# Validate Pointer Authentication and Branch Target Identification in OpenJDK on Google Cloud C4A

## In this learning path

- [Introduction](https://learn.arm.com/learning-paths/servers-and-cloud-computing/openjdk-pacbti-gcp/)
- [Learn about PAC/BTI security features and OpenJDK support](https://learn.arm.com/learning-paths/servers-and-cloud-computing/openjdk-pacbti-gcp/background/)
- [Create a Google Cloud C4A instance](https://learn.arm.com/learning-paths/servers-and-cloud-computing/openjdk-pacbti-gcp/instance/)
- [Test PAC/BTI support with SUSE OpenJDK](https://learn.arm.com/learning-paths/servers-and-cloud-computing/openjdk-pacbti-gcp/jvm-testing/)
- [Test PAC/BTI support with Oracle JDK](https://learn.arm.com/learning-paths/servers-and-cloud-computing/openjdk-pacbti-gcp/jvm-testing-2/)
- [Next Steps](https://learn.arm.com/learning-paths/servers-and-cloud-computing/openjdk-pacbti-gcp/_next-steps/)

## About this Learning Path

|  |  |
| --- | --- |
| Skill level: | Introductory |
| Reading time: | 30 min |
| Last updated: | 02 Oct 2026 |

|  |  |
| --- | --- |
| Author: | Doug Anson , Arm<br>[GitHub](https://github.com/DougAnsonAustinTx)<br>[LinkedIn](https://linkedin.com/in/douganson) |
| Arm IP: | [Neoverse](https://support.arm.com/?tab=compute-ip&Product%20Type=Infrastructure%20Processors) |
| Tags: | [Performance and Architecture](https://learn.arm.com/tag/performance-and-architecture) [Google Axion](https://learn.arm.com/tag/google-axion) [Linux](https://learn.arm.com/tag/linux) [Java](https://learn.arm.com/tag/java) [OpenJDK](https://learn.arm.com/tag/openjdk) [Bash](https://learn.arm.com/tag/bash) |

### Who is this for?
This is for Java developers running OpenJDK on Arm Neoverse platforms who want to verify Pointer Authentication (PAC) and Branch Target Identification (BTI) security features are properly enabled. PAC cryptographically signs return addresses to detect tampering, while BTI restricts where indirect branches can land.

### What will you learn?
After completing this Learning Path, you'll be able to perform the following tasks:
- Provision a Google Cloud C4A Arm-based virtual machine (VM) with SUSE Linux Enterprise Server.
- Install OpenJDK on the Arm-based VM.
- Verify PAC and BTI readiness in the installed Java VM (JVM) runtime.

### Prerequisites
Before starting, you'll need the following prerequisites:
- A [Google Cloud Platform (GCP)](https://cloud.google.com/free) account with billing enabled.
- Optionally, [install the gcloud CLI](https://learn.arm.com/install-guides/gcloud/) to connect to the VM from a local terminal instead of using the browser-based SSH.

### Summary
You’ll validate PAC and BTI support in Java on a Google Axion C4A VM. First, you’ll provision a SUSE Linux Enterprise Server VM and install OpenJDK. You’ll run a script that checks platform capabilities and JVM just-in-time (JIT) compiler support. Then, you’ll install Oracle JDK 21, repeat the tests, and compare how each runtime reports branch-protection support.

### Frequently asked questions

**How do I verify which JVM is active after installation?**

Run `java --version`. The output should identify the distribution and version, for example OpenJDK 17 on `aarch64`.

**How do I know that the C4A VM exposes PAC and BTI?**

Run the provided test script and review its hardware checks. It should report that PAC and BTI are available before you evaluate JVM compiler behavior.

**What result should I expect from the SUSE OpenJDK 17 tests?**

The tests confirm the platform exposes PAC and BTI, but the SUSE-packaged OpenJDK 17 JIT doesn’t emit PAC and BTI instructions. This distinguishes hardware capability from the compiler’s code generation.

**How do I ensure that the tests run against Oracle JDK 21?**

Run `JAVA=./jdk-21.0.11/bin/java ./test-pacbti.sh` to select the Oracle JDK for the test script. Replace `jdk-21.0.11` with your extracted directory name if it differs.

**Which C4A machine type should I use for this validation?**

Use the `c4a-standard-4` machine type.