The ELF format created by Wonderful has some quirks, owing both to the non-upstream binutils fork used and to the specifics of the ROM format itself.

In general, gcc-ia16 ELF files follow the 32-bit x86 ELF format.

binutils-ia16 introduces a custom set of relocations to support segmentation - the segelf specification as proposed by H. Peter Anvin. In particular, ELFs emitted by Wonderful currently use the following relocations:

• R_386_32 (in DWARF debug sections; uses 32-bit ELF addresses above)
• R_386_16
• R_386_PC16
• R_386_SEG16 (segelf)
• R_386_SUB16 (segelf)

In addition, R_386_SUB32 relocations are improperly emitted in DWARF debug sections by some versions of the toolchain; these should be ignored.

More extensive documentation for these relocations is available here.

ELF addresses 0x80000000 - 0xFFFFFFFF correspond to addresses in ROM.

31                 bit                 0
 ---- ---- ---- ---- ---- ---- ---- ----
 1bbb bbbb bbbb cccc cccc cccc cccc cccc
  ||| |||| |||| |||| |||| |||| |||| ||||
  ||| |||| |||| ++++-++++-++++-++++-++++- CPU address (bits 0-19)
  +++-++++-++++-------------------------- 64KB ROM bank (bits 30-20)
                                          Corresponds to banks 000 - 7FF (128 MB maximum)
                                          The last ROM bank uses addresses FFFxxxxx

To turn this into a physical address in the cartridge ROM's space, you should use the following equation: 1) & rom_mask.

ELF addresses 0x00000000 - 0x0000FFFF correspond to IRAM addresses.

31                 bit                 0
 ---- ---- ---- ---- ---- ---- ---- ----
 0000 0000 0000 0000 cccc cccc cccc cccc
                     |||| |||| |||| ||||
                     ++++-++++-++++-++++- IRAM address (bits 0-15)

ELF addresses 0x00010000 - 0x0001FFFF currently correspond to SRAM addresses, but this may be changed in a future version (to support >64KB SRAM), so please don't rely on it.

All of this may be changed in a future version, so please don't rely on it.

ELF VMA addresses 0x00000000 - 0x0000FFFF correspond to the 64K of code placed in NOR flash.

ELF VMA addresses 0x00010000 - 0x0001FFFF correspond to the 64K of data placed in SRAM.