Hardware oddity: HUBEXEC from memory below $400

in Propeller 2
CON _CLKFREQ = 100_000_000 DAT org loc pa,#$+1 ' < PA = 1 in cogexec, PA = 4 in hubexec mov thedbg,#0 ' to prove the point, delete cog copy cmp pa,#1 wz if_z skip #%10 if_z jmp #\$FFFFC ' go for the wraparound! thedbg debug("hubexec from low memory!!! ",udec(pa))
QED.
Comments
Sneaky. So when wrapping from $FFFFC to $0 the P2 doesn't realize it should be switching back into COG mode and allows you to execute from 0-$400 as HUBEXEC? Or is this a toolchain artefact of some sort? What is actually sitting in the binary image loaded at HUB address 0? Is this using PNut or Flexspin?
It is slightly surprising that Chip did it like that. So it's a select bit set by branch instructions rather than a live select based on the instruction fetch address from the PC register.
Interesting. Does it make any difference if instruction at $FFFFC is not skipped? Once in cog RAM exec starting at $0 any branch to below $400 switches to cog or LUT RAM exec, presumably.
EDIT:
Does next instruction after $3FF in LUT RAM switch to hub RAM exec at $400*4? I've forgotten.
The skip is just a courtesy, since $FFFFC is debug-locked and might contain something disturbing. I could have of course used the FIFO glitch to write a NOP there, but that'd be distracting from the actual point.
I did test that once-upon-a-time but I don't remember either. It's quite likely it wraps back to cogRAM address 0.