0.13.9

fix: initialize optional syscall hooks lazily

Do not install path-hide or network-isolation hooks during early kernel init. Initialize state on first access and install hooks only when the feature is enabled, with rollback on partial failure. Unsupported devices now keep booting with the feature disabled.

0.13.8

arm64: unify KP boot return path and make the map hole self-consistent

Stop shuffling version gates and fix the two structural problems behind
the pre-6.x boot failures instead:

1. The map anchor hole was smaller than the map section.  kptools carved
   and NOP-synced only 0x800 bytes, while the map section grew to ~0xf10
   with the scratch machinery, so map_prepare spilled 0x710 bytes of map
   code over untouched kernel text past the hole (the init_timer_key
   corruption class seen on Xiaomi 6.12).  Carve MAP_MAX_SIZE (0x1000)
   for both GKI and non-GKI anchors.

2. The backup/restore pair now covers exactly what kptools touched:
   start_prepare backs up max(map section size, setup_preset.map_max_size)
   bytes instead of only the map section, so restore_map rebuilds every
   NOPed byte of the hole.

3. start() now takes the _paging_init tail return for ALL kernel
   versions.  The return only depends on _paging_init's own frame layout
   (frame 0x290, x29 = sp+0x10), identical on the scratch and legacy
   paths, and it never executes the restored anchor bytes that the map
   section overflow made lethal (5.10 GKI died in do_tcp_getsockopt
   before console init).  The historical 4.9 tail-return boot loop was
   confounded with the scratch path running on 4.x.

One kpimg now serves every kernel version; the only remaining version
branch is the scratch-vs-legacy paging path inside _paging_init, which
reflects a real architectural difference (6.15+ has no linear map inside
the paging_init hook; 4.x cannot tolerate the scratch walk).

Verified in QEMU: 5.10.236 GKI and 6.12.69 boot to shell; the patched
4.9.255 kernel completes the whole KP chain (restore 0x1000 bytes,
symbol init, syscall hooks, rest_init hook) with zero data aborts.

arm64: kp: restore the caller's frame pointer in the tail return

The tail return set x29 = P (_paging_init's own frame pointer) instead of
[P] — the caller's frame pointer that _paging_init's normal epilogue
restores via ldp x29, x30, [sp, #16].  Every other register (x19-x28,
x30, sp) was restored correctly, and kernels whose post-paging_init code
never dereferences x29 got away with it (5.4/5.10/6.x, 4.19).  The 4.9
device kernel walks x29-relative locals in setup_arch after
paging_init() returns on real hardware (the QEMU virt DTB path happens
not to), so it hung right after the map work completed.

Restore x29 = [x10] like the epilogue does.

Also parameterize the map hole size (MAP_HOLE_OVERRIDE) so a bisect
variant with the legacy 0x800 hole can be built if a device still
disagrees.

Verified in QEMU: 5.10.236 and 6.12.69 boot to shell; patched 4.9.255
completes the KP chain (restore 0x1000, hook kernel_init) with zero data
aborts.

0.13.7

userd: apply two-phase scramble scan to old kernels only

The two-phase scan (record ~~ dir names during the iterate, descend after
it releases the directory lock) exists because opening a child directory
inside the iterate self-deadlocks on 4.x.  New kernels never had that
problem, and the collector-style pass risks missing the APK there, so
restore the original flow for kver >= 6.1: Pass1 flat layout scan,
vfs_llseek rewind, then Pass2 descending into ~~ dirs inside the iterate.
The two-phase scan now only applies to the old-kernel (< 6.1) path.

0.13.6

Merge upstream commits 8b8bbe6 and d20e772

kptools -p: support patching android boot.img directly

arm64: fix boot on 6.15+ kernels with 39-bit VA (6.18 verified)

0.13.5

Merge remote-tracking branch 'admire/fix/async-manager-refresh'

0.13.4

merge: sync upstream three commits (3abc2d9..2cc1d1e)

Sync from https://github.com/bmax121/KernelPatch main:
- 3abc2d9 fix new kernel compat & add some feature
  (selinux_hide/selinux_sepolicy, taskob, accctl, ksyms fixes, version 0.13.4)
- faa768e fix problem (selinux_hide/sepolicy fixes)
- 2cc1d1e fix problem (accctl/taskob cleanup)

Upstream 9413088 (lkm: fix 6.6+ insmod error) is already present locally
as f01d539 (identical patch), so it is not re-applied.

Conflicts resolved keeping both sides:
- kernel/patch/patch.c: selinux_hide_init + folkpatch_pathhide/netisolate init
- kernel/patch/common/sucompat.c: selinux_hide control + folkpatch suaudit,
  ANDROID safe-mode guard + idempotent probe-hook registration

0.13.3

bump to 0.13.3 & fix some overwriting

(cherry picked from commit 043c0c3bae68ddc6f2894b4e483d8f54cb85d112)

0.13.3-dev

bump to 0.13.3 & fix some overwriting

0.13.2

chore: bump version to 0.13.2

0.13.1

trusted_manager: add FolkPatch (me.yuki.folk) signature digest