--- old/make/autoconf/hotspot.m4	2018-06-04 22:08:25.063442760 +0200
+++ new/make/autoconf/hotspot.m4	2018-06-04 22:08:24.691429621 +0200
@@ -26,13 +26,13 @@
 # All valid JVM features, regardless of platform
 VALID_JVM_FEATURES="compiler1 compiler2 zero minimal dtrace jvmti jvmci \
     graal vm-structs jni-check services management cmsgc g1gc parallelgc serialgc nmt cds \
-    static-build link-time-opt aot jfr"
+    static-build link-time-opt aot jfr no-speculative-cti"
 
 # Deprecated JVM features (these are ignored, but with a warning)
 DEPRECATED_JVM_FEATURES="trace"
 
 # All valid JVM variants
-VALID_JVM_VARIANTS="server client minimal core zero custom"
+VALID_JVM_VARIANTS="server client minimal hardened core zero custom"
 
 ###############################################################################
 # Check if the specified JVM variant should be built. To be used in shell if
@@ -61,6 +61,7 @@
 ###############################################################################
 # Check which variants of the JVM that we want to build. Available variants are:
 #   server: normal interpreter, and a tiered C1/C2 compiler
+#   hardened: same as server but compiled with speculative calls disabled
 #   client: normal interpreter, and C1 (no C2 compiler)
 #   minimal: reduced form of client with optional features stripped out
 #   core: normal interpreter only, no compiler
@@ -70,7 +71,7 @@
 AC_DEFUN_ONCE([HOTSPOT_SETUP_JVM_VARIANTS],
 [
   AC_ARG_WITH([jvm-variants], [AS_HELP_STRING([--with-jvm-variants],
-      [JVM variants (separated by commas) to build (server,client,minimal,core,zero,custom) @<:@server@:>@])])
+      [JVM variants (separated by commas) to build (server,hardened,client,minimal,core,zero,custom) @<:@server@:>@])])
 
   SETUP_HOTSPOT_TARGET_CPU_PORT
 
@@ -104,7 +105,7 @@
   fi
 
   # All "special" variants share the same output directory ("server")
-  VALID_MULTIPLE_JVM_VARIANTS="server client minimal"
+  VALID_MULTIPLE_JVM_VARIANTS="server client minimal hardened"
   BASIC_GET_NON_MATCHING_VALUES(INVALID_MULTIPLE_VARIANTS, $JVM_VARIANTS, $VALID_MULTIPLE_JVM_VARIANTS)
   if  test "x$INVALID_MULTIPLE_VARIANTS" != x && test "x$BUILDING_MULTIPLE_JVM_VARIANTS" = xtrue; then
     AC_MSG_ERROR([You cannot build multiple variants with anything else than $VALID_MULTIPLE_JVM_VARIANTS.])
@@ -113,7 +114,7 @@
   # The "main" variant is the one used by other libs to link against during the
   # build.
   if test "x$BUILDING_MULTIPLE_JVM_VARIANTS" = "xtrue"; then
-    MAIN_VARIANT_PRIO_ORDER="server client minimal"
+    MAIN_VARIANT_PRIO_ORDER="server client minimal hardened"
     for variant in $MAIN_VARIANT_PRIO_ORDER; do
       if HOTSPOT_CHECK_JVM_VARIANT($variant); then
         JVM_VARIANT_MAIN="$variant"
@@ -127,6 +128,7 @@
   AC_SUBST(JVM_VARIANTS)
   AC_SUBST(VALID_JVM_VARIANTS)
   AC_SUBST(JVM_VARIANT_MAIN)
+  AC_SUBST(VALID_MULTIPLE_JVM_VARIANTS)
 
   if HOTSPOT_CHECK_JVM_VARIANT(zero); then
     # zero behaves as a platform and rewrites these values. This is really weird. :(
@@ -417,6 +419,7 @@
 
   # Enable features depending on variant.
   JVM_FEATURES_server="compiler1 compiler2 $NON_MINIMAL_FEATURES $JVM_FEATURES $JVM_FEATURES_jvmci $JVM_FEATURES_aot $JVM_FEATURES_graal"
+  JVM_FEATURES_hardened="$JVM_FEATURES_server no-speculative-cti"
   JVM_FEATURES_client="compiler1 $NON_MINIMAL_FEATURES $JVM_FEATURES $JVM_FEATURES_jvmci"
   JVM_FEATURES_core="$NON_MINIMAL_FEATURES $JVM_FEATURES"
   JVM_FEATURES_minimal="compiler1 minimal serialgc $JVM_FEATURES $JVM_FEATURES_link_time_opt"
@@ -424,6 +427,7 @@
   JVM_FEATURES_custom="$JVM_FEATURES"
 
   AC_SUBST(JVM_FEATURES_server)
+  AC_SUBST(JVM_FEATURES_hardened)
   AC_SUBST(JVM_FEATURES_client)
   AC_SUBST(JVM_FEATURES_core)
   AC_SUBST(JVM_FEATURES_minimal)