snapshots: Add flag to guarantee topological sort

When using virDomainSnapshotCreateXML with the REDEFINE flag on
multiple snapshot metadata XML descriptions, we require that a child
cannot be redefined before its parent.  Since libvirt already tracks a
DAG, it is more convenient if we can ensure that
virDomainListAllSnapshots() and friends have a way to return data in
an order that we can directly reuse, rather than having to
post-process the data ourselves to reconstruct the DAG.

Add VIR_DOMAIN_SNAPSHOT_LIST_TOPOLOGICAL as our new guarantee (well, a
guarantee at the time of the API call conclusion; there's always a
possible TOCTTOU race where someone redefining snapshots in between
the API results and the client actually using the list might render
the list out-of-date). Four listing APIs are directly benefitted by
the new flag; additionally, since we document that the older racy
ListNames interfaces should be sized by using the same flags on their
Num counterparts, the Num interfaces must document when they accept
(and ignore) the flag.

We could have supported the new flag just for the ListAll APIs (to
discourage people from using the older racy Num/ListNames APIs), but
it feels weird to special-case this flag value as being applicable to
only a subset of the API while all other List-related flags are
trivially applicable to all 6.
Signed-off-by: NEric Blake <eblake@redhat.com>
Reviewed-by: NJán Tomko <jtomko@redhat.com>
Reviewed-by: NDaniel P. Berrangé <berrange@redhat.com>

include/libvirt/libvirt-domain-snapshot.h

@@ -135,6 +135,10 @@ typedef enum {
     VIR_DOMAIN_SNAPSHOT_LIST_EXTERNAL    = (1 << 9), /* Filter by snapshots
                                                         that use files external
                                                         to disk images */
+
+    VIR_DOMAIN_SNAPSHOT_LIST_TOPOLOGICAL = (1 << 10), /* Ensure parents occur
+                                                         before children in
+                                                         the resulting list */
 } virDomainSnapshotListFlags;
 
 /* Return the number of snapshots for this domain */

src/libvirt-domain-snapshot.c

 /*
  * libvirt-domain-snapshot.c: entry points for virDomainSnapshotPtr APIs
  *
- * Copyright (C) 2006-2014 Red Hat, Inc.
+ * Copyright (C) 2006-2019 Red Hat, Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
@@ -298,6 +298,10 @@ virDomainSnapshotGetXMLDesc(virDomainSnapshotPtr snapshot,
  *
  * Provides the number of domain snapshots for this domain.
  *
+ * This function will accept VIR_DOMAIN_SNAPSHOT_LIST_TOPOLOGICAL in
+ * @flags only if virDomainSnapshotListNames() can honor it, although
+ * the flag has no other effect here.
+ *
  * By default, this command covers all snapshots; it is also possible to
  * limit things to just snapshots with no parents, when @flags includes
  * VIR_DOMAIN_SNAPSHOT_LIST_ROOTS.  Additional filters are provided in
@@ -369,6 +373,13 @@ virDomainSnapshotNum(virDomainPtr domain, unsigned int flags)
  * their names in @names.  The value to use for @nameslen can be determined
  * by virDomainSnapshotNum() with the same @flags.
  *
+ * If @flags contains VIR_DOMAIN_SNAPSHOT_LIST_TOPOLOGICAL, and no
+ * other connection is modifying snapshots, then it is guaranteed that
+ * for any snapshot in the resulting list, no snapshots later in the
+ * list can be reached by a sequence of virDomainSnapshotGetParent()
+ * starting from that earlier snapshot; otherwise, the order of
+ * snapshots in the resulting list is unspecified.
+ *
  * By default, this command covers all snapshots; it is also possible to
  * limit things to just snapshots with no parents, when @flags includes
  * VIR_DOMAIN_SNAPSHOT_LIST_ROOTS.  Additional filters are provided in
@@ -457,6 +468,14 @@ virDomainSnapshotListNames(virDomainPtr domain, char **names, int nameslen,
  * an array to store those objects.  This API solves the race inherent in
  * virDomainSnapshotListNames().
  *
+ * If @flags contains VIR_DOMAIN_SNAPSHOT_LIST_TOPOLOGICAL and @snaps
+ * is non-NULL, and no other connection is modifying snapshots, then
+ * it is guaranteed that for any snapshot in the resulting list, no
+ * snapshots later in the list can be reached by a sequence of
+ * virDomainSnapshotGetParent() starting from that earlier snapshot;
+ * otherwise, the order of snapshots in the resulting list is
+ * unspecified.
+ *
  * By default, this command covers all snapshots; it is also possible to
  * limit things to just snapshots with no parents, when @flags includes
  * VIR_DOMAIN_SNAPSHOT_LIST_ROOTS.  Additional filters are provided in
@@ -533,6 +552,10 @@ virDomainListAllSnapshots(virDomainPtr domain, virDomainSnapshotPtr **snaps,
  *
  * Provides the number of child snapshots for this domain snapshot.
  *
+ * This function will accept VIR_DOMAIN_SNAPSHOT_LIST_TOPOLOGICAL in
+ * @flags only if virDomainSnapshotListChildrenNames() can honor it,
+ * although the flag has no other effect here.
+ *
  * By default, this command covers only direct children; it is also possible
  * to expand things to cover all descendants, when @flags includes
  * VIR_DOMAIN_SNAPSHOT_LIST_DESCENDANTS.  Also, some filters are provided in
@@ -605,6 +628,14 @@ virDomainSnapshotNumChildren(virDomainSnapshotPtr snapshot, unsigned int flags)
  * @nameslen can be determined by virDomainSnapshotNumChildren() with
  * the same @flags.
  *
+ * If @flags lacks VIR_DOMAIN_SNAPSHOT_LIST_DESCENDANTS or contains
+ * VIR_DOMAIN_SNAPSHOT_LIST_TOPOLOGICAL, and no other connection is
+ * modifying snapshots, then it is guaranteed that for any snapshot in
+ * the resulting list, no snapshots later in the list can be reached
+ * by a sequence of virDomainSnapshotGetParent() starting from that
+ * earlier snapshot; otherwise, the order of snapshots in the
+ * resulting list is unspecified.
+ *
  * By default, this command covers only direct children; it is also possible
  * to expand things to cover all descendants, when @flags includes
  * VIR_DOMAIN_SNAPSHOT_LIST_DESCENDANTS.  Also, some filters are provided in
@@ -697,6 +728,14 @@ virDomainSnapshotListChildrenNames(virDomainSnapshotPtr snapshot,
  * snapshot, and allocate an array to store those objects.  This API solves
  * the race inherent in virDomainSnapshotListChildrenNames().
  *
+ * If @flags lacks VIR_DOMAIN_SNAPSHOT_LIST_DESCENDANTS or contains
+ * VIR_DOMAIN_SNAPSHOT_LIST_TOPOLOGICAL, @snaps is non-NULL, and no
+ * other connection is modifying snapshots, then it is guaranteed that
+ * for any snapshot in the resulting list, no snapshots later in the
+ * list can be reached by a sequence of virDomainSnapshotGetParent()
+ * starting from that earlier snapshot; otherwise, the order of
+ * snapshots in the resulting list is unspecified.
+ *
  * By default, this command covers only direct children; it is also possible
  * to expand things to cover all descendants, when @flags includes
  * VIR_DOMAIN_SNAPSHOT_LIST_DESCENDANTS.  Also, some filters are provided in