SD investigation on DIGIC 4

Started by theBilalFakhouri, April 15, 2022, 09:35:02 PM

Previous topic - Next topic

0 Members and 1 Guest are viewing this topic.

theBilalFakhouri

Hello,
I was digging into SD overclocking on DIGIC 4. let's start with some info:

-I am still not quite sure which version of DIGIC 4 SD controller is based on, it's one of these:

1- Physical Layer Specification v2.00 (introduced in 2006):
Doesn't support UHS-I mode and SDR modes, recommended rated frequency is 50 MHz (25MB/s), max frequency is 67 MHz.
In part two of layer specification v2.00 they mentioned it supports 1.8 Signaling.
Supports only SD and SDHC cards (up to 32 GB maximum).

1- Physical Layer Specification v3.00 (introduced in 2009):
Here is the first interesting info, SDXC card capacity first introduced in Layer Specification version 3.00, and never mentioned in 2.00 version (both parts) . . and guess what, all DIGIC 4 models with SD interface support SDXC card capacity (source: Canon website).
Version 3.00 is used in all DIGIC 5 models (support UHS-I, SDR modes).


Photo source: Part 1 Physical Layer Specification Ver3.01

-Finding overclocking registers on DIGIC 4:
In DIGIC 5 models there is a function which can toggle between the built in presets (24/48/96 MHz), calling this function works, and toggling between presets shows us which registers are changing.
Fortunately same function is also presented in DIGIC4 models, and from all LOGs I have captured (thanks Walter for help, my tests are done on 550D) + QEMU logs, the only register I could find and made sense is:

0xC0400004 (mentioned way back here and here)

Default value: 0x3000003 = 48 MHz (21MB/s), other values:
0x2000003 = 24 MHz (~11 MB/s)
0x1000003 = 16 MHz (~7 MB/s)

In Latest experiment I forced the register value to 0x4000003 which resulted in invalid benchmarks/clock speed:
Write 97.0 MB/s
Read 4946.8 MB/s
Write 5019.6 MB/s
Read 4970.8 MB/s

I see this as good sign, we might find some valid values using trial and error.
It might be some kind of ratio in this register value, between the left and right numbers . . Well, since I don't have DIGIC 4 camera, I want you (DIGIC 4 users) to test for example 0x3000002 and 0x3000001 . . run card benchmarks after each tweak, any difference?

-How to test:
-First let's make sure if we are overriding 0xC0400004 correctly:
-Install an iso-research build
-Download patch_ap.mo , copy it to ML/modules folder in your SD card
-Load bench.mo and patch_ap.mo modules, you will find "Apply patch" setting showed in "Debug" tab
-From "Apply patch" submenu you can set a value for this register, the default one is 0x3000003
-Change the value to 0x2000003 --> click on "Apply patch" --> run card benchmarks, it should give you 10.7/11.0 w/r speeds, if that happen that mean the override is working, if not, well I need to find another way to override this register --> Let me know

-You can see 0xC0400004 value by enabling "Print 0xC0400004 value" from "Apply patch" submenu, it will print it on screen, you can disable this while running card benchmarks, turn it on to make sure if the new value is applied

-Now once again set value to 0x1000003 --> click on "Apply patch" --> run benchmarks it should give you 7/7.1 w/r speeds (just to make sure once again if the overriding is working)
-Time for trial and error values, firstly please test these values:
0x0000003
0x4000003
0x5000003
0x6000003
0x7000003
0x8000003

Any change in speeds?

Secondly, these ones:

0x3000004
0x3000002
0x3000001
0x3000000
0x2000002

-If the benchmarks showed not realistic numbers (+5000 MB/s) during your tests, perform a camera restart before continuing testing other values.
-Do this test and run benchmarks in Photo mode (none-LiveView)
-Report back, all DIGIC 4 cameras with SD interface can do the test (60D/550D/600D/1100D).
-I am expecting max of 25 MB/s (maybe a little higher) at a certain value.

-Do it on your own risk!
-This test might break your SD card or SD card controller



-TO DO:
DIGIC 4 models doesn't include Voltage switch function in their ROMs, it's required to enable 1.8 Signaling and UHS-I mode, I think this could be implemented via sdSendCommand function.

Skinny

Very interesting... I made some tests with 550D using some adata micro-sd, can't say exact model name, I don't remember, but manufacturer's speed ratings was I think around 60/70mb for r/w. It's the fastest sd card that I have.


for the left 3, this one:
0x3000003
   ^

What I found, if I override it with 0x4000003, then it goes to 0x7000003 after the speed test, when I override with 0x8000003 it goes to 0xb000003.

so I think, 4 is 0b100, and 8 is 0b1000, and it seems that camera doesn't like zeroes and switches these numbers to 0b111 and 0b1011. (7 and b)
0x0000003 also switches to 0x3000003. so 0 to 0b11, as expected.





stock
write 15.5
read 21.9
write 15.7
read 21.9

0x2000003
write 9.1
read 11.0

0x1000003
write 6.4
read 7.4

0x4000003
write 14.4
read 21.9
write 15.9 <-- this is different, I think camera already switched to 7 after first write test
read 21.9
this is where I noticed value changed to 0x7000003!

0x5000003
write 6.4
read 7.4

0x6000003
write 9.1
read 11.0

so 5 and 6 are the same as 1 ans 2, which is logical in binary.

0x7000003
15.7
21.9
15.5
21.9
about the same as stock value but sometimes rec can go to 15.9(!)

0x8000003
15.6
21.9
value changed to 0xb000003

0x9000003
6.4
7.4
(here we go again)

I also tried e,
0xe000003
9.1
11.0
(again similar to just 2)

0xf000003
15.4
21.9
F is all ones, 0x1111, slightly lower rec speed?



and tests for the right digit:

0x3000004 liveview the interface get corrupted with horisontal/diagonal lines, camera not responding
0x3000001 everything goes black (crashes?)
0x3000000 same as 04

0x3000002
15.7
21.7
seems like original, but read speed is always 21.7 and not 21.9

0x7000002
15.4, 15.5
21.7
read speed again 21.7 and not 21.9




So....... I need to do more tests to see if 7000003 is really better than original 3000003, it can go to 15.9 mb/s rec speed and original value can only go to around 15.7, but I am not 100% sure, I need to do more tests with the original. Maybe it's just doing nothing.
And for right digit, only 2 and 3 are working, and 2 has slightly lower read speed.

theBilalFakhouri

Thanks for the tests!

Quote from: Skinny on April 16, 2022, 10:56:15 AM
Very interesting... I made some tests with 550D using some adata micro-sd, can't say exact model name, I don't remember, but manufacturer's speed ratings was I think around 60/70mb for r/w. It's the fastest sd card that I have.

Could you benchmark this card on PC?
15.7 MB/s is a low write speed, on 550D it should be up to ~21MB/s

Also it seems that your benchmarks are done in LiveView ? while I asked to do it in Photo mode none-LiveView . . could you do a one benchmark in camera (stock value, without overriding) outside LiveView?

Quote from: Skinny on April 16, 2022, 10:56:15 AM
Very interesting... I made some tests with 550D using some adata micro-sd, can't say exact model name, I don't remember, but manufacturer's speed ratings was I think around 60/70mb for r/w.
What I found, if I override it with 0x4000003, then it goes to 0x7000003 after the speed test, when I override with 0x8000003 it goes to 0xb000003.

so I think, 4 is 0b100, and 8 is 0b1000, and it seems that camera doesn't like zeroes and switches these numbers to 0b111 and 0b1011. (7 and b)
0x0000003 also switches to 0x3000003. so 0 to 0b11, as expected.

Okay, I will provide another patch_ap version, to force the selected value (for the left digit), hopefully the value wouldn't change during the tests.



The right digit (0x3000003) could be related to LiveView, what about overriding it to:
                                     ^

Quote from: Skinny on April 16, 2022, 10:56:15 AM
0x3000004 liveview get corrupted with horisontal/diagonal lines, camera not responding
0x3000001 everything goes black (crashes?)

But outside LiveView, does it make any difference?


Skinny

Oh, I did all the tests in photo mode without liveview, with mirror closed. I mean the ML interface get corrupted. Don't know why I wrote liveview, maybe my mind was somewhere else.. sorry :)

What software do you recommend to test a card on PC?


About speed - for example, when I record in raw, it stays at 20mb/s for about 2/3 of the time, but sometimes it drops to 10 or even 5-7, so the common speed is always lower than 20. Maybe same thing happens during the test..
The speed fluctuates all the time with all SD cards, even if I lower the resolution sometimes I can record for example only ~240 frames, but sometimes ~360. And it is not consistent every time.
Which is very strange because 5D2 for example can do almost exact amount of frames over and over again +/- one frame.

Quote from: theBilalFakhouri on April 16, 2022, 11:38:39 AM
Okay, I will provide another patch_ap version, to force the selected value (for the left digit), hopefully the value wouldn't change during the tests.
It seems that it changes the value only after one recording. I tried to record raw video with "print value" active, and it holds it's value during recording. only switching to new value after recording stops. But the speed is always worse in these three modes (0, 4 and 8 ). Although I need to test it more, now battery is charging. And other values stays as is.


p.s. before battery discharged, I tried to record something in raw with 0x7000003, and it seems like it is slightly better, again. I am not sure, because the numbers are different every time, but for example I tried to do about 10 recordings with default value and I could record 60-80 frames every time, and 85 frames ONCE. But with 0x7000003, I've got 85 frames 4 times, but sometimes it is still only 62 or so. So it seems slightly faster, but I am not sure.

Maybe I should try 0x700000X with X something without zero in second lsb, because it doesn't work when I tried 0 and 4 which is 0b000 and 0b100, everything goes black with 1 which is 0b01, but 2 works (0b10) and 3 too.
So I expect black screen at 5, working at 6 and 7, and corrupted display at 8. and then again black screen with 9 and so on.

theBilalFakhouri

Quote from: Skinny on April 16, 2022, 12:46:02 PM
Oh, I did all the tests in photo mode without liveview, with mirror closed. I mean the ML interface get corrupted. Don't know why I wrote liveview, maybe my mind was somewhere else.. sorry :)

Ah, okay, no problem :)
Let's skip the right digit then . .

Quote from: Skinny on April 16, 2022, 12:46:02 PM
What software do you recommend to test a card on PC?

CrystalDiskMark
I recommend to run benchmarks on PC before continuing making more tests on camera, if the SD card was limited to 22 MB/s we won't see a difference in camera.

Quote from: Skinny on April 16, 2022, 12:46:02 PM
About speed - for example, when I record in raw, it stays at 20mb/s for about 2/3 of the time, but sometimes it drops to 10 or even 5-7, so the common speed is always lower than 20. Maybe same thing happens during the test..
The speed fluctuates all the time with all SD cards, even if I lower the resolution sometimes I can record for example only ~240 frames, but sometimes ~360. And it is not consistent every time.

Have you tried formatting the SD card in camera, same result? speeds drop happens too on my 700D, formatting SD card in camera solves the problem.

Quote from: Skinny on April 16, 2022, 12:46:02 PM
It seems that it changes the value only after one recording. I tried to record raw video with "print value" active, and it holds it's value during recording. only switching to new value after recording stops. But the speed is always worse in these three modes (0, 4 and 8 ). Although I need to test it more, now battery is charging. And other values stays as is.

Let's skip RAW video recording tests for now . . since a lot of things would happen in LiveView and while RAW video recording, let's try to get 25 MB/s in photo mode first :D



The new patch_ap.mo is provided in this build:
magiclantern-iso-research.2019Dec21.550D109_0xC0400004_override.zip

Hardcoded addresses for 550D, won't work on other DIGIC 4 camera.

With this version you will able be to override the left digit:
0x3000003
   ^
The value shouldn't change during your tests, first make sure the override is working:

-Set "Enter a value" to 2 --> click on "Apply patch" --> run benchmark, it should give 24 MHz mode write/read speeds (~11MB/s)
-Set "Enter a value" to back to 3 --> click on "Apply patch" --> run benchmark, it should give 48 MHz mode write/read speeds (~21MB/s)

Test other provided values: 0,4,5,6,7,8,9.
Report back.

Don't forget:
Quote from: theBilalFakhouri on April 15, 2022, 09:35:02 PM
-If the benchmarks showed not realistic numbers (+5000 MB/s) during your tests, perform a camera restart before continuing testing other values.

Skinny

I've added some info to the previous post..

Quotep.s. before battery discharged, I tried to record something in raw with 0x7000003, and it seems like it is slightly better, again. I am not sure, because the numbers are different every time, but for example I tried to do about 10 recordings with default value and I could record 60-80 frames every time, and 85 frames ONCE. But with 0x7000003, I've got 85 frames 4 times, but sometimes it is still only 62 or so. So it seems slightly faster, but I am not sure.

Maybe I should try 0x700000X with X something without zero in second lsb, because it doesn't work when I tried 0 and 4 which is 0b000 and 0b100, everything goes black with 1 which is 0b01, but 2 works (0b10) and 3 too.
So I expect black screen at 5, working at 6 and 7, and corrupted display at 8. and then again black screen with 9 and so on.


ok let's skip raw recording for now...

I tried formatting the card in camera, and fat32 and exfat, with different cluster sizes and everything back in the day... doesn't change anything really. But I'll do it again because why not :)

And on my camera it never showed any unrealistic values. And Only value with 0, 4 and 8 changes to something else (to 3 or 7 or b), and as I can see in raw, only after the first recording. so I expect the same behavior with new module, although we'll see.. I'll report soon.

Walter Schulz

Quote from: theBilalFakhouri on April 16, 2022, 01:06:13 PM

-Set "Enter a value" to 2 --> click on "Apply patch" --> run benchmark, it should give 24 MHz mode write/read speeds (~11MB/s)

Write: 10.4
Read: 11.0

Quote from: theBilalFakhouri on April 16, 2022, 01:06:13 PM
-Set "Enter a value" to back to 3 --> click on "Apply patch" --> run benchmark, it should give 48 MHz mode write/read speeds (~21MB/s)

Write: 20.1
Read: 21.9

Quote from: theBilalFakhouri on April 16, 2022, 01:06:13 PM
Test other provided values: 0,4,5,6,7,8,9.

0:
Write: 95.0
Read: 4995.1
Write: 5019.6
Read: 4995.1
No clean shutdown. Modules loading after 2nd restart only.

4:
Pretty much as 0

5:
Write: 7.0
Read: 7.4
ML screen not reacting anymore. Troubles with trashcan button. Had to switch to Canon Q menu to access ML menu again.
Shutdown and battery plug just to be sure to kill gremlins.


6:
Write: 10.4
Read: 11.0

7:
Like 3
Write/read: 20, 21

8:
Weird numbers again like 0 and 4.

9:
Works like 5

Card tested on PC, 650D and EOS M.
EOS M stable with 192 MHz and write speeds in benchmark just above 75 MByte/s
650D with 240 MHz above 92 MByte/s in benchmark.



Danne


Skinny

@theBilalFakhouri well.... seems like my card is slow. In the card reader crystal disk mark shows the same numbers as in the camera, 21,9 for read maximum.

I found it on the internet, it is adata premier pro with green line. It is the same as this one:
https://www.memoryc.com/26902-32gb-adata-premier-pro-microsdhc-cl10-uhs-i-u3-v30-a2-memory-card-with-sd-adapter.html

but older, it is A1 not A2 class and SDHC and not XC, but UHS-I U3 and V30 too, so it should be at least 30mb/s or 50 if UHS? anyway it was rated as more, 60 or so. I don't think my card readers (they are old) can operate at UHS-I so maybe it's just card readers limits.

I think if the camera uses 48 mhz, and it gives 21,9 mb/s, then maybe the USB card readers also use 48 mhz? could be, because I know cheap USB devices usually get their clocks from usb, and usb is 12 mhz, so 48 is just a multiple of 12, they can easily get it with PLL. And numbers are the same then.


Ok so I did some tests again with new patch_ap.




After formatting the card in camera, stock settings:
(I did test three times for good measure)
first:
write 16.7 <--- strange
read 21.9
write 15.9
read 21.9

second:
write 15.7
read 21.9
write 15.9
read 21.9

third:
15.7
21.9
15.9
21.9

then everything was similar to what Walter Schulz measured.
0:
93.2
4923.0
4876.1
4970.0

2:
9.1
11.0
9.1
11.0

3: (just to check again)
15.7
21.9
15.9
21.9

4:
93.7
4923.0
4807.5
4970.8

5:
6.4
7.4
6.4
7.4
I didn't notice any strange camera behavior with 5..

6:
9.1
11.0
9.1
11.0

7:
15.9
21.9
15.7
21.9

8: Value goes to C,
93.3
4970.0
4853.0
4923.0

9:
6.4
7.4
6.4
7.4




So the only difference this time was in 4 and 0 and 8 behavior. Now I can get unrealistic numbers too :P :D
Are we trying to activate 50 mHz or UHS-I? what if 50 is just not possible in hardware?

Walter Schulz

You will never see an UHS-I card with V60 or higher. By definition the highest label an UHS-I can get is V30. No matter how good it actually is.

Skinny

Ah, I see, good to know. Then maybe the card is somewhat capable but only in UHS-I, because 15/16 mb write is sloooow... Thank you :)

theBilalFakhouri

Thanks Walter, Skinny for the tests, I will prepare another test, we maybe need to tweak 0xC0400008 too.  Also mentioned way back here .

On 550D 0xC0400008 = 0x0363110F (when no write/read operation is happening ?)
                                    0x1363110F (writing/reading happening ?)

Above link describe:

0x1363110F
   ^
as SD/MMC Clock 2

It's always set to 0x10000000 in the function which can toggle between built in presets (550D.109 = ff3f3d30), it might be related to clock speed.

Walter Schulz

Quote from: Skinny on April 16, 2022, 04:27:29 PM
Then maybe the card is somewhat capable but only in UHS-I, because 15/16 mb write is sloooow...

Sorry, but I'm unable to decypher your message.
Do you have a card labeled with V30 but not showing write rates above 30 MByte/s using a cardreader?
Maybe your cardreader is just be able to do SDS50/DDR50 (bandwidth around 25 MByte/s).

theBilalFakhouri

Quote from: Skinny on April 16, 2022, 04:15:01 PM
Are we trying to activate 50 mHz or UHS-I? what if 50 is just not possible in hardware?

I am trying to achieve *50 MHz* (25MB/s write speed). It should be possible according to SD Association :P .

UHS-I mode requires 1.8 Signaling (voltage switch), not presented in DIGIC 4 ROMs, this has to be implemented in a ML function (we are not doing this right now).

theBilalFakhouri

From your tests, apparently 0xC0400004 has four values which can give an effect (0,1,2,3) then it will repeat itself.

Skinny

Quote from: Walter Schulz on April 16, 2022, 04:38:04 PM
Sorry, but I'm unable to decypher your message.
Do you have a card labeled with V30 but not showing write rates above 30 MByte/s using a cardreader?
exactly, I mentioned it in previous post. it can only go to 21,9 read speed in camera and in cardreaders too. The same number.
I don't know what SDS50/DDR50 is, but I think cheap card readers just use 48 MHz..

Well guys I'm sorry if my messages are hard to decypher sometimes, I don't know why I write so. English is not my first language, but even when I speak in my native language people sometimes can't understand what I mean :) I'll try to express my thoughts more clearly.

Quote from: theBilalFakhouri on April 16, 2022, 04:41:49 PM
I am trying to achieve *50 MHz* (25MB/s write speed). It should be possible according to SD Association :P .
is 50 available on other cameras? you mentioned:
QuoteIn DIGIC 5 models there is a function which can toggle between the built in presets (24/48/96 MHz)
but 50? I mean, it is not multiple of 12... maybe 50 can not be generated from existing clocks. who knows..

Quote from: theBilalFakhouri on April 16, 2022, 04:41:49 PM
UHS-I mode requires 1.8 Signaling (voltage switch), not presented in DIGIC 4 ROMs, this has to be implemented in a ML function (we are not doing this right now).
Is this required for SD card itself? I can make an adapter in hardware if it will be too hard to do in ML. Just for tests.

theBilalFakhouri

New test build for 550D:
magiclantern-iso-research.2019Dec21.550D109_clocks_override.zip

-How to test:
-Set the camera to Photo mode, none-LiveView
-From "Apply patch" submenu, turn on "Print values", write down 0xC0400008 value, take a picture, write down 0xC0400008 value again
-From "Apply patch" submenu, keep 0xC0400004 as it is, change 0xC0400008 to 2 --> click on "Apply patch", write down 0xC0400008 value
-Turn off "Print values", run benchmarks
-Turn on "Print values", write down 0xC0400008 value
-Share the results

-Will share further steps depending on the results.
-Keep in mind, these tests might be risky.

Walter Schulz

Quote from: Skinny on April 16, 2022, 05:26:38 PM
exactly, I mentioned it in previous post. it can only go to 21,9 read speed in camera and in cardreaders too. The same number.
I don't know what SDS50/DDR50 is, but I think cheap card readers just use 48 MHz..

Get a decent cardreader. See cardreader test list at https://www.cameramemoryspeed.com for starters.
About SDR (sorry about the typo) and DDR: https://hjreggel.net/cardspeed/cs_sdxc.html

theBilalFakhouri

Quote from: Skinny on April 16, 2022, 05:26:38 PM
is 50 available on other cameras? you mentioned:
...
but 50? I mean, it is not multiple of 12... maybe 50 can not be generated from existing clocks. who knows..

Yes, it's available on my 700D (even if it not mentioned in ROMs, there is preset which result in 25 MB/s).
Further more, even on 5D3 without overclocking there is a built in preset which result in 25MB/s write speed (that's outside UHS-I mode, without 1.8 Signaling too).

Also, 550D have 16/24/48 MHz built in presets and 16 MHz isn't multiple of 12 MHz.

Canon has configured clock speeds in a way, I am trying to understand Canon's way on DIGIC 4. ;)

Skinny

Quote from: theBilalFakhouri on April 16, 2022, 05:29:44 PM
New test build for 550D:
ok here we go:
0xC0400008 value initially: 363110f
after taking a picture: 1363110f very briefly, and it immediately goes to 363110f

Quote from: theBilalFakhouri on April 16, 2022, 05:29:44 PM
-From "Apply patch" submenu, keep 0xC0400004 as it is, change 0xC0400008 to 2 --> click on "Apply patch", write down 0xC0400008 value
the value is still 363110f,
benchmark shows the same default speeds,
and the value is still 363110f after that.


Quote from: theBilalFakhouri on April 16, 2022, 05:40:15 PM
Yes, it's available on my 700D (even if it not mentioned in ROMs, there is preset which result in 25 MB/s).
Further more, even on 5D3 without overclocking there is a built in preset which result in 25MB/s write speed (that's outside UHS-I mode, without 1.8 Signaling too).

Also, 550D have 16/24/48 MHz built in presets and 16 MHz isn't multiple of 12 MHz.

Canon has configured clock speeds in a way, I am trying to understand Canon's way on DIGIC 4. ;)
ah, ok, I see now :) I thought it was just simple divider or something..

Walter Schulz

Value 363110f unchanged for all tests.
Benchmark numbers normal:
Write: 20.0
Read: 21.9

Skinny

Quote from: Walter Schulz on April 16, 2022, 05:36:36 PM
Get a decent cardreader. See cardreader test list at https://www.cameramemoryspeed.com for starters.
About SDR (sorry about the typo) and DDR: https://hjreggel.net/cardspeed/cs_sdxc.html
Sure, it is good to have a decent cardreader. Maybe when times will become better.. For now, I already have 3 indecent cardreaders :) So I guess I'll stick with them for now.. Thanks for links.

theBilalFakhouri

Okay, as expected . .

0xC0400008 = 0x1363110F
                          ^

This digit is being changed by two more function (WriteBlk/DMA), will override it from there too. It might make sense . . on DIGIC 5 cameras in every write/read operation overclocking registers are being updated.

Could you try enabling "Print values" while running card benchmarks, 0xC0400008 should be 0x1363110F all/most of time, can you confirm this?

Skinny

Quote from: theBilalFakhouri on April 16, 2022, 05:57:54 PM
Could you try enabling "Print values" while running card benchmarks, 0xC0400008 should be 0x1363110F all/most of time, can you confirm this?
confirmed! stays 1363110f

it switches back to 363110f between the writes/reads, and it's back to 363110f after the test is finished.

Walter Schulz

Same. Short switch to 363110f after changing modes.