grpc 1.74.0 → 1.75.0.pre1

data/src/core/handshaker/security/secure_endpoint.cc

@@ -186,11 +186,13 @@ class FrameProtector : public RefCounted<FrameProtector> {
 
   absl::Status Unprotect(absl::Status read_status)
       ABSL_EXCLUSIVE_LOCKS_REQUIRED(read_mu_) {
+    GRPC_LATENT_SEE_ALWAYS_ON_SCOPE("unprotect");
+
     if (shutdown_) {
       return absl::CancelledError("secure endpoint shutdown");
     }
 
-    GRPC_LATENT_SEE_INNER_SCOPE("unprotect");
+    GRPC_TRACE_LOG(secure_endpoint, INFO) << "Starting unprotect for " << this;
     bool keep_looping = false;
     tsi_result result = TSI_OK;
 
@@ -321,7 +323,8 @@ class FrameProtector : public RefCounted<FrameProtector> {
       ABSL_EXCLUSIVE_LOCKS_REQUIRED(write_mu_) {
     if (shutdown_) return TSI_FAILED_PRECONDITION;
 
-    GRPC_LATENT_SEE_INNER_SCOPE("protect");
+    GRPC_LATENT_SEE_ALWAYS_ON_SCOPE("protect");
+    GRPC_TRACE_LOG(secure_endpoint, INFO) << "Starting protect for " << this;
     uint8_t* cur = GRPC_SLICE_START_PTR(write_staging_buffer_);
     uint8_t* end = GRPC_SLICE_END_PTR(write_staging_buffer_);
 
@@ -416,6 +419,10 @@ class FrameProtector : public RefCounted<FrameProtector> {
     }
     // TODO(yangg) do different things according to the error type?
     if (result != TSI_OK) output_buffer_.Clear();
+
+    GRPC_TRACE_LOG(secure_endpoint, INFO)
+        << "Protect: " << this << " result: " << result;
+
     return result;
   }
 
@@ -583,7 +590,7 @@ static void on_write(void* user_data, grpc_error_handle error) {
 static void endpoint_write(
     grpc_endpoint* secure_ep, grpc_slice_buffer* slices, grpc_closure* cb,
     grpc_event_engine::experimental::EventEngine::Endpoint::WriteArgs args) {
-  GRPC_LATENT_SEE_INNER_SCOPE("secure_endpoint write");
+  GRPC_LATENT_SEE_ALWAYS_ON_SCOPE("secure_endpoint write");
   secure_endpoint* ep = reinterpret_cast<secure_endpoint*>(secure_ep);
   tsi_result result;
   {
@@ -800,7 +807,7 @@ class SecureEndpoint final : public EventEngine::Endpoint {
 
     bool Write(absl::AnyInvocable<void(absl::Status)> on_writable,
                SliceBuffer* data, WriteArgs args) {
-      GRPC_LATENT_SEE_INNER_SCOPE("secure_endpoint write");
+      GRPC_LATENT_SEE_ALWAYS_ON_SCOPE("secure_endpoint write");
       tsi_result result;
       frame_protector_.TraceOp("Write", data->c_slice_buffer());
       if (grpc_core::IsSecureEndpointOffloadLargeWritesEnabled()) {
@@ -887,6 +894,8 @@ class SecureEndpoint final : public EventEngine::Endpoint {
       grpc_core::MutexLock read_lock(frame_protector_.read_mu());
       wrapped_ep = std::move(wrapped_ep_);
       frame_protector_.Shutdown();
+      GRPC_TRACE_LOG(secure_endpoint, INFO)
+          << "Shutdown for secure endpoint: " << this;
     }
 
     std::shared_ptr<TelemetryInfo> GetTelemetryInfo() const {
@@ -896,7 +905,7 @@ class SecureEndpoint final : public EventEngine::Endpoint {
 
    private:
     bool MaybeFinishReadImmediately() {
-      GRPC_LATENT_SEE_INNER_SCOPE("secure_endpoint maybe finish read");
+      GRPC_LATENT_SEE_ALWAYS_ON_SCOPE("secure_endpoint maybe finish read");
       grpc_core::MutexLock lock(frame_protector_.read_mu());
       // If the read is large, since we got the bytes whilst still calling read,
       // offload the decryption to event engine.
@@ -927,7 +936,7 @@ class SecureEndpoint final : public EventEngine::Endpoint {
 
     static void FinishAsyncRead(grpc_core::RefCountedPtr<Impl> impl,
                                 absl::Status status) {
-      GRPC_LATENT_SEE_PARENT_SCOPE("secure endpoint finish async read");
+      GRPC_LATENT_SEE_ALWAYS_ON_SCOPE("secure endpoint finish async read");
       {
         grpc_core::MutexLock lock(impl->frame_protector_.read_mu());
         if (status.ok() && impl->wrapped_ep_ == nullptr) {
@@ -962,7 +971,7 @@ class SecureEndpoint final : public EventEngine::Endpoint {
     };
 
     static void FinishAsyncWrite(grpc_core::RefCountedPtr<Impl> impl) {
-      GRPC_LATENT_SEE_PARENT_SCOPE("secure endpoint finish async write");
+      GRPC_LATENT_SEE_ALWAYS_ON_SCOPE("secure endpoint finish async write");
       tsi_result result;
       std::unique_ptr<SliceBuffer> data;
       WriteArgs args;
@@ -1067,12 +1076,18 @@ grpc_core::OrphanablePtr<grpc_endpoint> grpc_secure_endpoint_create(
         event_engine_endpoint = grpc_event_engine::experimental::
             grpc_take_wrapped_event_engine_endpoint(to_wrap.release());
     CHECK(event_engine_endpoint != nullptr);
-    return grpc_core::OrphanablePtr<grpc_endpoint>(
-        grpc_event_engine::experimental::grpc_event_engine_endpoint_create(
-            std::make_unique<grpc_event_engine::experimental::SecureEndpoint>(
-                std::move(event_engine_endpoint), protector,
-                zero_copy_protector, leftover_slices, leftover_nslices,
-                channel_args)));
+    if (grpc_core::IsPipelinedReadSecureEndpointEnabled()) {
+      return grpc_pipelined_secure_endpoint_create(
+          protector, zero_copy_protector, std::move(event_engine_endpoint),
+          leftover_slices, channel_args, leftover_nslices);
+    } else {
+      return grpc_core::OrphanablePtr<grpc_endpoint>(
+          grpc_event_engine::experimental::grpc_event_engine_endpoint_create(
+              std::make_unique<grpc_event_engine::experimental::SecureEndpoint>(
+                  std::move(event_engine_endpoint), protector,
+                  zero_copy_protector, leftover_slices, leftover_nslices,
+                  channel_args)));
+    }
   }
   return grpc_core::MakeOrphanable<secure_endpoint>(
       &vtable, protector, zero_copy_protector, std::move(to_wrap),

data/src/core/handshaker/security/secure_endpoint.h

@@ -55,4 +55,12 @@ grpc_core::OrphanablePtr<grpc_endpoint> grpc_legacy_secure_endpoint_create(
     grpc_slice* leftover_slices, const grpc_channel_args* channel_args,
     size_t leftover_nslices);
 
+grpc_core::OrphanablePtr<grpc_endpoint> grpc_pipelined_secure_endpoint_create(
+    struct tsi_frame_protector* protector,
+    struct tsi_zero_copy_grpc_protector* zero_copy_protector,
+    std::unique_ptr<grpc_event_engine::experimental::EventEngine::Endpoint>
+        to_wrap,
+    grpc_slice* leftover_slices, const grpc_core::ChannelArgs& channel_args,
+    size_t leftover_nslices);
+
 #endif  // GRPC_SRC_CORE_HANDSHAKER_SECURITY_SECURE_ENDPOINT_H

data/src/core/lib/channel/promise_based_filter.cc

@@ -242,8 +242,7 @@ void BaseCallData::CapturedBatch::CancelWith(grpc_error_handle error,
 ///////////////////////////////////////////////////////////////////////////////
 // BaseCallData::Flusher
 
-BaseCallData::Flusher::Flusher(BaseCallData* call, latent_see::Metadata* desc)
-    : latent_see::InnerScope(desc), call_(call) {
+BaseCallData::Flusher::Flusher(BaseCallData* call) : call_(call) {
   GRPC_CALL_STACK_REF(call_->call_stack(), "flusher");
 }
 
@@ -395,7 +394,7 @@ bool BaseCallData::SendMessage::IsIdle() const {
 }
 
 void BaseCallData::SendMessage::OnComplete(absl::Status status) {
-  Flusher flusher(base_, GRPC_LATENT_SEE_METADATA("SendMessage::OnComplete"));
+  Flusher flusher(base_);
   GRPC_TRACE_LOG(channel, INFO)
       << base_->LogTag() << " SendMessage.OnComplete st=" << StateString(state_)
       << " status=" << status;
@@ -705,8 +704,7 @@ void BaseCallData::ReceiveMessage::OnComplete(absl::Status status) {
       break;
   }
   completed_status_ = status;
-  Flusher flusher(base_,
-                  GRPC_LATENT_SEE_METADATA("ReceiveMessage::OnComplete"));
+  Flusher flusher(base_);
   ScopedContext ctx(base_);
   base_->WakeInsideCombiner(&flusher);
 }
@@ -1220,9 +1218,7 @@ class ClientCallData::PollContext {
         auto* next_poll = static_cast<NextPoll*>(p);
         {
           ScopedContext ctx(next_poll->call_data);
-          Flusher flusher(next_poll->call_data,
-                          GRPC_LATENT_SEE_METADATA(
-                              "ClientCallData::PollContext::~PollContext"));
+          Flusher flusher(next_poll->call_data);
           next_poll->call_data->WakeInsideCombiner(&flusher);
         }
         GRPC_CALL_STACK_UNREF(next_poll->call_stack, "re-poll");
@@ -1351,7 +1347,7 @@ void ClientCallData::StartBatch(grpc_transport_stream_op_batch* b) {
   // Fake out the activity based context.
   ScopedContext context(this);
   CapturedBatch batch(b);
-  Flusher flusher(this, GRPC_LATENT_SEE_METADATA("ClientCallData::StartBatch"));
+  Flusher flusher(this);
 
   GRPC_TRACE_LOG(channel, INFO) << LogTag() << " StartBatch " << DebugString();
 
@@ -1557,8 +1553,7 @@ void ClientCallData::RecvInitialMetadataReady(grpc_error_handle error) {
       << DebugString() << " error:" << error.ToString()
       << " md:" << recv_initial_metadata_->metadata->DebugString();
   ScopedContext context(this);
-  Flusher flusher(this, GRPC_LATENT_SEE_METADATA(
-                            "ClientCallData::RecvInitialMetadataReady"));
+  Flusher flusher(this);
   if (!error.ok()) {
     switch (recv_initial_metadata_->state) {
       case RecvInitialMetadata::kHookedWaitingForPipe:
@@ -1744,8 +1739,7 @@ void ClientCallData::RecvTrailingMetadataReadyCallback(
 }
 
 void ClientCallData::RecvTrailingMetadataReady(grpc_error_handle error) {
-  Flusher flusher(this, GRPC_LATENT_SEE_METADATA(
-                            "ClientCallData::RecvTrailingMetadataReady"));
+  Flusher flusher(this);
   GRPC_TRACE_LOG(channel, INFO)
       << LogTag() << " ClientCallData.RecvTrailingMetadataReady "
       << "recv_trailing_state=" << StateString(recv_trailing_state_)
@@ -1796,12 +1790,12 @@ void ClientCallData::SetStatusFromError(grpc_metadata_batch* metadata,
 
 // Wakeup and poll the promise if appropriate.
 void ClientCallData::WakeInsideCombiner(Flusher* flusher) {
-  GRPC_LATENT_SEE_INNER_SCOPE("ClientCallData::WakeInsideCombiner");
+  GRPC_LATENT_SEE_SCOPE("ClientCallData::WakeInsideCombiner");
   PollContext(this, flusher).Run();
 }
 
 void ClientCallData::OnWakeup() {
-  Flusher flusher(this, GRPC_LATENT_SEE_METADATA("ClientCallData::OnWakeup"));
+  Flusher flusher(this);
   ScopedContext context(this);
   WakeInsideCombiner(&flusher);
 }
@@ -1877,9 +1871,7 @@ class ServerCallData::PollContext {
       auto run = [](void* p, grpc_error_handle) {
         auto* next_poll = static_cast<NextPoll*>(p);
         {
-          Flusher flusher(next_poll->call_data,
-                          GRPC_LATENT_SEE_METADATA(
-                              "ServerCallData::PollContext::~PollContext"));
+          Flusher flusher(next_poll->call_data);
           ScopedContext context(next_poll->call_data);
           next_poll->call_data->WakeInsideCombiner(&flusher);
         }
@@ -1983,7 +1975,7 @@ void ServerCallData::StartBatch(grpc_transport_stream_op_batch* b) {
   // Fake out the activity based context.
   ScopedContext context(this);
   CapturedBatch batch(b);
-  Flusher flusher(this, GRPC_LATENT_SEE_METADATA("ServerCallData::StartBatch"));
+  Flusher flusher(this);
   bool wake = false;
 
   GRPC_TRACE_LOG(channel, INFO) << LogTag() << " StartBatch: " << DebugString();
@@ -2272,8 +2264,7 @@ void ServerCallData::RecvTrailingMetadataReady(grpc_error_handle error) {
   GRPC_TRACE_LOG(channel, INFO)
       << LogTag() << ": RecvTrailingMetadataReady error=" << error
       << " md=" << recv_trailing_metadata_->DebugString();
-  Flusher flusher(this, GRPC_LATENT_SEE_METADATA(
-                            "ServerCallData::RecvTrailingMetadataReady"));
+  Flusher flusher(this);
   PollContext poll_ctx(this, &flusher);
   Completed(error, recv_trailing_metadata_->get(GrpcTarPit()).has_value(),
             &flusher);
@@ -2287,8 +2278,7 @@ void ServerCallData::RecvInitialMetadataReadyCallback(void* arg,
 }
 
 void ServerCallData::RecvInitialMetadataReady(grpc_error_handle error) {
-  Flusher flusher(this, GRPC_LATENT_SEE_METADATA(
-                            "ServerCallData::RecvInitialMetadataReady"));
+  Flusher flusher(this);
   GRPC_TRACE_LOG(channel, INFO)
       << LogTag() << ": RecvInitialMetadataReady " << error;
   CHECK(recv_initial_state_ == RecvInitialState::kForwarded);
@@ -2351,7 +2341,7 @@ std::string ServerCallData::DebugString() const {
 
 // Wakeup and poll the promise if appropriate.
 void ServerCallData::WakeInsideCombiner(Flusher* flusher) {
-  GRPC_LATENT_SEE_INNER_SCOPE("ServerCallData::WakeInsideCombiner");
+  GRPC_LATENT_SEE_SCOPE("ServerCallData::WakeInsideCombiner");
   PollContext poll_ctx(this, flusher);
   GRPC_TRACE_LOG(channel, INFO)
       << LogTag() << ": WakeInsideCombiner " << DebugString();
@@ -2503,7 +2493,7 @@ void ServerCallData::WakeInsideCombiner(Flusher* flusher) {
 }
 
 void ServerCallData::OnWakeup() {
-  Flusher flusher(this, GRPC_LATENT_SEE_METADATA("ServerCallData::OnWakeup"));
+  Flusher flusher(this);
   ScopedContext context(this);
   WakeInsideCombiner(&flusher);
 }

data/src/core/lib/channel/promise_based_filter.h

@@ -196,7 +196,10 @@ struct CallHasAsyncErrorInterceptor<
 template <typename Derived>
 struct CallHasAsyncErrorInterceptor<
     Derived, std::enable_if_t<IsFusedFilter<Derived>::value>> {
-  static constexpr bool value = Derived::FusedFilterHasAsyncErrorInterceptor();
+  // Fused filter types return a promise, which resolves to a
+  // ServerMetadataHandle type. So we assume that an async error interceptor is
+  // always needed.
+  static constexpr bool value = true;
 };
 
 // Given a boolean X export a type:
@@ -1304,11 +1307,9 @@ class BaseCallData : public Activity, private Wakeable {
     }
   };
 
-  class Flusher : public latent_see::InnerScope {
+  class Flusher {
    public:
-    explicit Flusher(BaseCallData* call,
-                     latent_see::Metadata* desc = GRPC_LATENT_SEE_METADATA(
-                         "PromiseBasedFilter::Flusher"));
+    explicit Flusher(BaseCallData* call);
     // Calls closures, schedules batches, relinquishes call combiner.
     ~Flusher();
 

data/src/core/lib/event_engine/ares_resolver.h

@@ -22,8 +22,10 @@
 
 #if GRPC_ARES == 1
 
-#include <ares.h>
 #include <grpc/event_engine/event_engine.h>
+// ares.h is not self-contained w.r.t. windows headers so pull in
+// event_engine.h first
+#include <ares.h>
 
 #include <list>
 #include <memory>

data/src/core/lib/event_engine/cf_engine/cf_engine.cc

@@ -24,6 +24,7 @@
 #include "absl/log/check.h"
 #include "absl/log/log.h"
 #include "src/core/lib/event_engine/cf_engine/cf_engine.h"
+#include "src/core/lib/event_engine/cf_engine/cfsocket_listener.h"
 #include "src/core/lib/event_engine/cf_engine/cfstream_endpoint.h"
 #include "src/core/lib/event_engine/cf_engine/dns_service_resolver.h"
 #include "src/core/lib/event_engine/posix_engine/timer_manager.h"
@@ -81,11 +82,14 @@ CFEventEngine::~CFEventEngine() {
 
 absl::StatusOr<std::unique_ptr<EventEngine::Listener>>
 CFEventEngine::CreateListener(
-    Listener::AcceptCallback /* on_accept */,
-    absl::AnyInvocable<void(absl::Status)> /* on_shutdown */,
-    const EndpointConfig& /* config */,
-    std::unique_ptr<MemoryAllocatorFactory> /* memory_allocator_factory */) {
-  grpc_core::Crash("unimplemented");
+    Listener::AcceptCallback on_accept,
+    absl::AnyInvocable<void(absl::Status)> on_shutdown,
+    const EndpointConfig& config,
+    std::unique_ptr<MemoryAllocatorFactory> memory_allocator_factory) {
+  return std::make_unique<CFSocketListener>(
+      std::static_pointer_cast<CFEventEngine>(shared_from_this()),
+      std::move(on_accept), std::move(on_shutdown), config,
+      std::move(memory_allocator_factory));
 }
 
 CFEventEngine::ConnectionHandle CFEventEngine::Connect(

data/src/core/lib/event_engine/cf_engine/cf_engine.h

@@ -30,7 +30,7 @@
 
 namespace grpc_event_engine::experimental {
 
-class CFEventEngine : public EventEngine, public Scheduler {
+class CFEventEngine : public EventEngine {
  public:
   CFEventEngine();
   ~CFEventEngine() override;
@@ -57,6 +57,7 @@ class CFEventEngine : public EventEngine, public Scheduler {
   TaskHandle RunAfter(Duration when,
                       absl::AnyInvocable<void()> closure) override;
   bool Cancel(TaskHandle handle) override;
+  ThreadPool* thread_pool() const { return thread_pool_.get(); }
 
  private:
   struct Closure;

data/src/core/lib/event_engine/cf_engine/cfsocket_listener.cc

@@ -0,0 +1,263 @@
+// Copyright 2025 The gRPC Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <grpc/support/port_platform.h>
+
+#ifdef GPR_APPLE
+#include <AvailabilityMacros.h>
+#ifdef AVAILABLE_MAC_OS_X_VERSION_10_12_AND_LATER
+
+#include <netinet/in.h>
+#include <sys/socket.h>
+
+#include "src/core/lib/debug/trace_flags.h"
+#include "src/core/lib/debug/trace_impl.h"
+#include "src/core/lib/event_engine/cf_engine/cfsocket_listener.h"
+#include "src/core/lib/event_engine/cf_engine/cfstream_endpoint.h"
+#include "src/core/lib/event_engine/tcp_socket_utils.h"
+#include "src/core/util/strerror.h"
+
+namespace grpc_event_engine::experimental {
+
+namespace {
+
+auto GetCfSocketResolvedAddress6(CFSocketRef ipv6cfsock) {
+  CFTypeUniqueRef<CFDataRef> sin6cfd = CFSocketCopyAddress(ipv6cfsock);
+  auto sin6 = reinterpret_cast<const sockaddr*>(CFDataGetBytePtr(sin6cfd));
+  return EventEngine::ResolvedAddress{sin6, sin6->sa_len};
+}
+
+}  // namespace
+
+CFSocketListenerImpl::CFSocketListenerImpl(
+    std::shared_ptr<CFEventEngine> engine,
+    EventEngine::Listener::AcceptCallback on_accept,
+    absl::AnyInvocable<void(absl::Status)> on_shutdown,
+    const EndpointConfig& config,
+    std::unique_ptr<MemoryAllocatorFactory> memory_allocator_factory)
+    : engine_(std::move(engine)),
+      on_accept_(std::move(on_accept)),
+      on_shutdown_(std::move(on_shutdown)),
+      memory_allocator_factory_(std::move(memory_allocator_factory)) {}
+
+CFSocketListenerImpl::~CFSocketListenerImpl() {
+  on_shutdown_(absl::OkStatus());
+  dispatch_release(queue_);
+
+  GRPC_TRACE_LOG(event_engine, INFO)
+      << "CFSocketListenerImpl::~CFSocketListenerImpl, this: " << this;
+}
+
+void CFSocketListenerImpl::Shutdown() {
+  GRPC_TRACE_LOG(event_engine, INFO)
+      << "CFSocketListenerImpl::Shutdown: this: " << this;
+
+  grpc_core::MutexLock lock(&mu_);
+
+  shutdown_ = true;
+  for (auto& [ipv6cfsock] : ipv6cfsocks_) {
+    CFSocketInvalidate(ipv6cfsock);
+  }
+  if (runloop_) {
+    CFRunLoopWakeUp(runloop_);
+    CFRunLoopStop(runloop_);
+  }
+}
+
+absl::StatusOr<int> CFSocketListenerImpl::Bind(
+    const EventEngine::ResolvedAddress& addr) {
+  grpc_core::MutexLock lock(&mu_);
+
+  if (started_) {
+    return absl::FailedPreconditionError(
+        "Listener is already started, ports can no longer be bound");
+  }
+  CHECK(addr.size() <= EventEngine::ResolvedAddress::MAX_SIZE_BYTES);
+
+  int port = ResolvedAddressGetPort(addr);
+  // if port is not specified, reuse any listening port
+  if (port == 0) {
+    for (auto& [ipv6cfsock] : ipv6cfsocks_) {
+      auto bind_addr = GetCfSocketResolvedAddress6(ipv6cfsock);
+      int bind_port = ResolvedAddressGetPort(bind_addr);
+      if (bind_port > 0) {
+        port = bind_port;
+        break;
+      }
+    }
+  }
+
+  EventEngine::ResolvedAddress addr6;
+  // treat :: or 0.0.0.0 as a family-agnostic wildcard.
+  if (MaybeGetWildcardPortFromAddress(addr).has_value()) {
+    addr6 = ResolvedAddressMakeWild6(port);
+  }
+  // convert to ipv6 if needed
+  if (!ResolvedAddressToV4Mapped(addr, &addr6)) {
+    addr6 = addr;
+  }
+  // update port
+  ResolvedAddressSetPort(addr6, port);
+
+  // open socket
+  CFSocketContext ipv6cfsock_context = {0, this, Retain, Release, nullptr};
+  auto ipv6cfsock = CFSocketCreate(kCFAllocatorDefault, PF_INET6, SOCK_STREAM,
+                                   IPPROTO_TCP, kCFSocketAcceptCallBack,
+                                   handleConnect, &ipv6cfsock_context);
+
+  // allow reuse of the address and port
+  auto sin6_fd = CFSocketGetNative(ipv6cfsock);
+  int sock_flag = 1;
+  int err = setsockopt(sin6_fd, SOL_SOCKET, SO_REUSEADDR, &sock_flag,
+                       sizeof(sock_flag));
+  if (err != 0) {
+    return absl::InternalError(absl::StrCat(
+        "CFSocketListenerImpl::Bind, setsockopt(SO_REUSEADDR) errors: ",
+        grpc_core::StrError(errno)));
+  }
+  err = setsockopt(sin6_fd, SOL_SOCKET, SO_REUSEPORT, &sock_flag,
+                   sizeof(sock_flag));
+  if (err != 0) {
+    return absl::InternalError(absl::StrCat(
+        "CFSocketListenerImpl::Bind, setsockopt(SO_REUSEPORT) errors: ",
+        grpc_core::StrError(errno)));
+  }
+
+  // bind socket to address
+  CFTypeUniqueRef<CFDataRef> sin6cfd =
+      CFDataCreate(kCFAllocatorDefault, (UInt8*)addr6.address(), addr6.size());
+  CFSocketError cf_error = CFSocketSetAddress(ipv6cfsock, sin6cfd);
+  if (cf_error != kCFSocketSuccess) {
+    return absl::InternalError(absl::StrCat(
+        "CFSocketListenerImpl::Bind, CFSocketSetAddress error: ", cf_error));
+  }
+
+  // find actual bind address and port
+  auto bind_addr = GetCfSocketResolvedAddress6(ipv6cfsock);
+  int bind_port = ResolvedAddressGetPort(bind_addr);
+
+  ipv6cfsocks_.emplace_back(ipv6cfsock);
+
+  GRPC_TRACE_LOG(event_engine, INFO)
+      << "CFSocketListenerImpl::Bind, addr: "
+      << ResolvedAddressToString(addr).value_or("")
+      << ", bind_addr: " << ResolvedAddressToString(bind_addr).value_or("")
+      << ", this: " << this;
+
+  return bind_port;
+}
+
+absl::Status CFSocketListenerImpl::Start() {
+  grpc_core::MutexLock lock(&mu_);
+
+  CHECK(!started_);
+  started_ = true;
+
+  dispatch_async_f(queue_, Ref().release(), [](void* thatPtr) {
+    grpc_core::RefCountedPtr<CFSocketListenerImpl> that{
+        static_cast<CFSocketListenerImpl*>(thatPtr)};
+
+    GRPC_TRACE_LOG(event_engine, INFO)
+        << "CFSocketListenerImpl::Start, running CFRunLoop"
+        << ", this: " << thatPtr;
+
+    {
+      grpc_core::MutexLock lock(&that->mu_);
+      if (that->shutdown_) {
+        return;
+      }
+
+      that->runloop_ = CFRunLoopGetCurrent();
+      for (auto& [ipv6cfsock] : that->ipv6cfsocks_) {
+        CFTypeUniqueRef<CFRunLoopSourceRef> ipv6cfsock_source =
+            CFSocketCreateRunLoopSource(kCFAllocatorDefault, ipv6cfsock, 0);
+        CFRunLoopAddSource(CFRunLoopGetCurrent(), ipv6cfsock_source,
+                           kCFRunLoopDefaultMode);
+      }
+    }
+
+    CFRunLoopRun();
+
+    GRPC_TRACE_LOG(event_engine, INFO)
+        << "CFSocketListenerImpl::Start, CFRunLoop stopped"
+        << ", this: " << thatPtr;
+  });
+
+  return absl::OkStatus();
+}
+
+/* static */
+void CFSocketListenerImpl::handleConnect(CFSocketRef s,
+                                         CFSocketCallBackType type,
+                                         CFDataRef address, const void* data,
+                                         void* info) {
+  CFSocketListenerImpl* self = static_cast<CFSocketListenerImpl*>(info);
+
+  switch (type) {
+    case kCFSocketAcceptCallBack: {
+      std::string peer_name = "unknown";
+      auto peer_sin6 =
+          reinterpret_cast<const sockaddr*>(CFDataGetBytePtr(address));
+      auto peer_addr =
+          EventEngine::ResolvedAddress(peer_sin6, peer_sin6->sa_len);
+      auto addr_uri = ResolvedAddressToURI(peer_addr);
+      if (!addr_uri.ok()) {
+        GRPC_TRACE_LOG(event_engine, ERROR)
+            << "invalid peer name: " << addr_uri.status() << ", this: " << self;
+      } else {
+        peer_name = *addr_uri;
+      }
+
+      auto socketHandle = *static_cast<const CFSocketNativeHandle*>(data);
+      auto endpoint = std::make_unique<CFStreamEndpoint>(
+          self->engine_,
+          self->memory_allocator_factory_->CreateMemoryAllocator(
+              absl::StrCat("endpoint-tcp-server-connection: ", peer_name)));
+
+      endpoint->AcceptSocket(
+          [that = self->Ref(), socketHandle, peer_name = std::move(peer_name),
+           endpoint = std::move(endpoint)](absl::Status status) mutable {
+            if (!status.ok()) {
+              GRPC_TRACE_LOG(event_engine, ERROR)
+                  << "CFSocketListenerImpl::handleConnect, accept failed: "
+                  << status << ", this: " << that.get();
+              return;
+            }
+
+            that->on_accept_(
+                std::move(endpoint),
+                that->memory_allocator_factory_->CreateMemoryAllocator(
+                    absl::StrCat("on-accept-tcp-server-connection: ",
+                                 peer_name)));
+            GRPC_TRACE_LOG(event_engine, INFO)
+                << "CFSocketListenerImpl::handleConnect, accepted socket: "
+                << socketHandle << ", peer_name: " << peer_name
+                << ", this: " << that.get();
+          },
+          socketHandle, peer_addr);
+
+      break;
+    }
+    default:
+      GRPC_TRACE_LOG(event_engine, ERROR)
+          << "CFSocketListenerImpl::handleConnect, unexpected type: " << type
+          << ", this: " << self;
+      break;
+  }
+}
+
+}  // namespace grpc_event_engine::experimental
+
+#endif  // AVAILABLE_MAC_OS_X_VERSION_10_12_AND_LATER
+#endif  // GPR_APPLE