int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)

{

	struct inet_request_sock *ireq;

	struct tcp_options_received tmp_opt;

	struct request_sock *req;

	__be32 saddr = ip_hdr(skb)->saddr;

	__be32 daddr = ip_hdr(skb)->daddr;

	__u32 isn = TCP_SKB_CB(skb)->when;

	struct dst_entry *dst = NULL;

#ifdef CONFIG_SYN_COOKIES

	int want_cookie = 0;

#else

#define want_cookie 0 /* Argh, why doesn't gcc optimize this :( */

#endif

 

	/* Never answer to SYNs send to broadcast or multicast */

	if (skb->rtable->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))

		goto drop;

 

	/* TW buckets are converted to open requests without

	 * limitations, they conserve resources and peer is

	 * evidently real one.

	 */

 

	//关键函数inet_csk_reqsk_queue_is_full

	if (inet_csk_reqsk_queue_is_full(sk) && !isn) {

#ifdef CONFIG_SYN_COOKIES

		if (sysctl_tcp_syncookies) {

			want_cookie = 1;

		} else

#endif

		goto drop;

	}

 

	/* Accept backlog is full. If we have already queued enough

	 * of warm entries in syn queue, drop request. It is better than

	 * clogging syn queue with openreqs with exponentially increasing

	 * timeout.

	 */

	if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)

		goto drop;

 

	req = inet_reqsk_alloc(&tcp_request_sock_ops);

	if (!req)

		goto drop;

省略N多代码

static inline int inet_csk_reqsk_queue_is_full(const struct sock *sk)

{

	return reqsk_queue_is_full(&inet_csk(sk)->icsk_accept_queue);

}

static inline int reqsk_queue_is_full(const struct request_sock_queue *queue)

{

        //注意这里是用>>(右移)来判断的，不是大于号

	return queue->listen_opt->qlen >> queue->listen_opt->max_qlen_log;

}

/** struct listen_sock - listen state

 *

 * @max_qlen_log - log_2 of maximal queued SYNs/REQUESTs

 */

struct listen_sock {

	u8			max_qlen_log;// 2^max_qlen_log = 半连接队列最大长度

	/* 3 bytes hole, try to use */

	int			qlen;//全连接队列的当前长度

	int			qlen_young;

	int			clock_hand;

	u32			hash_rnd;

	u32			nr_table_entries;

	struct request_sock	*syn_table[0];

};

//file:net/socket.c

 

SYSCALL_DEFINE2(listen, int, fd, int, backlog)

{

	struct socket *sock;

	int err, fput_needed;

	int somaxconn;

 

	sock = sockfd_lookup_light(fd, &err, &fput_needed);

	if (sock) {

		somaxconn = sock_net(sock->sk)->core.sysctl_somaxconn;

		//上限不超过somaxconn

		if ((unsigned)backlog > somaxconn)

			backlog = somaxconn;

 

		err = security_socket_listen(sock, backlog);

		if (!err)

		        //这里是关键。

			err = sock->ops->listen(sock, backlog);

 

		fput_light(sock->file, fput_needed);

	}

	return err;

}

int inet_listen(struct socket *sock, int backlog)

{

	struct sock *sk = sock->sk;

	unsigned char old_state;

	int err;

 

	lock_sock(sk);

 

	err = -EINVAL;

	if (sock->state != SS_UNCONNECTED || sock->type != SOCK_STREAM)

		goto out;

 

	old_state = sk->sk_state;

	if (!((1 << old_state) & (TCPF_CLOSE | TCPF_LISTEN)))

		goto out;

 

	/* Really, if the socket is already in listen state

	 * we can only allow the backlog to be adjusted.

	 */

	if (old_state != TCP_LISTEN) {

	        //关键函数inet_csk_listen_start

		err = inet_csk_listen_start(sk, backlog);

		if (err)

			goto out;

	}

	sk->sk_max_ack_backlog = backlog;

	err = 0;

 

out:

	release_sock(sk);

	return err;

}

int inet_csk_listen_start(struct sock *sk, const int nr_table_entries)

{

	struct inet_sock *inet = inet_sk(sk);

	struct inet_connection_sock *icsk = inet_csk(sk);

 

	//关键函数reqsk_queue_alloc

	int rc = reqsk_queue_alloc(&icsk->icsk_accept_queue, nr_table_entries);

  //后面省略

}

int reqsk_queue_alloc(struct request_sock_queue *queue,

		      unsigned int nr_table_entries)

{

	size_t lopt_size = sizeof(struct listen_sock);

	struct listen_sock *lopt;

 

  //这里开始影响到nr_table_entries的取值，内核版本小于2.6.20的话nr_table_entries是不会修改的

        nr_table_entries = min_t(u32, nr_table_entries, sysctl_max_syn_backlog);

	nr_table_entries = max_t(u32, nr_table_entries, 8);

	nr_table_entries = roundup_pow_of_two(nr_table_entries + 1);

 

	//nr_table_entries到这里已经确定

	lopt_size += nr_table_entries * sizeof(struct request_sock *);

	if (lopt_size > PAGE_SIZE)

		lopt = __vmalloc(lopt_size,

			GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO,

			PAGE_KERNEL);

	else

		lopt = kzalloc(lopt_size, GFP_KERNEL);

	if (lopt == NULL)

		return -ENOMEM;

 

  //这里确定了lopt->max_qlen_log的值

	for (lopt->max_qlen_log = 3;

	     (1 << lopt->max_qlen_log) < nr_table_entries;//内核版本小于2.6.20的话这里是sysctl_max_syn_backlog

	     lopt->max_qlen_log++);

 

	get_random_bytes(&lopt->hash_rnd, sizeof(lopt->hash_rnd));

	rwlock_init(&queue->syn_wait_lock);

	queue->rskq_accept_head = NULL;

	lopt->nr_table_entries = nr_table_entries;

 

	write_lock_bh(&queue->syn_wait_lock);

	queue->listen_opt = lopt;

	write_unlock_bh(&queue->syn_wait_lock);

 

	return 0;

}