--- old/src/jdk.internal.vm.compiler/share/classes/org.graalvm.compiler.hotspot/src/org/graalvm/compiler/hotspot/HotSpotGraalJVMCIServiceLocator.java	2017-03-20 17:38:33.000000000 -0700
+++ new/src/jdk.internal.vm.compiler/share/classes/org.graalvm.compiler.hotspot/src/org/graalvm/compiler/hotspot/HotSpotGraalJVMCIServiceLocator.java	2017-03-20 17:38:33.000000000 -0700
@@ -23,12 +23,14 @@
 package org.graalvm.compiler.hotspot;
 
 import static org.graalvm.compiler.core.common.util.ModuleAPI.addExports;
+import static org.graalvm.compiler.core.common.util.ModuleAPI.addOpens;
 import static org.graalvm.compiler.core.common.util.ModuleAPI.getModule;
 import static org.graalvm.compiler.core.common.util.Util.JAVA_SPECIFICATION_VERSION;
 
 import org.graalvm.compiler.serviceprovider.ServiceProvider;
 
 import jdk.vm.ci.hotspot.HotSpotVMEventListener;
+import jdk.vm.ci.runtime.JVMCICompiler;
 import jdk.vm.ci.runtime.JVMCICompilerFactory;
 import jdk.vm.ci.services.JVMCIServiceLocator;
 
@@ -38,10 +40,10 @@
     private boolean exportsAdded;
 
     /**
-     * Dynamically exports various internal JDK packages to the Graal module. This requires only
-     * {@code --add-exports=java.base/jdk.internal.module=org.graalvm.compiler.graal_core} on the VM
-     * command line instead of a {@code --add-exports} instance for each JDK internal package used
-     * by Graal.
+     * Dynamically exports and opens various internal JDK packages to the Graal module. This
+     * requires only a single {@code --add-exports=java.base/jdk.internal.module=<Graal module>} on
+     * the VM command line instead of a {@code --add-exports} instance for each JDK internal package
+     * used by Graal.
      */
     private void addExports() {
         if (JAVA_SPECIFICATION_VERSION >= 9 && !exportsAdded) {
@@ -50,6 +52,9 @@
             addExports.invokeStatic(javaBaseModule, "jdk.internal.misc", graalModule);
             addExports.invokeStatic(javaBaseModule, "jdk.internal.jimage", graalModule);
             addExports.invokeStatic(javaBaseModule, "com.sun.crypto.provider", graalModule);
+            addOpens.invokeStatic(javaBaseModule, "jdk.internal.misc", graalModule);
+            addOpens.invokeStatic(javaBaseModule, "jdk.internal.jimage", graalModule);
+            addOpens.invokeStatic(javaBaseModule, "com.sun.crypto.provider", graalModule);
             exportsAdded = true;
         }
     }
@@ -70,8 +75,23 @@
         return null;
     }
 
-    public void onCompilerCreation(HotSpotGraalCompiler compiler) {
+    /**
+     * The signature cannot mention HotSpotGraalCompiler since it indirectly references
+     * JVMCICompiler which is in a non-exported JVMCI package. This causes an IllegalAccessError
+     * while looking for the
+     * <a href="http://hg.openjdk.java.net/jdk9/hs/jdk/rev/89ef4b822745#l32.65">provider</a> factory
+     * method:
+     *
+     * <pre>
+     * java.util.ServiceConfigurationError: jdk.vm.ci.services.JVMCIServiceLocator: Unable to get public provider() method
+     * ...
+     * Caused by: java.lang.IllegalAccessError: superinterface check failed: class org.graalvm.compiler.api.runtime.GraalJVMCICompiler
+     * (in module org.graalvm.compiler.graal_core) cannot access class jdk.vm.ci.runtime.JVMCICompiler (in module jdk.vm.ci) because
+     * module jdk.vm.ci does not export jdk.vm.ci.runtime to module org.graalvm.compiler.graal_core
+     * </pre>
+     */
+    void onCompilerCreation(JVMCICompiler compiler) {
         assert this.graalRuntime == null : "only expect a single JVMCICompiler to be created";
-        this.graalRuntime = (HotSpotGraalRuntime) compiler.getGraalRuntime();
+        this.graalRuntime = (HotSpotGraalRuntime) ((HotSpotGraalCompiler) compiler).getGraalRuntime();
     }
 }