Enable os.memfd_create through runtime weak linking

cpython-unix/Makefile

@@ -220,6 +220,9 @@ $(OUTDIR)/xcb-proto-$(XCB_PROTO_VERSION)-$(PACKAGE_SUFFIX).tar: $(PYTHON_DEP_DEP
 $(OUTDIR)/xorgproto-$(XORGPROTO_VERSION)-$(PACKAGE_SUFFIX).tar: $(PYTHON_DEP_DEPENDS) $(HERE)/build-xorgproto.sh
 	$(RUN_BUILD) --docker-image $(DOCKER_IMAGE_BUILD) xorgproto
 
+$(OUTDIR)/linux-uapi-$(LINUX_UAPI_VERSION)-$(PACKAGE_SUFFIX).tar: $(PYTHON_DEP_DEPENDS) $(HERE)/build-linux-uapi.sh
+	$(RUN_BUILD) --docker-image $(DOCKER_IMAGE_BUILD) linux-uapi
+
 $(OUTDIR)/xtrans-$(XTRANS_VERSION)-$(PACKAGE_SUFFIX).tar: $(PYTHON_DEP_DEPENDS) $(HERE)/build-xtrans.sh
 	$(RUN_BUILD) --docker-image $(DOCKER_IMAGE_BUILD) xtrans
 
@@ -255,6 +258,7 @@ PYTHON_DEPENDS_$(1) := \
     $$(if $$(NEED_LIBEDIT),$$(OUTDIR)/libedit-$$(LIBEDIT_VERSION)-$$(PACKAGE_SUFFIX).tar) \
     $$(if $$(NEED_LIBFFI_3_3),$$(OUTDIR)/libffi-3.3-$$(LIBFFI_3.3_VERSION)-$$(PACKAGE_SUFFIX).tar) \
     $$(if $$(NEED_LIBFFI),$$(OUTDIR)/libffi-$$(LIBFFI_VERSION)-$$(PACKAGE_SUFFIX).tar) \
+    $$(if $$(NEED_LINUX_UAPI),$$(OUTDIR)/linux-uapi-$$(LINUX_UAPI_VERSION)-$$(PACKAGE_SUFFIX).tar) \
     $$(if $$(NEED_m4),$$(OUTDIR)/m4-$$(M4_VERSION)-$$(PACKAGE_SUFFIX).tar) \
     $$(if $$(NEED_MPDECIMAL),$$(OUTDIR)/mpdecimal-$$(MPDECIMAL_VERSION)-$$(PACKAGE_SUFFIX).tar) \
     $$(if $$(NEED_NCURSES),$$(OUTDIR)/ncurses-$$(NCURSES_VERSION)-$$(PACKAGE_SUFFIX).tar) \

cpython-unix/build-cpython.sh

@@ -338,11 +338,39 @@ if [ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_15}" ]; then
     patch -p1 -i "${ROOT}/patch-testinternalcapi-interpreter-extern.patch"
 fi
 
+# CPython uses HAVE_GETRANDOM_SYSCALL to decide whether to include
+# <sys/syscall.h>, but other APIs independently depend on __NR_* definitions
+# from that header. Include it whenever configure finds the header.
+patch -p1 -i "${ROOT}/patch-posixmodule-sys-syscall-header.patch"
+
+# The modern UAPI overlay provides the memfd constants, but some glibc sysroots
+# predate the memfd_create() wrapper. Force the configure check on and weak-link
+# the wrapper so the function is exposed only when runtime glibc provides it.
+# This workaround is specific to glibc builds; the UAPI overlay itself can also
+# be used with other Linux libcs.
+if [[ -n "${LINUX_UAPI_INCLUDE_ARCH:-}" && "${TARGET_TRIPLE}" == *-linux-gnu* ]]; then
+    if [[ -n "${PYTHON_MEETS_MINIMUM_VERSION_3_14}" ]]; then
+        patch -p1 -i "${ROOT}/patch-posixmodule-memfd-create-weak.patch"
+    else
+        patch -p1 -i "${ROOT}/patch-posixmodule-memfd-create-weak-legacy.patch"
+    fi
+
+    export ac_cv_func_memfd_create=yes
+fi
+
 # Most bits look at CFLAGS. But setup.py only looks at CPPFLAGS.
 # So we need to set both.
 CFLAGS="${EXTRA_TARGET_CFLAGS} -fPIC -I${TOOLS_PATH}/deps/include -I${TOOLS_PATH}/deps/include/ncursesw"
 LDFLAGS="${EXTRA_TARGET_LDFLAGS} -L${TOOLS_PATH}/deps/lib"
 
+if [[ -n "${LINUX_UAPI_INCLUDE_ARCH:-}" ]]; then
+    if [[ ! -d "${TOOLS_PATH}/deps/linux-uapi/usr/include/${LINUX_UAPI_INCLUDE_ARCH}" ]]; then
+        echo "missing linux-uapi package for ${LINUX_UAPI_INCLUDE_ARCH}"
+        exit 1
+    fi
+    CFLAGS="-isystem ${TOOLS_PATH}/deps/linux-uapi/usr/include/${LINUX_UAPI_INCLUDE_ARCH} -isystem ${TOOLS_PATH}/deps/linux-uapi/usr/include ${CFLAGS}"
+fi
+
 # Some target configurations use `-fvisibility=hidden`. Python's configure handles
 # symbol visibility properly itself. So let it do its thing.
 CFLAGS=${CFLAGS//-fvisibility=hidden/}
@@ -1062,6 +1090,14 @@ replace_in_all("-I%s/deps/include/ncursesw" % tools_path, "")
 replace_in_all("-I%s/deps/include/uuid" % tools_path, "")
 replace_in_all("-I%s/deps/include" % tools_path, "")
 replace_in_all("-L%s/deps/lib" % tools_path, "")
+linux_uapi_include_arch = os.environ.get("LINUX_UAPI_INCLUDE_ARCH")
+if linux_uapi_include_arch:
+    replace_in_all(
+        "-isystem %s/deps/linux-uapi/usr/include/%s"
+        % (tools_path, linux_uapi_include_arch),
+        "",
+    )
+replace_in_all("-isystem %s/deps/linux-uapi/usr/include" % tools_path, "")
 # See https://github.com/python/cpython/issues/145810#issuecomment-4068139183
 replace_in_all("-LModules/_hacl", "")
 

cpython-unix/build-linux-uapi.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+set -ex
+
+ROOT=$(pwd)
+
+export PATH=${TOOLS_PATH}/${TOOLCHAIN}/bin:${TOOLS_PATH}/host/bin:$PATH
+
+archives=("${ROOT}"/linux-libc-dev_*.deb)
+if [[ ${#archives[@]} -ne 1 || ! -f "${archives[0]}" ]]; then
+    echo "expected exactly one linux-libc-dev package"
+    exit 1
+fi
+
+mkdir -p "${ROOT}/linux-uapi-package" "${ROOT}/out/tools/deps/linux-uapi"
+pushd "${ROOT}/linux-uapi-package"
+ar x "${archives[0]}" data.tar.xz
+tar -xf data.tar.xz -C "${ROOT}/out/tools/deps/linux-uapi"
+popd

cpython-unix/build.py

@@ -812,6 +812,10 @@ def build_cpython(
             "TOOLCHAIN": "clang-%s" % host_platform,
         }
 
+        # Use modern kernel UAPI headers without changing the target's libc.
+        if linux_uapi_include_arch := settings.get("linux_uapi_include_arch"):
+            env["LINUX_UAPI_INCLUDE_ARCH"] = linux_uapi_include_arch
+
         # Set environment variables allowing convenient testing for Python
         # version ranges.
         for v in ("3.10", "3.11", "3.12", "3.13", "3.14", "3.15"):
@@ -1139,6 +1143,7 @@ def main():
             "libffi-3.3",
             "libffi",
             "libpthread-stubs",
+            "linux-uapi",
             "m4",
             "mpdecimal",
             "ncurses",

cpython-unix/patch-posixmodule-memfd-create-weak-legacy.patch

@@ -0,0 +1,35 @@
+diff --git a/Modules/posixmodule.c b/Modules/posixmodule.c
+--- a/Modules/posixmodule.c
++++ b/Modules/posixmodule.c
+@@ -528,6 +528,12 @@ extern char        *ctermid_r(char *);
+ #  include <linux/memfd.h>
+ #endif
+
++#ifdef HAVE_MEMFD_CREATE
++/* Weak references. */
++__attribute__((weak))
++int memfd_create(const char *name, unsigned int flags);
++#endif
++
+ /* eventfd() */
+ #ifdef HAVE_SYS_EVENTFD_H
+ #  include <sys/eventfd.h>
+@@ -15718,6 +15724,18 @@ posixmodule_exec(PyObject *m)
+ {
+     _posixstate *state = get_posix_state(m);
+
++#ifdef HAVE_MEMFD_CREATE
++    if (memfd_create == NULL) {
++        PyObject *dict = PyModule_GetDict(m);
++        if (dict == NULL) {
++            return -1;
++        }
++        if (PyDict_DelItemString(dict, "memfd_create") < 0) {
++            return -1;
++        }
++    }
++#endif
++
+ #if defined(HAVE_PWRITEV)
+     if (HAVE_PWRITEV_RUNTIME) {} else {
+         PyObject* dct = PyModule_GetDict(m);

cpython-unix/patch-posixmodule-memfd-create-weak.patch

@@ -0,0 +1,35 @@
+diff --git a/Modules/posixmodule.c b/Modules/posixmodule.c
+--- a/Modules/posixmodule.c
++++ b/Modules/posixmodule.c
+@@ -192,6 +192,12 @@
+ #  include <linux/memfd.h>        // memfd_create(), MFD_CLOEXEC
+ #endif
+
++#ifdef HAVE_MEMFD_CREATE
++/* Weak references. */
++__attribute__((weak))
++int memfd_create(const char *name, unsigned int flags);
++#endif
++
+ #ifdef HAVE_SYS_EVENTFD_H
+ #  include <sys/eventfd.h>        // eventfd()
+ #endif
+@@ -18128,6 +18134,18 @@ posixmodule_exec(PyObject *m)
+ {
+     _posixstate *state = get_posix_state(m);
+
++#ifdef HAVE_MEMFD_CREATE
++    if (memfd_create == NULL) {
++        PyObject *dict = PyModule_GetDict(m);
++        if (dict == NULL) {
++            return -1;
++        }
++        if (PyDict_PopString(dict, "memfd_create", NULL) < 0) {
++            return -1;
++        }
++    }
++#endif
++
+ #if defined(HAVE_PWRITEV)
+     if (HAVE_PWRITEV_RUNTIME) {} else {
+         PyObject* dct = PyModule_GetDict(m);

cpython-unix/patch-posixmodule-sys-syscall-header.patch

@@ -0,0 +1,6 @@
+diff --git a/Modules/posixmodule.c b/Modules/posixmodule.c
+--- a/Modules/posixmodule.c
++++ b/Modules/posixmodule.c
+@@ -296 +296 @@
+-#ifdef HAVE_GETRANDOM_SYSCALL
++#ifdef HAVE_SYS_SYSCALL_H