SYSCALL_DEFINE2(listen, int, fd, int, backlog)

[listen]

SYSCALL_DEFINE2(listen, int, fd, int, backlog)
{
	struct socket *sock;
	int err, fput_needed;
	int somaxconn;

	sock = sockfd_lookup_light(fd, &err, &fput_needed);
	if (sock) {
		somaxconn = sock_net(sock->sk)->core.sysctl_somaxconn;
		if ((unsigned int)backlog > somaxconn)
			backlog = somaxconn;

			err = sock->ops->listen(sock, backlog);

		fput_light(sock->file, fput_needed);
	}
	return err;
}

对TCP，ops指向inet_stream_ops，调用的是inet_listen
[listen->inet_listen]

int inet_listen(struct socket *sock, int backlog)
{
	struct sock *sk = sock->sk;
	unsigned char old_state;
	if (sock->state != SS_UNCONNECTED || sock->type != SOCK_STREAM)
		goto out;

 	old_state = sk->sk_state;
	if (!((1 << old_state) & (TCPF_CLOSE | TCPF_LISTEN)))
 		goto out;

先对状态和类型做一个检测

	/* Really, if the socket is already in listen state
	 * we can only allow the backlog to be adjusted.
	 */
	if (old_state != TCP_LISTEN) {
		err = inet_csk_listen_start(sk, backlog);
	}
	sk->sk_max_ack_backlog = backlog;
	return err;
}

如果状态不在TCP_LISTEN状态，要改变状态，否则，只是设置下sk_max_ack_backlog的值。
[listen->inet_listen->inet_csk_listen_start]

int inet_csk_listen_start(struct sock *sk, const int nr_table_entries)
{
	struct inet_sock *inet = inet_sk(sk);
	struct inet_connection_sock *icsk = inet_csk(sk);
	int rc = reqsk_queue_alloc(&icsk->icsk_accept_queue, nr_table_entries);
	if (rc != 0)
		return rc;

分配一个队列，大小为nr_table_entries，用来放请求连接。
[listen->inet_listen->inet_csk_listen_start->reqsk_queue_alloc]

int reqsk_queue_alloc(struct request_sock_queue *queue,
		      unsigned int nr_table_entries)
{
	size_t lopt_size = sizeof(struct listen_sock);
	struct listen_sock *lopt;

	nr_table_entries = min_t(u32, nr_table_entries, sysctl_max_syn_backlog);

sysctl_max_syn_backlog是一个全局量：

/*
 * Maximum number of SYN_RECV sockets in queue per LISTEN socket.
 * One SYN_RECV socket costs about 80bytes on a 32bit machine.
 * It would be better to replace it with a global counter for all sockets
 * but then some measure against one socket starving all other sockets
 * would be needed.
 *
 * The minimum value of it is 128. Experiments with real servers show that
 * it is absolutely not enough even at 100conn/sec. 256 cures most
 * of problems.
 * This value is adjusted to 128 for low memory machines,
 * and it will increase in proportion to the memory of machine.
 * Note : Dont forget somaxconn that may limit backlog too.
 */
int sysctl_max_syn_backlog = 256;
EXPORT_SYMBOL(sysctl_max_syn_backlog);

回到reqsk_queue_alloc中来：

	nr_table_entries = max_t(u32, nr_table_entries, 8);
	nr_table_entries = roundup_pow_of_two(nr_table_entries + 1);
	lopt_size += nr_table_entries * sizeof(struct request_sock *);
	if (lopt_size > PAGE_SIZE)
		lopt = vzalloc(lopt_size);
	else
		lopt = kzalloc(lopt_size, GFP_KERNEL);
	if (lopt == NULL)
		return -ENOMEM;

request_sock是一个socket的精简结构，专用于处理连接请求socket

	for (lopt->max_qlen_log = 3;
	     (1 << lopt->max_qlen_log) < nr_table_entries;
	     lopt->max_qlen_log++);

	get_random_bytes(&lopt->hash_rnd, sizeof(lopt->hash_rnd));
	rwlock_init(&queue->syn_wait_lock);
	queue->rskq_accept_head = NULL;
	lopt->nr_table_entries = nr_table_entries;

	write_lock_bh(&queue->syn_wait_lock);
	queue->listen_opt = lopt;
	write_unlock_bh(&queue->syn_wait_lock);

	return 0;
}

完成一些初始化。listen_sock用来表示listen的状态
[listen->inet_listen->inet_csk_listen_start]

	sk->sk_max_ack_backlog = 0;
	sk->sk_ack_backlog = 0;
	memset(&inet_csk(sk)->icsk_ack, 0, sizeof(inet_csk(sk)->icsk_ack));

	/* There is race window here: we announce ourselves listening,
	 * but this transition is still not validated by get_port().
	 * It is OK, because this socket enters to hash table only
 	 * after validation is complete.
	 */
	sk->sk_state = TCP_LISTEN;

将状态改为TCP_LISTEN

	if (!sk->sk_prot->get_port(sk, inet->inet_num)) {
		inet->inet_sport = htons(inet->inet_num);

		sk_dst_reset(sk);
		sk->sk_prot->hash(sk);

		return 0;
	}

	sk->sk_state = TCP_CLOSE;
	__reqsk_queue_destroy(&icsk->icsk_accept_queue);
	return -EADDRINUSE;
}

如果端口号没被绑定，sk->sk_prot->get_port返回非0，出错返回。对TCP，sk_port指向tcp_prot，调用inet_hash
[listen->inet_listen->inet_csk_listen_start->inet_hash]

void inet_hash(struct sock *sk)
{
	if (sk->sk_state != TCP_CLOSE) {
		local_bh_disable();
		__inet_hash(sk);
		local_bh_enable();
	}
}

[listen->inet_listen->inet_csk_listen_start->inet_hash->__inet_hash]

static void __inet_hash(struct sock *sk)
{
	struct inet_hashinfo *hashinfo = sk->sk_prot->h.hashinfo;
	struct inet_listen_hashbucket *ilb;
	ilb = &hashinfo->listening_hash[inet_sk_listen_hashfn(sk)];

 	hlist_nulls_add_head_rcu(&sk->sk_nulls_node, &ilb->head)
	__this_cpu_add(prot_inuse.val[sk->sk_prot->inuse_idx], 1);
}

prot_inuse是一个全局量：

struct prot_inuse {
    int val[PROTO_INUSE_NR]; // 64
};
static DEFINE_PER_CPU(struct prot_inuse, prot_inuse);