CHERI static analysis

on YouTube ↗23m

" summary

Adds CHERI support to the Clang Static Analyzer and implements four CHERI-aware checkers: a pointer alignment checker, a capability-copy detector, and a provenance-aware pointer‑as‑integer checker plus a simple sizeof-pointer IST matcher. Analysis is path‑sensitive and interprocedural within a TU, runs about 4–5× slower than compile, and is exercised on 300+ CHERI ports. Pointer alignment and provenance warnings produce the most true positives; capability-copy detection yields many false positives that need refinement.

AI-written summary · about

" chapters (9)

1. 0:00Static analysis for CHERI
2. 2:13CHERI portability issues
3. 3:57Extending Clang analyzer for CHERI
4. 6:29Pointer alignment in CHERI
5. 10:47Capability copy detection
6. 11:54Pointer provenance in CHERI
7. 13:17Pointer size checker
8. 14:22Results and evaluation
9. 15:25Q&A

" related talks

• 19mStatic Analysis for CHERIIan Stark, Irina Dudina · SOAP 2024
• 18mWhat’s next for memory safety?Simon Moore · Resilient IoT + Trustable AI Conference 2025
• 01h 33mHands-on Introduction to CHERIMarno van der Maas, John Thomson, Alfredo Mazzinghi · RISC-V Summit Europe 2026 Developer Workshops
• 10mCHERI in out-of-order microarchitecturesFranz Fuchs · RISC-V Summit Europe 2024
• 20mMaking CHERI AccessibleMarno van der Maas, John Thomson · RISC-V Summit North America 2025
• 27mA CHERI C Memory Model for Verified Temporal SafetyNathaniel Wesley Filardo, Kayvan Memarian, Peter Sewell, Brian Campbell, Ricardo Almeida, Ian Stark, Vadim Zaliva · CPP 2025
• 23mInterpreter Memory Safety via Differential Fuzzing with a CHERI on TopJeremy Singer, Zheng Wang, Huanting Wang, Kai Feng · ISMM 2026
• 31mMemory Safety: The Pernicious ChallengeNuala Kilmartin, Mike Eftimikas, Ashley Setter · IoTSF Conference 2024