diff --git a/.gitignore b/.gitignore
index a8c2d3a..0d54a79 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,3 +5,5 @@ fp-info-cache
 plot/
 *.o
 *.bin
+*.map
+*.lst
diff --git a/Makefile b/Makefile
index 023a6d5..d875389 100644
--- a/Makefile
+++ b/Makefile
@@ -1,12 +1,19 @@
 
 MACHINE := pet
 
-.PHONY: all
+.PHONY: all clean
 
-all: rs232.bin
+all: rs232.bin rs232.lst
+
+clean:
+	rm -f rs232.bin *.o *.lst *.map
 
 rs232.bin: driver.o
-	cl65 -t ${MACHINE} -o $@ $^
+	cl65 -v -C mem.cfg -l rs232.lst -m rs232.map -o $@ $^
+
+%.lst: %.bin
+	@# the start address shouldn't be hardcoded here...
+	da65 -o $@ -S 0x7000 $<
 
 %.o: %.a65
-	ca65 -t ${MACHINE} -o $@ $<
+	ca65 -v -t ${MACHINE} -o $@ $<
diff --git a/driver.a65 b/driver.a65
index 2e17dd6..9846f47 100644
--- a/driver.a65
+++ b/driver.a65
@@ -2,6 +2,13 @@
 ; 6502 mode
 .p02
 
+; define where we want to be loaded
+.global __LOADADDR__
+__LOADADDR__ = $7000
+; and where data should reside
+.global __DATAADDR__
+__DATAADDR__ = $7200
+
 ; load useful register/memory locations
 .include "pet.inc"
 
@@ -22,10 +29,25 @@ PHI2_CLOCK = 1000000
 ; don't set the baud rate too high, or other operations will be starved
 BAUD_RATE = 300
 
-; we expect to be loaded somewhere in the middle of user ram
-; TODO verify if this is safe with the Editor/Basic 2.0 ROM
-; or if there is a way to limit memory usage by the ROM
-.org $7000
+; parameters and return values can reside in an unused area of the zero page
+.zeropage
+	; available bytes to read or write
+	.export rs_available
+	rs_available: .byte 0
+	; single byte transfer from input / to output fifo
+	.export rs_data
+	rs_data: .byte 0
+	; status of operation
+	rs_status_ok = 0
+	rs_status_read_buffer_empty = 1
+	rs_status_write_buffer_full = 2
+	rs_status_device_not_initialized = 3
+	rs_status_device_already_initialized = 4
+	.export rs_status
+	rs_status: .byte 0
+
+; specify the load address, so code and data will be located there
+;.org __LOADADDR__
 
 ; entry points
 .code
@@ -45,25 +67,8 @@ BAUD_RATE = 300
 	rs_write:
 		jmp write
 
-; parameters and return values
-.data
-	; available bytes to read or write
-	.export rs_available
-	rs_available: .byte 0
-	; single byte transfer from input / to output fifo
-	.export rs_data
-	rs_data: .byte 0
-	; status of operation
-	rs_status_ok = 0
-	rs_status_read_buffer_empty = 1
-	rs_status_write_buffer_full = 2
-	rs_status_device_not_initialized = 3
-	rs_status_device_already_initialized = 4
-	.export rs_status
-	rs_status: .byte 0
-
 ; driver state data
-
+.data
 	; 1=driver initialized
 	initialized: .byte 0
 	; saved IRQ vector
@@ -434,6 +439,7 @@ BAUD_RATE = 300
 		stx outqlen
 
 		; prepare shift register
+		; layout: 000000E7 6543210S
 		; bit0 = start bit = 0
 		; bit1..7 = data0..6
 		clc
@@ -444,7 +450,7 @@ BAUD_RATE = 300
 		lda #%00000001
 		rol
 		sta outbuf+1
-		; set shift length
+		; we're shifting 10 bits out
 		lda #10
 		sta outshift
 
diff --git a/mem.cfg b/mem.cfg
new file mode 100644
index 0000000..df3da0c
--- /dev/null
+++ b/mem.cfg
@@ -0,0 +1,21 @@
+SYMBOLS {
+    __LOADADDR__:  type = import;
+    __DATAADDR__:  type = import;
+}
+MEMORY {
+    # $ED-$F7 seems to be an unused area in the zero page according to the BASIC 2.0/4.0 memory map
+    ZP:       file = "", define = yes, start = $00ED, size = $000A;
+    # we're loading at $7000, max code size $800 bytes
+    RAM:      file = %O,               start = __LOADADDR__, size = $0800;
+    # if we reside in ROM instead, we should have more space available
+    ROM:      file = %O,               start = $9000, size = $2000;
+}
+SEGMENTS {
+    ZEROPAGE: load = ZP,       type = zp;
+    # change these two to "ROM" if you want to put them on a ROM chip
+    CODE:     load = RAM,      type = ro;
+    RODATA:   load = RAM,      type = ro;
+    # data and bss should come after the code if they all reside in RAM
+    DATA:     load = RAM,      type = rw;
+    BSS:      load = RAM,      type = bss, define   = yes;
+}