Warning! The following is pure speculation from my side. The secondstage bootloader is undocumented and no sources are available. See Second stage loader for my repeated attempts to get DMM to release the sources. Despite the promise by tmbinc in February that the sources will be commited "soon", there's been nothing so far.
I'm basing my answers on the last public version of the secondstage for the 7020, build 28. Although those sources are also offline, I still have a copy.
ZitatOriginal von thowi
Could therefore somebody give me a hint where and how it actually stores its config when you do a save and reboot within the bootloader ?
The configuration used to be stored in NVRAM on (or close to) the front processor. I would be surprised if there are major differences between the 7020 FP and the 7025 FP. As far as I can remember there also used to be some crypto stuff going on to access the config data... Unless DMM will release some API for it, it could be a bit tricky to write a driver to access and manipulate this data.