[WinUAE/A500] CIA A - Timer A INT2 problem

Hello,

I started working on my own "kickstart" for Amiga 500. I test it on WinUAE with A500 predefined settings (512kB Chip RAM).
I ran into issue I cannot overcome. I set up Timer A of CIA A to generate INT2 every 10ms. In the debugger I checked that CRA, ICR registers are set correctly, I set mask in Status Register, and enable interrupts in OCS (INTENA register) and exception vector is setup. Debbuger shows that timer is running but when it underflows strange things happen => CPU loads address from 0x000000 instead of INT2 vector. Why? Does anyone know the solution? Is that specific to Amiga/CIA/OCS/WinUAE? Is there anything I'm not aware of?

The complete code is attached with Makefile and linker script.
My initialization code looks like this

.global _reset
_reset:
	/* enable RAM */
	move.b    #3, 0xBFE201
	move.b    #2, 0xBFE001

	/* copy data to ram */
	lea.l     __rom_data_start, %a1
	lea.l     __data_start, %a0
	bra.b     2f
1:	move.b    (%a1)+, (%a0)+
2:	cmp.l     #__edata, %a0
	bcs.b     1b

	/* zero bss section */
	lea.l     __bss_start, %a0
	bra.b     4f
3:	clr.b     (%a0)+
4:	cmp.l     #__end, %a0
	bcs.b     3b

	/* initialize stack */
	lea.l     __stack, %sp
	lea.l     __stack, %fp
	link.w    %fp, #0

	/* branch to c entry */
	jsr main

	/* _exit = loop infinitely */
5:	bra.s 5b

and the main function is something like this:

volatile int x = 0;

__attribute__((interrupt))
void exception_handler(void) {
    ++x;
    OCS_INTREQ = 0x7FFF;
}

int main() {

    uint32_t *i;
    for (i = 0x000008; i < 0x000400; ++i) {
        *i = exception_handler;
    }

    // set timer
    uint16_t div = 7093; /* 100/second */
    CIAA_CRA = 0;
    CIAA_TALO = (uint8_t) ( div       & 0xFF);
    CIAA_TAHI = (uint8_t) ((div >> 8) & 0xFF);

    OCS_INTENA = 0x7FFF; /* disable all interrupts */
    OCS_INTREQ = 0x7FFF; /* clear all pending interrupts */

    asm volatile ("andi.w #0xF8FF, %sr");        /* unmask all interrupts */
    CIAA_ICR = 0x81;
    OCS_INTENA = (1 << 15) | (1 << 3) | (1 << 14);

    // start timer
    CIAA_CRA |= CIA_CRA_START;
}
}

which emits code like below:

00fc005a <exception_handler>:
  fc005a:	4e56 0000      	linkw %fp,#0
  fc005e:	2f00           	movel %d0,%sp@-
  fc0060:	2039 0000 0400 	movel 400 <x>,%d0
  fc0066:	5280           	addql #1,%d0
  fc0068:	23c0 0000 0400 	movel %d0,400 <x>
  fc006e:	33fc 7fff 00df 	movew #32767,dff09c
  fc0074:	f09c 
  fc0076:	201f           	movel %sp@+,%d0
  fc0078:	4e5e           	unlk %fp
  fc007a:	4e73           	rte

00fc007c <main>:
  fc007c:	4e56 0000      	linkw %fp,#0
  fc0080:	307c 0008      	moveaw #8,%a0
  fc0084:	20fc 00fc 005a 	movel #16515162,%a0@+
  fc008a:	b0fc 0400      	cmpaw #1024,%a0
  fc008e:	66f4           	bnes fc0084 <main+0x8>
  fc0090:	13fc 0000 00bf 	moveb #0,bfee01
  fc0096:	ee01 
  fc0098:	13fc ffb5 00bf 	moveb #-75,bfe401
  fc009e:	e401 
  fc00a0:	13fc 001b 00bf 	moveb #27,bfe501
  fc00a6:	e501 
  fc00a8:	33fc 7fff 00df 	movew #32767,dff09a
  fc00ae:	f09a 
  fc00b0:	33fc 7fff 00df 	movew #32767,dff09c
  fc00b6:	f09c 
  fc00b8:	027c f8ff      	andiw #-1793,%sr
  fc00bc:	13fc ff81 00bf 	moveb #-127,bfed01
  fc00c2:	ed01 
  fc00c4:	33fc c008 00df 	movew #-16376,dff09a
  fc00ca:	f09a 
  fc00cc:	1039 00bf ee01 	moveb bfee01,%d0
  fc00d2:	0000 0001      	orib #1,%d0
  fc00d6:	13c0 00bf ee01 	moveb %d0,bfee01
  fc00dc:	4e5e           	unlk %fp
  fc00de:	4e75           	rts

[Toni Wilen]

http://eab.abime.net/showthread.php?t=53527

Thanks!