QNX Technical Articles

Date of this edition: November 14, 2008

---

Changes to these notes since November 20, 2006 are highlighted below with this icon:

---

Target OS: QNX^® Neutrino^® 6.3.0 SP2

Host OS: Microsoft Windows Vista, XP SP2, 2000 SP4, or NT SP6a; Sun Solaris 7, 8, 9, or 10; QNX^® Neutrino^® 6.3.0 SP2; Linux Red Hat 8 or 9, Red Hat Enterprise WS 3 or 4, Red Hat Fedora Core 3 or 4, Debian 3.1, or SUSE 10

---

We're deprecating support for the following: Linux Red Hat 8 and 9 Solaris 7, 8, and 9 Windows NT QNX Momentics 6.3 is the last release that you can install on these hosts. QNX Neutrino 6.3.0 supports only the new flash filesystem (FFS3). The older flash filesystem (FFS2) has been discontinued. For the most up-to-date version of these notes, go to our website, www.qnx.com, log into your myQNX account, and then go to the Download Center.

---

---

Make sure that Plug and Play OS is disabled in the BIOS before you run QNX Neutrino self-hosted.

---

Contents...

• What's new in the QNX Momentics 6.3.0 SP2 to SP3 Upgrade?
  • Network Drivers Patch (Patch ID 153)
  • Debug Malloc Library Patch (Patch ID 155)
  • USB Driver Patch (Patch ID 189)
  • qconfig Patch (Patch ID 205)
  • Photon Patch for Windows (Patch ID 209)
  • Hardware Update Patch (Patch ID 214)
  • zip and unzip for Windows and Solaris Hosts Patch (Patch ID 228)
  • Photon Security Patch (Patch ID 232)
  • Maintenance Patch for QNX Momentics 6.3.0 SP2 Network Protocol Components (Patch ID 234)
  • ARMLE, ARMBE, and SHLE gcc libraries for Windows Patch (Patch ID 238)
  • Photon Screensaver Patch for the QNX Neutrino Core OS 6.3.2 (Patch ID 241)
  • Maintenance Patch for Filesystems (Patch ID 245)
  • qnx_cp for Solaris Patch (Patch ID 251)
  • Graphics Driver Patches (Patch IDs 171 and 268)
  • su and passwd Patch (Patch ID 270)
  • IDE System Builder Patch (Patch ID 277)
  • Device Enumeration Patch (Patch ID 278)
  • cpp0 2.95.3 Patch (Patch ID 280)
  • qnxactivate Patch (Patch ID 282)
  • BSP Utilities Patch (Patch ID 283)
  • io-graphics Patch (Patch ID 290)
  • Self-hosted QNX Neutrino Installation and Booting Patch (Patch ID 291)
  • startup-bios, rtc, and pci-bios Patch (Patch ID 311)
  • Documentation Patch (Patch ID 313)
  • pci and pci-bios Patch (Patch ID 326)
  • awk for Linux and Solaris Patch (Patch ID 332)
  • qaudit.sh Patch (Patch ID 338)
  • io-graphics Patch (Patch ID 344)
  • input-cfg Patch (Patch ID 346)
  • devg-i830.so Patch (Patch ID 347)
  • Device Enumerator Patch (Patch ID 359)
  • qnxactivate Patch (Patch ID 361)
  • Block Drivers Patch (Patch ID 366)
  • RCS ID Header File Patch (Patch ID 373)
  • devg-radeon.so Patch (Patch ID 381)
  • PCI BIOS Patch (Patch ID 388)
• Experimental items
• Known issues
  • Booting
  • BSPs, DDKs, and TDKs
  • Compiler and tools
  • Core OS: Kernel ¦ Libraries and header files ¦ Core utilities
  • Device drivers: Audio (deva-*) ¦ Block-oriented (devb-*) ¦ Graphics (devg-*) ¦ Human interface devices (devh-*) ¦ Network (devn-*) ¦ USB (devu-*)
  • Filesystems
  • IDE (Professional Edition only)
  • I/O devices
  • Licensing
  • Multimedia
  • Network protocols
  • Photon
  • Utilities
  • Host-specific: QNX Neutrino self-hosted ¦ Windows hosts ¦ Solaris hosts
• Deprecation of legacy multimedia components
• Getting started with the documentation
• Technical support

Throughout this document, you may see reference numbers associated with particular issues, changes, etc. When corresponding with our Technical Support staff about a given issue, please quote the relevant reference number. You might also find the reference numbers useful for tracking issues as they become fixed.

Some of the items in these release notes apply only to certain editions of QNX Momentics, and are marked accordingly using “PE” (Professional Edition) and “SE” (Standard Edition) abbreviations in parentheses beside the items. Items that aren't marked apply to all editions.

What's new in the QNX Momentics 6.3.0 SP2 to SP3 Upgrade?

The QNX Momentics 6.3.0 SP2 to SP3 Upgrade is a roll-up release that incorporates Documentation Update 1.0.0 and the following patches:

Applying this upgrade to a 6.3.0 SP2 system brings the system into line with QNX Momentics 6.3.0 SP3.

---

The SP2 to SP3 Upgrade includes the latest documentation, including the Documentation Update 1.0.0. Don't install the Documentation Update 1.0.0 after installing the SP2 to SP3 Upgrade, or your system's documentation will be in an inconsistent state.

---

We're no longer planning to deprecate the -M option to qcc. In 6.4, qcc will continue to use -M for generating a mapfile. (Ref# 26743)

What's new: Network Drivers Patch (Patch ID 153)

Many drivers now have a probe_phy option. This option lets you select whether or not the PHY is probed at regular intervals to see if the duplex setting and/or the speed on the connection has changed (e.g. the cable has been unplugged and plugged into a different hub or switch.

Here's a description of the new option:

probe_phy=1

Poll the PHY at regular intervals to see if the speed or duplex setting has changed.

probe_phy=0

Poll the PHY at regular intervals, but only during periods when no packets are received on the interface, or the link is down. This setting increases the packet-throughput performance on the link, and is the default.

This patch also addresses the following issues:

devn-pcnet.so

• Packet processing now occurs only after the driver has fully registered with io-net, in order to prevent an assertion with the debug version of io-net. (Ref# 23068)
• io-net no longer fails with a SIGBUS on startup with the devn-pcnet.so network driver on the MIPSLE Malta boards using QNX Neutrino 6.3.2. (Ref# 28177)
• This driver now includes the probe_phy option, as described above. (Ref# 28634)
• devn-pcnet.so no longer loops forever when processing a list of packets. (Ref# 29128)
• Promiscuous and multicast support for the devn-pcnet.so driver is controlled via command-line options rather than by devctl() due to observed NIC-reset problems when the modes are switched in the hardware. The default mode is promiscuous Rx disabled and all-multicast Rx enabled. This allows TCP/IP v6 to run its routing daemons. You can enable promiscuous mode by specifying the promiscuous command-line option to the driver. You can disable multicast mode by specifying the nomulticast command-line option to the driver. (Ref# 29378)
• This driver now provides more information when you use nicinfo.
• We've fixed an issue that affected duplex operations at 10 Mbit/second.
• devn-pcnet.so no longer locks up with npm-qnet-l4_lite.so.
• devn-pcnet.so no longer leaks memory with npm-qnet-l4_lite.so.
• We've added the _NPKT_PROMISC flag to received packets.

devn-rtl.so

• The correct duplex setting is now negotiated when the speed is 10 Mbit. (Ref# 17146)
• This driver now works on MIPSBE targets. (Ref# 24259)
• This driver now includes the probe_phy option, as described above. (Ref# 28637)
• Issuing a umount /dev/io-net/en1 no longer causes io-net to crash. (Ref# 29470)
• You can now start a second instance of io-net using the RTL driver. (Ref# 29488)
• nicinfo now reports the correct speed and duplex setting when they're specified. (Ref# 29489)
• The devn-rtl.so driver no longer loses packets during a receive on PPCBE targets. (Ref# 29680)
• devn-rtl.so now scans and automatically detects Dlink DFE-528Tx Rev E1 with vendor ID 0x1186 and device ID 0x1300, with NIC labeled DL10038D. (Ref# 29729)

  ---

  The Dlink DFE-538TX Rev D2 with a NIC labeled DL10038C that also has the same vendor and device IDs as the DFE-528TX card isn't apparently 100% rtl-8139-compatible and doesn't appear to work correctly.

  ---

• We now provide an SHLE variant of this driver.
• We've added a caching API for SH.

devn-pegasus.so

• The devn-pegasus.so driver now works with newer 8513-based chips. (Ref# 27727)
• This driver now includes the probe_phy option, as described above. (Ref# 28647)
• Multicast and broadcast statistics are now correctly displayed with nicinfo. (Ref# 29130)

devn-rtl8150.so

This is a new driver for SMC2208 USB/Ethernet adaptors.

CPU targets provided: x86, ARMLE, SHLE

Location: $QNX_TARGET/x86/lib/dll/devn-rtl8150.so, $QNX_TARGET/armle/lib/dll/devn-rtl8150.so, $QNX_TARGET/shle/lib/dll/devn-rtl8150.so

libdrvr*

• Drivers that auto-negotiate now report the correct speed and duplex after the cable is reconnected after being disconnected for a while. (Ref# 20417, 20423)
• If you forced the speed on the command line, the first link's speed was negotiated properly, but subsequent renegotiations didn't honor the override speed, performing a normal auto-negotiation instead. We've now corrected this.
• We've corrected an auto-negotiation problem with gigabit Ethernet.
• We've added the unit option as an alias for the lan option.
• We've corrected the display of memory addresses.

What's new: Debug Malloc Library Patch (Patch ID 155)

The debug malloc library in 6.3.0 SP2 for SHLE passes in a special flag when it needs to allocate memory from the kernel using mmap(). This flag tells the 6.3.0 SP2 SHLE kernel not to set the contents of allocated memory to zeros. This flag will not be recognized in the later version of the SHLE kernel, therefore, will cause compatibility problems when you apply the QNX Neutrino Core OS 6.3.2 on a 6.30 SP2 system. The fix is to not set this flag by default. (Ref# 27639)

What's new: USB Driver Patch (Patch ID 189)

This patch addresses the issues listed below for each binary.

io-usb, libusbdi.so

• usbd_urb_status() no longer returns EOK when the status function parameter indicates that the URB is still busy. (Ref# 22156)
• A client USB driver no longer gets an extra insertion callback if it's started while the USB stack is enumerating a device. (Ref# 22307)
• The enumeration code no longer retries or delays if a device has been removed. This fixes long delays (8s) if a hub is quickly inserted, removed, and inserted again, and devices are attached to the hub. (Ref# 27409)
• Some devices don't handle string descriptors properly, so libusbdi.so now checks to see if the string index fields for Manufacture or Product are set. If they aren't, the library doesn't try to read the language table (index 0) on the string descriptor. (Ref# 23097)
• Client drivers are now prevented from attaching to USB hubs. The detach from the hub was aborting the interrupt endpoint that reported port status changes. The hub would then no longer report the insertion or removal of devices. (Ref# 24552; Ticket ID 69035)
• The power is now turned on for at least one port for hubs that have ganged power controls. (Ref# 27117)
• We added code to check PCI capabilities for power-management features and power-up the devices if they're powered down. This fixes a problem where Windows powered down USB chips on a PCI bus, and after resetting and booting into Neutrino, the USB drivers failed. (Ref# 27273)
• Bulk/interrupt transfers now correctly set the direction for zero-length transfers; if you're using the OHCI controller, and you print to a USB printer, the printer no longer blocks. (Ref# 23802)
• If a device has multiple interfaces and alternate settings on the second interface, selecting one of alternate settings no longer causes errors when enqueuing transactions on the first interface. (Ref# 28313)
• Errors are now correctly reported for isochronous transfers when the buffer size is larger than MPS. (Ref# 28315)
• Fetching and storing multiple configurations for a device now works correctly. This change lets you select a default configuration/interface for a multiconfiguration device. (Ref# 28449)
• The io-usb server no longer crashes with a SIGSEGV on startup when bad arguments are passed to it. (Ref# 29082)
• USB client drivers are no longer notified of HUB insertions when the client driver is first started. (Ref# 29527)
• Starting a devb-umass driver no longer causes other drivers' URBs for nonmass-storage devices to be aborted. (Ref# 29562)
• devu-ohci no longer runs out of Endpoint Descriptors. (Ref# 29661)
• io-usb no longer aborts endpoints for devices on bus 0 for devices attached to other USB buses. (Ref# 29747)
• io-usb no longer crashes with a SIGSEGV when transactions time out. (Ref# 30054)
• io-usb with a UHCI or EHCI chipset no longer misses port changes when the client drivers call usbd_reset_device(). (Ref# 29884)

devu-ohci.so

• devu-ohci.so now correctly handles zero-length packets for the Philips ISP1562 USB PCI chipset. (Ref# 24062)
• We fixed a toggle problem for USB transfers that span multiple TDs. An URB transfer spanning more than one memory page with an odd number of packets would have the expected data toggle set incorrectly. (Ref# 27856)
• The OHCI driver now works on platforms that have PCI bus master translation. (Ref# 29556)
• The OHCI driver no longer has an endian bug that caused io-usb to crash on big-endian platforms. (Ref# 29558)

devu-uhci.so

• We now clear an interrupt before processing completed transactions (TDs). This fixes a problem where a completed transaction was done but the interrupt was missed and the client driver waited indefinitely or until some other completed transactions occurred. (Ref# 28771)
• Calling usbd_reset_pipe() to clear a stalled bulk endpoint no longer makes the driver run out of EDs. (Ref# 29773)
• devu-uhci.so now correctly aborts a timed-out control transfer, so it doesn't make the system lock up. (Ref# 29883)
• The UHCI driver now works on platforms that have PCI bus master translation. (Ref# 30033)

devu-ehci.so

• devu-ehci.so now correctly handles large transfers for the Philips ISP1562 USB PCI chipset. (Ref# 24062)
• If two drivers attempt to abort an endpoint at the same time, the EHCI driver no longer loops while disabling and enabling the schedule. The client drivers no longer remain blocked forever waiting for the abort operation to complete. (Ref# 25647)
• The default interrupt threshold is now 1. This increases the allowable interrupt frequency and improves the “out-of-box” mass storage performance. (Ref# 28952)
• Multiple split interrupt transactions no longer fail on EHCI chipsets. (Ref# 29230)
• The EHCI driver no longer has an endian bug when aborting endpoints. This problem caused io-usb to run READY when aborting a device's endpoint. (Ref# 29553)
• io-usb with UHCI/EHCI chipsets no longer misses port changes when client drivers call usbd_reset_device(). (Ref# 29884)
• The EHCI controller no longer halts on big-endian platforms with PCI bus mastering translation. (Ref# 30029)

usb

• This utility now displays the Full speed HC capability.

devb-umass

• A reduced SCSI command set model was implemented. This increases interoperability with nonstandard devices that don't function properly when encountering SCSI commands that they don't support.
• The SCSI_INQUIRY command now requests only 36 bytes. Some devices fail when asked for the full 96 bytes. (Ref# 22105)
• devb-umass now works correctly with devices (such as the San Disk Cruzer Mini) that return invalid data for CSW. You can now specify the csw_ignore option on the command line. (Ref# 22104)
• devb-umass now correctly detects a Y-E Data floppy drive. (Ref# 29552)
• If a driver attempts to attach to a device that's already controlled by another driver (i.e. usbd_attach() returns EBUSY), io-usb no longer aborts the endpoints for that device after the attach fails. This problem caused other drivers to fail when the URBs were aborted for no reason. (Ref# 29562)
• devb-umass now handles devices that return invalid sense data (NO_MEDIA). (Ref# 29600)

io-blk

• Automounting now works with USB whenever a device is inserted; devb-umass no longer crashes with a SIGSEGV when a USB device is inserted after the driver has been started with PNP and automount enabled. (Ref# 18901)
• fsync() no longer causes problems on read-only media. (Ref# 22013)
• We corrected a problem with the DCMD_FSYS_DIRECTIO command to devctl() that caused data-transfer errors when the filesystem's block size wasn't the same as the device-sector size. (Ref# 24149)

fs-cd.so

• Recursive searches in a CD filesystem no longer return corrupted entries. (Ref# 19014)

fs-dos.so

• stat() no longer fails on directory names that contain UTF-8 characters. (Ref# 22959)

What's new: qconfig Patch (Patch ID 205)

This patch includes an updated version of the qconfig utility that provides more information about the QNX software on your system. (Ref# 29317)

These files are installed in the host-specific directories under your base installation directory for QNX Momentics:

• host/win32/x86/usr/bin/qconfig.exe
• host/linux/x86/usr/bin/qconfig
• host/solaris/sparc/usr/bin/qconfig
• host/qnx6/x86/usr/bin/qconfig

What's new: Photon Patch for Windows (Patch ID 209)

QNX Momentics SP2 didn't install certain binaries and header files on Windows hosts. This patch installs the following files in the host/win32/x86 directory under your base installation directory for QNX Momentics:

• lib/libfontharnessutils.a
• usr/lib/libph.dll.a
• usr/photon/bin/ph.dll.3
• usr/photon/bin/PtWeb.dll.3
• usr/photon/bin/jpeg.dll.3
• usr/photon/bin/font/ttfFFcore.dll.1
• usr/photon/bin/font/PHFcore.dll.1
• usr/photon/bin/font/FCcore.dll.1
• usr/photon/bin/font/ttfFFcore.dll
• usr/photon/bin/font/PHFcore.dll
• usr/photon/bin/font/FCcore.dll
• usr/photon/bin/phfont.exe
• usr/photon/bin/ph.dll
• usr/photon/bin/PtWeb.dll
• usr/photon/bin/jpeg.dll
• usr/photon/bin/Photon.exe
• usr/photon/appbuilder/ab.exe
• usr/photon/appbuilder/ab.res
• usr/photon/appbuilder/phablang.exe
• usr/photon/appbuilder/phablang.res
• usr/include/_pack1.h
• usr/include/_pack64.h
• usr/include/_packpop.h
• usr/include/env.h
• usr/include/errno.h
• usr/include/fnmatch.h
• usr/include/gulliver.h
• usr/include/inttypes.h
• usr/include/qnx/time.h
• usr/include/share.h
• usr/include/sys/cdefs.h
• usr/include/sys/compiler_gnu.h
• usr/include/sys/interact.h
• usr/include/sys/kernel.h
• usr/include/sys/keyboard.h
• usr/include/sys/keycodes.h
• usr/include/sys/lmf.h
• usr/include/sys/name.h
• usr/include/sys/platform.h
• usr/include/sys/pointer.h
• usr/include/sys/proxy.h
• usr/include/sys/qnx_glob.h
• usr/include/sys/sched.h
• usr/include/sys/seginfo.h
• usr/include/sys/sendmx.h
• usr/include/sys/trace.h
• usr/include/sys/tracecod.h
• usr/include/sys/types.h
• usr/include/sys/vc.h
• usr/include/time.h
• usr/include/unicode.h
• usr/include/x86/platform.h
• usr/bin/mkfontdir.exe
• usr/bin/phindows.exe

(Ref# 29640)

What's new: Hardware Update Patch (Patch ID 214)

This maintenance patch provides an update to the following components:

What's new: zip and unzip for Windows and Solaris Hosts Patch (Patch ID 228)

You need zip and unzip to install some of our products. This patch installs these commands for Windows and Solaris hosts; they're already included on QNX Neutrino and Linux hosts. (Ref# 29419)

What's new: Photon Security Patch (Patch ID 232)

This patch fixes security vulnerabilities in Photon reported by iDefense.com. It contains these files:

• target/qnx6/armle/usr/lib/libAp.a
• target/qnx6/armle/usr/lib/libph.so.3
• target/qnx6/armle/usr/lib/libApS.a
• target/qnx6/armle/usr/lib/libph.a
• target/qnx6/armle/usr/lib/libphS.a
• target/qnx6/armle/usr/lib/libAp.so.3
• target/qnx6/armle/usr/photon/bin/fontsleuth
• target/qnx6/mipsle/usr/lib/libAp.a
• target/qnx6/mipsle/usr/lib/libph.so.3
• target/qnx6/mipsle/usr/lib/libApS.a
• target/qnx6/mipsle/usr/lib/libph.a
• target/qnx6/mipsle/usr/lib/libphS.a
• target/qnx6/mipsle/usr/lib/libAp.so.3
• target/qnx6/mipsle/usr/photon/bin/fontsleuth
• target/qnx6/ppcbe/usr/lib/libAp.a
• target/qnx6/ppcbe/usr/lib/libph.so.3
• target/qnx6/ppcbe/usr/lib/libApS.a
• target/qnx6/ppcbe/usr/lib/libph.a
• target/qnx6/ppcbe/usr/lib/libphS.a
• target/qnx6/ppcbe/usr/lib/libAp.so.3
• target/qnx6/ppcbe/usr/photon/bin/fontsleuth
• target/qnx6/shle/usr/lib/libAp.a
• target/qnx6/shle/usr/lib/libph.so.3
• target/qnx6/shle/usr/lib/libApS.a
• target/qnx6/shle/usr/lib/libph.a
• target/qnx6/shle/usr/lib/libphS.a
• target/qnx6/shle/usr/lib/libAp.so.3
• target/qnx6/shle/usr/photon/bin/fontsleuth
• target/qnx6/x86/usr/lib/libAp.a
• target/qnx6/x86/usr/lib/libApS.a
• target/qnx6/x86/usr/lib/libph.so.3
• target/qnx6/x86/usr/lib/libph.a
• target/qnx6/x86/usr/lib/libphS.a
• target/qnx6/x86/usr/lib/libAp.so.3
• target/qnx6/x86/usr/photon/bin/fontsleuth

This patch fixes these issues:

• Local exploitation of a format string vulnerability in the fontsleuth command allows attackers to gain root privileges — iDefense Security Advisory 02.07.06. (Ref #29447)
• Local exploitation of a stack-based buffer overflow vulnerability libAp allows local attackers to gain root privileges — iDefense Security Advisory 02.07.06. (Ref #28807)
• Local exploitation of a stack-based buffer overflow vulnerability in libph allows local attackers to gain root privileges — iDefense Security Advisory 02.07.06. (Ref #29448)

What's new: Maintenance Patch for QNX Momentics 6.3.0 SP2 Network Protocol Components (Patch ID 234)

Several of these fixes correct problems that can affect your system's network service availability or fix potential data corruption issues, so we recommend that you update your system to use the binary versions included in this patch. See reference numbers 21549, 21962, 25036, 38470, 38674, 28765, 38575, 24275, 38567, 23581, and 23582.

This patch addresses the following issues:

npm-tcpip-v4.so

• The TCP/IP stack could formerly fault if you tried to get file-descriptor information (e.g. by executing sin fd) on a system where a process had called shutdown() for a TCP/IP socket descriptor, but the socket hadn't yet been closed. This has been fixed. You also now get more diagnostic information when you use sin fd to view information on socket file descriptors. (Ref# 21549)
• The TCP/IP stack obtains a timer, which starts at time 0, from the process manager. If the TCP/IP stack and a TCP/IP application that tries to connect to a remote host start executing too soon, the TCP/IP stack may apply a time of 0 seconds to ARP cache entry structures.

  If this occurs, you may end up with a permanent ARP entry (i.e. one that never times out). You can also end up with permanent, incomplete ARP entries that never time out and that the TCP/IP stack doesn't attempt to resolve. If this happens, your host won't be able to communicate with one or (possibly) more remote hosts (i.e. the ones the TCP/IP application in the OS image is trying to reach).

  You can check for permanent ARP entries by running the arp -an command and examining the output. The only permanent entries listed should be for the IP addresses assigned to your host's interfaces; there shouldn't be any permanent, incomplete entries. If you find a permanent entry that isn't for the IP address of an interface on your host, and you didn't explicitly create a permanent entry, then you could be encountering this problem. A workaround for your OS image was to delay the start of the TCP/IP stack or the first TCP/IP application by at least one second, by using the sleep command (e.g. sleep 1) or some other delay mechanism. This has been fixed, so this workaround is no longer necessary. (Ref# 21395)

• If you connect() on an unlinked or nonexistent AF_LOCAL socket, errno used to be incorrectly set to ECONNREFUSED instead of ENOENT. This has been fixed. (Ref# 21664)
• If a program called bind() for an AF_LOCAL socket, and the path namespace entry was created, the TCP/IP stack used to leak a small amount of memory, even if the path were unlinked. This has been fixed. (Ref# 21639)
• A user TCP application that was blocked on read() formerly could unblock and return 0 when the sin utility was run. It appeared as if the remote TCP application had closed its end of the socket, when it hadn't. A user symptom could be TCP server applications that terminated, closed a TCP session for no reason, or reported that the client had ended the session when it hasn't. This has been fixed. (Ref# 21962)
• The socket() function call formerly could have set errno incorrectly if the system were out of memory for AF_LOCAL sockets. (Ref# 22917)
• When the fastforward path in the TCP/IP stack was used (see the fastforward option to npm-tcpip-v4.so or npm-tcpip-v6.so), the TCP/IP stack didn't deal with the next hop gateway properly if it wasn't responding to an ARP request. The TCP/IP stack now correctly marks the route as being down and sends an ICMP-unreachable packet back to the source. (Ref# 23864)
• If a packet were to be forwarded, and there was no route specified on the gateway, the TCP/IP stack returned ICMP_UNREACH with an ICMP_UNREACH_HOST code. The TCP/IP stack has been changed to return a ICMP_UNREACH_NET code. (Ref# 23900)
• When the TCP/IP stack ran out of threads, it wasn't obvious to the user that this had occurred, beyond the slow response of the TCP/IP stack. (See the threads option for npm-tcpip.so. Now if this occurs, this situation is logged to sloginfo. (Ref# 26556)
• When multiple threads at the same priority sent data on a stream socket, the data would sometimes be intermixed in a nonintuitive way when received at the peer. We've corrected this. (Ref# 24873)
• The TCP/IP stack no longer causes io-net to run READY when using the SO_BINDTODEVICE socket option. This could have occurred if a socket were bound to one network interface, but a packet arrived on another network interface that had no socket bound to it, targeting the same IP port. Applications that could have been affected by this behavior include dhcp.client, dhcpd, dhcprelay, and bootpd. (Ref# 25036)
• When unlinking Unix Domain Name pathnames, and binding new pathnames, the stack formerly might have maintained a reference to freed memory, which could have caused the bind() function to fail for Unix sockets, or corrupted the TCP/IP stack's memory. We've corrected this. (Ref# 38470)
• When the number of interfaces is greater than 8, the stack formerly could incorrectly assign two interfaces with the same interface index. This has been fixed. (Ref# 25359)
• We've changed the source to be compatible with gcc 3.4.4. (Ref# 26682)
• The TCP/IP stack no longer faults when you use the ioctl() SIOCGIFALIAS to get information on an address that doesn't exist. (Ref# 25166)
• The TCP/IP stack formerly could sometimes generate a double reply in response to sin fd queries. This didn't cause any issues, but made kernel traces confusing. (Ref# 25856)
• The stack formerly could corrupt an internal packet cache and then fault when more than three link layer types were in use (e.g. ethernet, PPP, other). (Ref# 28896)

route, arp, netstat, npm-tcpip-v4.so

• The TCP/IP stack used a monotonic clock internally. Interfaces that used an absolute timeout value to specify a timeout, or to query a timeout, were converted to use a relative timeout value. Utilities that used this interface were converted to use a relative timeout value. This introduced portability and maintenance issues because the timeout values were incorrectly applied if the application wasn't modified. These interfaces once again use an absolute timeout. The interfaces effected are:
  • The Routing Socket rt_metrics structure member rmx_expire — the lifetime for the route

  The arp, route and netstat utilities had been modified to supply a relative timeout rather than an absolute one. We've changed them back, so that they again use an absolute timeout value. (Ref# 22877)

sysctl, npm-tcpip-v4.so, <netinet/icmp_var.h>

The TCP/IP stack would always respond to the ICMP timestamp request. You can now turn this feature off with the sysctl utility or the sysctl() function. The object to control this is net.inet.icmp.tstamprepl; the default is 1 (on). (Ref# 23329)

sysctl, npm-tcpip-v4.so, <netinet/in.h>, <netinet/ip_var.h>

The TCP/IP stack by default uses sequential IP header IDs. You can now enable random IP header IDs, by using the sysctl utility or the sysctl() function. The object to control this is net.inet.ip.random_id; the default is 0 (off). (Ref# 23328)

npm-qnet-l4_lite.so

• Qnet formerly could potentially leak a small amount of memory during name resolution if a network error occurred. In this scenario, it was also possible for an application to become permanently REPLY-blocked on Qnet. This affected applications calling netmgr_remote_nd(). This has been fixed. (Ref# 38674, 28814, 25949)
• Qnet formerly could potentially fault or corrupt the memory of the io-net process if your network contained a large number of Qnet nodes, or nodes with long hostnames and domains. This was typically an issue if the number of nodes names in the /net directory were more than approximately 100 nodes, but could have been an issue with a smaller number of nodes with very long host and domain names. (Ref# 28765)
• We've add a new Qnet IOMSG, _NETMGR_QOS_FLUSH. This message lets an application force a retransmission instead of waiting for Qnet to activate its own timeout. This is useful for periodic detectable hardware failures where the application can take action, instead of enabling shorter timeout periods for Qnet, which adds more load to the system. (Ref# 38260)

  Here's an example:

  #include <sys/netmgr.h>
  #include <sys/netmsg.h>
  
  extern int __netmgr_send( void *smsg1, int ssize1, const void *smsg2,
                            int ssize2, void *rmsg, int rsize);
   
  int main (void)
  {
              struct _io_msg msg;
  
              msg.type = _IO_MSG;
              msg.combine_len = sizeof(msg);
              msg.mgrid = _IOMGR_NETMGR;
              msg.subtype = _NETMGR_QOS_FLUSH;
  
              __netmgr_send(&msg, sizeof(msg), 0, 0, 0, 0);
  }
      

• Qnet now supports a vtag=tag_number option that causes Qnet to insert a 4-byte vlan tag into the packet. The tag_number must be greater than zero. If you use this option, Qnet accepts only packets that have a tag value that matches the given tag_number. If the driver being used doesn't support 1518-byte packets, you must also use the Qnet mtu_en=1496 option. (Ref# 38260)
• Qnet had a calculation issue when determining whether to retry during a node resolution. It would retry twice the number specified by the res_retries option, over twice the amount of time. The default is 2, which resulted in 4 retries. This has been fixed. (Ref# 25781)
• We've changed the possible values for the periodic_ticks option from 1, 2, 5, or 10 to any value from 1 to 1000. (Ref# 24893)
• We've added the max_tx_bufs=num option. This option specifies the number of tx buffers that Qnet holds in reserve before allocating more. The default was also changed from 100 to 500. If your application sends large messages, you may want to increase this value for performance. If your application typically sends small messages (most default system traffic is small messages) you may want to decrease this value to save memory. (Ref# 23852)
• Qnet priority inheritance now works correctly for messages being sent with a priority greater than 63. The priority was formerly capped at 63. (Ref# 23352)
• Qnet supported a maximum of two network interfaces (the first two located) although the user could override and specify which two (with the bind=interface option). Qnet now supports more interfaces via the max_num_l4s=num option. The default is two; the maximum is four. (Ref# 22269)
• Qnet now lets you specify the maximum transmission unit (MTU) of a Qnet packet via the mtu_en=num option. The num argument must be greater than 100. All nodes in network must use the same value. The default is 1500. (Ref# 22250)
• Qnet used to log an event for every misaligned packet supplied by a driver. This could have an impact on performance. Qnet now logs this event only periodically. This is caused only by certain drivers. (Ref# 21621)
• Qnet used a pulse with a hard-coded priority for the QoS transmission thread, and the QoS periodic transmission thread. You can now set the priority of these pulses, using the options qos_per_pri=num and qos_tx_pri=num, where num is the new priority. We recommend that you not change these values; we supply these options for the user case where the priority of the io-net subsystems must be changed, which is typically rare. (Ref# 20891)
• Qnet has added more debugging sloginfo events in the kernel interface layer to aid in debugging. (Ref# 20290)
• Qnet now loads the resolver file at the proper time in its initialization. It was being loaded too late previously. (Ref# 38267)
• When a channel is destroyed, Qnet notifies the client node involved. If that client node is down, Qnet no longer faults logging an event regarding this scenario. (Ref# 21336)
• Qnet has the option of using CRC to check for packet corruption. By default it relies on the hardware. When using software CRC checks, Qnet verifies the CRC if it's present, although it also allows packets that don't contain a CRC value (other nodes not using the no_crc option). We've added a new enforce_crc option:

  enforce_crc=num

  If you use this option in combination with do_crc, only packets that contain a valid CRC are accepted. This option has an effect only when do_crc is also set to 1. Setting enforce_crc to one causes packets that are received without a valid software-level CRC generated by the remote mode (i.e. it's running do_crc=0) to be discarded, because the packet content's integrity is unknown, and could be suspect. The default is zero, which allows received packets without a generated software-level CRC to be processed. (Ref# 39171)

fs-cifs

• When using fs-cifs, pread() no causes the file pointer to be changed. This had the potential to corrupt binaries being launched over the CIFS network protocol when using QNX Neutrino Core OS 6.3.2. (Ref# 38575)
• fs-cifs no longer faults if an empty password ("") is passed on the command line. (Ref# 27957)
• The timestamp of created files is no longer incorrect when the server or client (fs-cifs) system has its time zone set to something other than GMT. (Ref# 25619)
• fs-cifs no longer faults when you use a password longer than 32 characters. (Ref# 24252)
• If you're using fs-cifs to rename a file in the same directory, while changing only the case of letters in the filename (e.g. file to FILE) and the server is Windows, the file is no longer deleted. (Ref# 23706)
• By default, if the CIFS server can't be reached, or isn't responding, it could take a long period of time before an application fails, as TCP timeouts would be applied. We've added a new -o timeout=num_seconds option that lets you specify the timeout to apply. This is applied to all server-blocking operations (e.g. mount, open(), read(), write(), and so on). Note that you could always use a signal to unblock the application. (Ref# 23115)
• fs-cifs formerly might not have responded if left idle for several hours. This has been fixed. (Ref# 22226)
• fs-cifs now supports more modern dialects. This improves compatibility with later Windows OS releases. This results in improvements in the accuracy of file time status, and quicker mounting of Windows shared directories. (Ref# 38233)
• When using fs-cifs on PPCBE targets, fs-cifs formerly could return an unexpected errno back to applications that were trying to connect to resource-manager processes, but resolve the manager pathname via the CIFS mountpoint rather than the manager process if that process wasn't running. This could occur if the fs-cifs mountpoint is /, and the application is trying to resolve a pathname under /dev. For example, devc-pty might not have launched properly if the power manager weren't running, because fs-cifs returned an errno other than EBADF. This has been fixed. (Ref# 25447)
• If there had been a successful mount of a share, and then the share was umounted, subsequent mounts of that same share would succeed, even if the user and password credentials specified were incorrect or missing. This has been fixed. (Ref# 27151)
• The stat() times of a file accessed over the network using fs-cifs on a PPC target are now correctly decoded. (Ref# 22726)
• When fs-cifs has a connection to the network server, and the server is rebooted, or some kind of temporary network failure occurs, fs-cifs tries to reestablish the connection and resume the operation it might have been doing. If that operation is a readdir(), fs-cifs no longer loses its place in the directory. It formerly could have returned duplicate entries, or missed entries. (Ref# 23729)
• There used to be potentially a very small timing window (out of the user's control) where access() could fail with EINVAL on an fs-cifs mountpoint. We've fixed this. (Ref# 20372)
• A certain pattern of read(), seek() and ftruncate() no longer returns corrupt data when you call read(). (Ref# 24275, 23583)
• fs-cifs now supports mmap() properly. (Ref# 24255)
• fs-cifs now implements the file access modes O_APPEND and O_TRUNC correctly. It formerly could potentially result in file corruption. (Ref# 38567)
• If fs-cifs failed to authenticate with the server using an encrypted password, it would then attempt to authenticate with the server using an older method while sending the password unencrypted. This behavior has been changed to only send the password encrypted, unless you specify the option -o plainpwd. You might need the -o plainpwd option when mounting shares on older versions of Windows. (Ref# 39865)

  The new password options are as follows:

  -o plainpwd

  If logging in with an encrypted password fails, try to log in by using the password unencrypted.

  ---

  Sending passwords in plain text may be considered a security problem.

  ---

  -o showpwd

  Show the plain-text password in the log file.

  ---

  Adding the password to the log file may be a security problem if unauthorized personal have access to the log file.

  ---

fs-nfs2

A certain pattern of read(), seek(), and ftruncate() used to potentially return corrupt data when read() was called. We've fixed this issue. (Ref# 23581)

fs-nfs3

• fs-nfs3 no longer (depending on the server implementation) causes an application calling readdir() for a NFS-mounted directory to loop forever. The call to readdir() never returned NULL; instead, it started at the first directory entry again. This has been fixed. (Ref# 23092)
• Using the -w size=num and -w number=num options to change the size of the cache for asynchronous write operations no longer causes internal cache corruption. (Ref# 25186)

  ---

  These options aren't documented yet; for a description, see “Known issues,” below.

  ---

• When implementing asynchronous write (write caching), fs-nfs3 now correctly submits cached NFS write operations with the user ID of the application performing the write instead of root. (Ref# 23425)
• fs-nfs3 now supports file sizes greater than 2 GB. (Ref# 21592)
• The usage message now correctly says that the -s option, which specifies to use a soft mount, is a mountpoint option, not a global option. (Ref# 23381)
• A certain pattern of read(), seek(), and ftruncate() used to potentially return corrupt data when read() was called. We've fixed this issue. (Ref# 23582)
• fs-nfs3 now supports values greater than 8096 for the -B option. (Ref# 20810)
• If you're using fs-nfs3 with asynchronous writes, and the server is using root-squashing (i.e. it maps root to anonymous or nobody), you can now create directories and files correctly. (Ref# 25113)

fs-nfs2, fs-nfs3

• If an application is executed from an NFS-mounted filesystem, and has its binary code changed on the filesystem while maintaining the same path and filename on the filesystem, executing the application a second time no longer causes the already executing instance of the application to fault. (Ref# 22601)
• NFS requests always have a unique identifier (xid) value. If a NFS server stops responding (for example because of a temporary network failure) fs-nfs2 and fs-nfs3 try to remount the server and resend the request. We've found that some servers refuse to reply to a request if the request's xid hasn't been changed after a remount, which is against the NFS specification. We've added an -x option to work around this problem; it causes the client to change the xid of the request after a remount. (Ref# 25402)
• When you mount and unmount a NFS mountpoint repeatedly for hundreds of iterations, there's no longer a potential for a resource to be unreleased, causing all further mount attempts to fail. There's still a timeout period that must expire before mounts can continue. Unless you're doing this operation in a loop, you aren't likely to encounter this timeout. (Ref# 15078)
• fs-nfs2 and fs-nfs3 are no longer vulnerable to improperly formatted RPC packets (e.g. those generated by a reconfigured NFS server for which the client had established a mountpoint). (Ref# 21480)
• fs-nfs2 and fs-nfs3 now recover properly if the NFS server terminates and is restarted while the client is actively exchanging data with the server. Attempts to access files over the NFS link used to result in errors, with errno set to EPERM. (Ref# 25765)
• When you now call mkdir() with a pathname, if a symbolic link already exists with that pathname, mkdir fails with the errno value EEXIST; mkdir() previously resolved the link. (Ref# 19213)
• In some cases, fs-nfs2 and fs-nfs3 wouldn't treat a TCP connection as a stream, and would expect that the entire packet should be returned with a read(). This would cause false failures, and fs-nfs2 and fs-nfs3 would remount the NFS server more times than necessary. We've fixed this. (Ref# 8873)
• A link pathname that ends in a slash is no longer treated as a link rather than the directory it points to. For example, readlink() now returns an error instead of data for a path that ends in /. (Ref# 19209)
• If you specify O_EXCL and O_CREAT for open(), and the path names a symbolic link, open() now correctly fails and sets errno to EEXIST. (Ref# 19210)
• mkfifo() now fails with EEXIST if the path names a symbolic link. (Ref# 19212)
• When deleting a directory, fs-nfs2 and fs-nfs3 would incorrectly attempt to use a file operation first, and then a directory operation. This made some NFS servers stop communicating with fs-nfs2 or fs-nfs3. We've fixed both client filesystems to use only a directory operation. (Ref# 38671, 38672)

fs-cifs, fs-nfs2, fs-nfs3

The usage message now correctly states that you don't need to specify a server-export/mountpoint combination on the command line when you launch fs-cifs, fs-nfs2, or fs-nfs3. You can invoke the mount command later to add mountpoints. (Ref #15446)

nfsd

• This server no longer faults when listing the contents of directories when the pathnames exceed 255 characters. (Ref# 23248)
• If the export in the /etc/exports file is a link to another directory, showmount now correctly displays the link pathname instead of the target pathname. (Ref# 26149)
• nfsd allows you to access files only up to 16 subdirectory levels deep within the directory exported in the /etc/exports file. It now returns an error of NFS_ENAMETOOLONG to the client instead of faulting. (Ref# 38838)
• nfsd previously became permanently blocked on a FIFO if a Neutrino NFS client attempted to create and use one. It now supports FIFOs as described in the NFS version 3 specification. The Neutrino fs-nfs2 and fs-nfs3 NFS clients don't currently support FIFO special files. (Ref# 11098)

  ---

  When using nfsd, be careful about what files are exported. If you don't have specific control over the NFS client and what files are accessed by the client, you shouldn't export directories that contain nonregular files (e.g. /dev). If these files don't have regular file semantics, nfsd may have unexpected behavior, such as becoming permanently blocked on the manager that owns the pathname.

  ---

• nfsd no longer faults if it accesses a directory pathname that's longer than 256 characters to service a NFS version 2 request. (Ref# 38441)

What's new: ARMLE, ARMBE, and SHLE gcc libraries for Windows Patch (Patch ID 238)

QNX Momentics SP2 erroneously kept version 3.3.1 of the C++ libraries when it should have updated them to 3.3.5. This patch installs the correct version of these libraries. (Ref# 38243)

What's new: Photon Screensaver Patch for the QNX Neutrino Core OS 6.3.2 (Patch ID 241)

This patch fixes a problem with the screensaver phsaver on targets running QNX Momentics 6.3.0 SP1 or SP2 with the 6.3.2 OS. It contains these files:

• target/qnx6/armle/usr/photon/savers/phattract
• target/qnx6/armle/usr/photon/savers/phmatrix
• target/qnx6/armle/usr/photon/savers/phpoly
• target/qnx6/armle/usr/photon/savers/phsplines
• target/qnx6/armle/usr/photon/savers/phtails
• target/qnx6/armle/usr/photon/savers/phpyro
• target/qnx6/armle/usr/photon/savers/puzzle
• target/qnx6/armle/usr/photon/savers/qix
• target/qnx6/armle/usr/photon/savers/rocks
• target/qnx6/armle/usr/photon/savers/sphere
• target/qnx6/armle/usr/photon/savers/flame
• target/qnx6/mipsle/usr/photon/savers/phattract
• target/qnx6/mipsle/usr/photon/savers/phmatrix
• target/qnx6/mipsle/usr/photon/savers/phpoly
• target/qnx6/mipsle/usr/photon/savers/phsplines
• target/qnx6/mipsle/usr/photon/savers/phtails
• target/qnx6/mipsle/usr/photon/savers/phpyro
• target/qnx6/mipsle/usr/photon/savers/puzzle
• target/qnx6/mipsle/usr/photon/savers/qix
• target/qnx6/mipsle/usr/photon/savers/rocks
• target/qnx6/mipsle/usr/photon/savers/sphere
• target/qnx6/mipsle/usr/photon/savers/flame
• target/qnx6/ppcbe/usr/photon/savers/phattract
• target/qnx6/ppcbe/usr/photon/savers/phmatrix
• target/qnx6/ppcbe/usr/photon/savers/phpoly
• target/qnx6/ppcbe/usr/photon/savers/phsplines
• target/qnx6/ppcbe/usr/photon/savers/phtails
• target/qnx6/ppcbe/usr/photon/savers/phpyro
• target/qnx6/ppcbe/usr/photon/savers/puzzle
• target/qnx6/ppcbe/usr/photon/savers/qix
• target/qnx6/ppcbe/usr/photon/savers/rocks
• target/qnx6/ppcbe/usr/photon/savers/sphere
• target/qnx6/ppcbe/usr/photon/savers/flame
• target/qnx6/shle/usr/photon/savers/phattract
• target/qnx6/shle/usr/photon/savers/phmatrix
• target/qnx6/shle/usr/photon/savers/phpoly
• target/qnx6/shle/usr/photon/savers/phsplines
• target/qnx6/shle/usr/photon/savers/phtails
• target/qnx6/shle/usr/photon/savers/phpyro
• target/qnx6/shle/usr/photon/savers/puzzle
• target/qnx6/shle/usr/photon/savers/qix
• target/qnx6/shle/usr/photon/savers/rocks
• target/qnx6/shle/usr/photon/savers/sphere
• target/qnx6/shle/usr/photon/savers/flame
• target/qnx6/x86/usr/photon/savers/phattract
• target/qnx6/x86/usr/photon/savers/phmatrix
• target/qnx6/x86/usr/photon/savers/phpoly
• target/qnx6/x86/usr/photon/savers/phsplines
• target/qnx6/x86/usr/photon/savers/phtails
• target/qnx6/x86/usr/photon/savers/phpyro
• target/qnx6/x86/usr/photon/savers/puzzle
• target/qnx6/x86/usr/photon/savers/qix
• target/qnx6/x86/usr/photon/savers/rocks
• target/qnx6/x86/usr/photon/savers/sphere
• target/qnx6/x86/usr/photon/savers/flame

On machines running the QNX Neutrino Core OS 6.3.2, if a screensaver is configured to require a password and you press Cancel at the screensaver's password prompt, the screensaver no longer exits. (Ref #38266)

What's new: Maintenance Patch for Filesystems (Patch ID 245)

devb-eide

The devb-eide driver in this patch supports the following chipsets:

devb-ahci

The devb-ahci supports the Intel AHCI SATA controller with the following device IDs:

• ICH-6 82801FB_SATA 0x2651
• ICH-6 82801FBM_SATA 0x2653
• ICH-7 82801GB_SATA 0x27c1
• ICH-7 82801GBM_SATA 0x27c5

---

You need to enable AHCI mode in the BIOS.

---

devb-mvSata

The devb-mvSata driver supports Vendor ID 0x11ab with the following device IDs:

Fixed issues

This patch addresses the following issues:

• io-blk.so now automounts removable media after the device has been manually unmounted. (Ref# 38394)
• Bad directory contents no longer cause fs-cd.so to run READY. (Ref# 29577)
• We've fixed some inconsistencies and oddities in how io-blk.so handles the blk automount= option in some unusual cases. (Ref# 29351)
• fs-dos.so now correct handles a FAT-hosted OS/2 filesystem. (Ref# 28811)
• io-blk.so now delays the completion of the lock mount option if no CD is currently installed. (Ref# 28037)
• chkdosfs no longer causes devb-eide to run READY in some cases. (Ref# 26855)
• We corrected a problem with the DCMD_FSYS_DIRECTIO command to devctl() that caused data-transfer errors when the filesystem's block size wasn't the same as the device-sector size. (Ref# 24149)
• Writing to a 0-sized unlinked file no longer crashes fs-ext2.so. (Ref# 22593)
• In fs-qnx4.so, if you do the following:
  1. Create a directory.
  2. Create a file.
  3. Hold that file open with O_ACCMODE.
  4. Unlink that file.
  5. Create the same filename.
  6. Close any files.

  then attempting to remove the directory no longer fails with an error of EBADFSYS. (Ref# 18786)

• fs-ext2.so no longer doubly frees groups' descriptors following an EBADFSYS mount failure. (Ref# 38632)
• fs-ext2.so now enforces the maximum length of a symbolic link to be the value specified by SYMLINK_MAX. (Ref# 38601)
• fs-qnx4.so no longer crashes when it zero-fills preallocated blocks and the write() operation to the end of file is interrupted by a signal in some cases. (Ref# 38414; Ticket ID 72461)
• io-blk.so now locks a vnode when it's created, to prevent a crash that could occur if a high-priority sync tried to use the vnode before it was initialized. (Ref# 23462)
• fs-ext2.so no longer runs READY if you try to create too many files and inodes. (Ref# 22676)
• io-blk.so now correctly honors the before and after keywords to the mount command's -o option. You can also specify these keywords on the devb-* command line, in the blk options, the way you specify ro, rw, noatime, and so on. (Ref# 19606)
• fs-ext2.so no longer deadlocks during a truncate() on a full disk. (Ref# 23791)
• On fs-ext2.so, dt no longer reports data errors with large files on a full disk. (Ref# 23718)
• fs-ext2.so no longer runs ready if it encounters invalid (0-length) directory records; it now flags them as being EBADFSYS. (Ref# 23303, 23304)
• If you try to mount a corrupt filesystem that has a bad mode for its root directory, the mount fails with an EBADFSYS error instead of crashing fs-ext2.so. (Ref# 23302)
• Attempting to grow a directory (or .inodes file) on a completely full fs-qnx4.so disk no longer leaves the directory marked as busy. (Ref# 15354)

What's new: qnx_cp for Solaris Patch (Patch ID 251)

The -c option to qnx_cp now works correctly on Solaris hosts. (Ref# 38615)

What's new: Graphics Driver Patches (Patch IDs 171 and 268)

These patches include the following:

devg-i830.so

Supports Intel 82830, 82845, 82855, 82865, 82915G, 82915GM, 82945G, and 82945GM chipsets (x86).

devg-radeon.so

Supports Radeon 9200, 9600, 9800, Mobility Mp, X300, and x600 chipsets (PPCBE, x86).

The x86 version of this driver initializes secondary cards for multicard displays.

$QNX_TARGET/etc/system/enum/devices/graphics

We updated the enumerator to detect the supported chipsets.

What's new: su and passwd Patch (Patch ID 270)

This patch addresses an issue where su and passwd would allow a buffer overrun to occur. (Ref# 29454)

What's new: IDE System Builder Patch (Patch ID 277)

The IDE's System Builder now finds the components installed in the prebuilt directory for Board Support Packages. (Ref# 39121)

What's new: Device Enumeration Patch (Patch ID 278)

• We've removed a blanket condition for enumerating PCI serial devices, so that we don't start devc-ser8250 for all of them. The new enumeration is based entirely on the vendor and device IDs, so the correct driver is started for the specific card. (Ref# 38968)
• Network drivers are no longer mounted before io-net has fully started. This was a problem mainly on multicore systems. (Ref# 38185)
• We changed enum-pnpbios so that it works properly on systems that have a partial PNP BIOS. (Ref# 29768)
• The enumerator now detects the Intel 82562 network interface on the XTX conga-XEVAL baseboard with the conga-X945 processor board. (Ref# 39895)

What's new: cpp0 2.95.3 Patch (Patch ID 280)

This patch contains an update to cpp0, the preprocessor for gcc 2.95.3. This version of cpp0 can now handle long filenames when searching the paths for include files. (Ref# 25322)

What's new: qnxactivate Patch (Patch ID 282)

This patch addresses the following issues:

• qnxactivate now lets you add new license keys. (Ref# 30028)
• The Manual Activation dialog now has a button that you can use to save the prompt key in a file, and another to load the response key from a file. This eliminates the need to retype the keys, which can be error-prone. (Ref# 38690)
• qnxactivate now uses a clearer font that should be easier to read. (Ref# 38842)

What's new: BSP Utilities Patch (Patch ID 283)

This patch contains these new utilities:

• packagebsp
• setupbsp

These utilities support a new, simplified way of packaging and installing Board Support Packages. We plan to provide a technote that describes how to use these utilities. (Ref# 28858)

What's new: io-graphics Patch (Patch ID 290)

This patch fixes the following issues:

• The io-graphics initialization sequence no longer breaks some graphics drivers, such as devg-smi7xx. (Ref# 24084)
• The io-graphics server no longer locks up Amanda PCI, MGT5200 and other boards. (Ref# 25861)
• io-graphics now supports the following wide-screen video modes:
  • WXGA (1280x800)
  • WXGA+ (1440x900)
  • WSXGA+ (1680x1050)
  • WUXGA (1920x1200)

  These are the standard display sizes for laptops with wide screens. (Ref# 25744)

What's new: Self-hosted QNX Neutrino Installation and Booting Patch (Patch ID 291)

This patch improves the way that you install and boot a self-hosted QNX Neutrino system. The improvements include:

• support for USB keyboards and mice (Ref# 23671, 25445, 39555)
• support for SATA disks (Ref# 38956)
• the ability to update the drivers on your system (Ref# 39248)
• the ability to install QNX Neutrino in partitions of type 77, 78, or 79 (Ref# 39387)
• displaying drive identifiers when you're asked to choose a drive (Ref# 39187)
• the ability to install QNX Neutrino from a second CD drive (Ref# 18982)
• The boot image for self-hosted Neutrino systems now starts io-hid and devc-con-hid, which support PS2, USB, and all other human-interface devices, instead of devc-con.

What's new: startup-bios, rtc, and pci-bios Patch (Patch ID 311)

• Neutrino now correctly reads the realtime clock on machines with the ATI IXP200 chipset. (Ref# 28363)
• We added support for the x86 NX (no-execute) page table bit. On processors that support it (AMD64, IA-32e), mmap()'d memory no longer lets you execute instructions in that memory unless you've specified the PROT_EXEC permission flag. If not specified, a SIGSEGV occurs.

  ---

  You must have installed the QNX Neutrino Core OS 6.3.2 and enable page-table extensions (with the -x startup option) in order for the NX bit to be effective.

  ---

  You can turn off support by putting -F ~0x4000 on the startup command line. (Ref# 40162)

• pci-bios runs on the Intel Wallowa board. (Ref# 40373)

What's new: Documentation Patch (Patch ID 313)

This patch contains a new version of the Building Embedded Systems guide that describes how to work with the new simplified packaging of Board Support Packages. This also includes updated versions of the Neutrino User's Guide and Utilities Reference. (Ref# 38711, 39260)

What's new: pci and pci-bios Patch (Patch ID 326)

• The pci utility wouldn't display base address registers if they contained an address of zero, so we've changed the utility to check the size of the register, rather than the address. (Ref# 40613)
• pci-bios now correctly enumerates all PCI buses, and it leaves the bus numbering as configured by the BIOS. (Ref# 40583)
• pci-bios now correctly detects all devices on the Acer Travelmate 8100. (Ref# 40974)
• pci-bios now correctly enumerates the buses on the Intel Marble Canyon board. (Ref# 40795)
• The PCI server now does some additional checks on the class code and header type because some boards misreport their bridge type. (Ref# 41331)

What's new: awk for Linux and Solaris Patch (Patch ID 332)

In QNX Momentics, awk should be a symbolic link to the GNU utility gawk. This link was missing in Linux and Solaris hosts in QNX Momentics 6.3.0, Service Pack 1, and Service Pack 2. (Ref# 40717)

What's new: qaudit.sh Patch (Patch ID 338)

We've included a qaudit.sh script that lists the QNX products that you've installed on your system. (Ref# 26136)

What's new: io-graphics Patch (Patch ID 344)

We changed the way that io-graphics starts up, so that it and devc-con no longer get locked in an infinite loop. (Ref# 40882)

What's new: input-cfg Patch (Patch ID 346)

The input-cfg program no longer says that USB wheel mice aren't supported. (Ref# 40864)

What's new: devg-i830.so Patch (Patch ID 347)

We fixed the initialization of devg-i830.so so that switching the graphic mode on a T-System no longer fails, resulting in a black screen. (Ref# 41055; Ticket ID 74381)

What's new: Device Enumerator Patch (Patch ID 359)

• The network enumerator now detects Broadcom BCM57xx chipsets with device IDs 0x1653 and 0x169c. (Ref# 40752)
• The network enumerator correctly detects Realtek 8139 PCI cards. (Ref# 41258)

What's new: qnxactivate Patch (Patch ID 361)

• qnxactivate can now accept text messages from the server that explain why activation failed, provide additional information, and so on. (Ref# 40914)

What's new: Block Drivers Patch (Patch ID 366)

devb-ahci

This driver now correctly detects the hard drive on the IBM ThinkPad T60. (Ref# 40126)

devb-eide

This driver now:

• scans for slave devices on Intel SATA controllers (Ref# 40474)
• supports UDMA modes on VT8251 (Ref# 41450)
• supports UDMA modes on AMD Geode LX800 (AMD CS5536) (Ref# 41463)
• works on the Dell Dimension 3100 (ATA mode only, not RAID) (Ref# 41505)

What's new: RCS ID Header File Patch (Patch ID 373)

When you install this patch, the following files are installed under $QNX_TARGET/usr/include:

• sys/platform.h
• sys/target_nto.h

These header files define some macros that we use to determine the version ID of the source code used in the executables on the system. (Ref# 38433)

What's new: devg-radeon.so Patch (Patch ID 381)

• We updated /etc/system/enum/graphics so that the graphics enumerator on x86 systems now detects the Fujitsu Coral-PA reference card. (Ref# 25057)
• The devg-radeon.so driver now supports the Radeon M22 (Mobility X300). (Ref# 39723)

What's new: PCI BIOS Patch (Patch ID 388)

The pci-bios server no longer loops on a CardBus device on bus 0. (Ref# 41665)

Experimental items

---

Experimental software is primarily provided for customers and the community to try out, and perhaps to get a glimpse of what might be in store for the future. For information about the use of experimental software, see the Commercial Software License Agreement (CSLA) or Partner Software License Agreement (PSLA) in the Licensing area of our website, http://www.qnx.com/legal/licensing/.

---

The experimental items in QNX Momentics 6.3.0 are:

• asynchronous messaging
• asynchronous message queues

Known issues

QNX Momentics 6.3.0 SP3 contains known issues in these areas:

• Booting
• BSPs, DDKs, and TDKs
• Compiler and tools
• Core OS: Kernel ¦ Libraries and header files ¦ Core utilities
• Device drivers: Audio (deva-*) ¦ Block-oriented (devb-*) ¦ Graphics (devg-*) ¦ Human interface devices (devh-*) ¦ Network (devn-*) ¦ USB (devu-*)
• Filesystems
• IDE (Professional Edition only)
• I/O devices
• Licensing
• Multimedia
• Network protocols
• Photon
• Utilities
• Host-specific: QNX Neutrino self-hosted ¦ Windows hosts ¦ Solaris hosts

---

We're actively investigating all known issues.

---

Known issues: Booting

• The combination of F1 and F4 for diskboot (Safe Mode, Don't mount filesystems) doesn't work. (Ref# 21876)

  Workaround: Press F5 to start the debug shell; it simply starts fesh just after mounting the filesystems. If you want to run a consistency check a filesystem, run /sbin/chkfsys after the shell starts.

• QNX Neutrino might not boot on machines with an ICH6 chipset with the hard drive on SATA, and a CD drive on EIDE. The OS detects the SATA device and then hangs on EIDE detection. (Ref# 40446)

  Workaround: We've added a new -R command-line option to diskboot and a new “Hit space...” option, F3. Using these prevents diskboot from restarting a devb- driver. The drivers are restarted if only a CD-ROM is found. In the case of this issue, the restart means devb-ahci and devb-eide compete for the same bus, which results in a hang.

• The printed 6.3.0 Service Pack 3 Installation Guide says that the configuration file for updating the disk drivers must be called drvrupdate.cfg, but it must actually be called drivers.cfg. (Ref# 40994)
• The boot image for self-hosted Neutrino systems now starts io-hid and devc-con-hid, which support PS2, USB, and all other human-interface devices, instead of devc-con. The documentation doesn't describe devc-con-hid, and the Neutrino User's Guide still says that diskboot starts devc-con. The command-line options for devc-con-hid and devc-con are similar. (Ref# 41834)
• Some Sony VAIO laptops don't assign an interrupt to a USB device; when you're booting Neutrino, you'll see some “InterruptAttachEvent failed” messages. (Ref# 41237)

  Workaround: Contact Technical Support to get a customized utility that enables the interrupts.

Known issues: BSPs, DDKs, and TDKs

• Don't use a BSP with SP1, SP2, or SP3 unless the BSP's release notes state that you should. Please contact us for more information.
• On Neutrino hosts, running the default uninstall script uninstalls both the binary and source BSP packages. (Ref# 18894)
• SH4 binaries linked with QNX Neutrino 6.2.1 or earlier generate an “illegal instruction” error on exiting when you run them on SH4A targets. Renesas changed the nop opcode between SH4 and SH4A, and some of our process-initialization files (inserted at link time) used the old form. This was fixed in QNX Neutrino 6.3.0. (Ref# 24701)

  Workaround: Relink any SH4 binaries that you linked with QNX Neutrino 6.2.1 or earlier.

• When you install a BSP or TDK on a self-hosted system, some binaries overwrite system binaries; if you install more than one BSP or TDK, it might overwrite binaries installed by another BSP or TDK. For more information, see the release notes for the BSPs and TDKs. (Ref# 25958)
• packagebsp:
  • In the shiplist files, you can't add comments to the end of a line. For example, this won't work:

    /binaries/content/file  #this is a test
      

    We do allow comments that take up an entire line, like this:

    #################
    #Binary shiplist#
    #################
    
    #/binaries/content/foo
    /binaries/content/foo2
    #end of shiplist
      

    (Ref# 29371)

  • On Windows, packagebsp prints extra newline characters when you run it with bash. (Ref# 38457)
  • Some of the options to packagebsp are in pairs; one might specify the root directory of an optional component, while another specifies the shiplist. If you specify only one of these options, packagebsp doesn't add the optional component. Instead, it should give an error message and then exit. (Ref# 38366)
  • The packagebsp script should log its complete output (both regular and error messages) to a file that you can inspect later. (Ref# 30048)
  • packagebsp doesn't make sure that you have enough disk space available in the temporary directory or the destination directory. (Ref# 29968)
• setupbsp:
  • On Windows, don't use a DOS-style relative path for the installation directory, or an error will occur during installation. For example, C:installdir is a DOS-style relative path (note there isn't a backslash after the C:). The path should always start with C:\, C:/, or /. (Ref# 38654)
  • The uninstaller that setupbsp creates removes the files that are listed in the shiplist, but leaves behind files added since you installed the BSP. (Ref# 38490)
  • If you specify the -v option for verbose output, setupbsp should send some of the output to stderr as well as to stdout. (Ref# 38453)
  • You can use setupbsp multiple to set up a BSP in different working directories, but the uninstaller that setupbsp creates removes the only instance of the documentation for the BSP the first time that you run it; it should remove the documentation only when you uninstall the last instance of the BSP. (Ref# 38363)
  • setupbsp doesn't check to make sure you have enough disk space available before setting up the BSP. (Ref# 38249)
  • The uninstaller that setupbsp creates doesn't remove any directories. (Ref# 38241)

Known issues: Compiler and tools

gcc

• If you're using gcc 3.3.5 with the deprecated GNU libstdc++ library, cout/cin doesn't work on SH targets. Use the Dinkum C++ library instead.
• MIPS C++ support with gcc 3.3.5 works only with the Dinkumware NO_EXCEPTION libraries. Anything else will generate a SIGILL error.
• On MIPS, code that uses exceptions in shared libraries generates a SIGILL or other signal. Exceptions work as expected in static libraries and executables. (Ref# 23355)
• There's an alignment issue with gcc 2.95.3, where an __attribute__((__aligned__(N))) applied to a typedef also applies that alignment to the base type. (Ref# 18662)

  For example, the following code applies an alignment of 8 to both my_long_long_t and the long long:

  typedef long long my_long_long_t __attribute__((__aligned__(8)));

  Workaround: Make a duplicate typedef of a dummy type:

  typedef long long my_dummy_t;
  typedef my_dummy_t my_long_long_t __attribute__((__aligned__(8)));

• Nested functions (i.e. one function declared inside another) aren't standard C or C++, and they can cause problems on SH and PPC platforms. We recommend that you not use GNU extensions to ANSI C; for more information, see “Extensions to the C Language Family” in the gcc documentation at www.gnu.org.
• With gcc 2.95.x and 3.x, C++ shared objects can optionally use __cxa_atexit(), which allows their destructors (normally registered with atexit()) to be called at dlclose() time. This feature isn't yet supported; as a result, you can't use dlopen() and dlclose() on C++ shared objects. (Ref# 19702)

  Workaround: Add the following to your C++ shared library:

  #include <dlfcn.h>
  
  /*
  * stick around for atexit(dtors)
  * add to common.mk:
  * CCFLAGS += -DSONAME_STR=\"$(notdir $(FULLNAME)$(VERSION_TAG_$(BUILD_TYPE)))\"
  */
  
  extern void hackslash(void) __attribute__((constructor));
  
  void hackslash(void) {
    dlopen(SONAME_STR,RTLD_NOW);
  }
      

• On most platforms, the gcc 3.3.5 options -fpic and -fPIC are synonymous, but on PPC they're different and incompatible. We chose -fpic over -fPIC for performance reasons, and our PPC OS is built that way. (Ref# 21947)

  Workaround: If you see problems (such as relocation-truncation errors) at link time when building shared objects, consider splitting your shared object into multiple shared objects.

• When you're compiling with gcc 3.3.5 for MIPS, you might get this error:

  relocation truncated to fit: R_MIPS_GPREL16
    

  (Ref# 22822)

  Workaround: Pass the -Wac,-G4 option to qcc.

• gcc 2.95.3 ignores #pragma pack() directives for global structures on the ARM platform. For example, the structure in this code is still padded to 8 bytes instead of the expected 5:

  #pragma pack(1)
  struct five {
      unsigned char a;
      unsigned b;
  };
  
  struct five five;

  (Ref# 5151)

  Workaround: This problem doesn't affect code generated with gcc 3.3.5.

• Both gcc 2.95.3 and 3.3.5 report parsing errors for seemingly simple code. (Ref# 20409)

  Workaround: See “Parse errors for simple code” in gcc.gnu.org/bugs.html#known.

• If you use the -Os option with gcc 3.3.5 to optimize for size, you might get some compile errors. This issue will be fixed in gcc 3.4. (Ref# 19955, 21347).

gdb

• Watchpoints don't work on the Freescale 8540ADS and Lite5200 platforms. (Ref# 21293)
• Black-box regression tests for watchpoints fail for ARM targets. It appears that the watchpoint isn't correctly set. (Ref# 25599)
• If you have two breakpoints exactly one instruction apart, the second breakpoint won't stop the debugger. (Ref# 20833)

  Workaround: Disable breakpoints in code that you're single-stepping through.

• gdb may display a “Compiled with unknown debugging format” warning when debugging binaries compiled with gcc 3.3.5. This doesn't seem to affect the debugger in any way. (Ref# 20658)
• If you run gdb over phditto, gdb hangs, because the Photon server spawned by phrelay inherits phrelay's set of ignored signals including SIGUSR1, which gdb relies on. (Ref# 24817)

  Workaround: Launch pterm windows using pwm's Desktop Menu (press Alt-Enter or right-click on the desktop background) instead of using the Terminal button on the shelf. Only pterm windows started by shelf inherit the ignored SIGUSR1.

  Another option is to write a wrapper around gdb to reset SIGUSR1.

• On SH4 targets, gdb sometimes displays “finish meaningless on outermost frame” when trying to step out of a DLL if stop-on-solib-events is on. (Ref# 21502)

  Workaround: Disable stop-on-solib-events, or download the newer version of gdb from our website; log into your myQNX account, then go to Prerelease Software-->Trial Software-->Trial Software - QNX Momentics 6.3.x-->GDB 6.2.1 Experimental Release in the Download Center.

• If you reset your target board while you're debugging from the Windows-hosted IDE, and you've clicked Terminate and remove in the IDE Debug view, the ntoCPU-gdb.exe process may run ready, consuming 100% of CPU. (Ref# 25174)

  Workaround: There is no workaround (other than not following this sequence of events). If gdb does run ready, you must terminate it from the Windows Task Manager. This problem will be fixed in a future version of gdb; you can get an experimental version from the Download Center on our website; look under Prerelease Software-->Trial Software-->Trial Software - QNX Momentics 6.3.x.

ld

• Between the 2.10.1 version of the GNU linker in QNX Momentics 6.2.1 and the 2.12.1 version in QNX Momentics 6.3.0, a bug was fixed in the handling of relocation addends for SH targets. As a result of this fix, SH startup binaries (e.g. startup-systemh) that were created prior to QNX Momentics 6.3.0 won't work correctly if included in a boot image generated in QNX Momentics 6.3.0.

  Workaround: Rebuild the startup binary using QNX Momentics 6.3.0. The resulting startup will work with both 6.2.1 and 6.3.0.

• Version 2.12.1 of ld produces bad R_386_NONE relocations if you're using gcc 2.95.3 and C++ to build shared objects. (Ref# 20433)

  Workaround: SP3 also includes version 2.10.1, and the qcc configuration files have been set up to use the older linker only if you're using gcc 2.95.3 and C++ to build shared objects.

make

• The Windows version of make doesn't work with UNC paths, such as //some_machine/dir. (Ref# 24202)

  Workaround: Use drive-letter mountpoints instead.

• Our recursive makefiles use the value of the NAME environment variable (if set) to name the resulting binary. We realized (too late) that this was too generic a variable to use for this purpose; if you have a NAME environment variable set on your system for some other purpose (e.g. your name or email address), its value will be used as the name of your binaries. We apologize for this mix-up. (Ref# 29843)

  Workaround: Unset the NAME environment variable before you build any executables.

qcc

• In order to use gcc 3.3.5's support for the PPC Altivec extensions, add this option:

  -I $QNX_HOST/usr/lib/gcc-lib/powerpc-unknown-nto-qnx6.3.0/3.3.5/include
    

  to the qcc command line. This tells qcc where to find the <altivec.h> header file. GCC doesn't need this workaround, as it knows to search its own include directories. (Ref# 26109)

• We're deprecating the -M option as of QNX Momentics 6.3.0. In 6.4, qcc will use -M for generating Makefile dependencies. (Ref# 26693)

qcp

The qcp utility works only on x86 platforms. (Ref# 9500)

usemsg

If you use usemsg to add versioning information or a usage message to a binary that has had a stack size set with the -N option to qcc, sometimes the stack-size modification is lost. (Ref# 25103)

Workaround: Pass the -l option to usemsg.

Windows-specific

• The IDE and tools suffer from performance problems when installed on a Windows workstation with Novell client software. The problem also affects all Cygwin applications. (Ref# 21730)
• Because of recent changes to the Cygwin library, you can't use COM1 as the port name for serial debugging under Windows. Instead, you must use /dev/com1.
• The usemsg.exe utility might not be able to find the required files. (Ref# 21881)

  Workaround: Make sure the QNX Momentics Cygwin is in your PATH before the “real” Cygwin, or delete the Cygwin make.

Known issues: Core OS

Kernel

procnto

• Specifying the -as option to procnto on SH platforms is the same as specifying -ad, not -ae as stated in the Utilities Reference. (Ref# 22858)
• Physical memory fragmentation can occur when a lot of threads are created and remain alive for a period of time before most of them are destroyed. This fragmentation might cause problem for device drivers that need physical, contiguous memory (passing the MAP_PHYS flag to mmap()) for DMA and other device-related operations.

  This problem doesn't affect normal memory allocation, such as that using malloc(). When physical, contiguous allocations fail, malloc() and other normal memory-allocation operations still work. Also, this problem describes a situation when it isn't possible to allocate 4 MB physical, contiguous memory in a system that has 64 MB RAM. It may still be possible to allocate small chunks of physical, contiguous memory. As most device drivers need only small chunks of physical, contiguous memory (e.g. 32 KB), this problem may not be a concern for them either.

  When creating a thread, the OS kernel uses _smalloc() to allocate memory for various internal data structures called objects. When the thread is destroyed, the kernel releases the memory to a pool of free objects for reuse the next time an object is needed. When a free-object pool reaches a certain size, the OS releases objects directly back into a kernel memory pool that only the kernel uses. The kernel does not return the memory to the free pool of general memory that all the processes in the system use. Physical memory can get fragmented when kernel holds on pages of memory here and there; eventually large (4 MB and greater) physical, contiguous allocations could start to fail. (Ref# 16405)

  Workaround: Reserve enough physical contiguous memory before hand to make sure it's always available when needed.

• The 74xx series PPCs with a 60x bus (not MBX) don't support 16-byte bus transactions. This limitation can cause unexpected alignment exceptions when using Altivec instructions to/from uncached memory regions. Symptomatic of this issue, passing messages to or from uncached memory regions can result in a kernel crash, due to the 60x bus limitation. (Ref# 14878)

  Workarounds:

  • Don't pass messages to or from uncached memory regions.
  • Disable the PPC_CPU_ALTIVEC feature flag in startup-* code to avoid using Altivec instructions in a message pass. (This also means that the OS won't save and restore the Altivec register set on a context switch.)
• On Broadcom MIPS BCM1250 and BCM1125 chips, the startup program doesn't add cache callouts for the onboard L2 cache. This causes msync() operations that attempt to flush the cache not to force the data all the way to main memory. This isn't normally a problem, because the L2 cache uses a bus-snooping protocol and maintains consistency with the main memory anyway. You might have problems if you have the same region of memory mapped both with and without the PROT_NOCACHE attribute. (Ref# 21855)
• Programs that you execute in place (XIP) in an image filesystem (IFS) on PPC targets might randomly crash in rare cases.

  PPC targets have separate caches for data and instructions. If the IFS is copied (or decompressed) when the data cache is enabled, the startup needs to flush the data cache. The kernel maps in the code or data segment directly from IFS for XIP; if the cache isn't flushed, the instruction cache may be loaded incorrectly, because it's loaded from the underlying memory directly, which may be different from the contents in the data cache.

  As the first-level data cache size is relatively small, the chance of running into this problem is low. We haven't seen any such crash in our kernel regression tests, and we aren't aware of any problem report from customers or internal sources which may be related to this problem. (Ref# 24783)

  Workaround: If you aren't using a mini-driver, you can add the following code segment to the startup program startup/lib/ppc/cpu_startnext.c to flush the data cache for IFS areas:

  void cpu_startnext(uintptr_t eip, unsigned cpu) {
  
      unsigned start, size, vaddr, dcache_linesize;
     
      /* First, flush the cache for ifs so that kernel can load executables
         from it without problems.
      */
  
      dcache_linesize = 1 << ppcv->cache_lsize;
      start = shdr->image_paddr + shdr->startup_size;
      vaddr = start & ~(dcache_linesize - 1);
      size = shdr->imagefs_size + (start - vaddr);
   
      for( ;; ) {
          icache_flush(vaddr);
          if(size <= dcache_linesize) break;
          vaddr += dcache_linesize;
          size -= dcache_linesize;
  }
      

  If you're using a mini-driver, please contact us for a fix.

• When you're debugging an application on a system that's using floating point emulation (i.e. you passed -fe to procnto), attempts to step over floating point instructions cause the system to hang. (Ref# 26049)

  Workaround: Don't use floating point emulation, or don't step over floating point instructions (use a run-to-breakpoint instead).

procnto-smp

• If you use pipelines or setpgid() on a termination process, procnto-smp can become deadlocked. You have to reboot your machine to recover. (Ref# 23481)
• When using floating point emulation on MIPS processors, internal filesystem sanity tests have resulted in SIGILL exceptions. This problem doesn't occur if you use a hardware floating point unit. (Ref# 25206)
• An internal test of terminal access control fails on x86 SMP. (Ref# 24948)
• A test of mutexes on an SMP x86 platform case may cause a reboot. The test case in question produces a high degree of resource contention in order to test the reliability of the mutual-exclusion mechanisms within the OS. It does this by creating several resources with multiple threads per resource, each contending for that resource. On a four-way SMP x86 system, this test case has caused, on rare occasions, the system to unexpectedly reboot. At the time of the reported failure, there were 11 resources and 79 competing threads per resource. (Ref# 24938)

mq

If you use the instrumented kernel to trace events while you're using mq, emitting _NTO_TRACE_COMM_SMSG communication-class events might cause your application to crash with an EFAULT when it calls mq_send(). We've encountered this problem on SHLE boards. (Ref# 38082)

Workaround: Filter out the _NTO_TRACE_COMM_SMSG events by doing one of the following:

• On the command line, filter out all COMM-class messages by passing the -F6 option to tracelogger.
• In your application, filter out COMM_SMSG messages by calling:

  TraceEvent( _NTO_TRACE_DELEVENT, _NTO_TRACE_COMM, _NTO_TRACE_COMM_SMSG);
      

• In the IDE, filter out COMM_SMSG messages with qconn by selecting the Class Specific mode in the System Profiler Configuration dialog, then selecting the Communication tab, selecting the Event Specific mode, and then disabling Send Message.

The side effect of filtering out these events is that the IDE's System Profiler won't be able to show you any message-passing.

Time zones

The USA is changing its time zone rules, effective 2007, enacted as part of the Energy Policy Act of 2005. While the standard rule will change across all states, US states will still have the right to choose not to observe it, per the Uniform Time Act of 1966.

This has ramifications not just for self-hosted QNX Momentics installations; the effects of this change on in-use runtime systems also needs to be considered. For example:

• The default values you use for DST may need to be changed for the USA locales (/etc/timezone/uc_tz_t, /etc/TIMEZONE).
• Specific rules that determine the time zone in any applications that deal with localization will need to be changed.

(Ref# 40378)

Libraries and header files

Bessel functions

According to POSIX 1003.1, the Bessel functions — j0(), j1(), jn(), y0(), y1(), and yn() — should be declared in <math.h>. They currently aren't declared in any header, but the functions are in libbessel.a and libbessel.so. (Ref# 23554)

Workaround: Declare them in your program; for the correct prototypes, see the entries for these functions in the Neutrino Library Reference.

asctime(), ctime(), gmtime(), and localtime()

These functions return a time in one of two static buffers (either a tm structure or an array of type char). Calling any of these functions can change the data in both these buffers. The documentation needs to make this clear. (Ref# 24716; Ticket ID 69174)

calloc_ram()

The prototype for this startup-library function is incorrect in the Customizing Image Startup Programs chapter of Building Embedded Systems. (Ref# 23448)

The prototype should be:

paddr32_t calloc_ram (size_t size,
                      unsigned align)

chroot()

The entry for this function in the Neutrino Library Reference incorrectly states that the effective user ID of the process must be the superuser to change the root directory. (Ref# 22761)

ELF64_R_INFO()

The definition of this macro is incorrect in <sys/elf.h>. It uses Elf32_Xword() instead of the Elf64_Xword() macro. (Ref# 40936)

Workaround: Edit the header file and change this line:

#define ELF64_R_INFO(s,t)	((((Elf32_Xword)(s))<<32) | ((Elf64_Xword)((t)&0xffffffff)))
  

to this:

#define ELF64_R_INFO(s,t)	((((Elf64_Xword)(s))<<32) | ((Elf64_Xword)((t)&0xffffffff)))
  

ENDIAN_*()

If the <cpuinline.h> file for a given processor family doesn't contain an implementation for __cpu_endian_ret*(), an application reverts to an implementation of the ENDIAN_*() macros defined in <gulliver.h>, which may have unintended side effects when used on device memory. Since the value is read multiple times, multibyte register devices that have clear-on-read behavior generate erroneous values. The implementation also isn't optimal, in that the memory location may be read several times. (Ref# 22140)

FILE* I/O functions

If a FILE* stream is placed into unbuffered mode (so theoretically all writes should physically happen immediately and any failures be detected), the low-level functions correctly indicate the errors, but the FILE*-oriented output functions (fwrite(), fprintf(), etc.) don't propagate these errors back as their return values. For example, if there's no space left on the disk, these functions don't indicate that an error has occurred. (Ref# 19598)

Workaround: Use the file-descriptor I/O functions instead, or call ferror() to check for errors after each call to fwrite(), fprintf(), and so on.

fork()

• Physically contiguous areas aren't preserved across a fork(). If one process does a mmap() with MAP_ANON|MAP_PHYS to obtain a physically contiguous memory (drivers and the like), and then forks, the child process (which is supposed to be a duplicate of the parent) actually doesn't enforce contiguous areas when copying the parent's mappings. (Ref# 17531)
• If you do a mmap() with MAP_ANON|MAP_SHARED with permissions of PROT_NONE, and use mprotect() to change a single page to PROT_READ|PROT_WRITE, and then fork(), the permissions of the MAP_ANON|MAP_SHARED mapping are not set per-page, but are reset to the default when the mmap() was first done, PROT_NONE. (Ref# 24585)

  Workaround: In the parent process, set the appropriate permissions when you create the mapping, or in the child process, use mprotect() to explicitly establish the mapping's protection attributes.

• In extremely limited cases, it's possible that a call to fork() may fail and set errno to EINTR. This issue is limited to only x86, PowerPC, and SH architectures and usually occurs only when stacks have dynamically allocated all backing store (e.g. a 512 KB stack has 512 KB memory allocated) through heavy stack usage followed by a call to fork(). (Ref# 18408)

getgrouplist()

The list of groups that this function creates still includes the group ID that you pass as the basegid argument. Typically, you pass the group number from the password file for this argument. (Ref# 15547)

ham_action_fail_notify_pulse(), ham_action_fail_notify_pulse_node(), ham_action_fail_notify_signal(), ham_action_fail_notify_signal_node()

The prototypes for these functions are incorrect in the High Availability Toolkit Developer's Guide, and the names of ham_action_fail_notify_pulse_node() and ham_action_fail_notify_signal_node() are wrong. These functions all return an int. (Ref# 26253)

libc

The following functions are included in libc.a, but not in libc.so (to save space), but the documentation doesn't mention this. (Ref# 26866)

• alphasort()
• brk()
• cfgopen()
• crypt()
• encrypt()
• entutent()
• fcfgopen()
• forkpty()
• ftw(), ftw64()
• getgrouplist()
• getlogin(), getlogin_r()
• getpass()
• getutent()
• getutid()
• getutline()
• getwd()
• getw()
• globfree()
• glob()
• hwi_find_item()
• hwi_find_tag()
• hwi_next_item()
• hwi_next_tag()
• hwi_off2tag()
• hwi_tag2off()
• initstate()
• inputline()
• intr_capture()
• intr_lock()
• intr_release()
• intr_timed_wait()
• intr_unlock()
• intr_wait()
• login_tty()
• modem_open()
• modem_read()
• modem_script()
• modem_write()
• nftw(), nftw64()
• openpty()
• pclose()
• popen()
• pututline()
• putw()
• qnx_crypt()
• random()
• rdchk()
• re_comp()
• re_exec()
• regcomp()
• regerror()
• regexec()
• regfree()
• sbrk()
• _scalloc()
• scandir()
• sched_get_priority_adjust()
• setkey()
• setstate()
• setutent()
• _sfree()
• slogb()
• slogf()
• slogi()
• _smalloc()
• srandom()
• _srealloc()
• utmpname()
• vslogf()
• wordexp()
• wordfree()

libmalloc

• When using libmalloc_g, if you enable MALLOC_FILLAREA and MALLOC_CKCHAIN and do too many heap over- or underruns, then your process may fault. This occurs because the underruns and overruns may corrupt the metadata associated with heap allocations. Once the heap is corrupted, the reliability of the checking is also compromised. This is described in the section on libmalloc_g in the Neutrino Programmer's Guide. (Ref# 24428, 23322)
• The libmalloc implementation of string.c may corrupt the heap on PPC targets. (Ref# 24394)
• An internal string.c test case fails for the libmalloc string implementation. The libmalloc implementation of strcmp() and strncmp() incorrectly compares the two strings based on the difference between the characters treated as signed values instead of the difference between the characters treated as unsigned values. (Ref# 24369)
• mprobe() sometimes causes the caller to fault. (Ref# 24423)
• The libmalloc macro DH_ULEN() always returns 0 because of a bug in the definitions in the header files. If MALLOC_GUARD is undefined, DH_ULEN() is defined to be 0 in <malloc_g/malloc-lib.h>. If your code also includes <malloc_g/malloc.h>, the file explicitly undefines MALLOC_GUARD before including <malloc_g/malloc-lib.h>, resulting in the DH_ULEN() value of 0. (Ref# 24454)

  Workaround: Include <malloc_g/malloc.h> after <malloc_g/malloc-lib.h>, as follows:

  #define MALLOC_DEBUG
  #define MALLOC_GUARD
  #define MALLOC_PC
  #include <malloc_g/malloc-lib.h>
  
  ... other includes/code that depends on MALLOC_GUARD ...
  
  #include <malloc_g/malloc.h>
      

• Memory traces may incorrectly show that allocations made before main() are associated not with a particular function, but possibly with a variable name. (Ref# 19486)
• When you're using the libmalloc library, stack information for memory events is implemented only for x86, PPC, and SH4 architectures. The result is that line-number information and call traces aren't available for display when memory events occur on other architectures. This is a feature deficiency and will be corrected in a future release. The offset within the function where the event occurred is provided. (Ref# 12611)
• The libmalloc backtrace information is missing for architectures other than x86, PPC and SH4. This will be implemented in future release. (Ref# 25393)

MsgSend(), memcpy()

A regression test fails for PROT_NOCACHE memory. (Ref# 24709, 21505)

name_attach()

In QNX Momentics 6.2.1B, the name_attach() server side never had to handle any _IO_* messages, but could set an error code of ENOSYS for them all. In 6.3.0, an _IO_CONNECT message is sent when the client does a name_open(); if the server doesn't reply with an EOK, the client fails to connect to the server. This message is needed in the remote case to force the establishment of the network link, and to determine that the server is actually there. (Ref# 20507)

Workaround: Add code to the server to handle this message. For an example, see the online documentation for name_attach() in the Neutrino Library Reference.

pipe()

• When there are multiple writers to a pipe and the O_NONBLOCK flag is clear, a write of less than PIPE_BUF bytes into a full pipe could cause loss of data in the particular write even though the write returns with no error. (Ref# 20220)
• When there are multiple readers and writers to a pipe, and reader/writer processes terminate repeatedly, the pipe manager may fault. (Ref# 20128)

pthread_cond_timedwait(), pthread_cond_wait()

The documentation for these functions should include the following (Ref# 27051):

If a thread that's blocked on a condition variable is canceled, the thread reacquires the mutex that's guarding the condition variable, so that the thread's cleanup handlers run in the same state as the critical code before and after the call to this function. If some other thread owns the lock, the canceled thread blocks until the mutex is available.

---

Make sure that the thread's cleanup handlers unlock the mutex.

---

RPC Library (librpc.so, librpc.so.2, librpc.a, librpcS.a)

If all available memory is exhausted, the RPC library can potentially fault if a malloc() call fails during the first execution of either a clnt_broadcast() call or a rpc_broadcast() call. Memory corruption may occur if all thread-specific data keys are exhausted before the RPC library functions have been called. (Ref# 21945)

spawn()

On ARM targets with low-memory conditions, attempts to create a new process may result in an EINTR error instead of ENOMEM as might be expected. This happens when, during process creation, attempts to fault in the stack result in an out-of-memory condition, at which point a SIGBUS is delivered to the process, causing it to return EINTR. If the out-of-memory condition is detected before the stack is allocated, ENOMEM is returned. (Ref# 24406)

<stdio.h>

A duplicate declaration of vsnprintf() causes compile warnings. (Ref# 21880)

sysconf()

The value that sysconf( _SC_OPEN_MAX ) returns might not be correct if you've used the -F option to procnto to change the maximum number of file descriptors per process. (Ref# 16966)

tempnam()

The entry for tempnam() in the Neutrino Library Reference doesn't accurately describe how the function determines the directory portion of the temporary file's name. (Ref# 27332)

Workaround: See the entry for tmpnam(); this function and and tempnam() use the same method for determining the directory.

---

The tempnam() function's behavior doesn't conform to POSIX.

---

vfork()

Internal testing causes a kernel crash on x86, ARM, and PPC platforms. (Ref# 24952)

Core utilities

mkefs, mkefts, and mkifs

The documentation for these utilities incorrectly says that if you specify a perms attribute of * for a file, the host file's permissions are used, and that for an inline file, the permissions are obtained from the umask of the user running mkefs. The actual permissions used are 0666. (Ref# 22371)

mkefs

Under Windows, if you redirect the output from mkefs to a file, the end-of-line characters will be DOS-style (CR, LF) instead of UNIX-style (CR). (Ref# 19065)

Workaround: Under Windows, use this syntax:

mkefs buildfile outputfile
  

instead of redirecting the output:

mkefs buildfile > outputfile
  

mkifs

• Executables compiled with the -Nstacksize option and then included in images built using mkifs don't (by default) use the stacksize parameter. (Ref# 23573)

  Workaround: Specify [+raw] in the build file for any executables that you compiled with the -Nstacksize option. For more information about the raw attribute, see the entry for mkifs in the Utilities Reference.

• The documentation for mkifs doesn't describe the difference between the raw.boot and binary.boot bootfiles. (Ref# 39923)

  Workaround: Here are descriptions:

  raw.boot

  Create a binary image with an instruction sequence prepended to it to jump to the offset of startup_vaddr within the startup header. The advantage is that when you download a raw image to memory using a bootloader, you can then instruct it to run right at the beginning of the image, rather than having to figure out what the actual startup_vaddr is each time you modify the startup code.

  binary.boot

  Create a simple binary image without the jump instruction. If you build a binary image, and you want to load it with U-Boot (or some other bootloader), you have to execute mkifs -vvvv buildfile imagefile, so that you can see what the actual entry address is, and then pass that entry address to the bootloader when you start the image. If you modify the startup code, the entry address may change, so you have to obtain it every time. With a raw image, you can just have the bootloader jump to the same address that you downloaded the image to.

QNX_HOST, QNX_TARGET

The development environment variables (QNX_HOST, QNX_TARGET, etc.) aren't set if you have a login shell other than the default (sh). This environment is picked up automatically from /etc/profile.d/qnxsdk.sh but if SHELL is set to ksh, then /etc/profile looks for *.ksh in the directory instead of *.sh and finds nothing. (Ref# 24660)

Workaround: Copy /etc/profile.d/qnxsdk.sh to /etc/profile.d/qnxsdk.ksh.

rtc

To enable reading from the RTC on a machine with a ServerWorks chipset on it (observed on a SuperMicro SuperServer 8060), you must first set the OS date and then set the RTC from the OS date:

# date 200607191700
Wed Jul 19 17:00:01 EDT 2006
# rtc -s hw
  

(Ref# 26324)

startup-bios

• Don't use the -x option on machines that don't support extended addressing, or else pci-bios won't start. (Ref# 40404)
• The -I option isn't described in the documentation. (Ref# 24418)

  Workaround: Here's the description:

  -I irq

  Make irq the highest-priority hardware interrupt in the system. You can specify a number from 0 through 7 (the default is 3).

tracelogger, traceprinter

• In the previous version of tracelogger, if you specified a duration for the log (with the -s option), then the number of iterations logged was unlimited. With the new version, the number of iterations logged is left at the default, 32. (Ref# 26823)

  Workaround: If you're using the -s option, add the -n0 option.

• The entries for tracelogger and traceprinter in the Utilities Reference are out-of-date. (Ref# 26514)

  Workaround: See the System Analysis Toolkit User's Guide for the correct documentation.

• We've seen some kernel crashes when running regression tests using tracelogger and the procnto-800-instr instrumented kernel on Motorola RPX Lite boards. We haven't been able to reproduce these crashes outside the regression environment; they might be caused by memory exhaustion. (Ref# 26507)

  Workaround: Be cautious when running tracelogger on procnto-800-instr kernels under low-memory conditions.

Known issues: Device drivers

Audio device drivers (deva-*)

• The graphics drivers run at a higher priority than applications, but they shouldn't run at a higher priority than the audio, or else breaks in the audio occur. (Ref# 4026)

  Workaround: Use the on command to adjust the priorities of the audio and graphics drivers.

Block-oriented drivers (devb-*)

devb-*

High-priority threads can get starved off by lower ones via devb-* because the filesystem uses sleepon_*() functions, which don't inherit priorities. (Ref# 2109)

devb-adpu320

Reading DVD-RAM causes devb-adpu320 to become blocked on a CONDVAR. (Ref# 19772)

devb-doc, devb-doc3, dformat, dformat3

The Disk On Chip drivers were provided by the vendor. If you run use -i on them, the state is given as Experimental. (Ref# 23101)

devb-aha8

You can't restart this driver on IBM PPC405 boards. (Ref# 16018)

devb-ncr8

This driver supports the NCR53c810, NCR53c815, NCR53c820, NCR53c825, NCR53c860, NCR53c875, NCR53c885, NCR53c895, and NCR53c896 PCI SCSI adapters. The list in the documentation is incomplete. (Ref# 22482)

devb-umass

The documentation and usage message say to use the devnn option to specify the USB address of the device. The correct name of the option is devno. (Ref# 24347)

devb-eide

DMA modes don't work on these drives:

• Hitachi-LG Data Storage DVD WRITABLE/CD-RW DRIVE, ROM VER.E111, May 2006
• Toshiba Samsung Storage Technology TS-H352C/DELH, DE02, May 2006

(Ref# 41600)

Graphics drivers (devg-*)

• The following drivers are shipped only with the appropriate BSPs:
  • devg-pxa250.so
  • devg-q2sd.so
  • devg-rpxlite.so
  • devg-sa1110.so

  but their entries in the Utilities Reference don't say so. (Ref# 18023)

• Starting Photon with multiple cards fails after running crttrap trap. When running crttrap trap, devg-vesabios.so will put the secondary card in a bad state, causing devg-radeon.so to fail to initialize (Ref. #39511).

  Workaround: Do the following:

  • Boot into text mode.
  • Run crttrap trap.
  • Configure the system to start both cards.
  • Reboot before starting Photon.

  After this, you should be able to start and stop Photon on both cards properly.

  You'll need to follow the steps above only if you run crttrap trap again.

• All graphics drivers hang while trapping on (discontinued) Abit IS-20 (865GV) motherboards because of an issue in the BIOS. (Ref# 39626)

  Workaround: Use the onboard graphics controller instead. If you set the onboard display as the primary controller, any installed PCI graphics cards will still be detected / trapped.

• The planar YUV overlay format doesn't work properly in the devg-radeon.so driver. (Ref# 29014)
• If you have more than 512 MB of system RAM, the devg-radeon.so driver won't work. (Ref# 29339)

  Workaround: Reduce the system RAM to 512 MB or use the devg-vesabios.so graphics driver.

• The devg-radeon.so driver doesn't work properly on ViewSonic VP2030b monitors; none of the resolutions work. (Ref# 41905)

  Workaround: Use the devg-vesabios.so graphics driver instead.

Human interface device drivers (devh-*)

• If you press several keys at once on some Microsoft keyboards, the keyboard doesn't produce any indication when you release the keys. As a result, the input driver thinks you're still holding the keys down. For more information, see http://support.microsoft.com/kb/909528/en-us. (Ref# 40611)
• Autorepeat doesn't currently work on ViewSonic 10191 USB keyboards. (Ref# 41118)
• Pressing the space bar on a ViewSonic 10191 USB keyboard when the system displays the “Press space bar to input boot options” message doesn't work. You get the menu only after the EIDE enumeration is done.

  If you also have a Microsoft USB mouse connected, you get a “devh-usb.so - Unable to attach to USB device 1 (10)” message. (Ref# 41122)

Network drivers (devn-*)

devn-asix.so

This driver doesn't support the 1000 MB/s interface of the Linksys Gigabit USB Adapter (model no. USB1000). (Ref# 38115)

Workaround: Force the driver to use speed and duplex settings that it supports (10 and 100 Mbit/s).

devn-i82544.so

• If you use more than 64 Tx descriptors, the PPC version of the driver is inoperative. (Ref #22848)

  Workaround: We've temporarily changed the PPC version of this driver to use 64 Tx descriptors by default (on other targets, the default is 128). This may result in lost packets for high-throughput transmit operations.

• There appear to be endian issues with the devn-i82544.so driver on PPC; the following values are reported incorrectly (Ref# 22854):
  • hardware checksumming: netstat -p event counts
  • nicinfo Tx/Rx packet counts.

devn-ne2000

The documentation for devn-ne2000 now includes the did, pci, and vid options, but the usage message hasn't been updated. (Ref# 20914)

devn-pcnet.so

• This driver doesn't support Fiber PCNET cards with the AM79C971KC chip. (Ref# 12497)
• We don't recommended that you use devn-pcnet.so on the BCM1250 platform, because it can lose receive interrupts. (Ref# 29714)

devn-pegasus.so, devn-rtl8150.so

Slaying io-net with the devn-pegasus.so and devn-rtl8150.so drivers isn't always successful. (Ref# 28602)

Workaround: Use kill -9 instead to kill io-net.

devn-rtl8150.so

• On the SH platform, the lan= option gets overridden. (Ref# 29285)

  Workaround: Fully specify the vendor ID, device ID, bus number, and device number to the driver when starting (e.g. vid=0x0bda,did=0x8150,busnum=1,devnum=2,lan=2).

• Multicast and promiscuous modes for the rtl8150 driver aren't currently supported. (Ref# 29352)

devn-smc9000

Not all IPv6 multicast protocols function properly with this driver. (Ref# 21720)

devn-tigon3.so

This network driver on the Dell PowerEdge 850 board will run only up to 100 Mbit/s, and not 1000 Mbit/s. Other boards work well at 1000 Mbit/s. (Ref# 39355)

USB drivers (devu-*)

• The PCI-USBNEC101-5P-1 controller card won't allow at least the following boards to boot: SystemH, EDOSK7780, BCM1x80. (Ref# 29496)

Known issues: Filesystems

• The fs-pkg filesystem isn't designed to let you use chmod or chown on “virtual” fs-pkg directories. (Ref# 9552)
• The documentation doesn't describe how you can change the order of resolution for filesystems that are mounted at the same mountpoint. (Ref# 38426)

  Workaround: Here's the description:

  Generally the order of resolving a filename is the order in which you mounted the filesystems at the same mountpoint (i.e. new mounts go on top of or in front of any existing ones). You can specify the order of resolution when you mount the filesystem. For example, you can use:

  • the before and after keywords for block I/O (devb-*) drivers, in the blk options
  • the -Z b and -Z a options to fs-cifs, fs-nfs2, and fs-nfs3

  You can also use the -o option to mount with these keywords:

  before

  Mount the filesystem so that it's resolved before any other filesystems mounted at the same pathname (in other words, it's placed in front of any existing mount). When you access a file, the system looks on this filesystem first.

  after

  Mount the filesystem so that it's resolved after any other filesystems mounted at the same pathname (in other words, it's placed behind any existing mounts). When you access a file, the system looks on this filesystem last, and only if the file wasn't found on any other filesystems.

  If you specify the appropriate before option, the filesystem floats in front of any other filesystems mounted at the same mountpoint, except those that you later mount with before. If you specify after, the filesystem goes behind any any other filesystems mounted at the same mountpoint, except those that are already mounted with after. So, the search order for these filesystems is:

  1. those mounted with before
  2. those mounted with no flags
  3. those mounted with after

  with each list searched in order of mount requests. The first server to claim the name gets it. You would typically use after to have a filesystem wait at the back and pick up things the no one else is handling, and before to make sure a filesystems looks first at filenames.

Known issues: IDE (Professional Edition only)

• For MIPS only, the dietitian can't shrink the socket library because the library exports symbols that should be resolved in the C library. This problem (Ref# 12394) was fixed on all platforms except MIPS. (Ref# 15986)
• If you check out an existing PhAB project from CVS, the IDE starts PhAB before checking the project out. PhAB creates some directories, and then the CVS checkout says that the files already exist. After telling the IDE to replace the files with the ones from CVS, PhAB still thinks that it's the old set of widgets (empty project).

  Workaround: To check out projects from CVS, use Check out Project, and then convert the projects; don't use Check out as..., which generates invalid configurations. (Ref# 18405)

• The IDE has problems when projects are located in a remote (network drive) directory, and the network isn't reachable. (Ref# 11719)

  Workaround: Close any project that you created on a remote drive before disconnecting the drive.

• The IDE incorrectly lets you choose the Intel C Compiler (icc) for non-x86 targets such as PowerPC or MIPS. (Ref# 22636)

  Workaround: Build only x86 variants with ICC.

• The System Profiler in the IDE requires a minimum color depth of 16 bits. Otherwise, the timelines might appear to be blank. (Ref# 23763)
• Opening a PhAB 6.2.1 project in the 6.3 IDE or PhAB converts it to a 6.3 project, which then won't run correctly if compiled for a 6.2.1 target. (Ref# 24298)

  Workaround: If you're using the coexistence feature in the IDE to target Neutrino 6.2.1, you should set the IDE to open the 6.2.1 version of PhAB. To do this, change the Path to Photon Appbuilder setting on the Appbuilder preferences dialog (Window-->Preferences-->QNX-->Appbuilder).

• If you have a source file that contains some classes, and you open them in the Open Type Hierarchy view, then make some changes in the source file (e.g. moving a class into or out of a namespace), save the changes, make sure the indexer kicks in, and then reopen the same class in the Hierarchy view from the Outline view, an error message pops up, and a null-pointer exception is generated. The view becomes unusable. (Ref# 24999)

  Workaround: Restart the IDE.

• The Application Profiler can attribute CPU time to the wrong line if you're profiling code that has profiling and debugging information, and that you linked against a static library that doesn't have profiling and debugging information. (Ref# 21024)

  Workaround: Build everything with debugging information, or use -gdwarf-2 instead of -gstabs with gcc 2.95.3.

• In the Debugger, the this pointer is listed twice in the Debug Variables view. This is a benign error. (Ref# 20063)

  Workaround: If you compile with gcc 3.3.5, the second entry doesn't appear.

• If you set the Save automatically before build option for a project, and you change one of the project's files, the file is saved if the project is selected in the tree, but not if the file is selected. This is a bug in Eclipse 3.0; see https://bugs.eclipse.org/bugs/show_bug.cgi?id=75063. (Ref# 25866)
• If you select a number of lines in the C/C++ editor, and then press Tab, the editor corrupts the whole file. (Ref# 25864)
• Assigning a hotkey to the Rebuild Project action has no effect (the hotkey doesn't work). This is a bug in Eclipse 3.0; see https://bugs.eclipse.org/bugs/show_bug.cgi?id=99193. (Ref# 25616)
• When using Memory Analysis for ARMLE, ARMBE, MIPSLE, MIPSBE, and SHLE targets, libmalloc sometimes has difficulty tracing back to the call site of a function. As a result, the source files for function calls aren't always shown in the Memory Analysis perspective. There is no workaround at this time. (Ref# 26035, 25938, 26100)
• The Application Profiler's sampling information shows “unknown” function names for MIPSLE and MIPSBE targets. There is no workaround at this time. (Ref# 24510, 25938)
• Code coverage doesn't work well for C++ code if you use gcc 2.95.3; the output includes unusual characters and function names. (Ref# 26592)

  Workaround: Use gcc 3.3.x instead of 2.95.3.

• The IDE doesn't correctly parse compiler errors from gcc 3.3.5. (Ref# 19221)

  Workaround: Add -fmessage-length=0 to the qcc or gcc command-line options.

• Working in the System Profiler's timeline editor can cause problems with focus and mouse-tracking in the rest of the IDE. (Ref# 20538)
• The IDE's System Information perspective doesn't properly update the progress view while it's refreshing data. (Ref# 21021)
• The C++ Class Browser is currently experimental. (Ref# 369)
• The IDE User's Guide doesn't explain how to import an SP3 project into an older version of the IDE. (Ref# 26985)

  Workaround: Here's how to do it:

  1. Back up your existing 6.3.0 SP3 workspace.
  2. Delete the .cdtproject and .project files from the project you wish to import.
  3. Import the project into your workspace in the older version of the IDE.
• The System Profiler can take a very long time to load and parse a .kev file that was generated by a target system that's running Neutrino 6.3.0 SP1. The parsing is much faster for .kev files from an SP2 system. (Ref# 27221)
• In the System Builder, if you choose Combine images and then uncheck Final Processing, the IDE still does the final processing. (Ref# 27082)
• In a System Builder project, if you select an image, type a large value such as 0x8c0c0000 in the Offset field in the Properties-->Combine section, and then press Enter, the IDE restores the previous value. (Ref# 27954)
• If you check a project out from CVS by using the New Project wizard, and you choose only one CPU with both debug and release versions, then when the wizard is done, the debug variant is always unchecked for SH, PPC and x86. In addition, a message pops up while the project is being checked out, saying “The file has been changed on the file system, do you want to load the changes?” but it doesn't say which file has been changed. (Ref# 25422, Eclipse ref# 102659)
• If you don't have a web browser in any of the directories listed in your PATH variable, you can't display the documentation in the IDE. (Ref# 29580)

  Workaround: Specify a browser for the IDE to use, by choosing Window-->Preferences, and then choosing Help from the list on the left side of the dialog. In the right part of the dialog, select Custom Browser and fill in the path to the browser below.

• The 6.3.0 SP2 version of the Quickstart Guide: 10 Steps to Your First QNX Program is also applicable to 6.3.0 SP3. (Ref# 41691)

Linux-hosted IDE

• SP3 doesn't include the Motif plugin. $QNX_HOST/usr/qde/eclipse/libXm.so and $QNX_HOST/usr/qde/eclipse/libXm.so.2 are broken symbolic links. (Ref# 40059)
• Under Linux with GTK, if you work extensively in the IDE (e.g. switching in and out of debugging) for a few hours (four hours on average), you get a JVM termination with the following at the top of the resultant hs_err_pidxxxx.log file:

  An unexpected exception has been detected in native code outside the VM.

  This is because of a memory leak in Eclipse; we've submitted a problem report to eclipse.org. (Ref# 22396)

  Workaround: Upgrade your system to Red Hat Enterprise; the VM and GTK on it are more stable.

• If you start the IDE on Linux Fedora Core 4 (a version of Linux that we don't officially support), you'll see this message:

  Starting QNX Development Environment
  /opt/qnx630/host/linux/x86/usr/qde/eclipse/eclipse: error while loading 
  shared libraries: /opt/qnx630/host/linux/x86/usr/qde/eclipse/libXm.so.2: 
  cannot restore segment prot after reloc: Permission denied
    

  This message is caused by selinux (secure Linux). (Ref# 26579)

  Workaround: Install an upgrade of selinux:

  yum install selinux-policy-targeted
    

• The IDE uses Mozilla, which isn't installed by default on Enterprise WS 4, to display the documentation. You need to change this to firefox; in the IDE, choose Windows-->Preferences-->Help and change the Custom Browser Command from mozilla %1 to firefox %1. (Ref# 26891)
• On Linux hosts, the IDE's System Builder doesn't properly determine the local host ID, so the tftp server doesn't work. (Ref# 23668)

  Workaround: Use the ifconfig utility to get the host's IP address.

• If your serial device is something like /dev/ttyUSB0, the Terminal 1 view of the System Builder might display the message Device Not Specified. The dialog gives you a way to specify the speed, parity, etc., but no way to specify the serial device to use.

  Workaround: Start the IDE like this:

  qde -vmargs -Dos.name=Linux-all-ports
    

Neutrino-hosted IDE

• The New Project wizard lets you use special characters in the project name, but make won't build such a project. (Ref# 24441, 24531)

  Workaround: Don't use spaces or the following characters in a project name:

  | ! $ ( " ) & ` : ; \ '
  * ? [ ] # ~ = % < > { }
    

• The self-hosted IDE gives the following warning:

  Warning: Could not get charToByteConverterClass!
    

  This warning is generated because we are using a non-SUN VM. This is the explanation from Aonix:

  The charToByteConverterClass is an internal sun.io class that the org.apache.xml.serializer.Encodings tries to access with a Class.forName(). Of course, this won't work on any non-Sun Java VM. The exception is caught and a default converter is used instead (after printing the warning message you see).

  You can ignore the warning. (Ref# 25851)

Solaris-hosted IDE

• If you're using the IDE, make sure you have the appropriate patch installed to run the Java 2 SE 1.4.2 VM under Solaris. You can download the patch from java.sun.com:

  http://java.sun.com/j2se/1.4.2/download.html

• The IDE uses Mozilla, which isn't installed by default, to display the to display the documentation and generate reports for code coverage. You need to change this to hotjava; in the IDE, choose Windows-->Preferences-->Help and change the Custom Browser Command from mozilla %1 to hotjava %1.

Windows-hosted IDE

• The IDE won't launch on Windows NT hosts, because NT doesn't include usp10.dll, the DLL for the Uniscribe Unicode script processor. (Ref# 24713)

  Workaround: Download the Windows 98 version of usp10.dll from support.microsoft.com/kb/q249973.

• On Windows XP, if you're logged in as a system administrator the first time you start the IDE, this user owns the configuration files, so other users won't be able to access them. (Ref# 24881)

  Workaround: Log in as the system administrator and delete the subdirectories in the $QNX_HOST/usr/qde/eclipse/configuration directory. Then log in as a nonadministrator and start the IDE.

• If you reset your target board while you're debugging from the Windows-hosted IDE, and you've clicked Terminate and remove in the IDE Debug view, the ntoCPU-gdb.exe process may run ready, consuming 100% of CPU. (Ref# 25174)

  Workaround: There is no workaround (other than not following this sequence of events). If gdb does run ready, you must terminate it from the Windows Task Manager. This problem will be fixed in a future version of gdb; you can get an experimental version from the Download Center on our website; look under Prerelease Software-->Trial Software-->Trial Software - QNX Momentics 6.3.x.

Known issues: I/O devices

io-usb

• In some cases when unmounting DLLs and running the usb utility at the same time, some memory allocated by io-usb isn't freed. This is a rare situation. (Ref# 21716)
• The io-usb server crashes if you repeatedly mount and umount and plug and unplug devices attached to the port. (Ref# 21556)
• io-usb might crash with a SIGSEGV when you shut down the system and you don't have any USB devices inserted. (Ref# 29495)

Known issues: Licensing

• If a disk is full (on any host) when you execute QNX Momentics-licensed components, you might not get a meaningful message to alert you of the problem. Instead, you may be requested to type in your license key (but doing so doesn't rectify the issue). Check your disk and free up some space if necessary. We'll provide a clearer message in a future release. (Ref# 21116)

Known issues: Multimedia

soundfile.so, soundfile_noph.so

Loading these legacy plugins causes a SIGBUS error. (Ref# 21707)

Workaround: Use the -ae option to procnto to enable alignment fault emulation.

Multimedia TDK 1.0.1

If you install the Multimedia TDK 1.0.1 after installing SP3, some files will be incompatible with SP3. (Ref# 39359)

Workaround: Do the following:

1. Before you install the Multimedia TDK 1.0.1, back up the files listed below for for these targets:
   • $QNX_TARGET/armle
   • $QNX_TARGET/mipsle
   • $QNX_TARGET/ppcbe
   • $QNX_TARGET/shle
   • $QNX_TARGET/x86
2. If you're on a self-hosted Neutrino system, also back up the versions of the files under /.
3. Install the Multimedia TDK 1.0.1.
4. Restore the files from the backup you made.

Here's the list of files that you need to back up before installing the TDK and restore afterward:

• usr/lib/mmedia/libaif_parser.a
• usr/lib/mmedia/libau_parser.a
• usr/lib/mmedia/libaudio_writer.a
• usr/lib/mmedia/libavi_parser.a
• usr/lib/mmedia/libcdda_reader.a
• usr/lib/mmedia/libff_mpegv_decoder.a
• usr/lib/mmedia/libfildes_streamer.a
• usr/lib/mmedia/libhttp_streamer.a
• usr/lib/mmedia/libiff_parser.a
• usr/lib/mmedia/libmidi_parser.a
• usr/lib/mmedia/libogg_decoder.a
• usr/lib/mmedia/liboggi_decoder.a
• usr/lib/mmedia/librawfile_writer.a
• usr/lib/mmedia/libstream_reader.a
• usr/lib/mmedia/libwav_parser.a
• usr/lib/mmedia/libwavfile_writer.a
• usr/lib/mmedia/libwindow_writer.a
• lib/dll/mmedia/aif_parser.so
• lib/dll/mmedia/au_parser.so
• lib/dll/mmedia/audio_writer.so
• lib/dll/mmedia/avi_parser.so
• lib/dll/mmedia/cdda_reader.so
• lib/dll/mmedia/ff_mpegv_decoder.so
• lib/dll/mmedia/fildes_streamer.so
• lib/dll/mmedia/http_streamer.so
• lib/dll/mmedia/iff_parser.so
• lib/dll/mmedia/midi_parser.so
• lib/dll/mmedia/ogg_decoder.so
• lib/dll/mmedia/oggi_decoder.so
• lib/dll/mmedia/rawfile_writer.so
• lib/dll/mmedia/stream_reader.so
• lib/dll/mmedia/wav_parser.so
• lib/dll/mmedia/wavfile_writer.so
• lib/dll/mmedia/window_writer.so
• usr/lib/libTremor.so.1
• usr/lib/libTremorS.a
• usr/lib/libaoi.so.1
• usr/lib/libaoiS.a
• usr/lib/libavcodec.so.1
• usr/lib/libavcodecS.a
• usr/lib/libmmconvenience.a
• usr/lib/libmmconvenienceS.a
• usr/lib/libmmedia.a
• usr/lib/libmmedia.so.1
• usr/lib/libmmediaS.a
• usr/lib/libmpegs.a
• usr/lib/libmpegsS.a
• usr/lib/libogg.so.1
• usr/lib/liboggS.a
• usr/lib/libvorbis.so.1
• usr/lib/libvorbisS.a
• usr/lib/libxing_audio.a
• usr/lib/libxing_audio.so.1
• usr/lib/libxing_audioS.a
• usr/photon/bin/mmplay
• usr/bin/playaudio

Known issues: Network protocols

npm-qnet.so

Redundant GNS servers have a window where service could be lost. If connectivity is lost to a gns process in server mode while it's acting as a redundant server, and while client gns processes running on other nodes are registering services, the server may become out of sync with the other redundant servers. (Ref# 20008)

npm-qnet-l4_lite.so

• This DLL has many options to alter how Qnet functions (e.g. timeouts, retries, and idle times). You shouldn't use these options unless you're trying to overcome an issue related to your environment. Qnet is optimized to function with its default settings. (Ref# 21298)
• Once Qnet has a domain, you can't set Qnet to not use a domain; you can only change the domain. (Ref# 38802)
• You can't use the Qnet “file” resolver (resolve=file option) to resolve IP addresses. It currently supports MAC addresses in combination with the option bind=en. (Ref# 38997)
• Qnet treats the _CS_DOMAIN configuration string differently if it's undefined or set to a NULL string. If it's undefined, Qnet uses a domain of .net.intra; if it's set to a NULL string, Qnet applies that as the domain (for example hostname.). (Ref# 19676)

fs-cifs

• pwrite() behavior isn't consistent with other Neutrino filesystems. If you open a file with O_APPEND, the offset supplied to pwrite() doesn't override O_APPEND. The data is written to the end of the file, regardless of the file offset supplied. (Ref# 38576)
• If you unlink() a file on a CIFS mount point, any open file descriptors for that file become invalid. (Ref# 38574)
• If you perform a socket operation on a file descriptor of a file on a fs-cifs mountpoint, the operation fails, but the errno returned might not be ENOTSOCK. (Ref# 38572)
• fs-cifs doesn't support POSIX file-locking functions. (Ref# 38570)
• fs-cifs incorrectly sets an errno of EPERM instead of EBADF if you attempt to write to a file opened as O_RDONLY or O_ACCMODE. (Ref# 38565)
• If a component of a pathname supplied to a function isn't a directory, fs-cifs should return ENOTDIR. It currently returns ENOENT. (Ref# 38564)
• fs-cifs may return a different errno when the mkdir() function call fails than those returned by the local filesystem. (Ref# 38573)
• PATH_MAX for CIFS (and thus fs-cifs) isn't 1024 as in POSIX. This is set by both Windows and the CIFS specification. The pathname length can be up to 255 characters. (Ref# 38566)

fs-nfs2

• If you attempt to access a link to a file using a pathname that ends in slash, the operation fails with an incorrect errno of EINVAL instead of ENOTDIR. (Ref# 38560)
• fs-nfs2 doesn't support files larger than 2 GB. (Ref# 39060)
• fs-nfs2 doesn't correctly implement the options -w size=n and -w number=n as described in the fs-nfs2 usage message. Don't use them. (Ref# 39031)
• If a path ends in a slash, it must be a directory. When accessing a link with a trailing slash, fs-nfs2 immediately returns EINVAL, instead of resolving the link and reporting errors such as EPERM (permission denied) or ENOTDIR (not a directory) before returning EINVAL (invalid argument). This behavior was seen as an optimization to reduce network traffic, because this kind of file access will ultimately fail. Strict POSIX behavior will be added in a future release. (Ref# 20878)
• fs-nfs2 doesn't support a -B option greater than 8096. (Ref# 39022)

fs-nfs3

• The -s option, which specifies to use a soft mount, isn't documented. (Ref# 23381)
• The -w size=num and -w number=num options aren't documented. (Ref# 23583)

  Workaround: Here's a description:

  The fs-nfs3 manager supports a write-caching feature (by default), which greatly enhances performance. This is accomplished by performing write operations locally and releasing the application, but delaying transmission of the write operation to the NFS server until a later time.

  ---

  You should disable this feature if multiple NFS clients will be accessing the same files on the NFS server, or else corruption may result because the server's file contents might be out of date compared to the cached version on each client. You can disable this feature using the -w sync=hard option.

  ---

  -w sync=hard

  Disable write caching.

  -w size=num

  The buffer size for each file, in units of 1 KB (default is 8; size = 8).

  -w number=num

  The number of buffers; each buffer can buffer one file. The default is 10, which means up to 10 files can be buffered simultaneously.

  -w delay=sec

  The data in the cache will be flushed to the server after sec seconds. The default is 2 seconds.

• fs-nfs3's exit status is always 255. (Ref# 38512)

fs-nfs2, fs-nfs3

• fs-nfs2 lets you modify the on-disk binary file of an executable that is executing. It should return an error with errno set to EBUSY. (Ref# 38563)
• If you use the mount command to mount an NFS server, and you specify the argument -o ver3 and fs-nfs3 isn't running, fs-nfs2 will accept this mount request. (Ref# 38640)
• fs-nfs2 and fs-nfs3 don't support fchdir(). (Ref# 38548)
• The NFS clients don't distinguish between a pathname ending or not ending in / when passed as the argument to mkdir(). (Ref# 38484)
• NFS is a connectionless protocol. If a server stops responding to the NFS client, it continues to try to reach the server to complete an operation until the server becomes available, or the user stops the operation. While the fs-nfs2 and fs-nfs3 clients are trying to reach the server, NFS operations are blocked until they're successful. This isn't an issue if the client is talking only to one server, but if an fs-nfs2 process has mounted multiple servers, the blocked operation also block the client's ability to talk to the other servers. (Ref# 39084)

  Workaround: Start separate client (fs-nfs2, fs-nfs3) processes for each server you wish to mount.

fs-cifs, fs-nfs2, fs-nfs3

The documentation incorrectly implies that at least one server-export/mountpoint combination is required on the command line when you launch fs-cifs, fs-nfs2, or fs-nfs3. You can invoke the mount command later to add mountpoints. (Ref #15446)

gns

• A gns daemon can't act as both a client and server at the same time. If a local service is registered with a GNS client, the client can forward that information to redundant or backup servers; a server can't forward the information. (Ref# 21037)
• Currently, GNS (name_attach()) isn't compatible with the resource manager framework. (Ref# 20062)

  Workaround: Your resource manager must handle the raw QNX messages until this is corrected.

nfsd

nfsd lets you access files only up to 16 subdirectory levels deep within the directory exported in the /etc/exports file. Deeper directory levels and files aren't accessible. (Ref# 40104)

slinger

When slinger is executing a CGI script and setting the environment variables to be passed to the script, the environment variable SERVER_ROOT is set to / instead of to the directory specified by HTTPD_SCRIPTALIAS. The actual current working directory of slinger is correct; it's just the environment variable that's wrong. (Ref# 20795)

tftp

• tftp can terminate with a floating-point exception when printing statistics from a get or put command when you're using verbose mode. (Ref# 20615)
• tftp can fault if you press Enter at the “To” prompt without supplying the host parameter. (Ref# 20064)

rpcgen

This utility looks for the C preprocessor in the wrong place on QNX Neutrino hosts. (Ref# 8461)

Workaround: Create a symbolic link:

ln -s /usr/qnx630/host/qnx6/x86/usr/bin/qcc /usr/bin/qcc
  

npm-tcpip-v4.so

• If a packet is smaller than the minimum Ethernet packet size, the packet may be padded with random data, rather than zeroes. (Ref# 21460)
• The TCP/IP stack doesn't maintain the statistics for outbound packets over VLAN interfaces. (Ref# 16684)
• The TCP/IP stack doesn't maintain the statistics for the number of input and output bytes or packets if the packets are forwarded via the fast-forward feature. (Ref# 23041)
• The TCP/IP stack doesn't maintain proper interface statistics for the link speed. (Ref# 27015)
• If the default UDP socket receive-buffer size is set near its limit (for example sysctl -w net.inet.udp.recvspace=240000), UDP-based sockets become unreliable. (Ref# 27386)

npm-tcpip-v4.so, npm-tcpip-v6.so

If a packet is smaller than the minimum Ethernet packet size, the packet may be padded with random data, rather than zeroes. (Ref# 21460)

pppd

• When pppd creates a proxy arp entry, it does this without the permanent flag, so the entry will time out after approx 20 minutes, instead of being permanently set. (Ref# 24103)
• pppd doesn't use the /etc/ppp/options.ttyname option file. (Ref# 23743)

rcp

This utility sets its user ID to root. It was reported that you can overrun the source/target file argument buffers in the utility, giving yourself root access. Under QNX Neutrino, rcp spawns the cp utility for local file-copying operations; it's the cp utility that faults. When rcp spawns cp, it does so with the credentials of the user who launched rcp, rather than root's. (Ref# 22002)

Known issues: Photon

Starting Photon

When you start Photon, you might see a “Cannot attach mouse input report (error code2)” message on the console. It's a benign message that you can ignore. (Ref# 29662)

PT_CB_ACTIVATE and PT_CB_ARM

These callbacks don't work with PtText and PtNumeric. (Ref# 21608)

Workaround: For a PtText, add this code:

int raw_text_callback( PtWidget_t *widget, void *data, PtCallbackInfo_t
*cbinfo )
{
    PtSuperClassRawEvent( PtBasic, widget, cbinfo->event );
    return Pt_CONTINUE;
}
  

When you create a PtText widget, add this code:

PtRawCallback_t text_cb = { Ph_EV_BUT_PRESS | Ph_EV_BUT_RELEASE,
  raw_text_callback };
…

PtSetArg( …, Pt_CB_RAW, &text_cb, Pt_LINK_INSERT );
… = PtCreateWidget( PtText, … );
  

You can use similar code for a PtNumeric widget.

PdGetOffscreenContextPtr()

This function leaks memory on MIPS hardware. (Ref# 8065)

ptermcs

This utility core-dumps when saving. The problem is in PxTerminalBuildCharsets(): if the “internal” charset is NULL but the “font charset” is specified, it builds a bad data structure that causes PxTerminalSaveCharsets() to crash. (Ref# 19568)

PhAB

• The template editor currently lets you delete or rename the widget template, but doesn't provide a way to restore the default value. (Ref# 21969)
• If you're using bash as your shell in Neutrino, PhAB doesn't populate the list of targets when you try to build an application. (Ref# 22850)
• Opening a PhAB 6.2.1 project in the 6.3 IDE or PhAB converts it to a 6.3 project, which then won't run correctly if compiled for a 6.2.1 target. (Ref# 24298)

  Workaround: If you're using the coexistence feature in the IDE to target Neutrino 6.2.1, you should set the IDE to open the 6.2.1 version of PhAB. To do this, change the Path to Photon Appbuilder setting on the Appbuilder preferences dialog (Window-->Preferences-->QNX-->Appbuilder).

PhAB for Windows

• If you create an application, and then build it, the Make Application window has an extra unreadable character at the end of each line. (Ref# 22190)
• If you start PhAB through the IDE on a Windows XP SP2 host, several security-alert dialogs are displayed, because the Windows XP SP2 firewall detects the background TCP/IP communication between the PhAB application and the Photon server. (Ref# 22282)

  Workaround: Configure Windows to unblock. Once you've done this, Windows won't display the security warnings when you restart PhAB.

• If you try to copy and paste something in PhAB when running it as a nonadministrator user, you get an error message:

  PhAB: Can't open: "clipboard.phab" (Permission denied).
  Please resolve the problem and re-try this operation. (No error)
      

  Thus, copying and pasting is impossible. (Ref# 39879)

  Workaround: Make sure that your HOMEDRIVE and HOMEPATH environment variables are set to point to a directory that you have permission to write into.

  PhAB for Windows uses the HOME environment variable if it's set, otherwise it internally sets HOME to HOMEDRIVE followed by HOMEPATH. If these aren't valid, then PhAB will encounter difficulties.

• You can't save a PhAB project in a path that contains spaces (e.g C:\Documents and Settings\some_user\my_phab_app). (Ref# 39883)

$HOME/.ph/phapps

Note that this file, which contains a list of the applications that you want Photon to launch automatically when it starts, must be executable. (Ref# 22196)

voyager

If you use voyager with vserver on a Malta board or any other platform that doesn't have a Floating Point Unit, voyager continually fails with a SIGFPE error when it tries to load a page. (Ref# 22404)

Workaround: Rebuild the OS image so that it uses floating-point emulation, by specifying the -fe option to procnto in the buildfile.

io-graphics

• If you don't specify a plugin, io-graphics fails. (Ref# 22489)

  Workaround: Always specify the -pphoton option (gri-photon.so is currently the only plugin available).

• If you specify the -d and -p options for io-graphics, you must put the -d option before the -p, or else io-graphics fails. (Ref# 22670)

Alpha on PPC

If you use alpha drawing functions on PPC targets, and you draw an image to a memory context and blit it to the screen, the colors are incorrect. (Ref# 21458)

Workaround: Don't use a memory context, or draw to one memory context, blit to another memory context, and then blit to the screen.

phditto

If you run gdb over phditto, gdb hangs, because the Photon server spawned by phrelay inherits phrelay's set of ignored signals including SIGUSR1, which gdb relies on. (Ref# 24817)

Workaround: Launch pterm windows using pwm's Desktop Menu (press Alt-Enter or right-click on the desktop background) instead of using the Terminal button on the shelf. Only pterm windows started by shelf inherit the ignored SIGUSR1.

Another option is to write a wrapper around gdb to reset SIGUSR1.

Pt_ARG_SCROLLBAR_WIDTH

Setting this resource for a PtList or for a compound widget that includes a PtList has no effect. (PR 20431)

Workaround: Attach the following callback to the Pt_REALIZED resource of the list widget:

int
list_realized_cb( PtWidget_t *widget, ApInfo_t *apinfo,
                  PtCallbackInfo_t *cbinfo )
{
    PtGenListWidget_t *list = (PtGenListWidget_t*)widget;
    unsigned short      *width;

    // NOTE: Use the width that the user set in PhAB.
    PtGetResource( widget, Pt_ARG_SCROLLBAR_WIDTH, &width, 0 );

    // This code sets the actual sizes of scrollbar(s).
    if( list->scrollbar )
        PtSetResource( list->scrollbar, Pt_ARG_WIDTH, *width, 0 );
    if( list->hscrollbar )
        PtSetResource( list->hscrollbar, Pt_ARG_HEIGHT, *width, 0 );

    // This is a workaround to make the list widget
    // position (anchor) the scrollbars correctly (with the new size).
    PtSetResource( widget, Pt_ARG_SCROLLBAR_WIDTH, *width - 1, 0 );
    PtSetResource( widget, Pt_ARG_SCROLLBAR_WIDTH, *width, 0 );

    return Pt_CONTINUE;
}
  

If you're using a compound widget such as a PtCombobox, use this code:

int combo_realized_cb( PtWidget_t *widget, ApInfo_t *apinfo, 
                       PtCallbackInfo_t *cbinfo )
{
 PtGenListWidget_t *list;
 PtWidget_t   *wp = widget;
 unsigned short    *width, list_width;

 // NOTE: Use the width that the user set in PhAB.
 PtGetResource( widget, Pt_ARG_CBOX_BUTTON_WIDTH, &width, 0 );

 // Find the list widget in the combo
 while( (wp = PtWidgetFamily( widget, wp )) ) {
  if( PtWidgetIsClass( wp, PtList ) ) {
   list = (PtGenListWidget_t*)wp;
   break;
  }
 }

 if( !wp )
  return Pt_CONTINUE;

 list_width = *width + 2;

 // This code sets the actual sizes of scrollbar(s).
 if( list->scrollbar )
     PtSetResource( list->scrollbar, Pt_ARG_WIDTH, list_width, 0 );
 if( list->hscrollbar )
     PtSetResource( list->hscrollbar, Pt_ARG_HEIGHT, list_width, 0 );

    // This is a workaround to make the list widget 
    // position (anchor) the scrollbars correctly (with the new size).
    PtSetResource( wp, Pt_ARG_SCROLLBAR_WIDTH, list_width - 1, 0 );
    PtSetResource( wp, Pt_ARG_SCROLLBAR_WIDTH, list_width, 0 );

 return Pt_CONTINUE;
}
  

helpviewer

• If you aren't using ksh or sh as your login shell, the environment variables that the helpviewer uses aren't initialized. (Ref# 27250)

  Workaround: Set QNX_HELP_HOME_PAGE to /usr/qnx630/target/qnx6/usr/help/product/momentics/bookset.html, and QNX_HELP_PATH to /usr/qnx630/target/qnx6/usr/help/product (assuming you installed QNX Momentics in the default location).

• If you run the helpviewer as one user, and you then log in as another user and search the documention, helpviewer's indexer fails with a message of “Cannot open /var/help/usr/qnx630/target/qnx6/usr/help/product.” (Ref# 25628)

  Workaround: Log in as root and type:

  rm -r /var/help/usr
    

  and then generate the index.

Known issues: Utilities

show_vesa

You must log in as root and be in text mode — not Photon — to run this utility. The documentation for this utility lists several options, but show_vesa doesn't have any. (Ref# 41020)

slay

If you use the -C option to change the runmask for a process, the processor for blocked threads doesn't change until the threads become unblocked (or never if the threads remain blocked). The documentation should mention this. (Ref# 40730)

Known issues: Host-specific

QNX Neutrino self-hosted

qconfig

There are two versions of qconfig installed in three places on self-hosted Neutrino systems:

• $QNX_HOST/usr/bin/qconfig — this is always the correct version
• /usr/bin/qconfig — this is the correct version if you've installed the SP2 to SP3 Upgrade on a 6.3.0 SP2 system; it's the wrong version if you've done a clean installation of 6.3.0 SP3.
• $QNX_TARGET/x86/usr/bin/qconfig — this version is obsolete, and you don't need it anyway

(Ref# 42105)

Workaround: Do the following:

1. Log in as root.
2. cp $QNX_HOST/usr/bin/qconfig /usr/bin/qconfig
3. rm $QNX_TARGET/x86/usr/bin/qconfig

Windows hosts

echo.exe

On Windows, the QNX-provided echo.exe interprets the Windows \ separator as an escape character. As a result, environment variable settings won't work if you use \ as a path separator; use / instead. (Ref# 19924)

PATH and quotation marks

Certain programs (e.g. Norton Ghost) add directories inside double quotation marks (e.g. ...;"c:\Program Files\Norton Ghost\";...) to your PATH environment variable. This causes the Cygwin spawn() function to fail, which in turn causes cp to fail when called by ln-w. (Ref# 20046)

Workaround: Modify your PATH environment variable and remove any quotation marks.

MAKEFLAGS

Microsoft Visual Studio also uses the MAKEFLAGS environment variable, but in a much different way than QNX Neutrino does. The result is that Microsoft Visual Studio no longer works after you've installed QNX Momentics.

Workaround: If you want to work with Microsoft Visual Studio (MSVS) after installing QNX Momentics on the same system, do the following:

1. Open a command window and run cmd.
2. Type set.
3. Find the value for MAKEFLAGS and save it.
4. Type set MAKEFLAGS.
5. Do your MSVS work.
6. To work with QNX Momentics again, type:

   set MAKEFLAGS=saved_makeflags_value

Permissions

If you don't have permission to write files in the top-level directory of the C drive, you won't be able to run certain tools, such as bindres and usemsg, which are needed for building PhAB applications. (Ref# 21849)

Solaris hosts

qconfig

If you're using the default Solaris shell, you might have problems switching between different installed versions of QNX Momentics. When you run a command like this:

`eval qconfig -e -n"QNX Momentics 6.3.0"`
  

you get this error:

QNX_HOST=/opt/qnx630/host/solaris/sparc: is not an identifier
  

and your PATH isn't updated. (Ref# 20653)

Workaround: Use ksh instead of the default Solaris shell.

Deprecation of legacy multimedia components

QNX Momentics 6.2.1 introduced a new multimedia library based on an “addon” architecture, and legacy multimedia components (pre-6.2.1) were deprecated. 6.3.0 is the last release that includes these legacy components. The deprecated items are:

• /etc/config/media/mpregistry
• /usr/photon/bin/phplay
• /usr/bin/plaympegaudio_noph
• /usr/bin/playsound_noph
• /usr/bin/playAudioCd
• /usr/lib/libmedia.so.2
• /usr/photon/plugins/mpegaudioplugin
• /usr/photon/plugins/mpegsystemplugin
• /usr/photon/plugins/mpegvideoplugin
• /usr/photon/plugins/soundplugin
• /usr/photon/dll/audiocd.so
• /usr/photon/dll/extproc.so
• /usr/photon/dll/mpegaudio.so
• /usr/photon/dll/mpegsystem.so
• /usr/photon/dll/mpegvideo.so
• /usr/photon/dll/soundfile.so
• /usr/photon/bin/mpegaudio
• /usr/photon/bin/mpegsystem
• /usr/photon/bin/mpegvideo

You should make sure that any multimedia applications that you plan to migrate to the next release of QNX Momentics use the current multimedia library. For more information, see the Multimedia Developer's Guide.

---

QNX Momentics ships with the runtime components of the current multimedia library. You require the Multimedia TDK to develop new multimedia components.

---

Getting started with the documentation

After you've installed your development suite, you'll find an extensive set of online documentation in HTML format. Go to the help menu item (e.g. in Windows XP: All Programs-->QNX Momentics-->Documentation) or look under the following directory:

${QNX_TARGET}/usr/help/product/momentics/bookset.html

This “roadmap” page contains links to the various HTML booksets that accompany the OS (e.g. System Architecture, Programmer's Guide, Library Reference, Utilities Reference, etc.).

You'll find the installation and release notes in the base_dirinstall/patches/6.3.0sp2tosp3/ directory, where base_dir is the directory where you installed QNX Momentics (see the output of the qconfig command).

---

For the most up-to-date version of these notes, go to our website, www.qnx.com, log into your myQNX account, and then go to the Download Center.

---

You can install and work with multiple versions of QNX Neutrino. Whether you're using the command line or the IDE, you can choose which version of the OS to build programs for. For more information, see the IDE User's Guide or the QNX Neutrino Programmer's Guide.

---

Coexistence of 6.3.0 and 6.2.1 is supported only on Windows and Solaris hosts.

---

Technical support

If you have any questions, comments, or problems with a QNX product, please contact Technical Support. For more information, see the How to Get Help chapter of the Welcome to QNX Momentics guide or visit our website, www.qnx.com.