Fake RAM size on an Android TV Box

I don't know if this should be posted here or on the Debian sub-forum. Please feel free to move this topic to a more appropriate sub-forum if warranted.

Before I go into the subject, I wanted to say that I did encounter a similar issue with a fake RAM size on a 10.1" Android tablet that I bought from a Chinese seller on eBay. The eBay ad claimed the tablet was an octa-core system with a 4GB RAM. Upon received the tablet, sure enough the info section under the settings did really show the device had 8-core CPU with a 4GB RAM. However, the system wasn't very responsive. So, I installed this AIDA64 utility and it revealed the tablet only had a 4-core CPU with 1GB RAM.

Now back to the subject. A friend recently bought this Android 10.0 TV BOX 16GB 256GB 8G 128G D9 TV Box 2.4G/5G WIFI 905 Core 4K 4D bluetooth TV receiver 1280P Fast Set Top Youtube Set and the info on the device really shows the system has 16GB RAM. So, I asked him to install the AIDA64 utility and it finds out the system indeed has 16GB RAM. However, upon looking closer to the /proc/meminfo (see the attached picture or the excerpt below) dumped by the AIDA64 utility, is it safe to conclude that this device only has 1GB RAM, i.e. MemAvailable is 251744 kB with a SwapCached 12944 kB, as shown below?

MemTotal:        16777216 kB
MemFree:         15818188 kB
MemAvailable:      251744 kB
Buffers:              888 kB
Cached:            205980 kB
SwapCached:         12944 kB
Active:            320304 kB
Inactive:          255352 kB
Active(anon):      233500 kB
Inactive(anon):    140876 kB
Active(file):       86804 kB
Inactive(file):    114476 kB
Unevictable:         4208 kB
...

OTOH, is there any other way anyone out here can recommend on how to solidly check the RAM size, besides opening the case (which I believe is completely sealed, i.e. no screws found at the bottom of the case)? Perhaps, install the Armbian on a USB stick to find out more (if the device is supported)?

Oh, well, if it's too good to be true,......

habibie,

> tablet was an octa-core system with a 4GB RAM.
> Upon received the tablet, sure enough the info
> section under the settings did really show the
> device had 8-core CPU with a 4GB RAM. However, the
> system wasn't very responsive. So, I installed
> this
> AIDA64
> utility and it revealed the tablet only had a
> 4-core CPU with 1GB RAM.

Not sure if the utility is up-to-date. The new octa-core are usually BigLittle (4 performance, 4 low energy). Not sure if the tablet was set up to disable the 4 low energy core (wildass guess) ?

FWIW, in the old days, that could also be dual-issue for each core, so they claim 8 core. For example the Pogoplug V3 is not actual dual-core, but dual-issue (run as fast as real dual-core).

> is it safe to conclude that this device
> only has 1GB RAM, i.e. MemAvailable is
> 251744 kB with a SwapCached 12944 kB, as
> shown below?
>

MemTotal:        16777216 kB
> MemFree:         15818188 kB
> MemAvailable:      251744 kB
> Buffers:              888 kB
> Cached:            205980 kB
> SwapCached:         12944 kB
> Active:            320304 kB
> Inactive:          255352 kB
> Active(anon):      233500 kB
> Inactive(anon):    140876 kB
> Active(file):       86804 kB
> Inactive(file):    114476 kB
> Unevictable:         4208 kB
> ...

Not really. I would trust:

Quote

MemTotal: 16 777 216 kB

In Debian

# free -h
               total        used        free      shared  buff/cache   available
Mem:           999Mi       122Mi       354Mi       0.0Ki       522Mi       622Mi
Swap:          8.0Gi        18Mi       8.0Gi

You would add used+free+cache memory and it'll come out to be Total.

> Perhaps, install the Armbian
> on a USB stick to find out more (if the device is
> supported)?

Or find an Android memtest utility that stress the memory to the max.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Finally, I managed to remotely connect the device using the adb utility through a TCP/IP connection and found out the device only has 1GB RAM through a dmesg dump (see line #45 on the attached file) or the excerpt is shown below ([ 0.000000@0] Memory: 609240K/1027072K available (11061K kernel code, 1298K rwdata, 4600K rodata, 1307K init, 3727K bss, 417832K reserved)). I hope anyone here can confirm this before I will tell my friend to file a full refund.

p281:/ # dmesg
[    0.000000@0] Initializing cgroup subsys cpu
[    0.000000@0] Initializing cgroup subsys cpuacct
[    0.000000@0] Linux version 3.14.29-g56dfc295cbe4 (org@nb16) (gcc version 4.9.2 20140904 (prerelease) (crosstool-NG linaro-1.13.1-4.9-2014.09 - Linaro GCC 4.9-2014.09) ) #17 SMP PREEMPT Tue Jun 15 09:19:57 CEST 2021
[    0.000000@0] CPU: AArch64 Processor [410fd034] revision 4
[    0.000000@0] no prop version_code
[    0.000000@0] fdt Reserved memory table:
[    0.000000@0]              linux,di_cma: 0x000000003c800000 - 0x000000003f000000  (40 MiB)
[    0.000000@0] cma: Reserved 40 MiB at 3c800000, total cma pages:10240
[    0.000000@0]             linux,ion-dev: 0x000000003a800000 - 0x000000003c800000  (32 MiB)
[    0.000000@0]               linux,ppmgr: 0x000000003a800000 - 0x000000003a800000  (0 MiB)
[    0.000000@0]        linux,codec_mm_cma: 0x0000000028000000 - 0x0000000033c00000  (188 MiB)
[    0.000000@0] cma: Reserved 188 MiB at 28000000, total cma pages:58368
[    0.000000@0]              linux,picdec: 0x000000003a800000 - 0x000000003a800000  (0 MiB)
[    0.000000@0] Reserved memory: unable to setup CMA region
[    0.000000@0]               linux,demod: 0x000000003a200000 - 0x000000003a800000  (6 MiB)
[    0.000000@0]   linux,codec_mm_reserved: 0x0000000036100000 - 0x000000003a200000  (65 MiB)
[    0.000000@0]           linux,vdin1_cma: 0x0000000034c00000 - 0x0000000036000000  (20 MiB)
[    0.000000@0] cma: Reserved 20 MiB at 34c00000, total cma pages:63488
[    0.000000@0] fdt Reserved memory total:  371 MiB
[    0.000000@0] cma: Reserved 8 MiB at 34400000, total cma pages:65536
[    0.000000@0] On node 0 totalpages: 256768
[    0.000000@0]   Normal zone: 5539 pages used for memmap
[    0.000000@0]   Normal zone: 0 pages reserved
[    0.000000@0]   Normal zone: 256768 pages, LIFO batch:31
[    0.000000@0] psci: Using PSCI v0.1 Function IDs from DT
[    0.000000@0] PERCPU: Embedded 12 pages/cpu @ffffffc0360a8000 s20032 r8192 d20928 u49152
[    0.000000@0] pcpu-alloc: s20032 r8192 d20928 u49152 alloc=12*4096
[    0.000000@0] pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3 
[    0.000000@0] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 251229
[    0.000000@0] Kernel command line: rootfstype=ramfs init=/init console=ttyS0,115200 no_console_suspend earlycon=aml_uart,0xc81004c0 ramoops.pstore_en=1 ramoops.record_size=0x8000 ramoops.console_size=0x4000 androidboot.selinux=permissive logo=osd1,loaded,0x3d800000,576cvbs maxcpus=4 vout=576cvbs,enable hdmimode=1080p60hz cvbsmode=576cvbs hdmitx= cvbsdrv=0 androidboot.firstboot=0 androidboot.fake_rom_size=256 fake_mem_size=16 jtag=apao quiet androidboot.hardware=amlogic androidboot.logo_mode=0 androidboot.serialno=1234567890 mac=6c:01:1b:09:d9:65 androidboot.mac=6c:01:1b:09:d9:65 androidboot.slot_suffix=_a buildvariant=userdebug
[    0.000000@0] logo: osd1
[    0.000000@0] logo: loaded
[    0.000000@0] logo: 0x3d800000
[    0.000000@0] logo: 576cvbs
[    0.000000@0] vout_serve: 576cvbs
[    0.000000@0] vout_serve: enable: 1
[    0.000000@0] logo: get hdmimode: 1080p60hz
[    0.000000@0] logo: get cvbsmode: 576cvbs
[    0.000000@0] tv_vout: cvbs performance line = 0
[    0.000000@0] jtag: jtag select 2
[    0.000000@0] PID hash table entries: 4096 (order: 3, 32768 bytes)
[    0.000000@0] Dentry cache hash table entries: 131072 (order: 8, 1048576 bytes)
[    0.000000@0] Inode-cache hash table entries: 65536 (order: 7, 524288 bytes)
[    0.000000@0] Memory: 609240K/1027072K available (11061K kernel code, 1298K rwdata, 4600K rodata, 1307K init, 3727K bss, 417832K reserved)
[    0.000000@0] Virtual kernel memory layout:
[    0.000000@0]     vmalloc : 0xffffff8000000000 - 0xffffff8040000000   (  1024 MB)
[    0.000000@0]     vmemmap : 0xffffff8040010000 - 0xffffff80415b8000   (    21 MB)
[    0.000000@0]     modules : 0xffffffbffc000000 - 0xffffffc000000000   (    64 MB)
[    0.000000@0]     memory  : 0xffffffc000000000 - 0xffffffc03f000000   (  1008 MB)
[    0.000000@0]       .init : 0xffffffc001fcd000 - 0xffffffc002113e40   (  1308 kB)
[    0.000000@0]       .text : 0xffffffc001080000 - 0xffffffc001fcc7e4   ( 15666 kB)
[    0.000000@0]       .data : 0xffffffc002114000 - 0xffffffc002258838   (  1299 kB)
[    0.000000@0] PM: Registered nosave memory: [mem 0x01080000-0x01fcbfff]

[

Kernel command line ......androidboot.fake_rom_size=256 fake_mem_size=16 ...

interesting parameters...

Well, back in the days with 386/486/Pentium, we have fake cache motherboard and re-marked cpu,...

daviddyer Wrote:
-------------------------------------------------------
> Kernel command line
> ......androidboot.fake_rom_size=256
> fake_mem_size=16 ...
>
> interesting parameters...
>
Indeed an interesting one.

> Kernel command line
> ......androidboot.fake_rom_size=256
> fake_mem_size=16 ...
>
> interesting parameters...

That's the loudest bell ringing :)) I don't know Android but it looks like a custom kernel, so they can do whatever they want to fake it.

Quote

[ 0.000000@0] Memory: 609240K/1027072K available (11061K kernel code, 1298K rwdata, 4600K rodata, 1307K init, 3727K bss, 417832K reserved)

Regardless of whatever real RAM they have on this box, the kernel only knows 1GB. So I'd say return it.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

daviddyer Wrote:
-------------------------------------------------------
> Kernel command line
> ......androidboot.fake_rom_size=256
> fake_mem_size=16 ...
>
> interesting parameters...
>
I sure would like to hack this device to learn something. For instance, can we modify the boot arguments to remove the androidboot.fake_rom_size=256? If so, how?

habibie,

> I sure would like to hack this device to learn
> something. For instance, can we modify the boot
> arguments to remove the
> androidboot.fake_rom_size=256? If so, how?

Looks like this box can be pried opened with a plastic wedge. Open and look for serial header.

Quote

[ 0.000000@0] CPU: AArch64 Processor [410fd034] revision 4

Quote

[ 0.000000@0] Kernel command line: rootfstype=ramfs init=/init console=ttyS0,115200 no_console_suspend earlycon=aml_uart,0xc81004c0 ramoops.pstore_en=1 ramoops.record_size=0x8000 ramoops.console_size=0x4000 androidboot.selinux=permissive logo=osd1,loaded,0x3d800000,576cvbs maxcpus=4 vout=576cvbs,enable hdmimode=1080p60hz cvbsmode=576cvbs hdmitx= cvbsdrv=0 androidboot.firstboot=0 androidboot.fake_rom_size=256 fake_mem_size=16 jtag=apao quiet androidboot.hardware=amlogic androidboot.logo_mode=0 androidboot.serialno=1234567890 mac=6c:01:1b:09:d9:65 androidboot.mac=6c:01:1b:09:d9:65 androidboot.slot_suffix=_a buildvariant=userdebug

This looks like amlogic chip, so most likely running with u-boot as boot loader. If you have serial console you can change bootargs.

=====

If there is no serial header, then perhaps the USB port is used for that purpose.

The kernel boot log does show any typical USB serial TTL chip (e.g. CP2xxx, PL3xxx), but there is this UART driver.

[    0.185770@0] Serial: AMBA PL011 UART driver

So if you have a USB cable that has one connector that fit this box (is this regular USB A connector?), and the other end is USB A connector. Then you can try connecting a Kirkwood/rPi box with this cable.

And then power up both boxes, see if you can find this message in this TV box dmesg:

xxxx serial: ttyAMA0 at

If you see that device is up, use minicom/picocom on the serial console server box.

Note: on the rPI, the PL011 UART is connected to Bluetooth. So if this is the same as rPi, then USB cable won't show anything.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

bodhi Wrote:
-------------------------------------------------------
> habibie,
>
> > I sure would like to hack this device to learn something. For instance, can we modify the boot arguments to remove the androidboot.fake_rom_size=256? If so, how?

>
> Looks like this box can be pried opened with a plastic wedge. Open and look for serial header.
>
>
I hope so. For now, I proposed to my friend as follows: I hope I am able to just install some google chrome plugins, i.e. Speed Dial [FVD] - New Tab Page, 3D, Sync..., etc. This way, I can load google chrome with lots of sites and do a cat /proc/meminfo from a shell (through i.e. Bash Shell X [Root] application) to show how much RAM and if the SWAP file are both used. Video the whole process and have my friend send it to the seller and/or AliExpress as a proof to get a full refund. My friend promised to give this TV Box to me when he gets a full refund. From that on, I hope to start prying the box with a plastic wedge to open it.

>

Quote

[ 0.000000@0] CPU: AArch64 Processor [410fd034] revision 4

>
>

Quote

[ 0.000000@0] Kernel command line: rootfstype=ramfs init=/init console=ttyS0,115200 no_console_suspend earlycon=aml_uart,0xc81004c0 ramoops.pstore_en=1 ramoops.record_size=0x8000 ramoops.console_size=0x4000 androidboot.selinux=permissive logo=osd1,loaded,0x3d800000,576cvbs maxcpus=4 vout=576cvbs,enable hdmimode=1080p60hz cvbsmode=576cvbs hdmitx= cvbsdrv=0 androidboot.firstboot=0 androidboot.fake_rom_size=256 fake_mem_size=16 jtag=apao quiet androidboot.hardware=amlogic androidboot.logo_mode=0 androidboot.serialno=1234567890 mac=6c:01:1b:09:d9:65 androidboot.mac=6c:01:1b:09:d9:65 androidboot.slot_suffix=_a buildvariant=userdebug

>
> This looks like amlogic chip, so most likely running with u-boot as boot loader. If you have serial console you can change bootargs.
>
Yes and it is an AMLogic S905L2 CPU (go to Product Detail and it clearly says the CPU is Amlogic S905L2 up to 1.5 GHz, Quad core).

> =====
>
> If there is no serial header, then perhaps the USB port is used for that purpose.
>
> The kernel boot log does show any typical USB serial TTL chip (e.g. CP2xxx, PL3xxx), but there is this UART driver.
>
>

> [    0.185770@0] Serial: AMBA PL011 UART driver
>

>
> So if you have a USB cable that has one connector that fit this box (is this regular USB A connector?), and the other end is USB A connector. Then you can try connecting a Kirkwood/rPi box with this cable.
>
> And then power up both boxes, see if you can find this message in this TV box dmesg:
>
Right now, I have borrowed the device and have powered it up through its USB1 port connected to one of the USB ports on my computer. The device is also connected to my router and I am able to obtain a shell using ADB to remotely connect with a TCP/IP connection.

>

> xxxx serial: ttyAMA0 at
>

>
> If you see that device is up, use minicom/picocom
> on the serial console server box.
>
> Note: on the rPI, the PL011 UART is connected to
> Bluetooth. So if this is the same as rPi, then USB
> cable won't show anything.
>
The dmesg dump (attached in my OP) does show the following (I am not sure if c11084c0 can be considered as a serial console):

[    0.818615@2] usbhid: USB HID core driver
[    0.819488@2] ashmem: initialized
[    0.819732@2] logger: created 256K log 'log_main'
[    0.819956@2] logger: created 256K log 'log_events'
[    0.820160@2] logger: created 256K log 'log_radio'
[    0.820372@2] logger: created 256K log 'log_system'
[    0.821989@2] meson_uart c81004c0.serial: ==uart0 reg addr = ffffff80000fe4c0
[    0.822023@2] c81004c0.serial: ttyS0 at MMIO 0xc81004c0 (irq = 225, base_baud = 1500000) is a meson_uart
[    0.822039@2] meson_uart c81004c0.serial: ttyS0 use xtal(8M) 24000000 change 0 to 115200
[    0.894386@2] console [ttyS0] enabled
[    0.894901@2] meson_uart c11084c0.serial: ==uart1 reg addr = ffffff800010a4c0
[    0.894934@2] c11084c0.serial: ttyS1 at MMIO 0xc11084c0 (irq = 58, base_baud = 1500000) is a meson_uart
[    0.895798@2] hdmitx_hdcp_init

Well,, pry it open first...

An alternative might be seeing if you can boot an Armbian for Amlogic S9xxx STB image from microSD which will bypass the current firmware and see the true RAM.

I just installed/ran a shell terminal. After doing an su into root, I was able to do a df to dump partitions and a dmesg | more to dump the kernel boot log to reveal the RAM size ([ 0.000000@0] Memory: 609240K/1027072K available (11061K kernel code, 1298K rwdata, 4600K rodata, 1307K init, 3727K bss, 417832K reserved)). I created a video clip for my friend to show these two dumps so he can send them to the seller and/or AliExpress to ask for a full refund. Let's what will happen.

Just dispute with the credit card.

Hello,

I bought the

RUPA Android TV Box 11.0, Smart TV Box 8GB RAM 64GB ROM RK3566 Quad-Core 64-Bit-ARM Cortex-A53 CPU.

Got root via developer-mode/internet-adb and the allready installed /system/xbin/su

Kernel shows 32GB flash
[ 9.825255] mmcblk2: mmc2:0001 032G34 29.1 GiB

but filesystem tells me:

rk356x_box:/sdcard # df -h .
Filesystem Size Used Avail Use% Mounted on
/dev/fuse 49G 577M 48G 2% /storage/emulated

So I put a 2GB file into it:
rk356x_box:/sdcard # dd if=/dev/zero of=bla bs=1M count=2048

Seems this file takes 4GB space:

rk356x_box:/sdcard # df -h .
Filesystem Size Used Avail Use% Mounted on
/dev/fuse 49G 4.5G 44G 10% /storage/emulated

Same goes for ram. Kernel shows 4GB Ram
rk356x_box:/sdcard # dmesg |grep Memo
[ 0.000000] Memory: 3966216K/4175872K available (15230K kernel code, 2104K rwdata, 9112K rodata, 4096K init, 2198K bss, 201464K reserved, 8192K cma-reserved)

But /proc/meminfo fakes 8GB
rk356x_box:/sdcard # cat /proc/meminfo
MemTotal: 8165416 kB
MemFree: 6077872 kB
MemAvailable: 6098120 kB
...

with 6.4 G used after boot
rk356x_box:/sdcard # free -h
total used free shared buffers
Mem: 7.7G 6.4G 1.3G 5.4M 2.0M
-/+ buffers/cache: 6.4G 1.3G
Swap: 3.8G 0 3.8G

Why does someone with programming skills patches the Kernel to fake this values? For what? 30 Euros / box price difference? Google for foxluo@hugsun02

What a shame.

wegegeld Wrote:
-------------------------------------------------------
>
> So I put a 2GB file into it:
>
> Seems this file takes 4GB space:
>
>
> Why does someone with programming skills patches
> the Kernel to fake this values? For what? 30 Euros
> / box price difference? Google for
> foxluo@hugsun02
>
> What a shame.

Just when I think nothing could drop my jaw! 8-(

So thanks form me; you people are awesome for shining the light!

=========
-= Cloud 9 =-

> Why does someone with programming skills patches
> the Kernel to fake this values? For what? 30 Euros
> / box price difference? Google for
> foxluo@hugsun02
>
> What a shame.

The people who did the fake might not have been the same ones who used it.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)