The fastest path to a FreeBSD kernel banner on a PinePhone Pro is to not build anything. Download the Honeyguide image, dd it to a microSD, slot it in, power on. There’s a graphical boot menu on the EFI framebuffer; pick FreeBSD; you have a login prompt within 30 seconds. ● working
This essay is about getting to that prompt cleanly, with serial console working, so you can iterate from a known good base.
Prerequisites: the SPI flash
The phone’s boot ROM looks at SPI flash before SD. If your PPP shipped with the stock Manjaro/postmarketOS install, SPI is probably loaded with the old Pine64 U-Boot that hard-prefers eMMC. Reflash it with rk2aw + Megi’s U-Boot 2024.04 first. rk2aw is a small SPL replacement that fixes RAM training on the RK3399S so a modern U-Boot can actually run; Megi’s U-Boot 2024.04 is the one with the working SD-first boot order and the framebuffer support that makes the boot menu visible.
I did this once on 2026-03-31 from postmarketOS over ssh 192.168.1.160. It’s a dd of idbloader.bin to sector 64 of /dev/mtdblock0 and u-boot.itb to sector 20480. After that you can boot anything you want from SD without having to hold the volume key on power-on.
If you don’t have postmarketOS installed and don’t want to install it just for this, the alternative is the Tow-Boot blob, but I haven’t tested that path and I can’t recommend it.
The serial console gotcha
The PinePhone Pro exposes UART2 on the 3.5 mm headphone jack. Console parameters are 1500000 baud, 8N1, no flow control. Privacy switch #6 (the headphone-jack kill switch) must be ON for the line to be electrically connected — the labels on the back of the case are inverted, ON means “enabled,” not “killed.”
So my host setup is two adapters: the CP2102 on /dev/ttyUSB0 for whatever I’m doing on a different board, and the FT232 on /dev/ttyUSB1 for the phone. picocom or screen at 1500000 both work.
There’s a second console-related gotcha specific to FreeBSD on this hardware. Honeyguide’s CRU (clock and reset unit) bring-up does a hack: it leaves the UART clock alone instead of letting the kernel reinitialize it, because reinitialization causes lockup. The tradeoff is that kernel boot messages do not appear on serial. You see the U-Boot banner, the U-Boot menu, the loader output — and then silence until userland starts and the console reattaches. If you want kernel banner output, look at the EFI framebuffer; the panel is alive during boot.
Loader.conf changes
Honeyguide’s default /boot/loader.conf ships with boot_serial="NO" and only console="efi". That gives you a framebuffer console, which is fine for the first boot but useless when you start kernel-panicking and want to see the trace. Edit:
boot_serial="YES"
console="comconsole,efi"
comconsole_speed="1500000"comconsole,efi puts both consoles in the list; the framebuffer goes first as fallback, but dmesg and panic output flow to serial. After the kernel hands off to userland, getty on ttyu0 gives you a serial login.
Flashing the image
# On the build host, or any FreeBSD/Linux box with an SD card reader
curl -O https://pppfreebsd.honeyguide.net/freebsd-ppp-latest.img.xz
xz -d freebsd-ppp-latest.img.xz
# Find the SD device. On Linux usually /dev/sdX or /dev/mmcblkN.
# On FreeBSD, /dev/daN.
sudo dd if=freebsd-ppp-latest.img of=/dev/sdX bs=1M status=progress
sync
# Slot the SD into the phone's SD slot (under the back cover).
# Power on while holding nothing — boot order is SD-first per SPI U-Boot.The image is around 1.5 GB compressed, 3-4 GB uncompressed. It includes a 2 GB UFS root that growfs will expand on first boot to fill the SD card. If you have an 8 GB card or larger, you don’t have to do anything special; if you want a different layout, you’ll be repartitioning by hand.
After the first boot, login is root with no password. There’s no SSH key configured by default — set PermitRootLogin yes and PasswordAuthentication yes in /etc/ssh/sshd_config and pick a password, or copy in a key. (Or use the USB-Ethernet path from essay 4, which is what I do in practice; the UART is for the few cases where USB hasn’t enumerated yet.)
What you have now
A FreeBSD 14 system on a phone. vt0 is the system console on the framebuffer. dwc3 is enumerated as host-mode USB by default; we’ll flip that to gadget-mode in essay 4. WiFi is detected but won’t associate (firmware load issue, essay later). Bluetooth has no daemon running. Audio is silent. Touch is detected but in polling mode.
But you have an SSH-able root prompt over UART, you can pkg install whatever you need from the network if you have a USB-Ethernet dongle on the host, and the next essay is about replacing this kernel with one you built yourself.
Where this can go wrong
If the phone won’t boot from SD: check that the SD card is in the SD slot, not the SIM slot (the cutouts on the PPP back cover are confusing in dim light). Check that SPI U-Boot is actually rk2aw + Megi’s. Hold the volume-down key on power to force boot menu if available. If the framebuffer is blank but the back-cover LED is breathing, the kernel probably booted but the panel didn’t initialize — get on serial.
If serial shows U-Boot output but no kernel banner: that’s expected per the CRU note above. Wait 30 seconds and try a getty login on the same serial.
If serial shows nothing: privacy switch #6, baud rate, FT232 vs CP2102, ground continuity on the TRRS jack. In that order.