Ran a brute force (random) search for the above registers, and...
SDR104 @ 160MHz

static uint32_t uhs_regs[] = { 0xC0400600, 0xC0400604,/*C0400608, C040060C*/0xC0400610, 0xC0400614, 0xC0400618, 0xC0400624, 0xC0400628, 0xC040061C, 0xC0400620 }; /* register addresses */
static uint32_t sdr50_700D[] = { 0x3, 0x3, 0x4, 0x1D000301, 0x0, 0x201, 0x201, 0x100, 0x4 }; /* SDR50 values from 700D (96MHz) */
static uint32_t sdr_80MHz[] = { 0x3, 0x3, 0x5, 0x1D000401, 0x0, 0x201, 0x201, 0x100, 0x5 }; /* underclocked values: 80MHz = 96*(4+1)/(5+1) */
static uint32_t sdr_120MHz[] = { 0x3, 0x3, 0x3, 0x1D000201, 0x0, 0x201, 0x201, 0x100, 0x3 }; /* overclocked values: 120MHz = 96*(4+1)/(3+1) */
static uint32_t sdr_132MHz[] = { 0x2, 0x2, 0x2, 0x1D000201, 0x0, 0x100, 0x100, 0x100, 0x2 }; /* overclocked values: 132MHz?! (found by brute-forcing) */
static uint32_t sdr_160MHz[] = { 0x2, 0x3, 0x1, 0x1D000001, 0x0, 0x100, 0x100, 0x100, 0x1 }; /* overclocked values: 160MHz = 96*(4+1)/(2?+1) (found by brute-forcing) */
Before and after (5D3 1.1.3):
I'd expect even higher speeds with faster SD cards.
Caveat: SDR104 requires tuning the sampling point (not implemented, not performed by Canon firmware, but doable). That might be required to avoid random errors, speed drops, or higher frequency - if the controller supports it. From 0xC0400610/20, the frequencies are 80, 96, 120, 160 and 240 - the latter is probably too high. Frequency appears tweakable from other registers - if any of you can figure out how to explain the 132MHz preset, that might be helpful for getting other intermediate values.
Download:
sd_uhs.mo (same link), to be loaded on top of crop_rec_4k branch (link removed; one SD card died during the experiment).
Source: module_hginfo_dump.sh sd_uhs.mo (
sd_uhs branch, based on crop_rec_4k)
Supported models: 5D3 1.1.3/1.2.3, 700D 1.1.5, 6D 1.1.6 (edit: 650D 1.0.4, 100D 1.0.1, 70D 1.1.2, EOS M 2.0.2).
Card must be at least 2GB (not checked).
Porting to other DIGIC 5 models should be as easy as finding the stubs.
Brute-forcing: press shutter halfway during the initial tests, until it starts running some more. Press shutter halfway again to stop (infinite loop).
No guarantees of success, no guarantees of safety, no guarantees of data integrity. You have been warned.
Please post logs and benchmarks.