Merge ~vpa1977/ubuntu/+source/openjdk-17:sr-20230117 into ubuntu/+source/openjdk-17:ubuntu/devel

[Vladimir Petko]

openjdk-17 (17.0.6+10-0ubuntu1) lunar; urgency=medium

  * OpenJDK 17.0.6 release, build 10.
    - CVE-2023-21835, CVE-2023-21843
    - Release notes:
      https://www.oracle.com/java/technologies/javase/17-0-6-relnotes.html
  * debian/patches/*: Refreshed patches for the new release and dropped unused
    patches.
  * debian/rules: add lunar to jtreg version selection.

PPA: https://launchpad.net/~vpa1977/+archive/ubuntu/jdk-security-release2

1978527... by Vladimir Petko on 2023-01-17

maintainer

4f68554... by Vladimir Petko on 2023-01-18

 maintainer

26e138b... by Vladimir Petko on 2023-01-18

fix patch formatting

4bdf74f... by Vladimir Petko on 2023-01-19

New upstream version 17.0.6+10

8d62909... by Vladimir Petko on 2023-01-19

Update upstream source from tag 'upstream/17.0.6+10'

Update to upstream version '17.0.6+10'
with Debian dir af7e9d5c19652037b4b8a5b4025b023b47630b54

e9458f0... by Vladimir Petko on 2023-01-19

changelog .10

diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..7745062
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1 @@
+*	-text
diff --git a/.github/actions/config/action.yml b/.github/actions/config/action.yml
new file mode 100644
index 0000000..5f648ff
--- /dev/null
+++ b/.github/actions/config/action.yml
@@ -0,0 +1,46 @@
+#
+# Copyright (c) 2022, Oracle and/or its affiliates. All rights reserved.
+# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+#
+# This code is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License version 2 only, as
+# published by the Free Software Foundation.  Oracle designates this
+# particular file as subject to the "Classpath" exception as provided
+# by Oracle in the LICENSE file that accompanied this code.
+#
+# This code is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+# version 2 for more details (a copy is included in the LICENSE file that
+# accompanied this code).
+#
+# You should have received a copy of the GNU General Public License version
+# 2 along with this work; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+# or visit www.oracle.com if you need additional information or have any
+# questions.
+#
+
+name: 'Config'
+description: 'Read JDK Configuration Variables'
+inputs:
+  var:
+    description: 'The name of the variable to read'
+    required: true
+outputs:
+  value:
+    description: 'The value of the configuration variable'
+    value: ${{ steps.read-config.outputs.value }}
+
+runs:
+  using: composite
+  steps:
+    - name: 'Read configuration variable from repo'
+      id: read-config
+      run: |
+        # Extract value from configuration file
+        value="$(grep -h ${{ inputs.var }}= make/conf/github-actions.conf | cut -d '=' -f 2-)"
+        echo "value=$value" >> $GITHUB_OUTPUT
+      shell: bash
diff --git a/.github/actions/do-build/action.yml b/.github/actions/do-build/action.yml
new file mode 100644
index 0000000..3deb7f4
--- /dev/null
+++ b/.github/actions/do-build/action.yml
@@ -0,0 +1,80 @@
+#
+# Copyright (c) 2022, Oracle and/or its affiliates. All rights reserved.
+# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+#
+# This code is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License version 2 only, as
+# published by the Free Software Foundation.  Oracle designates this
+# particular file as subject to the "Classpath" exception as provided
+# by Oracle in the LICENSE file that accompanied this code.
+#
+# This code is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+# version 2 for more details (a copy is included in the LICENSE file that
+# accompanied this code).
+#
+# You should have received a copy of the GNU General Public License version
+# 2 along with this work; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+# or visit www.oracle.com if you need additional information or have any
+# questions.
+#
+
+name: 'Do build'
+description: 'Build the JDK using make'
+inputs:
+  make-target:
+    description: 'Make target(s)'
+    required: true
+  platform:
+    description: 'Platform name'
+    required: true
+  debug-suffix:
+    description: 'File name suffix denoting debug level, possibly empty'
+    required: false
+
+runs:
+  using: composite
+  steps:
+    - name: 'Build'
+      id: build
+      run: >
+        make LOG=info ${{ inputs.make-target }}
+        || bash ./.github/scripts/gen-build-failure-report.sh "$GITHUB_STEP_SUMMARY"
+      shell: bash
+
+    - name: 'Check for failure'
+      id: check
+      run: |
+        # Check for failure marker file
+        build_dir="$(ls -d build/*)"
+        if [[ -e $build_dir/build-failure ]]; then
+          # Collect relevant log files
+          mkdir failure-logs
+          cp \
+              $build_dir/spec.gmk \
+              $build_dir/build.log \
+              $build_dir/configure.log \
+              $build_dir/make-support/failure-summary.log \
+              $build_dir/make-support/failure-logs/* \
+              failure-logs/ 2> /dev/null || true
+          echo 'failure=true' >> $GITHUB_OUTPUT
+        fi
+      shell: bash
+
+    - name: 'Upload build logs'
+      uses: actions/upload-artifact@v3
+      with:
+        name: failure-logs-${{ inputs.platform }}${{ inputs.debug-suffix }}
+        path: failure-logs
+      if: steps.check.outputs.failure == 'true'
+
+      # This is the best way I found to abort the job with an error message
+    - name: 'Notify about build failures'
+      uses: actions/github-script@v6
+      with:
+        script: core.setFailed('Build failed. See summary for details.')
+      if: steps.check.outputs.failure == 'true'
diff --git a/.github/actions/get-bootjdk/action.yml b/.github/actions/get-bootjdk/action.yml
new file mode 100644
index 0000000..19c3a01
--- /dev/null
+++ b/.github/actions/get-bootjdk/action.yml
@@ -0,0 +1,109 @@
+#
+# Copyright (c) 2022, Oracle and/or its affiliates. All rights reserved.
+# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+#
+# This code is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License version 2 only, as
+# published by the Free Software Foundation.  Oracle designates this
+# particular file as subject to the "Classpath" exception as provided
+# by Oracle in the LICENSE file that accompanied this code.
+#
+# This code is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+# version 2 for more details (a copy is included in the LICENSE file that
+# accompanied this code).
+#
+# You should have received a copy of the GNU General Public License version
+# 2 along with this work; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+# or visit www.oracle.com if you need additional information or have any
+# questions.
+#
+
+name: 'Get BootJDK'
+description: 'Download the BootJDK from cache or source location'
+inputs:
+  platform:
+    description: 'Platform'
+    required: true
+outputs:
+  path:
+    description: 'Path to the installed BootJDK'
+    value: ${{ steps.path-name.outputs.path }}
+
+runs:
+  using: composite
+  steps:
+    - name: 'Determine platform prefix'
+      id: platform-prefix
+      run: |
+        # Convert platform name to upper case
+        platform_prefix="$(echo ${{ inputs.platform }} | tr [a-z-] [A-Z_])"
+        echo "value=$platform_prefix" >> $GITHUB_OUTPUT
+      shell: bash
+
+    - name: 'Get URL configuration'
+      id: url
+      uses: ./.github/actions/config
+      with:
+        var: ${{ steps.platform-prefix.outputs.value}}_BOOT_JDK_URL
+
+    - name: 'Get SHA256 configuration'
+      id: sha256
+      uses: ./.github/actions/config
+      with:
+        var: ${{ steps.platform-prefix.outputs.value}}_BOOT_JDK_SHA256
+
+    - name: 'Get file extension configuration'
+      id: ext
+      uses: ./.github/actions/config
+      with:
+        var: ${{ steps.platform-prefix.outputs.value}}_BOOT_JDK_EXT
+
+    - name: 'Check cache for BootJDK'
+      id: get-cached-bootjdk
+      uses: actions/cache@v3
+      with:
+        path: bootjdk/jdk
+        key: boot-jdk-${{ inputs.platform }}-${{ steps.sha256.outputs.value }}
+
+      # macOS is missing sha256sum
+    - name: 'Install sha256sum'
+      run: |
+        # Run Homebrew installation
+        brew install coreutils
+      shell: bash
+      if: steps.get-cached-bootjdk.outputs.cache-hit != 'true' && runner.os == 'macOS'
+
+    - name: 'Download BootJDK'
+      run: |
+        # Download BootJDK and verify checksum
+        mkdir -p bootjdk/jdk
+        mkdir -p bootjdk/unpacked
+        wget --progress=dot:mega -O bootjdk/jdk.${{ steps.ext.outputs.value }} '${{ steps.url.outputs.value }}'
+        echo '${{ steps.sha256.outputs.value }} bootjdk/jdk.${{ steps.ext.outputs.value }}' | sha256sum -c >/dev/null -
+      shell: bash
+      if: steps.get-cached-bootjdk.outputs.cache-hit != 'true'
+
+    - name: 'Unpack BootJDK'
+      run: |
+        # Unpack the BootJDK and move files to a common location
+        if [[ '${{ steps.ext.outputs.value }}' == 'tar.gz' ]]; then
+          tar -xf bootjdk/jdk.${{ steps.ext.outputs.value }} -C bootjdk/unpacked
+        else
+          unzip -q bootjdk/jdk.${{ steps.ext.outputs.value }} -d bootjdk/unpacked
+        fi
+        jdk_root="$(dirname $(find bootjdk/unpacked -name bin -type d))"
+        mv "$jdk_root"/* bootjdk/jdk/
+      shell: bash
+      if: steps.get-cached-bootjdk.outputs.cache-hit != 'true'
+
+    - name: 'Export path to where BootJDK is installed'
+      id: path-name
+      run: |
+        # Export the path
+        echo 'path=bootjdk/jdk' >> $GITHUB_OUTPUT
+      shell: bash
diff --git a/.github/actions/get-bundles/action.yml b/.github/actions/get-bundles/action.yml
new file mode 100644
index 0000000..956e152
--- /dev/null
+++ b/.github/actions/get-bundles/action.yml
@@ -0,0 +1,109 @@
+#
+# Copyright (c) 2022, Oracle and/or its affiliates. All rights reserved.
+# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+#
+# This code is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License version 2 only, as
+# published by the Free Software Foundation.  Oracle designates this
+# particular file as subject to the "Classpath" exception as provided
+# by Oracle in the LICENSE file that accompanied this code.
+#
+# This code is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+# version 2 for more details (a copy is included in the LICENSE file that
+# accompanied this code).
+#
+# You should have received a copy of the GNU General Public License version
+# 2 along with this work; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+# or visit www.oracle.com if you need additional information or have any
+# questions.
+#
+
+name: 'Get bundles'
+description: 'Download resulting JDK bundles'
+inputs:
+  platform:
+    description: 'Platform name'
+    required: true
+  debug-suffix:
+    description: 'File name suffix denoting debug level, possibly empty'
+    required: false
+outputs:
+  jdk-path:
+    description: 'Path to the installed JDK bundle'
+    value: ${{ steps.path-name.outputs.jdk }}
+  symbols-path:
+    description: 'Path to the installed symbols bundle'
+    value: ${{ steps.path-name.outputs.symbols }}
+  tests-path:
+    description: 'Path to the installed tests bundle'
+    value: ${{ steps.path-name.outputs.tests }}
+
+runs:
+  using: composite
+  steps:
+    - name: 'Download bundles artifact'
+      id: download-bundles
+      uses: actions/download-artifact@v3
+      with:
+        name: bundles-${{ inputs.platform }}${{ inputs.debug-suffix }}
+        path: bundles
+      continue-on-error: true
+
+    - name: 'Download bundles artifact (retry)'
+      uses: actions/download-artifact@v3
+      with:
+        name: bundles-${{ inputs.platform }}${{ inputs.debug-suffix }}
+        path: bundles
+      if: steps.download-bundles.outcome == 'failure'
+
+    - name: 'Unpack bundles'
+      run: |
+        if [[ -e bundles/jdk-${{ inputs.platform }}${{ inputs.debug-suffix }}.zip ]]; then
+          echo 'Unpacking jdk bundle...'
+          mkdir -p bundles/jdk
+          unzip -q bundles/jdk-${{ inputs.platform }}${{ inputs.debug-suffix }}.zip -d bundles/jdk
+        fi
+
+        if [[ -e bundles/jdk-${{ inputs.platform }}${{ inputs.debug-suffix }}.tar.gz ]]; then
+          echo 'Unpacking jdk bundle...'
+          mkdir -p bundles/jdk
+          tar -xf bundles/jdk-${{ inputs.platform }}${{ inputs.debug-suffix }}.tar.gz -C bundles/jdk
+        fi
+
+        if [[ -e bundles/symbols-${{ inputs.platform }}${{ inputs.debug-suffix }}.tar.gz ]]; then
+          echo 'Unpacking symbols bundle...'
+          mkdir -p bundles/symbols
+          tar -xf bundles/symbols-${{ inputs.platform }}${{ inputs.debug-suffix }}.tar.gz -C bundles/symbols
+        fi
+
+        if [[ -e bundles/tests-${{ inputs.platform }}${{ inputs.debug-suffix }}.tar.gz ]]; then
+          echo 'Unpacking tests bundle...'
+          mkdir -p bundles/tests
+          tar -xf bundles/tests-${{ inputs.platform }}${{ inputs.debug-suffix }}.tar.gz -C bundles/tests
+        fi
+      shell: bash
+
+    - name: 'Export paths to where bundles are installed'
+      id: path-name
+      run: |
+        # Export the paths
+
+        jdk_dir="$GITHUB_WORKSPACE/$(dirname $(find bundles/jdk -name bin -type d))"
+        symbols_dir="$GITHUB_WORKSPACE/$(dirname $(find bundles/symbols -name bin -type d))"
+        tests_dir="$GITHUB_WORKSPACE/bundles/tests"
+
+        if [[ '${{ runner.os }}' == 'Windows' ]]; then
+          jdk_dir="$(cygpath $jdk_dir)"
+          symbols_dir="$(cygpath $symbols_dir)"
+          tests_dir="$(cygpath $tests_dir)"
+        fi
+
+        echo "jdk=$jdk_dir" >> $GITHUB_OUTPUT
+        echo "symbols=$symbols_dir" >> $GITHUB_OUTPUT
+        echo "tests=$tests_dir" >> $GITHUB_OUTPUT
+      shell: bash
diff --git a/.github/actions/get-gtest/action.yml b/.github/actions/get-gtest/action.yml
new file mode 100644
index 0000000..76faaea
--- /dev/null
+++ b/.github/actions/get-gtest/action.yml
@@ -0,0 +1,54 @@
+#
+# Copyright (c) 2022, Oracle and/or its affiliates. All rights reserved.
+# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+#
+# This code is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License version 2 only, as
+# published by the Free Software Foundation.  Oracle designates this
+# particular file as subject to the "Classpath" exception as provided
+# by Oracle in the LICENSE file that accompanied this code.
+#
+# This code is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+# version 2 for more details (a copy is included in the LICENSE file that
+# accompanied this code).
+#
+# You should have received a copy of the GNU General Public License version
+# 2 along with this work; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+# or visit www.oracle.com if you need additional information or have any
+# questions.
+#
+
+name: 'Get GTest'
+description: 'Download GTest source'
+outputs:
+  path:
+    description: 'Path to the installed GTest'
+    value: ${{ steps.path-name.outputs.path }}
+
+runs:
+  using: composite
+  steps:
+    - name: 'Get GTest version configuration'
+      id: version
+      uses: ./.github/actions/config
+      with:
+        var: GTEST_VERSION
+
+    - name: 'Checkout GTest source'
+      uses: actions/checkout@v3
+      with:
+        repository: google/googletest
+        ref: 'release-${{ steps.version.outputs.value }}'
+        path: gtest
+
+    - name: 'Export path to where GTest is installed'
+      id: path-name
+      run: |
+        # Export the path
+        echo 'path=gtest' >> $GITHUB_OUTPUT
+      shell: bash
diff --git a/.github/actions/get-jtreg/action.yml b/.github/actions/get-jtreg/action.yml
new file mode 100644
index 0000000..7c49b10
--- /dev/null
+++ b/.github/actions/get-jtreg/action.yml
@@ -0,0 +1,72 @@
+#
+# Copyright (c) 2022, Oracle and/or its affiliates. All rights reserved.
+# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+#
+# This code is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License version 2 only, as
+# published by the Free Software Foundation.  Oracle designates this
+# particular file as subject to the "Classpath" exception as provided
+# by Oracle in the LICENSE file that accompanied this code.
+#
+# This code is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+# version 2 for more details (a copy is included in the LICENSE file that
+# accompanied this code).
+#
+# You should have received a copy of the GNU General Public License version
+# 2 along with this work; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+# or visit www.oracle.com if you need additional information or have any
+# questions.
+#
+
+name: 'Get JTReg'
+description: 'Download JTReg from cache or source location'
+outputs:
+  path:
+    description: 'Path to the installed JTReg'
+    value: ${{ steps.path-name.outputs.path }}
+
+runs:
+  using: composite
+  steps:
+    - name: 'Get JTReg version configuration'
+      id: version
+      uses: ./.github/actions/config
+      with:
+        var: JTREG_VERSION
+
+    - name: 'Check cache for JTReg'
+      id: get-cached-jtreg
+      uses: actions/cache@v3
+      with:
+        path: jtreg/installed
+        key: jtreg-${{ steps.version.outputs.value }}
+
+    - name: 'Checkout the JTReg source'
+      uses: actions/checkout@v3
+      with:
+        repository: openjdk/jtreg
+        ref: jtreg-${{ steps.version.outputs.value }}
+        path: jtreg/src
+      if: steps.get-cached-jtreg.outputs.cache-hit != 'true'
+
+    - name: 'Build JTReg'
+      run: |
+        # Build JTReg and move files to the proper locations
+        bash make/build.sh --jdk "$JAVA_HOME_11_X64"
+        mkdir ../installed
+        mv build/images/jtreg/* ../installed
+      working-directory: jtreg/src
+      shell: bash
+      if: steps.get-cached-jtreg.outputs.cache-hit != 'true'
+
+    - name: 'Export path to where JTReg is installed'
+      id: path-name
+      run: |
+        # Export the path
+        echo 'path=jtreg/installed' >> $GITHUB_OUTPUT
+      shell: bash
diff --git a/.github/actions/get-msys2/action.yml b/.github/actions/get-msys2/action.yml
new file mode 100644
index 0000000..3e6c341
--- /dev/null
+++ b/.github/actions/get-msys2/action.yml
@@ -0,0 +1,44 @@
+#
+# Copyright (c) 2022, Oracle and/or its affiliates. All rights reserved.
+# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+#
+# This code is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License version 2 only, as
+# published by the Free Software Foundation.  Oracle designates this
+# particular file as subject to the "Classpath" exception as provided
+# by Oracle in the LICENSE file that accompanied this code.
+#
+# This code is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+# version 2 for more details (a copy is included in the LICENSE file that
+# accompanied this code).
+#
+# You should have received a copy of the GNU General Public License version
+# 2 along with this work; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+# or visit www.oracle.com if you need additional information or have any
+# questions.
+#
+
+name: 'Get MSYS2'
+description: 'Download MSYS2 and prepare a Windows host'
+
+runs:
+  using: composite
+  steps:
+    - name: 'Install MSYS2'
+      uses: msys2/setup-msys2@v2
+      with:
+        install: 'autoconf tar unzip zip make'
+        path-type: minimal
+        location: msys2
+
+      # We can't run bash until this is completed, so stick with pwsh
+    - name: 'Set MSYS2 path'
+      run: |
+        # Prepend msys2/msys64/usr/bin to the PATH
+        echo "$env:GITHUB_WORKSPACE/msys2/msys64/usr/bin" >> $env:GITHUB_PATH
+      shell: pwsh
diff --git a/.github/actions/upload-bundles/action.yml b/.github/actions/upload-bundles/action.yml
new file mode 100644
index 0000000..88f7f6e
--- /dev/null
+++ b/.github/actions/upload-bundles/action.yml
@@ -0,0 +1,77 @@
+#
+# Copyright (c) 2022, Oracle and/or its affiliates. All rights reserved.
+# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+#
+# This code is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License version 2 only, as
+# published by the Free Software Foundation.  Oracle designates this
+# particular file as subject to the "Classpath" exception as provided
+# by Oracle in the LICENSE file that accompanied this code.
+#
+# This code is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+# version 2 for more details (a copy is included in the LICENSE file that
+# accompanied this code).
+#
+# You should have received a copy of the GNU General Public License version
+# 2 along with this work; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+# or visit www.oracle.com if you need additional information or have any
+# questions.
+#
+
+name: 'Upload bundles'
+description: 'Upload resulting JDK bundles'
+inputs:
+  platform:
+    description: 'Platform name'
+    required: true
+  debug-suffix:
+    description: 'File name suffix denoting debug level, possibly empty'
+    required: false
+
+runs:
+  using: composite
+  steps:
+
+    - name: 'Determine bundle names'
+      id: bundles
+      run: |
+        # Rename bundles to consistent names
+        jdk_bundle_zip="$(ls build/*/bundles/jdk-*_bin${{ inputs.debug-suffix }}.zip 2> /dev/null || true)"
+        jdk_bundle_tar_gz="$(ls build/*/bundles/jdk-*_bin${{ inputs.debug-suffix }}.tar.gz 2> /dev/null || true)"
+        symbols_bundle="$(ls build/*/bundles/jdk-*_bin${{ inputs.debug-suffix }}-symbols.tar.gz 2> /dev/null || true)"
+        tests_bundle="$(ls build/*/bundles/jdk-*_bin-tests${{ inputs.debug-suffix }}.tar.gz 2> /dev/null || true)"
+
+        mkdir bundles
+
+        if [[ "$jdk_bundle_zip" != "" ]]; then
+          mv "$jdk_bundle_zip" "bundles/jdk-${{ inputs.platform }}${{ inputs.debug-suffix }}.zip"
+        fi
+        if [[ "$jdk_bundle_tar_gz" != "" ]]; then
+          mv "$jdk_bundle_tar_gz" "bundles/jdk-${{ inputs.platform }}${{ inputs.debug-suffix }}.tar.gz"
+        fi
+        if [[ "$symbols_bundle" != "" ]]; then
+          mv "$symbols_bundle" "bundles/symbols-${{ inputs.platform }}${{ inputs.debug-suffix }}.tar.gz"
+        fi
+        if [[ "$tests_bundle" != "" ]]; then
+          mv "$tests_bundle" "bundles/tests-${{ inputs.platform }}${{ inputs.debug-suffix }}.tar.gz"
+        fi
+
+        if [[ "$jdk_bundle_zip$jdk_bundle_tar_gz$symbols_bundle$tests_bundle" != "" ]]; then
+          echo 'bundles-found=true' >> $GITHUB_OUTPUT
+        else
+          echo 'bundles-found=false' >> $GITHUB_OUTPUT
+        fi
+      shell: bash
+
+    - name: 'Upload bundles artifact'
+      uses: actions/upload-artifact@v3
+      with:
+        name: bundles-${{ inputs.platform }}${{ inputs.debug-suffix }}
+        path: bundles
+        retention-days: 1
+      if: steps.bundles.outputs.bundles-found == 'true'
diff --git a/.github/scripts/gen-build-failure-report.sh b/.github/scripts/gen-build-failure-report.sh
new file mode 100644
index 0000000..fd3215f
--- /dev/null
+++ b/.github/scripts/gen-build-failure-report.sh
@@ -0,0 +1,51 @@
+#!/bin/bash
+#
+# Copyright (c) 2022, Oracle and/or its affiliates. All rights reserved.
+# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+#
+# This code is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License version 2 only, as
+# published by the Free Software Foundation.  Oracle designates this
+# particular file as subject to the "Classpath" exception as provided
+# by Oracle in the LICENSE file that accompanied this code.
+#
+# This code is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+# version 2 for more details (a copy is included in the LICENSE file that
+# accompanied this code).
+#
+# You should have received a copy of the GNU General Public License version
+# 2 along with this work; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+# or visit www.oracle.com if you need additional information or have any
+# questions.
+#
+
+GITHUB_STEP_SUMMARY="$1"
+BUILD_DIR="$(ls -d build/*)"
+
+# Send signal to the do-build action that we failed
+touch "$BUILD_DIR/build-failure"
+
+(
+  echo '### :boom: Build failure summary'
+  echo ''
+  echo 'The build failed. Here follows the failure summary from the build.'
+  echo '<details><summary><b>View build failure summary</b></summary>'
+  echo ''
+  echo '```'
+  if [[ -f "$BUILD_DIR/make-support/failure-summary.log" ]]; then
+    cat "$BUILD_DIR/make-support/failure-summary.log"
+  else
+    echo "Failure summary ($BUILD_DIR/make-support/failure-summary.log) not found"
+  fi
+  echo '```'
+  echo '</details>'
+  echo ''
+
+  echo ''
+  echo ':arrow_right: To see the entire test log, click the job in the list to the left. To download logs, see the `failure-logs` [artifact above](#artifacts).'
+) >> $GITHUB_STEP_SUMMARY
diff --git a/.github/scripts/gen-test-results.sh b/.github/scripts/gen-test-results.sh
new file mode 100644
index 0000000..73edb8b
--- /dev/null
+++ b/.github/scripts/gen-test-results.sh
@@ -0,0 +1,92 @@
+#!/bin/bash
+#
+# Copyright (c) 2022, Oracle and/or its affiliates. All rights reserved.
+# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+#
+# This code is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License version 2 only, as
+# published by the Free Software Foundation.  Oracle designates this
+# particular file as subject to the "Classpath" exception as provided
+# by Oracle in the LICENSE file that accompanied this code.
+#
+# This code is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+# version 2 for more details (a copy is included in the LICENSE file that
+# accompanied this code).
+#
+# You should have received a copy of the GNU General Public License version
+# 2 along with this work; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+# or visit www.oracle.com if you need additional information or have any
+# questions.
+#
+
+GITHUB_STEP_SUMMARY="$1"
+
+test_suite_name=$(cat build/run-test-prebuilt/test-support/test-last-ids.txt)
+results_dir=build/run-test-prebuilt/test-results/$test_suite_name/text
+report_dir=build/run-test-prebuilt/test-support/$test_suite_name
+
+failures=$(sed -E -e 's/(.*)\.(java|sh)/\1/' -e '/^#/d' $results_dir/newfailures.txt 2> /dev/null || true)
+errors=$(sed -E -e 's/(.*)\.(java|sh)/\1/' -e '/^#/d' $results_dir/other_errors.txt 2> /dev/null || true)
+
+if [[ "$failures" = "" && "$errors" = "" ]]; then
+  # If we have nothing to report, exit this step now
+  exit 0
+fi
+
+echo "### Test output for failed tests" >> $GITHUB_STEP_SUMMARY
+for test in $failures $errors; do
+  anchor="$(echo "$test" | tr [A-Z/] [a-z_])"
+  base_path="$(echo "$test" | tr '#' '_')"
+  report_file="$report_dir/$base_path.jtr"
+  hs_err_files=$(ls $report_dir/$base_path/hs_err*.log 2> /dev/null || true)
+  echo "####  <a id="$anchor">$test"
+
+  echo '<details><summary>View test results</summary>'
+  echo ''
+  echo '```'
+  if [[ -f "$report_file" ]]; then
+    cat "$report_file"
+  else
+    echo "Error: Result file $report_file not found"
+  fi
+  echo '```'
+  echo '</details>'
+  echo ''
+
+  if [[ "$hs_err_files" != "" ]]; then
+    echo '<details><summary>View HotSpot error log</summary>'
+    echo ''
+    for hs_err in $hs_err_files; do
+      echo '```'
+      echo "$hs_err:"
+      echo ''
+      cat "$hs_err"
+      echo '```'
+    done
+
+    echo '</details>'
+    echo ''
+  fi
+
+done >> $GITHUB_STEP_SUMMARY
+
+# With many failures, the summary can easily exceed 1024 kB, the limit set by Github
+# Trim it down if so.
+summary_size=$(wc -c < $GITHUB_STEP_SUMMARY)
+if [[ $summary_size -gt 1000000 ]]; then
+  # Trim to below 1024 kB, and cut off after the last detail group
+  head -c 1000000 $GITHUB_STEP_SUMMARY | tac | sed -n -e '/<\/details>/,$ p' | tac > $GITHUB_STEP_SUMMARY.tmp
+  mv $GITHUB_STEP_SUMMARY.tmp $GITHUB_STEP_SUMMARY
+  (
+    echo ''
+    echo ':x: **WARNING: Summary is too large and has been truncated.**'
+    echo ''
+  )  >> $GITHUB_STEP_SUMMARY
+fi
+
+echo ':arrow_right: To see the entire test log, click the job in the list to the left.'  >> $GITHUB_STEP_SUMMARY
diff --git a/.github/scripts/gen-test-summary.sh b/.github/scripts/gen-test-summary.sh
new file mode 100644
index 0000000..d016cb3
--- /dev/null
+++ b/.github/scripts/gen-test-summary.sh
@@ -0,0 +1,70 @@
+#!/bin/bash
+#
+# Copyright (c) 2022, Oracle and/or its affiliates. All rights reserved.
+# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+#
+# This code is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License version 2 only, as
+# published by the Free Software Foundation.  Oracle designates this
+# particular file as subject to the "Classpath" exception as provided
+# by Oracle in the LICENSE file that accompanied this code.
+#
+# This code is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+# version 2 for more details (a copy is included in the LICENSE file that
+# accompanied this code).
+#
+# You should have received a copy of the GNU General Public License version
+# 2 along with this work; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+# or visit www.oracle.com if you need additional information or have any
+# questions.
+#
+
+GITHUB_STEP_SUMMARY="$1"
+GITHUB_OUTPUT="$2"
+
+test_suite_name=$(cat build/run-test-prebuilt/test-support/test-last-ids.txt)
+results_dir=build/run-test-prebuilt/test-results/$test_suite_name/text
+
+if [[ ! -f build/run-test-prebuilt/make-support/exit-with-error ]]; then
+  # There were no failures, exit now
+  exit
+fi
+
+failures=$(sed -E -e 's/(.*)\.(java|sh)/\1/' -e '/^#/d' $results_dir/newfailures.txt 2> /dev/null || true)
+errors=$(sed -E -e 's/(.*)\.(java|sh)/\1/' -e '/^#/d' $results_dir/other_errors.txt 2> /dev/null || true)
+failure_count=$(echo $failures | wc -w || true)
+error_count=$(echo $errors | wc -w || true)
+
+if [[ "$failures" = "" && "$errors" = "" ]]; then
+  # We know something went wrong, but not what
+  echo 'error-message=Unspecified test suite failure. Please see log for job for details.' >> $GITHUB_OUTPUT
+  exit 0
+fi
+
+echo 'failure=true' >> $GITHUB_OUTPUT
+echo "error-message=Test run reported $failure_count test failure(s) and $error_count error(s). See summary for details." >> $GITHUB_OUTPUT
+
+echo '### :boom: Test failures summary' >> $GITHUB_STEP_SUMMARY
+
+if [[ "$failures" != "" ]]; then
+  echo '' >> $GITHUB_STEP_SUMMARY
+  echo 'These tests reported failure:' >> $GITHUB_STEP_SUMMARY
+  for test in $failures; do
+    anchor="$(echo "$test" | tr [A-Z/] [a-z_])"
+    echo "* [$test](#user-content-$anchor)"
+  done >> $GITHUB_STEP_SUMMARY
+fi
+
+if [[ "$errors" != "" ]]; then
+  echo '' >> $GITHUB_STEP_SUMMARY
+  echo 'These tests reported errors:'  >> $GITHUB_STEP_SUMMARY
+  for test in $errors; do
+    anchor="$(echo "$test" | tr [A-Z/] [a-z_])"
+    echo "* [$test](#user-content-$anchor)"
+  done >> $GITHUB_STEP_SUMMARY
+fi
diff --git a/.github/workflows/build-cross-compile.yml b/.github/workflows/build-cross-compile.yml
new file mode 100644
index 0000000..168c592
--- /dev/null
+++ b/.github/workflows/build-cross-compile.yml
@@ -0,0 +1,154 @@
+#
+# Copyright (c) 2022, Oracle and/or its affiliates. All rights reserved.
+# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+#
+# This code is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License version 2 only, as
+# published by the Free Software Foundation.  Oracle designates this
+# particular file as subject to the "Classpath" exception as provided
+# by Oracle in the LICENSE file that accompanied this code.
+#
+# This code is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+# version 2 for more details (a copy is included in the LICENSE file that
+# accompanied this code).
+#
+# You should have received a copy of the GNU General Public License version
+# 2 along with this work; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+# or visit www.oracle.com if you need additional information or have any
+# questions.
+#
+
+name: 'Build (cross-compile)'
+
+on:
+  workflow_call:
+    inputs:
+      gcc-major-version:
+        required: false
+        type: string
+        default: '10'
+      apt-gcc-version:
+        required: false
+        type: string
+        default: '10.3.0-1ubuntu1~20.04'
+      apt-gcc-cross-suffix:
+        required: false
+        type: string
+        default: 'cross1'
+
+jobs:
+  build-cross-compile:
+    name: build
+    runs-on: ubuntu-20.04
+
+    strategy:
+      fail-fast: false
+      matrix:
+        target-cpu:
+          - aarch64
+          - arm
+          - s390x
+          - ppc64le
+        include:
+          - target-cpu: aarch64
+            debian-arch: arm64
+            gnu-arch: aarch64
+          - target-cpu: arm
+            debian-arch: armhf
+            gnu-arch: arm
+            gnu-abi: eabihf
+          - target-cpu: s390x
+            debian-arch: s390x
+            gnu-arch: s390x
+          - target-cpu: ppc64le
+            debian-arch: ppc64el
+            gnu-arch: powerpc64le
+
+    steps:
+      - name: 'Checkout the JDK source'
+        uses: actions/checkout@v3
+
+      - name: 'Get the BootJDK'
+        id: bootjdk
+        uses: ./.github/actions/get-bootjdk
+        with:
+          platform: linux-x64
+
+        # Use linux-x64 JDK bundle as build JDK
+      - name: 'Get build JDK'
+        id: buildjdk
+        uses: ./.github/actions/get-bundles
+        with:
+          platform: linux-x64
+
+        # Upgrading apt to solve libc6 installation bugs, see JDK-8260460.
+      - name: 'Install toolchain and dependencies'
+        run: |
+          # Install dependencies using apt-get
+          sudo apt-get update
+          sudo apt-get install --only-upgrade apt
+          sudo apt-get install \
+              gcc-${{ inputs.gcc-major-version }}=${{ inputs.apt-gcc-version }} \
+              g++-${{ inputs.gcc-major-version }}=${{ inputs.apt-gcc-version }} \
+              gcc-${{ inputs.gcc-major-version }}-${{ matrix.gnu-arch }}-linux-gnu${{ matrix.gnu-abi}}=${{ inputs.apt-gcc-version }}${{ inputs.apt-gcc-cross-suffix }} \
+              g++-${{ inputs.gcc-major-version }}-${{ matrix.gnu-arch }}-linux-gnu${{ matrix.gnu-abi}}=${{ inputs.apt-gcc-version }}${{ inputs.apt-gcc-cross-suffix }} \
+              libxrandr-dev libxtst-dev libcups2-dev libasound2-dev
+          sudo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-${{ inputs.gcc-major-version }} 100 --slave /usr/bin/g++ g++ /usr/bin/g++-${{ inputs.gcc-major-version }}
+
+      - name: 'Check cache for sysroot'
+        id: get-cached-sysroot
+        uses: actions/cache@v3
+        with:
+          path: sysroot
+          key: sysroot-${{ matrix.debian-arch }}-${{ hashFiles('./.github/workflows/build-cross-compile.yml') }}
+
+      - name: 'Install sysroot dependencies'
+        run: sudo apt-get install debootstrap qemu-user-static
+        if: steps.get-cached-sysroot.outputs.cache-hit != 'true'
+
+      - name: 'Create sysroot'
+        run: >
+          sudo qemu-debootstrap
+          --arch=${{ matrix.debian-arch }}
+          --verbose
+          --include=fakeroot,symlinks,build-essential,libx11-dev,libxext-dev,libxrender-dev,libxrandr-dev,libxtst-dev,libxt-dev,libcups2-dev,libfontconfig1-dev,libasound2-dev,libfreetype6-dev,libpng-dev
+          --resolve-deps
+          buster
+          sysroot
+          https://httpredir.debian.org/debian/
+        if: steps.get-cached-sysroot.outputs.cache-hit != 'true'
+
+      - name: 'Prepare sysroot'
+        run: |
+          # Prepare sysroot and remove unused files to minimize cache
+          sudo chroot sysroot symlinks -cr .
+          sudo chown ${USER} -R sysroot
+          rm -rf sysroot/{dev,proc,run,sys}
+        if: steps.get-cached-sysroot.outputs.cache-hit != 'true'
+
+      - name: 'Configure'
+        run: >
+          bash configure
+          --with-conf-name=linux-${{ matrix.target-cpu }}
+          --with-version-opt=${GITHUB_ACTOR}-${GITHUB_SHA}
+          --with-boot-jdk=${{ steps.bootjdk.outputs.path }}
+          --with-zlib=system
+          --enable-debug
+          --disable-precompiled-headers
+          --openjdk-target=${{ matrix.gnu-arch }}-linux-gnu${{ matrix.gnu-abi}}
+          --with-sysroot=sysroot
+          --with-build-jdk=${{ steps.buildjdk.outputs.jdk-path }}
+          CC=${{ matrix.gnu-arch }}-linux-gnu${{ matrix.gnu-abi}}-gcc-10
+          CXX=${{ matrix.gnu-arch }}-linux-gnu${{ matrix.gnu-abi}}-g++-10
+
+      - name: 'Build'
+        id: build
+        uses: ./.github/actions/do-build
+        with:
+          make-target: 'hotspot'
+          platform: linux-${{ matrix.target-cpu }}
diff --git a/.github/workflows/build-linux.yml b/.github/workflows/build-linux.yml
new file mode 100644
index 0000000..5b1a6e8
--- /dev/null
+++ b/.github/workflows/build-linux.yml
@@ -0,0 +1,132 @@
+#
+# Copyright (c) 2022, Oracle and/or its affiliates. All rights reserved.
+# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+#
+# This code is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License version 2 only, as
+# published by the Free Software Foundation.  Oracle designates this
+# particular file as subject to the "Classpath" exception as provided
+# by Oracle in the LICENSE file that accompanied this code.
+#
+# This code is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+# version 2 for more details (a copy is included in the LICENSE file that
+# accompanied this code).
+#
+# You should have received a copy of the GNU General Public License version
+# 2 along with this work; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+# or visit www.oracle.com if you need additional information or have any
+# questions.
+#
+
+name: 'Build (linux)'
+
+on:
+  workflow_call:
+    inputs:
+      platform:
+        required: true
+        type: string
+      extra-conf-options:
+        required: false
+        type: string
+      make-target:
+        required: false
+        type: string
+        default: 'product-bundles test-bundles'
+      debug-levels:
+        required: false
+        type: string
+        default: '[ "debug", "release" ]'
+      apt-gcc-version:
+        required: true
+        type: string
+      apt-architecture:
+        required: false
+        type: string
+      apt-extra-packages:
+        required: false
+        type: string
+
+jobs:
+  build-linux:
+    name: build
+    runs-on: ubuntu-20.04
+
+    strategy:
+      fail-fast: false
+      matrix:
+        debug-level: ${{ fromJSON(inputs.debug-levels) }}
+        include:
+          - debug-level: debug
+            flags: --with-debug-level=fastdebug
+            suffix: -debug
+
+    steps:
+      - name: 'Checkout the JDK source'
+        uses: actions/checkout@v3
+
+      - name: 'Get the BootJDK'
+        id: bootjdk
+        uses: ./.github/actions/get-bootjdk
+        with:
+          platform: linux-x64
+
+      - name: 'Get JTReg'
+        id: jtreg
+        uses: ./.github/actions/get-jtreg
+
+      - name: 'Get GTest'
+        id: gtest
+        uses: ./.github/actions/get-gtest
+
+      - name: 'Set architecture'
+        id: arch
+        run: |
+          # Set a proper suffix for packages if using a different architecture
+          if [[ '${{ inputs.apt-architecture }}' != '' ]]; then
+            echo 'suffix=:${{ inputs.apt-architecture }}' >> $GITHUB_OUTPUT
+          fi
+
+      # Upgrading apt to solve libc6 installation bugs, see JDK-8260460.
+      - name: 'Install toolchain and dependencies'
+        run: |
+          # Install dependencies using apt-get
+          if [[ '${{ inputs.apt-architecture }}' != '' ]]; then
+            sudo dpkg --add-architecture ${{ inputs.apt-architecture }}
+          fi
+          sudo apt-get update
+          sudo apt-get install --only-upgrade apt
+          sudo apt-get install gcc-${{ inputs.apt-gcc-version }} g++-${{ inputs.apt-gcc-version }} libxrandr-dev${{ steps.arch.outputs.suffix }} libxtst-dev${{ steps.arch.outputs.suffix }} libcups2-dev${{ steps.arch.outputs.suffix }} libasound2-dev${{ steps.arch.outputs.suffix }} ${{ inputs.apt-extra-packages }}
+          sudo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-10 100 --slave /usr/bin/g++ g++ /usr/bin/g++-10
+
+      - name: 'Configure'
+        run: >
+          bash configure
+          --with-conf-name=${{ inputs.platform }}
+          ${{ matrix.flags }}
+          --with-version-opt=${GITHUB_ACTOR}-${GITHUB_SHA}
+          --with-boot-jdk=${{ steps.bootjdk.outputs.path }}
+          --with-jtreg=${{ steps.jtreg.outputs.path }}
+          --with-gtest=${{ steps.gtest.outputs.path }}
+          --enable-jtreg-failure-handler
+          --with-zlib=system
+          ${{ inputs.extra-conf-options }}
+
+      - name: 'Build'
+        id: build
+        uses: ./.github/actions/do-build
+        with:
+          make-target: '${{ inputs.make-target }}'
+          platform: ${{ inputs.platform }}
+          debug-suffix: '${{ matrix.suffix }}'
+
+      - name: 'Upload bundles'
+        uses: ./.github/actions/upload-bundles
+        with:
+          platform: ${{ inputs.platform }}
+          debug-suffix: '${{ matrix.suffix }}'
diff --git a/.github/workflows/build-macos.yml b/.github/workflows/build-macos.yml
new file mode 100644
index 0000000..a19dcc3
--- /dev/null
+++ b/.github/workflows/build-macos.yml
@@ -0,0 +1,114 @@
+#
+# Copyright (c) 2022, Oracle and/or its affiliates. All rights reserved.
+# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+#
+# This code is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License version 2 only, as
+# published by the Free Software Foundation.  Oracle designates this
+# particular file as subject to the "Classpath" exception as provided
+# by Oracle in the LICENSE file that accompanied this code.
+#
+# This code is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+# version 2 for more details (a copy is included in the LICENSE file that
+# accompanied this code).
+#
+# You should have received a copy of the GNU General Public License version
+# 2 along with this work; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+# or visit www.oracle.com if you need additional information or have any
+# questions.
+#
+
+name: 'Build (macos)'
+
+on:
+  workflow_call:
+    inputs:
+      platform:
+        required: true
+        type: string
+      extra-conf-options:
+        required: false
+        type: string
+      make-target:
+        required: false
+        type: string
+        default: 'product-bundles test-bundles'
+      debug-levels:
+        required: false
+        type: string
+        default: '[ "debug", "release" ]'
+      xcode-toolset-version:
+        required: true
+        type: string
+
+jobs:
+  build-macos:
+    name: build
+    runs-on: macos-11
+
+    strategy:
+      fail-fast: false
+      matrix:
+        debug-level: ${{ fromJSON(inputs.debug-levels) }}
+        include:
+          - debug-level: debug
+            flags: --with-debug-level=fastdebug
+            suffix: -debug
+
+    steps:
+      - name: 'Checkout the JDK source'
+        uses: actions/checkout@v3
+
+      - name: 'Get the BootJDK'
+        id: bootjdk
+        uses: ./.github/actions/get-bootjdk
+        with:
+          platform: macos-x64
+
+      - name: 'Get JTReg'
+        id: jtreg
+        uses: ./.github/actions/get-jtreg
+
+      - name: 'Get GTest'
+        id: gtest
+        uses: ./.github/actions/get-gtest
+
+      - name: 'Install toolchain and dependencies'
+        run: |
+          # Run Homebrew installation and xcode-select
+          brew install make
+          sudo xcode-select --switch /Applications/Xcode_${{ inputs.xcode-toolset-version }}.app/Contents/Developer
+          # This will make GNU make available as 'make' and not only as 'gmake'
+          echo '/usr/local/opt/make/libexec/gnubin' >> $GITHUB_PATH
+
+      - name: 'Configure'
+        run: >
+          bash configure
+          --with-conf-name=${{ inputs.platform }}
+          ${{ matrix.flags }}
+          --with-version-opt=${GITHUB_ACTOR}-${GITHUB_SHA}
+          --with-boot-jdk=${{ steps.bootjdk.outputs.path }}
+          --with-jtreg=${{ steps.jtreg.outputs.path }}
+          --with-gtest=${{ steps.gtest.outputs.path }}
+          --enable-jtreg-failure-handler
+          --with-zlib=system
+          ${{ inputs.extra-conf-options }}
+
+      - name: 'Build'
+        id: build
+        uses: ./.github/actions/do-build
+        with:
+          make-target: '${{ inputs.make-target }}'
+          platform: ${{ inputs.platform }}
+          debug-suffix: '${{ matrix.suffix }}'
+
+      - name: 'Upload bundles'
+        uses: ./.github/actions/upload-bundles
+        with:
+          platform: ${{ inputs.platform }}
+          debug-suffix: '${{ matrix.suffix }}'
diff --git a/.github/workflows/build-windows.yml b/.github/workflows/build-windows.yml
new file mode 100644
index 0000000..86fdba8
--- /dev/null
+++ b/.github/workflows/build-windows.yml
@@ -0,0 +1,131 @@
+#
+# Copyright (c) 2022, Oracle and/or its affiliates. All rights reserved.
+# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+#
+# This code is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License version 2 only, as
+# published by the Free Software Foundation.  Oracle designates this
+# particular file as subject to the "Classpath" exception as provided
+# by Oracle in the LICENSE file that accompanied this code.
+#
+# This code is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+# version 2 for more details (a copy is included in the LICENSE file that
+# accompanied this code).
+#
+# You should have received a copy of the GNU General Public License version
+# 2 along with this work; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+# or visit www.oracle.com if you need additional information or have any
+# questions.
+#
+
+name: 'Build (windows)'
+
+on:
+  workflow_call:
+    inputs:
+      platform:
+        required: true
+        type: string
+      extra-conf-options:
+        required: false
+        type: string
+      make-target:
+        required: false
+        type: string
+        default: 'product-bundles test-bundles'
+      debug-levels:
+        required: false
+        type: string
+        default: '[ "debug", "release" ]'
+      msvc-toolset-version:
+        required: true
+        type: string
+      msvc-toolset-architecture:
+        required: true
+        type: string
+
+env:
+  # These are needed to make the MSYS2 bash work properly
+  MSYS2_PATH_TYPE: minimal
+  CHERE_INVOKING: 1
+
+jobs:
+  build-windows:
+    name: build
+    runs-on: windows-2019
+    defaults:
+      run:
+        shell: bash
+
+    strategy:
+      fail-fast: false
+      matrix:
+        debug-level: ${{ fromJSON(inputs.debug-levels) }}
+        include:
+          - debug-level: debug
+            flags: --with-debug-level=fastdebug
+            suffix: -debug
+
+    steps:
+      - name: 'Checkout the JDK source'
+        uses: actions/checkout@v3
+
+      - name: 'Get MSYS2'
+        uses: ./.github/actions/get-msys2
+
+      - name: 'Get the BootJDK'
+        id: bootjdk
+        uses: ./.github/actions/get-bootjdk
+        with:
+          platform: windows-x64
+
+      - name: 'Get JTReg'
+        id: jtreg
+        uses: ./.github/actions/get-jtreg
+
+      - name: 'Get GTest'
+        id: gtest
+        uses: ./.github/actions/get-gtest
+
+      - name: 'Install toolchain and dependencies'
+        run: |
+          # Run Visual Studio Installer
+          '/c/Program Files (x86)/Microsoft Visual Studio/Installer/vs_installer.exe' \
+            modify --quiet --installPath 'C:/Program Files (x86)/Microsoft Visual Studio/2019/Enterprise' \
+            --add Microsoft.VisualStudio.Component.VC.${{ inputs.msvc-toolset-version }}.${{ inputs.msvc-toolset-architecture }}
+
+      - name: 'Configure'
+        run: >
+          bash configure
+          --with-conf-name=${{ inputs.platform }}
+          ${{ matrix.flags }}
+          --with-version-opt=${GITHUB_ACTOR}-${GITHUB_SHA}
+          --with-boot-jdk=${{ steps.bootjdk.outputs.path }}
+          --with-jtreg=${{ steps.jtreg.outputs.path }}
+          --with-gtest=${{ steps.gtest.outputs.path }}
+          --enable-jtreg-failure-handler
+          --with-msvc-toolset-version=${{ inputs.msvc-toolset-version }}
+          ${{ inputs.extra-conf-options }}
+        env:
+          # We need a minimal PATH on Windows
+          # Set PATH to "", so just GITHUB_PATH is included
+          PATH: ''
+
+      - name: 'Build'
+        id: build
+        uses: ./.github/actions/do-build
+        with:
+          make-target: '${{ inputs.make-target }}'
+          platform: ${{ inputs.platform }}
+          debug-suffix: '${{ matrix.suffix }}'
+
+      - name: 'Upload bundles'
+        uses: ./.github/actions/upload-bundles
+        with:
+          platform: ${{ inputs.platform }}
+          debug-suffix: '${{ matrix.suffix }}'
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
new file mode 100644
index 0000000..88b68ea
--- /dev/null
+++ b/.github/workflows/main.yml
@@ -0,0 +1,331 @@
+#
+# Copyright (c) 2022, Oracle and/or its affiliates. All rights reserved.
+# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+#
+# This code is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License version 2 only, as
+# published by the Free Software Foundation.  Oracle designates this
+# particular file as subject to the "Classpath" exception as provided
+# by Oracle in the LICENSE file that accompanied this code.
+#
+# This code is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+# version 2 for more details (a copy is included in the LICENSE file that
+# accompanied this code).
+#
+# You should have received a copy of the GNU General Public License version
+# 2 along with this work; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+# or visit www.oracle.com if you need additional information or have any
+# questions.
+#
+
+name: 'OpenJDK GHA Sanity Checks'
+
+on:
+  push:
+    branches-ignore:
+      - master
+      - pr/*
+  workflow_dispatch:
+    inputs:
+      platforms:
+        description: 'Platform(s) to execute on (comma separated, e.g. "linux-x64, macos, aarch64")'
+        required: true
+        default: 'linux-x64, linux-x86, linux-x64-variants, linux-cross-compile, macos-x64, macos-aarch64, windows-x64, windows-aarch64'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+
+  ###
+  ### Determine platforms to include
+  ###
+
+  select:
+    name: 'Select platforms'
+    runs-on: ubuntu-20.04
+    outputs:
+      linux-x64: ${{ steps.include.outputs.linux-x64 }}
+      linux-x86: ${{ steps.include.outputs.linux-x86 }}
+      linux-x64-variants: ${{ steps.include.outputs.linux-x64-variants }}
+      linux-cross-compile: ${{ steps.include.outputs.linux-cross-compile }}
+      macos-x64: ${{ steps.include.outputs.macos-x64 }}
+      macos-aarch64: ${{ steps.include.outputs.macos-aarch64 }}
+      windows-x64: ${{ steps.include.outputs.windows-x64 }}
+      windows-aarch64: ${{ steps.include.outputs.windows-aarch64 }}
+
+    steps:
+        # This function must be inlined in main.yml, or we'd be forced to checkout the repo
+      - name: 'Check what jobs to run'
+        id: include
+        run: |
+          # Determine which platform jobs to run
+
+          # Returns 'true' if the input platform list matches any of the platform monikers given as argument,
+          # 'false' otherwise.
+          # arg $1: platform name or names to look for
+          function check_platform() {
+            if [[ '${{ !secrets.JDK_SUBMIT_FILTER || startsWith(github.ref, 'refs/heads/submit/') }}' == 'false' ]]; then
+              # If JDK_SUBMIT_FILTER is set, and this is not a "submit/" branch, don't run anything
+              echo 'false'
+              return
+            fi
+
+            if [[ $GITHUB_EVENT_NAME == workflow_dispatch ]]; then
+              input='${{ github.event.inputs.platforms }}'
+            elif [[ $GITHUB_EVENT_NAME == push ]]; then
+              input='${{ secrets.JDK_SUBMIT_PLATFORMS }}'
+            else
+              echo 'Internal error in GHA'
+              exit 1
+            fi
+
+            normalized_input="$(echo ,$input, | tr -d ' ')"
+            if [[ "$normalized_input" == ",," ]]; then
+              # For an empty input, assume all platforms should run
+              echo 'true'
+              return
+            else
+              # Check for all acceptable platform names
+              for part in $* ; do
+                if echo "$normalized_input" | grep -q -e ",$part," ; then
+                  echo 'true'
+                  return
+                fi
+              done
+            fi
+
+            echo 'false'
+          }
+
+          echo "linux-x64=$(check_platform linux-x64 linux x64)" >> $GITHUB_OUTPUT
+          echo "linux-x86=$(check_platform linux-x86 linux x86)" >> $GITHUB_OUTPUT
+          echo "linux-x64-variants=$(check_platform linux-x64-variants variants)" >> $GITHUB_OUTPUT
+          echo "linux-cross-compile=$(check_platform linux-cross-compile cross-compile)" >> $GITHUB_OUTPUT
+          echo "macos-x64=$(check_platform macos-x64 macos x64)" >> $GITHUB_OUTPUT
+          echo "macos-aarch64=$(check_platform macos-aarch64 macos aarch64)" >> $GITHUB_OUTPUT
+          echo "windows-x64=$(check_platform windows-x64 windows x64)" >> $GITHUB_OUTPUT
+          echo "windows-aarch64=$(check_platform windows-aarch64 windows aarch64)" >> $GITHUB_OUTPUT
+
+  ###
+  ### Build jobs
+  ###
+
+  build-linux-x64:
+    name: linux-x64
+    needs: select
+    uses: ./.github/workflows/build-linux.yml
+    with:
+      platform: linux-x64
+      apt-gcc-version: '10=10.3.0-1ubuntu1~20.04'
+    # The linux-x64 jdk bundle is used as buildjdk for the cross-compile job
+    if: needs.select.outputs.linux-x64 == 'true' || needs.select.outputs.linux-cross-compile == 'true'
+
+  build-linux-x86:
+    name: linux-x86
+    needs: select
+    uses: ./.github/workflows/build-linux.yml
+    with:
+      platform: linux-x86
+      apt-gcc-version: '10-multilib'
+      apt-architecture: 'i386'
+      # Some multilib libraries do not have proper inter-dependencies, so we have to
+      # install their dependencies manually.
+      apt-extra-packages: 'libfreetype6-dev:i386 libtiff-dev:i386 libcupsimage2-dev:i386'
+      extra-conf-options: '--with-target-bits=32'
+    if: needs.select.outputs.linux-x86 == 'true'
+
+  build-linux-x64-hs-nopch:
+    name: linux-x64-hs-nopch
+    needs: select
+    uses: ./.github/workflows/build-linux.yml
+    with:
+      platform: linux-x64
+      make-target: 'hotspot'
+      debug-levels: '[ "debug" ]'
+      apt-gcc-version: '10=10.3.0-1ubuntu1~20.04'
+      extra-conf-options: '--disable-precompiled-headers'
+    if: needs.select.outputs.linux-x64-variants == 'true'
+
+  build-linux-x64-hs-zero:
+    name: linux-x64-hs-zero
+    needs: select
+    uses: ./.github/workflows/build-linux.yml
+    with:
+      platform: linux-x64
+      make-target: 'hotspot'
+      debug-levels: '[ "debug" ]'
+      apt-gcc-version: '10=10.3.0-1ubuntu1~20.04'
+      extra-conf-options: '--with-jvm-variants=zero --disable-precompiled-headers'
+    if: needs.select.outputs.linux-x64-variants == 'true'
+
+  build-linux-x64-hs-minimal:
+    name: linux-x64-hs-minimal
+    needs: select
+    uses: ./.github/workflows/build-linux.yml
+    with:
+      platform: linux-x64
+      make-target: 'hotspot'
+      debug-levels: '[ "debug" ]'
+      apt-gcc-version: '10=10.3.0-1ubuntu1~20.04'
+      extra-conf-options: '--with-jvm-variants=minimal --disable-precompiled-headers'
+    if: needs.select.outputs.linux-x64-variants == 'true'
+
+  build-linux-x64-hs-optimized:
+    name: linux-x64-hs-optimized
+    needs: select
+    uses: ./.github/workflows/build-linux.yml
+    with:
+      platform: linux-x64
+      make-target: 'hotspot'
+      # Technically this is not the "debug" level, but we can't inject a new matrix state for just this job
+      debug-levels: '[ "debug" ]'
+      apt-gcc-version: '10=10.3.0-1ubuntu1~20.04'
+      extra-conf-options: '--with-debug-level=optimized --disable-precompiled-headers'
+    if: needs.select.outputs.linux-x64-variants == 'true'
+
+  build-linux-cross-compile:
+    name: linux-cross-compile
+    needs:
+      - select
+      - build-linux-x64
+    uses: ./.github/workflows/build-cross-compile.yml
+    if: needs.select.outputs.linux-cross-compile == 'true'
+
+  build-macos-x64:
+    name: macos-x64
+    needs: select
+    uses: ./.github/workflows/build-macos.yml
+    with:
+      platform: macos-x64
+      xcode-toolset-version: '11.7'
+    if: needs.select.outputs.macos-x64 == 'true'
+
+  build-macos-aarch64:
+    name: macos-aarch64
+    needs: select
+    uses: ./.github/workflows/build-macos.yml
+    with:
+      platform: macos-aarch64
+      xcode-toolset-version: '12.4'
+      extra-conf-options: '--openjdk-target=aarch64-apple-darwin'
+    if: needs.select.outputs.macos-aarch64 == 'true'
+
+  build-windows-x64:
+    name: windows-x64
+    needs: select
+    uses: ./.github/workflows/build-windows.yml
+    with:
+      platform: windows-x64
+      msvc-toolset-version: '14.25'
+      msvc-toolset-architecture: 'x86.x64'
+    if: needs.select.outputs.windows-x64 == 'true'
+
+  build-windows-aarch64:
+    name: windows-aarch64
+    needs: select
+    uses: ./.github/workflows/build-windows.yml
+    with:
+      platform: windows-aarch64
+      msvc-toolset-version: '14.29'
+      msvc-toolset-architecture: 'arm64'
+      make-target: 'hotspot'
+      extra-conf-options: '--openjdk-target=aarch64-unknown-cygwin'
+    if: needs.select.outputs.windows-aarch64 == 'true'
+
+  ###
+  ### Test jobs
+  ###
+
+  test-linux-x64:
+    name: linux-x64
+    needs:
+      - build-linux-x64
+    uses: ./.github/workflows/test.yml
+    with:
+      platform: linux-x64
+      bootjdk-platform: linux-x64
+      runs-on: ubuntu-20.04
+
+  test-linux-x86:
+    name: linux-x86
+    needs:
+      - build-linux-x86
+    uses: ./.github/workflows/test.yml
+    with:
+      platform: linux-x86
+      bootjdk-platform: linux-x64
+      runs-on: ubuntu-20.04
+
+  test-macos-x64:
+    name: macos-x64
+    needs:
+      - build-macos-x64
+    uses: ./.github/workflows/test.yml
+    with:
+      platform: macos-x64
+      bootjdk-platform: macos-x64
+      runs-on: macos-11
+
+  test-windows-x64:
+    name: windows-x64
+    needs:
+      - build-windows-x64
+    uses: ./.github/workflows/test.yml
+    with:
+      platform: windows-x64
+      bootjdk-platform: windows-x64
+      runs-on: windows-2019
+
+  # Remove bundles so they are not misconstrued as binary distributions from the JDK project
+  remove-bundles:
+    name: 'Remove bundle artifacts'
+    runs-on: ubuntu-20.04
+    if: always()
+    needs:
+      - build-linux-x64
+      - build-linux-x86
+      - build-linux-x64-hs-nopch
+      - build-linux-x64-hs-zero
+      - build-linux-x64-hs-minimal
+      - build-linux-x64-hs-optimized
+      - build-linux-cross-compile
+      - build-macos-x64
+      - build-macos-aarch64
+      - build-windows-x64
+      - build-windows-aarch64
+      - test-linux-x64
+      - test-linux-x86
+      - test-macos-x64
+      - test-windows-x64
+
+    steps:
+        # Hack to get hold of the api environment variables that are only defined for actions
+      - name: 'Get API configuration'
+        id: api
+        uses: actions/github-script@v6
+        with:
+          script: 'return { url: process.env["ACTIONS_RUNTIME_URL"], token: process.env["ACTIONS_RUNTIME_TOKEN"] }'
+
+      - name: 'Remove bundle artifacts'
+        run: |
+          # Find and remove all bundle artifacts
+          ALL_ARTIFACT_URLS="$(curl -s \
+              -H 'Accept: application/json;api-version=6.0-preview' \
+              -H 'Authorization: Bearer ${{ fromJson(steps.api.outputs.result).token }}' \
+              '${{ fromJson(steps.api.outputs.result).url }}_apis/pipelines/workflows/${{ github.run_id }}/artifacts?api-version=6.0-preview')"
+          BUNDLE_ARTIFACT_URLS="$(echo "$ALL_ARTIFACT_URLS" | jq -r -c '.value | map(select(.name|startswith("bundles-"))) | .[].url')"
+          for url in $BUNDLE_ARTIFACT_URLS; do
+            echo "Removing $url"
+            curl -s \
+                -H 'Accept: application/json;api-version=6.0-preview' \
+                -H 'Authorization: Bearer ${{ fromJson(steps.api.outputs.result).token }}' \
+                -X DELETE "$url" \
+            || echo "Failed to remove bundle"
+          done
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
new file mode 100644
index 0000000..81735dd
--- /dev/null
+++ b/.github/workflows/test.yml
@@ -0,0 +1,205 @@
+#
+# Copyright (c) 2022, Oracle and/or its affiliates. All rights reserved.
+# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+#
+# This code is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License version 2 only, as
+# published by the Free Software Foundation.  Oracle designates this
+# particular file as subject to the "Classpath" exception as provided
+# by Oracle in the LICENSE file that accompanied this code.
+#
+# This code is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+# version 2 for more details (a copy is included in the LICENSE file that
+# accompanied this code).
+#
+# You should have received a copy of the GNU General Public License version
+# 2 along with this work; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+# or visit www.oracle.com if you need additional information or have any
+# questions.
+#
+
+name: 'Run tests'
+
+on:
+  workflow_call:
+    inputs:
+      platform:
+        required: true
+        type: string
+      bootjdk-platform:
+        required: true
+        type: string
+      runs-on:
+        required: true
+        type: string
+
+env:
+  # These are needed to make the MSYS2 bash work properly
+  MSYS2_PATH_TYPE: minimal
+  CHERE_INVOKING: 1
+
+jobs:
+  test:
+    name: test
+    runs-on: ${{ inputs.runs-on }}
+    defaults:
+      run:
+        shell: bash
+
+    strategy:
+      fail-fast: false
+      matrix:
+        test-name:
+          - 'jdk/tier1 part 1'
+          - 'jdk/tier1 part 2'
+          - 'jdk/tier1 part 3'
+          - 'langtools/tier1'
+          - 'hs/tier1 common'
+          - 'hs/tier1 compiler'
+          - 'hs/tier1 gc'
+          - 'hs/tier1 runtime'
+          - 'hs/tier1 serviceability'
+
+        include:
+          - test-name: 'jdk/tier1 part 1'
+            test-suite: 'test/jdk/:tier1_part1'
+
+          - test-name: 'jdk/tier1 part 2'
+            test-suite: 'test/jdk/:tier1_part2'
+
+          - test-name: 'jdk/tier1 part 3'
+            test-suite: 'test/jdk/:tier1_part3'
+
+          - test-name: 'langtools/tier1'
+            test-suite: 'test/langtools/:tier1'
+
+          - test-name: 'hs/tier1 common'
+            test-suite: 'test/hotspot/jtreg/:tier1_common'
+            debug-suffix: -debug
+
+          - test-name: 'hs/tier1 compiler'
+            test-suite: 'test/hotspot/jtreg/:tier1_compiler'
+            debug-suffix: -debug
+
+          - test-name: 'hs/tier1 gc'
+            test-suite: 'test/hotspot/jtreg/:tier1_gc'
+            debug-suffix: -debug
+
+          - test-name: 'hs/tier1 runtime'
+            test-suite: 'test/hotspot/jtreg/:tier1_runtime'
+            debug-suffix: -debug
+
+          - test-name: 'hs/tier1 serviceability'
+            test-suite: 'test/hotspot/jtreg/:tier1_serviceability'
+            debug-suffix: -debug
+
+    steps:
+      - name: 'Checkout the JDK source'
+        uses: actions/checkout@v3
+
+      - name: 'Get MSYS2'
+        uses: ./.github/actions/get-msys2
+        if: runner.os == 'Windows'
+
+      - name: 'Get the BootJDK'
+        id: bootjdk
+        uses: ./.github/actions/get-bootjdk
+        with:
+          platform: ${{ inputs.bootjdk-platform }}
+
+      - name: 'Get JTReg'
+        id: jtreg
+        uses: ./.github/actions/get-jtreg
+
+      - name: 'Get bundles'
+        id: bundles
+        uses: ./.github/actions/get-bundles
+        with:
+          platform: ${{ inputs.platform }}
+          debug-suffix: ${{ matrix.debug-suffix }}
+
+      - name: 'Install dependencies'
+        run: |
+          # On macOS we need to install some dependencies for testing
+          brew install make
+          sudo xcode-select --switch /Applications/Xcode_11.7.app/Contents/Developer
+          # This will make GNU make available as 'make' and not only as 'gmake'
+          echo '/usr/local/opt/make/libexec/gnubin' >> $GITHUB_PATH
+        if: runner.os == 'macOS'
+
+      - name: 'Set PATH'
+        id: path
+        run: |
+          # We need a minimal PATH on Windows
+          # Set PATH to "", so just GITHUB_PATH is included
+          if [[ '${{ runner.os }}' == 'Windows' ]]; then
+            echo "value=" >> $GITHUB_OUTPUT
+          else
+            echo "value=$PATH" >> $GITHUB_OUTPUT
+          fi
+
+      - name: 'Run tests'
+        id: run-tests
+        run: >
+          make test-prebuilt
+          TEST='${{ matrix.test-suite }}'
+          BOOT_JDK=${{ steps.bootjdk.outputs.path }}
+          JT_HOME=${{ steps.jtreg.outputs.path }}
+          JDK_IMAGE_DIR=${{ steps.bundles.outputs.jdk-path }}
+          SYMBOLS_IMAGE_DIR=${{ steps.bundles.outputs.symbols-path }}
+          TEST_IMAGE_DIR=${{ steps.bundles.outputs.tests-path }}
+          JTREG='JAVA_OPTIONS=-XX:-CreateCoredumpOnCrash;VERBOSE=fail,error,time;KEYWORDS=!headful'
+          && bash ./.github/scripts/gen-test-summary.sh "$GITHUB_STEP_SUMMARY" "$GITHUB_OUTPUT"
+        env:
+          PATH: ${{ steps.path.outputs.value }}
+
+        # This is a separate step, since if the markdown from a step gets bigger than
+        # 1024 kB it is skipped, but then the short summary above is still generated
+      - name: 'Generate test report'
+        run: bash ./.github/scripts/gen-test-results.sh "$GITHUB_STEP_SUMMARY"
+        if: always()
+
+      - name: 'Package test results'
+        id: package
+        run: |
+          # Package test-results and relevant parts of test-support
+          mkdir results
+
+          if [[ -d build/run-test-prebuilt/test-results ]]; then
+            cd build/run-test-prebuilt/test-results/
+            zip -r -9 "$GITHUB_WORKSPACE/results/test-results.zip" .
+            cd $GITHUB_WORKSPACE
+          else
+            echo '::warning ::Missing test-results directory'
+          fi
+
+          if [[ -d build/run-test-prebuilt/test-support ]]; then
+            cd build/run-test-prebuilt/test-support/
+            zip -r -9 "$GITHUB_WORKSPACE/results/test-support.zip" . -i *.jtr -i */hs_err*.log -i */replay*.log
+            cd $GITHUB_WORKSPACE
+          else
+            echo '::warning ::Missing test-support directory'
+          fi
+
+          artifact_name="results-${{ inputs.platform }}-$(echo ${{ matrix.test-name }} | tr '/ ' '__')"
+          echo "artifact-name=$artifact_name" >> $GITHUB_OUTPUT
+        if: always()
+
+      - name: 'Upload test results'
+        uses: actions/upload-artifact@v3
+        with:
+          path: results
+          name: ${{ steps.package.outputs.artifact-name }}
+        if: always()
+
+        # This is the best way I found to abort the job with an error message
+      - name: 'Notify about test failures'
+        uses: actions/github-script@v6
+        with:
+          script: core.setFailed('${{ steps.run-tests.outputs.error-message }}')
+        if: steps.run-tests.outputs.failure == 'true'
diff --git a/.gitignore b/.gitignore
index cf21c89..6787b23 100644
--- a/.gitignore
+++ b/.gitignore
@@ -16,3 +16,5 @@ NashornProfile.txt
 **/JTreport/**
 **/JTwork/**
 /src/utils/LogCompilation/target/
+/.project/
+/.settings/
diff --git a/.jcheck/conf b/.jcheck/conf
index 54b440d..28a08ac 100644
--- a/.jcheck/conf
+++ b/.jcheck/conf
@@ -1,7 +1,7 @@
 [general]
 project=jdk-updates
 jbs=JDK
-version=17.0.5
+version=17.0.6
 
 [checks]
 error=author,committer,reviewers,merge,issues,executable,symlink,message,hg-tag,whitespace,problemlists
diff --git a/configure b/configure
old mode 100755
new mode 100644
diff --git a/debian/changelog b/debian/changelog
index e7739f6..5847965 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,15 @@
+openjdk-17 (17.0.6+10-0ubuntu1) lunar; urgency=medium
+
+  * OpenJDK 17.0.6 release, build 10.
+    - CVE-2023-21835, CVE-2023-21843
+    - Release notes:
+      https://www.oracle.com/java/technologies/javase/17-0-6-relnotes.html
+  * debian/patches/*: Refreshed patches for the new release and dropped unused
+    patches.
+  * debian/rules: add lunar to jtreg version selection.
+
+ -- Vladimir Petko <[e-mail]>  Thu, 19 Jan 2023 21:34:14 +1300
+
 openjdk-17 (17.0.5+8-2ubuntu1) kinetic-security; urgency=medium
 
   * Handle jtreg package name for backports.
diff --git a/debian/control b/debian/control
index 4fd33c9..51e734d 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: openjdk-17
 Section: java
 Priority: optional
-Maintainer: OpenJDK Team <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: OpenJDK Team <[e-mail]>
 Uploaders: Matthias Klose <[e-mail]>
 Build-Depends: debhelper (>= 11),
   m4, lsb-release, zip, unzip,
diff --git a/debian/control.in b/debian/control.in
index 1c13028..ff3128e 100644
--- a/debian/control.in
+++ b/debian/control.in
@@ -1,7 +1,8 @@
 Source: @basename@
 Section: java
 Priority: optional
-Maintainer: OpenJDK Team <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: OpenJDK Team <[e-mail]>
 Uploaders: Matthias Klose <[e-mail]>
 Build-Depends: @bd_debhelper@
   m4, lsb-release, zip, unzip,
diff --git a/debian/patches/accessible-toolkit.diff b/debian/patches/accessible-toolkit.diff
deleted file mode 100644
index b337a9c..0000000
--- a/debian/patches/accessible-toolkit.diff
+++ /dev/null
@@ -1,15 +0,0 @@
---- a/jdk/src/share/classes/java/awt/Toolkit.java
-+++ b/jdk/src/share/classes/java/awt/Toolkit.java
-@@ -894,7 +894,11 @@
-                         return null;
-                     }
-                 });
--                loadAssistiveTechnologies();
-+                try {
-+                    loadAssistiveTechnologies();
-+                } catch ( AWTError error) {
-+                    // ignore silently
-+                }
-             } finally {
-                 // Make sure to always re-enable the JIT.
-                 java.lang.Compiler.enable();
diff --git a/debian/patches/adlc-parser.diff b/debian/patches/adlc-parser.diff
index 8cb97bf..096aadb 100644
--- a/debian/patches/adlc-parser.diff
+++ b/debian/patches/adlc-parser.diff
@@ -1,11 +1,22 @@
 # DP: fixes an uninitialized memory issue in adlc
 --- a/src/hotspot/share/adlc/formsopt.cpp
 +++ b/src/hotspot/share/adlc/formsopt.cpp
-@@ -445,6 +445,7 @@ FrameForm::FrameForm() {
+@@ -436,6 +436,10 @@
+ //==============================Frame Handling=================================
+ //------------------------------FrameForm--------------------------------------
+ FrameForm::FrameForm() {
++  _sync_stack_slots = NULL;
++  _inline_cache_reg = NULL;
++  _interpreter_frame_pointer_reg = NULL;
++  _cisc_spilling_operand_name = NULL;
+   _frame_pointer = NULL;
+   _c_frame_pointer = NULL;
+   _alignment = NULL;
+@@ -444,7 +448,6 @@
+   _varargs_C_out_slots_killed = NULL;
    _return_value = NULL;
    _c_return_value = NULL;
-   _interpreter_frame_pointer_reg = NULL;
-+  _cisc_spilling_operand_name = NULL;
+-  _interpreter_frame_pointer_reg = NULL;
  }
  
  FrameForm::~FrameForm() {
diff --git a/debian/patches/default-jvm-cfg.diff b/debian/patches/default-jvm-cfg.diff
index 8022257..cad65d0 100644
--- a/debian/patches/default-jvm-cfg.diff
+++ b/debian/patches/default-jvm-cfg.diff
@@ -1,6 +1,6 @@
 --- a/src/java.base/share/native/libjli/java.c
 +++ b/src/java.base/share/native/libjli/java.c
-@@ -2079,7 +2079,7 @@ jint
+@@ -1997,7 +1997,7 @@
  ReadKnownVMs(const char *jvmCfgName, jboolean speculative)
  {
      FILE *jvmCfg;
@@ -9,7 +9,7 @@
      int cnt = 0;
      int lineno = 0;
      jlong start = 0, end = 0;
-@@ -2094,6 +2094,11 @@ ReadKnownVMs(const char *jvmCfgName, jbo
+@@ -2012,6 +2012,11 @@
  
      jvmCfg = fopen(jvmCfgName, "r");
      if (jvmCfg == NULL) {
diff --git a/debian/patches/enumipv6-fix.diff b/debian/patches/enumipv6-fix.diff
deleted file mode 100644
index 82f73c5..0000000
--- a/debian/patches/enumipv6-fix.diff
+++ /dev/null
@@ -1,11 +0,0 @@
---- openjdk/jdk/src/solaris/native/java/net/NetworkInterface.c~	2012-02-15 09:26:50.000000000 +0100
-+++ openjdk/jdk/src/solaris/native/java/net/NetworkInterface.c	2012-02-26 14:13:22.602107361 +0100
-@@ -1105,7 +1105,7 @@
-     uint8_t ipv6addr[16];
- 
-     if ((f = fopen(_PATH_PROCNET_IFINET6, "r")) != NULL) {
--        while (fscanf(f, "%4s%4s%4s%4s%4s%4s%4s%4s %02x %02x %02x %02x %20s\n",
-+        while (fscanf(f, "%4s%4s%4s%4s%4s%4s%4s%4s %x %x %x %x %20s\n",
-                          addr6p[0], addr6p[1], addr6p[2], addr6p[3], addr6p[4], addr6p[5], addr6p[6], addr6p[7],
-                          &if_idx, &plen, &scope, &dad_status, devname) != EOF) {
- 
diff --git a/debian/patches/generated-headers.patch b/debian/patches/generated-headers.patch
index 9309aaa..9c5a2d3 100644
--- a/debian/patches/generated-headers.patch
+++ b/debian/patches/generated-headers.patch
@@ -1,6 +1,6 @@
 --- a/make/modules/java.desktop/lib/Awt2dLibraries.gmk
 +++ b/make/modules/java.desktop/lib/Awt2dLibraries.gmk
-@@ -289,7 +289,7 @@ $(eval $(call SetupJdkLibrary, BUILD_LIB
+@@ -290,7 +290,7 @@
      INCLUDE_FILES := $(BUILD_LIBLCMS_INCLUDE_FILES), \
      OPTIMIZATION := HIGHEST, \
      CFLAGS := $(CFLAGS_JDKLIB) \
@@ -9,7 +9,7 @@
      CFLAGS_windows := -DCMS_IS_WINDOWS_, \
      EXTRA_HEADER_DIRS := \
          common/awt/debug \
-@@ -337,7 +337,7 @@ $(eval $(call SetupJdkLibrary, BUILD_LIB
+@@ -338,7 +338,7 @@
      NAME := javajpeg, \
      INCLUDE_FILES := $(BUILD_LIBJAVAJPEG_INCLUDE_FILES), \
      OPTIMIZATION := HIGHEST, \
diff --git a/debian/patches/hotspot-disable-exec-shield-workaround.diff b/debian/patches/hotspot-disable-exec-shield-workaround.diff
index bf9d6df..924a182 100644
--- a/debian/patches/hotspot-disable-exec-shield-workaround.diff
+++ b/debian/patches/hotspot-disable-exec-shield-workaround.diff
@@ -1,6 +1,6 @@
 --- a/src/hotspot/os_cpu/linux_x86/os_linux_x86.cpp
 +++ b/src/hotspot/os_cpu/linux_x86/os_linux_x86.cpp
-@@ -635,7 +635,7 @@ void os::verify_stack_alignment() {
+@@ -651,7 +651,7 @@
   * updates (JDK-8023956).
   */
  void os::workaround_expand_exec_shield_cs_limit() {
diff --git a/debian/patches/hotspot-disable-werror.diff b/debian/patches/hotspot-disable-werror.diff
deleted file mode 100644
index 0ec8583..0000000
--- a/debian/patches/hotspot-disable-werror.diff
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/src/hotspot/make/linux/makefiles/gcc.make
-+++ b/src/hotspot/make/linux/makefiles/gcc.make
-@@ -203,7 +203,7 @@ else
- endif
- 
- # Compiler warnings are treated as errors
--WARNINGS_ARE_ERRORS ?= -Werror -Wno-error=format
-+WARNINGS_ARE_ERRORS ?=
- 
- ifeq ($(USE_CLANG), true)
-   # However we need to clean the code up before we can unrestrictedly enable this option with Clang
diff --git a/debian/patches/hotspot-set-compiler.diff b/debian/patches/hotspot-set-compiler.diff
deleted file mode 100644
index 181b71c..0000000
--- a/debian/patches/hotspot-set-compiler.diff
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/src/hotspot/make/linux/makefiles/gcc.make
-+++ b/src/hotspot/make/linux/makefiles/gcc.make
-@@ -39,7 +39,7 @@
-     ifeq ($(USE_CLANG), true)
-       CXX = clang++
-       CC  = clang
--    else
-+    else ifeq ($(CXX),)
-       CXX = g++
-       CC  = gcc
-     endif
diff --git a/debian/patches/hotspot-warn-no-errformat.diff b/debian/patches/hotspot-warn-no-errformat.diff
deleted file mode 100644
index 0628b89..0000000
--- a/debian/patches/hotspot-warn-no-errformat.diff
+++ /dev/null
@@ -1,22 +0,0 @@
---- a/src/hotspot/make/solaris/makefiles/gcc.make
-+++ b/src/hotspot/make/solaris/makefiles/gcc.make
-@@ -117,7 +117,7 @@ endif
- 
- 
- # Compiler warnings are treated as errors
--WARNINGS_ARE_ERRORS ?= -Werror
-+WARNINGS_ARE_ERRORS ?= -Werror -Wno-error=format
- 
- # Enable these warnings. See 'info gcc' about details on these options
- WARNING_FLAGS = -Wpointer-arith -Wconversion -Wsign-compare -Wundef -Wformat=2
---- a/src/hotspot/make/linux/makefiles/gcc.make
-+++ b/src/hotspot/make/linux/makefiles/gcc.make
-@@ -203,7 +203,7 @@ else
- endif
- 
- # Compiler warnings are treated as errors
--WARNINGS_ARE_ERRORS ?= -Werror
-+WARNINGS_ARE_ERRORS ?= -Werror -Wno-error=format
- 
- ifeq ($(USE_CLANG), true)
-   # However we need to clean the code up before we can unrestrictedly enable this option with Clang
diff --git a/debian/patches/include-all-srcs.diff b/debian/patches/include-all-srcs.diff
deleted file mode 100644
index f73bfaf..0000000
--- a/debian/patches/include-all-srcs.diff
+++ /dev/null
@@ -1,54 +0,0 @@
---- a/src/jdk/make/CreateJars.gmk
-+++ b/src/jdk/make/CreateJars.gmk
-@@ -569,38 +569,12 @@
- ##########################################################################################
- 
- SRC_ZIP_INCLUDES = \
--    com/sun/corba \
--    com/sun/image/codec/jpeg \
--    com/sun/imageio \
--    com/sun/java_cup \
--    com/sun/javadoc \
--    com/sun/java/swing \
--    com/sun/jmx \
--    com/sun/naming \
--    com/sun/org/apache \
--    com/sun/security/auth \
--    com/sun/security/jgss \
--    com/sun/source \
-+    com \
-     java \
--    javax/accessibility \
--    javax/annotation \
--    javax/imageio \
--    javax/lang \
--    javax/management \
--    javax/naming \
--    javax/print \
--    javax/rmi \
--    javax/script \
--    javax/security \
--    javax/sound \
--    javax/sql \
--    javax/swing \
--    javax/tools \
--    javax/xml \
--    org/ietf \
--    org/omg \
--    org/w3c/dom \
--    org/xml/sax \
-+    javax \
-+    jdk \
-+    org \
-+    sun \
-     #
- 
- SRC_ZIP_SRCS = $(JDK_TOPDIR)/src/share/classes $(JDK_TOPDIR)/src/$(OPENJDK_TARGET_OS_API_DIR)/classes
-@@ -632,7 +606,6 @@
- $(eval $(call SetupZipArchive,BUILD_SRC_ZIP, \
-     SRC := $(SRC_ZIP_SRCS) $(IMAGES_OUTPUTDIR)/src, \
-     INCLUDES := $(SRC_ZIP_INCLUDES) launcher, \
--    EXCLUDES := javax/swing/beaninfo, \
-     SUFFIXES := .java .c .h, \
-     ZIP := $(IMAGES_OUTPUTDIR)/src.zip, \
-     EXTRA_DEPS := $(LAUNCHER_ZIP_SRC)))
diff --git a/debian/patches/java-access-bridge-security.diff b/debian/patches/java-access-bridge-security.diff
deleted file mode 100644
index 2e5d0e1..0000000
--- a/debian/patches/java-access-bridge-security.diff
+++ /dev/null
@@ -1,15 +0,0 @@
-# patch only used for builds with java-access-bridge support
-
---- openjdk/jdk/src/share/lib/security/java.security-linux
-+++ openjdk/jdk/src/share/lib/security/java.security-linux
-@@ -149,7 +149,9 @@
-                com.sun.org.apache.xml.internal.security.,\
-                com.sun.org.glassfish.,\
-                org.jcp.xml.dsig.internal.,\
--               oracle.jrockit.jfr.
-+               oracle.jrockit.jfr.,\
-+               org.GNOME.Accessibility.,\
-+               org.GNOME.Bonobo.
- #
- # List of comma-separated packages that start with or equal this string
- # will cause a security exception to be thrown when
diff --git a/debian/patches/jaw-classpath.diff b/debian/patches/jaw-classpath.diff
index 05e834c..5cf865e 100644
--- a/debian/patches/jaw-classpath.diff
+++ b/debian/patches/jaw-classpath.diff
@@ -2,7 +2,7 @@ Fix finding the Java ATK wrapper, see #900912
 
 --- a/src/hotspot/os/linux/os_linux.cpp
 +++ b/src/hotspot/os/linux/os_linux.cpp
-@@ -461,6 +461,7 @@ void os::init_system_properties_values()
+@@ -464,6 +464,7 @@
      if (!set_boot_path('/', ':')) {
        vm_exit_during_initialization("Failed setting boot class path.", NULL);
      }
diff --git a/debian/patches/jdk-pulseaudio.diff b/debian/patches/jdk-pulseaudio.diff
deleted file mode 100644
index 5b75862..0000000
--- a/debian/patches/jdk-pulseaudio.diff
+++ /dev/null
@@ -1,16 +0,0 @@
---- a/src/jdk/src/java.desktop/share/conf/sound.properties
-+++ b/src/jdk/src/java.desktop/share/conf/sound.properties
-@@ -37,3 +37,13 @@
- # Specify the default Receiver by provider and name:
- # javax.sound.midi.Receiver=com.sun.media.sound.MidiProvider#SunMIDI1
- #
-+
-+javax.sound.sampled.Clip=org.classpath.icedtea.pulseaudio.PulseAudioMixerProvider
-+javax.sound.sampled.Port=org.classpath.icedtea.pulseaudio.PulseAudioMixerProvider
-+javax.sound.sampled.SourceDataLine=org.classpath.icedtea.pulseaudio.PulseAudioMixerProvider
-+javax.sound.sampled.TargetDataLine=org.classpath.icedtea.pulseaudio.PulseAudioMixerProvider
-+
-+#javax.sound.sampled.Clip=com.sun.media.sound.DirectAudioDeviceProvider
-+#javax.sound.sampled.Port=com.sun.media.sound.PortMixerProvider
-+#javax.sound.sampled.SourceDataLine=com.sun.media.sound.DirectAudioDeviceProvider
-+#javax.sound.sampled.TargetDataLine=com.sun.media.sound.DirectAudioDeviceProvider
diff --git a/debian/patches/jexec.diff b/debian/patches/jexec.diff
deleted file mode 100644
index 47e598b..0000000
--- a/debian/patches/jexec.diff
+++ /dev/null
@@ -1,35 +0,0 @@
---- a/src/java.base/unix/native/launcher/jexec.c
-+++ b/src/java.base/unix/native/launcher/jexec.c
-@@ -168,9 +168,10 @@ int main(int argc, const char * argv[])
- 
-     /* Get the path to the java binary, which is in a known position relative
-      * to our current position, which is in argv[0]. */
--    if (getJavaPath(argv[argi++], java, RELATIVE_DEPTH) != 0) {
-+    if (getJavaPath(JDK_BASE_DIR "/lib/jexec", java, RELATIVE_DEPTH) != 0) {
-         errorExit(errno, MISSING_JAVA_MSG);
-     }
-+    argi++;
-     alen = (argc + 2) * (sizeof (const char *));
-     if (alen <= 0 || alen > INT_MAX / sizeof(char *)) {
-         errorExit(errno, BAD_ARG_MSG);
---- a/make/launcher/Launcher-java.base.gmk
-+++ b/make/launcher/Launcher-java.base.gmk
-@@ -56,6 +56,9 @@ $(eval $(call SetupBuildLauncher, keytoo
- ################################################################################
- 
- ifeq ($(call isTargetOs, linux), true)
-+  ifeq (,$(DEBIAN_JDK_BASE_DIR))
-+    $(error DEBIAN_JDK_BASE_DIR must be defined for jexec build)
-+  endif
-   $(eval $(call SetupJdkExecutable, BUILD_JEXEC, \
-       NAME := jexec, \
-       SRC := $(TOPDIR)/src/$(MODULE)/unix/native/launcher, \
-@@ -63,7 +66,7 @@ ifeq ($(call isTargetOs, linux), true)
-       OPTIMIZATION := LOW, \
-       CFLAGS := $(CFLAGS_JDKEXE) \
-           -I$(TOPDIR)/src/$(MODULE)/share/native/libjli, \
--      CFLAGS_linux := -fPIC, \
-+      CFLAGS_linux := -fPIC '-DJDK_BASE_DIR="$(DEBIAN_JDK_BASE_DIR)"', \
-       CFLAGS_solaris := -KPIC, \
-       LDFLAGS := $(LDFLAGS_JDKEXE), \
-       OUTPUT_DIR := $(SUPPORT_OUTPUTDIR)/modules_libs/$(MODULE), \
diff --git a/debian/patches/multiple-pkcs11-library-init.diff b/debian/patches/multiple-pkcs11-library-init.diff
index 81a65ca..0238c4f 100644
--- a/debian/patches/multiple-pkcs11-library-init.diff
+++ b/debian/patches/multiple-pkcs11-library-init.diff
@@ -7,7 +7,7 @@ Allow multiple PKCS11 library initialisation to be a non-critical error.
 
 --- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/Config.java
 +++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/Config.java
-@@ -52,6 +52,7 @@ final class Config {
+@@ -52,6 +52,7 @@
      static final int ERR_HALT       = 1;
      static final int ERR_IGNORE_ALL = 2;
      static final int ERR_IGNORE_LIB = 3;
@@ -15,7 +15,7 @@ Allow multiple PKCS11 library initialisation to be a non-critical error.
  
      // same as allowSingleThreadedModules but controlled via a system property
      // and applied to all providers. if set to false, no SunPKCS11 instances
-@@ -1019,6 +1020,8 @@ final class Config {
+@@ -1023,6 +1024,8 @@
              handleStartupErrors = ERR_IGNORE_LIB;
          } else if (val.equals("halt")) {
              handleStartupErrors = ERR_HALT;
@@ -26,7 +26,7 @@ Allow multiple PKCS11 library initialisation to be a non-critical error.
          }
 --- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
 +++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
-@@ -179,26 +179,37 @@ public final class SunPKCS11 extends Aut
+@@ -179,26 +179,37 @@
                  String nssLibraryDirectory = config.getNssLibraryDirectory();
                  String nssSecmodDirectory = config.getNssSecmodDirectory();
                  boolean nssOptimizeSpace = config.getNssOptimizeSpace();
diff --git a/debian/patches/no-pch-build.diff b/debian/patches/no-pch-build.diff
deleted file mode 100644
index 76726e8..0000000
--- a/debian/patches/no-pch-build.diff
+++ /dev/null
@@ -1,110 +0,0 @@
---- a/src/hotspot/src/share/vm/oops/arrayKlassKlass.cpp~	2013-03-04 22:51:00.000000000 +0100
-+++ b/src/hotspot/src/share/vm/oops/arrayKlassKlass.cpp	2013-04-15 13:57:24.992929086 +0200
-@@ -30,6 +30,7 @@
- #include "runtime/handles.inline.hpp"
- #ifndef SERIALGC
- #include "gc_implementation/parNew/parOopClosures.inline.hpp"
-+#include "gc_implementation/parallelScavenge/psOldGen.hpp"
- #include "gc_implementation/parallelScavenge/psPromotionManager.inline.hpp"
- #include "gc_implementation/parallelScavenge/psScavenge.inline.hpp"
- #include "memory/cardTableRS.hpp"
---- a/src/hotspot/src/share/vm/oops/constantPoolKlass.cpp~	2013-03-04 22:51:00.000000000 +0100
-+++ b/src/hotspot/src/share/vm/oops/constantPoolKlass.cpp	2013-04-15 14:02:52.143087149 +0200
-@@ -49,6 +49,7 @@
- #endif
- #ifndef SERIALGC
- #include "gc_implementation/parNew/parOopClosures.inline.hpp"
-+#include "gc_implementation/parallelScavenge/psOldGen.hpp"
- #include "gc_implementation/parallelScavenge/psPromotionManager.inline.hpp"
- #include "gc_implementation/parallelScavenge/psScavenge.inline.hpp"
- #include "memory/cardTableRS.hpp"
---- a/src/hotspot/src/share/vm/oops/cpCacheKlass.cpp~	2013-03-04 22:51:00.000000000 +0100
-+++ b/src/hotspot/src/share/vm/oops/cpCacheKlass.cpp	2013-04-15 14:04:45.219838633 +0200
-@@ -35,6 +35,7 @@
- #include "runtime/handles.inline.hpp"
- #ifndef SERIALGC
- #include "gc_implementation/parNew/parOopClosures.inline.hpp"
-+#include "gc_implementation/parallelScavenge/psOldGen.hpp"
- #include "gc_implementation/parallelScavenge/psPromotionManager.inline.hpp"
- #include "gc_implementation/parallelScavenge/psScavenge.inline.hpp"
- #include "memory/cardTableRS.hpp"
---- a/src/hotspot/src/share/vm/oops/instanceKlass.cpp~	2013-03-04 22:51:00.000000000 +0100
-+++ b/src/hotspot/src/share/vm/oops/instanceKlass.cpp	2013-04-15 14:07:55.861109867 +0200
-@@ -70,6 +70,7 @@
- #include "gc_implementation/g1/g1RemSet.inline.hpp"
- #include "gc_implementation/g1/heapRegionSeq.inline.hpp"
- #include "gc_implementation/parNew/parOopClosures.inline.hpp"
-+#include "gc_implementation/parallelScavenge/psOldGen.hpp"
- #include "gc_implementation/parallelScavenge/psPromotionManager.inline.hpp"
- #include "gc_implementation/parallelScavenge/psScavenge.inline.hpp"
- #include "oops/oop.pcgc.inline.hpp"
---- a/src/hotspot/src/share/vm/oops/instanceKlassKlass.cpp~	2013-03-04 22:51:00.000000000 +0100
-+++ b/src/hotspot/src/share/vm/oops/instanceKlassKlass.cpp	2013-04-15 14:08:53.541485528 +0200
-@@ -44,6 +44,7 @@
- #include "runtime/fieldDescriptor.hpp"
- #ifndef SERIALGC
- #include "gc_implementation/parNew/parOopClosures.inline.hpp"
-+#include "gc_implementation/parallelScavenge/psOldGen.hpp"
- #include "gc_implementation/parallelScavenge/psPromotionManager.inline.hpp"
- #include "gc_implementation/parallelScavenge/psScavenge.inline.hpp"
- #include "memory/cardTableRS.hpp"
---- a/src/hotspot/src/share/vm/oops/instanceMirrorKlass.cpp~	2013-03-04 22:51:00.000000000 +0100
-+++ b/src/hotspot/src/share/vm/oops/instanceMirrorKlass.cpp	2013-04-15 14:10:11.162003798 +0200
-@@ -42,6 +42,7 @@
- #include "gc_implementation/g1/g1RemSet.inline.hpp"
- #include "gc_implementation/g1/heapRegionSeq.inline.hpp"
- #include "gc_implementation/parNew/parOopClosures.inline.hpp"
-+#include "gc_implementation/parallelScavenge/psOldGen.hpp"
- #include "gc_implementation/parallelScavenge/psPromotionManager.inline.hpp"
- #include "gc_implementation/parallelScavenge/psScavenge.inline.hpp"
- #include "oops/oop.pcgc.inline.hpp"
---- a/src/hotspot/src/share/vm/oops/instanceRefKlass.cpp~	2013-03-04 22:51:00.000000000 +0100
-+++ b/src/hotspot/src/share/vm/oops/instanceRefKlass.cpp	2013-04-15 14:11:11.726403390 +0200
-@@ -39,6 +39,7 @@
- #include "gc_implementation/g1/g1RemSet.inline.hpp"
- #include "gc_implementation/g1/heapRegionSeq.inline.hpp"
- #include "gc_implementation/parNew/parOopClosures.inline.hpp"
-+#include "gc_implementation/parallelScavenge/psOldGen.hpp"
- #include "gc_implementation/parallelScavenge/psPromotionManager.inline.hpp"
- #include "gc_implementation/parallelScavenge/psScavenge.inline.hpp"
- #include "oops/oop.pcgc.inline.hpp"
---- a/src/hotspot/src/share/vm/oops/klassKlass.cpp~	2013-03-04 22:51:00.000000000 +0100
-+++ b/src/hotspot/src/share/vm/oops/klassKlass.cpp	2013-04-15 14:13:01.999133769 +0200
-@@ -42,6 +42,7 @@
- #include "runtime/handles.inline.hpp"
- #ifndef SERIALGC
- #include "gc_implementation/parNew/parOopClosures.inline.hpp"
-+#include "gc_implementation/parallelScavenge/psOldGen.hpp"
- #include "gc_implementation/parallelScavenge/psPromotionManager.inline.hpp"
- #include "gc_implementation/parallelScavenge/psScavenge.inline.hpp"
- #include "memory/cardTableRS.hpp"
---- a/src/hotspot/src/share/vm/oops/objArrayKlass.cpp~	2013-03-04 22:51:00.000000000 +0100
-+++ b/src/hotspot/src/share/vm/oops/objArrayKlass.cpp	2013-04-15 14:16:10.616389484 +0200
-@@ -47,6 +47,7 @@
- #include "gc_implementation/g1/g1RemSet.inline.hpp"
- #include "gc_implementation/g1/heapRegionSeq.inline.hpp"
- #include "gc_implementation/parNew/parOopClosures.inline.hpp"
-+#include "gc_implementation/parallelScavenge/psOldGen.hpp"
- #include "gc_implementation/parallelScavenge/psCompactionManager.hpp"
- #include "gc_implementation/parallelScavenge/psPromotionManager.inline.hpp"
- #include "gc_implementation/parallelScavenge/psScavenge.inline.hpp"
---- a/src/hotspot/src/share/vm/oops/objArrayKlassKlass.cpp~	2013-03-04 22:51:00.000000000 +0100
-+++ b/src/hotspot/src/share/vm/oops/objArrayKlassKlass.cpp	2013-04-15 14:17:01.800729154 +0200
-@@ -33,6 +33,7 @@
- #include "oops/oop.inline2.hpp"
- #ifndef SERIALGC
- #include "gc_implementation/parNew/parOopClosures.inline.hpp"
-+#include "gc_implementation/parallelScavenge/psOldGen.hpp"
- #include "gc_implementation/parallelScavenge/psPromotionManager.inline.hpp"
- #include "gc_implementation/parallelScavenge/psScavenge.inline.hpp"
- #include "memory/cardTableRS.hpp"
---- a/src/hotspot/src/share/vm/gc_implementation/parallelScavenge/psTasks.cpp~	2013-03-04 22:51:00.000000000 +0100
-+++ b/src/hotspot/src/share/vm/gc_implementation/parallelScavenge/psTasks.cpp	2013-04-15 14:20:24.782079605 +0200
-@@ -28,6 +28,7 @@
- #include "gc_implementation/parallelScavenge/cardTableExtension.hpp"
- #include "gc_implementation/parallelScavenge/gcTaskManager.hpp"
- #include "gc_implementation/parallelScavenge/psMarkSweep.hpp"
-+#include "gc_implementation/parallelScavenge/psOldGen.hpp"
- #include "gc_implementation/parallelScavenge/psPromotionManager.hpp"
- #include "gc_implementation/parallelScavenge/psPromotionManager.inline.hpp"
- #include "gc_implementation/parallelScavenge/psScavenge.inline.hpp"
diff --git a/debian/patches/nspr+nss-headers.diff b/debian/patches/nspr+nss-headers.diff
deleted file mode 100644
index 235bb6d..0000000
--- a/debian/patches/nspr+nss-headers.diff
+++ /dev/null
@@ -1,9090 +0,0 @@
-Replace header files in src/jdk.crypto.cryptoki/share/native/libj2pkcs11.
-
-Import from NSPR 4.29:
- - prcpucfg.h
- - prtypes.h
-
-Import from NSS 2.63:
- - pkcs11.h
- - pkcs11f.h
- - pkcs11n.h
- - pkcs11p.h
- - pkcs11t.h
- - pkcs11u.h
-
-src/jdk.crypto.cryptoki/unix/native/libj2pkcs11/p11_md.h:
- - Remove macro CK_PTR
- - Remove macro CK_DEFINE_FUNCTION
- - Remove macro CK_DECLARE_FUNCTION
- - Remove macro CK_DECLARE_FUNCTION_POINTER
- - Remove macro CK_CALLBACK_FUNCTION
- 
-src/jdk.crypto.cryptoki/share/native/libj2pkcs11/pkcs11wrapper.h:
- - use CK_TRUE/CK_FALSE instead of TRUE/FALSE
-
-src/jdk.crypto.cryptoki/share/native/libj2pkcs11/p11_convert.c:
- - FIXME: CKM_KEA_DERIVE is undefined
-
-src/jdk.crypto.cryptoki/share/native/libj2pkcs11/p11_util.c:
- - FIXME: CKM_CAMELLIA_CTR is undefined
-
-
---- a/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/pkcs11.h
-+++ b/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/pkcs11.h
-@@ -1,10 +1,15 @@
--/* Copyright (c) OASIS Open 2016-2019. All Rights Reserved.
-- * Distributed under the terms of the OASIS IPR Policy,
-- * [http://www.oasis-open.org/policies-guidelines/ipr], AS-IS, WITHOUT ANY
-- * IMPLIED OR EXPRESS WARRANTY; there is no warranty of MERCHANTABILITY, FITNESS FOR A
-- * PARTICULAR PURPOSE or NONINFRINGEMENT of the rights of others.
-+/* This Source Code Form is subject to the terms of the Mozilla Public
-+ * License, v. 2.0. If a copy of the MPL was not distributed with this
-+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-+/*
-+ * Copyright (C) 1994-1999 RSA Security Inc. Licence to copy this document
-+ * is granted provided that it is identified as "RSA Security In.c Public-Key
-+ * Cryptography Standards (PKCS)" in all material mentioning or referencing
-+ * this document.
-+ *
-+ * The latest version of this header can be found at:
-+ *    http://www.rsalabs.com/pkcs/pkcs-11/index.html
-  */
--
- #ifndef _PKCS11_H_
- #define _PKCS11_H_ 1
- 
-@@ -13,20 +18,21 @@ extern "C" {
- #endif
- 
- /* Before including this file (pkcs11.h) (or pkcs11t.h by
-- * itself), 5 platform-specific macros must be defined.  These
-+ * itself), 6 platform-specific macros must be defined.  These
-  * macros are described below, and typical definitions for them
-  * are also given.  Be advised that these definitions can depend
-  * on both the platform and the compiler used (and possibly also
-- * on whether a Cryptoki library is linked statically or
-+ * on whether a PKCS #11 library is linked statically or
-  * dynamically).
-  *
-- * In addition to defining these 5 macros, the packing convention
-- * for Cryptoki structures should be set.  The Cryptoki
-+ * In addition to defining these 6 macros, the packing convention
-+ * for PKCS #11 structures should be set.  The PKCS #11
-  * convention on packing is that structures should be 1-byte
-  * aligned.
-  *
-- * If you're using Windows this might be done by using the following
-- * preprocessor directive before including pkcs11.h or pkcs11t.h:
-+ * In a Win32 environment, this might be done by using the
-+ * following preprocessor directive before including pkcs11.h
-+ * or pkcs11t.h:
-  *
-  * #pragma pack(push, cryptoki, 1)
-  *
-@@ -35,8 +41,8 @@ extern "C" {
-  *
-  * #pragma pack(pop, cryptoki)
-  *
-- * In a UNIX environment, you're on your own for this.  You might
-- * not need to do (or be able to do!) anything.
-+ * In a UNIX environment, you're on your own here.  You might
-+ * not need to do anything.
-  *
-  *
-  * Now for the macros:
-@@ -47,17 +53,42 @@ extern "C" {
-  *
-  * typedef CK_BYTE CK_PTR CK_BYTE_PTR;
-  *
-- * If you're using windows, it might be defined by:
-+ * In a Win32 environment, it might be defined by
-  *
-  * #define CK_PTR *
-  *
-- * In a typical UNIX environment, it might be defined by:
-+ * In a UNIX environment, it might be defined by
-  *
-  * #define CK_PTR *
-  *
-  *
-- * 2. CK_DECLARE_FUNCTION(returnType, name): A macro which makes
-- * an importable Cryptoki library function declaration out of a
-+ * 2. CK_DEFINE_FUNCTION(returnType, name): A macro which makes
-+ * an exportable PKCS #11 library function definition out of a
-+ * return type and a function name.  It should be used in the
-+ * following fashion to define the exposed PKCS #11 functions in
-+ * a PKCS #11 library:
-+ *
-+ * CK_DEFINE_FUNCTION(CK_RV, C_Initialize)(
-+ *   CK_VOID_PTR pReserved
-+ * )
-+ * {
-+ *   ...
-+ * }
-+ *
-+ * For defining a function in a Win32 PKCS #11 .dll, it might be
-+ * defined by
-+ *
-+ * #define CK_DEFINE_FUNCTION(returnType, name) \
-+ *   returnType __declspec(dllexport) name
-+ *
-+ * In a UNIX environment, it might be defined by
-+ *
-+ * #define CK_DEFINE_FUNCTION(returnType, name) \
-+ *   returnType name
-+ *
-+ *
-+ * 3. CK_DECLARE_FUNCTION(returnType, name): A macro which makes
-+ * an importable PKCS #11 library function declaration out of a
-  * return type and a function name.  It should be used in the
-  * following fashion:
-  *
-@@ -65,49 +96,49 @@ extern "C" {
-  *   CK_VOID_PTR pReserved
-  * );
-  *
-- * If you're using Windows to declare a function in a Win32 cryptoki .dll,
-- * it might be defined by:
-+ * For declaring a function in a Win32 PKCS #11 .dll, it might
-+ * be defined by
-  *
-  * #define CK_DECLARE_FUNCTION(returnType, name) \
-  *   returnType __declspec(dllimport) name
-  *
-- * In a UNIX environment, it might be defined by:
-+ * In a UNIX environment, it might be defined by
-  *
-  * #define CK_DECLARE_FUNCTION(returnType, name) \
-  *   returnType name
-  *
-  *
-- * 3. CK_DECLARE_FUNCTION_POINTER(returnType, name): A macro
-- * which makes a Cryptoki API function pointer declaration or
-+ * 4. CK_DECLARE_FUNCTION_POINTER(returnType, name): A macro
-+ * which makes a PKCS #11 API function pointer declaration or
-  * function pointer type declaration out of a return type and a
-  * function name.  It should be used in the following fashion:
-  *
-- * // Define funcPtr to be a pointer to a Cryptoki API function
-+ * // Define funcPtr to be a pointer to a PKCS #11 API function
-  * // taking arguments args and returning CK_RV.
-  * CK_DECLARE_FUNCTION_POINTER(CK_RV, funcPtr)(args);
-  *
-  * or
-  *
-  * // Define funcPtrType to be the type of a pointer to a
-- * // Cryptoki API function taking arguments args and returning
-+ * // PKCS #11 API function taking arguments args and returning
-  * // CK_RV, and then define funcPtr to be a variable of type
-  * // funcPtrType.
-  * typedef CK_DECLARE_FUNCTION_POINTER(CK_RV, funcPtrType)(args);
-  * funcPtrType funcPtr;
-  *
-- * If you're using Windows to access
-- * functions in a Win32 Cryptoki .dll, in might be defined by:
-+ * For accessing functions in a Win32 PKCS #11 .dll, in might be
-+ * defined by
-  *
-  * #define CK_DECLARE_FUNCTION_POINTER(returnType, name) \
-  *   returnType __declspec(dllimport) (* name)
-  *
-- * In a UNIX environment, it might be defined by:
-+ * In a UNIX environment, it might be defined by
-  *
-  * #define CK_DECLARE_FUNCTION_POINTER(returnType, name) \
-  *   returnType (* name)
-  *
-  *
-- * 4. CK_CALLBACK_FUNCTION(returnType, name): A macro which makes
-+ * 5. CK_CALLBACK_FUNCTION(returnType, name): A macro which makes
-  * a function pointer type for an application callback out of
-  * a return type for the callback and a name for the callback.
-  * It should be used in the following fashion:
-@@ -121,77 +152,76 @@ extern "C" {
-  * typedef CK_CALLBACK_FUNCTION(CK_RV, myCallbackType)(args);
-  * myCallbackType myCallback;
-  *
-- * If you're using Windows, it might be defined by:
-+ * In a Win32 environment, it might be defined by
-  *
-  * #define CK_CALLBACK_FUNCTION(returnType, name) \
-  *   returnType (* name)
-  *
-- * In a UNIX environment, it might be defined by:
-+ * In a UNIX environment, it might be defined by
-  *
-  * #define CK_CALLBACK_FUNCTION(returnType, name) \
-  *   returnType (* name)
-  *
-  *
-- * 5. NULL_PTR: This macro is the value of a NULL pointer.
-+ * 6. NULL_PTR: This macro is the value of a NULL pointer.
-  *
-  * In any ANSI/ISO C environment (and in many others as well),
-- * this should best be defined by
-+ * this should be defined by
-  *
-  * #ifndef NULL_PTR
-  * #define NULL_PTR 0
-  * #endif
-  */
- 
--
--/* All the various Cryptoki types and #define'd values are in the
-- * file pkcs11t.h.
-- */
-+/* All the various PKCS #11 types and #define'd values are in the
-+ * file pkcs11t.h. */
- #include "pkcs11t.h"
- 
--#define __PASTE(x,y)      x##y
-+#define __PASTE(x, y) x##y
- 
-+#ifndef CK_PKCS11_3_0
-+/* remember that we set it so we can unset it at the end */
-+#define __NSS_CK_PKCS11_3_IMPLICIT 1
-+#define CK_PKCS11_3_0 1
-+#endif
- 
- /* ==============================================================
-  * Define the "extern" form of all the entry points.
-  * ==============================================================
-  */
- 
--#define CK_NEED_ARG_LIST  1
-+#define CK_NEED_ARG_LIST 1
- #define CK_PKCS11_FUNCTION_INFO(name) \
--  extern CK_DECLARE_FUNCTION(CK_RV, name)
-+    CK_DECLARE_FUNCTION(CK_RV, name)
- 
--/* pkcs11f.h has all the information about the Cryptoki
-- * function prototypes.
-- */
-+/* pkcs11f.h has all the information about the PKCS #11
-+ * function prototypes. */
- #include "pkcs11f.h"
- 
- #undef CK_NEED_ARG_LIST
- #undef CK_PKCS11_FUNCTION_INFO
- 
--
- /* ==============================================================
-  * Define the typedef form of all the entry points.  That is, for
-- * each Cryptoki function C_XXX, define a type CK_C_XXX which is
-+ * each PKCS #11 function C_XXX, define a type CK_C_XXX which is
-  * a pointer to that kind of function.
-  * ==============================================================
-  */
- 
--#define CK_NEED_ARG_LIST  1
-+#define CK_NEED_ARG_LIST 1
- #define CK_PKCS11_FUNCTION_INFO(name) \
--  typedef CK_DECLARE_FUNCTION_POINTER(CK_RV, __PASTE(CK_,name))
-+    typedef CK_DECLARE_FUNCTION_POINTER(CK_RV, __PASTE(CK_, name))
- 
--/* pkcs11f.h has all the information about the Cryptoki
-- * function prototypes.
-- */
-+/* pkcs11f.h has all the information about the PKCS #11
-+ * function prototypes. */
- #include "pkcs11f.h"
- 
- #undef CK_NEED_ARG_LIST
- #undef CK_PKCS11_FUNCTION_INFO
- 
--
- /* ==============================================================
-- * Define structed vector of entry points.  A CK_FUNCTION_LIST
-- * contains a CK_VERSION indicating a library's Cryptoki version
-+ * Define structed vector of entry points.  A CK_FUNCTION_3_0_LIST
-+ * contains a CK_VERSION indicating a library's PKCS #11 version
-  * and then a whole slew of function pointers to the routines in
-  * the library.  This type was declared, but not defined, in
-  * pkcs11t.h.
-@@ -199,39 +229,41 @@ extern "C" {
-  */
- 
- #define CK_PKCS11_FUNCTION_INFO(name) \
--  __PASTE(CK_,name) name;
-+    __PASTE(CK_, name)                \
-+    name;
- 
--/* Create the 3.0 Function list */
-+#include "pkcs11p.h"
- struct CK_FUNCTION_LIST_3_0 {
- 
--  CK_VERSION    version;  /* Cryptoki version */
-+    CK_VERSION version; /* PKCS #11 version */
- 
--/* Pile all the function pointers into the CK_FUNCTION_LIST. */
--/* pkcs11f.h has all the information about the Cryptoki
-- * function prototypes.
-- */
-+/* Pile all the function pointers into the CK_FUNCTION_LIST_3_0. */
-+/* pkcs11f.h has all the information about the PKCS #11
-+ * function prototypes. */
- #include "pkcs11f.h"
--
- };
- 
- #define CK_PKCS11_2_0_ONLY 1
- 
--/* Continue to define the old CK_FUNCTION_LIST */
-+/* now define the 2.0 function list */
- struct CK_FUNCTION_LIST {
- 
--  CK_VERSION    version;  /* Cryptoki version */
-+    CK_VERSION version; /* PKCS #11 version */
- 
- /* Pile all the function pointers into the CK_FUNCTION_LIST. */
--/* pkcs11f.h has all the information about the Cryptoki
-- * function prototypes.
-- */
-+/* pkcs11f.h has all the information about the PKCS #11
-+ * function prototypes. */
- #include "pkcs11f.h"
--
- };
-+#include "pkcs11u.h"
- 
- #undef CK_PKCS11_FUNCTION_INFO
- #undef CK_PKCS11_2_0_ONLY
- 
-+#ifdef __NSS_CK_PKCS11_3_IMPLICIT
-+#undef CK_PKCS11_3_0
-+#undef __NSS_CK_PKCS11_3_IMPLICIT
-+#endif
- 
- #undef __PASTE
- 
-@@ -239,6 +271,4 @@ struct CK_FUNCTION_LIST {
- }
- #endif
- 
--#endif /* _PKCS11_H_ */
--
--
-+#endif
---- a/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/pkcs11f.h
-+++ b/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/pkcs11f.h
-@@ -1,1197 +1,1044 @@
--/* Copyright (c) OASIS Open 2016, 2019. All Rights Reserved./
-- * /Distributed under the terms of the OASIS IPR Policy,
-- * [http://www.oasis-open.org/policies-guidelines/ipr], AS-IS, WITHOUT ANY
-- * IMPLIED OR EXPRESS WARRANTY; there is no warranty of MERCHANTABILITY, FITNESS FOR A
-- * PARTICULAR PURPOSE or NONINFRINGEMENT of the rights of others.
-- */
--
--/* Latest version of the specification:
-- * http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/pkcs11-base-v2.40.html
-- */
--
--/* This header file contains pretty much everything about all the
-- * Cryptoki function prototypes.  Because this information is
-- * used for more than just declaring function prototypes, the
-- * order of the functions appearing herein is important, and
-- * should not be altered.
-- */
-+/* This Source Code Form is subject to the terms of the Mozilla Public
-+ * License, v. 2.0. If a copy of the MPL was not distributed with this
-+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-+/*
-+ * Copyright (C) 1994-1999 RSA Security Inc. Licence to copy this document
-+ * is granted provided that it is identified as "RSA Security In.c Public-Key
-+ * Cryptography Standards (PKCS)" in all material mentioning or referencing
-+ * this document.
-+ */
-+/* This function contains pretty much everything about all the */
-+/* PKCS #11  function prototypes.  Because this information is */
-+/* used for more than just declaring function prototypes, the */
-+/* order of the functions appearing herein is important, and */
-+/* should not be altered. */
- 
- /* General-purpose */
- 
--/* C_Initialize initializes the Cryptoki library. */
-+/* C_Initialize initializes the PKCS #11 library. */
- CK_PKCS11_FUNCTION_INFO(C_Initialize)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_VOID_PTR   pInitArgs  /* if this is not NULL_PTR, it gets
--                            * cast to CK_C_INITIALIZE_ARGS_PTR
--                            * and dereferenced
--                            */
--);
-+    CK_VOID_PTR pInitArgs /* if this is not NULL_PTR, it gets
-+                           * cast to CK_C_INITIALIZE_ARGS_PTR
-+                           * and dereferenced */
-+    );
- #endif
- 
--
- /* C_Finalize indicates that an application is done with the
-- * Cryptoki library.
-- */
-+ * PKCS #11 library. */
- CK_PKCS11_FUNCTION_INFO(C_Finalize)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_VOID_PTR   pReserved  /* reserved.  Should be NULL_PTR */
--);
-+    CK_VOID_PTR pReserved /* reserved.  Should be NULL_PTR */
-+    );
- #endif
- 
--
--/* C_GetInfo returns general information about Cryptoki. */
-+/* C_GetInfo returns general information about PKCS #11. */
- CK_PKCS11_FUNCTION_INFO(C_GetInfo)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_INFO_PTR   pInfo  /* location that receives information */
--);
-+    CK_INFO_PTR pInfo /* location that receives information */
-+    );
- #endif
- 
--
- /* C_GetFunctionList returns the function list. */
- CK_PKCS11_FUNCTION_INFO(C_GetFunctionList)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_FUNCTION_LIST_PTR_PTR ppFunctionList  /* receives pointer to
--                                            * function list
--                                            */
--);
-+    CK_FUNCTION_LIST_PTR_PTR ppFunctionList /* receives pointer to
-+                                             * function list */
-+    );
- #endif
- 
--
--
- /* Slot and token management */
- 
- /* C_GetSlotList obtains a list of slots in the system. */
- CK_PKCS11_FUNCTION_INFO(C_GetSlotList)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_BBOOL       tokenPresent,  /* only slots with tokens */
--  CK_SLOT_ID_PTR pSlotList,     /* receives array of slot IDs */
--  CK_ULONG_PTR   pulCount       /* receives number of slots */
--);
-+    CK_BBOOL tokenPresent,    /* only slots with tokens? */
-+    CK_SLOT_ID_PTR pSlotList, /* receives array of slot IDs */
-+    CK_ULONG_PTR pulCount     /* receives number of slots */
-+    );
- #endif
- 
--
- /* C_GetSlotInfo obtains information about a particular slot in
-- * the system.
-- */
-+ * the system. */
- CK_PKCS11_FUNCTION_INFO(C_GetSlotInfo)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SLOT_ID       slotID,  /* the ID of the slot */
--  CK_SLOT_INFO_PTR pInfo    /* receives the slot information */
--);
-+    CK_SLOT_ID slotID,     /* the ID of the slot */
-+    CK_SLOT_INFO_PTR pInfo /* receives the slot information */
-+    );
- #endif
- 
--
- /* C_GetTokenInfo obtains information about a particular token
-- * in the system.
-- */
-+ * in the system. */
- CK_PKCS11_FUNCTION_INFO(C_GetTokenInfo)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SLOT_ID        slotID,  /* ID of the token's slot */
--  CK_TOKEN_INFO_PTR pInfo    /* receives the token information */
--);
-+    CK_SLOT_ID slotID,      /* ID of the token's slot */
-+    CK_TOKEN_INFO_PTR pInfo /* receives the token information */
-+    );
- #endif
- 
--
- /* C_GetMechanismList obtains a list of mechanism types
-- * supported by a token.
-- */
-+ * supported by a token. */
- CK_PKCS11_FUNCTION_INFO(C_GetMechanismList)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SLOT_ID            slotID,          /* ID of token's slot */
--  CK_MECHANISM_TYPE_PTR pMechanismList,  /* gets mech. array */
--  CK_ULONG_PTR          pulCount         /* gets # of mechs. */
--);
-+    CK_SLOT_ID slotID,                    /* ID of token's slot */
-+    CK_MECHANISM_TYPE_PTR pMechanismList, /* gets mech. array */
-+    CK_ULONG_PTR pulCount                 /* gets # of mechs. */
-+    );
- #endif
- 
--
- /* C_GetMechanismInfo obtains information about a particular
-- * mechanism possibly supported by a token.
-- */
-+ * mechanism possibly supported by a token. */
- CK_PKCS11_FUNCTION_INFO(C_GetMechanismInfo)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SLOT_ID            slotID,  /* ID of the token's slot */
--  CK_MECHANISM_TYPE     type,    /* type of mechanism */
--  CK_MECHANISM_INFO_PTR pInfo    /* receives mechanism info */
--);
-+    CK_SLOT_ID slotID,          /* ID of the token's slot */
-+    CK_MECHANISM_TYPE type,     /* type of mechanism */
-+    CK_MECHANISM_INFO_PTR pInfo /* receives mechanism info */
-+    );
- #endif
- 
--
- /* C_InitToken initializes a token. */
- CK_PKCS11_FUNCTION_INFO(C_InitToken)
- #ifdef CK_NEED_ARG_LIST
-+/* pLabel changed from CK_CHAR_PTR to CK_UTF8CHAR_PTR for v2.10 */
- (
--  CK_SLOT_ID      slotID,    /* ID of the token's slot */
--  CK_UTF8CHAR_PTR pPin,      /* the SO's initial PIN */
--  CK_ULONG        ulPinLen,  /* length in bytes of the PIN */
--  CK_UTF8CHAR_PTR pLabel     /* 32-byte token label (blank padded) */
--);
-+    CK_SLOT_ID slotID,     /* ID of the token's slot */
-+    CK_UTF8CHAR_PTR pPin,  /* the SO's initial PIN */
-+    CK_ULONG ulPinLen,     /* length in bytes of the PIN */
-+    CK_UTF8CHAR_PTR pLabel /* 32-byte token label (blank padded) */
-+    );
- #endif
- 
--
- /* C_InitPIN initializes the normal user's PIN. */
- CK_PKCS11_FUNCTION_INFO(C_InitPIN)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,  /* the session's handle */
--  CK_UTF8CHAR_PTR   pPin,      /* the normal user's PIN */
--  CK_ULONG          ulPinLen   /* length in bytes of the PIN */
--);
-+    CK_SESSION_HANDLE hSession, /* the session's handle */
-+    CK_UTF8CHAR_PTR pPin,       /* the normal user's PIN */
-+    CK_ULONG ulPinLen           /* length in bytes of the PIN */
-+    );
- #endif
- 
--
- /* C_SetPIN modifies the PIN of the user who is logged in. */
- CK_PKCS11_FUNCTION_INFO(C_SetPIN)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,  /* the session's handle */
--  CK_UTF8CHAR_PTR   pOldPin,   /* the old PIN */
--  CK_ULONG          ulOldLen,  /* length of the old PIN */
--  CK_UTF8CHAR_PTR   pNewPin,   /* the new PIN */
--  CK_ULONG          ulNewLen   /* length of the new PIN */
--);
-+    CK_SESSION_HANDLE hSession, /* the session's handle */
-+    CK_UTF8CHAR_PTR pOldPin,    /* the old PIN */
-+    CK_ULONG ulOldLen,          /* length of the old PIN */
-+    CK_UTF8CHAR_PTR pNewPin,    /* the new PIN */
-+    CK_ULONG ulNewLen           /* length of the new PIN */
-+    );
- #endif
- 
--
--
- /* Session management */
- 
- /* C_OpenSession opens a session between an application and a
-- * token.
-- */
-+ * token. */
- CK_PKCS11_FUNCTION_INFO(C_OpenSession)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SLOT_ID            slotID,        /* the slot's ID */
--  CK_FLAGS              flags,         /* from CK_SESSION_INFO */
--  CK_VOID_PTR           pApplication,  /* passed to callback */
--  CK_NOTIFY             Notify,        /* callback function */
--  CK_SESSION_HANDLE_PTR phSession      /* gets session handle */
--);
-+    CK_SLOT_ID slotID,              /* the slot's ID */
-+    CK_FLAGS flags,                 /* from CK_SESSION_INFO */
-+    CK_VOID_PTR pApplication,       /* passed to callback */
-+    CK_NOTIFY Notify,               /* callback function */
-+    CK_SESSION_HANDLE_PTR phSession /* gets session handle */
-+    );
- #endif
- 
--
- /* C_CloseSession closes a session between an application and a
-- * token.
-- */
-+ * token. */
- CK_PKCS11_FUNCTION_INFO(C_CloseSession)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession  /* the session's handle */
--);
-+    CK_SESSION_HANDLE hSession /* the session's handle */
-+    );
- #endif
- 
--
- /* C_CloseAllSessions closes all sessions with a token. */
- CK_PKCS11_FUNCTION_INFO(C_CloseAllSessions)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SLOT_ID     slotID  /* the token's slot */
--);
-+    CK_SLOT_ID slotID /* the token's slot */
-+    );
- #endif
- 
--
- /* C_GetSessionInfo obtains information about the session. */
- CK_PKCS11_FUNCTION_INFO(C_GetSessionInfo)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE   hSession,  /* the session's handle */
--  CK_SESSION_INFO_PTR pInfo      /* receives session info */
--);
-+    CK_SESSION_HANDLE hSession, /* the session's handle */
-+    CK_SESSION_INFO_PTR pInfo   /* receives session info */
-+    );
- #endif
- 
--
- /* C_GetOperationState obtains the state of the cryptographic operation
-- * in a session.
-- */
-+ * in a session. */
- CK_PKCS11_FUNCTION_INFO(C_GetOperationState)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,             /* session's handle */
--  CK_BYTE_PTR       pOperationState,      /* gets state */
--  CK_ULONG_PTR      pulOperationStateLen  /* gets state length */
--);
-+    CK_SESSION_HANDLE hSession,       /* session's handle */
-+    CK_BYTE_PTR pOperationState,      /* gets state */
-+    CK_ULONG_PTR pulOperationStateLen /* gets state length */
-+    );
- #endif
- 
--
- /* C_SetOperationState restores the state of the cryptographic
-- * operation in a session.
-- */
-+ * operation in a session. */
- CK_PKCS11_FUNCTION_INFO(C_SetOperationState)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,            /* session's handle */
--  CK_BYTE_PTR      pOperationState,      /* holds state */
--  CK_ULONG         ulOperationStateLen,  /* holds state length */
--  CK_OBJECT_HANDLE hEncryptionKey,       /* en/decryption key */
--  CK_OBJECT_HANDLE hAuthenticationKey    /* sign/verify key */
--);
-+    CK_SESSION_HANDLE hSession,         /* session's handle */
-+    CK_BYTE_PTR pOperationState,        /* holds state */
-+    CK_ULONG ulOperationStateLen,       /* holds state length */
-+    CK_OBJECT_HANDLE hEncryptionKey,    /* en/decryption key */
-+    CK_OBJECT_HANDLE hAuthenticationKey /* sign/verify key */
-+    );
- #endif
- 
--
- /* C_Login logs a user into a token. */
- CK_PKCS11_FUNCTION_INFO(C_Login)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,  /* the session's handle */
--  CK_USER_TYPE      userType,  /* the user type */
--  CK_UTF8CHAR_PTR   pPin,      /* the user's PIN */
--  CK_ULONG          ulPinLen   /* the length of the PIN */
--);
-+    CK_SESSION_HANDLE hSession, /* the session's handle */
-+    CK_USER_TYPE userType,      /* the user type */
-+    CK_UTF8CHAR_PTR pPin,       /* the user's PIN */
-+    CK_ULONG ulPinLen           /* the length of the PIN */
-+    );
- #endif
- 
--
- /* C_Logout logs a user out from a token. */
- CK_PKCS11_FUNCTION_INFO(C_Logout)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession  /* the session's handle */
--);
-+    CK_SESSION_HANDLE hSession /* the session's handle */
-+    );
- #endif
- 
--
--
- /* Object management */
- 
- /* C_CreateObject creates a new object. */
- CK_PKCS11_FUNCTION_INFO(C_CreateObject)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,    /* the session's handle */
--  CK_ATTRIBUTE_PTR  pTemplate,   /* the object's template */
--  CK_ULONG          ulCount,     /* attributes in template */
--  CK_OBJECT_HANDLE_PTR phObject  /* gets new object's handle. */
--);
-+    CK_SESSION_HANDLE hSession,   /* the session's handle */
-+    CK_ATTRIBUTE_PTR pTemplate,   /* the object's template */
-+    CK_ULONG ulCount,             /* attributes in template */
-+    CK_OBJECT_HANDLE_PTR phObject /* gets new object's handle. */
-+    );
- #endif
- 
--
- /* C_CopyObject copies an object, creating a new object for the
-- * copy.
-- */
-+ * copy. */
- CK_PKCS11_FUNCTION_INFO(C_CopyObject)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE    hSession,    /* the session's handle */
--  CK_OBJECT_HANDLE     hObject,     /* the object's handle */
--  CK_ATTRIBUTE_PTR     pTemplate,   /* template for new object */
--  CK_ULONG             ulCount,     /* attributes in template */
--  CK_OBJECT_HANDLE_PTR phNewObject  /* receives handle of copy */
--);
-+    CK_SESSION_HANDLE hSession,      /* the session's handle */
-+    CK_OBJECT_HANDLE hObject,        /* the object's handle */
-+    CK_ATTRIBUTE_PTR pTemplate,      /* template for new object */
-+    CK_ULONG ulCount,                /* attributes in template */
-+    CK_OBJECT_HANDLE_PTR phNewObject /* receives handle of copy */
-+    );
- #endif
- 
--
- /* C_DestroyObject destroys an object. */
- CK_PKCS11_FUNCTION_INFO(C_DestroyObject)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,  /* the session's handle */
--  CK_OBJECT_HANDLE  hObject    /* the object's handle */
--);
-+    CK_SESSION_HANDLE hSession, /* the session's handle */
-+    CK_OBJECT_HANDLE hObject    /* the object's handle */
-+    );
- #endif
- 
--
- /* C_GetObjectSize gets the size of an object in bytes. */
- CK_PKCS11_FUNCTION_INFO(C_GetObjectSize)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,  /* the session's handle */
--  CK_OBJECT_HANDLE  hObject,   /* the object's handle */
--  CK_ULONG_PTR      pulSize    /* receives size of object */
--);
-+    CK_SESSION_HANDLE hSession, /* the session's handle */
-+    CK_OBJECT_HANDLE hObject,   /* the object's handle */
-+    CK_ULONG_PTR pulSize        /* receives size of object */
-+    );
- #endif
- 
--
- /* C_GetAttributeValue obtains the value of one or more object
-- * attributes.
-- */
-+ * attributes. */
- CK_PKCS11_FUNCTION_INFO(C_GetAttributeValue)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,   /* the session's handle */
--  CK_OBJECT_HANDLE  hObject,    /* the object's handle */
--  CK_ATTRIBUTE_PTR  pTemplate,  /* specifies attrs; gets vals */
--  CK_ULONG          ulCount     /* attributes in template */
--);
-+    CK_SESSION_HANDLE hSession, /* the session's handle */
-+    CK_OBJECT_HANDLE hObject,   /* the object's handle */
-+    CK_ATTRIBUTE_PTR pTemplate, /* specifies attrs; gets vals */
-+    CK_ULONG ulCount            /* attributes in template */
-+    );
- #endif
- 
--
- /* C_SetAttributeValue modifies the value of one or more object
-- * attributes.
-- */
-+ * attributes */
- CK_PKCS11_FUNCTION_INFO(C_SetAttributeValue)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,   /* the session's handle */
--  CK_OBJECT_HANDLE  hObject,    /* the object's handle */
--  CK_ATTRIBUTE_PTR  pTemplate,  /* specifies attrs and values */
--  CK_ULONG          ulCount     /* attributes in template */
--);
-+    CK_SESSION_HANDLE hSession, /* the session's handle */
-+    CK_OBJECT_HANDLE hObject,   /* the object's handle */
-+    CK_ATTRIBUTE_PTR pTemplate, /* specifies attrs and values */
-+    CK_ULONG ulCount            /* attributes in template */
-+    );
- #endif
- 
--
- /* C_FindObjectsInit initializes a search for token and session
-- * objects that match a template.
-- */
-+ * objects that match a template. */
- CK_PKCS11_FUNCTION_INFO(C_FindObjectsInit)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,   /* the session's handle */
--  CK_ATTRIBUTE_PTR  pTemplate,  /* attribute values to match */
--  CK_ULONG          ulCount     /* attrs in search template */
--);
-+    CK_SESSION_HANDLE hSession, /* the session's handle */
-+    CK_ATTRIBUTE_PTR pTemplate, /* attribute values to match */
-+    CK_ULONG ulCount            /* attrs in search template */
-+    );
- #endif
- 
--
- /* C_FindObjects continues a search for token and session
-  * objects that match a template, obtaining additional object
-- * handles.
-- */
-+ * handles. */
- CK_PKCS11_FUNCTION_INFO(C_FindObjects)
- #ifdef CK_NEED_ARG_LIST
- (
-- CK_SESSION_HANDLE    hSession,          /* session's handle */
-- CK_OBJECT_HANDLE_PTR phObject,          /* gets obj. handles */
-- CK_ULONG             ulMaxObjectCount,  /* max handles to get */
-- CK_ULONG_PTR         pulObjectCount     /* actual # returned */
--);
-+    CK_SESSION_HANDLE hSession,    /* session's handle */
-+    CK_OBJECT_HANDLE_PTR phObject, /* gets obj. handles */
-+    CK_ULONG ulMaxObjectCount,     /* max handles to get */
-+    CK_ULONG_PTR pulObjectCount    /* actual # returned */
-+    );
- #endif
- 
--
- /* C_FindObjectsFinal finishes a search for token and session
-- * objects.
-- */
-+ * objects. */
- CK_PKCS11_FUNCTION_INFO(C_FindObjectsFinal)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession  /* the session's handle */
--);
-+    CK_SESSION_HANDLE hSession /* the session's handle */
-+    );
- #endif
- 
--
--
- /* Encryption and decryption */
- 
- /* C_EncryptInit initializes an encryption operation. */
- CK_PKCS11_FUNCTION_INFO(C_EncryptInit)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,    /* the session's handle */
--  CK_MECHANISM_PTR  pMechanism,  /* the encryption mechanism */
--  CK_OBJECT_HANDLE  hKey         /* handle of encryption key */
--);
-+    CK_SESSION_HANDLE hSession,  /* the session's handle */
-+    CK_MECHANISM_PTR pMechanism, /* the encryption mechanism */
-+    CK_OBJECT_HANDLE hKey        /* handle of encryption key */
-+    );
- #endif
- 
--
- /* C_Encrypt encrypts single-part data. */
- CK_PKCS11_FUNCTION_INFO(C_Encrypt)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,            /* session's handle */
--  CK_BYTE_PTR       pData,               /* the plaintext data */
--  CK_ULONG          ulDataLen,           /* bytes of plaintext */
--  CK_BYTE_PTR       pEncryptedData,      /* gets ciphertext */
--  CK_ULONG_PTR      pulEncryptedDataLen  /* gets c-text size */
--);
-+    CK_SESSION_HANDLE hSession,      /* session's handle */
-+    CK_BYTE_PTR pData,               /* the plaintext data */
-+    CK_ULONG ulDataLen,              /* bytes of plaintext */
-+    CK_BYTE_PTR pEncryptedData,      /* gets ciphertext */
-+    CK_ULONG_PTR pulEncryptedDataLen /* gets c-text size */
-+    );
- #endif
- 
--
- /* C_EncryptUpdate continues a multiple-part encryption
-- * operation.
-- */
-+ * operation. */
- CK_PKCS11_FUNCTION_INFO(C_EncryptUpdate)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,           /* session's handle */
--  CK_BYTE_PTR       pPart,              /* the plaintext data */
--  CK_ULONG          ulPartLen,          /* plaintext data len */
--  CK_BYTE_PTR       pEncryptedPart,     /* gets ciphertext */
--  CK_ULONG_PTR      pulEncryptedPartLen /* gets c-text size */
--);
-+    CK_SESSION_HANDLE hSession,      /* session's handle */
-+    CK_BYTE_PTR pPart,               /* the plaintext data */
-+    CK_ULONG ulPartLen,              /* plaintext data len */
-+    CK_BYTE_PTR pEncryptedPart,      /* gets ciphertext */
-+    CK_ULONG_PTR pulEncryptedPartLen /* gets c-text size */
-+    );
- #endif
- 
--
- /* C_EncryptFinal finishes a multiple-part encryption
-- * operation.
-- */
-+ * operation. */
- CK_PKCS11_FUNCTION_INFO(C_EncryptFinal)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,                /* session handle */
--  CK_BYTE_PTR       pLastEncryptedPart,      /* last c-text */
--  CK_ULONG_PTR      pulLastEncryptedPartLen  /* gets last size */
--);
-+    CK_SESSION_HANDLE hSession,          /* session handle */
-+    CK_BYTE_PTR pLastEncryptedPart,      /* last c-text */
-+    CK_ULONG_PTR pulLastEncryptedPartLen /* gets last size */
-+    );
- #endif
- 
--
- /* C_DecryptInit initializes a decryption operation. */
- CK_PKCS11_FUNCTION_INFO(C_DecryptInit)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,    /* the session's handle */
--  CK_MECHANISM_PTR  pMechanism,  /* the decryption mechanism */
--  CK_OBJECT_HANDLE  hKey         /* handle of decryption key */
--);
-+    CK_SESSION_HANDLE hSession,  /* the session's handle */
-+    CK_MECHANISM_PTR pMechanism, /* the decryption mechanism */
-+    CK_OBJECT_HANDLE hKey        /* handle of decryption key */
-+    );
- #endif
- 
--
- /* C_Decrypt decrypts encrypted data in a single part. */
- CK_PKCS11_FUNCTION_INFO(C_Decrypt)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,           /* session's handle */
--  CK_BYTE_PTR       pEncryptedData,     /* ciphertext */
--  CK_ULONG          ulEncryptedDataLen, /* ciphertext length */
--  CK_BYTE_PTR       pData,              /* gets plaintext */
--  CK_ULONG_PTR      pulDataLen          /* gets p-text size */
--);
-+    CK_SESSION_HANDLE hSession,  /* session's handle */
-+    CK_BYTE_PTR pEncryptedData,  /* ciphertext */
-+    CK_ULONG ulEncryptedDataLen, /* ciphertext length */
-+    CK_BYTE_PTR pData,           /* gets plaintext */
-+    CK_ULONG_PTR pulDataLen      /* gets p-text size */
-+    );
- #endif
- 
--
- /* C_DecryptUpdate continues a multiple-part decryption
-- * operation.
-- */
-+ * operation. */
- CK_PKCS11_FUNCTION_INFO(C_DecryptUpdate)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,            /* session's handle */
--  CK_BYTE_PTR       pEncryptedPart,      /* encrypted data */
--  CK_ULONG          ulEncryptedPartLen,  /* input length */
--  CK_BYTE_PTR       pPart,               /* gets plaintext */
--  CK_ULONG_PTR      pulPartLen           /* p-text size */
--);
-+    CK_SESSION_HANDLE hSession,  /* session's handle */
-+    CK_BYTE_PTR pEncryptedPart,  /* encrypted data */
-+    CK_ULONG ulEncryptedPartLen, /* input length */
-+    CK_BYTE_PTR pPart,           /* gets plaintext */
-+    CK_ULONG_PTR pulPartLen      /* p-text size */
-+    );
- #endif
- 
--
- /* C_DecryptFinal finishes a multiple-part decryption
-- * operation.
-- */
-+ * operation. */
- CK_PKCS11_FUNCTION_INFO(C_DecryptFinal)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,       /* the session's handle */
--  CK_BYTE_PTR       pLastPart,      /* gets plaintext */
--  CK_ULONG_PTR      pulLastPartLen  /* p-text size */
--);
-+    CK_SESSION_HANDLE hSession, /* the session's handle */
-+    CK_BYTE_PTR pLastPart,      /* gets plaintext */
-+    CK_ULONG_PTR pulLastPartLen /* p-text size */
-+    );
- #endif
- 
--
--
- /* Message digesting */
- 
- /* C_DigestInit initializes a message-digesting operation. */
- CK_PKCS11_FUNCTION_INFO(C_DigestInit)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,   /* the session's handle */
--  CK_MECHANISM_PTR  pMechanism  /* the digesting mechanism */
--);
-+    CK_SESSION_HANDLE hSession, /* the session's handle */
-+    CK_MECHANISM_PTR pMechanism /* the digesting mechanism */
-+    );
- #endif
- 
--
- /* C_Digest digests data in a single part. */
- CK_PKCS11_FUNCTION_INFO(C_Digest)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,     /* the session's handle */
--  CK_BYTE_PTR       pData,        /* data to be digested */
--  CK_ULONG          ulDataLen,    /* bytes of data to digest */
--  CK_BYTE_PTR       pDigest,      /* gets the message digest */
--  CK_ULONG_PTR      pulDigestLen  /* gets digest length */
--);
-+    CK_SESSION_HANDLE hSession, /* the session's handle */
-+    CK_BYTE_PTR pData,          /* data to be digested */
-+    CK_ULONG ulDataLen,         /* bytes of data to digest */
-+    CK_BYTE_PTR pDigest,        /* gets the message digest */
-+    CK_ULONG_PTR pulDigestLen   /* gets digest length */
-+    );
- #endif
- 
--
- /* C_DigestUpdate continues a multiple-part message-digesting
-- * operation.
-- */
-+ * operation. */
- CK_PKCS11_FUNCTION_INFO(C_DigestUpdate)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,  /* the session's handle */
--  CK_BYTE_PTR       pPart,     /* data to be digested */
--  CK_ULONG          ulPartLen  /* bytes of data to be digested */
--);
-+    CK_SESSION_HANDLE hSession, /* the session's handle */
-+    CK_BYTE_PTR pPart,          /* data to be digested */
-+    CK_ULONG ulPartLen          /* bytes of data to be digested */
-+    );
- #endif
- 
--
- /* C_DigestKey continues a multi-part message-digesting
-  * operation, by digesting the value of a secret key as part of
-- * the data already digested.
-- */
-+ * the data already digested. */
- CK_PKCS11_FUNCTION_INFO(C_DigestKey)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,  /* the session's handle */
--  CK_OBJECT_HANDLE  hKey       /* secret key to digest */
--);
-+    CK_SESSION_HANDLE hSession, /* the session's handle */
-+    CK_OBJECT_HANDLE hKey       /* secret key to digest */
-+    );
- #endif
- 
--
- /* C_DigestFinal finishes a multiple-part message-digesting
-- * operation.
-- */
-+ * operation. */
- CK_PKCS11_FUNCTION_INFO(C_DigestFinal)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,     /* the session's handle */
--  CK_BYTE_PTR       pDigest,      /* gets the message digest */
--  CK_ULONG_PTR      pulDigestLen  /* gets byte count of digest */
--);
-+    CK_SESSION_HANDLE hSession, /* the session's handle */
-+    CK_BYTE_PTR pDigest,        /* gets the message digest */
-+    CK_ULONG_PTR pulDigestLen   /* gets byte count of digest */
-+    );
- #endif
- 
--
--
- /* Signing and MACing */
- 
- /* C_SignInit initializes a signature (private key encryption)
-  * operation, where the signature is (will be) an appendix to
-  * the data, and plaintext cannot be recovered from the
-- * signature.
-- */
-+ *signature. */
- CK_PKCS11_FUNCTION_INFO(C_SignInit)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,    /* the session's handle */
--  CK_MECHANISM_PTR  pMechanism,  /* the signature mechanism */
--  CK_OBJECT_HANDLE  hKey         /* handle of signature key */
--);
-+    CK_SESSION_HANDLE hSession,  /* the session's handle */
-+    CK_MECHANISM_PTR pMechanism, /* the signature mechanism */
-+    CK_OBJECT_HANDLE hKey        /* handle of signature key */
-+    );
- #endif
- 
--
- /* C_Sign signs (encrypts with private key) data in a single
-  * part, where the signature is (will be) an appendix to the
-- * data, and plaintext cannot be recovered from the signature.
-- */
-+ * data, and plaintext cannot be recovered from the signature. */
- CK_PKCS11_FUNCTION_INFO(C_Sign)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,        /* the session's handle */
--  CK_BYTE_PTR       pData,           /* the data to sign */
--  CK_ULONG          ulDataLen,       /* count of bytes to sign */
--  CK_BYTE_PTR       pSignature,      /* gets the signature */
--  CK_ULONG_PTR      pulSignatureLen  /* gets signature length */
--);
-+    CK_SESSION_HANDLE hSession,  /* the session's handle */
-+    CK_BYTE_PTR pData,           /* the data to sign */
-+    CK_ULONG ulDataLen,          /* count of bytes to sign */
-+    CK_BYTE_PTR pSignature,      /* gets the signature */
-+    CK_ULONG_PTR pulSignatureLen /* gets signature length */
-+    );
- #endif
- 
--
- /* C_SignUpdate continues a multiple-part signature operation,
-  * where the signature is (will be) an appendix to the data,
-- * and plaintext cannot be recovered from the signature.
-- */
-+ * and plaintext cannot be recovered from the signature. */
- CK_PKCS11_FUNCTION_INFO(C_SignUpdate)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,  /* the session's handle */
--  CK_BYTE_PTR       pPart,     /* the data to sign */
--  CK_ULONG          ulPartLen  /* count of bytes to sign */
--);
-+    CK_SESSION_HANDLE hSession, /* the session's handle */
-+    CK_BYTE_PTR pPart,          /* the data to sign */
-+    CK_ULONG ulPartLen          /* count of bytes to sign */
-+    );
- #endif
- 
--
- /* C_SignFinal finishes a multiple-part signature operation,
-- * returning the signature.
-- */
-+ * returning the signature. */
- CK_PKCS11_FUNCTION_INFO(C_SignFinal)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,        /* the session's handle */
--  CK_BYTE_PTR       pSignature,      /* gets the signature */
--  CK_ULONG_PTR      pulSignatureLen  /* gets signature length */
--);
-+    CK_SESSION_HANDLE hSession,  /* the session's handle */
-+    CK_BYTE_PTR pSignature,      /* gets the signature */
-+    CK_ULONG_PTR pulSignatureLen /* gets signature length */
-+    );
- #endif
- 
--
- /* C_SignRecoverInit initializes a signature operation, where
-- * the data can be recovered from the signature.
-- */
-+ * the data can be recovered from the signature. */
- CK_PKCS11_FUNCTION_INFO(C_SignRecoverInit)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,   /* the session's handle */
--  CK_MECHANISM_PTR  pMechanism, /* the signature mechanism */
--  CK_OBJECT_HANDLE  hKey        /* handle of the signature key */
--);
-+    CK_SESSION_HANDLE hSession,  /* the session's handle */
-+    CK_MECHANISM_PTR pMechanism, /* the signature mechanism */
-+    CK_OBJECT_HANDLE hKey        /* handle of the signature key */
-+    );
- #endif
- 
--
- /* C_SignRecover signs data in a single operation, where the
-- * data can be recovered from the signature.
-- */
-+ * data can be recovered from the signature. */
- CK_PKCS11_FUNCTION_INFO(C_SignRecover)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,        /* the session's handle */
--  CK_BYTE_PTR       pData,           /* the data to sign */
--  CK_ULONG          ulDataLen,       /* count of bytes to sign */
--  CK_BYTE_PTR       pSignature,      /* gets the signature */
--  CK_ULONG_PTR      pulSignatureLen  /* gets signature length */
--);
-+    CK_SESSION_HANDLE hSession,  /* the session's handle */
-+    CK_BYTE_PTR pData,           /* the data to sign */
-+    CK_ULONG ulDataLen,          /* count of bytes to sign */
-+    CK_BYTE_PTR pSignature,      /* gets the signature */
-+    CK_ULONG_PTR pulSignatureLen /* gets signature length */
-+    );
- #endif
- 
--
--
- /* Verifying signatures and MACs */
- 
- /* C_VerifyInit initializes a verification operation, where the
-  * signature is an appendix to the data, and plaintext cannot
-- * cannot be recovered from the signature (e.g. DSA).
-- */
-+ *  cannot be recovered from the signature (e.g. DSA). */
- CK_PKCS11_FUNCTION_INFO(C_VerifyInit)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,    /* the session's handle */
--  CK_MECHANISM_PTR  pMechanism,  /* the verification mechanism */
--  CK_OBJECT_HANDLE  hKey         /* verification key */
--);
-+    CK_SESSION_HANDLE hSession,  /* the session's handle */
-+    CK_MECHANISM_PTR pMechanism, /* the verification mechanism */
-+    CK_OBJECT_HANDLE hKey        /* verification key */
-+    );
- #endif
- 
--
- /* C_Verify verifies a signature in a single-part operation,
-  * where the signature is an appendix to the data, and plaintext
-- * cannot be recovered from the signature.
-- */
-+ * cannot be recovered from the signature. */
- CK_PKCS11_FUNCTION_INFO(C_Verify)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,       /* the session's handle */
--  CK_BYTE_PTR       pData,          /* signed data */
--  CK_ULONG          ulDataLen,      /* length of signed data */
--  CK_BYTE_PTR       pSignature,     /* signature */
--  CK_ULONG          ulSignatureLen  /* signature length*/
--);
-+    CK_SESSION_HANDLE hSession, /* the session's handle */
-+    CK_BYTE_PTR pData,          /* signed data */
-+    CK_ULONG ulDataLen,         /* length of signed data */
-+    CK_BYTE_PTR pSignature,     /* signature */
-+    CK_ULONG ulSignatureLen     /* signature length*/
-+    );
- #endif
- 
--
- /* C_VerifyUpdate continues a multiple-part verification
-  * operation, where the signature is an appendix to the data,
-- * and plaintext cannot be recovered from the signature.
-- */
-+ * and plaintext cannot be recovered from the signature. */
- CK_PKCS11_FUNCTION_INFO(C_VerifyUpdate)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,  /* the session's handle */
--  CK_BYTE_PTR       pPart,     /* signed data */
--  CK_ULONG          ulPartLen  /* length of signed data */
--);
-+    CK_SESSION_HANDLE hSession, /* the session's handle */
-+    CK_BYTE_PTR pPart,          /* signed data */
-+    CK_ULONG ulPartLen          /* length of signed data */
-+    );
- #endif
- 
--
- /* C_VerifyFinal finishes a multiple-part verification
-- * operation, checking the signature.
-- */
-+ * operation, checking the signature. */
- CK_PKCS11_FUNCTION_INFO(C_VerifyFinal)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,       /* the session's handle */
--  CK_BYTE_PTR       pSignature,     /* signature to verify */
--  CK_ULONG          ulSignatureLen  /* signature length */
--);
-+    CK_SESSION_HANDLE hSession, /* the session's handle */
-+    CK_BYTE_PTR pSignature,     /* signature to verify */
-+    CK_ULONG ulSignatureLen     /* signature length */
-+    );
- #endif
- 
--
- /* C_VerifyRecoverInit initializes a signature verification
-- * operation, where the data is recovered from the signature.
-- */
-+ * operation, where the data is recovered from the signature. */
- CK_PKCS11_FUNCTION_INFO(C_VerifyRecoverInit)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,    /* the session's handle */
--  CK_MECHANISM_PTR  pMechanism,  /* the verification mechanism */
--  CK_OBJECT_HANDLE  hKey         /* verification key */
--);
-+    CK_SESSION_HANDLE hSession,  /* the session's handle */
-+    CK_MECHANISM_PTR pMechanism, /* the verification mechanism */
-+    CK_OBJECT_HANDLE hKey        /* verification key */
-+    );
- #endif
- 
--
- /* C_VerifyRecover verifies a signature in a single-part
-- * operation, where the data is recovered from the signature.
-- */
-+ * operation, where the data is recovered from the signature. */
- CK_PKCS11_FUNCTION_INFO(C_VerifyRecover)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,        /* the session's handle */
--  CK_BYTE_PTR       pSignature,      /* signature to verify */
--  CK_ULONG          ulSignatureLen,  /* signature length */
--  CK_BYTE_PTR       pData,           /* gets signed data */
--  CK_ULONG_PTR      pulDataLen       /* gets signed data len */
--);
-+    CK_SESSION_HANDLE hSession, /* the session's handle */
-+    CK_BYTE_PTR pSignature,     /* signature to verify */
-+    CK_ULONG ulSignatureLen,    /* signature length */
-+    CK_BYTE_PTR pData,          /* gets signed data */
-+    CK_ULONG_PTR pulDataLen     /* gets signed data len */
-+    );
- #endif
- 
--
--
- /* Dual-function cryptographic operations */
- 
- /* C_DigestEncryptUpdate continues a multiple-part digesting
-- * and encryption operation.
-- */
-+ * and encryption operation. */
- CK_PKCS11_FUNCTION_INFO(C_DigestEncryptUpdate)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,            /* session's handle */
--  CK_BYTE_PTR       pPart,               /* the plaintext data */
--  CK_ULONG          ulPartLen,           /* plaintext length */
--  CK_BYTE_PTR       pEncryptedPart,      /* gets ciphertext */
--  CK_ULONG_PTR      pulEncryptedPartLen  /* gets c-text length */
--);
-+    CK_SESSION_HANDLE hSession,      /* session's handle */
-+    CK_BYTE_PTR pPart,               /* the plaintext data */
-+    CK_ULONG ulPartLen,              /* plaintext length */
-+    CK_BYTE_PTR pEncryptedPart,      /* gets ciphertext */
-+    CK_ULONG_PTR pulEncryptedPartLen /* gets c-text length */
-+    );
- #endif
- 
--
- /* C_DecryptDigestUpdate continues a multiple-part decryption and
-- * digesting operation.
-- */
-+ * digesting operation. */
- CK_PKCS11_FUNCTION_INFO(C_DecryptDigestUpdate)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,            /* session's handle */
--  CK_BYTE_PTR       pEncryptedPart,      /* ciphertext */
--  CK_ULONG          ulEncryptedPartLen,  /* ciphertext length */
--  CK_BYTE_PTR       pPart,               /* gets plaintext */
--  CK_ULONG_PTR      pulPartLen           /* gets plaintext len */
--);
-+    CK_SESSION_HANDLE hSession,  /* session's handle */
-+    CK_BYTE_PTR pEncryptedPart,  /* ciphertext */
-+    CK_ULONG ulEncryptedPartLen, /* ciphertext length */
-+    CK_BYTE_PTR pPart,           /* gets plaintext */
-+    CK_ULONG_PTR pulPartLen      /* gets plaintext len */
-+    );
- #endif
- 
--
- /* C_SignEncryptUpdate continues a multiple-part signing and
-- * encryption operation.
-- */
-+ * encryption operation. */
- CK_PKCS11_FUNCTION_INFO(C_SignEncryptUpdate)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,            /* session's handle */
--  CK_BYTE_PTR       pPart,               /* the plaintext data */
--  CK_ULONG          ulPartLen,           /* plaintext length */
--  CK_BYTE_PTR       pEncryptedPart,      /* gets ciphertext */
--  CK_ULONG_PTR      pulEncryptedPartLen  /* gets c-text length */
--);
-+    CK_SESSION_HANDLE hSession,      /* session's handle */
-+    CK_BYTE_PTR pPart,               /* the plaintext data */
-+    CK_ULONG ulPartLen,              /* plaintext length */
-+    CK_BYTE_PTR pEncryptedPart,      /* gets ciphertext */
-+    CK_ULONG_PTR pulEncryptedPartLen /* gets c-text length */
-+    );
- #endif
- 
--
- /* C_DecryptVerifyUpdate continues a multiple-part decryption and
-- * verify operation.
-- */
-+ * verify operation. */
- CK_PKCS11_FUNCTION_INFO(C_DecryptVerifyUpdate)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,            /* session's handle */
--  CK_BYTE_PTR       pEncryptedPart,      /* ciphertext */
--  CK_ULONG          ulEncryptedPartLen,  /* ciphertext length */
--  CK_BYTE_PTR       pPart,               /* gets plaintext */
--  CK_ULONG_PTR      pulPartLen           /* gets p-text length */
--);
-+    CK_SESSION_HANDLE hSession,  /* session's handle */
-+    CK_BYTE_PTR pEncryptedPart,  /* ciphertext */
-+    CK_ULONG ulEncryptedPartLen, /* ciphertext length */
-+    CK_BYTE_PTR pPart,           /* gets plaintext */
-+    CK_ULONG_PTR pulPartLen      /* gets p-text length */
-+    );
- #endif
- 
--
--
- /* Key management */
- 
- /* C_GenerateKey generates a secret key, creating a new key
-- * object.
-- */
-+ * object. */
- CK_PKCS11_FUNCTION_INFO(C_GenerateKey)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE    hSession,    /* the session's handle */
--  CK_MECHANISM_PTR     pMechanism,  /* key generation mech. */
--  CK_ATTRIBUTE_PTR     pTemplate,   /* template for new key */
--  CK_ULONG             ulCount,     /* # of attrs in template */
--  CK_OBJECT_HANDLE_PTR phKey        /* gets handle of new key */
--);
-+    CK_SESSION_HANDLE hSession,  /* the session's handle */
-+    CK_MECHANISM_PTR pMechanism, /* key generation mech. */
-+    CK_ATTRIBUTE_PTR pTemplate,  /* template for new key */
-+    CK_ULONG ulCount,            /* # of attrs in template */
-+    CK_OBJECT_HANDLE_PTR phKey   /* gets handle of new key */
-+    );
- #endif
- 
--
- /* C_GenerateKeyPair generates a public-key/private-key pair,
-- * creating new key objects.
-- */
-+ * creating new key objects. */
- CK_PKCS11_FUNCTION_INFO(C_GenerateKeyPair)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE    hSession,                    /* session handle */
--  CK_MECHANISM_PTR     pMechanism,                  /* key-gen mech. */
--  CK_ATTRIBUTE_PTR     pPublicKeyTemplate,          /* template for pub. key */
--  CK_ULONG             ulPublicKeyAttributeCount,   /* # pub. attrs. */
--  CK_ATTRIBUTE_PTR     pPrivateKeyTemplate,         /* template for priv. key */
--  CK_ULONG             ulPrivateKeyAttributeCount,  /* # priv.  attrs. */
--  CK_OBJECT_HANDLE_PTR phPublicKey,                 /* gets pub. key handle */
--  CK_OBJECT_HANDLE_PTR phPrivateKey                 /* gets priv. key handle */
--);
-+    CK_SESSION_HANDLE hSession,           /* session handle */
-+    CK_MECHANISM_PTR pMechanism,          /* key-gen mech. */
-+    CK_ATTRIBUTE_PTR pPublicKeyTemplate,  /* template for pub. key */
-+    CK_ULONG ulPublicKeyAttributeCount,   /* # pub. attrs. */
-+    CK_ATTRIBUTE_PTR pPrivateKeyTemplate, /* template for priv. key */
-+    CK_ULONG ulPrivateKeyAttributeCount,  /* # priv. attrs. */
-+    CK_OBJECT_HANDLE_PTR phPublicKey,     /* gets pub. key handle */
-+    CK_OBJECT_HANDLE_PTR phPrivateKey     /* gets priv. key handle */
-+    );
- #endif
- 
--
- /* C_WrapKey wraps (i.e., encrypts) a key. */
- CK_PKCS11_FUNCTION_INFO(C_WrapKey)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,        /* the session's handle */
--  CK_MECHANISM_PTR  pMechanism,      /* the wrapping mechanism */
--  CK_OBJECT_HANDLE  hWrappingKey,    /* wrapping key */
--  CK_OBJECT_HANDLE  hKey,            /* key to be wrapped */
--  CK_BYTE_PTR       pWrappedKey,     /* gets wrapped key */
--  CK_ULONG_PTR      pulWrappedKeyLen /* gets wrapped key size */
--);
-+    CK_SESSION_HANDLE hSession,    /* the session's handle */
-+    CK_MECHANISM_PTR pMechanism,   /* the wrapping mechanism */
-+    CK_OBJECT_HANDLE hWrappingKey, /* wrapping key */
-+    CK_OBJECT_HANDLE hKey,         /* key to be wrapped */
-+    CK_BYTE_PTR pWrappedKey,       /* gets wrapped key */
-+    CK_ULONG_PTR pulWrappedKeyLen  /* gets wrapped key size */
-+    );
- #endif
- 
--
- /* C_UnwrapKey unwraps (decrypts) a wrapped key, creating a new
-- * key object.
-- */
-+ * key object. */
- CK_PKCS11_FUNCTION_INFO(C_UnwrapKey)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE    hSession,          /* session's handle */
--  CK_MECHANISM_PTR     pMechanism,        /* unwrapping mech. */
--  CK_OBJECT_HANDLE     hUnwrappingKey,    /* unwrapping key */
--  CK_BYTE_PTR          pWrappedKey,       /* the wrapped key */
--  CK_ULONG             ulWrappedKeyLen,   /* wrapped key len */
--  CK_ATTRIBUTE_PTR     pTemplate,         /* new key template */
--  CK_ULONG             ulAttributeCount,  /* template length */
--  CK_OBJECT_HANDLE_PTR phKey              /* gets new handle */
--);
-+    CK_SESSION_HANDLE hSession,      /* session's handle */
-+    CK_MECHANISM_PTR pMechanism,     /* unwrapping mech. */
-+    CK_OBJECT_HANDLE hUnwrappingKey, /* unwrapping key */
-+    CK_BYTE_PTR pWrappedKey,         /* the wrapped key */
-+    CK_ULONG ulWrappedKeyLen,        /* wrapped key len */
-+    CK_ATTRIBUTE_PTR pTemplate,      /* new key template */
-+    CK_ULONG ulAttributeCount,       /* template length */
-+    CK_OBJECT_HANDLE_PTR phKey       /* gets new handle */
-+    );
- #endif
- 
--
- /* C_DeriveKey derives a key from a base key, creating a new key
-- * object.
-- */
-+ * object. */
- CK_PKCS11_FUNCTION_INFO(C_DeriveKey)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE    hSession,          /* session's handle */
--  CK_MECHANISM_PTR     pMechanism,        /* key deriv. mech. */
--  CK_OBJECT_HANDLE     hBaseKey,          /* base key */
--  CK_ATTRIBUTE_PTR     pTemplate,         /* new key template */
--  CK_ULONG             ulAttributeCount,  /* template length */
--  CK_OBJECT_HANDLE_PTR phKey              /* gets new handle */
--);
-+    CK_SESSION_HANDLE hSession,  /* session's handle */
-+    CK_MECHANISM_PTR pMechanism, /* key deriv. mech. */
-+    CK_OBJECT_HANDLE hBaseKey,   /* base key */
-+    CK_ATTRIBUTE_PTR pTemplate,  /* new key template */
-+    CK_ULONG ulAttributeCount,   /* template length */
-+    CK_OBJECT_HANDLE_PTR phKey   /* gets new handle */
-+    );
- #endif
- 
--
--
- /* Random number generation */
- 
- /* C_SeedRandom mixes additional seed material into the token's
-- * random number generator.
-- */
-+ * random number generator. */
- CK_PKCS11_FUNCTION_INFO(C_SeedRandom)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,  /* the session's handle */
--  CK_BYTE_PTR       pSeed,     /* the seed material */
--  CK_ULONG          ulSeedLen  /* length of seed material */
--);
-+    CK_SESSION_HANDLE hSession, /* the session's handle */
-+    CK_BYTE_PTR pSeed,          /* the seed material */
-+    CK_ULONG ulSeedLen          /* length of seed material */
-+    );
- #endif
- 
--
- /* C_GenerateRandom generates random data. */
- CK_PKCS11_FUNCTION_INFO(C_GenerateRandom)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,    /* the session's handle */
--  CK_BYTE_PTR       RandomData,  /* receives the random data */
--  CK_ULONG          ulRandomLen  /* # of bytes to generate */
--);
-+    CK_SESSION_HANDLE hSession, /* the session's handle */
-+    CK_BYTE_PTR RandomData,     /* receives the random data */
-+    CK_ULONG ulRandomLen        /* # of bytes to generate */
-+    );
- #endif
- 
--
--
- /* Parallel function management */
- 
- /* C_GetFunctionStatus is a legacy function; it obtains an
-  * updated status of a function running in parallel with an
-- * application.
-- */
-+ * application. */
- CK_PKCS11_FUNCTION_INFO(C_GetFunctionStatus)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession  /* the session's handle */
--);
-+    CK_SESSION_HANDLE hSession /* the session's handle */
-+    );
- #endif
- 
--
- /* C_CancelFunction is a legacy function; it cancels a function
-- * running in parallel.
-- */
-+ * running in parallel. */
- CK_PKCS11_FUNCTION_INFO(C_CancelFunction)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession  /* the session's handle */
--);
-+    CK_SESSION_HANDLE hSession /* the session's handle */
-+    );
- #endif
- 
-+/* Functions added in for PKCS #11 Version 2.01 or later */
- 
- /* C_WaitForSlotEvent waits for a slot event (token insertion,
-- * removal, etc.) to occur.
-- */
-+ * removal, etc.) to occur. */
- CK_PKCS11_FUNCTION_INFO(C_WaitForSlotEvent)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_FLAGS flags,        /* blocking/nonblocking flag */
--  CK_SLOT_ID_PTR pSlot,  /* location that receives the slot ID */
--  CK_VOID_PTR pRserved   /* reserved.  Should be NULL_PTR */
--);
-+    CK_FLAGS flags,       /* blocking/nonblocking flag */
-+    CK_SLOT_ID_PTR pSlot, /* location that receives the slot ID */
-+    CK_VOID_PTR pRserved  /* reserved.  Should be NULL_PTR */
-+    );
- #endif
- 
--#ifndef CK_PKCS11_2_0_ONLY
--/* C_GetInterfaceList returns all the interfaces supported by the module*/
-+#if defined(CK_PKCS11_3_0) && !defined(CK_PKCS11_2_0_ONLY)
- CK_PKCS11_FUNCTION_INFO(C_GetInterfaceList)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_INTERFACE_PTR  pInterfacesList,  /* returned interfaces */
--  CK_ULONG_PTR      pulCount          /* number of interfaces returned */
--);
-+    CK_INTERFACE_PTR interfaces,
-+    CK_ULONG_PTR pulCount);
- #endif
- 
--/* C_GetInterface returns a specific interface from the module. */
- CK_PKCS11_FUNCTION_INFO(C_GetInterface)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_UTF8CHAR_PTR       pInterfaceName, /* name of the interface */
--  CK_VERSION_PTR        pVersion,       /* version of the interface */
--  CK_INTERFACE_PTR_PTR  ppInterface,    /* returned interface */
--  CK_FLAGS              flags           /* flags controlling the semantics
--                                         * of the interface */
--);
-+    CK_UTF8CHAR_PTR pInterfaceName,
-+    CK_VERSION_PTR pVersion,
-+    CK_INTERFACE_PTR_PTR ppInterface,
-+    CK_FLAGS flags);
- #endif
- 
- CK_PKCS11_FUNCTION_INFO(C_LoginUser)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,  /* the session's handle */
--  CK_USER_TYPE      userType,  /* the user type */
--  CK_UTF8CHAR_PTR   pPin,      /* the user's PIN */
--  CK_ULONG          ulPinLen,  /* the length of the PIN */
--  CK_UTF8CHAR_PTR   pUsername, /* the user's name */
--  CK_ULONG          ulUsernameLen /*the length of the user's name */
--);
-+    CK_SESSION_HANDLE hSession,
-+    CK_USER_TYPE userType,
-+    CK_CHAR_PTR pPin,
-+    CK_ULONG ulPinLen,
-+    CK_UTF8CHAR_PTR pUsername,
-+    CK_ULONG ulUsernameLen);
- #endif
- 
- CK_PKCS11_FUNCTION_INFO(C_SessionCancel)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,  /* the session's handle */
--  CK_FLAGS          flags      /* flags control which sessions are cancelled */
--);
-+    CK_SESSION_HANDLE hSession,
-+    CK_FLAGS flags);
- #endif
- 
- CK_PKCS11_FUNCTION_INFO(C_MessageEncryptInit)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,    /* the session's handle */
--  CK_MECHANISM_PTR  pMechanism,  /* the encryption mechanism */
--  CK_OBJECT_HANDLE  hKey         /* handle of encryption key */
--);
-+    CK_SESSION_HANDLE hSession,
-+    CK_MECHANISM_PTR pMechanism,
-+    CK_OBJECT_HANDLE hKey);
- #endif
- 
- CK_PKCS11_FUNCTION_INFO(C_EncryptMessage)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,   /* the session's handle */
--  CK_VOID_PTR pParameter,       /* message specific parameter */
--  CK_ULONG ulParameterLen,      /* length of message specific parameter */
--  CK_BYTE_PTR pAssociatedData,  /* AEAD Associated data */
--  CK_ULONG ulAssociatedDataLen, /* AEAD Associated data length */
--  CK_BYTE_PTR pPlaintext,       /* plain text  */
--  CK_ULONG ulPlaintextLen,      /* plain text length */
--  CK_BYTE_PTR pCiphertext,      /* gets cipher text */
--  CK_ULONG_PTR pulCiphertextLen /* gets cipher text length */
--);
-+    CK_SESSION_HANDLE hSession,
-+    CK_VOID_PTR pParameter,
-+    CK_ULONG ulParameterLen,
-+    CK_BYTE_PTR pAssociatedData,
-+    CK_ULONG ulAssociatedDataLen,
-+    CK_BYTE_PTR pPlaintext,
-+    CK_ULONG ulPlaintextLen,
-+    CK_BYTE_PTR pCiphertext,
-+    CK_ULONG_PTR pulCiphertextLen);
- #endif
- 
- CK_PKCS11_FUNCTION_INFO(C_EncryptMessageBegin)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,   /* the session's handle */
--  CK_VOID_PTR pParameter,       /* message specific parameter */
--  CK_ULONG ulParameterLen,      /* length of message specific parameter */
--  CK_BYTE_PTR pAssociatedData,  /* AEAD Associated data */
--  CK_ULONG ulAssociatedDataLen  /* AEAD Associated data length */
--);
-+    CK_SESSION_HANDLE hSession,
-+    CK_VOID_PTR pParameter,
-+    CK_ULONG ulParameterLen,
-+    CK_BYTE_PTR pAssociatedData,
-+    CK_ULONG ulAssociatedDataLen);
- #endif
- 
- CK_PKCS11_FUNCTION_INFO(C_EncryptMessageNext)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,        /* the session's handle */
--  CK_VOID_PTR pParameter,            /* message specific parameter */
--  CK_ULONG ulParameterLen,           /* length of message specific parameter */
--  CK_BYTE_PTR pPlaintextPart,        /* plain text */
--  CK_ULONG ulPlaintextPartLen,       /* plain text length */
--  CK_BYTE_PTR pCiphertextPart,       /* gets cipher text */
--  CK_ULONG_PTR pulCiphertextPartLen, /* gets cipher text length */
--  CK_FLAGS flags                     /* multi mode flag */
--);
-+    CK_SESSION_HANDLE hSession,
-+    CK_VOID_PTR pParameter,
-+    CK_ULONG ulParameterLen,
-+    CK_BYTE_PTR pPlaintextPart,
-+    CK_ULONG ulPlaintextPartLen,
-+    CK_BYTE_PTR pCiphertextPart,
-+    CK_ULONG_PTR pulCiphertextPartLen,
-+    CK_FLAGS flags);
- #endif
- 
- CK_PKCS11_FUNCTION_INFO(C_MessageEncryptFinal)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession        /* the session's handle */
--);
-+    CK_SESSION_HANDLE hSession);
- #endif
- 
- CK_PKCS11_FUNCTION_INFO(C_MessageDecryptInit)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,    /* the session's handle */
--  CK_MECHANISM_PTR  pMechanism,  /* the decryption mechanism */
--  CK_OBJECT_HANDLE  hKey         /* handle of decryption key */
--);
-+    CK_SESSION_HANDLE hSession,
-+    CK_MECHANISM_PTR pMechanism,
-+    CK_OBJECT_HANDLE hKey);
- #endif
- 
- CK_PKCS11_FUNCTION_INFO(C_DecryptMessage)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,   /* the session's handle */
--  CK_VOID_PTR pParameter,       /* message specific parameter */
--  CK_ULONG ulParameterLen,      /* length of message specific parameter */
--  CK_BYTE_PTR pAssociatedData,  /* AEAD Associated data */
--  CK_ULONG ulAssociatedDataLen, /* AEAD Associated data length */
--  CK_BYTE_PTR pCiphertext,      /* cipher text */
--  CK_ULONG ulCiphertextLen,     /* cipher text length */
--  CK_BYTE_PTR pPlaintext,       /* gets plain text */
--  CK_ULONG_PTR pulPlaintextLen  /* gets plain text length */
--);
-+    CK_SESSION_HANDLE hSession,
-+    CK_VOID_PTR pParameter,
-+    CK_ULONG ulParameterLen,
-+    CK_BYTE_PTR pAssociatedData,
-+    CK_ULONG ulAssociatedDataLen,
-+    CK_BYTE_PTR pCiphertext,
-+    CK_ULONG ulCiphertextLen,
-+    CK_BYTE_PTR pPlaintext,
-+    CK_ULONG_PTR pulPlaintextLen);
- #endif
- 
- CK_PKCS11_FUNCTION_INFO(C_DecryptMessageBegin)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,   /* the session's handle */
--  CK_VOID_PTR pParameter,       /* message specific parameter */
--  CK_ULONG ulParameterLen,      /* length of message specific parameter */
--  CK_BYTE_PTR pAssociatedData,  /* AEAD Associated data */
--  CK_ULONG ulAssociatedDataLen  /* AEAD Associated data length */
--);
-+    CK_SESSION_HANDLE hSession,
-+    CK_VOID_PTR pParameter,
-+    CK_ULONG ulParameterLen,
-+    CK_BYTE_PTR pAssociatedData,
-+    CK_ULONG ulAssociatedDataLen);
- #endif
- 
- CK_PKCS11_FUNCTION_INFO(C_DecryptMessageNext)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,        /* the session's handle */
--  CK_VOID_PTR pParameter,            /* message specific parameter */
--  CK_ULONG ulParameterLen,           /* length of message specific parameter */
--  CK_BYTE_PTR pCiphertextPart,       /* cipher text */
--  CK_ULONG ulCiphertextPartLen,      /* cipher text length */
--  CK_BYTE_PTR pPlaintextPart,        /* gets plain text */
--  CK_ULONG_PTR pulPlaintextPartLen,  /* gets plain text length */
--  CK_FLAGS flags                     /* multi mode flag */
--);
-+    CK_SESSION_HANDLE hSession,
-+    CK_VOID_PTR pParameter,
-+    CK_ULONG ulParameterLen,
-+    CK_BYTE_PTR pCiphertextPart,
-+    CK_ULONG ulCiphertextPartLen,
-+    CK_BYTE_PTR pPlaintextPart,
-+    CK_ULONG_PTR pulPlaintextPartLen,
-+    CK_FLAGS flags);
- #endif
- 
- CK_PKCS11_FUNCTION_INFO(C_MessageDecryptFinal)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession        /* the session's handle */
--);
-+    CK_SESSION_HANDLE hSession);
- #endif
- 
- CK_PKCS11_FUNCTION_INFO(C_MessageSignInit)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,    /* the session's handle */
--  CK_MECHANISM_PTR  pMechanism,  /* the signing mechanism */
--  CK_OBJECT_HANDLE  hKey         /* handle of signing key */
--);
-+    CK_SESSION_HANDLE hSession,
-+    CK_MECHANISM_PTR pMechanism,
-+    CK_OBJECT_HANDLE hKey);
- #endif
- 
- CK_PKCS11_FUNCTION_INFO(C_SignMessage)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,   /* the session's handle */
--  CK_VOID_PTR pParameter,       /* message specific parameter */
--  CK_ULONG ulParameterLen,      /* length of message specific parameter */
--  CK_BYTE_PTR pData,            /* data to sign */
--  CK_ULONG ulDataLen,           /* data to sign length */
--  CK_BYTE_PTR pSignature,       /* gets signature */
--  CK_ULONG_PTR pulSignatureLen  /* gets signature length */
--);
-+    CK_SESSION_HANDLE hSession,
-+    CK_VOID_PTR pParameter,
-+    CK_ULONG ulParameterLen,
-+    CK_BYTE_PTR pData,
-+    CK_ULONG ulDataLen,
-+
-+    CK_BYTE_PTR pSignature,
-+    CK_ULONG_PTR pulSignatureLen);
- #endif
- 
- CK_PKCS11_FUNCTION_INFO(C_SignMessageBegin)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,   /* the session's handle */
--  CK_VOID_PTR pParameter,       /* message specific parameter */
--  CK_ULONG ulParameterLen      /* length of message specific parameter */
--);
-+    CK_SESSION_HANDLE hSession,
-+    CK_VOID_PTR pParameter,
-+    CK_ULONG ulParameterLen);
- #endif
- 
- CK_PKCS11_FUNCTION_INFO(C_SignMessageNext)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,   /* the session's handle */
--  CK_VOID_PTR pParameter,       /* message specific parameter */
--  CK_ULONG ulParameterLen,      /* length of message specific parameter */
--  CK_BYTE_PTR pData,            /* data to sign */
--  CK_ULONG ulDataLen,           /* data to sign length */
--  CK_BYTE_PTR pSignature,       /* gets signature */
--  CK_ULONG_PTR pulSignatureLen  /* gets signature length */
--);
-+    CK_SESSION_HANDLE hSession,
-+    CK_VOID_PTR pParameter,
-+    CK_ULONG ulParameterLen,
-+    CK_BYTE_PTR pData,
-+    CK_ULONG ulDataLen,
-+    CK_BYTE_PTR pSignature,
-+    CK_ULONG_PTR pulSignatureLen);
- #endif
- 
- CK_PKCS11_FUNCTION_INFO(C_MessageSignFinal)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession        /* the session's handle */
--);
-+    CK_SESSION_HANDLE hSession);
- #endif
- 
- CK_PKCS11_FUNCTION_INFO(C_MessageVerifyInit)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,    /* the session's handle */
--  CK_MECHANISM_PTR  pMechanism,  /* the signing mechanism */
--  CK_OBJECT_HANDLE  hKey         /* handle of signing key */
--);
-+    CK_SESSION_HANDLE hSession,
-+    CK_MECHANISM_PTR pMechanism,
-+    CK_OBJECT_HANDLE hKey);
- #endif
- 
- CK_PKCS11_FUNCTION_INFO(C_VerifyMessage)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,   /* the session's handle */
--  CK_VOID_PTR pParameter,       /* message specific parameter */
--  CK_ULONG ulParameterLen,      /* length of message specific parameter */
--  CK_BYTE_PTR pData,            /* data to sign */
--  CK_ULONG ulDataLen,           /* data to sign length */
--  CK_BYTE_PTR pSignature,       /* signature */
--  CK_ULONG ulSignatureLen       /* signature length */
--);
-+    CK_SESSION_HANDLE hSession,
-+    CK_VOID_PTR pParameter,
-+    CK_ULONG ulParameterLen,
-+    CK_BYTE_PTR pData,
-+    CK_ULONG ulDataLen,
-+    CK_BYTE_PTR pSignature,
-+    CK_ULONG ulSignatureLen);
- #endif
- 
- CK_PKCS11_FUNCTION_INFO(C_VerifyMessageBegin)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,   /* the session's handle */
--  CK_VOID_PTR pParameter,       /* message specific parameter */
--  CK_ULONG ulParameterLen      /* length of message specific parameter */
--);
-+    CK_SESSION_HANDLE hSession,
-+    CK_VOID_PTR pParameter,
-+    CK_ULONG ulParameterLen);
- #endif
- 
- CK_PKCS11_FUNCTION_INFO(C_VerifyMessageNext)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession,   /* the session's handle */
--  CK_VOID_PTR pParameter,       /* message specific parameter */
--  CK_ULONG ulParameterLen,      /* length of message specific parameter */
--  CK_BYTE_PTR pData,            /* data to sign */
--  CK_ULONG ulDataLen,           /* data to sign length */
--  CK_BYTE_PTR pSignature,       /* signature */
--  CK_ULONG ulSignatureLen       /* signature length */
--);
-+    CK_SESSION_HANDLE hSession,
-+    CK_VOID_PTR pParameter,
-+    CK_ULONG ulParameterLen,
-+    CK_BYTE_PTR pData,
-+    CK_ULONG ulDataLen,
-+    CK_BYTE_PTR pSignature,
-+    CK_ULONG ulSignatureLen);
- #endif
- 
- CK_PKCS11_FUNCTION_INFO(C_MessageVerifyFinal)
- #ifdef CK_NEED_ARG_LIST
- (
--  CK_SESSION_HANDLE hSession        /* the session's handle */
--);
-+    CK_SESSION_HANDLE hSession);
- #endif
- 
--#endif /* CK_PKCS11_2_0_ONLY */
--
-+#endif
---- /dev/null
-+++ b/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/pkcs11n.h
-@@ -0,0 +1,672 @@
-+/* This Source Code Form is subject to the terms of the Mozilla Public
-+ * License, v. 2.0. If a copy of the MPL was not distributed with this
-+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-+
-+#ifndef _PKCS11N_H_
-+#define _PKCS11N_H_
-+
-+/*
-+ * pkcs11n.h
-+ *
-+ * This file contains the NSS-specific type definitions for Cryptoki
-+ * (PKCS#11).
-+ */
-+
-+/*
-+ * NSSCK_VENDOR_NSS
-+ *
-+ * Cryptoki reserves the high half of all the number spaces for
-+ * vendor-defined use.  I'd like to keep all of our NSS-
-+ * specific values together, but not in the oh-so-obvious
-+ * 0x80000001, 0x80000002, etc. area.  So I've picked an offset,
-+ * and constructed values for the beginnings of our spaces.
-+ *
-+ * Note that some "historical" Netscape values don't fall within
-+ * this range.
-+ */
-+#define NSSCK_VENDOR_NSS 0x4E534350 /* NSCP */
-+
-+/*
-+ * NSS-defined object classes
-+ *
-+ */
-+#define CKO_NSS (CKO_VENDOR_DEFINED | NSSCK_VENDOR_NSS)
-+
-+#define CKO_NSS_CRL (CKO_NSS + 1)
-+#define CKO_NSS_SMIME (CKO_NSS + 2)
-+#define CKO_NSS_TRUST (CKO_NSS + 3)
-+#define CKO_NSS_BUILTIN_ROOT_LIST (CKO_NSS + 4)
-+#define CKO_NSS_NEWSLOT (CKO_NSS + 5)
-+#define CKO_NSS_DELSLOT (CKO_NSS + 6)
-+
-+/*
-+ * NSS-defined key types
-+ *
-+ */
-+#define CKK_NSS (CKK_VENDOR_DEFINED | NSSCK_VENDOR_NSS)
-+
-+#define CKK_NSS_PKCS8 (CKK_NSS + 1)
-+
-+#define CKK_NSS_JPAKE_ROUND1 (CKK_NSS + 2)
-+#define CKK_NSS_JPAKE_ROUND2 (CKK_NSS + 3)
-+
-+#define CKK_NSS_CHACHA20 (CKK_NSS + 4)
-+
-+/*
-+ * NSS-defined certificate types
-+ *
-+ */
-+#define CKC_NSS (CKC_VENDOR_DEFINED | NSSCK_VENDOR_NSS)
-+
-+/* FAKE PKCS #11 defines */
-+#define CKA_DIGEST 0x81000000L
-+#define CKA_NSS_MESSAGE 0x82000000L
-+#define CKA_NSS_MESSAGE_MASK 0xff000000L
-+#define CKA_FLAGS_ONLY 0 /* CKA_CLASS */
-+
-+/*
-+ * NSS-defined object attributes
-+ *
-+ */
-+#define CKA_NSS (CKA_VENDOR_DEFINED | NSSCK_VENDOR_NSS)
-+
-+#define CKA_NSS_URL (CKA_NSS + 1)
-+#define CKA_NSS_EMAIL (CKA_NSS + 2)
-+#define CKA_NSS_SMIME_INFO (CKA_NSS + 3)
-+#define CKA_NSS_SMIME_TIMESTAMP (CKA_NSS + 4)
-+#define CKA_NSS_PKCS8_SALT (CKA_NSS + 5)
-+#define CKA_NSS_PASSWORD_CHECK (CKA_NSS + 6)
-+#define CKA_NSS_EXPIRES (CKA_NSS + 7)
-+#define CKA_NSS_KRL (CKA_NSS + 8)
-+
-+#define CKA_NSS_PQG_COUNTER (CKA_NSS + 20)
-+#define CKA_NSS_PQG_SEED (CKA_NSS + 21)
-+#define CKA_NSS_PQG_H (CKA_NSS + 22)
-+#define CKA_NSS_PQG_SEED_BITS (CKA_NSS + 23)
-+#define CKA_NSS_MODULE_SPEC (CKA_NSS + 24)
-+#define CKA_NSS_OVERRIDE_EXTENSIONS (CKA_NSS + 25)
-+
-+#define CKA_NSS_JPAKE_SIGNERID (CKA_NSS + 26)
-+#define CKA_NSS_JPAKE_PEERID (CKA_NSS + 27)
-+#define CKA_NSS_JPAKE_GX1 (CKA_NSS + 28)
-+#define CKA_NSS_JPAKE_GX2 (CKA_NSS + 29)
-+#define CKA_NSS_JPAKE_GX3 (CKA_NSS + 30)
-+#define CKA_NSS_JPAKE_GX4 (CKA_NSS + 31)
-+#define CKA_NSS_JPAKE_X2 (CKA_NSS + 32)
-+#define CKA_NSS_JPAKE_X2S (CKA_NSS + 33)
-+
-+#define CKA_NSS_MOZILLA_CA_POLICY (CKA_NSS + 34)
-+#define CKA_NSS_SERVER_DISTRUST_AFTER (CKA_NSS + 35)
-+#define CKA_NSS_EMAIL_DISTRUST_AFTER (CKA_NSS + 36)
-+
-+/*
-+ * Trust attributes:
-+ *
-+ * If trust goes standard, these probably will too.  So I'll
-+ * put them all in one place.
-+ */
-+
-+#define CKA_TRUST (CKA_NSS + 0x2000)
-+
-+/* "Usage" key information */
-+#define CKA_TRUST_DIGITAL_SIGNATURE (CKA_TRUST + 1)
-+#define CKA_TRUST_NON_REPUDIATION (CKA_TRUST + 2)
-+#define CKA_TRUST_KEY_ENCIPHERMENT (CKA_TRUST + 3)
-+#define CKA_TRUST_DATA_ENCIPHERMENT (CKA_TRUST + 4)
-+#define CKA_TRUST_KEY_AGREEMENT (CKA_TRUST + 5)
-+#define CKA_TRUST_KEY_CERT_SIGN (CKA_TRUST + 6)
-+#define CKA_TRUST_CRL_SIGN (CKA_TRUST + 7)
-+
-+/* "Purpose" trust information */
-+#define CKA_TRUST_SERVER_AUTH (CKA_TRUST + 8)
-+#define CKA_TRUST_CLIENT_AUTH (CKA_TRUST + 9)
-+#define CKA_TRUST_CODE_SIGNING (CKA_TRUST + 10)
-+#define CKA_TRUST_EMAIL_PROTECTION (CKA_TRUST + 11)
-+#define CKA_TRUST_IPSEC_END_SYSTEM (CKA_TRUST + 12)
-+#define CKA_TRUST_IPSEC_TUNNEL (CKA_TRUST + 13)
-+#define CKA_TRUST_IPSEC_USER (CKA_TRUST + 14)
-+#define CKA_TRUST_TIME_STAMPING (CKA_TRUST + 15)
-+#define CKA_TRUST_STEP_UP_APPROVED (CKA_TRUST + 16)
-+
-+#define CKA_CERT_SHA1_HASH (CKA_TRUST + 100)
-+#define CKA_CERT_MD5_HASH (CKA_TRUST + 101)
-+
-+/* NSS trust stuff */
-+
-+/* HISTORICAL: define used to pass in the database key for DSA private keys */
-+#define CKA_NSS_DB 0xD5A0DB00L
-+#define CKA_NSS_TRUST 0x80000001L
-+
-+/* FAKE PKCS #11 defines */
-+#define CKM_FAKE_RANDOM 0x80000efeUL
-+#define CKM_INVALID_MECHANISM 0xffffffffUL
-+#define CKT_INVALID_TYPE 0xffffffffUL
-+
-+/*
-+ * NSS-defined crypto mechanisms
-+ *
-+ */
-+#define CKM_NSS (CKM_VENDOR_DEFINED | NSSCK_VENDOR_NSS)
-+
-+#define CKM_NSS_AES_KEY_WRAP (CKM_NSS + 1)
-+#define CKM_NSS_AES_KEY_WRAP_PAD (CKM_NSS + 2)
-+
-+/* HKDF key derivation mechanisms. See CK_NSS_HKDFParams for documentation. */
-+#define CKM_NSS_HKDF_SHA1 (CKM_NSS + 3)
-+#define CKM_NSS_HKDF_SHA256 (CKM_NSS + 4)
-+#define CKM_NSS_HKDF_SHA384 (CKM_NSS + 5)
-+#define CKM_NSS_HKDF_SHA512 (CKM_NSS + 6)
-+
-+/* J-PAKE round 1 key generation mechanisms.
-+ *
-+ * Required template attributes: CKA_PRIME, CKA_SUBPRIME, CKA_BASE,
-+ *                               CKA_NSS_JPAKE_SIGNERID
-+ * Output key type: CKK_NSS_JPAKE_ROUND1
-+ * Output key class: CKO_PRIVATE_KEY
-+ * Parameter type: CK_NSS_JPAKERound1Params
-+ *
-+ */
-+#define CKM_NSS_JPAKE_ROUND1_SHA1 (CKM_NSS + 7)
-+#define CKM_NSS_JPAKE_ROUND1_SHA256 (CKM_NSS + 8)
-+#define CKM_NSS_JPAKE_ROUND1_SHA384 (CKM_NSS + 9)
-+#define CKM_NSS_JPAKE_ROUND1_SHA512 (CKM_NSS + 10)
-+
-+/* J-PAKE round 2 key derivation mechanisms.
-+ *
-+ * Required template attributes: CKA_NSS_JPAKE_PEERID
-+ * Input key type:  CKK_NSS_JPAKE_ROUND1
-+ * Output key type: CKK_NSS_JPAKE_ROUND2
-+ * Output key class: CKO_PRIVATE_KEY
-+ * Parameter type: CK_NSS_JPAKERound2Params
-+ */
-+#define CKM_NSS_JPAKE_ROUND2_SHA1 (CKM_NSS + 11)
-+#define CKM_NSS_JPAKE_ROUND2_SHA256 (CKM_NSS + 12)
-+#define CKM_NSS_JPAKE_ROUND2_SHA384 (CKM_NSS + 13)
-+#define CKM_NSS_JPAKE_ROUND2_SHA512 (CKM_NSS + 14)
-+
-+/* J-PAKE final key material derivation mechanisms
-+ *
-+ * Input key type:  CKK_NSS_JPAKE_ROUND2
-+ * Output key type: CKK_GENERIC_SECRET
-+ * Output key class: CKO_SECRET_KEY
-+ * Parameter type: CK_NSS_JPAKEFinalParams
-+ *
-+ * You must apply a KDF (e.g. CKM_NSS_HKDF_*) to resultant keying material
-+ * to get a key with uniformly distributed bits.
-+ */
-+#define CKM_NSS_JPAKE_FINAL_SHA1 (CKM_NSS + 15)
-+#define CKM_NSS_JPAKE_FINAL_SHA256 (CKM_NSS + 16)
-+#define CKM_NSS_JPAKE_FINAL_SHA384 (CKM_NSS + 17)
-+#define CKM_NSS_JPAKE_FINAL_SHA512 (CKM_NSS + 18)
-+
-+/* Constant-time MAC mechanisms:
-+ *
-+ * These operations verify a padded, MAC-then-encrypt block of data in
-+ * constant-time. Because of the order of operations, the padding bytes are not
-+ * protected by the MAC. However, disclosing the value of the padding bytes
-+ * gives an attacker the ability to decrypt ciphertexts. Such disclosure can be
-+ * as subtle as taking slightly less time to perform the MAC when the padding
-+ * is one byte longer. See https://www.isg.rhul.ac.uk/tls/
-+ *
-+ * CKM_NSS_HMAC_CONSTANT_TIME: performs an HMAC authentication.
-+ * CKM_NSS_SSL3_MAC_CONSTANT_TIME: performs an authentication with SSLv3 MAC.
-+ *
-+ * Parameter type: CK_NSS_MAC_CONSTANT_TIME_PARAMS
-+ */
-+#define CKM_NSS_HMAC_CONSTANT_TIME (CKM_NSS + 19)
-+#define CKM_NSS_SSL3_MAC_CONSTANT_TIME (CKM_NSS + 20)
-+
-+/* TLS 1.2 mechanisms */
-+#define CKM_NSS_TLS_PRF_GENERAL_SHA256 (CKM_NSS + 21)
-+#define CKM_NSS_TLS_MASTER_KEY_DERIVE_SHA256 (CKM_NSS + 22)
-+#define CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256 (CKM_NSS + 23)
-+#define CKM_NSS_TLS_MASTER_KEY_DERIVE_DH_SHA256 (CKM_NSS + 24)
-+
-+/* TLS extended master secret derivation */
-+#define CKM_NSS_TLS_EXTENDED_MASTER_KEY_DERIVE (CKM_NSS + 25)
-+#define CKM_NSS_TLS_EXTENDED_MASTER_KEY_DERIVE_DH (CKM_NSS + 26)
-+
-+#define CKM_NSS_CHACHA20_KEY_GEN (CKM_NSS + 27)
-+#define CKM_NSS_CHACHA20_POLY1305 (CKM_NSS + 28)
-+
-+/* Additional PKCS #12 PBE algorithms defined in v1.1 */
-+#define CKM_NSS_PKCS12_PBE_SHA224_HMAC_KEY_GEN (CKM_NSS + 29)
-+#define CKM_NSS_PKCS12_PBE_SHA256_HMAC_KEY_GEN (CKM_NSS + 30)
-+#define CKM_NSS_PKCS12_PBE_SHA384_HMAC_KEY_GEN (CKM_NSS + 31)
-+#define CKM_NSS_PKCS12_PBE_SHA512_HMAC_KEY_GEN (CKM_NSS + 32)
-+
-+#define CKM_NSS_CHACHA20_CTR (CKM_NSS + 33)
-+
-+/* IKE mechanism (to be proposed to PKCS #11 */
-+#define CKM_NSS_IKE_PRF_PLUS_DERIVE (CKM_NSS + 34)
-+#define CKM_NSS_IKE_PRF_DERIVE (CKM_NSS + 35)
-+#define CKM_NSS_IKE1_PRF_DERIVE (CKM_NSS + 36)
-+#define CKM_NSS_IKE1_APP_B_PRF_DERIVE (CKM_NSS + 37)
-+
-+#define CKM_NSS_PUB_FROM_PRIV (CKM_NSS + 40)
-+
-+/* SP800-108 NSS mechanism with support for data object derivation */
-+#define CKM_NSS_SP800_108_COUNTER_KDF_DERIVE_DATA (CKM_NSS + 42)
-+#define CKM_NSS_SP800_108_FEEDBACK_KDF_DERIVE_DATA (CKM_NSS + 43)
-+#define CKM_NSS_SP800_108_DOUBLE_PIPELINE_KDF_DERIVE_DATA (CKM_NSS + 44)
-+
-+/*
-+ * HISTORICAL:
-+ * Do not attempt to use these. They are only used by NSS's internal
-+ * PKCS #11 interface. Most of these are place holders for other mechanism
-+ * and will change in the future.
-+ */
-+#define CKM_NSS_PBE_SHA1_DES_CBC 0x80000002UL
-+#define CKM_NSS_PBE_SHA1_TRIPLE_DES_CBC 0x80000003UL
-+#define CKM_NSS_PBE_SHA1_40_BIT_RC2_CBC 0x80000004UL
-+#define CKM_NSS_PBE_SHA1_128_BIT_RC2_CBC 0x80000005UL
-+#define CKM_NSS_PBE_SHA1_40_BIT_RC4 0x80000006UL
-+#define CKM_NSS_PBE_SHA1_128_BIT_RC4 0x80000007UL
-+#define CKM_NSS_PBE_SHA1_FAULTY_3DES_CBC 0x80000008UL
-+#define CKM_NSS_PBE_SHA1_HMAC_KEY_GEN 0x80000009UL
-+#define CKM_NSS_PBE_MD5_HMAC_KEY_GEN 0x8000000aUL
-+#define CKM_NSS_PBE_MD2_HMAC_KEY_GEN 0x8000000bUL
-+
-+#define CKM_TLS_PRF_GENERAL 0x80000373UL
-+
-+typedef struct CK_NSS_JPAKEPublicValue {
-+    CK_BYTE *pGX;
-+    CK_ULONG ulGXLen;
-+    CK_BYTE *pGV;
-+    CK_ULONG ulGVLen;
-+    CK_BYTE *pR;
-+    CK_ULONG ulRLen;
-+} CK_NSS_JPAKEPublicValue;
-+
-+typedef struct CK_NSS_JPAKERound1Params {
-+    CK_NSS_JPAKEPublicValue gx1; /* out */
-+    CK_NSS_JPAKEPublicValue gx2; /* out */
-+} CK_NSS_JPAKERound1Params;
-+
-+typedef struct CK_NSS_JPAKERound2Params {
-+    CK_BYTE *pSharedKey;         /* in */
-+    CK_ULONG ulSharedKeyLen;     /* in */
-+    CK_NSS_JPAKEPublicValue gx3; /* in */
-+    CK_NSS_JPAKEPublicValue gx4; /* in */
-+    CK_NSS_JPAKEPublicValue A;   /* out */
-+} CK_NSS_JPAKERound2Params;
-+
-+typedef struct CK_NSS_JPAKEFinalParams {
-+    CK_NSS_JPAKEPublicValue B; /* in */
-+} CK_NSS_JPAKEFinalParams;
-+
-+/* macAlg: the MAC algorithm to use. This determines the hash function used in
-+ *     the HMAC/SSLv3 MAC calculations.
-+ * ulBodyTotalLen: the total length of the data, including padding bytes and
-+ *     padding length.
-+ * pHeader: points to a block of data that contains additional data to
-+ *     authenticate. For TLS this includes the sequence number etc. For SSLv3,
-+ *     this also includes the initial padding bytes.
-+ *
-+ * NOTE: the softoken's implementation of CKM_NSS_HMAC_CONSTANT_TIME and
-+ * CKM_NSS_SSL3_MAC_CONSTANT_TIME requires that the sum of ulBodyTotalLen
-+ * and ulHeaderLen be much smaller than 2^32 / 8 bytes because it uses an
-+ * unsigned int variable to represent the length in bits. This should not
-+ * be a problem because the SSL/TLS protocol limits the size of an SSL
-+ * record to something considerably less than 2^32 bytes.
-+ */
-+typedef struct CK_NSS_MAC_CONSTANT_TIME_PARAMS {
-+    CK_MECHANISM_TYPE macAlg; /* in */
-+    CK_ULONG ulBodyTotalLen;  /* in */
-+    CK_BYTE *pHeader;         /* in */
-+    CK_ULONG ulHeaderLen;     /* in */
-+} CK_NSS_MAC_CONSTANT_TIME_PARAMS;
-+
-+typedef struct CK_NSS_AEAD_PARAMS {
-+    CK_BYTE_PTR pNonce;
-+    CK_ULONG ulNonceLen;
-+    CK_BYTE_PTR pAAD;
-+    CK_ULONG ulAADLen;
-+    CK_ULONG ulTagLen;
-+} CK_NSS_AEAD_PARAMS;
-+
-+/*
-+ * NSS-defined return values
-+ *
-+ */
-+#define CKR_NSS (CKM_VENDOR_DEFINED | NSSCK_VENDOR_NSS)
-+
-+#define CKR_NSS_CERTDB_FAILED (CKR_NSS + 1)
-+#define CKR_NSS_KEYDB_FAILED (CKR_NSS + 2)
-+
-+/* Mandatory parameter for the CKM_NSS_HKDF_* key deriviation mechanisms.
-+   See RFC 5869.
-+
-+    bExtract: If set, HKDF-Extract will be applied to the input key. If
-+              the optional salt is given, it is used; otherwise, the salt is
-+              set to a sequence of zeros equal in length to the HMAC output.
-+              If bExpand is not set, then the key template given to
-+              C_DeriveKey must indicate an output key size less than or equal
-+              to the output size of the HMAC.
-+
-+    bExpand:  If set, HKDF-Expand will be applied to the input key (if
-+              bExtract is not set) or to the result of HKDF-Extract (if
-+              bExtract is set). Any info given in the optional pInfo field will
-+              be included in the calculation.
-+
-+    The size of the output key must be specified in the template passed to
-+    C_DeriveKey.
-+*/
-+typedef struct CK_NSS_HKDFParams {
-+    CK_BBOOL bExtract;
-+    CK_BYTE_PTR pSalt;
-+    CK_ULONG ulSaltLen;
-+    CK_BBOOL bExpand;
-+    CK_BYTE_PTR pInfo;
-+    CK_ULONG ulInfoLen;
-+} CK_NSS_HKDFParams;
-+
-+/*
-+ * CK_NSS_IKE_PRF_PLUS_PARAMS is a structure that provides the parameters to
-+ * the CKM_NSS_IKE_PRF_PLUS_DERIVE mechanism.
-+ * The fields of the structure have the following meanings:
-+ *      prfMechanism    underlying MAC mechanism used to generate the prf.
-+ *      bHasSeedKey     hSeed key is present.
-+ *      hSeedKey        optional seed from key
-+ *      pSeedData       optional seed from data.
-+ *      ulSeedDataLen   length of optional seed data.
-+ *        If no seed data is present this value is NULL.
-+ */
-+typedef struct CK_NSS_IKE_PRF_PLUS_DERIVE_PARAMS {
-+    CK_MECHANISM_TYPE prfMechanism;
-+    CK_BBOOL bHasSeedKey;
-+    CK_OBJECT_HANDLE hSeedKey;
-+    CK_BYTE_PTR pSeedData;
-+    CK_ULONG ulSeedDataLen;
-+} CK_NSS_IKE_PRF_PLUS_DERIVE_PARAMS;
-+
-+/* CK_NSS_IKE_PRF_DERIVE_PARAMS is a structure that provides the parameters to
-+ *  the CKM_NSS_IKE_PRF_DERIVE mechanism.
-+ *
-+ * The fields of the structure have the following meanings:
-+ *     prfMechanism underlying MAC mechanism used to generate the prf.
-+ *     bRekey       hNewKey is present.
-+ *     pNi          Ni value
-+ *     ulNiLen      length of Ni
-+ *     pNr          Nr value
-+ *     ulNrLen      length of Nr
-+ *     hNewKey      New key value to drive the rekey.
-+ */
-+typedef struct CK_NSS_IKE_PRF_DERIVE_PARAMS {
-+    CK_MECHANISM_TYPE prfMechanism;
-+    CK_BBOOL bDataAsKey;
-+    CK_BBOOL bRekey;
-+    CK_BYTE_PTR pNi;
-+    CK_ULONG ulNiLen;