2026-06-17
The asker wants a clear, mechanical description of the Line-Fill Buffer (LFB) on post-Haswell Intel cores: what fields each entry holds, whether the LFB stores the cache line payload or merely tracks the outstanding request, and how it interacts with the L1D, L2, and the rest of the memory subsystem (store buffer, super-queue, etc.).
This is hard because Intel's public documentation is deliberately sparse here. Most of what we "know" about the LFB comes from patents, SDM scraps, optimization manual hints, performance-counter behavior (L1D_PEND_MISS.FB_FULL, L1D.REPLACEMENT, OFFCORE_REQUESTS_BUFFER.SQ_FULL), and side-channel research (MDS/RIDL exposed surprising LFB internals). The structure also shifted across generations — Haswell had 10 LFBs per core, later parts added a separate Super Queue (SQ) for L2-miss traffic, and Sunny Cove reshuffled the path again.
A solid answer should distinguish three roles the LFB plays simultaneously:
So the short answer is: yes, the LFB holds the payload, not just the request. That's why MDS attacks (Fallout, RIDL, ZombieLoad) could leak data through it.
Direction for a definitive answer: cite the Intel Optimization Reference Manual section on the L1D ("up to 10 outstanding misses"), the patents around the fill buffer / WC buffers, and Travis Downs / Henry Wong / Agner Fog's measurements. Cross-reference the MDS papers for the post-2018 understanding of LFB partitioning between SMT siblings.
Gotchas:
