Formal Verification of an Out-of-Order Multiprocessor against an In-Order Weak-Memory ISA

2026-07-21

AI Summary

This work addresses transient, architecturally illegal intermediate states that can arise in out-of-order multicore processors under weak memory models. The authors propose a core specification that abstracts microarchitectural redundancy as instruction sequences and validates correctness in two steps: first, proving that the processor implementation refines this specification; second, reducing system-level out-of-order execution and inter-core interleavings to sequential ISA semantics. This approach yields the first unbounded formal verification of equivalence between an out-of-order multicore processor and a sequentially consistent weak-memory ISA, effectively isolating the impact of illegal intermediate states. The entire verification is mechanized in the Rocq theorem prover and innovatively leverages a large language model agent to automatically generate proofs covering all possible out-of-order executions and concurrent interleavings.

Abstract

Out-of-order multiprocessor is a critical piece of modern hardware, and their verification must solve the following challenges. First, inter-core interleaving, in which the order their reads and writes reach shared memory is unrestricted. Second, intra-core out-of-order execution, in which instructions fire out of program order. The combination of the two yields weak outcomes, which no sequential execution explains, and modern ISA allows such behaviors to account for them. However, the microarchitecture even exhibits excess out-of-order executions, temporarily entering states forbidden by the ISA. While discarded later, such states complicate reasoning about the core in full-system verification. Prior works verify a range of processor designs, while none have performed unbounded verification for out-of-order multiprocessor exhibiting such weak outcomes. We present the first formal verification of an out-of-order multiprocessor against an in-order, weak-memory ISA. Our key idea is a well-designed core specification, which captures the essence of excess executions in a single list of instructions. Building upon this, we decompose the proof into two steps. The first is a core refinement, proving a core implementation against this specification, abstracting away every microarchitectural state except those necessary to reason about excess executions and the core interface. The second is a system inclusion, serializing the out-of-order memory executions and inter-core interleaving into the ISA, easily removing excess executions thanks to the core specification. All of our proofs are mechanized in Rocq, heavily utilizing large language model (LLM) agents to write proofs automatically.

Problem

• formal verification
• out-of-order multiprocessor
• weak-memory ISA
• excess executions
• inter-core interleaving

Innovation

• formal verification
• out-of-order multiprocessor
• weak-memory model
• core refinement
• mechanized proof