1Name 2 3 KHR_robust_buffer_access_behavior 4 5Name Strings 6 7 GL_KHR_robust_buffer_access_behavior 8 9Contact 10 11 Jon Leech (oddhack 'at' sonic.net) 12 Piers Daniell, NVIDIA (pdaniell 'at' nvidia.com) 13 14Contributors 15 16 Jan-Harald Fredriksen, ARM 17 Jeff Bolz, NVIDIA 18 Kenneth Russell, Google 19 Pat Brown, NVIDIA 20 21Notice 22 23 Copyright (c) 2012-2014 The Khronos Group Inc. Copyright terms at 24 http://www.khronos.org/registry/speccopyright.html 25 26Specification Update Policy 27 28 Khronos-approved extension specifications are updated in response to 29 issues and bugs prioritized by the Khronos OpenGL and OpenGL ES Working Groups. For 30 extensions which have been promoted to a core Specification, fixes will 31 first appear in the latest version of that core Specification, and will 32 eventually be backported to the extension document. This policy is 33 described in more detail at 34 https://www.khronos.org/registry/OpenGL/docs/update_policy.php 35 36Status 37 38 Complete. 39 Approved by the OpenGL ES Working Group on June 25, 2014. 40 Approved by the ARB on June 26, 2014. 41 Ratified by the Khronos Board of Promoters on August 7, 2014. 42 43Version 44 45 Version 7, June 26, 2014 46 47Number 48 49 ARB Extension #169 50 OpenGL ES Extension #189 51 52Dependencies 53 54 OpenGL ES 2.0 or OpenGL 3.2 are required. 55 56 GL_KHR_robustness is required. 57 58 This extension is written against the OpenGL ES 3.1 Specification 59 (version of June 4, 2014) and the OpenGL ES 3.10.3 Shading Language 60 Specification (version of June 6, 2014) 61 62Overview 63 64 This extension specifies the behavior of out-of-bounds buffer and 65 array accesses. This is an improvement over the existing 66 KHR_robustness extension which states that the application should 67 not crash, but that behavior is otherwise undefined. This extension 68 specifies the access protection provided by the GL to ensure that 69 out-of-bounds accesses cannot read from or write to data not owned 70 by the application. All accesses are contained within the buffer 71 object and program area they reference. These additional robustness 72 guarantees apply to contexts created with the robust access flag 73 set. 74 75IP Status 76 77 No known IP claims. 78 79New Procedures and Functions 80 81 None 82 83New Tokens 84 85 None 86 87Additions to the OpenGL ES 3.1 Specification 88 89 Append to section 6.4 "Effects of Accessing Outside Buffer Bounds" on p. 90 58: 91 92 "Robust buffer access can be enabled by creating a context with robust 93 access enabled through the window system binding APIs. When enabled, any 94 command unable to generate a GL error as described above, such as buffer 95 object accesses from the active program, will not read or modify memory 96 outside of the data store of the buffer object and will not result in GL 97 interruption or termination. 98 99 Out-of-bounds reads may return any of the following values: 100 101 * Values from anywhere within the buffer object. 102 * Zero values, or (0,0,0,x) vectors for vector reads where x is a 103 valid value represented in the type of the vector components and may 104 be any of 105 106 + 0, 1, or the maximum representable positive integer value, for 107 signed or unsigned integer components 108 + 0.0 or 1.0, for floating-point components 109 110 Out-of-bounds writes may modify values within the buffer object or be 111 discarded. 112 113 Accesses made through resources attached to binding points are only 114 protected within the buffer object from which the binding point is 115 declared. For example, for an out-of-bounds access to a member variable 116 of a uniform block, the access protection is provided within the uniform 117 buffer object, and not for the bound buffer range for this uniform 118 block." 119 120 121 Add a new subsection 10.3.4rob "Robust Buffer Access" preceding section 122 10.3.5 "Packed Vertex Data Formats" on p. 243: 123 124 "Robust buffer access can be enabled by creating a context with robust 125 access enabled through the window system binding APIs. When enabled, 126 indices within the element array (see section 10.3.7) that reference 127 vertex data that lies outside the enabled attribute's vertex buffer 128 object result in reading zero. It is not possible to read vertex data 129 from outside the enabled vertex buffer objects or from another GL 130 context, and these accesses do not result in abnormal program 131 termination." 132 133 134 Replace the last paragraph of section 11.1.3.2 "Texel Fetches", on p. 135 265: 136 137 "In all the above cases, if the context was created with robust buffer 138 access enabled (see section 10.3.4rob), the result of the texture fetch 139 is zero, or a texture source color of (0,0,0,1) in the case of a texel 140 fetch from an incomplete texture. If robust buffer access is not 141 enabled, the result of the texture fetch is undefined in each case." 142 143 144 Replace the last paragraph of section 11.1.3.12 "Undefined Behavior" on 145 p. 272: 146 147 "Robust buffer access can be enabled by creating a context with 148 robust access enabled through the window system binding APIs. When 149 enabled, out-of-bounds accesses will be bounded within the working 150 memory of the active program, cannot access memory owned by other 151 GL contexts, and will not result in abnormal program termination. 152 Out-of-bounds access to local and global variables cannot read 153 values from other program invocations. An out-of-bounds read may 154 return another value from the active program's working memory or 155 zero. An out-of-bounds write may overwrite a value from the active 156 program's working memory or be discarded. 157 158 Out-of-bounds accesses to resources backed by buffer objects cannot read 159 or modify data outside of the buffer object. For resources bound to 160 buffer ranges, access is restricted within the buffer object from which 161 the buffer range was created, and not within the buffer range itself. 162 Out-of-bounds reads and writes behave as described in section 6.4. 163 164 Out-of-bounds accesses to arrays of resources, such as an array of 165 textures, can only access the data of bound resources. Reads from 166 unbound resources return zero and writes are discarded. It is not 167 possible to access data owned by other GL contexts. 168 169 Applications that require defined behavior for out-of-bounds 170 accesses should range check all computed indices before 171 dereferencing the array, vector or matrix." 172 173 174Additions to chapter 5 of the OpenGL ES Shading Language Specification 175version 3.10.3 176 177 Add a new section 5.12 "Out-of-Bounds Access and Robust Buffer Access 178 Behavior" on p. 84: 179 180 "In the sections described above for array, vector, matrix and structure 181 accesses, any out-of-bounds access produces undefined behavior. However, 182 if robust buffer access is enabled via the GL API, such accesses will be 183 bound within the memory extent of the active program. It will not be 184 possible to access memory from other programs, and accesses will not 185 result in abnormal program termination. Out-of-bounds reads return 186 undefined values, which include values from other variables of the 187 active program or zero. Out-of-bounds writes may be discarded or 188 overwrite other variables of the active program, depending on the value 189 of the computed index and how this relates to the extent of the active 190 program's memory. Applications that require defined behavior for 191 out-of-bounds accesses should range check all computed indices before 192 dereferencing an array." 193 194Errors 195 196 None 197 198New State 199 200 None 201 202New Implementation Dependent State 203 204 None 205 206Interactions with OpenGL ES 2.0 207 208 If only OpenGL ES 2.0 is supported then modifications to texel fetch 209 behavior are ignored, since texel fetch functionality does not exist 210 in OpenGL ES 2.0. 211 212Interactions with OpenGL 213 214 In OpenGL implementations of this extension, the language in section 6.4 215 on values returned from out-of-bound reads is still applied in its 216 entirety to the "Undefined Behavior" language in section 11.1.3.12, 217 including the (0,0,0,x) read behavior. 218 219 However, when read specifically against the operations in 6.4, 220 out-of-bounds reads are further restricted to return either values from 221 anywhere within the buffer object, or zero. The less tightly specified 222 (0,0,0,x) reads defined for OpenGL ES does *not* apply in this case. 223 224Issues 225 226 1) Why are out-of-bounds reads of buffer object backed resources defined 227 to allow returning "a value from the current buffer object" in 228 addition to one of several possible defined values? 229 230 RESOLVED: This is necessary to allow the implementation to either 231 range check, apply a mask/modulus or apply a clamp to the index. 232 233 2) Why do out-of-bounds writes to buffer object backed resources have a 234 stronger guarantee than reads? The spec says that writes outside of 235 the bounded range are discarded but reads are only protected within 236 the buffer object. 237 238 RESOLVED: This stronger guarantee for writes can be made because 239 GPUs made since around 2008 (DX10) already implement this behavior. 240 241 3) How does this extension differ from 242 ARB_robust_buffer_access_behavior? 243 244 - It is written against OpenGL ES 3.1 instead of GL 4.2, and can 245 be implemented for OpenGL ES 2.0 contexts as well. 246 - References to GL_CONTEXT_FLAG_ROBUST_ACCESS_BIT_ARB are 247 removed, since there is no query for context creation flags in 248 any version of OpenGL ES. 249 - For OpenGL ES implementations only, it widens the scope of possible 250 return values from OOB buffer reads to (0,0,0,x) where x is zero, 251 one, or MAXINT for integer types. 252 253 4) What value should be returned for out of bounds reads that are 254 not part of another resource? 255 256 DISCUSSION: As noted in bug 12104, some implementations cannot return 257 zero for all components in this case, but may return another defined 258 value, such as one, for the alpha component of vector reads. The 259 agreed resolution has been incorporated in the language for section 260 2.9.4 and referenced from elsewhere in the extension language. 261 262 5) How should this extension be enabled via EGL? 263 264 PROPOSED: If a context is successfully created supporting 265 KHR_robustness (see issue 10 of that spec), the EGL 1.5 spec and 266 EGL_EXT_create_context_robustness extensions will be modified to 267 *allow* (but not require) support of 268 GL_KHR_robust_buffer_access_behavior as well. 269 270 DISCUSSION: We can't require support of this extension, because 271 that's a behavior modification to the EGL context creation 272 functionality and cannot be supported on existing implementations 273 which may support robustness already but not the additional 274 guarantees of this spec. 275 276 6) What changed in promoting this extension from OES to KHR? What 277 remains to be done for consistency between GL and ES? 278 279 DISCUSSION: The only meaningful difference is identified in the 280 "Interactions with OpenGL" section, and is simply slightly tighter 281 constrains on out-of-range buffer reads through the operations in 282 section 6.4. 283 284 285Revision History 286 287 Rev. Date Author Changes 288 ---- ------------ --------- ------------------------------------------- 289 7 2014/06/26 Jon Leech Change from OES to KHR. Update issue 3 290 and add issue 6 on ES / GL differences. 291 6 2014/06/24 Jon Leech Rebase against OpenGL ES 3.1. Fix typos. 292 Add issue 5 on enabling the extension 293 at context creation time. 294 5 2014/06/09 Jon Leech Update values-returned language to allow 295 returning any of 0, 1, or the maximum 296 representable positive value for integer 297 types (Bug 12104). 298 4 2014/06/02 Jon Leech Incorporate new language on values returned 299 from reads inside a buffer object (Bug 300 12104 comment #31). 301 3 2014/05/14 Jon Leech Revert language on disabled attribute 302 reads mistakenly included from bug 10695. 303 2 2014/05/07 Jon Leech Add issue 4 on values to be returned 304 from out of bounds reads (Bug 12104). 305 1 2014/04/23 Jon Leech Branch from ARB_rbab and convert to be 306 based on ES 3 specs instead of GL 4.2. 307