A walk through for installing mb_boot_tv onto an Apple TV.

James McKenzie,

We are planning to start offering dedicated hosting on Apple TVs shortly, check our services soon for prices.

You can now run mb_boot_tv without even opening the case of the Apple TV using a USB stick. The Apple TV will on detecting the stick, run mb_boot_tv and then will net-boot Linux - instructions here.

Prerequisites

a T10 torx screwdriver.
a T8 torx screwdriver.
some way to connect a 44 pin 2.5 inch parallel ATA hard disk to a Linux computer (eg a 44pin to 40pin cable and a Linux PC with a spare PATA port, or an IDE to USB adaptor)
a copy of the current mb_boot_tv binary
support for EFI GPT (partition tables) on your Linux machine (CONFIG_EFI_PARTITION), and support for writing to the HFS+ file system (CONFIG_HFSPLUS_FS). Kernel 2.6.16 onwards seem to have write support.
A copy of fsck_hfs from Darwin compiled for Linux. (Your distribution may contain this in the package hfsplus-tools, or you can follow the instructions below to build it

Step 1 open the case, remove the disk and connect it to your Linux machine

I apologise for the quality of the photos, I used a friend's point and shoot camera, rather than my SLR.
Click on the photos for larger versions

	Opening the case is a real cinch, carefully peel off the grey rubber mat on the bottom of the apple TV to reveal 8 screws. I found that the sticky goo used to hold it on is soluble in turpentine, obviously only use solvents once you've removed the disk.
	The four T10 at the corners hold the metal base plate to the top of the case, the remaining four T8 hold the disk to the base plate. Unscrew the four T10 corner screws.
	Carefully separate the two halves. Watch out for the IDE cable, which joins the disk (connected to the base) to the board (connected to the top). Unplug the disk and set aside the top half; there's a handy pull strap to help you unplug the cable, but remember to pull evenly from the centre of the connector.
	Then remove the 4 T8 screws securing the disk. The disk has a green thermal pad stuck to its base which adheres to the metal base plate, you may need to apply a small quantity of force to un-stick it from the bottom of the case. Having done that, remove the other end of the IDE cable.
	Connect the disk your adaptor, note carefully where pin 1 goes. There's a lot to get wrong at this step. Make sure the power pins are on the left hand side of the disk, and make sure the pins are correctly aligned with the connector and not off by out.
	Connect the disk to your Linux machine, (If you're using PATA as I am, you'll obviously need to power your linux machine off for this step)

Step 2 backup your Apple TV

If you ever want to revert or if you screw up, you'll need a backup of the original contents of the disk. You'll need about 2.5-3Gb of free space. Examine the dmesg output from your Linux machine's boot to find the name of the disk, or if you used a USB or Firewire adaptor.

[root@banana ~]# dmesg
...
VP_IDE: VIA vt8235 (rev 00) IDE UDMA133 controller on pci0000:00:11.1
    ide0: BM-DMA at 0xe000-0xe007, BIOS settings: hda:DMA, hdb:pio
    ide1: BM-DMA at 0xe008-0xe00f, BIOS settings: hdc:DMA, hdd:pio
Probing IDE interface ide0...
[...]
Probing IDE interface ide1...
hdc: FUJITSU MHW2040AT, ATA DISK drive
ide1 at 0x170-0x177,0x376 on irq 15
hdc: max request size: 512KiB
hdc: 78140160 sectors (40007 MB) w/2048KiB Cache, CHS=16383/255/63, UDMA(33)
hdc: cache flushes supported
hdc: hdc1 hdc2 hdc3 hdc4

Here the disk's been found as hdc (if you only see one partition on the disk you need to make sure your kernel is compiled to support the EFI partition scheme CONFIG_EFI_PARTITION). Check it's the right disk with parted

[root@banana ~]# parted /dev/hdc print
Disk geometry for /dev/hdc: 0.000-38154.375 megabytes
Disk label type: gpt
Minor    Start       End     Filesystem  Name                  Flags
1          0.020     34.019  fat32       EFI                   boot
2         34.020    433.996              Recovery              
3        433.996   1333.992              OSBoot                
4       1333.992  38026.375              Media                 
[root@banana ~]#

You should have an EFI, Recovery, OSBoot and Media partitions. Next backup the disk:

[root@banana ~]# gzip -1 < /dev/hdc > appletv-backup.img.gz
[.. long dull wait ...]
[root@banana ~]# ls -l appletv-backup.img.gz
-rw-r--r--  1 root root 2681076104 Apr 18 22:54 appletv-backup.img.gz
[root@banana ~]# gzip -tv appletv-backup.img.gz
appletv-backup.img.gz:	OK
[root@banana ~]#

Now you're almost ready to break things, but first you need to make sure you have a copy of the apple fsck for apple file systems compiled to run on Linux. Your distribution may already package it in the hfsplus-tools package, or you can download a static binary, or follow the instructions below to compile your own. If you already have it skip to the actual installation.

[root@banana ~]# mkdir -p /usr/local/src/
[root@banana ~]# wget http://darwinsource.opendarwin.org/tarballs/apsl/diskdev_cmds-332.14.tar.gz [or a local copy]
--11:29:45--  http://darwinsource.opendarwin.org/tarballs/apsl/diskdev_cmds-332.14.tar.gz      
           => `diskdev_cmds-332.14.tar.gz'
Resolving darwinsource.opendarwin.org... 204.152.184.197
Connecting to darwinsource.opendarwin.org[204.152.184.197]:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 714,035 [application/x-tar]

100%[====================================>] 714,035       14.51K/s    ETA 00:00

11:32:22 (4.60 KB/s) - `diskdev_cmds-332.14.tar.gz' saved [714,035/714,035]

[root@banana src]# wget http://www.ecl.udel.edu/~mcgee/diskdev_cmds/diskdev_cmds-332.14.patch.bz2       [or a local copy]
--11:33:04--  http://www.ecl.udel.edu/%7Emcgee/diskdev_cmds/diskdev_cmds-332.14.patch.bz2
           => `diskdev_cmds-332.14.patch.bz2'
Resolving www.ecl.udel.edu... 128.4.60.10
Connecting to www.ecl.udel.edu[128.4.60.10]:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 20,960 [text/plain]

100%[====================================>] 20,960         2.32K/s    ETA 00:00

11:33:20 (2.32 KB/s) - `diskdev_cmds-332.14.patch.bz2' saved [20,960/20,960]

[root@banana src]# tar xfz diskdev_cmds-332.14.tar.gz
[root@banana src]# cd diskdev_cmds-332.14
[root@banana diskdev_cmds-332.14]# bzcat ../diskdev_cmds-332.14.patch.bz2 | patch -p1
patching file Makefile.lnx
patching file fsck_hfs.tproj/Makefile.lnx
patching file fsck_hfs.tproj/cache.c
[...]
patching file newfs_hfs.tproj/newfs_hfs.c
patching file newfs_hfs.tproj/newfs_hfs.h
[root@banana diskdev_cmds-332.14]# make -f Makefile.lnx 
for d in newfs_hfs.tproj fsck_hfs.tproj; do make -C $d -f Makefile.lnx all; done
make[1]: Entering directory `/usr/local/src/diskdev_cmds-332.14/newfs_hfs.tproj'
gcc -g3 -Wall -I/usr/local/src/diskdev_cmds-332.14/include -DDEBUG_BUILD=0 -D_FILE_OFFSET_BITS=64 -D LINUX=1 -D BSD=1   -c -o hfs_endian.o hfs_endian.c
[...]
make[2]: Leaving directory `/usr/local/src/diskdev_cmds-332.14/fsck_hfs.tproj/dfalib'
gcc   fsck_hfs.o strings.o utilities.o cache.o dfalib/libdfa.a   -o fsck_hfs
make[1]: Leaving directory `/usr/local/src/diskdev_cmds-332.14/fsck_hfs.tproj'
[root@banana diskdev_cmds-332.14]# install -m 755 fsck_hfs.tproj/fsck_hfs /sbin/fsck_hfs
[root@banana diskdev_cmds-332.14]# ln -sf fsck_hfs /sbin/fsck.hfs
[root@banana diskdev_cmds-332.14]# ln -sf fsck_hfs /sbin/fsck.hfsplus
[root@banana diskdev_cmds-332.14]#

Next you need to install mb_boot_tv into the main OSX partition, and the recovery partition. [You have to do both, because at the moment the firmware in the Apple TV doesn't think Linux successfully boots the machine and periodically will boot to the recovery image] So going with the disk being called hdc as above (yours might be called something different). Check the partitions again, and proceed to mount the main OSX partition.

[root@banana ~]# wget http://www.mythic-beasts.com/resources/appletv/mb_boot_tv/mb_boot_tv.gz
--01:59:19--  http://www.mythic-beasts.com/resources/appletv/mb_boot_tv/mb_boot_tv.gz
           => `mb_boot_tv.gz'
Resolving www.mythic-beasts.com... 131.111.64.221
Connecting to www.mythic-beasts.com[131.111.64.221]:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 30,288 [application/x-gzip]

100%[====================================>] 30,288       118.00K/s             

01:59:19 (117.55 KB/s) - `mb_boot_tv.gz' saved [30,288/30,288]

[root@banana ~]# gzip -dv mb_boot_tv.gz 
mb_boot_tv.gz:   60.3% -- replaced with mb_boot_tv
[root@banana ~]# chmod 755 mb_boot_tv
[root@banana ~]# ls -l mb_boot_tv 
-rw-r--r--  1 root root 78160 Apr 26 01:50 mb_boot_tv
[root@banana ~]# parted /dev/hdc print 
Disk geometry for /dev/hdc: 0.000-38154.375 megabytes
Disk label type: gpt
Minor    Start       End     Filesystem  Name                  Flags
1          0.020     34.019  fat32       EFI                   boot
2         34.020    433.996              Recovery              
3        433.996   1333.992              OSBoot                
4       1333.992  38026.375              Media                 
[root@banana ~]# fsck_hfs -f /dev/hdc3
** /dev/hdc3
** Checking HFS Plus volume.
** Checking Extents Overflow file.
** Checking Catalog file.
** Checking multi-linked files.
** Checking Catalog hierarchy.
** Checking volume bitmap.
** Checking volume information.
** The volume OSBoot appears to be OK.
[root@banana ~]# mkdir -p /mnt/tv
[root@banana ~]# mount -t hfsplus -o force /dev/hdc3 /mnt/tv

if your mount command fails, check dmesg for a messages of the form:

Apr 23 14:14:43 banana kernel: HFS+-fs: unable to parse mount options

if you get one that means your kernel's too old to support mounting hfs+ file systems read-write, so upgrade it. 2.6.16 or later works.
Next copy the boot loader to the OSX partition.

[root@banana ~]# cp mb_boot_tv /mnt/tv/mb_boot_tv
[root@banana ~]# ls /mnt/tv
Applications  dev        mach                 Network      System  var
bin           Developer  mach_kernel.prelink  private      tmp     Volumes
Desktop DB    etc        mb_boot_tv           sbin         Users
Desktop DF    Library    mnt                  SeedScratch  usr
[root@banana ~]#

Edit the boot loader configuration file in /mnt/tv/System/Library/CoreServices/com.apple.Boot.plist, and change the bit which says:

<key>Kernel</key>
<string>mach_kernel</string>
<key>Kernel Cache</key>
<string>mach_kernel.prelink</string>

to instead read

<key>Kernel</key>
<string>mb_boot_tv</string>

Unmount the file system and proceed to mount the recovery file system and install the boot loader

[root@banana ~]# umount /dev/hdc3
[root@banana ~]# fsck_hfs -f /dev/hdc2
** /dev/hdc2
** Checking HFS Plus volume.
** Checking Extents Overflow file.
** Checking Catalog file.
** Checking Catalog hierarchy.
** Checking volume bitmap.
** Checking volume information.
** The volume Recovery appears to be OK.
[root@banana ~]# mount -t hfsplus -o force /dev/hdc2 /mnt/tv
[root@banana ~]# cp mb_boot_tv /mnt/tv/mb_boot_tv
[root@banana ~]# ls /mnt/tv
boot.efi      com.apple.Boot.plist  Desktop DF           mb_boot_tv
BootLogo.png  Desktop DB            mach_kernel.prelink  OS.dmg
[root@banana ~]#

Edit the boot loader configuration file in /mnt/tv/com.apple.Boot.plist, and again change the bit which says:

<key>Kernel</key>
<string>mach_kernel</string>
<key>Kernel Cache</key>
<string>mach_kernel.prelink</string>

to instead read

<key>Kernel</key>
<string>mb_boot_tv</string>

Unmount the file system

[root@banana ~]# umount /mnt/tv

At this point your boot loader is installed, and the machine will net-boot when you put the disk back into the Apple TV. If you want to install an operating system now is the time to do it. See the Getting Linux onto your Apple TV walk through. or the Configuring you server to net-boot mb_boot_tv.