Although it's legacy, I think I still need to at least give it a try.

The code would split into two parts, one goes to the MBR boot code, one sits in the gap between MBR header and first partition.

First part should fit into the boot code part which would only allow max code size of 512 - 2 - 16*4 = 446 bytes excepts the MBR signature 0xaa55 and partition table.

Since we don't need to deal with partitions/filesystem at this moment, I would just generates empty partition table.

And I wrote a linking script for assembling this:

TARGET(elf32-i386)
ENTRY(_start)

MEMORY {
  boot : ORIGIN = 0x7c00, LENGTH = 0x1be
  part : ORIGIN = 0x7dbe, LENGTH = 0x40
  sig  : ORIGIN = 0x7dfe, LENGTH = 0x2
}

SECTIONS {
  . = 0x7c00;
  .text : {
    *(.text)
  } > boot

  .fill_part : {
    FILL(0x00)
  } > part

  .magic : {
    SHORT(0xaa55)
  } > sig
}

which just... generate the stage1 as a valid MBR header in the form of a elf file, and could be used for debugging.

Then as usual, objcopy the code out, and boot it with qemu. and it works!