TCP层close系统调用的实现分析

在调用close系统调用关闭套接字时，如果套接字引用计数已经归零，则需继续向上层调用其close实现，tcp为tcp_close；本文仅介绍tcp部分，前置部分请参考本博关于close系统调用的文章；

 void tcp_close(struct sock *sk, long timeout)
 {
     struct sk_buff *skb;
     int data_was_unread = ;
     int state;

     lock_sock(sk);
     sk->sk_shutdown = SHUTDOWN_MASK;

     /* LISTEN状态处理 */
     if (sk->sk_state == TCP_LISTEN) {
         /* 设置close状态 */
         tcp_set_state(sk, TCP_CLOSE);

         /* Special case. */
         /* 清理完成连接队列 */
         inet_csk_listen_stop(sk);

         goto adjudge_to_death;
     }

     /*  We need to flush the recv. buffs.  We do this only on the
      *  descriptor close, not protocol-sourced closes, because the
      *  reader process may not have drained the data yet!
      */
     /* 删除接收队列中用户进程未读取的skb */
     while ((skb = __skb_dequeue(&sk->sk_receive_queue)) != NULL) {
         u32 len = TCP_SKB_CB(skb)->end_seq - TCP_SKB_CB(skb)->seq;

         /* 减去fin的一个序号长度 */
         if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
             len--;
         data_was_unread += len;
         __kfree_skb(skb);
     }

     sk_mem_reclaim(sk);

     /* If socket has been already reset (e.g. in tcp_reset()) - kill it. */
     /* CLOSE状态 */
     if (sk->sk_state == TCP_CLOSE)
         goto adjudge_to_death;

     /* As outlined in RFC 2525, section 2.17, we send a RST here because
      * data was lost. To witness the awful effects of the old behavior of
      * always doing a FIN, run an older 2.1.x kernel or 2.0.x, start a bulk
      * GET in an FTP client, suspend the process, wait for the client to
      * advertise a zero window, then kill -9 the FTP client, wheee...
      * Note: timeout is always zero in such a case.
      */
     /* 修复状态，断开连接 */
     if (unlikely(tcp_sk(sk)->repair)) {
         sk->sk_prot->disconnect(sk, );
     }
     /* 用户进程有数据未读 */
     else if (data_was_unread) {
         /* Unread data was tossed, zap the connection. */
         NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPABORTONCLOSE);

         /* 设置为close */
         tcp_set_state(sk, TCP_CLOSE);

         /* 发送rst */
         tcp_send_active_reset(sk, sk->sk_allocation);
     }
     /* lingertime==0，断开连接 */
     else if (sock_flag(sk, SOCK_LINGER) && !sk->sk_lingertime) {
         /* Check zero linger _after_ checking for unread data. */
         sk->sk_prot->disconnect(sk, );
         NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPABORTONDATA);
     }
     /* 关闭状态转移 */
     else if (tcp_close_state(sk)) {
         /* We FIN if the application ate all the data before
          * zapping the connection.
          */

         /* RED-PEN. Formally speaking, we have broken TCP state
          * machine. State transitions:
          *
          * TCP_ESTABLISHED -> TCP_FIN_WAIT1
          * TCP_SYN_RECV    -> TCP_FIN_WAIT1 (forget it, it's impossible)
          * TCP_CLOSE_WAIT -> TCP_LAST_ACK
          *
          * are legal only when FIN has been sent (i.e. in window),
          * rather than queued out of window. Purists blame.
          *
          * F.e. "RFC state" is ESTABLISHED,
          * if Linux state is FIN-WAIT-1, but FIN is still not sent.
          *
          * The visible declinations are that sometimes
          * we enter time-wait state, when it is not required really
          * (harmless), do not send active resets, when they are
          * required by specs (TCP_ESTABLISHED, TCP_CLOSE_WAIT, when
          * they look as CLOSING or LAST_ACK for Linux)
          * Probably, I missed some more holelets.
          *                         --ANK
          * XXX (TFO) - To start off we don't support SYN+ACK+FIN
          * in a single packet! (May consider it later but will
          * probably need API support or TCP_CORK SYN-ACK until
          * data is written and socket is closed.)
          */
         /* 发送fin */
         tcp_send_fin(sk);
     }

     /* 等待关闭，状态为FIN_WAIT_1 CLOSING LAST_ACK或sk_lingertime超时 */
     sk_stream_wait_close(sk, timeout);

 adjudge_to_death:
     state = sk->sk_state;
     sock_hold(sk);

     /* 设置为DEAD状态 */
     sock_orphan(sk);

     /* It is the last release_sock in its life. It will remove backlog. */
     /* 删除控制块的backlog、cb */
     release_sock(sk);

     /* Now socket is owned by kernel and we acquire BH lock
        to finish close. No need to check for user refs.
      */
     local_bh_disable();
     bh_lock_sock(sk);
     WARN_ON(sock_owned_by_user(sk));

     /* 增加孤儿计数 */
     percpu_counter_inc(sk->sk_prot->orphan_count);

     /* Have we already been destroyed by a softirq or backlog? */
     /* 被软中断或者backlog销毁了????? */
     if (state != TCP_CLOSE && sk->sk_state == TCP_CLOSE)
         goto out;

     /*    This is a (useful) BSD violating of the RFC. There is a
      *    problem with TCP as specified in that the other end could
      *    keep a socket open forever with no application left this end.
      *    We use a 1 minute timeout (about the same as BSD) then kill
      *    our end. If they send after that then tough - BUT: long enough
      *    that we won't make the old 4*rto = almost no time - whoops
      *    reset mistake.
      *
      *    Nope, it was not mistake. It is really desired behaviour
      *    f.e. on http servers, when such sockets are useless, but
      *    consume significant resources. Let's do it with special
      *    linger2    option.                    --ANK
      */

     if (sk->sk_state == TCP_FIN_WAIT2) {
         struct tcp_sock *tp = tcp_sk(sk);
         /* linger2小于0，无需等待 */
         if (tp->linger2 < ) {

             /* 转到CLOSE */
             tcp_set_state(sk, TCP_CLOSE);
             /* 发送rst */
             tcp_send_active_reset(sk, GFP_ATOMIC);
             __NET_INC_STATS(sock_net(sk),
                     LINUX_MIB_TCPABORTONLINGER);
         } else {

             /* 获取FIN_WAIT_2超时时间 */
             const int tmo = tcp_fin_time(sk);

             /* FIN_WAIT_2超时时间> timewait时间，加FIN_WAIT_2定时器 */
             if (tmo > TCP_TIMEWAIT_LEN) {
                 inet_csk_reset_keepalive_timer(sk,
                         tmo - TCP_TIMEWAIT_LEN);
             }
             /* 小于TIME_WAIT时间，则进入TIME_WAIT */
             else {
                 tcp_time_wait(sk, TCP_FIN_WAIT2, tmo);
                 goto out;
             }
         }
     }

     /* 未处于CLOSE */
     if (sk->sk_state != TCP_CLOSE) {
         sk_mem_reclaim(sk);

         /* 孤儿数量过多，或者socket内存过多 */
         if (tcp_check_oom(sk, )) {
             /* 进入CLOSE */
             tcp_set_state(sk, TCP_CLOSE);
             /* 发送rst */
             tcp_send_active_reset(sk, GFP_ATOMIC);
             __NET_INC_STATS(sock_net(sk),
                     LINUX_MIB_TCPABORTONMEMORY);
         }
     }

     /* 处于CLOSE */
     if (sk->sk_state == TCP_CLOSE) {
         struct request_sock *req = tcp_sk(sk)->fastopen_rsk;
         /* We could get here with a non-NULL req if the socket is
          * aborted (e.g., closed with unread data) before 3WHS
          * finishes.
          */
         if (req)
             reqsk_fastopen_remove(sk, req, false);

         /* 销毁控制块 */
         inet_csk_destroy_sock(sk);
     }
     /* Otherwise, socket is reprieved until protocol close. */

 out:
     bh_unlock_sock(sk);
     local_bh_enable();
     sock_put(sk);
 }