OpenWrt support for Cudy TR1200 (MT7628)

I'm working on port OpenWrt to this router. I managed to build a binary, but I can't reach the u-boot console. Someone knows how?

I tried pressing down/up arrow, all numbers from 0 to 9, etc.
The Reset button only loads the tftp recovery and web recovery (that only accepts signed firmware). After that, boots straight on the OEM firmware.

Have you tried ctrl + c?
It's common for interrupting the boot process.

Also can you access the u-boot env variables with fw_printenv in OEM firmware?

I tried with this combination and don't work.

Searching for more comments working on Cudy's MT7628 boards I can see a pattern. People run into the same problem, then Cudy generates a signed firmware (or someone dump and reflash the spi chip) and no more u-boot comments. I've even tried reading commits or PRs from other devices with MT7628 and no method read there works.
I tried to read the SPI chip with a test clip and it doesn't work, I hope I don't have to desolder it.

Additionally, if the firmware starts, I have no shell access and the serial output only shows kernel messages.

Cudy support confirmed to me that the bootloader was locked. By reprogramming the SPI chip I was able to load an OpenWrt build.

Cudy also kindly sent me a firmware with an unlocked U-boot, which made testing easier. I will be documenting on the Wiki soon.

I sent a PR: