S6Edge-KSUNext

Kernel for the Samsung universal7420 family — Galaxy S6 (zeroflte), S6 Edge (zerolte), S6 Edge+ (zenlte), and Note 5 (noblelte) — with KernelSU-Next (legacy branch) integrated.

Flashable output: LOS20-KSUNext-universal7420-<YYYYMMDD>.zip (AnyKernel3). One zip, device auto-detected at flash time.

Branches

Branch	Base	Target ROM
main	Cronos_7420 (ananjaser1211, 2019, Linux 3.10.61)	Samsung stock / older ROMs
LOS20	LineageOS 20 universal7420 (Linux 3.10.108)	LineageOS 20 (Android 13) and derivatives

The main branch reproduces the original Cronos + KSU-Next integration. It panics early in driver probe on modern Android 13/14 userspace because Cronos never received the Samsung-driver bugfixes that Samsung / LineageOS accumulated post-2019. The LOS20 branch swaps the kernel base to the LOS-20 universal7420 tree (which those fixes merged into) and re-applies the KSU manual hooks there. It targets LineageOS 20 directly and should work on any LOS-20-derived ROM (VoltageOS, ArrowOS, etc.) that uses the same universal7420 device tree.

Supported devices

All four universal7420 devices share the same kernel source — only the defconfig differs (panel/sensors/modem bits). The release zip is a single flashable that selects the right Image at install time.

Model	Codename	Example SKUs
Galaxy S6	zeroflte	SM-G920F/I/K/L/S
Galaxy S6 Edge	zerolte	SM-G925F/I/K/L/S
Galaxy S6 Edge+	zenlte	SM-G928F/C/G/N0
Galaxy Note 5	noblelte	SM-N920C/I/K/S/T

SoC: Samsung Exynos 7420 (arm64). Kernel base (this branch): Linux 3.10.108 from the LineageOS 20 samsungexynos7420 tree.

What's in the tree

Path	Purpose
kernel/	LineageOS 20 universal7420 source with KSU manual-hook patches
kernel/KernelSU-Next/	KernelSU-Next legacy branch with 3.10 compatibility shims
anykernel/	AnyKernel3 packaging template (osm0sis)
build.sh	Top-level orchestrator: defconfig → make → zip
.gitignore	Excludes build artifacts, toolchain, flashable zip

The toolchain is not committed — fetch it separately (see below).

Build prerequisites

• Linux host with make, python3, zip
• Google Android aarch64 GCC 4.9 prebuilt (ndk-r13-release branch)
• Host gcc/g++, bc, bison, flex, libssl-dev/openssl

Installing the toolchain

The build script expects the compiler at ./toolchain/bin/aarch64-linux-android-gcc:

git clone --depth 1 -b ndk-r13-release \
  https://android.googlesource.com/platform/prebuilts/gcc/linux-x86/aarch64/aarch64-linux-android-4.9 \
  toolchain

Building

./build.sh

What it does:

1. make mrproper + explicit artifact wipe.
2. For each variant (zerolte, zeroflte, zenlte, noblelte):
   • make clean (preserves host tools), reset .config.
   • make exynos7420-<variant>_defconfig.
   • make -j$(nproc) Image in-tree.
   • Stash the resulting Image as anykernel/Image.<variant>.
3. Generate a device-detecting anykernel.sh and zip the AnyKernel3 tree into LOS20-KSUNext-universal7420-<date>.zip.

The zip is a single flashable covering all four devices; the recovery script reads ro.product.device at install time and copies the matching Image.<variant> into place before flashing.

Flashing

Reboot into TWRP (or compatible recovery) and flash the generated LOS20-KSUNext-universal7420-<date>.zip. AnyKernel3 detects the device, picks the right per-variant Image, and repacks the current boot image. If you flash on an unsupported codename the script aborts cleanly — your boot image is not touched. Then install the KernelSU-Next manager APK (v3.1.0 or v3.2.0; see KernelSU-Next manager version below).

KernelSU-Next integration notes

Linux 3.10 arm64 has no CONFIG_KPROBES hook surface that KSU can use and no LSM hook framework <linux/lsm_hooks.h> (that landed in 4.2). KSU runs in manual-hook mode — the build log confirms -- KernelSU-Next: Hook mode: Manual.

Manual hook call sites wired into the kernel:

Syscall / path	Hook	File
execve / execveat / compat variants	ksu_handle_execveat	fs/exec.c
faccessat	ksu_handle_faccessat	fs/open.c
read	ksu_handle_sys_read, ksu_vfs_read_hook	fs/read_write.c
newfstatat / fstatat64	ksu_handle_stat	fs/stat.c
reboot	ksu_handle_sys_reboot	kernel/sys.c
setresuid	ksu_handle_setresuid	KSU-side setuid_hook

3.10 compatibility shims inside KernelSU-Next/

KSU-Next targets 3.18+. The shims in this repo backport it to 3.10:

• lsm_hooks.c — stubbed (the LSM hook framework header doesn't exist pre-4.2).
• setuid_hook.c — <linux/bpf.h> guarded to >= 3.18.
• throne_tracker.c — struct dir_context + iterate_dir shim (3.11+); on 3.10 we bridge to the old vfs_readdir(file, filldir_t, void *) API.
• infra/file_wrapper.c — file_operations.iterate member guard (>= 3.11).
• runtime/ksud_integration.c — file_operations.read_iter + read_iter_proxy guarded (>= 3.16).
• uapi/selinux.h, uapi/supercall.h — rewrote static const __u32 FOO = ...; as #define FOO ... so the values are integer constant expressions.
• compat/kernel_compat.h — inline compat helpers for untagged_addr, replace_fops, strscpy, bin2hex, d_inode, d_is_reg, groups_sort.
• infra/su_mount_ns.c — ns_get_path stubbed (3.19+); per-session mount-ns isolation degrades to a no-op.
• runtime/boot_event.c — ext4_unregister_sysfs guarded (3.15+); the nuke_ext4_sysfs ioctl returns -ENOSYS on this kernel.
• UID type fixes — current_uid().val → __kuid_val(current_uid()), etc.
• Header ordering — <linux/sched.h> added before <linux/cred.h> in several KSU files so current->cred has a complete struct task_struct.
• Kbuild hook-detection grep — scans both kernel/sys.c and kernel/reboot.c since 3.10 has no reboot.c.

Defconfig changes

Applied identically to all four variants: exynos7420-{zerolte,zeroflte,zenlte,noblelte}_defconfig.

CONFIG_KSU=y
CONFIG_KSU_MANUAL_HOOK=y
# CONFIG_KSU_KPROBES_HOOK is not set
CONFIG_OVERLAY_FS=y

Lazy bootstrap

KSU-Next's built-in-driver initialisation expects either a late-load ksud binary or the upstream /system/bin/init second_stage + zygote app_process execve-detection to drive apply_kernelsu_rules(), setup_ksu_cred(), and the first track_throne(false) scan. Neither of those reliably fires on this 3.10 kernel: there is no ksud until the manager installs one (and the manager can't install it until it gets root), and the execve detection misses Android 13's init/zygote launch on universal7420.

Workaround (kernel/KernelSU-Next/kernel/supercall/supercall.c): on the first sys_reboot fd-install magic call from the manager, run the late-load-style bootstrap once — apply sepolicy rules to inject u:r:ksu:s0, cache the new SID, elevate ksu_cred, then synchronously track_throne(false) to crown the manager. By the time sys_reboot returns the fd to userspace, the manager's subsequent ioctl can pass the is_manager() / transive_to_domain checks. This is the single biggest patch that makes KSU-Next work on 3.10 without a ksud userspace.

Also in kernel/KernelSU-Next/kernel/runtime/boot_event.c: added track_throne(false) at the end of on_post_fs_data() as a belt-and-suspenders trigger for when the zygote execve detection does fire.

KernelSU-Next manager version

The kernel advertises KSU_VERSION=33110 (see build.sh KSU_VERSION_OVERRIDE). This clears both v3.1.0's (MINIMAL_SUPPORTED_KERNEL=32310) and v3.2.0's (MINIMAL_SUPPORTED_KERNEL=33110) version gates in the manager's Natives.kt. All ioctls v3.2.0 depends on (SET_SEPOLICY, SET_INIT_PGRP, app-profile v2, GET_INFO with LKM/MANAGER flag bits) are present in the vendored KSU-Next source, so the version bump is not a lie — just a workaround for the manager not having any other way to detect feature availability.

Known limitations

• su_mount_ns (per-session mount-namespace unshare) is a no-op on 3.10.
• nuke_ext4_sysfs ioctl is a no-op on 3.10.
• Kprobes-based hook mode is not available; only manual hooks.
• SUSFS is not integrated — its lowest official kernel branch is kernel-4.9 and a 3.10 backport is a multi-week project.
• First manager open after boot may show "not working" briefly; reopening the app shows it crowned and working. This is a cosmetic artefact of the lazy bootstrap running inside the first sys_reboot call.
• Only zerolte is routinely flash-tested (it's the only device in hand). The zeroflte, zenlte, and noblelte builds compile from the same source against their own defconfigs and are produced/shipped, but have not been personally verified on-device — reports welcome.

Credits

• LineageOS samsungexynos7420 team — the universal7420 lineage-20 kernel tree used as base on this branch (GPL-2.0)
• ananjaser1211/Cronos_7420 — the original Cronos_7420 port used as base on the main branch (GPL-2.0)
• rifsxd/KernelSU-Next — KSU-Next, v3.2.0-legacy branch (GPL-3.0)
• osm0sis/AnyKernel3 — flashable ZIP template (MIT)
• Google Android ndk-r13-release prebuilt aarch64-linux-android-4.9 GCC

License

This repository is a composite work. See LICENSE at the repo root for the full breakdown. Short version:

• Linux kernel + vendor contributions: GPL-2.0 (kernel/COPYING)
• KernelSU-Next: GPL-3.0 (kernel/KernelSU-Next/LICENSE)
• AnyKernel3: MIT (anykernel/LICENSE)
• Top-level integration files (build.sh, this README, .gitignore): GPL-2.0

Build artifacts combine GPL-2.0 and GPL-3.0 code and are distributed under the terms of both. For a strictly GPL-2.0-only build, disable CONFIG_KSU in the defconfig before ./build.sh.