Blog
A proposed row in the Xilinx bitstream database had been unverifiable for eighteen months. Two 22.7 MB bitstreams differing in a single bit settle it on silicon: with the bit an LED blinks, without it the counter is frozen.
A row in Project X-Ray's bitstream database says which bits in a bitstream correspond to which feature in the silicon. Most rows were minted by a fuzzer that compares thousands of Vivado outputs. Some rows exist only as proposals, and a proposal that nobody can check is where this starts: eight rows for the Artix-7 regional clock buffer were offered in December 2024 and the pull request was closed on 14 August 2026, pending a fuzzer that could make them verifiable.
One of those eight is now verified — not by a fuzzer, by a board. Two bitstreams for an ALINX AX7203 (xc7a200tfbg484-2), 22.7 MB of frames each, differing by exactly one bit: frame 0x00401C00, word 50, bit 31. With that bit set an LED blinks at 0.75 Hz. With it cleared the same design sits frozen — an unclocked counter stuck at zero. The regional clock does not reach the fabric without it.
That is what the row claimed, and it is the whole claim: HCLK_L.ENABLE_BUFFER.HCLK_CK_BUFRCLK2 = 00_31 is the enable for that buffer.
Every earlier probe in the upstream discussion sank the BUFR's clock into an ISERDESE2 or an ODDR. Both live in the I/O column, so the regional clock never leaves it, and nothing in the horizontal clock spine is ever switched on. The maintainer working the other half of this said plainly that he had no design producing a single HCLK_L line.
Sink the clock into ordinary CLB fabric instead — a plain counter — and it has to reach the leaves. The probe is thirty lines. That is the entire trick, and it produced the whole chain at once: the source pip, the leaf row, the missing enable, and the consumer in the clock-management tile.
On a small part the probe places by luck. On the xc7a200t it fails twice, at both ends of the buffer.
The arc into the buffer fails because a pad-fed BUFR must sit on the one site its clock-capable pad can reach — its I pin has no fabric input at all — and nothing told the placer which. The arc out of it fails because a BUFR drives one clock region, the placer does not cost global nets, and so the flops it clocks drift toward whatever data pin they touch. On this board that is an LED half a die away, in the opposite half from the only clock-capable oscillator.
Both patches are submitted upstream and both are open, not merged. CI is green on all three parts it tests. The second one has a trap worth repeating: the region has to be derived by asking the routing graph where the clock actually arrives, and the walk must collect only bel pins named CLK. Counting every pin it touches returns a rectangle covering the whole die, which is a constraint that constrains nothing.
A BUFR can divide its clock. The database has carried D1 through D8 for years; the flow hardcoded BYPASS until a patch in June 2026 made the rest reachable, and nothing since had driven a divided BUFR onto a board. Same probe, same counter, only the divide parameter changes:
| BUFR_DIVIDE | predicted lit time | observed |
|---|---|---|
| BYPASS | 0.67 s | ~0.65 s |
| 2 | 1.34 s | ~4x faster than D8 |
| 4 | 2.68 s | ~3 s |
| 8 | 5.37 s | ~5 s |
Predicted from 2^28 x divide / 200e6. The midpoint matters more than the endpoints: two readings can only show that something divides, while a third landing where the outer two predict shows the ratio tracks the parameter instead of the divider latching one value.
The first divide run was void. I had reverted the emitter patch to keep the pull requests clean, then built the divide probes on branches made after that, so the flashed bitstream carried zero enable lines and the clock never reached the fabric at all. The LED sat frozen and I was one step from reporting that the divide is ignored on silicon. What caught it was checking that the bitstream contained the feature the experiment was about, before interpreting the LED rather than after.
That void run turned out to be worth more than it cost: it is a second, independent negative control for the enable bit — a bitstream built by a different route, for a different purpose, again showing a dead counter when the bit is absent.
The same probe also tied the buffer's CLR low. A BUFR in divide mode needs its divider released by a CLR pulse where BYPASS does not, so even with the enable present that build could not have separated "divide ignored" from "divider never started".
And a code search after the fact found prior art against my own patch: a fork has fixed the same placement bug since April 2025 with a single line, calling the existing preplace helper. I measured it — identical sites on both probes — and said so on the pull request, offering to close mine in favour of it. I should have run that search before sending, not after.
The flow. Yosys is YosysHQ. nextpnr is YosysHQ and David Shah. Project X-Ray and the xc7 database are SymbiFlow and F4PGA. The Xilinx port, the Artix-7 support, the BUFR packer and the BUFIO site fix are openXC7, funded by NLnet — and the mechanism my region patch borrows is the one a maintainer wrote for BUFIO weeks earlier. The eight candidate rows are AdamLee7's, from a pull request I reviewed and agreed should be closed. What is mine is a thirty-line probe, two patches, and a board on a desk.
They answer different questions. A fuzzer asks what the bits are, across a whole tile, from thousands of vendor bitstreams. A one-bit A/B asks whether one specific bit does the one thing it is claimed to do. The second is narrower and much cheaper — about thirty minutes per bit, most of it spent flashing — and it needs no vendor tool at all.
It also cannot replace the fuzzer. It cannot find bits, only test them; it cannot separate a divide of 8 from a divide of 7; and its negative result is ambiguous in a way its positive result is not, because a bit that changes nothing may be a wrong bit or a default that was already set.
Work with me
I work contract and part-time on hardware-AI, FPGA/RTL and ML systems — from specification and open toolchains to reproducible measurements.