1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3 * f_eem.c -- USB CDC Ethernet (EEM) link function driver
4 *
5 * Copyright (C) 2003-2005,2008 David Brownell
6 * Copyright (C) 2008 Nokia Corporation
7 * Copyright (C) 2009 EF Johnson Technologies
8 */
9
10 #include <linux/cleanup.h>
11 #include <linux/kernel.h>
12 #include <linux/module.h>
13 #include <linux/device.h>
14 #include <linux/etherdevice.h>
15 #include <linux/crc32.h>
16 #include <linux/slab.h>
17
18 #include "u_ether.h"
19 #include "u_ether_configfs.h"
20 #include "u_eem.h"
21
22 #define EEM_HLEN 2
23
24 /*
25 * This function is a "CDC Ethernet Emulation Model" (CDC EEM)
26 * Ethernet link.
27 */
28
29 struct f_eem {
30 struct gether port;
31 u8 ctrl_id;
32 };
33
34 struct in_context {
35 struct sk_buff *skb;
36 struct usb_ep *ep;
37 };
38
func_to_eem(struct usb_function * f)39 static inline struct f_eem *func_to_eem(struct usb_function *f)
40 {
41 return container_of(f, struct f_eem, port.func);
42 }
43
44 /*-------------------------------------------------------------------------*/
45
46 /* interface descriptor: */
47
48 static struct usb_interface_descriptor eem_intf = {
49 .bLength = sizeof eem_intf,
50 .bDescriptorType = USB_DT_INTERFACE,
51
52 /* .bInterfaceNumber = DYNAMIC */
53 .bNumEndpoints = 2,
54 .bInterfaceClass = USB_CLASS_COMM,
55 .bInterfaceSubClass = USB_CDC_SUBCLASS_EEM,
56 .bInterfaceProtocol = USB_CDC_PROTO_EEM,
57 /* .iInterface = DYNAMIC */
58 };
59
60 /* full speed support: */
61
62 static struct usb_endpoint_descriptor eem_fs_in_desc = {
63 .bLength = USB_DT_ENDPOINT_SIZE,
64 .bDescriptorType = USB_DT_ENDPOINT,
65
66 .bEndpointAddress = USB_DIR_IN,
67 .bmAttributes = USB_ENDPOINT_XFER_BULK,
68 };
69
70 static struct usb_endpoint_descriptor eem_fs_out_desc = {
71 .bLength = USB_DT_ENDPOINT_SIZE,
72 .bDescriptorType = USB_DT_ENDPOINT,
73
74 .bEndpointAddress = USB_DIR_OUT,
75 .bmAttributes = USB_ENDPOINT_XFER_BULK,
76 };
77
78 static struct usb_descriptor_header *eem_fs_function[] = {
79 /* CDC EEM control descriptors */
80 (struct usb_descriptor_header *) &eem_intf,
81 (struct usb_descriptor_header *) &eem_fs_in_desc,
82 (struct usb_descriptor_header *) &eem_fs_out_desc,
83 NULL,
84 };
85
86 /* high speed support: */
87
88 static struct usb_endpoint_descriptor eem_hs_in_desc = {
89 .bLength = USB_DT_ENDPOINT_SIZE,
90 .bDescriptorType = USB_DT_ENDPOINT,
91
92 .bEndpointAddress = USB_DIR_IN,
93 .bmAttributes = USB_ENDPOINT_XFER_BULK,
94 .wMaxPacketSize = cpu_to_le16(512),
95 };
96
97 static struct usb_endpoint_descriptor eem_hs_out_desc = {
98 .bLength = USB_DT_ENDPOINT_SIZE,
99 .bDescriptorType = USB_DT_ENDPOINT,
100
101 .bEndpointAddress = USB_DIR_OUT,
102 .bmAttributes = USB_ENDPOINT_XFER_BULK,
103 .wMaxPacketSize = cpu_to_le16(512),
104 };
105
106 static struct usb_descriptor_header *eem_hs_function[] = {
107 /* CDC EEM control descriptors */
108 (struct usb_descriptor_header *) &eem_intf,
109 (struct usb_descriptor_header *) &eem_hs_in_desc,
110 (struct usb_descriptor_header *) &eem_hs_out_desc,
111 NULL,
112 };
113
114 /* super speed support: */
115
116 static struct usb_endpoint_descriptor eem_ss_in_desc = {
117 .bLength = USB_DT_ENDPOINT_SIZE,
118 .bDescriptorType = USB_DT_ENDPOINT,
119
120 .bEndpointAddress = USB_DIR_IN,
121 .bmAttributes = USB_ENDPOINT_XFER_BULK,
122 .wMaxPacketSize = cpu_to_le16(1024),
123 };
124
125 static struct usb_endpoint_descriptor eem_ss_out_desc = {
126 .bLength = USB_DT_ENDPOINT_SIZE,
127 .bDescriptorType = USB_DT_ENDPOINT,
128
129 .bEndpointAddress = USB_DIR_OUT,
130 .bmAttributes = USB_ENDPOINT_XFER_BULK,
131 .wMaxPacketSize = cpu_to_le16(1024),
132 };
133
134 static struct usb_ss_ep_comp_descriptor eem_ss_bulk_comp_desc = {
135 .bLength = sizeof eem_ss_bulk_comp_desc,
136 .bDescriptorType = USB_DT_SS_ENDPOINT_COMP,
137
138 /* the following 2 values can be tweaked if necessary */
139 /* .bMaxBurst = 0, */
140 /* .bmAttributes = 0, */
141 };
142
143 static struct usb_descriptor_header *eem_ss_function[] = {
144 /* CDC EEM control descriptors */
145 (struct usb_descriptor_header *) &eem_intf,
146 (struct usb_descriptor_header *) &eem_ss_in_desc,
147 (struct usb_descriptor_header *) &eem_ss_bulk_comp_desc,
148 (struct usb_descriptor_header *) &eem_ss_out_desc,
149 (struct usb_descriptor_header *) &eem_ss_bulk_comp_desc,
150 NULL,
151 };
152
153 /* string descriptors: */
154
155 static struct usb_string eem_string_defs[] = {
156 [0].s = "CDC Ethernet Emulation Model (EEM)",
157 { } /* end of list */
158 };
159
160 static struct usb_gadget_strings eem_string_table = {
161 .language = 0x0409, /* en-us */
162 .strings = eem_string_defs,
163 };
164
165 static struct usb_gadget_strings *eem_strings[] = {
166 &eem_string_table,
167 NULL,
168 };
169
170 /*-------------------------------------------------------------------------*/
171
eem_setup(struct usb_function * f,const struct usb_ctrlrequest * ctrl)172 static int eem_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl)
173 {
174 struct usb_composite_dev *cdev = f->config->cdev;
175 u16 w_index = le16_to_cpu(ctrl->wIndex);
176 u16 w_value = le16_to_cpu(ctrl->wValue);
177 u16 w_length = le16_to_cpu(ctrl->wLength);
178
179 DBG(cdev, "invalid control req%02x.%02x v%04x i%04x l%d\n",
180 ctrl->bRequestType, ctrl->bRequest,
181 w_value, w_index, w_length);
182
183 /* device either stalls (value < 0) or reports success */
184 return -EOPNOTSUPP;
185 }
186
187
eem_set_alt(struct usb_function * f,unsigned intf,unsigned alt)188 static int eem_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
189 {
190 struct f_eem *eem = func_to_eem(f);
191 struct usb_composite_dev *cdev = f->config->cdev;
192 struct net_device *net;
193
194 /* we know alt == 0, so this is an activation or a reset */
195 if (alt != 0)
196 goto fail;
197
198 if (intf == eem->ctrl_id) {
199 DBG(cdev, "reset eem\n");
200 gether_disconnect(&eem->port);
201
202 if (!eem->port.in_ep->desc || !eem->port.out_ep->desc) {
203 DBG(cdev, "init eem\n");
204 if (config_ep_by_speed(cdev->gadget, f,
205 eem->port.in_ep) ||
206 config_ep_by_speed(cdev->gadget, f,
207 eem->port.out_ep)) {
208 eem->port.in_ep->desc = NULL;
209 eem->port.out_ep->desc = NULL;
210 goto fail;
211 }
212 }
213
214 /* zlps should not occur because zero-length EEM packets
215 * will be inserted in those cases where they would occur
216 */
217 eem->port.is_zlp_ok = 1;
218 eem->port.cdc_filter = DEFAULT_FILTER;
219 DBG(cdev, "activate eem\n");
220 net = gether_connect(&eem->port);
221 if (IS_ERR(net))
222 return PTR_ERR(net);
223 } else
224 goto fail;
225
226 return 0;
227 fail:
228 return -EINVAL;
229 }
230
eem_disable(struct usb_function * f)231 static void eem_disable(struct usb_function *f)
232 {
233 struct f_eem *eem = func_to_eem(f);
234 struct usb_composite_dev *cdev = f->config->cdev;
235
236 DBG(cdev, "eem deactivated\n");
237
238 if (eem->port.in_ep->enabled)
239 gether_disconnect(&eem->port);
240 }
241
242 /*-------------------------------------------------------------------------*/
243
244 /* EEM function driver setup/binding */
245
eem_bind(struct usb_configuration * c,struct usb_function * f)246 static int eem_bind(struct usb_configuration *c, struct usb_function *f)
247 {
248 struct usb_composite_dev *cdev = c->cdev;
249 struct f_eem *eem = func_to_eem(f);
250 struct usb_string *us;
251 int status;
252 struct usb_ep *ep;
253
254 struct f_eem_opts *eem_opts;
255 struct net_device *net __free(detach_gadget) = NULL;
256
257 eem_opts = container_of(f->fi, struct f_eem_opts, func_inst);
258
259 scoped_guard(mutex, &eem_opts->lock)
260 if (eem_opts->bind_count == 0 && !eem_opts->bound) {
261 if (!device_is_registered(&eem_opts->net->dev)) {
262 gether_set_gadget(eem_opts->net, cdev->gadget);
263 status = gether_register_netdev(eem_opts->net);
264 } else
265 status = gether_attach_gadget(eem_opts->net, cdev->gadget);
266
267 if (status)
268 return status;
269 net = eem_opts->net;
270 }
271
272 us = usb_gstrings_attach(cdev, eem_strings,
273 ARRAY_SIZE(eem_string_defs));
274 if (IS_ERR(us))
275 return PTR_ERR(us);
276 eem_intf.iInterface = us[0].id;
277
278 /* allocate instance-specific interface IDs */
279 status = usb_interface_id(c, f);
280 if (status < 0)
281 return status;
282 eem->ctrl_id = status;
283 eem_intf.bInterfaceNumber = status;
284
285 /* allocate instance-specific endpoints */
286 ep = usb_ep_autoconfig(cdev->gadget, &eem_fs_in_desc);
287 if (!ep)
288 return -ENODEV;
289 eem->port.in_ep = ep;
290
291 ep = usb_ep_autoconfig(cdev->gadget, &eem_fs_out_desc);
292 if (!ep)
293 return -ENODEV;
294 eem->port.out_ep = ep;
295
296 /* support all relevant hardware speeds... we expect that when
297 * hardware is dual speed, all bulk-capable endpoints work at
298 * both speeds
299 */
300 eem_hs_in_desc.bEndpointAddress = eem_fs_in_desc.bEndpointAddress;
301 eem_hs_out_desc.bEndpointAddress = eem_fs_out_desc.bEndpointAddress;
302
303 eem_ss_in_desc.bEndpointAddress = eem_fs_in_desc.bEndpointAddress;
304 eem_ss_out_desc.bEndpointAddress = eem_fs_out_desc.bEndpointAddress;
305
306 status = usb_assign_descriptors(f, eem_fs_function, eem_hs_function,
307 eem_ss_function, eem_ss_function);
308 if (status)
309 return status;
310
311 eem_opts->bind_count++;
312 retain_and_null_ptr(net);
313
314 DBG(cdev, "CDC Ethernet (EEM): IN/%s OUT/%s\n",
315 eem->port.in_ep->name, eem->port.out_ep->name);
316 return 0;
317 }
318
eem_cmd_complete(struct usb_ep * ep,struct usb_request * req)319 static void eem_cmd_complete(struct usb_ep *ep, struct usb_request *req)
320 {
321 struct in_context *ctx = req->context;
322
323 dev_kfree_skb_any(ctx->skb);
324 kfree(req->buf);
325 usb_ep_free_request(ctx->ep, req);
326 kfree(ctx);
327 }
328
329 /*
330 * Add the EEM header and ethernet checksum.
331 * We currently do not attempt to put multiple ethernet frames
332 * into a single USB transfer
333 */
eem_wrap(struct gether * port,struct sk_buff * skb)334 static struct sk_buff *eem_wrap(struct gether *port, struct sk_buff *skb)
335 {
336 struct sk_buff *skb2 = NULL;
337 struct usb_ep *in = port->in_ep;
338 int headroom, tailroom, padlen = 0;
339 u16 len;
340
341 if (!skb)
342 return NULL;
343
344 len = skb->len;
345 headroom = skb_headroom(skb);
346 tailroom = skb_tailroom(skb);
347
348 /* When (len + EEM_HLEN + ETH_FCS_LEN) % in->maxpacket) is 0,
349 * stick two bytes of zero-length EEM packet on the end.
350 */
351 if (((len + EEM_HLEN + ETH_FCS_LEN) % in->maxpacket) == 0)
352 padlen += 2;
353
354 if ((tailroom >= (ETH_FCS_LEN + padlen)) &&
355 (headroom >= EEM_HLEN) && !skb_cloned(skb))
356 goto done;
357
358 skb2 = skb_copy_expand(skb, EEM_HLEN, ETH_FCS_LEN + padlen, GFP_ATOMIC);
359 dev_kfree_skb_any(skb);
360 skb = skb2;
361 if (!skb)
362 return skb;
363
364 done:
365 /* use the "no CRC" option */
366 put_unaligned_be32(0xdeadbeef, skb_put(skb, 4));
367
368 /* EEM packet header format:
369 * b0..13: length of ethernet frame
370 * b14: bmCRC (0 == sentinel CRC)
371 * b15: bmType (0 == data)
372 */
373 len = skb->len;
374 put_unaligned_le16(len & 0x3FFF, skb_push(skb, 2));
375
376 /* add a zero-length EEM packet, if needed */
377 if (padlen)
378 put_unaligned_le16(0, skb_put(skb, 2));
379
380 return skb;
381 }
382
383 /*
384 * Remove the EEM header. Note that there can be many EEM packets in a single
385 * USB transfer, so we need to break them out and handle them independently.
386 */
eem_unwrap(struct gether * port,struct sk_buff * skb,struct sk_buff_head * list)387 static int eem_unwrap(struct gether *port,
388 struct sk_buff *skb,
389 struct sk_buff_head *list)
390 {
391 struct usb_composite_dev *cdev = port->func.config->cdev;
392 int status = 0;
393
394 do {
395 struct sk_buff *skb2;
396 u16 header;
397 u16 len = 0;
398
399 if (skb->len < EEM_HLEN) {
400 status = -EINVAL;
401 DBG(cdev, "invalid EEM header\n");
402 goto error;
403 }
404
405 /* remove the EEM header */
406 header = get_unaligned_le16(skb->data);
407 skb_pull(skb, EEM_HLEN);
408
409 /* EEM packet header format:
410 * b0..14: EEM type dependent (data or command)
411 * b15: bmType (0 == data, 1 == command)
412 */
413 if (header & BIT(15)) {
414 struct usb_request *req;
415 struct in_context *ctx;
416 struct usb_ep *ep;
417 u16 bmEEMCmd;
418
419 /* EEM command packet format:
420 * b0..10: bmEEMCmdParam
421 * b11..13: bmEEMCmd
422 * b14: reserved (must be zero)
423 * b15: bmType (1 == command)
424 */
425 if (header & BIT(14))
426 continue;
427
428 bmEEMCmd = (header >> 11) & 0x7;
429 switch (bmEEMCmd) {
430 case 0: /* echo */
431 len = header & 0x7FF;
432 if (skb->len < len) {
433 status = -EOVERFLOW;
434 goto error;
435 }
436
437 skb2 = skb_clone(skb, GFP_ATOMIC);
438 if (unlikely(!skb2)) {
439 DBG(cdev, "EEM echo response error\n");
440 goto next;
441 }
442 skb_trim(skb2, len);
443 put_unaligned_le16(BIT(15) | BIT(11) | len,
444 skb_push(skb2, 2));
445
446 ep = port->in_ep;
447 req = usb_ep_alloc_request(ep, GFP_ATOMIC);
448 if (!req) {
449 dev_kfree_skb_any(skb2);
450 goto next;
451 }
452
453 req->buf = kmalloc(skb2->len, GFP_KERNEL);
454 if (!req->buf) {
455 usb_ep_free_request(ep, req);
456 dev_kfree_skb_any(skb2);
457 goto next;
458 }
459
460 ctx = kmalloc_obj(*ctx);
461 if (!ctx) {
462 kfree(req->buf);
463 usb_ep_free_request(ep, req);
464 dev_kfree_skb_any(skb2);
465 goto next;
466 }
467 ctx->skb = skb2;
468 ctx->ep = ep;
469
470 skb_copy_bits(skb2, 0, req->buf, skb2->len);
471 req->length = skb2->len;
472 req->complete = eem_cmd_complete;
473 req->zero = 1;
474 req->context = ctx;
475 if (usb_ep_queue(port->in_ep, req, GFP_ATOMIC)) {
476 DBG(cdev, "echo response queue fail\n");
477 kfree(ctx);
478 kfree(req->buf);
479 usb_ep_free_request(ep, req);
480 dev_kfree_skb_any(skb2);
481 }
482 break;
483
484 case 1: /* echo response */
485 case 2: /* suspend hint */
486 case 3: /* response hint */
487 case 4: /* response complete hint */
488 case 5: /* tickle */
489 default: /* reserved */
490 continue;
491 }
492 } else {
493 u32 crc, crc2;
494 struct sk_buff *skb3;
495
496 /* check for zero-length EEM packet */
497 if (header == 0)
498 continue;
499
500 /* EEM data packet format:
501 * b0..13: length of ethernet frame
502 * b14: bmCRC (0 == sentinel, 1 == calculated)
503 * b15: bmType (0 == data)
504 */
505 len = header & 0x3FFF;
506 if ((skb->len < len)
507 || (len < (ETH_HLEN + ETH_FCS_LEN))) {
508 status = -EINVAL;
509 goto error;
510 }
511
512 /* validate CRC */
513 if (header & BIT(14)) {
514 crc = get_unaligned_le32(skb->data + len
515 - ETH_FCS_LEN);
516 crc2 = ~crc32_le(~0,
517 skb->data, len - ETH_FCS_LEN);
518 } else {
519 crc = get_unaligned_be32(skb->data + len
520 - ETH_FCS_LEN);
521 crc2 = 0xdeadbeef;
522 }
523 if (crc != crc2) {
524 DBG(cdev, "invalid EEM CRC\n");
525 goto next;
526 }
527
528 skb2 = skb_clone(skb, GFP_ATOMIC);
529 if (unlikely(!skb2)) {
530 DBG(cdev, "unable to unframe EEM packet\n");
531 goto next;
532 }
533 skb_trim(skb2, len - ETH_FCS_LEN);
534
535 skb3 = skb_copy_expand(skb2,
536 NET_IP_ALIGN,
537 0,
538 GFP_ATOMIC);
539 if (unlikely(!skb3)) {
540 dev_kfree_skb_any(skb2);
541 goto next;
542 }
543 dev_kfree_skb_any(skb2);
544 skb_queue_tail(list, skb3);
545 }
546 next:
547 skb_pull(skb, len);
548 } while (skb->len);
549
550 error:
551 dev_kfree_skb_any(skb);
552 return status;
553 }
554
to_f_eem_opts(struct config_item * item)555 static inline struct f_eem_opts *to_f_eem_opts(struct config_item *item)
556 {
557 return container_of(to_config_group(item), struct f_eem_opts,
558 func_inst.group);
559 }
560
561 /* f_eem_item_ops */
562 USB_ETHERNET_CONFIGFS_ITEM(eem);
563
564 /* f_eem_opts_dev_addr */
565 USB_ETHERNET_CONFIGFS_ITEM_ATTR_DEV_ADDR(eem);
566
567 /* f_eem_opts_host_addr */
568 USB_ETHERNET_CONFIGFS_ITEM_ATTR_HOST_ADDR(eem);
569
570 /* f_eem_opts_qmult */
571 USB_ETHERNET_CONFIGFS_ITEM_ATTR_QMULT(eem);
572
573 /* f_eem_opts_ifname */
574 USB_ETHERNET_CONFIGFS_ITEM_ATTR_IFNAME(eem);
575
576 static struct configfs_attribute *eem_attrs[] = {
577 &eem_opts_attr_dev_addr,
578 &eem_opts_attr_host_addr,
579 &eem_opts_attr_qmult,
580 &eem_opts_attr_ifname,
581 NULL,
582 };
583
584 static const struct config_item_type eem_func_type = {
585 .ct_item_ops = &eem_item_ops,
586 .ct_attrs = eem_attrs,
587 .ct_owner = THIS_MODULE,
588 };
589
eem_free_inst(struct usb_function_instance * f)590 static void eem_free_inst(struct usb_function_instance *f)
591 {
592 struct f_eem_opts *opts;
593
594 opts = container_of(f, struct f_eem_opts, func_inst);
595 if (device_is_registered(&opts->net->dev))
596 gether_cleanup(netdev_priv(opts->net));
597 else
598 free_netdev(opts->net);
599 kfree(opts);
600 }
601
eem_alloc_inst(void)602 static struct usb_function_instance *eem_alloc_inst(void)
603 {
604 struct f_eem_opts *opts;
605
606 opts = kzalloc_obj(*opts);
607 if (!opts)
608 return ERR_PTR(-ENOMEM);
609 mutex_init(&opts->lock);
610 opts->func_inst.free_func_inst = eem_free_inst;
611 opts->net = gether_setup_default();
612 if (IS_ERR(opts->net)) {
613 struct net_device *net = opts->net;
614 kfree(opts);
615 return ERR_CAST(net);
616 }
617
618 config_group_init_type_name(&opts->func_inst.group, "", &eem_func_type);
619
620 return &opts->func_inst;
621 }
622
eem_free(struct usb_function * f)623 static void eem_free(struct usb_function *f)
624 {
625 struct f_eem *eem;
626 struct f_eem_opts *opts;
627
628 eem = func_to_eem(f);
629 opts = container_of(f->fi, struct f_eem_opts, func_inst);
630 kfree(eem);
631 mutex_lock(&opts->lock);
632 opts->refcnt--;
633 mutex_unlock(&opts->lock);
634 }
635
eem_unbind(struct usb_configuration * c,struct usb_function * f)636 static void eem_unbind(struct usb_configuration *c, struct usb_function *f)
637 {
638 struct f_eem_opts *opts;
639
640 DBG(c->cdev, "eem unbind\n");
641
642 opts = container_of(f->fi, struct f_eem_opts, func_inst);
643
644 usb_free_all_descriptors(f);
645
646 opts->bind_count--;
647 if (opts->bind_count == 0 && !opts->bound)
648 gether_detach_gadget(opts->net);
649 }
650
eem_alloc(struct usb_function_instance * fi)651 static struct usb_function *eem_alloc(struct usb_function_instance *fi)
652 {
653 struct f_eem *eem;
654 struct f_eem_opts *opts;
655
656 /* allocate and initialize one new instance */
657 eem = kzalloc_obj(*eem);
658 if (!eem)
659 return ERR_PTR(-ENOMEM);
660
661 opts = container_of(fi, struct f_eem_opts, func_inst);
662 mutex_lock(&opts->lock);
663 opts->refcnt++;
664
665 eem->port.ioport = netdev_priv(opts->net);
666 mutex_unlock(&opts->lock);
667 eem->port.cdc_filter = DEFAULT_FILTER;
668
669 eem->port.func.name = "cdc_eem";
670 /* descriptors are per-instance copies */
671 eem->port.func.bind = eem_bind;
672 eem->port.func.unbind = eem_unbind;
673 eem->port.func.set_alt = eem_set_alt;
674 eem->port.func.setup = eem_setup;
675 eem->port.func.disable = eem_disable;
676 eem->port.func.free_func = eem_free;
677 eem->port.wrap = eem_wrap;
678 eem->port.unwrap = eem_unwrap;
679 eem->port.header_len = EEM_HLEN;
680
681 return &eem->port.func;
682 }
683
684 DECLARE_USB_FUNCTION_INIT(eem, eem_alloc_inst, eem_alloc);
685 MODULE_DESCRIPTION("USB CDC Ethernet (EEM) link function driver");
686 MODULE_LICENSE("GPL");
687 MODULE_AUTHOR("David Brownell");
688