Understanding the boot loader on a computer system is probably the most important aspect of security. Most computer systems have multiple boot loaders that run in sequence immediately after a power reset is applied to the processor on the computer system. This applies to embedded, desktop, and server systems.
The boot sequence on a Cyclone V HPS works like this:
The On-chip ROM (for which source code is not provided) loads the preloader (1st stage bootloader). The preloader then loads U-boot. U-boot then loads the kernel and root file system.
There are two well thought out options for the preloader according to the Cyclone V boot guide. The two options are licensed differently depending on how the source code is built. One is licensed under a BSD license and the other under GPL v2 with U-Boot.
The preloader settings directory can be found on the DE0-Nano-SoC CD in the DE0_NANO_SOC_GHRD subdirectory.
After the sources are generated and the preloader image is built using the Makefile, U-boot must be compiled. An Altera port of U-Boot is available on github for the Cyclone V FPGA SoC. U-Boot is built using the Linaro ARM cross toolchain.
There's quite a bit that can be done with the Cyclone V FPGA SoC boot configuration. FPGA images can be loaded from U-boot. The jumpers on the board can be configured to boot from the on-board serial flash (QSPI), bare metal applications can be loaded from the preloader, the FPGA can be configured from serial flash, and the list goes on. The HPS SoC Boot Guide for the Cyclone V SoC is a valuable reference and contains all of the boot configuration information.