SMT‐based context‐bounded model checking for CUDA programs

Abstract

We present ESBMC-GPU tool, an extension to the Efficient SMT-Based Context-Bounded Model Checker (ESBMC), which is aimed at verifying Graphics Processing Unit (GPU) programs written for the Compute Unified Device Architecture (CUDA) platform. ESBMC-GPU uses an operational model, that is, an abstract representation of the standard CUDA libraries, which conservatively approximates their semantics, in order to verify CUDA-based programs. It then explicitly explores the possible interleavings (up to the given context bound), while treats each interleaving itself symbolically. Additionally, ESBMC-GPU employs the monotonic partial order reduction and the two-thread analysis to prune the state space exploration. Experimental results show that ESBMC-GPU can successfully verify 82% of all benchmarks, while keeping lower rates of false results. Going further than previous attempts, ESBMC-GPU is able to detect more properties violations than other existing GPU verifiers due to its ability to verify errors of the program execution flow and to detect array out-of-bounds and data race violations. exploration, similar to Cordeiro et al. [4]. In particular, we explicitly explore the possible interleavings (up to the given context bound), while we treat each interleaving itself symbolically w.r.t. a given property.To prune the state-space exploration, we apply Monotonic Partial Order Reduction (MPOR) [12] to CUDA programs, which eliminates redundant interleavings without missing any behavior that can be exhibited by the program. We have modified the MPOR algorithm to identify transitions between threads that accessed different memory locations in the same array. Because CUDA kernels typically produce regular and independent access to explore the benefits of the GPU execution model, the application of MPOR routinely leads to substantial performance improvements in most benchmarks. Thus, using operational models that simulate CUDA libraries, together with MPOR implementation in ESBMC-GPU, we achieve significant (correct) results of CUDA kernels verification, primarily when compared with other state-of-the-art GPU verifiers [3,[7][8][9]. Additionally, the present approach considers low-level aspects related to dynamic memory allocation, data transfer, memory deallocation, and overflow. Such violations are typically present in CUDA programs, however, they are routinely ignored by most GPU verifiers. Thus, we provide a more precise verification than other existing approaches, considering soundness of data passed by the main program to the kernel, with the drawback of leading to a higher verification time. ContributionsWe make four major contributions:we extend benefits of SMT-based context-bounded model checking for CUDA programs, in the context of parallel programming for GPUs, to detect more failures than other existing approaches, while keeping lower rates of false results; although SMT-based context-bounded model checking is not a novel technique, we have not seen in the literature its application to verify CUDA programs. this wor...

Bounded model checking of C++ programs based on the Qt cross‐platform framework

“…The original idea of performing model checking of real embedded applications, through an environment operational model, has already been done before in the literature and the correctness of such operational model is actually a major issue. Consequently, the usefulness of QtOM relies on the fact that it correctly represents the original Qt libraries.…”

ESBMC-GPU A context-bounded model checking tool to verify CUDA programs

“…ESBMC was designed to handle multi-threaded software, through the use of an API called POSIX -ISO/IEC 9945 [18]. In order to support the verification of CUDA kernels, COM applies code transformations to kernel calls using ESBMC's intrinsic functions [6]. In particular, thread/block configurations in a CUDA kernel call are used as parameters in such intrinsic functions, which are responsible for checking for preconditions, configuring block and threads dimension, and translating GPU threads to POSIX ones.…”

“…ESBMC models the Pthreads API [12] to support thread synchronization, i.e., mutex locking operations and conditional waiting, and dynamic creation of threads, which makes that representation very similar to the official CUDA scheduler [6], in such a way that our multi-threading model approximates to that of GPU kernels. Therefore, COM is able to use such aspects present in ESBMC, in order to handle variables in different types of memory and also in inter-warp communication.…”

“…In CUDA programs, whilst threads execute the same parametrized kernel, only two of them are necessary for conflict check. Thus, such an analysis ensures that errors (e.g., data races) detected between two threads, in a given subgroup and due to unsynchronized accesses to shared variables, are enough to justify a property violation [6].…”

“…In order to address the mentioned issues, an extension to the Efficient SMT-Based Context-Bounded Model Checker (ESBMC) [3] was developed, named as ESBMC-GPU [4,5,6], with the goal of verifying CUDA-based programs (available online at http://esbmc.org/gpu/). ESBMC-GPU consists of an extension for parsing CUDA source code (i.e., a front-end to ESBMC) and a CUDA operational model (COM), which is an abstract representation of the standard CUDA libraries (i.e., the native API) that conservatively approximates their semantics.…”