2015 International Conference on Computer Science and Applications
Design Optimization and Implementation of Bootloader in Embedded System
Development
Chen Sha
Software institute, Beijing University of Technology
Beijing Engineering Research Center for IoT Software
and Systems
Beijing, China
e-mail: 770430056@qq.com
Abstract—Bootloader is an important part of ARM embedded
system. The realization of Bootloader is closely related with
hardware. This paper gives a brief introduction to S3C2440
development board and its starting mode. Mainly introduces
the initialization of the each function module in S3C2440
during the system startup, and scheme out the Simplified
Bootloader for S3C2440. After testing, This Bootloader has
good practicability and portability.
Keywords-ARM; Bootloader; embedded system; starting
mode
I. INTRODUCTION
Every computer system has its own bootloader. Like
Windows system requires BIOS boot program, embedded
systems also need boot program. Unlike the BIOS in
Windows systems which is boot by firmware, the boot
process of embedded systems is done by developers due to
economic considerations, which is the boot program called
the Bootloader [1]. Bootloader is a piece of the boot
program. It usually executes after the system is powered on,
which is used to initialize the hardware devices, set the
appropriate software environment, and finally start the
operating system kernel. For different types of demoboard,
their hardware configuration varies. Therefore, Bootloader
is needed for each type of the bare boards according to their
hardware features. This paper introduces various functional
modules’ initialization during S3C2440 boot process, and
designs a suitable thin Bootloader for S3C2440.
Bootloader’s boot program is the first program to be
executed in an embedded system. It can initialize the system
hardware, relocate the Bootloader from the Flash to
SDRAM, establish SDRAM memory image map, and set
some environment parameters to pass to the operating
system kernel, and finally jumps to the location of the
kernel in the memory to start the kernel.
II. S3C2440 DEMOBOARD INTRODUCTION
S3C2440 is a chip produced by Samsung, which is
based on an ARM920T core 16/32-bit embedded RISC
microprocessor and belongs to ARMv4T instruction set. It is
primarily used for handheld devices as well as high cost and
low-power consumption applications. Its operating
frequency is up to 203 MHz. It is developed using 0.13um
978-1-4799-9961-3/15 $31.00 © 2015 IEEE
DOI 10.1109/CSA.2015.37
Zhu-ying Lin
Software institute, Beijing University of Technology
Beijing Engineering Research Center for IoT Software
and Systems
Beijing, China
e-mail: zhuying_lin@bjut.edu.cn
CMOS standard cell and a memory compiler, and adopted a
new bus architecture which is called the Advanced
Microcontroller Bus Architecture (AMBA).
A. S3C2440 Demoboard Configuration
S3C2440 is a S3C2440A-40 processor-based demoboard.
Its internal resources includes Hitachi 4.3-inch touch screen
LCD, 8bit width 256M NAND FLASH, 2MB NOR FLASH,
32bit width 64M SDRAM, 7-12V wide voltage input,
LT1765 high efficiency DC / DC buck, standard 12V power
supply, as well as 100Mbps low power embedded Ethernet
network chips DM9000A [2].
B. S3C2440 Demoboard Boot Mode
For S3C2440 demoboard can boot in two ways: NAND
and NOR boot mode, which can be adjusted by the toggle
switch on the board.
The NOR mode is when the board is powered on, the
address 0 "saw" by CPU is the address 0 on the NOR
FLASH. That is when using NOR mode, CPU can run
directly from NOR FLASH address 0 when the board is
powered on. Therefore, the Bootloader can be burned
directly onto NOR FLASH address 0. Hence, when you
start the demoboard, Bootloader’s boot program will start
from NOR FLASH address 0. But NOR FLASH has some
drawbacks, which is that it can read data like reading
SDRAM memory, but cannot write to an address in NOR
FLASH like writing to SDRAM memory.
The NAND mode is when the board is powered on,
NAND FLASH accesses the control interface and 4KB of
data is automatically copied from NAND FLASH address 0
to the first 4KB address space of the on-chip RAM of 2440.
This space is usually referred to as 4KB "Steppingstone".
Therefore, the address 0 “saw” by CPU is the address 0 in
RAM on 2440 chip. Hence, the Bootloader can be burned
directly onto NAND FLASH address 0. When the board
starts, it will automatically copy the first 4KB code of the
Bootloader to 2440’s RAM for execution [2].
III. BOOT PROCESS AND IMPLEMENTATION
A. Boot Process Analysis
Bootloader program is composed of the assembler code
and C code. Its execution is also divided into two phases.
The first phase executes the assembly code, which mainly
150
151
executes hardware-related operations including close the (0x01 << 4) | (0x01))
watchdog, set the system clock, start ICACHE, initialize ldr r0, = 0x4c000014
SDRAM, and relocate the Bootloader from the NAND // FCLK: HCLK: PCLK = 1: 4: 8
FLASH or NOR FLASH to SDRAM. The second phase is mov r1, # 0x05
to set some environment parameters, and jumps to the str r1, [r0]
location of the kernel in the memory to start the kernel [3].
The boot process of the Bootloader is shown in Figure 1. / * Read the contents of the coprocessor to registers r1 *
/
mrc p15, 0, r1, c1, c0, 0
/ * Set to "asynchronous bus mode" * /
orr r1, r1, # 0xc0000000
/ * Write the contents of register r1 to the coprocessor * /
mcr p15, 0, r1, c1, c0, 0

ldr r0, = 0x4c000004

/ * Set the frequency to 400MHZ * /
ldr r1, = S3C2440_MPLL_400MHZ
str r1, [r0]

/ * Read the contents of the coprocessor to registers r0 *

/
mrc p15, 0, r0, c1, c0, 0
/ * Start ICACHE * /
orr r0, r0, # (1 << 12)
/ * Write the contents of register r0 to the coprocessor * /
mcr p15, 0, r0, c1, c0, 0
c) Initialize SDRAM
By setting Memory Controllers’ registers, thereby
initializing the SDRAM’s functions. Registers which need
to be set is shown in Figure 2.

Figure 1. Boot process of the Bootloader

B. Analysis and Implementation of the Bootloader

1) First Phase of the Bootloader
a) Close Watchdog
2440 chip’s watchdog is turned on by default, so the first
is to close the watchdog, otherwise the program will restart.
The watchdog’s register WTCON’s address is 0x53000000.
Write 0 to register WTCON to turn off the watchdog,
detailed code is as follows:
ldr r0, =0x53000000
mov r1, #0
str r1, [r0]
b) Set the clock
When setting the clock, it should go through the
following steps. First, set register CLKDIVN to set system’s Figure 2. Memory Controllers’ Registers
FCLK, HCLK, PCLK to 1: 4: 8, and then, by setting the
coprocessor change CPU bus mode from "fast bus mode" to d) Relocation
"asynchronous bus mode". Then set register MPLLCON The relocation process is to relocate the Bootloader from
which sets the system frequency to 400MHZ [2]. Finally the FLASH to SDRAM. We must first initialize the NAND
start ICACHE. Detailed code is as follows: FLASH. Then, judge whether the Bootloader is in the
#define S3C2440_MPLL_400MHZ ((0x5c << 12) | NAND FLASH or in the NOR FLASH. If it is in the NOR

152
151
FLASH, then read the data directly from the NOR FLASH Bootloader program’s link script is defined as:
as reading from the memory into the SDRAM. If it is in the SECTIONS {
NAND FLASH, you need to follow the NAND FLASH . = 0x33f80000;
timing requirements for reading. .text : { *(.text) }
For NAND FLASH initialization, follow 2440 chip’s . = ALIGN(4);
manual and operate register NFCONF and NFCONT. .rodata : {*(.rodata*)}
NAND FLASH’s reading operation is slightly . = ALIGN(4);
complicated, detailed operation procedures is shown in .data : { *(.data) }
Figure 3. . = ALIGN(4);
__bss_start = .;
.bss : { *(.bss) *(COMMON) }
__bss_end = .;
}

Therefore, it can be seen that when running Bootloader,

it should be located in SDRAM at address 0x33f80000. And
sequentially store code snippets, read-only data segment,
data segment, and BSS segment. The workflow of the
relocation operation of the Bootloader is shown in Figure 4.

Figure 3. NAND FLASH’s Reading Operation

Figure 4. Bootloader relocation operation workflow

153
152
 e) Set Serial Port
After the kernel is boot, information will be printed
out, so the serial port settings needs to be done. Initialize
the serial ports according to 2440 chip’s manual, and add
functionality to print characters and strings. Details is as Figure 5. uImage structure
follows:
/* In the image file uImage, zImage is the actual kernel.
* Initialize UART0 So the actual kernel should be the storage location of
* 115200,8N1, no flow control uImage plus 64 bytes. Kernel size will not exceed 2MB.
*/ If the kernel is stored in the NAND FLASH
void uart0_init (void) (previously stored at address 0x60000), read 2MB data
{ from the NAND FLASH at address 0x60000 + 64 to
// GPH2, GPH3 used as TXD0, RXD0 address 0x30008000 in SDRAM.
GPHCON | = 0xa0; If the kernel is stored in the NOR FLASH (previously
// GPH2, GPH3 internal pullup stored at address 0), read 2MB data from NOR FLASH at
GPHUP = 0x0c; address 0 + 64 to address 0x30008000 in SDRAM [5].
// 8N1 (8 data bits, no check, 1 stop bit)
b) Set parameters
ULCON0 = 0x03;
Passing parameters from the Bootloader to the kernel
// Query, UART clock source is PCLK
is done by tag structure, and it needs to set up four type of
UCON0 = 0x05;
tags, which are the start tag, memory tag, command line
// Do not use the FIFO
tag, and end tag. The command line tag is the most
UFCON0 = 0x00;
important tag, expressed as "noinitrd root = / dev /
// Do not use flow control
mtdblock3 init = / linuxrc console = ttySAC0".
UMCON0 = 0x00;
Tags are expressed in the form of tag, whose structure
// 115200 baud rate
is shown in Figure 6.
UBRDIV0 = UART_BRD;
}

/ * Send a character * /
void putc (unsigned char c)
{
/ * Wait until the all data in the buffer is sent * /
while ((UTRSTAT0 & TXD0READY)!);
/ * Write data to UTXH0 register, UART
automatically sends it out * /
UTXH0 = c;
}

/ * Print a string * /
void puts (char * str)
{
int i = 0;
while (str [i])
{
putc (str [i]); Figure 6. tag structure
i ++;
} Each tag uses the tag header structure as the starting
} part. The tag_header structure is shown in Figure 7.
f) Execution of the main function
Jump to the main function to perform the second
phase of the operation, i.e., execute:
ldr pc, = main
Figure 7. Tag header structure
2) Second Phase of the Bootloader
a) Reads kernel from FLASH to SDRAM The core of the start tag is constituted by tag core
The detailed structure of the kernel image file uImage structure, which is shown in Figure 8.
is shown in Figure 5.

154
153

Figure 8. tag_core structure
The core of the memory tag is constituted by
tag_mem32 structure, which is shown in Figure 9.
Figure 9. tag_mem32 structure
The core of the command line tag is constituted by
tag_cmdline structure, which is shown in Figure 10.
c) Load kernel
The kernel is stored at address 0x30008000 in
SDRAM, and the machine ID is 362, so the kernel is boot
as follows:
void (* theKernel) (int zero, int arch, unsigned int
params);
puts ("Boot kernel \ n \ r");
theKernel = (void (*) (int, int, unsigned int))
0x30008000;
theKernel (0, 362, 0x30000100);
IV. PROGRAMMING VERIFICATION
The Bootloader is programmed into the NAND
FLASH or NOR FLASH, and some of the printed
information after boot is shown in Figure 12.

Figure 10. tag_cmdline structure

Position of the tag is set at address 0x30000100 in

SDRAM. Detailed memory map is shown in Figure 11.

Figure 12. Part of the printed information after starting the kernel

After verification, the Bootloader implemented in this

paper launches the Linux kernel successfully.
V. CONCLUSION
The Bootloader implemented in this article is
debugged and it can execute smoothly. It successfully
launched the operating system kernel. The practical
application shows that this Bootloader is streamlined,
removing the tedious downloading burning capabilities
and other setup functions. Thus, it has better real-time
performance, stability and portability. Meanwhile, from
the design process, the Bootloader's functional framework
which includes hardware initialization, relocation, kernel
startup and so on, is very clear. Readers can have better
grasp of the overall implementation process of the
Bootloader. Through the analysis of S3C2440's
Bootloader, it can be learned that a good design can
improve the real-time performance and stability of the
entire system. Therefore, Bootloader is an integral part of
embedded development.
REFERENCES
[1] WANG Jingcun, GAO Feng. Analysis and Design of Bootloader
Based on ARM9 [J].Embedded technology, 2010(02):44-46.
[2] WEI Dongshan. Embedded Linux application development
[M].Beijing: POSTS & TELECOM PRESS, 2008.
[3] ZHANG Wei, LIU Bi, Dong Qunfeng. U-Boot’S Transplantation
Figure 11. SDRAM memory map and Implementation Based on S3C2410 [J].The application of

155
154
 computer system, 2014, 23(9):204-207.
[4] Ruilong Deng, Jiming Chen, Jialu Fan, Youxian Sun. A general
approach for building Linux on sensor node Imote2 [J].Computer
Standards & Interfaces, 2011, 34(1):101-108.
[5] XIE Fei, JIANG Daming. Implementation of automatic
identification boot in U—Boot based on ARM9 [J].Electronic
design engineering, 2013, 21(3):54-56.
[6] Xiaoming Liu, Lian Pan. The Study of Target Tracking Based on
ARM Embedded Platform [J].Journal of Computers, 2012,
7(8):2015-2023.
[7] Liu Zhichao, Jing Qi. A way to verify running Linux Kernel
function [J].Microcomputer & Its Applications, 2014, 33(21):4-5.

156
155