Allwinner FEL mode: what it is and how to enter

FEL is Allwinner's factory / firmware / recovery USB-based boot mode. When the BROM can't find a valid eGON.BT0 SPL on any of the standard boot media (MMC0, MMC2, SPI-NOR), it falls through to FEL and waits silently for a USB host to open a dialog.

How the board enters FEL:

1. Automatic: no valid SPL on any media. Very common on brand-new boards, wiped SD cards, or after a failed flash.
2. Manual, via FEL button: some boards (Cubieboard, Pine64) have a dedicated push-button that grounds a boot-select pin at power-on. The BROM sees it and jumps to FEL regardless of what's on MMC.
3. Manual, via short-to-ground: on boards without a dedicated button (OrangePi Zero3), you can short a specific pad (typically labeled *FEL*, *BOOT*, or *RECOVERY*) to ground at power-on to force FEL.

What FEL looks like on the host side: the board enumerates as USB VID/PID 1f3a:efe8 (Allwinner Technology / sunxi-USB-boot). Open-source tools like sunxi-tools' sunxi-fel speak the protocol and can upload an SPL to SRAM, execute it, and boot a working system without touching the on-board storage: the standard bring-up flow for a bricked board.

Why FEL matters for security: the BROM's fallback to FEL is unconditional and cannot be disabled without blowing OTP fuses (which most vendors don't). This means any Allwinner device with USB access has an always-on recovery path: useful for repair, and useful for research. For threat-modeling purposes: physical USB access on an Allwinner device implies the ability to boot any signed-or-unsigned image via FEL.