Cerberus V1: Jetson Orin Nano Imaging — The Plan B Recovery Flash

The goal

Get JetPack 7.2 (L4T r39.2.0) onto the 256GB M.2 NVMe SSD inside the Jetson Orin Nano Super Developer Kit — Cerberus V1's sole compute brain.

Plan A: USB-ISO flash (failed, twice)

The documented NVIDIA path is to write the JetPack ISO to a USB drive, boot the Jetson from it, and run the installer. Two attempts, two hangs at a blank post-install screen:

Attempt 1 — wrong firmware. The board shipped with pre-r39 firmware. Step 3.1's firmware gate (≥36.0) was too loose — the ISO expected r39 firmware and silently hung. The board self-updated to v39 on-device.

Attempt 2 — still hung. With v39 firmware confirmed, the ISO flash was retried. Same blank screen. Root cause not fully diagnosed, but the pattern (boot → installer runs → post-install blank) matched a known NVIDIA edge case with certain carrier board revisions.

Plan B: USB-C Force Recovery Mode (success)

The fallback was host-flashing via USB-C in Force Recovery Mode. This involves:

1. Jumper J14 pins 9 and 10 (GND + FC REC) to put the Jetson into recovery mode
2. Connect the Jetson to the command-centre PC via USB-C
3. Run l4t_initrd_flash.sh from the host

Three real host-side bugs had to be fixed before this worked:

Bug 1 — qemu-aarch64-static missing. Modern Ubuntu dropped the old binary name. Fixed with a symlink: ln -s /usr/bin/qemu-aarch64 /usr/bin/qemu-aarch64-static.

Bug 2 — NVIDIA flash script tries to generate an SSH DSA key. OpenSSH removed DSA support years ago. The script's ssh-keygen -t dsa command fails fatally. Fixed by deleting the unused key-gen line from the recovery ramdisk script.

Bug 3 — UFW blocking the flash tool's NFS port. The host PC's firewall was blocking port 2049, which the flash tool uses internally. Fixed by opening port 2049 for the duration of the flash, then reverting.

All three were found and fixed during a single evening session.

What shipped

• JetPack 7.2 (L4T r39.2.0) on the 256GB NVMe — 233G total, 211G available
• Full desktop (gdm + gnome-initial-setup) with OOBE completed
• Hostname: cerberus-v1, username: cerberus-v1
• Tailscale SSH for headless access — no manual key copying needed
• Storage, memory, and network all nominal, no pending reboot

The full flashing procedure with all fixes and both Plan A and Plan B paths is documented in vehicles/cerberus/V1/cerberus-v1-jetson-flashing.md for next time.

What was deferred

System update, sshd password-auth review, and other post-flash hardening all need sudo on the Jetson. The password is stored securely, but these steps are low-priority hardening — deferred until the next physical bench session.