diff --git a/README.md b/README.md
index 05063df..ca2655f 100644
--- a/README.md
+++ b/README.md
@@ -95,6 +95,15 @@ or:
     Ctrl-C A
     quit
 
+or:
+
+    ./qemumonitor
+    quit
+
+or:
+
+    echo quit | ./qemumonitor
+
 See also:
 
 - <http://stackoverflow.com/questions/14165158/how-to-switch-to-qemu-monitor-console-when-running-with-curses>
diff --git a/qemumonitor b/qemumonitor
new file mode 100755
index 0000000..30bfb3a
--- /dev/null
+++ b/qemumonitor
@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+# We could also use Ctrl + Alt + 2 on the SDL GUI,
+# but that opens up a tiny window which can't scroll up or be searched.
+# And this is the only way when running in -noscreen.
+telnet localhost 45454
diff --git a/rootfs_overlay/pci.sh b/rootfs_overlay/pci.sh
index c2b6181..364593f 100755
--- a/rootfs_overlay/pci.sh
+++ b/rootfs_overlay/pci.sh
@@ -21,8 +21,8 @@ dd bs=4 status=none if=/dev/lkmc_pci count=1 skip=1 | od -An -t x1
 printf '\x80\x00\x00\x00' | dd bs=4 status=none of=/dev/lkmc_pci count=1 seek=8
 # factorial(0xC) = 0x1c8cfc00
 printf '\x0C\x00\x00\x00' | dd bs=4 status=none of=/dev/lkmc_pci count=1 seek=2
-# => interrupt
-# Yes, we should the interrupt to notify poll, but lazy.
+# => irq_handler .*
+# Yes, we should use the interrupt to notify poll, but lazy.
 sleep 1
 dd bs=4 status=none if=/dev/lkmc_pci count=1 skip=2 | od -An -t x1
 dd bs=4 status=none if=/dev/lkmc_pci count=1 skip=8 | od -An -t x1
@@ -30,10 +30,10 @@ dd bs=4 status=none if=/dev/lkmc_pci count=1 skip=8 | od -An -t x1
 
 # Manual IRQ raising.
 printf '\x04\x03\x02\x01' | dd bs=4 status=none of=/dev/lkmc_pci count=1 seek=24
-# => interrupt
+# => irq_handler .*
 sleep 1
 printf '\x08\x07\x06\x05' | dd bs=4 status=none of=/dev/lkmc_pci count=1 seek=24
-# => interrupt
+# => irq_handler .*
 sleep 1
 
 # Teardown.
diff --git a/rootfs_overlay/pci_rescan.sh b/rootfs_overlay/pci_rescan.sh
new file mode 100755
index 0000000..cecf2d2
--- /dev/null
+++ b/rootfs_overlay/pci_rescan.sh
@@ -0,0 +1,2 @@
+#!/bin/sh
+echo 1 > /sys/bus/pci/rescan
diff --git a/runqemu b/runqemu
index 9cd7f70..8af5f86 100755
--- a/runqemu
+++ b/runqemu
@@ -10,7 +10,7 @@ kgdb=false
 nographic=false
 extra_append=''
 extra_flags=''
-while getopts a:dknq OPT; do
+while getopts a:de:knq OPT; do
   case "$OPT" in
     a)
       arch=$OPTARG
@@ -19,6 +19,9 @@ while getopts a:dknq OPT; do
       debug=true
       extra_flags="$extra_flags -S -s"
       ;;
+    e)
+      extra_append="$extra_append $OPTARG"
+      ;;
     k)
       debug=true
       extra_append="$extra_append kgdbwait"