gh-152433: Make ctypes callbacks work on Windows UWP builds

UWP does not allow memory to be writable and executable at the same
time. Allocate each closure in its own PAGE_READWRITE page, then switch
it to PAGE_EXECUTE_READ with VirtualProtectFromApp() and flush the
instruction cache once ffi_prep_closure_loc() has written it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: thexai

Misc/NEWS.d/next/Windows/2026-11-03-12-00-00.gh-issue-152433.UwpCbk.rst

@@ -0,0 +1,3 @@
+:mod:`ctypes` callbacks now work on Windows UWP builds. Closure memory is
+allocated writable and switched to executable once the closure is prepared,
+since UWP does not allow memory that is writable and executable at once.

Modules/_ctypes/callbacks.c

@@ -545,6 +545,13 @@ CThunkObject *_ctypes_alloc_callback(ctypes_state *st,
         goto error;
     }
 
+#if defined(MS_WIN32) && !defined(MS_WINDOWS_DESKTOP)
+    if (Py_ffi_closure_make_executable(p->pcl_write,
+                                       sizeof(ffi_closure)) < 0) {
+        goto error;
+    }
+#endif
+
     p->converters = Py_NewRef(converters);
     p->callable = Py_NewRef(callable);
     return p;

Modules/_ctypes/ctypes.h

@@ -553,6 +553,11 @@ extern void _ctypes_init_fielddesc(void);
 #ifdef USING_MALLOC_CLOSURE_DOT_C
 void Py_ffi_closure_free(void *p);
 void *Py_ffi_closure_alloc(size_t size, void** codeloc);
+#if defined(MS_WIN32) && !defined(MS_WINDOWS_DESKTOP)
+  /* Make a closure written by ffi_prep_closure_loc() executable (UWP only).
+     Return 0 on success, or set an exception and return -1 on error. */
+  int Py_ffi_closure_make_executable(void* p, size_t size);
+#endif
 #else
 #define Py_ffi_closure_free ffi_closure_free
 #define Py_ffi_closure_alloc ffi_closure_alloc

Modules/_ctypes/malloc_closure.c

@@ -28,6 +28,50 @@
 
 /******************************************************************/
 
+#if defined(MS_WIN32) && !defined(MS_WINDOWS_DESKTOP)
+/* UWP does not allow memory to be writable and executable at the same time:
+   VirtualAllocFromApp() rejects PAGE_EXECUTE_READWRITE.  Instead, each
+   closure gets its own page, which is allocated as PAGE_READWRITE so that
+   ffi_prep_closure_loc() can write the trampoline, and is then switched to
+   PAGE_EXECUTE_READ by Py_ffi_closure_make_executable().  Using one page
+   per closure ensures that changing the protection never affects another
+   closure which may be executing concurrently.  This requires the
+   "codeGeneration" capability in the application manifest. */
+
+void Py_ffi_closure_free(void *p)
+{
+    VirtualFree(p, 0, MEM_RELEASE);
+}
+
+void *Py_ffi_closure_alloc(size_t size, void** codeloc)
+{
+    void *p = VirtualAllocFromApp(NULL, size, MEM_COMMIT | MEM_RESERVE,
+                                  PAGE_READWRITE);
+    if (p == NULL) {
+        return NULL;
+    }
+#ifdef _M_ARM
+    // set Thumb bit so that blx is called correctly
+    *codeloc = (void *)((uintptr_t)p | 1);
+#else
+    *codeloc = p;
+#endif
+    return p;
+}
+
+int Py_ffi_closure_make_executable(void *p, size_t size)
+{
+    ULONG old_protect;
+    if (!VirtualProtectFromApp(p, size, PAGE_EXECUTE_READ, &old_protect)
+        || !FlushInstructionCache(GetCurrentProcess(), p, size))
+    {
+        PyErr_SetFromWindowsErr(0);
+        return -1;
+    }
+    return 0;
+}
+
+#else /* MS_WINDOWS_DESKTOP or not MS_WIN32 */
 
 #ifdef Py_GIL_DISABLED
 static PyMutex malloc_closure_lock;
@@ -68,25 +112,10 @@ static void more_core(void)
 
     /* allocate a memory block */
 #ifdef MS_WIN32
-#ifdef MS_WINDOWS_DESKTOP
     item = (ITEM *)VirtualAlloc(NULL,
                                            count * sizeof(ITEM),
                                            MEM_COMMIT,
                                            PAGE_EXECUTE_READWRITE);
-#else // UWP
-    /* Due security restrictions, UWP not allows request Read-Write-Execute permissions at once.
-       The correct flow in UWP for execute dynamic code in memmory is:
-         1. Alloate as Read-Write (PAGE_READWRITE) and write dynamic code to memmory.
-         2. Change to Executable (PAGE_EXECUTE_READ) with 'VirtualProtectFromApp'.
-         3. Flush cache with 'FlushInstructionCache' to ensure CPU instruction cache coherency
-            before executing the generated code.
-       TODO: Implement 2 and 3 in the appropriate places. For now, this defers
-       the error from import time to time of use (or never, if an app avoids it). */
-    item = (ITEM*)VirtualAllocFromApp(NULL,
-                                      count * sizeof(ITEM),
-                                      MEM_COMMIT | MEM_RESERVE,
-                                      PAGE_READWRITE);
-#endif // !MS_WINDOWS_DESKTOP
     if (item == NULL)
         return;
 #else
@@ -176,3 +205,5 @@ void *Py_ffi_closure_alloc(size_t size, void** codeloc)
     FT_MUTEX_UNLOCK(&malloc_closure_lock);
     return (void *)item;
 }
+
+#endif /* MS_WINDOWS_DESKTOP or not MS_WIN32 */