kobako 0.29.0 → 0.30.0

data/crates/kobako-wasmtime/src/preview1/path.rs

@@ -1,421 +1,302 @@
-//! The 10 `path_*` calls. Each resolves a path beneath a directory
-//! descriptor, asks its Mount what the guest may do there, and asks the
-//! Filesystem. Links and timestamps are no Filesystem's, so those calls
-//! are unsupported.
+//! The 10 `path_*` calls. Each hands the call to the runtime's VFS, which
+//! resolves the path, asks the Mount, and asks the Filesystem. What a Linux
+//! syscall entry checks before the VFS stays here, such as the order of an
+//! open's errors.
 
-use std::sync::Arc;
+use kobako_runtime::filesystem::{FilesystemError, Iattr};
+use kobako_runtime::vfs::{self, OpenHow, Start};
+use wiggle::GuestPtr;
 
-use kobako_runtime::filesystem::{
-    Access, FileType, Filesystem, FilesystemError, OpenOptions, Rename,
-};
-use kobako_runtime::mount::Mount;
-
-use super::args::{
-    self, FDFLAGS_APPEND, FDFLAGS_NONBLOCK, FDFLAGS_SYNCHRONIZED, RIGHTS_FD_READ, RIGHTS_FD_WRITE,
-};
-use super::beneath::{resolve, ResolvedPath};
 use super::errno::{Answer, Errno};
-use super::fd::write_metadata;
+use super::fd::to_filestat;
 use super::memory::GuestMemory;
-use crate::descriptors::{Descriptor, Descriptors, Identity, OpenDirectory, OpenFile};
-
-const LOOKUPFLAGS_SYMLINK_FOLLOW: u32 = 1 << 0;
-const OFLAGS_CREAT: u32 = 1 << 0;
-const OFLAGS_DIRECTORY: u32 = 1 << 1;
-const OFLAGS_EXCL: u32 = 1 << 2;
-const OFLAGS_TRUNC: u32 = 1 << 3;
+use super::types;
+use crate::descriptors::{Descriptor, Descriptors};
 
-/// The flags `path_open` takes besides the path itself.
-pub(crate) struct OpenFlags {
-    pub(crate) dirflags: u32,
-    pub(crate) oflags: u32,
-    pub(crate) rights_base: u64,
-    pub(crate) rights_inheriting: u64,
-    pub(crate) fdflags: u32,
+/// The arguments `path_open` takes besides where it starts and the path, as
+/// Linux's `openat2` takes a `struct open_how`; they become the `OpenHow` the
+/// VFS opens with.
+pub(crate) struct PathOpen {
+    pub(crate) dirflags: types::Lookupflags,
+    pub(crate) oflags: types::Oflags,
+    pub(crate) rights_base: types::Rights,
+    pub(crate) fdflags: types::Fdflags,
 }
 
-/// The directory `fd` stands for; any other descriptor is `BADF`.
-fn directory(table: &Descriptors, fd: u32) -> Answer<&OpenDirectory> {
-    match table.get(fd).ok_or(Errno::Badf)? {
-        Descriptor::Directory(dir) => Ok(dir),
-        Descriptor::Stdin(_) | Descriptor::Channel(_) | Descriptor::File(_) => {
-            Err(Errno::Badf.into())
-        }
-    }
-}
+/// How many times a call is made before a guest is answered EAGAIN, as cap-std
+/// makes `openat2` four times: any move in the process answers a `..` walking
+/// past it so, and nothing bounds how often one lands.
+const MAX_ATTEMPTS: usize = 4;
 
-/// Whether the guest may reach `path` with `access`, as its Mount
-/// decides. A Mount that follows no link refuses one first.
-fn judge(mount: &Mount, path: &str, access: Access, follows_last: bool) -> Answer {
-    if !mount.follows_links() {
-        refuse_links(mount, path, follows_last)?;
+/// What `call` answers once no move landed during its walk, made again at most
+/// `MAX_ATTEMPTS` times in all, as cap-std retries `openat2` on EAGAIN.
+pub(super) fn retry_eagain<T>(
+    mut call: impl FnMut() -> Result<T, FilesystemError>,
+) -> Result<T, FilesystemError> {
+    let mut answer = call();
+    for _ in 1..MAX_ATTEMPTS {
+        if !matches!(answer, Err(FilesystemError::WouldBlock)) {
+            break;
+        }
+        answer = call();
     }
-    Ok(mount.check(path, access)?)
+    answer
 }
 
-/// Refuse a link standing on the way to `path`, and at its end when the
-/// call would follow it, before the Mount judges a path the link would
-/// lead elsewhere.
-fn refuse_links(mount: &Mount, path: &str, follows_last: bool) -> Answer {
-    let ends = path.match_indices('/').map(|(end, _)| end);
-    for end in ends.chain(follows_last.then_some(path.len())) {
-        match mount.filesystem().symlink_metadata(&path[..end]) {
-            Ok(metadata) if metadata.file_type == FileType::Symlink => {
-                return Err(Errno::Loop.into())
-            }
-            Ok(_) => {}
-            // What is missing holds no link; the call answers for it.
-            Err(FilesystemError::NotFound | FilesystemError::NotADirectory) => break,
-            Err(err) => return Err(err.into()),
+/// Where `fd` stands, for a path to be walked from, once the guard answered for a
+/// directory there, found when the VFS has taken the name, as Linux's
+/// `path_init` takes the descriptor. What is no directory the walk itself
+/// refuses, and a move the guard meets is one a walk meets, so `retry_eagain`
+/// makes the call again.
+fn start_of(table: &Descriptors, fd: u32) -> impl vfs::Start + '_ {
+    move || {
+        let file = &table.get(fd).ok_or(FilesystemError::BadDescriptor)?.file;
+        if file.is_directory() {
+            table.walk_guard().check(file.path())?;
         }
+        Ok(file.path().clone())
     }
-    Ok(())
 }
 
-/// A path beneath `fd`, relative to its mount's root, for a call acting
-/// on what stands there rather than where a link leads: refused when it
-/// ends in `/` and names a file or a link.
-fn beneath<'a>(
-    table: &'a Descriptors,
-    mem: &GuestMemory,
-    fd: u32,
-    path: (u32, u32),
-) -> Answer<(&'a OpenDirectory, String)> {
-    let dir = directory(table, fd)?;
-    let path = resolve(dir, &mem.path(path.0, path.1)?)?.check_directory(
-        dir.mount.filesystem().as_ref(),
-        <dyn Filesystem>::symlink_metadata,
-    )?;
-    Ok((dir, path))
-}
-
-/// A trailing `/` asks for the directory being made, so it is no
-/// refusal here, as `mkdir(2)` takes it.
 pub(crate) fn create_directory(
     table: &Descriptors,
-    mem: &GuestMemory,
+    mem: &GuestMemory<'_, '_>,
     fd: u32,
-    path: (u32, u32),
+    path: GuestPtr<str>,
 ) -> Answer {
-    let dir = directory(table, fd)?;
-    let path = resolve(dir, &mem.path(path.0, path.1)?)?.path;
-    judge(&dir.mount, &path, Access::ReadWrite, false)?;
-    Ok(dir.mount.filesystem().create_dir(&path)?)
+    let path = mem.path(path)?;
+    Ok(retry_eagain(|| {
+        vfs::filename_mkdirat(table.cred(), &start_of(table, fd), &path)
+    })?)
 }
 
 pub(crate) fn filestat_get(
     table: &Descriptors,
-    mem: &mut GuestMemory,
+    mem: &GuestMemory<'_, '_>,
     fd: u32,
-    flags: u32,
-    path: (u32, u32),
-    out: u32,
-) -> Answer {
-    args::flags(flags, args::LOOKUPFLAGS)?;
-    let dir = directory(table, fd)?;
-    let resolved = resolve(dir, &mem.path(path.0, path.1)?)?;
-    // A trailing `/` resolves a link standing there, as Linux's `lstat` does.
-    let follow = flags & LOOKUPFLAGS_SYMLINK_FOLLOW != 0 || resolved.names_directory;
-    let resolved = if follow {
-        resolved.follow_last(dir, false)?
-    } else {
-        resolved
-    };
-    let filesystem = dir.mount.filesystem();
-    let path = resolved.check_directory(filesystem.as_ref(), <dyn Filesystem>::metadata)?;
-    let metadata = if follow {
-        filesystem.metadata(&path)?
-    } else {
-        filesystem.symlink_metadata(&path)?
-    };
-    write_metadata(mem, out, metadata)
+    flags: types::Lookupflags,
+    path: GuestPtr<str>,
+) -> Answer<types::Filestat> {
+    let path = mem.path(path)?;
+    let follow = flags.contains(types::Lookupflags::SYMLINK_FOLLOW);
+    let stat =
+        retry_eagain(|| vfs::vfs_fstatat(table.cred(), &start_of(table, fd), &path, follow))?;
+    Ok(to_filestat(table, stat))
 }
 
-/// A Filesystem keeps no timestamps of the guest's choosing.
 pub(crate) fn filestat_set_times(
     table: &Descriptors,
-    mem: &GuestMemory,
+    mem: &GuestMemory<'_, '_>,
     fd: u32,
-    flags: u32,
-    path: (u32, u32),
-    fst_flags: u32,
+    flags: types::Lookupflags,
+    path: GuestPtr<str>,
+    times: &Iattr,
 ) -> Answer {
-    args::flags(flags, args::LOOKUPFLAGS)?;
-    args::fstflags(fst_flags)?;
-    beneath(table, mem, fd, path)?;
-    Err(Errno::Notsup.into())
+    let path = mem.path(path)?;
+    let follow = flags.contains(types::Lookupflags::SYMLINK_FOLLOW);
+    Ok(retry_eagain(|| {
+        vfs::do_utimes_path(table.cred(), &start_of(table, fd), &path, follow, times)
+    })?)
 }
 
-/// A Filesystem holds no links, and answering as if one were made would
-/// leave the guest believing it was.
 pub(crate) fn link(
     table: &Descriptors,
-    mem: &GuestMemory,
-    old_fd: u32,
-    old_flags: u32,
-    old_path: (u32, u32),
-    new_fd: u32,
-    new_path: (u32, u32),
+    mem: &GuestMemory<'_, '_>,
+    old: (u32, GuestPtr<str>),
+    new: (u32, GuestPtr<str>),
+    flags: types::Lookupflags,
 ) -> Answer {
-    args::flags(old_flags, args::LOOKUPFLAGS)?;
-    directory(table, old_fd)?;
-    directory(table, new_fd)?;
-    mem.path(old_path.0, old_path.1)?;
-    mem.path(new_path.0, new_path.1)?;
-    Err(Errno::Notsup.into())
+    let (old_path, new_path) = (mem.path(old.1)?, mem.path(new.1)?);
+    let follow = flags.contains(types::Lookupflags::SYMLINK_FOLLOW);
+    Ok(retry_eagain(|| {
+        let (from, to) = (start_of(table, old.0), start_of(table, new.0));
+        vfs::filename_linkat(table.cred(), &from, &old_path, &to, &new_path, follow)
+    })?)
 }
 
 pub(crate) fn open(
     table: &mut Descriptors,
-    mem: &mut GuestMemory,
+    mem: &GuestMemory<'_, '_>,
     fd: u32,
-    path: (u32, u32),
-    flags: &OpenFlags,
-    out: u32,
-) -> Answer {
-    args::flags(flags.dirflags, args::LOOKUPFLAGS)?;
-    args::flags(flags.oflags, args::OFLAGS)?;
-    args::flags(flags.rights_base, args::RIGHTS)?;
-    args::flags(flags.rights_inheriting, args::RIGHTS)?;
-    args::flags(flags.fdflags, args::FDFLAGS)?;
-    let path = mem.path(path.0, path.1)?;
-    let dir = match table.get(fd).ok_or(Errno::Badf)? {
-        Descriptor::Directory(dir) => dir,
-        Descriptor::File(_) => return Err(Errno::Notdir.into()),
-        Descriptor::Stdin(_) | Descriptor::Channel(_) => return Err(Errno::Badf.into()),
-    };
-    let oflag = |bit| flags.oflags & bit != 0;
-    // A Filesystem makes no write durable on its own schedule, and every
-    // call waits for its answer, so an open asking otherwise is
-    // unsupported rather than quietly granted.
-    if flags.fdflags & (FDFLAGS_SYNCHRONIZED | FDFLAGS_NONBLOCK) != 0 {
-        return Err(Errno::Notsup.into());
-    }
-    if oflag(OFLAGS_DIRECTORY) && oflag(OFLAGS_CREAT | OFLAGS_EXCL | OFLAGS_TRUNC) {
-        return Err(Errno::Inval.into());
-    }
-    let resolved = resolve(dir, &path)?;
-    // A path ending in `/` asks for a directory, which cannot be created
-    // as a file.
-    if path.ends_with('/') && oflag(OFLAGS_CREAT) {
-        return Err(Errno::Isdir.into());
-    }
-    // A trailing `/` resolves a link standing there, as Linux's `open` does.
-    let follow = flags.dirflags & LOOKUPFLAGS_SYMLINK_FOLLOW != 0 || resolved.names_directory;
-    let resolved = if follow {
-        resolved.follow_last(dir, oflag(OFLAGS_CREAT))?
-    } else {
-        resolved
-    };
-    let path =
-        resolved.check_directory(dir.mount.filesystem().as_ref(), <dyn Filesystem>::metadata)?;
-    let mount = Arc::clone(&dir.mount);
-    if table.is_full() {
-        return Err(Errno::Mfile.into());
-    }
-
-    let read = flags.rights_base & RIGHTS_FD_READ != 0;
-    let write = flags.rights_base & RIGHTS_FD_WRITE != 0;
-    if !mount.follows_links() {
-        refuse_links(&mount, &path, follow)?;
-    }
-    let looked_up = if follow {
-        mount.filesystem().metadata(&path)
-    } else {
-        mount.filesystem().symlink_metadata(&path)
-    };
-    let (existing, identity) = match looked_up {
-        Ok(metadata) => (Some(metadata.file_type), Identity::of(&metadata)),
-        Err(FilesystemError::NotFound) => (None, None),
-        Err(err) => return Err(err.into()),
-    };
-    // What stands at the path answers before any access is judged, as
-    // Linux's `open` does on a read-only mount.
-    let refusal = match existing {
-        None if !oflag(OFLAGS_CREAT) => Some(Errno::Noent),
-        Some(_) if oflag(OFLAGS_CREAT) && oflag(OFLAGS_EXCL) => Some(Errno::Exist),
-        Some(FileType::Directory) if write || oflag(OFLAGS_TRUNC | OFLAGS_CREAT) => {
-            Some(Errno::Isdir)
-        }
-        Some(FileType::Directory) | None => None,
-        Some(_) if oflag(OFLAGS_DIRECTORY) => Some(Errno::Notdir),
-        Some(_) => None,
-    };
-    if let Some(errno) = refusal {
-        return Err(errno.into());
-    }
-    // Creating changes the Mount only where nothing stands yet, so the
-    // Mount judges the open once, knowing what it does.
-    let changes = write || oflag(OFLAGS_TRUNC) || (oflag(OFLAGS_CREAT) && existing.is_none());
-    let access = if changes {
-        Access::ReadWrite
-    } else {
-        Access::Read
-    };
-    mount.check(&path, access)?;
-    let descriptor = match existing {
-        Some(FileType::Directory) => Descriptor::Directory(OpenDirectory {
-            _hold: mount.filesystem().hold_directory(&path)?,
-            mount,
-            path,
-            identity,
-            preopen: false,
-            listing: None,
-        }),
-        Some(_) | None => {
-            let mut options = OpenOptions::default();
-            options.read = read;
-            options.write = write;
-            // A file already there is opened as it is, so a host that opens
-            // only to create never asks for more than the guest.
-            options.create = oflag(OFLAGS_CREAT) && existing.is_none();
-            options.create_new = oflag(OFLAGS_CREAT) && oflag(OFLAGS_EXCL);
-            options.truncate = oflag(OFLAGS_TRUNC);
-            options.nofollow = !follow;
-            Descriptor::File(OpenFile {
-                file: mount.filesystem().open(&path, &options)?,
-                position: 0,
-                append: flags.fdflags & FDFLAGS_APPEND != 0,
-                readable: read,
-                writable: write,
-                mount,
-            })
-        }
-    };
-    let opened = table.push(descriptor).ok_or(Errno::Mfile)?;
-    mem.write_u32(out, opened)
+    path: GuestPtr<str>,
+    call: &PathOpen,
+) -> Answer<types::Fd> {
+    let oflags = call.oflags;
+    let mut how = OpenHow::default();
+    // wasi-libc asks `fd_read` and `fd_readdir` for `O_RDONLY` and neither for
+    // `O_SEARCH`, which glibc spells `O_PATH`; wasi-testsuite lists a
+    // directory opened with `fd_readdir` alone, and makes a file asking no
+    // right at all, which only an `O_RDONLY` open does.
+    how.create = oflags.contains(types::Oflags::CREAT);
+    how.exclusive = oflags.contains(types::Oflags::EXCL);
+    how.truncate = oflags.contains(types::Oflags::TRUNC);
+    how.write = call.rights_base.contains(types::Rights::FD_WRITE);
+    how.read = call
+        .rights_base
+        .intersects(types::Rights::FD_READ | types::Rights::FD_READDIR)
+        || (!how.write && (how.create || how.truncate));
+    how.directory = oflags.contains(types::Oflags::DIRECTORY);
+    how.follow = call.dirflags.contains(types::Lookupflags::SYMLINK_FOLLOW);
+    how.append = call.fdflags.contains(types::Fdflags::APPEND);
+    how.nonblock = call.fdflags.contains(types::Fdflags::NONBLOCK);
+    how.dsync = call.fdflags.contains(types::Fdflags::DSYNC);
+    how.sync = call
+        .fdflags
+        .intersects(types::Fdflags::RSYNC | types::Fdflags::SYNC);
+    // Linux's `do_sys_openat2` builds the flags, then reserves a descriptor
+    // before `do_file_open` answers for the name, so a full table answers
+    // whatever the path names.
+    let op = vfs::build_open_flags(&how)?;
+    let new = table.lowest_unused().ok_or(Errno::Mfile)?;
+    let path = mem.path(path)?;
+    let file = retry_eagain(|| vfs::do_file_open(table.cred(), &start_of(table, fd), &path, &op))?;
+    table.place(new, Descriptor::for_file(file));
+    Ok(new.into())
 }
 
-/// A Filesystem holds no links to read.
 pub(crate) fn readlink(
     table: &Descriptors,
-    mem: &GuestMemory,
+    mem: &mut GuestMemory<'_, '_>,
     fd: u32,
-    path: (u32, u32),
-) -> Answer {
-    beneath(table, mem, fd, path)?;
-    Err(Errno::Notsup.into())
-}
-
-/// Refuse a guest path ending in `.` or `..` as `refusal`, since it names
-/// no entry a call may remove or move. Linux looks up what stands before
-/// it first, so a missing or non-directory parent answers as itself.
-fn refuse_dot_end(dir: &OpenDirectory, path: &str, refusal: Errno) -> Answer {
-    let trimmed = path.trim_end_matches('/');
-    let (parent, last) = trimmed.rsplit_once('/').unwrap_or(("", trimmed));
-    if !matches!(last, "." | "..") {
-        return Ok(());
-    }
-    if !parent.is_empty() {
-        let parent = resolve(dir, parent)?.path;
-        if dir.mount.filesystem().metadata(&parent)?.file_type != FileType::Directory {
-            return Err(Errno::Notdir.into());
-        }
+    path: GuestPtr<str>,
+    buf: GuestPtr<u8>,
+    buf_len: types::Size,
+) -> Answer<types::Size> {
+    if buf_len == 0 {
+        return Err(Errno::Inval.into());
     }
-    Err(refusal.into())
+    let path = mem.path(path)?;
+    let target = retry_eagain(|| vfs::do_readlinkat(table.cred(), &start_of(table, fd), &path))?;
+    write_link(mem, &target, buf, buf_len)
 }
 
-/// A Mount's root is where the guest stands, not a directory it may
-/// remove or move; each call refuses it as Linux refuses its own root.
-fn refuse_root(path: &str, refusal: Errno) -> Answer {
-    if path.is_empty() {
-        return Err(refusal.into());
-    }
-    Ok(())
+/// As much of where a link points as the buffer holds, as `readlink` cuts it
+/// off there without saying so.
+fn write_link(
+    mem: &mut GuestMemory<'_, '_>,
+    target: &str,
+    buf: GuestPtr<u8>,
+    buf_len: types::Size,
+) -> Answer<types::Size> {
+    let take = target.len().min(buf_len as usize);
+    mem.write_bytes(buf, &target.as_bytes()[..take])?;
+    Ok(take as u32)
 }
 
 pub(crate) fn remove_directory(
     table: &Descriptors,
-    mem: &GuestMemory,
+    mem: &GuestMemory<'_, '_>,
     fd: u32,
-    path: (u32, u32),
+    path: GuestPtr<str>,
 ) -> Answer {
-    refuse_dot_end(
-        directory(table, fd)?,
-        &mem.path(path.0, path.1)?,
-        Errno::Inval,
-    )?;
-    let (dir, path) = beneath(table, mem, fd, path)?;
-    refuse_root(&path, Errno::Inval)?;
-    judge(&dir.mount, &path, Access::ReadWrite, false)?;
-    Ok(dir.mount.filesystem().remove_dir(&path)?)
+    let path = mem.path(path)?;
+    Ok(retry_eagain(|| {
+        vfs::filename_rmdir(table.cred(), &start_of(table, fd), &path)
+    })?)
 }
 
-/// A rename stays within one Mount; across two it is `XDEV`, as
-/// across two mounted devices. A directory moves only beneath a Mount
-/// that allows it, the Filesystem checking what it moves as it moves it.
 pub(crate) fn rename(
     table: &Descriptors,
-    mem: &GuestMemory,
-    old: (u32, (u32, u32)),
-    new: (u32, (u32, u32)),
+    mem: &GuestMemory<'_, '_>,
+    old: (u32, GuestPtr<str>),
+    new: (u32, GuestPtr<str>),
 ) -> Answer {
-    let from_dir = directory(table, old.0)?;
-    let to_dir = directory(table, new.0)?;
-    let (from, to) = (mem.path(old.1 .0, old.1 .1)?, mem.path(new.1 .0, new.1 .1)?);
-    refuse_dot_end(from_dir, &from, Errno::Busy)?;
-    refuse_dot_end(to_dir, &to, Errno::Busy)?;
-    let from = resolve(from_dir, &from)?;
-    let to = resolve(to_dir, &to)?;
-    refuse_root(&from.path, Errno::Busy)?;
-    refuse_root(&to.path, Errno::Busy)?;
-    // A trailing `/` on either side asks that the source be a directory,
-    // which `rename(2)` checks before it finds a rename onto its own path
-    // leaves everything as it was. A rename moves a link rather than what
-    // it points at, so each side is checked as it stands.
-    let names_directory = from.names_directory || to.names_directory;
-    let from = ResolvedPath {
-        names_directory,
-        ..from
-    }
-    .check_directory(
-        from_dir.mount.filesystem().as_ref(),
-        <dyn Filesystem>::symlink_metadata,
-    )?;
-    let to = match to {
-        to if to.path == from => to.path,
-        to => to.check_directory(
-            to_dir.mount.filesystem().as_ref(),
-            <dyn Filesystem>::symlink_metadata,
-        )?,
-    };
-    if !Arc::ptr_eq(&from_dir.mount, &to_dir.mount) {
-        return Err(Errno::Xdev.into());
-    }
-    judge(&from_dir.mount, &from, Access::ReadWrite, false)?;
-    judge(&to_dir.mount, &to, Access::ReadWrite, false)?;
-    let rename = match (from_dir.mount.moves_directories(), names_directory) {
-        (false, _) => Rename::File,
-        (true, true) => Rename::Directory,
-        (true, false) => Rename::Any,
-    };
-    Ok(from_dir.mount.filesystem().rename(&from, &to, rename)?)
+    let (from_path, to_path) = (mem.path(old.1)?, mem.path(new.1)?);
+    Ok(retry_eagain(|| {
+        let (from, to) = (start_of(table, old.0), start_of(table, new.0));
+        vfs::filename_renameat2(table.cred(), &from, &from_path, &to, &to_path)
+    })?)
 }
 
-/// A Filesystem holds no links to make.
 pub(crate) fn symlink(
     table: &Descriptors,
-    mem: &GuestMemory,
-    old_path: (u32, u32),
+    mem: &GuestMemory<'_, '_>,
+    old_path: GuestPtr<str>,
     fd: u32,
-    new_path: (u32, u32),
+    new_path: GuestPtr<str>,
 ) -> Answer {
-    directory(table, fd)?;
-    mem.path(old_path.0, old_path.1)?;
-    mem.path(new_path.0, new_path.1)?;
-    Err(Errno::Notsup.into())
+    let (target, path) = (mem.path(old_path)?, mem.path(new_path)?);
+    // wasi-testsuite's symlink_create has a guest make no link to an absolute
+    // path, where Linux would make one; a guest walks none of them anyway. It
+    // is refused once the start is found, where the link would be made.
+    let start = || -> Result<vfs::Path, FilesystemError> {
+        let start = start_of(table, fd).path_init()?;
+        match target.starts_with('/') {
+            true => Err(FilesystemError::NotPermitted),
+            false => Ok(start),
+        }
+    };
+    Ok(retry_eagain(|| {
+        vfs::filename_symlinkat(table.cred(), &target, &start, &path)
+    })?)
 }
 
 pub(crate) fn unlink_file(
     table: &Descriptors,
-    mem: &GuestMemory,
+    mem: &GuestMemory<'_, '_>,
     fd: u32,
-    path: (u32, u32),
+    path: GuestPtr<str>,
 ) -> Answer {
-    // Linux's `unlink` follows no link at the end, so a trailing `/` is
-    // answered by the name itself: no file removes as a directory.
-    let (dir, path) = beneath(table, mem, fd, path)?;
-    refuse_root(&path, Errno::Isdir)?;
-    judge(&dir.mount, &path, Access::ReadWrite, false)?;
-    Ok(dir.mount.filesystem().remove_file(&path)?)
+    let path = mem.path(path)?;
+    Ok(retry_eagain(|| {
+        vfs::filename_unlinkat(table.cred(), &start_of(table, fd), &path)
+    })?)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    // Every Invocation holds to the hook refusing a readlink, so no guest call
+    // reaches this; only the encoding itself can witness it.
+    #[test]
+    fn a_link_is_cut_off_where_the_buffer_ends() {
+        let mut bytes = [0u8; 8];
+        let answered = {
+            let mut memory = wiggle::GuestMemory::Unshared(&mut bytes);
+            let mut mem = GuestMemory::new(&mut memory, 64);
+            write_link(&mut mem, "target", GuestPtr::new(2), 3)
+                .unwrap_or_else(|_| panic!("the link must write"))
+        };
+        assert_eq!(
+            (answered, &bytes),
+            (3, b"\0\0tar\0\0\0"),
+            "where a link points through path_readlink must fill the buffer and answer what fit"
+        );
+    }
+
+    /// What `retry_eagain` answers when the first `moves` calls each had a move
+    /// land in them, and how many calls it made.
+    fn retry_after_moves(moves: usize) -> (Result<(), FilesystemError>, usize) {
+        let mut made = 0;
+        let answer = retry_eagain(|| {
+            made += 1;
+            match made <= moves {
+                true => Err(FilesystemError::WouldBlock),
+                false => Ok(()),
+            }
+        });
+        (answer, made)
+    }
+
+    // A move lands during a walk only between two of its steps, which no guest
+    // call can time, so the retry itself witnesses it.
+    // @behavior RT-256
+    #[test]
+    fn a_path_call_a_move_landed_in_is_made_again_four_times_at_most() {
+        assert_eq!(
+            [
+                retry_after_moves(0),
+                retry_after_moves(3),
+                retry_after_moves(4)
+            ],
+            [
+                (Ok(()), 1),
+                (Ok(()), 4),
+                (Err(FilesystemError::WouldBlock), 4),
+            ],
+            "a path_* call answered EAGAIN must be made again until it answers otherwise, four \
+             times in all at most, as cap-std makes openat2"
+        );
+    }
 }