Index: ioemu/vnc.c
===================================================================
--- ioemu.orig/vnc.c	2007-05-03 09:56:31.000000000 +0100
+++ ioemu/vnc.c	2007-05-03 10:07:55.000000000 +0100
@@ -143,13 +143,16 @@
 static void vnc_dpy_update(DisplayState *ds, int x, int y, int w, int h)
 {
     VncState *vs = ds->opaque;
-    int i;
+    uint64_t mask;
 
     h += y;
+    if (w != 1024)
+	mask = ((1ULL << (w / 16)) - 1) << (x / 16);
+    else
+	mask = ~(0ULL);
 
     for (; y < h; y++)
-	for (i = 0; i < w; i += 16)
-	    vnc_set_bit(vs->dirty_row[y], (x + i) / 16);
+	vs->dirty_row[y] |= mask;
 }
 
 static void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h,
@@ -373,6 +376,7 @@
 static void vnc_update_client(void *opaque)
 {
     VncState *vs = opaque;
+    int64_t now = qemu_get_clock(rt_clock);
 
     if (vs->need_update && vs->csock != -1) {
 	int y;
@@ -383,6 +387,8 @@
 	int saved_offset;
 	int has_dirty = 0;
 
+	qemu_mod_timer(vs->timer, now + VNC_REFRESH_INTERVAL);
+
         vnc_set_bits(width_mask, (vs->width / 16), VNC_DIRTY_WORDS);
 
 	/* Walk through the dirty map and eliminate tiles that
@@ -390,7 +396,7 @@
 	row = vs->ds->data;
 	old_row = vs->old_data;
 
-	for (y = 0; y < vs->height; y++) {
+	for (y = 0; y < vs->ds->height; y++) {
 	    if (vnc_and_bits(vs->dirty_row[y], width_mask, VNC_DIRTY_WORDS)) {
 		int x;
 		char *ptr, *old_ptr;
@@ -415,10 +421,8 @@
 	    old_row += vs->ds->linesize;
 	}
 
-	if (!has_dirty) {
-	    qemu_mod_timer(vs->timer, qemu_get_clock(rt_clock) + VNC_REFRESH_INTERVAL);
+	if (!has_dirty)
 	    return;
-	}
 
 	/* Count rectangles */
 	n_rectangles = 0;
@@ -454,17 +458,13 @@
 	vs->output.buffer[saved_offset] = (n_rectangles >> 8) & 0xFF;
 	vs->output.buffer[saved_offset + 1] = n_rectangles & 0xFF;
 	vnc_flush(vs);
-
     }
-    qemu_mod_timer(vs->timer, qemu_get_clock(rt_clock) + VNC_REFRESH_INTERVAL);
 }
 
 static void vnc_timer_init(VncState *vs)
 {
-    if (vs->timer == NULL) {
+    if (vs->timer == NULL)
 	vs->timer = qemu_new_timer(rt_clock, vnc_update_client, vs);
-	qemu_mod_timer(vs->timer, qemu_get_clock(rt_clock));
-    }
 }
 
 static void vnc_dpy_refresh(DisplayState *ds)
@@ -736,6 +736,8 @@
 	    old_row += vs->ds->linesize;
 	}
     }
+
+    qemu_mod_timer(vs->timer, qemu_get_clock(rt_clock));
 }
 
 static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
Index: ioemu/vl.c
===================================================================
--- ioemu.orig/vl.c	2007-05-03 10:07:54.000000000 +0100
+++ ioemu/vl.c	2007-05-03 10:07:55.000000000 +0100
@@ -5195,10 +5195,10 @@
         /* XXX: better handling of removal */
         for(ioh = first_io_handler; ioh != NULL; ioh = ioh_next) {
             ioh_next = ioh->next;
-            if (FD_ISSET(ioh->fd, &rfds)) {
+            if (ioh->fd_read && FD_ISSET(ioh->fd, &rfds)) {
                 ioh->fd_read(ioh->opaque);
             }
-            if (FD_ISSET(ioh->fd, &wfds)) {
+            if (ioh->fd_write && FD_ISSET(ioh->fd, &wfds)) {
                 ioh->fd_write(ioh->opaque);
             }
         }
