--- old/make/autoconf/hotspot.m4	2018-06-08 14:40:36.399835762 -0700
+++ new/make/autoconf/hotspot.m4	2018-06-08 14:40:36.171835770 -0700
@@ -26,13 +26,13 @@
 # All valid JVM features, regardless of platform
 VALID_JVM_FEATURES="compiler1 compiler2 zero minimal dtrace jvmti jvmci \
     graal vm-structs jni-check services management cmsgc g1gc parallelgc serialgc nmt cds \
-    static-build link-time-opt aot jfr"
+    static-build link-time-opt aot jfr no-speculative-cti"
 
 # Deprecated JVM features (these are ignored, but with a warning)
 DEPRECATED_JVM_FEATURES="trace"
 
 # All valid JVM variants
-VALID_JVM_VARIANTS="server client minimal core zero custom"
+VALID_JVM_VARIANTS="server client minimal hardened core zero custom"
 
 ###############################################################################
 # Check if the specified JVM variant should be built. To be used in shell if
@@ -61,6 +61,7 @@
 ###############################################################################
 # Check which variants of the JVM that we want to build. Available variants are:
 #   server: normal interpreter, and a tiered C1/C2 compiler
+#   hardened: same as server but compiled with speculative calls disabled
 #   client: normal interpreter, and C1 (no C2 compiler)
 #   minimal: reduced form of client with optional features stripped out
 #   core: normal interpreter only, no compiler
@@ -70,7 +71,7 @@
 AC_DEFUN_ONCE([HOTSPOT_SETUP_JVM_VARIANTS],
 [
   AC_ARG_WITH([jvm-variants], [AS_HELP_STRING([--with-jvm-variants],
-      [JVM variants (separated by commas) to build (server,client,minimal,core,zero,custom) @<:@server@:>@])])
+      [JVM variants (separated by commas) to build (server,hardened,client,minimal,core,zero,custom) @<:@server@:>@])])
 
   SETUP_HOTSPOT_TARGET_CPU_PORT
 
@@ -104,7 +105,7 @@
   fi
 
   # All "special" variants share the same output directory ("server")
-  VALID_MULTIPLE_JVM_VARIANTS="server client minimal"
+  VALID_MULTIPLE_JVM_VARIANTS="server client minimal hardened"
   BASIC_GET_NON_MATCHING_VALUES(INVALID_MULTIPLE_VARIANTS, $JVM_VARIANTS, $VALID_MULTIPLE_JVM_VARIANTS)
   if  test "x$INVALID_MULTIPLE_VARIANTS" != x && test "x$BUILDING_MULTIPLE_JVM_VARIANTS" = xtrue; then
     AC_MSG_ERROR([You cannot build multiple variants with anything else than $VALID_MULTIPLE_JVM_VARIANTS.])
@@ -113,7 +114,7 @@
   # The "main" variant is the one used by other libs to link against during the
   # build.
   if test "x$BUILDING_MULTIPLE_JVM_VARIANTS" = "xtrue"; then
-    MAIN_VARIANT_PRIO_ORDER="server client minimal"
+    MAIN_VARIANT_PRIO_ORDER="server client minimal hardened"
     for variant in $MAIN_VARIANT_PRIO_ORDER; do
       if HOTSPOT_CHECK_JVM_VARIANT($variant); then
         JVM_VARIANT_MAIN="$variant"
@@ -127,6 +128,7 @@
   AC_SUBST(JVM_VARIANTS)
   AC_SUBST(VALID_JVM_VARIANTS)
   AC_SUBST(JVM_VARIANT_MAIN)
+  AC_SUBST(VALID_MULTIPLE_JVM_VARIANTS)
 
   if HOTSPOT_CHECK_JVM_VARIANT(zero); then
     # zero behaves as a platform and rewrites these values. This is really weird. :(
@@ -409,6 +411,11 @@
     JVM_FEATURES_link_time_opt=""
   fi
 
+  JVM_FEATURES_HARDENED="no-speculative-cti"
+  if test "x$HARDENED_HOTSPOT" = "xtrue"; then
+    JVM_FEATURES="$JVM_FEATURES $JVM_FEATURES_HARDENED"
+  fi
+
   # All variants but minimal (and custom) get these features
   NON_MINIMAL_FEATURES="$NON_MINIMAL_FEATURES cmsgc g1gc parallelgc serialgc jni-check jvmti management nmt services vm-structs"
   if test "x$ENABLE_CDS" = "xtrue"; then
@@ -416,7 +423,9 @@
   fi
 
   # Enable features depending on variant.
-  JVM_FEATURES_server="compiler1 compiler2 $NON_MINIMAL_FEATURES $JVM_FEATURES $JVM_FEATURES_jvmci $JVM_FEATURES_aot $JVM_FEATURES_graal"
+  JVM_FEATURES_server="compiler1 compiler2 $NON_MINIMAL_FEATURES $JVM_FEATURES \
+      $JVM_FEATURES_jvmci $JVM_FEATURES_aot $JVM_FEATURES_graal"
+  JVM_FEATURES_hardened="$JVM_FEATURES_HARDENED"
   JVM_FEATURES_client="compiler1 $NON_MINIMAL_FEATURES $JVM_FEATURES $JVM_FEATURES_jvmci"
   JVM_FEATURES_core="$NON_MINIMAL_FEATURES $JVM_FEATURES"
   JVM_FEATURES_minimal="compiler1 minimal serialgc $JVM_FEATURES $JVM_FEATURES_link_time_opt"
@@ -424,12 +433,15 @@
   JVM_FEATURES_custom="$JVM_FEATURES"
 
   AC_SUBST(JVM_FEATURES_server)
+  AC_SUBST(JVM_FEATURES_hardened)
   AC_SUBST(JVM_FEATURES_client)
   AC_SUBST(JVM_FEATURES_core)
   AC_SUBST(JVM_FEATURES_minimal)
   AC_SUBST(JVM_FEATURES_zero)
   AC_SUBST(JVM_FEATURES_custom)
 
+  AC_SUBST(JVM_FEATURES_HARDENED)
+
   # Used for verification of Makefiles by check-jvm-feature
   AC_SUBST(VALID_JVM_FEATURES)
 
@@ -442,6 +454,10 @@
 #
 AC_DEFUN_ONCE([HOTSPOT_FINALIZE_JVM_FEATURES],
 [
+  # The hardened variant should have all the features of server. Add them here
+  # to catch any custom additions automatically.
+  JVM_FEATURES_hardened="$JVM_FEATURES_hardened $JVM_FEATURES_server"
+
   for variant in $JVM_VARIANTS; do
     AC_MSG_CHECKING([JVM features for JVM variant '$variant'])
     features_var_name=JVM_FEATURES_$variant