  Graphics Processing Units (GPU) offer tremendous computational power by
following a throughput oriented computing paradigm where many thousand
computational units operate in parallel. Programming this massively parallel
hardware is challenging. Programmers must correctly and efficiently coordinate
thousands of threads and their accesses to various shared memory spaces.
Existing mainstream GPU programming languages, such as CUDA and OpenCL, are
based on C/C++ inheriting their fundamentally unsafe ways to access memory via
raw pointers. This facilitates easy to make, but hard to detect bugs such as
data races and deadlocks.
  In this paper, we present Descend: a safe GPU systems programming language.
In the spirit of Rust, Descend's type system enforces safe CPU and GPU memory
management by tracking Ownership and Lifetimes. Descend introduces a new
holistic GPU programming model where computations are hierarchically scheduled
over the GPU's execution resources: grid, blocks, and threads. Descend's
extended Borrow checking ensures that execution resources safely access memory
regions without introducing data races. For this, we introduced views
describing safe parallel access patterns of memory regions.
  We discuss the memory safety guarantees offered by Descend's type system and
evaluate our implementation of Descend using a number of benchmarks, showing
that no significant runtime overhead is introduced compared to manually written
CUDA programs lacking Descend's safety guarantees.
