fix: avoid first stage bootloop when blocking kernel modules

kernel/core/init.c

@@ -137,9 +137,6 @@ int __init kernelsu_init(void)
     ksu_init_symbol_resolver();
     ksu_syscall_hook_init();
 
-    // Block modules early, before vendor modules are loaded in second stage.
-    ksu_module_blacklist_init();
-
     ksu_feature_init();
     ksu_sulog_init();
     ksu_adb_root_init();

kernel/feature/module_blacklist.c

@@ -18,6 +18,14 @@
 // which flows in through ksu_config (boot-patch / boot-patch-v2) or the kernel
 // cmdline (built-in). Names use the kernel form (underscores, e.g.
 // `oplus_secure_guard`).
+//
+// The blacklist is only installed once second stage init starts. A blacklisted
+// module fails to load with EPERM, and first stage init treats any module in
+// modules.load that fails to load as fatal (LOG(FATAL), i.e. a bootloop)
+// unless it is listed in modules.blocklist. ksuinit adds the names to
+// modules.blocklist in the ramdisk instead, so first stage init skips them
+// cleanly; second stage loaders (e.g. vendor_dlkm modprobe) do not abort boot
+// on a failed module.
 
 static char block_modules[256];
 
@@ -43,15 +51,17 @@ static const struct kernel_param_ops block_modules_param_ops = {
 module_param_cb(block_modules, &block_modules_param_ops, NULL, 0);
 
 // Merge the configured names into the kernel's native module_blacklist.
-void __init ksu_module_blacklist_init(void)
+void ksu_module_blacklist_apply(void)
 {
+    static bool applied;
     char **native_blacklist;
     const char *existing;
     char *merged;
     size_t existing_len;
 
-    if (!block_modules[0])
+    if (applied || !block_modules[0])
         return;
+    applied = true;
 
     native_blacklist = (char **)find_kernel_symbol_exact("module_blacklist");
     if (!native_blacklist) {

kernel/feature/module_blacklist.h

@@ -2,9 +2,10 @@
 #define __KSU_MODULE_BLACKLIST_H
 
 // Block the modules named in the `block_modules` param from loading by merging
-// them into the kernel's native `module_blacklist`. Call once at init, after
-// the symbol resolver is up and before vendor modules are loaded.
-void ksu_module_blacklist_init(void);
+// them into the kernel's native `module_blacklist`. Call when second stage init
+// starts: a module that fails to load in first stage init is fatal, see the
+// implementation. Only the first call has an effect.
+void ksu_module_blacklist_apply(void);
 
 // Teardown hook. Intentionally keeps the merged list installed; see the
 // implementation for why the pointer is not restored.

kernel/runtime/ksud_integration.c

@@ -26,6 +26,7 @@
 #include "runtime/ksud.h"
 #include "runtime/ksud_boot.h"
 #include "policy/feature.h"
+#include "feature/module_blacklist.h"
 #include "selinux/selinux.h"
 #include "hook/syscall_hook.h"
 #include "hook/syscall_event_bridge.h"
@@ -167,6 +168,9 @@ void ksu_handle_execveat_ksud(const char *path, struct user_arg_ptr *argv)
             setup_ksu_cred();
             // after apply_kernelsu_rules, so that selinux_hide has its sepolicy backup
             ksu_feature_apply_forced();
+            // Not earlier: a blocked module failing to load in first stage
+            // init is fatal, ksuinit uses modules.blocklist for that instead.
+            ksu_module_blacklist_apply();
             init_second_stage_executed = true;
         }
     }

manager/app/src/main/java/me/weishu/kernelsu/ui/util/KsuCli.kt

@@ -612,11 +612,17 @@ private val KNOWN_BLOCKABLE_MODULES = listOf(
 
 // Return the known anti-root modules currently loaded on this device (per
 // /proc/modules), so the install screen can pre-fill only the relevant ones.
+// Modules other modules use are left out: blocking one keeps its users from
+// loading as well, so ksuinit refuses to block it in first stage anyway.
 suspend fun getLoadedBlockableModules(): List<String> = withContext(Dispatchers.IO) {
     val shell = getRootShell()
     val out = shell.newJob().add("cat /proc/modules").to(ArrayList(), null).exec().out
-    val loaded = out.mapNotNull { it.trim().substringBefore(' ').takeIf(String::isNotBlank) }.toHashSet()
-    KNOWN_BLOCKABLE_MODULES.filter { it in loaded }
+    // <name> <size> <refcount> <used by, or "-"> <state> <address>
+    val unused = out.mapNotNull { line ->
+        val fields = line.trim().split(Regex("\\s+"))
+        fields.getOrNull(0)?.takeIf { fields.getOrNull(3) == "-" }
+    }.toHashSet()
+    KNOWN_BLOCKABLE_MODULES.filter { it in unused }
 }
 
 fun hasMagisk(): Boolean {

manager/app/src/main/res/values-zh-rCN/strings.xml

@@ -287,7 +287,7 @@
     <string name="enable_adb">启动时强制启用 ADB 调试</string>
     <string name="enable_adb_summary">强制允许 USB 调试并取消 adb 认证，非必要请勿开启！</string>
     <string name="install_block_modules">屏蔽内核模块（风险）</string>
-    <string name="install_block_modules_warning">启动时阻止所列内核模块加载。屏蔽系统依赖的模块可能导致卡开机 logo 或反复重启（例如部分联发科机型上的 mkp）。请仅在确认这些模块在你的设备上可以安全屏蔽时启用。如无法开机，可通过 fastboot 刷回原厂 boot / init_boot 镜像恢复。</string>
+    <string name="install_block_modules_warning">启动时阻止所列内核模块加载。被其他开机模块依赖的模块会保留加载，但屏蔽系统需要的模块仍可能导致功能异常或卡开机。请仅在确认这些模块在你的设备上可以安全屏蔽时启用。如无法开机，可通过 fastboot 刷回原厂 boot / init_boot 镜像恢复。</string>
     <string name="install_block_modules_list">要屏蔽的模块</string>
     <string name="install_block_modules_summary">以逗号分隔的模块名，启动时阻止其加载，例如 oplus_secure_guard。留空则不屏蔽任何模块。</string>
     <string name="install_block_modules_invalid">模块名只能包含字母、数字和下划线，且每个不超过 64 个字符。</string>

manager/app/src/main/res/values/strings.xml

@@ -307,7 +307,7 @@
     <string name="enable_adb">Force enable adb on boot</string>
     <string name="enable_adb_summary">Force enable USB debugging and disable adb authentication. Do not enable this unless absolutely necessary.</string>
     <string name="install_block_modules">Block kernel modules (risky)</string>
-    <string name="install_block_modules_warning">Stop the listed kernel modules from loading at boot. Blocking a module the system depends on can make the device hang on the boot logo or bootloop (e.g. MediaTek mkp on some devices). Only enable this if you know the modules are safe to block on your device. To recover, flash the stock boot / init_boot image with fastboot.</string>
+    <string name="install_block_modules_warning">Stop the listed kernel modules from loading at boot. Modules that other boot-time modules depend on are left loaded, but blocking a module the system needs can still break features or hang the boot. Only enable this if you know the modules are safe to block on your device. To recover, flash the stock boot / init_boot image with fastboot.</string>
     <string name="install_block_modules_list">Modules to block</string>
     <string name="install_block_modules_summary">Comma-separated module names to stop from loading at boot, e.g. oplus_secure_guard. Leave empty to block nothing.</string>
     <string name="install_block_modules_invalid">Module names may contain only letters, digits and underscores, each at most 64 characters.</string>