extensions/EXT_robustness.txt

Name

    EXT_robustness

Name Strings

    GL_EXT_robustness

Contributors

    Daniel Koch, TransGaming
    Nicolas Capens, TransGaming
    Contributors to ARB_robustness

Contact

    Greg Roth, NVIDIA (groth 'at' nvidia.com)

Status

    Complete.

Version

    Version 3, 2011/10/31

Number

    OpenGL ES Extension #107

Dependencies

    This extension is written against the OpenGL ES 2.0 Specification
    but can apply to OpenGL ES 1.1 and up.

    EGL_EXT_create_context_robustness is used to determine if a context
    implementing this extension supports robust buffer access, and if it
    supports reset notification. 

Overview

    Several recent trends in how OpenGL integrates into modern computer
    systems have created new requirements for robustness and security
    for OpenGL rendering contexts.
    
    Additionally GPU architectures now support hardware fault detection;
    for example, video memory supporting ECC (error correcting codes)
    and error detection.  OpenGL contexts should be capable of recovering
    from hardware faults such as uncorrectable memory errors.  Along with
    recovery from such hardware faults, the recovery mechanism can
    also allow recovery from video memory access exceptions and system
    software failures.  System software failures can be due to device
    changes or driver failures.

    OpenGL queries that that return (write) some number of bytes to a
    buffer indicated by a pointer parameter introduce risk of buffer
    overflows that might be exploitable by malware. To address this,
    queries with return value sizes that are not expressed directly by
    the parameters to the query itself are given additional API
    functions with an additional parameter that specifies the number of
    bytes in the buffer and never writing bytes beyond that limit. This
    is particularly useful for multi-threaded usage of OpenGL contexts
    in a "share group" where one context can change objects in ways that
    can cause buffer overflows for another context's OpenGL queries.

    The original ARB_vertex_buffer_object extension includes an issue
    that explicitly states program termination is allowed when
    out-of-bounds vertex buffer object fetches occur. Modern graphics
    hardware is capable well-defined behavior in the case of out-of-
    bounds vertex buffer object fetches. Older hardware may require
    extra checks to enforce well-defined (and termination free)
    behavior, but this expense is warranted when processing potentially
    untrusted content.

    The intent of this extension is to address some specific robustness
    goals:

    *   For all existing OpenGL queries, provide additional "safe" APIs 
        that limit data written to user pointers to a buffer size in 
        bytes that is an explicit additional parameter of the query.

    *   Provide a mechanism for an OpenGL application to learn about
        graphics resets that affect the context.  When a graphics reset
        occurs, the OpenGL context becomes unusable and the application
        must create a new context to continue operation. Detecting a
        graphics reset happens through an inexpensive query.

    *   Provide an enable to guarantee that out-of-bounds buffer object
        accesses by the GPU will have deterministic behavior and preclude
        application instability or termination due to an incorrect buffer
        access.  Such accesses include vertex buffer fetches of
        attributes and indices, and indexed reads of uniforms or
        parameters from buffers.

New Procedures and Functions

        enum GetGraphicsResetStatusEXT();

        void ReadnPixelsEXT(int x, int y, sizei width, sizei height,
                            enum format, enum type, sizei bufSize,
                            void *data);

        void GetnUniformfvEXT(uint program, int location, sizei bufSize,
                              float *params);
        void GetnUniformivEXT(uint program, int location, sizei bufSize,
                              int *params);

New Tokens

    Returned by GetGraphicsResetStatusEXT:

        NO_ERROR                                        0x0000
        GUILTY_CONTEXT_RESET_EXT                        0x8253
        INNOCENT_CONTEXT_RESET_EXT                      0x8254
        UNKNOWN_CONTEXT_RESET_EXT                       0x8255

    Accepted by the <value> parameter of GetBooleanv, GetIntegerv,
    and GetFloatv:

        CONTEXT_ROBUST_ACCESS_EXT                       0x90F3
        RESET_NOTIFICATION_STRATEGY_EXT                 0x8256

    Returned by GetIntegerv and related simple queries when <value> is
    RESET_NOTIFICATION_STRATEGY_EXT :

        LOSE_CONTEXT_ON_RESET_EXT                       0x8252
        NO_RESET_NOTIFICATION_EXT                       0x8261

Additions to Chapter 2 of the OpenGL ES 2.0 Specification (OpenGL ES Operation)

Add a new subsection after 2.5 "GL Errors" and renumber subsequent
sections accordingly.

    2.6 "Graphics Reset Recovery"

    Certain events can result in a reset of the GL context. Such a reset
    causes all context state to be lost. Recovery from such events
    requires recreation of all objects in the affected context. The
    current status of the graphics reset state is returned by

        enum GetGraphicsResetStatusEXT();

    The symbolic constant returned indicates if the GL context has been
    in a reset state at any point since the last call to
    GetGraphicsResetStatusEXT. NO_ERROR indicates that the GL context
    has not been in a reset state since the last call.
    GUILTY_CONTEXT_RESET_EXT indicates that a reset has been detected
    that is attributable to the current GL context.
    INNOCENT_CONTEXT_RESET_EXT indicates a reset has been detected that
    is not attributable to the current GL context.
    UNKNOWN_CONTEXT_RESET_EXT indicates a detected graphics reset whose
    cause is unknown.

    If a reset status other than NO_ERROR is returned and subsequent
    calls return NO_ERROR, the context reset was encountered and
    completed. If a reset status is repeatedly returned, the context may
    be in the process of resetting.

    Reset notification behavior is determined at context creation time,
    and may be queried by calling GetIntegerv with the symbolic constant
    RESET_NOTIFICATION_STRATEGY_EXT.

    If the reset notification behavior is NO_RESET_NOTIFICATION_EXT,
    then the implementation will never deliver notification of reset
    events, and GetGraphicsResetStatusEXT will always return
    NO_ERROR[fn1].
       [fn1: In this case it is recommended that implementations should
        not allow loss of context state no matter what events occur.
        However, this is only a recommendation, and cannot be relied
        upon by applications.]

    If the behavior is LOSE_CONTEXT_ON_RESET_EXT, a graphics reset will
    result in the loss of all context state, requiring the recreation of
    all associated objects. In this case GetGraphicsResetStatusEXT may
    return any of the values described above.

    If a graphics reset notification occurs in a context, a notification
    must also occur in all other contexts which share objects with that
    context[fn2].
       [fn2: The values returned by GetGraphicsResetStatusEXT in the
        different contexts may differ.]

    Add to Section 2.8 "Vertex Arrays" before subsection "Transferring
    Array Elements"

    Robust buffer access is enabled by creating a context with robust
    access enabled through the window system binding APIs. When enabled,
    indices within the vertex array that lie outside the arrays defined
    for enabled attributes result in undefined values for the
    corresponding attributes, but cannot result in application failure.
    Robust buffer access behavior may be queried by calling GetIntegerv
    with the symbolic constant CONTEXT_ROBUST_ACCESS_EXT.

Additions to Chapter 4 of the OpenGL ES 2.0 Specification (Per-Fragment
Operations and the Frame Buffer)

    Modify section 4.3.1 "Reading Pixels"

    Pixels are read using

        void ReadPixels(int x, int y, sizei width, sizei height,
                        enum format, enum type, void *data);
        void ReadnPixelsEXT(int x, int y, sizei width, sizei height,
                           enum format, enum type, sizei bufSize,
                           void *data);

    Add to the description of ReadPixels:

    ReadnPixelsEXT behaves identically to ReadPixels except that it does
    not write more than <bufSize> bytes into <data>. If the buffer size
    required to fill all the requested data is greater than <bufSize> an
    INVALID_OPERATION error is generated and <data> is not altered.

Additions to Chapter 5 of the OpenGL ES 2.0 Specification (Special
Functions):

    None

Additions to Chapter 6 of the OpenGL ES 2.0 Specification (State and
State Requests)

    Modify Section 6.1.8 "Shader and Program Queries"

    The commands

        void GetUniformfv(uint program, int location, float *params);
        void GetnUniformfvEXT(uint program, int location, sizei bufSize,
                              float *params);
        void GetUniformiv(uint program, int location, int *params);
        void GetnUniformivEXT(uint program, int location, sizei bufSize,
                              int *params);

    return the value or values of the uniform at location <location>
    for program object <program> in the array <params>. Calling
    GetnUniformfvEXT or GetnUniformivEXT ensures that no more than
    <bufSize> bytes are written into <params>. If the buffer size
    required to fill all the requested data is greater than <bufSize> an
    INVALID_OPERATION error is generated and <params> is not altered.
    ...

Additions to The OpenGL ES Shading Language Specification, Version 1.

    Append to the third paragraph of section 4.1.9 "Arrays"

    If robust buffer access is enabled via the OpenGL ES API, such
    indexing must not result in abnormal program termination. The
    results are still undefined, but implementations are encouraged to
    produce zero values for such accesses.

Interactions with EGL_EXT_create_context_robustness

    If the EGL window-system binding API is used to create a context,
    the EGL_EXT_create_context_robustness extension is supported, and
    the attribute EGL_CONTEXT_OPENGL_ROBUST_ACCESS_EXT is set to
    EGL_TRUE when eglCreateContext is called, the resulting context will
    perform robust buffer access as described above in section 2.8, and
    the CONTEXT_ROBUST_ACCESS_EXT query will return GL_TRUE as described
    above in section 6.1.5.

    If the EGL window-system binding API is used to create a context and
    the EGL_EXT_create_context_robustness extension is supported, then
    the value of attribute EGL_CONTEXT_RESET_NOTIFICATION_STRATEGY_EXT
    determines the reset notification behavior and the value of
    RESET_NOTIFICATION_STRATEGY_EXT, as described in section 2.6.

Errors

    ReadnPixelsEXT, GetnUniformfvEXT, and GetnUniformivEXT share all the
    errors of their unsized buffer query counterparts with the addition
    that INVALID_OPERATION is generated if the buffer size required to
    fill all the requested data is greater than <bufSize>.

New Implementation Dependent State

    Get Value                       Type  Get Command     Minimum Value    Description                  Sec.  Attribute
    ---------                       ----  -----------     -------------    ---------------------------  ----- ---------
    CONTEXT_ROBUST_ACCESS_EXT       B     GetIntegerv     -                Robust access enabled        6.1.5 -
    RESET_NOTIFICATION_STRATEGY_EXT Z_2   GetIntegerv     See sec. 2.6     Reset notification behavior  2.6   -

Issues


    1.  What should this extension be called?

        RESOLVED: EXT_robustness

        Since this is intended to be a version of ARB_robustness for
        OpenGL ES, it should be named accordingly.

    2.  How does this extension differ from Desktop GL's ARB_robustness?

        RESOLVED: Because EGL_EXT_create_context_robustness uses a
	separate attribute to enable robust buffer access, a
	corresponding query is added here.

    3.  Should we provide a context creation mechanism to enable this extension?

        RESOLVED. Yes.

        Currently, EGL_EXT_create_context_robustness provides this
        mechanism via two unique attributes. These attributes differ
	from those specified by KHR_create_context to allow for
	differences in what functionality those attributes define.
        
    4. What can cause a graphics reset?

       Either user or implementor errors may result in a graphics reset.
       If the application attempts to perform a rendering that takes too long
       whether due to an infinite loop in a shader or even just a rendering
       operation that takes too long on the given hardware. Implementation
       errors may produce badly formed hardware commands. Memory access errors
       may result from user or implementor mistakes. On some systems, power
       management events such as system sleep, screen saver activation, or
       pre-emption may also context resets to occur. Any of these events may
       result in a graphics reset event that will be detectable by the
       mechanism described in this extension.

    5. How should the application react to a reset context event?

       RESOLVED: For this extension, the application is expected to query
       the reset status until NO_ERROR is returned. If a reset is encountered,
       at least one *RESET* status will be returned. Once NO_ERROR is again
       encountered, the application can safely destroy the old context and
       create a new one.

       After a reset event, apps should not use a context for any purpose
       other than determining its reset status, and then destroying it. If a
       context receives a reset event, all other contexts in its share group
       will also receive reset events, and should be destroyed and
       recreated.

       Apps should be cautious in interpreting the GUILTY and INNOCENT reset
       statuses. These are guidelines to the immediate cause of a reset, but
       not guarantees of the ultimate cause.

    6. If a graphics reset occurs in a shared context, what happens in
       shared contexts?

       RESOLVED: A reset in one context will result in a reset in all other
       contexts in its share group. 

    7. How can an application query for robust buffer access support,
       since this is now determined at context creation time?

       RESOLVED. The application can query the value of ROBUST_ACCESS_EXT
       using GetIntegerv. If true, this functionality is enabled.

    8. How is the reset notification behavior controlled?

       RESOLVED: Reset notification behavior is determined at context
       creation time using EGL/GLX/WGL/etc. mechanisms. In order that shared
       objects be handled predictably, a context cannot share with
       another context unless both have the same reset notification
       behavior.


Revision History

    Rev.    Date       Author     Changes
    ----  ------------ ---------  ----------------------------------------
      3   31 Oct  2011 groth      Reverted to attribute for robust access. Now it's a
                                  companion to rather than subset of KHR_create_context
      2   11 Oct  2011 groth      Merged ANGLE and NV extensions.
                                  Convert to using flag to indicate robust access.
      1   15 July 2011 groth      Initial version