  We present CleanQ, a high-performance operating-system interface for
descriptor-based data transfer with rigorous formal semantics, based on a
simple, formally-verified notion of ownership transfer, with a fast reference
implementation. CleanQ aims to replace the current proliferation of similar,
but subtly diverse, and loosely specified, descriptor-based interfaces in OS
kernels and device drivers. CleanQ has strict semantics that not only clarify
both the implementation of the interface for different hardware devices and
software usecases, but also enable composition of modules as in more
heavyweight frameworks like Unix streams. We motivate CleanQ by showing that
loose specifications derived from implementation lead to security and
correctness bugs in production systems that a clean, formal, and
easilyunderstandable abstraction helps eliminate. We further demonstrate by
experiment that there is negligible performance cost for a clean design: we
show overheads in the tens of cycles for operations, and comparable end-to-end
performance to the highly-tuned Virtio and DPDK implementations on Linux.
