bios.c revision 63981
1/*-
2 * Copyright (c) 1997 Michael Smith
3 * Copyright (c) 1998 Jonathan Lemon
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 *    notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 *    notice, this list of conditions and the following disclaimer in the
13 *    documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25 * SUCH DAMAGE.
26 *
27 * $FreeBSD: head/sys/amd64/amd64/bios.c 63981 2000-07-28 22:58:28Z peter $
28 */
29
30/*
31 * Code for dealing with the BIOS in x86 PC systems.
32 */
33
34#include "isa.h"
35
36#include <sys/param.h>
37#include <sys/systm.h>
38#include <sys/kernel.h>
39#include <sys/malloc.h>
40#include <sys/bus.h>
41#include <vm/vm.h>
42#include <vm/pmap.h>
43#include <machine/md_var.h>
44#include <machine/segments.h>
45#include <machine/stdarg.h>
46#include <machine/vmparam.h>
47#include <machine/pc/bios.h>
48#include <isa/isavar.h>
49#include <isa/pnpreg.h>
50#include <isa/pnpvar.h>
51
52#define BIOS_START	0xe0000
53#define BIOS_SIZE	0x20000
54
55/* exported lookup results */
56struct bios32_SDentry		PCIbios = {entry : 0};
57struct PnPBIOS_table		*PnPBIOStable = 0;
58
59static u_int			bios32_SDCI = 0;
60
61/* start fairly early */
62static void			bios32_init(void *junk);
63SYSINIT(bios32, SI_SUB_CPU, SI_ORDER_ANY, bios32_init, NULL);
64
65/*
66 * bios32_init
67 *
68 * Locate various bios32 entities.
69 */
70static void
71bios32_init(void *junk)
72{
73    u_long			sigaddr;
74    struct bios32_SDheader	*sdh;
75    struct PnPBIOS_table	*pt;
76    u_int8_t			ck, *cv;
77    int				i;
78    char			*p;
79
80    /*
81     * BIOS32 Service Directory, PCI BIOS
82     */
83
84    /* look for the signature */
85    if ((sigaddr = bios_sigsearch(0, "_32_", 4, 16, 0)) != 0) {
86
87	/* get a virtual pointer to the structure */
88	sdh = (struct bios32_SDheader *)(uintptr_t)BIOS_PADDRTOVADDR(sigaddr);
89	for (cv = (u_int8_t *)sdh, ck = 0, i = 0; i < (sdh->len * 16); i++) {
90	    ck += cv[i];
91	}
92	/* If checksum is OK, enable use of the entrypoint */
93	if ((ck == 0) && (sdh->entry < (BIOS_START + BIOS_SIZE))) {
94	    bios32_SDCI = BIOS_PADDRTOVADDR(sdh->entry);
95	    if (bootverbose) {
96		printf("bios32: Found BIOS32 Service Directory header at %p\n", sdh);
97		printf("bios32: Entry = 0x%x (%x)  Rev = %d  Len = %d\n",
98		       sdh->entry, bios32_SDCI, sdh->revision, sdh->len);
99	    }
100
101#ifndef PC98
102	    /* Allow user override of PCI BIOS search */
103	    if (((p = getenv("machdep.bios.pci")) == NULL) || strcmp(p, "disable")) {
104
105		/* See if there's a PCI BIOS entrypoint here */
106		PCIbios.ident.id = 0x49435024;	/* PCI systems should have this */
107		if (!bios32_SDlookup(&PCIbios) && bootverbose)
108		    printf("pcibios: PCI BIOS entry at 0x%x+0x%x\n", PCIbios.base, PCIbios.entry);
109	    }
110#endif
111	} else {
112	    printf("bios32: Bad BIOS32 Service Directory\n");
113	}
114    }
115
116    /*
117     * PnP BIOS
118     *
119     * Allow user override of PnP BIOS search
120     */
121    if ((((p = getenv("machdep.bios.pnp")) == NULL) || strcmp(p, "disable")) &&
122	((sigaddr = bios_sigsearch(0, "$PnP", 4, 16, 0)) != 0)) {
123
124	/* get a virtual pointer to the structure */
125	pt = (struct PnPBIOS_table *)(uintptr_t)BIOS_PADDRTOVADDR(sigaddr);
126	for (cv = (u_int8_t *)pt, ck = 0, i = 0; i < pt->len; i++) {
127	    ck += cv[i];
128	}
129	/* If checksum is OK, enable use of the entrypoint */
130	if (ck == 0) {
131	    PnPBIOStable = pt;
132	    if (bootverbose) {
133		printf("pnpbios: Found PnP BIOS data at %p\n", pt);
134		printf("pnpbios: Entry = %x:%x  Rev = %d.%d\n",
135		       pt->pmentrybase, pt->pmentryoffset, pt->version >> 4, pt->version & 0xf);
136		if ((pt->control & 0x3) == 0x01)
137		    printf("pnpbios: Event flag at %x\n", pt->evflagaddr);
138		if (pt->oemdevid != 0)
139		    printf("pnpbios: OEM ID %x\n", pt->oemdevid);
140
141	    }
142	} else {
143	    printf("pnpbios: Bad PnP BIOS data checksum\n");
144	}
145    }
146
147    if (bootverbose) {
148	    /* look for other know signatures */
149	    printf("Other BIOS signatures found:\n");
150	    printf("ACPI: %08x\n", bios_sigsearch(0, "RSD PTR ", 8, 16, 0));
151    }
152}
153
154/*
155 * bios32_SDlookup
156 *
157 * Query the BIOS32 Service Directory for the service named in (ent),
158 * returns nonzero if the lookup fails.  The caller must fill in
159 * (ent->ident), the remainder are populated on a successful lookup.
160 */
161int
162bios32_SDlookup(struct bios32_SDentry *ent)
163{
164    struct bios_regs args;
165
166    if (bios32_SDCI == 0)
167	return (1);
168
169    args.eax = ent->ident.id;		/* set up arguments */
170    args.ebx = args.ecx = args.edx = 0;
171    bios32(&args, bios32_SDCI, GSEL(GCODE_SEL, SEL_KPL));
172    if ((args.eax & 0xff) == 0) {	/* success? */
173	ent->base = args.ebx;
174	ent->len = args.ecx;
175	ent->entry = args.edx;
176	ent->ventry = BIOS_PADDRTOVADDR(ent->base + ent->entry);
177	return (0);			/* all OK */
178    }
179    return (1);				/* failed */
180}
181
182
183/*
184 * bios_sigsearch
185 *
186 * Search some or all of the BIOS region for a signature string.
187 *
188 * (start)	Optional offset returned from this function
189 *		(for searching for multiple matches), or NULL
190 *		to start the search from the base of the BIOS.
191 *		Note that this will be a _physical_ address in
192 *		the range 0xe0000 - 0xfffff.
193 * (sig)	is a pointer to the byte(s) of the signature.
194 * (siglen)	number of bytes in the signature.
195 * (paralen)	signature paragraph (alignment) size.
196 * (sigofs)	offset of the signature within the paragraph.
197 *
198 * Returns the _physical_ address of the found signature, 0 if the
199 * signature was not found.
200 */
201
202u_int32_t
203bios_sigsearch(u_int32_t start, u_char *sig, int siglen, int paralen, int sigofs)
204{
205    u_char	*sp, *end;
206
207    /* compute the starting address */
208    if ((start >= BIOS_START) && (start <= (BIOS_START + BIOS_SIZE))) {
209	sp = (char *)BIOS_PADDRTOVADDR(start);
210    } else if (start == 0) {
211	sp = (char *)BIOS_PADDRTOVADDR(BIOS_START);
212    } else {
213	return 0;				/* bogus start address */
214    }
215
216    /* compute the end address */
217    end = (u_char *)BIOS_PADDRTOVADDR(BIOS_START + BIOS_SIZE);
218
219    /* loop searching */
220    while ((sp + sigofs + siglen) < end) {
221
222	/* compare here */
223	if (!bcmp(sp + sigofs, sig, siglen)) {
224	    /* convert back to physical address */
225	    return((u_int32_t)BIOS_VADDRTOPADDR(sp));
226	}
227	sp += paralen;
228    }
229    return(0);
230}
231
232/*
233 * do not staticize, used by bioscall.s
234 */
235union {
236    struct {
237	u_short	offset;
238	u_short	segment;
239    } vec16;
240    struct {
241	u_int	offset;
242	u_short	segment;
243    } vec32;
244} bioscall_vector;			/* bios jump vector */
245
246void
247set_bios_selectors(struct bios_segments *seg, int flags)
248{
249    struct soft_segment_descriptor ssd = {
250	0,			/* segment base address (overwritten) */
251	0,			/* length (overwritten) */
252	SDT_MEMERA,		/* segment type (overwritten) */
253	0,			/* priority level */
254	1,			/* descriptor present */
255	0, 0,
256	1,			/* descriptor size (overwritten) */
257	0			/* granularity == byte units */
258    };
259    union descriptor *p_gdt;
260
261#ifdef SMP
262    p_gdt = &gdt[cpuid * NGDT];
263#else
264    p_gdt = gdt;
265#endif
266
267    ssd.ssd_base = seg->code32.base;
268    ssd.ssd_limit = seg->code32.limit;
269    ssdtosd(&ssd, &p_gdt[GBIOSCODE32_SEL].sd);
270
271    ssd.ssd_def32 = 0;
272    if (flags & BIOSCODE_FLAG) {
273	ssd.ssd_base = seg->code16.base;
274	ssd.ssd_limit = seg->code16.limit;
275	ssdtosd(&ssd, &p_gdt[GBIOSCODE16_SEL].sd);
276    }
277
278    ssd.ssd_type = SDT_MEMRWA;
279    if (flags & BIOSDATA_FLAG) {
280	ssd.ssd_base = seg->data.base;
281	ssd.ssd_limit = seg->data.limit;
282	ssdtosd(&ssd, &p_gdt[GBIOSDATA_SEL].sd);
283    }
284
285    if (flags & BIOSUTIL_FLAG) {
286	ssd.ssd_base = seg->util.base;
287	ssd.ssd_limit = seg->util.limit;
288	ssdtosd(&ssd, &p_gdt[GBIOSUTIL_SEL].sd);
289    }
290
291    if (flags & BIOSARGS_FLAG) {
292	ssd.ssd_base = seg->args.base;
293	ssd.ssd_limit = seg->args.limit;
294	ssdtosd(&ssd, &p_gdt[GBIOSARGS_SEL].sd);
295    }
296}
297
298extern int vm86pa;
299extern void bios16_jmp(void);
300
301/*
302 * this routine is really greedy with selectors, and uses 5:
303 *
304 * 32-bit code selector:	to return to kernel
305 * 16-bit code selector:	for running code
306 *        data selector:	for 16-bit data
307 *        util selector:	extra utility selector
308 *        args selector:	to handle pointers
309 *
310 * the util selector is set from the util16 entry in bios16_args, if a
311 * "U" specifier is seen.
312 *
313 * See <machine/pc/bios.h> for description of format specifiers
314 */
315int
316bios16(struct bios_args *args, char *fmt, ...)
317{
318    char	*p, *stack, *stack_top;
319    va_list 	ap;
320    int 	flags = BIOSCODE_FLAG | BIOSDATA_FLAG;
321    u_int 	i, arg_start, arg_end;
322    u_int 	*pte, *ptd;
323
324    arg_start = 0xffffffff;
325    arg_end = 0;
326
327    /*
328     * Some BIOS entrypoints attempt to copy the largest-case
329     * argument frame (in order to generalise handling for
330     * different entry types).  If our argument frame is
331     * smaller than this, the BIOS will reach off the top of
332     * our constructed stack segment.  Pad the top of the stack
333     * with some garbage to avoid this.
334     */
335    stack = (caddr_t)PAGE_SIZE - 32;
336
337    va_start(ap, fmt);
338    for (p = fmt; p && *p; p++) {
339	switch (*p) {
340	case 'p':			/* 32-bit pointer */
341	    i = va_arg(ap, u_int);
342	    arg_start = min(arg_start, i);
343	    arg_end = max(arg_end, i);
344	    flags |= BIOSARGS_FLAG;
345	    stack -= 4;
346	    break;
347
348	case 'i':			/* 32-bit integer */
349	    i = va_arg(ap, u_int);
350	    stack -= 4;
351	    break;
352
353	case 'U':			/* 16-bit selector */
354	    flags |= BIOSUTIL_FLAG;
355	    /* FALLTHROUGH */
356	case 'D':			/* 16-bit selector */
357	case 'C':			/* 16-bit selector */
358	    stack -= 2;
359	    break;
360
361	case 's':			/* 16-bit integer */
362	    i = va_arg(ap, u_short);
363	    stack -= 2;
364	    break;
365
366	default:
367	    return (EINVAL);
368	}
369    }
370
371    if (flags & BIOSARGS_FLAG) {
372	if (arg_end - arg_start > ctob(16))
373	    return (EACCES);
374	args->seg.args.base = arg_start;
375	args->seg.args.limit = 0xffff;
376    }
377
378    args->seg.code32.base = (u_int)&bios16_jmp & PG_FRAME;
379    args->seg.code32.limit = 0xffff;
380
381    ptd = (u_int *)rcr3();
382    if (ptd == IdlePTD) {
383	/*
384	 * no page table, so create one and install it.
385	 */
386	pte = (u_int *)malloc(PAGE_SIZE, M_TEMP, M_WAITOK);
387	ptd = (u_int *)((u_int)ptd + KERNBASE);
388	*ptd = vtophys(pte) | PG_RW | PG_V;
389    } else {
390	/*
391	 * this is a user-level page table
392	 */
393	pte = (u_int *)&PTmap;
394    }
395    /*
396     * install pointer to page 0.  we don't need to flush the tlb,
397     * since there should not be a previous mapping for page 0.
398     */
399    *pte = (vm86pa - PAGE_SIZE) | PG_RW | PG_V;
400
401    stack_top = stack;
402    va_start(ap, fmt);
403    for (p = fmt; p && *p; p++) {
404	switch (*p) {
405	case 'p':			/* 32-bit pointer */
406	    i = va_arg(ap, u_int);
407	    *(u_int *)stack = (i - arg_start) |
408		(GSEL(GBIOSARGS_SEL, SEL_KPL) << 16);
409	    stack += 4;
410	    break;
411
412	case 'i':			/* 32-bit integer */
413	    i = va_arg(ap, u_int);
414	    *(u_int *)stack = i;
415	    stack += 4;
416	    break;
417
418	case 'U':			/* 16-bit selector */
419	    *(u_short *)stack = GSEL(GBIOSUTIL_SEL, SEL_KPL);
420	    stack += 2;
421	    break;
422
423	case 'D':			/* 16-bit selector */
424	    *(u_short *)stack = GSEL(GBIOSDATA_SEL, SEL_KPL);
425	    stack += 2;
426	    break;
427
428	case 'C':			/* 16-bit selector */
429	    *(u_short *)stack = GSEL(GBIOSCODE16_SEL, SEL_KPL);
430	    stack += 2;
431	    break;
432
433	case 's':			/* 16-bit integer */
434	    i = va_arg(ap, u_short);
435	    *(u_short *)stack = i;
436	    stack += 2;
437	    break;
438
439	default:
440	    return (EINVAL);
441	}
442    }
443
444    set_bios_selectors(&args->seg, flags);
445    bioscall_vector.vec16.offset = (u_short)args->entry;
446    bioscall_vector.vec16.segment = GSEL(GBIOSCODE16_SEL, SEL_KPL);
447
448    i = bios16_call(&args->r, stack_top);
449
450    if (pte == (u_int *)&PTmap) {
451	*pte = 0;			/* remove entry */
452    } else {
453	*ptd = 0;			/* remove page table */
454	free(pte, M_TEMP);		/* ... and free it */
455    }
456
457    /*
458     * XXX only needs to be invlpg(0) but that doesn't work on the 386
459     */
460    invltlb();
461
462    return (i);
463}
464
465/*
466 * PnP BIOS interface; enumerate devices only known to the system
467 * BIOS and save information about them for later use.
468 */
469
470struct pnp_sysdev
471{
472    u_int16_t	size;
473    u_int8_t	handle;
474    u_int32_t	devid;
475    u_int8_t	type[3];
476    u_int16_t	attrib;
477#define PNPATTR_NODISABLE	(1<<0)	/* can't be disabled */
478#define PNPATTR_NOCONFIG	(1<<1)	/* can't be configured */
479#define PNPATTR_OUTPUT		(1<<2)	/* can be primary output */
480#define PNPATTR_INPUT		(1<<3)	/* can be primary input */
481#define PNPATTR_BOOTABLE	(1<<4)	/* can be booted from */
482#define PNPATTR_DOCK		(1<<5)	/* is a docking station */
483#define PNPATTR_REMOVEABLE	(1<<6)	/* device is removeable */
484#define PNPATTR_CONFIG_STATIC	0x00
485#define PNPATTR_CONFIG_DYNAMIC	0x07
486#define PNPATTR_CONFIG_DYNONLY	0x17
487    /* device-specific data comes here */
488    u_int8_t	devdata[0];
489} __attribute__ ((packed));
490
491/* We have to cluster arguments within a 64k range for the bios16 call */
492struct pnp_sysdevargs
493{
494    u_int16_t	next;
495    struct pnp_sysdev node;
496};
497
498/*
499 * This function is called after the bus has assigned resource
500 * locations for a logical device.
501 */
502static void
503pnpbios_set_config(void *arg, struct isa_config *config, int enable)
504{
505}
506
507/*
508 * Quiz the PnP BIOS, build a list of PNP IDs and resource data.
509 */
510static void
511pnpbios_identify(driver_t *driver, device_t parent)
512{
513    struct PnPBIOS_table	*pt = PnPBIOStable;
514    struct bios_args		args;
515    struct pnp_sysdev		*pd;
516    struct pnp_sysdevargs	*pda;
517    u_int16_t			ndevs, bigdev;
518    int				error, currdev;
519    u_int8_t			*devnodebuf, tag;
520    u_int32_t			*devid, *compid;
521    int				idx, left;
522    device_t			dev;
523
524    /* no PnP BIOS information */
525    if (pt == NULL)
526	return;
527
528    bzero(&args, sizeof(args));
529    args.seg.code16.base = BIOS_PADDRTOVADDR(pt->pmentrybase);
530    args.seg.code16.limit = 0xffff;		/* XXX ? */
531    args.seg.data.base = BIOS_PADDRTOVADDR(pt->pmdataseg);
532    args.seg.data.limit = 0xffff;
533    args.entry = pt->pmentryoffset;
534
535    if ((error = bios16(&args, PNP_COUNT_DEVNODES, &ndevs, &bigdev)) || (args.r.eax & 0xff))
536	printf("pnpbios: error %d/%x getting device count/size limit\n", error, args.r.eax);
537    ndevs &= 0xff;				/* clear high byte garbage */
538    if (bootverbose)
539	printf("pnpbios: %d devices, largest %d bytes\n", ndevs, bigdev);
540
541    devnodebuf = malloc(bigdev + (sizeof(struct pnp_sysdevargs) - sizeof(struct pnp_sysdev)),
542			M_DEVBUF, M_NOWAIT);
543    pda = (struct pnp_sysdevargs *)devnodebuf;
544    pd = &pda->node;
545
546    for (currdev = 0, left = ndevs; (currdev != 0xff) && (left > 0); left--) {
547
548	bzero(pd, bigdev);
549	pda->next = currdev;
550	/* get current configuration */
551	if ((error = bios16(&args, PNP_GET_DEVNODE, &pda->next, &pda->node, (u_int16_t)1))) {
552	    printf("pnpbios: error %d making BIOS16 call\n", error);
553	    break;
554	}
555	if ((error = (args.r.eax & 0xff))) {
556	    if (bootverbose)
557		printf("pnpbios: %s 0x%x fetching node %d\n", error & 0x80 ? "error" : "warning", error, currdev);
558	    if (error & 0x80)
559		break;
560	}
561	currdev = pda->next;
562	if (pd->size < sizeof(struct pnp_sysdev)) {
563	    printf("pnpbios: bogus system node data, aborting scan\n");
564	    break;
565	}
566
567	/*
568	 * If we are in APIC_IO mode, we should ignore the ISA PIC if it
569	 * shows up.  Likewise, in !APIC_IO mode, we should ignore the
570	 * APIC (less important).
571	 * This is significant because the ISA PIC will claim IRQ 2 (which
572	 * it uses for chaining), while in APIC mode this is a valid IRQ
573	 * available for general use.
574	 */
575#ifdef APIC_IO
576	if (!strcmp(pnp_eisaformat(pd->devid), "PNP0000"))	/* ISA PIC */
577	    continue;
578#else
579	if (!strcmp(pnp_eisaformat(pd->devid), "PNP0003"))	/* APIC */
580	    continue;
581#endif
582
583	/* Add the device and parse its resources */
584	dev = BUS_ADD_CHILD(parent, ISA_ORDER_PNP, NULL, -1);
585	isa_set_vendorid(dev, pd->devid);
586	isa_set_logicalid(dev, pd->devid);
587	ISA_SET_CONFIG_CALLBACK(parent, dev, pnpbios_set_config, 0);
588	pnp_parse_resources(dev, &pd->devdata[0],
589			    pd->size - sizeof(struct pnp_sysdev),
590			    isa_get_vendorid(dev), isa_get_logicalid(dev), 0);
591	if (!device_get_desc(dev))
592	    device_set_desc_copy(dev, pnp_eisaformat(pd->devid));
593
594	/* Find device IDs */
595	devid = &pd->devid;
596	compid = NULL;
597
598	/* look for a compatible device ID too */
599	left = pd->size - sizeof(struct pnp_sysdev);
600	idx = 0;
601	while (idx < left) {
602	    tag = pd->devdata[idx++];
603	    if (PNP_RES_TYPE(tag) == 0) {
604		/* Small resource */
605		switch (PNP_SRES_NUM(tag)) {
606		case PNP_TAG_COMPAT_DEVICE:
607		    compid = (u_int32_t *)(pd->devdata + idx);
608		    if (bootverbose)
609			printf("pnpbios: node %d compat ID 0x%08x\n", pd->handle, *compid);
610		    /* FALLTHROUGH */
611		case PNP_TAG_END:
612		    idx = left;
613		    break;
614		default:
615		    idx += PNP_SRES_LEN(tag);
616		    break;
617		}
618	    } else
619		/* Large resource, skip it */
620		idx += *(u_int16_t *)(pd->devdata + idx) + 2;
621	}
622	if (bootverbose) {
623	    printf("pnpbios: handle %d device ID %s (%08x)",
624		   pd->handle, pnp_eisaformat(*devid), *devid);
625	    if (compid != NULL)
626		printf(" compat ID %s (%08x)",
627		       pnp_eisaformat(*compid), *compid);
628	    printf("\n");
629	}
630    }
631}
632
633static device_method_t pnpbios_methods[] = {
634	/* Device interface */
635	DEVMETHOD(device_identify,	pnpbios_identify),
636
637	{ 0, 0 }
638};
639
640static driver_t pnpbios_driver = {
641	"pnpbios",
642	pnpbios_methods,
643	1,			/* no softc */
644};
645
646static devclass_t pnpbios_devclass;
647
648DRIVER_MODULE(pnpbios, isa, pnpbios_driver, pnpbios_devclass, 0, 0);
649