Boot to CFE Prompt from RAM on BCM63xx

I'm new to OpenWRT and just playing around with an old Switch based on BCM63xx.
I'm trying to get OpenWrt working on it, but I want to backup the ROM (firmware), and also be able to load it. The CFE version that is shipped with it does not support the "dn" command needed to make the backup.

I can boot OpenWrt on th BCM63xx switch, I do this by connecting to the serial interface,
pressing control + c during boot. Then on the legacy CFE prompt I can
load a OpenWrt elf image to RAM and boot OpenWRT.
I've built the image myself using the git repo and in the configuration I have selected the
bmc-63xx-cfe bootloader.

On the prompt while connected to the serial console I write:

Available commands:

write_reg           Write the register.
read_reg            Read the register.
sm                  Set memory or registers.
dm                  Dump memory or registers.
w                   Write the whole image start from beginning of the flash
e                   Erase [n]vram or [a]ll flash except bootrom
r                   Run program from flash image or from host depend on [f/h] flag
p                   Print boot line and board parameter info
c                   Change booline parameters
f                   Write image to the flash 
i                   Erase persistent storage data
b                   Change board parameters
reset               Reset the board
flashimage          Flashes a compressed image after the bootloader.
help                Obtain help for CFE commands

For more information about a command, enter 'help command-name'
*** command status = 0
CFE> r
0x80a00000/3934668 Entry at 0x80a00000

I'm trying to load a newer CFE that supports more commands, with the above I can boot into OpenWRT, but how can I boot into CFE on this RAM version?

Thanks in advance,