Build SukiSU Ultra + SuSFS #15
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build SukiSU Ultra + SuSFS | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| device_name: | |
| description: 'Select target device' | |
| required: true | |
| default: 'star' | |
| type: choice | |
| options: [star, mars, venus] | |
| localversion: | |
| description: 'Custom version suffix' | |
| required: true | |
| default: '-next-palaziks' | |
| bbr_enable: | |
| description: "Enable TCP BBR/Brutal (false=off, true=add, default=set as default)" | |
| required: true | |
| type: choice | |
| default: 'true' | |
| options: | |
| - 'false' | |
| - 'true' | |
| - 'default' | |
| huawei_lz4ko: | |
| description: 'Huawei LZ4KO patch' | |
| required: true | |
| type: boolean | |
| default: true | |
| adios_enable: | |
| description: 'Enable ADIOS IO Scheduler (Improves IO read/write performance)' | |
| required: true | |
| type: boolean | |
| default: true | |
| rekernel_enable: | |
| description: 'Enable Re-Kernel Support (Enhances app freezing via NoActive/Freezer)' | |
| required: true | |
| type: boolean | |
| default: false | |
| baseband_guard: | |
| description: 'Enable Baseband Guard (Anti-brick modem protection)' | |
| required: true | |
| type: boolean | |
| default: true | |
| lto_type: | |
| description: 'LTO Optimization (none = fast compile, thin = default, full = slow)' | |
| required: true | |
| type: choice | |
| default: 'thin' | |
| options: | |
| - 'none' | |
| - 'thin' | |
| - 'full' | |
| unicode_fix: | |
| description: 'Enable Unicode Bypass Fix (path traversal protection)' | |
| required: true | |
| type: boolean | |
| default: true | |
| wireguard: | |
| description: 'Enable WireGuard VPN support' | |
| required: true | |
| type: boolean | |
| default: false | |
| netfilter_full: | |
| description: 'Full Netfilter (conntrack, NAT, hashlimit)' | |
| required: true | |
| type: boolean | |
| default: false | |
| wakelock_blocker: | |
| description: 'Enable Wakelock Blocker (better idle battery drain)' | |
| required: true | |
| type: boolean | |
| default: true | |
| swap_size: | |
| description: 'Swap size in GB' | |
| required: true | |
| default: '16' | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout Repository | |
| uses: actions/checkout@v4 | |
| - name: Dynamic Memory Allocation (Swap) | |
| uses: pierotofy/set-swap-space@master | |
| with: | |
| swap-size-gb: ${{ inputs.swap_size || '16' }} | |
| - name: Restore CCache | |
| uses: actions/cache/restore@v4 | |
| with: | |
| path: ~/.ccache | |
| key: ccache-${{ inputs.device_name }}-${{ github.run_id }} | |
| restore-keys: ccache-${{ inputs.device_name }}- | |
| - name: Install Dependencies | |
| run: | | |
| sudo apt update | |
| sudo apt install -y clang lld llvm git make gcc flex bison bc \ | |
| libssl-dev ccache libncurses5-dev libncursesw5-dev cmake \ | |
| python3 python-is-python3 cpio curl patch rsync | |
| - name: "⚡ Setup SukiSU Ultra (builtin)" | |
| run: | | |
| set -e | |
| echo "=== Setting up SukiSU Ultra (builtin) ===" | |
| KERNEL_REPO="$(pwd)" | |
| git clone --depth=1 -b builtin https://github.com/SukiSU-Ultra/SukiSU-Ultra.git SukiSU-Ultra | |
| # ✅ run setup.sh FROM kernel root | |
| bash SukiSU-Ultra/kernel/setup.sh "$KERNEL_REPO" | |
| # ✅ fix pgtable after setup | |
| sed -i '/pgtable.h/c\#include <asm/pgtable.h>' drivers/kernelsu/feature/sucompat.c | |
| # Keep this 5.4 fix just in case SukiSU needs it too! | |
| if [ -f drivers/kernelsu/feature/sucompat.c ]; then | |
| # Fix 1: Missing header | |
| sed -i '/pgtable.h/c\#include <asm/pgtable.h>' drivers/kernelsu/feature/sucompat.c | |
| # Fix 2: Downgrade modern string copy to 5.4 standard | |
| sed -i 's/strncpy_from_user_nofault/strncpy_from_user/g' drivers/kernelsu/feature/sucompat.c | |
| echo "✅ 5.4 Compatibility patches applied to sucompat.c" | |
| fi | |
| echo "✅ SukiSU Ultra integrated + pgtable fixed" | |
| - name: Setup SuSFS for SukiSU Ultra | |
| run: | | |
| set -e | |
| KERNEL_REPO="$(pwd)" | |
| git clone --depth=1 https://gitlab.com/simonpunk/susfs4ksu.git \ | |
| -b gki-android12-5.10 ../susfs4ksu | |
| SUSFS_DIR="$KERNEL_REPO/../susfs4ksu" | |
| cd "$KERNEL_REPO" | |
| cp "$SUSFS_DIR/kernel_patches/fs/susfs.c" "$KERNEL_REPO/fs/" | |
| cp "$SUSFS_DIR/kernel_patches/include/linux/susfs.h" "$KERNEL_REPO/include/linux/" | |
| cp "$SUSFS_DIR/kernel_patches/include/linux/susfs_def.h" "$KERNEL_REPO/include/linux/" | |
| grep -q "linux/cred.h" "$KERNEL_REPO/include/linux/susfs_def.h" || \ | |
| sed -i '1s/^/#include <linux\/cred.h>\n/' "$KERNEL_REPO/include/linux/susfs_def.h" | |
| grep -q "susfs.o" fs/Makefile || echo 'obj-$(CONFIG_KSU_SUSFS) += susfs.o' >> fs/Makefile | |
| # Fix fsnotify for 5.4: rewrite 3-line 5.9+ signature to 5.4 handle_event prototype | |
| perl -i -0pe 's/static int susfs_handle_sdcard_inode_event\(struct fsnotify_mark \*mark, u32 mask,\s*struct inode \*inode, struct inode \*dir,\s*const struct qstr \*file_name, u32 cookie\)/static int susfs_handle_sdcard_inode_event(struct fsnotify_group *group, struct inode *inode, u32 mask, const void *data, int data_type, const struct qstr *file_name, u32 cookie, struct fsnotify_iter_info *iter_info)/s' fs/susfs.c | |
| # Rename ops field to match 5.4 | |
| sed -i 's/\.handle_inode_event = /.handle_event = /' fs/susfs.c | |
| echo "✅ SuSFS copied + fsnotify fixed for 5.4" | |
| - name: Apply SuSFS 5.4 Patch (JackA1ltman) | |
| run: | | |
| set -e | |
| git clone --depth=1 https://github.com/JackA1ltman/NonGKI_Kernel_Build_2nd.git ../jacka_repo | |
| PATCH_FILE="../jacka_repo/Patches/Patch/susfs_patch_to_5.4.patch" | |
| if [ ! -f "$PATCH_FILE" ]; then | |
| echo "❌ Patch not found, available:" | |
| ls ../jacka_repo/Patches/Patch/ || true | |
| exit 1 | |
| fi | |
| patch -p1 --forward --batch < "$PATCH_FILE" || echo "⚠️ Patch partially applied" | |
| echo "✅ JackA1ltman susfs 5.4 patch applied" | |
| # supercall.c — needs susfs.h for susfs functions | |
| grep -q "susfs.h" drivers/kernelsu/supercall/supercall.c || \ | |
| sed -i '1s/^/#include <linux\/susfs.h>\n/' drivers/kernelsu/supercall/supercall.c | |
| # fs/open.c — needs susfs.h for open_redirect hooks | |
| grep -q "susfs.h" fs/open.c || \ | |
| sed -i '/#include <linux\/fs.h>/a #include <linux\/susfs.h>' fs/open.c | |
| - name: Append Defconfig Flags | |
| run: | | |
| set -e | |
| DEVICE="${{ inputs.device_name || 'star' }}" | |
| DEFCONFIG=$(find arch/arm64/configs -name "*${DEVICE}*defconfig" | head -n 1) | |
| echo "DEFCONFIG=$DEFCONFIG" >> $GITHUB_ENV | |
| if [ -z "$DEFCONFIG" ] || [ ! -f "$DEFCONFIG" ]; then | |
| echo "❌ Defconfig not found!" | |
| exit 1 | |
| fi | |
| echo "✅ Using defconfig: $DEFCONFIG" | |
| # KSU base | |
| echo "CONFIG_KSU=y" >> "$DEFCONFIG" | |
| echo "CONFIG_TMPFS_XATTR=y" >> "$DEFCONFIG" | |
| echo "CONFIG_TMPFS_POSIX_ACL=y" >> "$DEFCONFIG" | |
| # SuSFS v2.x features | |
| echo "CONFIG_KSU_SUSFS=y" >> "$DEFCONFIG" | |
| echo "CONFIG_KSU_SUSFS_SUS_PATH=y" >> "$DEFCONFIG" | |
| echo "CONFIG_KSU_SUSFS_SUS_MOUNT=y" >> "$DEFCONFIG" | |
| echo "CONFIG_KSU_SUSFS_SUS_KSTAT=y" >> "$DEFCONFIG" | |
| echo "CONFIG_KSU_SUSFS_SPOOF_UNAME=y" >> "$DEFCONFIG" | |
| echo "CONFIG_KSU_SUSFS_ENABLE_LOG=y" >> "$DEFCONFIG" | |
| echo "CONFIG_KSU_SUSFS_HIDE_KSU_SUSFS_SYMBOLS=y" >> "$DEFCONFIG" | |
| echo "CONFIG_KSU_SUSFS_SPOOF_CMDLINE_OR_BOOTCONFIG=y" >> "$DEFCONFIG" | |
| echo "CONFIG_KSU_SUSFS_OPEN_REDIRECT=y" >> "$DEFCONFIG" | |
| echo "CONFIG_KSU_SUSFS_SUS_MAP=y" >> "$DEFCONFIG" | |
| # Enable Huawei LZ4KO Crypto Algorithm | |
| if [ "${{ github.event.inputs.huawei_lz4ko }}" == "true" ]; then | |
| echo "CONFIG_ZSMALLOC=y" >> "$DEFCONFIG" | |
| echo "CONFIG_CRYPTO_LZ4=y" >> "$DEFCONFIG" | |
| echo "CONFIG_CRYPTO_LZ4K=y" >> "$DEFCONFIG" | |
| fi | |
| - name: Apply Unicode Bypass Fix | |
| if: inputs.unicode_fix | |
| run: | | |
| PATCH_URL="https://github.com/TheWildJames/kernel_patches/raw/main/common/unicode_bypass_fix_6.1-.patch" | |
| wget -qO /tmp/ub_fix.patch "$PATCH_URL" 2>/dev/null && \ | |
| patch -p1 --forward < /tmp/ub_fix.patch || true | |
| echo "Unicode fix applied" | |
| - name: 🚀 Apply Huawei LZ4KO ZRAM Patch | |
| if: inputs.huawei_lz4ko | |
| run: | | |
| curl -sSL "https://github.com/crdroidandroid/android_kernel_xiaomi_courbet/commit/94caa27.patch" -o lz4ko.patch | |
| patch -p1 -F 3 < lz4ko.patch || echo "⚠️ Patch had minor conflicts" | |
| - name: Enable WireGuard | |
| if: inputs.wireguard | |
| run: | | |
| echo "Enabling WireGuard..." | |
| cat >> "$DEFCONFIG" << 'EOF' | |
| CONFIG_WIREGUARD=y | |
| EOF | |
| - name: Enable Full Netfilter | |
| if: inputs.netfilter_full | |
| run: | | |
| echo "Enabling full Netfilter support..." | |
| cat >> "$DEFCONFIG" << 'EOF' | |
| CONFIG_NF_CONNTRACK=y | |
| CONFIG_NF_CONNTRACK_MARK=y | |
| CONFIG_NF_CONNTRACK_ZONES=y | |
| CONFIG_NF_CONNTRACK_TIMESTAMP=y | |
| CONFIG_NF_CONNTRACK_EVENTS=y | |
| CONFIG_NF_CONNTRACK_TIMEOUT=y | |
| CONFIG_NF_CONNTRACK_LABELS=y | |
| CONFIG_NF_NAT=y | |
| CONFIG_NF_NAT_MASQUERADE=y | |
| CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=y | |
| CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y | |
| CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=y | |
| CONFIG_NETFILTER_XT_MATCH_STATE=y | |
| CONFIG_NETFILTER_XT_TARGET_MASQUERADE=y | |
| CONFIG_NETFILTER_XT_TARGET_REDIRECT=y | |
| EOF | |
| - name: Enable Wakelock Blocker | |
| if: inputs.wakelock_blocker | |
| run: | | |
| echo "Enabling Wakelock Blocker..." | |
| cat >> "$DEFCONFIG" << 'EOF' | |
| CONFIG_PM_WAKELOCKS=y | |
| CONFIG_PM_WAKELOCKS_GC=y | |
| CONFIG_PM_WAKELOCKS_LIMIT=100 | |
| EOF | |
| # Патч для принудительного блокирования известных wakelocks | |
| WAKELOCK_C="kernel/power/wakelock.c" | |
| if [ -f "$WAKELOCK_C" ]; then | |
| # Добавляем список заблокированных wakelocks от cctv18/Epicmann24 | |
| cat >> "$WAKELOCK_C" << 'WLEOF' | |
| /* palaziks: wakelock blocker list */ | |
| static const char * const blocked_wakelocks[] = { | |
| "WLAN_pm_wlock", | |
| "IPA_WS", | |
| "qcom_rx_wakelock", | |
| "event0", | |
| }; | |
| WLEOF | |
| fi | |
| - name: Configure BBR & Brutal | |
| run: | | |
| if [[ "${{ github.event.inputs.bbr_enable }}" != "false" ]]; then | |
| echo "Adding TCP Congestion Algorithms..." | |
| echo "CONFIG_TCP_CONG_ADVANCED=y" >> "$DEFCONFIG" | |
| echo "CONFIG_TCP_CONG_BBR=y" >> "$DEFCONFIG" | |
| echo "CONFIG_TCP_CONG_CUBIC=y" >> "$DEFCONFIG" | |
| echo "CONFIG_TCP_CONG_VEGAS=y" >> "$DEFCONFIG" | |
| echo "CONFIG_TCP_CONG_NV=y" >> "$DEFCONFIG" | |
| echo "CONFIG_TCP_CONG_WESTWOOD=y" >> "$DEFCONFIG" | |
| echo "CONFIG_TCP_CONG_HTCP=y" >> "$DEFCONFIG" | |
| echo "CONFIG_TCP_CONG_BRUTAL=y" >> "$DEFCONFIG" | |
| if [[ "${{ github.event.inputs.bbr_enable }}" == "default" ]]; then | |
| echo "Setting BBR as default algorithm..." | |
| echo "CONFIG_DEFAULT_TCP_CONG=bbr" >> "$DEFCONFIG" | |
| else | |
| echo "CONFIG_DEFAULT_TCP_CONG=cubic" >> "$DEFCONFIG" | |
| fi | |
| fi | |
| - name: Configure LTO | |
| run: | | |
| if [[ "${{ github.event.inputs.lto_type }}" == "none" ]]; then | |
| echo "CONFIG_LTO_CLANG_NONE=y" >> "$DEFCONFIG" | |
| elif [[ "${{ github.event.inputs.lto_type }}" == "full" ]]; then | |
| echo "CONFIG_LTO_CLANG_FULL=y" >> "$DEFCONFIG" | |
| else | |
| echo "CONFIG_LTO_CLANG_THIN=y" >> "$DEFCONFIG" | |
| fi | |
| - name: Configure ADIOS IO | |
| if: inputs.adios_enable | |
| run: | | |
| echo "Enabling ADIOS IO Scheduler..." | |
| echo "CONFIG_MQ_IOSCHED_ADIOS=y" >> "$DEFCONFIG" | |
| echo "CONFIG_MQ_IOSCHED_DEFAULT_ADIOS=y" >> "$DEFCONFIG" | |
| - name: Configure Re-Kernel | |
| if: inputs.rekernel_enable | |
| run: | | |
| echo "Enabling Re-Kernel Support..." | |
| echo "CONFIG_REKERNEL=y" >> "$DEFCONFIG" | |
| - name: Configure Baseband Guard | |
| if: inputs.baseband_guard | |
| run: | | |
| echo "Enabling Baseband Guard Support..." | |
| echo "CONFIG_BBG=y" >> "$DEFCONFIG" | |
| curl -sSL https://github.com/cctv18/Baseband-guard/raw/master/setup.sh | bash | |
| sed -i '/^config LSM$/,/^help$/{ /^[[:space:]]*default/ { /baseband_guard/! s/selinux/selinux,baseband_guard/ } }' security/Kconfig | |
| - name: Build Project | |
| run: | | |
| git config --global user.email "bot@example.com" | |
| git config --global user.name "wannq" | |
| export CCACHE_DIR=~/.ccache | |
| ccache -M 5G | |
| export LOCALVERSION="${{ inputs.localversion }}" | |
| chmod +x ./build.sh | |
| # Tell the script to use ccache | |
| ./build.sh all ${{ inputs.device_name }} CC="ccache clang" 2>&1 | tee /tmp/kbuild.log | |
| # Look for the Image in the 'out' directory or '../out' directory | |
| if [ ! -f out/arch/arm64/boot/Image ] && [ ! -f ../out/arch/arm64/boot/Image ]; then | |
| echo "BUILD FAILED" | |
| grep -E "error:|FAILED" /tmp/kbuild.log | tail -50 | |
| exit 1 | |
| fi | |
| - name: Save CCache | |
| if: always() | |
| uses: actions/cache/save@v4 | |
| with: | |
| path: ~/.ccache | |
| key: ccache-${{ inputs.device_name }}-${{ github.run_id }} | |
| - name: Compress & Upload | |
| run: | | |
| mkdir -p upload | |
| # Copy from the correct output directories | |
| cp out/arch/arm64/boot/Image upload/ || cp ../out/arch/arm64/boot/Image upload/ || true | |
| find ../out out -name "*.zip" -exec cp {} upload/ \; || true | |
| tar -czvf kernel-star-ksunext.tar.gz upload/ | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: SukiSU-Ultra-SuSFS-${{ inputs.device_name }} | |
| path: kernel-star-sukisu.tar.gz |