20.0: Initial bringup

Signed-off-by: Tad <tad@spotco.us>

Manifests/Manifest_LAOS-20.0.xml

@@ -0,0 +1,55 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<manifest>
+
+	<remote name="gitlab" fetch="https://gitlab.com/" />
+
+<!-- START OF UNNECESSARY REPO REMOVAL -->
+	<remove-project name="LineageOS/android_external_ant-wireless_ant_native" />
+	<remove-project name="LineageOS/android_external_ant-wireless_ant_service" />
+	<remove-project name="LineageOS/android_external_bash" />
+	<remove-project name="LineageOS/android_external_htop" />
+	<remove-project name="LineageOS/android_external_libncurses" />
+	<remove-project name="LineageOS/android_external_nano" />
+	<remove-project name="LineageOS/android_external_openssh" />
+	<remove-project name="LineageOS/android_external_vim" />
+	<remove-project name="LineageOS/android_packages_apps_Eleven" />
+	<remove-project name="LineageOS/android_packages_apps_Jelly" />
+	<!--<remove-project name="LineageOS/android_packages_apps_Stk" />-->
+	<remove-project name="LineageOS/android_prebuilts_gcc_darwin-x86_aarch64_aarch64-linux-android-4.9" />
+	<remove-project name="LineageOS/android_prebuilts_gcc_darwin-x86_arm_arm-linux-androideabi-4.9" />
+	<remove-project name="LineageOS/android_prebuilts_gcc_darwin-x86_x86_x86_64-linux-android-4.9" />
+	<remove-project name="LineageOS/charter" />
+	<remove-project name="LineageOS/cm_crowdin" />
+	<remove-project name="LineageOS/contributors-cloud-generator" />
+	<remove-project name="LineageOS/hudson" />
+	<remove-project name="LineageOS/lineage_wiki" />
+	<remove-project name="LineageOS/mirror" />
+	<remove-project name="LineageOS/www" />
+	<remove-project name="platform/packages/apps/SampleLocationAttribution" />
+	<remove-project name="platform/prebuilts/clang/host/darwin-x86" />
+	<remove-project name="platform/prebuilts/go/darwin-x86" />
+<!-- END OF UNNECESSARY REPO REMOVAL -->
+
+<!-- START OF BRANCH SWITCHING -->
+	<!--<remove-project name="platform/external/swiftshader" />
+	<project path="external/swiftshader" name="google/swiftshader" remote="github" revision="master" />-->
+
+	<!-- Switch to the Mulch WebView -->
+	<remove-project name="LineageOS/android_external_chromium-webview_patches" />
+	<remove-project name="LineageOS/android_external_chromium-webview_prebuilt_arm" />
+	<remove-project name="LineageOS/android_external_chromium-webview_prebuilt_arm64" />
+	<remove-project name="LineageOS/android_external_chromium-webview_prebuilt_x86" />
+	<project path="external/chromium-webview" name="divested-mobile/mulch" groups="pdk" clone-depth="1" remote="gitlab" revision="master" />
+<!-- END OF BRANCH SWITCHING -->
+
+<!-- START OF ADDITIONAL REPOS -->
+	<!-- GrapheneOS -->
+	<project path="external/hardened_malloc" name="GrapheneOS/hardened_malloc" remote="github" revision="13" />
+	<project path="external/SecureCamera" name="GrapheneOS/platform_external_Camera" remote="github" revision="13" />
+<!-- END OF ADDITIONAL REPOS -->
+
+<!-- START OF DEVICE REPOS -->
+	<!-- Common -->
+	<project path="packages/apps/ElmyraService" name="LineageOS/android_packages_apps_ElmyraService" remote="github" />
+
+</manifest>

Misc/Features/GrapheneOS.txt

@@ -64,19 +64,25 @@ nojit
 9  https://github.com/GrapheneOS/platform_build/commit/e36c7aefaa78a1ed5b94c7f51d29277008eea232
 
 [implemented] captive portal toggle
+13 https://github.com/GrapheneOS/platform_packages_apps_Settings/commit/d700613896eb60972f8fd9df466218a06be36f1f
 12 https://github.com/GrapheneOS/platform_packages_apps_Settings/commit/2a0b0b9193195c360260a3ef7094e45c44b79a24
 
 [implemented] show crash details
+13 https://github.com/GrapheneOS/platform_frameworks_base/commit/d3d6432758ca3a85a9c8ae0406a01657bd3d3672
 12 https://github.com/GrapheneOS/platform_frameworks_base/commit/e740f4b78344c5671d022dfe90bed9e2dacd3db6
 
 [implemented] monet toggle
+13 https://github.com/GrapheneOS/platform_frameworks_base/commit/42d81724ba40b7ea91331f2695e4e07be21f5333
+13xhttps://github.com/GrapheneOS/platform_packages_apps_ThemePicker/commit/5ac22ffc1ac27c7bad6995a9b1d1cc63404f2470
 12 https://github.com/GrapheneOS/platform_frameworks_base/commit/e77f8f544c8c6e826d8497be6ebbc69d72d2f1a5
 12 https://github.com/GrapheneOS/platform_packages_apps_ThemePicker/commit/a287544b550887ea646277d78cde80b19e1ca9af
 
 [implemented] user logout
+13 https://github.com/GrapheneOS/platform_frameworks_base/commit/ff39e8de7f61b75f9221ad342e7f18d9f904c079
 12 https://github.com/GrapheneOS/platform_frameworks_base/commit/93838b55c9b6460249a22be42f04026d8780fefc
 
 [implemented] recovery serial number
+13 https://github.com/GrapheneOS/platform_bootable_recovery/commit/b243f19a5ee35dc58d83e223b705a626ed4c1ea4
 12 https://github.com/GrapheneOS/platform_bootable_recovery/commit/bf7fe6fb6bf8211b0c5e1259fe5f6eee644fbf3a
 
 [implemented] google contacts
@@ -87,18 +93,23 @@ nojit
 12 https://github.com/GrapheneOS/platform_packages_inputmethods_LatinIME/commit/37abf03503ec25d62f3e38d24b5ef4ba31e94ae3
 
 [implemented] location indicators
+13 https://github.com/GrapheneOS/platform_packages_modules_Permission/commit/6e875072470f996f5d60691810c4c64ee3011881
+13 https://github.com/GrapheneOS/platform_frameworks_base/commit/5ebd90bcec00065ce70ac0e845f556f13ad3980c
 12 https://github.com/GrapheneOS/platform_packages_modules_Permission/commit/9825dbc644360850b2cb87c8dcafc39101aec865
 12 https://github.com/GrapheneOS/platform_frameworks_base/commit/b5e18d97d2c35f7288f04050b13813fafaf65d5e
-12 https://github.com/GrapheneOS/platform_frameworks_base/commit/a5d43c015790e63d94ec252ce9cd2579903a39f2
 
 [implemented] browser location
+13 https://github.com/GrapheneOS/platform_packages_modules_Permission/commit/5a9192559d20916c3891d3d986be9ecd998615ad
+13 https://github.com/GrapheneOS/platform_frameworks_base/commit/7675e420104462b2e87dd80792a55f6a6f016e54
 12 https://github.com/GrapheneOS/platform_packages_modules_Permission/commit/648874c9785f8be251e5168314262f4af1f70766
 12 https://github.com/GrapheneOS/platform_frameworks_base/commit/248343df0fddd2703399c46eee7ef04d43350686
 
 [implemented] fbe padding
+13 https://github.com/GrapheneOS/platform_system_extras/commit/9adf4750630c15a1975ef8667e3e4ca50c84d1c0
 12 https://github.com/GrapheneOS/platform_system_extras/commit/144930183585cec74882a5c0ffa321354ad9eb7e
 
 [implemented] special permissions
+13xhttps://github.com/GrapheneOS/platform_frameworks_base/commit/2bea9ac7ded28ad2cc08ac0d4794a5cbe54e142a
 12 https://github.com/GrapheneOS/platform_frameworks_base/commit/5bbbffa0d89d19a87a8de83b185cd8d58db31915
 12 https://github.com/GrapheneOS/platform_packages_modules_Permission/commit/ddac53e6650955e465b585715cff792f5b68c807
 12 https://github.com/GrapheneOS/platform_packages_modules_Permission/commit/f1898802c8fd7474f723f9a44a316142d940dfed
@@ -112,6 +123,7 @@ nojit
 9 https://github.com/GrapheneOS/platform_frameworks_base/commit/09632b10185b9133949a431e27089f72b5cfeefa
 
 [implemented] sensors permission
+13xhttps://github.com/GrapheneOS/platform_frameworks_base/commit/64e32600a9e4a6d595cfd027ba8144dbae360580
 12 https://github.com/GrapheneOS/platform_packages_modules_Permission/commit/452c474dfae9a312f6e01db5b28de308dbb14cc2
 12 https://github.com/GrapheneOS/platform_packages_modules_Permission/commit/daed8c4e3ff8bf94a2a9aa319d32ec2ff5653c8f
 12 https://github.com/GrapheneOS/platform_frameworks_native/commit/dcef490d7cab7bb9f96f8bfe19a8779ac140b26d
@@ -131,6 +143,7 @@ nojit
 9 https://github.com/GrapheneOS/platform_frameworks_base/commit/899441075ddbfc945cff97e433c9e1c9d6bde7af
 
 [implemented] network permission
+13xhttps://github.com/GrapheneOS/platform_frameworks_base/commit/51f155c1e9113c5b87734d53f808acc2873c4580
 12xhttps://github.com/GrapheneOS/platform_frameworks_base/commit/30370e36ac6945d4c837fb217ea747f66a6a7361
 12xhttps://github.com/GrapheneOS/platform_frameworks_base/commit/3dbe45681a043d44080e8c579e36a3a4562e75a1
 12xhttps://github.com/GrapheneOS/platform_frameworks_base/commit/fdf369f81209a9dea42ad0f4eff8e3912d48b8af
@@ -167,6 +180,7 @@ nojit
 9 https://github.com/GrapheneOS/platform_frameworks_base/commit/6ef61fd6f745b9709269d3612a3a4eea2250ebec
 
 [implemented] protected fifo/regular
+13 https://github.com/GrapheneOS/platform_system_sepolicy/commit/d51e7878fbce05a0740de63edfee1dd41148f990
 12 https://github.com/GrapheneOS/platform_system_core/commit/ddf48612c160b13552588af4d64bc7bb55571618
 12 https://github.com/GrapheneOS/platform_system_core/commit/fc8f654d4f905ee88c3cdd3494c6a65b2de6d5a1
 12 https://github.com/GrapheneOS/platform_system_sepolicy/commit/452bfdca38a4ffc3d3a2df9439694fcb8d0f9def
@@ -176,6 +190,10 @@ nojit
 10 https://github.com/GrapheneOS/platform_frameworks_base/commit/12a3d6dc2b94af26e1be34ec81c2581ef17f1582
 
 [implemented] always random mac
+13 https://github.com/GrapheneOS/platform_packages_apps_Settings/commit/36e57f959e0f616c21c1736a27d9d00c130d3253
+13 https://github.com/GrapheneOS/platform_frameworks_opt_net_wifi/commit/9814c0700ff10ae1d58f9448d71854838f504b5b
+13 https://github.com/GrapheneOS/platform_packages_modules_Wifi/commit/b7c9f05e79246c64113bd73f66f75b3572946b36
+13 https://github.com/GrapheneOS/platform_packages_modules_NetworkStack/commit/791f2a5d60c231965aa5a56dcd871976a05e7097
 12 https://github.com/GrapheneOS/platform_packages_apps_Settings/commit/2e67bc8b420752bec795235ab6d5c27d0956b017
 12 https://github.com/GrapheneOS/platform_packages_modules_Wifi/commit/9a9e6eb3232720776230eebd70ab9816d5127c53
 12 https://github.com/GrapheneOS/platform_packages_modules_Wifi/commit/8bd5c19549b782a23c44afe313c52fc3253b5024
@@ -193,6 +211,22 @@ nojit
 10 https://github.com/GrapheneOS/platform_frameworks_opt_net_wifi/commit/87ede685fec2f92b978891c2eed5776f5f2ca204
 
 [implemented] bionic hardening
+13 https://github.com/GrapheneOS/platform_bionic/commit/62466d9d131aebb4454654e045d0afde187f0d84 #explicit zero
+13 https://github.com/GrapheneOS/platform_bionic/commit/f8c3140db93971abc776b4d5d9f64287a3ad02f9 #brk
+13 https://github.com/GrapheneOS/platform_bionic/commit/e5379e6fb4624931d39308088d0801b9fe9e054b #random
+13 https://github.com/GrapheneOS/platform_bionic/commit/35aff4c20bf4bdd12a765e7c0b3692089d32fa45 #undefined
+13 https://github.com/GrapheneOS/platform_bionic/commit/3b14d195c6de9dcbdcfc37d8ef90c0b65bf92209 #merge
+13 https://github.com/GrapheneOS/platform_bionic/commit/3d7649782fcb131935883ddef1cccf154a580500 #vla formatting
+13 https://github.com/GrapheneOS/platform_bionic/commit/8915fef70eb725b5e1b51c3c8a60f75b39fd2167 #pthread
+13 https://github.com/GrapheneOS/platform_bionic/commit/a3aa05d593d520a81a1278d91d3a41e6204c7b76 #read only
+13 https://github.com/GrapheneOS/platform_bionic/commit/5c09fbeda8dfd1a64852ac3c7746bda77b6260ce #zero
+13 https://github.com/GrapheneOS/platform_bionic/commit/807c194b1b9b256236c49baf3bb4bcb7eae634d8 #fork mmap
+13 https://github.com/GrapheneOS/platform_bionic/commit/4623600722e3c91a416c599518b06bf921b690a6 #memprot pthread
+13 https://github.com/GrapheneOS/platform_bionic/commit/3a6ccf8026e444b56ded41eb31b3e1b5e609dcb0 #xor
+13 https://github.com/GrapheneOS/platform_bionic/commit/40cee4efd256f9ef8c676e429287a8195762e6b2 #junk
+13 https://github.com/GrapheneOS/platform_bionic/commit/0f6716f3ff6ea721bab23e84411661b82e70841f #guard
+13 https://github.com/GrapheneOS/platform_bionic/commit/e40393e6f01204f28924c37d9afde4a0639bfd3e #pthread guard
+13 https://github.com/GrapheneOS/platform_bionic/commit/48edd2dc2af0aa0f691289d83b27eafdf1b9011e #stack rand
 12 https://github.com/GrapheneOS/platform_bionic/commit/72dc351222621913b4350ae85fb836e0d6ce45a1 #explicit zero
 12 https://github.com/GrapheneOS/platform_bionic/commit/1912d38d17233cb5b6b4d0bd5cfc04d5da91fe18 #brk
 12 https://github.com/GrapheneOS/platform_bionic/commit/c6c9ea18bada95a07504440460e832a4e78c949c #random
@@ -262,24 +296,37 @@ nojit
 9  https://github.com/GrapheneOS/platform_bionic/commit/85e5bca0a525a1cb8142aa092286ae3424983dd5 #move
 
 [implemented] automatically reboot device after timeout if set
+13 https://github.com/GrapheneOS/platform_frameworks_base/commit/5b1e3b1adebc69fc427b5e5bdfe80040a945a988
+13 https://github.com/GrapheneOS/platform_packages_apps_Settings/commit/91aaddcc6d5dda916dee0611ceeccb7300c1f8ab
 12 https://github.com/GrapheneOS/platform_frameworks_base/commit/663efe46ab069c5121c729ebe9bb46503e36a813
 12 https://github.com/GrapheneOS/platform_packages_apps_Settings/commit/a33e2ac46038f8fcf096f4fd129a2f7cee23174b
 11 https://github.com/GrapheneOS/platform_frameworks_base/commit/3afe69fda4e6d89c90bb5d35e43ed2cc272e20dc
 11 https://github.com/GrapheneOS/platform_packages_apps_Settings/commit/607919bb5de5aa42558f73840a1f1c06fc5c04fd
 
+[implemented] system_server extensions
+13 https://github.com/GrapheneOS/platform_frameworks_base/commit/b11b8567b91234fc26b86e06b7f4ffab15e11140
+
 [implemented] Bluetooth auto turn off (partial CalyxOS)
+13 https://github.com/GrapheneOS/platform_frameworks_base/commit/647d5ff84f600579576cacbda2e9ecfa4efaa5ac
+13 https://github.com/GrapheneOS/platform_packages_apps_Settings/commit/38ba109db0f7e79821c014b199a18f3a1af6e250
 12 https://github.com/GrapheneOS/platform_frameworks_base/commit/6577307ef97cfeb4ba951d0c9e2696a21bd1237a
 12 https://github.com/GrapheneOS/platform_packages_apps_Settings/commit/cfc5b87c62cc67b5a242a3030eba7fff934871b5
 11 https://github.com/GrapheneOS/platform_frameworks_base/commit/e9d17cd4807dbfa837b16296b3a2e4434c060002
 11 https://github.com/GrapheneOS/platform_packages_apps_Settings/commit/43ca9fac87286bab5db3be5ee079e0047a469a66
 
 [implemented] Wi-Fi auto turn off (partial CalyxOS)
+13 https://github.com/GrapheneOS/platform_frameworks_base/commit/edc426dd2fb8cc519bfbb934ee58d7e95eae0ebe
+13 https://github.com/GrapheneOS/platform_packages_apps_Settings/commit/1f9ca051a9960fa82e9e172d1a571d1596404c3d
 12 https://github.com/GrapheneOS/platform_frameworks_base/commit/b008fb6e05af55577bad6046af4a91af4fccaeca
 12 https://github.com/GrapheneOS/platform_packages_apps_Settings/commit/0f8a16323cfe431da8146e5ae58972c42b4d32d6
 11 https://github.com/GrapheneOS/platform_frameworks_base/commit/423f3e151beae0c608881d4bf16b8dff22b5efc6
 11 https://github.com/GrapheneOS/platform_packages_apps_Settings/commit/ff9e9e0abf72b4df05d21bb462a305c8c09a8ba0
 
 [implemented] ptrace scope
+13 https://github.com/GrapheneOS/platform_packages_apps_Settings/commit/426ace8bd191266138b47929cea2c179550910c2
+13 https://github.com/GrapheneOS/platform_system_sepolicy/commit/e4694afc15dca0efeb27a693baffb0238bb163c3
+13 https://github.com/GrapheneOS/platform_system_sepolicy/commit/6bd1b07a7c479cbe683db175bce6cc8f7779d71d
+13 https://github.com/GrapheneOS/platform_system_core/commit/57fea4a2c948c237f88ec619aa43b8dbf77095a1
 12 https://github.com/GrapheneOS/platform_packages_apps_Settings/commit/5856ae7235b4b7880eee747b36c555ed3dc18c15
 12 https://github.com/GrapheneOS/platform_system_core/commit/e3f9fc0f142294720e0cc69b6b80a336747def72
 12 https://github.com/GrapheneOS/platform_system_sepolicy/commit/1969d65929ce84a75f502cd4980ad8f10b10db0c
@@ -290,6 +337,8 @@ nojit
 11 https://github.com/GrapheneOS/platform_packages_apps_Settings/commit/52ea603339c54d589009c8ee218509f3835ad011
 
 [implemented] fwrapv
+13 https://github.com/GrapheneOS/platform_build/commit/b602dc513b17522410a19710e7186aaa58c278d5
+13 https://github.com/GrapheneOS/platform_build_soong/commit/36ac3e0806cdcd0c46647d784523c0b946c257a6
 12 https://github.com/GrapheneOS/platform_build/commit/3f48705d28662a3e95d13f4e7fec6f49f59b34f3
 12 https://github.com/GrapheneOS/platform_build_soong/commit/428b9ac0dd158026a47b1d512cb6b13bf9995032
 11 https://github.com/GrapheneOS/platform_build_soong/commit/7c87660739544e1ab3bef757dae869894c01cb2e
@@ -312,10 +361,17 @@ nojit
 9x https://github.com/GrapheneOS/platform_system_bt/commit/c5db5a9f9e8c0b7fc0b96390f5a58089f8fbbe32
 
 [implemented] secondary user disable install
+13 https://github.com/GrapheneOS/platform_packages_apps_Settings/commit/9aec08f299ef2be29e717b25b0211ba2d8745dfb
 12 https://github.com/GrapheneOS/platform_packages_apps_Settings/commit/2120c698b9146047a9a76a61cc9946a8be30c210
 11 https://github.com/GrapheneOS/platform_packages_apps_Settings/commit/62f81c237b7f4a33fbb13752def9cbf3f5c9e0d4
 
 [implemented] constify
+13 https://github.com/GrapheneOS/platform_art/commit/fd1f3ab3277bde55559ca0c377df2960c92da033
+13 https://github.com/GrapheneOS/platform_frameworks_base/commit/1e1014e3fe5868f082af0aaa4135981096802e36
+13 https://github.com/GrapheneOS/platform_external_conscrypt/commit/9156c24225d559f04de15ab4d554a6508174d1cb
+13 https://github.com/GrapheneOS/platform_frameworks_ex/commit/81e1b0977057a79697f04f19e4802393166634c4
+13 https://github.com/GrapheneOS/platform_libcore/commit/3db31e42c2b1fd603784740eae152dc4cb49040c
+13 https://github.com/GrapheneOS/platform_packages_apps_Nfc/commit/706324620259083541bc923d06b690b6404bb00e
 12 https://github.com/GrapheneOS/platform_frameworks_base/commit/b3a5c3db7fa158619656871ba3c5e3a73ee73725
 12 https://github.com/GrapheneOS/platform_art/commit/290124f03583d79e9d444af3a047137d65d27870
 12 https://github.com/GrapheneOS/platform_packages_apps_Nfc/commit/862e68ca4e085bbb008196f2483f37ef4d0ed331
@@ -346,10 +402,28 @@ nojit
 9  https://github.com/GrapheneOS/platform_art/commit/76bf4c46f0090423ead013f02c6b0b4e58b33c95
 
 [implemented] exec spawning toggle
+13 https://github.com/GrapheneOS/platform_packages_apps_Settings/commit/5afd1a5403eaea5bde396b4b9a1c026cdf3444a3
 12 https://github.com/GrapheneOS/platform_packages_apps_Settings/commit/9ae00559df9661b8b46750cba93266c5adaacf0e
 12 https://github.com/GrapheneOS/platform_frameworks_base/commit/f4b8f281032c4d69b22c6d1b47adec3123c526fc
 
 [implemented] exec spawning
+13 https://github.com/GrapheneOS/platform_build/commit/b61886519903fadc69bd0c8faf6e610e6114089f
+13 https://github.com/GrapheneOS/platform_frameworks_base/commit/f6454056a0bed0ca737729c908203deb40413a82
+13 https://github.com/GrapheneOS/platform_frameworks_base/commit/8c137a9695244d36b8087df5b3d0dba6cf799947
+13 https://github.com/GrapheneOS/platform_frameworks_base/commit/f60c56fc37c98366aaeec4842bfd7550c32c19c5
+13 https://github.com/GrapheneOS/platform_frameworks_base/commit/942e6d02b07b6f6b73a20b1946c7eeda4dbc57e6
+13xhttps://github.com/GrapheneOS/platform_frameworks_base/commit/07e331134dd7fc7794cb4e9118fe3fe6b7ad0eb3
+13 https://github.com/GrapheneOS/platform_frameworks_base/commit/ad633f4ff31ebddaf3aec1e90432946dd5814d67
+13 https://github.com/GrapheneOS/platform_frameworks_base/commit/fc746360ab39e6024d88c7170a48cb3a85d30db1
+13 https://github.com/GrapheneOS/platform_frameworks_base/commit/00276bdd8425f7c6ab8d30ec017f68f3c849660a
+13 https://github.com/GrapheneOS/platform_frameworks_base/commit/1ac12342486c84014003563b0cdbb8956135423f
+13 https://github.com/GrapheneOS/platform_frameworks_base/commit/0bceff56a0d5dc48ad512daddc79ee792c5412df
+13 https://github.com/GrapheneOS/platform_frameworks_base/commit/c4d421d9700258ba58cdb38b2cf9ee6110cf190c
+13 https://github.com/GrapheneOS/platform_frameworks_base/commit/c21272358c055a45343176299a4bfa2c3f7ba76e
+13 https://github.com/GrapheneOS/platform_frameworks_base/commit/43b00f2b01ea8522a4295da0d6ff7b57d5b6204c
+13 https://github.com/GrapheneOS/platform_libcore/commit/7fc6b36e04d21855e37a362285e2c3fdd619ff55
+13 https://github.com/GrapheneOS/platform_libcore/commit/1655920912a470b64eb37985c94963eed0dc1554
+13 https://github.com/GrapheneOS/platform_system_core/commit/d0074777a84e2315f9e9545b07db16621f577bc5
 12 https://github.com/GrapheneOS/platform_frameworks_base/commit/0e356d803d9a4fe0cbc8fb41ed7622bea41d7deb
 12 https://github.com/GrapheneOS/platform_frameworks_base/commit/89dded236b1fee41914510840055b7cc4d6369cb
 12 https://github.com/GrapheneOS/platform_frameworks_base/commit/e3ffa598b29637f3d67bed71fac3b0c01f6bb881
@@ -407,6 +481,8 @@ nojit
 9  https://github.com/GrapheneOS/platform_frameworks_base/commit/8806ec3ef166fe1fd1eeb690ace6dd5a7682195c
 
 [implemented] hardened_malloc
+13 https://github.com/GrapheneOS/platform_bionic/commit/c420a5e1fbb68b04549d02f08f5184e1d78412a2
+13 https://github.com/GrapheneOS/platform_build_soong/commit/1907c48ba4cd48a77b4838d5a835e4dbfd659b71
 12 https://github.com/GrapheneOS/platform_bionic/commit/e63d04c19cf13923165b30ad3b7cd499ad8f05e6
 12 https://github.com/GrapheneOS/platform_build_soong/commit/cc973e807d440a2cfe7bed420fbf7ae25985ddc1
 12 https://github.com/GrapheneOS/platform_system_core/commit/0b3bd63d593f3182ab6295695dc092f8a9b0eb20

Patches/LineageOS-20.0/android_art/0001-constify_JNINativeMethod.patch

@@ -0,0 +1,525 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Tue, 16 Aug 2022 16:48:08 -0400
+Subject: [PATCH] constify JNINativeMethod tables
+
+---
+ benchmark/micro-native/micro_native.cc                    | 8 ++++----
+ runtime/native/dalvik_system_BaseDexClassLoader.cc        | 2 +-
+ runtime/native/dalvik_system_DexFile.cc                   | 2 +-
+ runtime/native/dalvik_system_VMDebug.cc                   | 2 +-
+ runtime/native/dalvik_system_VMRuntime.cc                 | 2 +-
+ runtime/native/dalvik_system_VMStack.cc                   | 2 +-
+ runtime/native/dalvik_system_ZygoteHooks.cc               | 2 +-
+ runtime/native/java_lang_Class.cc                         | 2 +-
+ runtime/native/java_lang_Object.cc                        | 2 +-
+ runtime/native/java_lang_String.cc                        | 2 +-
+ runtime/native/java_lang_StringFactory.cc                 | 2 +-
+ runtime/native/java_lang_System.cc                        | 2 +-
+ runtime/native/java_lang_Thread.cc                        | 2 +-
+ runtime/native/java_lang_Throwable.cc                     | 2 +-
+ runtime/native/java_lang_VMClassLoader.cc                 | 2 +-
+ runtime/native/java_lang_invoke_MethodHandle.cc           | 2 +-
+ runtime/native/java_lang_invoke_MethodHandleImpl.cc       | 2 +-
+ runtime/native/java_lang_ref_FinalizerReference.cc        | 2 +-
+ runtime/native/java_lang_ref_Reference.cc                 | 2 +-
+ runtime/native/java_lang_reflect_Array.cc                 | 2 +-
+ runtime/native/java_lang_reflect_Constructor.cc           | 2 +-
+ runtime/native/java_lang_reflect_Executable.cc            | 2 +-
+ runtime/native/java_lang_reflect_Field.cc                 | 2 +-
+ runtime/native/java_lang_reflect_Method.cc                | 2 +-
+ runtime/native/java_lang_reflect_Parameter.cc             | 2 +-
+ runtime/native/java_lang_reflect_Proxy.cc                 | 2 +-
+ runtime/native/java_util_concurrent_atomic_AtomicLong.cc  | 2 +-
+ runtime/native/jdk_internal_misc_Unsafe.cc                | 2 +-
+ runtime/native/libcore_io_Memory.cc                       | 2 +-
+ runtime/native/libcore_util_CharsetUtils.cc               | 2 +-
+ .../native/org_apache_harmony_dalvik_ddmc_DdmServer.cc    | 2 +-
+ .../org_apache_harmony_dalvik_ddmc_DdmVmInternal.cc       | 2 +-
+ runtime/native/sun_misc_Unsafe.cc                         | 2 +-
+ test/004-JniTest/jni_test.cc                              | 2 +-
+ test/139-register-natives/regnative.cc                    | 2 +-
+ 35 files changed, 38 insertions(+), 38 deletions(-)
+
+diff --git a/benchmark/micro-native/micro_native.cc b/benchmark/micro-native/micro_native.cc
+index dffbf3b11d..e70366cc48 100644
+--- a/benchmark/micro-native/micro_native.cc
++++ b/benchmark/micro-native/micro_native.cc
+@@ -38,7 +38,7 @@
+ static void NativeMethods_emptyJniStaticSynchronizedMethod0(JNIEnv*, jclass) { }
+ static void NativeMethods_emptyJniSynchronizedMethod0(JNIEnv*, jclass) { }
+ 
+-static JNINativeMethod gMethods_NormalOnly[] = {
++static const JNINativeMethod gMethods_NormalOnly[] = {
+   NATIVE_METHOD(NativeMethods, emptyJniStaticSynchronizedMethod0, "()V"),
+   NATIVE_METHOD(NativeMethods, emptyJniSynchronizedMethod0, "()V"),
+ };
+@@ -53,7 +53,7 @@ static void NativeMethods_emptyJniStaticMethod6L(JNIEnv*, jclass, jobject, jarra
+ static void NativeMethods_emptyJniStaticMethod0(JNIEnv*, jclass) { }
+ static void NativeMethods_emptyJniStaticMethod6(JNIEnv*, jclass, int, int, int, int, int, int) { }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+   NATIVE_METHOD(NativeMethods, emptyJniMethod0, "()V"),
+   NATIVE_METHOD(NativeMethods, emptyJniMethod6, "(IIIIII)V"),
+   NATIVE_METHOD(NativeMethods, emptyJniMethod6L, "(Ljava/lang/String;[Ljava/lang/String;[[ILjava/lang/Object;[Ljava/lang/Object;[[[[Ljava/lang/Object;)V"),
+@@ -72,7 +72,7 @@ static void NativeMethods_emptyJniStaticMethod6L_Fast(JNIEnv*, jclass, jobject,
+ static void NativeMethods_emptyJniStaticMethod0_Fast(JNIEnv*, jclass) { }
+ static void NativeMethods_emptyJniStaticMethod6_Fast(JNIEnv*, jclass, int, int, int, int, int, int) { }
+ 
+-static JNINativeMethod gMethods_Fast[] = {
++static const JNINativeMethod gMethods_Fast[] = {
+   NATIVE_METHOD(NativeMethods, emptyJniMethod0_Fast, "()V"),
+   NATIVE_METHOD(NativeMethods, emptyJniMethod6_Fast, "(IIIIII)V"),
+   NATIVE_METHOD(NativeMethods, emptyJniMethod6L_Fast, "(Ljava/lang/String;[Ljava/lang/String;[[ILjava/lang/Object;[Ljava/lang/Object;[[[[Ljava/lang/Object;)V"),
+@@ -88,7 +88,7 @@ DEFINE_CRITICAL_JNI_METHOD(void, emptyJniStaticMethod0_1Critical)() { }
+ DEFINE_NORMAL_JNI_METHOD(void,   emptyJniStaticMethod6_1Critical)(JNIEnv*, jclass, int, int, int, int, int, int) { }
+ DEFINE_CRITICAL_JNI_METHOD(void, emptyJniStaticMethod6_1Critical)(int, int, int, int, int, int) { }
+ 
+-static JNINativeMethod gMethods_Critical[] = {
++static const JNINativeMethod gMethods_Critical[] = {
+   // Don't use NATIVE_METHOD because the name is mangled differently.
+   { "emptyJniStaticMethod0_Critical", "()V",
+         reinterpret_cast<void*>(NAME_CRITICAL_JNI_METHOD(emptyJniStaticMethod0_1Critical)) },
+diff --git a/runtime/native/dalvik_system_BaseDexClassLoader.cc b/runtime/native/dalvik_system_BaseDexClassLoader.cc
+index 607395d308..f3d84e57a8 100644
+--- a/runtime/native/dalvik_system_BaseDexClassLoader.cc
++++ b/runtime/native/dalvik_system_BaseDexClassLoader.cc
+@@ -58,7 +58,7 @@ static jobjectArray BaseDexClassLoader_computeClassLoaderContextsNative(JNIEnv*
+   return result;
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+   NATIVE_METHOD(BaseDexClassLoader, computeClassLoaderContextsNative,
+                 "()[Ljava/lang/String;"),
+ };
+diff --git a/runtime/native/dalvik_system_DexFile.cc b/runtime/native/dalvik_system_DexFile.cc
+index d714206241..9a75010174 100644
+--- a/runtime/native/dalvik_system_DexFile.cc
++++ b/runtime/native/dalvik_system_DexFile.cc
+@@ -922,7 +922,7 @@ static void DexFile_setTrusted(JNIEnv* env, jclass, jobject j_cookie) {
+   }
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+   NATIVE_METHOD(DexFile, closeDexFile, "(Ljava/lang/Object;)Z"),
+   NATIVE_METHOD(DexFile,
+                 defineClassNative,
+diff --git a/runtime/native/dalvik_system_VMDebug.cc b/runtime/native/dalvik_system_VMDebug.cc
+index 2e09c9f2fe..b22a6a0128 100644
+--- a/runtime/native/dalvik_system_VMDebug.cc
++++ b/runtime/native/dalvik_system_VMDebug.cc
+@@ -494,7 +494,7 @@ static void VMDebug_setAllocTrackerStackDepth(JNIEnv* env, jclass, jint stack_de
+   }
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+   NATIVE_METHOD(VMDebug, countInstancesOfClass, "(Ljava/lang/Class;Z)J"),
+   NATIVE_METHOD(VMDebug, countInstancesOfClasses, "([Ljava/lang/Class;Z)[J"),
+   NATIVE_METHOD(VMDebug, dumpHprofData, "(Ljava/lang/String;I)V"),
+diff --git a/runtime/native/dalvik_system_VMRuntime.cc b/runtime/native/dalvik_system_VMRuntime.cc
+index db5d420035..693d1d572e 100644
+--- a/runtime/native/dalvik_system_VMRuntime.cc
++++ b/runtime/native/dalvik_system_VMRuntime.cc
+@@ -509,7 +509,7 @@ static jboolean VMRuntime_isValidClassLoaderContext(JNIEnv* env,
+   return ClassLoaderContext::IsValidEncoding(encoded_class_loader_context.c_str());
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+   FAST_NATIVE_METHOD(VMRuntime, addressOf, "(Ljava/lang/Object;)J"),
+   NATIVE_METHOD(VMRuntime, bootClassPath, "()Ljava/lang/String;"),
+   NATIVE_METHOD(VMRuntime, clampGrowthLimit, "()V"),
+diff --git a/runtime/native/dalvik_system_VMStack.cc b/runtime/native/dalvik_system_VMStack.cc
+index 71078c9ad2..457d3887df 100644
+--- a/runtime/native/dalvik_system_VMStack.cc
++++ b/runtime/native/dalvik_system_VMStack.cc
+@@ -168,7 +168,7 @@ static jobjectArray VMStack_getAnnotatedThreadStackTrace(JNIEnv* env, jclass, jo
+   return GetThreadStack(soa, javaThread, fn);
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+   FAST_NATIVE_METHOD(VMStack, fillStackTraceElements, "(Ljava/lang/Thread;[Ljava/lang/StackTraceElement;)I"),
+   FAST_NATIVE_METHOD(VMStack, getCallingClassLoader, "()Ljava/lang/ClassLoader;"),
+   FAST_NATIVE_METHOD(VMStack, getClosestUserClassLoader, "()Ljava/lang/ClassLoader;"),
+diff --git a/runtime/native/dalvik_system_ZygoteHooks.cc b/runtime/native/dalvik_system_ZygoteHooks.cc
+index eae7c2066e..088e62b2ff 100644
+--- a/runtime/native/dalvik_system_ZygoteHooks.cc
++++ b/runtime/native/dalvik_system_ZygoteHooks.cc
+@@ -454,7 +454,7 @@ static jboolean ZygoteHooks_nativeZygoteLongSuspendOk(JNIEnv* env ATTRIBUTE_UNUS
+ }
+ 
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+   NATIVE_METHOD(ZygoteHooks, nativePreFork, "()J"),
+   NATIVE_METHOD(ZygoteHooks, nativePostZygoteFork, "()V"),
+   NATIVE_METHOD(ZygoteHooks, nativePostForkSystemServer, "(I)V"),
+diff --git a/runtime/native/java_lang_Class.cc b/runtime/native/java_lang_Class.cc
+index da42e61ce1..a16577df2a 100644
+--- a/runtime/native/java_lang_Class.cc
++++ b/runtime/native/java_lang_Class.cc
+@@ -838,7 +838,7 @@ static jobject Class_newInstance(JNIEnv* env, jobject javaThis) {
+   return soa.AddLocalReference<jobject>(receiver.Get());
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+   FAST_NATIVE_METHOD(Class, classForName,
+                 "(Ljava/lang/String;ZLjava/lang/ClassLoader;)Ljava/lang/Class;"),
+   FAST_NATIVE_METHOD(Class, getDeclaredAnnotation,
+diff --git a/runtime/native/java_lang_Object.cc b/runtime/native/java_lang_Object.cc
+index 8fc10d1114..8740755199 100644
+--- a/runtime/native/java_lang_Object.cc
++++ b/runtime/native/java_lang_Object.cc
+@@ -54,7 +54,7 @@ static jint Object_identityHashCodeNative(JNIEnv* env, jclass, jobject javaObjec
+   return static_cast<jint>(o->IdentityHashCode());
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+   FAST_NATIVE_METHOD(Object, internalClone, "()Ljava/lang/Object;"),
+   FAST_NATIVE_METHOD(Object, notify, "()V"),
+   FAST_NATIVE_METHOD(Object, notifyAll, "()V"),
+diff --git a/runtime/native/java_lang_String.cc b/runtime/native/java_lang_String.cc
+index 94ca5b53d6..4313c8af2d 100644
+--- a/runtime/native/java_lang_String.cc
++++ b/runtime/native/java_lang_String.cc
+@@ -117,7 +117,7 @@ static jstring String_doRepeat(JNIEnv* env, jobject java_this, jint count) {
+   return soa.AddLocalReference<jstring>(result);
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+   FAST_NATIVE_METHOD(String, charAt, "(I)C"),
+   FAST_NATIVE_METHOD(String, compareTo, "(Ljava/lang/String;)I"),
+   FAST_NATIVE_METHOD(String, concat, "(Ljava/lang/String;)Ljava/lang/String;"),
+diff --git a/runtime/native/java_lang_StringFactory.cc b/runtime/native/java_lang_StringFactory.cc
+index 9086ee932d..de0a81e9a5 100644
+--- a/runtime/native/java_lang_StringFactory.cc
++++ b/runtime/native/java_lang_StringFactory.cc
+@@ -264,7 +264,7 @@ static jstring StringFactory_newStringFromUtf8Bytes(JNIEnv* env, jclass, jbyteAr
+   return soa.AddLocalReference<jstring>(result);
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+   FAST_NATIVE_METHOD(StringFactory, newStringFromBytes, "([BIII)Ljava/lang/String;"),
+   FAST_NATIVE_METHOD(StringFactory, newStringFromChars, "(II[C)Ljava/lang/String;"),
+   FAST_NATIVE_METHOD(StringFactory, newStringFromString, "(Ljava/lang/String;)Ljava/lang/String;"),
+diff --git a/runtime/native/java_lang_System.cc b/runtime/native/java_lang_System.cc
+index 63cbd2c815..e7b3894aad 100644
+--- a/runtime/native/java_lang_System.cc
++++ b/runtime/native/java_lang_System.cc
+@@ -239,7 +239,7 @@ static void System_arraycopyBooleanUnchecked(JNIEnv* env,
+       javaDst, dstPos, count);
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+   FAST_NATIVE_METHOD(System, arraycopy, "(Ljava/lang/Object;ILjava/lang/Object;II)V"),
+   FAST_NATIVE_METHOD(System, arraycopyCharUnchecked, "([CI[CII)V"),
+   FAST_NATIVE_METHOD(System, arraycopyByteUnchecked, "([BI[BII)V"),
+diff --git a/runtime/native/java_lang_Thread.cc b/runtime/native/java_lang_Thread.cc
+index 570c554782..f90db08a8d 100644
+--- a/runtime/native/java_lang_Thread.cc
++++ b/runtime/native/java_lang_Thread.cc
+@@ -195,7 +195,7 @@ static void Thread_yield(JNIEnv*, jobject) {
+   sched_yield();
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+   FAST_NATIVE_METHOD(Thread, currentThread, "()Ljava/lang/Thread;"),
+   FAST_NATIVE_METHOD(Thread, interrupted, "()Z"),
+   FAST_NATIVE_METHOD(Thread, isInterrupted, "()Z"),
+diff --git a/runtime/native/java_lang_Throwable.cc b/runtime/native/java_lang_Throwable.cc
+index b89e287481..5cdd70c513 100644
+--- a/runtime/native/java_lang_Throwable.cc
++++ b/runtime/native/java_lang_Throwable.cc
+@@ -38,7 +38,7 @@ static jobjectArray Throwable_nativeGetStackTrace(JNIEnv* env, jclass, jobject j
+   return Thread::InternalStackTraceToStackTraceElementArray(soa, javaStackState);
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+   FAST_NATIVE_METHOD(Throwable, nativeFillInStackTrace, "()Ljava/lang/Object;"),
+   FAST_NATIVE_METHOD(Throwable, nativeGetStackTrace, "(Ljava/lang/Object;)[Ljava/lang/StackTraceElement;"),
+ };
+diff --git a/runtime/native/java_lang_VMClassLoader.cc b/runtime/native/java_lang_VMClassLoader.cc
+index 11e02a2ce4..ce37a33086 100644
+--- a/runtime/native/java_lang_VMClassLoader.cc
++++ b/runtime/native/java_lang_VMClassLoader.cc
+@@ -155,7 +155,7 @@ static jobjectArray VMClassLoader_getBootClassPathEntries(JNIEnv* env, jclass) {
+   return array;
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+   FAST_NATIVE_METHOD(VMClassLoader, findLoadedClass, "(Ljava/lang/ClassLoader;Ljava/lang/String;)Ljava/lang/Class;"),
+   NATIVE_METHOD(VMClassLoader, getBootClassPathEntries, "()[Ljava/lang/String;"),
+ };
+diff --git a/runtime/native/java_lang_invoke_MethodHandle.cc b/runtime/native/java_lang_invoke_MethodHandle.cc
+index 5309a28a09..ed2d5ae126 100644
+--- a/runtime/native/java_lang_invoke_MethodHandle.cc
++++ b/runtime/native/java_lang_invoke_MethodHandle.cc
+@@ -37,7 +37,7 @@ static void MethodHandle_invokeExactWithFrame(JNIEnv* env, jobject thiz, jobject
+   MethodHandleInvokeExactWithFrame(soa.Self(), handle, frame);
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+   NATIVE_METHOD(MethodHandle, invokeExactWithFrame, "(Ldalvik/system/EmulatedStackFrame;)V")
+ };
+ 
+diff --git a/runtime/native/java_lang_invoke_MethodHandleImpl.cc b/runtime/native/java_lang_invoke_MethodHandleImpl.cc
+index 00ce01f11a..fc53b82d36 100644
+--- a/runtime/native/java_lang_invoke_MethodHandleImpl.cc
++++ b/runtime/native/java_lang_invoke_MethodHandleImpl.cc
+@@ -63,7 +63,7 @@ static jobject MethodHandleImpl_getMemberInternal(JNIEnv* env, jobject thiz) {
+   return soa.AddLocalReference<jobject>(h_object.Get());
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+   NATIVE_METHOD(MethodHandleImpl, getMemberInternal, "()Ljava/lang/reflect/Member;"),
+ };
+ 
+diff --git a/runtime/native/java_lang_ref_FinalizerReference.cc b/runtime/native/java_lang_ref_FinalizerReference.cc
+index 535b243411..0a8dfb6c09 100644
+--- a/runtime/native/java_lang_ref_FinalizerReference.cc
++++ b/runtime/native/java_lang_ref_FinalizerReference.cc
+@@ -42,7 +42,7 @@ static jobject FinalizerReference_getReferent(JNIEnv* env, jobject javaThis) {
+   return soa.AddLocalReference<jobject>(referent);
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+   FAST_NATIVE_METHOD(FinalizerReference, makeCircularListIfUnenqueued, "()Z"),
+   FAST_NATIVE_METHOD(FinalizerReference, getReferent, "()Ljava/lang/Object;"),
+ };
+diff --git a/runtime/native/java_lang_ref_Reference.cc b/runtime/native/java_lang_ref_Reference.cc
+index f23010bf48..e36287154f 100644
+--- a/runtime/native/java_lang_ref_Reference.cc
++++ b/runtime/native/java_lang_ref_Reference.cc
+@@ -73,7 +73,7 @@ static void Reference_clearReferent(JNIEnv* env, jobject javaThis) {
+   Runtime::Current()->GetHeap()->GetReferenceProcessor()->ClearReferent(ref);
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+   FAST_NATIVE_METHOD(Reference, getReferent, "()Ljava/lang/Object;"),
+   FAST_NATIVE_METHOD(Reference, clearReferent, "()V"),
+   FAST_NATIVE_METHOD(Reference, refersTo0, "(Ljava/lang/Object;)Z"),
+diff --git a/runtime/native/java_lang_reflect_Array.cc b/runtime/native/java_lang_reflect_Array.cc
+index ff94593cdf..e359e7d8a8 100644
+--- a/runtime/native/java_lang_reflect_Array.cc
++++ b/runtime/native/java_lang_reflect_Array.cc
+@@ -74,7 +74,7 @@ static jobject Array_createObjectArray(JNIEnv* env, jclass, jclass javaElementCl
+   return soa.AddLocalReference<jobject>(new_array);
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+   FAST_NATIVE_METHOD(Array, createMultiArray, "(Ljava/lang/Class;[I)Ljava/lang/Object;"),
+   FAST_NATIVE_METHOD(Array, createObjectArray, "(Ljava/lang/Class;I)Ljava/lang/Object;"),
+ };
+diff --git a/runtime/native/java_lang_reflect_Constructor.cc b/runtime/native/java_lang_reflect_Constructor.cc
+index 1d362c0302..16f5dedb44 100644
+--- a/runtime/native/java_lang_reflect_Constructor.cc
++++ b/runtime/native/java_lang_reflect_Constructor.cc
+@@ -128,7 +128,7 @@ static jobject Constructor_newInstanceFromSerialization(JNIEnv* env, jclass unus
+     return env->NewObject(allocClass, ctor);
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+   FAST_NATIVE_METHOD(Constructor, getExceptionTypes, "()[Ljava/lang/Class;"),
+   FAST_NATIVE_METHOD(Constructor, newInstance0, "([Ljava/lang/Object;)Ljava/lang/Object;"),
+   FAST_NATIVE_METHOD(Constructor, newInstanceFromSerialization, "(Ljava/lang/Class;Ljava/lang/Class;)Ljava/lang/Object;"),
+diff --git a/runtime/native/java_lang_reflect_Executable.cc b/runtime/native/java_lang_reflect_Executable.cc
+index fef16b9099..1acce4e5d3 100644
+--- a/runtime/native/java_lang_reflect_Executable.cc
++++ b/runtime/native/java_lang_reflect_Executable.cc
+@@ -383,7 +383,7 @@ static jint Executable_getParameterCountInternal(JNIEnv* env, jobject javaMethod
+ }
+ 
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+   FAST_NATIVE_METHOD(Executable, compareMethodParametersInternal,
+                      "(Ljava/lang/reflect/Method;)I"),
+   FAST_NATIVE_METHOD(Executable, getAnnotationNative,
+diff --git a/runtime/native/java_lang_reflect_Field.cc b/runtime/native/java_lang_reflect_Field.cc
+index cfc4a292ba..7bbff9ba36 100644
+--- a/runtime/native/java_lang_reflect_Field.cc
++++ b/runtime/native/java_lang_reflect_Field.cc
+@@ -521,7 +521,7 @@ static jboolean Field_isAnnotationPresentNative(JNIEnv* env,
+   return annotations::IsFieldAnnotationPresent(field, klass);
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+   FAST_NATIVE_METHOD(Field, get,        "(Ljava/lang/Object;)Ljava/lang/Object;"),
+   FAST_NATIVE_METHOD(Field, getBoolean, "(Ljava/lang/Object;)Z"),
+   FAST_NATIVE_METHOD(Field, getByte,    "(Ljava/lang/Object;)B"),
+diff --git a/runtime/native/java_lang_reflect_Method.cc b/runtime/native/java_lang_reflect_Method.cc
+index 2c0dd806e1..e052ba9b2c 100644
+--- a/runtime/native/java_lang_reflect_Method.cc
++++ b/runtime/native/java_lang_reflect_Method.cc
+@@ -86,7 +86,7 @@ static jobject Method_invoke(JNIEnv* env, jobject javaMethod, jobject javaReceiv
+   return InvokeMethod<kRuntimePointerSize>(soa, javaMethod, javaReceiver, javaArgs);
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+   FAST_NATIVE_METHOD(Method, getDefaultValue, "()Ljava/lang/Object;"),
+   FAST_NATIVE_METHOD(Method, getExceptionTypes, "()[Ljava/lang/Class;"),
+   FAST_NATIVE_METHOD(Method, invoke, "(Ljava/lang/Object;[Ljava/lang/Object;)Ljava/lang/Object;"),
+diff --git a/runtime/native/java_lang_reflect_Parameter.cc b/runtime/native/java_lang_reflect_Parameter.cc
+index 263a56796f..92bf9078a4 100644
+--- a/runtime/native/java_lang_reflect_Parameter.cc
++++ b/runtime/native/java_lang_reflect_Parameter.cc
+@@ -98,7 +98,7 @@ static jobject Parameter_getAnnotationNative(JNIEnv* env,
+       annotations::GetAnnotationForMethodParameter(method, parameterIndex, klass));
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+   FAST_NATIVE_METHOD(
+       Parameter,
+       getAnnotationNative,
+diff --git a/runtime/native/java_lang_reflect_Proxy.cc b/runtime/native/java_lang_reflect_Proxy.cc
+index f723ed223d..c2b533de5d 100644
+--- a/runtime/native/java_lang_reflect_Proxy.cc
++++ b/runtime/native/java_lang_reflect_Proxy.cc
+@@ -37,7 +37,7 @@ static jclass Proxy_generateProxy(JNIEnv* env, jclass, jstring name, jobjectArra
+       soa, name, interfaces, loader, methods, throws));
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+   FAST_NATIVE_METHOD(Proxy, generateProxy, "(Ljava/lang/String;[Ljava/lang/Class;Ljava/lang/ClassLoader;[Ljava/lang/reflect/Method;[[Ljava/lang/Class;)Ljava/lang/Class;"),
+ };
+ 
+diff --git a/runtime/native/java_util_concurrent_atomic_AtomicLong.cc b/runtime/native/java_util_concurrent_atomic_AtomicLong.cc
+index fa288edcb8..299ac5a61d 100644
+--- a/runtime/native/java_util_concurrent_atomic_AtomicLong.cc
++++ b/runtime/native/java_util_concurrent_atomic_AtomicLong.cc
+@@ -30,7 +30,7 @@ static jboolean AtomicLong_VMSupportsCS8(JNIEnv*, jclass) {
+   return QuasiAtomic::LongAtomicsUseMutexes(kRuntimeISA) ? JNI_FALSE : JNI_TRUE;
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+   NATIVE_METHOD(AtomicLong, VMSupportsCS8, "()Z"),
+ };
+ 
+diff --git a/runtime/native/jdk_internal_misc_Unsafe.cc b/runtime/native/jdk_internal_misc_Unsafe.cc
+index 307a2fa8b9..b945705273 100644
+--- a/runtime/native/jdk_internal_misc_Unsafe.cc
++++ b/runtime/native/jdk_internal_misc_Unsafe.cc
+@@ -494,7 +494,7 @@ static void Unsafe_unpark(JNIEnv* env, jobject, jobject jthread) {
+   }
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+   FAST_NATIVE_METHOD(Unsafe, compareAndSwapInt, "(Ljava/lang/Object;JII)Z"),
+   FAST_NATIVE_METHOD(Unsafe, compareAndSwapLong, "(Ljava/lang/Object;JJJ)Z"),
+   FAST_NATIVE_METHOD(Unsafe, compareAndSwapObject, "(Ljava/lang/Object;JLjava/lang/Object;Ljava/lang/Object;)Z"),
+diff --git a/runtime/native/libcore_io_Memory.cc b/runtime/native/libcore_io_Memory.cc
+index 5e38280259..8648ea3799 100644
+--- a/runtime/native/libcore_io_Memory.cc
++++ b/runtime/native/libcore_io_Memory.cc
+@@ -181,7 +181,7 @@ static void Memory_peekShortArray(JNIEnv* env,
+ }
+ 
+ // The remaining Memory methods are contained in libcore/luni/src/main/native/libcore_io_Memory.cpp
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+     FAST_NATIVE_METHOD(Memory, peekByteArray, "(J[BII)V"),
+     FAST_NATIVE_METHOD(Memory, peekCharArray, "(J[CIIZ)V"),
+     FAST_NATIVE_METHOD(Memory, peekDoubleArray, "(J[DIIZ)V"),
+diff --git a/runtime/native/libcore_util_CharsetUtils.cc b/runtime/native/libcore_util_CharsetUtils.cc
+index 92f355e3b1..58a98f0595 100644
+--- a/runtime/native/libcore_util_CharsetUtils.cc
++++ b/runtime/native/libcore_util_CharsetUtils.cc
+@@ -155,7 +155,7 @@ static jbyteArray CharsetUtils_toUtf8Bytes(JNIEnv* env, jclass, jstring java_str
+   return soa.AddLocalReference<jbyteArray>(result);
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+   FAST_NATIVE_METHOD(CharsetUtils, asciiBytesToChars, "([BII[C)V"),
+   FAST_NATIVE_METHOD(CharsetUtils, isoLatin1BytesToChars, "([BII[C)V"),
+   FAST_NATIVE_METHOD(CharsetUtils, toAsciiBytes, "(Ljava/lang/String;II)[B"),
+diff --git a/runtime/native/org_apache_harmony_dalvik_ddmc_DdmServer.cc b/runtime/native/org_apache_harmony_dalvik_ddmc_DdmServer.cc
+index 419aed8578..ccbef4f3f4 100644
+--- a/runtime/native/org_apache_harmony_dalvik_ddmc_DdmServer.cc
++++ b/runtime/native/org_apache_harmony_dalvik_ddmc_DdmServer.cc
+@@ -38,7 +38,7 @@ static void DdmServer_nativeSendChunk(JNIEnv* env, jclass, jint type,
+   Runtime::Current()->GetRuntimeCallbacks()->DdmPublishChunk(static_cast<uint32_t>(type), chunk);
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+   FAST_NATIVE_METHOD(DdmServer, nativeSendChunk, "(I[BII)V"),
+ };
+ 
+diff --git a/runtime/native/org_apache_harmony_dalvik_ddmc_DdmVmInternal.cc b/runtime/native/org_apache_harmony_dalvik_ddmc_DdmVmInternal.cc
+index 081ec2043a..a84d522e23 100644
+--- a/runtime/native/org_apache_harmony_dalvik_ddmc_DdmVmInternal.cc
++++ b/runtime/native/org_apache_harmony_dalvik_ddmc_DdmVmInternal.cc
+@@ -211,7 +211,7 @@ static jbyteArray DdmVmInternal_getThreadStats(JNIEnv* env, jclass) {
+   return result;
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+   NATIVE_METHOD(DdmVmInternal, setRecentAllocationsTrackingEnabled, "(Z)V"),
+   NATIVE_METHOD(DdmVmInternal, setThreadNotifyEnabled, "(Z)V"),
+   NATIVE_METHOD(DdmVmInternal, getStackTraceById, "(I)[Ljava/lang/StackTraceElement;"),
+diff --git a/runtime/native/sun_misc_Unsafe.cc b/runtime/native/sun_misc_Unsafe.cc
+index e9c5af013d..885603a4c9 100644
+--- a/runtime/native/sun_misc_Unsafe.cc
++++ b/runtime/native/sun_misc_Unsafe.cc
+@@ -541,7 +541,7 @@ static void Unsafe_unpark(JNIEnv* env, jobject, jobject jthread) {
+   }
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+   FAST_NATIVE_METHOD(Unsafe, compareAndSwapInt, "(Ljava/lang/Object;JII)Z"),
+   FAST_NATIVE_METHOD(Unsafe, compareAndSwapLong, "(Ljava/lang/Object;JJJ)Z"),
+   FAST_NATIVE_METHOD(Unsafe, compareAndSwapObject, "(Ljava/lang/Object;JLjava/lang/Object;Ljava/lang/Object;)Z"),
+diff --git a/test/004-JniTest/jni_test.cc b/test/004-JniTest/jni_test.cc
+index 429bd94fe0..1518f931ab 100644
+--- a/test/004-JniTest/jni_test.cc
++++ b/test/004-JniTest/jni_test.cc
+@@ -33,7 +33,7 @@ static JavaVM* jvm = nullptr;
+ static jint Java_Main_intFastNativeMethod(JNIEnv*, jclass, jint a, jint b, jint c);
+ static jint Java_Main_intCriticalNativeMethod(jint a, jint b, jint c);
+ 
+-static JNINativeMethod sMainMethods[] = {
++static const JNINativeMethod sMainMethods[] = {
+   {"intFastNativeMethod", "(III)I", reinterpret_cast<void*>(Java_Main_intFastNativeMethod) },
+   {"intCriticalNativeMethod", "(III)I", reinterpret_cast<void*>(Java_Main_intCriticalNativeMethod) },
+ };
+diff --git a/test/139-register-natives/regnative.cc b/test/139-register-natives/regnative.cc
+index d9c8b31ac7..083c14c1ec 100644
+--- a/test/139-register-natives/regnative.cc
++++ b/test/139-register-natives/regnative.cc
+@@ -22,7 +22,7 @@ namespace art {
+ static void foo(JNIEnv*, jclass) {
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+     { "foo", "()V", reinterpret_cast<void*>(foo) }
+ };
+ 

Patches/LineageOS-20.0/android_bionic/0001-HM-Use_HM.patch

@@ -0,0 +1,181 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Wed, 5 Dec 2018 01:51:56 -0500
+Subject: [PATCH] use Scudo on 32-bit and hardened_malloc on 64-bit
+
+Co-authored-by: anupritaisno1 <www.anuprita804@gmail.com>
+Signed-off-by: anupritaisno1 <www.anuprita804@gmail.com>
+[tad@spotco.us]: kept Lineage's scudo 32-bit workaround
+---
+ libc/Android.bp                  | 50 ++++++++++++++-----------------
+ libc/bionic/h_malloc_wrapper.cpp | 51 ++++++++++++++++++++++++++++++++
+ libc/bionic/malloc_common.h      |  8 +++++
+ 3 files changed, 82 insertions(+), 27 deletions(-)
+ create mode 100644 libc/bionic/h_malloc_wrapper.cpp
+
+diff --git a/libc/Android.bp b/libc/Android.bp
+index 544a1e0b4..a72a5d7fb 100644
+--- a/libc/Android.bp
++++ b/libc/Android.bp
+@@ -75,6 +75,8 @@ libc_common_flags = [
+     // ever touch 0, 1, or 2 bytes into a call to memset, which was never going
+     // to amortize.)
+     "-fno-builtin",
++
++    "-DH_MALLOC_PREFIX",
+ ]
+ 
+ // Define some common cflags
+@@ -120,19 +122,6 @@ cc_defaults {
+     ldflags: ["-Wl,-z,muldefs"],
+ 
+     multilib: {
+-        lib64: {
+-            product_variables: {
+-                malloc_zero_contents: {
+-                    cflags: ["-DSCUDO_ZERO_CONTENTS"],
+-                },
+-                malloc_pattern_fill_contents: {
+-                    cflags: ["-DSCUDO_PATTERN_FILL_CONTENTS"],
+-                },
+-                malloc_not_svelte: {
+-                    cflags: ["-DUSE_SCUDO"],
+-                },
+-            },
+-        },
+         lib32: {
+             product_variables: {
+                 malloc_zero_contents: {
+@@ -184,20 +173,19 @@ libc32_scudo_product_variables = {
+ // ========================================================
+ cc_defaults {
+     name: "libc_native_allocator_defaults",
+-
+-    whole_static_libs: [
+-        "libjemalloc5",
+-        "libc_jemalloc_wrapper",
+-    ],
+-    header_libs: ["gwp_asan_headers"],
++    whole_static_libs: ["libc_jemalloc_wrapper"],
+     multilib: {
+-        lib64: {
+-            product_variables: libc_scudo_product_variables,
+-        },
+         lib32: {
++            whole_static_libs: ["libjemalloc5"],
+             product_variables: libc32_scudo_product_variables,
+-        }
++        },
++        lib64: {
++            cflags: ["-DH_MALLOC_PREFIX"],
++            whole_static_libs: ["libhardened_malloc"],
++        },
+     },
++
++    header_libs: ["gwp_asan_headers"],
+ }
+ 
+ // Functions not implemented by jemalloc directly, or that need to
+@@ -205,12 +193,20 @@ cc_defaults {
+ cc_library_static {
+     name: "libc_jemalloc_wrapper",
+     defaults: ["libc_defaults"],
+-    srcs: ["bionic/jemalloc_wrapper.cpp"],
++    multilib: {
++        lib32: {
++            // Used to pull in the jemalloc/hardened_malloc include directory so that if the
++            // library is removed, the include directory is also removed.
++            srcs: ["bionic/jemalloc_wrapper.cpp"],
++            static_libs: ["libjemalloc5"],
++        },
++        lib64: {
++            srcs: ["bionic/h_malloc_wrapper.cpp"],
++            static_libs: ["libhardened_malloc"],
++        },
++    },
+     cflags: ["-fvisibility=hidden"],
+ 
+-    // Used to pull in the jemalloc include directory so that if the
+-    // library is removed, the include directory is also removed.
+-    static_libs: ["libjemalloc5"],
+ }
+ 
+ // ========================================================
+diff --git a/libc/bionic/h_malloc_wrapper.cpp b/libc/bionic/h_malloc_wrapper.cpp
+new file mode 100644
+index 000000000..5fb0968c2
+--- /dev/null
++++ b/libc/bionic/h_malloc_wrapper.cpp
+@@ -0,0 +1,51 @@
++#include <errno.h>
++#include <malloc.h>
++#include <sys/param.h>
++#include <unistd.h>
++
++#include <private/MallocXmlElem.h>
++
++#include "h_malloc.h"
++
++__BEGIN_DECLS
++int h_malloc_info(int options, FILE* fp);
++__END_DECLS
++
++int h_malloc_info(int options, FILE* fp) {
++  if (options != 0) {
++    errno = EINVAL;
++    return -1;
++  }
++
++  fflush(fp);
++  int fd = fileno(fp);
++  MallocXmlElem root(fd, "malloc", "version=\"jemalloc-1\"");
++
++  // Dump all of the large allocations in the arenas.
++  for (size_t i = 0; i < h_mallinfo_narenas(); i++) {
++    struct mallinfo mi = h_mallinfo_arena_info(i);
++    if (mi.hblkhd != 0) {
++      MallocXmlElem arena_elem(fd, "heap", "nr=\"%d\"", i);
++      {
++        MallocXmlElem(fd, "allocated-large").Contents("%zu", mi.ordblks);
++        MallocXmlElem(fd, "allocated-huge").Contents("%zu", mi.uordblks);
++        MallocXmlElem(fd, "allocated-bins").Contents("%zu", mi.fsmblks);
++
++        size_t total = 0;
++        for (size_t j = 0; j < h_mallinfo_nbins(); j++) {
++          struct mallinfo mi = h_mallinfo_bin_info(i, j);
++          if (mi.ordblks != 0) {
++            MallocXmlElem bin_elem(fd, "bin", "nr=\"%d\"", j);
++            MallocXmlElem(fd, "allocated").Contents("%zu", mi.ordblks);
++            MallocXmlElem(fd, "nmalloc").Contents("%zu", mi.uordblks);
++            MallocXmlElem(fd, "ndalloc").Contents("%zu", mi.fordblks);
++            total += mi.ordblks;
++          }
++        }
++        MallocXmlElem(fd, "bins-total").Contents("%zu", total);
++      }
++    }
++  }
++
++  return 0;
++}
+diff --git a/libc/bionic/malloc_common.h b/libc/bionic/malloc_common.h
+index 4afcc4a8d..cca9e5202 100644
+--- a/libc/bionic/malloc_common.h
++++ b/libc/bionic/malloc_common.h
+@@ -67,8 +67,16 @@ __END_DECLS
+ 
+ #else
+ 
++#ifdef __LP64__
++#include "h_malloc.h"
++#define Malloc(function)  h_ ## function
++__BEGIN_DECLS
++int h_malloc_info(int options, FILE* fp);
++__END_DECLS
++#else
+ #include "jemalloc.h"
+ #define Malloc(function)  je_ ## function
++#endif
+ 
+ #endif
+ 

Patches/LineageOS-20.0/android_bionic/0002-Graphene_Bionic_Hardening-1.patch

@@ -0,0 +1,91 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: anupritaisno1 <www.anuprita804@gmail.com>
+Date: Wed, 13 Oct 2021 12:30:25 +0300
+Subject: [PATCH] add a real explicit_bzero implementation
+
+Clang, GCC and other compilers special-case standard C functions like
+memset. Calls to memset will be optimized out.
+
+OpenBSD provides explicit_bzero to work around this but Android simply
+defines it as memset so nothing prevents it from being optimized away.
+
+This implementation uses a memory read constraint via empty inline
+assembly rather than something that may be broken via link-time
+optimization in the future.
+
+Signed-off-by: anupritaisno1 <www.anuprita804@gmail.com>
+Change-Id: Ia021e30f86ee4b998d541fbf7262110f9d1d6fbf
+Signed-off-by: anupritaisno1 <www.anuprita804@gmail.com>
+---
+ libc/Android.bp                                        | 1 +
+ libc/bionic/explicit_bzero.cpp                         | 7 +++++++
+ libc/include/string.h                                  | 1 +
+ libc/libc.map.txt                                      | 1 +
+ libc/upstream-openbsd/android/include/openbsd-compat.h | 4 ----
+ 5 files changed, 10 insertions(+), 4 deletions(-)
+ create mode 100644 libc/bionic/explicit_bzero.cpp
+
+diff --git a/libc/Android.bp b/libc/Android.bp
+index a72a5d7fb..9cfe9fa43 100644
+--- a/libc/Android.bp
++++ b/libc/Android.bp
+@@ -1099,6 +1099,7 @@ cc_library_static {
+         "bionic/eventfd.cpp",
+         "bionic/exec.cpp",
+         "bionic/execinfo.cpp",
++        "bionic/explicit_bzero.cpp",
+         "bionic/faccessat.cpp",
+         "bionic/fchmod.cpp",
+         "bionic/fchmodat.cpp",
+diff --git a/libc/bionic/explicit_bzero.cpp b/libc/bionic/explicit_bzero.cpp
+new file mode 100644
+index 000000000..b06daa138
+--- /dev/null
++++ b/libc/bionic/explicit_bzero.cpp
+@@ -0,0 +1,7 @@
++#include <string.h>
++
++void* explicit_bzero(void* s, size_t n) {
++  void *ptr = memset(s, 0, n);
++  __asm__ __volatile__("" : : "r"(ptr) : "memory");
++  return ptr;
++}
+diff --git a/libc/include/string.h b/libc/include/string.h
+index 0cc5611aa..befffd082 100644
+--- a/libc/include/string.h
++++ b/libc/include/string.h
+@@ -56,6 +56,7 @@ void* mempcpy(void* __dst, const void* __src, size_t __n) __INTRODUCED_IN(23);
+ #endif
+ void* memmove(void* __dst, const void* __src, size_t __n);
+ void* memset(void* __dst, int __ch, size_t __n);
++void* explicit_bzero(void *s, size_t n);
+ void* memmem(const void* __haystack, size_t __haystack_size, const void* __needle, size_t __needle_size) __attribute_pure__;
+ 
+ char* strchr(const char* __s, int __ch) __attribute_pure__;
+diff --git a/libc/libc.map.txt b/libc/libc.map.txt
+index 7397b687c..ba51f9a5a 100644
+--- a/libc/libc.map.txt
++++ b/libc/libc.map.txt
+@@ -332,6 +332,7 @@ LIBC {
+     execvp;
+     execvpe; # introduced=21
+     exit;
++    explicit_bzero; # introduced=33
+     faccessat;
+     fallocate; # introduced=21
+     fallocate64; # introduced=21
+diff --git a/libc/upstream-openbsd/android/include/openbsd-compat.h b/libc/upstream-openbsd/android/include/openbsd-compat.h
+index 8e6f87da8..26dc01863 100644
+--- a/libc/upstream-openbsd/android/include/openbsd-compat.h
++++ b/libc/upstream-openbsd/android/include/openbsd-compat.h
+@@ -57,10 +57,6 @@ extern const char* __progname;
+ /* OpenBSD has this, but we can't really implement it correctly on Linux. */
+ #define issetugid() 0
+ 
+-#if !defined(ANDROID_HOST_MUSL)
+-#define explicit_bzero(p, s) memset(p, 0, s)
+-#endif
+-
+ #if defined(ANDROID_HOST_MUSL)
+ #define __LIBC_HIDDEN__ __attribute__((visibility("hidden")))
+ #endif

Patches/LineageOS-20.0/android_bionic/0002-Graphene_Bionic_Hardening-10.patch

@@ -0,0 +1,84 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Wed, 2 Dec 2015 23:37:28 -0500
+Subject: [PATCH] switch pthread_atfork handler allocation to mmap
+
+Signed-off-by: anupritaisno1 <www.anuprita804@gmail.com>
+---
+ libc/bionic/pthread_atfork.cpp | 35 ++++++++++++++++++++++++++++------
+ 1 file changed, 29 insertions(+), 6 deletions(-)
+
+diff --git a/libc/bionic/pthread_atfork.cpp b/libc/bionic/pthread_atfork.cpp
+index 0dcabdfb2..6306052ee 100644
+--- a/libc/bionic/pthread_atfork.cpp
++++ b/libc/bionic/pthread_atfork.cpp
+@@ -29,6 +29,9 @@
+ #include <errno.h>
+ #include <pthread.h>
+ #include <stdlib.h>
++#include <sys/mman.h>
++#include <sys/prctl.h>
++#include <unistd.h>
+ 
+ #include "platform/bionic/macros.h"
+ 
+@@ -43,6 +46,8 @@ struct atfork_t {
+   void* dso_handle;
+ };
+ 
++static atfork_t* pool;
++
+ class atfork_list_t {
+  public:
+   constexpr atfork_list_t() : first_(nullptr), last_(nullptr) {}
+@@ -101,7 +106,8 @@ class atfork_list_t {
+       last_ = entry->prev;
+     }
+ 
+-    free(entry);
++    entry->next = pool;
++    pool = entry;
+   }
+ 
+   atfork_t* first_;
+@@ -154,18 +160,35 @@ void __bionic_atfork_run_parent() {
+ // __register_atfork is the name used by glibc
+ extern "C" int __register_atfork(void (*prepare)(void), void (*parent)(void),
+                                  void(*child)(void), void* dso) {
+-  atfork_t* entry = reinterpret_cast<atfork_t*>(malloc(sizeof(atfork_t)));
+-  if (entry == nullptr) {
+-    return ENOMEM;
++  pthread_mutex_lock(&g_atfork_list_mutex);
++
++  if (!pool) {
++    size_t page_size = getpagesize();
++    char* page = static_cast<char*>(mmap(NULL, page_size, PROT_READ|PROT_WRITE,
++                                         MAP_ANONYMOUS|MAP_PRIVATE, -1, 0));
++    if (page == MAP_FAILED) {
++      pthread_mutex_unlock(&g_atfork_list_mutex);
++      return ENOMEM;
++    }
++
++    prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME, page, page_size,
++      "atfork handlers");
++
++    for (char* it = page; it < page + page_size - sizeof(atfork_t); it += sizeof(atfork_t)) {
++      atfork_t* node = reinterpret_cast<atfork_t*>(it);
++      node->next = pool;
++      pool = node;
++    }
+   }
+ 
++  atfork_t* entry = pool;
++  pool = entry->next;
++
+   entry->prepare = prepare;
+   entry->parent = parent;
+   entry->child = child;
+   entry->dso_handle = dso;
+ 
+-  pthread_mutex_lock(&g_atfork_list_mutex);
+-
+   g_atfork_list.push_back(entry);
+ 
+   pthread_mutex_unlock(&g_atfork_list_mutex);

Patches/LineageOS-20.0/android_bionic/0002-Graphene_Bionic_Hardening-11.patch

@@ -0,0 +1,95 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Thu, 3 Dec 2015 12:58:31 -0500
+Subject: [PATCH] add memory protection for pthread_atfork handlers
+
+Signed-off-by: anupritaisno1 <www.anuprita804@gmail.com>
+---
+ libc/bionic/pthread_atfork.cpp | 34 ++++++++++++++++++++++++++++++++--
+ 1 file changed, 32 insertions(+), 2 deletions(-)
+
+diff --git a/libc/bionic/pthread_atfork.cpp b/libc/bionic/pthread_atfork.cpp
+index 6306052ee..d59f3ae54 100644
+--- a/libc/bionic/pthread_atfork.cpp
++++ b/libc/bionic/pthread_atfork.cpp
+@@ -47,6 +47,7 @@ struct atfork_t {
+ };
+ 
+ static atfork_t* pool;
++static atfork_t* page_list;
+ 
+ class atfork_list_t {
+  public:
+@@ -160,13 +161,22 @@ void __bionic_atfork_run_parent() {
+ // __register_atfork is the name used by glibc
+ extern "C" int __register_atfork(void (*prepare)(void), void (*parent)(void),
+                                  void(*child)(void), void* dso) {
++  size_t page_size = getpagesize();
++
+   pthread_mutex_lock(&g_atfork_list_mutex);
+ 
++  for (atfork_t* page_it = page_list; page_it; page_it = page_it->next) {
++    mprotect(page_it, page_size, PROT_READ|PROT_WRITE);
++  }
++
+   if (!pool) {
+-    size_t page_size = getpagesize();
+     char* page = static_cast<char*>(mmap(NULL, page_size, PROT_READ|PROT_WRITE,
+                                          MAP_ANONYMOUS|MAP_PRIVATE, -1, 0));
+     if (page == MAP_FAILED) {
++      for (atfork_t* page_it = page_list; page_it; page_it = page_it->next) {
++        mprotect(page_it, page_size, PROT_READ);
++      }
++
+       pthread_mutex_unlock(&g_atfork_list_mutex);
+       return ENOMEM;
+     }
+@@ -174,11 +184,15 @@ extern "C" int __register_atfork(void (*prepare)(void), void (*parent)(void),
+     prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME, page, page_size,
+       "atfork handlers");
+ 
+-    for (char* it = page; it < page + page_size - sizeof(atfork_t); it += sizeof(atfork_t)) {
++    for (char* it = page + sizeof(atfork_t); it < page + page_size - sizeof(atfork_t); it += sizeof(atfork_t)) {
+       atfork_t* node = reinterpret_cast<atfork_t*>(it);
+       node->next = pool;
+       pool = node;
+     }
++
++    atfork_t* page_node = reinterpret_cast<atfork_t*>(page);
++    page_node->next = page_list;
++    page_list = page_node;
+   }
+ 
+   atfork_t* entry = pool;
+@@ -191,6 +205,10 @@ extern "C" int __register_atfork(void (*prepare)(void), void (*parent)(void),
+ 
+   g_atfork_list.push_back(entry);
+ 
++  for (atfork_t* page_it = page_list; page_it; page_it = page_it->next) {
++    mprotect(page_it, page_size, PROT_READ);
++  }
++
+   pthread_mutex_unlock(&g_atfork_list_mutex);
+ 
+   return 0;
+@@ -198,8 +216,20 @@ extern "C" int __register_atfork(void (*prepare)(void), void (*parent)(void),
+ 
+ extern "C" __LIBC_HIDDEN__ void __unregister_atfork(void* dso) {
+   pthread_mutex_lock(&g_atfork_list_mutex);
++
++  size_t page_size = getpagesize();
++
++  for (atfork_t* page_it = page_list; page_it; page_it = page_it->next) {
++    mprotect(page_it, page_size, PROT_READ|PROT_WRITE);
++  }
++
+   g_atfork_list.remove_if([&](const atfork_t* entry) {
+     return entry->dso_handle == dso;
+   });
++
++  for (atfork_t* page_it = page_list; page_it; page_it = page_it->next) {
++    mprotect(page_it, page_size, PROT_READ);
++  }
++
+   pthread_mutex_unlock(&g_atfork_list_mutex);
+ }

Patches/LineageOS-20.0/android_bionic/0002-Graphene_Bionic_Hardening-12.patch

@@ -0,0 +1,85 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Wed, 27 Jan 2016 18:02:15 -0500
+Subject: [PATCH] add XOR mangling mitigation for thread-local dtors
+
+Signed-off-by: anupritaisno1 <www.anuprita804@gmail.com>
+---
+ libc/bionic/__cxa_thread_atexit_impl.cpp | 8 +++++---
+ libc/bionic/libc_init_common.cpp         | 2 ++
+ libc/private/bionic_globals.h            | 1 +
+ 3 files changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/libc/bionic/__cxa_thread_atexit_impl.cpp b/libc/bionic/__cxa_thread_atexit_impl.cpp
+index 99077c101..74608513e 100644
+--- a/libc/bionic/__cxa_thread_atexit_impl.cpp
++++ b/libc/bionic/__cxa_thread_atexit_impl.cpp
+@@ -13,15 +13,17 @@
+  * See the License for the specific language governing permissions and
+  * limitations under the License.
+  */
++#include <stdint.h>
+ #include <sys/cdefs.h>
+ 
+ #include <private/bionic_defs.h>
++#include <private/bionic_globals.h>
+ 
+ #include "pthread_internal.h"
+ 
+ class thread_local_dtor {
+  public:
+-  void (*func) (void *);
++  uintptr_t func;
+   void *arg;
+   void *dso_handle; // unused...
+   thread_local_dtor* next;
+@@ -35,7 +37,7 @@ __BIONIC_WEAK_FOR_NATIVE_BRIDGE
+ int __cxa_thread_atexit_impl(void (*func) (void *), void *arg, void *dso_handle) {
+   thread_local_dtor* dtor = new thread_local_dtor();
+ 
+-  dtor->func = func;
++  dtor->func = __libc_globals->dtor_cookie ^ reinterpret_cast<uintptr_t>(func);
+   dtor->arg = arg;
+   dtor->dso_handle = dso_handle;
+ 
+@@ -54,7 +56,7 @@ extern "C" __LIBC_HIDDEN__ void __cxa_thread_finalize() {
+     thread_local_dtor* current = thread->thread_local_dtors;
+     thread->thread_local_dtors = current->next;
+ 
+-    current->func(current->arg);
++    (reinterpret_cast<void (*)(void*)>(__libc_globals->dtor_cookie ^ current->func))(current->arg);
+     if (__loader_remove_thread_local_dtor != nullptr) {
+       __loader_remove_thread_local_dtor(current->dso_handle);
+     }
+diff --git a/libc/bionic/libc_init_common.cpp b/libc/bionic/libc_init_common.cpp
+index 8084e73d1..45abfbff5 100644
+--- a/libc/bionic/libc_init_common.cpp
++++ b/libc/bionic/libc_init_common.cpp
+@@ -45,6 +45,7 @@
+ #include <async_safe/log.h>
+ 
+ #include "private/WriteProtected.h"
++#include "private/bionic_arc4random.h"
+ #include "private/bionic_defs.h"
+ #include "private/bionic_globals.h"
+ #include "private/bionic_tls.h"
+@@ -69,6 +70,7 @@ void __libc_init_globals() {
+   __libc_globals.mutate([](libc_globals* globals) {
+     __libc_init_vdso(globals);
+     __libc_init_setjmp_cookie(globals);
++    arc4random_buf(&globals->dtor_cookie, sizeof(globals->dtor_cookie));
+   });
+ }
+ 
+diff --git a/libc/private/bionic_globals.h b/libc/private/bionic_globals.h
+index e105c18d9..ce05936b0 100644
+--- a/libc/private/bionic_globals.h
++++ b/libc/private/bionic_globals.h
+@@ -45,6 +45,7 @@
+ 
+ struct libc_globals {
+   vdso_entry vdso[VDSO_END];
++  long dtor_cookie;
+   long setjmp_cookie;
+   uintptr_t heap_pointer_tag;
+ 

Patches/LineageOS-20.0/android_bionic/0002-Graphene_Bionic_Hardening-13.patch

@@ -0,0 +1,25 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Fri, 29 Jan 2016 20:20:09 -0500
+Subject: [PATCH] use a better pthread_attr junk filling pattern
+
+Guarantee that junk filled pointers will fault, at least on pure 64-bit.
+
+Signed-off-by: anupritaisno1 <www.anuprita804@gmail.com>
+---
+ libc/bionic/pthread_attr.cpp | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/libc/bionic/pthread_attr.cpp b/libc/bionic/pthread_attr.cpp
+index 89aa28966..08e237f9f 100644
+--- a/libc/bionic/pthread_attr.cpp
++++ b/libc/bionic/pthread_attr.cpp
+@@ -53,7 +53,7 @@ int pthread_attr_init(pthread_attr_t* attr) {
+ 
+ __BIONIC_WEAK_FOR_NATIVE_BRIDGE
+ int pthread_attr_destroy(pthread_attr_t* attr) {
+-  memset(attr, 0x42, sizeof(pthread_attr_t));
++  memset(attr, 0xdf, sizeof(pthread_attr_t));
+   return 0;
+ }
+ 

Patches/LineageOS-20.0/android_bionic/0002-Graphene_Bionic_Hardening-14.patch

@@ -0,0 +1,76 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Renlord <me@renlord.com>
+Date: Thu, 12 Sep 2019 14:51:51 +1000
+Subject: [PATCH] add guard page(s) between static_tls and stack
+
+Signed-off-by: anupritaisno1 <www.anuprita804@gmail.com>
+---
+ libc/bionic/pthread_create.cpp | 29 +++++++++++++++++++----------
+ 1 file changed, 19 insertions(+), 10 deletions(-)
+
+diff --git a/libc/bionic/pthread_create.cpp b/libc/bionic/pthread_create.cpp
+index 121b26f82..31c553e25 100644
+--- a/libc/bionic/pthread_create.cpp
++++ b/libc/bionic/pthread_create.cpp
+@@ -201,9 +201,10 @@ int __init_thread(pthread_internal_t* thread) {
+ ThreadMapping __allocate_thread_mapping(size_t stack_size, size_t stack_guard_size) {
+   const StaticTlsLayout& layout = __libc_shared_globals()->static_tls_layout;
+ 
+-  // Allocate in order: stack guard, stack, static TLS, guard page.
++  // Allocate in order: stack guard, stack, guard page, static TLS, guard page.
+   size_t mmap_size;
+   if (__builtin_add_overflow(stack_size, stack_guard_size, &mmap_size)) return {};
++  if (__builtin_add_overflow(mmap_size, PTHREAD_GUARD_SIZE, &mmap_size)) return {};
+   if (__builtin_add_overflow(mmap_size, layout.size(), &mmap_size)) return {};
+   if (__builtin_add_overflow(mmap_size, PTHREAD_GUARD_SIZE, &mmap_size)) return {};
+ 
+@@ -212,8 +213,8 @@ ThreadMapping __allocate_thread_mapping(size_t stack_size, size_t stack_guard_si
+   mmap_size = __BIONIC_ALIGN(mmap_size, PAGE_SIZE);
+   if (mmap_size < unaligned_size) return {};
+ 
+-  // Create a new private anonymous map. Make the entire mapping PROT_NONE, then carve out a
+-  // read+write area in the middle.
++  // Create a new private anonymous map. Make the entire mapping PROT_NONE, then carve out
++  // read+write areas for the stack and static TLS
+   const int flags = MAP_PRIVATE | MAP_ANONYMOUS | MAP_NORESERVE;
+   char* const space = static_cast<char*>(mmap(nullptr, mmap_size, PROT_NONE, flags, -1, 0));
+   if (space == MAP_FAILED) {
+@@ -223,13 +224,21 @@ ThreadMapping __allocate_thread_mapping(size_t stack_size, size_t stack_guard_si
+                           mmap_size, strerror(errno));
+     return {};
+   }
+-  const size_t writable_size = mmap_size - stack_guard_size - PTHREAD_GUARD_SIZE;
+-  if (mprotect(space + stack_guard_size,
+-               writable_size,
+-               PROT_READ | PROT_WRITE) != 0) {
++
++  if (mprotect(space + stack_guard_size, stack_size, PROT_READ | PROT_WRITE) != 0) {
+     async_safe_format_log(ANDROID_LOG_WARN, "libc",
+                           "pthread_create failed: couldn't mprotect R+W %zu-byte thread mapping region: %s",
+-                          writable_size, strerror(errno));
++                          stack_size, strerror(errno));
++    munmap(space, mmap_size);
++    return {};
++  }
++
++  char* const static_tls_space = space + stack_guard_size + stack_size + PTHREAD_GUARD_SIZE;
++
++  if (mprotect(static_tls_space, layout.size(), PROT_READ | PROT_WRITE) != 0) {
++    async_safe_format_log(ANDROID_LOG_WARN, "libc",
++                          "pthread_create failed: couldn't mprotect R+W %zu-byte static TLS mapping region: %s",
++                          layout.size(), strerror(errno));
+     munmap(space, mmap_size);
+     return {};
+   }
+@@ -239,9 +248,9 @@ ThreadMapping __allocate_thread_mapping(size_t stack_size, size_t stack_guard_si
+   result.mmap_size = mmap_size;
+   result.mmap_base_unguarded = space + stack_guard_size;
+   result.mmap_size_unguarded = mmap_size - stack_guard_size - PTHREAD_GUARD_SIZE;
+-  result.static_tls = space + mmap_size - PTHREAD_GUARD_SIZE - layout.size();
++  result.static_tls = static_tls_space;
+   result.stack_base = space;
+-  result.stack_top = result.static_tls;
++  result.stack_top = space + stack_guard_size + stack_size;
+   return result;
+ }
+ 

Patches/LineageOS-20.0/android_bionic/0002-Graphene_Bionic_Hardening-15.patch

@@ -0,0 +1,58 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Thu, 10 Oct 2019 22:52:49 -0400
+Subject: [PATCH] move pthread_internal_t behind guard page
+
+Signed-off-by: anupritaisno1 <www.anuprita804@gmail.com>
+---
+ libc/bionic/pthread_create.cpp | 19 +++++++++----------
+ 1 file changed, 9 insertions(+), 10 deletions(-)
+
+diff --git a/libc/bionic/pthread_create.cpp b/libc/bionic/pthread_create.cpp
+index 31c553e25..627fbb25b 100644
+--- a/libc/bionic/pthread_create.cpp
++++ b/libc/bionic/pthread_create.cpp
+@@ -201,10 +201,13 @@ int __init_thread(pthread_internal_t* thread) {
+ ThreadMapping __allocate_thread_mapping(size_t stack_size, size_t stack_guard_size) {
+   const StaticTlsLayout& layout = __libc_shared_globals()->static_tls_layout;
+ 
+-  // Allocate in order: stack guard, stack, guard page, static TLS, guard page.
++  size_t thread_page_size = __BIONIC_ALIGN(sizeof(pthread_internal_t), PAGE_SIZE);
++
++  // Allocate in order: stack guard, stack, guard page, pthread_internal_t, static TLS, guard page.
+   size_t mmap_size;
+   if (__builtin_add_overflow(stack_size, stack_guard_size, &mmap_size)) return {};
+   if (__builtin_add_overflow(mmap_size, PTHREAD_GUARD_SIZE, &mmap_size)) return {};
++  if (__builtin_add_overflow(mmap_size, thread_page_size, &mmap_size)) return {};
+   if (__builtin_add_overflow(mmap_size, layout.size(), &mmap_size)) return {};
+   if (__builtin_add_overflow(mmap_size, PTHREAD_GUARD_SIZE, &mmap_size)) return {};
+ 
+@@ -233,9 +236,10 @@ ThreadMapping __allocate_thread_mapping(size_t stack_size, size_t stack_guard_si
+     return {};
+   }
+ 
+-  char* const static_tls_space = space + stack_guard_size + stack_size + PTHREAD_GUARD_SIZE;
++  char* const thread = space + stack_guard_size + stack_size + PTHREAD_GUARD_SIZE;
++  char* const static_tls_space = thread + thread_page_size;
+ 
+-  if (mprotect(static_tls_space, layout.size(), PROT_READ | PROT_WRITE) != 0) {
++  if (mprotect(thread, thread_page_size + layout.size(), PROT_READ | PROT_WRITE) != 0) {
+     async_safe_format_log(ANDROID_LOG_WARN, "libc",
+                           "pthread_create failed: couldn't mprotect R+W %zu-byte static TLS mapping region: %s",
+                           layout.size(), strerror(errno));
+@@ -280,13 +284,8 @@ static int __allocate_thread(pthread_attr_t* attr, bionic_tcb** tcbp, void** chi
+     stack_top = static_cast<char*>(attr->stack_base) + attr->stack_size;
+   }
+ 
+-  // Carve out space from the stack for the thread's pthread_internal_t. This
+-  // memory isn't counted in pthread_attr_getstacksize.
+-
+-  // To safely access the pthread_internal_t and thread stack, we need to find a 16-byte aligned boundary.
+-  stack_top = align_down(stack_top - sizeof(pthread_internal_t), 16);
+-
+-  pthread_internal_t* thread = reinterpret_cast<pthread_internal_t*>(stack_top);
++  pthread_internal_t* thread = reinterpret_cast<pthread_internal_t*>(
++      mapping.static_tls - __BIONIC_ALIGN(sizeof(pthread_internal_t), PAGE_SIZE));
+   if (!stack_clean) {
+     // If thread was not allocated by mmap(), it may not have been cleared to zero.
+     // So assume the worst and zero it.

Patches/LineageOS-20.0/android_bionic/0002-Graphene_Bionic_Hardening-16.patch

@@ -0,0 +1,98 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Renlord <me@renlord.com>
+Date: Sun, 20 Oct 2019 08:17:11 +1100
+Subject: [PATCH] add secondary stack randomization
+
+Signed-off-by: anupritaisno1 <www.anuprita804@gmail.com>
+---
+ libc/bionic/pthread_create.cpp | 32 +++++++++++++++++++++++++++-----
+ libc/include/sys/cdefs.h       |  1 +
+ 2 files changed, 28 insertions(+), 5 deletions(-)
+
+diff --git a/libc/bionic/pthread_create.cpp b/libc/bionic/pthread_create.cpp
+index 627fbb25b..1dc32be32 100644
+--- a/libc/bionic/pthread_create.cpp
++++ b/libc/bionic/pthread_create.cpp
+@@ -29,6 +29,7 @@
+ #include <pthread.h>
+ 
+ #include <errno.h>
++#include <stdlib.h>
+ #include <string.h>
+ #include <sys/auxv.h>
+ #include <sys/mman.h>
+@@ -201,12 +202,24 @@ int __init_thread(pthread_internal_t* thread) {
+ ThreadMapping __allocate_thread_mapping(size_t stack_size, size_t stack_guard_size) {
+   const StaticTlsLayout& layout = __libc_shared_globals()->static_tls_layout;
+ 
++  // round up if the given stack size is not in multiples of PAGE_SIZE
++  stack_size = __BIONIC_ALIGN(stack_size, PAGE_SIZE);
+   size_t thread_page_size = __BIONIC_ALIGN(sizeof(pthread_internal_t), PAGE_SIZE);
+ 
+-  // Allocate in order: stack guard, stack, guard page, pthread_internal_t, static TLS, guard page.
++  // Place a randomly sized gap above the stack, up to 10% as large as the stack
++  // on 32-bit and 50% on 64-bit where virtual memory is plentiful.
++#if __LP64__
++  size_t max_gap_size = stack_size / 2;
++#else
++  size_t max_gap_size = stack_size / 10;
++#endif
++  // Make sure random stack top guard size are multiples of PAGE_SIZE.
++  size_t gap_size = __BIONIC_ALIGN(arc4random_uniform(max_gap_size), PAGE_SIZE);
++
++  // Allocate in order: stack guard, stack, (random) guard page(s), pthread_internal_t, static TLS, guard page.
+   size_t mmap_size;
+   if (__builtin_add_overflow(stack_size, stack_guard_size, &mmap_size)) return {};
+-  if (__builtin_add_overflow(mmap_size, PTHREAD_GUARD_SIZE, &mmap_size)) return {};
++  if (__builtin_add_overflow(mmap_size, gap_size, &mmap_size)) return {};
+   if (__builtin_add_overflow(mmap_size, thread_page_size, &mmap_size)) return {};
+   if (__builtin_add_overflow(mmap_size, layout.size(), &mmap_size)) return {};
+   if (__builtin_add_overflow(mmap_size, PTHREAD_GUARD_SIZE, &mmap_size)) return {};
+@@ -228,15 +241,21 @@ ThreadMapping __allocate_thread_mapping(size_t stack_size, size_t stack_guard_si
+     return {};
+   }
+ 
+-  if (mprotect(space + stack_guard_size, stack_size, PROT_READ | PROT_WRITE) != 0) {
++  // Stack is at the lower end of mapped space, stack guard region is at the lower end of stack.
++  // Make the usable portion of the stack between the guard region and random gap readable and
++  // writable.
++  if (mprotect((space + stack_guard_size), stack_size, PROT_READ | PROT_WRITE) == -1) {
+     async_safe_format_log(ANDROID_LOG_WARN, "libc",
+                           "pthread_create failed: couldn't mprotect R+W %zu-byte thread mapping region: %s",
+                           stack_size, strerror(errno));
+     munmap(space, mmap_size);
+     return {};
+   }
++  prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME, space, stack_guard_size, "stack guard");
++  char* const stack_top_guard = space + stack_guard_size + stack_size;
++  prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME, stack_top_guard, gap_size, "stack top guard");
+ 
+-  char* const thread = space + stack_guard_size + stack_size + PTHREAD_GUARD_SIZE;
++  char* const thread = space + stack_guard_size + stack_size + gap_size;
+   char* const static_tls_space = thread + thread_page_size;
+ 
+   if (mprotect(thread, thread_page_size + layout.size(), PROT_READ | PROT_WRITE) != 0) {
+@@ -254,7 +273,10 @@ ThreadMapping __allocate_thread_mapping(size_t stack_size, size_t stack_guard_si
+   result.mmap_size_unguarded = mmap_size - stack_guard_size - PTHREAD_GUARD_SIZE;
+   result.static_tls = static_tls_space;
+   result.stack_base = space;
+-  result.stack_top = space + stack_guard_size + stack_size;
++  // Choose a random base within the first page of the stack. Waste no more
++  // than the space originally wasted by pthread_internal_t for compatibility.
++  result.stack_top = space + stack_guard_size + stack_size - arc4random_uniform(sizeof(pthread_internal_t));
++  result.stack_top = reinterpret_cast<char*>(__BIONIC_ALIGN_DOWN(reinterpret_cast<size_t>(result.stack_top), 16));
+   return result;
+ }
+ 
+diff --git a/libc/include/sys/cdefs.h b/libc/include/sys/cdefs.h
+index 5b9d99b3a..aa6c0040a 100644
+--- a/libc/include/sys/cdefs.h
++++ b/libc/include/sys/cdefs.h
+@@ -61,6 +61,7 @@
+ #endif
+ 
+ #define __BIONIC_ALIGN(__value, __alignment) (((__value) + (__alignment)-1) & ~((__alignment)-1))
++#define __BIONIC_ALIGN_DOWN(value, alignment) ((value) & ~((alignment) - 1))
+ 
+ /*
+  * The __CONCAT macro is used to concatenate parts of symbol names, e.g.

Patches/LineageOS-20.0/android_bionic/0002-Graphene_Bionic_Hardening-2.patch

@@ -0,0 +1,76 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Sun, 8 Feb 2015 01:18:54 -0500
+Subject: [PATCH] replace brk and sbrk with stubs
+
+Pretend that there is never room to grow the heap in order to prevent
+usage of these unsafe legacy functions. There are likely no users of
+these in practice as it is inherently broken to use them outside of
+malloc.
+
+Signed-off-by: anupritaisno1 <www.anuprita804@gmail.com>
+---
+ libc/bionic/brk.cpp | 48 ++++++++-------------------------------------
+ 1 file changed, 8 insertions(+), 40 deletions(-)
+
+diff --git a/libc/bionic/brk.cpp b/libc/bionic/brk.cpp
+index 566c33a7a..ef9305513 100644
+--- a/libc/bionic/brk.cpp
++++ b/libc/bionic/brk.cpp
+@@ -29,48 +29,16 @@
+ #include <errno.h>
+ #include <unistd.h>
+ 
+-#if defined(__LP64__)
+-static void* __bionic_brk;
+-#else
+-void* __bionic_brk; // Accidentally exported by the NDK.
++#if !defined(__LP64__)
++void* __bionic_brk = reinterpret_cast<void*>(-1); // Accidentally exported by the NDK.
+ #endif
+ 
+-extern "C" void* __brk(void* __addr);
+-
+-int brk(void* end_data) {
+-  __bionic_brk = __brk(end_data);
+-  if (__bionic_brk < end_data) {
+-    errno = ENOMEM;
+-    return -1;
+-  }
+-  return 0;
++int brk(void*) {
++  errno = ENOMEM;
++  return -1;
+ }
+ 
+-void* sbrk(ptrdiff_t increment) {
+-  // Initialize __bionic_brk if necessary.
+-  if (__bionic_brk == nullptr) {
+-    __bionic_brk = __brk(nullptr);
+-  }
+-
+-  // Don't ask the kernel if we already know the answer.
+-  if (increment == 0) {
+-    return __bionic_brk;
+-  }
+-
+-  // Avoid overflow.
+-  uintptr_t old_brk = reinterpret_cast<uintptr_t>(__bionic_brk);
+-  if ((increment > 0 && static_cast<uintptr_t>(increment) > (UINTPTR_MAX - old_brk)) ||
+-      (increment < 0 && static_cast<uintptr_t>(-increment) > old_brk)) {
+-    errno = ENOMEM;
+-    return reinterpret_cast<void*>(-1);
+-  }
+-
+-  void* desired_brk = reinterpret_cast<void*>(old_brk + increment);
+-  __bionic_brk = __brk(desired_brk);
+-  if (__bionic_brk < desired_brk) {
+-    errno = ENOMEM;
+-    return reinterpret_cast<void*>(-1);
+-  }
+-
+-  return reinterpret_cast<void*>(old_brk);
++void* sbrk(ptrdiff_t) {
++  errno = ENOMEM;
++  return reinterpret_cast<void*>(-1);
+ }

Patches/LineageOS-20.0/android_bionic/0002-Graphene_Bionic_Hardening-3.patch

@@ -0,0 +1,57 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Mon, 4 Mar 2019 04:26:04 -0500
+Subject: [PATCH] use blocking getrandom and avoid urandom fallback
+
+Signed-off-by: anupritaisno1 <www.anuprita804@gmail.com>
+---
+ libc/bionic/getentropy.cpp | 28 +++-------------------------
+ 1 file changed, 3 insertions(+), 25 deletions(-)
+
+diff --git a/libc/bionic/getentropy.cpp b/libc/bionic/getentropy.cpp
+index 9c93e713b..c9438ad2b 100644
+--- a/libc/bionic/getentropy.cpp
++++ b/libc/bionic/getentropy.cpp
+@@ -33,22 +33,6 @@
+ 
+ #include "private/ScopedFd.h"
+ 
+-static int getentropy_urandom(void* buffer, size_t buffer_size, int saved_errno) {
+-  ScopedFd fd(TEMP_FAILURE_RETRY(open("/dev/urandom", O_RDONLY | O_NOFOLLOW | O_CLOEXEC, 0)));
+-  if (fd.get() == -1) return -1;
+-
+-  size_t collected = 0;
+-  while (collected < buffer_size) {
+-    ssize_t count = TEMP_FAILURE_RETRY(read(fd.get(), static_cast<char*>(buffer) + collected,
+-                                            buffer_size - collected));
+-    if (count == -1) return -1;
+-    collected += count;
+-  }
+-
+-  errno = saved_errno;
+-  return 0;
+-}
+-
+ int getentropy(void* buffer, size_t buffer_size) {
+   if (buffer_size > 256) {
+     errno = EIO;
+@@ -59,16 +43,10 @@ int getentropy(void* buffer, size_t buffer_size) {
+ 
+   size_t collected = 0;
+   while (collected < buffer_size) {
+-    long count = TEMP_FAILURE_RETRY(getrandom(static_cast<char*>(buffer) + collected,
+-                                              buffer_size - collected, GRND_NONBLOCK));
++    long count = TEMP_FAILURE_RETRY(
++        getrandom(static_cast<char*>(buffer) + collected, buffer_size - collected, 0));
+     if (count == -1) {
+-      // EAGAIN: there isn't enough entropy right now.
+-      // ENOSYS/EINVAL: getrandom(2) or GRND_NONBLOCK isn't supported.
+-      // EFAULT: `buffer` is invalid.
+-      // Try /dev/urandom regardless because it can't hurt,
+-      // and we don't need to optimize the EFAULT case.
+-      // See http://b/33059407 and http://b/67015565.
+-      return getentropy_urandom(buffer, buffer_size, saved_errno);
++      return -1;
+     }
+     collected += count;
+   }

Patches/LineageOS-20.0/android_bionic/0002-Graphene_Bionic_Hardening-4.patch

@@ -0,0 +1,26 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Mon, 19 Sep 2016 07:57:43 -0400
+Subject: [PATCH] fix undefined out-of-bounds accesses in sched.h
+
+Signed-off-by: anupritaisno1 <www.anuprita804@gmail.com>
+---
+ libc/include/sched.h | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/libc/include/sched.h b/libc/include/sched.h
+index 364ca1065..2493ed234 100644
+--- a/libc/include/sched.h
++++ b/libc/include/sched.h
+@@ -219,7 +219,10 @@ int sched_getcpu(void);
+  * statically-sized CPU set. See `CPU_ALLOC` for dynamically-sized CPU sets.
+  */
+ typedef struct {
+-  __CPU_BITTYPE  __bits[ CPU_SETSIZE / __CPU_BITS ];
++  union {
++    __CPU_BITTYPE  __bits_minimum[ CPU_SETSIZE / __CPU_BITS ];
++    __CPU_BITTYPE  __bits[0];
++  };
+ } cpu_set_t;
+ 
+ /**

Patches/LineageOS-20.0/android_bionic/0002-Graphene_Bionic_Hardening-5.patch

@@ -0,0 +1,47 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Sat, 19 Nov 2016 09:56:14 -0500
+Subject: [PATCH] stop implicitly marking mappings as mergeable
+
+Signed-off-by: anupritaisno1 <www.anuprita804@gmail.com>
+---
+ libc/bionic/mmap.cpp | 19 +------------------
+ 1 file changed, 1 insertion(+), 18 deletions(-)
+
+diff --git a/libc/bionic/mmap.cpp b/libc/bionic/mmap.cpp
+index 9aad0b315..6bf0ecfd1 100644
+--- a/libc/bionic/mmap.cpp
++++ b/libc/bionic/mmap.cpp
+@@ -39,8 +39,6 @@ extern "C" void*  __mmap2(void*, size_t, int, int, int, size_t);
+ 
+ #define MMAP2_SHIFT 12 // 2**12 == 4096
+ 
+-static bool kernel_has_MADV_MERGEABLE = true;
+-
+ void* mmap64(void* addr, size_t size, int prot, int flags, int fd, off64_t offset) {
+   if (offset < 0 || (offset & ((1UL << MMAP2_SHIFT)-1)) != 0) {
+     errno = EINVAL;
+@@ -54,22 +52,7 @@ void* mmap64(void* addr, size_t size, int prot, int flags, int fd, off64_t offse
+     return MAP_FAILED;
+   }
+ 
+-  bool is_private_anonymous =
+-      (flags & (MAP_PRIVATE | MAP_ANONYMOUS)) == (MAP_PRIVATE | MAP_ANONYMOUS);
+-  bool is_stack_or_grows_down = (flags & (MAP_STACK | MAP_GROWSDOWN)) != 0;
+-
+-  void* result = __mmap2(addr, size, prot, flags, fd, offset >> MMAP2_SHIFT);
+-
+-  if (result != MAP_FAILED && kernel_has_MADV_MERGEABLE &&
+-      is_private_anonymous && !is_stack_or_grows_down) {
+-    ErrnoRestorer errno_restorer;
+-    int rc = madvise(result, size, MADV_MERGEABLE);
+-    if (rc == -1 && errno == EINVAL) {
+-      kernel_has_MADV_MERGEABLE = false;
+-    }
+-  }
+-
+-  return result;
++  return __mmap2(addr, size, prot, flags, fd, offset >> MMAP2_SHIFT);
+ }
+ 
+ void* mmap(void* addr, size_t size, int prot, int flags, int fd, off_t offset) {

Patches/LineageOS-20.0/android_bionic/0002-Graphene_Bionic_Hardening-6.patch

@@ -0,0 +1,40 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Sat, 16 Jul 2016 23:55:16 -0400
+Subject: [PATCH] replace VLA formatting with dprintf-like function
+
+Signed-off-by: anupritaisno1 <www.anuprita804@gmail.com>
+---
+ libc/bionic/bionic_systrace.cpp | 10 +---------
+ 1 file changed, 1 insertion(+), 9 deletions(-)
+
+diff --git a/libc/bionic/bionic_systrace.cpp b/libc/bionic/bionic_systrace.cpp
+index 227cb84c3..25ae76a89 100644
+--- a/libc/bionic/bionic_systrace.cpp
++++ b/libc/bionic/bionic_systrace.cpp
+@@ -29,8 +29,6 @@
+ #include <async_safe/log.h>
+ #include <cutils/trace.h> // For ATRACE_TAG_BIONIC.
+ 
+-#define WRITE_OFFSET   32
+-
+ static Lock g_lock;
+ static CachedProperty g_debug_atrace_tags_enableflags("debug.atrace.tags.enableflags");
+ static uint64_t g_tags;
+@@ -67,15 +65,9 @@ static void trace_begin_internal(const char* message) {
+     return;
+   }
+ 
+-  // If bionic tracing has been enabled, then write the message to the
+-  // kernel trace_marker.
+-  int length = strlen(message);
+-  char buf[length + WRITE_OFFSET];
+-  size_t len = async_safe_format_buffer(buf, length + WRITE_OFFSET, "B|%d|%s", getpid(), message);
+-
+   // Tracing may stop just after checking property and before writing the message.
+   // So the write is acceptable to fail. See b/20666100.
+-  TEMP_FAILURE_RETRY(write(trace_marker_fd, buf, len));
++  async_safe_format_fd(trace_marker_fd, "B|%d|%s", getpid(), message);
+ }
+ 
+ void bionic_trace_begin(const char* message) {

Patches/LineageOS-20.0/android_bionic/0002-Graphene_Bionic_Hardening-7.patch

@@ -0,0 +1,26 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Fri, 17 Jul 2015 21:32:05 -0400
+Subject: [PATCH] increase default pthread stack to 8MiB on 64-bit
+
+Signed-off-by: anupritaisno1 <www.anuprita804@gmail.com>
+---
+ libc/bionic/pthread_internal.h | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/libc/bionic/pthread_internal.h b/libc/bionic/pthread_internal.h
+index 071a5bcb3..ab71e2a17 100644
+--- a/libc/bionic/pthread_internal.h
++++ b/libc/bionic/pthread_internal.h
+@@ -238,7 +238,11 @@ __LIBC_HIDDEN__ void pthread_key_clean_all(void);
+ // stack overflows, we subtracted the same amount we were using there
+ // from the default thread stack size. This should keep memory usage
+ // roughly constant.
++#ifdef __LP64__
++#define PTHREAD_STACK_SIZE_DEFAULT ((8 * 1024 * 1024) - SIGNAL_STACK_SIZE_WITHOUT_GUARD)
++#else
+ #define PTHREAD_STACK_SIZE_DEFAULT ((1 * 1024 * 1024) - SIGNAL_STACK_SIZE_WITHOUT_GUARD)
++#endif
+ 
+ // Leave room for a guard page in the internally created signal stacks.
+ #define SIGNAL_STACK_SIZE (SIGNAL_STACK_SIZE_WITHOUT_GUARD + PTHREAD_GUARD_SIZE)

Patches/LineageOS-20.0/android_bionic/0002-Graphene_Bionic_Hardening-8.patch

@@ -0,0 +1,59 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Sat, 1 Oct 2016 05:11:44 -0400
+Subject: [PATCH] make __stack_chk_guard read-only at runtime
+
+Signed-off-by: anupritaisno1 <www.anuprita804@gmail.com>
+---
+ libc/bionic/__libc_init_main_thread.cpp | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/libc/bionic/__libc_init_main_thread.cpp b/libc/bionic/__libc_init_main_thread.cpp
+index 95f46e9fa..7e1e7cbcb 100644
+--- a/libc/bionic/__libc_init_main_thread.cpp
++++ b/libc/bionic/__libc_init_main_thread.cpp
+@@ -28,6 +28,9 @@
+ 
+ #include "libc_init_common.h"
+ 
++#include <limits.h>
++#include <sys/mman.h>
++
+ #include <async_safe/log.h>
+ 
+ #include "private/KernelArgumentBlock.h"
+@@ -35,14 +38,14 @@
+ #include "private/bionic_defs.h"
+ #include "private/bionic_elf_tls.h"
+ #include "private/bionic_globals.h"
+-#include "private/bionic_ssp.h"
+ #include "pthread_internal.h"
+ 
+ extern "C" pid_t __getpid();
+ extern "C" int __set_tid_address(int* tid_address);
+ 
+ // Declared in "private/bionic_ssp.h".
+-uintptr_t __stack_chk_guard = 0;
++__attribute__((aligned(PAGE_SIZE)))
++uintptr_t __stack_chk_guard[PAGE_SIZE / sizeof(uintptr_t)] = {0};
+ 
+ static pthread_internal_t main_thread;
+ 
+@@ -107,10 +110,16 @@ void __init_tcb_dtv(bionic_tcb* tcb) {
+ // Note in particular that it is not possible to return from any existing
+ // stack frame with stack protector enabled after this function is called.
+ extern "C" void android_reset_stack_guards() {
++  if (mprotect(__stack_chk_guard, sizeof(__stack_chk_guard), PROT_READ|PROT_WRITE) == -1) {
++    async_safe_fatal("mprotect __stack_chk_guard: %s", strerror(errno));
++  }
+   // The TLS stack guard is set from the global, so ensure that we've initialized the global
+   // before we initialize the TLS. Dynamic executables will initialize their copy of the global
+   // stack protector from the one in the main thread's TLS.
+-  __libc_safe_arc4random_buf(&__stack_chk_guard, sizeof(__stack_chk_guard));
++  __libc_safe_arc4random_buf(&__stack_chk_guard[0], sizeof(__stack_chk_guard[0]));
++  if (mprotect(__stack_chk_guard, sizeof(__stack_chk_guard), PROT_READ) == -1) {
++    async_safe_fatal("mprotect __stack_chk_guard: %s", strerror(errno));
++  }
+   __init_tcb_stack_guard(__get_bionic_tcb());
+ }
+ 

Patches/LineageOS-20.0/android_bionic/0002-Graphene_Bionic_Hardening-9.patch

@@ -0,0 +1,41 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Sun, 12 Mar 2017 17:49:13 -0400
+Subject: [PATCH] on 64-bit, zero the leading stack canary byte
+
+This reduces entropy of the canary from 64-bit to 56-bit in exchange for
+mitigating non-terminated C string overflows.
+
+Signed-off-by: anupritaisno1 <www.anuprita804@gmail.com>
+---
+ libc/bionic/__libc_init_main_thread.cpp | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/libc/bionic/__libc_init_main_thread.cpp b/libc/bionic/__libc_init_main_thread.cpp
+index 7e1e7cbcb..5bdf61d2c 100644
+--- a/libc/bionic/__libc_init_main_thread.cpp
++++ b/libc/bionic/__libc_init_main_thread.cpp
+@@ -49,6 +49,12 @@ uintptr_t __stack_chk_guard[PAGE_SIZE / sizeof(uintptr_t)] = {0};
+ 
+ static pthread_internal_t main_thread;
+ 
++#if __LP64__
++static const uintptr_t canary_mask = __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__ ?
++  0xffffffffffffff00UL :
++  0x00ffffffffffffffUL;
++#endif
++
+ // Setup for the main thread. For dynamic executables, this is called by the
+ // linker _before_ libc is mapped in memory. This means that all writes to
+ // globals from this function will apply to linker-private copies and will not
+@@ -117,6 +123,10 @@ extern "C" void android_reset_stack_guards() {
+   // before we initialize the TLS. Dynamic executables will initialize their copy of the global
+   // stack protector from the one in the main thread's TLS.
+   __libc_safe_arc4random_buf(&__stack_chk_guard[0], sizeof(__stack_chk_guard[0]));
++#if __LP64__
++  // Sacrifice 8 bits of entropy on 64-bit to mitigate non-terminated C string overflows
++  __stack_chk_guard[0] &= canary_mask;
++#endif
+   if (mprotect(__stack_chk_guard, sizeof(__stack_chk_guard), PROT_READ) == -1) {
+     async_safe_fatal("mprotect __stack_chk_guard: %s", strerror(errno));
+   }

Patches/LineageOS-20.0/android_bionic/0003-Hosts_Cache.patch

@@ -0,0 +1,639 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Tom Marshall <tdm@cyngn.com>
+Date: Fri, 17 Jun 2016 16:38:12 -0700
+Subject: [PATCH] bionic: Sort and cache hosts file data for fast lookup
+
+The hosts file is normally searched linearly.  This is very slow when
+the file is large.  To mitigate this, read the hosts file and sort the
+entries in an in-memory cache.  When an address is requested via
+gethostbyname or getaddrinfo, binary search the cache.
+
+In case where the cache is not available, return a suitable error code
+and fall back to the existing lookup code.
+
+This has been written to behave as much like the existing lookup code as
+possible.  But note bionic and glibc differ in behavior for some corner
+cases.  Choose the most standard compliant behavior for these where
+possible.  Otherwise choose the behavior that seems most reasonable.
+
+RM-290
+
+Change-Id: I3b322883cbc48b0d76a0ce9d149b59faaac1dc58
+(cherry picked from commit ed4c3a6bd449a4ed70645071a440ae146f194116)
+---
+ libc/dns/net/getaddrinfo.c |  10 +
+ libc/dns/net/hosts_cache.c | 520 +++++++++++++++++++++++++++++++++++++
+ libc/dns/net/hosts_cache.h |  23 ++
+ libc/dns/net/sethostent.c  |   7 +
+ 4 files changed, 560 insertions(+)
+ create mode 100644 libc/dns/net/hosts_cache.c
+ create mode 100644 libc/dns/net/hosts_cache.h
+
+diff --git a/libc/dns/net/getaddrinfo.c b/libc/dns/net/getaddrinfo.c
+index d0c11d2b0..cc94b21e2 100644
+--- a/libc/dns/net/getaddrinfo.c
++++ b/libc/dns/net/getaddrinfo.c
+@@ -109,6 +109,8 @@
+ #include "nsswitch.h"
+ #include "private/bionic_defs.h"
+ 
++#include "hosts_cache.h"
++
+ typedef union sockaddr_union {
+     struct sockaddr     generic;
+     struct sockaddr_in  in;
+@@ -2125,6 +2127,14 @@ _files_getaddrinfo(void *rv, void *cb_data, va_list ap)
+ 	name = va_arg(ap, char *);
+ 	pai = va_arg(ap, struct addrinfo *);
+ 
++	memset(&sentinel, 0, sizeof(sentinel));
++	cur = &sentinel;
++	int gai_error = hc_getaddrinfo(name, NULL, pai, &cur);
++	if (gai_error != EAI_SYSTEM) {
++		*((struct addrinfo **)rv) = sentinel.ai_next;
++		return (gai_error == 0 ? NS_SUCCESS : NS_NOTFOUND);
++	}
++
+ //	fprintf(stderr, "_files_getaddrinfo() name = '%s'\n", name);
+ 	memset(&sentinel, 0, sizeof(sentinel));
+ 	cur = &sentinel;
+diff --git a/libc/dns/net/hosts_cache.c b/libc/dns/net/hosts_cache.c
+new file mode 100644
+index 000000000..52d29e032
+--- /dev/null
++++ b/libc/dns/net/hosts_cache.c
+@@ -0,0 +1,520 @@
++/*
++ * Copyright (C) 2016 The CyanogenMod Project
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License");
++ * you may not use this file except in compliance with the License.
++ * You may obtain a copy of the License at
++ *
++ *      http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software
++ * distributed under the License is distributed on an "AS IS" BASIS,
++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++ * See the License for the specific language governing permissions and
++ * limitations under the License.
++ */
++
++#include <fcntl.h>
++#include <netdb.h>
++#include <stdio.h>
++#include <stdlib.h>
++#include <string.h>
++#include <ctype.h>
++#include <strings.h>
++#include <sys/file.h>
++#include <sys/mman.h>
++#include <sys/socket.h>
++#include <sys/stat.h>
++#include <sys/types.h>
++#include <unistd.h>
++#include <utime.h>
++#include <pthread.h>
++
++#include <netinet/in6.h>
++#include <arpa/inet.h>
++
++#include "hostent.h"
++#include "resolv_private.h"
++
++#define MAX_ADDRLEN	(INET6_ADDRSTRLEN - (1 + 5))
++#define MAX_HOSTLEN	MAXHOSTNAMELEN
++
++#define ESTIMATED_LINELEN	32
++#define HCFILE_ALLOC_SIZE	256
++
++/*
++ * Host cache entry for hcfile.c_data.
++ * Offsets are into hcfile.h_data.
++ * Strings are *not* terminated by NULL, but by whitespace (isspace) or '#'.
++ * Use hstr* functions with these.
++ */
++struct hcent
++{
++	uint32_t	addr;
++	uint32_t	name;
++};
++
++/*
++ * Overall host cache file state.
++ */
++struct hcfile
++{
++	int		h_fd;
++	struct stat	h_st;
++	char		*h_data;
++
++	uint32_t	c_alloc;
++	uint32_t	c_len;
++	struct hcent	*c_data;
++};
++static struct hcfile hcfile;
++static pthread_mutex_t hclock = PTHREAD_MUTEX_INITIALIZER;
++
++static size_t hstrlen(const char *s)
++{
++	const char *p = s;
++	while (*p && *p != '#' && !isspace(*p))
++		++p;
++	return p - s;
++}
++
++static int hstrcmp(const char *a, const char *b)
++{
++	size_t alen = hstrlen(a);
++	size_t blen = hstrlen(b);
++	int res = strncmp(a, b, MIN(alen, blen));
++	if (res == 0)
++		res = alen - blen;
++	return res;
++}
++
++static char *hstrcpy(char *dest, const char *src)
++{
++	size_t len = hstrlen(src);
++	memcpy(dest, src, len);
++	dest[len] = '\0';
++	return dest;
++}
++
++static char *hstrdup(const char *s)
++{
++	size_t len = hstrlen(s);
++	char *dest = (char *)malloc(len + 1);
++	if (!dest)
++		return NULL;
++	memcpy(dest, s, len);
++	dest[len] = '\0';
++	return dest;
++}
++
++static int cmp_hcent_name(const void *a, const void *b)
++{
++	struct hcent *ea = (struct hcent *)a;
++	const char *na = hcfile.h_data + ea->name;
++	struct hcent *eb = (struct hcent *)b;
++	const char *nb = hcfile.h_data + eb->name;
++
++	return hstrcmp(na, nb);
++}
++
++static struct hcent *_hcfindname(const char *name)
++{
++	size_t first, last, mid;
++	struct hcent *cur = NULL;
++	int cmp;
++
++	if (hcfile.c_len == 0)
++		return NULL;
++
++	first = 0;
++	last = hcfile.c_len - 1;
++	mid = (first + last) / 2;
++	while (first <= last) {
++		cur = hcfile.c_data + mid;
++		cmp = hstrcmp(hcfile.h_data + cur->name, name);
++		if (cmp == 0)
++			goto found;
++		if (cmp < 0)
++			first = mid + 1;
++		else {
++			if (mid > 0)
++				last = mid - 1;
++			else
++				return NULL;
++		}
++		mid = (first + last) / 2;
++	}
++	return NULL;
++
++found:
++	while (cur > hcfile.c_data) {
++		struct hcent *prev = cur - 1;
++		cmp = cmp_hcent_name(cur, prev);
++		if (cmp)
++			break;
++		cur = prev;
++	}
++
++	return cur;
++}
++
++/*
++ * Find next name on line, if any.
++ *
++ * Assumes that line is terminated by LF.
++ */
++static const char *_hcnextname(const char *name)
++{
++	while (!isspace(*name)) {
++		if (*name == '#')
++			return NULL;
++		++name;
++	}
++	while (isspace(*name)) {
++		if (*name == '\n')
++			return NULL;
++		++name;
++	}
++	if (*name == '#')
++		return NULL;
++	return name;
++}
++
++static int _hcfilemmap(void)
++{
++	struct stat st;
++	int h_fd;
++	char *h_addr;
++	const char *p, *pend;
++	uint32_t c_alloc;
++
++	h_fd = open(_PATH_HOSTS, O_RDONLY);
++	if (h_fd < 0)
++		return -1;
++	if (flock(h_fd, LOCK_EX) != 0) {
++		close(h_fd);
++		return -1;
++	}
++
++	if (hcfile.h_data) {
++		memset(&st, 0, sizeof(st));
++		if (fstat(h_fd, &st) == 0) {
++			if (st.st_size == hcfile.h_st.st_size &&
++			    st.st_mtime == hcfile.h_st.st_mtime) {
++				flock(h_fd, LOCK_UN);
++				close(h_fd);
++				return 0;
++			}
++		}
++		free(hcfile.c_data);
++		munmap(hcfile.h_data, hcfile.h_st.st_size);
++		close(hcfile.h_fd);
++		memset(&hcfile, 0, sizeof(struct hcfile));
++	}
++
++	if (fstat(h_fd, &st) != 0) {
++		flock(h_fd, LOCK_UN);
++		close(h_fd);
++		return -1;
++	}
++	h_addr = mmap(NULL, st.st_size, PROT_READ, MAP_SHARED, h_fd, 0);
++	if (h_addr == MAP_FAILED) {
++		flock(h_fd, LOCK_UN);
++		close(h_fd);
++		return -1;
++	}
++
++	hcfile.h_fd = h_fd;
++	hcfile.h_st = st;
++	hcfile.h_data = h_addr;
++
++	c_alloc = 0;
++	/*
++	 * Do an initial allocation if the file is "large".  Estimate
++	 * 32 bytes per line and define "large" as more than half of
++	 * the alloc growth size (256 entries).
++	 */
++	if (st.st_size >= ESTIMATED_LINELEN * HCFILE_ALLOC_SIZE / 2) {
++		c_alloc = st.st_size / ESTIMATED_LINELEN;
++		hcfile.c_data = malloc(c_alloc * sizeof(struct hcent));
++		if (!hcfile.c_data) {
++			goto oom;
++		}
++	}
++
++	p = (const char *)h_addr;
++	pend = p + st.st_size;
++	while (p < pend) {
++		const char *eol, *addr, *name;
++		size_t len;
++		addr = p;
++		eol = memchr(p, '\n', pend - p);
++		if (!eol)
++			break;
++		p = eol + 1;
++		if (*addr == '#' || *addr == '\n')
++			continue;
++		len = hstrlen(addr);
++		if (len > MAX_ADDRLEN)
++			continue;
++		name = addr + len;
++		while (name < eol && isspace(*name))
++			++name;
++		while (name < eol) {
++			len = hstrlen(name);
++			if (len == 0)
++				break;
++			if (len < MAX_HOSTLEN) {
++				struct hcent *ent;
++				if (c_alloc <= hcfile.c_len) {
++					struct hcent *c_data;
++					c_alloc += HCFILE_ALLOC_SIZE;
++					c_data = realloc(hcfile.c_data, c_alloc * sizeof(struct hcent));
++					if (!c_data) {
++						goto oom;
++					}
++					hcfile.c_data = c_data;
++				}
++				ent = hcfile.c_data + hcfile.c_len;
++				ent->addr = addr - h_addr;
++				ent->name = name - h_addr;
++				++hcfile.c_len;
++			}
++			name += len;
++			while (name < eol && isspace(*name))
++				++name;
++		}
++	}
++
++	qsort(hcfile.c_data, hcfile.c_len,
++	    sizeof(struct hcent), cmp_hcent_name);
++
++	flock(h_fd, LOCK_UN);
++
++	return 0;
++
++oom:
++	free(hcfile.c_data);
++	munmap(hcfile.h_data, hcfile.h_st.st_size);
++	flock(hcfile.h_fd, LOCK_UN);
++	close(hcfile.h_fd);
++	memset(&hcfile, 0, sizeof(struct hcfile));
++	return -1;
++}
++
++/*
++ * Caching version of getaddrinfo.
++ *
++ * If we find the requested host name in the cache, use getaddrinfo to
++ * populate the result for each address we find.
++ *
++ * Note glibc and bionic differ in the handling of ai_canonname.  POSIX
++ * says that ai_canonname is only populated in the first result entry.
++ * glibc does this.  bionic populates ai_canonname in all result entries.
++ * We choose the POSIX/glibc way here.
++ */
++int hc_getaddrinfo(const char *host, const char *service,
++		   const struct addrinfo *hints,
++		   struct addrinfo **result)
++{
++	int ret = 0;
++	struct hcent *ent, *cur;
++	struct addrinfo *ai;
++	struct addrinfo rhints;
++	struct addrinfo *last;
++	int canonname = 0;
++	int cmp;
++
++	if (getenv("ANDROID_HOSTS_CACHE_DISABLE") != NULL)
++		return EAI_SYSTEM;
++
++	/* Avoid needless work and recursion */
++	if (hints && (hints->ai_flags & AI_NUMERICHOST))
++		return EAI_SYSTEM;
++	if (!host)
++		return EAI_SYSTEM;
++
++	pthread_mutex_lock(&hclock);
++
++	if (_hcfilemmap() != 0) {
++		ret = EAI_SYSTEM;
++		goto out;
++	}
++	ent = _hcfindname(host);
++	if (!ent) {
++		ret = EAI_NONAME;
++		goto out;
++	}
++
++	if (hints) {
++		canonname = (hints->ai_flags & AI_CANONNAME);
++		memcpy(&rhints, hints, sizeof(rhints));
++		rhints.ai_flags &= ~AI_CANONNAME;
++	}
++	else {
++		memset(&rhints, 0, sizeof(rhints));
++	}
++	rhints.ai_flags |= AI_NUMERICHOST;
++
++	last = NULL;
++	cur = ent;
++	do {
++		char addrstr[MAX_ADDRLEN];
++		struct addrinfo *res;
++
++		hstrcpy(addrstr, hcfile.h_data + cur->addr);
++
++		if (getaddrinfo(addrstr, service, &rhints, &res) == 0) {
++			if (!last)
++				(*result)->ai_next = res;
++			else
++				last->ai_next = res;
++			last = res;
++			while (last->ai_next)
++				last = last->ai_next;
++		}
++
++		if(cur + 1 >= hcfile.c_data + hcfile.c_len)
++			break;
++		cmp = cmp_hcent_name(cur, cur + 1);
++		cur = cur + 1;
++	}
++	while (!cmp);
++
++	if (last == NULL) {
++		/* This check is equivalent to (*result)->ai_next == NULL */
++		ret = EAI_NODATA;
++		goto out;
++	}
++
++	if (canonname) {
++		ai = (*result)->ai_next;
++		free(ai->ai_canonname);
++		ai->ai_canonname = hstrdup(hcfile.h_data + ent->name);
++	}
++
++out:
++	pthread_mutex_unlock(&hclock);
++	return ret;
++}
++
++/*
++ * Caching version of gethtbyname.
++ *
++ * Note glibc and bionic differ in the handling of aliases.  glibc returns
++ * all aliases for all entries, regardless of whether they match h_addrtype.
++ * bionic returns only the aliases for the first hosts entry.  We return all
++ * aliases for all IPv4 entries.
++ *
++ * Additionally, if an alias is IPv6 and the primary name for an alias also
++ * has an IPv4 entry, glibc will return the IPv4 address(es), but bionic
++ * will not.  Neither do we.
++ */
++int hc_gethtbyname(const char *host, int af, struct getnamaddr *info)
++{
++	int ret = NETDB_SUCCESS;
++	struct hcent *ent, *cur;
++	int cmp;
++	size_t addrlen;
++	unsigned int naliases = 0;
++	char *aliases[MAXALIASES];
++	unsigned int naddrs = 0;
++	char *addr_ptrs[MAXADDRS];
++	unsigned int n;
++
++	if (getenv("ANDROID_HOSTS_CACHE_DISABLE") != NULL)
++		return NETDB_INTERNAL;
++
++	switch (af) {
++	case AF_INET:  addrlen = NS_INADDRSZ;  break;
++	case AF_INET6: addrlen = NS_IN6ADDRSZ; break;
++	default:
++		return NETDB_INTERNAL;
++	}
++
++	pthread_mutex_lock(&hclock);
++
++	if (_hcfilemmap() != 0) {
++		ret = NETDB_INTERNAL;
++		goto out;
++	}
++
++	ent = _hcfindname(host);
++	if (!ent) {
++		ret = HOST_NOT_FOUND;
++		goto out;
++	}
++
++	cur = ent;
++	do {
++		char addr[16];
++		char addrstr[MAX_ADDRLEN];
++		char namestr[MAX_HOSTLEN];
++		const char *name;
++
++		hstrcpy(addrstr, hcfile.h_data + cur->addr);
++		if (inet_pton(af, addrstr, &addr) == 1) {
++			char *aligned;
++			/* First match is considered the official hostname */
++			if (naddrs == 0) {
++				hstrcpy(namestr, hcfile.h_data + cur->name);
++				HENT_SCOPY(info->hp->h_name, namestr, info->buf, info->buflen);
++			}
++			for (name = hcfile.h_data + cur->name; name; name = _hcnextname(name)) {
++				if (!hstrcmp(name, host))
++					continue;
++				hstrcpy(namestr, name);
++				HENT_SCOPY(aliases[naliases], namestr, info->buf, info->buflen);
++				++naliases;
++				if (naliases >= MAXALIASES)
++					goto nospc;
++			}
++			aligned = (char *)ALIGN(info->buf);
++			if (info->buf != aligned) {
++				if ((ptrdiff_t)info->buflen < (aligned - info->buf))
++					goto nospc;
++				info->buflen -= (aligned - info->buf);
++				info->buf = aligned;
++			}
++			HENT_COPY(addr_ptrs[naddrs], addr, addrlen, info->buf, info->buflen);
++			++naddrs;
++			if (naddrs >= MAXADDRS)
++				goto nospc;
++		}
++
++		if(cur + 1 >= hcfile.c_data + hcfile.c_len)
++			break;
++		cmp = cmp_hcent_name(cur, cur + 1);
++		cur = cur + 1;
++	}
++	while (!cmp);
++
++	if (naddrs == 0) {
++		ret = HOST_NOT_FOUND;
++		goto out;
++	}
++
++	addr_ptrs[naddrs++] = NULL;
++	aliases[naliases++] = NULL;
++
++	/* hp->h_name already populated */
++	HENT_ARRAY(info->hp->h_aliases, naliases, info->buf, info->buflen);
++	for (n = 0; n < naliases; ++n) {
++		info->hp->h_aliases[n] = aliases[n];
++	}
++	info->hp->h_addrtype = af;
++	info->hp->h_length = addrlen;
++	HENT_ARRAY(info->hp->h_addr_list, naddrs, info->buf, info->buflen);
++	for (n = 0; n < naddrs; ++n) {
++		info->hp->h_addr_list[n] = addr_ptrs[n];
++	}
++
++out:
++	pthread_mutex_unlock(&hclock);
++	*info->he = ret;
++	return ret;
++
++nospc:
++	ret = NETDB_INTERNAL;
++	goto out;
++}
+diff --git a/libc/dns/net/hosts_cache.h b/libc/dns/net/hosts_cache.h
+new file mode 100644
+index 000000000..fa5488f51
+--- /dev/null
++++ b/libc/dns/net/hosts_cache.h
+@@ -0,0 +1,23 @@
++/*
++ * Copyright (C) 2016 The CyanogenMod Project
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License");
++ * you may not use this file except in compliance with the License.
++ * You may obtain a copy of the License at
++ *
++ *      http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software
++ * distributed under the License is distributed on an "AS IS" BASIS,
++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++ * See the License for the specific language governing permissions and
++ * limitations under the License.
++ */
++
++struct getnamaddr;
++
++int hc_getaddrinfo(const char *host, const char *service,
++		   const struct addrinfo *hints,
++		   struct addrinfo **result);
++
++int hc_gethtbyname(const char *host, int af, struct getnamaddr *info);
+diff --git a/libc/dns/net/sethostent.c b/libc/dns/net/sethostent.c
+index 483105a95..1399378cd 100644
+--- a/libc/dns/net/sethostent.c
++++ b/libc/dns/net/sethostent.c
+@@ -55,6 +55,8 @@ __RCSID("$NetBSD: sethostent.c,v 1.20 2014/03/17 13:24:23 christos Exp $");
+ #include "hostent.h"
+ #include "resolv_private.h"
+ 
++#include "hosts_cache.h"
++
+ #ifndef _REENTRANT
+ void	res_close(void);
+ #endif
+@@ -109,6 +111,11 @@ _hf_gethtbyname(void *rv, void *cb_data, va_list ap)
+ 	/* NOSTRICT skip string len */(void)va_arg(ap, int);
+ 	af = va_arg(ap, int);
+ 
++	int rc = hc_gethtbyname(name, af, info);
++	if (rc != NETDB_INTERNAL) {
++		return (rc == NETDB_SUCCESS ? NS_SUCCESS : NS_NOTFOUND);
++	}
++
+ #if 0
+ 	{
+ 		res_state res = __res_get_state();

Patches/LineageOS-20.0/android_bionic/0003-Hosts_Wildcards.patch

@@ -0,0 +1,69 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Tom Marshall <tdm.code@gmail.com>
+Date: Thu, 16 Jan 2020 13:07:04 -0800
+Subject: [PATCH] bionic: Support wildcards in cached hosts file
+
+If an exact name is not found in the hosts file and the host name
+contains at least one dot, search for entries of the form "*.domain",
+where domain is the portion of the host name after the first dot.  If
+that is not found, repeat using the domain.
+
+Example: a.b.c.example.com would search for the following in turn:
+	a.b.c.example.com
+	*.b.c.example.com
+	*.c.example.com
+	*.example.com
+	*.com
+
+Change-Id: I4b0bb81699151d5b371850daebf785e35ec9b180
+---
+ libc/dns/net/hosts_cache.c | 29 ++++++++++++++++++++++++++++-
+ 1 file changed, 28 insertions(+), 1 deletion(-)
+
+diff --git a/libc/dns/net/hosts_cache.c b/libc/dns/net/hosts_cache.c
+index 52d29e032..fc6370d0c 100644
+--- a/libc/dns/net/hosts_cache.c
++++ b/libc/dns/net/hosts_cache.c
+@@ -117,7 +117,7 @@ static int cmp_hcent_name(const void *a, const void *b)
+ 	return hstrcmp(na, nb);
+ }
+ 
+-static struct hcent *_hcfindname(const char *name)
++static struct hcent *_hcfindname_exact(const char *name)
+ {
+ 	size_t first, last, mid;
+ 	struct hcent *cur = NULL;
+@@ -158,6 +158,33 @@ found:
+ 	return cur;
+ }
+ 
++static struct hcent *_hcfindname(const char *name)
++{
++	struct hcent *ent;
++	char namebuf[MAX_HOSTLEN];
++	char *p;
++	char *dot;
++
++	ent = _hcfindname_exact(name);
++	if (!ent && strlen(name) < sizeof(namebuf)) {
++		strcpy(namebuf, name);
++		p = namebuf;
++		do {
++			dot = strchr(p, '.');
++			if (!dot)
++				break;
++			if (dot > p) {
++				*(dot - 1) = '*';
++				ent = _hcfindname_exact(dot - 1);
++			}
++			p = dot + 1;
++		}
++		while (!ent);
++	}
++
++	return ent;
++}
++
+ /*
+  * Find next name on line, if any.
+  *

Patches/LineageOS-20.0/android_bionic/0004-hosts_toggle.patch

@@ -0,0 +1,35 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Tad <tad@spotco.us>
+Date: Wed, 20 Apr 2022 00:40:52 -0400
+Subject: [PATCH] Add a toggle to disable /etc/hosts lookup
+
+Signed-off-by: Tad <tad@spotco.us>
+Change-Id: I92679c57e73228dc194e61a86ea1a18b2ac90e04
+---
+ libc/dns/net/getaddrinfo.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/libc/dns/net/getaddrinfo.c b/libc/dns/net/getaddrinfo.c
+index cc94b21e2..12294da04 100644
+--- a/libc/dns/net/getaddrinfo.c
++++ b/libc/dns/net/getaddrinfo.c
+@@ -83,6 +83,7 @@
+ #include <sys/stat.h>
+ #include <sys/param.h>
+ #include <sys/socket.h>
++#include <sys/system_properties.h>
+ #include <sys/un.h>
+ #include <net/if.h>
+ #include <netinet/in.h>
+@@ -2127,6 +2128,11 @@ _files_getaddrinfo(void *rv, void *cb_data, va_list ap)
+ 	name = va_arg(ap, char *);
+ 	pai = va_arg(ap, struct addrinfo *);
+ 
++	char value[PROP_VALUE_MAX] = { 0 };
++	if (__system_property_get("persist.security.hosts_disable", value) != 0)
++		if (atoi(value) != 0 && strcmp(name, "localhost") != 0 && strcmp(name, "ip6-localhost") != 0)
++			return NS_NOTFOUND;
++
+ 	memset(&sentinel, 0, sizeof(sentinel));
+ 	cur = &sentinel;
+ 	int gai_error = hc_getaddrinfo(name, NULL, pai, &cur);

Patches/LineageOS-20.0/android_bootable_recovery/0001-No_SerialNum_Restrictions.patch

@@ -0,0 +1,38 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Wed, 19 Aug 2020 09:31:04 -0400
+Subject: [PATCH] reject updates with serialno constraints
+
+---
+ install/install.cpp | 16 ++--------------
+ 1 file changed, 2 insertions(+), 14 deletions(-)
+
+diff --git a/install/install.cpp b/install/install.cpp
+index 56b3ad7f..18a88489 100644
+--- a/install/install.cpp
++++ b/install/install.cpp
+@@ -221,22 +221,10 @@ bool CheckPackageMetadata(const std::map<std::string, std::string>& metadata, Ot
+     return false;
+   }
+ 
+-  // We allow the package to not have any serialno; and we also allow it to carry multiple serial
+-  // numbers split by "|"; e.g. serialno=serialno1|serialno2|serialno3 ... We will fail the
+-  // verification if the device's serialno doesn't match any of these carried numbers.
+   auto pkg_serial_no = get_value(metadata, "serialno");
+   if (!pkg_serial_no.empty()) {
+-    auto device_serial_no = android::base::GetProperty("ro.serialno", "");
+-    bool serial_number_match = false;
+-    for (const auto& number : android::base::Split(pkg_serial_no, "|")) {
+-      if (device_serial_no == android::base::Trim(number)) {
+-        serial_number_match = true;
+-      }
+-    }
+-    if (!serial_number_match) {
+-      LOG(ERROR) << "Package is for serial " << pkg_serial_no;
+-      return false;
+-    }
++    LOG(ERROR) << "Serial number constraint not permitted: " << pkg_serial_no;
++    return INSTALL_ERROR;
+   }
+ 
+   if (ota_type == OtaType::AB) {

Patches/LineageOS-20.0/android_build/0001-Enable_fwrapv.patch

@@ -0,0 +1,24 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Tue, 13 Sep 2016 22:05:56 -0400
+Subject: [PATCH] use -fwrapv when signed overflow checking is off
+
+Signed-off-by: anupritaisno1 <www.anuprita804@gmail.com>
+---
+ core/config_sanitizers.mk | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/core/config_sanitizers.mk b/core/config_sanitizers.mk
+index a0ff11951..0a73b70f5 100644
+--- a/core/config_sanitizers.mk
++++ b/core/config_sanitizers.mk
+@@ -505,3 +505,9 @@ ifneq ($(findstring fsanitize,$(my_cflags)),)
+     endif
+   endif
+ endif
++
++ifeq ($(filter signed-integer-overflow integer undefined,$(my_sanitize)),)
++  ifeq ($(filter -ftrapv,$(my_cflags)),)
++    my_cflags += -fwrapv
++  endif
++endif

Patches/LineageOS-20.0/android_build/0002-OTA_Keys.patch

@@ -0,0 +1,88 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Tad <tad@spotco.us>
+Date: Tue, 6 Apr 2021 05:04:32 -0400
+Subject: [PATCH] Allow setting OTA public keys from environment variable
+
+Change-Id: Ib2a00de63b0c7a8790640462d13a84daf2076fa7
+---
+ core/product_config.mk             |  5 +++++
+ target/product/security/Android.mk | 21 +++++++++++++++++----
+ tools/buildinfo.sh                 |  4 ++--
+ 3 files changed, 24 insertions(+), 6 deletions(-)
+
+diff --git a/core/product_config.mk b/core/product_config.mk
+index 37146d3a9..7dc8113f5 100644
+--- a/core/product_config.mk
++++ b/core/product_config.mk
+@@ -395,6 +395,11 @@ PRODUCT_OTA_PUBLIC_KEYS := $(sort $(PRODUCT_OTA_PUBLIC_KEYS))
+ PRODUCT_EXTRA_OTA_KEYS := $(sort $(PRODUCT_EXTRA_OTA_KEYS))
+ PRODUCT_EXTRA_RECOVERY_KEYS := $(sort $(PRODUCT_EXTRA_RECOVERY_KEYS))
+ 
++ifneq ($(OTA_KEY_OVERRIDE_DIR),)
++    PRODUCT_OTA_PUBLIC_KEYS := $(OTA_KEY_OVERRIDE_DIR)/releasekey.x509.pem
++    PRODUCT_EXTRA_RECOVERY_KEYS := $(OTA_KEY_OVERRIDE_DIR)/extra
++endif
++
+ # Resolve and setup per-module dex-preopt configs.
+ DEXPREOPT_DISABLED_MODULES :=
+ # If a module has multiple setups, the first takes precedence.
+diff --git a/target/product/security/Android.mk b/target/product/security/Android.mk
+index ad25a9261..c2dca4dc4 100644
+--- a/target/product/security/Android.mk
++++ b/target/product/security/Android.mk
+@@ -70,11 +70,17 @@ include $(BUILD_SYSTEM)/base_rules.mk
+ 
+ extra_ota_keys := $(addsuffix .x509.pem,$(PRODUCT_EXTRA_OTA_KEYS))
+ 
+-$(LOCAL_BUILT_MODULE): PRIVATE_CERT := $(DEFAULT_SYSTEM_DEV_CERTIFICATE).x509.pem
++OTA_PUBLIC_KEYS := $(DEFAULT_SYSTEM_DEV_CERTIFICATE).x509.pem
++
++ifneq ($(OTA_KEY_OVERRIDE_DIR),)
++    OTA_PUBLIC_KEYS := $(OTA_KEY_OVERRIDE_DIR)/releasekey.x509.pem
++endif
++
++$(LOCAL_BUILT_MODULE): PRIVATE_CERT := $(OTA_PUBLIC_KEYS)
+ $(LOCAL_BUILT_MODULE): PRIVATE_EXTRA_OTA_KEYS := $(extra_ota_keys)
+ $(LOCAL_BUILT_MODULE): \
+ 	    $(SOONG_ZIP) \
+-	    $(DEFAULT_SYSTEM_DEV_CERTIFICATE).x509.pem \
++	    $(OTA_PUBLIC_KEYS) \
+ 	    $(extra_ota_keys)
+ 	$(SOONG_ZIP) -o $@ -j -symlinks=false \
+ 	    $(addprefix -f ,$(PRIVATE_CERT) $(PRIVATE_EXTRA_OTA_KEYS))
+@@ -95,11 +101,18 @@ include $(BUILD_SYSTEM)/base_rules.mk
+ 
+ extra_recovery_keys := $(addsuffix .x509.pem,$(PRODUCT_EXTRA_RECOVERY_KEYS))
+ 
+-$(LOCAL_BUILT_MODULE): PRIVATE_CERT := $(DEFAULT_SYSTEM_DEV_CERTIFICATE).x509.pem
++OTA_PUBLIC_KEYS := $(DEFAULT_SYSTEM_DEV_CERTIFICATE).x509.pem
++
++ifneq ($(OTA_KEY_OVERRIDE_DIR),)
++    OTA_PUBLIC_KEYS := $(OTA_KEY_OVERRIDE_DIR)/releasekey.x509.pem
++    extra_recovery_keys := $(OTA_KEY_OVERRIDE_DIR)/extra.x509.pem
++endif
++
++$(LOCAL_BUILT_MODULE): PRIVATE_CERT := $(OTA_PUBLIC_KEYS)
+ $(LOCAL_BUILT_MODULE): PRIVATE_EXTRA_RECOVERY_KEYS := $(extra_recovery_keys)
+ $(LOCAL_BUILT_MODULE): \
+ 	    $(SOONG_ZIP) \
+-	    $(DEFAULT_SYSTEM_DEV_CERTIFICATE).x509.pem \
++	    $(OTA_PUBLIC_KEYS) \
+ 	    $(extra_recovery_keys)
+ 	$(SOONG_ZIP) -o $@ -j -symlinks=false \
+ 	    $(addprefix -f ,$(PRIVATE_CERT) $(PRIVATE_EXTRA_RECOVERY_KEYS))
+diff --git a/tools/buildinfo.sh b/tools/buildinfo.sh
+index c00e1e98b..8145794e1 100755
+--- a/tools/buildinfo.sh
++++ b/tools/buildinfo.sh
+@@ -26,8 +26,8 @@ echo "ro.build.version.min_supported_target_sdk=$PLATFORM_MIN_SUPPORTED_TARGET_S
+ echo "ro.build.date=`$DATE`"
+ echo "ro.build.date.utc=`$DATE +%s`"
+ echo "ro.build.type=$TARGET_BUILD_TYPE"
+-echo "ro.build.user=$BUILD_USERNAME"
+-echo "ro.build.host=$BUILD_HOSTNAME"
++echo "ro.build.user=emy"
++echo "ro.build.host=dosbm"
+ echo "ro.build.tags=$BUILD_VERSION_TAGS"
+ echo "ro.build.flavor=$TARGET_BUILD_FLAVOR"
+ if [ -n "$BOARD_BUILD_SYSTEM_ROOT_IMAGE" ] ; then

Patches/LineageOS-20.0/android_build/0003-Exec_Based_Spawning.patch

@@ -0,0 +1,28 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Thu, 17 Sep 2020 10:53:00 -0400
+Subject: [PATCH] disable enforce RRO for mainline devices
+
+This is currently incompatible with exec-based spawning. This also
+impacts the wrapper spawning model for the stock OS which is available
+by default, making it an upstream bug rather than a missing feature for
+exec-based spawning in GrapheneOS.
+
+Signed-off-by: anupritaisno1 <www.anuprita804@gmail.com>
+---
+ target/product/generic_system.mk | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/target/product/generic_system.mk b/target/product/generic_system.mk
+index 1a639ef71..7f5f74f4b 100644
+--- a/target/product/generic_system.mk
++++ b/target/product/generic_system.mk
+@@ -111,7 +111,7 @@ PRODUCT_COPY_FILES += \
+ # Enable dynamic partition size
+ PRODUCT_USE_DYNAMIC_PARTITION_SIZE := true
+ 
+-PRODUCT_ENFORCE_RRO_TARGETS := *
++#PRODUCT_ENFORCE_RRO_TARGETS := *
+ 
+ PRODUCT_NAME := generic_system
+ PRODUCT_BRAND := generic

Patches/LineageOS-20.0/android_build_soong/0001-Enable_fwrapv.patch

@@ -0,0 +1,64 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Wed, 23 Aug 2017 20:28:03 -0400
+Subject: [PATCH] use -fwrapv when signed overflow checking is off
+
+Signed-off-by: anupritaisno1 <www.anuprita804@gmail.com>
+---
+ cc/cc.go       |  2 ++
+ cc/cc_test.go  |  2 +-
+ cc/sanitize.go | 12 ++++++++++++
+ 3 files changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/cc/cc.go b/cc/cc.go
+index d17369c70..44060049a 100644
+--- a/cc/cc.go
++++ b/cc/cc.go
+@@ -1853,6 +1853,8 @@ func (c *Module) GenerateAndroidBuildActions(actx android.ModuleContext) {
+ 	}
+ 	if c.sanitize != nil {
+ 		flags = c.sanitize.flags(ctx, flags)
++	} else {
++		flags.Local.CFlags = append(flags.Local.CFlags, "-fwrapv")
+ 	}
+ 	if c.coverage != nil {
+ 		flags, deps = c.coverage.flags(ctx, flags, deps)
+diff --git a/cc/cc_test.go b/cc/cc_test.go
+index 09cc352a2..af6188905 100644
+--- a/cc/cc_test.go
++++ b/cc/cc_test.go
+@@ -4041,7 +4041,7 @@ func TestIncludeDirectoryOrdering(t *testing.T) {
+ 	conly := []string{"-fPIC", "${config.CommonGlobalConlyflags}"}
+ 	cppOnly := []string{"-fPIC", "${config.CommonGlobalCppflags}", "${config.DeviceGlobalCppflags}", "${config.ArmCppflags}"}
+ 
+-	cflags := []string{"-Wall", "-Werror", "-std=candcpp"}
++	cflags := []string{"-Wall", "-Werror", "-std=candcpp", "-fwrapv"}
+ 	cstd := []string{"-std=gnu99", "-std=conly"}
+ 	cppstd := []string{"-std=gnu++17", "-std=cpp", "-fno-rtti"}
+ 
+diff --git a/cc/sanitize.go b/cc/sanitize.go
+index 814fef6a9..e29a3afda 100644
+--- a/cc/sanitize.go
++++ b/cc/sanitize.go
+@@ -596,9 +596,21 @@ func (sanitize *sanitize) flags(ctx ModuleContext, flags Flags) Flags {
+ 	}
+ 
+ 	if !sanitize.Properties.SanitizerEnabled && !sanitize.Properties.UbsanRuntimeDep {
++		flags.Local.CFlags = append(flags.Local.CFlags, "-fwrapv")
+ 		return flags
+ 	}
+ 
++        wrapv := true
++        for _, element := range sanitize.Properties.Sanitizers {
++                if (element == "signed-integer-overflow" || element == "integer" || element == "undefined") {
++                        wrapv = false
++                        break
++                }
++        }
++        if wrapv {
++                flags.Local.CFlags = append(flags.Local.CFlags, "-fwrapv")
++        }
++
+ 	if Bool(sanitize.Properties.Sanitize.Address) {
+ 		if ctx.Arch().ArchType == android.Arm {
+ 			// Frame pointer based unwinder in ASan requires ARM frame setup.

Patches/LineageOS-20.0/android_build_soong/0002-hm_apex.patch

@@ -0,0 +1,21 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: anupritaisno1 <www.anuprita804@gmail.com>
+Date: Sun, 13 Sep 2020 09:35:41 +0000
+Subject: [PATCH] make hardened malloc available to apexes
+
+---
+ apex/apex.go | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/apex/apex.go b/apex/apex.go
+index 951157f17..2fb50e9a0 100644
+--- a/apex/apex.go
++++ b/apex/apex.go
+@@ -2955,6 +2955,7 @@ func makeApexAvailableBaseline() map[string][]string {
+ 		"libdebuggerd_handler_fallback",
+ 		"libdl_static",
+ 		"libjemalloc5",
++		"libhardened_malloc",
+ 		"liblinker_main",
+ 		"liblinker_malloc",
+ 		"liblz4",

Patches/LineageOS-20.0/android_external_conscrypt/0001-constify_JNINativeMethod.patch

@@ -0,0 +1,22 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Wed, 18 Nov 2020 14:28:24 -0500
+Subject: [PATCH] constify JNINativeMethod table
+
+---
+ common/src/jni/main/cpp/conscrypt/native_crypto.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/common/src/jni/main/cpp/conscrypt/native_crypto.cc b/common/src/jni/main/cpp/conscrypt/native_crypto.cc
+index 94a61fdf..ec63c712 100644
+--- a/common/src/jni/main/cpp/conscrypt/native_crypto.cc
++++ b/common/src/jni/main/cpp/conscrypt/native_crypto.cc
+@@ -10455,7 +10455,7 @@ static jlong NativeCrypto_SSL_get1_session(JNIEnv* env, jclass, jlong ssl_addres
+ #define REF_X509_CRL "L" TO_STRING(JNI_JARJAR_PREFIX) "org/conscrypt/OpenSSLX509CRL;"
+ #define REF_SSL "L" TO_STRING(JNI_JARJAR_PREFIX) "org/conscrypt/NativeSsl;"
+ #define REF_SSL_CTX "L" TO_STRING(JNI_JARJAR_PREFIX) "org/conscrypt/AbstractSessionContext;"
+-static JNINativeMethod sNativeCryptoMethods[] = {
++static const JNINativeMethod sNativeCryptoMethods[] = {
+         CONSCRYPT_NATIVE_METHOD(clinit, "()V"),
+         CONSCRYPT_NATIVE_METHOD(CMAC_CTX_new, "()J"),
+         CONSCRYPT_NATIVE_METHOD(CMAC_CTX_free, "(J)V"),

Patches/LineageOS-20.0/android_external_hardened_malloc/0001-Broken_Cameras-1.patch

@@ -0,0 +1,102 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Tue, 1 Jan 2019 14:45:27 -0500
+Subject: [PATCH] workarounds for Pixel 3 SoC era camera driver bugs
+
+---
+ h_malloc.c | 33 ++++++++++++++++++++++++++++-----
+ 1 file changed, 28 insertions(+), 5 deletions(-)
+
+diff --git a/h_malloc.c b/h_malloc.c
+index aca3f02..32fb863 100644
+--- a/h_malloc.c
++++ b/h_malloc.c
+@@ -76,6 +76,9 @@ static union {
+ #ifdef USE_PKEY
+         int metadata_pkey;
+ #endif
++        bool zero_on_free;
++        bool purge_slabs;
++        bool region_quarantine_protect;
+     };
+     char padding[PAGE_SIZE];
+ } ro __attribute__((aligned(PAGE_SIZE)));
+@@ -443,7 +446,7 @@ static void *slot_pointer(size_t size, void *slab, size_t slot) {
+ }
+ 
+ static void write_after_free_check(const char *p, size_t size) {
+-    if (!WRITE_AFTER_FREE_CHECK) {
++    if (!WRITE_AFTER_FREE_CHECK || !ro.zero_on_free) {
+         return;
+     }
+ 
+@@ -693,7 +696,7 @@ static inline void deallocate_small(void *p, const size_t *expected_size) {
+     if (likely(!is_zero_size)) {
+         check_canary(metadata, p, size);
+ 
+-        if (ZERO_ON_FREE) {
++        if (ro.zero_on_free) {
+             memset(p, 0, size - canary_size);
+         }
+     }
+@@ -770,7 +773,7 @@ static inline void deallocate_small(void *p, const size_t *expected_size) {
+         metadata->prev = NULL;
+ 
+         if (c->empty_slabs_total + slab_size > max_empty_slabs_total) {
+-            if (!memory_map_fixed(slab, slab_size)) {
++            if (ro.purge_slabs && !memory_map_fixed(slab, slab_size)) {
+                 label_slab(slab, slab_size, class);
+                 stats_slab_deallocate(c, slab_size);
+                 enqueue_free_slab(c, metadata);
+@@ -855,7 +858,7 @@ static void regions_quarantine_deallocate_pages(void *p, size_t size, size_t gua
+         return;
+     }
+ 
+-    if (unlikely(memory_map_fixed(p, size))) {
++    if (!ro.region_quarantine_protect || unlikely(memory_map_fixed(p, size))) {
+         memory_purge(p, size);
+     } else {
+         memory_set_name(p, size, "malloc large quarantine");
+@@ -1071,6 +1074,21 @@ static inline void enforce_init(void) {
+     }
+ }
+ 
++COLD static void handle_bugs(void) {
++    char path[256];
++    if (readlink("/proc/self/exe", path, sizeof(path)) == -1) {
++        return;
++    }
++
++    // Pixel 3, Pixel 3 XL, Pixel 3a and Pixel 3a XL camera provider
++    const char camera_provider[] = "/vendor/bin/hw/android.hardware.camera.provider@2.4-service_64";
++    if (strcmp(camera_provider, path) == 0) {
++        ro.zero_on_free = false;
++        ro.purge_slabs = false;
++        ro.region_quarantine_protect = false;
++    }
++}
++
+ COLD static void init_slow_path(void) {
+     static struct mutex lock = MUTEX_INITIALIZER;
+ 
+@@ -1085,6 +1103,11 @@ COLD static void init_slow_path(void) {
+     ro.metadata_pkey = pkey_alloc(0, 0);
+ #endif
+ 
++    ro.purge_slabs = true;
++    ro.zero_on_free = ZERO_ON_FREE;
++    ro.region_quarantine_protect = true;
++    handle_bugs();
++
+     if (unlikely(sysconf(_SC_PAGESIZE) != PAGE_SIZE)) {
+         fatal_error("runtime page size does not match compile-time page size which is not supported");
+     }
+@@ -1362,7 +1385,7 @@ EXPORT void *h_calloc(size_t nmemb, size_t size) {
+     }
+     total_size = adjust_size_for_canary(total_size);
+     void *p = alloc(total_size);
+-    if (!ZERO_ON_FREE && likely(p != NULL) && total_size && total_size <= max_slab_size_class) {
++    if (!ro.zero_on_free && likely(p != NULL) && total_size && total_size <= max_slab_size_class) {
+         memset(p, 0, total_size - canary_size);
+     }
+     return p;

Patches/LineageOS-20.0/android_external_hardened_malloc/0001-Broken_Cameras-2.patch

@@ -0,0 +1,25 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Tad <tad@spotco.us>
+Date: Tue, 15 Mar 2022 22:18:26 -0400
+Subject: [PATCH] Expand workaround to all camera executables
+
+Signed-off-by: Tad <tad@spotco.us>
+Change-Id: I23513ec0379bbb10829f989690334e9704fd20e2
+---
+ h_malloc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/h_malloc.c b/h_malloc.c
+index 32fb863..b8a858a 100644
+--- a/h_malloc.c
++++ b/h_malloc.c
+@@ -1082,7 +1082,8 @@ COLD static void handle_bugs(void) {
+ 
+     // Pixel 3, Pixel 3 XL, Pixel 3a and Pixel 3a XL camera provider
+     const char camera_provider[] = "/vendor/bin/hw/android.hardware.camera.provider@2.4-service_64";
+-    if (strcmp(camera_provider, path) == 0) {
++    // Any camera executable on system partition
++    if (strcmp(camera_provider, path) == 0 || (strstr(path, "camera") != NULL && (strncmp("/system", path, 7) == 0 || strncmp("/vendor", path, 7) == 0))) {
+         ro.zero_on_free = false;
+         ro.purge_slabs = false;
+         ro.region_quarantine_protect = false;

Patches/LineageOS-20.0/android_frameworks_base/0003-SUPL_No_IMSI.patch

@@ -0,0 +1,35 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: MSe1969 <mse1969@posteo.de>
+Date: Mon, 29 Oct 2018 12:14:17 +0100
+Subject: [PATCH] SUPL: Don't send IMSI / Phone number to SUPL server
+
+Change-Id: I5ccc4d61e52ac11ef33f44618d0e610089885b87
+---
+ .../android/server/location/gnss/GnssLocationProvider.java | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/services/core/java/com/android/server/location/gnss/GnssLocationProvider.java b/services/core/java/com/android/server/location/gnss/GnssLocationProvider.java
+index f5c2bbc8d5a2..8fddc9168eed 100644
+--- a/services/core/java/com/android/server/location/gnss/GnssLocationProvider.java
++++ b/services/core/java/com/android/server/location/gnss/GnssLocationProvider.java
+@@ -1694,6 +1694,11 @@ public class GnssLocationProvider extends AbstractLocationProvider implements
+         int type = AGPS_SETID_TYPE_NONE;
+         String setId = null;
+ 
++        /*
++         * We don't want to tell Google our IMSI or phone number to spy on us!
++         * As devices w/o SIM card also have working GPS, providing this data does
++         * not seem to add a lot of value, at least not for the device holder
++         *
+         int ddSubId = SubscriptionManager.getDefaultDataSubscriptionId();
+         if (SubscriptionManager.isValidSubscriptionId(ddSubId)) {
+             phone = phone.createForSubscriptionId(ddSubId);
+@@ -1710,7 +1715,7 @@ public class GnssLocationProvider extends AbstractLocationProvider implements
+                 // This means the framework has the SIM card.
+                 type = AGPS_SETID_TYPE_MSISDN;
+             }
+-        }
++        } */
+ 
+         mGnssNative.setAgpsSetId(type, (setId == null) ? "" : setId);
+     }

Patches/LineageOS-20.0/android_frameworks_base/0004-Fingerprint_Lockout.patch

@@ -0,0 +1,23 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Tue, 12 Sep 2017 01:52:11 -0400
+Subject: [PATCH] use permanent fingerprint lockout immediately
+
+Signed-off-by: anupritaisno1 <www.anuprita804@gmail.com>
+---
+ .../sensors/fingerprint/hidl/LockoutFrameworkImpl.java          | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/services/core/java/com/android/server/biometrics/sensors/fingerprint/hidl/LockoutFrameworkImpl.java b/services/core/java/com/android/server/biometrics/sensors/fingerprint/hidl/LockoutFrameworkImpl.java
+index a0befea8e085..49c2e305421f 100644
+--- a/services/core/java/com/android/server/biometrics/sensors/fingerprint/hidl/LockoutFrameworkImpl.java
++++ b/services/core/java/com/android/server/biometrics/sensors/fingerprint/hidl/LockoutFrameworkImpl.java
+@@ -41,7 +41,7 @@ public class LockoutFrameworkImpl implements LockoutTracker {
+     private static final String ACTION_LOCKOUT_RESET =
+             "com.android.server.biometrics.sensors.fingerprint.ACTION_LOCKOUT_RESET";
+     private static final int MAX_FAILED_ATTEMPTS_LOCKOUT_TIMED = 5;
+-    private static final int MAX_FAILED_ATTEMPTS_LOCKOUT_PERMANENT = 20;
++    private static final int MAX_FAILED_ATTEMPTS_LOCKOUT_PERMANENT = 5;
+     private static final long FAIL_LOCKOUT_TIMEOUT_MS = 30 * 1000;
+     private static final String KEY_LOCKOUT_RESET_USER = "lockout_reset_user";
+ 

Patches/LineageOS-20.0/android_frameworks_base/0005-User_Logout.patch

@@ -0,0 +1,42 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: flawedworld <flawedworld@flawed.world>
+Date: Fri, 15 Oct 2021 17:07:13 +0100
+Subject: [PATCH] enable secondary user logout support by default
+
+Ported from 11, 12 moved the isLogoutEnabled boolean to ActiveAdmin.java
+---
+ .../java/com/android/server/devicepolicy/ActiveAdmin.java     | 2 +-
+ .../server/devicepolicy/DevicePolicyManagerService.java       | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/ActiveAdmin.java b/services/devicepolicy/java/com/android/server/devicepolicy/ActiveAdmin.java
+index 0c69067ab131..ef3213b68bfe 100644
+--- a/services/devicepolicy/java/com/android/server/devicepolicy/ActiveAdmin.java
++++ b/services/devicepolicy/java/com/android/server/devicepolicy/ActiveAdmin.java
+@@ -214,7 +214,7 @@ class ActiveAdmin {
+     boolean requireAutoTime = false;
+     boolean forceEphemeralUsers = false;
+     boolean isNetworkLoggingEnabled = false;
+-    boolean isLogoutEnabled = false;
++    boolean isLogoutEnabled = true;
+ 
+     // one notification after enabling + one more after reboots
+     static final int DEF_MAXIMUM_NETWORK_LOGGING_NOTIFICATIONS_SHOWN = 2;
+diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
+index 7bbcea21ca09..4be9c1a1d54a 100644
+--- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
++++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
+@@ -16083,11 +16083,11 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
+     @Override
+     public boolean isLogoutEnabled() {
+         if (!mHasFeature) {
+-            return false;
++            return true;
+         }
+         synchronized (getLockObject()) {
+             ActiveAdmin deviceOwner = getDeviceOwnerAdminLocked();
+-            return (deviceOwner != null) && deviceOwner.isLogoutEnabled;
++            return (deviceOwner == null) || deviceOwner.isLogoutEnabled;
+         }
+     }
+ 

Patches/LineageOS-20.0/android_frameworks_base/0007-Always_Restict_Serial.patch

@@ -0,0 +1,29 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Wed, 6 Sep 2017 21:40:48 -0400
+Subject: [PATCH] always set deprecated Build.SERIAL to UNKNOWN
+
+Only support fetching the serial number via the new Build.getSerial()
+requiring the READ_PHONE_STATE permission.
+---
+ .../java/com/android/server/am/ActivityManagerService.java | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+diff --git a/services/core/java/com/android/server/am/ActivityManagerService.java b/services/core/java/com/android/server/am/ActivityManagerService.java
+index a78c64b6538d..aa0aeabc747e 100644
+--- a/services/core/java/com/android/server/am/ActivityManagerService.java
++++ b/services/core/java/com/android/server/am/ActivityManagerService.java
+@@ -4824,12 +4824,7 @@ public class ActivityManagerService extends IActivityManager.Stub
+ 
+             ProfilerInfo profilerInfo = mAppProfiler.setupProfilerInfoLocked(thread, app, instr);
+ 
+-            // We deprecated Build.SERIAL and it is not accessible to
+-            // Instant Apps and target APIs higher than O MR1. Since access to the serial
+-            // is now behind a permission we push down the value.
+-            final String buildSerial = (!appInfo.isInstantApp()
+-                    && appInfo.targetSdkVersion < Build.VERSION_CODES.P)
+-                            ? sTheRealBuildSerial : Build.UNKNOWN;
++            final String buildSerial = Build.UNKNOWN;
+ 
+             // Figure out whether the app needs to run in autofill compat mode.
+             AutofillOptions autofillOptions = null;

Patches/LineageOS-20.0/android_frameworks_base/0008-Browser_No_Location.patch

@@ -0,0 +1,33 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Mon, 18 Mar 2019 01:54:30 +0200
+Subject: [PATCH] stop auto-granting location to system browsers
+
+---
+ .../pm/permission/DefaultPermissionGrantPolicy.java | 13 -------------
+ 1 file changed, 13 deletions(-)
+
+diff --git a/services/core/java/com/android/server/pm/permission/DefaultPermissionGrantPolicy.java b/services/core/java/com/android/server/pm/permission/DefaultPermissionGrantPolicy.java
+index 0ae92b4ee846..091b067682e1 100644
+--- a/services/core/java/com/android/server/pm/permission/DefaultPermissionGrantPolicy.java
++++ b/services/core/java/com/android/server/pm/permission/DefaultPermissionGrantPolicy.java
+@@ -763,19 +763,6 @@ final class DefaultPermissionGrantPolicy {
+                         Intent.CATEGORY_APP_EMAIL, userId),
+                 userId, CONTACTS_PERMISSIONS, CALENDAR_PERMISSIONS);
+ 
+-        // Browser
+-        String browserPackage = ArrayUtils.firstOrNull(getKnownPackages(
+-                KnownPackages.PACKAGE_BROWSER, userId));
+-        if (browserPackage == null) {
+-            browserPackage = getDefaultSystemHandlerActivityPackageForCategory(pm,
+-                    Intent.CATEGORY_APP_BROWSER, userId);
+-            if (!pm.isSystemPackage(browserPackage)) {
+-                browserPackage = null;
+-            }
+-        }
+-        grantPermissionsToPackage(pm, browserPackage, userId, false /* ignoreSystemPackage */,
+-                true /*whitelistRestrictedPermissions*/, FOREGROUND_LOCATION_PERMISSIONS);
+-
+         // Voice interaction
+         if (voiceInteractPackageNames != null) {
+             for (String voiceInteractPackageName : voiceInteractPackageNames) {

Patches/LineageOS-20.0/android_frameworks_base/0009-SystemUI_No_Permission_Review.patch

@@ -0,0 +1,22 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Tue, 18 Dec 2018 08:48:14 -0500
+Subject: [PATCH] allow SystemUI to directly manage Bluetooth/WiFi
+
+---
+ packages/SystemUI/AndroidManifest.xml | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/packages/SystemUI/AndroidManifest.xml b/packages/SystemUI/AndroidManifest.xml
+index 6755e6bee975..e63121fafd31 100644
+--- a/packages/SystemUI/AndroidManifest.xml
++++ b/packages/SystemUI/AndroidManifest.xml
+@@ -85,6 +85,8 @@
+     <uses-permission android:name="android.permission.CONTROL_VPN" />
+     <uses-permission android:name="android.permission.PEERS_MAC_ADDRESS"/>
+     <uses-permission android:name="android.permission.READ_WIFI_CREDENTIAL"/>
++    <uses-permission android:name="android.permission.MANAGE_BLUETOOTH_WHEN_PERMISSION_REVIEW_REQUIRED" />
++    <uses-permission android:name="android.permission.MANAGE_WIFI_WHEN_PERMISSION_REVIEW_REQUIRED" />
+     <!-- Physical hardware -->
+     <uses-permission android:name="android.permission.MANAGE_USB" />
+     <uses-permission android:name="android.permission.CONTROL_DISPLAY_BRIGHTNESS" />

Patches/LineageOS-20.0/android_frameworks_base/0014-Automatic_Reboot.patch

@@ -0,0 +1,154 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: anupritaisno1 <www.anuprita804@gmail.com>
+Date: Mon, 18 Oct 2021 01:35:40 +0300
+Subject: [PATCH] automatically reboot device after timeout if set
+
+Signed-off-by: anupritaisno1 <www.anuprita804@gmail.com>
+Change-Id: If891bfbcc144c9336ba013260bad2b7c7a59c054
+---
+ core/java/android/provider/Settings.java      |  8 +++++
+ data/etc/com.android.systemui.xml             |  1 +
+ packages/SystemUI/AndroidManifest.xml         |  3 ++
+ .../keyguard/KeyguardViewMediator.java        | 35 +++++++++++++++++++
+ 4 files changed, 47 insertions(+)
+
+diff --git a/core/java/android/provider/Settings.java b/core/java/android/provider/Settings.java
+index aa40b9202c8a..c43917955d50 100644
+--- a/core/java/android/provider/Settings.java
++++ b/core/java/android/provider/Settings.java
+@@ -17064,6 +17064,14 @@ public final class Settings {
+         public static final String REVIEW_PERMISSIONS_NOTIFICATION_STATE =
+                 "review_permissions_notification_state";
+ 
++
++        /**
++         * Whether to automatically reboot the device after a user defined timeout
++         *
++         * @hide
++         */
++        public static final String SETTINGS_REBOOT_AFTER_TIMEOUT = "settings_reboot_after_timeout";
++
+         /**
+          * Settings migrated from Wear OS settings provider.
+          * @hide
+diff --git a/data/etc/com.android.systemui.xml b/data/etc/com.android.systemui.xml
+index f030d80a3533..f14ee3d45d8c 100644
+--- a/data/etc/com.android.systemui.xml
++++ b/data/etc/com.android.systemui.xml
+@@ -50,6 +50,7 @@
+         <permission name="android.permission.READ_NETWORK_USAGE_HISTORY"/>
+         <permission name="android.permission.READ_PRIVILEGED_PHONE_STATE"/>
+         <permission name="android.permission.REAL_GET_TASKS"/>
++        <permission name="android.permission.REBOOT"/>
+         <permission name="android.permission.REQUEST_NETWORK_SCORES"/>
+         <permission name="android.permission.RECEIVE_MEDIA_RESOURCE_USAGE"/>
+         <permission name="android.permission.SET_WALLPAPER_DIM_AMOUNT"/>
+diff --git a/packages/SystemUI/AndroidManifest.xml b/packages/SystemUI/AndroidManifest.xml
+index e63121fafd31..58945cba9997 100644
+--- a/packages/SystemUI/AndroidManifest.xml
++++ b/packages/SystemUI/AndroidManifest.xml
+@@ -327,6 +327,9 @@
+ 
+     <uses-permission android:name="android.permission.SET_UNRESTRICTED_KEEP_CLEAR_AREAS" />
+ 
++    <!-- Permission to allow rebooting the device after a user configurable amount of time -->
++    <uses-permission android:name="android.permission.REBOOT" />
++
+     <protected-broadcast android:name="com.android.settingslib.action.REGISTER_SLICE_RECEIVER" />
+     <protected-broadcast android:name="com.android.settingslib.action.UNREGISTER_SLICE_RECEIVER" />
+     <protected-broadcast android:name="com.android.settings.flashlight.action.FLASHLIGHT_CHANGED" />
+diff --git a/packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java b/packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java
+index 38970f21f325..61d758b0e0fd 100644
+--- a/packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java
++++ b/packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java
+@@ -194,6 +194,8 @@ public class KeyguardViewMediator extends CoreStartable implements Dumpable,
+ 
+     private final static String TAG = "KeyguardViewMediator";
+ 
++    private static final String DELAYED_REBOOT_ACTION =
++        "com.android.internal.policy.impl.PhoneWindowManager.DELAYED_REBOOT";
+     private static final String DELAYED_KEYGUARD_ACTION =
+         "com.android.internal.policy.impl.PhoneWindowManager.DELAYED_KEYGUARD";
+     private static final String DELAYED_LOCK_PROFILE_ACTION =
+@@ -332,6 +334,11 @@ public class KeyguardViewMediator extends CoreStartable implements Dumpable,
+      */
+     private int mDelayedProfileShowingSequence;
+ 
++    /**
++     * Same as {@link #mDelayedProfileShowingSequence}, but used for our reboot implementation
++     */
++    private int mDelayedRebootSequence;
++
+     /**
+      * If the user has disabled the keyguard, then requests to exit, this is
+      * how we'll ultimately let them know whether it was successful.  We use this
+@@ -1106,6 +1113,7 @@ public class KeyguardViewMediator extends CoreStartable implements Dumpable,
+         final IntentFilter delayedActionFilter = new IntentFilter();
+         delayedActionFilter.addAction(DELAYED_KEYGUARD_ACTION);
+         delayedActionFilter.addAction(DELAYED_LOCK_PROFILE_ACTION);
++        delayedActionFilter.addAction(DELAYED_REBOOT_ACTION);
+         delayedActionFilter.setPriority(IntentFilter.SYSTEM_HIGH_PRIORITY);
+         mContext.registerReceiver(mDelayedLockBroadcastReceiver, delayedActionFilter,
+                 SYSTEMUI_PERMISSION, null /* scheduler */,
+@@ -1451,6 +1459,18 @@ public class KeyguardViewMediator extends CoreStartable implements Dumpable,
+         }
+     }
+ 
++    private void doRebootForOwnerAfterTimeoutIfEnabled(long rebootAfterTimeout) {
++        long when = SystemClock.elapsedRealtime() + rebootAfterTimeout;
++        Intent rebootIntent = new Intent(DELAYED_REBOOT_ACTION);
++        rebootIntent.putExtra("seq", mDelayedRebootSequence);
++        rebootIntent.addFlags(Intent.FLAG_RECEIVER_FOREGROUND);
++        PendingIntent sender = PendingIntent.getBroadcast(mContext,
++                0, rebootIntent, PendingIntent.FLAG_CANCEL_CURRENT |  PendingIntent.FLAG_IMMUTABLE);
++        mAlarmManager.setExactAndAllowWhileIdle(AlarmManager.ELAPSED_REALTIME_WAKEUP, when, sender);
++        if (DEBUG) Log.d(TAG, "setting alarm to reboot device, timeout = "
++                         + String.valueOf(rebootAfterTimeout));
++    }
++
+     private void doKeyguardForChildProfilesLocked() {
+         UserManager um = UserManager.get(mContext);
+         for (int profileId : um.getEnabledProfileIds(UserHandle.myUserId())) {
+@@ -1468,6 +1488,10 @@ public class KeyguardViewMediator extends CoreStartable implements Dumpable,
+         mDelayedProfileShowingSequence++;
+     }
+ 
++    private void cancelDoRebootForOwnerAfterTimeoutIfEnabled() {
++        mDelayedRebootSequence++;
++    }
++
+     /**
+      * It will let us know when the device is waking up.
+      */
+@@ -1824,6 +1848,10 @@ public class KeyguardViewMediator extends CoreStartable implements Dumpable,
+ 
+         if (DEBUG) Log.d(TAG, "doKeyguard: showing the lock screen");
+         showLocked(options);
++        final long rebootAfterTimeout = Settings.Global.getLong(mContext.getContentResolver(), Settings.Global.SETTINGS_REBOOT_AFTER_TIMEOUT, 0);
++        if (rebootAfterTimeout >= 1) {
++            doRebootForOwnerAfterTimeoutIfEnabled(rebootAfterTimeout);
++        }
+     }
+ 
+     private void lockProfile(int userId) {
+@@ -2008,6 +2036,12 @@ public class KeyguardViewMediator extends CoreStartable implements Dumpable,
+                         }
+                     }
+                 }
++            } else if (DELAYED_REBOOT_ACTION.equals(intent.getAction())) {
++                final int sequence = intent.getIntExtra("seq", 0);
++                if (sequence == mDelayedRebootSequence) {
++                    PowerManager pm = mContext.getSystemService(PowerManager.class);
++                    pm.reboot(null);
++                }
+             }
+         }
+     };
+@@ -2578,6 +2612,7 @@ public class KeyguardViewMediator extends CoreStartable implements Dumpable,
+         mHideAnimationRun = false;
+         adjustStatusBarLocked();
+         sendUserPresentBroadcast();
++        cancelDoRebootForOwnerAfterTimeoutIfEnabled();
+     }
+ 
+     private Configuration.Builder createInteractionJankMonitorConf(String tag) {

Patches/LineageOS-20.0/android_frameworks_base/0015-Bluetooth_Timeout.patch

@@ -0,0 +1,120 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Dmitry Muhomor <muhomor.dmitry@gmail.com>
+Date: Sun, 31 Jul 2022 11:19:33 +0300
+Subject: [PATCH] Bluetooth auto turn off
+
+Co-authored-by: Pratyush <codelab@pratyush.dev>
+---
+ core/java/android/provider/Settings.java      |  6 ++
+ .../android/server/ext/BluetoothAutoOff.java  | 69 +++++++++++++++++++
+ .../android/server/ext/SystemServerExt.java   |  4 ++
+ 3 files changed, 79 insertions(+)
+ create mode 100644 services/core/java/com/android/server/ext/BluetoothAutoOff.java
+
+diff --git a/core/java/android/provider/Settings.java b/core/java/android/provider/Settings.java
+index 253fec41e120..a60ec93697a6 100644
+--- a/core/java/android/provider/Settings.java
++++ b/core/java/android/provider/Settings.java
+@@ -17078,6 +17078,12 @@ public final class Settings {
+          */
+         public static final String WIFI_OFF_TIMEOUT = "wifi_off_timeout";
+ 
++        /**
++         * The amount of time in milliseconds before a disconnected Bluetooth adapter is turned off
++         * @hide
++         */
++        public static final String BLUETOOTH_OFF_TIMEOUT = "bluetooth_off_timeout";
++
+         /**
+          * Settings migrated from Wear OS settings provider.
+          * @hide
+diff --git a/services/core/java/com/android/server/ext/BluetoothAutoOff.java b/services/core/java/com/android/server/ext/BluetoothAutoOff.java
+new file mode 100644
+index 000000000000..4e7dbc042f37
+--- /dev/null
++++ b/services/core/java/com/android/server/ext/BluetoothAutoOff.java
+@@ -0,0 +1,69 @@
++package com.android.server.ext;
++
++import android.annotation.Nullable;
++import android.bluetooth.BluetoothAdapter;
++import android.bluetooth.BluetoothManager;
++import android.content.BroadcastReceiver;
++import android.content.Context;
++import android.content.Intent;
++import android.content.IntentFilter;
++import android.os.Build;
++import android.provider.Settings;
++import android.util.Slog;
++
++class BluetoothAutoOff extends DelayedConditionalAction {
++    @Nullable
++    private final BluetoothAdapter adapter;
++
++    BluetoothAutoOff(SystemServerExt sse) {
++        super(sse, sse.bgHandler);
++        adapter = sse.context.getSystemService(BluetoothManager.class).getAdapter();
++    }
++
++    @Override
++    protected boolean shouldScheduleAlarm() {
++        return isAdapterOnAndDisconnected();
++    }
++
++    @Override
++    protected void alarmTriggered() {
++        if (isAdapterOnAndDisconnected()) {
++            adapter.disable();
++        }
++    }
++
++    @Override
++    protected void registerStateListener() {
++        IntentFilter f = new IntentFilter();
++        f.addAction(BluetoothAdapter.ACTION_STATE_CHANGED);
++        f.addAction(BluetoothAdapter.ACTION_CONNECTION_STATE_CHANGED);
++
++        sse.registerReceiver(new BroadcastReceiver() {
++            @Override
++            public void onReceive(Context broadcastContext, Intent intent) {
++                if (Build.isDebuggable()) {
++                    Slog.d("BtAutoOff", "" + intent + ", extras " + intent.getExtras().deepCopy());
++                }
++                update();
++            }
++        }, f, handler);
++    }
++
++    private boolean isAdapterOnAndDisconnected() {
++        if (adapter != null) {
++            int state = adapter.getLeStateSysApi(); // getState() converts BLE states into STATE_OFF
++
++            if (state == BluetoothAdapter.STATE_ON || state == BluetoothAdapter.STATE_BLE_ON) {
++                // getConnectionState() converts BLE states into STATE_DISCONNECTED
++                return adapter.getConnectionStateLeAware() == BluetoothAdapter.STATE_DISCONNECTED;
++            }
++        }
++
++        return false;
++    }
++
++    @Override
++    protected String getDelayGlobalSettingsKey() {
++        return Settings.Global.BLUETOOTH_OFF_TIMEOUT;
++    }
++}
+diff --git a/services/core/java/com/android/server/ext/SystemServerExt.java b/services/core/java/com/android/server/ext/SystemServerExt.java
+index 66350e2b7f74..3c341ed25f4e 100644
+--- a/services/core/java/com/android/server/ext/SystemServerExt.java
++++ b/services/core/java/com/android/server/ext/SystemServerExt.java
+@@ -53,6 +53,10 @@ public final class SystemServerExt {
+         if (packageManager.hasSystemFeature(PackageManager.FEATURE_WIFI, 0)) {
+             new WifiAutoOff(this);
+         }
++
++        if (packageManager.hasSystemFeature(PackageManager.FEATURE_BLUETOOTH, 0)) {
++            new BluetoothAutoOff(this);
++        }
+     }
+ 
+     public void registerReceiver(BroadcastReceiver receiver, IntentFilter filter, Handler handler) {

Patches/LineageOS-20.0/android_frameworks_base/0015-System_Server_Extensions.patch

@@ -0,0 +1,240 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Dmitry Muhomor <muhomor.dmitry@gmail.com>
+Date: Sun, 31 Jul 2022 10:06:14 +0300
+Subject: [PATCH] infrastructure for system_server extensions
+
+---
+ .../server/ext/DelayedConditionalAction.java  | 135 ++++++++++++++++++
+ .../android/server/ext/SystemServerExt.java   |  58 ++++++++
+ .../java/com/android/server/SystemServer.java |   4 +-
+ 3 files changed, 196 insertions(+), 1 deletion(-)
+ create mode 100644 services/core/java/com/android/server/ext/DelayedConditionalAction.java
+ create mode 100644 services/core/java/com/android/server/ext/SystemServerExt.java
+
+diff --git a/services/core/java/com/android/server/ext/DelayedConditionalAction.java b/services/core/java/com/android/server/ext/DelayedConditionalAction.java
+new file mode 100644
+index 000000000000..d72f302e9d42
+--- /dev/null
++++ b/services/core/java/com/android/server/ext/DelayedConditionalAction.java
+@@ -0,0 +1,135 @@
++/*
++ * Copyright (C) 2022 GrapheneOS
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License");
++ * you may not use this file except in compliance with the License.
++ * You may obtain a copy of the License at
++ *
++ *      http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software
++ * distributed under the License is distributed on an "AS IS" BASIS,
++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++ * See the License for the specific language governing permissions and
++ * limitations under the License.
++ */
++
++package com.android.server.ext;
++
++import android.app.AlarmManager;
++import android.content.ContentResolver;
++import android.content.Context;
++import android.database.ContentObserver;
++import android.net.Uri;
++import android.os.Build;
++import android.os.Handler;
++import android.os.Looper;
++import android.os.SystemClock;
++import android.provider.Settings;
++import android.util.Slog;
++
++/**
++ * Infrastructure for actions that:
++ * - happen after a user-configurable device-wide (Settings.Global) delay
++ * - need to be taken even when the device is in deep sleep
++ * - need to be rescheduled based on some listenable event
++ */
++public abstract class DelayedConditionalAction {
++    private static final String TAG = "DelayedConditionalAction";
++
++    protected final SystemServerExt sse;
++    protected final Thread thread;
++    protected final Handler handler;
++
++    protected final ContentResolver contentResolver;
++    protected final AlarmManager alarmManager;
++    private final AlarmManager.OnAlarmListener alarmListener;
++
++    protected DelayedConditionalAction(SystemServerExt sse, Handler handler) {
++        this.sse = sse;
++
++        Looper looper = handler.getLooper();
++        thread = looper.getThread();
++        this.handler = handler;
++
++        if (Build.isDebuggable()) {
++            if (thread != Thread.currentThread()) {
++                throw new IllegalStateException("all calls should happen on the same thread");
++            }
++        }
++
++        Context ctx = sse.context;
++        contentResolver = ctx.getContentResolver();
++        alarmManager = ctx.getSystemService(AlarmManager.class);
++
++        alarmListener = () -> {
++            if (delayDurationMillis() == 0) {
++                return;
++            }
++
++            alarmTriggered();
++        };
++
++        registerStateListener();
++
++        Uri delaySettingUri = Settings.Global.getUriFor(getDelayGlobalSettingsKey());
++
++        ContentObserver delayChangeListener = new ContentObserver(handler) {
++            @Override
++            public void onChange(boolean selfChange) {
++                update();
++            }
++        };
++
++        contentResolver.registerContentObserver(delaySettingUri, false, delayChangeListener);
++    }
++
++    private boolean alarmScheduled;
++
++    protected final void update() {
++        final Thread curThread = Thread.currentThread();
++        if (curThread != thread) {
++            String msg = "update() called on an unknown thread " + curThread;
++            if (Build.isDebuggable()) {
++                throw new IllegalStateException(msg);
++            } else {
++                Slog.e(TAG, msg, new Throwable());
++                return;
++            }
++        }
++
++        if (alarmScheduled) {
++            alarmManager.cancel(alarmListener);
++            alarmScheduled = false;
++        }
++
++        if (!shouldScheduleAlarm()) {
++            return;
++        }
++
++        long delayMillis = delayDurationMillis();
++
++        if (delayMillis == 0) {
++            return;
++        }
++
++        final long triggerAt = SystemClock.elapsedRealtime() + delayMillis;
++        alarmManager.setExact(AlarmManager.ELAPSED_REALTIME_WAKEUP, triggerAt,
++                    getClass().getName(), alarmListener, handler);
++        alarmScheduled = true;
++    }
++
++    private long delayDurationMillis() {
++        return Settings.Global.getLong(contentResolver, getDelayGlobalSettingsKey(), 0);
++    }
++
++    // Make sure to use the same Handler that is used for all other callbacks;
++    // call update() to reschedule / cancel the alarm
++    protected abstract void registerStateListener();
++
++    protected abstract boolean shouldScheduleAlarm();
++    protected abstract void alarmTriggered();
++
++    // android.provider.Settings.Global key
++    protected abstract String getDelayGlobalSettingsKey();
++}
+diff --git a/services/core/java/com/android/server/ext/SystemServerExt.java b/services/core/java/com/android/server/ext/SystemServerExt.java
+new file mode 100644
+index 000000000000..83d895650473
+--- /dev/null
++++ b/services/core/java/com/android/server/ext/SystemServerExt.java
+@@ -0,0 +1,58 @@
++/*
++ * Copyright (C) 2022 GrapheneOS
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License");
++ * you may not use this file except in compliance with the License.
++ * You may obtain a copy of the License at
++ *
++ *      http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software
++ * distributed under the License is distributed on an "AS IS" BASIS,
++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++ * See the License for the specific language governing permissions and
++ * limitations under the License.
++ */
++
++package com.android.server.ext;
++
++import android.content.BroadcastReceiver;
++import android.content.Context;
++import android.content.IntentFilter;
++import android.os.Handler;
++
++import com.android.internal.os.BackgroundThread;
++import com.android.server.pm.PackageManagerService;
++
++public final class SystemServerExt {
++
++    public final Context context;
++    public final Handler bgHandler;
++    public final PackageManagerService packageManager;
++
++    private SystemServerExt(Context systemContext, PackageManagerService pm) {
++        context = systemContext;
++        bgHandler = BackgroundThread.getHandler();
++        packageManager = pm;
++    }
++
++    /*
++     Called after system server has completed its initialization,
++     but before any of the apps are started.
++
++     Call from com.android.server.SystemServer#startOtherServices(), at the end of lambda
++     that is passed into mActivityManagerService.systemReady()
++     */
++    public static void init(Context systemContext, PackageManagerService pm) {
++        SystemServerExt sse = new SystemServerExt(systemContext, pm);
++        sse.bgHandler.post(sse::initBgThread);
++    }
++
++    void initBgThread() {
++
++    }
++
++    public void registerReceiver(BroadcastReceiver receiver, IntentFilter filter, Handler handler) {
++        context.registerReceiver(receiver, filter, null, handler);
++    }
++}
+diff --git a/services/java/com/android/server/SystemServer.java b/services/java/com/android/server/SystemServer.java
+index f1963c99f55e..966c166addef 100644
+--- a/services/java/com/android/server/SystemServer.java
++++ b/services/java/com/android/server/SystemServer.java
+@@ -2230,7 +2230,7 @@ public final class SystemServer implements Dumpable {
+                 Slog.e(TAG, "Failure starting HardwarePropertiesManagerService", e);
+             }
+             t.traceEnd();
+-          
++
+             if (!isWatch) {
+                 t.traceBegin("StartTwilightService");
+                 mSystemServiceManager.startService(TwilightService.class);
+@@ -3069,6 +3069,8 @@ public final class SystemServer implements Dumpable {
+                 reportWtf("Triggering OdsignStatsLogger", e);
+             }
+             t.traceEnd();
++
++            com.android.server.ext.SystemServerExt.init(mSystemContext, mPackageManagerService);
+         }, t);
+ 
+         t.traceBegin("StartSystemUI");

Patches/LineageOS-20.0/android_frameworks_base/0015-WiFi_Timeout.patch

@@ -0,0 +1,128 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Dmitry Muhomor <muhomor.dmitry@gmail.com>
+Date: Sun, 31 Jul 2022 10:06:14 +0300
+Subject: [PATCH] Wi-Fi auto turn off
+
+Co-authored-by: Pratyush <codelab@pratyush.dev>
+---
+ core/java/android/provider/Settings.java      |  6 ++
+ .../android/server/ext/SystemServerExt.java   |  5 +-
+ .../com/android/server/ext/WifiAutoOff.java   | 69 +++++++++++++++++++
+ 3 files changed, 79 insertions(+), 1 deletion(-)
+ create mode 100644 services/core/java/com/android/server/ext/WifiAutoOff.java
+
+diff --git a/core/java/android/provider/Settings.java b/core/java/android/provider/Settings.java
+index c43917955d50..253fec41e120 100644
+--- a/core/java/android/provider/Settings.java
++++ b/core/java/android/provider/Settings.java
+@@ -17072,6 +17072,12 @@ public final class Settings {
+          */
+         public static final String SETTINGS_REBOOT_AFTER_TIMEOUT = "settings_reboot_after_timeout";
+ 
++        /**
++         * The amount of time in milliseconds before a disconnected Wi-Fi adapter is turned off
++         * @hide
++         */
++        public static final String WIFI_OFF_TIMEOUT = "wifi_off_timeout";
++
+         /**
+          * Settings migrated from Wear OS settings provider.
+          * @hide
+diff --git a/services/core/java/com/android/server/ext/SystemServerExt.java b/services/core/java/com/android/server/ext/SystemServerExt.java
+index 83d895650473..66350e2b7f74 100644
+--- a/services/core/java/com/android/server/ext/SystemServerExt.java
++++ b/services/core/java/com/android/server/ext/SystemServerExt.java
+@@ -19,6 +19,7 @@ package com.android.server.ext;
+ import android.content.BroadcastReceiver;
+ import android.content.Context;
+ import android.content.IntentFilter;
++import android.content.pm.PackageManager;
+ import android.os.Handler;
+ 
+ import com.android.internal.os.BackgroundThread;
+@@ -49,7 +50,9 @@ public final class SystemServerExt {
+     }
+ 
+     void initBgThread() {
+-
++        if (packageManager.hasSystemFeature(PackageManager.FEATURE_WIFI, 0)) {
++            new WifiAutoOff(this);
++        }
+     }
+ 
+     public void registerReceiver(BroadcastReceiver receiver, IntentFilter filter, Handler handler) {
+diff --git a/services/core/java/com/android/server/ext/WifiAutoOff.java b/services/core/java/com/android/server/ext/WifiAutoOff.java
+new file mode 100644
+index 000000000000..c7a3c05fe766
+--- /dev/null
++++ b/services/core/java/com/android/server/ext/WifiAutoOff.java
+@@ -0,0 +1,69 @@
++package com.android.server.ext;
++
++import android.content.BroadcastReceiver;
++import android.content.Context;
++import android.content.Intent;
++import android.content.IntentFilter;
++import android.net.wifi.WifiInfo;
++import android.net.wifi.WifiManager;
++import android.os.Build;
++import android.provider.Settings;
++import android.util.Slog;
++
++class WifiAutoOff extends DelayedConditionalAction {
++    private final WifiManager wifiManager;
++
++    WifiAutoOff(SystemServerExt sse) {
++        super(sse, sse.bgHandler);
++        wifiManager = sse.context.getSystemService(WifiManager.class);
++    }
++
++    @Override
++    protected boolean shouldScheduleAlarm() {
++        return isWifiEnabledAndNotConnected();
++    }
++
++    @Override
++    protected void alarmTriggered() {
++        if (isWifiEnabledAndNotConnected()) {
++            wifiManager.setWifiEnabled(false);
++        }
++    }
++
++    private boolean isWifiEnabledAndNotConnected() {
++        if (wifiManager.isWifiEnabled()) {
++            WifiInfo i = wifiManager.getConnectionInfo();
++            if (i == null) {
++                return true;
++            }
++            return i.getBSSID() == null;
++        }
++
++        return false;
++    }
++
++    @Override
++    protected void registerStateListener() {
++        IntentFilter f = new IntentFilter();
++        f.addAction(WifiManager.WIFI_STATE_CHANGED_ACTION);
++        f.addAction(WifiManager.NETWORK_STATE_CHANGED_ACTION);
++        // ConnectivityManager APIs seem unfit for listening to Wi-Fi state specifically, they look
++        // to be higher level than that, eg VPN over Wi-Fi isn't considered to be a Wi-Fi connection
++        // by ConnectivityManager
++
++        sse.registerReceiver(new BroadcastReceiver() {
++            @Override
++            public void onReceive(Context context, Intent intent) {
++                if (Build.isDebuggable()) {
++                    Slog.d("WifiAutoOff", "" + intent + ", extras " + intent.getExtras().deepCopy());
++                }
++                update();
++            }
++        }, f, handler);
++    }
++
++    @Override
++    protected String getDelayGlobalSettingsKey() {
++        return Settings.Global.WIFI_OFF_TIMEOUT;
++    }
++}

Patches/LineageOS-20.0/android_frameworks_base/0017-constify_JNINativeMethod.patch

@@ -0,0 +1,241 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Tue, 16 Aug 2022 16:49:07 -0400
+Subject: [PATCH] constify JNINativeMethod tables
+
+---
+ cmds/hid/jni/com_android_commands_hid_Device.cpp              | 2 +-
+ cmds/uinput/jni/com_android_commands_uinput_Device.cpp        | 2 +-
+ core/jni/LayoutlibLoader.cpp                                  | 2 +-
+ core/jni/android_app_ActivityThread.cpp                       | 2 +-
+ core/jni/android_os_HidlMemory.cpp                            | 2 +-
+ core/jni/android_os_HwBinder.cpp                              | 2 +-
+ core/jni/android_os_HwBlob.cpp                                | 2 +-
+ core/jni/android_os_HwParcel.cpp                              | 2 +-
+ core/jni/android_os_HwRemoteBinder.cpp                        | 2 +-
+ libs/hwui/jni/android_graphics_DisplayListCanvas.cpp          | 2 +-
+ media/jni/android_media_ImageWriter.cpp                       | 4 ++--
+ media/jni/android_media_MediaSync.cpp                         | 2 +-
+ media/jni/soundpool/android_media_SoundPool.cpp               | 2 +-
+ services/core/jni/com_android_server_UsbMidiDevice.cpp        | 2 +-
+ .../com_android_server_companion_virtual_InputController.cpp  | 2 +-
+ services/core/jni/com_android_server_tv_TvUinputBridge.cpp    | 2 +-
+ 16 files changed, 17 insertions(+), 17 deletions(-)
+
+diff --git a/cmds/hid/jni/com_android_commands_hid_Device.cpp b/cmds/hid/jni/com_android_commands_hid_Device.cpp
+index 2cda57dd67e9..7613651e75c4 100644
+--- a/cmds/hid/jni/com_android_commands_hid_Device.cpp
++++ b/cmds/hid/jni/com_android_commands_hid_Device.cpp
+@@ -354,7 +354,7 @@ static void closeDevice(JNIEnv* /* env */, jclass /* clazz */, jlong ptr) {
+     }
+ }
+ 
+-static JNINativeMethod sMethods[] = {
++static const JNINativeMethod sMethods[] = {
+         {"nativeOpenDevice",
+          "(Ljava/lang/String;IIII[B"
+          "Lcom/android/commands/hid/Device$DeviceCallback;)J",
+diff --git a/cmds/uinput/jni/com_android_commands_uinput_Device.cpp b/cmds/uinput/jni/com_android_commands_uinput_Device.cpp
+index 06fa2aac2c7e..4c20055020a4 100644
+--- a/cmds/uinput/jni/com_android_commands_uinput_Device.cpp
++++ b/cmds/uinput/jni/com_android_commands_uinput_Device.cpp
+@@ -301,7 +301,7 @@ static void setAbsInfo(JNIEnv* env, jclass /* clazz */, jint handle, jint axisCo
+     ::ioctl(static_cast<int>(handle), UI_ABS_SETUP, &absSetup);
+ }
+ 
+-static JNINativeMethod sMethods[] = {
++static const JNINativeMethod sMethods[] = {
+         {"nativeOpenUinputDevice",
+          "(Ljava/lang/String;IIIII"
+          "Lcom/android/commands/uinput/Device$DeviceCallback;)J",
+diff --git a/core/jni/LayoutlibLoader.cpp b/core/jni/LayoutlibLoader.cpp
+index 93ba23bfdf84..eac4e807165e 100644
+--- a/core/jni/LayoutlibLoader.cpp
++++ b/core/jni/LayoutlibLoader.cpp
+@@ -68,7 +68,7 @@ static void NativeAllocationRegistry_Delegate_nativeApplyFreeFunction(JNIEnv*, j
+     nativeFreeFunction(nativePtr);
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+         NATIVE_METHOD(NativeAllocationRegistry_Delegate, nativeApplyFreeFunction, "(JJ)V"),
+ };
+ 
+diff --git a/core/jni/android_app_ActivityThread.cpp b/core/jni/android_app_ActivityThread.cpp
+index e25ba76cbbeb..16a8d4656179 100644
+--- a/core/jni/android_app_ActivityThread.cpp
++++ b/core/jni/android_app_ActivityThread.cpp
+@@ -33,7 +33,7 @@ static void android_app_ActivityThread_initZygoteChildHeapProfiling(JNIEnv* env,
+     android_mallopt(M_INIT_ZYGOTE_CHILD_PROFILING, nullptr, 0);
+ }
+ 
+-static JNINativeMethod gActivityThreadMethods[] = {
++static const JNINativeMethod gActivityThreadMethods[] = {
+     // ------------ Regular JNI ------------------
+     { "nPurgePendingResources",        "()V",
+       (void*) android_app_ActivityThread_purgePendingResources },
+diff --git a/core/jni/android_os_HidlMemory.cpp b/core/jni/android_os_HidlMemory.cpp
+index 69e48184c0ad..612fc95776a5 100644
+--- a/core/jni/android_os_HidlMemory.cpp
++++ b/core/jni/android_os_HidlMemory.cpp
+@@ -50,7 +50,7 @@ static void nativeFinalize(JNIEnv* env, jobject jobj) {
+     delete native;
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+         {"nativeFinalize", "()V", (void*) nativeFinalize},
+ };
+ 
+diff --git a/core/jni/android_os_HwBinder.cpp b/core/jni/android_os_HwBinder.cpp
+index 781895eeeaba..cbec79144826 100644
+--- a/core/jni/android_os_HwBinder.cpp
++++ b/core/jni/android_os_HwBinder.cpp
+@@ -352,7 +352,7 @@ static void JHwBinder_report_sysprop_change(JNIEnv * /*env*/, jclass /*clazz*/)
+     report_sysprop_change();
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+     { "native_init", "()J", (void *)JHwBinder_native_init },
+     { "native_setup", "()V", (void *)JHwBinder_native_setup },
+ 
+diff --git a/core/jni/android_os_HwBlob.cpp b/core/jni/android_os_HwBlob.cpp
+index a9db91be1d5b..ba4cf6101449 100644
+--- a/core/jni/android_os_HwBlob.cpp
++++ b/core/jni/android_os_HwBlob.cpp
+@@ -599,7 +599,7 @@ static jlong JHwBlob_native_handle(JNIEnv *env, jobject thiz) {
+     return handle;
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+     { "native_init", "()J", (void *)JHwBlob_native_init },
+     { "native_setup", "(I)V", (void *)JHwBlob_native_setup },
+ 
+diff --git a/core/jni/android_os_HwParcel.cpp b/core/jni/android_os_HwParcel.cpp
+index 4c4443fc29c3..78fd6d90691b 100644
+--- a/core/jni/android_os_HwParcel.cpp
++++ b/core/jni/android_os_HwParcel.cpp
+@@ -1068,7 +1068,7 @@ static void JHwParcel_native_writeBuffer(
+     }
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+     { "native_init", "()J", (void *)JHwParcel_native_init },
+     { "native_setup", "(Z)V", (void *)JHwParcel_native_setup },
+ 
+diff --git a/core/jni/android_os_HwRemoteBinder.cpp b/core/jni/android_os_HwRemoteBinder.cpp
+index d2d7213e5761..497aa193eb4d 100644
+--- a/core/jni/android_os_HwRemoteBinder.cpp
++++ b/core/jni/android_os_HwRemoteBinder.cpp
+@@ -452,7 +452,7 @@ static jint JHwRemoteBinder_hashCode(JNIEnv* env, jobject thiz) {
+     return static_cast<jint>(longHash ^ (longHash >> 32)); // See Long.hashCode()
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+     { "native_init", "()J", (void *)JHwRemoteBinder_native_init },
+ 
+     { "native_setup_empty", "()V",
+diff --git a/libs/hwui/jni/android_graphics_DisplayListCanvas.cpp b/libs/hwui/jni/android_graphics_DisplayListCanvas.cpp
+index f060bb32031a..3ebb3553ce20 100644
+--- a/libs/hwui/jni/android_graphics_DisplayListCanvas.cpp
++++ b/libs/hwui/jni/android_graphics_DisplayListCanvas.cpp
+@@ -174,7 +174,7 @@ static void android_view_DisplayListCanvas_drawWebViewFunctor(CRITICAL_JNI_PARAM
+ 
+ const char* const kClassPathName = "android/graphics/RecordingCanvas";
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+         // ------------ @CriticalNative --------------
+         {"nCreateDisplayListCanvas", "(JII)J",
+          (void*)android_view_DisplayListCanvas_createDisplayListCanvas},
+diff --git a/media/jni/android_media_ImageWriter.cpp b/media/jni/android_media_ImageWriter.cpp
+index 6c6fccb59216..21067698888d 100644
+--- a/media/jni/android_media_ImageWriter.cpp
++++ b/media/jni/android_media_ImageWriter.cpp
+@@ -1101,7 +1101,7 @@ static jobjectArray Image_createSurfacePlanes(JNIEnv* env, jobject thiz,
+ 
+ // ----------------------------------------------------------------------------
+ 
+-static JNINativeMethod gImageWriterMethods[] = {
++static const JNINativeMethod gImageWriterMethods[] = {
+     {"nativeClassInit",         "()V",                        (void*)ImageWriter_classInit },
+     {"nativeInit",              "(Ljava/lang/Object;Landroid/view/Surface;IIIZIIJ)J",
+                                                               (void*)ImageWriter_init },
+@@ -1118,7 +1118,7 @@ static JNINativeMethod gImageWriterMethods[] = {
+     {"cancelImage",             "(JLandroid/media/Image;)V",   (void*)ImageWriter_cancelImage },
+ };
+ 
+-static JNINativeMethod gImageMethods[] = {
++static const JNINativeMethod gImageMethods[] = {
+     {"nativeCreatePlanes",      "(III)[Landroid/media/ImageWriter$WriterSurfaceImage$SurfacePlane;",
+                                                                (void*)Image_createSurfacePlanes },
+     {"nativeGetWidth",          "()I",                         (void*)Image_getWidth },
+diff --git a/media/jni/android_media_MediaSync.cpp b/media/jni/android_media_MediaSync.cpp
+index d1ce30a3e827..d93bda166c44 100644
+--- a/media/jni/android_media_MediaSync.cpp
++++ b/media/jni/android_media_MediaSync.cpp
+@@ -514,7 +514,7 @@ static void android_media_MediaSync_native_finalize(JNIEnv *env, jobject thiz) {
+     android_media_MediaSync_release(env, thiz);
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+     { "native_setSurface",
+       "(Landroid/view/Surface;)V",
+       (void *)android_media_MediaSync_native_setSurface },
+diff --git a/media/jni/soundpool/android_media_SoundPool.cpp b/media/jni/soundpool/android_media_SoundPool.cpp
+index 5264772be7c3..aa079ca33790 100644
+--- a/media/jni/soundpool/android_media_SoundPool.cpp
++++ b/media/jni/soundpool/android_media_SoundPool.cpp
+@@ -553,7 +553,7 @@ android_media_SoundPool_release(JNIEnv *env, jobject thiz)
+ // ----------------------------------------------------------------------------
+ 
+ // Dalvik VM type signatures
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+     {   "_load",
+         "(Ljava/io/FileDescriptor;JJI)I",
+         (void *)android_media_SoundPool_load_FD
+diff --git a/services/core/jni/com_android_server_UsbMidiDevice.cpp b/services/core/jni/com_android_server_UsbMidiDevice.cpp
+index c8e769878b8c..ab09e4b10cb9 100644
+--- a/services/core/jni/com_android_server_UsbMidiDevice.cpp
++++ b/services/core/jni/com_android_server_UsbMidiDevice.cpp
+@@ -142,7 +142,7 @@ android_server_UsbMidiDevice_close(JNIEnv *env, jobject thiz, jobjectArray fds)
+     }
+ }
+ 
+-static JNINativeMethod method_table[] = {
++static const JNINativeMethod method_table[] = {
+         {"nativeOpen", "(IIII)[Ljava/io/FileDescriptor;",
+          (void *)android_server_UsbMidiDevice_open},
+         {"nativeClose", "([Ljava/io/FileDescriptor;)V", (void *)android_server_UsbMidiDevice_close},
+diff --git a/services/core/jni/com_android_server_companion_virtual_InputController.cpp b/services/core/jni/com_android_server_companion_virtual_InputController.cpp
+index daca1531d41f..4cfde792e625 100644
+--- a/services/core/jni/com_android_server_companion_virtual_InputController.cpp
++++ b/services/core/jni/com_android_server_companion_virtual_InputController.cpp
+@@ -460,7 +460,7 @@ static bool nativeWriteScrollEvent(JNIEnv* env, jobject thiz, jint fd, jfloat xA
+             writeInputEvent(fd, EV_SYN, SYN_REPORT, 0);
+ }
+ 
+-static JNINativeMethod methods[] = {
++static const JNINativeMethod methods[] = {
+         {"nativeOpenUinputKeyboard", "(Ljava/lang/String;IILjava/lang/String;)I",
+          (void*)nativeOpenUinputKeyboard},
+         {"nativeOpenUinputMouse", "(Ljava/lang/String;IILjava/lang/String;)I",
+diff --git a/services/core/jni/com_android_server_tv_TvUinputBridge.cpp b/services/core/jni/com_android_server_tv_TvUinputBridge.cpp
+index 99deab4fd652..2cb1aaef13fa 100644
+--- a/services/core/jni/com_android_server_tv_TvUinputBridge.cpp
++++ b/services/core/jni/com_android_server_tv_TvUinputBridge.cpp
+@@ -534,7 +534,7 @@ static void nativeClear(JNIEnv* env, jclass clazz, jlong ptr) {
+  * JNI registration
+  */
+ 
+-static JNINativeMethod gUinputBridgeMethods[] = {
++static const JNINativeMethod gUinputBridgeMethods[] = {
+         {"nativeOpen", "(Ljava/lang/String;Ljava/lang/String;III)J", (void*)nativeOpen},
+         {"nativeGamepadOpen", "(Ljava/lang/String;Ljava/lang/String;)J", (void*)nativeGamepadOpen},
+         {"nativeClose", "(J)V", (void*)nativeClose},

Patches/LineageOS-20.0/android_frameworks_base/0018-Exec_Based_Spawning-1.patch

@@ -0,0 +1,181 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Sat, 14 Mar 2015 18:10:20 -0400
+Subject: [PATCH] add exec-based spawning support
+
+---
+ .../com/android/internal/os/ExecInit.java     | 115 ++++++++++++++++++
+ .../com/android/internal/os/WrapperInit.java  |   2 +-
+ .../android/internal/os/ZygoteConnection.java |  10 +-
+ 3 files changed, 125 insertions(+), 2 deletions(-)
+ create mode 100644 core/java/com/android/internal/os/ExecInit.java
+
+diff --git a/core/java/com/android/internal/os/ExecInit.java b/core/java/com/android/internal/os/ExecInit.java
+new file mode 100644
+index 000000000000..2adcab7fdbe6
+--- /dev/null
++++ b/core/java/com/android/internal/os/ExecInit.java
+@@ -0,0 +1,115 @@
++package com.android.internal.os;
++
++import android.os.Trace;
++import android.system.ErrnoException;
++import android.system.Os;
++import android.util.Slog;
++import android.util.TimingsTraceLog;
++import dalvik.system.VMRuntime;
++
++/**
++ * Startup class for the process.
++ * @hide
++ */
++public class ExecInit {
++    /**
++     * Class not instantiable.
++     */
++    private ExecInit() {
++    }
++
++    /**
++     * The main function called when starting a runtime application.
++     *
++     * The first argument is the target SDK version for the app.
++     *
++     * The remaining arguments are passed to the runtime.
++     *
++     * @param args The command-line arguments.
++     */
++    public static void main(String[] args) {
++        // Parse our mandatory argument.
++        int targetSdkVersion = Integer.parseInt(args[0], 10);
++
++        // Mimic system Zygote preloading.
++        ZygoteInit.preload(new TimingsTraceLog("ExecInitTiming",
++                Trace.TRACE_TAG_DALVIK));
++
++        // Launch the application.
++        String[] runtimeArgs = new String[args.length - 1];
++        System.arraycopy(args, 1, runtimeArgs, 0, runtimeArgs.length);
++        Runnable r = execInit(targetSdkVersion, runtimeArgs);
++
++        r.run();
++    }
++
++    /**
++     * Executes a runtime application with exec-based spawning.
++     * This method never returns.
++     *
++     * @param niceName The nice name for the application, or null if none.
++     * @param targetSdkVersion The target SDK version for the app.
++     * @param args Arguments for {@link RuntimeInit#main}.
++     */
++    public static void execApplication(String niceName, int targetSdkVersion,
++            String instructionSet, String[] args) {
++        int niceArgs = niceName == null ? 0 : 1;
++        int baseArgs = 5 + niceArgs;
++        String[] argv = new String[baseArgs + args.length];
++        if (VMRuntime.is64BitInstructionSet(instructionSet)) {
++            argv[0] = "/system/bin/app_process64";
++        } else {
++            argv[0] = "/system/bin/app_process32";
++        }
++        argv[1] = "/system/bin";
++        argv[2] = "--application";
++        if (niceName != null) {
++            argv[3] = "--nice-name=" + niceName;
++        }
++        argv[3 + niceArgs] = "com.android.internal.os.ExecInit";
++        argv[4 + niceArgs] = Integer.toString(targetSdkVersion);
++        System.arraycopy(args, 0, argv, baseArgs, args.length);
++
++        WrapperInit.preserveCapabilities();
++        try {
++            Os.execv(argv[0], argv);
++        } catch (ErrnoException e) {
++            throw new RuntimeException(e);
++        }
++    }
++
++    /**
++     * The main function called when an application is started with exec-based spawning.
++     *
++     * When the app starts, the runtime starts {@link RuntimeInit#main}
++     * which calls {@link main} which then calls this method.
++     * So we don't need to call commonInit() here.
++     *
++     * @param targetSdkVersion target SDK version
++     * @param argv arg strings
++     */
++    private static Runnable execInit(int targetSdkVersion, String[] argv) {
++        if (RuntimeInit.DEBUG) {
++            Slog.d(RuntimeInit.TAG, "RuntimeInit: Starting application from exec");
++        }
++
++        // Check whether the first argument is a "-cp" in argv, and assume the next argument is the
++        // classpath. If found, create a PathClassLoader and use it for applicationInit.
++        ClassLoader classLoader = null;
++        if (argv != null && argv.length > 2 && argv[0].equals("-cp")) {
++            classLoader = ZygoteInit.createPathClassLoader(argv[1], targetSdkVersion);
++
++            // Install this classloader as the context classloader, too.
++            Thread.currentThread().setContextClassLoader(classLoader);
++
++            // Remove the classpath from the arguments.
++            String removedArgs[] = new String[argv.length - 2];
++            System.arraycopy(argv, 2, removedArgs, 0, argv.length - 2);
++            argv = removedArgs;
++        }
++
++        // Perform the same initialization that would happen after the Zygote forks.
++        Zygote.nativePreApplicationInit();
++        return RuntimeInit.applicationInit(targetSdkVersion, /*disabledCompatChanges*/ null, argv, classLoader);
++    }
++}
+diff --git a/core/java/com/android/internal/os/WrapperInit.java b/core/java/com/android/internal/os/WrapperInit.java
+index 6860759eea8a..a2eef62f80be 100644
+--- a/core/java/com/android/internal/os/WrapperInit.java
++++ b/core/java/com/android/internal/os/WrapperInit.java
+@@ -186,7 +186,7 @@ public class WrapperInit {
+      *       This is acceptable here as failure will leave the wrapped app with strictly less
+      *       capabilities, which may make it crash, but not exceed its allowances.
+      */
+-    private static void preserveCapabilities() {
++    public static void preserveCapabilities() {
+         StructCapUserHeader header = new StructCapUserHeader(
+                 OsConstants._LINUX_CAPABILITY_VERSION_3, 0);
+         StructCapUserData[] data;
+diff --git a/core/java/com/android/internal/os/ZygoteConnection.java b/core/java/com/android/internal/os/ZygoteConnection.java
+index 993e4e7b4b3d..756547706f60 100644
+--- a/core/java/com/android/internal/os/ZygoteConnection.java
++++ b/core/java/com/android/internal/os/ZygoteConnection.java
+@@ -29,6 +29,7 @@ import android.net.Credentials;
+ import android.net.LocalSocket;
+ import android.os.Parcel;
+ import android.os.Process;
++import android.os.SystemProperties;
+ import android.os.Trace;
+ import android.system.ErrnoException;
+ import android.system.Os;
+@@ -247,7 +248,7 @@ class ZygoteConnection {
+                     fdsToClose[1] = zygoteFd.getInt$();
+                 }
+ 
+-                if (parsedArgs.mInvokeWith != null || parsedArgs.mStartChildZygote
++                if (parsedArgs.mInvokeWith != null || SystemProperties.getBoolean("sys.spawn.exec", true) || parsedArgs.mStartChildZygote
+                         || !multipleOK || peer.getUid() != Process.SYSTEM_UID) {
+                     // Continue using old code for now. TODO: Handle these cases in the other path.
+                     pid = Zygote.forkAndSpecialize(parsedArgs.mUid, parsedArgs.mGid,
+@@ -535,6 +536,13 @@ class ZygoteConnection {
+             throw new IllegalStateException("WrapperInit.execApplication unexpectedly returned");
+         } else {
+             if (!isZygote) {
++                if (SystemProperties.getBoolean("sys.spawn.exec", true)) {
++                    ExecInit.execApplication(parsedArgs.mNiceName, parsedArgs.mTargetSdkVersion,
++                            VMRuntime.getCurrentInstructionSet(), parsedArgs.mRemainingArgs);
++
++                    // Should not get here.
++                    throw new IllegalStateException("ExecInit.execApplication unexpectedly returned");
++                }
+                 return ZygoteInit.zygoteInit(parsedArgs.mTargetSdkVersion,
+                         parsedArgs.mDisabledCompatChanges,
+                         parsedArgs.mRemainingArgs, null /* classLoader */);

Patches/LineageOS-20.0/android_frameworks_base/0018-Exec_Based_Spawning-10.patch

@@ -0,0 +1,28 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Wed, 11 Sep 2019 06:57:24 -0400
+Subject: [PATCH] disable preloading classloaders for exec spawning
+
+---
+ core/java/com/android/internal/os/ZygoteInit.java | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/core/java/com/android/internal/os/ZygoteInit.java b/core/java/com/android/internal/os/ZygoteInit.java
+index 7d19700afef4..9dbc05ddac72 100644
+--- a/core/java/com/android/internal/os/ZygoteInit.java
++++ b/core/java/com/android/internal/os/ZygoteInit.java
+@@ -141,9 +141,11 @@ public class ZygoteInit {
+             preloadClasses();
+             bootTimingsTraceLog.traceEnd(); // PreloadClasses
+         }
+-        bootTimingsTraceLog.traceBegin("CacheNonBootClasspathClassLoaders");
+-        cacheNonBootClasspathClassLoaders();
+-        bootTimingsTraceLog.traceEnd(); // CacheNonBootClasspathClassLoaders
++        if (fullPreload) {
++            bootTimingsTraceLog.traceBegin("CacheNonBootClasspathClassLoaders");
++            cacheNonBootClasspathClassLoaders();
++            bootTimingsTraceLog.traceEnd(); // CacheNonBootClasspathClassLoaders
++        }
+         if (fullPreload) {
+             bootTimingsTraceLog.traceBegin("PreloadResources");
+             preloadResources();

Patches/LineageOS-20.0/android_frameworks_base/0018-Exec_Based_Spawning-11.patch

@@ -0,0 +1,28 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Wed, 11 Sep 2019 06:58:51 -0400
+Subject: [PATCH] disable preloading HALs for exec spawning
+
+---
+ core/java/com/android/internal/os/ZygoteInit.java | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/core/java/com/android/internal/os/ZygoteInit.java b/core/java/com/android/internal/os/ZygoteInit.java
+index 9dbc05ddac72..083734b2b816 100644
+--- a/core/java/com/android/internal/os/ZygoteInit.java
++++ b/core/java/com/android/internal/os/ZygoteInit.java
+@@ -151,9 +151,11 @@ public class ZygoteInit {
+             preloadResources();
+             bootTimingsTraceLog.traceEnd(); // PreloadResources
+         }
+-        Trace.traceBegin(Trace.TRACE_TAG_DALVIK, "PreloadAppProcessHALs");
+-        nativePreloadAppProcessHALs();
+-        Trace.traceEnd(Trace.TRACE_TAG_DALVIK);
++        if (fullPreload) {
++            Trace.traceBegin(Trace.TRACE_TAG_DALVIK, "PreloadAppProcessHALs");
++            nativePreloadAppProcessHALs();
++            Trace.traceEnd(Trace.TRACE_TAG_DALVIK);
++        }
+         Trace.traceBegin(Trace.TRACE_TAG_DALVIK, "PreloadGraphicsDriver");
+         maybePreloadGraphicsDriver();
+         Trace.traceEnd(Trace.TRACE_TAG_DALVIK);

Patches/LineageOS-20.0/android_frameworks_base/0018-Exec_Based_Spawning-12.patch

@@ -0,0 +1,273 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: anupritaisno1 <www.anuprita804@gmail.com>
+Date: Sat, 31 Oct 2020 00:26:09 +0200
+Subject: [PATCH] pass through runtime flags for exec spawning and implement
+ them in the child
+
+Signed-off-by: anupritaisno1 <www.anuprita804@gmail.com>
+---
+ .../com/android/internal/os/ExecInit.java     |  14 +-
+ core/java/com/android/internal/os/Zygote.java |   9 ++
+ .../android/internal/os/ZygoteConnection.java |   2 +-
+ core/jni/com_android_internal_os_Zygote.cpp   | 148 ++++++++++--------
+ 4 files changed, 101 insertions(+), 72 deletions(-)
+
+diff --git a/core/java/com/android/internal/os/ExecInit.java b/core/java/com/android/internal/os/ExecInit.java
+index 830e5b562a91..749c67abf389 100644
+--- a/core/java/com/android/internal/os/ExecInit.java
++++ b/core/java/com/android/internal/os/ExecInit.java
+@@ -31,15 +31,20 @@ public class ExecInit {
+         // Parse our mandatory argument.
+         int targetSdkVersion = Integer.parseInt(args[0], 10);
+ 
++        // Parse the runtime_flags.
++        int runtimeFlags = Integer.parseInt(args[1], 10);
++
+         // Mimic system Zygote preloading.
+         ZygoteInit.preload(new TimingsTraceLog("ExecInitTiming",
+                 Trace.TRACE_TAG_DALVIK), false);
+ 
+         // Launch the application.
+-        String[] runtimeArgs = new String[args.length - 1];
+-        System.arraycopy(args, 1, runtimeArgs, 0, runtimeArgs.length);
++        String[] runtimeArgs = new String[args.length - 2];
++        System.arraycopy(args, 2, runtimeArgs, 0, runtimeArgs.length);
+         Runnable r = execInit(targetSdkVersion, runtimeArgs);
+ 
++        Zygote.nativeHandleRuntimeFlags(runtimeFlags);
++
+         r.run();
+     }
+ 
+@@ -52,9 +57,9 @@ public class ExecInit {
+      * @param args Arguments for {@link RuntimeInit#main}.
+      */
+     public static void execApplication(String niceName, int targetSdkVersion,
+-            String instructionSet, String[] args) {
++            String instructionSet, int runtimeFlags, String[] args) {
+         int niceArgs = niceName == null ? 0 : 1;
+-        int baseArgs = 5 + niceArgs;
++        int baseArgs = 6 + niceArgs;
+         String[] argv = new String[baseArgs + args.length];
+         if (VMRuntime.is64BitInstructionSet(instructionSet)) {
+             argv[0] = "/system/bin/app_process64";
+@@ -68,6 +73,7 @@ public class ExecInit {
+         }
+         argv[3 + niceArgs] = "com.android.internal.os.ExecInit";
+         argv[4 + niceArgs] = Integer.toString(targetSdkVersion);
++        argv[5 + niceArgs] = Integer.toString(runtimeFlags);
+         System.arraycopy(args, 0, argv, baseArgs, args.length);
+ 
+         WrapperInit.preserveCapabilities();
+diff --git a/core/java/com/android/internal/os/Zygote.java b/core/java/com/android/internal/os/Zygote.java
+index b1e7d15cbf4a..96b56f7bd1d6 100644
+--- a/core/java/com/android/internal/os/Zygote.java
++++ b/core/java/com/android/internal/os/Zygote.java
+@@ -1425,4 +1425,13 @@ public final class Zygote {
+         }
+         return runtimeFlags;
+     }
++
++    /**
++     * Used on GrapheneOS to set up runtime flags
++     *
++     * @param runtimeFlags flags to be passed to the native method
++     *
++     * @hide
++     */
++    public static native void nativeHandleRuntimeFlags(int runtimeFlags);
+ }
+diff --git a/core/java/com/android/internal/os/ZygoteConnection.java b/core/java/com/android/internal/os/ZygoteConnection.java
+index 27518dd4cdce..a8d9400c7992 100644
+--- a/core/java/com/android/internal/os/ZygoteConnection.java
++++ b/core/java/com/android/internal/os/ZygoteConnection.java
+@@ -539,7 +539,7 @@ class ZygoteConnection {
+                 if (SystemProperties.getBoolean("sys.spawn.exec", true) &&
+                         (parsedArgs.mRuntimeFlags & ApplicationInfo.FLAG_DEBUGGABLE) == 0) {
+                     ExecInit.execApplication(parsedArgs.mNiceName, parsedArgs.mTargetSdkVersion,
+-                            VMRuntime.getCurrentInstructionSet(), parsedArgs.mRemainingArgs);
++                            VMRuntime.getCurrentInstructionSet(), parsedArgs.mRuntimeFlags, parsedArgs.mRemainingArgs);
+ 
+                     // Should not get here.
+                     throw new IllegalStateException("ExecInit.execApplication unexpectedly returned");
+diff --git a/core/jni/com_android_internal_os_Zygote.cpp b/core/jni/com_android_internal_os_Zygote.cpp
+index 21bbac0b0a7d..a7e4ea1624e6 100644
+--- a/core/jni/com_android_internal_os_Zygote.cpp
++++ b/core/jni/com_android_internal_os_Zygote.cpp
+@@ -1540,6 +1540,80 @@ static void BindMountStorageDirs(JNIEnv* env, jobjectArray pkg_data_info_list,
+   }
+ }
+ 
++static void HandleRuntimeFlags(JNIEnv* env, jint& runtime_flags, const char* process_name, const char* nice_name_ptr) {
++    // Set process properties to enable debugging if required.
++    if ((runtime_flags & RuntimeFlags::DEBUG_ENABLE_JDWP) != 0) {
++        EnableDebugger();
++    }
++    if ((runtime_flags & RuntimeFlags::PROFILE_FROM_SHELL) != 0) {
++        // simpleperf needs the process to be dumpable to profile it.
++        if (prctl(PR_SET_DUMPABLE, 1, 0, 0, 0) == -1) {
++            ALOGE("prctl(PR_SET_DUMPABLE) failed: %s", strerror(errno));
++            RuntimeAbort(env, __LINE__, "prctl(PR_SET_DUMPABLE, 1) failed");
++        }
++    }
++
++    HeapTaggingLevel heap_tagging_level;
++    switch (runtime_flags & RuntimeFlags::MEMORY_TAG_LEVEL_MASK) {
++        case RuntimeFlags::MEMORY_TAG_LEVEL_TBI:
++            heap_tagging_level = M_HEAP_TAGGING_LEVEL_TBI;
++            break;
++        case RuntimeFlags::MEMORY_TAG_LEVEL_ASYNC:
++            heap_tagging_level = M_HEAP_TAGGING_LEVEL_ASYNC;
++            break;
++        case RuntimeFlags::MEMORY_TAG_LEVEL_SYNC:
++            heap_tagging_level = M_HEAP_TAGGING_LEVEL_SYNC;
++            break;
++        default:
++            heap_tagging_level = M_HEAP_TAGGING_LEVEL_NONE;
++            break;
++    }
++    mallopt(M_BIONIC_SET_HEAP_TAGGING_LEVEL, heap_tagging_level);
++
++    // Now that we've used the flag, clear it so that we don't pass unknown flags to the ART
++    // runtime.
++    runtime_flags &= ~RuntimeFlags::MEMORY_TAG_LEVEL_MASK;
++
++    // Avoid heap zero initialization for applications without MTE. Zero init may
++    // cause app compat problems, use more memory, or reduce performance. While it
++    // would be nice to have them for apps, we will have to wait until they are
++    // proven out, have more efficient hardware, and/or apply them only to new
++    // applications.
++    if (!(runtime_flags & RuntimeFlags::NATIVE_HEAP_ZERO_INIT_ENABLED)) {
++        mallopt(M_BIONIC_ZERO_INIT, 0);
++    }
++
++    // Now that we've used the flag, clear it so that we don't pass unknown flags to the ART
++    // runtime.
++    runtime_flags &= ~RuntimeFlags::NATIVE_HEAP_ZERO_INIT_ENABLED;
++
++    if (process_name == nullptr) {
++        process_name = "zygote";
++    }
++
++    android_mallopt_gwp_asan_options_t gwp_asan_options;
++    // The system server doesn't have its nice name set by the time SpecializeCommon is called.
++    gwp_asan_options.program_name = nice_name_ptr ?: process_name;
++    switch (runtime_flags & RuntimeFlags::GWP_ASAN_LEVEL_MASK) {
++        default:
++        case RuntimeFlags::GWP_ASAN_LEVEL_NEVER:
++            gwp_asan_options.desire = Action::DONT_TURN_ON_UNLESS_OVERRIDDEN;
++            android_mallopt(M_INITIALIZE_GWP_ASAN, &gwp_asan_options, sizeof(gwp_asan_options));
++            break;
++        case RuntimeFlags::GWP_ASAN_LEVEL_ALWAYS:
++            gwp_asan_options.desire = Action::TURN_ON_FOR_APP;
++            android_mallopt(M_INITIALIZE_GWP_ASAN, &gwp_asan_options, sizeof(gwp_asan_options));
++            break;
++        case RuntimeFlags::GWP_ASAN_LEVEL_LOTTERY:
++            gwp_asan_options.desire = Action::TURN_ON_WITH_SAMPLING;
++            android_mallopt(M_INITIALIZE_GWP_ASAN, &gwp_asan_options, sizeof(gwp_asan_options));
++            break;
++    }
++    // Now that we've used the flag, clear it so that we don't pass unknown flags to the ART
++    // runtime.
++    runtime_flags &= ~RuntimeFlags::GWP_ASAN_LEVEL_MASK;
++}
++
+ // Utility routine to specialize a zygote child process.
+ static void SpecializeCommon(JNIEnv* env, uid_t uid, gid_t gid, jintArray gids, jint runtime_flags,
+                              jobjectArray rlimits, jlong permitted_capabilities,
+@@ -1673,74 +1747,9 @@ static void SpecializeCommon(JNIEnv* env, uid_t uid, gid_t gid, jintArray gids,
+         }
+     }
+ 
+-    // Set process properties to enable debugging if required.
+-    if ((runtime_flags & RuntimeFlags::DEBUG_ENABLE_JDWP) != 0) {
+-        EnableDebugger();
+-    }
+-    if ((runtime_flags & RuntimeFlags::PROFILE_FROM_SHELL) != 0) {
+-        // simpleperf needs the process to be dumpable to profile it.
+-        if (prctl(PR_SET_DUMPABLE, 1, 0, 0, 0) == -1) {
+-            ALOGE("prctl(PR_SET_DUMPABLE) failed: %s", strerror(errno));
+-            RuntimeAbort(env, __LINE__, "prctl(PR_SET_DUMPABLE, 1) failed");
+-        }
+-    }
+-
+-    HeapTaggingLevel heap_tagging_level;
+-    switch (runtime_flags & RuntimeFlags::MEMORY_TAG_LEVEL_MASK) {
+-        case RuntimeFlags::MEMORY_TAG_LEVEL_TBI:
+-            heap_tagging_level = M_HEAP_TAGGING_LEVEL_TBI;
+-            break;
+-        case RuntimeFlags::MEMORY_TAG_LEVEL_ASYNC:
+-            heap_tagging_level = M_HEAP_TAGGING_LEVEL_ASYNC;
+-            break;
+-        case RuntimeFlags::MEMORY_TAG_LEVEL_SYNC:
+-            heap_tagging_level = M_HEAP_TAGGING_LEVEL_SYNC;
+-            break;
+-        default:
+-            heap_tagging_level = M_HEAP_TAGGING_LEVEL_NONE;
+-            break;
+-    }
+-    mallopt(M_BIONIC_SET_HEAP_TAGGING_LEVEL, heap_tagging_level);
+-
+-    // Now that we've used the flag, clear it so that we don't pass unknown flags to the ART
+-    // runtime.
+-    runtime_flags &= ~RuntimeFlags::MEMORY_TAG_LEVEL_MASK;
+-
+-    // Avoid heap zero initialization for applications without MTE. Zero init may
+-    // cause app compat problems, use more memory, or reduce performance. While it
+-    // would be nice to have them for apps, we will have to wait until they are
+-    // proven out, have more efficient hardware, and/or apply them only to new
+-    // applications.
+-    if (!(runtime_flags & RuntimeFlags::NATIVE_HEAP_ZERO_INIT_ENABLED)) {
+-        mallopt(M_BIONIC_ZERO_INIT, 0);
+-    }
+-
+-    // Now that we've used the flag, clear it so that we don't pass unknown flags to the ART
+-    // runtime.
+-    runtime_flags &= ~RuntimeFlags::NATIVE_HEAP_ZERO_INIT_ENABLED;
+-
+     const char* nice_name_ptr = nice_name.has_value() ? nice_name.value().c_str() : nullptr;
+-    android_mallopt_gwp_asan_options_t gwp_asan_options;
+-    // The system server doesn't have its nice name set by the time SpecializeCommon is called.
+-    gwp_asan_options.program_name = nice_name_ptr ?: process_name;
+-    switch (runtime_flags & RuntimeFlags::GWP_ASAN_LEVEL_MASK) {
+-        default:
+-        case RuntimeFlags::GWP_ASAN_LEVEL_NEVER:
+-            gwp_asan_options.desire = Action::DONT_TURN_ON_UNLESS_OVERRIDDEN;
+-            android_mallopt(M_INITIALIZE_GWP_ASAN, &gwp_asan_options, sizeof(gwp_asan_options));
+-            break;
+-        case RuntimeFlags::GWP_ASAN_LEVEL_ALWAYS:
+-            gwp_asan_options.desire = Action::TURN_ON_FOR_APP;
+-            android_mallopt(M_INITIALIZE_GWP_ASAN, &gwp_asan_options, sizeof(gwp_asan_options));
+-            break;
+-        case RuntimeFlags::GWP_ASAN_LEVEL_LOTTERY:
+-            gwp_asan_options.desire = Action::TURN_ON_WITH_SAMPLING;
+-            android_mallopt(M_INITIALIZE_GWP_ASAN, &gwp_asan_options, sizeof(gwp_asan_options));
+-            break;
+-    }
+-    // Now that we've used the flag, clear it so that we don't pass unknown flags to the ART
+-    // runtime.
+-    runtime_flags &= ~RuntimeFlags::GWP_ASAN_LEVEL_MASK;
++
++    HandleRuntimeFlags(env, runtime_flags, process_name, nice_name_ptr);
+ 
+     SetCapabilities(permitted_capabilities, effective_capabilities, permitted_capabilities,
+                     fail_fn);
+@@ -2634,6 +2643,10 @@ static void com_android_internal_os_Zygote_nativeAllowFilesOpenedByPreload(JNIEn
+     gPreloadFdsExtracted = true;
+ }
+ 
++static void nativeHandleRuntimeFlagsWrapper(JNIEnv* env, jclass, jint runtime_flags) {
++    HandleRuntimeFlags(env, runtime_flags, nullptr, nullptr);
++}
++
+ static const JNINativeMethod gMethods[] = {
+         {"nativeForkAndSpecialize",
+          "(II[II[[IILjava/lang/String;Ljava/lang/String;[I[IZLjava/lang/String;Ljava/lang/"
+@@ -2686,6 +2699,7 @@ static const JNINativeMethod gMethods[] = {
+          (void*)com_android_internal_os_Zygote_nativeMarkOpenedFilesBeforePreload},
+         {"nativeAllowFilesOpenedByPreload", "()V",
+          (void*)com_android_internal_os_Zygote_nativeAllowFilesOpenedByPreload},
++        {"nativeHandleRuntimeFlags", "(I)V", (void*)nativeHandleRuntimeFlagsWrapper},
+ };
+ 
+ int register_com_android_internal_os_Zygote(JNIEnv* env) {

Patches/LineageOS-20.0/android_frameworks_base/0018-Exec_Based_Spawning-13.patch

@@ -0,0 +1,34 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Dmitry Muhomor <muhomor.dmitry@gmail.com>
+Date: Mon, 8 Aug 2022 18:42:19 +0300
+Subject: [PATCH] exec spawning: don't close the binder connection when the app
+ crashes
+
+When an unhandled exception occured, binder connections were closed with
+IPCThreadState::stopProcess() before the invocation of java.lang.Thread#dispatchUncaughtException().
+By default, that method tries to report the crash via ActivityManager#handleApplicationCrash(),
+which always failed due to the closed binder connection.
+This meant that the crash dialog was never shown and additional crash handling was skipped.
+
+Zygote-based spawning never calls IPCThreadState::stopProcess().
+---
+ cmds/app_process/app_main.cpp | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/cmds/app_process/app_main.cpp b/cmds/app_process/app_main.cpp
+index 12083b6fe20b..4ca8b1e18431 100644
+--- a/cmds/app_process/app_main.cpp
++++ b/cmds/app_process/app_main.cpp
+@@ -85,8 +85,10 @@ public:
+         AndroidRuntime* ar = AndroidRuntime::getRuntime();
+         ar->callMain(mClassName, mClass, mArgs);
+ 
+-        IPCThreadState::self()->stopProcess();
+-        hardware::IPCThreadState::self()->stopProcess();
++        if (mClassName != "com.android.internal.os.ExecInit") {
++            IPCThreadState::self()->stopProcess();
++            hardware::IPCThreadState::self()->stopProcess();
++        }
+     }
+ 
+     virtual void onZygoteInit()

Patches/LineageOS-20.0/android_frameworks_base/0018-Exec_Based_Spawning-2.patch

@@ -0,0 +1,25 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Tue, 21 May 2019 23:54:20 -0400
+Subject: [PATCH] disable exec spawning when using debugging options
+
+The debugging options are not yet supported probably, so disable exec
+spawning when doing debugging.
+---
+ core/java/com/android/internal/os/ZygoteConnection.java | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/core/java/com/android/internal/os/ZygoteConnection.java b/core/java/com/android/internal/os/ZygoteConnection.java
+index 756547706f60..27518dd4cdce 100644
+--- a/core/java/com/android/internal/os/ZygoteConnection.java
++++ b/core/java/com/android/internal/os/ZygoteConnection.java
+@@ -536,7 +536,8 @@ class ZygoteConnection {
+             throw new IllegalStateException("WrapperInit.execApplication unexpectedly returned");
+         } else {
+             if (!isZygote) {
+-                if (SystemProperties.getBoolean("sys.spawn.exec", true)) {
++                if (SystemProperties.getBoolean("sys.spawn.exec", true) &&
++                        (parsedArgs.mRuntimeFlags & ApplicationInfo.FLAG_DEBUGGABLE) == 0) {
+                     ExecInit.execApplication(parsedArgs.mNiceName, parsedArgs.mTargetSdkVersion,
+                             VMRuntime.getCurrentInstructionSet(), parsedArgs.mRemainingArgs);
+ 

Patches/LineageOS-20.0/android_frameworks_base/0018-Exec_Based_Spawning-3.patch

@@ -0,0 +1,47 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Tue, 14 May 2019 14:24:21 -0400
+Subject: [PATCH] add parameter for avoiding full preload with exec
+
+---
+ core/java/com/android/internal/os/ExecInit.java   | 2 +-
+ core/java/com/android/internal/os/ZygoteInit.java | 6 +++++-
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/core/java/com/android/internal/os/ExecInit.java b/core/java/com/android/internal/os/ExecInit.java
+index 2adcab7fdbe6..830e5b562a91 100644
+--- a/core/java/com/android/internal/os/ExecInit.java
++++ b/core/java/com/android/internal/os/ExecInit.java
+@@ -33,7 +33,7 @@ public class ExecInit {
+ 
+         // Mimic system Zygote preloading.
+         ZygoteInit.preload(new TimingsTraceLog("ExecInitTiming",
+-                Trace.TRACE_TAG_DALVIK));
++                Trace.TRACE_TAG_DALVIK), false);
+ 
+         // Launch the application.
+         String[] runtimeArgs = new String[args.length - 1];
+diff --git a/core/java/com/android/internal/os/ZygoteInit.java b/core/java/com/android/internal/os/ZygoteInit.java
+index ca1ae194cb12..b244492bb76f 100644
+--- a/core/java/com/android/internal/os/ZygoteInit.java
++++ b/core/java/com/android/internal/os/ZygoteInit.java
+@@ -131,7 +131,7 @@ public class ZygoteInit {
+      */
+     private static ClassLoader sCachedSystemServerClassLoader = null;
+ 
+-    static void preload(TimingsTraceLog bootTimingsTraceLog) {
++    static void preload(TimingsTraceLog bootTimingsTraceLog, boolean fullPreload) {
+         Log.d(TAG, "begin preload");
+         bootTimingsTraceLog.traceBegin("BeginPreload");
+         beginPreload();
+@@ -163,6 +163,10 @@ public class ZygoteInit {
+         sPreloadComplete = true;
+     }
+ 
++    static void preload(TimingsTraceLog bootTimingsTraceLog) {
++        preload(bootTimingsTraceLog, true);
++    }
++
+     static void lazyPreload() {
+         Preconditions.checkState(!sPreloadComplete);
+         Log.i(TAG, "Lazily preloading resources.");

Patches/LineageOS-20.0/android_frameworks_base/0018-Exec_Based_Spawning-4.patch

@@ -0,0 +1,50 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Wed, 11 Sep 2019 06:43:55 -0400
+Subject: [PATCH] pass through fullPreload to libcore
+
+---
+ core/java/com/android/internal/os/ZygoteInit.java | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/core/java/com/android/internal/os/ZygoteInit.java b/core/java/com/android/internal/os/ZygoteInit.java
+index b244492bb76f..fcea83ad594a 100644
+--- a/core/java/com/android/internal/os/ZygoteInit.java
++++ b/core/java/com/android/internal/os/ZygoteInit.java
+@@ -134,7 +134,7 @@ public class ZygoteInit {
+     static void preload(TimingsTraceLog bootTimingsTraceLog, boolean fullPreload) {
+         Log.d(TAG, "begin preload");
+         bootTimingsTraceLog.traceBegin("BeginPreload");
+-        beginPreload();
++        beginPreload(fullPreload);
+         bootTimingsTraceLog.traceEnd(); // BeginPreload
+         bootTimingsTraceLog.traceBegin("PreloadClasses");
+         preloadClasses();
+@@ -156,7 +156,7 @@ public class ZygoteInit {
+         // Ask the WebViewFactory to do any initialization that must run in the zygote process,
+         // for memory sharing purposes.
+         WebViewFactory.prepareWebViewInZygote();
+-        endPreload();
++        endPreload(fullPreload);
+         warmUpJcaProviders();
+         Log.d(TAG, "end preload");
+ 
+@@ -174,14 +174,14 @@ public class ZygoteInit {
+         preload(new TimingsTraceLog("ZygoteInitTiming_lazy", Trace.TRACE_TAG_DALVIK));
+     }
+ 
+-    private static void beginPreload() {
++    private static void beginPreload(boolean fullPreload) {
+         Log.i(TAG, "Calling ZygoteHooks.beginPreload()");
+ 
+-        ZygoteHooks.onBeginPreload();
++        ZygoteHooks.onBeginPreload(fullPreload);
+     }
+ 
+-    private static void endPreload() {
+-        ZygoteHooks.onEndPreload();
++    private static void endPreload(boolean fullPreload) {
++        ZygoteHooks.onEndPreload(fullPreload);
+ 
+         Log.i(TAG, "Called ZygoteHooks.endPreload()");
+     }

Patches/LineageOS-20.0/android_frameworks_base/0018-Exec_Based_Spawning-5.patch

@@ -0,0 +1,28 @@
+From 07e331134dd7fc7794cb4e9118fe3fe6b7ad0eb3 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Tue, 14 May 2019 14:28:27 -0400
+Subject: [PATCH] disable OpenGL preloading for exec spawning
+
+---
+ core/java/com/android/internal/os/ZygoteInit.java | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/core/java/com/android/internal/os/ZygoteInit.java b/core/java/com/android/internal/os/ZygoteInit.java
+index fcea83ad594a..2bb66ce1de96 100644
+--- a/core/java/com/android/internal/os/ZygoteInit.java
++++ b/core/java/com/android/internal/os/ZygoteInit.java
+@@ -148,9 +148,11 @@ static void preload(TimingsTraceLog bootTimingsTraceLog, boolean fullPreload) {
+         Trace.traceBegin(Trace.TRACE_TAG_DALVIK, "PreloadAppProcessHALs");
+         nativePreloadAppProcessHALs();
+         Trace.traceEnd(Trace.TRACE_TAG_DALVIK);
+-        Trace.traceBegin(Trace.TRACE_TAG_DALVIK, "PreloadGraphicsDriver");
+-        maybePreloadGraphicsDriver();
+-        Trace.traceEnd(Trace.TRACE_TAG_DALVIK);
++        if (fullPreload) {
++            Trace.traceBegin(Trace.TRACE_TAG_DALVIK, "PreloadGraphicsDriver");
++            maybePreloadGraphicsDriver();
++            Trace.traceEnd(Trace.TRACE_TAG_DALVIK);
++        }
+         preloadSharedLibraries();
+         preloadTextResources();
+         // Ask the WebViewFactory to do any initialization that must run in the zygote process,

Patches/LineageOS-20.0/android_frameworks_base/0018-Exec_Based_Spawning-6.patch

@@ -0,0 +1,28 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Tue, 14 May 2019 14:28:52 -0400
+Subject: [PATCH] disable resource preloading for exec spawning
+
+---
+ core/java/com/android/internal/os/ZygoteInit.java | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/core/java/com/android/internal/os/ZygoteInit.java b/core/java/com/android/internal/os/ZygoteInit.java
+index fcea83ad594a..8c716851f8ae 100644
+--- a/core/java/com/android/internal/os/ZygoteInit.java
++++ b/core/java/com/android/internal/os/ZygoteInit.java
+@@ -142,9 +142,11 @@ public class ZygoteInit {
+         bootTimingsTraceLog.traceBegin("CacheNonBootClasspathClassLoaders");
+         cacheNonBootClasspathClassLoaders();
+         bootTimingsTraceLog.traceEnd(); // CacheNonBootClasspathClassLoaders
+-        bootTimingsTraceLog.traceBegin("PreloadResources");
+-        preloadResources();
+-        bootTimingsTraceLog.traceEnd(); // PreloadResources
++        if (fullPreload) {
++            bootTimingsTraceLog.traceBegin("PreloadResources");
++            preloadResources();
++            bootTimingsTraceLog.traceEnd(); // PreloadResources
++        }
+         Trace.traceBegin(Trace.TRACE_TAG_DALVIK, "PreloadAppProcessHALs");
+         nativePreloadAppProcessHALs();
+         Trace.traceEnd(Trace.TRACE_TAG_DALVIK);

Patches/LineageOS-20.0/android_frameworks_base/0018-Exec_Based_Spawning-7.patch

@@ -0,0 +1,28 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Tue, 14 May 2019 14:30:59 -0400
+Subject: [PATCH] disable class preloading for exec spawning
+
+---
+ core/java/com/android/internal/os/ZygoteInit.java | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/core/java/com/android/internal/os/ZygoteInit.java b/core/java/com/android/internal/os/ZygoteInit.java
+index 8c716851f8ae..881e0a2c7c42 100644
+--- a/core/java/com/android/internal/os/ZygoteInit.java
++++ b/core/java/com/android/internal/os/ZygoteInit.java
+@@ -136,9 +136,11 @@ public class ZygoteInit {
+         bootTimingsTraceLog.traceBegin("BeginPreload");
+         beginPreload(fullPreload);
+         bootTimingsTraceLog.traceEnd(); // BeginPreload
+-        bootTimingsTraceLog.traceBegin("PreloadClasses");
+-        preloadClasses();
+-        bootTimingsTraceLog.traceEnd(); // PreloadClasses
++        if (fullPreload) {
++            bootTimingsTraceLog.traceBegin("PreloadClasses");
++            preloadClasses();
++            bootTimingsTraceLog.traceEnd(); // PreloadClasses
++        }
+         bootTimingsTraceLog.traceBegin("CacheNonBootClasspathClassLoaders");
+         cacheNonBootClasspathClassLoaders();
+         bootTimingsTraceLog.traceEnd(); // CacheNonBootClasspathClassLoaders

Patches/LineageOS-20.0/android_frameworks_base/0018-Exec_Based_Spawning-8.patch

@@ -0,0 +1,28 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Tue, 14 May 2019 14:31:29 -0400
+Subject: [PATCH] disable WebView reservation for exec spawning
+
+---
+ core/java/com/android/internal/os/ZygoteInit.java | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/core/java/com/android/internal/os/ZygoteInit.java b/core/java/com/android/internal/os/ZygoteInit.java
+index 881e0a2c7c42..cb584be53832 100644
+--- a/core/java/com/android/internal/os/ZygoteInit.java
++++ b/core/java/com/android/internal/os/ZygoteInit.java
+@@ -157,9 +157,11 @@ public class ZygoteInit {
+         Trace.traceEnd(Trace.TRACE_TAG_DALVIK);
+         preloadSharedLibraries();
+         preloadTextResources();
+-        // Ask the WebViewFactory to do any initialization that must run in the zygote process,
+-        // for memory sharing purposes.
+-        WebViewFactory.prepareWebViewInZygote();
++        if (fullPreload) {
++            // Ask the WebViewFactory to do any initialization that must run in the zygote process,
++            // for memory sharing purposes.
++            WebViewFactory.prepareWebViewInZygote();
++        }
+         endPreload(fullPreload);
+         warmUpJcaProviders();
+         Log.d(TAG, "end preload");

Patches/LineageOS-20.0/android_frameworks_base/0018-Exec_Based_Spawning-9.patch

@@ -0,0 +1,57 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Tue, 14 May 2019 14:34:32 -0400
+Subject: [PATCH] disable JCA provider warm up for exec spawning
+
+---
+ .../com/android/internal/os/ZygoteInit.java   | 22 ++++++++++---------
+ 1 file changed, 12 insertions(+), 10 deletions(-)
+
+diff --git a/core/java/com/android/internal/os/ZygoteInit.java b/core/java/com/android/internal/os/ZygoteInit.java
+index cb584be53832..7d19700afef4 100644
+--- a/core/java/com/android/internal/os/ZygoteInit.java
++++ b/core/java/com/android/internal/os/ZygoteInit.java
+@@ -163,7 +163,7 @@ public class ZygoteInit {
+             WebViewFactory.prepareWebViewInZygote();
+         }
+         endPreload(fullPreload);
+-        warmUpJcaProviders();
++        warmUpJcaProviders(fullPreload);
+         Log.d(TAG, "end preload");
+ 
+         sPreloadComplete = true;
+@@ -227,7 +227,7 @@ public class ZygoteInit {
+      * By doing it here we avoid that each app does it when requesting a service from the provider
+      * for the first time.
+      */
+-    private static void warmUpJcaProviders() {
++    private static void warmUpJcaProviders(boolean fullPreload) {
+         long startTime = SystemClock.uptimeMillis();
+         Trace.traceBegin(
+                 Trace.TRACE_TAG_DALVIK, "Starting installation of AndroidKeyStoreProvider");
+@@ -237,15 +237,17 @@ public class ZygoteInit {
+                 + (SystemClock.uptimeMillis() - startTime) + "ms.");
+         Trace.traceEnd(Trace.TRACE_TAG_DALVIK);
+ 
+-        startTime = SystemClock.uptimeMillis();
+-        Trace.traceBegin(
+-                Trace.TRACE_TAG_DALVIK, "Starting warm up of JCA providers");
+-        for (Provider p : Security.getProviders()) {
+-            p.warmUpServiceProvision();
++        if (fullPreload) {
++            startTime = SystemClock.uptimeMillis();
++            Trace.traceBegin(
++                    Trace.TRACE_TAG_DALVIK, "Starting warm up of JCA providers");
++            for (Provider p : Security.getProviders()) {
++                p.warmUpServiceProvision();
++            }
++            Log.i(TAG, "Warmed up JCA providers in "
++                    + (SystemClock.uptimeMillis() - startTime) + "ms.");
++            Trace.traceEnd(Trace.TRACE_TAG_DALVIK);
+         }
+-        Log.i(TAG, "Warmed up JCA providers in "
+-                + (SystemClock.uptimeMillis() - startTime) + "ms.");
+-        Trace.traceEnd(Trace.TRACE_TAG_DALVIK);
+     }
+ 
+     /**

Patches/LineageOS-20.0/android_frameworks_base/0020-Location_Indicators.patch

@@ -0,0 +1,48 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Danny Lin <danny@kdrag0n.dev>
+Date: Tue, 12 Oct 2021 01:03:59 +0300
+Subject: [PATCH] SystemUI: Use new privacy indicators for location
+
+Android has had location indicators for a while, but let's use the new
+privacy indicator infrastructure for displaying them. This makes them
+integrate better with the new camera and microphone indicators.
+
+Change-Id: Ie457bb2dad17bddbf9dc3a818e3ec586023ce918
+---
+ core/java/android/permission/PermissionUsageHelper.java       | 2 +-
+ .../src/com/android/systemui/privacy/PrivacyItemController.kt | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/core/java/android/permission/PermissionUsageHelper.java b/core/java/android/permission/PermissionUsageHelper.java
+index f5f1c374b636..b3cadb3ea22b 100644
+--- a/core/java/android/permission/PermissionUsageHelper.java
++++ b/core/java/android/permission/PermissionUsageHelper.java
+@@ -118,7 +118,7 @@ public class PermissionUsageHelper implements AppOpsManager.OnOpActiveChangedLis
+ 
+     private static boolean shouldShowLocationIndicator() {
+         return DeviceConfig.getBoolean(DeviceConfig.NAMESPACE_PRIVACY,
+-                PROPERTY_LOCATION_INDICATORS_ENABLED, false);
++                PROPERTY_LOCATION_INDICATORS_ENABLED, true);
+     }
+ 
+     private static long getRecentThreshold(Long now) {
+diff --git a/packages/SystemUI/src/com/android/systemui/privacy/PrivacyItemController.kt b/packages/SystemUI/src/com/android/systemui/privacy/PrivacyItemController.kt
+index a676150f44a2..35a9b18d9f69 100644
+--- a/packages/SystemUI/src/com/android/systemui/privacy/PrivacyItemController.kt
++++ b/packages/SystemUI/src/com/android/systemui/privacy/PrivacyItemController.kt
+@@ -63,7 +63,7 @@ class PrivacyItemController @Inject constructor(
+     val micCameraAvailable
+         get() = privacyConfig.micCameraAvailable
+     val locationAvailable
+-        get() = privacyConfig.locationAvailable
++        get() = true
+     val allIndicatorsAvailable
+         get() = micCameraAvailable && locationAvailable && privacyConfig.mediaProjectionAvailable
+ 
+@@ -275,4 +275,4 @@ class PrivacyItemController @Inject constructor(
+             listeningCanceller = delegate.executeDelayed({ setListeningState() }, 0L)
+         }
+     }
+-}
+\ No newline at end of file
++}

Patches/LineageOS-20.0/android_frameworks_base/0021-Boot_Animation.patch

@@ -0,0 +1,40 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Tad <tad@spotco.us>
+Date: Wed, 6 Apr 2022 01:10:00 -0400
+Subject: [PATCH] Use basic boot animation
+
+Signed-off-by: Tad <tad@spotco.us>
+Change-Id: I0c87ddd9aec21fc610f3d17701192c04150308d7
+---
+ cmds/bootanimation/BootAnimation.cpp | 11 ++---------
+ 1 file changed, 2 insertions(+), 9 deletions(-)
+
+diff --git a/cmds/bootanimation/BootAnimation.cpp b/cmds/bootanimation/BootAnimation.cpp
+index 50c8e933d25f..9f4e6a158cc4 100644
+--- a/cmds/bootanimation/BootAnimation.cpp
++++ b/cmds/bootanimation/BootAnimation.cpp
+@@ -726,7 +726,7 @@ GLuint linkShader(GLuint vertexShader, GLuint fragmentShader) {
+ }
+ 
+ void BootAnimation::initShaders() {
+-    bool dynamicColoringEnabled = mAnimation != nullptr && mAnimation->dynamicColoringEnabled;
++    bool dynamicColoringEnabled = false;
+     GLuint vertexShader = compileShader(GL_VERTEX_SHADER, (const GLchar *)VERTEX_SHADER_SOURCE);
+     GLuint imageFragmentShader =
+         compileShader(GL_FRAGMENT_SHADER, dynamicColoringEnabled
+@@ -762,14 +762,7 @@ bool BootAnimation::threadLoop() {
+     bool result;
+     initShaders();
+ 
+-    // We have no bootanimation file, so we use the stock android logo
+-    // animation.
+-    if (mZipFileName.isEmpty()) {
+-        ALOGD("No animation file");
+-        result = android();
+-    } else {
+-        result = movie();
+-    }
++    result = android();
+ 
+     mCallbacks->shutdown();
+     eglMakeCurrent(mDisplay, EGL_NO_SURFACE, EGL_NO_SURFACE, EGL_NO_CONTEXT);

Patches/LineageOS-20.0/android_frameworks_base/0022-Ignore_StatementService_ANR.patch

@@ -0,0 +1,26 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Wed, 20 Oct 2021 19:40:42 -0400
+Subject: [PATCH] don't report statementservice crashes
+
+There's a known issue in AOSP 12 caused by it creating overly large
+intents for the work manager. It's not caused by anything done by end
+users and they can't work around it so avoid reporting it to them since
+they get a message each time it tries again.
+---
+ core/res/res/values/config.xml | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/core/res/res/values/config.xml b/core/res/res/values/config.xml
+index d655721615b6..cad56011d94b 100644
+--- a/core/res/res/values/config.xml
++++ b/core/res/res/values/config.xml
+@@ -3737,7 +3737,7 @@
+ 
+     <!-- List of comma separated package names for which we the system will not show crash, ANR,
+          etc. dialogs. -->
+-    <string translatable="false" name="config_appsNotReportingCrashes"></string>
++    <string translatable="false" name="config_appsNotReportingCrashes">com.android.statementservice</string>
+ 
+     <!-- Inactivity threshold (in milliseconds) used in JobScheduler. JobScheduler will consider
+          the device to be "idle" after being inactive for this long. -->

Patches/LineageOS-20.0/android_frameworks_base/0023-Skip_Screen_Animation.patch

@@ -0,0 +1,26 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Danny Lin <danny@kdrag0n.dev>
+Date: Tue, 15 Dec 2020 16:58:40 -0800
+Subject: [PATCH] SystemUI: Skip screen-on animation in all scenarios
+
+Unlike turning the screen off, turning it on is a time-critical
+operation that should be done as fast as possible without a slow
+animation. It's not only noticeable when using capacitive fingerprint
+sensors.
+---
+ .../android/systemui/statusbar/phone/CentralSurfacesImpl.java   | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/packages/SystemUI/src/com/android/systemui/statusbar/phone/CentralSurfacesImpl.java b/packages/SystemUI/src/com/android/systemui/statusbar/phone/CentralSurfacesImpl.java
+index 000f268cba69..d779bb216328 100644
+--- a/packages/SystemUI/src/com/android/systemui/statusbar/phone/CentralSurfacesImpl.java
++++ b/packages/SystemUI/src/com/android/systemui/statusbar/phone/CentralSurfacesImpl.java
+@@ -4058,7 +4058,7 @@ public class CentralSurfacesImpl extends CoreStartable implements
+ 
+         boolean launchingAffordanceWithPreview =
+                 mNotificationPanelViewController.isLaunchingAffordanceWithPreview();
+-        mScrimController.setLaunchingAffordanceWithPreview(launchingAffordanceWithPreview);
++        mScrimController.setLaunchingAffordanceWithPreview(true);
+ 
+         if (mStatusBarKeyguardViewManager.isShowingAlternateAuth()) {
+             if (mState == StatusBarState.SHADE || mState == StatusBarState.SHADE_LOCKED

Patches/LineageOS-20.0/android_frameworks_base/0024-Burnin_Protection.patch

@@ -0,0 +1,262 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Park Ju Hyung <qkrwngud825@gmail.com>
+Date: Sun, 15 Jan 2017 03:33:04 +0900
+Subject: [PATCH] SystemUI: add burnIn protection
+
+Devices with AMOLED display suffer from
+status-bar's notification items and nagivation bar's software keys
+causing permanent burn-ins when used long-term.
+
+Moving all items in the area
+both horizontally and vertically workarounds this problem.
+
+jrizzoli: integrate with runtime cmsdk preference
+
+Linux4: removed toggle from settings - the burnIn protection is always
+enabled if the corresponding AOSP overlay is set to true
+
+Change-Id: I35b04d1edff86a556adb3ad349569e5d82653f16
+Signed-off-by: Park Ju Hyung <qkrwngud825@gmail.com>
+Signed-off-by: Alex Naidis <alex.naidis@linux.com>
+Signed-off-by: Thecrazyskull <anaskarbila@gmail.com>
+Signed-off-by: Joey Rizzoli <joey@lineageos.org>
+---
+ .../SystemUI/res/values/lineage_dimens.xml    |   3 +
+ .../navigationbar/NavigationBarView.java      |  26 +++++
+ .../statusbar/phone/PhoneStatusBarView.java   |  27 +++++
+ .../policy/BurnInProtectionController.java    | 105 ++++++++++++++++++
+ 4 files changed, 161 insertions(+)
+ create mode 100644 packages/SystemUI/src/com/android/systemui/statusbar/policy/BurnInProtectionController.java
+
+diff --git a/packages/SystemUI/res/values/lineage_dimens.xml b/packages/SystemUI/res/values/lineage_dimens.xml
+index e1998ce3d3ab..dc59ccd794f7 100644
+--- a/packages/SystemUI/res/values/lineage_dimens.xml
++++ b/packages/SystemUI/res/values/lineage_dimens.xml
+@@ -21,4 +21,7 @@
+ 
+     <!-- Largest size an avatar might need to be drawn in the power menu user picker -->
+     <dimen name="global_actions_avatar_size">24dp</dimen>
++
++    <dimen name="burnin_protection_horizontal_shift">3dp</dimen>
++    <dimen name="burnin_protection_vertical_shift">1dp</dimen>
+ </resources>
+diff --git a/packages/SystemUI/src/com/android/systemui/navigationbar/NavigationBarView.java b/packages/SystemUI/src/com/android/systemui/navigationbar/NavigationBarView.java
+index 448639cc1fe5..2505301d4268 100644
+--- a/packages/SystemUI/src/com/android/systemui/navigationbar/NavigationBarView.java
++++ b/packages/SystemUI/src/com/android/systemui/navigationbar/NavigationBarView.java
+@@ -158,6 +158,13 @@ public class NavigationBarView extends FrameLayout implements TunerService.Tunab
+     private FloatingRotationButton mFloatingRotationButton;
+     private RotationButtonController mRotationButtonController;
+ 
++    private int mBasePaddingBottom;
++    private int mBasePaddingLeft;
++    private int mBasePaddingRight;
++    private int mBasePaddingTop;
++
++    private ViewGroup mNavigationBarContents;
++
+     /**
+      * Helper that is responsible for showing the right toast when a disallowed activity operation
+      * occurred. In pinned mode, we show instructions on how to break out of this mode, whilst in
+@@ -859,12 +866,31 @@ public class NavigationBarView extends FrameLayout implements TunerService.Tunab
+         mContextualButtonGroup.setButtonVisibility(R.id.accessibility_button, visible);
+     }
+ 
++    public void shiftNavigationBarItems(int horizontalShift, int verticalShift) {
++        if (mNavigationBarContents == null) {
++            return;
++        }
++
++        mNavigationBarContents.setPaddingRelative(mBasePaddingLeft + horizontalShift,
++                mBasePaddingTop + verticalShift,
++                mBasePaddingRight + horizontalShift,
++                mBasePaddingBottom - verticalShift);
++        invalidate();
++    }
++
+     @Override
+     public void onFinishInflate() {
+         super.onFinishInflate();
+         mNavigationInflaterView = findViewById(R.id.navigation_inflater);
+         mNavigationInflaterView.setButtonDispatchers(mButtonDispatchers);
+ 
++
++        mNavigationBarContents = (ViewGroup) findViewById(R.id.nav_buttons);
++
++        mBasePaddingLeft = mNavigationBarContents.getPaddingStart();
++        mBasePaddingTop = mNavigationBarContents.getPaddingTop();
++        mBasePaddingRight = mNavigationBarContents.getPaddingEnd();
++        mBasePaddingBottom = mNavigationBarContents.getPaddingBottom();
+         updateOrientationViews();
+         reloadNavIcons();
+     }
+diff --git a/packages/SystemUI/src/com/android/systemui/statusbar/phone/PhoneStatusBarView.java b/packages/SystemUI/src/com/android/systemui/statusbar/phone/PhoneStatusBarView.java
+index 3f37a352ed5f..b65cfe4fc4a1 100644
+--- a/packages/SystemUI/src/com/android/systemui/statusbar/phone/PhoneStatusBarView.java
++++ b/packages/SystemUI/src/com/android/systemui/statusbar/phone/PhoneStatusBarView.java
+@@ -19,6 +19,7 @@ package com.android.systemui.statusbar.phone;
+ 
+ import android.annotation.Nullable;
+ import android.content.Context;
++import android.content.res.Resources;
+ import android.content.res.Configuration;
+ import android.graphics.Rect;
+ import android.inputmethodservice.InputMethodService;
+@@ -60,6 +61,13 @@ public class PhoneStatusBarView extends FrameLayout implements Callbacks {
+     private final CommandQueue mCommandQueue;
+     private final StatusBarContentInsetsProvider mContentInsetsProvider;
+ 
++    private int mBasePaddingBottom;
++    private int mBasePaddingLeft;
++    private int mBasePaddingRight;
++    private int mBasePaddingTop;
++
++    private ViewGroup mStatusBarContents;
++
+     private DarkReceiver mBattery;
+     private ClockController mClockController;
+     private int mRotationOrientation = -1;
+@@ -132,6 +140,18 @@ public class PhoneStatusBarView extends FrameLayout implements Callbacks {
+         mTouchEventHandler = handler;
+     }
+ 
++    public void shiftStatusBarItems(int horizontalShift, int verticalShift) {
++        if (mStatusBarContents == null) {
++            return;
++        }
++
++        mStatusBarContents.setPaddingRelative(mBasePaddingLeft + horizontalShift,
++                mBasePaddingTop + verticalShift,
++                mBasePaddingRight + horizontalShift,
++                mBasePaddingBottom - verticalShift);
++        invalidate();
++    }
++
+     @Override
+     public void onFinishInflate() {
+         super.onFinishInflate();
+@@ -139,6 +159,13 @@ public class PhoneStatusBarView extends FrameLayout implements Callbacks {
+         mClockController = new ClockController(getContext(), this);
+         mCutoutSpace = findViewById(R.id.cutout_space_view);
+ 
++        mStatusBarContents = (ViewGroup) findViewById(R.id.status_bar_contents);
++
++        mBasePaddingLeft = mStatusBarContents.getPaddingStart();
++        mBasePaddingTop = mStatusBarContents.getPaddingTop();
++        mBasePaddingRight = mStatusBarContents.getPaddingEnd();
++        mBasePaddingBottom = mStatusBarContents.getPaddingBottom();
++
+         updateResources();
+     }
+ 
+diff --git a/packages/SystemUI/src/com/android/systemui/statusbar/policy/BurnInProtectionController.java b/packages/SystemUI/src/com/android/systemui/statusbar/policy/BurnInProtectionController.java
+new file mode 100644
+index 000000000000..a7b7bd9e53dc
+--- /dev/null
++++ b/packages/SystemUI/src/com/android/systemui/statusbar/policy/BurnInProtectionController.java
+@@ -0,0 +1,105 @@
++/*
++ * Copyright 2017 Paranoid Android
++ * Copyright 2020 The LineageOS Project
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License");
++ * you may not use this file except in compliance with the License.
++ * You may obtain a copy of the License at
++ *
++ *     http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software
++ * distributed under the License is distributed on an "AS IS" BASIS,
++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++ * See the License for the specific language governing permissions and
++ * limitations under the License.
++ */
++
++package com.android.systemui.statusbar.policy;
++
++import android.content.Context;
++import android.content.res.Resources;
++import android.os.Handler;
++import android.os.Looper;
++import android.util.Log;
++
++import com.android.systemui.R;
++import com.android.systemui.navigationbar.NavigationBarView;
++import com.android.systemui.statusbar.phone.PhoneStatusBarView;
++import com.android.systemui.statusbar.phone.StatusBar;
++
++public class BurnInProtectionController {
++    private static final String TAG = "BurnInProtectionController";
++    private static final boolean DEBUG = false;
++    private static final long INTERVAL = 60000; // Milliseconds
++
++    private int mHorizontalShift = 0;
++    private int mVerticalShift = 0;
++    private int mHorizontalDirection = 1;
++    private int mVerticalDirection = 1;
++    private int mNavigationBarHorizontalMaxShift;
++    private int mNavigationBarVerticalMaxShift;
++    private int mHorizontalMaxShift;
++    private int mVerticalMaxShift;
++    private long mShiftInterval;
++
++    private final Handler mHandler = new Handler();
++    private final Runnable mRunnable = () -> {
++            shiftItems();
++            mHandler.postDelayed(this.mRunnable, INTERVAL);
++    };
++
++    private PhoneStatusBarView mPhoneStatusBarView;
++    private StatusBar mStatusBar;
++
++    private Context mContext;
++
++    public BurnInProtectionController(Context context, StatusBar statusBar,
++            PhoneStatusBarView phoneStatusBarView) {
++        mContext = context;
++
++        mPhoneStatusBarView = phoneStatusBarView;
++        mStatusBar = statusBar;
++
++        mHorizontalMaxShift = mContext.getResources()
++                .getDimensionPixelSize(R.dimen.burnin_protection_horizontal_shift);
++        // total of ((vertical_max_shift - 1) * 2) pixels can be moved
++        mVerticalMaxShift = mContext.getResources()
++                .getDimensionPixelSize(R.dimen.burnin_protection_vertical_shift) - 1;
++    }
++
++    public void startShiftTimer(boolean enabled) {
++        if (!enabled) return;
++        mHandler.removeCallbacks(mRunnable);
++        mHandler.postDelayed(mRunnable, INTERVAL);
++        if (DEBUG) Log.d(TAG, "Started shift timer");
++    }
++
++    public void stopShiftTimer(boolean enabled) {
++        if (!enabled) return;
++        mHandler.removeCallbacks(mRunnable);
++        if (DEBUG) Log.d(TAG, "Canceled shift timer");
++    }
++
++    private void shiftItems() {
++        mHorizontalShift += mHorizontalDirection;
++        if ((mHorizontalShift >=  mHorizontalMaxShift) ||
++                (mHorizontalShift <= -mHorizontalMaxShift)) {
++            mHorizontalDirection *= -1;
++        }
++
++        mVerticalShift += mVerticalDirection;
++        if ((mVerticalShift >=  mVerticalMaxShift) ||
++                (mVerticalShift <= -mVerticalMaxShift)) {
++            mVerticalDirection *= -1;
++        }
++
++        mPhoneStatusBarView.shiftStatusBarItems(mHorizontalShift, mVerticalShift);
++        NavigationBarView navigationBarView = mStatusBar.getNavigationBarView();
++
++        if (navigationBarView != null) {
++            navigationBarView.shiftNavigationBarItems(mHorizontalShift, mVerticalShift);
++        }
++        if (DEBUG) Log.d(TAG, "Shifting items\u2026");
++    }
++}

Patches/LineageOS-20.0/android_frameworks_base/0025-Monet_Toggle.patch

@@ -0,0 +1,219 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: empratyush <codelab@pratyush.dev>
+Date: Thu, 24 Mar 2022 11:55:21 +0530
+Subject: [PATCH] make monet based theming user configurable
+
+---
+ core/java/android/provider/Settings.java      | 21 +++++
+ .../theme/ThemeOverlayController.java         | 86 +++++++++++--------
+ 2 files changed, 70 insertions(+), 37 deletions(-)
+
+diff --git a/core/java/android/provider/Settings.java b/core/java/android/provider/Settings.java
+index a60ec93697a6..29a26dcd5d4b 100644
+--- a/core/java/android/provider/Settings.java
++++ b/core/java/android/provider/Settings.java
+@@ -6600,6 +6600,27 @@ public final class Settings {
+             return putStringForUser(cr, name, Float.toString(value), userHandle);
+         }
+ 
++        /**
++         * Control whether to enable dynamic monet based theming mode.
++         * @hide
++         */
++        @UnsupportedAppUsage
++        public static final String MONET_MODE = "monet_mode";
++
++        /**
++         * MONET_MODE value for enabled mode.
++         * @hide
++         */
++        @UnsupportedAppUsage
++        public static final int MONET_MODE_ENABLED = 1;
++
++        /**
++         * MONET_MODE value for disabled mode.
++         * @hide
++         */
++        @UnsupportedAppUsage
++        public static final int MONET_MODE_DISABLED = 0;
++
+         /**
+          * Control whether to enable adaptive sleep mode.
+          * @hide
+diff --git a/packages/SystemUI/src/com/android/systemui/theme/ThemeOverlayController.java b/packages/SystemUI/src/com/android/systemui/theme/ThemeOverlayController.java
+index 48e05575b8bb..9ed599e0a722 100644
+--- a/packages/SystemUI/src/com/android/systemui/theme/ThemeOverlayController.java
++++ b/packages/SystemUI/src/com/android/systemui/theme/ThemeOverlayController.java
+@@ -122,7 +122,6 @@ public class ThemeOverlayController extends CoreStartable implements Dumpable {
+     private final SystemSettings mSystemSettings;
+     private final Executor mMainExecutor;
+     private final Handler mBgHandler;
+-    private final boolean mIsMonetEnabled;
+     private final UserTracker mUserTracker;
+     private final ConfigurationController mConfigurationController;
+     private final DeviceProvisionedController mDeviceProvisionedController;
+@@ -268,7 +267,11 @@ public class ThemeOverlayController extends CoreStartable implements Dumpable {
+         final boolean hadWallpaperColors = mCurrentColors.get(userId) != null;
+         int latestWallpaperType = getLatestWallpaperType(userId);
+         if ((flags & latestWallpaperType) != 0) {
+-            mCurrentColors.put(userId, wallpaperColors);
++            if (isMonetEnabled(userId)) {
++                mCurrentColors.put(userId, wallpaperColors);
++            } else {
++                mCurrentColors.put(userId, null);
++            }
+             if (DEBUG) Log.d(TAG, "got new colors: " + wallpaperColors + " where: " + flags);
+         }
+ 
+@@ -366,6 +369,15 @@ public class ThemeOverlayController extends CoreStartable implements Dumpable {
+         }
+     };
+ 
++    private boolean isMonetEnabled(int user) {
++        return Settings.Secure.getIntForUser(
++                mContext.getContentResolver(),
++                Settings.Secure.MONET_MODE,
++                Settings.Secure.MONET_MODE_DISABLED,
++                user
++        ) == Settings.Secure.MONET_MODE_ENABLED;
++    }
++
+     @Inject
+     public ThemeOverlayController(Context context, BroadcastDispatcher broadcastDispatcher,
+             @Background Handler bgHandler, @Main Executor mainExecutor,
+@@ -377,7 +389,6 @@ public class ThemeOverlayController extends CoreStartable implements Dumpable {
+             SystemSettings systemSettings, ConfigurationController configurationController) {
+         super(context);
+ 
+-        mIsMonetEnabled = featureFlags.isEnabled(Flags.MONET);
+         mConfigurationController = configurationController;
+         mDeviceProvisionedController = deviceProvisionedController;
+         mBroadcastDispatcher = broadcastDispatcher;
+@@ -477,24 +488,17 @@ public class ThemeOverlayController extends CoreStartable implements Dumpable {
+                 },
+                 UserHandle.USER_ALL);
+ 
+-        if (!mIsMonetEnabled) {
+-            return;
+-        }
+-
+         mUserTracker.addCallback(mUserTrackerCallback, mMainExecutor);
+ 
+         mConfigurationController.addCallback(mConfigurationListener);
+         mDeviceProvisionedController.addCallback(mDeviceProvisionedListener);
+ 
+-        // All wallpaper color and keyguard logic only applies when Monet is enabled.
+-        if (!mIsMonetEnabled) {
+-            return;
+-        }
+-
+         // Upon boot, make sure we have the most up to date colors
+         Runnable updateColors = () -> {
+-            WallpaperColors systemColor = mWallpaperManager.getWallpaperColors(
+-                    getLatestWallpaperType(mUserTracker.getUserId()));
++            WallpaperColors systemColor = isMonetEnabled(
++                    mUserTracker.getUserId()) ? mWallpaperManager.getWallpaperColors(
++                    getLatestWallpaperType(mUserTracker.getUserId()))
++                                             : null;
+             Runnable applyColors = () -> {
+                 if (DEBUG) Log.d(TAG, "Boot colors: " + systemColor);
+                 mCurrentColors.put(mUserTracker.getUserId(), systemColor);
+@@ -520,7 +524,8 @@ public class ThemeOverlayController extends CoreStartable implements Dumpable {
+             @Override
+             public void onFinishedGoingToSleep() {
+                 final int userId = mUserTracker.getUserId();
+-                final WallpaperColors colors = mDeferredWallpaperColors.get(userId);
++                final WallpaperColors colors = isMonetEnabled(userId)
++                        ? mDeferredWallpaperColors.get(userId) : null;
+                 if (colors != null) {
+                     int flags = mDeferredWallpaperColorsFlags.get(userId);
+ 
+@@ -531,10 +536,30 @@ public class ThemeOverlayController extends CoreStartable implements Dumpable {
+                 }
+             }
+         });
++
++        mSecureSettings.registerContentObserverForUser(
++                Settings.Secure.getUriFor(Settings.Secure.MONET_MODE),
++                false,
++                new ContentObserver(mBgHandler) {
++                    @Override
++                    public void onChange(boolean selfChange) {
++                        super.onChange(selfChange);
++                        WallpaperColors color = isMonetEnabled(mUserTracker.getUserId())
++                                ? mWallpaperManager.getWallpaperColors(WallpaperManager.FLAG_SYSTEM, mUserTracker.getUserId())
++
++                                : null;
++                        handleWallpaperColors(color, WallpaperManager.FLAG_SYSTEM, mUserTracker.getUserId());
++                        reevaluateSystemTheme(true);
++                    }
++                },
++                UserHandle.USER_ALL
++        );
+     }
+ 
+     private void reevaluateSystemTheme(boolean forceReload) {
+-        final WallpaperColors currentColors = mCurrentColors.get(mUserTracker.getUserId());
++        final WallpaperColors currentColors = isMonetEnabled(
++                   mUserTracker.getUserId()) ? mCurrentColors.get(mUserTracker.getUserId())
++                                             : null;
+         final int mainColor;
+         if (currentColors == null) {
+             mainColor = Color.TRANSPARENT;
+@@ -547,15 +572,13 @@ public class ThemeOverlayController extends CoreStartable implements Dumpable {
+         }
+         mMainWallpaperColor = mainColor;
+ 
+-        if (mIsMonetEnabled) {
+-            mThemeStyle = fetchThemeStyleFromSetting();
+-            mSecondaryOverlay = getOverlay(mMainWallpaperColor, ACCENT, mThemeStyle);
+-            mNeutralOverlay = getOverlay(mMainWallpaperColor, NEUTRAL, mThemeStyle);
+-            mNeedsOverlayCreation = true;
+-            if (DEBUG) {
+-                Log.d(TAG, "fetched overlays. accent: " + mSecondaryOverlay
+-                        + " neutral: " + mNeutralOverlay);
+-            }
++        mThemeStyle = fetchThemeStyleFromSetting();
++        mSecondaryOverlay = getOverlay(mMainWallpaperColor, ACCENT, mThemeStyle);
++        mNeutralOverlay = getOverlay(mMainWallpaperColor, NEUTRAL, mThemeStyle);
++        mNeedsOverlayCreation = true;
++        if (DEBUG) {
++            Log.d(TAG, "fetched overlays. accent: " + mSecondaryOverlay
++                    + " neutral: " + mNeutralOverlay);
+         }
+ 
+         updateThemeOverlays();
+@@ -655,7 +678,7 @@ public class ThemeOverlayController extends CoreStartable implements Dumpable {
+ 
+         // Let's generate system overlay if the style picker decided to override it.
+         OverlayIdentifier systemPalette = categoryToPackage.get(OVERLAY_CATEGORY_SYSTEM_PALETTE);
+-        if (mIsMonetEnabled && systemPalette != null && systemPalette.getPackageName() != null) {
++        if (systemPalette != null && systemPalette.getPackageName() != null) {
+             try {
+                 String colorString =  systemPalette.getPackageName().toLowerCase();
+                 if (!colorString.startsWith("#")) {
+@@ -671,16 +694,6 @@ public class ThemeOverlayController extends CoreStartable implements Dumpable {
+                 // Color.parseColor doesn't catch any exceptions from the calls it makes
+                 Log.w(TAG, "Invalid color definition: " + systemPalette.getPackageName(), e);
+             }
+-        } else if (!mIsMonetEnabled && systemPalette != null) {
+-            try {
+-                // It's possible that we flipped the flag off and still have a @ColorInt in the
+-                // setting. We need to sanitize the input, otherwise the overlay transaction will
+-                // fail.
+-                categoryToPackage.remove(OVERLAY_CATEGORY_SYSTEM_PALETTE);
+-                categoryToPackage.remove(OVERLAY_CATEGORY_ACCENT_COLOR);
+-            } catch (NumberFormatException e) {
+-                // This is a package name. All good, let's continue
+-            }
+         }
+ 
+         // Compatibility with legacy themes, where full packages were defined, instead of just
+@@ -758,7 +771,6 @@ public class ThemeOverlayController extends CoreStartable implements Dumpable {
+         pw.println("mMainWallpaperColor=" + Integer.toHexString(mMainWallpaperColor));
+         pw.println("mSecondaryOverlay=" + mSecondaryOverlay);
+         pw.println("mNeutralOverlay=" + mNeutralOverlay);
+-        pw.println("mIsMonetEnabled=" + mIsMonetEnabled);
+         pw.println("mColorScheme=" + mColorScheme);
+         pw.println("mNeedsOverlayCreation=" + mNeedsOverlayCreation);
+         pw.println("mAcceptColorEvents=" + mAcceptColorEvents);

Patches/LineageOS-20.0/android_frameworks_base/0026-Crash_Details.patch

@@ -0,0 +1,349 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Dmitry Muhomor <muhomor.dmitry@gmail.com>
+Date: Mon, 8 Aug 2022 19:03:37 +0300
+Subject: [PATCH] add an option to show the details of an application error to
+ the user
+
+Adds a "Show details" item to crash and ANR (app not responding) dialogs that takes the user to a
+SystemUI activity which shows the error details and allows to copy them to the clipboard or to
+export them via the standard sharing UI.
+---
+ .../android/app/ApplicationErrorReport.java   |  14 +-
+ core/res/res/layout/app_anr_dialog.xml        |   4 +-
+ core/res/res/layout/app_error_dialog.xml      |   4 +-
+ core/res/res/values/strings.xml               |   3 +
+ core/res/res/values/symbols.xml               |   3 +
+ packages/SystemUI/AndroidManifest.xml         |  12 ++
+ packages/SystemUI/res/values/strings.xml      |   5 +
+ .../android/systemui/ErrorReportActivity.kt   | 159 ++++++++++++++++++
+ .../java/com/android/server/am/AppErrors.java |   1 +
+ 9 files changed, 199 insertions(+), 6 deletions(-)
+ create mode 100644 packages/SystemUI/src/com/android/systemui/ErrorReportActivity.kt
+
+diff --git a/core/java/android/app/ApplicationErrorReport.java b/core/java/android/app/ApplicationErrorReport.java
+index a0b3dc0452ac..d6b9a837c46b 100644
+--- a/core/java/android/app/ApplicationErrorReport.java
++++ b/core/java/android/app/ApplicationErrorReport.java
+@@ -98,6 +98,9 @@ public class ApplicationErrorReport implements Parcelable {
+      */
+     public String packageName;
+ 
++    /** @hide */
++    public long packageVersion;
++
+     /**
+      * Package name of the application which installed the application this
+      * report pertains to.
+@@ -162,13 +165,18 @@ public class ApplicationErrorReport implements Parcelable {
+             String packageName, int appFlags) {
+         // check if error reporting is enabled in secure settings
+         int enabled = Settings.Global.getInt(context.getContentResolver(),
+-                Settings.Global.SEND_ACTION_APP_ERROR, 0);
++                Settings.Global.SEND_ACTION_APP_ERROR, 1);
+         if (enabled == 0) {
+             return null;
+         }
+ 
+         PackageManager pm = context.getPackageManager();
+ 
++        ComponentName systemUiReceiver = getErrorReportReceiver(pm, packageName, "com.android.systemui");
++        if (systemUiReceiver != null) {
++            return systemUiReceiver;
++        }
++
+         // look for receiver in the installer package
+         String candidate = null;
+         ComponentName result = null;
+@@ -233,6 +241,7 @@ public class ApplicationErrorReport implements Parcelable {
+     public void writeToParcel(Parcel dest, int flags) {
+         dest.writeInt(type);
+         dest.writeString(packageName);
++        dest.writeLong(packageVersion);
+         dest.writeString(installerPackageName);
+         dest.writeString(processName);
+         dest.writeLong(time);
+@@ -260,6 +269,7 @@ public class ApplicationErrorReport implements Parcelable {
+     public void readFromParcel(Parcel in) {
+         type = in.readInt();
+         packageName = in.readString();
++        packageVersion = in.readLong();
+         installerPackageName = in.readString();
+         processName = in.readString();
+         time = in.readLong();
+@@ -686,7 +696,7 @@ public class ApplicationErrorReport implements Parcelable {
+      */
+     public void dump(Printer pw, String prefix) {
+         pw.println(prefix + "type: " + type);
+-        pw.println(prefix + "packageName: " + packageName);
++        pw.println(prefix + "packageName: " + packageName + ":" + packageVersion);
+         pw.println(prefix + "installerPackageName: " + installerPackageName);
+         pw.println(prefix + "processName: " + processName);
+         pw.println(prefix + "time: " + time);
+diff --git a/core/res/res/layout/app_anr_dialog.xml b/core/res/res/layout/app_anr_dialog.xml
+index 5ad0f4c0f6cc..ad3a2d2991de 100644
+--- a/core/res/res/layout/app_anr_dialog.xml
++++ b/core/res/res/layout/app_anr_dialog.xml
+@@ -41,8 +41,8 @@
+             android:id="@+id/aerr_report"
+             android:layout_width="match_parent"
+             android:layout_height="wrap_content"
+-            android:text="@string/aerr_report"
+-            android:drawableStart="@drawable/ic_feedback"
++            android:text="@string/aerr_show_details"
++            android:drawableStart="@drawable/ic_info_outline_24"
+             style="@style/aerr_list_item" />
+ 
+ </LinearLayout>
+diff --git a/core/res/res/layout/app_error_dialog.xml b/core/res/res/layout/app_error_dialog.xml
+index c3b149a1e295..a47b82018377 100644
+--- a/core/res/res/layout/app_error_dialog.xml
++++ b/core/res/res/layout/app_error_dialog.xml
+@@ -52,8 +52,8 @@
+         android:id="@+id/aerr_report"
+         android:layout_width="match_parent"
+         android:layout_height="wrap_content"
+-        android:text="@string/aerr_report"
+-        android:drawableStart="@drawable/ic_feedback"
++        android:text="@string/aerr_show_details"
++        android:drawableStart="@drawable/ic_info_outline_24"
+         style="@style/aerr_list_item" />
+ 
+     <Button
+diff --git a/core/res/res/values/strings.xml b/core/res/res/values/strings.xml
+index e5d90f00f327..055ba19fb30f 100644
+--- a/core/res/res/values/strings.xml
++++ b/core/res/res/values/strings.xml
+@@ -6314,4 +6314,7 @@ ul.</string>
+ 
+     <!-- Title for preference of the system default locale. [CHAR LIMIT=50]-->
+     <string name="system_locale_title">System default</string>
++
++    <!-- Button that opens the screen with details of an application error -->
++    <string name="aerr_show_details">Show details</string>
+ </resources>
+diff --git a/core/res/res/values/symbols.xml b/core/res/res/values/symbols.xml
+index 6bb35facca7b..c4241414164f 100644
+--- a/core/res/res/values/symbols.xml
++++ b/core/res/res/values/symbols.xml
+@@ -4798,5 +4798,8 @@
+   <java-symbol type="id" name="language_picker_item" />
+   <java-symbol type="id" name="language_picker_header" />
+ 
++  <!-- Button that opens the screen with details of an application error -->
++  <java-symbol type="string" name="aerr_show_details" />
++
+   <java-symbol type="dimen" name="status_bar_height_default" />
+ </resources>
+diff --git a/packages/SystemUI/AndroidManifest.xml b/packages/SystemUI/AndroidManifest.xml
+index 58945cba9997..b39415febb4b 100644
+--- a/packages/SystemUI/AndroidManifest.xml
++++ b/packages/SystemUI/AndroidManifest.xml
+@@ -943,5 +943,17 @@
+             </intent-filter>
+         </receiver>
+ 
++        <activity
++            android:name=".ErrorReportActivity"
++            android:exported="true"
++            android:theme="@android:style/Theme.DeviceDefault.DayNight"
++            android:documentLaunchMode="always"
++            android:process=":ui"
++        >
++            <intent-filter>
++                <action android:name="android.intent.action.APP_ERROR" />
++            </intent-filter>
++        </activity>
++
+     </application>
+ </manifest>
+diff --git a/packages/SystemUI/res/values/strings.xml b/packages/SystemUI/res/values/strings.xml
+index af8d7ed22ed3..ea4409b20f2b 100644
+--- a/packages/SystemUI/res/values/strings.xml
++++ b/packages/SystemUI/res/values/strings.xml
+@@ -2539,4 +2539,9 @@
+     =1 {# notification}
+     other {# notifications}
+     }</string>
++
++    <string name="error_report_title">Error in %1$s</string>
++    <string name="copy_to_clipboard">Copy to clipboard</string>
++    <string name="copied_to_clipboard">Copied to clipboard</string>
++    <string name="error_share">Share</string>
+ </resources>
+diff --git a/packages/SystemUI/src/com/android/systemui/ErrorReportActivity.kt b/packages/SystemUI/src/com/android/systemui/ErrorReportActivity.kt
+new file mode 100644
+index 000000000000..94630b044fbe
+--- /dev/null
++++ b/packages/SystemUI/src/com/android/systemui/ErrorReportActivity.kt
+@@ -0,0 +1,159 @@
++/*
++ * Copyright (C) 2022 GrapheneOS
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License");
++ * you may not use this file except in compliance with the License.
++ * You may obtain a copy of the License at
++ *
++ *      http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software
++ * distributed under the License is distributed on an "AS IS" BASIS,
++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++ * See the License for the specific language governing permissions and
++ * limitations under the License.
++ */
++
++package com.android.systemui
++
++import android.app.Activity
++import android.app.ApplicationErrorReport
++import android.content.ClipData
++import android.content.ClipDescription
++import android.content.ClipboardManager
++import android.content.Intent
++import android.graphics.Typeface
++import android.os.Build
++import android.os.Bundle
++import android.util.StringBuilderPrinter
++import android.util.TypedValue
++import android.view.Gravity
++import android.view.View
++import android.widget.Button
++import android.widget.LinearLayout
++import android.widget.LinearLayout.LayoutParams
++import android.widget.ScrollView
++import android.widget.TextView
++import android.widget.Toast
++
++class ErrorReportActivity : Activity() {
++
++    override fun onCreate(savedInstanceState: Bundle?) {
++        super.onCreate(savedInstanceState)
++
++        val title: String
++        val reportText: String
++        try {
++            val report = intent.getParcelableExtra<ApplicationErrorReport>(Intent.EXTRA_BUG_REPORT)!!
++            val pm = packageManager
++            val ai = pm.getApplicationInfo(report.packageName, 0)
++            title = getString(R.string.error_report_title, ai.loadLabel(pm))
++
++            reportText = errorReportToText(report)
++        } catch (e: Exception) {
++            e.printStackTrace()
++            finishAndRemoveTask()
++            return
++        }
++
++        setTitle(title)
++
++        val textView = TextView(this).apply {
++            typeface = Typeface.MONOSPACE
++            text = reportText
++            textSize = 12f
++            setTextIsSelectable(true)
++            // default color is too light
++            val color = if (resources.configuration.isNightModeActive) 0xff_d0_d0_d0 else 0xff_00_00_00
++            setTextColor(color.toInt())
++        }
++
++        val scroller = ScrollView(this).apply {
++            isScrollbarFadingEnabled = false
++            scrollBarStyle = View.SCROLLBARS_INSIDE_INSET
++            addView(textView)
++        }
++
++        val formattedReportText = "```\n" + reportText + "\n```"
++        val clipData = ClipData.newPlainText(title, formattedReportText)
++
++        val btnCopy = Button(this).apply {
++            setText(R.string.copy_to_clipboard)
++            setOnClickListener { _ ->
++                val cm = getSystemService(ClipboardManager::class.java)
++                cm.setPrimaryClip(clipData)
++                Toast.makeText(this@ErrorReportActivity, R.string.copied_to_clipboard, Toast.LENGTH_SHORT).show()
++            }
++        }
++
++        val btnShare = Button(this).apply {
++            setText(R.string.error_share)
++            setOnClickListener { _ ->
++                val i = Intent(Intent.ACTION_SEND)
++                i.clipData = clipData
++                i.type = ClipDescription.MIMETYPE_TEXT_PLAIN
++                i.putExtra(Intent.EXTRA_SUBJECT, title)
++                i.putExtra(Intent.EXTRA_TEXT, formattedReportText)
++                startActivity(Intent.createChooser(i, title))
++            }
++        }
++
++        val buttonLayout = LinearLayout(this).apply {
++            orientation = LinearLayout.HORIZONTAL
++            gravity = Gravity.CENTER
++            addView(btnCopy)
++            addView(btnShare)
++        }
++
++        val pad = px(16)
++
++        val layout = LinearLayout(this).apply {
++            orientation = LinearLayout.VERTICAL
++            addView(scroller, LayoutParams(LayoutParams.MATCH_PARENT, 0, 1f))
++            addView(buttonLayout)
++            setPadding(pad, pad, pad, pad)
++        }
++
++        setContentView(layout)
++    }
++
++    fun px(dp: Int) = TypedValue.applyDimension(
++            TypedValue.COMPLEX_UNIT_PX, dp.toFloat(), resources.displayMetrics).toInt()
++
++    fun errorReportToText(r: ApplicationErrorReport) =
++
++"""type: ${reportTypeToString(r.type)}
++osVersion: ${Build.FINGERPRINT}
++package: ${r.packageName}:${r.packageVersion}
++process: ${r.processName}
++
++${reportInfoToString(r)}"""
++
++    fun reportInfoToString(r: ApplicationErrorReport): String {
++        if (r.type == ApplicationErrorReport.TYPE_CRASH) {
++            return r.crashInfo.stackTrace
++        }
++
++        val sb = StringBuilder()
++        val printer = StringBuilderPrinter(sb)
++
++        when (r.type) {
++            ApplicationErrorReport.TYPE_ANR ->
++                r.anrInfo.dump(printer, "")
++            ApplicationErrorReport.TYPE_BATTERY ->
++                r.batteryInfo.dump(printer, "")
++            ApplicationErrorReport.TYPE_RUNNING_SERVICE ->
++                r.runningServiceInfo.dump(printer, "")
++        }
++
++        return sb.toString()
++    }
++
++    fun reportTypeToString(type: Int) = when (type) {
++        ApplicationErrorReport.TYPE_CRASH -> "crash"
++        ApplicationErrorReport.TYPE_ANR -> "ANR"
++        ApplicationErrorReport.TYPE_BATTERY -> "battery"
++        ApplicationErrorReport.TYPE_RUNNING_SERVICE -> "running_service"
++        else -> "unknown ($type)"
++    }
++}
+diff --git a/services/core/java/com/android/server/am/AppErrors.java b/services/core/java/com/android/server/am/AppErrors.java
+index 08c1de61d7fb..026562a98739 100644
+--- a/services/core/java/com/android/server/am/AppErrors.java
++++ b/services/core/java/com/android/server/am/AppErrors.java
+@@ -827,6 +827,7 @@ class AppErrors {
+ 
+         ApplicationErrorReport report = new ApplicationErrorReport();
+         report.packageName = r.info.packageName;
++        report.packageVersion = r.info.longVersionCode;
+         report.installerPackageName = errState.getErrorReportReceiver().getPackageName();
+         report.processName = r.processName;
+         report.time = timeMillis;

Patches/LineageOS-20.0/android_frameworks_ex/0001-constify_JNINativeMethod.patch

@@ -0,0 +1,22 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Mon, 4 Jan 2021 19:56:14 -0500
+Subject: [PATCH] constify JNINativeMethod table
+
+---
+ framesequence/jni/FrameSequenceJNI.cpp | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/framesequence/jni/FrameSequenceJNI.cpp b/framesequence/jni/FrameSequenceJNI.cpp
+index c701f033..4041733d 100644
+--- a/framesequence/jni/FrameSequenceJNI.cpp
++++ b/framesequence/jni/FrameSequenceJNI.cpp
+@@ -141,7 +141,7 @@ static jlong JNICALL nativeGetFrame(
+     return delayMs;
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+     {   "nativeDecodeByteArray",
+         "([BII)L" JNI_PACKAGE "/FrameSequence;",
+         (void*) nativeDecodeByteArray

Patches/LineageOS-20.0/android_frameworks_libs_systemui/0001-Icon_Cache.patch

@@ -0,0 +1,22 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Tue, 2 Nov 2021 14:44:13 -0400
+Subject: [PATCH] invalidate icon cache between OS releases
+
+---
+ .../src/com/android/launcher3/icons/cache/BaseIconCache.java    | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/iconloaderlib/src/com/android/launcher3/icons/cache/BaseIconCache.java b/iconloaderlib/src/com/android/launcher3/icons/cache/BaseIconCache.java
+index 057bdc2..23288f0 100644
+--- a/iconloaderlib/src/com/android/launcher3/icons/cache/BaseIconCache.java
++++ b/iconloaderlib/src/com/android/launcher3/icons/cache/BaseIconCache.java
+@@ -237,7 +237,7 @@ public abstract class BaseIconCache {
+      */
+     private void updateSystemState() {
+         mLocaleList = mContext.getResources().getConfiguration().getLocales();
+-        mSystemState = mLocaleList.toLanguageTags() + "," + Build.VERSION.SDK_INT;
++        mSystemState = mLocaleList.toLanguageTags() + "," + Build.VERSION.INCREMENTAL;
+     }
+ 
+     protected String getIconSystemState(String packageName) {

Patches/LineageOS-20.0/android_frameworks_opt_net_ims/0001-Fix_Calling.patch

@@ -0,0 +1,55 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Tad <tad@spotco.us>
+Date: Tue, 14 Apr 2020 16:59:46 -0400
+Subject: [PATCH] Fix calling after VoLTE is removed from devices that had it
+ previously enabled
+
+Change-Id: Id5e3b8f7793d0783104b8b59581688c8ef821396
+---
+ src/java/com/android/ims/ImsManager.java | 26 +-----------------------
+ 1 file changed, 1 insertion(+), 25 deletions(-)
+
+diff --git a/src/java/com/android/ims/ImsManager.java b/src/java/com/android/ims/ImsManager.java
+index c41426d..e94a6aa 100644
+--- a/src/java/com/android/ims/ImsManager.java
++++ b/src/java/com/android/ims/ImsManager.java
+@@ -544,13 +544,6 @@ public class ImsManager implements FeatureUpdates {
+      */
+     @UnsupportedAppUsage(maxTargetSdk = Build.VERSION_CODES.R, trackingBug = 170729553)
+     public static boolean isEnhanced4gLteModeSettingEnabledByUser(Context context) {
+-        DefaultSubscriptionManagerProxy p = new DefaultSubscriptionManagerProxy(context);
+-        ImsManager mgr = ImsManager.getInstance(context, p.getDefaultVoicePhoneId());
+-        if (mgr != null) {
+-            return mgr.isEnhanced4gLteModeSettingEnabledByUser();
+-        }
+-        Rlog.e(TAG, "isEnhanced4gLteModeSettingEnabledByUser: ImsManager null, returning default"
+-                + " value.");
+         return false;
+     }
+ 
+@@ -565,24 +558,7 @@ public class ImsManager implements FeatureUpdates {
+      * return the default value.
+      */
+     public boolean isEnhanced4gLteModeSettingEnabledByUser() {
+-        int setting = mSubscriptionManagerProxy.getIntegerSubscriptionProperty(
+-                getSubId(), SubscriptionManager.ENHANCED_4G_MODE_ENABLED,
+-                SUB_PROPERTY_NOT_INITIALIZED);
+-        boolean onByDefault = getBooleanCarrierConfig(
+-                CarrierConfigManager.KEY_ENHANCED_4G_LTE_ON_BY_DEFAULT_BOOL);
+-        boolean isUiUnEditable =
+-                !getBooleanCarrierConfig(CarrierConfigManager.KEY_EDITABLE_ENHANCED_4G_LTE_BOOL)
+-                || getBooleanCarrierConfig(CarrierConfigManager.KEY_HIDE_ENHANCED_4G_LTE_BOOL);
+-        boolean isSettingNotInitialized = setting == SUB_PROPERTY_NOT_INITIALIZED;
+-
+-        // If Enhanced 4G LTE Mode is uneditable, hidden, not initialized and VoIMS opt-in disabled
+-        // we use the default value. If VoIMS opt-in is enabled, we will always allow the user to
+-        // change the IMS enabled setting.
+-        if ((isUiUnEditable || isSettingNotInitialized) && !isVoImsOptInEnabled()) {
+-            return onByDefault;
+-        } else {
+-            return (setting == ProvisioningManager.PROVISIONING_VALUE_ENABLED);
+-        }
++        return false;
+     }
+ 
+     /**

Patches/LineageOS-20.0/android_frameworks_opt_net_wifi/0001-Random_MAC.patch

@@ -0,0 +1,88 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: renlord <me@renlord.com>
+Date: Fri, 15 Oct 2021 19:11:18 +0530
+Subject: [PATCH] add support for always generating new random MAC
+
+To trigger re-generation of randomized MAC addressed for an already
+connected AP. User simply has to toggle on/off wifi. Otherwise, on
+re-connection, a new randomized MAC address also gets generated.
+
+based on https://github.com/GrapheneOS/platform_frameworks_opt_net_wifi/commit/a0d9bda06b71694f38fe02bbe24628ee21a7d270
+---
+ .../wifitrackerlib/StandardWifiEntry.java     | 32 ++++++++++++++-----
+ .../com/android/wifitrackerlib/WifiEntry.java |  1 +
+ 2 files changed, 25 insertions(+), 8 deletions(-)
+
+diff --git a/libs/WifiTrackerLib/src/com/android/wifitrackerlib/StandardWifiEntry.java b/libs/WifiTrackerLib/src/com/android/wifitrackerlib/StandardWifiEntry.java
+index 249544b7d..49ae22dae 100644
+--- a/libs/WifiTrackerLib/src/com/android/wifitrackerlib/StandardWifiEntry.java
++++ b/libs/WifiTrackerLib/src/com/android/wifitrackerlib/StandardWifiEntry.java
+@@ -267,7 +267,7 @@ public class StandardWifiEntry extends WifiEntry {
+                 return wifiInfoMac;
+             }
+         }
+-        if (mTargetWifiConfig == null || getPrivacy() != PRIVACY_RANDOMIZED_MAC) {
++        if (mTargetWifiConfig == null || getPrivacy() == PRIVACY_DEVICE_MAC) {
+             final String[] factoryMacs = mWifiManager.getFactoryMacAddresses();
+             if (factoryMacs.length > 0) {
+                 return factoryMacs[0];
+@@ -550,12 +550,18 @@ public class StandardWifiEntry extends WifiEntry {
+     @Override
+     @Privacy
+     public synchronized int getPrivacy() {
+-        if (mTargetWifiConfig != null
+-                && mTargetWifiConfig.macRandomizationSetting
+-                == WifiConfiguration.RANDOMIZATION_NONE) {
+-            return PRIVACY_DEVICE_MAC;
++        if (mTargetWifiConfig != null) {
++            switch (mTargetWifiConfig.macRandomizationSetting) {
++                case WifiConfiguration.RANDOMIZATION_NONE:
++                    return PRIVACY_DEVICE_MAC;
++                case WifiConfiguration.RANDOMIZATION_ALWAYS:
++                    return PRIVACY_RANDOMIZATION_ALWAYS;
++                default:
++                    // WifiConfiguration.RANDOMIZATION_AUTO and WifiConfiguration.RANDOMIZATION_PERSISTENT
++                    return PRIVACY_RANDOMIZED_MAC;
++            }
+         } else {
+-            return PRIVACY_RANDOMIZED_MAC;
++            return PRIVACY_RANDOMIZATION_ALWAYS;
+         }
+     }
+ 
+@@ -565,11 +571,21 @@ public class StandardWifiEntry extends WifiEntry {
+             return;
+         }
+ 
+-        mTargetWifiConfig.macRandomizationSetting = privacy == PRIVACY_RANDOMIZED_MAC
+-                ? WifiConfiguration.RANDOMIZATION_AUTO : WifiConfiguration.RANDOMIZATION_NONE;
++        mTargetWifiConfig.macRandomizationSetting = translatePrivacyToWifiConfigurationValues(privacy);
+         mWifiManager.save(mTargetWifiConfig, null /* listener */);
+     }
+ 
++    private static int translatePrivacyToWifiConfigurationValues(int privacyValue) {
++        switch (privacyValue) {
++            case PRIVACY_RANDOMIZED_MAC:
++                return WifiConfiguration.RANDOMIZATION_PERSISTENT;
++            case PRIVACY_DEVICE_MAC:
++                return WifiConfiguration.RANDOMIZATION_NONE;
++            default:
++                return WifiConfiguration.RANDOMIZATION_ALWAYS;
++        }
++    }
++
+     @Override
+     public synchronized boolean isAutoJoinEnabled() {
+         if (mTargetWifiConfig == null) {
+diff --git a/libs/WifiTrackerLib/src/com/android/wifitrackerlib/WifiEntry.java b/libs/WifiTrackerLib/src/com/android/wifitrackerlib/WifiEntry.java
+index f346c6179..a33f6328f 100644
+--- a/libs/WifiTrackerLib/src/com/android/wifitrackerlib/WifiEntry.java
++++ b/libs/WifiTrackerLib/src/com/android/wifitrackerlib/WifiEntry.java
+@@ -137,6 +137,7 @@ public class WifiEntry {
+     public static final int PRIVACY_DEVICE_MAC = 0;
+     public static final int PRIVACY_RANDOMIZED_MAC = 1;
+     public static final int PRIVACY_UNKNOWN = 2;
++    public static final int PRIVACY_RANDOMIZATION_ALWAYS = 100;
+ 
+     @Retention(RetentionPolicy.SOURCE)
+     @IntDef(value = {

Patches/LineageOS-20.0/android_hardware_qcom_audio/0001-Unused-8996.patch

@@ -0,0 +1,58 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: codeworkx <daniel.hillenbrand@codeworkx.de>
+Date: Sun, 20 Jan 2019 17:48:20 +0100
+Subject: [PATCH] audio_extn: Fix unused parameter warning in utils.c
+
+The unused parameter warning appears if we are not building with
+at least one of the following cflags enabled:
+
+* DEV_ARBI_ENABLED
+* SOUND_TRIGGER_ENABLED
+* AUDIO_LISTEN_ENABLED
+
+  hardware/qcom/audio/hal/audio_extn/utils.c:2522:55: error: unused parameter 'snd_device'
+[-Werror,-Wunused-parameter]
+  void audio_extn_utils_release_snd_device(snd_device_t snd_device)
+                                                      ^
+
+Change-Id: I694c683c9bfde60343f0f6ea8d806bc5e24437e6
+(cherry picked from commit 12981fb9f3c8a67bcc362c7badfb9189bc181cda)
+---
+ hal/audio_extn/audio_extn.h | 5 +++++
+ hal/audio_extn/utils.c      | 2 ++
+ 2 files changed, 7 insertions(+)
+
+diff --git a/hal/audio_extn/audio_extn.h b/hal/audio_extn/audio_extn.h
+index 1187642d1..38ae1aed5 100644
+--- a/hal/audio_extn/audio_extn.h
++++ b/hal/audio_extn/audio_extn.h
+@@ -688,7 +688,12 @@ bool audio_extn_utils_is_dolby_format(audio_format_t format);
+ int audio_extn_utils_get_bit_width_from_string(const char *);
+ int audio_extn_utils_get_sample_rate_from_string(const char *);
+ int audio_extn_utils_get_channels_from_string(const char *);
++
++#if !defined(DEV_ARBI_ENABLED) && !defined(SOUND_TRIGGER_ENABLED) && !defined(AUDIO_LISTEN_ENABLED)
++#define audio_extn_utils_release_snd_device(snd_device) (0)
++#else
+ void audio_extn_utils_release_snd_device(snd_device_t snd_device);
++#endif
+ int audio_extn_utils_get_app_sample_rate_for_device(struct audio_device *adev,
+                                     struct audio_usecase *usecase, int snd_device);
+ 
+diff --git a/hal/audio_extn/utils.c b/hal/audio_extn/utils.c
+index cd788542f..10f1eb216 100644
+--- a/hal/audio_extn/utils.c
++++ b/hal/audio_extn/utils.c
+@@ -2520,6 +2520,7 @@ int audio_extn_utils_get_channels_from_string(const char *id_string)
+     return -EINVAL;
+ }
+ 
++#if defined(DEV_ARBI_ENABLED) || defined(SOUND_TRIGGER_ENABLED) || defined(AUDIO_LISTEN_ENABLED)
+ void audio_extn_utils_release_snd_device(snd_device_t snd_device)
+ {
+     audio_extn_dev_arbi_release(snd_device);
+@@ -2528,3 +2529,4 @@ void audio_extn_utils_release_snd_device(snd_device_t snd_device)
+     audio_extn_listen_update_device_status(snd_device,
+                                     LISTEN_EVENT_SND_DEVICE_FREE);
+ }
++#endif

Patches/LineageOS-20.0/android_hardware_qcom_audio/0001-Unused-8998.patch

@@ -0,0 +1,60 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: codeworkx <daniel.hillenbrand@codeworkx.de>
+Date: Sun, 20 Jan 2019 17:48:20 +0100
+Subject: [PATCH] audio_extn: Fix unused parameter warning in utils.c
+
+The unused parameter warning appears if we are not building with
+at least one of the following cflags enabled:
+
+* DEV_ARBI_ENABLED
+* SOUND_TRIGGER_ENABLED
+* AUDIO_LISTEN_ENABLED
+
+  hardware/qcom/audio/hal/audio_extn/utils.c:2522:55: error: unused parameter 'snd_device'
+[-Werror,-Wunused-parameter]
+  void audio_extn_utils_release_snd_device(snd_device_t snd_device)
+                                                      ^
+
+Change-Id: I694c683c9bfde60343f0f6ea8d806bc5e24437e6
+Signed-off-by: Atman <masteratman@gmail.com>
+---
+ hal/audio_extn/audio_extn.h | 4 ++++
+ hal/audio_extn/utils.c      | 2 ++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/hal/audio_extn/audio_extn.h b/hal/audio_extn/audio_extn.h
+index f37c948ec6..c6b2051a71 100644
+--- a/hal/audio_extn/audio_extn.h
++++ b/hal/audio_extn/audio_extn.h
+@@ -815,7 +815,11 @@ bool audio_extn_utils_is_dolby_format(audio_format_t format);
+ int audio_extn_utils_get_bit_width_from_string(const char *);
+ int audio_extn_utils_get_sample_rate_from_string(const char *);
+ int audio_extn_utils_get_channels_from_string(const char *);
++#if !defined(DEV_ARBI_ENABLED) && !defined(SOUND_TRIGGER_ENABLED) && !defined(AUDIO_LISTEN_ENABLED)
++#define audio_extn_utils_release_snd_device(snd_device) (0)
++#else
+ void audio_extn_utils_release_snd_device(snd_device_t snd_device);
++#endif
+ bool audio_extn_utils_is_vendor_enhanced_fwk();
+ int audio_extn_utils_get_vendor_enhanced_info();
+ int audio_extn_utils_get_app_sample_rate_for_device(struct audio_device *adev,
+diff --git a/hal/audio_extn/utils.c b/hal/audio_extn/utils.c
+index 4675fc39c2..4a5d91a974 100644
+--- a/hal/audio_extn/utils.c
++++ b/hal/audio_extn/utils.c
+@@ -2917,6 +2917,7 @@ int audio_extn_utils_get_channels_from_string(const char *id_string)
+     return -EINVAL;
+ }
+ 
++#if defined(DEV_ARBI_ENABLED) || defined(SOUND_TRIGGER_ENABLED) || defined(AUDIO_LISTEN_ENABLED)
+ void audio_extn_utils_release_snd_device(snd_device_t snd_device)
+ {
+     audio_extn_dev_arbi_release(snd_device);
+@@ -2925,6 +2926,7 @@ void audio_extn_utils_release_snd_device(snd_device_t snd_device)
+     audio_extn_listen_update_device_status(snd_device,
+             LISTEN_EVENT_SND_DEVICE_FREE);
+ }
++#endif
+ 
+ int audio_extn_utils_get_license_params(
+         const struct audio_device *adev,

Patches/LineageOS-20.0/android_hardware_qcom_audio/0001-Unused-sdm845.patch

@@ -0,0 +1,60 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: codeworkx <daniel.hillenbrand@codeworkx.de>
+Date: Sun, 20 Jan 2019 17:48:20 +0100
+Subject: [PATCH] audio_extn: Fix unused parameter warning in utils.c
+
+The unused parameter warning appears if we are not building with
+at least one of the following cflags enabled:
+
+* DEV_ARBI_ENABLED
+* SOUND_TRIGGER_ENABLED
+* AUDIO_LISTEN_ENABLED
+
+  hardware/qcom/audio/hal/audio_extn/utils.c:2522:55: error: unused parameter 'snd_device'
+[-Werror,-Wunused-parameter]
+  void audio_extn_utils_release_snd_device(snd_device_t snd_device)
+                                                      ^
+
+Change-Id: I694c683c9bfde60343f0f6ea8d806bc5e24437e6
+Signed-off-by: Atman <masteratman@gmail.com>
+---
+ hal/audio_extn/audio_extn.h | 4 ++++
+ hal/audio_extn/utils.c      | 2 ++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/hal/audio_extn/audio_extn.h b/hal/audio_extn/audio_extn.h
+index 85502ad91d..95890ab12e 100755
+--- a/hal/audio_extn/audio_extn.h
++++ b/hal/audio_extn/audio_extn.h
+@@ -860,7 +860,11 @@ bool audio_extn_utils_is_dolby_format(audio_format_t format);
+ int audio_extn_utils_get_bit_width_from_string(const char *);
+ int audio_extn_utils_get_sample_rate_from_string(const char *);
+ int audio_extn_utils_get_channels_from_string(const char *);
++#if !defined(DEV_ARBI_ENABLED) && !defined(SOUND_TRIGGER_ENABLED) && !defined(AUDIO_LISTEN_ENABLED)
++#define audio_extn_utils_release_snd_device(snd_device) (0)
++#else
+ void audio_extn_utils_release_snd_device(snd_device_t snd_device);
++#endif
+ bool audio_extn_utils_is_vendor_enhanced_fwk();
+ int audio_extn_utils_get_vendor_enhanced_info();
+ int audio_extn_utils_get_app_sample_rate_for_device(struct audio_device *adev,
+diff --git a/hal/audio_extn/utils.c b/hal/audio_extn/utils.c
+index 756faf544c..0e25d3a396 100755
+--- a/hal/audio_extn/utils.c
++++ b/hal/audio_extn/utils.c
+@@ -3272,6 +3272,7 @@ int audio_extn_utils_get_channels_from_string(const char *id_string)
+     return -EINVAL;
+ }
+ 
++#if defined(DEV_ARBI_ENABLED) || defined(SOUND_TRIGGER_ENABLED) || defined(AUDIO_LISTEN_ENABLED)
+ void audio_extn_utils_release_snd_device(snd_device_t snd_device)
+ {
+     audio_extn_dev_arbi_release(snd_device);
+@@ -3280,6 +3281,7 @@ void audio_extn_utils_release_snd_device(snd_device_t snd_device)
+     audio_extn_listen_update_device_status(snd_device,
+             LISTEN_EVENT_SND_DEVICE_FREE);
+ }
++#endif
+ 
+ int audio_extn_utils_get_license_params(
+         const struct audio_device *adev,

Patches/LineageOS-20.0/android_hardware_qcom_audio/0001-Unused-sm8150.patch

@@ -0,0 +1,58 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: codeworkx <daniel.hillenbrand@codeworkx.de>
+Date: Mon, 1 Jul 2019 06:36:30 +0000
+Subject: [PATCH] audio_extn: Fix unused parameter warning in utils.c
+
+The unused parameter warning appears if we are not building with
+at least one of the following cflags enabled:
+
+* DEV_ARBI_ENABLED
+* SOUND_TRIGGER_ENABLED
+* AUDIO_LISTEN_ENABLED
+
+  hardware/qcom/audio/hal/audio_extn/utils.c:2522:55: error: unused parameter 'snd_device'
+[-Werror,-Wunused-parameter]
+  void audio_extn_utils_release_snd_device(snd_device_t snd_device)
+
+Change-Id: I694c683c9bfde60343f0f6ea8d806bc5e24437e6
+---
+ hal/audio_extn/audio_extn.h | 4 ++++
+ hal/audio_extn/utils.c      | 2 ++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/hal/audio_extn/audio_extn.h b/hal/audio_extn/audio_extn.h
+index 75ef7f239a..58f7f72be9 100644
+--- a/hal/audio_extn/audio_extn.h
++++ b/hal/audio_extn/audio_extn.h
+@@ -868,7 +868,11 @@ bool audio_extn_utils_is_dolby_format(audio_format_t format);
+ int audio_extn_utils_get_bit_width_from_string(const char *);
+ int audio_extn_utils_get_sample_rate_from_string(const char *);
+ int audio_extn_utils_get_channels_from_string(const char *);
++#if !defined(DEV_ARBI_ENABLED) && !defined(SOUND_TRIGGER_ENABLED) && !defined(AUDIO_LISTEN_ENABLED)
++#define audio_extn_utils_release_snd_device(snd_device) (0)
++#else
+ void audio_extn_utils_release_snd_device(snd_device_t snd_device);
++#endif
+ bool audio_extn_utils_is_vendor_enhanced_fwk();
+ int audio_extn_utils_get_vendor_enhanced_info();
+ int audio_extn_utils_get_app_sample_rate_for_device(struct audio_device *adev,
+diff --git a/hal/audio_extn/utils.c b/hal/audio_extn/utils.c
+index 6c97447c9a..364250f2d8 100644
+--- a/hal/audio_extn/utils.c
++++ b/hal/audio_extn/utils.c
+@@ -3303,6 +3303,7 @@ int audio_extn_utils_get_channels_from_string(const char *id_string)
+     return -EINVAL;
+ }
+ 
++#if defined(DEV_ARBI_ENABLED) || defined(SOUND_TRIGGER_ENABLED) || defined(AUDIO_LISTEN_ENABLED)
+ void audio_extn_utils_release_snd_device(snd_device_t snd_device)
+ {
+     audio_extn_dev_arbi_release(snd_device);
+@@ -3311,6 +3312,7 @@ void audio_extn_utils_release_snd_device(snd_device_t snd_device)
+     audio_extn_listen_update_device_status(snd_device,
+             LISTEN_EVENT_SND_DEVICE_FREE);
+ }
++#endif
+ 
+ int audio_extn_utils_get_license_params(
+         const struct audio_device *adev,

Patches/LineageOS-20.0/android_libcore/0002-constify_JNINativeMethod.patch

@@ -0,0 +1,213 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Tue, 16 Aug 2022 16:50:48 -0400
+Subject: [PATCH] constify JNINativeMethod tables
+
+---
+ luni/src/main/native/android_system_OsConstants.cpp           | 2 +-
+ luni/src/main/native/java_lang_StringToReal.cpp               | 2 +-
+ luni/src/main/native/java_lang_invoke_MethodHandle.cpp        | 2 +-
+ luni/src/main/native/java_lang_invoke_VarHandle.cpp           | 2 +-
+ luni/src/main/native/libcore_icu_ICU.cpp                      | 2 +-
+ luni/src/main/native/libcore_io_AsynchronousCloseMonitor.cpp  | 2 +-
+ luni/src/main/native/libcore_io_Linux.cpp                     | 2 +-
+ luni/src/main/native/libcore_io_Memory.cpp                    | 2 +-
+ luni/src/main/native/libcore_math_NativeBN.cpp                | 2 +-
+ .../src/main/native/libcore_util_NativeAllocationRegistry.cpp | 2 +-
+ luni/src/main/native/org_apache_harmony_xml_ExpatParser.cpp   | 4 ++--
+ luni/src/main/native/sun_misc_Unsafe.cpp                      | 2 +-
+ ojluni/src/main/native/Character.cpp                          | 2 +-
+ ojluni/src/main/native/jdk_internal_misc_VM.cpp               | 2 +-
+ 14 files changed, 15 insertions(+), 15 deletions(-)
+
+diff --git a/luni/src/main/native/android_system_OsConstants.cpp b/luni/src/main/native/android_system_OsConstants.cpp
+index 50e3c104666..8ad66d2742b 100644
+--- a/luni/src/main/native/android_system_OsConstants.cpp
++++ b/luni/src/main/native/android_system_OsConstants.cpp
+@@ -722,7 +722,7 @@ static void OsConstants_initConstants(JNIEnv* env, jclass c) {
+     initConstant(env, c, "_SC_XOPEN_XCU_VERSION", _SC_XOPEN_XCU_VERSION);
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+     NATIVE_METHOD(OsConstants, initConstants, "()V"),
+ };
+ void register_android_system_OsConstants(JNIEnv* env) {
+diff --git a/luni/src/main/native/java_lang_StringToReal.cpp b/luni/src/main/native/java_lang_StringToReal.cpp
+index 7a492856394..edd71fad700 100644
+--- a/luni/src/main/native/java_lang_StringToReal.cpp
++++ b/luni/src/main/native/java_lang_StringToReal.cpp
+@@ -892,7 +892,7 @@ static jdouble StringToReal_parseDblImpl(JNIEnv* env, jclass, jstring s, jint e)
+     return createDouble(env, str.c_str(), e);
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+     NATIVE_METHOD(StringToReal, parseFltImpl, "(Ljava/lang/String;I)F"),
+     NATIVE_METHOD(StringToReal, parseDblImpl, "(Ljava/lang/String;I)D"),
+ };
+diff --git a/luni/src/main/native/java_lang_invoke_MethodHandle.cpp b/luni/src/main/native/java_lang_invoke_MethodHandle.cpp
+index 0441d4552dc..3335c6de9ac 100644
+--- a/luni/src/main/native/java_lang_invoke_MethodHandle.cpp
++++ b/luni/src/main/native/java_lang_invoke_MethodHandle.cpp
+@@ -29,7 +29,7 @@ static jobject MethodHandle_invoke(JNIEnv* env, jobject, jobjectArray) {
+     return nullptr;
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+     NATIVE_METHOD(MethodHandle, invokeExact, "([Ljava/lang/Object;)Ljava/lang/Object;"),
+     NATIVE_METHOD(MethodHandle, invoke, "([Ljava/lang/Object;)Ljava/lang/Object;"),
+ };
+diff --git a/luni/src/main/native/java_lang_invoke_VarHandle.cpp b/luni/src/main/native/java_lang_invoke_VarHandle.cpp
+index e1cc1c7f8b5..9f5215a5204 100644
+--- a/luni/src/main/native/java_lang_invoke_VarHandle.cpp
++++ b/luni/src/main/native/java_lang_invoke_VarHandle.cpp
+@@ -210,7 +210,7 @@ static jboolean VarHandle_weakCompareAndSetRelease(JNIEnv* env, jobject, jobject
+   return JNI_FALSE;
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+   NATIVE_METHOD(VarHandle, compareAndExchange, "([Ljava/lang/Object;)Ljava/lang/Object;"),
+   NATIVE_METHOD(VarHandle, compareAndExchangeAcquire, "([Ljava/lang/Object;)Ljava/lang/Object;"),
+   NATIVE_METHOD(VarHandle, compareAndExchangeRelease, "([Ljava/lang/Object;)Ljava/lang/Object;"),
+diff --git a/luni/src/main/native/libcore_icu_ICU.cpp b/luni/src/main/native/libcore_icu_ICU.cpp
+index f9401d1edb7..1531ad1ca59 100644
+--- a/luni/src/main/native/libcore_icu_ICU.cpp
++++ b/luni/src/main/native/libcore_icu_ICU.cpp
+@@ -112,7 +112,7 @@ static jstring ICU_getUnicodeVersion(JNIEnv* env, jclass) {
+     return versionString(env, unicodeVersion);
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+     NATIVE_METHOD(ICU, getAvailableLocalesNative, "()[Ljava/lang/String;"),
+     NATIVE_METHOD(ICU, getCldrVersion, "()Ljava/lang/String;"),
+     NATIVE_METHOD(ICU, getDefaultLocale, "()Ljava/lang/String;"),
+diff --git a/luni/src/main/native/libcore_io_AsynchronousCloseMonitor.cpp b/luni/src/main/native/libcore_io_AsynchronousCloseMonitor.cpp
+index e99edd6c4f9..61b75bcd358 100644
+--- a/luni/src/main/native/libcore_io_AsynchronousCloseMonitor.cpp
++++ b/luni/src/main/native/libcore_io_AsynchronousCloseMonitor.cpp
+@@ -26,7 +26,7 @@ static void AsynchronousCloseMonitor_signalBlockedThreads(JNIEnv* env, jclass, j
+     AsynchronousCloseMonitor::signalBlockedThreads(fd);
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+     NATIVE_METHOD(AsynchronousCloseMonitor, signalBlockedThreads, "(Ljava/io/FileDescriptor;)V"),
+ };
+ void register_libcore_io_AsynchronousCloseMonitor(JNIEnv* env) {
+diff --git a/luni/src/main/native/libcore_io_Linux.cpp b/luni/src/main/native/libcore_io_Linux.cpp
+index e8ed90e7a2c..0115e31d22d 100755
+--- a/luni/src/main/native/libcore_io_Linux.cpp
++++ b/luni/src/main/native/libcore_io_Linux.cpp
+@@ -2758,7 +2758,7 @@ static jint Linux_writev(JNIEnv* env, jobject, jobject javaFd, jobjectArray buff
+ #define NATIVE_METHOD_OVERLOAD(className, functionName, signature, variant) \
+     { #functionName, signature, reinterpret_cast<void*>(className ## _ ## functionName ## variant) }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+     NATIVE_METHOD(Linux, accept, "(Ljava/io/FileDescriptor;Ljava/net/SocketAddress;)Ljava/io/FileDescriptor;"),
+     NATIVE_METHOD(Linux, access, "(Ljava/lang/String;I)Z"),
+     NATIVE_METHOD(Linux, android_fdsan_exchange_owner_tag, "(Ljava/io/FileDescriptor;JJ)V"),
+diff --git a/luni/src/main/native/libcore_io_Memory.cpp b/luni/src/main/native/libcore_io_Memory.cpp
+index 851cb9fc4a7..72c71b7553d 100644
+--- a/luni/src/main/native/libcore_io_Memory.cpp
++++ b/luni/src/main/native/libcore_io_Memory.cpp
+@@ -242,7 +242,7 @@ static void Memory_unsafeBulkPut(JNIEnv* env, jclass, jbyteArray dstArray, jint
+ }
+ 
+ // The remaining Memory methods are contained in art/runtime/native/libcore_io_Memory.cc
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+     NATIVE_METHOD(Memory, memmove, "(Ljava/lang/Object;ILjava/lang/Object;IJ)V"),
+     FAST_NATIVE_METHOD(Memory, peekByte, "(J)B"),
+     FAST_NATIVE_METHOD(Memory, peekIntNative, "(J)I"),
+diff --git a/luni/src/main/native/libcore_math_NativeBN.cpp b/luni/src/main/native/libcore_math_NativeBN.cpp
+index dc4b947358b..c6af376f6bc 100644
+--- a/luni/src/main/native/libcore_math_NativeBN.cpp
++++ b/luni/src/main/native/libcore_math_NativeBN.cpp
+@@ -164,7 +164,7 @@ static void NativeBN_BN_mod_exp(JNIEnv* env, jclass, jlong r, jlong a, jlong p,
+   }
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+    NATIVE_METHOD(NativeBN, BN_div, "(JJJJ)V"),
+    NATIVE_METHOD(NativeBN, BN_free, "(J)V"),
+    NATIVE_METHOD(NativeBN, BN_mod_exp, "(JJJJ)V"),
+diff --git a/luni/src/main/native/libcore_util_NativeAllocationRegistry.cpp b/luni/src/main/native/libcore_util_NativeAllocationRegistry.cpp
+index ded578a9580..faaa5c7a7c4 100644
+--- a/luni/src/main/native/libcore_util_NativeAllocationRegistry.cpp
++++ b/luni/src/main/native/libcore_util_NativeAllocationRegistry.cpp
+@@ -29,7 +29,7 @@ static void NativeAllocationRegistry_applyFreeFunction(JNIEnv*,
+     nativeFreeFunction(nativePtr);
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+     NATIVE_METHOD(NativeAllocationRegistry, applyFreeFunction, "(JJ)V"),
+ };
+ 
+diff --git a/luni/src/main/native/org_apache_harmony_xml_ExpatParser.cpp b/luni/src/main/native/org_apache_harmony_xml_ExpatParser.cpp
+index fdabcf71591..62a2cd37b76 100644
+--- a/luni/src/main/native/org_apache_harmony_xml_ExpatParser.cpp
++++ b/luni/src/main/native/org_apache_harmony_xml_ExpatParser.cpp
+@@ -1366,7 +1366,7 @@ static void ExpatParser_staticInitialize(JNIEnv* env, jobject classObject, jstri
+     emptyString = reinterpret_cast<jstring>(env->NewGlobalRef(empty));
+ }
+ 
+-static JNINativeMethod parserMethods[] = {
++static const JNINativeMethod parserMethods[] = {
+     NATIVE_METHOD(ExpatParser, appendString, "(JLjava/lang/String;Z)V"),
+     NATIVE_METHOD(ExpatParser, appendBytes, "(J[BII)V"),
+     NATIVE_METHOD(ExpatParser, appendChars, "(J[CII)V"),
+@@ -1380,7 +1380,7 @@ static JNINativeMethod parserMethods[] = {
+     NATIVE_METHOD(ExpatParser, staticInitialize, "(Ljava/lang/String;)V"),
+ };
+ 
+-static JNINativeMethod attributeMethods[] = {
++static const JNINativeMethod attributeMethods[] = {
+     NATIVE_METHOD(ExpatAttributes, freeAttributes, "(J)V"),
+     NATIVE_METHOD(ExpatAttributes, getIndexForQName, "(JLjava/lang/String;)I"),
+     NATIVE_METHOD(ExpatAttributes, getIndex, "(JLjava/lang/String;Ljava/lang/String;)I"),
+diff --git a/luni/src/main/native/sun_misc_Unsafe.cpp b/luni/src/main/native/sun_misc_Unsafe.cpp
+index 49848a2db2b..87b2feac807 100644
+--- a/luni/src/main/native/sun_misc_Unsafe.cpp
++++ b/luni/src/main/native/sun_misc_Unsafe.cpp
+@@ -23,7 +23,7 @@ static jobject Unsafe_allocateInstance(JNIEnv* env, jclass, jclass c) {
+   return env->AllocObject(c);
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+   NATIVE_METHOD(Unsafe, allocateInstance, "(Ljava/lang/Class;)Ljava/lang/Object;"),
+ };
+ void register_sun_misc_Unsafe(JNIEnv* env) {
+diff --git a/ojluni/src/main/native/Character.cpp b/ojluni/src/main/native/Character.cpp
+index 3e27c674d2f..719190c81ae 100644
+--- a/ojluni/src/main/native/Character.cpp
++++ b/ojluni/src/main/native/Character.cpp
+@@ -158,7 +158,7 @@ Character_getNameImpl(JNIEnv* env, jclass, jint codePoint) {
+     return (U_FAILURE(status) || byteCount == 0) ? NULL : env->NewStringUTF(buf);
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+   FAST_NATIVE_METHOD(Character, digitImpl, "(II)I"),
+   FAST_NATIVE_METHOD(Character, getDirectionalityImpl, "(I)B"),
+   NATIVE_METHOD(Character, getNameImpl, "(I)Ljava/lang/String;"),
+diff --git a/ojluni/src/main/native/jdk_internal_misc_VM.cpp b/ojluni/src/main/native/jdk_internal_misc_VM.cpp
+index 8e413286798..9791a13b84f 100644
+--- a/ojluni/src/main/native/jdk_internal_misc_VM.cpp
++++ b/ojluni/src/main/native/jdk_internal_misc_VM.cpp
+@@ -29,7 +29,7 @@ JNIEXPORT jlong JNICALL VM_getNanoTimeAdjustment(jlong offsetInSeconds) {
+     return JVM_GetNanoTimeAdjustment(nullptr, nullptr, offsetInSeconds);
+ }
+ 
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+   CRITICAL_NATIVE_METHOD(VM, getNanoTimeAdjustment, "(J)J"),
+ };
+ 

Patches/LineageOS-20.0/android_libcore/0003-Exec_Based_Spawning-1.patch

@@ -0,0 +1,79 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Wed, 11 Sep 2019 13:46:38 +0300
+Subject: [PATCH] add parameter for avoiding full preload with exec
+
+---
+ api/module-lib-current.txt                    |  2 ++
+ .../main/java/dalvik/system/ZygoteHooks.java  | 24 +++++++++++++++++--
+ 2 files changed, 24 insertions(+), 2 deletions(-)
+
+diff --git a/api/module-lib-current.txt b/api/module-lib-current.txt
+index c85cffb885e..570df304548 100644
+--- a/api/module-lib-current.txt
++++ b/api/module-lib-current.txt
+@@ -365,7 +365,9 @@ package dalvik.system {
+   public final class ZygoteHooks {
+     method public static void gcAndFinalize();
+     method public static boolean isIndefiniteThreadSuspensionSafe();
++    method public static void onBeginPreload(boolean);
+     method public static void onBeginPreload();
++    method public static void onEndPreload(boolean);
+     method public static void onEndPreload();
+     method public static void postForkChild(int, boolean, boolean, String);
+     method public static void postForkCommon();
+diff --git a/dalvik/src/main/java/dalvik/system/ZygoteHooks.java b/dalvik/src/main/java/dalvik/system/ZygoteHooks.java
+index bfe19454d07..b770e02a906 100644
+--- a/dalvik/src/main/java/dalvik/system/ZygoteHooks.java
++++ b/dalvik/src/main/java/dalvik/system/ZygoteHooks.java
+@@ -65,7 +65,7 @@ public final class ZygoteHooks {
+      * @hide
+      */
+     @SystemApi(client = MODULE_LIBRARIES)
+-    public static void onBeginPreload() {
++    public static void onBeginPreload(boolean fullPreload) {
+         com.android.i18n.system.ZygoteHooks.onBeginPreload();
+ 
+         ICU.initializeCacheInZygote();
+@@ -86,13 +86,23 @@ public final class ZygoteHooks {
+         }
+     }
+ 
++    /**
++     * Called when the zygote begins preloading classes and data.
++     *
++     * @hide
++     */
++    @SystemApi(client = MODULE_LIBRARIES)
++    public static void onBeginPreload() {
++        onBeginPreload(true);
++    }
++
+     /**
+      * Called when the zygote has completed preloading classes and data.
+      *
+      * @hide
+      */
+     @SystemApi(client = MODULE_LIBRARIES)
+-    public static void onEndPreload() {
++    public static void onEndPreload(boolean fullPreload) {
+         com.android.i18n.system.ZygoteHooks.onEndPreload();
+ 
+         // Clone standard descriptors as originals closed / rebound during zygote post fork.
+@@ -101,6 +111,16 @@ public final class ZygoteHooks {
+         FileDescriptor.err.cloneForFork();
+     }
+ 
++    /**
++     * Called when the zygote has completed preloading classes and data.
++     *
++     * @hide
++     */
++    @SystemApi(client = MODULE_LIBRARIES)
++    public static void onEndPreload() {
++        onEndPreload(true);
++    }
++
+     /**
+      * Called after GC but before fork, it cleans stale cache entries in
+      * BaseLocale and Locale, so to avoid the cleaning to happen in every

Patches/LineageOS-20.0/android_libcore/0003-Exec_Based_Spawning-2.patch

@@ -0,0 +1,42 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Fri, 15 Oct 2021 00:00:10 +0300
+Subject: [PATCH] disable cache pinning for exec spawning
+
+---
+ .../src/main/java/dalvik/system/ZygoteHooks.java   | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/dalvik/src/main/java/dalvik/system/ZygoteHooks.java b/dalvik/src/main/java/dalvik/system/ZygoteHooks.java
+index b770e02a906..70743a320a5 100644
+--- a/dalvik/src/main/java/dalvik/system/ZygoteHooks.java
++++ b/dalvik/src/main/java/dalvik/system/ZygoteHooks.java
+@@ -66,11 +66,13 @@ public final class ZygoteHooks {
+      */
+     @SystemApi(client = MODULE_LIBRARIES)
+     public static void onBeginPreload(boolean fullPreload) {
+-        com.android.i18n.system.ZygoteHooks.onBeginPreload();
++        if (fullPreload) {
++            com.android.i18n.system.ZygoteHooks.onBeginPreload();
+ 
+-        ICU.initializeCacheInZygote();
+-        DecimalFormatData.initializeCacheInZygote();
+-        SimpleDateFormatData.initializeCacheInZygote();
++            ICU.initializeCacheInZygote();
++            DecimalFormatData.initializeCacheInZygote();
++            SimpleDateFormatData.initializeCacheInZygote();
++        }
+ 
+         // Look up JaCoCo on the boot classpath, if it exists. This will be used later for enabling
+         // memory-mapped Java coverage.
+@@ -103,7 +105,9 @@ public final class ZygoteHooks {
+      */
+     @SystemApi(client = MODULE_LIBRARIES)
+     public static void onEndPreload(boolean fullPreload) {
+-        com.android.i18n.system.ZygoteHooks.onEndPreload();
++        if (fullPreload) {
++            com.android.i18n.system.ZygoteHooks.onEndPreload();
++        }
+ 
+         // Clone standard descriptors as originals closed / rebound during zygote post fork.
+         FileDescriptor.in.cloneForFork();

Patches/LineageOS-20.0/android_packages_apps_Dialer/0001-Not_Private_Banner.patch

@@ -0,0 +1,185 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Torsten Grote <t@grobox.de>
+Date: Thu, 18 Jun 2020 13:15:16 -0300
+Subject: [PATCH] Show privacy warning on in-call screen
+
+Includes:
+Author: Chirayu Desai <chirayudesai1@gmail.com>
+Date:   Tue Jul 28 02:23:37 2020 +0530
+
+    Move the incall warning back to the center
+
+    * Instead of left/started aligned.
+
+Change-Id: Ic9b18c110481df7042ca1daa36182e0999fe948f
+---
+ .../res/drawable/ic_baseline_warning.xml      |  9 +++++
+ .../dialer/theme/common/res/values/colors.xml |  1 +
+ .../res/layout/fragment_incoming_call.xml     |  7 +++-
+ .../contactgrid/res/layout/incall_header.xml  | 39 +++++++++++++++++++
+ .../impl/res/layout/frag_incall_voice.xml     |  7 ++++
+ .../android/incallui/res/values/strings.xml   |  3 ++
+ .../incallui/theme/res/values/styles.xml      |  4 +-
+ 7 files changed, 67 insertions(+), 3 deletions(-)
+ create mode 100644 java/com/android/dialer/common/res/drawable/ic_baseline_warning.xml
+ create mode 100644 java/com/android/incallui/contactgrid/res/layout/incall_header.xml
+
+diff --git a/java/com/android/dialer/common/res/drawable/ic_baseline_warning.xml b/java/com/android/dialer/common/res/drawable/ic_baseline_warning.xml
+new file mode 100644
+index 000000000..c2baa9bdb
+--- /dev/null
++++ b/java/com/android/dialer/common/res/drawable/ic_baseline_warning.xml
+@@ -0,0 +1,9 @@
++<?xml version="1.0" encoding="utf-8"?>
++<vector xmlns:android="http://schemas.android.com/apk/res/android"
++        android:height="16dp"
++        android:width="16dp"
++        android:viewportWidth="24"
++        android:viewportHeight="24">
++  <path android:fillColor="?attr/colorControlNormal"
++        android:pathData="M13,14H11V10H13M13,18H11V16H13M1,21H23L12,2L1,21Z"/>
++</vector>
+\ No newline at end of file
+diff --git a/java/com/android/dialer/theme/common/res/values/colors.xml b/java/com/android/dialer/theme/common/res/values/colors.xml
+index 1831862b1..6f6795cea 100644
+--- a/java/com/android/dialer/theme/common/res/values/colors.xml
++++ b/java/com/android/dialer/theme/common/res/values/colors.xml
+@@ -21,6 +21,7 @@
+   <color name="dialer_divider_line_color">#D8D8D8</color>
+   <color name="dialer_link_color">#2A56C6</color>
+   <color name="dialer_snackbar_action_text_color">#4285F4</color>
++  <color name="incall_header_background">#f3b514</color>
+ 
+   <!-- Colors for the notification actions -->
+   <color name="notification_action_accept">#097138</color>
+diff --git a/java/com/android/incallui/answer/impl/res/layout/fragment_incoming_call.xml b/java/com/android/incallui/answer/impl/res/layout/fragment_incoming_call.xml
+index 1672bf984..63de75999 100644
+--- a/java/com/android/incallui/answer/impl/res/layout/fragment_incoming_call.xml
++++ b/java/com/android/incallui/answer/impl/res/layout/fragment_incoming_call.xml
+@@ -78,18 +78,23 @@
+         android:id="@+id/incall_contact_grid"
+         android:layout_width="match_parent"
+         android:layout_height="match_parent"
+-        android:layout_marginTop="24dp"
+         android:clipChildren="false"
+         android:clipToPadding="false"
+         android:focusable="true"
+         android:gravity="top|center_horizontal"
+         android:orientation="vertical">
+ 
++      <include
++          layout="@layout/incall_header"
++          android:layout_width="match_parent"
++          android:layout_height="wrap_content"/>
++
+       <include
+           android:id="@id/contactgrid_top_row"
+           layout="@layout/incall_contactgrid_top_row"
+           android:layout_width="wrap_content"
+           android:layout_height="wrap_content"
++          android:layout_marginTop="24dp"
+           android:layout_marginBottom="8dp"
+           android:layout_marginStart="24dp"
+           android:layout_marginEnd="24dp"/>
+diff --git a/java/com/android/incallui/contactgrid/res/layout/incall_header.xml b/java/com/android/incallui/contactgrid/res/layout/incall_header.xml
+new file mode 100644
+index 000000000..7e8e90e5d
+--- /dev/null
++++ b/java/com/android/incallui/contactgrid/res/layout/incall_header.xml
+@@ -0,0 +1,39 @@
++<?xml version="1.0" encoding="utf-8"?>
++<!--
++  ~ Copyright (C) 2020 The Calyx Institute
++  ~
++  ~ Licensed under the Apache License, Version 2.0 (the "License");
++  ~ you may not use this file except in compliance with the License.
++  ~ You may obtain a copy of the License at
++  ~
++  ~      http://www.apache.org/licenses/LICENSE-2.0
++  ~
++  ~ Unless required by applicable law or agreed to in writing, software
++  ~ distributed under the License is distributed on an "AS IS" BASIS,
++  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++  ~ See the License for the specific language governing permissions and
++  ~ limitations under the License
++  -->
++<LinearLayout
++    xmlns:android="http://schemas.android.com/apk/res/android"
++    android:layout_width="match_parent"
++    android:layout_height="wrap_content"
++    android:background="@color/incall_header_background"
++    android:gravity="center"
++    android:orientation="vertical"
++    android:padding="8dp"
++    android:fitsSystemWindows="true">
++
++  <TextView
++      android:id="@+id/incall_privacy_title"
++      android:layout_width="wrap_content"
++      android:layout_height="wrap_content"
++      android:textColor="?android:attr/textColorPrimaryInverse"
++      android:drawableStart="@drawable/ic_baseline_warning"
++      android:drawablePadding="8dp"
++      android:drawableTint="?android:attr/textColorPrimaryInverse"
++      android:gravity="center"
++      android:padding="4dp"
++      android:text="@string/incall_screen_privacy_data_collection"/>
++
++</LinearLayout>
+diff --git a/java/com/android/incallui/incall/impl/res/layout/frag_incall_voice.xml b/java/com/android/incallui/incall/impl/res/layout/frag_incall_voice.xml
+index 9cc599dc7..fac420908 100644
+--- a/java/com/android/incallui/incall/impl/res/layout/frag_incall_voice.xml
++++ b/java/com/android/incallui/incall/impl/res/layout/frag_incall_voice.xml
+@@ -29,11 +29,18 @@
+       android:clipToPadding="false"
+       android:fitsSystemWindows="true">
+ 
++    <include
++        layout="@layout/incall_header"
++        android:id="@+id/incall_header"
++        android:layout_width="match_parent"
++        android:layout_height="wrap_content"/>
++
+     <LinearLayout
+         android:id="@id/incall_contact_grid"
+         android:layout_width="match_parent"
+         android:layout_height="wrap_content"
+         android:layout_marginTop="12dp"
++        android:layout_below="@+id/incall_header"
+         android:gravity="center_horizontal"
+         android:orientation="vertical">
+ 
+diff --git a/java/com/android/incallui/res/values/strings.xml b/java/com/android/incallui/res/values/strings.xml
+index c18ee495e..a5d08d3ec 100644
+--- a/java/com/android/incallui/res/values/strings.xml
++++ b/java/com/android/incallui/res/values/strings.xml
+@@ -212,4 +212,7 @@
+   <!-- Text for button to accept RTT request. [CHAR LIMIT=20] -->
+   <string name="rtt_button_accept_request">Join RTT</string>
+ 
++  <!-- Text for call not private banner. -->
++  <string name="incall_screen_privacy_data_collection">The location and audio of this call are not private.</string>
++
+ </resources>
+diff --git a/java/com/android/incallui/theme/res/values/styles.xml b/java/com/android/incallui/theme/res/values/styles.xml
+index 5b65cc3d9..19e7fdc4f 100644
+--- a/java/com/android/incallui/theme/res/values/styles.xml
++++ b/java/com/android/incallui/theme/res/values/styles.xml
+@@ -21,7 +21,7 @@
+        Theme.Black.NoTitleBar directly, since we want any popups or dialogs from the
+        InCallActivity to have the correct Material style. -->
+   <style name="Theme.InCallScreen.Light" parent="@style/Dialer.ThemeBase.NoActionBar">
+-    <item name="android:statusBarColor">@android:color/transparent</item>
++    <item name="android:statusBarColor">@color/incall_header_background</item>
+     <item name="android:navigationBarColor">@android:color/transparent</item>
+     <item name="android:windowDrawsSystemBarBackgrounds">true</item>
+ 
+@@ -36,7 +36,7 @@
+   <style name="Theme.InCallScreen" parent="@style/Dialer.Dark.ThemeBase.NoActionBar">
+     <item name="android:textColorPrimary">@android:color/white</item>
+     <item name="android:textColorSecondary">#DDFFFFFF</item>
+-    <item name="android:statusBarColor">@android:color/transparent</item>
++    <item name="android:statusBarColor">@color/incall_header_background</item>
+     <item name="android:navigationBarColor">@android:color/transparent</item>
+     <item name="android:windowDrawsSystemBarBackgrounds">true</item>
+     <item name="android:colorPrimaryDark">@color/dialer_theme_color_dark</item>

Patches/LineageOS-20.0/android_packages_apps_LineageParts/0001-Remove_Analytics.patch

@@ -0,0 +1,140 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Tad <tad@spotco.us>
+Date: Tue, 14 Apr 2020 17:03:26 -0400
+Subject: [PATCH] Remove analytics
+
+Change-Id: Ic01c97d6ceac8d324609763973639b41b4581a76
+---
+ AndroidManifest.xml           | 25 -------------------------
+ proguard.flags                |  1 -
+ res/values/config.xml         |  3 ---
+ res/values/strings.xml        | 22 ----------------------
+ res/xml/parts_catalog.xml     |  5 -----
+ res/xml/trust_preferences.xml |  3 ---
+ 6 files changed, 59 deletions(-)
+
+diff --git a/AndroidManifest.xml b/AndroidManifest.xml
+index b266fb7..5370ad8 100644
+--- a/AndroidManifest.xml
++++ b/AndroidManifest.xml
+@@ -226,31 +226,6 @@
+                 android:resource="@string/summary_empty" />
+         </activity-alias>
+ 
+-        <!-- Anonymous Statistics -->
+-        <receiver android:name=".lineagestats.ReportingServiceManager"
+-            android:enabled="true"
+-            android:exported="false"
+-            android:label="ReportingServiceManager">
+-            <intent-filter>
+-                <action android:name="android.intent.action.BOOT_COMPLETED" />
+-                <action android:name="org.lineageos.lineageparts.action.TRIGGER_REPORT_METRICS" />
+-            </intent-filter>
+-        </receiver>
+-
+-        <service android:label="ReportingService"
+-            android:enabled="true"
+-            android:exported="false"
+-            android:name=".lineagestats.ReportingService">
+-        </service>
+-
+-        <service android:name=".lineagestats.StatsUploadJobService"
+-                 android:permission="android.permission.BIND_JOB_SERVICE" />
+-
+-        <service android:name=".lineagestats.ReportingService"
+-                 android:label="ReportingService"
+-                 android:enabled="true"
+-                 android:exported="false" />
+-
+         <activity android:name=".profiles.NFCProfile">
+             <intent-filter>
+                 <action android:name="android.nfc.action.NDEF_DISCOVERED"/>
+diff --git a/proguard.flags b/proguard.flags
+index 9de6495..911b751 100644
+--- a/proguard.flags
++++ b/proguard.flags
+@@ -7,7 +7,6 @@
+ -keep class org.lineageos.lineageparts.gestures.*
+ -keep class org.lineageos.lineageparts.hardware.*
+ -keep class org.lineageos.lineageparts.input.*
+--keep class org.lineageos.lineageparts.lineagestats.*
+ -keep class org.lineageos.lineageparts.livedisplay.*
+ -keep class org.lineageos.lineageparts.notificationlight.*
+ -keep class org.lineageos.lineageparts.power.*
+diff --git a/res/values/config.xml b/res/values/config.xml
+index a3ee437..c4532c5 100644
+--- a/res/values/config.xml
++++ b/res/values/config.xml
+@@ -17,9 +17,6 @@
+ 
+ <resources xmlns:xliff="urn:oasis:names:tc:xliff:document:1.2">
+ 
+-    <!-- Metrics server endpoint -->
+-    <string name="stats_lineage_url">https://stats.lineageos.org/api/v1/stats</string>
+-
+     <!-- Default action ids for a device's touchscreen gestures
+          The array should be sorted in the same order as the
+          touchscreen gestures advertised by the device's LineageHW impl. -->
+diff --git a/res/values/strings.xml b/res/values/strings.xml
+index 02a5316..a806a7c 100644
+--- a/res/values/strings.xml
++++ b/res/values/strings.xml
+@@ -533,28 +533,6 @@
+                  <b>Total commits:</b> <xliff:g id="total_commits">%2$s</xliff:g><br/><br/>
+                  <b>Last update:</b> <xliff:g id="date">%3$s</xliff:g>]]></string>
+ 
+-    <!-- Anonymous Statistics #Lineage -->
+-    <!-- About device screen, list item title. Takes the user to the screen about opting in or out of anonymous statistics. -->
+-    <string name="anonymous_statistics_title">LineageOS statistics</string>
+-    <string name="anonymous_statistics_summary">Help make LineageOS better by opting into anonymous statistics reporting</string>
+-    <string name="anonymous_statistics_warning_title">About</string>
+-    <string name="anonymous_statistics_warning">Opting into LineageOS Statistics will allow non-personal data to be submitted to the
+-        developers of LineageOS to track unique installations across devices. The information submitted includes an unique identifier,
+-        which does not compromise your privacy or personal data. The data is submitted during each boot.\n\nFor an example of the data that is submitted, tap on Preview Data.</string>
+-    <string name="enable_reporting_title">Enable reporting</string>
+-    <string name="preview_data_title">Preview data</string>
+-    <string name="view_stats_title">View stats</string>
+-    <string name="anonymous_learn_more">Learn more</string>
+-
+-    <!-- Anonymous Statistics - Preview -->
+-    <string name="preview_id_title">Unique ID</string>
+-    <string name="preview_device_title">Device</string>
+-    <string name="preview_version_title">Version</string>
+-    <string name="preview_country_title">Country</string>
+-    <string name="preview_carrier_title">Carrier</string>
+-    <string name="stats_collection_title">Stats collection</string>
+-    <string name="stats_collection_summary">Allow installation metrics and device statistics to be collected</string>
+-
+     <!-- Display : Rotation  -->
+     <string name="accelerometer_title">Auto-rotate screen</string>
+     <string name="display_rotation_title">Rotation settings</string>
+diff --git a/res/xml/parts_catalog.xml b/res/xml/parts_catalog.xml
+index 9711b21..414640e 100644
+--- a/res/xml/parts_catalog.xml
++++ b/res/xml/parts_catalog.xml
+@@ -70,11 +70,6 @@
+           android:fragment="org.lineageos.lineageparts.statusbar.StatusBarSettings"
+           lineage:xmlRes="@xml/status_bar_settings" />
+ 
+-    <part android:key="lineagestats"
+-          android:title="@string/anonymous_statistics_title"
+-          android:fragment="org.lineageos.lineageparts.lineagestats.AnonymousStats"
+-          lineage:xmlRes="@xml/anonymous_stats" />
+-
+     <part android:key="power_menu"
+           android:title="@string/power_menu_title"
+           android:fragment="org.lineageos.lineageparts.input.PowerMenuActions"
+diff --git a/res/xml/trust_preferences.xml b/res/xml/trust_preferences.xml
+index 7cebff4..3b89030 100644
+--- a/res/xml/trust_preferences.xml
++++ b/res/xml/trust_preferences.xml
+@@ -47,9 +47,6 @@
+             android:entryValues="@array/trust_restrict_usb_values"
+             android:defaultValue="0" />
+ 
+-        <lineageos.preference.LineagePartsPreference
+-            android:key="lineagestats" />
+-
+         <ListPreference
+             android:key="sms_security_check_limit"
+             android:defaultValue="30"

Patches/LineageOS-20.0/android_packages_apps_Nfc/0001-constify_JNINativeMethod.patch

@@ -0,0 +1,92 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Sun, 17 Mar 2019 20:58:37 -0400
+Subject: [PATCH] constify JNINativeMethod tables
+
+---
+ nci/jni/NativeLlcpConnectionlessSocket.cpp | 2 +-
+ nci/jni/NativeLlcpServiceSocket.cpp        | 2 +-
+ nci/jni/NativeLlcpSocket.cpp               | 2 +-
+ nci/jni/NativeNfcManager.cpp               | 2 +-
+ nci/jni/NativeNfcTag.cpp                   | 2 +-
+ nci/jni/NativeP2pDevice.cpp                | 2 +-
+ 6 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/nci/jni/NativeLlcpConnectionlessSocket.cpp b/nci/jni/NativeLlcpConnectionlessSocket.cpp
+index 7506d80e..e1e547ec 100644
+--- a/nci/jni/NativeLlcpConnectionlessSocket.cpp
++++ b/nci/jni/NativeLlcpConnectionlessSocket.cpp
+@@ -280,7 +280,7 @@ static jboolean nativeLlcpConnectionlessSocket_doClose(JNIEnv* e, jobject o) {
+ ** Description:     JNI functions
+ **
+ *****************************************************************************/
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+     {"doSendTo", "(I[B)Z", (void*)nativeLlcpConnectionlessSocket_doSendTo},
+     {"doReceiveFrom", "(I)Lcom/android/nfc/LlcpPacket;",
+      (void*)nativeLlcpConnectionlessSocket_doReceiveFrom},
+diff --git a/nci/jni/NativeLlcpServiceSocket.cpp b/nci/jni/NativeLlcpServiceSocket.cpp
+index 1000deef..e2753daf 100644
+--- a/nci/jni/NativeLlcpServiceSocket.cpp
++++ b/nci/jni/NativeLlcpServiceSocket.cpp
+@@ -129,7 +129,7 @@ static jboolean nativeLlcpServiceSocket_doClose(JNIEnv* e, jobject o) {
+ ** Description:     JNI functions
+ **
+ *****************************************************************************/
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+     {"doAccept", "(III)Lcom/android/nfc/dhimpl/NativeLlcpSocket;",
+      (void*)nativeLlcpServiceSocket_doAccept},
+     {"doClose", "()Z", (void*)nativeLlcpServiceSocket_doClose},
+diff --git a/nci/jni/NativeLlcpSocket.cpp b/nci/jni/NativeLlcpSocket.cpp
+index 0ee0d248..fa49ec94 100644
+--- a/nci/jni/NativeLlcpSocket.cpp
++++ b/nci/jni/NativeLlcpSocket.cpp
+@@ -214,7 +214,7 @@ static jint nativeLlcpSocket_doGetRemoteSocketRW(JNIEnv* e, jobject o) {
+ ** Description:     JNI functions
+ **
+ *****************************************************************************/
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+     {"doConnect", "(I)Z", (void*)nativeLlcpSocket_doConnect},
+     {"doConnectBy", "(Ljava/lang/String;)Z",
+      (void*)nativeLlcpSocket_doConnectBy},
+diff --git a/nci/jni/NativeNfcManager.cpp b/nci/jni/NativeNfcManager.cpp
+index 445a5ddc..5bae5af0 100644
+--- a/nci/jni/NativeNfcManager.cpp
++++ b/nci/jni/NativeNfcManager.cpp
+@@ -2202,7 +2202,7 @@ static jbyteArray nfcManager_doGetRoutingTable(JNIEnv* e, jobject o) {
+ ** JNI functions for android-4.0.1_r1
+ **
+ *****************************************************************************/
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+     {"doDownload", "()Z", (void*)nfcManager_doDownload},
+ 
+     {"initializeNativeStructure", "()Z", (void*)nfcManager_initNativeStruc},
+diff --git a/nci/jni/NativeNfcTag.cpp b/nci/jni/NativeNfcTag.cpp
+index a99dc941..68b59619 100644
+--- a/nci/jni/NativeNfcTag.cpp
++++ b/nci/jni/NativeNfcTag.cpp
+@@ -1873,7 +1873,7 @@ void nativeNfcTag_releaseRfInterfaceMutexLock() {
+ ** JNI functions for Android 4.0.3
+ **
+ *****************************************************************************/
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+     {"doConnect", "(I)I", (void*)nativeNfcTag_doConnect},
+     {"doDisconnect", "()Z", (void*)nativeNfcTag_doDisconnect},
+     {"doReconnect", "()I", (void*)nativeNfcTag_doReconnect},
+diff --git a/nci/jni/NativeP2pDevice.cpp b/nci/jni/NativeP2pDevice.cpp
+index 23f5db41..396c6d0c 100644
+--- a/nci/jni/NativeP2pDevice.cpp
++++ b/nci/jni/NativeP2pDevice.cpp
+@@ -58,7 +58,7 @@ static jboolean nativeP2pDeviceDoSend(JNIEnv*, jobject, jbyteArray) {
+ ** Description:     JNI functions
+ **
+ *****************************************************************************/
+-static JNINativeMethod gMethods[] = {
++static const JNINativeMethod gMethods[] = {
+     {"doConnect", "()Z", (void*)nativeP2pDeviceDoConnect},
+     {"doDisconnect", "()Z", (void*)nativeP2pDeviceDoDisconnect},
+     {"doTransceive", "([B)[B", (void*)nativeP2pDeviceDoTransceive},

Patches/LineageOS-20.0/android_packages_apps_Settings/0005-Automatic_Reboot.patch

@@ -0,0 +1,196 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: pratyush <codelab@pratyush.dev>
+Date: Mon, 7 Jun 2021 22:15:59 +0100
+Subject: [PATCH] add auto-reboot setting
+
+---
+ res/values/arrays.xml                         | 31 +++++++
+ res/values/strings.xml                        |  3 +
+ res/xml/security_dashboard_settings.xml       | 10 ++-
+ .../AutoRebootPreferenceController.java       | 82 +++++++++++++++++++
+ .../settings/security/SecuritySettings.java   |  1 +
+ 5 files changed, 126 insertions(+), 1 deletion(-)
+ create mode 100644 src/com/android/settings/security/AutoRebootPreferenceController.java
+
+diff --git a/res/values/arrays.xml b/res/values/arrays.xml
+index 0632f72eb0..35e3247663 100644
+--- a/res/values/arrays.xml
++++ b/res/values/arrays.xml
+@@ -158,6 +158,37 @@
+         <item>1800000</item>
+     </string-array>
+ 
++    <!-- Auto reboot settings -->
++    <string-array name="auto_reboot_entries">
++        <item>Off</item>
++        <item>10 minutes</item>
++        <item>30 minutes</item>
++        <item>1 hour</item>
++        <item>2 hours</item>
++        <item>4 hours</item>
++        <item>8 hours</item>
++        <item>12 hours</item>
++        <item>24 hours</item>
++        <item>36 hours</item>
++        <item>48 hours</item>
++        <item>72 hours</item>
++    </string-array>
++
++    <string-array name="auto_reboot_values" translatable="false">
++        <item>0</item>  <!-- Disabled -->
++        <item>600000</item>
++        <item>1800000</item>
++        <item>3600000</item>
++        <item>7200000</item>
++        <item>14400000</item>
++        <item>28800000</item>
++        <item>43200000</item>
++        <item>86400000</item>
++        <item>129600000</item>
++        <item>172800000</item>
++        <item>259200000</item>
++    </string-array>
++
+     <string-array name="entries_font_size">
+         <item msgid="6490061470416867723">Small</item>
+         <item msgid="3579015730662088893">Default</item>
+diff --git a/res/values/strings.xml b/res/values/strings.xml
+index 02a145b188..b8cfb4a71b 100644
+--- a/res/values/strings.xml
++++ b/res/values/strings.xml
+@@ -696,6 +696,9 @@
+     <!-- Summary for settings checkbox to disable widgets when the setting has been disabled by an installed device admin [CHAR LIMIT=50] -->
+     <string name="security_enable_widgets_disabled_summary">Disabled by admin</string>
+ 
++    <string name="auto_reboot_title">Auto reboot</string>
++    <string name="auto_reboot_summary">Automatically reboot the device, if the phone hasn\'t been unlocked within the selected number of hours.</string>
++
+     <!-- Text shown for the title of the lock when trust lost option [CHAR LIMIT=40] -->
+     <string name="trust_lost_locks_screen_title">Lock screen when trust is lost</string>
+     <!-- Text shown for the description of the lock when trust lost option [CHAR LIMIT=NONE -->
+diff --git a/res/xml/security_dashboard_settings.xml b/res/xml/security_dashboard_settings.xml
+index 0550441d3f..d0aeb27fe5 100644
+--- a/res/xml/security_dashboard_settings.xml
++++ b/res/xml/security_dashboard_settings.xml
+@@ -60,6 +60,14 @@
+             android:title="@string/security_settings_biometric_preference_title"
+             android:summary="@string/summary_placeholder"
+             settings:keywords="@string/keywords_biometric_settings" />
++
++        <ListPreference
++            android:key="auto_reboot"
++            android:title="@string/auto_reboot_title"
++            android:summary="@string/auto_reboot_summary"
++            android:persistent="false"
++            android:entries="@array/auto_reboot_entries"
++            android:entryValues="@array/auto_reboot_values" />
+     </PreferenceCategory>
+ 
+     <Preference
+@@ -71,4 +79,4 @@
+         settings:controller="com.android.settings.security.SecurityAdvancedSettingsController"
+         settings:keywords="@string/security_advanced_settings_keywords" />
+ 
+-</PreferenceScreen>
+\ No newline at end of file
++</PreferenceScreen>
+diff --git a/src/com/android/settings/security/AutoRebootPreferenceController.java b/src/com/android/settings/security/AutoRebootPreferenceController.java
+new file mode 100644
+index 0000000000..c7a75219a5
+--- /dev/null
++++ b/src/com/android/settings/security/AutoRebootPreferenceController.java
+@@ -0,0 +1,82 @@
++package com.android.settings.security;
++
++import android.content.Context;
++import android.os.UserManager;
++import android.provider.Settings;
++import android.util.Log;
++
++import androidx.preference.ListPreference;
++import androidx.preference.Preference;
++import androidx.preference.PreferenceCategory;
++import androidx.preference.PreferenceScreen;
++
++import com.android.settings.core.PreferenceControllerMixin;
++import com.android.settingslib.core.AbstractPreferenceController;
++import com.android.settingslib.core.lifecycle.events.OnResume;
++
++public class AutoRebootPreferenceController extends AbstractPreferenceController
++    implements PreferenceControllerMixin, OnResume,
++           Preference.OnPreferenceChangeListener {
++
++    private static final String KEY_AUTO_REBOOT = "auto_reboot";
++    private static final String PREF_KEY_SECURITY_CATEGORY = "security_category";
++
++    private PreferenceCategory mSecurityCategory;
++    private boolean mIsAdmin;
++    private final UserManager mUm;
++
++    public AutoRebootPreferenceController(Context context) {
++        super(context);
++        mUm = UserManager.get(context);
++    }
++
++    @Override
++    public void displayPreference(PreferenceScreen screen) {
++        super.displayPreference(screen);
++        mSecurityCategory = screen.findPreference(PREF_KEY_SECURITY_CATEGORY);
++        updatePreferenceState();
++    }
++
++    @Override
++    public boolean isAvailable() {
++        mIsAdmin = mUm.isAdminUser();
++        return mIsAdmin;
++    }
++
++    @Override
++    public String getPreferenceKey() {
++        return KEY_AUTO_REBOOT;
++    }
++
++    // TODO: should we use onCreatePreferences() instead?
++    private void updatePreferenceState() {
++        if (mSecurityCategory == null) {
++            return;
++        }
++
++        if (mIsAdmin) {
++            ListPreference autoReboot =
++                    (ListPreference) mSecurityCategory.findPreference(KEY_AUTO_REBOOT);
++            autoReboot.setValue(Long.toString(Settings.Global.getLong(
++                    mContext.getContentResolver(), Settings.Global.SETTINGS_REBOOT_AFTER_TIMEOUT, 0)));
++        } else {
++            mSecurityCategory.removePreference(
++                    mSecurityCategory.findPreference(KEY_AUTO_REBOOT));
++        }
++    }
++
++    @Override
++    public void onResume() {
++        updatePreferenceState();
++    }
++
++    @Override
++    public boolean onPreferenceChange(Preference preference, Object value) {
++        final String key = preference.getKey();
++        if (KEY_AUTO_REBOOT.equals(key) && mIsAdmin) {
++            long timeout = Long.parseLong((String) value);
++            Settings.Global.putLong(mContext.getContentResolver(), Settings.Global.SETTINGS_REBOOT_AFTER_TIMEOUT, timeout);
++        }
++        return true;
++    }
++}
+diff --git a/src/com/android/settings/security/SecuritySettings.java b/src/com/android/settings/security/SecuritySettings.java
+index 6aadee6aad..abc3dce662 100644
+--- a/src/com/android/settings/security/SecuritySettings.java
++++ b/src/com/android/settings/security/SecuritySettings.java
+@@ -105,6 +105,7 @@ public class SecuritySettings extends DashboardFragment {
+         securityPreferenceControllers.add(new CombinedBiometricStatusPreferenceController(
+                 context, lifecycle));
+         securityPreferenceControllers.add(new ChangeScreenLockPreferenceController(context, host));
++        securityPreferenceControllers.add(new AutoRebootPreferenceController(context));
+         controllers.add(new PreferenceCategoryController(context, SECURITY_CATEGORY)
+                 .setChildren(securityPreferenceControllers));
+         controllers.addAll(securityPreferenceControllers);

Patches/LineageOS-20.0/android_packages_apps_Settings/0006-Bluetooth_Timeout.patch

@@ -0,0 +1,238 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Oliver Scott <olivercscott@gmail.com>
+Date: Fri, 2 Oct 2020 12:37:30 -0400
+Subject: [PATCH] add bluetooth auto-turn-off setting
+
+---
+ res/values/arrays.xml                         |  44 +++++++
+ res/values/strings.xml                        |  19 +++
+ res/xml/connected_devices.xml                 |   8 ++
+ .../BluetoothTimeoutPreferenceController.java | 115 ++++++++++++++++++
+ 4 files changed, 186 insertions(+)
+ create mode 100644 src/com/android/settings/bluetooth/BluetoothTimeoutPreferenceController.java
+
+diff --git a/res/values/arrays.xml b/res/values/arrays.xml
+index 35e3247663..5adc98d256 100644
+--- a/res/values/arrays.xml
++++ b/res/values/arrays.xml
+@@ -39,6 +39,50 @@
+         <item>All</item>
+     </string-array>
+ 
++    <!-- Bluetooth settings.  The delay in inactivity before bluetooth is turned off. These are shown in a list dialog. -->
++    <string-array name="bluetooth_timeout_entries">
++        <item>@string/bluetooth_timeout_summary_never</item>
++        <item>@string/bluetooth_timeout_summary_15secs</item>
++        <item>@string/bluetooth_timeout_summary_30secs</item>
++        <item>@string/bluetooth_timeout_summary_1min</item>
++        <item>@string/bluetooth_timeout_summary_2mins</item>
++        <item>@string/bluetooth_timeout_summary_5mins</item>
++        <item>@string/bluetooth_timeout_summary_10mins</item>
++        <item>@string/bluetooth_timeout_summary_30mins</item>
++        <item>@string/bluetooth_timeout_summary_1hour</item>
++        <item>@string/bluetooth_timeout_summary_2hours</item>
++        <item>@string/bluetooth_timeout_summary_4hours</item>
++        <item>@string/bluetooth_timeout_summary_8hours</item>
++    </string-array>
++
++    <!-- Do not translate. -->
++    <string-array name="bluetooth_timeout_values" translatable="false">
++        <!-- Do not translate. -->
++        <item>0</item>
++        <!-- Do not translate. -->
++        <item>15000</item>
++        <!-- Do not translate. -->
++        <item>30000</item>
++        <!-- Do not translate. -->
++        <item>60000</item>
++        <!-- Do not translate. -->
++        <item>120000</item>
++        <!-- Do not translate. -->
++        <item>300000</item>
++        <!-- Do not translate. -->
++        <item>600000</item>
++        <!-- Do not translate. -->
++        <item>1800000</item>
++        <!-- Do not translate. -->
++        <item>3600000</item>
++        <!-- Do not translate. -->
++        <item>7200000</item>
++        <!-- Do not translate. -->
++        <item>14400000</item>
++        <!-- Do not translate. -->
++        <item>28800000</item>
++    </string-array>
++
+     <!-- Display settings.  The delay in inactivity before the screen is turned off. These are shown in a list dialog. -->
+     <string-array name="screen_timeout_entries">
+         <item>15 seconds</item>
+diff --git a/res/values/strings.xml b/res/values/strings.xml
+index b8cfb4a71b..a81f271aa3 100644
+--- a/res/values/strings.xml
++++ b/res/values/strings.xml
+@@ -27,6 +27,25 @@
+     <!-- Used in confirmation dialogs as the action that the user will tap to turn on the feature. [CHAR LIMIT=40]-->
+     <string name="confirmation_turn_on">Turn on</string>
+ 
++    <!-- Connected devices screen, setting option name to change bluetooth timeout -->
++    <string name="bluetooth_timeout">Bluetooth timeout</string>
++
++    <!-- Connected devices screen, setting option summary to change bluetooth timeout -->
++    <string name="bluetooth_timeout_summary">Bluetooth will turn off after <xliff:g id="timeout_description">%1$s</xliff:g> if no devices connected</string>
++    <string name="bluetooth_timeout_summary2">Do not automatically turn off Bluetooth</string>
++    <string name="bluetooth_timeout_summary_never">Never</string>
++    <string name="bluetooth_timeout_summary_15secs">15 seconds</string>
++    <string name="bluetooth_timeout_summary_30secs">30 seconds</string>
++    <string name="bluetooth_timeout_summary_1min">1 minute</string>
++    <string name="bluetooth_timeout_summary_2mins">2 minutes</string>
++    <string name="bluetooth_timeout_summary_5mins">5 minutes</string>
++    <string name="bluetooth_timeout_summary_10mins">10 minutes</string>
++    <string name="bluetooth_timeout_summary_30mins">30 minutes</string>
++    <string name="bluetooth_timeout_summary_1hour">1 hour</string>
++    <string name="bluetooth_timeout_summary_2hours">2 hours</string>
++    <string name="bluetooth_timeout_summary_4hours">4 hours</string>
++    <string name="bluetooth_timeout_summary_8hours">8 hours</string>
++
+     <!-- Device Info screen. Used for a status item's value when the proper value is not known -->
+     <string name="device_info_default">Unknown</string>
+     <!-- [CHAR LIMIT=NONE] Device Info screen. Countdown for user taps to enable development settings -->
+diff --git a/res/xml/connected_devices.xml b/res/xml/connected_devices.xml
+index a0e0a1f26d..ded58ebd41 100644
+--- a/res/xml/connected_devices.xml
++++ b/res/xml/connected_devices.xml
+@@ -47,6 +47,14 @@
+         settings:useAdminDisabledSummary="true"
+         settings:controller="com.android.settings.connecteddevice.AddDevicePreferenceController"/>
+ 
++    <androidx.preference.ListPreference
++        android:key="bluetooth_timeout"
++        android:title="@string/bluetooth_timeout"
++        android:summary="@string/summary_placeholder"
++        android:entries="@array/bluetooth_timeout_entries"
++        android:entryValues="@array/bluetooth_timeout_values"
++        settings:controller="com.android.settings.bluetooth.BluetoothTimeoutPreferenceController"/>
++
+     <PreferenceCategory
+         android:key="previously_connected_devices"
+         android:title="@string/connected_device_saved_title"
+diff --git a/src/com/android/settings/bluetooth/BluetoothTimeoutPreferenceController.java b/src/com/android/settings/bluetooth/BluetoothTimeoutPreferenceController.java
+new file mode 100644
+index 0000000000..244147948a
+--- /dev/null
++++ b/src/com/android/settings/bluetooth/BluetoothTimeoutPreferenceController.java
+@@ -0,0 +1,115 @@
++/*
++ * Copyright (C) 2020 The Calyx Institute
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License");
++ * you may not use this file except in compliance with the License.
++ * You may obtain a copy of the License at
++ *
++ *      http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software
++ * distributed under the License is distributed on an "AS IS" BASIS,
++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++ * See the License for the specific language governing permissions and
++ * limitations under the License.
++ */
++
++package com.android.settings.bluetooth;
++
++import android.bluetooth.BluetoothAdapter;
++import android.content.Context;
++import android.provider.Settings;
++import android.util.Log;
++
++import androidx.preference.ListPreference;
++import androidx.preference.Preference;
++
++import com.android.settings.R;
++import com.android.settings.core.BasePreferenceController;
++import com.android.settings.core.PreferenceControllerMixin;
++
++public class BluetoothTimeoutPreferenceController extends BasePreferenceController implements
++        PreferenceControllerMixin, Preference.OnPreferenceChangeListener {
++    private static final String TAG = "BluetoothTimeoutPrefCtrl";
++
++    public static final int FALLBACK_BLUETOOTH_TIMEOUT_VALUE = 0;
++
++    private final String mBluetoothTimeoutKey;
++
++    protected BluetoothAdapter mBluetoothAdapter;
++
++    public BluetoothTimeoutPreferenceController(Context context, String key) {
++        super(context, key);
++        mBluetoothTimeoutKey = key;
++
++        mBluetoothAdapter = BluetoothAdapter.getDefaultAdapter();
++        if (mBluetoothAdapter == null) {
++            Log.e(TAG, "Bluetooth is not supported on this device");
++            return;
++        }
++    }
++
++    @Override
++    public int getAvailabilityStatus() {
++        return mBluetoothAdapter != null ? AVAILABLE : UNSUPPORTED_ON_DEVICE;
++    }
++
++    @Override
++    public String getPreferenceKey() {
++        return mBluetoothTimeoutKey;
++    }
++
++    @Override
++    public void updateState(Preference preference) {
++        final ListPreference timeoutListPreference = (ListPreference) preference;
++        final long currentTimeout = Settings.Global.getLong(mContext.getContentResolver(),
++                Settings.Global.BLUETOOTH_OFF_TIMEOUT, FALLBACK_BLUETOOTH_TIMEOUT_VALUE);
++        timeoutListPreference.setValue(String.valueOf(currentTimeout));
++        updateTimeoutPreferenceDescription(timeoutListPreference,
++                Long.parseLong(timeoutListPreference.getValue()));
++    }
++
++    @Override
++    public boolean onPreferenceChange(Preference preference, Object newValue) {
++        try {
++            long value = Long.parseLong((String) newValue);
++            Settings.Global.putLong(mContext.getContentResolver(), Settings.Global.BLUETOOTH_OFF_TIMEOUT, value);
++            updateTimeoutPreferenceDescription((ListPreference) preference, value);
++        } catch (NumberFormatException e) {
++            Log.e(TAG, "could not persist bluetooth timeout setting", e);
++        }
++        return true;
++    }
++
++    public static CharSequence getTimeoutDescription(
++            long currentTimeout, CharSequence[] entries, CharSequence[] values) {
++        if (currentTimeout < 0 || entries == null || values == null
++                || values.length != entries.length) {
++            return null;
++        }
++
++        for (int i = 0; i < values.length; i++) {
++            long timeout = Long.parseLong(values[i].toString());
++            if (currentTimeout == timeout) {
++                return entries[i];
++            }
++        }
++        return null;
++    }
++
++    private void updateTimeoutPreferenceDescription(ListPreference preference,
++                                                    long currentTimeout) {
++        final CharSequence[] entries = preference.getEntries();
++        final CharSequence[] values = preference.getEntryValues();
++        final CharSequence timeoutDescription = getTimeoutDescription(
++                currentTimeout, entries, values);
++        String summary = "";
++        if (timeoutDescription != null) {
++            if (currentTimeout != 0)
++                summary = mContext.getString(R.string.bluetooth_timeout_summary, timeoutDescription);
++            else
++                summary = mContext.getString(R.string.bluetooth_timeout_summary2);
++        }
++        preference.setSummary(summary);
++    }
++}

Patches/LineageOS-20.0/android_packages_apps_Settings/0007-WiFi_Timeout.patch

@@ -0,0 +1,238 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Oliver Scott <olivercscott@gmail.com>
+Date: Thu, 25 Feb 2021 11:31:14 -0500
+Subject: [PATCH] add Wi-Fi timeout feature
+
+---
+ res/values/arrays.xml                         |  44 +++++++
+ res/values/strings.xml                        |  19 +++
+ res/xml/wifi_configure_settings.xml           |   8 ++
+ .../wifi/WifiTimeoutPreferenceController.java | 115 ++++++++++++++++++
+ 4 files changed, 186 insertions(+)
+ create mode 100644 src/com/android/settings/wifi/WifiTimeoutPreferenceController.java
+
+diff --git a/res/values/arrays.xml b/res/values/arrays.xml
+index 5adc98d256..9cac9fbee2 100644
+--- a/res/values/arrays.xml
++++ b/res/values/arrays.xml
+@@ -83,6 +83,50 @@
+         <item>28800000</item>
+     </string-array>
+ 
++    <!-- Wifi settings.  The delay in inactivity before wifi is turned off. These are shown in a list dialog. -->
++    <string-array name="wifi_timeout_entries">
++        <item>@string/wifi_timeout_summary_never</item>
++        <item>@string/wifi_timeout_summary_15secs</item>
++        <item>@string/wifi_timeout_summary_30secs</item>
++        <item>@string/wifi_timeout_summary_1min</item>
++        <item>@string/wifi_timeout_summary_2mins</item>
++        <item>@string/wifi_timeout_summary_5mins</item>
++        <item>@string/wifi_timeout_summary_10mins</item>
++        <item>@string/wifi_timeout_summary_30mins</item>
++        <item>@string/wifi_timeout_summary_1hour</item>
++        <item>@string/wifi_timeout_summary_2hours</item>
++        <item>@string/wifi_timeout_summary_4hours</item>
++        <item>@string/wifi_timeout_summary_8hours</item>
++    </string-array>
++
++    <!-- Do not translate. -->
++    <string-array name="wifi_timeout_values" translatable="false">
++        <!-- Do not translate. -->
++        <item>0</item>
++        <!-- Do not translate. -->
++        <item>15000</item>
++        <!-- Do not translate. -->
++        <item>30000</item>
++        <!-- Do not translate. -->
++        <item>60000</item>
++        <!-- Do not translate. -->
++        <item>120000</item>
++        <!-- Do not translate. -->
++        <item>300000</item>
++        <!-- Do not translate. -->
++        <item>600000</item>
++        <!-- Do not translate. -->
++        <item>1800000</item>
++        <!-- Do not translate. -->
++        <item>3600000</item>
++        <!-- Do not translate. -->
++        <item>7200000</item>
++        <!-- Do not translate. -->
++        <item>14400000</item>
++        <!-- Do not translate. -->
++        <item>28800000</item>
++    </string-array>
++
+     <!-- Display settings.  The delay in inactivity before the screen is turned off. These are shown in a list dialog. -->
+     <string-array name="screen_timeout_entries">
+         <item>15 seconds</item>
+diff --git a/res/values/strings.xml b/res/values/strings.xml
+index a81f271aa3..bc13f31367 100644
+--- a/res/values/strings.xml
++++ b/res/values/strings.xml
+@@ -46,6 +46,25 @@
+     <string name="bluetooth_timeout_summary_4hours">4 hours</string>
+     <string name="bluetooth_timeout_summary_8hours">8 hours</string>
+ 
++    <!--  screen, setting option name to change wifi timeout -->
++    <string name="wifi_timeout">Turn off Wi-Fi automatically</string>
++
++    <!--  screen, setting option summary to change wifi timeout -->
++    <string name="wifi_timeout_summary">Wi-Fi will turn off after <xliff:g id="timeout_description">%1$s</xliff:g> if no network connected</string>
++    <string name="wifi_timeout_summary2">Disabled</string>
++    <string name="wifi_timeout_summary_never">Never</string>
++    <string name="wifi_timeout_summary_15secs">15 seconds</string>
++    <string name="wifi_timeout_summary_30secs">30 seconds</string>
++    <string name="wifi_timeout_summary_1min">1 minute</string>
++    <string name="wifi_timeout_summary_2mins">2 minutes</string>
++    <string name="wifi_timeout_summary_5mins">5 minutes</string>
++    <string name="wifi_timeout_summary_10mins">10 minutes</string>
++    <string name="wifi_timeout_summary_30mins">30 minutes</string>
++    <string name="wifi_timeout_summary_1hour">1 hour</string>
++    <string name="wifi_timeout_summary_2hours">2 hours</string>
++    <string name="wifi_timeout_summary_4hours">4 hours</string>
++    <string name="wifi_timeout_summary_8hours">8 hours</string>
++
+     <!-- Device Info screen. Used for a status item's value when the proper value is not known -->
+     <string name="device_info_default">Unknown</string>
+     <!-- [CHAR LIMIT=NONE] Device Info screen. Countdown for user taps to enable development settings -->
+diff --git a/res/xml/wifi_configure_settings.xml b/res/xml/wifi_configure_settings.xml
+index 2ab7b6a28f..a682e2db92 100644
+--- a/res/xml/wifi_configure_settings.xml
++++ b/res/xml/wifi_configure_settings.xml
+@@ -26,6 +26,14 @@
+         android:summary="@string/wifi_wakeup_summary"
+         settings:controller="com.android.settings.wifi.WifiWakeupPreferenceController"/>
+ 
++    <ListPreference
++        android:key="wifi_timeout"
++        android:title="@string/wifi_timeout"
++        android:summary="@string/wifi_timeout_summary"
++        android:entries="@array/wifi_timeout_entries"
++        android:entryValues="@array/wifi_timeout_values"
++        settings:controller="com.android.settings.wifi.WifiTimeoutPreferenceController"/>
++
+     <SwitchPreference
+         android:key="notify_open_networks"
+         android:title="@string/wifi_notify_open_networks"
+diff --git a/src/com/android/settings/wifi/WifiTimeoutPreferenceController.java b/src/com/android/settings/wifi/WifiTimeoutPreferenceController.java
+new file mode 100644
+index 0000000000..7116c90519
+--- /dev/null
++++ b/src/com/android/settings/wifi/WifiTimeoutPreferenceController.java
+@@ -0,0 +1,115 @@
++/*
++ * Copyright (C) 2020 The Calyx Institute
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License");
++ * you may not use this file except in compliance with the License.
++ * You may obtain a copy of the License at
++ *
++ *      http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software
++ * distributed under the License is distributed on an "AS IS" BASIS,
++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++ * See the License for the specific language governing permissions and
++ * limitations under the License.
++ */
++
++package com.android.settings.wifi;
++
++import android.content.Context;
++import android.net.wifi.WifiManager;
++import android.provider.Settings;
++import android.util.Log;
++
++import androidx.preference.ListPreference;
++import androidx.preference.Preference;
++
++import com.android.settings.R;
++import com.android.settings.core.BasePreferenceController;
++import com.android.settings.core.PreferenceControllerMixin;
++
++public class WifiTimeoutPreferenceController extends BasePreferenceController implements
++        PreferenceControllerMixin, Preference.OnPreferenceChangeListener {
++    private static final String TAG = "WifiTimeoutPrefCtrl";
++
++    public static final int FALLBACK_WIFI_TIMEOUT_VALUE = 0;
++
++    private final String mWifiTimeoutKey;
++
++    protected WifiManager mWifiManager;
++
++    public WifiTimeoutPreferenceController(Context context, String key) {
++        super(context, key);
++        mWifiTimeoutKey = key;
++
++        mWifiManager = context.getSystemService(WifiManager.class);
++        if (mWifiManager == null) {
++            Log.e(TAG, "Wifi is not supported on this device");
++            return;
++        }
++    }
++
++    @Override
++    public int getAvailabilityStatus() {
++        return mWifiManager != null ? AVAILABLE : UNSUPPORTED_ON_DEVICE;
++    }
++
++    @Override
++    public String getPreferenceKey() {
++        return mWifiTimeoutKey;
++    }
++
++    @Override
++    public void updateState(Preference preference) {
++        final ListPreference timeoutListPreference = (ListPreference) preference;
++        final long currentTimeout = Settings.Global.getLong(mContext.getContentResolver(),
++                Settings.Global.WIFI_OFF_TIMEOUT, FALLBACK_WIFI_TIMEOUT_VALUE);
++        timeoutListPreference.setValue(String.valueOf(currentTimeout));
++        updateTimeoutPreferenceDescription(timeoutListPreference,
++                Long.parseLong(timeoutListPreference.getValue()));
++    }
++
++    @Override
++    public boolean onPreferenceChange(Preference preference, Object newValue) {
++        try {
++            long value = Long.parseLong((String) newValue);
++            Settings.Global.putLong(mContext.getContentResolver(), Settings.Global.WIFI_OFF_TIMEOUT, value);
++            updateTimeoutPreferenceDescription((ListPreference) preference, value);
++        } catch (NumberFormatException e) {
++            Log.e(TAG, "could not persist wifi timeout setting", e);
++        }
++        return true;
++    }
++
++    public static CharSequence getTimeoutDescription(
++            long currentTimeout, CharSequence[] entries, CharSequence[] values) {
++        if (currentTimeout < 0 || entries == null || values == null
++                || values.length != entries.length) {
++            return null;
++        }
++
++        for (int i = 0; i < values.length; i++) {
++            long timeout = Long.parseLong(values[i].toString());
++            if (currentTimeout == timeout) {
++                return entries[i];
++            }
++        }
++        return null;
++    }
++
++    private void updateTimeoutPreferenceDescription(ListPreference preference,
++                                                    long currentTimeout) {
++        final CharSequence[] entries = preference.getEntries();
++        final CharSequence[] values = preference.getEntryValues();
++        final CharSequence timeoutDescription = getTimeoutDescription(
++                currentTimeout, entries, values);
++        String summary = "";
++        if (timeoutDescription != null) {
++            if (currentTimeout != 0)
++                summary = mContext.getString(R.string.wifi_timeout_summary, timeoutDescription);
++            else
++                summary = mContext.getString(R.string.wifi_timeout_summary2);
++        }
++        preference.setSummary(summary);
++    }
++}

Patches/LineageOS-20.0/android_packages_apps_Settings/0008-ptrace_scope.patch

@@ -0,0 +1,168 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: flawedworld <38294951+flawedworld@users.noreply.github.com>
+Date: Tue, 6 Apr 2021 01:15:32 +0100
+Subject: [PATCH] add native debugging setting
+
+---
+ res/values/strings.xml                        |   3 +
+ res/xml/security_dashboard_settings.xml       |   6 +
+ .../NativeDebugPreferenceController.java      | 106 ++++++++++++++++++
+ .../settings/security/SecuritySettings.java   |   1 +
+ 4 files changed, 116 insertions(+)
+ create mode 100644 src/com/android/settings/security/NativeDebugPreferenceController.java
+
+diff --git a/res/values/strings.xml b/res/values/strings.xml
+index bc13f31367..dbc4e491f4 100644
+--- a/res/values/strings.xml
++++ b/res/values/strings.xml
+@@ -737,6 +737,9 @@
+     <string name="auto_reboot_title">Auto reboot</string>
+     <string name="auto_reboot_summary">Automatically reboot the device, if the phone hasn\'t been unlocked within the selected number of hours.</string>
+ 
++    <string name="native_debug_title">Enable native code debugging</string>
++    <string name="native_debug_summary">Generate useful logs / bug reports from crashes and permit debugging native code.</string>
++
+     <!-- Text shown for the title of the lock when trust lost option [CHAR LIMIT=40] -->
+     <string name="trust_lost_locks_screen_title">Lock screen when trust is lost</string>
+     <!-- Text shown for the description of the lock when trust lost option [CHAR LIMIT=NONE -->
+diff --git a/res/xml/security_dashboard_settings.xml b/res/xml/security_dashboard_settings.xml
+index d0aeb27fe5..61e2db495a 100644
+--- a/res/xml/security_dashboard_settings.xml
++++ b/res/xml/security_dashboard_settings.xml
+@@ -68,6 +68,12 @@
+             android:persistent="false"
+             android:entries="@array/auto_reboot_entries"
+             android:entryValues="@array/auto_reboot_values" />
++
++        <SwitchPreference
++            android:key="native_debug"
++            android:title="@string/native_debug_title"
++            android:summary="@string/native_debug_summary"
++            android:persistent="false" />
+     </PreferenceCategory>
+ 
+     <Preference
+diff --git a/src/com/android/settings/security/NativeDebugPreferenceController.java b/src/com/android/settings/security/NativeDebugPreferenceController.java
+new file mode 100644
+index 0000000000..9271e6e21c
+--- /dev/null
++++ b/src/com/android/settings/security/NativeDebugPreferenceController.java
+@@ -0,0 +1,106 @@
++/*
++ * Copyright (C) 2020 The Android Open Source Project
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License");
++ * you may not use this file except in compliance with the License.
++ * You may obtain a copy of the License at
++ *
++ *      http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software
++ * distributed under the License is distributed on an "AS IS" BASIS,
++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++ * See the License for the specific language governing permissions and
++ * limitations under the License
++ */
++
++package com.android.settings.security;
++
++import android.content.Context;
++
++import android.os.UserHandle;
++import android.os.UserManager;
++import android.os.SystemProperties;
++
++import android.provider.Settings;
++
++import androidx.preference.Preference;
++import androidx.preference.PreferenceCategory;
++import androidx.preference.PreferenceGroup;
++import androidx.preference.PreferenceScreen;
++import androidx.preference.TwoStatePreference;
++import androidx.preference.SwitchPreference;
++
++import com.android.internal.widget.LockPatternUtils;
++import com.android.settings.core.PreferenceControllerMixin;
++import com.android.settingslib.core.AbstractPreferenceController;
++import com.android.settingslib.core.lifecycle.events.OnResume;
++
++public class NativeDebugPreferenceController extends AbstractPreferenceController
++        implements PreferenceControllerMixin, OnResume, Preference.OnPreferenceChangeListener {
++
++    private static final String SYS_KEY_NATIVE_DEBUG = "persist.native_debug";
++    private static final String PREF_KEY_NATIVE_DEBUG = "native_debug";
++    private static final String PREF_KEY_SECURITY_CATEGORY = "security_category";
++
++    private PreferenceCategory mSecurityCategory;
++    private SwitchPreference mNativeDebug;
++    private boolean mIsAdmin;
++    private UserManager mUm;
++
++    public NativeDebugPreferenceController(Context context) {
++        super(context);
++        mUm = UserManager.get(context);
++    }
++
++    @Override
++    public void displayPreference(PreferenceScreen screen) {
++        super.displayPreference(screen);
++        mSecurityCategory = screen.findPreference(PREF_KEY_SECURITY_CATEGORY);
++        updatePreferenceState();
++    }
++
++    @Override
++    public boolean isAvailable() {
++        mIsAdmin = mUm.isAdminUser();
++        return mIsAdmin;
++    }
++
++    @Override
++    public String getPreferenceKey() {
++        return PREF_KEY_NATIVE_DEBUG;
++    }
++
++    // TODO: should we use onCreatePreferences() instead?
++    private void updatePreferenceState() {
++        if (mSecurityCategory == null) {
++            return;
++        }
++
++        if (mIsAdmin) {
++            mNativeDebug = (SwitchPreference) mSecurityCategory.findPreference(PREF_KEY_NATIVE_DEBUG);
++            mNativeDebug.setChecked(SystemProperties.getBoolean(SYS_KEY_NATIVE_DEBUG, true));
++        } else {
++            mSecurityCategory.removePreference(mSecurityCategory.findPreference(PREF_KEY_NATIVE_DEBUG));
++        }
++    }
++
++    @Override
++    public void onResume() {
++        updatePreferenceState();
++        if (mNativeDebug != null) {
++                boolean mode = mNativeDebug.isChecked();
++                SystemProperties.set(SYS_KEY_NATIVE_DEBUG, Boolean.toString(mode));
++        }
++    }
++
++    @Override
++    public boolean onPreferenceChange(Preference preference, Object value) {
++        final String key = preference.getKey();
++        if (PREF_KEY_NATIVE_DEBUG.equals(key)) {
++            final boolean mode = !mNativeDebug.isChecked();
++            SystemProperties.set(SYS_KEY_NATIVE_DEBUG, Boolean.toString(mode));
++        }
++        return true;
++    }
++}
+diff --git a/src/com/android/settings/security/SecuritySettings.java b/src/com/android/settings/security/SecuritySettings.java
+index abc3dce662..706a9b572c 100644
+--- a/src/com/android/settings/security/SecuritySettings.java
++++ b/src/com/android/settings/security/SecuritySettings.java
+@@ -106,6 +106,7 @@ public class SecuritySettings extends DashboardFragment {
+                 context, lifecycle));
+         securityPreferenceControllers.add(new ChangeScreenLockPreferenceController(context, host));
+         securityPreferenceControllers.add(new AutoRebootPreferenceController(context));
++        securityPreferenceControllers.add(new NativeDebugPreferenceController(context));
+         controllers.add(new PreferenceCategoryController(context, SECURITY_CATEGORY)
+                 .setChildren(securityPreferenceControllers));
+         controllers.addAll(securityPreferenceControllers);

Patches/LineageOS-20.0/android_packages_apps_Settings/0009-Install_Restrictions.patch

@@ -0,0 +1,141 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: flawedworld <flawedworld@flawed.world>
+Date: Wed, 1 Sep 2021 23:36:10 +0300
+Subject: [PATCH] UserManager app installation restrictions
+
+---
+ res/values/strings.xml                        |  2 +
+ res/xml/user_details_settings.xml             |  4 ++
+ .../settings/users/UserDetailsSettings.java   | 43 ++++++++++++++++---
+ 3 files changed, 44 insertions(+), 5 deletions(-)
+
+diff --git a/res/values/strings.xml b/res/values/strings.xml
+index 7f05a40666..cad27ff267 100644
+--- a/res/values/strings.xml
++++ b/res/values/strings.xml
+@@ -7778,6 +7778,8 @@
+     <string name="user_enable_calling">Turn on phone calls</string>
+     <!-- Title of preference to enable calling and SMS [CHAR LIMIT=45] -->
+     <string name="user_enable_calling_sms">Turn on phone calls &amp; SMS</string>
++    <!-- Title of preference to disallow installing apps [CHAR LIMIT=45] -->
++    <string name="user_disallow_install_apps">Disallow installing apps</string>
+     <!-- Title of preference to remove the user [CHAR LIMIT=35] -->
+     <string name="user_remove_user">Delete user</string>
+     <!-- Title for confirmation of turning on calls [CHAR LIMIT=40] -->
+diff --git a/res/xml/user_details_settings.xml b/res/xml/user_details_settings.xml
+index 2301bac1d4..d2766360a0 100644
+--- a/res/xml/user_details_settings.xml
++++ b/res/xml/user_details_settings.xml
+@@ -29,6 +29,10 @@
+             android:key="app_and_content_access"
+             android:icon="@drawable/ic_lock_closed"
+             android:title="@string/user_restrictions_title" />
++    <SwitchPreference
++            android:icon="@drawable/ic_settings_install"
++            android:key="disallow_install_apps"
++            android:title="@string/user_disallow_install_apps" />
+     <com.android.settingslib.RestrictedPreference
+             android:key="app_copying"
+             android:icon="@drawable/ic_apps"
+diff --git a/src/com/android/settings/users/UserDetailsSettings.java b/src/com/android/settings/users/UserDetailsSettings.java
+index 99760401d2..5f9387f1f6 100644
+--- a/src/com/android/settings/users/UserDetailsSettings.java
++++ b/src/com/android/settings/users/UserDetailsSettings.java
+@@ -64,6 +64,7 @@ public class UserDetailsSettings extends SettingsPreferenceFragment
+     private static final String KEY_REMOVE_USER = "remove_user";
+     private static final String KEY_APP_AND_CONTENT_ACCESS = "app_and_content_access";
+     private static final String KEY_APP_COPYING = "app_copying";
++    private static final String KEY_DISALLOW_INSTALL_APPS = "disallow_install_apps";
+ 
+     /** Integer extra containing the userId to manage */
+     static final String EXTRA_USER_ID = "user_id";
+@@ -92,6 +93,7 @@ public class UserDetailsSettings extends SettingsPreferenceFragment
+     Preference mAppCopyingPref;
+     @VisibleForTesting
+     Preference mRemoveUserPref;
++    private SwitchPreference mInstallAppsPref;
+ 
+     @VisibleForTesting
+     /** The user being studied (not the user doing the studying). */
+@@ -159,12 +161,37 @@ public class UserDetailsSettings extends SettingsPreferenceFragment
+ 
+     @Override
+     public boolean onPreferenceChange(Preference preference, Object newValue) {
+-        if (Boolean.TRUE.equals(newValue)) {
+-            showDialog(mUserInfo.isGuest() ? DIALOG_CONFIRM_ENABLE_CALLING
+-                    : DIALOG_CONFIRM_ENABLE_CALLING_AND_SMS);
+-            return false;
++        if (preference == mPhonePref) {
++            if (Boolean.TRUE.equals(newValue)) {
++                showDialog(mUserInfo.isGuest() ? DIALOG_CONFIRM_ENABLE_CALLING
++                        : DIALOG_CONFIRM_ENABLE_CALLING_AND_SMS);
++                return false;
++            }
++            enableCallsAndSms(false);
++        } else if (preference == mInstallAppsPref) {
++            if (mUserInfo.isGuest()) {
++                mDefaultGuestRestrictions.putBoolean(UserManager.DISALLOW_INSTALL_APPS, (Boolean) newValue);
++                mUserManager.setDefaultGuestRestrictions(mDefaultGuestRestrictions);
++
++                // Update the guest's restrictions, if there is a guest
++                // TODO: Maybe setDefaultGuestRestrictions() can internally just set the restrictions
++                // on any existing guest rather than do it here with multiple Binder calls.
++                List<UserInfo> users = mUserManager.getUsers(true);
++                for (UserInfo user: users) {
++                    if (user.isGuest()) {
++                        UserHandle userHandle = UserHandle.of(user.id);
++                        for (String key : mDefaultGuestRestrictions.keySet()) {
++                            mUserManager.setUserRestriction(
++                                    key, mDefaultGuestRestrictions.getBoolean(key), userHandle);
++                        }
++                    }
++                }
++            } else {
++                UserHandle userHandle = UserHandle.of(mUserInfo.id);
++                mUserManager.setUserRestriction(UserManager.DISALLOW_INSTALL_APPS, (Boolean) newValue,
++                        userHandle);
++            }
+         }
+-        enableCallsAndSms(false);
+         return true;
+     }
+ 
+@@ -258,6 +285,7 @@ public class UserDetailsSettings extends SettingsPreferenceFragment
+         mRemoveUserPref = findPreference(KEY_REMOVE_USER);
+         mAppAndContentAccessPref = findPreference(KEY_APP_AND_CONTENT_ACCESS);
+         mAppCopyingPref = findPreference(KEY_APP_COPYING);
++        mInstallAppsPref = findPreference(KEY_DISALLOW_INSTALL_APPS);
+ 
+         mSwitchUserPref.setTitle(
+                 context.getString(com.android.settingslib.R.string.user_switch_to_user,
+@@ -276,6 +304,7 @@ public class UserDetailsSettings extends SettingsPreferenceFragment
+             removePreference(KEY_REMOVE_USER);
+             removePreference(KEY_APP_AND_CONTENT_ACCESS);
+             removePreference(KEY_APP_COPYING);
++            removePreference(KEY_DISALLOW_INSTALL_APPS);
+         } else {
+             if (!Utils.isVoiceCapable(context)) { // no telephony
+                 removePreference(KEY_ENABLE_TELEPHONY);
+@@ -309,11 +338,14 @@ public class UserDetailsSettings extends SettingsPreferenceFragment
+                 if (!SHOW_APP_COPYING_PREF) {
+                     removePreference(KEY_APP_COPYING);
+                 }
++                removePreference(KEY_DISALLOW_INSTALL_APPS);
+             } else {
+                 mPhonePref.setChecked(!mUserManager.hasUserRestriction(
+                         UserManager.DISALLOW_OUTGOING_CALLS, new UserHandle(userId)));
+                 mRemoveUserPref.setTitle(R.string.user_remove_user);
+                 removePreference(KEY_APP_COPYING);
++                mInstallAppsPref.setChecked(mUserManager.hasUserRestriction(
++                        UserManager.DISALLOW_INSTALL_APPS, new UserHandle(userId)));
+             }
+             if (RestrictedLockUtilsInternal.hasBaseUserRestriction(context,
+                     UserManager.DISALLOW_REMOVE_USER, UserHandle.myUserId())) {
+@@ -324,6 +356,7 @@ public class UserDetailsSettings extends SettingsPreferenceFragment
+             mPhonePref.setOnPreferenceChangeListener(this);
+             mAppAndContentAccessPref.setOnPreferenceClickListener(this);
+             mAppCopyingPref.setOnPreferenceClickListener(this);
++            mInstallAppsPref.setOnPreferenceChangeListener(this);
+         }
+     }
+ 

Patches/LineageOS-20.0/android_packages_apps_Settings/0010-exec_spawning_toggle.patch

@@ -0,0 +1,168 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Sat, 26 Mar 2022 20:35:37 -0400
+Subject: [PATCH] add exec spawning toggle
+
+---
+ res/values/strings.xml                        |   3 +
+ res/xml/security_dashboard_settings.xml       |   6 +
+ .../ExecSpawnPreferenceController.java        | 106 ++++++++++++++++++
+ .../settings/security/SecuritySettings.java   |   1 +
+ 4 files changed, 116 insertions(+)
+ create mode 100644 src/com/android/settings/security/ExecSpawnPreferenceController.java
+
+diff --git a/res/values/strings.xml b/res/values/strings.xml
+index dbc4e491f4..7f05a40666 100644
+--- a/res/values/strings.xml
++++ b/res/values/strings.xml
+@@ -737,6 +737,9 @@
+     <string name="auto_reboot_title">Auto reboot</string>
+     <string name="auto_reboot_summary">Automatically reboot the device, if the phone hasn\'t been unlocked within the selected number of hours.</string>
+ 
++    <string name="exec_spawn_title">Enable secure app spawning</string>
++    <string name="exec_spawn_summary">Launch apps in a more secure way than Android which takes slightly longer and increases memory usage by app processes.</string>
++
+     <string name="native_debug_title">Enable native code debugging</string>
+     <string name="native_debug_summary">Generate useful logs / bug reports from crashes and permit debugging native code.</string>
+ 
+diff --git a/res/xml/security_dashboard_settings.xml b/res/xml/security_dashboard_settings.xml
+index 61e2db495a..3a06288497 100644
+--- a/res/xml/security_dashboard_settings.xml
++++ b/res/xml/security_dashboard_settings.xml
+@@ -69,6 +69,12 @@
+             android:entries="@array/auto_reboot_entries"
+             android:entryValues="@array/auto_reboot_values" />
+ 
++        <SwitchPreference
++            android:key="exec_spawn"
++            android:title="@string/exec_spawn_title"
++            android:summary="@string/exec_spawn_summary"
++            android:persistent="false" />
++
+         <SwitchPreference
+             android:key="native_debug"
+             android:title="@string/native_debug_title"
+diff --git a/src/com/android/settings/security/ExecSpawnPreferenceController.java b/src/com/android/settings/security/ExecSpawnPreferenceController.java
+new file mode 100644
+index 0000000000..78f021210a
+--- /dev/null
++++ b/src/com/android/settings/security/ExecSpawnPreferenceController.java
+@@ -0,0 +1,106 @@
++/*
++ * Copyright (C) 2022 The Android Open Source Project
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License");
++ * you may not use this file except in compliance with the License.
++ * You may obtain a copy of the License at
++ *
++ *      http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software
++ * distributed under the License is distributed on an "AS IS" BASIS,
++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++ * See the License for the specific language governing permissions and
++ * limitations under the License
++ */
++
++package com.android.settings.security;
++
++import android.content.Context;
++
++import android.os.UserHandle;
++import android.os.UserManager;
++import android.os.SystemProperties;
++
++import android.provider.Settings;
++
++import androidx.preference.Preference;
++import androidx.preference.PreferenceCategory;
++import androidx.preference.PreferenceGroup;
++import androidx.preference.PreferenceScreen;
++import androidx.preference.TwoStatePreference;
++import androidx.preference.SwitchPreference;
++
++import com.android.internal.widget.LockPatternUtils;
++import com.android.settings.core.PreferenceControllerMixin;
++import com.android.settingslib.core.AbstractPreferenceController;
++import com.android.settingslib.core.lifecycle.events.OnResume;
++
++public class ExecSpawnPreferenceController extends AbstractPreferenceController
++        implements PreferenceControllerMixin, OnResume, Preference.OnPreferenceChangeListener {
++
++    private static final String SYS_KEY_EXEC_SPAWN = "persist.security.exec_spawn";
++    private static final String PREF_KEY_EXEC_SPAWN = "exec_spawn";
++    private static final String PREF_KEY_SECURITY_CATEGORY = "security_category";
++
++    private PreferenceCategory mSecurityCategory;
++    private SwitchPreference mExecSpawn;
++    private boolean mIsAdmin;
++    private UserManager mUm;
++
++    public ExecSpawnPreferenceController(Context context) {
++        super(context);
++        mUm = UserManager.get(context);
++    }
++
++    @Override
++    public void displayPreference(PreferenceScreen screen) {
++        super.displayPreference(screen);
++        mSecurityCategory = screen.findPreference(PREF_KEY_SECURITY_CATEGORY);
++        updatePreferenceState();
++    }
++
++    @Override
++    public boolean isAvailable() {
++        mIsAdmin = mUm.isAdminUser();
++        return mIsAdmin;
++    }
++
++    @Override
++    public String getPreferenceKey() {
++        return PREF_KEY_EXEC_SPAWN;
++    }
++
++    // TODO: should we use onCreatePreferences() instead?
++    private void updatePreferenceState() {
++        if (mSecurityCategory == null) {
++            return;
++        }
++
++        if (mIsAdmin) {
++            mExecSpawn = (SwitchPreference) mSecurityCategory.findPreference(PREF_KEY_EXEC_SPAWN);
++            mExecSpawn.setChecked(SystemProperties.getBoolean(SYS_KEY_EXEC_SPAWN, true));
++        } else {
++            mSecurityCategory.removePreference(mSecurityCategory.findPreference(PREF_KEY_EXEC_SPAWN));
++        }
++    }
++
++    @Override
++    public void onResume() {
++        updatePreferenceState();
++        if (mExecSpawn != null) {
++                boolean mode = mExecSpawn.isChecked();
++                SystemProperties.set(SYS_KEY_EXEC_SPAWN, Boolean.toString(mode));
++        }
++    }
++
++    @Override
++    public boolean onPreferenceChange(Preference preference, Object value) {
++        final String key = preference.getKey();
++        if (PREF_KEY_EXEC_SPAWN.equals(key)) {
++            final boolean mode = !mExecSpawn.isChecked();
++            SystemProperties.set(SYS_KEY_EXEC_SPAWN, Boolean.toString(mode));
++        }
++        return true;
++    }
++}
+diff --git a/src/com/android/settings/security/SecuritySettings.java b/src/com/android/settings/security/SecuritySettings.java
+index 706a9b572c..315dcf818a 100644
+--- a/src/com/android/settings/security/SecuritySettings.java
++++ b/src/com/android/settings/security/SecuritySettings.java
+@@ -106,6 +106,7 @@ public class SecuritySettings extends DashboardFragment {
+                 context, lifecycle));
+         securityPreferenceControllers.add(new ChangeScreenLockPreferenceController(context, host));
+         securityPreferenceControllers.add(new AutoRebootPreferenceController(context));
++        securityPreferenceControllers.add(new ExecSpawnPreferenceController(context));
+         securityPreferenceControllers.add(new NativeDebugPreferenceController(context));
+         controllers.add(new PreferenceCategoryController(context, SECURITY_CATEGORY)
+                 .setChildren(securityPreferenceControllers));

Patches/LineageOS-20.0/android_packages_apps_Settings/0011-Random_MAC.patch

@@ -0,0 +1,145 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: renlord <me@renlord.com>
+Date: Fri, 15 Oct 2021 20:02:51 +0530
+Subject: [PATCH] add option to always randomize MAC RANDOMIZATION_ALWAYS is
+ set as the default option
+
+---
+ res/layout/wifi_network_config.xml            |  2 +-
+ res/values/arrays.xml                         |  7 +++++
+ res/xml/wifi_network_details_fragment2.xml    |  2 +-
+ .../WifiDetailPreferenceController2.java      |  2 +-
+ .../WifiPrivacyPreferenceController2.java     | 28 +++++++++++++++----
+ 5 files changed, 32 insertions(+), 9 deletions(-)
+
+diff --git a/res/layout/wifi_network_config.xml b/res/layout/wifi_network_config.xml
+index f91f7385c1..c0907b19ee 100644
+--- a/res/layout/wifi_network_config.xml
++++ b/res/layout/wifi_network_config.xml
+@@ -675,7 +675,7 @@
+                      android:layout_height="wrap_content"
+                      style="@style/wifi_item_spinner"
+                      android:prompt="@string/wifi_privacy_settings"
+-                     android:entries="@array/wifi_privacy_entries"/>
++                     android:entries="@array/wifi_privacy_entries_extended"/>
+         </LinearLayout>
+ 
+         <LinearLayout
+diff --git a/res/values/arrays.xml b/res/values/arrays.xml
+index 9cac9fbee2..cfc7671652 100644
+--- a/res/values/arrays.xml
++++ b/res/values/arrays.xml
+@@ -1398,6 +1398,12 @@
+         <item>Treat as unmetered</item>
+     </string-array>
+ 
++    <string-array name="wifi_privacy_entries_extended">
++        <item>Use per-connection randomized MAC (default)</item>
++        <item>Use per-network randomized MAC</item>
++        <item>Use device MAC</item>
++    </string-array>
++
+     <string-array name="wifi_privacy_entries">
+         <item>Use randomized MAC (default)</item>
+         <item>Use device MAC</item>
+@@ -1415,6 +1421,7 @@
+     </string-array>
+ 
+     <string-array name="wifi_privacy_values" translatable="false">
++        <item>100</item>
+         <item>1</item>
+         <item>0</item>
+     </string-array>
+diff --git a/res/xml/wifi_network_details_fragment2.xml b/res/xml/wifi_network_details_fragment2.xml
+index eb9add14f6..2079ef1675 100644
+--- a/res/xml/wifi_network_details_fragment2.xml
++++ b/res/xml/wifi_network_details_fragment2.xml
+@@ -69,7 +69,7 @@
+         android:key="privacy"
+         android:icon="@drawable/ic_wifi_privacy_24dp"
+         android:title="@string/wifi_privacy_settings"
+-        android:entries="@array/wifi_privacy_entries"
++        android:entries="@array/wifi_privacy_entries_extended"
+         android:entryValues="@array/wifi_privacy_values"/>
+ 
+     <Preference
+diff --git a/src/com/android/settings/wifi/details2/WifiDetailPreferenceController2.java b/src/com/android/settings/wifi/details2/WifiDetailPreferenceController2.java
+index ba7628e8b9..5e8cf313aa 100644
+--- a/src/com/android/settings/wifi/details2/WifiDetailPreferenceController2.java
++++ b/src/com/android/settings/wifi/details2/WifiDetailPreferenceController2.java
+@@ -778,7 +778,7 @@ public class WifiDetailPreferenceController2 extends AbstractPreferenceControlle
+     }
+ 
+     private int getMacAddressTitle() {
+-        if (mWifiEntry.getPrivacy() == WifiEntry.PRIVACY_RANDOMIZED_MAC) {
++        if (mWifiEntry.getPrivacy() != WifiEntry.PRIVACY_DEVICE_MAC) {
+             return mWifiEntry.getConnectedState() == WifiEntry.CONNECTED_STATE_CONNECTED
+                     ? R.string.wifi_advanced_randomized_mac_address_title
+                     : R.string.wifi_advanced_randomized_mac_address_disconnected_title;
+diff --git a/src/com/android/settings/wifi/details2/WifiPrivacyPreferenceController2.java b/src/com/android/settings/wifi/details2/WifiPrivacyPreferenceController2.java
+index 632a5624c4..d695b8a825 100644
+--- a/src/com/android/settings/wifi/details2/WifiPrivacyPreferenceController2.java
++++ b/src/com/android/settings/wifi/details2/WifiPrivacyPreferenceController2.java
+@@ -41,6 +41,10 @@ public class WifiPrivacyPreferenceController2 extends BasePreferenceController i
+     private WifiEntry mWifiEntry;
+     private Preference mPreference;
+ 
++    private static final int PREF_RANDOMIZATION_ALWAYS = 0;
++    private static final int PREF_RANDOMIZATION_PERSISTENT = 1;
++    private static final int PREF_RANDOMIZATION_NONE = 2;
++
+     public WifiPrivacyPreferenceController2(Context context) {
+         super(context, KEY_WIFI_PRIVACY);
+ 
+@@ -98,8 +102,6 @@ public class WifiPrivacyPreferenceController2 extends BasePreferenceController i
+         return mWifiEntry.getPrivacy();
+     }
+ 
+-    private static final int PREF_RANDOMIZATION_PERSISTENT = 0;
+-    private static final int PREF_RANDOMIZATION_NONE = 1;
+ 
+     /**
+      * Returns preference index value.
+@@ -108,8 +110,14 @@ public class WifiPrivacyPreferenceController2 extends BasePreferenceController i
+      * @return index value of preference
+      */
+     public static int translateMacRandomizedValueToPrefValue(int macRandomized) {
+-        return (macRandomized == WifiEntry.PRIVACY_RANDOMIZED_MAC)
+-            ? PREF_RANDOMIZATION_PERSISTENT : PREF_RANDOMIZATION_NONE;
++        switch (macRandomized) {
++            case WifiEntry.PRIVACY_RANDOMIZED_MAC:
++                return PREF_RANDOMIZATION_PERSISTENT;
++            case WifiEntry.PRIVACY_DEVICE_MAC:
++                return PREF_RANDOMIZATION_NONE;
++            default:
++                return PREF_RANDOMIZATION_ALWAYS;
++        }
+     }
+ 
+     /**
+@@ -119,8 +127,14 @@ public class WifiPrivacyPreferenceController2 extends BasePreferenceController i
+      * @return mac randomized value
+      */
+     public static int translatePrefValueToMacRandomizedValue(int prefMacRandomized) {
+-        return (prefMacRandomized == PREF_RANDOMIZATION_PERSISTENT)
+-            ? WifiEntry.PRIVACY_RANDOMIZED_MAC : WifiEntry.PRIVACY_DEVICE_MAC;
++        switch (prefMacRandomized) {
++            case PREF_RANDOMIZATION_PERSISTENT:
++                return WifiEntry.PRIVACY_RANDOMIZED_MAC;
++            case PREF_RANDOMIZATION_NONE:
++                return WifiEntry.PRIVACY_DEVICE_MAC;
++            default:
++                return WifiEntry.PRIVACY_RANDOMIZATION_ALWAYS;
++        }
+     }
+ 
+     private void updateSummary(ListPreference preference, int macRandomized) {
+@@ -150,6 +164,8 @@ public class WifiPrivacyPreferenceController2 extends BasePreferenceController i
+                 return WifiEntry.PRIVACY_DEVICE_MAC;
+             case WifiConfiguration.RANDOMIZATION_PERSISTENT:
+                 return WifiEntry.PRIVACY_RANDOMIZED_MAC;
++            case WifiConfiguration.RANDOMIZATION_ALWAYS:
++                return WifiEntry.PRIVACY_RANDOMIZATION_ALWAYS;
+             default:
+                 return WifiEntry.PRIVACY_UNKNOWN;
+         }

Patches/LineageOS-20.0/android_packages_apps_Settings/0013-Captive_Portal_Toggle.patch

@@ -0,0 +1,240 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Pratyush <codelab@pratyush.dev>
+Date: Wed, 20 Oct 2021 05:40:11 +0530
+Subject: [PATCH] add toggle to set captiveportal settings
+
+Access is disallowed for users that are disallowed from configuring
+Private DNS settings. This restriction provides administrative control
+over this feature in a way that's compatible with existing device
+manager implementations. Private DNS is the closest fit from the
+existing user management restrictions that are available.
+
+Co-authored-by: stuux <stuux@posteo.net>
+Co-authored-by: Renlord <me@renlord.com>
+Co-authored-by: Danny Lin <danny@kdrag0n.dev>
+Co-authored-by: anupritaisno1 <www.anuprita804@gmail.com>
+Signed-off-by: empratyush <codelab@pratyush.dev>
+---
+ res/values/arrays.xml                         |  10 +
+ ...ConnectivityCheckPreferenceController.java | 176 ++++++++++++++++++
+ .../network/NetworkDashboardFragment.java     |   3 +
+ 3 files changed, 189 insertions(+)
+ create mode 100644 src/com/android/settings/network/ConnectivityCheckPreferenceController.java
+
+diff --git a/res/values/arrays.xml b/res/values/arrays.xml
+index cfc7671652..7fac175770 100644
+--- a/res/values/arrays.xml
++++ b/res/values/arrays.xml
+@@ -210,6 +210,16 @@
+         <item>@string/dark_ui_auto_mode_custom_bedtime</item>
+     </string-array>
+ 
++    <string-array name="connectivity_check_entries">
++        <item>Standard (Google)</item>
++        <item>Disabled</item>
++    </string-array>
++
++    <string-array name="connectivity_check_values" translatable="false">
++        <item>0</item>
++        <item>1</item>
++    </string-array>
++
+     <!-- Security settings.  The delay after screen is turned off until device locks.
+          These are shown in a list dialog. -->
+     <string-array name="lock_after_timeout_entries">
+diff --git a/src/com/android/settings/network/ConnectivityCheckPreferenceController.java b/src/com/android/settings/network/ConnectivityCheckPreferenceController.java
+new file mode 100644
+index 0000000000..bf16eb825a
+--- /dev/null
++++ b/src/com/android/settings/network/ConnectivityCheckPreferenceController.java
+@@ -0,0 +1,176 @@
++/*
++ * Copyright (C) 2020 The Android Open Source Project
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License");
++ * you may not use this file except in compliance with the License.
++ * You may obtain a copy of the License at
++ *
++ *      http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software
++ * distributed under the License is distributed on an "AS IS" BASIS,
++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++ * See the License for the specific language governing permissions and
++ * limitations under the License.
++ */
++
++package com.android.settings.network;
++
++import android.content.ContentResolver;
++import android.content.Context;
++import android.content.res.Resources;
++import android.database.ContentObserver;
++import android.net.LinkProperties;
++import android.net.Network;
++import android.os.Handler;
++import android.os.Looper;
++import android.os.UserHandle;
++import android.os.UserManager;
++import android.provider.Settings;
++import androidx.preference.ListPreference;
++import androidx.preference.Preference;
++import androidx.preference.PreferenceScreen;
++import com.android.internal.util.ArrayUtils;
++import com.android.settings.R;
++import com.android.settings.core.BasePreferenceController;
++import com.android.settings.core.PreferenceControllerMixin;
++import com.android.settingslib.RestrictedLockUtils.EnforcedAdmin;
++import com.android.settingslib.RestrictedLockUtilsInternal;
++import com.android.settingslib.core.lifecycle.events.OnResume;
++
++public class ConnectivityCheckPreferenceController
++        extends BasePreferenceController
++        implements PreferenceControllerMixin, Preference.OnPreferenceChangeListener,
++        OnResume {
++
++    // imported defaults from AOSP NetworkStack
++    private static final String STANDARD_HTTPS_URL =
++            "https://www.google.com/generate_204";
++    private static final String STANDARD_HTTP_URL =
++            "http://connectivitycheck.gstatic.com/generate_204";
++    private static final String STANDARD_FALLBACK_URL =
++            "http://www.google.com/gen_204";
++    private static final String STANDARD_OTHER_FALLBACK_URLS =
++            "http://play.googleapis.com/generate_204";
++
++    private static final int STANDARD_CAPTIVE_PORTAL_HTTP_URL_INTVAL = 0;
++    private static final int DISABLED_CAPTIVE_PORTAL_INTVAL = 1;
++
++    private static final String KEY_CONNECTIVITY_CHECK_SETTINGS =
++            "connectivity_check_settings";
++
++    private ListPreference mConnectivityPreference;
++
++    public ConnectivityCheckPreferenceController(Context context) {
++        super(context, KEY_CONNECTIVITY_CHECK_SETTINGS);
++    }
++
++    @Override
++    public int getAvailabilityStatus() {
++        if (isDisabledByAdmin()) {
++            return BasePreferenceController.DISABLED_FOR_USER;
++        }
++        return BasePreferenceController.AVAILABLE;
++    }
++
++    @Override
++    public void displayPreference(PreferenceScreen screen) {
++        ListPreference captiveList = new ListPreference(screen.getContext());
++        captiveList.setKey(KEY_CONNECTIVITY_CHECK_SETTINGS);
++        captiveList.setOrder(30);
++        captiveList.setIcon(R.drawable.ic_settings_language);
++        captiveList.setTitle(R.string.connectivity_check_title);
++        captiveList.setSummary(R.string.connectivity_check_summary);
++        captiveList.setEntries(R.array.connectivity_check_entries);
++        captiveList.setEntryValues(R.array.connectivity_check_values);
++
++        if (mConnectivityPreference == null) {
++            screen.addPreference(captiveList);
++            mConnectivityPreference = captiveList;
++        }
++        super.displayPreference(screen);
++        updatePreferenceState();
++    }
++
++    @Override
++    public String getPreferenceKey() {
++        return KEY_CONNECTIVITY_CHECK_SETTINGS;
++    }
++
++    private void updatePreferenceState() {
++        if (Settings.Global.getInt(mContext.getContentResolver(),
++                Settings.Global.CAPTIVE_PORTAL_MODE, Settings.Global.CAPTIVE_PORTAL_MODE_PROMPT)
++                == Settings.Global.CAPTIVE_PORTAL_MODE_IGNORE) {
++            mConnectivityPreference.setValueIndex(DISABLED_CAPTIVE_PORTAL_INTVAL);
++            return;
++        }
++
++        String pref = Settings.Global.getString(
++                mContext.getContentResolver(), Settings.Global.CAPTIVE_PORTAL_HTTP_URL);
++        if (STANDARD_HTTP_URL.equals(pref)) {
++            mConnectivityPreference.setValueIndex(
++                    STANDARD_CAPTIVE_PORTAL_HTTP_URL_INTVAL);
++        }
++    }
++
++    @Override
++    public void onResume() {
++        updatePreferenceState();
++        if (mConnectivityPreference != null) {
++            setCaptivePortalURLs(
++                    mContext.getContentResolver(),
++                    Integer.parseInt(mConnectivityPreference.getValue()));
++        }
++    }
++
++    private void setCaptivePortalURLs(ContentResolver cr, int mode) {
++        switch (mode) {
++            case STANDARD_CAPTIVE_PORTAL_HTTP_URL_INTVAL:
++                Settings.Global.putString(cr, Settings.Global.CAPTIVE_PORTAL_HTTP_URL,
++                        STANDARD_HTTP_URL);
++                Settings.Global.putString(cr, Settings.Global.CAPTIVE_PORTAL_HTTPS_URL,
++                        STANDARD_HTTPS_URL);
++                Settings.Global.putString(cr, Settings.Global.CAPTIVE_PORTAL_FALLBACK_URL,
++                        STANDARD_FALLBACK_URL);
++                Settings.Global.putString(
++                        cr, Settings.Global.CAPTIVE_PORTAL_OTHER_FALLBACK_URLS,
++                        STANDARD_OTHER_FALLBACK_URLS);
++                Settings.Global.putInt(cr, Settings.Global.CAPTIVE_PORTAL_MODE,
++                        Settings.Global.CAPTIVE_PORTAL_MODE_PROMPT);
++                break;
++            default:
++                // Default URLs as placeholder
++                Settings.Global.putString(cr, Settings.Global.CAPTIVE_PORTAL_HTTP_URL,
++                        STANDARD_HTTP_URL);
++                Settings.Global.putString(cr, Settings.Global.CAPTIVE_PORTAL_HTTPS_URL,
++                        STANDARD_HTTPS_URL);
++                Settings.Global.putString(cr, Settings.Global.CAPTIVE_PORTAL_FALLBACK_URL,
++                        STANDARD_FALLBACK_URL);
++                Settings.Global.putString(
++                        cr, Settings.Global.CAPTIVE_PORTAL_OTHER_FALLBACK_URLS,
++                        STANDARD_OTHER_FALLBACK_URLS);
++                Settings.Global.putInt(cr, Settings.Global.CAPTIVE_PORTAL_MODE,
++                        Settings.Global.CAPTIVE_PORTAL_MODE_IGNORE);
++        }
++    }
++
++    @Override
++    public boolean onPreferenceChange(Preference preference, Object value) {
++        final String key = preference.getKey();
++        if (KEY_CONNECTIVITY_CHECK_SETTINGS.equals(key)) {
++            setCaptivePortalURLs(mContext.getContentResolver(),
++                    Integer.parseInt((String)value));
++            return true;
++        } else {
++            return false;
++        }
++    }
++
++    private EnforcedAdmin getEnforcedAdmin() {
++        return RestrictedLockUtilsInternal.checkIfRestrictionEnforced(
++                mContext, UserManager.DISALLOW_CONFIG_PRIVATE_DNS,
++                UserHandle.myUserId());
++    }
++
++    private boolean isDisabledByAdmin() { return getEnforcedAdmin() != null; }
++}
+diff --git a/src/com/android/settings/network/NetworkDashboardFragment.java b/src/com/android/settings/network/NetworkDashboardFragment.java
+index 0cd24dc2a2..31295e9f83 100644
+--- a/src/com/android/settings/network/NetworkDashboardFragment.java
++++ b/src/com/android/settings/network/NetworkDashboardFragment.java
+@@ -121,6 +121,9 @@ public class NetworkDashboardFragment extends DashboardFragment implements
+         }
+         controllers.add(privateDnsPreferenceController);
+         controllers.add(new NetworkProviderCallsSmsController(context, lifecycle));
++        ConnectivityCheckPreferenceController connectivityCheck =
++                new ConnectivityCheckPreferenceController(context);
++        controllers.add(connectivityCheck);
+         return controllers;
+     }
+ 

Patches/LineageOS-20.0/android_packages_apps_SetupWizard/0001-Remove_Analytics.patch

@@ -0,0 +1,178 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Tad <tad@spotco.us>
+Date: Fri, 3 Sep 2021 08:52:48 -0400
+Subject: [PATCH] Remove analytics
+
+Change-Id: I044dd6b137b8a1d4a6dde3a63c0aaa454309341f
+---
+ res/layout/setup_lineage_settings.xml         | 29 -----------------
+ .../lineageos/setupwizard/FinishActivity.java | 13 --------
+ .../setupwizard/LineageSettingsActivity.java  | 32 -------------------
+ .../lineageos/setupwizard/SetupWizardApp.java |  1 -
+ 4 files changed, 75 deletions(-)
+
+diff --git a/res/layout/setup_lineage_settings.xml b/res/layout/setup_lineage_settings.xml
+index 5d206e4..db3594a 100644
+--- a/res/layout/setup_lineage_settings.xml
++++ b/res/layout/setup_lineage_settings.xml
+@@ -45,35 +45,6 @@
+                     android:layout_width="match_parent"
+                     android:layout_height="match_parent">
+ 
+-                    <!-- Whether or not to enable metrics -->
+-                    <LinearLayout
+-                        android:id="@+id/metrics"
+-                        android:orientation="horizontal"
+-                        android:layout_width="match_parent"
+-                        android:layout_height="wrap_content"
+-                        android:paddingLeft="@dimen/location_margin_left"
+-                        android:paddingRight="@dimen/content_margin_right"
+-                        android:background="?android:attr/selectableItemBackground"
+-                        android:clickable="true">
+-
+-
+-                        <CheckBox
+-                            android:id="@+id/enable_metrics_checkbox"
+-                            android:layout_width="wrap_content"
+-                            android:layout_height="wrap_content"
+-                            android:duplicateParentState="true"
+-                            android:clickable="false"
+-                            style="@style/SudCheckBox.Multiline" />
+-
+-                        <TextView
+-                            android:id="@+id/enable_metrics_summary"
+-                            android:layout_width="wrap_content"
+-                            android:layout_height="wrap_content"
+-                            android:text="@string/services_metrics_label"
+-                            style="@style/SudCheckBox.Multiline" />
+-
+-                    </LinearLayout>
+-
+                     <!-- Checkbox for using on-screen nav keys -->
+                     <LinearLayout
+                         android:id="@+id/nav_keys"
+diff --git a/src/org/lineageos/setupwizard/FinishActivity.java b/src/org/lineageos/setupwizard/FinishActivity.java
+index 95e3166..0a07369 100644
+--- a/src/org/lineageos/setupwizard/FinishActivity.java
++++ b/src/org/lineageos/setupwizard/FinishActivity.java
+@@ -26,7 +26,6 @@ import static org.lineageos.setupwizard.Manifest.permission.FINISH_SETUP;
+ import static org.lineageos.setupwizard.SetupWizardApp.ACTION_SETUP_COMPLETE;
+ import static org.lineageos.setupwizard.SetupWizardApp.DISABLE_NAV_KEYS;
+ import static org.lineageos.setupwizard.SetupWizardApp.ENABLE_RECOVERY_UPDATE;
+-import static org.lineageos.setupwizard.SetupWizardApp.KEY_SEND_METRICS;
+ import static org.lineageos.setupwizard.SetupWizardApp.LOGV;
+ import static org.lineageos.setupwizard.SetupWizardApp.NAVIGATION_OPTION_KEY;
+ import static org.lineageos.setupwizard.SetupWizardApp.UPDATE_RECOVERY_PROP;
+@@ -175,7 +174,6 @@ public class FinishActivity extends BaseSetupWizardActivity {
+     }
+ 
+     private void completeSetup() {
+-        handleEnableMetrics(mSetupWizardApp);
+         handleNavKeys(mSetupWizardApp);
+         handleRecoveryUpdate(mSetupWizardApp);
+         handleNavigationOption(mSetupWizardApp);
+@@ -189,17 +187,6 @@ public class FinishActivity extends BaseSetupWizardActivity {
+         startActivityForResult(intent, NEXT_REQUEST);
+     }
+ 
+-    private static void handleEnableMetrics(SetupWizardApp setupWizardApp) {
+-        Bundle privacyData = setupWizardApp.getSettingsBundle();
+-        if (privacyData != null
+-                && privacyData.containsKey(KEY_SEND_METRICS)) {
+-            LineageSettings.Secure.putInt(setupWizardApp.getContentResolver(),
+-                    LineageSettings.Secure.STATS_COLLECTION,
+-                    privacyData.getBoolean(KEY_SEND_METRICS)
+-                            ? 1 : 0);
+-        }
+-    }
+-
+     private static void handleNavKeys(SetupWizardApp setupWizardApp) {
+         if (setupWizardApp.getSettingsBundle().containsKey(DISABLE_NAV_KEYS)) {
+             writeDisableNavkeysOption(setupWizardApp,
+diff --git a/src/org/lineageos/setupwizard/LineageSettingsActivity.java b/src/org/lineageos/setupwizard/LineageSettingsActivity.java
+index ace417f..5f77401 100644
+--- a/src/org/lineageos/setupwizard/LineageSettingsActivity.java
++++ b/src/org/lineageos/setupwizard/LineageSettingsActivity.java
+@@ -18,7 +18,6 @@
+ package org.lineageos.setupwizard;
+ 
+ import static org.lineageos.setupwizard.SetupWizardApp.DISABLE_NAV_KEYS;
+-import static org.lineageos.setupwizard.SetupWizardApp.KEY_SEND_METRICS;
+ 
+ import android.app.Activity;
+ import android.content.Context;
+@@ -50,17 +49,10 @@ public class LineageSettingsActivity extends BaseSetupWizardActivity {
+ 
+     private SetupWizardApp mSetupWizardApp;
+ 
+-    private CheckBox mMetrics;
+     private CheckBox mNavKeys;
+ 
+     private boolean mSupportsKeyDisabler = false;
+ 
+-    private final View.OnClickListener mMetricsClickListener = view -> {
+-        boolean checked = !mMetrics.isChecked();
+-        mMetrics.setChecked(checked);
+-        mSetupWizardApp.getSettingsBundle().putBoolean(KEY_SEND_METRICS, checked);
+-    };
+-
+     private final View.OnClickListener mNavKeysClickListener = view -> {
+         boolean checked = !mNavKeys.isChecked();
+         mNavKeys.setChecked(checked);
+@@ -80,20 +72,6 @@ public class LineageSettingsActivity extends BaseSetupWizardActivity {
+                 privacyPolicy, policySummary);
+         getGlifLayout().setDescriptionText(servicesFullDescription);
+ 
+-        View metricsRow = findViewById(R.id.metrics);
+-        metricsRow.setOnClickListener(mMetricsClickListener);
+-        metricsRow.requestFocus();
+-        String metricsHelpImproveLineage =
+-                getString(R.string.services_help_improve_cm, os_name);
+-        String metricsSummary = getString(R.string.services_metrics_label,
+-                metricsHelpImproveLineage, os_name, os_name);
+-        final SpannableStringBuilder metricsSpan = new SpannableStringBuilder(metricsSummary);
+-        metricsSpan.setSpan(new android.text.style.StyleSpan(android.graphics.Typeface.BOLD),
+-                0, metricsHelpImproveLineage.length(), Spannable.SPAN_EXCLUSIVE_EXCLUSIVE);
+-        TextView metrics = (TextView) findViewById(R.id.enable_metrics_summary);
+-        metrics.setText(metricsSpan);
+-        mMetrics = (CheckBox) findViewById(R.id.enable_metrics_checkbox);
+-
+         View navKeysRow = findViewById(R.id.nav_keys);
+         navKeysRow.setOnClickListener(mNavKeysClickListener);
+         mNavKeys = (CheckBox) findViewById(R.id.nav_keys_checkbox);
+@@ -110,7 +88,6 @@ public class LineageSettingsActivity extends BaseSetupWizardActivity {
+     public void onResume() {
+         super.onResume();
+         updateDisableNavkeysOption();
+-        updateMetricsOption();
+     }
+ 
+     @Override
+@@ -134,15 +111,6 @@ public class LineageSettingsActivity extends BaseSetupWizardActivity {
+         return R.drawable.ic_features;
+     }
+ 
+-    private void updateMetricsOption() {
+-        final Bundle myPageBundle = mSetupWizardApp.getSettingsBundle();
+-        boolean metricsChecked =
+-                !myPageBundle.containsKey(KEY_SEND_METRICS) || myPageBundle
+-                        .getBoolean(KEY_SEND_METRICS);
+-        mMetrics.setChecked(metricsChecked);
+-        myPageBundle.putBoolean(KEY_SEND_METRICS, metricsChecked);
+-    }
+-
+     private void updateDisableNavkeysOption() {
+         if (mSupportsKeyDisabler) {
+             final Bundle myPageBundle = mSetupWizardApp.getSettingsBundle();
+diff --git a/src/org/lineageos/setupwizard/SetupWizardApp.java b/src/org/lineageos/setupwizard/SetupWizardApp.java
+index dcfe3bc..9466815 100644
+--- a/src/org/lineageos/setupwizard/SetupWizardApp.java
++++ b/src/org/lineageos/setupwizard/SetupWizardApp.java
+@@ -60,7 +60,6 @@ public class SetupWizardApp extends Application {
+     public static final String EXTRA_ENABLE_NEXT_ON_CONNECT = "wifi_enable_next_on_connect";
+ 
+     public static final String KEY_DETECT_CAPTIVE_PORTAL = "captive_portal_detection_enabled";
+-    public static final String KEY_SEND_METRICS = "send_metrics";
+     public static final String DISABLE_NAV_KEYS = "disable_nav_keys";
+     public static final String ENABLE_RECOVERY_UPDATE = "enable_recovery_update";
+     public static final String UPDATE_RECOVERY_PROP = "persist.vendor.recovery_update";

Patches/LineageOS-20.0/android_packages_apps_ThemePicker/0001-Monet_Toggle.patch

@@ -0,0 +1,279 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: empratyush <codelab@pratyush.dev>
+Date: Sun, 27 Mar 2022 11:56:58 +0530
+Subject: [PATCH] add a UI for enabling Material You
+
+---
+ res/layout/monet_mode_section_view.xml        |  30 +++++
+ res/values/strings.xml                        |   2 +
+ .../monet/MonetModeSectionController.java     | 126 ++++++++++++++++++
+ .../module/DefaultCustomizationSections.java  |   5 +
+ .../picker/monet/MonetModeSectionView.java    |  53 ++++++++
+ 5 files changed, 216 insertions(+)
+ create mode 100644 res/layout/monet_mode_section_view.xml
+ create mode 100644 src/com/android/customization/model/monet/MonetModeSectionController.java
+ create mode 100644 src/com/android/customization/picker/monet/MonetModeSectionView.java
+
+diff --git a/res/layout/monet_mode_section_view.xml b/res/layout/monet_mode_section_view.xml
+new file mode 100644
+index 0000000..2cfed92
+--- /dev/null
++++ b/res/layout/monet_mode_section_view.xml
+@@ -0,0 +1,30 @@
++<?xml version="1.0" encoding="utf-8"?>
++<com.android.customization.picker.monet.MonetModeSectionView
++    xmlns:android="http://schemas.android.com/apk/res/android"
++    android:layout_width="match_parent"
++    android:layout_height="wrap_content"
++    android:background="?selectableItemBackground"
++    android:clickable="true"
++    android:gravity="center_vertical"
++    android:orientation="horizontal"
++    android:paddingVertical="@dimen/section_vertical_padding"
++    android:paddingHorizontal="@dimen/section_horizontal_padding">
++
++    <TextView
++        android:id="@+id/monet_mode_toggle_title"
++        android:layout_width="0dp"
++        android:layout_height="wrap_content"
++        android:layout_weight="1"
++        android:text="@string/monet_title"
++        style="@style/SectionTitleTextStyle"/>
++
++    <Switch
++        android:id="@+id/monet_mode_toggle"
++        android:layout_width="wrap_content"
++        android:layout_height="wrap_content"
++        android:background="@null"
++        android:clickable="false"
++        android:focusable="false"
++        style="@style/Switch.SettingsLib"/>
++
++</com.android.customization.picker.monet.MonetModeSectionView>
+diff --git a/res/values/strings.xml b/res/values/strings.xml
+index 1a15fd0..7d81de1 100755
+--- a/res/values/strings.xml
++++ b/res/values/strings.xml
+@@ -236,6 +236,8 @@
+     <!-- The title of mode section view. [CHAR_LIMIT=20] -->
+     <string name="mode_title" msgid="1000319159005403986">Dark theme</string>
+     <string name="mode_disabled_msg" msgid="1926077857799715086">Temporarily disabled due to Battery Saver</string>
++
++    <string name="monet_title">Use wallpaper colors</string>
+     <!-- The text for A11y announcement when theme changes. -->
+     <string name="mode_changed">Theme changed</string>
+ 
+diff --git a/src/com/android/customization/model/monet/MonetModeSectionController.java b/src/com/android/customization/model/monet/MonetModeSectionController.java
+new file mode 100644
+index 0000000..214d6b1
+--- /dev/null
++++ b/src/com/android/customization/model/monet/MonetModeSectionController.java
+@@ -0,0 +1,126 @@
++package com.android.customization.model.monet;
++
++import static android.provider.Settings.Secure.MONET_MODE_DISABLED;
++import static android.provider.Settings.Secure.MONET_MODE_ENABLED;
++
++import android.content.Context;
++import android.database.ContentObserver;
++import android.os.Handler;
++import android.os.Looper;
++import android.provider.Settings;
++import android.view.LayoutInflater;
++import android.widget.Switch;
++
++import androidx.annotation.MainThread;
++import androidx.lifecycle.Lifecycle;
++import androidx.lifecycle.LifecycleObserver;
++import androidx.lifecycle.OnLifecycleEvent;
++
++import com.android.customization.picker.monet.MonetModeSectionView;
++import com.android.wallpaper.R;
++import com.android.wallpaper.model.CustomizationSectionController;
++
++import java.util.concurrent.ExecutorService;
++import java.util.concurrent.Executors;
++
++public class MonetModeSectionController implements
++        CustomizationSectionController<MonetModeSectionView>, LifecycleObserver {
++
++    private static final ExecutorService sExecutorService = Executors.newSingleThreadExecutor();
++    private final Lifecycle mLifecycle;
++    private Context mContext;
++    private MonetModeSectionView mMonetModeSectionView;
++
++    private final ContentObserver mContentObserver = new ContentObserver(
++            new Handler(Looper.getMainLooper())) {
++        @Override
++        public void onChange(boolean selfChange) {
++            super.onChange(selfChange);
++            sExecutorService.execute(() -> {
++                //set is checked ??
++            });
++        }
++    };
++
++    public MonetModeSectionController(Context context, Lifecycle lifecycle) {
++        mContext = context;
++        mLifecycle = lifecycle;
++        mLifecycle.addObserver(this);
++    }
++
++
++    @OnLifecycleEvent(Lifecycle.Event.ON_START)
++    @MainThread
++    public void onStart() {
++        sExecutorService.submit(() -> {
++            if (mContext != null && mLifecycle.getCurrentState().isAtLeast(
++                    Lifecycle.State.STARTED)) {
++
++                mContext.getContentResolver().registerContentObserver(
++                        Settings.Secure.getUriFor(Settings.Secure.MONET_MODE), false,
++                        mContentObserver);
++            }
++        });
++    }
++
++    @OnLifecycleEvent(Lifecycle.Event.ON_STOP)
++    @MainThread
++    public void onStop() {
++        sExecutorService.submit(() -> {
++            mContext.getContentResolver().unregisterContentObserver(mContentObserver);
++        });
++    }
++
++    @Override
++    public void release() {
++        mLifecycle.removeObserver(this);
++        mContext = null;
++    }
++
++    @Override
++    public boolean isAvailable(Context context) {
++        return context != null;
++    }
++
++    @Override
++    public MonetModeSectionView createView(Context context) {
++        mMonetModeSectionView = (MonetModeSectionView) LayoutInflater.from(context).inflate(
++                R.layout.monet_mode_section_view, /* root= */ null);
++        mMonetModeSectionView.setViewListener(this::onViewActivated);
++        mMonetModeSectionView.setEnabled(isAvailable(context));
++        return mMonetModeSectionView;
++    }
++
++    private void onViewActivated(Context context, boolean viewActivated) {
++        if (context == null) {
++            return;
++        }
++        Switch switchView = mMonetModeSectionView.findViewById(R.id.monet_mode_toggle);
++        int shortDelay = context.getResources().getInteger(android.R.integer.config_shortAnimTime);
++        new Handler(Looper.getMainLooper()).postDelayed(() -> {
++                    mMonetModeSectionView.announceForAccessibility(
++                            context.getString(R.string.mode_changed));
++                    setMonetEnabled(viewActivated, context);
++                },
++                /* delayMillis= */ shortDelay);
++    }
++
++    public static boolean isMonetEnabled(Context context) {
++        return Settings.Secure.getIntForUser(
++                context.getContentResolver(),
++                Settings.Secure.MONET_MODE,
++                MONET_MODE_DISABLED,
++                context.getUserId()
++        ) == MONET_MODE_ENABLED;
++    }
++
++    public static void setMonetEnabled(boolean isEnabled, Context context) {
++        Settings.Secure.putIntForUser(context.getContentResolver(),
++                Settings.Secure.MONET_MODE,
++                isEnabled ? MONET_MODE_ENABLED : MONET_MODE_DISABLED,
++                context.getUserId()
++        );
++    }
++
++
++}
+diff --git a/src/com/android/customization/module/DefaultCustomizationSections.java b/src/com/android/customization/module/DefaultCustomizationSections.java
+index 096552e..45a27a6 100644
+--- a/src/com/android/customization/module/DefaultCustomizationSections.java
++++ b/src/com/android/customization/module/DefaultCustomizationSections.java
+@@ -10,6 +10,7 @@ import com.android.customization.model.color.ColorSectionController;
+ import com.android.customization.model.grid.GridOptionsManager;
+ import com.android.customization.model.grid.GridSectionController;
+ import com.android.customization.model.mode.DarkModeSectionController;
++import com.android.customization.model.monet.MonetModeSectionController;
+ import com.android.customization.model.themedicon.ThemedIconSectionController;
+ import com.android.customization.model.themedicon.ThemedIconSwitchProvider;
+ import com.android.wallpaper.model.CustomizationSectionController;
+@@ -50,6 +51,10 @@ public final class DefaultCustomizationSections implements CustomizationSections
+         sectionControllers.add(new DarkModeSectionController(activity,
+                 lifecycleOwner.getLifecycle()));
+ 
++        // Monet enable/disable section.
++        sectionControllers.add(new MonetModeSectionController(activity,
++                lifecycleOwner.getLifecycle()));
++
+         // Themed app icon section.
+         sectionControllers.add(new ThemedIconSectionController(
+                 ThemedIconSwitchProvider.getInstance(activity), workspaceViewModel,
+diff --git a/src/com/android/customization/picker/monet/MonetModeSectionView.java b/src/com/android/customization/picker/monet/MonetModeSectionView.java
+new file mode 100644
+index 0000000..90d6e43
+--- /dev/null
++++ b/src/com/android/customization/picker/monet/MonetModeSectionView.java
+@@ -0,0 +1,53 @@
++package com.android.customization.picker.monet;
++
++import android.content.Context;
++import android.util.AttributeSet;
++import android.widget.Switch;
++
++import androidx.annotation.Nullable;
++
++import com.android.customization.model.monet.MonetModeSectionController;
++import com.android.wallpaper.R;
++import com.android.wallpaper.picker.SectionView;
++
++public final class MonetModeSectionView extends SectionView {
++
++    private boolean mIsMonetEnabled;
++    private Switch switchView;
++
++    public MonetModeSectionView(Context context, @Nullable AttributeSet attrs) {
++        super(context, attrs);
++        setTitle(context.getString(R.string.mode_title));
++        mIsMonetEnabled = MonetModeSectionController.isMonetEnabled(context);
++    }
++
++    @Override
++    protected void onFinishInflate() {
++        super.onFinishInflate();
++        switchView = findViewById(R.id.monet_mode_toggle);
++        switchView.setChecked(mIsMonetEnabled);
++        switchView.setOnCheckedChangeListener((buttonView, isChecked) ->
++                switchView.setChecked(mIsMonetEnabled)
++        );
++        setOnClickListener(view -> modeToggleClicked());
++    }
++
++    private void modeToggleClicked() {
++        mIsMonetEnabled = !mIsMonetEnabled;
++        viewActivated(mIsMonetEnabled);
++    }
++
++    private void viewActivated(boolean isChecked) {
++        if (mSectionViewListener != null) {
++            mSectionViewListener.onViewActivated(getContext(), isChecked);
++        }
++    }
++
++    @Override
++    public void setEnabled(boolean enabled) {
++        final int numOfChildViews = getChildCount();
++        for (int i = 0; i < numOfChildViews; i++) {
++            getChildAt(i).setEnabled(enabled);
++        }
++    }
++}

Patches/LineageOS-20.0/android_packages_apps_Updater/0001-Server.patch

@@ -0,0 +1,33 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Tad <tad@spotco.us>
+Date: Thu, 20 Sep 2018 16:43:46 -0400
+Subject: [PATCH] Switch to our update server
+
+Change-Id: I26dc2942736cf0cfe4e7b92ddfdd04b9d74dbae5
+---
+ src/org/lineageos/updater/misc/Utils.java | 11 ++---------
+ 1 file changed, 2 insertions(+), 9 deletions(-)
+
+diff --git a/src/org/lineageos/updater/misc/Utils.java b/src/org/lineageos/updater/misc/Utils.java
+index 79ded8f..69a5252 100644
+--- a/src/org/lineageos/updater/misc/Utils.java
++++ b/src/org/lineageos/updater/misc/Utils.java
+@@ -153,16 +153,9 @@ public class Utils {
+         String incrementalVersion = SystemProperties.get(Constants.PROP_BUILD_VERSION_INCREMENTAL);
+         String device = SystemProperties.get(Constants.PROP_NEXT_DEVICE,
+                 SystemProperties.get(Constants.PROP_DEVICE));
+-        String type = SystemProperties.get(Constants.PROP_RELEASE_TYPE).toLowerCase(Locale.ROOT);
++        String server = "0OTA_SERVER_CLEARNET0";
+ 
+-        String serverUrl = SystemProperties.get(Constants.PROP_UPDATER_URI);
+-        if (serverUrl.trim().isEmpty()) {
+-            serverUrl = context.getString(R.string.updater_server_url);
+-        }
+-
+-        return serverUrl.replace("{device}", device)
+-                .replace("{type}", type)
+-                .replace("{incr}", incrementalVersion);
++        return server + "?base=LineageOS&device=" + device + "&inc=" + incrementalVersion;
+     }
+ 
+     public static String getUpgradeBlockedURL(Context context) {

Patches/LineageOS-20.0/android_packages_apps_Updater/0002-Tor_Support.patch

@@ -0,0 +1,397 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Tad <tad@spotco.us>
+Date: Thu, 20 Sep 2018 21:44:53 -0400
+Subject: [PATCH] Add support for routing over Tor
+
+Change-Id: Ibfe080c3d801af34fb64fda1b6b8f4f39a2b1ccf
+---
+ AndroidManifest.xml                           |  4 ++
+ res/layout/preferences_dialog.xml             |  8 +++
+ res/values/strings.xml                        |  2 +
+ .../lineageos/updater/UpdatesActivity.java    | 12 ++++
+ .../updater/UpdatesCheckReceiver.java         |  4 ++
+ .../updater/controller/UpdaterController.java |  8 +++
+ .../updater/download/DownloadClient.java      |  8 ++-
+ .../download/HttpURLConnectionClient.java     | 27 ++++++--
+ src/org/lineageos/updater/misc/Constants.java |  1 +
+ src/org/lineageos/updater/misc/Utils.java     | 65 +++++++++++++++++++
+ 10 files changed, 134 insertions(+), 5 deletions(-)
+
+diff --git a/AndroidManifest.xml b/AndroidManifest.xml
+index 693ded4..91e85a3 100644
+--- a/AndroidManifest.xml
++++ b/AndroidManifest.xml
+@@ -12,6 +12,10 @@
+     <uses-permission android:name="android.permission.START_ACTIVITIES_FROM_BACKGROUND" />
+     <uses-permission android:name="android.permission.WAKE_LOCK" />
+ 
++    <queries>
++        <package android:name="org.torproject.android" />
++    </queries>
++
+     <application
+         android:allowBackup="false"
+         android:icon="@mipmap/ic_launcher"
+diff --git a/res/layout/preferences_dialog.xml b/res/layout/preferences_dialog.xml
+index c586f44..b1536ea 100644
+--- a/res/layout/preferences_dialog.xml
++++ b/res/layout/preferences_dialog.xml
+@@ -29,6 +29,14 @@
+             android:entries="@array/menu_auto_updates_check_interval_entries" />
+     </LinearLayout>
+ 
++    <androidx.appcompat.widget.SwitchCompat
++        android:id="@+id/preferences_onion_routing"
++        android:layout_width="match_parent"
++        android:layout_height="wrap_content"
++        android:layout_marginBottom="16dp"
++        android:text="@string/menu_onion_routing"
++        android:textSize="16sp" />
++
+     <androidx.appcompat.widget.SwitchCompat
+         android:id="@+id/preferences_auto_delete_updates"
+         android:layout_width="match_parent"
+diff --git a/res/values/strings.xml b/res/values/strings.xml
+index bfb2627..916e1e6 100644
+--- a/res/values/strings.xml
++++ b/res/values/strings.xml
+@@ -70,6 +70,7 @@
+     <string name="menu_auto_updates_check_interval_weekly">Once a week</string>
+     <string name="menu_auto_updates_check_interval_monthly">Once a month</string>
+     <string name="menu_auto_updates_check_interval_never">Never</string>
++    <string name="menu_onion_routing">Perform requests over Tor</string>
+     <string name="menu_auto_delete_updates">Delete updates when installed</string>
+     <string name="menu_delete_update">Delete</string>
+     <string name="menu_copy_url">Copy URL</string>
+@@ -87,6 +88,7 @@
+     <string name="snack_download_failed">The download failed. Please check your internet connection and try again later.</string>
+     <string name="snack_download_verification_failed">The update verification failed.</string>
+     <string name="snack_download_verified">Download completed.</string>
++    <string name="snack_orbot_not_available">Orbot is not installed, disabling Tor routing!</string>
+ 
+     <string name="snack_update_not_installable">This update can\'t be installed on top of the current build.</string>
+ 
+diff --git a/src/org/lineageos/updater/UpdatesActivity.java b/src/org/lineageos/updater/UpdatesActivity.java
+index 9c56f0b..766fb83 100644
+--- a/src/org/lineageos/updater/UpdatesActivity.java
++++ b/src/org/lineageos/updater/UpdatesActivity.java
+@@ -377,10 +377,14 @@ public class UpdatesActivity extends UpdatesListActivity {
+ 
+         final DownloadClient downloadClient;
+         try {
++            if(Utils.isOnionRoutingEnabled(getApplicationContext())) {
++                Utils.requestStartOrbot(getApplicationContext());
++            }
+             downloadClient = new DownloadClient.Builder()
+                     .setUrl(url)
+                     .setDestination(jsonFileTmp)
+                     .setDownloadCallback(callback)
++                    .setUseOnionRouting(Utils.isOnionRoutingEnabled(getApplicationContext()))
+                     .build();
+         } catch (IOException exception) {
+             Log.e(TAG, "Could not build download client");
+@@ -480,6 +484,7 @@ public class UpdatesActivity extends UpdatesListActivity {
+     private void showPreferencesDialog() {
+         View view = LayoutInflater.from(this).inflate(R.layout.preferences_dialog, null);
+         Spinner autoCheckInterval = view.findViewById(R.id.preferences_auto_updates_check_interval);
++        SwitchCompat onionRouting = view.findViewById(R.id.preferences_onion_routing);
+         SwitchCompat autoDelete = view.findViewById(R.id.preferences_auto_delete_updates);
+         SwitchCompat dataWarning = view.findViewById(R.id.preferences_mobile_data_warning);
+         SwitchCompat abPerfMode = view.findViewById(R.id.preferences_ab_perf_mode);
+@@ -491,6 +496,7 @@ public class UpdatesActivity extends UpdatesListActivity {
+ 
+         SharedPreferences prefs = PreferenceManager.getDefaultSharedPreferences(this);
+         autoCheckInterval.setSelection(Utils.getUpdateCheckSetting(this));
++        onionRouting.setChecked(prefs.getBoolean(Constants.PREF_ONION_ROUTING, false));
+         autoDelete.setChecked(prefs.getBoolean(Constants.PREF_AUTO_DELETE_UPDATES, false));
+         dataWarning.setChecked(prefs.getBoolean(Constants.PREF_MOBILE_DATA_WARNING, true));
+         abPerfMode.setChecked(prefs.getBoolean(Constants.PREF_AB_PERF_MODE, false));
+@@ -530,6 +536,8 @@ public class UpdatesActivity extends UpdatesListActivity {
+                     prefs.edit()
+                             .putInt(Constants.PREF_AUTO_UPDATES_CHECK_INTERVAL,
+                                     autoCheckInterval.getSelectedItemPosition())
++                            .putBoolean(Constants.PREF_ONION_ROUTING,
++                                    onionRouting.isChecked() && Utils.isOrbotInstalled(getApplicationContext()))
+                             .putBoolean(Constants.PREF_AUTO_DELETE_UPDATES, autoDelete.isChecked())
+                             .putBoolean(Constants.PREF_MOBILE_DATA_WARNING, dataWarning.isChecked())
+                             .putBoolean(Constants.PREF_AB_PERF_MODE, abPerfMode.isChecked())
+@@ -542,6 +550,10 @@ public class UpdatesActivity extends UpdatesListActivity {
+                         UpdatesCheckReceiver.cancelUpdatesCheck(this);
+                     }
+ 
++                    if(onionRouting.isChecked() && !Utils.isOrbotInstalled(getApplicationContext())) {
++                        showSnackbar(R.string.snack_orbot_not_available, Snackbar.LENGTH_LONG);
++                    }
++
+                     if (Utils.isABDevice()) {
+                         boolean enableABPerfMode = abPerfMode.isChecked();
+                         mUpdaterService.getUpdaterController().setPerformanceMode(enableABPerfMode);
+diff --git a/src/org/lineageos/updater/UpdatesCheckReceiver.java b/src/org/lineageos/updater/UpdatesCheckReceiver.java
+index 7fa9cd5..962fd00 100644
+--- a/src/org/lineageos/updater/UpdatesCheckReceiver.java
++++ b/src/org/lineageos/updater/UpdatesCheckReceiver.java
+@@ -110,10 +110,14 @@ public class UpdatesCheckReceiver extends BroadcastReceiver {
+         };
+ 
+         try {
++            if(Utils.isOnionRoutingEnabled(context)) {
++                Utils.requestStartOrbot(context);
++            }
+             DownloadClient downloadClient = new DownloadClient.Builder()
+                     .setUrl(url)
+                     .setDestination(jsonNew)
+                     .setDownloadCallback(callback)
++                    .setUseOnionRouting(Utils.isOnionRoutingEnabled(context))
+                     .build();
+             downloadClient.start();
+         } catch (IOException e) {
+diff --git a/src/org/lineageos/updater/controller/UpdaterController.java b/src/org/lineageos/updater/controller/UpdaterController.java
+index 5d7d51a..7ac5f5b 100644
+--- a/src/org/lineageos/updater/controller/UpdaterController.java
++++ b/src/org/lineageos/updater/controller/UpdaterController.java
+@@ -374,12 +374,16 @@ public class UpdaterController {
+         update.setFile(destination);
+         DownloadClient downloadClient;
+         try {
++            if(Utils.isOnionRoutingEnabled(mContext)) {
++                Utils.requestStartOrbot(mContext);
++            }
+             downloadClient = new DownloadClient.Builder()
+                     .setUrl(update.getDownloadUrl())
+                     .setDestination(update.getFile())
+                     .setDownloadCallback(getDownloadCallback(downloadId))
+                     .setProgressListener(getProgressListener(downloadId))
+                     .setUseDuplicateLinks(true)
++                    .setUseOnionRouting(Utils.isOnionRoutingEnabled(mContext))
+                     .build();
+         } catch (IOException exception) {
+             Log.e(TAG, "Could not build download client");
+@@ -419,6 +423,9 @@ public class UpdaterController {
+             verifyUpdateAsync(downloadId);
+             notifyUpdateChange(downloadId);
+         } else {
++            if(Utils.isOnionRoutingEnabled(mContext)) {
++                Utils.requestStartOrbot(mContext);
++            }
+             DownloadClient downloadClient;
+             try {
+                 downloadClient = new DownloadClient.Builder()
+@@ -427,6 +434,7 @@ public class UpdaterController {
+                         .setDownloadCallback(getDownloadCallback(downloadId))
+                         .setProgressListener(getProgressListener(downloadId))
+                         .setUseDuplicateLinks(true)
++                        .setUseOnionRouting(Utils.isOnionRoutingEnabled(mContext))
+                         .build();
+             } catch (IOException exception) {
+                 Log.e(TAG, "Could not build download client");
+diff --git a/src/org/lineageos/updater/download/DownloadClient.java b/src/org/lineageos/updater/download/DownloadClient.java
+index 3494947..7a7f7cf 100644
+--- a/src/org/lineageos/updater/download/DownloadClient.java
++++ b/src/org/lineageos/updater/download/DownloadClient.java
+@@ -60,6 +60,7 @@ public interface DownloadClient {
+         private DownloadClient.DownloadCallback mCallback;
+         private DownloadClient.ProgressListener mProgressListener;
+         private boolean mUseDuplicateLinks;
++        private boolean mOnionRouting;
+ 
+         public DownloadClient build() throws IOException {
+             if (mUrl == null) {
+@@ -70,7 +71,7 @@ public interface DownloadClient {
+                 throw new IllegalStateException("No download callback defined");
+             }
+             return new HttpURLConnectionClient(mUrl, mDestination, mProgressListener, mCallback,
+-                    mUseDuplicateLinks);
++                    mUseDuplicateLinks, mOnionRouting);
+         }
+ 
+         public Builder setUrl(String url) {
+@@ -97,5 +98,10 @@ public interface DownloadClient {
+             mUseDuplicateLinks = useDuplicateLinks;
+             return this;
+         }
++
++        public Builder setUseOnionRouting(boolean onionRouting) {
++            mOnionRouting = onionRouting;
++            return this;
++        }
+     }
+ }
+diff --git a/src/org/lineageos/updater/download/HttpURLConnectionClient.java b/src/org/lineageos/updater/download/HttpURLConnectionClient.java
+index b9c4b5d..b94fff0 100644
+--- a/src/org/lineageos/updater/download/HttpURLConnectionClient.java
++++ b/src/org/lineageos/updater/download/HttpURLConnectionClient.java
+@@ -18,12 +18,16 @@ package org.lineageos.updater.download;
+ import android.os.SystemClock;
+ import android.util.Log;
+ 
++import org.lineageos.updater.misc.Utils;
++
+ import java.io.File;
+ import java.io.FileOutputStream;
+ import java.io.IOException;
+ import java.io.InputStream;
+ import java.io.OutputStream;
+ import java.net.HttpURLConnection;
++import java.net.InetSocketAddress;
++import java.net.Proxy;
+ import java.net.URL;
+ import java.util.Comparator;
+ import java.util.List;
+@@ -42,6 +46,7 @@ public class HttpURLConnectionClient implements DownloadClient {
+     private final DownloadClient.ProgressListener mProgressListener;
+     private final DownloadClient.DownloadCallback mCallback;
+     private final boolean mUseDuplicateLinks;
++    private final boolean mUseOnionRouting;
+ 
+     private DownloadThread mDownloadThread;
+ 
+@@ -56,8 +61,14 @@ public class HttpURLConnectionClient implements DownloadClient {
+     HttpURLConnectionClient(String url, File destination,
+             DownloadClient.ProgressListener progressListener,
+             DownloadClient.DownloadCallback callback,
+-            boolean useDuplicateLinks) throws IOException {
+-        mClient = (HttpURLConnection) new URL(url).openConnection();
++            boolean useDuplicateLinks, boolean useOnionRouting) throws IOException {
++        mUseOnionRouting = useOnionRouting;
++        if(mUseOnionRouting) {
++            Proxy orbot = new Proxy(Proxy.Type.SOCKS, new InetSocketAddress("127.0.0.1", 9050));
++            mClient = (HttpURLConnection) new URL(url).openConnection(orbot);
++        } else {
++            mClient = (HttpURLConnection) new URL(url).openConnection();
++        }
+         mDestination = destination;
+         mProgressListener = progressListener;
+         mCallback = callback;
+@@ -177,7 +188,12 @@ public class HttpURLConnectionClient implements DownloadClient {
+         private void changeClientUrl(URL newUrl) throws IOException {
+             String range = mClient.getRequestProperty("Range");
+             mClient.disconnect();
+-            mClient = (HttpURLConnection) newUrl.openConnection();
++            if(mUseOnionRouting) {
++                Proxy orbot = new Proxy(Proxy.Type.SOCKS, new InetSocketAddress("127.0.0.1", 9050));
++                mClient = (HttpURLConnection) newUrl.openConnection(orbot);
++            } else {
++                mClient = (HttpURLConnection) newUrl.openConnection();
++            }
+             if (range != null) {
+                 mClient.setRequestProperty("Range", range);
+             }
+@@ -232,7 +248,7 @@ public class HttpURLConnectionClient implements DownloadClient {
+                     }
+                     Log.d(TAG, "Downloading from " + newUrl);
+                     changeClientUrl(url);
+-                    mClient.setConnectTimeout(5000);
++                    mClient.setConnectTimeout(mUseOnionRouting ? 45000 : 5000);
+                     mClient.connect();
+                     if (!isSuccessCode(mClient.getResponseCode())) {
+                         throw new IOException("Server replied with " + mClient.getResponseCode());
+@@ -257,6 +273,9 @@ public class HttpURLConnectionClient implements DownloadClient {
+         public void run() {
+             boolean justResumed = false;
+             try {
++                if(mUseOnionRouting) {
++                    Utils.waitUntilOrbotIsAvailable();
++                }
+                 mClient.setInstanceFollowRedirects(!mUseDuplicateLinks);
+                 mClient.connect();
+                 int responseCode = mClient.getResponseCode();
+diff --git a/src/org/lineageos/updater/misc/Constants.java b/src/org/lineageos/updater/misc/Constants.java
+index 6144ed7..37e81d8 100644
+--- a/src/org/lineageos/updater/misc/Constants.java
++++ b/src/org/lineageos/updater/misc/Constants.java
+@@ -30,6 +30,7 @@ public final class Constants {
+ 
+     public static final String PREF_LAST_UPDATE_CHECK = "last_update_check";
+     public static final String PREF_AUTO_UPDATES_CHECK_INTERVAL = "auto_updates_check_interval";
++    public static final String PREF_ONION_ROUTING = "onion_routing";
+     public static final String PREF_AUTO_DELETE_UPDATES = "auto_delete_updates";
+     public static final String PREF_AB_PERF_MODE = "ab_perf_mode";
+     public static final String PREF_MOBILE_DATA_WARNING = "pref_mobile_data_warning";
+diff --git a/src/org/lineageos/updater/misc/Utils.java b/src/org/lineageos/updater/misc/Utils.java
+index 69a5252..2b42726 100644
+--- a/src/org/lineageos/updater/misc/Utils.java
++++ b/src/org/lineageos/updater/misc/Utils.java
+@@ -44,6 +44,7 @@ import java.io.BufferedReader;
+ import java.io.File;
+ import java.io.FileReader;
+ import java.io.IOException;
++import java.net.Socket;
+ import java.util.ArrayList;
+ import java.util.Enumeration;
+ import java.util.HashSet;
+@@ -149,11 +150,75 @@ public class Utils {
+         return updates;
+     }
+ 
++    //Credit: https://stackoverflow.com/a/6758962
++    public static boolean isPackageInstalled(Context context, String packageID) {
++        PackageManager pm = context.getPackageManager();
++        try {
++            pm.getPackageInfo(packageID, PackageManager.GET_META_DATA);
++        } catch(PackageManager.NameNotFoundException e) {
++            return false;
++        }
++        return true;
++    }
++
++    public static boolean isOrbotInstalled(Context context) {
++        return isPackageInstalled(context, "org.torproject.android");
++    }
++
++    public static boolean isOnionRoutingEnabled(Context context) {
++        SharedPreferences preferences = PreferenceManager.getDefaultSharedPreferences(context);
++        return preferences.getBoolean(Constants.PREF_ONION_ROUTING, false);
++    }
++
++    //Credit: OrbotHelper/NetCipher
++    public static void requestStartOrbot(Context context) {
++        Intent intent = new Intent("org.torproject.android.intent.action.START");
++        intent.setPackage("org.torproject.android");
++        intent.putExtra("org.torproject.android.intent.extra.PACKAGE_NAME", context.getPackageName());
++        context.sendBroadcast(intent);
++    }
++
++    //Credit: https://www.geekality.net/2013/04/30/java-simple-check-to-see-if-a-server-is-listening-on-a-port/
++    public static boolean isPortListening(String host, int port) {
++        Socket s = null;
++        try {
++            s = new Socket(host, port);
++            return true;
++        } catch(Exception e) {
++            return false;
++        } finally {
++            if (s != null) {
++                try {
++                    s.close();
++                } catch(Exception e1) {
++                }
++            }
++        }
++    }
++
++    public static boolean waitUntilOrbotIsAvailable() {
++        int tries = 0;
++        boolean listening;
++        while(!(listening = isPortListening("127.0.0.1", 9050)) && tries <= 60) {
++            tries++;
++            try {
++                Thread.sleep(1000);
++            } catch(Exception e) {
++
++            }
++        }
++        return listening;
++    }
++
+     public static String getServerURL(Context context) {
+         String incrementalVersion = SystemProperties.get(Constants.PROP_BUILD_VERSION_INCREMENTAL);
+         String device = SystemProperties.get(Constants.PROP_NEXT_DEVICE,
+                 SystemProperties.get(Constants.PROP_DEVICE));
+         String server = "0OTA_SERVER_CLEARNET0";
++        String serverOnion = "0OTA_SERVER_ONION0";
++        if(serverOnion.toLowerCase().startsWith("http") && isOnionRoutingEnabled(context)) {
++            server = serverOnion;
++        }
+ 
+         return server + "?base=LineageOS&device=" + device + "&inc=" + incrementalVersion;
+     }

Patches/LineageOS-20.0/android_packages_modules_DnsResolver/0001-Hosts_Cache.patch

@@ -0,0 +1,659 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Tom Marshall <tdm.code@gmail.com>
+Date: Tue, 25 Aug 2020 08:31:32 -0700
+Subject: [PATCH] DnsResolver: Sort and cache hosts file data for fast lookup
+
+The hosts file is normally searched linearly.  This is very slow when
+the file is large.  To mitigate this, read the hosts file and sort the
+entries in an in-memory cache.  When an address is requested via
+gethostbyname or getaddrinfo, binary search the cache.
+
+In case where the cache is not available, return a suitable error code
+and fall back to the existing lookup code.
+
+This has been written to behave as much like the existing lookup code as
+possible.  But note bionic and glibc differ in behavior for some corner
+cases.  Choose the most standard compliant behavior for these where
+possible.  Otherwise choose the behavior that seems most reasonable.
+
+Note: this change is the analogue of the bionic change of the same name.
+Both should be kept in sync.
+
+Change-Id: I5926493864d4b1291ae83f8b601bf5dcc54085cd
+---
+ Android.bp      |   1 +
+ getaddrinfo.cpp |   9 +
+ hosts_cache.cpp | 523 ++++++++++++++++++++++++++++++++++++++++++++++++
+ hosts_cache.h   |  28 +++
+ sethostent.cpp  |   7 +
+ 5 files changed, 568 insertions(+)
+ create mode 100644 hosts_cache.cpp
+ create mode 100644 hosts_cache.h
+
+diff --git a/Android.bp b/Android.bp
+index 45425aa..e843654 100644
+--- a/Android.bp
++++ b/Android.bp
+@@ -164,6 +164,7 @@ cc_library {
+         "getaddrinfo.cpp",
+         "gethnamaddr.cpp",
+         "sethostent.cpp",
++        "hosts_cache.cpp",
+         "res_cache.cpp",
+         "res_comp.cpp",
+         "res_debug.cpp",
+diff --git a/getaddrinfo.cpp b/getaddrinfo.cpp
+index 6674f23..d854293 100644
+--- a/getaddrinfo.cpp
++++ b/getaddrinfo.cpp
+@@ -66,6 +66,8 @@
+ #include "resolv_private.h"
+ #include "util.h"
+ 
++#include "hosts_cache.h"
++
+ #define ANY 0
+ 
+ using android::net::NetworkDnsEventReported;
+@@ -1559,6 +1561,13 @@ static bool files_getaddrinfo(const size_t netid, const char* name, const addrin
+     FILE* hostf = nullptr;
+ 
+     cur = &sentinel;
++
++    int hc_error = hc_getaddrinfo(name, pai, &cur);
++    if (hc_error != EAI_SYSTEM) {
++        *res = sentinel.ai_next;
++        return sentinel.ai_next != NULL;
++    }
++
+     _sethtent(&hostf);
+     while ((p = _gethtent(&hostf, name, pai)) != nullptr) {
+         cur->ai_next = p;
+diff --git a/hosts_cache.cpp b/hosts_cache.cpp
+new file mode 100644
+index 0000000..a40fb40
+--- /dev/null
++++ b/hosts_cache.cpp
+@@ -0,0 +1,523 @@
++/*
++ * Copyright (C) 2016 The CyanogenMod Project
++ * Copyright (C) 2020 The LineageOS Project
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License");
++ * you may not use this file except in compliance with the License.
++ * You may obtain a copy of the License at
++ *
++ *      http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software
++ * distributed under the License is distributed on an "AS IS" BASIS,
++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++ * See the License for the specific language governing permissions and
++ * limitations under the License.
++ */
++
++#include <fcntl.h>
++#include <netdb.h>
++#include <stdio.h>
++#include <stdlib.h>
++#include <string.h>
++#include <ctype.h>
++#include <strings.h>
++#include <sys/file.h>
++#include <sys/mman.h>
++#include <sys/socket.h>
++#include <sys/stat.h>
++#include <sys/types.h>
++#include <unistd.h>
++#include <utime.h>
++#include <pthread.h>
++
++#include <netinet/in6.h>
++#include <arpa/inet.h>
++#include <arpa/nameser.h>
++
++#include "hostent.h"
++#include "resolv_private.h"
++
++constexpr int MAXALIASES = 35;
++constexpr int MAXADDRS = 35;
++
++#define MAX_ADDRLEN	(INET6_ADDRSTRLEN - (1 + 5))
++#define MAX_HOSTLEN	MAXHOSTNAMELEN
++
++#define ESTIMATED_LINELEN	32
++#define HCFILE_ALLOC_SIZE	256
++
++/* From sethostent.c */
++#define ALIGNBYTES	(sizeof(uintptr_t) - 1)
++#define ALIGN(p)	(((uintptr_t)(p) + ALIGNBYTES) &~ ALIGNBYTES)
++
++/*
++ * Host cache entry for hcfile.c_data.
++ * Offsets are into hcfile.h_data.
++ * Strings are *not* terminated by NULL, but by whitespace (isspace) or '#'.
++ * Use hstr* functions with these.
++ */
++struct hcent
++{
++    uint32_t    addr;
++    uint32_t    name;
++};
++
++/*
++ * Overall host cache file state.
++ */
++struct hcfile
++{
++    int             h_fd;
++    struct stat     h_st;
++    char*           h_data;
++
++    uint32_t        c_alloc;
++    uint32_t        c_len;
++    struct hcent*    c_data;
++};
++static struct hcfile hcfile;
++static pthread_mutex_t hclock = PTHREAD_MUTEX_INITIALIZER;
++
++static size_t hstrlen(const char *s)
++{
++    const char *p = s;
++    while (*p && *p != '#' && !isspace(*p))
++        ++p;
++    return p - s;
++}
++
++static int hstrcmp(const char *a, const char *b)
++{
++    size_t alen = hstrlen(a);
++    size_t blen = hstrlen(b);
++    int res = strncmp(a, b, MIN(alen, blen));
++    if (res == 0)
++        res = alen - blen;
++    return res;
++}
++
++static char *hstrcpy(char *dest, const char *src)
++{
++    size_t len = hstrlen(src);
++    memcpy(dest, src, len);
++    dest[len] = '\0';
++    return dest;
++}
++
++static char *hstrdup(const char *s)
++{
++    size_t len = hstrlen(s);
++    char *dest = (char *)malloc(len + 1);
++    if (!dest)
++        return NULL;
++    memcpy(dest, s, len);
++    dest[len] = '\0';
++    return dest;
++}
++
++static int cmp_hcent_name(const void *a, const void *b)
++{
++    struct hcent *ea = (struct hcent *)a;
++    const char *na = hcfile.h_data + ea->name;
++    struct hcent *eb = (struct hcent *)b;
++    const char *nb = hcfile.h_data + eb->name;
++
++    return hstrcmp(na, nb);
++}
++
++static struct hcent *_hcfindname(const char *name)
++{
++    size_t first, last, mid;
++    struct hcent *cur = NULL;
++    int cmp;
++
++    if (hcfile.c_len == 0)
++        return NULL;
++
++    first = 0;
++    last = hcfile.c_len - 1;
++    mid = (first + last) / 2;
++    while (first <= last) {
++        cur = hcfile.c_data + mid;
++        cmp = hstrcmp(hcfile.h_data + cur->name, name);
++        if (cmp == 0)
++            goto found;
++        if (cmp < 0)
++            first = mid + 1;
++        else {
++            if (mid > 0)
++                last = mid - 1;
++            else
++                return NULL;
++        }
++        mid = (first + last) / 2;
++    }
++    return NULL;
++
++found:
++    while (cur > hcfile.c_data) {
++        struct hcent *prev = cur - 1;
++        cmp = cmp_hcent_name(cur, prev);
++        if (cmp)
++            break;
++        cur = prev;
++    }
++
++    return cur;
++}
++
++/*
++ * Find next name on line, if any.
++ *
++ * Assumes that line is terminated by LF.
++ */
++static const char *_hcnextname(const char *name)
++{
++    while (!isspace(*name)) {
++        if (*name == '#')
++            return NULL;
++        ++name;
++    }
++    while (isspace(*name)) {
++        if (*name == '\n')
++            return NULL;
++        ++name;
++    }
++    if (*name == '#')
++        return NULL;
++    return name;
++}
++
++static int _hcfilemmap(void)
++{
++    struct stat st;
++    int h_fd;
++    char *h_addr;
++    const char *p, *pend;
++    uint32_t c_alloc;
++
++    h_fd = open(_PATH_HOSTS, O_CLOEXEC);
++    if (h_fd < 0)
++        return -1;
++    if (flock(h_fd, LOCK_EX) != 0) {
++        close(h_fd);
++        return -1;
++    }
++
++    if (hcfile.h_data) {
++        memset(&st, 0, sizeof(st));
++        if (fstat(h_fd, &st) == 0) {
++            if (st.st_size == hcfile.h_st.st_size &&
++                st.st_mtime == hcfile.h_st.st_mtime) {
++                flock(h_fd, LOCK_UN);
++                close(h_fd);
++                return 0;
++            }
++        }
++        free(hcfile.c_data);
++        munmap(hcfile.h_data, hcfile.h_st.st_size);
++        close(hcfile.h_fd);
++        memset(&hcfile, 0, sizeof(struct hcfile));
++    }
++
++    if (fstat(h_fd, &st) != 0) {
++        flock(h_fd, LOCK_UN);
++        close(h_fd);
++        return -1;
++    }
++    h_addr = (char*)mmap(NULL, st.st_size, PROT_READ, MAP_SHARED, h_fd, 0);
++    if (h_addr == MAP_FAILED) {
++        flock(h_fd, LOCK_UN);
++        close(h_fd);
++        return -1;
++    }
++
++    hcfile.h_fd = h_fd;
++    hcfile.h_st = st;
++    hcfile.h_data = h_addr;
++
++    c_alloc = 0;
++    /*
++     * Do an initial allocation if the file is "large".  Estimate
++     * 32 bytes per line and define "large" as more than half of
++     * the alloc growth size (256 entries).
++     */
++    if (st.st_size >= ESTIMATED_LINELEN * HCFILE_ALLOC_SIZE / 2) {
++        c_alloc = st.st_size / ESTIMATED_LINELEN;
++        hcfile.c_data = (struct hcent*)malloc(c_alloc * sizeof(struct hcent));
++        if (!hcfile.c_data) {
++            goto oom;
++        }
++    }
++
++    p = (const char *)h_addr;
++    pend = p + st.st_size;
++    while (p < pend) {
++        const char *eol, *addr, *name;
++        size_t len;
++        addr = p;
++        eol = (const char*)memchr(p, '\n', pend - p);
++        if (!eol)
++            break;
++        p = eol + 1;
++        if (*addr == '#' || *addr == '\n')
++            continue;
++        len = hstrlen(addr);
++        if (len > MAX_ADDRLEN)
++            continue;
++        name = addr + len;
++        while (name < eol && isspace(*name))
++            ++name;
++        while (name < eol) {
++            len = hstrlen(name);
++            if (len == 0)
++                break;
++            if (len < MAX_HOSTLEN) {
++                struct hcent *ent;
++                if (c_alloc <= hcfile.c_len) {
++                    struct hcent *c_data;
++                    c_alloc += HCFILE_ALLOC_SIZE;
++                    c_data = (struct hcent*)realloc(hcfile.c_data, c_alloc * sizeof(struct hcent));
++                    if (!c_data) {
++                        goto oom;
++                    }
++                    hcfile.c_data = c_data;
++                }
++                ent = hcfile.c_data + hcfile.c_len;
++                ent->addr = addr - h_addr;
++                ent->name = name - h_addr;
++                ++hcfile.c_len;
++            }
++            name += len;
++            while (name < eol && isspace(*name))
++                ++name;
++        }
++    }
++
++    qsort(hcfile.c_data, hcfile.c_len,
++        sizeof(struct hcent), cmp_hcent_name);
++
++    flock(h_fd, LOCK_UN);
++
++    return 0;
++
++oom:
++    free(hcfile.c_data);
++    munmap(hcfile.h_data, hcfile.h_st.st_size);
++    flock(hcfile.h_fd, LOCK_UN);
++    close(hcfile.h_fd);
++    memset(&hcfile, 0, sizeof(struct hcfile));
++    return -1;
++}
++
++/*
++ * Caching version of getaddrinfo.
++ *
++ * If we find the requested host name in the cache, use getaddrinfo to
++ * populate the result for each address we find.
++ *
++ * Note glibc and bionic differ in the handling of ai_canonname.  POSIX
++ * says that ai_canonname is only populated in the first result entry.
++ * glibc does this.  bionic populates ai_canonname in all result entries.
++ * We choose the POSIX/glibc way here.
++ */
++int hc_getaddrinfo(const char *name, const struct addrinfo* hints, struct addrinfo** result)
++{
++    int ret = 0;
++    struct hcent *ent, *cur;
++    struct addrinfo *ai;
++    struct addrinfo rhints;
++    struct addrinfo *last;
++    int canonname = 0;
++    int cmp;
++
++    if (getenv("ANDROID_HOSTS_CACHE_DISABLE") != NULL)
++        return EAI_SYSTEM;
++
++    if (!name)
++        return EAI_SYSTEM;
++
++    pthread_mutex_lock(&hclock);
++
++    if (_hcfilemmap() != 0) {
++        ret = EAI_SYSTEM;
++        goto out;
++    }
++    ent = _hcfindname(name);
++    if (!ent) {
++        ret = EAI_NONAME;
++        goto out;
++    }
++
++    if (hints) {
++        canonname = (hints->ai_flags & AI_CANONNAME);
++        memcpy(&rhints, hints, sizeof(rhints));
++        rhints.ai_flags &= ~AI_CANONNAME;
++    }
++    else {
++        memset(&rhints, 0, sizeof(rhints));
++    }
++    rhints.ai_flags |= AI_NUMERICHOST;
++
++    last = NULL;
++    cur = ent;
++    do {
++        char addrstr[MAX_ADDRLEN];
++        struct addrinfo *res;
++
++        hstrcpy(addrstr, hcfile.h_data + cur->addr);
++
++        if (getaddrinfo_numeric(addrstr, nullptr, rhints, &res) == 0) {
++            if (!last)
++                (*result)->ai_next = res;
++            else
++                last->ai_next = res;
++            last = res;
++            while (last->ai_next)
++                last = last->ai_next;
++        }
++
++        if(cur + 1 >= hcfile.c_data + hcfile.c_len)
++            break;
++        cmp = cmp_hcent_name(cur, cur + 1);
++        cur = cur + 1;
++    }
++    while (!cmp);
++
++    if (last == NULL) {
++        /* This check is equivalent to (*result)->ai_next == NULL */
++        ret = EAI_NODATA;
++        goto out;
++    }
++
++    if (canonname) {
++        ai = (*result)->ai_next;
++        free(ai->ai_canonname);
++        ai->ai_canonname = hstrdup(hcfile.h_data + ent->name);
++    }
++
++out:
++    pthread_mutex_unlock(&hclock);
++    return ret;
++}
++
++/*
++ * Caching version of gethtbyname.
++ *
++ * Note glibc and bionic differ in the handling of aliases.  glibc returns
++ * all aliases for all entries, regardless of whether they match h_addrtype.
++ * bionic returns only the aliases for the first hosts entry.  We return all
++ * aliases for all IPv4 entries.
++ *
++ * Additionally, if an alias is IPv6 and the primary name for an alias also
++ * has an IPv4 entry, glibc will return the IPv4 address(es), but bionic
++ * will not.  Neither do we.
++ */
++int hc_gethtbyname(const char *host, int af, struct getnamaddr *info)
++{
++    int ret = NETDB_SUCCESS;
++    struct hcent *ent, *cur;
++    int cmp;
++    size_t addrlen;
++    unsigned int naliases = 0;
++    char *aliases[MAXALIASES];
++    unsigned int naddrs = 0;
++    char *addr_ptrs[MAXADDRS];
++    unsigned int n;
++
++    if (getenv("ANDROID_HOSTS_CACHE_DISABLE") != NULL)
++        return NETDB_INTERNAL;
++
++    switch (af) {
++    case AF_INET:  addrlen = NS_INADDRSZ;  break;
++    case AF_INET6: addrlen = NS_IN6ADDRSZ; break;
++    default:
++        return NETDB_INTERNAL;
++    }
++
++    pthread_mutex_lock(&hclock);
++
++    if (_hcfilemmap() != 0) {
++        ret = NETDB_INTERNAL;
++        goto out;
++    }
++
++    ent = _hcfindname(host);
++    if (!ent) {
++        ret = HOST_NOT_FOUND;
++        goto out;
++    }
++
++    cur = ent;
++    do {
++        char addr[16];
++        char addrstr[MAX_ADDRLEN];
++        char namestr[MAX_HOSTLEN];
++        const char *name;
++
++        hstrcpy(addrstr, hcfile.h_data + cur->addr);
++        if (inet_pton(af, addrstr, &addr) == 1) {
++            char *aligned;
++            /* First match is considered the official hostname */
++            if (naddrs == 0) {
++                hstrcpy(namestr, hcfile.h_data + cur->name);
++                HENT_SCOPY(info->hp->h_name, namestr, info->buf, info->buflen);
++            }
++            for (name = hcfile.h_data + cur->name; name; name = _hcnextname(name)) {
++                if (!hstrcmp(name, host))
++                    continue;
++                hstrcpy(namestr, name);
++                HENT_SCOPY(aliases[naliases], namestr, info->buf, info->buflen);
++                ++naliases;
++                if (naliases >= MAXALIASES)
++                    goto nospc;
++            }
++            aligned = (char *)ALIGN(info->buf);
++            if (info->buf != aligned) {
++                if ((ptrdiff_t)info->buflen < (aligned - info->buf))
++                    goto nospc;
++                info->buflen -= (aligned - info->buf);
++                info->buf = aligned;
++            }
++            HENT_COPY(addr_ptrs[naddrs], addr, addrlen, info->buf, info->buflen);
++            ++naddrs;
++            if (naddrs >= MAXADDRS)
++                goto nospc;
++        }
++
++        if(cur + 1 >= hcfile.c_data + hcfile.c_len)
++            break;
++        cmp = cmp_hcent_name(cur, cur + 1);
++        cur = cur + 1;
++    }
++    while (!cmp);
++
++    if (naddrs == 0) {
++        ret = HOST_NOT_FOUND;
++        goto out;
++    }
++
++    addr_ptrs[naddrs++] = NULL;
++    aliases[naliases++] = NULL;
++
++    /* hp->h_name already populated */
++    HENT_ARRAY(info->hp->h_aliases, naliases, info->buf, info->buflen);
++    for (n = 0; n < naliases; ++n) {
++        info->hp->h_aliases[n] = aliases[n];
++    }
++    info->hp->h_addrtype = af;
++    info->hp->h_length = addrlen;
++    HENT_ARRAY(info->hp->h_addr_list, naddrs, info->buf, info->buflen);
++    for (n = 0; n < naddrs; ++n) {
++        info->hp->h_addr_list[n] = addr_ptrs[n];
++    }
++
++out:
++    pthread_mutex_unlock(&hclock);
++    return ret;
++
++nospc:
++    ret = NETDB_INTERNAL;
++    goto out;
++}
+diff --git a/hosts_cache.h b/hosts_cache.h
+new file mode 100644
+index 0000000..55138dc
+--- /dev/null
++++ b/hosts_cache.h
+@@ -0,0 +1,28 @@
++/*
++ * Copyright (C) 2016 The CyanogenMod Project
++ * Copyright (C) 2020 The LineageOS Project
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License");
++ * you may not use this file except in compliance with the License.
++ * You may obtain a copy of the License at
++ *
++ *      http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software
++ * distributed under the License is distributed on an "AS IS" BASIS,
++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++ * See the License for the specific language governing permissions and
++ * limitations under the License.
++ */
++
++#ifndef NETD_RESOLV_HOSTS_CACHE_H
++#define NETD_RESOLV_HOSTS_CACHE_H
++
++struct getnamaddr;
++
++int hc_getaddrinfo(const char* name, const struct addrinfo* hints,
++                   struct addrinfo** result);
++
++int hc_gethtbyname(const char *host, int af, struct getnamaddr *info);
++
++#endif
+diff --git a/sethostent.cpp b/sethostent.cpp
+index 7f9384c..f1bf657 100644
+--- a/sethostent.cpp
++++ b/sethostent.cpp
+@@ -43,6 +43,8 @@
+ #include "hostent.h"
+ #include "resolv_private.h"
+ 
++#include "hosts_cache.h"
++
+ constexpr int MAXALIASES = 35;
+ constexpr int MAXADDRS = 35;
+ 
+@@ -69,6 +71,11 @@ int _hf_gethtbyname2(const char* name, int af, getnamaddr* info) {
+     char* aliases[MAXALIASES];
+     char* addr_ptrs[MAXADDRS];
+ 
++    int rc = hc_gethtbyname(name, af, info);
++    if (rc != NETDB_INTERNAL) {
++        return (rc == NETDB_SUCCESS ? 0 : EAI_NODATA);
++    }
++
+     FILE* hf = NULL;
+     sethostent_r(&hf);
+     if (hf == NULL) {

Patches/LineageOS-20.0/android_packages_modules_DnsResolver/0001-Hosts_Wildcards.patch

@@ -0,0 +1,72 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Tom Marshall <tdm.code@gmail.com>
+Date: Thu, 16 Jan 2020 13:07:04 -0800
+Subject: [PATCH] DnsResolver: Support wildcards in cached hosts file
+
+If an exact name is not found in the hosts file and the host name
+contains at least one dot, search for entries of the form "*.domain",
+where domain is the portion of the host name after the first dot.  If
+that is not found, repeat using the domain.
+
+Example: a.b.c.example.com would search for the following in turn:
+	a.b.c.example.com
+	*.b.c.example.com
+	*.c.example.com
+	*.example.com
+	*.com
+
+Note: this change is the analogue of the bionic change of the same name.
+Both should be kept in sync.
+
+Change-Id: I4b0bb81699151d5b371850daebf785e35ec9b170
+---
+ hosts_cache.cpp | 29 ++++++++++++++++++++++++++++-
+ 1 file changed, 28 insertions(+), 1 deletion(-)
+
+diff --git a/hosts_cache.cpp b/hosts_cache.cpp
+index a40fb40..258eac1 100644
+--- a/hosts_cache.cpp
++++ b/hosts_cache.cpp
+@@ -126,7 +126,7 @@ static int cmp_hcent_name(const void *a, const void *b)
+     return hstrcmp(na, nb);
+ }
+ 
+-static struct hcent *_hcfindname(const char *name)
++static struct hcent *_hcfindname_exact(const char *name)
+ {
+     size_t first, last, mid;
+     struct hcent *cur = NULL;
+@@ -167,6 +167,33 @@ found:
+     return cur;
+ }
+ 
++static struct hcent *_hcfindname(const char *name)
++{
++    struct hcent *ent;
++    char namebuf[MAX_HOSTLEN];
++    char *p;
++    char *dot;
++
++    ent = _hcfindname_exact(name);
++    if (!ent && strlen(name) < sizeof(namebuf)) {
++        strlcpy(namebuf, name, sizeof(namebuf));
++        p = namebuf;
++        do {
++            dot = strchr(p, '.');
++            if (!dot)
++                break;
++            if (dot > p) {
++                *(dot - 1) = '*';
++                ent = _hcfindname_exact(dot - 1);
++            }
++            p = dot + 1;
++        }
++        while (!ent);
++    }
++
++    return ent;
++}
++
+ /*
+  * Find next name on line, if any.
+  *

Patches/LineageOS-20.0/android_packages_modules_DnsResolver/0002-hosts_toggle.patch

@@ -0,0 +1,33 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Tad <tad@spotco.us>
+Date: Wed, 20 Apr 2022 00:40:53 -0400
+Subject: [PATCH] Add a toggle to disable /etc/hosts lookup
+
+Signed-off-by: Tad <tad@spotco.us>
+Change-Id: Iea165003474e1107dc77980985bf9928c369dbb5
+---
+ getaddrinfo.cpp | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/getaddrinfo.cpp b/getaddrinfo.cpp
+index d854293..6ff4f09 100644
+--- a/getaddrinfo.cpp
++++ b/getaddrinfo.cpp
+@@ -57,6 +57,7 @@
+ #include <future>
+ 
+ #include <android-base/logging.h>
++#include <android-base/properties.h>
+ 
+ #include "Experiments.h"
+ #include "netd_resolv/resolv.h"
+@@ -1556,6 +1557,9 @@ static struct addrinfo* getCustomHosts(const size_t netid, const char* _Nonnull
+ 
+ static bool files_getaddrinfo(const size_t netid, const char* name, const addrinfo* pai,
+                               addrinfo** res) {
++    if (android::base::GetIntProperty("persist.security.hosts_disable", 0) != 0 && name != "localhost" && name != "ip6-localhost")
++        return false;
++
+     struct addrinfo sentinel = {};
+     struct addrinfo *p, *cur;
+     FILE* hostf = nullptr;

Patches/LineageOS-20.0/android_packages_modules_NetworkStack/0001-Random_MAC.patch

@@ -0,0 +1,70 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Pratyush <39559233+empratyush@users.noreply.github.com>
+Date: Thu, 20 May 2021 13:21:31 +0530
+Subject: [PATCH] avoid reusing DHCP state for full MAC randomization
+
+---
+ src/android/net/dhcp/DhcpClient.java | 29 +++++++++++++++++++++++++++-
+ 1 file changed, 28 insertions(+), 1 deletion(-)
+
+diff --git a/src/android/net/dhcp/DhcpClient.java b/src/android/net/dhcp/DhcpClient.java
+index c88b6532..c9f65d0d 100644
+--- a/src/android/net/dhcp/DhcpClient.java
++++ b/src/android/net/dhcp/DhcpClient.java
+@@ -75,6 +75,9 @@ import android.net.networkstack.aidl.dhcp.DhcpOption;
+ import android.net.util.HostnameTransliterator;
+ import android.net.util.NetworkStackUtils;
+ import android.net.util.SocketUtils;
++import android.net.wifi.WifiConfiguration;
++import android.net.wifi.WifiInfo;
++import android.net.wifi.WifiManager;
+ import android.os.Build;
+ import android.os.Handler;
+ import android.os.Message;
+@@ -116,6 +119,7 @@ import java.net.SocketAddress;
+ import java.net.SocketException;
+ import java.nio.ByteBuffer;
+ import java.util.Arrays;
++import java.util.ArrayList;
+ import java.util.List;
+ import java.util.Random;
+ 
+@@ -1250,7 +1254,7 @@ public class DhcpClient extends StateMachine {
+                                 + " lease expiry: "  + attributes.assignedV4AddressExpiry
+                                 + " current time: "  + currentTime);
+                     }
+-                    if (currentTime >= attributes.assignedV4AddressExpiry) {
++                    if (currentTime >= attributes.assignedV4AddressExpiry || shouldAvoidStateReuse()) {
+                         // Lease has expired.
+                         transitionTo(mDhcpInitState);
+                         return HANDLED;
+@@ -1284,6 +1288,29 @@ public class DhcpClient extends StateMachine {
+         return true;
+     }
+ 
++    private static final int RANDOMIZATION_ALWAYS = 100;
++
++    private boolean shouldAvoidStateReuse() {
++        try {
++            WifiManager wifiManager = (WifiManager) mContext.getSystemService(Context.WIFI_SERVICE);
++            WifiInfo wifiInfo =  wifiManager.getConnectionInfo();
++            if (wifiInfo != null) {
++                int connectedNetworkId = wifiInfo.getNetworkId();
++                List<WifiConfiguration> configurationList = wifiManager.getConfiguredNetworks();
++                for (WifiConfiguration configuration : configurationList){
++                    if (configuration.networkId == connectedNetworkId){
++                        return configuration.macRandomizationSetting == RANDOMIZATION_ALWAYS;
++                    }
++                }
++            }
++        } catch (Exception e) {
++            loge(e.getLocalizedMessage(), e);
++        }
++
++        loge("ConfiguredNetworks should contain Connected network id config");
++        return true;
++    }
++
+     private void receiveOfferOrAckPacket(final DhcpPacket packet, final boolean acceptRapidCommit) {
+         if (!isValidPacket(packet)) return;
+ 

Patches/LineageOS-20.0/android_packages_modules_Permission/0005-Browser_No_Location.patch

@@ -0,0 +1,54 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Tue, 19 Oct 2021 15:17:55 +0300
+Subject: [PATCH] stop auto-granting location to system browsers
+
+---
+ .../role/model/BrowserRoleBehavior.java       | 27 -------------------
+ 1 file changed, 27 deletions(-)
+
+diff --git a/PermissionController/src/com/android/permissioncontroller/role/model/BrowserRoleBehavior.java b/PermissionController/src/com/android/permissioncontroller/role/model/BrowserRoleBehavior.java
+index 9d4d9e08b..9765432ea 100644
+--- a/PermissionController/src/com/android/permissioncontroller/role/model/BrowserRoleBehavior.java
++++ b/PermissionController/src/com/android/permissioncontroller/role/model/BrowserRoleBehavior.java
+@@ -52,11 +52,6 @@ public class BrowserRoleBehavior implements RoleBehavior {
+             .addCategory(Intent.CATEGORY_BROWSABLE)
+             .setData(Uri.fromParts("http", "", null));
+ 
+-    private static final List<String> SYSTEM_BROWSER_PERMISSIONS = Arrays.asList(
+-            android.Manifest.permission.ACCESS_COARSE_LOCATION,
+-            android.Manifest.permission.ACCESS_FINE_LOCATION
+-    );
+-
+     @Nullable
+     @Override
+     public String getFallbackHolder(@NonNull Role role, @NonNull Context context) {
+@@ -130,28 +125,6 @@ public class BrowserRoleBehavior implements RoleBehavior {
+         return new ArrayList<>(packageNames);
+     }
+ 
+-    @Override
+-    public void grant(@NonNull Role role, @NonNull String packageName, @NonNull Context context) {
+-        // @see com.android.server.pm.permission.DefaultPermissionGrantPolicy
+-        //      #grantDefaultPermissionsToDefaultBrowser(java.lang.String, int)
+-        if (SdkLevel.isAtLeastS()) {
+-            if (PackageUtils.isSystemPackage(packageName, context)) {
+-                Permissions.grant(packageName, SYSTEM_BROWSER_PERMISSIONS, false, false, false,
+-                        true, false, context);
+-            }
+-        }
+-    }
+-
+-    @Override
+-    public void revoke(@NonNull Role role, @NonNull String packageName, @NonNull Context context) {
+-        if (SdkLevel.isAtLeastT()) {
+-            if (PackageUtils.isSystemPackage(packageName, context)) {
+-                Permissions.revoke(packageName, SYSTEM_BROWSER_PERMISSIONS, false, true, false,
+-                        context);
+-            }
+-        }
+-    }
+-
+     @Override
+     public boolean isVisibleAsUser(@NonNull Role role, @NonNull UserHandle user,
+             @NonNull Context context) {

Patches/LineageOS-20.0/android_packages_modules_Permission/0006-Location_Indicators.patch

@@ -0,0 +1,25 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Sun, 17 Oct 2021 22:53:22 -0400
+Subject: [PATCH] SystemUI: Use new privacy indicators for location
+
+Android has had location indicators for a while, but let's use the new
+privacy indicator infrastructure for displaying them. This makes them
+integrate better with the new camera and microphone indicators.
+---
+ .../permission/ui/handheld/v31/DashboardUtils.kt                | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/PermissionController/src/com/android/permissioncontroller/permission/ui/handheld/v31/DashboardUtils.kt b/PermissionController/src/com/android/permissioncontroller/permission/ui/handheld/v31/DashboardUtils.kt
+index fbb5164b4..a759a5dd5 100644
+--- a/PermissionController/src/com/android/permissioncontroller/permission/ui/handheld/v31/DashboardUtils.kt
++++ b/PermissionController/src/com/android/permissioncontroller/permission/ui/handheld/v31/DashboardUtils.kt
+@@ -129,7 +129,7 @@ fun shouldShowCameraMicIndicators(): Boolean {
+  */
+ fun isLocationIndicatorsFlagEnabled(): Boolean {
+     return DeviceConfig.getBoolean(DeviceConfig.NAMESPACE_PRIVACY,
+-            PROPERTY_LOCATION_INDICATORS_ENABLED, false)
++            PROPERTY_LOCATION_INDICATORS_ENABLED, true)
+ }
+ 
+ /**

Patches/LineageOS-20.0/android_packages_modules_Wifi/0001-Random_MAC.patch

@@ -0,0 +1,101 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Pratyush <codelab@pratyush.dev>
+Date: Wed, 17 Aug 2022 08:30:59 +0200
+Subject: [PATCH] add option of always randomizing MAC addresses
+
+Co-authored-by: renlord <me@renlord.com>
+---
+ framework/api/current.txt                           |  1 +
+ .../java/android/net/wifi/WifiConfiguration.java    | 13 ++++++++++---
+ .../com/android/server/wifi/WifiConfigManager.java  |  6 +++++-
+ .../android/server/wifi/WifiConfigurationUtil.java  |  2 +-
+ 4 files changed, 17 insertions(+), 5 deletions(-)
+
+diff --git a/framework/api/current.txt b/framework/api/current.txt
+index f78a462c90..d7546a057c 100644
+--- a/framework/api/current.txt
++++ b/framework/api/current.txt
+@@ -154,6 +154,7 @@ package android.net.wifi {
+     method public void writeToParcel(android.os.Parcel, int);
+     field @Deprecated public String BSSID;
+     field @Deprecated public String FQDN;
++    field @Deprecated public static final int RANDOMIZATION_ALWAYS = 100; // 0x64
+     field @Deprecated public static final int RANDOMIZATION_AUTO = 3; // 0x3
+     field @Deprecated public static final int RANDOMIZATION_NONE = 0; // 0x0
+     field @Deprecated public static final int RANDOMIZATION_NON_PERSISTENT = 2; // 0x2
+diff --git a/framework/java/android/net/wifi/WifiConfiguration.java b/framework/java/android/net/wifi/WifiConfiguration.java
+index e988679fac..b7f4692198 100644
+--- a/framework/java/android/net/wifi/WifiConfiguration.java
++++ b/framework/java/android/net/wifi/WifiConfiguration.java
+@@ -1787,7 +1787,8 @@ public class WifiConfiguration implements Parcelable {
+             RANDOMIZATION_NONE,
+             RANDOMIZATION_PERSISTENT,
+             RANDOMIZATION_NON_PERSISTENT,
+-            RANDOMIZATION_AUTO})
++            RANDOMIZATION_AUTO,
++            RANDOMIZATION_ALWAYS})
+     public @interface MacRandomizationSetting {}
+ 
+     /**
+@@ -1811,16 +1812,22 @@ public class WifiConfiguration implements Parcelable {
+      */
+     public static final int RANDOMIZATION_AUTO = 3;
+ 
++    /**
++     * Generate a randomize MAC always
++     */
++    public static final int RANDOMIZATION_ALWAYS = 100;
++
+     /**
+      * Level of MAC randomization for this network.
+      * One of {@link #RANDOMIZATION_NONE}, {@link #RANDOMIZATION_AUTO},
+      * {@link #RANDOMIZATION_PERSISTENT} or {@link #RANDOMIZATION_NON_PERSISTENT}.
+-     * By default this field is set to {@link #RANDOMIZATION_AUTO}.
++     * {@link #RANDOMIZATION_PERSISTENT} or {@link #RANDOMIZATION_NON_PERSISTENT} or RANDOMIZATION_ALWAYS.
++     * By default this field is set to RANDOMIZATION_ALWAYS in GrapheneOS.
+      * @hide
+      */
+     @SystemApi
+     @MacRandomizationSetting
+-    public int macRandomizationSetting = RANDOMIZATION_AUTO;
++    public int macRandomizationSetting = RANDOMIZATION_ALWAYS;
+ 
+     /**
+      * Set the MAC randomization setting for this network.
+diff --git a/service/java/com/android/server/wifi/WifiConfigManager.java b/service/java/com/android/server/wifi/WifiConfigManager.java
+index f5729dc0b8..1038c2e04f 100644
+--- a/service/java/com/android/server/wifi/WifiConfigManager.java
++++ b/service/java/com/android/server/wifi/WifiConfigManager.java
+@@ -466,6 +466,9 @@ public class WifiConfigManager {
+             return true;
+         }
+ 
++        if (config.macRandomizationSetting == WifiConfiguration.RANDOMIZATION_ALWAYS) {
++            return true;
++        }
+         if (!isMacRandomizationSupported()
+                 || config.macRandomizationSetting == WifiConfiguration.RANDOMIZATION_NONE) {
+             return false;
+@@ -620,7 +623,8 @@ public class WifiConfigManager {
+     private MacAddress updateRandomizedMacIfNeeded(WifiConfiguration config) {
+         boolean shouldUpdateMac = config.randomizedMacExpirationTimeMs
+                 < mClock.getWallClockMillis() || mClock.getWallClockMillis()
+-                - config.randomizedMacLastModifiedTimeMs >= NON_PERSISTENT_MAC_REFRESH_MS_MAX;
++                - config.randomizedMacLastModifiedTimeMs >= NON_PERSISTENT_MAC_REFRESH_MS_MAX ||
++                config.macRandomizationSetting == WifiConfiguration.RANDOMIZATION_ALWAYS;
+         if (!shouldUpdateMac) {
+             return config.getRandomizedMacAddress();
+         }
+diff --git a/service/java/com/android/server/wifi/WifiConfigurationUtil.java b/service/java/com/android/server/wifi/WifiConfigurationUtil.java
+index 907ca721dd..d1c489f4b2 100644
+--- a/service/java/com/android/server/wifi/WifiConfigurationUtil.java
++++ b/service/java/com/android/server/wifi/WifiConfigurationUtil.java
+@@ -245,7 +245,7 @@ public class WifiConfigurationUtil {
+     public static boolean hasMacRandomizationSettingsChanged(WifiConfiguration existingConfig,
+             WifiConfiguration newConfig) {
+         if (existingConfig == null) {
+-            return newConfig.macRandomizationSetting != WifiConfiguration.RANDOMIZATION_AUTO;
++            return newConfig.macRandomizationSetting != WifiConfiguration.RANDOMIZATION_ALWAYS;
+         }
+         return newConfig.macRandomizationSetting != existingConfig.macRandomizationSetting;
+     }

Patches/LineageOS-20.0/android_system_core/0001-Harden.patch

@@ -0,0 +1,60 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Mon, 12 Feb 2018 03:29:58 -0500
+Subject: [PATCH] Harden
+
+Change-Id: I46e3fc4ac896a509ab8ca90ae4ce09b820da434b
+[tad@spotco.us]: added protected fifos and regular from newer GrapheneOS patches
+[tad@spotco.us]: added IPv6 privacy options TODO split into another patch
+---
+ init/first_stage_init.cpp |  6 +++---
+ rootdir/init.rc           | 11 +++++++++++
+ 2 files changed, 14 insertions(+), 3 deletions(-)
+
+diff --git a/init/first_stage_init.cpp b/init/first_stage_init.cpp
+index d050ed783..e828916d6 100644
+--- a/init/first_stage_init.cpp
++++ b/init/first_stage_init.cpp
+@@ -237,9 +237,9 @@ int FirstStageMain(int argc, char** argv) {
+     CHECKCALL(mkdir("/dev/pts", 0755));
+     CHECKCALL(mkdir("/dev/socket", 0755));
+     CHECKCALL(mkdir("/dev/dm-user", 0755));
+-    CHECKCALL(mount("devpts", "/dev/pts", "devpts", 0, NULL));
++    CHECKCALL(mount("devpts", "/dev/pts", "devpts", MS_NOSUID|MS_NOEXEC, NULL));
+ #define MAKE_STR(x) __STRING(x)
+-    CHECKCALL(mount("proc", "/proc", "proc", 0, "hidepid=2,gid=" MAKE_STR(AID_READPROC)));
++    CHECKCALL(mount("proc", "/proc", "proc", MS_NOSUID|MS_NODEV|MS_NOEXEC, "hidepid=2,gid=" MAKE_STR(AID_READPROC)));
+ #undef MAKE_STR
+     // Don't expose the raw commandline to unprivileged processes.
+     CHECKCALL(chmod("/proc/cmdline", 0440));
+@@ -251,7 +251,7 @@ int FirstStageMain(int argc, char** argv) {
+     android::base::ReadFileToString("/proc/bootconfig", &bootconfig);
+     gid_t groups[] = {AID_READPROC};
+     CHECKCALL(setgroups(arraysize(groups), groups));
+-    CHECKCALL(mount("sysfs", "/sys", "sysfs", 0, NULL));
++    CHECKCALL(mount("sysfs", "/sys", "sysfs", MS_NOSUID|MS_NODEV|MS_NOEXEC, NULL));
+     CHECKCALL(mount("selinuxfs", "/sys/fs/selinux", "selinuxfs", 0, NULL));
+ 
+     CHECKCALL(mknod("/dev/kmsg", S_IFCHR | 0600, makedev(1, 11)));
+diff --git a/rootdir/init.rc b/rootdir/init.rc
+index cd71aa8aa..96117071e 100644
+--- a/rootdir/init.rc
++++ b/rootdir/init.rc
+@@ -330,6 +330,17 @@ on init
+     write /proc/sys/kernel/sched_wakeup_granularity_ns 2000000
+     write /proc/sys/kernel/sched_child_runs_first 0
+ 
++    write /proc/sys/kernel/dmesg_restrict 1
++    write /proc/sys/fs/protected_hardlinks 1
++    write /proc/sys/fs/protected_symlinks 1
++    write /proc/sys/fs/protected_fifos 1
++    write /proc/sys/fs/protected_regular 1
++    write /proc/sys/net/ipv6/conf/all/use_tempaddr 2
++    write /proc/sys/net/ipv6/conf/all/max_addresses 128
++    write /proc/sys/net/ipv6/conf/all/temp_prefered_lft 21600
++    write /proc/sys/net/ipv6/conf/default/use_tempaddr 2
++    write /proc/sys/net/ipv6/conf/default/max_addresses 128
++    write /proc/sys/net/ipv6/conf/default/temp_prefered_lft 21600
+     write /proc/sys/kernel/randomize_va_space 2
+     write /proc/sys/vm/mmap_min_addr 32768
+     write /proc/sys/net/ipv4/ping_group_range "0 2147483647"

Patches/LineageOS-20.0/android_system_core/0002-ptrace_scope.patch

@@ -0,0 +1,27 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: flawedworld <38294951+flawedworld@users.noreply.github.com>
+Date: Mon, 5 Apr 2021 03:02:51 +0100
+Subject: [PATCH] add a property for controlling ptrace_scope
+
+Signed-off-by: anupritaisno1 <www.anuprita804@gmail.com>
+---
+ rootdir/init.rc | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/rootdir/init.rc b/rootdir/init.rc
+index 96117071e..e33ba79a3 100644
+--- a/rootdir/init.rc
++++ b/rootdir/init.rc
+@@ -1213,6 +1213,12 @@ on property:perf.drop_caches=3
+ on property:net.tcp_def_init_rwnd=*
+     write /proc/sys/net/ipv4/tcp_default_init_rwnd ${net.tcp_def_init_rwnd}
+ 
++on property:persist.native_debug=true
++    write /proc/sys/kernel/yama/ptrace_scope 0
++
++on property:persist.native_debug=false
++    write /proc/sys/kernel/yama/ptrace_scope 2
++
+ # perf_event_open syscall security:
+ # Newer kernels have the ability to control the use of the syscall via SELinux
+ # hooks. init tests for this, and sets sys_init.perf_lsm_hooks to 1 if the

Patches/LineageOS-20.0/android_system_core/0003-HM-Increase_vm_mmc.patch

@@ -0,0 +1,23 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Thu, 13 Dec 2018 09:26:25 -0500
+Subject: [PATCH] increase max_map_count for hardened malloc
+
+Signed-off-by: anupritaisno1 <www.anuprita804@gmail.com>
+---
+ rootdir/init.rc | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/rootdir/init.rc b/rootdir/init.rc
+index e33ba79a3..06fde2a63 100644
+--- a/rootdir/init.rc
++++ b/rootdir/init.rc
+@@ -1098,6 +1098,8 @@ on boot
+     symlink /sys/class/block/${dev.mnt.dev.data} /dev/sys/block/by-name/userdata
+     symlink /sys/class/block/${dev.mnt.rootdisk.data} /dev/sys/block/by-name/rootdisk
+ 
++    write /proc/sys/vm/max_map_count 1048576
++
+     # F2FS tuning. Set cp_interval larger than dirty_expire_centisecs, 30 secs,
+     # to avoid power consumption when system becomes mostly idle. Be careful
+     # to make it too large, since it may bring userdata loss, if they