The package rpms/java-openjdk.git has added or updated architecture specific content in
its
spec file (ExclusiveArch/ExcludeArch or %ifarch/%ifnarch) in commit(s):
https://src.fedoraproject.org/cgit/rpms/java-openjdk.git/commit/?id=d30d1...
https://src.fedoraproject.org/cgit/rpms/java-openjdk.git/commit/?id=eb6f5....
Change:
-%ifarch s390
-%ifarch s390
Thanks.
Full change:
============
commit eb6f5c2dfb1f2297be4b550b70c8a4a832642f96
Author: Severin Gehwolf <sgehwolf(a)redhat.com>
Date: Fri Apr 20 14:02:54 2018 +0200
Clean up patches.
- Remove unneeded ones.
- Rename patches for clarity. Update JDK-8201788
from upstream.
- Add patches needed to build on more arches (Zero).
diff --git a/JDK-8200556-aarch64-slowdebug-crash.patch
b/JDK-8200556-aarch64-slowdebug-crash.patch
new file mode 100644
index 0000000..bb5453e
--- /dev/null
+++ b/JDK-8200556-aarch64-slowdebug-crash.patch
@@ -0,0 +1,14 @@
+diff -r 214a94e9366c src/cpu/aarch64/vm/nativeInst_aarch64.cpp
+--- openjdk/src/hotspot/cpu/aarch64/nativeInst_aarch64.cpp Mon Jul 17 12:11:32 2017
+0000
++++ openjdk/src/hotspot/cpu/aarch64/nativeInst_aarch64.cpp Mon Jul 24 16:23:14 2017
+0100
+@@ -343,7 +343,7 @@
+ CodeBuffer cb(code_pos, instruction_size);
+ MacroAssembler a(&cb);
+
+- a.mov(rscratch1, entry);
++ a.movptr(rscratch1, (uintptr_t)entry);
+ a.br(rscratch1);
+
+ ICache::invalidate_range(code_pos, instruction_size);
+
+
diff --git a/JDK-8201495-s390-java-opts.patch b/JDK-8201495-s390-java-opts.patch
new file mode 100644
index 0000000..a16db0c
--- /dev/null
+++ b/JDK-8201495-s390-java-opts.patch
@@ -0,0 +1,21 @@
+# HG changeset patch
+# User sgehwolf
+# Date 1523874036 -7200
+# Mon Apr 16 12:20:36 2018 +0200
+# Node ID fc3a72e286e0d5bf9b994d1b778b39f3b080c686
+# Parent 69bae761600bdbc97953500ac51a396d31f54ee9
+8201495: [Zero] Reduce limits of max heap size for boot JDK on s390
+Reviewed-by: ihse, aph, simonis
+
+diff --git a/make/autoconf/boot-jdk.m4 b/make/autoconf/boot-jdk.m4
+--- a/make/autoconf/boot-jdk.m4
++++ b/make/autoconf/boot-jdk.m4
+@@ -405,7 +405,7 @@
+ BOOTCYCLE_JVM_ARGS_BIG=-Xms64M
+
+ # Maximum amount of heap memory and stack size.
+- JVM_HEAP_LIMIT_32="1024"
++ JVM_HEAP_LIMIT_32="768"
+ # Running a 64 bit JVM allows for and requires a bigger heap
+ JVM_HEAP_LIMIT_64="1600"
+ STACK_SIZE_32=768
diff --git a/JDK-8201509-s390-atomic_store.patch b/JDK-8201509-s390-atomic_store.patch
new file mode 100644
index 0000000..ba7f748
--- /dev/null
+++ b/JDK-8201509-s390-atomic_store.patch
@@ -0,0 +1,18 @@
+diff --git a/src/hotspot/os_cpu/linux_zero/os_linux_zero.hpp
b/src/hotspot/os_cpu/linux_zero/os_linux_zero.hpp
+--- a/src/hotspot/os_cpu/linux_zero/os_linux_zero.hpp
++++ b/src/hotspot/os_cpu/linux_zero/os_linux_zero.hpp
+@@ -50,10 +50,10 @@
+ : "Q"(*(volatile long*)src));
+ #elif defined(S390) && !defined(_LP64)
+ double tmp;
+- asm volatile ("ld %0, 0(%1)\n"
+- "std %0, 0(%2)\n"
+- : "=r"(tmp)
+- : "a"(src), "a"(dst));
++ asm volatile ("ld %0, %2\n"
++ "std %0, %1\n"
++ : "=&f"(tmp), "=Q"(*(volatile double*)dst)
++ : "Q"(*(volatile double*)src));
+ #else
+ *(jlong *) dst = *(const jlong *) src;
+ #endif
diff --git a/JDK-8201788-bootcycle-images-jobs.patch
b/JDK-8201788-bootcycle-images-jobs.patch
new file mode 100644
index 0000000..05d1a39
--- /dev/null
+++ b/JDK-8201788-bootcycle-images-jobs.patch
@@ -0,0 +1,27 @@
+# HG changeset patch
+# User sgehwolf
+# Date 1524152606 -7200
+# Thu Apr 19 17:43:26 2018 +0200
+# Node ID f7a3ca673e9cc831848fc890a2df3ae9acb447e4
+# Parent dd26184768b0a1c4103a2e9eaa8b4d852a9eca1b
+8201788: Number of make jobs wrong for bootcycle-images target
+Reviewed-by: erikj, ihse
+
+diff --git a/make/Init.gmk b/make/Init.gmk
+--- a/make/Init.gmk
++++ b/make/Init.gmk
+@@ -310,9 +310,13 @@
+ ifneq ($(PARALLEL_TARGETS), )
+ $(call StartGlobalTimer)
+ $(call PrepareSmartJavac)
++ # JOBS will only be empty for a bootcycle-images recursive call
++ # or if specified via a make argument directly. In those cases
++ # treat it as NOT using jobs at all.
+ ( cd $(TOPDIR) && \
+ $(NICE) $(MAKE) $(MAKE_ARGS) $(OUTPUT_SYNC_FLAG) \
+- -j $(JOBS) -f make/Main.gmk $(USER_MAKE_VARS) \
++ $(if $(JOBS), -j $(JOBS)) \
++ -f make/Main.gmk $(USER_MAKE_VARS) \
+ $(PARALLEL_TARGETS) $(COMPARE_BUILD_MAKE) $(BUILD_LOG_PIPE) || \
+ ( exitcode=$$? && \
+ $(PRINTF) "\nERROR: Build failed for $(TARGET_DESCRIPTION) (exit code
$$exitcode) \n" \
diff --git a/PStack-808293.patch b/PStack-808293.patch
deleted file mode 100644
index fc5fe4e..0000000
--- a/PStack-808293.patch
+++ /dev/null
@@ -1,33 +0,0 @@
----
openjdk/src/jdk.hotspot.agent/share/classes/sun/jvm/hotspot/tools/PStack.java 2012-04-06
02:26:33.322164601 +0200
-+++
openjdk/src/jdk.hotspot.agent/share/classes/sun/jvm/hotspot/tools/PStack.java 2012-04-06
02:26:57.958514071 +0200
-@@ -84,7 +85,8 @@
- if (jthread != null) {
- jthread.printThreadInfoOn(out);
- }
-- while (f != null) {
-+ int maxStack = 256;
-+ while (f != null && maxStack-- > 0) {
- ClosestSymbol sym = f.closestSymbolToPC();
- Address pc = f.pc();
- out.print(pc + "\t");
-@@ -158,10 +160,19 @@
- }
- }
- }
-+ Address oldPC = f.pc();
-+ Address oldFP = f.localVariableBase();
- f = f.sender(th);
-+ if (f != null
-+ && oldPC.equals(f.pc())
-+ && oldFP.equals(f.localVariableBase())) {
-+ // We didn't make any progress
-+ f = null;
-+ }
- }
- } catch (Exception exp) {
-- exp.printStackTrace();
-+ // exp.printStackTrace();
-+ out.println("bad stack: " + exp);
- // continue, may be we can do a better job for other threads
- }
- if (concurrentLocks) {
diff --git a/RHBZ-1249083-system-crypto-policy-PR3183.patch
b/RHBZ-1249083-system-crypto-policy-PR3183.patch
new file mode 100644
index 0000000..4efbe9a
--- /dev/null
+++ b/RHBZ-1249083-system-crypto-policy-PR3183.patch
@@ -0,0 +1,88 @@
+
+# HG changeset patch
+# User andrew
+# Date 1478057514 0
+# Node ID 1c4d5cb2096ae55106111da200b0bcad304f650c
+# Parent 3d53f19b48384e5252f4ec8891f7a3a82d77af2a
+PR3183: Support Fedora/RHEL system crypto policy
+diff -r 3d53f19b4838 -r 1c4d5cb2096a
src/java.base/share/classes/java/security/Security.java
+--- a/src/java.base/share/classes/java/security/Security.java Wed Oct 26 03:51:39 2016
+0100
++++ b/src/java.base/share/classes/java/security/Security.java Wed Nov 02 03:31:54 2016
+0000
+@@ -43,6 +43,9 @@
+ * implementation-specific location, which is typically the properties file
+ * {@code conf/security/java.security} in the Java installation directory.
+ *
++ * <p>Additional default values of security properties are read from a
++ * system-specific location, if available.</p>
++ *
+ * @author Benjamin Renaud
+ * @since 1.1
+ */
+@@ -52,6 +55,10 @@
+ private static final Debug sdebug =
+ Debug.getInstance("properties");
+
++ /* System property file*/
++ private static final String SYSTEM_PROPERTIES =
++ "/etc/crypto-policies/back-ends/java.config";
++
+ /* The java.security properties */
+ private static Properties props;
+
+@@ -93,6 +100,7 @@
+ if (sdebug != null) {
+ sdebug.println("reading security properties file: " +
+ propFile);
++ sdebug.println(props.toString());
+ }
+ } catch (IOException e) {
+ if (sdebug != null) {
+@@ -114,6 +122,31 @@
+ }
+
+ if ("true".equalsIgnoreCase(props.getProperty
++ ("security.useSystemPropertiesFile"))) {
++
++ // now load the system file, if it exists, so its values
++ // will win if they conflict with the earlier values
++ try (BufferedInputStream bis =
++ new BufferedInputStream(new FileInputStream(SYSTEM_PROPERTIES))) {
++ props.load(bis);
++ loadedProps = true;
++
++ if (sdebug != null) {
++ sdebug.println("reading system security properties file "
+
++ SYSTEM_PROPERTIES);
++ sdebug.println(props.toString());
++ }
++ } catch (IOException e) {
++ if (sdebug != null) {
++ sdebug.println
++ ("unable to load security properties from " +
++ SYSTEM_PROPERTIES);
++ e.printStackTrace();
++ }
++ }
++ }
++
++ if ("true".equalsIgnoreCase(props.getProperty
+ ("security.overridePropertiesFile"))) {
+
+ String extraPropFile = System.getProperty
+diff -r 3d53f19b4838 -r 1c4d5cb2096a src/java.base/share/conf/security/java.security
+--- a/src/java.base/share/conf/security/java.security Wed Oct 26 03:51:39 2016 +0100
++++ b/src/java.base/share/conf/security/java.security Wed Nov 02 03:31:54 2016 +0000
+@@ -276,6 +276,13 @@
+ security.overridePropertiesFile=true
+
+ #
++# Determines whether this properties file will be appended to
++# using the system properties file stored at
++# /etc/crypto-policies/back-ends/java.config
++#
++security.useSystemPropertiesFile=true
++
++#
+ # Determines the default key and trust manager factory algorithms for
+ # the javax.net.ssl package.
+ #
diff --git a/RHBZ-1565658-system-nss-SunEC.patch b/RHBZ-1565658-system-nss-SunEC.patch
new file mode 100644
index 0000000..7b1d4aa
--- /dev/null
+++ b/RHBZ-1565658-system-nss-SunEC.patch
@@ -0,0 +1,654 @@
+diff --git openjdk/make/autoconf/jdk-options.m4 openjdk/make/autoconf/jdk-options.m4
+--- openjdk/make/autoconf/jdk-options.m4
++++ openjdk/make/autoconf/jdk-options.m4
+@@ -264,9 +264,10 @@
+ #
+ AC_DEFUN_ONCE([JDKOPT_DETECT_INTREE_EC],
+ [
++ AC_REQUIRE([LIB_SETUP_MISC_LIBS])
+ AC_MSG_CHECKING([if elliptic curve crypto implementation is present])
+
+- if test -d "${TOPDIR}/src/jdk.crypto.ec/share/native/libsunec/impl"; then
++ if test "x${system_nss}" = "xyes" -o -d
"${TOPDIR}/src/jdk.crypto.ec/share/native/libsunec/impl"; then
+ ENABLE_INTREE_EC=true
+ AC_MSG_RESULT([yes])
+ else
+diff --git openjdk/make/autoconf/libraries.m4 openjdk/make/autoconf/libraries.m4
+--- openjdk/make/autoconf/libraries.m4
++++ openjdk/make/autoconf/libraries.m4
+@@ -175,6 +175,48 @@
+ AC_SUBST(LIBDL)
+ LIBS="$save_LIBS"
+
++ ###############################################################################
++ #
++ # Check for the NSS libraries
++ #
++
++ AC_MSG_CHECKING([whether to build the Sun EC provider against the system NSS
libraries])
++
++ # default is bundled
++ DEFAULT_SYSTEM_NSS=no
++
++ AC_ARG_ENABLE([system-nss], [AS_HELP_STRING([--enable-system-nss],
++ [build the SunEC provider using the system NSS libraries
@<:@disabled@:>@])],
++ [
++ case "${enableval}" in
++ yes)
++ system_nss=yes
++ ;;
++ *)
++ system_nss=no
++ ;;
++ esac
++ ],
++ [
++ system_nss=${DEFAULT_SYSTEM_NSS}
++ ])
++ AC_MSG_RESULT([$system_nss])
++
++ if test "x${system_nss}" = "xyes"; then
++ PKG_CHECK_MODULES(NSS_SOFTTKN, nss-softokn >= 3.16.1, [NSS_SOFTOKN_FOUND=yes],
[NSS_SOFTOKN_FOUND=no])
++ PKG_CHECK_MODULES(NSS, nss >= 3.16.1, [NSS_FOUND=yes], [NSS_FOUND=no])
++ if test "x${NSS_SOFTOKN_FOUND}" = "xyes" -a
"x${NSS_FOUND}" = "xyes"; then
++ NSS_LIBS="$NSS_SOFTOKN_LIBS $NSS_LIBS -lfreebl";
++ USE_EXTERNAL_NSS=true
++ else
++ AC_MSG_ERROR([--enable-system-nss specified, but NSS not found.])
++ fi
++ else
++ USE_EXTERNAL_NSS=false
++ fi
++ AC_SUBST(USE_EXTERNAL_NSS)
++
++
+ # Deprecated libraries, keep the flags for backwards compatibility
+ if test "x$OPENJDK_TARGET_OS" = "xwindows"; then
+ BASIC_DEPRECATED_ARG_WITH([dxsdk])
+diff --git openjdk/make/autoconf/spec.gmk.in openjdk/make/autoconf/spec.gmk.in
+--- openjdk/make/autoconf/spec.gmk.in
++++ openjdk/make/autoconf/spec.gmk.in
+@@ -764,6 +764,10 @@
+ # Libraries
+ #
+
++USE_EXTERNAL_NSS:=@USE_EXTERNAL_NSS@
++NSS_LIBS:=@NSS_LIBS@
++NSS_CFLAGS:=@NSS_CFLAGS@
++
+ USE_EXTERNAL_LCMS:=@USE_EXTERNAL_LCMS@
+ LCMS_CFLAGS:=@LCMS_CFLAGS@
+ LCMS_LIBS:=@LCMS_LIBS@
+diff --git openjdk/make/lib/Lib-jdk.crypto.ec.gmk openjdk/make/lib/Lib-jdk.crypto.ec.gmk
+--- openjdk/make/lib/Lib-jdk.crypto.ec.gmk
++++ openjdk/make/lib/Lib-jdk.crypto.ec.gmk
+@@ -29,9 +29,15 @@
+
+ ifeq ($(ENABLE_INTREE_EC), true)
+
+- LIBSUNEC_SRC := $(TOPDIR)/src/jdk.crypto.ec/share/native/libsunec
+ BUILD_LIBSUNEC_FLAGS := $(addprefix -I, $(SUNEC_SRC))
+
++ ifeq ($(USE_EXTERNAL_NSS), true)
++ LIBSUNEC_SRC := $(TOPDIR)/src/jdk.crypto.ec/share/native/libsunec/ECC_JNI.cpp
++ BUILD_LIBSUNEC_FLAGS += $(NSS_CFLAGS) -DSYSTEM_NSS -DNSS_ENABLE_ECC
++ else
++ LIBSUNEC_SRC := $(TOPDIR)/src/jdk.crypto.ec/share/native/libsunec
++ endif
++
+ #
+ # On sol-sparc...all libraries are compiled with -xregs=no%appl
+ # (set in CFLAGS_REQUIRED_sparc)
+@@ -60,7 +66,7 @@
+ LDFLAGS := $(LDFLAGS_JDKLIB) $(LDFLAGS_CXX_JDK), \
+ LDFLAGS_macosx := $(call SET_SHARED_LIBRARY_ORIGIN), \
+ LIBS := $(LIBCXX), \
+- LIBS_linux := -lc, \
++ LIBS_linux := -lc $(NSS_LIBS), \
+ LIBS_solaris := -lc, \
+ VERSIONINFO_RESOURCE := $(GLOBAL_VERSION_INFO_RESOURCE), \
+ RC_FLAGS := $(RC_FLAGS) \
+diff --git openjdk/make/mapfiles/libsunec/mapfile-vers
openjdk/make/mapfiles/libsunec/mapfile-vers
+--- openjdk/make/mapfiles/libsunec/mapfile-vers
++++ openjdk/make/mapfiles/libsunec/mapfile-vers
+@@ -31,6 +31,7 @@
+ Java_sun_security_ec_ECDSASignature_signDigest;
+ Java_sun_security_ec_ECDSASignature_verifySignedDigest;
+ Java_sun_security_ec_ECDHKeyAgreement_deriveKey;
++ Java_sun_security_ec_SunEC_initialize;
+ local:
+ *;
+ };
+diff --git openjdk/src/java.base/unix/native/include/jni_md.h
openjdk/src/java.base/unix/native/include/jni_md.h
+--- openjdk/src/java.base/unix/native/include/jni_md.h
++++ openjdk/src/java.base/unix/native/include/jni_md.h
+@@ -36,6 +36,11 @@
+ #define JNIEXPORT
+ #define JNIIMPORT
+ #endif
++#if (defined(__GNUC__)) || __has_attribute(unused)
++ #define UNUSED(x) UNUSED_ ## x __attribute__((__unused__))
++#else
++ #define UNUSED(x) UNUSED_ ## x
++#endif
+
+ #define JNICALL
+
+diff --git openjdk/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
openjdk/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
+--- openjdk/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
++++ openjdk/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
+@@ -61,6 +61,7 @@
+ AccessController.doPrivileged(new PrivilegedAction<Void>() {
+ public Void run() {
+ System.loadLibrary("sunec"); // check for native library
++ initialize();
+ return null;
+ }
+ });
+@@ -272,4 +273,9 @@
+ putService(new ProviderService(this, "KeyAgreement",
+ "ECDH", "sun.security.ec.ECDHKeyAgreement", null,
ATTRS));
+ }
++
++ /**
++ * Initialize the native code.
++ */
++ private static native void initialize();
+ }
+diff --git openjdk/src/jdk.crypto.ec/share/native/libsunec/ECC_JNI.cpp
openjdk/src/jdk.crypto.ec/share/native/libsunec/ECC_JNI.cpp
+--- openjdk/src/jdk.crypto.ec/share/native/libsunec/ECC_JNI.cpp
++++ openjdk/src/jdk.crypto.ec/share/native/libsunec/ECC_JNI.cpp
+@@ -25,7 +25,11 @@
+
+ #include <jni.h>
+ #include "jni_util.h"
++#ifdef SYSTEM_NSS
++#include "ecc_impl.h"
++#else
+ #include "impl/ecc_impl.h"
++#endif
+
+ #define ILLEGAL_STATE_EXCEPTION "java/lang/IllegalStateException"
+ #define INVALID_ALGORITHM_PARAMETER_EXCEPTION \
+@@ -33,6 +37,13 @@
+ #define INVALID_PARAMETER_EXCEPTION \
+ "java/security/InvalidParameterException"
+ #define KEY_EXCEPTION "java/security/KeyException"
++#define INTERNAL_ERROR "java/lang/InternalError"
++
++#ifdef SYSTEM_NSS
++#define SYSTEM_UNUSED(x) UNUSED(x)
++#else
++#define SYSTEM_UNUSED(x) x
++#endif
+
+ extern "C" {
+
+@@ -55,8 +66,13 @@
+ /*
+ * Deep free of the ECParams struct
+ */
+-void FreeECParams(ECParams *ecparams, jboolean freeStruct)
++void FreeECParams(ECParams *ecparams, jboolean SYSTEM_UNUSED(freeStruct))
+ {
++#ifdef SYSTEM_NSS
++ // Needs to be freed using the matching method to the one
++ // that allocated it. PR_TRUE means the memory is zeroed.
++ PORT_FreeArena(ecparams->arena, PR_TRUE);
++#else
+ // Use B_FALSE to free the SECItem->data element, but not the SECItem itself
+ // Use B_TRUE to free both
+
+@@ -70,6 +86,7 @@
+ SECITEM_FreeItem(&ecparams->curveOID, B_FALSE);
+ if (freeStruct)
+ free(ecparams);
++#endif
+ }
+
+ jbyteArray getEncodedBytes(JNIEnv *env, SECItem *hSECItem)
+@@ -95,7 +112,7 @@
+ */
+ JNIEXPORT jobjectArray
+ JNICALL Java_sun_security_ec_ECKeyPairGenerator_generateECKeyPair
+- (JNIEnv *env, jclass clazz, jint keySize, jbyteArray encodedParams, jbyteArray seed)
++ (JNIEnv *env, jclass UNUSED(clazz), jint UNUSED(keySize), jbyteArray encodedParams,
jbyteArray seed)
+ {
+ ECPrivateKey *privKey = NULL; // contains both public and private values
+ ECParams *ecparams = NULL;
+@@ -127,8 +144,17 @@
+ env->GetByteArrayRegion(seed, 0, jSeedLength, pSeedBuffer);
+
+ // Generate the new keypair (using the supplied seed)
++#ifdef SYSTEM_NSS
++ if (RNG_RandomUpdate((unsigned char *) pSeedBuffer, jSeedLength)
++ != SECSuccess) {
++ ThrowException(env, KEY_EXCEPTION);
++ goto cleanup;
++ }
++ if (EC_NewKey(ecparams, &privKey) != SECSuccess) {
++#else
+ if (EC_NewKey(ecparams, &privKey, (unsigned char *) pSeedBuffer,
+ jSeedLength, 0) != SECSuccess) {
++#endif
+ ThrowException(env, KEY_EXCEPTION);
+ goto cleanup;
+ }
+@@ -175,10 +201,15 @@
+ }
+ if (privKey) {
+ FreeECParams(&privKey->ecParams, false);
++#ifndef SYSTEM_NSS
++ // The entire ECPrivateKey is allocated in the arena
++ // when using system NSS, so only the in-tree version
++ // needs to clear these manually.
+ SECITEM_FreeItem(&privKey->version, B_FALSE);
+ SECITEM_FreeItem(&privKey->privateValue, B_FALSE);
+ SECITEM_FreeItem(&privKey->publicValue, B_FALSE);
+ free(privKey);
++#endif
+ }
+
+ if (pSeedBuffer) {
+@@ -196,7 +227,7 @@
+ */
+ JNIEXPORT jbyteArray
+ JNICALL Java_sun_security_ec_ECDSASignature_signDigest
+- (JNIEnv *env, jclass clazz, jbyteArray digest, jbyteArray privateKey, jbyteArray
encodedParams, jbyteArray seed, jint timing)
++ (JNIEnv *env, jclass UNUSED(clazz), jbyteArray digest, jbyteArray privateKey,
jbyteArray encodedParams, jbyteArray seed, jint timing)
+ {
+ jbyte* pDigestBuffer = NULL;
+ jint jDigestLength = env->GetArrayLength(digest);
+@@ -255,8 +286,18 @@
+ env->GetByteArrayRegion(seed, 0, jSeedLength, pSeedBuffer);
+
+ // Sign the digest (using the supplied seed)
++#ifdef SYSTEM_NSS
++ if (RNG_RandomUpdate((unsigned char *) pSeedBuffer, jSeedLength)
++ != SECSuccess) {
++ ThrowException(env, KEY_EXCEPTION);
++ goto cleanup;
++ }
++ if (ECDSA_SignDigest(&privKey, &signature_item, &digest_item)
++ != SECSuccess) {
++#else
+ if (ECDSA_SignDigest(&privKey, &signature_item, &digest_item,
+ (unsigned char *) pSeedBuffer, jSeedLength, 0, timing) != SECSuccess) {
++#endif
+ ThrowException(env, KEY_EXCEPTION);
+ goto cleanup;
+ }
+@@ -305,7 +346,7 @@
+ */
+ JNIEXPORT jboolean
+ JNICALL Java_sun_security_ec_ECDSASignature_verifySignedDigest
+- (JNIEnv *env, jclass clazz, jbyteArray signedDigest, jbyteArray digest, jbyteArray
publicKey, jbyteArray encodedParams)
++ (JNIEnv *env, jclass UNUSED(clazz), jbyteArray signedDigest, jbyteArray digest,
jbyteArray publicKey, jbyteArray encodedParams)
+ {
+ jboolean isValid = false;
+
+@@ -362,9 +403,10 @@
+
+ cleanup:
+ {
+- if (params_item.data)
++ if (params_item.data) {
+ env->ReleaseByteArrayElements(encodedParams,
+ (jbyte *) params_item.data, JNI_ABORT);
++ }
+
+ if (pubKey.publicValue.data)
+ env->ReleaseByteArrayElements(publicKey,
+@@ -390,7 +432,7 @@
+ */
+ JNIEXPORT jbyteArray
+ JNICALL Java_sun_security_ec_ECDHKeyAgreement_deriveKey
+- (JNIEnv *env, jclass clazz, jbyteArray privateKey, jbyteArray publicKey, jbyteArray
encodedParams)
++ (JNIEnv *env, jclass UNUSED(clazz), jbyteArray privateKey, jbyteArray publicKey,
jbyteArray encodedParams)
+ {
+ jbyteArray jSecret = NULL;
+ ECParams *ecparams = NULL;
+@@ -466,9 +508,10 @@
+ env->ReleaseByteArrayElements(publicKey,
+ (jbyte *) publicValue_item.data, JNI_ABORT);
+
+- if (params_item.data)
++ if (params_item.data) {
+ env->ReleaseByteArrayElements(encodedParams,
+ (jbyte *) params_item.data, JNI_ABORT);
++ }
+
+ if (ecparams)
+ FreeECParams(ecparams, true);
+@@ -477,4 +520,28 @@
+ return jSecret;
+ }
+
++JNIEXPORT void
++JNICALL Java_sun_security_ec_SunEC_initialize
++ (JNIEnv *env, jclass UNUSED(clazz))
++{
++#ifdef SYSTEM_NSS
++ if (SECOID_Init() != SECSuccess) {
++ ThrowException(env, INTERNAL_ERROR);
++ }
++ if (RNG_RNGInit() != SECSuccess) {
++ ThrowException(env, INTERNAL_ERROR);
++ }
++#endif
++}
++
++JNIEXPORT void
++JNICALL JNI_OnUnload
++ (JavaVM *vm, void *reserved)
++{
++#ifdef SYSTEM_NSS
++ RNG_RNGShutdown();
++ SECOID_Shutdown();
++#endif
++}
++
+ } /* extern "C" */
+diff --git openjdk/src/jdk.crypto.ec/share/native/libsunec/ecc_impl.h
openjdk/src/jdk.crypto.ec/share/native/libsunec/ecc_impl.h
+new file mode 100644
+--- /dev/null
++++ openjdk/src/jdk.crypto.ec/share/native/libsunec/ecc_impl.h
+@@ -0,0 +1,298 @@
++/*
++ * Copyright (c) 2007, 2017, Oracle and/or its affiliates. All rights reserved.
++ * Use is subject to license terms.
++ *
++ * This library is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU Lesser General Public
++ * License as published by the Free Software Foundation; either
++ * version 2.1 of the License, or (at your option) any later version.
++ *
++ * This library is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ * Lesser General Public License for more details.
++ *
++ * You should have received a copy of the GNU Lesser General Public License
++ * along with this library; if not, write to the Free Software Foundation,
++ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
++ *
++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
++ * or visit
www.oracle.com if you need additional information or have any
++ * questions.
++ */
++
++/* *********************************************************************
++ *
++ * The Original Code is the Netscape security libraries.
++ *
++ * The Initial Developer of the Original Code is
++ * Netscape Communications Corporation.
++ * Portions created by the Initial Developer are Copyright (C) 1994-2000
++ * the Initial Developer. All Rights Reserved.
++ *
++ * Contributor(s):
++ * Dr Vipul Gupta <vipul.gupta(a)sun.com> and
++ * Douglas Stebila <douglas(a)stebila.ca>, Sun Microsystems Laboratories
++ *
++ * Last Modified Date from the Original Code: May 2017
++ *********************************************************************** */
++
++#ifndef _ECC_IMPL_H
++#define _ECC_IMPL_H
++
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++#include <sys/types.h>
++
++#ifdef SYSTEM_NSS
++#include <secitem.h>
++#include <secerr.h>
++#include <keythi.h>
++#ifdef LEGACY_NSS
++#include <softoken.h>
++#else
++#include <blapi.h>
++#endif
++#else
++#include "ecl-exp.h"
++#endif
++
++/*
++ * Multi-platform definitions
++ */
++#ifdef __linux__
++#define B_FALSE FALSE
++#define B_TRUE TRUE
++typedef unsigned char uint8_t;
++typedef unsigned long ulong_t;
++typedef enum { B_FALSE, B_TRUE } boolean_t;
++#endif /* __linux__ */
++
++#ifdef _ALLBSD_SOURCE
++#include <stdint.h>
++#define B_FALSE FALSE
++#define B_TRUE TRUE
++typedef unsigned long ulong_t;
++typedef enum boolean { B_FALSE, B_TRUE } boolean_t;
++#endif /* _ALLBSD_SOURCE */
++
++#ifdef AIX
++#define B_FALSE FALSE
++#define B_TRUE TRUE
++typedef unsigned char uint8_t;
++typedef unsigned long ulong_t;
++#endif /* AIX */
++
++#ifdef _WIN32
++typedef unsigned char uint8_t;
++typedef unsigned long ulong_t;
++typedef enum boolean { B_FALSE, B_TRUE } boolean_t;
++#define strdup _strdup /* Replace POSIX name with ISO C++ name */
++#endif /* _WIN32 */
++
++#ifndef _KERNEL
++#include <stdlib.h>
++#endif /* _KERNEL */
++
++#define EC_MAX_DIGEST_LEN 1024 /* max digest that can be signed */
++#define EC_MAX_POINT_LEN 145 /* max len of DER encoded Q */
++#define EC_MAX_VALUE_LEN 72 /* max len of ANSI X9.62 private value d */
++#define EC_MAX_SIG_LEN 144 /* max signature len for supported curves */
++#define EC_MIN_KEY_LEN 112 /* min key length in bits */
++#define EC_MAX_KEY_LEN 571 /* max key length in bits */
++#define EC_MAX_OID_LEN 10 /* max length of OID buffer */
++
++/*
++ * Various structures and definitions from NSS are here.
++ */
++
++#ifndef SYSTEM_NSS
++#ifdef _KERNEL
++#define PORT_ArenaAlloc(a, n, f) kmem_alloc((n), (f))
++#define PORT_ArenaZAlloc(a, n, f) kmem_zalloc((n), (f))
++#define PORT_ArenaGrow(a, b, c, d) NULL
++#define PORT_ZAlloc(n, f) kmem_zalloc((n), (f))
++#define PORT_Alloc(n, f) kmem_alloc((n), (f))
++#else
++#define PORT_ArenaAlloc(a, n, f) malloc((n))
++#define PORT_ArenaZAlloc(a, n, f) calloc(1, (n))
++#define PORT_ArenaGrow(a, b, c, d) NULL
++#define PORT_ZAlloc(n, f) calloc(1, (n))
++#define PORT_Alloc(n, f) malloc((n))
++#endif
++
++#define PORT_NewArena(b) (char *)12345
++#define PORT_ArenaMark(a) NULL
++#define PORT_ArenaUnmark(a, b)
++#define PORT_ArenaRelease(a, m)
++#define PORT_FreeArena(a, b)
++#define PORT_Strlen(s) strlen((s))
++#define PORT_SetError(e)
++
++#define PRBool boolean_t
++#define PR_TRUE B_TRUE
++#define PR_FALSE B_FALSE
++
++#ifdef _KERNEL
++#define PORT_Assert ASSERT
++#define PORT_Memcpy(t, f, l) bcopy((f), (t), (l))
++#else
++#define PORT_Assert assert
++#define PORT_Memcpy(t, f, l) memcpy((t), (f), (l))
++#endif
++
++#endif
++
++#define CHECK_OK(func) if (func == NULL) goto cleanup
++#define CHECK_SEC_OK(func) if (SECSuccess != (rv = func)) goto cleanup
++
++#ifndef SYSTEM_NSS
++typedef enum {
++ siBuffer = 0,
++ siClearDataBuffer = 1,
++ siCipherDataBuffer = 2,
++ siDERCertBuffer = 3,
++ siEncodedCertBuffer = 4,
++ siDERNameBuffer = 5,
++ siEncodedNameBuffer = 6,
++ siAsciiNameString = 7,
++ siAsciiString = 8,
++ siDEROID = 9,
++ siUnsignedInteger = 10,
++ siUTCTime = 11,
++ siGeneralizedTime = 12
++} SECItemType;
++
++typedef struct SECItemStr SECItem;
++
++struct SECItemStr {
++ SECItemType type;
++ unsigned char *data;
++ unsigned int len;
++};
++
++typedef SECItem SECKEYECParams;
++
++typedef enum { ec_params_explicit,
++ ec_params_named
++} ECParamsType;
++
++typedef enum { ec_field_GFp = 1,
++ ec_field_GF2m
++} ECFieldType;
++
++struct ECFieldIDStr {
++ int size; /* field size in bits */
++ ECFieldType type;
++ union {
++ SECItem prime; /* prime p for (GFp) */
++ SECItem poly; /* irreducible binary polynomial for (GF2m) */
++ } u;
++ int k1; /* first coefficient of pentanomial or
++ * the only coefficient of trinomial
++ */
++ int k2; /* two remaining coefficients of pentanomial */
++ int k3;
++};
++typedef struct ECFieldIDStr ECFieldID;
++
++struct ECCurveStr {
++ SECItem a; /* contains octet stream encoding of
++ * field element (X9.62 section 4.3.3)
++ */
++ SECItem b;
++ SECItem seed;
++};
++typedef struct ECCurveStr ECCurve;
++
++typedef void PRArenaPool;
++
++struct ECParamsStr {
++ PRArenaPool * arena;
++ ECParamsType type;
++ ECFieldID fieldID;
++ ECCurve curve;
++ SECItem base;
++ SECItem order;
++ int cofactor;
++ SECItem DEREncoding;
++ ECCurveName name;
++ SECItem curveOID;
++};
++typedef struct ECParamsStr ECParams;
++
++struct ECPublicKeyStr {
++ ECParams ecParams;
++ SECItem publicValue; /* elliptic curve point encoded as
++ * octet stream.
++ */
++};
++typedef struct ECPublicKeyStr ECPublicKey;
++
++struct ECPrivateKeyStr {
++ ECParams ecParams;
++ SECItem publicValue; /* encoded ec point */
++ SECItem privateValue; /* private big integer */
++ SECItem version; /* As per SEC 1, Appendix C, Section C.4 */
++};
++typedef struct ECPrivateKeyStr ECPrivateKey;
++
++typedef enum _SECStatus {
++ SECBufferTooSmall = -3,
++ SECWouldBlock = -2,
++ SECFailure = -1,
++ SECSuccess = 0
++} SECStatus;
++#endif
++
++#ifdef _KERNEL
++#define RNG_GenerateGlobalRandomBytes(p,l) ecc_knzero_random_generator((p), (l))
++#else
++/*
++ This function is no longer required because the random bytes are now
++ supplied by the caller. Force a failure.
++*/
++#ifndef SYSTEM_NSS
++#define RNG_GenerateGlobalRandomBytes(p,l) SECFailure
++#endif
++#endif
++#define CHECK_MPI_OK(func) if (MP_OKAY > (err = func)) goto cleanup
++#define MP_TO_SEC_ERROR(err)
++
++#define SECITEM_TO_MPINT(it, mp) \
++ CHECK_MPI_OK(mp_read_unsigned_octets((mp), (it).data, (it).len))
++
++extern int ecc_knzero_random_generator(uint8_t *, size_t);
++extern ulong_t soft_nzero_random_generator(uint8_t *, ulong_t);
++
++#ifdef SYSTEM_NSS
++#define EC_DecodeParams(a,b,c) EC_DecodeParams(a,b)
++#define ECDSA_VerifyDigest(a,b,c,d) ECDSA_VerifyDigest(a,b,c)
++#define ECDH_Derive(a,b,c,d,e,f) ECDH_Derive(a,b,c,d,e)
++#else
++extern SECStatus EC_DecodeParams(const SECItem *, ECParams **, int);
++
++extern SECItem * SECITEM_AllocItem(PRArenaPool *, SECItem *, unsigned int, int);
++extern SECStatus SECITEM_CopyItem(PRArenaPool *, SECItem *, const SECItem *,
++ int);
++extern void SECITEM_FreeItem(SECItem *, boolean_t);
++
++/* This function has been modified to accept an array of random bytes */
++extern SECStatus EC_NewKey(ECParams *ecParams, ECPrivateKey **privKey,
++ const unsigned char* random, int randomlen, int);
++/* This function has been modified to accept an array of random bytes */
++extern SECStatus ECDSA_SignDigest(ECPrivateKey *, SECItem *, const SECItem *,
++ const unsigned char* random, int randomlen, int, int timing);
++extern SECStatus ECDSA_VerifyDigest(ECPublicKey *, const SECItem *,
++ const SECItem *, int);
++extern SECStatus ECDH_Derive(SECItem *, ECParams *, SECItem *, boolean_t,
++ SECItem *, int);
++#endif
++
++#ifdef __cplusplus
++}
++#endif
++
++#endif /* _ECC_IMPL_H */
diff --git a/aarch64BuildFailure.patch b/aarch64BuildFailure.patch
deleted file mode 100644
index bb5453e..0000000
--- a/aarch64BuildFailure.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff -r 214a94e9366c src/cpu/aarch64/vm/nativeInst_aarch64.cpp
---- openjdk/src/hotspot/cpu/aarch64/nativeInst_aarch64.cpp Mon Jul 17 12:11:32 2017
+0000
-+++ openjdk/src/hotspot/cpu/aarch64/nativeInst_aarch64.cpp Mon Jul 24 16:23:14 2017
+0100
-@@ -343,7 +343,7 @@
- CodeBuffer cb(code_pos, instruction_size);
- MacroAssembler a(&cb);
-
-- a.mov(rscratch1, entry);
-+ a.movptr(rscratch1, (uintptr_t)entry);
- a.br(rscratch1);
-
- ICache::invalidate_range(code_pos, instruction_size);
-
-
diff --git a/bootcycle_jobs.patch b/bootcycle_jobs.patch
deleted file mode 100644
index 05cae9d..0000000
--- a/bootcycle_jobs.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-diff -r 21b063d75b3e make/Init.gmk
---- openjdk/make/Init.gmk Thu Mar 16 16:34:33 2017 +0000
-+++ oepnjdk/make/Init.gmk Tue Apr 04 13:49:37 2017 +0100
-@@ -303,7 +303,8 @@
- $(call PrepareSmartJavac)
- ( cd $(TOPDIR) && \
- $(NICE) $(MAKE) $(MAKE_ARGS) $(OUTPUT_SYNC_FLAG) \
-- -j $(JOBS) -f make/Main.gmk $(USER_MAKE_VARS) \
-+ $(if $(DISABLE_JOBS),, -j $(JOBS)) \
-+ -f make/Main.gmk $(USER_MAKE_VARS) \
- $(PARALLEL_TARGETS) $(COMPARE_BUILD_MAKE) $(BUILD_LOG_PIPE) || \
- ( exitcode=$$? && \
- $(PRINTF) "\nERROR: Build failed for $(TARGET_DESCRIPTION) (exit code
$$exitcode) \n" \
-diff -r 21b063d75b3e make/Main.gmk
---- jdk9/make/Main.gmk Thu Mar 16 16:34:33 2017 +0000
-+++ jdk9/make/Main.gmk Tue Apr 04 13:49:37 2017 +0100
-@@ -320,7 +320,7 @@
- ifneq ($(COMPILE_TYPE), cross)
- $(call LogWarn, Boot cycle build step 2: Building a new JDK image using previously
built image)
- +$(MAKE) $(MAKE_ARGS) -f $(TOPDIR)/make/Init.gmk PARALLEL_TARGETS=$(BOOTCYCLE_TARGET)
\
-- JOBS= SPEC=$(dir $(SPEC))bootcycle-spec.gmk main
-+ DISABLE_JOBS=true SPEC=$(dir $(SPEC))bootcycle-spec.gmk main
- else
- $(call LogWarn, Boot cycle build disabled when cross compiling)
- endif
diff --git a/hotspot-min-max-macros.patch b/hotspot-min-max-macros.patch
deleted file mode 100644
index 3b2909c..0000000
--- a/hotspot-min-max-macros.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff -r b515beb3b4ad openjdk/srchotspot/src/share/vm/utilities/globalDefinitions.hpp
---- openjdk/srchotspot/src/share/vm/utilities/globalDefinitions.hpp Thu Jul 07 18:40:53
2016 +0100
-+++ openjdk/srchotspot/src/share/vm/utilities/globalDefinitions.hpp Tue Jul 12 19:13:51
2016 +0100
-@@ -1163,8 +1163,10 @@
- #undef min
- #endif
-
-+#ifndef _GLIBCXX_STDLIB_H
- #define max(a,b) Do_not_use_max_use_MAX2_instead
- #define min(a,b) Do_not_use_min_use_MIN2_instead
-+#endif
-
- // It is necessary to use templates here. Having normal overloaded
- // functions does not work because it is necessary to provide both 32-
diff --git a/java-openjdk-s390-size_t.patch b/java-openjdk-s390-size_t.patch
new file mode 100644
index 0000000..920624c
--- /dev/null
+++ b/java-openjdk-s390-size_t.patch
@@ -0,0 +1,134 @@
+diff --git a/src/hotspot/share/code/codeCache.cpp b/src/hotspot/share/code/codeCache.cpp
+--- a/src/hotspot/share/code/codeCache.cpp
++++ b/src/hotspot/share/code/codeCache.cpp
+@@ -405,7 +405,7 @@
+ add_heap(heap);
+
+ // Reserve Space
+- size_t size_initial = MIN2(InitialCodeCacheSize, rs.size());
++ size_t size_initial = MIN2((size_t)InitialCodeCacheSize, rs.size());
+ size_initial = align_up(size_initial, os::vm_page_size());
+ if (!heap->reserve(rs, size_initial, CodeCacheSegmentSize)) {
+ vm_exit_during_initialization(err_msg("Could not reserve enough space in %s
(" SIZE_FORMAT "K)",
+diff --git a/src/hotspot/share/gc/cms/parNewGeneration.cpp
b/src/hotspot/share/gc/cms/parNewGeneration.cpp
+--- a/src/hotspot/share/gc/cms/parNewGeneration.cpp
++++ b/src/hotspot/share/gc/cms/parNewGeneration.cpp
+@@ -200,7 +200,7 @@
+ const size_t num_overflow_elems = of_stack->size();
+ const size_t space_available = queue->max_elems() - queue->size();
+ const size_t num_take_elems = MIN3(space_available / 4,
+- ParGCDesiredObjsFromOverflowList,
++ (size_t)ParGCDesiredObjsFromOverflowList,
+ num_overflow_elems);
+ // Transfer the most recent num_take_elems from the overflow
+ // stack to our work queue.
+diff --git a/src/hotspot/share/gc/g1/g1ConcurrentMark.cpp
b/src/hotspot/share/gc/g1/g1ConcurrentMark.cpp
+--- a/src/hotspot/share/gc/g1/g1ConcurrentMark.cpp
++++ b/src/hotspot/share/gc/g1/g1ConcurrentMark.cpp
+@@ -2296,7 +2296,7 @@
+ // of things to do) or totally (at the very end).
+ size_t target_size;
+ if (partially) {
+- target_size = MIN2((size_t)_task_queue->max_elems()/3, GCDrainStackTargetSize);
++ target_size = MIN2((size_t)_task_queue->max_elems()/3,
(size_t)GCDrainStackTargetSize);
+ } else {
+ target_size = 0;
+ }
+diff --git a/src/hotspot/share/gc/g1/g1ConcurrentMarkObjArrayProcessor.cpp
b/src/hotspot/share/gc/g1/g1ConcurrentMarkObjArrayProcessor.cpp
+--- a/src/hotspot/share/gc/g1/g1ConcurrentMarkObjArrayProcessor.cpp
++++ b/src/hotspot/share/gc/g1/g1ConcurrentMarkObjArrayProcessor.cpp
+@@ -31,7 +31,7 @@
+ }
+
+ size_t G1CMObjArrayProcessor::process_array_slice(objArrayOop obj, HeapWord* start_from,
size_t remaining) {
+- size_t words_to_scan = MIN2(remaining, ObjArrayMarkingStride);
++ size_t words_to_scan = MIN2(remaining, (size_t)ObjArrayMarkingStride);
+
+ if (remaining > ObjArrayMarkingStride) {
+ push_array_slice(start_from + ObjArrayMarkingStride);
+diff --git a/src/hotspot/share/gc/g1/g1PageBasedVirtualSpace.cpp
b/src/hotspot/share/gc/g1/g1PageBasedVirtualSpace.cpp
+--- a/src/hotspot/share/gc/g1/g1PageBasedVirtualSpace.cpp
++++ b/src/hotspot/share/gc/g1/g1PageBasedVirtualSpace.cpp
+@@ -100,7 +100,7 @@
+ return reserved_size() - committed_size();
+ }
+
+-size_t G1PageBasedVirtualSpace::addr_to_page_index(char* addr) const {
++uintptr_t G1PageBasedVirtualSpace::addr_to_page_index(char* addr) const {
+ return (addr - _low_boundary) / _page_size;
+ }
+
+diff --git a/src/hotspot/share/gc/parallel/psCompactionManager.inline.hpp
b/src/hotspot/share/gc/parallel/psCompactionManager.inline.hpp
+--- a/src/hotspot/share/gc/parallel/psCompactionManager.inline.hpp
++++ b/src/hotspot/share/gc/parallel/psCompactionManager.inline.hpp
+@@ -115,7 +115,7 @@
+ const size_t beg_index = size_t(index);
+ assert(beg_index < len || len == 0, "index too large");
+
+- const size_t stride = MIN2(len - beg_index, ObjArrayMarkingStride);
++ const size_t stride = MIN2(len - beg_index, (size_t)ObjArrayMarkingStride);
+ const size_t end_index = beg_index + stride;
+ T* const base = (T*)obj->base();
+ T* const beg = base + beg_index;
+diff --git a/src/hotspot/share/gc/parallel/psParallelCompact.cpp
b/src/hotspot/share/gc/parallel/psParallelCompact.cpp
+--- a/src/hotspot/share/gc/parallel/psParallelCompact.cpp
++++ b/src/hotspot/share/gc/parallel/psParallelCompact.cpp
+@@ -905,8 +905,8 @@
+ void PSParallelCompact::initialize_dead_wood_limiter()
+ {
+ const size_t max = 100;
+- _dwl_mean = double(MIN2(ParallelOldDeadWoodLimiterMean, max)) / 100.0;
+- _dwl_std_dev = double(MIN2(ParallelOldDeadWoodLimiterStdDev, max)) / 100.0;
++ _dwl_mean = double(MIN2((size_t)ParallelOldDeadWoodLimiterMean, max)) / 100.0;
++ _dwl_std_dev = double(MIN2((size_t)ParallelOldDeadWoodLimiterStdDev, max)) / 100.0;
+ _dwl_first_term = 1.0 / (sqrt(2.0 * M_PI) * _dwl_std_dev);
+ DEBUG_ONLY(_dwl_initialized = true;)
+ _dwl_adjustment = normal_distribution(1.0);
+diff --git a/src/hotspot/share/gc/shared/plab.cpp b/src/hotspot/share/gc/shared/plab.cpp
+--- a/src/hotspot/share/gc/shared/plab.cpp
++++ b/src/hotspot/share/gc/shared/plab.cpp
+@@ -32,7 +32,7 @@
+
+ size_t PLAB::min_size() {
+ // Make sure that we return something that is larger than AlignmentReserve
+- return align_object_size(MAX2(MinTLABSize / HeapWordSize,
(uintx)oopDesc::header_size())) + AlignmentReserve;
++ return align_object_size(MAX2(MinTLABSize / HeapWordSize,
(size_t)oopDesc::header_size())) + AlignmentReserve;
+ }
+
+ size_t PLAB::max_size() {
+diff --git a/src/hotspot/share/prims/whitebox.cpp b/src/hotspot/share/prims/whitebox.cpp
+--- a/src/hotspot/share/prims/whitebox.cpp
++++ b/src/hotspot/share/prims/whitebox.cpp
+@@ -1096,7 +1096,7 @@
+ WB_END
+
+ WB_ENTRY(jobject, WB_GetSizeTVMFlag(JNIEnv* env, jobject o, jstring name))
+- uintx result;
++ size_t result;
+ if (GetVMFlag <size_t> (thread, env, name, &result,
&CommandLineFlags::size_tAt)) {
+ ThreadToNativeFromVM ttnfv(thread); // can't be in VM when we call JNI
+ return longBox(thread, env, result);
+diff --git a/src/hotspot/share/runtime/arguments.cpp
b/src/hotspot/share/runtime/arguments.cpp
+--- a/src/hotspot/share/runtime/arguments.cpp
++++ b/src/hotspot/share/runtime/arguments.cpp
+@@ -1586,7 +1586,7 @@
+ // Increase the code cache size - tiered compiles a lot more.
+ if (FLAG_IS_DEFAULT(ReservedCodeCacheSize)) {
+ FLAG_SET_ERGO(uintx, ReservedCodeCacheSize,
+- MIN2(CODE_CACHE_DEFAULT_LIMIT, ReservedCodeCacheSize * 5));
++ MIN2(CODE_CACHE_DEFAULT_LIMIT, (size_t)(ReservedCodeCacheSize * 5)));
+ }
+ // Enable SegmentedCodeCache if TieredCompilation is enabled and ReservedCodeCacheSize
>= 240M
+ if (FLAG_IS_DEFAULT(SegmentedCodeCache) && ReservedCodeCacheSize >= 240*M)
{
+diff --git a/src/hotspot/share/runtime/arguments.hpp
b/src/hotspot/share/runtime/arguments.hpp
+--- a/src/hotspot/share/runtime/arguments.hpp
++++ b/src/hotspot/share/runtime/arguments.hpp
+@@ -328,7 +328,7 @@
+ // Value of the conservative maximum heap alignment needed
+ static size_t _conservative_max_heap_alignment;
+
+- static uintx _min_heap_size;
++ static size_t _min_heap_size;
+
+ // -Xrun arguments
+ static AgentLibraryList _libraryList;
diff --git a/java-openjdk.spec b/java-openjdk.spec
index d095e6a..53e037b 100644
--- a/java-openjdk.spec
+++ b/java-openjdk.spec
@@ -825,7 +825,7 @@ Provides: java-%{javaver}-%{origin}-src%{?1} =
%{epoch}:%{version}-%{release}
Name: java-%{origin}
Version: %{newjavaver}.%{buildver}
-Release: 1%{?dist}
+Release: 2%{?dist}
# java-1.5.0-ibm from
jpackage.org set Epoch to 1 for unknown reasons
# and this change was brought into RHEL-4. java-1.5.0-ibm packages
# also included the epoch in their virtual provides. This created a
@@ -866,38 +866,48 @@ Source13: TestCryptoLevel.java
# Ensure ECDSA is working
Source14: TestECDSA.java
+############################################
#
# RPM/distribution specific patches
#
+############################################
+
+# NSS via SunPKCS11 Provider (disabled comment
+# due to memory leak).
+Patch1000: enableCommentedOutSystemNss.patch
# Ignore AWTError when assistive technologies are loaded
-Patch1: accessible-toolkit.patch
+Patch1: accessible-toolkit.patch
# Restrict access to java-atk-wrapper classes
-Patch3: java-atk-wrapper-security.patch
-# RHBZ 808293
-Patch4: PStack-808293.patch
-# Allow multiple initialization of PKCS11 libraries
-Patch5: multiple-pkcs11-library-init.patch
-Patch12: system-nss-ec-rh1565658.patch
-Patch13: libjpeg-turbo-1.4-compat.patch
-# follow system wide crypto policy RHBZ#1249083
-Patch14: systemCryptoPolicyPR3183.patch
-
+Patch2: java-atk-wrapper-security.patch
+Patch3: libjpeg-turbo-1.4-compat.patch
+# Follow system wide crypto policy RHBZ#1249083
+Patch4: RHBZ-1249083-system-crypto-policy-PR3183.patch
+# System NSS via SunEC Provider
+Patch5: RHBZ-1565658-system-nss-SunEC.patch
+
+#############################################
#
# OpenJDK specific patches
#
-
-# JVM heap size changes for s390 (thanks to aph)
-Patch101: sorted-diff.patch
-Patch104: bootcycle_jobs.patch
-
-
-Patch400: ppc_stack_overflow_fix.patch
-Patch401: aarch64BuildFailure.patch
-
-
-# Non-OpenJDK fixes
-Patch1000: enableCommentedOutSystemNss.patch
+#############################################
+
+# s390 (Zero) build does not bootcycle without this patch
+# Already in JDK-11. Missing backports.
+Patch100: JDK-8201495-s390-java-opts.patch
+# See JDK-8198844. This won't be needed any more in
+# JDK 11+
+Patch101: sorted-diff.patch
+# Type fixing for s390 (Zero). Not upstream.
+Patch102: java-openjdk-s390-size_t.patch
+# bootcycle-images target may run out of ressources
+# due to bad jobs config. Missing backports.
+Patch103: JDK-8201788-bootcycle-images-jobs.patch
+# s390 (Zero) build fix. Pending upstream.
+Patch104: JDK-8201509-s390-atomic_store.patch
+
+# aarch64 slowdebug build fix. Pending upstream
+Patch400: JDK-8200556-aarch64-slowdebug-crash.patch
BuildRequires: autoconf
BuildRequires: automake
@@ -1154,26 +1164,18 @@ fi
sh %{SOURCE12}
pushd %{top_level_dir_name}
%patch1 -p1
+%patch2 -p1
%patch3 -p1
%patch4 -p1
%patch5 -p1
-%patch12 -p1
-%patch13 -p1
-%patch14 -p1
-
-# s390 build fixes
-%ifarch s390
-
-%endif
%patch101 -p1
+%patch102 -p1
+%patch103 -p1
%patch104 -p1
-# Zero PPC fixes
-# TODO: propose them upstream
%patch400 -p1
-%patch401 -p1
popd # openjdk
%patch1000
@@ -1728,6 +1730,20 @@ require "copy_jdk_configs.lua"
%changelog
+* Fri Apr 20 2018 Severin Gehwolf <sgehwolf(a)redhat.com> - 1:10.0.1.10-2
+- Removed unneeded patches:
+ PStack-808293.patch
+ multiple-pkcs11-library-init.patch
+ ppc_stack_overflow_fix.patch
+- Added patches for s390 Zero builds:
+ JDK-8201495-s390-java-opts.patch
+ JDK-8201509-s390-atomic_store.patch
+- Renamed patches for clarity:
+ aarch64BuildFailure.patch => JDK-8200556-aarch64-slowdebug-crash.patch
+ systemCryptoPolicyPR3183.patch => RHBZ-1249083-system-crypto-policy-PR3183.patch
+ bootcycle_jobs.patch => JDK-8201788-bootcycle-images-jobs.patch
+ system-nss-ec-rh1565658.patch => RHBZ-1565658-system-nss-SunEC.patch
+
* Fri Apr 20 2018 Jiri Vanek <jvanek(a)redhat.com> - 1:10.0.1.10-1
- updated to security update 1
- jexec unlinked from path
diff --git a/multiple-pkcs11-library-init.patch b/multiple-pkcs11-library-init.patch
deleted file mode 100644
index ade94ee..0000000
--- a/multiple-pkcs11-library-init.patch
+++ /dev/null
@@ -1,74 +0,0 @@
-# HG changeset patch
-# User andrew
-# Date 1352129932 0
-# Node ID e9c857dcb964dbfa5eef3a3590244cb4d999cf7a
-# Parent 1406789608b76d0906881979335d685855f44190
-Allow multiple PKCS11 library initialisation to be a non-critical error.
-
-diff -r 1406789608b7 -r e9c857dcb964 src/share/classes/sun/security/pkcs11/Config.java
---- openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/Config.java Tue Oct
30 13:05:14 2012 +0000
-+++ openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/Config.java Mon Nov
05 15:38:52 2012 +0000
-@@ -52,6 +52,7 @@
- static final int ERR_HALT = 1;
- static final int ERR_IGNORE_ALL = 2;
- static final int ERR_IGNORE_LIB = 3;
-+ static final int ERR_IGNORE_MULTI_INIT = 4;
-
- // same as allowSingleThreadedModules but controlled via a system property
- // and applied to all providers. if set to false, no SunPKCS11 instances
-@@ -980,6 +981,8 @@
- handleStartupErrors = ERR_IGNORE_LIB;
- } else if (val.equals("halt")) {
- handleStartupErrors = ERR_HALT;
-+ } else if (val.equals("ignoreMultipleInitialisation")) {
-+ handleStartupErrors = ERR_IGNORE_MULTI_INIT;
- } else {
- throw excToken("Invalid value for handleStartupErrors:");
- }
-diff -r 1406789608b7 -r e9c857dcb964
src/share/classes/sun/security/pkcs11/SunPKCS11.java
---- openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java Tue
Oct 30 13:05:14 2012 +0000
-+++ openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java Mon
Nov 05 15:38:52 2012 +0000
-@@ -168,26 +168,37 @@
- String nssLibraryDirectory = config.getNssLibraryDirectory();
- String nssSecmodDirectory = config.getNssSecmodDirectory();
- boolean nssOptimizeSpace = config.getNssOptimizeSpace();
-+ int errorHandling = config.getHandleStartupErrors();
-
- if (secmod.isInitialized()) {
- if (nssSecmodDirectory != null) {
- String s = secmod.getConfigDir();
- if ((s != null) &&
- (s.equals(nssSecmodDirectory) == false)) {
-- throw new ProviderException("Secmod directory "
-- + nssSecmodDirectory
-- + " invalid, NSS already initialized with "
-- + s);
-+ String msg = "Secmod directory " +
nssSecmodDirectory
-+ + " invalid, NSS already initialized with " +
s;
-+ if (errorHandling == Config.ERR_IGNORE_MULTI_INIT ||
-+ errorHandling == Config.ERR_IGNORE_ALL) {
-+ throw new UnsupportedOperationException(msg);
-+ } else {
-+ throw new ProviderException(msg);
-+ }
- }
- }
- if (nssLibraryDirectory != null) {
- String s = secmod.getLibDir();
- if ((s != null) &&
- (s.equals(nssLibraryDirectory) == false)) {
-- throw new ProviderException("NSS library directory
"
-+ String msg = "NSS library directory "
- + nssLibraryDirectory
- + " invalid, NSS already initialized with "
-- + s);
-+ + s;
-+ if (errorHandling == Config.ERR_IGNORE_MULTI_INIT ||
-+ errorHandling == Config.ERR_IGNORE_ALL) {
-+ throw new UnsupportedOperationException(msg);
-+ } else {
-+ throw new ProviderException(msg);
-+ }
- }
- }
- } else {
diff --git a/ppc_stack_overflow_fix.patch b/ppc_stack_overflow_fix.patch
deleted file mode 100644
index d1b6184..0000000
--- a/ppc_stack_overflow_fix.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-diff --git a/src/cpu/zero/vm/stack_zero.hpp b/src/cpu/zero/vm/stack_zero.hpp
---- openjdk/src/hotspot/cpu/zero/stack_zero.hpp
-+++ openjdk/src/hotspot/cpu/zero/stack_zero.hpp
-@@ -99,7 +99,7 @@
- int shadow_pages_size() const {
- return _shadow_pages_size;
- }
-- int abi_stack_available(Thread *thread) const;
-+ ssize_t abi_stack_available(Thread *thread) const;
-
- public:
- void overflow_check(int required_words, TRAPS);
-diff --git a/src/cpu/zero/vm/stack_zero.inline.hpp
b/src/cpu/zero/vm/stack_zero.inline.hpp
---- openjdk/src/hotspot/cpu/zero/stack_zero.inline.hpp
-+++ openjdk/src/hotspot/cpu/zero/stack_zero.inline.hpp
-@@ -47,12 +47,12 @@
- // This method returns the amount of ABI stack available for us
- // to use under normal circumstances. Note that the returned
- // value can be negative.
--inline int ZeroStack::abi_stack_available(Thread *thread) const {
-+inline ssize_t ZeroStack::abi_stack_available(Thread *thread) const {
- guarantee(Thread::current() == thread, "should run in the same thread");
-- int stack_used = thread->stack_base() - (address) &stack_used
-+ ssize_t stack_used = thread->stack_base() - (address) &stack_used
- + (JavaThread::stack_guard_zone_size() + JavaThread::stack_shadow_zone_size());
-- int stack_free = thread->stack_size() - stack_used;
-+ ssize_t stack_free = thread->stack_size() - stack_used;
- return stack_free;
- }
-
- #endif // CPU_ZERO_VM_STACK_ZERO_INLINE_HPP
-diff --git a/src/os/linux/vm/os_linux.cpp b/src/os/linux/vm/os_linux.cpp
---- openjdk/src/hotspot/os/posix/os_posix.cpp
-+++ openjdk/src/hotspot/os/posix/os_posix.cpp
-@@ -4791,6 +4791,13 @@
-
- _java_thread_min_stack_allowed = align_up(_java_thread_min_stack_allowed,
vm_page_size());
- _java_thread_min_stack_allowed = MAX2(_java_thread_min_stack_allowed,
os_min_stack_allowed);
-+#ifdef ZERO
-+ // If this is Zero, allow at the very minimum one page each for the
-+ // Zero stack and the native stack. This won't make any difference
-+ // for 4k pages, but is significant for large pages.
-+ _java_thread_min_stack_allowed = MAX2(_java_thread_min_stack_allowed,
-+
align_size_up((size_t)(JavaThread::stack_guard_zone_size()+JavaThread::stack_shadow_zone_size()+2)
* vm_page_size(), vm_page_size());
-+#endif
-
- size_t stack_size_in_bytes = ThreadStackSize * K;
- if (stack_size_in_bytes != 0 &&
diff --git a/system-nss-ec-rh1565658.patch b/system-nss-ec-rh1565658.patch
deleted file mode 100644
index 7b1d4aa..0000000
--- a/system-nss-ec-rh1565658.patch
+++ /dev/null
@@ -1,654 +0,0 @@
-diff --git openjdk/make/autoconf/jdk-options.m4 openjdk/make/autoconf/jdk-options.m4
---- openjdk/make/autoconf/jdk-options.m4
-+++ openjdk/make/autoconf/jdk-options.m4
-@@ -264,9 +264,10 @@
- #
- AC_DEFUN_ONCE([JDKOPT_DETECT_INTREE_EC],
- [
-+ AC_REQUIRE([LIB_SETUP_MISC_LIBS])
- AC_MSG_CHECKING([if elliptic curve crypto implementation is present])
-
-- if test -d "${TOPDIR}/src/jdk.crypto.ec/share/native/libsunec/impl"; then
-+ if test "x${system_nss}" = "xyes" -o -d
"${TOPDIR}/src/jdk.crypto.ec/share/native/libsunec/impl"; then
- ENABLE_INTREE_EC=true
- AC_MSG_RESULT([yes])
- else
-diff --git openjdk/make/autoconf/libraries.m4 openjdk/make/autoconf/libraries.m4
---- openjdk/make/autoconf/libraries.m4
-+++ openjdk/make/autoconf/libraries.m4
-@@ -175,6 +175,48 @@
- AC_SUBST(LIBDL)
- LIBS="$save_LIBS"
-
-+ ###############################################################################
-+ #
-+ # Check for the NSS libraries
-+ #
-+
-+ AC_MSG_CHECKING([whether to build the Sun EC provider against the system NSS
libraries])
-+
-+ # default is bundled
-+ DEFAULT_SYSTEM_NSS=no
-+
-+ AC_ARG_ENABLE([system-nss], [AS_HELP_STRING([--enable-system-nss],
-+ [build the SunEC provider using the system NSS libraries
@<:@disabled@:>@])],
-+ [
-+ case "${enableval}" in
-+ yes)
-+ system_nss=yes
-+ ;;
-+ *)
-+ system_nss=no
-+ ;;
-+ esac
-+ ],
-+ [
-+ system_nss=${DEFAULT_SYSTEM_NSS}
-+ ])
-+ AC_MSG_RESULT([$system_nss])
-+
-+ if test "x${system_nss}" = "xyes"; then
-+ PKG_CHECK_MODULES(NSS_SOFTTKN, nss-softokn >= 3.16.1, [NSS_SOFTOKN_FOUND=yes],
[NSS_SOFTOKN_FOUND=no])
-+ PKG_CHECK_MODULES(NSS, nss >= 3.16.1, [NSS_FOUND=yes], [NSS_FOUND=no])
-+ if test "x${NSS_SOFTOKN_FOUND}" = "xyes" -a
"x${NSS_FOUND}" = "xyes"; then
-+ NSS_LIBS="$NSS_SOFTOKN_LIBS $NSS_LIBS -lfreebl";
-+ USE_EXTERNAL_NSS=true
-+ else
-+ AC_MSG_ERROR([--enable-system-nss specified, but NSS not found.])
-+ fi
-+ else
-+ USE_EXTERNAL_NSS=false
-+ fi
-+ AC_SUBST(USE_EXTERNAL_NSS)
-+
-+
- # Deprecated libraries, keep the flags for backwards compatibility
- if test "x$OPENJDK_TARGET_OS" = "xwindows"; then
- BASIC_DEPRECATED_ARG_WITH([dxsdk])
-diff --git openjdk/make/autoconf/spec.gmk.in openjdk/make/autoconf/spec.gmk.in
---- openjdk/make/autoconf/spec.gmk.in
-+++ openjdk/make/autoconf/spec.gmk.in
-@@ -764,6 +764,10 @@
- # Libraries
- #
-
-+USE_EXTERNAL_NSS:=@USE_EXTERNAL_NSS@
-+NSS_LIBS:=@NSS_LIBS@
-+NSS_CFLAGS:=@NSS_CFLAGS@
-+
- USE_EXTERNAL_LCMS:=@USE_EXTERNAL_LCMS@
- LCMS_CFLAGS:=@LCMS_CFLAGS@
- LCMS_LIBS:=@LCMS_LIBS@
-diff --git openjdk/make/lib/Lib-jdk.crypto.ec.gmk openjdk/make/lib/Lib-jdk.crypto.ec.gmk
---- openjdk/make/lib/Lib-jdk.crypto.ec.gmk
-+++ openjdk/make/lib/Lib-jdk.crypto.ec.gmk
-@@ -29,9 +29,15 @@
-
- ifeq ($(ENABLE_INTREE_EC), true)
-
-- LIBSUNEC_SRC := $(TOPDIR)/src/jdk.crypto.ec/share/native/libsunec
- BUILD_LIBSUNEC_FLAGS := $(addprefix -I, $(SUNEC_SRC))
-
-+ ifeq ($(USE_EXTERNAL_NSS), true)
-+ LIBSUNEC_SRC := $(TOPDIR)/src/jdk.crypto.ec/share/native/libsunec/ECC_JNI.cpp
-+ BUILD_LIBSUNEC_FLAGS += $(NSS_CFLAGS) -DSYSTEM_NSS -DNSS_ENABLE_ECC
-+ else
-+ LIBSUNEC_SRC := $(TOPDIR)/src/jdk.crypto.ec/share/native/libsunec
-+ endif
-+
- #
- # On sol-sparc...all libraries are compiled with -xregs=no%appl
- # (set in CFLAGS_REQUIRED_sparc)
-@@ -60,7 +66,7 @@
- LDFLAGS := $(LDFLAGS_JDKLIB) $(LDFLAGS_CXX_JDK), \
- LDFLAGS_macosx := $(call SET_SHARED_LIBRARY_ORIGIN), \
- LIBS := $(LIBCXX), \
-- LIBS_linux := -lc, \
-+ LIBS_linux := -lc $(NSS_LIBS), \
- LIBS_solaris := -lc, \
- VERSIONINFO_RESOURCE := $(GLOBAL_VERSION_INFO_RESOURCE), \
- RC_FLAGS := $(RC_FLAGS) \
-diff --git openjdk/make/mapfiles/libsunec/mapfile-vers
openjdk/make/mapfiles/libsunec/mapfile-vers
---- openjdk/make/mapfiles/libsunec/mapfile-vers
-+++ openjdk/make/mapfiles/libsunec/mapfile-vers
-@@ -31,6 +31,7 @@
- Java_sun_security_ec_ECDSASignature_signDigest;
- Java_sun_security_ec_ECDSASignature_verifySignedDigest;
- Java_sun_security_ec_ECDHKeyAgreement_deriveKey;
-+ Java_sun_security_ec_SunEC_initialize;
- local:
- *;
- };
-diff --git openjdk/src/java.base/unix/native/include/jni_md.h
openjdk/src/java.base/unix/native/include/jni_md.h
---- openjdk/src/java.base/unix/native/include/jni_md.h
-+++ openjdk/src/java.base/unix/native/include/jni_md.h
-@@ -36,6 +36,11 @@
- #define JNIEXPORT
- #define JNIIMPORT
- #endif
-+#if (defined(__GNUC__)) || __has_attribute(unused)
-+ #define UNUSED(x) UNUSED_ ## x __attribute__((__unused__))
-+#else
-+ #define UNUSED(x) UNUSED_ ## x
-+#endif
-
- #define JNICALL
-
-diff --git openjdk/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
openjdk/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
---- openjdk/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
-+++ openjdk/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
-@@ -61,6 +61,7 @@
- AccessController.doPrivileged(new PrivilegedAction<Void>() {
- public Void run() {
- System.loadLibrary("sunec"); // check for native library
-+ initialize();
- return null;
- }
- });
-@@ -272,4 +273,9 @@
- putService(new ProviderService(this, "KeyAgreement",
- "ECDH", "sun.security.ec.ECDHKeyAgreement", null,
ATTRS));
- }
-+
-+ /**
-+ * Initialize the native code.
-+ */
-+ private static native void initialize();
- }
-diff --git openjdk/src/jdk.crypto.ec/share/native/libsunec/ECC_JNI.cpp
openjdk/src/jdk.crypto.ec/share/native/libsunec/ECC_JNI.cpp
---- openjdk/src/jdk.crypto.ec/share/native/libsunec/ECC_JNI.cpp
-+++ openjdk/src/jdk.crypto.ec/share/native/libsunec/ECC_JNI.cpp
-@@ -25,7 +25,11 @@
-
- #include <jni.h>
- #include "jni_util.h"
-+#ifdef SYSTEM_NSS
-+#include "ecc_impl.h"
-+#else
- #include "impl/ecc_impl.h"
-+#endif
-
- #define ILLEGAL_STATE_EXCEPTION "java/lang/IllegalStateException"
- #define INVALID_ALGORITHM_PARAMETER_EXCEPTION \
-@@ -33,6 +37,13 @@
- #define INVALID_PARAMETER_EXCEPTION \
- "java/security/InvalidParameterException"
- #define KEY_EXCEPTION "java/security/KeyException"
-+#define INTERNAL_ERROR "java/lang/InternalError"
-+
-+#ifdef SYSTEM_NSS
-+#define SYSTEM_UNUSED(x) UNUSED(x)
-+#else
-+#define SYSTEM_UNUSED(x) x
-+#endif
-
- extern "C" {
-
-@@ -55,8 +66,13 @@
- /*
- * Deep free of the ECParams struct
- */
--void FreeECParams(ECParams *ecparams, jboolean freeStruct)
-+void FreeECParams(ECParams *ecparams, jboolean SYSTEM_UNUSED(freeStruct))
- {
-+#ifdef SYSTEM_NSS
-+ // Needs to be freed using the matching method to the one
-+ // that allocated it. PR_TRUE means the memory is zeroed.
-+ PORT_FreeArena(ecparams->arena, PR_TRUE);
-+#else
- // Use B_FALSE to free the SECItem->data element, but not the SECItem itself
- // Use B_TRUE to free both
-
-@@ -70,6 +86,7 @@
- SECITEM_FreeItem(&ecparams->curveOID, B_FALSE);
- if (freeStruct)
- free(ecparams);
-+#endif
- }
-
- jbyteArray getEncodedBytes(JNIEnv *env, SECItem *hSECItem)
-@@ -95,7 +112,7 @@
- */
- JNIEXPORT jobjectArray
- JNICALL Java_sun_security_ec_ECKeyPairGenerator_generateECKeyPair
-- (JNIEnv *env, jclass clazz, jint keySize, jbyteArray encodedParams, jbyteArray seed)
-+ (JNIEnv *env, jclass UNUSED(clazz), jint UNUSED(keySize), jbyteArray encodedParams,
jbyteArray seed)
- {
- ECPrivateKey *privKey = NULL; // contains both public and private values
- ECParams *ecparams = NULL;
-@@ -127,8 +144,17 @@
- env->GetByteArrayRegion(seed, 0, jSeedLength, pSeedBuffer);
-
- // Generate the new keypair (using the supplied seed)
-+#ifdef SYSTEM_NSS
-+ if (RNG_RandomUpdate((unsigned char *) pSeedBuffer, jSeedLength)
-+ != SECSuccess) {
-+ ThrowException(env, KEY_EXCEPTION);
-+ goto cleanup;
-+ }
-+ if (EC_NewKey(ecparams, &privKey) != SECSuccess) {
-+#else
- if (EC_NewKey(ecparams, &privKey, (unsigned char *) pSeedBuffer,
- jSeedLength, 0) != SECSuccess) {
-+#endif
- ThrowException(env, KEY_EXCEPTION);
- goto cleanup;
- }
-@@ -175,10 +201,15 @@
- }
- if (privKey) {
- FreeECParams(&privKey->ecParams, false);
-+#ifndef SYSTEM_NSS
-+ // The entire ECPrivateKey is allocated in the arena
-+ // when using system NSS, so only the in-tree version
-+ // needs to clear these manually.
- SECITEM_FreeItem(&privKey->version, B_FALSE);
- SECITEM_FreeItem(&privKey->privateValue, B_FALSE);
- SECITEM_FreeItem(&privKey->publicValue, B_FALSE);
- free(privKey);
-+#endif
- }
-
- if (pSeedBuffer) {
-@@ -196,7 +227,7 @@
- */
- JNIEXPORT jbyteArray
- JNICALL Java_sun_security_ec_ECDSASignature_signDigest
-- (JNIEnv *env, jclass clazz, jbyteArray digest, jbyteArray privateKey, jbyteArray
encodedParams, jbyteArray seed, jint timing)
-+ (JNIEnv *env, jclass UNUSED(clazz), jbyteArray digest, jbyteArray privateKey,
jbyteArray encodedParams, jbyteArray seed, jint timing)
- {
- jbyte* pDigestBuffer = NULL;
- jint jDigestLength = env->GetArrayLength(digest);
-@@ -255,8 +286,18 @@
- env->GetByteArrayRegion(seed, 0, jSeedLength, pSeedBuffer);
-
- // Sign the digest (using the supplied seed)
-+#ifdef SYSTEM_NSS
-+ if (RNG_RandomUpdate((unsigned char *) pSeedBuffer, jSeedLength)
-+ != SECSuccess) {
-+ ThrowException(env, KEY_EXCEPTION);
-+ goto cleanup;
-+ }
-+ if (ECDSA_SignDigest(&privKey, &signature_item, &digest_item)
-+ != SECSuccess) {
-+#else
- if (ECDSA_SignDigest(&privKey, &signature_item, &digest_item,
- (unsigned char *) pSeedBuffer, jSeedLength, 0, timing) != SECSuccess) {
-+#endif
- ThrowException(env, KEY_EXCEPTION);
- goto cleanup;
- }
-@@ -305,7 +346,7 @@
- */
- JNIEXPORT jboolean
- JNICALL Java_sun_security_ec_ECDSASignature_verifySignedDigest
-- (JNIEnv *env, jclass clazz, jbyteArray signedDigest, jbyteArray digest, jbyteArray
publicKey, jbyteArray encodedParams)
-+ (JNIEnv *env, jclass UNUSED(clazz), jbyteArray signedDigest, jbyteArray digest,
jbyteArray publicKey, jbyteArray encodedParams)
- {
- jboolean isValid = false;
-
-@@ -362,9 +403,10 @@
-
- cleanup:
- {
-- if (params_item.data)
-+ if (params_item.data) {
- env->ReleaseByteArrayElements(encodedParams,
- (jbyte *) params_item.data, JNI_ABORT);
-+ }
-
- if (pubKey.publicValue.data)
- env->ReleaseByteArrayElements(publicKey,
-@@ -390,7 +432,7 @@
- */
- JNIEXPORT jbyteArray
- JNICALL Java_sun_security_ec_ECDHKeyAgreement_deriveKey
-- (JNIEnv *env, jclass clazz, jbyteArray privateKey, jbyteArray publicKey, jbyteArray
encodedParams)
-+ (JNIEnv *env, jclass UNUSED(clazz), jbyteArray privateKey, jbyteArray publicKey,
jbyteArray encodedParams)
- {
- jbyteArray jSecret = NULL;
- ECParams *ecparams = NULL;
-@@ -466,9 +508,10 @@
- env->ReleaseByteArrayElements(publicKey,
- (jbyte *) publicValue_item.data, JNI_ABORT);
-
-- if (params_item.data)
-+ if (params_item.data) {
- env->ReleaseByteArrayElements(encodedParams,
- (jbyte *) params_item.data, JNI_ABORT);
-+ }
-
- if (ecparams)
- FreeECParams(ecparams, true);
-@@ -477,4 +520,28 @@
- return jSecret;
- }
-
-+JNIEXPORT void
-+JNICALL Java_sun_security_ec_SunEC_initialize
-+ (JNIEnv *env, jclass UNUSED(clazz))
-+{
-+#ifdef SYSTEM_NSS
-+ if (SECOID_Init() != SECSuccess) {
-+ ThrowException(env, INTERNAL_ERROR);
-+ }
-+ if (RNG_RNGInit() != SECSuccess) {
-+ ThrowException(env, INTERNAL_ERROR);
-+ }
-+#endif
-+}
-+
-+JNIEXPORT void
-+JNICALL JNI_OnUnload
-+ (JavaVM *vm, void *reserved)
-+{
-+#ifdef SYSTEM_NSS
-+ RNG_RNGShutdown();
-+ SECOID_Shutdown();
-+#endif
-+}
-+
- } /* extern "C" */
-diff --git openjdk/src/jdk.crypto.ec/share/native/libsunec/ecc_impl.h
openjdk/src/jdk.crypto.ec/share/native/libsunec/ecc_impl.h
-new file mode 100644
---- /dev/null
-+++ openjdk/src/jdk.crypto.ec/share/native/libsunec/ecc_impl.h
-@@ -0,0 +1,298 @@
-+/*
-+ * Copyright (c) 2007, 2017, Oracle and/or its affiliates. All rights reserved.
-+ * Use is subject to license terms.
-+ *
-+ * This library is free software; you can redistribute it and/or
-+ * modify it under the terms of the GNU Lesser General Public
-+ * License as published by the Free Software Foundation; either
-+ * version 2.1 of the License, or (at your option) any later version.
-+ *
-+ * This library is distributed in the hope that it will be useful,
-+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-+ * Lesser General Public License for more details.
-+ *
-+ * You should have received a copy of the GNU Lesser General Public License
-+ * along with this library; if not, write to the Free Software Foundation,
-+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-+ *
-+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
-+ * or visit
www.oracle.com if you need additional information or have any
-+ * questions.
-+ */
-+
-+/* *********************************************************************
-+ *
-+ * The Original Code is the Netscape security libraries.
-+ *
-+ * The Initial Developer of the Original Code is
-+ * Netscape Communications Corporation.
-+ * Portions created by the Initial Developer are Copyright (C) 1994-2000
-+ * the Initial Developer. All Rights Reserved.
-+ *
-+ * Contributor(s):
-+ * Dr Vipul Gupta <vipul.gupta(a)sun.com> and
-+ * Douglas Stebila <douglas(a)stebila.ca>, Sun Microsystems Laboratories
-+ *
-+ * Last Modified Date from the Original Code: May 2017
-+ *********************************************************************** */
-+
-+#ifndef _ECC_IMPL_H
-+#define _ECC_IMPL_H
-+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif
-+
-+#include <sys/types.h>
-+
-+#ifdef SYSTEM_NSS
-+#include <secitem.h>
-+#include <secerr.h>
-+#include <keythi.h>
-+#ifdef LEGACY_NSS
-+#include <softoken.h>
-+#else
-+#include <blapi.h>
-+#endif
-+#else
-+#include "ecl-exp.h"
-+#endif
-+
-+/*
-+ * Multi-platform definitions
-+ */
-+#ifdef __linux__
-+#define B_FALSE FALSE
-+#define B_TRUE TRUE
-+typedef unsigned char uint8_t;
-+typedef unsigned long ulong_t;
-+typedef enum { B_FALSE, B_TRUE } boolean_t;
-+#endif /* __linux__ */
-+
-+#ifdef _ALLBSD_SOURCE
-+#include <stdint.h>
-+#define B_FALSE FALSE
-+#define B_TRUE TRUE
-+typedef unsigned long ulong_t;
-+typedef enum boolean { B_FALSE, B_TRUE } boolean_t;
-+#endif /* _ALLBSD_SOURCE */
-+
-+#ifdef AIX
-+#define B_FALSE FALSE
-+#define B_TRUE TRUE
-+typedef unsigned char uint8_t;
-+typedef unsigned long ulong_t;
-+#endif /* AIX */
-+
-+#ifdef _WIN32
-+typedef unsigned char uint8_t;
-+typedef unsigned long ulong_t;
-+typedef enum boolean { B_FALSE, B_TRUE } boolean_t;
-+#define strdup _strdup /* Replace POSIX name with ISO C++ name */
-+#endif /* _WIN32 */
-+
-+#ifndef _KERNEL
-+#include <stdlib.h>
-+#endif /* _KERNEL */
-+
-+#define EC_MAX_DIGEST_LEN 1024 /* max digest that can be signed */
-+#define EC_MAX_POINT_LEN 145 /* max len of DER encoded Q */
-+#define EC_MAX_VALUE_LEN 72 /* max len of ANSI X9.62 private value d */
-+#define EC_MAX_SIG_LEN 144 /* max signature len for supported curves */
-+#define EC_MIN_KEY_LEN 112 /* min key length in bits */
-+#define EC_MAX_KEY_LEN 571 /* max key length in bits */
-+#define EC_MAX_OID_LEN 10 /* max length of OID buffer */
-+
-+/*
-+ * Various structures and definitions from NSS are here.
-+ */
-+
-+#ifndef SYSTEM_NSS
-+#ifdef _KERNEL
-+#define PORT_ArenaAlloc(a, n, f) kmem_alloc((n), (f))
-+#define PORT_ArenaZAlloc(a, n, f) kmem_zalloc((n), (f))
-+#define PORT_ArenaGrow(a, b, c, d) NULL
-+#define PORT_ZAlloc(n, f) kmem_zalloc((n), (f))
-+#define PORT_Alloc(n, f) kmem_alloc((n), (f))
-+#else
-+#define PORT_ArenaAlloc(a, n, f) malloc((n))
-+#define PORT_ArenaZAlloc(a, n, f) calloc(1, (n))
-+#define PORT_ArenaGrow(a, b, c, d) NULL
-+#define PORT_ZAlloc(n, f) calloc(1, (n))
-+#define PORT_Alloc(n, f) malloc((n))
-+#endif
-+
-+#define PORT_NewArena(b) (char *)12345
-+#define PORT_ArenaMark(a) NULL
-+#define PORT_ArenaUnmark(a, b)
-+#define PORT_ArenaRelease(a, m)
-+#define PORT_FreeArena(a, b)
-+#define PORT_Strlen(s) strlen((s))
-+#define PORT_SetError(e)
-+
-+#define PRBool boolean_t
-+#define PR_TRUE B_TRUE
-+#define PR_FALSE B_FALSE
-+
-+#ifdef _KERNEL
-+#define PORT_Assert ASSERT
-+#define PORT_Memcpy(t, f, l) bcopy((f), (t), (l))
-+#else
-+#define PORT_Assert assert
-+#define PORT_Memcpy(t, f, l) memcpy((t), (f), (l))
-+#endif
-+
-+#endif
-+
-+#define CHECK_OK(func) if (func == NULL) goto cleanup
-+#define CHECK_SEC_OK(func) if (SECSuccess != (rv = func)) goto cleanup
-+
-+#ifndef SYSTEM_NSS
-+typedef enum {
-+ siBuffer = 0,
-+ siClearDataBuffer = 1,
-+ siCipherDataBuffer = 2,
-+ siDERCertBuffer = 3,
-+ siEncodedCertBuffer = 4,
-+ siDERNameBuffer = 5,
-+ siEncodedNameBuffer = 6,
-+ siAsciiNameString = 7,
-+ siAsciiString = 8,
-+ siDEROID = 9,
-+ siUnsignedInteger = 10,
-+ siUTCTime = 11,
-+ siGeneralizedTime = 12
-+} SECItemType;
-+
-+typedef struct SECItemStr SECItem;
-+
-+struct SECItemStr {
-+ SECItemType type;
-+ unsigned char *data;
-+ unsigned int len;
-+};
-+
-+typedef SECItem SECKEYECParams;
-+
-+typedef enum { ec_params_explicit,
-+ ec_params_named
-+} ECParamsType;
-+
-+typedef enum { ec_field_GFp = 1,
-+ ec_field_GF2m
-+} ECFieldType;
-+
-+struct ECFieldIDStr {
-+ int size; /* field size in bits */
-+ ECFieldType type;
-+ union {
-+ SECItem prime; /* prime p for (GFp) */
-+ SECItem poly; /* irreducible binary polynomial for (GF2m) */
-+ } u;
-+ int k1; /* first coefficient of pentanomial or
-+ * the only coefficient of trinomial
-+ */
-+ int k2; /* two remaining coefficients of pentanomial */
-+ int k3;
-+};
-+typedef struct ECFieldIDStr ECFieldID;
-+
-+struct ECCurveStr {
-+ SECItem a; /* contains octet stream encoding of
-+ * field element (X9.62 section 4.3.3)
-+ */
-+ SECItem b;
-+ SECItem seed;
-+};
-+typedef struct ECCurveStr ECCurve;
-+
-+typedef void PRArenaPool;
-+
-+struct ECParamsStr {
-+ PRArenaPool * arena;
-+ ECParamsType type;
-+ ECFieldID fieldID;
-+ ECCurve curve;
-+ SECItem base;
-+ SECItem order;
-+ int cofactor;
-+ SECItem DEREncoding;
-+ ECCurveName name;
-+ SECItem curveOID;
-+};
-+typedef struct ECParamsStr ECParams;
-+
-+struct ECPublicKeyStr {
-+ ECParams ecParams;
-+ SECItem publicValue; /* elliptic curve point encoded as
-+ * octet stream.
-+ */
-+};
-+typedef struct ECPublicKeyStr ECPublicKey;
-+
-+struct ECPrivateKeyStr {
-+ ECParams ecParams;
-+ SECItem publicValue; /* encoded ec point */
-+ SECItem privateValue; /* private big integer */
-+ SECItem version; /* As per SEC 1, Appendix C, Section C.4 */
-+};
-+typedef struct ECPrivateKeyStr ECPrivateKey;
-+
-+typedef enum _SECStatus {
-+ SECBufferTooSmall = -3,
-+ SECWouldBlock = -2,
-+ SECFailure = -1,
-+ SECSuccess = 0
-+} SECStatus;
-+#endif
-+
-+#ifdef _KERNEL
-+#define RNG_GenerateGlobalRandomBytes(p,l) ecc_knzero_random_generator((p), (l))
-+#else
-+/*
-+ This function is no longer required because the random bytes are now
-+ supplied by the caller. Force a failure.
-+*/
-+#ifndef SYSTEM_NSS
-+#define RNG_GenerateGlobalRandomBytes(p,l) SECFailure
-+#endif
-+#endif
-+#define CHECK_MPI_OK(func) if (MP_OKAY > (err = func)) goto cleanup
-+#define MP_TO_SEC_ERROR(err)
-+
-+#define SECITEM_TO_MPINT(it, mp) \
-+ CHECK_MPI_OK(mp_read_unsigned_octets((mp), (it).data, (it).len))
-+
-+extern int ecc_knzero_random_generator(uint8_t *, size_t);
-+extern ulong_t soft_nzero_random_generator(uint8_t *, ulong_t);
-+
-+#ifdef SYSTEM_NSS
-+#define EC_DecodeParams(a,b,c) EC_DecodeParams(a,b)
-+#define ECDSA_VerifyDigest(a,b,c,d) ECDSA_VerifyDigest(a,b,c)
-+#define ECDH_Derive(a,b,c,d,e,f) ECDH_Derive(a,b,c,d,e)
-+#else
-+extern SECStatus EC_DecodeParams(const SECItem *, ECParams **, int);
-+
-+extern SECItem * SECITEM_AllocItem(PRArenaPool *, SECItem *, unsigned int, int);
-+extern SECStatus SECITEM_CopyItem(PRArenaPool *, SECItem *, const SECItem *,
-+ int);
-+extern void SECITEM_FreeItem(SECItem *, boolean_t);
-+
-+/* This function has been modified to accept an array of random bytes */
-+extern SECStatus EC_NewKey(ECParams *ecParams, ECPrivateKey **privKey,
-+ const unsigned char* random, int randomlen, int);
-+/* This function has been modified to accept an array of random bytes */
-+extern SECStatus ECDSA_SignDigest(ECPrivateKey *, SECItem *, const SECItem *,
-+ const unsigned char* random, int randomlen, int, int timing);
-+extern SECStatus ECDSA_VerifyDigest(ECPublicKey *, const SECItem *,
-+ const SECItem *, int);
-+extern SECStatus ECDH_Derive(SECItem *, ECParams *, SECItem *, boolean_t,
-+ SECItem *, int);
-+#endif
-+
-+#ifdef __cplusplus
-+}
-+#endif
-+
-+#endif /* _ECC_IMPL_H */
diff --git a/systemCryptoPolicyPR3183.patch b/systemCryptoPolicyPR3183.patch
deleted file mode 100644
index 4efbe9a..0000000
--- a/systemCryptoPolicyPR3183.patch
+++ /dev/null
@@ -1,88 +0,0 @@
-
-# HG changeset patch
-# User andrew
-# Date 1478057514 0
-# Node ID 1c4d5cb2096ae55106111da200b0bcad304f650c
-# Parent 3d53f19b48384e5252f4ec8891f7a3a82d77af2a
-PR3183: Support Fedora/RHEL system crypto policy
-diff -r 3d53f19b4838 -r 1c4d5cb2096a
src/java.base/share/classes/java/security/Security.java
---- a/src/java.base/share/classes/java/security/Security.java Wed Oct 26 03:51:39 2016
+0100
-+++ b/src/java.base/share/classes/java/security/Security.java Wed Nov 02 03:31:54 2016
+0000
-@@ -43,6 +43,9 @@
- * implementation-specific location, which is typically the properties file
- * {@code conf/security/java.security} in the Java installation directory.
- *
-+ * <p>Additional default values of security properties are read from a
-+ * system-specific location, if available.</p>
-+ *
- * @author Benjamin Renaud
- * @since 1.1
- */
-@@ -52,6 +55,10 @@
- private static final Debug sdebug =
- Debug.getInstance("properties");
-
-+ /* System property file*/
-+ private static final String SYSTEM_PROPERTIES =
-+ "/etc/crypto-policies/back-ends/java.config";
-+
- /* The java.security properties */
- private static Properties props;
-
-@@ -93,6 +100,7 @@
- if (sdebug != null) {
- sdebug.println("reading security properties file: " +
- propFile);
-+ sdebug.println(props.toString());
- }
- } catch (IOException e) {
- if (sdebug != null) {
-@@ -114,6 +122,31 @@
- }
-
- if ("true".equalsIgnoreCase(props.getProperty
-+ ("security.useSystemPropertiesFile"))) {
-+
-+ // now load the system file, if it exists, so its values
-+ // will win if they conflict with the earlier values
-+ try (BufferedInputStream bis =
-+ new BufferedInputStream(new FileInputStream(SYSTEM_PROPERTIES))) {
-+ props.load(bis);
-+ loadedProps = true;
-+
-+ if (sdebug != null) {
-+ sdebug.println("reading system security properties file "
+
-+ SYSTEM_PROPERTIES);
-+ sdebug.println(props.toString());
-+ }
-+ } catch (IOException e) {
-+ if (sdebug != null) {
-+ sdebug.println
-+ ("unable to load security properties from " +
-+ SYSTEM_PROPERTIES);
-+ e.printStackTrace();
-+ }
-+ }
-+ }
-+
-+ if ("true".equalsIgnoreCase(props.getProperty
- ("security.overridePropertiesFile"))) {
-
- String extraPropFile = System.getProperty
-diff -r 3d53f19b4838 -r 1c4d5cb2096a src/java.base/share/conf/security/java.security
---- a/src/java.base/share/conf/security/java.security Wed Oct 26 03:51:39 2016 +0100
-+++ b/src/java.base/share/conf/security/java.security Wed Nov 02 03:31:54 2016 +0000
-@@ -276,6 +276,13 @@
- security.overridePropertiesFile=true
-
- #
-+# Determines whether this properties file will be appended to
-+# using the system properties file stored at
-+# /etc/crypto-policies/back-ends/java.config
-+#
-+security.useSystemPropertiesFile=true
-+
-+#
- # Determines the default key and trust manager factory algorithms for
- # the javax.net.ssl package.
- #
commit f726fb5b1f08075cedb5341ac6aeb8af82123985
Author: Jiri Vanek <jvanek(a)redhat.com>
Date: Fri Apr 20 19:59:54 2018 +0200
moved to build with jdk9
diff --git a/java-openjdk.spec b/java-openjdk.spec
index b564db3..d095e6a 100644
--- a/java-openjdk.spec
+++ b/java-openjdk.spec
@@ -1277,7 +1277,7 @@ bash ../configure \
--with-version-build=%{buildver} \
--with-version-pre="" \
--with-version-opt="" \
- --with-boot-jdk=/usr/lib/jvm/java-%{majorver}-openjdk \
+ --with-boot-jdk=/usr/lib/jvm/java-9-openjdk \
--with-debug-level=$debugbuild \
--with-native-debug-symbols=internal \
--enable-unlimited-crypto \
commit df24fcf69fe53c90b3d73d97e0038157c223e68e
Author: Jiri Vanek <jvanek(a)redhat.com>
Date: Fri Apr 20 19:51:05 2018 +0200
moved to build with jdk9
diff --git a/java-openjdk.spec b/java-openjdk.spec
index db412b5..b564db3 100644
--- a/java-openjdk.spec
+++ b/java-openjdk.spec
@@ -927,7 +927,7 @@ BuildRequires: nss-devel
BuildRequires: pkgconfig
BuildRequires: xorg-x11-proto-devel
BuildRequires: zip
-BuildRequires: java-openjdk-devel
+BuildRequires: java-9-openjdk-devel
# Zero-assembler build requirement
%ifnarch %{jit_arches}
BuildRequires: libffi-devel
commit a421a46438d333a3784056f52020395aaa04b745
Author: Jiri Vanek <jvanek(a)redhat.com>
Date: Fri Apr 20 19:39:49 2018 +0200
Sync with rawhide
diff --git a/.gitignore b/.gitignore
index ee1bc2b..0801e98 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
*.rpm
/systemtap-tapset-3.6.0pre02.tar.xz
/jdk-jdk10-jdk-10+46.tar.xz
+/jdk-updates-jdk10u-jdk-10.0.1+10.tar.xz
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..e3ebf0c
--- /dev/null
+++ b/README.md
@@ -0,0 +1,11 @@
+Rolling release of (usually) STSs OpenJDK
+OpenJDK have release cadence of 6 months. but 3/4 of them are Short Term Supported for 6
months only. This package is designed to harbore them. Currently it is build on openJDK
10. LTSs (next is 11) will go as separate packages.
+
+JDK10 is next major release of Java platform. It is bringing many cool improvements -
http://openjdk.java.net/projects/jdk/10/ and is landing to your Fedora. Where it will be
maintained for f27 and newer. Unluckily, it is STS (short term support) version. Between
individual LTS will be always several STS. Again, please See announcement:
http://mail.openjdk.java.net/pipermail/discuss/2017-September/004281.html and See java SIG
plans:
https://jvanek.fedorapeople.org/devconf/2018/changesInjavaReleaseProcess.pdf . So
this is rolling release of all STSs to come. Its fate during the release of fresh LTS is
yet to be decided. You will always be allowed to install Used LTS in fedora build root,
alongside with latest STS via alternatives.
+
+
+See announcement:
http://mail.openjdk.java.net/pipermail/discuss/2017-September/004281.html
+See java SIG plans:
https://jvanek.fedorapeople.org/devconf/2018/changesInjavaReleaseProcess.pdf
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1557371#c0
+https://fedoraproject.org/wiki/Changes/java-openjdk-10
diff --git a/java-openjdk.spec b/java-openjdk.spec
index 2795023..db412b5 100644
--- a/java-openjdk.spec
+++ b/java-openjdk.spec
@@ -143,14 +143,14 @@
# New Version-String scheme-style defines
%global majorver 10
-%global securityver 0
+%global securityver 1
# Standard JPackage naming and versioning defines
%global origin openjdk
%global origin_nice OpenJDK
%global top_level_dir_name %{origin}
%global minorver 0
-%global buildver 46
+%global buildver 10
# priority must be 7 digits in total
# setting to 1, so debug ones can have 0
%global priority 00000%{minorver}1
@@ -524,6 +524,7 @@ exit 0
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/librmi.so
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libsaproc.so
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libsctp.so
+%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libsunec.so
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libunpack.so
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libverify.so
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libzip.so
@@ -696,16 +697,13 @@ OrderWithRequires: %{name}-headless%{?1}%{?_isa} =
%{epoch}:%{version}-%{release
Provides: java-%{javaver}-%{origin} = %{epoch}:%{version}-%{release}
# Standard JPackage base provides
-Provides: jre-%{javaver}-%{origin}%{?1} = %{epoch}:%{version}-%{release}
+Provides: jre = %{javaver}%{?1}
Provides: jre-%{origin}%{?1} = %{epoch}:%{version}-%{release}
Provides: jre-%{javaver}%{?1} = %{epoch}:%{version}-%{release}
+Provides: jre-%{javaver}-%{origin}%{?1} = %{epoch}:%{version}-%{release}
Provides: java-%{javaver}%{?1} = %{epoch}:%{version}-%{release}
-Provides: jre = %{javaver}%{?1}
Provides: java-%{origin}%{?1} = %{epoch}:%{version}-%{release}
Provides: java%{?1} = %{epoch}:%{javaver}
-# Standard JPackage extensions provides
-Provides: java-fonts%{?1} = %{epoch}:%{version}
-
}
%define java_headless_rpo() %{expand:
@@ -735,24 +733,14 @@ Requires(postun): %{_sbindir}/alternatives
Requires(postun): chkconfig >= 1.7
# Standard JPackage base provides
+Provides: jre-headless%{?1} = %{epoch}:%{javaver}
Provides: jre-%{javaver}-%{origin}-headless%{?1} = %{epoch}:%{version}-%{release}
Provides: jre-%{origin}-headless%{?1} = %{epoch}:%{version}-%{release}
Provides: jre-%{javaver}-headless%{?1} = %{epoch}:%{version}-%{release}
+Provides: java-%{javaver}-%{origin}-headless%{?1} = %{epoch}:%{version}-%{release}
Provides: java-%{javaver}-headless%{?1} = %{epoch}:%{version}-%{release}
-Provides: jre-headless%{?1} = %{epoch}:%{javaver}
Provides: java-%{origin}-headless%{?1} = %{epoch}:%{version}-%{release}
Provides: java-headless%{?1} = %{epoch}:%{javaver}
-# Standard JPackage extensions provides
-Provides: jndi%{?1} = %{epoch}:%{version}
-Provides: jndi-ldap%{?1} = %{epoch}:%{version}
-Provides: jndi-cos%{?1} = %{epoch}:%{version}
-Provides: jndi-rmi%{?1} = %{epoch}:%{version}
-Provides: jndi-dns%{?1} = %{epoch}:%{version}
-Provides: jaas%{?1} = %{epoch}:%{version}
-Provides: jsse%{?1} = %{epoch}:%{version}
-Provides: jce%{?1} = %{epoch}:%{version}
-Provides: jdbc-stdext%{?1} = 4.1
-Provides: java-sasl%{?1} = %{epoch}:%{version}
#
https://bugzilla.redhat.com/show_bug.cgi?id=1312019
Provides: /usr/bin/jjs
@@ -778,6 +766,7 @@ Provides: java-sdk-%{javaver}%{?1} = %{epoch}:%{version}
#Provides: java-sdk-%%{origin}%%{?1} = %%{epoch}:%%{version}
#Provides: java-sdk%%{?1} = %%{epoch}:%%{javaver}
Provides: java-%{javaver}-devel%{?1} = %{epoch}:%{version}
+Provides: java-%{javaver}-%{origin}-devel%{?1} = %{epoch}:%{version}
#Provides: java-devel-%%{origin}%%{?1} = %%{epoch}:%%{version}
#Provides: java-devel%%{?1} = %%{epoch}:%%{javaver}
@@ -789,7 +778,9 @@ Provides: java-%{javaver}-devel%{?1} = %{epoch}:%{version}
Requires: %{name}-devel%{?1} = %{epoch}:%{version}-%{release}
OrderWithRequires: %{name}-headless%{?1} = %{epoch}:%{version}-%{release}
-Provides: java-%{javaver}-%{origin}-jmods = %{epoch}:%{version}-%{release}
+Provides: java-jmods%{?1} = %{epoch}:%{version}-%{release}
+Provides: java-%{javaver}-jmods%{?1} = %{epoch}:%{version}-%{release}
+Provides: java-%{javaver}-%{origin}-jmods%{?1} = %{epoch}:%{version}-%{release}
}
@@ -797,7 +788,9 @@ Provides: java-%{javaver}-%{origin}-jmods =
%{epoch}:%{version}-%{release}
Requires: %{name}%{?1}%{?_isa} = %{epoch}:%{version}-%{release}
OrderWithRequires: %{name}-headless%{?1}%{?_isa} = %{epoch}:%{version}-%{release}
-Provides: java-%{javaver}-%{origin}-demo = %{epoch}:%{version}-%{release}
+Provides: java-demo%{?1} = %{epoch}:%{version}-%{release}
+Provides: java-%{javaver}-demo%{?1} = %{epoch}:%{version}-%{release}
+Provides: java-%{javaver}-%{origin}-demo%{?1} = %{epoch}:%{version}-%{release}
}
@@ -832,7 +825,7 @@ Provides: java-%{javaver}-%{origin}-src%{?1} =
%{epoch}:%{version}-%{release}
Name: java-%{origin}
Version: %{newjavaver}.%{buildver}
-Release: 10%{?dist}
+Release: 1%{?dist}
# java-1.5.0-ibm from
jpackage.org set Epoch to 1 for unknown reasons
# and this change was brought into RHEL-4. java-1.5.0-ibm packages
# also included the epoch in their virtual provides. This created a
@@ -850,7 +843,7 @@ Group: Development/Languages
License: ASL 1.1 and ASL 2.0 and GPL+ and GPLv2 and GPLv2 with exceptions and GPL+ and
LGPLv2 and MPLv1.0 and MPLv1.1 and Public Domain and W3C
URL:
http://openjdk.java.net/
-Source0: jdk-jdk%{majorver}-jdk-%{majorver}+%{buildver}.tar.xz
+Source0: jdk-updates-jdk%{majorver}u-jdk-%{newjavaver}+%{buildver}.tar.xz
# Use 'generate_tarballs.sh' to generate the following tarballs
# They are based on code contained in the IcedTea7 project
@@ -885,7 +878,7 @@ Patch3: java-atk-wrapper-security.patch
Patch4: PStack-808293.patch
# Allow multiple initialization of PKCS11 libraries
Patch5: multiple-pkcs11-library-init.patch
-Patch12: removeSunEcProvider-RH1154143.patch
+Patch12: system-nss-ec-rh1565658.patch
Patch13: libjpeg-turbo-1.4-compat.patch
# follow system wide crypto policy RHBZ#1249083
Patch14: systemCryptoPolicyPR3183.patch
@@ -934,7 +927,7 @@ BuildRequires: nss-devel
BuildRequires: pkgconfig
BuildRequires: xorg-x11-proto-devel
BuildRequires: zip
-BuildRequires: java-9-openjdk-devel
+BuildRequires: java-openjdk-devel
# Zero-assembler build requirement
%ifnarch %{jit_arches}
BuildRequires: libffi-devel
@@ -1284,10 +1277,11 @@ bash ../configure \
--with-version-build=%{buildver} \
--with-version-pre="" \
--with-version-opt="" \
- --with-boot-jdk=/usr/lib/jvm/java-9-openjdk \
+ --with-boot-jdk=/usr/lib/jvm/java-%{majorver}-openjdk \
--with-debug-level=$debugbuild \
--with-native-debug-symbols=internal \
--enable-unlimited-crypto \
+ --enable-system-nss \
--with-zlib=system \
--with-libjpeg=system \
--with-giflib=system \
@@ -1351,8 +1345,7 @@ $JAVA_HOME/bin/java --add-opens java.base/javax.crypto=ALL-UNNAMED
TestCryptoLev
# Check ECC is working
$JAVA_HOME/bin/javac -d . %{SOURCE14}
-# FIXME make it run after system NSS support?
-$JAVA_HOME/bin/java $(echo $(basename %{SOURCE14})|sed "s|\.java||") || true
+$JAVA_HOME/bin/java $(echo $(basename %{SOURCE14})|sed "s|\.java||")
# Check debug symbols are present and can identify code
find "$JAVA_HOME" -iname '*.so' -print0 | while read -d $'\0'
lib
@@ -1495,7 +1488,7 @@ popd
# Install Javadoc documentation
install -d -m 755 $RPM_BUILD_ROOT%{_javadocdir}
cp -a %{buildoutputdir -- $suffix}/images/docs
$RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir -- $suffix}
-cp -a %{buildoutputdir -- $suffix}/bundles/jdk-%{majorver}+%{buildver}-docs.zip
$RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir -- $suffix}.zip
+cp -a %{buildoutputdir -- $suffix}/bundles/jdk-%{newjavaver}+%{buildver}-docs.zip
$RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir -- $suffix}.zip
# Install icons and menu entries
for s in 16 24 32 48 ; do
@@ -1735,8 +1728,22 @@ require "copy_jdk_configs.lua"
%changelog
+* Fri Apr 20 2018 Jiri Vanek <jvanek(a)redhat.com> - 1:10.0.1.10-1
+- updated to security update 1
+- jexec unlinked from path
+- used java-openjdk as boot jdk
+- aligned provides/requires
+- renamed zip javadoc
+
+* Tue Apr 10 2018 Severin Gehwolf <sgehwolf(a)redhat.com> - 1:10.0.0.46-12
+- Enable basic EC ciphers test in %check.
+
+* Tue Apr 10 2018 Severin Gehwolf <sgehwolf(a)redhat.com> - 1:10.0.0.46-11
+- Port Martin Balao's JDK 9 patch for system NSS support to JDK 10.
+- Resolves RHBZ#1565658
+
* Mon Apr 09 2018 Jiri Vanek <jvanek(a)redhat.com> - 1:10.0.0.46-10
-- fixed stap instal for i686(i386) and arm(armv7hl)
+- jexec linked to path
* Fri Apr 06 2018 Jiri Vanek <jvanek(a)redhat.com> - 1:10.0.0.46-9
- subpackage(s) replaced by sub-package(s) and other cosmetic changes
diff --git a/removeSunEcProvider-RH1154143.patch b/removeSunEcProvider-RH1154143.patch
deleted file mode 100644
index e128232..0000000
--- a/removeSunEcProvider-RH1154143.patch
+++ /dev/null
@@ -1,19 +0,0 @@
---- openjdk/src/java.base/share/conf/security/java.security.orig 2018-01-18
12:22:46.148339081 +0100
-+++ openjdk/src/java.base/share/conf/security/java.security 2018-01-18 12:25:12.225469321
+0100
-@@ -66,7 +66,6 @@
- #endif
- security.provider.tbd=SUN
- security.provider.tbd=SunRsaSign
--security.provider.tbd=SunEC
- security.provider.tbd=SunJSSE
- security.provider.tbd=SunJCE
- security.provider.tbd=SunJGSS
-@@ -681,7 +680,7 @@
- # Example:
- # jdk.tls.disabledAlgorithms=MD5, SSLv3, DSA, RSA keySize < 2048
- jdk.tls.disabledAlgorithms=SSLv3, RC4, MD5withRSA, DH keySize < 1024, \
-- EC keySize < 224, DES40_CBC, RC4_40
-+ EC, ECDHE, ECDH, DES40_CBC, RC4_40
-
- #
- # Legacy algorithms for Secure Socket Layer/Transport Layer Security (SSL/TLS)
diff --git a/sources b/sources
index e5f4ee4..31d2e7a 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (systemtap-tapset-3.6.0pre02.tar.xz) =
848f42ef7ca751e723fd50e3a6da14c0965ad4da37ea3331568658e27497b7a7e4b9aad3dedd264ad0bb5566c37a92302b905f10258a4e2c89dc4ba609e55481
-SHA512 (jdk-jdk10-jdk-10+46.tar.xz) =
6412a0cf2cfcce0a6df35f9250964d2b1f9edc110534e905a9add4a036ba6884506f5f5990d1e1d1e2db406180dae8e20097c5cf44a15c7b7b60558b95049359
+SHA512 (jdk-updates-jdk10u-jdk-10.0.1+10.tar.xz) =
e57810a4208bb12a6b37f5e8313e30c489e6611ec6be8e7a8fb3c0ae9f1842803a3775bc7cc1f597064444fb4fabae5798a4447712fbf547f7021dd0da384613
diff --git a/system-nss-ec-rh1565658.patch b/system-nss-ec-rh1565658.patch
new file mode 100644
index 0000000..7b1d4aa
--- /dev/null
+++ b/system-nss-ec-rh1565658.patch
@@ -0,0 +1,654 @@
+diff --git openjdk/make/autoconf/jdk-options.m4 openjdk/make/autoconf/jdk-options.m4
+--- openjdk/make/autoconf/jdk-options.m4
++++ openjdk/make/autoconf/jdk-options.m4
+@@ -264,9 +264,10 @@
+ #
+ AC_DEFUN_ONCE([JDKOPT_DETECT_INTREE_EC],
+ [
++ AC_REQUIRE([LIB_SETUP_MISC_LIBS])
+ AC_MSG_CHECKING([if elliptic curve crypto implementation is present])
+
+- if test -d "${TOPDIR}/src/jdk.crypto.ec/share/native/libsunec/impl"; then
++ if test "x${system_nss}" = "xyes" -o -d
"${TOPDIR}/src/jdk.crypto.ec/share/native/libsunec/impl"; then
+ ENABLE_INTREE_EC=true
+ AC_MSG_RESULT([yes])
+ else
+diff --git openjdk/make/autoconf/libraries.m4 openjdk/make/autoconf/libraries.m4
+--- openjdk/make/autoconf/libraries.m4
++++ openjdk/make/autoconf/libraries.m4
+@@ -175,6 +175,48 @@
+ AC_SUBST(LIBDL)
+ LIBS="$save_LIBS"
+
++ ###############################################################################
++ #
++ # Check for the NSS libraries
++ #
++
++ AC_MSG_CHECKING([whether to build the Sun EC provider against the system NSS
libraries])
++
++ # default is bundled
++ DEFAULT_SYSTEM_NSS=no
++
++ AC_ARG_ENABLE([system-nss], [AS_HELP_STRING([--enable-system-nss],
++ [build the SunEC provider using the system NSS libraries
@<:@disabled@:>@])],
++ [
++ case "${enableval}" in
++ yes)
++ system_nss=yes
++ ;;
++ *)
++ system_nss=no
++ ;;
++ esac
++ ],
++ [
++ system_nss=${DEFAULT_SYSTEM_NSS}
++ ])
++ AC_MSG_RESULT([$system_nss])
++
++ if test "x${system_nss}" = "xyes"; then
++ PKG_CHECK_MODULES(NSS_SOFTTKN, nss-softokn >= 3.16.1, [NSS_SOFTOKN_FOUND=yes],
[NSS_SOFTOKN_FOUND=no])
++ PKG_CHECK_MODULES(NSS, nss >= 3.16.1, [NSS_FOUND=yes], [NSS_FOUND=no])
++ if test "x${NSS_SOFTOKN_FOUND}" = "xyes" -a
"x${NSS_FOUND}" = "xyes"; then
++ NSS_LIBS="$NSS_SOFTOKN_LIBS $NSS_LIBS -lfreebl";
++ USE_EXTERNAL_NSS=true
++ else
++ AC_MSG_ERROR([--enable-system-nss specified, but NSS not found.])
++ fi
++ else
++ USE_EXTERNAL_NSS=false
++ fi
++ AC_SUBST(USE_EXTERNAL_NSS)
++
++
+ # Deprecated libraries, keep the flags for backwards compatibility
+ if test "x$OPENJDK_TARGET_OS" = "xwindows"; then
+ BASIC_DEPRECATED_ARG_WITH([dxsdk])
+diff --git openjdk/make/autoconf/spec.gmk.in openjdk/make/autoconf/spec.gmk.in
+--- openjdk/make/autoconf/spec.gmk.in
++++ openjdk/make/autoconf/spec.gmk.in
+@@ -764,6 +764,10 @@
+ # Libraries
+ #
+
++USE_EXTERNAL_NSS:=@USE_EXTERNAL_NSS@
++NSS_LIBS:=@NSS_LIBS@
++NSS_CFLAGS:=@NSS_CFLAGS@
++
+ USE_EXTERNAL_LCMS:=@USE_EXTERNAL_LCMS@
+ LCMS_CFLAGS:=@LCMS_CFLAGS@
+ LCMS_LIBS:=@LCMS_LIBS@
+diff --git openjdk/make/lib/Lib-jdk.crypto.ec.gmk openjdk/make/lib/Lib-jdk.crypto.ec.gmk
+--- openjdk/make/lib/Lib-jdk.crypto.ec.gmk
++++ openjdk/make/lib/Lib-jdk.crypto.ec.gmk
+@@ -29,9 +29,15 @@
+
+ ifeq ($(ENABLE_INTREE_EC), true)
+
+- LIBSUNEC_SRC := $(TOPDIR)/src/jdk.crypto.ec/share/native/libsunec
+ BUILD_LIBSUNEC_FLAGS := $(addprefix -I, $(SUNEC_SRC))
+
++ ifeq ($(USE_EXTERNAL_NSS), true)
++ LIBSUNEC_SRC := $(TOPDIR)/src/jdk.crypto.ec/share/native/libsunec/ECC_JNI.cpp
++ BUILD_LIBSUNEC_FLAGS += $(NSS_CFLAGS) -DSYSTEM_NSS -DNSS_ENABLE_ECC
++ else
++ LIBSUNEC_SRC := $(TOPDIR)/src/jdk.crypto.ec/share/native/libsunec
++ endif
++
+ #
+ # On sol-sparc...all libraries are compiled with -xregs=no%appl
+ # (set in CFLAGS_REQUIRED_sparc)
+@@ -60,7 +66,7 @@
+ LDFLAGS := $(LDFLAGS_JDKLIB) $(LDFLAGS_CXX_JDK), \
+ LDFLAGS_macosx := $(call SET_SHARED_LIBRARY_ORIGIN), \
+ LIBS := $(LIBCXX), \
+- LIBS_linux := -lc, \
++ LIBS_linux := -lc $(NSS_LIBS), \
+ LIBS_solaris := -lc, \
+ VERSIONINFO_RESOURCE := $(GLOBAL_VERSION_INFO_RESOURCE), \
+ RC_FLAGS := $(RC_FLAGS) \
+diff --git openjdk/make/mapfiles/libsunec/mapfile-vers
openjdk/make/mapfiles/libsunec/mapfile-vers
+--- openjdk/make/mapfiles/libsunec/mapfile-vers
++++ openjdk/make/mapfiles/libsunec/mapfile-vers
+@@ -31,6 +31,7 @@
+ Java_sun_security_ec_ECDSASignature_signDigest;
+ Java_sun_security_ec_ECDSASignature_verifySignedDigest;
+ Java_sun_security_ec_ECDHKeyAgreement_deriveKey;
++ Java_sun_security_ec_SunEC_initialize;
+ local:
+ *;
+ };
+diff --git openjdk/src/java.base/unix/native/include/jni_md.h
openjdk/src/java.base/unix/native/include/jni_md.h
+--- openjdk/src/java.base/unix/native/include/jni_md.h
++++ openjdk/src/java.base/unix/native/include/jni_md.h
+@@ -36,6 +36,11 @@
+ #define JNIEXPORT
+ #define JNIIMPORT
+ #endif
++#if (defined(__GNUC__)) || __has_attribute(unused)
++ #define UNUSED(x) UNUSED_ ## x __attribute__((__unused__))
++#else
++ #define UNUSED(x) UNUSED_ ## x
++#endif
+
+ #define JNICALL
+
+diff --git openjdk/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
openjdk/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
+--- openjdk/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
++++ openjdk/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
+@@ -61,6 +61,7 @@
+ AccessController.doPrivileged(new PrivilegedAction<Void>() {
+ public Void run() {
+ System.loadLibrary("sunec"); // check for native library
++ initialize();
+ return null;
+ }
+ });
+@@ -272,4 +273,9 @@
+ putService(new ProviderService(this, "KeyAgreement",
+ "ECDH", "sun.security.ec.ECDHKeyAgreement", null,
ATTRS));
+ }
++
++ /**
++ * Initialize the native code.
++ */
++ private static native void initialize();
+ }
+diff --git openjdk/src/jdk.crypto.ec/share/native/libsunec/ECC_JNI.cpp
openjdk/src/jdk.crypto.ec/share/native/libsunec/ECC_JNI.cpp
+--- openjdk/src/jdk.crypto.ec/share/native/libsunec/ECC_JNI.cpp
++++ openjdk/src/jdk.crypto.ec/share/native/libsunec/ECC_JNI.cpp
+@@ -25,7 +25,11 @@
+
+ #include <jni.h>
+ #include "jni_util.h"
++#ifdef SYSTEM_NSS
++#include "ecc_impl.h"
++#else
+ #include "impl/ecc_impl.h"
++#endif
+
+ #define ILLEGAL_STATE_EXCEPTION "java/lang/IllegalStateException"
+ #define INVALID_ALGORITHM_PARAMETER_EXCEPTION \
+@@ -33,6 +37,13 @@
+ #define INVALID_PARAMETER_EXCEPTION \
+ "java/security/InvalidParameterException"
+ #define KEY_EXCEPTION "java/security/KeyException"
++#define INTERNAL_ERROR "java/lang/InternalError"
++
++#ifdef SYSTEM_NSS
++#define SYSTEM_UNUSED(x) UNUSED(x)
++#else
++#define SYSTEM_UNUSED(x) x
++#endif
+
+ extern "C" {
+
+@@ -55,8 +66,13 @@
+ /*
+ * Deep free of the ECParams struct
+ */
+-void FreeECParams(ECParams *ecparams, jboolean freeStruct)
++void FreeECParams(ECParams *ecparams, jboolean SYSTEM_UNUSED(freeStruct))
+ {
++#ifdef SYSTEM_NSS
++ // Needs to be freed using the matching method to the one
++ // that allocated it. PR_TRUE means the memory is zeroed.
++ PORT_FreeArena(ecparams->arena, PR_TRUE);
++#else
+ // Use B_FALSE to free the SECItem->data element, but not the SECItem itself
+ // Use B_TRUE to free both
+
+@@ -70,6 +86,7 @@
+ SECITEM_FreeItem(&ecparams->curveOID, B_FALSE);
+ if (freeStruct)
+ free(ecparams);
++#endif
+ }
+
+ jbyteArray getEncodedBytes(JNIEnv *env, SECItem *hSECItem)
+@@ -95,7 +112,7 @@
+ */
+ JNIEXPORT jobjectArray
+ JNICALL Java_sun_security_ec_ECKeyPairGenerator_generateECKeyPair
+- (JNIEnv *env, jclass clazz, jint keySize, jbyteArray encodedParams, jbyteArray seed)
++ (JNIEnv *env, jclass UNUSED(clazz), jint UNUSED(keySize), jbyteArray encodedParams,
jbyteArray seed)
+ {
+ ECPrivateKey *privKey = NULL; // contains both public and private values
+ ECParams *ecparams = NULL;
+@@ -127,8 +144,17 @@
+ env->GetByteArrayRegion(seed, 0, jSeedLength, pSeedBuffer);
+
+ // Generate the new keypair (using the supplied seed)
++#ifdef SYSTEM_NSS
++ if (RNG_RandomUpdate((unsigned char *) pSeedBuffer, jSeedLength)
++ != SECSuccess) {
++ ThrowException(env, KEY_EXCEPTION);
++ goto cleanup;
++ }
++ if (EC_NewKey(ecparams, &privKey) != SECSuccess) {
++#else
+ if (EC_NewKey(ecparams, &privKey, (unsigned char *) pSeedBuffer,
+ jSeedLength, 0) != SECSuccess) {
++#endif
+ ThrowException(env, KEY_EXCEPTION);
+ goto cleanup;
+ }
+@@ -175,10 +201,15 @@
+ }
+ if (privKey) {
+ FreeECParams(&privKey->ecParams, false);
++#ifndef SYSTEM_NSS
++ // The entire ECPrivateKey is allocated in the arena
++ // when using system NSS, so only the in-tree version
++ // needs to clear these manually.
+ SECITEM_FreeItem(&privKey->version, B_FALSE);
+ SECITEM_FreeItem(&privKey->privateValue, B_FALSE);
+ SECITEM_FreeItem(&privKey->publicValue, B_FALSE);
+ free(privKey);
++#endif
+ }
+
+ if (pSeedBuffer) {
+@@ -196,7 +227,7 @@
+ */
+ JNIEXPORT jbyteArray
+ JNICALL Java_sun_security_ec_ECDSASignature_signDigest
+- (JNIEnv *env, jclass clazz, jbyteArray digest, jbyteArray privateKey, jbyteArray
encodedParams, jbyteArray seed, jint timing)
++ (JNIEnv *env, jclass UNUSED(clazz), jbyteArray digest, jbyteArray privateKey,
jbyteArray encodedParams, jbyteArray seed, jint timing)
+ {
+ jbyte* pDigestBuffer = NULL;
+ jint jDigestLength = env->GetArrayLength(digest);
+@@ -255,8 +286,18 @@
+ env->GetByteArrayRegion(seed, 0, jSeedLength, pSeedBuffer);
+
+ // Sign the digest (using the supplied seed)
++#ifdef SYSTEM_NSS
++ if (RNG_RandomUpdate((unsigned char *) pSeedBuffer, jSeedLength)
++ != SECSuccess) {
++ ThrowException(env, KEY_EXCEPTION);
++ goto cleanup;
++ }
++ if (ECDSA_SignDigest(&privKey, &signature_item, &digest_item)
++ != SECSuccess) {
++#else
+ if (ECDSA_SignDigest(&privKey, &signature_item, &digest_item,
+ (unsigned char *) pSeedBuffer, jSeedLength, 0, timing) != SECSuccess) {
++#endif
+ ThrowException(env, KEY_EXCEPTION);
+ goto cleanup;
+ }
+@@ -305,7 +346,7 @@
+ */
+ JNIEXPORT jboolean
+ JNICALL Java_sun_security_ec_ECDSASignature_verifySignedDigest
+- (JNIEnv *env, jclass clazz, jbyteArray signedDigest, jbyteArray digest, jbyteArray
publicKey, jbyteArray encodedParams)
++ (JNIEnv *env, jclass UNUSED(clazz), jbyteArray signedDigest, jbyteArray digest,
jbyteArray publicKey, jbyteArray encodedParams)
+ {
+ jboolean isValid = false;
+
+@@ -362,9 +403,10 @@
+
+ cleanup:
+ {
+- if (params_item.data)
++ if (params_item.data) {
+ env->ReleaseByteArrayElements(encodedParams,
+ (jbyte *) params_item.data, JNI_ABORT);
++ }
+
+ if (pubKey.publicValue.data)
+ env->ReleaseByteArrayElements(publicKey,
+@@ -390,7 +432,7 @@
+ */
+ JNIEXPORT jbyteArray
+ JNICALL Java_sun_security_ec_ECDHKeyAgreement_deriveKey
+- (JNIEnv *env, jclass clazz, jbyteArray privateKey, jbyteArray publicKey, jbyteArray
encodedParams)
++ (JNIEnv *env, jclass UNUSED(clazz), jbyteArray privateKey, jbyteArray publicKey,
jbyteArray encodedParams)
+ {
+ jbyteArray jSecret = NULL;
+ ECParams *ecparams = NULL;
+@@ -466,9 +508,10 @@
+ env->ReleaseByteArrayElements(publicKey,
+ (jbyte *) publicValue_item.data, JNI_ABORT);
+
+- if (params_item.data)
++ if (params_item.data) {
+ env->ReleaseByteArrayElements(encodedParams,
+ (jbyte *) params_item.data, JNI_ABORT);
++ }
+
+ if (ecparams)
+ FreeECParams(ecparams, true);
+@@ -477,4 +520,28 @@
+ return jSecret;
+ }
+
++JNIEXPORT void
++JNICALL Java_sun_security_ec_SunEC_initialize
++ (JNIEnv *env, jclass UNUSED(clazz))
++{
++#ifdef SYSTEM_NSS
++ if (SECOID_Init() != SECSuccess) {
++ ThrowException(env, INTERNAL_ERROR);
++ }
++ if (RNG_RNGInit() != SECSuccess) {
++ ThrowException(env, INTERNAL_ERROR);
++ }
++#endif
++}
++
++JNIEXPORT void
++JNICALL JNI_OnUnload
++ (JavaVM *vm, void *reserved)
++{
++#ifdef SYSTEM_NSS
++ RNG_RNGShutdown();
++ SECOID_Shutdown();
++#endif
++}
++
+ } /* extern "C" */
+diff --git openjdk/src/jdk.crypto.ec/share/native/libsunec/ecc_impl.h
openjdk/src/jdk.crypto.ec/share/native/libsunec/ecc_impl.h
+new file mode 100644
+--- /dev/null
++++ openjdk/src/jdk.crypto.ec/share/native/libsunec/ecc_impl.h
+@@ -0,0 +1,298 @@
++/*
++ * Copyright (c) 2007, 2017, Oracle and/or its affiliates. All rights reserved.
++ * Use is subject to license terms.
++ *
++ * This library is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU Lesser General Public
++ * License as published by the Free Software Foundation; either
++ * version 2.1 of the License, or (at your option) any later version.
++ *
++ * This library is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ * Lesser General Public License for more details.
++ *
++ * You should have received a copy of the GNU Lesser General Public License
++ * along with this library; if not, write to the Free Software Foundation,
++ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
++ *
++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
++ * or visit
www.oracle.com if you need additional information or have any
++ * questions.
++ */
++
++/* *********************************************************************
++ *
++ * The Original Code is the Netscape security libraries.
++ *
++ * The Initial Developer of the Original Code is
++ * Netscape Communications Corporation.
++ * Portions created by the Initial Developer are Copyright (C) 1994-2000
++ * the Initial Developer. All Rights Reserved.
++ *
++ * Contributor(s):
++ * Dr Vipul Gupta <vipul.gupta(a)sun.com> and
++ * Douglas Stebila <douglas(a)stebila.ca>, Sun Microsystems Laboratories
++ *
++ * Last Modified Date from the Original Code: May 2017
++ *********************************************************************** */
++
++#ifndef _ECC_IMPL_H
++#define _ECC_IMPL_H
++
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++#include <sys/types.h>
++
++#ifdef SYSTEM_NSS
++#include <secitem.h>
++#include <secerr.h>
++#include <keythi.h>
++#ifdef LEGACY_NSS
++#include <softoken.h>
++#else
++#include <blapi.h>
++#endif
++#else
++#include "ecl-exp.h"
++#endif
++
++/*
++ * Multi-platform definitions
++ */
++#ifdef __linux__
++#define B_FALSE FALSE
++#define B_TRUE TRUE
++typedef unsigned char uint8_t;
++typedef unsigned long ulong_t;
++typedef enum { B_FALSE, B_TRUE } boolean_t;
++#endif /* __linux__ */
++
++#ifdef _ALLBSD_SOURCE
++#include <stdint.h>
++#define B_FALSE FALSE
++#define B_TRUE TRUE
++typedef unsigned long ulong_t;
++typedef enum boolean { B_FALSE, B_TRUE } boolean_t;
++#endif /* _ALLBSD_SOURCE */
++
++#ifdef AIX
++#define B_FALSE FALSE
++#define B_TRUE TRUE
++typedef unsigned char uint8_t;
++typedef unsigned long ulong_t;
++#endif /* AIX */
++
++#ifdef _WIN32
++typedef unsigned char uint8_t;
++typedef unsigned long ulong_t;
++typedef enum boolean { B_FALSE, B_TRUE } boolean_t;
++#define strdup _strdup /* Replace POSIX name with ISO C++ name */
++#endif /* _WIN32 */
++
++#ifndef _KERNEL
++#include <stdlib.h>
++#endif /* _KERNEL */
++
++#define EC_MAX_DIGEST_LEN 1024 /* max digest that can be signed */
++#define EC_MAX_POINT_LEN 145 /* max len of DER encoded Q */
++#define EC_MAX_VALUE_LEN 72 /* max len of ANSI X9.62 private value d */
++#define EC_MAX_SIG_LEN 144 /* max signature len for supported curves */
++#define EC_MIN_KEY_LEN 112 /* min key length in bits */
++#define EC_MAX_KEY_LEN 571 /* max key length in bits */
++#define EC_MAX_OID_LEN 10 /* max length of OID buffer */
++
++/*
++ * Various structures and definitions from NSS are here.
++ */
++
++#ifndef SYSTEM_NSS
++#ifdef _KERNEL
++#define PORT_ArenaAlloc(a, n, f) kmem_alloc((n), (f))
++#define PORT_ArenaZAlloc(a, n, f) kmem_zalloc((n), (f))
++#define PORT_ArenaGrow(a, b, c, d) NULL
++#define PORT_ZAlloc(n, f) kmem_zalloc((n), (f))
++#define PORT_Alloc(n, f) kmem_alloc((n), (f))
++#else
++#define PORT_ArenaAlloc(a, n, f) malloc((n))
++#define PORT_ArenaZAlloc(a, n, f) calloc(1, (n))
++#define PORT_ArenaGrow(a, b, c, d) NULL
++#define PORT_ZAlloc(n, f) calloc(1, (n))
++#define PORT_Alloc(n, f) malloc((n))
++#endif
++
++#define PORT_NewArena(b) (char *)12345
++#define PORT_ArenaMark(a) NULL
++#define PORT_ArenaUnmark(a, b)
++#define PORT_ArenaRelease(a, m)
++#define PORT_FreeArena(a, b)
++#define PORT_Strlen(s) strlen((s))
++#define PORT_SetError(e)
++
++#define PRBool boolean_t
++#define PR_TRUE B_TRUE
++#define PR_FALSE B_FALSE
++
++#ifdef _KERNEL
++#define PORT_Assert ASSERT
++#define PORT_Memcpy(t, f, l) bcopy((f), (t), (l))
++#else
++#define PORT_Assert assert
++#define PORT_Memcpy(t, f, l) memcpy((t), (f), (l))
++#endif
++
++#endif
++
++#define CHECK_OK(func) if (func == NULL) goto cleanup
++#define CHECK_SEC_OK(func) if (SECSuccess != (rv = func)) goto cleanup
++
++#ifndef SYSTEM_NSS
++typedef enum {
++ siBuffer = 0,
++ siClearDataBuffer = 1,
++ siCipherDataBuffer = 2,
++ siDERCertBuffer = 3,
++ siEncodedCertBuffer = 4,
++ siDERNameBuffer = 5,
++ siEncodedNameBuffer = 6,
++ siAsciiNameString = 7,
++ siAsciiString = 8,
++ siDEROID = 9,
++ siUnsignedInteger = 10,
++ siUTCTime = 11,
++ siGeneralizedTime = 12
++} SECItemType;
++
++typedef struct SECItemStr SECItem;
++
++struct SECItemStr {
++ SECItemType type;
++ unsigned char *data;
++ unsigned int len;
++};
++
++typedef SECItem SECKEYECParams;
++
++typedef enum { ec_params_explicit,
++ ec_params_named
++} ECParamsType;
++
++typedef enum { ec_field_GFp = 1,
++ ec_field_GF2m
++} ECFieldType;
++
++struct ECFieldIDStr {
++ int size; /* field size in bits */
++ ECFieldType type;
++ union {
++ SECItem prime; /* prime p for (GFp) */
++ SECItem poly; /* irreducible binary polynomial for (GF2m) */
++ } u;
++ int k1; /* first coefficient of pentanomial or
++ * the only coefficient of trinomial
++ */
++ int k2; /* two remaining coefficients of pentanomial */
++ int k3;
++};
++typedef struct ECFieldIDStr ECFieldID;
++
++struct ECCurveStr {
++ SECItem a; /* contains octet stream encoding of
++ * field element (X9.62 section 4.3.3)
++ */
++ SECItem b;
++ SECItem seed;
++};
++typedef struct ECCurveStr ECCurve;
++
++typedef void PRArenaPool;
++
++struct ECParamsStr {
++ PRArenaPool * arena;
++ ECParamsType type;
++ ECFieldID fieldID;
++ ECCurve curve;
++ SECItem base;
++ SECItem order;
++ int cofactor;
++ SECItem DEREncoding;
++ ECCurveName name;
++ SECItem curveOID;
++};
++typedef struct ECParamsStr ECParams;
++
++struct ECPublicKeyStr {
++ ECParams ecParams;
++ SECItem publicValue; /* elliptic curve point encoded as
++ * octet stream.
++ */
++};
++typedef struct ECPublicKeyStr ECPublicKey;
++
++struct ECPrivateKeyStr {
++ ECParams ecParams;
++ SECItem publicValue; /* encoded ec point */
++ SECItem privateValue; /* private big integer */
++ SECItem version; /* As per SEC 1, Appendix C, Section C.4 */
++};
++typedef struct ECPrivateKeyStr ECPrivateKey;
++
++typedef enum _SECStatus {
++ SECBufferTooSmall = -3,
++ SECWouldBlock = -2,
++ SECFailure = -1,
++ SECSuccess = 0
++} SECStatus;
++#endif
++
++#ifdef _KERNEL
++#define RNG_GenerateGlobalRandomBytes(p,l) ecc_knzero_random_generator((p), (l))
++#else
++/*
++ This function is no longer required because the random bytes are now
++ supplied by the caller. Force a failure.
++*/
++#ifndef SYSTEM_NSS
++#define RNG_GenerateGlobalRandomBytes(p,l) SECFailure
++#endif
++#endif
++#define CHECK_MPI_OK(func) if (MP_OKAY > (err = func)) goto cleanup
++#define MP_TO_SEC_ERROR(err)
++
++#define SECITEM_TO_MPINT(it, mp) \
++ CHECK_MPI_OK(mp_read_unsigned_octets((mp), (it).data, (it).len))
++
++extern int ecc_knzero_random_generator(uint8_t *, size_t);
++extern ulong_t soft_nzero_random_generator(uint8_t *, ulong_t);
++
++#ifdef SYSTEM_NSS
++#define EC_DecodeParams(a,b,c) EC_DecodeParams(a,b)
++#define ECDSA_VerifyDigest(a,b,c,d) ECDSA_VerifyDigest(a,b,c)
++#define ECDH_Derive(a,b,c,d,e,f) ECDH_Derive(a,b,c,d,e)
++#else
++extern SECStatus EC_DecodeParams(const SECItem *, ECParams **, int);
++
++extern SECItem * SECITEM_AllocItem(PRArenaPool *, SECItem *, unsigned int, int);
++extern SECStatus SECITEM_CopyItem(PRArenaPool *, SECItem *, const SECItem *,
++ int);
++extern void SECITEM_FreeItem(SECItem *, boolean_t);
++
++/* This function has been modified to accept an array of random bytes */
++extern SECStatus EC_NewKey(ECParams *ecParams, ECPrivateKey **privKey,
++ const unsigned char* random, int randomlen, int);
++/* This function has been modified to accept an array of random bytes */
++extern SECStatus ECDSA_SignDigest(ECPrivateKey *, SECItem *, const SECItem *,
++ const unsigned char* random, int randomlen, int, int timing);
++extern SECStatus ECDSA_VerifyDigest(ECPublicKey *, const SECItem *,
++ const SECItem *, int);
++extern SECStatus ECDH_Derive(SECItem *, ECParams *, SECItem *, boolean_t,
++ SECItem *, int);
++#endif
++
++#ifdef __cplusplus
++}
++#endif
++
++#endif /* _ECC_IMPL_H */
diff --git a/update_package.sh b/update_package.sh
index 3d513b9..5d0f330 100644
--- a/update_package.sh
+++ b/update_package.sh
@@ -25,13 +25,13 @@ fi
set -e
if [ "x$PROJECT_NAME" = "x" ] ; then
- PROJECT_NAME="jdk"
+ PROJECT_NAME="jdk-updates"
fi
if [ "x$REPO_NAME" = "x" ] ; then
- REPO_NAME="jdk10"
+ REPO_NAME="jdk10u"
fi
if [ "x$VERSION" = "x" ] ; then
- VERSION="jdk-10+46"
+ VERSION="jdk-10.0.1+10"
fi
if [ "x$COMPRESSION" = "x" ] ; then
commit d30d1eb3338904d67eb629c630a6ae2bc5a8881c
Author: Severin Gehwolf <sgehwolf(a)redhat.com>
Date: Fri Apr 20 14:02:54 2018 +0200
Clean up patches.
- Remove unneeded ones.
- Rename patches for clarity. Update JDK-8201788
from upstream.
- Add patches needed to build on more arches (Zero).
diff --git a/JDK-8200556-aarch64-slowdebug-crash.patch
b/JDK-8200556-aarch64-slowdebug-crash.patch
new file mode 100644
index 0000000..bb5453e
--- /dev/null
+++ b/JDK-8200556-aarch64-slowdebug-crash.patch
@@ -0,0 +1,14 @@
+diff -r 214a94e9366c src/cpu/aarch64/vm/nativeInst_aarch64.cpp
+--- openjdk/src/hotspot/cpu/aarch64/nativeInst_aarch64.cpp Mon Jul 17 12:11:32 2017
+0000
++++ openjdk/src/hotspot/cpu/aarch64/nativeInst_aarch64.cpp Mon Jul 24 16:23:14 2017
+0100
+@@ -343,7 +343,7 @@
+ CodeBuffer cb(code_pos, instruction_size);
+ MacroAssembler a(&cb);
+
+- a.mov(rscratch1, entry);
++ a.movptr(rscratch1, (uintptr_t)entry);
+ a.br(rscratch1);
+
+ ICache::invalidate_range(code_pos, instruction_size);
+
+
diff --git a/JDK-8201495-s390-java-opts.patch b/JDK-8201495-s390-java-opts.patch
new file mode 100644
index 0000000..a16db0c
--- /dev/null
+++ b/JDK-8201495-s390-java-opts.patch
@@ -0,0 +1,21 @@
+# HG changeset patch
+# User sgehwolf
+# Date 1523874036 -7200
+# Mon Apr 16 12:20:36 2018 +0200
+# Node ID fc3a72e286e0d5bf9b994d1b778b39f3b080c686
+# Parent 69bae761600bdbc97953500ac51a396d31f54ee9
+8201495: [Zero] Reduce limits of max heap size for boot JDK on s390
+Reviewed-by: ihse, aph, simonis
+
+diff --git a/make/autoconf/boot-jdk.m4 b/make/autoconf/boot-jdk.m4
+--- a/make/autoconf/boot-jdk.m4
++++ b/make/autoconf/boot-jdk.m4
+@@ -405,7 +405,7 @@
+ BOOTCYCLE_JVM_ARGS_BIG=-Xms64M
+
+ # Maximum amount of heap memory and stack size.
+- JVM_HEAP_LIMIT_32="1024"
++ JVM_HEAP_LIMIT_32="768"
+ # Running a 64 bit JVM allows for and requires a bigger heap
+ JVM_HEAP_LIMIT_64="1600"
+ STACK_SIZE_32=768
diff --git a/JDK-8201509-s390-atomic_store.patch b/JDK-8201509-s390-atomic_store.patch
new file mode 100644
index 0000000..ba7f748
--- /dev/null
+++ b/JDK-8201509-s390-atomic_store.patch
@@ -0,0 +1,18 @@
+diff --git a/src/hotspot/os_cpu/linux_zero/os_linux_zero.hpp
b/src/hotspot/os_cpu/linux_zero/os_linux_zero.hpp
+--- a/src/hotspot/os_cpu/linux_zero/os_linux_zero.hpp
++++ b/src/hotspot/os_cpu/linux_zero/os_linux_zero.hpp
+@@ -50,10 +50,10 @@
+ : "Q"(*(volatile long*)src));
+ #elif defined(S390) && !defined(_LP64)
+ double tmp;
+- asm volatile ("ld %0, 0(%1)\n"
+- "std %0, 0(%2)\n"
+- : "=r"(tmp)
+- : "a"(src), "a"(dst));
++ asm volatile ("ld %0, %2\n"
++ "std %0, %1\n"
++ : "=&f"(tmp), "=Q"(*(volatile double*)dst)
++ : "Q"(*(volatile double*)src));
+ #else
+ *(jlong *) dst = *(const jlong *) src;
+ #endif
diff --git a/JDK-8201788-bootcycle-images-jobs.patch
b/JDK-8201788-bootcycle-images-jobs.patch
new file mode 100644
index 0000000..05d1a39
--- /dev/null
+++ b/JDK-8201788-bootcycle-images-jobs.patch
@@ -0,0 +1,27 @@
+# HG changeset patch
+# User sgehwolf
+# Date 1524152606 -7200
+# Thu Apr 19 17:43:26 2018 +0200
+# Node ID f7a3ca673e9cc831848fc890a2df3ae9acb447e4
+# Parent dd26184768b0a1c4103a2e9eaa8b4d852a9eca1b
+8201788: Number of make jobs wrong for bootcycle-images target
+Reviewed-by: erikj, ihse
+
+diff --git a/make/Init.gmk b/make/Init.gmk
+--- a/make/Init.gmk
++++ b/make/Init.gmk
+@@ -310,9 +310,13 @@
+ ifneq ($(PARALLEL_TARGETS), )
+ $(call StartGlobalTimer)
+ $(call PrepareSmartJavac)
++ # JOBS will only be empty for a bootcycle-images recursive call
++ # or if specified via a make argument directly. In those cases
++ # treat it as NOT using jobs at all.
+ ( cd $(TOPDIR) && \
+ $(NICE) $(MAKE) $(MAKE_ARGS) $(OUTPUT_SYNC_FLAG) \
+- -j $(JOBS) -f make/Main.gmk $(USER_MAKE_VARS) \
++ $(if $(JOBS), -j $(JOBS)) \
++ -f make/Main.gmk $(USER_MAKE_VARS) \
+ $(PARALLEL_TARGETS) $(COMPARE_BUILD_MAKE) $(BUILD_LOG_PIPE) || \
+ ( exitcode=$$? && \
+ $(PRINTF) "\nERROR: Build failed for $(TARGET_DESCRIPTION) (exit code
$$exitcode) \n" \
diff --git a/PStack-808293.patch b/PStack-808293.patch
deleted file mode 100644
index fc5fe4e..0000000
--- a/PStack-808293.patch
+++ /dev/null
@@ -1,33 +0,0 @@
----
openjdk/src/jdk.hotspot.agent/share/classes/sun/jvm/hotspot/tools/PStack.java 2012-04-06
02:26:33.322164601 +0200
-+++
openjdk/src/jdk.hotspot.agent/share/classes/sun/jvm/hotspot/tools/PStack.java 2012-04-06
02:26:57.958514071 +0200
-@@ -84,7 +85,8 @@
- if (jthread != null) {
- jthread.printThreadInfoOn(out);
- }
-- while (f != null) {
-+ int maxStack = 256;
-+ while (f != null && maxStack-- > 0) {
- ClosestSymbol sym = f.closestSymbolToPC();
- Address pc = f.pc();
- out.print(pc + "\t");
-@@ -158,10 +160,19 @@
- }
- }
- }
-+ Address oldPC = f.pc();
-+ Address oldFP = f.localVariableBase();
- f = f.sender(th);
-+ if (f != null
-+ && oldPC.equals(f.pc())
-+ && oldFP.equals(f.localVariableBase())) {
-+ // We didn't make any progress
-+ f = null;
-+ }
- }
- } catch (Exception exp) {
-- exp.printStackTrace();
-+ // exp.printStackTrace();
-+ out.println("bad stack: " + exp);
- // continue, may be we can do a better job for other threads
- }
- if (concurrentLocks) {
diff --git a/RHBZ-1249083-system-crypto-policy-PR3183.patch
b/RHBZ-1249083-system-crypto-policy-PR3183.patch
new file mode 100644
index 0000000..4efbe9a
--- /dev/null
+++ b/RHBZ-1249083-system-crypto-policy-PR3183.patch
@@ -0,0 +1,88 @@
+
+# HG changeset patch
+# User andrew
+# Date 1478057514 0
+# Node ID 1c4d5cb2096ae55106111da200b0bcad304f650c
+# Parent 3d53f19b48384e5252f4ec8891f7a3a82d77af2a
+PR3183: Support Fedora/RHEL system crypto policy
+diff -r 3d53f19b4838 -r 1c4d5cb2096a
src/java.base/share/classes/java/security/Security.java
+--- a/src/java.base/share/classes/java/security/Security.java Wed Oct 26 03:51:39 2016
+0100
++++ b/src/java.base/share/classes/java/security/Security.java Wed Nov 02 03:31:54 2016
+0000
+@@ -43,6 +43,9 @@
+ * implementation-specific location, which is typically the properties file
+ * {@code conf/security/java.security} in the Java installation directory.
+ *
++ * <p>Additional default values of security properties are read from a
++ * system-specific location, if available.</p>
++ *
+ * @author Benjamin Renaud
+ * @since 1.1
+ */
+@@ -52,6 +55,10 @@
+ private static final Debug sdebug =
+ Debug.getInstance("properties");
+
++ /* System property file*/
++ private static final String SYSTEM_PROPERTIES =
++ "/etc/crypto-policies/back-ends/java.config";
++
+ /* The java.security properties */
+ private static Properties props;
+
+@@ -93,6 +100,7 @@
+ if (sdebug != null) {
+ sdebug.println("reading security properties file: " +
+ propFile);
++ sdebug.println(props.toString());
+ }
+ } catch (IOException e) {
+ if (sdebug != null) {
+@@ -114,6 +122,31 @@
+ }
+
+ if ("true".equalsIgnoreCase(props.getProperty
++ ("security.useSystemPropertiesFile"))) {
++
++ // now load the system file, if it exists, so its values
++ // will win if they conflict with the earlier values
++ try (BufferedInputStream bis =
++ new BufferedInputStream(new FileInputStream(SYSTEM_PROPERTIES))) {
++ props.load(bis);
++ loadedProps = true;
++
++ if (sdebug != null) {
++ sdebug.println("reading system security properties file "
+
++ SYSTEM_PROPERTIES);
++ sdebug.println(props.toString());
++ }
++ } catch (IOException e) {
++ if (sdebug != null) {
++ sdebug.println
++ ("unable to load security properties from " +
++ SYSTEM_PROPERTIES);
++ e.printStackTrace();
++ }
++ }
++ }
++
++ if ("true".equalsIgnoreCase(props.getProperty
+ ("security.overridePropertiesFile"))) {
+
+ String extraPropFile = System.getProperty
+diff -r 3d53f19b4838 -r 1c4d5cb2096a src/java.base/share/conf/security/java.security
+--- a/src/java.base/share/conf/security/java.security Wed Oct 26 03:51:39 2016 +0100
++++ b/src/java.base/share/conf/security/java.security Wed Nov 02 03:31:54 2016 +0000
+@@ -276,6 +276,13 @@
+ security.overridePropertiesFile=true
+
+ #
++# Determines whether this properties file will be appended to
++# using the system properties file stored at
++# /etc/crypto-policies/back-ends/java.config
++#
++security.useSystemPropertiesFile=true
++
++#
+ # Determines the default key and trust manager factory algorithms for
+ # the javax.net.ssl package.
+ #
diff --git a/RHBZ-1565658-system-nss-SunEC.patch b/RHBZ-1565658-system-nss-SunEC.patch
new file mode 100644
index 0000000..7b1d4aa
--- /dev/null
+++ b/RHBZ-1565658-system-nss-SunEC.patch
@@ -0,0 +1,654 @@
+diff --git openjdk/make/autoconf/jdk-options.m4 openjdk/make/autoconf/jdk-options.m4
+--- openjdk/make/autoconf/jdk-options.m4
++++ openjdk/make/autoconf/jdk-options.m4
+@@ -264,9 +264,10 @@
+ #
+ AC_DEFUN_ONCE([JDKOPT_DETECT_INTREE_EC],
+ [
++ AC_REQUIRE([LIB_SETUP_MISC_LIBS])
+ AC_MSG_CHECKING([if elliptic curve crypto implementation is present])
+
+- if test -d "${TOPDIR}/src/jdk.crypto.ec/share/native/libsunec/impl"; then
++ if test "x${system_nss}" = "xyes" -o -d
"${TOPDIR}/src/jdk.crypto.ec/share/native/libsunec/impl"; then
+ ENABLE_INTREE_EC=true
+ AC_MSG_RESULT([yes])
+ else
+diff --git openjdk/make/autoconf/libraries.m4 openjdk/make/autoconf/libraries.m4
+--- openjdk/make/autoconf/libraries.m4
++++ openjdk/make/autoconf/libraries.m4
+@@ -175,6 +175,48 @@
+ AC_SUBST(LIBDL)
+ LIBS="$save_LIBS"
+
++ ###############################################################################
++ #
++ # Check for the NSS libraries
++ #
++
++ AC_MSG_CHECKING([whether to build the Sun EC provider against the system NSS
libraries])
++
++ # default is bundled
++ DEFAULT_SYSTEM_NSS=no
++
++ AC_ARG_ENABLE([system-nss], [AS_HELP_STRING([--enable-system-nss],
++ [build the SunEC provider using the system NSS libraries
@<:@disabled@:>@])],
++ [
++ case "${enableval}" in
++ yes)
++ system_nss=yes
++ ;;
++ *)
++ system_nss=no
++ ;;
++ esac
++ ],
++ [
++ system_nss=${DEFAULT_SYSTEM_NSS}
++ ])
++ AC_MSG_RESULT([$system_nss])
++
++ if test "x${system_nss}" = "xyes"; then
++ PKG_CHECK_MODULES(NSS_SOFTTKN, nss-softokn >= 3.16.1, [NSS_SOFTOKN_FOUND=yes],
[NSS_SOFTOKN_FOUND=no])
++ PKG_CHECK_MODULES(NSS, nss >= 3.16.1, [NSS_FOUND=yes], [NSS_FOUND=no])
++ if test "x${NSS_SOFTOKN_FOUND}" = "xyes" -a
"x${NSS_FOUND}" = "xyes"; then
++ NSS_LIBS="$NSS_SOFTOKN_LIBS $NSS_LIBS -lfreebl";
++ USE_EXTERNAL_NSS=true
++ else
++ AC_MSG_ERROR([--enable-system-nss specified, but NSS not found.])
++ fi
++ else
++ USE_EXTERNAL_NSS=false
++ fi
++ AC_SUBST(USE_EXTERNAL_NSS)
++
++
+ # Deprecated libraries, keep the flags for backwards compatibility
+ if test "x$OPENJDK_TARGET_OS" = "xwindows"; then
+ BASIC_DEPRECATED_ARG_WITH([dxsdk])
+diff --git openjdk/make/autoconf/spec.gmk.in openjdk/make/autoconf/spec.gmk.in
+--- openjdk/make/autoconf/spec.gmk.in
++++ openjdk/make/autoconf/spec.gmk.in
+@@ -764,6 +764,10 @@
+ # Libraries
+ #
+
++USE_EXTERNAL_NSS:=@USE_EXTERNAL_NSS@
++NSS_LIBS:=@NSS_LIBS@
++NSS_CFLAGS:=@NSS_CFLAGS@
++
+ USE_EXTERNAL_LCMS:=@USE_EXTERNAL_LCMS@
+ LCMS_CFLAGS:=@LCMS_CFLAGS@
+ LCMS_LIBS:=@LCMS_LIBS@
+diff --git openjdk/make/lib/Lib-jdk.crypto.ec.gmk openjdk/make/lib/Lib-jdk.crypto.ec.gmk
+--- openjdk/make/lib/Lib-jdk.crypto.ec.gmk
++++ openjdk/make/lib/Lib-jdk.crypto.ec.gmk
+@@ -29,9 +29,15 @@
+
+ ifeq ($(ENABLE_INTREE_EC), true)
+
+- LIBSUNEC_SRC := $(TOPDIR)/src/jdk.crypto.ec/share/native/libsunec
+ BUILD_LIBSUNEC_FLAGS := $(addprefix -I, $(SUNEC_SRC))
+
++ ifeq ($(USE_EXTERNAL_NSS), true)
++ LIBSUNEC_SRC := $(TOPDIR)/src/jdk.crypto.ec/share/native/libsunec/ECC_JNI.cpp
++ BUILD_LIBSUNEC_FLAGS += $(NSS_CFLAGS) -DSYSTEM_NSS -DNSS_ENABLE_ECC
++ else
++ LIBSUNEC_SRC := $(TOPDIR)/src/jdk.crypto.ec/share/native/libsunec
++ endif
++
+ #
+ # On sol-sparc...all libraries are compiled with -xregs=no%appl
+ # (set in CFLAGS_REQUIRED_sparc)
+@@ -60,7 +66,7 @@
+ LDFLAGS := $(LDFLAGS_JDKLIB) $(LDFLAGS_CXX_JDK), \
+ LDFLAGS_macosx := $(call SET_SHARED_LIBRARY_ORIGIN), \
+ LIBS := $(LIBCXX), \
+- LIBS_linux := -lc, \
++ LIBS_linux := -lc $(NSS_LIBS), \
+ LIBS_solaris := -lc, \
+ VERSIONINFO_RESOURCE := $(GLOBAL_VERSION_INFO_RESOURCE), \
+ RC_FLAGS := $(RC_FLAGS) \
+diff --git openjdk/make/mapfiles/libsunec/mapfile-vers
openjdk/make/mapfiles/libsunec/mapfile-vers
+--- openjdk/make/mapfiles/libsunec/mapfile-vers
++++ openjdk/make/mapfiles/libsunec/mapfile-vers
+@@ -31,6 +31,7 @@
+ Java_sun_security_ec_ECDSASignature_signDigest;
+ Java_sun_security_ec_ECDSASignature_verifySignedDigest;
+ Java_sun_security_ec_ECDHKeyAgreement_deriveKey;
++ Java_sun_security_ec_SunEC_initialize;
+ local:
+ *;
+ };
+diff --git openjdk/src/java.base/unix/native/include/jni_md.h
openjdk/src/java.base/unix/native/include/jni_md.h
+--- openjdk/src/java.base/unix/native/include/jni_md.h
++++ openjdk/src/java.base/unix/native/include/jni_md.h
+@@ -36,6 +36,11 @@
+ #define JNIEXPORT
+ #define JNIIMPORT
+ #endif
++#if (defined(__GNUC__)) || __has_attribute(unused)
++ #define UNUSED(x) UNUSED_ ## x __attribute__((__unused__))
++#else
++ #define UNUSED(x) UNUSED_ ## x
++#endif
+
+ #define JNICALL
+
+diff --git openjdk/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
openjdk/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
+--- openjdk/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
++++ openjdk/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
+@@ -61,6 +61,7 @@
+ AccessController.doPrivileged(new PrivilegedAction<Void>() {
+ public Void run() {
+ System.loadLibrary("sunec"); // check for native library
++ initialize();
+ return null;
+ }
+ });
+@@ -272,4 +273,9 @@
+ putService(new ProviderService(this, "KeyAgreement",
+ "ECDH", "sun.security.ec.ECDHKeyAgreement", null,
ATTRS));
+ }
++
++ /**
++ * Initialize the native code.
++ */
++ private static native void initialize();
+ }
+diff --git openjdk/src/jdk.crypto.ec/share/native/libsunec/ECC_JNI.cpp
openjdk/src/jdk.crypto.ec/share/native/libsunec/ECC_JNI.cpp
+--- openjdk/src/jdk.crypto.ec/share/native/libsunec/ECC_JNI.cpp
++++ openjdk/src/jdk.crypto.ec/share/native/libsunec/ECC_JNI.cpp
+@@ -25,7 +25,11 @@
+
+ #include <jni.h>
+ #include "jni_util.h"
++#ifdef SYSTEM_NSS
++#include "ecc_impl.h"
++#else
+ #include "impl/ecc_impl.h"
++#endif
+
+ #define ILLEGAL_STATE_EXCEPTION "java/lang/IllegalStateException"
+ #define INVALID_ALGORITHM_PARAMETER_EXCEPTION \
+@@ -33,6 +37,13 @@
+ #define INVALID_PARAMETER_EXCEPTION \
+ "java/security/InvalidParameterException"
+ #define KEY_EXCEPTION "java/security/KeyException"
++#define INTERNAL_ERROR "java/lang/InternalError"
++
++#ifdef SYSTEM_NSS
++#define SYSTEM_UNUSED(x) UNUSED(x)
++#else
++#define SYSTEM_UNUSED(x) x
++#endif
+
+ extern "C" {
+
+@@ -55,8 +66,13 @@
+ /*
+ * Deep free of the ECParams struct
+ */
+-void FreeECParams(ECParams *ecparams, jboolean freeStruct)
++void FreeECParams(ECParams *ecparams, jboolean SYSTEM_UNUSED(freeStruct))
+ {
++#ifdef SYSTEM_NSS
++ // Needs to be freed using the matching method to the one
++ // that allocated it. PR_TRUE means the memory is zeroed.
++ PORT_FreeArena(ecparams->arena, PR_TRUE);
++#else
+ // Use B_FALSE to free the SECItem->data element, but not the SECItem itself
+ // Use B_TRUE to free both
+
+@@ -70,6 +86,7 @@
+ SECITEM_FreeItem(&ecparams->curveOID, B_FALSE);
+ if (freeStruct)
+ free(ecparams);
++#endif
+ }
+
+ jbyteArray getEncodedBytes(JNIEnv *env, SECItem *hSECItem)
+@@ -95,7 +112,7 @@
+ */
+ JNIEXPORT jobjectArray
+ JNICALL Java_sun_security_ec_ECKeyPairGenerator_generateECKeyPair
+- (JNIEnv *env, jclass clazz, jint keySize, jbyteArray encodedParams, jbyteArray seed)
++ (JNIEnv *env, jclass UNUSED(clazz), jint UNUSED(keySize), jbyteArray encodedParams,
jbyteArray seed)
+ {
+ ECPrivateKey *privKey = NULL; // contains both public and private values
+ ECParams *ecparams = NULL;
+@@ -127,8 +144,17 @@
+ env->GetByteArrayRegion(seed, 0, jSeedLength, pSeedBuffer);
+
+ // Generate the new keypair (using the supplied seed)
++#ifdef SYSTEM_NSS
++ if (RNG_RandomUpdate((unsigned char *) pSeedBuffer, jSeedLength)
++ != SECSuccess) {
++ ThrowException(env, KEY_EXCEPTION);
++ goto cleanup;
++ }
++ if (EC_NewKey(ecparams, &privKey) != SECSuccess) {
++#else
+ if (EC_NewKey(ecparams, &privKey, (unsigned char *) pSeedBuffer,
+ jSeedLength, 0) != SECSuccess) {
++#endif
+ ThrowException(env, KEY_EXCEPTION);
+ goto cleanup;
+ }
+@@ -175,10 +201,15 @@
+ }
+ if (privKey) {
+ FreeECParams(&privKey->ecParams, false);
++#ifndef SYSTEM_NSS
++ // The entire ECPrivateKey is allocated in the arena
++ // when using system NSS, so only the in-tree version
++ // needs to clear these manually.
+ SECITEM_FreeItem(&privKey->version, B_FALSE);
+ SECITEM_FreeItem(&privKey->privateValue, B_FALSE);
+ SECITEM_FreeItem(&privKey->publicValue, B_FALSE);
+ free(privKey);
++#endif
+ }
+
+ if (pSeedBuffer) {
+@@ -196,7 +227,7 @@
+ */
+ JNIEXPORT jbyteArray
+ JNICALL Java_sun_security_ec_ECDSASignature_signDigest
+- (JNIEnv *env, jclass clazz, jbyteArray digest, jbyteArray privateKey, jbyteArray
encodedParams, jbyteArray seed, jint timing)
++ (JNIEnv *env, jclass UNUSED(clazz), jbyteArray digest, jbyteArray privateKey,
jbyteArray encodedParams, jbyteArray seed, jint timing)
+ {
+ jbyte* pDigestBuffer = NULL;
+ jint jDigestLength = env->GetArrayLength(digest);
+@@ -255,8 +286,18 @@
+ env->GetByteArrayRegion(seed, 0, jSeedLength, pSeedBuffer);
+
+ // Sign the digest (using the supplied seed)
++#ifdef SYSTEM_NSS
++ if (RNG_RandomUpdate((unsigned char *) pSeedBuffer, jSeedLength)
++ != SECSuccess) {
++ ThrowException(env, KEY_EXCEPTION);
++ goto cleanup;
++ }
++ if (ECDSA_SignDigest(&privKey, &signature_item, &digest_item)
++ != SECSuccess) {
++#else
+ if (ECDSA_SignDigest(&privKey, &signature_item, &digest_item,
+ (unsigned char *) pSeedBuffer, jSeedLength, 0, timing) != SECSuccess) {
++#endif
+ ThrowException(env, KEY_EXCEPTION);
+ goto cleanup;
+ }
+@@ -305,7 +346,7 @@
+ */
+ JNIEXPORT jboolean
+ JNICALL Java_sun_security_ec_ECDSASignature_verifySignedDigest
+- (JNIEnv *env, jclass clazz, jbyteArray signedDigest, jbyteArray digest, jbyteArray
publicKey, jbyteArray encodedParams)
++ (JNIEnv *env, jclass UNUSED(clazz), jbyteArray signedDigest, jbyteArray digest,
jbyteArray publicKey, jbyteArray encodedParams)
+ {
+ jboolean isValid = false;
+
+@@ -362,9 +403,10 @@
+
+ cleanup:
+ {
+- if (params_item.data)
++ if (params_item.data) {
+ env->ReleaseByteArrayElements(encodedParams,
+ (jbyte *) params_item.data, JNI_ABORT);
++ }
+
+ if (pubKey.publicValue.data)
+ env->ReleaseByteArrayElements(publicKey,
+@@ -390,7 +432,7 @@
+ */
+ JNIEXPORT jbyteArray
+ JNICALL Java_sun_security_ec_ECDHKeyAgreement_deriveKey
+- (JNIEnv *env, jclass clazz, jbyteArray privateKey, jbyteArray publicKey, jbyteArray
encodedParams)
++ (JNIEnv *env, jclass UNUSED(clazz), jbyteArray privateKey, jbyteArray publicKey,
jbyteArray encodedParams)
+ {
+ jbyteArray jSecret = NULL;
+ ECParams *ecparams = NULL;
+@@ -466,9 +508,10 @@
+ env->ReleaseByteArrayElements(publicKey,
+ (jbyte *) publicValue_item.data, JNI_ABORT);
+
+- if (params_item.data)
++ if (params_item.data) {
+ env->ReleaseByteArrayElements(encodedParams,
+ (jbyte *) params_item.data, JNI_ABORT);
++ }
+
+ if (ecparams)
+ FreeECParams(ecparams, true);
+@@ -477,4 +520,28 @@
+ return jSecret;
+ }
+
++JNIEXPORT void
++JNICALL Java_sun_security_ec_SunEC_initialize
++ (JNIEnv *env, jclass UNUSED(clazz))
++{
++#ifdef SYSTEM_NSS
++ if (SECOID_Init() != SECSuccess) {
++ ThrowException(env, INTERNAL_ERROR);
++ }
++ if (RNG_RNGInit() != SECSuccess) {
++ ThrowException(env, INTERNAL_ERROR);
++ }
++#endif
++}
++
++JNIEXPORT void
++JNICALL JNI_OnUnload
++ (JavaVM *vm, void *reserved)
++{
++#ifdef SYSTEM_NSS
++ RNG_RNGShutdown();
++ SECOID_Shutdown();
++#endif
++}
++
+ } /* extern "C" */
+diff --git openjdk/src/jdk.crypto.ec/share/native/libsunec/ecc_impl.h
openjdk/src/jdk.crypto.ec/share/native/libsunec/ecc_impl.h
+new file mode 100644
+--- /dev/null
++++ openjdk/src/jdk.crypto.ec/share/native/libsunec/ecc_impl.h
+@@ -0,0 +1,298 @@
++/*
++ * Copyright (c) 2007, 2017, Oracle and/or its affiliates. All rights reserved.
++ * Use is subject to license terms.
++ *
++ * This library is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU Lesser General Public
++ * License as published by the Free Software Foundation; either
++ * version 2.1 of the License, or (at your option) any later version.
++ *
++ * This library is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ * Lesser General Public License for more details.
++ *
++ * You should have received a copy of the GNU Lesser General Public License
++ * along with this library; if not, write to the Free Software Foundation,
++ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
++ *
++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
++ * or visit
www.oracle.com if you need additional information or have any
++ * questions.
++ */
++
++/* *********************************************************************
++ *
++ * The Original Code is the Netscape security libraries.
++ *
++ * The Initial Developer of the Original Code is
++ * Netscape Communications Corporation.
++ * Portions created by the Initial Developer are Copyright (C) 1994-2000
++ * the Initial Developer. All Rights Reserved.
++ *
++ * Contributor(s):
++ * Dr Vipul Gupta <vipul.gupta(a)sun.com> and
++ * Douglas Stebila <douglas(a)stebila.ca>, Sun Microsystems Laboratories
++ *
++ * Last Modified Date from the Original Code: May 2017
++ *********************************************************************** */
++
++#ifndef _ECC_IMPL_H
++#define _ECC_IMPL_H
++
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++#include <sys/types.h>
++
++#ifdef SYSTEM_NSS
++#include <secitem.h>
++#include <secerr.h>
++#include <keythi.h>
++#ifdef LEGACY_NSS
++#include <softoken.h>
++#else
++#include <blapi.h>
++#endif
++#else
++#include "ecl-exp.h"
++#endif
++
++/*
++ * Multi-platform definitions
++ */
++#ifdef __linux__
++#define B_FALSE FALSE
++#define B_TRUE TRUE
++typedef unsigned char uint8_t;
++typedef unsigned long ulong_t;
++typedef enum { B_FALSE, B_TRUE } boolean_t;
++#endif /* __linux__ */
++
++#ifdef _ALLBSD_SOURCE
++#include <stdint.h>
++#define B_FALSE FALSE
++#define B_TRUE TRUE
++typedef unsigned long ulong_t;
++typedef enum boolean { B_FALSE, B_TRUE } boolean_t;
++#endif /* _ALLBSD_SOURCE */
++
++#ifdef AIX
++#define B_FALSE FALSE
++#define B_TRUE TRUE
++typedef unsigned char uint8_t;
++typedef unsigned long ulong_t;
++#endif /* AIX */
++
++#ifdef _WIN32
++typedef unsigned char uint8_t;
++typedef unsigned long ulong_t;
++typedef enum boolean { B_FALSE, B_TRUE } boolean_t;
++#define strdup _strdup /* Replace POSIX name with ISO C++ name */
++#endif /* _WIN32 */
++
++#ifndef _KERNEL
++#include <stdlib.h>
++#endif /* _KERNEL */
++
++#define EC_MAX_DIGEST_LEN 1024 /* max digest that can be signed */
++#define EC_MAX_POINT_LEN 145 /* max len of DER encoded Q */
++#define EC_MAX_VALUE_LEN 72 /* max len of ANSI X9.62 private value d */
++#define EC_MAX_SIG_LEN 144 /* max signature len for supported curves */
++#define EC_MIN_KEY_LEN 112 /* min key length in bits */
++#define EC_MAX_KEY_LEN 571 /* max key length in bits */
++#define EC_MAX_OID_LEN 10 /* max length of OID buffer */
++
++/*
++ * Various structures and definitions from NSS are here.
++ */
++
++#ifndef SYSTEM_NSS
++#ifdef _KERNEL
++#define PORT_ArenaAlloc(a, n, f) kmem_alloc((n), (f))
++#define PORT_ArenaZAlloc(a, n, f) kmem_zalloc((n), (f))
++#define PORT_ArenaGrow(a, b, c, d) NULL
++#define PORT_ZAlloc(n, f) kmem_zalloc((n), (f))
++#define PORT_Alloc(n, f) kmem_alloc((n), (f))
++#else
++#define PORT_ArenaAlloc(a, n, f) malloc((n))
++#define PORT_ArenaZAlloc(a, n, f) calloc(1, (n))
++#define PORT_ArenaGrow(a, b, c, d) NULL
++#define PORT_ZAlloc(n, f) calloc(1, (n))
++#define PORT_Alloc(n, f) malloc((n))
++#endif
++
++#define PORT_NewArena(b) (char *)12345
++#define PORT_ArenaMark(a) NULL
++#define PORT_ArenaUnmark(a, b)
++#define PORT_ArenaRelease(a, m)
++#define PORT_FreeArena(a, b)
++#define PORT_Strlen(s) strlen((s))
++#define PORT_SetError(e)
++
++#define PRBool boolean_t
++#define PR_TRUE B_TRUE
++#define PR_FALSE B_FALSE
++
++#ifdef _KERNEL
++#define PORT_Assert ASSERT
++#define PORT_Memcpy(t, f, l) bcopy((f), (t), (l))
++#else
++#define PORT_Assert assert
++#define PORT_Memcpy(t, f, l) memcpy((t), (f), (l))
++#endif
++
++#endif
++
++#define CHECK_OK(func) if (func == NULL) goto cleanup
++#define CHECK_SEC_OK(func) if (SECSuccess != (rv = func)) goto cleanup
++
++#ifndef SYSTEM_NSS
++typedef enum {
++ siBuffer = 0,
++ siClearDataBuffer = 1,
++ siCipherDataBuffer = 2,
++ siDERCertBuffer = 3,
++ siEncodedCertBuffer = 4,
++ siDERNameBuffer = 5,
++ siEncodedNameBuffer = 6,
++ siAsciiNameString = 7,
++ siAsciiString = 8,
++ siDEROID = 9,
++ siUnsignedInteger = 10,
++ siUTCTime = 11,
++ siGeneralizedTime = 12
++} SECItemType;
++
++typedef struct SECItemStr SECItem;
++
++struct SECItemStr {
++ SECItemType type;
++ unsigned char *data;
++ unsigned int len;
++};
++
++typedef SECItem SECKEYECParams;
++
++typedef enum { ec_params_explicit,
++ ec_params_named
++} ECParamsType;
++
++typedef enum { ec_field_GFp = 1,
++ ec_field_GF2m
++} ECFieldType;
++
++struct ECFieldIDStr {
++ int size; /* field size in bits */
++ ECFieldType type;
++ union {
++ SECItem prime; /* prime p for (GFp) */
++ SECItem poly; /* irreducible binary polynomial for (GF2m) */
++ } u;
++ int k1; /* first coefficient of pentanomial or
++ * the only coefficient of trinomial
++ */
++ int k2; /* two remaining coefficients of pentanomial */
++ int k3;
++};
++typedef struct ECFieldIDStr ECFieldID;
++
++struct ECCurveStr {
++ SECItem a; /* contains octet stream encoding of
++ * field element (X9.62 section 4.3.3)
++ */
++ SECItem b;
++ SECItem seed;
++};
++typedef struct ECCurveStr ECCurve;
++
++typedef void PRArenaPool;
++
++struct ECParamsStr {
++ PRArenaPool * arena;
++ ECParamsType type;
++ ECFieldID fieldID;
++ ECCurve curve;
++ SECItem base;
++ SECItem order;
++ int cofactor;
++ SECItem DEREncoding;
++ ECCurveName name;
++ SECItem curveOID;
++};
++typedef struct ECParamsStr ECParams;
++
++struct ECPublicKeyStr {
++ ECParams ecParams;
++ SECItem publicValue; /* elliptic curve point encoded as
++ * octet stream.
++ */
++};
++typedef struct ECPublicKeyStr ECPublicKey;
++
++struct ECPrivateKeyStr {
++ ECParams ecParams;
++ SECItem publicValue; /* encoded ec point */
++ SECItem privateValue; /* private big integer */
++ SECItem version; /* As per SEC 1, Appendix C, Section C.4 */
++};
++typedef struct ECPrivateKeyStr ECPrivateKey;
++
++typedef enum _SECStatus {
++ SECBufferTooSmall = -3,
++ SECWouldBlock = -2,
++ SECFailure = -1,
++ SECSuccess = 0
++} SECStatus;
++#endif
++
++#ifdef _KERNEL
++#define RNG_GenerateGlobalRandomBytes(p,l) ecc_knzero_random_generator((p), (l))
++#else
++/*
++ This function is no longer required because the random bytes are now
++ supplied by the caller. Force a failure.
++*/
++#ifndef SYSTEM_NSS
++#define RNG_GenerateGlobalRandomBytes(p,l) SECFailure
++#endif
++#endif
++#define CHECK_MPI_OK(func) if (MP_OKAY > (err = func)) goto cleanup
++#define MP_TO_SEC_ERROR(err)
++
++#define SECITEM_TO_MPINT(it, mp) \
++ CHECK_MPI_OK(mp_read_unsigned_octets((mp), (it).data, (it).len))
++
++extern int ecc_knzero_random_generator(uint8_t *, size_t);
++extern ulong_t soft_nzero_random_generator(uint8_t *, ulong_t);
++
++#ifdef SYSTEM_NSS
++#define EC_DecodeParams(a,b,c) EC_DecodeParams(a,b)
++#define ECDSA_VerifyDigest(a,b,c,d) ECDSA_VerifyDigest(a,b,c)
++#define ECDH_Derive(a,b,c,d,e,f) ECDH_Derive(a,b,c,d,e)
++#else
++extern SECStatus EC_DecodeParams(const SECItem *, ECParams **, int);
++
++extern SECItem * SECITEM_AllocItem(PRArenaPool *, SECItem *, unsigned int, int);
++extern SECStatus SECITEM_CopyItem(PRArenaPool *, SECItem *, const SECItem *,
++ int);
++extern void SECITEM_FreeItem(SECItem *, boolean_t);
++
++/* This function has been modified to accept an array of random bytes */
++extern SECStatus EC_NewKey(ECParams *ecParams, ECPrivateKey **privKey,
++ const unsigned char* random, int randomlen, int);
++/* This function has been modified to accept an array of random bytes */
++extern SECStatus ECDSA_SignDigest(ECPrivateKey *, SECItem *, const SECItem *,
++ const unsigned char* random, int randomlen, int, int timing);
++extern SECStatus ECDSA_VerifyDigest(ECPublicKey *, const SECItem *,
++ const SECItem *, int);
++extern SECStatus ECDH_Derive(SECItem *, ECParams *, SECItem *, boolean_t,
++ SECItem *, int);
++#endif
++
++#ifdef __cplusplus
++}
++#endif
++
++#endif /* _ECC_IMPL_H */
diff --git a/aarch64BuildFailure.patch b/aarch64BuildFailure.patch
deleted file mode 100644
index bb5453e..0000000
--- a/aarch64BuildFailure.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff -r 214a94e9366c src/cpu/aarch64/vm/nativeInst_aarch64.cpp
---- openjdk/src/hotspot/cpu/aarch64/nativeInst_aarch64.cpp Mon Jul 17 12:11:32 2017
+0000
-+++ openjdk/src/hotspot/cpu/aarch64/nativeInst_aarch64.cpp Mon Jul 24 16:23:14 2017
+0100
-@@ -343,7 +343,7 @@
- CodeBuffer cb(code_pos, instruction_size);
- MacroAssembler a(&cb);
-
-- a.mov(rscratch1, entry);
-+ a.movptr(rscratch1, (uintptr_t)entry);
- a.br(rscratch1);
-
- ICache::invalidate_range(code_pos, instruction_size);
-
-
diff --git a/bootcycle_jobs.patch b/bootcycle_jobs.patch
deleted file mode 100644
index 05cae9d..0000000
--- a/bootcycle_jobs.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-diff -r 21b063d75b3e make/Init.gmk
---- openjdk/make/Init.gmk Thu Mar 16 16:34:33 2017 +0000
-+++ oepnjdk/make/Init.gmk Tue Apr 04 13:49:37 2017 +0100
-@@ -303,7 +303,8 @@
- $(call PrepareSmartJavac)
- ( cd $(TOPDIR) && \
- $(NICE) $(MAKE) $(MAKE_ARGS) $(OUTPUT_SYNC_FLAG) \
-- -j $(JOBS) -f make/Main.gmk $(USER_MAKE_VARS) \
-+ $(if $(DISABLE_JOBS),, -j $(JOBS)) \
-+ -f make/Main.gmk $(USER_MAKE_VARS) \
- $(PARALLEL_TARGETS) $(COMPARE_BUILD_MAKE) $(BUILD_LOG_PIPE) || \
- ( exitcode=$$? && \
- $(PRINTF) "\nERROR: Build failed for $(TARGET_DESCRIPTION) (exit code
$$exitcode) \n" \
-diff -r 21b063d75b3e make/Main.gmk
---- jdk9/make/Main.gmk Thu Mar 16 16:34:33 2017 +0000
-+++ jdk9/make/Main.gmk Tue Apr 04 13:49:37 2017 +0100
-@@ -320,7 +320,7 @@
- ifneq ($(COMPILE_TYPE), cross)
- $(call LogWarn, Boot cycle build step 2: Building a new JDK image using previously
built image)
- +$(MAKE) $(MAKE_ARGS) -f $(TOPDIR)/make/Init.gmk PARALLEL_TARGETS=$(BOOTCYCLE_TARGET)
\
-- JOBS= SPEC=$(dir $(SPEC))bootcycle-spec.gmk main
-+ DISABLE_JOBS=true SPEC=$(dir $(SPEC))bootcycle-spec.gmk main
- else
- $(call LogWarn, Boot cycle build disabled when cross compiling)
- endif
diff --git a/hotspot-min-max-macros.patch b/hotspot-min-max-macros.patch
deleted file mode 100644
index 3b2909c..0000000
--- a/hotspot-min-max-macros.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff -r b515beb3b4ad openjdk/srchotspot/src/share/vm/utilities/globalDefinitions.hpp
---- openjdk/srchotspot/src/share/vm/utilities/globalDefinitions.hpp Thu Jul 07 18:40:53
2016 +0100
-+++ openjdk/srchotspot/src/share/vm/utilities/globalDefinitions.hpp Tue Jul 12 19:13:51
2016 +0100
-@@ -1163,8 +1163,10 @@
- #undef min
- #endif
-
-+#ifndef _GLIBCXX_STDLIB_H
- #define max(a,b) Do_not_use_max_use_MAX2_instead
- #define min(a,b) Do_not_use_min_use_MIN2_instead
-+#endif
-
- // It is necessary to use templates here. Having normal overloaded
- // functions does not work because it is necessary to provide both 32-
diff --git a/java-openjdk-s390-size_t.patch b/java-openjdk-s390-size_t.patch
new file mode 100644
index 0000000..920624c
--- /dev/null
+++ b/java-openjdk-s390-size_t.patch
@@ -0,0 +1,134 @@
+diff --git a/src/hotspot/share/code/codeCache.cpp b/src/hotspot/share/code/codeCache.cpp
+--- a/src/hotspot/share/code/codeCache.cpp
++++ b/src/hotspot/share/code/codeCache.cpp
+@@ -405,7 +405,7 @@
+ add_heap(heap);
+
+ // Reserve Space
+- size_t size_initial = MIN2(InitialCodeCacheSize, rs.size());
++ size_t size_initial = MIN2((size_t)InitialCodeCacheSize, rs.size());
+ size_initial = align_up(size_initial, os::vm_page_size());
+ if (!heap->reserve(rs, size_initial, CodeCacheSegmentSize)) {
+ vm_exit_during_initialization(err_msg("Could not reserve enough space in %s
(" SIZE_FORMAT "K)",
+diff --git a/src/hotspot/share/gc/cms/parNewGeneration.cpp
b/src/hotspot/share/gc/cms/parNewGeneration.cpp
+--- a/src/hotspot/share/gc/cms/parNewGeneration.cpp
++++ b/src/hotspot/share/gc/cms/parNewGeneration.cpp
+@@ -200,7 +200,7 @@
+ const size_t num_overflow_elems = of_stack->size();
+ const size_t space_available = queue->max_elems() - queue->size();
+ const size_t num_take_elems = MIN3(space_available / 4,
+- ParGCDesiredObjsFromOverflowList,
++ (size_t)ParGCDesiredObjsFromOverflowList,
+ num_overflow_elems);
+ // Transfer the most recent num_take_elems from the overflow
+ // stack to our work queue.
+diff --git a/src/hotspot/share/gc/g1/g1ConcurrentMark.cpp
b/src/hotspot/share/gc/g1/g1ConcurrentMark.cpp
+--- a/src/hotspot/share/gc/g1/g1ConcurrentMark.cpp
++++ b/src/hotspot/share/gc/g1/g1ConcurrentMark.cpp
+@@ -2296,7 +2296,7 @@
+ // of things to do) or totally (at the very end).
+ size_t target_size;
+ if (partially) {
+- target_size = MIN2((size_t)_task_queue->max_elems()/3, GCDrainStackTargetSize);
++ target_size = MIN2((size_t)_task_queue->max_elems()/3,
(size_t)GCDrainStackTargetSize);
+ } else {
+ target_size = 0;
+ }
+diff --git a/src/hotspot/share/gc/g1/g1ConcurrentMarkObjArrayProcessor.cpp
b/src/hotspot/share/gc/g1/g1ConcurrentMarkObjArrayProcessor.cpp
+--- a/src/hotspot/share/gc/g1/g1ConcurrentMarkObjArrayProcessor.cpp
++++ b/src/hotspot/share/gc/g1/g1ConcurrentMarkObjArrayProcessor.cpp
+@@ -31,7 +31,7 @@
+ }
+
+ size_t G1CMObjArrayProcessor::process_array_slice(objArrayOop obj, HeapWord* start_from,
size_t remaining) {
+- size_t words_to_scan = MIN2(remaining, ObjArrayMarkingStride);
++ size_t words_to_scan = MIN2(remaining, (size_t)ObjArrayMarkingStride);
+
+ if (remaining > ObjArrayMarkingStride) {
+ push_array_slice(start_from + ObjArrayMarkingStride);
+diff --git a/src/hotspot/share/gc/g1/g1PageBasedVirtualSpace.cpp
b/src/hotspot/share/gc/g1/g1PageBasedVirtualSpace.cpp
+--- a/src/hotspot/share/gc/g1/g1PageBasedVirtualSpace.cpp
++++ b/src/hotspot/share/gc/g1/g1PageBasedVirtualSpace.cpp
+@@ -100,7 +100,7 @@
+ return reserved_size() - committed_size();
+ }
+
+-size_t G1PageBasedVirtualSpace::addr_to_page_index(char* addr) const {
++uintptr_t G1PageBasedVirtualSpace::addr_to_page_index(char* addr) const {
+ return (addr - _low_boundary) / _page_size;
+ }
+
+diff --git a/src/hotspot/share/gc/parallel/psCompactionManager.inline.hpp
b/src/hotspot/share/gc/parallel/psCompactionManager.inline.hpp
+--- a/src/hotspot/share/gc/parallel/psCompactionManager.inline.hpp
++++ b/src/hotspot/share/gc/parallel/psCompactionManager.inline.hpp
+@@ -115,7 +115,7 @@
+ const size_t beg_index = size_t(index);
+ assert(beg_index < len || len == 0, "index too large");
+
+- const size_t stride = MIN2(len - beg_index, ObjArrayMarkingStride);
++ const size_t stride = MIN2(len - beg_index, (size_t)ObjArrayMarkingStride);
+ const size_t end_index = beg_index + stride;
+ T* const base = (T*)obj->base();
+ T* const beg = base + beg_index;
+diff --git a/src/hotspot/share/gc/parallel/psParallelCompact.cpp
b/src/hotspot/share/gc/parallel/psParallelCompact.cpp
+--- a/src/hotspot/share/gc/parallel/psParallelCompact.cpp
++++ b/src/hotspot/share/gc/parallel/psParallelCompact.cpp
+@@ -905,8 +905,8 @@
+ void PSParallelCompact::initialize_dead_wood_limiter()
+ {
+ const size_t max = 100;
+- _dwl_mean = double(MIN2(ParallelOldDeadWoodLimiterMean, max)) / 100.0;
+- _dwl_std_dev = double(MIN2(ParallelOldDeadWoodLimiterStdDev, max)) / 100.0;
++ _dwl_mean = double(MIN2((size_t)ParallelOldDeadWoodLimiterMean, max)) / 100.0;
++ _dwl_std_dev = double(MIN2((size_t)ParallelOldDeadWoodLimiterStdDev, max)) / 100.0;
+ _dwl_first_term = 1.0 / (sqrt(2.0 * M_PI) * _dwl_std_dev);
+ DEBUG_ONLY(_dwl_initialized = true;)
+ _dwl_adjustment = normal_distribution(1.0);
+diff --git a/src/hotspot/share/gc/shared/plab.cpp b/src/hotspot/share/gc/shared/plab.cpp
+--- a/src/hotspot/share/gc/shared/plab.cpp
++++ b/src/hotspot/share/gc/shared/plab.cpp
+@@ -32,7 +32,7 @@
+
+ size_t PLAB::min_size() {
+ // Make sure that we return something that is larger than AlignmentReserve
+- return align_object_size(MAX2(MinTLABSize / HeapWordSize,
(uintx)oopDesc::header_size())) + AlignmentReserve;
++ return align_object_size(MAX2(MinTLABSize / HeapWordSize,
(size_t)oopDesc::header_size())) + AlignmentReserve;
+ }
+
+ size_t PLAB::max_size() {
+diff --git a/src/hotspot/share/prims/whitebox.cpp b/src/hotspot/share/prims/whitebox.cpp
+--- a/src/hotspot/share/prims/whitebox.cpp
++++ b/src/hotspot/share/prims/whitebox.cpp
+@@ -1096,7 +1096,7 @@
+ WB_END
+
+ WB_ENTRY(jobject, WB_GetSizeTVMFlag(JNIEnv* env, jobject o, jstring name))
+- uintx result;
++ size_t result;
+ if (GetVMFlag <size_t> (thread, env, name, &result,
&CommandLineFlags::size_tAt)) {
+ ThreadToNativeFromVM ttnfv(thread); // can't be in VM when we call JNI
+ return longBox(thread, env, result);
+diff --git a/src/hotspot/share/runtime/arguments.cpp
b/src/hotspot/share/runtime/arguments.cpp
+--- a/src/hotspot/share/runtime/arguments.cpp
++++ b/src/hotspot/share/runtime/arguments.cpp
+@@ -1586,7 +1586,7 @@
+ // Increase the code cache size - tiered compiles a lot more.
+ if (FLAG_IS_DEFAULT(ReservedCodeCacheSize)) {
+ FLAG_SET_ERGO(uintx, ReservedCodeCacheSize,
+- MIN2(CODE_CACHE_DEFAULT_LIMIT, ReservedCodeCacheSize * 5));
++ MIN2(CODE_CACHE_DEFAULT_LIMIT, (size_t)(ReservedCodeCacheSize * 5)));
+ }
+ // Enable SegmentedCodeCache if TieredCompilation is enabled and ReservedCodeCacheSize
>= 240M
+ if (FLAG_IS_DEFAULT(SegmentedCodeCache) && ReservedCodeCacheSize >= 240*M)
{
+diff --git a/src/hotspot/share/runtime/arguments.hpp
b/src/hotspot/share/runtime/arguments.hpp
+--- a/src/hotspot/share/runtime/arguments.hpp
++++ b/src/hotspot/share/runtime/arguments.hpp
+@@ -328,7 +328,7 @@
+ // Value of the conservative maximum heap alignment needed
+ static size_t _conservative_max_heap_alignment;
+
+- static uintx _min_heap_size;
++ static size_t _min_heap_size;
+
+ // -Xrun arguments
+ static AgentLibraryList _libraryList;
diff --git a/java-openjdk.spec b/java-openjdk.spec
index 2576668..f1faca3 100644
--- a/java-openjdk.spec
+++ b/java-openjdk.spec
@@ -833,7 +833,7 @@ Provides: java-%{javaver}-%{origin}-src%{?1} =
%{epoch}:%{version}-%{release}
Name: java-%{origin}
Version: %{newjavaver}.%{buildver}
-Release: 12%{?dist}
+Release: 13%{?dist}
# java-1.5.0-ibm from
jpackage.org set Epoch to 1 for unknown reasons
# and this change was brought into RHEL-4. java-1.5.0-ibm packages
# also included the epoch in their virtual provides. This created a
@@ -874,38 +874,48 @@ Source13: TestCryptoLevel.java
# Ensure ECDSA is working
Source14: TestECDSA.java
+############################################
#
# RPM/distribution specific patches
#
+############################################
+
+# NSS via SunPKCS11 Provider (disabled comment
+# due to memory leak).
+Patch1000: enableCommentedOutSystemNss.patch
# Ignore AWTError when assistive technologies are loaded
-Patch1: accessible-toolkit.patch
+Patch1: accessible-toolkit.patch
# Restrict access to java-atk-wrapper classes
-Patch3: java-atk-wrapper-security.patch
-# RHBZ 808293
-Patch4: PStack-808293.patch
-# Allow multiple initialization of PKCS11 libraries
-Patch5: multiple-pkcs11-library-init.patch
-Patch12: system-nss-ec-rh1565658.patch
-Patch13: libjpeg-turbo-1.4-compat.patch
-# follow system wide crypto policy RHBZ#1249083
-Patch14: systemCryptoPolicyPR3183.patch
-
+Patch2: java-atk-wrapper-security.patch
+Patch3: libjpeg-turbo-1.4-compat.patch
+# Follow system wide crypto policy RHBZ#1249083
+Patch4: RHBZ-1249083-system-crypto-policy-PR3183.patch
+# System NSS via SunEC Provider
+Patch5: RHBZ-1565658-system-nss-SunEC.patch
+
+#############################################
#
# OpenJDK specific patches
#
-
-# JVM heap size changes for s390 (thanks to aph)
-Patch101: sorted-diff.patch
-Patch104: bootcycle_jobs.patch
-
-
-Patch400: ppc_stack_overflow_fix.patch
-Patch401: aarch64BuildFailure.patch
-
-
-# Non-OpenJDK fixes
-Patch1000: enableCommentedOutSystemNss.patch
+#############################################
+
+# s390 (Zero) build does not bootcycle without this patch
+# Already in JDK-11. Missing backports.
+Patch100: JDK-8201495-s390-java-opts.patch
+# See JDK-8198844. This won't be needed any more in
+# JDK 11+
+Patch101: sorted-diff.patch
+# Type fixing for s390 (Zero). Not upstream.
+Patch102: java-openjdk-s390-size_t.patch
+# bootcycle-images target may run out of ressources
+# due to bad jobs config. Missing backports.
+Patch103: JDK-8201788-bootcycle-images-jobs.patch
+# s390 (Zero) build fix. Pending upstream.
+Patch104: JDK-8201509-s390-atomic_store.patch
+
+# aarch64 slowdebug build fix. Pending upstream
+Patch400: JDK-8200556-aarch64-slowdebug-crash.patch
BuildRequires: autoconf
BuildRequires: automake
@@ -1162,26 +1172,18 @@ fi
sh %{SOURCE12}
pushd %{top_level_dir_name}
%patch1 -p1
+%patch2 -p1
%patch3 -p1
%patch4 -p1
%patch5 -p1
-%patch12 -p1
-%patch13 -p1
-%patch14 -p1
-
-# s390 build fixes
-%ifarch s390
-
-%endif
%patch101 -p1
+%patch102 -p1
+%patch103 -p1
%patch104 -p1
-# Zero PPC fixes
-# TODO: propose them upstream
%patch400 -p1
-%patch401 -p1
popd # openjdk
%patch1000
@@ -1736,6 +1738,20 @@ require "copy_jdk_configs.lua"
%changelog
+* Fri Apr 20 2018 Severin Gehwolf <sgehwolf(a)redhat.com> - 1:10.0.0.46-13
+- Removed unneeded patches:
+ PStack-808293.patch
+ multiple-pkcs11-library-init.patch
+ ppc_stack_overflow_fix.patch
+- Added patches for s390 Zero builds:
+ JDK-8201495-s390-java-opts.patch
+ JDK-8201509-s390-atomic_store.patch
+- Renamed patches for clarity:
+ aarch64BuildFailure.patch => JDK-8200556-aarch64-slowdebug-crash.patch
+ systemCryptoPolicyPR3183.patch => RHBZ-1249083-system-crypto-policy-PR3183.patch
+ bootcycle_jobs.patch => JDK-8201788-bootcycle-images-jobs.patch
+ system-nss-ec-rh1565658.patch => RHBZ-1565658-system-nss-SunEC.patch
+
* Tue Apr 10 2018 Severin Gehwolf <sgehwolf(a)redhat.com> - 1:10.0.0.46-12
- Enable basic EC ciphers test in %check.
diff --git a/multiple-pkcs11-library-init.patch b/multiple-pkcs11-library-init.patch
deleted file mode 100644
index ade94ee..0000000
--- a/multiple-pkcs11-library-init.patch
+++ /dev/null
@@ -1,74 +0,0 @@
-# HG changeset patch
-# User andrew
-# Date 1352129932 0
-# Node ID e9c857dcb964dbfa5eef3a3590244cb4d999cf7a
-# Parent 1406789608b76d0906881979335d685855f44190
-Allow multiple PKCS11 library initialisation to be a non-critical error.
-
-diff -r 1406789608b7 -r e9c857dcb964 src/share/classes/sun/security/pkcs11/Config.java
---- openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/Config.java Tue Oct
30 13:05:14 2012 +0000
-+++ openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/Config.java Mon Nov
05 15:38:52 2012 +0000
-@@ -52,6 +52,7 @@
- static final int ERR_HALT = 1;
- static final int ERR_IGNORE_ALL = 2;
- static final int ERR_IGNORE_LIB = 3;
-+ static final int ERR_IGNORE_MULTI_INIT = 4;
-
- // same as allowSingleThreadedModules but controlled via a system property
- // and applied to all providers. if set to false, no SunPKCS11 instances
-@@ -980,6 +981,8 @@
- handleStartupErrors = ERR_IGNORE_LIB;
- } else if (val.equals("halt")) {
- handleStartupErrors = ERR_HALT;
-+ } else if (val.equals("ignoreMultipleInitialisation")) {
-+ handleStartupErrors = ERR_IGNORE_MULTI_INIT;
- } else {
- throw excToken("Invalid value for handleStartupErrors:");
- }
-diff -r 1406789608b7 -r e9c857dcb964
src/share/classes/sun/security/pkcs11/SunPKCS11.java
---- openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java Tue
Oct 30 13:05:14 2012 +0000
-+++ openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java Mon
Nov 05 15:38:52 2012 +0000
-@@ -168,26 +168,37 @@
- String nssLibraryDirectory = config.getNssLibraryDirectory();
- String nssSecmodDirectory = config.getNssSecmodDirectory();
- boolean nssOptimizeSpace = config.getNssOptimizeSpace();
-+ int errorHandling = config.getHandleStartupErrors();
-
- if (secmod.isInitialized()) {
- if (nssSecmodDirectory != null) {
- String s = secmod.getConfigDir();
- if ((s != null) &&
- (s.equals(nssSecmodDirectory) == false)) {
-- throw new ProviderException("Secmod directory "
-- + nssSecmodDirectory
-- + " invalid, NSS already initialized with "
-- + s);
-+ String msg = "Secmod directory " +
nssSecmodDirectory
-+ + " invalid, NSS already initialized with " +
s;
-+ if (errorHandling == Config.ERR_IGNORE_MULTI_INIT ||
-+ errorHandling == Config.ERR_IGNORE_ALL) {
-+ throw new UnsupportedOperationException(msg);
-+ } else {
-+ throw new ProviderException(msg);
-+ }
- }
- }
- if (nssLibraryDirectory != null) {
- String s = secmod.getLibDir();
- if ((s != null) &&
- (s.equals(nssLibraryDirectory) == false)) {
-- throw new ProviderException("NSS library directory
"
-+ String msg = "NSS library directory "
- + nssLibraryDirectory
- + " invalid, NSS already initialized with "
-- + s);
-+ + s;
-+ if (errorHandling == Config.ERR_IGNORE_MULTI_INIT ||
-+ errorHandling == Config.ERR_IGNORE_ALL) {
-+ throw new UnsupportedOperationException(msg);
-+ } else {
-+ throw new ProviderException(msg);
-+ }
- }
- }
- } else {
diff --git a/ppc_stack_overflow_fix.patch b/ppc_stack_overflow_fix.patch
deleted file mode 100644
index d1b6184..0000000
--- a/ppc_stack_overflow_fix.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-diff --git a/src/cpu/zero/vm/stack_zero.hpp b/src/cpu/zero/vm/stack_zero.hpp
---- openjdk/src/hotspot/cpu/zero/stack_zero.hpp
-+++ openjdk/src/hotspot/cpu/zero/stack_zero.hpp
-@@ -99,7 +99,7 @@
- int shadow_pages_size() const {
- return _shadow_pages_size;
- }
-- int abi_stack_available(Thread *thread) const;
-+ ssize_t abi_stack_available(Thread *thread) const;
-
- public:
- void overflow_check(int required_words, TRAPS);
-diff --git a/src/cpu/zero/vm/stack_zero.inline.hpp
b/src/cpu/zero/vm/stack_zero.inline.hpp
---- openjdk/src/hotspot/cpu/zero/stack_zero.inline.hpp
-+++ openjdk/src/hotspot/cpu/zero/stack_zero.inline.hpp
-@@ -47,12 +47,12 @@
- // This method returns the amount of ABI stack available for us
- // to use under normal circumstances. Note that the returned
- // value can be negative.
--inline int ZeroStack::abi_stack_available(Thread *thread) const {
-+inline ssize_t ZeroStack::abi_stack_available(Thread *thread) const {
- guarantee(Thread::current() == thread, "should run in the same thread");
-- int stack_used = thread->stack_base() - (address) &stack_used
-+ ssize_t stack_used = thread->stack_base() - (address) &stack_used
- + (JavaThread::stack_guard_zone_size() + JavaThread::stack_shadow_zone_size());
-- int stack_free = thread->stack_size() - stack_used;
-+ ssize_t stack_free = thread->stack_size() - stack_used;
- return stack_free;
- }
-
- #endif // CPU_ZERO_VM_STACK_ZERO_INLINE_HPP
-diff --git a/src/os/linux/vm/os_linux.cpp b/src/os/linux/vm/os_linux.cpp
---- openjdk/src/hotspot/os/posix/os_posix.cpp
-+++ openjdk/src/hotspot/os/posix/os_posix.cpp
-@@ -4791,6 +4791,13 @@
-
- _java_thread_min_stack_allowed = align_up(_java_thread_min_stack_allowed,
vm_page_size());
- _java_thread_min_stack_allowed = MAX2(_java_thread_min_stack_allowed,
os_min_stack_allowed);
-+#ifdef ZERO
-+ // If this is Zero, allow at the very minimum one page each for the
-+ // Zero stack and the native stack. This won't make any difference
-+ // for 4k pages, but is significant for large pages.
-+ _java_thread_min_stack_allowed = MAX2(_java_thread_min_stack_allowed,
-+
align_size_up((size_t)(JavaThread::stack_guard_zone_size()+JavaThread::stack_shadow_zone_size()+2)
* vm_page_size(), vm_page_size());
-+#endif
-
- size_t stack_size_in_bytes = ThreadStackSize * K;
- if (stack_size_in_bytes != 0 &&
diff --git a/system-nss-ec-rh1565658.patch b/system-nss-ec-rh1565658.patch
deleted file mode 100644
index 7b1d4aa..0000000
--- a/system-nss-ec-rh1565658.patch
+++ /dev/null
@@ -1,654 +0,0 @@
-diff --git openjdk/make/autoconf/jdk-options.m4 openjdk/make/autoconf/jdk-options.m4
---- openjdk/make/autoconf/jdk-options.m4
-+++ openjdk/make/autoconf/jdk-options.m4
-@@ -264,9 +264,10 @@
- #
- AC_DEFUN_ONCE([JDKOPT_DETECT_INTREE_EC],
- [
-+ AC_REQUIRE([LIB_SETUP_MISC_LIBS])
- AC_MSG_CHECKING([if elliptic curve crypto implementation is present])
-
-- if test -d "${TOPDIR}/src/jdk.crypto.ec/share/native/libsunec/impl"; then
-+ if test "x${system_nss}" = "xyes" -o -d
"${TOPDIR}/src/jdk.crypto.ec/share/native/libsunec/impl"; then
- ENABLE_INTREE_EC=true
- AC_MSG_RESULT([yes])
- else
-diff --git openjdk/make/autoconf/libraries.m4 openjdk/make/autoconf/libraries.m4
---- openjdk/make/autoconf/libraries.m4
-+++ openjdk/make/autoconf/libraries.m4
-@@ -175,6 +175,48 @@
- AC_SUBST(LIBDL)
- LIBS="$save_LIBS"
-
-+ ###############################################################################
-+ #
-+ # Check for the NSS libraries
-+ #
-+
-+ AC_MSG_CHECKING([whether to build the Sun EC provider against the system NSS
libraries])
-+
-+ # default is bundled
-+ DEFAULT_SYSTEM_NSS=no
-+
-+ AC_ARG_ENABLE([system-nss], [AS_HELP_STRING([--enable-system-nss],
-+ [build the SunEC provider using the system NSS libraries
@<:@disabled@:>@])],
-+ [
-+ case "${enableval}" in
-+ yes)
-+ system_nss=yes
-+ ;;
-+ *)
-+ system_nss=no
-+ ;;
-+ esac
-+ ],
-+ [
-+ system_nss=${DEFAULT_SYSTEM_NSS}
-+ ])
-+ AC_MSG_RESULT([$system_nss])
-+
-+ if test "x${system_nss}" = "xyes"; then
-+ PKG_CHECK_MODULES(NSS_SOFTTKN, nss-softokn >= 3.16.1, [NSS_SOFTOKN_FOUND=yes],
[NSS_SOFTOKN_FOUND=no])
-+ PKG_CHECK_MODULES(NSS, nss >= 3.16.1, [NSS_FOUND=yes], [NSS_FOUND=no])
-+ if test "x${NSS_SOFTOKN_FOUND}" = "xyes" -a
"x${NSS_FOUND}" = "xyes"; then
-+ NSS_LIBS="$NSS_SOFTOKN_LIBS $NSS_LIBS -lfreebl";
-+ USE_EXTERNAL_NSS=true
-+ else
-+ AC_MSG_ERROR([--enable-system-nss specified, but NSS not found.])
-+ fi
-+ else
-+ USE_EXTERNAL_NSS=false
-+ fi
-+ AC_SUBST(USE_EXTERNAL_NSS)
-+
-+
- # Deprecated libraries, keep the flags for backwards compatibility
- if test "x$OPENJDK_TARGET_OS" = "xwindows"; then
- BASIC_DEPRECATED_ARG_WITH([dxsdk])
-diff --git openjdk/make/autoconf/spec.gmk.in openjdk/make/autoconf/spec.gmk.in
---- openjdk/make/autoconf/spec.gmk.in
-+++ openjdk/make/autoconf/spec.gmk.in
-@@ -764,6 +764,10 @@
- # Libraries
- #
-
-+USE_EXTERNAL_NSS:=@USE_EXTERNAL_NSS@
-+NSS_LIBS:=@NSS_LIBS@
-+NSS_CFLAGS:=@NSS_CFLAGS@
-+
- USE_EXTERNAL_LCMS:=@USE_EXTERNAL_LCMS@
- LCMS_CFLAGS:=@LCMS_CFLAGS@
- LCMS_LIBS:=@LCMS_LIBS@
-diff --git openjdk/make/lib/Lib-jdk.crypto.ec.gmk openjdk/make/lib/Lib-jdk.crypto.ec.gmk
---- openjdk/make/lib/Lib-jdk.crypto.ec.gmk
-+++ openjdk/make/lib/Lib-jdk.crypto.ec.gmk
-@@ -29,9 +29,15 @@
-
- ifeq ($(ENABLE_INTREE_EC), true)
-
-- LIBSUNEC_SRC := $(TOPDIR)/src/jdk.crypto.ec/share/native/libsunec
- BUILD_LIBSUNEC_FLAGS := $(addprefix -I, $(SUNEC_SRC))
-
-+ ifeq ($(USE_EXTERNAL_NSS), true)
-+ LIBSUNEC_SRC := $(TOPDIR)/src/jdk.crypto.ec/share/native/libsunec/ECC_JNI.cpp
-+ BUILD_LIBSUNEC_FLAGS += $(NSS_CFLAGS) -DSYSTEM_NSS -DNSS_ENABLE_ECC
-+ else
-+ LIBSUNEC_SRC := $(TOPDIR)/src/jdk.crypto.ec/share/native/libsunec
-+ endif
-+
- #
- # On sol-sparc...all libraries are compiled with -xregs=no%appl
- # (set in CFLAGS_REQUIRED_sparc)
-@@ -60,7 +66,7 @@
- LDFLAGS := $(LDFLAGS_JDKLIB) $(LDFLAGS_CXX_JDK), \
- LDFLAGS_macosx := $(call SET_SHARED_LIBRARY_ORIGIN), \
- LIBS := $(LIBCXX), \
-- LIBS_linux := -lc, \
-+ LIBS_linux := -lc $(NSS_LIBS), \
- LIBS_solaris := -lc, \
- VERSIONINFO_RESOURCE := $(GLOBAL_VERSION_INFO_RESOURCE), \
- RC_FLAGS := $(RC_FLAGS) \
-diff --git openjdk/make/mapfiles/libsunec/mapfile-vers
openjdk/make/mapfiles/libsunec/mapfile-vers
---- openjdk/make/mapfiles/libsunec/mapfile-vers
-+++ openjdk/make/mapfiles/libsunec/mapfile-vers
-@@ -31,6 +31,7 @@
- Java_sun_security_ec_ECDSASignature_signDigest;
- Java_sun_security_ec_ECDSASignature_verifySignedDigest;
- Java_sun_security_ec_ECDHKeyAgreement_deriveKey;
-+ Java_sun_security_ec_SunEC_initialize;
- local:
- *;
- };
-diff --git openjdk/src/java.base/unix/native/include/jni_md.h
openjdk/src/java.base/unix/native/include/jni_md.h
---- openjdk/src/java.base/unix/native/include/jni_md.h
-+++ openjdk/src/java.base/unix/native/include/jni_md.h
-@@ -36,6 +36,11 @@
- #define JNIEXPORT
- #define JNIIMPORT
- #endif
-+#if (defined(__GNUC__)) || __has_attribute(unused)
-+ #define UNUSED(x) UNUSED_ ## x __attribute__((__unused__))
-+#else
-+ #define UNUSED(x) UNUSED_ ## x
-+#endif
-
- #define JNICALL
-
-diff --git openjdk/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
openjdk/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
---- openjdk/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
-+++ openjdk/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
-@@ -61,6 +61,7 @@
- AccessController.doPrivileged(new PrivilegedAction<Void>() {
- public Void run() {
- System.loadLibrary("sunec"); // check for native library
-+ initialize();
- return null;
- }
- });
-@@ -272,4 +273,9 @@
- putService(new ProviderService(this, "KeyAgreement",
- "ECDH", "sun.security.ec.ECDHKeyAgreement", null,
ATTRS));
- }
-+
-+ /**
-+ * Initialize the native code.
-+ */
-+ private static native void initialize();
- }
-diff --git openjdk/src/jdk.crypto.ec/share/native/libsunec/ECC_JNI.cpp
openjdk/src/jdk.crypto.ec/share/native/libsunec/ECC_JNI.cpp
---- openjdk/src/jdk.crypto.ec/share/native/libsunec/ECC_JNI.cpp
-+++ openjdk/src/jdk.crypto.ec/share/native/libsunec/ECC_JNI.cpp
-@@ -25,7 +25,11 @@
-
- #include <jni.h>
- #include "jni_util.h"
-+#ifdef SYSTEM_NSS
-+#include "ecc_impl.h"
-+#else
- #include "impl/ecc_impl.h"
-+#endif
-
- #define ILLEGAL_STATE_EXCEPTION "java/lang/IllegalStateException"
- #define INVALID_ALGORITHM_PARAMETER_EXCEPTION \
-@@ -33,6 +37,13 @@
- #define INVALID_PARAMETER_EXCEPTION \
- "java/security/InvalidParameterException"
- #define KEY_EXCEPTION "java/security/KeyException"
-+#define INTERNAL_ERROR "java/lang/InternalError"
-+
-+#ifdef SYSTEM_NSS
-+#define SYSTEM_UNUSED(x) UNUSED(x)
-+#else
-+#define SYSTEM_UNUSED(x) x
-+#endif
-
- extern "C" {
-
-@@ -55,8 +66,13 @@
- /*
- * Deep free of the ECParams struct
- */
--void FreeECParams(ECParams *ecparams, jboolean freeStruct)
-+void FreeECParams(ECParams *ecparams, jboolean SYSTEM_UNUSED(freeStruct))
- {
-+#ifdef SYSTEM_NSS
-+ // Needs to be freed using the matching method to the one
-+ // that allocated it. PR_TRUE means the memory is zeroed.
-+ PORT_FreeArena(ecparams->arena, PR_TRUE);
-+#else
- // Use B_FALSE to free the SECItem->data element, but not the SECItem itself
- // Use B_TRUE to free both
-
-@@ -70,6 +86,7 @@
- SECITEM_FreeItem(&ecparams->curveOID, B_FALSE);
- if (freeStruct)
- free(ecparams);
-+#endif
- }
-
- jbyteArray getEncodedBytes(JNIEnv *env, SECItem *hSECItem)
-@@ -95,7 +112,7 @@
- */
- JNIEXPORT jobjectArray
- JNICALL Java_sun_security_ec_ECKeyPairGenerator_generateECKeyPair
-- (JNIEnv *env, jclass clazz, jint keySize, jbyteArray encodedParams, jbyteArray seed)
-+ (JNIEnv *env, jclass UNUSED(clazz), jint UNUSED(keySize), jbyteArray encodedParams,
jbyteArray seed)
- {
- ECPrivateKey *privKey = NULL; // contains both public and private values
- ECParams *ecparams = NULL;
-@@ -127,8 +144,17 @@
- env->GetByteArrayRegion(seed, 0, jSeedLength, pSeedBuffer);
-
- // Generate the new keypair (using the supplied seed)
-+#ifdef SYSTEM_NSS
-+ if (RNG_RandomUpdate((unsigned char *) pSeedBuffer, jSeedLength)
-+ != SECSuccess) {
-+ ThrowException(env, KEY_EXCEPTION);
-+ goto cleanup;
-+ }
-+ if (EC_NewKey(ecparams, &privKey) != SECSuccess) {
-+#else
- if (EC_NewKey(ecparams, &privKey, (unsigned char *) pSeedBuffer,
- jSeedLength, 0) != SECSuccess) {
-+#endif
- ThrowException(env, KEY_EXCEPTION);
- goto cleanup;
- }
-@@ -175,10 +201,15 @@
- }
- if (privKey) {
- FreeECParams(&privKey->ecParams, false);
-+#ifndef SYSTEM_NSS
-+ // The entire ECPrivateKey is allocated in the arena
-+ // when using system NSS, so only the in-tree version
-+ // needs to clear these manually.
- SECITEM_FreeItem(&privKey->version, B_FALSE);
- SECITEM_FreeItem(&privKey->privateValue, B_FALSE);
- SECITEM_FreeItem(&privKey->publicValue, B_FALSE);
- free(privKey);
-+#endif
- }
-
- if (pSeedBuffer) {
-@@ -196,7 +227,7 @@
- */
- JNIEXPORT jbyteArray
- JNICALL Java_sun_security_ec_ECDSASignature_signDigest
-- (JNIEnv *env, jclass clazz, jbyteArray digest, jbyteArray privateKey, jbyteArray
encodedParams, jbyteArray seed, jint timing)
-+ (JNIEnv *env, jclass UNUSED(clazz), jbyteArray digest, jbyteArray privateKey,
jbyteArray encodedParams, jbyteArray seed, jint timing)
- {
- jbyte* pDigestBuffer = NULL;
- jint jDigestLength = env->GetArrayLength(digest);
-@@ -255,8 +286,18 @@
- env->GetByteArrayRegion(seed, 0, jSeedLength, pSeedBuffer);
-
- // Sign the digest (using the supplied seed)
-+#ifdef SYSTEM_NSS
-+ if (RNG_RandomUpdate((unsigned char *) pSeedBuffer, jSeedLength)
-+ != SECSuccess) {
-+ ThrowException(env, KEY_EXCEPTION);
-+ goto cleanup;
-+ }
-+ if (ECDSA_SignDigest(&privKey, &signature_item, &digest_item)
-+ != SECSuccess) {
-+#else
- if (ECDSA_SignDigest(&privKey, &signature_item, &digest_item,
- (unsigned char *) pSeedBuffer, jSeedLength, 0, timing) != SECSuccess) {
-+#endif
- ThrowException(env, KEY_EXCEPTION);
- goto cleanup;
- }
-@@ -305,7 +346,7 @@
- */
- JNIEXPORT jboolean
- JNICALL Java_sun_security_ec_ECDSASignature_verifySignedDigest
-- (JNIEnv *env, jclass clazz, jbyteArray signedDigest, jbyteArray digest, jbyteArray
publicKey, jbyteArray encodedParams)
-+ (JNIEnv *env, jclass UNUSED(clazz), jbyteArray signedDigest, jbyteArray digest,
jbyteArray publicKey, jbyteArray encodedParams)
- {
- jboolean isValid = false;
-
-@@ -362,9 +403,10 @@
-
- cleanup:
- {
-- if (params_item.data)
-+ if (params_item.data) {
- env->ReleaseByteArrayElements(encodedParams,
- (jbyte *) params_item.data, JNI_ABORT);
-+ }
-
- if (pubKey.publicValue.data)
- env->ReleaseByteArrayElements(publicKey,
-@@ -390,7 +432,7 @@
- */
- JNIEXPORT jbyteArray
- JNICALL Java_sun_security_ec_ECDHKeyAgreement_deriveKey
-- (JNIEnv *env, jclass clazz, jbyteArray privateKey, jbyteArray publicKey, jbyteArray
encodedParams)
-+ (JNIEnv *env, jclass UNUSED(clazz), jbyteArray privateKey, jbyteArray publicKey,
jbyteArray encodedParams)
- {
- jbyteArray jSecret = NULL;
- ECParams *ecparams = NULL;
-@@ -466,9 +508,10 @@
- env->ReleaseByteArrayElements(publicKey,
- (jbyte *) publicValue_item.data, JNI_ABORT);
-
-- if (params_item.data)
-+ if (params_item.data) {
- env->ReleaseByteArrayElements(encodedParams,
- (jbyte *) params_item.data, JNI_ABORT);
-+ }
-
- if (ecparams)
- FreeECParams(ecparams, true);
-@@ -477,4 +520,28 @@
- return jSecret;
- }
-
-+JNIEXPORT void
-+JNICALL Java_sun_security_ec_SunEC_initialize
-+ (JNIEnv *env, jclass UNUSED(clazz))
-+{
-+#ifdef SYSTEM_NSS
-+ if (SECOID_Init() != SECSuccess) {
-+ ThrowException(env, INTERNAL_ERROR);
-+ }
-+ if (RNG_RNGInit() != SECSuccess) {
-+ ThrowException(env, INTERNAL_ERROR);
-+ }
-+#endif
-+}
-+
-+JNIEXPORT void
-+JNICALL JNI_OnUnload
-+ (JavaVM *vm, void *reserved)
-+{
-+#ifdef SYSTEM_NSS
-+ RNG_RNGShutdown();
-+ SECOID_Shutdown();
-+#endif
-+}
-+
- } /* extern "C" */
-diff --git openjdk/src/jdk.crypto.ec/share/native/libsunec/ecc_impl.h
openjdk/src/jdk.crypto.ec/share/native/libsunec/ecc_impl.h
-new file mode 100644
---- /dev/null
-+++ openjdk/src/jdk.crypto.ec/share/native/libsunec/ecc_impl.h
-@@ -0,0 +1,298 @@
-+/*
-+ * Copyright (c) 2007, 2017, Oracle and/or its affiliates. All rights reserved.
-+ * Use is subject to license terms.
-+ *
-+ * This library is free software; you can redistribute it and/or
-+ * modify it under the terms of the GNU Lesser General Public
-+ * License as published by the Free Software Foundation; either
-+ * version 2.1 of the License, or (at your option) any later version.
-+ *
-+ * This library is distributed in the hope that it will be useful,
-+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-+ * Lesser General Public License for more details.
-+ *
-+ * You should have received a copy of the GNU Lesser General Public License
-+ * along with this library; if not, write to the Free Software Foundation,
-+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-+ *
-+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
-+ * or visit
www.oracle.com if you need additional information or have any
-+ * questions.
-+ */
-+
-+/* *********************************************************************
-+ *
-+ * The Original Code is the Netscape security libraries.
-+ *
-+ * The Initial Developer of the Original Code is
-+ * Netscape Communications Corporation.
-+ * Portions created by the Initial Developer are Copyright (C) 1994-2000
-+ * the Initial Developer. All Rights Reserved.
-+ *
-+ * Contributor(s):
-+ * Dr Vipul Gupta <vipul.gupta(a)sun.com> and
-+ * Douglas Stebila <douglas(a)stebila.ca>, Sun Microsystems Laboratories
-+ *
-+ * Last Modified Date from the Original Code: May 2017
-+ *********************************************************************** */
-+
-+#ifndef _ECC_IMPL_H
-+#define _ECC_IMPL_H
-+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif
-+
-+#include <sys/types.h>
-+
-+#ifdef SYSTEM_NSS
-+#include <secitem.h>
-+#include <secerr.h>
-+#include <keythi.h>
-+#ifdef LEGACY_NSS
-+#include <softoken.h>
-+#else
-+#include <blapi.h>
-+#endif
-+#else
-+#include "ecl-exp.h"
-+#endif
-+
-+/*
-+ * Multi-platform definitions
-+ */
-+#ifdef __linux__
-+#define B_FALSE FALSE
-+#define B_TRUE TRUE
-+typedef unsigned char uint8_t;
-+typedef unsigned long ulong_t;
-+typedef enum { B_FALSE, B_TRUE } boolean_t;
-+#endif /* __linux__ */
-+
-+#ifdef _ALLBSD_SOURCE
-+#include <stdint.h>
-+#define B_FALSE FALSE
-+#define B_TRUE TRUE
-+typedef unsigned long ulong_t;
-+typedef enum boolean { B_FALSE, B_TRUE } boolean_t;
-+#endif /* _ALLBSD_SOURCE */
-+
-+#ifdef AIX
-+#define B_FALSE FALSE
-+#define B_TRUE TRUE
-+typedef unsigned char uint8_t;
-+typedef unsigned long ulong_t;
-+#endif /* AIX */
-+
-+#ifdef _WIN32
-+typedef unsigned char uint8_t;
-+typedef unsigned long ulong_t;
-+typedef enum boolean { B_FALSE, B_TRUE } boolean_t;
-+#define strdup _strdup /* Replace POSIX name with ISO C++ name */
-+#endif /* _WIN32 */
-+
-+#ifndef _KERNEL
-+#include <stdlib.h>
-+#endif /* _KERNEL */
-+
-+#define EC_MAX_DIGEST_LEN 1024 /* max digest that can be signed */
-+#define EC_MAX_POINT_LEN 145 /* max len of DER encoded Q */
-+#define EC_MAX_VALUE_LEN 72 /* max len of ANSI X9.62 private value d */
-+#define EC_MAX_SIG_LEN 144 /* max signature len for supported curves */
-+#define EC_MIN_KEY_LEN 112 /* min key length in bits */
-+#define EC_MAX_KEY_LEN 571 /* max key length in bits */
-+#define EC_MAX_OID_LEN 10 /* max length of OID buffer */
-+
-+/*
-+ * Various structures and definitions from NSS are here.
-+ */
-+
-+#ifndef SYSTEM_NSS
-+#ifdef _KERNEL
-+#define PORT_ArenaAlloc(a, n, f) kmem_alloc((n), (f))
-+#define PORT_ArenaZAlloc(a, n, f) kmem_zalloc((n), (f))
-+#define PORT_ArenaGrow(a, b, c, d) NULL
-+#define PORT_ZAlloc(n, f) kmem_zalloc((n), (f))
-+#define PORT_Alloc(n, f) kmem_alloc((n), (f))
-+#else
-+#define PORT_ArenaAlloc(a, n, f) malloc((n))
-+#define PORT_ArenaZAlloc(a, n, f) calloc(1, (n))
-+#define PORT_ArenaGrow(a, b, c, d) NULL
-+#define PORT_ZAlloc(n, f) calloc(1, (n))
-+#define PORT_Alloc(n, f) malloc((n))
-+#endif
-+
-+#define PORT_NewArena(b) (char *)12345
-+#define PORT_ArenaMark(a) NULL
-+#define PORT_ArenaUnmark(a, b)
-+#define PORT_ArenaRelease(a, m)
-+#define PORT_FreeArena(a, b)
-+#define PORT_Strlen(s) strlen((s))
-+#define PORT_SetError(e)
-+
-+#define PRBool boolean_t
-+#define PR_TRUE B_TRUE
-+#define PR_FALSE B_FALSE
-+
-+#ifdef _KERNEL
-+#define PORT_Assert ASSERT
-+#define PORT_Memcpy(t, f, l) bcopy((f), (t), (l))
-+#else
-+#define PORT_Assert assert
-+#define PORT_Memcpy(t, f, l) memcpy((t), (f), (l))
-+#endif
-+
-+#endif
-+
-+#define CHECK_OK(func) if (func == NULL) goto cleanup
-+#define CHECK_SEC_OK(func) if (SECSuccess != (rv = func)) goto cleanup
-+
-+#ifndef SYSTEM_NSS
-+typedef enum {
-+ siBuffer = 0,
-+ siClearDataBuffer = 1,
-+ siCipherDataBuffer = 2,
-+ siDERCertBuffer = 3,
-+ siEncodedCertBuffer = 4,
-+ siDERNameBuffer = 5,
-+ siEncodedNameBuffer = 6,
-+ siAsciiNameString = 7,
-+ siAsciiString = 8,
-+ siDEROID = 9,
-+ siUnsignedInteger = 10,
-+ siUTCTime = 11,
-+ siGeneralizedTime = 12
-+} SECItemType;
-+
-+typedef struct SECItemStr SECItem;
-+
-+struct SECItemStr {
-+ SECItemType type;
-+ unsigned char *data;
-+ unsigned int len;
-+};
-+
-+typedef SECItem SECKEYECParams;
-+
-+typedef enum { ec_params_explicit,
-+ ec_params_named
-+} ECParamsType;
-+
-+typedef enum { ec_field_GFp = 1,
-+ ec_field_GF2m
-+} ECFieldType;
-+
-+struct ECFieldIDStr {
-+ int size; /* field size in bits */
-+ ECFieldType type;
-+ union {
-+ SECItem prime; /* prime p for (GFp) */
-+ SECItem poly; /* irreducible binary polynomial for (GF2m) */
-+ } u;
-+ int k1; /* first coefficient of pentanomial or
-+ * the only coefficient of trinomial
-+ */
-+ int k2; /* two remaining coefficients of pentanomial */
-+ int k3;
-+};
-+typedef struct ECFieldIDStr ECFieldID;
-+
-+struct ECCurveStr {
-+ SECItem a; /* contains octet stream encoding of
-+ * field element (X9.62 section 4.3.3)
-+ */
-+ SECItem b;
-+ SECItem seed;
-+};
-+typedef struct ECCurveStr ECCurve;
-+
-+typedef void PRArenaPool;
-+
-+struct ECParamsStr {
-+ PRArenaPool * arena;
-+ ECParamsType type;
-+ ECFieldID fieldID;
-+ ECCurve curve;
-+ SECItem base;
-+ SECItem order;
-+ int cofactor;
-+ SECItem DEREncoding;
-+ ECCurveName name;
-+ SECItem curveOID;
-+};
-+typedef struct ECParamsStr ECParams;
-+
-+struct ECPublicKeyStr {
-+ ECParams ecParams;
-+ SECItem publicValue; /* elliptic curve point encoded as
-+ * octet stream.
-+ */
-+};
-+typedef struct ECPublicKeyStr ECPublicKey;
-+
-+struct ECPrivateKeyStr {
-+ ECParams ecParams;
-+ SECItem publicValue; /* encoded ec point */
-+ SECItem privateValue; /* private big integer */
-+ SECItem version; /* As per SEC 1, Appendix C, Section C.4 */
-+};
-+typedef struct ECPrivateKeyStr ECPrivateKey;
-+
-+typedef enum _SECStatus {
-+ SECBufferTooSmall = -3,
-+ SECWouldBlock = -2,
-+ SECFailure = -1,
-+ SECSuccess = 0
-+} SECStatus;
-+#endif
-+
-+#ifdef _KERNEL
-+#define RNG_GenerateGlobalRandomBytes(p,l) ecc_knzero_random_generator((p), (l))
-+#else
-+/*
-+ This function is no longer required because the random bytes are now
-+ supplied by the caller. Force a failure.
-+*/
-+#ifndef SYSTEM_NSS
-+#define RNG_GenerateGlobalRandomBytes(p,l) SECFailure
-+#endif
-+#endif
-+#define CHECK_MPI_OK(func) if (MP_OKAY > (err = func)) goto cleanup
-+#define MP_TO_SEC_ERROR(err)
-+
-+#define SECITEM_TO_MPINT(it, mp) \
-+ CHECK_MPI_OK(mp_read_unsigned_octets((mp), (it).data, (it).len))
-+
-+extern int ecc_knzero_random_generator(uint8_t *, size_t);
-+extern ulong_t soft_nzero_random_generator(uint8_t *, ulong_t);
-+
-+#ifdef SYSTEM_NSS
-+#define EC_DecodeParams(a,b,c) EC_DecodeParams(a,b)
-+#define ECDSA_VerifyDigest(a,b,c,d) ECDSA_VerifyDigest(a,b,c)
-+#define ECDH_Derive(a,b,c,d,e,f) ECDH_Derive(a,b,c,d,e)
-+#else
-+extern SECStatus EC_DecodeParams(const SECItem *, ECParams **, int);
-+
-+extern SECItem * SECITEM_AllocItem(PRArenaPool *, SECItem *, unsigned int, int);
-+extern SECStatus SECITEM_CopyItem(PRArenaPool *, SECItem *, const SECItem *,
-+ int);
-+extern void SECITEM_FreeItem(SECItem *, boolean_t);
-+
-+/* This function has been modified to accept an array of random bytes */
-+extern SECStatus EC_NewKey(ECParams *ecParams, ECPrivateKey **privKey,
-+ const unsigned char* random, int randomlen, int);
-+/* This function has been modified to accept an array of random bytes */
-+extern SECStatus ECDSA_SignDigest(ECPrivateKey *, SECItem *, const SECItem *,
-+ const unsigned char* random, int randomlen, int, int timing);
-+extern SECStatus ECDSA_VerifyDigest(ECPublicKey *, const SECItem *,
-+ const SECItem *, int);
-+extern SECStatus ECDH_Derive(SECItem *, ECParams *, SECItem *, boolean_t,
-+ SECItem *, int);
-+#endif
-+
-+#ifdef __cplusplus
-+}
-+#endif
-+
-+#endif /* _ECC_IMPL_H */
diff --git a/systemCryptoPolicyPR3183.patch b/systemCryptoPolicyPR3183.patch
deleted file mode 100644
index 4efbe9a..0000000
--- a/systemCryptoPolicyPR3183.patch
+++ /dev/null
@@ -1,88 +0,0 @@
-
-# HG changeset patch
-# User andrew
-# Date 1478057514 0
-# Node ID 1c4d5cb2096ae55106111da200b0bcad304f650c
-# Parent 3d53f19b48384e5252f4ec8891f7a3a82d77af2a
-PR3183: Support Fedora/RHEL system crypto policy
-diff -r 3d53f19b4838 -r 1c4d5cb2096a
src/java.base/share/classes/java/security/Security.java
---- a/src/java.base/share/classes/java/security/Security.java Wed Oct 26 03:51:39 2016
+0100
-+++ b/src/java.base/share/classes/java/security/Security.java Wed Nov 02 03:31:54 2016
+0000
-@@ -43,6 +43,9 @@
- * implementation-specific location, which is typically the properties file
- * {@code conf/security/java.security} in the Java installation directory.
- *
-+ * <p>Additional default values of security properties are read from a
-+ * system-specific location, if available.</p>
-+ *
- * @author Benjamin Renaud
- * @since 1.1
- */
-@@ -52,6 +55,10 @@
- private static final Debug sdebug =
- Debug.getInstance("properties");
-
-+ /* System property file*/
-+ private static final String SYSTEM_PROPERTIES =
-+ "/etc/crypto-policies/back-ends/java.config";
-+
- /* The java.security properties */
- private static Properties props;
-
-@@ -93,6 +100,7 @@
- if (sdebug != null) {
- sdebug.println("reading security properties file: " +
- propFile);
-+ sdebug.println(props.toString());
- }
- } catch (IOException e) {
- if (sdebug != null) {
-@@ -114,6 +122,31 @@
- }
-
- if ("true".equalsIgnoreCase(props.getProperty
-+ ("security.useSystemPropertiesFile"))) {
-+
-+ // now load the system file, if it exists, so its values
-+ // will win if they conflict with the earlier values
-+ try (BufferedInputStream bis =
-+ new BufferedInputStream(new FileInputStream(SYSTEM_PROPERTIES))) {
-+ props.load(bis);
-+ loadedProps = true;
-+
-+ if (sdebug != null) {
-+ sdebug.println("reading system security properties file "
+
-+ SYSTEM_PROPERTIES);
-+ sdebug.println(props.toString());
-+ }
-+ } catch (IOException e) {
-+ if (sdebug != null) {
-+ sdebug.println
-+ ("unable to load security properties from " +
-+ SYSTEM_PROPERTIES);
-+ e.printStackTrace();
-+ }
-+ }
-+ }
-+
-+ if ("true".equalsIgnoreCase(props.getProperty
- ("security.overridePropertiesFile"))) {
-
- String extraPropFile = System.getProperty
-diff -r 3d53f19b4838 -r 1c4d5cb2096a src/java.base/share/conf/security/java.security
---- a/src/java.base/share/conf/security/java.security Wed Oct 26 03:51:39 2016 +0100
-+++ b/src/java.base/share/conf/security/java.security Wed Nov 02 03:31:54 2016 +0000
-@@ -276,6 +276,13 @@
- security.overridePropertiesFile=true
-
- #
-+# Determines whether this properties file will be appended to
-+# using the system properties file stored at
-+# /etc/crypto-policies/back-ends/java.config
-+#
-+security.useSystemPropertiesFile=true
-+
-+#
- # Determines the default key and trust manager factory algorithms for
- # the javax.net.ssl package.
- #
commit 5cce001e471a070489e094ae15144ed54f190caa
Author: Severin Gehwolf <sgehwolf(a)redhat.com>
Date: Tue Apr 10 17:30:19 2018 +0200
Enable system NSS support test in %check.
diff --git a/java-openjdk.spec b/java-openjdk.spec
index 3fc3a0f..2576668 100644
--- a/java-openjdk.spec
+++ b/java-openjdk.spec
@@ -833,7 +833,7 @@ Provides: java-%{javaver}-%{origin}-src%{?1} =
%{epoch}:%{version}-%{release}
Name: java-%{origin}
Version: %{newjavaver}.%{buildver}
-Release: 11%{?dist}
+Release: 12%{?dist}
# java-1.5.0-ibm from
jpackage.org set Epoch to 1 for unknown reasons
# and this change was brought into RHEL-4. java-1.5.0-ibm packages
# also included the epoch in their virtual provides. This created a
@@ -1353,8 +1353,7 @@ $JAVA_HOME/bin/java --add-opens java.base/javax.crypto=ALL-UNNAMED
TestCryptoLev
# Check ECC is working
$JAVA_HOME/bin/javac -d . %{SOURCE14}
-# FIXME make it run after system NSS support?
-$JAVA_HOME/bin/java $(echo $(basename %{SOURCE14})|sed "s|\.java||") || true
+$JAVA_HOME/bin/java $(echo $(basename %{SOURCE14})|sed "s|\.java||")
# Check debug symbols are present and can identify code
find "$JAVA_HOME" -iname '*.so' -print0 | while read -d $'\0'
lib
@@ -1737,6 +1736,9 @@ require "copy_jdk_configs.lua"
%changelog
+* Tue Apr 10 2018 Severin Gehwolf <sgehwolf(a)redhat.com> - 1:10.0.0.46-12
+- Enable basic EC ciphers test in %check.
+
* Tue Apr 10 2018 Severin Gehwolf <sgehwolf(a)redhat.com> - 1:10.0.0.46-11
- Port Martin Balao's JDK 9 patch for system NSS support to JDK 10.
- Resolves RHBZ#1565658
commit b72995d6647ea925ae28f4d91c6f76da434eec79
Author: Severin Gehwolf <sgehwolf(a)redhat.com>
Date: Tue Apr 10 17:02:57 2018 +0200
Port Martin Balao's JDK 9 patch for system NSS support to JDK 10.
Resolves RHBZ#1565658.
diff --git a/java-openjdk.spec b/java-openjdk.spec
index 2795023..3fc3a0f 100644
--- a/java-openjdk.spec
+++ b/java-openjdk.spec
@@ -524,6 +524,7 @@ exit 0
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/librmi.so
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libsaproc.so
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libsctp.so
+%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libsunec.so
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libunpack.so
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libverify.so
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libzip.so
@@ -832,7 +833,7 @@ Provides: java-%{javaver}-%{origin}-src%{?1} =
%{epoch}:%{version}-%{release}
Name: java-%{origin}
Version: %{newjavaver}.%{buildver}
-Release: 10%{?dist}
+Release: 11%{?dist}
# java-1.5.0-ibm from
jpackage.org set Epoch to 1 for unknown reasons
# and this change was brought into RHEL-4. java-1.5.0-ibm packages
# also included the epoch in their virtual provides. This created a
@@ -885,7 +886,7 @@ Patch3: java-atk-wrapper-security.patch
Patch4: PStack-808293.patch
# Allow multiple initialization of PKCS11 libraries
Patch5: multiple-pkcs11-library-init.patch
-Patch12: removeSunEcProvider-RH1154143.patch
+Patch12: system-nss-ec-rh1565658.patch
Patch13: libjpeg-turbo-1.4-compat.patch
# follow system wide crypto policy RHBZ#1249083
Patch14: systemCryptoPolicyPR3183.patch
@@ -1288,6 +1289,7 @@ bash ../configure \
--with-debug-level=$debugbuild \
--with-native-debug-symbols=internal \
--enable-unlimited-crypto \
+ --enable-system-nss \
--with-zlib=system \
--with-libjpeg=system \
--with-giflib=system \
@@ -1735,6 +1737,10 @@ require "copy_jdk_configs.lua"
%changelog
+* Tue Apr 10 2018 Severin Gehwolf <sgehwolf(a)redhat.com> - 1:10.0.0.46-11
+- Port Martin Balao's JDK 9 patch for system NSS support to JDK 10.
+- Resolves RHBZ#1565658
+
* Mon Apr 09 2018 Jiri Vanek <jvanek(a)redhat.com> - 1:10.0.0.46-10
- fixed stap instal for i686(i386) and arm(armv7hl)
diff --git a/removeSunEcProvider-RH1154143.patch b/removeSunEcProvider-RH1154143.patch
deleted file mode 100644
index e128232..0000000
--- a/removeSunEcProvider-RH1154143.patch
+++ /dev/null
@@ -1,19 +0,0 @@
---- openjdk/src/java.base/share/conf/security/java.security.orig 2018-01-18
12:22:46.148339081 +0100
-+++ openjdk/src/java.base/share/conf/security/java.security 2018-01-18 12:25:12.225469321
+0100
-@@ -66,7 +66,6 @@
- #endif
- security.provider.tbd=SUN
- security.provider.tbd=SunRsaSign
--security.provider.tbd=SunEC
- security.provider.tbd=SunJSSE
- security.provider.tbd=SunJCE
- security.provider.tbd=SunJGSS
-@@ -681,7 +680,7 @@
- # Example:
- # jdk.tls.disabledAlgorithms=MD5, SSLv3, DSA, RSA keySize < 2048
- jdk.tls.disabledAlgorithms=SSLv3, RC4, MD5withRSA, DH keySize < 1024, \
-- EC keySize < 224, DES40_CBC, RC4_40
-+ EC, ECDHE, ECDH, DES40_CBC, RC4_40
-
- #
- # Legacy algorithms for Secure Socket Layer/Transport Layer Security (SSL/TLS)
diff --git a/system-nss-ec-rh1565658.patch b/system-nss-ec-rh1565658.patch
new file mode 100644
index 0000000..7b1d4aa
--- /dev/null
+++ b/system-nss-ec-rh1565658.patch
@@ -0,0 +1,654 @@
+diff --git openjdk/make/autoconf/jdk-options.m4 openjdk/make/autoconf/jdk-options.m4
+--- openjdk/make/autoconf/jdk-options.m4
++++ openjdk/make/autoconf/jdk-options.m4
+@@ -264,9 +264,10 @@
+ #
+ AC_DEFUN_ONCE([JDKOPT_DETECT_INTREE_EC],
+ [
++ AC_REQUIRE([LIB_SETUP_MISC_LIBS])
+ AC_MSG_CHECKING([if elliptic curve crypto implementation is present])
+
+- if test -d "${TOPDIR}/src/jdk.crypto.ec/share/native/libsunec/impl"; then
++ if test "x${system_nss}" = "xyes" -o -d
"${TOPDIR}/src/jdk.crypto.ec/share/native/libsunec/impl"; then
+ ENABLE_INTREE_EC=true
+ AC_MSG_RESULT([yes])
+ else
+diff --git openjdk/make/autoconf/libraries.m4 openjdk/make/autoconf/libraries.m4
+--- openjdk/make/autoconf/libraries.m4
++++ openjdk/make/autoconf/libraries.m4
+@@ -175,6 +175,48 @@
+ AC_SUBST(LIBDL)
+ LIBS="$save_LIBS"
+
++ ###############################################################################
++ #
++ # Check for the NSS libraries
++ #
++
++ AC_MSG_CHECKING([whether to build the Sun EC provider against the system NSS
libraries])
++
++ # default is bundled
++ DEFAULT_SYSTEM_NSS=no
++
++ AC_ARG_ENABLE([system-nss], [AS_HELP_STRING([--enable-system-nss],
++ [build the SunEC provider using the system NSS libraries
@<:@disabled@:>@])],
++ [
++ case "${enableval}" in
++ yes)
++ system_nss=yes
++ ;;
++ *)
++ system_nss=no
++ ;;
++ esac
++ ],
++ [
++ system_nss=${DEFAULT_SYSTEM_NSS}
++ ])
++ AC_MSG_RESULT([$system_nss])
++
++ if test "x${system_nss}" = "xyes"; then
++ PKG_CHECK_MODULES(NSS_SOFTTKN, nss-softokn >= 3.16.1, [NSS_SOFTOKN_FOUND=yes],
[NSS_SOFTOKN_FOUND=no])
++ PKG_CHECK_MODULES(NSS, nss >= 3.16.1, [NSS_FOUND=yes], [NSS_FOUND=no])
++ if test "x${NSS_SOFTOKN_FOUND}" = "xyes" -a
"x${NSS_FOUND}" = "xyes"; then
++ NSS_LIBS="$NSS_SOFTOKN_LIBS $NSS_LIBS -lfreebl";
++ USE_EXTERNAL_NSS=true
++ else
++ AC_MSG_ERROR([--enable-system-nss specified, but NSS not found.])
++ fi
++ else
++ USE_EXTERNAL_NSS=false
++ fi
++ AC_SUBST(USE_EXTERNAL_NSS)
++
++
+ # Deprecated libraries, keep the flags for backwards compatibility
+ if test "x$OPENJDK_TARGET_OS" = "xwindows"; then
+ BASIC_DEPRECATED_ARG_WITH([dxsdk])
+diff --git openjdk/make/autoconf/spec.gmk.in openjdk/make/autoconf/spec.gmk.in
+--- openjdk/make/autoconf/spec.gmk.in
++++ openjdk/make/autoconf/spec.gmk.in
+@@ -764,6 +764,10 @@
+ # Libraries
+ #
+
++USE_EXTERNAL_NSS:=@USE_EXTERNAL_NSS@
++NSS_LIBS:=@NSS_LIBS@
++NSS_CFLAGS:=@NSS_CFLAGS@
++
+ USE_EXTERNAL_LCMS:=@USE_EXTERNAL_LCMS@
+ LCMS_CFLAGS:=@LCMS_CFLAGS@
+ LCMS_LIBS:=@LCMS_LIBS@
+diff --git openjdk/make/lib/Lib-jdk.crypto.ec.gmk openjdk/make/lib/Lib-jdk.crypto.ec.gmk
+--- openjdk/make/lib/Lib-jdk.crypto.ec.gmk
++++ openjdk/make/lib/Lib-jdk.crypto.ec.gmk
+@@ -29,9 +29,15 @@
+
+ ifeq ($(ENABLE_INTREE_EC), true)
+
+- LIBSUNEC_SRC := $(TOPDIR)/src/jdk.crypto.ec/share/native/libsunec
+ BUILD_LIBSUNEC_FLAGS := $(addprefix -I, $(SUNEC_SRC))
+
++ ifeq ($(USE_EXTERNAL_NSS), true)
++ LIBSUNEC_SRC := $(TOPDIR)/src/jdk.crypto.ec/share/native/libsunec/ECC_JNI.cpp
++ BUILD_LIBSUNEC_FLAGS += $(NSS_CFLAGS) -DSYSTEM_NSS -DNSS_ENABLE_ECC
++ else
++ LIBSUNEC_SRC := $(TOPDIR)/src/jdk.crypto.ec/share/native/libsunec
++ endif
++
+ #
+ # On sol-sparc...all libraries are compiled with -xregs=no%appl
+ # (set in CFLAGS_REQUIRED_sparc)
+@@ -60,7 +66,7 @@
+ LDFLAGS := $(LDFLAGS_JDKLIB) $(LDFLAGS_CXX_JDK), \
+ LDFLAGS_macosx := $(call SET_SHARED_LIBRARY_ORIGIN), \
+ LIBS := $(LIBCXX), \
+- LIBS_linux := -lc, \
++ LIBS_linux := -lc $(NSS_LIBS), \
+ LIBS_solaris := -lc, \
+ VERSIONINFO_RESOURCE := $(GLOBAL_VERSION_INFO_RESOURCE), \
+ RC_FLAGS := $(RC_FLAGS) \
+diff --git openjdk/make/mapfiles/libsunec/mapfile-vers
openjdk/make/mapfiles/libsunec/mapfile-vers
+--- openjdk/make/mapfiles/libsunec/mapfile-vers
++++ openjdk/make/mapfiles/libsunec/mapfile-vers
+@@ -31,6 +31,7 @@
+ Java_sun_security_ec_ECDSASignature_signDigest;
+ Java_sun_security_ec_ECDSASignature_verifySignedDigest;
+ Java_sun_security_ec_ECDHKeyAgreement_deriveKey;
++ Java_sun_security_ec_SunEC_initialize;
+ local:
+ *;
+ };
+diff --git openjdk/src/java.base/unix/native/include/jni_md.h
openjdk/src/java.base/unix/native/include/jni_md.h
+--- openjdk/src/java.base/unix/native/include/jni_md.h
++++ openjdk/src/java.base/unix/native/include/jni_md.h
+@@ -36,6 +36,11 @@
+ #define JNIEXPORT
+ #define JNIIMPORT
+ #endif
++#if (defined(__GNUC__)) || __has_attribute(unused)
++ #define UNUSED(x) UNUSED_ ## x __attribute__((__unused__))
++#else
++ #define UNUSED(x) UNUSED_ ## x
++#endif
+
+ #define JNICALL
+
+diff --git openjdk/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
openjdk/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
+--- openjdk/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
++++ openjdk/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
+@@ -61,6 +61,7 @@
+ AccessController.doPrivileged(new PrivilegedAction<Void>() {
+ public Void run() {
+ System.loadLibrary("sunec"); // check for native library
++ initialize();
+ return null;
+ }
+ });
+@@ -272,4 +273,9 @@
+ putService(new ProviderService(this, "KeyAgreement",
+ "ECDH", "sun.security.ec.ECDHKeyAgreement", null,
ATTRS));
+ }
++
++ /**
++ * Initialize the native code.
++ */
++ private static native void initialize();
+ }
+diff --git openjdk/src/jdk.crypto.ec/share/native/libsunec/ECC_JNI.cpp
openjdk/src/jdk.crypto.ec/share/native/libsunec/ECC_JNI.cpp
+--- openjdk/src/jdk.crypto.ec/share/native/libsunec/ECC_JNI.cpp
++++ openjdk/src/jdk.crypto.ec/share/native/libsunec/ECC_JNI.cpp
+@@ -25,7 +25,11 @@
+
+ #include <jni.h>
+ #include "jni_util.h"
++#ifdef SYSTEM_NSS
++#include "ecc_impl.h"
++#else
+ #include "impl/ecc_impl.h"
++#endif
+
+ #define ILLEGAL_STATE_EXCEPTION "java/lang/IllegalStateException"
+ #define INVALID_ALGORITHM_PARAMETER_EXCEPTION \
+@@ -33,6 +37,13 @@
+ #define INVALID_PARAMETER_EXCEPTION \
+ "java/security/InvalidParameterException"
+ #define KEY_EXCEPTION "java/security/KeyException"
++#define INTERNAL_ERROR "java/lang/InternalError"
++
++#ifdef SYSTEM_NSS
++#define SYSTEM_UNUSED(x) UNUSED(x)
++#else
++#define SYSTEM_UNUSED(x) x
++#endif
+
+ extern "C" {
+
+@@ -55,8 +66,13 @@
+ /*
+ * Deep free of the ECParams struct
+ */
+-void FreeECParams(ECParams *ecparams, jboolean freeStruct)
++void FreeECParams(ECParams *ecparams, jboolean SYSTEM_UNUSED(freeStruct))
+ {
++#ifdef SYSTEM_NSS
++ // Needs to be freed using the matching method to the one
++ // that allocated it. PR_TRUE means the memory is zeroed.
++ PORT_FreeArena(ecparams->arena, PR_TRUE);
++#else
+ // Use B_FALSE to free the SECItem->data element, but not the SECItem itself
+ // Use B_TRUE to free both
+
+@@ -70,6 +86,7 @@
+ SECITEM_FreeItem(&ecparams->curveOID, B_FALSE);
+ if (freeStruct)
+ free(ecparams);
++#endif
+ }
+
+ jbyteArray getEncodedBytes(JNIEnv *env, SECItem *hSECItem)
+@@ -95,7 +112,7 @@
+ */
+ JNIEXPORT jobjectArray
+ JNICALL Java_sun_security_ec_ECKeyPairGenerator_generateECKeyPair
+- (JNIEnv *env, jclass clazz, jint keySize, jbyteArray encodedParams, jbyteArray seed)
++ (JNIEnv *env, jclass UNUSED(clazz), jint UNUSED(keySize), jbyteArray encodedParams,
jbyteArray seed)
+ {
+ ECPrivateKey *privKey = NULL; // contains both public and private values
+ ECParams *ecparams = NULL;
+@@ -127,8 +144,17 @@
+ env->GetByteArrayRegion(seed, 0, jSeedLength, pSeedBuffer);
+
+ // Generate the new keypair (using the supplied seed)
++#ifdef SYSTEM_NSS
++ if (RNG_RandomUpdate((unsigned char *) pSeedBuffer, jSeedLength)
++ != SECSuccess) {
++ ThrowException(env, KEY_EXCEPTION);
++ goto cleanup;
++ }
++ if (EC_NewKey(ecparams, &privKey) != SECSuccess) {
++#else
+ if (EC_NewKey(ecparams, &privKey, (unsigned char *) pSeedBuffer,
+ jSeedLength, 0) != SECSuccess) {
++#endif
+ ThrowException(env, KEY_EXCEPTION);
+ goto cleanup;
+ }
+@@ -175,10 +201,15 @@
+ }
+ if (privKey) {
+ FreeECParams(&privKey->ecParams, false);
++#ifndef SYSTEM_NSS
++ // The entire ECPrivateKey is allocated in the arena
++ // when using system NSS, so only the in-tree version
++ // needs to clear these manually.
+ SECITEM_FreeItem(&privKey->version, B_FALSE);
+ SECITEM_FreeItem(&privKey->privateValue, B_FALSE);
+ SECITEM_FreeItem(&privKey->publicValue, B_FALSE);
+ free(privKey);
++#endif
+ }
+
+ if (pSeedBuffer) {
+@@ -196,7 +227,7 @@
+ */
+ JNIEXPORT jbyteArray
+ JNICALL Java_sun_security_ec_ECDSASignature_signDigest
+- (JNIEnv *env, jclass clazz, jbyteArray digest, jbyteArray privateKey, jbyteArray
encodedParams, jbyteArray seed, jint timing)
++ (JNIEnv *env, jclass UNUSED(clazz), jbyteArray digest, jbyteArray privateKey,
jbyteArray encodedParams, jbyteArray seed, jint timing)
+ {
+ jbyte* pDigestBuffer = NULL;
+ jint jDigestLength = env->GetArrayLength(digest);
+@@ -255,8 +286,18 @@
+ env->GetByteArrayRegion(seed, 0, jSeedLength, pSeedBuffer);
+
+ // Sign the digest (using the supplied seed)
++#ifdef SYSTEM_NSS
++ if (RNG_RandomUpdate((unsigned char *) pSeedBuffer, jSeedLength)
++ != SECSuccess) {
++ ThrowException(env, KEY_EXCEPTION);
++ goto cleanup;
++ }
++ if (ECDSA_SignDigest(&privKey, &signature_item, &digest_item)
++ != SECSuccess) {
++#else
+ if (ECDSA_SignDigest(&privKey, &signature_item, &digest_item,
+ (unsigned char *) pSeedBuffer, jSeedLength, 0, timing) != SECSuccess) {
++#endif
+ ThrowException(env, KEY_EXCEPTION);
+ goto cleanup;
+ }
+@@ -305,7 +346,7 @@
+ */
+ JNIEXPORT jboolean
+ JNICALL Java_sun_security_ec_ECDSASignature_verifySignedDigest
+- (JNIEnv *env, jclass clazz, jbyteArray signedDigest, jbyteArray digest, jbyteArray
publicKey, jbyteArray encodedParams)
++ (JNIEnv *env, jclass UNUSED(clazz), jbyteArray signedDigest, jbyteArray digest,
jbyteArray publicKey, jbyteArray encodedParams)
+ {
+ jboolean isValid = false;
+
+@@ -362,9 +403,10 @@
+
+ cleanup:
+ {
+- if (params_item.data)
++ if (params_item.data) {
+ env->ReleaseByteArrayElements(encodedParams,
+ (jbyte *) params_item.data, JNI_ABORT);
++ }
+
+ if (pubKey.publicValue.data)
+ env->ReleaseByteArrayElements(publicKey,
+@@ -390,7 +432,7 @@
+ */
+ JNIEXPORT jbyteArray
+ JNICALL Java_sun_security_ec_ECDHKeyAgreement_deriveKey
+- (JNIEnv *env, jclass clazz, jbyteArray privateKey, jbyteArray publicKey, jbyteArray
encodedParams)
++ (JNIEnv *env, jclass UNUSED(clazz), jbyteArray privateKey, jbyteArray publicKey,
jbyteArray encodedParams)
+ {
+ jbyteArray jSecret = NULL;
+ ECParams *ecparams = NULL;
+@@ -466,9 +508,10 @@
+ env->ReleaseByteArrayElements(publicKey,
+ (jbyte *) publicValue_item.data, JNI_ABORT);
+
+- if (params_item.data)
++ if (params_item.data) {
+ env->ReleaseByteArrayElements(encodedParams,
+ (jbyte *) params_item.data, JNI_ABORT);
++ }
+
+ if (ecparams)
+ FreeECParams(ecparams, true);
+@@ -477,4 +520,28 @@
+ return jSecret;
+ }
+
++JNIEXPORT void
++JNICALL Java_sun_security_ec_SunEC_initialize
++ (JNIEnv *env, jclass UNUSED(clazz))
++{
++#ifdef SYSTEM_NSS
++ if (SECOID_Init() != SECSuccess) {
++ ThrowException(env, INTERNAL_ERROR);
++ }
++ if (RNG_RNGInit() != SECSuccess) {
++ ThrowException(env, INTERNAL_ERROR);
++ }
++#endif
++}
++
++JNIEXPORT void
++JNICALL JNI_OnUnload
++ (JavaVM *vm, void *reserved)
++{
++#ifdef SYSTEM_NSS
++ RNG_RNGShutdown();
++ SECOID_Shutdown();
++#endif
++}
++
+ } /* extern "C" */
+diff --git openjdk/src/jdk.crypto.ec/share/native/libsunec/ecc_impl.h
openjdk/src/jdk.crypto.ec/share/native/libsunec/ecc_impl.h
+new file mode 100644
+--- /dev/null
++++ openjdk/src/jdk.crypto.ec/share/native/libsunec/ecc_impl.h
+@@ -0,0 +1,298 @@
++/*
++ * Copyright (c) 2007, 2017, Oracle and/or its affiliates. All rights reserved.
++ * Use is subject to license terms.
++ *
++ * This library is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU Lesser General Public
++ * License as published by the Free Software Foundation; either
++ * version 2.1 of the License, or (at your option) any later version.
++ *
++ * This library is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ * Lesser General Public License for more details.
++ *
++ * You should have received a copy of the GNU Lesser General Public License
++ * along with this library; if not, write to the Free Software Foundation,
++ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
++ *
++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
++ * or visit
www.oracle.com if you need additional information or have any
++ * questions.
++ */
++
++/* *********************************************************************
++ *
++ * The Original Code is the Netscape security libraries.
++ *
++ * The Initial Developer of the Original Code is
++ * Netscape Communications Corporation.
++ * Portions created by the Initial Developer are Copyright (C) 1994-2000
++ * the Initial Developer. All Rights Reserved.
++ *
++ * Contributor(s):
++ * Dr Vipul Gupta <vipul.gupta(a)sun.com> and
++ * Douglas Stebila <douglas(a)stebila.ca>, Sun Microsystems Laboratories
++ *
++ * Last Modified Date from the Original Code: May 2017
++ *********************************************************************** */
++
++#ifndef _ECC_IMPL_H
++#define _ECC_IMPL_H
++
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++#include <sys/types.h>
++
++#ifdef SYSTEM_NSS
++#include <secitem.h>
++#include <secerr.h>
++#include <keythi.h>
++#ifdef LEGACY_NSS
++#include <softoken.h>
++#else
++#include <blapi.h>
++#endif
++#else
++#include "ecl-exp.h"
++#endif
++
++/*
++ * Multi-platform definitions
++ */
++#ifdef __linux__
++#define B_FALSE FALSE
++#define B_TRUE TRUE
++typedef unsigned char uint8_t;
++typedef unsigned long ulong_t;
++typedef enum { B_FALSE, B_TRUE } boolean_t;
++#endif /* __linux__ */
++
++#ifdef _ALLBSD_SOURCE
++#include <stdint.h>
++#define B_FALSE FALSE
++#define B_TRUE TRUE
++typedef unsigned long ulong_t;
++typedef enum boolean { B_FALSE, B_TRUE } boolean_t;
++#endif /* _ALLBSD_SOURCE */
++
++#ifdef AIX
++#define B_FALSE FALSE
++#define B_TRUE TRUE
++typedef unsigned char uint8_t;
++typedef unsigned long ulong_t;
++#endif /* AIX */
++
++#ifdef _WIN32
++typedef unsigned char uint8_t;
++typedef unsigned long ulong_t;
++typedef enum boolean { B_FALSE, B_TRUE } boolean_t;
++#define strdup _strdup /* Replace POSIX name with ISO C++ name */
++#endif /* _WIN32 */
++
++#ifndef _KERNEL
++#include <stdlib.h>
++#endif /* _KERNEL */
++
++#define EC_MAX_DIGEST_LEN 1024 /* max digest that can be signed */
++#define EC_MAX_POINT_LEN 145 /* max len of DER encoded Q */
++#define EC_MAX_VALUE_LEN 72 /* max len of ANSI X9.62 private value d */
++#define EC_MAX_SIG_LEN 144 /* max signature len for supported curves */
++#define EC_MIN_KEY_LEN 112 /* min key length in bits */
++#define EC_MAX_KEY_LEN 571 /* max key length in bits */
++#define EC_MAX_OID_LEN 10 /* max length of OID buffer */
++
++/*
++ * Various structures and definitions from NSS are here.
++ */
++
++#ifndef SYSTEM_NSS
++#ifdef _KERNEL
++#define PORT_ArenaAlloc(a, n, f) kmem_alloc((n), (f))
++#define PORT_ArenaZAlloc(a, n, f) kmem_zalloc((n), (f))
++#define PORT_ArenaGrow(a, b, c, d) NULL
++#define PORT_ZAlloc(n, f) kmem_zalloc((n), (f))
++#define PORT_Alloc(n, f) kmem_alloc((n), (f))
++#else
++#define PORT_ArenaAlloc(a, n, f) malloc((n))
++#define PORT_ArenaZAlloc(a, n, f) calloc(1, (n))
++#define PORT_ArenaGrow(a, b, c, d) NULL
++#define PORT_ZAlloc(n, f) calloc(1, (n))
++#define PORT_Alloc(n, f) malloc((n))
++#endif
++
++#define PORT_NewArena(b) (char *)12345
++#define PORT_ArenaMark(a) NULL
++#define PORT_ArenaUnmark(a, b)
++#define PORT_ArenaRelease(a, m)
++#define PORT_FreeArena(a, b)
++#define PORT_Strlen(s) strlen((s))
++#define PORT_SetError(e)
++
++#define PRBool boolean_t
++#define PR_TRUE B_TRUE
++#define PR_FALSE B_FALSE
++
++#ifdef _KERNEL
++#define PORT_Assert ASSERT
++#define PORT_Memcpy(t, f, l) bcopy((f), (t), (l))
++#else
++#define PORT_Assert assert
++#define PORT_Memcpy(t, f, l) memcpy((t), (f), (l))
++#endif
++
++#endif
++
++#define CHECK_OK(func) if (func == NULL) goto cleanup
++#define CHECK_SEC_OK(func) if (SECSuccess != (rv = func)) goto cleanup
++
++#ifndef SYSTEM_NSS
++typedef enum {
++ siBuffer = 0,
++ siClearDataBuffer = 1,
++ siCipherDataBuffer = 2,
++ siDERCertBuffer = 3,
++ siEncodedCertBuffer = 4,
++ siDERNameBuffer = 5,
++ siEncodedNameBuffer = 6,
++ siAsciiNameString = 7,
++ siAsciiString = 8,
++ siDEROID = 9,
++ siUnsignedInteger = 10,
++ siUTCTime = 11,
++ siGeneralizedTime = 12
++} SECItemType;
++
++typedef struct SECItemStr SECItem;
++
++struct SECItemStr {
++ SECItemType type;
++ unsigned char *data;
++ unsigned int len;
++};
++
++typedef SECItem SECKEYECParams;
++
++typedef enum { ec_params_explicit,
++ ec_params_named
++} ECParamsType;
++
++typedef enum { ec_field_GFp = 1,
++ ec_field_GF2m
++} ECFieldType;
++
++struct ECFieldIDStr {
++ int size; /* field size in bits */
++ ECFieldType type;
++ union {
++ SECItem prime; /* prime p for (GFp) */
++ SECItem poly; /* irreducible binary polynomial for (GF2m) */
++ } u;
++ int k1; /* first coefficient of pentanomial or
++ * the only coefficient of trinomial
++ */
++ int k2; /* two remaining coefficients of pentanomial */
++ int k3;
++};
++typedef struct ECFieldIDStr ECFieldID;
++
++struct ECCurveStr {
++ SECItem a; /* contains octet stream encoding of
++ * field element (X9.62 section 4.3.3)
++ */
++ SECItem b;
++ SECItem seed;
++};
++typedef struct ECCurveStr ECCurve;
++
++typedef void PRArenaPool;
++
++struct ECParamsStr {
++ PRArenaPool * arena;
++ ECParamsType type;
++ ECFieldID fieldID;
++ ECCurve curve;
++ SECItem base;
++ SECItem order;
++ int cofactor;
++ SECItem DEREncoding;
++ ECCurveName name;
++ SECItem curveOID;
++};
++typedef struct ECParamsStr ECParams;
++
++struct ECPublicKeyStr {
++ ECParams ecParams;
++ SECItem publicValue; /* elliptic curve point encoded as
++ * octet stream.
++ */
++};
++typedef struct ECPublicKeyStr ECPublicKey;
++
++struct ECPrivateKeyStr {
++ ECParams ecParams;
++ SECItem publicValue; /* encoded ec point */
++ SECItem privateValue; /* private big integer */
++ SECItem version; /* As per SEC 1, Appendix C, Section C.4 */
++};
++typedef struct ECPrivateKeyStr ECPrivateKey;
++
++typedef enum _SECStatus {
++ SECBufferTooSmall = -3,
++ SECWouldBlock = -2,
++ SECFailure = -1,
++ SECSuccess = 0
++} SECStatus;
++#endif
++
++#ifdef _KERNEL
++#define RNG_GenerateGlobalRandomBytes(p,l) ecc_knzero_random_generator((p), (l))
++#else
++/*
++ This function is no longer required because the random bytes are now
++ supplied by the caller. Force a failure.
++*/
++#ifndef SYSTEM_NSS
++#define RNG_GenerateGlobalRandomBytes(p,l) SECFailure
++#endif
++#endif
++#define CHECK_MPI_OK(func) if (MP_OKAY > (err = func)) goto cleanup
++#define MP_TO_SEC_ERROR(err)
++
++#define SECITEM_TO_MPINT(it, mp) \
++ CHECK_MPI_OK(mp_read_unsigned_octets((mp), (it).data, (it).len))
++
++extern int ecc_knzero_random_generator(uint8_t *, size_t);
++extern ulong_t soft_nzero_random_generator(uint8_t *, ulong_t);
++
++#ifdef SYSTEM_NSS
++#define EC_DecodeParams(a,b,c) EC_DecodeParams(a,b)
++#define ECDSA_VerifyDigest(a,b,c,d) ECDSA_VerifyDigest(a,b,c)
++#define ECDH_Derive(a,b,c,d,e,f) ECDH_Derive(a,b,c,d,e)
++#else
++extern SECStatus EC_DecodeParams(const SECItem *, ECParams **, int);
++
++extern SECItem * SECITEM_AllocItem(PRArenaPool *, SECItem *, unsigned int, int);
++extern SECStatus SECITEM_CopyItem(PRArenaPool *, SECItem *, const SECItem *,
++ int);
++extern void SECITEM_FreeItem(SECItem *, boolean_t);
++
++/* This function has been modified to accept an array of random bytes */
++extern SECStatus EC_NewKey(ECParams *ecParams, ECPrivateKey **privKey,
++ const unsigned char* random, int randomlen, int);
++/* This function has been modified to accept an array of random bytes */
++extern SECStatus ECDSA_SignDigest(ECPrivateKey *, SECItem *, const SECItem *,
++ const unsigned char* random, int randomlen, int, int timing);
++extern SECStatus ECDSA_VerifyDigest(ECPublicKey *, const SECItem *,
++ const SECItem *, int);
++extern SECStatus ECDH_Derive(SECItem *, ECParams *, SECItem *, boolean_t,
++ SECItem *, int);
++#endif
++
++#ifdef __cplusplus
++}
++#endif
++
++#endif /* _ECC_IMPL_H */