nexoniarz/SchOS
nexoniarz/SchOS
Watch
1
0
Fork
You've already forked SchOS
 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

unix: a bound socket is a file

Browse source 
Gate 1, item 3, and the last of foundations.md.

bind() creates a T_SOCK node at the path; connect() resolves the path and looks
for the socket bound to **that inode**. Matching on the inode rather than on
the path *string* is the part that matters: the name used to live only in the
socket table, so two spellings of one path missed each other, a relative path
never matched an absolute one, and there was nothing to stat() or unlink().
An inode is the thing a path resolves *to*, so connect() can walk the path
however it likes and arrive at the same socket.

    # ls -l /tmp
    srwxr-xr-x 1 root root 0 2026-09-22 08:04 socktest

The node is a marker, not the binding. It holds no data and the live
association stays in the socket table, so a socket file left by a crash is
what Linux leaves behind -- a dead file that connect() refuses until something
binds again -- and unlink()ing a live socket's path does not disturb anyone
already connected.

EADDRINUSE comes from the *directory* rather than from a scan of the table,
deliberately: a stale socket file has to refuse a rebind for the same reason a
running server's does, or two servers both believe they own it. The creation
lives in sys_bind() and not in unix.c, because that is the layer with both --
kernel/net/unix.c knows about sockets and has no business calling create().

T_SOCK is a compat addition to SchFS by the rule in schfs.h: a driver that does
not know SCHFS_T_SOCK maps it to a zero-length regular file, so nothing goes
stale and nothing becomes unreadable.

cmd/socktest section 15 asserts the plan's own wording -- bind, stat, see an
`s`, unlink -- plus the two a name table could never fail: a second bind to a
live path is refused, and connecting to a path that is a *regular file* is
refused rather than matched by name.

**And the semantics being real broke socktest on its second run**, correctly:
the socket files persisted and every bind() hit EADDRINUSE. Every real server
unlinks before binding; socktest now does too, which is the change the new
behaviour demands rather than a workaround for it.

Chasing that turned up something worse. `socktest` reported rc=1 with every
check passing, and so did every other first-party program:

  - **lib/start.S called main and threw %eax away.** sys_exit() reads the
    status from %rdi and nothing put it there, so every program exited with
    whatever that register happened to hold. Every test suite ends in
    `return failures ? 1 : 0` and none of it reached the shell.
  - **exit(void) passed no status either**, for the same reason: the
    declaration takes no argument, so %rdi was the caller's litter.

`if socktest; then` works now, and a failing command reports 1 -- checked both
ways, because a fix that makes everything return 0 would look identical from
the success side.

Also factored: unlink_path() out of sys_unlink, so a failed bind can take its
own node back out without going through the syscall entry, and create_sock()
as a named door rather than exporting create() with an arbitrary type.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Nexoniarz 2026-09-22 10:06:10 +02:00
commit 3f13989883
15 changed files with 339 additions and 45 deletions
Download patch file Download diff file Expand all files Collapse all files

1
kernel/fs/schfs/kmount.c
View file

@ -1203,6 +1203,7 @@ kp_entry(uint64_t ino, uint16_t type, const char *name, unsigned namelen,
kp_puts(c->buf, c->cap, c->len,
type == SCHFS_T_DIR ? "dir " :
type == SCHFS_T_SYMLINK ? "symlink " :
type == SCHFS_T_SOCK ? "socket " :
type == SCHFS_T_DEV ? "dev " : "file ");
for (unsigned i = 0; i < namelen && *c->len < c->cap - 1; i++)
c->buf[(*c->len)++] = name[i];

3
kernel/fs/schfs/vfs.c
View file

@ -53,6 +53,7 @@ type_to_vfs(uint16_t t)
case SCHFS_T_DIR: return T_DIR;
case SCHFS_T_DEV: return T_DEV;
case SCHFS_T_SYMLINK: return T_SYMLINK;
case SCHFS_T_SOCK: return T_SOCK;
default: return T_FILE;
}
}
@ -64,6 +65,7 @@ type_from_vfs(short t)
case T_DIR: return SCHFS_T_DIR;
case T_DEV: return SCHFS_T_DEV;
case T_SYMLINK: return SCHFS_T_SYMLINK;
case T_SOCK: return SCHFS_T_SOCK;
default: return SCHFS_T_FILE;
}
}
@ -434,6 +436,7 @@ gd_emit(struct gd_ctx *g, uint64 ino, unsigned short type,
*(uint8 *)(k + 18) = type == SCHFS_T_DIR ? 4 /* DT_DIR */
: type == SCHFS_T_DEV ? 2 /* DT_CHR */
: type == SCHFS_T_SYMLINK ? 10 /* DT_LNK */
: type == SCHFS_T_SOCK ? 12 /* DT_SOCK */
: 8; /* DT_REG */
memmove(k + 19, name, namelen);
memset(k + 19 + namelen, 0, reclen - 19 - namelen);

37
kernel/net/unix.c
View file

@ -133,12 +133,12 @@ alloc_locked(int type)
// Find a socket listening on this name. Caller holds stab.lock.
static struct socket *
find_listener(const char *name)
find_listener_ino(uint dev, uint64 ino)
{
struct socket *s;
for(s = stab.sock; s < stab.sock + NSOCK; s++)
if(s->state == SS_LISTENING && strncmp(s->name, name, UNIX_PATH_MAX) == 0)
if(s->state == SS_LISTENING && s->bind_dev == dev && s->bind_ino == ino)
return s;
return 0;
}
@ -656,11 +656,22 @@ sockpair(struct socket **pa, struct socket **pb)
return 0;
}
// bind(2) for AF_UNIX. The caller has already created the filesystem node and
// hands over its identity; see sys_bind() in kernel/sys/sys_net.c for why the
// creation lives there and not here.
//
// The name used to live only in this table, so `bind()` created nothing --
// there was no file to stat(), no `s` in `ls -l`, and nothing to unlink. A
// Wayland client finds its compositor by bind()ing a real path, and
// libwayland locks the file beside it; a name table can express neither.
//
// **The node is a marker, not the binding.** It holds no data. What makes a
// socket findable is that connect() resolves the path to an inode and looks
// for the socket bound to *that inode*, so any spelling of the path arrives
// at the same place -- which a string comparison could never manage.
int
sockbind(struct socket *s, const char *path)
sockbind(struct socket *s, const char *path, uint dev, uint64 ino)
{
struct socket *other;
if(path[0] == '\0')
return -EINVAL;
@ -669,14 +680,9 @@ sockbind(struct socket *s, const char *path)
release(&stab.lock);
return -EINVAL;
}
for(other = stab.sock; other < stab.sock + NSOCK; other++){
if(other != s && other->state >= SS_BOUND &&
strncmp(other->name, path, UNIX_PATH_MAX) == 0){
release(&stab.lock);
return -EADDRINUSE;
}
}
safestrcpy(s->name, path, UNIX_PATH_MAX);
s->bind_dev = dev;
s->bind_ino = ino;
s->state = SS_BOUND;
release(&stab.lock);
return 0;
@ -753,8 +759,11 @@ sockaccept(struct socket *s)
return c;
}
// connect(2) for AF_UNIX. The listener is the socket bound to the inode the
// path resolved to -- the caller did the resolving, for the same reason
// sockbind() does not create the node.
int
sockconnect(struct socket *s, const char *path)
sockconnect(struct socket *s, uint dev, uint64 ino)
{
struct socket *srv, *peer;
@ -763,7 +772,7 @@ sockconnect(struct socket *s, const char *path)
release(&stab.lock);
return -EINVAL;
}
srv = find_listener(path);
srv = find_listener_ino(dev, ino);
if(srv == 0){
release(&stab.lock);
return -ECONNREFUSED;

58
kernel/sys/sys_fs.c
View file

@ -52,6 +52,7 @@ struct linux_stat {
#define LINUX_S_IFCHR 0020000
#define LINUX_S_IFREG 0100000
#define LINUX_S_IFLNK 0120000
#define LINUX_S_IFSOCK 0140000
// Linux's dev_t: 12 bits of major and 8 of minor packed into the low 32, with
// the overflow of each above that. Spelled out in full rather than as
@ -87,6 +88,7 @@ stati_linux(struct inode *ip, struct linux_stat *st)
case T_DIR: type_bits = LINUX_S_IFDIR; perm_bits = 0755; break;
case T_DEV: type_bits = LINUX_S_IFCHR; perm_bits = 0666; break;
case T_SYMLINK: type_bits = LINUX_S_IFLNK; perm_bits = 0777; break;
case T_SOCK: type_bits = LINUX_S_IFSOCK; perm_bits = 0755; break;
default: type_bits = LINUX_S_IFREG; perm_bits = (ip->rwmode & 2) ? 0755 : 0555; break;
}
st->st_mode = type_bits | perm_bits;
@ -812,29 +814,61 @@ bad_link:
// is the standard shape -- and against -1/EPERM every such test took the
// complaining branch. zsh saving its history is one of them, and it went on
// reporting a failure after the history had in fact been written.
addr_t sys_unlink(void)
// A socket node, for bind(2).
//
// create() is static because everything that creates a file is in this file;
// AF_UNIX bind is the one exception, and it gets a named door rather than
// create() being exported -- the difference matters, because `create` with an
// arbitrary type is a much bigger thing to hand out than "make me a socket".
//
// Returns a locked inode, like create() does.
struct inode *
create_sock(char *path)
{
return create(path, T_SOCK, 0, 0);
}
// The body of unlink(2), by path. Factored out so that a failed bind can take
// its own node back out without going through the syscall entry, and so there
// is one implementation of what unlink means rather than two.
//
// The caller brackets this with begin_op()/end_op(), the same as sys_unlink.
int
unlink_path(char *path)
{
struct inode *ip, *dp;
char name[DIRSIZ], *path;
char name[DIRSIZ];
uint off;
int err = EPERM;
if (argstr(0, &path) < 0) return -EFAULT;
begin_op();
if (!(dp = nameiparent(path, name))) { end_op(); return -ENOENT; }
if (!(dp = nameiparent(path, name))) return -ENOENT;
ilock(dp);
// "." and ".." are refused by name, which is what POSIX asks for.
if (namecmp(name, ".") == 0 || namecmp(name, "..") == 0) { err = EINVAL; goto bad_unlink; }
if (!(ip = dirlookup(dp, name, &off))) { err = ENOENT; goto bad_unlink; }
if (namecmp(name, ".") == 0 || namecmp(name, "..") == 0) { err = EINVAL; goto bad; }
if (!(ip = dirlookup(dp, name, &off))) { err = ENOENT; goto bad; }
ilock(ip);
if (ip->nlink < 1) panic("unlink: nlink < 1");
if (ip->type == T_DIR && dirempty(ip) != 1) { iunlockput(ip); err = ENOTEMPTY; goto bad_unlink; }
if (dirunlink(dp, name, off) < 0) { iunlockput(ip); err = EIO; goto bad_unlink; }
if (ip->type == T_DIR && dirempty(ip) != 1) { iunlockput(ip); err = ENOTEMPTY; goto bad; }
if (dirunlink(dp, name, off) < 0) { iunlockput(ip); err = EIO; goto bad; }
if (ip->type == T_DIR) { dp->nlink--; iupdate(dp); }
iunlockput(dp); ip->nlink--; iupdate(ip); iunlockput(ip);
end_op(); return 0;
bad_unlink: iunlockput(dp); end_op(); return -err;
return 0;
bad:
iunlockput(dp);
return -err;
}
addr_t sys_unlink(void)
{
char *path;
int r;
if (argstr(0, &path) < 0) return -EFAULT;
begin_op();
r = unlink_path(path);
end_op();
return r;
}
addr_t sys_exec(void)
{
char *path, *argv[MAXARG], *envp[MAXENV];

64
kernel/sys/sys_net.c
View file

@ -19,6 +19,7 @@
#include "fs.h"
#include "spinlock.h"
#include "sleeplock.h"
#include "stat.h"
#include "file.h"
#include "posix.h"
#include "syscall.h"
@ -241,7 +242,46 @@ SYSCALL_DEFINE(bind)
if ((r = fetch_sun_path(uaddr, ulen, path)) < 0)
return r;
return sockbind(s, path);
// The node lives in the filesystem now, and it is made here rather than in
// sockbind() because this is the layer that has both -- kernel/net/unix.c
// knows about sockets and has no business calling create().
//
// EADDRINUSE comes from the directory, not from a scan of the socket
// table: the name being taken is a property of the filesystem, and a
// socket file left behind by a crashed server has to refuse a rebind for
// the same reason a running one does. Otherwise two servers both believe
// they own it.
{
struct inode *ip;
uint dev;
uint64 ino;
begin_op();
if ((ip = namei(path)) != 0) {
iput(ip);
end_op();
return -EADDRINUSE;
}
if ((ip = create_sock(path)) == 0) {
end_op();
return -ENOENT; // the directory does not exist
}
dev = ip->dev;
ino = ip->inum;
iunlockput(ip);
end_op();
r = sockbind(s, path, dev, ino);
if (r < 0) {
// Take the node back out, so a failed bind leaves nothing behind
// for the next one to trip over.
begin_op();
unlink_path(path);
end_op();
}
return r;
}
}
SYSCALL_DEFINE(listen)
@ -277,7 +317,27 @@ SYSCALL_DEFINE(connect)
if ((r = fetch_sun_path(uaddr, ulen, path)) < 0)
return r;
return sockconnect(s, path);
// Resolve the path here, for the same reason bind() creates here. A path
// that names nothing, or names something that is not a socket, is
// ECONNREFUSED -- which is what Linux says and what a client can act on.
{
struct inode *ip;
uint dev;
uint64 ino;
short type;
if ((ip = namei(path)) == 0)
return -ECONNREFUSED;
ilock(ip);
dev = ip->dev;
ino = ip->inum;
type = ip->type;
iunlockput(ip);
if (type != T_SOCK)
return -ECONNREFUSED;
return sockconnect(s, dev, ino);
}
}
// accept(2) and accept4(2) share everything but the flags word.