gki_ksu_workflow

KO | EN

gitlite — search

#mysql #terminal #claude-code #editor #swift #chatbot #web #react #automation #git

gki_ksu_workflow

(★ 9)

GKI Kernel Builder — Multi-Variant KernelSU with SUSFS. Fast native make builds, ditching bloated Kleaf/Bazel.

File Explorer

ZIP Download

- - kernel_versions.json
- - 55_try_umount_for_susfs.patch
  - unicode_bypass_fix_6.1+.patch
  - unicode_bypass_fix_6.1-.patch
- - bootstrap_toolchains.sh
  - check_cve.sh
  - check_updates.sh
  - setup_ksu.sh
  - susfs_deinlined.sh
- - build-kernel.yml
  - build.yml
  - cleanup-runs.yml
  - cleanup-tags.yml
  - update.yml
- dependabot.yml
LICENSE
README.md
README_CN.md
README_JP.md
README_KO.md
SECURITY.md

# Use via CDN

jsDelivr

jsDelivr serves any public GitHub repository as a CDN with zero setup. Pick a version and a file to get a ready-to-paste link and snippet.

Version

File

Link

Example

# Project Badges

License
Last Commit
Release
Android
Kernel
Architecture
CI

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

🌐 [English](README.md) &nbsp;|&nbsp; [简体中文](README_CN.md) &nbsp;|&nbsp; [日本語](README_JP.md) &nbsp;|&nbsp; [한국어](README_KO.md)

</div>

*Automated GitHub Actions CI/CD pipeline for compiling and distributing GKI kernels.*

</div>

---

## 🚀 Overview

This repository implements a unified, config-driven build orchestration system that compiles multiple **KernelSU** variants across multiple kernel versions from a single workflow trigger. Each variant is encapsulated within its own isolated job, maximizing maintainability, simplifying fault isolation, and enabling seamless horizontal scaling for future variants and kernel versions.

---

## ⚙️ Configuration

All kernel version-specific settings are centralized in [`.github/config/kernel_versions.json`](.github/config/kernel_versions.json). A single `kernel_version` input at workflow dispatch drives the entire build matrix — including Kernel version, Sublevel, Compiler, Rust availability, and AnyKernel3 branch selection.

> [!NOTE]
> **Kernel 6.12.23 Deprecation:** Commit [`650419b`](https://github.com/midori01/gki_ksu_workflow/commit/650419be4e0f4d976aa5f57bbfc9982d8bf130ed) removed the [deprecated](https://android.googlesource.com/kernel/common/+/refs/heads/deprecated/android16-6.12-2025-06) `android16-6.12-2025-06` branch from the default build matrix. If you still need this version, simply revert that commit (`git revert 650419b`). If you require other kernel versions or revisions, feel free to edit [`.github/config/kernel_versions.json`](.github/config/kernel_versions.json) directly.

---

## 📦 Build Variants

| Variant | SUSFS | Droidspaces | Hook Type |
| :--- | :---: | :---: | :--- |
| [MidoriSU-KX](https://github.com/KOWX712/KernelSU) | ❌ | ❌ | `Kprobes` |
| [MidoriSU-KX-DS](https://github.com/KOWX712/KernelSU) | ❌ | ✅ | `Kprobes` |
| [MidoriSU-KX-SUSFS](https://github.com/KOWX712/KernelSU) | ✅ | ❌ | `De-inlined` |
| [MidoriSU-KX-SUSFS-DS](https://github.com/KOWX712/KernelSU) | ✅ | ✅ | `De-inlined` |
| [MidoriSU-NX](https://github.com/KernelSU-Next/KernelSU-Next) | ❌ | ❌ | `Tracepoint` |
| [MidoriSU-NX-DS](https://github.com/KernelSU-Next/KernelSU-Next) | ❌ | ✅ | `Tracepoint` |
| [MidoriSU-NX-SUSFS](https://github.com/KernelSU-Next/KernelSU-Next) | ✅ | ❌ | `De-inlined` |
| [MidoriSU-NX-SUSFS-DS](https://github.com/KernelSU-Next/KernelSU-Next) | ✅ | ✅ | `De-inlined` |
| [MidoriSU-OX](https://github.com/tiann/KernelSU) | ❌ | ❌ | `Kprobes` |
| [MidoriSU-OX-DS](https://github.com/tiann/KernelSU) | ❌ | ✅ | `Kprobes` |
| [MidoriSU-OX-SUSFS](https://github.com/tiann/KernelSU) | ✅ | ❌ | `De-inlined` |
| [MidoriSU-OX-SUSFS-DS](https://github.com/tiann/KernelSU) | ✅ | ✅ | `De-inlined` |
| [MidoriSU-RX](https://github.com/ReSukiSU/ReSukiSU) | ❌ | ❌ | `Manual` |
| [MidoriSU-RX-DS](https://github.com/ReSukiSU/ReSukiSU) | ❌ | ✅ | `Manual` |
| [MidoriSU-RX-SUSFS](https://github.com/ReSukiSU/ReSukiSU) | ✅ | ❌ | `De-inlined` |
| [MidoriSU-RX-SUSFS-DS](https://github.com/ReSukiSU/ReSukiSU) | ✅ | ✅ | `De-inlined` |
| [MidoriSU-XX](https://github.com/backslashxx/KernelSU) | ❌ | ❌ | `Branch Link` |
| [MidoriSU-XX-DS](https://github.com/backslashxx/KernelSU) | ❌ | ✅ | `Branch Link` |
| [MidoriSU-XX-SUSFS](https://github.com/backslashxx/KernelSU) | ✅ | ❌ | `De-inlined` |
| [MidoriSU-XX-SUSFS-DS](https://github.com/backslashxx/KernelSU) | ✅ | ✅ | `De-inlined` |

> \* **MidoriSU-RX & MidoriSU-XX Hook Type:** Runtime-configurable via `midorisu_rx_hook_mode` and `midorisu_xx_hook_mode`.
> - `midorisu_rx_hook_mode` — `manual` (default) / `tracepoint`
> - `midorisu_xx_hook_mode`:
>   - `branch link hijacking` — default for MidoriSU-XX; uses `CONFIG_KSU_HACK_ARM64_BRANCH_LINK` to scan kernel text and overwrite call-site branch instructions (`b`/`bl`) directly to hooks, bypassing trampoline overhead and complying with ARM64 CFI
>   - `syscall table tampering` — uses `CONFIG_KSU_TAMPER_SYSCALL_TABLE` to directly tamper with `sys_call_table` entries, avoiding indirect branch (`blr`) overhead while complying with Clang CFI
>   - `manual` — manually-patched hooks via `scope-min-manual-hooks-v2.3.patch`

> [!TIP]
> **Matrix Build Orchestration:** The matrix always produces exactly **1 artifact per variant** — the enabled features (Droidspaces and/or SUSFS) are applied to that single artifact. With all 5 variants selected, this yields **5 builds per sublevel for each kernel version**. Choosing `all` from the `kernel_version` dropdown compiles all configured sublevels across 6.1, 6.6 and 6.12 in parallel for a total of **40 concurrent jobs**.

---

## 📱 MidoriSU Manager

[**MidoriSU**](https://github.com/midori01/KernelSU) is the official companion app for all MidoriSU kernel variants. Heavily customized and expanded based on [**KowSU**](https://github.com/KOWX712/KernelSU), it offers seamless out-of-the-box compatibility across the entire MidoriSU family — **KX, NX, OX, RX, XX** — including all SUSFS and Droidspaces combinations.

| Feature | Description |
| :--- | :--- |
| **Homepage Overview** | Modernized dashboard status card: dynamically displays KSU driver name (native driver name & dynamic LKM detection), hook type, SUSFS version, Droidspaces version, Re:Kernel(-X) version, kernel build timestamp, and OEM unlock status. |
| **Dual Themes & Personalization** | Seamlessly supports both Material 3 Expressive and Miuix UI themes with live preview cards; includes a built-in switcher to toggle between **MidoriSU**, **KowSU**, and **Official KernelSU** app names, icons, and splash themes. |
| **Flashing & Partition Tools** | Direct in-app backup and flashing of `boot.img`, as well as flashing AnyKernel3 zip packages with target slot selection (Slot A/B). |
| **Allowlist Backup & Restore** | Complete backup and restoration for Superuser allowlist rules and per-app profile configurations. |
| **Module Export as ZIP** | Export any installed module directly into a standard flashable ZIP archive. |
| **Kernel Module (LKM) Manager** | Inspect loaded kernel modules with support for dynamic loading and unloading. |
| **Kernel Diagnostics** | In-app inspection, searching, and sharing for `/proc/kallsyms` symbol table, live dmesg kernel logs, and `CONFIG_*` kernel compile options. |
| **Toggles & Integrations** | Instant SELinux mode switching (Enforcing / Permissive), integrated SUSFS WebUI shortcut, and KSU driver update check toggle. |

---

## 🔧 Hook Type Reference

| Type | Mechanism & Characteristics |
| :--- | :--- |
| `Kprobes` | Dynamically instruments kernel functions at runtime via kprobe breakpoints. Minimal kernel footprint, broad compatibility. |
| `Tracepoint` | Hooks into the kernel's static syscall tracepoint infrastructure (`sys_enter`/`sys_exit`) without modifying kernel source. |
| `Inline` | Compile-time injection via `#ifdef CONFIG_KSU_SUSFS` blocks embedded directly into kernel subsystem source. Uses `static_key` branches for runtime toggling. No reliance on kprobes or LSM hooks. Hardwired into VFS (`exec`, `open`, `stat`, `readdir`, `statfs`), SELinux (`avc`, `hooks`, `services`), input, mounts, and procfs. |
| `De-inlined` | SUSFS hooks applied via kernel source patching rather than inline `#ifdef CONFIG_KSU_SUSFS` blocks. Cleaner separation of SUSFS logic from core kernel subsystems. |
| `Manual` | Static kernel source patching. Custom hooks injected at compile time into core kernel subsystems. |
| `Branch Link Hijacking` | Scans kernel text to overwrite caller branch instructions (`b`/`bl`) directly to hooks without trampoline overhead. Complies with ARM64 Clang CFI. Enabled via `CONFIG_KSU_HACK_ARM64_BRANCH_LINK`. |
| `Syscall Table Tampering` | High-performance method that directly modifies function pointers in `sys_call_table` for sucompat and `sys_reboot`. Avoids indirect branch (`blr`) overhead and complies with Clang CFI. Enabled via `CONFIG_KSU_TAMPER_SYSCALL_TABLE`. |

---

## 🧩 Additional Features

| Feature | Description |
| :--- | :--- |
| **Kernel Version** | Select `6.1`, `6.6`, `6.12`, or `all` to compile one or all kernel versions. Sublevel, revision, compiler, and Rust settings are auto-resolved from the centralized config. |
| **Source Mirror** | Choose between Google's official AOSP mirror or a self-hosted mirror for kernel source and toolchain downloads. |
| **SUSFS Module** | When SUSFS is enabled, automatically fetches the latest [susfs4ksu-module](https://github.com/sidex15/susfs4ksu-module) and attaches it to the release. A single `susfs_commit` input controls SUSFS versions across variants. |
| **KSU Toolkit** | Automatically fetches the latest [ksu_toolkit](https://github.com/backslashxx/ksu_toolkit) module from nightly.link and attaches it to the release. |
| **Droidspaces** | Container support via [Droidspaces-OSS](https://github.com/ravindu644/Droidspaces-OSS) — SYSVIPC, IPC_NS, PID_NS, DEVTMPFS, NTSync, and networking. Enabled per-variant through the `use_droidspaces` toggle. |
| **Re:Kernel(-X)** | Integrated [Re:Kernel](https://github.com/Sakion-Team/Re-Kernel) and [Re:Kernel-X](https://github.com/myflavor/ReKernel-X) modules compiled directly into the kernel. Provides tombstone freeze recovery, network-triggered unfreeze, and binder async cleanup. Toggled via `use_rekernel` switch. |
| **Unicode Bypass Fix** | Always enabled. Patches kernel unicode normalization to prevent filesystem bypass attacks via non-standard unicode encodings. |
| **ADIOS I/O Scheduler** | Optionally integrates [ADIOS](https://github.com/firelzrd/adios) as the built-in default multi-queue I/O scheduler for kernels. Enabled through the `use_adios` toggle. |
| **LZ4/ZSTD ZRAM backends** | Optionally updates the kernel's LZ4 and ZSTD implementations from the official LZ4 1.10.0 and Zstandard 1.5.7 releases, with ZRAM backend support enabled for kernel 6.12 (only tested on 6.12.23). Controlled by the `use_lz4_zstd` toggle; 6.1 and 6.6 builds remain unchanged. |
| **Ccache** | Compiler cache integration with a 60-second wait guard for dependency installation, ensuring robust accelerated incremental rebuilds across workflow runs. |
| **Spoofed Build Metadata** | Customizable `kernel name`, `build timestamp`, `user`, and `host` strings for the compiled image. |

---

## ✅ Tested Devices

The following devices have been confirmed to work with kernels built by this workflow:

> [!NOTE]
> **Compatibility Notes:**
> - All listed devices run Android 16+ with GKI kernels (6.1/6.6/6.12)
> - SUSFS and Droidspaces features have been tested on all device families
> - Users on stock ROMs are advised to flash the kernel via MidoriSU Manager or Kernel Flasher

> [!TIP]
> **Have a device not listed?**  
> If you've successfully tested a kernel on your device, feel free to open an issue or pull request to have it added to this list!

---

gki_ksu_workflow

Owner Repos

File Explorer

# Use via CDN

# Project Badges

Was this content helpful?

Recent Feedback

gki_ksu_workflow

Owner Repos

File Explorer

# Use via CDN

# Project Badges

Was this content helpful?

Recent Feedback

Download README