tiny85 burns buf to pg 67 in flash

;tiny85flash0.asm avr stufio 4. Flashes 64 byte buffer into page 67 of tiny85.Works but code is messy.
;tn85SelfProg2. Erase worked in simulation. Got do_spm going. There's a difference between lds and out for spmcsr
;Test self prog program for Tiny 85. Just want to put a page
; of random data into flash



.include "tn85def.inc"
.equ tab_size = 64
.def spmcsr_val=r18
.def buf_ctr = r19
.def counterReg = r17

.DSEG
var1:    .BYTE 1            ; reserve 1 byte to var1
table:   .BYTE tab_size     ; reserve tab_size bytes

 .CSEG
;--------------set up stack
ldi r16,low(RAMEND)
out spl, r16
ldi r16, high(RAMEND)
out sph,r16

rjmp test_tableToFlashBuffer

;----------stack done
;ldi r30,0xc0 ;load the starting page address into Z
;ldi r31,0x01 ; z=01c0 means PC page is page 7 0b111
ldi r30,0xc0 ;
ldi r31,0x10 ; z=$10c0 page 67, byte 0
ldi r16, 0x51
mov r0, r16 ; r1:r0 is 0xa150
ldi r16, 0xa1
mov r1, r16
;-----------now erase page----------
ldi spmcsr_val,0x03  ;this is the page erase command
rcall do_spm
;-------------page erased----------

;---------now fill buffer with 64 bytes coming from r0,r1---
nop
push r30
ldi buf_ctr, 32  ;number of temp buf insertions
write_buf:
ldi spmcsr_val,01  ;this is write r0:r1 to temp buffer
rcall do_spm    ;two bytes written, now what?
inc r30
inc r30     ;bump up z for next write
dec buf_ctr
brne write_buf   ;loop 32 times
nop      ;when here have written to temp buf and z points to next page
pop r30     ;get z-pointer back after 64 inc's
;----------buffer now filled and z-ptr points to start of page------

;---------------now do page write----------------
ldi spmcsr_val, 0x05 ;command that writes temp buffer to flash. 64 bytes
rcall do_spm
nop      ; page now written. z still points to start of this page

here: rjmp here
;----------------------------------------------------------------
fillBuf:
        ldi ZL,low(table)               ;table is my buffer
        ldi ZH, high(table)             ;Z now points to table
        ldi counterReg,64               ;64 bytes in buffer
        ldi r16,$30
storeB0:
        st z+,r16
        inc r16
        dec counterReg
        brne storeB0

;       rjmp here
ret
;----------------------------------------------------------

do_spm:
;lds r16,SPMCSR
in r16,SPMCSR
andi r16,1
cpi r16,1
breq do_spm
mov r16,spmcsr_val
out SPMCSR,r16
spm
ret
;-------------------------------------------------------------------
tableToFlashBuffer:		;send the 64 bytes, 32 words to flash page <-- Z pnts there.
	push r30			;save for later spm work.
	ldi XL,low(table)               ;X pnts to table that contains the 64 bytes.
    ldi XH, high(table)
;assume Z is already pointing to correct flash start of page.
	ldi buf_ctr,32		;send 32 words
sendr0r1:
	ld r16, x+			;get first byte
	mov r0,r16			;  into r0
	ld r16, x+			; and get the second of the pair into
	mov r1,r16			; into r1
	ldi spmcsr_val,01		;set up for write into spare buffer flash page
	rcall do_spm		;that's r0,r1 gone in.
	inc r30
	inc r30
	dec buf_ctr			;done 32 times?
	brne sendr0r1
	pop r30				;for next spm job
ret
;--------------------------------------------------------------------------
erasePage:			; assume Z points to start of a flash page. Erase it.
	ldi spmcsr_val,0x03  ;this is the page erase command
	rcall do_spm
ret
;------------------------------------------------------------------
writePage:
	ldi spmcsr_val, 0x05 ;command that writes temp buffer to flash. 64 bytes
	rcall do_spm
	nop      ; page now written. z still points to start of this page
ret
;---------------------------------------------------------------
test_tableToFlashBuffer:
	rcall fillBuf
	ldi ZH, $10
	ldi ZL,$c0		;z=$01c0. Start of page 67.
	rcall erasePage
	rcall tableToFlashBuffer
	rcall writePage
herettt:
	rjmp herettt