The boot loader has been introduced as a small extra application that uses an existing interface (for example, UART or Ethernet) to provide self-programming capabilities. On the AVR, a boot loader section of 256 bytes to 4 KB can be reserved in its flash. This code can perform any number of user-defined tasks, from setting up a serial link with a remote system, to booting from a remote image over Ethernet using PXE.

At its core, an AVR boot loader is no different from any other AVR application, except that when compiling it one extra linker flag is added to set the starting byte address for the boot loader:

--section-start=.text=0x1800 

Replace this address with a similar one for the specific MCU that you're using (for AVR depending on the BOOTSZ flags set and controller used, see datasheet table about Boot Size Configuration: Boot Reset Address, where, for example, the boot reset address is 0xC00 is in words and the section start is defined in bytes). This ensures that the boot loader code will be written to the proper location in the MCU's ROM. Writing the boot loader code to the ROM is almost always done via ISP.

AVR MCUs divide the flash ROM into two sections: the no-read-while-write (NRWW) (for most, if not all application memory space) and read-while-write (RWW) sections. In brief, this means that the RWW section can be safely erased and rewritten without affecting the CPU's operation. This is why the boot loader resides in the NRWW section and also why it's not easy to have the boot loader update itself.

Another important detail is that the boot loader can also not update the fuses that set various flags in the MCU. To change these, one has to externally program the device.

After programming the MCU with a boot loader, one would generally set the flags in the MCU that let the processor know that a boot loader has been installed. In the case of AVR, these flags are BOOTSZ and BOOTRST.