Using Linux’s memfd_secret syscall from the JVM with JEP-419 JEP-454

var captureStateLayout = Linker.Option.captureStateLayout(); (1)
long errnoOffset = captureStateLayout.byteOffset(
        MemoryLayout.PathElement.groupElement("errno")); (2)

var linker = Linker.nativeLinker();
MethodHandle syscall = linker.downcallHandle(
        linker.defaultLookup().find("syscall").orElseThrow(),
        FunctionDescriptor.of(ValueLayout.JAVA_INT, ValueLayout.JAVA_INT),
        Linker.Option.captureCallState("errno") (3)
);

var captureState = arena.allocate(captureStateLayout); (4)
int result = (int) syscall.invoke(captureState, SYS_getpid); (5)
int errno = captureState.get(ValueLayout.JAVA_INT, errnoOffset); (6)

var linker = Linker.nativeLinker();
MethodHandle strerror = linker.downcallHandle(
      linker.defaultLookup().find("strerror").orElseThrow(),
      FunctionDescriptor.of(ValueLayout.ADDRESS, ValueLayout.JAVA_INT)
);

String errmsg = ((MemorySegment) strerror.invoke(errno)) (1)
                                         .reinterpret(Long.MAX_VALUE) (2)
                                         .getString(0); (3)

var captureState = arena.allocate(captureStateLayout); (1)
fd = (int) sys_memfd_secret.invoke(captureState, 0); (2)
if (fd == -1) {
  int errno = captureState.get(ValueLayout.JAVA_INT, errnoOffset); (3)
  System.err.println(errno == ENOSYS ?
                     "tried to call a syscall that doesn't exist (errno=ENOSYS), may need to set the 'secretmem.enable=1' kernel boot option" :
                     "syscall memfd_secret failed, errno: " + errno + ", " + strerror(errno));
  return Optional.empty();
}

try (var channel = FileChannel.open(path, StandardOpenOption.READ, StandardOpenOption.WRITE)) {
    MemorySegment segment = channel.map(FileChannel.MapMode.READ_WRITE, 0, size, arena);
}

var linker = Linker.nativeLinker();
var syscallAddress = linker.defaultLookup().find("syscall").orElseThrow();
var syscall = linker.downcallHandle(
        syscallAddress,
        FunctionDescriptor.of(
                ValueLayout.JAVA_INT,
                ValueLayout.JAVA_INT  (1)
        )
);

var sys_getpid = MethodHandles.insertArguments(syscall, 0, SYS_getpid); (2)
sys_getpid.invoke(); (3)

var linker = Linker.nativeLinker();
var syscallAddress = linker.defaultLookup().findOrThrow("syscall");
var basicSyscallDescriptor = FunctionDescriptor.of(
        ValueLayout.JAVA_INT,
        ValueLayout.JAVA_INT
);

var sys_memfd_secret = MethodHandles.insertArguments(
        linker.downcallHandle(
                syscallAddress,
                basicSyscallDescriptor.appendArgumentLayouts(ValueLayout.JAVA_INT) (1)
        ),
        0,
        SYS_memfd_secret (2)
);

int fd = (int) sys_memfd_secret.invoke(0); (3)

sudo dnf install java-21-openjdk-devel (1)
sudo dnf install java-25-openjdk-devel java-25-openjdk-jmods (2)
curl -LO https://github.com/llvm/llvm-project/releases/download/llvmorg-22.1.2/LLVM-22.1.2-Linux-ARM64.tar.xz (3)
tar xf LLVM-22.1.2-Linux-ARM64.tar.xz --directory /clang/extract/path/
git clone --depth 1 https://github.com/openjdk/jextract.git
cd jextract
sh ./gradlew \
  -Pjdk_home=/path/to/jdk25 \
  -Pllvm_home=/clang/extract/path/LLVM-22.1.2-Linux-ARM64/ \
  clean verify (4)

$ ./build/jextract/bin/jextract --version
jextract 23
JDK version 25.0.2+10-LTS
LibClang version clang version 22.1.2 (https://github.com/llvm/llvm-project 1ab49a973e210e97d61e5db6557180dcb92c3e98)

#include <unistd.h>
#include <sys/mman.h>
#include <sys/syscall.h>

--source (1)
--output build/generated/sources/jextract-syscall/java (2)
--target-package linux (3)
--header-class-name syscall_h (4)

--include-function syscall
--include-constant SYS_memfd_secret

--include-function close
--include-function ftruncate

--include-function mmap
--include-function munmap
--include-constant PROT_READ
--include-constant PROT_WRITE
--include-constant MAP_SHARED

--include-function strerror

$ jextract @memfd_secret_header.jextract.options memfd_secret_header.h (1)

// ...
public class syscall_h extends syscall_h$shared {

    syscall_h() {
        // Should not be called directly
    }

    static final Arena LIBRARY_ARENA = Arena.ofAuto();

    static final SymbolLookup SYMBOL_LOOKUP = SymbolLookup.loaderLookup()
            .or(Linker.nativeLinker().defaultLookup());

    private static final int PROT_READ = (int)1L;
    /**
     * {@snippet lang=c :
     * #define PROT_READ 1
     * }
     */
    public static int PROT_READ() {
        return PROT_READ;
    }
    private static final int PROT_WRITE = (int)2L;
    /**
     * {@snippet lang=c :
     * #define PROT_WRITE 2
     * }
     */
    public static int PROT_WRITE() {
        return PROT_WRITE;
    }
    private static final int MAP_SHARED = (int)1L;
    /**
     * {@snippet lang=c :
     * #define MAP_SHARED 1
     * }
     */
    public static int MAP_SHARED() {
        return MAP_SHARED;
    }

    // ...

    /**
     * {@snippet lang=c :
     * extern int close(int __fd)
     * }
     */
    public static int close(int __fd) {
        // ...
    }

    //...

    /**
     * {@snippet lang=c :
     * extern int ftruncate(int __fd, __off_t __length)
     * }
     */
    public static int ftruncate(int __fd, long __length) {
        // ...
    }

    /**
     * Variadic invoker class for:
     * {@snippet lang=c :
     * extern long syscall(long __sysno, ...)
     * }
     */
    public static class syscall {
        private static final FunctionDescriptor BASE_DESC = FunctionDescriptor.of(
                syscall_h.C_LONG,
                syscall_h.C_LONG
            );
        private static final MemorySegment ADDR = SYMBOL_LOOKUP.findOrThrow("syscall");

        private final MethodHandle handle;
        private final FunctionDescriptor descriptor;
        private final MethodHandle spreader;

        private syscall(MethodHandle handle, FunctionDescriptor descriptor, MethodHandle spreader) {
            this.handle = handle;
            this.descriptor = descriptor;
            this.spreader = spreader;
        }

        /**
         * Variadic invoker factory for:
         * {@snippet lang=c :
         * extern long syscall(long __sysno, ...)
         * }
         */
        public static syscall makeInvoker(MemoryLayout... layouts) {
            FunctionDescriptor desc$ = BASE_DESC.appendArgumentLayouts(layouts);
            Linker.Option fva$ = Linker.Option.firstVariadicArg(BASE_DESC.argumentLayouts().size());
            var mh$ = Linker.nativeLinker().downcallHandle(ADDR, desc$, fva$);
            var spreader$ = mh$.asSpreader(Object[].class, layouts.length);
            return new syscall(mh$, desc$, spreader$);
        }

        /**
         * {@return the address}
         */
        public static MemorySegment address() {
            return ADDR;
        }

        /**
         * {@return the specialized method handle}
         */
        public MethodHandle handle() {
            return handle;
        }

        /**
         * {@return the specialized descriptor}
         */
        public FunctionDescriptor descriptor() {
            return descriptor;
        }

        public long apply(long __sysno, Object... x1) {
            try {
                if (TRACE_DOWNCALLS) {
                    traceDowncall("syscall", __sysno, x1);
                }
                return (long) spreader.invokeExact(__sysno, x1);
            } catch(IllegalArgumentException | ClassCastException ex$)  {
                throw ex$; // rethrow IAE from passing wrong number/type of args
            } catch (Throwable ex$) {
               throw new AssertionError("should not reach here", ex$);
            }
        }
    }

    // ...

    /**
     * {@snippet lang=c :
     * extern void *mmap(void *__addr, size_t __len, int __prot, int __flags, int __fd, __off_t __offset)
     * }
     */
    public static MemorySegment mmap(MemorySegment __addr, long __len, int __prot, int __flags, int __fd, long __offset) {
        var mh$ = mmap.HANDLE;
        try {
            if (TRACE_DOWNCALLS) {
                traceDowncall("mmap", __addr, __len, __prot, __flags, __fd, __offset);
            }
            return (MemorySegment)mh$.invokeExact(__addr, __len, __prot, __flags, __fd, __offset);
        } catch (Error | RuntimeException ex) {
           throw ex;
        } catch (Throwable ex$) {
           throw new AssertionError("should not reach here", ex$);
        }
    }

    // ...

    /**
     * {@snippet lang=c :
     * extern int munmap(void *__addr, size_t __len)
     * }
     */
    public static int munmap(MemorySegment __addr, long __len) {
        // ...
    }
    private static final int SYS_memfd_secret = (int)447L;
    /**
     * {@snippet lang=c :
     * #define SYS_memfd_secret 447
     * }
     */
    public static int SYS_memfd_secret() {
        return SYS_memfd_secret;
    }
}