Boot Process

The Apple TV has 4 partitions:

EFI System Partition	Wikipedia article
Restore:	Contains restore/boot disk image
OSBoot	Contains System Software
Media	Holds iPod-esque file structure

Restore is the boot partition.

1: The Apple TV checks/runs the boot.efi file at Restore/boot.efi, which checks Restore/com.apple.Boot.plist for boot parameters:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>Background Color</key>
	<integer>0</integer>
	<key>Boot Fail Logo</key>
	<string></string>
	<key>Boot Logo</key>
	<string>BootLogo.png</string>
	<key>Kernel</key>
	<string>mach_kernel</string>
	<key>Kernel Cache</key>
	<string>mach_kernel.prelink</string>
	<key>Kernel Flags</key>
	<string>rp=file:///OS.dmg</string>
</dict>
</plist>

As far as I can tell, Kernel: mach_kernel is never used.

2: Kernel Cache: mach_kernel.prelink is quickly loaded into RAM. This is why the AppleTV boots so quickly - no need for driver detection. It is a collection of files compressed with LZSS.

3: From Kernel Flags: rp=file:///OS.dmg, the disk image Restore/OS.dmg becomes the system root. This is where/when critical system components are loaded.

4: Later, effective root gets changed to OSBoot/, albeit as a read-only filesystem. There are many symbolic links that lead to Media/Scratch to accommodate settings changes and updates to the running system.

Testing so far

SSE2-compatible kernel placed at Restore/mach_kernel.

Kernel Flags: rp=file:///OS.dmg changed to Kernel Flags: rd=disk0s3. This changes the system root from Restore/OS.dmg to OSBoot. An SSE2-compatible Mac OS X system can be placed here, and its kernel boots, but hangs at trying to launch loginwindow. The original Apple TV mach_kernel.prelink cached kernel seems to have settings that interfere with "normal" operation.

Kernel Cache: mach_kernel.prelink removed from com.apple.Boot.plist, boot fails with an "Apple TV Question Mark" icon. Apple-S boot shows missing kernel caches.

Kernel Flags: -v this enables verbose boot mode

Replacing boot.efi it with a stock 10.4.9 boot.efi causes boot to completely fail with an "Apple TV Question Mark" icon.