1 /*
2 * f_eem.c -- USB CDC Ethernet (EEM) link function driver
3 *
4 * Copyright (C) 2003-2005,2008 David Brownell
5 * Copyright (C) 2008 Nokia Corporation
6 * Copyright (C) 2009 EF Johnson Technologies
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
12 */
13
14 #include <linux/kernel.h>
15 #include <linux/module.h>
16 #include <linux/device.h>
17 #include <linux/etherdevice.h>
18 #include <linux/crc32.h>
19 #include <linux/slab.h>
20
21 #include "u_ether.h"
22 #include "u_ether_configfs.h"
23 #include "u_eem.h"
24
25 #define EEM_HLEN 2
26
27 /*
28 * This function is a "CDC Ethernet Emulation Model" (CDC EEM)
29 * Ethernet link.
30 */
31
32 struct f_eem {
33 struct gether port;
34 u8 ctrl_id;
35 };
36
37 struct in_context {
38 struct sk_buff *skb;
39 struct usb_ep *ep;
40 };
41
func_to_eem(struct usb_function * f)42 static inline struct f_eem *func_to_eem(struct usb_function *f)
43 {
44 return container_of(f, struct f_eem, port.func);
45 }
46
47 /*-------------------------------------------------------------------------*/
48
49 /* interface descriptor: */
50
51 static struct usb_interface_descriptor eem_intf = {
52 .bLength = sizeof eem_intf,
53 .bDescriptorType = USB_DT_INTERFACE,
54
55 /* .bInterfaceNumber = DYNAMIC */
56 .bNumEndpoints = 2,
57 .bInterfaceClass = USB_CLASS_COMM,
58 .bInterfaceSubClass = USB_CDC_SUBCLASS_EEM,
59 .bInterfaceProtocol = USB_CDC_PROTO_EEM,
60 /* .iInterface = DYNAMIC */
61 };
62
63 /* full speed support: */
64
65 static struct usb_endpoint_descriptor eem_fs_in_desc = {
66 .bLength = USB_DT_ENDPOINT_SIZE,
67 .bDescriptorType = USB_DT_ENDPOINT,
68
69 .bEndpointAddress = USB_DIR_IN,
70 .bmAttributes = USB_ENDPOINT_XFER_BULK,
71 };
72
73 static struct usb_endpoint_descriptor eem_fs_out_desc = {
74 .bLength = USB_DT_ENDPOINT_SIZE,
75 .bDescriptorType = USB_DT_ENDPOINT,
76
77 .bEndpointAddress = USB_DIR_OUT,
78 .bmAttributes = USB_ENDPOINT_XFER_BULK,
79 };
80
81 static struct usb_descriptor_header *eem_fs_function[] = {
82 /* CDC EEM control descriptors */
83 (struct usb_descriptor_header *) &eem_intf,
84 (struct usb_descriptor_header *) &eem_fs_in_desc,
85 (struct usb_descriptor_header *) &eem_fs_out_desc,
86 NULL,
87 };
88
89 /* high speed support: */
90
91 static struct usb_endpoint_descriptor eem_hs_in_desc = {
92 .bLength = USB_DT_ENDPOINT_SIZE,
93 .bDescriptorType = USB_DT_ENDPOINT,
94
95 .bEndpointAddress = USB_DIR_IN,
96 .bmAttributes = USB_ENDPOINT_XFER_BULK,
97 .wMaxPacketSize = cpu_to_le16(512),
98 };
99
100 static struct usb_endpoint_descriptor eem_hs_out_desc = {
101 .bLength = USB_DT_ENDPOINT_SIZE,
102 .bDescriptorType = USB_DT_ENDPOINT,
103
104 .bEndpointAddress = USB_DIR_OUT,
105 .bmAttributes = USB_ENDPOINT_XFER_BULK,
106 .wMaxPacketSize = cpu_to_le16(512),
107 };
108
109 static struct usb_descriptor_header *eem_hs_function[] = {
110 /* CDC EEM control descriptors */
111 (struct usb_descriptor_header *) &eem_intf,
112 (struct usb_descriptor_header *) &eem_hs_in_desc,
113 (struct usb_descriptor_header *) &eem_hs_out_desc,
114 NULL,
115 };
116
117 /* super speed support: */
118
119 static struct usb_endpoint_descriptor eem_ss_in_desc = {
120 .bLength = USB_DT_ENDPOINT_SIZE,
121 .bDescriptorType = USB_DT_ENDPOINT,
122
123 .bEndpointAddress = USB_DIR_IN,
124 .bmAttributes = USB_ENDPOINT_XFER_BULK,
125 .wMaxPacketSize = cpu_to_le16(1024),
126 };
127
128 static struct usb_endpoint_descriptor eem_ss_out_desc = {
129 .bLength = USB_DT_ENDPOINT_SIZE,
130 .bDescriptorType = USB_DT_ENDPOINT,
131
132 .bEndpointAddress = USB_DIR_OUT,
133 .bmAttributes = USB_ENDPOINT_XFER_BULK,
134 .wMaxPacketSize = cpu_to_le16(1024),
135 };
136
137 static struct usb_ss_ep_comp_descriptor eem_ss_bulk_comp_desc = {
138 .bLength = sizeof eem_ss_bulk_comp_desc,
139 .bDescriptorType = USB_DT_SS_ENDPOINT_COMP,
140
141 /* the following 2 values can be tweaked if necessary */
142 /* .bMaxBurst = 0, */
143 /* .bmAttributes = 0, */
144 };
145
146 static struct usb_descriptor_header *eem_ss_function[] = {
147 /* CDC EEM control descriptors */
148 (struct usb_descriptor_header *) &eem_intf,
149 (struct usb_descriptor_header *) &eem_ss_in_desc,
150 (struct usb_descriptor_header *) &eem_ss_bulk_comp_desc,
151 (struct usb_descriptor_header *) &eem_ss_out_desc,
152 (struct usb_descriptor_header *) &eem_ss_bulk_comp_desc,
153 NULL,
154 };
155
156 /* string descriptors: */
157
158 static struct usb_string eem_string_defs[] = {
159 [0].s = "CDC Ethernet Emulation Model (EEM)",
160 { } /* end of list */
161 };
162
163 static struct usb_gadget_strings eem_string_table = {
164 .language = 0x0409, /* en-us */
165 .strings = eem_string_defs,
166 };
167
168 static struct usb_gadget_strings *eem_strings[] = {
169 &eem_string_table,
170 NULL,
171 };
172
173 /*-------------------------------------------------------------------------*/
174
eem_setup(struct usb_function * f,const struct usb_ctrlrequest * ctrl)175 static int eem_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl)
176 {
177 struct usb_composite_dev *cdev = f->config->cdev;
178 int value = -EOPNOTSUPP;
179 u16 w_index = le16_to_cpu(ctrl->wIndex);
180 u16 w_value = le16_to_cpu(ctrl->wValue);
181 u16 w_length = le16_to_cpu(ctrl->wLength);
182
183 DBG(cdev, "invalid control req%02x.%02x v%04x i%04x l%d\n",
184 ctrl->bRequestType, ctrl->bRequest,
185 w_value, w_index, w_length);
186
187 /* device either stalls (value < 0) or reports success */
188 return value;
189 }
190
191
eem_set_alt(struct usb_function * f,unsigned intf,unsigned alt)192 static int eem_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
193 {
194 struct f_eem *eem = func_to_eem(f);
195 struct usb_composite_dev *cdev = f->config->cdev;
196 struct net_device *net;
197
198 /* we know alt == 0, so this is an activation or a reset */
199 if (alt != 0)
200 goto fail;
201
202 if (intf == eem->ctrl_id) {
203 DBG(cdev, "reset eem\n");
204 gether_disconnect(&eem->port);
205
206 if (!eem->port.in_ep->desc || !eem->port.out_ep->desc) {
207 DBG(cdev, "init eem\n");
208 if (config_ep_by_speed(cdev->gadget, f,
209 eem->port.in_ep) ||
210 config_ep_by_speed(cdev->gadget, f,
211 eem->port.out_ep)) {
212 eem->port.in_ep->desc = NULL;
213 eem->port.out_ep->desc = NULL;
214 goto fail;
215 }
216 }
217
218 /* zlps should not occur because zero-length EEM packets
219 * will be inserted in those cases where they would occur
220 */
221 eem->port.is_zlp_ok = 1;
222 eem->port.cdc_filter = DEFAULT_FILTER;
223 DBG(cdev, "activate eem\n");
224 net = gether_connect(&eem->port);
225 if (IS_ERR(net))
226 return PTR_ERR(net);
227 } else
228 goto fail;
229
230 return 0;
231 fail:
232 return -EINVAL;
233 }
234
eem_disable(struct usb_function * f)235 static void eem_disable(struct usb_function *f)
236 {
237 struct f_eem *eem = func_to_eem(f);
238 struct usb_composite_dev *cdev = f->config->cdev;
239
240 DBG(cdev, "eem deactivated\n");
241
242 if (eem->port.in_ep->enabled)
243 gether_disconnect(&eem->port);
244 }
245
246 /*-------------------------------------------------------------------------*/
247
248 /* EEM function driver setup/binding */
249
eem_bind(struct usb_configuration * c,struct usb_function * f)250 static int eem_bind(struct usb_configuration *c, struct usb_function *f)
251 {
252 struct usb_composite_dev *cdev = c->cdev;
253 struct f_eem *eem = func_to_eem(f);
254 struct usb_string *us;
255 int status;
256 struct usb_ep *ep;
257
258 struct f_eem_opts *eem_opts;
259
260 eem_opts = container_of(f->fi, struct f_eem_opts, func_inst);
261 /*
262 * in drivers/usb/gadget/configfs.c:configfs_composite_bind()
263 * configurations are bound in sequence with list_for_each_entry,
264 * in each configuration its functions are bound in sequence
265 * with list_for_each_entry, so we assume no race condition
266 * with regard to eem_opts->bound access
267 */
268 if (!eem_opts->bound) {
269 mutex_lock(&eem_opts->lock);
270 gether_set_gadget(eem_opts->net, cdev->gadget);
271 status = gether_register_netdev(eem_opts->net);
272 mutex_unlock(&eem_opts->lock);
273 if (status)
274 return status;
275 eem_opts->bound = true;
276 }
277
278 us = usb_gstrings_attach(cdev, eem_strings,
279 ARRAY_SIZE(eem_string_defs));
280 if (IS_ERR(us))
281 return PTR_ERR(us);
282 eem_intf.iInterface = us[0].id;
283
284 /* allocate instance-specific interface IDs */
285 status = usb_interface_id(c, f);
286 if (status < 0)
287 goto fail;
288 eem->ctrl_id = status;
289 eem_intf.bInterfaceNumber = status;
290
291 status = -ENODEV;
292
293 /* allocate instance-specific endpoints */
294 ep = usb_ep_autoconfig(cdev->gadget, &eem_fs_in_desc);
295 if (!ep)
296 goto fail;
297 eem->port.in_ep = ep;
298
299 ep = usb_ep_autoconfig(cdev->gadget, &eem_fs_out_desc);
300 if (!ep)
301 goto fail;
302 eem->port.out_ep = ep;
303
304 status = -ENOMEM;
305
306 /* support all relevant hardware speeds... we expect that when
307 * hardware is dual speed, all bulk-capable endpoints work at
308 * both speeds
309 */
310 eem_hs_in_desc.bEndpointAddress = eem_fs_in_desc.bEndpointAddress;
311 eem_hs_out_desc.bEndpointAddress = eem_fs_out_desc.bEndpointAddress;
312
313 eem_ss_in_desc.bEndpointAddress = eem_fs_in_desc.bEndpointAddress;
314 eem_ss_out_desc.bEndpointAddress = eem_fs_out_desc.bEndpointAddress;
315
316 status = usb_assign_descriptors(f, eem_fs_function, eem_hs_function,
317 eem_ss_function);
318 if (status)
319 goto fail;
320
321 DBG(cdev, "CDC Ethernet (EEM): %s speed IN/%s OUT/%s\n",
322 gadget_is_superspeed(c->cdev->gadget) ? "super" :
323 gadget_is_dualspeed(c->cdev->gadget) ? "dual" : "full",
324 eem->port.in_ep->name, eem->port.out_ep->name);
325 return 0;
326
327 fail:
328 ERROR(cdev, "%s: can't bind, err %d\n", f->name, status);
329
330 return status;
331 }
332
eem_cmd_complete(struct usb_ep * ep,struct usb_request * req)333 static void eem_cmd_complete(struct usb_ep *ep, struct usb_request *req)
334 {
335 struct in_context *ctx = req->context;
336
337 dev_kfree_skb_any(ctx->skb);
338 kfree(req->buf);
339 usb_ep_free_request(ctx->ep, req);
340 kfree(ctx);
341 }
342
343 /*
344 * Add the EEM header and ethernet checksum.
345 * We currently do not attempt to put multiple ethernet frames
346 * into a single USB transfer
347 */
eem_wrap(struct gether * port,struct sk_buff * skb)348 static struct sk_buff *eem_wrap(struct gether *port, struct sk_buff *skb)
349 {
350 struct sk_buff *skb2 = NULL;
351 struct usb_ep *in = port->in_ep;
352 int padlen = 0;
353 u16 len = skb->len;
354
355 int headroom = skb_headroom(skb);
356 int tailroom = skb_tailroom(skb);
357
358 /* When (len + EEM_HLEN + ETH_FCS_LEN) % in->maxpacket) is 0,
359 * stick two bytes of zero-length EEM packet on the end.
360 */
361 if (((len + EEM_HLEN + ETH_FCS_LEN) % in->maxpacket) == 0)
362 padlen += 2;
363
364 if ((tailroom >= (ETH_FCS_LEN + padlen)) &&
365 (headroom >= EEM_HLEN) && !skb_cloned(skb))
366 goto done;
367
368 skb2 = skb_copy_expand(skb, EEM_HLEN, ETH_FCS_LEN + padlen, GFP_ATOMIC);
369 dev_kfree_skb_any(skb);
370 skb = skb2;
371 if (!skb)
372 return skb;
373
374 done:
375 /* use the "no CRC" option */
376 put_unaligned_be32(0xdeadbeef, skb_put(skb, 4));
377
378 /* EEM packet header format:
379 * b0..13: length of ethernet frame
380 * b14: bmCRC (0 == sentinel CRC)
381 * b15: bmType (0 == data)
382 */
383 len = skb->len;
384 put_unaligned_le16(len & 0x3FFF, skb_push(skb, 2));
385
386 /* add a zero-length EEM packet, if needed */
387 if (padlen)
388 put_unaligned_le16(0, skb_put(skb, 2));
389
390 return skb;
391 }
392
393 /*
394 * Remove the EEM header. Note that there can be many EEM packets in a single
395 * USB transfer, so we need to break them out and handle them independently.
396 */
eem_unwrap(struct gether * port,struct sk_buff * skb,struct sk_buff_head * list)397 static int eem_unwrap(struct gether *port,
398 struct sk_buff *skb,
399 struct sk_buff_head *list)
400 {
401 struct usb_composite_dev *cdev = port->func.config->cdev;
402 int status = 0;
403
404 do {
405 struct sk_buff *skb2;
406 u16 header;
407 u16 len = 0;
408
409 if (skb->len < EEM_HLEN) {
410 status = -EINVAL;
411 DBG(cdev, "invalid EEM header\n");
412 goto error;
413 }
414
415 /* remove the EEM header */
416 header = get_unaligned_le16(skb->data);
417 skb_pull(skb, EEM_HLEN);
418
419 /* EEM packet header format:
420 * b0..14: EEM type dependent (data or command)
421 * b15: bmType (0 == data, 1 == command)
422 */
423 if (header & BIT(15)) {
424 struct usb_request *req;
425 struct in_context *ctx;
426 struct usb_ep *ep;
427 u16 bmEEMCmd;
428
429 /* EEM command packet format:
430 * b0..10: bmEEMCmdParam
431 * b11..13: bmEEMCmd
432 * b14: reserved (must be zero)
433 * b15: bmType (1 == command)
434 */
435 if (header & BIT(14))
436 continue;
437
438 bmEEMCmd = (header >> 11) & 0x7;
439 switch (bmEEMCmd) {
440 case 0: /* echo */
441 len = header & 0x7FF;
442 if (skb->len < len) {
443 status = -EOVERFLOW;
444 goto error;
445 }
446
447 skb2 = skb_clone(skb, GFP_ATOMIC);
448 if (unlikely(!skb2)) {
449 DBG(cdev, "EEM echo response error\n");
450 goto next;
451 }
452 skb_trim(skb2, len);
453 put_unaligned_le16(BIT(15) | BIT(11) | len,
454 skb_push(skb2, 2));
455
456 ep = port->in_ep;
457 req = usb_ep_alloc_request(ep, GFP_ATOMIC);
458 if (!req) {
459 dev_kfree_skb_any(skb2);
460 goto next;
461 }
462
463 req->buf = kmalloc(skb2->len, GFP_KERNEL);
464 if (!req->buf) {
465 usb_ep_free_request(ep, req);
466 dev_kfree_skb_any(skb2);
467 goto next;
468 }
469
470 ctx = kmalloc(sizeof(*ctx), GFP_KERNEL);
471 if (!ctx) {
472 kfree(req->buf);
473 usb_ep_free_request(ep, req);
474 dev_kfree_skb_any(skb2);
475 goto next;
476 }
477 ctx->skb = skb2;
478 ctx->ep = ep;
479
480 skb_copy_bits(skb2, 0, req->buf, skb2->len);
481 req->length = skb2->len;
482 req->complete = eem_cmd_complete;
483 req->zero = 1;
484 req->context = ctx;
485 if (usb_ep_queue(port->in_ep, req, GFP_ATOMIC))
486 DBG(cdev, "echo response queue fail\n");
487 break;
488
489 case 1: /* echo response */
490 case 2: /* suspend hint */
491 case 3: /* response hint */
492 case 4: /* response complete hint */
493 case 5: /* tickle */
494 default: /* reserved */
495 continue;
496 }
497 } else {
498 u32 crc, crc2;
499 struct sk_buff *skb3;
500
501 /* check for zero-length EEM packet */
502 if (header == 0)
503 continue;
504
505 /* EEM data packet format:
506 * b0..13: length of ethernet frame
507 * b14: bmCRC (0 == sentinel, 1 == calculated)
508 * b15: bmType (0 == data)
509 */
510 len = header & 0x3FFF;
511 if ((skb->len < len)
512 || (len < (ETH_HLEN + ETH_FCS_LEN))) {
513 status = -EINVAL;
514 goto error;
515 }
516
517 /* validate CRC */
518 if (header & BIT(14)) {
519 crc = get_unaligned_le32(skb->data + len
520 - ETH_FCS_LEN);
521 crc2 = ~crc32_le(~0,
522 skb->data, len - ETH_FCS_LEN);
523 } else {
524 crc = get_unaligned_be32(skb->data + len
525 - ETH_FCS_LEN);
526 crc2 = 0xdeadbeef;
527 }
528 if (crc != crc2) {
529 DBG(cdev, "invalid EEM CRC\n");
530 goto next;
531 }
532
533 skb2 = skb_clone(skb, GFP_ATOMIC);
534 if (unlikely(!skb2)) {
535 DBG(cdev, "unable to unframe EEM packet\n");
536 goto next;
537 }
538 skb_trim(skb2, len - ETH_FCS_LEN);
539
540 skb3 = skb_copy_expand(skb2,
541 NET_IP_ALIGN,
542 0,
543 GFP_ATOMIC);
544 if (unlikely(!skb3)) {
545 DBG(cdev, "unable to realign EEM packet\n");
546 dev_kfree_skb_any(skb2);
547 goto next;
548 }
549 dev_kfree_skb_any(skb2);
550 skb_queue_tail(list, skb3);
551 }
552 next:
553 skb_pull(skb, len);
554 } while (skb->len);
555
556 error:
557 dev_kfree_skb_any(skb);
558 return status;
559 }
560
to_f_eem_opts(struct config_item * item)561 static inline struct f_eem_opts *to_f_eem_opts(struct config_item *item)
562 {
563 return container_of(to_config_group(item), struct f_eem_opts,
564 func_inst.group);
565 }
566
567 /* f_eem_item_ops */
568 USB_ETHERNET_CONFIGFS_ITEM(eem);
569
570 /* f_eem_opts_dev_addr */
571 USB_ETHERNET_CONFIGFS_ITEM_ATTR_DEV_ADDR(eem);
572
573 /* f_eem_opts_host_addr */
574 USB_ETHERNET_CONFIGFS_ITEM_ATTR_HOST_ADDR(eem);
575
576 /* f_eem_opts_qmult */
577 USB_ETHERNET_CONFIGFS_ITEM_ATTR_QMULT(eem);
578
579 /* f_eem_opts_ifname */
580 USB_ETHERNET_CONFIGFS_ITEM_ATTR_IFNAME(eem);
581
582 static struct configfs_attribute *eem_attrs[] = {
583 &eem_opts_attr_dev_addr,
584 &eem_opts_attr_host_addr,
585 &eem_opts_attr_qmult,
586 &eem_opts_attr_ifname,
587 NULL,
588 };
589
590 static struct config_item_type eem_func_type = {
591 .ct_item_ops = &eem_item_ops,
592 .ct_attrs = eem_attrs,
593 .ct_owner = THIS_MODULE,
594 };
595
eem_free_inst(struct usb_function_instance * f)596 static void eem_free_inst(struct usb_function_instance *f)
597 {
598 struct f_eem_opts *opts;
599
600 opts = container_of(f, struct f_eem_opts, func_inst);
601 if (opts->bound)
602 gether_cleanup(netdev_priv(opts->net));
603 else
604 free_netdev(opts->net);
605 kfree(opts);
606 }
607
eem_alloc_inst(void)608 static struct usb_function_instance *eem_alloc_inst(void)
609 {
610 struct f_eem_opts *opts;
611
612 opts = kzalloc(sizeof(*opts), GFP_KERNEL);
613 if (!opts)
614 return ERR_PTR(-ENOMEM);
615 mutex_init(&opts->lock);
616 opts->func_inst.free_func_inst = eem_free_inst;
617 opts->net = gether_setup_default();
618 if (IS_ERR(opts->net)) {
619 struct net_device *net = opts->net;
620 kfree(opts);
621 return ERR_CAST(net);
622 }
623
624 config_group_init_type_name(&opts->func_inst.group, "", &eem_func_type);
625
626 return &opts->func_inst;
627 }
628
eem_free(struct usb_function * f)629 static void eem_free(struct usb_function *f)
630 {
631 struct f_eem *eem;
632 struct f_eem_opts *opts;
633
634 eem = func_to_eem(f);
635 opts = container_of(f->fi, struct f_eem_opts, func_inst);
636 kfree(eem);
637 mutex_lock(&opts->lock);
638 opts->refcnt--;
639 mutex_unlock(&opts->lock);
640 }
641
eem_unbind(struct usb_configuration * c,struct usb_function * f)642 static void eem_unbind(struct usb_configuration *c, struct usb_function *f)
643 {
644 DBG(c->cdev, "eem unbind\n");
645
646 usb_free_all_descriptors(f);
647 }
648
eem_alloc(struct usb_function_instance * fi)649 static struct usb_function *eem_alloc(struct usb_function_instance *fi)
650 {
651 struct f_eem *eem;
652 struct f_eem_opts *opts;
653
654 /* allocate and initialize one new instance */
655 eem = kzalloc(sizeof(*eem), GFP_KERNEL);
656 if (!eem)
657 return ERR_PTR(-ENOMEM);
658
659 opts = container_of(fi, struct f_eem_opts, func_inst);
660 mutex_lock(&opts->lock);
661 opts->refcnt++;
662
663 eem->port.ioport = netdev_priv(opts->net);
664 mutex_unlock(&opts->lock);
665 eem->port.cdc_filter = DEFAULT_FILTER;
666
667 eem->port.func.name = "cdc_eem";
668 /* descriptors are per-instance copies */
669 eem->port.func.bind = eem_bind;
670 eem->port.func.unbind = eem_unbind;
671 eem->port.func.set_alt = eem_set_alt;
672 eem->port.func.setup = eem_setup;
673 eem->port.func.disable = eem_disable;
674 eem->port.func.free_func = eem_free;
675 eem->port.wrap = eem_wrap;
676 eem->port.unwrap = eem_unwrap;
677 eem->port.header_len = EEM_HLEN;
678
679 return &eem->port.func;
680 }
681
682 DECLARE_USB_FUNCTION_INIT(eem, eem_alloc_inst, eem_alloc);
683 MODULE_LICENSE("GPL");
684 MODULE_AUTHOR("David Brownell");
685