13:11 <litghost> > it looks like even the "undocumented" PHASER block is in the tilegrid,

13:11 <litghost> One thing to keep in mind is that 005-tilegrid just identifies base addresses, (e.g. which frames of the bitstream tiles exist). The detailed fuzzers are still required to determine the meaning of the bits in the frame. Many tiles are still left to fuzz, e.g. DSP, XADC. We believe we can document those functions, but the time hasn't been spent on it yet

19:58 <litghost> The CI system runs "make all_conda" (or equiv) prior to running which solves the problem

19:58 <litghost> I believe mithro is working on proof of concept that completely seperates the all_conda target from CMake, but I don't know what happened with that

19:59 <hackerfoo> Shouldn't there be a dependency?

19:59 <hackerfoo> Most people doing a checkout won't run `make all_conda`, and it's not in the README.

20:00 <litghost> Sure

20:02 <hackerfoo> Separating Conda out would be nice so I can make a proper Nix configuration.

20:03 <hackerfoo> Or maybe Puppet for internal non-Google3 use.

20:09 <hackerfoo> Wow, the Puppet website seems very commercial, "Free Trial": https://puppet.com/

21:36 <bunnie> litghost: are there any frames in the bitstream that exist but we have no idea what the function is? or are all frames generally mapped to a known type of block and it's "just" a matter of detailed fuzzing...

22:09 <litghost> So frames are known to cover one column of configuration

22:16 <litghost> Most tiles contain data from more than one frame, hence tilegrids "frames" field

22:17 <litghost> Each frame is 101 32-bit words, and in general tiles only touch a range of bits within the frames they span

22:17 <litghost> This is modelled as the "offset" field

22:18 <litghost> Generally what we see is as you move up or down a column the offset increases or decreases, but the frame address is constant

22:20 <litghost> So to answer your question, almost every frame has bits known to belong to the interconnect, and around word 50, some bits that belong to the clock network

22:21 <litghost> The remaining bits appear to soley a function of the logic attached to the interconnect, e.g. SLICEL or BRAM

22:32 <sorear> If I were trying to hide something I’d put a write only bit in some frame in a location where other frames have nonexistent bits

22:50 <hackerfoo> sorear: I'd just add a password: Just write a particular invalid value at a certain location to unlock extra functionality. To make it more secure, make it dependent on a chip ID or RNG if available.

22:51 <sorear> oh there’d absolutely be a password

22:52 <sorear> but messing with functional logic is likely to be harder