171 bytes1
Wooohoooo! It took half the day, but it was fun...
So, here it is. I think it conforms to the specs (wraparound of cell pointer, echo of characters on input, reading char by char, echo of input chars, ...), and it seems to actually work (well, I didn't try many programs, but given the simplicity of the language, the coverage isn't that bad, I think).
Limitations
One important thing: if your brainfuck program contains other chars than the 8 brainfuck instructions, or if the [] are not well-balanced, it will crash on you, mouhahahaha!
Also, the brainfuck program can't exceed 512 bytes (a sector). But this seems conforming since you say "executable Brainfuck is located at second disk sector".
Last detail: I didn't explicitly initialized the cells to zero. Qemu seem to do it for me, and I'm relying on this, but I don't know whether a real BIOS on a real computer would do it (initialization would just take a few bytes more, anyway).
The code
(based on your template, and by the way, thanks for this, I would never have tried without it):
[BITS 16]
[ORG 0x7C00]
%define cellcount 30000 ; you can't actually increase this value much beyond this point...
; first sector:
boot:
; initialize segment registers
xor ax, ax
mov ss, ax
mov ds, ax
mov es, ax
jmp 0x0000:$+5
; initialize stack
mov sp, 0x7bfe
; load brainfuck code into 0x8000
; no error checking is used
mov ah, 2 ; read
mov al, 1 ; one sector
mov ch, 0 ; cylinder & 0xff
mov cl, 2 ; sector | ((cylinder >> 2) & 0xc0)
mov dh, 0 ; head
; dl is already the drive number
mov bx, 0x8000 ; read buffer (es:bx)
int 0x13 ; read sectors
; initialize SI (instruction pointer)
mov si, bx ; 0x8000
; initialize DI (data pointer)
mov bh, 0x82
mov di, bx ; 0x8200
decode:
lodsb ; fetch brainfuck instruction character
.theend:
test al, al ; endless loop on 0x00
jz .theend
and ax, 0x0013 ; otherwise, bit shuffling to get opcode id
shl ax, 4
shl al, 2
shr ax, 1
add ax, getchar ; and compute instruction implementation address
jmp ax
align 32, db 0
getchar:
xor ah, ah
int 0x16
cmp al, 13
jne .normal
mov al, 10 ; "enter" key translated to newline
.normal:
mov byte [di], al
push di
jmp echochar
align 32, db 0
decrementdata:
dec byte [di]
jmp decode
align 32, db 0
putchar:
push di
mov al, byte [di]
echochar:
mov ah, 0x0E
xor bx, bx
cmp al, 10 ; newline needs additional carriage return
jne .normal
mov al, 13
int 0x10
mov al, 10
.normal:
int 0x10
pop di
jmp decode
align 32, db 0
incrementdata:
inc byte [di]
jmp decode
align 32, db 0
decrementptr:
dec di
cmp di, 0x8200 ; pointer wraparound check (really, was that necessary?)
jge decode
add di, cellcount
jmp decode
align 32, db 0
jumpback:
pop si
jmp jumpforward
align 32, db 0
incrementptr:
inc di
cmp di, 0x8200+cellcount ; pointer wraparound check
jl decode
sub di, cellcount
jmp decode
align 32, db 0
jumpforward:
cmp byte [di], 0
jz .skip
push si
jmp decode
.skip:
xor bx, bx ; bx contains the count of [ ] imbrication
.loop:
lodsb
cmp al, '['
je .inc
cmp al, ']'
jne .loop
test bx, bx
jz decode
dec bx
jmp .loop
.inc:
inc bx
jmp .loop
; fill sector
times (0x1FE)-($-$$) db 0
; boot signature
db 0x55, 0xAA
; second sector contains the actual brainfuck program
; currently: "Hello world" followed by a stdin->stdout cat loop
db '++++++++[>++++[>++>+++>+++>+<<<<-]>+>+>->>+[<]<-]>>.>---.+++++++..+++.>>.<-.<.+++.------.--------.>>+.>++.,[.,]'
times 0x400-($-$$) db 0
Tricks used
Ok, I cheated a bit. Since you said "being a bootloader, the size of the program is counted in non-zero bytes in the compiled code", I made the code smaller by allowing "holes" between the implementation of the eight brainfuck opcodes. This way, I don't need a big sequence of tests, a jump table, or anything: I just jump to the brainfuck "opcode id" (from 0 to 8) multiplied by 32 to execute the brainfuck instruction (worth to note that it means the implementation of the instructions can't take more than 32 bytes).
Moreover, to get this "opcode id" from the brainfuck program character fetched, I noticed just a bit of bit shuffling was necessary. Indeed, if we just consider bits 0, 1 and 4 of the opcode character, we end up with the 8 unique combinations:
X XX
00101100 0x2C , Accept one byte of input, storing its value in the byte at the pointer.
00101101 0x2D - Decrement (decrease by one) the byte at the pointer.
00101110 0x2E . Output the value of the byte at the pointer.
00101011 0x2B + Increment (increase by one) the byte at the pointer.
00111100 0x3C < Decrement the pointer (to point to the next cell to the left).
01011101 0x5D ] Jump back after the corresp [ if data at pointer is nonzero.
00111110 0x3E > Increment the pointer (to point to the next cell to the right).
01011011 0x5B [ Jump forward after the corresp ] if data at pointer is zero.
And, lucky me, there is actually one opcode that requires more than 32 bytes to implement, but it's the last one (jump forward [). As there is more room after, everything is fine.
Other trick: I don't know how a typical brainfuck interpreter works, but, to make things much smaller, I did not actually implement ] as "Jump back after the corresponding [ if data at pointer is nonzero". Instead, I always go back to the corresponding [, and, from here, re-apply the typical [ implementation (which then, eventually, goes forward after the ] again if needed). For this, each time I encouter a [, I put the current "brainfuck instruction pointer" on the stack before executing the inner instructions, and when I encounter a ], I pop back the instruction pointer. Pretty much as if it was a call to a function. You could therefore theoretically overflow the stack by making many many imbricated loops, but not with the current 512-bytes limitation of the brainfuck code, anyway.
1. Including the zero bytes that were part of the code itself, but not those that were part of some padding
Input must be redI'm pretty sure most bootloaders don't natively support color. \$\endgroup\$