int main(int argc, char* argv[])
{
 long int str[2] = {0x41424344, 0x0}; /* ASCII "ABCD" */

 struct
    {
      unsigned short y;
      unsigned short x;
    } p; 

  
   p.x = 0x1234;  
   p.y = 0x5678;

   unsigned long *lparam,a;

   lparam = (unsigned long *)&p;
   a =  *lparam;

   printf ("%s\n", (char *)&str);       // x86    : "DCBA"  PowerPc: "ABCD"                                 
   printf ("%0x\n", a);                      // x86    :  12345678 (打印并非按内存次序)
   printf ("%0x\n", *((char*)&a+1)); // x86    :  56

                                  // powerpc: "ABCD"
                                  // powerpc: 56781234
                                  // powerpc: 78
          
   //  x86:                                         PowerPc
   //  &a 内存分配 78 56 34 12       56 78 12 34
   //  &p 内存分配 78 56 34 12                
 return 0;
}

/*--------*/
/* PowerPC application test */

#include "stdio.h"
#include <sysLib.h>
#include <vxWorks.h>
#include <taskLib.h>

void t1()
{
  long int str[2] = {0x41424344, 0x0}; // ASCII "ABCD"

 struct
    {
      unsigned short y;
      unsigned short x;
    } p; 

  
   p.x = 0x1234;  
   p.y = 0x5678;

   unsigned long *lparam,a;

   lparam = (unsigned long *)&p;
   a =  *lparam;

   printf ("%s\n", (char *)&str);  
   printf ("%0x\n", a);         
}

int t2()
{

   long id;
   id=  taskSpawn("abc",120,VX_FP_TASK,20000,(FUNCPTR)t1,
   0,0,0,0,0,0,0,0,0,0);
   return 0;
}

When designing an embedded system, a fundamental decision is the type of I/O scheme. Should we use interrupt-driven or polled I/O? We'll explore how this important decision has an impact not only on the firmware but on the hardware as well.

Fishing for I/O

Polled I/O is much like fishing: there is a lot of waiting. In a polled I/O scheme, software is written to check the status of an I/O device. If there is no data to be received (Rx) or if the device is not ready to transmit (Tx), the software must wait. This technique is called busy-waiting. After waiting for some time, eventually the software can receive or transmit some data, and the rest of the software can execute (see Diagram 1).

Diagram 1: Flowchart for polled I/O

If this sounds inefficient, that's because it is. It's a very simple way of dealing with I/O with no surprises for the developer, but a lot of CPU time is spent waiting for data to transfer.

Interrupt-driven I/O uses a little hardware to aid in efficiency. When the I/O device has already received some data or the I/O device is ready to transmit, an interrupt is generated, and the appropriate interrupt service routine (ISR) handles reading or writing some data. Interrupts add a level of complexity, and can be very difficult to debug, but the resulting system wastes no time waiting for data to transfer (see Diagram 2).

Diagram 2: Flowchart for interrupt-driven I/O

Yes, ISRs can be this simple. The above diagram shows separate ISRs for the receiver and transmitter if there are two separate interrupts. Sometimes there is only one interrupt for both functions, so the ISR is a little more complicated.

Development Time

From the simple example above, it may appear that interrupts and ISRs are very easy to implement. In many cases they are, but they can also be very complicated. The development cost of ISRs is generally higher than polled I/O. Consider that you're not only developing the functionality of the polled I/O routines, but you've also got to deal with how interrupts work in your particular system. Polled I/O occurs at very specific points in the firmware (i.e. whenever the polled I/O routines are called). Interrupts can happen at anytime. An interrupt bug can cause anything from simple system crashes to really frustrating intermittent data loss and unreliable system performance.

Which Is Best?

The decision to use polled or interrupt-driven I/O is usually pretty easy. If you've got the interrupt, use it! In the long run, even though it may take more time to develop, interrupt-driven I/O leads to a solid design, predictable performance, and holds up well to modifications of application code. However, if you've got a very simple design, using a straightforward polled I/O scheme may be preferable. There are a few factors which can influence your design.

Throughput. If your system throughput requirements are very high, you must use interrupt-driven I/O. Polled I/O won't work because the CPU efficiency won't be high enough to move the data and do everything else. However, if you've got a specialized system with extremely high data rate requirements, it may actually be faster to use polled I/O. That's because polled I/O doesn't incur any interrupt overhead or interrupt latency (see below).

Interrupt latency. Interrupt latency is the time it takes for the processor to respond to an interrupt event. These times range from 100's of nanoseconds to 10's of microseconds. In very rare cases, if interrupt latency is long or unpredictable, it may be preferable to poll for an event in very controlled conditions to ensure quick capture of an event.

Interrupt availability. Most of today's microcontrollers have several external interrupts. If a hardware interrupt is not available, you will have no choice but to poll for I/O (see Simulating Interrupt-Driven I/O below). It's best to work with the electrical engineers to make sure that the microcontroller you choose works for both the electrical and firmware designs.

By the way, there is no reason that you can't incorporate both types of I/O in a system. For example, perhaps your Ethernet driver uses interrupts and your serial port driver doesn't. It's all a matter of using a suitable technique for each situation.

Simulating Interrupt-Driven I/O

So what if you've got a system where there are no more external interrupts and you want some interrupt-driven I/O? You can simulate interrupt-driven I/O by using a dedicated task in an RTOS. While you can't really address interrupt latency with this technique, it gives CPU time to other tasks when there is no data to receive or transmit. An example task is shown below which handles receiving and transmitting characters on a UART.

Diagram 3: Flowchart of UARTTask

Conclusion

Both polling and interrupt-driven techniques should be in the embedded designer's toolbox. While we recommend using interrupt-driven I/O whenever possible, it doesn't really matter which technique you use as long as the final design meets product requirements, is easy to understand, and is easy to maintain.

  8  7   6  5  4  3  2  1         +        Length        +       Content
-------------------------------------------------------------------------
|Class |X |      Tag    |                                                |             
-------------------------------------------------------------------------          
Class:   
0 0 Universal
0 1 Application
1 0 Context-speciatic:指Type不需传送，双方约定 IMPLICIT
1 1 prviate

X :
0 ---- primitive   -----指定:content without a Structure 只有 1个Length 1个Content
1 ---- contructed  -----指定:content with addition structure
                            (如squence,squence of , implicit squence ,implicit squence of )
                            (Type , Length ,Content )任意个嵌套T-L-C
Tag:
ASN.1中Tag可能超过5个Bits,但是MMS中不会出现

Length: 指Content的长度。可以任意长度， 

例子：
1.单个OCTET STRING (ASN.1 key word )
Type (= OCTET STRING), Length (= 5 Octets) and Content (= 24 65 4F EF F3 hex）
 T  L  C
 -  -  --------------
 04 05 24 65 4F EF F3
 
2.有上下文中的[2]IMPLICIT OCTET STRING (多[2]IMPLICIT )
 T  L  C
 -  -  --------------
 82 05 24 65 4F EF F3
 --            
 1 0 0 0 0 0 1 0  05  24 65 4F EF F3
 ---   ---------
 1 0 : Context-speciatic
 0 0 0 1 0: 02 primitive , value = 2
 
 3.有上下文中的[2] OCTET STRING (多个[2] 无关键字IMPLICIT )
  T     L  C
           -----------------------
           T    L   C
           -    -   --------------
  82   07  04   05  24 65 4F EF F3
           -----------------------> OCTET STRING
 
 82:
  1 0 1 0 0 0 1 0
  --- - ---------
  1 0 : Context-speciatic
  1   : constructed
 
The DER are particularly advisable for the coding of short messages; 适合短消息
the CER are suitable for very long messages 适合长消息    

The "A0" in the first line says that it is a MMS definition
(A = 1010 hex for the first four bits of the ASN.1 types - context-specific and constructed).
The "0" is the tag that contains the number in square brackets on the right. 

数据映射到MMS

ICCP (具体到购买何种Block)
ICCP Server ObjectS
1.Association
2.Data Value
3.Data Set
4.Transfer Set
5.Account             
6.Device
7.Program
8.Event
9.Conformance Blocks and Associated Objects 
9-1 Block 1 (Periodic Power System Data)保护事项对象是可选的
    Indication Point Object、 Status Points、Analog Points、Quality Codes
    Time Stamp、COV Counter、Protection Equipment Event Object
   
9-2 Block 2 (Extended Data Set Condition Monitoring)
    主要是用来report-by-exception, or RBE，以节省带宽。
   
9-3 Block 3 (Block Data Transfer) 
    主要用来如何利用ASN.1节省传送字节
   
9-4 Block 4 (Information Messages)
9-5 Block 5 (Device Control)
9-6 Block 6 (Program Control)
9-7 Block 7 (Event Reporting)    
9-8 Block 8 (Additional User Objects)
9-9 Block 9 (Time Series Data)

Three TASE.2 operations are defined for use in managing associations: Associate, Conclude, and Abort
Associate:用在客户端，用来跟服务器建立联系。 Conclude, Abort服务器、客户端均可用。

数据传送机制
a) One Shot Data
b) Periodic Data
c) Event Data
d) Exception Data(如不变不送，... ... )

Direct-Control (NonSBO)noninterlocked
Select-Before-Operateinterlocked. (SBO) 带选择控制 

包含tag的service or data
-------------------------------
尚未知道的tag？？？？？
#define AARE_apdu1 0x61
#define AARQ_apdu0 0x60
#define ABRT_apdu4 0x64
#define RLRE_apdu3 0x63
#define RLRQ_apdu2 0x62

#define acse_result_diagnostic3 0xa3
#define acse_result2         0xa2
#define acse_service_user1     0xa1

Data ::= CHOICE {                                     
 -- context tag 0 is reserved for AccessResult         
 IF ( str1 )                                           
  array       [1] IMPLICIT SEQUENCE OF Data,                  
 ELSE                                                  
  array       [1] IMPLICIT NULL,                              
 ENDIF                                                 
 IF ( str2 )                                           
  structure   [2] IMPLICIT SEQUENCE OF Data,              
 ELSE                                                  
  structure   [2] IMPLICIT NULL,                          
 ENDIF                                                 
  boolean  [3] IMPLICIT BOOLEAN,                         
  bit-string  [4] IMPLICIT BIT STRING,                   
  integer     [5] IMPLICIT INTEGER,                         
  unsigned    [6] IMPLICIT INTEGER, -- shall not be negative
  floating-point [7] IMPLICIT FloatingPoint,            
             --  [8] is reserved                                    
  octet-string   [9] IMPLICIT OCTET STRING,               
  visible-string [10] IMPLICIT VisibleString,           
  generalized-time [11] IMPLICIT GeneralizedTime,       
  binary-time      [12] IMPLICIT TimeOfDay,                  
  bcd              [13] IMPLICIT INTEGER, -- shall not be negative   
  booleanArray     [14] IMPLICIT BIT STRING,                
  objId            [15] IMPLICIT OBJECT IDENTIFIER,                
  ...,                                                  
  mMSString        [16] IMPLICIT MMSString                     
}              

GetNameList-Request ::= SEQUENCE {
 objectClass [0] ObjectClass,
 objectScope [1] CHOICE {
 vmdSpecific [0] IMPLICIT NULL,
 domainSpecific [1] IMPLICIT Identifier,
 aaSpecific     [2] IMPLICIT NULL },
 continueAfter  [2] IMPLICIT Identifier OPTIONAL }
GetNameList-Response ::= SEQUENCE {
 listOfIdentifier [0] IMPLICIT SEQUENCE OF Identifier,
 moreFollows      [1] IMPLICIT BOOLEAN DEFAULT TRUE } 

AcknowledgeEventNotification-Request ::= SEQUENCE {
 eventEnrollmentName          [0] ObjectName,
 acknowledgedState            [2] IMPLICIT EC-State,
 timeOfAcknowledgedTransition [3] EventTime } 
 
ConfirmedServiceRequest包含很多choice

flex ,yacc/bison 的脚本???   

RFC1006
主要描述ISO 高4层利用TCP/IP的传输层功能来进行传输，实现ISO
具体描述各种原语TP和TCP的对应关系

参考文档:
Transport service  [ISO8072]
Transport protocol [ISO8073]        

In order to achieve good performance, the default TPDU size is
65531 octets, instead of 128 octets. In order to negotiate a
smaller (standard) TPDU size, the negotiation mechanism
specified in [ISO8073] is used
连接利用TCP 102端口

TCP TP最大区别:TCP包是流式的，没有边界
               TP发送的是离散的对象(NSDUs).  
TP0
TP4
 initiate negotiation初始化需要商讨的东西(Vendor需发布的东西)

CASM
ASCE

Telecontrol Application Service Element (TASE.2)
Inter-Control Centre Communications Protocol, ICCP

RFC1006

ASN.1 ACSE

Abstract Syntax Notation 1 (ASN.1)
( ISO/IEC 8824 and 8825 )

ISO/IEC 8824-1:1998, Information technology - Abstract Syntax Notation One (ASN.1): Specification of
                     basic notation
                    
ISO/IEC 8824-2:1998, Information technology - Abstract Syntax Notation One (ASN.1): Information object
                     specification
                    
ISO/IEC 8825-1:1998, Information technology - ASN.1 encoding rules: Specification of Basic Encoding
                     Rules (BER), Canonical Encoding Rules (CER, and Distinguished Encoding Rules (DER)
                    
ISO/IEC 8825-2:1998, Information technology - ASN.1 encoding rules: Specification of Packed Encoding
                     Rules (PER)

ISO/ISP 14226-1:1996 Industrial automation systems -- International Standardized Profile AMM11:
                     MMS General Applications Base Profile -- Part 1: Specification of ACSE,
                     Presentation and Session protocols for use by MMS

ISO/ISP 14226-2:1996 Industrial automation systems -- International Standardized Profile AMM11:
                     MMS General Applications Base Profile -- Part 2: Common MMS requirements

ISO/ISP 14226-3:1996 Industrial automation systems -- International Standardized Profile AMM11:
                     MMS General Applications Base Profile -- Part 3: Specific MMS requirements
 
学习好地方
http://www.ncepu.com.ru/home/html/f72.html(有些参考论文)
http://corba.blogbus.com/index.html(个人blog)

====================================
 IEC 870-6-503 TASE.2 Services and Protocol
 IEC 870-6-702 TASE.2 Profiles
 IEC 870-6-802 TASE.2 Object Models
文档google到了，只是比较旧的

最近得好好学习ASN.1了，这玩艺看样子，应用挺广的
不学不行啊！！

有正学习ASN.1的相互交流啊！！！

ASN.1 --- MMS ----ICCP -----IEC 61850

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
An asterisk (*) following two names, "A" and "B", denotes the "empty" lexical item (see 11.7), or one of the permitted sequences of lexical items associated with "A", or an alternating series of one of the sequences of lexical items associated with "A" and one of the sequences of lexical items associated with "B", both starting and finishing with one associated with "A". Thus:   
  C ::= A B * (空或者以A开头和以A结尾的条目)
is equivalent to:
  C ::= D | empty
 D ::= A | A B D
"D" being an auxiliary name not appearing elsewhere in the productions.
EXAMPLE – "C ::= A B *" is the shorthand notation for the following alternatives of C:
  empty
 A
 A B A
 A B A B A
 A B A B A B A
--------------------------------------
E ::= A B +  (以A开头和以A结尾的条目,不能为空)
--------------------------------------
F ::= A ? (为空或A串)

编码的基本原则是类型—长度—值的三段式结构，简称TLV（Type—Length--Value）结构
ASN.1编码的基本型结构和递归型结构
ASN.1 TAG含义：
Bits 7,6     Type of tag
Bit  5         Primitive or Constructed Flag
Bit  4-0     Tag value





ASN.1有四种类型：
简单类型，它相当于原子，没有下层组件；
结构类型，有组成部分；
标签类型，由其它类型生成；
其它类型，包括CHOICE和ANY类型。
可以使用ASN.1的分配符（::=）给类型和值指定名字，这些名字可以用于定义其它类型或值。

除了CHOICE和ANY类型以外，每种ASN.1类型都有一个标签，由一个类和一个非负的标签数组成。标签值可以唯一区分ASN.1类型。也就是说，ASN.1类型的名字并不影响它的抽象含义，只有标签值才有这个作用。有四类标签：

●Universal：该类型的含义在所有的application中都相同。这种类型只在X.208中定义。
●Application：该类型的含义由application决定，如X.500目录服务。两个不同的application中的类型可以具有相同的application-specific标签但是可以具有不同的含义。
●Private：,该类型的含义根据给定的企业而不同。
●Context-specific：该类型的含义根据给定的结构类型而不同。Context-specific标签用于在一个给定的结构类型上下文中区分使用相同的下层标签的组件类型。在两个不同的结构类型中组件类型可以具有相同的标签但是含义不同。

MMS中
Bits 7,6    Bit 5      Description, key words
--------     -----        -------------------------
0 0            0            Description: Universal Tag, Primitive
                                        Example keywords: INTEGER, BITSTRING, BOOLEAN
0 0            1            Description: Universal Tag, Constructed
                                        Example keyword: SEQUENCE, SEQUENCE OF
1 0            0            Description: Context Specific, Primitive
                                        Example Keyword: IMPLICIT
1 0            1            Description: Context Specific, Constructed
                                        Example Keywords: IMPLICIT SEQUENCE
                                                          IMPLICIT SEQUENCE OF
-----------------------------------------------------------------------------------------
识别符由小写字母开头，类型索引由大写字母开头。
类型索引由大写字母开头。

简单类型（Simple types）
    ●BIT STRING:由0和1任意组成的比特流
    ●IA5String:由IA5(ASCII)字符任意组成的字符流
    ●INTEGER:一个任意的整数
    ●NULL:null值
    ●OBJECT IDENTIFIER:对象识别符，有一列整数构成，用于确定对象，如算法或属性类型
    ●OCTET STRING:任意的octet（8bit值）流
    ●PrintableString:任意可打印字符流
    ●T61String:T.61（8bit）字符的任意流
    ●UTCTime:"coordinated universal time"或者格林威治平均时（GMT）值。

结构化类型
    ●SEQUENCE:一个或多个类型的有序集合
    ●SEQUENCE OF:0个或某个给定类型多次出现的有序集合
    ●SET:一个或多个类型的无序集合
    ●SET OF:0个或某给定类型多次出现的无序集合

隐式和显式标签类型
●隐式标签类型是在其它类型基础上通过改变其下层类型的标签生成的。
●显式标签是在其它类型基础上通过在其下层类型的标签之外添加一个外层标签生成的。从效果上看，显式标签类型是包含一个组件的结构类型，该组件即下层类型。

其他类型
包括CHOICE和ANY类型。
●CHOICE类型表示一个联合体，它具有一个或多个备选项（alternative）；
●ANY类型表示任意类型的任意值，其中任意类型可能在使用对象识别符或整数值注册中定义。

基本编码规则BER（Basic Encoding Rules）
●三种编码方法
   基本的，     定长编码；
   结构化的，定长编码；
   结构化的，不定长编码

简单的non-string类型使用第一种（简单、定长编码）；结构类型可使用任一种结构化的编码方法；简单的string类型根据值的长度是否已知可使用任一种方法。隐式标签定义的类型可使用下层类型的方法，显式标签定义的类型使用结构化的编码方法。

 每种BER编码方法都有三或四部分：
 ●Identifier octets:定义了ASN.1值的类和标签值，指明编码方法是简单化的还是结构化的。
 ●Length octets:对于定长编码方法，它指出了内容octet的个数；对于结构化、非定长编码方法，它指名长度是不确定的。
 ●Contents octets:对于简单的、定长编码方法，它给出了值的具体表示；对于结构化的方法，它给出了值的内容的BER编码的串联。
 ●End-of-contents octets:对于结构化、非定长的编码方法，它表示内容结束；对于其它方法，没有该部分。

简单定长方法（Primitive, definite-length method）
这种方法用于简单类型及通过对简单类型使用隐式标签生成的类型。它要求值的长度是事先预知的

1.Identifier octets，有两种形式：较小的标签值（标签值在0和30之间）和较大的标签值（标签值大于等于31）
 ●Low-tag-number form：一个octet。Bit8和bit7表示类（如表2），bit6值为0，表示编码方法为简单化的。Bit5－1给出了标签值。如下表所示：
              Class                Bit 8    Bit 7
              universal               0    0 
              application            0    1
              context-specific    1    0
              private                   1    1
●High-tag-number form：两个或多个octet。第一个octet形式如low-tag-number form，但是bit5－1均为1。第二个和以后的octet给出标签值，基于128，最高位在先，以便使用尽可能少的数字，每个octet的bit8都置为1，最后一个为0。

2.Length octets：有两种格式：短型（长度在0至127之间）和长型（长度在0至21008-1之间）
●Short form: 一个octet，bit8为0，bit7－1表示长度。
●Long form: 2－127个octet。第一个octet的Bit8为1，bit7－1表示后面有多少个用于表示实际长度的octet。第二个和随后的octet给出实际长度，基于256，高位数字在先。

3.Contents octets：给出了值的具体表示（如果类型是由隐式标签定义的，则给出了下层类型的值）

3.2 结构化定长方法（Constructed, definite-length method）

     结构化的、定长方法适用于简单的string类型、结构类型、在二者基础上通过隐式标签生成的类型和在任何类型基础上由显式标签生成的类型。要求值的长度事先已知。BER编码方法各部分如下：

 1．Identifier octets：与第3.1节介绍的一样，但bit6的值为1，表示编码方法是结构化的。
 2．Length octets：见第3.1节。
 3．Contents octets，值的组件的BER编码的串联

●对于简单string类型和在其基础上由隐式标签生成的类型，是值的连续子串的BER编码的串联（隐式标签的下层值）
●对于结构类型和在其基础上由隐式标签生成的类型，是值的组件的BER编码的串联（隐式标签的下层值）
●对于在任何类型基础上使用显式标签生成的类型，是下层值的BER编码特定类型的细节见第5节。

3.3 结构化非定长方法（Constructed, indefinite-length method）

    结构化的、非定长编码用于简单string类型、结构类型、在二者基础上使用隐式标签生成的类型和在任何类型基础上使用显式标签生成的类型。不要求事先知道值的长度。BER编码各部分如下：

    ●Identifier octets，见第3.2节
    ●Length octets.一个octet，值为80
    ●Contents octets.见第3.2节。
    ●End-of-contents octets两个octet，为00  00。

 由于end-of-contents octet出现在通常普通BER编码出现的位置（例如，在一个sequence值的内容octet出现的位置），可把00和00分别视为identifier和length octet。因此end-of-contents octet实际上是一个具有universal class，标签值为0，长度为0的值的简单定长编码。
----------------------------------------------------------------
部分摘自:
RSA实验室技术笔记
作者：Burton S.Kaliski Jr.
最终修订日期：Nov 1，1993
翻译：David(David@javaresearch.org),2002年6月
----------------------------------------------------------------

2. ":"-separated paths :为分割符
3. set PATH in BASH Shell as follows:
   > export PATH=.:/home/yap/bin:/bin:/usr/local/bin
  
4. in TCSH Shell, you would do:
   > setenv PATH=.:/home/yap/bin:/bin:/usr/local/bin
 
 This says to look first in the current directory ".", then /home/yap/bin,
 then /bin, and finally /usr/local/bin. 

5.
 Better still, since you do not know what the previous value
 of PATH is, it is best to simply append what you want to
 the front or back of the current value of PATH.
 
 > export PATH=.:/home/yap/bin:`printenv PATH`

  #define DEFS_OFFSET(s,m)       (DEFS_UI16)&(((s *)0)->m)
  #define DEFS_MEMBER_SIZE(s,m)  sizeof(((s *)0)->m)

  /* The following macros make it easier to specify binary numbers. For      */
  /* example, to specify a byte in binary:  DEFS_BINARY(01100001) or to   */
  /* specify a word in binary:  DEFS_BINARY_WORD(00111101,11001010)       */

  #define DEFS_BINARY_CONVERT(byte) (((byte & 0x10000000L) / 0x200000L) +  \
                                        ((byte & 0x01000000L) / 0x040000L) +  \
                                        ((byte & 0x00100000L) / 0x008000L) +  \
                                        ((byte & 0x00010000L) / 0x001000L) +  \
                                        ((byte & 0x00001000L) / 0x000200L) +  \
                                        ((byte & 0x00000100L) / 0x000040L) +  \
                                        ((byte & 0x00000010L) / 0x000008L) +  \
                                        ((byte & 0x00000001L) / 0x000001L))

  #define DEFS_BINARY(byte) DEFS_BINARY_CONVERT(0x##byte)

  #define DEFS_BINARY_WORD(high,low) (DEFS_BINARY_CONVERT(0x##high) * 256) + \

2006.1.7 字节交换顺序

/* This is a set of routines for demonstrating the effects of
 byte ordering between little endian and big endian machines

 Big Endian (B_ENDIAN == TRUE):

  MSB [ n | n+1 | n+2 | n+3 ] LSB

 Little Endian (B_ENDIAN == FALSE):

  MSB [ n+3 | n+2 | n+1 | n] LSB

 little/big-endian is bitness as well.  For example,

  struct {
   short b:5,   --- we _want_ signed for the example ---
   c:11;
  };

 is stored in little-endian (gint32el) ['+' denotes sign bit]:

 tf_Bitstream view -->
   0123456789A BCDEF
  |-----c----+|--b-+|

 Whereas bigendian (Motorola) stores it thus:

 tf_Bitstream view -->
   FEDCB A9876543210
  |+-b--|+----c-----|

 So, you have to invert bits as well to convert endianness.

 #define Gettf_Bit(Val,Idx) ( ( (Val) & (1<<(Idx)) ) )
 #define Settf_Bit(Val,Idx,tf_Bit) ( ( (Val) & (~(1<<Idx)) ) | ((tf_Bit)<<(Idx)) )
 for ( i = 0; i < sizeof(Val)*8; i++)
    NewVal = Settf_Bit(NewVal,sizeof(Val)*8-i-1, Gettf_Bit(Val,i));
*/        

DNP
DnpMasterStart
  --> taskSpawn ("tDnpMaster", priority, VX_FP_TASK, 0x8000,
        (FUNCPTR) DnpMasterTask,
        (int) ini_name, 0, 0, 0, 0, 0, 0, 0, 0, 0)
       
   dnpMasterTask ---> dnp_init()
                 ---> ca_task_initialize()
                 ---> ca_add_fd_registration()
                 ---> 从配置文件中得到dnp的配置信息
                 ---> pdpdvrs_initDNP()
                 ---> addr_init()
                 ---> dnp_loop()
       
  DnpMasterAddDevice
  DnpMasterAdd8550
  DnpMasterAddText
 
  DNP　PEER TO PEER
 
  一些debug信息
 
  物理层
  　．利用查表法来确定链路层的长度
  --->． pdpphys_initPhysRecMgr 物理层初始化，分配内存
  　  ． valid_address()
  　　． pdpphys_parseDNPframe()　
 
 
  DnpMasterTask
  

========================================================

  串口：从温旧梦

  　非重叠模式优点　．直接
  　　　　　　　　　．易移植
  　　　　　　缺点　．线程中读、写相互堵塞
  　　　　　　　　　．线程间相互堵塞（包括读之间，写之间，读写之间）
 
  　　　　　　单片机，嵌入式如vxworks，任务中相对简单的程序中常用
 
  　重叠模式　优点　．灵活，效率高（后台执行操作）
  　　　　　　　　　．多线程间，线程中，读写操作不会相互堵塞
  　　　　　　缺点　．不那么直接
  　　　　　　　　　．不易于移植
  　
  EV_RXCHAR：事件通知模式用在非重叠模是一个比较好的方式，因为程序不用轮询串口，以节省CPU的thread quantum
  　　　　　 方式如下：
  　　　　　DWORD dwCommEvent;
   DWORD dwRead;
   char  chRead;
   
   if (!SetCommMask(hComm, EV_RXCHAR))
      // Error setting communications event mask.
   
   for ( ; ; ) {
      if (WaitCommEvent(hComm, &dwCommEvent, NULL)) {
         if (ReadFile(hComm, &chRead, 1, &dwRead, NULL))
            // A byte has been read; process it.
         else
            // An error occurred in the ReadFile call.
            break;
      }
      else
         // Error in WaitCommEvent.
         break;
   }
   问题出现在：当多个字节连续的发送，第１个byte到，引起EV_RXCHAR 事件发生，
                          WaitCommEvent指示可读．第２个byte紧接着到，EV_RXCHAR只是在内部置位，
                          当第１个byte读完，调用WaitCommEvent时，系统再次指示EV_RXCHAR 事件发生，
                          可读第２个byte,问题出现在当第２个字符到达，而没有被读出时，第３个字符到
                          达了，此时系统也期望将对应于第３个字符的EV_RXCHAR置位，但是系统中的
                          EV_RXCHAR标志位已经被第２个已经置位了，于是就被忽略，当第２个自负读出
  　　　　　　后，只能在系统缓冲区，等待第４个字符到，而读出第３个字符，这样代码和系统
                          就失去同步。
   　　　　　　（我觉得这种情况在一般情况下不会出现,在单片机、
                               嵌入式应该是一个一个字符往外蹦，）
   
   　　　　　　而且WaitCommEvent会导致很多其它事件丢失，在高速情况下。
  　　　　　　　　
  　　解决办法是：利用ClearCommError判断缓冲中的字符个数，一次性读完所有到达字符

 if (Len<=0)
  CRC = 0;
 else
 {
  Len--;
  for (IX=0;IX<=Len;IX++)
  {
   CRC=CRC^(unsigned int)(Array[IX]);
   for(IY=0;IY<=7;IY++)
   if ((CRC&1)!=0 
    CRC=(CRC>>1)^0xA001;      else
    CRC=CRC>>1;    //
  }
  
     }
 Rcvbuf[0] = (CRC & 0xff00)>>8;//高位置
 Rcvbuf[1] = (CRC & 0x00ff);  //低位置
}

Who selects the memory management strategy? There are several possible layers of memory manager involved, each of which may override the previous (lower-level) one:(内存分配策略的选择)

1.The operating system kernel provides the most basic memory allocation services. This underlying  allocation strategy, and its characteristics, can vary from one operating systems platform to another,   and this level is the most likely to be affected by hardware considerations.
 
2.The compiler's default runtime library builds its allocation services, such as C++'s operator new  and C's malloc, upon the native allocation services. The compiler's services might just be a thin   wrapper around the native ones and inherit their characteristics, or the compiler's services might  override the native strategies by buying larger chunks from the native services and then parceling those out according to their own methods.
 
3.The standard containers and allocators in turn use the compiler's services, and possibly further override them to implement their own strategies and optimizations.
 
4.Finally, user-defined containers and/or user-defined allocators can further reuse any of the lower-level  services (for example, they may want to directly access native services if portability doesn't matter)  and do pretty much whatever they please.
         包容关系
              ------------------------------------------------+
              |  user-defined containters and/or allocators   |
              |    +------------------------------------------+
              |    | stardard containters  and/or allocators  |
              |  +--------------------------------------------|
              |  |                                            |
              |  |      operator new and allocator            |
              |------------------------------------------------
              |            操作系统核心                       | 
              ------------------------------------------------|
When you ask for n bytes of memory using new or malloc, you actually use up at least n bytes of memory because typically the memory manager must add some overhead to your request. Two common considerations that affect this overhead are:

1. Housekeeping overhead.
In a general-purpose (i.e., not fixed-size) allocation scheme, the memory manager will have to somehow remember how big each block is so that it later knows how much memory to release when you call delete or free. Typically the manager remembers the block size by storing that value at the beginning of the actual block it allocates, and then giving you a pointer to "your" memory that's offset past the housekeeping information. (See Figure 2.) Of course, this means it has to allocate extra space for that value, which could be a number as big as the largest possible valid allocation and so is typically the same size as a pointer.
When freeing the block, the memory manager will just take the pointer you give it, subtract the number of housekeeping bytes and read the size, then perform the deallocation.
                           size          +    n bytes    用于通用分配策略
                     (housrkeeping info)    (我申请的)
                    
2. Chunk size overhead.
Even when you don't need to store extra information, a memory manager will often reserve more bytes than you asked for because memory is often allocated in certain-sized chunks.

For one thing, some platforms require certain types of data to appear on certain byte boundaries (e.g., some require pointers to be stored on 4-byte boundaries) and either break or perform more slowly if they're not. This is called alignment, and it calls for extra padding within, and possibly at the end of, the object's data. Even plain old built-in C-style arrays are affected by this need for alignment because it contributes to sizeof(struct).固定分配大小，须填充以补齐字节

For example:

// Example 1: Assume sizeof(long) == 4 and longs have a 4-byte
//            alignment requirement.(32位操作系统,不同的操作系统有不同)
struct X1
{
  char c1; // at offset 0, 1 byte
           // bytes 1-3: 3 padding bytes
  long l;  // bytes 4-7: 4 bytes, aligned on 4-byte boundary
  char c2; // byte 8: 1 byte
           // bytes 9-11: 3 padding bytes (see narrative)
}; // sizeof(X1) == 12
n == 1 + 3 + 4 + 1 == 9, and m == sizeof(X1) == 12

struct X2
{
  long l;  // bytes 0-3
  char c1; // byte 4
  char c2; // byte 5
           // bytes 6-7: 2 padding bytes
}; // sizeof(X2) == 8
 
容器的内存空间分配
Each standard container uses a different underlying memory structure and therefore imposes different overhead per contained object:
1、vector<T> internally stores a contiguous C-style array of T objects, and so has no extra per-element    overhead at all (besides padding for alignment, of course; note that here "contiguous" has the same meaning as it does for C-style arrays, as shown in Figure 3).
    
2、deque<T> can be thought of as a vector<T> whose internal storage is broken up into chunks.  A deque<T> stores chunks, or "pages," of objects; the actual page size isn't specified by the standard,    and depends mainly on how big T objects are and on the size choices made by your standard library implementer.   This paging requires the deque to store one extra pointer of management information per page, which usually    works out to a mere fraction of a bit per contained object; for example, on a system with 8-bit bytes and
   4-byte ints and pointers, a deque<int> with a 4K page size incurs an overhead per int of 0.03125 bits -    just 1/32 of a bit. There's no other per-element overhead because deque<T> doesn't store any extra pointers    or other information for individual T objects. There is no requirement that a deque's pages be C-style arrays,   but that's the usual implementation.
 
3、list<T> is a doubly-linked list of nodes that hold T elements. This means that for each T element,    list<T> also stores two pointers, which point to the previous and next nodes in the list. Every time we   insert a new T element, we also create two more pointers, so a list<T> requires at least two pointers'    worth of overhead per element.
 
4、set<T> (and, for that matter, a multiset<T>, map<Key,T>, or multimap<Key,T>) also stores nodes that hold    T (or pair<const Key,T>) elements. The usual implementation of a set is as a tree with three extra    pointers per node. Often people see this and think, 'why three pointers? isn't two enough, one for the    left child and one for the right child?' The reason three are needed is that we also need an "up" pointer    to the parent node, otherwise determining the 'next' element starting from some arbitrary iterator can't
    be done efficiently enough. (Besides trees, other internal implementations of set are possible; for     example, an alternating skip list can be used, which still requires at least three pointers per element     in the set.)
 
     Container      Typical housekeeping data overhead per contained object
     ----------    ---------------------------------------------------------
      vector         No overhead per T.
      deque          Nearly no overhead per T — typically just a fraction of a bit.
      list           Two pointers per T.
      set, multiset  Three pointers per T.
      map, multimap  Three pointers per pair<const Key, T>.
 
 多分配的结构：
     vector      None; objects are not allocated individually. (See sidebar.)
     deque       None; objects are allocated in pages, and nearly always each
                 page will store many objects.
      list           | set, multiset              |    map, multimap                                      
      struct LNode { | struct SNode {             |     struct MNode {                   
        LNode* prev; |  SNode* prev;              |      MNode* prev;                    
        LNode* next; |  SNode* next;              |      MNode* next;                    
        T object;    |  SNode* parent;            |      MNode* parent;                  
      };             |   T object;                |      std::pair<const Key, T> data;   
                     |    }; // or equivalent     |       }; // or equivalent
  在如下条件：
 1、Pointers and ints are 4 bytes long. (Typical for 32-bit platforms.)
 2、sizeof(string) is 16. Note that this is just the size of the immediate string object
    and ignores any data buffers the string may itself allocate; the number and size of
    string's internal buffers will vary from implementation to implementation, but doesn't
    affect the comparative results below. (This sizeof(string) is the actual value of one
     popular implementation.)
 3、The default memory allocation strategy is to use fixed-size allocation where the block
    sizes are multiples of 16 bytes. (Typical for Microsoft Visual C++.)
   
        Container                       Basic node    Actual size of allocation block for node,
                                        data size     including internal node data alignment
                                                      and block allocation overhead
        ----------------------   ------------------   -----------------------------------------
        list<char>                     9 bytes         16 bytes        
        set<char>, multiset<char>      13 bytes        16 bytes        
        list<int>                      12 bytes        16 bytes        
        set<int>, multiset<int>        16 bytes        16 bytes        
        list<string>                   24 bytes        32 bytes
        set<string>, multiset<string>  28 bytes        32 bytes
       -----------------------------------------------------------------------------------------
       条件： Same actual overhead per contained object                  
        (implementation-dependent assumptions: sizeof(string) == 16,
        4-byte pointers and ints, and 16-byte fixed-size allocation blocks)                                                                                                                               
    
 内存算法:
 best-first:
  - The first block in the heap that is big enough is allocated
  - Each free block keeps a pointer to the next free block
  - These pointers may be adjusted as memory is allocated
   
    We can keep track of free space in a separate list called the free list
   
 nearest-fit
 worst-fit
 next-fit ......
 
 memory leak: If a dynamically allocated variable leaves its scope before being
               recycled, the memory cannot be recycled and the program will
               gradually drain away memory until the computer halts.
 dangling pointer: The invalid reference in this kind of situation is known as a
                   dangling pointer.    
    |-----------|------------------------------------|------------------------------|
    |           | Manual Memory                      |   Automatic Memory           |
    |           | Management                         |    Management                |
    |-----------|------------------------------------|------------------------------|
    | Benefits  |   size (smaller)                   |  constrains complexity       |
    |           |   speed (faster)                   |                              |
    |           |   control (you decide when to free)|                              |
    |-----------|------------------------------------|------------------------------|        
    | Costs     |    complexity                      |larger total memory footprint |    
    |           |    memory leaks                    |“comparable” performance      |     
    |           |    dangling pointers               |                              |
    |-----------|------------------------------------|------------------------------|
  If you rewrite all of the functions in a program              
  as inline macros, you can increase the speed at which the  
  program executes. This is because the processor doesn’t have to  
  waste time jumping around to different memory locations. In addition,   
  because execution will not frequently jump to a nonlocal spot           
  in memory, the processor will be able to spend much of its time executing
  code in the cache.                                                      
 
  Likewise, you can make a program smaller by isolating every bit     
  of redundant code and placing it in its own function. While this will
  decrease the total number of machine instructions, this tactic will 
  make a program slower because not only does the processor spend     
  most of its time jumping around memory, but the processor’s cache  
  will also need to be constantly refreshed.                          
 
  memory alloc:
  1. Bitmapped Allocation
     利用bitmap来记录内存分配的占位符,利用BST数来记录分配内存的大小
  2. Sequential Fit
     The sequential fit technique organizes memory into a linear linked    
     list of free and reserved regions . When an allocation request occurs,
     the memory manager moves sequentially through the list until it finds
     a free block of memory that can service/fit the request (hence the name “sequential fit”).    
     分配和回收、归并      
     其中选择空闲节点的匹配可选算法
     [ best-fit
       nearest-fit                       
       worst-fit          
       next-fit ......          
      ]
  3.Segregated Lists
     
   Garbage Collection的种类
          
   Reference counting collectors: identify garbage by maintaining a    
   running tally of the number of pointers that reference each block of
   allocated memory. When the number of references to a particular    
   block of memory reaches zero, the memory is viewed as garbage      
   and reclaimed. There are a number of types of reference counting  
   algorithms, each one implementing its own variation of the counting
   mechanism (i.e., simple reference counting, deferred reference    
   counting, 1-bit reference counting, etc.).    
   
    Follows these rules:
    - When an object is created, create a reference count (RC) field
    - Set the reference count to 1 upon creation, to account for   
      the object which initially points to this object             
    - When an object with pointers is created, increment the RC of 
      all of the objects pointed to by this object by 1            
    - When an object with pointers is destroyed (goes out of scope, etc.)
      decrement the RC of all objects pointed to by this object by 1
    - When a pointer is modified, decrement the RC of the old target
      by 1 and increment the RC of the new target by 1             
    - When an object’s RC reaches 0, reclaim the object as free spa
    
   Tracing garbage collectors traverse the application run-time environment
   (i.e., registers, stack, heap, data section) in search of              
   pointers to memory in the heap. Think of tracing collectors as         
   pointer hunter-gatherers. If a pointer is found somewhere in the       
   run-time environment, the heap memory that is pointed to is            
   assumed to be “alive” and is not recycled. Otherwise, the allocated  
   memory is reclaimed. There are several subspecies of tracing garbage   
   collectors, including mark-sweep, mark-compact, and copying            
   garbage collectors.                                                    
  
suballocator:they are talking about a specialpurpose                           
             application component that is implemented by the programmer    
             and based on existing services provided by application libraries
             (like malloc() and free()).

Suballocators are user code which reserve the system-provided
heap and then manage that memory itself      

DuplicateHandle
The DuplicateHandle function duplicates an object handle. The duplicate handle refers
to the same object as the original handle. Therefore, any changes to the object are
reflected through both handles.DuplicateHandle can be called by either the source
process or the target process. It can also be invoked where the source and target
process are the same. Note that DuplicateHandle should not be used to duplicate
handles to I/O completion ports.

监护程序的编写
  win9X -> 编写console 程序
           createpipe()
           DuplicateHandle()
           CreateProcess()获得console的输入,输出handle

   windoww2000 xp
           OpenSCManager()
           OpenService()
           ControlService()
           QueryServiceStatus()
           StartService()
          
守护程序的编写:对长时间远行程序的监控，非正常退出时，重新运行服务。
        
       

2. 链表的好用法
   struct a {
     static a *mLinkedList; // 申明为一个静态变量
 
     a *mNext;
     bool mCanRemoteCreate;

    a(bool canRemoteCreate)
    {
       mNext = mLinkedList;
       mLinkedList = this;
       mCanRemoteCreate = canRemoteCreate;
    }
    static int *create(const char *name);
  };
 
  a *a::mLinkedList = NULL; // 初始化
 
3. 灵活的应用# ##
Token-Pasting Operator (##)

#define paster( n ) printf( "token" #n " = %d", token##n )
int token9 = 9;
If a macro is called with a numeric argument like
paster( 9 );the macro yields
printf( "token" "9" " = %d", token9 );which becomes
printf( "token9 = %d", token9 );

Stringizing Operator (#)
#define stringer( x ) printf( #x "\n" )
void main()
{
    stringer( In quotes in the printf function call\n );
    stringer( "In quotes when printed to the screen"\n );  
    stringer( "This: \"  prints an escaped double quote" );
}
Such invocations would be expanded during preprocessing, producing the following code:
void main()
{
   printf( "In quotes in the printf function call\n" "\n" );
   printf( "\"In quotes when printed to the screen\"\n" "\n" );
   printf( "\"This: \\\" prints an escaped double quote\"" "\n" );
}
When the program is run, screen output for each line is as follows:In quotes in the printf function call
"In quotes when printed to the screen"
"This: \" prints an escaped double quotation mark"
#define IMPLEMENT_NETCONNECTION(className, classGroup, canRemoteCreate) \
   NetClassRep* className::getClassRep() const { return &className::dynClassRep; } \
   NetClassRepInstance<className> className::dynClassRep(#className, 0, NetClassTypeNone, 0); \
   NetClassGroup className::getNetClassGroup() const { return classGroup; } \
   static NetConnectionRep g##className##Rep(&className::dynClassRep, canRemoteCreate)

4. 枚举:初始化为0值开始,后者比前者大1,除非显式指定.
   By default, the first enumerator has a value of 0, and each successive enumerator is one larger
   than the value of the previous one, unless you explicitly specify a value for a particular
   enumerator. Enumerators needn’t have unique values. The name of each enumerator is treated
   as a constant and must be unique within the scope where the enum is defined. An enumerator
   can be promoted to an integer value. However, converting an integer to an enumerator requires
   an explicit cast, and the results are not defined.

=========================
一些优秀的数学算法
5.1 /// Determines if number is a power of two.
 inline bool isPow2(const U32 number)
 {
    return (number & (number - 1)) == 0;
 }
5.2 浮点数的计算机中的储存方法

    单精度      1|   8   |   23    |
             符号  指数      尾数
    双精度      1|   11  |   52    |
             符号  指数      尾数  
            
    10110.100011 -> 1.0110100011* 2(4) 2的4之方
   
    符号位 0
    尾数   0110100011
    指数   4 以过剩127储存 +127= 131  -> 10000011
    所以  IEEE 754 : 0100000110110100011
   
    -0.0010011  -> -1.0011 * 2(-3) 2的-3之方
    符号位：-1
    尾数  : 0011
    指数为：-3  +127  的124 -〉01111100
    所以： 1 01111100 0011000000000000000000
   
    /// Determines the binary logarithm of the input value rounded down to the nearest power of 2.
 inline U32 getBinLog2(U32 value)
 {
    F32 floatValue = F32(value);
    return (*((U32 *) &floatValue) >> 23) - 127;
 }

=========================
模式编程
模版
引用计数
对象指针
构成功能强大

Limited Bandwidth - There is a limit to the rate at which hosts on the network can send data to one another. If a computer is connected to the network with a 56 kbps modem, this might be 5 Kbytes per second, while computers on a local area network might be able to communicate at 128 megabytes per second. For service providers, additional bandwidth capacity can be costly, so even if there is no physical bandwidth limitation, bandwidth conservation is important for many projects.

Packet Loss - Computer networks are inherently unreliable. Information transmitted over a network may become corrupted in transit, or may be dropped at a router where traffic has become congested. Even when (especially when) using a guaranteed message delivery protocol such as TCP, the unreliable nature of the underlying network still must be taken into account for network applications.

Latency - Messages sent from one host to another on the network take time to arrive at the destination. The time can be influenced by many factors, including the medium over which the messages travel, how many intermediate hosts must route the message, an the level of traffic congestion at each of those network nodes. Latency becomes particularly problematic in network simulations that attempt to present a real-time interface to the client, when the latency of the connection may be perceptible in time.

Standard Network Protocols

When computers communicate over networks, they send and receive data using specific network protocols. These protocols ensure that the computers are using the same specifications to address, forward and process data on the network. The internet, certainly the most widely used computer network today, uses a stack of three primary protocols that facilitate communication over the network. They are:

IP - Internet Protocol: The Internet Protocol is the basic building block for internet communications. IP is a routing protocol, which means that it is used to route information packets from a source host to a destination host, specified by an IP address. IP packets are not guaranteed to arrive at the destination specified by the sender, and those packets that do arrive are not guaranteed to arrive in the order they were sent. IP packet payloads may also be corrupted when they are delivered. IP is not useful as an application protocol - it is used mainly as a foundation for the higher level TCP and UDP protocols.

UDP - User Datagram Protocol: The User Datagram Protocol supplies a thin layer on top of IP that performs error detection and application level routing on a single host. UDP packets are addressed using both an IP address to specify the physical host, and a port number, to specify which process on the machine the packet should be delivered to. UDP packets also contain a checksum, so that corrupted packets can be discarded. UDP packets that are corrupted or dropped by an intermediate host are not retransmitted by the sender, because the sender is never notified whether a given packet was delivered or not.

TCP/IP - Transmission Control Protocol: TCP was designed to make internet programming easier by building a reliable, connection-based protocol on top of the unreliable IP. TCP does this by sending acknowledgements when data packets arrive, and resending data that was dropped. TCP is a stream protocol, so the network connection can be treated like any other file stream in the system. TCP is not suitable for simulation data, because any dropped packets will stall the data pipeline until the dropped data can be retransmitted.

Application Network Topologies

Networked applications can be designed to communicate with each other using different topological organization strategies. Some common communcations organization paradigms are discussed below.

Peer-to-Peer: In a peer-to-peer network application, the client processes involved in the network communicate directly with one another. Though there may be one or more hosts with authoritative control over the network of peers, peer-to-peer applications largely distribute the responsibility for the simulation or application amongst the peers.

Client-Server: In the client-server model, one host on the network, the server, acts as a central communications hub for all the other hosts (the clients). Typically the server is authoritative, and is responsible for routing communication between the several clients.

Client-Tiered Server Cluster: In network applications where more clients want to subscribe to a service than can be accomodated by one server, the server's role will be handled by a cluster of servers peered together. The servers in the network communicate using the peer-to-peer model, and communicate with the clients using the client-server model. The servers may also communicate with an authoritative "super-server" to handle logins or resolve conflicts

...............................

There are many Symmetric Encryption algorithms of varying levels of security, but all of them when used alone have several drawbacks. First, both parties to the communication must have a copy of the shared secret key. If a client is attempting to communicate with a service it has never contacted before, and doesn't share a key with, it won't be able to communicate securely with it. Also, although an intermediate eavesdropper cannot read the data sent between the hosts, it can alter the messages, potentially causing one or more of the systems to fail.

Symmetric Encryption加密算法并不适应游戏中，因为游戏者可以任意加入，而且偷窥者虽然不能读懂数据含义，但很有可能更改消息！

Public Key Cryptography and Key Exchange

Public Key Cryptography algorithms were invented to solve the symmetric key distribution problem. In public key algorithms, each participant in the communication has a key pair composed of a public key and a private key. The theory of public keys suggests that a message encrypted with the public key can only be decrypted with the private key and vice-versa.

Key exchange algorithms (Diffie-Helman, ECDH) have certain properties such that two users, A and B can share their public keys with each other in plain text, and then, using each other's public key and their own private keys they can generate the same shared secret key. Eavesdroppers can see the public keys, but, because the private keys are never transmitted, cannot know the shared secret. Because public key algorithms are computationally much more expensive than symmetric cryptography, network applications generally use public key cryptography to share a secret key that is then used as a symmetric cipher key.

Digital Signatures/Certificate Authorization

Public key algorithms still have one vulnerability, known as the Man-in-the-Middle attack. Basically, an eavesdropper in the communication between A and B can intercept the public keys in transit and substitute its own public key, thereby establishing a secure connection with A and B - decrypting incoming data and reencrypting it with its shared key to the opposite party.

To combat this attack, the concept of certificates was introduced. In this model, the public key of one or both of the participants in the communication is digitally signed with the private key of some known, trusted Certificate Authority (CA). Then, using the Certificate Authority's public key, the parties to the communication can validate the public key of the opposite parties.

Malicious Attackers and Denial of Service

A problem facing developers of internet applications and web sites are Denial-of-Service attacks. Malicious users employing custom tools often attempt to shut down publicly available internet servers. There are a variety of well-known categories of DoS attacks.

Traffic flooding: This attack sends a barrage of data to the public address of the server, in an attempt to overwhelm that server's connection to the internet. This attack often employs many machines, hijacked by the attacker and acting in concert. These attacks are often the most difficult to mount since they require a large number of available machines with high-speed internet access in order to attack a remote host effectively.

Connection depletion: The connection depletion attack works by exploting a weakness of some connection based communications protocols. Connection depletion attacks work by initiating a constant flow of spurious connection attempts. When a legitimate user attempts to connect to the server, all available pending connection slots are already taken up by the spoofed connection attempts, thereby denying service to valid clients.

Server CPU depletion: If the server performs public key cryptography as part of the connection sequence, a malicious client could be constructed to initiate bogus connection attempts in an effort to initiate many CPU intesive cryptographic operations on the server.

The TNL uses a two-phase connection protocol to protect against connection depletion attacks, and implements a client-puzzle algorithm to prevent CPU depletion attacks. Also, TNL is built so that bogus packets are discarded as quickly as possible, preventing flooding attacks from impacting the server CPU.

***** CVS exited normally with code 1 *****