docs: add per-feature documentation and move release notes to dynamic rendering

Add a docs/ directory with per-feature markdown files (SUSFS, BBG, DroidSpaces,
Networking, NTSync, TMPFS, BPF, Ptrace, Unicode, Performance, DroidSpaces-OSS)
linked from a central docs/index.md. README updated to reference the new docs.

Replace the static .github/config/RELEASE_NOTES.md template with a dynamic
renderer (.github/scripts/render_release_body.py) that assembles release notes
from workflow environment variables and git metadata — no template file needed.
Workflow call sites updated to call the script without a template path.

.github/config/RELEASE_NOTES.md

@@ -1,149 +0,0 @@
-# Wild Kernels for GKI2 Devices 5.10+ Release #
-
-**IMPORTANT DISCLAIMER**
-
-> [!CAUTION]
-> This software is provided for testing and educational purposes only. Use at your own risk. The developers are not responsible for any damage, data loss, or issues that may occur. Please ensure you have proper backups before installation.
-
-Join the telegram here: https://t.me/WildKernelsTG
-
-# Features
-- [KernelSU-Next](#kernelsu-next)
-- [SUSFS v2.2.0](#susfs-v220)
-- [Baseband Guard (BBG)](#baseband-guard-bbg)
-- [DroidSpaces-OSS](#droidspaces-oss)
-- [Networking Improvements](#networking)
-- [NTSync](#ntsync)
-- [Misc](#misc)
-
-<!-- NOTE: The anchor links above match GitHub's auto-generated heading IDs (derived from heading text). Do NOT add explicit {#id} heading attributes: GitHub's release-notes renderer does not support them and renders them as literal text. -->
-
-## [KernelSU-Next](https://github.com/pershoot/KernelSU-Next)
-
-A kernel-based root solution for Android devices.
-
-> [!WARNING]
-> This release uses the [pershoot/KernelSU-Next](https://github.com/pershoot/KernelSU-Next) fork. The fork maintainer has said it is not ready for production use, so treat it as use at your own risk.
-
-**Manager:** [build-manager run]({{KSU_MANAGER}}) — {{KSU_MANAGER_NOTE}}
-
-> [!IMPORTANT]
-> For best compatiblity ensure your Manager Version and Kernel Version match eg. 30100 = 30100.
-
-**Version**  
-`{{KSU_VERSION}}`
-
-**Tag**  
-`{{KSU_GIT_TAG}}`
-
-**Branch**  
-`{{KSUN_BRANCH}}`
-
-**Commit**  
-`{{KSUN_COMMIT}}`
-
-## [SUSFS v2.2.0](https://gitlab.com/simonpunk/susfs4ksu)
-
-A KSU addon for hiding root using kernel patches and a userspace module!
-
-Reccomended Module: [susfs4ksu-module by sidex15](https://github.com/sidex15/susfs4ksu-module)
-
-- SUS_PATH - Hide suspicious paths: hides the user-defined path and all its sub-paths from various system calls. Use `add_sus_path_loop` instead of `add_sus_path` if the path is frequently modified. Caution: may cause performance loss and is vulnerable to side-channel attacks. Effective only on zygote-spawned user app processes with uid >= 10000
-- SUS_MOUNT - Hide suspicious mounts (no CLI support): assigns fake mnt_id/mnt_group_id to mounts mounted by the ksu process until /sdcard is decrypted (evades mnt_id/mnt_group_id gap detections), and hides all sus mounts from `/proc/self/[mounts|mountinfo|mountstat]` for non-su processes
-- SUS_KSTAT - Spoof kernel statistics: spoofs the kstat of user-defined files/directories. Effective only on zygote-spawned user app processes with uid >= 10000
-- SPOOF_UNAME - Kernel version spoofing: spoofs the string returned by the uname syscall to a user-defined string. Effective on all processes
-- ENABLE_LOG - Susfs kernel logging: logs susfs events to the kernel log; uncheck to completely disable all susfs log
-- HIDE_KSU_SUSFS_SYMBOLS - Hide ksu/susfs symbols: automatically hides ksu and susfs symbols from `/proc/kallsyms`. Effective on all processes
-- SPOOF_CMDLINE_OR_BOOTCONFIG - Boot parameter spoofing: spoofs the output of `/proc/bootconfig` (GKI) or `/proc/cmdline` (non-GKI) with a user-defined file. Effective on all processes
-- OPEN_REDIRECT - File access redirection: redirects a target path to be opened with another user-defined path (both paths must exist before they can be added). Does NOT bypass detections by itself; SELinux permissions for both paths are the user's responsibility. Effective only on processes with a pre-defined uid scheme
-- SUS_MAP - Memory mapping protection: hides mmapped real files from `/proc/<pid>/[maps|smaps|smaps_rollup|map_files|mem|pagemap]`. No anon-memory support; does not hide inline/PLT hooks caused by the injected library itself; may not evade strong injection detection. Effective only on zygote-spawned unmounted user app processes with uid >= 10000
-- AVC_SPOOF - Spoof procfs avc denial logs (enabled at runtime via the sidex15 module — not a build-time Kconfig option)
-
-{{SUSFS_BRANCHES}}
-
-## [Baseband Guard (BBG)](https://github.com/vc-teahouse/Baseband-guard)
-
-A lightweight LSM (Linux Security Module) for the Android kernel, designed to block unauthorized writes to critical partitions/device nodes at the system level.
-
-## [DroidSpaces-OSS](https://github.com/ravindu644/Droidspaces-OSS)
-
-A lightweight, LXC-inspired container runtime for Android and Linux. Run full Linux distributions natively with zero performance penalty.
-
-## Networking
-
-- BBRv1 - Improved TCP congestion control
-- BBRv3 - Improved TCP congestion control — available for Android 12 (5.10) through Android 15 (6.6), Android 16 (6.12) coming soon
-- Wireguard - Built-in VPN support
-- IP Set & IPv6 NAT Support - Advanced firewall capabilities
-- TTL Target Support - Network packet manipulation
-- CAKE, fq, fq_codel - Traffic shaping and fair queuing for reduced lag and balanced bandwidth
-- connmark - Connection marking for packet classification
-- TCP congestion control - CUBIC, BIC, Westwood, and HTCP for optimized performance across different network conditions
-- CIFS - Network filesystem support (SMB/CIFS sharing)
-
-## Other Features
-
-- TMPFS_XATTR - Extended attributes for tmpfs (Mountify support)
-- TMPFS_POSIX_ACL - POSIX ACLs for tmpfs
-
-## [NTSync](#ntsync)
-
-Provide high-performance, low-latency synchronization primitives compatible with the Windows NT kernel API
-
-## [Misc](#misc)
-
-- Ptrace Leak Fix: For kernels < 5.16
-- Unicode Fix: Prevent path traversal and other detections using non-printable Unicode codepoints [Experimental]
-- BTF/eBPF Support: CONFIG_BTF, CONFIG_BPF_EVENTS, CONFIG_FUSE_BPF for debugging and eBPF tooling
-- TMPFS_XATTR: Extended attributes for tmpfs (Mountify support)
-- TMPFS_POSIX_ACL: POSIX ACLs for tmpfs
-
-## Changelog
-
-### This Release
-- Added BBRv3 — available for Android 12 (5.10) through Android 15 (6.6)
-- Added NTSync
-- Ptrace Leak Fix - For kernels < 5.16
-- Unicode Fix - Prevent path traversal and other detections using non-printable Unicode codepoints [Experimental]
-
-## Recommended Tools
-
-[Kernel Flasher](https://github.com/fatalcoder524/KernelFlasher)
-- Recommended flashing utility
-
-[PixelFlasher by badabing2005](https://github.com/badabing2005/PixelFlasher)
-- Pixel phone flashing GUI utility with features.
-
-## Installation Instructions
-
-### Prerequisites
-- Unlocked bootloader.
-- Backup your current boot image.
-- Have root access using Magisk / KernelSU / Apatch (Any forks).
-
-### Via Kernel Flasher
-Download the correct AnyKernel3 ZIP for your device.
-If you previously used another root method, clean it up first:
-a. Magisk: perform a complete uninstall after flashing the AnyKernel3 ZIP.
-b. KSU LKM (boot/init_boot/vendor_boot‑patched): Flash back the stock boot/init_boot/vendor_boot depending on what you patched.
-c. KSU GKI: if you are 100% sure you already flashed stock init_boot/boot/vendor_boot, no action is needed; otherwise, follow the same steps as KSU LKM.
-d. APatch: remove /data/adb contents to avoid leftover root conflicts after flashing the AnyKernel3 ZIP.
-Flash the ZIP to the active slot using Kernel Flasher.
-Install the KernelSU‑Next Manager APK, same version as mentioned in the release notes.
-Open the KernelSU‑Next app.
-Reboot the device if you performed any cleanup in step 2
-
-## Force Load Kernel Modules (Bypass) — flashing with `Bypass-Image`
-
-> [!IMPORTANT]
-> Most users do not need this. This option does not help bypass root-detection systems — it only replaces the kernel image used during flashing for compatibility workarounds.
-
-**How to enable:**
-- Set `do.flash_bypass=1`, in the anykernel.sh file within the AnyKernel3.zip. 
-
-**Behavior:**
-- If `do.flash_bypass=1` is set it will move `Bypass-Image` to replace the usual `Image` file prior to performing version checks and flashing.
-- If `do.flash_bypass=1` is set and `Bypass-Image` is not found, the installer will abort with an error to avoid accidental forced flashing of an unintended image.
-
-**Why / When to use:**
-- Use this only when a `Normal` flash fails to boot due to kernel module incompatibilities.

.github/scripts/render_release_body.py

@@ -1,192 +1,186 @@
+#!/usr/bin/env python3
+"""
+Render release notes dynamically from workflow environment variables.
+
+No static template file is read. The script assembles the markdown directly
+from env vars set by the workflow.
+
+Invoke without a template file argument:
+    python3 .github/scripts/render_release_body.py > release_body.md
+"""
+
 import json
 import os
-import sys
 from pathlib import Path
 
+ROOT = Path(os.environ.get("GITHUB_WORKSPACE", "."))
 
-PLACEHOLDERS = {
-    "{{KSU_VERSION}}": lambda: os.environ.get("KSU_VERSION", "unknown"),
-    "{{KSU_GIT_TAG}}": lambda: os.environ.get("KSU_GIT_TAG", "no-tag"),
-    "{{KSUN_BRANCH}}": lambda: os.environ.get("KSUN_BRANCH", "dev"),
-    "{{KSUN_COMMIT}}": lambda: os.environ.get("KSUN_COMMIT", "unknown"),
-    "{{KSU_MANAGER}}": lambda: os.environ.get("KSU_MANAGER", "Placeholder"),
-    "{{KSU_MANAGER_NOTE}}": lambda: os.environ.get("KSU_MANAGER_NOTE", ""),
-    "{{SUSFS_BRANCHES}}": lambda: os.environ.get("SUSFS_COMMIT", "latest on auto-derived gki-{version} branch"),
-    "{{SUSFS_BRANCHS}}": lambda: os.environ.get("SUSFS_COMMIT", "latest on auto-derived gki-{version} branch"),
-}
-
+def env(name: str, default: str = "") -> str:
+    return os.environ.get(name, default).strip()
 
-def build_managers_markdown(text: str) -> str:
-    raw = os.environ.get("MANAGER_LIST", "").strip()
+def parse_managers(raw: str):
+    raw = raw.strip()
     if not raw:
-        return text
+        return []
     try:
-        managers = json.loads(raw)
-    except Exception:
-        return text
-    if not isinstance(managers, list) or not managers:
-        return text
-    # Build markdown list for all selected managers
+        data = json.loads(raw)
+    except json.JSONDecodeError:
+        return []
+    if not isinstance(data, list):
+        return []
+    return data
+
+def build_preamble() -> str:
+    return (
+        "# Wild Kernels for GKI2 Devices\n\n"
+        "> [!CAUTION]\n"
+        "> This software is provided for testing and educational purposes only. "
+        "Use at your own risk. The developers are not responsible for any damage, "
+        "data loss, or issues that may occur. Please ensure you have proper backups "
+        "before installation.\n\n"
+        "Join the Telegram group: <https://t.me/WildKernelsTG>\n\n"
+        "---\n\n"
+    )
+
+def build_managers_section(managers) -> str:
+    if not managers:
+        return ""
     flavor_labels = {"next": "KernelSU-Next", "kernelsu": "KernelSU", "resukisu": "ReSukiSU"}
     lines = []
     for m in managers:
         flavor = m.get("flavor", "")
         label = flavor_labels.get(flavor, flavor or "unknown")
         run_id = m.get("run_id")
-        owner = m.get("owner", "")
-        repo = m.get("repo", "")
         stock = m.get("stock", "")
-        if run_id and owner and repo:
-            url = f"https://github.com/{owner}/{repo}/actions/runs/{run_id}"
-            note = f" — stock `{stock[:12]}`" if stock else ""
-            lines.append(f"- **{label}:** [build-manager run]({url}){note}")
+        if run_id:
+            url = f"https://github.com/{m.get('owner', '')}/{m.get('repo', '')}/actions/runs/{run_id}"
+            stock_note = f" (stock `{stock[:12]}`)" if stock else ""
+            lines.append(f"- **{label}:** [{url}]({url}){stock_note}")
         else:
-            lines.append(f"- **{label}** manager (no run ID)")
-    replacement = "**Managers:**\n" + "\n".join(lines)
-    # Replace the single-manager line in template
-    # Template has: **Manager:** [build-manager run]({{KSU_MANAGER}}) — {{KSU_MANAGER_NOTE}}
-    # Replace that whole line if present
-    import re
-    text = re.sub(r"\*\*Manager:\*\*.*\n", replacement + "\n", text, count=1)
-    return text
-
-
-def filter_sections(text: str) -> str:
-    # Map heading substring -> required env flag
-    # If flag is "false", that section is dropped.
-    flag_map = {
-        "SUSFS": os.environ.get("USE_SUSFS", "true") == "true",
-        "Baseband Guard": os.environ.get("USE_BBG", "true") == "true",
-        "BBG": os.environ.get("USE_BBG", "true") == "true",
-        "DroidSpaces": os.environ.get("USE_DS", "true") == "true",
-        "Networking": os.environ.get("USE_NET", "true") == "true",
-        "NTSync": os.environ.get("USE_NTSYNC", "true") == "true",
-        "Ptrace": os.environ.get("USE_PTRACE", "true") == "true",
-        "Unicode": os.environ.get("USE_UNICODE", "true") == "true",
-        "BPF": os.environ.get("USE_BPF", "true") == "true",
-    }
-    # Split keeping delimiters: first chunk is preamble before first ## 
-    parts = text.split("\n## ")
-    if len(parts) <= 1:
-        return text
-    kept = [parts[0]]
-    for part in parts[1:]:
-        heading_line = part.split("\n", 1)[0]
-        keep = True
-        for key, enabled in flag_map.items():
-            if key.lower() in heading_line.lower() and not enabled:
-                keep = False
-                break
-        # Also drop specific subsections inside Misc/Other Features if relevant
-        # For now only top-level headings filtered; keep is per heading.
-        if keep:
-            kept.append("## " + part)
-    return "\n".join(kept) if len(kept) > 1 else parts[0] + "\n## ".join(kept[1:])
-
-
-def inject_feature_summary(text: str) -> str:
-    feature_set = os.environ.get("FEATURE_SET", "").strip()
-    root_flavor = os.environ.get("ROOT_FLAVOR", "").strip()
-    if not feature_set and not root_flavor:
-        return text
-    summary_lines = []
-    if root_flavor:
-        summary_lines.append(f"**Root:** {root_flavor}")
+            lines.append(f"- **{label}:** release assets")
+    return "**Managers:**\n" + "\n".join(lines) + "\n"
+
+def build_ksu_section() -> str:
+    version = env("KSU_VERSION", "unknown")
+    tag = env("KSU_GIT_TAG", "no-tag")
+    branch = env("KSUN_BRANCH", "dev")
+    commit = env("KSUN_COMMIT", "unknown")
+    manager_url = env("KSU_MANAGER", "")
+    manager_note = env("KSU_MANAGER_NOTE", "")
+    parts = ["## KernelSU", ""]
+    parts.append(f"- **Version:** `{version}`")
+    if tag and tag != "no-tag":
+        parts.append(f"- **Tag:** `{tag}`")
+    parts.append(f"- **Branch:** `{branch}`")
+    parts.append(f"- **Commit:** `{commit}`")
+    if manager_url:
+        note = f" — {manager_note}" if manager_note else ""
+        base = manager_url.split("/actions/")[0]
+        parts.append(f"- **Manager:** [{base}]({manager_url}){note}")
+    parts.append("")
+    return "\n".join(parts)
+
+def build_susfs_section() -> str:
+    variant_envs = [
+        ("android12-5.10", "susfs_commit_android12_5_10"),
+        ("android13-5.10", "susfs_commit_android13_5_10"),
+        ("android13-5.15", "susfs_commit_android13_5_15"),
+        ("android14-5.15", "susfs_commit_android14_5_15"),
+        ("android14-6.1", "susfs_commit_android14_6_1"),
+        ("android15-6.6", "susfs_commit_android15_6_6"),
+        ("android16-6.12", "susfs_commit_android16_6_12"),
+    ]
+    per_variant = []
+    for variant, env_key in variant_envs:
+        sha = env(env_key)
+        if sha and len(sha) == 40:
+            per_variant.append((variant, sha))
+    if per_variant:
+        parts = [
+            "## SUSFS",
+            "",
+            "Pinned SUSFS commits per Android/kernel variant:",
+            "",
+        ]
+        for variant, sha in per_variant:
+            parts.append(f"- **{variant}:** `{sha}`")
+        parts.append("")
+        return "\n".join(parts)
+    sha = env("SUSFS_COMMIT", "")
+    if sha:
+        return f"## SUSFS\n\n- **Commit:** `{sha}`\n"
+    return ""
+
+def build_root_section() -> str:
+    root_flavor = env("ROOT_FLAVOR", "unknown")
+    feature_set = env("FEATURE_SET", "")
+    parts = ["## This Build", ""]
+    parts.append(f"- **Root:** `{root_flavor}`")
     if feature_set:
-        summary_lines.append(f"**Features:** {feature_set}")
-    # Insert after the Features anchor list or after disclaimer
-    summary = "> " + " | ".join(summary_lines) + "\n" if summary_lines else ""
-    # Find the Features anchor list end (line with <!-- NOTE:)
-    marker = "<!-- NOTE:"
-    if marker in text and summary:
-        text = text.replace(marker, summary + "\n" + marker, 1)
-    return text
-
-
-def render_markdown(template_path: Path):
-    text = template_path.read_text()
-
-    for placeholder, getter in PLACEHOLDERS.items():
-        text = text.replace(placeholder, getter())
-
-    text = build_managers_markdown(text)
-    text = inject_feature_summary(text)
-    text = filter_sections(text)
-
-    print(text, end="")
-
-
-config_path = Path(sys.argv[1])
-if config_path.suffix.lower() == ".md":
-    render_markdown(config_path)
-    sys.exit(0)
-
-# Backward-compatible JSON renderer for older release configs.
-
-def emit(text=""):
-    print(text)
-
-
-def emit_list(items):
-    if isinstance(items, list):
-        for item in items:
-            emit(f"- {item}")
-
-
-def emit_description(value):
-    if isinstance(value, list):
-        for line in value:
-            emit(line)
-    elif value:
-        emit(str(value))
-
-
-data = json.loads(config_path.read_text())
-
-emit("**IMPORTANT DISCLAIMER**")
-for line in data["release"]["disclaimer"]:
-    emit(line)
-
-kernelsu = data.get("kernelsu", {})
-emit()
-emit(f"## {kernelsu.get('name', 'KernelSU-Next')}")
-emit(f"- Version: {os.environ.get('KSU_VERSION', kernelsu.get('version', 'unknown'))}")
-emit(f"- Tag: {os.environ.get('KSU_GIT_TAG', kernelsu.get('tag', 'no-tag'))}")
-emit(f"- Branch: {os.environ.get('KSUN_BRANCH', kernelsu.get('branch', 'dev'))}")
-emit(f"- Commit: {os.environ.get('KSUN_COMMIT', kernelsu.get('commit', 'unknown'))}")
-if kernelsu.get("url"):
-    emit(f"- URL: {kernelsu['url']}")
-if kernelsu.get("manager"):
-    emit(f"- Manager: {kernelsu['manager']}")
-
-skip_keys = {"release", "kernelsu"}
-for key in data.keys():
-    if key in skip_keys:
-        continue
-
-    section = data[key]
-    emit()
-    emit(f"## {section.get('name', key)}")
-
-    if section.get("description"):
-        emit_description(section["description"])
-
-    if section.get("version"):
-        emit(f"- Version: {section['version']}")
-    if section.get("tag"):
-        emit(f"- Tag: {section['tag']}")
-    if section.get("branch"):
-        emit(f"- Branch: {section['branch']}")
-
-    if key == "susfs":
-        susfs_commit = os.environ.get("SUSFS_COMMIT", "")
-        if susfs_commit:
-            emit(f"- Commit: `{susfs_commit}`")
-        else:
-            emit("- Commit: latest on auto-derived gki-{version} branch")
-
-    if section.get("items"):
-        emit_list(section["items"])
-
-    if section.get("url"):
-        emit(f"- URL: {section['url']}")
+        parts.append(f"- **Feature Set:** `{feature_set}`")
+    parts.append("")
+    return "\n".join(parts)
+
+def build_features_section() -> str:
+    enabled = []
+    if env("USE_SUSFS", "true") == "true":
+        enabled.append("SUSFS")
+    if env("USE_BBG", "true") == "true":
+        enabled.append("Baseband Guard")
+    if env("USE_DS", "true") == "true":
+        enabled.append("DroidSpaces-OSS")
+    if env("USE_NET", "true") == "true":
+        enabled.append("Networking")
+    if env("USE_NTSYNC", "true") == "true":
+        enabled.append("NTSync")
+    if env("USE_PTRACE", "true") == "true":
+        enabled.append("Ptrace Leak Fix")
+    if env("USE_UNICODE", "true") == "true":
+        enabled.append("Unicode Fix")
+    if env("USE_BPF", "true") == "true":
+        enabled.append("BTF / eBPF / FUSE-BPF")
+    if env("USE_PERF", "true") == "true":
+        enabled.append("Performance Tuning")
+
+    if not enabled:
+        return ""
+
+    parts = [
+        "## Features Included",
+        "",
+        "Each feature is documented separately in `docs/`:",
+        "",
+    ]
+    feature_doc_map = [
+        ("SUSFS", "susfs.md"),
+        ("Baseband Guard", "bbg.md"),
+        ("DroidSpaces-OSS", "droidspaces.md"),
+        ("Networking", "networking.md"),
+        ("NTSync", "ntsync.md"),
+        ("Ptrace Leak Fix", "ptrace.md"),
+        ("Unicode Fix", "unicode.md"),
+        ("BTF / eBPF / FUSE-BPF", "bpf.md"),
+        ("Performance Tuning", "performance.md"),
+    ]
+    for feature, doc in feature_doc_map:
+        if feature in enabled:
+            parts.append(f"- [{feature}](docs/{doc})")
+    parts.append("")
+    return "\n".join(parts)
+
+def render() -> str:
+    parts = []
+    parts.append(build_preamble())
+    parts.append(build_root_section())
+    parts.append(build_ksu_section())
+    parts.append(build_susfs_section())
+    parts.append(build_managers_section(parse_managers(env("MANAGER_LIST", ""))))
+    parts.append(build_features_section())
+    return "\n".join(parts)
+
+if __name__ == "__main__":
+    output = render()
+    print(output, end="")
+    step_summary = os.environ.get("GITHUB_STEP_SUMMARY")
+    if step_summary:
+        Path(step_summary).write_text(output)

.github/workflows/main.yml

@@ -950,7 +950,6 @@ jobs:
 
     env:
       GH_TOKEN: ${{ github.token }}
-      RELEASE_NOTES: .github/config/RELEASE_NOTES.md
     outputs:
       new_tag: ${{ steps.tag.outputs.new_tag }}
     steps:
@@ -1147,10 +1146,9 @@ jobs:
       run: |
         set -e
 
-        RELEASE_NOTES_PATH="$RELEASE_NOTES"
         : > release_body.md
 
-        python3 .github/scripts/render_release_body.py "$RELEASE_NOTES_PATH" > release_body.md
+        python3 .github/scripts/render_release_body.py > release_body.md
 
     - name: Publish release notes preview
       run: |
@@ -1251,7 +1249,7 @@ jobs:
           # KSU version not computed here; render will show placeholder if release job skipped
         run: |
           set -e
-          python3 .github/scripts/render_release_body.py .github/config/RELEASE_NOTES.md > release_body.md
+          python3 .github/scripts/render_release_body.py > release_body.md
           {
             echo "## Release Notes Preview (CI Summary)"
             echo

.gitignore

@@ -2,4 +2,5 @@ testing/
 AIO-REJ/
 kernel-manifests/
 kernels/
-bbr/
+bbr/
+__pycache__/

README.md

@@ -33,6 +33,7 @@ By flashing this kernel, **YOU** are choosing to make these modifications. If so
 
 ## 🔗 Additional Resources
 
+- 📖 **[Kernel Features Documentation](docs/index.md)** — per-feature documentation
 - 🩹 [Kernel Patches](https://github.com/WildKernels/kernel_patches)
 - 📜 [Old Build Scripts](https://github.com/TheWildJames/kernel_build_scripts)
 - ⚡ [Kernel Flasher](https://github.com/fatalcoder524/KernelFlasher)

docs/bbg.md

@@ -0,0 +1,19 @@
+# Baseband Guard (BBG)
+
+Baseband Guard is a lightweight Linux Security Module (LSM) for the Android kernel, designed to block unauthorized writes to critical partitions and device nodes at the system level.
+
+## Source
+
+- **Upstream:** [vc-teahouse/Baseband-guard](https://github.com/vc-teahouse/Baseband-guard)
+
+## Purpose
+
+BBG protects critical baseband-related partitions and device nodes from unauthorized modifications. It operates at the kernel security module level, intercepting write operations to protected resources.
+
+## Build Integration
+
+When `use_bbg` is enabled in the build workflow, BBG is included in the kernel build. It is enabled by default.
+
+## Related
+
+- [index.md](../index.md) — full feature index

docs/bpf.md

@@ -0,0 +1,23 @@
+# BTF / eBPF / FUSE-BPF
+
+This kernel includes support for BTF (BPF Type Format), eBPF (extended Berkeley Packet Filter), and FUSE-BPF.
+
+## BTF (`CONFIG_BTF`)
+
+BTF provides type information for BPF programs, enabling better introspection and debugging of BPF-based features. BTF is also used by various kernel tooling and debugging facilities.
+
+## eBPF (`CONFIG_BPF_EVENTS`)
+
+eBPF allows sandboxed programs to run in the kernel without changing kernel source code or loading modules. `CONFIG_BPF_EVENTS` enables BPF programs to attach to kernel events for tracing, monitoring, and other purposes.
+
+## FUSE-BPF (`CONFIG_FUSE_BPF`)
+
+FUSE-BPF enables BPF programs to interact with FUSE (Filesystem in Userspace) filesystems. This is useful for BPF-based debugging and tooling that involves FUSE-mounted filesystems.
+
+## Build Integration
+
+These options are enabled via kernel configuration and are included when the `use_bpf` feature flag is set in the build workflow.
+
+## Related
+
+- [index.md](../index.md) — full feature index

docs/droidspaces.md

@@ -0,0 +1,19 @@
+# DroidSpaces-OSS
+
+DroidSpaces-OSS is a lightweight, LXC-inspired container runtime for Android and Linux, allowing full Linux distributions to run natively with zero performance penalty.
+
+## Source
+
+- **Upstream:** [ravindu644/Droidspaces-OSS](https://github.com/ravindu644/Droidspaces-OSS)
+
+## Purpose
+
+DroidSpaces provides container-like isolation for running Linux distributions on Android, using an LXC-inspired approach. It is designed to have minimal performance overhead.
+
+## Build Integration
+
+DroidSpaces-OSS patches are applied during the build workflow when `use_ds` is enabled. The source commit is resolved at the latest `main` branch tip at build time.
+
+## Related
+
+- [index.md](../index.md) — full feature index

docs/index.md

@@ -0,0 +1,67 @@
+# Kernel Features — Documentation Index
+
+Per-feature documentation for the GKI2 kernels built from this repository.
+
+## Root Implementations
+
+| Feature | Doc | Source |
+|---------|-----|--------|
+| KernelSU-Next | [kernelsu.md](kernelsu.md) | [KernelSU-Next/KernelSU-Next](https://github.com/KernelSU-Next/KernelSU-Next) |
+| KernelSU | [kernelsu.md](kernelsu.md) | [tiann/KernelSU](https://github.com/tiann/KernelSU) |
+| ReSukiSU | [kernelsu.md](kernelsu.md) | [ReSukiSU/ReSukiSU](https://github.com/ReSukiSU/ReSukiSU) |
+| NoMount | [nomount.md](nomount.md) | [maxsteeel/nomount](https://github.com/maxsteeel/nomount) |
+
+## Root Hiding & Security
+
+| Feature | Doc | Source |
+|---------|-----|--------|
+| SUSFS | [susfs.md](susfs.md) | [simonpunk/susfs4ksu](https://gitlab.com/simonpunk/susfs4ksu) |
+| Baseband Guard | [bbg.md](bbg.md) | [vc-teahouse/Baseband-guard](https://github.com/vc-teahouse/Baseband-guard) |
+
+## Kernel Modules & Compatibility
+
+| Feature | Doc | Source |
+|---------|-----|--------|
+| NTSync | [ntsync.md](ntsync.md) | Internal (synthesized from kernel feature set) |
+
+## Networking
+
+| Feature | Doc | Source |
+|---------|-----|--------|
+| TCP Congestion Control (BBRv1, BBRv3, CUBIC, BIC, Westwood, HTCP) | [networking.md](networking.md) | Upstream kernel |
+| WireGuard | [networking.md](networking.md) | [wireguard/wireguard-linux-compat](https://git.zx2c4.com/wireguard-linux-compat/) |
+| IP Set / IPv6 NAT | [networking.md](networking.md) | Upstream kernel |
+| Conntrack / connmark | [networking.md](networking.md) | Upstream kernel |
+| CIFS (SMB/CIFS) | [networking.md](networking.md) | Upstream kernel |
+| TTL Target | [networking.md](networking.md) | Upstream kernel |
+
+## Filesystem & Storage
+
+| Feature | Doc | Source |
+|---------|-----|--------|
+| TMPFS Extended Attributes | [tmpfs.md](tmpfs.md) | Upstream kernel |
+| TMPFS POSIX ACLs | [tmpfs.md](tmpfs.md) | Upstream kernel |
+
+## Debugging, Tracing & BPF
+
+| Feature | Doc | Source |
+|---------|-----|--------|
+| BTF / eBPF / FUSE-BPF | [bpf.md](bpf.md) | Upstream kernel |
+| Ptrace Leak Fix | [ptrace.md](ptrace.md) | Upstream kernel community |
+| Unicode Fix | [unicode.md](unicode.md) | Internal |
+
+## Performance
+
+| Feature | Doc | Source |
+|---------|-----|--------|
+| Performance Tuning | [performance.md](performance.md) | Upstream kernel |
+
+## Container Runtime
+
+| Feature | Doc | Source |
+|---------|-----|--------|
+| DroidSpaces-OSS | [droidspaces.md](droidspaces.md) | [ravindu644/Droidspaces-OSS](https://github.com/ravindu644/Droidspaces-OSS) |
+
+---
+
+**Release Notes** — for build-specific version/commit info, see the [release workflow](https://github.com/WildKernels/GKI_KernelSU_SUSFS/actions/workflows/main.yml) or the releases page.

docs/kernelsu.md

@@ -0,0 +1,38 @@
+# KernelSU / KernelSU-Next / ReSukiSU
+
+KernelSU is a root solution for Android GKI devices that operates in kernel mode and grants root permission to userspace applications directly from kernel space.
+
+This repository builds kernels that integrate KernelSU, KernelSU-Next, and ReSukiSU depending on the selected `root_flavor` at build time.
+
+## Source Locations
+
+| Implementation | Upstream Repository | Branch Used |
+|----------------|---------------------|-------------|
+| KernelSU-Next (manager) | [KernelSU-Next/KernelSU-Next](https://github.com/KernelSU-Next/KernelSU-Next) | `dev` |
+| KernelSU-Next (kernel with SUSFS) | [pershoot/KernelSU-Next](https://github.com/pershoot/KernelSU-Next) | `dev-susfs` (when SUSFS enabled) |
+| KernelSU (classic) | [tiann/KernelSU](https://github.com/tiann/KernelSU) | `main` |
+| ReSukiSU | [ReSukiSU/ReSukiSU](https://github.com/ReSukiSU/ReSukiSU) | `main` |
+
+## Manager
+
+Each root implementation ships its own KernelSU Manager APK. The manager must match the kernel version for full compatibility.
+
+- **KernelSU-Next manager:** built from the official `KernelSU-Next/KernelSU-Next` repo at `dev`-tip.
+- **KernelSU manager:** built from `tiann/KernelSU`.
+- **ReSukiSU manager:** built from `ReSukiSU/ReSukiSU`.
+
+## Version Compatibility
+
+Ensure the manager version and the kernel version match. For example, if the kernel reports version `30100`, use manager version `30100`.
+
+## SUSFS Integration
+
+When `use_susfs` is enabled, KernelSU-Next kernels are sourced from the `pershoot/KernelSU-Next` fork on the `dev-susfs` branch. Classic KernelSU and ReSukiSU get SUSFS patches applied during the build workflow.
+
+For more on the root-hiding side of SUSFS, see [susfs.md](susfs.md).
+
+## Related
+
+- [susfs.md](susfs.md) — root hiding add-on
+- [nomount.md](nomount.md) — NoMount metamodule
+- [index.md](../index.md) — full feature index

docs/networking.md

@@ -0,0 +1,46 @@
+# Networking Features
+
+This kernel includes a range of networking features and improvements, covering congestion control, VPN support, firewall capabilities, and traffic shaping.
+
+## Congestion Control
+
+| Algorithm | Description |
+|-----------|-------------|
+| **BBRv1** | Improved TCP congestion control. |
+| **BBRv3** | Improved TCP congestion control. Available for Android 12 (5.10) through Android 15 (6.6); Android 16 (6.12) support coming soon. |
+| **CUBIC** | Default TCP congestion control for many Linux systems. |
+| **BIC** | Binary Increase Congestion control. |
+| **Westwood** | TCP congestion control optimized for heterogeneous networks. |
+| **HTCP** | H-TCP congestion control. |
+
+## VPN Support
+
+- **WireGuard** — Built-in VPN support via the WireGuard kernel module.
+
+## Firewall & NAT
+
+- **IP Set** — Advanced firewall capabilities via ip_set.
+- **IPv6 NAT** — NAT support for IPv6.
+- **TTL Target** — Network packet manipulation via TTL targeting.
+
+## Traffic Shaping & Fair Queuing
+
+- **CAKE** — Common Applications Kept Enhanced; a full-featured queue discipline.
+- **fq** — Fair Queue packet scheduler.
+- **fq_codel** — Fair Queuing with Controlled Delay.
+
+## Connection Marking
+
+- **connmark** — Connection marking for packet classification.
+
+## Filesystem Support
+
+- **CIFS** — Network filesystem support for SMB/CIFS sharing.
+
+## Build Integration
+
+Most networking features are upstream kernel configurations enabled in the kernel config for each Android/kernel variant. BBRv3 backports are applied as patches for specific Android/kernel versions.
+
+## Related
+
+- [index.md](../index.md) — full feature index

docs/nomount.md

@@ -0,0 +1,26 @@
+# NoMount
+
+NoMount is a metamodule for the Android kernel that provides mount-related functionality used alongside root implementations.
+
+This repository builds a flashable NoMount metamodule from the pinned NoMount source commit and uploads it as a separate artifact alongside the kernel build.
+
+## Source
+
+- **Repository:** [maxsteeel/nomount](https://github.com/maxsteeel/nomount)
+- **Branch:** `dev`
+
+## Build Integration
+
+NoMount is resolved either at a pinned verified commit (when `commit_mode=verified`) or at the latest `dev` branch tip (when `commit_mode=latest` or `update`).
+
+The build workflow:
+1. Clones the NoMount source at the resolved commit.
+2. Builds the metamodule archive from that commit.
+3. Uploads the metamodule as `NoMount-Metamodule`.
+
+The kernel and metamodule revisions must match exactly. The NoMount integration invokes the upstream `kernel/setup.sh` by its full immutable commit URL and passes that same SHA as the script argument.
+
+## Related
+
+- [kernelsu.md](kernelsu.md) — root implementation
+- [index.md](../index.md) — full feature index

docs/ntsync.md

@@ -0,0 +1,17 @@
+# NTSync
+
+NTSync provides high-performance, low-latency synchronization primitives compatible with the Windows NT kernel API.
+
+It is included in builds from this repository when the corresponding feature flag is enabled.
+
+## Purpose
+
+NTSync brings Windows-compatible synchronization primitives (such as those used by NT kernel objects) to the Android kernel, which can be useful for compatibility with software expecting Windows-style synchronization behavior.
+
+## Build Integration
+
+NTSync is enabled via the `use_ntsync` feature flag in the build workflow. It is enabled by default.
+
+## Related
+
+- [index.md](../index.md) — full feature index

docs/performance.md

@@ -0,0 +1,15 @@
+# Performance Tuning
+
+This kernel includes performance-related tuning and options.
+
+## Features
+
+Performance tuning may include various kernel configuration options and optimizations aimed at improving system responsiveness and throughput.
+
+## Build Integration
+
+Performance-related features are enabled via the `use_perf` feature flag in the build workflow. This flag is disabled by default.
+
+## Related
+
+- [index.md](../index.md) — full feature index

docs/ptrace.md

@@ -0,0 +1,15 @@
+# Ptrace Leak Fix
+
+Applicable to kernels older than 5.16, this fix addresses a ptrace-related information leak.
+
+## Purpose
+
+On kernels older than 5.16, a ptrace-related information leak may be present. This fix patches the kernel to close that leak, improving security for systems using ptrace.
+
+## Build Integration
+
+The ptrace leak fix is applied as a patch during the build workflow when `use_ptrace` is enabled. It is enabled by default.
+
+## Related
+
+- [index.md](../index.md) — full feature index

docs/susfs.md

@@ -0,0 +1,45 @@
+# SUSFS
+
+SUSFS is a KernelSU add-on that provides root-hiding mechanisms using kernel patches and a userspace module.
+
+Implemented by [simonpunk](https://gitlab.com/simonpunk/susfs4ksu), the kernel patches are integrated into the builds from this repository when `use_susfs` is enabled.
+
+## Source
+
+- **Upstream:** [simonpunk/susfs4ksu](https://gitlab.com/simonpunk/susfs4ksu)
+- **Module (userspace add-on):** [susfs4ksu-module by sidex15](https://github.com/sidex15/susfs4ksu-module)
+- **Recommended module:** [sidex15/susfs4ksu-module](https://github.com/sidex15/susfs4ksu-module)
+
+## Capabilities
+
+SUSFS provides multiple root-hiding and spoofing capabilities:
+
+| Capability | Description |
+|------------|-------------|
+| `SUS_PATH` | Hide suspicious paths from various system calls. Effective on zygote-spawned user app processes with `uid >= 10000`. |
+| `SUS_MOUNT` | Assign fake mount IDs to mounts and hide sus mounts from `/proc/self/[mounts|mountinfo|mountstat]` for non-su processes. |
+| `SUS_KSTAT` | Spoof kernel statistics for user-defined files/directories. Effective on zygote-spawned user app processes with `uid >= 10000`. |
+| `SPOOF_UNAME` | Spoof the string returned by the `uname` syscall to a user-defined string. Effective on all processes. |
+| `ENABLE_LOG` | Log SUSFS events to the kernel log. Disable to completely suppress SUSFS logging. |
+| `HIDE_KSU_SUSFS_SYMBOLS` | Automatically hide KSU and SUSFS symbols from `/proc/kallsyms`. Effective on all processes. |
+| `SPOOF_CMDLINE_OR_BOOTCONFIG` | Spoof `/proc/bootconfig` (GKI) or `/proc/cmdline` (non-GKI) output with a user-defined file. Effective on all processes. |
+| `OPEN_REDIRECT` | Redirect a target path to be opened with another user-defined path. Both paths must exist before they can be added. Requires SELinux permissions for both paths. Effective only on processes with a pre-defined UID scheme. |
+| `SUS_MAP` | Hide mmapped real files from `/proc/<pid>/[maps\|smaps\|smaps_rollup\|map_files\|mem\|pagemap]`. No anonymous-memory support; does not hide inline/PLT hooks caused by the injected library itself. May not evade strong injection detection. Effective only on zygote-spawned unmounted user app processes with `uid >= 10000`. |
+| `AVC_SPOOF` | Spoof procfs AVC denial logs. Enabled at runtime via the sidex15 module — not a build-time Kconfig option. |
+
+## Build Integration
+
+In this repository, SUSFS kernel patches are applied per Android/kernel version variant. The pinned SUSFS commits per variant are defined in the build workflow (see `.github/workflows/main.yml`).
+
+SUSFS is always built at the latest branch tip when the root flavor is KernelSU-Next; for KernelSU and ReSukiSU, it uses the audited pinned commits.
+
+## Usage Notes
+
+- Some capabilities are effective only on zygote-spawned user app processes with `uid >= 10000`. This is a fundamental limitation of how the hooks are applied.
+- `OPEN_REDIRECT` does **not** bypass detections by itself; SELinux permissions for both paths are the user's responsibility.
+- `SUS_MAP` does not hide inline or PLT hooks caused by the injected library itself, and may not evade strong injection detection.
+
+## Related
+
+- [kernelsu.md](kernelsu.md) — root implementation
+- [index.md](../index.md) — full feature index

docs/tmpfs.md

@@ -0,0 +1,19 @@
+# TMPFS Features
+
+The kernel includes extended attributes (xattr) and POSIX ACL support for tmpfs.
+
+## TMPFS Extended Attributes (`TMPFS_XATTR`)
+
+Enables extended attributes on tmpfs filesystems. This is required for Mountify support and other features that depend on extended attributes on tmpfs.
+
+## TMPFS POSIX ACLs (`TMPFS_POSIX_ACL`)
+
+Enables POSIX Access Control Lists on tmpfs filesystems, allowing more fine-grained permission control on tmpfs-mounted files.
+
+## Build Integration
+
+Both features are enabled via kernel configuration options (`CONFIG_TMPFS_XATTR` and `CONFIG_TMPFS_POSIX_ACL`) and are included in the builds by default when the corresponding feature flags are set.
+
+## Related
+
+- [index.md](../index.md) — full feature index

docs/unicode.md

@@ -0,0 +1,21 @@
+# Unicode Fix
+
+The Unicode Fix prevents path traversal and other detections using non-printable Unicode codepoints.
+
+This fix is marked as experimental.
+
+## Purpose
+
+Certain path traversal attacks and detection-evasion techniques can use non-printable Unicode codepoints. The Unicode Fix patches the kernel to mitigate these vectors.
+
+## Status
+
+**Experimental** — use at your own risk.
+
+## Build Integration
+
+The Unicode Fix is applied as a patch during the build workflow when `use_unicode` is enabled. It is enabled by default.
+
+## Related
+
+- [index.md](../index.md) — full feature index