On Thu, 29 Oct 2026 10:10:32 GMT, Andrew Haley <[email protected]> wrote:
> > Since CI doesn't test with branch protection enabled
>
> We could fix that. I wouldn't be against, say, building and testing just the
> Windows/AArch64 build with it enabled. This would mean that ROP-breaking
> changes would be detected in CI.
I like the idea of running CI with PAC/AUT instructions enabled to catch bugs,
but I'd like to confirm with @erikj79, since we'd be deviating from the default
(branch protection being off). There's a possibility of folks being unable to
reproduce CI failures if they don't have an AArch64 machine that supports
pointer authentication. Erik, what do you think?
If we go ahead, perhaps we should do this for Linux/AArch64 as well, since
pointer authentication is supported there as well.
The exact change would be the following:
diff --git a/.github/workflows/build-windows.yml
b/.github/workflows/build-windows.yml
index dc1aedd362d9..5801ee51bd3d 100644
--- a/.github/workflows/build-windows.yml
+++ b/.github/workflows/build-windows.yml
@@ -163,6 +163,7 @@ jobs:
--with-msvc-toolset-version=${{ inputs.msvc-toolset-version }}
--with-jmod-compress=zip-1
--with-external-symbols-in-bundles=none
+ ${{ inputs.platform == 'windows-aarch64' &&
'--enable-branch-protection' || '' }}
${{ inputs.extra-conf-options }} ${{ inputs.configure-arguments }}
|| (
echo "Dumping config.log:" &&
cat config.log &&
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 054bd00beb95..ffa185237137 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -205,7 +205,7 @@ jobs:
TEST_IMAGE_DIR=${{ steps.bundles.outputs.tests-path }}
${{ steps.extra-options.outputs.test-jdk }}
${{ steps.extra-options.outputs.compile-jdk }}
-
JTREG='JAVA_OPTIONS=-XX:-CreateCoredumpOnCrash;VERBOSE=fail,error,time;KEYWORDS=!headful;${{
steps.extra-options.outputs.extra-problem-lists }}'
+ JTREG='JAVA_OPTIONS=-XX:-CreateCoredumpOnCrash ${{ inputs.platform
== 'windows-aarch64' && '-XX:UseBranchProtection=standard' || ''
}};VERBOSE=fail,error,time;KEYWORDS=!headful;${{
steps.extra-options.outputs.extra-problem-lists }}'
&& bash ./.github/scripts/gen-test-summary.sh "$GITHUB_STEP_SUMMARY"
"$GITHUB_OUTPUT"
env:
PATH: ${{ steps.path.outputs.value }}
I applied this patch on top of the commits in this branch to create a separate
branch and ran CI for Windows/ARM64 (see
https://github.com/raneashay/openjdk-jdk/actions/runs/40901946509). You can
trace the commit history in that run to see that the above patch is the only
difference.
-------------
PR Comment: https://git.openjdk.org/jdk/pull/33595#issuecomment-6505259835
