How does "fastboot boot <kernel>" works internally?

Question

Fastboot has the following handy feature (if booting the custom image fails, the device just magically boots the default image next time, and all's gonna be alright):

To boot with a host-side kernel image

This command allows you to download a kernel image (and optional root filesystem image) and boot the phone with those, instead of using the kernel and rootfs in the boot flash partition. It is very useful while developing a kernel or modifying the rootfs.

fastboot boot < kernel > [ < ramdisk > ]

Does anyone know how it internally works? Is the kernel copied to a special boot partition before rebooting the device? (UPDATE: As the answer points out, there is no reboot, as fastboot is a step in the boot process, which basically makes my question meaningless.) I was looking into the source code of fastboot, but it seems it contains only what happens on the host side, and not on the device.

I mean, how the flashing feature works is pretty easy, I can imitate it by just copying a boot image with a custom kernel to the boot partition, e.g., via:

dd if='<my_boot.img>' of='/dev/block/platform/msm_sdcc.1/by-name/boot'

Btw: I am asking the question because of an app I am developing; I'd like to "risk free" boot a custom kernel directly from the device, where it is stored e.g. on the SD-card.

Unrealizable

Answer 1

Is the kernel copied to a special boot partition before rebooting the device?

No, there would be no modification to any partition.
Booting a kernel means loading (i.e. reading into memory) the kernel image from a storage device. This fastboot is similar to a netboot, e.g. the kernel image is loaded from a server/host over an Ethernet link using TFTP. If the sole intent is to boot the system using the kernel image, then there is simply no reason to also write the kernel image to a partition, especially when one has not been explicitly specified.

The optional root filesystem of this operation is clearly specified as a ramdisk image, which would also not require writing to or storage in a partition.

Does anyone know how it internally works?

The fastboot program is an alternate bootloader that executes after you reboot the device.
The kernel in loaded from the host over USB into memory. The optional rootfs (a ramdisk or maybe an initramfs image) can also be loaded from the host over USB into memory. Once loaded, an ordinary kernel boot can commence.

Btw: I am asking the question because of an app I am developing; I'd like to "risk free" boot a custom kernel directly from the device, where it is stored e.g. on the SD-card

You'll probably have to use some other bootloader/method than this fastboot.

Algerian

I was falsely assuming that the device reboots again after fastboot mode; but it makes perfect sense that the device just proceeds with the next boot step, by using the kernel copied to memory. Thanks for clarification! So my idea of booting once from the device is probably hard to achieve, or at least an error prone task, as a custom bootloader is something device specific? – Unrealizable

Yes, bootloaders are typically device/board specific. Fastboot seems to be a GUI frontend to the phone's actual bootloader, perhaps U-Boot. Try playing with the getvar command with various U-Boot environment variables such as bootargs and bootcmd. Does the devices command report the detection of an SDcard (U-Boot might call it mmc instead of SDcard)? – Algerian

Why don't you just boot your custom kernel over fastboot? The bonus is that if it doesn't work, you can just reboot into the working kernel on storage. – Certitude