http://blog.chinaunix.net/uid-23629988-id-3181446.html

    int tcp_child_process(struct sock *parent, struct sock *child,
             struct sk_buff *skb)
    {
        int ret = 0;
        int state = child->sk_state;

        if (!sock_owned_by_user(child)) {
            //到达这里
            ret = tcp_rcv_state_process(child, skb, tcp_hdr(skb),
                         skb->len);
            /* Wakeup parent, send SIGIO */
            if (state == TCP_SYN_RECV && child->sk_state != state)
                parent->sk_data_ready(parent, 0);
        } 
        ...... ......
    }

那么包的处理仍然是交给tcp_rcv_state_process。回忆第一篇文章中，tcp_rcv_state_process是根据child的状态来决定如何处理。而child是从父socket生成的。如果child的状态和父socket状态一样，肯定是有问题的。那么child的状态是何时改变的呢？

    struct sock *inet_csk_clone(struct sock *sk, const struct request_sock *req,
                 const gfp_t priority)
    {
        //首先clone统一的sock结构信息
        struct sock *newsk = sk_clone(sk, priority);

        if (newsk != NULL) {
            //开始clone 面向连接的sock的信息
            struct inet_connection_sock *newicsk = inet_csk(newsk);
            //在这里，newsk的状态被设置为TCP_SYN_RECV
            newsk->sk_state = TCP_SYN_RECV;
            newicsk->icsk_bind_hash = NULL;

            ...... ......
        }
        return newsk;
    }

说实话，这个结果让我觉得有些不爽。

    int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                 const struct tcphdr *th, unsigned int len)
    {
        struct tcp_sock *tp = tcp_sk(sk);
        struct inet_connection_sock *icsk = inet_csk(sk);
        int queued = 0;
        int res;

        tp->rx_opt.saw_tstamp = 0;

     
      ...... ......


        res = tcp_validate_incoming(sk, skb, th, 0);
        if (res <= 0)
            return -res;

        /* step 5: check the ACK field */
        if (th->ack) {
            //检查是否接受这个ack包
            int acceptable = tcp_ack(sk, skb, FLAG_SLOWPATH) > 0;

            switch (sk->sk_state) {
            case TCP_SYN_RECV:
                if (acceptable) {
                    tp->copied_seq = tp->rcv_nxt;
                    smp_mb();
                    //完成了三次握手，sk的状态自然改为 TCP_ESTABLISHED
                    tcp_set_state(sk, TCP_ESTABLISHED);
                    //sk_state_change默认为sock_def_wakeup, 会唤醒sleep在该socket上的进程
                    sk->sk_state_change(sk);

                    /* Note, that this wakeup is only for marginal
                     * crossed SYN case. Passively open sockets
                     * are not waked up, because sk->sk_sleep ==
                     * NULL and sk->sk_socket == NULL.
                     */
                    //这里也仍然是一个wake动作，但是按照我的理解
                    //这里应该是处理socket作为文件描述符的异步操作，如epoll
                    if (sk->sk_socket)
                        sk_wake_async(sk,
                             SOCK_WAKE_IO, POLL_OUT);

                    tp->snd_una = TCP_SKB_CB(skb)->ack_seq;
                    tp->snd_wnd = ntohs(th->window) <<
                         tp->rx_opt.snd_wscale;
                    tcp_init_wl(tp, TCP_SKB_CB(skb)->seq);

                    if (tp->rx_opt.tstamp_ok)
                        tp->advmss -= TCPOLEN_TSTAMP_ALIGNED;

                    /* Make sure socket is routed, for
                     * correct metrics.
                     */
                    icsk->icsk_af_ops->rebuild_header(sk);

                    tcp_init_metrics(sk);

                    tcp_init_congestion_control(sk);

                    /* Prevent spurious tcp_cwnd_restart() on
                     * first data packet.
                     */
                    tp->lsndtime = tcp_time_stamp;

                    tcp_mtup_init(sk);
                    tcp_initialize_rcv_mss(sk);
                    tcp_init_buffer_space(sk);
                    tcp_fast_path_on(tp);
                } else {
                    return 1;
                }
                break;

            }
        } else
            goto discard;

        /* step 6: check the URG bit */
        tcp_urg(sk, skb, th);

        /* step 7: process the segment text */
        //这时sk->sk_state的状态已经为TCP_ESTABLISHED
        /* 其实对于这个ack包，它只含有TCP的首部，没有数据。那么我认为在将tcp置为established后，不需要后面的操     作了 */
        switch (sk->sk_state) {
            ...... ......
        case TCP_ESTABLISHED:
            tcp_data_queue(sk, skb);
            queued = 1;
            break;
        }

        /* tcp_data could move socket to TIME-WAIT */
        if (sk->sk_state != TCP_CLOSE) {
            tcp_data_snd_check(sk);
            tcp_ack_snd_check(sk);
        }

        if (!queued) {
    discard:
            __kfree_skb(skb);
        }
        return 0;
    }

这里处理完毕后，回到tcp_child_process

    int tcp_child_process(struct sock *parent, struct sock *child,
             struct sk_buff *skb)
    {
        int ret = 0;
        int state = child->sk_state;

        if (!sock_owned_by_user(child)) {
            ret = tcp_rcv_state_process(child, skb, tcp_hdr(skb),
                         skb->len);
            /* Wakeup parent, send SIGIO */
            /*
            对于这个ack包，state的状态即为child之前的状态，即TCP_SYN_RECV。
            再成功处理了ack包后，child->sk_state变为TCP_ESTABLISHED
            因此进入parent->sk_data_ready，仍然是一个异步通知的手段
            */
            if (state == TCP_SYN_RECV && child->sk_state != state)
                parent->sk_data_ready(parent, 0);
        } 

      ...... ......

    }

这样这个ack包基本上已经处理完毕。但是还有一个问题，这个新建的child socket是何时添加到TCP的ehash中，即已经连接的hash表中。还是要回到tcp_v4_syn_recv_sock中，在该函数的结尾处，调用了__inet_hash_nolisten(newsk, NULL);将newsk加入父socket的ehash表中的。