Thanks, your solution helped for the sysupgrade.bin, but I needed to remove the tplink header completely from KERNEL_INITRAMFS, and let it boot with an uncompressed kernel with tftpboot. Also, the vendor tplink header has some fields in different endian, which I flipped with hex editor before flashing with sysupgrade -n -F sysupgrade.bin. It seemed to be missing the metadata without -F and complained. Then on reboot it booted but could not find root partition:
[ 1.034343] MTD: Couldn't look up '': -22
[ 1.038693] /dev/root: Can't open blockdev
[ 1.042883] VFS: Cannot open root device "" or unknown-block(0,0): error -6
[ 1.049984] Please append a correct "root=" boot option; here are the available partitions:
[ 1.058477] 1f00 128 mtdblock0
[ 1.058492] (driver?)
[ 1.065119] 1f01 16000 mtdblock1
[ 1.065132] (driver?)
[ 1.071776] 1f02 64 mtdblock2
[ 1.071788] (driver?)
[ 1.078444] 1f03 64 mtdblock3
[ 1.078458] (driver?)
[ 1.085084] 1f04 64 mtdblock4
[ 1.085096] (driver?)
[ 1.091738] List of all bdev filesystems:
[ 1.095801] squashfs
[ 1.095807]
[ 1.099628] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[ 1.108012] Rebooting in 1 seconds..
So my remaining question is how do I pass the root= boot parameter to the kernel and what should it be?