Aetina AIE-KX23 (Jetson AGX Orin 64GB) - Flashing Runbook

Last validated: 2026-08-23 Result of this procedure: JetPack 6.0 (L4T R36.3.0) with Aetina carrier BSP, booting from internal eMMC, both NICs and both CAN interfaces functional.

1. Hardware facts (verified on this unit)

Important gotchas about identity

• USB PID 7023 is documented by NVIDIA as "AGX Orin Industrial (P3701-0008)". On this unit that is misleading. The EEPROM read (board SKU 0005) and Aetina's own BSP contents (tegra234-mb1-bct-pmic-p3701-0005.dts) both confirm P3701-0005. Trust the EEPROM, not the PID.
• SDK Manager labels the bundle "Jetson AGX Orin Industrial 64GB". Also misleading. Ignore it.

Physical controls

Recovery and Reset are recessed pinholes on the back panel:

• Recovery = left
• Reset = right

The board auto-powers-on when DC is applied.

Ports

• OTG Type-C port = the flashing port. USB 2.0 only.
• Use a USB-A to USB-C cable. USB-C to USB-C frequently fails to negotiate on a USB 2.0-only Type-C receptacle. This is expected behavior, not a bad cable.

2. Prerequisites

Host machine

An x86_64 Linux host. Three options, ranked by reliability:

1. Native Ubuntu 20.04 / 22.04 - best. No USB proxy layer.
2. Windows 11 + WSL2 via NVIDIA SDK Manager for Windows - works, but see the USB troubleshooting section. This is what was used for the validated run.
3. VirtualBox VM - do not use. USB passthrough drops the device mid-flash.

NVIDIA only qualifies Ubuntu 20.04 and 22.04 as flash hosts.

Packages required on the build host

sudo apt update
sudo apt install -y bzip2 unzip qemu-user-static

bzip2 is not optional. Aetina's setup.sh silently fails without it (see section 9).

Files to download

Ignore everything under SOURCES / DOCS / TOOLS on the NVIDIA page unless you are building a custom kernel.

Version matching is mandatory. The Aetina patch is built for R36.3.0 specifically. Do not pair it with R36.4 or R36.5.

Disk space

Approximately 30 GB free on the build host.

3. Build the BSP tree

3.1 Create the working directory

mkdir -p ~/aetina_r36
cd ~/aetina_r36

Copy the three downloaded files into this directory.

3.2 Extract the NVIDIA BSP

cd ~/aetina_r36
tar xf Jetson_Linux_R36.3.0_aarch64.tbz2

This creates Linux_for_Tegra/.

3.3 Extract the sample rootfs into it

sudo and the p flag are both required. The rootfs carries ownership and permissions that must survive extraction.

cd ~/aetina_r36
sudo tar xpf Tegra_Linux_Sample-Root-Filesystem_R36.3.0_aarch64.tbz2 -C Linux_for_Tegra/rootfs/

Takes a few minutes. Silent on success.

3.4 Restructure to what Aetina's setup.sh expects

setup.sh hardcodes a sibling directory named JetPack_6.0_Linux_JETSON_AGX_ORIN_TARGETS. It will fail with "Invalid JetPack folder name" otherwise.

cd ~/aetina_r36
mkdir -p JetPack_6.0_Linux_JETSON_AGX_ORIN_TARGETS
mv Linux_for_Tegra JetPack_6.0_Linux_JETSON_AGX_ORIN_TARGETS/

3.5 Extract the Aetina patch

cd ~/aetina_r36
unzip PATCH_R36_3_0_ORIN_AGX_AIB-MX03_v1.3.0_STD_Aetina.zip
cd PATCH_R36_3_0_ORIN_AGX_AIB-MX03_v1.3.0_STD_Aetina
md5sum -c PATCH_R36_3_0_ORIN_AGX_AIB-MX03_v1.3.0_STD_Aetina.tar.gz.md5sum
tar xzf PATCH_R36_3_0_ORIN_AGX_AIB-MX03_v1.3.0_STD_Aetina.tar.gz

Verify the md5sum returns OK before continuing.

3.6 Move the patch folder to be a sibling of the JetPack folder

setup.sh uses ../ relative paths.

cd ~/aetina_r36
mv PATCH_R36_3_0_ORIN_AGX_AIB-MX03_v1.3.0_STD_Aetina/R36_3_0_ORIN_AGX_AIB-MX03_v1.3.0_STD_Aetina .
ls -la

~/aetina_r36 must now contain both of these as siblings:

• JetPack_6.0_Linux_JETSON_AGX_ORIN_TARGETS/
• R36_3_0_ORIN_AGX_AIB-MX03_v1.3.0_STD_Aetina/

3.7 Run Aetina's setup.sh

Do not run apply_binaries.sh yourself first. setup.sh runs it.

cd ~/aetina_r36/R36_3_0_ORIN_AGX_AIB-MX03_v1.3.0_STD_Aetina
chmod +x setup.sh
sudo ./setup.sh

Takes 10-20 minutes.

3.8 CRITICAL: verify the kernel modules extracted

setup.sh reports "Updated successfully" even when the kernel module extraction fails. Its only success check compares kernel/Image timestamps, which change regardless.

The script does this:

sudo rm -rf .../rootfs/usr/lib/modules
sudo tar -xjf kernel_module/kernel_supplements.tbz2 -C .../rootfs/usr/

If bzip2 is missing, the delete succeeds and the extract fails, leaving a rootfs with no kernel modules at all. Flashing that produces a kernel with no drivers.

Verify:

ls -la ~/aetina_r36/JetPack_6.0_Linux_JETSON_AGX_ORIN_TARGETS/Linux_for_Tegra/rootfs/usr/lib/modules/

You must see a version directory, e.g. 5.15.136-tegra. If it is missing or empty:

sudo apt install -y bzip2
cd ~/aetina_r36/R36_3_0_ORIN_AGX_AIB-MX03_v1.3.0_STD_Aetina
sudo tar -xjf kernel_module/kernel_supplements.tbz2 -C ~/aetina_r36/JetPack_6.0_Linux_JETSON_AGX_ORIN_TARGETS/Linux_for_Tegra/rootfs/usr/

Then re-run the remaining copy steps:

cd ~/aetina_r36/R36_3_0_ORIN_AGX_AIB-MX03_v1.3.0_STD_Aetina
sudo cp -rf Linux_for_Tegra/* ~/aetina_r36/JetPack_6.0_Linux_JETSON_AGX_ORIN_TARGETS/Linux_for_Tegra/
sudo cp -rpf Linux_for_Tegra/rootfs/home/* ~/aetina_r36/JetPack_6.0_Linux_JETSON_AGX_ORIN_TARGETS/Linux_for_Tegra/rootfs/home/
sudo rm -rf ~/aetina_r36/JetPack_6.0_Linux_JETSON_AGX_ORIN_TARGETS/Linux_for_Tegra/rootfs/etc/systemd/system/default.target
sudo rm -rf ~/aetina_r36/JetPack_6.0_Linux_JETSON_AGX_ORIN_TARGETS/Linux_for_Tegra/rootfs/usr/bin/qemu-aarch64-static

3.9 Verify Aetina's files landed

cd ~/aetina_r36/JetPack_6.0_Linux_JETSON_AGX_ORIN_TARGETS/Linux_for_Tegra
ls -la bootloader/uefi_jetson.bin
ls -la bootloader/BOOTAA64.efi
ls -la bootloader/tos-optee_t234.img
ls -la bootloader/tegra234-mb1-bct-pmic-p3701-0005.dts
ls -la bootloader/tegra234-mb1-bct-gpio-p3701-0000-a04.dtsi
ls -la kernel/Image
ls -la kernel/dtb/tegra234-p3737-0000+p3701-0005-nv.dtb

All should be dated the day you ran setup.sh. These are the carrier-specific pieces - the bootloader chain, the MB1-BCT pinmux/GPIO/PMIC data, and the device tree matching P3701-0005.

3.10 Pre-create the login account

Skips the first-boot OOBE wizard, which matters because HDMI may not work on first boot.

cd ~/aetina_r36/JetPack_6.0_Linux_JETSON_AGX_ORIN_TARGETS/Linux_for_Tegra
sudo ./tools/l4t_create_default_user.sh -u <username> -p <password> -a --accept-license

4. Put the board into recovery mode (RCM)

The board auto-powers-on when DC is applied, so the reliable sequence is:

1. Unplug the DC jack entirely. Not just power off - pull the connector.
2. Connect the USB-A-to-C cable from host to the board's OTG Type-C port.
3. Wait 30 seconds.
4. Press and hold the top pinhole (Recovery).
5. While holding, plug in the DC jack.
6. Keep holding Recovery for another 3 seconds, then release.

Alternative if the board is already running: hold Recovery, briefly tap Reset (bottom pinhole), keep holding Recovery 3 more seconds.

Verify

On a Linux host:

lsusb | grep -i 0955

On Windows:

usbipd list

You want 0955:7023 / APX. If you see 0955:7020 with an RNDIS or USB Serial device, the board booted normally and recovery did not take.

5. USB attach (WSL2 hosts only)

Skip this section entirely on a native Linux host.

5.1 Attach

In an Administrator PowerShell terminal:

usbipd list
usbipd bind --busid <BUSID> --force
usbipd attach --wsl <DistroName> --busid <BUSID> --auto-attach

Notes:

• --auto-attach is mandatory. The Jetson re-enumerates several times during a flash under different product IDs. Without it, WSL loses the device on the first transition.
• Leave this window open for the entire flash. The stream of attach/detach messages is the mechanism working, not errors.
• On usbipd 5.x the distro is the value of --wsl. There is no --distribution flag.
• Wait 60 seconds after attaching before starting the flash.

5.2 Verify from inside WSL

wsl -d <DistroName>
lsusb | grep -i 0955

Note the Device NNN number. It increments once per attach for the lifetime of the WSL VM and only resets on wsl --shutdown. A low number confirms a fresh VM.

6. Flash

cd ~/aetina_r36/JetPack_6.0_Linux_JETSON_AGX_ORIN_TARGETS/Linux_for_Tegra
sudo ./flash.sh jetson-agx-orin-devkit internal

Checkpoints

Total runtime: approximately 15-16 minutes (945 seconds on the validated run).

Do not touch the board, cable, or usbipd window during the flash.

7. First boot

The flash ends with "Reset the board to boot from internal eMMC." The board does not leave recovery on its own. Do this in order:

1. Unplug the OTG cable.
2. Ctrl+C the usbipd window (WSL hosts).
3. Pull the DC jack. Wait 30 seconds.
4. Connect ethernet. Connect HDMI if you want video.
5. Reconnect DC power with nothing in either pinhole.

Allow several minutes - first boot expands the filesystem and runs initial service setup.

Confirming it booted

In order of usefulness:

1. Router DHCP lease - strongest signal, independent of everything else.
2. HDMI output - Aetina's BSP adds framebuffer console support.
3. USB - reconnect the OTG cable; 0955:7020 means booted, 0955:7023 means it fell back to RCM.
4. SSH over USB device mode - ssh <user>@192.168.55.1

Verification commands

cat /etc/nv_tegra_release
uname -r
ip -br a

Expected:

• R36 (release), REVISION: 3.0
• 5.15.136-tegra
• eth0 and eth1 both present (1GbE and 10GbE)
• can0 and can1 both present

can0 / can1 and dual eth interfaces are the proof that Aetina's device tree is loaded. Stock NVIDIA L4T on a devkit config shows neither.

8. Post-flash software install

8.1 Enable the NVIDIA apt repository

Aetina's image ships with the repo lines commented out.

sudo sed -i 's|^#deb https://repo.download.nvidia.com|deb https://repo.download.nvidia.com|' /etc/apt/sources.list.d/nvidia-l4t-apt-source.list
cat /etc/apt/sources.list.d/nvidia-l4t-apt-source.list
sudo apt update

The signing key (jetson-ota-public.asc) is already in /etc/apt/trusted.gpg.d/.

The release suite in that file must match the flashed L4T version (r36.3 here).

8.2 Install the JetPack stack

sudo apt install -y nvidia-jetpack

CUDA, cuDNN, TensorRT, OpenCV, container runtime. Several GB.

8.3 Verify the vendor BSP survived

ip -br a
nvcc --version

If can0 / can1 disappeared after installing nvidia-jetpack, the stock BSP packages overwrote Aetina's device tree. See section 10.

8.4 Monitoring tool

sudo apt install -y python3-pip
sudo pip3 install jetson-stats
sudo jtop

8.5 Power mode

The board defaults to a restricted power profile (observed: MODE_30W, with CPU cores 10-12 offline). For inference workloads you want the full envelope.

sudo nvpmodel -q --verbose
sudo nvpmodel -m 0
sudo jetson_clocks

nvpmodel -m 0 is MAXN on most AGX Orin configurations - confirm against the -q output first. jetson_clocks pins all clocks to maximum and disables dynamic scaling; good for benchmarking, not something to leave on permanently.

Thermal note: the AIE-KX23 ships with a 12V / 11.5A (138W) adapter and is rated to roughly 75W at full load on the 64GB module. Watch temperatures under sustained load.

The AGX Orin 64GB module already reaches its 275 TOPS ceiling under MAXN. "Super Mode" is not relevant here - it targeted Orin Nano / Orin NX in JetPack 6.2 and AGX Orin 32GB in JetPack 7.2.

9. Troubleshooting - failures actually encountered

ERROR: might be timeout in USB write at Sending bct_br

Cause: The Tegra boot ROM accepts one RCM session. A previous failed run consumed it. The reboot recovery at the end of a failed run is issued through the MB2 applet, which never loaded, so it silently does nothing and the board stays in a half-consumed state.

Fix - do all of it:

wsl --shutdown

Then:

1. Unplug the DC jack (not just power off).
2. Unplug the OTG cable.
3. Wait 60 seconds.
4. Clear stale artifacts:

cd ~/aetina_r36/JetPack_6.0_Linux_JETSON_AGX_ORIN_TARGETS/Linux_for_Tegra
sudo rm -f bootloader/fuse_t234.xml bootloader/cvm.bin bootloader/custinfo_out.bin

1. Re-enter recovery, re-bind, re-attach, wait 60 seconds, flash.

Confirm the lsusb device number is low (2 or 3) - that proves the WSL VM actually restarted.

Error: probing the target board failed. / blank ECID is

Cause: nvsdkmanager_flash.sh (the SDK Manager path) does a pre-check, reboots the board to recovery, then calls flash.sh about 2 seconds later. usbipd's --auto-attach polls and has not re-attached yet. flash.sh gives up in that gap.

Fix: Do not use SDK Manager's orchestration. Put the board in recovery, attach, wait, and call flash.sh directly. There is no reboot between probe and flash that way.

SDK Manager "The target is in a bad state"

Wrapper for the above. Not a hardware fault, and nothing has been written to the board. Check NV_L4T_JETSON_LINUX_WINDOWS_FLASH_COMP.log in the exported logs for the real error.

Board flashes successfully but boots straight back to APX

Cause: Wrong bootloader / MB1-BCT for the carrier. MB1 loads carrier-specific pinmux, pad voltage, PMIC, and GPIO configuration before any Linux device tree exists. Get that wrong and boot dies at bootrom level, which presents as RCM.

This is what happens if you flash stock NVIDIA L4T (any version) on this carrier. The fix is the Aetina BSP. There is no stock board config that works.

SDK Manager offers JetPack 7.0 / 7.1 but greys out 6.x

Target Hardware is set to Jetson AGX Thor modules. Change it to Jetson AGX Orin modules.

Note: JetPack 7.0 and 7.1 are Thor-only (AGX Thor Devkit, T5000, T4000). JetPack 7.2 and later do support the Orin family, including AGX Orin - that arrived around June 2026 with L4T r39.x, Ubuntu 24.04, kernel 6.8, and CUDA 13. Do not assume the whole 7.x line is off-limits for this module; check the JetPack Archive page for the per-release hardware support list.

The limiting factor for this board is the Aetina carrier BSP, not NVIDIA's module support. See section 11.

ISO / USB-drive installer refuses with "NVIDIA UEFI Firmware Version Too Old"

The ISO installer requires the on-device UEFI to already be new enough to parse it. Chicken-and-egg. Use the USB recovery-mode flash instead, which rewrites UEFI wholesale and does not care what is currently installed.

E: Unable to locate package nvidia-jetpack

The NVIDIA apt repo lines are commented out in /etc/apt/sources.list.d/nvidia-l4t-apt-source.list. See section 8.1.

No HDMI output

The factory Aetina image is headless. Blank HDMI on a fresh unit is expected and does not mean the board is dead. Use the USB serial gadget or check DHCP leases instead.

COM port disappears when the board is off

That serial port is a USB gadget presented by the booted Linux system, not a debug UART. It cannot show you the boot process. For real boot-stage visibility you need a USB-to-TTL adapter (CP2102 or CH340) on the board's debug UART header. Worth owning before the next attempt.

10. Known issues (from Aetina's release notes)

1. Suspend mode cannot resume via keyboard and mouse.
2. USB and NVMe performance are reduced compared to JetPack 5.
3. In rare cases the system may hang during boot at the UEFI stage, requiring a refresh.

Plus one observed in the field: installing nvidia-jetpack has been reported to reinstall stock BSP components over vendor customization. Always re-check ip -br a for can0 / can1 after any large NVIDIA package operation.

11. Upgrade path and package holds

Do not run a blanket apt upgrade

The nvidia-l4t-bootloader, nvidia-l4t-kernel, nvidia-l4t-kernel-dtbs, and related packages carry exactly the files Aetina replaced. A blanket upgrade can overwrite them and return the board to the non-booting RCM state - and it would not be recoverable from the device, since it would not boot to fix itself.

Set holds first:

sudo apt-mark hold nvidia-l4t-bootloader nvidia-l4t-kernel nvidia-l4t-kernel-dtbs nvidia-l4t-kernel-oot-modules nvidia-l4t-display-kernel nvidia-l4t-init nvidia-l4t-initrd
apt-mark showhold

With those held, sudo apt upgrade for ordinary Ubuntu packages is safe.

What the hardware supports vs what this board can run

Stock NVIDIA L4T of any version does not boot on this carrier - verified. So a newer JetPack requires a matching Aetina BSP, not just a newer NVIDIA release.

Upgrade decision table

Aetina technical support: https://forms.office.com/r/qxycH46bc3

Ask specifically whether any BSP newer than the Nov 2024 JetPack 6.0 patch exists for the AIE-KX23, including JetPack 7.2. Vendors often hold newer BSPs for direct request rather than publishing them.

12. Quick reference - the whole flash in one block

Assumes the BSP tree at ~/aetina_r36 is already built and verified.

# Host: reset everything
wsl --shutdown

# Board: pull DC jack, unplug OTG, wait 60s
# Board: hold Recovery (top pinhole), plug in DC, hold 3s more
# Board: reconnect OTG cable

# Windows PowerShell (Administrator):
usbipd list
usbipd bind --busid <BUSID> --force
usbipd attach --wsl <DistroName> --busid <BUSID> --auto-attach
# leave open, wait 60s

# Second window:
wsl -d <DistroName>
lsusb | grep -i 0955
cd ~/aetina_r36/JetPack_6.0_Linux_JETSON_AGX_ORIN_TARGETS/Linux_for_Tegra
sudo rm -f bootloader/fuse_t234.xml bootloader/cvm.bin bootloader/custinfo_out.bin
sudo ./flash.sh jetson-agx-orin-devkit internal

# After success: unplug OTG, Ctrl+C usbipd, pull DC, wait 30s, reconnect DC

13. Archive and cleanup

After a successful flash, keep the source files and delete the derived trees. Sources are small and awkward to re-obtain; derived trees are large and rebuild mechanically in 20-30 minutes.

Keep (~2.5 GB)

Store these together in a deliberate location - not a Downloads folder.

Add a README.txt alongside them explaining what they are. Six months on, an unlabeled tarball is something you delete by accident.

Delete

The SDK Manager JetPack tree is worth deleting even if space is not a concern: it is a BSP that does not boot on this carrier, and keeping it invites a future mistake.

The assembled BSP tree also contains a rootfs with the password baked in by l4t_create_default_user.sh. Another reason not to leave it lying around.

Copy the source files out of the working directory before deleting it - they live inside ~/aetina_r36.

mkdir -p /mnt/c/Users/<user>/jetson-bsp-archive
cd ~/aetina_r36
cp Jetson_Linux_R36.3.0_aarch64.tbz2 /mnt/c/Users/<user>/jetson-bsp-archive/
cp Tegra_Linux_Sample-Root-Filesystem_R36.3.0_aarch64.tbz2 /mnt/c/Users/<user>/jetson-bsp-archive/
cp PATCH_R36_3_0_ORIN_AGX_AIB-MX03_v1.3.0_STD_Aetina.zip /mnt/c/Users/<user>/jetson-bsp-archive/
cp overlay_mb1bct_36.x.tbz2 /mnt/c/Users/<user>/jetson-bsp-archive/
ls -la /mnt/c/Users/<user>/jetson-bsp-archive/

Verify sizes match, then:

cd ~
sudo rm -rf ~/aetina_r36
sudo rm -rf ~/nvidia
df -h /

Keep the WSL distro itself

The SDK Manager distro is a validated Ubuntu 22.04 flash host with usbipd already configured. That environment is most of what makes a successful flash possible. Keep it even when empty.

Reclaiming space on Windows

Deleting files inside WSL does not shrink ext4.vhdx. It stays at its high-water mark.

wsl --manage <Distro> --set-sparse true currently fails with:

Sparse VHD support is currently disabled due to potential data corruption.

Do not use --allow-unsafe. Compact the disk with diskpart instead - the read-only attach makes it safe.

Find the path:

Get-ChildItem HKCU:\Software\Microsoft\Windows\CurrentVersion\Lxss | ForEach-Object { Get-ItemProperty $_.PSPath } | Select-Object DistributionName, BasePath

Then, in an Administrator PowerShell:

wsl --shutdown
diskpart

Inside diskpart (substitute the actual BasePath plus \ext4.vhdx):

select vdisk file="C:\Users\<user>\AppData\Local\...\ext4.vhdx"
attach vdisk readonly
compact vdisk
detach vdisk
exit

compact vdisk shows a percentage counter and takes a few minutes.

Verified result on this setup: the SDK Manager distro's ext4.vhdx went from roughly 47 GB to 3.4 GB after deleting both BSP trees and compacting. The BasePath for an SDK Manager distro looks like C:\Users\<user>\AppData\Local\Packages\nvidia_sdkm_wsl_ubuntu_22.04_jetpack_<version>\LocalState, with ext4.vhdx inside it.

If select vdisk reports the file is in use, WSL has not fully stopped. Confirm with wsl --list --verbose that every distro reads Stopped, and close any lingering WSL terminals.

If you expect to flash another unit soon

Keeping the assembled ~/aetina_r36 tree saves 20-30 minutes per unit and avoids re-hitting the assembly pitfalls (particularly the bzip2 trap in section 3.8). Re-run l4t_create_default_user.sh with a different password for each unit.

If it is speculative, delete it. The four source files plus sections 3.1-3.10 rebuild it.