#include <sys/types.h>          /* See NOTES */
#include <sys/socket.h>
int socket(int domain, int type, int protocol);

static int sock_alloc_file(struct socket *sock, struct file **f, int flags)
{    
    …………    
    /* 申请一个struct file，并将socket_file_ops作为参数来传递。
    * 在alloc_file中，会将socket_file_ops赋给file->f_op。
    */    
    file = alloc_file(&path, FMODE_READ | FMODE_WRITE, &socket_file_ops);    
    …………    
    /* 让sock->file指向file，完成sock和file的关联 */    
    sock->file = file;    
    file->f_flags = O_RDWR | (flags & O_NONBLOCK);    
    file->f_pos = 0;    
    file->private_data = sock;    
    *f = file;    
    return fd;
}

#include <sys/types.h>          /* See NOTES */
#include <sys/socket.h>
int bind(int sockfd, const struct sockaddr *addr, socklen_t addrlen);

struct sockaddr {    
    sa_family_t sa_family;    
    char        sa_data[14];
}

#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <arpa/inet.h>

#define LOOPBACK_ADDR 0x7F000001
#define LISTEN_PORT   1234

int main(void) {
    int sock;
    struct sockaddr_in addr;

    sock = socket(AF_INET, SOCK_STREAM, 0);
    if (-1 == sock) {
        printf("Fail to create socket\n");
        goto err1;
    }

    addr.sin_family = AF_INET;
    addr.sin_addr.s_addr = htonl(LOOPBACK_ADDR);
    addr.sin_port = htons(LISTEN_PORT);

    if (0 != bind(sock, (struct sockaddr *)&addr, sizeof(addr))) {
        printf("Fail to bind\n");
        goto err2;
    }

    if (0 != listen(sock, 3)) {
        printf("Fail to listen\n");
        goto err2;
    }

    while (1) {
        sleep(3);
    }

    close(sock);
    return 0;

err2:
    close(sock);
err1:
    return -1;
}

[fgao@ubuntu ~]# netstat -ant
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address  Foreign Address        State
tcp        0      0    127.0.0.1:1234      0.0.0.0:*      LISTEN

SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
{
    // 直接调用内核内部实现的 __sys_bind 函数
    return __sys_bind(fd, umyaddr, addrlen);
}

int __sys_bind(int fd, struct sockaddr __user *umyaddr, int addrlen)
{
    struct socket *sock;
    struct sockaddr_storage address;
    int err, fput_needed;

    // 通过文件描述符 fd 查找对应的 socket 结构
    // sockfd_lookup_light 是一个轻量级的查找函数
    sock = sockfd_lookup_light(fd, &err, &fput_needed);
    if (sock) {
        // 将用户空间的地址 umyaddr 复制到内核空间的 address 变量中
        err = move_addr_to_kernel(umyaddr, addrlen, &address);
        if (!err) {
            // 执行安全性检查，确保当前进程有权限执行 bind 操作
            err = security_socket_bind(sock,
                                       (struct sockaddr *)&address,
                                       addrlen);
            if (!err)
                // 调用具体协议的 bind 实现
                // 通过 sock->ops->bind 函数指针调用协议相关的 bind 操作
                err = sock->ops->bind(sock,
                                      (struct sockaddr *)&address, addrlen);
        }
        // 释放对 socket 文件结构的引用
        fput_light(sock->file, fput_needed);
    }
    // 返回操作的结果，成功返回 0，失败返回负的错误代码
    return err;
}

int inet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
{
    struct sock *sk = sock->sk; // 获取与 socket 关联的 sock 结构
    int err;

    // 如果套接字协议有自己的绑定函数，则直接调用它（例如 RAW 套接字）
    if (sk->sk_prot->bind) {
        return sk->sk_prot->bind(sk, uaddr, addr_len);
    }

    // 检查地址长度是否小于 sockaddr_in 结构的大小
    if (addr_len < sizeof(struct sockaddr_in))
        return -EINVAL; // 返回无效参数错误

    /* 在进行任何检查之前运行 BPF 程序，以便如果程序以错误的方式更改上下文，
     * 它将被捕获。
     */
    err = BPF_CGROUP_RUN_PROG_INET4_BIND(sk, uaddr);
    if (err)
        return err; // 如果 BPF 程序返回错误，则直接返回

    // 调用内部的 __inet_bind 函数执行实际的绑定操作
    return __inet_bind(sk, uaddr, addr_len, false, true);
}
EXPORT_SYMBOL(inet_bind); // 导出符号以供其他内核模块使用
int __inet_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len,
        bool force_bind_address_no_port, bool with_lock)
{
    struct sockaddr_in *addr = (struct sockaddr_in *)uaddr;
    struct inet_sock *inet = inet_sk(sk);
    struct net *net = sock_net(sk);
    unsigned short snum;
    int chk_addr_ret;
    u32 tb_id = RT_TABLE_LOCAL;
    int err;

    if (addr->sin_family != AF_INET) {
        /* Compatibility games : accept AF_UNSPEC (mapped to AF_INET)
         * only if s_addr is INADDR_ANY.
         */
        err = -EAFNOSUPPORT;
        if (addr->sin_family != AF_UNSPEC ||
            addr->sin_addr.s_addr != htonl(INADDR_ANY))
            goto out;
    }

    tb_id = l3mdev_fib_table_by_index(net, sk->sk_bound_dev_if) ? : tb_id;
    chk_addr_ret = inet_addr_type_table(net, addr->sin_addr.s_addr, tb_id);

    /* Not specified by any standard per-se, however it breaks too
     * many applications when removed.  It is unfortunate since
     * allowing applications to make a non-local bind solves
     * several problems with systems using dynamic addressing.
     * (ie. your servers still start up even if your ISDN link
     *  is temporarily down)
     */
    err = -EADDRNOTAVAIL;
    if (!inet_can_nonlocal_bind(net, inet) &&
        addr->sin_addr.s_addr != htonl(INADDR_ANY) &&
        chk_addr_ret != RTN_LOCAL &&
        chk_addr_ret != RTN_MULTICAST &&
        chk_addr_ret != RTN_BROADCAST)
        goto out;

    snum = ntohs(addr->sin_port);
    err = -EACCES;
    if (snum && inet_port_requires_bind_service(net, snum) &&
        !ns_capable(net->user_ns, CAP_NET_BIND_SERVICE))
        goto out;

    /*      We keep a pair of addresses. rcv_saddr is the one
     *      used by hash lookups, and saddr is used for transmit.
     *
     *      In the BSD API these are the same except where it
     *      would be illegal to use them (multicast/broadcast) in
     *      which case the sending device address is used.
     */
    if (with_lock)
        lock_sock(sk);

    /* Check these errors (active socket, double bind). */
    err = -EINVAL;
    if (sk->sk_state != TCP_CLOSE || inet->inet_num)
        goto out_release_sock;

    inet->inet_rcv_saddr = inet->inet_saddr = addr->sin_addr.s_addr;
    if (chk_addr_ret == RTN_MULTICAST || chk_addr_ret == RTN_BROADCAST)
        inet->inet_saddr = 0;  /* Use device */

    /* Make sure we are allowed to bind here. */
    if (snum || !(inet->bind_address_no_port ||
              force_bind_address_no_port)) {
        if (sk->sk_prot->get_port(sk, snum)) {
            inet->inet_saddr = inet->inet_rcv_saddr = 0;
            err = -EADDRINUSE;
            goto out_release_sock;
        }
        err = BPF_CGROUP_RUN_PROG_INET4_POST_BIND(sk);
        if (err) {
            inet->inet_saddr = inet->inet_rcv_saddr = 0;
            goto out_release_sock;
        }
    }

    if (inet->inet_rcv_saddr)
        sk->sk_userlocks |= SOCK_BINDADDR_LOCK;
    if (snum)
        sk->sk_userlocks |= SOCK_BINDPORT_LOCK;
    inet->inet_sport = htons(inet->inet_num);
    inet->inet_daddr = 0;
    inet->inet_dport = 0;
    sk_dst_reset(sk);
    err = 0;
out_release_sock:
    if (with_lock)
        release_sock(sk);
out:
    return err;
}

#include <sys/types.h>          /* See NOTES */
#include <sys/socket.h>
int connect(int sockfd, const struct sockaddr *addr, socklen_t addrlen);

SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
        int, addrlen)
{
    return __sys_connect(fd, uservaddr, addrlen);
}
int __sys_connect(int fd, struct sockaddr __user *uservaddr, int addrlen)
{
    int ret = -EBADF; // 初始化返回值为 -EBADF，表示文件描述符无效
    struct fd f;

    // 获取文件描述符 fd 对应的文件结构
    f = fdget(fd);
    if (f.file) { // 如果文件结构存在
        struct sockaddr_storage address;

        // 将用户空间的地址 uservaddr 复制到内核空间的 address 变量中
        ret = move_addr_to_kernel(uservaddr, addrlen, &address);
        if (!ret) // 如果地址复制成功
            // 调用内部函数 __sys_connect_file 执行连接操作
            ret = __sys_connect_file(f.file, &address, addrlen, 0);

        // 如果 f.flags 不为 0，释放文件结构的引用
        if (f.flags)
            fput(f.file);
    }

    return ret; // 返回操作的结果
}
int __sys_connect_file(struct file *file, struct sockaddr_storage *address,
                       int addrlen, int file_flags)
{
    struct socket *sock;
    int err;

    // 从文件结构中获取 socket 结构
    sock = sock_from_file(file, &err);
    if (!sock) // 如果获取失败
        goto out; // 跳转到 out 标签，返回错误码

    // 执行安全性检查，确保连接操作被允许
    err = security_socket_connect(sock, (struct sockaddr *)address, addrlen);
    if (err) // 如果安全检查失败
        goto out; // 跳转到 out 标签，返回错误码

    // 调用 socket 操作的 connect 方法执行连接操作
    err = sock->ops->connect(sock, (struct sockaddr *)address, addrlen,
                             sock->file->f_flags | file_flags);
out:
    return err; // 返回操作的结果
}

int inet_dgram_connect(struct socket *sock, struct sockaddr *uaddr,
               int addr_len, int flags)
{
    struct sock *sk = sock->sk;
    int err;

    if (addr_len < sizeof(uaddr->sa_family))
        return -EINVAL;
    if (uaddr->sa_family == AF_UNSPEC)
        return sk->sk_prot->disconnect(sk, flags);

    if (BPF_CGROUP_PRE_CONNECT_ENABLED(sk)) {
        err = sk->sk_prot->pre_connect(sk, uaddr, addr_len);
        if (err)
            return err;
    }

    if (!inet_sk(sk)->inet_num && inet_autobind(sk))
        return -EAGAIN;
    return sk->sk_prot->connect(sk, uaddr, addr_len);
}
EXPORT_SYMBOL(inet_dgram_connect);
int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
{
    int res;

    lock_sock(sk);
    res = __ip4_datagram_connect(sk, uaddr, addr_len);
    release_sock(sk);
    return res;
}
EXPORT_SYMBOL(ip4_datagram_connect);
int __ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
{
    struct inet_sock *inet = inet_sk(sk);
    struct sockaddr_in *usin = (struct sockaddr_in *) uaddr;
    struct flowi4 *fl4;
    struct rtable *rt;
    __be32 saddr;
    int oif;
    int err;

    // 检查地址长度是否足够
    if (addr_len < sizeof(*usin))
        return -EINVAL;

    // 检查地址族是否为 AF_INET
    if (usin->sin_family != AF_INET)
        return -EAFNOSUPPORT;

    // 重置套接字的路由缓存
    sk_dst_reset(sk);

    // 获取绑定的设备接口索引和源地址
    oif = sk->sk_bound_dev_if;
    saddr = inet->inet_saddr;

    // 处理多播地址的情况
    if (ipv4_is_multicast(usin->sin_addr.s_addr)) {
        if (!oif || netif_index_is_l3_master(sock_net(sk), oif))
            oif = inet->mc_index;
        if (!saddr)
            saddr = inet->mc_addr;
    }

    // 设置流信息
    fl4 = &inet->cork.fl.u.ip4;

    // 查找路由
    rt = ip_route_connect(fl4, usin->sin_addr.s_addr, saddr,
                          RT_CONN_FLAGS(sk), oif,
                          sk->sk_protocol,
                          inet->inet_sport, usin->sin_port, sk);
    if (IS_ERR(rt)) {
        err = PTR_ERR(rt);
        if (err == -ENETUNREACH)
            IP_INC_STATS(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);
        goto out;
    }

    // 检查是否为广播地址且套接字不允许广播
    if ((rt->rt_flags & RTCF_BROADCAST) && !sock_flag(sk, SOCK_BROADCAST)) {
        ip_rt_put(rt);
        err = -EACCES;
        goto out;
    }

    // 更新源地址
    if (!inet->inet_saddr)
        inet->inet_saddr = fl4->saddr;

    // 更新接收源地址
    if (!inet->inet_rcv_saddr) {
        inet->inet_rcv_saddr = fl4->saddr;
        if (sk->sk_prot->rehash)
            sk->sk_prot->rehash(sk);
    }

    // 设置目标地址和端口
    inet->inet_daddr = fl4->daddr;
    inet->inet_dport = usin->sin_port;

    // 更新重用端口状态
    reuseport_has_conns(sk, true);

    // 设置套接字状态为已连接
    sk->sk_state = TCP_ESTABLISHED;

    // 设置传输哈希
    sk_set_txhash(sk);

    // 随机生成 IP 标识符
    inet->inet_id = prandom_u32();

    // 设置套接字的路由缓存
    sk_dst_set(sk, &rt->dst);

    err = 0;
out:
    return err;
}
EXPORT_SYMBOL(__ip4_datagram_connect);

int inet_stream_connect(struct socket *sock, struct sockaddr *uaddr,
            int addr_len, int flags)
{
    int err;

    lock_sock(sock->sk);
    err = __inet_stream_connect(sock, uaddr, addr_len, flags, 0);
    release_sock(sock->sk);
    return err;
}
int __inet_stream_connect(struct socket *sock, struct sockaddr *uaddr,
                          int addr_len, int flags, int is_sendmsg)
{
    struct sock *sk = sock->sk;
    int err;
    long timeo;

    // 检查地址参数的有效性
    if (uaddr) {
        if (addr_len < sizeof(uaddr->sa_family))
            return -EINVAL;

        // 如果地址族是 AF_UNSPEC，断开连接
        if (uaddr->sa_family == AF_UNSPEC) {
            err = sk->sk_prot->disconnect(sk, flags);
            sock->state = err ? SS_DISCONNECTING : SS_UNCONNECTED;
            goto out;
        }
    }

    // 根据套接字的当前状态进行处理
    switch (sock->state) {
    default:
        err = -EINVAL;
        goto out;
    case SS_CONNECTED:
        err = -EISCONN;
        goto out;
    case SS_CONNECTING:
        if (inet_sk(sk)->defer_connect)
            err = is_sendmsg ? -EINPROGRESS : -EISCONN;
        else
            err = -EALREADY;
        break;
    case SS_UNCONNECTED:
        err = -EISCONN;
        if (sk->sk_state != TCP_CLOSE)
            goto out;

        // 如果启用了 BPF 预连接钩子，调用预连接处理函数
        if (BPF_CGROUP_PRE_CONNECT_ENABLED(sk)) {
            err = sk->sk_prot->pre_connect(sk, uaddr, addr_len);
            if (err)
                goto out;
        }

        // 尝试连接
        err = sk->sk_prot->connect(sk, uaddr, addr_len);
        if (err < 0)
            goto out;

        sock->state = SS_CONNECTING;

        if (!err && inet_sk(sk)->defer_connect)
            goto out;

        err = -EINPROGRESS;
        break;
    }

    // 获取发送超时时间
    timeo = sock_sndtimeo(sk, flags & O_NONBLOCK);

    // 如果套接字处于 SYN_SENT 或 SYN_RECV 状态，等待连接完成
    if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) {
        int writebias = (sk->sk_protocol == IPPROTO_TCP) &&
                        tcp_sk(sk)->fastopen_req &&
                        tcp_sk(sk)->fastopen_req->data ? 1 : 0;

        if (!timeo || !inet_wait_for_connect(sk, timeo, writebias))
            goto out;

        err = sock_intr_errno(timeo);
        if (signal_pending(current))
            goto out;
    }

    // 检查连接是否被关闭
    if (sk->sk_state == TCP_CLOSE)
        goto sock_error;

    // 设置套接字状态为已连接
    sock->state = SS_CONNECTED;
    err = 0;
out:
    return err;

sock_error:
    err = sock_error(sk) ? : -ECONNABORTED;
    sock->state = SS_UNCONNECTED;
    if (sk->sk_prot->disconnect(sk, flags))
        sock->state = SS_DISCONNECTING;
    goto out;
}

int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
{
    struct sockaddr_in *usin = (struct sockaddr_in *)uaddr;
    struct inet_sock *inet = inet_sk(sk);
    struct tcp_sock *tp = tcp_sk(sk);
    __be16 orig_sport, orig_dport;
    __be32 daddr, nexthop;
    struct flowi4 *fl4;
    struct rtable *rt;
    int err;
    struct ip_options_rcu *inet_opt;
    struct inet_timewait_death_row *tcp_death_row = &sock_net(sk)->ipv4.tcp_death_row;

    // 检查地址长度和地址族
    if (addr_len < sizeof(struct sockaddr_in))
        return -EINVAL;

    if (usin->sin_family != AF_INET)
        return -EAFNOSUPPORT;

    // 获取目的地址和下一跳地址
    nexthop = daddr = usin->sin_addr.s_addr;
    inet_opt = rcu_dereference_protected(inet->inet_opt, lockdep_sock_is_held(sk));
    if (inet_opt && inet_opt->opt.srr) {
        if (!daddr)
            return -EINVAL;
        nexthop = inet_opt->opt.faddr;
    }

    // 保存原始的源端口和目的端口
    orig_sport = inet->inet_sport;
    orig_dport = usin->sin_port;
    fl4 = &inet->cork.fl.u.ip4;

    // 查找路由
    rt = ip_route_connect(fl4, nexthop, inet->inet_saddr, RT_CONN_FLAGS(sk), sk->sk_bound_dev_if, IPPROTO_TCP, orig_sport, orig_dport, sk);
    if (IS_ERR(rt)) {
        err = PTR_ERR(rt);
        if (err == -ENETUNREACH)
            IP_INC_STATS(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);
        return err;
    }

    // 检查路由标志
    if (rt->rt_flags & (RTCF_MULTICAST | RTCF_BROADCAST)) {
        ip_rt_put(rt);
        return -ENETUNREACH;
    }

    // 设置目的地址
    if (!inet_opt || !inet_opt->opt.srr)
        daddr = fl4->daddr;

    // 设置源地址
    if (!inet->inet_saddr)
        inet->inet_saddr = fl4->saddr;
    sk_rcv_saddr_set(sk, inet->inet_saddr);

    // 重置 TCP 时间戳选项
    if (tp->rx_opt.ts_recent_stamp && inet->inet_daddr != daddr) {
        tp->rx_opt.ts_recent = 0;
        tp->rx_opt.ts_recent_stamp = 0;
        if (likely(!tp->repair))
            WRITE_ONCE(tp->write_seq, 0);
    }

    // 设置目的端口和地址
    inet->inet_dport = usin->sin_port;
    sk_daddr_set(sk, daddr);

    // 设置扩展头长度
    inet_csk(sk)->icsk_ext_hdr_len = 0;
    if (inet_opt)
        inet_csk(sk)->icsk_ext_hdr_len = inet_opt->opt.optlen;

    // 设置 MSS 限制
    tp->rx_opt.mss_clamp = TCP_MSS_DEFAULT;

    // 设置套接字状态为 SYN_SENT
    tcp_set_state(sk, TCP_SYN_SENT);
    err = inet_hash_connect(tcp_death_row, sk);
    if (err)
        goto failure;

    sk_set_txhash(sk);

    // 更新路由端口
    rt = ip_route_newports(fl4, rt, orig_sport, orig_dport, inet->inet_sport, inet->inet_dport, sk);
    if (IS_ERR(rt)) {
        err = PTR_ERR(rt);
        rt = NULL;
        goto failure;
    }

    // 设置套接字的 GSO 类型和能力
    sk->sk_gso_type = SKB_GSO_TCPV4;
    sk_setup_caps(sk, &rt->dst);
    rt = NULL;

    // 设置 TCP 序列号和时间戳偏移
    if (likely(!tp->repair)) {
        if (!tp->write_seq)
            WRITE_ONCE(tp->write_seq, secure_tcp_seq(inet->inet_saddr, inet->inet_daddr, inet->inet_sport, usin->sin_port));
        tp->tsoffset = secure_tcp_ts_off(sock_net(sk), inet->inet_saddr, inet->inet_daddr);
    }

    // 设置 IP 标识符
    inet->inet_id = prandom_u32();

    // 处理 TCP 快速打开
    if (tcp_fastopen_defer_connect(sk, &err))
        return err;
    if (err)
        goto failure;

    // 发起 TCP 连接
    err = tcp_connect(sk);
    if (err)
        goto failure;

    return 0;

failure:
    // 处理失败情况，重置套接字状态
    tcp_set_state(sk, TCP_CLOSE);
    ip_rt_put(rt);
    sk->sk_route_caps = 0;
    inet->inet_dport = 0;
    return err;
}

int tcp_connect(struct sock *sk)
{
    struct tcp_sock *tp = tcp_sk(sk);
    struct sk_buff *buff;
    int err;

    // 调用 BPF 钩子函数，用于 TCP 连接的回调
    tcp_call_bpf(sk, BPF_SOCK_OPS_TCP_CONNECT_CB, 0, NULL);

    // 重建 IP 头部，如果失败则返回错误
    if (inet_csk(sk)->icsk_af_ops->rebuild_header(sk))
        return -EHOSTUNREACH; // 路由失败或类似问题

    // 初始化 TCP 连接参数
    tcp_connect_init(sk);

    // 如果处于 TCP 修复模式，直接完成连接
    if (unlikely(tp->repair)) {
        tcp_finish_connect(sk, NULL);
        return 0;
    }

    // 分配一个新的 sk_buff 用于发送 SYN 包
    buff = sk_stream_alloc_skb(sk, 0, sk->sk_allocation, true);
    if (unlikely(!buff))
        return -ENOBUFS; // 缓冲区不足

    // 初始化非数据包的 SKB，设置 SYN 标志
    tcp_init_nondata_skb(buff, tp->write_seq++, TCPHDR_SYN);
    tcp_mstamp_refresh(tp);
    tp->retrans_stamp = tcp_time_stamp(tp);

    // 将 SKB 加入发送队列
    tcp_connect_queue_skb(sk, buff);
    tcp_ecn_send_syn(sk, buff);
    tcp_rbtree_insert(&sk->tcp_rtx_queue, buff);

    // 发送 SYN 包，如果启用了快速打开则包括数据
    err = tp->fastopen_req ? tcp_send_syn_data(sk, buff) :
          tcp_transmit_skb(sk, buff, 1, sk->sk_allocation);
    if (err == -ECONNREFUSED)
        return err;

    // 更新发送序列号
    WRITE_ONCE(tp->snd_nxt, tp->write_seq);
    tp->pushed_seq = tp->write_seq;
    buff = tcp_send_head(sk);
    if (unlikely(buff)) {
        WRITE_ONCE(tp->snd_nxt, TCP_SKB_CB(buff)->seq);
        tp->pushed_seq = TCP_SKB_CB(buff)->seq;
    }

    // 增加活动打开连接的统计计数
    TCP_INC_STATS(sock_net(sk), TCP_MIB_ACTIVEOPENS);

    // 设置重传定时器以重复发送 SYN 直到收到响应
    inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
                              inet_csk(sk)->icsk_rto, TCP_RTO_MAX);
    return 0;
}

#include <sys/types.h>          /* See NOTES */
#include <sys/socket.h>
int listen(int sockfd, int backlog);

SYSCALL_DEFINE2(listen, int, fd, int, backlog)
{
    return __sys_listen(fd, backlog);
}
int __sys_listen(int fd, int backlog)
{
    struct socket *sock;
    int err, fput_needed;
    int somaxconn;

    sock = sockfd_lookup_light(fd, &err, &fput_needed);
    if (sock) {
        somaxconn = sock_net(sock->sk)->core.sysctl_somaxconn;
        if ((unsigned int)backlog > somaxconn)
            backlog = somaxconn;

        err = security_socket_listen(sock, backlog);
        if (!err)
            err = sock->ops->listen(sock, backlog);

        fput_light(sock->file, fput_needed);
    }
    return err;
}

int inet_listen(struct socket *sock, int backlog)
{
    struct sock *sk = sock->sk;
    unsigned char old_state;
    int err, tcp_fastopen;

    // 获取套接字的锁，以确保对套接字状态的修改是线程安全的
    lock_sock(sk);

    // 初始化错误码为无效参数
    err = -EINVAL;
    // 检查套接字状态是否为未连接，且类型是否为流式套接字
    if (sock->state != SS_UNCONNECTED || sock->type != SOCK_STREAM)
        goto out;

    // 获取当前套接字的状态
    old_state = sk->sk_state;
    // 检查套接字状态是否为关闭或监听状态
    if (!((1 << old_state) & (TCPF_CLOSE | TCPF_LISTEN)))
        goto out;

    // 设置最大确认的积压队列长度
    WRITE_ONCE(sk->sk_max_ack_backlog, backlog);

    // 如果套接字已经处于监听状态，只允许调整积压队列长度
    if (old_state != TCP_LISTEN) {
        // 启用 TCP 快速打开（TFO），无需显式设置 TCP_FASTOPEN 套接字选项
        tcp_fastopen = sock_net(sk)->ipv4.sysctl_tcp_fastopen;
        if ((tcp_fastopen & TFO_SERVER_WO_SOCKOPT1) &&
            (tcp_fastopen & TFO_SERVER_ENABLE) &&
            !inet_csk(sk)->icsk_accept_queue.fastopenq.max_qlen) {
            fastopen_queue_tune(sk, backlog);
            tcp_fastopen_init_key_once(sock_net(sk));
        }

        // 启动监听
        err = inet_csk_listen_start(sk, backlog);
        if (err)
            goto out;

        // 调用 BPF 钩子函数，用于 TCP 监听的回调
        tcp_call_bpf(sk, BPF_SOCK_OPS_TCP_LISTEN_CB, 0, NULL);
    }
    // 成功设置监听状态
    err = 0;

out:
    // 释放套接字的锁
    release_sock(sk);
    return err;
}

int inet_csk_listen_start(struct sock *sk, int backlog)
{
    struct inet_connection_sock *icsk = inet_csk(sk);
    struct inet_sock *inet = inet_sk(sk);
    int err = -EADDRINUSE;

    // 为接受队列分配资源
    reqsk_queue_alloc(&icsk->icsk_accept_queue);

    // 初始化确认积压队列长度和延迟确认
    sk->sk_ack_backlog = 0;
    inet_csk_delack_init(sk);

    /* 这里存在一个竞争窗口：我们宣布自己正在监听，
     * 但此转换尚未通过 get_port() 验证。
     * 这是可以的，因为只有在验证完成后，该套接字才会进入哈希表。
     */
    inet_sk_state_store(sk, TCP_LISTEN);

    // 尝试获取端口号
    if (!sk->sk_prot->get_port(sk, inet->inet_num)) {
        // 设置套接字的源端口
        inet->inet_sport = htons(inet->inet_num);

        // 重置套接字的路由缓存
        sk_dst_reset(sk);

        // 将套接字插入到协议的哈希表中
        err = sk->sk_prot->hash(sk);

        // 如果成功插入哈希表，返回 0 表示成功
        if (likely(!err))
            return 0;
    }

    // 如果失败，将套接字状态设置为关闭
    inet_sk_set_state(sk, TCP_CLOSE);
    return err;
}

#include <sys/types.h>          /* See NOTES */
#include <sys/socket.h>
int accept(int sockfd, struct sockaddr *addr, socklen_t *addrlen);
int accept4(int sockfd, struct sockaddr *addr, socklen_t *addrlen, int flags);

SYSCALL_DEFINE3(accept, int, fd, struct sockaddr __user *, upeer_sockaddr,
        int __user *, upeer_addrlen)
{
    return __sys_accept4(fd, upeer_sockaddr, upeer_addrlen, 0);
}
SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
        int __user *, upeer_addrlen, int, flags)
{
    return __sys_accept4(fd, upeer_sockaddr, upeer_addrlen, flags);
}
int __sys_accept4(int fd, struct sockaddr __user *upeer_sockaddr,
          int __user *upeer_addrlen, int flags)
{
    int ret = -EBADF;
    struct fd f;

    f = fdget(fd);
    if (f.file) {
        ret = __sys_accept4_file(f.file, 0, upeer_sockaddr,
                        upeer_addrlen, flags,
                        rlimit(RLIMIT_NOFILE));
        if (f.flags)
            fput(f.file);
    }

    return ret;
}
int __sys_accept4_file(struct file *file, unsigned file_flags,
               struct sockaddr __user *upeer_sockaddr,
               int __user *upeer_addrlen, int flags,
               unsigned long nofile)
{
    struct socket *sock, *newsock;
    struct file *newfile;
    int err, len, newfd;
    struct sockaddr_storage address;

    // 检查 flags 是否只包含 SOCK_CLOEXEC 和 SOCK_NONBLOCK
    if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
        return -EINVAL;

    // 如果 SOCK_NONBLOCK 不等于 O_NONBLOCK 并且 flags 包含 SOCK_NONBLOCK，则替换为 O_NONBLOCK
    if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
        flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;

    // 从文件结构中获取 socket
    sock = sock_from_file(file, &err);
    if (!sock)
        goto out;

    // 分配新的 socket 结构
    err = -ENFILE;
    newsock = sock_alloc();
    if (!newsock)
        goto out;

    // 复制套接字类型和操作
    newsock->type = sock->type;
    newsock->ops = sock->ops;

    /*
     * 不需要在这里调用 try_module_get，因为监听套接字 (sock)
     * 已经持有协议模块 (sock->ops->owner)。
     */
    __module_get(newsock->ops->owner);

    // 获取一个未使用的文件描述符
    newfd = __get_unused_fd_flags(flags, nofile);
    if (unlikely(newfd < 0)) {
        err = newfd;
        sock_release(newsock);
        goto out;
    }

    // 为新 socket 分配文件结构
    newfile = sock_alloc_file(newsock, flags, sock->sk->sk_prot_creator->name);
    if (IS_ERR(newfile)) {
        err = PTR_ERR(newfile);
        put_unused_fd(newfd);
        goto out;
    }

    // 安全检查
    err = security_socket_accept(sock, newsock);
    if (err)
        goto out_fd;

    // 调用协议的 accept 方法
    err = sock->ops->accept(sock, newsock, sock->file->f_flags | file_flags, false);
    if (err < 0)
        goto out_fd;

    // 如果用户提供了对等地址缓冲区，则获取对等地址
    if (upeer_sockaddr) {
        len = newsock->ops->getname(newsock, (struct sockaddr *)&address, 2);
        if (len < 0) {
            err = -ECONNABORTED;
            goto out_fd;
        }
        err = move_addr_to_user(&address, len, upeer_sockaddr, upeer_addrlen);
        if (err < 0)
            goto out_fd;
    }

    /* 文件标志不会通过 accept() 继承，和其他操作系统不同。 */

    // 安装新的文件描述符
    fd_install(newfd, newfile);
    err = newfd;
out:
    return err;
out_fd:
    fput(newfile);
    put_unused_fd(newfd);
    goto out;
}

int inet_accept(struct socket *sock, struct socket *newsock, int flags,
        bool kern)
{
    struct sock *sk1 = sock->sk;
    int err = -EINVAL;
    struct sock *sk2 = sk1->sk_prot->accept(sk1, flags, &err, kern);

    if (!sk2)
        goto do_err;

    lock_sock(sk2);

    sock_rps_record_flow(sk2);
    WARN_ON(!((1 << sk2->sk_state) &
          (TCPF_ESTABLISHED | TCPF_SYN_RECV |
          TCPF_CLOSE_WAIT | TCPF_CLOSE)));

    sock_graft(sk2, newsock);

    newsock->state = SS_CONNECTED;
    err = 0;
    release_sock(sk2);
do_err:
    return err;
}

struct sock *inet_csk_accept(struct sock *sk, int flags, int *err, bool kern)
{
    struct inet_connection_sock *icsk = inet_csk(sk);
    struct request_sock_queue *queue = &icsk->icsk_accept_queue;
    struct request_sock *req;
    struct sock *newsk;
    int error;

    lock_sock(sk);

    /* 确保套接字处于监听状态，并且有挂起的连接请求 */
    error = -EINVAL;
    if (sk->sk_state != TCP_LISTEN)
        goto out_err;

    /* 查找已建立的连接 */
    if (reqsk_queue_empty(queue)) {
        long timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);

        /* 如果是非阻塞套接字，则不等待 */
        error = -EAGAIN;
        if (!timeo)
            goto out_err;

        error = inet_csk_wait_for_connect(sk, timeo);
        if (error)
            goto out_err;
    }

    // 从请求队列中移除一个请求
    req = reqsk_queue_remove(queue, sk);
    newsk = req->sk;

    // 处理 TCP Fast Open 的情况
    if (sk->sk_protocol == IPPROTO_TCP &&
        tcp_rsk(req)->tfo_listener) {
        spin_lock_bh(&queue->fastopenq.lock);
        if (tcp_rsk(req)->tfo_listener) {
            /* 我们仍在等待 3WHS 的最终 ACK，因此现在不能释放 req。
             * 相反，我们将 req->sk 设置为 NULL，以表示子套接字已被获取，
             * 因此当 3WHS 完成（或中止）时，reqsk_fastopen_remove() 将释放 req。
             */
            req->sk = NULL;
            req = NULL;
        }
        spin_unlock_bh(&queue->fastopenq.lock);
    }

out:
    release_sock(sk);
    if (newsk && mem_cgroup_sockets_enabled) {
        int amt;

        /* 原子地获取内存使用情况，设置并收费 newsk->sk_memcg。 */
        lock_sock(newsk);

        /* 套接字尚未被接受，因此无需查看 newsk->sk_wmem_queued。 */
        amt = sk_mem_pages(newsk->sk_forward_alloc +
                           atomic_read(&newsk->sk_rmem_alloc));
        mem_cgroup_sk_alloc(newsk);
        if (newsk->sk_memcg && amt)
            mem_cgroup_charge_skmem(newsk->sk_memcg, amt);

        release_sock(newsk);
    }
    if (req)
        reqsk_put(req);
    return newsk;

out_err:
    newsk = NULL;
    req = NULL;
    *err = error;
    goto out;
}

#include <sys/types.h>
#include <sys/socket.h>
ssize_t send(int sockfd, const void *buf, size_t len, int flags);
ssize_t sendto(int sockfd, const void *buf, size_t len, int flags,
            const struct sockaddr *dest_addr, socklen_t addrlen);
ssize_t sendmsg(int sockfd, const struct msghdr *msg, int flags);

SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
        unsigned int, flags, struct sockaddr __user *, addr,
        int, addr_len)
{
    return __sys_sendto(fd, buff, len, flags, addr, addr_len);
}
SYSCALL_DEFINE4(send, int, fd, void __user *, buff, size_t, len,
        unsigned int, flags)
{
    return __sys_sendto(fd, buff, len, flags, NULL, 0);
}
int __sys_sendto(int fd, void __user *buff, size_t len, unsigned int flags,
         struct sockaddr __user *addr,  int addr_len)
{
    struct socket *sock;
    struct sockaddr_storage address;
    int err;
    struct msghdr msg;
    struct iovec iov;
    int fput_needed;

    // 将用户空间的缓冲区导入到内核空间的 iovec 结构中
    err = import_single_range(WRITE, buff, len, &iov, &msg.msg_iter);
    if (unlikely(err))
        return err;

    // 查找文件描述符对应的 socket
    sock = sockfd_lookup_light(fd, &err, &fput_needed);
    if (!sock)
        goto out;

    // 初始化消息头结构
    msg.msg_name = NULL;
    msg.msg_control = NULL;
    msg.msg_controllen = 0;
    msg.msg_namelen = 0;

    // 如果提供了地址，则将地址从用户空间移动到内核空间
    if (addr) {
        err = move_addr_to_kernel(addr, addr_len, &address);
        if (err < 0)
            goto out_put;
        msg.msg_name = (struct sockaddr *)&address;
        msg.msg_namelen = addr_len;
    }

    // 如果 socket 是非阻塞的，则设置 MSG_DONTWAIT 标志
    if (sock->file->f_flags & O_NONBLOCK)
        flags |= MSG_DONTWAIT;
    msg.msg_flags = flags;

    // 发送消息
    err = sock_sendmsg(sock, &msg);

out_put:
    // 释放 socket 引用
    fput_light(sock->file, fput_needed);
out:
    return err;
}

SYSCALL_DEFINE3(sendmsg, int, fd, struct user_msghdr __user *, msg, unsigned int, flags)
{
    return __sys_sendmsg(fd, msg, flags, true);
}
long __sys_sendmsg(int fd, struct user_msghdr __user *msg, unsigned int flags,
           bool forbid_cmsg_compat)
{
    int fput_needed, err;
    struct msghdr msg_sys;
    struct socket *sock;

    if (forbid_cmsg_compat && (flags & MSG_CMSG_COMPAT))
        return -EINVAL;

    sock = sockfd_lookup_light(fd, &err, &fput_needed);
    if (!sock)
        goto out;

    err = ___sys_sendmsg(sock, msg, &msg_sys, flags, NULL, 0);

    fput_light(sock->file, fput_needed);
out:
    return err;
}
static int ____sys_sendmsg(struct socket *sock, struct msghdr *msg_sys,
               unsigned int flags, struct used_address *used_address,
               unsigned int allowed_msghdr_flags)
{
    unsigned char ctl[sizeof(struct cmsghdr) + 20]
                __aligned(sizeof(__kernel_size_t));
    /* 20 is size of ipv6_pktinfo */
    unsigned char *ctl_buf = ctl;
    int ctl_len;
    ssize_t err;

    err = -ENOBUFS;

    if (msg_sys->msg_controllen > INT_MAX)
        goto out;
    flags |= (msg_sys->msg_flags & allowed_msghdr_flags);
    ctl_len = msg_sys->msg_controllen;
    if ((MSG_CMSG_COMPAT & flags) && ctl_len) {
        err =
            cmsghdr_from_user_compat_to_kern(msg_sys, sock->sk, ctl,
                             sizeof(ctl));
        if (err)
            goto out;
        ctl_buf = msg_sys->msg_control;
        ctl_len = msg_sys->msg_controllen;
    } else if (ctl_len) {
        BUILD_BUG_ON(sizeof(struct cmsghdr) !=
                 CMSG_ALIGN(sizeof(struct cmsghdr)));
        if (ctl_len > sizeof(ctl)) {
            ctl_buf = sock_kmalloc(sock->sk, ctl_len, GFP_KERNEL);
            if (ctl_buf == NULL)
                goto out;
        }
        err = -EFAULT;
        /*
         * Careful! Before this, msg_sys->msg_control contains a user pointer.
         * Afterwards, it will be a kernel pointer. Thus the compiler-assisted
         * checking falls down on this.
         */
        if (copy_from_user(ctl_buf,
                   (void __user __force *)msg_sys->msg_control,
                   ctl_len))
            goto out_freectl;
        msg_sys->msg_control = ctl_buf;
    }
    msg_sys->msg_flags = flags;

    if (sock->file->f_flags & O_NONBLOCK)
        msg_sys->msg_flags |= MSG_DONTWAIT;
    /*
     * If this is sendmmsg() and current destination address is same as
     * previously succeeded address, omit asking LSM's decision.
     * used_address->name_len is initialized to UINT_MAX so that the first
     * destination address never matches.
     */
    if (used_address && msg_sys->msg_name &&
        used_address->name_len == msg_sys->msg_namelen &&
        !memcmp(&used_address->name, msg_sys->msg_name,
            used_address->name_len)) {
        err = sock_sendmsg_nosec(sock, msg_sys);
        goto out_freectl;
    }
    err = sock_sendmsg(sock, msg_sys);
    /*
     * If this is sendmmsg() and sending to current destination address was
     * successful, remember it.
     */
    if (used_address && err >= 0) {
        used_address->name_len = msg_sys->msg_namelen;
        if (msg_sys->msg_name)
            memcpy(&used_address->name, msg_sys->msg_name,
                   used_address->name_len);
    }

out_freectl:
    if (ctl_buf != ctl)
        sock_kfree_s(sock->sk, ctl_buf, ctl_len);
out:
    return err;
}