diff -r bff625f165fa src/jdk.vm.ci/share/classes/jdk.vm.ci.hotspot/src/jdk/vm/ci/hotspot/HotSpotMetaAccessProvider.java
--- a/src/jdk.vm.ci/share/classes/jdk.vm.ci.hotspot/src/jdk/vm/ci/hotspot/HotSpotMetaAccessProvider.java	Mon Mar 07 09:34:29 2016 +0100
+++ b/src/jdk.vm.ci/share/classes/jdk.vm.ci.hotspot/src/jdk/vm/ci/hotspot/HotSpotMetaAccessProvider.java	Tue Mar 08 10:08:43 2016 -1000
@@ -33,6 +33,8 @@ import java.lang.reflect.Executable;
 import java.lang.reflect.Field;
 import java.lang.reflect.Method;
 import java.lang.reflect.Modifier;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
 
 import jdk.vm.ci.code.CodeUtil;
 import jdk.vm.ci.code.TargetDescription;
@@ -92,7 +94,13 @@ public class HotSpotMetaAccessProvider i
     private static Field getReflectionSlotField(Class<?> reflectionClass) {
         try {
             Field field = reflectionClass.getDeclaredField("slot");
-            field.setAccessible(true);
+            AccessController.doPrivileged(
+                            new PrivilegedAction<Void>() {
+                                public Void run() {
+                                    field.setAccessible(true);
+                                    return null;
+                                }
+                            });
             return field;
         } catch (NoSuchFieldException | SecurityException e) {
             throw new JVMCIError(e);
@@ -141,7 +149,8 @@ public class HotSpotMetaAccessProvider i
         int actionValue = convertDeoptAction(action);
         int reasonValue = convertDeoptReason(reason);
         int debugValue = debugId & intMaskRight(config.deoptimizationDebugIdBits);
-        JavaConstant c = JavaConstant.forInt(~((debugValue << config.deoptimizationDebugIdShift) | (reasonValue << config.deoptimizationReasonShift) | (actionValue << config.deoptimizationActionShift)));
+        JavaConstant c = JavaConstant.forInt(
+                        ~((debugValue << config.deoptimizationDebugIdShift) | (reasonValue << config.deoptimizationReasonShift) | (actionValue << config.deoptimizationActionShift)));
         assert c.asInt() < 0;
         return c;
     }
diff -r bff625f165fa src/jdk.vm.ci/share/classes/jdk.vm.ci.hotspot/src/jdk/vm/ci/hotspot/HotSpotVMConfig.java
--- a/src/jdk.vm.ci/share/classes/jdk.vm.ci.hotspot/src/jdk/vm/ci/hotspot/HotSpotVMConfig.java	Mon Mar 07 09:34:29 2016 +0100
+++ b/src/jdk.vm.ci/share/classes/jdk.vm.ci.hotspot/src/jdk/vm/ci/hotspot/HotSpotVMConfig.java	Tue Mar 08 10:08:43 2016 -1000
@@ -28,6 +28,8 @@ import static jdk.vm.ci.hotspot.UnsafeAc
 
 import java.lang.reflect.Field;
 import java.lang.reflect.Modifier;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
 import java.util.HashMap;
 import java.util.Iterator;
 
@@ -50,6 +52,26 @@ import sun.misc.Unsafe;
 public class HotSpotVMConfig {
 
     /**
+     * Value of the Java {@code os.name} property.
+     */
+    private final String osName;
+
+    /**
+     * Helper method to read a system property via a privileged section.
+     *
+     * @param name property name
+     * @return the property's value or the empty string
+     */
+    private static String getProperty(String name) {
+        return AccessController.doPrivileged(
+                        new PrivilegedAction<String>() {
+                            public String run() {
+                                return System.getProperty(name, "");
+                            }
+                        });
+    }
+
+    /**
      * Gets the configuration associated with the singleton {@link HotSpotJVMCIRuntime}.
      */
     public static HotSpotVMConfig config() {
@@ -94,6 +116,10 @@ public class HotSpotVMConfig {
         assert jvmciHotSpotVMLongConstants != 0;
         assert jvmciHotSpotVMAddresses != 0;
 
+        osName = getProperty("os.name");
+        windowsOs = osName.startsWith("Windows");
+        linuxOs = osName.startsWith("Linux");
+
         initialize();
 
         oopEncoding = new CompressEncoding(narrowOopBase, narrowOopShift, logMinObjAlignment());
@@ -145,7 +171,7 @@ public class HotSpotVMConfig {
             flags.put(e.getName(), e);
         }
 
-        String osName = getHostOSName();
+        String simpleOsName = getSimpleHostOSName();
         String osArch = getHostArchitectureName();
 
         for (Field f : HotSpotVMConfig.class.getDeclaredFields()) {
@@ -212,7 +238,7 @@ public class HotSpotVMConfig {
                 String name = annotation.name();
                 VMAddresses.Address entry = vmAddresses.get(name);
                 if (entry == null) {
-                    if (!isRequired(osName, annotation.os())) {
+                    if (!isRequired(simpleOsName, annotation.os())) {
                         continue;
                     }
                     throw new JVMCIError(f.getName() + ": expected VM address not found: " + name);
@@ -285,27 +311,22 @@ public class HotSpotVMConfig {
     /**
      * Gets the host operating system name.
      */
-    private static String getHostOSName() {
-        String osName = System.getProperty("os.name");
+    private String getSimpleHostOSName() {
         switch (osName) {
             case "Linux":
-                osName = "linux";
-                break;
+                return "linux";
             case "SunOS":
-                osName = "solaris";
-                break;
+                return "solaris";
             case "Mac OS X":
-                osName = "bsd";
-                break;
+                return "bsd";
             default:
                 // Of course Windows is different...
                 if (osName.startsWith("Windows")) {
-                    osName = "windows";
+                    return "windows";
                 } else {
                     throw new JVMCIError("Unexpected OS name: " + osName);
                 }
         }
-        return osName;
     }
 
     /**
@@ -313,16 +334,16 @@ public class HotSpotVMConfig {
      * {@linkplain HotSpotJVMCIBackendFactory backend}.
      */
     public String getHostArchitectureName() {
-        String arch = System.getProperty("os.arch");
+        String arch = getProperty("os.arch");
         switch (arch) {
             case "x86_64":
-                arch = "amd64";
-                break;
+                return "amd64";
             case "sparcv9":
-                arch = "sparc";
-                break;
+                return "sparc";
+            default:
+                // All other names are the ones we expect.
+                return arch;
         }
-        return arch;
     }
 
     /**
@@ -837,9 +858,10 @@ public class HotSpotVMConfig {
         }
     }
 
+    public final boolean windowsOs;
+    public final boolean linuxOs;
+
     @HotSpotVMConstant(name = "ASSERT") @Stable public boolean cAssertions;
-    public final boolean windowsOs = System.getProperty("os.name", "").startsWith("Windows");
-    public final boolean linuxOs = System.getProperty("os.name", "").startsWith("Linux");
 
     @HotSpotVMFlag(name = "CodeEntryAlignment") @Stable public int codeEntryAlignment;
     @HotSpotVMFlag(name = "VerifyOops") @Stable public boolean verifyOops;
diff -r bff625f165fa src/jdk.vm.ci/share/classes/jdk.vm.ci.inittimer/src/jdk/vm/ci/inittimer/InitTimer.java
--- a/src/jdk.vm.ci/share/classes/jdk.vm.ci.inittimer/src/jdk/vm/ci/inittimer/InitTimer.java	Mon Mar 07 09:34:29 2016 +0100
+++ b/src/jdk.vm.ci/share/classes/jdk.vm.ci.inittimer/src/jdk/vm/ci/inittimer/InitTimer.java	Tue Mar 08 10:08:43 2016 -1000
@@ -22,6 +22,8 @@
  */
 package jdk.vm.ci.inittimer;
 
+import java.security.AccessController;
+import java.security.PrivilegedAction;
 import java.util.concurrent.atomic.AtomicInteger;
 
 /**
@@ -68,7 +70,16 @@ public final class InitTimer implements 
      * Specifies if initialization timing is enabled. Note: This property cannot use
      * {@code HotSpotJVMCIRuntime.Option} since that class is not visible from this package.
      */
-    private static final boolean ENABLED = Boolean.getBoolean("jvmci.InitTimer");
+    private static final boolean ENABLED;
+
+    static {
+        ENABLED = AccessController.doPrivileged(
+                        new PrivilegedAction<Boolean>() {
+                            public Boolean run() {
+                                return Boolean.getBoolean("jvmci.InitTimer");
+                            }
+                        });
+    }
 
     public static final AtomicInteger nesting = ENABLED ? new AtomicInteger() : null;
     public static final String SPACES = "                                            ";
diff -r bff625f165fa src/jdk.vm.ci/share/classes/jdk.vm.ci.services/src/jdk/vm/ci/services/Services.java
--- a/src/jdk.vm.ci/share/classes/jdk.vm.ci.services/src/jdk/vm/ci/services/Services.java	Mon Mar 07 09:34:29 2016 +0100
+++ b/src/jdk.vm.ci/share/classes/jdk.vm.ci.services/src/jdk/vm/ci/services/Services.java	Tue Mar 08 10:08:43 2016 -1000
@@ -22,6 +22,8 @@
  */
 package jdk.vm.ci.services;
 
+import java.security.AccessController;
+import java.security.PrivilegedAction;
 import java.util.Formatter;
 import java.util.Iterator;
 import java.util.ServiceConfigurationError;
@@ -39,7 +41,12 @@ public final class Services {
      * Gets an {@link Iterable} of the JVMCI providers available for a given service.
      */
     public static <S> Iterable<S> load(Class<S> service) {
-        return ServiceLoader.load(service);
+        return AccessController.doPrivileged(
+                        new PrivilegedAction<Iterable<S>>() {
+                            public Iterable<S> run() {
+                                return ServiceLoader.load(service);
+                            }
+                        });
     }
 
     /**
@@ -50,7 +57,7 @@ public final class Services {
      *            {@code service} is available
      */
     public static <S> S loadSingle(Class<S> service, boolean required) {
-        Iterable<S> providers = ServiceLoader.load(service);
+        Iterable<S> providers = load(service);
         S singleProvider = null;
         try {
             for (Iterator<S> it = providers.iterator(); it.hasNext();) {