Petr4: formal foundations for p4 data planes

Abstract

P4 is a domain-specific language for programming and specifying packet-processing systems. It is based on an elegant design with high-level abstractions like parsers and match-action pipelines that can be compiled to efficient implementations in software or hardware. Unfortunately, like many industrial languages, P4 has developed without a formal foundation. The P4 Language Specification is a 160-page document with a mixture of informal prose, graphical diagrams, and pseudocode, leaving many aspects of the language semantics up to individual compilation targets. The P4 reference implementation is a complex system, running to over 40KLoC of C++ code, with support for only a few targets. Clearly neither of these artifacts is suitable for formal reasoning about P4 in general. This paper presents a new framework, called Petr4, that puts P4 on a solid foundation. Petr4 consists of a clean-slate definitional interpreter and a core calculus that models a fragment of P4. Petr4 is not tied to any particular target: the interpreter is parameterized over an interface that collects features delegated to targets in one place, while the core calculus overapproximates target-specific behaviors using non-determinism. We have validated the interpreter against a suite of over 750 tests from the P4 reference implementation, exercising our target interface with tests for different targets. We validated the core calculus with a proof of type-preserving termination. While developing Petr4, we reported dozens of bugs in the language specification and the reference implementation, many of which have been fixed.

P4BID: Information Flow Control in P4

“…This section briefly reviews the core P4 calculus presented in the recent work on petr4 [10], the representation of P4 programs in terms of the core calculus syntax, and the operational semantics and typing judgements for the core calculus.…”

“…To understand the semantics of Core P4 programs, we will review the evaluation judgement forms for expressions, statements, and declarations from petr4 [10]. The main judgements are as follows: Since function calls are expressions, and a function's body can update the memory store, the evaluation judgement for expressions can modify the memory store.…”

“…Technically, this is a termination insensitive notion of non-interference, since it does not require that both executions terminate. However, P4 programs do not allow recursion and Doenges et al [10] prove that all well-typed Core P4 programs terminate. We present similar non-interference definitions for expressions and declarations in Definition C.5 and Definition C.10.…”

“…Like many languages in real-world use, P4 has no formal specification. To firm up the foundations of P4, Doenges et al [10] developed a formal version of P4, called Core P4, as part of the broader petr4 project. The formal operational model of Core P4 makes it possible to develop type systems that provably guarantee program properties.…”

“…1. An Information Flow Control (IFC) type system for Core P4 [10], a core calculus modeling the P4 language, together with a soundness theorem: well-typed programs satisfy non-interference (Section 4).…”