mirror of
https://github.com/mozilla/gecko-dev.git
synced 2024-11-05 08:35:26 +00:00
b9c5df43a5
No review because this is just syncing us with upstream: http://code.google.com/p/angleproject/ This is also doing some cleanup, removing stale/empty files and updating patches. The main benefit from this update is that long-identifier-shortening has been fixed.
366 lines
15 KiB
Plaintext
366 lines
15 KiB
Plaintext
Name
|
|
|
|
EXT_robustness
|
|
|
|
Name Strings
|
|
|
|
GL_EXT_robustness
|
|
|
|
Contributors
|
|
|
|
Daniel Koch, TransGaming
|
|
Nicolas Capens, TransGaming
|
|
Contributors to ARB_robustness
|
|
|
|
Contact
|
|
|
|
Greg Roth, NVIDIA (groth 'at' nvidia.com)
|
|
|
|
Status
|
|
|
|
Complete.
|
|
|
|
Version
|
|
|
|
Version 3, 2011/10/31
|
|
|
|
Number
|
|
|
|
OpenGL ES Extension #107
|
|
|
|
Dependencies
|
|
|
|
This extension is written against the OpenGL ES 2.0 Specification
|
|
but can apply to OpenGL ES 1.1 and up.
|
|
|
|
EGL_EXT_create_context_robustness is used to determine if a context
|
|
implementing this extension supports robust buffer access, and if it
|
|
supports reset notification.
|
|
|
|
Overview
|
|
|
|
Several recent trends in how OpenGL integrates into modern computer
|
|
systems have created new requirements for robustness and security
|
|
for OpenGL rendering contexts.
|
|
|
|
Additionally GPU architectures now support hardware fault detection;
|
|
for example, video memory supporting ECC (error correcting codes)
|
|
and error detection. OpenGL contexts should be capable of recovering
|
|
from hardware faults such as uncorrectable memory errors. Along with
|
|
recovery from such hardware faults, the recovery mechanism can
|
|
also allow recovery from video memory access exceptions and system
|
|
software failures. System software failures can be due to device
|
|
changes or driver failures.
|
|
|
|
OpenGL queries that that return (write) some number of bytes to a
|
|
buffer indicated by a pointer parameter introduce risk of buffer
|
|
overflows that might be exploitable by malware. To address this,
|
|
queries with return value sizes that are not expressed directly by
|
|
the parameters to the query itself are given additional API
|
|
functions with an additional parameter that specifies the number of
|
|
bytes in the buffer and never writing bytes beyond that limit. This
|
|
is particularly useful for multi-threaded usage of OpenGL contexts
|
|
in a "share group" where one context can change objects in ways that
|
|
can cause buffer overflows for another context's OpenGL queries.
|
|
|
|
The original ARB_vertex_buffer_object extension includes an issue
|
|
that explicitly states program termination is allowed when
|
|
out-of-bounds vertex buffer object fetches occur. Modern graphics
|
|
hardware is capable well-defined behavior in the case of out-of-
|
|
bounds vertex buffer object fetches. Older hardware may require
|
|
extra checks to enforce well-defined (and termination free)
|
|
behavior, but this expense is warranted when processing potentially
|
|
untrusted content.
|
|
|
|
The intent of this extension is to address some specific robustness
|
|
goals:
|
|
|
|
* For all existing OpenGL queries, provide additional "safe" APIs
|
|
that limit data written to user pointers to a buffer size in
|
|
bytes that is an explicit additional parameter of the query.
|
|
|
|
* Provide a mechanism for an OpenGL application to learn about
|
|
graphics resets that affect the context. When a graphics reset
|
|
occurs, the OpenGL context becomes unusable and the application
|
|
must create a new context to continue operation. Detecting a
|
|
graphics reset happens through an inexpensive query.
|
|
|
|
* Provide an enable to guarantee that out-of-bounds buffer object
|
|
accesses by the GPU will have deterministic behavior and preclude
|
|
application instability or termination due to an incorrect buffer
|
|
access. Such accesses include vertex buffer fetches of
|
|
attributes and indices, and indexed reads of uniforms or
|
|
parameters from buffers.
|
|
|
|
New Procedures and Functions
|
|
|
|
enum GetGraphicsResetStatusEXT();
|
|
|
|
void ReadnPixelsEXT(int x, int y, sizei width, sizei height,
|
|
enum format, enum type, sizei bufSize,
|
|
void *data);
|
|
|
|
void GetnUniformfvEXT(uint program, int location, sizei bufSize,
|
|
float *params);
|
|
void GetnUniformivEXT(uint program, int location, sizei bufSize,
|
|
int *params);
|
|
|
|
New Tokens
|
|
|
|
Returned by GetGraphicsResetStatusEXT:
|
|
|
|
NO_ERROR 0x0000
|
|
GUILTY_CONTEXT_RESET_EXT 0x8253
|
|
INNOCENT_CONTEXT_RESET_EXT 0x8254
|
|
UNKNOWN_CONTEXT_RESET_EXT 0x8255
|
|
|
|
Accepted by the <value> parameter of GetBooleanv, GetIntegerv,
|
|
and GetFloatv:
|
|
|
|
CONTEXT_ROBUST_ACCESS_EXT 0x90F3
|
|
RESET_NOTIFICATION_STRATEGY_EXT 0x8256
|
|
|
|
Returned by GetIntegerv and related simple queries when <value> is
|
|
RESET_NOTIFICATION_STRATEGY_EXT :
|
|
|
|
LOSE_CONTEXT_ON_RESET_EXT 0x8252
|
|
NO_RESET_NOTIFICATION_EXT 0x8261
|
|
|
|
Additions to Chapter 2 of the OpenGL ES 2.0 Specification (OpenGL ES Operation)
|
|
|
|
Add a new subsection after 2.5 "GL Errors" and renumber subsequent
|
|
sections accordingly.
|
|
|
|
2.6 "Graphics Reset Recovery"
|
|
|
|
Certain events can result in a reset of the GL context. Such a reset
|
|
causes all context state to be lost. Recovery from such events
|
|
requires recreation of all objects in the affected context. The
|
|
current status of the graphics reset state is returned by
|
|
|
|
enum GetGraphicsResetStatusEXT();
|
|
|
|
The symbolic constant returned indicates if the GL context has been
|
|
in a reset state at any point since the last call to
|
|
GetGraphicsResetStatusEXT. NO_ERROR indicates that the GL context
|
|
has not been in a reset state since the last call.
|
|
GUILTY_CONTEXT_RESET_EXT indicates that a reset has been detected
|
|
that is attributable to the current GL context.
|
|
INNOCENT_CONTEXT_RESET_EXT indicates a reset has been detected that
|
|
is not attributable to the current GL context.
|
|
UNKNOWN_CONTEXT_RESET_EXT indicates a detected graphics reset whose
|
|
cause is unknown.
|
|
|
|
If a reset status other than NO_ERROR is returned and subsequent
|
|
calls return NO_ERROR, the context reset was encountered and
|
|
completed. If a reset status is repeatedly returned, the context may
|
|
be in the process of resetting.
|
|
|
|
Reset notification behavior is determined at context creation time,
|
|
and may be queried by calling GetIntegerv with the symbolic constant
|
|
RESET_NOTIFICATION_STRATEGY_EXT.
|
|
|
|
If the reset notification behavior is NO_RESET_NOTIFICATION_EXT,
|
|
then the implementation will never deliver notification of reset
|
|
events, and GetGraphicsResetStatusEXT will always return
|
|
NO_ERROR[fn1].
|
|
[fn1: In this case it is recommended that implementations should
|
|
not allow loss of context state no matter what events occur.
|
|
However, this is only a recommendation, and cannot be relied
|
|
upon by applications.]
|
|
|
|
If the behavior is LOSE_CONTEXT_ON_RESET_EXT, a graphics reset will
|
|
result in the loss of all context state, requiring the recreation of
|
|
all associated objects. In this case GetGraphicsResetStatusEXT may
|
|
return any of the values described above.
|
|
|
|
If a graphics reset notification occurs in a context, a notification
|
|
must also occur in all other contexts which share objects with that
|
|
context[fn2].
|
|
[fn2: The values returned by GetGraphicsResetStatusEXT in the
|
|
different contexts may differ.]
|
|
|
|
Add to Section 2.8 "Vertex Arrays" before subsection "Transferring
|
|
Array Elements"
|
|
|
|
Robust buffer access is enabled by creating a context with robust
|
|
access enabled through the window system binding APIs. When enabled,
|
|
indices within the vertex array that lie outside the arrays defined
|
|
for enabled attributes result in undefined values for the
|
|
corresponding attributes, but cannot result in application failure.
|
|
Robust buffer access behavior may be queried by calling GetIntegerv
|
|
with the symbolic constant CONTEXT_ROBUST_ACCESS_EXT.
|
|
|
|
Additions to Chapter 4 of the OpenGL ES 2.0 Specification (Per-Fragment
|
|
Operations and the Frame Buffer)
|
|
|
|
Modify section 4.3.1 "Reading Pixels"
|
|
|
|
Pixels are read using
|
|
|
|
void ReadPixels(int x, int y, sizei width, sizei height,
|
|
enum format, enum type, void *data);
|
|
void ReadnPixelsEXT(int x, int y, sizei width, sizei height,
|
|
enum format, enum type, sizei bufSize,
|
|
void *data);
|
|
|
|
Add to the description of ReadPixels:
|
|
|
|
ReadnPixelsEXT behaves identically to ReadPixels except that it does
|
|
not write more than <bufSize> bytes into <data>. If the buffer size
|
|
required to fill all the requested data is greater than <bufSize> an
|
|
INVALID_OPERATION error is generated and <data> is not altered.
|
|
|
|
Additions to Chapter 5 of the OpenGL ES 2.0 Specification (Special
|
|
Functions):
|
|
|
|
None
|
|
|
|
Additions to Chapter 6 of the OpenGL ES 2.0 Specification (State and
|
|
State Requests)
|
|
|
|
Modify Section 6.1.8 "Shader and Program Queries"
|
|
|
|
The commands
|
|
|
|
void GetUniformfv(uint program, int location, float *params);
|
|
void GetnUniformfvEXT(uint program, int location, sizei bufSize,
|
|
float *params);
|
|
void GetUniformiv(uint program, int location, int *params);
|
|
void GetnUniformivEXT(uint program, int location, sizei bufSize,
|
|
int *params);
|
|
|
|
return the value or values of the uniform at location <location>
|
|
for program object <program> in the array <params>. Calling
|
|
GetnUniformfvEXT or GetnUniformivEXT ensures that no more than
|
|
<bufSize> bytes are written into <params>. If the buffer size
|
|
required to fill all the requested data is greater than <bufSize> an
|
|
INVALID_OPERATION error is generated and <params> is not altered.
|
|
...
|
|
|
|
Additions to The OpenGL ES Shading Language Specification, Version 1.
|
|
|
|
Append to the third paragraph of section 4.1.9 "Arrays"
|
|
|
|
If robust buffer access is enabled via the OpenGL ES API, such
|
|
indexing must not result in abnormal program termination. The
|
|
results are still undefined, but implementations are encouraged to
|
|
produce zero values for such accesses.
|
|
|
|
Interactions with EGL_EXT_create_context_robustness
|
|
|
|
If the EGL window-system binding API is used to create a context,
|
|
the EGL_EXT_create_context_robustness extension is supported, and
|
|
the attribute EGL_CONTEXT_OPENGL_ROBUST_ACCESS_EXT is set to
|
|
EGL_TRUE when eglCreateContext is called, the resulting context will
|
|
perform robust buffer access as described above in section 2.8, and
|
|
the CONTEXT_ROBUST_ACCESS_EXT query will return GL_TRUE as described
|
|
above in section 6.1.5.
|
|
|
|
If the EGL window-system binding API is used to create a context and
|
|
the EGL_EXT_create_context_robustness extension is supported, then
|
|
the value of attribute EGL_CONTEXT_RESET_NOTIFICATION_STRATEGY_EXT
|
|
determines the reset notification behavior and the value of
|
|
RESET_NOTIFICATION_STRATEGY_EXT, as described in section 2.6.
|
|
|
|
Errors
|
|
|
|
ReadnPixelsEXT, GetnUniformfvEXT, and GetnUniformivEXT share all the
|
|
errors of their unsized buffer query counterparts with the addition
|
|
that INVALID_OPERATION is generated if the buffer size required to
|
|
fill all the requested data is greater than <bufSize>.
|
|
|
|
New Implementation Dependent State
|
|
|
|
Get Value Type Get Command Minimum Value Description Sec. Attribute
|
|
--------- ---- ----------- ------------- --------------------------- ----- ---------
|
|
CONTEXT_ROBUST_ACCESS_EXT B GetIntegerv - Robust access enabled 6.1.5 -
|
|
RESET_NOTIFICATION_STRATEGY_EXT Z_2 GetIntegerv See sec. 2.6 Reset notification behavior 2.6 -
|
|
|
|
Issues
|
|
|
|
|
|
1. What should this extension be called?
|
|
|
|
RESOLVED: EXT_robustness
|
|
|
|
Since this is intended to be a version of ARB_robustness for
|
|
OpenGL ES, it should be named accordingly.
|
|
|
|
2. How does this extension differ from Desktop GL's ARB_robustness?
|
|
|
|
RESOLVED: Because EGL_EXT_create_context_robustness uses a
|
|
separate attribute to enable robust buffer access, a
|
|
corresponding query is added here.
|
|
|
|
3. Should we provide a context creation mechanism to enable this extension?
|
|
|
|
RESOLVED. Yes.
|
|
|
|
Currently, EGL_EXT_create_context_robustness provides this
|
|
mechanism via two unique attributes. These attributes differ
|
|
from those specified by KHR_create_context to allow for
|
|
differences in what functionality those attributes define.
|
|
|
|
4. What can cause a graphics reset?
|
|
|
|
Either user or implementor errors may result in a graphics reset.
|
|
If the application attempts to perform a rendering that takes too long
|
|
whether due to an infinite loop in a shader or even just a rendering
|
|
operation that takes too long on the given hardware. Implementation
|
|
errors may produce badly formed hardware commands. Memory access errors
|
|
may result from user or implementor mistakes. On some systems, power
|
|
management events such as system sleep, screen saver activation, or
|
|
pre-emption may also context resets to occur. Any of these events may
|
|
result in a graphics reset event that will be detectable by the
|
|
mechanism described in this extension.
|
|
|
|
5. How should the application react to a reset context event?
|
|
|
|
RESOLVED: For this extension, the application is expected to query
|
|
the reset status until NO_ERROR is returned. If a reset is encountered,
|
|
at least one *RESET* status will be returned. Once NO_ERROR is again
|
|
encountered, the application can safely destroy the old context and
|
|
create a new one.
|
|
|
|
After a reset event, apps should not use a context for any purpose
|
|
other than determining its reset status, and then destroying it. If a
|
|
context receives a reset event, all other contexts in its share group
|
|
will also receive reset events, and should be destroyed and
|
|
recreated.
|
|
|
|
Apps should be cautious in interpreting the GUILTY and INNOCENT reset
|
|
statuses. These are guidelines to the immediate cause of a reset, but
|
|
not guarantees of the ultimate cause.
|
|
|
|
6. If a graphics reset occurs in a shared context, what happens in
|
|
shared contexts?
|
|
|
|
RESOLVED: A reset in one context will result in a reset in all other
|
|
contexts in its share group.
|
|
|
|
7. How can an application query for robust buffer access support,
|
|
since this is now determined at context creation time?
|
|
|
|
RESOLVED. The application can query the value of ROBUST_ACCESS_EXT
|
|
using GetIntegerv. If true, this functionality is enabled.
|
|
|
|
8. How is the reset notification behavior controlled?
|
|
|
|
RESOLVED: Reset notification behavior is determined at context
|
|
creation time using EGL/GLX/WGL/etc. mechanisms. In order that shared
|
|
objects be handled predictably, a context cannot share with
|
|
another context unless both have the same reset notification
|
|
behavior.
|
|
|
|
|
|
Revision History
|
|
|
|
Rev. Date Author Changes
|
|
---- ------------ --------- ----------------------------------------
|
|
3 31 Oct 2011 groth Reverted to attribute for robust access. Now it's a
|
|
companion to rather than subset of KHR_create_context
|
|
2 11 Oct 2011 groth Merged ANGLE and NV extensions.
|
|
Convert to using flag to indicate robust access.
|
|
1 15 July 2011 groth Initial version
|