The Hacker's Encyclopedia 1998

home *** CD-ROM | disk | FTP | other *** search

/ The Hacker's Encyclopedia 1998 / hackers_encyclopedia.iso / zines / phrack1 / phrack26.006 < prev next >

Wrap

Text File | 2003-06-11 | 19.3 KB | 384 lines

==Phrack Inc.== Volume Three, Issue 26, File 6 of 11 +-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+ Basic Concepts of Translation Brought to you by The Dead Lord and The Chief Executive Officers February 17, 1989 +-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-+ This tutorial is meant for the hardcore hackers who have entered the world of ESS switches. The information here is useful and valuable, although not invaluable. You can easily reap the benefits of access to a switch even if you only know RC:LINE, but to really learn the system in and out, the concepts about translation are ones that need to be mastered. In electromechanical switches, switching was directly controlled by whatever the customer dialed. If a 5 were dialed, the selector moved across 5 positions, and so on. There were no digit storing devices like registers and senders. As the network grew larger, this became inefficient and switching systems using digit storage and decoding devices were put into use. In this type of setup, the customer dials a number, which is stored in a register, or sender. The sender then uses a decoder and gives the contents of the register as input. The decoder translates the input into a format that can be used to complete the call, and sends this translation back to the digit storage device. This is a simplified example of translation, since the only input was dialed digits and the only output was routable information, but it shows what translation is: The changing of information from one form to another. When 1 ESS was first tested in Morris, Illinois in 1960, it introduced a switching method called Stored Program Control. Instead of switching and logic functions being handled by hardware, it was done through computer programs. This greatly expanded the translation function. Because calls are handled by many programs, information must be provided for each program. For example, when a customer picks up a phone, the switch needs to know if outgoing service is being denied, if the line is being observed, line class, special equipment features, etc. The line equipment number is given to the translation program as input. The translator translates the LEN and produces the answers to these and other pertinent questions in a coded form that can be used by the central processor of the switch. If the call is an interoffice call, the first three dialed digits are given to a translator as input and they translate into a route index and, possibly, other information. The route index, in turn, is given as input to another translator, which translates into: Which trunk to use (trunk identity), transmitter identity, the alternate route, etc. So actually, in early systems, translation was a single shot thing, and in Stored Program Control Systems (SPCS), the translation function is used many many times. In the 1 ESS, translation data is stored on magnetic memory cards in the program store. However, since translation data is constantly being changed, there is a provision made to store the changes in an area of the call store memory. The area of call store is called the recent change (RC) area. The changes are eventually transcribed from the call store into the program store by a memory card writer. In the 1A ESS, translation data is stored in the unduplicated call store, with backup in the form of disk memory called file store. Additionally, magnetic tapes are made of the translation area of call store. When a change in translation is made, the change is entered in a duplicated copy of call store. After checks are made as to the validity of the change (format and everything), the change is then placed in the unduplicated copy of call store. After that, the change is also written to a set of disk files in file store. Before the new data is written, the old data is written to a part of the disk file called "rollback." |------------|-------------|-------------| | DATA | 1 ESS | 1A ESS | |------------|-------------|-------------| | Transient | Duplicated | Duplicated | |Information | Call Store | Call Store | |------------|-------------|-------------| | Generic | Duplicated |Program Store| | Program |Program Store| | |------------|-------------|-------------| | Parameter | Duplicated |Unduplicated | | Table |Program Store| Call Store | |------------|-------------|-------------| |Translation | Duplicated |Unduplicated | |Information |Call Store + | Call Store | | |Program Store| | |------------|-------------|-------------| Transient Information: Telephone calls or data messages in progress; present state of all lines, junctors, and trunks in the office. Generic Program: The operating intelligence of the system. It controls actions like line and trunk scanning, setting up and taking down connections, etc. Parameter Table: Informs the generic program of the size and makeup of the office. This information includes equipment items (frames and units), call store allocation (call registers, hoppers, queues, etc.) and office options (days AMA tapes will be switched, etc.). Translation Information: Day to day changeable info which is accessed by translator programs. Also includes form tables, lists called "translators" which are linked in an hierarchical pattern. This is a quote from Engineering and Operations in the Bell System, pages 415-416: "The 1 ESS includes a fully duplicated No. 1 Central Processor Unit (Central Control includes the generic program), program store bus, call store bus, program stores, and call stores. The 1 ESS uses permanent magnet twister program store modules as basic memory elements. These provide a memory that is fundamentally read only, and have a cycle time of 5.5 microseconds. The call store provides "scratch pad," or temporary duplicated memory. As with the 1 ESS, the 1A CPU has a CPU, prog store bus, and call store bus that are fully duplicated. However, the 1A processor uses readable and writable memory for both prog and call stores, and has a cycle time of 700 nanoseconds. However, the program stores aren't fully duplicated, but 2 spare stores are provided for reliability. A portion of the call store is duplicated, but only one copy of certain fault recognition programs, parameter information, and translation data is provided. An extra copy of the unduplicated prog and call store is provided for in file store." The program store translation area in the 1 ESS and the unduplicated call store translation area in the 1A ESS contain all the info that can change from day to day for that office. Here is a list of things that are stored in the translation area: + Line Equipment Number (LEN), Directory Number (DN), trunk assignments (all explained later). + Office codes. + Rate and route information. + Traffic measurement information. + Associated miscellaneous info for call processing and charging. Call store can be thought of as RAM; it is filled as long as the ESS is powered. Program store is like ROM; it is physically written onto magnetic cards. File store is simply information stored on magnetic tapes (or disk drives). All data that's changeable (rate and route, customers' features, trunk selection, alternate paths, etc.) is called translation data and is stored in the translation area. Changes in translation are called recent changes and are stored in an area called the recent change area. Once again, I stress that this article is sort of a "masters" file for hackers who are interested in ESS. If the concepts are too difficult, don't panic. Knowledge comes with time. Don't feel bad if you don't catch on right away. Translation data is stored in the form of tables or lists. Each table is linked in a hierarchical pattern. Tables high in the hierarchy contain pointers (addresses) to the lower tables. Tables low in the hierarchy contain the actual data. Most translators are broken down into subtranslators, which are linked by a Head Table, or "HT". The HT points to the different ST's stored in memory, in the same way that a table of contents in a book points to the pages of each chapter. This way, when a new feature is added, it's just a matter of adding a new entry in the HT, and having the entry point to a newly stored ST. Translation input is divided into 2 parts: the selector and the index. The selector determines which ST to access, and the index determines which item (word number) in that particular ST to access. In some cases, the translation information may not fit into the space allotted to an ST, so pointers to auxiliary blocks and/or expansion tables may have to be given. You can think of a BASIC program, where a GOSUB points to a subroutine at location 4000. Now, if the subroutine is 100 bytes long, but you only have room for 75, another GOSUB must be issued to point to the rest of the subroutine. So a full translator is quite a large unit -- it can have a head table, subtranslators, auxiliary blocks, abbreviated codes, lists, subauxiliary blocks and expansion tables. The example below shows a custom calling feature that exists on 5 ESS: Dog Control Frequency, "DCF". In the e below diagram, DCF represents the Head Table, and has a list of pointers that identify the location of subtranslators "A" through "D". The data field "2" in subtranslator "D" is too small to store the entire subroutine, so an expansion table "2A" was produced to house the entire program. * D.C.F. * head table | | |------|-----------|--------| | | | | A B C D subtranslators | ---1 data: tables |or ---2 ---->| lists | | ---3 | | | etc % / expansion 2-Atable ESS programs access translators by locating their octal address in the Master Head Table, which is also called the Base Translator. 1 ESS MHT %%%%%%%%% The 1 ESS has 2 copies of the MHT: One in program store, and one in call store. The copy in call store is the one that's used normally, since call store memory has a faster cycle time. The one in program store is there for backup. The MHT is 338 bytes long (23 bit bytes), and as we mentioned, is used as a sort of directory for locating translators. The MHT can point to starting addresses of Head Tables (which point to translators), or to tables and lists. Head Tables point to subtranslators. Subtranslators can point to auxiliary and expansion blocks, lists, or tables. There is another Master Head Table called the Auxiliary Master Head Table, which points to other translators. There are 2 copies of the AMHT, one in program and one in call store. The AMHT is found by accessing the MHT, and for those interested, the address of the AMHT is located in the 28th byte of the MHT. The MHT is fixed; meaning that the first byte will ALWAYS be the address of the DN translator. The last byte will ALWAYS be the address to the JNNL to JNNT/JCN Head Table (explained later). ESS needs a table to read this table. Otherwise, how would it know what byte leads where? There is a "T-reading octal program" located at (octal address) 1105615 in the parameter area in the program store.This address is stored in the generic program and is used to read the Master Head Table. 1A ESS %%%%%% A 1A ESS switch call store byte contains 26 bits, named 0 through 25, which is a lot more than I can say about an Apple... Bits 24 and 25 are used for parity, and are not used for data. This leads to what is known as a K-code. No, a K-code is not used by lowly software K-rad pirates, but it is used by us ESS hackers. Each call store K-code contains 65,536 bytes, and can be thought of as a "page" of memory. Anyway, translation data is stored in the unduplicated call store. Remember, we're still talking about 1A ESS. In generic 1AE6 and earlier, unduplicated call store starts at K-code 17, and as more translation data is fed into the system, it pushes down into K-code 16, 15, 14, etc. In generic 7 and above, call store has been increased by a great deal, because of a huge memory expansion unit. On the early generics, the entire call store and program store had to fit in 38 K-codes. In the later generics, there are 38 K-codes assigned to call store (that's split between duplicated and unduplicated), and another 38 K-codes for program store. Not all K-codes may be used, so it's not really a full 38 K-codes, but hey, you can't have all your memory and use it too. Anyhow, because generics 1A E7 and higher have such huge call store memories, it's convenient to divide call store into 3 parts: The "duplicated call store" (DCS), which is located at the very top of the memory map, the "low unduplicated call store," (LUCS), which is located in the middle of call store, and the "high unduplicated call store," (HUCS). The LUCS area starts at K-code 17 and goes down as it fills up (being very watchful about not going into the DCS area. The HUCS area starts at K-code 37 and goes down as it fills up to K-code 20, being mindful not to step on LUCS's toes. Translators are classified as being either HUCS or LUCS translators, (but not both). LUCS translators aren't fixed; they can exist anywhere in the area as long as they're identified by the MHT. HUCS translators can either be fixed or not fixed. Note that in generics 1AE6 and earlier, there is no such distinction, because there's not enough memory to make such a distinction feasible. As for the location of the MHT, in generic 1AE6 and earlier, it's located in K-code 17 at octal address 3724000, and is 1376 bytes long. The later MHT's were moved to K-code 37 at octal address 7720000, and is 3424 bytes long. Translator Types %%%%%%%%%%%%%%%% As I said, translators take data as input and change it into another form for output. All translators exist in the form of hierarchical lists and tables. They reside in call store on 1A's and program store on 1's. The higher data in a translator points to the location of the lower data. The lower data contains the actual information. The different translators are located by the Master Head Table, which contains pointers to all the translators in the system. The kind of data that needs to be translated is changeable data. For example: o line equipment number o directory number o 3/6 digit codes o trunk network number to trunk group number o trunk network number to peripheral equipment number Now, there are two types of translators: Multilevel and expansion. The multilevel translators contain a maximum of six levels of information in the form of linked hierarchical tables: 1- Head Table 2- Subtranslator 3- Primary translator word 4- Auxiliary block or expansion table 5- List 6- Subauxiliary block (1) Head Table: The HT is the "directory" for the translator. It contains addresses or pointers to each subtranslator. (2) Subtranslator: The ST's are the main subdivisions, so as an office grows larger, or as more features are added, the number of ST's grows larger. For example, there is a translator for every 1,000 directory numbers, so if an office grows from 3,000 to 8,000 lines, an extra 5 subtranslators must be added. Input for translation must contain 2 things: A selector and an index. The selector contains the information as to which subtranslator to use (in the case of DCF, the selector would either be an A, B, C, or D). The index shows which item or word in that particular subtranslator to access. In the DCF example, if the selector were "D", the index could be 1, 2, 3, etc. (3) Primary Translation Word (PTW): Each index points to a PTW, which is a byte of information. Often, all you need is 1 byte of information (remember that each byte is 23 bits!). If the data isn't stored in the PTW, an address will be there to point to an auxiliary block or expansion table, where the data will be found. The ESS can recognize whether the byte contains data or an address by: 1 ESS) The 3 most significant bits will be 0. 1A ESS) The 4 most significant bits will be 0. So, if all the 3 (or 4 for 1A) most significant bits contain 0's, the word will be interpreted as an address. (Anyone want to throw the ESS switch into an endless loop????) (4) Auxiliary Block: The first byte in the AB contains the length of the block. This byte is called the word number (WRDN), and is used by the ESS so it knows where the auxiliary block ends. Remember that when the ESS reads data, all it sees is: 110001011000101010100100101110010010101000101010100100101111 So, in order to stop at the end of the block, the WRDN number must be present. (5) List: The list is used when additional information other than the standard found in the auxiliary block is needed. The list, like the ST, has an associated index. The address of the list is found in the AB and the index shows which item of data in the list should be looked at. A good example of what kind of information is found in the list would be a speed calling list. (6) Subauxiliary Block: The list is only large enough to hold a 7 digit phone number, and if more information has to be stored (like a 10 digit phone number or a trunk identity), an address is stored in the list that points to an SB, which acts very much like an AB. Expansion Translator %%%%%%%%%%%%%%%%%%%% The expansion translator has one table (called an expansion table). This type of translator gets only an index as input, since this type of translator is only a bunch of words. It could have auxiliary blocks, if the space allocated to a word is too small. RECENT CHANGE AREA OF CALL STORE (1 ESS) %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% The recent change area consists of: + primary recent change area + auxiliary recent change area + customer originated recent change (CORC) The starting and ending addresses for these rc areas are stored in the MHT. The primary recent change area is used to store changes affecting primary translation words. Each change is stored in a primary RC register, which consists of two 23 bit bytes. These two bytes contain status bits, primary translation address in the program store, and the primary translation word (PTW) address in call store. The first byte in the register is the "address word" (AW) and the second is the new primary translation word. When looking through the AW, bits 22 and 21 can tell you what kind of recent change is being implemented: 11: temporary (not to be put into PS) 10: permanent (to be put into PS) 01: delayed (not active yet) 00: deleted (this space is available) The PTW (abbreviations make things SO much easier) contains the translation data or the address of the auxiliary RC (TAG). You can tell whether the data is an RC or an address by looking at bits 22 to 18. If they are 0, then this byte contains an address, which is stored in bits 17 to 0. _______________________________________________________________________________