A Hoare Logic for SIMT Programs

Kojima, Kensuke; Igarashi, Atsushi

doi:10.1007/978-3-319-03542-0_5

Cited by 11 publications

(5 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…GPUVerify also relies on a two-thread abstraction (pen and paper proof)-in this paper, we present the first machine-checked proof of the two-thread abstraction idea. VeriCUDA [20,21] focuses on reasoning about the functional correctness of GPU programs using Hoare-logic. In [22] the authors extend VeriCUDA to proving DRF.…”

Section: Related Workmentioning

confidence: 99%

Checking Data-Race Freedom of GPU Kernels, Compositionally

Cogumbreiro

Lange

Rong

et al. 2021

Computer Aided Verification

View full text Add to dashboard Cite

GPUs offer parallelism as a commodity, but they are difficult to program correctly. Static analyzers that guarantee data-race freedom (DRF) are essential to help programmers establish the correctness of their programs (kernels). However, existing approaches produce too many false alarms and struggle to handle larger programs. To address these limitations we formalize a novel compositional analysis for DRF, based on access memory protocols. These protocols are behavioral types that codify the way threads interact over shared memory.Our work includes fully mechanized proofs of our theoretical results, the first mechanized proofs in the field of DRF analysis for GPU kernels. Our theory is implemented in , a tool that outperforms the state-of-the-art. Notably, it can correctly verify at least $$1.42{\times }$$ 1.42 × more real-world kernels, and it exhibits a linear growth in 4 out of 5 experiments, while others grow exponentially in all 5 experiments.

show abstract

Section: Related Workmentioning

confidence: 99%

Checking Data-Race Freedom of GPU Kernels, Compositionally

Cogumbreiro

Lange

Rong

et al. 2021

Computer Aided Verification

View full text Add to dashboard Cite

show abstract

“…In the same vein as the GPUVerify project, several other methods for testing and verifying properties of GPU kernels have been proposed. These include approaches based on dynamic analysis [47], [48], [49], verification via SMT solving [50], [51], [52], symbolic execution [53], [54] and program logic [55], [56]. Among these approaches, GPUVerify is the only technique that uses candidatebased invariant generation as part of its analysis method.…”

Section: Related Workmentioning

confidence: 99%

Implementing and Evaluating Candidate-Based Invariant Generation

Betts

Chong

Deligiannis

et al. 2018

IIEEE Trans. Software Eng.

View full text Add to dashboard Cite

The discovery of inductive invariants lies at the heart of static program verification. Presently, many automatic solutions to inductive invariant generation are inflexible, only applicable to certain classes of programs, or unpredictable. An automatic technique that circumvents these deficiencies to some extent is candidate-based invariant generation, whereby a large number of candidate invariants are guessed and then proven to be inductive or rejected using a sound program analyzer. This paper describes our efforts to apply candidate-based invariant generation in GPUVerify, a static checker for programs that run on GPUs. We study a set of 383 GPU programs that contain loops, drawn from a number of open source suites and vendor SDKs. Among this set, 253 benchmarks require provision of loop invariants for verification to succeed. We describe the methodology we used to incrementally improve the invariant generation capabilities of GPUVerify to handle these benchmarks, through candidate-based invariant generation, using cheap static analysis to speculate potential program invariants. We also describe a set of experiments that we used to examine the effectiveness of our rules for candidate generation, assessing rules based on their generality (the extent to which they generate candidate invariants), hit rate (the extent to which the generated candidates hold), worth (the extent to which provable candidates actually help in allowing verification to succeed), and influence (the extent to which the success of one generation rule depends on candidates generated by another rule). We believe that our methodology may serve as a useful framework for other researchers interested in candidate-based invariant generation. The candidates produced by GPUVerify help to verify 231 of the 253 programs. This increase in precision, however, makes GPUVerify sluggish: the more candidates that are generated, the more time is spent determining which are inductive invariants. To speed up this process, we have investigated four under-approximating program analyses that aim to reject false candidates quickly and a framework whereby these analyses can run in sequence or in parallel. Across two platforms, running Windows and Linux, our results show that the best combination of these techniques running sequentially speeds up invariant generation across our benchmarks by 1.17× (Windows) and 1.01× (Linux), with per-benchmark best speedups of 93.58× (Windows) and 48.34× (Linux), and worst slowdowns of 10.24× (Windows) and 43.31× (Linux). We find that parallelizing the strategies marginally improves overall invariant generation speedups to 1.27× (Windows) and 1.11× (Linux), maintains good best-case speedups of 91.18× (Windows) and 44.60× (Linux), and, importantly, dramatically reduces worst-case slowdowns to 3.15× (Windows) and 3.17× (Linux).

show abstract

“…Kojima et al proposed a Hoare logic for single instruction multiple threads (SIMT) programs and proved the soundness and relative completeness of the logic [7]. SIMT semantics force all threads to execute a every step of a program simultaneously.…”

Section: Related Workmentioning

confidence: 99%

Proof of Soundness of Concurrent Separation Logic for GPGPU in Coq

Asakura

Masuhara

Aotani

2016

Journal of Information Processing

View full text Add to dashboard Cite

We design a concurrent separation logic for GPGPU, namely GPUCSL, and prove its soundness by using Coq. GPUCSL is based on a CSL proposed by Blom et al., which is for automatic verification of GPGPU kernels, but employs different inference rules because the rules in Blom's CSL are not standard. For example, Blom's CSL does not have a frame rule. Our CSL is a simple extension of the original CSL, and it is more suitable as a basis of advanced properties proposed for other studies on CSLs. Our soundness proof is based on Vafeiadis' method, which is for a CSL with a fork-join concurrency model. The proof reveals two problems in Blom's approach in terms of soundness and extensibility. First, their assumption that thread ID independence of a kernel implies barrier divergence freedom does not hold. Second, it is not easy to extend their proof to other CSLs with a frame rule. Although our CSL covers only a subset of CUDA, our preliminary experiment shows that it is useful and expressive enough to verify a simple kernel with barriers.

show abstract

A Hoare Logic for SIMT Programs

Cited by 11 publications

References 13 publications

Checking Data-Race Freedom of GPU Kernels, Compositionally

Checking Data-Race Freedom of GPU Kernels, Compositionally

Implementing and Evaluating Candidate-Based Invariant Generation

Proof of Soundness of Concurrent Separation Logic for GPGPU in Coq

Contact Info

Product

Resources

About