From 6100e7b50e5a0e25bdb0dd329df334cae90f57a7 Mon Sep 17 00:00:00 2001 From: Paul Mackerras Date: Wed, 4 Feb 2026 08:48:34 +1100 Subject: [PATCH] dcache: Fix another dcache bug causing occasional load data corruption Commit a7420c2a4d69 ("dcache: Fix bug causing load to return incorrect data", 2025-12-27) fixed the main cause of the bug, but left a 1-cycle window where the same problem could still occur. If a touch that misses in the dcache is followed immediately by a load to a different cache line with the same index, then because the touch is completed and the new tag is written for the line being touched in the same cycle, it is possible for the following load to use the previous (stale) tag value for the line. If that old value matches the load (i.e., the load would have been a hit in the absence of the touch) then the load will incorrectly return data from the line being touched. Fix this by delaying the completion of the touch until after the new tag has been written, which is indicated by r1.write_tag = 0. Fixes: a7420c2a4d69 ("dcache: Fix bug causing load to return incorrect data", 2025-12-27) Signed-off-by: Paul Mackerras --- dcache.vhdl | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/dcache.vhdl b/dcache.vhdl index 0d8d354..dcde2ee 100644 --- a/dcache.vhdl +++ b/dcache.vhdl @@ -1703,8 +1703,10 @@ begin r1.wb.adr <= next_row_wb_addr(r1.wb.adr); end if; - -- If this is a touch, complete the instruction - if r1.full = '1' and r1.req.touch = '1' and r1.req.hit_reload = '1' then + -- If this is a touch, complete the instruction, but not + -- until the new tag for this cache line has been written. + if r1.full = '1' and r1.req.touch = '1' and r1.req.hit_reload = '1' and + r1.write_tag = '0' then r1.full <= '0'; r1.slow_valid <= '1'; r1.ls_valid <= '1';