Lately I've been developing a Qtouch button using ATtiny10, and playing with the various configurations. As you may know, Atmel provides a utility in the Qtouch library that spits out a pre-compiled, configured hex file that you can just burn into a chip and go with it. But being the inquisitive person that I am, I took a look under the hood, and found high strangeness. For example, the first thing the device does after reset is this -
clr XL
ldd XL,Y+50
ldd XL,Y+51
clr XL
Other than that the Y register hasn't been initialized yet, this would be unremarkable (just pointless), except that the LDD instruction isn't supported on the Tiny10. For any other device the assembler throws out an unsupported opcode, but not these. LDD instructions, using both Y and Z registers, are scattered liberally through the code. The Y register does change, so it could be different when those LDDs are executed, but the Z register is never initialized nor used for anything else.
Now you would think perhaps these instructions were accessing the IO registers, since the addresses fall into that space, but you'd be wrong. They don't seem to address anything. When I single step through the code, the value of the XL register (or whatever other register is specified) doesn't change. It's like the LDD is ignored, as it should be if it's an unsupported instruction. Except that a little later, this piece of code is executed -
wdr
ldi XL,0xD8
out CCP,XL
ldi XL,0x4E
out WDTCSR,XL
ldd XL,Z+32
tst XL
brne PC
This starts off perfectly conventionally. It writes the password to the code protection register, then sets the watchdog for 64ms. But then, using the uninitialized Z register, it LDD's 0x20 and this time something happens - the XL register changes from 0x4E to 0x00. That is obviously meant to happen, because otherwise the BRNE following makes the program freeze until the watchdog time out. IO reg 0x20 is reserved, by the way, and reading it (with an LDD) previously didn't result in a change to the XL value.
There's a further undocumented instruction in the middle somewhere, which appears in some variations of the build but not others, as hex 0x0077.
Perhaps the reason nobody has ever seen any uncompiled source code for Qtouch is because what's going on in there is secret.
