Valet m10 bricked

I tried to recover by serial port (RX, TX, GND)
it doesn't recognize Ctrl + C

Decompressing using gzip...........done
Start to blink diag led ...

CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: 01/13/10 11:33:50 CST (root@chungzi_pc)
Copyright (C) 2000-2008 Broadcom Corporation.

Initializing Arena
Initializing Devices.

This is a Serial Flash
Boot partition size = 262144(0x40000)
Found a 4MB ST compatible serial flash
Partition information:
boot    #00   00000000 -> 0003FFFF  (262144)
trx     #01   00040000 -> 0004001B  (28)
os      #02   0004001C -> 003F7FFF  (3899364)
nvram   #03   003F8000 -> 003FFFFF  (32768)
Partition information:
boot    #00   00000000 -> 0003FFFF  (262144)
trx     #01   00040000 -> 003F7FFF  (3899392)
nvram   #02   003F8000 -> 003FFFFF  (32768)
et0: Broadcom BCM47XX GMAC Mbps Ethernet Controller
CPU type 0x19749: 300MHz
Total memory: 32768 KBytes

CFE mem:    0x80700000 - 0x807A4A90 (674448)
Data:       0x8073AB10 - 0x8073DDF0 (13024)
BSS:        0x8073DDF0 - 0x8073EA90 (3232)
Heap:       0x8073EA90 - 0x807A2A90 (409600)
Stack:      0x807A2A90 - 0x807A4A90 (8192)
Text:       0x80700000 - 0x8073AB08 (240392)

Boot version: v5.1.4
The boot is CFE
mac_init(): Find mac [68:7f:74:49:97:58] in location 0

### CLKDIV= 0x80a082c, SFlashClkDiv=8 clkdivsf=4 ###
### Change it to 0x40a082c (4) ###
CMD: [ifconfig eth0 -addr= -mask=]
Device eth0:  hwaddr 68-7F-74-49-97-58, ipaddr, mask
        gateway not set, nameserver not set
CMD: [go;]
Check CRC of image1
  Len:     0x370000     (3604480)       (0xBC040000)
  Offset0: 0x1C         (28)            (0xBC04001C)
  Offset1: 0x9D0        (2512)  (0xBC0409D0)
  Offset2: 0x15BC00     (1424384)       (0xBC19BC00)
  Header CRC:    0xFFE6DE93
  Calculate CRC: 0xFFE6DE93
Image 1 is OK
Try to load image 1.
Waiting for 3 seconds to upgrade ...
CMD: [load -raw -addr=0x807a4a90 -max=0x185b570 :]
Loader:raw Filesys:tftp Dev:eth0 File:: Options:(null)
Loading: _tftpd_open(): retries=0/3
_tftpd_open(): retries=1/3
_tftpd_open(): retries=2/3

### Start=342573339 E=743628409 Delta=401055070 ###
Could not load :: Timeout occured
CMD: [boot -raw -z -addr=0x80001000 -max=0x6ff000 flash0.os:]
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: .. 3916 bytes read

### Start=746708510 E=747478317 Delta=769807 ###
Entry at 0x80001000
Closing network.
Starting program at 0x80001000
Linux version (root@linux) (gcc version 4.1.2) #15589 Mon Jun 15 00:09:45 +04 2020
CPU revision is: 00019749
Found a 4MB ST compatible serial flash
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
Zone PFN ranges:
  Normal          0 ->     8192
  HighMem      8192 ->     8192
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0:        0 ->     8192
Built 1 zonelists in Zone order.  Total pages: 8192
Kernel command line: console=ttyS0,115200 root=1f02 rootfstype=squashfs noinitrd
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
PID hash table entries: 256 (order: 8, 1024 bytes)
CPU: BCMb83a rev 0 at 300 MHz
Using 150.000 MHz high precision timer.
console [ttyS0] enabled
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 26024k/32768k available (3464k kernel code, 6728k reserved, 1364k data, 188k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
Generic PHY: Registered new driver
PCI: no core
PCI: no core
PCI: Fixing up bus 0
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
WRT160Nv3/M10/E1000 GPIO Init
devfs: 2004-01-31 Richard Gooch (
devfs: boot_options: 0x1
squashfs: version 3.0 (2006/03/15) Phillip Lougher
io scheduler noop registered
io scheduler deadline registered (default)
HDLC line discipline: version $Revision: 4.8 $, maxframe=4096
N_HDLC line discipline registered.
Serial: 8250/16550 driver $Revision: 1.90 $ 4 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x0 (irq = 8) is a 16550A
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
MPPE/MPPC encryption/compression module registered
NET: Registered protocol family 24
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <>
et_module_init: passivemode set to 0x0
eth0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller
pflash: found no supported devices
bootloader size: 262144
nvram size: 32768
sflash: Filesystem type: squashfs, size=0x20f424
partition size = 2180096
Creating 5 MTD partitions on "sflash":
0x00000000-0x00040000 : "cfe"
0x00040000-0x003f00▒0 : "linux"
0x0019bc00-0x003b0000 : "rootfs"
mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-only
0x003f0000-0x00400000 : "nvram"
0x003b0000-0x003f0000 : "ddwrt"
Broadcom Watchdog Timer: 0.07 initialized.
u32 classifier
    Performance counters on
    Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
ctnetlink v0.93: registering with nfnetlink.
IPv4 over IPv4 tunneling driver
GRE over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team
ClusterIP Version 0.8 loaded successfully
TCP bic registered
TCP cubic registered
TCP westwood registered
TCP highspeed registered
TCP hybla registered
TCP htcp registered
TCP vegas registered
TCP scalable registered
NET: Registered protocol family 1
NET: Registered protocol family 17
Welcome to PF_RING 3.2.1
(C) 2004-06 L.Deri <>
NET: Registered protocol family 27
PF_RING: bucket length    128 bytes
PF_RING: ring slots       4096
PF_RING: sample rate      1 [1=no sampling]
PF_RING: capture TX       No [RX only]
PF_RING: transparent mode Yes
PF_RING initialized correctly.
PF_RING: registered /proc/net/pf_ring/
802.1Q VLAN Support v1.8 Ben Greear <>
All bugs added by David S. Miller <>
decode 1f02
SQUASHFS error: Failed to allocate read_data block
List of all partitions:
1f00        256 mtdblock0 (driver?)
1f01       3776 mtdblock1 (driver?)
1f02       2129 mtdblock2 (driver?)
1f03         64 mtdblock3 (driver?)
1f04        256 mtdblock4 (driver?)
No filesystem could mount root, tried:  squashfs
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,2)

no ping

@arima0k,welcome to the community!

Correct. I have the same issue on an E1000. Please update this thread if you find a solution.

The firmware installed appears to be dd-wrt. This is the OpenWrt forum. They are not the same. For that 4/32 Broadcom box, OpenWrt is not well suited anyway-- you should go to the dd-wrt forum for advice.

The bootloader seems to have tftp recovery and also very likely CFE web recovery.