ui/spice: support websockets ports

diff --git a/hw/qxl.c b/hw/qxl.c
index bdafdf2..1b47ed3 100644
--- a/hw/qxl.c
+++ b/hw/qxl.c
@@ -1347,6 +1347,7 @@  static void qxl_create_guest_primary(PCIQXLDevice *qxl, int loadvm,
     if (qxl->mode == QXL_MODE_NATIVE) {
         qxl_set_guest_bug(qxl, "%s: nop since already in QXL_MODE_NATIVE",
                       __func__);
+        return;
     }
     qxl_exit_vga_mode(qxl);
 
diff --git a/qemu-config.c b/qemu-config.c
index cd1ec21..dd5f36b 100644
--- a/qemu-config.c
+++ b/qemu-config.c
@@ -472,6 +472,12 @@  QemuOptsList qemu_spice_opts = {
             .name = "tls-port",
             .type = QEMU_OPT_NUMBER,
         },{
+            .name = "ws-port",
+            .type = QEMU_OPT_NUMBER,
+        },{
+            .name = "wss-port",
+            .type = QEMU_OPT_NUMBER,
+        },{
             .name = "addr",
             .type = QEMU_OPT_STRING,
         },{
diff --git a/qemu-options.hx b/qemu-options.hx
index 7d97f96..ae7b568 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -849,7 +849,8 @@  Enable SDL.
 ETEXI
 
 DEF("spice", HAS_ARG, QEMU_OPTION_spice,
-    "-spice [port=port][,tls-port=secured-port][,x509-dir=<dir>]\n"
+    "-spice [port=port][,tls-port=secured-port][,ws-port=ws-port]\n"
+    "       [,wss-port=wss-port],[,x509-dir=<dir>]\n"
     "       [,x509-key-file=<file>][,x509-key-password=<file>]\n"
     "       [,x509-cert-file=<file>][,x509-cacert-file=<file>]\n"
     "       [,x509-dh-key-file=<file>][,addr=addr][,ipv4|ipv6]\n"
@@ -864,7 +865,7 @@  DEF("spice", HAS_ARG, QEMU_OPTION_spice,
     "       [,agent-mouse=[on|off]][,playback-compression=[on|off]]\n"
     "       [,seamless-migration=[on|off]]\n"
     "   enable spice\n"
-    "   at least one of {port, tls-port} is mandatory\n",
+    "   at least one of {port, tls-port, ws-port, wss-port} is mandatory\n",
     QEMU_ARCH_ALL)
 STEXI
 @item -spice @var{option}[,@var{option}[,...]]
@@ -921,6 +922,12 @@  The x509 file names can also be configured individually.
 @item tls-ciphers=<list>
 Specify which ciphers to use.
 
+@item ws-port=<nr>
+Set the TCP port spice is listening on for unencrypted websocket channels.
+
+@item wss-port=<nr>
+Set the TCP port spice is listening on for encrypted websocket channels.
+
 @item tls-channel=[main|display|cursor|inputs|record|playback]
 @item plaintext-channel=[main|display|cursor|inputs|record|playback]
 Force specific channel to be used with or without TLS encryption.  The
diff --git a/roms/openbios b/roms/openbios
index f095c85..d1d2787 160000
--- a/roms/openbios
+++ b/roms/openbios
@@ -1 +1 @@ 
-Subproject commit f095c858136896d236931357b8d597f407286f71
+Subproject commit d1d2787f87167edf487a60e61b9168514d5a7434
diff --git a/ui/spice-core.c b/ui/spice-core.c
index 5147365..190b14d 100644
--- a/ui/spice-core.c
+++ b/ui/spice-core.c
@@ -542,6 +542,14 @@  static void vm_change_state_handler(void *opaque, int running,
     }
 }
 
+static void validate_port(int port, const char *port_name)
+{
+    if (port < 0 || port > 65535) {
+        error_report("spice %s is out of range", port_name);
+        exit(1);
+    }
+}
+
 void qemu_spice_init(void)
 {
     QemuOpts *opts = QTAILQ_FIRST(&qemu_spice_opts.head);
@@ -552,7 +560,7 @@  void qemu_spice_init(void)
     char *x509_key_file = NULL,
         *x509_cert_file = NULL,
         *x509_cacert_file = NULL;
-    int port, tls_port, len, addr_flags;
+    int port, tls_port, ws_port, wss_port, len, addr_flags;
     spice_image_compression_t compression;
     spice_wan_compression_t wan_compr;
     bool seamless_migration;
@@ -564,18 +572,17 @@  void qemu_spice_init(void)
     }
     port = qemu_opt_get_number(opts, "port", 0);
     tls_port = qemu_opt_get_number(opts, "tls-port", 0);
-    if (!port && !tls_port) {
-        error_report("neither port nor tls-port specified for spice");
-        exit(1);
-    }
-    if (port < 0 || port > 65535) {
-        error_report("spice port is out of range");
-        exit(1);
-    }
-    if (tls_port < 0 || tls_port > 65535) {
-        error_report("spice tls-port is out of range");
+    ws_port = qemu_opt_get_number(opts, "ws-port", 0);
+    wss_port = qemu_opt_get_number(opts, "wss-port", 0);
+    if (!port && !tls_port && !ws_port && !wss_port) {
+        error_report("none of {port,tls-port,ws-port,wss-port}"
+                     " specified for spice");
         exit(1);
     }
+    validate_port(port, "port");
+    validate_port(tls_port, "tls_port");
+    validate_port(ws_port, "ws_port");
+    validate_port(wss_port, "wss_port");
     password = qemu_opt_get(opts, "password");
 
     if (tls_port) {
@@ -636,6 +643,17 @@  void qemu_spice_init(void)
                              x509_dh_file,
                              tls_ciphers);
     }
+    if (ws_port || wss_port) {
+#if SPICE_SERVER_VERSION >= 0x000c01
+        if (spice_server_set_ws_ports(spice_server, ws_port, wss_port)) {
+            error_report("spice server could not set ws_port and wss_port");
+            exit(1);
+        }
+#else
+        error_report("spice server doesn't support websockets");
+        exit(1);
+#endif
+    }
     if (password) {
         spice_server_set_ticket(spice_server, password, 0, 0, 0);
     }