diff --git a/make/conf/module-loader-map.conf b/make/conf/module-loader-map.conf
index e904031186dee..1062b780a79ff 100644
--- a/make/conf/module-loader-map.conf
+++ b/make/conf/module-loader-map.conf
@@ -94,48 +94,26 @@ PLATFORM_MODULES_windows= \
 
 NATIVE_ACCESS_MODULES= \
     java.base \
-    java.datatransfer \
     java.desktop \
     java.instrument \
-    java.logging \
     java.management \
-    java.management.rmi \
-    java.naming \
-    java.net.http \
     java.prefs \
     java.rmi \
-    java.scripting \
-    java.se \
     java.security.jgss \
-    java.security.sasl \
     java.smartcardio \
-    java.sql \
-    java.sql.rowset \
-    java.transaction.xa \
-    java.xml \
-    java.xml.crypto \
     jdk.accessibility \
-    jdk.charsets \
+    jdk.attach \
     jdk.crypto.cryptoki \
-    jdk.dynalink \
-    jdk.httpserver \
-    jdk.incubator.vector \
+    jdk.crypto.mscapi \
+    jdk.hotspot.agent \
     jdk.internal.le \
     jdk.internal.vm.ci \
+    jdk.jdi \
     jdk.jfr \
-    jdk.jsobject \
-    jdk.localedata \
+    jdk.jpackage \
     jdk.management \
     jdk.management.agent \
-    jdk.management.jfr \
-    jdk.naming.dns \
-    jdk.naming.rmi \
     jdk.net \
-    jdk.nio.mapmode \
     jdk.sctp \
     jdk.security.auth \
-    jdk.security.jgss \
-    jdk.unsupported \
-    jdk.xml.dom \
-    jdk.zipfs \
     #
diff --git a/make/test/BuildTestLib.gmk b/make/test/BuildTestLib.gmk
index d48f263f6f96d..dceae073ff385 100644
--- a/make/test/BuildTestLib.gmk
+++ b/make/test/BuildTestLib.gmk
@@ -64,7 +64,7 @@ $(eval $(call SetupJavaCompilation, BUILD_TEST_LIB_JAR, \
     BIN := $(TEST_LIB_SUPPORT)/test-lib_classes, \
     HEADERS := $(TEST_LIB_SUPPORT)/test-lib_headers, \
     JAR := $(TEST_LIB_SUPPORT)/test-lib.jar, \
-    DISABLED_WARNINGS := try deprecation rawtypes unchecked serial cast removal preview dangling-doc-comments, \
+    DISABLED_WARNINGS := try deprecation rawtypes unchecked serial cast removal preview restricted dangling-doc-comments, \
     JAVAC_FLAGS := --add-exports java.base/sun.security.util=ALL-UNNAMED \
         --add-exports java.base/jdk.internal.classfile=ALL-UNNAMED \
         --add-exports java.base/jdk.internal.classfile.attribute=ALL-UNNAMED \
diff --git a/src/hotspot/share/classfile/vmClassMacros.hpp b/src/hotspot/share/classfile/vmClassMacros.hpp
index 503b595074d80..10fa89007957c 100644
--- a/src/hotspot/share/classfile/vmClassMacros.hpp
+++ b/src/hotspot/share/classfile/vmClassMacros.hpp
@@ -77,6 +77,7 @@
   do_klass(StackOverflowError_klass,                    java_lang_StackOverflowError                          ) \
   do_klass(IllegalMonitorStateException_klass,          java_lang_IllegalMonitorStateException                ) \
   do_klass(Reference_klass,                             java_lang_ref_Reference                               ) \
+  do_klass(IllegalCallerException_klass,                java_lang_IllegalCallerException                      ) \
                                                                                                                 \
   /* ref klasses and set reference types */                                                                     \
   do_klass(SoftReference_klass,                         java_lang_ref_SoftReference                           ) \
diff --git a/src/hotspot/share/classfile/vmSymbols.hpp b/src/hotspot/share/classfile/vmSymbols.hpp
index f79af705f0b0a..bb0712031293c 100644
--- a/src/hotspot/share/classfile/vmSymbols.hpp
+++ b/src/hotspot/share/classfile/vmSymbols.hpp
@@ -217,6 +217,7 @@ class SerializeClosure;
   template(java_lang_CloneNotSupportedException,      "java/lang/CloneNotSupportedException")     \
   template(java_lang_IllegalAccessException,          "java/lang/IllegalAccessException")         \
   template(java_lang_IllegalArgumentException,        "java/lang/IllegalArgumentException")       \
+  template(java_lang_IllegalCallerException,          "java/lang/IllegalCallerException")         \
   template(java_lang_IllegalStateException,           "java/lang/IllegalStateException")          \
   template(java_lang_IllegalMonitorStateException,    "java/lang/IllegalMonitorStateException")   \
   template(java_lang_IllegalThreadStateException,     "java/lang/IllegalThreadStateException")    \
@@ -627,7 +628,7 @@ class SerializeClosure;
   template(object_object_object_signature,            "(Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object;") \
   template(string_string_string_signature,            "(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;") \
   template(string_string_signature,                   "(Ljava/lang/String;)Ljava/lang/String;")                   \
-  template(classloader_string_long_signature,         "(Ljava/lang/ClassLoader;Ljava/lang/String;)J")             \
+  template(classloader_class_string_string_long_signature,         "(Ljava/lang/ClassLoader;Ljava/lang/Class;Ljava/lang/String;Ljava/lang/String;)J")             \
   template(byte_array_void_signature,                 "([B)V")                                                    \
   template(char_array_void_signature,                 "([C)V")                                                    \
   template(int_int_void_signature,                    "(II)V")                                                    \
diff --git a/src/hotspot/share/prims/nativeLookup.cpp b/src/hotspot/share/prims/nativeLookup.cpp
index e838c831ff1ab..6e7e9ce7850dc 100644
--- a/src/hotspot/share/prims/nativeLookup.cpp
+++ b/src/hotspot/share/prims/nativeLookup.cpp
@@ -272,17 +272,24 @@ address NativeLookup::lookup_style(const methodHandle& method, char* pure_name,
   }
 
   // Otherwise call static method findNative in ClassLoader
+
   Klass*   klass = vmClasses::ClassLoader_klass();
-  Handle name_arg = java_lang_String::create_from_str(jni_name, CHECK_NULL);
+  Handle jni_class(THREAD, method->method_holder()->java_mirror());
+  Handle jni_name_arg = java_lang_String::create_from_str(jni_name, CHECK_NULL);
+  Handle java_name_arg = java_lang_String::create_from_str(method->name()->as_C_string(), CHECK_NULL);
+
+  JavaCallArguments args;
+  args.push_oop(loader);
+  args.push_oop(jni_class);
+  args.push_oop(jni_name_arg);
+  args.push_oop(java_name_arg);
 
   JavaValue result(T_LONG);
   JavaCalls::call_static(&result,
                          klass,
                          vmSymbols::findNative_name(),
-                         vmSymbols::classloader_string_long_signature(),
-                         // Arguments
-                         loader,
-                         name_arg,
+                         vmSymbols::classloader_class_string_string_long_signature(),
+                         &args,
                          CHECK_NULL);
   entry = (address) (intptr_t) result.get_jlong();
 
@@ -409,6 +416,14 @@ address NativeLookup::lookup_base(const methodHandle& method, TRAPS) {
   entry = lookup_entry_prefixed(method, CHECK_NULL);
   if (entry != nullptr) return entry;
 
+
+  if (THREAD->has_pending_exception()) {
+    oop exception = THREAD->pending_exception();
+    if (exception->is_a(vmClasses::IllegalCallerException_klass())) {
+      // we already have a pending exception from the restricted method check, just return
+      return nullptr;
+    }
+  }
   // Native function not found, throw UnsatisfiedLinkError
   stringStream ss;
   ss.print("'");
diff --git a/src/hotspot/share/runtime/arguments.cpp b/src/hotspot/share/runtime/arguments.cpp
index ee8c7b24541bc..c3c3efad541a7 100644
--- a/src/hotspot/share/runtime/arguments.cpp
+++ b/src/hotspot/share/runtime/arguments.cpp
@@ -304,6 +304,8 @@ bool needs_module_property_warning = false;
 #define UPGRADE_PATH_LEN 12
 #define ENABLE_NATIVE_ACCESS "enable.native.access"
 #define ENABLE_NATIVE_ACCESS_LEN 20
+#define ILLEGAL_NATIVE_ACCESS "illegal.native.access"
+#define ILLEGAL_NATIVE_ACCESS_LEN 21
 
 // Return TRUE if option matches 'property', or 'property=', or 'property.'.
 static bool matches_property_suffix(const char* option, const char* property, size_t len) {
@@ -325,6 +327,7 @@ bool Arguments::is_internal_module_property(const char* property) {
         matches_property_suffix(property_suffix, LIMITMODS, LIMITMODS_LEN) ||
         matches_property_suffix(property_suffix, PATH, PATH_LEN) ||
         matches_property_suffix(property_suffix, UPGRADE_PATH, UPGRADE_PATH_LEN) ||
+        matches_property_suffix(property_suffix, ILLEGAL_NATIVE_ACCESS, ILLEGAL_NATIVE_ACCESS_LEN) ||
         matches_property_suffix(property_suffix, ENABLE_NATIVE_ACCESS, ENABLE_NATIVE_ACCESS_LEN)) {
       return true;
     }
@@ -2263,6 +2266,10 @@ jint Arguments::parse_each_vm_init_arg(const JavaVMInitArgs* args, bool* patch_m
       if (!create_numbered_module_property("jdk.module.enable.native.access", tail, enable_native_access_count++)) {
         return JNI_ENOMEM;
       }
+    } else if (match_option(option, "--illegal-native-access=", &tail)) {
+      if (!create_module_property("jdk.module.illegal.native.access", tail, InternalProperty)) {
+        return JNI_ENOMEM;
+      }
     } else if (match_option(option, "--limit-modules=", &tail)) {
       if (!create_module_property("jdk.module.limitmods", tail, InternalProperty)) {
         return JNI_ENOMEM;
diff --git a/src/java.base/share/classes/java/lang/ClassLoader.java b/src/java.base/share/classes/java/lang/ClassLoader.java
index 665c7a2567027..b7b6153c8d6d7 100644
--- a/src/java.base/share/classes/java/lang/ClassLoader.java
+++ b/src/java.base/share/classes/java/lang/ClassLoader.java
@@ -2445,7 +2445,16 @@ static NativeLibrary loadLibrary(Class<?> fromClass, String name) {
     /*
      * Invoked in the VM class linking code.
      */
-    static long findNative(ClassLoader loader, String entryName) {
+    static long findNative(ClassLoader loader, Class<?> clazz, String entryName, String javaName) {
+        long addr = findNativeInternal(loader, entryName);
+        if (addr != 0 && loader != null) {
+            Reflection.ensureNativeAccess(clazz, clazz, javaName);
+        }
+        return addr;
+    }
+
+    // @@@: Avoid duplication!
+    static long findNativeInternal(ClassLoader loader, String entryName) {
         if (loader == null) {
             return BootLoader.getNativeLibraries().find(entryName);
         } else {
diff --git a/src/java.base/share/classes/java/lang/Module.java b/src/java.base/share/classes/java/lang/Module.java
index 82dae27efa039..5b1111a6d72a6 100644
--- a/src/java.base/share/classes/java/lang/Module.java
+++ b/src/java.base/share/classes/java/lang/Module.java
@@ -307,15 +307,23 @@ private Module moduleForNativeAccess() {
     void ensureNativeAccess(Class<?> owner, String methodName, Class<?> currentClass) {
         // The target module whose enableNativeAccess flag is ensured
         Module target = moduleForNativeAccess();
-        if (!EnableNativeAccess.isNativeAccessEnabled(target)) {
-            if (ModuleBootstrap.hasEnableNativeAccessFlag()) {
+        ModuleBootstrap.IllegalNativeAccess illegalNativeAccess = ModuleBootstrap.illegalNativeAccess();
+        if (illegalNativeAccess != ModuleBootstrap.IllegalNativeAccess.ALLOW &&
+                !EnableNativeAccess.isNativeAccessEnabled(target)) {
+            if (illegalNativeAccess == ModuleBootstrap.IllegalNativeAccess.DENY) {
                 throw new IllegalCallerException("Illegal native access from: " + this);
-            }
-            if (EnableNativeAccess.trySetEnableNativeAccess(target)) {
+            } else if (EnableNativeAccess.trySetEnableNativeAccess(target)) {
                 // warn and set flag, so that only one warning is reported per module
                 String cls = owner.getName();
                 String mtd = cls + "::" + methodName;
                 String mod = isNamed() ? "module " + getName() : "an unnamed module";
+                if (currentClass != null) {
+                    // try to extract location of the current class (e.g. jar or folder)
+                    URL url = System.codeSource(currentClass);
+                    if (url != null) {
+                        mod += " (" + url + ")";
+                    }
+                }
                 String modflag = isNamed() ? getName() : "ALL-UNNAMED";
                 String caller = currentClass != null ? currentClass.getName() : "code";
                 System.err.printf("""
diff --git a/src/java.base/share/classes/java/lang/Runtime.java b/src/java.base/share/classes/java/lang/Runtime.java
index e77bf4c41e36c..6aeabc9e7ed4b 100644
--- a/src/java.base/share/classes/java/lang/Runtime.java
+++ b/src/java.base/share/classes/java/lang/Runtime.java
@@ -36,6 +36,7 @@
 import java.util.StringTokenizer;
 
 import jdk.internal.access.SharedSecrets;
+import jdk.internal.javac.Restricted;
 import jdk.internal.reflect.CallerSensitive;
 import jdk.internal.reflect.Reflection;
 
@@ -828,14 +829,19 @@ public void runFinalization() {
      *             a native library image by the host system.
      * @throws     NullPointerException if {@code filename} is
      *             {@code null}
+     * @throws     IllegalCallerException If the caller is in a module that
+     *             does not have native access enabled.
      * @spec jni/index.html Java Native Interface Specification
      * @see        java.lang.Runtime#getRuntime()
      * @see        java.lang.SecurityException
      * @see        java.lang.SecurityManager#checkLink(java.lang.String)
      */
     @CallerSensitive
+    @Restricted
     public void load(String filename) {
-        load0(Reflection.getCallerClass(), filename);
+        Class<?> caller = Reflection.getCallerClass();
+        Reflection.ensureNativeAccess(caller, Runtime.class, "load");
+        load0(caller, filename);
     }
 
     void load0(Class<?> fromClass, String filename) {
@@ -894,13 +900,18 @@ void load0(Class<?> fromClass, String filename) {
      *             native library image by the host system.
      * @throws     NullPointerException if {@code libname} is
      *             {@code null}
+     * @throws     IllegalCallerException If the caller is in a module that
+     *             does not have native access enabled.
      * @spec jni/index.html Java Native Interface Specification
      * @see        java.lang.SecurityException
      * @see        java.lang.SecurityManager#checkLink(java.lang.String)
      */
     @CallerSensitive
+    @Restricted
     public void loadLibrary(String libname) {
-        loadLibrary0(Reflection.getCallerClass(), libname);
+        Class<?> caller = Reflection.getCallerClass();
+        Reflection.ensureNativeAccess(caller, Runtime.class, "loadLibrary");
+        loadLibrary0(caller, libname);
     }
 
     void loadLibrary0(Class<?> fromClass, String libname) {
diff --git a/src/java.base/share/classes/java/lang/System.java b/src/java.base/share/classes/java/lang/System.java
index 5e28b9ce95b7c..837914fe0be94 100644
--- a/src/java.base/share/classes/java/lang/System.java
+++ b/src/java.base/share/classes/java/lang/System.java
@@ -70,6 +70,7 @@
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.stream.Stream;
 
+import jdk.internal.javac.Restricted;
 import jdk.internal.logger.LoggerFinderLoader.TemporaryLoggerFinder;
 import jdk.internal.misc.Blocker;
 import jdk.internal.misc.CarrierThreadLocal;
@@ -356,7 +357,7 @@ private static class CallersHolder {
             = Collections.synchronizedMap(new WeakHashMap<>());
     }
 
-    private static URL codeSource(Class<?> clazz) {
+    static URL codeSource(Class<?> clazz) {
         PrivilegedAction<ProtectionDomain> pa = clazz::getProtectionDomain;
         @SuppressWarnings("removal")
         CodeSource cs = AccessController.doPrivileged(pa).getCodeSource();
@@ -2018,14 +2019,19 @@ public static void runFinalization() {
      *             linked with the VM, or the library cannot be mapped to
      *             a native library image by the host system.
      * @throws     NullPointerException if {@code filename} is {@code null}
+     * @throws     IllegalCallerException If the caller is in a module that
+     *             does not have native access enabled.
      *
      * @spec jni/index.html Java Native Interface Specification
      * @see        java.lang.Runtime#load(java.lang.String)
      * @see        java.lang.SecurityManager#checkLink(java.lang.String)
      */
     @CallerSensitive
+    @Restricted
     public static void load(String filename) {
-        Runtime.getRuntime().load0(Reflection.getCallerClass(), filename);
+        Class<?> caller = Reflection.getCallerClass();
+        Reflection.ensureNativeAccess(caller, System.class, "load");
+        Runtime.getRuntime().load0(caller, filename);
     }
 
     /**
@@ -2056,14 +2062,19 @@ public static void load(String filename) {
      *             linked with the VM,  or the library cannot be mapped to a
      *             native library image by the host system.
      * @throws     NullPointerException if {@code libname} is {@code null}
+     * @throws     IllegalCallerException If the caller is in a module that
+     *             does not have native access enabled.
      *
      * @spec jni/index.html Java Native Interface Specification
      * @see        java.lang.Runtime#loadLibrary(java.lang.String)
      * @see        java.lang.SecurityManager#checkLink(java.lang.String)
      */
     @CallerSensitive
+    @Restricted
     public static void loadLibrary(String libname) {
-        Runtime.getRuntime().loadLibrary0(Reflection.getCallerClass(), libname);
+        Class<?> caller = Reflection.getCallerClass();
+        Reflection.ensureNativeAccess(caller, System.class, "loadLibrary");
+        Runtime.getRuntime().loadLibrary0(caller, libname);
     }
 
     /**
@@ -2649,7 +2660,7 @@ public Object classData(Class<?> c) {
 
             @Override
             public long findNative(ClassLoader loader, String entry) {
-                return ClassLoader.findNative(loader, entry);
+                return ClassLoader.findNativeInternal(loader, entry);
             }
 
             @Override
diff --git a/src/java.base/share/classes/java/lang/foreign/package-info.java b/src/java.base/share/classes/java/lang/foreign/package-info.java
index 6594826e40524..0455f8272593e 100644
--- a/src/java.base/share/classes/java/lang/foreign/package-info.java
+++ b/src/java.base/share/classes/java/lang/foreign/package-info.java
@@ -165,10 +165,11 @@
  * In the reference implementation, access to restricted methods can be granted to
  * specific modules using the command line option {@code --enable-native-access=M1,M2, ... Mn},
  * where {@code M1}, {@code M2}, {@code ... Mn} are module names (for the unnamed module,
- * the special value {@code ALL-UNNAMED} can be used). If this option is specified,
- * access to restricted methods are only granted to the modules listed by that option.
- * If this option is not specified, access to restricted methods is enabled for all
- * modules, but access to restricted methods will result in runtime warnings.
+ * the special value {@code ALL-UNNAMED} can be used). Access to restricted methods
+ * from modules not listed by that option is deemed <em>illegal</em>. Clients can
+ * control how illegal access to restricted method is handled, using the command line
+ * option {@code --illegal-native-access}. If this option is not specified,
+ * illegal access to restricted methods will result in runtime warnings.
  *
  * @spec jni/index.html Java Native Interface Specification
  *
diff --git a/src/java.base/share/classes/jdk/internal/foreign/abi/fallback/LibFallback.java b/src/java.base/share/classes/jdk/internal/foreign/abi/fallback/LibFallback.java
index 58d6baf852554..19682d6c43f5b 100644
--- a/src/java.base/share/classes/jdk/internal/foreign/abi/fallback/LibFallback.java
+++ b/src/java.base/share/classes/jdk/internal/foreign/abi/fallback/LibFallback.java
@@ -36,7 +36,7 @@ private LibFallback() {}
 
     static final boolean SUPPORTED = tryLoadLibrary();
 
-    @SuppressWarnings("removal")
+    @SuppressWarnings({"removal", "restricted"})
     private static boolean tryLoadLibrary() {
         return java.security.AccessController.doPrivileged(
                 new java.security.PrivilegedAction<>() {
diff --git a/src/java.base/share/classes/jdk/internal/jimage/NativeImageBuffer.java b/src/java.base/share/classes/jdk/internal/jimage/NativeImageBuffer.java
index 8d228c050c605..0e3b178c32b0a 100644
--- a/src/java.base/share/classes/jdk/internal/jimage/NativeImageBuffer.java
+++ b/src/java.base/share/classes/jdk/internal/jimage/NativeImageBuffer.java
@@ -38,6 +38,7 @@ class NativeImageBuffer {
     static {
         java.security.AccessController.doPrivileged(
                 new java.security.PrivilegedAction<Void>() {
+                    @SuppressWarnings("restricted")
                     public Void run() {
                         System.loadLibrary("jimage");
                         return null;
diff --git a/src/java.base/share/classes/jdk/internal/module/ModuleBootstrap.java b/src/java.base/share/classes/jdk/internal/module/ModuleBootstrap.java
index b97b0a2de40b0..7426708e38aa6 100644
--- a/src/java.base/share/classes/jdk/internal/module/ModuleBootstrap.java
+++ b/src/java.base/share/classes/jdk/internal/module/ModuleBootstrap.java
@@ -787,17 +787,23 @@ private static void addExtraExportsOrOpens(ModuleLayer bootLayer,
         }
     }
 
-    private static final boolean HAS_ENABLE_NATIVE_ACCESS_FLAG;
     private static final Set<String> USER_NATIVE_ACCESS_MODULES;
     private static final Set<String> JDK_NATIVE_ACCESS_MODULES;
+    private static final IllegalNativeAccess ILLEGAL_NATIVE_ACCESS;
 
-    public static boolean hasEnableNativeAccessFlag() {
-        return HAS_ENABLE_NATIVE_ACCESS_FLAG;
+    public enum IllegalNativeAccess {
+        ALLOW,
+        WARN,
+        DENY
+    }
+
+    public static IllegalNativeAccess illegalNativeAccess() {
+        return ILLEGAL_NATIVE_ACCESS;
     }
 
     static {
+        ILLEGAL_NATIVE_ACCESS = addIllegalNativeAccess();
         USER_NATIVE_ACCESS_MODULES = decodeEnableNativeAccess();
-        HAS_ENABLE_NATIVE_ACCESS_FLAG = !USER_NATIVE_ACCESS_MODULES.isEmpty();
         JDK_NATIVE_ACCESS_MODULES = ModuleLoaderMap.nativeAccessModules();
     }
 
@@ -847,6 +853,27 @@ private static Set<String> decodeEnableNativeAccess() {
         return modules;
     }
 
+    /**
+     * Process the --illegal-native-access option (and its default).
+     */
+    private static IllegalNativeAccess addIllegalNativeAccess() {
+        String value = getAndRemoveProperty("jdk.module.illegal.native.access");
+        // don't use a switch: bootstrapping issues!
+        if (value == null) {
+            return IllegalNativeAccess.WARN; // default
+        } else if (value.equals("deny")) {
+            return IllegalNativeAccess.DENY;
+        } else if (value.equals("allow")) {
+            return IllegalNativeAccess.ALLOW;
+        } else if (value.equals("warn")) {
+            return IllegalNativeAccess.WARN;
+        } else {
+            fail("Value specified to --illegal-access not recognized:"
+                    + " '" + value + "'");
+            return null;
+        }
+    }
+
     /**
      * Decodes the values of --add-reads, -add-exports, --add-opens or
      * --patch-modules options that are encoded in system properties.
diff --git a/src/java.base/share/classes/jdk/internal/reflect/Reflection.java b/src/java.base/share/classes/jdk/internal/reflect/Reflection.java
index f6fa499538834..349ff1af9b5ce 100644
--- a/src/java.base/share/classes/jdk/internal/reflect/Reflection.java
+++ b/src/java.base/share/classes/jdk/internal/reflect/Reflection.java
@@ -112,14 +112,16 @@ public static void ensureMemberAccess(Class<?> currentClass,
 
     @ForceInline
     public static void ensureNativeAccess(Class<?> currentClass, Class<?> owner, String methodName) {
-        // if there is no caller class, act as if the call came from unnamed module of system class loader
-        Module module = currentClass != null ?
-                currentClass.getModule() :
-                ClassLoader.getSystemClassLoader().getUnnamedModule();
-        class Holder {
-            static final JavaLangAccess JLA = SharedSecrets.getJavaLangAccess();
+        if (VM.isModuleSystemInited()) {
+            // if there is no caller class, act as if the call came from unnamed module of system class loader
+            Module module = currentClass != null ?
+                    currentClass.getModule() :
+                    ClassLoader.getSystemClassLoader().getUnnamedModule();
+            class Holder {
+                static final JavaLangAccess JLA = SharedSecrets.getJavaLangAccess();
+            }
+            Holder.JLA.ensureNativeAccess(module, owner, methodName, currentClass);
         }
-        Holder.JLA.ensureNativeAccess(module, owner, methodName, currentClass);
     }
 
     /**
diff --git a/src/java.base/share/classes/sun/launcher/resources/launcher.properties b/src/java.base/share/classes/sun/launcher/resources/launcher.properties
index 489b1395a22b1..b384ce7544e3f 100644
--- a/src/java.base/share/classes/sun/launcher/resources/launcher.properties
+++ b/src/java.base/share/classes/sun/launcher/resources/launcher.properties
@@ -65,6 +65,11 @@ java.launcher.opt.footer = \
 \    --enable-native-access <module name>[,<module name>...]\n\
 \                  allow code in modules to access code and data outside the Java runtime.\n\
 \                  <module name> can also be ALL-UNNAMED to indicate code on the class path.\n\
+\    --illegal-native-access=<value>\n\
+\                  allow or deny access to code and data outside the Java runtime\n\
+\                  by code in modules for which native access is not explicitly enabled.\n\
+\                  <value> is one of "deny", "warn" or "allow".\n\
+\                  This option will be removed in a future release.\n\
 \    --list-modules\n\
 \                  list observable modules and exit\n\
 \    -d <module name>\n\
diff --git a/src/java.base/share/man/java.1 b/src/java.base/share/man/java.1
index 990fdccf8d547..ee5167820ea65 100644
--- a/src/java.base/share/man/java.1
+++ b/src/java.base/share/man/java.1
@@ -552,15 +552,47 @@ of the release.
 Native access involves access to code or data outside the Java runtime.
 This is generally unsafe and, if done incorrectly, might crash the JVM
 or result in memory corruption.
-Methods that provide native access are restricted, and by default their
-use causes warnings.
-This option allows code in the specified modules to use restricted
-methods without warnings.
-\f[I]module\f[R] can be \f[V]ALL-UNNAMED\f[R] to indicate code on the
-class path.
-When this option is present, any use of restricted methods by code
-outside the specified modules causes an
+Native access can occur as a result of calling a method that is either
+\f[B]restricted\f[R] [https://openjdk.org/jeps/454#Safety], or
+\f[V]native\f[R].
+This option allows code in the specified modules to perform native
+access.
+Native access occurring in a module that has not been explicitly enabled
+is deemed \f[I]illegal\f[R].
+.RS
+.PP
+\f[I]module\f[R] can be a module name, or \f[V]ALL-UNNAMED\f[R] to
+indicate code on the class path.
+.RE
+.TP
+-\f[V]--illegal-native-access=\f[R]\f[I]parameter\f[R]
+This option specifies a mode for how illegal native access is handled:
+.RS
+.RS
+.PP
+\f[B]Note:\f[R] This option will be removed in a future release.
+.RE
+.IP \[bu] 2
+\f[V]allow\f[R]: This mode allows illegal native access in all modules,
+without any warings.
+.IP \[bu] 2
+\f[V]warn\f[R]: This mode is identical to \f[V]allow\f[R] except that a
+warning message is issued for the first illegal native access found in a
+module.
+This mode is the default for the current JDK but will change in a future
+release.
+.IP \[bu] 2
+\f[V]deny\f[R]: This mode disables all illegal native access except for
+those modules enabled by the \f[V]--enable-native-access\f[R]
+command-line option.
+That is, any illegal native access causes an
 \f[V]IllegalCallerException\f[R].
+This mode will become the default in a future release.
+.PP
+To verify that your application is ready for a future version of the
+JDK, run it with \f[V]--illegal-native-access=deny\f[R] along with any
+necessary \f[V]--enable-native-access\f[R] options.
+.RE
 .TP
 \f[V]--finalization=\f[R]\f[I]value\f[R]
 Controls whether the JVM performs finalization of objects.
diff --git a/src/java.desktop/macosx/classes/com/apple/eio/FileManager.java b/src/java.desktop/macosx/classes/com/apple/eio/FileManager.java
index 8967a99f15e39..1a77ddd760049 100644
--- a/src/java.desktop/macosx/classes/com/apple/eio/FileManager.java
+++ b/src/java.desktop/macosx/classes/com/apple/eio/FileManager.java
@@ -58,7 +58,7 @@ public class FileManager {
         loadOSXLibrary();
     }
 
-    @SuppressWarnings("removal")
+    @SuppressWarnings({"removal", "restricted"})
     private static void loadOSXLibrary() {
         java.security.AccessController.doPrivileged(
             new java.security.PrivilegedAction<Void>() {
diff --git a/src/java.desktop/macosx/classes/com/apple/laf/AquaFileView.java b/src/java.desktop/macosx/classes/com/apple/laf/AquaFileView.java
index 4177e32f63d81..34e5b7c9b7c87 100644
--- a/src/java.desktop/macosx/classes/com/apple/laf/AquaFileView.java
+++ b/src/java.desktop/macosx/classes/com/apple/laf/AquaFileView.java
@@ -65,7 +65,7 @@ class AquaFileView extends FileView {
         loadOSXUILibrary();
     }
 
-    @SuppressWarnings("removal")
+    @SuppressWarnings({"removal", "restricted"})
     private static void loadOSXUILibrary() {
         java.security.AccessController.doPrivileged(
             new java.security.PrivilegedAction<Void>() {
diff --git a/src/java.desktop/macosx/classes/com/apple/laf/AquaLookAndFeel.java b/src/java.desktop/macosx/classes/com/apple/laf/AquaLookAndFeel.java
index d68cd1448eaa9..8192fde22af64 100644
--- a/src/java.desktop/macosx/classes/com/apple/laf/AquaLookAndFeel.java
+++ b/src/java.desktop/macosx/classes/com/apple/laf/AquaLookAndFeel.java
@@ -152,7 +152,7 @@ public boolean isSupportedLookAndFeel() {
      * @see #uninitialize
      * @see UIManager#setLookAndFeel
      */
-    @SuppressWarnings("removal")
+    @SuppressWarnings({"removal", "restricted"})
     public void initialize() {
         java.security.AccessController.doPrivileged(new PrivilegedAction<Void>() {
                 public Void run() {
diff --git a/src/java.desktop/macosx/classes/com/apple/laf/AquaMenuBarUI.java b/src/java.desktop/macosx/classes/com/apple/laf/AquaMenuBarUI.java
index 5d6b15671775d..f252e310750c7 100644
--- a/src/java.desktop/macosx/classes/com/apple/laf/AquaMenuBarUI.java
+++ b/src/java.desktop/macosx/classes/com/apple/laf/AquaMenuBarUI.java
@@ -41,7 +41,7 @@
 import sun.security.action.GetBooleanAction;
 
 // MenuBar implementation for Mac L&F
-@SuppressWarnings("removal")
+@SuppressWarnings({"removal", "restricted"})
 public class AquaMenuBarUI extends BasicMenuBarUI implements ScreenMenuBarProvider {
 
     static {
diff --git a/src/java.desktop/macosx/classes/com/apple/laf/AquaNativeResources.java b/src/java.desktop/macosx/classes/com/apple/laf/AquaNativeResources.java
index 3e31eca43d0e3..a8abf1a6cd8d0 100644
--- a/src/java.desktop/macosx/classes/com/apple/laf/AquaNativeResources.java
+++ b/src/java.desktop/macosx/classes/com/apple/laf/AquaNativeResources.java
@@ -32,7 +32,7 @@
 
 import com.apple.laf.AquaUtils.RecyclableSingleton;
 
-@SuppressWarnings("removal")
+@SuppressWarnings({"removal", "restricted"})
 public class AquaNativeResources {
     static {
         java.security.AccessController.doPrivileged(
diff --git a/src/java.desktop/macosx/classes/com/apple/laf/ScreenMenu.java b/src/java.desktop/macosx/classes/com/apple/laf/ScreenMenu.java
index b3ec61b5c7913..d8d0928c55fcf 100644
--- a/src/java.desktop/macosx/classes/com/apple/laf/ScreenMenu.java
+++ b/src/java.desktop/macosx/classes/com/apple/laf/ScreenMenu.java
@@ -45,7 +45,7 @@ final class ScreenMenu extends Menu
         loadAWTLibrary();
     }
 
-    @SuppressWarnings("removal")
+    @SuppressWarnings({"removal", "restricted"})
     private static void loadAWTLibrary() {
         java.security.AccessController.doPrivileged(
             new java.security.PrivilegedAction<Void>() {
diff --git a/src/java.desktop/macosx/classes/sun/awt/PlatformGraphicsInfo.java b/src/java.desktop/macosx/classes/sun/awt/PlatformGraphicsInfo.java
index 796dee199ad01..6af002fc04f70 100644
--- a/src/java.desktop/macosx/classes/sun/awt/PlatformGraphicsInfo.java
+++ b/src/java.desktop/macosx/classes/sun/awt/PlatformGraphicsInfo.java
@@ -30,7 +30,7 @@
 import java.security.AccessController;
 import java.security.PrivilegedAction;
 
-@SuppressWarnings("removal")
+@SuppressWarnings({"removal", "restricted"})
 public class PlatformGraphicsInfo {
 
     static {
diff --git a/src/java.desktop/macosx/classes/sun/lwawt/macosx/CAccessibility.java b/src/java.desktop/macosx/classes/sun/lwawt/macosx/CAccessibility.java
index d4526324c585a..655294299c882 100644
--- a/src/java.desktop/macosx/classes/sun/lwawt/macosx/CAccessibility.java
+++ b/src/java.desktop/macosx/classes/sun/lwawt/macosx/CAccessibility.java
@@ -77,7 +77,7 @@ class CAccessibility implements PropertyChangeListener {
         loadAWTLibrary();
     }
 
-    @SuppressWarnings("removal")
+    @SuppressWarnings({"removal", "restricted"})
     private static void loadAWTLibrary() {
             // Need to load the native library for this code.
         java.security.AccessController.doPrivileged(
diff --git a/src/java.desktop/macosx/classes/sun/lwawt/macosx/LWCToolkit.java b/src/java.desktop/macosx/classes/sun/lwawt/macosx/LWCToolkit.java
index d430825bb8565..9a9be0e65c7e4 100644
--- a/src/java.desktop/macosx/classes/sun/lwawt/macosx/LWCToolkit.java
+++ b/src/java.desktop/macosx/classes/sun/lwawt/macosx/LWCToolkit.java
@@ -146,7 +146,7 @@ public final class LWCToolkit extends LWToolkit {
     static {
         System.err.flush();
 
-        @SuppressWarnings("removal")
+        @SuppressWarnings({"removal", "restricted"})
         ResourceBundle platformResources = java.security.AccessController.doPrivileged(
                 new java.security.PrivilegedAction<ResourceBundle>() {
             @Override
diff --git a/src/java.desktop/share/classes/com/sun/imageio/plugins/jpeg/JPEGImageReader.java b/src/java.desktop/share/classes/com/sun/imageio/plugins/jpeg/JPEGImageReader.java
index e2b3b3537ac06..c28759058c086 100644
--- a/src/java.desktop/share/classes/com/sun/imageio/plugins/jpeg/JPEGImageReader.java
+++ b/src/java.desktop/share/classes/com/sun/imageio/plugins/jpeg/JPEGImageReader.java
@@ -90,7 +90,7 @@ public class JPEGImageReader extends ImageReader {
         initStatic();
     }
 
-    @SuppressWarnings("removal")
+    @SuppressWarnings({"removal", "restricted"})
     private static void initStatic() {
         java.security.AccessController.doPrivileged(
             new java.security.PrivilegedAction<Void>() {
diff --git a/src/java.desktop/share/classes/com/sun/imageio/plugins/jpeg/JPEGImageWriter.java b/src/java.desktop/share/classes/com/sun/imageio/plugins/jpeg/JPEGImageWriter.java
index 0d41c4d2961ee..39189130be356 100644
--- a/src/java.desktop/share/classes/com/sun/imageio/plugins/jpeg/JPEGImageWriter.java
+++ b/src/java.desktop/share/classes/com/sun/imageio/plugins/jpeg/JPEGImageWriter.java
@@ -175,7 +175,7 @@ public class JPEGImageWriter extends ImageWriter {
         initStatic();
     }
 
-    @SuppressWarnings("removal")
+    @SuppressWarnings({"removal", "restricted"})
     private static void initStatic() {
         java.security.AccessController.doPrivileged(
             new java.security.PrivilegedAction<Void>() {
diff --git a/src/java.desktop/share/classes/com/sun/media/sound/Platform.java b/src/java.desktop/share/classes/com/sun/media/sound/Platform.java
index c4387a2109cc9..727718c6ca90f 100644
--- a/src/java.desktop/share/classes/com/sun/media/sound/Platform.java
+++ b/src/java.desktop/share/classes/com/sun/media/sound/Platform.java
@@ -74,7 +74,7 @@ static boolean isBigEndian() {
     /**
      * Load the native library or libraries.
      */
-    @SuppressWarnings("removal")
+    @SuppressWarnings({"removal", "restricted"})
     private static void loadLibraries() {
         // load the native library
         isNativeLibLoaded = true;
diff --git a/src/java.desktop/share/classes/java/awt/SplashScreen.java b/src/java.desktop/share/classes/java/awt/SplashScreen.java
index a7939f4a385c5..78ec4ed7aa0e9 100644
--- a/src/java.desktop/share/classes/java/awt/SplashScreen.java
+++ b/src/java.desktop/share/classes/java/awt/SplashScreen.java
@@ -121,7 +121,7 @@ public final class SplashScreen {
      * @return the {@link SplashScreen} instance, or {@code null} if there is
      *         none or it has already been closed
      */
-    @SuppressWarnings("removal")
+    @SuppressWarnings({"removal", "restricted"})
     public static  SplashScreen getSplashScreen() {
         synchronized (SplashScreen.class) {
             if (GraphicsEnvironment.isHeadless()) {
diff --git a/src/java.desktop/share/classes/java/awt/Toolkit.java b/src/java.desktop/share/classes/java/awt/Toolkit.java
index 54053fdc2e179..cf6260e9bda21 100644
--- a/src/java.desktop/share/classes/java/awt/Toolkit.java
+++ b/src/java.desktop/share/classes/java/awt/Toolkit.java
@@ -1375,7 +1375,7 @@ private static void setPlatformResources(ResourceBundle bundle) {
      * directly.  -hung
      */
     private static boolean loaded = false;
-    @SuppressWarnings("removal")
+    @SuppressWarnings({"removal", "restricted"})
     static void loadLibraries() {
         if (!loaded) {
             java.security.AccessController.doPrivileged(
diff --git a/src/java.desktop/share/classes/java/awt/event/NativeLibLoader.java b/src/java.desktop/share/classes/java/awt/event/NativeLibLoader.java
index 04414f4fa2f3c..27a2c4397476b 100644
--- a/src/java.desktop/share/classes/java/awt/event/NativeLibLoader.java
+++ b/src/java.desktop/share/classes/java/awt/event/NativeLibLoader.java
@@ -52,7 +52,7 @@ class NativeLibLoader {
      * For now, we know it's done by the implementation, and we assume
      * that the name of the library is "awt".  -br.
      */
-    @SuppressWarnings("removal")
+    @SuppressWarnings({"removal", "restricted"})
     static void loadLibraries() {
         java.security.AccessController.doPrivileged(
             new java.security.PrivilegedAction<Void>() {
diff --git a/src/java.desktop/share/classes/java/awt/image/ColorModel.java b/src/java.desktop/share/classes/java/awt/image/ColorModel.java
index 03ee479951d82..a0aa8fddc10f8 100644
--- a/src/java.desktop/share/classes/java/awt/image/ColorModel.java
+++ b/src/java.desktop/share/classes/java/awt/image/ColorModel.java
@@ -202,7 +202,7 @@ public abstract class ColorModel implements Transparency{
      * that the name of the library is "awt".  -br.
      */
     private static boolean loaded = false;
-    @SuppressWarnings("removal")
+    @SuppressWarnings({"removal", "restricted"})
     static void loadLibraries() {
         if (!loaded) {
             java.security.AccessController.doPrivileged(
diff --git a/src/java.desktop/share/classes/sun/awt/NativeLibLoader.java b/src/java.desktop/share/classes/sun/awt/NativeLibLoader.java
index ef524f0b39aea..868ebdf3699bd 100644
--- a/src/java.desktop/share/classes/sun/awt/NativeLibLoader.java
+++ b/src/java.desktop/share/classes/sun/awt/NativeLibLoader.java
@@ -52,7 +52,7 @@ class NativeLibLoader {
      * For now, we know it's done by the implementation, and we assume
      * that the name of the library is "awt".  -br.
      */
-    @SuppressWarnings("removal")
+    @SuppressWarnings({"removal", "restricted"})
     static void loadLibraries() {
         java.security.AccessController.doPrivileged(
             new java.security.PrivilegedAction<Void>() {
diff --git a/src/java.desktop/share/classes/sun/awt/image/ImagingLib.java b/src/java.desktop/share/classes/sun/awt/image/ImagingLib.java
index ed09560fc9904..a98e6fc81fbad 100644
--- a/src/java.desktop/share/classes/sun/awt/image/ImagingLib.java
+++ b/src/java.desktop/share/classes/sun/awt/image/ImagingLib.java
@@ -51,7 +51,7 @@
  * (in which case our java code will be executed) or may throw
  * an exception.
  */
-@SuppressWarnings("removal")
+@SuppressWarnings({"removal", "restricted"})
 public class ImagingLib {
 
     static boolean useLib = true;
diff --git a/src/java.desktop/share/classes/sun/awt/image/JPEGImageDecoder.java b/src/java.desktop/share/classes/sun/awt/image/JPEGImageDecoder.java
index eb28029589770..b976a716deda8 100644
--- a/src/java.desktop/share/classes/sun/awt/image/JPEGImageDecoder.java
+++ b/src/java.desktop/share/classes/sun/awt/image/JPEGImageDecoder.java
@@ -42,7 +42,7 @@
  *
  * @author Jim Graham
  */
-@SuppressWarnings("removal")
+@SuppressWarnings({"removal", "restricted"})
 public class JPEGImageDecoder extends ImageDecoder {
     private static ColorModel RGBcolormodel;
     private static ColorModel ARGBcolormodel;
diff --git a/src/java.desktop/share/classes/sun/awt/image/NativeLibLoader.java b/src/java.desktop/share/classes/sun/awt/image/NativeLibLoader.java
index 3cf7f1ba5ef0c..e1fe5658e6377 100644
--- a/src/java.desktop/share/classes/sun/awt/image/NativeLibLoader.java
+++ b/src/java.desktop/share/classes/sun/awt/image/NativeLibLoader.java
@@ -52,7 +52,7 @@ class NativeLibLoader {
      * For now, we know it's done by the implementation, and we assume
      * that the name of the library is "awt".  -br.
      */
-    @SuppressWarnings("removal")
+    @SuppressWarnings({"removal", "restricted"})
     static void loadLibraries() {
         java.security.AccessController.doPrivileged(
             new java.security.PrivilegedAction<Void>() {
diff --git a/src/java.desktop/share/classes/sun/font/FontManagerNativeLibrary.java b/src/java.desktop/share/classes/sun/font/FontManagerNativeLibrary.java
index ede2d0348b7f6..9439f6ed8574a 100644
--- a/src/java.desktop/share/classes/sun/font/FontManagerNativeLibrary.java
+++ b/src/java.desktop/share/classes/sun/font/FontManagerNativeLibrary.java
@@ -27,7 +27,7 @@
 
 import sun.awt.OSInfo;
 
-@SuppressWarnings("removal")
+@SuppressWarnings({"removal", "restricted"})
 public class FontManagerNativeLibrary {
     static {
         java.security.AccessController.doPrivileged(
diff --git a/src/java.desktop/share/classes/sun/java2d/Disposer.java b/src/java.desktop/share/classes/sun/java2d/Disposer.java
index 6b152dda3b028..5a80a61604544 100644
--- a/src/java.desktop/share/classes/sun/java2d/Disposer.java
+++ b/src/java.desktop/share/classes/sun/java2d/Disposer.java
@@ -50,7 +50,7 @@
  *
  * @see DisposerRecord
  */
-@SuppressWarnings("removal")
+@SuppressWarnings({"removal", "restricted"})
 public class Disposer implements Runnable {
     private static final ReferenceQueue<Object> queue = new ReferenceQueue<>();
     private static final Hashtable<java.lang.ref.Reference<Object>, DisposerRecord> records =
diff --git a/src/java.desktop/share/classes/sun/java2d/cmm/lcms/LCMS.java b/src/java.desktop/share/classes/sun/java2d/cmm/lcms/LCMS.java
index 9da28ab1548a9..2fe86b3500cf9 100644
--- a/src/java.desktop/share/classes/sun/java2d/cmm/lcms/LCMS.java
+++ b/src/java.desktop/share/classes/sun/java2d/cmm/lcms/LCMS.java
@@ -143,7 +143,7 @@ private LCMS() {}
 
     private static LCMS theLcms = null;
 
-    @SuppressWarnings("removal")
+    @SuppressWarnings({"removal", "restricted"})
     static synchronized PCMM getModule() {
         if (theLcms != null) {
             return theLcms;
diff --git a/src/java.desktop/unix/classes/sun/awt/X11GraphicsEnvironment.java b/src/java.desktop/unix/classes/sun/awt/X11GraphicsEnvironment.java
index 93f5eaf6656c0..42b20f6684398 100644
--- a/src/java.desktop/unix/classes/sun/awt/X11GraphicsEnvironment.java
+++ b/src/java.desktop/unix/classes/sun/awt/X11GraphicsEnvironment.java
@@ -59,7 +59,7 @@ public final class X11GraphicsEnvironment extends SunGraphicsEnvironment {
         initStatic();
     }
 
-    @SuppressWarnings("removal")
+    @SuppressWarnings({"removal", "restricted"})
     private static void initStatic() {
         java.security.AccessController.doPrivileged(
                           new java.security.PrivilegedAction<Object>() {
diff --git a/src/java.desktop/unix/classes/sun/print/CUPSPrinter.java b/src/java.desktop/unix/classes/sun/print/CUPSPrinter.java
index 6c75949731d05..bca192e4570af 100644
--- a/src/java.desktop/unix/classes/sun/print/CUPSPrinter.java
+++ b/src/java.desktop/unix/classes/sun/print/CUPSPrinter.java
@@ -85,7 +85,7 @@ public class CUPSPrinter  {
         initStatic();
     }
 
-    @SuppressWarnings("removal")
+    @SuppressWarnings({"removal", "restricted"})
     private static void initStatic() {
         // load awt library to access native code
         java.security.AccessController.doPrivileged(
diff --git a/src/java.desktop/windows/classes/sun/awt/PlatformGraphicsInfo.java b/src/java.desktop/windows/classes/sun/awt/PlatformGraphicsInfo.java
index 4644a2e5f46ac..6d14a72400c0c 100644
--- a/src/java.desktop/windows/classes/sun/awt/PlatformGraphicsInfo.java
+++ b/src/java.desktop/windows/classes/sun/awt/PlatformGraphicsInfo.java
@@ -39,7 +39,7 @@ public class PlatformGraphicsInfo {
         hasDisplays = hasDisplays0();
     }
 
-    @SuppressWarnings("removal")
+    @SuppressWarnings({"removal", "restricted"})
     private static void loadAWTLibrary() {
         java.security.AccessController.doPrivileged(
             new java.security.PrivilegedAction<Void>() {
diff --git a/src/java.desktop/windows/classes/sun/awt/windows/WToolkit.java b/src/java.desktop/windows/classes/sun/awt/windows/WToolkit.java
index eff6f930a5be7..ad643ccbd3dfd 100644
--- a/src/java.desktop/windows/classes/sun/awt/windows/WToolkit.java
+++ b/src/java.desktop/windows/classes/sun/awt/windows/WToolkit.java
@@ -168,7 +168,7 @@ public final class WToolkit extends SunToolkit implements Runnable {
      */
     private static native void initIDs();
     private static boolean loaded = false;
-    @SuppressWarnings("removal")
+    @SuppressWarnings({"removal", "restricted"})
     public static void loadLibraries() {
         if (!loaded) {
             java.security.AccessController.doPrivileged(
diff --git a/src/java.desktop/windows/classes/sun/print/PrintServiceLookupProvider.java b/src/java.desktop/windows/classes/sun/print/PrintServiceLookupProvider.java
index 28055c1afece6..9079e7c2bfeff 100644
--- a/src/java.desktop/windows/classes/sun/print/PrintServiceLookupProvider.java
+++ b/src/java.desktop/windows/classes/sun/print/PrintServiceLookupProvider.java
@@ -54,7 +54,7 @@ public class PrintServiceLookupProvider extends PrintServiceLookup {
         loadAWTLibrary();
     }
 
-    @SuppressWarnings("removal")
+    @SuppressWarnings({"removal", "restricted"})
     private static void loadAWTLibrary() {
         java.security.AccessController.doPrivileged(
             new java.security.PrivilegedAction<Void>() {
diff --git a/src/java.instrument/share/classes/sun/instrument/InstrumentationImpl.java b/src/java.instrument/share/classes/sun/instrument/InstrumentationImpl.java
index bd610c3648069..3aeddd1c90d9c 100644
--- a/src/java.instrument/share/classes/sun/instrument/InstrumentationImpl.java
+++ b/src/java.instrument/share/classes/sun/instrument/InstrumentationImpl.java
@@ -63,6 +63,7 @@
  * Keeps a pointer to the native data structure in a scalar field to allow native
  * processing behind native methods.
  */
+@SuppressWarnings("restricted")
 public class InstrumentationImpl implements Instrumentation {
     private static final String TRACE_USAGE_PROP_NAME = "jdk.instrument.traceUsage";
     private static final boolean TRACE_USAGE;
diff --git a/src/java.management/share/classes/java/lang/management/ManagementFactory.java b/src/java.management/share/classes/java/lang/management/ManagementFactory.java
index 8e290f373b72b..b1ac1d0391e54 100644
--- a/src/java.management/share/classes/java/lang/management/ManagementFactory.java
+++ b/src/java.management/share/classes/java/lang/management/ManagementFactory.java
@@ -1020,7 +1020,7 @@ static PlatformComponent<?> findSingleton(Class<?> mbeanIntf)
         loadNativeLib();
     }
 
-    @SuppressWarnings("removal")
+    @SuppressWarnings({"removal", "restricted"})
     private static void loadNativeLib() {
         AccessController.doPrivileged((PrivilegedAction<Void>) () -> {
             System.loadLibrary("management");
diff --git a/src/java.prefs/macosx/classes/java/util/prefs/MacOSXPreferencesFile.java b/src/java.prefs/macosx/classes/java/util/prefs/MacOSXPreferencesFile.java
index 61ee92cf6013a..c222bc3d81f02 100644
--- a/src/java.prefs/macosx/classes/java/util/prefs/MacOSXPreferencesFile.java
+++ b/src/java.prefs/macosx/classes/java/util/prefs/MacOSXPreferencesFile.java
@@ -82,7 +82,7 @@ class MacOSXPreferencesFile {
         loadPrefsLib();
     }
 
-    @SuppressWarnings("removal")
+    @SuppressWarnings({"removal", "restricted"})
     private static void loadPrefsLib() {
         java.security.AccessController.doPrivileged(
             new java.security.PrivilegedAction<Void>() {
diff --git a/src/java.prefs/unix/classes/java/util/prefs/FileSystemPreferences.java b/src/java.prefs/unix/classes/java/util/prefs/FileSystemPreferences.java
index 2a8947146666c..ed76ce57f9472 100644
--- a/src/java.prefs/unix/classes/java/util/prefs/FileSystemPreferences.java
+++ b/src/java.prefs/unix/classes/java/util/prefs/FileSystemPreferences.java
@@ -53,7 +53,7 @@ class FileSystemPreferences extends AbstractPreferences {
         loadPrefsLib();
     }
 
-    @SuppressWarnings("removal")
+    @SuppressWarnings({"removal", "restricted"})
     private static void loadPrefsLib() {
         PrivilegedAction<Void> load = () -> {
             System.loadLibrary("prefs");
diff --git a/src/java.prefs/windows/classes/java/util/prefs/WindowsPreferences.java b/src/java.prefs/windows/classes/java/util/prefs/WindowsPreferences.java
index df1f29c9c1353..885535755a2aa 100644
--- a/src/java.prefs/windows/classes/java/util/prefs/WindowsPreferences.java
+++ b/src/java.prefs/windows/classes/java/util/prefs/WindowsPreferences.java
@@ -50,7 +50,7 @@ class WindowsPreferences extends AbstractPreferences {
         loadPrefsLib();
     }
 
-    @SuppressWarnings("removal")
+    @SuppressWarnings({"removal", "restricted"})
     private static void loadPrefsLib() {
         PrivilegedAction<Void> load = () -> {
             System.loadLibrary("prefs");
diff --git a/src/java.rmi/share/classes/sun/rmi/transport/GC.java b/src/java.rmi/share/classes/sun/rmi/transport/GC.java
index f15a46beacaca..4bd50511dd45a 100644
--- a/src/java.rmi/share/classes/sun/rmi/transport/GC.java
+++ b/src/java.rmi/share/classes/sun/rmi/transport/GC.java
@@ -39,7 +39,7 @@
  * @since    1.2
  */
 
-@SuppressWarnings("removal")
+@SuppressWarnings({"removal", "restricted"})
 class GC {
 
     private GC() { }            /* To prevent instantiation */
diff --git a/src/java.security.jgss/share/classes/sun/security/jgss/wrapper/SunNativeProvider.java b/src/java.security.jgss/share/classes/sun/security/jgss/wrapper/SunNativeProvider.java
index 2099eaf779e0b..11545a25a6351 100644
--- a/src/java.security.jgss/share/classes/sun/security/jgss/wrapper/SunNativeProvider.java
+++ b/src/java.security.jgss/share/classes/sun/security/jgss/wrapper/SunNativeProvider.java
@@ -68,7 +68,7 @@ static void debug(String message) {
         System.err.println(NAME + ": " + message);
     }
 
-    @SuppressWarnings("removal")
+    @SuppressWarnings({"removal", "restricted"})
     private static final HashMap<String, String> MECH_MAP =
             AccessController.doPrivileged(
                 new PrivilegedAction<>() {
diff --git a/src/java.security.jgss/share/classes/sun/security/krb5/Credentials.java b/src/java.security.jgss/share/classes/sun/security/krb5/Credentials.java
index 9ec0b7b7c12fa..d31418ac35104 100644
--- a/src/java.security.jgss/share/classes/sun/security/krb5/Credentials.java
+++ b/src/java.security.jgss/share/classes/sun/security/krb5/Credentials.java
@@ -524,7 +524,7 @@ public static void printDebug(Credentials c) {
     }
 
 
-    @SuppressWarnings("removal")
+    @SuppressWarnings({"removal", "restricted"})
     static void ensureLoaded() {
         java.security.AccessController.doPrivileged(
                 new java.security.PrivilegedAction<Void> () {
diff --git a/src/java.security.jgss/share/classes/sun/security/krb5/SCDynamicStoreConfig.java b/src/java.security.jgss/share/classes/sun/security/krb5/SCDynamicStoreConfig.java
index 41c93afcf4074..1d917c226c600 100644
--- a/src/java.security.jgss/share/classes/sun/security/krb5/SCDynamicStoreConfig.java
+++ b/src/java.security.jgss/share/classes/sun/security/krb5/SCDynamicStoreConfig.java
@@ -45,7 +45,7 @@ public class SCDynamicStoreConfig {
     private static native List<String> getKerberosConfig();
 
     static {
-        @SuppressWarnings("removal")
+        @SuppressWarnings({"removal", "restricted"})
         boolean isMac = java.security.AccessController.doPrivileged(
             new java.security.PrivilegedAction<Boolean>() {
                 public Boolean run() {
diff --git a/src/java.smartcardio/unix/classes/sun/security/smartcardio/PlatformPCSC.java b/src/java.smartcardio/unix/classes/sun/security/smartcardio/PlatformPCSC.java
index 10a27e7a1b2eb..93d213bc1495e 100644
--- a/src/java.smartcardio/unix/classes/sun/security/smartcardio/PlatformPCSC.java
+++ b/src/java.smartcardio/unix/classes/sun/security/smartcardio/PlatformPCSC.java
@@ -61,7 +61,7 @@ class PlatformPCSC {
         // empty
     }
 
-    @SuppressWarnings("removal")
+    @SuppressWarnings({"removal", "restricted"})
     static final Throwable initException
             = AccessController.doPrivileged(new PrivilegedAction<Throwable>() {
         public Throwable run() {
diff --git a/src/java.smartcardio/windows/classes/sun/security/smartcardio/PlatformPCSC.java b/src/java.smartcardio/windows/classes/sun/security/smartcardio/PlatformPCSC.java
index 8541b67f61312..01cddcf8aa376 100644
--- a/src/java.smartcardio/windows/classes/sun/security/smartcardio/PlatformPCSC.java
+++ b/src/java.smartcardio/windows/classes/sun/security/smartcardio/PlatformPCSC.java
@@ -41,7 +41,7 @@ class PlatformPCSC {
         initException = loadLibrary();
     }
 
-    @SuppressWarnings("removal")
+    @SuppressWarnings({"removal", "restricted"})
     private static Throwable loadLibrary() {
         try {
             AccessController.doPrivileged(new PrivilegedAction<Void>() {
diff --git a/src/jdk.accessibility/windows/classes/com/sun/java/accessibility/internal/AccessBridge.java b/src/jdk.accessibility/windows/classes/com/sun/java/accessibility/internal/AccessBridge.java
index 8488fb526ee09..b5a5943d2d907 100644
--- a/src/jdk.accessibility/windows/classes/com/sun/java/accessibility/internal/AccessBridge.java
+++ b/src/jdk.accessibility/windows/classes/com/sun/java/accessibility/internal/AccessBridge.java
@@ -160,7 +160,7 @@ public final class AccessBridge {
         initStatic();
     }
 
-    @SuppressWarnings("removal")
+    @SuppressWarnings({"removal", "restricted"})
     private static void initStatic() {
         // Load the appropriate DLLs
         boolean is32on64 = false;
diff --git a/src/jdk.attach/aix/classes/sun/tools/attach/VirtualMachineImpl.java b/src/jdk.attach/aix/classes/sun/tools/attach/VirtualMachineImpl.java
index d0a6dac40c86f..9f9f96a9416df 100644
--- a/src/jdk.attach/aix/classes/sun/tools/attach/VirtualMachineImpl.java
+++ b/src/jdk.attach/aix/classes/sun/tools/attach/VirtualMachineImpl.java
@@ -38,6 +38,7 @@
 /*
  * Aix implementation of HotSpotVirtualMachine
  */
+@SuppressWarnings("restricted")
 public class VirtualMachineImpl extends HotSpotVirtualMachine {
     // "/tmp" is used as a global well-known location for the files
     // .java_pid<pid>. and .attach_pid<pid>. It is important that this
diff --git a/src/jdk.attach/linux/classes/sun/tools/attach/VirtualMachineImpl.java b/src/jdk.attach/linux/classes/sun/tools/attach/VirtualMachineImpl.java
index 81d4fd259ed00..4eb29482e29ec 100644
--- a/src/jdk.attach/linux/classes/sun/tools/attach/VirtualMachineImpl.java
+++ b/src/jdk.attach/linux/classes/sun/tools/attach/VirtualMachineImpl.java
@@ -40,6 +40,7 @@
 /*
  * Linux implementation of HotSpotVirtualMachine
  */
+@SuppressWarnings("restricted")
 public class VirtualMachineImpl extends HotSpotVirtualMachine {
     // "/tmp" is used as a global well-known location for the files
     // .java_pid<pid>. and .attach_pid<pid>. It is important that this
diff --git a/src/jdk.attach/macosx/classes/sun/tools/attach/VirtualMachineImpl.java b/src/jdk.attach/macosx/classes/sun/tools/attach/VirtualMachineImpl.java
index 891a0561a8abd..19104d49014ac 100644
--- a/src/jdk.attach/macosx/classes/sun/tools/attach/VirtualMachineImpl.java
+++ b/src/jdk.attach/macosx/classes/sun/tools/attach/VirtualMachineImpl.java
@@ -37,6 +37,7 @@
 /*
  * Bsd implementation of HotSpotVirtualMachine
  */
+@SuppressWarnings("restricted")
 public class VirtualMachineImpl extends HotSpotVirtualMachine {
     // "tmpdir" is used as a global well-known location for the files
     // .java_pid<pid>. and .attach_pid<pid>. It is important that this
diff --git a/src/jdk.attach/windows/classes/sun/tools/attach/AttachProviderImpl.java b/src/jdk.attach/windows/classes/sun/tools/attach/AttachProviderImpl.java
index cd40cdc8266c6..503d9592370ab 100644
--- a/src/jdk.attach/windows/classes/sun/tools/attach/AttachProviderImpl.java
+++ b/src/jdk.attach/windows/classes/sun/tools/attach/AttachProviderImpl.java
@@ -34,6 +34,7 @@
 import java.net.InetAddress;
 import java.net.UnknownHostException;
 
+@SuppressWarnings("restricted")
 public class AttachProviderImpl extends HotSpotAttachProvider {
 
     public AttachProviderImpl() {
diff --git a/src/jdk.attach/windows/classes/sun/tools/attach/VirtualMachineImpl.java b/src/jdk.attach/windows/classes/sun/tools/attach/VirtualMachineImpl.java
index 184d07137e289..9c30f5618d66e 100644
--- a/src/jdk.attach/windows/classes/sun/tools/attach/VirtualMachineImpl.java
+++ b/src/jdk.attach/windows/classes/sun/tools/attach/VirtualMachineImpl.java
@@ -35,6 +35,7 @@
 /*
  * Windows implementation of HotSpotVirtualMachine
  */
+@SuppressWarnings("restricted")
 public class VirtualMachineImpl extends HotSpotVirtualMachine {
 
     // the enqueue code stub (copied into each target VM)
diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
index 63303105587f9..29cf38eb1775d 100644
--- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
+++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
@@ -83,7 +83,7 @@ public class PKCS11 {
         // cannot use LoadLibraryAction because that would make the native
         // library available to the bootclassloader, but we run in the
         // extension classloader.
-        @SuppressWarnings("removal")
+        @SuppressWarnings({"removal", "restricted"})
         var dummy = AccessController.doPrivileged(new PrivilegedAction<Object>() {
             public Object run() {
                 System.loadLibrary(PKCS11_WRAPPER);
diff --git a/src/jdk.crypto.mscapi/windows/classes/sun/security/mscapi/SunMSCAPI.java b/src/jdk.crypto.mscapi/windows/classes/sun/security/mscapi/SunMSCAPI.java
index c66258628210c..e57fe331f2832 100644
--- a/src/jdk.crypto.mscapi/windows/classes/sun/security/mscapi/SunMSCAPI.java
+++ b/src/jdk.crypto.mscapi/windows/classes/sun/security/mscapi/SunMSCAPI.java
@@ -50,7 +50,7 @@ public final class SunMSCAPI extends Provider {
     private static final String INFO = "Sun's Microsoft Crypto API provider";
 
     static {
-        @SuppressWarnings("removal")
+        @SuppressWarnings({"removal", "restricted"})
         var dummy = AccessController.doPrivileged(new PrivilegedAction<Void>() {
             public Void run() {
                 System.loadLibrary("sunmscapi");
diff --git a/src/jdk.hotspot.agent/share/classes/sun/jvm/hotspot/debugger/bsd/BsdDebuggerLocal.java b/src/jdk.hotspot.agent/share/classes/sun/jvm/hotspot/debugger/bsd/BsdDebuggerLocal.java
index 163d253e36051..0ce2a4507ae74 100644
--- a/src/jdk.hotspot.agent/share/classes/sun/jvm/hotspot/debugger/bsd/BsdDebuggerLocal.java
+++ b/src/jdk.hotspot.agent/share/classes/sun/jvm/hotspot/debugger/bsd/BsdDebuggerLocal.java
@@ -62,6 +62,7 @@ can be fetched. The readJ(Type) routines here will throw a
     RuntimeException if they are called before the debugger is
     configured with the Java primitive type sizes. </P> */
 
+@SuppressWarnings("restricted")
 public class BsdDebuggerLocal extends DebuggerBase implements BsdDebugger {
     private boolean useGCC32ABI;
     private boolean attached;
diff --git a/src/jdk.hotspot.agent/share/classes/sun/jvm/hotspot/debugger/linux/LinuxDebuggerLocal.java b/src/jdk.hotspot.agent/share/classes/sun/jvm/hotspot/debugger/linux/LinuxDebuggerLocal.java
index 5a91c06e83ea4..5bab3d252d03a 100644
--- a/src/jdk.hotspot.agent/share/classes/sun/jvm/hotspot/debugger/linux/LinuxDebuggerLocal.java
+++ b/src/jdk.hotspot.agent/share/classes/sun/jvm/hotspot/debugger/linux/LinuxDebuggerLocal.java
@@ -67,6 +67,7 @@ can be fetched. The readJ(Type) routines here will throw a
     RuntimeException if they are called before the debugger is
     configured with the Java primitive type sizes. </P> */
 
+@SuppressWarnings("restricted")
 public class LinuxDebuggerLocal extends DebuggerBase implements LinuxDebugger {
     private boolean useGCC32ABI;
     private boolean attached;
diff --git a/src/jdk.hotspot.agent/share/classes/sun/jvm/hotspot/debugger/windbg/WindbgDebuggerLocal.java b/src/jdk.hotspot.agent/share/classes/sun/jvm/hotspot/debugger/windbg/WindbgDebuggerLocal.java
index fa00159f6a86c..f082b7e52c639 100644
--- a/src/jdk.hotspot.agent/share/classes/sun/jvm/hotspot/debugger/windbg/WindbgDebuggerLocal.java
+++ b/src/jdk.hotspot.agent/share/classes/sun/jvm/hotspot/debugger/windbg/WindbgDebuggerLocal.java
@@ -54,6 +54,7 @@ can be fetched. The readJ(Type) routines here will throw a
     RuntimeException if they are called before the debugger is
     configured with the Java primitive type sizes. </P> */
 
+@SuppressWarnings("restricted")
 public class WindbgDebuggerLocal extends DebuggerBase implements WindbgDebugger {
   private PageCache cache;
   private boolean   attached;
diff --git a/src/jdk.jdi/windows/classes/com/sun/tools/jdi/SharedMemoryTransportService.java b/src/jdk.jdi/windows/classes/com/sun/tools/jdi/SharedMemoryTransportService.java
index d16ee6e1dd546..ae3ccf7f14921 100644
--- a/src/jdk.jdi/windows/classes/com/sun/tools/jdi/SharedMemoryTransportService.java
+++ b/src/jdk.jdi/windows/classes/com/sun/tools/jdi/SharedMemoryTransportService.java
@@ -65,6 +65,7 @@ public String toString() {
         }
     }
 
+    @SuppressWarnings("restricted")
     SharedMemoryTransportService() {
         System.loadLibrary("dt_shmem");
         initialize();
diff --git a/src/jdk.jpackage/windows/classes/jdk/jpackage/internal/ExecutableRebrander.java b/src/jdk.jpackage/windows/classes/jdk/jpackage/internal/ExecutableRebrander.java
index 060c94b12cf8a..a297f507da84a 100644
--- a/src/jdk.jpackage/windows/classes/jdk/jpackage/internal/ExecutableRebrander.java
+++ b/src/jdk.jpackage/windows/classes/jdk/jpackage/internal/ExecutableRebrander.java
@@ -48,7 +48,7 @@
 import static jdk.jpackage.internal.StandardBundlerParam.VERSION;
 import static jdk.jpackage.internal.WindowsAppImageBuilder.ICON_ICO;
 
-
+@SuppressWarnings("restricted")
 final class ExecutableRebrander {
     private static final ResourceBundle I18N = ResourceBundle.getBundle(
             "jdk.jpackage.internal.resources.WinResources");
diff --git a/src/jdk.jpackage/windows/classes/jdk/jpackage/internal/WinExeBundler.java b/src/jdk.jpackage/windows/classes/jdk/jpackage/internal/WinExeBundler.java
index c8aae5922873a..fa81b4278b06a 100644
--- a/src/jdk.jpackage/windows/classes/jdk/jpackage/internal/WinExeBundler.java
+++ b/src/jdk.jpackage/windows/classes/jdk/jpackage/internal/WinExeBundler.java
@@ -31,6 +31,7 @@
 import java.text.MessageFormat;
 import java.util.Map;
 
+@SuppressWarnings("restricted")
 public class WinExeBundler extends AbstractBundler {
 
     static {
diff --git a/src/jdk.jpackage/windows/classes/jdk/jpackage/internal/WindowsRegistry.java b/src/jdk.jpackage/windows/classes/jdk/jpackage/internal/WindowsRegistry.java
index a62d9c3b68775..7c4b6092901b4 100644
--- a/src/jdk.jpackage/windows/classes/jdk/jpackage/internal/WindowsRegistry.java
+++ b/src/jdk.jpackage/windows/classes/jdk/jpackage/internal/WindowsRegistry.java
@@ -28,6 +28,7 @@
 import java.util.ArrayList;
 import java.util.List;
 
+@SuppressWarnings("restricted")
 final class WindowsRegistry {
 
     // Currently we only support HKEY_LOCAL_MACHINE. Native implementation will
diff --git a/src/jdk.management.agent/unix/classes/jdk/internal/agent/FileSystemImpl.java b/src/jdk.management.agent/unix/classes/jdk/internal/agent/FileSystemImpl.java
index 9582a97cb8f79..a11b580d443d8 100644
--- a/src/jdk.management.agent/unix/classes/jdk/internal/agent/FileSystemImpl.java
+++ b/src/jdk.management.agent/unix/classes/jdk/internal/agent/FileSystemImpl.java
@@ -31,7 +31,7 @@
 /*
  * Linux implementation of jdk.internal.agent.FileSystem
  */
-@SuppressWarnings("removal")
+@SuppressWarnings({"removal", "restricted"})
 public class FileSystemImpl extends FileSystem {
 
     public boolean supportsFileSecurity(File f) throws IOException {
diff --git a/src/jdk.management.agent/windows/classes/jdk/internal/agent/FileSystemImpl.java b/src/jdk.management.agent/windows/classes/jdk/internal/agent/FileSystemImpl.java
index f0fd31c0f9e52..5a913f9c0aa01 100644
--- a/src/jdk.management.agent/windows/classes/jdk/internal/agent/FileSystemImpl.java
+++ b/src/jdk.management.agent/windows/classes/jdk/internal/agent/FileSystemImpl.java
@@ -31,7 +31,7 @@
 /*
  * Windows implementation of sun.management.FileSystem
  */
-@SuppressWarnings("removal")
+@SuppressWarnings({"removal", "restricted"})
 public class FileSystemImpl extends FileSystem {
 
     public boolean supportsFileSecurity(File f) throws IOException {
diff --git a/src/jdk.management/share/classes/com/sun/management/internal/Flag.java b/src/jdk.management/share/classes/com/sun/management/internal/Flag.java
index 6fb2c80247dcc..bf83f40f722c1 100644
--- a/src/jdk.management/share/classes/com/sun/management/internal/Flag.java
+++ b/src/jdk.management/share/classes/com/sun/management/internal/Flag.java
@@ -36,7 +36,7 @@
  * corresponds to one VMOption.
  *
  */
-@SuppressWarnings("removal")
+@SuppressWarnings({"removal", "restricted"})
 class Flag {
     private String name;
     private Object value;
diff --git a/src/jdk.management/share/classes/com/sun/management/internal/PlatformMBeanProviderImpl.java b/src/jdk.management/share/classes/com/sun/management/internal/PlatformMBeanProviderImpl.java
index cddb9127d2e9b..cdc5998426d9a 100644
--- a/src/jdk.management/share/classes/com/sun/management/internal/PlatformMBeanProviderImpl.java
+++ b/src/jdk.management/share/classes/com/sun/management/internal/PlatformMBeanProviderImpl.java
@@ -44,7 +44,7 @@
 import sun.management.ManagementFactoryHelper;
 import sun.management.spi.PlatformMBeanProvider;
 
-@SuppressWarnings("removal")
+@SuppressWarnings({"removal", "restricted"})
 public final class PlatformMBeanProviderImpl extends PlatformMBeanProvider {
     static final String DIAGNOSTIC_COMMAND_MBEAN_NAME =
         "com.sun.management:type=DiagnosticCommand";
diff --git a/src/jdk.net/aix/classes/jdk/net/AIXSocketOptions.java b/src/jdk.net/aix/classes/jdk/net/AIXSocketOptions.java
index 9ace5aa33f2e0..086c346ff8f97 100644
--- a/src/jdk.net/aix/classes/jdk/net/AIXSocketOptions.java
+++ b/src/jdk.net/aix/classes/jdk/net/AIXSocketOptions.java
@@ -32,7 +32,7 @@
 import jdk.net.ExtendedSocketOptions.PlatformSocketOptions;
 import sun.nio.fs.UnixUserPrincipals;
 
-@SuppressWarnings("removal")
+@SuppressWarnings({"removal", "restricted"})
 class AIXSocketOptions extends PlatformSocketOptions {
 
     public AIXSocketOptions() {
diff --git a/src/jdk.net/linux/classes/jdk/net/LinuxSocketOptions.java b/src/jdk.net/linux/classes/jdk/net/LinuxSocketOptions.java
index 20241bc5f334d..8d3ceeebfa9a3 100644
--- a/src/jdk.net/linux/classes/jdk/net/LinuxSocketOptions.java
+++ b/src/jdk.net/linux/classes/jdk/net/LinuxSocketOptions.java
@@ -32,7 +32,7 @@
 import jdk.net.ExtendedSocketOptions.PlatformSocketOptions;
 import sun.nio.fs.UnixUserPrincipals;
 
-@SuppressWarnings("removal")
+@SuppressWarnings({"removal", "restricted"})
 class LinuxSocketOptions extends PlatformSocketOptions {
 
     public LinuxSocketOptions() {
diff --git a/src/jdk.net/macosx/classes/jdk/net/MacOSXSocketOptions.java b/src/jdk.net/macosx/classes/jdk/net/MacOSXSocketOptions.java
index 7ad4bc7650ae7..c2912e8b80808 100644
--- a/src/jdk.net/macosx/classes/jdk/net/MacOSXSocketOptions.java
+++ b/src/jdk.net/macosx/classes/jdk/net/MacOSXSocketOptions.java
@@ -32,7 +32,7 @@
 import jdk.net.ExtendedSocketOptions.PlatformSocketOptions;
 import sun.nio.fs.UnixUserPrincipals;
 
-@SuppressWarnings("removal")
+@SuppressWarnings({"removal", "restricted"})
 class MacOSXSocketOptions extends PlatformSocketOptions {
 
     public MacOSXSocketOptions() {
diff --git a/src/jdk.net/windows/classes/jdk/net/WindowsSocketOptions.java b/src/jdk.net/windows/classes/jdk/net/WindowsSocketOptions.java
index 543d584bfe5a1..f5f69e205176f 100644
--- a/src/jdk.net/windows/classes/jdk/net/WindowsSocketOptions.java
+++ b/src/jdk.net/windows/classes/jdk/net/WindowsSocketOptions.java
@@ -30,7 +30,7 @@
 import jdk.net.ExtendedSocketOptions.PlatformSocketOptions;
 
 
-@SuppressWarnings("removal")
+@SuppressWarnings({"removal", "restricted"})
 class WindowsSocketOptions extends PlatformSocketOptions {
 
     public WindowsSocketOptions() {
diff --git a/src/jdk.sctp/unix/classes/sun/nio/ch/sctp/SctpChannelImpl.java b/src/jdk.sctp/unix/classes/sun/nio/ch/sctp/SctpChannelImpl.java
index 4355605e25815..2e12e67c6c72c 100644
--- a/src/jdk.sctp/unix/classes/sun/nio/ch/sctp/SctpChannelImpl.java
+++ b/src/jdk.sctp/unix/classes/sun/nio/ch/sctp/SctpChannelImpl.java
@@ -1094,7 +1094,7 @@ static native int send0(int fd, long address, int length,
         loadSctpLibrary();
     }
 
-    @SuppressWarnings("removal")
+    @SuppressWarnings({"removal", "restricted"})
     private static void loadSctpLibrary() {
         IOUtil.load();   /* loads nio & net native libraries */
         AccessController.doPrivileged(
diff --git a/src/jdk.sctp/unix/classes/sun/nio/ch/sctp/SctpNet.java b/src/jdk.sctp/unix/classes/sun/nio/ch/sctp/SctpNet.java
index 239e09837f7a9..decf964c6cb72 100644
--- a/src/jdk.sctp/unix/classes/sun/nio/ch/sctp/SctpNet.java
+++ b/src/jdk.sctp/unix/classes/sun/nio/ch/sctp/SctpNet.java
@@ -333,7 +333,7 @@ static native void setInitMsgOption0(int fd, int arg1, int arg2)
         loadSctpLibrary();
     }
 
-    @SuppressWarnings("removal")
+    @SuppressWarnings({"removal", "restricted"})
     private static void loadSctpLibrary() {
         IOUtil.load();   // loads nio & net native libraries
         java.security.AccessController.doPrivileged(
diff --git a/src/jdk.security.auth/share/classes/com/sun/security/auth/module/NTSystem.java b/src/jdk.security.auth/share/classes/com/sun/security/auth/module/NTSystem.java
index 0814f0f733282..677d4aefc8663 100644
--- a/src/jdk.security.auth/share/classes/com/sun/security/auth/module/NTSystem.java
+++ b/src/jdk.security.auth/share/classes/com/sun/security/auth/module/NTSystem.java
@@ -129,7 +129,7 @@ public synchronized long getImpersonationToken() {
         return impersonationToken;
     }
 
-
+    @SuppressWarnings("restricted")
     private void loadNative() {
         System.loadLibrary("jaas");
     }
diff --git a/src/jdk.security.auth/share/classes/com/sun/security/auth/module/UnixSystem.java b/src/jdk.security.auth/share/classes/com/sun/security/auth/module/UnixSystem.java
index 96bc1fb32fce4..f3741c1040401 100644
--- a/src/jdk.security.auth/share/classes/com/sun/security/auth/module/UnixSystem.java
+++ b/src/jdk.security.auth/share/classes/com/sun/security/auth/module/UnixSystem.java
@@ -53,6 +53,7 @@ public class UnixSystem {
      * Instantiate a {@code UnixSystem} and load
      * the native library to access the underlying system information.
      */
+    @SuppressWarnings("restricted")
     public UnixSystem() {
         System.loadLibrary("jaas");
         getUnixInfo();
diff --git a/test/hotspot/jtreg/runtime/jni/checked/TestCheckedReleaseArrayElements.java b/test/hotspot/jtreg/runtime/jni/checked/TestCheckedReleaseArrayElements.java
index 6bc09b8a03451..07e46a1dfcac0 100644
--- a/test/hotspot/jtreg/runtime/jni/checked/TestCheckedReleaseArrayElements.java
+++ b/test/hotspot/jtreg/runtime/jni/checked/TestCheckedReleaseArrayElements.java
@@ -49,6 +49,7 @@ public static void main(String[] args) throws Throwable {
             // that might generate output on stderr (which should be empty for this test).
             ProcessBuilder pb =
                 ProcessTools.createLimitedTestJavaProcessBuilder("-Xcheck:jni",
+                                                                 "--enable-native-access=ALL-UNNAMED",
                                                                  "-Djava.library.path=" + Utils.TEST_NATIVE_PATH,
                                                                  "TestCheckedReleaseArrayElements");
             OutputAnalyzer output = ProcessTools.executeProcess(pb);
diff --git a/test/jdk/java/foreign/TestRestricted.java b/test/jdk/java/foreign/TestRestricted.java
index beccd89582978..b5b0974e57ab2 100644
--- a/test/jdk/java/foreign/TestRestricted.java
+++ b/test/jdk/java/foreign/TestRestricted.java
@@ -88,7 +88,11 @@ static RestrictedMethod of(Class<?> owner, String name, Class<?> returnType, Cla
             RestrictedMethod.of(MemorySegment.class, "reinterpret", MemorySegment.class, Arena.class, Consumer.class),
             RestrictedMethod.of(MemorySegment.class, "reinterpret", MemorySegment.class, long.class, Arena.class, Consumer.class),
             RestrictedMethod.of(AddressLayout.class, "withTargetLayout", AddressLayout.class, MemoryLayout.class),
-            RestrictedMethod.of(ModuleLayer.Controller.class, "enableNativeAccess", ModuleLayer.Controller.class, Module.class)
+            RestrictedMethod.of(ModuleLayer.Controller.class, "enableNativeAccess", ModuleLayer.Controller.class, Module.class),
+            RestrictedMethod.of(System.class, "load", void.class, String.class),
+            RestrictedMethod.of(System.class, "loadLibrary", void.class, String.class),
+            RestrictedMethod.of(Runtime.class, "load", void.class, String.class),
+            RestrictedMethod.of(Runtime.class, "loadLibrary", void.class, String.class)
     );
 
     @Test
diff --git a/test/jdk/java/foreign/enablenativeaccess/TestEnableNativeAccess.java b/test/jdk/java/foreign/enablenativeaccess/TestEnableNativeAccess.java
index 9dd228f5152b6..1e111925cf13e 100644
--- a/test/jdk/java/foreign/enablenativeaccess/TestEnableNativeAccess.java
+++ b/test/jdk/java/foreign/enablenativeaccess/TestEnableNativeAccess.java
@@ -28,6 +28,10 @@
  * @library /test/lib
  * @build TestEnableNativeAccess
  *        panama_module/*
+ *        panama_jni_load_module/*
+ *        panama_jni_def_module/*
+ *        panama_jni_use_module/*
+ *
  *        org.openjdk.foreigntest.unnamed.PanamaMainUnnamedModule
  * @run testng/othervm/timeout=180 TestEnableNativeAccess
  * @summary Basic test for java --enable-native-access
@@ -62,20 +66,25 @@ public Object[][] succeedCases() {
                 { "panama_enable_native_access", PANAMA_MAIN, successNoWarning(), new String[]{"--enable-native-access=panama_module"} },
                 { "panama_enable_native_access_reflection", PANAMA_REFLECTION, successNoWarning(), new String[]{"--enable-native-access=panama_module"} },
                 { "panama_enable_native_access_invoke", PANAMA_INVOKE, successNoWarning(), new String[]{"--enable-native-access=panama_module"} },
-                { "panama_enable_native_access_jni", PANAMA_JNI, successNoWarning(), new String[]{"--enable-native-access=ALL-UNNAMED"} },
 
                 { "panama_comma_separated_enable", PANAMA_MAIN, successNoWarning(), new String[]{"--enable-native-access=java.base,panama_module"} },
                 { "panama_comma_separated_enable_reflection", PANAMA_REFLECTION, successNoWarning(), new String[]{"--enable-native-access=java.base,panama_module"} },
                 { "panama_comma_separated_enable_invoke", PANAMA_INVOKE, successNoWarning(), new String[]{"--enable-native-access=java.base,panama_module"} },
-                { "panama_comma_separated_enable_jni", PANAMA_JNI, successNoWarning(), new String[]{"--enable-native-access=java.base,ALL-UNNAMED"} },
+                { "panama_comma_separated_enable_jni", PANAMA_JNI, successNoWarning(), new String[]{"--enable-native-access=panama_jni_load_module,panama_jni_def_module,ALL-UNNAMED"} },
 
                 { "panama_enable_native_access_warn", PANAMA_MAIN, successWithWarning("panama"), new String[]{} },
                 { "panama_enable_native_access_warn_reflection", PANAMA_REFLECTION, successWithWarning("panama"), new String[]{} },
                 { "panama_enable_native_access_warn_invoke", PANAMA_INVOKE, successWithWarning("panama"), new String[]{} },
-                { "panama_enable_native_access_warn_jni", PANAMA_JNI, successWithWarning("ALL-UNNAMED"), new String[]{} },
+                { "panama_enable_native_access_warn_jni", PANAMA_JNI, successWithWarnings("panama_jni_load_module", "panama_jni_def_module", "ALL-UNNAMED"), new String[]{} },
+
+                { "panama_enable_native_access_allow", PANAMA_MAIN, successNoWarning(), new String[]{"--illegal-native-access=allow"} },
+                { "panama_enable_native_access_allow_reflection", PANAMA_REFLECTION, successNoWarning(), new String[]{"--illegal-native-access=allow"} },
+                { "panama_enable_native_access_allow_invoke", PANAMA_INVOKE, successNoWarning(), new String[]{"--illegal-native-access=allow"} },
+                { "panama_enable_native_access_allow_jni", PANAMA_JNI, successNoWarning(), new String[]{"--illegal-native-access=allow"} },
 
                 { "panama_no_unnamed_module_native_access", UNNAMED, successWithWarning("ALL-UNNAMED"), new String[]{} },
                 { "panama_all_unnamed_module_native_access", UNNAMED, successNoWarning(), new String[]{"--enable-native-access=ALL-UNNAMED"} },
+                { "panama_allow_unnamed_module_native_access", UNNAMED, successNoWarning(), new String[]{"--illegal-native-access=allow"} },
         };
     }
 
@@ -131,12 +140,15 @@ public void testRepeatedOption() throws Exception {
      * Specifies bad value to --enable-native-access.
      */
     public void testBadValue() throws Exception {
-        run("panama_enable_native_access_warn_unknown_module", PANAMA_MAIN,
+        run("panama_deny_bad_unknown_module", PANAMA_MAIN,
                 failWithWarning("WARNING: Unknown module: BAD specified to --enable-native-access"),
-                "--enable-native-access=BAD");
-        run("panama_no_all_module_path_blanket_native_access", PANAMA_MAIN,
+                "--illegal-native-access=deny", "--enable-native-access=BAD");
+        run("panama_deny_bad_all_module_path_module", PANAMA_MAIN,
                 failWithWarning("WARNING: Unknown module: ALL-MODULE-PATH specified to --enable-native-access"),
-                "--enable-native-access=ALL-MODULE-PATH" );
+                "--illegal-native-access=deny", "--enable-native-access=ALL-MODULE-PATH" );
+        run("panama_deny_no_module", PANAMA_MAIN,
+                failWithError("module panama_module"),
+                "--illegal-native-access=deny");
     }
 
     private int count(Iterable<String> lines, CharSequence cs) {
diff --git a/test/jdk/java/foreign/enablenativeaccess/TestEnableNativeAccessBase.java b/test/jdk/java/foreign/enablenativeaccess/TestEnableNativeAccessBase.java
index b5afb727997ba..5f02e7cc4ace7 100644
--- a/test/jdk/java/foreign/enablenativeaccess/TestEnableNativeAccessBase.java
+++ b/test/jdk/java/foreign/enablenativeaccess/TestEnableNativeAccessBase.java
@@ -38,8 +38,8 @@ public class TestEnableNativeAccessBase {
     static final String PANAMA_REFLECTION = "panama_module/" + PANAMA_REFLECTION_CLS;
     static final String PANAMA_INVOKE_CLS = "org.openjdk.foreigntest.PanamaMainInvoke";
     static final String PANAMA_INVOKE = "panama_module/" + PANAMA_INVOKE_CLS;
-    static final String PANAMA_JNI_CLS = "org.openjdk.foreigntest.PanamaMainJNI";
-    static final String PANAMA_JNI = "panama_module/" + PANAMA_JNI_CLS;
+    static final String PANAMA_JNI_CLS = "org.openjdk.jni.PanamaMainJNI";
+    static final String PANAMA_JNI = "panama_jni_load_module/" + PANAMA_JNI_CLS;
     static final String UNNAMED = "org.openjdk.foreigntest.unnamed.PanamaMainUnnamedModule";
 
     /**
@@ -99,6 +99,14 @@ static Result successWithWarning(String moduleName) {
         return success().expect("WARNING").expect("--enable-native-access=" + moduleName);
     }
 
+    static Result successWithWarnings(String... moduleNames) {
+        Result result = success();
+        for (String moduleName : moduleNames) {
+            result = result.expect("WARNING").expect("--enable-native-access=" + moduleName);
+        }
+        return result;
+    }
+
     static Result failWithWarning(String expectedOutput) {
         return new Result(false).expect(expectedOutput).expect("WARNING");
     }
diff --git a/test/jdk/java/foreign/enablenativeaccess/TestEnableNativeAccessDynamic.java b/test/jdk/java/foreign/enablenativeaccess/TestEnableNativeAccessDynamic.java
index fa09b0eb41454..05804d6e89dc9 100644
--- a/test/jdk/java/foreign/enablenativeaccess/TestEnableNativeAccessDynamic.java
+++ b/test/jdk/java/foreign/enablenativeaccess/TestEnableNativeAccessDynamic.java
@@ -73,6 +73,7 @@ OutputAnalyzer run(String action, String moduleAndCls, boolean enableNativeAcces
             Result expectedResult, boolean panamaModuleInBootLayer) throws Exception
     {
         List<String> list = new ArrayList<>();
+        list.add("--illegal-native-access=deny");
         if (panamaModuleInBootLayer) {
             list.addAll(List.of("-p", MODULE_PATH));
             list.add("--add-modules=panama_module");
diff --git a/test/jdk/java/foreign/enablenativeaccess/panama_jni_def_module/module-info.java b/test/jdk/java/foreign/enablenativeaccess/panama_jni_def_module/module-info.java
new file mode 100644
index 0000000000000..85c00ce5daec3
--- /dev/null
+++ b/test/jdk/java/foreign/enablenativeaccess/panama_jni_def_module/module-info.java
@@ -0,0 +1,26 @@
+/*
+ * Copyright (c) 2024, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+module panama_jni_def_module {
+    exports org.openjdk.jni.def;
+}
diff --git a/test/jdk/java/foreign/enablenativeaccess/panama_jni_def_module/org/openjdk/jni/def/PanamaJNIDef.java b/test/jdk/java/foreign/enablenativeaccess/panama_jni_def_module/org/openjdk/jni/def/PanamaJNIDef.java
new file mode 100644
index 0000000000000..402ce9278e9ee
--- /dev/null
+++ b/test/jdk/java/foreign/enablenativeaccess/panama_jni_def_module/org/openjdk/jni/def/PanamaJNIDef.java
@@ -0,0 +1,32 @@
+/*
+ * Copyright (c) 2024, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package org.openjdk.jni.def;
+
+import java.lang.foreign.FunctionDescriptor;
+import java.lang.foreign.Linker;
+
+public class PanamaJNIDef {
+
+    public static native void nativeLinker0(Linker linker, FunctionDescriptor desc, Linker.Option[] options);
+}
diff --git a/test/jdk/java/foreign/enablenativeaccess/panama_module/org/openjdk/foreigntest/libLinkerInvokerModule.cpp b/test/jdk/java/foreign/enablenativeaccess/panama_jni_def_module/org/openjdk/jni/def/libLinkerInvokerModule.cpp
similarity index 94%
rename from test/jdk/java/foreign/enablenativeaccess/panama_module/org/openjdk/foreigntest/libLinkerInvokerModule.cpp
rename to test/jdk/java/foreign/enablenativeaccess/panama_jni_def_module/org/openjdk/jni/def/libLinkerInvokerModule.cpp
index 4591d7a506ae3..c46e6e6acdba8 100644
--- a/test/jdk/java/foreign/enablenativeaccess/panama_module/org/openjdk/foreigntest/libLinkerInvokerModule.cpp
+++ b/test/jdk/java/foreign/enablenativeaccess/panama_jni_def_module/org/openjdk/jni/def/libLinkerInvokerModule.cpp
@@ -47,7 +47,7 @@ void call(void* arg) {
 
 extern "C" {
     JNIEXPORT void JNICALL
-    Java_org_openjdk_foreigntest_PanamaMainJNI_nativeLinker0(JNIEnv *env, jclass cls, jobject linker, jobject desc, jobjectArray opts) {
+    Java_org_openjdk_jni_def_PanamaJNIDef_nativeLinker0(JNIEnv *env, jclass cls, jobject linker, jobject desc, jobjectArray opts) {
         Context context;
         env->GetJavaVM(&context.jvm);
         context.linker = env->NewGlobalRef(linker);
diff --git a/test/jdk/java/foreign/enablenativeaccess/panama_jni_load_module/module-info.java b/test/jdk/java/foreign/enablenativeaccess/panama_jni_load_module/module-info.java
new file mode 100644
index 0000000000000..87e4d8dac050b
--- /dev/null
+++ b/test/jdk/java/foreign/enablenativeaccess/panama_jni_load_module/module-info.java
@@ -0,0 +1,27 @@
+/*
+ * Copyright (c) 2024, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+module panama_jni_load_module {
+    exports org.openjdk.jni;
+    requires panama_jni_use_module;
+}
diff --git a/test/jdk/java/foreign/enablenativeaccess/panama_jni_load_module/org/openjdk/jni/PanamaMainJNI.java b/test/jdk/java/foreign/enablenativeaccess/panama_jni_load_module/org/openjdk/jni/PanamaMainJNI.java
new file mode 100644
index 0000000000000..ffe540acae0ac
--- /dev/null
+++ b/test/jdk/java/foreign/enablenativeaccess/panama_jni_load_module/org/openjdk/jni/PanamaMainJNI.java
@@ -0,0 +1,37 @@
+/*
+ * Copyright (c) 2024, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package org.openjdk.jni;
+
+import org.openjdk.jni.use.PanamaJNIUse;
+
+public class PanamaMainJNI {
+
+    static {
+        System.loadLibrary("LinkerInvokerModule");
+    }
+
+    public static void main(String[] args) {
+        PanamaJNIUse.run();
+    }
+}
diff --git a/test/jdk/java/foreign/enablenativeaccess/panama_jni_use_module/module-info.java b/test/jdk/java/foreign/enablenativeaccess/panama_jni_use_module/module-info.java
new file mode 100644
index 0000000000000..daeca16c132fd
--- /dev/null
+++ b/test/jdk/java/foreign/enablenativeaccess/panama_jni_use_module/module-info.java
@@ -0,0 +1,27 @@
+/*
+ * Copyright (c) 2024, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+module panama_jni_use_module {
+    exports org.openjdk.jni.use;
+    requires panama_jni_def_module;
+}
diff --git a/test/jdk/java/foreign/enablenativeaccess/panama_jni_use_module/org/openjdk/jni/use/PanamaJNIUse.java b/test/jdk/java/foreign/enablenativeaccess/panama_jni_use_module/org/openjdk/jni/use/PanamaJNIUse.java
new file mode 100644
index 0000000000000..2445b4951dc59
--- /dev/null
+++ b/test/jdk/java/foreign/enablenativeaccess/panama_jni_use_module/org/openjdk/jni/use/PanamaJNIUse.java
@@ -0,0 +1,41 @@
+/*
+ * Copyright (c) 2024, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package org.openjdk.jni.use;
+
+import java.lang.foreign.FunctionDescriptor;
+import java.lang.foreign.Linker;
+
+import org.openjdk.jni.def.PanamaJNIDef;
+
+public class PanamaJNIUse {
+    public static void run() {
+        testDirectAccessCLinker();
+    }
+
+    public static void testDirectAccessCLinker() {
+        System.out.println("Trying to get downcall handle");
+        PanamaJNIDef.nativeLinker0(Linker.nativeLinker(), FunctionDescriptor.ofVoid(), new Linker.Option[0]);
+        System.out.println("Got downcall handle");
+    }
+}
diff --git a/test/jdk/java/foreign/enablenativeaccess/panama_module/org/openjdk/foreigntest/PanamaMainJNI.java b/test/jdk/java/foreign/enablenativeaccess/panama_module/org/openjdk/foreigntest/PanamaMainJNI.java
deleted file mode 100644
index 164ee5852ccfa..0000000000000
--- a/test/jdk/java/foreign/enablenativeaccess/panama_module/org/openjdk/foreigntest/PanamaMainJNI.java
+++ /dev/null
@@ -1,23 +0,0 @@
-package org.openjdk.foreigntest;
-
-import java.lang.foreign.FunctionDescriptor;
-import java.lang.foreign.Linker;
-
-public class PanamaMainJNI {
-
-    static {
-        System.loadLibrary("LinkerInvokerModule");
-    }
-
-    public static void main(String[] args) {
-        testDirectAccessCLinker();
-    }
-
-    public static void testDirectAccessCLinker() {
-        System.out.println("Trying to get downcall handle");
-        nativeLinker0(Linker.nativeLinker(), FunctionDescriptor.ofVoid(), new Linker.Option[0]);
-        System.out.println("Got downcall handle");
-    }
-
-    static native void nativeLinker0(Linker linker, FunctionDescriptor desc, Linker.Option[] options);
-}
diff --git a/test/jdk/java/foreign/handles/Driver.java b/test/jdk/java/foreign/handles/Driver.java
index 1abfa6963fb9a..ca0545e2fd48a 100644
--- a/test/jdk/java/foreign/handles/Driver.java
+++ b/test/jdk/java/foreign/handles/Driver.java
@@ -24,6 +24,6 @@
 /*
  * @test
  * @build invoker_module/* lookup_module/*
- * @run testng/othervm --enable-native-access=invoker_module
+ * @run testng/othervm --illegal-native-access=deny --enable-native-access=invoker_module
  *                     lookup_module/handle.lookup.MethodHandleLookup
  */
diff --git a/test/jdk/java/foreign/handles/invoker_module/handle/invoker/MethodHandleInvoker.java b/test/jdk/java/foreign/handles/invoker_module/handle/invoker/MethodHandleInvoker.java
index 9b696caa82d1e..fbb85cc54dfc5 100644
--- a/test/jdk/java/foreign/handles/invoker_module/handle/invoker/MethodHandleInvoker.java
+++ b/test/jdk/java/foreign/handles/invoker_module/handle/invoker/MethodHandleInvoker.java
@@ -90,6 +90,7 @@ static void addDefaultMapping(Class<?> carrier, Object value) {
         addDefaultMapping(Consumer.class, (Consumer<Object>)(Object o) -> {});
         addDefaultMapping(FunctionDescriptor.class, FunctionDescriptor.ofVoid());
         addDefaultMapping(Linker.Option[].class, null);
+        addDefaultMapping(Runtime.class, Runtime.getRuntime());
         addDefaultMapping(byte.class, (byte)0);
         addDefaultMapping(boolean.class, true);
         addDefaultMapping(char.class, (char)0);
diff --git a/test/jdk/java/foreign/handles/lookup_module/handle/lookup/MethodHandleLookup.java b/test/jdk/java/foreign/handles/lookup_module/handle/lookup/MethodHandleLookup.java
index ed916c1fe2419..42e6d7a7d8403 100644
--- a/test/jdk/java/foreign/handles/lookup_module/handle/lookup/MethodHandleLookup.java
+++ b/test/jdk/java/foreign/handles/lookup_module/handle/lookup/MethodHandleLookup.java
@@ -71,6 +71,18 @@ static Object[][] restrictedMethods() {
                     { MethodHandles.lookup().findStatic(SymbolLookup.class, "libraryLookup",
                             MethodType.methodType(SymbolLookup.class, Path.class, Arena.class)),
                             "SymbolLookup::libraryLookup(Path)" },
+                    { MethodHandles.lookup().findStatic(System.class, "load",
+                            MethodType.methodType(void.class, String.class)),
+                            "System::load" },
+                    { MethodHandles.lookup().findStatic(System.class, "loadLibrary",
+                            MethodType.methodType(void.class, String.class)),
+                            "System::loadLibrary" },
+                    { MethodHandles.lookup().findVirtual(Runtime.class, "load",
+                            MethodType.methodType(void.class, String.class)),
+                            "Runtime::load" },
+                    { MethodHandles.lookup().findVirtual(Runtime.class, "loadLibrary",
+                            MethodType.methodType(void.class, String.class)),
+                            "Runtime::loadLibrary" }
             };
         } catch (Throwable ex) {
             throw new ExceptionInInitializerError((ex));