# Spice Protocol

version v1.0, 01.01.2009
Draft 1

Copyright © 2009 Red Hat, Inc.
Licensed under a Creative Commons Attribution-Share Alike 3.0
United States License (see http://creativecommons.org/licenses/by-sa/3.0/us/legalcode)

## 1. Introduction

Spice protocol defines a set of protocol messages for accessing, controlling, and receiving inputs from remote computing devices (e.g., keyboard, video, mouse) across networks, and sending output to them. A controlled device can reside on either side, client and/or server. In addition, the protocol defines a set of calls for supporting migration of a remote server from one network address to another. Encryption of transported data, with one exception, was kept out of the protocol for maximum flexibility in choosing an encryption method. Spice uses simple messaging and does not depend on any RPC standard or a specific transport layer.

Spice communication session is split into multiple communication channels (e.g., every channel is a remote device) in order to have the ability to control communication and execution of messages according to the channel type (e.g. QoS encryption), and to add and remove communication channels during run time (which is supported by spice protocol definition). The following communication channels are defined in the current protocol definition: a). the main channel serves as the main spice session connection b). display channel for receiving remote display updates c). inputs channel for sending mouse and keyboard events d). cursor channel for receiving pointer shape and position e). Playback channel for receiving audio stream, and f). Record channel for sending audio capture. More channel types will be added as the protocol evolves. Spice also defines a set of protocol definitions for synchronizing channels` execution on the remote site.

## 2. Common Protocol definition

1. Endianness

   Unless stated otherwise, all data structures are packed and byte and bit order is in little endian format.

2. Data types

   1. UINT8 – 8 bits unsigned integer

   2. INT16 – 16 bits signed integer

   3. UINT16 – 16 bits unsigned integer

   4. UINT32 – 32 bits unsigned integer

   5. INT32 - 32 bits signed integer

   6. UINT64 – 64 bits unsigned integer

   7. SPICE_ADDRESS - 64 bits unsigned integer, value is the offset of the addressed data from the beginning of spice protocol message body (i.e., data following SpiceDataHeader or SpicedSubMessage).

   8. SPICE_FIXED28_4 – 32 bits fixed point number. 28 high bits are signed integer. Low 4 bits is unsigned integer numerator of a fraction with denominator 16.

   9. POINT

      INT32 x
      INT32 y

   10. POINT16

       INT16 x
       INT16 y

   11. RECT

       INT32 top
       INT32 left
       INT32 bottom
       INT32 right

   12. POINTFIX

       SPICE_FIXED28_4 x
       SPICE_FIXED28_4 y

3. Protocol Magic number UINT8[4]

   SPICE_MAGIC = { 0x52, 0x45, 0x44, 0x51} // "REDQ"

4. Protocol version

   Protocol version defined as two UINT32 values, major protocol version and minor protocol version. Server and client having the same major version must keep compatibility regardless of minor version (i.e., incrementing the major version brakes compatibility). Major protocol version with "huge" value are reserved for development purposes and are considered unsupported and unreliable. "huge" values are defined as having bit 31 set. The minor protocol version is incremented on every protocol change that does not break compatibility. It is set to zero on major protocol version increment.

   1. Current Protocol version

          SPICE_VERSION_MAJOR = 2
          SPICE_VERSION_MINOR = 2

5. Compatibility – UINT32[]

   In order to allow some degree of flexibility in client and server implementation and in order to improve compatibility, spice protocol supports bidirectional exchange of channels compatibilities. Compatibilities are expressed in UINT32 vector that is split into two groups: common compatibilities and channels compatibilities. Common compatibilities stands for compatibilities shared by all channels, and channels compatibilities stands for channel specific compatibilities. Splitting the vector into two types allows us to add channel compatibilities independently. Each compatibility is expressed using one or more bits in the compatibilities vector. For example capability 0 will be the low bit of the first (index 0) UINT32.

6. Channel types – UINT8

       SPICE_CHANNEL_MAIN      = 1
       SPICE_CHANNEL_DISPLAY   = 2
       SPICE_CHANNEL_INPUTS    = 3
       SPICE_CHANNEL_CURSOR    = 4
       SPICE_CHANNEL_PLAYBACK  = 5
       SPICE_CHANNEL_RECORD    = 6
       SPICE_CHANNEL_TUNNEL    = 7 // obsolete
       SPICE_CHANNEL_SMARTCARD = 8
       SPICE_CHANNEL_USBREDIR  = 9
       SPICE_CHANNEL_PORT              = 10
       SPICE_CHANNEL_WEBDAV    = 11

7. Error codes UINT32

       SPICE_LINK_ERR_OK                       = 0
       SPICE_LINK_ERR_ERROR                    = 1
       SPICE_LINK_ERR_INVALID_MAGIC            = 2
       SPICE_LINK_ERR_INVALID_DATA             = 3
       SPICE_LINK_ERR_VERSION_MISMATCH         = 4
       SPICE_LINK_ERR_NEED_SECURED             = 5
       SPICE_LINK_ERR_NEED_UNSECURED           = 6
       SPICE_LINK_ERR_PERMISSION_DENIED        = 7
       SPICE_LINK_ERR_BAD_CONNECTION_ID        = 8
       SPICE_LINK_ERR_CHANNEL_NOT_AVAILABLE    = 9

8. Warning codes

       SPICE_WARN_GENERAL                              = 0

9. Information codes

       SPICE_INFO_GENERAL                              = 0

10. public key buffer size.

        SPICE_TICKET_PUBKEY_BYTES = 162 /* size needed for holding 1024 bit RSA public
        key in X.509 SubjectPublicKeyInfo format. */

11. Channel link: establishing a channel connection.

    1. Connection process

       The channel connection process is initiated by the client. The client sends SpiceLinkMess. In response, the server sends SpiceLinkReply. When the client receives SpiceLinkReply, it examines the error code and in case there is no error it encrypts its password with public key received in SpiceLinkReply and sends it to the server. The server receive the password and sends the link result to the client. The client examines the link result, and in case the result equals to SPICE_LINK_ERR_OK, a valid connection is established.

       Channel connection for channel types other then SPICE_CHANNEL_MAIN is allowed only after the client has active SPICE_CHANNEL_MAIN channel connection. Only one SPICE_CHANNEL_MAIN connection is allowed, and this channel connection establishes spice session with the remote server.

    2. Ticketing

       Ticketing is a mechanism implemented in spice to ensure connections are opened only from authorized sources. To enable this mechanism a ticket is set in spice server consisting of a password and time validity. After time validity passes, the whole ticket is expired. The ticket is encrypted. To encrypt, server generates a 1024 bit RSA key and send the public part to the client (via RedLinkInfo). Client uses this key to encrypt the password and send it back to server (after SpiceLinkMess). Server decrypt the password, compare it to ticket and ensure it was received within the allowed time-frame.

    3. SpiceLinkMess definition.

       UINT32 magic | value of this fields must be equal to SPICE_MAGIC
       UINT32 major_version | value of this fields must be equal to SPICE_VERSION_MAJOR
       UINT32 minor_version | value of this fields must be equal to SPICE_VERSION_MINOR
       UINT32 size | number of bytes following this field to the end of this message.
       UINT32 connection_id | In case of a new session (i.e., channel type is SPICE_CHANNEL_MAIN) this field is set to zero, and in response the server will allocate session id and will send it via the SpiceLinkReply message. In case of all other channel types, this field will be equal to the allocated session id.
       UINT8 channel_type | one of SPICE_CHANNEL_?
       UINT8 channel_id | channel id to connect to. This enables having multiple channels of the same type.
       UINT32 num_common_caps | number of common client channel capabilities words
       UINT32 num_channel_caps | number of specific client channel capabilities words
       UINT32 caps_offset | location of the start of the capabilities vector given by the bytes offset from the “ size” member (i.e., from the address of the “connection_id” member).

    4. SpiceLinkReply definition

       UINT32 magic | value of this field must be equal to SPICE_MAGIC
       UINT32 major_version | server major protocol version.
       UINT32 minor_version | server minor protocol version.
       UINT32 size | number of bytes following this field to the end of this message.
       UINT32 error | Error codes (i.e., SPICE_LINK_ERR_?)
       UINT8[SPICE_TICKET_PUBKEY_BYTES] pub_key | 1024 bit RSA public key in X.509 SubjectPublicKeyInfo format.
       UINT32 num_common_caps | number of common server channel capabilities words
       UINT32 num_channel_caps | number of specific server channel capabilities words
       UINT32 caps_offset | location of the start of the capabilities vector given by the bytes offset from the “ size” member (i.e., from the address of the “connection_id” member)

    5. Encrypted Password

       Client sends RSA encrypted password, with public key received from server (in SpiceLinkReply). Format is EME-OAEP as described in PKCS#1 v2.0 with SHA-1, MGF1 and an empty encoding parameter.

    6. Link Result UINT32

       The server sends link result error code (i.e., SPICE_LINK_ERR_?)

12. Protocol message definition

    All messages transmitted after the link stage have a common message layout. It begins with SpiceDataHeader which describes one main message and an optional sub messages list.

    1. SpiceDataHeader

       UINT64 serial | serial number of the message within the channel. Serial numbers start with a value of 1 and are incremented on every message transmitted.
       UINT16 type | message type can be one that is accepted by all channel (e.g., SPICE_MSG_MIGRATE), or specific to a channel type (e.g., SPICE_MSG_DISPLAY_MODE for display channel).
       UINT32 size | size of the message body in bytes. In case sub_list (see below) is not zero then the actual main message size is sub_list. The message body follows SpiceDataHeader
       UINT32 sub_list | optional sub-messages list. If this field is not zero then sub_list is the offset in bytes to SpiceSubMessageList from the end of SpiceDataHeader. All sub-messages need to be executed before the main message, and in the order they appear in the sub-messageslist.

    2. SpiceSubMessageList

       UINT16 size | number of sub-messages in this list.
       UINT32[] sub_messages | array of offsets to sub message, offset is number of bytes from the end of SpiceDataHeader to start of SpicedSubMessage.

    3. SpicedSubMessage

       UINT16 type | message type can be one that is accepted by all channel (e.g., SPICE_MSG_MIGRATE), or specific to a channel type (e.g., SPICE_MSG_DISPLAY_MODE for display channel).
       UINT32 size | size of the message body in bytes. The message body follows SpicedSubMessage.

13. Common messages and messaging naming convention

    Messages types and message body structures are prefixed according to the source of the message. The prefixes for messages sent from the server to the client are SPICE_MSG for types and SpiceMsg for structures. For messages sent from the client the prefixes are SPICE_MSGC and SpiceMsgc.

14. Server messages that are common to all channels

        SPICE_MSG_MIGRATE               = 1
        SPICE_MSG_MIGRATE_DATA          = 2
        SPICE_MSG_SET_ACK               = 3
        SPICE_MSG_PING                  = 4
        SPICE_MSG_WAIT_FOR_CHANNELS     = 5
        SPICE_MSG_DISCONNECTING         = 6
        SPICE_MSG_NOTIFY                = 7

        SPICE_MSG_FIRST_AVAIL   = 101

    Specific channel server messages start from SPICE_MSG_FIRST_AVAIL. All message types from SPICE_MSG_NOTIFY + 1 to SPICE_MSG_FIRST_AVAIL – 1 are reserved for further use.

15. Client messages that are common to all channels

        SPICE_MSGC_ACK_SYNC                     = 1
        SPICE_MSGC_ACK                          = 2
        SPICE_MSGC_PONG                         = 3
        SPICE_MSGC_MIGRATE_FLUSH_MARK           = 4
        SPICE_MSGC_MIGRATE_DATA                 = 5
        SPICE_MSGC_DISCONNECTING                = 6

        SPICE_MSGC_FIRST_AVAIL          = 101

    Specific channel client messages start from SPICE_MSGC_FIRST_AVAIL. All message types from SPICE_MSGC_ACK_SYNC+ 1 to SPICE_MSGC_FIRST_AVAIL – 1 are reserved for further use.

16. Messages acknowledgment.

    Spice provides a set of messages for requesting an acknowledgment on every one or more messages that the client consumes. In order to request acknowledgment messages, the server sends SPICE_MSG_SET_ACK with the requested acknowledgment frequency – after how many received messages the client sends acknowledgment. . In response, the client sends SPICE_MSGC_ACK_SYNC. From this point, for every requested number of messages that the client receive, it will send a SPICE_MSGC_ACK message.

    1. SPICE_MSG_SET_ACK, SpiceMsgSetAck

       UINT32 generation | the generation of the acknowledgment sequence. This value will be sent back by SPICE_MSGC_ACK_SYNC. It is used for acknowledgment accounting synchronization.
       UINT32 window | the window size. Spice client will send acknowledgment for every “window” messages. Zero window size will disable messages acknowledgment.

    2. SPICE_MSGC_ACK_SYNC, UINT32

       UINT32 | Spice client sends SpiceMsgSetAck.generation in response to SPICE_MSG_SET_ACK

    3. SPICE_MSGC_ACK, VOID

       Spice client sends SPICE_MSGC_ACK message for every SpiceMsgSetAck.window messages it consumes.

17. Ping

    Spice protocol provides ping messages for debugging purpose. Spice server sends SPICE_MSG_PING and the client responses with SPICE_MSGC_PONG. The server can measure round trip time by subtracting current time with the time that is returned in SPICE_MSGC_PONG message.

    1. SPICE_MSG_PING, SpiceMsgPing

       UINT32 id | the id of this message
       UINT64 time | time stamp of this message

    2. SPICE_MSGC_PONG, SpiceMsgPing

       UINT32 id | Spice client copies it from SpiceMsgPing.id
       UINT64 time | Spice client copies it from SpiceMsgPing.time

18. Channel migration

    Spice supports migration of Spice server. The following common messages combined with specific main channel messages is used for migrating channels connections between spice servers. We will refer these servers as source and destination. Main channel is used for initiating and controlling the migration process. The following describes the actual channel migration process.

    Channel migration process starts with sending SPICE_MSG_MIGRATE message from the server. The client receives the message, examine the attached flags and: if the server requests messages flush (i.e., SPICE_MIGRATE_NEED_FLUSH flag is on), the client sends SPICE_MSGC_MIGRATE_FLUSH_MARK message to the server. This procedure can be used to ensure safe delivery of all mid air messages before performing the migration action. if the server requests data transfer (i.e., SPICE_MIGRATE_NEED_DATA_TRANSFER flag is on), the client expects to receive one last message from the server before migrating to destination. This message type must be SPICE_MSG_MIGRATE_DATA type. The content of the received message will be transmitted to the destination on connection swap.

    Afterward, the client swaps communication channels (i.e., starts using the connection with the destination server). The client can close connection with the source server only after all other channels also have finished the migration process. If the server side has requested data transfer, the client first transmits SPICE_MSGC_MIGRATE_DATA message containing the data received on SPICE_MSG_MIGRATE_DATA.

    1. Migration flags

           SPICE_MIGRATE_NEED_FLUSH                        = 1
           SPICE_MIGRATE_NEED_DATA_TRANSFER                = 2

    2. SPICE_MSG_MIGRATE, SpiceMsgMigrate

       UINT32 flags | combination of SPICE migration flags.

       1. SPICE_MSG_MIGRATE_DATA, UINT8[]

          Server migrate data, body of this message is variable length raw data that is determined by each channel type independently

       2. SPICE_MSGC_MIGRATE_FLUSH_MARK, VOID

          This messages mark completion of client communication channel flushing.

    3. SPICE_MSGC_MIGRATE_DATA, UINT8[]

       Post migration data, sent by client to the destination, containing the data sent by the source using the SPICE_MSG_MIGRATE_DATA message.

19. Channel synchronization

    Spice provides mechanism for synchronizing channels message execution on the client side. The server sends SPICE_MSG_WAIT_FOR_CHANNELS message which contains a list of channels messages to wait for (i.e., SpiceMsgWaitForChannels). The Spice client will wait for completion of all the messages that are in that list before executing any more messages.

    1. SpiceWaitForChannel

       UINT8 type | channel type (e.g., SPICE_CHANNEL_INPUTS)
       UINT8 id | channel id.
       UIN64 serial | message serial id (i.e, SpiceDataHeader.serial) to wait for

       1. SPICE_MSG_WAIT_FOR_CHANNELS, SpiceMsgWaitForChannels

          UINT8 wait_count | number of items in wait_list
          SpiceWaitForChannel[] wait_list | list of channels to wait for.

20. Disconnect reason

    The following messages are used for notification about orderly disconnection of the server or client.

    1. SPICE_MSG_DISCONNECTING, SpiceMsgDisconnect

       UINT64 time_stamp | time stamp of disconnect action on the server.
       UINT32 reason | disconnect reason, SPICE_LINK_ERR_?

    2. SPICE_MSGC_DISCONNECTING, SpiceMsgDisconnect

       UINT64 time_stamp | time stamp of disconnect action on the client.
       UINT32 reason | disconnect reason, SPICE_LINK_ERR_?

21. Server notification

    Spice protocol defines message for delivering notifications to the client using SPICE_MSG_NOTIFY message. Messages are categorized by severity and visibility. The later can be used as hint for the way the message is displayed to the user. For example high visibility notifications will trigger message box and low visibility notifications will be directed to the log.

    1. SPICE_MSG_NOTIFY, SpiceMsgNotify

       UINT64 time_stamp | server side time stamp of this message.
       UINT32 severity | one of SPICE_NOTIFY_SEVERITY_?
       UINT32 visibility | one of SPICE_NOTIFY_VISIBILITY_?
       UINT32 what | one of SPICE_LINK_ERR_?, SPICE_WARN_? Or SPICE_INFO_?, depending on severity.
       UINT32 message_len | size of message
       UINT8[] message | message string in UTF8.
       UINT8 0 | string zero termination

## 3. Main Channel definition

1. Server messages

       SPICE_MSG_MAIN_MIGRATE_BEGIN            = 101
       SPICE_MSG_MAIN_MIGRATE_CANCEL           = 102
       SPICE_MSG_MAIN_INIT                     = 103
       SPICE_MSG_MAIN_CHANNELS_LIST            = 104
       SPICE_MSG_MAIN_MOUSE_MODE               = 105
       SPICE_MSG_MAIN_MULTI_MEDIA_TIME         = 106

       SPICE_MSG_MAIN_AGENT_CONNECTED          = 107
       SPICE_MSG_MAIN_AGENT_DISCONNECTED       = 108
       SPICE_MSG_MAIN_AGENT_DATA               = 109
       SPICE_MSG_MAIN_AGENT_TOKEN              = 110

2. Client messages

       SPICE_MSGC_MAIN_CLIENT_INFO             = 101
       SPICE_MSGC_MAIN_MIGRATE_CONNECTED       = 102
       SPICE_MSGC_MAIN_MIGRATE_CONNECT_ERROR   = 103
       SPICE_MSGC_MAIN_ATTACH_CHANNELS         = 104
       SPICE_MSGC_MAIN_MOUSE_MODE_REQUEST      = 105

       SPICE_MSGC_MAIN_AGENT_START             = 106
       SPICE_MSGC_MAIN_AGENT_DATA              = 107
       SPICE_MSGC_MAIN_AGENT_TOKEN             = 108

3. Migration control

   Spice migration control is performed using the main channel messages. Spice server initiates migration process by sending SPICE_MSG_MAIN_MIGRATE_BEGIN message. Once the client has completed its pre-migrate procedure it notifies the server by transmitting SPICE_MSGC_MAIN_MIGRATE_CONNECTED message. In case of pre-migrate procedure error, the client sends SPICE_MSGC_MAIN_MIGRATE_CONNECT_ERROR. Once the server receives SPICE_MSGC_MAIN_MIGRATE_CONNECTED he can commence the migration process. The server can send SPICE_MSG_MAIN_MIGRATE_CANCEL in order to instruct the client to cancel the migration process.

   1. SPICE_MSG_MAIN_MIGRATE_BEGIN, SpiceMsgMainMigrationBegin

      UINT16 port | port of destination server
      UINT16 sport | secure port of destination server
      UINT8[] host_name | host name of destination server

   2. SPICE_MSG_MAIN_MIGRATE_CANCEL, VOID

      Instruct the client to cancel migration process

   3. SPICE_MSGC_MAIN_MIGRATE_CONNECTED, VOID

      Notify the server of successful completion of the pre-migrate stage

   4. SPICE_MSGC_MAIN_MIGRATE_CONNECT_ERROR, VOID

      Notify the server of pre-migrate stage error

4. Mouse modes

   Spice protocol specifies two mouse modes, client mode and server mode. In client mode, the affective mouse is the client side mouse: the client sends mouse position within the display and the server sends mouse shape messages. In server mode, the client sends relative mouse movements and the server sends position and shape commands. Spice main channel is used for mouse mode control.

   1. Modes

          SPICE_MOUSE_MODE_SERVER = 1
          SPICE_MOUSE_MODE_CLIENT = 2

   2. SPICE_MSG_MAIN_MOUSE_MODE, SpiceMsgMainMouseMode

      Spice server sends this message on every mouse mode change

      UINT32 supported_modes | current supported mouse mode, this is any combination of SPICE_MOUSE_MODE_?
      UINT32 current_mode | the current mouse mode. Can be one of SPICE_MOUSE_MODE_?

   3. SPICE_MSGC_MAIN_MOUSE_MODE_REQUEST, UINT32

      Spice client sends this message to request specific mouse mode. It is not guarantied that the server will accept the request. Only on receiving SPICE_MSG_MAIN_MOUSE_MODE message, the client can know of actual mouse mode change.

      UINT32 | requested mode, one of SPICE_MOUSE_MODE_?

5. Main channel init message

   Spice server must send SpiceMsgMainInit as the first transmitted message t and is disallowed to send it at any other point.

   1. SPICE_MSG_MAIN_INIT, SpiceMsgMainInit

      UINT32 session_id | session id is generated by the server. This id will be send on every new channel connection within this session (i.e., in SpiceLinkMess.connection_id).
      UINT32 display_channels_hint | optional hint of expected number of display channels. Zero is defined as an invalid value
      UINT32 supported_mouse_modes | supported mouse modes. This is any combination of SPICE_MOUSE_MODE_?
      UINT32 current_mouse_mode | the current mouse mode, one of SPICE_MOUSE_MODE_?
      UINT32 agent_connected | current state of Spice agent (see This Section), 0 and 1 stand for disconnected and connected state respectively.
      UINT32 agent_tokens | number of available tokens for sending messages to Spice agent.
      UINT32 multi_media_time | current server multimedia time. The multimedia time is used for synchronizing video (for more information see Multimedia time)
      UINT32 ram_hint | optional hint for help in determining global LZ compression dictionary size (for more information see section Spice Image in “Display Channel”).

6. Server side channels notification

   In order to have the ability to dynamically attach to the server side channels, Spice protocol includes SPICE_MSG_MAIN_CHANNELS_LIST message. This massage informs the client of available channels in the server side. In response to this message the client can decide to link with the new available channel(s). The server must receive SPICE_MSGC_MAIN_ATTACH_CHANNELS before sending any SPICE_MSG_MAIN_CHANNELS_LIST message.

   1. SPICE_MSG_MAIN_CHANNELS_LIST, SpiceMsgChannels

      UINT32 num_of_channels | number of channels in this list
      SpiceChannelId[] channels | vector of “num_of_channels” channel ids

   2. SpiceChannelId

      UINT8 type | channel type, one of SPICE_CHANNEL_? channel types, except for SPICE_CHANNEL_MAIN
      UINT8 id | channel id

7. Multimedia time

   Spice defines messages for setting multimedia time for synchronization of video and audio streams. Two methods for updating multimedia time are supported. The first method uses the time stamp of data that arrives on the playback channel.The second method uses the main channel SPICE_MSG_MAIN_MULTI_MEDIA_TIME message. The latter method is used when no active playback channel exist.

   1. SPICE_MSG_MAIN_MULTI_MEDIA_TIME, UINT32

      UINT32 | multimedia time

8. Spice agent

   Spice protocol defines a set of messages for bidirectional communication channel between Spice client and spice client agent on the remote server. Spice provides a communication channel only, the actual transferred data content is opaque to the protocol. This channel can be used for various purposes, for example, client-guest clipboard sharing, authentication and display configuration.

   Spice client receives notifications of remote site agent connection as part of the SPICE_MSG_MAIN_INIT message or by a specific server SPICE_MSG_MAIN_AGENT_CONNECTED. Remote agent disconnection notification is delivered by SPICE_MSG_MAIN_AGENT_DISCONNECTED message. A bidirectional tokens mechanism is used in order to prevent blocking of the main channel with agent messages (e.g., in case the agent stops consuming the data). Each side is not allowed to send more messages than the tokens allocated to it by the other side. The number of tokens that are allocated for the client is initialized from SPICE_MSG_MAIN_INIT message, and farther allocation of tokens is done using SPICE_MSG_MAIN_AGENT_TOKEN. Server tokens initial count is delivered in SPICE_MSGC_MAIN_AGENT_START message. This message must be the first agent related message that the client sends to the server. Farther tokens allocation for the server is done using SPICE_MSGC_MAIN_AGENT_TOKEN. Actual data packets are delivered using SPICE_MSG_MAIN_AGENT_DATA and SPICE_MSGC_MAIN_AGENT_DATA.

   1. Although agent messages are opaque for the protocol, agent data stream is defined by Spice protocol in order to delineate messages. Still, the client-server communication is independent from the agent channel, e.g., agent protocol conflicts don’t affect the rest of the channels. Agent stream is defined as a run of messages having the following format:

      UINT32 protocol | unique protocol of this message. The protocol id must be registered in order to prevent conflicts.
      UINT32 type | protocol dependent message type.
      UINT64 opaque | protocol dependent opaque data.
      UINT32 size | size of data in bytes.
      UINT8 data[0] | data of this message.

      Client and server must continue processing unknown protocols messages or messages having unknown type (i.e., receive and dump).

   2. SPICE_MSG_MAIN_AGENT_CONNECTED, VOID

   3. SPICE_MSG_MAIN_AGENT_DISCONNECTED, UINT32

      UINT32 | disconnect error code SPICE_LINK_ERR_?

   4. SPICE_AGENT_MAX_DATA_SIZE = 2048

   5. SPICE_MSG_MAIN_AGENT_DATA, UINT8[]

      Agent packet is the entire message body (i.e. SpiceDataHeader.size). The maximum packet size is SPICE_AGENT_MAX_DATA_SIZE.

   6. SPICE_MSG_MAIN_AGENT_TOKEN, UINT32

      UINT32 | allocated tokens count for the client

   7. SPICE_MSGC_MAIN_AGENT_START, UINT32

      UINT32 | allocated tokens count for the server

   8. SPICE_MSGC_MAIN_AGENT_DATA, UINT8[]

      Agent packet is the entire message body (i.e. SpiceDataHeader.size). The maximum packet size is SPICE_AGENT_MAX_DATA_SIZE.

   9. SPICE_MSGC_MAIN_AGENT_TOKEN, UINT32

      UINT32 | allocated tokens count for the server

## 4. Inputs channel definition

Spice Inputs channel controls the server mouse and the keyboard.

1. Client messages

       SPICE_MSGC_INPUTS_KEY_DOWN              = 101
       SPICE_MSGC_INPUTS_KEY_UP                = 102
       SPICE_MSGC_INPUTS_KEY_MODIFIERS         = 103

       SPICE_MSGC_INPUTS_MOUSE_MOTION          = 111
       SPICE_MSGC_INPUTS_MOUSE_POSITION        = 112
       SPICE_MSGC_INPUTS_MOUSE_PRESS           = 113
       SPICE_MSGC_INPUTS_MOUSE_RELEASE         = 114

2. Server Messages

       SPICE_MSG_INPUTS_INIT                   = 101
       SPICE_MSG_INPUTS_KEY_MODIFIERS          = 102

       SPICE_MSG_INPUTS_MOUSE_MOTION_ACK       = 111

3. Keyboard messages

   Spice supports sending keyboard key events and keyboard leds synchronization. The client sends key event using SPICE_MSGC_INPUTS_KEY_DOWN and SPICE_MSGC_INPUTS_KEY_UP messages. Key value is expressed using PC AT scan code (see KeyCode). Keyboard leds synchronization is done by sending SPICE_MSG_INPUTS_KEY_MODIFIERS message by the server or by sending SPICE_MSGC_INPUTS_KEY_MODIFIERS by the client, these messages contain keyboard leds state. Keyboard modifiers is also sent by the server using SPICE_MSG_INPUTS_INIT, this message must be sent as the first server message and the server mustn’t send it at any other point.

   1. Keyboard led bits

          SPICE_SCROLL_LOCK_MODIFIER      = 1
          SPICE_NUM_LOCK_MODIFIER         = 2
          SPICE_CAPS_LOCK_MODIFIER        = 4

   2. SPICE_MSG_INPUTS_INIT, UINT32

      UINT32 | any combination of keyboard led bits. If bit is set then the led is on.

   3. SPICE_MSG_INPUTS_KEY_MODIFIERS, UINT32

      UINT32 | any combination of keyboard led bits. If bit is set then the led is on.

   4. SPICE_MSGC_INPUTS_KEY_MODIFIERS, UINT32

      UINT32 | any combination of keyboard led bits. If bit is set then the led is on.

   5. KeyCode

      UINT8[4] | the value of key code is a PC AT scan code. The code is composed by up to four bytes for supporting extended codes. A code is terminated by a zero byte.

   6. SPICE_MSGC_INPUTS_KEY_DOWN, KeyCode

      KeyCode | client sends this message to notify of key press event.

   7. SPICE_MSGC_INPUTS_KEY_UP, KeyCode

      KeyCode – client sends this message to notify of key release event.

4. Mouse messages

   spice support two modes of mouse operation: client mouse and server mouse (for more information see mouse modes). in server mouse mode the client sends mouse motion message (i.e., msgc_inputs_mouse_motion), and in client mouse mode it sends position message (i.e., msgc_inputs_mouse_position). position message holds the position of the client mouse on the display and the id of the display channel, which is derived from SpiceLinkMess.channel_id. in order to prevent flood of mouse motion/position events, the server sends red_inputs_mouse_motion_ack message on every red_motion_ack_bunch messages it receive. this mechanism allows the client to keep track on the server’s messages consumption rate and to change the event pushing policy according to it. mouse button events are sent to the server using msgc_inputs_mouse_press and msgc_inputs_mouse_release messages.

   1. Spice Button ID

          SPICE_MOUSE_BUTTON_LEFT         = 1, left button
          SPICE_MOUSE_BUTTON_MIDDLE       = 2, middle button
          SPICE_MOUSE_BUTTON_RIGHT        = 3, right button
          SPICE_MOUSE_BUTTON_UP           = 4, scroll up button
          SPICE_MOUSE_BUTTON_DOWN         = 5, scroll down button

   2. Buttons masks

          SPICE_MOUSE_BUTTON_MASK_LEFT            = 1,  left button mask
          SPICE_MOUSE_BUTTON_MASK_MIDDLE          = 2,  middle button mask
          SPICE_MOUSE_BUTTON_MASK_RIGHT           = 4, right button mask

   3. SPICE_INPUT_MOTION_ACK_BUNCH

          SPICE_INPUT_MOTION_ACK_BUNCH            = 4

   4. SPICE_MSGC_INPUTS_MOUSE_MOTION, SpiceMsgcMouseMotion

      INT32 dx | number of pixels the mouse had moved on x axis
      INT32 dy | number of pixels the mouse had moved on y axis
      UINT32 buttons_state | any combination of buttons mask. Set bit describe pressed button and clear bit describe unpressed button.

   5. SPICE_MSGC_INPUTS_MOUSE_POSITION, SpiceMsgcMousePosition

      UINT32 x | position on x axis
      UINT32 y | position on y axis
      UINT32 buttons_state | any combination of buttons mask. Set bit describe pressed button and clear bit describe unpressed button.
      UINT8 display_id | id of the display that client mouse is on.

   6. SPICE_MSGC_INPUTS_MOUSE_PRESS, SpiceMsgcMousePress

      UINT32 button | one of SPICE_MOUSE_?BUTTON
      UINT32 buttons_state | any combination of buttons masks. Set bit describes pressed button, and clear bit describes unpressed button.

   7. SPICE_MSGC_INPUTS_MOUSE_RELEASE, SpiceMsgcMouseRelease

      UINT32 button | one of SPICE_MOUSE_?BUTTON
      UINT32 buttons_state | any combination of buttons mask. Set bit describes pressed button and clear bit describes unpressed button.

## 5. Display channel definition

Spice protocol defines a set of messages for supporting rendering of the remote display area on the client display. The protocol supports rendering of graphics primitives (e.g., lines, images) and video streams. The protocol also supports caching of images and color palettes on the client side. Spice display channel supports several images compression methods for reducing network traffic.

1. Server messages

       SPICE_MSG_DISPLAY_MODE                          = 101
       SPICE_MSG_DISPLAY_MARK                          = 102
       SPICE_MSG_DISPLAY_RESET                         = 103
       SPICE_MSG_DISPLAY_COPY_BITS                     = 104

       SPICE_MSG_DISPLAY_INVAL_LIST                    = 105
       SPICE_MSG_DISPLAY_INVAL_ALL_PIXMAPS             = 106
       SPICE_MSG_DISPLAY_INVAL_PALETTE                 = 107
       SPICE_MSG_DISPLAY_INVAL_ALL_PALETTES            = 108

       SPICE_MSG_DISPLAY_STREAM_CREATE                 = 122
       SPICE_MSG_DISPLAY_STREAM_DATA                   = 123
       SPICE_MSG_DISPLAY_STREAM_CLIP                   = 124
       SPICE_MSG_DISPLAY_STREAM_DESTROY                = 125
       SPICE_MSG_DISPLAY_STREAM_DESTROY_ALL            = 126

       SPICE_MSG_DISPLAY_DRAW_FILL                     = 302
       SPICE_MSG_DISPLAY_DRAW_OPAQUE                   = 303
       SPICE_MSG_DISPLAY_DRAW_COPY                     = 304
       SPICE_MSG_DISPLAY_DRAW_BLEND                    = 305
       SPICE_MSG_DISPLAY_DRAW_BLACKNESS                = 306
       SPICE_MSG_DISPLAY_DRAW_WHITENESS                = 307
       SPICE_MSG_DISPLAY_DRAW_INVERS                   = 308
       SPICE_MSG_DISPLAY_DRAW_ROP3                     = 309
       SPICE_MSG_DISPLAY_DRAW_STROKE                   = 310
       SPICE_MSG_DISPLAY_DRAW_TEXT                     = 311
       SPICE_MSG_DISPLAY_DRAW_TRANSPARENT              = 312
       SPICE_MSG_DISPLAY_DRAW_ALPHA_BLEND              = 313

2. Client messages

       SPICE_MSGC_DISPLAY_INIT                         = 101

3. Operation flow

   Spice server sends to the client a mode message using SPICE_MSG_DISPLAY_MODE for specifying the current draw area size and format. In response the client creates a draw area for rendering all the followed rendering commands sent by the server. The client will expose the new remote display area content (i.e., after mode command) only after it receives a mark command (i.e., SPICE_MSG_DISPLAY_MARK) from the server. The server can send a reset command using SPICE_MSG_DISPLAY_RESET to instruct the client to drop its draw area and palette cache. Sending mode message is allowed only while no active draw area exists on the client side. Sending reset message is allowed only while active draw area exists on client side. Sending mark message is allowed only once, between mode and reset messages. Draw commands, copy bits command and stream commands are allowed only if the client have an active display area (i.e., between SPICE_MSG_DISPLAY_MODE to SPICE_MSG_DISPLAY_RESET).

   On channel connection, the client optionally sends an init message, using SPICE_MSGC_DISPLAY_INIT, in order to enable image caching and global dictionary compression. The message includes the cache id and its size and the size of the dictionary compression window. These sizes and id are determined by the client. It is disallowed to send more then one init message.

   Color pallets cache are manged by the server. Items cache insertion commands are sent as part of the rendering commands. Cache items removal are sent explicitly using SPICE_MSG_DISPLAY_INVAL_LIST or SPICE_MSG_DISPLAY_INVAL_LIST server messages. Resetting client caches is done by sending SPICE_MSG_DISPLAY_INVAL_ALL_PIXMAPS or SPICE_MSG_DISPLAY_INVAL_ALL_PALETTES server messages.

4. Draw area control

   1. SPICE_MSG_DISPLAY_MODE, SpiceMsgDisplayMode

      UINT32 width | width of the display area
      UINT32 height | height of the display area
      UINT32 depth | color depth of the display area. Valid values are 16bpp or 32bpp.

   2. SPICE_MSG_DISPLAY_MARK, VOID

      Mark the beginning of the display area visibility

   3. SPICE_MSG_DISPLAY_RESET, VOID

      Drop current display area of the channel and reset palette cache

5. Raster operation descriptor

   The following defines a set of flags for describing raster operations that can be applied on a source image, source brush, destination and the result during a rendering operation. Combination of those flags defines the necessary steps that are needed to be preformed during a rendering operation. In the following definitions of rendering commands this combination is referred to by rop_descriptor.

       SPICE_ROPD_INVERS_SRC           = 1

   Source Image need to be inverted before rendering

       SPICE_ROPD_INVERS_BRUSH         = 2

   SpiceBrush need to be inverted before rendering

       SPICE_ROPD_INVERS_DEST          = 4

   Destination area need to be inverted before rendering

       SPICE_ROPD_OP_PUT               = 8

   SpiceCopy operation should be used.

       SPICE_ROPD_OP_OR                = 16

   OR operation should be used.

       SPICE_ROPD_OP_AND               = 32

   AND operation should be used.

       SPICE_ROPD_OP_XOR               = 64

   XOR operation should be used.

       SPICE_ROPD_OP_BLACKNESS         = 128

   Destination pixel should be replaced by black

       SPICE_ROPD_OP_WHITENESS         = 256

   Destination pixel should be replaced by white

       SPICE_ROPD_OP_INVERS            = 512

   Destination pixel should be inverted

       SPICE_ROPD_INVERS_RES           = 1024

   Result of the operation needs to be inverted

   OP_PUT, OP_OR, OP_AND, OP_XOR, OP_BLACKNESS, OP_WHITENESS, and OP_INVERS are mutually exclusive

   OP_BLACKNESS, OP_WHITENESS, and OP_INVERS are exclusive

6. Raw raster image

   The following section describes Spice raw raster image (Pixmap). Pixmap is one of several ways to transfer images in Spice protocol (for more information see Spice Image).

   1. Pixmap format types

          PIXMAP_FORMAT_1BIT_LE           = 1

      1 bit per pixel and bits order is little endian. Each pixel value is an index in a color table. The color table size is 2.

          PIXMAP_FORMAT_1BIT_BE           = 2

      1 bit per pixel and bits order is big endian. Each pixel value is index in a color table. The color table size is 2.

          PIXMAP_FORMAT_4BIT_LE           = 3

      4 bits per pixel and nibble order inside a byte is little endian. Each pixel value is an index in a color table. The color table size is 16.

          PIXMAP_FORMAT_4BIT_BE           = 4

      4 bits per pixel and nibble order inside a byte is big endian. Each pixel value is an index in a color table. The color table size is 16.

          PIXMAP_FORMAT_8BIT              = 5

      8 bits per pixel. Each pixel value is an index in a color table. The color table size is 256.

          PIXMAP_FORMAT_16BIT             = 6

      pixel format is 16 bits RGB555.

          PIXMAP_FORMAT_24BIT             = 7

      pixel format is 24 bits RGB888.

          PIXMAP_FORMAT_32BIT             = 8

      pixel format is 32 bits RGB888.

          PIXMAP_FORMAT_RGBA              = 9

      pixel format is 32 bits ARGB8888.

   2. SpicePalette

      UINT64 id | unique id of the palette
      UINT16 table_size | number of entries in the color table
      UINT32[] color_table | each entry is RGB555 or RGB888 color depending on the current display area mode. If display area mode color depth is 32, the effective format is RGB888. If display area mode color depth is 16 the effective format is RGB555.

   3. Pixmap flags

          PIXMAP_FLAG_PAL_CACHE_ME        = 1

      Instruct the client to add the palette to cache

          PIXMAP_FLAG_PAL_FROM_CACHE      = 2

      Instruct the client to retrieve palette from cache.

          PIXMAP_FLAG_TOP_DOWN            = 4

      Pixmap lines are ordered from top to bottom (i.e., line 0 is the highest line).

   4. Pixmap

      UINT8 format | one of PIXMAP_FORMAT_?
      UINT8 flags | combination of PIXMAP_FLAG_?
      UINT32 width | width of the pixmap
      UINT32 height | height of the pixmap
      UINT32 stride | number of bytes to add for moving from the beginning of line n to the beginning of line n+1
          union {
                  SPICE_ADDRESS palette;
                  UINT64 palette_id;
          }
      | address of the color palette (must be zero if no color table is required for format) or id of the palette (valid if FLAG_PAL_FROM_CACHE is set).
      SPICE_ADDRESS data | address of line 0 of the pixmap.

7. LZ with palette

   This section describes a data structure that is combination of a color palette and a compressed pixmap data. The pixmap is compressed using our implementation of LZSS algorithm (see next section). Each decoded pixel value is an index in the color palette.

   1. LZPalette Flags

          LZPALETTE_FLAG_PAL_CACHE_ME             = 1

      Instruct the client to add the palette to the cache

          LZPALETTE_FLAG_PAL_FROM_CACHE           = 2

      Instruct the client to retrieve palette from the cache.

          LZPALETTE_FLAG_TOP_DOWN                 = 4

      pixmap lines are ordered from top to bottom (i.e. line 0 is the highest line).

   2. LZPalette

      UINT8 flags | combination of LZPALETTE_FLAG_?
      UINT32 data_size | size of compressed data
          union {
                  SPICE_ADDRESS palette;
                  UINT64 palette_id;
          }
      | address of the color palette (see SpicePalette section in “Raw raster image”)[zero value is disallowed] or id of the palette (valid if FLAG_PAL_FROM_CACHE).
      UINT8[] data | compressed pixmap

8. Spice Image

   The following section describes Spice image. Spice image is used in various commands and data structures for representing a raster image. Spice image supports several compression types in addition to the raw mode: Quic, LZ and GLZ. Quic is a predictive coding algorithm. It is a generalization of SFALIC from gray-scale to color images withe addition of RLE encoding. By LZ we refer to the our implementation of the LZSS algorithm, which was adjusted for images in different formats. By GLZ we refer to an extension of LZ that allows it to use a dictionary that is based on a set of images and not just on the image being compressed.

   1. Image types

          IMAGE_TYPE_PIXMAP               = 0
          SPICE_IMAGE_TYPE_QUIC           = 1
          SPICE_IMAGE_TYPE_LZ_PLT         = 100
          SPICE_IMAGE_TYPE_LZ_RGB         = 101
          SPICE_IMAGE_TYPE_GLZ_RGB        = 102
          SPICE_IMAGE_TYPE_FROM_CACHE     = 103

   2. Image flags

      IMAGE_FLAG_CACHE_ME = 1, this flag instruct the client to add the image to image cache, cache key is SpiceImageDescriptor.id (see below).

   3. SpiceImageDescriptor

      UINT64 id | unique id of the image
      UINT8 type | type of the image. One of IMAGE_TYPE_?
      UINT8 flags | any combination of IMAGE_FLAG_?
      UINT32 width | width of the image
      UINT32 height | height of the image

   4. Image data

      Image data follows SpiceImageDescriptor and its content depends on SpiceImageDescriptor.type:

      - In case of PIXMAP – content is Pixmap.

      - In case of QUIC – content is Quic compressed image. Data begins with the size of the compressed data, represented by UINT32, followed by the compressed data.

      - In case of LZ_PLT – content is LZPalette.

      - In case of LZ_RGB – content is LZ_RGB – LZ encoding of an RGB image. Data begins with the size of the compressed data, represented by UINT32, followed by the compressed data.

      - In case of GLZ_RGB – content is GLZ_RGB – GLZ encoding of an RGB image. Data begins with the size of the compressed data, represented by UINT32, , followed by the compressed data.

      - In case of FROM_CACHE – No image data. The client should use SpiceImageDescriptor.id to retrieve the relevant image from cache.

9. Glyph SpiceString

   Glyph string defines an array of glyphs for rendering. Glyphs in a string can be in A1, A4 or A8 format (i.e., 1bpp, 4bpp, or 8bpp alpha mask). Every glyph contains its rendering position on the destination draw area.

   1. SpiceRasterGlyph

      POINT render_pos | location of the glyph on the draw area
      POINT glyph_origin | origin of the glyph. The origin is relative to the upper left corner of the draw area. Positive value on x axis advances leftward and positive value on y axis advances upward.
      UINT16 width | glyph’s width
      UINT16 height | glyph’s height
      UINT8[] data | alpha mask of the glyph. Actual mask data depends on the glyph string’s flags. If the format is A1 then the line stride is ALIGN(width, 8) / 8. If the format is A4, the line stride is ALIGN(width, 2) / 2. If the format is A8, the line stride is width.

   2. Glyph SpiceString flags

          GLYPH_STRING_FLAG_RASTER_A1                     = 1

      Glyphs type is 1bpp alpha value (i.e., 0 is transparent 1 is opaque)

          GLYPH_STRING_FLAG_RASTER_A4                     = 2

      Glyphs type is 4bpp alpha value (i.e., 0 is transparent 16 is opaque)

          GLYPH_STRING_FLAG_RASTER_A8                     = 4

      Glyphs type is 4bpp alpha value (i.e., 0 is transparent 256 is opaque)

          GLYPH_STRING_FLAG_RASTER_TOP_DOWN               = 8

      Line 0 is the top line of the mask

   3. GlyphString

      UINT16 length | number of glyphs
      UINT16 flags | combination of GLYPH_STRING_FLAG_?
      UINT8[] data | glyphs

10. Data Types

    1. RectList

       UINT32 count | number of RECT items in rects
       RECT[] rects | array of <count> RECT

    2. Path segment flags

           PATH_SEGMENT_FLAG_BEGIN         = 1

       this segment begins a new path

           PATH_SEGMENT_FLAG_END           = 2

       this segment ends the current path

           PATH_SEGMENT_FLAG_CLOSE         = 8

       this segment closes the path and is invalid if PATH_SEGMENT_FLAG_END is not set

           PATH_SEGMENT_FLAG_BEZIER        = 16

       this segment content is a Bezier curve

    3. SpicePathSeg

       UINT32 flags | any combination of PATH_SEGMENT_FLAG_?
       UINT32 count | number of points in the segment
       POINTFIX[] points | segment points

    4. PathSegList

       List of SpicePathSeg items. End of the list is reached if the sum of all previous PathSegs' sizes is equal to list_size. Address of next segment is the address of SpicePathSeg.points[SpicePathSeg.count]

       UINT32 list_size | total size of in bytes of all PathSegs in the list,

       SpicePathSeg seg0 – first path segment.

    5. SpiceClip types

           SPICE_CLIP_TYPE_NONE            = 0

       no clipping

           SPICE_CLIP_TYPE_RECTS           = 1

       data is RectList and union of all rectangles in RectList is the effective clip

           SPICE_CLIP_TYPE_PATH            = 2

       data is PathSegList and the figure described by PathSegList is the effective clip

    6. SpiceClip

       UIN32 type | one of CLIP_TYPE_?
       SPICE_ADDRESS data | address of clip data. The content depends on <type>

    7. Mask flags

           MASK_FLAG_INVERS        = 1, the effective mask is the inverse of the mask

    8. Mask

       UINT8 flags | flags of the mask, combination of MASK_FLAG_?
       POINT position | origin of the mask in bitmap coordinates
       SPICE_ADDRESS bitmap | address of the mask’s image, the format of the image must be 1bpp. If the bitmap is zero then no masking operation needs to be preformed.

       In all rendering commands, the mask must be big enough to cover the destination rectangle

    9. SpiceBrush types

           SPICE_BRUSH_TYPE_NONE           = 0 /* the brush is invalid */
           SPICE_BRUSH_TYPE_SOLID          = 1 /* the brush is solid RGB color */
           SPICE_BRUSH_TYPE_PATTERN        = 2 /* the brush is a pattern */

    10. SpicePattern

        SPICE_ADDRESS image | address of the pattern’s Image
        POINT position | origin coordinates of the pattern in the image

    11. SpiceBrush

        UINT32 type | one of BRUSH_TYPE_?

            Union {
                    UINT32 color; */ RGB color. The format of the color depends on current
            draw area mode.*/
                    SpicePattern pattern;
            }

    12. Image scale mode

        The following defines the method for scaling image

            SPICE_IMAGE_SCALE_MODE_INTERPOLATE      = 0

        The client is allowed to INTERPOLATE pixel color.

            SPICE_IMAGE_SCALE_MODE_NEAREST          = 1

        The client must use the nearest pixel.

    13. LineAtrr flags

            LINE_ATTR_FLAG_START_WITH_GAP           = 4

        first style segment if gap (i.e., foreground)

            LINE_ATTR_FLAG_STYLED                   = 8

        style member of LineAtrr is valid and contains effective line style for the rendering operation.

    14. LineAtrr join style

            LINE_ATTR_JOIN_ROUND                    = 0
            LINE_ATTR_JOIN_BEVEL                    = 1
            LINE_ATTR_JOIN_MITER                    = 2

    15. LineAtrr cap style

            LINE_ATTR_CAP_ROUND                     = 0
            LINE_ATTR_CAP_SQUARE                    = 1
            LINE_ATTR_CAP_BUTT                      = 2

    16. SpiceLineAttr

        UINT8 flags | combination of LINE_ATTR_?
        UINT8 join_style | one of LINE_ATTR_JOIN_?
        UINT8 cap_style | one of LINE_ATTR_CAP_?
        UINT8 style_num_segments | number of style segments in line style
        SPICE_FIXED28_4 width | width of the line in pixels
        SPICE_FIXED28_4 miter_limit | miter limit in pixels
        SPICE_ADDRESS style | address of line style line style is array of SPICE_FIXED28_4. The array defines segments that each represents length of foreground or background pixels in the style. If FLAG_START_WITH_GAP is defined then the first segment in the style is background, otherwise it is foreground. Renderer uses this array of segments repeatedly during rendering operation.

11. Rendering command

    1. SpiceMsgDisplayBase

       Common field to all rendering command

       RECT bounding_box | the affected area on the display area
       SpiceClip clip | the effective clip to set before rendering a command

    2. SPICE_MSG_DISPLAY_COPY_BITS

           SpiceMsgDisplayBase
           POINT source_position

       SpiceCopy bits from the draw area to bounding_box on the draw area. Source area left top corner is source_position and its height and width is equal to bounding_box height and width. Source and destination rectangles can overlap.

    3. SPICE_MSG_DISPLAY_DRAW_FILL

           SpiceMsgDisplayBase
           SpiceBrush brush
           UINT16 rop_descriptor
           Mask mask

       SpiceFill bounding_box using brush as the fill pattern and rop_descriptor instructions. If the mask is valid, it will limit the modified area (i.e., only pixels on the destination area that their corresponding bits are set will be affected).

    4. SPICE_MSG_DISPLAY_DRAW_OPAQUE

           SpiceMsgDisplayBase
           SPICE_ADDRESS source_image
           RECT source_area
           SpiceBrush brush
           UINT16 rop_descriptor
           UINT8 scale_mode
           Mask mask

       Combine pixels from source_area in source_image with the brush’s pattern using rop_descriptor instructions. The result image will be rendered into bounding_box. In case scaling of source image is required it will be performed according to scale_mode and before the combination with brush pixels. If mask is valid it will limit the modified area.

    5. SPICE_MSG_DISPLAY_DRAW_COPY

           SpiceMsgDisplayBase
           SPICE_ADDRESS source_image
           RECT source_area
           UINT16 rop_descriptor
           UINT8 scale_mode
           Mask mask

       SpiceCopy pixels from source_area in source_image to bounding_box using rop_descriptor instructions. In case scaling of source image is required it will be performed according to scale_mode and before the copying to the draw area. If mask is valid it will limit the modified area.

    6. SPICE_MSG_DISPLAY_DRAW_BLEND

           SpiceMsgDisplayBase
           SPICE_ADDRESS source_image
           RECT source_area
           UINT16 rop_descriptor
           UINT8 scale_mode
           Mask mask

       Mixing pixels from source_area in source_image with bounding_box pixels on the draw area using rop_descriptor instructions. In case scaling of source image is required it will be performed according to scale_mode and before the mixing with the draw area. If mask is valid it will limit the modified area.

    7. SPICE_MSG_DISPLAY_DRAW_BLACKNESS

           SpiceMsgDisplayBase
           Mask mask

       SpiceFill bounding_box with black pixels. If mask is valid it will limit the modified area.

    8. SPICE_MSG_DISPLAY_DRAW_WHITENESS

           SpiceMsgDisplayBase
           Mask mask

       SpiceFill bounding_box with white pixels. If mask is valid it will limit the modified area.

    9. SPICE_MSG_DISPLAY_DRAW_INVERS

           SpiceMsgDisplayBase
           Mask mask

       Inverse all pixels in bounding_box. If mask is valid it will limit the modified area.

    10. SPICE_MSG_DISPLAY_DRAW_ROP3

            SpiceMsgDisplayBase
            SPICE_ADDRESS source_image
            RECT source_area
            SpiceBrush brush
            UINT8 rop3
            UINT8 scale_mode
            Mask mask

        Mix pixels from source_area in source_image, bounding_box pixels in the draw area, and the brush pattern. The method for mixing three pixels into the destination area (i.e., bounding_box) is defined by rop3 (i.e., ternary raster operations). In case scaling of source image is required it will be performed according to scale_mode and before the mixing. If mask is valid it will limit the modified area.

    11. SPICE_MSG_DISPLAY_DRAW_TRANSPARENT

            SpiceMsgDisplayBase
            SPICE_ADDRESS source_image
            RECT source_area
            UINT32 transparent_color
            UINT32 transparent _true_color

        SpiceCopy pixels from source_area on source_image to bounding_box on the draw area. In case scaling of source image is required it will use SPICE_IMAGE_SCALE_MODE_NEAREST. Pixels with value equal to the transparent color will be masked out. SpiceTransparent color is provided in two forms: true color (i.e., RGB888) and the color in the original format (i.e., before compression) .

    12. SPICE_MSG_DISPLAY_DRAW_ALPHA_BLEND

            SpiceMsgDisplayBase
            UINT8 alpha
            SPICE_ADDRESS source_image
            RECT source_area

        Alpha blend source_area of source_image on bounding_box of draw area using alpha value or alternatively per pixel alpha value. In case scaling of source image is required, it will use SPICE_IMAGE_SCALE_MODE_INTERPOLATE mode. Alpha value is defined as 0 is full transparency and 255 is full opacity. Format of source image can be pre-multiplied ARGB8888 for per pixel alpha value.

        New RGB color is defined as:

            color' =   (source_color *  alpha)  /  255
            alpha' =   (source_alpha *  alpha)  /  255
            new_color = color' + ((255 - alpha' ) * destination_color) / 255

    13. SPICE_MSG_DISPLAY_DRAW_STROKE

            SpiceMsgDisplayBase
            SPICE_ADDRESS path – address of the PathSegList that defines the path to render
            SpiceLineAttr attr
            Bush brush
            UINT16 fore_mode -  foreground rop_descriptor
            UINT16 back_mode – background rop_descriptor

        Render path using brush line attribute and rop descriptors. If the line is styled (i.e., LINE_ATTR_FLAG_STYLED is set in attr.falgs) then background (i.e., inverse of the style) is drawn using back_mode and the foreground is drawn using fore_mode. If the line is not styled, the entire path is rendered using fore_mode.

    14. SPICE_MSG_DISPLAY_DRAW_TEXT

            SpiceMsgDisplayBase
            SPICE_ADDRESS string – address of GlyphString
            RECT back_area
            SpiceBrush fore_brush
            SpiceBrush back_brush
            UINT16 fore_mode
            UINT16 back_mode

        Render string of glyph on the display area using brush fore_brush and the rop_descriptor fore_mode. If back_area is not empty the renderer fill back_area on the display area prior to rendering the glyph string. back_area is filled using back_brush and the rop_descriptor back_mode.

12. Video streaming commands

    Spice supports the creation of video streams by the server for rendering video content on the client display area. Unlike other rendering commands, the stream data can be compressed using lossy or video specific compression algorithms. It is not required to render video frames as they arrive and it is also allowed to drop video frames. This enables using video frames buffering for having smoother playback and audio synchronization. Audio synchronization is achieved by using time stamp that is attached to audio and video streams. By using video streaming the network traffic can be dramatically reduced. When the stream is created, the server sends create message using SPICE_MSG_DISPLAY_STREAM_CREATE. After the server creates a stream he can send data using SPICE_MSG_DISPLAY_STREAM_DATA, or set new stream clipping by sending clip message using SPICE_MSG_DISPLAY_STREAM_CLIP. Once the server no longer needs the stream, he can send destroy command using SPICE_MSG_DISPLAY_STREAM_DESTROY. The server can also destroy all active streams by sending destroy all message using SPICE_MSG_DISPLAY_STREAM_DESTROY_ALL.

    1. Stream flags

           STREAM_FLAG_TOP_DOWN = 1 /* stream frame line order is from top to bottom */

    2. Codec types

           STREAM_CODEC_TYPE_MJPEG = 1 /* this stream uses motion JPEG  codec */

    3. SPICE_MSG_DISPLAY_STREAM_CREATE, SpiceMsgDisplayStreamCreate

       UINT32 id | id of the new stream. It is the server’s responsibility to manage stream ids
       UINT32 flags | flags of the stream, any combination of STREAM_FLAG_?
       UINT32 codec_type | type of codec used for this stream, one of STREAM_CODEC_TYPE_?
       UINT64 reserved | must be zero
       UINT32 stream_width | width of the source frame.
       UINT32 stream_height | height of the source frame
       UINT32 source_width | actual frame width to use, must be less or equal to stream_width.
       UINT32 source_height | actual frame height to use, must be less or equal to stream_height.
       RECT destination | area to render into on the client display area
       SpiceClip clip | clipping of the stream

    4. SPICE_MSG_DISPLAY_STREAM_DATA, SpiceMsgDisplayStreamData

       UINT32 id | stream id (i.e., SpiceMsgDisplayStreamCreate.id)
       UINT32 multimedia_time | frame time stamp
       UINT32 data_size | stream data size to consume in bytes
       UINT32 pad_size | additional data padding in bytes
       UINT8[] data | stream data depending on SpiceMsgDisplayStreamCreate.codec_type. Size of data is ( data_size + pad_size)

    5. SPICE_MSG_DISPLAY_STREAM_CLIP, SpiceMsgDisplayStreamClip

       UINT32 id | stream id (i.e., SpiceMsgDisplayStreamCreate.id)

       SpiceClip clip – new clipping of the stream

    6. SPICE_MSG_DISPLAY_STREAM_DESTROY, UINT32

       UINT32 | id of stream to destroy

    7. SPICE_MSG_DISPLAY_STREAM_DESTROY_ALL, VOID

       Destroy all active streams

13. Cache control

    1. Resource type

           SPICE_RES_TYPE_PIXMAP = 1

    2. SpiceResourceID

       UINT8 type | type of the resource, one of SPICE_RES_TYPE_?
       UINT64 id | id of the resource

    3. SpiceResourceList

       UINT16 count | number of items in resources
       SpiceResourceID[] resources | list of resources id

    4. SPICE_MSG_DISPLAY_INVAL_LIST, SpiceResourceList

       SpiceResourceList | list of resources to remove from cache

    5. SPICE_MSG_DISPLAY_INVAL_ALL_PIXMAPS, SpiceMsgWaitForChannels

       Remove all images from the image cache. The client must use SpiceMsgWaitForChannels (for more info see Channel synchronization) to synchronize with other channels before clearing the cache.

    6. SPICE_MSG_DISPLAY_INVAL_PALETTE, UINT64

       UINT64 id of palette | client needs to remove palette with that id from the cache

    7. SPICE_MSG_DISPLAY_INVAL_ALL_PALETTES, VOID

       Remove all palettes from palette cache

## 6. Cursor channel definition

Spice protocol defines a set of messages for controlling cursor shape and position on the remote display area, cursor position messages are irrelevant for client mouse mode (see Mouse Modes). Spice protocol also defines a set of messages for managing cursor shape cache on the client site. Client must strictly obey all such instructions. The server sends SPICE_MSG_CURSOR_INIT to set current pointer state (i.e., shape, position, visibility etc.) and to clear shape cache. After the server sends init message it can send any other cursor command except for SPICE_MSG_CURSOR_INIT. The server can send SPICE_MSG_CURSOR_RESET message - this will disable the cursor and reset the cursor cache. After this message the only valid message the server can send is SPICE_MSG_CURSOR_INIT. The relevant remote display area for a cursor channel is the one of the display channel that has the same channel id (i.e., SpiceLinkMess.channel_id).

1. Server messages

       SPICE_MSG_CURSOR_INIT           = 101
       SPICE_MSG_CURSOR_RESET          = 102
       SPICE_MSG_CURSOR_SET            = 103
       SPICE_MSG_CURSOR_MOVE           = 104
       SPICE_MSG_CURSOR_HIDE           = 105
       SPICE_MSG_CURSOR_TRAIL          = 106
       SPICE_MSG_CURSOR_INVAL_ONE      = 107
       SPICE_MSG_CURSOR_INVAL_ALL      = 108

   1. Cursors types

          SPICE_CURSOR_TYPE_ALPHA         = 0
          SPICE_CURSOR_TYPE_MONO          = 1
          SPICE_CURSOR_TYPE_COLOR4        = 2
          SPICE_CURSOR_TYPE_COLOR8        = 3
          SPICE_CURSOR_TYPE_COLOR16       = 4
          SPICE_CURSOR_TYPE_COLOR24       = 5
          SPICE_CURSOR_TYPE_COLOR32       = 6

   2. SpiceCursorHeader

      UINT64 unique | unique identifier of the corresponding cursor shape. It is used for storing and retrieving cursors from the cursor cache.
      UINT16 type | type of the shape, one of CURSOR_TYPE_?
      UINT16 width | width of the shape
      UINT16 height | height of the shape
      UINT16 hot_spot_x | position of hot spot on x axis
      UINT16 hot_spot_y | position of hot spot on y axis

   3. Cursor flags

          CURSOR_FLAGS_NONE               = 1

      set when SpiceCursor (see below) is invalid

          CURSOR_CURSOR_FLAGS _CACHE_ME   = 2

      set when the client should add this shape to the shapes cache. The client will use SpiceCursorHeader.unique as cache key.

          CURSOR_FLAGS_FROM_CACHE         = 4

      set when the client should retrieve the cursor shape, using SpiceCursorHeader.unique as key, from the shapes cache. In this case all fields of SpiceCursorHeader except for unique are invalid.

   4. SpiceCursor

      UINT32 flags | any valid combination of SPICE_CURSOR_FLAGS_?
      SpiceCursorHeader header |
      UINT8[] data | actual cursor shape data, the size is determine by width, height and type from SpiceCursorHeader. Next we will describe in detail the shape data format according to cursor type:
      ALPHA, alpha shape | data contains pre-multiplied ARGB8888 pixmap. Line stride is <width * 4>.
      MONO, monochrome shape | data contains two bitmaps with size <width> * <height>. The first bitmap is AND mask and the second is XOR mask. Line stride is ALIGN(<width>, 8) / 8. Bits order within every byte is big endian.
      COLOR4, 4 bits per pixel shape | First data region is pixmap: the stride of the pixmap is ALIGN(width , 2) / 2; every nibble is translated to a color usingthe color palette; Nibble order is big endian. Second data region contain 16 colors palette: each entry is 32 bit RGB color. Third region is a bitmap mask: line stride is ALIGN(<width>, 8) / 8; bits order within every byte is big endian.
      COLOR4, 8 bits per pixel shape | First data region is pixmap: the stride of the pixmap is <width>; every byte is translated to color using the color palette. Second data region contain 256 colors palette: each entry is 32 bit RGB color. Third region is a bitmap mask: line stride is ALIGN(<width>, 8) / 8; bits order within every byte is big endian.
      COLOR16, 16 bits per pixel shape | First data region is pixmap: the stride of the pixmap is <width * 2>; every UINT16 is RGB_555. Second region is a bitmap mask: line stride is ALIGN(<width>, 8) / 8; bits order within every byte is big endian.
      COLOR24, 24 bits per pixel shape | First data region is pixmap: the stride of the pixmap is <width * 3>; every UINT8[3] is RGB_888. Second region is a bitmap mask: line stride is ALIGN(<width>, 8) / 8; bits order within every byte is big endian.
      COLOR32, 32 bits per pixel shape | First data region is pixmap: the stride of the pixmap is <width * 4>,;every UINT32 is RGB_888. Second region is a bitmap mask: line stride is ALIGN(<width>, 8) / 8; bits order within every byte is big endian.

      For more deatails on drawing the cursor shape see this section

   5. SPICE_MSG_CURSOR_INIT, SpiceMsgCursorInit

      POINT16 position | position of mouse pointer on the relevant display area. Not relevant in client mode.
      UINT16 trail_length | number of cursors in the trail excluding main cursor.
      UINT16 trail_frequency | millisecond interval between trail updates.
      UIN8 visible | if 1, the cursor is visible. If 0, the cursor is invisible.
      SpiceCursor cursor | current cursor shape

   6. SPICE_MSG_CURSOR_RESET, VOID

   7. SPICE_MSG_CURSOR_SET, SpiceMsgCursorSet

      POINT16 position | position of mouse pointer on the relevant display area. not relevant in client mode.
      UINT8 visible | if 1, the cursor is visible. If 0, the cursor is invisible.
      SpiceCursor cursor | current cursor shape

   8. SPICE_MSG_CURSOR_MOVE, POINT16

      POINT16 | new mouse position. Not relevant in client mode. This message also implicitly sets cursor visibility to 1.

   9. SPICE_MSG_CURSOR_HIDE, VOID

      Hide pointer on the relevant display area.

   10. SPICE_MSG_CURSOR_TRAIL

       UINT16 length | number of cursors in the trail excluding main cursor.
       UINT16 frequency | millisecond interval between trail updates

   11. SPICE_MSG_CURSOR_INVAL_ONE, UINT64

       UINT64 | id of cursor shape to remove from the cursor cache

   12. SPICE_MSG_CURSOR_INVAL_ALL, VOLD

       Clear cursor cache

2. Drawing the cursor shape according to the cursor type

   This section is relevant only for server mouse mode. Cursor shape positioning on the display area is done by placing cursor hot spot on the current cursor position.

   1. Alpha - no spacial handling, just bland the shape on the display area.

   2. Monochrome

      For each cleared bit in the AND mask clear the corresponding bits in the relevant pixel on the display area For each set bit in the XOR mask reverse the corresponding bits in the relevant pixel on the display area

   3. Color

      If the source color is black and mask bit is set, NOP. Else, if the source color is white and the mask bit is set, reverse all bits in the relevant pixel on the display area. Else, put source color.

## 7. Playback channel definition

Spice supports sending audio streams for playback on the client side. An audio stream is sent by the server in an audio packet using SPICE_MSG_PLAYBACK_DATA message. The content of the audio packet is controlled by the playback mode that the server sends using SPICE_MSG_PLAYBACK_MODE message. The server can start and stop the stream using SPICE_MSG_PLAYBACK_START and SPICE_MSG_PLAYBACK_STOP messages. Sending audio packet is allowed only between start and stop messages. Sending start message is allowed only in stop state and after at least one mode message was sent. Sending a stop message is allowed only during a start state.

1. Server messages

       SPICE_MSG_PLAYBACK_DATA                 = 101
       SPICE_MSG_PLAYBACK_MODE                 = 102
       SPICE_MSG_PLAYBACK_START                = 103
       SPICE_MSG_PLAYBACK_STOP                 = 104

2. Audio format

       SPICE_AUDIO_FMT_S16                     = 1 /* each channel sample is a 16 bit
       signed integer */

3. Playback data mode

   Two types of data mode are available: (1) raw PCM data, (2) compressed data in CELT 0_5_1 format (obsolete) and (3) compressed data in OPUS format.

       SPICE_AUDIO_DATA_MODE_RAW               = 1
       SPICE_AUDIO_DATA_MODE_CELT_0_5_1        = 2
       SPICE_AUDIO_DATA_MODE_OPUS              = 3

4. Playback channel capabilities

       SPICE_PLAYBACK_CAP_CELT_0_5_1           = 0
       SPICE_PLAYBACK_CAP_VOLUME               = 1
       SPICE_PLAYBACK_CAP_LATENCY              = 2
       SPICE_PLAYBACK_CAP_OPUS                 = 3

   Spice client needs to declare support of OPUS in channel capabilities in order to allow the server to send playback packets in OPUS format.

5. SPICE_MSG_PLAYBACK_MODE, SpiceMsgPlaybackMode

   UINT32 time | server time stamp
   UINT32 mode | one of SPICE_AUDIO_DATA_MODE_?
   UINT8[] data | specific data, content depend on mode

6. SPICE_MSG_PLAYBACK_START, SpiceMsgRecordStart

   UINT32 channels | number of audio channels
   UINT32 format | one of SPICE_AUDIO_FMT_?
   UINT32 frequency | channel samples per second

7. SPICE_MSG_PLAYBACK_DATA, SpiceMsgPlaybackPacket

   UINT32 time | server time stamp
   UINT8[] data | playback data , content depend on mode

8. SPICE_MSG_PLAYBACK_STOP, VOID

   Stop current audio playback

## 8. Record Channel definition

Spice supports transmitting of audio captured streams from the client to the server. Spice server starts audio capturing using SPICE_MSG_RECORD_START message. This message instructs the client to start transmitting captured audio . In response, the client sends time stamp of the stream start using SPICE_MSGC_RECORD_START_MARK. After the client sends start mark it can start transmitting audio stream data using SPICE_MSGC_RECORD_DATA. One mode message must be sent by the client before any other message using SPICE_MSGC_RECORD_MODE. This, in order to inform the server on what type of data will be transferred. Mode message can also be transmitted at any other time in order to switch the data type delivered by SPICE_MSGC_RECORD_DATA. The Server can send SPICE_MSG_RECORD_STOP for stopping captured audio streaming. Sending a start message is allowed only while the stream is in stop state. Sending a stop message and data messages is allowed only while the stream is in start state. Sending mark message is allowed only between start message and the first data message.

1. Server messages

       SPICE_MSG_RECORD_START                  = 101
       SPICE_MSG_RECORD_STOP                   = 102

2. Client messages

       SPICE_MSGC_RECORD_DATA                  = 101
       SPICE_MSGC_RECORD_MODE                  = 102
       SPICE_MSGC_RECORD_START_MARK            = 103

3. Audio format

       SPICE_AUDIO_FMT_S16                     = 1 /* each channel sample is a 16 bit signed integer */

4. Record data mode

   Two types of data mode are available: (1) raw PCM data (2) compressed data in CELT 0.5.1 format (obsolete) (3) compressed data in OPUS format.

       SPICE_AUDIO_DATA_MODE_RAW               = 1
       SPICE_AUDIO_DATA_MODE_CELT_0_5_1        = 2
       SPICE_AUDIO_DATA_MODE_OPUS              = 3

5. Record channel capabilities

       SPICE_RECORD_CAP_CELT_0_5_1             = 0
       SPICE_RECORD_CAP_VOLUME                 = 1
       SPICE_RECORD_CAP_OPUS                   = 2

   Spice server needs to declare support of OPUS in channel capabilities in order to allow the client to send recorded packets in OPUS format.

6. SPICE_MSGC_RECORD_MODE, SpiceMsgcRecordMode

   UINT32 time | client time stamp
   UINT32 mode | one of SPICE_AUDIO_DATA_MODE_?
   UINT8[] data | specific data, content depend on mode

7. SPICE_MSG_RECORD_START, SpiceMsgRecordStart

   UINT32 channel | number of audio channels
   UINT32 format | one of SPICE_AUDIO_FMT_?
   UINT32 frequency | channel samples per second

8. SPICE_MSGC_RECORD_START_MARK, UINT32

   UINT32 | client time stamp of stream start

9. SPICE_MSGC_RECORD_DATA, SpiceMsgcRecordPacket

   UINT32 time | client time stamp
   UINT8[] data | recorded data , content depend on mode

10. SPICE_MSG_RECORD_STOP, VOID

    Stop current audio capture