Repository navigation
Conversation
u9521
marked this pull request as draft
September 22, 2026 09:46
u9521
marked this pull request as ready for review
September 22, 2026 10:14
u9521
force-pushed
the
lkm-x64
branch
2 times, most recently
from
October 6, 2026 03:42
f808216 to
6056fc8
Compare
u9521
force-pushed
the
lkm-x64
branch
2 times, most recently
from
October 11, 2026 13:23
3c9d9e8 to
0b949eb
Compare
boot-patch-v2 now supports x86-64 next to arm64: it decodes the bzImage payload, recovers kallsyms and BTF from the decompressed image, links the bootstrap into unused .text padding, patches the kernel image reservation, kernel_init() and load_module() call sites, and appends the KSULKM1 capsule that carries kernelsu.ko between _end and the kernel relocation table. The stub data behind the payload is relocated by a whole number of pages and every link-time reference that crosses the payload boundary is adjusted; the capsule is reached through the direct map, because it lives outside the kernel image mapping and the virtual and physical KASLR offsets are independent. The module is split per architecture (lkm_image/arm64.rs, x86_64.rs) around a shared core -- image layout, branch encoding, symbol map, capsule and report -- so both architectures run the same patch-site scan, resolve the same symbol spec lists and print the same report. The bootstrap link definitions are pinned by a test that checks them against the embedded objects. boot-patch-v2 also writes a restore record into the capsule (capsule v2: 96 -> 112 byte header) and boot-restore-v2 undoes the injection from that record alone, with no backup file: arm64 comes back byte for byte, x86-64 comes back byte for byte after decompression (the payload is compressed again, so the boot image itself differs and AVB/vbmeta has to be re-signed). Patching an already patched image restores it in memory first and carries the original container fields forward, so updating the module is a single command that is idempotent byte for byte. --verify-only checks the record without writing anything. The injected bootstrap logs what it does through printk (an optional symbol, with a cave-local no-op fallback), takes the load_module() argument string from the capsule (--module-args, or the --allow-shell/--no-custom-rc/ --bundled switches that mirror boot-patch), and can rewrite the module's vermagic to match the target kernel (--override-vermagic, off by default). The module that ships with KernelSU is called the "bundled" one throughout, so that "embedded" keeps meaning "bytes compiled into a binary" and the kernel image side reads as injected. Tested against real arm64 GKI and x86-64 AVD kernels: the patched kernels boot with the module loaded, boot-restore-v2 gives the original kernel back byte for byte, and patching the patched image is a no-op.
Route the shared --block-module option into the capsule params, so boot-patch-v2 can block vendor anti-root modules the same way boot-patch does through the ramdisk's /ksu_config. - Call KsuConfigArgs::validate() before the params are joined: the kernel copies block_modules into a 255-byte buffer and truncates silently, which would leave some modules unblocked. - Add block_module to --module-args' conflicts: that flag replaces the whole params string, so the combination would silently drop the list.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ksud boot-patch-v2) now works on x86-64bzImagenext to arm64: it decodes the compressed payload, recovers kallsyms and BTF from the decompressed image, links the bootstrap into unused.textpadding, patches the kernel image reservation,kernel_init()andload_module()call sites, and appends the capsule that carrieskernelsu.kobetween_endand the relocation table.ksud boot-restore-v2 [--verify-only] [--flash]undoes an injection from the restore record inside the capsule (capsule v2); no backup file is involved. arm64 comes back byte for byte, x86-64 comes back byte for byte after decompression, so the boot image itself differs and AVB/vbmeta has to be re-signed.--verify-onlychecks the record without writing anything.printk(resolved as an optional symbol, with a local no-op fallback) and can rewrite the module's vermagic to match the target kernel (--override-vermagic, off by default) for kernels that insist on an exact match.