9 changed files with 2291 additions and 1115 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1,2 +1,2 @@
-SOURCES/shenandoah8u432-b06.tar.xz
+SOURCES/shenandoah8u452-b09.tar.xz
 SOURCES/tapsets-icedtea-3.15.0.tar.xz
--- a/.java-1.8.0-openjdk.metadata
+++ b/.java-1.8.0-openjdk.metadata
@ -1,2 +1,2 @@
-af2d3b85c48ecc8c22188ac687e6160658ef6aca SOURCES/shenandoah8u432-b06.tar.xz
+c09d806f1a991cd77d3f15bb35ff69cb9d1bdbc0 SOURCES/shenandoah8u452-b09.tar.xz
 7ae2cba67467825b2c2a5fec7aea041865023002 SOURCES/tapsets-icedtea-3.15.0.tar.xz
--- a/SOURCES/NEWS
+++ b/SOURCES/NEWS
@ -3,6 +3,197 @@ Key:
 JDK-X  - https://bugs.openjdk.java.net/browse/JDK-X
 CVE-XXXX-YYYY: https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY

+New in release OpenJDK 8u452 (2025-04-15):
+===========================================
+Live versions of these release notes can be found at:
+  * https://bit.ly/openjdk8u452
+
+* CVEs
+  - CVE-2025-21587
+  - CVE-2025-30691
+  - CVE-2025-30698
+* Changes
+  - JDK-8037013: [TESTBUG] Fix test/java/lang/ClassLoader/Assert.sh on AIX
+  - JDK-8048215: [TESTBUG] java/lang/management/ManagementFactory/ThreadMXBeanProxy.java Expected non-null LockInfo
+  - JDK-8068305: [TEST_BUG] Test java/awt/Mixing/HWDisappear.java fails with GTKL&F
+  - JDK-8212096: javax/net/ssl/ServerName/SSLEngineExplorerMatchedSNI.java failed intermittently due to SSLException: Tag mismatch
+  - JDK-8227651: Tests fail with SSLProtocolException: Input record too big
+  - JDK-8240235: jdk.test.lib.util.JarUtils updates jar files incorrectly
+  - JDK-8244966: Add .vscode to .hgignore and .gitignore
+  - JDK-8250825: C2 crashes with assert(field != __null) failed: missing field
+  - JDK-8255466: C2 crashes at ciObject::get_oop() const+0x0
+  - JDK-8261020: Wrong format parameter in create_emergency_chunk_path
+  - JDK-8265019: Update tests for additional TestNG test permissions
+  - JDK-8266881: Enable debug log for SSLEngineExplorerMatchedSNI.java
+  - JDK-8268457: XML Transformer outputs Unicode supplementary character incorrectly to HTML
+  - JDK-8285756: clean up use of bad arguments for `@clean` in langtools tests
+  - JDK-8309841: Jarsigner should print a warning if an entry is removed
+  - JDK-8316193: jdk/jfr/event/oldobject/TestListenerLeak.java java.lang.Exception: Could not find leak
+  - JDK-8326110: [8u] The Marlin tests should be updated after JDK-8241307
+  - JDK-8337494: Clarify JarInputStream behavior
+  - JDK-8337692: Better TLS connection support
+  - JDK-8338430: Improve compiler transformations
+  - JDK-8339560: Unaddressed comments during code review of JDK-8337664
+  - JDK-8339637: (tz) Update Timezone Data to 2024b
+  - JDK-8339644: Improve parsing of Day/Month in tzdata rules
+  - JDK-8339810: Clean up the code in sun.tools.jar.Main to properly close resources and use ZipFile during extract
+  - JDK-8340552: Harden TzdbZoneRulesCompiler against missing zone names
+  - JDK-8340660: [8u] Test com/sun/jdi/PrivateTransportTest.sh fails on MacOS
+  - JDK-8342562: Enhance Deflater operations
+  - JDK-8343007: Enhance Buffered Image handling
+  - JDK-8345504: Bump update version of OpenJDK: 8u452
+  - JDK-8346140: [8u] tools/jar/ExtractFilesTest.java and tools/jar/MultipleManifestTest.java fails with jtreg5.1
+  - JDK-8346587: Distrust TLS server certificates anchored by Camerfirma Root CAs
+  - JDK-8347847: Enhance jar file support
+  - JDK-8347965: (tz) Update Timezone Data to 2025a
+  - JDK-8348211: [8u] sun/management/jmxremote/startstop/JMXStartStopTest.java fails after backport of JDK-8066708
+  - JDK-8349166: Bad indentation in backport of JDK-8250825
+  - JDK-8350816: [8u] Update TzdbZoneRulesCompiler to ignore HST/EST/MST links
+  - JDK-8352097: (tz) zone.tab update missed in 2025a backport
+  - JDK-8353433: XCG currency code not recognized in JDK 8u
+
+Notes on individual issues:
+===========================
+
+security-libs/java.security:
+
+JDK-8309841: Jarsigner should print a warning if an entry is removed
+====================================================================
+In previous OpenJDK releases, the jarsigner tool did not detect the
+case where a file was removed from a signed JAR file but its signature
+was still present. With this release, `jarsigner -verify` checks that
+every signature has a matching file entry and prints a warning if this
+is not the case. The `-verbose` option can also be added to the
+command to see the names of the mismatched entries.
+
+security-libs/javax.net.ssl:
+
+JDK-8346587: Distrust TLS server certificates anchored by Camerfirma Root CAs
+=============================================================================
+In accordance with similar plans recently announced by Google,
+Mozilla, Apple and Microsoft, the JDK will not trust Transport Layer
+Security (TLS) certificates issued after the 15th of April 2025 which
+are anchored by Camerfirma root certificates.
+
+Certificates issued on or before April 15th, 2025 will continue to
+be trusted until they expire.
+
+If a server's certificate chain is anchored by an affected
+certificate, attempts to negotiate a TLS session will fail with an
+Exception that indicates the trust anchor is not trusted. For example,
+
+"TLS server certificate issued after 2025-04-15 and anchored by a
+distrusted legacy Camerfirma root CA: CN=Chambers of Commerce Root -
+2008, O=AC Camerfirma S.A., SERIALNUMBER=A82743287, L=Madrid (see
+current address at www.camerfirma.com/address), C=EU"
+
+To check whether a certificate in a JDK keystore is affected by this
+change, you can the `keytool` utility:
+
+keytool -v -list -alias <your_server_alias> -keystore <your_keystore_filename>
+
+If any of the certificates in the chain are affected by this change,
+then you will need to update the certificate or contact the
+organisation responsible for managing the certificate.
+
+These restrictions apply to the following Camerfirma root certificates
+included in the JDK:
+
+Alias name: camerfirmachamberscommerceca [jdk]
+CN=Chambers of Commerce Root
+OU=http://www.chambersign.org
+O=AC Camerfirma SA CIF A82743287
+C=EU
+SHA256: 0C:25:8A:12:A5:67:4A:EF:25:F2:8B:A7:DC:FA:EC:EE:A3:48:E5:41:E6:F5:CC:4E:E6:3B:71:B3:61:60:6A:C3
+
+Alias name: camerfirmachambersca [jdk]
+CN=Chambers of Commerce Root - 2008
+O=AC Camerfirma S.A.
+SERIALNUMBER=A82743287
+L=Madrid (see current address at www.camerfirma.com/address)
+C=EU
+SHA256: 06:3E:4A:FA:C4:91:DF:D3:32:F3:08:9B:85:42:E9:46:17:D8:93:D7:FE:94:4E:10:A7:93:7E:E2:9D:96:93:C0
+
+Alias name: camerfirmachambersignca [jdk]
+CN=Global Chambersign Root - 2008
+O=AC Camerfirma S.A.
+SERIALNUMBER=A82743287
+L=Madrid (see current address at www.camerfirma.com/address)
+C=EU
+SHA256: 13:63:35:43:93:34:A7:69:80:16:A0:D3:24:DE:72:28:4E:07:9D:7B:52:20:BB:8F:BD:74:78:16:EE:BE:BA:CA
+
+Users can, *at their own risk*, remove this restriction by modifying
+the `java.security` configuration file (or override it by using the
+`java.security.properties` system property) so "CAMERFIRMA_TLS" is no
+longer listed in the `jdk.security.caDistrustPolicies` security
+property.
+
+core-libs/java.time:
+
+JDK-8339637: (tz) Update Timezone Data to 2024b
+===============================================
+This OpenJDK release upgrades the in-tree copy of the IANA timezone
+database to 2024b.  This timezone update is primarily concerned with
+improving historical data for Mexico, Monogolia and Portugal. It also
+makes Asia/Choibalsan an alias for Asia/Ulaanbaatar and makes the MET
+timezone the same as CET.
+
+The 2024b update also makes a number of legacy timezone IDs equal to
+geographical names rather than fixed offsets, as follows:
+
+* EST => America/Panama instead of -5:00
+* MST => America/Phoenix instead of -7:00
+* HST => Pacific/Honolulu instead of -10:00
+
+For long term support releases of OpenJDK, this change is overridden
+locally to retain the existing fixed offset mapping.
+
+New in release OpenJDK 8u442 (2025-01-21):
+===========================================
+Live versions of these release notes can be found at:
+  * https://bit.ly/openjdk8u442
+
+* Changes
+  - JDK-8048003: test/compiler/8009761/Test8009761.java failed with: java.lang.RuntimeException: static java.lang.Object Test8009761.m3(boolean,boolean) not compiled
+  - JDK-8058322: Zero name_index item of MethodParameters attribute cause MalformedParameterException.
+  - JDK-8066708: JMXStartStopTest fails to connect to port 38112
+  - JDK-8133287: (fs) java/nio/file/Files/probeContentType/ParallelProbes.java should use othervm mode
+  - JDK-8189687: Swing: Invalid position of candidate pop-up of InputMethod in Hi-DPI on Windows
+  - JDK-8209023: fix 2 compiler tests to avoid JDK-8208690
+  - JDK-8239312: [macOS] javax/swing/JFrame/NSTexturedJFrame/NSTexturedJFrame.java
+  - JDK-8260380: Upgrade to LittleCMS 2.12
+  - JDK-8315731: Open source several Swing Text related tests
+  - JDK-8335428: Enhanced Building of Processes
+  - JDK-8335912, JDK-8337499: Add an operation mode to the jar command when extracting to not overwriting existing files
+  - JDK-8336564: Enhance mask blit functionality redux
+  - JDK-8338402: GHA: some of bundles may not get removed
+  - JDK-8339133: [8u] Profiler crashes at guarantee(is_result_safe || is_in_asgct()): unsafe access to zombie method
+  - JDK-8339180: Enhanced Building of Processes: Follow-on Issue
+  - JDK-8339394: Bump update version of OpenJDK: 8u442
+  - JDK-8339882: Replace ThreadLocalStorage::thread with Thread::current_or_null in jdk8 backport of JDK-8183925
+  - JDK-8340815: Add SECURITY.md file
+  - JDK-8342822: jdk8u432-b06 does not compile on AIX
+  - JDK-8342841: [8u] Separate jdk_security_infra tests from jdk_tier1
+
+Notes on individual issues:
+===========================
+
+core-libs/java.util.jar:
+
+JDK-8335912/JDK-8337499: Add an operation mode to the jar command when extracting to not overwriting existing files
+===================================================================================================================
+In previous OpenJDK releases, when the jar tool extracted files from
+an archive, it would overwrite any existing files with the same name
+in the target directory. With this release, a new option ('-k') may be
+specified so that existing files are not overwritten.
+
+The option may be specified as in the following example:
+
+* jar xkf foo.jar
+
+By default, the old behaviour remains in place and files will be
+overwritten.
+
 New in release OpenJDK 8u432 (2024-10-15):
 ===========================================
 Live versions of these release notes can be found at:
--- a/SOURCES/fips-8u-6d1aade0648.patch
+++ b/SOURCES/fips-8u-6d1aade0648.patch
@ -1,5 +1,5 @@
 diff --git a/common/autoconf/configure.ac b/common/autoconf/configure.ac
-index 151e5a109f8..a8761b500e0 100644
+index 151e5a109f..a8761b500e 100644
 --- a/common/autoconf/configure.ac
 +++ b/common/autoconf/configure.ac
@@ -212,6 +212,7 @@ LIB_SETUP_FREETYPE
@ -11,10 +11,10 @@ index 151e5a109f8..a8761b500e0 100644
 LIB_SETUP_ON_WINDOWS
 
 diff --git a/common/autoconf/generated-configure.sh b/common/autoconf/generated-configure.sh
-index 71fabf4dbb3..17f4f50673d 100644
+index c6144b1968..9ac55d20d3 100644
 --- a/common/autoconf/generated-configure.sh
 +++ b/common/autoconf/generated-configure.sh
-@@ -651,6 +651,9 @@ LLVM_CONFIG
+@@ -655,6 +655,9 @@ ENABLE_LIBFFI_BUNDLING
 LIBFFI_LIBS
 LIBFFI_CFLAGS
 STATIC_CXX_SETTING
@ -24,15 +24,15 @@ index 71fabf4dbb3..17f4f50673d 100644
 LIBDL
 LIBM
 LIBZIP_CAN_USE_MMAP
-@@ -1111,6 +1114,7 @@ with_fontconfig
+@@ -1119,6 +1122,7 @@ with_fontconfig
 with_fontconfig_include
 with_giflib
 with_zlib
 +enable_sysconf_nss
 with_stdc__lib
- with_msvcr_dll
- with_msvcp_dll
-@@ -1218,6 +1222,8 @@ FREETYPE_CFLAGS
+ with_libffi
+ with_libffi_include
+@@ -1232,6 +1236,8 @@ FREETYPE_CFLAGS
 FREETYPE_LIBS
 ALSA_CFLAGS
 ALSA_LIBS
@ -41,16 +41,16 @@ index 71fabf4dbb3..17f4f50673d 100644
 LIBFFI_CFLAGS
 LIBFFI_LIBS
 CCACHE'
-@@ -1871,6 +1877,8 @@ Optional Features:
+@@ -1874,6 +1880,8 @@ Optional Features:
                           disable bundling of the freetype library with the
                           build result [enabled on Windows or when using
                           --with-freetype, disabled otherwise]
 +  --enable-sysconf-nss    build the System Configurator (libsysconf) using the
 +                          system NSS library if available [disabled]
-   --enable-sjavac         use sjavac to do fast incremental compiles
-                           [disabled]
-   --disable-precompiled-headers
-@@ -2115,6 +2123,8 @@ Some influential environment variables:
+   --enable-libffi-bundling
+                           enable bundling of libffi.so to make the built JDK
+                           runnable on more systems
+@@ -2129,6 +2137,8 @@ Some influential environment variables:
               linker flags for FREETYPE, overriding pkg-config
   ALSA_CFLAGS C compiler flags for ALSA, overriding pkg-config
   ALSA_LIBS   linker flags for ALSA, overriding pkg-config
@ -59,60 +59,7 @@ index 71fabf4dbb3..17f4f50673d 100644
   LIBFFI_CFLAGS
               C compiler flags for LIBFFI, overriding pkg-config
   LIBFFI_LIBS linker flags for LIBFFI, overriding pkg-config
-@@ -2879,6 +2889,52 @@ $as_echo "$ac_res" >&6; }
-   eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
- 
- } # ac_fn_c_check_header_compile
-+
-+# ac_fn_c_try_link LINENO
-+# -----------------------
-+# Try to link conftest.$ac_ext, and return whether this succeeded.
-+ac_fn_c_try_link ()
-+{
-+  as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
-+  rm -f conftest.$ac_objext conftest$ac_exeext
-+  if { { ac_try="$ac_link"
-+case "(($ac_try" in
-+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
-+  *) ac_try_echo=$ac_try;;
-+esac
-+eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
-+$as_echo "$ac_try_echo"; } >&5
-+  (eval "$ac_link") 2>conftest.err
-+  ac_status=$?
-+  if test -s conftest.err; then
-+    grep -v '^ *+' conftest.err >conftest.er1
-+    cat conftest.er1 >&5
-+    mv -f conftest.er1 conftest.err
-+  fi
-+  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
-+  test $ac_status = 0; } && {
-+	 test -z "$ac_c_werror_flag" ||
-+	 test ! -s conftest.err
-+       } && test -s conftest$ac_exeext && {
-+	 test "$cross_compiling" = yes ||
-+	 test -x conftest$ac_exeext
-+       }; then :
-+  ac_retval=0
-+else
-+  $as_echo "$as_me: failed program was:" >&5
-+sed 's/^/| /' conftest.$ac_ext >&5
-+
-+	ac_retval=1
-+fi
-+  # Delete the IPA/IPO (Inter Procedural Analysis/Optimization) information
-+  # created by the PGI compiler (conftest_ipa8_conftest.oo), as it would
-+  # interfere with the next link command; also delete a directory that is
-+  # left behind by Apple's compiler.  We do this before executing the actions.
-+  rm -rf conftest.dSYM conftest_ipa8_conftest.oo
-+  eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
-+  as_fn_set_status $ac_retval
-+
-+} # ac_fn_c_try_link
- cat >config.log <<_ACEOF
- This file contains any messages produced by compilers while
- running configure, to aid debugging if configure makes a mistake.
-@@ -4049,6 +4105,11 @@ fi
+@@ -4109,6 +4119,11 @@ fi
 
 
 
@ -124,7 +71,7 @@ index 71fabf4dbb3..17f4f50673d 100644
 #
 # Copyright (c) 2011, 2015, Oracle and/or its affiliates. All rights reserved.
 # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
-@@ -49304,6 +49365,157 @@ fi
+@@ -50141,6 +50156,157 @@ fi
   LIBS="$save_LIBS"
 
 
@ -246,7 +193,7 @@ index 71fabf4dbb3..17f4f50673d 100644
 +/* end confdefs.h.  */
 +#include <nss3/pk11pub.h>
 +int
-+main ()
+main (void)
 +{
 +SECMOD_GetSystemFIPSEnabled()
 +  ;
@ -283,10 +230,10 @@ index 71fabf4dbb3..17f4f50673d 100644
   #
   # statically link libstdc++ before C++ ABI is stablized on Linux unless
 diff --git a/common/autoconf/libraries.m4 b/common/autoconf/libraries.m4
-index 6efae578ea9..0080846255b 100644
+index 4ed8b4fdd6..caf293be72 100644
 --- a/common/autoconf/libraries.m4
 +++ b/common/autoconf/libraries.m4
-@@ -1067,3 +1067,63 @@ AC_DEFUN_ONCE([LIB_SETUP_ON_WINDOWS],
+@@ -1216,3 +1216,63 @@ AC_DEFUN_ONCE([LIB_SETUP_ON_WINDOWS],
     BASIC_DEPRECATED_ARG_WITH([dxsdk-include])
   fi
 ])
@ -351,12 +298,12 @@ index 6efae578ea9..0080846255b 100644
 +  AC_SUBST(USE_SYSCONF_NSS)
 +])
 diff --git a/common/autoconf/spec.gmk.in b/common/autoconf/spec.gmk.in
-index 506cf617087..7241593b1a4 100644
+index 8da3ac32a0..4d081d1b84 100644
 --- a/common/autoconf/spec.gmk.in
 +++ b/common/autoconf/spec.gmk.in
-@@ -312,6 +312,10 @@ CUPS_CFLAGS:=@CUPS_CFLAGS@
- ALSA_LIBS:=@ALSA_LIBS@
- ALSA_CFLAGS:=@ALSA_CFLAGS@
+@@ -317,6 +317,10 @@ ENABLE_LIBFFI_BUNDLING:=@ENABLE_LIBFFI_BUNDLING@
+ LIBFFI_LIB_DIR:=@LIBFFI_LIB_DIR@
+ LIBFFI_LIB_FILE:=@LIBFFI_LIB_FILE@
 
 +USE_SYSCONF_NSS:=@USE_SYSCONF_NSS@
 +NSS_LIBS:=@NSS_LIBS@
@ -366,7 +313,7 @@ index 506cf617087..7241593b1a4 100644
 
 # Source file for cacerts
 diff --git a/common/bin/compare_exceptions.sh.incl b/common/bin/compare_exceptions.sh.incl
-index 3b79a526f56..d2a0e39b206 100644
+index 3b79a526f5..d2a0e39b20 100644
 --- a/common/bin/compare_exceptions.sh.incl
 +++ b/common/bin/compare_exceptions.sh.incl
@@ -280,6 +280,7 @@ ACCEPTED_SMALL_SIZE_DIFF="
@ -402,7 +349,7 @@ index 3b79a526f56..d2a0e39b206 100644
 ./jre/lib/sparcv9/libunpack.so
 ./jre/lib/sparcv9/libverify.so
 diff --git a/common/nb_native/nbproject/configurations.xml b/common/nb_native/nbproject/configurations.xml
-index d2beed0b93a..3b6aef98d9a 100644
+index d2beed0b93..3b6aef98d9 100644
 --- a/common/nb_native/nbproject/configurations.xml
 +++ b/common/nb_native/nbproject/configurations.xml
@@ -53,6 +53,9 @@
@ -428,10 +375,10 @@ index d2beed0b93a..3b6aef98d9a 100644
             ex="false"
             tool="0"
 diff --git a/jdk/make/lib/SecurityLibraries.gmk b/jdk/make/lib/SecurityLibraries.gmk
-index b0b85d80448..47a41d7518d 100644
+index 84abb7e76b..cb4531b880 100644
 --- a/jdk/make/lib/SecurityLibraries.gmk
 +++ b/jdk/make/lib/SecurityLibraries.gmk
-@@ -289,3 +289,34 @@ ifeq ($(OPENJDK_TARGET_OS), solaris)
+@@ -303,3 +303,34 @@ ifeq ($(OPENJDK_TARGET_OS), solaris)
 
   endif
 endif
@ -468,7 +415,7 @@ index b0b85d80448..47a41d7518d 100644
 +
 diff --git a/jdk/make/mapfiles/libsystemconf/mapfile-vers b/jdk/make/mapfiles/libsystemconf/mapfile-vers
 new file mode 100644
-index 00000000000..a65ceb3b78c
+index 0000000000..a65ceb3b78
 --- /dev/null
 +++ b/jdk/make/mapfiles/libsystemconf/mapfile-vers
@@ -0,0 +1,35 @@
@ -508,7 +455,7 @@ index 00000000000..a65ceb3b78c
 +		*;
 +};
 diff --git a/jdk/src/share/classes/java/security/Security.java b/jdk/src/share/classes/java/security/Security.java
-index 0db09da7061..813b907db3e 100644
+index 0db09da706..813b907db3 100644
 --- a/jdk/src/share/classes/java/security/Security.java
 +++ b/jdk/src/share/classes/java/security/Security.java
@@ -30,6 +30,8 @@ import java.util.*;
@ -640,7 +587,7 @@ index 0db09da7061..813b907db3e 100644
     /*
 diff --git a/jdk/src/share/classes/java/security/SystemConfigurator.java b/jdk/src/share/classes/java/security/SystemConfigurator.java
 new file mode 100644
-index 00000000000..a24a0445db2
+index 0000000000..a24a0445db
 --- /dev/null
 +++ b/jdk/src/share/classes/java/security/SystemConfigurator.java
@@ -0,0 +1,248 @@
@ -894,7 +841,7 @@ index 00000000000..a24a0445db2
 +}
 diff --git a/jdk/src/share/classes/sun/misc/JavaSecuritySystemConfiguratorAccess.java b/jdk/src/share/classes/sun/misc/JavaSecuritySystemConfiguratorAccess.java
 new file mode 100644
-index 00000000000..5c30a8b29c7
+index 0000000000..5c30a8b29c
 --- /dev/null
 +++ b/jdk/src/share/classes/sun/misc/JavaSecuritySystemConfiguratorAccess.java
@@ -0,0 +1,31 @@
@ -930,7 +877,7 @@ index 00000000000..5c30a8b29c7
 +    boolean isPlainKeySupportEnabled();
 +}
 diff --git a/jdk/src/share/classes/sun/misc/SharedSecrets.java b/jdk/src/share/classes/sun/misc/SharedSecrets.java
-index f065a2c685d..0dafe6f59cf 100644
+index f065a2c685..0dafe6f59c 100644
 --- a/jdk/src/share/classes/sun/misc/SharedSecrets.java
 +++ b/jdk/src/share/classes/sun/misc/SharedSecrets.java
@@ -31,6 +31,7 @@ import java.io.Console;
@ -967,7 +914,7 @@ index f065a2c685d..0dafe6f59cf 100644
 }
 diff --git a/jdk/src/share/classes/sun/security/pkcs11/FIPSKeyImporter.java b/jdk/src/share/classes/sun/security/pkcs11/FIPSKeyImporter.java
 new file mode 100644
-index 00000000000..14d19450390
+index 0000000000..14d1945039
 --- /dev/null
 +++ b/jdk/src/share/classes/sun/security/pkcs11/FIPSKeyImporter.java
@@ -0,0 +1,290 @@
@ -1262,7 +1209,7 @@ index 00000000000..14d19450390
 +    }
 +}
 diff --git a/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java b/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java
-index fedcd7743ef..f9d70863bd1 100644
+index fedcd7743e..f9d70863bd 100644
 --- a/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java
 +++ b/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java
@@ -26,6 +26,9 @@
@ -1366,7 +1313,7 @@ index fedcd7743ef..f9d70863bd1 100644
             if (config.getHandleStartupErrors() == Config.ERR_IGNORE_ALL) {
                 throw new UnsupportedOperationException
 diff --git a/jdk/src/share/classes/sun/security/pkcs11/wrapper/PKCS11.java b/jdk/src/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
-index 2e42d1d9fb0..1b7eed1c656 100644
+index 2e42d1d9fb..1b7eed1c65 100644
 --- a/jdk/src/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
 +++ b/jdk/src/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
@@ -49,6 +49,7 @@ package sun.security.pkcs11.wrapper;
@ -1493,7 +1440,7 @@ index 2e42d1d9fb0..1b7eed1c656 100644
 +}
 }
 diff --git a/jdk/src/share/classes/sun/security/ssl/KeyManagerFactoryImpl.java b/jdk/src/share/classes/sun/security/ssl/KeyManagerFactoryImpl.java
-index ffee2c1603b..98119479823 100644
+index ffee2c1603..9811947982 100644
 --- a/jdk/src/share/classes/sun/security/ssl/KeyManagerFactoryImpl.java
 +++ b/jdk/src/share/classes/sun/security/ssl/KeyManagerFactoryImpl.java
@@ -33,8 +33,13 @@ import java.security.KeyStore.*;
@ -1532,7 +1479,7 @@ index ffee2c1603b..98119479823 100644
                         "FIPS mode: KeyStore must be " +
                         "from provider " + SunJSSE.cryptoProvider.getName());
 diff --git a/jdk/src/share/classes/sun/security/ssl/SSLContextImpl.java b/jdk/src/share/classes/sun/security/ssl/SSLContextImpl.java
-index 820e10164fc..6fe2c29389f 100644
+index 820e10164f..6fe2c29389 100644
 --- a/jdk/src/share/classes/sun/security/ssl/SSLContextImpl.java
 +++ b/jdk/src/share/classes/sun/security/ssl/SSLContextImpl.java
@@ -31,6 +31,7 @@ import java.security.*;
@ -1630,7 +1577,7 @@ index 820e10164fc..6fe2c29389f 100644
                         ProtocolVersion.TLS13,
                         ProtocolVersion.TLS12,
 diff --git a/jdk/src/share/classes/sun/security/ssl/SunJSSE.java b/jdk/src/share/classes/sun/security/ssl/SunJSSE.java
-index 2845dc37938..52337a7b6cf 100644
+index 2845dc3793..52337a7b6c 100644
 --- a/jdk/src/share/classes/sun/security/ssl/SunJSSE.java
 +++ b/jdk/src/share/classes/sun/security/ssl/SunJSSE.java
@@ -30,6 +30,8 @@ import static sun.security.util.SecurityConstants.PROVIDER_VER;
@ -1659,7 +1606,7 @@ index 2845dc37938..52337a7b6cf 100644
             "sun.security.ssl.SSLContextImpl$TLSContext");
         if (isfips == false) {
 diff --git a/jdk/src/share/lib/security/java.security-aix b/jdk/src/share/lib/security/java.security-aix
-index 7a93d4e6b59..681a24b905d 100644
+index 37bca2df46..730212b601 100644
 --- a/jdk/src/share/lib/security/java.security-aix
 +++ b/jdk/src/share/lib/security/java.security-aix
@@ -287,6 +287,13 @@ package.definition=sun.,\
@ -1677,7 +1624,7 @@ index 7a93d4e6b59..681a24b905d 100644
 # Determines the default key and trust manager factory algorithms for
 # the javax.net.ssl package.
 diff --git a/jdk/src/share/lib/security/java.security-linux b/jdk/src/share/lib/security/java.security-linux
-index 145a84f94cf..789c19a8cba 100644
+index 9bb8e992fb..a1b3943b11 100644
 --- a/jdk/src/share/lib/security/java.security-linux
 +++ b/jdk/src/share/lib/security/java.security-linux
@@ -75,6 +75,14 @@ security.provider.7=com.sun.security.sasl.Provider
@ -1722,7 +1669,7 @@ index 145a84f94cf..789c19a8cba 100644
 # Determines the default key and trust manager factory algorithms for
 # the javax.net.ssl package.
 diff --git a/jdk/src/share/lib/security/java.security-macosx b/jdk/src/share/lib/security/java.security-macosx
-index 35fa140d7a5..d4da666af3b 100644
+index 7a765742e6..5abd95fff8 100644
 --- a/jdk/src/share/lib/security/java.security-macosx
 +++ b/jdk/src/share/lib/security/java.security-macosx
@@ -290,6 +290,13 @@ package.definition=sun.,\
@ -1740,7 +1687,7 @@ index 35fa140d7a5..d4da666af3b 100644
 # Determines the default key and trust manager factory algorithms for
 # the javax.net.ssl package.
 diff --git a/jdk/src/share/lib/security/java.security-solaris b/jdk/src/share/lib/security/java.security-solaris
-index f79ba37ddb9..300132384a1 100644
+index f0100336f5..2f4c6c2fd6 100644
 --- a/jdk/src/share/lib/security/java.security-solaris
 +++ b/jdk/src/share/lib/security/java.security-solaris
@@ -288,6 +288,13 @@ package.definition=sun.,\
@ -1758,7 +1705,7 @@ index f79ba37ddb9..300132384a1 100644
 # Determines the default key and trust manager factory algorithms for
 # the javax.net.ssl package.
 diff --git a/jdk/src/share/lib/security/java.security-windows b/jdk/src/share/lib/security/java.security-windows
-index d70503ce95f..64db5a5cd1e 100644
+index e51bdece13..b4a509753b 100644
 --- a/jdk/src/share/lib/security/java.security-windows
 +++ b/jdk/src/share/lib/security/java.security-windows
@@ -290,6 +290,13 @@ package.definition=sun.,\
@ -1777,7 +1724,7 @@ index d70503ce95f..64db5a5cd1e 100644
 # the javax.net.ssl package.
 diff --git a/jdk/src/solaris/native/java/security/systemconf.c b/jdk/src/solaris/native/java/security/systemconf.c
 new file mode 100644
-index 00000000000..8dcb7d9073f
+index 0000000000..8dcb7d9073
 --- /dev/null
 +++ b/jdk/src/solaris/native/java/security/systemconf.c
@@ -0,0 +1,224 @@
--- a/SOURCES/java-1.8.0-openjdk-portable.specfile
+++ b/SOURCES/java-1.8.0-openjdk-portable.specfile
@ -269,7 +269,7 @@
 # Define version of OpenJDK 8 used
 %global project openjdk
 %global repo shenandoah-jdk8u
-%global openjdk_revision 8u432-b06
+%global openjdk_revision 8u452-b09
 %global shenandoah_revision shenandoah%{openjdk_revision}
 # Define IcedTea version used for SystemTap tapsets and desktop file
 %global icedteaver      3.15.0
@ -595,6 +595,9 @@ Patch581: jdk8257794-remove_broken_assert.patch
 Patch12: jdk8186464-rh1433262-zip64_failure.patch
 # JDK-8328999, RH2251025 - Update GIFlib to 5.2.2 (PR#571)
 Patch13: jdk8328999-update_giflib_5.2.2.patch
+# JDK-8141590 - Cannot build Zero with devkit
+Patch14: jdk8141590-bundle_libffi.patch
+Patch15: jdk8141590-bundle_libffi-followup.patch

 #############################################
 #
@ -875,6 +878,8 @@ popd
 pushd %{top_level_dir_name}
 %patch -P502 -p1
 %patch -P13 -p1
+%patch -P14 -p1
+%patch -P15 -p1
 popd

 pushd %{top_level_dir_name}
@ -1004,6 +1009,7 @@ function buildjdk() {
 %endif
 %ifarch %{zero_arches}
    --with-jvm-variants=zero \
+    --enable-libffi-bundling \
 %endif
    --with-cacerts-file=`readlink -f %{_sysconfdir}/pki/java/cacerts`  \
    --with-native-debug-symbols=${debug_symbols} \
@ -1173,10 +1179,12 @@ function packagejdk() {
        # Strip the files
        for file in $(find ${jdkname} ${jrename} -type f) ; do
            if file ${file} | grep -q 'ELF'; then
-                noextfile=${file/.so/};
-                objcopy --only-keep-debug ${file} ${noextfile}.debuginfo;
-                objcopy --add-gnu-debuglink=${noextfile}.debuginfo ${file};
-                strip -g ${file};
+                if ! echo ${file} | grep -q 'libffi' ; then
+                  noextfile=${file/.so/};
+                  objcopy --only-keep-debug ${file} ${noextfile}.debuginfo;
+                  objcopy --add-gnu-debuglink=${noextfile}.debuginfo ${file};
+                  strip -g ${file};
+                fi
            fi
        done

@ -1539,6 +1547,29 @@ done
 %endif

 %changelog
+* Fri Apr 11 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.452.b09-1
+- Update to 8u452-b09 (GA)
+- Update release notes for 8u452-b09.
+- Remove long option documentation from JDK-8335912/JDK-8337499 as not present in 8u
+- ** This tarball is embargoed until 2025-04-15 @ 1pm PT. **
+
+* Thu Jan 16 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.442.b06-1
+- Update to 8u442-b06 (GA)
+- Update release notes for 8u442-b06.
+- Switch to GA mode for final release
+- Revise JDK-8141590 backport to install libffi.so* in lib as well as jre/lib
+
+* Thu Jan 16 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.442.b05-0.2.ea
+- Include backport of JDK-8141590 to allow bundling of libffi on Zero architectures
+- Rebase FIPS patch after application of 8141590
+- Add local patch on top of 8141590 to improve path detection for s390x
+- Don't attempt to strip libffi.so*
+
+* Mon Jan 06 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.442.b05-0.1.ea
+- Update to 8u442-b05 (EA).
+- Update release notes for 8u442-b05.
+- Switch to EA mode for pre-release.
+
 * Fri Oct 11 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.432.b06-1
 - Update to shenandoah-jdk8u432-b06 (GA)
 - Update release notes for shenandoah-8u432-b06.
--- a/SOURCES/jdk8141590-bundle_libffi-followup.patch
+++ b/SOURCES/jdk8141590-bundle_libffi-followup.patch
@ -0,0 +1,51 @@
+commit 928f3bf4a3017931ecc7012688e62d8a03264e61
+Author:     Andrew Hughes <gnu.andrew@redhat.com>
+AuthorDate: Thu Jan 16 17:40:36 2025 +0000
+Commit:     Andrew Hughes <gnu.andrew@redhat.com>
+CommitDate: Thu Jan 16 22:50:24 2025 +0000
+
+    Search /usr/lib64 on architectures other than x86_64
+
+diff --git a/common/autoconf/generated-configure.sh b/common/autoconf/generated-configure.sh
+index 587b4c2657..5aeebe49a3 100644
+--- a/common/autoconf/generated-configure.sh
+++ b/common/autoconf/generated-configure.sh
+@@ -4493,7 +4493,7 @@ VS_TOOLSET_SUPPORTED_2022=true
+ #CUSTOM_AUTOCONF_INCLUDE
+ 
+ # Do not change or remove the following line, it is needed for consistency checks:
+-DATE_WHEN_GENERATED=1737049912
+DATE_WHEN_GENERATED=1737067804
+ 
+ ###############################################################################
+ #
+@@ -50590,9 +50590,11 @@ $as_echo_n "checking for libffi lib file location... " >&6; }
+             as_fn_error $? "Could not locate libffi.so.? for bundling" "$LINENO" 5
+           fi
+         else
+-          # Fallback on the default /usr/lib dir
+          # Fallback on the default /usr/lib and /usr/lib64 dirs
+           if test -e ${SYSROOT}/usr/lib/libffi.so.? ; then
+             LIBFFI_LIB_FILE="${SYSROOT}/usr/lib/libffi.so.?"
+          elif test -e ${SYSROOT}/usr/lib64/libffi.so.? ; then
+            LIBFFI_LIB_FILE="${SYSROOT}/usr/lib64/libffi.so.?"
+           else
+             as_fn_error $? "Could not locate libffi.so.? for bundling" "$LINENO" 5
+           fi
+diff --git a/common/autoconf/libraries.m4 b/common/autoconf/libraries.m4
+index 4ed8b4fdd6..6ab6dbc075 100644
+--- a/common/autoconf/libraries.m4
+++ b/common/autoconf/libraries.m4
+@@ -1121,9 +1121,11 @@ AC_DEFUN_ONCE([LIB_SETUP_STATIC_LINK_LIBSTDCPP],
+             AC_MSG_ERROR([Could not locate libffi.so.? for bundling])
+           fi
+         else
+-          # Fallback on the default /usr/lib dir
+          # Fallback on the default /usr/lib and /usr/lib64 dirs
+           if test -e ${SYSROOT}/usr/lib/libffi.so.? ; then
+             LIBFFI_LIB_FILE="${SYSROOT}/usr/lib/libffi.so.?"
+          elif test -e ${SYSROOT}/usr/lib64/libffi.so.? ; then
+            LIBFFI_LIB_FILE="${SYSROOT}/usr/lib64/libffi.so.?"
+           else
+             AC_MSG_ERROR([Could not locate libffi.so.? for bundling])
+           fi
--- a/SOURCES/jdk8141590-bundle_libffi.patch
+++ b/SOURCES/jdk8141590-bundle_libffi.patch
@ -0,0 +1,763 @@
+diff --git a/common/autoconf/generated-configure.sh b/common/autoconf/generated-configure.sh
+index ad3f7f232e..587b4c2657 100644
+--- a/common/autoconf/generated-configure.sh
+++ b/common/autoconf/generated-configure.sh
+@@ -649,6 +649,9 @@ LLVM_LIBS
+ LLVM_LDFLAGS
+ LLVM_CFLAGS
+ LLVM_CONFIG
+LIBFFI_LIB_FILE
+LIBFFI_LIB_DIR
+ENABLE_LIBFFI_BUNDLING
+ LIBFFI_LIBS
+ LIBFFI_CFLAGS
+ STATIC_CXX_SETTING
+@@ -1117,6 +1120,10 @@ with_fontconfig_include
+ with_giflib
+ with_zlib
+ with_stdc__lib
+with_libffi
+with_libffi_include
+with_libffi_lib
+enable_libffi_bundling
+ with_msvcr_dll
+ with_msvcp_dll
+ with_vcruntime_1_dll
+@@ -1867,6 +1874,9 @@ Optional Features:
+                           disable bundling of the freetype library with the
+                           build result [enabled on Windows or when using
+                           --with-freetype, disabled otherwise]
+  --enable-libffi-bundling
+                          enable bundling of libffi.so to make the built JDK
+                          runnable on more systems
+   --enable-sjavac         use sjavac to do fast incremental compiles
+                           [disabled]
+   --disable-precompiled-headers
+@@ -1996,6 +2006,11 @@ Optional Packages:
+                           force linking of the C++ runtime on Linux to either
+                           static or dynamic, default is static with dynamic as
+                           fallback
+  --with-libffi           specify prefix directory for the libffi package
+                          (expecting the libraries under PATH/lib and the
+                          headers under PATH/include)
+  --with-libffi-include   specify directory for the libffi include files
+  --with-libffi-lib       specify directory for the libffi library
+   --with-msvcr-dll        path to microsoft C runtime dll (msvcr*.dll)
+                           (Windows only) [probed]
+   --with-msvcp-dll        path to microsoft C++ runtime dll (msvcp*.dll)
+@@ -2878,6 +2893,52 @@ $as_echo "$ac_res" >&6; }
+   eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
+ 
+ } # ac_fn_c_check_header_compile
+
+# ac_fn_c_try_link LINENO
+# -----------------------
+# Try to link conftest.$ac_ext, and return whether this succeeded.
+ac_fn_c_try_link ()
+{
+  as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
+  rm -f conftest.$ac_objext conftest$ac_exeext
+  if { { ac_try="$ac_link"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
+$as_echo "$ac_try_echo"; } >&5
+  (eval "$ac_link") 2>conftest.err
+  ac_status=$?
+  if test -s conftest.err; then
+    grep -v '^ *+' conftest.err >conftest.er1
+    cat conftest.er1 >&5
+    mv -f conftest.er1 conftest.err
+  fi
+  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; } && {
+	 test -z "$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       } && test -s conftest$ac_exeext && {
+	 test "$cross_compiling" = yes ||
+	 test -x conftest$ac_exeext
+       }; then :
+  ac_retval=0
+else
+  $as_echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+	ac_retval=1
+fi
+  # Delete the IPA/IPO (Inter Procedural Analysis/Optimization) information
+  # created by the PGI compiler (conftest_ipa8_conftest.oo), as it would
+  # interfere with the next link command; also delete a directory that is
+  # left behind by Apple's compiler.  We do this before executing the actions.
+  rm -rf conftest.dSYM conftest_ipa8_conftest.oo
+  eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
+  as_fn_set_status $ac_retval
+
+} # ac_fn_c_try_link
+ cat >config.log <<_ACEOF
+ This file contains any messages produced by compilers while
+ running configure, to aid debugging if configure makes a mistake.
+@@ -4432,7 +4493,7 @@ VS_TOOLSET_SUPPORTED_2022=true
+ #CUSTOM_AUTOCONF_INCLUDE
+ 
+ # Do not change or remove the following line, it is needed for consistency checks:
+-DATE_WHEN_GENERATED=1716396030
+DATE_WHEN_GENERATED=1737049912
+ 
+ ###############################################################################
+ #
+@@ -50215,8 +50276,70 @@ $as_echo "static" >&6; }
+   fi
+ 
+ 
+
+# Check whether --with-libffi was given.
+if test "${with_libffi+set}" = set; then :
+  withval=$with_libffi;
+fi
+
+
+# Check whether --with-libffi-include was given.
+if test "${with_libffi_include+set}" = set; then :
+  withval=$with_libffi_include;
+fi
+
+
+# Check whether --with-libffi-lib was given.
+if test "${with_libffi_lib+set}" = set; then :
+  withval=$with_libffi_lib;
+fi
+
+  # Check whether --enable-libffi-bundling was given.
+if test "${enable_libffi_bundling+set}" = set; then :
+  enableval=$enable_libffi_bundling;
+fi
+
+
+  # Check if ffi is needed
+   if test "x$JVM_VARIANT_ZERO" = xtrue || test "x$JVM_VARIANT_ZEROSHARK" = xtrue; then
+-    # Figure out LIBFFI_CFLAGS and LIBFFI_LIBS
+    NEEDS_LIB_FFI=true
+  else
+    NEEDS_LIB_FFI=false
+  fi
+
+  if test "x$NEEDS_LIB_FFI" = xfalse; then
+    if test "x${with_libffi}" != x || test "x${with_libffi_include}" != x || test "x${with_libffi_lib}" != x; then
+      { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: libffi not used, so --with-libffi is ignored" >&5
+$as_echo "$as_me: WARNING: libffi not used, so --with-libffi is ignored" >&2;}
+    fi
+    LIBFFI_CFLAGS=
+    LIBFFI_LIBS=
+  else
+    LIBFFI_FOUND=no
+
+    if test "x${with_libffi}" = xno || test "x${with_libffi_include}" = xno || test "x${with_libffi_lib}" = xno; then
+      as_fn_error $? "It is not possible to disable the use of libffi. Remove the --without-libffi option." "$LINENO" 5
+    fi
+
+    if test "x${with_libffi}" != x; then
+      LIBFFI_LIB_PATH="${with_libffi}/lib"
+      LIBFFI_LIBS="-L${with_libffi}/lib -lffi"
+      LIBFFI_CFLAGS="-I${with_libffi}/include"
+      LIBFFI_FOUND=yes
+    fi
+    if test "x${with_libffi_include}" != x; then
+      LIBFFI_CFLAGS="-I${with_libffi_include}"
+      LIBFFI_FOUND=yes
+    fi
+    if test "x${with_libffi_lib}" != x; then
+      LIBFFI_LIB_PATH="${with_libffi_lib}"
+      LIBFFI_LIBS="-L${with_libffi_lib} -lffi"
+      LIBFFI_FOUND=yes
+    fi
+    # Do not try pkg-config if we have a sysroot set.
+    if test "x$SYSROOT" = x; then
+      if test "x$LIBFFI_FOUND" = xno; then
+        # Figure out LIBFFI_CFLAGS and LIBFFI_LIBS
+ 
+ pkg_failed=no
+ { $as_echo "$as_me:${as_lineno-$LINENO}: checking for LIBFFI" >&5
+@@ -50272,40 +50395,224 @@ fi
+ 	# Put the nasty error message in config.log where it belongs
+ 	echo "$LIBFFI_PKG_ERRORS" >&5
+ 
+-	as_fn_error $? "Package requirements (libffi) were not met:
+-
+-$LIBFFI_PKG_ERRORS
+-
+-Consider adjusting the PKG_CONFIG_PATH environment variable if you
+-installed software in a non-standard prefix.
+-
+-Alternatively, you may set the environment variables LIBFFI_CFLAGS
+-and LIBFFI_LIBS to avoid the need to call pkg-config.
+-See the pkg-config man page for more details.
+-" "$LINENO" 5
+	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+                LIBFFI_FOUND=no
+ elif test $pkg_failed = untried; then
+-	{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+-$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
+-as_fn_error $? "The pkg-config script could not be found or is too old.  Make sure it
+-is in your PATH or set the PKG_CONFIG environment variable to the full
+-path to pkg-config.
+-
+-Alternatively, you may set the environment variables LIBFFI_CFLAGS
+-and LIBFFI_LIBS to avoid the need to call pkg-config.
+-See the pkg-config man page for more details.
+-
+-To get pkg-config, see <http://pkg-config.freedesktop.org/>.
+-See \`config.log' for more details" "$LINENO" 5; }
+	LIBFFI_FOUND=no
+ else
+ 	LIBFFI_CFLAGS=$pkg_cv_LIBFFI_CFLAGS
+ 	LIBFFI_LIBS=$pkg_cv_LIBFFI_LIBS
+         { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+ $as_echo "yes" >&6; }
+-	:
+	LIBFFI_FOUND=yes
+fi
+      fi
+    fi
+    if test "x$LIBFFI_FOUND" = xno; then
+      for ac_header in ffi.h
+do :
+  ac_fn_cxx_check_header_mongrel "$LINENO" "ffi.h" "ac_cv_header_ffi_h" "$ac_includes_default"
+if test "x$ac_cv_header_ffi_h" = xyes; then :
+  cat >>confdefs.h <<_ACEOF
+#define HAVE_FFI_H 1
+_ACEOF
+
+            LIBFFI_FOUND=yes
+            LIBFFI_CFLAGS=
+            LIBFFI_LIBS=-lffi
+
+else
+  LIBFFI_FOUND=no
+
+fi
+
+done
+
+    fi
+    if test "x$LIBFFI_FOUND" = xno; then
+
+  # Print a helpful message on how to acquire the necessary build dependency.
+  # ffi is the help tag: freetype, cups, pulse, alsa etc
+  MISSING_DEPENDENCY=ffi
+
+  if test "x$OPENJDK_BUILD_OS_ENV" = "xwindows.cygwin"; then
+    cygwin_help $MISSING_DEPENDENCY
+  elif test "x$OPENJDK_BUILD_OS_ENV" = "xwindows.msys"; then
+    msys_help $MISSING_DEPENDENCY
+  else
+    PKGHANDLER_COMMAND=
+
+    case $PKGHANDLER in
+      apt-get)
+        apt_help     $MISSING_DEPENDENCY ;;
+      yum)
+        yum_help     $MISSING_DEPENDENCY ;;
+      port)
+        port_help    $MISSING_DEPENDENCY ;;
+      pkgutil)
+        pkgutil_help $MISSING_DEPENDENCY ;;
+      pkgadd)
+        pkgadd_help  $MISSING_DEPENDENCY ;;
+    esac
+
+    if test "x$PKGHANDLER_COMMAND" != x; then
+      HELP_MSG="You might be able to fix this by running '$PKGHANDLER_COMMAND'."
+    fi
+  fi
+
+      as_fn_error $? "Could not find libffi! $HELP_MSG" "$LINENO" 5
+    fi
+
+    { $as_echo "$as_me:${as_lineno-$LINENO}: checking if libffi works" >&5
+$as_echo_n "checking if libffi works... " >&6; }
+    ac_ext=c
+ac_cpp='$CPP $CPPFLAGS'
+ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
+ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
+ac_compiler_gnu=$ac_cv_c_compiler_gnu
+
+    OLD_CFLAGS="$CFLAGS"
+    CFLAGS="$CFLAGS $LIBFFI_CFLAGS"
+    OLD_LIBS="$LIBS"
+    LIBS="$LIBS $LIBFFI_LIBS"
+    cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#include <ffi.h>
+int
+main (void)
+{
+
+          ffi_call(NULL, NULL, NULL, NULL);
+          return 0;
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"; then :
+  LIBFFI_WORKS=yes
+else
+  LIBFFI_WORKS=no
+
+ fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext conftest.$ac_ext
+    CFLAGS="$OLD_CFLAGS"
+    LIBS="$OLD_LIBS"
+    ac_ext=cpp
+ac_cpp='$CXXCPP $CPPFLAGS'
+ac_compile='$CXX -c $CXXFLAGS $CPPFLAGS conftest.$ac_ext >&5'
+ac_link='$CXX -o conftest$ac_exeext $CXXFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
+ac_compiler_gnu=$ac_cv_cxx_compiler_gnu
+
+    { $as_echo "$as_me:${as_lineno-$LINENO}: result: $LIBFFI_WORKS" >&5
+$as_echo "$LIBFFI_WORKS" >&6; }
+ 
+    if test "x$LIBFFI_WORKS" = xno; then
+
+  # Print a helpful message on how to acquire the necessary build dependency.
+  # ffi is the help tag: freetype, cups, pulse, alsa etc
+  MISSING_DEPENDENCY=ffi
+
+  if test "x$OPENJDK_BUILD_OS_ENV" = "xwindows.cygwin"; then
+    cygwin_help $MISSING_DEPENDENCY
+  elif test "x$OPENJDK_BUILD_OS_ENV" = "xwindows.msys"; then
+    msys_help $MISSING_DEPENDENCY
+  else
+    PKGHANDLER_COMMAND=
+
+    case $PKGHANDLER in
+      apt-get)
+        apt_help     $MISSING_DEPENDENCY ;;
+      yum)
+        yum_help     $MISSING_DEPENDENCY ;;
+      port)
+        port_help    $MISSING_DEPENDENCY ;;
+      pkgutil)
+        pkgutil_help $MISSING_DEPENDENCY ;;
+      pkgadd)
+        pkgadd_help  $MISSING_DEPENDENCY ;;
+    esac
+
+    if test "x$PKGHANDLER_COMMAND" != x; then
+      HELP_MSG="You might be able to fix this by running '$PKGHANDLER_COMMAND'."
+    fi
+   fi
+ 
+      as_fn_error $? "Found libffi but could not link and compile with it. $HELP_MSG" "$LINENO" 5
+    fi
+
+    { $as_echo "$as_me:${as_lineno-$LINENO}: checking if libffi should be bundled" >&5
+$as_echo_n "checking if libffi should be bundled... " >&6; }
+    if test "x$enable_libffi_bundling" = "x"; then
+      { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+      ENABLE_LIBFFI_BUNDLING=false
+    elif  test "x$enable_libffi_bundling" = "xno"; then
+      { $as_echo "$as_me:${as_lineno-$LINENO}: result: no, forced" >&5
+$as_echo "no, forced" >&6; }
+      ENABLE_LIBFFI_BUNDLING=false
+    elif  test "x$enable_libffi_bundling" = "xyes"; then
+      { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes, forced" >&5
+$as_echo "yes, forced" >&6; }
+      ENABLE_LIBFFI_BUNDLING=true
+    else
+      as_fn_error $? "Invalid value for --enable-libffi-bundling" "$LINENO" 5
+    fi
+
+    # Find the libffi.so.X to bundle
+    if test "x${ENABLE_LIBFFI_BUNDLING}" = "xtrue"; then
+      { $as_echo "$as_me:${as_lineno-$LINENO}: checking for libffi lib file location" >&5
+$as_echo_n "checking for libffi lib file location... " >&6; }
+      if test "x${LIBFFI_LIB_PATH}" != x; then
+        if test -e ${LIBFFI_LIB_PATH}/libffi.so.?; then
+          LIBFFI_LIB_FILE="${LIBFFI_LIB_PATH}/libffi.so.?"
+        else
+          as_fn_error $? "Could not locate libffi.so.? for bundling in ${LIBFFI_LIB_PATH}" "$LINENO" 5
+        fi
+      else
+        # If we don't have an explicit path, look in a few obvious places
+        if test "x${OPENJDK_TARGET_CPU}" = "xx86"; then
+          if test -e ${SYSROOT}/usr/lib/libffi.so.? ; then
+            LIBFFI_LIB_FILE="${SYSROOT}/usr/lib/libffi.so.?"
+          elif test -e ${SYSROOT}/usr/lib/i386-linux-gnu/libffi.so.? ; then
+            LIBFFI_LIB_FILE="${SYSROOT}/usr/lib/i386-linux-gnu/libffi.so.?"
+          else
+            as_fn_error $? "Could not locate libffi.so.? for bundling" "$LINENO" 5
+          fi
+        elif test "x${OPENJDK_TARGET_CPU}" = "xx86_64"; then
+          if test -e ${SYSROOT}/usr/lib64/libffi.so.? ; then
+            LIBFFI_LIB_FILE="${SYSROOT}/usr/lib64/libffi.so.?"
+          elif test -e ${SYSROOT}/usr/lib/x86_64-linux-gnu/libffi.so.? ; then
+            LIBFFI_LIB_FILE="${SYSROOT}/usr/lib/x86_64-linux-gnu/libffi.so.?"
+          else
+            as_fn_error $? "Could not locate libffi.so.? for bundling" "$LINENO" 5
+          fi
+        else
+          # Fallback on the default /usr/lib dir
+          if test -e ${SYSROOT}/usr/lib/libffi.so.? ; then
+            LIBFFI_LIB_FILE="${SYSROOT}/usr/lib/libffi.so.?"
+          else
+            as_fn_error $? "Could not locate libffi.so.? for bundling" "$LINENO" 5
+          fi
+        fi
+      fi
+      # Make sure the wildcard is evaluated
+      LIBFFI_LIB_FILE="$(ls ${LIBFFI_LIB_FILE})"
+      LIBFFI_LIB_DIR="$(dirname ${LIBFFI_LIB_FILE})"
+      LIBFFI_LIB_FILE="$(basename ${LIBFFI_LIB_FILE})"
+      { $as_echo "$as_me:${as_lineno-$LINENO}: result: ${LIBFFI_LIB_FILE} in ${LIBFFI_LIB_DIR}" >&5
+$as_echo "${LIBFFI_LIB_FILE} in ${LIBFFI_LIB_DIR}" >&6; }
+    fi
+  fi
+
+
+
+
+
+
+
+   if test "x$JVM_VARIANT_ZEROSHARK" = xtrue; then
+     # Extract the first word of "llvm-config", so it can be a program name with args.
+ set dummy llvm-config; ac_word=$2
+diff --git a/common/autoconf/libraries.m4 b/common/autoconf/libraries.m4
+index 6efae578ea..4ed8b4fdd6 100644
+--- a/common/autoconf/libraries.m4
+++ b/common/autoconf/libraries.m4
+@@ -988,12 +988,161 @@ AC_DEFUN_ONCE([LIB_SETUP_STATIC_LINK_LIBSTDCPP],
+   fi
+   AC_SUBST(STATIC_CXX_SETTING)
+ 
+  AC_ARG_WITH(libffi, [AS_HELP_STRING([--with-libffi],
+      [specify prefix directory for the libffi package
+      (expecting the libraries under PATH/lib and the headers under PATH/include)])])
+  AC_ARG_WITH(libffi-include, [AS_HELP_STRING([--with-libffi-include],
+      [specify directory for the libffi include files])])
+  AC_ARG_WITH(libffi-lib, [AS_HELP_STRING([--with-libffi-lib],
+      [specify directory for the libffi library])])
+  AC_ARG_ENABLE(libffi-bundling, [AS_HELP_STRING([--enable-libffi-bundling],
+      [enable bundling of libffi.so to make the built JDK runnable on more systems])])
+
+  # Check if ffi is needed
+   if test "x$JVM_VARIANT_ZERO" = xtrue || test "x$JVM_VARIANT_ZEROSHARK" = xtrue; then
+-    # Figure out LIBFFI_CFLAGS and LIBFFI_LIBS
+-    PKG_CHECK_MODULES([LIBFFI], [libffi])
+    NEEDS_LIB_FFI=true
+  else
+    NEEDS_LIB_FFI=false
+  fi
+
+  if test "x$NEEDS_LIB_FFI" = xfalse; then
+    if test "x${with_libffi}" != x || test "x${with_libffi_include}" != x || test "x${with_libffi_lib}" != x; then
+      AC_MSG_WARN([libffi not used, so --with-libffi is ignored])
+    fi
+    LIBFFI_CFLAGS=
+    LIBFFI_LIBS=
+  else
+    LIBFFI_FOUND=no
+ 
+    if test "x${with_libffi}" = xno || test "x${with_libffi_include}" = xno || test "x${with_libffi_lib}" = xno; then
+      AC_MSG_ERROR([It is not possible to disable the use of libffi. Remove the --without-libffi option.])
+    fi
+
+    if test "x${with_libffi}" != x; then
+      LIBFFI_LIB_PATH="${with_libffi}/lib"
+      LIBFFI_LIBS="-L${with_libffi}/lib -lffi"
+      LIBFFI_CFLAGS="-I${with_libffi}/include"
+      LIBFFI_FOUND=yes
+    fi
+    if test "x${with_libffi_include}" != x; then
+      LIBFFI_CFLAGS="-I${with_libffi_include}"
+      LIBFFI_FOUND=yes
+    fi
+    if test "x${with_libffi_lib}" != x; then
+      LIBFFI_LIB_PATH="${with_libffi_lib}"
+      LIBFFI_LIBS="-L${with_libffi_lib} -lffi"
+      LIBFFI_FOUND=yes
+    fi
+    # Do not try pkg-config if we have a sysroot set.
+    if test "x$SYSROOT" = x; then
+      if test "x$LIBFFI_FOUND" = xno; then
+        # Figure out LIBFFI_CFLAGS and LIBFFI_LIBS
+        PKG_CHECK_MODULES([LIBFFI], [libffi], [LIBFFI_FOUND=yes], [LIBFFI_FOUND=no])
+      fi
+    fi
+    if test "x$LIBFFI_FOUND" = xno; then
+      AC_CHECK_HEADERS([ffi.h],
+          [
+            LIBFFI_FOUND=yes
+            LIBFFI_CFLAGS=
+            LIBFFI_LIBS=-lffi
+          ],
+          [LIBFFI_FOUND=no]
+      )
+    fi
+    if test "x$LIBFFI_FOUND" = xno; then
+      HELP_MSG_MISSING_DEPENDENCY([ffi])
+      AC_MSG_ERROR([Could not find libffi! $HELP_MSG])
+    fi
+
+    AC_MSG_CHECKING([if libffi works])
+    AC_LANG_PUSH(C)
+    OLD_CFLAGS="$CFLAGS"
+    CFLAGS="$CFLAGS $LIBFFI_CFLAGS"
+    OLD_LIBS="$LIBS"
+    LIBS="$LIBS $LIBFFI_LIBS"
+    AC_LINK_IFELSE([AC_LANG_PROGRAM([#include <ffi.h>],
+        [
+          ffi_call(NULL, NULL, NULL, NULL);
+          return 0;
+        ])],
+        [LIBFFI_WORKS=yes],
+        [LIBFFI_WORKS=no]
+    )
+    CFLAGS="$OLD_CFLAGS"
+    LIBS="$OLD_LIBS"
+    AC_LANG_POP(C)
+    AC_MSG_RESULT([$LIBFFI_WORKS])
+
+    if test "x$LIBFFI_WORKS" = xno; then
+      HELP_MSG_MISSING_DEPENDENCY([ffi])
+      AC_MSG_ERROR([Found libffi but could not link and compile with it. $HELP_MSG])
+    fi
+
+    AC_MSG_CHECKING([if libffi should be bundled])
+    if test "x$enable_libffi_bundling" = "x"; then
+      AC_MSG_RESULT([no])
+      ENABLE_LIBFFI_BUNDLING=false
+    elif  test "x$enable_libffi_bundling" = "xno"; then
+      AC_MSG_RESULT([no, forced])
+      ENABLE_LIBFFI_BUNDLING=false
+    elif  test "x$enable_libffi_bundling" = "xyes"; then
+      AC_MSG_RESULT([yes, forced])
+      ENABLE_LIBFFI_BUNDLING=true
+    else
+      AC_MSG_ERROR([Invalid value for --enable-libffi-bundling])
+    fi
+
+    # Find the libffi.so.X to bundle
+    if test "x${ENABLE_LIBFFI_BUNDLING}" = "xtrue"; then
+      AC_MSG_CHECKING([for libffi lib file location])
+      if test "x${LIBFFI_LIB_PATH}" != x; then
+        if test -e ${LIBFFI_LIB_PATH}/libffi.so.?; then
+          LIBFFI_LIB_FILE="${LIBFFI_LIB_PATH}/libffi.so.?"
+        else
+          AC_MSG_ERROR([Could not locate libffi.so.? for bundling in ${LIBFFI_LIB_PATH}])
+        fi
+      else
+        # If we don't have an explicit path, look in a few obvious places
+        if test "x${OPENJDK_TARGET_CPU}" = "xx86"; then
+          if test -e ${SYSROOT}/usr/lib/libffi.so.? ; then
+            LIBFFI_LIB_FILE="${SYSROOT}/usr/lib/libffi.so.?"
+          elif test -e ${SYSROOT}/usr/lib/i386-linux-gnu/libffi.so.? ; then
+            LIBFFI_LIB_FILE="${SYSROOT}/usr/lib/i386-linux-gnu/libffi.so.?"
+          else
+            AC_MSG_ERROR([Could not locate libffi.so.? for bundling])
+          fi
+        elif test "x${OPENJDK_TARGET_CPU}" = "xx86_64"; then
+          if test -e ${SYSROOT}/usr/lib64/libffi.so.? ; then
+            LIBFFI_LIB_FILE="${SYSROOT}/usr/lib64/libffi.so.?"
+          elif test -e ${SYSROOT}/usr/lib/x86_64-linux-gnu/libffi.so.? ; then
+            LIBFFI_LIB_FILE="${SYSROOT}/usr/lib/x86_64-linux-gnu/libffi.so.?"
+          else
+            AC_MSG_ERROR([Could not locate libffi.so.? for bundling])
+          fi
+        else
+          # Fallback on the default /usr/lib dir
+          if test -e ${SYSROOT}/usr/lib/libffi.so.? ; then
+            LIBFFI_LIB_FILE="${SYSROOT}/usr/lib/libffi.so.?"
+          else
+            AC_MSG_ERROR([Could not locate libffi.so.? for bundling])
+          fi
+        fi
+      fi
+      # Make sure the wildcard is evaluated
+      LIBFFI_LIB_FILE="$(ls ${LIBFFI_LIB_FILE})"
+      LIBFFI_LIB_DIR="$(dirname ${LIBFFI_LIB_FILE})"
+      LIBFFI_LIB_FILE="$(basename ${LIBFFI_LIB_FILE})"
+      AC_MSG_RESULT([${LIBFFI_LIB_FILE} in ${LIBFFI_LIB_DIR}])
+    fi
+   fi
+ 
+  AC_SUBST(LIBFFI_CFLAGS)
+  AC_SUBST(LIBFFI_LIBS)
+  AC_SUBST(ENABLE_LIBFFI_BUNDLING)
+  AC_SUBST(LIBFFI_LIB_DIR)
+  AC_SUBST(LIBFFI_LIB_FILE)
+
+   if test "x$JVM_VARIANT_ZEROSHARK" = xtrue; then
+     AC_CHECK_PROG([LLVM_CONFIG], [llvm-config], [llvm-config])
+ 
+diff --git a/common/autoconf/spec.gmk.in b/common/autoconf/spec.gmk.in
+index 9573bb2cbd..8da3ac32a0 100644
+--- a/common/autoconf/spec.gmk.in
+++ b/common/autoconf/spec.gmk.in
+@@ -311,6 +311,11 @@ FONTCONFIG_CFLAGS:=@FONTCONFIG_CFLAGS@
+ CUPS_CFLAGS:=@CUPS_CFLAGS@
+ ALSA_LIBS:=@ALSA_LIBS@
+ ALSA_CFLAGS:=@ALSA_CFLAGS@
+LIBFFI_LIBS:=@LIBFFI_LIBS@
+LIBFFI_CFLAGS:=@LIBFFI_CFLAGS@
+ENABLE_LIBFFI_BUNDLING:=@ENABLE_LIBFFI_BUNDLING@
+LIBFFI_LIB_DIR:=@LIBFFI_LIB_DIR@
+LIBFFI_LIB_FILE:=@LIBFFI_LIB_FILE@
+ 
+ PACKAGE_PATH=@PACKAGE_PATH@
+ 
+diff --git a/hotspot/make/Makefile b/hotspot/make/Makefile
+index ad195763be..b9114cb99a 100644
+--- a/hotspot/make/Makefile
+++ b/hotspot/make/Makefile
+@@ -476,6 +476,8 @@ $(EXPORT_INCLUDE_DIR)/%:			$(ZERO_BUILD_DIR)/../generated/jvmtifiles/%
+ # Unix
+ $(EXPORT_JRE_LIB_ARCH_DIR)/%.$(LIBRARY_SUFFIX): $(ZERO_BUILD_DIR)/%.$(LIBRARY_SUFFIX)
+ 	$(install-file)
+$(EXPORT_JRE_LIB_ARCH_DIR)/$(LIBFFI_LIB_FILE):  $(LIBFFI_LIB_DIR)/$(LIBFFI_LIB_FILE)
+	$(install-file)
+ $(EXPORT_JRE_LIB_ARCH_DIR)/%.debuginfo:		$(ZERO_BUILD_DIR)/%.debuginfo
+ 	$(install-file)
+ $(EXPORT_JRE_LIB_ARCH_DIR)/%.diz:		$(ZERO_BUILD_DIR)/%.diz
+diff --git a/hotspot/make/aix/makefiles/defs.make b/hotspot/make/aix/makefiles/defs.make
+index b12c9c8df2..db10f6a68f 100644
+--- a/hotspot/make/aix/makefiles/defs.make
+++ b/hotspot/make/aix/makefiles/defs.make
+@@ -220,4 +220,7 @@ ADD_SA_BINARIES/zero  =
+ 
+ EXPORT_LIST += $(ADD_SA_BINARIES/$(HS_ARCH))
+ 
+ifeq ($(ENABLE_LIBFFI_BUNDLING), true)
+  EXPORT_LIST += $(EXPORT_JRE_LIB_ARCH_DIR)/$(LIBFFI_LIB_FILE)
+endif
+ 
+diff --git a/hotspot/make/bsd/makefiles/defs.make b/hotspot/make/bsd/makefiles/defs.make
+index 7cd21cc175..23436f12d8 100644
+--- a/hotspot/make/bsd/makefiles/defs.make
+++ b/hotspot/make/bsd/makefiles/defs.make
+@@ -364,6 +364,10 @@ ADD_SA_BINARIES/zero  =
+ 
+ EXPORT_LIST += $(ADD_SA_BINARIES/$(HS_ARCH))
+ 
+ifeq ($(ENABLE_LIBFFI_BUNDLING), true)
+  EXPORT_LIST += $(EXPORT_JRE_LIB_ARCH_DIR)/$(LIBFFI_LIB_FILE)
+endif
+
+ # Universal build settings
+ ifeq ($(OS_VENDOR), Darwin)
+   # Build universal binaries by default on Mac OS X
+diff --git a/hotspot/make/linux/makefiles/defs.make b/hotspot/make/linux/makefiles/defs.make
+index ec414639d2..0baa4f068d 100644
+--- a/hotspot/make/linux/makefiles/defs.make
+++ b/hotspot/make/linux/makefiles/defs.make
+@@ -333,4 +333,6 @@ ADD_SA_BINARIES/zero  =
+ 
+ EXPORT_LIST += $(ADD_SA_BINARIES/$(HS_ARCH))
+ 
+-
+ifeq ($(ENABLE_LIBFFI_BUNDLING), true)
+  EXPORT_LIST += $(EXPORT_JRE_LIB_ARCH_DIR)/$(LIBFFI_LIB_FILE)
+endif
+diff --git a/hotspot/make/solaris/makefiles/defs.make b/hotspot/make/solaris/makefiles/defs.make
+index c88351c82b..cb838e854d 100644
+--- a/hotspot/make/solaris/makefiles/defs.make
+++ b/hotspot/make/solaris/makefiles/defs.make
+@@ -304,3 +304,7 @@ ifeq ($(ENABLE_FULL_DEBUG_SYMBOLS),1)
+   endif
+ endif
+ EXPORT_LIST += $(EXPORT_LIB_DIR)/sa-jdi.jar
+
+ifeq ($(ENABLE_LIBFFI_BUNDLING), true)
+  EXPORT_LIST += $(EXPORT_JRE_LIB_ARCH_DIR)/$(LIBFFI_LIB_FILE)
+endif
+diff --git a/hotspot/make/windows/makefiles/defs.make b/hotspot/make/windows/makefiles/defs.make
+index 6b36f0e2bc..6f42c7ad37 100644
+--- a/hotspot/make/windows/makefiles/defs.make
+++ b/hotspot/make/windows/makefiles/defs.make
+@@ -300,6 +300,10 @@ ifeq ($(BUILD_WIN_SA), 1)
+   MAKE_ARGS += BUILD_WIN_SA=1
+ endif
+ 
+ifeq ($(ENABLE_LIBFFI_BUNDLING), true)
+  EXPORT_LIST += $(EXPORT_JRE_LIB_ARCH_DIR)/$(LIBFFI_LIB_FILE)
+endif
+
+ # Propagate compiler and tools paths from configure to nmake.
+ # Need to make sure they contain \\ and not /.
+ ifneq ($(SPEC),)
+diff --git a/jdk/make/Images.gmk b/jdk/make/Images.gmk
+index 2e378c9134..0edefd7b5c 100644
+--- a/jdk/make/Images.gmk
+++ b/jdk/make/Images.gmk
+@@ -249,7 +249,8 @@ endif
+ 
+ ifneq ($(findstring $(OPENJDK_TARGET_OS), linux solaris),) # If Linux or Solaris
+     JDK_LIB_FILES += $(LIBRARY_PREFIX)jli$(SHARED_LIBRARY_SUFFIX) \
+-		     $(LIBRARY_PREFIX)jawt$(SHARED_LIBRARY_SUFFIX)
+		     $(LIBRARY_PREFIX)jawt$(SHARED_LIBRARY_SUFFIX) \
+		     $(LIBFFI_LIB_FILE)
+ endif
+ 
+ # Find all files to copy from $(JDK_OUTPUTDIR)/lib
+diff --git a/jdk/make/Import.gmk b/jdk/make/Import.gmk
+index b115fa7f86..29fa2662a6 100644
+--- a/jdk/make/Import.gmk
+++ b/jdk/make/Import.gmk
+@@ -114,7 +114,7 @@ endef
+ #
+ # Import hotspot
+ #
+-HOTSPOT_IMPORT_FILES := $(addprefix $(LIBRARY_PREFIX), jvm.* saproc.* jsig.* sawindbg.* jvm_db.* jvm_dtrace.*) \
+HOTSPOT_IMPORT_FILES := $(addprefix $(LIBRARY_PREFIX), jvm.* saproc.* jsig.* sawindbg.* jvm_db.* jvm_dtrace.* ffi.*) \
+     Xusage.txt sa-jdi.jar
+ 
+ ifeq ($(OPENJDK_TARGET_OS), macosx)
+diff --git a/make/devkit/Tools.gmk b/make/devkit/Tools.gmk
+index c2460105b7..cf2ef251ac 100644
+--- a/make/devkit/Tools.gmk
+++ b/make/devkit/Tools.gmk
+@@ -82,8 +82,8 @@ RPM_LIST := \
+     libXi libXi-devel \
+     libXdmcp libXdmcp-devel \
+     libXau libXau-devel \
+-    libgcc
+-
+    libgcc \
+    libffi libffi-devel
+ 
+ ifeq ($(ARCH),x86_64)
+   RPM_DIR ?= $(RPM_DIR_x86_64)
+@@ -203,6 +203,18 @@ $(libs) : $(rpms)
+ 	@mkdir -p $(SYSROOT)/usr/lib
+ 	@touch $@
+ 
+##########################################################################################
+# Create links for ffi header files so that they become visible by default when using the
+# devkit.
+
+$(SYSROOT)/usr/include/ffi.h: $(rpms)
+	cd $(@D) && rm $(@F) && ln -s ../lib/libffi-*/include/$(@F) .
+
+$(SYSROOT)/usr/include/ffitarget.h: $(rpms)
+	cd $(@D) && rm $(@F) && ln -s ../lib/libffi-*/include/$(@F) .
+
+SYSROOT_LINKS += $(SYSROOT)/usr/include/ffi.h $(SYSROOT)/usr/include/ffitarget.h
+
+ ##########################################################################################
+ 
+ # Define marker files for each source package to be compiled
+@@ -479,7 +491,7 @@ rpms : $(rpms)
+ libs : $(libs)
+ sysroot : rpms libs
+ gcc : sysroot $(gcc) $(gccpatch)
+-all : binutils gcc bfdlib $(PREFIX)/devkit.info
+all : binutils gcc bfdlib $(PREFIX)/devkit.info $(SYSROOT_LINKS)
+ 
+ # this is only built for host. so separate.
+ ccache : $(ccache)
--- a/SOURCES/s390-8214206_fix.patch
+++ b/SOURCES/s390-8214206_fix.patch
@ -16,7 +16,7 @@ diff --git openjdk.orig/hotspot/src/share/vm/gc_implementation/shenandoah/shenan
   Atomic::add(val, &_sum);
 
 -  int mag = log2_intptr(val) + 1;
-+  int mag = log2_intptr((uintptr_t)val) + 1;
+  int mag = log2_long(val) + 1;
 
   // Defensively saturate for product bits:
   if (mag < 0) {
--- a/SPECS/java-1.8.0-openjdk.spec
+++ b/SPECS/java-1.8.0-openjdk.spec