chore: merge branch 'dev'

* dev: (44 commits)
  docs: add auto-updating contributors grid via contrib.rocks
  docs: drop osm0sis fork note from AnyKernel3 credit
  docs: keep Installation section as single Installation Guide link
  docs: add PixelFlasher to installation method table
  docs: move PixelFlasher to own pixelflasher.md
  docs: update prerequisite to GKI2 kernel 5.10+
  docs: simplify kernelflasher prerequisites
  docs: add kernel version matcher with note to kernelflasher from magiskboot
  docs: remove Choosing ZIP section from kernelflasher
  docs: remove Choosing ZIP section from magiskboot, keep simple kernel version line
  docs: remove Choosing ZIP section from installation, keep in magiskboot
  docs: expand KMI/SPL chooser with full description and add to magiskboot
  docs: add brick/warranty caution to installation and magiskboot
  docs: add folder structure preview before each magiskboot platform
  docs: add platform jump links and split Linux/Windows sections in magiskboot
  docs: remove not just Android OS version from note
  docs: fix note rendering outside list
  docs: fix Android version note wording
  docs: clarify kernel version matching with Android version note
  docs: remove Android-Image-Kitchen warning from magiskboot
  ...

Signed-off-by: Ahmed Al-Nassif <mr.ahmed.nassif@gmail.com>

.github/workflows/main.yml

@@ -1281,7 +1281,7 @@ jobs:
                 enabled.append("Performance Tuning")
             if not enabled:
                 return ""
-            parts = ["## Features Included", "", "See [Kernel Features Documentation](https://github.com/WildKernels/GKI_KernelSU_SUSFS/blob/dev/docs/index.md) for full details.", ""]
+            parts = ["## Features Included", "", "See [Kernel Features Documentation](https://github.com/WildKernels/GKI_KernelSU_SUSFS/blob/dev/docs/features.md) for full details.", ""]
             feature_doc_map = [
                 ("SUSFS", "susfs.md"),
                 ("Baseband Guard", "bbg.md"),
@@ -1555,7 +1555,7 @@ jobs:
                   enabled.append("Performance Tuning")
               if not enabled:
                   return ""
-              parts = ["## Features Included", "", "See [Kernel Features Documentation](https://github.com/WildKernels/GKI_KernelSU_SUSFS/blob/dev/docs/index.md) for full details.", ""]
+              parts = ["## Features Included", "", "See [Kernel Features Documentation](https://github.com/WildKernels/GKI_KernelSU_SUSFS/blob/dev/docs/features.md) for full details.", ""]
               feature_doc_map = [
                   ("SUSFS", "susfs.md"),
                   ("Baseband Guard", "bbg.md"),

README.md

@@ -3,7 +3,7 @@
 # Wild Kernels for Android
 
 [![KernelSU](https://img.shields.io/badge/KernelSU-Supported-green)](https://kernelsu.org/)
-[![SUSFS](https://img.shields.io/badge/SUSFS-Integrated-orange)](https://gitlab.com/simonpunk/susfs4ksu)
+[![susfs4ksu](https://img.shields.io/badge/susfs4ksu-Integrated-orange)](https://gitlab.com/simonpunk/susfs4ksu)
 
 </div>
 
@@ -34,25 +34,23 @@ By flashing this kernel, **YOU** are choosing to make these modifications. If so
 
 ## Features
 
-- [KernelSU-Next](docs/kernelsu-next.md) / [KernelSU (Classic)](docs/kernelsu-classic.md) / [ReSukiSU](docs/resukisu.md) - root implementations
-- [SUSFS](docs/susfs.md) - root hiding
-- [NoMount](docs/nomount.md) - mount metamodule (root hiding)
-- [Baseband Guard](docs/bbg.md) - partition protection
-- [Networking](docs/networking.md) - WireGuard, BBR, IPSet, CIFS
-- [TMPFS](docs/tmpfs.md) - xattr / POSIX ACLs
-- [BPF](docs/bpf.md) - BTF / eBPF / FUSE-BPF
-- [Ptrace Leak Fix](docs/ptrace.md) - internal to root hiding
-- [Unicode Fix](docs/unicode.md) - internal to root hiding (experimental)
-- [Performance](docs/performance.md) - incl. [NTSync](docs/ntsync.md)
-- [DroidSpaces](docs/droidspaces.md) - container runtime
+- KernelSU / KernelSU-Next / ReSukiSU - root implementations
+- susfs4ksu - root hiding (incl. Ptrace Leak Fix, Unicode Fix)
+- NoMount / Mountify - mount metamodules
+- Baseband Guard - partition protection
+- Networking - WireGuard, BBR, IPSet, CIFS
+- TMPFS - xattr / POSIX ACLs
+- BPF - BTF / eBPF / FUSE-BPF
+- Performance - incl. NTSync
+- DroidSpaces - container runtime
 
-Full documentation: [docs/index.md](docs/index.md)
+Full documentation: [docs/features.md](docs/features.md)
 
 ---
 
 ## Installation
 
-See **[Installation Guide](docs/installation.md)** - [Kernel Flasher](docs/kernelflasher.md) · [Patch boot.img with magiskboot](docs/magiskboot.md).
+See **[Installation Guide](docs/installation.md)**.
 
 ---
 
@@ -69,7 +67,7 @@ See **[Installation Guide](docs/installation.md)** - [Kernel Flasher](docs/kerne
 - **DroidSpaces-OSS**: Developed by [ravindu644](https://github.com/ravindu644/Droidspaces-OSS)
 - **Baseband-guard (BBG)**: Developed by [vc-teahouse](https://github.com/vc-teahouse/Baseband-guard)
 - **Kernel Patches**: Maintained by [WildKernels/kernel_patches](https://github.com/WildKernels/kernel_patches)
-- **AnyKernel3**: Maintained by [WildKernels/AnyKernel3](https://github.com/WildKernels/AnyKernel3) (fork of [osm0sis/AnyKernel3](https://github.com/osm0sis/AnyKernel3))
+- **AnyKernel3**: Maintained by [WildKernels/AnyKernel3](https://github.com/WildKernels/AnyKernel3)
 - **Sultan Kernels (Pixel)**: Developed by [kerneltoast](https://github.com/kerneltoast)
 - **Device Boot Fix**: [Boot fix commit](https://github.com/Anything-at-25-00/android_kernel_common_android12-5.10/commit/2476d262b597fe8af82cfb7aaf96676f51c6b4ed) for fixing some devices not booting
 
@@ -110,6 +108,8 @@ Flashing this kernel will void your warranty, and there is always a risk of bric
 
 **These amazing people help make this project possible!**
 
+[![Contributors](https://contrib.rocks/image?repo=WildKernels/GKI_KernelSU_SUSFS)](https://github.com/WildKernels/GKI_KernelSU_SUSFS/graphs/contributors)
+
 | Contributor | Contribution |
 |-------------|-------------|
 | [simonpunk](https://gitlab.com/simonpunk/susfs4ksu.git) | Created SUSFS! |

docs/ROOT_VARIANTS.md

@@ -1,77 +0,0 @@
-# Pinned GKI Root Variants
-
-`Build pinned root variants` is a manual, artifact-only workflow. It produces
-three separate source trees and never combines root implementations:
-
-| Variant | Source | Pinned commit |
-| --- | --- | --- |
-| KernelSU | `tiann/KernelSU` | `da9abf498a77d438989fea0f5f4e348b9a540c07` |
-| KernelSU Next | `KernelSU-Next/KernelSU-Next` `dev` | `234f6e040fcbca18b16d2398e1aa225712ec99ad` |
-| ReSukiSU | `ReSukiSU/ReSukiSU` | `3ef06b0fcb0960dc9563256fe26a58e892663387` |
-| NoMount | `maxsteeel/nomount` `dev` | `c52936b229c25a4b0e41b6627f7d3bc5eaaaf2b5` |
-
-The workflow resolves the selected target to its immutable SUSFS pin:
-
-| GKI target | SUSFS branch tip pinned for this workflow |
-| --- | --- |
-| android12-5.10 | `3c14ad549f826b1f53878ec8c12253efebeed75a` |
-| android13-5.10 | `f81aaf10e9560282052bb61dd931315c2ca3e617` |
-| android13-5.15 | `ccb1918684b27644d17a6c842f57b60ae5966025` |
-| android14-5.15 | `0463ac089308014e8c22cc6a4558e0d6d2a53e08` |
-| android14-6.1 | `e287d59066380bf6de4396532d4a42edf4408701` |
-| android15-6.6 | `be7b7ef49a1e1b189c3abf00eacaa7ebdb4168c1` |
-| android16-6.12 | `f37930f374ef88de990d6abea0c67d0ea28c1edc` |
-
-All pins were resolved on 2026-08-13 from the named upstream branches. A pin
-is re-verified after checkout; a mismatch, missing upstream `fs/nomount`
-integration, or existing root integration fails the build.
-
-The workflow snapshots ABI/KMI controls before root integration and verifies
-them immediately afterward. It then snapshots the approved, target-specific
-SUSFS and device-patch ABI updates before NoMount integration and requires
-NoMount to leave that baseline unchanged. The guard covers legacy ABI symbol
-lists and the Android 16 Bazel ABI/staging/symbol definitions. It does not
-remove protected exports, bypass ABI checks, build a bypass image, create
-releases, or claim device compatibility.
-
-## Build-verified only artifact metadata
-
-Successful builds upload a single `<target>-BuildInfo` artifact combining a
-human-readable summary table with an embedded machine-readable JSON block. The
-JSON `status` is **`Build-verified only`** only after the corresponding
-AnyKernel3 and NoMount metamodule artifacts are uploaded and their GitHub
-Actions API URLs and GitHub-issued `sha256` digests are recorded. Each record
-also includes the build method, root implementation/manager/version and commit,
-SUSFS and NoMount revisions, Android branch/KMI, kernel source commit, and
-provenance run URL.
-
-NoMount integration invokes the upstream `kernel/setup.sh` by its full immutable
-commit URL and passes that same SHA as the script argument. Each kernel artifact
-also receives a separately uploaded NoMount metamodule archive built from the
-same SHA; its artifact URL and SHA-256 digest are included in the metadata
-record. Kernel and metamodule revisions must match exactly.
-
-The metadata `catalog` object makes publication eligibility explicit:
-
-| Field | Required value |
-| --- | --- |
-| `availability` | `eligible-with-provenance-and-checksums` |
-| `device_compatibility` | `not-validated` |
-| `flashability` | `not-guaranteed` |
-| `boot` | `not-guaranteed` |
-
-This status means that CI completed the source build and artifact integrity
-metadata is available. It is not device validation and does not claim device
-compatibility, flashability, or a successful boot. A catalog or release
-publisher may expose a successful build artifact only with its provenance URL
-and both kernel and matching NoMount metamodule checksums. It must mark an
-unbuilt, failed, or metadata-incomplete entry unavailable and provide no
-download.
-
-This workflow remains artifact-only: it does not create releases or publish a
-catalog. Any separate publisher must enforce this metadata contract.
-
-Runs dispatched before this metadata contract was added cannot retroactively
-contain these metadata artifacts. Their artifact digests remain available from
-the GitHub Actions artifact API, but they must not be represented as complete
-metadata-contract records.

docs/bbg.md

@@ -1,19 +0,0 @@
-# Baseband Guard (BBG)
-
-Baseband Guard is a lightweight Linux Security Module (LSM) for the Android kernel, designed to block unauthorized writes to critical partitions and device nodes at the system level.
-
-## Source
-
-- **Source:** [vc-teahouse/Baseband-guard](https://github.com/vc-teahouse/Baseband-guard)
-
-## Purpose
-
-BBG protects critical baseband-related partitions and device nodes from unauthorized modifications. It operates at the kernel security module level, intercepting write operations to protected resources.
-
-## Build Integration
-
-When `use_bbg` is enabled in the build workflow, BBG is included in the kernel build. It is enabled by default.
-
-## Related
-
-- [index.md](../index.md) - full feature index

docs/bpf.md

@@ -1,23 +0,0 @@
-# BTF / eBPF / FUSE-BPF
-
-This kernel includes support for BTF (BPF Type Format), eBPF (extended Berkeley Packet Filter), and FUSE-BPF.
-
-## BTF (`CONFIG_BTF`)
-
-BTF provides type information for BPF programs, enabling better introspection and debugging of BPF-based features. BTF is also used by various kernel tooling and debugging facilities.
-
-## eBPF (`CONFIG_BPF_EVENTS`)
-
-eBPF allows sandboxed programs to run in the kernel without changing kernel source code or loading modules. `CONFIG_BPF_EVENTS` enables BPF programs to attach to kernel events for tracing, monitoring, and other purposes.
-
-## FUSE-BPF (`CONFIG_FUSE_BPF`)
-
-FUSE-BPF enables BPF programs to interact with FUSE (Filesystem in Userspace) filesystems. This is useful for BPF-based debugging and tooling that involves FUSE-mounted filesystems.
-
-## Build Integration
-
-These options are enabled via kernel configuration and are included when the `use_bpf` feature flag is set in the build workflow.
-
-## Related
-
-- [index.md](../index.md) - full feature index

docs/droidspaces.md

@@ -1,19 +0,0 @@
-# DroidSpaces-OSS
-
-DroidSpaces-OSS is a lightweight, LXC-inspired container runtime for Android and Linux, allowing full Linux distributions to run natively with zero performance penalty.
-
-## Source
-
-- **Source:** [ravindu644/Droidspaces-OSS](https://github.com/ravindu644/Droidspaces-OSS)
-
-## Purpose
-
-DroidSpaces provides container-like isolation for running Linux distributions on Android, using an LXC-inspired approach. It is designed to have minimal performance overhead.
-
-## Build Integration
-
-DroidSpaces-OSS patches are applied during the build workflow when `use_ds` is enabled. The source commit is resolved at the latest `main` branch tip at build time.
-
-## Related
-
-- [index.md](../index.md) - full feature index

docs/index.md → docs/features.md

@@ -6,18 +6,24 @@ Per-feature documentation for the GKI2 kernels built from this repository.
 
 | Root Flavor | Description | Source |
 |-------------|-------------|----------|
+| KernelSU | Root solution for GKI devices, original implementation by tiann, pinned to verified commit. SUSFS patches applied during build. | [tiann/KernelSU](https://github.com/tiann/KernelSU) |
 | KernelSU-Next | Root solution for GKI devices, original KernelSU-Next implementation, always at latest dev-tip. SUSFS-enabled builds sourced from pershoot fork. | [KernelSU-Next/KernelSU-Next](https://github.com/KernelSU-Next/KernelSU-Next) · [pershoot/KernelSU-Next](https://github.com/pershoot/KernelSU-Next) |
-| KernelSU (Classic) | Original KernelSU by tiann, pinned to verified commit. SUSFS patches applied during build. | [tiann/KernelSU](https://github.com/tiann/KernelSU) |
 | ReSukiSU | ReSukiSU root fork, pinned to verified commit. Own SUSFS pins per flavor. | [ReSukiSU/ReSukiSU](https://github.com/ReSukiSU/ReSukiSU) |
 
 ## Root Hiding
 
 | Feature | Description | Source |
 |---------|-------------|--------|
-| SUSFS | Root-hiding add-on for KernelSU using kernel patches and a userspace module. | [simonpunk/susfs4ksu](https://gitlab.com/simonpunk/susfs4ksu) |
-| NoMount | Metamodule providing mount-related functionality alongside root implementations. | [maxsteeel/nomount](https://github.com/maxsteeel/nomount) |
+| susfs4ksu | Root-hiding add-on for KernelSU using kernel patches and a userspace module. | [simonpunk/susfs4ksu](https://gitlab.com/simonpunk/susfs4ksu) |
 | Ptrace Leak Fix | Fixes ptrace info leak on kernels older than 5.16. Internal to root hiding. | [patch](https://github.com/WildKernels/kernel_patches/blob/main/gki_ptrace.patch) |
-| Unicode Fix | Prevents path traversal via non-printable Unicode (experimental). Internal to root hiding. | Internal to root hiding · [patch 6.1-](https://github.com/WildKernels/kernel_patches/blob/main/common/unicode_bypass_fix_6.1-.patch) · [patch 6.1+](https://github.com/WildKernels/kernel_patches/blob/main/common/unicode_bypass_fix_6.1+.patch) |
+| Unicode Fix | Prevents path traversal via non-printable Unicode (experimental). Internal to root hiding. | [patch 6.1-](https://github.com/WildKernels/kernel_patches/blob/main/common/unicode_bypass_fix_6.1-.patch) · [patch 6.1+](https://github.com/WildKernels/kernel_patches/blob/main/common/unicode_bypass_fix_6.1+.patch) |
+
+## Meta Module
+
+| Module | Description | Source |
+|--------|-------------|--------|
+| NoMount | Metamodule providing mount-related functionality alongside root implementations. | [maxsteeel/nomount](https://github.com/maxsteeel/nomount) |
+| Mountify | Globally mounted modules via OverlayFS. | [backslashxx/mountify](https://github.com/backslashxx/mountify) |
 
 ## Security
 
@@ -29,32 +35,25 @@ Per-feature documentation for the GKI2 kernels built from this repository.
 
 | Feature | Description | Source |
 |---------|-------------|--------|
-| TCP Congestion Control | BBRv1, BBRv3, CUBIC, BIC, Westwood, HTCP | Upstream kernel |
-| WireGuard | Built-in VPN support | [wireguard/wireguard-linux-compat](https://git.zx2c4.com/wireguard-linux-compat/) |
-| IP Set / IPv6 NAT | Advanced firewall capabilities | Upstream kernel |
-| Conntrack / connmark | Connection marking for packet classification | Upstream kernel |
-| CIFS | SMB/CIFS network filesystem | Upstream kernel |
-| TTL Target | Network packet manipulation | Upstream kernel |
-
-## Filesystem & Storage
-
-| Feature | Description | Source |
-|---------|-------------|--------|
-| TMPFS Extended Attributes | Extended attributes on tmpfs | Upstream kernel |
-| TMPFS POSIX ACLs | POSIX ACL support on tmpfs | Upstream kernel |
+| TCP Congestion Control | BBRv1, BBRv3, CUBIC, BIC, Westwood, HTCP | `CONFIG_TCP_CONG_BBR` / `CONFIG_TCP_CONG_CUBIC` etc |
+| WireGuard | Built-in VPN support | `CONFIG_WIREGUARD` |
+| IP Set / IPv6 NAT | Advanced firewall capabilities | `CONFIG_IP_SET` / `CONFIG_IP6_NF_NAT` |
+| Conntrack / connmark | Connection marking for packet classification | `CONFIG_NF_CONNTRACK` / `CONFIG_NET_ACT_CONNMARK` |
+| CIFS | SMB/CIFS network filesystem | `CONFIG_CIFS` |
+| TTL Target | Network packet manipulation | `CONFIG_IP_NF_TARGET_TTL` / `CONFIG_IP6_NF_TARGET_HL` |
 
 ## Debugging, Tracing & BPF
 
 | Feature | Description | Source |
 |---------|-------------|--------|
-| BTF / eBPF / FUSE-BPF | BPF Type Format, extended BPF, FUSE-BPF interaction | Upstream kernel |
+| BTF / eBPF / FUSE-BPF | BPF Type Format, extended BPF, FUSE-BPF interaction | `CONFIG_DEBUG_INFO_BTF` / `CONFIG_BPF_SYSCALL` / `CONFIG_FUSE_BPF` |
 
 ## Performance
 
 | Feature | Description | Source |
 |---------|-------------|--------|
-| NTSync | High-performance synchronization primitives compatible with Windows NT kernel API. | Internal |
-| Performance Tuning | Kernel configuration and tuning options | Upstream kernel |
+| NTSync | High-performance synchronization primitives compatible with Windows NT kernel API. | `CONFIG_NTSYNC` · [kernel_patches/common/ntsync](https://github.com/WildKernels/kernel_patches/tree/main/common/ntsync) |
+| Performance Tuning | Kernel configuration and tuning options | [WildKernels/kernel_patches](https://github.com/WildKernels/kernel_patches/tree/main/common) |
 
 ## Container Runtime
 
@@ -64,6 +63,6 @@ Per-feature documentation for the GKI2 kernels built from this repository.
 
 ---
 
-**Installation** - see [Installation Guide](installation.md) ([Kernel Flasher](kernelflasher.md) · [Patch boot.img with magiskboot](magiskboot.md)).
+**Installation** - see [Installation Guide](installation.md).
 
 **Release Notes** - for build-specific version/commit info, see the [release workflow](https://github.com/WildKernels/GKI_KernelSU_SUSFS/actions/workflows/main.yml) or the releases page.

docs/installation.md

@@ -1,7 +1,7 @@
 # Installation
 
 > [!CAUTION]
-> Flashing a kernel can brick your device and will void your warranty. Make a full backup before proceeding.
+> Flashing a kernel can brick your device and will void your warranty. Make a full backup (boot partition at minimum) before proceeding.
 
 Choose the method that fits your situation:
 
@@ -9,15 +9,7 @@ Choose the method that fits your situation:
 |--------|-------------|---------------|-------|
 | **Kernel Flasher** | Upgrading with root already available, no PC needed | Yes | [kernelflasher.md](kernelflasher.md) |
 | **magiskboot** | When you want to flash a pre-patched `boot.img` directly (no pre-rooted setup required) | No | [magiskboot.md](magiskboot.md) |
-
-## Choosing the correct AnyKernel3 ZIP
-
-Each release artifact is named by **KMI** and **SPL**:
-
-- **KMI** - `android12-5.10`, `android13-5.10`, `android13-5.15`, `android14-5.15`, `android14-6.1`, `android15-6.6`, `android16-6.12`. Must match `uname -r`.
-- **SPL** - monthly security patch level. Pick the build closest to your current SPL.
-
-If you don't know which file to download, read the KMI/SPL description in the release notes.
+| **PixelFlasher** | If you have zero flashing experience, a PC and a Pixel - other devices can work but are not officially supported | No | [pixelflasher.md](pixelflasher.md) |
 
 ## After flashing (both methods)
 
@@ -27,4 +19,4 @@ If you don't know which file to download, read the KMI/SPL description in the re
 
 ---
 
-See also: [Kernel Features Documentation](index.md) · [Releases](https://github.com/WildKernels/GKI_KernelSU_SUSFS/releases)
+See also: [Kernel Features Documentation](features.md) · [Releases](https://github.com/WildKernels/GKI_KernelSU_SUSFS/releases)

docs/kernelflasher.md

@@ -8,34 +8,26 @@
 
 ## Prerequisites
 
-- Device with unlocked bootloader running a supported GKI kernel (see KMI below)
-- Root access already granted to the flashing app (for upgrades) or a working method to flash initially (fastboot / custom recovery)
-- Battery >50%
-
-## Choosing the correct AnyKernel3 ZIP
-
-Each release artifact is named by **KMI (Kernel Module Interface)** and **Security Patch Level (SPL)**.
-
-- **KMI** - e.g. `android12-5.10`, `android13-5.10`, `android13-5.15`, `android14-5.15`, `android14-6.1`, `android15-6.6`, `android16-6.12`. Must match your device's current kernel version. Check with `uname -r` or in Settings → About phone → Kernel version.
-- **SPL** - monthly security patch string in the filename. Pick the build closest to your current SPL; newer SPL is generally backwards compatible but read the release notes for breaking changes.
-
-If you don't know which file to download, carefully read the description of KMI and Security patch level in the release notes before downloading.
+- Device with unlocked bootloader running a GKI2 kernel 5.10+
+- Root access already granted to the flashing app
 
 ## Steps
 
-1. **Download the AnyKernel3 ZIP** for your KMI/SPL from the latest [Releases](https://github.com/WildKernels/GKI_KernelSU_SUSFS/releases) page.
+1. **Download the AnyKernel3 ZIP** that matches your kernel version (e.g., `6.1.157-android14`) from the latest [Releases](https://github.com/WildKernels/GKI_KernelSU_SUSFS/releases) page.
 2. **Open the Kernel Flasher app**, grant necessary root permissions when prompted.
 3. **Select the AnyKernel3 ZIP** you downloaded and flash. Do not interrupt the process.
 4. **Reboot** when prompted and verify KernelSU manager shows the expected version.
 
+> [!NOTE]
+> Match by the full kernel version (e.g., `6.1.157-android14`) - your device's Android version and the `android14` in the kernel version are not necessarily the same.
+
 This requires the flashing app to have root permissions. On first install from stock (no root yet), flash via recovery or fastboot instead, then use this method for subsequent upgrades.
 
 ## Supported flashing apps
 
 - [Kernel Flasher](https://github.com/fatalcoder524/KernelFlasher) - recommended, actively maintained
-- [PixelFlasher](https://github.com/badabing2005/PixelFlasher) - alternative with advanced options
 
-Both require root to flash a kernel from within Android.
+Requires root to flash a kernel from within Android. See also [PixelFlasher](pixelflasher.md) - alternative with advanced options.
 
 ## After flashing
 

docs/kernelsu-classic.md

@@ -1,27 +0,0 @@
-# KernelSU (Classic)
-
-Classic KernelSU is a root solution for Android GKI devices that operates in kernel mode and grants root permission to userspace applications from kernel space. It is the original implementation by `tiann`.
-
-## Source
-
-- **Source:** [tiann/KernelSU](https://github.com/tiann/KernelSU) (`main` branch)
-- **Pinned commit:** `932014ab5b2c9b74a3d11e2ec4d17dd10fc9442e`
-
-Pinned in `main.yml` as `PIN_KERNELSU` and resolved via `pick` so builds are always verified against an exact commit.
-
-## How This Repo Uses It
-
-- Built when `root_flavor` is **`KernelSU`** or **`All`**.
-- SUSFS patches are applied during the build workflow (when `use_susfs` is enabled) rather than sourced from a SUSFS-enabled fork.
-- Resolved at the pinned commit in verified mode; at latest `main` tip in latest mode.
-
-## Manager
-
-The KernelSU manager APK is built from `tiann/KernelSU`. The manager version should match the kernel version (e.g., kernel version `30100` → manager version `30100`).
-
-## Related
-
-- [kernelsu-next.md](kernelsu-next.md) - KernelSU-Next
-- [resukisu.md](resukisu.md) - ReSukiSU
-- [susfs.md](susfs.md) - root hiding add-on
-- [index.md](../index.md) - full feature index

docs/kernelsu-next.md

@@ -1,26 +0,0 @@
-# KernelSU-Next
-
-KernelSU-Next is a root solution for Android GKI devices that operates in kernel mode and grants root permission to userspace applications from kernel space.
-
-## Source
-
-- **Official:** [KernelSU-Next/KernelSU-Next](https://github.com/KernelSU-Next/KernelSU-Next) (`dev` branch)
-- **SUSFS-enabled fork:** [pershoot/KernelSU-Next](https://github.com/pershoot/KernelSU-Next) (`dev-susfs` branch, used when `use_susfs` is enabled)
-
-## How This Repo Uses It
-
-- Built when `root_flavor` is **`KernelSU-Next`** or **`All`**.
-- With SUSFS enabled, kernel sources come from the `pershoot/KernelSU-Next` fork.
-- Without SUSFS, kernel sources come from the official `KernelSU-Next/KernelSU-Next` `dev` branch.
-- Always resolves at latest dev-tip (not pinned).
-
-## Manager
-
-The KernelSU-Next manager APK is built from the official `KernelSU-Next/KernelSU-Next` repo and must match the kernel version (e.g., kernel version `30100` → manager version `30100`).
-
-## Related
-
-- [kernelsu-classic.md](kernelsu-classic.md) - classic KernelSU
-- [resukisu.md](resukisu.md) - ReSukiSU
-- [susfs.md](susfs.md) - root hiding add-on
-- [index.md](../index.md) - full feature index

docs/magiskboot.md

@@ -2,24 +2,37 @@
 
 For some devices, the `boot.img` format isn't as common as `lz4`, `gz`, and uncompressed. A typical example is the Pixel, where the `boot.img` is compressed in the `lz4_legacy` format, while the ramdisk may be in `gz` or also compressed in `lz4_legacy`. Currently, if you directly flash the `boot.img` provided by KernelSU, the device may not be able to boot. In this case, you can manually patch the `boot.img`.
 
+> [!CAUTION]
+> Flashing a kernel can brick your device and will void your warranty. Make a full backup (boot partition at minimum) before proceeding.
+
 > [!TIP]
 > It's always recommended to use `magiskboot` to patch images. There are two ways:
 > - [magiskboot (official)](https://github.com/topjohnwu/Magisk/releases) - runs on Android devices (and Linux)
-> - [magiskboot_build](https://github.com/capntrips/magiskboot_build) - cross-built binaries for Windows/macOS/Linux PCs
+> - [WildKernels/Magisk (W.I.P.)](https://github.com/WildKernels/Magisk) - cross-built binaries for Windows/macOS/Linux PCs (W.I.P.)
 >
-> The official build of `magiskboot` can only run on Android devices. If you want to run it on a PC, use the second option.
 
-> [!WARNING]
-> `Android-Image-Kitchen` isn't recommended for now because it doesn't handle the boot metadata (such as security patch level) correctly. Therefore, it may not work on some devices.
+**Platforms:** [Android](#using-magiskboot-on-android-devices) · [Linux](#using-magiskboot-on-linux) · [Windows / Other](#using-magiskboot-on-windows--other)
 
 ## Preparation
 
-1. Get your device's stock `boot.img`. You can get it from your device manufacturer. You may need [payload-dumper-go](https://github.com/ssut/payload-dumper-go).
-2. Download the AnyKernel3 ZIP file provided by KernelSU that matches the KMI version of your device.
+1. Get your device's stock `boot.img`.
+2. Download the AnyKernel3 ZIP file that matches your kernel version (e.g., `6.1.157-android14`).
 3. Unpack the AnyKernel3 package and get the `Image` file, which is the kernel file of KernelSU.
 
+> [!NOTE]
+> Match by the full kernel version (e.g., `6.1.157-android14`) - your device's Android version and the `android14` in the kernel version are not necessarily the same.
+
 ## Using magiskboot on Android devices
 
+Folder structure on device (`/data/local/tmp/`):
+
+```
+/data/local/tmp/
+├── magiskboot
+├── boot.img
+└── Image
+```
+
 1. Download latest Magisk from [GitHub Releases](https://github.com/topjohnwu/Magisk/releases).
 2. Rename `Magisk-*(version).apk` to `Magisk-*.zip` and unzip it.
 3. Push `libmagiskboot.so` to your device by ADB:
@@ -55,9 +68,54 @@ For some devices, the `boot.img` format isn't as common as `lz4`, `gz`, and unco
    fastboot flash boot new-boot.img
    ```
 
-## Using magiskboot on Windows / macOS / Linux PC
+## Using magiskboot on Linux
 
-1. Download the corresponding `magiskboot` binary for your OS from [magiskboot_build](https://github.com/capntrips/magiskboot_build).
+Folder structure on PC:
+
+```
+.
+├── magiskboot
+├── boot.img
+└── Image
+```
+
+Official `magiskboot` can run in Linux normally - use the [official build](https://github.com/topjohnwu/Magisk/releases). If you prefer, you can also use [WildKernels/Magisk (W.I.P.)](https://github.com/WildKernels/Magisk).
+
+1. Prepare stock `boot.img` and `Image` in your PC.
+2. Make it executable:
+   ```sh
+   chmod +x magiskboot
+   ```
+3. Unpack `boot.img`:
+   ```sh
+   ./magiskboot unpack boot.img
+   ```
+   You will get a `kernel` file - this is your stock kernel.
+4. Replace kernel:
+   ```sh
+   mv -f Image kernel
+   ```
+5. Repack:
+   ```sh
+   ./magiskboot repack boot.img
+   ```
+   You will get a `new-boot.img` file. Flash it by fastboot:
+   ```sh
+   fastboot flash boot new-boot.img
+   ```
+
+## Using magiskboot on Windows / Other
+
+Folder structure on PC:
+
+```
+.
+├── magiskboot.exe
+├── boot.img
+└── Image
+```
+
+1. Download the corresponding `magiskboot` binary for your OS from [WildKernels/Magisk (W.I.P.)](https://github.com/WildKernels/Magisk).
 2. Prepare stock `boot.img` and `Image` in your PC.
 3. Make it executable:
    ```sh
@@ -81,9 +139,6 @@ For some devices, the `boot.img` format isn't as common as `lz4`, `gz`, and unco
    fastboot flash boot new-boot.img
    ```
 
-> [!INFO]
-> Official `magiskboot` can run in Linux environments normally. If you're a Linux user, you can use the official build.
-
 ---
 
 Related: [Installation Overview](installation.md) · [Install with Kernel Flasher](kernelflasher.md) · [Releases](https://github.com/WildKernels/GKI_KernelSU_SUSFS/releases)

docs/networking.md

@@ -1,46 +0,0 @@
-# Networking Features
-
-This kernel includes a range of networking features and improvements, covering congestion control, VPN support, firewall capabilities, and traffic shaping.
-
-## Congestion Control
-
-| Algorithm | Description |
-|-----------|-------------|
-| **BBRv1** | Improved TCP congestion control. |
-| **BBRv3** | Improved TCP congestion control. Available for Android 12 (5.10) through Android 15 (6.6); Android 16 (6.12) support coming soon. |
-| **CUBIC** | Default TCP congestion control for many Linux systems. |
-| **BIC** | Binary Increase Congestion control. |
-| **Westwood** | TCP congestion control optimized for heterogeneous networks. |
-| **HTCP** | H-TCP congestion control. |
-
-## VPN Support
-
-- **WireGuard** - Built-in VPN support via the WireGuard kernel module.
-
-## Firewall & NAT
-
-- **IP Set** - Advanced firewall capabilities via ip_set.
-- **IPv6 NAT** - NAT support for IPv6.
-- **TTL Target** - Network packet manipulation via TTL targeting.
-
-## Traffic Shaping & Fair Queuing
-
-- **CAKE** - Common Applications Kept Enhanced; a full-featured queue discipline.
-- **fq** - Fair Queue packet scheduler.
-- **fq_codel** - Fair Queuing with Controlled Delay.
-
-## Connection Marking
-
-- **connmark** - Connection marking for packet classification.
-
-## Filesystem Support
-
-- **CIFS** - Network filesystem support for SMB/CIFS sharing.
-
-## Build Integration
-
-Most networking features are upstream kernel configurations enabled in the kernel config for each Android/kernel variant. BBRv3 backports are applied as patches for specific Android/kernel versions.
-
-## Related
-
-- [index.md](../index.md) - full feature index

docs/nomount.md

@@ -1,26 +0,0 @@
-# NoMount
-
-NoMount is a metamodule for the Android kernel that provides mount-related functionality used alongside root implementations.
-
-This repository builds a flashable NoMount metamodule from the pinned NoMount source commit and uploads it as a separate artifact alongside the kernel build.
-
-## Source
-
-- **Repository:** [maxsteeel/nomount](https://github.com/maxsteeel/nomount)
-- **Branch:** `dev`
-
-## Build Integration
-
-NoMount is resolved either at a pinned verified commit (when `commit_mode=verified`) or at the latest `dev` branch tip (when `commit_mode=latest` or `update`).
-
-The build workflow:
-1. Clones the NoMount source at the resolved commit.
-2. Builds the metamodule archive from that commit.
-3. Uploads the metamodule as `NoMount-Metamodule`.
-
-The kernel and metamodule revisions must match exactly. The NoMount integration invokes the upstream `kernel/setup.sh` by its full immutable commit URL and passes that same SHA as the script argument.
-
-## Related
-
-- [kernelsu.md](kernelsu.md) - root implementation
-- [index.md](../index.md) - full feature index

docs/ntsync.md

@@ -1,22 +0,0 @@
-# NTSync
-
-High-performance synchronization primitives compatible with Windows NT kernel API. Internal to performance category.
-
-## Source
-
-- **Internal**
-
-## Purpose
-
-NTSync brings Windows-compatible synchronization primitives (such as those used by NT kernel objects) to the Android kernel, which can be useful for compatibility with software expecting Windows-style synchronization behavior.
-
-It is documented as internal to the performance category.
-
-## Build Integration
-
-NTSync is enabled via the `use_ntsync` feature flag in the build workflow. It is enabled by default.
-
-## Related
-
-- [performance.md](performance.md) - performance category
-- [index.md](index.md) - full feature index

docs/performance.md

@@ -1,19 +0,0 @@
-# Performance Tuning
-
-This kernel includes performance-related tuning and options, including NTSync.
-
-## Features
-
-| Feature | Description |
-|---------|-------------|
-| NTSync | High-performance synchronization primitives compatible with Windows NT kernel API. Internal to performance category. |
-| Performance Tuning | Kernel configuration and tuning options and optimizations aimed at improving system responsiveness and throughput. |
-
-## Build Integration
-
-Performance-related features are enabled via the `use_perf` feature flag in the build workflow. This flag is disabled by default. NTSync is controlled separately via `use_ntsync` (enabled by default) but documented under performance.
-
-## Related
-
-- [ntsync.md](ntsync.md) - NTSync details
-- [index.md](index.md) - full feature index

docs/pixelflasher.md

@@ -0,0 +1,42 @@
+# Install with PixelFlasher
+
+Alternative flashing app with advanced options.
+
+> [!CAUTION]
+> Flashing a kernel can brick your device and will void your warranty. Make a full backup (boot partition at minimum) before proceeding.
+
+## Prerequisites
+
+- Device with unlocked bootloader running a GKI2 kernel 5.10+
+- Root access already granted to the flashing app
+
+## Steps
+
+1. **Download the AnyKernel3 ZIP** that matches your kernel version (e.g., `6.1.157-android14`) from the latest [Releases](https://github.com/WildKernels/GKI_KernelSU_SUSFS/releases) page.
+2. **Open PixelFlasher**, grant necessary root permissions when prompted.
+3. **Select the AnyKernel3 ZIP** you downloaded and flash. Do not interrupt the process.
+4. **Reboot** when prompted and verify KernelSU manager shows the expected version.
+
+> [!NOTE]
+> Match by the full kernel version (e.g., `6.1.157-android14`) - your device's Android version and the `android14` in the kernel version are not necessarily the same.
+
+## About
+
+- **Source:** [badabing2005/PixelFlasher](https://github.com/badabing2005/PixelFlasher) - alternative with advanced options
+- Requires root to flash a kernel from within Android.
+
+## After flashing
+
+- Install / update the matching KernelSU manager APK (see release assets `manager-apk-*`).
+- If using SUSFS, install the SUSFS module via the manager.
+- Verify with `su` or manager app that root is working.
+
+## Troubleshooting
+
+- **Bootloop** - restore your boot backup via fastboot/recovery.
+- **Wrong KMI** - re-flash with the correct KMI variant; KMI mismatch is the most common failure.
+- **Manager shows old version** - ensure you flashed the intended variant and rebooted fully.
+
+---
+
+Related: [Installation Overview](installation.md) · [Install with Kernel Flasher](kernelflasher.md) · [Patch boot.img Manually](magiskboot.md) · [Releases](https://github.com/WildKernels/GKI_KernelSU_SUSFS/releases)

docs/ptrace.md

@@ -1,22 +0,0 @@
-# Ptrace Leak Fix
-
-Fixes ptrace info leak on kernels older than 5.16. Internal to root hiding.
-
-## Source
-
-- **Source:** [patch](https://github.com/WildKernels/kernel_patches/blob/main/gki_ptrace.patch) (`kernel_patches/gki_ptrace.patch`)
-
-## Purpose
-
-On kernels older than 5.16, a ptrace-related information leak may be present. This fix patches the kernel to close that leak, improving security for systems using ptrace.
-
-It is documented as internal to root hiding (SUSFS/KernelSU) - not a standalone top-level feature.
-
-## Build Integration
-
-The ptrace leak fix is applied as a patch during the build workflow when `use_ptrace` is enabled. It is enabled by default.
-
-## Related
-
-- [susfs.md](susfs.md) - root hiding
-- [index.md](index.md) - full feature index

docs/resukisu.md

@@ -1,27 +0,0 @@
-# ReSukiSU
-
-ReSukiSU is a root solution for Android GKI devices that operates in kernel mode and grants root permission to userspace applications from kernel space. It is a fork/variant of KernelSU maintained by the ReSukiSU project.
-
-## Source
-
-- **Source:** [ReSukiSU/ReSukiSU](https://github.com/ReSukiSU/ReSukiSU) (`main` branch)
-- **Pinned commit:** `03b60f260cce36f23efbd26c9c334edfdc9ce7eb`
-
-Pinned in `main.yml` as `PIN_RESUKISU` and resolved via `pick` so builds are always verified against an exact commit.
-
-## How This Repo Uses It
-
-- Built when `root_flavor` is **`ReSukiSU`** or **`All`**.
-- SUSFS patches are applied during the build workflow (when `use_susfs` is enabled), and ReSukiSU also has its own per-flavor SUSFS pins.
-- Resolved at the pinned commit in verified mode; at latest `main` tip in latest mode.
-
-## Manager
-
-The ReSukiSU manager APK is built from `ReSukiSU/ReSukiSU`. The manager version should match the kernel version (e.g., kernel version `30100` → manager version `30100`).
-
-## Related
-
-- [kernelsu-next.md](kernelsu-next.md) - KernelSU-Next
-- [kernelsu-classic.md](kernelsu-classic.md) - classic KernelSU
-- [susfs.md](susfs.md) - root hiding add-on
-- [index.md](../index.md) - full feature index

docs/susfs.md

@@ -1,35 +0,0 @@
-# SUSFS
-
-SUSFS is a KernelSU add-on that provides root-hiding mechanisms using kernel patches and a userspace module.
-
-## Source
-
-- **Source:** [simonpunk/susfs4ksu](https://gitlab.com/simonpunk/susfs4ksu)
-- **Module (userspace add-on):** [sidex15/susfs4ksu-module](https://github.com/sidex15/susfs4ksu-module)
-
-## Capabilities
-
-SUSFS provides multiple root-hiding and spoofing capabilities:
-
-| Capability | Description |
-|------------|-------------|
-| `SUS_PATH` | Hide suspicious paths from various system calls. Effective on zygote-spawned user app processes with `uid >= 10000`. |
-| `SUS_MOUNT` | Assign fake mount IDs to mounts and hide sus mounts from `/proc/self/[mounts|mountinfo|mountstat]` for non-su processes. |
-| `SUS_KSTAT` | Spoof kernel statistics for user-defined files/directories. Effective on zygote-spawned user app processes with `uid >= 10000`. |
-| `SPOOF_UNAME` | Spoof the string returned by the `uname` syscall to a user-defined string. Effective on all processes. |
-| `ENABLE_LOG` | Log SUSFS events to the kernel log. Disable to completely suppress SUSFS logging. |
-| `HIDE_KSU_SUSFS_SYMBOLS` | Automatically hide KSU and SUSFS symbols from `/proc/kallsyms`. Effective on all processes. |
-| `SPOOF_CMDLINE_OR_BOOTCONFIG` | Spoof `/proc/bootconfig` (GKI) or `/proc/cmdline` (non-GKI) output with a user-defined file. Effective on all processes. |
-| `OPEN_REDIRECT` | Redirect a target path to be opened with another user-defined path. Both paths must exist before they can be added. Requires SELinux permissions for both paths. Effective only on processes with a pre-defined UID scheme. |
-| `SUS_MAP` | Hide mmapped real files from `/proc/<pid>/[maps|smaps|smaps_rollup|map_files|mem|pagemap]`. No anonymous-memory support; does not hide inline/PLT hooks caused by the injected library itself. May not evade strong injection detection. Effective only on zygote-spawned unmounted user app processes with `uid >= 10000`. |
-| `AVC_SPOOF` | Spoof procfs AVC denial logs. Enabled at runtime via the sidex15 module - not a build-time Kconfig option. |
-
-## Build Integration
-
-In this repository, SUSFS kernel patches are applied per Android/kernel version variant. The pinned SUSFS commits per variant are defined in the build workflow (`.github/workflows/main.yml`).
-
-SUSFS is always built at the latest branch tip when the root flavor is KernelSU-Next; for KernelSU and ReSukiSU, it uses the audited pinned commits.
-
-## Related
-
-- [index.md](../index.md) - full feature index

docs/tmpfs.md

@@ -1,19 +0,0 @@
-# TMPFS Features
-
-The kernel includes extended attributes (xattr) and POSIX ACL support for tmpfs.
-
-## TMPFS Extended Attributes (`TMPFS_XATTR`)
-
-Enables extended attributes on tmpfs filesystems. This is required for Mountify support and other features that depend on extended attributes on tmpfs.
-
-## TMPFS POSIX ACLs (`TMPFS_POSIX_ACL`)
-
-Enables POSIX Access Control Lists on tmpfs filesystems, allowing more fine-grained permission control on tmpfs-mounted files.
-
-## Build Integration
-
-Both features are enabled via kernel configuration options (`CONFIG_TMPFS_XATTR` and `CONFIG_TMPFS_POSIX_ACL`) and are included in the builds by default when the corresponding feature flags are set.
-
-## Related
-
-- [index.md](../index.md) - full feature index

docs/unicode.md

@@ -1,26 +0,0 @@
-# Unicode Fix
-
-Prevents path traversal via non-printable Unicode (experimental). Internal to root hiding.
-
-## Source
-
-- **Source:** Internal to root hiding - [patch 6.1-](https://github.com/WildKernels/kernel_patches/blob/main/common/unicode_bypass_fix_6.1-.patch) (`kernel_patches/common/unicode_bypass_fix_6.1-.patch`) · [patch 6.1+](https://github.com/WildKernels/kernel_patches/blob/main/common/unicode_bypass_fix_6.1+.patch) (`kernel_patches/common/unicode_bypass_fix_6.1+.patch`)
-
-## Purpose
-
-Certain path traversal attacks and detection-evasion techniques can use non-printable Unicode codepoints. The Unicode Fix patches the kernel to mitigate these vectors.
-
-It is documented as internal to root hiding (SUSFS/KernelSU) - not a standalone top-level feature.
-
-## Status
-
-**Experimental** - use at your own risk.
-
-## Build Integration
-
-The Unicode Fix is applied as a patch during the build workflow when `use_unicode` is enabled. It is enabled by default.
-
-## Related
-
-- [susfs.md](susfs.md) - root hiding
-- [index.md](index.md) - full feature index