kobako 0.29.0 → 0.30.0

data/crates/kobako-wasmtime/tests/{guest_file.rs → integration/guest_file.rs}

@@ -2,18 +2,20 @@
 //! writes beneath a mounted path, and how it fails where nothing is
 //! mounted, nothing is there, or the Mount only reads.
 
-mod support;
+use crate::support;
 
 use std::sync::atomic::{AtomicUsize, Ordering};
 use std::sync::Arc;
 
-use kobako_runtime::filesystem::Access;
 use kobako_runtime::filesystem::{
-    DirEntry, File, Filesystem, FilesystemError, Memory, Metadata, OpenOptions, Rename,
+    FileOperations, FileSystemType, FileType, Filesystem, FilesystemError, Finish, InodeOperations,
+    Kiocb, Kstat, Lookup, OpenHow, Tmpfs,
 };
 use kobako_runtime::grant::Grant;
-use kobako_runtime::mount::Mount;
-use kobako_runtime::Hold;
+use kobako_runtime::mount::{Access, Mount};
+use kobako_runtime::security::prepare_creds_within;
+use kobako_runtime::vfs::Inode;
+use kobako_runtime::vfs::{self, Dentry, Path};
 use kobako_runtime::{Completion, Entry, Runtime};
 use kobako_transport::envelope::{Flag, Outcome, Preamble};
 
@@ -43,24 +45,42 @@ fn run(source: &str, grants: &[Grant], flags: Vec<Flag>) -> Option<Result<String
     })
 }
 
-fn mount(filesystem: Arc<dyn Filesystem>, access: Access) -> Grant {
-    Grant::Mount(Mount::new("/data", filesystem, access).expect("/data is a guest path"))
+fn mount(filesystem: Arc<dyn FileSystemType>, access: Access) -> Grant {
+    Grant::Mount(
+        Mount::new(
+            "/data",
+            Filesystem::new(filesystem).expect("the instance must stand"),
+            access,
+        )
+        .expect("/data is a guest path"),
+    )
 }
 
-fn note_memory() -> Arc<Memory> {
+fn note_tmpfs() -> Arc<Tmpfs> {
     Arc::new([("note.txt", "hello\nworld\n")].into_iter().collect())
 }
 
-fn contents(filesystem: &dyn Filesystem, path: &str) -> Vec<u8> {
-    let mut file = filesystem
-        .open(path, &{
-            let mut options = OpenOptions::default();
-            options.read = true;
-            options
-        })
-        .expect("the file must exist");
+/// The root of `filesystem` as the host reaches it through the VFS.
+fn host<F: FileSystemType>(filesystem: &Arc<F>) -> Path {
+    let filesystem = Filesystem::new(filesystem.clone()).expect("the instance must stand");
+    let mount = Mount::new("/data", filesystem, Access::Read).expect("/data is a guest path");
+    Path::root(mount.mnt())
+}
+
+fn contents<F: FileSystemType>(filesystem: &Arc<F>, path: &str) -> Vec<u8> {
+    let mut how = OpenHow::default();
+    how.read = true;
+    let op = vfs::build_open_flags(&how).expect("a read means an open");
+    let Ok(mut file) = vfs::do_file_open(
+        &prepare_creds_within(&[], None),
+        &host(filesystem),
+        path,
+        &op,
+    ) else {
+        panic!("the file must exist");
+    };
     let mut buf = vec![0; 64];
-    let read = file.read_at(&mut buf, 0).expect("the file must read");
+    let read = file.pread(&mut buf, 0).expect("the file must read");
     buf.truncate(read);
     buf
 }
@@ -70,7 +90,7 @@ fn contents(filesystem: &dyn Filesystem, path: &str) -> Vec<u8> {
 fn a_script_reads_a_file_beneath_a_mounted_path() {
     let Some(answer) = run(
         r#"print File.read("/data/note.txt")"#,
-        &[mount(note_memory(), Access::Read)],
+        &[mount(note_tmpfs(), Access::Read)],
         Vec::new(),
     ) else {
         return;
@@ -85,10 +105,10 @@ fn a_script_reads_a_file_beneath_a_mounted_path() {
 // @behavior FL-002
 #[test]
 fn a_script_writes_a_file_beneath_a_read_write_mount() {
-    let memory = Arc::new(Memory::new());
+    let tmpfs = Arc::new(Tmpfs::new());
     let Some(answer) = run(
         r#"print File.open("/data/out.txt", "w") { |f| f.write("kept"); :done }"#,
-        &[mount(memory.clone(), Access::ReadWrite)],
+        &[mount(tmpfs.clone(), Access::ReadWrite)],
         Vec::new(),
     ) else {
         return;
@@ -99,9 +119,9 @@ fn a_script_writes_a_file_beneath_a_read_write_mount() {
         "File.open must answer its block's value"
     );
     assert_eq!(
-        contents(memory.as_ref(), "out.txt"),
+        contents(&tmpfs, "out.txt"),
         b"kept",
-        "a file written in File.open's block through the bundled guest must land in the Memory"
+        "a file written in File.open's block through the bundled guest must land in the Tmpfs"
     );
 }
 
@@ -110,7 +130,7 @@ fn a_script_writes_a_file_beneath_a_read_write_mount() {
 fn a_script_reads_a_file_line_by_line() {
     let Some(answer) = run(
         r#"File.open("/data/note.txt") { |f| f.each_line { |line| print line.upcase } }; nil"#,
-        &[mount(note_memory(), Access::Read)],
+        &[mount(note_tmpfs(), Access::Read)],
         Vec::new(),
     ) else {
         return;
@@ -141,7 +161,7 @@ fn opening_a_file_with_nothing_mounted_is_unimplemented() {
 fn opening_a_missing_file_raises_enoent() {
     let Some(answer) = run(
         r#"File.read("/data/missing.txt")"#,
-        &[mount(note_memory(), Access::Read)],
+        &[mount(note_tmpfs(), Access::Read)],
         Vec::new(),
     ) else {
         return;
@@ -159,7 +179,7 @@ fn opening_a_missing_file_raises_enoent() {
 fn writing_beneath_a_read_only_mount_raises_erofs() {
     let Some(answer) = run(
         r#"File.write("/data/note.txt", "changed")"#,
-        &[mount(note_memory(), Access::Read)],
+        &[mount(note_tmpfs(), Access::Read)],
         Vec::new(),
     ) else {
         return;
@@ -176,7 +196,7 @@ fn writing_beneath_a_read_only_mount_raises_erofs() {
 // @behavior FL-012
 #[test]
 fn a_write_past_a_mounts_space_raises_enospc() {
-    let full = Arc::new(Memory::new().with_limit(Some(4)));
+    let full = Arc::new(Tmpfs::new().with_size(Some(4)));
     let Some(answer) = run(
         r#"File.open("/data/note.txt", "w") { |file| file.write("five!") }"#,
         &[mount(full, Access::ReadWrite)],
@@ -187,7 +207,7 @@ fn a_write_past_a_mounts_space_raises_enospc() {
     assert_eq!(
         answer,
         Err("Errno::ENOSPC".to_string()),
-        "IO#write past a Memory's limit through the bundled guest must raise Errno::ENOSPC"
+        "IO#write past a Tmpfs's limit through the bundled guest must raise Errno::ENOSPC"
     );
 }
 
@@ -214,7 +234,7 @@ fn a_name_or_path_past_linuxs_limits_raises_enametoolong() {
     "#;
     let Some(answer) = run(
         script,
-        &[mount(Arc::new(Memory::new()), Access::ReadWrite)],
+        &[mount(Arc::new(Tmpfs::new()), Access::ReadWrite)],
         Vec::new(),
     ) else {
         return;
@@ -233,7 +253,7 @@ fn a_name_or_path_past_linuxs_limits_raises_enametoolong() {
 fn a_code_the_engine_answers_raises_its_own_errno() {
     let Some(answer) = run(
         r#"File.rename("/data", "/data/moved")"#,
-        &[mount(note_memory(), Access::ReadWrite)],
+        &[mount(note_tmpfs(), Access::ReadWrite)],
         Vec::new(),
     ) else {
         return;
@@ -281,7 +301,7 @@ fn the_disable_file_flag_removes_file() {
 fn an_io_may_stand_for_a_file_the_guest_opened() {
     let Some(answer) = run(
         r#"File.open("/data/note.txt") { |f| print IO.new(f.fileno, "r").read }; nil"#,
-        &[mount(note_memory(), Access::Read)],
+        &[mount(note_tmpfs(), Access::Read)],
         Vec::new(),
     ) else {
         return;
@@ -298,16 +318,16 @@ fn an_io_may_stand_for_a_file_the_guest_opened() {
 // @behavior FL-024
 #[test]
 fn an_exclusive_create_refuses_a_file_already_there() {
-    let memory = note_memory();
+    let tmpfs = note_tmpfs();
     let Some(answer) = run(
         r#"File.open("/data/note.txt", "wx") { |f| f.write("lost") }"#,
-        &[mount(memory.clone(), Access::ReadWrite)],
+        &[mount(tmpfs.clone(), Access::ReadWrite)],
         Vec::new(),
     ) else {
         return;
     };
     assert_eq!(
-        (answer, contents(memory.as_ref(), "note.txt")),
+        (answer, contents(&tmpfs, "note.txt")),
         (Err("Errno::EEXIST".to_string()), b"hello\nworld\n".to_vec()),
         "File.open with wx of a file already there through the bundled guest must raise \
          Errno::EEXIST and leave the file as it was"
@@ -317,16 +337,16 @@ fn an_exclusive_create_refuses_a_file_already_there() {
 // @behavior FL-025
 #[test]
 fn an_exclusive_create_makes_a_file_nothing_is_at() {
-    let memory = Arc::new(Memory::new());
+    let tmpfs = Arc::new(Tmpfs::new());
     let Some(answer) = run(
         r#"File.open("/data/lock", "w+x") { |f| f.write("mine") }; nil"#,
-        &[mount(memory.clone(), Access::ReadWrite)],
+        &[mount(tmpfs.clone(), Access::ReadWrite)],
         Vec::new(),
     ) else {
         return;
     };
     assert_eq!(
-        (answer, contents(memory.as_ref(), "lock")),
+        (answer, contents(&tmpfs, "lock")),
         (Ok(String::new()), b"mine".to_vec()),
         "File.open with w+x of a path nothing is at through the bundled guest must create the \
          file with what was written"
@@ -351,7 +371,7 @@ fn an_access_mode_cruby_refuses_raises_argument_error() {
     "#;
     let Some(answer) = run(
         script,
-        &[mount(note_memory(), Access::ReadWrite)],
+        &[mount(note_tmpfs(), Access::ReadWrite)],
         Vec::new(),
     ) else {
         return;
@@ -371,16 +391,16 @@ fn an_access_mode_cruby_refuses_raises_argument_error() {
 // @behavior FL-027
 #[test]
 fn an_integer_mode_opens_by_its_file_constants_flags() {
-    let memory = note_memory();
+    let tmpfs = note_tmpfs();
     let Some(answer) = run(
         r#"File.open("/data/note.txt", File::WRONLY | File::CREAT | File::EXCL) { }"#,
-        &[mount(memory.clone(), Access::ReadWrite)],
+        &[mount(tmpfs.clone(), Access::ReadWrite)],
         Vec::new(),
     ) else {
         return;
     };
     assert_eq!(
-        (answer, contents(memory.as_ref(), "note.txt")),
+        (answer, contents(&tmpfs, "note.txt")),
         (Err("Errno::EEXIST".to_string()), b"hello\nworld\n".to_vec()),
         "File.open with WRONLY | CREAT | EXCL of a file already there through the bundled guest \
          must raise Errno::EEXIST and leave the file as it was"
@@ -392,16 +412,25 @@ fn an_integer_mode_opens_by_its_file_constants_flags() {
 // @behavior FL-028
 #[test]
 fn an_exclusive_open_without_create_makes_no_file() {
-    let memory = Arc::new(Memory::new());
+    let tmpfs = Arc::new(Tmpfs::new());
     let Some(answer) = run(
         r#"File.open("/data/lock", File::RDONLY | File::EXCL) { }"#,
-        &[mount(memory.clone(), Access::ReadWrite)],
+        &[mount(tmpfs.clone(), Access::ReadWrite)],
         Vec::new(),
     ) else {
         return;
     };
     assert_eq!(
-        (answer, memory.metadata("lock").is_err()),
+        (
+            answer,
+            vfs::vfs_fstatat(
+                &prepare_creds_within(&[], None),
+                &host(&tmpfs),
+                "lock",
+                false
+            )
+            .is_err()
+        ),
         (Err("Errno::ENOENT".to_string()), true),
         "File.open with RDONLY | EXCL of a path nothing is at through the bundled guest must \
          raise Errno::ENOENT and make no file"
@@ -427,7 +456,7 @@ fn an_integer_mode_with_a_flag_file_constants_lacks_raises_einval() {
     "#;
     let Some(answer) = run(
         script,
-        &[mount(note_memory(), Access::ReadWrite)],
+        &[mount(note_tmpfs(), Access::ReadWrite)],
         Vec::new(),
     ) else {
         return;
@@ -444,7 +473,7 @@ fn an_integer_mode_with_a_flag_file_constants_lacks_raises_einval() {
 // @behavior FL-031
 #[test]
 fn rdonly_beside_wronly_opens_to_write_only() {
-    let memory = note_memory();
+    let tmpfs = note_tmpfs();
     let script = r#"
         File.open("/data/note.txt", File::RDONLY | File::WRONLY) do |file|
           file.write("J")
@@ -457,13 +486,13 @@ fn rdonly_beside_wronly_opens_to_write_only() {
     "#;
     let Some(answer) = run(
         script,
-        &[mount(memory.clone(), Access::ReadWrite)],
+        &[mount(tmpfs.clone(), Access::ReadWrite)],
         Vec::new(),
     ) else {
         return;
     };
     assert_eq!(
-        (answer, contents(memory.as_ref(), "note.txt")),
+        (answer, contents(&tmpfs, "note.txt")),
         (Ok("IOError".to_string()), b"Jello\nworld\n".to_vec()),
         "File.open with RDONLY | WRONLY through the bundled guest must write and raise IOError \
          on a read"
@@ -472,18 +501,18 @@ fn rdonly_beside_wronly_opens_to_write_only() {
 
 // Neither open asks to write, so only a mode that reaches the host as it
 // stands, rather than one refused before it leaves the guest, changes
-// the Memory.
+// the Tmpfs.
 // @behavior FL-032
 #[test]
 fn an_integer_mode_may_create_or_truncate_without_asking_to_write() {
-    let memory = note_memory();
+    let tmpfs = note_tmpfs();
     let script = r#"
         File.open("/data/lock", File::CREAT | File::EXCL) { }
         File.open("/data/note.txt", File::RDONLY | File::TRUNC) { }
     "#;
     let Some(answer) = run(
         script,
-        &[mount(memory.clone(), Access::ReadWrite)],
+        &[mount(tmpfs.clone(), Access::ReadWrite)],
         Vec::new(),
     ) else {
         return;
@@ -491,8 +520,8 @@ fn an_integer_mode_may_create_or_truncate_without_asking_to_write() {
     assert_eq!(
         (
             answer,
-            contents(memory.as_ref(), "lock"),
-            contents(memory.as_ref(), "note.txt")
+            contents(&tmpfs, "lock"),
+            contents(&tmpfs, "note.txt")
         ),
         (Ok(String::new()), Vec::new(), Vec::new()),
         "File.open with CREAT | EXCL of a new path and with RDONLY | TRUNC of a file through the \
@@ -503,17 +532,27 @@ fn an_integer_mode_may_create_or_truncate_without_asking_to_write() {
 // @behavior FL-033
 #[test]
 fn a_path_holding_a_nul_byte_raises_argument_error() {
+    let script = r#"
+        path = "/data/note.txt\0x"
+        calls = [-> { File.open(path) { } }, -> { File.read(path) }, -> { File.write(path, "x") },
+                 -> { File.exist?(path) }, -> { File.stat(path) }, -> { Dir.exist?(path) },
+                 -> { Dir.children(path) }]
+        print calls.map { |call| begin; call.call; "none"; rescue Exception => e; e.class.to_s; end }.join(",")
+    "#;
     let Some(answer) = run(
-        r#"File.open("/data/note.txt\0x") { }"#,
-        &[mount(note_memory(), Access::ReadWrite)],
+        script,
+        &[mount(note_tmpfs(), Access::ReadWrite)],
         Vec::new(),
     ) else {
         return;
     };
     assert_eq!(
         answer,
-        Err("ArgumentError".to_string()),
-        "File.open of a path holding a NUL byte through the bundled guest must raise ArgumentError"
+        Ok("ArgumentError,ArgumentError,ArgumentError,ArgumentError,ArgumentError,ArgumentError,\
+            ArgumentError"
+            .to_string()),
+        "File.open, File.read, File.write, File.exist?, File.stat, Dir.exist?, and Dir.children of a \
+         path holding a NUL byte through the bundled guest must each raise ArgumentError"
     );
 }
 
@@ -538,104 +577,122 @@ fn file_constants_names_the_flags_an_open_honors() {
     );
 }
 
-/// A Memory whose every open file is handed through `wrap` first.
+/// A Tmpfs whose every open file is handed through `wrap` first.
 struct WrapsFiles<W> {
-    memory: Memory,
-    wrap: W,
+    inner: Arc<dyn InodeOperations>,
+    wrap: Arc<W>,
 }
 
 impl<W> WrapsFiles<W> {
     fn over_note(contents: &str, wrap: W) -> Arc<Self> {
+        let tmpfs: Tmpfs = [("note.txt", contents)].into_iter().collect();
         Arc::new(Self {
-            memory: [("note.txt", contents)].into_iter().collect(),
-            wrap,
+            inner: Arc::new(tmpfs),
+            wrap: Arc::new(wrap),
         })
     }
 }
 
-impl<W, F> Filesystem for WrapsFiles<W>
+impl<W, F> WrapsFiles<W>
 where
-    W: Fn(Box<dyn File>) -> F + Send + Sync,
-    F: File + 'static,
+    W: Fn(Box<dyn FileOperations>) -> F + Send + Sync + 'static,
+    F: FileOperations + 'static,
 {
-    fn open(&self, path: &str, options: &OpenOptions) -> Result<Box<dyn File>, FilesystemError> {
-        Ok(Box::new((self.wrap)(self.memory.open(path, options)?)))
-    }
-
-    fn metadata(&self, path: &str) -> Result<Metadata, FilesystemError> {
-        self.memory.metadata(path)
-    }
-
-    fn symlink_metadata(&self, path: &str) -> Result<Metadata, FilesystemError> {
-        self.memory.symlink_metadata(path)
-    }
-
-    fn stored_path(&self, path: &str) -> Result<String, FilesystemError> {
-        self.memory.stored_path(path)
-    }
-
-    fn canonicalize_beneath(&self, base: &str, path: &str) -> Result<String, FilesystemError> {
-        self.memory.canonicalize_beneath(base, path)
-    }
-
-    fn for_policy(&self) -> Option<Arc<dyn Filesystem>> {
-        self.memory.for_policy()
-    }
-
-    fn hold_directory(&self, path: &str) -> Result<Option<Hold>, FilesystemError> {
-        self.memory.hold_directory(path)
+    /// `found` with the entry it names handing its files through `wrap` too.
+    fn wrap_found(&self, found: Lookup) -> Lookup {
+        match found {
+            Lookup::Found(inode) => Lookup::Found(inode.with_ops(Arc::new(Self {
+                inner: inode.ops().clone(),
+                wrap: self.wrap.clone(),
+            }))),
+            other => other,
+        }
     }
+}
 
-    fn read_dir(&self, path: &str) -> Result<Vec<DirEntry>, FilesystemError> {
-        self.memory.read_dir(path)
+impl<W, F> FileSystemType for WrapsFiles<W>
+where
+    W: Fn(Box<dyn FileOperations>) -> F + Send + Sync + 'static,
+    F: FileOperations + 'static,
+{
+    fn fill_super(self: Arc<Self>, sb: &mut Filesystem) -> Result<(), FilesystemError> {
+        sb.d_make_root(Inode::new(&Kstat::new(FileType::Dir, 0), self));
+        Ok(())
     }
+}
 
-    fn create_dir(&self, path: &str) -> Result<(), FilesystemError> {
-        self.memory.create_dir(path)
+impl<W, F> InodeOperations for WrapsFiles<W>
+where
+    W: Fn(Box<dyn FileOperations>) -> F + Send + Sync + 'static,
+    F: FileOperations + 'static,
+{
+    fn getattr(&self, dentry: &Dentry) -> Result<Kstat, FilesystemError> {
+        self.inner.getattr(dentry)
     }
 
-    fn remove_dir(&self, path: &str) -> Result<(), FilesystemError> {
-        self.memory.remove_dir(path)
+    fn setattr(
+        &self,
+        dentry: &Dentry,
+        attr: &kobako_runtime::filesystem::Iattr,
+    ) -> Result<(), FilesystemError> {
+        self.inner.setattr(dentry, attr)
     }
 
-    fn remove_file(&self, path: &str) -> Result<(), FilesystemError> {
-        self.memory.remove_file(path)
+    fn lookup(&self, dentry: &Dentry) -> Result<Lookup, FilesystemError> {
+        Ok(self.wrap_found(self.inner.lookup(dentry)?))
     }
 
-    fn rename(&self, from: &str, to: &str, rename: Rename) -> Result<(), FilesystemError> {
-        self.memory.rename(from, to, rename)
+    fn open(
+        &self,
+        dentry: &Dentry,
+        how: &OpenHow,
+    ) -> Result<Box<dyn FileOperations>, FilesystemError> {
+        let opened = self.inner.open(dentry, how)?;
+        if dentry
+            .inode()
+            .is_none_or(|inode| inode.kind() == kobako_runtime::filesystem::FileType::Dir)
+        {
+            return Ok(opened);
+        }
+        Ok(Box::new((self.wrap)(opened)))
     }
 
-    fn for_invocation(&self) -> Option<Arc<dyn Filesystem>> {
-        self.memory.for_invocation()
+    /// Opens what it made, as a Filesystem ending in `finish_open` does, so the
+    /// new file is wrapped too; what it only looked up is handed back wrapped.
+    fn atomic_open(&self, dentry: &Dentry, how: &OpenHow) -> Result<Finish, FilesystemError> {
+        let (made, created) = match self.inner.atomic_open(dentry, how)? {
+            Finish::Open { file, created } => (file, created),
+            Finish::NoOpen { created } => (self.inner.open(dentry, how)?, created),
+            Finish::Lookup(found) => return Ok(Finish::Lookup(self.wrap_found(found))),
+            Finish::Spelled { file, name, inode } => {
+                let Lookup::Found(inode) = self.wrap_found(Lookup::Found(inode)) else {
+                    unreachable!("a found entry stays found once wrapped");
+                };
+                let file = Box::new((self.wrap)(file));
+                return Ok(Finish::Spelled { file, name, inode });
+            }
+            _ => unreachable!("Finish has no other end"),
+        };
+        Ok(Finish::Open {
+            file: Box::new((self.wrap)(made)),
+            created,
+        })
     }
 }
 
 struct CountedFile {
-    file: Box<dyn File>,
+    file: Box<dyn FileOperations>,
     reads: Arc<AtomicUsize>,
 }
 
-impl File for CountedFile {
-    fn read_at(&mut self, buf: &mut [u8], offset: u64) -> Result<usize, FilesystemError> {
+impl FileOperations for CountedFile {
+    fn read_iter(&mut self, iocb: &mut Kiocb, buf: &mut [u8]) -> Result<usize, FilesystemError> {
         self.reads.fetch_add(1, Ordering::Relaxed);
-        self.file.read_at(buf, offset)
-    }
-
-    fn write_at(&mut self, buf: &[u8], offset: u64) -> Result<usize, FilesystemError> {
-        self.file.write_at(buf, offset)
-    }
-
-    fn append(&mut self, buf: &[u8]) -> Result<(u64, usize), FilesystemError> {
-        self.file.append(buf)
-    }
-
-    fn metadata(&self) -> Result<Metadata, FilesystemError> {
-        self.file.metadata()
+        self.file.read_iter(iocb, buf)
     }
 
-    fn set_len(&mut self, len: u64) -> Result<(), FilesystemError> {
-        self.file.set_len(len)
+    fn write_iter(&mut self, iocb: &mut Kiocb, buf: &[u8]) -> Result<usize, FilesystemError> {
+        self.file.write_iter(iocb, buf)
     }
 }
 
@@ -667,56 +724,32 @@ fn a_read_of_a_length_asks_the_filesystem_once() {
 
 /// An open file whose Filesystem refuses to release it, as a database
 /// refusing the commit a close stands for.
-struct RefusesClose(Box<dyn File>);
+struct RefusesClose(Box<dyn FileOperations>);
 
-impl File for RefusesClose {
-    fn read_at(&mut self, buf: &mut [u8], offset: u64) -> Result<usize, FilesystemError> {
-        self.0.read_at(buf, offset)
+impl FileOperations for RefusesClose {
+    fn read_iter(&mut self, iocb: &mut Kiocb, buf: &mut [u8]) -> Result<usize, FilesystemError> {
+        self.0.read_iter(iocb, buf)
     }
 
-    fn write_at(&mut self, buf: &[u8], offset: u64) -> Result<usize, FilesystemError> {
-        self.0.write_at(buf, offset)
+    fn write_iter(&mut self, iocb: &mut Kiocb, buf: &[u8]) -> Result<usize, FilesystemError> {
+        self.0.write_iter(iocb, buf)
     }
 
-    fn append(&mut self, buf: &[u8]) -> Result<(u64, usize), FilesystemError> {
-        self.0.append(buf)
-    }
-
-    fn metadata(&self) -> Result<Metadata, FilesystemError> {
-        self.0.metadata()
-    }
-
-    fn set_len(&mut self, len: u64) -> Result<(), FilesystemError> {
-        self.0.set_len(len)
-    }
-
-    fn close(self: Box<Self>) -> Result<(), FilesystemError> {
+    fn flush(&mut self) -> Result<(), FilesystemError> {
         Err(FilesystemError::PermissionDenied)
     }
 }
 
 /// An open file whose every read fails in a way no error code names.
-struct FailsReads(Box<dyn File>);
+struct FailsReads(Box<dyn FileOperations>);
 
-impl File for FailsReads {
-    fn read_at(&mut self, _buf: &mut [u8], _offset: u64) -> Result<usize, FilesystemError> {
+impl FileOperations for FailsReads {
+    fn read_iter(&mut self, _iocb: &mut Kiocb, _buf: &mut [u8]) -> Result<usize, FilesystemError> {
         Err(FilesystemError::Other("the disk went away".to_string()))
     }
 
-    fn write_at(&mut self, buf: &[u8], offset: u64) -> Result<usize, FilesystemError> {
-        self.0.write_at(buf, offset)
-    }
-
-    fn append(&mut self, buf: &[u8]) -> Result<(u64, usize), FilesystemError> {
-        self.0.append(buf)
-    }
-
-    fn metadata(&self) -> Result<Metadata, FilesystemError> {
-        self.0.metadata()
-    }
-
-    fn set_len(&mut self, len: u64) -> Result<(), FilesystemError> {
-        self.0.set_len(len)
+    fn write_iter(&mut self, iocb: &mut Kiocb, buf: &[u8]) -> Result<usize, FilesystemError> {
+        self.0.write_iter(iocb, buf)
     }
 }
 
@@ -758,27 +791,15 @@ fn a_close_the_filesystem_refuses_fails_the_scripts_close() {
 
 /// An open file taking at most three bytes per write, as a Filesystem a
 /// Host App writes in Ruby may.
-struct WritesInParts(Box<dyn File>);
-
-impl File for WritesInParts {
-    fn read_at(&mut self, buf: &mut [u8], offset: u64) -> Result<usize, FilesystemError> {
-        self.0.read_at(buf, offset)
-    }
+struct WritesInParts(Box<dyn FileOperations>);
 
-    fn write_at(&mut self, buf: &[u8], offset: u64) -> Result<usize, FilesystemError> {
-        self.0.write_at(&buf[..buf.len().min(3)], offset)
+impl FileOperations for WritesInParts {
+    fn read_iter(&mut self, iocb: &mut Kiocb, buf: &mut [u8]) -> Result<usize, FilesystemError> {
+        self.0.read_iter(iocb, buf)
     }
 
-    fn append(&mut self, buf: &[u8]) -> Result<(u64, usize), FilesystemError> {
-        self.0.append(&buf[..buf.len().min(3)])
-    }
-
-    fn metadata(&self) -> Result<Metadata, FilesystemError> {
-        self.0.metadata()
-    }
-
-    fn set_len(&mut self, len: u64) -> Result<(), FilesystemError> {
-        self.0.set_len(len)
+    fn write_iter(&mut self, iocb: &mut Kiocb, buf: &[u8]) -> Result<usize, FilesystemError> {
+        self.0.write_iter(iocb, &buf[..buf.len().min(3)])
     }
 }
 
@@ -793,7 +814,7 @@ fn an_errno_a_script_raises_reads_as_crubys() {
         out << e.class.to_s << e.errno
         print out.inspect
     "#;
-    let Some(answer) = run(script, &[mount(note_memory(), Access::Read)], Vec::new()) else {
+    let Some(answer) = run(script, &[mount(note_tmpfs(), Access::Read)], Vec::new()) else {
         return;
     };
     assert_eq!(
@@ -812,7 +833,7 @@ fn an_errno_a_script_raises_reads_as_crubys() {
 fn a_system_call_error_keeps_a_number_no_class_names() {
     let Some(answer) = run(
         r#"e = SystemCallError.new(9999); print [e.class.to_s, e.message, e.errno].inspect"#,
-        &[mount(note_memory(), Access::Read)],
+        &[mount(note_tmpfs(), Access::Read)],
         Vec::new(),
     ) else {
         return;
@@ -835,7 +856,7 @@ fn a_read_length_past_64_bits_raises_range_error() {
           print e.class.to_s
         end
     "#;
-    let Some(answer) = run(script, &[mount(note_memory(), Access::Read)], Vec::new()) else {
+    let Some(answer) = run(script, &[mount(note_tmpfs(), Access::Read)], Vec::new()) else {
         return;
     };
     assert_eq!(
@@ -859,7 +880,7 @@ fn a_system_call_error_number_past_the_errno_range_raises_range_error() {
         end
         print out.inspect
     "#;
-    let Some(answer) = run(script, &[mount(note_memory(), Access::Read)], Vec::new()) else {
+    let Some(answer) = run(script, &[mount(note_tmpfs(), Access::Read)], Vec::new()) else {
         return;
     };
     assert_eq!(
@@ -884,7 +905,7 @@ fn a_read_or_write_a_stream_was_not_opened_for_raises_ioerror() {
     "#;
     let Some(answer) = run(
         script,
-        &[mount(note_memory(), Access::ReadWrite)],
+        &[mount(note_tmpfs(), Access::ReadWrite)],
         Vec::new(),
     ) else {
         return;
@@ -905,7 +926,7 @@ fn a_read_or_write_a_stream_was_not_opened_for_raises_ioerror() {
 fn a_path_that_is_no_valid_utf8_raises_eilseq() {
     let Some(answer) = run(
         r#"File.read("/data/\xff")"#,
-        &[mount(note_memory(), Access::Read)],
+        &[mount(note_tmpfs(), Access::Read)],
         Vec::new(),
     ) else {
         return;
@@ -929,7 +950,7 @@ fn a_write_lands_whole_when_the_filesystem_takes_it_in_parts() {
         return;
     };
     assert_eq!(
-        (answer, contents(filesystem.as_ref(), "note.txt")),
+        (answer, contents(&filesystem,"note.txt")),
         (Ok("11".to_string()), b"hello world".to_vec()),
         "IO#write to a file whose Filesystem takes three bytes per write through the bundled guest \
          must answer every byte and land them all"
@@ -938,35 +959,45 @@ fn a_write_lands_whole_when_the_filesystem_takes_it_in_parts() {
 
 /// An open file reporting a length it does not hold, so a script meets a
 /// file of several GiB without the test allocating one.
-struct ReportsLen(Box<dyn File>, u64);
+struct ReportsLen(Arc<dyn InodeOperations>, u64);
 
-impl File for ReportsLen {
-    fn read_at(&mut self, buf: &mut [u8], offset: u64) -> Result<usize, FilesystemError> {
-        self.0.read_at(buf, offset)
-    }
-
-    fn write_at(&mut self, buf: &[u8], offset: u64) -> Result<usize, FilesystemError> {
-        self.0.write_at(buf, offset)
+impl FileSystemType for ReportsLen {
+    fn fill_super(self: Arc<Self>, sb: &mut Filesystem) -> Result<(), FilesystemError> {
+        sb.d_make_root(Inode::new(&Kstat::new(FileType::Dir, 0), self));
+        Ok(())
     }
+}
 
-    fn append(&mut self, buf: &[u8]) -> Result<(u64, usize), FilesystemError> {
-        self.0.append(buf)
+impl InodeOperations for ReportsLen {
+    fn getattr(&self, dentry: &Dentry) -> Result<Kstat, FilesystemError> {
+        let mut stat = self.0.getattr(dentry)?;
+        if stat.file_type == FileType::RegFile {
+            stat.size = self.1;
+        }
+        Ok(stat)
     }
 
-    fn metadata(&self) -> Result<Metadata, FilesystemError> {
-        let mut metadata = self.0.metadata()?;
-        metadata.len = self.1;
-        Ok(metadata)
+    fn lookup(&self, dentry: &Dentry) -> Result<Lookup, FilesystemError> {
+        Ok(match self.0.lookup(dentry)? {
+            Lookup::Found(inode) => {
+                Lookup::Found(inode.with_ops(Arc::new(Self(inode.ops().clone(), self.1))))
+            }
+            other => other,
+        })
     }
 
-    fn set_len(&mut self, len: u64) -> Result<(), FilesystemError> {
-        self.0.set_len(len)
+    fn open(
+        &self,
+        dentry: &Dentry,
+        how: &OpenHow,
+    ) -> Result<Box<dyn FileOperations>, FilesystemError> {
+        self.0.open(dentry, how)
     }
 }
 
 fn three_gib_note() -> Grant {
-    let filesystem = WrapsFiles::over_note("hello", |file| ReportsLen(file, 3 << 30));
-    mount(filesystem, Access::Read)
+    let tmpfs: Tmpfs = [("note.txt", "hello")].into_iter().collect();
+    mount(Arc::new(ReportsLen(Arc::new(tmpfs), 3 << 30)), Access::Read)
 }
 
 // @behavior FL-020
@@ -1010,7 +1041,7 @@ fn a_position_past_2_gib_is_reported_whole() {
 fn setting_a_files_position_moves_where_the_next_read_starts() {
     let Some(answer) = run(
         r#"File.open("/data/note.txt") { |f| f.pos = 2; print f.read }"#,
-        &[mount(note_memory(), Access::Read)],
+        &[mount(note_tmpfs(), Access::Read)],
         Vec::new(),
     ) else {
         return;
@@ -1040,7 +1071,7 @@ fn a_seek_before_the_start_or_by_an_unknown_whence_raises_einval() {
              end
            end
            nil"#,
-        &[mount(note_memory(), Access::Read)],
+        &[mount(note_tmpfs(), Access::Read)],
         Vec::new(),
     ) else {
         return;