Out-of-Order Execution

Full multi-issue out-of-order is a config-gated backend on GSys LibreCore. Minimal packages keep OoOEn=0 for netlist identity with the in-order path — a product option, not a quality disclaimer.

Authoritative detail: architecture/out-of-order/README.md, the contract core/ooo/AGENTS-ooo-contract.md, the working plan core/ooo/AGENTS-ooo-plan.md, and the running log architecture/out-of-order/log-2026-09.md.

Two knobs

Invariant: SliceOoOEn and OoOEn are mutually exclusive product choices (XOR) — do not enable both.

Pipeline when OoOEn=1

decode → scoreboard (in-order alloc + commit)
              │
              ▼
     g6lc_ooo_dispatch
        multi-port rename + freelist
        age-ordered IQ + chain wakeup
        ROB multi-WB complete
        LSQ + memdep / STL
        PRF + WB bypass → issue operands
        mispredict: cancel mask → squash younger IQ/ROB/LSQ
              │
              ▼
     issue_read_operands → EX → WB → commit

When OoOEn=0, the dispatch module is not in the path (identity).

Module map (core/ooo/)

Scoreboard entries carry physical tags (p_rs1/p_rs2/p_rd, ooo_renamed) when on; zeros when off. RVFI/commit observe tags via the scoreboard entry.

Production packages

check_cfg legality for OoO (core/include/config_pkg.sv):

assert (!(Cfg.OoOEn && !Cfg.SpeculativeSb));
assert (!(Cfg.OoOEn && Cfg.NrHarts > 1 && Cfg.FpPresent && !Cfg.SmtDrainedHandoff));
                                                     // FP + mixed residency: refused
assert (Cfg.SmtDrainedHandoff || (Cfg.OoOEn && Cfg.NrHarts > 1));
`ifndef G6LC_OOO_SMT_MIXED_QUALIFY
assert (Cfg.SmtDrainedHandoff);                      // multi-core mixed residency: qualification-gated
`endif
`ifndef G6LC_OOO_FP_QUALIFY
assert (!(Cfg.OoOEn && Cfg.FpPresent && Cfg.NrHarts > 1 && !Cfg.SmtDrainedHandoff));
                                                     // single-hart and drained FP lifted (T9g/M4)
`endif

OoOEn && NrHarts > 1 is no longer refused: integer multi-hart OoO is legal under the drained handoff — the thread selector switches only when the scoreboard and store queues are empty (asserted at the switch in cva6.sv as ooo_switch_drained), so the hart-blind IQ/ROB/LSQ never hold two harts’ work at once. Since T9g/M4 the FP register class exists on the OoO path (per-hart g6lc_rename FP maps/pools/checkpoints, per-committing-hart dirty_fp_state, op-agnostic LSQ) and the fpu_wrap owner table is proven — so FP is legal single-hart (g6lc64_ooo) and under the drained handoff (g6lc64_ooo_int2_l3, RV64GC+B). FP under mixed residency stays refused pending the hart-tagged lazy-FS audit. g6lc64_ooo_int clears every FP format and keeps NrHarts=1, which is what makes it legal — treat it as a bring-up and verification baseline, not a qualified product.

Physical-address load validation (COH_OOO)

On the COH_OOO coherence fabric (g6lc64_ooo_int2) the load tag/check stage exports the accepted physical address of each granted load together with its saved TID, hart and access size (the legacy virtual load_paddr_o STQ key is not reused). The LSQ keeps that record until the load retires or is cancelled and checks it against physical store/load and load/load aliases, remote modifications, sibling-hart committed stores and TID reuse. A modification event holds load retirement for one cycle; matching loads are cancelled and replayed through the existing precise path, and PMA non-idempotent loads are never replay candidates. The uncertified early STQ forward shortcut is disabled in this mode. Contract and evidence: core/ooo/AGENTS-ooo-contract.md (physical validation candidate), core/ooo/AGENTS-ooo-plan.md T7/T7b, and the coherence envelope on Multi-Core Cluster.

ROB / IQ / LSQ / PRF depths scale from issue width when left at 0 in package builders (see build_config_pkg / package sources).

Bottlenecks the design targets

Measured state of the window (T9f–T10d): the 16-entry ring is adopted on g6lc64_ooo_int2_l3 and g6lc64_smt2_ooo_int; ring 32, the 3×64-entry TAGE_LITE, DeepSpec/memdep and the FTQ/FDIP/loop-buffer frontend each regressed the strict boot on their own and stay off. The prefetcher (g6lc_l2_pf) and the window bundle ship config-gated with their evidence rather than enabled.

Observability

PMU group 1 (see architecture README) exposes rename/IQ/ROB/LSQ/STL-class events. Prefer counters + RVFI when debugging mispredict or memory-order bugs.

Verification

# The OoO targets that elaborate end to end:
g6lc-build verify --lint --synth --target g6lc64_ooo_int
g6lc-build verify --lint --synth --target g6lc64_smt2_ooo_int
g6lc-build verify --lint --synth --target g6lc64_ooo_int2
g6lc-build verify --lint --synth --target g6lc64_ooo_int2_l3   # RV64GC+B, ring 16
g6lc-build verify --lint --synth --target g6lc64_ooo            # single-hart FP, legal since M4
g6lc-build verify --target g6lc64_ooo_server                    # opt-in / unqualified
g6lc-build test --suite ooo-l3-tests

Optional suites are long-running by design; gate them in CI deliberately.

SoC-readiness notes

• DFT: preserve test_en_i / testmode_i through new stateful structures.
• Timing: IQ select, rename, and LSQ CAM are first-class critical paths — structural FO4 with sv-timing is useful early; STA still owns sign-off.
• Do not break in-order packages: OoOEn=0 must remain identity.

Related

• Multi-Issue
• L2 / L3 Cache — often co-enabled on server packages
• Server Profiles
• Upgrade Program
• Spec / flush discipline: agents/guides/AGENTS-speculation.md