Index: UPDATING
===================================================================
--- UPDATING
+++ UPDATING
@@ -31,6 +31,13 @@
 	disable the most expensive debugging functionality run
 	"ln -s 'abort:false,junk:false' /etc/malloc.conf".)
 
+20180827:
+	The legacy DRM modules and drivers have now been added to the loader's
+	module blacklist, in favor of loading them with kld_list in rc.conf(5).
+	The module blacklist may be overridden with the loader.conf(5)
+	'module_blacklist' variable, but loading them via rc.conf(5) is strongly
+	encouraged.
+
 20180826:
 	The Yarrow CSPRNG has been removed from the kernel as it has not been
 	supported by its designers since at least 2003. Fortuna has been the
Index: stand/defaults/loader.conf
===================================================================
--- stand/defaults/loader.conf
+++ stand/defaults/loader.conf
@@ -92,6 +92,7 @@
 #console="vidconsole"		# A comma separated list of console(s)
 #currdev="disk1s1a"		# Set the current device
 module_path="/boot/modules;/boot/dtb;/boot/dtb/overlays"	# Set the module search path
+module_blacklist="drm drm2 radeonkms i915kms amdgpu"	# Loader module blacklist
 #prompt="\\${interpret}"	# Set the command prompt
 #root_disk_unit="0"		# Force the root disk unit number
 #rootdev="disk1s1a"		# Set the root filesystem
Index: stand/defaults/loader.conf.5
===================================================================
--- stand/defaults/loader.conf.5
+++ stand/defaults/loader.conf.5
@@ -23,7 +23,7 @@
 .\" SUCH DAMAGE.
 .\"
 .\" $FreeBSD$
-.Dd March 23, 2018
+.Dd August 26, 2018
 .Dt LOADER.CONF 5
 .Os
 .Sh NAME
@@ -147,6 +147,13 @@
 If set to
 .Dq YES ,
 module names will be displayed as they are loaded.
+.It Ar module_blacklist
+Blacklist of modules.
+Modules specified in the blacklist may not be loaded directly with a
+.Ar *_load
+directive, defined below.
+Blacklisted modules may still be loaded indirectly as dependencies of other
+modules.
 .It Ar *_load
 If set to
 .Dq YES ,
Index: stand/lua/config.lua
===================================================================
--- stand/lua/config.lua
+++ stand/lua/config.lua
@@ -54,6 +54,7 @@
 local MSG_XENKERNLOADING = "Loading Xen kernel..."
 local MSG_KERNLOADING = "Loading kernel..."
 local MSG_MODLOADING = "Loading configured modules..."
+local MSG_MODBLACKLIST = "Not loading blacklisted module '%s'"
 local MSG_MODLOADFAIL = "Could not load one or more modules!"
 
 local MODULEEXPR = '([%w-_]+)'
@@ -265,20 +266,37 @@
 	return true
 end
 
+local function getBlacklist()
+	local blacklist_str = loader.getenv('module_blacklist')
+	if blacklist_str == nil then
+		return nil
+	end
+
+	local blacklist = {}
+	for mod in blacklist_str:gmatch("[;, ]?([%w-_]+)[;, ]?") do
+		blacklist[mod] = true
+	end
+	return blacklist
+end
+
 local function loadModule(mod, silent)
 	local status = true
+	local blacklist = getBlacklist()
 	local pstatus
 	for k, v in pairs(mod) do
 		if v.load ~= nil and v.load:lower() == "yes" then
+			local module_name = v.name or k
+			if blacklist[module_name] ~= nil then
+				if not silent then
+					print(MSG_MODBLACKLIST:format(module_name))
+				end
+				goto continue
+			end
 			local str = "load "
 			if v.type ~= nil then
 				str = str .. "-t " .. v.type .. " "
 			end
-			if v.name ~= nil then
-				str = str .. v.name
-			else
-				str = str .. k
-			end
+			str = str .. module_name
 			if v.flags ~= nil then
 				str = str .. " " .. v.flags
 			end
@@ -309,6 +327,7 @@
 			end
 
 		end
+		::continue::
 	end
 
 	return status