OpenBSD引导的第二部PBR，也是活动分区的一个扇区的代码，由第一步的MBR加载到0x7C00处，manpage里详细的讲解了过程和大致实现 biosboot(8) （http://man.openbsd.org/OpenBSD-6.0/man8/i386/biosboot.8），代码在sys/arch/i386/stand/biosboot/目录下，主要就是其中的biosboot.S；和mbr.S一样，在代码的开头清晰的介绍了该代码要做的事情：
/*
* Memory layout:
*
* 0x00000 -> 0x07BFF our stack (to 31k)
* 0x07A00 -> 0x07BFF typical MBR loc (at 30k5)
* 0x07C00 -> 0x07DFF our code (at 31k)
* 0x07E00 -> ... /boot inode block (at 31k5)
* 0x07E00 -> ... (indirect block if nec)
* 0x40000 -> ... /boot (at 256k)
*
* The BIOS loads the MBR at physical address 0x07C00. It then relocates
* itself to (typically) 0x07A00.
*
* The MBR then loads us at physical address 0x07C00.
*
* We use a long jmp to normalise our address to seg:offset 07C0:0000.
* (In real mode on x86, segment registers contain a base address in
* paragraphs (16 bytes). 0000:00010 is the same as 0001:0000.)
*
* We set the stack to start at 0000:7BFC (grows down on i386)
*
* We then read the inode for /boot into memory just above us at
* 07E0:0000, and run through the direct block table (and the first
* indirect block table, if necessary).
*
* We load /boot at seg:offset 4000:0000.
*
* Previous versions limited the size of /boot to 64k (loaded in a single
* segment). This version does not have this limitation.
*/
注释内容包含了mbr.S开头的内容，还是讲解了大致引导过程：BIOS 读MBR到0x7C00处，然后MBR将自身重定位到0x7A00，MBR加载PBR也就是biosboot.S到0x7C00，然后jmp到0x7C00处的biosboot.S执行。
biosboot.S的特殊之处在于不像mbr.S里那样直接从磁盘扇区的第1扇区这种“物理”定位信息加载后续代码，也就是说biosboot需要能直接操作文件系统了，因为它后续加载的是/boot，要直接从根分区加载boot！对比其他的bootloader，比如GRUB，GRUB能直接读各种各样的文件系统，其代码复杂度可想而知，OpenBSD的biosboot实际上并不能读文件系统，因为它只有512字节啊，这点空间不可能能放下文件系统驱动！biosboot采取的方法是在最终的二进制内容里直接保存/boot所在的磁盘扇区位置信息，当然不可能直接写死在biosboot.S代码里，采取的办法是打二进制patch，也就是直接修改编译后的二进制文件里的，通过用户态程序/usr/sbin/installboot将/boot的物理位置信息写到编译后的biosboot中，然后将修改后的biosboot写到分区第一个扇区；这里涉及到ELF文件相关知识，在biosboot.S中有几个导出的符号，installboot将/boot物理位置信息写到这几个符号所指的位置处，代码的注释里清晰的讲解了这几个导出符号：
/*
* The data passed by installboot is:
*
* inodeblk uint32 the filesystem block that holds /boot's inode
* inodedbl uint32 the memory offset to the beginning of the
* direct block list (di_db[]). (This is the
* offset within the block + $INODEOFF, which is
* where we load the block to.)
* fs_bsize_p uint16 the filesystem block size _in paragraphs_
* (i.e. fs_bsize / 16)
* fs_bsize_s uint16 the number of disk sectors in a filesystem
* block (i.e. fs_bsize / d_secsize). Directly written
* into the LBA command block, at lba_count.
* XXX LIMITED TO 127 BY PHOENIX EDD SPEC.
* fsbtodb uint8 shift count to convert filesystem blocks to
* disk blocks (sectors). Note that this is NOT
* log2 fs_bsize, since fragmentation allows
* the trailing part of a file to use part of a
* filesystem block. In other words, filesystem
* block numbers can point into the middle of
* filesystem blocks.
* p_offset uint32 the starting disk block (sector) of the
* filesystem
* nblocks uint16 the number of filesystem blocks to read.
* While this can be calculated as
* howmany(di_size, fs_bsize) it takes us too
* many code bytes to do it.
*
* All of these are patched directly into the code where they are used
* (once only, each), to save space.
*
* One more symbol is exported, in anticipation of a "-c" flag in
* installboot to force CHS reads:
*
* force_chs uint8 set to the value 1 to force biosboot to use CHS
* reads (this will of course cause the boot sequence
* to fail if /boot is above 8 GB).
*/
这几个值使biosboot能直接定位到磁盘上的boot。biosboot中和mbr一样也有CHS、LBA相关的代码，按住shift键强制使用CHS模式。加载boot到0x40000，也就是256KB处，然后jmp到其中继续执行/boot。
OK，终于看完这些实模式的鬼东西了……后面空了再继续写boot后面的东西吧。