Hi everyone, I recently bought Qin F21 Pro to play with J2ME, custom kernels and so on. My version came with official preinstalled Google Services, with Go variants of the apps. (Un)fortunately I got a new revision with projet AGN_3224WPA_F21PRO_C3BW_MV3224_P0_V02, OTA f21_pro_agenew_oversea with ROM version 2.0.3
Detailed info about the device: the hardware, MTK status
Firmware
- Android:
11 / API 30
- DuoQin version:
2.0.3
- OTA tag:
f21_pro_agenew_oversea
- Display build:
1.0.0
- Build ID:
RP1A.200720.011
- Incremental:
1762416485
- Security patch:
2022-06-05
- Build date:
2025-11-06 16:06:41 CST
- Build type:
user/release-keys
- Fingerprint:
Android/Android/Android:11/RP1A.200720.011/1762416485:user/release-keys
- Kernel:
4.19.127, build 2025-11-06 16:09:38 CST
- Baseband:
MOLY.LR12A.R3.MP.V202.3
Hardware bring-up
- Display:
480×640, 208 dpi, 60 Hz, rotation 0
- Display stack: legacy MTK FB/LCM + M4U; DRM core is present but
CONFIG_DRM_MEDIATEK is disabled
- Bootloader DTBO LCM string:
nt35521_hd_dsi_vdo_truly_rt5081_drv
- Kernel-compiled LCM strings:
IPS_PV028V0E_T40_2QP0_BOE_MIPI_VGA, GC9503_YH_028BG3175C0_MIPI2_VGA, GC9503_YIHUA_3224WPA_MIPI2_VGA
- GPU: PowerVR Rogue GE8300; Rogue DDK
1.13@5776728; OpenGL ES 3.2; EGL platform meow
- GPU kernel config:
rgx clark m1.9ED4971894; userspace uses gralloc.rogue.so and vulkan.mt6761.so
- Touch runtime: generic
mtk-tpd, 480×640, pressure 0–255, multitouch tracking IDs 0–10
- Touch kernel: active GSL path (
tp-gsl / GSL1691); DTBO also describes inactive Goodix GT1151 at 0x14 and Hynitron CST8xx at 0x15
- Keypad: MTK matrix keypad plus SN7326 expander at I2C
0x58; runtime reports digits, arrows, Enter, Menu, Back, Camera, Select, * and #
- PMIC keys: Power and Volume Up; MT6357 ACCDET provides headset buttons and jack switches
- Rear camera:
sp5508z5157v_mipi_raw, I2C 0x1a, EEPROM 0x50, AF 0x0c; 2592×1944, flash, orientation 90°
- Front camera:
ov02b_mipi_raw, I2C 0x2d, EEPROM 0x52; 1600×1200, fixed focus, orientation 270°
- Camera stack: MTK imgsensor/ISP/JPEG; Camera Provider
2.6, device HAL 3.6
- Audio: MT6357 codec/ACCDET; Awinic AW87xxx speaker PA at I2C
0x58; Audio HAL 6.0
- Charging: ETA6937 primary charger at I2C
0x6a; WUSB3801 Type-C controller at I2C 0x60
- Stock charger bug:
[eta6937_otg_thr] stays runnable at about 100% of one CPU; stock code busy-waits instead of sleeping
- Flash/IR: AW3641E flashlight; MTK PWM IR transmitter
- AW3641E’s unconditional
set_driver log can appear during camera HAL enumeration or flash-device acquire/release while the LED remains off;
- Sensors exposed by Android: light, proximity, tilt detector and device orientation; no accelerometer or gyroscope HAL sensor is exposed
- Connectivity kernel: MT6761 CONSYS, Wi-Fi, Bluetooth, GPS and MT6631 FM; modem uses MTK ECCCI/CLDMA with MD1 support
- Additional DTBO nodes: NFC at I2C
0x08, cap-touch at 0x5d, dual-SIM hotplug, RGB/keypad/button/backlight LEDs and vibrator
- HAL generation: graphics allocator/mapper
4.0, composer 2.1, GNSS 2.1, sensors/thermal 2.0, radio through 1.5, Wi-Fi through 1.4, USB gadget 1.1
MediaTek BROM
- HW code:
0x717
- HW subcode:
0x8a00
- HW version:
0xca01
- SW version:
0x200
- Target config:
0x0
- SBC: disabled
- SLA: disabled
- DAA: disabled
- SWJTAG: disabled
- Root certificate required: no
- Memory read authentication: no
- Memory write authentication: no
- Command
0xC8 blocked: no
eMMC
- ID:
RX1BMB
- Firmware version:
0x0
- User region:
0x747c00000 bytes (29.12 GiB)
- Boot1:
0x400000 bytes (4 MiB)
- Boot2:
0x400000 bytes (4 MiB)
- RPMB:
0x400000 bytes (4 MiB)
- GP1–GP4: absent
Custom kernel
I just got it yesterday, but by today with the help of GPT 5.6 Sol in Codex I already have a custom kernel based on JamiKettunen’s android_kernel_duoqin_mt6761 repo (that one is for an older F21 Pro revision).
The custom kernel already has most things working: WiFi/BT, rear camera, front camera, flashlight, charging, audio, keypad, keypad backlight, touchscreen, display (obviously), light/proximity sensors.
What’s still not tested: calls, mobile data, SIM operation - I haven’t yet put a SIM into it, but I will probably soon. It’s not my main phone.
Bootloader
This is one of the funniest things on this device’s revision. The fastboot bootloader is very tiny, and it’s obviously never been tested.
- Bug 1: If you enable the OEM unlock toggle and then try to unlock the device with fastboot, you won’t be able to! Why? Because the bootloader has a confirmation step where you have to press “Volume Up” button to confirm. But F21 Pro does not have that button! And on my revision it’s not remapped in the bootloader to any of the existing keys. Thankfully, I was able to unlock the device with
mtkclient’s lower level seccfg feature. This also made it so that userdata wasn’t wiped
- Bug 2: The bootloader’s
fastboot boot is very broken on my version. This made it very annoying to test new kernels, so I had GPT actually investigate and patch the bootloader binary, fixing the fastboot boot path. Signature verification worked because the bootloader on this device seems to be signed with test keys that are available on GitHub, which were used.
Misc
As mentioned in the top collapsed section, there’s a stock kernel bug, at least in my revision, that makes 1 core spin at 100% when a USB cable is connected for OTG. To quote GPT:
We found the exact bug in the stock kernel. The public reference uses wait_event(...) and sleeps until its 10-second timer wakes the thread. Your V3 stock function does something else: it compiles an infinite loop around a 1,000-iteration __const_udelay sequence. That is effectively mdelay(1000)—a one-second busy-wait that deliberately burns a core, checks one flag, then repeats forever. The fix is to use msleep(1000) or restore the reference wait-queue/hrtimer logic.
After identifying this, GPT actually made a binary patch to the stock kernel (that is, modifying the stock kernel binary directly) and reflashed it, making the bug disappear. The full custom kernel build also has this bug fixed.
With mtkclient, I also made the full backup of all important partitions from my device’s version.
I’m just sending all this in case someone needs help or has a similar device 
I wonder if anyone will be interested in me releasing that custom kernel? I don’t know if my revision of the devie is common or not.