import UBI java-1.8.0-openjdk-1.8.0.412.b08-2.el8

.gitignore

@@ -1,2 +1,2 @@
-SOURCES/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u282-b08-4curve.tar.xz
+SOURCES/shenandoah8u412-b08.tar.xz
 SOURCES/tapsets-icedtea-3.15.0.tar.xz

.java-1.8.0-openjdk.metadata

@@ -1,2 +1,2 @@
-de58a4f646ca65cafbd2166d7d08eb330adaf4e6 SOURCES/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u282-b08-4curve.tar.xz
+9cb6b4c557e9a433fe4c16b3996f998335cec8a5 SOURCES/shenandoah8u412-b08.tar.xz
 7ae2cba67467825b2c2a5fec7aea041865023002 SOURCES/tapsets-icedtea-3.15.0.tar.xz

SOURCES/NEWS

@@ -1,863 +0,0 @@
-Key:
-
-JDK-X  - https://bugs.openjdk.java.net/browse/JDK-X
-CVE-XXXX-YYYY: https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY
-
-New in release OpenJDK 8u282 (2021-01-19):
-===========================================
-Live versions of these release notes can be found at:
-  * https://bitly.com/openjdk8u282
-  * https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u282.txt
-
-* Security fixes
-  - JDK-8247619: Improve Direct Buffering of Characters
-* Other changes
-  - JDK-6962725: Regtest javax/swing/JFileChooser/6738668/bug6738668.java fails under Linux
-  - JDK-8008657: JSpinner setComponentOrientation doesn't affect on text orientation
-  - JDK-8022535: [TEST BUG] javax/swing/text/html/parser/Test8017492.java fails
-  - JDK-8025936: Windows .pdb and .map files does not have proper dependencies setup
-  - JDK-8030350: Enable additional compiler warnings for GCC
-  - JDK-8031423: Test java/awt/dnd/DisposeFrameOnDragCrash/DisposeFrameOnDragTest.java fails by Timeout on Windows
-  - JDK-8036122: Fix warning 'format not a string literal'
-  - JDK-8039279: Move awt tests to openjdk repository
-  - JDK-8041592: [TEST_BUG] Move 42 AWT hw/lw mixing tests to jdk
-  - JDK-8043126: move awt automated functional tests from AWT_Events/Lw and AWT_Events/AWT to OpenJDK repository
-  - JDK-8043131: Move ShapedAndTranslucentWindows and GC functional AWT tests to regression tree
-  - JDK-8043899: compiler/5091921/Test7005594.java fails if specified -Xmx is less than 1600m
-  - JDK-8044157: [TEST_BUG] Improve recently submitted AWT_Mixing tests
-  - JDK-8044172: [TEST_BUG] Move regtests for 4523758 and AltPlusNumberKeyCombinationsTest to jdk
-  - JDK-8044429: move awt automated tests for AWT_Modality to OpenJDK repository
-  - JDK-8044765: Move functional tests AWT_SystemTray/Automated to openjdk repository
-  - JDK-8046221: [TEST_BUG] Cleanup datatransfer tests
-  - JDK-8047180: Move functional tests AWT_Headless/Automated to OpenJDK repository
-  - JDK-8047367: move awt automated tests from AWT_Modality to OpenJDK repository - part 2
-  - JDK-8048246: Move AWT_DnD/Clipboard/Automated functional tests to OpenJDK
-  - JDK-8049617: move awt automated tests from AWT_Modality to OpenJDK repository - part 3
-  - JDK-8049694: Migrate functional AWT_DesktopProperties/Automated tests to OpenJDK
-  - JDK-8050885: move awt automated tests from AWT_Modality to OpenJDK repository - part 4
-  - JDK-8051440: move tests about maximizing undecorated to OpenJDK
-  - JDK-8051853: new URI("x/").resolve("..").getSchemeSpecificPart() returns null!
-  - JDK-8052012: move awt automated tests from AWT_Modality to OpenJDK repository - part 5
-  - JDK-8052408: Move AWT_BAT functional tests to OpenJDK (3 of 3)
-  - JDK-8053657: [TEST_BUG] move some 5 tests related to undecorated Frame/JFrame to JDK
-  - JDK-8054143: move awt automated tests from AWT_Modality to OpenJDK repository - part 6
-  - JDK-8054358: move awt automated tests from AWT_Modality to OpenJDK repository - part 7
-  - JDK-8054359: move awt automated tests from AWT_Modality to OpenJDK repository - part 8
-  - JDK-8055360: Move the rest part of AWT ShapedAndTranslucent tests to OpenJDK
-  - JDK-8055664: move 14 tests about setLocationRelativeTo to jdk
-  - JDK-8055836: move awt tests from AWT_Modality to OpenJDK repository - part 9
-  - JDK-8057694: move awt tests from AWT_Modality to OpenJDK repository - part 10
-  - JDK-8058805: [TEST_BUG]Test java/awt/TrayIcon/SecurityCheck/NoPermissionTest/NoPermissionTest.java fails
-  - JDK-8062808: Turn on the -Wreturn-type warning
-  - JDK-8063102: Change open awt regression tests to avoid sun.awt.SunToolkit.realSync, part 1
-  - JDK-8063104: Change open awt regression tests to avoid sun.awt.SunToolkit.realSync, part 2
-  - JDK-8063106: Change open swing regression tests to avoid sun.awt.SunToolkit.realSync, part 1
-  - JDK-8063107: Change open swing regression tests to avoid sun.awt.SunToolkit.realSync, part 2
-  - JDK-8064573: [TEST_BUG] javax/swing/text/AbstractDocument/6968363/Test6968363.java is asocial pressing VK_LEFT and not releasing
-  - JDK-8064575: [TEST_BUG] javax/swing/JEditorPane/6917744/bug6917744.java 100 times press keys and never releases
-  - JDK-8064809: [TEST_BUG] javax/swing/JComboBox/4199622/bug4199622.java contains a lot of keyPress and not a single keyRelease
-  - JDK-8067441: Some tests fails with error: cannot find symbol getSystemMnemonicKeyCodes()
-  - JDK-8068228: Test closed/java/awt/Mouse/MaximizedFrameTest/MaximizedFrameTest fails with GTKLookAndFeel
-  - JDK-8068275: Some tests failed after JDK-8063104
-  - JDK-8069211: (zipfs) ZipFileSystem creates corrupted zip if entry output stream gets closed more than once
-  - JDK-8074807: Fix some tests unnecessary using internal API
-  - JDK-8076315: move 4 manual functional swing tests to regression suite
-  - JDK-8130772: Util.hitMnemonics does not work: getSystemMnemonicKeyCodes() returns ALT_MASK rather than VK_ALT
-  - JDK-8132664: closed/javax/swing/DataTransfer/DefaultNoDrop/DefaultNoDrop.java locks on Windows
-  - JDK-8134632: Mark javax/sound/midi/Devices/InitializationHang.java as headful
-  - JDK-8148854: Class names "SomeClass" and "LSomeClass;" treated by JVM as an equivalent
-  - JDK-8148916: Mark bug6400879.java as intermittently failing
-  - JDK-8148983: Fix extra comma in changes for JDK-8148916
-  - JDK-8152545: Use preprocessor instead of compiling a program to generate native nio constants
-  - JDK-8156803: Turn StressLCM/StressGCM flags to diagnostic
-  - JDK-8160438: javax/swing/plaf/nimbus/8057791/bug8057791.java fails
-  - JDK-8160761: [TESTBUG] Several compiler tests fail with product bits
-  - JDK-8163161: [PIT][TEST_BUG] increase timeout in javax/swing/plaf/nimbus/8057791/bug8057791.java
-  - JDK-8165808: Add release barriers when allocating objects with concurrent collection
-  - JDK-8166015: [PIT][TEST_BUG] stray character in java/awt/Focus/ModalDialogActivationTest/ModalDialogActivationTest.java
-  - JDK-8166583: Add oopDesc::klass_or_null_acquire()
-  - JDK-8166663: Simplify oops_on_card_seq_iterate_careful
-  - JDK-8166862: CMS needs klass_or_null_acquire
-  - JDK-8168292: [TESTBUG] [macosx] Test java/awt/TrayIcon/DragEventSource/DragEventSource.java fails on OS X
-  - JDK-8168682: jdk/test/java/lang/ClassLoader/forNameLeak/ClassForNameLeak.java fails with -Xcomp
-  - JDK-8179083: Uninitialized notifier in Java Monitor Wait tracing event
-  - JDK-8185003: JMX: Add a version of ThreadMXBean.dumpAllThreads with a maxDepth argument
-  - JDK-8197981: Missing return statement in __sync_val_compare_and_swap_8
-  - JDK-8202076: test/jdk/java/io/File/WinSpecialFiles.java on windows with VS2017
-  - JDK-8205507: jdk/javax/xml/crypto/dsig/GenerationTests.java timed out
-  - JDK-8207766: [testbug] Adapt tests for Aix.
-  - JDK-8212070: Introduce diagnostic flag to abort VM on failed JIT compilation
-  - JDK-8213448: [TESTBUG] enhance jfr/jvm/TestDumpOnCrash
-  - JDK-8215727: Restore JFR thread sampler loop to old / previous behavior
-  - JDK-8217362: Emergency dump does not work when disk=false is set
-  - JDK-8217766: Container Support doesn't work for some Join Controllers combinations
-  - JDK-8219013: Update Apache Santuario (XML Signature) to version 2.1.3
-  - JDK-8219562: Line of code in osContainer_linux.cpp L102 appears unreachable
-  - JDK-8220579: [Containers] SubSystem.java out of sync with osContainer_linux.cpp
-  - JDK-8220657: JFR.dump does not work when filename is set
-  - JDK-8221340: [TESTBUG] TestCgroupMetrics.java fails after fix for JDK-8219562
-  - JDK-8221342: [TESTBUG] Generate Dockerfile for docker testing
-  - JDK-8221710: [TESTBUG] more configurable parameters for docker testing
-  - JDK-8223108: Test java/awt/EventQueue/NonComponentSourcePost.java is unstable
-  - JDK-8224502: [TESTBUG] JDK docker test TestSystemMetrics.java fails with access issues and OOM
-  - JDK-8225072: Add LuxTrust certificate that is expiring in March 2021 to list of allowed but expired certs
-  - JDK-8227006: [linux] Runtime.availableProcessors execution time increased by factor of 100
-  - JDK-8229868: Update Apache Santuario TPRM version
-  - JDK-8231209: [REDO] ThreadMXBean::getThreadAllocatedBytes() can be quicker for self thread
-  - JDK-8231968: getCurrentThreadAllocatedBytes default implementation s/b getThreadAllocatedBytes
-  - JDK-8232114: JVM crashed at imjpapi.dll in native code
-  - JDK-8233548: Update CUP to v0.11b
-  - JDK-8234270: [REDO] JDK-8204128 NMT might report incorrect numbers for Compiler area
-  - JDK-8234339: replace JLI_StrTok in java_md_solinux.c
-  - JDK-8238448: RSASSA-PSS signature verification fail when using certain odd key sizes
-  - JDK-8239105: Add exception for expiring Digicert root certificates to VerifyCACerts test
-  - JDK-8242335: Additional Tests for RSASSA-PSS
-  - JDK-8242480: Negative value may be returned by getFreeSwapSpaceSize() in the docker
-  - JDK-8244225: stringop-overflow warning on strncpy call from compile_the_world_in
-  - JDK-8245400: Upgrade to LittleCMS 2.11
-  - JDK-8246648: issue with OperatingSystemImpl getFreeSwapSpaceSize in docker after 8242480
-  - JDK-8248214: Add paddings for TaskQueueSuper to reduce false-sharing cache contention
-  - JDK-8249176: Update GlobalSignR6CA test certificates
-  - JDK-8249846: Change of behavior after JDK-8237117: Better ForkJoinPool behavior
-  - JDK-8250636: iso8601_time returns incorrect offset part on MacOS
-  - JDK-8250665: Wrong translation for the month name of May in ar_JO,LB,SY
-  - JDK-8250928: JFR: Improve hash algorithm for stack traces
-  - JDK-8251365: Build failure on AIX after 8250636
-  - JDK-8251469: Better cleanup for test/jdk/javax/imageio/SetOutput.java
-  - JDK-8251840: Java_sun_awt_X11_XToolkit_getDefaultScreenData should not be in make/mapfiles/libawt_xawt/mapfile-vers
-  - JDK-8252384: [TESTBUG] Some tests refer to COMPAT provider rather than JRE
-  - JDK-8252395: [8u] --with-native-debug-symbols=external doesn't include debuginfo files for binaries
-  - JDK-8252497: Incorrect numeric currency code for ROL
-  - JDK-8252754: Hash code calculation of JfrStackTrace is inconsistent
-  - JDK-8252904: VM crashes when JFR is used and JFR event class is transformed
-  - JDK-8252975: [8u] JDK-8252395 breaks the build for --with-native-debug-symbols=internal
-  - JDK-8253036: Support building the Zero assembler port on AArch64
-  - JDK-8253284: Zero OrderAccess barrier mappings are incorrect
-  - JDK-8253550: [8u] JDK-8252395 breaks the build for make STRIP_POLICY=no_strip
-  - JDK-8253752: test/sun/management/jmxremote/bootstrap/RmiBootstrapTest.java fails randomly
-  - JDK-8253837: JFR 8u fix symbol and cstring hashtable equals implementaion
-  - JDK-8254081: java/security/cert/PolicyNode/GetPolicyQualifiers.java fails due to an expired certificate
-  - JDK-8254144: Non-x86 Zero builds fail with return-type warning in os_linux_zero.cpp
-  - JDK-8254166: Zero: return-type warning in zeroInterpreter_zero.cpp
-  - JDK-8254683: [TEST_BUG] jdk/test/sun/tools/jconsole/WorkerDeadlockTest.java fails
-  - JDK-8254982: (tz) Upgrade time-zone data to tzdata2020c
-  - JDK-8255003: Build failures on Solaris
-  - JDK-8255226: (tz) Upgrade time-zone data to tzdata2020d
-  - JDK-8255269: Unsigned overflow in g1Policy.cpp
-  - JDK-8255603: Memory/Performance regression after JDK-8210985
-  - JDK-8255717: Fix JFR crash in WriteObjectSampleStacktrace due to object not initialized
-  - JDK-8256618: Zero: Linux x86_32 build still fails
-  - JDK-8256671: Incorrect assignment operator used in guarantee() in genCollectedHeap
-  - JDK-8256752: 8252395 incorrect copy rule for macos .dSYM folder
-  - JDK-8257397: [TESTBUG] test/lib/containers/docker/Common.java refers to -Xlog:os+container=trace
-  - JDK-8258630: Add expiry exception for QuoVadis root certificate
-* AArch64 port
-  - Fix AArch64 build failure after JDK-8062808 backport
-* Shenandoah
-  - Fix racy update of code roots
-
-Notes on individual issues:
-===========================
-
-security-libs/javax.xml.crypto:
-
-JDK-8230839: Updated XML Signature Implementation to Apache Santuario 2.1.3
-===========================================================================
-The XML Signature implementation in the `java.xml.crypto` module has
-been updated to version 2.1.3 of Apache Santuario. New features
-include:
-
-* Added support for embedding elliptic curve public keys in the
-  KeyValue element
-
-New in release OpenJDK 8u275 (2020-11-05):
-===========================================
-Live versions of these release notes can be found at:
-  * https://bitly.com/openjdk8u275
-  * https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u275.txt
-
-* Regression fixes
-  - JDK-8214440: ldap over a TLS connection negotiate failed with "javax.net.ssl.SSLPeerUnverifiedException: hostname of the server '' does not match the hostname in the server's certificate"
-  - JDK-8223940: Private key not supported by chosen signature algorithm
-  - JDK-8236512: PKCS11 Connection closed after Cipher.doFinal and NoPadding
-  - JDK-8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)
-
-New in release OpenJDK 8u272 (2020-10-20):
-===========================================
-Live versions of these release notes can be found at:
-  * https://bitly.com/openjdk8u272
-  * https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u272.txt
-
-* New features
-  - JDK-8245468: Add TLSv1.3 implementation classes from 11.0.7
-* Security fixes
-  - JDK-8233624: Enhance JNI linkage
-  - JDK-8236196: Improve string pooling
-  - JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
-  - JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
-  - JDK-8237995, CVE-2020-14782: Enhance certificate processing
-  - JDK-8240124: Better VM Interning
-  - JDK-8241114, CVE-2020-14792: Better range handling
-  - JDK-8242680, CVE-2020-14796: Improved URI Support
-  - JDK-8242685, CVE-2020-14797: Better Path Validation
-  - JDK-8242695, CVE-2020-14798: Enhanced buffer support
-  - JDK-8243302: Advanced class supports
-  - JDK-8244136, CVE-2020-14803: Improved Buffer supports
-  - JDK-8244479: Further constrain certificates
-  - JDK-8244955: Additional Fix for JDK-8240124
-  - JDK-8245407: Enhance zoning of times
-  - JDK-8245412: Better class definitions
-  - JDK-8245417: Improve certificate chain handling
-  - JDK-8248574: Improve jpeg processing
-  - JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
-  - JDK-8253019: Enhanced JPEG decoding
-* Other changes
-  - JDK-6574989: TEST_BUG: javax/sound/sampled/Clip/bug5070081.java fails sometimes
-  - JDK-8006205: [TESTBUG] NEED_TEST: please JTREGIFY test/compiler/7177917/Test7177917.java
-  - JDK-8023697: failed class resolution reports different class name in detail message for the first and subsequent times
-  - JDK-8025886: replace [[ and == bash extensions in regtest
-  - JDK-8026236: Add PrimeTest for BigInteger
-  - JDK-8031625: javadoc problems referencing inner class constructors
-  - JDK-8035493: JVMTI PopFrame capability must instruct compilers not to prune locals
-  - JDK-8036088: Replace strtok() with its safe equivalent strtok_s() in DefaultProxySelector.c
-  - JDK-8039082: [TEST_BUG] Test java/awt/dnd/BadSerializationTest/BadSerializationTest.java fails
-  - JDK-8046274: Removing dependency on jakarta-regexp
-  - JDK-8048933: -XX:+TraceExceptions output should include the message
-  - JDK-8057003: Large reference arrays cause extremely long synchronization times
-  - JDK-8060721: Test runtime/SharedArchiveFile/LimitSharedSizes.java fails in jdk 9 fcs new platforms/compiler
-  - JDK-8061616: HotspotDiagnosticMXBean.getVMOption() throws IllegalArgumentException for flags of type double
-  - JDK-8062947: Fix exception message to correctly represent LDAP connection failure
-  - JDK-8064319: Need to enable -XX:+TraceExceptions in release builds
-  - JDK-8075774: Small readability and performance improvements for zipfs
-  - JDK-8076151: [TESTBUG] Test java/awt/FontClass/CreateFont/fileaccess/FontFile.java fails
-  - JDK-8078334: Mark regression tests using randomness
-  - JDK-8078880: Mark a few more intermittently failuring security-libs
-  - JDK-8080462: Update SunPKCS11 provider with PKCS11 v2.40 support
-  - JDK-8132206: move ScanTest.java into OpenJDK
-  - JDK-8132376: Add @requires os.family to the client tests with access to internal OS-specific API
-  - JDK-8132745: minor cleanup of java/util/Scanner/ScanTest.java
-  - JDK-8137087: [TEST_BUG] Cygwin failure of java/awt/appletviewer/IOExceptionIfEncodedURLTest/IOExceptionIfEncodedURLTest.sh
-  - JDK-8144539: Update PKCS11 tests to run with security manager
-  - JDK-8145808: java/awt/Graphics2D/MTGraphicsAccessTest/MTGraphicsAccessTest.java hangs on Win. 8
-  - JDK-8148754: C2 loop unrolling fails due to unexpected graph shape
-  - JDK-8148854: Class names "SomeClass" and "LSomeClass;" treated by JVM as an equivalent
-  - JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed due to timeout on DeadServerNoTimeoutTest is incorrect
-  - JDK-8151788: NullPointerException from ntlm.Client.type3
-  - JDK-8151834: Test SmallPrimeExponentP.java times out intermittently
-  - JDK-8152077: (cal) Calendar.roll does not always roll the hours during daylight savings
-  - JDK-8153430: jdk regression test MletParserLocaleTest, ParserInfiniteLoopTest reduce default timeout
-  - JDK-8153583: Make OutputAnalyzer.reportDiagnosticSummary public
-  - JDK-8154313: Generated javadoc scattered all over the place
-  - JDK-8156169: Some sound tests rarely hangs because of incorrect synchronization
-  - JDK-8160768: Add capability to custom resolve host/domain names within the default JNDI LDAP provider
-  - JDK-8161973: PKIXRevocationChecker.getSoftFailExceptions() not working
-  - JDK-8163251: Hard coded loop limit prevents reading of smart card data greater than 8k
-  - JDK-8165936: Potential Heap buffer overflow when seaching timezone info files
-  - JDK-8165996: PKCS11 using NSS throws an error regarding secmod.db when NSS uses sqlite
-  - JDK-8166148: Fix for JDK-8165936 broke solaris builds
-  - JDK-8167300: Scheduling failures during gcm should be fatal
-  - JDK-8167615: Opensource unit/regression tests for JavaSound
-  - JDK-8168517: java/lang/ProcessBuilder/Basic.java failed
-  - JDK-8169925: PKCS #11 Cryptographic Token Interface license
-  - JDK-8172012: [TEST_BUG] delays needed in javax/swing/JTree/4633594/bug4633594.java
-  - JDK-8173300: [TESTBUG]compiler/tiered/NonTieredLevelsTest.java fails with compiler.whitebox.SimpleTestCaseHelper(int) must be compiled
-  - JDK-8177334: Update xmldsig implementation to Apache Santuario 2.1.1
-  - JDK-8177628: Opensource unit/regression tests for ImageIO
-  - JDK-8183341: Better cleanup for javax/imageio/AllowSearch.java
-  - JDK-8183349: Better cleanup for jdk/test/javax/imageio/plugins/shared/CanWriteSequence.java and WriteAfterAbort.java
-  - JDK-8183351: Better cleanup for jdk/test/javax/imageio/spi/AppletContextTest/BadPluginConfigurationTest.sh
-  - JDK-8184762: ZapStackSegments should use optimized memset
-  - JDK-8191678: [TESTBUG] Add keyword headful in java/awt FocusTransitionTest test.
-  - JDK-8192953: sun/management/jmxremote/bootstrap/*.sh tests fail with error : revokeall.exe: Permission denied
-  - JDK-8193137: Nashorn crashes when given an empty script file
-  - JDK-8193234: When using -Xcheck:jni an internally allocated buffer can leak
-  - JDK-8194298: Add support for per Socket configuration of TCP keepalive
-  - JDK-8198004: javax/swing/JFileChooser/6868611/bug6868611.java throws error
-  - JDK-8200313: java/awt/Gtk/GtkVersionTest/GtkVersionTest.java fails
-  - JDK-8201633: Problems with AES-GCM native acceleration
-  - JDK-8203357: Container Metrics
-  - JDK-8209113: Use WeakReference for lastFontStrike for created Fonts
-  - JDK-8210147: adjust some WSAGetLastError usages in windows network coding
-  - JDK-8211049: Second parameter of "initialize" method is not used
-  - JDK-8211163: UNIX version of Java_java_io_Console_echo does not return a clean boolean
-  - JDK-8211714: Need to update vm_version.cpp to recognise VS2017 minor versions
-  - JDK-8214862: assert(proj != __null) at compile.cpp:3251
-  - JDK-8216283: Allow shorter method sampling interval than 10 ms
-  - JDK-8217606: LdapContext#reconnect always opens a new connection
-  - JDK-8217647: JFR: recordings on 32-bit systems unreadable
-  - JDK-8217878: ENVELOPING XML signature no longer works in JDK 11
-  - JDK-8218629: XML Digital Signature throws NAMESPACE_ERR exception on OpenJDK 11, works 8/9/10
-  - JDK-8219566: JFR did not collect call stacks when MaxJavaStackTraceDepth is set to zero
-  - JDK-8219919: RuntimeStub name lost with PrintFrameConverterAssembly
-  - JDK-8220165: Encryption using GCM results in RuntimeException- input length out of bound
-  - JDK-8220313: [TESTBUG] Update base image for Docker testing to OL 7.6
-  - JDK-8220555: JFR tool shows potentially misleading message when it cannot access a file
-  - JDK-8220674: [TESTBUG] MetricsMemoryTester failcount test in docker container only works with debug JVMs
-  - JDK-8221569: JFR tool produces incorrect output when both --categories and --events are specified
-  - JDK-8222079: Don't use memset to initialize fields decode_env constructor in disassembler.cpp
-  - JDK-8224217: RecordingInfo should use textual representation of path
-  - JDK-8225695: 32-bit build failures after JDK-8080462 (Update SunPKCS11 provider with PKCS11 v2.40 support)
-  - JDK-8226575: OperatingSystemMXBean should be made container aware
-  - JDK-8226697: Several tests which need the @key headful keyword are missing it.
-  - JDK-8226809: Circular reference in printed stack trace is not correctly indented & ambiguous
-  - JDK-8228835: Memory leak in PKCS11 provider when using AES GCM
-  - JDK-8229378: jdwp library loader in linker_md.c quietly truncates on buffer overflow
-  - JDK-8230303: JDB hangs when running monitor command
-  - JDK-8230711: ConnectionGraph::unique_java_object(Node* N) return NULL if n is not in the CG
-  - JDK-8231213: Migrate SimpleDateFormatConstTest to JDK Repo
-  - JDK-8231779: crash HeapWord*ParallelScavengeHeap::failed_mem_allocate
-  - JDK-8233097: Fontmetrics for large Fonts has zero width
-  - JDK-8233621: Mismatch in jsse.enableMFLNExtension property name
-  - JDK-8234617: C1: Incorrect result of field load due to missing narrowing conversion
-  - JDK-8235243: handle VS2017 15.9 and VS2019 in abstract_vm_version
-  - JDK-8235325: build failure on Linux after 8235243
-  - JDK-8235687: Contents/MacOS/libjli.dylib cannot be a symlink
-  - JDK-8236645: JDK 8u231 introduces a regression with incompatible handling of XML messages
-  - JDK-8237951: CTW: C2 compilation fails with "malformed control flow"
-  - JDK-8238225: Issues reported after replacing symlink at Contents/MacOS/libjli.dylib with binary
-  - JDK-8238380: java.base/unix/native/libjava/childproc.c "multiple definition" link errors with GCC10
-  - JDK-8238386: (sctp) jdk.sctp/unix/native/libsctp/SctpNet.c "multiple definition" link errors with GCC10
-  - JDK-8238388: libj2gss/NativeFunc.o "multiple definition" link errors with GCC10
-  - JDK-8238898: Missing hash characters for header on license file
-  - JDK-8239385: KerberosTicket client name refers wrongly to sAMAccountName in AD
-  - JDK-8239819: XToolkit: Misread of screen information memory
-  - JDK-8240295: hs_err elapsed time in seconds is not accurate enough
-  - JDK-8240676: Meet not symmetric failure when running lucene on jdk8
-  - JDK-8241888: Mirror jdk.security.allowNonCaAnchor system property with a security one
-  - JDK-8242498: Invalid "sun.awt.TimedWindowEvent" object leads to JVM crash
-  - JDK-8242556: Cannot load RSASSA-PSS public key with non-null params from byte array
-  - JDK-8243138: Enhance BaseLdapServer to support starttls extended request
-  - JDK-8243320: Add SSL root certificates to Oracle Root CA program
-  - JDK-8243321: Add Entrust root CA - G4 to Oracle Root CA program
-  - JDK-8243489: Thread CPU Load event may contain wrong data for CPU time under certain conditions
-  - JDK-8244151: Update MUSCLE PC/SC-Lite headers to the latest release 1.8.26
-  - JDK-8244818: Java2D Queue Flusher crash while moving application window to external monitor
-  - JDK-8245467: Remove 8u TLSv1.2 implementation files
-  - JDK-8245469: Remove DTLS protocol implementation
-  - JDK-8245470: Fix JDK8 compatibility issues
-  - JDK-8245471: Revert JDK-8148188
-  - JDK-8245472: Backport JDK-8038893 to JDK8
-  - JDK-8245473: OCSP stapling support
-  - JDK-8245474: Add TLS_KRB5 cipher suites support according to RFC-2712
-  - JDK-8245476: Disable TLSv1.3 protocol in the ClientHello message by default
-  - JDK-8245477: Adjust TLS tests location
-  - JDK-8245653: Remove 8u TLS tests
-  - JDK-8245681: Add TLSv1.3 regression test from 11.0.7
-  - JDK-8246193: Possible NPE in ENC-PA-REP search in AS-REQ
-  - JDK-8246310: Clean commented-out code about ModuleEntry andPackageEntry in JFR
-  - JDK-8246384: Enable JFR by default on supported architectures for October 2020 release
-  - JDK-8248643: Remove extra leading space in JDK-8240295 8u backport
-  - JDK-8248851: CMS: Missing memory fences between free chunk check and klass read
-  - JDK-8249158: THREAD_START and THREAD_END event posted in primordial phase
-  - JDK-8249610: Make sun.security.krb5.Config.getBooleanObject(String... keys) method public
-  - JDK-8249677: Regression in 8u after JDK-8237117: Better ForkJoinPool behavior
-  - JDK-8250546: Expect changed behaviour reported in JDK-8249846
-  - JDK-8250627: Use -XX:+/-UseContainerSupport for enabling/disabling Java container metrics
-  - JDK-8250755: Better cleanup for jdk/test/javax/imageio/plugins/shared/CanWriteSequence.java
-  - JDK-8250875: Incorrect parameter type for update_number in JDK_Version::jdk_update
-  - JDK-8251117: Cannot check P11Key size in P11Cipher and P11AEADCipher
-  - JDK-8251120: [8u] HotSpot build assumes ENABLE_JFR is set to either true or false
-  - JDK-8251341: Minimal Java specification change
-  - JDK-8251478: Backport TLSv1.3 regression tests to JDK8u
-  - JDK-8251546: 8u backport of JDK-8194298 breaks AIX and Solaris builds
-  - JDK-8252084: Minimal VM fails to bootcycle: undefined symbol: AgeTableTracer::is_tenuring_distribution_event_enabled
-  - JDK-8252573: 8u: Windows build failed after 8222079 backport
-  - JDK-8252886: [TESTBUG] sun/security/ec/TestEC.java : Compilation failed
-  - JDK-8254673: Call to JvmtiExport::post_vm_start() was removed by the fix for JDK-8249158
-  - JDK-8254937: Revert JDK-8148854 for 8u272
-
-Notes on individual issues:
-===========================
-
-core-svc/java.lang.management:
-
-JDK-8236876: OperatingSystemMXBean Methods Inside a Container Return Container Specific Data
-============================================================================================
-When executing in a container, or other virtualized operating
-environment, the following `OperatingSystemMXBean` methods in this
-release return container specific information, if
-available. Otherwise, they return host specific data:
-
-* getFreePhysicalMemorySize()
-* getTotalPhysicalMemorySize()
-* getFreeSwapSpaceSize()
-* getTotalSwapSpaceSize()
-* getSystemCpuLoad()
-
-security-libs/java.security:
-
-JDK-8250756: Added Entrust Root Certification Authority - G4 certificate
-========================================================================
-The Entrust root certificate has been added to the cacerts truststore:
-
-Alias Name: entrustrootcag4
-Distinguished Name: CN=Entrust Root Certification Authority - G4, OU="(c) 2015 Entrust,  Inc. - for authorized use only", OU=See www.entrust.net/legal-terms, O="Entrust, Inc.", C=US
-
-JDK-8250860: Added 3 SSL Corporation Root CA Certificates
-=========================================================
-The following root certificates have been added to the cacerts truststore for the SSL Corporation:
-
-Alias Name: sslrootrsaca
-Distinguished Name: CN=SSL.com Root Certification Authority RSA, O=SSL Corporation, L=Houston, ST=Texas, C=US
-
-Alias Name: sslrootevrsaca
-Distinguished Name: CN=SSL.com EV Root Certification Authority RSA R2, O=SSL Corporation, L=Houston, ST=Texas, C=US
-
-Alias Name: sslrooteccca
-Distinguished Name: CN=SSL.com Root Certification Authority ECC, O=SSL Corporation, L=Houston, ST=Texas, C=US
-
-security-libs/javax.crypto:pkcs11:
-
-JDK-8221441: SunPKCS11 Provider Upgraded with Support for PKCS#11 v2.40
-=======================================================================
-The SunPKCS11 provider has been updated with support for PKCS#11
-v2.40. This version adds support for more algorithms such as the
-AES/GCM/NoPadding cipher, DSA signatures using SHA-2 family of message
-digests, and RSASSA-PSS signatures when the corresponding PKCS11
-mechanisms are supported by the underlying PKCS11 library.
-
-security-libs/javax.security:
-
-JDK-8242059: Support for canonicalize in krb5.conf
-==================================================
-The 'canonicalize' flag in the [krb5.conf file][0] is now supported by
-the JDK Kerberos implementation. When set to *true*, RFC 6806 [1] name
-canonicalization is requested by clients in TGT requests to KDC
-services (AS protocol). Otherwise, and by default, it is not
-requested.
-
-The new default behavior is different from previous releases where
-name canonicalization was always requested by clients in TGT requests
-to KDC services (provided that support for RFC 6806[1] was not
-explicitly disabled with the *sun.security.krb5.disableReferrals*
-system or security properties).
-
-[0]: https://web.mit.edu/kerberos/krb5-devel/doc/admin/conf_files/krb5_conf.html
-[1]: https://tools.ietf.org/html/rfc6806
-
-security-libs/javax.xml.crypto:
-
-JDK-8202891: Updated xmldsig Implementation to Apache Santuario 2.1.1
-=====================================================================
-The XMLDSig provider implementation in the `java.xml.crypto` module has been updated to version 2.1.1 of Apache Santuario.
-
-New features include:
-
-1. Support for the SHA-224 and SHA-3 DigestMethod algorithms specified
-in RFC 6931.
-2. Support for the HMAC-SHA224, RSA-SHA224, ECDSA-SHA224, and
-RSASSA-PSS family of SignatureMethod algorithms specified in RFC 6931.
-
-JDK-8238185: New OpenJDK-specific JDK 8 Updates System Property to fallback to legacy Base64 Encoding format
-============================================================================================================
-The upgrade to the Apache Santuario libraries (see above) introduced
-an issue where XML signature using Base64 encoding resulted in
-appending `&#xd` or `&#13` to the encoded output. This behavioural
-change was made in the Apache Santuario codebase to comply with RFC
-2045. The Santuario team has adopted a position of keeping their
-libraries compliant with RFC 2045.
-
-Earlier versions of OpenJDK 8 using the legacy encoder returns encoded
-data in a format without `&#xd` or `&#13`.
-
-Therefore a new system property, specific to the 8 update stream,
-`com.sun.org.apache.xml.internal.security.lineFeedOnly` is made
-available to fall back to the legacy Base64 encoded format.
-
-Users can set this flag in one of two ways:
-
-1. -Dcom.sun.org.apache.xml.internal.security.lineFeedOnly=true
-
-2. System.setProperty("com.sun.org.apache.xml.internal.security.lineFeedOnly", "true")
-
-This new system property is disabled by default. It has no effect on
-default behaviour nor when
-`com.sun.org.apache.xml.internal.security.ignoreLineBreaks` property
-is set.
-
-Later JDK family versions will only support the recommended property:
-
-`com.sun.org.apache.xml.internal.security.ignoreLineBreaks`
-
-JDK-8254177: US/Pacific-New Zone name removed as part of tzdata2020b
-====================================================================
-Following JDK's update to tzdata2020b, the long-obsolete files
-pacificnew and systemv have been removed. As a result, the
-"US/Pacific-New" zone name declared in the pacificnew data file is no
-longer available for use.
-
-Information regarding the update can be viewed at
-https://mm.icann.org/pipermail/tz-announce/2020-October/000059.html
-
-New in release OpenJDK 8u265 (2020-07-27):
-===========================================
-Live versions of these release notes can be found at:
-  * https://bitly.com/openjdk8u265
-  * https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u265.txt
-
-* Bug fixes
-  - JDK-8249677: Regression in 8u after JDK-8237117: Better ForkJoinPool behavior
-  - JDK-8250546: Expect changed behaviour reported in JDK-8249846
-
-New in release OpenJDK 8u262 (2020-07-14):
-===========================================
-Live versions of these release notes can be found at:
-  * https://bitly.com/oj8u262
-  * https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u262.txt
-
-* New features
-  - JDK-8223147: JFR Backport
-* Security fixes
-  - JDK-8028431, CVE-2020-14579: NullPointerException in DerValue.equals(DerValue)
-  - JDK-8028591, CVE-2020-14578: NegativeArraySizeException in sun.security.util.DerInputStream.getUnalignedBitString()
-  - JDK-8230613: Better ASCII conversions
-  - JDK-8231800: Better listing of arrays
-  - JDK-8232014: Expand DTD support
-  - JDK-8233255: Better Swing Buttons
-  - JDK-8234032: Improve basic calendar services
-  - JDK-8234042: Better factory production of certificates
-  - JDK-8234418: Better parsing with CertificateFactory
-  - JDK-8234836: Improve serialization handling
-  - JDK-8236191: Enhance OID processing
-  - JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
-  - JDK-8237592, CVE-2020-14577: Enhance certificate verification
-  - JDK-8238002, CVE-2020-14581: Better matrix operations
-  - JDK-8238804: Enhance key handling process
-  - JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
-  - JDK-8238843: Enhanced font handing
-  - JDK-8238920, CVE-2020-14583: Better Buffer support
-  - JDK-8238925: Enhance WAV file playback
-  - JDK-8240119, CVE-2020-14593: Less Affine Transformations
-  - JDK-8240482: Improved WAV file playback
-  - JDK-8241379: Update JCEKS support
-  - JDK-8241522: Manifest improved jar headers redux
-  - JDK-8242136, CVE-2020-14621: Better XML namespace handling
-* Other changes
-  - JDK-4949105: Access Bridge lacks html tags parsing
-  - JDK-7147060: com/sun/org/apache/xml/internal/security/transforms/ClassLoaderTest.java doesn't run in agentvm mode
-  - JDK-8003209: JFR events for network utilization
-  - JDK-8030680: 292 cleanup from default method code assessment
-  - JDK-8035633: TEST_BUG: java/net/NetworkInterface/Equals.java and some tests failed on windows intermittently
-  - JDK-8037866: Replace the Fun class in tests with lambdas
-  - JDK-8041626: Shutdown tracing event
-  - JDK-8041915: Move 8 awt tests to OpenJDK regression tests tree
-  - JDK-8067796: (process) Process.waitFor(timeout, unit) doesn't throw NPE if timeout is less than, or equal to zero when unit == null
-  - JDK-8076475: Misuses of strncpy/strncat
-  - JDK-8130737: AffineTransformOp can't handle child raster with non-zero x-offset
-  - JDK-8141056: Erroneous assignment in HeapRegionSet.cpp
-  - JDK-8146612: C2: Precedence edges specification violated
-  - JDK-8148886: SEGV in sun.java2d.marlin.Renderer._endRendering
-  - JDK-8149338: JVM Crash caused by Marlin renderer not handling NaN coordinates
-  - JDK-8150986: serviceability/sa/jmap-hprof/JMapHProfLargeHeapTest.java failing because expects HPROF JAVA PROFILE 1.0.1 file format
-  - JDK-8151582: (ch) test java/nio/channels/AsyncCloseAndInterrupt.java failing due to "Connection succeeded"
-  - JDK-8165675: Trace event for thread park has incorrect unit for timeout
-  - JDK-8171934: ObjectSizeCalculator.getEffectiveMemoryLayoutSpecification() does not recognize OpenJDK's HotSpot VM
-  - JDK-8172559: [PIT][TEST_BUG] Move @test to be 1st annotation in java/awt/image/Raster/TestChildRasterOp.java
-  - JDK-8176182: 4 security tests are not run
-  - JDK-8178374: Problematic ByteBuffer handling in CipherSpi.bufferCrypt method
-  - JDK-8178910: Problemlist sample tests
-  - JDK-8181841: A TSA server returns timestamp with precision higher than milliseconds
-  - JDK-8183925: Decouple crash protection from watcher thread
-  - JDK-8191393: Random crashes during cfree+0x1c
-  - JDK-8195817: JFR.stop should require name of recording
-  - JDK-8195818: JFR.start should increase autogenerated name by one
-  - JDK-8195819: Remove recording=x from jcmd JFR.check output
-  - JDK-8196969: JTreg Failure: serviceability/sa/ClhsdbJstack.java causes NPE
-  - JDK-8199712: Flight Recorder
-  - JDK-8202578: Revisit location for class unload events
-  - JDK-8202835: jfr/event/os/TestSystemProcess.java fails on missing events
-  - JDK-8203287: Zero fails to build after JDK-8199712 (Flight Recorder)
-  - JDK-8203346: JFR: Inconsistent signature of jfr_add_string_constant
-  - JDK-8203664: JFR start failure after AppCDS archive created with JFR StartFlightRecording
-  - JDK-8203921: JFR thread sampling is missing fixes from JDK-8194552
-  - JDK-8203929: Limit amount of data for JFR.dump
-  - JDK-8205516: JFR tool
-  - JDK-8207392: [PPC64] Implement JFR profiling
-  - JDK-8207829: FlightRecorderMXBeanImpl is leaking the first classloader which calls it
-  - JDK-8209960: -Xlog:jfr* doesn't work with the JFR
-  - JDK-8210024: JFR calls virtual is_Java_thread from ~Thread()
-  - JDK-8210776: Upgrade X Window System 6.8.2 to the latest XWD 1.0.7
-  - JDK-8211239: Build fails without JFR: empty JFR events signatures mismatch
-  - JDK-8212232: Wrong metadata for the configuration of the cutoff for old object sample events
-  - JDK-8213015: Inconsistent settings between JFR.configure and -XX:FlightRecorderOptions
-  - JDK-8213421: Line number information for execution samples always 0
-  - JDK-8213617: JFR should record the PID of the recorded process
-  - JDK-8213734: SAXParser.parse(File, ..) does not close resources when Exception occurs.
-  - JDK-8213914: [TESTBUG] Several JFR VM events are not covered by tests
-  - JDK-8213917: [TESTBUG] Shutdown JFR event is not covered by test
-  - JDK-8213966: The ZGC JFR events should be marked as experimental
-  - JDK-8214542: JFR: Old Object Sample event slow on a deep heap in debug builds
-  - JDK-8214750: Unnecessary <p> tags in jfr classes
-  - JDK-8214896: JFR Tool left files behind
-  - JDK-8214906: [TESTBUG] jfr/event/sampling/TestNative.java fails with UnsatisfiedLinkError
-  - JDK-8214925: JFR tool fails to execute
-  - JDK-8215175: Inconsistencies in JFR event metadata
-  - JDK-8215237: jdk.jfr.Recording javadoc does not compile
-  - JDK-8215284: Reduce noise induced by periodic task getFileSize()
-  - JDK-8215355: Object monitor deadlock with no threads holding the monitor (using jemalloc 5.1)
-  - JDK-8215362: JFR GTest JfrTestNetworkUtilization fails
-  - JDK-8215771: The jfr tool should pretty print reference chains
-  - JDK-8216064: -XX:StartFlightRecording:settings= doesn't work properly
-  - JDK-8216486: Possibility of integer overflow in JfrThreadSampler::run()
-  - JDK-8216528: test/jdk/java/rmi/transport/runtimeThreadInheritanceLeak/RuntimeThreadInheritanceLeak.java failing with Xcomp
-  - JDK-8216559: [JFR] Native libraries not correctly parsed from /proc/self/maps
-  - JDK-8216578: Remove unused/obsolete method in JFR code
-  - JDK-8216995: Clean up JFR command line processing
-  - JDK-8217744: [TESTBUG] JFR TestShutdownEvent fails on some systems due to process surviving SIGINT
-  - JDK-8217748: [TESTBUG] Exclude TestSig test case from JFR TestShutdownEvent
-  - JDK-8218935: Make jfr strncpy uses GCC 8.x friendly
-  - JDK-8220293: Deadlock in JFR string pool
-  - JDK-8223689: Add JFR Thread Sampling Support
-  - JDK-8223690: Add JFR BiasedLock Event Support
-  - JDK-8223691: Add JFR G1 Region Type Change Event Support
-  - JDK-8223692: Add JFR G1 Heap Summary Event Support
-  - JDK-8224172: assert(jfr_is_event_enabled(id)) failed: invariant
-  - JDK-8224475: JTextPane does not show images in HTML rendering
-  - JDK-8225068: Remove DocuSign root certificate that is expiring in May 2020
-  - JDK-8225069: Remove Comodo root certificate that is expiring in May 2020
-  - JDK-8226253: JAWS reports wrong number of radio buttons when buttons are hidden.
-  - JDK-8226779: [TESTBUG] Test JFR API from Java agent
-  - JDK-8226892: ActionListeners on JRadioButtons don't get notified when selection is changed with arrow keys
-  - JDK-8227011: Starting a JFR recording in response to JVMTI VMInit and / or Java agent premain corrupts memory
-  - JDK-8227269: Slow class loading when running with JDWP
-  - JDK-8227605: Kitchensink fails "assert((((klass)->trace_id() & (JfrTraceIdEpoch::leakp_in_use_this_epoch_bit())) != 0)) failed: invariant"
-  - JDK-8229366: JFR backport allows unchecked writing to memory
-  - JDK-8229401: Fix JFR code cache test failures
-  - JDK-8229708: JFR backport code does not initialize
-  - JDK-8229873: 8229401 broke jdk8u-jfr-incubator
-  - JDK-8229888: (zipfs) Updating an existing zip file does not preserve original permissions
-  - JDK-8229899: Make java.io.File.isInvalid() less racy
-  - JDK-8230448: [test] JFRSecurityTestSuite.java is failing on Windows
-  - JDK-8230597: Update GIFlib library to the 5.2.1
-  - JDK-8230707: JFR related tests are failing
-  - JDK-8230769: BufImg_SetupICM add ReleasePrimitiveArrayCritical call in early return
-  - JDK-8230782: Robot.createScreenCapture() fails if ?awt.robot.gtk? is set to false
-  - JDK-8230856: Java_java_net_NetworkInterface_getByName0 on unix misses ReleaseStringUTFChars in early return
-  - JDK-8230926: [macosx] Two apostrophes are entered instead of one with "U.S. International - PC" layout
-  - JDK-8230947: TestLookForUntestedEvents.java is failing after JDK-8230707
-  - JDK-8231995: two jtreg tests failed after 8229366 is fixed
-  - JDK-8233197: Invert JvmtiExport::post_vm_initialized() and Jfr:on_vm_start() start-up order for correct option parsing
-  - JDK-8233623: Add classpath exception to copyright in EventHandlerProxyCreator.java file
-  - JDK-8233880: Support compilers with multi-digit major version numbers
-  - JDK-8236002: CSR for JFR backport suggests not leaving out the package-info
-  - JDK-8236008: Some backup files were accidentally left in the hotspot tree
-  - JDK-8236074: Missed package-info
-  - JDK-8236174: Should update javadoc since tags
-  - JDK-8236996: Incorrect Roboto font rendering on Windows with subpixel antialiasing
-  - JDK-8238076: Fix OpenJDK 7 Bootstrap Broken by JFR Backport
-  - JDK-8238452: Keytool generates wrong expiration date if validity is set to 2050/01/01
-  - JDK-8238555: Allow Initialization of SunPKCS11 with NSS when there are external FIPS modules in the NSSDB
-  - JDK-8238589: Necessary code cleanup in JFR for JDK8u
-  - JDK-8238590: Enable JFR by default during compilation in 8u
-  - JDK-8239055: Wrong implementation of VMState.hasListener
-  - JDK-8239476: JDK-8238589 broke windows build by moving OrderedPair
-  - JDK-8239479: minimal1 and zero builds are failing
-  - JDK-8239852: java/util/concurrent tests fail with -XX:+VerifyGraphEdges: assert(!VerifyGraphEdges) failed: verification should have failed
-  - JDK-8239867: correct over use of INCLUDE_JFR macro
-  - JDK-8240375: Disable JFR by default for July 2020 release
-  - JDK-8240576: JVM crashes after transformation in C2 IdealLoopTree::merge_many_backedges
-  - JDK-8241444: Metaspace::_class_vsm not initialized if compressed class pointers are disabled
-  - JDK-8241638: launcher time metrics always report 1 on Linux when _JAVA_LAUNCHER_DEBUG set
-  - JDK-8241750: x86_32 build failure after JDK-8227269
-  - JDK-8241902: AIX Build broken after integration of JDK-8223147 (JFR Backport)
-  - JDK-8242788: Non-PCH build is broken after JDK-8191393
-  - JDK-8242883: Incomplete backport of JDK-8078268: backport test part
-  - JDK-8243059: Build fails when --with-vendor-name contains a comma
-  - JDK-8243474: [TESTBUG] removed three tests of 0 bytes
-  - JDK-8243539: Copyright info (Year) should be updated for fix of 8241638
-  - JDK-8243541: (tz) Upgrade time-zone data to tzdata2020a
-  - JDK-8244407: JVM crashes after transformation in C2 IdealLoopTree::split_fall_in
-  - JDK-8244461: [JDK 8u] Build fails with glibc 2.32
-  - JDK-8244548: JDK 8u: sun.misc.Version.jdkUpdateVersion() returns wrong result
-  - JDK-8244777: ClassLoaderStats VM Op uses constant hash value
-  - JDK-8244843: JapanEraNameCompatTest fails
-  - JDK-8245167: Top package in method profiling shows null in JMC
-  - JDK-8246223: Windows build fails after JDK-8227269
-  - JDK-8246703: [TESTBUG] Add test for JDK-8233197
-  - JDK-8248399: Build installs jfr binary when JFR is disabled
-  - JDK-8248715: New JavaTimeSupplementary localisation for 'in' installed in wrong package
-
-Notes on individual issues:
-===========================
-
-hotspot/jfr:
-
-JDK-8240687: JDK Flight Recorder Integrated to OpenJDK 8u
-=========================================================
-
-OpenJDK 8u now contains the backport of JEP 328: Flight Recorder
-(https://openjdk.java.net/jeps/328) from later versions of OpenJDK.
-
-JFR is a low-overhead framework to collect and provide data helpful to
-troubleshoot the performance of the OpenJDK runtime and of Java
-applications. It consists of a new API to define custom events under
-the jdk.jfr namespace and a JMX interface to interact with the
-framework. The recording can also be initiated with the application
-startup using the -XX:+FlightRecorder flag or via jcmd. JFR replaces
-the +XX:EnableTracing feature introduced in JEP 167, providing a more
-efficient way to retrieve the same information. For compatibility
-reasons, +XX:EnableTracing is still accepted, however no data will be
-printed.
-
-While JFR is not built by default upstream, it is included in Red Hat
-binaries for supported architectures (x86_64, AArch64 & PowerPC 64)
-
-hotspot/runtime:
-
-JDK-8205622: JFR Start Failure After AppCDS Archive Created with JFR StartFlightRecording
-=========================================================================================
-
-JFR will be disabled with a warning message if it is enabled during
-CDS dumping. The user will see the following warning message:
-
-OpenJDK 64-Bit Server VM warning: JFR will be disabled during CDS dumping
-
-if JFR is enabled during CDS dumping such as in the following command
-line:
-
-$ java -Xshare:dump -XX:StartFlightRecording=dumponexit=true
-
-security-libs/java.security:
-
-JDK-8244167: Removal of Comodo Root CA Certificate
-==================================================
-
-The following expired Comodo root CA certificate was removed from the
-`cacerts` keystore: + alias name "addtrustclass1ca [jdk]"
-
-Distinguished Name: CN=AddTrust Class 1 CA Root, OU=AddTrust TTP Network, O=AddTrust AB, C=SE
-
-JDK-8244166: Removal of DocuSign Root CA Certificate
-====================================================
-
-The following expired DocuSign root CA certificate was removed from
- the `cacerts` keystore: + alias name "keynectisrootca [jdk]"
-
-Distinguished Name: CN=KEYNECTIS ROOT CA, OU=ROOT, O=KEYNECTIS, C=FR
-
-security-libs/javax.crypto:pkcs11:
-
-JDK-8240191: Allow SunPKCS11 initialization with NSS when external FIPS modules are present in the Security Modules Database
-============================================================================================================================
-
-The SunPKCS11 security provider can now be initialized with NSS when
-FIPS-enabled external modules are configured in the Security Modules
-Database (NSSDB). Prior to this change, the SunPKCS11 provider would
-throw a RuntimeException with the message: "FIPS flag set for
-non-internal module" when such a library was configured for NSS in
-non-FIPS mode.
-
-This change allows the JDK to work properly with recent NSS releases
-on GNU/Linux operating systems when the system-wide FIPS policy is
-turned on.
-
-Further information can be found in JDK-8238555.
-
-New in release OpenJDK 8u252 (2020-04-14):
-===========================================
-Live versions of these release notes can be found at:
-  * https://bitly.com/oj8u252
-  * https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u252.txt
-
-* Security fixes
-  - JDK-8223898, CVE-2020-2754: Forward references to Nashorn
-  - JDK-8223904, CVE-2020-2755: Improve Nashorn matching
-  - JDK-8224541, CVE-2020-2756: Better mapping of serial ENUMs
-  - JDK-8224549, CVE-2020-2757: Less Blocking Array Queues
-  - JDK-8225603: Enhancement for big integers
-  - JDK-8227542: Manifest improved jar headers
-  - JDK-8231415, CVE-2020-2773: Better signatures in XML
-  - JDK-8233250: Better X11 rendering
-  - JDK-8233410: Better Build Scripting
-  - JDK-8234027: Better JCEKS key support
-  - JDK-8234408, CVE-2020-2781: Improve TLS session handling
-  - JDK-8234825, CVE-2020-2800: Better Headings for HTTP Servers
-  - JDK-8234841, CVE-2020-2803: Enhance buffering of byte buffers
-  - JDK-8235274, CVE-2020-2805: Enhance typing of methods
-  - JDK-8236201, CVE-2020-2830: Better Scanner conversions
-  - JDK-8238960: linux-i586 builds are inconsistent as the newly build jdk is not able to reserve enough space for object heap
-* Other changes
-  - JDK-8005819: Support cross-realm MSSFU
-  - JDK-8022263: use same Clang warnings on BSD as on Linux
-  - JDK-8038631: Create wrapper for awt.Robot with additional functionality
-  - JDK-8047212: runtime/ParallelClassLoading/bootstrap/random/inner-complex assert(ObjectSynchronizer::verify_objmon_isinpool(inf)) failed: monitor is invalid
-  - JDK-8055283: Expand ResourceHashtable with C_HEAP allocation, removal and some unit tests
-  - JDK-8068184: Fix for JDK-8032832 caused a deadlock
-  - JDK-8079693: Add support for ECDSA P-384 and P-521 curves to XML Signature
-  - JDK-8132130: some docs cleanup
-  - JDK-8135318: CMS wrong max_eden_size for check_gc_overhead_limit
-  - JDK-8144445: Maximum size checking in Marlin ArrayCache utility methods is not optimal
-  - JDK-8144446: Automate the Marlin crash test
-  - JDK-8144526: Remove Marlin logging use of deleted internal API
-  - JDK-8144630: Use PrivilegedAction to create Thread in Marlin RendererStats
-  - JDK-8144654: Improve Marlin logging
-  - JDK-8144718: Pisces / Marlin Strokers may generate invalid curves with huge coordinates and round joins
-  - JDK-8166976: TestCipherPBECons has wrong @run line
-  - JDK-8167409: Invalid value passed to critical JNI function
-  - JDK-8181872: C1: possible overflow when strength reducing integer multiply by constant
-  - JDK-8187078: -XX:+VerifyOops finds numerous problems when running JPRT
-  - JDK-8191227: issues with unsafe handle resolution
-  - JDK-8197441: Signature#initSign/initVerify for an invalid private/public key fails with ClassCastException for SunPKCS11 provider
-  - JDK-8204152: SignedObject throws NullPointerException for null keys with an initialized Signature object
-  - JDK-8215756: Memory leaks in the AWT on macOS
-  - JDK-8216472: (se) Stack overflow during selection operation leads to crash (win)
-  - JDK-8219244: NMT: Change ThreadSafepointState's allocation type from mtInternal to mtThread
-  - JDK-8219597: (bf) Heap buffer state changes could provoke unexpected exceptions
-  - JDK-8225128: Add exception for expiring DocuSign root to VerifyCACerts test
-  - JDK-8225130: Add exception for expiring Comodo roots to VerifyCACerts test
-  - JDK-8229022: BufferedReader performance can be improved by using StringBuilder
-  - JDK-8229345: Memory leak due to vtable stubs not being shared on SPARC
-  - JDK-8229872: (fs) Increase buffer size used with getmntent
-  - JDK-8230235: Rendering HTML with empty img attribute and documentBaseKey cause Exception
-  - JDK-8231430: C2: Memory stomp in max_array_length() for T_ILLEGAL type
-  - JDK-8235744: PIT: test/jdk/javax/swing/text/html/TestJLabelWithHTMLText.java times out in linux-x64
-  - JDK-8235904: Infinite loop when rendering huge lines
-  - JDK-8236179: C1 register allocation error with T_ADDRESS
-  - JDK-8237368: Problem with NullPointerException in RMI TCPEndpoint.read
-  - JDK-8240521: Revert backport of 8231584: Deadlock with ClassLoader.findLibrary and System.loadLibrary call
-  - JDK-8241296: Segfault in JNIHandleBlock::oops_do()
-  - JDK-8241307: Marlin renderer should not be the default in 8u252
-
-Notes on individual issues:
-===========================
-
-hotspot/svc:
-
-JDK-8174881: Binary format for HPROF updated 
-============================================
-
-When dumping the heap in binary format, HPROF format 1.0.2 is always
-used now. Previously, format 1.0.1 was used for heaps smaller than
-2GB. HPROF format 1.0.2 is also used by jhsdb jmap for the
-serviceability agent.
-
-security-libs/java.security:
-
-JDK-8229518: Added Support for PKCS#1 v2.2 Algorithms Including RSASSA-PSS Signature
-====================================================================================
-
-The SunRsaSign and SunJCE providers have been enhanced with support
-for more algorithms defined in PKCS#1 v2.2, such as RSASSA-PSS
-signature and OAEP using FIPS 180-4 digest algorithms. New
-constructors and methods have been added to relevant JCA/JCE classes
-under the `java.security.spec` and `javax.crypto.spec` packages for
-supporting additional RSASSA-PSS parameters.
-
-security-libs/javax.crypto:
-
-JDK-8205471: RSASSA-PSS Signature Support Added to SunMSCAPI
-============================================================
-
-The RSASSA-PSS signature algorithm support has been added to the SunMSCAPI provider.
-
-security-libs/javax.security:
-
-JDK-8227564: Allow SASL Mechanisms to Be Restricted
-===================================================
-
-A security property named `jdk.sasl.disabledMechanisms` has been added
-that can be used to disable SASL mechanisms. Any disabled mechanism
-will be ignored if it is specified in the `mechanisms` argument of
-`Sasl.createSaslClient` or the `mechanism` argument of
-`Sasl.createSaslServer`. The default value for this security property
-is empty, which means that no mechanisms are disabled out-of-the-box.

SOURCES/README.md

@@ -1,8 +1,34 @@
-Package of LTS OpenJDK 8
-OpenJDK have release cadence of 6 months. but 3/4 of them are Short Term Supported for 6 months only. This package is designed to harbore them. Currently it is build on openJDK 10. LTSs (next is 11) will go as separate packages. 
+OpenJDK 8 is a Long-Term Support (LTS) release of the Java platform.
 
-JDK8 is last LTS release of Java platform. It is bringing many cool improvements - http://openjdk.java.net/projects/jdk/8/ and is landing to your RHEL. Where it will be maintained for several years. You will always be allowed to install Used LTSs in build root, and alongside via alternatives. 
+For a list of major changes in OpenJDK 8 (java-1.8.0-openjdk), see the
+upstream release page: https://openjdk.org/projects/jdk8/features
 
-See announcement: http://mail.openjdk.java.net/pipermail/discuss/2017-September/004281.html
-See java SIG plans: https://jvanek.fedorapeople.org/devconf/2018/changesInjavaReleaseProcess.pdf
+# Rebuilding the OpenJDK package
 
+The OpenJDK packages are now created from a single build which is then
+packaged for different major versions of Red Hat Enterprise Linux
+(RHEL). This allows the OpenJDK team to focus their efforts on the
+development and testing of this single build, rather than having
+multiple builds which only differ by the platform they were built on.
+
+This does make rebuilding the package slightly more complicated than a
+normal package. Modifications should be made to the
+`java-1.8.0-openjdk-portable.specfile` file, which can be found with
+this README file in the source RPM or installed in the documentation
+tree by the `java-1.8.0-openjdk-headless` RPM.
+
+Once the modified `java-1.8.0-openjdk-portable` RPMs are built, they
+should be installed and will produce a number of tarballs in the
+`/usr/lib/jvm` directory. The `java-1.8.0-openjdk` RPMs can then be
+built, which will use these tarballs to create the usual RPMs found in
+RHEL. The `java-1.8.0-openjdk-portable` RPMs can be uninstalled once
+the desired final RPMs are produced.
+
+Note that the `java-1.8.0-openjdk.spec` file has a hard requirement on
+the exact version of java-1.8.0-openjdk-portable to use, so this will
+need to be modified if the version or rpmrelease values are changed in
+`java-1.8.0-openjdk-portable.specfile`.
+
+To reduce the number of RPMs involved, the `fastdebug` and `slowdebug`
+builds may be disabled using `--without fastdebug` and `--without
+slowdebug`.

SOURCES/TestSecurityProperties.java

@@ -0,0 +1,84 @@
+/* TestSecurityProperties -- Ensure system security properties can be used to
+                             enable the crypto policies.
+   Copyright (C) 2022 Red Hat, Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+import java.io.File;
+import java.io.FileInputStream;
+import java.security.Security;
+import java.util.Properties;
+
+public class TestSecurityProperties {
+    // JDK 11
+    private static final String JDK_PROPS_FILE_JDK_11 = System.getProperty("java.home") + "/conf/security/java.security";
+    // JDK 8
+    private static final String JDK_PROPS_FILE_JDK_8 = System.getProperty("java.home") + "/lib/security/java.security";
+
+    private static final String POLICY_FILE = "/etc/crypto-policies/back-ends/java.config";
+
+    private static final String MSG_PREFIX = "DEBUG: ";
+
+    public static void main(String[] args) {
+        if (args.length == 0) {
+            System.err.println("TestSecurityProperties <true|false>");
+            System.err.println("Invoke with 'true' if system security properties should be enabled.");
+            System.err.println("Invoke with 'false' if system security properties should be disabled.");
+            System.exit(1);
+        }
+        boolean enabled = Boolean.valueOf(args[0]);
+        System.out.println(MSG_PREFIX + "System security properties enabled: " + enabled);
+        Properties jdkProps = new Properties();
+        loadProperties(jdkProps);
+        if (enabled) {
+            loadPolicy(jdkProps);
+        }
+        for (Object key: jdkProps.keySet()) {
+            String sKey = (String)key;
+            String securityVal = Security.getProperty(sKey);
+            String jdkSecVal = jdkProps.getProperty(sKey);
+            if (!securityVal.equals(jdkSecVal)) {
+                String msg = "Expected value '" + jdkSecVal + "' for key '" +
+                             sKey + "'" + " but got value '" + securityVal + "'";
+                throw new RuntimeException("Test failed! " + msg);
+            } else {
+                System.out.println(MSG_PREFIX + sKey + " = " + jdkSecVal + " as expected.");
+            }
+        }
+        System.out.println("TestSecurityProperties PASSED!");
+    }
+
+    private static void loadProperties(Properties props) {
+        String javaVersion = System.getProperty("java.version");
+        System.out.println(MSG_PREFIX + "Java version is " + javaVersion);
+        String propsFile = JDK_PROPS_FILE_JDK_11;
+        if (javaVersion.startsWith("1.8.0")) {
+            propsFile = JDK_PROPS_FILE_JDK_8;
+        }
+        try (FileInputStream fin = new FileInputStream(propsFile)) {
+            props.load(fin);
+        } catch (Exception e) {
+            throw new RuntimeException("Test failed!", e);
+        }
+    }
+
+    private static void loadPolicy(Properties props) {
+        try (FileInputStream fin = new FileInputStream(POLICY_FILE)) {
+            props.load(fin);
+        } catch (Exception e) {
+            throw new RuntimeException("Test failed!", e);
+        }
+    }
+
+}

SOURCES/TestTranslations.java

@@ -0,0 +1,160 @@
+/* TestTranslations -- Ensure translations are available for new timezones
+   Copyright (C) 2022 Red Hat, Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+import java.text.DateFormatSymbols;
+
+import java.time.ZoneId;
+import java.time.format.TextStyle;
+
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Locale;
+import java.util.Objects;
+import java.util.TimeZone;
+
+public class TestTranslations {
+
+    private static Map<Locale,String[]> KYIV, CIUDAD_JUAREZ;
+
+    static {
+        Map<Locale,String[]> map = new HashMap<Locale,String[]>();
+        map.put(Locale.US, new String[] { "Eastern European Time", "GMT+02:00", "EET",
+                                          "Eastern European Summer Time", "GMT+03:00", "EEST",
+                                          "Eastern European Time", "GMT+02:00", "EET"});
+        map.put(Locale.FRANCE, new String[] { "Heure d'Europe de l'Est", "UTC+02:00", "EET",
+                                              "Heure d'\u00e9t\u00e9 d'Europe de l'Est", "UTC+03:00", "EEST",
+                                              "Heure d'Europe de l'Est", "UTC+02:00", "EET"});
+        map.put(Locale.GERMANY, new String[] { "Osteurop\u00e4ische Zeit", "OEZ", "OEZ",
+                                               "Osteurop\u00e4ische Sommerzeit", "OESZ", "OESZ",
+                                               "Osteurop\u00e4ische Zeit", "OEZ", "OEZ"});
+        KYIV = Collections.unmodifiableMap(map);
+
+        map = new HashMap<Locale,String[]>();
+        map.put(Locale.US, new String[] { "Mountain Standard Time", "MST", "MST",
+                                          "Mountain Daylight Time", "MDT", "MDT",
+                                          "Mountain Time", "MT", "MT"});
+        map.put(Locale.FRANCE, new String[] { "Heure normale des Rocheuses", "UTC\u221207:00", "MST",
+                                              "Heure avanc\u00e9e des Rocheuses", "UTC\u221206:00", "MDT",
+                                              "Rocheuses", "UTC\u221207:00", "MT"});
+        map.put(Locale.GERMANY, new String[] { "Rocky Mountains Normalzeit", "GMT-07:00", "MST",
+                                               "Rocky Mountains Sommerzeit", "GMT-06:00", "MDT",
+                                               "Zeitzone Mountain", "GMT-07:00", "MT"});
+        CIUDAD_JUAREZ = Collections.unmodifiableMap(map);
+    }
+
+
+    public static void main(String[] args) {
+        if (args.length < 1) {
+            System.err.println("Test must be started with the name of the locale provider.");
+            System.exit(1);
+        }
+
+        System.out.println("Checking sanity of full zone string set...");
+        boolean invalid = Arrays.stream(Locale.getAvailableLocales())
+            .peek(l -> System.out.println("Locale: " + l))
+            .map(l -> DateFormatSymbols.getInstance(l).getZoneStrings())
+            .flatMap(zs -> Arrays.stream(zs))
+            .flatMap(names -> Arrays.stream(names))
+            .filter(name -> Objects.isNull(name) || name.isEmpty())
+            .findAny()
+            .isPresent();
+        if (invalid) {
+            System.err.println("Zone string for a locale returned null or empty string");
+            System.exit(2);
+        }
+
+        String localeProvider = args[0];
+        testZone(localeProvider, KYIV,
+                 new String[] { "Europe/Kiev", "Europe/Kyiv", "Europe/Uzhgorod", "Europe/Zaporozhye" });
+        testZone(localeProvider, CIUDAD_JUAREZ,
+                 new String[] { "America/Cambridge_Bay", "America/Ciudad_Juarez" });
+    }
+
+    private static void testZone(String localeProvider, Map<Locale,String[]> exp, String[] ids) {
+        for (Locale l : exp.keySet()) {
+            String[] expected = exp.get(l);
+            System.out.printf("Expected values for %s are %s\n", l, Arrays.toString(expected));
+            for (String id : ids) {
+                String expectedShortStd = null;
+                String expectedShortDST = null;
+                String expectedShortGen = null;
+
+                System.out.printf("Checking locale %s for %s...\n", l, id);
+
+                if ("JRE".equals(localeProvider)) {
+                    expectedShortStd = expected[2];
+                    expectedShortDST = expected[5];
+                    expectedShortGen = expected[8];
+                } else if ("CLDR".equals(localeProvider)) {
+                    expectedShortStd = expected[1];
+                    expectedShortDST = expected[4];
+                    expectedShortGen = expected[7];
+                } else {
+                    System.err.printf("Invalid locale provider %s\n", localeProvider);
+                    System.exit(3);
+                }
+                System.out.printf("Locale Provider is %s, using short values %s, %s and %s\n",
+                                  localeProvider, expectedShortStd, expectedShortDST, expectedShortGen);
+
+                String longStd = TimeZone.getTimeZone(id).getDisplayName(false, TimeZone.LONG, l);
+                String shortStd = TimeZone.getTimeZone(id).getDisplayName(false, TimeZone.SHORT, l);
+                String longDST = TimeZone.getTimeZone(id).getDisplayName(true, TimeZone.LONG, l);
+                String shortDST = TimeZone.getTimeZone(id).getDisplayName(true, TimeZone.SHORT, l);
+                String longGen = ZoneId.of(id).getDisplayName(TextStyle.FULL, l);
+                String shortGen = ZoneId.of(id).getDisplayName(TextStyle.SHORT, l);
+
+                if (!expected[0].equals(longStd)) {
+                    System.err.printf("Long standard display name for %s in %s was %s, expected %s\n",
+                                      id, l, longStd, expected[0]);
+                    System.exit(4);
+                }
+
+                if (!expectedShortStd.equals(shortStd)) {
+                    System.err.printf("Short standard display name for %s in %s was %s, expected %s\n",
+                                      id, l, shortStd, expectedShortStd);
+                    System.exit(5);
+                }
+
+                if (!expected[3].equals(longDST)) {
+                    System.err.printf("Long DST display name for %s in %s was %s, expected %s\n",
+                                      id, l, longDST, expected[3]);
+                    System.exit(6);
+                }
+
+                if (!expectedShortDST.equals(shortDST)) {
+                    System.err.printf("Short DST display name for %s in %s was %s, expected %s\n",
+                                      id, l, shortDST, expectedShortDST);
+                    System.exit(7);
+                }
+
+                if (!expected[6].equals(longGen)) {
+                    System.err.printf("Long generic display name for %s in %s was %s, expected %s\n",
+                                      id, l, longGen, expected[6]);
+                    System.exit(8);
+                }
+
+                if (!expectedShortGen.equals(shortGen)) {
+                    System.err.printf("Short generic display name for %s in %s was %s, expected %s\n",
+                                      id, l, shortGen, expectedShortGen);
+                    System.exit(9);
+                }
+            }
+        }
+    }
+}

SOURCES/jdk8186464-rh1433262-zip64_failure.patch

@@ -0,0 +1,286 @@
+# HG changeset patch
+# User sherman
+# Date 1505950914 25200
+#      Wed Sep 20 16:41:54 2017 -0700
+# Node ID 723486922bfe4c17e3f5c067ce5e97229842fbcd
+# Parent  c8ac05bbe47771b3dafa2e7fc9a95d86d68d7c07
+8186464: ZipFile cannot read some InfoZip ZIP64 zip files
+Reviewed-by: martin
+
+diff --git openjdk.orig/jdk/src/share/demo/nio/zipfs/src/com/sun/nio/zipfs/ZipFileSystem.java openjdk/jdk/src/share/demo/nio/zipfs/src/com/sun/nio/zipfs/ZipFileSystem.java
+index 26e2a5bf9e9..2630c118817 100644
+--- openjdk.orig/jdk/src/share/demo/nio/zipfs/src/com/sun/nio/zipfs/ZipFileSystem.java
++++ openjdk/jdk/src/share/demo/nio/zipfs/src/com/sun/nio/zipfs/ZipFileSystem.java
+@@ -92,6 +92,7 @@ public class ZipFileSystem extends FileSystem {
+     private final boolean createNew;     // create a new zip if not exists
+     private static final boolean isWindows =
+         System.getProperty("os.name").startsWith("Windows");
++    private final boolean forceEnd64;
+ 
+     // a threshold, in bytes, to decide whether to create a temp file
+     // for outputstream of a zip entry
+@@ -112,12 +113,13 @@ public class ZipFileSystem extends FileSystem {
+         if (this.defaultDir.charAt(0) != '/')
+             throw new IllegalArgumentException("default dir should be absolute");
+ 
++        this.forceEnd64 = "true".equals(env.get("forceZIP64End"));
+         this.provider = provider;
+         this.zfpath = zfpath;
+         if (Files.notExists(zfpath)) {
+             if (createNew) {
+                 try (OutputStream os = Files.newOutputStream(zfpath, CREATE_NEW, WRITE)) {
+-                    new END().write(os, 0);
++                    new END().write(os, 0, forceEnd64);
+                 }
+             } else {
+                 throw new FileSystemNotFoundException(zfpath.toString());
+@@ -1014,28 +1016,36 @@ public class ZipFileSystem extends FileSystem {
+                     end.cenoff = ENDOFF(buf);
+                     end.comlen = ENDCOM(buf);
+                     end.endpos = pos + i;
+-                    if (end.cenlen == ZIP64_MINVAL ||
+-                        end.cenoff == ZIP64_MINVAL ||
+-                        end.centot == ZIP64_MINVAL32)
+-                    {
+-                        // need to find the zip64 end;
+-                        byte[] loc64 = new byte[ZIP64_LOCHDR];
+-                        if (readFullyAt(loc64, 0, loc64.length, end.endpos - ZIP64_LOCHDR)
+-                            != loc64.length) {
+-                            return end;
+-                        }
+-                        long end64pos = ZIP64_LOCOFF(loc64);
+-                        byte[] end64buf = new byte[ZIP64_ENDHDR];
+-                        if (readFullyAt(end64buf, 0, end64buf.length, end64pos)
+-                            != end64buf.length) {
+-                            return end;
+-                        }
+-                        // end64 found, re-calcualte everything.
+-                        end.cenlen = ZIP64_ENDSIZ(end64buf);
+-                        end.cenoff = ZIP64_ENDOFF(end64buf);
+-                        end.centot = (int)ZIP64_ENDTOT(end64buf); // assume total < 2g
+-                        end.endpos = end64pos;
++                    // try if there is zip64 end;
++                    byte[] loc64 = new byte[ZIP64_LOCHDR];
++                    if (end.endpos < ZIP64_LOCHDR ||
++                        readFullyAt(loc64, 0, loc64.length, end.endpos - ZIP64_LOCHDR)
++                        != loc64.length ||
++                        !locator64SigAt(loc64, 0)) {
++                        return end;
++                    }
++                    long end64pos = ZIP64_LOCOFF(loc64);
++                    byte[] end64buf = new byte[ZIP64_ENDHDR];
++                    if (readFullyAt(end64buf, 0, end64buf.length, end64pos)
++                        != end64buf.length ||
++                        !end64SigAt(end64buf, 0)) {
++                        return end;
++                    }
++                    // end64 found,
++                    long cenlen64 = ZIP64_ENDSIZ(end64buf);
++                    long cenoff64 = ZIP64_ENDOFF(end64buf);
++                    long centot64 = ZIP64_ENDTOT(end64buf);
++                    // double-check
++                    if (cenlen64 != end.cenlen && end.cenlen != ZIP64_MINVAL ||
++                        cenoff64 != end.cenoff && end.cenoff != ZIP64_MINVAL ||
++                        centot64 != end.centot && end.centot != ZIP64_MINVAL32) {
++                        return end;
+                     }
++                    // to use the end64 values
++                    end.cenlen = cenlen64;
++                    end.cenoff = cenoff64;
++                    end.centot = (int)centot64; // assume total < 2g
++                    end.endpos = end64pos;
+                     return end;
+                 }
+             }
+@@ -1201,7 +1211,7 @@ public class ZipFileSystem extends FileSystem {
+ 
+     // sync the zip file system, if there is any udpate
+     private void sync() throws IOException {
+-        //System.out.printf("->sync(%s) starting....!%n", toString());
++        // System.out.printf("->sync(%s) starting....!%n", toString());
+         // check ex-closer
+         if (!exChClosers.isEmpty()) {
+             for (ExChannelCloser ecc : exChClosers) {
+@@ -1292,7 +1302,7 @@ public class ZipFileSystem extends FileSystem {
+             }
+             end.centot = elist.size();
+             end.cenlen = written - end.cenoff;
+-            end.write(os, written);
++            end.write(os, written, forceEnd64);
+         }
+         if (!streams.isEmpty()) {
+             //
+@@ -1849,8 +1859,8 @@ public class ZipFileSystem extends FileSystem {
+         long endpos;
+         int disktot;
+ 
+-        void write(OutputStream os, long offset) throws IOException {
+-            boolean hasZip64 = false;
++        void write(OutputStream os, long offset, boolean forceEnd64) throws IOException {
++            boolean hasZip64 = forceEnd64; // false;
+             long xlen = cenlen;
+             long xoff = cenoff;
+             if (xlen >= ZIP64_MINVAL) {
+@@ -1875,8 +1885,8 @@ public class ZipFileSystem extends FileSystem {
+                 writeShort(os, 45);               // version needed to extract
+                 writeInt(os, 0);                  // number of this disk
+                 writeInt(os, 0);                  // central directory start disk
+-                writeLong(os, centot);            // number of directory entires on disk
+-                writeLong(os, centot);            // number of directory entires
++                writeLong(os, centot);            // number of directory entries on disk
++                writeLong(os, centot);            // number of directory entries
+                 writeLong(os, cenlen);            // length of central directory
+                 writeLong(os, cenoff);            // offset of central directory
+ 
+diff --git openjdk.orig/jdk/src/share/native/java/util/zip/zip_util.c openjdk/jdk/src/share/native/java/util/zip/zip_util.c
+index 5fd6fea049d..858e5814e92 100644
+--- openjdk.orig/jdk/src/share/native/java/util/zip/zip_util.c
++++ openjdk/jdk/src/share/native/java/util/zip/zip_util.c
+@@ -385,6 +385,9 @@ findEND64(jzfile *zip, void *end64buf, jlong endpos)
+ {
+     char loc64[ZIP64_LOCHDR];
+     jlong end64pos;
++    if (endpos < ZIP64_LOCHDR) {
++	return -1;
++    }
+     if (readFullyAt(zip->zfd, loc64, ZIP64_LOCHDR, endpos - ZIP64_LOCHDR) == -1) {
+         return -1;    // end64 locator not found
+     }
+@@ -567,6 +570,7 @@ readCEN(jzfile *zip, jint knownTotal)
+ {
+     /* Following are unsigned 32-bit */
+     jlong endpos, end64pos, cenpos, cenlen, cenoff;
++    jlong cenlen64, cenoff64, centot64;
+     /* Following are unsigned 16-bit */
+     jint total, tablelen, i, j;
+     unsigned char *cenbuf = NULL;
+@@ -594,13 +598,20 @@ readCEN(jzfile *zip, jint knownTotal)
+     cenlen = ENDSIZ(endbuf);
+     cenoff = ENDOFF(endbuf);
+     total  = ENDTOT(endbuf);
+-    if (cenlen == ZIP64_MAGICVAL || cenoff == ZIP64_MAGICVAL ||
+-        total == ZIP64_MAGICCOUNT) {
+-        unsigned char end64buf[ZIP64_ENDHDR];
+-        if ((end64pos = findEND64(zip, end64buf, endpos)) != -1) {
+-            cenlen = ZIP64_ENDSIZ(end64buf);
+-            cenoff = ZIP64_ENDOFF(end64buf);
+-            total = (jint)ZIP64_ENDTOT(end64buf);
++    unsigned char end64buf[ZIP64_ENDHDR];
++    if ((end64pos = findEND64(zip, end64buf, endpos)) != -1) {
++	// end64 candidate found,
++	cenlen64 = ZIP64_ENDSIZ(end64buf);
++	cenoff64 = ZIP64_ENDOFF(end64buf);
++	centot64 = ZIP64_ENDTOT(end64buf);
++	// double-check
++	if ((cenlen64 == cenlen || cenlen == ZIP64_MAGICVAL) &&
++	    (cenoff64 == cenoff || cenoff == ZIP64_MAGICVAL) &&
++	    (centot64 == total || total == ZIP64_MAGICCOUNT)) {
++	    // to use the end64 values
++            cenlen = cenlen64;
++            cenoff = cenoff64;
++            total = (jint)centot64;
+             endpos = end64pos;
+             endhdrlen = ZIP64_ENDHDR;
+         }
+diff --git openjdk.orig/jdk/test/java/util/zip/ZipFile/ReadZip.java openjdk/jdk/test/java/util/zip/ZipFile/ReadZip.java
+index ffe8a8ed712..9b380003893 100644
+--- openjdk.orig/jdk/test/java/util/zip/ZipFile/ReadZip.java
++++ openjdk/jdk/test/java/util/zip/ZipFile/ReadZip.java
+@@ -22,7 +22,7 @@
+  */
+ 
+ /* @test
+- * @bug 4241361 4842702 4985614 6646605 5032358 6923692 6233323 8144977 8184993
++ * @bug 4241361 4842702 4985614 6646605 5032358 6923692 6233323 8144977 8184993 8186464
+  * @summary Make sure we can read a zip file.
+    @key randomness
+  * @run main/othervm ReadZip
+@@ -31,12 +31,24 @@
+  */
+ 
+ import java.io.*;
++import java.net.URI;
+ import java.nio.file.Files;
++import java.nio.file.FileSystem;
++import java.nio.file.FileSystems;
++import java.nio.file.Path;
+ import java.nio.file.Paths;
+ import java.nio.file.StandardCopyOption;
+ import java.nio.file.StandardOpenOption;
++import java.util.Collections;
++import java.util.HashMap;
++import java.util.List;
++import java.util.Map;
+ import java.util.zip.*;
+ 
++import sun.misc.IOUtils;
++
++import static java.nio.charset.StandardCharsets.US_ASCII;
++
+ public class ReadZip {
+     private static void unreached (Object o)
+         throws Exception
+@@ -144,8 +156,6 @@ public class ReadZip {
+             newZip.delete();
+         }
+ 
+-
+-
+         // Throw a FNF exception when read a non-existing zip file
+         try { unreached (new ZipFile(
+                              new File(System.getProperty("test.src", "."),
+@@ -153,5 +163,54 @@ public class ReadZip {
+                                       + String.valueOf(new java.util.Random().nextInt())
+                                       + ".zip")));
+         } catch (FileNotFoundException fnfe) {}
++
++        // read a zip file with ZIP64 end
++        Path path = Paths.get(System.getProperty("test.dir", ""), "end64.zip");
++        try {
++            URI uri = URI.create("jar:" + path.toUri());
++            Map<String, Object> env = new HashMap<>();
++	    env.put("create", "true");
++	    env.put("forceZIP64End", "true");
++            try (FileSystem fs = FileSystems.newFileSystem(uri, env)) {
++                Files.write(fs.getPath("hello"), "hello".getBytes());
++            }
++            try (ZipFile zf = new ZipFile(path.toFile())) {
++                if (!"hello".equals(new String(IOUtils.readAllBytes(zf.getInputStream(new ZipEntry("hello"))),
++                                               US_ASCII)))
++                    throw new RuntimeException("zipfile: read entry failed");
++            } catch (IOException x) {
++                throw new RuntimeException("zipfile: zip64 end failed");
++            }
++            try (FileSystem fs = FileSystems.newFileSystem(uri, Collections.emptyMap())) {
++                if (!"hello".equals(new String(Files.readAllBytes(fs.getPath("hello")))))
++                    throw new RuntimeException("zipfs: read entry failed");
++            } catch (IOException x) {
++                throw new RuntimeException("zipfile: zip64 end failed");
++            }
++        } finally {
++            Files.deleteIfExists(path);
++        }
++
++        // read a zip file created via "echo hello | zip dst.zip -", which uses
++        // ZIP64 end record
++        if (Files.notExists(Paths.get("/usr/bin/zip")))
++            return;
++        try {
++            Process zip = new ProcessBuilder("zip", path.toString().toString(), "-").start();
++            OutputStream os = zip.getOutputStream();
++            os.write("hello".getBytes(US_ASCII));
++            os.close();
++            zip.waitFor();
++            if (zip.exitValue() == 0 && Files.exists(path)) {
++                try (ZipFile zf = new ZipFile(path.toFile())) {
++                    if (!"hello".equals(new String(IOUtils.readAllBytes(zf.getInputStream(new ZipEntry("-"))))))
++                        throw new RuntimeException("zipfile: read entry failed");
++                } catch (IOException x) {
++                    throw new RuntimeException("zipfile: zip64 end failed");
++                }
++            }
++        } finally {
++            Files.deleteIfExists(path);
++        }
+     }
+ }

SOURCES/jdk8195607-pr3776-rh1760437-nss_sqlite_db_config.patch

@@ -1,125 +0,0 @@
-# HG changeset patch
-# User mbalao
-# Date 1529971845 -28800
-#      Tue Jun 26 08:10:45 2018 +0800
-# Node ID e9c20b7250cd98d16a67f2a30b34284c2caa01dc
-# Parent  9f1aa2e38d90dd60522237d7414af6bdcf03c4ff
-8195607, PR3776: sun/security/pkcs11/Secmod/TestNssDbSqlite.java failed with "NSS initialization failed" on NSS 3.34.1
-Reviewed-by: valeriep, weijun
-
-diff --git openjdk.orig/jdk/src/share/classes/sun/security/pkcs11/Secmod.java openjdk/jdk/src/share/classes/sun/security/pkcs11/Secmod.java
---- openjdk.orig/jdk/src/share/classes/sun/security/pkcs11/Secmod.java
-+++ openjdk/jdk/src/share/classes/sun/security/pkcs11/Secmod.java
-@@ -197,7 +197,7 @@
- 
-         if (configDir != null) {
-             String configDirPath = null;
--            String sqlPrefix = "sql:/";
-+            String sqlPrefix = "sql:";
-             if (!configDir.startsWith(sqlPrefix)) {
-                 configDirPath = configDir;
-             } else {
-diff --git openjdk.orig/jdk/src/share/native/sun/security/pkcs11/j2secmod.c openjdk/jdk/src/share/native/sun/security/pkcs11/j2secmod.c
---- openjdk.orig/jdk/src/share/native/sun/security/pkcs11/j2secmod.c
-+++ openjdk/jdk/src/share/native/sun/security/pkcs11/j2secmod.c
-@@ -69,9 +69,14 @@
-     int res = 0;
-     FPTR_Initialize initialize =
-         (FPTR_Initialize)findFunction(env, jHandle, "NSS_Initialize");
-+    #ifdef SECMOD_DEBUG
-+    FPTR_GetError getError =
-+        (FPTR_GetError)findFunction(env, jHandle, "PORT_GetError");
-+    #endif // SECMOD_DEBUG
-     unsigned int flags = 0x00;
-     const char *configDir = NULL;
-     const char *functionName = NULL;
-+    const char *configFile = NULL;
- 
-     /* If we cannot initialize, exit now */
-     if (initialize == NULL) {
-@@ -97,13 +102,18 @@
-         flags = 0x20; // NSS_INIT_OPTIMIZESPACE flag
-     }
- 
-+    configFile = "secmod.db";
-+    if (configDir != NULL && strncmp("sql:", configDir, 4U) == 0) {
-+        configFile = "pkcs11.txt";
-+    }
-+
-     /*
-      * If the NSS_Init function is requested then call NSS_Initialize to
-      * open the Cert, Key and Security Module databases, read only.
-      */
-     if (strcmp("NSS_Init", functionName) == 0) {
-         flags = flags | 0x01; // NSS_INIT_READONLY flag
--        res = initialize(configDir, "", "", "secmod.db", flags);
-+        res = initialize(configDir, "", "", configFile, flags);
- 
-     /*
-      * If the NSS_InitReadWrite function is requested then call
-@@ -111,7 +121,7 @@
-      * read/write.
-      */
-     } else if (strcmp("NSS_InitReadWrite", functionName) == 0) {
--        res = initialize(configDir, "", "", "secmod.db", flags);
-+        res = initialize(configDir, "", "", configFile, flags);
- 
-     /*
-      * If the NSS_NoDB_Init function is requested then call
-@@ -137,6 +147,13 @@
-         (*env)->ReleaseStringUTFChars(env, jConfigDir, configDir);
-     }
-     dprintf1("-res: %d\n", res);
-+    #ifdef SECMOD_DEBUG
-+    if (res == -1) {
-+        if (getError != NULL) {
-+            dprintf1("-NSS error: %d\n", getError());
-+        }
-+    }
-+    #endif // SECMOD_DEBUG
- 
-     return (res == 0) ? JNI_TRUE : JNI_FALSE;
- }
-diff --git openjdk.orig/jdk/src/solaris/native/sun/security/pkcs11/j2secmod_md.h openjdk/jdk/src/solaris/native/sun/security/pkcs11/j2secmod_md.h
---- openjdk.orig/jdk/src/solaris/native/sun/security/pkcs11/j2secmod_md.h
-+++ openjdk/jdk/src/solaris/native/sun/security/pkcs11/j2secmod_md.h
-@@ -34,6 +34,10 @@
-         const char *certPrefix, const char *keyPrefix,
-         const char *secmodName, unsigned int flags);
- 
-+#ifdef SECMOD_DEBUG
-+typedef int (*FPTR_GetError)(void);
-+#endif //SECMOD_DEBUG
-+
- // in secmod.h
- //extern SECMODModule *SECMOD_LoadModule(char *moduleSpec,SECMODModule *parent,
- //                                                      PRBool recurse);
-diff --git openjdk.orig/jdk/test/sun/security/pkcs11/Secmod/pkcs11.txt openjdk/jdk/test/sun/security/pkcs11/Secmod/pkcs11.txt
-new file mode 100644
---- /dev/null
-+++ openjdk/jdk/test/sun/security/pkcs11/Secmod/pkcs11.txt
-@@ -0,0 +1,4 @@
-+library=
-+name=NSS Internal PKCS #11 Module
-+parameters=configdir='sql:./tmpdb' certPrefix='' keyPrefix='' secmod='' flags= updatedir='' updateCertPrefix='' updateKeyPrefix='' updateid='' updateTokenDescription='' 
-+NSS=Flags=internal,critical trustOrder=75 cipherOrder=100 slotParams=(1={slotFlags=[RSA,DSA,DH,RC2,RC4,DES,RANDOM,SHA1,MD5,MD2,SSL,TLS,AES,Camellia,SEED,SHA256,SHA512] askpw=any timeout=30})
-diff --git openjdk.orig/jdk/test/sun/security/pkcs11/SecmodTest.java openjdk/jdk/test/sun/security/pkcs11/SecmodTest.java
---- openjdk.orig/jdk/test/sun/security/pkcs11/SecmodTest.java
-+++ openjdk/jdk/test/sun/security/pkcs11/SecmodTest.java
-@@ -55,7 +55,7 @@
- 
-         DBDIR = System.getProperty("test.classes", ".") + SEP + "tmpdb";
-         if (useSqlite) {
--            System.setProperty("pkcs11test.nss.db", "sql:/" + DBDIR);
-+            System.setProperty("pkcs11test.nss.db", "sql:" + DBDIR);
-         } else {
-             System.setProperty("pkcs11test.nss.db", DBDIR);
-         }
-@@ -67,6 +67,7 @@
-         if (useSqlite) {
-             copyFile("key4.db", BASE, DBDIR);
-             copyFile("cert9.db", BASE, DBDIR);
-+            copyFile("pkcs11.txt", BASE, DBDIR);
-         } else {
-             copyFile("secmod.db", BASE, DBDIR);
-             copyFile("key3.db", BASE, DBDIR);

SOURCES/jdk8199936-pr3533-enable_mstackrealign_on_x86_linux_as_well_as_x86_mac_os_x.patch

@@ -22,7 +22,7 @@ diff --git openjdk.orig///common/autoconf/flags.m4 openjdk///common/autoconf/fla
 +    # On 32-bit MacOSX the OS requires C-entry points to be 16 byte aligned.
 +    # While waiting for a better solution, the current workaround is to use -mstackrealign
 +    # This is also required on Linux systems which use libraries compiled with SSE instructions
-+    REALIGN_CFLAG="-mstackrealign"
++    REALIGN_CFLAG="-mincoming-stack-boundary=2 -mpreferred-stack-boundary=4"
 +    FLAGS_COMPILER_CHECK_ARGUMENTS([$REALIGN_CFLAG -Werror], [],
 +      AC_MSG_ERROR([The selected compiler $CXX does not support -mstackrealign! Try to put another compiler in the path.])
 +    )

SOURCES/jdk8203030-zero_s390_31_bit_size_t_type_conflicts_in_shared_code.patch

@@ -1,7 +1,7 @@
-diff --git openjdk.orig/hotspot/src/share/vm/gc_implementation/concurrentMarkSweep/compactibleFreeListSpace.cpp openjdk/hotspot/src/share/vm/gc_implementation/concurrentMarkSweep/compactibleFreeListSpace.cpp
---- openjdk.orig/hotspot/src/share/vm/gc_implementation/concurrentMarkSweep/compactibleFreeListSpace.cpp
-+++ openjdk/hotspot/src/share/vm/gc_implementation/concurrentMarkSweep/compactibleFreeListSpace.cpp
-@@ -2659,7 +2659,7 @@
+diff -r 4689eaf1a5c9 src/share/vm/gc_implementation/concurrentMarkSweep/compactibleFreeListSpace.cpp
+--- openjdk.orig/hotspot/src/share/vm/gc_implementation/concurrentMarkSweep/compactibleFreeListSpace.cpp	Mon Aug 31 07:09:56 2020 +0100
++++ openjdk/hotspot/src/share/vm/gc_implementation/concurrentMarkSweep/compactibleFreeListSpace.cpp	Tue Sep 08 22:20:44 2020 -0400
+@@ -2689,7 +2689,7 @@
    if (ResizeOldPLAB && CMSOldPLABResizeQuicker) {
      size_t multiple = _num_blocks[word_sz]/(CMSOldPLABToleranceFactor*CMSOldPLABNumRefills*n_blks);
      n_blks +=  CMSOldPLABReactivityFactor*multiple*n_blks;
@@ -10,10 +10,10 @@ diff --git openjdk.orig/hotspot/src/share/vm/gc_implementation/concurrentMarkSwe
    }
    assert(n_blks > 0, "Error");
    _cfls->par_get_chunk_of_blocks(word_sz, n_blks, fl);
-diff --git openjdk.orig/hotspot/src/share/vm/gc_implementation/concurrentMarkSweep/concurrentMarkSweepGeneration.cpp openjdk/hotspot/src/share/vm/gc_implementation/concurrentMarkSweep/concurrentMarkSweepGeneration.cpp
---- openjdk.orig/hotspot/src/share/vm/gc_implementation/concurrentMarkSweep/concurrentMarkSweepGeneration.cpp
-+++ openjdk/hotspot/src/share/vm/gc_implementation/concurrentMarkSweep/concurrentMarkSweepGeneration.cpp
-@@ -957,7 +957,7 @@
+diff -r 4689eaf1a5c9 src/share/vm/gc_implementation/concurrentMarkSweep/concurrentMarkSweepGeneration.cpp
+--- openjdk.orig/hotspot/src/share/vm/gc_implementation/concurrentMarkSweep/concurrentMarkSweepGeneration.cpp	Mon Aug 31 07:09:56 2020 +0100
++++ openjdk/hotspot/src/share/vm/gc_implementation/concurrentMarkSweep/concurrentMarkSweepGeneration.cpp	Tue Sep 08 22:20:44 2020 -0400
+@@ -961,7 +961,7 @@
    if (free_percentage < desired_free_percentage) {
      size_t desired_capacity = (size_t)(used() / ((double) 1 - desired_free_percentage));
      assert(desired_capacity >= capacity(), "invalid expansion size");
@@ -22,7 +22,7 @@ diff --git openjdk.orig/hotspot/src/share/vm/gc_implementation/concurrentMarkSwe
      if (PrintGCDetails && Verbose) {
        size_t desired_capacity = (size_t)(used() / ((double) 1 - desired_free_percentage));
        gclog_or_tty->print_cr("\nFrom compute_new_size: ");
-@@ -6577,7 +6577,7 @@
+@@ -6591,7 +6591,7 @@
      HeapWord* curAddr = _markBitMap.startWord();
      while (curAddr < _markBitMap.endWord()) {
        size_t remaining  = pointer_delta(_markBitMap.endWord(), curAddr);
@@ -31,7 +31,7 @@ diff --git openjdk.orig/hotspot/src/share/vm/gc_implementation/concurrentMarkSwe
        _markBitMap.clear_large_range(chunk);
        if (ConcurrentMarkSweepThread::should_yield() &&
            !foregroundGCIsActive() &&
-@@ -6875,7 +6875,7 @@
+@@ -6889,7 +6889,7 @@
      return;
    }
    // Double capacity if possible
@@ -40,30 +40,34 @@ diff --git openjdk.orig/hotspot/src/share/vm/gc_implementation/concurrentMarkSwe
    // Do not give up existing stack until we have managed to
    // get the double capacity that we desired.
    ReservedSpace rs(ReservedSpace::allocation_align_size_up(
-diff --git openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/concurrentMark.cpp openjdk/hotspot/src/share/vm/gc_implementation/g1/concurrentMark.cpp
---- openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/concurrentMark.cpp
-+++ openjdk/hotspot/src/share/vm/gc_implementation/g1/concurrentMark.cpp
-@@ -3902,7 +3902,7 @@
+diff -r 4689eaf1a5c9 src/share/vm/gc_implementation/g1/concurrentMark.cpp
+--- openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/concurrentMark.cpp	Mon Aug 31 07:09:56 2020 +0100
++++ openjdk/hotspot/src/share/vm/gc_implementation/g1/concurrentMark.cpp	Tue Sep 08 22:20:44 2020 -0400
+@@ -3916,7 +3916,7 @@
    // of things to do) or totally (at the very end).
    size_t target_size;
    if (partially) {
 -    target_size = MIN2((size_t)_task_queue->max_elems()/3, GCDrainStackTargetSize);
-+    target_size = MIN2((size_t)(_task_queue->max_elems()/3), (size_t) GCDrainStackTargetSize);
++    target_size = MIN2((size_t)_task_queue->max_elems()/3, (size_t)GCDrainStackTargetSize);
    } else {
      target_size = 0;
    }
-@@ -4706,7 +4706,7 @@
-   // The > 0 check is to deal with the prev and next live bytes which
-   // could be 0.
-   if (*hum_bytes > 0) {
--    bytes = MIN2(HeapRegion::GrainBytes, *hum_bytes);
-+    bytes = MIN2(HeapRegion::GrainBytes, (size_t)*hum_bytes);
-     *hum_bytes -= bytes;
+diff -r 4689eaf1a5c9 src/share/vm/gc_implementation/g1/g1BiasedArray.hpp
+--- openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1BiasedArray.hpp	Mon Aug 31 07:09:56 2020 +0100
++++ openjdk/hotspot/src/share/vm/gc_implementation/g1/g1BiasedArray.hpp	Tue Sep 08 22:20:44 2020 -0400
+@@ -78,7 +78,8 @@
+     size_t num_target_elems = pointer_delta(end, bottom, mapping_granularity_in_bytes);
+     idx_t bias = (uintptr_t)bottom / mapping_granularity_in_bytes;
+     address base = create_new_base_array(num_target_elems, target_elem_size_in_bytes);
+-    initialize_base(base, num_target_elems, bias, target_elem_size_in_bytes, log2_intptr(mapping_granularity_in_bytes));
++    initialize_base(base, num_target_elems, bias, target_elem_size_in_bytes,
++		    log2_intptr((uintptr_t)mapping_granularity_in_bytes));
    }
-   return bytes;
-diff --git openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1CollectedHeap.cpp openjdk/hotspot/src/share/vm/gc_implementation/g1/g1CollectedHeap.cpp
---- openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1CollectedHeap.cpp
-+++ openjdk/hotspot/src/share/vm/gc_implementation/g1/g1CollectedHeap.cpp
+ 
+   size_t bias() const { return _bias; }
+diff -r 4689eaf1a5c9 src/share/vm/gc_implementation/g1/g1CollectedHeap.cpp
+--- openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1CollectedHeap.cpp	Mon Aug 31 07:09:56 2020 +0100
++++ openjdk/hotspot/src/share/vm/gc_implementation/g1/g1CollectedHeap.cpp	Tue Sep 08 22:20:44 2020 -0400
 @@ -1729,7 +1729,7 @@
  
    verify_region_sets_optional();
@@ -73,21 +77,33 @@ diff --git openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1CollectedHea
    ergo_verbose1(ErgoHeapSizing,
                  "attempt heap expansion",
                  ergo_format_reason("allocation request failed")
-diff --git openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1PageBasedVirtualSpace.cpp openjdk/hotspot/src/share/vm/gc_implementation/g1/g1PageBasedVirtualSpace.cpp
---- openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1PageBasedVirtualSpace.cpp
-+++ openjdk/hotspot/src/share/vm/gc_implementation/g1/g1PageBasedVirtualSpace.cpp
-@@ -117,7 +117,7 @@
-   return reserved_size() - committed_size();
+diff -r 4689eaf1a5c9 src/share/vm/gc_implementation/g1/g1ConcurrentMarkObjArrayProcessor.cpp
+--- openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1ConcurrentMarkObjArrayProcessor.cpp	Mon Aug 31 07:09:56 2020 +0100
++++ openjdk/hotspot/src/share/vm/gc_implementation/g1/g1ConcurrentMarkObjArrayProcessor.cpp	Tue Sep 08 22:20:44 2020 -0400
+@@ -41,7 +41,7 @@
  }
  
--size_t G1PageBasedVirtualSpace::addr_to_page_index(char* addr) const {
-+uintptr_t G1PageBasedVirtualSpace::addr_to_page_index(char* addr) const {
-   return (addr - _low_boundary) / _page_size;
- }
+ size_t G1CMObjArrayProcessor::process_array_slice(objArrayOop obj, HeapWord* start_from, size_t remaining) {
+-  size_t words_to_scan = MIN2(remaining, ObjArrayMarkingStride);
++  size_t words_to_scan = MIN2(remaining, (size_t)ObjArrayMarkingStride);
  
-diff --git openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1StringDedupQueue.cpp openjdk/hotspot/src/share/vm/gc_implementation/g1/g1StringDedupQueue.cpp
---- openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1StringDedupQueue.cpp
-+++ openjdk/hotspot/src/share/vm/gc_implementation/g1/g1StringDedupQueue.cpp
+   if (remaining > ObjArrayMarkingStride) {
+     push_array_slice(start_from + ObjArrayMarkingStride);
+diff -r 4689eaf1a5c9 src/share/vm/gc_implementation/g1/g1PageBasedVirtualSpace.hpp
+--- openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1PageBasedVirtualSpace.hpp	Mon Aug 31 07:09:56 2020 +0100
++++ openjdk/hotspot/src/share/vm/gc_implementation/g1/g1PageBasedVirtualSpace.hpp	Tue Sep 08 22:20:44 2020 -0400
+@@ -89,7 +89,7 @@
+   void pretouch_internal(size_t start_page, size_t end_page);
+ 
+   // Returns the index of the page which contains the given address.
+-  uintptr_t  addr_to_page_index(char* addr) const;
++  size_t  addr_to_page_index(char* addr) const;
+   // Returns the address of the given page index.
+   char*  page_start(size_t index) const;
+ 
+diff -r 4689eaf1a5c9 src/share/vm/gc_implementation/g1/g1StringDedupQueue.cpp
+--- openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1StringDedupQueue.cpp	Mon Aug 31 07:09:56 2020 +0100
++++ openjdk/hotspot/src/share/vm/gc_implementation/g1/g1StringDedupQueue.cpp	Tue Sep 08 22:20:44 2020 -0400
 @@ -38,7 +38,7 @@
    _cancel(false),
    _empty(true),
@@ -97,9 +113,9 @@ diff --git openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1StringDedupQ
    _queues = NEW_C_HEAP_ARRAY(G1StringDedupWorkerQueue, _nqueues, mtGC);
    for (size_t i = 0; i < _nqueues; i++) {
      new (_queues + i) G1StringDedupWorkerQueue(G1StringDedupWorkerQueue::default_segment_size(), _max_cache_size, _max_size);
-diff --git openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1StringDedupTable.cpp openjdk/hotspot/src/share/vm/gc_implementation/g1/g1StringDedupTable.cpp
---- openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1StringDedupTable.cpp
-+++ openjdk/hotspot/src/share/vm/gc_implementation/g1/g1StringDedupTable.cpp
+diff -r 4689eaf1a5c9 src/share/vm/gc_implementation/g1/g1StringDedupTable.cpp
+--- openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1StringDedupTable.cpp	Mon Aug 31 07:09:56 2020 +0100
++++ openjdk/hotspot/src/share/vm/gc_implementation/g1/g1StringDedupTable.cpp	Tue Sep 08 22:20:44 2020 -0400
 @@ -120,7 +120,7 @@
  };
  
@@ -109,10 +125,10 @@ diff --git openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1StringDedupT
    _max_list_length(0),
    _cached(PaddedArray<G1StringDedupEntryList, mtGC>::create_unfreeable((uint)_nlists)),
    _overflowed(PaddedArray<G1StringDedupEntryList, mtGC>::create_unfreeable((uint)_nlists)) {
-diff --git openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/heapRegion.cpp openjdk/hotspot/src/share/vm/gc_implementation/g1/heapRegion.cpp
---- openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/heapRegion.cpp
-+++ openjdk/hotspot/src/share/vm/gc_implementation/g1/heapRegion.cpp
-@@ -109,7 +109,7 @@
+diff -r 4689eaf1a5c9 src/share/vm/gc_implementation/g1/heapRegion.cpp
+--- openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/heapRegion.cpp	Mon Aug 31 07:09:56 2020 +0100
++++ openjdk/hotspot/src/share/vm/gc_implementation/g1/heapRegion.cpp	Tue Sep 08 22:20:44 2020 -0400
+@@ -110,7 +110,7 @@
    if (FLAG_IS_DEFAULT(G1HeapRegionSize)) {
      size_t average_heap_size = (initial_heap_size + max_heap_size) / 2;
      region_size = MAX2(average_heap_size / HeapRegionBounds::target_number(),
@@ -121,9 +137,9 @@ diff --git openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/heapRegion.cpp
    }
  
    int region_size_log = log2_long((jlong) region_size);
-diff --git openjdk.orig/hotspot/src/share/vm/gc_implementation/parNew/parNewGeneration.cpp openjdk/hotspot/src/share/vm/gc_implementation/parNew/parNewGeneration.cpp
---- openjdk.orig/hotspot/src/share/vm/gc_implementation/parNew/parNewGeneration.cpp
-+++ openjdk/hotspot/src/share/vm/gc_implementation/parNew/parNewGeneration.cpp
+diff -r 4689eaf1a5c9 src/share/vm/gc_implementation/parNew/parNewGeneration.cpp
+--- openjdk.orig/hotspot/src/share/vm/gc_implementation/parNew/parNewGeneration.cpp	Mon Aug 31 07:09:56 2020 +0100
++++ openjdk/hotspot/src/share/vm/gc_implementation/parNew/parNewGeneration.cpp	Tue Sep 08 22:20:44 2020 -0400
 @@ -194,7 +194,7 @@
    const size_t num_overflow_elems = of_stack->size();
    const size_t space_available = queue->max_elems() - queue->size();
@@ -133,29 +149,27 @@ diff --git openjdk.orig/hotspot/src/share/vm/gc_implementation/parNew/parNewGene
                                       num_overflow_elems);
    // Transfer the most recent num_take_elems from the overflow
    // stack to our work queue.
-diff --git openjdk.orig/hotspot/src/share/vm/gc_implementation/parallelScavenge/psParallelCompact.cpp openjdk/hotspot/src/share/vm/gc_implementation/parallelScavenge/psParallelCompact.cpp
---- openjdk.orig/hotspot/src/share/vm/gc_implementation/parallelScavenge/psParallelCompact.cpp
-+++ openjdk/hotspot/src/share/vm/gc_implementation/parallelScavenge/psParallelCompact.cpp
-@@ -910,8 +910,8 @@
+diff -r 4689eaf1a5c9 src/share/vm/gc_implementation/parallelScavenge/psParallelCompact.cpp
+--- openjdk.orig/hotspot/src/share/vm/gc_implementation/parallelScavenge/psParallelCompact.cpp	Mon Aug 31 07:09:56 2020 +0100
++++ openjdk/hotspot/src/share/vm/gc_implementation/parallelScavenge/psParallelCompact.cpp	Tue Sep 08 22:20:44 2020 -0400
+@@ -912,7 +912,7 @@
+ 
  void PSParallelCompact::initialize_dead_wood_limiter()
  {
-   const size_t max = 100;
--  _dwl_mean = double(MIN2(ParallelOldDeadWoodLimiterMean, max)) / 100.0;
--  _dwl_std_dev = double(MIN2(ParallelOldDeadWoodLimiterStdDev, max)) / 100.0;
-+  _dwl_mean = double(MIN2((size_t)ParallelOldDeadWoodLimiterMean, max)) / 100.0;
-+  _dwl_std_dev = double(MIN2((size_t)ParallelOldDeadWoodLimiterStdDev, max)) / 100.0;
+-  const size_t max = 100;
++  const uintx max = 100;
+   _dwl_mean = double(MIN2(ParallelOldDeadWoodLimiterMean, max)) / 100.0;
+   _dwl_std_dev = double(MIN2(ParallelOldDeadWoodLimiterStdDev, max)) / 100.0;
    _dwl_first_term = 1.0 / (sqrt(2.0 * M_PI) * _dwl_std_dev);
-   DEBUG_ONLY(_dwl_initialized = true;)
-   _dwl_adjustment = normal_distribution(1.0);
-diff --git openjdk.orig/hotspot/src/share/vm/memory/collectorPolicy.cpp openjdk/hotspot/src/share/vm/memory/collectorPolicy.cpp
---- openjdk.orig/hotspot/src/share/vm/memory/collectorPolicy.cpp
-+++ openjdk/hotspot/src/share/vm/memory/collectorPolicy.cpp
+diff -r 4689eaf1a5c9 src/share/vm/memory/collectorPolicy.cpp
+--- openjdk.orig/hotspot/src/share/vm/memory/collectorPolicy.cpp	Mon Aug 31 07:09:56 2020 +0100
++++ openjdk/hotspot/src/share/vm/memory/collectorPolicy.cpp	Tue Sep 08 22:20:44 2020 -0400
 @@ -385,7 +385,7 @@
        uintx calculated_size = NewSize + OldSize;
        double shrink_factor = (double) MaxHeapSize / calculated_size;
        uintx smaller_new_size = align_size_down((uintx)(NewSize * shrink_factor), _gen_alignment);
 -      FLAG_SET_ERGO(uintx, NewSize, MAX2(young_gen_size_lower_bound(), smaller_new_size));
-+      FLAG_SET_ERGO(uintx, NewSize, MAX2(young_gen_size_lower_bound(), (size_t)smaller_new_size));
++      FLAG_SET_ERGO(uintx, NewSize, MAX2((uintx)young_gen_size_lower_bound(), smaller_new_size));
        _initial_gen0_size = NewSize;
  
        // OldSize is already aligned because above we aligned MaxHeapSize to
@@ -168,7 +182,7 @@ diff --git openjdk.orig/hotspot/src/share/vm/memory/collectorPolicy.cpp openjdk/
    }
    assert(max_new_size > 0, "All paths should set max_new_size");
  
-@@ -455,24 +455,23 @@
+@@ -455,23 +455,25 @@
        // lower limit.
        _min_gen0_size = NewSize;
        desired_new_size = NewSize;
@@ -190,15 +204,16 @@ diff --git openjdk.orig/hotspot/src/share/vm/memory/collectorPolicy.cpp openjdk/
        // NewRatio is overly large, the resulting sizes can be too
        // small.
 -      _min_gen0_size = MAX2(scale_by_NewRatio_aligned(_min_heap_byte_size), NewSize);
-+      _min_gen0_size = MAX2(scale_by_NewRatio_aligned(_min_heap_byte_size), (size_t)NewSize);
++      _min_gen0_size = MAX2(scale_by_NewRatio_aligned(_min_heap_byte_size),
++			    (size_t)NewSize);
        desired_new_size =
 -        MAX2(scale_by_NewRatio_aligned(_initial_heap_byte_size), NewSize);
--    }
-+        MAX2(scale_by_NewRatio_aligned(_initial_heap_byte_size), (size_t)NewSize);    }
++        MAX2(scale_by_NewRatio_aligned(_initial_heap_byte_size),
++	     (size_t)NewSize);
+     }
  
      assert(_min_gen0_size > 0, "Sanity check");
-     _initial_gen0_size = desired_new_size;
-@@ -573,7 +572,7 @@
+@@ -573,7 +575,7 @@
    } else {
      // It's been explicitly set on the command line.  Use the
      // OldSize and then determine the consequences.
@@ -207,9 +222,9 @@ diff --git openjdk.orig/hotspot/src/share/vm/memory/collectorPolicy.cpp openjdk/
      _initial_gen1_size = OldSize;
  
      // If the user has explicitly set an OldSize that is inconsistent
-diff --git openjdk.orig/hotspot/src/share/vm/memory/metaspace.cpp openjdk/hotspot/src/share/vm/memory/metaspace.cpp
---- openjdk.orig/hotspot/src/share/vm/memory/metaspace.cpp
-+++ openjdk/hotspot/src/share/vm/memory/metaspace.cpp
+diff -r 4689eaf1a5c9 src/share/vm/memory/metaspace.cpp
+--- openjdk.orig/hotspot/src/share/vm/memory/metaspace.cpp	Mon Aug 31 07:09:56 2020 +0100
++++ openjdk/hotspot/src/share/vm/memory/metaspace.cpp	Tue Sep 08 22:20:44 2020 -0400
 @@ -1482,7 +1482,7 @@
  
  void MetaspaceGC::post_initialize() {
@@ -237,38 +252,18 @@ diff --git openjdk.orig/hotspot/src/share/vm/memory/metaspace.cpp openjdk/hotspo
      if (PrintGCDetails && Verbose) {
        gclog_or_tty->print_cr("  "
                               "  maximum_free_percentage: %6.2f"
-@@ -3361,7 +3361,7 @@
+@@ -3320,7 +3320,7 @@
+     // Make the first class chunk bigger than a medium chunk so it's not put
      // on the medium chunk list.   The next chunk will be small and progress
      // from there.  This size calculated by -version.
-     _first_class_chunk_word_size = MIN2((size_t)MediumChunk*6,
--                                       (CompressedClassSpaceSize/BytesPerWord)*2);
-+                                       (size_t)(CompressedClassSpaceSize/BytesPerWord)*2);
+-    _first_class_chunk_word_size = MIN2((size_t)MediumChunk*6,
++    _first_class_chunk_word_size = MIN2((uintx)MediumChunk*6,
+                                        (CompressedClassSpaceSize/BytesPerWord)*2);
      _first_class_chunk_word_size = align_word_size_up(_first_class_chunk_word_size);
      // Arbitrarily set the initial virtual space to a multiple
-     // of the boot class loader size.
-diff --git openjdk.orig/hotspot/src/share/vm/memory/threadLocalAllocBuffer.cpp openjdk/hotspot/src/share/vm/memory/threadLocalAllocBuffer.cpp
---- openjdk.orig/hotspot/src/share/vm/memory/threadLocalAllocBuffer.cpp
-+++ openjdk/hotspot/src/share/vm/memory/threadLocalAllocBuffer.cpp
-@@ -250,13 +250,13 @@
-   size_t init_sz = 0;
- 
-   if (TLABSize > 0) {
--    init_sz = TLABSize / HeapWordSize;
-+    init_sz = (size_t)(TLABSize / HeapWordSize);
-   } else if (global_stats() != NULL) {
-     // Initial size is a function of the average number of allocating threads.
-     unsigned nof_threads = global_stats()->allocating_threads_avg();
- 
--    init_sz  = (Universe::heap()->tlab_capacity(myThread()) / HeapWordSize) /
--                      (nof_threads * target_refills());
-+    init_sz  = (size_t)((Universe::heap()->tlab_capacity(myThread()) / HeapWordSize) /
-+                      (nof_threads * target_refills()));
-     init_sz = align_object_size(init_sz);
-   }
-   init_sz = MIN2(MAX2(init_sz, min_size()), max_size());
-diff --git openjdk.orig/hotspot/src/share/vm/oops/objArrayKlass.inline.hpp openjdk/hotspot/src/share/vm/oops/objArrayKlass.inline.hpp
---- openjdk.orig/hotspot/src/share/vm/oops/objArrayKlass.inline.hpp
-+++ openjdk/hotspot/src/share/vm/oops/objArrayKlass.inline.hpp
+diff -r 4689eaf1a5c9 src/share/vm/oops/objArrayKlass.inline.hpp
+--- openjdk.orig/hotspot/src/share/vm/oops/objArrayKlass.inline.hpp	Mon Aug 31 07:09:56 2020 +0100
++++ openjdk/hotspot/src/share/vm/oops/objArrayKlass.inline.hpp	Tue Sep 08 22:20:44 2020 -0400
 @@ -48,7 +48,7 @@
    const size_t beg_index = size_t(index);
    assert(beg_index < len || len == 0, "index too large");
@@ -287,10 +282,10 @@ diff --git openjdk.orig/hotspot/src/share/vm/oops/objArrayKlass.inline.hpp openj
    const size_t end_index = beg_index + stride;
    T* const base = (T*)a->base();
    T* const beg = base + beg_index;
-diff --git openjdk.orig/hotspot/src/share/vm/runtime/arguments.cpp openjdk/hotspot/src/share/vm/runtime/arguments.cpp
---- openjdk.orig/hotspot/src/share/vm/runtime/arguments.cpp
-+++ openjdk/hotspot/src/share/vm/runtime/arguments.cpp
-@@ -1289,7 +1289,7 @@
+diff -r 4689eaf1a5c9 src/share/vm/runtime/arguments.cpp
+--- openjdk.orig/hotspot/src/share/vm/runtime/arguments.cpp	Mon Aug 31 07:09:56 2020 +0100
++++ openjdk/hotspot/src/share/vm/runtime/arguments.cpp	Tue Sep 08 22:20:44 2020 -0400
+@@ -1301,7 +1301,7 @@
      // NewSize was set on the command line and it is larger than
      // preferred_max_new_size.
      if (!FLAG_IS_DEFAULT(NewSize)) {   // NewSize explicitly set at command-line
@@ -299,7 +294,7 @@ diff --git openjdk.orig/hotspot/src/share/vm/runtime/arguments.cpp openjdk/hotsp
      } else {
        FLAG_SET_ERGO(uintx, MaxNewSize, preferred_max_new_size);
      }
-@@ -1314,8 +1314,8 @@
+@@ -1326,8 +1326,8 @@
        // Unless explicitly requested otherwise, make young gen
        // at least min_new, and at most preferred_max_new_size.
        if (FLAG_IS_DEFAULT(NewSize)) {
@@ -310,7 +305,7 @@ diff --git openjdk.orig/hotspot/src/share/vm/runtime/arguments.cpp openjdk/hotsp
          if (PrintGCDetails && Verbose) {
            // Too early to use gclog_or_tty
            tty->print_cr("CMS ergo set NewSize: " SIZE_FORMAT, NewSize);
-@@ -1325,7 +1325,7 @@
+@@ -1337,7 +1337,7 @@
        // so it's NewRatio x of NewSize.
        if (FLAG_IS_DEFAULT(OldSize)) {
          if (max_heap > NewSize) {
@@ -319,25 +314,15 @@ diff --git openjdk.orig/hotspot/src/share/vm/runtime/arguments.cpp openjdk/hotsp
            if (PrintGCDetails && Verbose) {
              // Too early to use gclog_or_tty
              tty->print_cr("CMS ergo set OldSize: " SIZE_FORMAT, OldSize);
-diff --git openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1ConcurrentMarkObjArrayProcessor.cpp openjdk/hotspot/src/share/vm/gc_implementation/g1/g1ConcurrentMarkObjArrayProcessor.cpp
---- openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1ConcurrentMarkObjArrayProcessor.cpp
-+++ openjdk/hotspot/src/share/vm/gc_implementation/g1/g1ConcurrentMarkObjArrayProcessor.cpp
-@@ -41,7 +41,7 @@
+diff -r 4689eaf1a5c9 src/share/vm/runtime/os.cpp
+--- openjdk.orig/hotspot/src/share/vm/runtime/os.cpp	Mon Aug 31 07:09:56 2020 +0100
++++ openjdk/hotspot/src/share/vm/runtime/os.cpp	Tue Sep 08 22:20:44 2020 -0400
+@@ -1272,7 +1272,7 @@
  }
  
- size_t G1CMObjArrayProcessor::process_array_slice(objArrayOop obj, HeapWord* start_from, size_t remaining) {
--  size_t words_to_scan = MIN2(remaining, ObjArrayMarkingStride);
-+  size_t words_to_scan = MIN2(remaining, (size_t) ObjArrayMarkingStride);
- 
-   if (remaining > ObjArrayMarkingStride) {
-     push_array_slice(start_from + ObjArrayMarkingStride);
-diff --git openjdk.orig/hotspot/src/share/vm/gc_implementation/shenandoah/shenandoahUtils.cpp openjdk/hotspot/src/share/vm/gc_implementation/shenandoah/shenandoahUtils.cpp
---- openjdk.orig/hotspot/src/share/vm/gc_implementation/shenandoah/shenandoahUtils.cpp
-+++ openjdk/hotspot/src/share/vm/gc_implementation/shenandoah/shenandoahUtils.cpp
-@@ -150,5 +150,5 @@
-     return value;
-   }
- 
--  return (size_t)1 << (log2_intptr(value) + 1);
-+  return (size_t)1 << (log2_intptr((uintptr_t) value) + 1);
- }
+ void os::set_memory_serialize_page(address page) {
+-  int count = log2_intptr(sizeof(class JavaThread)) - log2_int(64);
++  int count = log2_intptr((uintptr_t)sizeof(class JavaThread)) - log2_int(64);
+   _mem_serialize_page = (volatile int32_t *)page;
+   // We initialize the serialization page shift count here
+   // We assume a cache line size of 64 bytes

SOURCES/jdk8257794-remove_broken_assert.patch

@@ -0,0 +1,13 @@
+diff --git openjdk.orig/hotspot/src/share/vm/interpreter/bytecodeInterpreter.cpp openjdk/hotspot/src/share/vm/interpreter/bytecodeInterpreter.cpp
+--- openjdk.orig/hotspot/src/share/vm/interpreter/bytecodeInterpreter.cpp
++++ openjdk/hotspot/src/share/vm/interpreter/bytecodeInterpreter.cpp
+@@ -493,9 +493,6 @@
+       assert(labs(istate->_stack_base - istate->_stack_limit) == (istate->_method->max_stack() + extra_stack_entries
+                                                                                                + 1), "bad stack limit");
+     }
+-#ifndef SHARK
+-    IA32_ONLY(assert(istate->_stack_limit == istate->_thread->last_Java_sp() + 1, "wrong"));
+-#endif // !SHARK
+   }
+   // Verify linkages.
+   interpreterState l = istate;

SOURCES/jdk8281098-pr3836-pass_compiler_flags_to_adlc.patch

@@ -0,0 +1,67 @@
+# HG changeset patch
+# User Andrew John Hughes <gnu_andrew@member.fsf.org>
+# Date 1620365804 -3600
+#      Fri May 07 06:36:44 2021 +0100
+# Node ID 39b62f35eca823b4c9a98bc1dc0cb9acb87360f8
+# Parent  723b59ed1afe878c5cd35f080399c8ceec4f776b
+PR3836: Extra compiler flags not passed to adlc build
+
+diff --git openjdk.orig/hotspot/make/aix/makefiles/adlc.make openjdk/hotspot/make/aix/makefiles/adlc.make
+--- openjdk.orig/hotspot/make/aix/makefiles/adlc.make
++++ openjdk/hotspot/make/aix/makefiles/adlc.make
+@@ -69,6 +69,11 @@
+ CFLAGS_WARN = -w
+ CFLAGS += $(CFLAGS_WARN)
+ 
++# Extra flags from gnumake's invocation or environment
++CFLAGS += $(EXTRA_CFLAGS)
++LFLAGS += $(EXTRA_CFLAGS) $(EXTRA_LDFLAGS)
++ASFLAGS += $(EXTRA_ASFLAGS)
++
+ OBJECTNAMES = \
+ 	adlparse.o \
+ 	archDesc.o \
+diff --git openjdk.orig/hotspot/make/bsd/makefiles/adlc.make openjdk/hotspot/make/bsd/makefiles/adlc.make
+--- openjdk.orig/hotspot/make/bsd/makefiles/adlc.make
++++ openjdk/hotspot/make/bsd/makefiles/adlc.make
+@@ -71,6 +71,11 @@
+ endif
+ CFLAGS += $(CFLAGS_WARN)
+ 
++# Extra flags from gnumake's invocation or environment
++CFLAGS += $(EXTRA_CFLAGS)
++LFLAGS += $(EXTRA_CFLAGS) $(EXTRA_LDFLAGS)
++ASFLAGS += $(EXTRA_ASFLAGS)
++
+ OBJECTNAMES = \
+ 	adlparse.o \
+ 	archDesc.o \
+diff --git openjdk.orig/hotspot/make/linux/makefiles/adlc.make openjdk/hotspot/make/linux/makefiles/adlc.make
+--- openjdk.orig/hotspot/make/linux/makefiles/adlc.make
++++ openjdk/hotspot/make/linux/makefiles/adlc.make
+@@ -69,6 +69,11 @@
+ CFLAGS_WARN = $(WARNINGS_ARE_ERRORS)
+ CFLAGS += $(CFLAGS_WARN)
+ 
++# Extra flags from gnumake's invocation or environment
++CFLAGS += $(EXTRA_CFLAGS)
++LFLAGS += $(EXTRA_CFLAGS) $(EXTRA_LDFLAGS)
++ASFLAGS += $(EXTRA_ASFLAGS)
++
+ OBJECTNAMES = \
+ 	adlparse.o \
+ 	archDesc.o \
+diff --git openjdk.orig/hotspot/make/solaris/makefiles/adlc.make openjdk/hotspot/make/solaris/makefiles/adlc.make
+--- openjdk.orig/hotspot/make/solaris/makefiles/adlc.make
++++ openjdk/hotspot/make/solaris/makefiles/adlc.make
+@@ -85,6 +85,10 @@
+ endif
+ CFLAGS += $(CFLAGS_WARN)
+ 
++# Extra flags from gnumake's invocation or environment
++CFLAGS += $(EXTRA_CFLAGS)
++ASFLAGS += $(EXTRA_ASFLAGS)
++
+ ifeq ("${Platform_compiler}", "sparcWorks")
+ # Enable the following CFLAGS addition if you need to compare the
+ # built ELF objects.

SOURCES/nss.fips.cfg.in

@@ -1,6 +1,8 @@
 name = NSS-FIPS
 nssLibraryDirectory = @NSS_LIBDIR@
-nssSecmodDirectory = @NSS_SECMOD@
+nssSecmodDirectory = sql:/etc/pki/nssdb
 nssDbMode = readOnly
 nssModule = fips
 
+attributes(*,CKO_SECRET_KEY,CKK_GENERIC_SECRET)={ CKA_SIGN=true }
+

SOURCES/pr2462-resolve_disabled_warnings_for_libunpack_and_the_unpack200_binary.patch

@@ -7,10 +7,11 @@
 8074839: Resolve disabled warnings for libunpack and the unpack200 binary
 Reviewed-by: dholmes, ksrini
 
-diff --git openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/bytes.h openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/bytes.h
---- openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/bytes.h
+diff --git openjdk.orig/jdk/src/share/native/com/sun/java/util/jar/pack/bytes.h openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/bytes.h
+index bdaf95a2f6a..60c5b4f2a69 100644
+--- openjdk.orig/jdk/src/share/native/com/sun/java/util/jar/pack/bytes.h
 +++ openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/bytes.h
-@@ -63,7 +63,7 @@
+@@ -63,7 +63,7 @@ struct bytes {
      bytes res;
      res.ptr = ptr + beg;
      res.len = end - beg;
@@ -19,10 +20,11 @@ diff --git openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/bytes.h openj
      return res;
    }
    // building C strings inside byte buffers:
-diff --git openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/jni.cpp openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/jni.cpp
---- openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/jni.cpp
+diff --git openjdk.orig/jdk/src/share/native/com/sun/java/util/jar/pack/jni.cpp openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/jni.cpp
+index 5fbc7261fb3..4c002e779d8 100644
+--- openjdk.orig/jdk/src/share/native/com/sun/java/util/jar/pack/jni.cpp
 +++ openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/jni.cpp
-@@ -292,7 +292,7 @@
+@@ -292,7 +292,7 @@ Java_com_sun_java_util_jar_pack_NativeUnpack_getUnusedInput(JNIEnv *env, jobject
  
    if (uPtr->aborting()) {
      THROW_IOE(uPtr->get_abort_message());
@@ -31,16 +33,16 @@ diff --git openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/jni.cpp openj
    }
  
    // We have fetched all the files.
-@@ -310,7 +310,7 @@
- JNIEXPORT jlong JNICALL
- Java_com_sun_java_util_jar_pack_NativeUnpack_finish(JNIEnv *env, jobject pObj) {
-   unpacker* uPtr = get_unpacker(env, pObj, false);
+@@ -312,7 +312,7 @@ Java_com_sun_java_util_jar_pack_NativeUnpack_finish(JNIEnv *env, jobject pObj) {
+   // There's no need to create a new unpacker here if we don't already have one
+   // just to immediatly free it afterwards.
+   unpacker* uPtr = get_unpacker(env, pObj, /* noCreate= */ true);
 -  CHECK_EXCEPTION_RETURN_VALUE(uPtr, NULL);
 +  CHECK_EXCEPTION_RETURN_VALUE(uPtr, 0);
    size_t consumed = uPtr->input_consumed();
+   // free_unpacker() will set the unpacker field on 'pObj' to null
    free_unpacker(env, pObj, uPtr);
-   return consumed;
-@@ -320,6 +320,7 @@
+@@ -323,6 +323,7 @@ JNIEXPORT jboolean JNICALL
  Java_com_sun_java_util_jar_pack_NativeUnpack_setOption(JNIEnv *env, jobject pObj,
                                         jstring pProp, jstring pValue) {
    unpacker*   uPtr  = get_unpacker(env, pObj);
@@ -48,10 +50,11 @@ diff --git openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/jni.cpp openj
    const char* prop  = env->GetStringUTFChars(pProp, JNI_FALSE);
    CHECK_EXCEPTION_RETURN_VALUE(prop, false);
    const char* value = env->GetStringUTFChars(pValue, JNI_FALSE);
-diff --git openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/main.cpp openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/main.cpp
---- openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/main.cpp
+diff --git openjdk.orig/jdk/src/share/native/com/sun/java/util/jar/pack/main.cpp openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/main.cpp
+index 6fbc43a18ae..722c8baaff0 100644
+--- openjdk.orig/jdk/src/share/native/com/sun/java/util/jar/pack/main.cpp
 +++ openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/main.cpp
-@@ -142,31 +142,28 @@
+@@ -142,31 +142,28 @@ static const char* nbasename(const char* progname) {
    return progname;
  }
  
@@ -101,10 +104,11 @@ diff --git openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/main.cpp open
    }
  }
  
-diff --git openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.cpp openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.cpp
---- openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.cpp
+diff --git openjdk.orig/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.cpp openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.cpp
+index 56f391b1e87..f0a25f8cd20 100644
+--- openjdk.orig/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.cpp
 +++ openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.cpp
-@@ -222,9 +222,9 @@
+@@ -225,9 +225,9 @@ struct entry {
    }
  
  #ifdef PRODUCT
@@ -116,7 +120,7 @@ diff --git openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.cpp op
  #endif
  };
  
-@@ -715,13 +715,13 @@
+@@ -718,13 +718,13 @@ void unpacker::read_file_header() {
    // Now we can size the whole archive.
    // Read everything else into a mega-buffer.
    rp = hdr.rp;
@@ -134,7 +138,7 @@ diff --git openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.cpp op
        abort("EOF reading fixed input buffer");
        return;
      }
-@@ -735,7 +735,7 @@
+@@ -738,7 +738,7 @@ void unpacker::read_file_header() {
        return;
      }
      input.set(U_NEW(byte, add_size(header_size_0, archive_size, C_SLOP)),
@@ -143,7 +147,7 @@ diff --git openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.cpp op
      CHECK;
      assert(input.limit()[0] == 0);
      // Move all the bytes we read initially into the real buffer.
-@@ -958,13 +958,13 @@
+@@ -961,13 +961,13 @@ void cpool::init(unpacker* u_, int counts[CONSTANT_Limit]) {
    nentries = next_entry;
  
    // place a limit on future CP growth:
@@ -159,7 +163,7 @@ diff --git openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.cpp op
  
    // Note that this CP does not include "empty" entries
    // for longs and doubles.  Those are introduced when
-@@ -982,8 +982,9 @@
+@@ -985,8 +985,9 @@ void cpool::init(unpacker* u_, int counts[CONSTANT_Limit]) {
    }
  
    // Initialize *all* our entries once
@@ -170,7 +174,7 @@ diff --git openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.cpp op
  
    initGroupIndexes();
    // Initialize hashTab to a generous power-of-two size.
-@@ -3677,21 +3678,22 @@
+@@ -3681,21 +3682,22 @@ void cpool::computeOutputIndexes() {
  
  unpacker* debug_u;
  
@@ -197,7 +201,7 @@ diff --git openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.cpp op
    case CONSTANT_Signature:
      if (value.b.ptr == null)
        return ref(0)->string();
-@@ -3711,26 +3713,28 @@
+@@ -3715,26 +3717,28 @@ char* entry::string() {
      break;
    default:
      if (nrefs == 0) {
@@ -235,10 +239,11 @@ diff --git openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.cpp op
  }
  
  void print_cp_entries(int beg, int end) {
-diff --git openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.h openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.h
---- openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.h
+diff --git openjdk.orig/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.h openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.h
+index cec7a88b24e..ed5f3336a59 100644
+--- openjdk.orig/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.h
 +++ openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.h
-@@ -209,7 +209,7 @@
+@@ -209,7 +209,7 @@ struct unpacker {
    byte*     rp;          // read pointer (< rplimit <= input.limit())
    byte*     rplimit;     // how much of the input block has been read?
    julong    bytes_read;
@@ -247,10 +252,11 @@ diff --git openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.h open
  
    // callback to read at least one byte, up to available input
    typedef jlong (*read_input_fn_t)(unpacker* self, void* buf, jlong minlen, jlong maxlen);
-diff --git openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/utils.cpp openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/utils.cpp
---- openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/utils.cpp
+diff --git openjdk.orig/jdk/src/share/native/com/sun/java/util/jar/pack/utils.cpp openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/utils.cpp
+index e5197e1a3f1..40a10055ea5 100644
+--- openjdk.orig/jdk/src/share/native/com/sun/java/util/jar/pack/utils.cpp
 +++ openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/utils.cpp
-@@ -81,7 +81,7 @@
+@@ -81,7 +81,7 @@ void breakpoint() { }  // hook for debugger
  int assert_failed(const char* p) {
    char message[1<<12];
    sprintf(message, "@assert failed: %s\n", p);
@@ -259,10 +265,11 @@ diff --git openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/utils.cpp ope
    breakpoint();
    unpack_abort(message);
    return 0;
-diff --git openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/zip.cpp openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/zip.cpp
---- openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/zip.cpp
+diff --git openjdk.orig/jdk/src/share/native/com/sun/java/util/jar/pack/zip.cpp openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/zip.cpp
+index f58c94956c0..343da3e183b 100644
+--- openjdk.orig/jdk/src/share/native/com/sun/java/util/jar/pack/zip.cpp
 +++ openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/zip.cpp
-@@ -84,7 +84,7 @@
+@@ -84,7 +84,7 @@ void jar::init(unpacker* u_) {
  }
  
  // Write data to the ZIP output stream.
@@ -271,7 +278,7 @@ diff --git openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/zip.cpp openj
    while (len > 0) {
      int rc = (int)fwrite(buff, 1, len, jarfp);
      if (rc <= 0) {
-@@ -323,12 +323,12 @@
+@@ -323,12 +323,12 @@ void jar::write_central_directory() {
      // Total number of disks (int)
      header64[36] = (ushort)SWAP_BYTES(1);
      header64[37] = 0;
@@ -286,10 +293,11 @@ diff --git openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/zip.cpp openj
  
    PRINTCR((2, "writing zip comment\n"));
    // Write the comment.
-diff --git openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/zip.h openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/zip.h
---- openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/zip.h
+diff --git openjdk.orig/jdk/src/share/native/com/sun/java/util/jar/pack/zip.h openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/zip.h
+index 14ffc9d65bd..9877f6f68ca 100644
+--- openjdk.orig/jdk/src/share/native/com/sun/java/util/jar/pack/zip.h
 +++ openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/zip.h
-@@ -68,8 +68,8 @@
+@@ -68,8 +68,8 @@ struct jar {
    }
  
    // Private Methods

SOURCES/pr2888-openjdk_should_check_for_system_cacerts_database_eg_etc_pki_java_cacerts.patch

@@ -1,63 +0,0 @@
-# HG changeset patch
-# User andrew
-# Date 1459487045 -3600
-#      Fri Apr 01 06:04:05 2016 +0100
-# Node ID 3334efeacd8327a14b7d2f392f4546e3c29c594b
-# Parent  6b81fd2227d14226f2121f2d51b464536925686e
-PR2888: OpenJDK should check for system cacerts database (e.g. /etc/pki/java/cacerts)
-PR3575: System cacerts database handling should not affect jssecacerts
-
-diff --git openjdk.orig/jdk/src/share/classes/sun/security/ssl/TrustStoreManager.java openjdk/jdk/src/share/classes/sun/security/ssl/TrustStoreManager.java
---- openjdk.orig/jdk/src/share/classes/sun/security/ssl/TrustStoreManager.java
-+++ openjdk/jdk/src/share/classes/sun/security/ssl/TrustStoreManager.java
-@@ -72,7 +72,7 @@
-      * The preference of the default trusted KeyStore is:
-      *    javax.net.ssl.trustStore
-      *    jssecacerts
--     *    cacerts
-+     *    cacerts (system and local)
-      */
-     private static final class TrustStoreDescriptor {
-         private static final String fileSep = File.separator;
-@@ -83,6 +83,10 @@
-                 defaultStorePath + fileSep + "cacerts";
-         private static final String jsseDefaultStore =
-                 defaultStorePath + fileSep + "jssecacerts";
-+        /* Check system cacerts DB: /etc/pki/java/cacerts */
-+        private static final String systemStore =
-+                fileSep + "etc" + fileSep + "pki" +
-+                fileSep + "java" + fileSep + "cacerts";
- 
-         // the trust store name
-         private final String storeName;
-@@ -146,7 +150,8 @@
-                     long temporaryTime = 0L;
-                     if (!"NONE".equals(storePropName)) {
-                         String[] fileNames =
--                                new String[] {storePropName, defaultStore};
-+                                new String[] {storePropName,
-+                                              systemStore, defaultStore};
-                         for (String fileName : fileNames) {
-                             File f = new File(fileName);
-                             if (f.isFile() && f.canRead()) {
-diff --git openjdk.orig/jdk/src/share/classes/sun/security/tools/KeyStoreUtil.java openjdk/jdk/src/share/classes/sun/security/tools/KeyStoreUtil.java
---- openjdk.orig/jdk/src/share/classes/sun/security/tools/KeyStoreUtil.java
-+++ openjdk/jdk/src/share/classes/sun/security/tools/KeyStoreUtil.java
-@@ -108,9 +108,14 @@
-         throws Exception
-     {
-         String sep = File.separator;
--        File file = new File(System.getProperty("java.home") + sep
--                             + "lib" + sep + "security" + sep
--                             + "cacerts");
-+        /* Check system cacerts DB first; /etc/pki/java/cacerts */
-+        File file = new File(sep + "etc" + sep + "pki" + sep
-+                             + "java" + sep + "cacerts");
-+        if (!file.exists()) {
-+            file = new File(System.getProperty("java.home") + sep
-+                            + "lib" + sep + "security" + sep
-+                            + "cacerts");
-+        }
-         if (!file.exists()) {
-             return null;
-         }

SOURCES/pr2888-rh2055274-support_system_cacerts-8139f2361c2.patch

@@ -0,0 +1,193 @@
+diff --git a/jdk/src/share/classes/sun/security/ssl/TrustStoreManager.java b/jdk/src/share/classes/sun/security/ssl/TrustStoreManager.java
+index e7b4763db53..0005e56f528 100644
+--- a/jdk/src/share/classes/sun/security/ssl/TrustStoreManager.java
++++ b/jdk/src/share/classes/sun/security/ssl/TrustStoreManager.java
+@@ -31,6 +31,7 @@ import java.security.*;
+ import java.security.cert.*;
+ import java.util.*;
+ import sun.security.action.*;
++import sun.security.tools.KeyStoreUtil;
+ import sun.security.validator.TrustStoreUtil;
+ 
+ /**
+@@ -68,7 +69,7 @@ final class TrustStoreManager {
+      * The preference of the default trusted KeyStore is:
+      *    javax.net.ssl.trustStore
+      *    jssecacerts
+-     *    cacerts
++     *    cacerts (system and local)
+      */
+     private static final class TrustStoreDescriptor {
+         private static final String fileSep = File.separator;
+@@ -76,7 +77,8 @@ final class TrustStoreManager {
+                 GetPropertyAction.privilegedGetProperty("java.home") +
+                 fileSep + "lib" + fileSep + "security";
+         private static final String defaultStore =
+-                defaultStorePath + fileSep + "cacerts";
++                AccessController.doPrivileged((PrivilegedAction<String>) () ->
++                        KeyStoreUtil.getCacertsKeyStorePath());
+         private static final String jsseDefaultStore =
+                 defaultStorePath + fileSep + "jssecacerts";
+ 
+@@ -139,6 +141,10 @@ final class TrustStoreManager {
+                     String storePropPassword = System.getProperty(
+                             "javax.net.ssl.trustStorePassword", "");
+ 
++                    if (SSLLogger.isOn && SSLLogger.isOn("trustmanager")) {
++                        SSLLogger.fine("Default store: " + defaultStore);
++                    }
++
+                     String temporaryName = "";
+                     File temporaryFile = null;
+                     long temporaryTime = 0L;
+@@ -160,7 +166,7 @@ final class TrustStoreManager {
+                                     SSLLogger.isOn("trustmanager")) {
+                                 SSLLogger.fine(
+                                         "Inaccessible trust store: " +
+-                                        storePropName);
++                                        fileName);
+                             }
+                         }
+                     } else {
+diff --git a/jdk/src/share/classes/sun/security/tools/KeyStoreUtil.java b/jdk/src/share/classes/sun/security/tools/KeyStoreUtil.java
+index fcc77786da1..3a4388964cc 100644
+--- a/jdk/src/share/classes/sun/security/tools/KeyStoreUtil.java
++++ b/jdk/src/share/classes/sun/security/tools/KeyStoreUtil.java
+@@ -41,6 +41,8 @@ import java.text.Collator;
+ import java.util.Locale;
+ import java.util.ResourceBundle;
+ 
++import sun.security.util.SecurityProperties;
++
+ /**
+  * <p> This class provides several utilities to <code>KeyStore</code>.
+  *
+@@ -54,6 +56,8 @@ public class KeyStoreUtil {
+ 
+     private static final String JKS = "jks";
+ 
++    private static final String SYSTEM_CA_CERTS_PROP = "security.systemCACerts";
++
+     /**
+      * Returns true if the certificate is self-signed, false otherwise.
+      */
+@@ -96,16 +100,30 @@ public class KeyStoreUtil {
+         }
+     }
+ 
++    /**
++     * Returns the path to the cacerts DB
++     */
++    public static String getCacertsKeyStorePath()
++    {
++        // Check system DB first, preferring system property over security one
++        String systemDB = SecurityProperties
++                .privilegedGetOverridable(SYSTEM_CA_CERTS_PROP);
++        if (systemDB != null && !"".equals(systemDB) &&
++                (new File(systemDB)).isFile()) {
++            return systemDB;
++        }
++        String sep = File.separator;
++        return System.getProperty("java.home") + sep
++                + "lib" + sep + "security" + sep + "cacerts";
++    }
++
+     /**
+      * Returns the keystore with the configured CA certificates.
+      */
+     public static KeyStore getCacertsKeyStore()
+         throws Exception
+     {
+-        String sep = File.separator;
+-        File file = new File(System.getProperty("java.home") + sep
+-                             + "lib" + sep + "security" + sep
+-                             + "cacerts");
++        File file = new File(getCacertsKeyStorePath());
+         if (!file.exists()) {
+             return null;
+         }
+diff --git a/jdk/src/share/lib/security/java.security-aix b/jdk/src/share/lib/security/java.security-aix
+index 681a24b905d..ecb8bc43a6c 100644
+--- a/jdk/src/share/lib/security/java.security-aix
++++ b/jdk/src/share/lib/security/java.security-aix
+@@ -294,6 +294,12 @@ security.overridePropertiesFile=true
+ #
+ security.useSystemPropertiesFile=false
+ 
++#
++# Specifies the system certificate store
++# This property may be disabled using an empty value
++#
++security.systemCACerts=${java.home}/lib/security/cacerts
++
+ #
+ # Determines the default key and trust manager factory algorithms for
+ # the javax.net.ssl package.
+diff --git a/jdk/src/share/lib/security/java.security-linux b/jdk/src/share/lib/security/java.security-linux
+index 789c19a8cba..2546fdec9b2 100644
+--- a/jdk/src/share/lib/security/java.security-linux
++++ b/jdk/src/share/lib/security/java.security-linux
+@@ -307,6 +307,12 @@ security.overridePropertiesFile=true
+ #
+ security.useSystemPropertiesFile=false
+ 
++#
++# Specifies the system certificate store
++# This property may be disabled using an empty value
++#
++security.systemCACerts=${java.home}/lib/security/cacerts
++
+ #
+ # Determines the default key and trust manager factory algorithms for
+ # the javax.net.ssl package.
+diff --git a/jdk/src/share/lib/security/java.security-macosx b/jdk/src/share/lib/security/java.security-macosx
+index d4da666af3b..1a20027c02b 100644
+--- a/jdk/src/share/lib/security/java.security-macosx
++++ b/jdk/src/share/lib/security/java.security-macosx
+@@ -297,6 +297,12 @@ security.overridePropertiesFile=true
+ #
+ security.useSystemPropertiesFile=false
+ 
++#
++# Specifies the system certificate store
++# This property may be disabled using an empty value
++#
++security.systemCACerts=${java.home}/lib/security/cacerts
++
+ #
+ # Determines the default key and trust manager factory algorithms for
+ # the javax.net.ssl package.
+diff --git a/jdk/src/share/lib/security/java.security-solaris b/jdk/src/share/lib/security/java.security-solaris
+index 300132384a1..6299e0a3c7b 100644
+--- a/jdk/src/share/lib/security/java.security-solaris
++++ b/jdk/src/share/lib/security/java.security-solaris
+@@ -295,6 +295,12 @@ security.overridePropertiesFile=true
+ #
+ security.useSystemPropertiesFile=false
+ 
++#
++# Specifies the system certificate store
++# This property may be disabled using an empty value
++#
++security.systemCACerts=${java.home}/lib/security/cacerts
++
+ #
+ # Determines the default key and trust manager factory algorithms for
+ # the javax.net.ssl package.
+diff --git a/jdk/src/share/lib/security/java.security-windows b/jdk/src/share/lib/security/java.security-windows
+index 64db5a5cd1e..823994f3466 100644
+--- a/jdk/src/share/lib/security/java.security-windows
++++ b/jdk/src/share/lib/security/java.security-windows
+@@ -297,6 +297,12 @@ security.overridePropertiesFile=true
+ #
+ security.useSystemPropertiesFile=false
+ 
++#
++# Specifies the system certificate store
++# This property may be disabled using an empty value
++#
++security.systemCACerts=${java.home}/lib/security/cacerts
++
+ #
+ # Determines the default key and trust manager factory algorithms for
+ # the javax.net.ssl package.

SOURCES/pr3183-rh1340845-support_fedora_rhel_system_crypto_policy.patch

@@ -1,158 +0,0 @@
-
-# HG changeset patch
-# User andrew
-# Date 1478057514 0
-# Node ID 1c4d5cb2096ae55106111da200b0bcad304f650c
-# Parent  3d53f19b48384e5252f4ec8891f7a3a82d77af2a
-PR3183: Support Fedora/RHEL system crypto policy
-
-diff -r 3d53f19b4838 -r 1c4d5cb2096a src/share/classes/java/security/Security.java
---- openjdk/jdk/src/share/classes/java/security/Security.java	Wed Oct 26 03:51:39 2016 +0100
-+++ openjdk/jdk/src/share/classes/java/security/Security.java	Wed Nov 02 03:31:54 2016 +0000
-@@ -43,6 +43,9 @@
-  * implementation-specific location, which is typically the properties file
-  * {@code lib/security/java.security} in the Java installation directory.
-  *
-+ * <p>Additional default values of security properties are read from a
-+ * system-specific location, if available.</p>
-+ *
-  * @author Benjamin Renaud
-  */
- 
-@@ -52,6 +55,10 @@
-     private static final Debug sdebug =
-                         Debug.getInstance("properties");
- 
-+    /* System property file*/
-+    private static final String SYSTEM_PROPERTIES =
-+        "/etc/crypto-policies/back-ends/java.config";
-+
-     /* The java.security properties */
-     private static Properties props;
- 
-@@ -93,6 +100,7 @@
-                 if (sdebug != null) {
-                     sdebug.println("reading security properties file: " +
-                                 propFile);
-+                    sdebug.println(props.toString());
-                 }
-             } catch (IOException e) {
-                 if (sdebug != null) {
-@@ -114,6 +122,31 @@
-         }
- 
-         if ("true".equalsIgnoreCase(props.getProperty
-+                ("security.useSystemPropertiesFile"))) {
-+
-+            // now load the system file, if it exists, so its values
-+            // will win if they conflict with the earlier values
-+            try (BufferedInputStream bis =
-+                 new BufferedInputStream(new FileInputStream(SYSTEM_PROPERTIES))) {
-+                props.load(bis);
-+                loadedProps = true;
-+
-+                if (sdebug != null) {
-+                    sdebug.println("reading system security properties file " +
-+                                   SYSTEM_PROPERTIES);
-+                    sdebug.println(props.toString());
-+                }
-+            } catch (IOException e) {
-+                if (sdebug != null) {
-+                    sdebug.println
-+                        ("unable to load security properties from " +
-+                         SYSTEM_PROPERTIES);
-+                    e.printStackTrace();
-+                }
-+            }
-+        }
-+
-+        if ("true".equalsIgnoreCase(props.getProperty
-                 ("security.overridePropertiesFile"))) {
- 
-             String extraPropFile = System.getProperty
-diff -r 3d53f19b4838 -r 1c4d5cb2096a src/share/lib/security/java.security-aix
---- openjdk/jdk/src/share/lib/security/java.security-aix	Wed Oct 26 03:51:39 2016 +0100
-+++ openjdk/jdk/src/share/lib/security/java.security-aix	Wed Nov 02 03:31:54 2016 +0000
-@@ -276,6 +276,13 @@
- security.overridePropertiesFile=true
- 
- #
-+# Determines whether this properties file will be appended to
-+# using the system properties file stored at
-+# /etc/crypto-policies/back-ends/java.config
-+#
-+security.useSystemPropertiesFile=false
-+
-+#
- # Determines the default key and trust manager factory algorithms for
- # the javax.net.ssl package.
- #
-diff -r 3d53f19b4838 -r 1c4d5cb2096a src/share/lib/security/java.security-linux
---- openjdk/jdk/src/share/lib/security/java.security-linux	Wed Oct 26 03:51:39 2016 +0100
-+++ openjdk/jdk/src/share/lib/security/java.security-linux	Wed Nov 02 03:31:54 2016 +0000
-@@ -276,6 +276,13 @@
- security.overridePropertiesFile=true
- 
- #
-+# Determines whether this properties file will be appended to
-+# using the system properties file stored at
-+# /etc/crypto-policies/back-ends/java.config
-+#
-+security.useSystemPropertiesFile=true
-+
-+#
- # Determines the default key and trust manager factory algorithms for
- # the javax.net.ssl package.
- #
-diff -r 3d53f19b4838 -r 1c4d5cb2096a src/share/lib/security/java.security-macosx
---- openjdk/jdk/src/share/lib/security/java.security-macosx	Wed Oct 26 03:51:39 2016 +0100
-+++ openjdk/jdk/src/share/lib/security/java.security-macosx	Wed Nov 02 03:31:54 2016 +0000
-@@ -279,6 +279,13 @@
- security.overridePropertiesFile=true
- 
- #
-+# Determines whether this properties file will be appended to
-+# using the system properties file stored at
-+# /etc/crypto-policies/back-ends/java.config
-+#
-+security.useSystemPropertiesFile=false
-+
-+#
- # Determines the default key and trust manager factory algorithms for
- # the javax.net.ssl package.
- #
-diff -r 3d53f19b4838 -r 1c4d5cb2096a src/share/lib/security/java.security-solaris
---- openjdk/jdk/src/share/lib/security/java.security-solaris	Wed Oct 26 03:51:39 2016 +0100
-+++ openjdk/jdk/src/share/lib/security/java.security-solaris	Wed Nov 02 03:31:54 2016 +0000
-@@ -278,6 +278,13 @@
- security.overridePropertiesFile=true
- 
- #
-+# Determines whether this properties file will be appended to
-+# using the system properties file stored at
-+# /etc/crypto-policies/back-ends/java.config
-+#
-+security.useSystemPropertiesFile=false
-+
-+#
- # Determines the default key and trust manager factory algorithms for
- # the javax.net.ssl package.
- #
-diff -r 3d53f19b4838 -r 1c4d5cb2096a src/share/lib/security/java.security-windows
---- openjdk/jdk/src/share/lib/security/java.security-windows	Wed Oct 26 03:51:39 2016 +0100
-+++ openjdk/jdk/src/share/lib/security/java.security-windows	Wed Nov 02 03:31:54 2016 +0000
-@@ -279,6 +279,13 @@
- security.overridePropertiesFile=true
- 
- #
-+# Determines whether this properties file will be appended to
-+# using the system properties file stored at
-+# /etc/crypto-policies/back-ends/java.config
-+#
-+security.useSystemPropertiesFile=false
-+
-+#
- # Determines the default key and trust manager factory algorithms for
- # the javax.net.ssl package.
- #
-

SOURCES/pr3593-s390_use_z_format_specifier_for_size_t_arguments_as_size_t_not_equals_to_int.patch

@@ -141,3 +141,26 @@ diff --git openjdk.orig/hotspot/src/share/vm/utilities/globalDefinitions.hpp ope
  
  #define INTX_FORMAT           "%" PRIdPTR
  #define UINTX_FORMAT          "%" PRIuPTR
+diff --git openjdk.orig/hotspot/src/share/vm/runtime/memprofiler.cpp openjdk/hotspot/src/share/vm/runtime/memprofiler.cpp
+--- openjdk.orig/hotspot/src/share/vm/runtime/memprofiler.cpp
++++ openjdk/hotspot/src/share/vm/runtime/memprofiler.cpp
+@@ -117,16 +117,16 @@
+   }
+ 
+   // Print trace line in log
+-  fprintf(_log_fp, "%6.1f,%5d,%5d," UINTX_FORMAT_W(6) "," UINTX_FORMAT_W(6) ",",
++  fprintf(_log_fp, "%6.1f,%5d,%5d," SIZE_FORMAT_W(6) "," SIZE_FORMAT_W(6) ",",
+           os::elapsedTime(),
+           Threads::number_of_threads(),
+           SystemDictionary::number_of_classes(),
+           Universe::heap()->used() / K,
+           Universe::heap()->capacity() / K);
+ 
+-  fprintf(_log_fp, UINTX_FORMAT_W(6) ",", CodeCache::capacity() / K);
++  fprintf(_log_fp, SIZE_FORMAT_W(6) ",", CodeCache::capacity() / K);
+ 
+-  fprintf(_log_fp, UINTX_FORMAT_W(6) "," UINTX_FORMAT_W(6) "," UINTX_FORMAT_W(6) "\n",
++  fprintf(_log_fp, SIZE_FORMAT_W(6) "," SIZE_FORMAT_W(6) "," SIZE_FORMAT_W(6) "\n",
+           handles_memory_usage / K,
+           resource_memory_usage / K,
+           OopMapCache::memory_usage() / K);

SOURCES/pr3655-toggle_system_crypto_policy.patch

@@ -1,78 +0,0 @@
-# HG changeset patch
-# User andrew
-# Date 1545198926 0
-#      Wed Dec 19 05:55:26 2018 +0000
-# Node ID f2cbd688824c128db7fa848c8732fb0ab3507776
-# Parent  81f07f6d1f8b7b51b136d3974c61bc8bb513770c
-PR3655: Allow use of system crypto policy to be disabled by the user
-Summary: Read user overrides first so security.useSystemPropertiesFile can be disabled and add -Djava.security.disableSystemPropertiesFile
-
-diff --git a/src/share/classes/javopenjdk.orig/jdk/security/Security.java openjdk/jdk/src/share/classes/java/security/Security.java
---- openjdk.orig/jdk/src/share/classes/java/security/Security.java
-+++ openjdk/jdk/src/share/classes/java/security/Security.java
-@@ -122,31 +122,6 @@
-         }
- 
-         if ("true".equalsIgnoreCase(props.getProperty
--                ("security.useSystemPropertiesFile"))) {
--
--            // now load the system file, if it exists, so its values
--            // will win if they conflict with the earlier values
--            try (BufferedInputStream bis =
--                 new BufferedInputStream(new FileInputStream(SYSTEM_PROPERTIES))) {
--                props.load(bis);
--                loadedProps = true;
--
--                if (sdebug != null) {
--                    sdebug.println("reading system security properties file " +
--                                   SYSTEM_PROPERTIES);
--                    sdebug.println(props.toString());
--                }
--            } catch (IOException e) {
--                if (sdebug != null) {
--                    sdebug.println
--                        ("unable to load security properties from " +
--                         SYSTEM_PROPERTIES);
--                    e.printStackTrace();
--                }
--            }
--        }
--
--        if ("true".equalsIgnoreCase(props.getProperty
-                 ("security.overridePropertiesFile"))) {
- 
-             String extraPropFile = System.getProperty
-@@ -212,6 +187,33 @@
-             }
-         }
- 
-+        String disableSystemProps = System.getProperty("java.security.disableSystemPropertiesFile");
-+        if (disableSystemProps == null &&
-+            "true".equalsIgnoreCase(props.getProperty
-+                ("security.useSystemPropertiesFile"))) {
-+
-+            // now load the system file, if it exists, so its values
-+            // will win if they conflict with the earlier values
-+            try (BufferedInputStream bis =
-+                 new BufferedInputStream(new FileInputStream(SYSTEM_PROPERTIES))) {
-+                props.load(bis);
-+                loadedProps = true;
-+
-+                if (sdebug != null) {
-+                    sdebug.println("reading system security properties file " +
-+                                   SYSTEM_PROPERTIES);
-+                    sdebug.println(props.toString());
-+                }
-+            } catch (IOException e) {
-+                if (sdebug != null) {
-+                    sdebug.println
-+                        ("unable to load security properties from " +
-+                         SYSTEM_PROPERTIES);
-+                    e.printStackTrace();
-+                }
-+            }
-+        }
-+
-         if (!loadedProps) {
-             initializeStatic();
-             if (sdebug != null) {

SOURCES/repackReproduciblePolycies.sh

@@ -17,7 +17,7 @@ fi
 d=`mktemp -d`
 NW=$d/$f
   pushd $d
-    jar  xf   $ORIG
+    unzip $ORIG
     cat $M
 #    sed -i "s/Created-By.*/Created-By: 1.7.0/g"  $M
     sed -i "s/Created-By.*/Created-By: $2/g"  $M

SOURCES/rh1163501-increase_2048_bit_dh_upper_bound_fedora_infrastructure_in_dhparametergenerator.patch

@@ -1,66 +0,0 @@
-diff --git a/src/share/classes/com/sun/crypto/provider/DHParameterGenerator.java b/src/share/classes/com/sun/crypto/provider/DHParameterGenerator.java
---- openjdk/jdk/src/share/classes/com/sun/crypto/provider/DHParameterGenerator.java
-+++ openjdk/jdk/src/share/classes/com/sun/crypto/provider/DHParameterGenerator.java
-@@ -1,5 +1,6 @@
- /*
-  * Copyright (c) 1997, 2017, Oracle and/or its affiliates. All rights reserved.
-+ * Copyright (c) 2014 Red Hat Inc.
-  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
-  *
-  * This code is free software; you can redistribute it and/or modify it
-@@ -61,13 +62,13 @@
- 
-     private static void checkKeySize(int keysize)
-             throws InvalidParameterException {
--        boolean supported = ((keysize == 2048) || (keysize == 3072) ||
-+        boolean supported = ((keysize == 2048) || (keysize == 3072) || (keysize == 4096) ||
-             ((keysize >= 512) && (keysize <= 1024) && ((keysize & 0x3F) == 0)));
- 
-         if (!supported) {
-             throw new InvalidParameterException(
-                     "DH key size must be multiple of 64 and range " +
--                    "from 512 to 1024 (inclusive), or 2048, 3072. " +
-+                    "from 512 to 1024 (inclusive), or 2048, 3072, 4096. " +
-                     "The specific key size " + keysize + " is not supported");
-         }
-     }
-diff --git a/test/com/sun/crypto/provider/KeyAgreement/TestExponentSize.java b/test/com/sun/crypto/provider/KeyAgreement/TestExponentSize.java
---- openjdk/jdk/test/com/sun/crypto/provider/KeyAgreement/TestExponentSize.java
-+++ openjdk/jdk/test/com/sun/crypto/provider/KeyAgreement/TestExponentSize.java
-@@ -1,5 +1,6 @@
- /*
-  * Copyright (c) 2005, 2017, Oracle and/or its affiliates. All rights reserved.
-+ * Copyright (c) 2014 Red Hat Inc.
-  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
-  *
-  * This code is free software; you can redistribute it and/or modify it
-@@ -58,7 +59,7 @@
-      */
-     private enum Sizes {
-         two56(256), three84(384), five12(512), seven68(768), ten24(1024),
--        twenty48(2048);
-+        twenty48(2048), forty96(4096);
- 
-         private final int intSize;
-         private final BigInteger bigIntValue;
-@@ -130,6 +131,19 @@
-         kp = kpg.generateKeyPair();
-         checkKeyPair(kp, Sizes.twenty48, Sizes.five12);
- 
-+        kpg.initialize(Sizes.forty96.getIntSize());
-+        kp = kpg.generateKeyPair();
-+        checkKeyPair(kp, Sizes.forty96, Sizes.twenty48);
-+
-+        publicKey = (DHPublicKey)kp.getPublic();
-+        p = publicKey.getParams().getP();
-+        g = publicKey.getParams().getG();
-+
-+        // test w/ all values specified
-+        kpg.initialize(new DHParameterSpec(p, g, Sizes.ten24.getIntSize()));
-+        kp = kpg.generateKeyPair();
-+        checkKeyPair(kp, Sizes.forty96, Sizes.ten24);
-+
-         System.out.println("OK");
-     }
- 
-

SOURCES/rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch

@@ -1,11 +1,12 @@
-diff -r 5b86f66575b7 src/share/lib/security/java.security-linux
---- openjdk/jdk/src/share/lib/security/java.security-linux	Tue May 16 13:29:05 2017 -0700
-+++ openjdk/jdk/src/share/lib/security/java.security-linux	Tue Jun 06 14:05:12 2017 +0200
-@@ -74,6 +74,7 @@
+diff --git a/jdk/src/share/lib/security/java.security-linux b/jdk/src/share/lib/security/java.security-linux
+index 9d1c8fe8a8e..a80a3c12abb 100644
+--- a/jdk/src/share/lib/security/java.security-linux
++++ b/jdk/src/share/lib/security/java.security-linux
+@@ -74,6 +74,7 @@ security.provider.6=sun.security.jgss.SunProvider
  security.provider.7=com.sun.security.sasl.Provider
  security.provider.8=org.jcp.xml.dsig.internal.dom.XMLDSigRI
  security.provider.9=sun.security.smartcardio.SunPCSC
 +#security.provider.10=sun.security.pkcs11.SunPKCS11 ${java.home}/lib/security/nss.cfg
  
  #
- # Sun Provider SecureRandom seed source.
+ # Security providers used when FIPS mode support is active

SOURCES/rh1648644-java_access_bridge_privileged_security.patch

@@ -1,25 +0,0 @@
-diff --git openjdk.orig/jdk/src/share/lib/security/java.security-linux openjdk/jdk/src/share/lib/security/java.security-linux
---- openjdk.orig/jdk/src/share/lib/security/java.security-linux
-+++ openjdk/jdk/src/share/lib/security/java.security-linux
-@@ -226,7 +226,9 @@
-                com.sun.activation.registries.,\
-                jdk.jfr.events.,\
-                jdk.jfr.internal.,\
--               jdk.management.jfr.internal.
-+               jdk.management.jfr.internal.,\
-+               org.GNOME.Accessibility.,\
-+               org.GNOME.Bonobo.
- 
- #
- # List of comma-separated packages that start with or equal this string
-@@ -279,7 +281,9 @@
-                    com.sun.activation.registries.,\
-                    jdk.jfr.events.,\
-                    jdk.jfr.internal.,\
--                   jdk.management.jfr.internal.
-+                   jdk.management.jfr.internal.,\
-+                   org.GNOME.Accessibility.,\
-+                   org.GNOME.Bonobo.
- 
- #
- # Determines whether this properties file can be appended to

SOURCES/rh1655466-global_crypto_and_fips.patch

@@ -1,208 +0,0 @@
-diff --git a/src/share/classes/javopenjdk.orig/jdk/security/Security.java openjdk/jdk/src/share/classes/java/security/Security.java
---- openjdk.orig/jdk/src/share/classes/java/security/Security.java
-+++ openjdk/jdk/src/share/classes/java/security/Security.java
-@@ -191,27 +191,7 @@
-         if (disableSystemProps == null &&
-             "true".equalsIgnoreCase(props.getProperty
-                 ("security.useSystemPropertiesFile"))) {
--
--            // now load the system file, if it exists, so its values
--            // will win if they conflict with the earlier values
--            try (BufferedInputStream bis =
--                 new BufferedInputStream(new FileInputStream(SYSTEM_PROPERTIES))) {
--                props.load(bis);
--                loadedProps = true;
--
--                if (sdebug != null) {
--                    sdebug.println("reading system security properties file " +
--                                   SYSTEM_PROPERTIES);
--                    sdebug.println(props.toString());
--                }
--            } catch (IOException e) {
--                if (sdebug != null) {
--                    sdebug.println
--                        ("unable to load security properties from " +
--                         SYSTEM_PROPERTIES);
--                    e.printStackTrace();
--                }
--            }
-+            loadedProps = loadedProps && SystemConfigurator.configure(props);
-         }
- 
-         if (!loadedProps) {
-diff --git a/src/share/classes/javopenjdk.orig/jdk/security/SystemConfigurator.java openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java
-new file mode 100644
---- /dev/null
-+++ openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java
-@@ -0,0 +1,153 @@
-+/*
-+ * Copyright (c) 2019, Red Hat, Inc.
-+ *
-+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
-+ *
-+ * This code is free software; you can redistribute it and/or modify it
-+ * under the terms of the GNU General Public License version 2 only, as
-+ * published by the Free Software Foundation.
-+ *
-+ * This code is distributed in the hope that it will be useful, but WITHOUT
-+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
-+ * version 2 for more details (a copy is included in the LICENSE file that
-+ * accompanied this code).
-+ *
-+ * You should have received a copy of the GNU General Public License version
-+ * 2 along with this work; if not, write to the Free Software Foundation,
-+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
-+ *
-+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
-+ * or visit www.oracle.com if you need additional information or have any
-+ * questions.
-+ */
-+
-+package java.security;
-+
-+import java.io.BufferedInputStream;
-+import java.io.FileInputStream;
-+import java.io.IOException;
-+
-+import java.nio.file.Files;
-+import java.nio.file.FileSystems;
-+import java.nio.file.Path;
-+
-+import java.util.Iterator;
-+import java.util.Map.Entry;
-+import java.util.Properties;
-+import java.util.function.Consumer;
-+import java.util.regex.Matcher;
-+import java.util.regex.Pattern;
-+
-+import sun.security.util.Debug;
-+
-+/**
-+ * Internal class to align OpenJDK with global crypto-policies.
-+ * Called from java.security.Security class initialization,
-+ * during startup.
-+ *
-+ */
-+
-+class SystemConfigurator {
-+
-+    private static final Debug sdebug =
-+            Debug.getInstance("properties");
-+
-+    private static final String CRYPTO_POLICIES_BASE_DIR =
-+            "/etc/crypto-policies";
-+
-+    private static final String CRYPTO_POLICIES_JAVA_CONFIG =
-+            CRYPTO_POLICIES_BASE_DIR + "/back-ends/java.config";
-+
-+    private static final String CRYPTO_POLICIES_CONFIG =
-+            CRYPTO_POLICIES_BASE_DIR + "/config";
-+
-+    private static final class SecurityProviderInfo {
-+        int number;
-+        String key;
-+        String value;
-+        SecurityProviderInfo(int number, String key, String value) {
-+            this.number = number;
-+            this.key = key;
-+            this.value = value;
-+        }
-+    }
-+
-+    /*
-+     * Invoked when java.security.Security class is initialized, if
-+     * java.security.disableSystemPropertiesFile property is not set and
-+     * security.useSystemPropertiesFile is true.
-+     */
-+    static boolean configure(Properties props) {
-+        boolean loadedProps = false;
-+
-+        try (BufferedInputStream bis =
-+                new BufferedInputStream(
-+                        new FileInputStream(CRYPTO_POLICIES_JAVA_CONFIG))) {
-+            props.load(bis);
-+            loadedProps = true;
-+            if (sdebug != null) {
-+                sdebug.println("reading system security properties file " +
-+                        CRYPTO_POLICIES_JAVA_CONFIG);
-+                sdebug.println(props.toString());
-+            }
-+        } catch (IOException e) {
-+            if (sdebug != null) {
-+                sdebug.println("unable to load security properties from " +
-+                        CRYPTO_POLICIES_JAVA_CONFIG);
-+                e.printStackTrace();
-+            }
-+        }
-+
-+        try {
-+            if (enableFips()) {
-+                if (sdebug != null) { sdebug.println("FIPS mode detected"); }
-+                loadedProps = false;
-+                // Remove all security providers
-+                Iterator<Entry<Object, Object>> i = props.entrySet().iterator();
-+                while (i.hasNext()) {
-+                    Entry<Object, Object> e = i.next();
-+                    if (((String) e.getKey()).startsWith("security.provider")) {
-+                        if (sdebug != null) { sdebug.println("Removing provider: " + e); }
-+                        i.remove();
-+                    }
-+                }
-+                // Add FIPS security providers
-+                String fipsProviderValue = null;
-+                for (int n = 1;
-+                     (fipsProviderValue = (String) props.get("fips.provider." + n)) != null; n++) {
-+                    String fipsProviderKey = "security.provider." + n;
-+                    if (sdebug != null) {
-+                        sdebug.println("Adding provider " + n + ": " +
-+                                fipsProviderKey + "=" + fipsProviderValue);
-+                    }
-+                    props.put(fipsProviderKey, fipsProviderValue);
-+                }
-+                loadedProps = true;
-+            }
-+        } catch (Exception e) {
-+            if (sdebug != null) {
-+                sdebug.println("unable to load FIPS configuration");
-+                e.printStackTrace();
-+            }
-+        }
-+        return loadedProps;
-+    }
-+
-+    /*
-+     * FIPS is enabled only if crypto-policies are set to "FIPS"
-+     * and the com.redhat.fips property is true.
-+     */
-+    private static boolean enableFips() throws Exception {
-+	boolean fipsEnabled = Boolean.valueOf(System.getProperty("com.redhat.fips", "true"));
-+	if (fipsEnabled) {
-+	    Path configPath = FileSystems.getDefault().getPath(CRYPTO_POLICIES_CONFIG);
-+	    String cryptoPoliciesConfig = new String(Files.readAllBytes(configPath));
-+	    if (sdebug != null) { sdebug.println("Crypto config:\n" + cryptoPoliciesConfig); }
-+	    Pattern pattern = Pattern.compile("^FIPS$", Pattern.MULTILINE);
-+	    return pattern.matcher(cryptoPoliciesConfig).find();
-+	} else {
-+	    return false;
-+	}
-+    }
-+}
-diff --git openjdk.orig/jdk/src/share/lib/security/java.security-linux openjdk/jdk/src/share/lib/security/java.security-linux
---- openjdk.orig/jdk/src/share/lib/security/java.security-linux
-+++ openjdk/jdk/src/share/lib/security/java.security-linux
-@@ -77,6 +77,14 @@
- #security.provider.10=sun.security.pkcs11.SunPKCS11 ${java.home}/lib/security/nss.cfg
- 
- #
-+# Security providers used when global crypto-policies are set to FIPS.
-+#
-+fips.provider.1=sun.security.pkcs11.SunPKCS11 ${java.home}/lib/security/nss.fips.cfg
-+fips.provider.2=sun.security.provider.Sun
-+fips.provider.3=sun.security.ec.SunEC
-+fips.provider.4=com.sun.net.ssl.internal.ssl.Provider SunPKCS11-NSS-FIPS
-+
-+#
- # Sun Provider SecureRandom seed source.
- #
- # Select the primary source of seed data for the "SHA1PRNG" and

SOURCES/rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch

@@ -0,0 +1,13 @@
+--- openjdk/jdk/src/solaris/classes/sun/security/smartcardio/PlatformPCSC.java	2013-03-01 10:48:12.038189968 +0100
++++ openjdk/jdk/src/solaris/classes/sun/security/smartcardio/PlatformPCSC.java	2013-03-01 10:48:11.913188505 +0100
+@@ -48,8 +48,8 @@
+ 
+     private final static String PROP_NAME = "sun.security.smartcardio.library";
+ 
+-    private final static String LIB1 = "/usr/$LIBISA/libpcsclite.so";
+-    private final static String LIB2 = "/usr/local/$LIBISA/libpcsclite.so";
++    private final static String LIB1 = "/usr/$LIBISA/libpcsclite.so.1";
++    private final static String LIB2 = "/usr/local/$LIBISA/libpcsclite.so.1";
+     private final static String PCSC_FRAMEWORK = "/System/Library/Frameworks/PCSC.framework/Versions/Current/PCSC";
+ 
+     PlatformPCSC() {

SOURCES/rh1750419-redhat_alt_java.patch

@@ -1,12 +1,13 @@
 diff --git openjdk.orig/jdk/make/CompileLaunchers.gmk openjdk/jdk/make/CompileLaunchers.gmk
 --- openjdk.orig/jdk/make/CompileLaunchers.gmk
 +++ openjdk/jdk/make/CompileLaunchers.gmk
-@@ -255,6 +255,32 @@
+@@ -255,6 +255,33 @@
    endif
  endif
  
++# -Wno-error=cpp is present to allow commented warning in ifdef part of main.c
 +$(eval $(call SetupLauncher,alt-java, \
-+    -DEXPAND_CLASSPATH_WILDCARDS -DREDHAT_ALT_JAVA,,,user32.lib comctl32.lib, \
++    -DEXPAND_CLASSPATH_WILDCARDS -DREDHAT_ALT_JAVA -Wno-error=cpp,,,user32.lib comctl32.lib, \
 +    $(JDK_OUTPUTDIR)/objs/jli_static.lib, $(JAVA_RC_FLAGS), \
 +    $(JDK_TOPDIR)/src/windows/resource/java.rc, $(JDK_OUTPUTDIR)/objs/java_objs,true))
 +
@@ -115,12 +116,16 @@ new file mode 100644
 diff --git openjdk.orig/jdk/src/share/bin/main.c openjdk/jdk/src/share/bin/main.c
 --- openjdk.orig/jdk/src/share/bin/main.c
 +++ openjdk/jdk/src/share/bin/main.c
-@@ -32,6 +32,10 @@
+@@ -32,6 +32,14 @@
  
  #include "defines.h"
  
-+#if defined(linux) && defined(__x86_64)
++#ifdef REDHAT_ALT_JAVA
++#if defined(__linux__) && defined(__x86_64__)
 +#include "alt_main.h"
++#else
++#warning alt-java requested but SSB mitigation not available on this platform.
++#endif
 +#endif
 +
  #ifdef _MSC_VER

SOURCES/rh1760838-fips_default_keystore_type.patch

@@ -1,52 +0,0 @@
-diff -r 6efbd7b35a10 src/share/classes/java/security/SystemConfigurator.java
---- openjdk.orig/jdk/src/share/classes/java/security/SystemConfigurator.java	Thu Jan 23 18:22:31 2020 -0300
-+++ openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java	Mon Mar 02 19:20:17 2020 -0300
-@@ -123,6 +123,33 @@
-                     }
-                     props.put(fipsProviderKey, fipsProviderValue);
-                 }
-+                // Add other security properties
-+                String keystoreTypeValue = (String) props.get("fips.keystore.type");
-+                if (keystoreTypeValue != null) {
-+                    String nonFipsKeystoreType = props.getProperty("keystore.type");
-+                    props.put("keystore.type", keystoreTypeValue);
-+                    if (keystoreTypeValue.equals("PKCS11")) {
-+                    	// If keystore.type is PKCS11, javax.net.ssl.keyStore
-+                    	// must be "NONE". See JDK-8238264.
-+                    	System.setProperty("javax.net.ssl.keyStore", "NONE");
-+                    }
-+                    if (System.getProperty("javax.net.ssl.trustStoreType") == null) {
-+                        // If no trustStoreType has been set, use the
-+                        // previous keystore.type under FIPS mode. In
-+                        // a default configuration, the Trust Store will
-+                        // be 'cacerts' (JKS type).
-+                        System.setProperty("javax.net.ssl.trustStoreType",
-+                                nonFipsKeystoreType);
-+                    }
-+                    if (sdebug != null) {
-+                        sdebug.println("FIPS mode default keystore.type = " +
-+                                keystoreTypeValue);
-+                        sdebug.println("FIPS mode javax.net.ssl.keyStore = " +
-+                        		System.getProperty("javax.net.ssl.keyStore", ""));
-+                        sdebug.println("FIPS mode javax.net.ssl.trustStoreType = " +
-+                                System.getProperty("javax.net.ssl.trustStoreType", ""));
-+                    }
-+                }
-                 loadedProps = true;
-             }
-         } catch (Exception e) {
-diff -r 6efbd7b35a10 src/share/lib/security/java.security-linux
---- openjdk.orig/jdk/src/share/lib/security/java.security-linux	Thu Jan 23 18:22:31 2020 -0300
-+++ openjdk/jdk/src/share/lib/security/java.security-linux	Mon Mar 02 19:20:17 2020 -0300
-@@ -179,6 +179,11 @@
- keystore.type=jks
- 
- #
-+# Default keystore type used when global crypto-policies are set to FIPS.
-+#
-+fips.keystore.type=PKCS11
-+
-+#
- # Controls compatibility mode for the JKS keystore type.
- #
- # When set to 'true', the JKS keystore type supports loading

SOURCES/rh1860986-disable_tlsv1.3_in_fips_mode.patch

@@ -1,327 +0,0 @@
-diff -r bbc65dfa59d1 src/share/classes/java/security/SystemConfigurator.java
---- openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java	Thu Jan 23 18:22:31 2020 -0300
-+++ openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java	Sat Aug 01 23:16:51 2020 -0300
-@@ -1,11 +1,13 @@
- /*
-- * Copyright (c) 2019, Red Hat, Inc.
-+ * Copyright (c) 2019, 2020, Red Hat, Inc.
-  *
-  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
-  *
-  * This code is free software; you can redistribute it and/or modify it
-  * under the terms of the GNU General Public License version 2 only, as
-- * published by the Free Software Foundation.
-+ * published by the Free Software Foundation.  Oracle designates this
-+ * particular file as subject to the "Classpath" exception as provided
-+ * by Oracle in the LICENSE file that accompanied this code.
-  *
-  * This code is distributed in the hope that it will be useful, but WITHOUT
-  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-@@ -34,10 +36,10 @@
- import java.util.Iterator;
- import java.util.Map.Entry;
- import java.util.Properties;
--import java.util.function.Consumer;
--import java.util.regex.Matcher;
- import java.util.regex.Pattern;
- 
-+import sun.misc.SharedSecrets;
-+import sun.misc.JavaSecuritySystemConfiguratorAccess;
- import sun.security.util.Debug;
- 
- /**
-@@ -47,7 +49,7 @@
-  *
-  */
- 
--class SystemConfigurator {
-+final class SystemConfigurator {
- 
-     private static final Debug sdebug =
-             Debug.getInstance("properties");
-@@ -61,15 +63,16 @@
-     private static final String CRYPTO_POLICIES_CONFIG =
-             CRYPTO_POLICIES_BASE_DIR + "/config";
- 
--    private static final class SecurityProviderInfo {
--        int number;
--        String key;
--        String value;
--        SecurityProviderInfo(int number, String key, String value) {
--            this.number = number;
--            this.key = key;
--            this.value = value;
--        }
-+    private static boolean systemFipsEnabled = false;
-+
-+    static {
-+        SharedSecrets.setJavaSecuritySystemConfiguratorAccess(
-+            new JavaSecuritySystemConfiguratorAccess() {
-+                @Override
-+                public boolean isSystemFipsEnabled() {
-+                    return SystemConfigurator.isSystemFipsEnabled();
-+                }
-+            });
-     }
- 
-     /*
-@@ -128,9 +131,9 @@
-                     String nonFipsKeystoreType = props.getProperty("keystore.type");
-                     props.put("keystore.type", keystoreTypeValue);
-                     if (keystoreTypeValue.equals("PKCS11")) {
--                    	// If keystore.type is PKCS11, javax.net.ssl.keyStore
--                    	// must be "NONE". See JDK-8238264.
--                    	System.setProperty("javax.net.ssl.keyStore", "NONE");
-+                        // If keystore.type is PKCS11, javax.net.ssl.keyStore
-+                        // must be "NONE". See JDK-8238264.
-+                        System.setProperty("javax.net.ssl.keyStore", "NONE");
-                     }
-                     if (System.getProperty("javax.net.ssl.trustStoreType") == null) {
-                         // If no trustStoreType has been set, use the
-@@ -144,12 +147,13 @@
-                         sdebug.println("FIPS mode default keystore.type = " +
-                                 keystoreTypeValue);
-                         sdebug.println("FIPS mode javax.net.ssl.keyStore = " +
--                        		System.getProperty("javax.net.ssl.keyStore", ""));
-+                                System.getProperty("javax.net.ssl.keyStore", ""));
-                         sdebug.println("FIPS mode javax.net.ssl.trustStoreType = " +
-                                 System.getProperty("javax.net.ssl.trustStoreType", ""));
-                     }
-                 }
-                 loadedProps = true;
-+                systemFipsEnabled = true;
-             }
-         } catch (Exception e) {
-             if (sdebug != null) {
-@@ -165,20 +165,37 @@
-         return loadedProps;
-     }
- 
-+    /**
-+     * Returns whether or not global system FIPS alignment is enabled.
-+     *
-+     * Value is always 'false' before java.security.Security class is
-+     * initialized.
-+     *
-+     * Call from out of this package through SharedSecrets:
-+     *   SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
-+     *           .isSystemFipsEnabled();
-+     *
-+     * @return  a boolean value indicating whether or not global
-+     *          system FIPS alignment is enabled.
-+     */
-+    static boolean isSystemFipsEnabled() {
-+        return systemFipsEnabled;
-+    }
-+
-     /*
-      * FIPS is enabled only if crypto-policies are set to "FIPS"
-      * and the com.redhat.fips property is true.
-      */
-     private static boolean enableFips() throws Exception {
--	boolean fipsEnabled = Boolean.valueOf(System.getProperty("com.redhat.fips", "true"));
--	if (fipsEnabled) {
--	    Path configPath = FileSystems.getDefault().getPath(CRYPTO_POLICIES_CONFIG);
--	    String cryptoPoliciesConfig = new String(Files.readAllBytes(configPath));
--	    if (sdebug != null) { sdebug.println("Crypto config:\n" + cryptoPoliciesConfig); }
--	    Pattern pattern = Pattern.compile("^FIPS$", Pattern.MULTILINE);
--	    return pattern.matcher(cryptoPoliciesConfig).find();
--	} else {
--	    return false;
--	}
-+        boolean shouldEnable = Boolean.valueOf(System.getProperty("com.redhat.fips", "true"));
-+        if (shouldEnable) {
-+            Path configPath = FileSystems.getDefault().getPath(CRYPTO_POLICIES_CONFIG);
-+            String cryptoPoliciesConfig = new String(Files.readAllBytes(configPath));
-+            if (sdebug != null) { sdebug.println("Crypto config:\n" + cryptoPoliciesConfig); }
-+            Pattern pattern = Pattern.compile("^FIPS$", Pattern.MULTILINE);
-+            return pattern.matcher(cryptoPoliciesConfig).find();
-+        } else {
-+            return false;
-+        }
-     }
- }
-diff --git openjdk.orig/jdk/src/share/classes/sun/misc/JavaSecuritySystemConfiguratorAccess.java openjdk/jdk/src/share/classes/sun/misc/JavaSecuritySystemConfiguratorAccess.java
-new file mode 100644
---- /dev/null
-+++ openjdk/jdk/src/share/classes/sun/misc/JavaSecuritySystemConfiguratorAccess.java
-@@ -0,0 +1,30 @@
-+/*
-+ * Copyright (c) 2020, Red Hat, Inc.
-+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
-+ *
-+ * This code is free software; you can redistribute it and/or modify it
-+ * under the terms of the GNU General Public License version 2 only, as
-+ * published by the Free Software Foundation.  Oracle designates this
-+ * particular file as subject to the "Classpath" exception as provided
-+ * by Oracle in the LICENSE file that accompanied this code.
-+ *
-+ * This code is distributed in the hope that it will be useful, but WITHOUT
-+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
-+ * version 2 for more details (a copy is included in the LICENSE file that
-+ * accompanied this code).
-+ *
-+ * You should have received a copy of the GNU General Public License version
-+ * 2 along with this work; if not, write to the Free Software Foundation,
-+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
-+ *
-+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
-+ * or visit www.oracle.com if you need additional information or have any
-+ * questions.
-+ */
-+
-+package sun.misc;
-+
-+public interface JavaSecuritySystemConfiguratorAccess {
-+    boolean isSystemFipsEnabled();
-+}
-diff --git openjdk.orig/jdk/src/share/classes/sun/misc/SharedSecrets.java openjdk/jdk/src/share/classes/sun/misc/SharedSecrets.java
---- openjdk.orig/jdk/src/share/classes/sun/misc/SharedSecrets.java
-+++ openjdk/jdk/src/share/classes/sun/misc/SharedSecrets.java
-@@ -63,6 +63,7 @@
-     private static JavaObjectInputStreamReadString javaObjectInputStreamReadString;
-     private static JavaObjectInputStreamAccess javaObjectInputStreamAccess;
-     private static JavaSecuritySignatureAccess javaSecuritySignatureAccess;
-+    private static JavaSecuritySystemConfiguratorAccess javaSecuritySystemConfiguratorAccess;
- 
-     public static JavaUtilJarAccess javaUtilJarAccess() {
-         if (javaUtilJarAccess == null) {
-@@ -248,4 +249,12 @@
-         }
-         return javaxCryptoSealedObjectAccess;
-     }
-+
-+    public static void setJavaSecuritySystemConfiguratorAccess(JavaSecuritySystemConfiguratorAccess jssca) {
-+        javaSecuritySystemConfiguratorAccess = jssca;
-+    }
-+
-+    public static JavaSecuritySystemConfiguratorAccess getJavaSecuritySystemConfiguratorAccess() {
-+        return javaSecuritySystemConfiguratorAccess;
-+    }
- }
-diff --git openjdk.orig/jdk/src/share/classes/sun/security/ssl/SSLContextImpl.java openjdk/jdk/src/share/classes/sun/security/ssl/SSLContextImpl.java
---- openjdk.orig/jdk/src/share/classes/sun/security/ssl/SSLContextImpl.java
-+++ openjdk/jdk/src/share/classes/sun/security/ssl/SSLContextImpl.java
-@@ -31,6 +31,7 @@
- import java.security.cert.*;
- import java.util.*;
- import javax.net.ssl.*;
-+import sun.misc.SharedSecrets;
- import sun.security.action.GetPropertyAction;
- import sun.security.provider.certpath.AlgorithmChecker;
- import sun.security.validator.Validator;
-@@ -539,20 +540,38 @@
- 
-         static {
-             if (SunJSSE.isFIPS()) {
--                supportedProtocols = Arrays.asList(
--                    ProtocolVersion.TLS13,
--                    ProtocolVersion.TLS12,
--                    ProtocolVersion.TLS11,
--                    ProtocolVersion.TLS10
--                );
-+                if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
-+                        .isSystemFipsEnabled()) {
-+                    // RH1860986: TLSv1.3 key derivation not supported with
-+                    // the Security Providers available in system FIPS mode.
-+                    supportedProtocols = Arrays.asList(
-+                        ProtocolVersion.TLS12,
-+                        ProtocolVersion.TLS11,
-+                        ProtocolVersion.TLS10
-+                    );
- 
--                serverDefaultProtocols = getAvailableProtocols(
--                        new ProtocolVersion[] {
--                    ProtocolVersion.TLS13,
--                    ProtocolVersion.TLS12,
--                    ProtocolVersion.TLS11,
--                    ProtocolVersion.TLS10
--                });
-+                    serverDefaultProtocols = getAvailableProtocols(
-+                            new ProtocolVersion[] {
-+                        ProtocolVersion.TLS12,
-+                        ProtocolVersion.TLS11,
-+                        ProtocolVersion.TLS10
-+                    });
-+                } else {
-+                    supportedProtocols = Arrays.asList(
-+                        ProtocolVersion.TLS13,
-+                        ProtocolVersion.TLS12,
-+                        ProtocolVersion.TLS11,
-+                        ProtocolVersion.TLS10
-+                    );
-+
-+                    serverDefaultProtocols = getAvailableProtocols(
-+                            new ProtocolVersion[] {
-+                        ProtocolVersion.TLS13,
-+                        ProtocolVersion.TLS12,
-+                        ProtocolVersion.TLS11,
-+                        ProtocolVersion.TLS10
-+                    });
-+                }
-             } else {
-                 supportedProtocols = Arrays.asList(
-                     ProtocolVersion.TLS13,
-@@ -612,6 +631,16 @@
- 
-         static ProtocolVersion[] getSupportedProtocols() {
-             if (SunJSSE.isFIPS()) {
-+                if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
-+                        .isSystemFipsEnabled()) {
-+                    // RH1860986: TLSv1.3 key derivation not supported with
-+                    // the Security Providers available in system FIPS mode.
-+                    return new ProtocolVersion[] {
-+                            ProtocolVersion.TLS12,
-+                            ProtocolVersion.TLS11,
-+                            ProtocolVersion.TLS10
-+                    };
-+                }
-                 return new ProtocolVersion[] {
-                         ProtocolVersion.TLS13,
-                         ProtocolVersion.TLS12,
-@@ -939,6 +968,16 @@
- 
-         static ProtocolVersion[] getProtocols() {
-             if (SunJSSE.isFIPS()) {
-+                if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
-+                        .isSystemFipsEnabled()) {
-+                    // RH1860986: TLSv1.3 key derivation not supported with
-+                    // the Security Providers available in system FIPS mode.
-+                    return new ProtocolVersion[] {
-+                            ProtocolVersion.TLS12,
-+                            ProtocolVersion.TLS11,
-+                            ProtocolVersion.TLS10
-+                    };
-+                }
-                 return new ProtocolVersion[]{
-                         ProtocolVersion.TLS12,
-                         ProtocolVersion.TLS11,
-diff --git openjdk.orig/jdk/src/share/classes/sun/security/ssl/SunJSSE.java openjdk/jdk/src/share/classes/sun/security/ssl/SunJSSE.java
---- openjdk.orig/jdk/src/share/classes/sun/security/ssl/SunJSSE.java
-+++ openjdk/jdk/src/share/classes/sun/security/ssl/SunJSSE.java
-@@ -30,6 +30,8 @@
- 
- import java.security.*;
- 
-+import sun.misc.SharedSecrets;
-+
- /**
-  * The JSSE provider.
-  *
-@@ -215,8 +217,13 @@
-             "sun.security.ssl.SSLContextImpl$TLS11Context");
-         put("SSLContext.TLSv1.2",
-             "sun.security.ssl.SSLContextImpl$TLS12Context");
--        put("SSLContext.TLSv1.3",
--            "sun.security.ssl.SSLContextImpl$TLS13Context");
-+        if (!SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
-+                .isSystemFipsEnabled()) {
-+            // RH1860986: TLSv1.3 key derivation not supported with
-+            // the Security Providers available in system FIPS mode.
-+            put("SSLContext.TLSv1.3",
-+                "sun.security.ssl.SSLContextImpl$TLS13Context");
-+        }
-         put("SSLContext.TLS",
-             "sun.security.ssl.SSLContextImpl$TLSContext");
-         if (isfips == false) {

SOURCES/rh1868759-pkcs11_cancel_on_failure.patch

@@ -1,20 +0,0 @@
---- openjdk/jdk/src/share/classes/sun/security/pkcs11/P11Cipher.java      Mon Aug 31 06:57:19 2020 +0100
-+++ openjdk/jdk/src/share/classes/sun/security/pkcs11/P11Cipher.java      Mon Aug 31 15:56:48 2020 -0300
-@@ -627,7 +627,7 @@
-                 throw (ShortBufferException)
-                         (new ShortBufferException().initCause(e));
-             }
--            reset(false);
-+            reset(true);
-             throw new ProviderException("update() failed", e);
-         }
-     }
-@@ -745,7 +745,7 @@
-                 throw (ShortBufferException)
-                         (new ShortBufferException().initCause(e));
-             }
--            reset(false);
-+            reset(true);
-             throw new ProviderException("update() failed", e);
-         }
-     }

SOURCES/rh1906862-always_initialise_configurator_access.patch

@@ -1,65 +0,0 @@
-# HG changeset patch
-# User andrew
-# Date 1608219816 0
-#      Thu Dec 17 15:43:36 2020 +0000
-# Node ID db5d1b28bfce04352b3a48960bf836f6eb20804b
-# Parent  a2cfa397150e99b813354226d536eb8509b5850b
-RH1906862: Always initialise JavaSecuritySystemConfiguratorAccess
-
-diff --git openjdk.orig/jdk/src/share/classes/java/security/Security.java openjdk/jdk/src/share/classes/java/security/Security.java
---- openjdk.orig/jdk/src/share/classes/java/security/Security.java
-+++ openjdk/jdk/src/share/classes/java/security/Security.java
-@@ -30,6 +30,8 @@
- import java.util.concurrent.ConcurrentHashMap;
- import java.io.*;
- import java.net.URL;
-+import sun.misc.SharedSecrets;
-+import sun.misc.JavaSecuritySystemConfiguratorAccess;
- import sun.security.util.Debug;
- import sun.security.util.PropertyExpander;
- 
-@@ -69,6 +71,15 @@
-     }
- 
-     static {
-+        // Initialise here as used by code with system properties disabled
-+        SharedSecrets.setJavaSecuritySystemConfiguratorAccess(
-+            new JavaSecuritySystemConfiguratorAccess() {
-+                @Override
-+                public boolean isSystemFipsEnabled() {
-+                    return SystemConfigurator.isSystemFipsEnabled();
-+                }
-+            });
-+
-         // doPrivileged here because there are multiple
-         // things in initialize that might require privs.
-         // (the FileInputStream call and the File.exists call,
-diff --git openjdk.orig/jdk/src/share/classes/java/security/SystemConfigurator.java openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java
---- openjdk.orig/jdk/src/share/classes/java/security/SystemConfigurator.java
-+++ openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java
-@@ -39,8 +39,6 @@
- import java.util.Properties;
- import java.util.regex.Pattern;
- 
--import sun.misc.SharedSecrets;
--import sun.misc.JavaSecuritySystemConfiguratorAccess;
- import sun.security.util.Debug;
- 
- /**
-@@ -66,16 +64,6 @@
- 
-     private static boolean systemFipsEnabled = false;
- 
--    static {
--        SharedSecrets.setJavaSecuritySystemConfiguratorAccess(
--            new JavaSecuritySystemConfiguratorAccess() {
--                @Override
--                public boolean isSystemFipsEnabled() {
--                    return SystemConfigurator.isSystemFipsEnabled();
--                }
--            });
--    }
--
-     /*
-      * Invoked when java.security.Security class is initialized, if
-      * java.security.disableSystemPropertiesFile property is not set and

SOURCES/s390-8214206_fix.patch

@@ -1,16 +1,13 @@
-diff --git openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1BiasedArray.hpp openjdk/hotspot/src/share/vm/gc_implementation/g1/g1BiasedArray.hpp
---- openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1BiasedArray.hpp
-+++ openjdk/hotspot/src/share/vm/gc_implementation/g1/g1BiasedArray.hpp
-@@ -78,7 +78,8 @@
-     size_t num_target_elems = pointer_delta(end, bottom, mapping_granularity_in_bytes);
-     idx_t bias = (uintptr_t)bottom / mapping_granularity_in_bytes;
-     address base = create_new_base_array(num_target_elems, target_elem_size_in_bytes);
--    initialize_base(base, num_target_elems, bias, target_elem_size_in_bytes, log2_intptr(mapping_granularity_in_bytes));
-+    initialize_base(base, num_target_elems, bias, target_elem_size_in_bytes,
-+                    log2_long(mapping_granularity_in_bytes));
+diff --git openjdk.orig/hotspot/src/share/vm/gc_implementation/shenandoah/shenandoahUtils.cpp openjdk/hotspot/src/share/vm/gc_implementation/shenandoah/shenandoahUtils.cpp
+--- openjdk.orig/hotspot/src/share/vm/gc_implementation/shenandoah/shenandoahUtils.cpp
++++ openjdk/hotspot/src/share/vm/gc_implementation/shenandoah/shenandoahUtils.cpp
+@@ -150,5 +150,5 @@
+     return value;
    }
  
-   size_t bias() const { return _bias; }
+-  return (size_t)1 << (log2_intptr(value) + 1);
++  return (size_t)1 << (log2_intptr((uintptr_t) value) + 1);
+ }
 diff --git openjdk.orig/hotspot/src/share/vm/gc_implementation/shenandoah/shenandoahNumberSeq.cpp openjdk/hotspot/src/share/vm/gc_implementation/shenandoah/shenandoahNumberSeq.cpp
 --- openjdk.orig/hotspot/src/share/vm/gc_implementation/shenandoah/shenandoahNumberSeq.cpp
 +++ openjdk/hotspot/src/share/vm/gc_implementation/shenandoah/shenandoahNumberSeq.cpp
@@ -23,15 +20,27 @@ diff --git openjdk.orig/hotspot/src/share/vm/gc_implementation/shenandoah/shenan
  
    // Defensively saturate for product bits:
    if (mag < 0) {
-diff --git openjdk.orig/hotspot/src/share/vm/runtime/os.cpp openjdk/hotspot/src/share/vm/runtime/os.cpp
---- openjdk.orig/hotspot/src/share/vm/runtime/os.cpp
-+++ openjdk/hotspot/src/share/vm/runtime/os.cpp
-@@ -1284,7 +1284,7 @@
+diff --git openjdk.orig/hotspot/src/share/vm/gc_implementation/shenandoah/shenandoahHeap.cpp openjdk/hotspot/src/share/vm/gc_implementation/shenandoah/shenandoahHeap.cpp
+--- openjdk.orig/hotspot/src/share/vm/gc_implementation/shenandoah/shenandoahHeap.cpp
++++ openjdk/hotspot/src/share/vm/gc_implementation/shenandoah/shenandoahHeap.cpp
+@@ -659,7 +659,7 @@
  }
  
- void os::set_memory_serialize_page(address page) {
--  int count = log2_intptr(sizeof(class JavaThread)) - log2_int(64);
-+  int count = log2_long(sizeof(class JavaThread)) - log2_int(64);
-   _mem_serialize_page = (volatile int32_t *)page;
-   // We initialize the serialization page shift count here
-   // We assume a cache line size of 64 bytes
+ size_t ShenandoahHeap::soft_max_capacity() const {
+-  size_t v = OrderAccess::load_acquire((volatile size_t*)&_soft_max_size);
++  size_t v = OrderAccess::load_acquire((volatile jlong*)&_soft_max_size);
+   assert(min_capacity() <= v && v <= max_capacity(),
+          err_msg("Should be in bounds: " SIZE_FORMAT " <= " SIZE_FORMAT " <= " SIZE_FORMAT,
+                  min_capacity(), v, max_capacity()));
+diff --git openjdk.orig/hotspot/src/share/vm/gc_implementation/shenandoah/shenandoahHeap.hpp openjdk/hotspot/src/share/vm/gc_implementation/shenandoah/shenandoahHeap.hpp
+--- openjdk.orig/hotspot/src/share/vm/gc_implementation/shenandoah/shenandoahHeap.hpp
++++ openjdk/hotspot/src/share/vm/gc_implementation/shenandoah/shenandoahHeap.hpp
+@@ -155,7 +155,7 @@
+ private:
+            size_t _initial_size;
+            size_t _minimum_size;
+-  volatile size_t _soft_max_size;
++  volatile jlong  _soft_max_size;
+   shenandoah_padding(0);
+   volatile jlong  _used;
+   volatile size_t _committed;