diff --git a/rocket/src/main/scala/cpu.scala b/rocket/src/main/scala/cpu.scala
index 2f58276f..33e7c0a7 100644
--- a/rocket/src/main/scala/cpu.scala
+++ b/rocket/src/main/scala/cpu.scala
@@ -76,7 +76,7 @@ class rocketProc extends Component
   dtlb.io.cpu.req_val     := ctrl.io.dmem.req_val;  
   dtlb.io.cpu.req_cmd     := ctrl.io.dmem.req_cmd;
   dtlb.io.cpu.req_asid    := Bits(0,ASID_BITS); // FIXME: connect to PCR
-  dtlb.io.cpu.req_addr    := dpath.io.dmem.req_addr;
+  dtlb.io.cpu.req_vpn     := dpath.io.dmem.req_addr(VADDR_BITS-1,PGIDX_BITS);
   ctrl.io.xcpt_dtlb_ld    := dtlb.io.cpu.xcpt_ld; 
   ctrl.io.xcpt_dtlb_st    := dtlb.io.cpu.xcpt_st; 
   ctrl.io.dtlb_miss       := dtlb.io.cpu.resp_miss;
@@ -90,10 +90,13 @@ class rocketProc extends Component
   arb.io.mem              ^^ io.dmem
   
   // connect arbiter to ctrl+dpath+DTLB
-  arb.io.cpu.req_val      := dtlb.io.cpu.resp_val;
+//   arb.io.cpu.req_val      := dtlb.io.cpu.resp_val;
+  arb.io.cpu.req_val      := ctrl.io.dmem.req_val;
   arb.io.cpu.req_cmd      := ctrl.io.dmem.req_cmd;
   arb.io.cpu.req_type     := ctrl.io.dmem.req_type;
-  arb.io.cpu.req_addr     := dtlb.io.cpu.resp_addr;
+//   arb.io.cpu.req_addr     := dtlb.io.cpu.resp_addr;
+  arb.io.cpu.req_idx      := dpath.io.dmem.req_addr(PGIDX_BITS-1,0);
+  arb.io.cpu.req_ppn      := dtlb.io.cpu.resp_ppn;
   arb.io.cpu.req_data     := dpath.io.dmem.req_data;
   arb.io.cpu.req_tag      := dpath.io.dmem.req_tag;
   ctrl.io.dmem.req_rdy    := dtlb.io.cpu.req_rdy && arb.io.cpu.req_rdy;
diff --git a/rocket/src/main/scala/ctrl.scala b/rocket/src/main/scala/ctrl.scala
index 0fa03d4a..c79f6909 100644
--- a/rocket/src/main/scala/ctrl.scala
+++ b/rocket/src/main/scala/ctrl.scala
@@ -326,7 +326,8 @@ class rocketCtrl extends Component
   val jr_taken = (ex_reg_br_type === BR_JR);
   val j_taken  = (ex_reg_br_type === BR_J);
 
-  io.dmem.req_val     := ex_reg_mem_val; //  && ~io.dpath.killx;
+//   io.dmem.req_val     := ex_reg_mem_val;
+  io.dmem.req_val     := ex_reg_mem_val && ~io.dpath.killx;
   io.dmem.req_cmd     := ex_reg_mem_cmd;
   io.dmem.req_type    := ex_reg_mem_type;
   
diff --git a/rocket/src/main/scala/dcache.scala b/rocket/src/main/scala/dcache.scala
index 068ccc6a..2bb7dbb2 100644
--- a/rocket/src/main/scala/dcache.scala
+++ b/rocket/src/main/scala/dcache.scala
@@ -5,13 +5,15 @@ import Node._;
 import Constants._;
 import scala.math._;
 
-// interface between D$ and processor pipeline
+// interface between D$ and processor/DTLB
 class ioDmem(view: List[String] = null) extends Bundle(view) {
   val req_val   = Bool('input);
   val req_rdy   = Bool('output);
   val req_cmd   = Bits(4, 'input);
   val req_type  = Bits(3, 'input);
-  val req_addr  = UFix(PADDR_BITS, 'input);
+  val req_idx   = Bits(PGIDX_BITS, 'input);
+  val req_ppn   = Bits(PPN_BITS, 'input);
+//   val req_addr  = UFix(PADDR_BITS, 'input);
   val req_data  = Bits(64, 'input);
   val req_tag   = Bits(5, 'input);
   val resp_miss = Bool('output);
@@ -38,6 +40,70 @@ class ioDCacheDM extends Bundle() {
   val mem = new ioDcache().flip();
 }
 
+class rocketDCacheStoreGen extends Component {
+  val io = new Bundle {
+    val req_type      = Bits(3, 'input);
+    val req_addr_lsb  = Bits(3, 'input);
+    val req_data      = Bits(64, 'input);
+    val store_wmask   = Bits(64, 'output);
+    val store_data    = Bits(64, 'output);
+  }
+  
+  // generate write mask and store data signals based on store type and address LSBs
+  val wmask_b =
+    Mux(io.req_addr_lsb === UFix(0, 3), Bits("b0000_0001", 8),
+    Mux(io.req_addr_lsb === UFix(1, 3), Bits("b0000_0010", 8),
+    Mux(io.req_addr_lsb === UFix(2, 3), Bits("b0000_0100", 8),
+    Mux(io.req_addr_lsb === UFix(3, 3), Bits("b0000_1000", 8),
+    Mux(io.req_addr_lsb === UFix(4, 3), Bits("b0001_0000", 8),
+    Mux(io.req_addr_lsb === UFix(5, 3), Bits("b0010_0000", 8),
+    Mux(io.req_addr_lsb === UFix(6, 3), Bits("b0100_0000", 8),
+    Mux(io.req_addr_lsb === UFix(7, 3), Bits("b1000_0000", 8),
+        UFix(0, 8)))))))));
+
+  val wmask_h =
+    Mux(io.req_addr_lsb(2,1) === UFix(0, 2), Bits("b0000_0011", 8),
+    Mux(io.req_addr_lsb(2,1) === UFix(1, 2), Bits("b0000_1100", 8),
+    Mux(io.req_addr_lsb(2,1) === UFix(2, 2), Bits("b0011_0000", 8),
+    Mux(io.req_addr_lsb(2,1) === UFix(3, 2), Bits("b1100_0000", 8),
+        UFix(0, 8)))));
+
+  val wmask_w =
+    Mux(io.req_addr_lsb(2) === UFix(0, 1), Bits("b0000_1111", 8),
+    Mux(io.req_addr_lsb(2) === UFix(1, 1), Bits("b1111_0000", 8),
+        UFix(0, 8)));
+
+  val wmask_d =
+    Bits("b1111_1111", 8);
+    
+  val store_wmask_byte =
+    Mux(io.req_type === MT_B, wmask_b,
+    Mux(io.req_type === MT_H, wmask_h,
+    Mux(io.req_type === MT_W, wmask_w,
+    Mux(io.req_type === MT_D, wmask_d,
+        UFix(0, 8)))));
+  
+  io.store_wmask := 
+    Cat(Fill(8, store_wmask_byte(7)),
+  		Fill(8, store_wmask_byte(6)),
+  		Fill(8, store_wmask_byte(5)),
+  		Fill(8, store_wmask_byte(4)),
+  		Fill(8, store_wmask_byte(3)),
+  		Fill(8, store_wmask_byte(2)),
+  		Fill(8, store_wmask_byte(1)),
+  		Fill(8, store_wmask_byte(0)));
+    
+  io.store_data :=
+    Mux(io.req_type === MT_B, Fill(8, io.req_data( 7,0)),
+    Mux(io.req_type === MT_H, Fill(4, io.req_data(15,0)),
+    Mux(io.req_type === MT_W, Fill(2, io.req_data(31,0)),
+    Mux(io.req_type === MT_D, io.req_data,
+       UFix(0, 64)))));  
+  
+}
+ 
+
+ 
 // state machine to flush (write back dirty lines, invalidate clean ones) the D$
 class rocketDCacheDM_flush(lines: Int) extends Component {
   val io = new ioDCacheDM();
@@ -48,6 +114,7 @@ class rocketDCacheDM_flush(lines: Int) extends Component {
   val offsetbits = 6;
   val tagmsb    = addrbits - 1;
   val taglsb    = indexbits+offsetbits;
+  val tagbits   = tagmsb-taglsb+1;
   val indexmsb  = taglsb-1;
   val indexlsb  = offsetbits;
   val offsetmsb = indexlsb-1;
@@ -82,7 +149,11 @@ class rocketDCacheDM_flush(lines: Int) extends Component {
   
   dcache.io.cpu.req_val   := (io.cpu.req_val && (io.cpu.req_cmd != M_FLA) && !flush_waiting) || flushing;
   dcache.io.cpu.req_cmd   := Mux(flushing, M_FLA, io.cpu.req_cmd);
-  dcache.io.cpu.req_addr  := Mux(flushing, Cat(Bits(0,tagmsb-taglsb+1), flush_count, Bits(0,offsetbits)).toUFix, io.cpu.req_addr);
+  dcache.io.cpu.req_idx   := Mux(flushing, Cat(flush_count, Bits(0,offsetbits)), io.cpu.req_idx);
+  dcache.io.cpu.req_ppn   := Mux(flushing, UFix(0,PPN_BITS), io.cpu.req_ppn);
+//   dcache.io.cpu.req_addr  := 
+//     Mux(flushing, Cat(Bits(0,tagmsb-taglsb+1), flush_count, Bits(0,offsetbits)).toUFix, 
+//       io.cpu.req_addr);
   dcache.io.cpu.req_tag   := Mux(flushing, r_cpu_req_tag, io.cpu.req_tag);
   dcache.io.cpu.req_type  := io.cpu.req_type;
   dcache.io.cpu.req_data  ^^ io.cpu.req_data;
@@ -102,9 +173,10 @@ class rocketDCacheDM(lines: Int) extends Component {
   
   val addrbits = PADDR_BITS;
   val indexbits = ceil(log10(lines)/log10(2)).toInt;
-  val offsetbits = 6;
-  val tagmsb    = addrbits - 1;
+  val offsetbits = 6; // 64 byte cache lines = 2^6 bytes
+  val tagmsb    = PADDR_BITS-1;
   val taglsb    = indexbits+offsetbits;
+  val tagbits   = tagmsb-taglsb+1;
   val indexmsb  = taglsb-1;
   val indexlsb  = offsetbits;
   val offsetmsb = indexlsb-1;
@@ -113,45 +185,48 @@ class rocketDCacheDM(lines: Int) extends Component {
   val s_reset :: s_ready :: s_replay_load :: s_start_writeback :: s_writeback :: s_req_refill :: s_refill :: s_resolve_miss :: Nil = Enum(8) { UFix() };
   val state = Reg(resetVal = s_reset);
   
-  val r_cpu_req_addr   = Reg(resetVal = Bits(0, addrbits));
+  // idx arrives one clock cycle prior to ppn b/c of DTLB
+  val r_cpu_req_idx    = Reg(resetVal = Bits(0, PGIDX_BITS)); 
+  val r_cpu_req_ppn    = Reg(resetVal = Bits(0, PPN_BITS)); 
   val r_cpu_req_val    = Reg(resetVal = Bool(false));
   val r_cpu_req_cmd    = Reg(resetVal = Bits(0,4));
   val r_cpu_req_type   = Reg(resetVal = Bits(0,3));
   val r_cpu_req_tag    = Reg(resetVal = Bits(0,5));
+  val r_cpu_resp_val   = Reg(resetVal = Bool(false));
 
-  val p_store_data   = Reg(resetVal = Bits(0,64));
-  val p_store_addr   = Reg(resetVal = Bits(0,64));
-  val p_store_cmd    = Reg(resetVal = Bits(0,4));
-  val p_store_type   = Reg(resetVal = Bits(0,3));
-  val p_store_valid  = Reg(resetVal = Bool(false));
+  val p_store_data      = Reg(resetVal = Bits(0,64));
+  val p_store_idx       = Reg(resetVal = Bits(0,PGIDX_BITS));
+  val p_store_type      = Reg(resetVal = Bits(0,3));
+  val p_store_valid     = Reg(resetVal = Bool(false));
 
-  val req_load  = (r_cpu_req_cmd === M_XRD) || (r_cpu_req_cmd === M_PRD);
-  val req_store = (r_cpu_req_cmd === M_XWR);
-  val req_flush = (r_cpu_req_cmd === M_FLA);
-  val req_ptw_load = (r_cpu_req_cmd === M_PRD);
+  val req_store   = (io.cpu.req_cmd === M_XWR);
+  val r_req_load  = (r_cpu_req_cmd === M_XRD) || (r_cpu_req_cmd === M_PRD);
+  val r_req_store = (r_cpu_req_cmd === M_XWR);
+  val r_req_flush = (r_cpu_req_cmd === M_FLA);
+  val r_req_ptw_load = (r_cpu_req_cmd === M_PRD);
 
-  when (io.cpu.req_val && io.cpu.req_rdy) { 
-    r_cpu_req_addr  <== io.cpu.req_addr;
+  when (io.cpu.req_val && io.cpu.req_rdy) {
+    r_cpu_req_idx   <== io.cpu.req_idx;
     r_cpu_req_cmd   <== io.cpu.req_cmd;
     r_cpu_req_type  <== io.cpu.req_type;
     r_cpu_req_tag   <== io.cpu.req_tag;
   }
   
-  when (io.cpu.req_val && io.cpu.req_rdy && (io.cpu.req_cmd === M_XWR)) { 
-    p_store_data  <== io.cpu.req_data;
-    p_store_addr  <== io.cpu.req_addr;
-    p_store_type  <== io.cpu.req_type;
-    p_store_valid <== Bool(true);  
+  when (state === s_ready) {
+    r_cpu_req_ppn <== io.cpu.req_ppn;
   }
-
   when (io.cpu.req_rdy) {
     r_cpu_req_val <== io.cpu.req_val; 
   }  
-  when ((state === s_resolve_miss) && !req_load) {
+  when (state === s_resolve_miss) {
     r_cpu_req_val <== Bool(false);
+    when (r_req_load) {
+      r_cpu_resp_val <== Bool(true);
+    }
   }
+  r_cpu_resp_val <== Bool(false);
         
-  // counter
+  // refill counter
   val rr_count = Reg(resetVal = UFix(0,2));
   val rr_count_next = rr_count + UFix(1);
   when (((state === s_refill) && io.mem.resp_val) || ((state === s_writeback) && io.mem.req_rdy)) { 
@@ -159,146 +234,115 @@ class rocketDCacheDM(lines: Int) extends Component {
   }
 
   // tag array
-  val tagbits = addrbits-(indexbits+offsetbits);
+  val tag_addr = 
+    Mux((state === s_ready), io.cpu.req_idx(PGIDX_BITS-1,offsetbits),
+      r_cpu_req_idx(PGIDX_BITS-1,offsetbits)).toUFix;  
   val tag_we = 
     ((state === s_refill) && io.mem.req_rdy && (rr_count === UFix(3,2))) ||
-    ((state === s_resolve_miss) && req_flush);
-  val tag_array = new rocketSRAMsp(lines, tagbits);
-  val tag_raddr = 
-    Mux((state === s_ready), io.cpu.req_addr(indexmsb, indexlsb).toUFix, 
-      r_cpu_req_addr(indexmsb, indexlsb).toUFix);   
-  tag_array.io.a := tag_raddr;
-  tag_array.io.d    := r_cpu_req_addr(tagmsb, taglsb);
+    ((state === s_resolve_miss) && r_req_flush);
+    
+  val tag_array = new rocketSRAMsp(lines, tagbits);  
+  tag_array.io.a    := tag_addr;
+  tag_array.io.d    := r_cpu_req_ppn;
   tag_array.io.we   := tag_we;
   tag_array.io.bweb := ~Bits(0,tagbits);
   tag_array.io.ce   := Bool(true); // FIXME
-  val tag_rdata = tag_array.io.q;
+  val tag_rdata      = tag_array.io.q;
 
   // valid bit array
   val vb_array = Reg(resetVal = Bits(0, lines));
-  val vb_rdata = Reg(vb_array(tag_raddr));
-  when (tag_we && !req_flush) { 
-    vb_array <== vb_array.bitSet(r_cpu_req_addr(indexmsb, indexlsb).toUFix, UFix(1,1));
+//   val vb_rdata = Reg(vb_array(tag_raddr));
+  when (tag_we && !r_req_flush) { 
+    vb_array <== vb_array.bitSet(r_cpu_req_idx(PGIDX_BITS-1,offsetbits).toUFix, UFix(1,1));
   }
-  when (tag_we && req_flush) {
-    vb_array <== vb_array.bitSet(r_cpu_req_addr(indexmsb, indexlsb).toUFix, UFix(0,1));
+  when (tag_we && r_req_flush) {
+    vb_array <== vb_array.bitSet(r_cpu_req_idx(PGIDX_BITS-1,offsetbits).toUFix, UFix(0,1));
   }
 
-  val tag_valid = vb_rdata.toBool;
-  val tag_match = tag_valid && (tag_rdata === r_cpu_req_addr(tagmsb, taglsb));
+  val tag_valid = Reg(vb_array(tag_addr)).toBool;
+  val tag_match = (tag_rdata === io.cpu.req_ppn);
+  val addr_match    = (r_cpu_req_idx(PGIDX_BITS-1,offsetbits) === p_store_idx(PGIDX_BITS-1,offsetbits));
+  val ldst_conflict = r_cpu_req_val && r_req_load && p_store_valid && addr_match;
+
+  // write the pending store data when the cache is idle, when the next command isn't a load
+  // or when there's a load to the same address (in which case there's a 2 cycle delay:
+  // once cycle to write the store data and another to read the data back) 
+  val drain_store = p_store_valid && (!io.cpu.req_val || req_store || ldst_conflict);
+
+  // write pending store data from a store which missed
+  // after the cache line refill has completed
+  val resolve_store = (state === s_resolve_miss) && r_req_store;
   
-  // generate write mask and store data signals based on store type and address LSBs
-  val wmask_b =
-    Mux(p_store_addr(2,0) === UFix(0, 3), Bits("b0000_0001", 8),
-    Mux(p_store_addr(2,0) === UFix(1, 3), Bits("b0000_0010", 8),
-    Mux(p_store_addr(2,0) === UFix(2, 3), Bits("b0000_0100", 8),
-    Mux(p_store_addr(2,0) === UFix(3, 3), Bits("b0000_1000", 8),
-    Mux(p_store_addr(2,0) === UFix(4, 3), Bits("b0001_0000", 8),
-    Mux(p_store_addr(2,0) === UFix(5, 3), Bits("b0010_0000", 8),
-    Mux(p_store_addr(2,0) === UFix(6, 3), Bits("b0100_0000", 8),
-    Mux(p_store_addr(2,0) === UFix(7, 3), Bits("b1000_0000", 8),
-        UFix(0, 8)))))))));
-
-  val wmask_h =
-    Mux(p_store_addr(2,1) === UFix(0, 2), Bits("b0000_0011", 8),
-    Mux(p_store_addr(2,1) === UFix(1, 2), Bits("b0000_1100", 8),
-    Mux(p_store_addr(2,1) === UFix(2, 2), Bits("b0011_0000", 8),
-    Mux(p_store_addr(2,1) === UFix(3, 2), Bits("b1100_0000", 8),
-        UFix(0, 8)))));
-
-  val wmask_w =
-    Mux(p_store_addr(2) === UFix(0, 1), Bits("b0000_1111", 8),
-    Mux(p_store_addr(2) === UFix(1, 1), Bits("b1111_0000", 8),
-        UFix(0, 8)));
-
-  val wmask_d =
-    Bits("b1111_1111", 8);
-    
-  val store_wmask =
-    Mux(p_store_type === MT_B, wmask_b,
-    Mux(p_store_type === MT_H, wmask_h,
-    Mux(p_store_type === MT_W, wmask_w,
-    Mux(p_store_type === MT_D, wmask_d,
-        UFix(0, 8)))));
-    
-  val store_data =
-    Mux(p_store_type === MT_B, Fill(8, p_store_data( 7,0)),
-    Mux(p_store_type === MT_H, Fill(4, p_store_data(15,0)),
-    Mux(p_store_type === MT_W, Fill(2, p_store_data(31,0)),
-    Mux(p_store_type === MT_D, p_store_data,
-       UFix(0, 64)))));
-
-  val addr_match    = (r_cpu_req_addr(tagmsb, offsetlsb) === p_store_addr(tagmsb, offsetlsb));
-  val ldst_conflict = r_cpu_req_val && req_load && p_store_valid && addr_match;
-  val drain_store   = 
-    (state === s_ready) && p_store_valid &&
-    (!(io.cpu.req_val && (io.cpu.req_cmd === M_XRD)) ||
-     r_cpu_req_val && req_load && p_store_valid && addr_match);
-     
-  val resolve_store = (state === s_resolve_miss) && req_store;
-  val do_store      = drain_store | resolve_store;
-
   // dirty bit array
   val db_array  = Reg(resetVal = Bits(0, lines));
-  val db_rdata  = Reg(db_array(tag_raddr));
-  val tag_dirty = db_rdata.toBool;
+//   val db_rdata  = Reg(db_array(tag_raddr));
+  val tag_dirty = Reg(db_array(tag_addr)).toBool;
   
-  when (do_store)  {
+  when (io.cpu.req_val && io.cpu.req_rdy && req_store) { 
+    p_store_idx   <== io.cpu.req_idx;
+    p_store_data  <== io.cpu.req_data;
+    p_store_type  <== io.cpu.req_type;
+    p_store_valid <== Bool(true);  
+  }
+  when (drain_store)  {
     p_store_valid <== Bool(false);
-    db_array <== db_array.bitSet(p_store_addr(indexmsb, indexlsb).toUFix, UFix(1,1));
+    db_array <== db_array.bitSet(p_store_idx(PGIDX_BITS-1,offsetbits).toUFix, UFix(1,1));
+  }
+  when (resolve_store) {
+    db_array <== db_array.bitSet(p_store_idx(PGIDX_BITS-1,offsetbits).toUFix, UFix(1,1));
   }
   when (tag_we) {
-    db_array <== db_array.bitSet(r_cpu_req_addr(indexmsb, indexlsb).toUFix, UFix(0,1));
+    db_array <== db_array.bitSet(r_cpu_req_idx(PGIDX_BITS-1,offsetbits).toUFix, UFix(0,1));
   }
+  
+  // generate write mask and data signals for stores
+  val storegen = new rocketDCacheStoreGen();
+  storegen.io.req_addr_lsb := p_store_idx(2,0);
+  storegen.io.req_data := p_store_data;
+  storegen.io.req_type := p_store_type
+  val store_data = Fill(2, storegen.io.store_data);
+  val store_wmask_d = storegen.io.store_wmask;
+  val store_idx_sel = p_store_idx(offsetlsb).toBool;
+  val store_wmask = 
+    Mux(store_idx_sel, 
+  		Cat(store_wmask_d, Bits(0,64)),
+  		Cat(Bits(0,64), store_wmask_d)); 
 
   // data array
   val data_array = new rocketSRAMsp(lines*4, 128);
-  val store_wmask_expand = 
-    Cat(Fill(8, store_wmask(7)),
-  		Fill(8, store_wmask(6)),
-  		Fill(8, store_wmask(5)),
-  		Fill(8, store_wmask(4)),
-  		Fill(8, store_wmask(3)),
-  		Fill(8, store_wmask(2)),
-  		Fill(8, store_wmask(1)),
-  		Fill(8, store_wmask(0)));
-  							 
-  val da_store_wmask = 
-    Mux(p_store_addr(offsetlsb).toBool, 
-  		Cat(store_wmask_expand, Bits(0,64)),
-  		Cat(Bits(0,64), store_wmask_expand)); 
-
   data_array.io.a := 
-    Mux(do_store, p_store_addr(indexmsb, offsetmsb-1),
-    Mux((state === s_writeback) && io.mem.req_rdy, Cat(r_cpu_req_addr(indexmsb, indexlsb), rr_count_next),
-    Mux((state === s_start_writeback) || (state === s_writeback) || (state === s_refill), Cat(r_cpu_req_addr(indexmsb, indexlsb), rr_count),
-    Mux((state === s_resolve_miss) || (state === s_replay_load),  r_cpu_req_addr(indexmsb, offsetmsb-1),
-      io.cpu.req_addr(indexmsb, offsetmsb-1))))).toUFix;
+    Mux(drain_store || resolve_store, p_store_idx(PGIDX_BITS-1, offsetmsb-1),
+    Mux((state === s_writeback) && io.mem.req_rdy, Cat(r_cpu_req_idx(PGIDX_BITS-1, offsetbits), rr_count_next),
+    Mux((state === s_start_writeback) || (state === s_writeback) || (state === s_refill), Cat(r_cpu_req_idx(PGIDX_BITS-1, offsetbits), rr_count),
+    Mux((state === s_resolve_miss) || (state === s_replay_load),  r_cpu_req_idx(PGIDX_BITS-1, offsetmsb-1),
+      io.cpu.req_idx(PGIDX_BITS-1, offsetmsb-1))))).toUFix;
       
   data_array.io.d := 
-    Mux((state === s_refill), io.mem.resp_data,
-      Cat(store_data, store_data));
-      
-  data_array.io.we := ((state === s_refill) && io.mem.resp_val) || do_store;
-  data_array.io.bweb := 
-    Mux((state === s_refill), ~Bits(0,128),
-      da_store_wmask);
+    Mux((state === s_refill), io.mem.resp_data, 
+    Mux((state === s_resolve_miss), Fill(2, p_store_data),
+      store_data));
+  data_array.io.we := ((state === s_refill) && io.mem.resp_val) || drain_store || resolve_store;
+  data_array.io.bweb := Mux((state === s_refill), ~Bits(0,128), store_wmask);
   data_array.io.ce := Bool(true); // FIXME
   val data_array_rdata = data_array.io.q;
 
-  val miss = (state === s_ready) && r_cpu_req_val && req_load && (!tag_match || (p_store_valid && addr_match));
+  // signal a load miss when the data isn't present in the cache and when it's in the pending store data register
+  // (causes the cache to block for 2 cycles and the load instruction is replayed)
+  val hit  = tag_valid && tag_match;
+  val load_miss = (state === s_ready) && r_cpu_req_val && r_req_load && (!hit || (p_store_valid && addr_match));
 
   // output signals
-  io.cpu.req_rdy   := (state === s_ready) && !ldst_conflict && (!r_cpu_req_val || (tag_match && !req_flush));
-
-  io.cpu.resp_val  := ((state === s_ready) && r_cpu_req_val && tag_match && req_load && !(p_store_valid && addr_match)) || 
-                      ((state === s_resolve_miss) && req_flush);
+  // busy when there's a load to the same address as a pending store, or on a cache miss, or when executing a flush
+  io.cpu.req_rdy   := (state === s_ready) && !ldst_conflict && (!r_cpu_req_val || (hit && !r_req_flush));
+  io.cpu.resp_val  := ((state === s_ready) && r_cpu_req_val && r_req_load && hit && !(p_store_valid && addr_match)) || 
+                      ((state === s_resolve_miss) && r_req_flush) ||
+                      r_cpu_resp_val;
                       
-  io.cpu.resp_miss := miss;
-//   io.cpu.resp_tag  := Cat(Bits(0,1), r_cpu_req_type, r_cpu_req_addr(2,0), r_cpu_req_tag);
-  io.cpu.resp_tag  := Cat(req_ptw_load, r_cpu_req_type, r_cpu_req_addr(2,0), r_cpu_req_tag);
+  io.cpu.resp_miss := load_miss;
+  // tag MSB distinguishes between loads destined for the PTW and CPU
+  io.cpu.resp_tag  := Cat(r_req_ptw_load, r_cpu_req_type, r_cpu_req_idx(2,0), r_cpu_req_tag);
   io.cpu.resp_data := 
-    Mux(r_cpu_req_addr(offsetlsb).toBool, data_array_rdata(127, 64), 
+    Mux(r_cpu_req_idx(offsetlsb).toBool, data_array_rdata(127, 64), 
       data_array_rdata(63,0));
 
   io.mem.req_val   := (state === s_req_refill) || (state === s_writeback);
@@ -306,8 +350,8 @@ class rocketDCacheDM(lines: Int) extends Component {
   io.mem.req_wdata := data_array_rdata;
   io.mem.req_tag   := UFix(0);
   io.mem.req_addr  := 
-    Mux(state === s_writeback, Cat(tag_rdata, r_cpu_req_addr(indexmsb, indexlsb), rr_count).toUFix, 
-      Cat(r_cpu_req_addr(tagmsb, indexlsb), Bits(0,2)).toUFix);
+    Mux(state === s_writeback, Cat(tag_rdata, r_cpu_req_idx(PGIDX_BITS-1, offsetbits), rr_count), 
+      Cat(r_cpu_req_ppn, r_cpu_req_idx(PGIDX_BITS-1, offsetbits), Bits(0,2))).toUFix;
 
   // control state machine
   switch (state) {
@@ -318,13 +362,13 @@ class rocketDCacheDM(lines: Int) extends Component {
       when (ldst_conflict) {
         state <== s_replay_load;
       }
-      when (!r_cpu_req_val || tag_match) {
+      when (!r_cpu_req_val || (hit && !r_req_flush)) {
         state <== s_ready;
       }
       when (tag_valid & tag_dirty) {
         state <== s_start_writeback; 
       }
-      when (req_flush) {
+      when (r_req_flush) {
         state <== s_resolve_miss;
       }
       otherwise {
@@ -339,8 +383,12 @@ class rocketDCacheDM(lines: Int) extends Component {
     }
     is (s_writeback) {
       when (io.mem.req_rdy && (rr_count === UFix(3,2))) { 
-        when (req_flush) { state <== s_resolve_miss; } 
-        otherwise        { state <== s_req_refill; }
+        when (r_req_flush) {
+          state <== s_resolve_miss;
+        } 
+        otherwise {
+          state <== s_req_refill;
+        }
       }
     }
     is (s_req_refill)
diff --git a/rocket/src/main/scala/dtlb.scala b/rocket/src/main/scala/dtlb.scala
index 006d54a6..0e7a6489 100644
--- a/rocket/src/main/scala/dtlb.scala
+++ b/rocket/src/main/scala/dtlb.scala
@@ -18,11 +18,11 @@ class ioDTLB_CPU(view: List[String] = null) extends Bundle(view)
   val req_cmd  = Bits(4, 'input); // load/store/amo
   val req_rdy  = Bool('output);
   val req_asid = Bits(ASID_BITS, 'input);
-  val req_addr  = UFix(VADDR_BITS, 'input);
+  val req_vpn  = UFix(VPN_BITS, 'input);
   // lookup responses
   val resp_miss = Bool('output);
-  val resp_val = Bool('output);
-  val resp_addr = UFix(PADDR_BITS, 'output);
+//   val resp_val = Bool('output);
+  val resp_ppn = UFix(PPN_BITS, 'output);
   val xcpt_ld = Bool('output);
   val xcpt_st = Bool('output);
 }
@@ -35,25 +35,40 @@ class ioDTLB extends Bundle
 
 class rocketDTLB(entries: Int) extends Component
 {
-  val addr_bits = ceil(log10(entries)/log10(2)).toInt;  
   val io = new ioDTLB();
 
+  val addr_bits = ceil(log10(entries)/log10(2)).toInt;  
+
   val s_ready :: s_request :: s_wait :: Nil = Enum(3) { UFix() };
   val state = Reg(resetVal = s_ready);
-
-  val tag_cam = new rocketCAM(entries, addr_bits, ASID_BITS+VPN_BITS);
   
-  val req_vpn = io.cpu.req_addr(VADDR_BITS-1,PGIDX_BITS);
-  val req_idx = io.cpu.req_addr(PGIDX_BITS-1,0);
-  val req_load  = (io.cpu.req_cmd === M_XRD);
-  val req_store = (io.cpu.req_cmd === M_XWR);
+  val r_cpu_req_vpn     = Reg(resetVal = Bits(0, VPN_BITS));
+  val r_cpu_req_val     = Reg(resetVal = Bool(false));
+  val r_cpu_req_cmd     = Reg(resetVal = Bits(0,4));
+  val r_cpu_req_asid    = Reg(resetVal = Bits(0,ASID_BITS));
+  val r_refill_tag      = Reg(resetVal = Bits(0,ASID_BITS+VPN_BITS));
+  val r_refill_waddr    = Reg(resetVal = UFix(0,addr_bits));
+  val repl_count        = Reg(resetVal = UFix(0,addr_bits));
+  
+  when (io.cpu.req_val && io.cpu.req_rdy) { 
+    r_cpu_req_vpn   <== io.cpu.req_vpn;
+    r_cpu_req_cmd   <== io.cpu.req_cmd;
+    r_cpu_req_asid  <== io.cpu.req_asid;
+  }
+  
+  when (io.cpu.req_rdy) {
+    r_cpu_req_val <== io.cpu.req_val; 
+  }
+  
+//   val req_vpn = r_cpu_req_addr(VADDR_BITS-1,PGIDX_BITS);
+//   val req_idx = io.cpu.req_addr(PGIDX_BITS-1,0);
+  val req_load  = (r_cpu_req_cmd === M_XRD);
+  val req_store = (r_cpu_req_cmd === M_XWR);
 //   val req_amo   = io.cpu.req_cmd(3).toBool;
   
-  val lookup_tag = Cat(io.cpu.req_asid, req_vpn);
-  val r_refill_tag   = Reg(resetVal = Bits(0, ASID_BITS+VPN_BITS));
-  val r_refill_waddr = Reg(resetVal = UFix(0, addr_bits));
-  val repl_count = Reg(resetVal = UFix(0, addr_bits));
-  
+  val lookup_tag = Cat(r_cpu_req_asid, r_cpu_req_vpn);
+
+  val tag_cam = new rocketCAM(entries, addr_bits, ASID_BITS+VPN_BITS);  
   val tag_ram = Mem(entries, io.ptw.resp_val, r_refill_waddr.toUFix, io.ptw.resp_ppn);
   
   tag_cam.io.clear      := io.cpu.invalidate;
@@ -61,6 +76,7 @@ class rocketDTLB(entries: Int) extends Component
   tag_cam.io.write      := io.ptw.resp_val;
   tag_cam.io.write_tag  := r_refill_tag;
   tag_cam.io.write_addr := r_refill_waddr;
+  val tag_hit            = tag_cam.io.hit;
   val tag_hit_addr       = tag_cam.io.hit_addr;
   
   // extract fields from status register
@@ -75,10 +91,10 @@ class rocketDTLB(entries: Int) extends Component
   val ptw_perm_sw = io.ptw.resp_perm(5);
   
   // permission bit arrays
-  val ur_array = Reg(resetVal = Bits(0, entries)); // user execute permission
-  val uw_array = Reg(resetVal = Bits(0, entries)); // user execute permission
-  val sr_array = Reg(resetVal = Bits(0, entries)); // supervisor execute permission
-  val sw_array = Reg(resetVal = Bits(0, entries)); // supervisor execute permission
+  val ur_array = Reg(resetVal = Bits(0, entries)); // user read permission
+  val uw_array = Reg(resetVal = Bits(0, entries)); // user write permission
+  val sr_array = Reg(resetVal = Bits(0, entries)); // supervisor read permission
+  val sw_array = Reg(resetVal = Bits(0, entries)); // supervisor write permission
   when (io.ptw.resp_val) {
     ur_array <== ur_array.bitSet(r_refill_waddr, ptw_perm_ur);
     uw_array <== uw_array.bitSet(r_refill_waddr, ptw_perm_uw);
@@ -103,12 +119,13 @@ class rocketDTLB(entries: Int) extends Component
   
   val repl_waddr = Mux(invalid_entry, ie_addr, repl_count).toUFix;
   
-  val lookup_hit  = (state === s_ready) && io.cpu.req_val && tag_cam.io.hit;
-  val lookup_miss = (state === s_ready) && io.cpu.req_val && !tag_cam.io.hit;
-  
+  val lookup_hit  = (state === s_ready) && r_cpu_req_val && tag_hit;
+  val lookup_miss = (state === s_ready) && r_cpu_req_val && !tag_hit;
   val tlb_hit  = status_vm && lookup_hit;
   val tlb_miss = status_vm && lookup_miss;
   
+  // currently replace TLB entries in LIFO order
+  // TODO: implement LRU replacement policy
   when (tlb_miss) {
     r_refill_tag <== lookup_tag;
     r_refill_waddr <== repl_waddr;
@@ -130,10 +147,7 @@ class rocketDTLB(entries: Int) extends Component
 
   io.cpu.req_rdy   := (state === s_ready);
   io.cpu.resp_miss := tlb_miss;
-  io.cpu.resp_val  := Mux(status_vm, lookup_hit, io.cpu.req_val);
-  io.cpu.resp_addr  := 
-    Mux(status_vm, Cat(tag_ram(tag_hit_addr), req_idx),
-      io.cpu.req_addr(PADDR_BITS-1,0)).toUFix;
+  io.cpu.resp_ppn := Mux(status_vm, tag_ram(tag_hit_addr), r_cpu_req_vpn(PPN_BITS-1,0)).toUFix;
   
   io.ptw.req_val := (state === s_request);
   io.ptw.req_vpn := r_refill_tag(VPN_BITS-1,0);
diff --git a/rocket/src/main/scala/ptw.scala b/rocket/src/main/scala/ptw.scala
index 64cdb76d..048816db 100644
--- a/rocket/src/main/scala/ptw.scala
+++ b/rocket/src/main/scala/ptw.scala
@@ -7,7 +7,7 @@ import scala.math._;
 
 class ioDmemArbiter extends Bundle
 {
-  val ptw = new ioDmem(List("req_val", "req_rdy", "req_cmd", "req_type", "req_addr", "resp_data", "resp_val"));
+  val ptw = new ioDmem(List("req_val", "req_rdy", "req_cmd", "req_type", "req_idx", "req_ppn", "resp_data", "resp_val"));
   val cpu = new ioDmem();
   val mem = new ioDmem().flip();
 }
@@ -19,7 +19,8 @@ class rocketDmemArbiter extends Component
   io.mem.req_val  := io.ptw.req_val || io.cpu.req_val;
   io.mem.req_cmd  := Mux(io.ptw.req_val, io.ptw.req_cmd,  io.cpu.req_cmd);
   io.mem.req_type := Mux(io.ptw.req_val, io.ptw.req_type, io.cpu.req_type);
-  io.mem.req_addr := Mux(io.ptw.req_val, io.ptw.req_addr, io.cpu.req_addr);
+  io.mem.req_idx  := Mux(io.ptw.req_val, io.ptw.req_idx, io.cpu.req_idx);
+  io.mem.req_ppn  := Mux(io.ptw.req_val, io.ptw.req_ppn, io.cpu.req_ppn);
   io.mem.req_data := io.cpu.req_data;
   io.mem.req_tag  := Mux(io.ptw.req_val, Bits(0,5), io.cpu.req_tag);
   
@@ -40,7 +41,7 @@ class ioPTW extends Bundle
 {
   val itlb = new ioTLB_PTW().flip();
   val dtlb = new ioTLB_PTW().flip();
-  val dmem = new ioDmem(List("req_val", "req_rdy", "req_cmd", "req_type", "req_addr", "resp_data", "resp_val")).flip();
+  val dmem = new ioDmem(List("req_val", "req_rdy", "req_cmd", "req_type", "req_ppn", "req_idx", "resp_data", "resp_val")).flip();
   val ptbr = UFix(PADDR_BITS, 'input);
 }
 
@@ -90,7 +91,9 @@ class rocketPTW extends Component
     
   io.dmem.req_cmd  := M_PRD;
   io.dmem.req_type := MT_D;
-  io.dmem.req_addr := req_addr;
+//   io.dmem.req_addr := req_addr;
+  io.dmem.req_idx := req_addr(PGIDX_BITS-1,0);
+  io.dmem.req_ppn := req_addr(PADDR_BITS-1,PGIDX_BITS);
   
   val resp_val = (state === s_done) || (state === s_l1_fake) || (state === s_l2_fake);
   val resp_err = (state === s_error);