--- /dev/null	Fri Dec 21 15:00:08 2018
+++ new/usr/src/tools/smatch/src/check_spectre.c	Fri Dec 21 15:00:08 2018
@@ -0,0 +1,210 @@
+/*
+ * Copyright (C) 2018 Oracle.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
+ */
+
+#include "smatch.h"
+#include "smatch_extra.h"
+
+static int my_id;
+
+static int suppress_multiple = 1;
+
+static int is_write(struct expression *expr)
+{
+	return 0;
+}
+
+static int is_read(struct expression *expr)
+{
+	struct expression *parent, *last_parent;
+	struct statement *stmt;
+
+	if (is_write(expr))
+		return 0;
+
+	last_parent = expr;
+	while ((parent = expr_get_parent_expr(expr))){
+
+		last_parent = parent;
+
+		/* If we pass a value as a parameter that's a read, probably? */
+//		if (parent->type == EXPR_CALL)
+//			return 1;
+
+		if (parent->type == EXPR_ASSIGNMENT) {
+			if (parent->right == expr)
+				return 1;
+			if (parent->left == expr)
+				return 0;
+		}
+		expr = parent;
+	}
+
+	stmt = expr_get_parent_stmt(last_parent);
+	if (stmt && stmt->type == STMT_RETURN)
+		return 1;
+
+	return 0;
+}
+
+static int is_harmless(struct expression *expr)
+{
+	struct expression *tmp, *parent;
+	struct statement *stmt;
+	int count = 0;
+
+	parent = expr;
+	while ((tmp = expr_get_parent_expr(parent))) {
+		if (tmp->type == EXPR_ASSIGNMENT || tmp->type == EXPR_CALL)
+			return 0;
+		parent = tmp;
+		if (count++ > 4)
+			break;
+	}
+
+	stmt = expr_get_parent_stmt(parent);
+	if (!stmt)
+		return 0;
+	if (stmt->type == STMT_IF && stmt->if_conditional == parent)
+		return 1;
+	if (stmt->type == STMT_ITERATOR &&
+	    (stmt->iterator_pre_condition == parent ||
+	     stmt->iterator_post_condition == parent))
+		return 1;
+
+	return 0;
+}
+
+static unsigned long long get_max_by_type(struct expression *expr)
+{
+	struct symbol *type;
+	int cnt = 0;
+	sval_t max;
+
+	max.type = &ullong_ctype;
+	max.uvalue = -1ULL;
+
+	while (true) {
+		expr = strip_parens(expr);
+		type = get_type(expr);
+		if (type && sval_type_max(type).uvalue < max.uvalue)
+			max = sval_type_max(type);
+		if (expr->type == EXPR_PREOP) {
+			expr = expr->unop;
+		} else if (expr->type == EXPR_BINOP) {
+			if (expr->op == '%' || expr->op == '&')
+				expr = expr->right;
+			else
+				return max.uvalue;
+		} else {
+			expr = get_assigned_expr(expr);
+			if (!expr)
+				return max.uvalue;
+		}
+		if (cnt++ > 5)
+			return max.uvalue;
+	}
+
+	return max.uvalue;
+}
+
+static unsigned long long get_mask(struct expression *expr)
+{
+	struct expression *tmp;
+	sval_t mask;
+	int cnt = 0;
+
+	expr = strip_expr(expr);
+
+	tmp = get_assigned_expr(expr);
+	while (tmp) {
+		expr = tmp;
+		if (++cnt > 3)
+			break;
+		tmp = get_assigned_expr(expr);
+	}
+
+	if (expr->type == EXPR_BINOP && expr->op == '&') {
+		if (get_value(expr->right, &mask))  /* right is the common case */
+			return mask.uvalue;
+		if (get_value(expr->left, &mask))
+			return mask.uvalue;
+	}
+
+	return ULLONG_MAX;
+}
+
+static void array_check(struct expression *expr)
+{
+	struct expression_list *conditions;
+	struct expression *array_expr, *offset;
+	unsigned long long mask;
+	int array_size;
+	char *name;
+
+	expr = strip_expr(expr);
+	if (!is_array(expr))
+		return;
+
+	if (is_impossible_path())
+		return;
+	if (is_harmless(expr))
+		return;
+
+	array_expr = get_array_base(expr);
+	if (suppress_multiple && is_ignored_expr(my_id, array_expr))
+		return;
+
+	offset = get_array_offset(expr);
+	if (!is_user_rl(offset))
+		return;
+	if (is_nospec(offset))
+		return;
+
+	array_size = get_array_size(array_expr);
+	if (array_size > 0 && get_max_by_type(offset) < array_size)
+		return;
+//	binfo = get_bit_info(offset);
+//	if (array_size > 0 && binfo && binfo->possible < array_size)
+//		return;
+
+	mask = get_mask(offset);
+	if (mask <= array_size)
+		return;
+
+	conditions = get_conditions(offset);
+
+	name = expr_to_str(array_expr);
+	sm_warning("potential spectre issue '%s' [%s]%s",
+	       name,
+	       is_read(expr) ? "r" : "w",
+	       conditions ? " (local cap)" : "");
+	if (suppress_multiple)
+		add_ignore_expr(my_id, array_expr);
+	free_string(name);
+}
+
+void check_spectre(int id)
+{
+	my_id = id;
+
+	suppress_multiple = getenv("FULL_SPECTRE") == NULL;
+
+	if (option_project != PROJ_KERNEL)
+		return;
+
+	add_hook(&array_check, OP_HOOK);
+}
