UART pads (JP1) expose serial console at 115200 baud. Interrupting U-Boot by pressing any key allows:
setenv bootcmd "sf probe 0; sf read 0x82000000 0x200000 0x500000; bootm 0x82000000"
saveenv
This can chainload a custom kernel from an external SD card, bypassing signature verification entirely.
Not necessarily. Carriers stop pushing updates after 2–3 years. You can still manually update if you find the file.
If a new update causes instability, you may need to downgrade.
Important: Huawei prevents downgrading to very old versions due to security patches.