Index: ioemu/vnc.c
===================================================================
--- ioemu.orig/vnc.c	2007-05-03 10:24:06.000000000 +0100
+++ ioemu/vnc.c	2007-05-03 10:24:06.000000000 +0100
@@ -1197,7 +1197,7 @@
     }
 }
 
-void vnc_display_init(DisplayState *ds, int display)
+int vnc_display_init(DisplayState *ds, int display, int find_unused)
 {
     struct sockaddr_in addr;
     int reuse_addr, ret;
@@ -1228,10 +1228,6 @@
 	exit(1);
     }
 
-    addr.sin_family = AF_INET;
-    addr.sin_port = htons(5900 + display);
-    memset(&addr.sin_addr, 0, sizeof(addr.sin_addr));
-
     reuse_addr = 1;
     ret = setsockopt(vs->lsock, SOL_SOCKET, SO_REUSEADDR,
 		     (const char *)&reuse_addr, sizeof(reuse_addr));
@@ -1240,7 +1236,16 @@
 	exit(1);
     }
 
+ retry:
+    addr.sin_family = AF_INET;
+    addr.sin_port = htons(5900 + display);
+    memset(&addr.sin_addr, 0, sizeof(addr.sin_addr));
+
     if (bind(vs->lsock, (struct sockaddr *)&addr, sizeof(addr)) == -1) {
+	if (find_unused && errno == EADDRINUSE) {
+	    display++;
+	    goto retry;
+	}
 	fprintf(stderr, "bind() failed\n");
 	exit(1);
     }
@@ -1261,6 +1266,8 @@
     vs->ds->dpy_refresh = vnc_dpy_refresh;
 
     vnc_dpy_resize(vs->ds, 640, 400);
+
+    return display;
 }
 
 int vnc_start_viewer(int port)
Index: ioemu/vl.c
===================================================================
--- ioemu.orig/vl.c	2007-05-03 10:24:06.000000000 +0100
+++ ioemu/vl.c	2007-05-03 10:24:06.000000000 +0100
@@ -122,6 +122,7 @@
 static DisplayState display_state;
 int nographic;
 int vncviewer;
+int vncunused;
 const char* keyboard_layout = NULL;
 int64_t ticks_per_sec;
 int boot_device = 'c';
@@ -5417,6 +5418,7 @@
            "-loadvm file    start right away with a saved state (loadvm in monitor)\n"
 	   "-vnc display    start a VNC server on display\n"
            "-vncviewer      start a vncviewer process for this domain\n"
+           "-vncunused      bind the VNC server to an unused port\n"
            "-acpi           disable or enable ACPI of HVM domain \n"
            "\n"
            "During emulation, the following keys are useful:\n"
@@ -5504,6 +5506,7 @@
     QEMU_OPTION_vcpus,
     QEMU_OPTION_acpi,
     QEMU_OPTION_vncviewer,
+    QEMU_OPTION_vncunused,
 };
 
 typedef struct QEMUOption {
@@ -5579,6 +5582,7 @@
     { "smp", HAS_ARG, QEMU_OPTION_smp },
     { "vnc", HAS_ARG, QEMU_OPTION_vnc },
     { "vncviewer", 0, QEMU_OPTION_vncviewer },
+    { "vncunused", 0, QEMU_OPTION_vncunused },
     
     /* temporary options */
     { "usb", 0, QEMU_OPTION_usb },
@@ -5938,6 +5942,7 @@
     snapshot = 0;
     nographic = 0;
     vncviewer = 0;
+    vncunused = 0;
     kernel_filename = NULL;
     kernel_cmdline = "";
 #ifdef TARGET_PPC
@@ -6336,6 +6341,11 @@
             case QEMU_OPTION_vncviewer:
                 vncviewer++;
                 break;
+            case QEMU_OPTION_vncunused:
+                vncunused++;
+                if (vnc_display == -1)
+                    vnc_display = 0;
+                break;
             }
         }
     }
@@ -6537,7 +6547,7 @@
     if (nographic) {
         dumb_display_init(ds);
     } else if (vnc_display != -1) {
-	vnc_display_init(ds, vnc_display);
+	vnc_display = vnc_display_init(ds, vnc_display, vncunused);
 	if (vncviewer)
 	    vnc_start_viewer(vnc_display);
     } else {
Index: ioemu/vl.h
===================================================================
--- ioemu.orig/vl.h	2007-05-03 10:24:06.000000000 +0100
+++ ioemu/vl.h	2007-05-03 10:24:06.000000000 +0100
@@ -785,7 +785,7 @@
 void cocoa_display_init(DisplayState *ds, int full_screen);
 
 /* vnc.c */
-void vnc_display_init(DisplayState *ds, int display);
+int vnc_display_init(DisplayState *ds, int display, int find_unused);
 int vnc_start_viewer(int port);
 
 /* ide.c */
