Overclockmatic_RK3288 v1.0.6

[Gormar]

First post updated with my findings about memory overvoltage. I recently noticed that regulator.1 responsible for DDR voltage is soft locked to 1200 mV as a maximum output voltage (of course for ACT8846 and DDR3 memory configuration this is equivalent to 1.5V). This maximum output voltage value for regulator.1 (DCDC1) is written into DTB file (part of resource.img) just like rest of parameters but I'm affraid to modify that because many people doesn't understand why when they set 1200mV they get 1500mV on the DDR3 memory and setting 1500mV will get them 1825 mV. But I will think about it.

Note:
Nevermind what voltage I set in DTB for memory I had always measured 1.48V on DDR3 memory power supply capacitor.
That's why I have done some more investigating and found out that DDR voltage is soft locked in regulator.1 at 1.2V (1.5V for DDR3) ("cat /sys/class/regulator/regulator.1/max_microvolts").
This voltage is generated by ACT8846QM IC on output caled "DCDC1" (OUT1) connected by i2S bus with RK3288. To user it is presented by kernel as regulator number 1.

Warning.
Voltage set by DVFS mechanism for memory which is described in DTB as DDR operation points is also used for LOGIC_VDD (arm_logic) which is part of RK3288 (mainly IO interfaces). It is so probably because of DDR3 IO voltage which should be tide out to DDR3 main voltage with some tolerance (+/-0.3V). When you choose 1.45V for DDR3 it wouldn't have any effect on memory chip but will change voltage to RK3288 logic power domain (regulator number 3). Besides generating unnecessary heat it might as well be dangerous because it is above Absolute Maximum Rating for VDD_LOGIC as stated in RK3288 datasheet.

This should be announced to any RK3288 firmware modders especially those who also OC these boxes.

[Pihkal]

Hi,

I'd like to run this script on a cheap Q8 box but would like to know something first.
I don't have the original firmware image for my box so what if it goes horribly wrong, how can I recover from it?
I did manage to obtain the kernel.img and resource.img through adb by dumping the partitions with dd.
Will I be able to flash this back to my box if it fails to boot and if so, how?
Batchtool only allows flashing of a complete firmware image and Androidtool appears to be using different offsets then the ones I've seen.

One option would be to boot android from an sdcard and test the script on the installation on the card, if that's possible.
That way I would also be able to test if the firmware images on the net that are supposedly for my box work or not without any risk, assuming I don't need to flash another bootloader first.

I just don't want to brick my box.

Thank you.

[Gormar]

@Pihkal.
Yes, you will be able to flash only resource.img and kernel.img with Android Tool (just "tick" only relevant rows) even if you just copied them from MTD with dd command. Of course you will need to use correct partitions positions defined in your device firmware.

You can get parameter file from your device with this command:
dd if=/dev/block/mmcblk0p1 of=/somewhere/parameter.txt bs=512 count=3

For the first 7 or 8 partitions I haven't seen any different positions than:

0x00002000 uboot
0x00004000 misc
0x00006000 resource
0x0000E000 kernel
0x00016000 boot
0x00026000 recovery
0x00036000 backup

which corresponds to this parameter file: parameter.txt

[Pihkal]

Hi Gomar,

thanks for clearing that out for me.
Really useful info, appreciate it!
One more question: the second kernel lock is not found and the script appears to be aborting.

Found first kernel lock at offset: 0x2f4105
Second kernel lock not found!

Any idea why this is and more importantly, how to fix this?
Don't know if it matters but the installed kernel by default clocks to 1800 Mhz, maybe your looking for 1600 Mhz or something?

Thanks again!

Regards


EDIT:

Just wanted to confirm that flashing the resource.img file obtained with dd indeed recovers the box from a soft-brick.
Not that I doubted you in any way, if I would, I wouldn't have tried OCing the RAM and GPU. (and soft-bricking my box).

[Gormar]

Hi Gomar,
One more question: the second kernel lock is not found and the script appears to be aborting.

Found first kernel lock at offset: 0x2f4105
Second kernel lock not found!

Any idea why this is and more importantly, how to fix this?
Don't know if it matters but the installed kernel by default clocks to 1800 Mhz, maybe your looking for 1600 Mhz or something?

All known to me non OC'ed kernels for RK3288 has been crippled at low level not to set CPU core frequency above 1608MHz even if on the outside DVFS pretends that it is some or even much more. You can prepare resource.img in that way that your box will display 2.24GHz for CPU. You will be the best overclocker in your town . But without changing kernel's maximum CPU frequency value it will be just for show.

As to why only one kernel lock is found.
I realy do not know why there are two places with this important max CPU frequency value in the first place. That's why I do not know why there are kernels which has only one CPU lock value.

I made newer overclockmatic_RK3288 version (1.0.7_LP) mostly for Lollipop because it require PIE and incorporated there possibility to overwrite only one lock. It will work also under KitKat and you should use it.

If I may recommend you should first change frequency values for GPU, memory and CPU in resource.img then try them after reboot. Only if they work unlock kernel.

EDIT:
Just wanted to confirm that flashing the resource.img file obtained with dd indeed recovers the box from a soft-brick.
Not that I doubted you in any way, if I would, I wouldn't have tried OCing the RAM and GPU. (and soft-bricking my box).

I'm almost certain that I flashed kernel.img which was grabbed from internal eMMC MTD at least once but mostly I use images from firmware distributions and eventually changed by me or my overclockmatic_RK3288 software.

You can compress those files in zip format and place them somewhere. I can download them and check what is inside. But in general there shouldn't be a problem if you flash them with Android_Tool into correct partitions addresses.

[Pihkal]

Hi Gomar,

TricksterMOD is reporting 1800 Mhz, CoolTool also appears to be showing 1800 Mhz too but since I have no way of actually measuring it I'm gonna assume your right.
I've tried to download v1.0.7 of your tool but the link isn't working, I just get a blank tab and no download, can you please re-upload it?

I've already tried RAM and GPU with v1.0.6 of your tool, GPU clocks to 625 Mhz without a problem, the RAM doesn't like to be overclocked, 800Mhz and 600Mhz but give horizontal stripes and no boot.
Haven't tested lower frequencies yet.

I've just completed my mod of my box today, no heatsink yet as the damn box is to shallow for all my heatsinks but it does has a 8cm 12V fan running at 5V, 49 °C max during Antutu so I'd say it's safe to overclock the CPU.

Regarding the flashing of images dumped with dd, it works like a charm, just like you said.
Can you please give me a copy of your new tool so I can have some fun with it?

Thanks again!

Regards

[Gormar]

TricksterMOD is reporting 1800 Mhz, CoolTool also appears to be showing 1800 Mhz too but since I have no way of actually measuring it I'm gonna assume your right.

System may display anything especially when programmer want this .
To check RK3288 CPU real speed I use pi_fftcs_LP.elf file. This program calculates constan PI with AMG method and during this operation it displays each iteration speed in seconds. What I found is that those iteration times are very often (more than 95%) dependant only from CPU clock (of course if memory has any decent speed 400MHz+).

I've got those result on my OC'ed RK3288:

root@hammerhead:/mnt/external_sd/Download # ./pi_fftcs_LP.elf 100000
Calculation of PI using FFT and AGM, ver. LG1.1.2-MP1.5.2a.memsave
initializing...
nfft= 32768
radix= 10000
error_margin= 0.000620
calculating 131072 digits of PI...
AGM iteration
precision= 48:   0.89 sec
precision= 80:   0.89 sec
precision= 176:   0.89 sec
precision= 352:   0.90 sec
^C

After running this app for a few iteration you can stop its execution by pressing "CTRL" + "C" keys simultanously.

Regarding the flashing of images dumped with dd, it works like a charm, just like you said.

I'm glad to hear that. I wouldn't feel good if with my help you had broken your box .

[Pihkal]

I'm glad to hear that. I wouldn't feel good if with my help you had broken your box .

If I'd bricked my box it would have been my own fault as I would have bricked it and not you.
I can't seem to be able to download your benchmark tool either.

Don't want to nag but can you please provide me the 1.0.7 version of your OC tool and the benchmark tool?
Pretty pretty please?

Thanks again!

[Gormar]

Don't want to nag but can you please provide me the 1.0.7 version of your OC tool and the benchmark tool?

Yesterday I forgot to mention that I reuploaded those files. But if FreakTab attachments does work there are Google Drive links:
1. pi_fftem_LP.zip
2. overclockmatick_RK3288_1.0.7_LP.zip

[Pihkal]

Thanks Gomar!
Sadly I appear to be out of luck.
Version 1.0.7 complains it can't find the pvtm point, I let it patch anyway but on reboot nothing, just a black screen.
Also tried flashing D33's kernel but this also doesn't boot.

One last question, you warned about misinterpreting the ddr voltage regulator and using de io regulator.
Is this still true?
Changing the ddr voltage created a massive amount of extra heat on my box.

Thanks for all your hard work and your great support.

Regards

[Gormar]

Sadly I appear to be out of luck.
Version 1.0.7 complains it can't find the pvtm point, I let it patch anyway but on reboot nothing, just a black screen.

Upload this kernel somewhere and I will check it.

One last question, you warned about misinterpreting the ddr voltage regulator and using de io regulator.
Is this still true?
Changing the ddr voltage created a massive amount of extra heat on my box.

Yes it should still be true.
Of course I think that depends on kernel code because I didn't find any configuration possibility to explain why regulator #3 voltage is tied to regulator #1 on KR3288 platform.

You can check regulator.1(vdd_logic = arm_logic) voltage with below command:
cat /sys/class/regulator/regulator.1/microvolts

[Pihkal]

Hi Gomar.

Upload this kernel somewhere and I will check it.

Really?
Awesome, thank you so much!

https://drive.google.com/file/d/0B8nqmZjf_RUIbGpHeHVjdlZXRUE/view?usp=sharing

Yes it should still be true.
Of course I think that depends on kernel code because I didn't find any configuration possibility to explain why regulator #3 voltage is tied to regulator #1 on KR3288 platform.

Too bad, this Q8 box uses DDR2 RAM and I obviously failed to notice this when I ordered it.
It runs a "whopping" 400 Mhz (x 2), I can overclock it to 456 Mhz, which would be an increase in bandtwith of around 1GB/s, but I can't get it to run stable.
Changing the DDR voltage in the config file of your tool doesn't help stability, it just increases the heatproduction of the SoC massively.

I've been reading up on it and to my understanding there's a resistor that tricks the power management chip into thinking it's supplying a certain voltage to the RAM whilst it's actually supplying more voltage.
I'm now thinking of identifying and modifying this resistor, shouldn't be that hard to do.

Anyway, thanks once again for your help.

Regards

[Gormar]

Too bad, this Q8 box uses DDR2 RAM and I obviously failed to notice this when I ordered it.
It runs a "whopping" 400 Mhz (x 2), I can overclock it to 456 Mhz, which would be an increase in bandtwith of around 1GB/s, but I can't get it to run stable.
Changing the DDR voltage in the config file of your tool doesn't help stability, it just increases the heatproduction of the SoC massively.

It's a shame. In my test it seems that the most optimal memory frequency for RK3288 SoC is something about 600MHz (1200MHz DDR).

I've been reading up on it and to my understanding there's a resistor that tricks the power management chip into thinking it's supplying a certain voltage to the RAM whilst it's actually supplying more voltage.
I'm now thinking of identifying and modifying this resistor, shouldn't be that hard to do.

It might be possible but very dangerous. It seems that you will need to change just one resistor connected to the ground(R fb2). There is also capacitor (C ff) which capacity is dependant from two resistor in voltage divider (R fb1 and R fb2) on DCDC1 ACT8846 reference input but it only depends from R fb1.
You can get some idea what to do and where to search after reading FireFly RK3288 developer board (on page 4 look for R196, R197) and ACT8846 documentation (page 33-34).

Your kernel has only one hexadecimal value (0022D85F at 0x2f4105) for 1608MHz CPU frequency limit lock. I can not find any clue where the second one can be or even if it is there. I've got only one kernel with one lock which can be unlocked succesfully.
But I think in your case there might be a problem with too high CPU OC. Maybe try DVFS settings with CPU max frequency as 1800MHz or even 1716MHz at max.

[Pihkal]

Hi Gomar,

But I think in your case there might be a problem with too high CPU OC. Maybe try DVFS settings with CPU max frequency as 1800MHz or even 1716MHz at max.

Turns out you're right again, it boots @ 1800 Mhz.

I've also upgraded the PSU, from 5V 2A to 5V 3A, there's plenty of power for the thing now and I've finally modded a pretty big (in comparison to the SoC) heatsink so it fits in the box and installed it on the SoC with thermal compound and superglue, temps now never exceed 40°C whilst under full CPU and GPU load on stock speeds..

Stock Antutu 6 score: 41204

Tests:

CPU GPU RAM Result
1800 625 400 Boots, Antutu 6 score: 44844 (CPU voltage @ 1350 mV) -> Only stable OC I can achieve.
1800 625 456 Boots, Antutu crashes to launcher during RAM test
1900 625 400 Boots, Antutu crashes to launcher during RAM test (CPU voltage @ 1400 mV)

In the tests where Antutu crashes the rest of the apps appear to run normal.
For example, I use Fpse (PSX emulator) to load down the box and it runs just fine, even with RAM @ 456 Mhz and CPU @ 1900 Mhz

I've got only one kernel with one lock which can be unlocked succesfully.

Make that 2 as it has also unlocked mine.

You can get some idea what to do and where to search after reading FireFly RK3288 developer board (on page 4 look for R196, R197) and ACT8846 documentation (page 33-34).

Thanks, very interesting datasheet, haven't yet decided if I'm going through with it.

With all that being said, your program was never the issue, my crappy box and ignorance was the problem.

Thank you very much for all the info and help.

Regards

[tiesenhausen]

If I change in sys/bus/cpu/devices/cpu0/cpufreq the Parameter cpu_info_freq =1608000 to f.e. 1800000, it may take any effect?