/ # rm target/init-stderrout
/ # exec switch_root /target /lib/systemd/systemd &> /target/init-stderrout 2>&1
Connection closed by foreign host.
root@inp1wst007:/home/OMP/s.chupligin/work/y6/cm12boot# telnet 192.168.2.15 2323
Trying 192.168.2.15...
Connected to 192.168.2.15.
Escape character is '^]'.

Welcome to the Mer/SailfishOS Boat loader debug init system.

Log so far is in /init.log

To make post-switch_root halt before starting systemd, perform:
touch /target/init_enter_debug2
(When run post-switch_root, telnet is on port 2323, not 23)

You may inject commands into init shell process (PID 1):

To see output of commands as they're injected:
tail -f /init.log &
To run a command:
echo "ls -l /" >/init-ctl/stdin

(Be careful if you experiment with exec as you need to terminate
daemons and disable busybox hotplug handling)

To allow init to continue:
echo "continue" >/init-ctl/stdin

In order to work safely with the device's mmc you should
echo "umount_stowaways" >/init-ctl/stdin

Then you can mount and modify exported mass storage on host. When done
echo "mount_stowaways" >/init-ctl/stdin


/ # cat target/init-
init-ctl/       init-debug      init-stderrout
/ # cat target/init-stderrout
BusyBox v1.21.1 (2016-05-12 01:27:53 UTC) multi-call binary.

Usage: switch_root [-c /dev/console] NEW_ROOT NEW_INIT [ARGS]

Free initramfs and switch to another root fs:
chroot to NEW_ROOT, delete all in /, move NEW_ROOT to /,
execute NEW_INIT. PID must be 1. NEW_ROOT must be a mountpoint.

        -c DEV  Reopen stdio to DEV after switch

/ #