CleanQ: a lightweight, uniform, formally specified interface for intra-machine data transfer

TL;DR

CleanQ introduces a formally specified, high-performance OS interface for data transfer that simplifies implementation, enhances security, and maintains competitive performance compared to existing solutions.

Contribution

It provides a formally verified, uniform interface for data transfer in OS kernels, reducing bugs and enabling module composition.

Findings

Negligible overhead of tens of cycles per operation

Comparable performance to Virtio and DPDK implementations

Formal semantics improve security and correctness

Abstract

We present CleanQ, a high-performance operating-system interface for descriptor-based data transfer with rigorous formal semantics, based on a simple, formally-verified notion of ownership transfer, with a fast reference implementation. CleanQ aims to replace the current proliferation of similar, but subtly diverse, and loosely specified, descriptor-based interfaces in OS kernels and device drivers. CleanQ has strict semantics that not only clarify both the implementation of the interface for different hardware devices and software usecases, but also enable composition of modules as in more heavyweight frameworks like Unix streams. We motivate CleanQ by showing that loose specifications derived from implementation lead to security and correctness bugs in production systems that a clean, formal, and easilyunderstandable abstraction helps eliminate. We further demonstrate by experiment that there is negligible performance cost for a clean design: we show overheads in the tens of cycles for operations, and comparable end-to-end performance to the highly-tuned Virtio and DPDK implementations on Linux.