QNX Technical Articles

Date of this edition: November 18, 2014

---

Changes to these notes since October 31, 2006 are highlighted below with this icon:

---

Target OS: QNX^® Neutrino^® 6.3.0 SP3

Host OS: Microsoft Windows Vista, XP SP2, 2000 SP4, or NT SP6a; Sun Solaris 7, 8, 9, or 10; QNX^® Neutrino^® 6.3.0 or later; Linux Red Hat 8 or 9, Red Hat Enterprise WS 3 or 4, Red Hat Fedora Core 3 or 4, Debian 3.1, or SUSE 10

---

We're deprecating support for the following: Linux Red Hat 8 and 9 Solaris 7, 8, and 9 Windows NT QNX Momentics 6.3 is the last release that you can install on these hosts. QNX Neutrino 6.3 supports only the new flash filesystem (FFS3). The older flash filesystem (FFS2) has been discontinued.

---

Contents...

• Main features of QNX Momentics 6.3.0 Service Pack 3
  • QNX Momentics Development Suite
  • QNX Neutrino RTOS
  • Photon microGUI
  • A word about coexistence
• What's new in QNX Momentics 6.3.0 SP3?
  • Board Support Packages and Driver Development Kits
  • Compiler and tools
  • Core OS
  • Device drivers: Audio (deva-*) ¦ Block-oriented (devb-*) ¦ Character ¦ Flash (devf-*) ¦ Graphics (devg-*) ¦ Network (devn-*) ¦ USB (devu-)
  • Device enumeration
  • Filesystems
  • Flash filesystem
  • IDE (Professional Edition only)
  • Installation and licensing
  • I/O devices
  • Network protocols
  • Photon
  • Windows-specific
  • Documentation
• Experimental items
• Known issues
  • Booting
  • BSPs, DDKs, and TDKs
  • Compiler and tools
  • Core OS: Kernel ¦ Libraries and header files ¦ Core utilities
  • Device drivers: Audio (deva-*) ¦ Block-oriented (devb-*) ¦ Graphics (devg-*) ¦ Human interface devices (devh-*) ¦ Network (devn-*) ¦ USB (devu-*)
  • Filesystems
  • IDE (Professional Edition only)
  • I/O devices
  • Licensing
  • Multimedia
  • Network protocols
  • Photon
  • Utilities
  • Host-specific: QNX Neutrino self-hosted ¦ Windows hosts ¦ Solaris hosts
• Deprecation of legacy multimedia components
• Getting started with the documentation
• Technote: Fine-tuning your network drivers
• Technical support
• List of fixes
  • Software fixes
  • Documentation fixes

Throughout this document, you may see reference numbers associated with particular issues, changes, etc. When corresponding with our Technical Support staff about a given issue, please quote the relevant reference number. You might also find the reference numbers useful for tracking issues as they become fixed.

Some of the items in these release notes apply only to certain editions of QNX Momentics, and are marked accordingly using “PE” (Professional Edition) and “SE” (Standard Edition) abbreviations in parentheses beside the items. Items that aren't marked apply to all editions.

For the most up-to-date version of these notes, go to our website, www.qnx.com, log into your myQNX account, and then go to the Download Center.

---

Make sure that Plug and Play OS is disabled in the BIOS before you run QNX Neutrino self-hosted.

---

Main features of QNX Momentics 6.3.0 Service Pack 3

QNX Momentics 6.3.0 Service Pack 3 is a roll-up release that incorporates 6.3.0, Service Pack 1, Service Pack 2, Documentation Update 1.0.0, and the following patches:

Here are the main new features in QNX Momentics 6.3.0 SP3:

• QNX Momentics Development Suite
• QNX Neutrino RTOS
• Photon microGUI
• A word about coexistence

---

For up-to-date information on what's compatible between the latest two versions, see 6.3.0 and 6.2.1 Compatibility, available on our website.

---

QNX Momentics Development Suite

• GCC 3.3.5 support — enhanced C++ ABI (smaller footprints); improved code-generation/performance (especially for ARM/XScale); compatible with third-party offerings (e.g. Intel icc compiler for x86).
• Simplified installation — we're now using InstallShield for all hosts except QNX Neutrino (which installs via tarballs and shell scripts). The QNX Software Installer is now used only for third-party software.
• We've improved the way that you install and boot a self-hosted QNX Neutrino system. The improvements include:
  • support for USB keyboards and mice (Ref# 23671, 25445, 39555)
  • support for SATA disks (Ref# 38956)
  • the ability to update the drivers on your system (Ref# 39248)
  • the ability to install QNX Neutrino in partitions of type 77, 78, or 79 (Ref# 39387)
  • displaying drive identifiers when you're asked to choose a drive (Ref# 39187)
  • the ability to install QNX Neutrino from a second CD drive (Ref# 18982)

  For more information, see the installation note for Neutrino hosts.

• Version coexistence — you can install 6.3.0 and still build 6.2.1 target systems. (See the section below.)
• Enhanced IDE:
  • v2.1.2 of the Eclipse framework
  • v1.2 of the Eclipse C/C++ Development Tools (CDT) framework
  • Code Coverage plugin
  • Enhanced System Profiler plugin (new editor; event statistics views)
  • Better integrated System Builder plugin (BSP integration; Builder projects can be built outside the IDE; Builder-specific navigator; support for adding directories; independent EFS generation)
  • Numerous other enhancements (improved new-project wizard; more flexible project layouts; configurable keyboard shortcuts; improved build control; faster navigation; easier launch facility; and more).
• BSPs (binaries/bootable images) for several platforms.

  ---

  For 6.3 and beyond, BSPs are available only from our website.

  ---

• In QNX Momentics 6.3.0, separately packaged technology development kits (TDKs) augment the base Neutrino OS with specialized, value-added technologies.

  The base QNX Momentics suite includes the operating system and services required for most embedded systems (e.g. filesystems, GUI, IP networking technologies). The value-added TDKs, which are available from the Download Center on our website, help you control costs and achieve overall lower TCO for QNX Momentics-based systems.

  The TDKs currently include:

  • Adaptive Partitioning
  • Advanced Graphics
  • Critical Process Monitoring
  • Extended Networking
  • Flash Filesystem & Embedding
  • Multimedia
  • Multicore
  • Web Browser

  For more details, please contact your QNX sales representative.

---

With 6.3.0 SP3, some networking utilities and services have been moved from the base product to the Extended Networking TDK: Managers npm-tcpip-v6.so dhcpd dhcprelay routed route6d rtadvd rtsold snmpd snmptrapd bootpd mrouted named named-xfer Utilities ndp ping6 traceroute6 racoon setkey snmpbulkwalk snmpget snmpgetnext snmpnetstat snmpset snmpstatus snmptest snmptranslate snmptrap snmpwalk Libraries libsnmp

---

QNX Neutrino RTOS

• USB 2.0 stack (with mass storage class driver)
• Updated TCP/IP stack to NetBSD 1.6 source base
• SCTP protocol support (in the Extended Networking TDK)
• Asynchronous messaging (experimental implementation — may change)
• Qnet — new lightweight architecture featuring improved throughput, better reliability, and support for multiple simultaneous interfaces over various media.
• Global name service for Qnet
• IPFilter — for NAT and IP filtering (firewall) support (in the Extended Networking TDK)
• Multilink PPP
• NTP (Network Time Protocol) client/server
• Process resource limits
• Performance Counter API
• Standardized (unpublished) performance benchmarks and interpretation documents
• Added support for PowerPC Book E Architectures (IBM440 and Freescale PowerQUICC-III)
• Added support for physical addresses above 4 GB on PowerPC, MIPS, and x86.
• New flash filesystem offers improved resistance to power-loss corruption (in Flash Filesystems & Embedding TDK).
• The OS now supports 256 priority levels.
• The io-net, io-char, and io-graphics I/O subsystems have been enhanced to support future power-management features. Applications developed with QNX Momentics 6.3.0 will continue to work. The new functionality will be made fully available in a future release of Power Management.
• mkimage can now parse flash filesystem version 3 images. (Ref# 20386)

---

The OS images that we ship start procnto with the -v option, so that the kernel provides you with more information when a signal terminates a process.

---

Photon microGUI

• Extensible widget model (greater reuse of implementation code; widget layout managers; architectural footprint enhancements)
• GB18030-2000 Chinese character encoding
• 3D graphics (accelerated, OpenGL-based).
• New multimedia playback features (player/browser plugin using new multimedia framework; new readers/playback formats (MIDI; CD audio).
• Various other enhancements (io-graphics handles commands via config file; multi-headed displays; most Pg* functions are context-specific; added security to Photon clipboard [note that clipboard files are no longer compatible between 6.3.0 and previous releases]; clipboard changes cause a new event to be emitted; ped now supports drag and drop from the file manager; added support for the SGI image file format; and more).
• The default permissions on /dev/photon are now 600, but you can use chmod to change the permissions if you want to let other people look at your Photon session and inject keys into your pterms.

---

The Photon Application Builder (PhAB) is available only for Windows and QNX Neutrino hosts. If you're using a Linux or Solaris host, but you still want to use PhAB, consider installing a QNX Neutrino host to a second partition or an x86 simulator (e.g. VMware).

---

A word about coexistence

The QNX Momentics 6.3.0 development suite lets you install and work with multiple versions of Neutrino (from 6.2.1 and later). Whether you're using the command line or the IDE, you can choose which version of the OS to build programs for.

When you install QNX Momentics, you get a set of configuration files that indicate where you've installed the software. The QNX_CONFIGURATION environment variable stores the location of the configuration files for the installed versions of Neutrino; on a self-hosted Neutrino machine, the default is /etc/qnx.

QWinCfg for Windows hosts

On Windows hosts, you'll find a configuration program (QWinCfg) for switching between versions of QNX Momentics.

You launch QWinCfg via the start menu (e.g. All Programs-->QNX Momentics 6.3.0-->Configuration).

For details on using QWinCfg, see its entry in the Utilities Reference.

qconfig utility for non-Windows hosts

If you're using the command-line tools, use the qconfig utility to configure your machine to use a specific version of Neutrino:

• If you run it without any options, qconfig lists the versions that are installed on your machine.
• If you specify the -e option, you can set up the environment for building software for a specific version of the OS. For example, if you're using the Korn shell (ksh), you can configure your machine like this:

  eval `qconfig -n "QNX 6.3.0 Install" -e`

---

In the above command, you must use the “back tick” character (`), not the single quote character (').

---

When you start the IDE, it uses your current qconfig choice as the default version of the OS; if you haven't chosen a version, the IDE chooses an entry from the directory identified by QNX_CONFIGURATION. If you want to override the IDE's choice, you can choose the appropriate build target. (For more information, see the section “Version coexistence” in the Concepts chapter of the IDE User's Guide.)

---

Coexistence of 6.3.0 and 6.2.1 is supported only on Windows and Solaris hosts.

---

Environment variables

Neutrino uses these environment variables to locate files on the host machine:

QNX_HOST

The location of host-specific files.

QNX_TARGET

The location of target-specific files on the host machine.

QNX_CONFIGURATION

The location of the qconfig configuration files.

MAKEFLAGS

The location of included *.mk files.

The qconfig utility sets these variables according to the version of QNX Momentics that you specified.

What's new in QNX Momentics 6.3.0 SP3?

QNX Momentics 6.3.0 SP3 includes changes in these areas:

• Board Support Packages and Driver Development Kits
• Compiler and tools
• Core OS
• Device drivers
• Device enumeration
• Filesystems
• Flash filesystem
• IDE (Professional Edition only)
• Installation and licensing
• I/O devices
• Network protocols
• Photon
• Windows-specific
• Documentation

---

You'll find a list of fixes at the end of this document.

---

What's new: Board Support Packages and Driver Development Kits

• BSPs and DDKs are now packaged separately as standalone archives. The documentation has been changed to reflect this.
• BSPs are available only from our website. (Ref# 18522)
• The IDE now includes a BSP Perspective. To build a BSP, select File-->Import...-->QNX Board Support Package and follow the wizard's instructions.

  ---

  You can use this import facility only for 6.3 (and later) BSPs.

  ---

• The PowerPC startup- programs now have a -E option. For details, see the note re: PPC startups under Core OS below.
• QNX Neutrino now supports SH7770 and SH7780 CPUs from Renesas. We now provide Board Support Packages (BSPs) for the Renesas Lanbic and EDOSK 7780. There's also support for running the SH4A in 32-bit physical mode to let you use the 512 MB PCI window.

  ---

  You need to relink any SH4 binaries that you linked with QNX Neutrino 6.2.1 or earlier if you want to run them on SH4A targets. For more information, see “Known issues: BSPs, DDKs, and TDKs,” below.

  ---

• We now ship these new utilities:
  • packagebsp
  • setupbsp

  These utilities support a new, simplified way of packaging and installing Board Support Packages. We plan to provide a technote that describes how to use these utilities. (Ref# 28858)

---

For more information on BSPs and DDKs, see their installation notes and release notes.

---

What's new: Compiler and tools

• We changed the configure search paths for editors to look for vi first, then vim and others.
• Fixed the MIPS issue where linked-against static objects were compiled with older versions of the binutils.
• Fixed a problem where the wrong installation directory showed up in pinfo files.
• Fixed some quoting issues under Windows. Now, output the mkasmoff -f option only if it's needed.
• The import library gets installed in a place that gets picked up during linking, even when the shared object is going to a directory meant for runtime only.
• Changed the usemsg -o option to spawn ntomulti-objcopy because the unprefixed version (objcopy) doesn't exist on all hosts.
• Introduced a proper Windows fix to prevent usemsg from calling ldrel.
• Added the ability to specify a path in default files (e.g. gcc/2.95.3,gcc_ntox86)
• Ensured that solib-absolute-prefix isn't initialized if it has already been set.
• Due to the new location of the default C++ libraries, you must either:
  • ensure that boot images that contain C++ shared objects include the explicit “versioned” .so file (e.g. libcpp.so.4 rather than just libcpp.so)

    or:

  • specify the appropriate GCC version directory in the library search paths in your buildfiles.

bison

On self-hosted Neutrino systems, there's now a symbolic link from /usr/share/bison to /usr/qnx630/host/qnx6/x86/usr/share/bison (Ref# 18563)

ln-w

This utility now implements the functionality of symbolic links; there's a new -s option for creating them. (Ref# 21924)

gcc 2.95.3

• The libgcc.a for gcc 2.95.3 didn't correctly initialize the Floating Point Status/Control Register (fpscr) support code on SH4 for QNX Neutrino. (Ref# 21275)
  • Workaround: Create static archives instead of shared objects or DLLs, and link statically. Or, for user-defined shared libraries built with gcc 3.3.5, declare a constructor that initializes the fpscr support code correctly. For example:

    extern unsigned __fpscr_values[];
    static void on_lib_load(void) __attribute__((constructor));
    
    static void on_lib_load(void) {
      __fpscr_values[0] = 0x00040004;
      __fpscr_values[1] = 0x000c0004;
    }

  • Solution: Apply SP3 and relink all shared objects that use the fpscr.

  You can determine which shared objects use the fpscr by running this command:

  ntosh-objdump -D lib_my_dll.so | grep fpscr_values

  Since this bug also affects SHLE system shared libraries, you should rebuild any target systems that use any of the shared libraries in SP3, to make sure that the fixed shared libraries are used in the boot image and the target file system.

  The system shared libraries under $QNX_TARGET/shle that are affected are:

  • lib/gcc/3.3.5/libcpp.so
  • lib/gcc/3.3.5/libecpp-ne.so
  • lib/gcc/3.3.5/libcpp-ne.so
  • lib/gcc/2.95.3/libcpp.so
  • lib/gcc/2.95.3/libecpp.so
  • lib/gcc/2.95.3/libcpp-ne.so
  • lib/dll/devn-dm9102.so
  • lib/dll/devn-ne2000.so
  • lib/dll/devn-speedo.so
  • lib/dll/devg-coral.so
  • lib/dll/devg-rotate270.so
  • lib/dll/devg-smi5xx.so
  • lib/dll/devg-tvia.so
  • lib/dll/deva-util-restore.so
  • lib/dll/npm-ttcpip.so
  • lib/dll/npm-tcpip-v4.so
  • lib/dll/npm-pppmgr.so
  • lib/dll/npm-qnet-l4_lite.so
  • lib/dll/npm-qnet-compat.so
  • lib/dll/npm-tcpip.so
  • lib/dll/npm-qnet.so
  • lib/dll/fs-ext2.so
  • lib/libasound.so.2
  • lib/libusbdi.so.2
  • lib/libbessel.so.1
  • lib/libc.so.2
  • lib/libm.so.2
  • lib/libsocket.so.2
  • usr/lib/malloc_g/libmalloc.so.2
  • usr/lib/librpc.so.2
  • lib/dll/mmedia/oggi_decoder.so
  • lib/dll/mmedia/midi_parser.so
  • lib/dll/mmedia/audio_writer.so
  • lib/dll/gri-photon.so
  • lib/dll/gri-gl.so
  • lib/dll/gl/gl-mesa.so
  • lib/dll/gl/gl-ph.so
  • lib/dll/pi_io_png.so
  • lib/dll/vpi.so
  • lib/dll/phfont.so
  • lib/libFF-T2K.so.2
  • lib/libFF-T2K.so
  • usr/lib/libavcodec.so.1
  • usr/lib/libavcodec.so
  • usr/lib/libvorbis.so.1
  • usr/lib/libxing_audio.so.1
  • usr/lib/libvorbis.so
  • usr/lib/libxing_audio.so
  • usr/lib/libph.so.3
  • usr/lib/libAp.so.3
  • usr/lib/libgri.so.2
  • usr/lib/libphrender.so.2
  • usr/lib/libGLU.so.4
  • usr/lib/libGL.so.3
  • usr/lib/libmedia.so.2
  • usr/lib/libjpeg.so.3
  • usr/lib/libph.so
  • usr/lib/libAp.so
  • usr/lib/libgri.so
  • usr/lib/libphrender.so
  • usr/lib/libGLU.so
  • usr/lib/libGL.so
  • usr/lib/libmedia.so
  • usr/lib/libjpeg.so
  • usr/photon/dll/shelf/pload.so
  • usr/photon/dll/shelf/volume.so
  • lib/gcc/3.3.5/libstdc++.so
  • lib/libstdc++.so.5.0.5
  • lib/libstdc++.so.5

  The system shared libraries under $QNX_HOST/usr/lib/gcc-lib/ntosh/2.95.3/ml that are affected are:

  • libgcc.a
  • fpic/libgcc.a
  • fpic/fexceptions/libgcc.a
  • fexceptions/libgcc.a

  The system shared libraries under $QNX_HOST/usr/lib/gcc-lib/sh-unknown-nto-qnx6.3.0/3.3.5 that are affected are:

  • libgcc.a
  • pic/libgcc.a
• cpp0, the preprocessor for gcc 2.95.3, can now handle long filenames when searching the paths for include files. (Ref# 25322)

gcc

• 6.3.0 includes both gcc 2.95.3 and 3.3.5. Note that the newer version contains some alignment changes and adjustments. For details, see the 6.3.0 and 6.2.1 Compatibility note posted on our website.
• gcc-2.95.3 is the default compiler version. To get the default compiler, simply run:

  nto$CPU-gcc

  or:

  qcc -Vgcc_nto$CPU

  To get a specific version, run:

  nto$CPU-gcc-$version

  or:

  qcc -V$version,gcc_nto$CPU

  Examples:

  Command	Compiler version
  ntoarm-gcc	2.95.3
  ntoarm-gcc-2.95.3	2.95.3
  ntoarm-gcc-3.3.5	3.3.5
  qcc -Vgcc_ntomipsle	2.95.3
  qcc -V2.95.3,gcc_ntomipsle	2.95.3
  qcc -V3.3.5,gcc_ntomipsle	3.3.5

  ---

  To change the default compiler in the IDE, use the Compiler Tab in the project Properties dialog.

  ---

• GCC 3.3.5 has deprecated the pre-processor cpp0; this functionality is now merged in the compiler cc1.
• The binutils have lost their generic names (e.g. objcopy is now ntomulti-objcopy or ntox86-objcopy).

ld

Our linker used to behave such that any path specified with the -L option would also be added to the list of paths to be searched for shared objects.

This behavior is being deprecated; it will be removed in a future release. The correct method is to use the -rpath-link option.

ldrel

If you run ldrel on a binary that contains segment relocations, the relocations will be stripped. If you don't want them stripped, specify the -r option.

make

If you're using the QNX recursive makefile hierarchy, make needs to be able to find the makefile fragments (.mk files) with the rules for building QNX projects. These are stored in $QNX_TARGET/usr/include.

The environment variable MAKEFLAGS gives extra command-line flags to make; by setting it to -I$QNX_TARGET/usr/include, these .mk files will be found.

---

Microsoft's nmake also uses MAKEFLAGS, so if there's a mixed environment, you can use GNUMAKEFLAGS, which is an extension to standard make and exists only in the QNX-supplied version.

---

mkifs

• Now has a -n option that forces all modification times of inline files to be 0. This enables the checksum value to be repeated on subsequent builds.
• The mkifs program attempts to shrink the size of executables and shared objects that it puts in the image filesystem by removing data that isn't absolutely needed for execution of the program. You can disable this by using the +raw attribute.

  Starting with 6.3.0, mkifs keeps the following ELF sections by default, even without the +raw attribute:

  • QNX_Phab
  • QNX_info
  • QNX_usage

  You can use the new -s command-line option to name sections that you want mkifs to keep.

  ---

  If you specify -s, only the sections that you specify are kept. You need to explicitly specify the above names if you want to keep them as well.

  ---

qcc

We're no longer planning to deprecate the -M option. In 6.4, qcc will continue to use -M for generating a mapfile. (Ref# 26743)

qnx_cp

The -c option to qnx_cp now works correctly on Solaris hosts. (Ref# 38615)

zip and unzip

You need zip and unzip to install some of our products. SP3 installs these commands for Windows and Solaris hosts; they're already included on QNX Neutrino and Linux hosts. (Ref# 29419)

What's new: Core OS

Asynchronous messaging

Asynchronous messaging is a communication model that relies on a store-and-forward technique. Compared to regular reply-based communication in client-server systems, the messaging infrastructure ensures delivery, even if a participant is temporarily offline, busy, or unobtainable. In this technique, the sender doesn't need a response from the recipient. This provides more flexibility and scalability as the senders and receivers are decoupled and are no longer required to execute in lockstep.

---

Asynchronous messaging is an experimental feature in 6.3.0; its implementation may change. For more information, see the Asynchronous Messaging technote in the online documentation, as well as the asyncmsg_*() entries in the Neutrino Library Reference.

---

C++

Some class definitions are stricter in 6.3.0. For example, the set class requires unique keys; you can no longer modify keys that you've already added to the set, because you could create duplicates. This change could cause code that compiled on 6.2.1 not to compile on 6.3.0. (Ref# 21773)

dinit

In 6.3, dinit now creates long filenames by default. You can disable support for long filenames by specifying the -N option. (Ref# 17642)

---

This is the reverse of the behavior of 6.2.1; the -N option formerly enabled support for long filenames.

---

fcntl()

We fixed problems with side-channel connections and errno values reported. (Ref# 16959, 16960)

---

The OS now prevents _NTO_SIDE_CHANNEL connections from being duplicated (via dup(), dup2(), or fcntl(F_DUPFD)). This is to maintain consistency with the concept of side-channels forming a separate file-descriptor space that isn't subject to normal process-inheritance rules. If you are dup()ing side-channels, then they must now be attached as normal file descriptors. Note also that the low-level ConnectAttach() doesn't allow the specification of a specific side-channel index, which is required by dup2().

---

FD_SETSIZE

The value of FD_SETSIZE has changed from 32 to 256. This affects the size of the fd_set objects that you pass to select().

This means that by default the highest allowable fd number for FD_SET(fd, &set) is 255.

Any use of fd_set within data structures will therefore cause a change in structure size, so you should do a global recompile.

---

The global recompile should include all application code, as well as library code that would be referencing fd_set or structures containing fd_set. If you don't recompile, you may see random corruption and crashes.

---

To make the value higher, #define FD_SETSIZE before including <sys/select.h>. But make sure this is done consistently throughout your modules.

If you don't want to cause a global compile, you can #define FD_SETSIZE 32 before including <sys/select.h> (or -DFD_SETSIZE=32 on the command line) to set it back to the old size, but make sure this setting is consistently applied to all your code.

procnto*

• A problem with instrumentation could have caused a kernel stack overflow when instrumentation was turned on in SH4 platforms. We moved the instrumentation event after the shadow mask snapshot. The event itself was modifying the SR register before we could snapshot it properly, enabling interrupts before they should have been. (Ref# 21039)
• Single-stepping into a kernel call formerly could cause the kernel call to fail with an ENOSYS. On taking a debug exception on entering the kernel, the EAX register holding the syscall number was corrupted. When returning to the normal code path for kernel entry, the syscall number was invalid, resulting in a bad kernel call.

  This could have shown up when you used gdb to do a source-line step over a kernel call (or a library function that did a kernel call e.g. mmap()). (Ref# 19351)

• Addressed an x86 issue where under certain conditions, loading the data segment register from a user process with another valid segment descriptor could cause the kernel to crash. The scope of the issue is extremely limited, as the segment descriptor must have already been an existing legitimate segment (i.e. code segment). Assembly language inside the application itself must also have been explicitly coded, as the compiler doesn't generate code that exposes this issue. (Ref# 18836)
• Fixed an issue where a mmap() with a bad FD would result in a proc dump (due to an issues in the resmgr library), and also addressed the fact that EBADF wasn't being returned. (Ref# 19126)
• Fixed an issue where, under some circumstances, we could leak physical memory when encountering a low-memory situation on x86 platforms.

  On a large mmap() request, it was possible that during the mapping of that memory, there wouldn't be enough memory to allocate further L2 page tables. On L2 allocation failures, mem_virtual (x86 only) recovers by unmapping the physical address space mapped up to that point. The issue was that we allocated X bytes of physical RAM for the anonymous mapping, but managed to map only N bytes. When we freed N bytes from the page tables, we leaked the remaining X − N bytes.

  Now, we reset the page table to zero out the physical addresses, free all the physical memory, and then carry on as usual. (Ref# 11408)

• Attempting to call msync() on an illegal or unmapped address formerly caused a thread in procnto to lock up and never return. The process's address space was also held locked during this time, which could have caused other messages (such as mmap()) to block. (Ref# 21484)
• During the creation of a shared object, an error during the initialization (either allocation of backing store memory or reading of contents from the filesystem) used to result in a partially created object. The mmap() function returned a virtual address, but accessing that memory resulted in a SIGSEGV. (Ref# 21521)
• Using the debug procfs interface to read memory from io-net (with Qnet loaded) on a remote node formerly could lock up, due to a resource deadlock. (Ref# 19697)

Instrumented kernel

The instrumented kernel (procnto-instr) is now the default kernel for QNX Neutrino self-hosted systems.

LD_LIBRARY_PATH

For security reasons, the path(s) specified by LD_LIBRARY_PATH for setuid/setgid binaries will no longer be searched when loading shared objects.

Instead, only the path(s) defined by the _CS_LIBPATH configuration string will be used. You can examine or modify the value of _CS_LIBPATH using the getconf and setconf utilities.

---

In a buildfile, you can set the initial value of _CS_LIBPATH via the LD_LIBRARY_PATH= part of the “procnto” line. For example: PATH=/proc/boot:/bin:/usr/bin LD_LIBRARY_PATH=/proc/boot:/lib:/usr/lib:/lib/dll procnto

---

mkefs

On a Windows-hosted development machine, if a mkefs buildfile set the filter to deflate, temporary files of the form sXXX were left in C:\. One temporary file was left for each file compressed. The deflate.exe program now removes these temporary files. (Ref# 19278)

libpm and libpmm

• The pm_power_mode_t type has changed from 8-bit to 32-bit. This means that all code that includes <sys/pm.h> must be recompiled and relinked against the latest libpm.a and libpmm.a libraries.
• The prototype for the mode_init() policy function in libpmm changed from a void function to a return type of pm_power_mode_t. This function is now intended to return the initial power mode that the device should be set to. This will typically be PM_MODE_ACTIVE.

pidin

The pidin utility now has a format code (l) to show the last CPU a thread was run on.

poll()

The poll() function has been added. Initial support is limited to the first three event types: POLLRDNORM, POLLWRNORM, and POLLRDBAND.

POSIX Message Queues

The 6.3.0 release ships with an optional alternate implementation of POSIX message queues. This implementation uses the new asynchronous messaging facility of the kernel to buffer the messages within the kernel itself, and eliminates the (context-switching) overheads of using an external server (mqueue) in each message-queue operation, thus greatly improving the performance of POSIX message queues.

---

In earlier versions of QNX Neutrino, mqueue managed message queues and named semaphores; now, procnto handles named semaphores. If your embedded system uses named semaphores but not message queues, you don't need to include mqueue in your OS image. (Ref# 21823)

---

By default, the implementation of the mq_*() routines in libc is the old style, using the mqueue server to broker each transaction. To use the new-style implementation, the application(s) must be linked against the libmq library. In a manual build, specify the -l mq option; in automatic/recursive builds, use this setting in your common.mk file:

LIBS += mq

Since both variants adhere to the POSIX 1003.1 Message Passing API, no code-level changes are required in conforming applications.

The new server /sbin/mq must also be started. Although this server is not involved in each mq_send()/mq_receive()/mq_notify() operation, the server is necessary in order to maintain the queue names and create the corresponding kernel message queues. The server also presents all created queues in the /dev/mq/ directory, allowing the use of ls and rm for administration purposes (although the queue contents can't be manipulated via shell utilities). This directory could be changed to union over the directory exported by the old mqueue server by using the mq -N/dev/mqueue option, but this isn't recommended, because it may cause some user-namespace confusion.

The two POSIX message queue implementations may coexist but are disjoint. Queues created with mq_open() from libc aren't accessible to mq_open() from libmq and vice versa. When relinking applications to use the new implementation, be sure to change all affected components. We require such explicit intervention to use the alternate implementation because of potential incompatibilities if your code isn't strictly POSIX conforming.

Message queue descriptors (mqd_t) are no longer file descriptors in the alternate implementation. The POSIX 1003.1 standard makes no claim as to the underlying type of an mqd_t, and provides a specific set of functions to manipulate a message queue and its attributes based on an abstract mqd_t type.

For example, the following code modifies the nonblocking attribute of an open message queue:

mq_getattr(mq, &attr);
attr.mq_flags |= O_NONBLOCK;
mq_setattr(mq, &attr, NULL);

And this example attempts to obtain the count of messages in a queue:

mq_getattr(mq, &attr);
nmsg = attr.mq_curmsgs;

Other examples include the historic interchangeability of mq_send() with write() and of mq_receive() with read(). There's no direct counterpart to select() when used on a mixed set of queues and file descriptors or for the transition from a full queue, although mq_notify() may be used to register an event against a message queue on transition from empty.

---

The alternate implementation doesn't support the DCMD_MISC_MQSETCLOSEMSG QNX extension to inject a canned message when a queue descriptor is closed.

---

The default configuration of a message queue created by mq_open(O_CREAT) with a NULL mq_attr structure has been changed, because kernel buffers for the messages are now created up-front rather than on-demand. To create a queue with a specific configuration, simply provide a non-NULL mq_attr. To force the NULL default to match that of the old implementation, use the mq -m1024 -s4096 options (which isn't recommended, because this will consume 4 MB of system memory for each such queue!).

Since the kernel primitives supporting the asynchronous message-queue facilities are non-orthogonal with respect to native QNET networking, the alternate implementation allows for message queues to be manipulated only from the local machine. Of course, distributed access and the network-qualified naming of message queues is undefined by POSIX.

The following table summarizes the main differences between the alternate implementations:

Style	Server	Library	Pathname	mqd_t implementation	Qnet
Old (6.x)	mqueue	libc	/dev/mqueue/	int (file descriptor)	Yes
New (6.3.0)	mq	libmq	/dev/mq/	int (internal index)	No

PPC startups

• All PowerPC startup- programs now have a -E option. The procnto-600 kernel/process manager will no longer save and restore the EAR register (on chips that have it) during context switches, unless the -E switch is specified on the startup command line.
• The startups now provide better support for chip variations. The new design:
  • minimizes the number of locations that check the PVR SPR
  • minimizes duplication of code
  • makes it easier to leave out unneeded chip-dependent code
  • makes it easier to add support for new CPUs
  • removes the notion of a PVR split into “family” and “member” fields
  • automatically does as much CPU-dependent code as possible in the library
  • handles the Book E MMU.

  With the new design, the following routines are now deprecated (and they spit out a message to that effect if you call them):

  • ppc600_init_features()
  • ppc600_init_caches()
  • ppc600_flush_caches()

  They're handled automatically by the library now.

  Instead of ppc7450_init_l2_cache(), use ppc700_init_l2_cache().

  The startup library now enables instruction and data translation very early on for PPC 600-series chips. It also enables the data cache as well. Doing this speeds up the startup, removes code from the kernel (eventually), and lets us avoid duplicating the same routine over and over again in the startup/boards tree.

  However, basically all the board startups for PPC 600 chips have to be tweaked. Since the MMU is now enabled while startup is running, you can't just in8/out8 or dereference a physical address. Instead, you must use the startup_io_map/startup_memory_map|unmap functions to gain access to the storage.

  Also, callout routines should have a patcher that uses callout_[io/memory]_map[_indirect] calls to map the given physical addresses to a virtual address that the callout code can use. The kernel no longer looks for a “kernel_device” entry in the asinfo section and provides the mapping for you.

  For more information, see the section “PPC chips support” in the Customizing Image Startup Programs chapter of Building Embedded Systems.

  ---

  The MIPS startup library also uses the same style of code as with the PPC to deal with chip variations.

  ---

• In all previous PPC implementations, an interrupt would cause the processor to begin executing at a known location in low memory. The init_intrinfo() functions would indicate this by specifying a PPC_EXC_? constant for the cpu_intr_base field in the static array fed to add_interrupt_array() function. That's what you continue to do for boards with non-book E CPUs.

  With Book E processors, interrupts (and all other exceptions as well) no longer start at fixed locations in low memory. Instead, there's a set of IVORs (Interrupt Vector Offset Register). There's a different IVOR for each exception class. Book E describes 16 of them and reserves another 48 for future expansion and implementation use.

  Accordingly, when specifying the interrupt layout to startup you don't use the PPC_EXC_? constants on a Book E CPU. Instead, you identify the particular IVOR register that the processor will use when the interrupt goes off. For example, PPCBKE_SPR_IVOR4 is used for normal external interrupts, PPCBKE_SPR_IVOR10 for decrementor interrupts. See startup/boards/440rb/init_intrinfo.c for an example of what to do on Book E CPUs.

Priority levels

The OS now supports 256 priority levels.

Note that non-root processes can use only priority levels 1 to 63. Only root processes (i.e. those whose effective uid is 0) are allowed to set priorities above 63.

You can change the allowed priority range for non-root processes with the procnto -P option:

procnto -P priority

Here's a summary of the ranges:

Priority level	Owner
0	idle thread
1 through priority − 1	non-root or root
priority through 255	root

resmgr_handle_tune()

This is a new function that you can use to tune some of the parameters used internally by the resource manager layer when performing the client fd - ocb mapping. For more information, see the Neutrino Library Reference.

rtc

Neutrino now correctly reads the realtime clock on machines with the ATI IXP200 chipset. (Ref# 28363)

select()

The select() function used to make use of the functions _select_event() and _select_block(). The latter two functions weren't doc'd (other than being prototyped in /usr/include/sys/select.h.)

As of 6.3, these two functions are no longer used internally. However, they've been left in libc for the time being, but may be removed altogether in a future release. For reference, here is the old implementation of select():

/*
Copyright 2001, QNX Software Systems Ltd. All Rights Reserved
 
This source code has been published by QNX Software Systems 
Ltd. (QSSL). However, any use, reproduction, modification,
distribution or transfer of this software, or any software
which includes or is based upon any of this code, is only
permitted under the terms of the QNX Realtime Platform End
User License Agreement (see licensing.qnx.com for details)
or as otherwise expressly authorized by a written license
agreement from QSSL. For more information, please email
licensing@qnx.com.
*/
#include 
#include 
#include 
#include 
#include 
#include 
#include 
 
/*  The routine implements the Unix select call.  When 
 semantics differ the BSD
 semantics defined in APUE (pg. 396-400) are followed.
*/
 
int select(int nfds, fd_set *readfds, fd_set *writefds, 
fd_set *exceptfds, struct timeval *tvptr) 
{
     struct sigevent            event;
     struct timespec            ts;
 
     if(tvptr) 
     {
         if (tvptr->tv_sec < 0 ||   /* don't bother 
                         checking upper ends, roll over will catch really bad overflows */
             tvptr->tv_usec < 0)
             return errno= EINVAL, -1;
         
         ts.tv_sec= tvptr->tv_sec ;
         ts.tv_nsec= tvptr->tv_usec * 1000L ;
     }
 
     event.sigev_notify = SIGEV_SIGNAL_THREAD;
     event.sigev_signo = SIGSELECT;    /* This signal is     
      always SIGBLOCKed */
     /* event.sigev_value will be modified as needed by 
      select_sigevent() */
     event.sigev_code = SI_NOTIFY;
     event.sigev_priority = -1;
 
      return _select_event(nfds, readfds, writefds, exceptfds, tvptr ? &ts : 0, &event, _select_block, 0);
}

Shared memory on ARM processors

The behavior of the SHMCTL_GLOBAL and SHMCTL_PHYS flags has changed for ARM processors.

On ARM, you can use shm_ctl() to create shared memory objects that can be mapped outside the regular process address space to overcome the 32 MB address-space limitation.

In 6.2.1, these objects, when mapped, weren't protected and were potentially accessible via their global virtual addresses from any suitably privileged process. This access was restricted to processes that had performed ThreadCtl(_NTO_TCTL_IO), so in general, this was restricted to drivers or other system processes. The SHMCTL_LOWERPROT flag lowered this restriction so that any user process could potentially access these mappings without having to use ThreadCtl(_NTO_TCTL_IO) first.

In 6.3.0, these global mappings are protected, so that only the process that performed the mmap() of the shared memory object can access it. If you have any code written for 6.2.1 that relies on the implicit access allowed by these global mappings, you must modify it to use the flags to explicitly remove the per-process protection:

• SHMCTL_PRIV disables the per-process protection and restricts access to processes that have performed a ThreadCtl(_NTO_TCTL_IO). This is equivalent to the default 6.2.1 behavior.
• SHMCTL_LOWERPROT disables the per-process protection and allows access from any user process. This behavior is the same as the use of this flag in 6.2.1.

In addition to the per-process protection, 6.3.0 changes the alignment of the virtual addresses where these global mappings are placed:

• In 6.2.1, mappings were aligned on a 4 KB boundary.
• In 6.3.0, mappings are aligned on a 1 MB boundary. This alignment must be honored even if MAP_FIXED is used.

In 6.2.1, mmap() mapped separate objects like this:

• first object at 0x80000000 - 0x80002fff
• second object at 0x80003000 - 0x80005fff

In 6.3.0, mmap() maps these objects as:

• first object at 0x80000000 - 0x80002fff
• second object at 0x80100000 - 0x80102fff

If you have any code written for 6.2.1 that makes assumptions about the alignment of mappings or uses MAP_FIXED with non-1-MB alignment, you must modify it to comply with the new behavior.

64-bit “large file” libc/filesystem support

QNX Neutrino 6.3 now implements the X/Open Largefile Support extensions. For details, see the 6.3.0 and 6.2.1 Compatibility note posted on our website.

shm_ctl_special()

This function, which gives special attributes to a shared-memory object, is now documented in the Neutrino Library Reference. (Ref# 18667)

Startup library

The startup library now supports 64-bit physical addresses for the MIPS, PPC, and x86 architectures. Two versions of the libstartup.a are built:

• libstartup.a with 32-bit paddr_t's
• libstartup-64.a with 64-bit paddr_t's.

By default, startup programs will compile and link with the 32-bit version. If a board needs 64-bit physical addresses, add the make macro PADDR_SIZE=64 to the board's pinfo.mk file (see startup/boards/440rb/pinfo.mk for an example).

stat()

• The stat() function has been changed so that it no longer accepts 0 (zero) for the second argument. If you use this in your code, please check to see that the second argument points to a struct stat buffer.
• The st_size field for S_ISBLK devices was changed to mimic QNX 4 behavior (i.e. to report it as the number of 512-byte blocks and not the number of bytes or the number of raw sectors). (Ref #17294)

swapctl

Support for swapping (experimental on x86) has been removed with the 6.3.0 release. It was introduced to help compile and link large projects on memory-constrained hosts, but is no longer required using current PC configurations.

System page

• System page no longer contains the meminfo section, nor is the SYSPAGE_ENTRY(system_private)->ramsize field filled in. This is because they're restricted to 4 GB. Code referencing those syspage items should be modified to use the asinfo section (which has been generated since Neutrino 2.0).
• The add_mem() function has been removed from the startup library.

  Here's replacement code for SYSTEM_ENTRY(system_private)->ramsize:

  uint64_t
  get_total_mem(void) {
      char                    *str = SYSPAGE_ENTRY(strings)->data;
      struct asinfo_entry     *as = SYSPAGE_ENTRY(asinfo);
      uint64_t                total = 0;
      unsigned                num;
  
      for(num = _syspage_ptr->asinfo.entry_size / sizeof(*as); num > 0; --num) {
          if(strcmp(&str[as->name], "ram") == 0) {
              total += as->end - as->start + 1;
          }
          ++as;
      }
      return total;
  }

  For code that scans meminfo, replace the check of the type field with a strcmp() of the appropriate asinfo entry name (as above) and scan asinfo.

/etc/rc.d/rc.local

For your convenience, 6.3.0 SP3 installs an empty, executable version of /etc/rc.d/rc.local, with permissions of of 750 (read, write, execute for the user; read, execute for the group; no permissions for others). (Ref# 22665)

Fast mutex optimization (SH4 and ARM)

Renesas SH4 and ARM/XScale processors don't include atomic operations (atomic compare-swap or load-linked/store conditional), so these instructions are emulated on these platforms. As these instructions are used for mutexes, the cost of this emulation is significant. SP3 includes a new scheme that instead includes a specific code sequence that, when coupled with updates to the kernel, allows the implementation of mutexes using normal (nonemulated) assembly sequences. This provides a significant performance improvement for uncontested mutexes.

malloc() optimizations

The standard C library malloc() has been reworked to improve performance for small allocations.

Debug malloc

New features include enhanced leak detection and multi-level stack traces.

The debug malloc library in 6.3.0 SP3 for SHLE passes in a special flag when it needs to allocate memory from the kernel using mmap(). This flag tells the 6.3.0 SP3 SHLE kernel not to set the contents of allocated memory to zeros. This flag will not be recognized in the later version of the SHLE kernel, therefore, will cause compatibility problems when you apply the QNX Neutrino Core OS 6.3.2 on a 6.3.0 SP3 system. The fix is to not set this flag by default. (Ref# 27639)

esh, uesh, fesh

The embedded shells have two new builtin commands: emount and waitfor. (Ref# 22074, 23627)

su and passwd

These utilities no longer allow a buffer overrun to occur. (Ref# 29454)

RCS IDs

When you install this patch, the following files are installed under $QNX_TARGET/usr/include:

• sys/platform.h
• sys/target_nto.h

These header files define some macros that we use to determine the version ID of the source code used in the executables on the system. (Ref# 38433)

What's new: Device drivers

Audio device drivers (deva-*)

• deva-ctrl-sblive.so is no longer supported.

Block-oriented drivers (devb-*)

New drivers:

• devb-umass (USB mass storage):
  • A reduced SCSI command set model was implemented. This increases interoperability with nonstandard devices that don't function properly when encountering SCSI commands that they don't support.
  • The SCSI_INQUIRY command now requests only 36 bytes. Some devices fail when asked for the full 96 bytes. (Ref# 22105)
  • devb-umass now works correctly with devices (such as the San Disk Cruzer Mini) that return invalid data for CSW. You can now specify the csw_ignore option on the command line. (Ref# 22104)
  • devb-umass now correctly detects a Y-E Data floppy drive. (Ref# 29552)
  • If a driver attempts to attach to a device that's already controlled by another driver (i.e. usbd_attach() returns EBUSY), io-usb no longer aborts the endpoints for that device after the attach fails. This problem caused other drivers to fail when the URBs were aborted for no reason. (Ref# 29562)
  • devb-umass now handles devices that return invalid sense data (NO_MEDIA). (Ref# 29600)
• devb-adpu320 (SCSI driver for Adaptec Ultra320 adapters).

devb-eide

The devb-eide driver in SP3 supports the following chipsets:

The devb-eide driver now:

• scans for slave devices on Intel SATA controllers (Ref# 40474)
• supports UDMA modes on VT8251 (Ref# 41450)
• supports UDMA modes on AMD Geode LX800 (AMD CS5536) (Ref# 41463)
• works on the Dell Dimension 3100 (ATA mode only, not RAID) (Ref# 41505)

devb-ahci

The devb-ahci driver supports the Intel AHCI SATA controller with the following device IDs:

• ICH-6 82801FB_SATA 0x2651
• ICH-6 82801FBM_SATA 0x2653
• ICH-7 82801GB_SATA 0x27c1
• ICH-7 82801GBM_SATA 0x27c5

---

You need to enable AHCI mode in the BIOS.

---

This driver now correctly detects the hard drive on the IBM ThinkPad T60. (Ref# 40126)

devb-mvSata

The devb-mvSata driver supports Vendor ID 0x11ab with the following device IDs:

Character device drivers

If you've written a character device driver that links against the libio-char.a library, note that there has been a change in the API to accommodate power management. You need to update any driver source code originally written for 6.3.0 and earlier if you plan to compile it against the new library in 6.3.0 SP3.

---

You don't need to regenerate any binaries. This is an issue only if you're rebuilding old source code on the new 6.3.0 SP3 system.

---

For more information, see the release notes for the Character DDK.

Flash drivers (devf-*)

• On 32-bit wide Intel flash, if an attempt to access flash using a 16-bit aligned address failed, the flash driver used to crash when it reset the hardware. The reset callback now aligns the addresses properly. (Ref# 20151)

Graphics drivers (devg-*)

Other changes include:

devg-radeon.so

• The x86 version of this driver initializes secondary cards for multicard displays.
• The devg-radeon.so driver now supports the Radeon M22 (Mobility X300). (Ref# 39723)

Polygon acceleration

We added polygon acceleration support for some chipsets (e.g. Fujitsu Coral, Orchid).

$QNX_TARGET/etc/system/enum/devices/graphics

We updated the enumerator to detect the supported chipsets.

Network drivers (devn-*)

• devn-dm9102.so — for Davicom DM9102 controller.
• New MDI/PHY routines for Network drivers.

Many drivers now have a probe_phy option. This option lets you select whether or not the PHY is probed at regular intervals to see if the duplex setting and/or the speed on the connection has changed (e.g. the cable has been unplugged and plugged into a different hub or switch.

Here's a description of the new option:

probe_phy=1

Poll the PHY at regular intervals to see if the speed or duplex setting has changed.

probe_phy=0

Poll the PHY at regular intervals, but only during periods when no packets are received on the interface, or the link is down. This setting increases the packet-throughput performance on the link, and is the default.

6.3.0 SP3 also addresses the following issues:

devn-asix.so

This is a new driver for SMC2209 USB/Ethernet adaptors.

CPU targets provided: x86, ARMLE, MIPSLE, MIPSBE, PPCBE, SHLE

Location: $QNX_TARGET/x86/lib/dll/devn-asix.so, $QNX_TARGET/armle/lib/dll/devn-asix.so, $QNX_TARGET/mipsle/lib/dll/devn-asix.so, $QNX_TARGET/mipsbe/lib/dll/devn-asix.so, $QNX_TARGET/ppcbe/lib/dll/devn-asix.so, $QNX_TARGET/shle/lib/dll/devn-asix.so

Supported device IDs / chipsets:

• device 0x1a00 # Dlink DUBE100
• device 0x1720 # SMC 2209

devn-bcm43xx.so

We've updated this driver (for Broadcom BCM43xx Wireless Ethernet controllers) to add support for WPA and WPA2.

CPU targets provided: x86, PPCBE, SHLE

Location: $QNX_TARGET/x86/lib/dll/devn-bcm43xx.so, $QNX_TARGET/ppcbe/lib/dll/devn-bcm43xx.so, $QNX_TARGET/shle/lib/dll/devn-bcm43xx.so

Supported device IDs / chipsets:

• device 4301 # BCM4301_D11B
• device 4307 # BCM4307_D11B
• device 4320 # BCM4306_D11G
• device 4325 # BCM4306_D11G
• device 4303 # BCM4303_D11B
• device 4321 # BCM4306_D11A
• device 4324 # BCM4306_D11 DUAL
• device 4318 # BCM4318_D11G
• device 4319 # BCM4318_D11 DUAL
• device 431a # BCM4318_D11A
• device 4311 # BCM4311_D11G
• device 4312 # BCM4311_D11 DUAL
• device 4313 # BCM4311_D11A

devn-hermes2.so

This is a new driver for Agere Wireless Ethernet controllers.

CPU targets provided: x86

Location: $QNX_TARGET/x86/lib/dll/devn-hermes2.so

Supported device IDs / chipsets: PCMCIA manufacturer ID 156 device 3 # PCMCIA Hermes2 - Proxim Orinoco 802.11b

devn-i82544.so

We've updated this driver (for Intel 82544 Ethernet LAN adapters) with support for new chipsets.

CPU targets provided: x86, PPCBE

Location: $QNX_TARGET/x86/lib/dll/devn-i82544.so, $QNX_TARGET/ppcbe/lib/dll/devn-i82544.so

Supported device IDs / chipsets:

• device 1008 # Intel 82544EI Gigabit
• device 1009 # Intel 82544EI Gigabit
• device 100c # Intel 82544GC Gigabit
• device 100d # Intel 82544GC Gigabit
• device 100e # Intel 82540EM Gigabit
• device 100f # Intel 82545EM Gigabit
• device 1010 # Intel 82546EB Gigabit
• device 1011 # Intel 82545EM Gigabit
• device 1012 # Intel 82546EB Gigabit
• device 1013 # Intel 82541EI Gigabit
• device 1015 # Intel 82540EM Gigabit
• device 1016 # Intel 82540EP Gigabit
• device 1017 # Intel 82540EP Gigabit
• device 1018 # Intel 82541EI Gigabit
• device 1019 # Intel 82541EI Gigabit
• device 101d # Intel 82546EB Gigabit
• device 101e # Intel 82540EP Gigabit
• device 1026 # Intel 82545GM Gigabit
• device 1027 # Intel 82545GM Gigabit
• device 1028 # Intel 82545GM Gigabit
• device 1075 # Intel 82541GI Gigabit
• device 1076 # Intel 82541GI Gigabit
• device 1077 # Intel 82541GI Gigabit
• device 1078 # Intel 82541ER Gigabit
• device 1079 # Intel 82546GB Gigabit
• device 107a # Intel 82546GB Gigabit
• device 107b # Intel 82546GB Gigabit
• device 107c # Intel 82541PI Gigabit
• device 108a # Intel 82546EB Gigabit
• device 108b # Intel 82573V Gigabit
• device 108c # Intel 82573E Gigabit
• device 109a # Intel 82573L Gigabit

devn-pcnet.so

• Packet processing now occurs only after the driver has fully registered with io-net, in order to prevent an assertion with the debug version of io-net. (Ref# 23068)
• This driver now includes the probe_phy option, as described above. (Ref# 28634)
• Promiscuous and multicast support for the devn-pcnet.so driver is controlled via command-line options rather than by devctl() due to observed NIC-reset problems when the modes are switched in the hardware. The default mode is promiscuous Rx disabled and all-multicast Rx enabled. This allows TCP/IP v6 to run it's routing daemons. You can enable promiscuous mode by specifying the promiscuous command-line option to the driver. You can disable multicast mode by specifying the nomulticast command-line option to the driver. (Ref# 29378)
• This driver now provides more information when you use nicinfo.
• We've fixed an issue that affected duplex operations at 10 Mbit/second.
• We've added the _NPKT_PROMISC flag to received packets.

devn-rtl.so

• The correct duplex setting is now negotiated when the speed is 10 Mbit. (Ref# 17146)
• This driver now works on MIPSBE targets. (Ref# 24259)
• This driver now includes the probe_phy option, as described above. (Ref# 28637)
• Issuing a umount /dev/io-net/en1 no longer causes io-net to crash. (Ref# 29470)
• You can now start a second instance of io-net using the RTL driver. (Ref# 29488)
• nicinfo now reports the correct speed and duplex setting when they're specified. (Ref# 29489)
• The devn-rtl.so driver no longer loses packets during a receive on PPCBE targets. (Ref# 29680)
• devn-rtl.so now scans and automatically detects Dlink DFE-528Tx Rev E1 with vendor ID 0x1186 and device ID 0x1300, with NIC labeled DL10038D. (Ref# 29729)

  ---

  The Dlink DFE-538TX Rev D2 with a NIC labeled DL10038C that also has the same vendor and device IDs as the DFE-528TX card isn't apparently 100% rtl-8139-compatible and doesn't appear to work correctly.

  ---

• We now provide an SHLE variant of this driver.
• We've added a caching API for SH.

devn-pegasus.so

• The devn-pegasus.so driver now works with newer 8513-based chips. (Ref# 27727)
• This driver now includes the probe_phy option, as described above. (Ref# 28647)
• Multicast and broadcast statistics are now correctly displayed with nicinfo. (Ref# 29130)

devn-rtl8150.so

This is a new driver for SMC2208 USB/Ethernet adaptors.

CPU targets provided: x86, ARMLE, SHLE

Location: $QNX_TARGET/x86/lib/dll/devn-rtl8150.so, $QNX_TARGET/armle/lib/dll/devn-rtl8150.so, $QNX_TARGET/shle/lib/dll/devn-rtl8150.so

devn-tigon3.so

This is a new driver for the Broadcom BCM57xx Ethernet controller.

CPU targets provided: x86

Location: $QNX_TARGET/x86/lib/dll/devn-tigon3.so

Supported device IDs / chipsets:

• Broadcom BCM5705
• Broadcom BCM5721
• Broadcom BCM5751
• Broadcom BCM5752
• Broadcom BCM5787

libdrvr*

• If you forced the speed on the command line, the first link's speed was negotiated properly, but subsequent renegotiations didn't honor the override speed, performing a normal auto-negotiation instead. We've now corrected this.
• We've corrected an auto-negotiation problem with gigabit Ethernet.
• We've added the unit option as an alias for the lan option.
• We've corrected the display of memory addresses.

$QNX_TARGET/etc/system/enum/devices/net

We've updated the enumerator to add new Ethernet drivers.

pccard-launch

This is a new Pccard launch utility.

CPU targets provided: x86, ARMLE, MIPSLE, MIPSBE, PPCBE, SHLE

Location: $QNX_TARGET/x86/usr/sbin/pccard-launch, $QNX_TARGET/ppcbe/usr/sbin/pccard-launch, $QNX_TARGET/shle/usr/sbin/pccard-launch

pci-bios

We've updated this PCI server to add PCI-to-PCI bridge support.

CPU targets provided: x86

Location: $QNX_TARGET/x86/sbin/pci-bios

startup-bios

• We've added support for the Supermicro Supero x6DLP-EG2 x86 SMP platform based on the Intel Sossaman.

  CPU targets provided: x86

  Location: $QNX_TARGET/x86/boot/sys/startup-bios

• We added support for the x86 NX (no-execute) page table bit. On processors that support it (AMD64, IA-32e), mmap()'d memory no longer lets you execute instructions in that memory unless you've specified the PROT_EXEC permission flag. If not specified, a SIGSEGV occurs.

  ---

  You must have installed the QNX Neutrino Core OS 6.3.2 and enable page-table extensions (with the -x startup option) in order for the NX bit to be effective.

  ---

  You can turn off support by putting -F ~0x4000 on the startup command line. (Ref# 40162)

USB device drivers (devu-)

devu-ohci.so

• The OHCI driver now works on platforms that have PCI bus master translation. (Ref# 29556)
• The OHCI driver no longer has an endian bug that caused io-usb to crash on big-endian platforms. (Ref# 29558)

devu-ehci.so

• If two drivers attempt to abort an endpoint at the same time, the EHCI driver no longer loops while disabling and enabling the schedule. The client drivers no longer remain blocked forever waiting for the abort operation to complete. (Ref# 25647)
• The default interrupt threshold is now 1. This increases the allowable interrupt frequency and improves the “out-of-box” mass storage performance. (Ref# 28952)

usb

This utility now displays the Full speed HC capability.

What's new: Device enumeration

• We've removed a blanket condition for enumerating PCI serial devices, so that we don't start devc-ser8250 for all of them. The new enumeration is based entirely on the vendor and device IDs, so the correct driver is started for the specific card. (Ref# 38968)
• Network drivers are no longer mounted before io-net has fully started. This was a problem mainly on multicore systems. (Ref# 38185)
• We changed enum-pnpbios so that it works properly on systems that have a partial PNP BIOS. (Ref# 29768)
• The network enumerator now detects Broadcom BCM57xx chipsets with device IDs 0x1653 and 0x169c. (Ref# 40752)

What's new: Filesystems

find and inode numbers on big-endian platforms

File inode numbers in the find utility weren't being correctly treated as off_t variables. When compiled as _FILE_OFFSET_BITS=64 on big-endian platforms, this resulted in their always being displayed (for example, using find -printf "%i") as 0. The find utility now correctly displays the inode field as a 64-bit value where appropriate. (Ref# 19172)

fseeko64() and ftello64()

The stdio library didn't contain 64-bit variants of the fseeko() and ftello() routines. Thus, an application program compiled as _FILE_OFFSET_BITS=64 using these routines would be passing a 64-bit offset into a function expecting only a 32-bit value. The impact was that these routines wouldn't operate correctly (they'd randomly fail or seek to the wrong location); the behavior of the standard utilities head and tail might also have been affected. (Ref# 20437)

C++ and <stdio.h> _FILE_OFFSET_BITS=64

The 64-bit function mappings in <stdio.h> for the fopen(), freopen() and tmpfile() routines generated warnings within the namespace std scope. Compiling C++ code as _FILE_OFFSET_BITS=64 would produce “already declared in this scope” warnings from <stdio.h>. The header file has been fixed. (Ref# 20624)

Resource managers and the IOFUNC_MOUNT_32BIT flag

The iofunc library didn't implement the IOFUNC_MOUNT_32BIT flag. The intent of this flag, when used by a filesystem resource manager, is to indicate that it deals only with 32-bit file sizes and offsets (most likely it's compiled with _IOFUNC_OFFSET_BITS=32, _FILE_OFFSET_BITS=32, or both).

However, a 64-bit client application (compiled with _FILE_OFFSET_BITS=64 or using O_LARGEFILE) could seek or otherwise attempt to access a file beyond the 32-bit/2 GB limit, whereas the server is manipulating only 32 bits, resulting in an inconsistent file.

The IOFUNC_MOUNT_32BIT flag in an iofunc_mount_t is now honored, and the iofunc library detects any attempt to access beyond a 32-bit offset and fails with EOVERFLOW. (Ref# 21122)

umount can SIGSEGV a devb-* driver

In rare cases, a umount of a disk filesystem formerly could cause the associated devb-* driver (actually the io-blk.so library) to crash with a SIGSEGV. This has been fixed. (Ref# 19387)

fs-cd.so

• This module now supports ISO-9660 Interchange Level 3 (multiple file sections). (Ref# 22087)
• Recursive searches in a CD filesystem no longer return corrupted entries. (Ref# 19014)
• Bad directory contents no longer cause fs-cd.so to run READY. (Ref# 29577)

fs-cifs

When fs-cifs connected to a Windows server, a unique session was created. When a second fs-cifs process was started, it didn't specify an identifier different from the first instance, and thus confused the server, which thought that the original fs-cifs process had reestablished its connection. The server then terminated the first session.

This repeated: the second session was disconnected when the first fs-cifs detected that it had been disconnected and reestablished its link to the server. This continued back and forth each time file access was required from the server.

This issue has been fixed, and multiple CIFS sessions are supported, which can enhance performance. These modifications also allow a fs-cifs process to create a local mountpoint nested within the local mountpoint path of another fs-cifs process. (Ref# 15452, 21532)

fs-dos.so

• stat() no longer fails on directory names that contain UTF-8 characters. (Ref# 22959)
• fs-dos.so now correct handles a FAT-hosted OS/2 filesystem. (Ref# 28811)

fs-ext2.so

• Writing to a 0-sized unlinked file no longer crashes fs-ext2.so. (Ref# 22593)
• fs-ext2.so no longer doubly frees groups' descriptors following an EBADFSYS mount failure. (Ref# 38632)
• fs-ext2.so now enforces the maximum length of a symbolic link to be the value specified by SYMLINK_MAX. (Ref# 38601)
• fs-ext2.so no longer runs READY if you try to create too many files and inodes. (Ref# 22676)

fs-qnx4.so

• If you do the following:
  1. Create a directory.
  2. Create a file.
  3. Hold that file open with O_ACCMODE.
  4. Unlink that file.
  5. Create the same filename.
  6. Close any files.

  then attempting to remove the directory no longer fails with an error of EBADFSYS. (Ref# 18786)

• fs-qnx4.so no longer crashes when it zero-fills preallocated blocks and the write() operation to the end of file is interrupted by a signal in some cases. (Ref# 38414; Ticket ID 72461)
• Attempting to grow a directory (or .inodes file) on a completely full fs-qnx4.so disk no longer leaves the directory marked as busy. (Ref# 15354)

What's new: Flash filesystem

A new version of the NOR flash filesystem library offers significantly improved resistance to power-loss corruption. However, this improvement isn't backwards-compatible with the older version of the library.

The older library (libfs-flash.a) has been removed from this release. All flash drivers (devf-generic, devf-ram, etc.) now link against the version 3 library, i.e. libfs-flash3.a.

If your existing code links against libfs-flash.a, you must now use the version 3 library. For more information, please refer to the documentation on the new version 3 flash filesystem as well as the migration technote.

What's new: IDE (Professional Edition only)

Eclipse 3.0

The IDE is now based on Eclipse 3.0 and includes these new features:

• new look and feel, including new title bars and tabs, buttons for minimizing views, better drag-and-drop feedback, and detached views
• more responsive UI, including the ability to run jobs in the background
• support for single and multiple editor tabs, as well as editor pinning for editors that shouldn't be closed, and new menu options, keyboard shortcuts and key bindings
• background workspace auto-refresh — changes made in the local filesystem can now be automatically refreshed in the workspace (currently disabled by default)
• regular expressions in the text editors' Find/Replace dialog
• new editor functions: move lines up or down, copy lines, insert a new line above or below the current line, and convert text to lowercase or uppercase
• launch shortcuts in the context menu of all applicable views
• the ability to invoke an Ant build from the Run context menu

The new C Development Tools include:

• improvements to the New C++ Class wizard
• new C/C++ wizards that make it easier to create source and header files, source folders, and C & C++ projects
• filtering and grouping in the Outline view
• code folding — lets you hide and display functions, methods, classes, structures, and macros
• new preferences and code-folding in the Makefile editor
• a Type Hierarchy view that lets you easily visualize a program's structure and class usage.

---

If you import an old QNX C/C++ project into the SP3 version of the IDE, you should enable Clean and specify the clean target in the Make Builder tab of the project properties. The Clean entry in the Project menu uses this setting, which is enabled by default for new projects.

---

Debugging support and application launching in the CDT has been improved:

• thread-specific breakpoints
• breakpoint filtering
• support for variables in the Environment, Argument, and Working Directory tabs
• mixed source/assembly in the Disassembly view
• global variables can now be added to the Variables view
• the Debug console is now in the generic Console view
• automatic refresh options for shared library and register information

C/C++ project configuration and building have been improved:

• automatic project settings discovery
• C++ Include Paths and Symbols
• C/C++ Project Paths project properties to help you determine which files and directories you should put source, output, or library into
• C/C++ file types — define the types of specific files, especially C++ headers without extensions
• C/C++ working sets

It's now easier to edit and navigate through your C/C++ source files:

• C/C++ content assist — completions for classes and structure members, local and global variables, functions, preprocessor definitions, and preprocessor commands
• Rename refactoring
• Open type — open up the declaration of C/C++ classes, structures, unions, type definitions, enumerations and namespaces
• C/C++ Browsing perspective — navigate the class and structure members of a particular project
• context-sensitive searches from the Outline view, as well as resource-selection restricted searches in the C/C++ Search Dialog
• hyperlink navigation
• index error markers

These exclusive QNX Momentics tools have also been updated and improved:

• Memory Analysis
• System Profiler
• Code Coverage
• System Information

For more information, see the IDE User's Guide and the IDE's Welcome page.

Debugger

The Details pane in the Variables view now has an Assign Value (Ctrl+S) action. (Ref# 16758)

Support for BSPs

The System Builder now finds the components installed in the prebuilt directory for Board Support Packages. (Ref# 39121)

What's new: Installation and licensing

• The installation process has changed — we're no longer using the QNX Software Installer or cl-installer.
• You can't select individual target platforms (e.g. PPC, MIPS, etc.) anymore — you get all platforms when you install 6.3.

  ---

  If you're using the IDE, you might want to set your preferences for QNX projects to build only for the specific target platforms you want. See: Window-->Preferences-->QNX-->New Project-->Architecture.

  ---

• qnxactivate now lets you add new license keys. (Ref# 30028)
• The Manual Activation dialog for qnxactivate now has a button that you can use to save the prompt key in a file, and another to load the response key from a file. This eliminates the need to retype the keys, which can be error-prone. (Ref# 38690)
• qnxactivate can now accept text messages from the server that explain why activation failed, provide additional information, and so on. (Ref# 40914)
• We've included a qaudit.sh script that lists the QNX products that you've installed on your system. (Ref# 26136)

What's new: I/O devices

io-blk.so

• fsync() no longer causes problems on read-only media. (Ref# 22013)
• We've fixed some inconsistencies and oddities in how io-blk.so handles the blk automount= option in some unusual cases. (Ref# 29351)
• io-blk.so now delays the completion of the lock mount option if no CD is currently installed. (Ref# 28037)
• io-blk.so now locks a vnode when it's created, to prevent a crash that could occur if a high-priority sync tried to use the vnode before it was initialized. (Ref# 23462)
• io-blk.so now correctly honors the before and after keywords to the mount command's -o option. You can also specify these keywords on the devb-* command line, in the blk options, the way you specify ro, rw, noatime, and so on. (Ref# 19606)

io-char

• The terminal POSIX support library incorrectly treated a physical break condition on a serial line and the receipt of the INTR character as the same event, and thus used the wrong tty flags to control the handling behavior. A physical break should be configured by the IGNBRK and BRKINT flags, whereas a keyboard interrupt is configured by the VINTR character and the ISIG flag. The effect of this may be seen as the inability to use Ctrl-C in certain terminal configurations (for example esh, which despite +isig intr=03 didn't also configure -ignbrk +brkint). (Ref# 19736)
• The terminal POSIX support library incorrectly discarded an input 0x00 character when in ICANON (edited) mode, although it was available to be read in non-ICANON (raw) mode. (Ref# 21082)
• The terminal POSIX support library incorrectly implemented the IGNPAR flag. This flag, when used with INPCK, should cause parity checking of input characters to be performed, and any characters with a parity error should be discarded and not be made available to be read. However the bad characters weren't being ignored. (Ref# 21083)

The above problems have all been corrected in the io-char.a library; the changes affect all devc-* drivers (because they're statically linked against this library).

io-usb, libusbdi.so

This is a resource manager that supports USB 2.0/1.0.

• Some devices don't handle string descriptors properly, so libusbdi.so now checks to see if the string index fields for Manufacture or Product are set. If they aren't, the library doesn't try to read the language table (index 0) on the string descriptor. (Ref# 23097)
• If a device has multiple interfaces and alternate settings on the second interface, selecting one of alternate settings no longer causes errors when enqueuing transactions on the first interface. (Ref# 28313)
• Errors are now correctly reported for isochronous transfers when the buffer size is larger than MPS. (Ref# 28315)
• Fetching and storing multiple configurations for a device now works correctly. This change lets you select a default configuration/interface for a multiconfiguration device. (Ref# 28449)
• The io-usb server no longer crashes with a SIGSEGV on startup when bad arguments are passed to it. (Ref# 29082)
• USB client drivers are no longer notified of HUB insertions when the client driver is first started. (Ref# 29527)
• devu-ohci no longer runs out of Endpoint Descriptors. (Ref# 29661)

What's new: Network protocols

Global Name Service Manager (gns)

The name_open() function used to be a silent operation for the server in that it wouldn't know when a client called name_open(). This behavior is changed to allow operation over the network.

The server will now always receive an _IO_CONNECT message when a client calls name_open(). (For more information, please refer to the gns entry in the Utilities Reference.)

Qnet

We now ship two versions of Qnet:

• npm-qnet-l4_lite.so — the new lightweight Qnet
• npm-qnet-compat.so — the pre-6.3 version.

---

The new Qnet (npm-qnet-l4_lite.so) is not compatible with the pre-6.3 versions.

---

The default version is the new lightweight Qnet (npm-qnet.so is a link to npm-qnet-l4_lite.so). If you wish to use the older version of Qnet, have npm-qnet.so link to npm-qnet-compat.so and restart io-net.

---

You can't have an instance of npm-qnet-l4_lite.so and npm-qnet-compat.so active at the same time on the same node. You can't unmount Qnet (either version) from io-net in 6.3.0.

---

npm-qnet-l4_lite.so

• We've add a new Qnet IOMSG, _NETMGR_QOS_FLUSH. This message lets an application force a retransmission instead of waiting for Qnet to activate its own timeout. This is useful for periodic detectable hardware failures where the application can take action, instead of enabling shorter timeout periods for Qnet, which adds more load to the system. (Ref# 38260)

  Here's an example:

  #include <sys/netmgr.h>
  #include <sys/netmsg.h>
  
  extern int __netmgr_send( void *smsg1, int ssize1, const void *smsg2,
                            int ssize2, void *rmsg, int rsize);
   
  int main (void)
  {
              struct _io_msg msg;
  
              msg.type = _IO_MSG;
              msg.combine_len = sizeof(msg);
              msg.mgrid = _IOMGR_NETMGR;
              msg.subtype = _NETMGR_QOS_FLUSH;
  
              __netmgr_send(&msg, sizeof(msg), 0, 0, 0, 0);
  }
      

• Qnet now lets you specify the maximum transmission unit (MTU) of a Qnet packet via the mtu_en=num option. The num argument must be greater than 100. All nodes in network must use the same value. The default is 1500. (Ref# 22250)
• Qnet supported a maximum of two network interfaces (the first two located) although the user could override and specify which two (with the bind=interface option). Qnet now supports more interfaces via the max_num_l4s=num option. The default is two; the maximum is four. (Ref# 22269)
• Qnet used a pulse with a hard-coded priority for the QoS transmission thread, and the QoS periodic transmission thread. You can now set the priority of these pulses, using the options qos_per_pri=num and qos_tx_pri=num, where num is the new priority. We recommend that you not change these values; we supply these options for the user case where the priority of the io-net subsystems must be changed, which is typically rare. (Ref# 20891)
• Qnet has the option of using CRC to check for packet corruption. By default it relies on the hardware. When using software CRC checks, Qnet verifies the CRC if it's present, although it also allows packets that don't contain a CRC value (other nodes not using the no_crc option). We've added a new enforce_crc option:

  enforce_crc=num

  If you use this option in combination with do_crc, only packets that contain a valid CRC are accepted. This option has an effect only when do_crc is also set to 1. Setting enforce_crc to one causes packets that are received without a valid software-level CRC generated by the remote mode (i.e. it's running do_crc=0) to be discarded, because the packet content's integrity is unknown, and could be suspect. The default is zero, which allows received packets without a generated software-level CRC to be processed. (Ref# 39171)

npm-qnet-compat.so

• A race condition existed where Qnet could fault io-net. This could have happened when a client application sent a message (e.g. write() or read()) to a server application on another node. If the server application terminated while the message was being sent, or during the reply from the server back to the client, the client application's Qnet might have caused io-net to fault.

  This problem occurred only if the send or reply message buffer was larger than the MTU of the network being used. For example, with Ethernet, if the message buffer was larger than 1500 bytes, multiple packets needed to be sent to transmit the message. This has been fixed. (Ref# 21119, 21406)

• Depending on how the discovery took place, a 128-byte buffer of memory formerly could be lost at the initial discovery of each peer node on the network. This has been fixed. (Ref# 19242)

TCP/IP stack (npm-tcpip-v4.so and npm-tcpip-v6.so)

• The TCP/IP stack could formerly fault if you tried to get file-descriptor information (e.g. by executing sin fd) on a system where a process had called shutdown() for a TCP/IP socket descriptor, but the socket hadn't yet been closed. This has been fixed. You also now get more diagnostic information when you use sin fd to view information on socket file descriptors. (Ref# 21549)
• If a program called bind() for an AF_LOCAL socket, and the path namespace entry was created, the TCP/IP stack used to leak a small amount of memory, even if the path were unlinked. This has been fixed. (Ref# 21639)
• When the fastforward path in the TCP/IP stack was used (see the fastforward option to npm-tcpip-v4.so or npm-tcpip-v6.so), the TCP/IP stack didn't deal with the next hop gateway properly if it wasn't responding to an ARP request. The TCP/IP stack now correctly marks the route as being down and sends an ICMP-unreachable packet back to the source. (Ref# 23864)
• If a packet were to be forwarded, and there was no route specified on the gateway, the TCP/IP stack returned ICMP_UNREACH with an ICMP_UNREACH_HOST code. The TCP/IP stack has been changed to return a ICMP_UNREACH_NET code. (Ref# 23900)
• When the TCP/IP stack ran out of threads, it wasn't obvious to the user that this had occurred, beyond the slow response of the TCP/IP stack. (See the threads option for npm-tcpip.so. Now if this occurs, this situation is logged to sloginfo. (Ref# 26556)
• The TCP/IP stack formerly could sometimes generate a double reply in response to sin fd queries. This didn't cause any issues, but made kernel traces confusing. (Ref# 25856)

SCTP (in the Extended Networking TDK)

• SCTP currently supports only IPv4; its API may be subject to change.
• Although SCTP (lsm-sctp.so) supports only the IPv4 protocol family, it must be used in combination with the npm-tcpip-v6.so DLL. You can't mount lsm-sctp.so while using the npm-tcpip-v4.so DLL. This is due to internal dependencies. Note that npm-tcpip-v6.so also supports IPv4 along with IPv6 and other features.
• The TCP/IP stack (npm-tcpip.so) must be started with the option stacksize using a larger value than the default. For example, io-net -d -ptcpip stacksize=4096 when using SCTP (lsm-sctp.so).

IPFilter (in the Extended Networking TDK)

IPFilter (lsm-ipfilter-[v4|v6] can be used only with the matching TCP/IP stack (i.e. lsm-ipfilter-v4.so with npm-tcpip-v4.so; lsm-ipfilter-v6.so with npm-tcpip-v6.so).

Full TCP/IP stack and other updates

• The full TCP/IP stack (npm-tcpip-v6.so; npm-tcpip-v4.so) has been updated to overcome the vulnerabilities in the TCP protocol. For details, see the security advisories NISCC Vulnerability Advisory 236929 and CERT Advisory TA04-111A.

  ---

  Although our Tiny TCP/IP stack (npm-ttcpip.so) hasn't been updated to address the TCP vulnerabilities, we anticipate that embedded devices using our tiny stack have applications that use short-lived TCP connections and are therefore not as vulnerable.

  ---

• Fixed problem re: select() where a socket would be erroneously marked as writable when it isn't. A subsequent write() would block or fail with EWOULDBLOCK. Another possible symptom is that a notification for write would be lost.
• portmap has been replaced by rpcbind (portmap is now a symbolic link to rpcbind).
• RPC library has been updated to support RPC Bind version 4.
• dhcpd and dhcprelay have been updated to ISC dhcp version 3.0 p2.
• New binaries: rpcbind, rpcgen, ntpd, ntpupdate, ntpdc, ntpq, ntptrace, gns.
• New DLLs: nfm-autoip.so (in the Extended Networking TDK), npm-qnet-l4_lite.so, npm-qnet-compat.so, lsm-ipfilter.so and lsm-sctp.so (in the Extended Networking TDK).
• New libraries (in the Extended Networking TDK): libipsec, libsctp.

---

IPv6 is now part of the Extended Networking TDK.

---

rpcbind

By default, rpcbind executes in “secure” mode and uses Unix Domain Sockets for local communication.

If you wish to use an older RPC application with rpcbind or to use rpcbind in combination with the Tiny TCP/IP stack, you'll need to refer to the -L and -i options to rpcbind.

---

The service rpcbind must be defined for both UDP and TCP in the /etc/services file. While the default /etc/services provided has these modifications, if you choose to use the current /etc/services file at installation time, these definitions will be missing and rpcbind will fail to function. The required lines are: sunrpc 111/tcp rpcbind portmap sunrpc 111/udp rpcbind portmap

---

RPC library

Timeouts for clnt_broadcast() have changed. In 6.2 and earlier, timeout and retransmission occurs at 4 seconds and increases by 2 seconds for every timeout after that to a max of 14-second timeouts, resulting in 6 retransmissions.

In 6.3, timeout and retransmission occurs at 4 seconds and doubles after that to a max of 8 seconds, resulting in 2 retransmissions. You can alter timeout values by calling the lower-level call rpc_broadcast_exp().

dhcp.client

• The dhcp.client previously sent a request to the DHCP server for the DHCP options that it could apply (IP address, netmask, etc.), but users couldn't modify this list. We've added support for a /etc/dhcp/dhcp-options file, so that you can request options that aren't handled by dhcp.client directly.

  When received from the server, these options are passed to the /etc/dhcp/dhcp-up script. Previously, dhcp.client relied on the server's passing all options in its client definition to that client whether those specific options were requested or not. If you're adding option handling to the dhcp-up script, you must also add that option to the dhcp-options file. For more information, see dhcp.client in the Utilities Reference. (Ref# 19509)

• If you specify the -a option, dhcp.client sets the configured IP address as an alias. This allows it to coexist with AutoIP and its link-local address.

ntpd and ntpdate

These binaries can now adjust the time if the value to process is less than 1 ms in the past. (Ref# 17593)

rcp

This utility uses ftruncate() when copying a file, and rcp used to fail if the filesystem didn't support this function (i.e. ftruncate() failed with ENOSYS). It now continues. (Ref# 16487)

slinger

Slinger used to corrupt the beginning of the CGI script data stream if the HTTP request was a POST request. This has been fixed. (Ref# 20118)

ping

We modified ping to not require the FPU. (Ref# 15324)

pppd

• This daemon used to leak memory when used in on-demand mode, as the connection was dropped and reestablished over time. (Ref# 21427)
• Whenever you start pppd in on-demand mode, a session is established. When you terminate pppd, the created PPP interface should be destroyed. Formerly, the interface wasn't destroyed, so it was listed when pppd wasn't running. This has been fixed. (Ref# 21418)

pppoed

As a convenience, pppoed mounts the io-net DLL npm-pppoe.so if io-net hasn't already loaded it. The pppoed daemon used to do this using the system() function, which locates the mount command with the PATH of the user executing pppoed.

This was a security problem, because non-privileged users could have placed their own mount command in the path and had it executed as root. This could allow a local non-root user root access. The pppoed daemon now calls mount() directly. (Ref# 21675)

<netinet6/in6.h>

Compiling a C++ application using this header file (which <arpa/inet.h> includes) resulted in an error:

In file included from /usr/qnx630/target/qnx6/usr/include/arpa/inet.h:79,
from tst.cc:3:
/usr/qnx630/target/qnx6/usr/include/sys/types.h:263: error: `size_t' not
declared

This has been fixed. (Ref# 21204)

<kvm.h>

Compiling a C++ application using this header file used to result in an error related to undefined references. This has been fixed. (Ref# 19974)

ntpd and ntpdate

When ntpd or ntpdate (in broadcast/multicast mode, -M option) received an update from the NTP server, if the result of the comparison between the current time and the time from the server was 0 (i.e. no update was needed), an incorrect random residual value might have been stored. This residual value would then be added to the next time-synchronization update if the comparison between the current time and the time from the server was nonzero. This has been fixed. (Ref# 21766)

telnetd

During the initialization of the telnet link, if the client sent a large number of parameters to negotiate, telnetd used to overrun its reply buffer with the responses to all of the request's parameters. The telnetd daemon now flushes the buffer if it becomes full. (Ref# 21965)

route, arp, netstat, npm-tcpip-v4.so

• The TCP/IP stack used a monotonic clock internally. Interfaces that used an absolute timeout value to specify a timeout, or to query a timeout, were converted to use a relative timeout value. Utilities that used this interface were converted to use a relative timeout value. This introduced portability and maintenance issues because the timeout values were incorrectly applied if the application wasn't modified. These interfaces once again use an absolute timeout. The interfaces effected are:
  • The Routing Socket rt_metrics structure member rmx_expire — the lifetime for the route

  The arp, route and netstat utilities had been modified to supply a relative timeout rather than an absolute one. We've changed them back, so that they again use an absolute timeout value. (Ref# 22877)

sysctl, npm-tcpip-v4.so, <netinet/icmp_var.h>

The TCP/IP stack would always respond to the ICMP timestamp request. You can now turn this feature off with the sysctl utility or the sysctl() function. The object to control this is net.inet.icmp.tstamprepl; the default is 1 (on). (Ref# 23329)

sysctl, npm-tcpip-v4.so, <netinet/in.h>, <netinet/ip_var.h>

The TCP/IP stack by default uses sequential IP header IDs. You can now enable random IP header IDs, by using the sysctl utility or the sysctl() function. The object to control this is net.inet.ip.random_id; the default is 0 (off). (Ref# 23328)

fs-cifs

• When using fs-cifs, pread() no causes the file pointer to be changed. This had the potential to corrupt binaries being launched over the CIFS network protocol when using QNX Neutrino Core OS 6.3.2. (Ref# 38575)
• fs-cifs no longer faults if an empty password ("") is passed on the command line. (Ref# 27957)
• fs-cifs no longer faults when you use a password longer than 32 characters. (Ref# 24252)
• If you're using fs-cifs to rename a file in the same directory, while changing only the case of letters in the filename (e.g. file to FILE) and the server is Windows, the file is no longer deleted. (Ref# 23706)
• By default, if the CIFS server can't be reached, or isn't responding, it could take a long period of time before an application fails, as TCP timeouts would be applied. We've added a new -o timeout=num_seconds option that lets you specify the timeout to apply. This is applied to all server-blocking operations (e.g. mount, open(), read(), write(), and so on). Note that you could always use a signal to unblock the application. (Ref# 23115)
• fs-cifs now supports more modern dialects. This improves compatibility with later Windows OS releases. This results in improvements in the accuracy of file time status, and quicker mounting of Windows shared directories. (Ref# 38233)
• When using fs-cifs on PPCBE targets, fs-cifs formerly could return an unexpected errno back to applications that were trying to connect to resource-manager processes, but resolve the manager pathname via the CIFS mountpoint rather than the manager process if that process wasn't running. This could occur if the fs-cifs mountpoint is /, and the application is trying to resolve a pathname under /dev. For example, devc-pty might not have launched properly if the power manager weren't running, because fs-cifs returned an errno other than EBADF. This has been fixed. (Ref# 25447)
• If there had been a successful mount of a share, and then the share was umounted, subsequent mounts of that same share would succeed, even if the user and password credentials specified were incorrect or missing. This has been fixed. (Ref# 27151)
• The stat() times of a file accessed over the network using fs-cifs on a PPC target are now correctly decoded. (Ref# 22726)
• When fs-cifs has a connection to the network server, and the server is rebooted, or some kind of temporary network failure occurs, fs-cifs tries to reestablish the connection and resume the operation it might have been doing. If that operation is a readdir(), fs-cifs no longer loses its place in the directory. It formerly could have returned duplicate entries, or missed entries. (Ref# 23729)
• fs-cifs now implements the file access modes O_APPEND and O_TRUNC correctly. It formerly could potentially result in file corruption. (Ref# 38567)
• If fs-cifs failed to authenticate with the server using an encrypted password, it would then attempt to authenticate with the server using an older method while sending the password unencrypted. This behavior has been changed to only send the password encrypted, unless you specify the option -o plainpwd. You might need the -o plainpwd option when mounting shares on older versions of Windows. (Ref# 39865)

  The new password options are as follows:

  -o plainpwd

  If logging in with an encrypted password fails, try to log in by using the password unencrypted.

  ---

  Sending passwords in plain text may be considered a security problem.

  ---

  -o showpwd

  Show the plain-text password in the log file.

  ---

  Adding the password to the log file may be a security problem if unauthorized personal have access to the log file.

  ---

fs-nfs3

• fs-nfs3 no longer (depending on the server implementation) causes an application calling readdir() for a NFS-mounted directory to loop forever. The call to readdir() never returned NULL; instead, it started at the first directory entry again. This has been fixed. (Ref# 23092)
• Using the -w size=num and -w number=num options to change the size of the cache for asynchronous write operations no longer causes internal cache corruption. (Ref# 25186, 20810)

  ---

  These options aren't documented yet; for a description, see “Known issues: Network protocols,” below.

  ---

• The usage message now correctly says that the -s option, which specifies to use a soft mount, is a mountpoint option, not a global option. (Ref# 23381)
• fs-nfs3 now supports values greater than 8096 for the -B option. (Ref# 20810)
• If you're using fs-nfs3 with asynchronous writes, and the server is using root-squashing (i.e. it maps root to anonymous or nobody), you can now create directories and files correctly. (Ref# 25113)

fs-nfs2, fs-nfs3

• NFS requests always have a unique identifier (xid) value. If a NFS server stops responding (for example because of a temporary network failure) fs-nfs2 and fs-nfs3 try to remount the server and resend the request. We've found that some servers refuse to reply to a request if the request's xid hasn't been changed after a remount, which is against the NFS specification. We've added an -x option to work around this problem; it causes the client to change the xid of the request after a remount. (Ref# 25402)
• When you mount and unmount a NFS mountpoint repeatedly for hundreds of iterations, there's no longer a potential for a resource to be unreleased, causing all further mount attempts to fail. There's still a timeout period that must expire before mounts can continue. Unless you're doing this operation in a loop, you aren't likely to encounter this timeout. (Ref# 15078)
• fs-nfs2 and fs-nfs3 are no longer vulnerable to improperly formatted RPC packets (e.g. those generated by a reconfigured NFS server for which the client had established a mountpoint). (Ref# 21480)
• When you now call mkdir() with a pathname, if a symbolic link already exists with that pathname, mkdir fails with the errno value EEXIST; mkdir() previously resolved the link. (Ref# 19213)
• In some cases, fs-nfs2 and fs-nfs3 wouldn't treat a TCP connection as a stream, and would expect that the entire packet should be returned with a read(). This would cause false failures, and fs-nfs2 and fs-nfs3 would remount the NFS server more times than necessary. We've fixed this. (Ref# 8873)
• A link pathname that ends in a slash is no longer treated as a link rather than the directory it points to. For example, readlink() now returns an error instead of data for a path that ends in /. (Ref# 19209)
• If you specify O_EXCL and O_CREAT for open(), and the path names a symbolic link, open() now correctly fails and sets errno to EEXIST. (Ref# 19210)
• mkfifo() now fails with EEXIST if the path names a symbolic link. (Ref# 19212)
• When deleting a directory, fs-nfs2 and fs-nfs3 would incorrectly attempt to use a file operation first, and then a directory operation. This made some NFS servers stop communicating with fs-nfs2 or fs-nfs3. We've fixed both client filesystems to use only a directory operation. (Ref# 38671, 38672)

fs-cifs, fs-nfs2, fs-nfs3

The usage message now correctly states that you don't need to specify a server-export/mountpoint combination on the command line when you launch fs-cifs, fs-nfs2, or fs-nfs3. You can invoke the mount command later to add mountpoints. (Ref #15446)

nfsd

• If the export in the /etc/exports file is a link to another directory, showmount now correctly displays the link pathname instead of the target pathname. (Ref# 26149)
• nfsd previously became permanently blocked on a FIFO if a Neutrino NFS client attempted to create and use one. It now supports FIFOs as described in the NFS version 3 specification. The Neutrino fs-nfs2 and fs-nfs3 NFS clients don't currently support FIFO special files. (Ref# 11098)

  ---

  When using nfsd, be careful about what files are exported. If you don't have specific control over the NFS client and what files are accessed by the client, you shouldn't export directories that contain nonregular files (e.g. /dev). If these files don't have regular file semantics, nfsd may have unexpected behavior, such as becoming permanently blocked on the manager that owns the pathname.

  ---

• nfsd no longer faults if it accesses a directory pathname that's longer than 256 characters to service a NFS version 2 request. (Ref# 38441)

What's new: Photon

Image loading

Fixed an error when loading png files, which occasionally would cause SIGSEGVs.

Helpviewer

Changed the helpviewer to allow matching of whole words when searching inside documents.

Photon File Manager

The Photon File Manager now has a new addition to its preferences dialog that lets you select a filename-encoding scheme. This feature allows PFM to properly display filenames that aren't encoded in valid UTF8. For details, see the pfm entry in the Utilities Reference.

Photon Library (libph.so)

• Removed compilation type problem for PdSetTargetDevice().
• Fixed a bug where a non-editable combobox wouldn't give focus to the list when clicked.

PxConfig* API

The new API has been reworked to lift some of the restrictions of the old API. The old API can hold only one config file open at a time, seriously limiting its practicality (particularly for use in a library).

All existing PxConfig* calls (from pre-6.3) continue to be supported in the form of macro wrappers around the new API.

---

You need to recompile your applications if you're moving to 6.3 — we encourage you to migrate to the new API, particularly for new projects. But apps that worked with the old API should continue to work with the new.

---

For details on the new API, see the PxConfig* entries in the Photon Library Reference.

Voyager and IDE docs

If your connection configuration includes a proxy server, remember to add the following in the Proxy Overrides field in the Connection tab (Edit-->Preferences):

127.0.0.1, localhost

This will allow the IDE's help system to locate the files it needs.

Application Builder

Fixed an error when PhAB builds and tries to run phabbind.

Shelf (Launch menu)

• The Launch menu was changed to use the /etc/photon/launchmenu directory structure to generate the launch menu. For details, see the chapter Using the Photon microGUI in the Neutrino User's Guide.
• Added a “launch in terminal” toggle to the launcher plugin.

phfont

The design architecture has evolved from 6.2.x. Under 6.2.x, io-graphics was able to load the font server into its own data segment in order to speed up rendering services. This interface has been taken to a new level, through libfont, by allowing several system configurations:

1. An external font server and a client font instance within io-graphics.

   Benefit:

   Increased speed.

   Cons:

   Increase in memory footprint. Although io-graphics instantiates a client font instance, it can use greatly reduced resources, since it isn't concerned with other application requests.

2. A server font instance within io-graphics. This is the same behavior as 6.2.x. If an external font server isn't started, io-graphics will attempt to start a server font instance.

   Benefits:

   Good speed; middle memory footprint.

   Cons:

   Slower than option 1, since the graphics driver may have to wait for an outside client font request to complete.

3. An external font server only.

   Benefit:

   Minimal memory footprint

   Cons:

   Slowest option

Client applications may also load a private client font instance, resulting in maximum speed when making font requests. Please read the new documentation for phfont, fontadmin, and libfont (Font Library Functions, specifically Pf*Dll() API calls).

Under the 6.3 architecture, rendering plugins are utilized by phfont. These DLLs are located in /lib/dll/font. Each rendering DLL has an embedded use message; just type use dllname.

The following binaries are no longer required:

• phfontphf
• phfontpfr
• phfontFF
• phfontFA.

Please read the documentation on phfont for further details. Options for the DLLs are set via the fontopts file; see the docs on fontadmin for further details.

Due to the new library (libfont), when linking against a static libph you must also link against libfont.

embed_font

You can use this script to copy all the font system binaries and libraries to a target build image. Usage is simple:

embed_font target_root_directory

fontopt is now fontopts

The fontopt configuration file is now deprecated and no longer used. Use the fontopts file instead. See the docs for phfont and fontadmin for further details.

fontview

The fontview program is a font-viewer application that can display glyphs from any font format supported by phfont, without having to install the font file. For more information, see the usage message (type use fontview from a pterm).

The fontview utility uses the same rendering plugins as phfont.

mkfontdir

This utility now uses the same rendering plugins as phfont to process index files.

io-graphics

• Now has a new command-line format; supports configuration file, and multi-headed display.
• The io-graphics initialization sequence no longer breaks some graphics drivers, such as devg-smi7xx. (Ref# 24084)
• The io-graphics server no longer locks up Amanda PCI, MGT5200 and other boards. (Ref# 25861)
• io-graphics now supports the following wide-screen video modes:
  • WXGA (1280x800)
  • WXGA+ (1440x900)
  • WSXGA+ (1680x1050)
  • WUXGA (1920x1200)

  These are the standard display sizes for laptops with wide screens. (Ref# 25744)

TrueType fonts

We fixed a problem where PhAB for Windows wouldn't recognize and render user-supplied TrueType fonts. (Ref# 19865)

To install a TrueType font:

1. Use the Windows Control Panel to install the font.
2. Add the .ttf file to the following directory:

   %QNX_TARGET%\usr\photon\font_repository directory

3. Run mkfontdir so that the font appears in the font index file (fontdir).

Pg*() functions

Most Pg*() functions have Cx* versions, which are context-specific.

---

Since the Pg*() versions are implemented as macros based on their *Cx() counterparts, they no longer have symbols in the new libraries; you'll need to recompile your code if you use these functions. The macros are defined in the <PhProto.h> public header file.

---

New window frames

The window frames have been updated with a new look and new decorations. You can revert to the 6.2-style window frames by moving or removing /usr/photon/dll/winframe_updated.so.

You can have the new window frames on the desktop and have the old window frames in PhAB by launching PhAB with the -D option (ab -D) or with any other style of window frame by using the -F framestyle option.

Photon hook

You can pull in and execute a block of user code during the initialization of Photon applications. For details, see the widget styles section of the Managing Widgets in Application Code chapter of the Photon Programmer's Guide.

Photon clipboard

The Photon clipboard has been enhanced with added security. You can no longer get access to another user's clipboard files, unless you're running as root. Clipboard files are no longer compatible between 6.3.0 and previous releases. This also means that Photon applications built against libph.so.2 can't share the clipboard with Photon applications built against libph.so.3.

Note also that in 6.3, you're no longer limited to 64 KB when you cut and paste text. The limit is now your system RAM.

Clipboard Changed Event

Starting in 6.3.0, clipboard changes cause a new event to be emitted. The event will be a Ph_EV_INFO, with a subtype of Ph_CLIPBOARD_CHANGED. The data associated with the event will contain the input group number and the “clip type” string, so that the listener can call PhClipboardRead() to paste the data just copied. The old region changed event has been deprecated, but for now will still be emitted when the clipboard changes.

Multimedia

• New MIDI parser and configuration-file documentation.
• The dvdplayer is removed from the old Multimedia library.

phlogin

The default login application is now phlogin2, which provides a user icon that you can select to log in. If you remove phlogin2 from the path, phlogin (the original GUI login from 6.2) is used automatically.

savercfg

• There's now support for power-saving modes and enhanced password protection.
• Format of the config file has changed, but the new savercfg/saver are able to read both old and new formats.
• The new savercfg writes only the new format, so the old format will be lost once you change your settings. The transition is essentially transparent from the user's point of view, but anyone sharing their homedir between 6.3/6.2.x platforms should be aware of this.

PtExit()

This function no longer causes individual threads to exit. See the docs for details.

Pt_CB_NUMERIC_CHANGED

If the PtNumericInteger and PtNumericFloat widgets have the Pt_CALLBACKS_ACTIVE bit set in the Pt_ARG_FLAGS resource, these callbacks are also invoked when your application changes the Pt_ARG_NUMERIC_VALUE with a call to PtSetResource() or PtSetResources(), or if the Pt_ARG_NUMERIC_VALUE is changed indirectly by a change to Pt_ARG_NUMERIC_MIN or Pt_ARG_NUMERIC_MAX.

Screensavers

On machines running the QNX Neutrino Core OS 6.3.2, if a screensaver is configured to require a password, and you press Cancel at the screensaver's password prompt, the screensaver no longer exits. (Ref #38266)

Security

New versions of the following files fix some security vulnerabilities in Photon reported by iDefense.com:

• target/qnx6/armle/usr/lib/libAp.a
• target/qnx6/armle/usr/lib/libph.so.3
• target/qnx6/armle/usr/lib/libApS.a
• target/qnx6/armle/usr/lib/libph.a
• target/qnx6/armle/usr/lib/libphS.a
• target/qnx6/armle/usr/lib/libAp.so.3
• target/qnx6/armle/usr/photon/bin/fontsleuth
• target/qnx6/mipsle/usr/lib/libAp.a
• target/qnx6/mipsle/usr/lib/libph.so.3
• target/qnx6/mipsle/usr/lib/libApS.a
• target/qnx6/mipsle/usr/lib/libph.a
• target/qnx6/mipsle/usr/lib/libphS.a
• target/qnx6/mipsle/usr/lib/libAp.so.3
• target/qnx6/mipsle/usr/photon/bin/fontsleuth
• target/qnx6/ppcbe/usr/lib/libAp.a
• target/qnx6/ppcbe/usr/lib/libph.so.3
• target/qnx6/ppcbe/usr/lib/libApS.a
• target/qnx6/ppcbe/usr/lib/libph.a
• target/qnx6/ppcbe/usr/lib/libphS.a
• target/qnx6/ppcbe/usr/lib/libAp.so.3
• target/qnx6/ppcbe/usr/photon/bin/fontsleuth
• target/qnx6/shle/usr/lib/libAp.a
• target/qnx6/shle/usr/lib/libph.so.3
• target/qnx6/shle/usr/lib/libApS.a
• target/qnx6/shle/usr/lib/libph.a
• target/qnx6/shle/usr/lib/libphS.a
• target/qnx6/shle/usr/lib/libAp.so.3
• target/qnx6/shle/usr/photon/bin/fontsleuth
• target/qnx6/x86/usr/lib/libAp.a
• target/qnx6/x86/usr/lib/libApS.a
• target/qnx6/x86/usr/lib/libph.so.3
• target/qnx6/x86/usr/lib/libph.a
• target/qnx6/x86/usr/lib/libphS.a
• target/qnx6/x86/usr/lib/libAp.so.3
• target/qnx6/x86/usr/photon/bin/fontsleuth

This change fixes these issues:

• Local exploitation of a format string vulnerability in the fontsleuth command allows attackers to gain root privileges — iDefense Security Advisory 02.07.06. (Ref #29447)
• Local exploitation of a stack-based buffer overflow vulnerability libAp allows local attackers to gain root privileges — iDefense Security Advisory 02.07.06. (Ref #28807)
• Local exploitation of a stack-based buffer overflow vulnerability in libph allows local attackers to gain root privileges — iDefense Security Advisory 02.07.06. (Ref #29448)

What's new: Windows-specific

We now provide two shells:

• Bash shell (bash.exe)
• Korn shell (ksh.exe)

You'll find these executables under ${QNX_HOST}/usr/bin (e.g. C:\QNX630\host\win32\x86\usr\bin). You may want to create desktop shortcuts for these or other executables you'll use often.

What's new: Documentation

---

Service Pack 3 includes the latest documentation, including the Documentation Update 1.0.0. Don't install the Documentation Update 1.0.0 after installing Service Pack 3, or your system's documentation will be in an inconsistent state.

---

• We've developed a Neutrino User's Guide covering a broad range of topics to help users as well as system administrators work with a Neutrino system.
• We've added a description of the various commit levels to the documentation for io-blk.so in the Utilities Reference.
• We've added entries to the Utilities Reference for gcov, gprof, mksbp, and qde. (Ref# 17542)
• We've removed PtColorPalette from the Photon Widget Reference.
• We've deprecated PtTerminalFont() from the Photon Widget Reference.
• We've added PtTerminalFontInfo() to the Photon Widget Reference.
• We've added the cursor structure file description to the Photon Library Reference.
• We've made changes the new Pg*Cx() functions in the Photon Library Reference.
• We've added PgDefaultAlpha() and PgDefaultChroma() to the Photon Library Reference.
• We've updated the Working with BSPs chapter of the Building Embedded Systems guide to describe how to work with the new simplified packaging of Board Support Packages. (Ref# 38711)

Experimental items

---

Experimental software is primarily provided for customers and the community to try out, and perhaps to get a glimpse of what might be in store for the future. For information about the use of experimental software, see the Commercial Software License Agreement (CSLA) or Partner Software License Agreement (PSLA) in the Licensing area of our website, http://www.qnx.com/legal/licensing/.

---

The experimental items in QNX SDP 6.3.0 are:

• asynchronous messaging

Known issues

QNX Momentics 6.3.0 SP3 contains known issues in these areas:

• Booting
• BSPs, DDKs, and TDKs
• Compiler and tools
• Core OS: Kernel ¦ Libraries and header files ¦ Core utilities
• Device drivers: Audio (deva-*) ¦ Block-oriented (devb-*) ¦ Graphics (devg-*) ¦ Human interface devices (devh-*) ¦ Network (devn-*) ¦ USB (devu-*)
• Filesystems
• IDE (Professional Edition only)
• I/O devices
• Licensing
• Multimedia
• Network protocols
• Photon
• Utilities
• Host-specific: QNX Neutrino self-hosted ¦ Windows hosts ¦ Solaris hosts

---

We're actively investigating all known issues.

---

Known issues: Booting

• The combination of F1 and F4 for diskboot (Safe Mode, Don't mount filesystems) doesn't work. (Ref# 21876)

  Workaround: Press F5 to start the debug shell; it simply starts fesh just after mounting the filesystems. If you want to run a consistency check a filesystem, run /sbin/chkfsys after the shell starts.

• The graphics enumerator on x86 systems doesn't detect the Fujitsu Coral-PA reference card. (Ref# 25057)

  Workaround: Edit your /etc/system/enum/graphics enumerator file, search for Coral-P, and add the following line:

  device(pci, ven=10cf, dev=201e)           # Fujitsu Coral-PA
    

  The Coral-PA card will be enumerated when you reboot the system.

  The Coral cards don't support text mode, so on x86 systems, you need two video cards: one to use in text mode, and the Coral card.

• QNX Neutrino might not boot on machines with an ICH6 chipset with the hard drive on SATA, and a CD drive on EIDE. The OS detects the SATA device and then hangs on EIDE detection. (Ref# 40446)

  Workaround: We've added a new -R command-line option to diskboot and a new “Hit space...” option, F3. Using these prevents diskboot from restarting a devb- driver. The drivers are restarted if only a CD-ROM is found. In the case of this issue, the restart means devb-ahci and devb-eide compete for the same bus, which results in a hang.

• The printed 6.3.0 Service Pack 3 Installation Guide says that the configuration file for updating the disk drivers must be called drvrupdate.cfg, but it must actually be called drivers.cfg. (Ref# 40994)
• The boot image for self-hosted Neutrino systems now starts io-hid and devc-con-hid, which support PS2, USB, and all other human-interface devices, instead of devc-con. The documentation doesn't describe devc-con-hid, and the Neutrino User's Guide still says that diskboot starts devc-con. The command-line options for devc-con-hid and devc-con are similar. (Ref# 41834)
• Some Sony VAIO laptops don't assign an interrupt to a USB device; when you're booting Neutrino, you'll see some “InterruptAttachEvent failed” messages. (Ref# 41237)

  Workaround: Contact Technical Support to get a customized utility that enables the interrupts.

Known issues: BSPs, DDKs, and TDKs

• Don't use a BSP with SP1, SP2, or SP3 unless the BSP's release notes state that you should. Please contact us for more information.
• On Neutrino hosts, running the default uninstall script uninstalls both the binary and source BSP packages. (Ref# 18894)
• SH4 binaries linked with QNX Neutrino 6.2.1 or earlier generate an “illegal instruction” error on exiting when you run them on SH4A targets. Renesas changed the nop opcode between SH4 and SH4A, and some of our process-initialization files (inserted at link time) used the old form. This was fixed in QNX Neutrino 6.3.0. (Ref# 24701)

  Workaround: Relink any SH4 binaries that you linked with QNX Neutrino 6.2.1 or earlier.

• When you install a BSP or TDK on a self-hosted system, some binaries overwrite system binaries; if you install more than one BSP or TDK, it might overwrite binaries installed by another BSP or TDK. For more information, see the release notes for the BSPs and TDKs. (Ref# 25958)
• packagebsp:
  • In the shiplist files, you can't add comments to the end of a line. For example, this won't work:

    /binaries/content/file  #this is a test
      

    We do allow comments that take up an entire line, like this:

    #################
    #Binary shiplist#
    #################
    
    #/binaries/content/foo
    /binaries/content/foo2
    #end of shiplist
      

    (Ref# 29371)

  • On Windows, packagebsp prints extra newline characters when you run it with bash. (Ref# 38457)
  • Some of the options to packagebsp are in pairs; one might specify the root directory of an optional component, while another specifies the shiplist. If you specify only one of these options, packagebsp doesn't add the optional component. Instead, it should give an error message and then exit. (Ref# 38366)
  • The packagebsp script should log its complete output (both regular and error messages) to a file that you can inspect later. (Ref# 30048)
  • packagebsp doesn't make sure that you have enough disk space available in the temporary directory or the destination directory. (Ref# 29968)
• setupbsp:
  • On Windows, don't use a DOS-style relative path for the installation directory, or an error will occur during installation. For example, C:installdir is a DOS-style relative path (note there isn't a backslash after the C:). The path should always start with C:\, C:/, or /. (Ref# 38654)
  • The uninstaller that setupbsp creates removes the files that are listed in the shiplist, but leaves behind files added since you installed the BSP. (Ref# 38490)
  • If you specify the -v option for verbose output, setupbsp should send some of the output to stderr as well as to stdout. (Ref# 38453)
  • You can use setupbsp multiple to set up a BSP in different working directories, but the uninstaller that setupbsp creates removes the only instance of the documentation for the BSP the first time that you run it; it should remove the documentation only when you uninstall the last instance of the BSP. (Ref# 38363)
  • setupbsp doesn't check to make sure you have enough disk space available before setting up the BSP. (Ref# 38249)
  • The uninstaller that setupbsp creates doesn't remove any directories. (Ref# 38241)

Known issues: Compiler and tools

gcc

• If you're using gcc 3.3.5 with the deprecated GNU libstdc++ library, cout/cin doesn't work on SH targets. Use the Dinkum C++ library instead.
• MIPS C++ support with gcc 3.3.5 works only with the Dinkumware NO_EXCEPTION libraries. Anything else will generate a SIGILL error.
• On MIPS, code that uses exceptions in shared libraries generates a SIGILL or other signal. Exceptions work as expected in static libraries and executables. (Ref# 23355)
• There's an alignment issue with gcc 2.95.3, where an __attribute__((__aligned__(N))) applied to a typedef also applies that alignment to the base type. (Ref# 18662)

  For example, the following code applies an alignment of 8 to both my_long_long_t and the long long:

  typedef long long my_long_long_t __attribute__((__aligned__(8)));

  Workaround: Make a duplicate typedef of a dummy type:

  typedef long long my_dummy_t;
  typedef my_dummy_t my_long_long_t __attribute__((__aligned__(8)));

• Nested functions (i.e. one function declared inside another) aren't standard C or C++, and they can cause problems on SH and PPC platforms. We recommend that you not use GNU extensions to ANSI C; for more information, see “Extensions to the C Language Family” in the gcc documentation at www.gnu.org.
• With gcc 2.95.x and 3.x, C++ shared objects can optionally use __cxa_atexit(), which allows their destructors (normally registered with atexit()) to be called at dlclose() time. This feature isn't yet supported; as a result, you can't use dlopen() and dlclose() on C++ shared objects. (Ref# 19702)

  Workaround: Add the following to your C++ shared library:

  #include <dlfcn.h>
  
  /*
  * stick around for atexit(dtors)
  * add to common.mk:
  * CCFLAGS += -DSONAME_STR=\"$(notdir $(FULLNAME)$(VERSION_TAG_$(BUILD_TYPE)))\"
  */
  
  extern void hackslash(void) __attribute__((constructor));
  
  void hackslash(void) {
    dlopen(SONAME_STR,RTLD_NOW);
  }
      

• On most platforms, the gcc 3.3.5 options -fpic and -fPIC are synonymous, but on PPC they're different and incompatible. We chose -fpic over -fPIC for performance reasons, and our PPC OS is built that way. (Ref# 21947)

  Workaround: If you see problems (such as relocation-truncation errors) at link time when building shared objects, consider splitting your shared object into multiple shared objects.

• When you're compiling with gcc 3.3.5 for MIPS, you might get this error:

  relocation truncated to fit: R_MIPS_GPREL16
    

  (Ref# 22822)

  Workaround: Pass the -Wac,-G4 option to qcc.

• gcc 2.95.3 ignores #pragma pack() directives for global structures on the ARM platform. For example, the structure in this code is still padded to 8 bytes instead of the expected 5:

  #pragma pack(1)
  struct five {
      unsigned char a;
      unsigned b;
  };
  
  struct five five;

  (Ref# 5151)

  Workaround: This problem doesn't affect code generated with gcc 3.3.5.

• Both gcc 2.95.3 and 3.3.5 report parsing errors for seemingly simple code. (Ref# 20409)

  Workaround: See “Parse errors for simple code” in gcc.gnu.org/bugs.html#known.

• If you use the -Os option with gcc 3.3.5 to optimize for size, you might get some compile errors. This issue will be fixed in gcc 3.4. (Ref# 19955, 21347).

gdb

• Watchpoints don't work on the Freescale 8540ADS and Lite5200 platforms. (Ref# 21293)
• Black-box regression tests for watchpoints fail for ARM targets. It appears that the watchpoint isn't correctly set. (Ref# 25599)
• If you have two breakpoints exactly one instruction apart, the second breakpoint won't stop the debugger. (Ref# 20833)

  Workaround: Disable breakpoints in code that you're single-stepping through.

• gdb may display a “Compiled with unknown debugging format” warning when debugging binaries compiled with gcc 3.3.5. This doesn't seem to affect the debugger in any way. (Ref# 20658)
• If you run gdb over phditto, gdb hangs, because the Photon server spawned by phrelay inherits phrelay's set of ignored signals including SIGUSR1, which gdb relies on. (Ref# 24817)

  Workaround: Launch pterm windows using pwm's Desktop Menu (press Alt-Enter or right-click on the desktop background) instead of using the Terminal button on the shelf. Only pterm windows started by shelf inherit the ignored SIGUSR1.

  Another option is to write a wrapper around gdb to reset SIGUSR1.

• On SH4 targets, gdb sometimes displays “finish meaningless on outermost frame” when trying to step out of a DLL if stop-on-solib-events is on. (Ref# 21502)

  Workaround: Disable stop-on-solib-events, or download the newer version of gdb from our website; log into your myQNX account, then go to Prerelease Software-->Trial Software-->Trial Software - QNX Momentics 6.3.x-->GDB 6.2.1 Experimental Release in the Download Center.

• If you reset your target board while you're debugging from the Windows-hosted IDE, and you've clicked Terminate and remove in the IDE Debug view, the ntoCPU-gdb.exe process may run ready, consuming 100% of CPU. (Ref# 25174)

  Workaround: There is no workaround (other than not following this sequence of events). If gdb does run ready, you must terminate it from the Windows Task Manager. This problem will be fixed in a future version of gdb; you can get an experimental version from the Download Center on our website; look under Prerelease Software-->Trial Software-->Trial Software - QNX Momentics 6.3.x.

ld

• Between the 2.10.1 version of the GNU linker in QNX Momentics 6.2.1 and the 2.12.1 version in QNX Momentics 6.3.0, a bug was fixed in the handling of relocation addends for SH targets. As a result of this fix, SH startup binaries (e.g. startup-systemh) that were created prior to QNX Momentics 6.3.0 won't work correctly if included in a boot image generated in QNX Momentics 6.3.0.

  Workaround: Rebuild the startup binary using QNX Momentics 6.3.0. The resulting startup will work with both 6.2.1 and 6.3.0.

• Version 2.12.1 of ld produces bad R_386_NONE relocations if you're using gcc 2.95.3 and C++ to build shared objects. (Ref# 20433)

  Workaround: SP3 also includes version 2.10.1, and the qcc configuration files have been set up to use the older linker only if you're using gcc 2.95.3 and C++ to build shared objects.

make

• The Windows version of make doesn't work with UNC paths, such as //some_machine/dir. (Ref# 24202)

  Workaround: Use drive-letter mountpoints instead.

• Our recursive makefiles use the value of the NAME environment variable (if set) to name the resulting binary. We realized (too late) that this was too generic a variable to use for this purpose; if you have a NAME environment variable set on your system for some other purpose (e.g. your name or email address), its value will be used as the name of your binaries. We apologize for this mix-up. (Ref# 29843)

  Workaround: Unset the NAME environment variable before you build any executables.

qcc

• In order to use gcc 3.3.5's support for the PPC Altivec extensions, add this option:

  -I $QNX_HOST/usr/lib/gcc-lib/powerpc-unknown-nto-qnx6.3.0/3.3.5/include
    

  to the qcc command line. This tells qcc where to find the <altivec.h> header file. GCC doesn't need this workaround, as it knows to search its own include directories. (Ref# 26109)

• We're deprecating the -M option as of QNX Momentics 6.3.0. In 6.4, qcc will use -M for generating Makefile dependencies. (Ref# 26693)

qcp

The qcp utility works only on x86 platforms. (Ref# 9500)

usemsg

If you use usemsg to add versioning information or a usage message to a binary that has had a stack size set with the -N option to qcc, sometimes the stack-size modification is lost. (Ref# 25103)

Workaround: Pass the -l option to usemsg.

Windows-specific

• The IDE and tools suffer from performance problems when installed on a Windows workstation with Novell client software. The problem also affects all Cygwin applications. (Ref# 21730)
• Because of recent changes to the Cygwin library, you can't use COM1 as the port name for serial debugging under Windows. Instead, you must use /dev/com1.
• The usemsg.exe utility might not be able to find the required files. (Ref# 21881)

  Workaround: Make sure the QNX Momentics Cygwin is in your PATH before the “real” Cygwin, or delete the Cygwin make.

Known issues: Core OS

Kernel

procnto

• Specifying the -as option to procnto on SH platforms is the same as specifying -ad, not -ae as stated in the Utilities Reference. (Ref# 22858)
• Physical memory fragmentation can occur when a lot of threads are created and remain alive for a period of time before most of them are destroyed. This fragmentation might cause problem for device drivers that need physical, contiguous memory (passing the MAP_PHYS flag to mmap()) for DMA and other device-related operations.

  This problem doesn't affect normal memory allocation, such as that using malloc(). When physical, contiguous allocations fail, malloc() and other normal memory-allocation operations still work. Also, this problem describes a situation when it isn't possible to allocate 4 MB physical, contiguous memory in a system that has 64 MB RAM. It may still be possible to allocate small chunks of physical, contiguous memory. As most device drivers need only small chunks of physical, contiguous memory (e.g. 32 KB), this problem may not be a concern for them either.

  When creating a thread, the OS kernel uses _smalloc() to allocate memory for various internal data structures called objects. When the thread is destroyed, the kernel releases the memory to a pool of free objects for reuse the next time an object is needed. When a free-object pool reaches a certain size, the OS releases objects directly back into a kernel memory pool that only the kernel uses. The kernel does not return the memory to the free pool of general memory that all the processes in the system use. Physical memory can get fragmented when kernel holds on pages of memory here and there; eventually large (4 MB and greater) physical, contiguous allocations could start to fail. (Ref# 16405)

  Workaround: Reserve enough physical contiguous memory before hand to make sure it's always available when needed.

• The 74xx series PPCs with a 60x bus (not MBX) don't support 16-byte bus transactions. This limitation can cause unexpected alignment exceptions when using Altivec instructions to/from uncached memory regions. Symptomatic of this issue, passing messages to or from uncached memory regions can result in a kernel crash, due to the 60x bus limitation. (Ref# 14878)

  Workarounds:

  • Don't pass messages to or from uncached memory regions.
  • Disable the PPC_CPU_ALTIVEC feature flag in startup-* code to avoid using Altivec instructions in a message pass. (This also means that the OS won't save and restore the Altivec register set on a context switch.)
• On Broadcom MIPS BCM1250 and BCM1125 chips, the startup program doesn't add cache callouts for the onboard L2 cache. This causes msync() operations that attempt to flush the cache not to force the data all the way to main memory. This isn't normally a problem, because the L2 cache uses a bus-snooping protocol and maintains consistency with the main memory anyway. You might have problems if you have the same region of memory mapped both with and without the PROT_NOCACHE attribute. (Ref# 21855)
• Programs that you execute in place (XIP) in an image filesystem (IFS) on PPC targets might randomly crash in rare cases.

  PPC targets have separate caches for data and instructions. If the IFS is copied (or decompressed) when the data cache is enabled, the startup needs to flush the data cache. The kernel maps in the code or data segment directly from IFS for XIP; if the cache isn't flushed, the instruction cache may be loaded incorrectly, because it's loaded from the underlying memory directly, which may be different from the contents in the data cache.

  As the first-level data cache size is relatively small, the chance of running into this problem is low. We haven't seen any such crash in our kernel regression tests, and we aren't aware of any problem report from customers or internal sources which may be related to this problem. (Ref# 24783)

  Workaround: If you aren't using a mini-driver, you can add the following code segment to the startup program startup/lib/ppc/cpu_startnext.c to flush the data cache for IFS areas:

  void cpu_startnext(uintptr_t eip, unsigned cpu) {
  
      unsigned start, size, vaddr, dcache_linesize;
     
      /* First, flush the cache for ifs so that kernel can load executables
         from it without problems.
      */
  
      dcache_linesize = 1 << ppcv->cache_lsize;
      start = shdr->image_paddr + shdr->startup_size;
      vaddr = start & ~(dcache_linesize - 1);
      size = shdr->imagefs_size + (start - vaddr);
   
      for( ;; ) {
          icache_flush(vaddr);
          if(size <= dcache_linesize) break;
          vaddr += dcache_linesize;
          size -= dcache_linesize;
  }
      

  If you're using a mini-driver, please contact us for a fix.

• When you're debugging an application on a system that's using floating point emulation (i.e. you passed -fe to procnto), attempts to step over floating point instructions cause the system to hang. (Ref# 26049)

  Workaround: Don't use floating point emulation, or don't step over floating point instructions (use a run-to-breakpoint instead).

procnto-smp

• If you use pipelines or setpgid() on a termination process, procnto-smp can become deadlocked. You have to reboot your machine to recover. (Ref# 23481)
• When using floating point emulation on MIPS processors, internal filesystem sanity tests have resulted in SIGILL exceptions. This problem doesn't occur if you use a hardware floating point unit. (Ref# 25206)
• An internal test of terminal access control fails on x86 SMP. (Ref# 24948)
• A test of mutexes on an SMP x86 platform case may cause a reboot. The test case in question produces a high degree of resource contention in order to test the reliability of the mutual-exclusion mechanisms within the OS. It does this by creating several resources with multiple threads per resource, each contending for that resource. On a four-way SMP x86 system, this test case has caused, on rare occasions, the system to unexpectedly reboot. At the time of the reported failure, there were 11 resources and 79 competing threads per resource. (Ref# 24938)

mq

If you use the instrumented kernel to trace events while you're using mq, emitting _NTO_TRACE_COMM_SMSG communication-class events might cause your application to crash with an EFAULT when it calls mq_send(). We've encountered this problem on SHLE boards. (Ref# 38082)

Workaround: Filter out the _NTO_TRACE_COMM_SMSG events by doing one of the following:

• On the command line, filter out all COMM-class messages by passing the -F6 option to tracelogger.
• In your application, filter out COMM_SMSG messages by calling:

  TraceEvent( _NTO_TRACE_DELEVENT, _NTO_TRACE_COMM, _NTO_TRACE_COMM_SMSG);
      

• In the IDE, filter out COMM_SMSG messages with qconn by selecting the Class Specific mode in the System Profiler Configuration dialog, then selecting the Communication tab, selecting the Event Specific mode, and then disabling Send Message.

The side effect of filtering out these events is that the IDE's System Profiler won't be able to show you any message-passing.

Time zones

The USA is changing its time zone rules, effective 2007, enacted as part of the Energy Policy Act of 2005. While the standard rule will change across all states, US states will still have the right to choose not to observe it, per the Uniform Time Act of 1966.

This has ramifications not just for self-hosted QNX Momentics installations; the effects of this change on in-use runtime systems also needs to be considered. For example:

• The default values you use for DST may need to be changed for the USA locales (/etc/timezone/uc_tz_t, /etc/TIMEZONE).
• Specific rules that determine the time zone in any applications that deal with localization will need to be changed.

(Ref# 40378)

Libraries and header files

Bessel functions

According to POSIX 1003.1, the Bessel functions — j0(), j1(), jn(), y0(), y1(), and yn() — should be declared in <math.h>. They currently aren't declared in any header, but the functions are in libbessel.a and libbessel.so. (Ref# 23554)

Workaround: Declare them in your program; for the correct prototypes, see the entries for these functions in the Neutrino Library Reference.

asctime(), ctime(), gmtime(), and localtime()

These functions return a time in one of two static buffers (either a tm structure or an array of type char). Calling any of these functions can change the data in both these buffers. The documentation needs to make this clear. (Ref# 24716; Ticket ID 69174)

calloc_ram()

The prototype for this startup-library function is incorrect in the Customizing Image Startup Programs chapter of Building Embedded Systems. (Ref# 23448)

The prototype should be:

paddr32_t calloc_ram (size_t size,
                      unsigned align)

chroot()

The entry for this function in the Neutrino Library Reference incorrectly states that the effective user ID of the process must be the superuser to change the root directory. (Ref# 22761)

ELF64_R_INFO()

The definition of this macro is incorrect in <sys/elf.h>. It uses Elf32_Xword() instead of the Elf64_Xword() macro. (Ref# 40936)

Workaround: Edit the header file and change this line:

#define ELF64_R_INFO(s,t)	((((Elf32_Xword)(s))<<32) | ((Elf64_Xword)((t)&0xffffffff)))
  

to this:

#define ELF64_R_INFO(s,t)	((((Elf64_Xword)(s))<<32) | ((Elf64_Xword)((t)&0xffffffff)))
  

ENDIAN_*()

If the <cpuinline.h> file for a given processor family doesn't contain an implementation for __cpu_endian_ret*(), an application reverts to an implementation of the ENDIAN_*() macros defined in <gulliver.h>, which may have unintended side effects when used on device memory. Since the value is read multiple times, multibyte register devices that have clear-on-read behavior generate erroneous values. The implementation also isn't optimal, in that the memory location may be read several times. (Ref# 22140)

FILE* I/O functions

If a FILE* stream is placed into unbuffered mode (so theoretically all writes should physically happen immediately and any failures be detected), the low-level functions correctly indicate the errors, but the FILE*-oriented output functions (fwrite(), fprintf(), etc.) don't propagate these errors back as their return values. For example, if there's no space left on the disk, these functions don't indicate that an error has occurred. (Ref# 19598)

Workaround: Use the file-descriptor I/O functions instead, or call ferror() to check for errors after each call to fwrite(), fprintf(), and so on.

fork()

• Physically contiguous areas aren't preserved across a fork(). If one process does a mmap() with MAP_ANON|MAP_PHYS to obtain a physically contiguous memory (drivers and the like), and then forks, the child process (which is supposed to be a duplicate of the parent) actually doesn't enforce contiguous areas when copying the parent's mappings. (Ref# 17531)
• If you do a mmap() with MAP_ANON|MAP_SHARED with permissions of PROT_NONE, and use mprotect() to change a single page to PROT_READ|PROT_WRITE, and then fork(), the permissions of the MAP_ANON|MAP_SHARED mapping are not set per-page, but are reset to the default when the mmap() was first done, PROT_NONE. (Ref# 24585)

  Workaround: In the parent process, set the appropriate permissions when you create the mapping, or in the child process, use mprotect() to explicitly establish the mapping's protection attributes.

• In extremely limited cases, it's possible that a call to fork() may fail and set errno to EINTR. This issue is limited to only x86, PowerPC, and SH architectures and usually occurs only when stacks have dynamically allocated all backing store (e.g. a 512 KB stack has 512 KB memory allocated) through heavy stack usage followed by a call to fork(). (Ref# 18408)

getgrouplist()

The list of groups that this function creates still includes the group ID that you pass as the basegid argument. Typically, you pass the group number from the password file for this argument. (Ref# 15547)

ham_action_fail_notify_pulse(), ham_action_fail_notify_pulse_node(), ham_action_fail_notify_signal(), ham_action_fail_notify_signal_node()

The prototypes for these functions are incorrect in the High Availability Toolkit Developer's Guide, and the names of ham_action_fail_notify_pulse_node() and ham_action_fail_notify_signal_node() are wrong. These functions all return an int. (Ref# 26253)

libc

The following functions are included in libc.a, but not in libc.so (to save space), but the documentation doesn't mention this. (Ref# 26866)

• alphasort()
• brk()
• cfgopen()
• crypt()
• encrypt()
• entutent()
• fcfgopen()
• forkpty()
• ftw(), ftw64()
• getgrouplist()
• getlogin(), getlogin_r()
• getpass()
• getutent()
• getutid()
• getutline()
• getwd()
• getw()
• globfree()
• glob()
• hwi_find_item()
• hwi_find_tag()
• hwi_next_item()
• hwi_next_tag()
• hwi_off2tag()
• hwi_tag2off()
• initstate()
• inputline()
• intr_capture()
• intr_lock()
• intr_release()
• intr_timed_wait()
• intr_unlock()
• intr_wait()
• login_tty()
• modem_open()
• modem_read()
• modem_script()
• modem_write()
• nftw(), nftw64()
• openpty()
• pclose()
• popen()
• pututline()
• putw()
• qnx_crypt()
• random()
• rdchk()
• re_comp()
• re_exec()
• regcomp()
• regerror()
• regexec()
• regfree()
• sbrk()
• _scalloc()
• scandir()
• sched_get_priority_adjust()
• setkey()
• setstate()
• setutent()
• _sfree()
• slogb()
• slogf()
• slogi()
• _smalloc()
• srandom()
• _srealloc()
• utmpname()
• vslogf()
• wordexp()
• wordfree()

libmalloc

• When using libmalloc_g, if you enable MALLOC_FILLAREA and MALLOC_CKCHAIN and do too many heap over- or underruns, then your process may fault. This occurs because the underruns and overruns may corrupt the metadata associated with heap allocations. Once the heap is corrupted, the reliability of the checking is also compromised. This is described in the section on libmalloc_g in the Neutrino Programmer's Guide. (Ref# 24428, 23322)
• The libmalloc implementation of string.c may corrupt the heap on PPC targets. (Ref# 24394)
• An internal string.c test case fails for the libmalloc string implementation. The libmalloc implementation of strcmp() and strncmp() incorrectly compares the two strings based on the difference between the characters treated as signed values instead of the difference between the characters treated as unsigned values. (Ref# 24369)
• mprobe() sometimes causes the caller to fault. (Ref# 24423)
• The libmalloc macro DH_ULEN() always returns 0 because of a bug in the definitions in the header files. If MALLOC_GUARD is undefined, DH_ULEN() is defined to be 0 in <malloc_g/malloc-lib.h>. If your code also includes <malloc_g/malloc.h>, the file explicitly undefines MALLOC_GUARD before including <malloc_g/malloc-lib.h>, resulting in the DH_ULEN() value of 0. (Ref# 24454)

  Workaround: Include <malloc_g/malloc.h> after <malloc_g/malloc-lib.h>, as follows:

  #define MALLOC_DEBUG
  #define MALLOC_GUARD
  #define MALLOC_PC
  #include <malloc_g/malloc-lib.h>
  
  ... other includes/code that depends on MALLOC_GUARD ...
  
  #include <malloc_g/malloc.h>
      

• Memory traces may incorrectly show that allocations made before main() are associated not with a particular function, but possibly with a variable name. (Ref# 19486)
• When you're using the libmalloc library, stack information for memory events is implemented only for x86, PPC, and SH4 architectures. The result is that line-number information and call traces aren't available for display when memory events occur on other architectures. This is a feature deficiency and will be corrected in a future release. The offset within the function where the event occurred is provided. (Ref# 12611)
• The libmalloc backtrace information is missing for architectures other than x86, PPC and SH4. This will be implemented in future release. (Ref# 25393)

MsgSend(), memcpy()

A regression test fails for PROT_NOCACHE memory. (Ref# 24709, 21505)

name_attach()

In QNX Momentics 6.2.1B, the name_attach() server side never had to handle any _IO_* messages, but could set an error code of ENOSYS for them all. In 6.3.0, an _IO_CONNECT message is sent when the client does a name_open(); if the server doesn't reply with an EOK, the client fails to connect to the server. This message is needed in the remote case to force the establishment of the network link, and to determine that the server is actually there. (Ref# 20507)

Workaround: Add code to the server to handle this message. For an example, see the online documentation for name_attach() in the Neutrino Library Reference.

pipe()

• When there are multiple writers to a pipe and the O_NONBLOCK flag is clear, a write of less than PIPE_BUF bytes into a full pipe could cause loss of data in the particular write even though the write returns with no error. (Ref# 20220)
• When there are multiple readers and writers to a pipe, and reader/writer processes terminate repeatedly, the pipe manager may fault. (Ref# 20128)

pthread_cond_timedwait(), pthread_cond_wait()

The documentation for these functions should include the following (Ref# 27051):

If a thread that's blocked on a condition variable is canceled, the thread reacquires the mutex that's guarding the condition variable, so that the thread's cleanup handlers run in the same state as the critical code before and after the call to this function. If some other thread owns the lock, the canceled thread blocks until the mutex is available.

---

Make sure that the thread's cleanup handlers unlock the mutex.

---

RPC Library (librpc.so, librpc.so.2, librpc.a, librpcS.a)

If all available memory is exhausted, the RPC library can potentially fault if a malloc() call fails during the first execution of either a clnt_broadcast() call or a rpc_broadcast() call. Memory corruption may occur if all thread-specific data keys are exhausted before the RPC library functions have been called. (Ref# 21945)

spawn()

On ARM targets with low-memory conditions, attempts to create a new process may result in an EINTR error instead of ENOMEM as might be expected. This happens when, during process creation, attempts to fault in the stack result in an out-of-memory condition, at which point a SIGBUS is delivered to the process, causing it to return EINTR. If the out-of-memory condition is detected before the stack is allocated, ENOMEM is returned. (Ref# 24406)

<stdio.h>

A duplicate declaration of vsnprintf() causes compile warnings. (Ref# 21880)

sysconf()

The value that sysconf( _SC_OPEN_MAX ) returns might not be correct if you've used the -F option to procnto to change the maximum number of file descriptors per process. (Ref# 16966)

tempnam()

The entry for tempnam() in the Neutrino Library Reference doesn't accurately describe how the function determines the directory portion of the temporary file's name. (Ref# 27332)

Workaround: See the entry for tmpnam(); this function and and tempnam() use the same method for determining the directory.

---

The tempnam() function's behavior doesn't conform to POSIX.

---

vfork()

Internal testing causes a kernel crash on x86, ARM, and PPC platforms. (Ref# 24952)

Core utilities

mkefs, mkefts, and mkifs

The documentation for these utilities incorrectly says that if you specify a perms attribute of * for a file, the host file's permissions are used, and that for an inline file, the permissions are obtained from the umask of the user running mkefs. The actual permissions used are 0666. (Ref# 22371)

mkefs

Under Windows, if you redirect the output from mkefs to a file, the end-of-line characters will be DOS-style (CR, LF) instead of UNIX-style (CR). (Ref# 19065)

Workaround: Under Windows, use this syntax:

mkefs buildfile outputfile
  

instead of redirecting the output:

mkefs buildfile > outputfile
  

mkifs

• Executables compiled with the -Nstacksize option and then included in images built using mkifs don't (by default) use the stacksize parameter. (Ref# 23573)

  Workaround: Specify [+raw] in the build file for any executables that you compiled with the -Nstacksize option. For more information about the raw attribute, see the entry for mkifs in the Utilities Reference.

• The documentation for mkifs doesn't describe the difference between the raw.boot and binary.boot bootfiles. (Ref# 39923)

  Workaround: Here are descriptions:

  raw.boot

  Create a binary image with an instruction sequence prepended to it to jump to the offset of startup_vaddr within the startup header. The advantage is that when you download a raw image to memory using a bootloader, you can then instruct it to run right at the beginning of the image, rather than having to figure out what the actual startup_vaddr is each time you modify the startup code.

  binary.boot

  Create a simple binary image without the jump instruction. If you build a binary image, and you want to load it with U-Boot (or some other bootloader), you have to execute mkifs -vvvv buildfile imagefile, so that you can see what the actual entry address is, and then pass that entry address to the bootloader when you start the image. If you modify the startup code, the entry address may change, so you have to obtain it every time. With a raw image, you can just have the bootloader jump to the same address that you downloaded the image to.

QNX_HOST, QNX_TARGET

The development environment variables (QNX_HOST, QNX_TARGET, etc.) aren't set if you have a login shell other than the default (sh). This environment is picked up automatically from /etc/profile.d/qnxsdk.sh but if SHELL is set to ksh, then /etc/profile looks for *.ksh in the directory instead of *.sh and finds nothing. (Ref# 24660)

Workaround: Copy /etc/profile.d/qnxsdk.sh to /etc/profile.d/qnxsdk.ksh.

rtc

To enable reading from the RTC on a machine with a ServerWorks chipset on it (observed on a SuperMicro SuperServer 8060), you must first set the OS date and then set the RTC from the OS date:

# date 200607191700
Wed Jul 19 17:00:01 EDT 2006
# rtc -s hw
  

(Ref# 26324)

startup-bios

• Don't use the -x option on machines that don't support extended addressing, or else pci-bios won't start. (Ref# 40404)
• The -I option isn't described in the documentation. (Ref# 24418)

  Workaround: Here's the description:

  -I irq

  Make irq the highest-priority hardware interrupt in the system. You can specify a number from 0 through 7 (the default is 3).

tracelogger, traceprinter

• In the previous version of tracelogger, if you specified a duration for the log (with the -s option), then the number of iterations logged was unlimited. With the new version, the number of iterations logged is left at the default, 32. (Ref# 26823)

  Workaround: If you're using the -s option, add the -n0 option.

• The entries for tracelogger and traceprinter in the Utilities Reference are out-of-date. (Ref# 26514)

  Workaround: See the System Analysis Toolkit User's Guide for the correct documentation.

• We've seen some kernel crashes when running regression tests using tracelogger and the procnto-800-instr instrumented kernel on Motorola RPX Lite boards. We haven't been able to reproduce these crashes outside the regression environment; they might be caused by memory exhaustion. (Ref# 26507)

  Workaround: Be cautious when running tracelogger on procnto-800-instr kernels under low-memory conditions.

Known issues: Device drivers

Audio device drivers (deva-*)

• The graphics drivers run at a higher priority than applications, but they shouldn't run at a higher priority than the audio, or else breaks in the audio occur. (Ref# 4026)

  Workaround: Use the on command to adjust the priorities of the audio and graphics drivers.

Block-oriented drivers (devb-*)

devb-*

High-priority threads can get starved off by lower ones via devb-* because the filesystem uses sleepon_*() functions, which don't inherit priorities. (Ref# 2109)

devb-adpu320

Reading DVD-RAM causes devb-adpu320 to become blocked on a CONDVAR. (Ref# 19772)

devb-doc, devb-doc3, dformat, dformat3

The Disk On Chip drivers were provided by the vendor. If you run use -i on them, the state is given as Experimental. (Ref# 23101)

devb-aha8

You can't restart this driver on IBM PPC405 boards. (Ref# 16018)

devb-ncr8

This driver supports the NCR53c810, NCR53c815, NCR53c820, NCR53c825, NCR53c860, NCR53c875, NCR53c885, NCR53c895, and NCR53c896 PCI SCSI adapters. The list in the documentation is incomplete. (Ref# 22482)

devb-umass

The documentation and usage message say to use the devnn option to specify the USB address of the device. The correct name of the option is devno. (Ref# 24347)

devb-eide

DMA modes don't work on these drives:

• Hitachi-LG Data Storage DVD WRITABLE/CD-RW DRIVE, ROM VER.E111, May 2006
• Toshiba Samsung Storage Technology TS-H352C/DELH, DE02, May 2006

(Ref# 41600)

Graphics drivers (devg-*)

• The following drivers are shipped only with the appropriate BSPs:
  • devg-pxa250.so
  • devg-q2sd.so
  • devg-rpxlite.so
  • devg-sa1110.so

  but their entries in the Utilities Reference don't say so. (Ref# 18023)

• Starting Photon with multiple cards fails after running crttrap trap. When running crttrap trap, devg-vesabios.so will put the secondary card in a bad state, causing devg-radeon.so to fail to initialize (Ref. #39511).

  Workaround: Do the following:

  • Boot into text mode.
  • Run crttrap trap.
  • Configure the system to start both cards.
  • Reboot before starting Photon.

  After this, you should be able to start and stop Photon on both cards properly.

  You'll need to follow the steps above only if you run crttrap trap again.

• All graphics drivers hang while trapping on (discontinued) Abit IS-20 (865GV) motherboards because of an issue in the BIOS. (Ref# 39626)

  Workaround: Use the onboard graphics controller instead. If you set the onboard display as the primary controller, any installed PCI graphics cards will still be detected / trapped.

• The planar YUV overlay format doesn't work properly in the devg-radeon.so driver. (Ref# 29014)
• If you have more than 512 MB of system RAM, the devg-radeon.so driver won't work. (Ref# 29339)

  Workaround: Reduce the system RAM to 512 MB or use the devg-vesabios.so graphics driver.

• The devg-radeon.so driver doesn't work properly on ViewSonic VP2030b monitors; none of the resolutions work. (Ref# 41905)

  Workaround: Use the devg-vesabios.so graphics driver instead.

Human interface device drivers (devh-*)

• If you press several keys at once on some Microsoft keyboards, the keyboard doesn't produce any indication when you release the keys. As a result, the input driver thinks you're still holding the keys down. For more information, see http://support.microsoft.com/kb/909528/en-us. (Ref# 40611)
• Autorepeat doesn't currently work on ViewSonic 10191 USB keyboards. (Ref# 41118)
• Pressing the space bar on a ViewSonic 10191 USB keyboard when the system displays the “Press space bar to input boot options” message doesn't work. You get the menu only after the EIDE enumeration is done.

  If you also have a Microsoft USB mouse connected, you get a “devh-usb.so - Unable to attach to USB device 1 (10)” message. (Ref# 41122)

Network drivers (devn-*)

devn-asix.so

This driver doesn't support the 1000 MB/s interface of the Linksys Gigabit USB Adapter (model no. USB1000). (Ref# 38115)

Workaround: Force the driver to use speed and duplex settings that it supports (10 and 100 Mbit/s).

devn-i82544.so

• If you use more than 64 Tx descriptors, the PPC version of the driver is inoperative. (Ref #22848)

  Workaround: We've temporarily changed the PPC version of this driver to use 64 Tx descriptors by default (on other targets, the default is 128). This may result in lost packets for high-throughput transmit operations.

• There appear to be endian issues with the devn-i82544.so driver on PPC; the following values are reported incorrectly (Ref# 22854):
  • hardware checksumming: netstat -p event counts
  • nicinfo Tx/Rx packet counts.

devn-ne2000

The documentation for devn-ne2000 now includes the did, pci, and vid options, but the usage message hasn't been updated. (Ref# 20914)

devn-pcnet.so

• This driver doesn't support Fiber PCNET cards with the AM79C971KC chip. (Ref# 12497)
• We don't recommended that you use devn-pcnet.so on the BCM1250 platform, because it can lose receive interrupts. (Ref# 29714)

devn-pegasus.so, devn-rtl8150.so

Slaying io-net with the devn-pegasus.so and devn-rtl8150.so drivers isn't always successful. (Ref# 28602)

Workaround: Use kill -9 instead to kill io-net.

devn-rtl8150.so

• On the SH platform, the lan= option gets overridden. (Ref# 29285)

  Workaround: Fully specify the vendor ID, device ID, bus number, and device number to the driver when starting (e.g. vid=0x0bda,did=0x8150,busnum=1,devnum=2,lan=2).

• Multicast and promiscuous modes for the rtl8150 driver aren't currently supported. (Ref# 29352)

devn-smc9000

Not all IPv6 multicast protocols function properly with this driver. (Ref# 21720)

devn-tigon3.so

This network driver on the Dell PowerEdge 850 board will run only up to 100 Mbit/s, and not 1000 Mbit/s. Other boards work well at 1000 Mbit/s. (Ref# 39355)

USB drivers (devu-*)

• The PCI-USBNEC101-5P-1 controller card won't allow at least the following boards to boot: SystemH, EDOSK7780, BCM1x80. (Ref# 29496)

Known issues: Filesystems

• The fs-pkg filesystem isn't designed to let you use chmod or chown on “virtual” fs-pkg directories. (Ref# 9552)
• The documentation doesn't describe how you can change the order of resolution for filesystems that are mounted at the same mountpoint. (Ref# 38426)

  Workaround: Here's the description:

  Generally the order of resolving a filename is the order in which you mounted the filesystems at the same mountpoint (i.e. new mounts go on top of or in front of any existing ones). You can specify the order of resolution when you mount the filesystem. For example, you can use:

  • the before and after keywords for block I/O (devb-*) drivers, in the blk options
  • the -Z b and -Z a options to fs-cifs, fs-nfs2, and fs-nfs3

  You can also use the -o option to mount with these keywords:

  before

  Mount the filesystem so that it's resolved before any other filesystems mounted at the same pathname (in other words, it's placed in front of any existing mount). When you access a file, the system looks on this filesystem first.

  after

  Mount the filesystem so that it's resolved after any other filesystems mounted at the same pathname (in other words, it's placed behind any existing mounts). When you access a file, the system looks on this filesystem last, and only if the file wasn't found on any other filesystems.

  If you specify the appropriate before option, the filesystem floats in front of any other filesystems mounted at the same mountpoint, except those that you later mount with before. If you specify after, the filesystem goes behind any any other filesystems mounted at the same mountpoint, except those that are already mounted with after. So, the search order for these filesystems is:

  1. those mounted with before
  2. those mounted with no flags
  3. those mounted with after

  with each list searched in order of mount requests. The first server to claim the name gets it. You would typically use after to have a filesystem wait at the back and pick up things the no one else is handling, and before to make sure a filesystems looks first at filenames.

Known issues: IDE (Professional Edition only)

• For MIPS only, the dietitian can't shrink the socket library because the library exports symbols that should be resolved in the C library. This problem (Ref# 12394) was fixed on all platforms except MIPS. (Ref# 15986)
• If you check out an existing PhAB project from CVS, the IDE starts PhAB before checking the project out. PhAB creates some directories, and then the CVS checkout says that the files already exist. After telling the IDE to replace the files with the ones from CVS, PhAB still thinks that it's the old set of widgets (empty project).

  Workaround: To check out projects from CVS, use Check out Project, and then convert the projects; don't use Check out as..., which generates invalid configurations. (Ref# 18405)

• The IDE has problems when projects are located in a remote (network drive) directory, and the network isn't reachable. (Ref# 11719)

  Workaround: Close any project that you created on a remote drive before disconnecting the drive.

• The IDE incorrectly lets you choose the Intel C Compiler (icc) for non-x86 targets such as PowerPC or MIPS. (Ref# 22636)

  Workaround: Build only x86 variants with ICC.

• The System Profiler in the IDE requires a minimum color depth of 16 bits. Otherwise, the timelines might appear to be blank. (Ref# 23763)
• Opening a PhAB 6.2.1 project in the 6.3 IDE or PhAB converts it to a 6.3 project, which then won't run correctly if compiled for a 6.2.1 target. (Ref# 24298)

  Workaround: If you're using the coexistence feature in the IDE to target Neutrino 6.2.1, you should set the IDE to open the 6.2.1 version of PhAB. To do this, change the Path to Photon Appbuilder setting on the Appbuilder preferences dialog (Window-->Preferences-->QNX-->Appbuilder).

• If you have a source file that contains some classes, and you open them in the Open Type Hierarchy view, then make some changes in the source file (e.g. moving a class into or out of a namespace), save the changes, make sure the indexer kicks in, and then reopen the same class in the Hierarchy view from the Outline view, an error message pops up, and a null-pointer exception is generated. The view becomes unusable. (Ref# 24999)

  Workaround: Restart the IDE.

• The Application Profiler can attribute CPU time to the wrong line if you're profiling code that has profiling and debugging information, and that you linked against a static library that doesn't have profiling and debugging information. (Ref# 21024)

  Workaround: Build everything with debugging information, or use -gdwarf-2 instead of -gstabs with gcc 2.95.3.

• In the Debugger, the this pointer is listed twice in the Debug Variables view. This is a benign error. (Ref# 20063)

  Workaround: If you compile with gcc 3.3.5, the second entry doesn't appear.

• If you set the Save automatically before build option for a project, and you change one of the project's files, the file is saved if the project is selected in the tree, but not if the file is selected. This is a bug in Eclipse 3.0; see https://bugs.eclipse.org/bugs/show_bug.cgi?id=75063. (Ref# 25866)
• If you select a number of lines in the C/C++ editor, and then press Tab, the editor corrupts the whole file. (Ref# 25864)
• Assigning a hotkey to the Rebuild Project action has no effect (the hotkey doesn't work). This is a bug in Eclipse 3.0; see https://bugs.eclipse.org/bugs/show_bug.cgi?id=99193. (Ref# 25616)
• When using Memory Analysis for ARMLE, ARMBE, MIPSLE, MIPSBE, and SHLE targets, libmalloc sometimes has difficulty tracing back to the call site of a function. As a result, the source files for function calls aren't always shown in the Memory Analysis perspective. There is no workaround at this time. (Ref# 26035, 25938, 26100)
• The Application Profiler's sampling information shows “unknown” function names for MIPSLE and MIPSBE targets. There is no workaround at this time. (Ref# 24510, 25938)
• Code coverage doesn't work well for C++ code if you use gcc 2.95.3; the output includes unusual characters and function names. (Ref# 26592)

  Workaround: Use gcc 3.3.x instead of 2.95.3.

• The IDE doesn't correctly parse compiler errors from gcc 3.3.5. (Ref# 19221)

  Workaround: Add -fmessage-length=0 to the qcc or gcc command-line options.

• Working in the System Profiler's timeline editor can cause problems with focus and mouse-tracking in the rest of the IDE. (Ref# 20538)
• The IDE's System Information perspective doesn't properly update the progress view while it's refreshing data. (Ref# 21021)
• The C++ Class Browser is currently experimental. (Ref# 369)
• The IDE User's Guide doesn't explain how to import an SP3 project into an older version of the IDE. (Ref# 26985)

  Workaround: Here's how to do it:

  1. Back up your existing 6.3.0 SP3 workspace.
  2. Delete the .cdtproject and .project files from the project you wish to import.
  3. Import the project into your workspace in the older version of the IDE.
• The System Profiler can take a very long time to load and parse a .kev file that was generated by a target system that's running Neutrino 6.3.0 SP1. The parsing is much faster for .kev files from an SP2 system. (Ref# 27221)
• In the System Builder, if you choose Combine images and then uncheck Final Processing, the IDE still does the final processing. (Ref# 27082)
• In a System Builder project, if you select an image, type a large value such as 0x8c0c0000 in the Offset field in the Properties-->Combine section, and then press Enter, the IDE restores the previous value. (Ref# 27954)
• If you check a project out from CVS by using the New Project wizard, and you choose only one CPU with both debug and release versions, then when the wizard is done, the debug variant is always unchecked for SH, PPC and x86. In addition, a message pops up while the project is being checked out, saying “The file has been changed on the file system, do you want to load the changes?” but it doesn't say which file has been changed. (Ref# 25422, Eclipse ref# 102659)
• If you don't have a web browser in any of the directories listed in your PATH variable, you can't display the documentation in the IDE. (Ref# 29580)

  Workaround: Specify a browser for the IDE to use, by choosing Window-->Preferences, and then choosing Help from the list on the left side of the dialog. In the right part of the dialog, select Custom Browser and fill in the path to the browser below.

• The 6.3.0 SP2 version of the Quickstart Guide: 10 Steps to Your First QNX Program is also applicable to 6.3.0 SP3. (Ref# 41691)

Linux-hosted IDE

• SP3 doesn't include the Motif plugin. $QNX_HOST/usr/qde/eclipse/libXm.so and $QNX_HOST/usr/qde/eclipse/libXm.so.2 are broken symbolic links. (Ref# 40059)
• Under Linux with GTK, if you work extensively in the IDE (e.g. switching in and out of debugging) for a few hours (four hours on average), you get a JVM termination with the following at the top of the resultant hs_err_pidxxxx.log file:

  An unexpected exception has been detected in native code outside the VM.

  This is because of a memory leak in Eclipse; we've submitted a problem report to eclipse.org. (Ref# 22396)

  Workaround: Upgrade your system to Red Hat Enterprise; the VM and GTK on it are more stable.

• If you start the IDE on Linux Fedora Core 4 (a version of Linux that we don't officially support), you'll see this message:

  Starting QNX Development Environment
  /opt/qnx630/host/linux/x86/usr/qde/eclipse/eclipse: error while loading 
  shared libraries: /opt/qnx630/host/linux/x86/usr/qde/eclipse/libXm.so.2: 
  cannot restore segment prot after reloc: Permission denied
    

  This message is caused by selinux (secure Linux). (Ref# 26579)

  Workaround: Install an upgrade of selinux:

  yum install selinux-policy-targeted
    

• The IDE uses Mozilla, which isn't installed by default on Enterprise WS 4, to display the documentation. You need to change this to firefox; in the IDE, choose Windows-->Preferences-->Help and change the Custom Browser Command from mozilla %1 to firefox %1. (Ref# 26891)
• On Linux hosts, the IDE's System Builder doesn't properly determine the local host ID, so the tftp server doesn't work. (Ref# 23668)

  Workaround: Use the ifconfig utility to get the host's IP address.

• If your serial device is something like /dev/ttyUSB0, the Terminal 1 view of the System Builder might display the message Device Not Specified. The dialog gives you a way to specify the speed, parity, etc., but no way to specify the serial device to use.

  Workaround: Start the IDE like this:

  qde -vmargs -Dos.name=Linux-all-ports
    

Neutrino-hosted IDE

• The New Project wizard lets you use special characters in the project name, but make won't build such a project. (Ref# 24441, 24531)

  Workaround: Don't use spaces or the following characters in a project name:

  | ! $ ( " ) & ` : ; \ '
  * ? [ ] # ~ = % < > { }
    

• The self-hosted IDE gives the following warning:

  Warning: Could not get charToByteConverterClass!
    

  This warning is generated because we are using a non-SUN VM. This is the explanation from Aonix:

  The charToByteConverterClass is an internal sun.io class that the org.apache.xml.serializer.Encodings tries to access with a Class.forName(). Of course, this won't work on any non-Sun Java VM. The exception is caught and a default converter is used instead (after printing the warning message you see).

  You can ignore the warning. (Ref# 25851)

Solaris-hosted IDE

• If you're using the IDE, make sure you have the appropriate patch installed to run the Java 2 SE 1.4.2 VM under Solaris. You can download the patch from java.sun.com:

  http://java.sun.com/j2se/1.4.2/download.html

• The IDE uses Mozilla, which isn't installed by default, to display the to display the documentation and generate reports for code coverage. You need to change this to hotjava; in the IDE, choose Windows-->Preferences-->Help and change the Custom Browser Command from mozilla %1 to hotjava %1.

Windows-hosted IDE

• The IDE won't launch on Windows NT hosts, because NT doesn't include usp10.dll, the DLL for the Uniscribe Unicode script processor. (Ref# 24713)

  Workaround: Download the Windows 98 version of usp10.dll from support.microsoft.com/kb/q249973.

• On Windows XP, if you're logged in as a system administrator the first time you start the IDE, this user owns the configuration files, so other users won't be able to access them. (Ref# 24881)

  Workaround: Log in as the system administrator and delete the subdirectories in the $QNX_HOST/usr/qde/eclipse/configuration directory. Then log in as a nonadministrator and start the IDE.

• If you reset your target board while you're debugging from the Windows-hosted IDE, and you've clicked Terminate and remove in the IDE Debug view, the ntoCPU-gdb.exe process may run ready, consuming 100% of CPU. (Ref# 25174)

  Workaround: There is no workaround (other than not following this sequence of events). If gdb does run ready, you must terminate it from the Windows Task Manager. This problem will be fixed in a future version of gdb; you can get an experimental version from the Download Center on our website; look under Prerelease Software-->Trial Software-->Trial Software - QNX Momentics 6.3.x.

Known issues: I/O devices

io-blk

io-blk doesn't automount removable media after the device has been manually unmounted. (Ref# 38394)

Workaround: Instead of manually unmounting the device, use the sync command (see the Utilities Reference) to make sure that the filesystem cache contents have been flushed, and then remove the device without unmounting it.

If the device has been manually unmounted, manually mounting it and then removing and reinserting the device allows automount to function as before.

io-usb

• In some cases when unmounting DLLs and running the usb utility at the same time, some memory allocated by io-usb isn't freed. This is a rare situation. (Ref# 21716)
• The io-usb server crashes if you repeatedly mount and umount and plug and unplug devices attached to the port. (Ref# 21556)
• io-usb might crash with a SIGSEGV when you shut down the system and you don't have any USB devices inserted. (Ref# 29495)

Known issues: Licensing

• If a disk is full (on any host) when you execute QNX Momentics-licensed components, you might not get a meaningful message to alert you of the problem. Instead, you may be requested to type in your license key (but doing so doesn't rectify the issue). Check your disk and free up some space if necessary. We'll provide a clearer message in a future release. (Ref# 21116)

Known issues: Multimedia

soundfile.so, soundfile_noph.so

Loading these legacy plugins causes a SIGBUS error. (Ref# 21707)

Workaround: Use the -ae option to procnto to enable alignment fault emulation.

Multimedia TDK 1.0.1

If you install the Multimedia TDK 1.0.1 after installing SP3, some files will be incompatible with SP3. (Ref# 39359)

Workaround: Do the following:

1. Before you install the Multimedia TDK 1.0.1, back up the files listed below for for these targets:
   • $QNX_TARGET/armle
   • $QNX_TARGET/mipsle
   • $QNX_TARGET/ppcbe
   • $QNX_TARGET/shle
   • $QNX_TARGET/x86
2. If you're on a self-hosted Neutrino system, also back up the versions of the files under /.
3. Install the Multimedia TDK 1.0.1.
4. Restore the files from the backup you made.

Here's the list of files that you need to back up before installing the TDK and restore afterward:

• usr/lib/mmedia/libaif_parser.a
• usr/lib/mmedia/libau_parser.a
• usr/lib/mmedia/libaudio_writer.a
• usr/lib/mmedia/libavi_parser.a
• usr/lib/mmedia/libcdda_reader.a
• usr/lib/mmedia/libff_mpegv_decoder.a
• usr/lib/mmedia/libfildes_streamer.a
• usr/lib/mmedia/libhttp_streamer.a
• usr/lib/mmedia/libiff_parser.a
• usr/lib/mmedia/libmidi_parser.a
• usr/lib/mmedia/libogg_decoder.a
• usr/lib/mmedia/liboggi_decoder.a
• usr/lib/mmedia/librawfile_writer.a
• usr/lib/mmedia/libstream_reader.a
• usr/lib/mmedia/libwav_parser.a
• usr/lib/mmedia/libwavfile_writer.a
• usr/lib/mmedia/libwindow_writer.a
• lib/dll/mmedia/aif_parser.so
• lib/dll/mmedia/au_parser.so
• lib/dll/mmedia/audio_writer.so
• lib/dll/mmedia/avi_parser.so
• lib/dll/mmedia/cdda_reader.so
• lib/dll/mmedia/ff_mpegv_decoder.so
• lib/dll/mmedia/fildes_streamer.so
• lib/dll/mmedia/http_streamer.so
• lib/dll/mmedia/iff_parser.so
• lib/dll/mmedia/midi_parser.so
• lib/dll/mmedia/ogg_decoder.so
• lib/dll/mmedia/oggi_decoder.so
• lib/dll/mmedia/rawfile_writer.so
• lib/dll/mmedia/stream_reader.so
• lib/dll/mmedia/wav_parser.so
• lib/dll/mmedia/wavfile_writer.so
• lib/dll/mmedia/window_writer.so
• usr/lib/libTremor.so.1
• usr/lib/libTremorS.a
• usr/lib/libaoi.so.1
• usr/lib/libaoiS.a
• usr/lib/libavcodec.so.1
• usr/lib/libavcodecS.a
• usr/lib/libmmconvenience.a
• usr/lib/libmmconvenienceS.a
• usr/lib/libmmedia.a
• usr/lib/libmmedia.so.1
• usr/lib/libmmediaS.a
• usr/lib/libmpegs.a
• usr/lib/libmpegsS.a
• usr/lib/libogg.so.1
• usr/lib/liboggS.a
• usr/lib/libvorbis.so.1
• usr/lib/libvorbisS.a
• usr/lib/libxing_audio.a
• usr/lib/libxing_audio.so.1
• usr/lib/libxing_audioS.a
• usr/photon/bin/mmplay
• usr/bin/playaudio

Known issues: Network protocols

npm-qnet.so

Redundant GNS servers have a window where service could be lost. If connectivity is lost to a gns process in server mode while it's acting as a redundant server, and while client gns processes running on other nodes are registering services, the server may become out of sync with the other redundant servers. (Ref# 20008)

npm-qnet-l4_lite.so

• This DLL has many options to alter how Qnet functions (e.g. timeouts, retries, and idle times). You shouldn't use these options unless you're trying to overcome an issue related to your environment. Qnet is optimized to function with its default settings. (Ref# 21298)
• Once Qnet has a domain, you can't set Qnet to not use a domain; you can only change the domain. (Ref# 38802)
• You can't use the Qnet “file” resolver (resolve=file option) to resolve IP addresses. It currently supports MAC addresses in combination with the option bind=en. (Ref# 38997)
• Qnet treats the _CS_DOMAIN configuration string differently if it's undefined or set to a NULL string. If it's undefined, Qnet uses a domain of .net.intra; if it's set to a NULL string, Qnet applies that as the domain (for example hostname.). (Ref# 19676)

fs-cifs

• pwrite() behavior isn't consistent with other Neutrino filesystems. If you open a file with O_APPEND, the offset supplied to pwrite() doesn't override O_APPEND. The data is written to the end of the file, regardless of the file offset supplied. (Ref# 38576)
• If you unlink() a file on a CIFS mount point, any open file descriptors for that file become invalid. (Ref# 38574)
• If you perform a socket operation on a file descriptor of a file on a fs-cifs mountpoint, the operation fails, but the errno returned might not be ENOTSOCK. (Ref# 38572)
• fs-cifs doesn't support POSIX file-locking functions. (Ref# 38570)
• fs-cifs incorrectly sets an errno of EPERM instead of EBADF if you attempt to write to a file opened as O_RDONLY or O_ACCMODE. (Ref# 38565)
• If a component of a pathname supplied to a function isn't a directory, fs-cifs should return ENOTDIR. It currently returns ENOENT. (Ref# 38564)
• fs-cifs may return a different errno when the mkdir() function call fails than those returned by the local filesystem. (Ref# 38573)
• PATH_MAX for CIFS (and thus fs-cifs) isn't 1024 as in POSIX. This is set by both Windows and the CIFS specification. The pathname length can be up to 255 characters. (Ref# 38566)

fs-nfs2

• If you attempt to access a link to a file using a pathname that ends in slash, the operation fails with an incorrect errno of EINVAL instead of ENOTDIR. (Ref# 38560)
• fs-nfs2 doesn't support files larger than 2 GB. (Ref# 39060)
• fs-nfs2 doesn't correctly implement the options -w size=n and -w number=n as described in the fs-nfs2 usage message. Don't use them. (Ref# 39031)
• If a path ends in a slash, it must be a directory. When accessing a link with a trailing slash, fs-nfs2 immediately returns EINVAL, instead of resolving the link and reporting errors such as EPERM (permission denied) or ENOTDIR (not a directory) before returning EINVAL (invalid argument). This behavior was seen as an optimization to reduce network traffic, because this kind of file access will ultimately fail. Strict POSIX behavior will be added in a future release. (Ref# 20878)
• fs-nfs2 doesn't support a -B option greater than 8096. (Ref# 39022)

fs-nfs3

• The -s option, which specifies to use a soft mount, isn't documented. (Ref# 23381)
• The -w size=num and -w number=num options aren't documented. (Ref# 23583)

  Workaround: Here's a description:

  The fs-nfs3 manager supports a write-caching feature (by default), which greatly enhances performance. This is accomplished by performing write operations locally and releasing the application, but delaying transmission of the write operation to the NFS server until a later time.

  ---

  You should disable this feature if multiple NFS clients will be accessing the same files on the NFS server, or else corruption may result because the server's file contents might be out of date compared to the cached version on each client. You can disable this feature using the -w sync=hard option.

  ---

  -w sync=hard

  Disable write caching.

  -w size=num

  The buffer size for each file, in units of 1 KB (default is 8; size = 8).

  -w number=num

  The number of buffers; each buffer can buffer one file. The default is 10, which means up to 10 files can be buffered simultaneously.

  -w delay=sec

  The data in the cache will be flushed to the server after sec seconds. The default is 2 seconds.

• fs-nfs3's exit status is always 255. (Ref# 38512)

fs-nfs2, fs-nfs3

• fs-nfs2 lets you modify the on-disk binary file of an executable that is executing. It should return an error with errno set to EBUSY. (Ref# 38563)
• If you use the mount command to mount an NFS server, and you specify the argument -o ver3 and fs-nfs3 isn't running, fs-nfs2 will accept this mount request. (Ref# 38640)
• fs-nfs2 and fs-nfs3 don't support fchdir(). (Ref# 38548)
• The NFS clients don't distinguish between a pathname ending or not ending in / when passed as the argument to mkdir(). (Ref# 38484)
• NFS is a connectionless protocol. If a server stops responding to the NFS client, it continues to try to reach the server to complete an operation until the server becomes available, or the user stops the operation. While the fs-nfs2 and fs-nfs3 clients are trying to reach the server, NFS operations are blocked until they're successful. This isn't an issue if the client is talking only to one server, but if an fs-nfs2 process has mounted multiple servers, the blocked operation also block the client's ability to talk to the other servers. (Ref# 39084)

  Workaround: Start separate client (fs-nfs2, fs-nfs3) processes for each server you wish to mount.

fs-cifs, fs-nfs2, fs-nfs3

The documentation incorrectly implies that at least one server-export/mountpoint combination is required on the command line when you launch fs-cifs, fs-nfs2, or fs-nfs3. You can invoke the mount command later to add mountpoints. (Ref #15446)

gns

• A gns daemon can't act as both a client and server at the same time. If a local service is registered with a GNS client, the client can forward that information to redundant or backup servers; a server can't forward the information. (Ref# 21037)
• Currently, GNS (name_attach()) isn't compatible with the resource manager framework. (Ref# 20062)

  Workaround: Your resource manager must handle the raw QNX messages until this is corrected.

nfsd

nfsd lets you access files only up to 16 subdirectory levels deep within the directory exported in the /etc/exports file. Deeper directory levels and files aren't accessible. (Ref# 40104)

slinger

When slinger is executing a CGI script and setting the environment variables to be passed to the script, the environment variable SERVER_ROOT is set to / instead of to the directory specified by HTTPD_SCRIPTALIAS. The actual current working directory of slinger is correct; it's just the environment variable that's wrong. (Ref# 20795)

tftp

• tftp can terminate with a floating-point exception when printing statistics from a get or put command when you're using verbose mode. (Ref# 20615)
• tftp can fault if you press Enter at the “To” prompt without supplying the host parameter. (Ref# 20064)

rpcgen

This utility looks for the C preprocessor in the wrong place on QNX Neutrino hosts. (Ref# 8461)

Workaround: Create a symbolic link:

ln -s /usr/qnx630/host/qnx6/x86/usr/bin/qcc /usr/bin/qcc
  

npm-tcpip-v4.so

• If a packet is smaller than the minimum Ethernet packet size, the packet may be padded with random data, rather than zeroes. (Ref# 21460)
• The TCP/IP stack doesn't maintain the statistics for outbound packets over VLAN interfaces. (Ref# 16684)
• The TCP/IP stack doesn't maintain the statistics for the number of input and output bytes or packets if the packets are forwarded via the fast-forward feature. (Ref# 23041)
• The TCP/IP stack doesn't maintain proper interface statistics for the link speed. (Ref# 27015)
• If the default UDP socket receive-buffer size is set near its limit (for example sysctl -w net.inet.udp.recvspace=240000), UDP-based sockets become unreliable. (Ref# 27386)

npm-tcpip-v4.so, npm-tcpip-v6.so

If a packet is smaller than the minimum Ethernet packet size, the packet may be padded with random data, rather than zeroes. (Ref# 21460)

pppd

• When pppd creates a proxy arp entry, it does this without the permanent flag, so the entry will time out after approx 20 minutes, instead of being permanently set. (Ref# 24103)
• pppd doesn't use the /etc/ppp/options.ttyname option file. (Ref# 23743)

rcp

This utility sets its user ID to root. It was reported that you can overrun the source/target file argument buffers in the utility, giving yourself root access. Under QNX Neutrino, rcp spawns the cp utility for local file-copying operations; it's the cp utility that faults. When rcp spawns cp, it does so with the credentials of the user who launched rcp, rather than root's. (Ref# 22002)

Known issues: Photon

Starting Photon

When you start Photon, you might see a “Cannot attach mouse input report (error code2)” message on the console. It's a benign message that you can ignore. (Ref# 29662)

PT_CB_ACTIVATE and PT_CB_ARM

These callbacks don't work with PtText and PtNumeric. (Ref# 21608)

Workaround: For a PtText, add this code:

int raw_text_callback( PtWidget_t *widget, void *data, PtCallbackInfo_t
*cbinfo )
{
    PtSuperClassRawEvent( PtBasic, widget, cbinfo->event );
    return Pt_CONTINUE;
}
  

When you create a PtText widget, add this code:

PtRawCallback_t text_cb = { Ph_EV_BUT_PRESS | Ph_EV_BUT_RELEASE,
  raw_text_callback };
…

PtSetArg( …, Pt_CB_RAW, &text_cb, Pt_LINK_INSERT );
… = PtCreateWidget( PtText, … );
  

You can use similar code for a PtNumeric widget.

PdGetOffscreenContextPtr()

This function leaks memory on MIPS hardware. (Ref# 8065)

ptermcs

This utility core-dumps when saving. The problem is in PxTerminalBuildCharsets(): if the “internal” charset is NULL but the “font charset” is specified, it builds a bad data structure that causes PxTerminalSaveCharsets() to crash. (Ref# 19568)

PhAB

• The template editor currently lets you delete or rename the widget template, but doesn't provide a way to restore the default value. (Ref# 21969)
• If you're using bash as your shell in Neutrino, PhAB doesn't populate the list of targets when you try to build an application. (Ref# 22850)
• Opening a PhAB 6.2.1 project in the 6.3 IDE or PhAB converts it to a 6.3 project, which then won't run correctly if compiled for a 6.2.1 target. (Ref# 24298)

  Workaround: If you're using the coexistence feature in the IDE to target Neutrino 6.2.1, you should set the IDE to open the 6.2.1 version of PhAB. To do this, change the Path to Photon Appbuilder setting on the Appbuilder preferences dialog (Window-->Preferences-->QNX-->Appbuilder).

PhAB for Windows

• If you create an application, and then build it, the Make Application window has an extra unreadable character at the end of each line. (Ref# 22190)
• If you start PhAB through the IDE on a Windows XP SP2 host, several security-alert dialogs are displayed, because the Windows XP SP2 firewall detects the background TCP/IP communication between the PhAB application and the Photon server. (Ref# 22282)

  Workaround: Configure Windows to unblock. Once you've done this, Windows won't display the security warnings when you restart PhAB.

• If you try to copy and paste something in PhAB when running it as a nonadministrator user, you get an error message:

  PhAB: Can't open: "clipboard.phab" (Permission denied).
  Please resolve the problem and re-try this operation. (No error)
      

  Thus, copying and pasting is impossible. (Ref# 39879)

  Workaround: Make sure that your HOMEDRIVE and HOMEPATH environment variables are set to point to a directory that you have permission to write into.

  PhAB for Windows uses the HOME environment variable if it's set, otherwise it internally sets HOME to HOMEDRIVE followed by HOMEPATH. If these aren't valid, then PhAB will encounter difficulties.

• You can't save a PhAB project in a path that contains spaces (e.g C:\Documents and Settings\some_user\my_phab_app). (Ref# 39883)

$HOME/.ph/phapps

Note that this file, which contains a list of the applications that you want Photon to launch automatically when it starts, must be executable. (Ref# 22196)

voyager

If you use voyager with vserver on a Malta board or any other platform that doesn't have a Floating Point Unit, voyager continually fails with a SIGFPE error when it tries to load a page. (Ref# 22404)

Workaround: Rebuild the OS image so that it uses floating-point emulation, by specifying the -fe option to procnto in the buildfile.

io-graphics

• If you don't specify a plugin, io-graphics fails. (Ref# 22489)

  Workaround: Always specify the -pphoton option (gri-photon.so is currently the only plugin available).

• If you specify the -d and -p options for io-graphics, you must put the -d option before the -p, or else io-graphics fails. (Ref# 22670)

Alpha on PPC

If you use alpha drawing functions on PPC targets, and you draw an image to a memory context and blit it to the screen, the colors are incorrect. (Ref# 21458)

Workaround: Don't use a memory context, or draw to one memory context, blit to another memory context, and then blit to the screen.

phditto

If you run gdb over phditto, gdb hangs, because the Photon server spawned by phrelay inherits phrelay's set of ignored signals including SIGUSR1, which gdb relies on. (Ref# 24817)

Workaround: Launch pterm windows using pwm's Desktop Menu (press Alt-Enter or right-click on the desktop background) instead of using the Terminal button on the shelf. Only pterm windows started by shelf inherit the ignored SIGUSR1.

Another option is to write a wrapper around gdb to reset SIGUSR1.

Pt_ARG_SCROLLBAR_WIDTH

Setting this resource for a PtList or for a compound widget that includes a PtList has no effect. (PR 20431)

Workaround: Attach the following callback to the Pt_REALIZED resource of the list widget:

int
list_realized_cb( PtWidget_t *widget, ApInfo_t *apinfo,
                  PtCallbackInfo_t *cbinfo )
{
    PtGenListWidget_t *list = (PtGenListWidget_t*)widget;
    unsigned short      *width;

    // NOTE: Use the width that the user set in PhAB.
    PtGetResource( widget, Pt_ARG_SCROLLBAR_WIDTH, &width, 0 );

    // This code sets the actual sizes of scrollbar(s).
    if( list->scrollbar )
        PtSetResource( list->scrollbar, Pt_ARG_WIDTH, *width, 0 );
    if( list->hscrollbar )
        PtSetResource( list->hscrollbar, Pt_ARG_HEIGHT, *width, 0 );

    // This is a workaround to make the list widget
    // position (anchor) the scrollbars correctly (with the new size).
    PtSetResource( widget, Pt_ARG_SCROLLBAR_WIDTH, *width - 1, 0 );
    PtSetResource( widget, Pt_ARG_SCROLLBAR_WIDTH, *width, 0 );

    return Pt_CONTINUE;
}
  

If you're using a compound widget such as a PtCombobox, use this code:

int combo_realized_cb( PtWidget_t *widget, ApInfo_t *apinfo, 
                       PtCallbackInfo_t *cbinfo )
{
 PtGenListWidget_t *list;
 PtWidget_t   *wp = widget;
 unsigned short    *width, list_width;

 // NOTE: Use the width that the user set in PhAB.
 PtGetResource( widget, Pt_ARG_CBOX_BUTTON_WIDTH, &width, 0 );

 // Find the list widget in the combo
 while( (wp = PtWidgetFamily( widget, wp )) ) {
  if( PtWidgetIsClass( wp, PtList ) ) {
   list = (PtGenListWidget_t*)wp;
   break;
  }
 }

 if( !wp )
  return Pt_CONTINUE;

 list_width = *width + 2;

 // This code sets the actual sizes of scrollbar(s).
 if( list->scrollbar )
     PtSetResource( list->scrollbar, Pt_ARG_WIDTH, list_width, 0 );
 if( list->hscrollbar )
     PtSetResource( list->hscrollbar, Pt_ARG_HEIGHT, list_width, 0 );

    // This is a workaround to make the list widget 
    // position (anchor) the scrollbars correctly (with the new size).
    PtSetResource( wp, Pt_ARG_SCROLLBAR_WIDTH, list_width - 1, 0 );
    PtSetResource( wp, Pt_ARG_SCROLLBAR_WIDTH, list_width, 0 );

 return Pt_CONTINUE;
}
  

helpviewer

• If you aren't using ksh or sh as your login shell, the environment variables that the helpviewer uses aren't initialized. (Ref# 27250)

  Workaround: Set QNX_HELP_HOME_PAGE to /usr/qnx630/target/qnx6/usr/help/product/momentics/bookset.html, and QNX_HELP_PATH to /usr/qnx630/target/qnx6/usr/help/product (assuming you installed QNX Momentics in the default location).

• If you run the helpviewer as one user, and you then log in as another user and search the documention, helpviewer's indexer fails with a message of “Cannot open /var/help/usr/qnx630/target/qnx6/usr/help/product.” (Ref# 25628)

  Workaround: Log in as root and type:

  rm -r /var/help/usr
      

  and then generate the index.

Known issues: Utilities

show_vesa

You must log in as root and be in text mode — not Photon — to run this utility. The documentation for this utility lists several options, but show_vesa doesn't have any. (Ref# 41020)

slay

If you use the -C option to change the runmask for a process, the processor for blocked threads doesn't change until the threads become unblocked (or never if the threads remain blocked). The documentation should mention this. (Ref# 40730)

Known issues: Host-specific

QNX Neutrino self-hosted

qconfig

There are two versions of qconfig installed in three places on self-hosted Neutrino systems:

• $QNX_HOST/usr/bin/qconfig — this is always the correct version
• /usr/bin/qconfig — this is the correct version if you've installed the SP2 to SP3 Upgrade on a 6.3.0 SP2 system; it's the wrong version if you've done a clean installation of 6.3.0 SP3.
• $QNX_TARGET/x86/usr/bin/qconfig — this version is obsolete, and you don't need it anyway

(Ref# 42105)

Workaround: Do the following:

1. Log in as root.
2. cp $QNX_HOST/usr/bin/qconfig /usr/bin/qconfig
3. rm $QNX_TARGET/x86/usr/bin/qconfig

Windows hosts

echo.exe

On Windows, the QNX-provided echo.exe interprets the Windows \ separator as an escape character. As a result, environment variable settings won't work if you use \ as a path separator; use / instead. (Ref# 19924)

PATH and quotation marks

Certain programs (e.g. Norton Ghost) add directories inside double quotation marks (e.g. ...;"c:\Program Files\Norton Ghost\";...) to your PATH environment variable. This causes the Cygwin spawn() function to fail, which in turn causes cp to fail when called by ln-w. (Ref# 20046)

Workaround: Modify your PATH environment variable and remove any quotation marks.

MAKEFLAGS

Microsoft Visual Studio also uses the MAKEFLAGS environment variable, but in a much different way than QNX Neutrino does. The result is that Microsoft Visual Studio no longer works after you've installed QNX Momentics.

Workaround: If you want to work with Microsoft Visual Studio (MSVS) after installing QNX Momentics on the same system, do the following:

1. Open a command window and run cmd.
2. Type set.
3. Find the value for MAKEFLAGS and save it.
4. Type set MAKEFLAGS.
5. Do your MSVS work.
6. To work with QNX Momentics again, type:

   set MAKEFLAGS=saved_makeflags_value

Permissions

If you don't have permission to write files in the top-level directory of the C drive, you won't be able to run certain tools, such as bindres and usemsg, which are needed for building PhAB applications. (Ref# 21849)

Solaris hosts

qconfig

If you're using the default Solaris shell, you might have problems switching between different installed versions of QNX Momentics. When you run a command like this:

`eval qconfig -e -n"QNX Momentics 6.3.0"`
  

you get this error:

QNX_HOST=/opt/qnx630/host/solaris/sparc: is not an identifier
  

and your PATH isn't updated. (Ref# 20653)

Workaround: Use ksh instead of the default Solaris shell.

Deprecation of legacy multimedia components

QNX Momentics 6.2.1 introduced a new multimedia library based on an “addon” architecture, and legacy multimedia components (pre-6.2.1) were deprecated. 6.3.0 is the last release that includes these legacy components. The deprecated items are:

• /etc/config/media/mpregistry
• /usr/photon/bin/phplay
• /usr/bin/plaympegaudio_noph
• /usr/bin/playsound_noph
• /usr/bin/playAudioCd
• /usr/lib/libmedia.so.2
• /usr/photon/plugins/mpegaudioplugin
• /usr/photon/plugins/mpegsystemplugin
• /usr/photon/plugins/mpegvideoplugin
• /usr/photon/plugins/soundplugin
• /usr/photon/dll/audiocd.so
• /usr/photon/dll/extproc.so
• /usr/photon/dll/mpegaudio.so
• /usr/photon/dll/mpegsystem.so
• /usr/photon/dll/mpegvideo.so
• /usr/photon/dll/soundfile.so
• /usr/photon/bin/mpegaudio
• /usr/photon/bin/mpegsystem
• /usr/photon/bin/mpegvideo

You should make sure that any multimedia applications that you plan to migrate to the next release of QNX Momentics use the current multimedia library. For more information, see the Multimedia Developer's Guide.

---

QNX Momentics ships with the runtime components of the current multimedia library. You require the Multimedia TDK to develop new multimedia components.

---

Getting started with the documentation

After you've installed your development suite, you'll find an extensive set of online documentation in HTML format. Go to the help menu item (e.g. in Windows XP: All Programs-->QNX Momentics-->Documentation) or look under the following directory:

${QNX_TARGET}/usr/help/product/momentics/bookset.html

This “roadmap” page contains links to the various HTML booksets that accompany the OS (e.g. System Architecture, Programmer's Guide, Library Reference, Utilities Reference, etc.).

You'll find the installation and release notes in the ${QNX_TARGET}/etc/readme/ directory.

---

For the most up-to-date version of these notes, go to our website, www.qnx.com, log into your myQNX account, and then go to the Download Center.

---

Technote: Fine-tuning your network drivers

This technical note is intended to help you tune your network drivers for increased performance or reduced memory footprint using this Network Driver patch. This note includes:

• High-performance NICs
• Low-performance NICs
• Tuning high-performance NIC drivers
• PHY probing
• Speed and duplex

First, we need to talk about network driver interface hardware chips — ASICs — which are sometimes referred to as NICs (network interface controllers, or network interface chips).

At the risk of oversimplifying, we can categorize NICs into two groups: high-performance and low-performance. We aren't talking about the media bit rate (10, 100 or 1000 Mbit) but rather the ability of the complete system, when using the NIC, to avoid packet loss.

Hardware engineers work very hard to design media that rarely lose a packet. And there is a gain, or amplifying effect: when you lose 1% of your packets, you don't lose 1% of your throughput via a protocol, you lose around 50% of your throughput, due to the incurred software-level protocol timeouts and/or retransmissions.

High-performance NICs

What we call “high-performance” NICs have the ability, in a loaded system, to not lose any packets. They generally do this by using transmit and receive descriptor rings in main memory, which in turn point to packet buffers also in main memory.

High-performance NICs use bus-master DMA (direct memory access) to transfer packet data to and from main memory entirely independent of the CPU, using the descriptor rings as laundry lists of packet transmit and receive requests to carry out.

Thus, large scheduling latencies in software that service the NIC (e.g. io-net) can be tolerated.

Low-performance NICs

What we call “low-performance” NICs have been observed by users, in loaded systems, to consistently lose packets, with corresponding poor data throughput performance. These NICs don't use descriptor rings and DMA, but for simplicity, instead attempt to buffer the entire packet in a (usually limited) on-chip buffer area.

Unfortunately, these low-performance NICs, because of their low cost and size, are very attractive to board designers. Examples of these (usually older, obsolete) NICs include:

• Crystal 8900: devn-crys8900.so
• SMC9xxx: devn-smc9000.so
• National Semiconductor ne83815: devn-83815.so
• National Semiconductor ne2000: devn-ne2000.so, devn-wd.so

On a fast (e.g. 2 GHz) lightly loaded machine, these low-performance NICs can function adequately, without packet loss.

However on a slower (e.g. 100 MHz) machine that's CPU-bound with applications that may increase the scheduling latency of io-net, packet loss during receive can often result because the limited hardware buffer overflows.

You shouldn't use these NICs where you need high-performance data throughput. You should use them only for low-cost debug and diagnostic ports, which are often removed for production versions of boards.

If you're using NFS used with one of these low-performance NICs, you can get a great improvement by using the -B4096 or even -B2048 option to fs-nfs. Qnet in QNX Neutrino 6.3 and later generally automatically goes into “windowed mode” with these NICs to try to avoid packet loss.

Tuning high-performance NIC drivers

Common examples of high-performance NICs include:

• Intel i82544: devn-i82544.so
• Intel 82557/558/559: devn-speedo.so
• Tulip (DEC 21x4x): devn-tulip.so
• SMC 9432: devn-epic.so

These NICs are all at least 10/100 Mbit, and some are gigabit, but what makes them high-performance is their ability to function independently of the CPU and use the large CPU main memory for packet buffering, which the low performance NICs by design can't.

There are two critical data-transfer interfaces to a high-performance NIC, which you must tune correctly to avoid packet loss under load:

• The first is the (usually PCI) bus itself. The high-performance NIC will have some FIFO memory, used to buffer data for immediate transmit and receive. As the FIFO drains for transmit, or fills up for receive, the NIC must request to become the bus master to burst data to the FIFO for transmit, or from the FIFO for receive.

  If the latency to schedule the NIC as bus master is excessive, the FIFO will drain for transmit or will overflow for receive. Either will cause a packet to be lost.

  Excessive bus master scheduling latency used to be more of a problem in QNX 4, where other devices (e.g. disk) were programmed with excessive DMA burst length; they would “park” themselves on the bus. This doesn't appear to be as much of a problem in QNX Neutrino, but you should be aware that it can be a problem if you're suffering from mysterious packet loss. The nicinfo output can often give you a clue here.

• Far more likely, when you're encountering packet loss at the driver/hardware level, is that the transmit and receive descriptor rings are overflowing.

  For receive, this usually happens when a high (e.g. greater than 21) priority thread runs READY and hogs the CPU for an extended period of time. This causes io-net to not be scheduled, and the receive descriptor eventually fills up as packets arrive, and the NIC bus-masters the received packets into main memory.

  For transmit, this usually happens when there's an extremely large burst of transmit activity (e.g. server) and possibly some kind of backup or congestion (e.g. PAUSE frames) which simply fills up the transmit descriptor ring faster than the NIC can get it out onto the wire.

  In this network driver patch, the drivers for the high-performance NICs are generally configured with a default 64 transmit descriptors and 128 receive descriptors. You can change them using the transmit=XXXX and receive=XXXX command-line options to the drivers. Generally, the minimum allowed is 16, and the maximum is 2048. Due to the hardware design, stick to a power of 2, such as 16, 32, 64, 128, 256, 512, 1024, or 2048.

  Transmit buffer descriptors are generally quite small, generally in the range of 8 to 64 bytes. So, the cost of increasing the transmit=XXXX value to, say, 1024 for a server (which sees large bursts of transmitted data) is quite small:

  (1024 - 64) x 32 = 30,720 bytes

  for a transmit descriptor of 32 bytes.

  Receive buffer descriptors are similarly quite small, however there's a catch. For each receive descriptor, the driver must allocate a 1,500 byte Ethernet packet buffer. Because the packet buffers must be aligned, they aren't permitted to cross a 4 KB page boundary, so in reality, io-net allocates a 2 KB buffer for each 1,500 byte Ethernet packet.

  So, the cost of increasing the receive descriptor to 1024 from the default 128, with an almost insignificant 32-byte-sized receive descriptor is:

  (1024 - 128) x (32 + 2048) = 1,863,680 bytes

  or almost 2 Megabytes, which is nowhere near as much as the filesystem grabs by default for its cache, but still not an insignificant amount of memory for a memory-constrained embedded system.

  For a memory-constrained system, you should carefully select the sizes of the transmit and receive descriptor rings so that they're minimum-sized, yet no packets are lost under load, with the scheduling latency for io-net on your system.

  Obviously, reducing the receive descriptor ring has more of an effect than reducing the transmit descriptor ring.

  In an application where memory is of no concern, but maximum performance is, generally transmit and receive descriptor rings of 1024 or even 2048 are used.

  Most of the time, bigger is better. There is, however, a potential catch: for some benchmarks, such as RFC2544 (fast forwarding), we've observed that excessively large descriptor rings decrease performance because of cache thrashing.

  However, that's really getting out there. Most of the time, you simply need to configure the transmit and receive descriptor ring size to suit your application so that minimum memory is consumed, and no packets are lost.

PHY probing

Almost all of the network drivers in this patch have been optimized for performance with respect to PHY probing.

Prior to this patch, network drivers would periodically (e.g. every two or three seconds) communicate via the MII to the PHY chip connected to the NIC, to determine the speed and duplex of the current media connection.

The problem is that, while the PHY is being probed, packet loss can occur. The drivers in this patch contain an optimization to not probe the PHY, as long as there have recently been some packets received. This gives maximum performance for most users.

However, there is a nasty scenario: the NIC is connected to a 100 Mbit full-duplex link. The cable is rapidly unplugged and immediately replugged into a 10 Mbit half-duplex hub, which also has a steady stream of (e.g. broadcasted) received packets. In this scenario, because of the steady stream of received packets, the network driver won't probe the PHY, and will still think it's in 100 Mbit full-duplex. This is a problem, because the NIC isn't listening before it transmits; it's still full-duplex, on a half-duplex link. Excessive collisions and out-of-window collisions will result in packet loss.

However, if you leave the cable unplugged for three seconds before plugging it into another hub, the driver probes the PHY and relearns the media parameters and reprograms the NIC with the appropriate duplex.

If you need to rapidly unplug and replug the cable into network boxes with different duplexes, you should specify probe_phy=1 to the network driver, to force it to always periodically probe the PHY. Packet loss may result during this probing, but you will know that the driver is always in sync with the PHY with respect to the media.

For maximum performance, the default is probe_phy=0.

Speed and duplex

Most (but not all) of the drivers in this patch support more than one Ethernet speed and duplex. The most common are 10 and 100 Mbit, and half and full duplex, though the newest NICs support 1000 Mbit (gigabit) Ethernet as well.

All of the drivers let you specify speed=XX and duplex=Z, where XX is 10, 100 or 1000, and Z is 0 (zero) for half-duplex, and 1 (one) for full-duplex. Generally most 10 Mbit links are half-duplex (to old hubs or repeaters, which is the original Xerox blue-book Ethernet) and most 100 Mbit links are full-duplex (switches with point-to-point connections). However, for maximum confusion, you will occasionally see 10 Mbit/full-duplex, and 100 Mbit/half-duplex, but not very often.

If you don't specify speed and duplex, the driver attempts to auto-negotiate the speed and duplex to the fastest possible, by an IEEE specification. Most Ethernet hardware produced in the last few years is compliant with the IEEE specification, but there is some older hardware around that isn't.

In the absence of auto-negotiation, the PHY can figure out the speed pretty easily. However, the duplex is another matter. If auto-negotiation isn't supported, the remote device is assumed to be older and thus half-duplex, not full-duplex.

The moral of the story is that 99% of the time you shouldn't specify speed and duplex; the auto-negotiation should automatically figure it out for you. If you run the nicinfo utility, it will tell you what the auto-negotiated speed and duplex is, and most of the time, it will be correct.

---

It's crucial that both devices, at both ends of the link, use the same speed and duplex, otherwise heavy packet loss can occur (see above).

---

So, you should specify speed and duplex to the network driver only if you have older, perhaps broken or nonstandard Ethernet hardware, and you manually control both ends of the Ethernet link. For example, a managed hub or a cross-over cable.

Technical support

If you have any questions, comments, or problems with a QNX product, please contact Technical Support. For more information, see the How to Get Help chapter of the Welcome to QNX Momentics guide or visit our website, www.qnx.com.

List of fixes

Software fixes