The Apple TV has 4 partitions:
|EFI System Partition||Wikipedia article|
|Restore:||Contains restore/boot disk image|
|OSBoot||Contains System Software|
|Media||Holds iPod-esque file structure|
Restore is the boot partition.
1: The Apple TV checks/runs the boot.efi file at Restore/boot.efi, which checks Restore/com.apple.Boot.plist for boot parameters:
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Background Color</key> <integer>0</integer> <key>Boot Fail Logo</key> <string></string> <key>Boot Logo</key> <string>BootLogo.png</string> <key>Kernel</key> <string>mach_kernel</string> <key>Kernel Cache</key> <string>mach_kernel.prelink</string> <key>Kernel Flags</key> <string>rp=file:///OS.dmg</string> </dict> </plist>
As far as I can tell, Kernel: mach_kernel is never used.
2: Kernel Cache: mach_kernel.prelink is quickly loaded into RAM. This is why the AppleTV boots so quickly - no need for driver detection. It is a collection of files compressed with LZSS.
3: From Kernel Flags: rp=file:///OS.dmg, the disk image Restore/OS.dmg becomes the system root. This is where/when critical system components are loaded.
4: Later, effective root gets changed to OSBoot/, albeit as a read-only filesystem. There are many symbolic links that lead to Media/Scratch to accommodate settings changes and updates to the running system.
Testing so far
SSE2-compatible kernel placed at Restore/mach_kernel.
Kernel Flags: rp=file:///OS.dmg changed to Kernel Flags: rd=disk0s3. This changes the system root from Restore/OS.dmg to OSBoot. An SSE2-compatible Mac OS X system can be placed here, and its kernel boots, but hangs at trying to launch loginwindow. The original Apple TV mach_kernel.prelink cached kernel seems to have settings that interfere with "normal" operation.
Kernel Cache: mach_kernel.prelink removed from com.apple.Boot.plist, boot fails with an "Apple TV Question Mark" icon. Apple-S boot shows missing kernel caches.
Kernel Flags: -v this enables verbose boot mode
Replacing boot.efi it with a stock 10.4.9 boot.efi causes boot to completely fail with an "Apple TV Question Mark" icon.