Formal Verification of an Out-of-Order Multiprocessor against an In-Order Weak-Memory ISA
This work addresses transient, architecturally illegal intermediate states that can arise in out-of-order multicore processors under weak memory models. The authors propose a core specification that abstracts microarchitectural redundancy as instruction sequences and validates correctness in two steps: first, proving that the processor implementation refines this specification; second, reducing system-level out-of-order execution and inter-core interleavings to sequential ISA semantics. This approach yields the first unbounded formal verification of equivalence between an out-of-order multicore processor and a sequentially consistent weak-memory ISA, effectively isolating the impact of illegal intermediate states. The entire verification is mechanized in the Rocq theorem prover and innovatively leverages a large language model agent to automatically generate proofs covering all possible out-of-order executions and concurrent interleavings.