---

name: device-4b description: "Operate Device 4B hardware including firmware download, flashing via fastboot, adb control, serial monitoring via minicom, and JLink debugging. Use when working with Device 4B or 4b device. Integrates with jira-crash for firmware retrieval and gdb-start for debugging." license: MIT compatibility: Requires fastboot, adb, minicom, JLinkGDBServer. Linux environment with USB access.

Device 4B Skill

Operate Device 4B hardware for firmware flashing, debugging, and monitoring.

Workflow Overview

1. Get Firmware - Download from CI (URL in JIRA) or local build
2. Flash Firmware - Use fastboot to flash images
3. Monitor Serial - Use minicom for UART console
4. Debug - Use JLink GDB server + gdb-start skill
5. Control - Use adb for shell access

Skill Integration

Firmware Acquisition

From JIRA (Recommended)

Use the jira-crash skill to get firmware URL from JIRA issue description.

Firmware URL pattern:

Copyhttps://storage.example.internal/ci-artifacts/{project}-CI/{build_number}/{timestamp}.tar.gz

Example:

Copyhttps://storage.example.internal/ci-artifacts/embedded-dev-system-CI/16807/2026011909541.tar.gz

Download and Extract

Copy# Download
wget -O firmware.tar.gz "{firmware_url}"

# Extract
mkdir -p ~/tmp/{timestamp}/images
tar -xzf firmware.tar.gz -C ~/tmp/{timestamp}/images/

Firmware Directory Structure

After extraction, the image directory contains:

Copyfirmware/
├── image_nokasan/         # Combined flash image (default) - FLASHABLE
│   ├── vela_res.bin       # Resource partition image (fastboot flashable)
│   ├── vela_tee.bin       # TEE partition image (fastboot flashable)
│   └── usrdata.fex        # User data partition (fastboot flashable)
├── image_debug/           # Combined flash image (debug) - FLASHABLE
├── image_test/            # Combined flash image (test) - FLASHABLE
├── image_bootloader_test/ # Combined flash image (bootloader test) - FLASHABLE
├── ap/                    # AP core firmware - DEBUG ONLY
│   ├── vela_ap.elf        # ELF with debug symbols (for GDB)
│   ├── vela_ap.bin        # Binary image
│   └── .config            # Build configuration
├── ap_debug/              # AP core firmware (debug) - DEBUG ONLY
├── ap_test/               # AP core firmware (test) - DEBUG ONLY
├── bootloader/            # Bootloader firmware - DEBUG ONLY
│   ├── vela_bl.elf        # ELF with debug symbols (for GDB)
│   └── vela_bl.bin        # Binary image
├── tee/                   # TEE firmware - DEBUG ONLY
│   ├── vela_tee.elf       # ELF with debug symbols (for GDB)
│   └── vela_tee.bin       # Binary image
├── ota/                   # OTA firmware - DEBUG ONLY
└── build_cmd              # Build commands reference

Important Notes

• Only image_xxx/ directories contain flashable images (vela_res.bin, vela_tee.bin, usrdata.fex)
• Other directories (ap/, tee/, bootloader/) provide ELF files for debugging only
• Default: Use image_nokasan/ unless user specifies otherwise

Image Selection

Fastboot Flashing

Prerequisites

Before using fastboot:

Copy# Enable debug mode on device first
echo "" > /data/debugmode

Troubleshooting fwupd Conflict

If fastboot hangs or device stuck in bootloader:

Copy# Check if fwupd is running
ps -ef | grep fwupd | grep -v grep

# Disable fwupd service
sudo systemctl stop fwupd.service
sudo systemctl disable fwupd.service
sudo chmod -x /usr/libexec/fwupd/fwupd

Enter Fastboot Mode

Copy# Method 1 - From device shell (if device is responsive)
reboot bootloader

# Method 2 - Via ADB (if ADB is available)
adb reboot bootloader

# Method 3 - Auto-download mode (if device is bricked)
# 1. Run fastboot command on host (enters "< waiting for any device >" state)
# 2. Reboot/power cycle device
# 3. Device will stop in bootloader when it receives PC packet

Verify device detected:

Copyfastboot devices

Flash Partitions

Flash res partition (contains AP firmware):

Copyfastboot flash res {image_dir}/image_nokasan/vela_res.bin

Flash tee partition:

Copyfastboot flash tee {image_dir}/image_nokasan/vela_tee.bin
# Or from tee directory:
fastboot flash tee {image_dir}/tee/vela_tee.bin

Flash bootloader partition:

Copyfastboot flash bootloader {image_dir}/bootloader/vela_bl.bin

Flash usrdata partition (must erase first):

Copyfastboot erase usrdata
fastboot flash usrdata {image_dir}/image_nokasan/usrdata.fex

Reboot After Flashing

Copyfastboot reboot

Fastboot Commands Reference

Partition Names

ADB Control

After device boots:

Verify Connection

Copyadb devices

Shell Access

Copyadb shell

Common ADB Commands

Serial Monitoring (minicom)

Start minicom

Copyminicom -D /dev/ttyUSB0 -b 921600

Baud rate: 921600 (fixed for X4B)

Common serial ports:

• /dev/ttyUSB0 - USB-UART adapter
• /dev/ttyACM0 - CDC ACM device

minicom Shortcuts

Use the tmux skill to run minicom in a managed session for interactive monitoring.

JLink Debugging

Start JLink GDB Server

Connect to Core 0 (AP):

CopyJLinkGDBServer -if JTAG -speed 1000KHZ -device R528S3-CORE0 -port 23331

Connect to Core 1 (TEE):

CopyJLinkGDBServer -if JTAG -speed 1000KHZ -device R528S3-CORE1 -port 23332

JLink Parameters

Connect GDB

Use the gdb-start skill to connect GDB to JLink GDB server.

ELF files for debugging:

• AP: {image_dir}/ap/vela_ap.elf
• TEE: {image_dir}/tee/vela_tee.elf
• Bootloader: {image_dir}/bootloader/vela_bl.elf

GDB target:

• Core 0 (AP): localhost:23331
• Core 1 (TEE): localhost:23332

Use the tmux skill to run JLinkGDBServer in interactive session.

Quick Reference

Flash and Boot

Copy# 1. Download firmware (get URL from JIRA via jira-crash skill)
wget -O fw.tar.gz "{url}"
tar -xzf fw.tar.gz

# 2. Enter fastboot mode
adb reboot bootloader
# Or from device shell: reboot bootloader

# 3. Flash (use image_nokasan by default)
fastboot flash res firmware/image_nokasan/vela_res.bin
fastboot flash tee firmware/image_nokasan/vela_tee.bin
fastboot reboot

# 4. Verify
adb devices
adb shell

Debug Session

Copy# 1. Start JLink GDB Server (use tmux skill for interactive session)
JLinkGDBServer -if JTAG -speed 1000KHZ -device R528S3-CORE0 -port 2331

# 2. Connect GDB (use gdb-start skill)
# Target: localhost:2331
# ELF: firmware/ap/vela_ap.elf

Serial Monitor

Copy# Use tmux skill to run minicom
minicom -D /dev/ttyUSB0 -b 1500000

Memory Dump (Crash Analysis)

Dump device memory via fastboot for crash analysis.

Enable Dump Mode

Before crash occurs, enable dump mode on device:

Copyecho "" > /data/dumpmode

When device crashes, it will automatically stop in bootloader mode, allowing memory dump.

Dump Memory

Copy# Device is in bootloader after crash

# Dump memory region (address, size)
fastboot oem memdump 0x40000000 0x8000000

# Retrieve the dump file
fastboot get_staged 0x40000000.bin

Parameters

Common Memory Regions

Use with crash-analysis skill to analyze the memory dump with ELF symbols.

Troubleshooting