Bricked my MX60W by erasing NAND, any recovery?

[Roger12]

Hello. I was playing around with a second-hand MX60W and (foolishly) erased the NAND from the console (because it was complaining about "bad CRC or NAND"):

=> nand erase

NAND erase: device 0 whole chip
Skipping bad block at 0x1eb40000
Skipping bad block at 0x2f680000
Skipping bad block at 0x33140000
Erasing at 0x3ffe0000 -- 100% complete.
OK

Now it does not boot or respond to recovery by holding down the hardware reset button. I don't see anything on the serial console either. Is there any recovery path here?

[PhilipDAth]

I'd say you have a better chance of winning the national lottery.

[Roger12]

Ha, yes. From what I can tell, to recover from this I would need to:

- solder a header onto the board for a JTAG connection

- find a JTAG debugger

- set up a Linux box with a build environment

- build the MX60W u-boot source (via Das U-Boot)

- flash the build back onto the board with JTAG

And that's all assuming that Cisco didn't production-fuse off JTAG, which they probably did...

All in all, probably better to go back to eBay to pick up another MX60W for $30... It's too bad because there's nothing wrong with the hardware, but now it's a brick.

[PFSMatt]

May have some luck on OpenWRT/LEDE forums, since the MX60(W) is supported. But yeah, if you're getting absolutely nothing on the serial console, then not sure there's any sort of recovery option besides JTAG.  Supposedly JTAG is enabled on the board, and it looks like the 16 pin JTAG that the 4xx PowerPC chips use, so may have some luck messing around with OpenOCD or other JTAG tools.

But yeah, unless you're really bored and want to mess around just for the fun of it, probably better to just grab a cheap one from eBay.

Though now I'm curious enough I'm tempted to see if I can find an old MX60 I swear we had laying around, I want to know if it's actually recoverable from JTAG. 🙂

[Roger12]

I've actually been looking into it a bit more, mainly because it pains me to dump perfectly good hardware. A few more things I've found out:

- It looks like it might not be necessary to build u-boot separately. Apparently the openwrt images include it, so I might not even need to build it myself. (Found that out by setting up an Ubuntu VM and building it myself, sigh.)

- There's an open-source JTAG solution (openocd) that can use a Raspberry Pi as its hardware adaptor. I already happen to have a RasPi 4 I'm using as an SMB server that could be temporarily repurposed.

- The openwrt wiki (which is generally excellent) has some good JTAG writeups, including one about using JTAG to recover a Meraki MR18.

So what I need to do next is buy a 16-pin header to populate the on-board JTAG and break out the soldering iron...