| Name |
| |
| KHR_robust_buffer_access_behavior |
| |
| Name Strings |
| |
| GL_KHR_robust_buffer_access_behavior |
| |
| Contact |
| |
| Jon Leech (oddhack 'at' sonic.net) |
| Piers Daniell, NVIDIA (pdaniell 'at' nvidia.com) |
| |
| Contributors |
| |
| Jan-Harald Fredriksen, ARM |
| Jeff Bolz, NVIDIA |
| Kenneth Russell, Google |
| Pat Brown, NVIDIA |
| |
| Notice |
| |
| Copyright (c) 2012-2014 The Khronos Group Inc. Copyright terms at |
| http://www.khronos.org/registry/speccopyright.html |
| |
| Specification Update Policy |
| |
| Khronos-approved extension specifications are updated in response to |
| issues and bugs prioritized by the Khronos OpenGL and OpenGL ES Working Groups. For |
| extensions which have been promoted to a core Specification, fixes will |
| first appear in the latest version of that core Specification, and will |
| eventually be backported to the extension document. This policy is |
| described in more detail at |
| https://www.khronos.org/registry/OpenGL/docs/update_policy.php |
| |
| Status |
| |
| Complete. |
| Approved by the OpenGL ES Working Group on June 25, 2014. |
| Approved by the ARB on June 26, 2014. |
| Ratified by the Khronos Board of Promoters on August 7, 2014. |
| |
| Version |
| |
| Version 7, June 26, 2014 |
| |
| Number |
| |
| ARB Extension #169 |
| OpenGL ES Extension #189 |
| |
| Dependencies |
| |
| OpenGL ES 2.0 or OpenGL 3.2 are required. |
| |
| GL_KHR_robustness is required. |
| |
| This extension is written against the OpenGL ES 3.1 Specification |
| (version of June 4, 2014) and the OpenGL ES 3.10.3 Shading Language |
| Specification (version of June 6, 2014) |
| |
| Overview |
| |
| This extension specifies the behavior of out-of-bounds buffer and |
| array accesses. This is an improvement over the existing |
| KHR_robustness extension which states that the application should |
| not crash, but that behavior is otherwise undefined. This extension |
| specifies the access protection provided by the GL to ensure that |
| out-of-bounds accesses cannot read from or write to data not owned |
| by the application. All accesses are contained within the buffer |
| object and program area they reference. These additional robustness |
| guarantees apply to contexts created with the robust access flag |
| set. |
| |
| IP Status |
| |
| No known IP claims. |
| |
| New Procedures and Functions |
| |
| None |
| |
| New Tokens |
| |
| None |
| |
| Additions to the OpenGL ES 3.1 Specification |
| |
| Append to section 6.4 "Effects of Accessing Outside Buffer Bounds" on p. |
| 58: |
| |
| "Robust buffer access can be enabled by creating a context with robust |
| access enabled through the window system binding APIs. When enabled, any |
| command unable to generate a GL error as described above, such as buffer |
| object accesses from the active program, will not read or modify memory |
| outside of the data store of the buffer object and will not result in GL |
| interruption or termination. |
| |
| Out-of-bounds reads may return any of the following values: |
| |
| * Values from anywhere within the buffer object. |
| * Zero values, or (0,0,0,x) vectors for vector reads where x is a |
| valid value represented in the type of the vector components and may |
| be any of |
| |
| + 0, 1, or the maximum representable positive integer value, for |
| signed or unsigned integer components |
| + 0.0 or 1.0, for floating-point components |
| |
| Out-of-bounds writes may modify values within the buffer object or be |
| discarded. |
| |
| Accesses made through resources attached to binding points are only |
| protected within the buffer object from which the binding point is |
| declared. For example, for an out-of-bounds access to a member variable |
| of a uniform block, the access protection is provided within the uniform |
| buffer object, and not for the bound buffer range for this uniform |
| block." |
| |
| |
| Add a new subsection 10.3.4rob "Robust Buffer Access" preceding section |
| 10.3.5 "Packed Vertex Data Formats" on p. 243: |
| |
| "Robust buffer access can be enabled by creating a context with robust |
| access enabled through the window system binding APIs. When enabled, |
| indices within the element array (see section 10.3.7) that reference |
| vertex data that lies outside the enabled attribute's vertex buffer |
| object result in reading zero. It is not possible to read vertex data |
| from outside the enabled vertex buffer objects or from another GL |
| context, and these accesses do not result in abnormal program |
| termination." |
| |
| |
| Replace the last paragraph of section 11.1.3.2 "Texel Fetches", on p. |
| 265: |
| |
| "In all the above cases, if the context was created with robust buffer |
| access enabled (see section 10.3.4rob), the result of the texture fetch |
| is zero, or a texture source color of (0,0,0,1) in the case of a texel |
| fetch from an incomplete texture. If robust buffer access is not |
| enabled, the result of the texture fetch is undefined in each case." |
| |
| |
| Replace the last paragraph of section 11.1.3.12 "Undefined Behavior" on |
| p. 272: |
| |
| "Robust buffer access can be enabled by creating a context with |
| robust access enabled through the window system binding APIs. When |
| enabled, out-of-bounds accesses will be bounded within the working |
| memory of the active program, cannot access memory owned by other |
| GL contexts, and will not result in abnormal program termination. |
| Out-of-bounds access to local and global variables cannot read |
| values from other program invocations. An out-of-bounds read may |
| return another value from the active program's working memory or |
| zero. An out-of-bounds write may overwrite a value from the active |
| program's working memory or be discarded. |
| |
| Out-of-bounds accesses to resources backed by buffer objects cannot read |
| or modify data outside of the buffer object. For resources bound to |
| buffer ranges, access is restricted within the buffer object from which |
| the buffer range was created, and not within the buffer range itself. |
| Out-of-bounds reads and writes behave as described in section 6.4. |
| |
| Out-of-bounds accesses to arrays of resources, such as an array of |
| textures, can only access the data of bound resources. Reads from |
| unbound resources return zero and writes are discarded. It is not |
| possible to access data owned by other GL contexts. |
| |
| Applications that require defined behavior for out-of-bounds |
| accesses should range check all computed indices before |
| dereferencing the array, vector or matrix." |
| |
| |
| Additions to chapter 5 of the OpenGL ES Shading Language Specification |
| version 3.10.3 |
| |
| Add a new section 5.12 "Out-of-Bounds Access and Robust Buffer Access |
| Behavior" on p. 84: |
| |
| "In the sections described above for array, vector, matrix and structure |
| accesses, any out-of-bounds access produces undefined behavior. However, |
| if robust buffer access is enabled via the GL API, such accesses will be |
| bound within the memory extent of the active program. It will not be |
| possible to access memory from other programs, and accesses will not |
| result in abnormal program termination. Out-of-bounds reads return |
| undefined values, which include values from other variables of the |
| active program or zero. Out-of-bounds writes may be discarded or |
| overwrite other variables of the active program, depending on the value |
| of the computed index and how this relates to the extent of the active |
| program's memory. Applications that require defined behavior for |
| out-of-bounds accesses should range check all computed indices before |
| dereferencing an array." |
| |
| Errors |
| |
| None |
| |
| New State |
| |
| None |
| |
| New Implementation Dependent State |
| |
| None |
| |
| Interactions with OpenGL ES 2.0 |
| |
| If only OpenGL ES 2.0 is supported then modifications to texel fetch |
| behavior are ignored, since texel fetch functionality does not exist |
| in OpenGL ES 2.0. |
| |
| Interactions with OpenGL |
| |
| In OpenGL implementations of this extension, the language in section 6.4 |
| on values returned from out-of-bound reads is still applied in its |
| entirety to the "Undefined Behavior" language in section 11.1.3.12, |
| including the (0,0,0,x) read behavior. |
| |
| However, when read specifically against the operations in 6.4, |
| out-of-bounds reads are further restricted to return either values from |
| anywhere within the buffer object, or zero. The less tightly specified |
| (0,0,0,x) reads defined for OpenGL ES does *not* apply in this case. |
| |
| Issues |
| |
| 1) Why are out-of-bounds reads of buffer object backed resources defined |
| to allow returning "a value from the current buffer object" in |
| addition to one of several possible defined values? |
| |
| RESOLVED: This is necessary to allow the implementation to either |
| range check, apply a mask/modulus or apply a clamp to the index. |
| |
| 2) Why do out-of-bounds writes to buffer object backed resources have a |
| stronger guarantee than reads? The spec says that writes outside of |
| the bounded range are discarded but reads are only protected within |
| the buffer object. |
| |
| RESOLVED: This stronger guarantee for writes can be made because |
| GPUs made since around 2008 (DX10) already implement this behavior. |
| |
| 3) How does this extension differ from |
| ARB_robust_buffer_access_behavior? |
| |
| - It is written against OpenGL ES 3.1 instead of GL 4.2, and can |
| be implemented for OpenGL ES 2.0 contexts as well. |
| - References to GL_CONTEXT_FLAG_ROBUST_ACCESS_BIT_ARB are |
| removed, since there is no query for context creation flags in |
| any version of OpenGL ES. |
| - For OpenGL ES implementations only, it widens the scope of possible |
| return values from OOB buffer reads to (0,0,0,x) where x is zero, |
| one, or MAXINT for integer types. |
| |
| 4) What value should be returned for out of bounds reads that are |
| not part of another resource? |
| |
| DISCUSSION: As noted in bug 12104, some implementations cannot return |
| zero for all components in this case, but may return another defined |
| value, such as one, for the alpha component of vector reads. The |
| agreed resolution has been incorporated in the language for section |
| 2.9.4 and referenced from elsewhere in the extension language. |
| |
| 5) How should this extension be enabled via EGL? |
| |
| PROPOSED: If a context is successfully created supporting |
| KHR_robustness (see issue 10 of that spec), the EGL 1.5 spec and |
| EGL_EXT_create_context_robustness extensions will be modified to |
| *allow* (but not require) support of |
| GL_KHR_robust_buffer_access_behavior as well. |
| |
| DISCUSSION: We can't require support of this extension, because |
| that's a behavior modification to the EGL context creation |
| functionality and cannot be supported on existing implementations |
| which may support robustness already but not the additional |
| guarantees of this spec. |
| |
| 6) What changed in promoting this extension from OES to KHR? What |
| remains to be done for consistency between GL and ES? |
| |
| DISCUSSION: The only meaningful difference is identified in the |
| "Interactions with OpenGL" section, and is simply slightly tighter |
| constrains on out-of-range buffer reads through the operations in |
| section 6.4. |
| |
| |
| Revision History |
| |
| Rev. Date Author Changes |
| ---- ------------ --------- ------------------------------------------- |
| 7 2014/06/26 Jon Leech Change from OES to KHR. Update issue 3 |
| and add issue 6 on ES / GL differences. |
| 6 2014/06/24 Jon Leech Rebase against OpenGL ES 3.1. Fix typos. |
| Add issue 5 on enabling the extension |
| at context creation time. |
| 5 2014/06/09 Jon Leech Update values-returned language to allow |
| returning any of 0, 1, or the maximum |
| representable positive value for integer |
| types (Bug 12104). |
| 4 2014/06/02 Jon Leech Incorporate new language on values returned |
| from reads inside a buffer object (Bug |
| 12104 comment #31). |
| 3 2014/05/14 Jon Leech Revert language on disabled attribute |
| reads mistakenly included from bug 10695. |
| 2 2014/05/07 Jon Leech Add issue 4 on values to be returned |
| from out of bounds reads (Bug 12104). |
| 1 2014/04/23 Jon Leech Branch from ARB_rbab and convert to be |
| based on ES 3 specs instead of GL 4.2. |
