static noinline int do_init_module(struct module *mod)
{
  int ret = 0;
  struct mod_initfree *freeinit;
  freeinit = kmalloc(sizeof(*freeinit), GFP_KERNEL);
  if (!freeinit) {
    ret = -ENOMEM;
    goto fail;//HDR视图所占空间的释放
  /*
   *
   */
  }
  freeinit->module_init = mod->module_init;//调用mod中init函数指针
  /*
   * We want to find out whether @mod uses async during init.  Clear
   * PF_USED_ASYNC.  async_schedule*() will set it.
   */
  current->flags &= ~PF_USED_ASYNC;
  do_mod_ctors(mod);
  /* Start the module */
  if (mod->init != NULL)
    ret = do_one_initcall(mod->init);
  if (ret < 0) {
    goto fail_free_freeinit;//放INIT section区域（mod->module_init)
  }
  if (ret > 0) {
    pr_warn("%s: '%s'->init suspiciously returned %d, it should "
      "follow 0/-E convention\n"
      "%s: loading module anyway...\n",
      __func__, mod->name, ret, __func__);
    dump_stack();
  }
  /* Now it's a first class citizen! */
  mod->state = MODULE_STATE_LIVE;//新模块的状态
  blocking_notifier_call_chain(&module_notify_list,
             MODULE_STATE_LIVE, mod);//内核模块的通知链
  /*
   * We need to finish all async code before the module init sequence
   * is done.  This has potential to deadlock.  For example, a newly
   * detected block device can trigger request_module() of the
   * default iosched from async probing task.  Once userland helper
   * reaches here, async_synchronize_full() will wait on the async
   * task waiting on request_module() and deadlock.
   *
   * This deadlock is avoided by perfomring async_synchronize_full()
   * iff module init queued any async jobs.  This isn't a full
   * solution as it will deadlock the same if module loading from
   * async jobs nests more than once; however, due to the various
   * constraints, this hack seems to be the best option for now.
   * Please refer to the following thread for details.
   *
   * http://thread.gmane.org/gmane.linux.kernel/1420814
   */
  if (current->flags & PF_USED_ASYNC)
    async_synchronize_full();
  mutex_lock(&module_mutex);
  /* Drop initial reference. */
  module_put(mod);
  trim_init_extable(mod);
#ifdef CONFIG_KALLSYMS
  mod->num_symtab = mod->core_num_syms;
  mod->symtab = mod->core_symtab;
  mod->strtab = mod->core_strtab;
#endif
  unset_module_init_ro_nx(mod);
  module_arch_freeing_init(mod);
  mod->module_init = NULL;
  mod->init_size = 0;
  mod->init_ro_size = 0;
  mod->init_text_size = 0;
  /*
   * We want to free module_init, but be aware that kallsyms may be
   * walking this with preempt disabled.  In all the failure paths,
   * we call synchronize_rcu/synchronize_sched, but we don't want
   * to slow down the success path, so use actual RCU here.
   */
  call_rcu(&freeinit->rcu, do_free_init);
  mutex_unlock(&module_mutex);
  wake_up_all(&module_wq);
  return 0;
fail_free_freeinit:
  kfree(freeinit);
fail:
  /* Try to protect us from buggy refcounters. */
  mod->state = MODULE_STATE_GOING;//新模块的状态为MODULE_STATE_GOING
  synchronize_sched();
  module_put(mod);
  blocking_notifier_call_chain(&module_notify_list,
             MODULE_STATE_GOING, mod);
  free_module(mod);
  wake_up_all(&module_wq);
  return ret;
}

mod->state = MODULE_STATE_GOING;

kfree(freeinit);

free_module(mod);

struct blocking_notifier_head {
  struct rw_semaphore rwsem;
  struct notifier_block __rcu *head;
};

static BLOCKING_INIT_NOTIFIER_HEAD(module_notify_list) ;

int register_module_notifier(struct notifier_block *nb)
{
  return blocking_notifier_chain_register(&module_notify_list, nb);
}

struct notifier_block {
  notifier_fn_t notifier_call;
  struct notifier_block __rcu *next;
  int priority;
};

int register_module_notifier(struct notifier_block *nb)
{
  return blocking_notifier_chain_register(&module_notify_list, nb);
}

blocking_notifier_call_chain(&module_notify_list,
             MODULE_STATE_LIVE, mod);//内核模块的通知链

asmlinkage long sys_delete_module(const char __user *name_user,
        unsigned int flags);

SYSCALL_DEFINE2(delete_module, const char __user *, name_user,
    unsigned int, flags)
{
  struct module *mod;
  char name[MODULE_NAME_LEN];
  int ret, forced = 0;
  if (!capable(CAP_SYS_MODULE) || modules_disabled)
    return -EPERM;
  if (strncpy_from_user(name, name_user, MODULE_NAME_LEN-1) < 0)
    return -EFAULT;
  name[MODULE_NAME_LEN-1] = '\0';
  if (mutex_lock_interruptible(&module_mutex) != 0)
    return -EINTR;
  mod = find_module(name);
  if (!mod) {
    ret = -ENOENT;
    goto out;
  }
  if (!list_empty(&mod->source_list)) {
    /* Other modules depend on us: get rid of them first. */
    ret = -EWOULDBLOCK;
    goto out;
  }
  /* Doing init or already dying? */
  if (mod->state != MODULE_STATE_LIVE) {
    /* FIXME: if (force), slam module count damn the torpedoes */
    pr_debug("%s already dying\n", mod->name);
    ret = -EBUSY;
    goto out;
  }
  /* If it has an init func, it must have an exit func to unload */
  if (mod->init && !mod->exit) {
    forced = try_force_unload(flags);
    if (!forced) {
      /* This module can't be removed */
      ret = -EBUSY;
      goto out;
    }
  }
  /* Stop the machine so refcounts can't move and disable module. */
  ret = try_stop_module(mod, flags, &forced);
  if (ret != 0)
    goto out;
  mutex_unlock(&module_mutex);
  /* Final destruction now no one is using it. */
  if (mod->exit != NULL)
    mod->exit();
  blocking_notifier_call_chain(&module_notify_list,
             MODULE_STATE_GOING, mod);
  async_synchronize_full();
  /* Store the name of the last unloaded module for diagnostic purposes */
  strlcpy(last_unloaded_module, mod->name, sizeof(last_unloaded_module));
  free_module(mod);
  return 0;
out:
  mutex_unlock(&module_mutex);
  return ret;
}

if (strncpy_from_user(name, name_user, MODULE_NAME_LEN-1) < 0)
    return -EFAULT;

struct module *find_module(const char *name)
{
  return find_module_all(name, strlen(name), false);
}

/* Search for module by name: must hold module_mutex. */
/*函数通过list_each_entry在modules链表中遍历每一个模块mod，
通过前面的讨论我们知道，全局变量modules用来管理系统中所响己加载的
模块形成的链表。如果查找到指定的模块，则函数返回该模块的mod结构，
否则返回NULL。*/
static struct module *find_module_all(const char *name, size_t len,
              bool even_unformed)
{
  struct module *mod;
  list_for_each_entry(mod, &modules, list) {
    if (!even_unformed && mod->state == MODULE_STATE_UNFORMED)
      continue;
    if (strlen(mod->name) == len && !memcmp(mod->name, name, len))
      return mod;
  }
  return NULL;
}

if (!list_empty(&mod->source_list)) {
    /* Other modules depend on us: get rid of them first. */
    ret = -EWOULDBLOCK;
    goto out;
  }

static void free_module(struct module *mod)
{
  trace_module_free(mod);
  mod_sysfs_teardown(mod);
  /* We leave it in list to prevent duplicate loads, but make sure
   * that noone uses it while it's being deconstructed. */
  mutex_lock(&module_mutex);
  mod->state = MODULE_STATE_UNFORMED;
  mutex_unlock(&module_mutex);
  /* Remove dynamic debug info */
  ddebug_remove_module(mod->name);
  /* Arch-specific cleanup. */
  module_arch_cleanup(mod);
  /* Module unload stuff */
  module_unload_free(mod);
  /* Free any allocated parameters. */
  destroy_params(mod->kp, mod->num_kp);
  /* Now we can delete it from the lists */
  mutex_lock(&module_mutex);
  /* Unlink carefully: kallsyms could be walking list. */
  list_del_rcu(&mod->list);
  /* Remove this module from bug list, this uses list_del_rcu */
  module_bug_cleanup(mod);
  /* Wait for RCU synchronizing before releasing mod->list and buglist. */
  synchronize_rcu();
  mutex_unlock(&module_mutex);
  /* This may be NULL, but that's OK */
  unset_module_init_ro_nx(mod);
  module_arch_freeing_init(mod);
  module_memfree(mod->module_init);
  kfree(mod->args);
  percpu_modfree(mod);
  /* Free lock-classes; relies on the preceding sync_rcu(). */
  lockdep_free_key_range(mod->module_core, mod->core_size);
  /* Finally, free the core (containing the module structure) */
  unset_module_core_ro_nx(mod);
  module_memfree(mod->module_core);
#ifdef CONFIG_MPU
  update_protections(current->mm);
#endif
}