Merged gcj-eclipse branch to trunk.

From-SVN: r120621

43 files changed, 955 insertions, 735 deletions

diff --git a/libjava/classpath/java/security/AccessControlContext.java b/libjava/classpath/java/security/AccessControlContext.java
index 3b51e94..ffcfc0e 100644
--- a/libjava/classpath/java/security/AccessControlContext.java
+++ b/libjava/classpath/java/security/AccessControlContext.java
@@ -89,12 +89,30 @@ public final class AccessControlContext
   public AccessControlContext(AccessControlContext acc,
 			      DomainCombiner combiner)
   {
+    AccessControlContext acc2 = null;
     SecurityManager sm = System.getSecurityManager ();
     if (sm != null)
       {
-        sm.checkPermission (new SecurityPermission ("createAccessControlContext"));
+	Permission perm =
+	  new SecurityPermission ("createAccessControlContext");
+
+	// The default SecurityManager.checkPermission(perm) just calls 
+	// AccessController.checkPermission(perm) which in turn just
+	// calls AccessController.getContext().checkPermission(perm).
+	// This means AccessController.getContext() is called twice,
+	// once for the security check and once by us.  It's a very
+	// expensive call (on gcj at least) so if we're using the
+	// default security manager we avoid this duplication.
+	if (sm.getClass() == SecurityManager.class)
+	  {
+	    acc2 = AccessController.getContext ();
+	    acc2.checkPermission (perm);
+	  }
+	else
+	  sm.checkPermission (perm);
       }
-    AccessControlContext acc2 = AccessController.getContext();
+    if (acc2 == null)
+      acc2 = AccessController.getContext ();
     protectionDomains = combiner.combine (acc2.protectionDomains,
                                           acc.protectionDomains);
     this.combiner = combiner;
diff --git a/libjava/classpath/java/security/AccessController.java b/libjava/classpath/java/security/AccessController.java
index 93e34b8..6f8b3ec 100644
--- a/libjava/classpath/java/security/AccessController.java
+++ b/libjava/classpath/java/security/AccessController.java
@@ -88,7 +88,7 @@ public final class AccessController
    * should be be called.
    * @return the result of the <code>action.run()</code> method.
    */
-  public static Object doPrivileged(PrivilegedAction action)
+  public static <T> T doPrivileged(PrivilegedAction<T> action)
   {
     VMAccessController.pushContext(null);
     try
@@ -115,8 +115,8 @@ public final class AccessController
    * domains should be added to the protection domain of the calling class.
    * @return the result of the <code>action.run()</code> method.
    */
-  public static Object doPrivileged(PrivilegedAction action,
-                                    AccessControlContext context)
+  public static <T> T doPrivileged(PrivilegedAction<T> action,
+                                   AccessControlContext context)
   {
     VMAccessController.pushContext(context);
     try
@@ -145,7 +145,7 @@ public final class AccessController
    * @exception PrivilegedActionException wrapped around any checked exception
    * that is thrown in the <code>run()</code> method.
    */
-  public static Object doPrivileged(PrivilegedExceptionAction action)
+  public static <T> T doPrivileged(PrivilegedExceptionAction<T> action)
     throws PrivilegedActionException
   {
     VMAccessController.pushContext(null);
@@ -185,8 +185,8 @@ public final class AccessController
    * @exception PrivilegedActionException wrapped around any checked exception
    * that is thrown in the <code>run()</code> method.
    */
-  public static Object doPrivileged(PrivilegedExceptionAction action,
-                                    AccessControlContext context)
+  public static <T> T doPrivileged(PrivilegedExceptionAction<T> action,
+                                   AccessControlContext context)
     throws PrivilegedActionException
   {
     VMAccessController.pushContext(context);
diff --git a/libjava/classpath/java/security/AlgorithmParameterGenerator.java b/libjava/classpath/java/security/AlgorithmParameterGenerator.java
index e33fbaf..e2a17d4 100644
--- a/libjava/classpath/java/security/AlgorithmParameterGenerator.java
+++ b/libjava/classpath/java/security/AlgorithmParameterGenerator.java
@@ -40,6 +40,7 @@ package java.security;
 
 import gnu.java.security.Engine;
 
+import java.lang.reflect.InvocationTargetException;
 import java.security.spec.AlgorithmParameterSpec;
 
 /**
@@ -97,26 +98,29 @@ public class AlgorithmParameterGenerator
    * Returns a new <code>AlgorithmParameterGenerator</code> instance which
    * generates algorithm parameters for the specified algorithm.
    * 
-   * @param algorithm
-   *          the name of algorithm to use.
+   * @param algorithm the name of algorithm to use.
    * @return the new instance.
-   * @throws NoSuchAlgorithmException
-   *           if <code>algorithm</code> is not implemented by any provider.
+   * @throws NoSuchAlgorithmException if <code>algorithm</code> is not
+   *           implemented by any provider.
+   * @throws IllegalArgumentException if <code>algorithm</code> is
+   *           <code>null</code> or is an empty string.
    */
   public static AlgorithmParameterGenerator getInstance(String algorithm)
-    throws NoSuchAlgorithmException
+      throws NoSuchAlgorithmException
   {
     Provider[] p = Security.getProviders();
+    NoSuchAlgorithmException lastException = null;
     for (int i = 0; i < p.length; i++)
       try
         {
           return getInstance(algorithm, p[i]);
         }
-      catch (NoSuchAlgorithmException e)
-	{
-	  // Ignore.
-	}
-
+      catch (NoSuchAlgorithmException x)
+        {
+          lastException = x;
+        }
+    if (lastException != null)
+      throw lastException;
     throw new NoSuchAlgorithmException(algorithm);
   }
 
@@ -124,27 +128,27 @@ public class AlgorithmParameterGenerator
    * Returns a new <code>AlgorithmParameterGenerator</code> instance which
    * generates algorithm parameters for the specified algorithm.
    * 
-   * @param algorithm
-   *          the name of algorithm to use.
-   * @param provider
-   *          the name of the {@link Provider} to use.
+   * @param algorithm the name of algorithm to use.
+   * @param provider the name of the {@link Provider} to use.
    * @return the new instance.
-   * @throws NoSuchAlgorithmException
-   *           if the algorithm is not implemented by the named provider.
-   * @throws NoSuchProviderException
-   *           if the named provider was not found.
+   * @throws NoSuchAlgorithmException if the algorithm is not implemented by the
+   *           named provider.
+   * @throws NoSuchProviderException if the named provider was not found.
+   * @throws IllegalArgumentException if either <code>algorithm</code> or
+   *           <code>provider</code> is <code>null</code> or empty.
    */
   public static AlgorithmParameterGenerator getInstance(String algorithm,
-							String provider)
-    throws NoSuchAlgorithmException, NoSuchProviderException
+                                                        String provider)
+      throws NoSuchAlgorithmException, NoSuchProviderException
   {
-    if (provider == null || provider.length() == 0)
-      throw new IllegalArgumentException("Illegal provider");
-
+    if (provider == null)
+      throw new IllegalArgumentException("provider MUST NOT be null");
+    provider = provider.trim();
+    if (provider.length() == 0)
+      throw new IllegalArgumentException("provider MUST NOT be empty");
     Provider p = Security.getProvider(provider);
     if (p == null)
       throw new NoSuchProviderException(provider);
-
     return getInstance(algorithm, p);
   }
 
@@ -152,38 +156,50 @@ public class AlgorithmParameterGenerator
    * Returns a new <code>AlgorithmParameterGenerator</code> instance which
    * generates algorithm parameters for the specified algorithm.
    * 
-   * @param algorithm
-   *          the name of algorithm to use.
-   * @param provider
-   *          the {@link Provider} to use.
+   * @param algorithm the name of algorithm to use.
+   * @param provider the {@link Provider} to use.
    * @return the new instance.
-   * @throws NoSuchAlgorithmException
-   *           if the algorithm is not implemented by {@link Provider}.
+   * @throws NoSuchAlgorithmException if the algorithm is not implemented by
+   *           {@link Provider}.
+   * @throws IllegalArgumentException if either <code>algorithm</code> or
+   *           <code>provider</code> is <code>null</code>, or if
+   *           <code>algorithm</code> is an empty string.
    * @since 1.4
    * @see Provider
    */
   public static AlgorithmParameterGenerator getInstance(String algorithm,
                                                         Provider provider)
-    throws NoSuchAlgorithmException
+      throws NoSuchAlgorithmException
   {
-    if (provider == null)
-      throw new IllegalArgumentException("Illegal provider");
-
+    StringBuilder sb = new StringBuilder()
+        .append("AlgorithmParameterGenerator for algorithm [")
+        .append(algorithm).append("] from provider[")
+        .append(provider).append("] could not be created");
+    Throwable cause;
     try
       {
-	return new AlgorithmParameterGenerator(
-	  (AlgorithmParameterGeneratorSpi) Engine.getInstance(
-	    ALGORITHM_PARAMETER_GENERATOR, algorithm, provider),
-	  provider, algorithm);
+        Object spi = Engine.getInstance(ALGORITHM_PARAMETER_GENERATOR,
+                                        algorithm,
+                                        provider);
+        return new AlgorithmParameterGenerator((AlgorithmParameterGeneratorSpi) spi,
+                                               provider,
+                                               algorithm);
       }
-    catch (java.lang.reflect.InvocationTargetException ite)
+    catch (InvocationTargetException x)
       {
-	throw new NoSuchAlgorithmException(algorithm);
+        cause = x.getCause();
+        if (cause instanceof NoSuchAlgorithmException)
+          throw (NoSuchAlgorithmException) cause;
+        if (cause == null)
+          cause = x;
       }
-    catch (ClassCastException cce)
+    catch (ClassCastException x)
       {
-	throw new NoSuchAlgorithmException(algorithm);
+        cause = x;
       }
+    NoSuchAlgorithmException x = new NoSuchAlgorithmException(sb.toString());
+    x.initCause(cause);
+    throw x;
   }
 
   /** @return the {@link Provider} of this generator. */
diff --git a/libjava/classpath/java/security/AlgorithmParameters.java b/libjava/classpath/java/security/AlgorithmParameters.java
index c4655ae..f5e5063 100644
--- a/libjava/classpath/java/security/AlgorithmParameters.java
+++ b/libjava/classpath/java/security/AlgorithmParameters.java
@@ -41,6 +41,7 @@ package java.security;
 import gnu.java.security.Engine;
 
 import java.io.IOException;
+import java.lang.reflect.InvocationTargetException;
 import java.security.spec.AlgorithmParameterSpec;
 import java.security.spec.InvalidParameterSpecException;
 
@@ -91,106 +92,115 @@ public class AlgorithmParameters
   /**
    * Returns a new instance of <code>AlgorithmParameters</code> representing
    * the specified algorithm parameters.
+   * <p>
+   * The returned <code>AlgorithmParameters</code> must still be initialized
+   * with an <code>init()</code> method.
    * 
-   * <p>The returned <code>AlgorithmParameters</code> must still be initialized
-   * with an <code>init()</code> method.</p>
-   * 
-   * @param algorithm
-   *          the algorithm to use.
+   * @param algorithm the algorithm to use.
    * @return the new instance repesenting the desired algorithm.
-   * @throws NoSuchAlgorithmException
-   *           if the algorithm is not implemented by any provider.
+   * @throws NoSuchAlgorithmException if the algorithm is not implemented by any
+   *           provider.
+   * @throws IllegalArgumentException if <code>algorithm</code> is
+   *           <code>null</code> or is an empty string.
    */
   public static AlgorithmParameters getInstance(String algorithm)
-    throws NoSuchAlgorithmException
+      throws NoSuchAlgorithmException
   {
     Provider[] p = Security.getProviders();
-
+    NoSuchAlgorithmException lastException = null;
     for (int i = 0; i < p.length; i++)
       try
         {
           return getInstance(algorithm, p[i]);
         }
-      catch (NoSuchAlgorithmException e)
-	{
-	  // Ignore this.
-	}
-
+      catch (NoSuchAlgorithmException x)
+        {
+          lastException = x;
+        }
+    if (lastException != null)
+      throw lastException;
     throw new NoSuchAlgorithmException(algorithm);
   }
 
   /**
    * Returns a new instance of <code>AlgorithmParameters</code> representing
    * the specified algorithm parameters from a named provider.
+   * <p>
+   * The returned <code>AlgorithmParameters</code> must still be intialized
+   * with an <code>init()</code> method.
+   * </p>
    * 
-   * <p>The returned <code>AlgorithmParameters</code> must still be intialized
-   * with an <code>init()</code> method.</p>
-   * 
-   * @param algorithm
-   *          the algorithm to use.
-   * @param provider
-   *          the name of the {@link Provider} to use.
+   * @param algorithm the algorithm to use.
+   * @param provider the name of the {@link Provider} to use.
    * @return the new instance repesenting the desired algorithm.
-   * @throws NoSuchAlgorithmException
-   *           if the algorithm is not implemented by the named provider.
-   * @throws NoSuchProviderException
-   *           if the named provider was not found.
-   * @throws IllegalArgumentException
-   *           if <code>provider</code> is <code>null</code> or is an empty
-   *           string.
+   * @throws NoSuchAlgorithmException if the algorithm is not implemented by the
+   *           named provider.
+   * @throws NoSuchProviderException if the named provider was not found.
+   * @throws IllegalArgumentException if either <code>algorithm</code> or
+   *           <code>provider</code> is <code>null</code> or empty.
    */
-  public static AlgorithmParameters getInstance(String algorithm, String provider)
-    throws NoSuchAlgorithmException, NoSuchProviderException
+  public static AlgorithmParameters getInstance(String algorithm,
+                                                String provider)
+      throws NoSuchAlgorithmException, NoSuchProviderException
   {
-    if (provider == null || provider.length() == 0)
-      throw new IllegalArgumentException("Illegal provider");
-    
+    if (provider == null)
+      throw new IllegalArgumentException("provider MUST NOT be null");
+    provider = provider.trim();
+    if (provider.length() == 0)
+      throw new IllegalArgumentException("provider MUST NOT be empty");
     Provider p = Security.getProvider(provider);
     if (p == null)
       throw new NoSuchProviderException(provider);
-
     return getInstance(algorithm, p);
   }
 
   /**
    * Returns a new instance of <code>AlgorithmParameters</code> representing
    * the specified algorithm parameters from the specified {@link Provider}.
+   * <p>
+   * The returned <code>AlgorithmParameters</code> must still be intialized
+   * with an <code>init()</code> method.
    * 
-   * <p>The returned <code>AlgorithmParameters</code> must still be intialized
-   * with an <code>init()</code> method.</p>
-   * 
-   * @param algorithm
-   *          the algorithm to use.
-   * @param provider
-   *          the {@link Provider} to use.
+   * @param algorithm the algorithm to use.
+   * @param provider the {@link Provider} to use.
    * @return the new instance repesenting the desired algorithm.
-   * @throws NoSuchAlgorithmException
-   *           if the algorithm is not implemented by the {@link Provider}.
-   * @throws IllegalArgumentException
-   *           if <code>provider</code> is <code>null</code>.
+   * @throws NoSuchAlgorithmException if the algorithm is not implemented by the
+   *           {@link Provider}.
+   * @throws IllegalArgumentException if either <code>algorithm</code> or
+   *           <code>provider</code> is <code>null</code>, or if
+   *           <code>algorithm</code> is an empty string.
    * @since 1.4
    */
   public static AlgorithmParameters getInstance(String algorithm,
                                                 Provider provider)
-    throws NoSuchAlgorithmException
+      throws NoSuchAlgorithmException
   {
-    if (provider == null)
-      throw new IllegalArgumentException("Illegal provider");
-
+    StringBuilder sb = new StringBuilder("AlgorithmParameters for algorithm [")
+        .append(algorithm).append("] from provider[")
+        .append(provider).append("] could not be created");
+    Throwable cause;
     try
       {
-	return new AlgorithmParameters((AlgorithmParametersSpi)
-	  Engine.getInstance(ALGORITHM_PARAMETERS, algorithm, provider),
-	  provider, algorithm);
+        Object spi = Engine.getInstance(ALGORITHM_PARAMETERS, algorithm, provider);
+        return new AlgorithmParameters((AlgorithmParametersSpi) spi,
+                                       provider,
+                                       algorithm);
       }
-    catch (java.lang.reflect.InvocationTargetException ite)
+    catch (InvocationTargetException x)
       {
-	throw new NoSuchAlgorithmException(algorithm);
+        cause = x.getCause();
+        if (cause instanceof NoSuchAlgorithmException)
+          throw (NoSuchAlgorithmException) cause;
+        if (cause == null)
+          cause = x;
       }
-    catch (ClassCastException cce)
+    catch (ClassCastException x)
       {
-	throw new NoSuchAlgorithmException(algorithm);
+        cause = x;
       }
+    NoSuchAlgorithmException x = new NoSuchAlgorithmException(sb.toString());
+    x.initCause(cause);
+    throw x;
   }
 
   /** @return the provider of this parameter object. */
@@ -258,7 +268,8 @@ public class AlgorithmParameters
    * @throws InvalidParameterSpecException
    *           if <code>paramSpec</code> is invalid.
    */
-  public final AlgorithmParameterSpec getParameterSpec(Class paramSpec)
+  public final <T extends AlgorithmParameterSpec>
+  T getParameterSpec(Class<T> paramSpec)
     throws InvalidParameterSpecException
   {
     return paramSpi.engineGetParameterSpec(paramSpec);
diff --git a/libjava/classpath/java/security/AlgorithmParametersSpi.java b/libjava/classpath/java/security/AlgorithmParametersSpi.java
index a9faa15..bd61ce7 100644
--- a/libjava/classpath/java/security/AlgorithmParametersSpi.java
+++ b/libjava/classpath/java/security/AlgorithmParametersSpi.java
@@ -113,8 +113,8 @@ public abstract class AlgorithmParametersSpi
    * @throws InvalidParameterSpecException if the paramSpec is an
    * invalid parameter class
    */
-  protected abstract AlgorithmParameterSpec engineGetParameterSpec(Class
-								   paramSpec)
+  protected abstract <T extends AlgorithmParameterSpec> 
+  T engineGetParameterSpec(Class<T> paramSpec)
     throws InvalidParameterSpecException;
 
 
diff --git a/libjava/classpath/java/security/IdentityScope.java b/libjava/classpath/java/security/IdentityScope.java
index d1ea1f2..610d353 100644
--- a/libjava/classpath/java/security/IdentityScope.java
+++ b/libjava/classpath/java/security/IdentityScope.java
@@ -201,7 +201,7 @@ public abstract class IdentityScope extends Identity
    * 
    * @return an {@link Enumeration} of the identities in this scope.
    */
-  public abstract Enumeration identities();
+  public abstract Enumeration<Identity> identities();
 
   /**
    * Returns a string representing this instance. It includes the name, the
diff --git a/libjava/classpath/java/security/KeyFactory.java b/libjava/classpath/java/security/KeyFactory.java
index edb2a87..043dd59 100644
--- a/libjava/classpath/java/security/KeyFactory.java
+++ b/libjava/classpath/java/security/KeyFactory.java
@@ -40,6 +40,7 @@ package java.security;
 
 import gnu.java.security.Engine;
 
+import java.lang.reflect.InvocationTargetException;
 import java.security.spec.InvalidKeySpecException;
 import java.security.spec.KeySpec;
 
@@ -93,26 +94,29 @@ public class KeyFactory
    * Returns a new instance of <code>KeyFactory</code> representing the
    * specified key factory.
    * 
-   * @param algorithm
-   *          the name of algorithm to use.
+   * @param algorithm the name of algorithm to use.
    * @return a new instance repesenting the desired algorithm.
-   * @throws NoSuchAlgorithmException
-   *           if the algorithm is not implemented by any provider.
+   * @throws NoSuchAlgorithmException if the algorithm is not implemented by any
+   *           provider.
+   * @throws IllegalArgumentException if <code>algorithm</code> is
+   *           <code>null</code> or is an empty string.
    */
   public static KeyFactory getInstance(String algorithm)
-    throws NoSuchAlgorithmException
+      throws NoSuchAlgorithmException
   {
     Provider[] p = Security.getProviders();
+    NoSuchAlgorithmException lastException = null;
     for (int i = 0; i < p.length; i++)
       try
         {
           return getInstance(algorithm, p[i]);
         }
-      catch (NoSuchAlgorithmException e)
-	{
-	  // Ignore.
-	}
-
+      catch (NoSuchAlgorithmException x)
+        {
+          lastException = x;
+        }
+    if (lastException != null)
+      throw lastException;
     throw new NoSuchAlgorithmException(algorithm);
   }
 
@@ -120,29 +124,26 @@ public class KeyFactory
    * Returns a new instance of <code>KeyFactory</code> representing the
    * specified key factory from the specified provider.
    * 
-   * @param algorithm
-   *          the name of algorithm to use.
-   * @param provider
-   *          the name of the provider to use.
+   * @param algorithm the name of algorithm to use.
+   * @param provider the name of the provider to use.
    * @return a new instance repesenting the desired algorithm.
-   * @throws IllegalArgumentException
-   *           if <code>provider</code> is <code>null</code> or is an empty
-   *           string.
-   * @throws NoSuchAlgorithmException
-   *           if the algorithm is not implemented by the named provider.
-   * @throws NoSuchProviderException
-   *           if the named provider was not found.
+   * @throws NoSuchAlgorithmException if the algorithm is not implemented by the
+   *           named provider.
+   * @throws NoSuchProviderException if the named provider was not found.
+   * @throws IllegalArgumentException if either <code>algorithm</code> or
+   *           <code>provider</code> is <code>null</code> or empty.
    */
   public static KeyFactory getInstance(String algorithm, String provider)
-    throws NoSuchAlgorithmException, NoSuchProviderException
+      throws NoSuchAlgorithmException, NoSuchProviderException
   {
-    if (provider == null || provider.length() == 0)
-      throw new IllegalArgumentException("Illegal provider");
-
+    if (provider == null)
+      throw new IllegalArgumentException("provider MUST NOT be null");
+    provider = provider.trim();
+    if (provider.length() == 0)
+      throw new IllegalArgumentException("provider MUST NOT be empty");
     Provider p = Security.getProvider(provider);
     if (p == null)
       throw new NoSuchProviderException(provider);
-
     return getInstance(algorithm, p);
   }
 
@@ -150,38 +151,44 @@ public class KeyFactory
    * Returns a new instance of <code>KeyFactory</code> representing the
    * specified key factory from the designated {@link Provider}.
    * 
-   * @param algorithm
-   *          the name of algorithm to use.
-   * @param provider
-   *          the {@link Provider} to use.
+   * @param algorithm the name of algorithm to use.
+   * @param provider the {@link Provider} to use.
    * @return a new instance repesenting the desired algorithm.
-   * @throws IllegalArgumentException
-   *           if <code>provider</code> is <code>null</code>.
-   * @throws NoSuchAlgorithmException
-   *           if the algorithm is not implemented by {@link Provider}.
+   * @throws NoSuchAlgorithmException if the algorithm is not implemented by
+   *           {@link Provider}.
+   * @throws IllegalArgumentException if either <code>algorithm</code> or
+   *           <code>provider</code> is <code>null</code>, or if
+   *           <code>algorithm</code> is an empty string.
    * @since 1.4
    * @see Provider
    */
   public static KeyFactory getInstance(String algorithm, Provider provider)
-    throws NoSuchAlgorithmException
+      throws NoSuchAlgorithmException
   {
-    if (provider == null)
-      throw new IllegalArgumentException("Illegal provider");
-
+    StringBuilder sb = new StringBuilder("KeyFactory for algorithm [")
+        .append(algorithm).append("] from provider[")
+        .append(provider).append("] could not be created");
+    Throwable cause;
     try
       {
-	return new KeyFactory((KeyFactorySpi)
-	  Engine.getInstance(KEY_FACTORY, algorithm, provider),
-          provider, algorithm);
+        Object spi = Engine.getInstance(KEY_FACTORY, algorithm, provider);
+        return new KeyFactory((KeyFactorySpi) spi, provider, algorithm);
       }
-    catch (java.lang.reflect.InvocationTargetException ite)
+    catch (InvocationTargetException x)
       {
-	throw new NoSuchAlgorithmException(algorithm);
+        cause = x.getCause();
+        if (cause instanceof NoSuchAlgorithmException)
+          throw (NoSuchAlgorithmException) cause;
+        if (cause == null)
+          cause = x;
       }
-    catch (ClassCastException cce)
+    catch (ClassCastException x)
       {
-	throw new NoSuchAlgorithmException(algorithm);
-      } 
+        cause = x;
+      }
+    NoSuchAlgorithmException x = new NoSuchAlgorithmException(sb.toString());
+    x.initCause(cause);
+    throw x;
   }
 
   /**
@@ -248,7 +255,7 @@ public class KeyFactory
    *           the requested key specification is inappropriate for this key or
    *           the key is unrecognized.
    */
-  public final KeySpec getKeySpec(Key key, Class keySpec)
+  public final <T extends KeySpec> T getKeySpec(Key key, Class<T> keySpec)
     throws InvalidKeySpecException
   {
     return keyFacSpi.engineGetKeySpec(key, keySpec);
diff --git a/libjava/classpath/java/security/KeyFactorySpi.java b/libjava/classpath/java/security/KeyFactorySpi.java
index 1894fad0..fa56378 100644
--- a/libjava/classpath/java/security/KeyFactorySpi.java
+++ b/libjava/classpath/java/security/KeyFactorySpi.java
@@ -113,7 +113,8 @@ public abstract class KeyFactorySpi
    * is inappropriate for this key or the key is 
    * unrecognized.
    */
-  protected abstract KeySpec engineGetKeySpec(Key key, Class keySpec)
+  protected abstract <T extends KeySpec> T engineGetKeySpec(Key key,
+                                                            Class<T> keySpec)
     throws InvalidKeySpecException;
 
 
@@ -121,11 +122,11 @@ public abstract class KeyFactorySpi
    * Translates the key from an unknown or untrusted provider
    * into a key for this key factory.
    *
-   * @param the key from an unknown or untrusted provider
+   * @param key key from an unknown or untrusted provider
    *
    * @return the translated key
    *
-   * @throws InvalidKeySpecException if the key cannot be 
+   * @throws InvalidKeyException if the key cannot be 
    * processed by this key factory
    */
   protected abstract Key engineTranslateKey(Key key)
diff --git a/libjava/classpath/java/security/KeyPairGenerator.java b/libjava/classpath/java/security/KeyPairGenerator.java
index 357d7a7..6974035 100644
--- a/libjava/classpath/java/security/KeyPairGenerator.java
+++ b/libjava/classpath/java/security/KeyPairGenerator.java
@@ -40,6 +40,7 @@ package java.security;
 
 import gnu.java.security.Engine;
 
+import java.lang.reflect.InvocationTargetException;
 import java.security.spec.AlgorithmParameterSpec;
 
 /**
@@ -90,28 +91,29 @@ public abstract class KeyPairGenerator extends KeyPairGeneratorSpi
    * Returns a new instance of <code>KeyPairGenerator</code> which generates
    * key-pairs for the specified algorithm.
    * 
-   * @param algorithm
-   *          the name of the algorithm to use.
+   * @param algorithm the name of the algorithm to use.
    * @return a new instance repesenting the desired algorithm.
-   * @throws NoSuchAlgorithmException
-   *           if the algorithm is not implemented by any provider.
+   * @throws NoSuchAlgorithmException if the algorithm is not implemented by any
+   *           provider.
+   * @throws IllegalArgumentException if <code>algorithm</code> is
+   *           <code>null</code> or is an empty string.
    */
   public static KeyPairGenerator getInstance(String algorithm)
-    throws NoSuchAlgorithmException
+      throws NoSuchAlgorithmException
   {
     Provider[] p = Security.getProviders();
+    NoSuchAlgorithmException lastException = null;
     for (int i = 0; i < p.length; i++)
-      {
-        try
-          {
-            return getInstance(algorithm, p[i]);
-	  }
-	catch (NoSuchAlgorithmException e)
-	  {
-	    // Ignored.
-	  }
-      }
-
+      try
+        {
+          return getInstance(algorithm, p[i]);
+        }
+      catch (NoSuchAlgorithmException x)
+        {
+          lastException = x;
+        }
+    if (lastException != null)
+      throw lastException;
     throw new NoSuchAlgorithmException(algorithm);
   }
 
@@ -119,23 +121,26 @@ public abstract class KeyPairGenerator extends KeyPairGeneratorSpi
    * Returns a new instance of <code>KeyPairGenerator</code> which generates
    * key-pairs for the specified algorithm from a named provider.
    * 
-   * @param algorithm
-   *          the name of the algorithm to use.
-   * @param provider
-   *          the name of a {@link Provider} to use.
+   * @param algorithm the name of the algorithm to use.
+   * @param provider the name of a {@link Provider} to use.
    * @return a new instance repesenting the desired algorithm.
-   * @throws NoSuchAlgorithmException
-   *           if the algorithm is not implemented by the named provider.
-   * @throws NoSuchProviderException
-   *           if the named provider was not found.
+   * @throws NoSuchAlgorithmException if the algorithm is not implemented by the
+   *           named provider.
+   * @throws NoSuchProviderException if the named provider was not found.
+   * @throws IllegalArgumentException if either <code>algorithm</code> or
+   *           <code>provider</code> is <code>null</code> or empty.
    */
   public static KeyPairGenerator getInstance(String algorithm, String provider)
-    throws NoSuchAlgorithmException, NoSuchProviderException
+      throws NoSuchAlgorithmException, NoSuchProviderException
   {
+    if (provider == null)
+      throw new IllegalArgumentException("provider MUST NOT be null");
+    provider = provider.trim();
+    if (provider.length() == 0)
+      throw new IllegalArgumentException("provider MUST NOT be empty");
     Provider p = Security.getProvider(provider);
     if (p == null)
       throw new NoSuchProviderException(provider);
-
     return getInstance(algorithm, p);
   }
 
@@ -148,10 +153,11 @@ public abstract class KeyPairGenerator extends KeyPairGeneratorSpi
    * @param provider
    *          the {@link Provider} to use.
    * @return a new insatnce repesenting the desired algorithm.
-   * @throws IllegalArgumentException
-   *           if <code>provider</code> is <code>null</code>.
    * @throws NoSuchAlgorithmException
    *           if the algorithm is not implemented by the {@link Provider}.
+   * @throws IllegalArgumentException if either <code>algorithm</code> or
+   *           <code>provider</code> is <code>null</code>, or if
+   *           <code>algorithm</code> is an empty string.
    * @since 1.4
    * @see Provider
    */
@@ -159,20 +165,27 @@ public abstract class KeyPairGenerator extends KeyPairGeneratorSpi
 					     Provider provider)
     throws NoSuchAlgorithmException
   {
-    if (provider == null)
-      throw new IllegalArgumentException("Illegal provider");
-
-    Object o = null;
+    StringBuilder sb = new StringBuilder("KeyPairGenerator for algorithm [")
+        .append(algorithm).append("] from provider[")
+        .append(provider).append("] ");
+    Object o;
     try
       {
         o = Engine.getInstance(KEY_PAIR_GENERATOR, algorithm, provider);
       }
-    catch (java.lang.reflect.InvocationTargetException ite)
+    catch (InvocationTargetException x)
       {
-	throw new NoSuchAlgorithmException(algorithm);
+        Throwable cause = x.getCause();
+        if (cause instanceof NoSuchAlgorithmException)
+          throw (NoSuchAlgorithmException) cause;
+        if (cause == null)
+          cause = x;
+        sb.append("could not be created");
+        NoSuchAlgorithmException y = new NoSuchAlgorithmException(sb.toString());
+        y.initCause(cause);
+        throw y;
       }
-
-    KeyPairGenerator result = null;
+    KeyPairGenerator result;
     if (o instanceof KeyPairGenerator)
       {
         result = (KeyPairGenerator) o;
@@ -180,7 +193,11 @@ public abstract class KeyPairGenerator extends KeyPairGeneratorSpi
       }
     else if (o instanceof KeyPairGeneratorSpi)
       result = new DummyKeyPairGenerator((KeyPairGeneratorSpi) o, algorithm);
-
+    else
+      {
+        sb.append("is of an unexpected Type: ").append(o.getClass().getName());
+        throw new NoSuchAlgorithmException(sb.toString());
+      }
     result.provider = provider;
     return result;
   }
diff --git a/libjava/classpath/java/security/KeyStore.java b/libjava/classpath/java/security/KeyStore.java
index 8681d82..1d036c3 100644
--- a/libjava/classpath/java/security/KeyStore.java
+++ b/libjava/classpath/java/security/KeyStore.java
@@ -43,6 +43,7 @@ import gnu.java.security.Engine;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
+import java.lang.reflect.InvocationTargetException;
 import java.security.cert.CertificateException;
 import java.util.Date;
 import java.util.Enumeration;
@@ -108,105 +109,100 @@ public class KeyStore
     this.type = type;
   }
 
-  // Class methods.
-  // ------------------------------------------------------------------------
-
-  /** 
-   * Gets an instance of the KeyStore class representing
-   * the specified keystore. If the type is not 
-   * found then, it throws KeyStoreException.
-   *
-   * @param type the type of keystore to choose
-   * @return a KeyStore repesenting the desired type
-   * @throws KeyStoreException if the type of keystore is not implemented
-   *         by providers or the implementation cannot be instantiated.
+  /**
+   * Returns an instance of a <code>KeyStore</code> representing the specified
+   * type, from the first provider that implements it.
+   * 
+   * @param type the type of keystore to create.
+   * @return a <code>KeyStore</code> repesenting the desired type.
+   * @throws KeyStoreException if the designated type of is not implemented by
+   *           any provider, or the implementation could not be instantiated.
+   * @throws IllegalArgumentException if <code>type</code> is
+   *           <code>null</code> or is an empty string.
    */
   public static KeyStore getInstance(String type) throws KeyStoreException
   {
     Provider[] p = Security.getProviders();
-
+    KeyStoreException lastException = null;
     for (int i = 0; i < p.length; i++)
-      {
-        try
-          {
-            return getInstance(type, p[i]);
-          }
-        catch (KeyStoreException e)
-          {
-	    // Ignore.
-          }
-      }
-
+      try
+        {
+          return getInstance(type, p[i]);
+        }
+      catch (KeyStoreException x)
+        {
+          lastException = x;
+        }
+    if (lastException != null)
+      throw lastException;
     throw new KeyStoreException(type);
   }
 
-  /** 
-   * Gets an instance of the KeyStore class representing
-   * the specified key store from the specified provider. 
-   * If the type is not found then, it throws KeyStoreException. 
-   * If the provider is not found, then it throws 
-   * NoSuchProviderException.
-   *
-   * @param type the type of keystore to choose
-   * @param provider the provider name
-   * @return a KeyStore repesenting the desired type
-   * @throws KeyStoreException if the type of keystore is not 
-   *          implemented by the given provider
-   * @throws NoSuchProviderException if the provider is not found
-   * @throws IllegalArgumentException if the provider string is 
-   *           null or empty
+  /**
+   * Returns an instance of a <code>KeyStore</code> representing the specified
+   * type, from the named provider.
+   * 
+   * @param type the type of keystore to create.
+   * @param provider the name of the provider to use.
+   * @return a <code>KeyStore</code> repesenting the desired type.
+   * @throws KeyStoreException if the designated type is not implemented by the
+   *           given provider.
+   * @throws NoSuchProviderException if the provider is not found.
+   * @throws IllegalArgumentException if either <code>type</code> or
+   *           <code>provider</code> is <code>null</code> or empty.
    */
   public static KeyStore getInstance(String type, String provider)
     throws KeyStoreException, NoSuchProviderException
   {
-    if (provider == null || provider.length() == 0)
-      throw new IllegalArgumentException("Illegal provider");
-
+    if (provider == null)
+      throw new IllegalArgumentException("provider MUST NOT be null");
+    provider = provider.trim();
+    if (provider.length() == 0)
+      throw new IllegalArgumentException("provider MUST NOT be empty");
     Provider p = Security.getProvider(provider);
     if (p == null)
       throw new NoSuchProviderException(provider);
-
     return getInstance(type, p);
   }
 
-  /** 
-   * Gets an instance of the KeyStore class representing
-   * the specified key store from the specified provider. 
-   * If the type is not found then, it throws KeyStoreException. 
-   * If the provider is not found, then it throws 
-   * NoSuchProviderException.
-   *
-   * @param type the type of keystore to choose
-   * @param provider the keystore provider
-   * @return a KeyStore repesenting the desired type
-   * @throws KeyStoreException if the type of keystore is not 
-   *          implemented by the given provider
-   * @throws IllegalArgumentException if the provider object is null
+  /**
+   * Returns an instance of a <code>KeyStore</code> representing the specified
+   * type, from the specified provider.
+   * 
+   * @param type the type of keystore to create.
+   * @param provider the provider to use.
+   * @return a <code>KeyStore</code> repesenting the desired type.
+   * @throws KeyStoreException if the designated type is not implemented by the
+   *           given provider.
+   * @throws IllegalArgumentException if either <code>type</code> or
+   *           <code>provider</code> is <code>null</code>, or if
+   *           <code>type</code> is an empty string.
    * @since 1.4
    */
   public static KeyStore getInstance(String type, Provider provider)
-    throws KeyStoreException 
+      throws KeyStoreException
   {
-    if (provider == null)
-      throw new IllegalArgumentException("Illegal provider");
+    Throwable cause;
     try
       {
-        return new KeyStore(
-          (KeyStoreSpi) Engine.getInstance(KEY_STORE, type, provider),
-          provider, type);
+        Object spi = Engine.getInstance(KEY_STORE, type, provider);
+        return new KeyStore((KeyStoreSpi) spi, provider, type);
       }
-    catch (NoSuchAlgorithmException nsae)
+    catch (NoSuchAlgorithmException x)
       {
-        throw new KeyStoreException(type);
+        cause = x;
       }
-    catch (java.lang.reflect.InvocationTargetException ite)
+    catch (InvocationTargetException x)
       {
-	throw new KeyStoreException(type);
+        cause = x.getCause() != null ? x.getCause() : x;
       }
-    catch (ClassCastException cce)
+    catch (ClassCastException x)
       {
-        throw new KeyStoreException(type);
+        cause = x;
       }
+    KeyStoreException x = new KeyStoreException(type);
+    x.initCause(cause);
+    throw x;
   }
 
   /**
@@ -392,7 +388,7 @@ public class KeyStore
 
      @return an Enumeration of the aliases
    */
-  public final Enumeration aliases() throws KeyStoreException
+  public final Enumeration<String> aliases() throws KeyStoreException
   {
     return keyStoreSpi.engineAliases();
   }
diff --git a/libjava/classpath/java/security/KeyStoreSpi.java b/libjava/classpath/java/security/KeyStoreSpi.java
index a16008f..c8d2316 100644
--- a/libjava/classpath/java/security/KeyStoreSpi.java
+++ b/libjava/classpath/java/security/KeyStoreSpi.java
@@ -187,7 +187,7 @@ public abstract class KeyStoreSpi
    *
    * @return an Enumeration of the aliases
    */
-  public abstract Enumeration engineAliases();
+  public abstract Enumeration<String> engineAliases();
 
   /**
    * Determines if the keystore contains the specified alias.
diff --git a/libjava/classpath/java/security/MessageDigest.java b/libjava/classpath/java/security/MessageDigest.java
index b817759..0f8e934 100644
--- a/libjava/classpath/java/security/MessageDigest.java
+++ b/libjava/classpath/java/security/MessageDigest.java
@@ -38,6 +38,9 @@ exception statement from your version. */
 package java.security;
 
 import gnu.java.security.Engine;
+import java.nio.ByteBuffer;
+
+import java.lang.reflect.InvocationTargetException;
 
 /**
  * Message digests are secure one-way hash functions that take arbitrary-sized
@@ -72,28 +75,29 @@ public abstract class MessageDigest extends MessageDigestSpi
    * Returns a new instance of <code>MessageDigest</code> representing the
    * specified algorithm.
    * 
-   * @param algorithm
-   *          the name of the digest algorithm to use.
+   * @param algorithm the name of the digest algorithm to use.
    * @return a new instance representing the desired algorithm.
-   * @throws NoSuchAlgorithmException
-   *           if the algorithm is not implemented by any provider.
+   * @throws NoSuchAlgorithmException if the algorithm is not implemented by any
+   *           provider.
+   * @throws IllegalArgumentException if <code>algorithm</code> is
+   *           <code>null</code> or is an empty string.
    */
   public static MessageDigest getInstance(String algorithm)
-    throws NoSuchAlgorithmException
+      throws NoSuchAlgorithmException
   {
     Provider[] p = Security.getProviders();
+    NoSuchAlgorithmException lastException = null;
     for (int i = 0; i < p.length; i++)
-      {
-        try
-          {
-            return getInstance(algorithm, p[i]);
-          }
-        catch (NoSuchAlgorithmException ignored)
-	  {
-	    // Ignore.
-	  }
-      }
-
+      try
+        {
+          return getInstance(algorithm, p[i]);
+        }
+      catch (NoSuchAlgorithmException x)
+        {
+          lastException = x;
+        }
+    if (lastException != null)
+      throw lastException;
     throw new NoSuchAlgorithmException(algorithm);
   }
 
@@ -101,29 +105,26 @@ public abstract class MessageDigest extends MessageDigestSpi
    * Returns a new instance of <code>MessageDigest</code> representing the
    * specified algorithm from a named provider.
    * 
-   * @param algorithm
-   *          the name of the digest algorithm to use.
-   * @param provider
-   *          the name of the provider to use.
+   * @param algorithm the name of the digest algorithm to use.
+   * @param provider the name of the provider to use.
    * @return a new instance representing the desired algorithm.
-   * @throws NoSuchAlgorithmException
-   *           if the algorithm is not implemented by the named provider.
-   * @throws NoSuchProviderException
-   *           if the named provider was not found.
+   * @throws NoSuchAlgorithmException if the algorithm is not implemented by the
+   *           named provider.
+   * @throws NoSuchProviderException if the named provider was not found.
+   * @throws IllegalArgumentException if either <code>algorithm</code> or
+   *           <code>provider</code> is <code>null</code> or empty.
    */
   public static MessageDigest getInstance(String algorithm, String provider)
-    throws NoSuchAlgorithmException, NoSuchProviderException
+      throws NoSuchAlgorithmException, NoSuchProviderException
   {
-    if (provider != null)
-      provider = provider.trim();
-
-    if (provider == null || provider.length() == 0)
-      throw new IllegalArgumentException("Illegal provider");
-
+    if (provider == null)
+      throw new IllegalArgumentException("provider MUST NOT be null");
+    provider = provider.trim();
+    if (provider.length() == 0)
+      throw new IllegalArgumentException("provider MUST NOT be empty");
     Provider p = Security.getProvider(provider);
     if (p == null)
       throw new NoSuchProviderException(provider);
-
     return getInstance(algorithm, p);
   }
 
@@ -131,39 +132,43 @@ public abstract class MessageDigest extends MessageDigestSpi
    * Returns a new instance of <code>MessageDigest</code> representing the
    * specified algorithm from a designated {@link Provider}.
    * 
-   * @param algorithm
-   *          the name of the digest algorithm to use.
-   * @param provider
-   *          the {@link Provider} to use.
+   * @param algorithm the name of the digest algorithm to use.
+   * @param provider the {@link Provider} to use.
    * @return a new instance representing the desired algorithm.
-   * @throws IllegalArgumentException
-   *           if <code>provider</code> is <code>null</code>.
-   * @throws NoSuchAlgorithmException
-   *           if the algorithm is not implemented by {@link Provider}.
+   * @throws NoSuchAlgorithmException if the algorithm is not implemented by
+   *           {@link Provider}.
+   * @throws IllegalArgumentException if either <code>algorithm</code> or
+   *           <code>provider</code> is <code>null</code>, or if
+   *           <code>algorithm</code> is an empty string.
    * @since 1.4
    * @see Provider
    */
   public static MessageDigest getInstance(String algorithm, Provider provider)
     throws NoSuchAlgorithmException
   {
-    if (provider == null)
-      throw new IllegalArgumentException("Illegal provider");
-
-    MessageDigest result = null;
-    Object o = null;
+    StringBuilder sb = new StringBuilder("MessageDigest for algorithm [")
+        .append(algorithm).append("] from provider[")
+        .append(provider).append("] ");
+    Object o;
     try
       {
         o = Engine.getInstance(MESSAGE_DIGEST, algorithm, provider);
       }
-    catch (java.lang.reflect.InvocationTargetException ite)
+    catch (InvocationTargetException x)
       {
-        throw new NoSuchAlgorithmException(algorithm);
+        Throwable cause = x.getCause();
+        if (cause instanceof NoSuchAlgorithmException)
+          throw (NoSuchAlgorithmException) cause;
+        if (cause == null)
+          cause = x;
+        sb.append("could not be created");
+        NoSuchAlgorithmException y = new NoSuchAlgorithmException(sb.toString());
+        y.initCause(cause);
+        throw y;
       }
-
+    MessageDigest result;
     if (o instanceof MessageDigestSpi)
-      {
-        result = new DummyMessageDigest((MessageDigestSpi) o, algorithm);
-      }
+      result = new DummyMessageDigest((MessageDigestSpi) o, algorithm);
     else if (o instanceof MessageDigest)
       {
         result = (MessageDigest) o;
@@ -171,7 +176,8 @@ public abstract class MessageDigest extends MessageDigestSpi
       }
     else
       {
-        throw new NoSuchAlgorithmException(algorithm);
+        sb.append("is of an unexpected Type: ").append(o.getClass().getName());
+        throw new NoSuchAlgorithmException(sb.toString());
       }
     result.provider = provider;
     return result;
@@ -224,6 +230,17 @@ public abstract class MessageDigest extends MessageDigestSpi
   }
 
   /**
+   * Updates the digest with the remaining bytes of a buffer.
+   * 
+   * @param input The input byte buffer.
+   * @since 1.5
+   */
+  public void update (ByteBuffer input)
+  {
+    engineUpdate (input);
+  }
+  
+  /**
    * Computes the final digest of the stored data.
    * 
    * @return a byte array representing the message digest.
diff --git a/libjava/classpath/java/security/MessageDigestSpi.java b/libjava/classpath/java/security/MessageDigestSpi.java
index df3bd3e..6615b1d 100644
--- a/libjava/classpath/java/security/MessageDigestSpi.java
+++ b/libjava/classpath/java/security/MessageDigestSpi.java
@@ -37,6 +37,8 @@ exception statement from your version. */
 
 package java.security;
 
+import java.nio.ByteBuffer;
+
 /**
    This is the Service Provider Interface (SPI) for MessageDigest
    class in java.security. It provides the back end functionality
@@ -98,6 +100,23 @@ public abstract class MessageDigestSpi
   protected abstract void engineUpdate(byte[]input, int offset, int len);
 
   /**
+   * Updates this digest with the remaining bytes of a byte buffer.
+   * 
+   * @param input The input buffer.
+   * @since 1.5
+   */
+  protected void engineUpdate (ByteBuffer input)
+  {
+    byte[] buf = new byte[1024];
+    while (input.hasRemaining())
+      {
+        int n = Math.min(input.remaining(), buf.length);
+        input.get (buf, 0, n);
+        engineUpdate (buf, 0, n);
+      }
+  }
+  
+  /**
      Computes the final digest of the stored bytes and returns
      them. It performs any necessary padding. The message digest
      should reset sensitive data after performing the digest.
diff --git a/libjava/classpath/java/security/PermissionCollection.java b/libjava/classpath/java/security/PermissionCollection.java
index 4e8ffe5..c584983 100644
--- a/libjava/classpath/java/security/PermissionCollection.java
+++ b/libjava/classpath/java/security/PermissionCollection.java
@@ -120,7 +120,7 @@ public abstract class PermissionCollection implements Serializable
    *
    * @return an <code>Enumeration</code> of this collection's objects
    */
-  public abstract Enumeration elements();
+  public abstract Enumeration<Permission> elements();
 
   /**
    * This method sets this <code>PermissionCollection</code> object to be
@@ -159,7 +159,7 @@ public abstract class PermissionCollection implements Serializable
     StringBuffer sb = new StringBuffer(super.toString());
 
     sb.append(" (\n");
-    Enumeration e = elements();
+    Enumeration<Permission> e = elements();
     while (e.hasMoreElements())
       sb.append(' ').append(e.nextElement()).append('\n');
     return sb.append(")\n").toString();
diff --git a/libjava/classpath/java/security/Permissions.java b/libjava/classpath/java/security/Permissions.java
index e3fd069..56f5ad8 100644
--- a/libjava/classpath/java/security/Permissions.java
+++ b/libjava/classpath/java/security/Permissions.java
@@ -150,7 +150,7 @@ public final class Permissions extends PermissionCollection
    *
    * @return an <code>Enumeration</code> of this collection's elements
    */
-  public Enumeration elements()
+  public Enumeration<Permission> elements()
   {
     return new Enumeration()
     {
diff --git a/libjava/classpath/java/security/PrivilegedAction.java b/libjava/classpath/java/security/PrivilegedAction.java
index c3a4134..1a51eaa 100644
--- a/libjava/classpath/java/security/PrivilegedAction.java
+++ b/libjava/classpath/java/security/PrivilegedAction.java
@@ -47,9 +47,9 @@ package java.security;
  * @see AccessController
  * @see PrivilegedExceptionAction
  * @since 1.1
- * @status updated to 1.4
+ * @status updated to 1.5
  */
-public interface PrivilegedAction
+public interface PrivilegedAction<T>
 {
   /**
    * This method performs an operation that requires higher privileges to
@@ -60,5 +60,5 @@ public interface PrivilegedAction
    * @see AccessController#doPrivileged(PrivilegedAction)
    * @see AccessController#doPrivileged(PrivilegedAction, AccessControlContext)
    */
-  Object run();
+  T run();
 } // interface PrivilegedAction
diff --git a/libjava/classpath/java/security/PrivilegedExceptionAction.java b/libjava/classpath/java/security/PrivilegedExceptionAction.java
index d3d0478..351438e 100644
--- a/libjava/classpath/java/security/PrivilegedExceptionAction.java
+++ b/libjava/classpath/java/security/PrivilegedExceptionAction.java
@@ -46,9 +46,9 @@ package java.security;
  *
  * @author Aaron M. Renn (arenn@urbanophile.com)
  * @since 1.1
- * @status updated to 1.4
+ * @status updated to 1.5
  */
-public interface PrivilegedExceptionAction
+public interface PrivilegedExceptionAction<T>
 {
   /**
    * This method performs an operation that requires higher privileges to
@@ -61,5 +61,5 @@ public interface PrivilegedExceptionAction
    * @see AccessController#doPrivileged(PrivilegedExceptionAction,
    *                                    AccessControlContext)
    */
-  Object run() throws Exception;
+  T run() throws Exception;
 } // interface PrivilegedExceptionAction
diff --git a/libjava/classpath/java/security/SecureClassLoader.java b/libjava/classpath/java/security/SecureClassLoader.java
index 9d1fac79..dfc1758 100644
--- a/libjava/classpath/java/security/SecureClassLoader.java
+++ b/libjava/classpath/java/security/SecureClassLoader.java
@@ -1,5 +1,5 @@
 /* SecureClassLoader.java --- A Secure Class Loader
-   Copyright (C) 1999, 2004  Free Software Foundation, Inc.
+   Copyright (C) 1999, 2004, 2006  Free Software Foundation, Inc.
 
 This file is part of GNU Classpath.
 
@@ -37,6 +37,11 @@ exception statement from your version. */
 
 package java.security;
 
+import java.util.WeakHashMap;
+
+import java.nio.ByteBuffer;
+import java.util.HashMap;
+
 /**
  * A Secure Class Loader for loading classes with additional 
  * support for specifying code source and permissions when
@@ -48,21 +53,16 @@ package java.security;
  */
 public class SecureClassLoader extends ClassLoader
 {
-  java.util.WeakHashMap protectionDomainCache = new java.util.WeakHashMap();
+  private final HashMap<CodeSource,ProtectionDomain> protectionDomainCache
+    = new HashMap<CodeSource, ProtectionDomain>();
 
   protected SecureClassLoader(ClassLoader parent)
   {
     super(parent);
-    SecurityManager sm = System.getSecurityManager();
-    if(sm != null)
-      sm.checkCreateClassLoader();
   }
 
   protected SecureClassLoader()
   {
-    SecurityManager sm = System.getSecurityManager();
-    if(sm != null)
-      sm.checkCreateClassLoader();
   }
 
   /** 
@@ -79,13 +79,38 @@ public class SecureClassLoader extends ClassLoader
    *
    * @exception ClassFormatError if the byte array is not in proper classfile format.
    */
-  protected final Class defineClass(String name, byte[] b, int off, int len,
+  protected final Class<?> defineClass(String name, byte[] b, int off, int len,
 				    CodeSource cs)
   {
+    return super.defineClass(name, b, off, len, getProtectionDomain(cs));
+  }
+
+  /** 
+   * Creates a class using an ByteBuffer and a 
+   * CodeSource.
+   *
+   * @param name the name to give the class.  null if unknown.
+   * @param b the data representing the classfile, in classfile format.
+   * @param cs the CodeSource for the class or null when unknown.
+   *
+   * @return the class that was defined and optional CodeSource.
+   *
+   * @exception ClassFormatError if the byte array is not in proper classfile format.
+   *
+   * @since 1.5
+   */
+  protected final Class defineClass(String name, ByteBuffer b, CodeSource cs)
+  {
+    return super.defineClass(name, b, getProtectionDomain(cs));
+  }
+
+  /* Lookup or create a protection domain for the CodeSource,
+   * if CodeSource is null it will return null. */
+  private ProtectionDomain getProtectionDomain(CodeSource cs)
+  {
+    ProtectionDomain protectionDomain = null;
     if (cs != null)
       {
-	ProtectionDomain protectionDomain;
-	  
 	synchronized (protectionDomainCache)
 	  {
 	    protectionDomain = (ProtectionDomain)protectionDomainCache.get(cs);
@@ -105,10 +130,8 @@ public class SecureClassLoader extends ClassLoader
 		  protectionDomain = domain;
 	      }
 	  }
-	return super.defineClass(name, b, off, len, protectionDomain);
-      } 
-    else
-      return super.defineClass(name, b, off, len);
+      }
+    return protectionDomain;
   }
 
   /**
@@ -117,7 +140,7 @@ public class SecureClassLoader extends ClassLoader
    * java.security.Policy.getPermissions.
    *
    * This method is called by defineClass that takes a CodeSource
-   * arguement to build a proper ProtectionDomain for the class
+   * argument to build a proper ProtectionDomain for the class
    * being defined.
    */
   protected PermissionCollection getPermissions(CodeSource cs)
diff --git a/libjava/classpath/java/security/SecureRandom.java b/libjava/classpath/java/security/SecureRandom.java
index c66963e..005f467 100644
--- a/libjava/classpath/java/security/SecureRandom.java
+++ b/libjava/classpath/java/security/SecureRandom.java
@@ -45,6 +45,7 @@ import gnu.java.security.jce.prng.Sha160RandomSpi;
 
 import java.io.IOException;
 import java.io.InputStream;
+import java.lang.reflect.InvocationTargetException;
 import java.net.MalformedURLException;
 import java.net.URL;
 import java.util.Enumeration;
@@ -187,101 +188,106 @@ public class SecureRandom extends Random
     this.algorithm = algorithm;
   }
 
-  // Class methods.
-  // ------------------------------------------------------------------------
-
   /**
-   * Returns an instance of a SecureRandom. It creates the class from
-   * the first provider that implements it.
-   *
+   * Returns an instance of a <code>SecureRandom</code> from the first provider
+   * that implements it.
+   * 
    * @param algorithm The algorithm name.
-   * @return A new SecureRandom implementing the given algorithm.
-   * @throws NoSuchAlgorithmException If no installed provider implements
-   *         the given algorithm.
+   * @return A new <code>SecureRandom</code> implementing the given algorithm.
+   * @throws NoSuchAlgorithmException If no installed provider implements the
+   *           given algorithm.
+   * @throws IllegalArgumentException if <code>algorithm</code> is
+   *           <code>null</code> or is an empty string.
    */
   public static SecureRandom getInstance(String algorithm)
-    throws NoSuchAlgorithmException
+      throws NoSuchAlgorithmException
   {
     Provider[] p = Security.getProviders();
-    
+    NoSuchAlgorithmException lastException = null;
     for (int i = 0; i < p.length; i++)
-      {
-        try
-          {
-            return getInstance(algorithm, p[i]);
-          }
-        catch (NoSuchAlgorithmException e)
-          {
-	    // Ignore.
-          }
-      }
-
-    // None found.
+      try
+        {
+          return getInstance(algorithm, p[i]);
+        }
+      catch (NoSuchAlgorithmException x)
+        {
+          lastException = x;
+        }
+    if (lastException != null)
+      throw lastException;
     throw new NoSuchAlgorithmException(algorithm);
   }
 
   /**
-   * Returns an instance of a SecureRandom. It creates the class
-   * for the specified algorithm from the named provider.
-   *
+   * Returns an instance of a <code>SecureRandom</code> for the specified
+   * algorithm from the named provider.
+   * 
    * @param algorithm The algorithm name.
-   * @param provider  The provider name.
-   * @return A new SecureRandom implementing the chosen algorithm.
+   * @param provider The provider name.
+   * @return A new <code>SecureRandom</code> implementing the chosen
+   *         algorithm.
    * @throws NoSuchAlgorithmException If the named provider does not implement
-   *         the algorithm, or if the implementation cannot be
-   *         instantiated.
-   * @throws NoSuchProviderException If no provider named
-   *         <code>provider</code> is currently installed.
-   * @throws IllegalArgumentException If <code>provider</code> is null
-   *         or is empty.
+   *           the algorithm, or if the implementation cannot be instantiated.
+   * @throws NoSuchProviderException If no provider named <code>provider</code>
+   *           is currently installed.
+   * @throws IllegalArgumentException if either <code>algorithm</code> or
+   *           <code>provider</code> is <code>null</code> or empty.
    */
   public static SecureRandom getInstance(String algorithm, String provider)
-  throws NoSuchAlgorithmException, NoSuchProviderException
+      throws NoSuchAlgorithmException, NoSuchProviderException
   {
-    if (provider == null || provider.length() == 0)
-      throw new IllegalArgumentException("Illegal provider");
-
+    if (provider == null)
+      throw new IllegalArgumentException("provider MUST NOT be null");
+    provider = provider.trim();
+    if (provider.length() == 0)
+      throw new IllegalArgumentException("provider MUST NOT be empty");
     Provider p = Security.getProvider(provider);
     if (p == null)
       throw new NoSuchProviderException(provider);
-    
     return getInstance(algorithm, p);
   }
 
   /**
-   * Returns an instance of a SecureRandom. It creates the class for
-   * the specified algorithm from the given provider.
-   *
-   * @param algorithm The SecureRandom algorithm to create.
-   * @param provider  The provider to get the instance from.
-   * @throws NoSuchAlgorithmException If the algorithm cannot be found, or
-   *         if the class cannot be instantiated.
-   * @throws IllegalArgumentException If <code>provider</code> is null.
+   * Returns an instance of a <code>SecureRandom</code> for the specified
+   * algorithm from the given provider.
+   * 
+   * @param algorithm The <code>SecureRandom</code> algorithm to create.
+   * @param provider The provider to use.
+   * @throws NoSuchAlgorithmException If the algorithm cannot be found, or if
+   *           the class cannot be instantiated.
+   * @throws IllegalArgumentException if either <code>algorithm</code> or
+   *           <code>provider</code> is <code>null</code>, or if
+   *           <code>algorithm</code> is an empty string.
    */
   public static SecureRandom getInstance(String algorithm, Provider provider)
-  throws NoSuchAlgorithmException
+      throws NoSuchAlgorithmException
   {
-    if (provider == null)
-      throw new IllegalArgumentException("Illegal provider");
+    StringBuilder sb = new StringBuilder("SecureRandom for algorithm [")
+        .append(algorithm).append("] from provider[")
+        .append(provider).append("] could not be created");
+    Throwable cause;
     try
       {
-        return new SecureRandom((SecureRandomSpi)
-          Engine.getInstance(SECURE_RANDOM, algorithm, provider),
-          provider, algorithm);
+        Object spi = Engine.getInstance(SECURE_RANDOM, algorithm, provider);
+        return new SecureRandom((SecureRandomSpi) spi, provider, algorithm);
       }
-    catch (java.lang.reflect.InvocationTargetException ite)
+    catch (InvocationTargetException x)
       {
-	throw new NoSuchAlgorithmException(algorithm);
+        cause = x.getCause();
+        if (cause instanceof NoSuchAlgorithmException)
+          throw (NoSuchAlgorithmException) cause;
+        if (cause == null)
+          cause = x;
       }
-    catch (ClassCastException cce)
+    catch (ClassCastException x)
       {
-        throw new NoSuchAlgorithmException(algorithm);
+        cause = x;
       }
+    NoSuchAlgorithmException x = new NoSuchAlgorithmException(sb.toString());
+    x.initCause(cause);
+    throw x;
   }
 
-  // Instance methods.
-  // ------------------------------------------------------------------------
-
   /**
      Returns the provider being used by the current SecureRandom class.
 
diff --git a/libjava/classpath/java/security/Security.java b/libjava/classpath/java/security/Security.java
index d99c451..d3d2c1e 100644
--- a/libjava/classpath/java/security/Security.java
+++ b/libjava/classpath/java/security/Security.java
@@ -138,7 +138,7 @@ public final class Security
 	    Exception exception = null;
 	    try
 	      {
-            ClassLoader sys = ClassLoader.getSystemClassLoader();
+		ClassLoader sys = ClassLoader.getSystemClassLoader();
 		providers.addElement(Class.forName(name, true, sys).newInstance());
 	      }
 	    catch (ClassNotFoundException x)
@@ -408,9 +408,9 @@ public final class Security
    *         {@link Provider}s.
    * @since 1.4
    */
-  public static Set getAlgorithms(String serviceName)
+  public static Set<String> getAlgorithms(String serviceName)
   {
-    HashSet result = new HashSet();
+    HashSet<String> result = new HashSet<String>();
     if (serviceName == null || serviceName.length() == 0)
       return result;
 
@@ -541,7 +541,7 @@ public final class Security
    *           {@link Map}'s <i>keys</i>.
    * @see #getProviders(String)
    */
-  public static Provider[] getProviders(Map filter)
+  public static Provider[] getProviders(Map<String,String> filter)
   {
     if (providers == null || providers.isEmpty())
       return null;
@@ -549,7 +549,7 @@ public final class Security
     if (filter == null)
       return getProviders();
 
-    Set querries = filter.keySet();
+    Set<String> querries = filter.keySet();
     if (querries == null || querries.isEmpty())
       return getProviders();
 
@@ -572,7 +572,7 @@ public final class Security
           throw new InvalidParameterException(
               "missing dot in '" + String.valueOf(querry)+"'");
 
-        value = (String) filter.get(querry);
+        value = filter.get(querry);
         // deconstruct querry into [service, algorithm, attribute]
         if (value == null || value.trim().length() == 0) // <service>.<algorithm>
           {
diff --git a/libjava/classpath/java/security/Signature.java b/libjava/classpath/java/security/Signature.java
index 845a77a..1245707 100644
--- a/libjava/classpath/java/security/Signature.java
+++ b/libjava/classpath/java/security/Signature.java
@@ -40,6 +40,8 @@ package java.security;
 
 import gnu.java.security.Engine;
 
+import java.lang.reflect.InvocationTargetException;
+import java.nio.ByteBuffer;
 import java.security.cert.Certificate;
 import java.security.cert.X509Certificate;
 import java.security.spec.AlgorithmParameterSpec;
@@ -127,28 +129,29 @@ public abstract class Signature extends SignatureSpi
    * Returns an instance of <code>Signature</code> representing the specified
    * signature.
    * 
-   * @param algorithm
-   *          the algorithm to use.
+   * @param algorithm the algorithm to use.
    * @return a new instance repesenting the desired algorithm.
-   * @throws NoSuchAlgorithmException
-   *           if the algorithm is not implemented by any provider.
+   * @throws NoSuchAlgorithmException if the algorithm is not implemented by any
+   *           provider.
+   * @throws IllegalArgumentException if <code>algorithm</code> is
+   *           <code>null</code> or is an empty string.
    */
   public static Signature getInstance(String algorithm)
-    throws NoSuchAlgorithmException
+      throws NoSuchAlgorithmException
   {
     Provider[] p = Security.getProviders();
+    NoSuchAlgorithmException lastException = null;
     for (int i = 0; i < p.length; i++)
-      {
-        try
-          {
-            return getInstance(algorithm, p[i]);
-          }
-	catch (NoSuchAlgorithmException e)
-	  {
-	    // Ignored.
-	  }
-      }
-
+      try
+        {
+          return getInstance(algorithm, p[i]);
+        }
+      catch (NoSuchAlgorithmException x)
+        {
+          lastException = x;
+        }
+    if (lastException != null)
+      throw lastException;
     throw new NoSuchAlgorithmException(algorithm);
   }
 
@@ -156,28 +159,26 @@ public abstract class Signature extends SignatureSpi
    * Returns an instance of <code>Signature</code> representing the specified
    * signature from the named provider.
    * 
-   * @param algorithm
-   *          the algorithm to use.
-   * @param provider
-   *          the name of the provider to use.
+   * @param algorithm the algorithm to use.
+   * @param provider the name of the provider to use.
    * @return a new instance repesenting the desired algorithm.
-   * @throws IllegalArgumentException if <code>provider</code> is
-   *           <code>null</code> or is an empty string.
-   * @throws NoSuchProviderException
-   *           if the named provider was not found.
-   * @throws NoSuchAlgorithmException
-   *           if the algorithm is not implemented by the named provider.
+   * @throws NoSuchProviderException if the named provider was not found.
+   * @throws NoSuchAlgorithmException if the algorithm is not implemented by the
+   *           named provider.
+   * @throws IllegalArgumentException if either <code>algorithm</code> or
+   *           <code>provider</code> is <code>null</code> or empty.
    */
   public static Signature getInstance(String algorithm, String provider)
-    throws NoSuchAlgorithmException, NoSuchProviderException
+      throws NoSuchAlgorithmException, NoSuchProviderException
   {
-    if (provider == null || provider.length() == 0)
-      throw new IllegalArgumentException("Illegal provider");
-
+    if (provider == null)
+      throw new IllegalArgumentException("provider MUST NOT be null");
+    provider = provider.trim();
+    if (provider.length() == 0)
+      throw new IllegalArgumentException("provider MUST NOT be empty");
     Provider p = Security.getProvider(provider);
     if (p == null)
       throw new NoSuchProviderException(provider);
-
     return getInstance(algorithm, p);
   }
 
@@ -185,35 +186,41 @@ public abstract class Signature extends SignatureSpi
    * Returns an instance of <code>Signature</code> representing the specified
    * signature from the specified {@link Provider}.
    * 
-   * @param algorithm
-   *          the algorithm to use.
-   * @param provider
-   *          the {@link Provider} to use.
+   * @param algorithm the algorithm to use.
+   * @param provider the {@link Provider} to use.
    * @return a new instance repesenting the desired algorithm.
-   * @throws NoSuchAlgorithmException
-   *           if the algorithm is not implemented by the {@link Provider}.
+   * @throws NoSuchAlgorithmException if the algorithm is not implemented by the
+   *           {@link Provider}.
+   * @throws IllegalArgumentException if either <code>algorithm</code> or
+   *           <code>provider</code> is <code>null</code>, or if
+   *           <code>algorithm</code> is an empty string.
    */
   public static Signature getInstance(String algorithm, Provider provider)
     throws NoSuchAlgorithmException
   {
-    if (provider == null)
-      throw new IllegalArgumentException("Illegal provider");
-
-    Signature result = null;
-    Object o = null;
+    StringBuilder sb = new StringBuilder("Signature algorithm [")
+        .append(algorithm).append("] from provider[")
+        .append(provider).append("] ");
+    Object o;
     try
       {
         o = Engine.getInstance(SIGNATURE, algorithm, provider);
       }
-    catch (java.lang.reflect.InvocationTargetException ite)
+    catch (InvocationTargetException x)
       {
-        throw new NoSuchAlgorithmException(algorithm);
+        Throwable cause = x.getCause();
+        if (cause instanceof NoSuchAlgorithmException)
+          throw (NoSuchAlgorithmException) cause;
+        if (cause == null)
+          cause = x;
+        sb.append("could not be created");
+        NoSuchAlgorithmException y = new NoSuchAlgorithmException(sb.toString());
+        y.initCause(cause);
+        throw y;
       }
-
+    Signature result;
     if (o instanceof SignatureSpi)
-      {
-        result = new DummySignature((SignatureSpi) o, algorithm);
-      }
+      result = new DummySignature((SignatureSpi) o, algorithm);
     else if (o instanceof Signature)
       {
         result = (Signature) o;
@@ -221,7 +228,8 @@ public abstract class Signature extends SignatureSpi
       }
     else
       {
-        throw new NoSuchAlgorithmException(algorithm);
+        sb.append("is of an unexpected Type: ").append(o.getClass().getName());
+        throw new NoSuchAlgorithmException(sb.toString());
       }
     result.provider = provider;
     return result;
@@ -467,6 +475,22 @@ public abstract class Signature extends SignatureSpi
     else
       throw new SignatureException();
   }
+  
+  /**
+   * Update this signature with the {@link java.nio.Buffer#remaining()}
+   * bytes of the input buffer.
+   * 
+   * @param input The input buffer.
+   * @throws SignatureException If this instance was not properly
+   *  initialized.
+   */
+  public final void update(ByteBuffer input) throws SignatureException
+  {
+    if (state != UNINITIALIZED)
+      engineUpdate(input);
+    else
+      throw new SignatureException("not initialized");
+  }
 
   /**
    * Returns the name of the algorithm currently used. The names of algorithms
diff --git a/libjava/classpath/java/security/SignatureSpi.java b/libjava/classpath/java/security/SignatureSpi.java
index 25d49de..3b46815 100644
--- a/libjava/classpath/java/security/SignatureSpi.java
+++ b/libjava/classpath/java/security/SignatureSpi.java
@@ -37,6 +37,7 @@ exception statement from your version. */
 
 package java.security;
 
+import java.nio.ByteBuffer;
 import java.security.spec.AlgorithmParameterSpec;
 
 /**
@@ -131,6 +132,24 @@ public abstract class SignatureSpi
     throws SignatureException;
 
   /**
+   * Update this signature with the {@link java.nio.Buffer#remaining()}
+   * bytes of the given buffer.
+   * 
+   * @param input The input buffer.
+   * @throws SignatureException
+   */
+  protected void engineUpdate(ByteBuffer input) throws SignatureException
+  {
+    byte[] buf = new byte[4096];
+    while (input.hasRemaining())
+      {
+        int l = Math.min(input.remaining(), buf.length);
+        input.get(buf, 0, l);
+        engineUpdate(buf, 0, l);
+      }
+  }
+  
+  /**
    * Returns the signature bytes of all the data fed to this instance. The
    * format of the output depends on the underlying signature algorithm.
    * 
diff --git a/libjava/classpath/java/security/acl/Acl.java b/libjava/classpath/java/security/acl/Acl.java
index ff139af..6a3f7d5 100644
--- a/libjava/classpath/java/security/acl/Acl.java
+++ b/libjava/classpath/java/security/acl/Acl.java
@@ -117,7 +117,7 @@ public interface Acl extends Owner
    *
    * @return An enumeration of the ACL entries
    */
-  Enumeration entries();
+  Enumeration<AclEntry> entries();
 
   /**
    * This method tests whether or not the specified <code>Principal</code>
@@ -142,7 +142,7 @@ public interface Acl extends Owner
    *
    * @return A list of permissions for the <code>Principal</code>.
    */
-  Enumeration getPermissions(Principal user);
+  Enumeration<Permission> getPermissions(Principal user);
 
   /**
    * This method returns the ACL as a <code>String</code>
diff --git a/libjava/classpath/java/security/acl/AclEntry.java b/libjava/classpath/java/security/acl/AclEntry.java
index 7b1bcf5..ea906f1 100644
--- a/libjava/classpath/java/security/acl/AclEntry.java
+++ b/libjava/classpath/java/security/acl/AclEntry.java
@@ -94,7 +94,7 @@ public interface AclEntry extends Cloneable
   /**
    * This method adds the specified permission to this ACL entry.
    *
-   * @param perm The <code>Permission</code> to add
+   * @param permission The <code>Permission</code> to add
    *
    * @return <code>true</code> if the permission was added or <code>false</code> if it was already set for this entry
    */
@@ -113,7 +113,7 @@ public interface AclEntry extends Cloneable
    * This method tests whether or not the specified permission is associated
    * with this ACL entry.
    *
-   * @param perm The <code>Permission</code> to test
+   * @param permission The <code>Permission</code> to test
    *
    * @return <code>true</code> if this permission is associated with this entry or <code>false</code> otherwise
    */
@@ -125,7 +125,7 @@ public interface AclEntry extends Cloneable
    *
    * @return A list of permissions for this ACL entry
    */
-  Enumeration permissions();
+  Enumeration<Permission> permissions();
 
   /**
    * This method returns this object as a <code>String</code>.
diff --git a/libjava/classpath/java/security/acl/Group.java b/libjava/classpath/java/security/acl/Group.java
index 3ffdf15..ed6d56a 100644
--- a/libjava/classpath/java/security/acl/Group.java
+++ b/libjava/classpath/java/security/acl/Group.java
@@ -74,7 +74,7 @@ public interface Group extends Principal
    * This method tests whether or not a given <code>Principal</code> is a
    * member of this group.
    *
-   * @param user The <code>Principal</code> to test for membership
+   * @param member The <code>Principal</code> to test for membership
    *
    * @return <code>true</code> if the user is member, <code>false</code> otherwise
    */
@@ -86,5 +86,5 @@ public interface Group extends Principal
    *
    * @return The list of all members of the group
    */
-  Enumeration members();
+  Enumeration<? extends Principal> members();
 }
diff --git a/libjava/classpath/java/security/cert/CertPath.java b/libjava/classpath/java/security/cert/CertPath.java
index e818763..781eb3e 100644
--- a/libjava/classpath/java/security/cert/CertPath.java
+++ b/libjava/classpath/java/security/cert/CertPath.java
@@ -161,7 +161,7 @@ public abstract class CertPath implements Serializable
    *
    * @return the iterator of supported encodings in the path
    */
-  public abstract Iterator getEncodings();
+  public abstract Iterator<String> getEncodings();
 
   /**
    * Compares this path to another for semantic equality. To be equal, both
@@ -226,7 +226,7 @@ public abstract class CertPath implements Serializable
    *
    * @return the list of certificates, non-null but possibly empty
    */
-  public abstract List getCertificates();
+  public abstract List<? extends Certificate> getCertificates();
 
   /**
    * Serializes the path in its encoded form, to ensure reserialization with
diff --git a/libjava/classpath/java/security/cert/CertPathBuilder.java b/libjava/classpath/java/security/cert/CertPathBuilder.java
index f696520..519ed2b 100644
--- a/libjava/classpath/java/security/cert/CertPathBuilder.java
+++ b/libjava/classpath/java/security/cert/CertPathBuilder.java
@@ -40,6 +40,7 @@ package java.security.cert;
 
 import gnu.java.security.Engine;
 
+import java.lang.reflect.InvocationTargetException;
 import java.security.InvalidAlgorithmParameterException;
 import java.security.NoSuchAlgorithmException;
 import java.security.NoSuchProviderException;
@@ -111,50 +112,54 @@ public class CertPathBuilder
   }
 
   /**
-   * Get an instance of a named CertPathBuilder, from the first provider
-   * that implements it.
-   *
-   * @param algorithm The name of the CertPathBuilder to create.
+   * Returns an instance of a named <code>CertPathBuilder</code> from the
+   * first provider that implements it.
+   * 
+   * @param algorithm The name of the <code>CertPathBuilder</code> to create.
    * @return The new instance.
-   * @throws NoSuchAlgorithmException If no installed provider
-   *   implements the named algorithm.
+   * @throws NoSuchAlgorithmException If no installed provider implements the
+   *           named algorithm.
+   * @throws IllegalArgumentException if <code>algorithm</code> is
+   *           <code>null</code> or is an empty string.
    */
   public static CertPathBuilder getInstance(String algorithm)
-    throws NoSuchAlgorithmException
+      throws NoSuchAlgorithmException
   {
     Provider[] p = Security.getProviders();
-
+    NoSuchAlgorithmException lastException = null;
     for (int i = 0; i < p.length; i++)
-      {
-        try
-          {
-            return getInstance(algorithm, p[i]);
-          }
-        catch (NoSuchAlgorithmException e)
-          {
-	    // Ignored.
-          }
-      }
-
+      try
+        {
+          return getInstance(algorithm, p[i]);
+        }
+      catch (NoSuchAlgorithmException x)
+        {
+          lastException = x;
+        }
+    if (lastException != null)
+      throw lastException;
     throw new NoSuchAlgorithmException(algorithm);
   }
 
   /**
-   * Get an instance of a named CertPathBuilder from the named
+   * Returns an instance of a named <code>CertPathBuilder</code> from a named
    * provider.
-   *
-   * @param algorithm The name of the CertPathBuilder to create.
-   * @param provider  The name of the provider from which to get the
-   *   implementation.
+   * 
+   * @param algorithm The name of the <code>CertPathBuilder</code> to create.
+   * @param provider The name of the provider to use.
    * @return The new instance.
-   * @throws NoSuchAlgorithmException If no installed provider
-   *   implements the named algorithm.
-   * @throws NoSuchProviderException If the named provider does not
-   *   exist.
+   * @throws NoSuchAlgorithmException If no installed provider implements the
+   *           named algorithm.
+   * @throws NoSuchProviderException If the named provider does not exist.
+   * @throws IllegalArgumentException if either <code>algorithm</code> or
+   *           <code>provider</code> is <code>null</code>, or if
+   *           <code>algorithm</code> is an empty string.
    */
   public static CertPathBuilder getInstance(String algorithm, String provider)
-    throws NoSuchAlgorithmException, NoSuchProviderException
+      throws NoSuchAlgorithmException, NoSuchProviderException
   {
+    if (provider == null)
+      throw new IllegalArgumentException("provider MUST NOT be null");
     Provider p = Security.getProvider(provider);
     if (p == null)
       throw new NoSuchProviderException(provider);
@@ -162,41 +167,47 @@ public class CertPathBuilder
   }
 
   /**
-   * Get an instance of a named CertPathBuilder from the specified
-   * provider.
-   *
-   * @param algorithm The name of the CertPathBuilder to create.
-   * @param provider  The provider from which to get the implementation.
+   * Returns an instance of a named <code>CertPathBuilder</code> from the
+   * specified provider.
+   * 
+   * @param algorithm The name of the <code>CertPathBuilder</code> to create.
+   * @param provider The provider to use.
    * @return The new instance.
-   * @throws NoSuchAlgorithmException If no installed provider
-   *   implements the named algorithm.
-   * @throws IllegalArgumentException If <i>provider</i> in
-   *   <tt>null</tt>.
+   * @throws NoSuchAlgorithmException If no installed provider implements the
+   *           named algorithm.
+   * @throws IllegalArgumentException if either <code>algorithm</code> or
+   *           <code>provider</code> is <code>null</code>, or if
+   *           <code>algorithm</code> is an empty string.
    */
   public static CertPathBuilder getInstance(String algorithm, Provider provider)
-    throws NoSuchAlgorithmException
+      throws NoSuchAlgorithmException
   {
-    if (provider == null)
-      throw new IllegalArgumentException("null provider");
+    StringBuilder sb = new StringBuilder("CertPathBuilder for algorithm [")
+        .append(algorithm).append("] from provider[")
+        .append(provider).append("] could not be created");
+    Throwable cause;
     try
       {
-        return new CertPathBuilder((CertPathBuilderSpi)
-          Engine.getInstance(CERT_PATH_BUILDER, algorithm, provider),
-          provider, algorithm);
+        Object spi = Engine.getInstance(CERT_PATH_BUILDER, algorithm, provider);
+        return new CertPathBuilder((CertPathBuilderSpi) spi, provider, algorithm);
       }
-    catch (java.lang.reflect.InvocationTargetException ite)
+    catch (InvocationTargetException x)
       {
-        throw new NoSuchAlgorithmException(algorithm);
+        cause = x.getCause();
+        if (cause instanceof NoSuchAlgorithmException)
+          throw (NoSuchAlgorithmException) cause;
+        if (cause == null)
+          cause = x;
       }
-    catch (ClassCastException cce)
+    catch (ClassCastException x)
       {
-        throw new NoSuchAlgorithmException(algorithm);
+        cause = x;
       }
+    NoSuchAlgorithmException x = new NoSuchAlgorithmException(sb.toString());
+    x.initCause(cause);
+    throw x;
   }
 
-  // Instance methods.
-  // ------------------------------------------------------------------------
-
   /**
    * Return the name of this CertPathBuilder algorithm.
    *
diff --git a/libjava/classpath/java/security/cert/CertPathValidator.java b/libjava/classpath/java/security/cert/CertPathValidator.java
index 5fed19e..bf7c974 100644
--- a/libjava/classpath/java/security/cert/CertPathValidator.java
+++ b/libjava/classpath/java/security/cert/CertPathValidator.java
@@ -40,6 +40,7 @@ package java.security.cert;
 
 import gnu.java.security.Engine;
 
+import java.lang.reflect.InvocationTargetException;
 import java.security.AccessController;
 import java.security.InvalidAlgorithmParameterException;
 import java.security.NoSuchAlgorithmException;
@@ -124,91 +125,103 @@ public class CertPathValidator {
   }
 
   /**
-   * Get an instance of the given validator from the first provider that
+   * Returns an instance of the given validator from the first provider that
    * implements it.
-   *
+   * 
    * @param algorithm The name of the algorithm to get.
    * @return The new instance.
-   * @throws NoSuchAlgorithmException If no installed provider
-   * implements the requested algorithm.
+   * @throws NoSuchAlgorithmException If no installed provider implements the
+   *           requested algorithm.
+   * @throws IllegalArgumentException if <code>algorithm</code> is
+   *           <code>null</code> or is an empty string.
    */
   public static CertPathValidator getInstance(String algorithm)
     throws NoSuchAlgorithmException
   {
     Provider[] p = Security.getProviders();
+    NoSuchAlgorithmException lastException = null;
     for (int i = 0; i < p.length; i++)
-      {
-        try
-          {
-            return getInstance(algorithm, p[i]);
-          }
-        catch (NoSuchAlgorithmException e)
-          {
-	    // Ignored.
-          }
-      }
+      try
+        {
+          return getInstance(algorithm, p[i]);
+        }
+      catch (NoSuchAlgorithmException x)
+        {
+          lastException = x;
+        }
+    if (lastException != null)
+      throw lastException;
     throw new NoSuchAlgorithmException(algorithm);
   }
 
   /**
-   * Get an instance of the given validator from the named provider.
-   *
+   * Returns an instance of the given validator from the named provider.
+   * 
    * @param algorithm The name of the algorithm to get.
-   * @param provider  The name of the provider from which to get the
-   * implementation.
+   * @param provider The name of the provider from which to get the
+   *          implementation.
    * @return The new instance.
-   * @throws NoSuchAlgorithmException If the named provider does not
-   * implement the algorithm.
-   * @throws NoSuchProviderException If no provider named
-   * <i>provider</i> is installed.
+   * @throws NoSuchAlgorithmException If the named provider does not implement
+   *           the algorithm.
+   * @throws NoSuchProviderException If no provider named <i>provider</i> is
+   *           installed.
+   * @throws IllegalArgumentException if either <code>algorithm</code> or
+   *           <code>provider</code> is <code>null</code>, or if
+   *           <code>algorithm</code> is an empty string.
    */
-  public static CertPathValidator getInstance(String algorithm,
-                                              String provider)
-    throws NoSuchAlgorithmException, NoSuchProviderException
+  public static CertPathValidator getInstance(String algorithm, String provider)
+      throws NoSuchAlgorithmException, NoSuchProviderException
   {
+    if (provider == null)
+      throw new IllegalArgumentException("provider MUST NOT be null");
     Provider p = Security.getProvider(provider);
     if (p == null)
       throw new NoSuchProviderException(provider);
-
     return getInstance(algorithm, p);
   }
 
   /**
-   * Get an instance of the given validator from the given provider.
-   *
+   * Returns an instance of the given validator from the given provider.
+   * 
    * @param algorithm The name of the algorithm to get.
-   * @param provider  The provider from which to get the implementation.
+   * @param provider The provider from which to get the implementation.
    * @return The new instance.
-   * @throws NoSuchAlgorithmException If the provider does not implement
-   * the algorithm.
-   * @throws IllegalArgumentException If <i>provider</i> is null.
+   * @throws NoSuchAlgorithmException If the provider does not implement the
+   *           algorithm.
+   * @throws IllegalArgumentException if either <code>algorithm</code> or
+   *           <code>provider</code> is <code>null</code>, or if
+   *           <code>algorithm</code> is an empty string.
    */
   public static CertPathValidator getInstance(String algorithm,
                                               Provider provider)
     throws NoSuchAlgorithmException
   {
-    if (provider == null)
-      throw new IllegalArgumentException("null provider");
-
+    StringBuilder sb = new StringBuilder("CertPathValidator for algorithm [")
+        .append(algorithm).append("] from provider[")
+        .append(provider).append("] could not be created");
+    Throwable cause;
     try
       {
-        return new CertPathValidator((CertPathValidatorSpi)
-          Engine.getInstance(CERT_PATH_VALIDATOR, algorithm, provider),
-          provider, algorithm);
+        Object spi = Engine.getInstance(CERT_PATH_VALIDATOR, algorithm, provider);
+        return new CertPathValidator((CertPathValidatorSpi) spi, provider, algorithm);
       }
-    catch (java.lang.reflect.InvocationTargetException ite)
+    catch (InvocationTargetException x)
       {
-        throw new NoSuchAlgorithmException(algorithm);
+        cause = x.getCause();
+        if (cause instanceof NoSuchAlgorithmException)
+          throw (NoSuchAlgorithmException) cause;
+        if (cause == null)
+          cause = x;
       }
-    catch (ClassCastException cce)
+    catch (ClassCastException x)
       {
-        throw new NoSuchAlgorithmException(algorithm);
+        cause = x;
       }
+    NoSuchAlgorithmException x = new NoSuchAlgorithmException(sb.toString());
+    x.initCause(cause);
+    throw x;
   }
 
-  // Instance methods.
-  // ------------------------------------------------------------------------
-
   /**
    * Return the name of this validator.
    *
diff --git a/libjava/classpath/java/security/cert/CertStore.java b/libjava/classpath/java/security/cert/CertStore.java
index 864da86..a270865 100644
--- a/libjava/classpath/java/security/cert/CertStore.java
+++ b/libjava/classpath/java/security/cert/CertStore.java
@@ -40,6 +40,7 @@ package java.security.cert;
 
 import gnu.java.security.Engine;
 
+import java.lang.reflect.InvocationTargetException;
 import java.security.InvalidAlgorithmParameterException;
 import java.security.NoSuchAlgorithmException;
 import java.security.NoSuchProviderException;
@@ -52,7 +53,7 @@ import java.util.Collection;
  * A CertStore is a read-only repository for certificates and
  * certificate revocation lists.
  *
- * @since JDK 1.4
+ * @since 1.4
  */
 public class CertStore
 {
@@ -123,59 +124,63 @@ public class CertStore
   }
 
   /**
-   * Get an instance of the given certificate store from the first
+   * Returns an instance of the given certificate store type from the first
    * installed provider.
-   *
-   * @param type     The type of CertStore to create.
-   * @param params   The parameters to initialize this cert store with.
+   * 
+   * @param type The type of <code>CertStore</code> to create.
+   * @param params The parameters to initialize this cert store with.
    * @return The new instance.
-   * @throws InvalidAlgorithmParameterException If the instance rejects
-   *         the specified parameters.
-   * @throws NoSuchAlgorithmException If no installed provider
-   *         implements the specified CertStore.
-   * @throws IllegalArgumentException If <i>provider</i> is null.
+   * @throws InvalidAlgorithmParameterException If the instance rejects the
+   *           specified parameters.
+   * @throws NoSuchAlgorithmException If no installed provider implements the
+   *           specified CertStore.
+   * @throws IllegalArgumentException if <code>type</code> is
+   *           <code>null</code> or is an empty string.
    */
   public static CertStore getInstance(String type, CertStoreParameters params)
     throws InvalidAlgorithmParameterException, NoSuchAlgorithmException
   {
     Provider[] p = Security.getProviders();
+    NoSuchAlgorithmException lastException = null;
     for (int i = 0; i < p.length; i++)
-      {
-        try
-          {
-            return getInstance(type, params, p[i]);
-          }
-        catch (NoSuchAlgorithmException e)
-          {
-	    // Ignored.
-          }
-      }
-
+      try
+        {
+          return getInstance(type, params, p[i]);
+        }
+      catch (NoSuchAlgorithmException x)
+        {
+          lastException = x;
+        }
+    if (lastException != null)
+      throw lastException;
     throw new NoSuchAlgorithmException(type);
   }
 
   /**
-   * Get an instance of the given certificate store from the named
+   * Returns an instance of the given certificate store type from a named
    * provider.
-   *
-   * @param type     The type of CertStore to create.
-   * @param params   The parameters to initialize this cert store with.
-   * @param provider The name of the provider from which to get the
-   *        implementation.
+   * 
+   * @param type The type of <code>CertStore</code> to create.
+   * @param params The parameters to initialize this cert store with.
+   * @param provider The name of the provider to use.
    * @return The new instance.
-   * @throws InvalidAlgorithmParameterException If the instance rejects
-   *         the specified parameters.
+   * @throws InvalidAlgorithmParameterException If the instance rejects the
+   *           specified parameters.
    * @throws NoSuchAlgorithmException If the specified provider does not
-   *         implement the specified CertStore.
-   * @throws NoSuchProviderException If no provider named
-   *         <i>provider</i> is installed.
-   * @throws IllegalArgumentException If <i>provider</i> is null.
+   *           implement the specified CertStore.
+   * @throws NoSuchProviderException If no provider named <i>provider</i> is
+   *           installed.
+   * @throws IllegalArgumentException if either <code>type</code> or
+   *           <code>provider</code> is <code>null</code>, or if
+   *           <code>type</code> is an empty string.
    */
   public static CertStore getInstance(String type, CertStoreParameters params,
                                       String provider)
     throws InvalidAlgorithmParameterException, NoSuchAlgorithmException,
            NoSuchProviderException
   {
+    if (provider == null)
+      throw new IllegalArgumentException("provider MUST NOT be null");
     Provider p = Security.getProvider(provider);
     if (p == null)
       throw new NoSuchProviderException(provider);
@@ -183,48 +188,52 @@ public class CertStore
   }
 
   /**
-   * Get an instance of the given certificate store from the given
+   * Returns an instance of the given certificate store type from a given
    * provider.
    *
-   * @param type     The type of CertStore to create.
+   * @param type The type of <code>CertStore</code> to create.
    * @param params   The parameters to initialize this cert store with.
-   * @param provider The provider from which to get the implementation.
+   * @param provider The provider to use.
    * @return The new instance.
    * @throws InvalidAlgorithmParameterException If the instance rejects
    *         the specified parameters.
    * @throws NoSuchAlgorithmException If the specified provider does not
    *         implement the specified CertStore.
-   * @throws IllegalArgumentException If <i>provider</i> is null.
+   * @throws IllegalArgumentException if either <code>type</code> or
+   *           <code>provider</code> is <code>null</code>, or if
+   *           <code>type</code> is an empty string.
    */
   public static CertStore getInstance(String type, CertStoreParameters params,
                                       Provider provider)
-    throws InvalidAlgorithmParameterException, NoSuchAlgorithmException
+      throws InvalidAlgorithmParameterException, NoSuchAlgorithmException
   {
-    if (provider == null)
-      throw new IllegalArgumentException("null provider");
-
+    StringBuilder sb = new StringBuilder("CertStore of type [")
+        .append(type).append("] from provider[")
+        .append(provider).append("] could not be created");
+    Throwable cause;
     try
       {
-        return new CertStore((CertStoreSpi) Engine.getInstance(CERT_STORE,
-          type, provider, new Object[] { params }), provider, type, params);
+        Object[] args = new Object[] { params };
+        Object spi = Engine.getInstance(CERT_STORE, type, provider, args);
+        return new CertStore((CertStoreSpi) spi, provider, type, params);
       }
-    catch (ClassCastException cce)
+    catch (InvocationTargetException x)
       {
-        throw new NoSuchAlgorithmException(type);
+        cause = x.getCause();
+        if (cause instanceof NoSuchAlgorithmException)
+          throw (NoSuchAlgorithmException) cause;
+        if (cause == null)
+          cause = x;
       }
-    catch (java.lang.reflect.InvocationTargetException ite)
+    catch (ClassCastException x)
       {
-        Throwable cause = ite.getCause();
-        if (cause instanceof InvalidAlgorithmParameterException)
-          throw (InvalidAlgorithmParameterException) cause;
-        else
-          throw new NoSuchAlgorithmException(type);
+        cause = x;
       }
+    NoSuchAlgorithmException x = new NoSuchAlgorithmException(sb.toString());
+    x.initCause(cause);
+    throw x;
   }
 
-// Instance methods.
-  // ------------------------------------------------------------------------
-
   /**
    * Return the type of certificate store this instance represents.
    *
@@ -268,7 +277,7 @@ public class CertStore
    * @return The collection of certificates.
    * @throws CertStoreException If the certificates cannot be retrieved.
    */
-  public final Collection getCertificates(CertSelector selector)
+  public final Collection<? extends Certificate> getCertificates(CertSelector selector)
     throws CertStoreException
   {
     return storeSpi.engineGetCertificates(selector);
@@ -286,7 +295,7 @@ public class CertStore
    * @return The collection of certificate revocation lists.
    * @throws CertStoreException If the CRLs cannot be retrieved.
    */
-  public final Collection getCRLs(CRLSelector selector)
+  public final Collection<? extends CRL> getCRLs(CRLSelector selector)
     throws CertStoreException
   {
     return storeSpi.engineGetCRLs(selector);
diff --git a/libjava/classpath/java/security/cert/CertStoreSpi.java b/libjava/classpath/java/security/cert/CertStoreSpi.java
index a69545f..976d65c 100644
--- a/libjava/classpath/java/security/cert/CertStoreSpi.java
+++ b/libjava/classpath/java/security/cert/CertStoreSpi.java
@@ -50,7 +50,7 @@ import java.util.Collection;
  * implement the {@link CertStoreParameters} interface, if they require
  * parameters.
  *
- * @since JDK 1.4
+ * @since 1.4
  * @see CertStore
  * @see CollectionCertStoreParameters
  * @see LDAPCertStoreParameters
@@ -86,7 +86,7 @@ public abstract class CertStoreSpi
    * @return A (non-null) collection of certificates.
    * @throws CertStoreException If the certificates cannot be retrieved.
    */
-  public abstract Collection engineGetCertificates(CertSelector selector)
+  public abstract Collection<? extends Certificate> engineGetCertificates(CertSelector selector)
   throws CertStoreException;
 
   /**
@@ -98,6 +98,6 @@ public abstract class CertStoreSpi
    * @return A (non-null) collection of certificate revocation list.
    * @throws CertStoreException If the CRLs cannot be retrieved.
    */
-  public abstract Collection engineGetCRLs(CRLSelector selector)
+  public abstract Collection<? extends CRL> engineGetCRLs(CRLSelector selector)
   throws CertStoreException;
 }
diff --git a/libjava/classpath/java/security/cert/CertificateFactory.java b/libjava/classpath/java/security/cert/CertificateFactory.java
index aedeff5..8139c6e 100644
--- a/libjava/classpath/java/security/cert/CertificateFactory.java
+++ b/libjava/classpath/java/security/cert/CertificateFactory.java
@@ -41,6 +41,8 @@ package java.security.cert;
 import gnu.java.security.Engine;
 
 import java.io.InputStream;
+import java.lang.reflect.InvocationTargetException;
+import java.security.KeyStoreException;
 import java.security.NoSuchAlgorithmException;
 import java.security.NoSuchProviderException;
 import java.security.Provider;
@@ -56,7 +58,7 @@ import java.util.List;
  *
  * @author Mark Benvenuto
  * @author Casey Marshall
- * @since JDK 1.2
+ * @since 1.2
  * @status Fully compatible with JDK 1.4.
  */
 public class CertificateFactory
@@ -84,106 +86,102 @@ public class CertificateFactory
     this.type = type;
   }
 
-// Class methods.
-  // ------------------------------------------------------------------------
-
-  /** 
-   * Gets an instance of the CertificateFactory class representing
-   * the specified certificate factory. If the type is not 
-   * found then, it throws CertificateException.
-   *
-   * @param type     The type of certificate factory to create.
-   * @return a CertificateFactory repesenting the desired type
-   * @throws CertificateException If the type of certificate is not
-   *    implemented by any installed provider.
+  /**
+   * Returns an instance of a <code>CertificateFactory</code> representing the
+   * specified certificate factory type.
+   * 
+   * @param type The type of certificate factory to create.
+   * @return A <code>CertificateFactory</code> of the desired type.
+   * @throws CertificateException If the type of certificate factory is not
+   *           implemented by any installed provider.
+   * @throws IllegalArgumentException if <code>type</code> is
+   *           <code>null</code> or is an empty string.
    */
   public static final CertificateFactory getInstance(String type)
-    throws CertificateException
+      throws CertificateException
   {
     Provider[] p = Security.getProviders();
-
+    CertificateException lastException = null;
     for (int i = 0; i < p.length; i++)
-      {
-        try
-          {
-            return getInstance(type, p[i]);
-          }
-        catch (CertificateException e)
-          {
-	    // Ignored.
-          }
-      }
-
+      try
+        {
+          return getInstance(type, p[i]);
+        }
+      catch (CertificateException x)
+        {
+          lastException = x;
+        }
+    if (lastException != null)
+      throw lastException;
     throw new CertificateException(type);
   }
 
-  /** 
-   * Gets an instance of the CertificateFactory class representing
-   * the specified certificate factory from the specified provider. 
-   * If the type is not found then, it throws {@link CertificateException}. 
-   * If the provider is not found, then it throws 
-   * {@link java.security.NoSuchProviderException}.
-   *
-   * @param type     The type of certificate factory to create.
-   * @param provider The name of the provider from which to get the
-   *        implementation.
-   * @return A CertificateFactory for the desired type.
-   * @throws CertificateException If the type of certificate is not
-   *         implemented by the named provider.
+  /**
+   * Returns an instance of a <code>CertificateFactory</code> representing the
+   * specified certificate factory type from the named provider.
+   * 
+   * @param type The type of certificate factory to create.
+   * @param provider The name of the provider to use.
+   * @return A <code>CertificateFactory</code> for the desired type.
+   * @throws CertificateException If the type of certificate is not implemented
+   *           by the named provider.
    * @throws NoSuchProviderException If the named provider is not installed.
+   * @throws IllegalArgumentException if either <code>type</code> or
+   *           <code>provider</code> is <code>null</code>, or if
+   *           <code>type</code> is an empty string.
    */
   public static final CertificateFactory getInstance(String type,
                                                      String provider) 
     throws CertificateException, NoSuchProviderException
   {
+    if (provider == null)
+      throw new IllegalArgumentException("provider MUST NOT be null");
     Provider p = Security.getProvider(provider);
-    if( p == null)
+    if (p == null)
       throw new NoSuchProviderException(provider);
-
     return getInstance(type, p);
   }
 
   /**
-   * Get a certificate factory for the given certificate type from the
-   * given provider.
-   *
-   * @param type     The type of certificate factory to create.
+   * Returns an instance of a <code>CertificateFactory</code> representing the
+   * specified certificate factory type from the designated provider.
+   * 
+   * @param type The type of certificate factory to create.
    * @param provider The provider from which to get the implementation.
-   * @return A CertificateFactory for the desired type.
-   * @throws CertificateException If the type of certificate is not
-   *         implemented by the provider.
-   * @throws IllegalArgumentException If the provider is null.
+   * @return A <code>CertificateFactory</code> for the desired type.
+   * @throws CertificateException If the type of certificate is not implemented
+   *           by the provider.
+   * @throws IllegalArgumentException if either <code>type</code> or
+   *           <code>provider</code> is <code>null</code>, or if
+   *           <code>type</code> is an empty string.
    */
   public static final CertificateFactory getInstance(String type,
                                                      Provider provider)
-    throws CertificateException
+      throws CertificateException
   {
-    if (provider == null)
-      throw new IllegalArgumentException("null provider");
-
+    Throwable cause;
     try
       {
-        return new CertificateFactory((CertificateFactorySpi)
-          Engine.getInstance(CERTIFICATE_FACTORY, type, provider),
-          provider, type);
+        Object spi = Engine.getInstance(CERTIFICATE_FACTORY, type, provider);
+        return new CertificateFactory((CertificateFactorySpi) spi, provider, type);
       }
-    catch (ClassCastException cce)
+    catch (ClassCastException x)
       {
-        throw new CertificateException(type);
+        cause = x;
       }
-    catch (java.lang.reflect.InvocationTargetException ite)
+    catch (InvocationTargetException x)
       {
-        throw new CertificateException(type);
+        cause = x.getCause() != null ? x.getCause() : x;
       }
-    catch (NoSuchAlgorithmException nsae)
+    catch (NoSuchAlgorithmException x)
       {
-        throw new CertificateException(nsae.getMessage());
+        cause = x;
       }
+    CertificateException x = new CertificateException(type);
+    x.initCause(cause);
+    throw x;
   }
 
-// Instance methods.
-  // ------------------------------------------------------------------------
-
   /**
    * Gets the provider of this implementation.
    *
@@ -249,7 +247,7 @@ public class CertificateFactory
    * @throws CertificateException If an error occurs decoding the
    *   certificates.
    */
-  public final Collection generateCertificates(InputStream inStream)
+  public final Collection<? extends Certificate> generateCertificates(InputStream inStream)
     throws CertificateException
   {
     return certFacSpi.engineGenerateCertificates(inStream);
@@ -291,7 +289,7 @@ public class CertificateFactory
    *    InputStream data.
    * @throws CRLException If an error occurs decoding the CRLs.
    */
-  public final Collection generateCRLs(InputStream inStream)
+  public final Collection<? extends CRL> generateCRLs(InputStream inStream)
     throws CRLException
   {
     return certFacSpi.engineGenerateCRLs( inStream );
@@ -338,7 +336,7 @@ public class CertificateFactory
    * @throws CertificateException If an error occurs generating the
    *   CertPath.
    */
-  public final CertPath generateCertPath(List certificates)
+  public final CertPath generateCertPath(List<? extends Certificate> certificates)
     throws CertificateException
   {
     return certFacSpi.engineGenerateCertPath(certificates);
@@ -351,7 +349,7 @@ public class CertificateFactory
    *
    * @return The Iterator of supported encodings.
    */
-  public final Iterator getCertPathEncodings()
+  public final Iterator<String> getCertPathEncodings()
   {
     return certFacSpi.engineGetCertPathEncodings();
   }
diff --git a/libjava/classpath/java/security/cert/CertificateFactorySpi.java b/libjava/classpath/java/security/cert/CertificateFactorySpi.java
index beea964..e6a22b4 100644
--- a/libjava/classpath/java/security/cert/CertificateFactorySpi.java
+++ b/libjava/classpath/java/security/cert/CertificateFactorySpi.java
@@ -54,7 +54,7 @@ import java.util.List;
    Certificate factories are used to generate certificates and
    certificate revocation lists (CRL) from their encoding.
    
-   @since JDK 1.2
+   @since 1.2
    
    @author Mark Benvenuto
  */
@@ -117,7 +117,7 @@ public abstract class CertificateFactorySpi
 
      @throws CertificateException Certificate parsing error
   */
-  public abstract Collection engineGenerateCertificates(InputStream inStream)
+  public abstract Collection<? extends Certificate> engineGenerateCertificates(InputStream inStream)
     throws CertificateException;
 
   /**
@@ -157,7 +157,7 @@ public abstract class CertificateFactorySpi
 
      @throws CRLException CRL parsing error
   */
-  public abstract Collection engineGenerateCRLs(InputStream inStream)
+  public abstract Collection<? extends CRL> engineGenerateCRLs(InputStream inStream)
     throws CRLException;
 
   // 1.4 instance methods.
@@ -204,7 +204,7 @@ public abstract class CertificateFactorySpi
    * @throws CertificateException If an error occurs generating the
    *   CertPath.
    */
-  public CertPath engineGenerateCertPath(List certificates)
+  public CertPath engineGenerateCertPath(List<? extends Certificate> certificates)
     throws CertificateException
   {
     throw new UnsupportedOperationException("not implemented");
@@ -217,7 +217,7 @@ public abstract class CertificateFactorySpi
    *
    * @return The Iterator of supported encodings.
    */
-  public Iterator engineGetCertPathEncodings()
+  public Iterator<String> engineGetCertPathEncodings()
   {
     throw new UnsupportedOperationException("not implemented");
   }
diff --git a/libjava/classpath/java/security/cert/CollectionCertStoreParameters.java b/libjava/classpath/java/security/cert/CollectionCertStoreParameters.java
index bac1e3b..b3ee932 100644
--- a/libjava/classpath/java/security/cert/CollectionCertStoreParameters.java
+++ b/libjava/classpath/java/security/cert/CollectionCertStoreParameters.java
@@ -51,6 +51,7 @@ import java.util.Collections;
  * collection may be changed at any time.
  *
  * @see CertStore
+ * @since 1.4
  */
 public class CollectionCertStoreParameters implements CertStoreParameters
 {
@@ -81,7 +82,7 @@ public class CollectionCertStoreParameters implements CertStoreParameters
    * @param collection The collection.
    * @throws NullPointerException If <i>collection</i> is null.
    */
-  public CollectionCertStoreParameters(Collection collection)
+  public CollectionCertStoreParameters(Collection<?> collection)
   {
     if (collection == null)
       throw new NullPointerException();
@@ -103,7 +104,7 @@ public class CollectionCertStoreParameters implements CertStoreParameters
    *
    * @return The collection.
    */
-  public Collection getCollection()
+  public Collection<?> getCollection()
   {
     return collection;
   }
diff --git a/libjava/classpath/java/security/cert/PKIXBuilderParameters.java b/libjava/classpath/java/security/cert/PKIXBuilderParameters.java
index 38b3df5..5e234ce 100644
--- a/libjava/classpath/java/security/cert/PKIXBuilderParameters.java
+++ b/libjava/classpath/java/security/cert/PKIXBuilderParameters.java
@@ -48,6 +48,7 @@ import java.util.Set;
  * Parameters for building certificate paths using the PKIX algorithm.
  *
  * @see CertPathBuilder
+ * @since 1.4
  */
 public class PKIXBuilderParameters extends PKIXParameters
 {
@@ -97,7 +98,8 @@ public class PKIXBuilderParameters extends PKIXParameters
    * @throws ClassCastException If every element in <i>trustAnchors</i>
    *         is not a {@link TrustAnchor}.
    */
-  public PKIXBuilderParameters(Set trustAnchors, CertSelector targetConstraints)
+  public PKIXBuilderParameters(Set<TrustAnchor> trustAnchors,
+                               CertSelector targetConstraints)
     throws InvalidAlgorithmParameterException
   {
     super(trustAnchors);
diff --git a/libjava/classpath/java/security/cert/PKIXCertPathChecker.java b/libjava/classpath/java/security/cert/PKIXCertPathChecker.java
index a6eef41..a69347f 100644
--- a/libjava/classpath/java/security/cert/PKIXCertPathChecker.java
+++ b/libjava/classpath/java/security/cert/PKIXCertPathChecker.java
@@ -59,6 +59,7 @@ import java.util.Set;
  * the most-trusted certificate.
  *
  * @see PKIXParameters
+ * @since 1.4
  */
 public abstract class PKIXCertPathChecker implements Cloneable
 {
@@ -116,7 +117,7 @@ public abstract class PKIXCertPathChecker implements Cloneable
    * @return An immutable set of Strings of the supported X.509 OIDs, or
    *         null if no extensions are supported.
    */
-  public abstract Set getSupportedExtensions();
+  public abstract Set<String> getSupportedExtensions();
 
   /**
    * Checks a certificate, removing any critical extensions that are
@@ -128,6 +129,6 @@ public abstract class PKIXCertPathChecker implements Cloneable
    * @throws CertPathValidatorException If this certificate fails this
    *         check.
    */
-  public abstract void check(Certificate cert, Collection unresolvedCritExts)
+  public abstract void check(Certificate cert, Collection<String> unresolvedCritExts)
   throws CertPathValidatorException;
 }
diff --git a/libjava/classpath/java/security/cert/PKIXParameters.java b/libjava/classpath/java/security/cert/PKIXParameters.java
index 16ef07f..bb68cb9 100644
--- a/libjava/classpath/java/security/cert/PKIXParameters.java
+++ b/libjava/classpath/java/security/cert/PKIXParameters.java
@@ -56,6 +56,7 @@ import java.util.Set;
  * (Public-Key Infrastructure (X.509)) algorithm.
  *
  * @see CertPathBuilder
+ * @since 1.4
  */
 public class PKIXParameters implements CertPathParameters
 {
@@ -144,7 +145,7 @@ public class PKIXParameters implements CertPathParameters
    * @throws ClassCastException If every element in <i>trustAnchors</i>
    *         is not a {@link TrustAnchor}.
    */
-  public PKIXParameters(Set trustAnchors)
+  public PKIXParameters(Set<TrustAnchor> trustAnchors)
     throws InvalidAlgorithmParameterException
   {
     this();
@@ -199,7 +200,7 @@ public class PKIXParameters implements CertPathParameters
    *
    * @return A (never null, never empty) immutable set of trust anchors.
    */
-  public Set getTrustAnchors()
+  public Set<TrustAnchor> getTrustAnchors()
   {
     return Collections.unmodifiableSet(trustAnchors);
   }
@@ -216,7 +217,7 @@ public class PKIXParameters implements CertPathParameters
    * @throws ClassCastException If every element in <i>trustAnchors</i>
    *         is not a {@link TrustAnchor}.
    */
-  public void setTrustAnchors(Set trustAnchors)
+  public void setTrustAnchors(Set<TrustAnchor> trustAnchors)
     throws InvalidAlgorithmParameterException
   {
     if (trustAnchors.isEmpty())
@@ -235,7 +236,7 @@ public class PKIXParameters implements CertPathParameters
    * @return An immutable set of initial policy OID strings, or the
    *         empty set if any policy is acceptable.
    */
-  public Set getInitialPolicies()
+  public Set<String> getInitialPolicies()
   {
     return Collections.unmodifiableSet(initPolicies);
   }
@@ -249,7 +250,7 @@ public class PKIXParameters implements CertPathParameters
    * @throws ClassCastException If any element in <i>initPolicies</i> is
    *         not a string.
    */
-  public void setInitialPolicies(Set initPolicies)
+  public void setInitialPolicies(Set<String> initPolicies)
   {
     this.initPolicies.clear();
     if (initPolicies == null)
@@ -277,7 +278,7 @@ public class PKIXParameters implements CertPathParameters
    *
    * @return The list of cert stores.
    */
-  public List getCertStores()
+  public List<CertStore> getCertStores()
   {
     return Collections.unmodifiableList(certStores);
   }
@@ -288,7 +289,7 @@ public class PKIXParameters implements CertPathParameters
    *
    * @param certStores The cert stores.
    */
-  public void setCertStores(List certStores)
+  public void setCertStores(List<CertStore> certStores)
   {
     this.certStores.clear();
     if (certStores == null)
@@ -446,7 +447,7 @@ public class PKIXParameters implements CertPathParameters
    *
    * @return An immutable list of all certificate path checkers.
    */
-  public List getCertPathCheckers()
+  public List<PKIXCertPathChecker> getCertPathCheckers()
   {
     return Collections.unmodifiableList(pathCheckers);
   }
@@ -459,7 +460,7 @@ public class PKIXParameters implements CertPathParameters
    * @throws ClassCastException If any element of <i>pathCheckers</i> is
    *         not a {@link PKIXCertPathChecker}.
    */
-  public void setCertPathCheckers(List pathCheckers)
+  public void setCertPathCheckers(List<PKIXCertPathChecker> pathCheckers)
   {
     this.pathCheckers.clear();
     if (pathCheckers == null)
diff --git a/libjava/classpath/java/security/cert/PolicyNode.java b/libjava/classpath/java/security/cert/PolicyNode.java
index 58d411c..b119603 100644
--- a/libjava/classpath/java/security/cert/PolicyNode.java
+++ b/libjava/classpath/java/security/cert/PolicyNode.java
@@ -38,6 +38,12 @@ exception statement from your version. */
 
 package java.security.cert;
 
+import java.util.Iterator;
+import java.util.Set;
+
+/**
+ * @since 1.4
+ */
 public interface PolicyNode
 {
 
@@ -47,7 +53,7 @@ public interface PolicyNode
    *
    * @return An iterator over the child nodes.
    */
-  java.util.Iterator getChildren();
+  Iterator<? extends PolicyNode> getChildren();
 
   /**
    * Get the depth of this node within the tree, starting at 0 for the
@@ -64,7 +70,7 @@ public interface PolicyNode
    *
    * @return The set of expected policies.
    */
-  java.util.Set getExpectedPolicies();
+  Set<String> getExpectedPolicies();
 
   /**
    * Returns the parent node of this node, or null if this is the root
@@ -81,7 +87,7 @@ public interface PolicyNode
    *
    * @return The set of {@link PolicyQualifierInfo} objects.
    */
-  java.util.Set getPolicyQualifiers();
+  Set<? extends PolicyQualifierInfo> getPolicyQualifiers();
 
   /**
    * Get the policy OID this node represents. The root node should return
diff --git a/libjava/classpath/java/security/cert/PolicyQualifierInfo.java b/libjava/classpath/java/security/cert/PolicyQualifierInfo.java
index 7dcf231..b50f3f3 100644
--- a/libjava/classpath/java/security/cert/PolicyQualifierInfo.java
+++ b/libjava/classpath/java/security/cert/PolicyQualifierInfo.java
@@ -59,9 +59,10 @@ import java.io.IOException;
  * PolicyQualifierId ::= OBJECT IDENTIFIER
  * </pre>
  *
- * @since JDK 1.4
+ * @since 1.4
+ * @specnote this class was final in 1.4, but beginning with 1.5 is not
  */
-public final class PolicyQualifierInfo
+public class PolicyQualifierInfo
 {
 
   // Fields.
diff --git a/libjava/classpath/java/security/cert/X509CRL.java b/libjava/classpath/java/security/cert/X509CRL.java
index 5657b3e..a00706e 100644
--- a/libjava/classpath/java/security/cert/X509CRL.java
+++ b/libjava/classpath/java/security/cert/X509CRL.java
@@ -97,7 +97,7 @@ import javax.security.auth.x500.X500Principal;
 
 	@author Mark Benvenuto
 
-	@since JDK 1.2
+	@since 1.2
 */
 public abstract class X509CRL extends CRL implements X509Extension
 {
@@ -304,7 +304,7 @@ public abstract class X509CRL extends CRL implements X509Extension
 
      @return a set of revoked certificates.
   */
-  public abstract Set getRevokedCertificates();
+  public abstract Set<? extends X509CRLEntry> getRevokedCertificates();
 
   /**
      Returns the DER ASN.1 encoded tbsCertList which is 
diff --git a/libjava/classpath/java/security/cert/X509CRLSelector.java b/libjava/classpath/java/security/cert/X509CRLSelector.java
index 3c79fba..56b1713 100644
--- a/libjava/classpath/java/security/cert/X509CRLSelector.java
+++ b/libjava/classpath/java/security/cert/X509CRLSelector.java
@@ -69,6 +69,7 @@ import javax.security.auth.x500.X500Principal;
  * use or modify this class then they need to synchronize on the object.
  *
  * @author Casey Marshall (csm@gnu.org)
+ * @since 1.4
  */
 public class X509CRLSelector implements CRLSelector, Cloneable
 {
@@ -157,7 +158,7 @@ public class X509CRLSelector implements CRLSelector, Cloneable
    * @throws IOException If any of the elements in the collection is not
    *         a valid name.
    */
-  public void setIssuerNames(Collection names) throws IOException
+  public void setIssuerNames(Collection<?> names) throws IOException
   {
     if (names == null)
       {
@@ -224,7 +225,7 @@ public class X509CRLSelector implements CRLSelector, Cloneable
    *
    * @return The set of issuer names.
    */
-  public Collection getIssuerNames()
+  public Collection<Object> getIssuerNames()
   {
     if (issuerNames != null)
       return Collections.unmodifiableList(issuerNames);
diff --git a/libjava/classpath/java/security/cert/X509CertSelector.java b/libjava/classpath/java/security/cert/X509CertSelector.java
index 175e4c6..154ed2e 100644
--- a/libjava/classpath/java/security/cert/X509CertSelector.java
+++ b/libjava/classpath/java/security/cert/X509CertSelector.java
@@ -76,6 +76,7 @@ import javax.security.auth.x500.X500Principal;
  * use or modify this class then they need to synchronize on the object.
  *
  * @author Casey Marshall (csm@gnu.org)
+ * @since 1.4
  */
 public class X509CertSelector implements CertSelector, Cloneable
 {
@@ -573,7 +574,7 @@ public class X509CertSelector implements CertSelector, Cloneable
    *
    * @return The set of key purpose OIDs (strings).
    */
-  public Set getExtendedKeyUsage()
+  public Set<String> getExtendedKeyUsage()
   {
     if (keyPurposeSet != null)
       return Collections.unmodifiableSet(keyPurposeSet);
@@ -588,7 +589,7 @@ public class X509CertSelector implements CertSelector, Cloneable
    * @param keyPurposeSet The set of key purpose OIDs.
    * @throws IOException If any element of the set is not a valid OID string.
    */
-  public void setExtendedKeyUsage(Set keyPurposeSet) throws IOException
+  public void setExtendedKeyUsage(Set<String> keyPurposeSet) throws IOException
   {
     if (keyPurposeSet == null)
       {
@@ -653,7 +654,7 @@ public class X509CertSelector implements CertSelector, Cloneable
    * @param altNames The alternative names.
    * @throws IOException If any element of the argument is invalid.
    */
-  public void setSubjectAlternativeNames(Collection altNames)
+  public void setSubjectAlternativeNames(Collection<List<?>> altNames)
     throws IOException
   {
     if (altNames == null)
@@ -786,7 +787,7 @@ public class X509CertSelector implements CertSelector, Cloneable
   // certificate, and check it against the specified set.
 
   // FIXME
-//   public void setPolicy(Set policy) throws IOException
+//   public void setPolicy(Set<String> policy) throws IOException
 //   {
 //     if (policy != null)
 //       {
@@ -807,7 +808,7 @@ public class X509CertSelector implements CertSelector, Cloneable
 //   }
 
   // FIXME
-//   public void setPathToNames(Collection names) throws IOException
+//   public void setPathToNames(Collection<List<?>> names) throws IOException
 //   {
 //     if (names == null)
 //       {
@@ -843,19 +844,19 @@ public class X509CertSelector implements CertSelector, Cloneable
 //   }
 
   // FIXME
-//   public Collection getSubjectAlternativeNames()
+//   public Collection<List<?>> getSubjectAlternativeNames()
 //   {
 //     return null;
 //   }
 
   // FIXME
-//   public Set getPolicy()
+//   public Set<String> getPolicy()
 //   {
 //     return null;
 //   }
 
   // FIXME
-//   public Collection getPathToNames()
+//   public Collection<List<?>> getPathToNames()
 //   {
 //     return null;
 //   }
diff --git a/libjava/classpath/java/security/cert/X509Certificate.java b/libjava/classpath/java/security/cert/X509Certificate.java
index f6c6fcf..bc1b5c2 100644
--- a/libjava/classpath/java/security/cert/X509Certificate.java
+++ b/libjava/classpath/java/security/cert/X509Certificate.java
@@ -41,6 +41,7 @@ package java.security.cert;
 import java.math.BigInteger;
 import java.security.Principal;
 import java.util.Date;
+import java.util.List;
 
 /**
  * X509Certificate is the abstract class for X.509 certificates.
@@ -131,7 +132,7 @@ import java.util.Date;
  * Profile</a></i>.</li>
  * </ol>
  *
- * @since JDK 1.2
+ * @since 1.2
  * @author Mark Benvenuto
  * @author Casey Marshall (rsdio@metastatic.org)
  */
@@ -487,7 +488,7 @@ public abstract class X509Certificate
    * @throws CertificateParsingException If this extension cannot be
    * parsed from its encoded form.
    */
-  public java.util.List getExtendedKeyUsage()
+  public java.util.List<String> getExtendedKeyUsage()
     throws CertificateParsingException
   {
     throw new UnsupportedOperationException();
@@ -531,7 +532,7 @@ public abstract class X509Certificate
    * be parsed.
    * @since JDK 1.4
    */
-  public java.util.Collection getSubjectAlternativeNames()
+  public java.util.Collection<List<?>> getSubjectAlternativeNames()
     throws CertificateParsingException
   {
     throw new UnsupportedOperationException();
@@ -558,7 +559,7 @@ public abstract class X509Certificate
    * be parsed.
    * @since JDK 1.4
    */
-  public java.util.Collection getIssuerAlternativeNames()
+  public java.util.Collection<List<?>> getIssuerAlternativeNames()
     throws CertificateParsingException
   {
     throw new UnsupportedOperationException();
diff --git a/libjava/classpath/java/security/cert/X509Extension.java b/libjava/classpath/java/security/cert/X509Extension.java
index d2cb80a..bd94737 100644
--- a/libjava/classpath/java/security/cert/X509Extension.java
+++ b/libjava/classpath/java/security/cert/X509Extension.java
@@ -70,7 +70,7 @@ import java.util.Set;
  	
 	@author Mark Benvenuto
 
-	@since JDK 1.2
+	@since 1.2
 */
 public interface X509Extension
 {
@@ -91,7 +91,7 @@ public interface X509Extension
      @return A Set containing the OIDs. If there are no CRITICAL
      extensions or extensions at all this returns null.
   */
-  Set getCriticalExtensionOIDs();
+  Set<String> getCriticalExtensionOIDs();
 
   /**
      Returns a set of the NON-CRITICAL extension OIDs from the 
@@ -101,7 +101,7 @@ public interface X509Extension
      @return A Set containing the OIDs. If there are no NON-CRITICAL
      extensions or extensions at all this returns null.
   */
-  Set getNonCriticalExtensionOIDs();
+  Set<String> getNonCriticalExtensionOIDs();
 
   /**
      Returns the DER encoded OCTET string for the specified