--- /dev/null	Fri Dec 21 15:00:15 2018
+++ new/usr/src/tools/smatch/src/smatch_array_values.c	Fri Dec 21 15:00:15 2018
@@ -0,0 +1,196 @@
+/*
+ * Copyright (C) 2018 Oracle.  All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
+ */
+
+#include "smatch.h"
+#include "smatch_extra.h"
+#include "smatch_slist.h"
+
+static int my_id;
+
+struct db_info {
+	int count;
+	struct symbol *type;
+	struct range_list *rl;
+};
+
+static int get_vals(void *_db_info, int argc, char **argv, char **azColName)
+{
+	struct db_info *db_info = _db_info;
+	struct range_list *rl;
+
+	str_to_rl(db_info->type, argv[0], &rl);
+	db_info->rl = rl_union(db_info->rl, rl);
+
+	return 0;
+}
+
+static int is_file_local(struct expression *array)
+{
+	struct symbol *sym = NULL;
+	char *name;
+
+	name = expr_to_str_sym(array, &sym);
+	free_string(name);
+	if (!sym)
+		return 0;
+
+	if ((sym->ctype.modifiers & MOD_TOPLEVEL) &&
+	    (sym->ctype.modifiers & MOD_STATIC))
+		return 1;
+	return 0;
+}
+
+static char *get_toplevel_name(struct expression *array)
+{
+	char *name;
+	char buf[128];
+
+	if (is_array(array))
+		array = get_array_base(array);
+
+	if (!array || array->type != EXPR_SYMBOL)
+		return NULL;
+	if (!is_file_local(array))
+		return NULL;
+
+	name = expr_to_str(array);
+	snprintf(buf, sizeof(buf), "%s[]", name);
+	free_string(name);
+
+	return alloc_sname(buf);
+}
+
+static char *get_member_array(struct expression *array)
+{
+	char *name;
+	char buf[128];
+
+	name = get_member_name(array);
+	if (!name)
+		return NULL;
+	snprintf(buf, sizeof(buf), "%s[]", name);
+	free_string(name);
+	return alloc_sname(buf);
+}
+
+static char *get_array_name(struct expression *array)
+{
+	struct symbol *type;
+	char *name;
+
+	type = get_type(array);
+	if (!type || type->type != SYM_ARRAY)
+		return NULL;
+
+	name = get_toplevel_name(array);
+	if (name)
+		return name;
+	name = get_member_array(array);
+	if (name)
+		return name;
+
+	return NULL;
+}
+
+int get_array_rl(struct expression *expr, struct range_list **rl)
+{
+	struct expression *array;
+	struct symbol *type;
+	struct db_info db_info = {};
+	char *name;
+
+	type = get_type(expr);
+	if (!type || type->type != SYM_BASETYPE)
+		return 0;
+	db_info.type = type;
+
+	array = get_array_base(expr);
+	name = get_array_name(array);
+	if (!name)
+		return 0;
+
+	if (is_file_local(array)) {
+		run_sql(&get_vals, &db_info,
+			"select value from sink_info where file = '%s' and static = 1 and sink_name = '%s' and type = %d;",
+			get_filename(), name, DATA_VALUE);
+	} else {
+		run_sql(&get_vals, &db_info,
+			"select value from sink_info where sink_name = '%s' and type = %d limit 10;",
+			name, DATA_VALUE);
+	}
+	if (!db_info.rl || db_info.count >= 10)
+		return 0;
+
+	*rl = db_info.rl;
+	return 1;
+}
+
+static struct range_list *get_saved_rl(struct symbol *type, char *name)
+{
+	struct db_info db_info = {.type = type};
+
+	cache_sql(&get_vals, &db_info, "select value from sink_info where sink_name = '%s' and type = %d;",
+		  name, DATA_VALUE);
+	return db_info.rl;
+}
+
+static void update_cache(char *name, int is_static, struct range_list *rl)
+{
+	cache_sql(NULL, NULL, "delete from sink_info where sink_name = '%s' and type = %d;",
+		  name, DATA_VALUE);
+	cache_sql(NULL, NULL, "insert into sink_info values ('%s', %d, '%s', %d, '', '%s');",
+		  get_filename(), is_static, name, DATA_VALUE, show_rl(rl));
+}
+
+static void match_assign(struct expression *expr)
+{
+	struct expression *left, *array;
+	struct range_list *orig_rl, *rl;
+	struct symbol *type;
+	char *name;
+
+	type = get_type(expr->right);
+	if (!type || type->type != SYM_BASETYPE)
+		return;
+
+	left = strip_expr(expr->left);
+	if (!is_array(left))
+		return;
+	array = get_array_base(left);
+	name = get_array_name(array);
+	if (!name)
+		return;
+
+	if (expr->op != '=') {
+		rl = alloc_whole_rl(type);
+	} else {
+		get_absolute_rl(expr->right, &rl);
+		rl = cast_rl(type, rl);
+		orig_rl = get_saved_rl(type, name);
+		rl = rl_union(orig_rl, rl);
+	}
+
+	update_cache(name, is_file_local(array), rl);
+}
+
+void register_array_values(int id)
+{
+	my_id = id;
+
+	add_hook(&match_assign, ASSIGNMENT_HOOK);
+	add_hook(&match_assign, GLOBAL_ASSIGNMENT_HOOK);
+}
