Access UART ports

Universal Asynchronous Receiver Transmitters (UARTs) are commonly found in embedded devices and are built into the mother board of mobile devices. For developers working on the Linux kernel and the lower levels of the operating system, UART ports can be used to make the development easier. For example, the UART ports are used for the following tasks:

Observing boot and debug messages
Kernel development
Interacting with the system via a shell

On this page, you find instructions for how to access them on a range of Xperia devices. However, note that this is strictly for developers only, and you should be aware of the risks involved in unlocking the boot loader of your device. In addition, to access the UART port, you need to solder on the motherboard of your device, which means that you risk to permanently damage the motherboard.

To be able to follow this guide, you need a multimeter tool, a soldering station and a magnifying glass. You also need to have SMD soldering skills, as well as hardware hacking and advanced kernel debugging knowledge.

Note: Although protocol compatible, RS-232 and UART are not voltage compatible. UARTs most commonly operate at 3.3 volts, but can also be found operating at other standard voltages (for example 1.8V). This means that you will have to use an UART to USB adapter which can be acquired online. Any TTL232RG 1V8 adapter can be used to connect to the phone.

Identifying and connecting to the right pins

Find your device in the table below, and locate the header on your device and the header pinout for pinout reference.

The first thing we want to do is perform a continuity test between ground and possible ground pins on the connector using the multimeter. This will tell us which pin is connected directly to ground. Metal shielding is a convenient ground point to use for testing. Placing one probe on a shield and touching the other to pin 3, the multimeter emits a continuous audible tone, indicating that pin 3 is connected to ground. This will show you the connector orientation. After ground pin is identified use it as a reference for the RX and TX pins. Please note that the UART RX pin is for Data To Mobile Station and UART TX is for Data From Mobile Station.

After the pins are indentified we recommend that you solder 0.5 mm insulated wires to each of them and glue a connector on the device. This way the UART to USB adapter can be used on multiple devices.

UART adapter connected to an Xperia device.

After you’ve connected your device to the UART adapter, follow the instructions below to access your Xperia device from the computer.

Connecting from a Linux computer

Use apt-get under Ubuntu Linux, enter:

$ sudo apt-get install minicom
ls /dev/tty* to identify which serial ports are available on your system

Connecting from a Windows computer

Download and run putty (http://www.putty.org/)
Check device manager to identify which port is used (COM)
Configure port and speed

Note: The UART port speed is 115200

When successfully connected you should receive a log similar to this:

[1010] If you can read this line, S1 BOOT is done. Start the stone rolling!
[1020] booting linux @ 0x8000, ramdisk @ 0x2000000 (735338), tags/device tree @ 0x1e00000
[ 0.000000] Booting Linux on physical CPU 0x0
[ 0.000000] Initializing cgroup subsys cpu
[ 0.000000] Initializing cgroup subsys cpuacct
[ 0.000000] Linux version 3.10.49-g20b1dc8 (root@ubuntu) (gcc version 4.8 (GCC) ) #8 SMP PREEMPT Sun Nov 22 20:43:13 CET 2015
[ 0.000000] CPU: ARMv7 Processor [512f06f0] revision 0 (ARMv7), cr=10c5387d
[ 0.000000] CPU: PIPT / VIPT nonaliasing data cache, PIPT instruction cache
[ 0.000000] Machine: Qualcomm Technologies, Inc. MSM 8974 (Flattened Device Tree), model: SoMC Honami ROW
[ 0.000000] Node qcom,mdss_fb_primary memblock_reserve memory 3400000-5600000
[ 0.000000] cma: Found secure_region@0, memory base 0x00000000, size 252 MiB, limit 0xffffffff
[ 0.000000] cma: Found adsp_region@0, memory base 0x00000000, size 63 MiB, limit 0xffffffff
[ 0.000000] cma: Found qsecom_region@0, memory base 0x00000000, size 17 MiB, limit 0xffffffff
[ 0.000000] cma: Found audio_region@0, memory base 0x00000000, size 6 MiB, limit 0xffffffff
[ 0.000000] cma: Found peripheral_region@5d00000, memory base 0x05d00000, size 162 MiB, limit 0xffffffff
[ 0.000000] cma: Found external_image_region@fa00000, memory base 0x0fa00000, size 5 MiB, limit 0xffffffff
[ 0.000000] cma: Found camera_region@0, memory base 0x00000000, size 100 MiB, limit 0xffffffff
[ 0.000000] cma: Found cont_splash_mem@0, memory base 0x00000000, size 52 MiB, limit 0xffffffff
[ 0.000000] cma: CMA: reserved 252 MiB at 0x5e000000 for secure_mem
[ 0.000000] cma: CMA: reserved 64 MiB at 0x5a000000 for adsp_mem
[ 0.000000] cma: CMA: reserved 20 MiB at 0x58c00000 for qseecom_mem
[ 0.000000] cma: CMA: reserved 8 MiB at 0x58400000 for audio_mem
[ 0.000000] cma: CMA: reserved 162 MiB at 0x05d00000 for peripheral_mem
[ 0.000000] cma: CMA: reserved 5 MiB at 0x0fa00000 for (null)
[ 0.000000] cma: CMA: reserved 100 MiB at 0x52000000 for camera_mem
[ 0.000000] cma: CMA: reserved 52 MiB at 0x4ec00000 for cont_splash_mem
[ 0.000000] cma: CMA: reserved 16 MiB at 0x25000000 for default region
[ 0.000000] Memory policy: ECC disabled, Data cache writealloc
[ 0.000000] PERCPU: Embedded 12 pages/cpu @c2ed3000 s32832 r0 d16320 u49152
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 407292
[ 0.000000] Kernel command line: androidboot.hardware=rhine androidboot.selinux=permissive user_debug=31 msm_rtb.filter=0x3F ehci-hcd.park=3 lpj=192598 dwc3.maximum_speed=high dwc3_msm.prop_chg_detect=Y console=ttyHSL0,115200,n8 coherent_pool=8M vmalloc=400M mem=1759M androidboot.emmc=true androidboot.bootloader=s1 oemandroidboot.s1boot=1270-3115_S1_Boot_MSM8974_Rhine1.3_LA1.04_11 androidboot.serialno=CB51250K6P ta_info=1,16,256 startup=0x00000001 warmboot=0x00000000 oemandroidboot.imei=0044024513060800 oemandroidboot.phoneid=0000:0044024513060800 oemandroidboot.security=0 androidboot.baseband=msm
[ 0.000000] PID hash table entries: 4096 (order: 2, 16384 bytes)
[ 0.000000] Dentry cache hash table entries: 131072 (order: 7, 524288 bytes)
[ 0.000000] Inode-cache hash table entries: 65536 (order: 6, 262144 bytes)
[ 0.000000] Memory: 1038988K/1635328K available (11589K kernel code, 1321K rwdata, 4388K rodata, 1088K init, 3195K bss, 596340K reserved, 504832K highmem)
[ 0.000000] Virtual kernel memory layout:
[ 0.000000] vector : 0xffff0000 – 0xffff1000 ( 4 kB)
[ 0.000000] fixmap : 0xfff00000 – 0xfffe0000 ( 896 kB)
[ 0.000000] vmalloc : 0xf0200000 – 0xff000000 ( 238 MB)
[ 0.000000] lowmem : 0xcff00000 – 0xf0200000 ( 515 MB)
[ 0.000000] vmalloc : 0xc5d00000 – 0xcff00000 ( 162 MB)
[ 0.000000] lowmem : 0xc0000000 – 0xc5d00000 ( 93 MB)
[ 0.000000] pkmap : 0xbfe00000 – 0xc0000000 ( 2 MB)
[ 0.000000] .text : 0xc0008000 – 0xc109a6b4 (16970 kB)
[ 0.000000] .init : 0xc1100000 – 0xc1210040 (1089 kB)
[ 0.000000] .data : 0xc1212000 – 0xc135c624 (1322 kB)
[ 0.000000] .bss : 0xc135c6e8 – 0xc167b604 (3196 kB)
[ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[ 0.000000] Preemptible hierarchical RCU implementation.
[ 0.000000] RCU dyntick-idle grace-period acceleration is enabled.
[ 0.000000] NR_IRQS:16 nr_irqs:16 16
[ 0.000000] Architected cp15 and mmio timer(s) running at 19.20MHz (virt/virt).
[ 0.000000] sched_clock: 56 bits at 19MHz, resolution 52ns, wraps every 3579139424256ns
[ 0.000000] Switching to timer-based delay loop
[ 0.000000] sched_clock: 32 bits at 19MHz, resolution 52ns, wraps every 223696213963ns
[ 0.000533] Calibrating delay loop (skipped) preset value.. 38.51 BogoMIPS (lpj=192598)
[ 0.000548] pid_max: default: 32768 minimum: 301
[ 0.000687] Security Framework initialized
[ 0.000717] SELinux: Initializing.