The Apple TV has 4 partitions:
|EFI System Partition||Wikipedia article|
|Restore:||Contains restore/boot disk image|
|OSBoot||Contains System Software|
|Media||Holds iPod-esque file structure|
Restore is the boot partition.
1: The Apple TV checks/runs the boot.efi file at Restore/boot.efi, which checks Restore/com.apple.Boot.plist for boot parameters:
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Background Color</key> <integer>0</integer> <key>Boot Fail Logo</key> <string></string> <key>Boot Logo</key> <string>BootLogo.png</string> <key>Kernel</key> <string>mach_kernel</string> <key>Kernel Cache</key> <string>mach_kernel.prelink</string> <key>Kernel Flags</key> <string>rp=file:///OS.dmg</string> </dict> </plist>
As far as I can tell, Kernel: mach_kernel is never used.
2: Kernel Cache: mach_kernel.prelink is quickly loaded into RAM. This is why the AppleTV boots so quickly - no need for driver detection.
3: From Kernel Flags: rp=file:///OS.dmg, the disk image Restore/OS.dmg becomes the system root. This is where/when critical system components are loaded.
4: Later, effective root gets changed to OSBoot/, albiet as a read-only filesystem. There are many symbolic links that lead to Media/Scratch to accommodate settings changes and updates to the running system.
Testing so far
Kernel Cache: mach_kernel.prelink removed from com.apple.Boot.plist, SSE2-compatible kernel placed at Restore/mach_kernel.
Kernel Flags: rp=file:///OS.dmg changed to Kernel Flags: rd=disk0s3. This changes the system root from Restore/OS.dmg to OSBoot. An SSE2-compatible Mac OS X system can be placed here, and its kernel boots, but hangs at trying to launch loginwindow. The original Apple TV boot.efi seems to have settings that interfere with "normal" operation. Replacing it with a stock 10.4.9 boot.efi causes boot to completely fail with an "Apple TV Question Mark" icon.