 | 117 | 4.44 - 7.39 | TODO | 0x0200=512 | AVM | ||
| bb1 | 117 | 4.44 - 7.39 | TODO | 0x0201=513 | AVM | ||
| bb2 | 117 | 4.44 - 7.39 | TODO | 0x0202=514 | AVM | ||
| bb3 | 117 | 4.44 - 7.39 | TODO | 0x0203=515 | AVM | ||
| bb4 | 117 | 4.44 - 7.39 | TODO | 0x0204=516 | AVM | ||
| bb5 | 117 | 4.44 - 7.39 | TODO | 0x0205=517 | AVM | ||
| bb6 | 117 | 4.44 - 7.39 | TODO | 0x0206=518 | AVM | ||
| bb7 | 117 | 4.44 - 7.39 | TODO | 0x0207=519 | AVM | ||
| bb8 | 117 | 4.44 - 7.39 | TODO | 0x0208=520 | AVM | ||
| bb9 | 117 | 4.44 - 7.39 | TODO | 0x0209=521 | AVM | ||
| bluetooth | 22 | 4.07 - 4.88 | 146 | 1.63 - 7.39 | The MAC address of an initially planned Bluetooth interface which never happened (anon) | 0x0184=388 | AVM |
| bluetooth_key | 146 | 1.120 - 7.39 | The default key for an initially planned Bluetooth interface which never happened | 0x01AC=428 | AVM | ||
| bootloaderVersion | 129 | 4.07 - 7.30 | 146 | 1.63 - 7.39 | The Bootloader version in dotted notation. 0.18.01 = ADAM2, 1.xxx = EVA | 0x0182=386 | TI |
| bootserport | 93 | 4.07 - 7.27 | 146 | 1.63 - 7.39 | The serial port of the SoC to be used for the ADAM2 Shell and boot prompt | 0x0183=387 | TI |
| country (bootenv) | 56 | 4.77 - 7.30 | 146 | 1.63 - 7.39 | The international phone number of the currently selected country | 0x01A8=424 | AVM |
| cpufrequency | 94 | 4.07 - 7.27 | 146 | 1.63 - 7.39 | The clock frequency of the SoC's main CPU in Hertz | 0x0185=389 | TI |
| crash | 48 | 6.00 - 7.28 | 146 | 1.63 - 7.39 | Infos about the recent crash reason (cryptic). | 0x01A1=417 | AVM |
| DMC | 27 | 6.87 - 7.30 | 146 | 1.63 - 7.39 | TODO (anon) | 0x0103=259 | TI |
| ethaddr (bootenv) | 55 | 1.63 - 7.04 | TODO | 0x0197=407 | TI | ||
| firmware_info | 129 | 4.07 - 7.30 | 146 | 1.120 - 7.39 | The version of the currently installed Firmware | 0x01AE=430 | AVM |
| firmware_version | 129 | 4.07 - 7.30 | 146 | 1.63 - 7.39 | The current Branding for this box | 0x01A6=422 | AVM |
| firstfreeaddress (bootenv) | 129 | 4.07 - 7.30 | 146 | 1.63 - 7.39 | The first free address in RAM at the end of the space ADAM2 uses | 0x0186=390 | TI |
| flashsize (bootenv) | 124 | 4.07 - 7.30 | 146 | 1.63 - 7.39 | The hexadecimal amount of Flash in bytes, for new models per type of Flash in MB | 0x0187=391 | TI |
| gpon_serial | 2 | 7.01 - 7.25 | 63 | 6.98 - 7.39 | The unique ID of the GPON interface of the 5491 and 5530 (anon). | 0x01C9=457 | AVM |
| HardwareFeatures | 14 | 7.03 - 7.30 | 62 | 6.98 - 7.39 | TODO | 0x01CB=459 | AVM |
| http_key | 55 | 1.120 - 7.04 | TODO | 0x01AD=429 | TI | ||
| HWRevision (bootenv) | 129 | 4.07 - 7.30 | 146 | 1.63 - 7.39 | The hardware design number (for early models a character) to identify a model | 0x0100=256 | TI |
| HWSubRevision (bootenv) | 82 | 5.04 - 7.30 | 98 | 4.80 - 7.39 | The design revision number marking minor changes to the hardware | 0x0104=260 | AVM |
| jffs2_size | 31 | 4.57 - 7.19 | 144 | 3.98 - 7.39 | The size of the JFFS Partition in blocks | 0x01B9=441 | AVM |
| kernel_args | 5 | 4.57 - 4.88 | 146 | 1.63 - 7.39 | A space delimited set of name=value assignments passed to Kernel and Firmware | 0x01A0=416 | AVM |
| kernel_args1 | 146 | 1.63 - 7.39 | Merged with kernel_args before booting the Kernel | 0x019F=415 | AVM | ||
| kernel_args_tmp (bootenv) | Merged with kernel_args before booting the Kernel, also used by Recovery.exe | AVM | |||||
| language (bootenv) | 55 | 4.79 - 7.30 | 146 | 1.63 - 7.39 | The 2-character ISO language code of the currently selected language | 0x01A7=423 | AVM |
| linuxip | 55 | 1.63 - 7.04 | TODO | 0x0199=409 | TI | ||
| linux_fs_start | 51 | 5.28 - 7.30 | 131 | 1.63 - 7.39 | Which Firmware instance to use for new DualBoot models | 0x0198=408 | AVM |
| linux_fs_status | 51 | 7.19 - 7.39 | TODO | AVM | |||
| maca | 129 | 4.07 - 7.30 | 146 | 1.63 - 7.39 | The MAC address of the (first) LAN port(s) - eth0 (anon) | 0x0188=392 | TI |
| macb | 129 | 4.07 - 7.30 | 146 | 1.63 - 7.39 | The MAC address of the second LAN port - eth1 (anon) | 0x0189=393 | TI |
| macc (bootenv) | 1 | 4.33 | 55 | 1.63 - 7.04 | TODO (anon) | 0x0196=406 | TI |
| macdsl | 129 | 4.07 - 7.30 | 146 | 1.63 - 7.39 | The MAC address of the DSL interface (anon) | 0x018B=395 | AVM |
| macwlan | 129 | 4.07 - 7.30 | 146 | 1.63 - 7.39 | The MAC address of the (first) WLAN interface (anon) | 0x018A=394 | AVM |
| macwlan2 | 53 | 5.50 - 7.30 | 117 | 4.58 - 7.39 | The MAC address of the second WLAN interface (anon) | 0x0196=406 | AVM |
| macwlan3 | 3 | 7.03 - 7.28 | 63 | 6.98 - 7.39 | The MAC address of the third WLAN interface (anon) | 0x01CA=458 | AVM |
| memsize (bootenv) | 129 | 4.07 - 7.30 | 146 | 1.63 - 7.39 | The hexadecimal amount of RAM in bytes | 0x018C=396 | TI |
| modetty0 | 94 | 4.07 - 7.27 | 146 | 1.63 - 7.39 | The configuration of the first serial port of the SoC | 0x018D=397 | TI |
| modetty1 | 94 | 4.07 - 7.27 | 146 | 1.63 - 7.39 | The configuration of the second serial port of the SoC | 0x018E=398 | TI |
| modulation | 55 | 1.63 - 7.04 | DSL modem training mode (UR8). | 0x019A=410 | |||
| modulemem (bootenv) | 29 | 5.28 - 7.24 | 90 | 5.27 - 7.39 | TODO | 0x01C4=452 | AVM |
| mtd0 (bootenv) | 116 | 4.07 - 7.30 | 146 | 1.63 - 7.39 | Hexadecimal start and end address of the Filesystem (or empty) Partition | 0x01B0=432 | TI |
| mtd1 (bootenv) | 129 | 4.07 - 7.30 | 146 | 1.63 - 7.39 | Hexadecimal start and end address of the Kernel(+Filesystem) Partition | 0x01B1=433 | TI |
| mtd10 (bootenv) | 10 | 6.08 - 7.24 | 84 | 5.29 - 7.39 | TODO | 0x01BC=444 | AVM |
| mtd11 (bootenv) | 10 | 6.08 - 7.24 | 84 | 5.29 - 7.39 | TODO | 0x01BD=445 | AVM |
| mtd12 (bootenv) | 10 | 6.08 - 7.24 | 84 | 5.29 - 7.39 | TODO | 0x01BE=446 | AVM |
| mtd13 (bootenv) | 10 | 6.08 - 7.24 | 84 | 5.29 - 7.39 | TODO | 0x01BF=447 | AVM |
| mtd14 (bootenv) | 10 | 6.08 - 7.24 | 84 | 5.29 - 7.39 | TODO | 0x01C6=454 | AVM |
| mtd15 (bootenv) | 84 | 5.29 - 7.39 | TODO | 0x01C7=455 | AVM | ||
| mtd2 (bootenv) | 129 | 4.07 - 7.30 | 146 | 1.63 - 7.39 | Hexadecimal start and end address of the ADAM2 Partition | 0x01B2=434 | TI |
| mtd3 (bootenv) | 129 | 4.07 - 7.30 | 146 | 1.63 - 7.39 | Hexadecimal start and end address of the first TFFS Partition | 0x01B3=435 | TI |
| mtd4 (bootenv) | 129 | 4.07 - 7.30 | 146 | 1.63 - 7.39 | Hexadecimal start and end address of the second TFFS Partition | 0x01B4=436 | TI |
| mtd5 (bootenv) | 55 | 4.57 - 7.30 | 146 | 1.63 - 7.39 | Hexadecimal start and end address of an auxiliary Partition (if any) | 0x01B5=437 | TI |
| mtd6 (bootenv) | 15 | 6.08 - 7.24 | 146 | 1.63 - 7.39 | TODO | 0x01B6=438 | AVM |
| mtd7 (bootenv) | 10 | 6.08 - 7.24 | 146 | 1.63 - 7.39 | TODO | 0x01B7=439 | AVM |
| mtd8 (bootenv) | 10 | 6.08 - 7.24 | 84 | 5.29 - 7.39 | TODO | 0x01BA=442 | AVM |
| mtd9 (bootenv) | 6 | 6.08 - 7.24 | 84 | 5.29 - 7.39 | TODO | 0x01BB=443 | AVM |
| my_ipaddress | 129 | 4.07 - 7.30 | 146 | 1.63 - 7.39 | The IP to connect to ADAM2 via TinyFTP, as used by the Recovery | 0x018F=399 | TI |
| nfs (bootenv) | 93 | 1.63 - 7.04 | TODO | 0x019B=411 | AVM | ||
| nfsroot | 93 | 1.63 - 7.04 | TODO | 0x019C=412 | AVM | ||
| oam_lb_timeout | 55 | 1.63 - 7.04 | OAM loopback timeout in milliseconds (AR7 / UR8). | 0x019D=413 | |||
| plc_dak_nmk | 5 | 5.50 - 7.27 | 84 | 5.27 - 7.39 | TODO (anon) | 0x01C5=453 | AVM |
| ProductID | 129 | 4.07 - 7.30 | 146 | 1.63 - 7.39 | The ProductID string for this model to be matched with the correct Firmware | 0x0101=257 | TI |
| prompt | 129 | 4.07 - 7.30 | 146 | 1.63 - 7.39 | The prompt used for the ADAM2 Shell | 0x0190=400 | TI |
| provider | 9 | 6.20 - 7.26 | 105 | 4.77 - 7.39 | Provider additive. Optional settings for small IPSs | 0x01C3=451 | AVM |
| ptest (bootenv) | 60 | 4.07 - 7.26 | 146 | 1.120 - 7.39 | Control variable for product end control and Factory-Test | 0x01AA=426 | AVM |
| req_fullrate_freq | 94 | 4.07 - 7.27 | 146 | 1.63 - 7.39 | TODO | 0x0192=402 | TI |
| reserved (bootenv) | 22 | 4.07 - 4.88 | 146 | 1.63 - 7.39 | A reserved MAC address for unknown purposes - never used | 0x0191=401 | AVM |
| SerialNumber (bootenv) | 129 | 4.07 - 7.30 | 146 | 1.63 - 7.39 | Serial number of the Box, AES ecryption key for FRITZ!Media, or padded with zeros (anon). | 0x0102=258 | TI |
| SoftwareFeatures | 51 | 7.19 - 7.39 | TODO | 0x01CC=460 | AVM | ||
| subsys_id (bootenv) | TODO | AVM | |||||
| sysfrequency | 94 | 4.07 - 7.27 | 146 | 1.63 - 7.39 | The clock frequency to derive various subsystem clocks in the SoC | 0x0193=403 | TI |
| systype | 55 | 1.63 - 7.04 | TODO | 0x019E=414 | TI | ||
| tr069_passphrase | 63 | 4.52 - 7.29 | 136 | 4.28 - 7.39 | A 12-digit random password for TR-069 provisioning (anon) | 0x01C1=449 | AVM |
| tr069_serial | 63 | 4.52 - 7.29 | 136 | 4.28 - 7.39 | A box idenfier for TR-069 provisioning, derived from macdsl (anon). | 0x01C0=448 | AVM |
| urlader-version | 94 | 4.07 - 7.27 | 146 | 1.123 - 7.39 | The Bootloader version in integer notation. Discontinued for new models | 0x01FD=509 | AVM |
| usb_board_mac | 126 | 4.07 - 7.30 | 146 | 1.63 - 7.39 | The MAC address of the USB-NDIS port - box side - usbrndis (anon) | 0x0194=404 | TI |
| usb_device_id | 116 | 4.07 - 7.29 | 146 | 1.63 - 7.39 | The minor part of the USB-ID used to introduce the USB-NDIS port to a PC | 0x01A2=418 | AVM |
| usb_device_name | 115 | 4.07 - 7.29 | 146 | 1.63 - 7.39 | The device name used to introduce the USB-NDIS port to a PC | 0x01A4=420 | AVM |
| usb_manufacturer_name | 119 | 4.07 - 7.29 | 146 | 1.63 - 7.39 | The manufacturer name used to introduce the USB-NDIS port to a PC | 0x01A5=421 | AVM |
| usb_revision_id | 116 | 4.07 - 7.29 | 146 | 1.63 - 7.39 | The revision of the of the USB-ID used to introduce the USB-NDIS port to a PC. | 0x01A3=419 | AVM |
| usb_rndis_mac | 129 | 4.07 - 7.30 | 146 | 1.63 - 7.39 | The MAC address of the USB-NDIS port - PC side (anon) | 0x0195=405 | TI |
| webgui_pass | 40 | 4.68 - 7.29 | 124 | 4.49 - 7.39 | An 8-digit random password for the Webinterface as written on the Type-Plate (anon). | 0x01C2=450 | AVM |
| wlan_cal (bootenv) | 15 | 4.33 - 4.90 | 146 | 3.85 - 7.39 | WLAN calibration table created during Factory-Test of 31xx/71xx/80xx models | 0x01B8=440 | AVM |
| wlan_key | 118 | 4.07 - 7.30 | 146 | 1.120 - 7.39 | A 16-digit initial WLAN key for WPA. 24-digits for old models and WEP (anon). | 0x01AB=427 | AVM |
| wlan_ssid | 41 | 6.25 - 7.30 | 63 | 6.98 - 7.39 | The initial WLAN SSID, the model's name and 2 extra random characters. White space encoded as '#' (anon). | 0x01C8=456 | AVM |
| 96 variables | |||||||
Missing Supportdata
The data in this article is incomplete due to missing Supportdata-Probes for the models listed below.
If you own any of these models and would like to help then please get in touch.
| Model | Method | Info |
|---|---|---|
| FRITZ!Box WLAN 3270 IT | lua | http://fritz.box/support.lua |
| FRITZ!Box Fon ata | html | http://fritz.box/html/support.html |
| FRITZ!Box Fon ata 1020 | html | http://fritz.box/html/support.html |
| FRITZ!Box Fon 5010 | html | http://fritz.box/html/support.html |
| FRITZ!Box Fon 5012 | html | http://fritz.box/html/support.html |
| FRITZ!Box Fon 5113 | html | http://fritz.box/html/support.html |
| FRITZ!Box 6690 Cable | lua | http://fritz.box/support.lua |
| FRITZ!Box Fon WLAN 7113 INT | html | http://fritz.box/html/support.html |
| Speedport W 501V | telnet | |
| Speedport W 722V | console | |
| Eumex 300 IP | telnet | |
| 11 models without supportdata probes | ||
