blob: e37583333200f117b3bce52c3055ea265c13e8a3 [file] [log] [blame]
Name Strings
Jon Leech (oddhack 'at'
Piers Daniell, NVIDIA (pdaniell 'at'
Jan-Harald Fredriksen, ARM
Jeff Bolz, NVIDIA
Kenneth Russell, Google
Pat Brown, NVIDIA
Copyright (c) 2012-2014 The Khronos Group Inc. Copyright terms at
Specification Update Policy
Khronos-approved extension specifications are updated in response to
issues and bugs prioritized by the Khronos OpenGL and OpenGL ES Working Groups. For
extensions which have been promoted to a core Specification, fixes will
first appear in the latest version of that core Specification, and will
eventually be backported to the extension document. This policy is
described in more detail at
Approved by the OpenGL ES Working Group on June 25, 2014.
Approved by the ARB on June 26, 2014.
Ratified by the Khronos Board of Promoters on August 7, 2014.
Version 7, June 26, 2014
ARB Extension #169
OpenGL ES Extension #189
OpenGL ES 2.0 or OpenGL 3.2 are required.
GL_KHR_robustness is required.
This extension is written against the OpenGL ES 3.1 Specification
(version of June 4, 2014) and the OpenGL ES 3.10.3 Shading Language
Specification (version of June 6, 2014)
This extension specifies the behavior of out-of-bounds buffer and
array accesses. This is an improvement over the existing
KHR_robustness extension which states that the application should
not crash, but that behavior is otherwise undefined. This extension
specifies the access protection provided by the GL to ensure that
out-of-bounds accesses cannot read from or write to data not owned
by the application. All accesses are contained within the buffer
object and program area they reference. These additional robustness
guarantees apply to contexts created with the robust access flag
IP Status
No known IP claims.
New Procedures and Functions
New Tokens
Additions to the OpenGL ES 3.1 Specification
Append to section 6.4 "Effects of Accessing Outside Buffer Bounds" on p.
"Robust buffer access can be enabled by creating a context with robust
access enabled through the window system binding APIs. When enabled, any
command unable to generate a GL error as described above, such as buffer
object accesses from the active program, will not read or modify memory
outside of the data store of the buffer object and will not result in GL
interruption or termination.
Out-of-bounds reads may return any of the following values:
* Values from anywhere within the buffer object.
* Zero values, or (0,0,0,x) vectors for vector reads where x is a
valid value represented in the type of the vector components and may
be any of
+ 0, 1, or the maximum representable positive integer value, for
signed or unsigned integer components
+ 0.0 or 1.0, for floating-point components
Out-of-bounds writes may modify values within the buffer object or be
Accesses made through resources attached to binding points are only
protected within the buffer object from which the binding point is
declared. For example, for an out-of-bounds access to a member variable
of a uniform block, the access protection is provided within the uniform
buffer object, and not for the bound buffer range for this uniform
Add a new subsection 10.3.4rob "Robust Buffer Access" preceding section
10.3.5 "Packed Vertex Data Formats" on p. 243:
"Robust buffer access can be enabled by creating a context with robust
access enabled through the window system binding APIs. When enabled,
indices within the element array (see section 10.3.7) that reference
vertex data that lies outside the enabled attribute's vertex buffer
object result in reading zero. It is not possible to read vertex data
from outside the enabled vertex buffer objects or from another GL
context, and these accesses do not result in abnormal program
Replace the last paragraph of section "Texel Fetches", on p.
"In all the above cases, if the context was created with robust buffer
access enabled (see section 10.3.4rob), the result of the texture fetch
is zero, or a texture source color of (0,0,0,1) in the case of a texel
fetch from an incomplete texture. If robust buffer access is not
enabled, the result of the texture fetch is undefined in each case."
Replace the last paragraph of section "Undefined Behavior" on
p. 272:
"Robust buffer access can be enabled by creating a context with
robust access enabled through the window system binding APIs. When
enabled, out-of-bounds accesses will be bounded within the working
memory of the active program, cannot access memory owned by other
GL contexts, and will not result in abnormal program termination.
Out-of-bounds access to local and global variables cannot read
values from other program invocations. An out-of-bounds read may
return another value from the active program's working memory or
zero. An out-of-bounds write may overwrite a value from the active
program's working memory or be discarded.
Out-of-bounds accesses to resources backed by buffer objects cannot read
or modify data outside of the buffer object. For resources bound to
buffer ranges, access is restricted within the buffer object from which
the buffer range was created, and not within the buffer range itself.
Out-of-bounds reads and writes behave as described in section 6.4.
Out-of-bounds accesses to arrays of resources, such as an array of
textures, can only access the data of bound resources. Reads from
unbound resources return zero and writes are discarded. It is not
possible to access data owned by other GL contexts.
Applications that require defined behavior for out-of-bounds
accesses should range check all computed indices before
dereferencing the array, vector or matrix."
Additions to chapter 5 of the OpenGL ES Shading Language Specification
version 3.10.3
Add a new section 5.12 "Out-of-Bounds Access and Robust Buffer Access
Behavior" on p. 84:
"In the sections described above for array, vector, matrix and structure
accesses, any out-of-bounds access produces undefined behavior. However,
if robust buffer access is enabled via the GL API, such accesses will be
bound within the memory extent of the active program. It will not be
possible to access memory from other programs, and accesses will not
result in abnormal program termination. Out-of-bounds reads return
undefined values, which include values from other variables of the
active program or zero. Out-of-bounds writes may be discarded or
overwrite other variables of the active program, depending on the value
of the computed index and how this relates to the extent of the active
program's memory. Applications that require defined behavior for
out-of-bounds accesses should range check all computed indices before
dereferencing an array."
New State
New Implementation Dependent State
Interactions with OpenGL ES 2.0
If only OpenGL ES 2.0 is supported then modifications to texel fetch
behavior are ignored, since texel fetch functionality does not exist
in OpenGL ES 2.0.
Interactions with OpenGL
In OpenGL implementations of this extension, the language in section 6.4
on values returned from out-of-bound reads is still applied in its
entirety to the "Undefined Behavior" language in section,
including the (0,0,0,x) read behavior.
However, when read specifically against the operations in 6.4,
out-of-bounds reads are further restricted to return either values from
anywhere within the buffer object, or zero. The less tightly specified
(0,0,0,x) reads defined for OpenGL ES does *not* apply in this case.
1) Why are out-of-bounds reads of buffer object backed resources defined
to allow returning "a value from the current buffer object" in
addition to one of several possible defined values?
RESOLVED: This is necessary to allow the implementation to either
range check, apply a mask/modulus or apply a clamp to the index.
2) Why do out-of-bounds writes to buffer object backed resources have a
stronger guarantee than reads? The spec says that writes outside of
the bounded range are discarded but reads are only protected within
the buffer object.
RESOLVED: This stronger guarantee for writes can be made because
GPUs made since around 2008 (DX10) already implement this behavior.
3) How does this extension differ from
- It is written against OpenGL ES 3.1 instead of GL 4.2, and can
be implemented for OpenGL ES 2.0 contexts as well.
removed, since there is no query for context creation flags in
any version of OpenGL ES.
- For OpenGL ES implementations only, it widens the scope of possible
return values from OOB buffer reads to (0,0,0,x) where x is zero,
one, or MAXINT for integer types.
4) What value should be returned for out of bounds reads that are
not part of another resource?
DISCUSSION: As noted in bug 12104, some implementations cannot return
zero for all components in this case, but may return another defined
value, such as one, for the alpha component of vector reads. The
agreed resolution has been incorporated in the language for section
2.9.4 and referenced from elsewhere in the extension language.
5) How should this extension be enabled via EGL?
PROPOSED: If a context is successfully created supporting
KHR_robustness (see issue 10 of that spec), the EGL 1.5 spec and
EGL_EXT_create_context_robustness extensions will be modified to
*allow* (but not require) support of
GL_KHR_robust_buffer_access_behavior as well.
DISCUSSION: We can't require support of this extension, because
that's a behavior modification to the EGL context creation
functionality and cannot be supported on existing implementations
which may support robustness already but not the additional
guarantees of this spec.
6) What changed in promoting this extension from OES to KHR? What
remains to be done for consistency between GL and ES?
DISCUSSION: The only meaningful difference is identified in the
"Interactions with OpenGL" section, and is simply slightly tighter
constrains on out-of-range buffer reads through the operations in
section 6.4.
Revision History
Rev. Date Author Changes
---- ------------ --------- -------------------------------------------
7 2014/06/26 Jon Leech Change from OES to KHR. Update issue 3
and add issue 6 on ES / GL differences.
6 2014/06/24 Jon Leech Rebase against OpenGL ES 3.1. Fix typos.
Add issue 5 on enabling the extension
at context creation time.
5 2014/06/09 Jon Leech Update values-returned language to allow
returning any of 0, 1, or the maximum
representable positive value for integer
types (Bug 12104).
4 2014/06/02 Jon Leech Incorporate new language on values returned
from reads inside a buffer object (Bug
12104 comment #31).
3 2014/05/14 Jon Leech Revert language on disabled attribute
reads mistakenly included from bug 10695.
2 2014/05/07 Jon Leech Add issue 4 on values to be returned
from out of bounds reads (Bug 12104).
1 2014/04/23 Jon Leech Branch from ARB_rbab and convert to be
based on ES 3 specs instead of GL 4.2.