Was able to boot kernel this way:
CFE> boot -raw -addr=0x80001000 -max=0x48414C -tftp 192.168.1.100:vmlinux
CMD: [boot -raw -addr=0x80001000 -max=0x48414C -tftp 192.168.1.100:vmlinux]
Loader:raw Filesys:tftp Dev:eth0 File:192.168.1.100:vmlinux Options:(null)
Loading: _tftp_open(): retries=0/3
Stop to blink diag led .............. 4735308 bytes read
Entry at 0x80001000
Closing network.
et0: link down
Starting program at 0x80001000
[ 0.000000] Linux version 4.14.146 (user@server) (gcc version 7.4.0 (OpenWrt GCC 7.4.0 r11152-4791afa)) #0 Wed Oct 2 15:11:44 2019
[ 0.000000] CPU0 revision is: 00029006 (Broadcom BMIPS3300)
[ 0.000000] bcm47xx: Using ssb bus
[ 0.000000] ssb: Found chip with id 0x4704, rev 0x09 and package 0x00
[ 0.000000] ssb: Sonics Silicon Backplane found at address 0x18000000
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 01000000 @ 00000000 (usable)
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Primary instruction cache 16kB, VIPT, 2-way, linesize 16 bytes.
[ 0.000000] Primary data cache 16kB, 2-way, VIPT, cache aliases, linesize 16 bytes
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x0000000000000000-0x0000000000ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000000000000-0x0000000000ffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000000ffffff]
[ 0.000000] random: get_random_bytes called from start_kernel+0x88/0x4a8 with crng_init=0
[ 0.000000] Built 1 zonelists, mobility grouping off. Total pages: 4060
[ 0.000000] Kernel command line: noinitrd console=ttyS0,115200
[ 0.000000] PID hash table entries: 64 (order: -4, 256 bytes)
[ 0.000000] Dentry cache hash table entries: 2048 (order: 1, 8192 bytes)
[ 0.000000] Inode-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.000000] Memory: 11212K/16384K available (3552K kernel code, 154K rwdata, 768K rodata, 188K init, 276K bss, 5172K reserved, 0K cma-reserved)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS: 128
[ 0.000000] MIPS: machine is Linksys WRT150N V1.1
[ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 14479245804 ns
[ 0.000030] sched_clock: 32 bits at 132MHz, resolution 7ns, wraps every 16268815356ns
[ 0.000166] Calibrating delay loop... 262.96 BogoMIPS (lpj=1314816)
[ 0.070134] pid_max: default: 32768 minimum: 301
[ 0.071098] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.071215] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.082492] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.082597] futex hash table entries: 256 (order: -1, 3072 bytes)
[ 0.085689] NET: Registered protocol family 16
[ 0.170480] clocksource: Switched to clocksource MIPS
[ 0.483976] PCI host bridge to bus 0000:00
[ 0.484069] pci_bus 0000:00: root bus resource [mem 0x40000000-0x7fffffff]
[ 0.484122] pci_bus 0000:00: root bus resource [io 0x0100-0x07ff]
[ 0.484175] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[ 0.484229] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[ 0.484440] ssb: PCI: Fixing up bridge 0000:00:00.0
[ 0.484500] ssb: PCI: Fixing up device 0000:00:00.0
[ 0.484553] ssb: PCI: Fixing latency timer of device 0000:00:00.0 to 168
[ 0.486514] pci 0000:00:01.0: BAR 0: assigned [mem 0x40000000-0x40003fff]
[ 0.490803] PCI: Enabling device 0000:00:01.0 (0000 -> 0002)
[ 0.490864] ssb: PCI: Fixing up device 0000:00:01.0
[ 0.550634] ssb: Found chip with id 0x4321, rev 0x03 and package 0x01
[ 0.700249] can not parse nvram name pci/1/1/ledbh1(null) with value -1 got -22
[ 0.700888] can not parse nvram name pci/1/1/ledbh2(null) with value -1 got -22
[ 0.701368] can not parse nvram name pci/1/1/ledbh3(null) with value -1 got -22
[ 0.802144] ssb: Sonics Silicon Backplane found on PCI device 0000:00:01.0
[ 0.803286] NET: Registered protocol family 2
[ 0.805837] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.805991] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.806109] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.806949] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 0.807092] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 0.808150] NET: Registered protocol family 1
[ 0.819808] Crashlog allocated RAM at address 0xf00000
[ 0.829613] workingset: timestamp_bits=14 max_order=12 bucket_order=0
[ 0.858383] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.858443] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.919097] io scheduler noop registered
[ 0.919160] io scheduler deadline registered (default)
[ 0.919822] Serial: 8250/16550 driver, 2 ports, IRQ sharing enabled
[ 0.922241] console [ttyS0] disabled
[ 0.942598] serial8250.0: ttyS0 at MMIO 0xb8000300 (irq = 3, base_baud = 4125000) is a 16550A
[ 1.377644] console [ttyS0] enabled
[ 1.402602] serial8250.0: ttyS1 at MMIO 0xb8000400 (irq = 3, base_baud = 4125000) is a 16550A
[ 1.414460] physmap platform flash device: 02000001 at 1c000000
[ 1.420817] physmap-flash.0: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x0000ec Chip ID 0x0022a2
[ 1.431571] Amd/Fujitsu Extended Query Table at 0x0040
[ 1.436793] Fixing Samsung's Amd/Fujitsu Extended Query version to 1.3
[ 1.443697] Amd/Fujitsu Extended Query version 1.3.
[ 1.448830] number of CFI chips: 1
[ 1.457058] 4 bcm47xxpart partitions found on MTD device physmap-flash.0
[ 1.464024] Creating 4 MTD partitions on "physmap-flash.0":
[ 1.469706] 0x000000000000-0x000000040000 : "boot"
[ 1.490747] 0x000000040000-0x0000003a0000 : "firmware"
[ 1.499250] 3 trx partitions found on MTD device firmware
[ 1.504926] Creating 3 MTD partitions on "firmware":
[ 1.510034] 0x00000000001c-0x0000000008a4 : "loader"
[ 1.526959] 0x0000000008a4-0x000000082e14 : "linux"
[ 1.538638] 0x000000082e14-0x000000360000 : "rootfs"
[ 1.547039] mtd: device 4 (rootfs) set to be root filesystem
[ 1.552997] mtdsplit: squashfs has invalid size in "rootfs"
[ 1.565064] 0x0000003a0000-0x0000003f0000 : "rootfs"
[ 1.576853] 0x0000003f0000-0x000000400000 : "nvram"
[ 1.600152] libphy: Fixed MDIO Bus: probed
[ 1.604968] b44: Broadcom 44xx/47xx 10/100 PCI ethernet driver version 2.0
[ 1.646314] b53_common: found switch: BCM5325, rev 0
[ 1.651687] libphy: b44_eth_mii: probed
[ 1.750668] Broadcom B53 (1) 1:1e: attached PHY driver [Broadcom B53 (1)] (mii_bus:phy_addr=1:1e, irq=POLL)
[ 1.760695] b44 ssb0:0 eth0: Broadcom 44xx/47xx 10/100 PCI ethernet driver 00:1d:7e:6e:93:e5
[ 1.773114] libphy: b44_eth_mii: probed
[ 1.777051] b44 ssb0:1: could not find PHY at 4, use fixed one
[ 1.783585] Generic PHY fixed-0:00: attached PHY driver [Generic PHY] (mii_bus:phy_addr=fixed-0:00, irq=POLL)
[ 1.793805] b44 ssb0:1 eth1: Broadcom 44xx/47xx 10/100 PCI ethernet driver 00:88:88:88:00:2a
[ 1.803710] bcm47xx-wdt bcm47xx-wdt.0: BCM47xx Watchdog Timer enabled (30 seconds, Software Timer)
[ 1.813321] GPIO_WDT: failed to register misc device
[ 1.819141] NET: Registered protocol family 17
[ 1.824067] 8021q: 802.1Q VLAN Support v1.8
[ 1.847528] squashfs: SQUASHFS error: Major/Minor mismatch, older Squashfs 3.0 filesystems are unsupported
[ 1.857688] List of all partitions:
[ 1.861433] 1f00 256 mtdblock0
[ 1.861459] (driver?)
[ 1.868092] 1f01 3456 mtdblock1
[ 1.868103] (driver?)
[ 1.874879] 1f02 2 mtdblock2
[ 1.874903] (driver?)
[ 1.881661] 1f03 521 mtdblock3
[ 1.881685] (driver?)
[ 1.888310] 1f04 2932 mtdblock4
[ 1.888321] (driver?)
[ 1.895092] 1f05 320 mtdblock5
[ 1.895115] (driver?)
[ 1.901873] 1f06 64 mtdblock6
[ 1.901896] (driver?)
[ 1.908515] No filesystem could mount root, tried:
[ 1.908527] squashfs
[ 1.913582]
[ 1.917427] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,4)
[ 1.929097] Rebooting in 1 seconds..
[ 2.928902] bcm47xx: Please stand by while rebooting the system...
OpenWRT 18.06 Initramfs was too big to load 