[Qemu-devel] [PATCH 3/5] qxl: support concurrent async commands

[Alon Levy]

change the single pending current_async to a linked list of pending
SpiceAsyncCommand.

Signed-off-by: Alon Levy <address@hidden>
---
 hw/qxl-render.c    |    2 +-
 hw/qxl.c           |  145 +++++++++++++++++++++++++++++++++++-----------------
 hw/qxl.h           |   29 +++++++++--
 ui/spice-display.c |   19 ++++---
 ui/spice-display.h |    7 ++-
 5 files changed, 137 insertions(+), 65 deletions(-)

diff --git a/hw/qxl-render.c b/hw/qxl-render.c
index c290739..23a4289 100644
--- a/hw/qxl-render.c
+++ b/hw/qxl-render.c
@@ -125,7 +125,7 @@ void qxl_render_update(PCIQXLDevice *qxl)
 
     memset(dirty, 0, sizeof(dirty));
     qxl_spice_update_area(qxl, 0, &update,
-                          dirty, ARRAY_SIZE(dirty), 1, QXL_SYNC);
+                          dirty, ARRAY_SIZE(dirty), 1, QXL_SYNC, 0);
 
     for (i = 0; i < ARRAY_SIZE(dirty); i++) {
         if (qemu_spice_rect_is_empty(dirty+i)) {
diff --git a/hw/qxl.c b/hw/qxl.c
index af02cda..008f5f7 100644
--- a/hw/qxl.c
+++ b/hw/qxl.c
@@ -120,7 +120,8 @@ static QXLMode qxl_modes[] = {
 static PCIQXLDevice *qxl0;
 
 static void qxl_send_events(PCIQXLDevice *d, uint32_t events);
-static int qxl_destroy_primary(PCIQXLDevice *d, qxl_async_io async);
+static int qxl_destroy_primary(PCIQXLDevice *d, qxl_async_io async,
+                               uint64_t cookie);
 static void qxl_reset_memslots(PCIQXLDevice *d);
 static void qxl_reset_surfaces(PCIQXLDevice *d);
 static void qxl_ring_set_dirty(PCIQXLDevice *qxl);
@@ -140,12 +141,11 @@ void qxl_guest_bug(PCIQXLDevice *qxl, const char *msg, 
...)
     }
 }
 
-
 void qxl_spice_update_area(PCIQXLDevice *qxl, uint32_t surface_id,
                            struct QXLRect *area, struct QXLRect *dirty_rects,
                            uint32_t num_dirty_rects,
                            uint32_t clear_dirty_region,
-                           qxl_async_io async)
+                           qxl_async_io async, uint64_t cookie)
 {
     if (async == QXL_SYNC) {
         qxl->ssd.worker->update_area(qxl->ssd.worker, surface_id, area,
@@ -153,7 +153,7 @@ void qxl_spice_update_area(PCIQXLDevice *qxl, uint32_t 
surface_id,
     } else {
 #if SPICE_INTERFACE_QXL_MINOR >= 1
         spice_qxl_update_area_async(&qxl->ssd.qxl, surface_id, area,
-                                    clear_dirty_region, 0);
+                                    clear_dirty_region, cookie);
 #else
         abort();
 #endif
@@ -170,14 +170,13 @@ static void 
qxl_spice_destroy_surface_wait_complete(PCIQXLDevice *qxl,
 }
 
 static void qxl_spice_destroy_surface_wait(PCIQXLDevice *qxl, uint32_t id,
-                                           qxl_async_io async)
+                                           qxl_async_io async, uint64_t cookie)
 {
     if (async) {
 #if SPICE_INTERFACE_QXL_MINOR < 1
         abort();
 #else
-        spice_qxl_destroy_surface_async(&qxl->ssd.qxl, id,
-                                        (uint64_t)id);
+        spice_qxl_destroy_surface_async(&qxl->ssd.qxl, id, cookie);
 #endif
     } else {
         qxl->ssd.worker->destroy_surface_wait(qxl->ssd.worker, id);
@@ -186,9 +185,9 @@ static void qxl_spice_destroy_surface_wait(PCIQXLDevice 
*qxl, uint32_t id,
 }
 
 #if SPICE_INTERFACE_QXL_MINOR >= 1
-static void qxl_spice_flush_surfaces_async(PCIQXLDevice *qxl)
+static void qxl_spice_flush_surfaces_async(PCIQXLDevice *qxl, uint64_t cookie)
 {
-    spice_qxl_flush_surfaces_async(&qxl->ssd.qxl, 0);
+    spice_qxl_flush_surfaces_async(&qxl->ssd.qxl, cookie);
 }
 #endif
 
@@ -216,13 +215,14 @@ static void 
qxl_spice_destroy_surfaces_complete(PCIQXLDevice *qxl)
     qemu_mutex_unlock(&qxl->track_lock);
 }
 
-static void qxl_spice_destroy_surfaces(PCIQXLDevice *qxl, qxl_async_io async)
+static void qxl_spice_destroy_surfaces(PCIQXLDevice *qxl, qxl_async_io async,
+                                       uint64_t cookie)
 {
     if (async) {
 #if SPICE_INTERFACE_QXL_MINOR < 1
         abort();
 #else
-        spice_qxl_destroy_surfaces_async(&qxl->ssd.qxl, 0);
+        spice_qxl_destroy_surfaces_async(&qxl->ssd.qxl, cookie);
 #endif
     } else {
         qxl->ssd.worker->destroy_surfaces(qxl->ssd.worker);
@@ -736,17 +736,61 @@ static void 
qxl_create_guest_primary_complete(PCIQXLDevice *d);
 
 #if SPICE_INTERFACE_QXL_MINOR >= 1
 
+SpiceAsyncCommand *push_spice_async_command(PCIQXLDevice *qxl,
+    uint32_t async_io, int size)
+{
+    assert(size >= sizeof(SpiceAsyncCommand));
+    SpiceAsyncCommand *spice_async_command = g_malloc0(size);
+
+    spice_async_command->cookie = qxl->async_next_cookie++;
+    spice_async_command->async_io = async_io;
+    QLIST_INSERT_HEAD(&qxl->async_commands, spice_async_command, next);
+    dprint(qxl, 2, "allocated async cookie %"PRId64"\n",
+           qxl->async_next_cookie - 1);
+    return spice_async_command;
+}
+
+/* caller must call g_free */
+static SpiceAsyncCommand *pop_spice_async_command(PCIQXLDevice *qxl,
+                                                  uint64_t cookie)
+{
+    SpiceAsyncCommand *spice_async_command = NULL;
+
+    qemu_mutex_lock(&qxl->async_lock);
+    QLIST_FOREACH(spice_async_command, &qxl->async_commands, next) {
+        if (spice_async_command->cookie == cookie) {
+            QLIST_REMOVE(spice_async_command, next);
+            break;
+        }
+    }
+    qemu_mutex_unlock(&qxl->async_lock);
+    return spice_async_command;
+}
+
+/* can be called from any thread */
+void complete_spice_async_command(PCIQXLDevice *qxl,
+            SpiceAsyncCommand *spice_async_command)
+{
+    if (!spice_async_command->completion) {
+        return;
+    }
+    spice_async_command->completion(qxl, spice_async_command);
+}
+
 /* called from spice server thread context only */
 static void interface_async_complete(QXLInstance *sin, uint64_t cookie)
 {
     PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
     uint32_t current_async;
+    SpiceAsyncCommand *spice_async_command;
 
-    qemu_mutex_lock(&qxl->async_lock);
-    current_async = qxl->current_async;
-    qxl->current_async = QXL_UNDEFINED_IO;
-    qemu_mutex_unlock(&qxl->async_lock);
-
+    spice_async_command = pop_spice_async_command(qxl, cookie);
+    if (!spice_async_command) {
+        dprint(qxl, 1, "async_complete: ERROR: response to not "
+                       "pending operation, cookie=%ld\n", cookie);
+        return;
+    }
+    current_async = spice_async_command->async_io;
     dprint(qxl, 2, "async_complete: %d (%ld) done\n", current_async, cookie);
     switch (current_async) {
     case QXL_IO_CREATE_PRIMARY_ASYNC:
@@ -756,9 +800,12 @@ static void interface_async_complete(QXLInstance *sin, 
uint64_t cookie)
         qxl_spice_destroy_surfaces_complete(qxl);
         break;
     case QXL_IO_DESTROY_SURFACE_ASYNC:
-        qxl_spice_destroy_surface_wait_complete(qxl, (uint32_t)cookie);
+        qxl_spice_destroy_surface_wait_complete(qxl,
+            (uint64_t)spice_async_command->opaque);
         break;
     }
+    complete_spice_async_command(qxl, spice_async_command);
+    g_free(spice_async_command);
     qxl_send_events(qxl, QXL_INTERRUPT_IO_CMD);
 }
 
@@ -805,7 +852,7 @@ static void qxl_exit_vga_mode(PCIQXLDevice *d)
         return;
     }
     dprint(d, 1, "%s\n", __FUNCTION__);
-    qxl_destroy_primary(d, QXL_SYNC);
+    qxl_destroy_primary(d, QXL_SYNC, 0);
 }
 
 static void qxl_update_irq(PCIQXLDevice *d)
@@ -886,14 +933,14 @@ static void qxl_vga_ioport_write(void *opaque, uint32_t 
addr, uint32_t val)
 
     if (qxl->mode != QXL_MODE_VGA) {
         dprint(qxl, 1, "%s\n", __FUNCTION__);
-        qxl_destroy_primary(qxl, QXL_SYNC);
+        qxl_destroy_primary(qxl, QXL_SYNC, 0);
         qxl_soft_reset(qxl);
     }
     vga_ioport_write(opaque, addr, val);
 }
 
 static void qxl_add_memslot(PCIQXLDevice *d, uint32_t slot_id, uint64_t delta,
-                            qxl_async_io async)
+                            qxl_async_io async, uint64_t cookie)
 {
     static const int regions[] = {
         QXL_RAM_RANGE_INDEX,
@@ -963,7 +1010,7 @@ static void qxl_add_memslot(PCIQXLDevice *d, uint32_t 
slot_id, uint64_t delta,
            __FUNCTION__, memslot.slot_id,
            memslot.virt_start, memslot.virt_end);
 
-    qemu_spice_add_memslot(&d->ssd, &memslot, async);
+    qemu_spice_add_memslot(&d->ssd, &memslot, async, cookie);
     d->guest_slots[slot_id].ptr = (void*)memslot.virt_start;
     d->guest_slots[slot_id].size = memslot.virt_end - memslot.virt_start;
     d->guest_slots[slot_id].delta = delta;
@@ -988,7 +1035,7 @@ static void qxl_reset_surfaces(PCIQXLDevice *d)
 {
     dprint(d, 1, "%s:\n", __FUNCTION__);
     d->mode = QXL_MODE_UNDEFINED;
-    qxl_spice_destroy_surfaces(d, QXL_SYNC);
+    qxl_spice_destroy_surfaces(d, QXL_SYNC, 0);
 }
 
 /* called from spice server thread context only */
@@ -1020,7 +1067,7 @@ static void 
qxl_create_guest_primary_complete(PCIQXLDevice *qxl)
 }
 
 static void qxl_create_guest_primary(PCIQXLDevice *qxl, int loadvm,
-                                     qxl_async_io async)
+                                     qxl_async_io async, uint64_t cookie)
 {
     QXLDevSurfaceCreate surface;
     QXLSurfaceCreate *sc = &qxl->guest_primary.surface;
@@ -1048,7 +1095,7 @@ static void qxl_create_guest_primary(PCIQXLDevice *qxl, 
int loadvm,
 
     qxl->mode = QXL_MODE_NATIVE;
     qxl->cmdflags = 0;
-    qemu_spice_create_primary_surface(&qxl->ssd, 0, &surface, async);
+    qemu_spice_create_primary_surface(&qxl->ssd, 0, &surface, async, cookie);
 
     if (async == QXL_SYNC) {
         qxl_create_guest_primary_complete(qxl);
@@ -1057,7 +1104,8 @@ static void qxl_create_guest_primary(PCIQXLDevice *qxl, 
int loadvm,
 
 /* return 1 if surface destoy was initiated (in QXL_ASYNC case) or
  * done (in QXL_SYNC case), 0 otherwise. */
-static int qxl_destroy_primary(PCIQXLDevice *d, qxl_async_io async)
+static int qxl_destroy_primary(PCIQXLDevice *d, qxl_async_io async,
+                               uint64_t cookie)
 {
     if (d->mode == QXL_MODE_UNDEFINED) {
         return 0;
@@ -1066,7 +1114,7 @@ static int qxl_destroy_primary(PCIQXLDevice *d, 
qxl_async_io async)
     dprint(d, 1, "%s\n", __FUNCTION__);
 
     d->mode = QXL_MODE_UNDEFINED;
-    qemu_spice_destroy_primary_surface(&d->ssd, 0, async);
+    qemu_spice_destroy_primary_surface(&d->ssd, 0, async, cookie);
     return 1;
 }
 
@@ -1097,10 +1145,10 @@ static void qxl_set_mode(PCIQXLDevice *d, int modenr, 
int loadvm)
     }
 
     d->guest_slots[0].slot = slot;
-    qxl_add_memslot(d, 0, devmem, QXL_SYNC);
+    qxl_add_memslot(d, 0, devmem, QXL_SYNC, 0);
 
     d->guest_primary.surface = surface;
-    qxl_create_guest_primary(d, 0, QXL_SYNC);
+    qxl_create_guest_primary(d, 0, QXL_SYNC, 0);
 
     d->mode = QXL_MODE_COMPAT;
     d->cmdflags = QXL_COMMAND_FLAG_COMPAT;
@@ -1122,7 +1170,9 @@ static void ioport_write(void *opaque, target_phys_addr_t 
addr,
     qxl_async_io async = QXL_SYNC;
 #if SPICE_INTERFACE_QXL_MINOR >= 1
     uint32_t orig_io_port = io_port;
+    SpiceAsyncCommand *spice_async_command = NULL;
 #endif
+    uint64_t cookie = 0;
 
     switch (io_port) {
     case QXL_IO_RESET:
@@ -1179,15 +1229,12 @@ static void ioport_write(void *opaque, 
target_phys_addr_t addr,
 async_common:
         async = QXL_ASYNC;
         qemu_mutex_lock(&d->async_lock);
-        if (d->current_async != QXL_UNDEFINED_IO) {
-            qxl_guest_bug(d, "%d async started before last (%d) complete",
-                io_port, d->current_async);
-            qemu_mutex_unlock(&d->async_lock);
-            return;
-        }
-        d->current_async = orig_io_port;
+        spice_async_command = push_spice_async_command(d, orig_io_port,
+                                                sizeof(SpiceAsyncCommand));
         qemu_mutex_unlock(&d->async_lock);
-        dprint(d, 2, "start async %d (%"PRId64")\n", io_port, val);
+        cookie = spice_async_command->cookie;
+        dprint(d, 2, "start async %d (%"PRId64") cookie %"PRId64"\n", io_port,
+               val, cookie);
         break;
     default:
         break;
@@ -1199,7 +1246,7 @@ async_common:
     {
         QXLRect update = d->ram->update_area;
         qxl_spice_update_area(d, d->ram->update_surface,
-                              &update, NULL, 0, 0, async);
+                              &update, NULL, 0, 0, async, cookie);
         break;
     }
     case QXL_IO_NOTIFY_CMD:
@@ -1247,7 +1294,7 @@ async_common:
             break;
         }
         d->guest_slots[val].slot = d->ram->mem_slot;
-        qxl_add_memslot(d, val, 0, async);
+        qxl_add_memslot(d, val, 0, async, cookie);
         break;
     case QXL_IO_MEMSLOT_DEL:
         if (val >= NUM_MEMSLOTS) {
@@ -1264,7 +1311,7 @@ async_common:
         }
         dprint(d, 1, "QXL_IO_CREATE_PRIMARY async=%d\n", async);
         d->guest_primary.surface = d->ram->create_surface;
-        qxl_create_guest_primary(d, 0, async);
+        qxl_create_guest_primary(d, 0, async, cookie);
         break;
     case QXL_IO_DESTROY_PRIMARY:
         if (val != 0) {
@@ -1274,7 +1321,7 @@ async_common:
         }
         dprint(d, 1, "QXL_IO_DESTROY_PRIMARY (async=%d) (%s)\n", async,
                qxl_mode_to_string(d->mode));
-        if (!qxl_destroy_primary(d, async)) {
+        if (!qxl_destroy_primary(d, async, cookie)) {
             dprint(d, 1, "QXL_IO_DESTROY_PRIMARY_ASYNC in %s, ignored\n",
                     qxl_mode_to_string(d->mode));
             goto cancel_async;
@@ -1286,7 +1333,9 @@ async_common:
                              "%d >= NUM_SURFACES", async, val);
             goto cancel_async;
         }
-        qxl_spice_destroy_surface_wait(d, val, async);
+        spice_async_command->opaque = (void *)(uint64_t)val;
+        qxl_spice_destroy_surface_wait(d, val, async,
+                                       spice_async_command->cookie);
         break;
 #if SPICE_INTERFACE_QXL_MINOR >= 1
     case QXL_IO_FLUSH_RELEASE: {
@@ -1307,12 +1356,12 @@ async_common:
                      " (%"PRId64") (%s, s#=%d, res#=%d)\n",
                val, qxl_mode_to_string(d->mode), d->guest_surfaces.count,
                d->num_free_res);
-        qxl_spice_flush_surfaces_async(d);
+        qxl_spice_flush_surfaces_async(d, cookie);
         break;
 #endif
     case QXL_IO_DESTROY_ALL_SURFACES:
         d->mode = QXL_MODE_UNDEFINED;
-        qxl_spice_destroy_surfaces(d, async);
+        qxl_spice_destroy_surfaces(d, async, cookie);
         break;
     default:
         fprintf(stderr, "%s: ioport=0x%x, abort()\n", __FUNCTION__, io_port);
@@ -1324,7 +1373,7 @@ cancel_async:
     if (async) {
         qxl_send_events(d, QXL_INTERRUPT_IO_CMD);
         qemu_mutex_lock(&d->async_lock);
-        d->current_async = QXL_UNDEFINED_IO;
+        pop_spice_async_command(d, spice_async_command->cookie);
         qemu_mutex_unlock(&d->async_lock);
     }
 #else
@@ -1520,7 +1569,8 @@ static int qxl_init_common(PCIQXLDevice *qxl)
     qxl->num_surfaces = NUM_SURFACES;
     qemu_mutex_init(&qxl->track_lock);
     qemu_mutex_init(&qxl->async_lock);
-    qxl->current_async = QXL_UNDEFINED_IO;
+    QLIST_INIT(&qxl->async_commands);
+    qxl->async_next_cookie = 0;
 
     switch (qxl->revision) {
     case 1: /* spice 0.4 -- qxl-1 */
@@ -1697,9 +1747,9 @@ static int qxl_post_load(void *opaque, int version)
             if (!d->guest_slots[i].active) {
                 continue;
             }
-            qxl_add_memslot(d, i, 0, QXL_SYNC);
+            qxl_add_memslot(d, i, 0, QXL_SYNC, 0);
         }
-        qxl_create_guest_primary(d, 1, QXL_SYNC);
+        qxl_create_guest_primary(d, 1, QXL_SYNC, 0);
 
         /* replay surface-create and cursor-set commands */
         cmds = g_malloc0(sizeof(QXLCommandExt) * (NUM_SURFACES + 1));
@@ -1718,7 +1768,6 @@ static int qxl_post_load(void *opaque, int version)
         out++;
         qxl_spice_loadvm_commands(d, cmds, out);
         g_free(cmds);
-
         break;
     case QXL_MODE_COMPAT:
         qxl_set_mode(d, d->shadow_rom.mode, 1);
diff --git a/hw/qxl.h b/hw/qxl.h
index 868db81..4c89e14 100644
--- a/hw/qxl.h
+++ b/hw/qxl.h
@@ -17,7 +17,22 @@ enum qxl_mode {
 
 #define QXL_UNDEFINED_IO UINT32_MAX
 
-typedef struct PCIQXLDevice {
+typedef struct PCIQXLDevice PCIQXLDevice;
+typedef struct SpiceAsyncCommand SpiceAsyncCommand;
+typedef void (*SpiceAsyncCommandCompletion)(PCIQXLDevice *,
+                                            SpiceAsyncCommand *);
+
+/* Outstanding async request sent to spice server.
+ * cookie must be unique across the list. */
+struct SpiceAsyncCommand {
+    uint64_t                       cookie;
+    void                          *opaque;
+    uint32_t                       async_io;
+    SpiceAsyncCommandCompletion    completion;
+    QLIST_ENTRY(SpiceAsyncCommand) next;
+};
+
+struct PCIQXLDevice {
     PCIDevice          pci;
     SimpleSpiceDisplay ssd;
     int                id;
@@ -32,7 +47,8 @@ typedef struct PCIQXLDevice {
     int32_t            num_memslots;
     int32_t            num_surfaces;
 
-    uint32_t           current_async;
+    QLIST_HEAD(, SpiceAsyncCommand) async_commands;
+    uint64_t           async_next_cookie;
     QemuMutex          async_lock;
 
     struct guest_slots {
@@ -87,7 +103,7 @@ typedef struct PCIQXLDevice {
 
     /* io bar */
     MemoryRegion       io_bar;
-} PCIQXLDevice;
+};
 
 #define PANIC_ON(x) if ((x)) {                         \
     printf("%s: PANIC %s failed\n", __FUNCTION__, #x); \
@@ -116,13 +132,18 @@ void qxl_spice_update_area(PCIQXLDevice *qxl, uint32_t 
surface_id,
                            struct QXLRect *area, struct QXLRect *dirty_rects,
                            uint32_t num_dirty_rects,
                            uint32_t clear_dirty_region,
-                           qxl_async_io async);
+                           qxl_async_io async, uint64_t cookie);
 void qxl_spice_loadvm_commands(PCIQXLDevice *qxl, struct QXLCommandExt *ext,
                                uint32_t count);
 void qxl_spice_oom(PCIQXLDevice *qxl);
 void qxl_spice_reset_memslots(PCIQXLDevice *qxl);
 void qxl_spice_reset_image_cache(PCIQXLDevice *qxl);
 void qxl_spice_reset_cursor(PCIQXLDevice *qxl);
+SpiceAsyncCommand *push_spice_async_command(PCIQXLDevice *qxl,
+                                            uint32_t async_io, int size);
+/* complete_spice_async_command: call to cleanup a command */
+void complete_spice_async_command(PCIQXLDevice *qxl,
+                                  SpiceAsyncCommand *spice_async_command);
 
 /* qxl-logger.c */
 void qxl_log_cmd_cursor(PCIQXLDevice *qxl, QXLCursorCmd *cmd, int group_id);
diff --git a/ui/spice-display.c b/ui/spice-display.c
index 6c302a3..71e7305 100644
--- a/ui/spice-display.c
+++ b/ui/spice-display.c
@@ -61,11 +61,11 @@ void qemu_spice_rect_union(QXLRect *dest, const QXLRect *r)
 }
 
 void qemu_spice_add_memslot(SimpleSpiceDisplay *ssd, QXLDevMemSlot *memslot,
-                            qxl_async_io async)
+                            qxl_async_io async, uint64_t cookie)
 {
     if (async != QXL_SYNC) {
 #if SPICE_INTERFACE_QXL_MINOR >= 1
-        spice_qxl_add_memslot_async(&ssd->qxl, memslot, 0);
+        spice_qxl_add_memslot_async(&ssd->qxl, memslot, cookie);
 #else
         abort();
 #endif
@@ -81,11 +81,11 @@ void qemu_spice_del_memslot(SimpleSpiceDisplay *ssd, 
uint32_t gid, uint32_t sid)
 
 void qemu_spice_create_primary_surface(SimpleSpiceDisplay *ssd, uint32_t id,
                                        QXLDevSurfaceCreate *surface,
-                                       qxl_async_io async)
+                                       qxl_async_io async, uint64_t cookie)
 {
     if (async != QXL_SYNC) {
 #if SPICE_INTERFACE_QXL_MINOR >= 1
-        spice_qxl_create_primary_surface_async(&ssd->qxl, id, surface, 0);
+        spice_qxl_create_primary_surface_async(&ssd->qxl, id, surface, cookie);
 #else
         abort();
 #endif
@@ -96,11 +96,12 @@ void qemu_spice_create_primary_surface(SimpleSpiceDisplay 
*ssd, uint32_t id,
 
 
 void qemu_spice_destroy_primary_surface(SimpleSpiceDisplay *ssd,
-                                        uint32_t id, qxl_async_io async)
+                                        uint32_t id, qxl_async_io async,
+                                        uint64_t cookie)
 {
     if (async != QXL_SYNC) {
 #if SPICE_INTERFACE_QXL_MINOR >= 1
-        spice_qxl_destroy_primary_surface_async(&ssd->qxl, id, 0);
+        spice_qxl_destroy_primary_surface_async(&ssd->qxl, id, cookie);
 #else
         abort();
 #endif
@@ -223,7 +224,7 @@ void qemu_spice_create_host_memslot(SimpleSpiceDisplay *ssd)
     memset(&memslot, 0, sizeof(memslot));
     memslot.slot_group_id = MEMSLOT_GROUP_HOST;
     memslot.virt_end = ~0;
-    qemu_spice_add_memslot(ssd, &memslot, QXL_SYNC);
+    qemu_spice_add_memslot(ssd, &memslot, QXL_SYNC, 0);
 }
 
 void qemu_spice_create_host_primary(SimpleSpiceDisplay *ssd)
@@ -243,14 +244,14 @@ void qemu_spice_create_host_primary(SimpleSpiceDisplay 
*ssd)
     surface.mem        = (intptr_t)ssd->buf;
     surface.group_id   = MEMSLOT_GROUP_HOST;
 
-    qemu_spice_create_primary_surface(ssd, 0, &surface, QXL_SYNC);
+    qemu_spice_create_primary_surface(ssd, 0, &surface, QXL_SYNC, 0);
 }
 
 void qemu_spice_destroy_host_primary(SimpleSpiceDisplay *ssd)
 {
     dprint(1, "%s:\n", __FUNCTION__);
 
-    qemu_spice_destroy_primary_surface(ssd, 0, QXL_SYNC);
+    qemu_spice_destroy_primary_surface(ssd, 0, QXL_SYNC, 0);
 }
 
 void qemu_spice_vm_change_state_handler(void *opaque, int running,
diff --git a/ui/spice-display.h b/ui/spice-display.h
index 5e52df9..5db7eb8 100644
--- a/ui/spice-display.h
+++ b/ui/spice-display.h
@@ -99,14 +99,15 @@ void qemu_spice_display_resize(SimpleSpiceDisplay *ssd);
 void qemu_spice_display_refresh(SimpleSpiceDisplay *ssd);
 
 void qemu_spice_add_memslot(SimpleSpiceDisplay *ssd, QXLDevMemSlot *memslot,
-                            qxl_async_io async);
+                            qxl_async_io async, uint64_t cookie);
 void qemu_spice_del_memslot(SimpleSpiceDisplay *ssd, uint32_t gid,
                             uint32_t sid);
 void qemu_spice_create_primary_surface(SimpleSpiceDisplay *ssd, uint32_t id,
                                        QXLDevSurfaceCreate *surface,
-                                       qxl_async_io async);
+                                       qxl_async_io async, uint64_t cookie);
 void qemu_spice_destroy_primary_surface(SimpleSpiceDisplay *ssd,
-                                        uint32_t id, qxl_async_io async);
+                                        uint32_t id, qxl_async_io async,
+                                        uint64_t cookie);
 void qemu_spice_wakeup(SimpleSpiceDisplay *ssd);
 void qemu_spice_start(SimpleSpiceDisplay *ssd);
 void qemu_spice_stop(SimpleSpiceDisplay *ssd);
-- 
1.7.7