Validate Pointer Authentication and Branch Target Identification in OpenJDK on Google Cloud C4A
Introduction
Learn about PAC/BTI security features and OpenJDK support
Create a Google Cloud C4A instance
Test PAC/BTI support with SUSE OpenJDK
Test PAC/BTI support with Oracle JDK
Next Steps

  Log an issue

  Fork and edit

  Discuss on Discord

About this Learning Path

Skill level:  Introductory
Reading time:  30 min
Last updated:  02 Oct 2026
Skill level:
  Introductory
Reading time:
  30 min
Last updated:
  02 Oct 2026
Author:Doug Anson, Arm
Arm IP:Neoverse
Tags: Performance and Architecture Google Axion Linux Java OpenJDK Bash
Author:
  • Doug Anson, Arm
Arm IP:
Neoverse
Tags:
Performance and Architecture Google Axion Linux Java OpenJDK Bash

Who is this for?

This is for Java developers running OpenJDK on Arm Neoverse platforms who want to verify Pointer Authentication (PAC) and Branch Target Identification (BTI) security features are properly enabled. PAC cryptographically signs return addresses to detect tampering, while BTI restricts where indirect branches can land.

What will you learn?

Upon completion of this Learning Path, you will be able to:

  • Provision a Google Cloud C4A Arm-based virtual machine (VM) with SUSE Linux Enterprise Server.
  • Install OpenJDK on the Arm-based VM.
  • Verify PAC and BTI readiness in the installed Java VM (JVM) runtime.

Prerequisites

Before starting, you will need the following:

Summary

AI-assisted

This summary was drafted with an approved AI-assisted workflow and reviewed by Arm contributors before publication. Human technical review remains part of the process so the final page reflects engineering rigor, accuracy, and Arm editorial standards.

Close
?
You’ll validate PAC and BTI support in Java on a Google Axion C4A VM. First, you’ll provision a SUSE Linux Enterprise Server VM and install OpenJDK. You’ll run a script that checks platform capabilities and JVM just-in-time (JIT) compiler support. Then, you’ll install Oracle JDK 21, repeat the tests, and compare how each runtime reports branch-protection support.

Frequently asked questions

AI-assisted

These FAQs were drafted with an approved AI-assisted workflow and reviewed by Arm contributors before publication. Human technical review remains part of the process so the final page reflects engineering rigor, accuracy, and Arm editorial standards.

Close
?
How do I verify which JVM is active after installation?
Run java --version. The output should identify the distribution and version, for example OpenJDK 17 on aarch64.
How do I know that the C4A VM exposes PAC and BTI?
Run the provided test script and review its hardware checks. It should report that PAC and BTI are available before you evaluate JVM compiler behavior.
What result should I expect from the SUSE OpenJDK 17 tests?
The tests confirm the platform exposes PAC and BTI, but the SUSE-packaged OpenJDK 17 JIT doesn’t emit PAC and BTI instructions. This distinguishes hardware capability from the compiler’s code generation.
How do I ensure that the tests run against Oracle JDK 21?
Run JAVA=./jdk-21.0.11/bin/java ./test-pacbti.sh to select the Oracle JDK for the test script. Replace jdk-21.0.11 with your extracted directory name if it differs.
Which C4A machine type should I use for this validation?
Use the c4a-standard-4 machine type.
Next