1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * S390 kdump implementation 4 * 5 * Copyright IBM Corp. 2011 6 * Author(s): Michael Holzheu <holzheu@linux.vnet.ibm.com> 7 */ 8 9 #include <linux/crash_dump.h> 10 #include <asm/lowcore.h> 11 #include <linux/kernel.h> 12 #include <linux/init.h> 13 #include <linux/mm.h> 14 #include <linux/gfp.h> 15 #include <linux/slab.h> 16 #include <linux/memblock.h> 17 #include <linux/elf.h> 18 #include <linux/uio.h> 19 #include <asm/asm-offsets.h> 20 #include <asm/os_info.h> 21 #include <asm/elf.h> 22 #include <asm/ipl.h> 23 #include <asm/sclp.h> 24 #include <asm/maccess.h> 25 #include <asm/fpu.h> 26 27 #define PTR_ADD(x, y) (((char *) (x)) + ((unsigned long) (y))) 28 #define PTR_SUB(x, y) (((char *) (x)) - ((unsigned long) (y))) 29 #define PTR_DIFF(x, y) ((unsigned long)(((char *) (x)) - ((unsigned long) (y)))) 30 31 static struct memblock_region oldmem_region; 32 33 static struct memblock_type oldmem_type = { 34 .cnt = 1, 35 .max = 1, 36 .total_size = 0, 37 .regions = &oldmem_region, 38 .name = "oldmem", 39 }; 40 41 struct save_area { 42 struct list_head list; 43 u64 psw[2]; 44 u64 ctrs[16]; 45 u64 gprs[16]; 46 u32 acrs[16]; 47 u64 fprs[16]; 48 u32 fpc; 49 u32 prefix; 50 u32 todpreg; 51 u64 timer; 52 u64 todcmp; 53 u64 vxrs_low[16]; 54 __vector128 vxrs_high[16]; 55 }; 56 57 static LIST_HEAD(dump_save_areas); 58 59 /* 60 * Allocate a save area 61 */ 62 struct save_area * __init save_area_alloc(bool is_boot_cpu) 63 { 64 struct save_area *sa; 65 66 sa = memblock_alloc(sizeof(*sa), 8); 67 if (!sa) 68 return NULL; 69 70 if (is_boot_cpu) 71 list_add(&sa->list, &dump_save_areas); 72 else 73 list_add_tail(&sa->list, &dump_save_areas); 74 return sa; 75 } 76 77 /* 78 * Return the address of the save area for the boot CPU 79 */ 80 struct save_area * __init save_area_boot_cpu(void) 81 { 82 return list_first_entry_or_null(&dump_save_areas, struct save_area, list); 83 } 84 85 /* 86 * Copy CPU registers into the save area 87 */ 88 void __init save_area_add_regs(struct save_area *sa, void *regs) 89 { 90 struct lowcore *lc; 91 92 lc = (struct lowcore *)(regs - __LC_FPREGS_SAVE_AREA); 93 memcpy(&sa->psw, &lc->psw_save_area, sizeof(sa->psw)); 94 memcpy(&sa->ctrs, &lc->cregs_save_area, sizeof(sa->ctrs)); 95 memcpy(&sa->gprs, &lc->gpregs_save_area, sizeof(sa->gprs)); 96 memcpy(&sa->acrs, &lc->access_regs_save_area, sizeof(sa->acrs)); 97 memcpy(&sa->fprs, &lc->floating_pt_save_area, sizeof(sa->fprs)); 98 memcpy(&sa->fpc, &lc->fpt_creg_save_area, sizeof(sa->fpc)); 99 memcpy(&sa->prefix, &lc->prefixreg_save_area, sizeof(sa->prefix)); 100 memcpy(&sa->todpreg, &lc->tod_progreg_save_area, sizeof(sa->todpreg)); 101 memcpy(&sa->timer, &lc->cpu_timer_save_area, sizeof(sa->timer)); 102 memcpy(&sa->todcmp, &lc->clock_comp_save_area, sizeof(sa->todcmp)); 103 } 104 105 /* 106 * Copy vector registers into the save area 107 */ 108 void __init save_area_add_vxrs(struct save_area *sa, __vector128 *vxrs) 109 { 110 int i; 111 112 /* Copy lower halves of vector registers 0-15 */ 113 for (i = 0; i < 16; i++) 114 sa->vxrs_low[i] = vxrs[i].low; 115 /* Copy vector registers 16-31 */ 116 memcpy(sa->vxrs_high, vxrs + 16, 16 * sizeof(__vector128)); 117 } 118 119 static size_t copy_oldmem_iter(struct iov_iter *iter, unsigned long src, size_t count) 120 { 121 size_t len, copied, res = 0; 122 123 while (count) { 124 if (!oldmem_data.start && src < sclp.hsa_size) { 125 /* Copy from zfcp/nvme dump HSA area */ 126 len = min(count, sclp.hsa_size - src); 127 copied = memcpy_hsa_iter(iter, src, len); 128 } else { 129 /* Check for swapped kdump oldmem areas */ 130 if (oldmem_data.start && src - oldmem_data.start < oldmem_data.size) { 131 src -= oldmem_data.start; 132 len = min(count, oldmem_data.size - src); 133 } else if (oldmem_data.start && src < oldmem_data.size) { 134 len = min(count, oldmem_data.size - src); 135 src += oldmem_data.start; 136 } else { 137 len = count; 138 } 139 copied = memcpy_real_iter(iter, src, len); 140 } 141 count -= copied; 142 src += copied; 143 res += copied; 144 if (copied < len) 145 break; 146 } 147 return res; 148 } 149 150 int copy_oldmem_kernel(void *dst, unsigned long src, size_t count) 151 { 152 struct iov_iter iter; 153 struct kvec kvec; 154 155 kvec.iov_base = dst; 156 kvec.iov_len = count; 157 iov_iter_kvec(&iter, ITER_DEST, &kvec, 1, count); 158 if (copy_oldmem_iter(&iter, src, count) < count) 159 return -EFAULT; 160 return 0; 161 } 162 163 /* 164 * Copy one page from "oldmem" 165 */ 166 ssize_t copy_oldmem_page(struct iov_iter *iter, unsigned long pfn, size_t csize, 167 unsigned long offset) 168 { 169 unsigned long src; 170 171 src = pfn_to_phys(pfn) + offset; 172 return copy_oldmem_iter(iter, src, csize); 173 } 174 175 /* 176 * Remap "oldmem" for kdump 177 * 178 * For the kdump reserved memory this functions performs a swap operation: 179 * [0 - OLDMEM_SIZE] is mapped to [OLDMEM_BASE - OLDMEM_BASE + OLDMEM_SIZE] 180 */ 181 static int remap_oldmem_pfn_range_kdump(struct vm_area_struct *vma, 182 unsigned long from, unsigned long pfn, 183 unsigned long size, pgprot_t prot) 184 { 185 unsigned long size_old; 186 int rc; 187 188 if (pfn < oldmem_data.size >> PAGE_SHIFT) { 189 size_old = min(size, oldmem_data.size - (pfn << PAGE_SHIFT)); 190 rc = remap_pfn_range(vma, from, 191 pfn + (oldmem_data.start >> PAGE_SHIFT), 192 size_old, prot); 193 if (rc || size == size_old) 194 return rc; 195 size -= size_old; 196 from += size_old; 197 pfn += size_old >> PAGE_SHIFT; 198 } 199 return remap_pfn_range(vma, from, pfn, size, prot); 200 } 201 202 /* 203 * Remap "oldmem" for zfcp/nvme dump 204 * 205 * We only map available memory above HSA size. Memory below HSA size 206 * is read on demand using the copy_oldmem_page() function. 207 */ 208 static int remap_oldmem_pfn_range_zfcpdump(struct vm_area_struct *vma, 209 unsigned long from, 210 unsigned long pfn, 211 unsigned long size, pgprot_t prot) 212 { 213 unsigned long hsa_end = sclp.hsa_size; 214 unsigned long size_hsa; 215 216 if (pfn < hsa_end >> PAGE_SHIFT) { 217 size_hsa = min(size, hsa_end - (pfn << PAGE_SHIFT)); 218 if (size == size_hsa) 219 return 0; 220 size -= size_hsa; 221 from += size_hsa; 222 pfn += size_hsa >> PAGE_SHIFT; 223 } 224 return remap_pfn_range(vma, from, pfn, size, prot); 225 } 226 227 /* 228 * Remap "oldmem" for kdump or zfcp/nvme dump 229 */ 230 int remap_oldmem_pfn_range(struct vm_area_struct *vma, unsigned long from, 231 unsigned long pfn, unsigned long size, pgprot_t prot) 232 { 233 if (oldmem_data.start) 234 return remap_oldmem_pfn_range_kdump(vma, from, pfn, size, prot); 235 else 236 return remap_oldmem_pfn_range_zfcpdump(vma, from, pfn, size, 237 prot); 238 } 239 240 static const char *nt_name(Elf64_Word type) 241 { 242 const char *name = "LINUX"; 243 244 if (type == NT_PRPSINFO || type == NT_PRSTATUS || type == NT_PRFPREG) 245 name = KEXEC_CORE_NOTE_NAME; 246 return name; 247 } 248 249 /* 250 * Initialize ELF note 251 */ 252 static void *nt_init_name(void *buf, Elf64_Word type, void *desc, int d_len, 253 const char *name) 254 { 255 Elf64_Nhdr *note; 256 u64 len; 257 258 note = (Elf64_Nhdr *)buf; 259 note->n_namesz = strlen(name) + 1; 260 note->n_descsz = d_len; 261 note->n_type = type; 262 len = sizeof(Elf64_Nhdr); 263 264 memcpy(buf + len, name, note->n_namesz); 265 len = roundup(len + note->n_namesz, 4); 266 267 memcpy(buf + len, desc, note->n_descsz); 268 len = roundup(len + note->n_descsz, 4); 269 270 return PTR_ADD(buf, len); 271 } 272 273 static inline void *nt_init(void *buf, Elf64_Word type, void *desc, int d_len) 274 { 275 return nt_init_name(buf, type, desc, d_len, nt_name(type)); 276 } 277 278 /* 279 * Calculate the size of ELF note 280 */ 281 static size_t nt_size_name(int d_len, const char *name) 282 { 283 size_t size; 284 285 size = sizeof(Elf64_Nhdr); 286 size += roundup(strlen(name) + 1, 4); 287 size += roundup(d_len, 4); 288 289 return size; 290 } 291 292 static inline size_t nt_size(Elf64_Word type, int d_len) 293 { 294 return nt_size_name(d_len, nt_name(type)); 295 } 296 297 /* 298 * Fill ELF notes for one CPU with save area registers 299 */ 300 static void *fill_cpu_elf_notes(void *ptr, int cpu, struct save_area *sa) 301 { 302 struct elf_prstatus nt_prstatus; 303 elf_fpregset_t nt_fpregset; 304 305 /* Prepare prstatus note */ 306 memset(&nt_prstatus, 0, sizeof(nt_prstatus)); 307 memcpy(&nt_prstatus.pr_reg.gprs, sa->gprs, sizeof(sa->gprs)); 308 memcpy(&nt_prstatus.pr_reg.psw, sa->psw, sizeof(sa->psw)); 309 memcpy(&nt_prstatus.pr_reg.acrs, sa->acrs, sizeof(sa->acrs)); 310 nt_prstatus.common.pr_pid = cpu; 311 /* Prepare fpregset (floating point) note */ 312 memset(&nt_fpregset, 0, sizeof(nt_fpregset)); 313 memcpy(&nt_fpregset.fpc, &sa->fpc, sizeof(sa->fpc)); 314 memcpy(&nt_fpregset.fprs, &sa->fprs, sizeof(sa->fprs)); 315 /* Create ELF notes for the CPU */ 316 ptr = nt_init(ptr, NT_PRSTATUS, &nt_prstatus, sizeof(nt_prstatus)); 317 ptr = nt_init(ptr, NT_PRFPREG, &nt_fpregset, sizeof(nt_fpregset)); 318 ptr = nt_init(ptr, NT_S390_TIMER, &sa->timer, sizeof(sa->timer)); 319 ptr = nt_init(ptr, NT_S390_TODCMP, &sa->todcmp, sizeof(sa->todcmp)); 320 ptr = nt_init(ptr, NT_S390_TODPREG, &sa->todpreg, sizeof(sa->todpreg)); 321 ptr = nt_init(ptr, NT_S390_CTRS, &sa->ctrs, sizeof(sa->ctrs)); 322 ptr = nt_init(ptr, NT_S390_PREFIX, &sa->prefix, sizeof(sa->prefix)); 323 if (cpu_has_vx()) { 324 ptr = nt_init(ptr, NT_S390_VXRS_HIGH, 325 &sa->vxrs_high, sizeof(sa->vxrs_high)); 326 ptr = nt_init(ptr, NT_S390_VXRS_LOW, 327 &sa->vxrs_low, sizeof(sa->vxrs_low)); 328 } 329 return ptr; 330 } 331 332 /* 333 * Calculate size of ELF notes per cpu 334 */ 335 static size_t get_cpu_elf_notes_size(void) 336 { 337 struct save_area *sa = NULL; 338 size_t size; 339 340 size = nt_size(NT_PRSTATUS, sizeof(struct elf_prstatus)); 341 size += nt_size(NT_PRFPREG, sizeof(elf_fpregset_t)); 342 size += nt_size(NT_S390_TIMER, sizeof(sa->timer)); 343 size += nt_size(NT_S390_TODCMP, sizeof(sa->todcmp)); 344 size += nt_size(NT_S390_TODPREG, sizeof(sa->todpreg)); 345 size += nt_size(NT_S390_CTRS, sizeof(sa->ctrs)); 346 size += nt_size(NT_S390_PREFIX, sizeof(sa->prefix)); 347 if (cpu_has_vx()) { 348 size += nt_size(NT_S390_VXRS_HIGH, sizeof(sa->vxrs_high)); 349 size += nt_size(NT_S390_VXRS_LOW, sizeof(sa->vxrs_low)); 350 } 351 352 return size; 353 } 354 355 /* 356 * Initialize prpsinfo note (new kernel) 357 */ 358 static void *nt_prpsinfo(void *ptr) 359 { 360 struct elf_prpsinfo prpsinfo; 361 362 memset(&prpsinfo, 0, sizeof(prpsinfo)); 363 prpsinfo.pr_sname = 'R'; 364 strcpy(prpsinfo.pr_fname, "vmlinux"); 365 return nt_init(ptr, NT_PRPSINFO, &prpsinfo, sizeof(prpsinfo)); 366 } 367 368 /* 369 * Get vmcoreinfo using lowcore->vmcore_info (new kernel) 370 */ 371 static void *get_vmcoreinfo_old(unsigned long *size) 372 { 373 char nt_name[11], *vmcoreinfo; 374 unsigned long addr; 375 Elf64_Nhdr note; 376 377 if (copy_oldmem_kernel(&addr, __LC_VMCORE_INFO, sizeof(addr))) 378 return NULL; 379 memset(nt_name, 0, sizeof(nt_name)); 380 if (copy_oldmem_kernel(¬e, addr, sizeof(note))) 381 return NULL; 382 if (copy_oldmem_kernel(nt_name, addr + sizeof(note), 383 sizeof(nt_name) - 1)) 384 return NULL; 385 if (strcmp(nt_name, VMCOREINFO_NOTE_NAME) != 0) 386 return NULL; 387 vmcoreinfo = kzalloc(note.n_descsz, GFP_KERNEL); 388 if (!vmcoreinfo) 389 return NULL; 390 if (copy_oldmem_kernel(vmcoreinfo, addr + 24, note.n_descsz)) { 391 kfree(vmcoreinfo); 392 return NULL; 393 } 394 *size = note.n_descsz; 395 return vmcoreinfo; 396 } 397 398 /* 399 * Initialize vmcoreinfo note (new kernel) 400 */ 401 static void *nt_vmcoreinfo(void *ptr) 402 { 403 const char *name = VMCOREINFO_NOTE_NAME; 404 unsigned long size; 405 void *vmcoreinfo; 406 407 vmcoreinfo = os_info_old_entry(OS_INFO_VMCOREINFO, &size); 408 if (vmcoreinfo) 409 return nt_init_name(ptr, 0, vmcoreinfo, size, name); 410 411 vmcoreinfo = get_vmcoreinfo_old(&size); 412 if (!vmcoreinfo) 413 return ptr; 414 ptr = nt_init_name(ptr, 0, vmcoreinfo, size, name); 415 kfree(vmcoreinfo); 416 return ptr; 417 } 418 419 static size_t nt_vmcoreinfo_size(void) 420 { 421 const char *name = VMCOREINFO_NOTE_NAME; 422 unsigned long size; 423 void *vmcoreinfo; 424 425 vmcoreinfo = os_info_old_entry(OS_INFO_VMCOREINFO, &size); 426 if (vmcoreinfo) 427 return nt_size_name(size, name); 428 429 vmcoreinfo = get_vmcoreinfo_old(&size); 430 if (!vmcoreinfo) 431 return 0; 432 433 kfree(vmcoreinfo); 434 return nt_size_name(size, name); 435 } 436 437 /* 438 * Initialize final note (needed for /proc/vmcore code) 439 */ 440 static void *nt_final(void *ptr) 441 { 442 Elf64_Nhdr *note; 443 444 note = (Elf64_Nhdr *) ptr; 445 note->n_namesz = 0; 446 note->n_descsz = 0; 447 note->n_type = 0; 448 return PTR_ADD(ptr, sizeof(Elf64_Nhdr)); 449 } 450 451 /* 452 * Initialize ELF header (new kernel) 453 */ 454 static void *ehdr_init(Elf64_Ehdr *ehdr, int mem_chunk_cnt) 455 { 456 memset(ehdr, 0, sizeof(*ehdr)); 457 memcpy(ehdr->e_ident, ELFMAG, SELFMAG); 458 ehdr->e_ident[EI_CLASS] = ELFCLASS64; 459 ehdr->e_ident[EI_DATA] = ELFDATA2MSB; 460 ehdr->e_ident[EI_VERSION] = EV_CURRENT; 461 memset(ehdr->e_ident + EI_PAD, 0, EI_NIDENT - EI_PAD); 462 ehdr->e_type = ET_CORE; 463 ehdr->e_machine = EM_S390; 464 ehdr->e_version = EV_CURRENT; 465 ehdr->e_phoff = sizeof(Elf64_Ehdr); 466 ehdr->e_ehsize = sizeof(Elf64_Ehdr); 467 ehdr->e_phentsize = sizeof(Elf64_Phdr); 468 ehdr->e_phnum = mem_chunk_cnt + 1; 469 return ehdr + 1; 470 } 471 472 /* 473 * Return CPU count for ELF header (new kernel) 474 */ 475 static int get_cpu_cnt(void) 476 { 477 struct save_area *sa; 478 int cpus = 0; 479 480 list_for_each_entry(sa, &dump_save_areas, list) 481 if (sa->prefix != 0) 482 cpus++; 483 return cpus; 484 } 485 486 /* 487 * Return memory chunk count for ELF header (new kernel) 488 */ 489 static int get_mem_chunk_cnt(void) 490 { 491 int cnt = 0; 492 u64 idx; 493 494 for_each_physmem_range(idx, &oldmem_type, NULL, NULL) 495 cnt++; 496 return cnt; 497 } 498 499 /* 500 * Initialize ELF loads (new kernel) 501 */ 502 static void loads_init(Elf64_Phdr *phdr) 503 { 504 phys_addr_t start, end; 505 u64 idx; 506 507 for_each_physmem_range(idx, &oldmem_type, &start, &end) { 508 phdr->p_filesz = end - start; 509 phdr->p_type = PT_LOAD; 510 phdr->p_offset = start; 511 phdr->p_vaddr = (unsigned long)__va(start); 512 phdr->p_paddr = start; 513 phdr->p_memsz = end - start; 514 phdr->p_flags = PF_R | PF_W | PF_X; 515 phdr->p_align = PAGE_SIZE; 516 phdr++; 517 } 518 } 519 520 /* 521 * Initialize notes (new kernel) 522 */ 523 static void *notes_init(Elf64_Phdr *phdr, void *ptr, u64 notes_offset) 524 { 525 struct save_area *sa; 526 void *ptr_start = ptr; 527 int cpu; 528 529 ptr = nt_prpsinfo(ptr); 530 531 cpu = 1; 532 list_for_each_entry(sa, &dump_save_areas, list) 533 if (sa->prefix != 0) 534 ptr = fill_cpu_elf_notes(ptr, cpu++, sa); 535 ptr = nt_vmcoreinfo(ptr); 536 ptr = nt_final(ptr); 537 memset(phdr, 0, sizeof(*phdr)); 538 phdr->p_type = PT_NOTE; 539 phdr->p_offset = notes_offset; 540 phdr->p_filesz = (unsigned long) PTR_SUB(ptr, ptr_start); 541 phdr->p_memsz = phdr->p_filesz; 542 return ptr; 543 } 544 545 static size_t get_elfcorehdr_size(int mem_chunk_cnt) 546 { 547 size_t size; 548 549 size = sizeof(Elf64_Ehdr); 550 /* PT_NOTES */ 551 size += sizeof(Elf64_Phdr); 552 /* nt_prpsinfo */ 553 size += nt_size(NT_PRPSINFO, sizeof(struct elf_prpsinfo)); 554 /* regsets */ 555 size += get_cpu_cnt() * get_cpu_elf_notes_size(); 556 /* nt_vmcoreinfo */ 557 size += nt_vmcoreinfo_size(); 558 /* nt_final */ 559 size += sizeof(Elf64_Nhdr); 560 /* PT_LOADS */ 561 size += mem_chunk_cnt * sizeof(Elf64_Phdr); 562 563 return size; 564 } 565 566 /* 567 * Create ELF core header (new kernel) 568 */ 569 int elfcorehdr_alloc(unsigned long long *addr, unsigned long long *size) 570 { 571 Elf64_Phdr *phdr_notes, *phdr_loads; 572 size_t alloc_size; 573 int mem_chunk_cnt; 574 void *ptr, *hdr; 575 u64 hdr_off; 576 577 /* If we are not in kdump or zfcp/nvme dump mode return */ 578 if (!oldmem_data.start && !is_ipl_type_dump()) 579 return 0; 580 /* If we cannot get HSA size for zfcp/nvme dump return error */ 581 if (is_ipl_type_dump() && !sclp.hsa_size) 582 return -ENODEV; 583 584 /* For kdump, exclude previous crashkernel memory */ 585 if (oldmem_data.start) { 586 oldmem_region.base = oldmem_data.start; 587 oldmem_region.size = oldmem_data.size; 588 oldmem_type.total_size = oldmem_data.size; 589 } 590 591 mem_chunk_cnt = get_mem_chunk_cnt(); 592 593 alloc_size = get_elfcorehdr_size(mem_chunk_cnt); 594 595 hdr = kzalloc(alloc_size, GFP_KERNEL); 596 597 /* Without elfcorehdr /proc/vmcore cannot be created. Thus creating 598 * a dump with this crash kernel will fail. Panic now to allow other 599 * dump mechanisms to take over. 600 */ 601 if (!hdr) 602 panic("s390 kdump allocating elfcorehdr failed"); 603 604 /* Init elf header */ 605 ptr = ehdr_init(hdr, mem_chunk_cnt); 606 /* Init program headers */ 607 phdr_notes = ptr; 608 ptr = PTR_ADD(ptr, sizeof(Elf64_Phdr)); 609 phdr_loads = ptr; 610 ptr = PTR_ADD(ptr, sizeof(Elf64_Phdr) * mem_chunk_cnt); 611 /* Init notes */ 612 hdr_off = PTR_DIFF(ptr, hdr); 613 ptr = notes_init(phdr_notes, ptr, ((unsigned long) hdr) + hdr_off); 614 /* Init loads */ 615 hdr_off = PTR_DIFF(ptr, hdr); 616 loads_init(phdr_loads); 617 *addr = (unsigned long long) hdr; 618 *size = (unsigned long long) hdr_off; 619 BUG_ON(elfcorehdr_size > alloc_size); 620 return 0; 621 } 622 623 /* 624 * Free ELF core header (new kernel) 625 */ 626 void elfcorehdr_free(unsigned long long addr) 627 { 628 kfree((void *)(unsigned long)addr); 629 } 630 631 /* 632 * Read from ELF header 633 */ 634 ssize_t elfcorehdr_read(char *buf, size_t count, u64 *ppos) 635 { 636 void *src = (void *)(unsigned long)*ppos; 637 638 memcpy(buf, src, count); 639 *ppos += count; 640 return count; 641 } 642 643 /* 644 * Read from ELF notes data 645 */ 646 ssize_t elfcorehdr_read_notes(char *buf, size_t count, u64 *ppos) 647 { 648 void *src = (void *)(unsigned long)*ppos; 649 650 memcpy(buf, src, count); 651 *ppos += count; 652 return count; 653 } 654