1:  /* 在SYN_SENT状态下处理接收到的段，但是不处理带外数据 */
  2:  static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
  3:                     struct tcphdr *th, unsigned len)
  4:  {
  5:    struct tcp_sock *tp = tcp_sk(sk);
  6:    int saved_clamp = tp->rx_opt.mss_clamp;
  7:  
  8:    /* 解析TCP选项并保存到传输控制块中 */
  9:    tcp_parse_options(skb, &tp->rx_opt, 0);
 10:  
 11:    if (th->ack) {/* 处理ACK标志 */
 12:        /* rfc793:
 13:         * "If the state is SYN-SENT then
 14:         *    first check the ACK bit
 15:         *      If the ACK bit is set
 16:         *    If SEG.ACK =< ISS, or SEG.ACK > SND.NXT, send
 17:         *        a reset (unless the RST bit is set, if so drop
 18:         *        the segment and return)"
 19:         *
 20:         *  We do not send data with SYN, so that RFC-correct
 21:         *  test reduces to:
 22:         */
 23:        if (TCP_SKB_CB(skb)->ack_seq != tp->snd_nxt)
 24:            goto reset_and_undo;
 25:  
 26:        if (tp->rx_opt.saw_tstamp && tp->rx_opt.rcv_tsecr &&
 27:            !between(tp->rx_opt.rcv_tsecr, tp->retrans_stamp,
 28:                 tcp_time_stamp)) {
 29:            NET_INC_STATS_BH(LINUX_MIB_PAWSACTIVEREJECTED);
 30:            goto reset_and_undo;
 31:        }
 32:  
 33:        /* Now ACK is acceptable.
 34:         *
 35:         * "If the RST bit is set
 36:         *    If the ACK was acceptable then signal the user "error:
 37:         *    connection reset", drop the segment, enter CLOSED state,
 38:         *    delete TCB, and return."
 39:         */
 40:  
 41:        if (th->rst) {/* 收到ACK+RST段，需要tcp_reset设置错误码，并关闭套接口 */
 42:            tcp_reset(sk);
 43:            goto discard;
 44:        }
 45:  
 46:        /* rfc793:
 47:         *   "fifth, if neither of the SYN or RST bits is set then
 48:         *    drop the segment and return."
 49:         *
 50:         *    See note below!
 51:         *                                        --ANK(990513)
 52:         */
 53:        if (!th->syn)/* 在SYN_SENT状态下接收到的段必须存在SYN标志，否则说明接收到的段无效，丢弃该段 */
 54:            goto discard_and_undo;
 55:  
 56:        /* rfc793:
 57:         *   "If the SYN bit is on ...
 58:         *    are acceptable then ...
 59:         *    (our SYN has been ACKed), change the connection
 60:         *    state to ESTABLISHED..."
 61:         */
 62:  
 63:        /* 从首部标志中获取显示拥塞通知的特性 */
 64:        TCP_ECN_rcv_synack(tp, th);
 65:        if (tp->ecn_flags&TCP_ECN_OK)/* 如果支持ECN，则设置标志 */
 66:            sk->sk_no_largesend = 1;
 67:  
 68:        /* 设置与窗口相关的成员变量 */
 69:        tp->snd_wl1 = TCP_SKB_CB(skb)->seq;
 70:        tcp_ack(sk, skb, FLAG_SLOWPATH);
 71:  
 72:        /* Ok.. it‘s good. Set up sequence numbers and
 73:         * move to established.
 74:         */
 75:        tp->rcv_nxt = TCP_SKB_CB(skb)->seq + 1;
 76:        tp->rcv_wup = TCP_SKB_CB(skb)->seq + 1;
 77:  
 78:        /* RFC1323: The window in SYN & SYN/ACK segments is
 79:         * never scaled.
 80:         */
 81:        tp->snd_wnd = ntohs(th->window);
 82:        tcp_init_wl(tp, TCP_SKB_CB(skb)->ack_seq, TCP_SKB_CB(skb)->seq);
 83:  
 84:        if (!tp->rx_opt.wscale_ok) {
 85:            tp->rx_opt.snd_wscale = tp->rx_opt.rcv_wscale = 0;
 86:            tp->window_clamp = min(tp->window_clamp, 65535U);
 87:        }
 88:  
 89:        if (tp->rx_opt.saw_tstamp) {/* 根据是否支持时间戳选项来设置传输控制块的相关字段 */
 90:            tp->rx_opt.tstamp_ok       = 1;
 91:            tp->tcp_header_len =
 92:                sizeof(struct tcphdr) + TCPOLEN_TSTAMP_ALIGNED;
 93:            tp->advmss      -= TCPOLEN_TSTAMP_ALIGNED;
 94:            tcp_store_ts_recent(tp);
 95:        } else {
 96:            tp->tcp_header_len = sizeof(struct tcphdr);
 97:        }
 98:  
 99:        /* 初始化PMTU、MSS等成员变量 */
100:        if (tp->rx_opt.sack_ok && sysctl_tcp_fack)
101:            tp->rx_opt.sack_ok |= 2;
102:  
103:        tcp_sync_mss(sk, tp->pmtu_cookie);
104:        tcp_initialize_rcv_mss(sk);
105:  
106:        /* Remember, tcp_poll() does not lock socket!
107:         * Change state from SYN-SENT only after copied_seq
108:         * is initialized. */
109:        tp->copied_seq = tp->rcv_nxt;
110:        mb();
111:        tcp_set_state(sk, TCP_ESTABLISHED);
112:  
113:        /* Make sure socket is routed, for correct metrics.  */
114:        tp->af_specific->rebuild_header(sk);
115:  
116:        tcp_init_metrics(sk);
117:  
118:        /* Prevent spurious tcp_cwnd_restart() on first data
119:         * packet.
120:         */
121:        tp->lsndtime = tcp_time_stamp;
122:  
123:        tcp_init_buffer_space(sk);
124:  
125:        /* 如果启用了连接保活，则启用连接保活定时器 */
126:        if (sock_flag(sk, SOCK_KEEPOPEN))
127:            tcp_reset_keepalive_timer(sk, keepalive_time_when(tp));
128:  
129:        if (!tp->rx_opt.snd_wscale)/* 首部预测 */
130:            __tcp_fast_path_on(tp, tp->snd_wnd);
131:        else
132:            tp->pred_flags = 0;
133:  
134:        if (!sock_flag(sk, SOCK_DEAD)) {/* 如果套口不处于SOCK_DEAD状态，则唤醒等待该套接口的进程 */
135:            sk->sk_state_change(sk);
136:            sk_wake_async(sk, 0, POLL_OUT);
137:        }
138:  
139:        /* 连接建立完成，根据情况进入延时确认模式 */
140:        if (sk->sk_write_pending || tp->defer_accept || tp->ack.pingpong) {
141:            /* Save one ACK. Data will be ready after
142:             * several ticks, if write_pending is set.
143:             *
144:             * It may be deleted, but with this feature tcpdumps
145:             * look so _wonderfully_ clever, that I was not able
146:             * to stand against the temptation 8)     --ANK
147:             */
148:            tcp_schedule_ack(tp);
149:            tp->ack.lrcvtime = tcp_time_stamp;
150:            tp->ack.ato  = TCP_ATO_MIN;
151:            tcp_incr_quickack(tp);
152:            tcp_enter_quickack_mode(tp);
153:            tcp_reset_xmit_timer(sk, TCP_TIME_DACK, TCP_DELACK_MAX);
154:  
155:  discard:
156:            __kfree_skb(skb);
157:            return 0;
158:        } else {/* 不需要延时确认，立即发送ACK段 */
159:            tcp_send_ack(sk);
160:        }
161:        return -1;
162:    }
163:  
164:    /* No ACK in the segment */
165:  
166:    if (th->rst) {/* 收到RST段，则丢弃传输控制块 */
167:        /* rfc793:
168:         * "If the RST bit is set
169:         *
170:         *      Otherwise (no ACK) drop the segment and return."
171:         */
172:  
173:        goto discard_and_undo;
174:    }
175:  
176:    /* PAWS check. */
177:    /* PAWS检测失效，也丢弃传输控制块 */
178:    if (tp->rx_opt.ts_recent_stamp && tp->rx_opt.saw_tstamp && tcp_paws_check(&tp->rx_opt, 0))
179:        goto discard_and_undo;
180:  
181:    /* 在SYN_SENT状态下收到了SYN段并且没有ACK，说明是两端同时打开 */
182:    if (th->syn) {
183:        /* We see SYN without ACK. It is attempt of
184:         * simultaneous connect with crossed SYNs.
185:         * Particularly, it can be connect to self.
186:         */
187:        tcp_set_state(sk, TCP_SYN_RECV);/* 设置状态为TCP_SYN_RECV */
188:  
189:        if (tp->rx_opt.saw_tstamp) {/* 设置时间戳相关的字段 */
190:            tp->rx_opt.tstamp_ok = 1;
191:            tcp_store_ts_recent(tp);
192:            tp->tcp_header_len =
193:                sizeof(struct tcphdr) + TCPOLEN_TSTAMP_ALIGNED;
194:        } else {
195:            tp->tcp_header_len = sizeof(struct tcphdr);
196:        }
197:  
198:        /* 初始化窗口相关的成员变量 */
199:        tp->rcv_nxt = TCP_SKB_CB(skb)->seq + 1;
200:        tp->rcv_wup = TCP_SKB_CB(skb)->seq + 1;
201:  
202:        /* RFC1323: The window in SYN & SYN/ACK segments is
203:         * never scaled.
204:         */
205:        tp->snd_wnd    = ntohs(th->window);
206:        tp->snd_wl1    = TCP_SKB_CB(skb)->seq;
207:        tp->max_window = tp->snd_wnd;
208:  
209:        TCP_ECN_rcv_syn(tp, th);/* 从首部标志中获取显式拥塞通知的特性。 */
210:        if (tp->ecn_flags&TCP_ECN_OK)
211:            sk->sk_no_largesend = 1;
212:  
213:        /* 初始化MSS相关的成员变量 */
214:        tcp_sync_mss(sk, tp->pmtu_cookie);
215:        tcp_initialize_rcv_mss(sk);
216:  
217:        /* 向对端发送SYN+ACK段，并丢弃接收到的SYN段 */
218:        tcp_send_synack(sk);
219:  #if 0
220:        /* Note, we could accept data and URG from this segment.
221:         * There are no obstacles to make this.
222:         *
223:         * However, if we ignore data in ACKless segments sometimes,
224:         * we have no reasons to accept it sometimes.
225:         * Also, seems the code doing it in step6 of tcp_rcv_state_process
226:         * is not flawless. So, discard packet for sanity.
227:         * Uncomment this return to process the data.
228:         */
229:        return -1;
230:  #else
231:        goto discard;
232:  #endif
233:    }
234:    /* "fifth, if neither of the SYN or RST bits is set then
235:     * drop the segment and return."
236:     */
237:  
238:  discard_and_undo:
239:    tcp_clear_options(&tp->rx_opt);
240:    tp->rx_opt.mss_clamp = saved_clamp;
241:    goto discard;
242:  
243:  reset_and_undo:
244:    tcp_clear_options(&tp->rx_opt);
245:    tp->rx_opt.mss_clamp = saved_clamp;
246:    return 1;
247:  }
248:  

 1:  /*
 2:   *  Send a datagram to a given address. We move the address into kernel
 3:   *  space and check the user space data area is readable before invoking
 4:   *  the protocol.
 5:   */
 6:  
 7:  SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
 8:          unsigned, flags, struct sockaddr __user *, addr,
 9:          int, addr_len)
10:  {
11:      struct socket *sock;
12:      struct sockaddr_storage address;
13:      int err;
14:      struct msghdr msg;
15:      struct iovec iov;
16:      int fput_needed;
17:  
18:      if (len > INT_MAX)
19:          len = INT_MAX;
20:      sock = sockfd_lookup_light(fd, &err, &fput_needed);
21:      if (!sock)
22:          goto out;
23:  
24:      /* 可以看出用户空间的buff直接赋给了iov.iov_base, iov.iov_len = len */     
25:      iov.iov_base = buff;
26:      iov.iov_len = len;
27:      msg.msg_name = NULL;
28:      msg.msg_iov = &iov;
29:      msg.msg_iovlen = 1;
30:      msg.msg_control = NULL;
31:      msg.msg_controllen = 0;
32:      msg.msg_namelen = 0;
33:      if (addr) {
34:          err = move_addr_to_kernel(addr, addr_len, (struct sockaddr *)&address);
35:          if (err < 0)
36:              goto out_put;
37:          msg.msg_name = (struct sockaddr *)&address;
38:          msg.msg_namelen = addr_len;
39:      }
40:      if (sock->file->f_flags & O_NONBLOCK)
41:          flags |= MSG_DONTWAIT;
42:      msg.msg_flags = flags;
43:      err = sock_sendmsg(sock, &msg, len);
44:  
45:  out_put:
46:      fput_light(sock->file, fput_needed);
47:  out:
48:      return err;
49:  }

  1:  static int __sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
  2:               struct msghdr *msg_sys, unsigned flags,
  3:               struct used_address *used_address)
  4:  {
  5:      struct compat_msghdr __user *msg_compat =
  6:          (struct compat_msghdr __user *)msg;
  7:      struct sockaddr_storage address;
  8:      struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
  9:      unsigned char ctl[sizeof(struct cmsghdr) + 20]
 10:          __attribute__ ((aligned(sizeof(__kernel_size_t))));
 11:      /* 20 is size of ipv6_pktinfo */
 12:      unsigned char *ctl_buf = ctl;
 13:      int err, ctl_len, iov_size, total_len;
 14:  
 15:      err = -EFAULT;
 16:      if (MSG_CMSG_COMPAT & flags) {
 17:          if (get_compat_msghdr(msg_sys, msg_compat))
 18:              return -EFAULT;
 19:      }
 20:      else if (copy_from_user(msg_sys, msg, sizeof(struct msghdr)))
 21:          return -EFAULT;
 22:  
 23:      /* do not move before msg_sys is valid */
 24:      err = -EMSGSIZE;
 25:      if (msg_sys->msg_iovlen > UIO_MAXIOV)
 26:          goto out;
 27:  
 28:      /* Check whether to allocate the iovec area */
 29:      err = -ENOMEM;
 30:      iov_size = msg_sys->msg_iovlen * sizeof(struct iovec);
 31:      if (msg_sys->msg_iovlen > UIO_FASTIOV) {
 32:          iov = sock_kmalloc(sock->sk, iov_size, GFP_KERNEL);
 33:          if (!iov)
 34:              goto out;
 35:      }
 36:  
 37:      /* This will also move the address data into kernel space */
 38:      if (MSG_CMSG_COMPAT & flags) {
 39:          err = verify_compat_iovec(msg_sys, iov,
 40:                        (struct sockaddr *)&address,
 41:                        VERIFY_READ);
 42:      } else
 43:          err = verify_iovec(msg_sys, iov,
 44:                     (struct sockaddr *)&address,
 45:                     VERIFY_READ);
 46:      if (err < 0)
 47:          goto out_freeiov;
 48:      total_len = err;
 49:  
 50:      err = -ENOBUFS;
 51:  
 52:      if (msg_sys->msg_controllen > INT_MAX)
 53:          goto out_freeiov;
 54:      ctl_len = msg_sys->msg_controllen;
 55:      if ((MSG_CMSG_COMPAT & flags) && ctl_len) {
 56:          err =
 57:              cmsghdr_from_user_compat_to_kern(msg_sys, sock->sk, ctl,
 58:                               sizeof(ctl));
 59:          if (err)
 60:              goto out_freeiov;
 61:          ctl_buf = msg_sys->msg_control;
 62:          ctl_len = msg_sys->msg_controllen;
 63:      } else if (ctl_len) {
 64:          if (ctl_len > sizeof(ctl)) {
 65:              ctl_buf = sock_kmalloc(sock->sk, ctl_len, GFP_KERNEL);
 66:              if (ctl_buf == NULL)
 67:                  goto out_freeiov;
 68:          }
 69:          err = -EFAULT;
 70:          /*
 71:           * Careful! Before this, msg_sys->msg_control contains a user pointer.
 72:           * Afterwards, it will be a kernel pointer. Thus the compiler-assisted
 73:           * checking falls down on this.
 74:           */
 75:          if (copy_from_user(ctl_buf, (void __user *)msg_sys->msg_control,
 76:                     ctl_len))
 77:              goto out_freectl;
 78:          msg_sys->msg_control = ctl_buf;
 79:      }
 80:      msg_sys->msg_flags = flags;
 81:  
 82:      if (sock->file->f_flags & O_NONBLOCK)
 83:          msg_sys->msg_flags |= MSG_DONTWAIT;
 84:      /*
 85:       * If this is sendmmsg() and current destination address is same as
 86:       * previously succeeded address, omit asking LSM‘s decision.
 87:       * used_address->name_len is initialized to UINT_MAX so that the first
 88:       * destination address never matches.
 89:       */
 90:      if (used_address && used_address->name_len == msg_sys->msg_namelen &&
 91:          !memcmp(&used_address->name, msg->msg_name,
 92:              used_address->name_len)) {
 93:          err = sock_sendmsg_nosec(sock, msg_sys, total_len);
 94:          goto out_freectl;
 95:      }
 96:      err = sock_sendmsg(sock, msg_sys, total_len);
 97:      /*
 98:       * If this is sendmmsg() and sending to current destination address was
 99:       * successful, remember it.
100:       */
101:      if (used_address && err >= 0) {
102:          used_address->name_len = msg_sys->msg_namelen;
103:          memcpy(&used_address->name, msg->msg_name,
104:                 used_address->name_len);
105:      }
106:  
107:  out_freectl:
108:      if (ctl_buf != ctl)
109:          sock_kfree_s(sock->sk, ctl_buf, ctl_len);
110:  out_freeiov:
111:      if (iov != iovstack)
112:          sock_kfree_s(sock->sk, iov, iov_size);
113:  out:
114:      return err;
115:  }
116:  

  1:  /* sendmsg系统调用在TCP层的实现 */
  2:  int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
  3:          size_t size)
  4:  {
  5:      struct iovec *iov;
  6:      struct tcp_sock *tp = tcp_sk(sk);
  7:      struct sk_buff *skb;
  8:      int iovlen, flags;
  9:      int mss_now;
 10:      int err, copied;
 11:      long timeo;
 12:  
 13:      /* 获取套接口的锁 */
 14:      lock_sock(sk);
 15:      TCP_CHECK_TIMER(sk);
 16:  
 17:      /* 根据标志计算阻塞超时时间 */
 18:      flags = msg->msg_flags;
 19:      timeo = sock_sndtimeo(sk, flags & MSG_DONTWAIT);
 20:  
 21:      /* Wait for a connection to finish. */
 22:      if ((1 << sk->sk_state) & ~(TCPF_ESTABLISHED | TCPF_CLOSE_WAIT))/* 只有这两种状态才能发送消息 */
 23:          if ((err = sk_stream_wait_connect(sk, &timeo)) != 0)/* 其它状态下等待连接正确建立，超时则进行错误处理 */
 24:              goto out_err;
 25:  
 26:      /* This should be in poll */
 27:      clear_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags);
 28:  
 29:      /* 获得有效的MSS，如果支持OOB，则不能支持TSO，MSS则应当是比较小的值 */
 30:      mss_now = tcp_current_mss(sk, !(flags&MSG_OOB));
 31:  
 32:      /* Ok commence sending. */
 33:      /* 获取待发送数据块数及数据块指针 */
 34:      iovlen = msg->msg_iovlen;
 35:      iov = msg->msg_iov;
 36:      /* copied表示从用户数据块复制到skb中的字节数。 */
 37:      copied = 0;
 38:  
 39:      err = -EPIPE;
 40:      /* 如果套接口存在错误，则不允许发送数据，返回EPIPE错误 */
 41:      if (sk->sk_err || (sk->sk_shutdown & SEND_SHUTDOWN))
 42:          goto do_error;
 43:  
 44:      while (--iovlen >= 0) {/* 处理所有待发送数据块 */
 45:          int seglen = iov->iov_len;
 46:          unsigned char __user *from = iov->iov_base;
 47:  
 48:          iov++;
 49:  
 50:          while (seglen > 0) {/* 处理单个数据块中的所有数据 */
 51:              int copy;
 52:  
 53:              skb = sk->sk_write_queue.prev;
 54:  
 55:              if (!sk->sk_send_head ||/* 发送队列为空，前面取得的skb无效 */
 56:                  (copy = mss_now - skb->len) <= 0) {/* 如果skb有效，但是它已经没有多余的空间复制新数据了 */
 57:  
 58:  new_segment:
 59:                  /* Allocate new segment. If the interface is SG,
 60:                   * allocate skb fitting to single page.
 61:                   */
 62:                  if (!sk_stream_memory_free(sk))/* 发送队列中数据长度达到发送缓冲区的上限，等待缓冲区 */
 63:                      goto wait_for_sndbuf;
 64:  
 65:                  skb = sk_stream_alloc_pskb(sk, select_size(sk, tp),
 66:                                 0, sk->sk_allocation);/* 分配新的skb */
 67:                  if (!skb)/* 分配失败，说明系统内存不足，等待 */
 68:                      goto wait_for_memory;
 69:  
 70:                  /*
 71:                   * Check whether we can use HW checksum.
 72:                   */
 73:                  if (sk->sk_route_caps &
 74:                      (NETIF_F_IP_CSUM | NETIF_F_NO_CSUM |
 75:                       NETIF_F_HW_CSUM))/* 根据路由网络设备的特性，确定是否由硬件执行校验和 */
 76:                      skb->ip_summed = CHECKSUM_HW;
 77:  
 78:                  skb_entail(sk, tp, skb);/* 将SKB添加到发送队列尾部 */
 79:                  copy = mss_now;/* 本次需要复制的数据量是MSS */
 80:              }
 81:  
 82:              /* Try to append data to the end of skb. */
 83:              if (copy > seglen)/* 要复制的数据不能大于当前段的长度 */
 84:                  copy = seglen;
 85:  
 86:              /* Where to copy to? */
 87:              if (skb_tailroom(skb) > 0) {/* skb线性存储区底部还有空间 */
 88:                  /* We have some space in skb head. Superb! */
 89:                  if (copy > skb_tailroom(skb))/* 本次只复制skb存储区底部剩余空间大小的数据量 */
 90:                      copy = skb_tailroom(skb);
 91:                  /* 从用户空间复制指定长度的数据到skb中，如果失败，则退出 */
 92:                  if ((err = skb_add_data(skb, from, copy)) != 0)
 93:                      goto do_fault;
 94:              } else {/* 线性存储区底部已经没有空间了，复制到分散/聚集存储区中 */
 95:                  int merge = 0;/* 是否在页中添加数据 */
 96:                  int i = skb_shinfo(skb)->nr_frags;/* 分散/聚集片断数 */
 97:                  struct page *page = TCP_PAGE(sk);/* 分片页页 */
 98:                  int off = TCP_OFF(sk);/* 分片内的偏移 */
 99:  
100:                  if (skb_can_coalesce(skb, i, page, off) &&
101:                      off != PAGE_SIZE) {/* 当前分片还能添加数据 */
102:                      /* We can extend the last page
103:                       * fragment. */
104:                      merge = 1;
105:                  } else if (i == MAX_SKB_FRAGS ||/* 目前skb中的页不能添加数据，这里判断是否能再分配页 */
106:                         (!i &&
107:                         !(sk->sk_route_caps & NETIF_F_SG))) {/* 网卡不支持S/G，不能分片 */
108:                      /* Need to add new fragment and cannot
109:                       * do this because interface is non-SG,
110:                       * or because all the page slots are
111:                       * busy. */
112:                      tcp_mark_push(tp, skb);/* SKB可以提交了 */
113:                      goto new_segment;/* 重新分配skb */
114:                  } else if (page) {/* 分页数量未达到上限，判断当前页是否还有空间 */
115:                      /* If page is cached, align
116:                       * offset to L1 cache boundary
117:                       */
118:                      off = (off + L1_CACHE_BYTES - 1) &
119:                            ~(L1_CACHE_BYTES - 1);
120:                      if (off == PAGE_SIZE) {/* 最后一个分页数据已经满，需要分配新页 */
121:                          put_page(page);
122:                          TCP_PAGE(sk) = page = NULL;
123:                      }
124:                  }
125:  
126:                  if (!page) {/* 需要分配新页 */
127:                      /* Allocate new cache page. */
128:                      if (!(page = sk_stream_alloc_page(sk)))/* 分配新页，如果内存不足则等待内存 */
129:                          goto wait_for_memory;
130:                      off = 0;
131:                  }
132:  
133:                  if (copy > PAGE_SIZE - off)/* 待复制的数据不能大于页中剩余空间 */
134:                      copy = PAGE_SIZE - off;
135:  
136:                  /* Time to copy data. We are close to
137:                   * the end! */
138:                  err = skb_copy_to_page(sk, from, skb, page,
139:                                 off, copy);/* 从用户态复制数据到页中 */
140:                  if (err) {/* 复制失败了 */
141:                      /* If this page was new, give it to the
142:                       * socket so it does not get leaked.
143:                       */
144:                      if (!TCP_PAGE(sk)) {/* 如果是新分配的页，则将页记录到skb中，供今后使用 */
145:                          TCP_PAGE(sk) = page;
146:                          TCP_OFF(sk) = 0;
147:                      }
148:                      goto do_error;
149:                  }
150:  
151:                  /* Update the skb. */
152:                  /* 更新skb的分段信息 */
153:                  if (merge) {/* 在最后一个页中追加数据 */
154:                      skb_shinfo(skb)->frags[i - 1].size +=
155:                                      copy;/* 更新最后一页的数据长度 */
156:                  } else {/* 新分配的页 */
157:                      /* 更新skb中分片信息 */
158:                      skb_fill_page_desc(skb, i, page, off, copy);
159:                      if (TCP_PAGE(sk)) {
160:                          get_page(page);
161:                      } else if (off + copy < PAGE_SIZE) {
162:                          get_page(page);
163:                          TCP_PAGE(sk) = page;
164:                      }
165:                  }
166:  
167:                  /* 更新页内偏移 */
168:                  TCP_OFF(sk) = off + copy;
169:              }
170:  
171:              if (!copied)/* 如果没有复制数据，则取消PSH标志 */
172:                  TCP_SKB_CB(skb)->flags &= ~TCPCB_FLAG_PSH;
173:  
174:              tp->write_seq += copy;/* 更新发送队列最后一个包的序号 */
175:              TCP_SKB_CB(skb)->end_seq += copy;/* 更新skb的序号 */
176:              skb_shinfo(skb)->tso_segs = 0;
177:  
178:              /* 更新数据复制的指针 */
179:              from += copy;
180:              copied += copy;
181:              /* 如果所有数据已经复制完毕则退出 */
182:              if ((seglen -= copy) == 0 && iovlen == 0)
183:                  goto out;
184:  
185:              /* 如果当前skb中的数据小于mss，说明可以往里面继续复制数据。或者发送的是OOB数据，则也跳过发送过程，继续复制数据 */
186:              if (skb->len != mss_now || (flags & MSG_OOB))
187:                  continue;
188:  
189:              if (forced_push(tp)) {/* 必须立即发送数据，即上次发送后产生的数据已经超过通告窗口值的一半 */
190:                  /* 设置PSH标志后发送数据 */
191:                  tcp_mark_push(tp, skb);
192:                  __tcp_push_pending_frames(sk, tp, mss_now, TCP_NAGLE_PUSH);
193:              } else if (skb == sk->sk_send_head)/* 虽然不是必须发送数据，但是发送队列上只存在当前段，也将其发送出去 */
194:                  tcp_push_one(sk, mss_now);
195:              continue;
196:  
197:  wait_for_sndbuf:
198:              /* 由于发送队列满的原因导致等待 */
199:              set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
200:  wait_for_memory:
201:              if (copied)/* 虽然没有内存了，但是本次调用复制了数据到缓冲区，调用tcp_push将其发送出去 */
202:                  tcp_push(sk, tp, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH);
203:  
204:              /* 等待内存可用 */
205:              if ((err = sk_stream_wait_memory(sk, &timeo)) != 0)
206:                  goto do_error;/* 确实没有内存了，超时后返回失败 */
207:  
208:              /* 睡眠后，MSS可能发生了变化，重新计算 */
209:              mss_now = tcp_current_mss(sk, !(flags&MSG_OOB));
210:          }
211:      }
212:  
213:  out:
214:      if (copied)/* 从用户态复制了数据，发送它 */
215:          tcp_push(sk, tp, flags, mss_now, tp->nonagle);
216:      TCP_CHECK_TIMER(sk);
217:      release_sock(sk);/* 释放锁以后返回 */
218:      return copied;
219:  
220:  do_fault:
221:      if (!skb->len) {/* 复制数据失败了，如果skb长度为0，说明是新分配的，释放它 */
222:          if (sk->sk_send_head == skb)/* 如果skb是发送队列头，则清空队列头 */
223:              sk->sk_send_head = NULL;
224:          __skb_unlink(skb, skb->list);
225:          sk_stream_free_skb(sk, skb);/* 释放skb */
226:      }
227:  
228:  do_error:
229:      if (copied)
230:          goto out;
231:  out_err:
232:      err = sk_stream_error(sk, flags, err);
233:      TCP_CHECK_TIMER(sk);
234:      release_sock(sk);
235:      return err;
236:  }