Typically, to boot the MX28 system in recovery mode, end user should hold the recovery switch for several seconds while plugging in USB. Alternatively, the system can set the real time clock persistent bit HW_RTC_PERSISTENT1:0x8005C070:0 and then execute system reboot. Detail can refer to "Boot Modes" section in reference manual.
Once the MX28 is in recovery mode, PC host can load any MX28 boot stream to the device using sb_loader.exe via USB.