I was able to access u-boot prompt from the serial console.
After clicking Esc to interrupt the autoboot, use the password "Hs2021cfgmg" to enter into a configuration shell with a SCHS prompt (Intelligent Switch Mass Production Menu). From this prompt just type XXXX and you will enter the u-boot prompt!
Fro the SCHS prompt you can use hshelp to see available command.
In u-boot there is a rtk command I was not fully able to understand but I used the "upgarde runtime" command to replace the kermnel image on the SPI via tftp. Actually I did all that because I brick the router!
I wil be really intereted having OpenWrt running on this nice small hardware!