1/* 2 * Copyright (c) 2013-2019, ARM Limited and Contributors. All rights reserved. 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 */ 6 7#include <arch.h> 8#include <asm_macros.S> 9#include <assert_macros.S> 10#include <context.h> 11 12 .global el1_sysregs_context_save 13 .global el1_sysregs_context_restore 14#if CTX_INCLUDE_FPREGS 15 .global fpregs_context_save 16 .global fpregs_context_restore 17#endif 18 .global save_gp_pmcr_pauth_regs 19 .global restore_gp_pmcr_pauth_regs 20 .global el3_exit 21 22/* ------------------------------------------------------------------ 23 * The following function strictly follows the AArch64 PCS to use 24 * x9-x17 (temporary caller-saved registers) to save EL1 system 25 * register context. It assumes that 'x0' is pointing to a 26 * 'el1_sys_regs' structure where the register context will be saved. 27 * ------------------------------------------------------------------ 28 */ 29func el1_sysregs_context_save 30 31 mrs x9, spsr_el1 32 mrs x10, elr_el1 33 stp x9, x10, [x0, #CTX_SPSR_EL1] 34 35 mrs x15, sctlr_el1 36 mrs x16, actlr_el1 37 stp x15, x16, [x0, #CTX_SCTLR_EL1] 38 39 mrs x17, cpacr_el1 40 mrs x9, csselr_el1 41 stp x17, x9, [x0, #CTX_CPACR_EL1] 42 43 mrs x10, sp_el1 44 mrs x11, esr_el1 45 stp x10, x11, [x0, #CTX_SP_EL1] 46 47 mrs x12, ttbr0_el1 48 mrs x13, ttbr1_el1 49 stp x12, x13, [x0, #CTX_TTBR0_EL1] 50 51 mrs x14, mair_el1 52 mrs x15, amair_el1 53 stp x14, x15, [x0, #CTX_MAIR_EL1] 54 55 mrs x16, tcr_el1 56 mrs x17, tpidr_el1 57 stp x16, x17, [x0, #CTX_TCR_EL1] 58 59 mrs x9, tpidr_el0 60 mrs x10, tpidrro_el0 61 stp x9, x10, [x0, #CTX_TPIDR_EL0] 62 63 mrs x13, par_el1 64 mrs x14, far_el1 65 stp x13, x14, [x0, #CTX_PAR_EL1] 66 67 mrs x15, afsr0_el1 68 mrs x16, afsr1_el1 69 stp x15, x16, [x0, #CTX_AFSR0_EL1] 70 71 mrs x17, contextidr_el1 72 mrs x9, vbar_el1 73 stp x17, x9, [x0, #CTX_CONTEXTIDR_EL1] 74 75 /* Save AArch32 system registers if the build has instructed so */ 76#if CTX_INCLUDE_AARCH32_REGS 77 mrs x11, spsr_abt 78 mrs x12, spsr_und 79 stp x11, x12, [x0, #CTX_SPSR_ABT] 80 81 mrs x13, spsr_irq 82 mrs x14, spsr_fiq 83 stp x13, x14, [x0, #CTX_SPSR_IRQ] 84 85 mrs x15, dacr32_el2 86 mrs x16, ifsr32_el2 87 stp x15, x16, [x0, #CTX_DACR32_EL2] 88#endif 89 90 /* Save NS timer registers if the build has instructed so */ 91#if NS_TIMER_SWITCH 92 mrs x10, cntp_ctl_el0 93 mrs x11, cntp_cval_el0 94 stp x10, x11, [x0, #CTX_CNTP_CTL_EL0] 95 96 mrs x12, cntv_ctl_el0 97 mrs x13, cntv_cval_el0 98 stp x12, x13, [x0, #CTX_CNTV_CTL_EL0] 99 100 mrs x14, cntkctl_el1 101 str x14, [x0, #CTX_CNTKCTL_EL1] 102#endif 103 104 /* Save MTE system registers if the build has instructed so */ 105#if CTX_INCLUDE_MTE_REGS 106 mrs x15, TFSRE0_EL1 107 mrs x16, TFSR_EL1 108 stp x15, x16, [x0, #CTX_TFSRE0_EL1] 109 110 mrs x9, RGSR_EL1 111 mrs x10, GCR_EL1 112 stp x9, x10, [x0, #CTX_RGSR_EL1] 113#endif 114 115 ret 116endfunc el1_sysregs_context_save 117 118/* ------------------------------------------------------------------ 119 * The following function strictly follows the AArch64 PCS to use 120 * x9-x17 (temporary caller-saved registers) to restore EL1 system 121 * register context. It assumes that 'x0' is pointing to a 122 * 'el1_sys_regs' structure from where the register context will be 123 * restored 124 * ------------------------------------------------------------------ 125 */ 126func el1_sysregs_context_restore 127 128 ldp x9, x10, [x0, #CTX_SPSR_EL1] 129 msr spsr_el1, x9 130 msr elr_el1, x10 131 132 ldp x15, x16, [x0, #CTX_SCTLR_EL1] 133 msr sctlr_el1, x15 134 msr actlr_el1, x16 135 136 ldp x17, x9, [x0, #CTX_CPACR_EL1] 137 msr cpacr_el1, x17 138 msr csselr_el1, x9 139 140 ldp x10, x11, [x0, #CTX_SP_EL1] 141 msr sp_el1, x10 142 msr esr_el1, x11 143 144 ldp x12, x13, [x0, #CTX_TTBR0_EL1] 145 msr ttbr0_el1, x12 146 msr ttbr1_el1, x13 147 148 ldp x14, x15, [x0, #CTX_MAIR_EL1] 149 msr mair_el1, x14 150 msr amair_el1, x15 151 152 ldp x16, x17, [x0, #CTX_TCR_EL1] 153 msr tcr_el1, x16 154 msr tpidr_el1, x17 155 156 ldp x9, x10, [x0, #CTX_TPIDR_EL0] 157 msr tpidr_el0, x9 158 msr tpidrro_el0, x10 159 160 ldp x13, x14, [x0, #CTX_PAR_EL1] 161 msr par_el1, x13 162 msr far_el1, x14 163 164 ldp x15, x16, [x0, #CTX_AFSR0_EL1] 165 msr afsr0_el1, x15 166 msr afsr1_el1, x16 167 168 ldp x17, x9, [x0, #CTX_CONTEXTIDR_EL1] 169 msr contextidr_el1, x17 170 msr vbar_el1, x9 171 172 /* Restore AArch32 system registers if the build has instructed so */ 173#if CTX_INCLUDE_AARCH32_REGS 174 ldp x11, x12, [x0, #CTX_SPSR_ABT] 175 msr spsr_abt, x11 176 msr spsr_und, x12 177 178 ldp x13, x14, [x0, #CTX_SPSR_IRQ] 179 msr spsr_irq, x13 180 msr spsr_fiq, x14 181 182 ldp x15, x16, [x0, #CTX_DACR32_EL2] 183 msr dacr32_el2, x15 184 msr ifsr32_el2, x16 185#endif 186 /* Restore NS timer registers if the build has instructed so */ 187#if NS_TIMER_SWITCH 188 ldp x10, x11, [x0, #CTX_CNTP_CTL_EL0] 189 msr cntp_ctl_el0, x10 190 msr cntp_cval_el0, x11 191 192 ldp x12, x13, [x0, #CTX_CNTV_CTL_EL0] 193 msr cntv_ctl_el0, x12 194 msr cntv_cval_el0, x13 195 196 ldr x14, [x0, #CTX_CNTKCTL_EL1] 197 msr cntkctl_el1, x14 198#endif 199 /* Restore MTE system registers if the build has instructed so */ 200#if CTX_INCLUDE_MTE_REGS 201 ldp x11, x12, [x0, #CTX_TFSRE0_EL1] 202 msr TFSRE0_EL1, x11 203 msr TFSR_EL1, x12 204 205 ldp x13, x14, [x0, #CTX_RGSR_EL1] 206 msr RGSR_EL1, x13 207 msr GCR_EL1, x14 208#endif 209 210 /* No explict ISB required here as ERET covers it */ 211 ret 212endfunc el1_sysregs_context_restore 213 214/* ------------------------------------------------------------------ 215 * The following function follows the aapcs_64 strictly to use 216 * x9-x17 (temporary caller-saved registers according to AArch64 PCS) 217 * to save floating point register context. It assumes that 'x0' is 218 * pointing to a 'fp_regs' structure where the register context will 219 * be saved. 220 * 221 * Access to VFP registers will trap if CPTR_EL3.TFP is set. 222 * However currently we don't use VFP registers nor set traps in 223 * Trusted Firmware, and assume it's cleared. 224 * 225 * TODO: Revisit when VFP is used in secure world 226 * ------------------------------------------------------------------ 227 */ 228#if CTX_INCLUDE_FPREGS 229func fpregs_context_save 230 stp q0, q1, [x0, #CTX_FP_Q0] 231 stp q2, q3, [x0, #CTX_FP_Q2] 232 stp q4, q5, [x0, #CTX_FP_Q4] 233 stp q6, q7, [x0, #CTX_FP_Q6] 234 stp q8, q9, [x0, #CTX_FP_Q8] 235 stp q10, q11, [x0, #CTX_FP_Q10] 236 stp q12, q13, [x0, #CTX_FP_Q12] 237 stp q14, q15, [x0, #CTX_FP_Q14] 238 stp q16, q17, [x0, #CTX_FP_Q16] 239 stp q18, q19, [x0, #CTX_FP_Q18] 240 stp q20, q21, [x0, #CTX_FP_Q20] 241 stp q22, q23, [x0, #CTX_FP_Q22] 242 stp q24, q25, [x0, #CTX_FP_Q24] 243 stp q26, q27, [x0, #CTX_FP_Q26] 244 stp q28, q29, [x0, #CTX_FP_Q28] 245 stp q30, q31, [x0, #CTX_FP_Q30] 246 247 mrs x9, fpsr 248 str x9, [x0, #CTX_FP_FPSR] 249 250 mrs x10, fpcr 251 str x10, [x0, #CTX_FP_FPCR] 252 253#if CTX_INCLUDE_AARCH32_REGS 254 mrs x11, fpexc32_el2 255 str x11, [x0, #CTX_FP_FPEXC32_EL2] 256#endif 257 ret 258endfunc fpregs_context_save 259 260/* ------------------------------------------------------------------ 261 * The following function follows the aapcs_64 strictly to use x9-x17 262 * (temporary caller-saved registers according to AArch64 PCS) to 263 * restore floating point register context. It assumes that 'x0' is 264 * pointing to a 'fp_regs' structure from where the register context 265 * will be restored. 266 * 267 * Access to VFP registers will trap if CPTR_EL3.TFP is set. 268 * However currently we don't use VFP registers nor set traps in 269 * Trusted Firmware, and assume it's cleared. 270 * 271 * TODO: Revisit when VFP is used in secure world 272 * ------------------------------------------------------------------ 273 */ 274func fpregs_context_restore 275 ldp q0, q1, [x0, #CTX_FP_Q0] 276 ldp q2, q3, [x0, #CTX_FP_Q2] 277 ldp q4, q5, [x0, #CTX_FP_Q4] 278 ldp q6, q7, [x0, #CTX_FP_Q6] 279 ldp q8, q9, [x0, #CTX_FP_Q8] 280 ldp q10, q11, [x0, #CTX_FP_Q10] 281 ldp q12, q13, [x0, #CTX_FP_Q12] 282 ldp q14, q15, [x0, #CTX_FP_Q14] 283 ldp q16, q17, [x0, #CTX_FP_Q16] 284 ldp q18, q19, [x0, #CTX_FP_Q18] 285 ldp q20, q21, [x0, #CTX_FP_Q20] 286 ldp q22, q23, [x0, #CTX_FP_Q22] 287 ldp q24, q25, [x0, #CTX_FP_Q24] 288 ldp q26, q27, [x0, #CTX_FP_Q26] 289 ldp q28, q29, [x0, #CTX_FP_Q28] 290 ldp q30, q31, [x0, #CTX_FP_Q30] 291 292 ldr x9, [x0, #CTX_FP_FPSR] 293 msr fpsr, x9 294 295 ldr x10, [x0, #CTX_FP_FPCR] 296 msr fpcr, x10 297 298#if CTX_INCLUDE_AARCH32_REGS 299 ldr x11, [x0, #CTX_FP_FPEXC32_EL2] 300 msr fpexc32_el2, x11 301#endif 302 /* 303 * No explict ISB required here as ERET to 304 * switch to secure EL1 or non-secure world 305 * covers it 306 */ 307 308 ret 309endfunc fpregs_context_restore 310#endif /* CTX_INCLUDE_FPREGS */ 311 312/* ------------------------------------------------------------------ 313 * The following function is used to save and restore all the general 314 * purpose and ARMv8.3-PAuth (if enabled) registers. 315 * It also checks if Secure Cycle Counter is not disabled in MDCR_EL3 316 * when ARMv8.5-PMU is implemented, and if called from Non-secure 317 * state saves PMCR_EL0 and disables Cycle Counter. 318 * 319 * Ideally we would only save and restore the callee saved registers 320 * when a world switch occurs but that type of implementation is more 321 * complex. So currently we will always save and restore these 322 * registers on entry and exit of EL3. 323 * These are not macros to ensure their invocation fits within the 32 324 * instructions per exception vector. 325 * clobbers: x18 326 * ------------------------------------------------------------------ 327 */ 328func save_gp_pmcr_pauth_regs 329 stp x0, x1, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X0] 330 stp x2, x3, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X2] 331 stp x4, x5, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X4] 332 stp x6, x7, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X6] 333 stp x8, x9, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X8] 334 stp x10, x11, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X10] 335 stp x12, x13, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X12] 336 stp x14, x15, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X14] 337 stp x16, x17, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X16] 338 stp x18, x19, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X18] 339 stp x20, x21, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X20] 340 stp x22, x23, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X22] 341 stp x24, x25, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X24] 342 stp x26, x27, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X26] 343 stp x28, x29, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X28] 344 mrs x18, sp_el0 345 str x18, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_SP_EL0] 346 347 /* ---------------------------------------------------------- 348 * Check if earlier initialization MDCR_EL3.SCCD to 1 failed, 349 * meaning that ARMv8-PMU is not implemented and PMCR_EL0 350 * should be saved in non-secure context. 351 * ---------------------------------------------------------- 352 */ 353 mrs x9, mdcr_el3 354 tst x9, #MDCR_SCCD_BIT 355 bne 1f 356 357 /* Secure Cycle Counter is not disabled */ 358 mrs x9, pmcr_el0 359 360 /* Check caller's security state */ 361 mrs x10, scr_el3 362 tst x10, #SCR_NS_BIT 363 beq 2f 364 365 /* Save PMCR_EL0 if called from Non-secure state */ 366 str x9, [sp, #CTX_EL3STATE_OFFSET + CTX_PMCR_EL0] 367 368 /* Disable cycle counter when event counting is prohibited */ 3692: orr x9, x9, #PMCR_EL0_DP_BIT 370 msr pmcr_el0, x9 371 isb 3721: 373#if CTX_INCLUDE_PAUTH_REGS 374 /* ---------------------------------------------------------- 375 * Save the ARMv8.3-PAuth keys as they are not banked 376 * by exception level 377 * ---------------------------------------------------------- 378 */ 379 add x19, sp, #CTX_PAUTH_REGS_OFFSET 380 381 mrs x20, APIAKeyLo_EL1 /* x21:x20 = APIAKey */ 382 mrs x21, APIAKeyHi_EL1 383 mrs x22, APIBKeyLo_EL1 /* x23:x22 = APIBKey */ 384 mrs x23, APIBKeyHi_EL1 385 mrs x24, APDAKeyLo_EL1 /* x25:x24 = APDAKey */ 386 mrs x25, APDAKeyHi_EL1 387 mrs x26, APDBKeyLo_EL1 /* x27:x26 = APDBKey */ 388 mrs x27, APDBKeyHi_EL1 389 mrs x28, APGAKeyLo_EL1 /* x29:x28 = APGAKey */ 390 mrs x29, APGAKeyHi_EL1 391 392 stp x20, x21, [x19, #CTX_PACIAKEY_LO] 393 stp x22, x23, [x19, #CTX_PACIBKEY_LO] 394 stp x24, x25, [x19, #CTX_PACDAKEY_LO] 395 stp x26, x27, [x19, #CTX_PACDBKEY_LO] 396 stp x28, x29, [x19, #CTX_PACGAKEY_LO] 397#endif /* CTX_INCLUDE_PAUTH_REGS */ 398 399 ret 400endfunc save_gp_pmcr_pauth_regs 401 402/* ------------------------------------------------------------------ 403 * This function restores ARMv8.3-PAuth (if enabled) and all general 404 * purpose registers except x30 from the CPU context. 405 * x30 register must be explicitly restored by the caller. 406 * ------------------------------------------------------------------ 407 */ 408func restore_gp_pmcr_pauth_regs 409#if CTX_INCLUDE_PAUTH_REGS 410 /* Restore the ARMv8.3 PAuth keys */ 411 add x10, sp, #CTX_PAUTH_REGS_OFFSET 412 413 ldp x0, x1, [x10, #CTX_PACIAKEY_LO] /* x1:x0 = APIAKey */ 414 ldp x2, x3, [x10, #CTX_PACIBKEY_LO] /* x3:x2 = APIBKey */ 415 ldp x4, x5, [x10, #CTX_PACDAKEY_LO] /* x5:x4 = APDAKey */ 416 ldp x6, x7, [x10, #CTX_PACDBKEY_LO] /* x7:x6 = APDBKey */ 417 ldp x8, x9, [x10, #CTX_PACGAKEY_LO] /* x9:x8 = APGAKey */ 418 419 msr APIAKeyLo_EL1, x0 420 msr APIAKeyHi_EL1, x1 421 msr APIBKeyLo_EL1, x2 422 msr APIBKeyHi_EL1, x3 423 msr APDAKeyLo_EL1, x4 424 msr APDAKeyHi_EL1, x5 425 msr APDBKeyLo_EL1, x6 426 msr APDBKeyHi_EL1, x7 427 msr APGAKeyLo_EL1, x8 428 msr APGAKeyHi_EL1, x9 429#endif /* CTX_INCLUDE_PAUTH_REGS */ 430 431 /* ---------------------------------------------------------- 432 * Restore PMCR_EL0 when returning to Non-secure state if 433 * Secure Cycle Counter is not disabled in MDCR_EL3 when 434 * ARMv8.5-PMU is implemented. 435 * ---------------------------------------------------------- 436 */ 437 mrs x0, scr_el3 438 tst x0, #SCR_NS_BIT 439 beq 2f 440 441 /* ---------------------------------------------------------- 442 * Back to Non-secure state. 443 * Check if earlier initialization MDCR_EL3.SCCD to 1 failed, 444 * meaning that ARMv8-PMU is not implemented and PMCR_EL0 445 * should be restored from non-secure context. 446 * ---------------------------------------------------------- 447 */ 448 mrs x0, mdcr_el3 449 tst x0, #MDCR_SCCD_BIT 450 bne 2f 451 ldr x0, [sp, #CTX_EL3STATE_OFFSET + CTX_PMCR_EL0] 452 msr pmcr_el0, x0 4532: 454 ldp x0, x1, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X0] 455 ldp x2, x3, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X2] 456 ldp x4, x5, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X4] 457 ldp x6, x7, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X6] 458 ldp x8, x9, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X8] 459 ldp x10, x11, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X10] 460 ldp x12, x13, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X12] 461 ldp x14, x15, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X14] 462 ldp x16, x17, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X16] 463 ldp x18, x19, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X18] 464 ldp x20, x21, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X20] 465 ldp x22, x23, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X22] 466 ldp x24, x25, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X24] 467 ldp x26, x27, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X26] 468 ldr x28, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_SP_EL0] 469 msr sp_el0, x28 470 ldp x28, x29, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X28] 471 ret 472endfunc restore_gp_pmcr_pauth_regs 473 474/* ------------------------------------------------------------------ 475 * This routine assumes that the SP_EL3 is pointing to a valid 476 * context structure from where the gp regs and other special 477 * registers can be retrieved. 478 * ------------------------------------------------------------------ 479 */ 480func el3_exit 481#if ENABLE_ASSERTIONS 482 /* el3_exit assumes SP_EL0 on entry */ 483 mrs x17, spsel 484 cmp x17, #MODE_SP_EL0 485 ASM_ASSERT(eq) 486#endif 487 488 /* ---------------------------------------------------------- 489 * Save the current SP_EL0 i.e. the EL3 runtime stack which 490 * will be used for handling the next SMC. 491 * Then switch to SP_EL3. 492 * ---------------------------------------------------------- 493 */ 494 mov x17, sp 495 msr spsel, #MODE_SP_ELX 496 str x17, [sp, #CTX_EL3STATE_OFFSET + CTX_RUNTIME_SP] 497 498 /* ---------------------------------------------------------- 499 * Restore SPSR_EL3, ELR_EL3 and SCR_EL3 prior to ERET 500 * ---------------------------------------------------------- 501 */ 502 ldr x18, [sp, #CTX_EL3STATE_OFFSET + CTX_SCR_EL3] 503 ldp x16, x17, [sp, #CTX_EL3STATE_OFFSET + CTX_SPSR_EL3] 504 msr scr_el3, x18 505 msr spsr_el3, x16 506 msr elr_el3, x17 507 508#if IMAGE_BL31 && DYNAMIC_WORKAROUND_CVE_2018_3639 509 /* ---------------------------------------------------------- 510 * Restore mitigation state as it was on entry to EL3 511 * ---------------------------------------------------------- 512 */ 513 ldr x17, [sp, #CTX_CVE_2018_3639_OFFSET + CTX_CVE_2018_3639_DISABLE] 514 cbz x17, 1f 515 blr x17 5161: 517#endif 518 /* ---------------------------------------------------------- 519 * Restore general purpose (including x30), PMCR_EL0 and 520 * ARMv8.3-PAuth registers. 521 * Exit EL3 via ERET to a lower exception level. 522 * ---------------------------------------------------------- 523 */ 524 bl restore_gp_pmcr_pauth_regs 525 ldr x30, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_LR] 526 527#if IMAGE_BL31 && RAS_EXTENSION 528 /* ---------------------------------------------------------- 529 * Issue Error Synchronization Barrier to synchronize SErrors 530 * before exiting EL3. We're running with EAs unmasked, so 531 * any synchronized errors would be taken immediately; 532 * therefore no need to inspect DISR_EL1 register. 533 * ---------------------------------------------------------- 534 */ 535 esb 536#endif 537 exception_return 538 539endfunc el3_exit 540