1Name 2 3 IMG_tile_region_protection 4 5Name Strings 6 7 GL_IMG_tile_region_protection 8 9Contact 10 11 Deepak Ravikumar, Imagination Technologies 12 (deepak 'dot' ravikumar 'at' imgtec 'dot' com) 13 14Contributors 15 16 Ian King, Imagination Technologies 17 (Ian 'dot' King 'at' imgtec 'dot' com) 18 19Status 20 21 Complete. 22 23Version 24 25 Last Modified Date: June 06, 2022 26 Revision: 1.0 27 28Number 29 30 OpenGL SC Extension #1 31 32Dependencies 33 34 This extension is written against the OpenGL SC 2.0.1 35 specification, EGL Version 1.4 specification and the 36 GLSL ES Shading Language 1.00 specification with limitations as 37 specified in Appendix F of the OpenGL SC 2.0.1 specification. 38 39Overview 40 41 The safety-critical geometric primitives should have safety 42 mechanisms to guard them against faults that may result in pixel 43 corruption. On Imagination Technologies safety-critical Tile Based 44 rendering GPUs, Tile Region Protection (TRP) safety mechanism 45 performs safety integrity checks on all tiles that contain 46 safety-critical geometries and detect faults in the rendering of 47 these elements. This extension allows application to tag all its 48 safety-critical geometric primitives as safety-related so as to run 49 TRP safety checks on them and report faults in their rendering. 50 Any faults reported by this extension can then be acted upon by the 51 application. Depending on the hardware. TRP can detect either 52 transient or both transient and permanent faults that occur during 53 the rendering of these safety-critical elements. 54 55 This extension provides application a way to specify all its 56 safety-critical geometric primitives in order to enable the TRP 57 safety integrity checks on them, and thereby detect and report 58 faults in their rendering. 59 60 This extension also adds a read-only built-in boolean 61 gl_TRPIsProtected, to be used in the fragment shader to check if 62 the tile is protected by TRP or not. This built-in allows 63 developers to verify that all of the safety-critical geometric 64 primitives are indeed protected by TRP. Shaders using the new 65 functionality provided by this extension should enable this via 66 the construct, 67 68 #extension GL_IMG_tile_region_protection : require (or enable) 69 70IP Status 71 72 Imagination Technologies Proprietary 73 74New Procedures and Functions 75 76 None 77 78New Types 79 80 None 81 82New Tokens 83 84 Accepted by the <cap> parameter of Enable and Disable, 85 <value> parameter of IsEnabled and by the <pname> parameter 86 of GetBooleanv 87 88 GL_TRP_IMG 0x8EA0 89 90 Returned by GetGraphicsResetStatus 91 92 GL_TRP_ERROR_CONTEXT_RESET_IMG 0x8EA1 93 94 Returned by GetError 95 96 GL_TRP_UNSUPPORTED_CONTEXT_IMG 0x8EA2 97 98 99Additions to Chapter 2 of the OpenGL SC 2.0.1 Specification 100(OpenGL SC Operation) 101 102 Section 2.6 Graphics Reset Recovery Add below to the values 103 that can be returned by GetGraphicsResetStatus 104 105 TRP_ERROR_CONTEXT_RESET_IMG indicates that a reset has been detected 106 due to a fault detected by TRP in a safety-critical render in the 107 current GL context. 108 109 110 Table 2.3 Summary of GL errors add the below entry 111 112 Error Description Offending 113 command 114 ignored? Advisory Action 115 ------------------- ----------- ----- ------------------- 116 TRP_UNSUPPORTED_CONTEXT_IMG TRP enable Yes Continue for 117 failed due to non safety-critical 118 context not renders. 119 supporting Abort for 120 robust buffer safety-critical 121 and/or has renders. 122 reset notifi- 123 cation other 124 than 125 LOSE_CONTEXT_ON_RESET 126 127Additions to Chapter 4 of the OpenGL SC 2.0.1 Specification 128(Per-Fragment Operations and the Frame Buffer) 129 130 Add Section 4.1.9 Tile Region Protection(TRP) after 131 4.1.8 "Additional Multisample Fragment Operations" 132 133 Tile Region Protection performs safety checks during the 134 rendering of safety-critical geometric primitives, to protect them 135 from faults that may otherwise cause pixel data corruption and 136 result in the safety-critical elements being rendered incorrectly. 137 Depending on the hardware,TRP can detect either transient or both 138 transient and permanent faults that occur during the rendering of 139 these safety-critical elements. 140 141 TRP is enabled with the generic Enable command using the 142 symbolic constant TRP_IMG before passing the safety-critical 143 sequence of geometric primitives to the GL. Once TRP is enabled, 144 all further sequence of geometric primitives passed to the GL are 145 treated as safety-critical. It can be disabled with the Disable 146 command using the same symbolic constant for the non safety-critical 147 geometric primitives. 148 149 TRP runs safety integrity checks during the rendering of the 150 specified safety-critical geometries. Any fault detected by TRP in 151 the rendering of these elements will result in a reset of the GL 152 context and any subsequent GL commands on that context will 153 generate a CONTEXT_LOST error. In this case, GetGraphicsResetStatus 154 will return the value TRP_ERROR_CONTEXT_RESET_IMG. 155 156 TRP requires a graphic context with reset notification strategy 157 set to LOSE_CONTEXT_ON_RESET and robust buffer access enabled 158 with CONTEXT_ROBUST_ACCESS_EXT set to True. 159 GL_TRP_UNSUPPORTED_CONTEXT_IMG error is generated if TRP is 160 enabled for a graphics context that does not have robust buffer 161 access enabled (OPENGL_ROBUST_ACCESS_EXT set to False) or 162 that has reset notification strategy set to a value other than 163 LOSE_CONTEXT_ON_RESET 164 165 166Additions to Chapter 6 of the OpenGL SC 2.0.1 Specification 167(State and State Requests) 168 169 Table 6.11. Pixel Operations (cont.) add the below entry 170 171 Initial 172 Get Value Type Get Command Value Description Section 173 ------------------- ---- ----------- ------ ------------------- ------- 174 TRP_IMG B IsEnabled False Tile Region Protection 4.1.9 175 enabled 176 177 178Additions to Chapter 7 of the OpenGL Shading Language 1.00 Specification 179(Built-in Variables) 180 181 Added new built-in boolean to 7.2 Fragment Shader Special Variables 182 with the below description. 183 184 The fragment shader has access to the read-only built-in variable 185 gl_TRPIsProtected whose value is true for all fragments with window 186 relative coordinates falling inside a protected tile. At least one 187 square of an integer grid in window coordinates which are part of a 188 protected tile occupied by a geometric primitive is protected by 189 TRP safety checks. 190 191 The built-in variables that are accessible from a fragment shader 192 are intrinsically given types as follows: 193 194 mediump vec4 gl_FragCoord; 195 bool gl_FrontFacing; 196 mediump vec4 gl_FragColor; 197 mediump vec4 gl_FragData[gl_MaxDrawBuffers]; 198 mediump vec2 gl_PointCoord; 199 bool gl_TRPIsProtected; 200 201Dependencies on GL and ES profiles, versions, and other extensions 202 203 None 204 205Errors 206 207 TRP_UNSUPPORTED_CONTEXT_IMG error is generated if TRP is enabled for 208 a graphic context for which the reset notification strategy 209 RESET_NOTIFICATION_STRATEGY_EXT is not LOSE_CONTEXT_ON_RESET and 210 robust buffer access CONTEXT_ROBUST_ACCESS is false. 211 212New State 213 214 Table 6.11. Pixel Operations (cont.) add the below entry 215 216 Initial 217 Get Value Type Get Command Value Description Section 218 ------------------- ---- ----------- ------ ------------------- ------- 219 TRP_IMG B IsEnabled False Tile Region Protection 4.1.9 220 enabled 221 222New Implementation Dependent State 223 224 None 225 226Sample Code 227 228 The below code snippet illustrates the usage of this extension to 229 protect safety-critical sequence of geometric primitives. 230 231 /* Step 1 Enable TRP */ 232 glEnable(GL_TRP_IMG); 233 GLenum error = glGetError(); 234 if (error == (GLenum)GL_NO_ERROR) 235 { 236 /* Step 2 Submit commands for rendering the 237 * safety-critical sequence of geometric primitives. 238 */ 239 ... 240 } 241 242 /* Step 3 Disable TRP before submitting the 243 * non safety-critical sequence of geometric primitives to GL. 244 */ 245 glDisable(GL_TRP_IMG); 246 ... 247 /* End of non-safety critical geometry submission */ 248 249 /* Step 4 Upon completion of the submitted commands to GL, 250 * check status of the safety-critical renders 251 */ 252 error = glGetError(); 253 if (error == (GLenum)GL_CONTEXT_LOST) 254 { 255 GLenum graphicResetReason = glGetGraphicsResetStatus(); 256 if (graphicResetReason == (GLenum)GL_TRP_ERROR_CONTEXT_RESET_IMG) 257 { 258 /* Step 4.5 Handle fault detected by TRP in 259 * safety-critical render 260 */ 261 } 262 } 263 264 The fragment shader code snippet below illustrates how to identify 265 if the tile is protected by TRP safety checks or not. 266 267 #extension GL_IMG_tile_region_protection : enable 268 269 void main() 270 { 271 outColour.rgb = vec3(0.0,1.0,0.0); 272 /* Overlay safety protected tiles with green colour */ 273 outColour.a = gl_TRPIsProtected ? 0.5 : 0.0; 274 } 275 276Conformance Tests 277 278 GL2ExtensionTests/img_trp 279 280Issues 281 282 1) What should the default state of TRP_IMG be? 283 284 RESOLVED: If TRP_IMG default state was True, then every geometry 285 being rendered, irrespective of it being safety-critical or not, 286 will be treated as safety-related and safety integrity checks 287 would be run on them. This will have a negative effect on the 288 overall performance and would defeat the purpose of TRP, as TRP 289 is aimed at providing efficient and high performance 290 safety-critical rendering. Hence the default state of TRP_IMG is 291 false. 292 293 From an application perspective, TRP must be enabled before 294 submitting the safety-critical geometric primitives to the GL in 295 order to run the TRP safety integrity checks for them to detect 296 and report faults in their rendering. TRP should be disabled 297 before submitting non safety-critical sequence of geometric 298 primitives to the GL. 299 300 2) How should the application react to a TRP_ERROR_CONTEXT_RESET_IMG 301 event? 302 303 RESOLVED: Application should treat TRP_ERROR_CONTEXT_RESET_IMG 304 similar to a context reset event and should not use the graphics 305 context for any further purpose. Recovery requires creating a new 306 context and recreating all relevant states from the lost context. 307 308 3) How does this extension ensure freedom from interference 309 during the rendering of safety-critical sequence of geometric 310 primitives from faults that may arise from the rendering of 311 non-safety critical geometric primitives ? 312 313 RESOLVED: In order to ensure the integrity of rendering of 314 safety-critical sequence of geometric primitives, it is required 315 to ensure that there is freedom from interference during the 316 rendering of safety-critical geometric primitives from faults 317 that may have occurred during the rendering of 318 non safety-critical geometric primitives. Otherwise, such a fault 319 might cause non safety-critical geometric primitives to occlude 320 the safety-critical geometries and prevent it from being 321 displayed correctly. 322 323 This extension can efficiently detect such faults from 324 interfering with the expected rendering of safety-critical 325 sequence of geometric primitives, provided the application has 326 tagged at least one of the submitted geometric primitive as 327 safety-related. However, if the application explicitly calls 328 Flush, Finish or Readnpixels to submit commands containing only 329 non safety-critical sequence of geometric primitives to the GPU 330 and then proceeds to add more geometric primitives, including 331 sequence of safety-critical geometric primitives, then, the TRP 332 extension will not be able to ensure freedom from interference 333 during the rendering of the safety-critical sequence of geometric 334 primitives from faults that may have occurred from the rendering 335 of previously submitted non-safety critical geometric primitives. 336 In such use cases, the application should add additional safety 337 mechanisms to verify that the safety-critical geometry rendering 338 was not affected by faults from non safety-critical sequence of 339 geometric primitives. 340 341 It is highly recommended to avoid such use cases where the 342 application explicitly submits all previously called commands 343 (eg by calling Flush, Finish or Readnpixels), containing only 344 non safety-critical sequence of geometric primitives to the GPU 345 and then adds more geometric primitives including sequence of 346 safety-critical geometries for rendering. The same also applies 347 for the case where the application explicitly submits 348 safety-critical sequence of geometric primitives and then 349 adds further sequence of only non safety-critical 350 geometric primitives. This TRP extension is capable of 351 efficiently detecting rendering faults from non safety-critical 352 geometric primitives affecting safety-critical geometric 353 primitives rendering if it knows that there is at least one 354 safety-critical geometric primitive in the submitted sequence of 355 geometric primitives. 356 357Revision History 358 359 Revision 1.0, 06/06/2022 360 - Initial revision. 361