1// Copyright 2022-2024 The Khronos Group Inc. 2// 3// SPDX-License-Identifier: CC-BY-4.0 4 5= VK_EXT_pipeline_protected_access 6:toc: left 7:refpage: https://www.khronos.org/registry/vulkan/specs/1.3-extensions/man/html/ 8:sectnums: 9 10This proposal regards pipeline access to protected memory, and provides the 11means for applications to distinguish between pipelines that do and do not 12access protected memory. 13 14== Problem Statement 15 16Currently, access to protected memory is enabled with the 17`VkPhysicalDeviceProtectedMemoryFeatures::protectedMemory` feature. 18As this feature is enabled on the device, every pipeline created by the driver 19may be used to access protected memory. 20For some vendors, this has negative ramifications on the performance of 21pipeline creation and/or execution. 22 23Some applications may require access to protected memory in a handful of 24pipelines while the rest of the pipelines do not. 25In some cases, it may not be known at device creation time whether protected memory access 26would be necessary, for example in an OpenGL layer over Vulkan. 27Enabling the `protectedMemory` feature in such applications could lead to 28reduced performance with every pipeline instead of only those that do in fact 29access protected memory. 30 31This proposal addresses this problem by allowing applications to specify 32protected memory access in pipeline granularity. 33 34== Solution Space 35 36The proposed solution is a new Vulkan extension that allows the application to 37specify whether and how each individual pipeline may access protected memory. 38 39=== Per Pipeline Protected Access Flag 40 41A `VkPipelineCreateFlagBits` flag can be specified to disallow 42the pipeline from being used in a protected command buffer and submission. 43 44An additional `VkPipelineCreateFlagBits` flag could restrict the usage 45of a pipeline to protected command buffers. 46 47Pros: 48 49- Simple to use 50 51Cons: 52 53- If protected access is required for only one kind of resource, for example a 54 protected buffer, the use of a single boolean disallows optimizations that 55 could be applicable to access to other kinds of resources. 56 57=== Per Usage Access Flags 58 59An alternative could be to provide the usages that may require protected memory 60access when creating a pipeline; a set of `VkBufferUsageFlags` and 61`VkImageUsageFlags` flags. 62 63Pros: 64 65- Specifying protected access to one usage does not disallow optimizations to 66 accesses to unprotected resources that are used differently. 67 68Cons: 69 70- If many resources with the same usage are accessed, but not all need to be 71 protected, access to all of them may be suboptimal. 72 73=== Per Resource Access Flags 74 75Ultimately, the application could specify exactly which resources may be 76protected; a flag for each render pass attachment, a flag for each binding in 77the descriptor set layout, a flag for each vertex binding, etc. 78 79Pros: 80 81- This can theoretically lead to the most efficient pipeline that only pays a 82 potential penalty for access to the exact resources that use protected memory. 83 84Cons: 85 86- This is considerably more complex, requiring flags added to numerous places. 87 88== Proposal 89 90In practice, pipelines that actually access protected memory are scarce and 91rarely, if ever, access a mixture of protected and unprotected resources of the 92same kind. 93Additionally, on some hardware, not all combinations of protected access for 94input and output resources are possible. 95As such, the first solution is adopted in this extension, serving the needs of 96all known users without introducing unnecessary complexity. 97 98=== Features 99 100[source,c] 101---- 102typedef struct VkPhysicalDevicePipelineProtectedAccessFeaturesEXT { 103 VkStructureType sType; 104 void* pNext; 105 VkBool32 pipelineProtectedAccess; 106} VkPhysicalDevicePipelineProtectedAccessFeaturesEXT; 107---- 108 109- `pipelineProtectedAccess` specifies that per-pipeline protected access can be 110 specified. 111 112When this feature is enabled, pipelines can be flagged as not accessing 113protected resources (as otherwise is assumed by the `protectedMemory` feature). 114Such pipelines are not allowed to be bound to protected command buffers. 115Conversely, they can be flagged such that they can only be bound to protected 116command buffers. 117 118=== Pipeline Creation 119 120To create a pipeline that will not access protected memory, and that cannot be 121used in a protected command buffer and submission, specify the 122`VK_PIPELINE_CREATE_NO_PROTECTED_ACCESS_BIT_EXT` create flag. 123 124To create a pipeline that may access protected memory, and that cannot be used 125in a non-protected command buffer and submission, specify the 126`VK_PIPELINE_CREATE_PROTECTED_ACCESS_ONLY_BIT_EXT` create flag. 127 128== Issues 129 130=== RESOLVED: How should the `pipelineProtectedAccess` feature interact with `protectedMemory`? 131 132The `pipelineProtectedAccess` feature allows pipelines to be restricted to or 133excluded from access to protected resources. 134Without the `protectedMemory` feature, there cannot be any protected resources 135to begin with. 136As such, enabling the `pipelineProtectedAccess` feature without the 137`protectedMemory` is ineffective, but is nevertheless not incorrect. 138 139=== RESOLVED: Should the `pipelineProtectedAccess` feature allow pipelines to opt into protected access or out of it? 140 141Both, with the default retaining current Vulkan behavior. 142This is necessary to make sure that the mere act of enabling the 143`pipelineProtectedAccess` feature does not break existing code. 144Opt-in is supported in addition to opt-out to help platforms where the specific 145knowledge that a pipeline is only used with protected command buffers leads to 146possible optimizations. 147 148=== RESOLVED: Should links between protected and unprotected pipeline libraries be allowed? 149 150No. 151The linked pipeline could not be considered protected in that case, as parts of 152it has been created without the necessary flag. 153And if the result is an unprotected pipeline, it is not useful (or efficient) 154to create parts of it as protected. 155