hilink: matched 12-ohm rework restores immediate 480 Mbit/s; acceptance pending

devices/ssc338q_fpv_openipc-urllc-aio/USB-HS-INVESTIGATION.md

@@ -1,4 +1,4 @@
-# RTL8812EU enumerating at 12 Mbit/s on `Sstar-ehci-1` — investigation record
+# RTL8812EU enumerating at 12 Mbit/s on `Sstar-ehci-1` — investigation record (root cause found; acceptance pending)
 
 Device: `ssc338q_fpv_openipc-urllc-aio` (HiLink URLLC, SSC338Q / infinity6e).
 Radio: Realtek RTL8812EU, USB ID `0bda:a81a`, directly attached to the SSC338Q
@@ -6,8 +6,9 @@ USB 2.0 EHCI port (`Sstar-ehci-1`).
 
 ## Fixed observations (treated as inputs, not re-derived here)
 
-- The radio repeatedly enumerates at **12 Mbit/s (full speed)** after USB
-  unbind/rebind cycles.
+- The radio repeatedly enumerated at **12 Mbit/s (full speed)** after USB
+  unbind/rebind cycles (pre-rework symptom; HS since restored — see the
+  series-damping experiment below).
 - The active device tree reports `dpdm_swap = <0>` and
   `power-enable-pad = <PAD_UNKNOWN>` (0xffff).
 - **Verified on hardware (2026-10, Piotr):** the full `soc:Sstar-ehci-1`
@@ -30,10 +31,15 @@ USB 2.0 EHCI port (`Sstar-ehci-1`).
   RTL8812EU-module D+ or D-`; each component measured about 100 ohm across
   its own endpoints with all power removed. These are **two separate
   per-line series resistors**, not one 100-ohm differential termination.
+- **Verified on hardware (2026-10, Piotr):** both previously verified 100
+  ohm per-line resistors were **replaced with matched 12 ohm parts**;
+  immediately afterward `/sys/bus/usb/devices/1-1/speed` returned **`480`**.
+  This is direct A/B evidence that the original 100 ohm-per-line network
+  **blocked High-Speed negotiation** on this unit.
 - RF/FEC configuration is not a USB fix and is out of scope for this issue.
 - This document contains no credentials, pairing or RF-access material.
 
-## Conclusion (current fault-domain classification)
+## Conclusion (root cause found; acceptance pending)
 
 Combined with the exact vendor EHCI/UTMI source audit below (which found no
 HiLink-specific software discrepancy in anything this overlay or the shipped
@@ -46,35 +52,38 @@ remaining software-adjacent candidates that are cheap to test:
   input-supply-capacity tuning (done on hardware, no change), and
   wrong-voltage-at-module-ingress (measured 5.13 V at the input, within the
   4.75–5.25 V range).
-- **Remaining fault domain:** the USB **high-speed physical path / signal
-  integrity / rework** — D+/D− routing and symmetry across the carrier,
-  harness/pads and intervening components, controlled impedance and stubs,
-  series/ESD/common-mode components on the pair, connector and solder
-  integrity, or PHY-side / device-side silicon-level hardware — exactly the
-  boundary detailed in the hardware section below. The supply findings above
-  rule out only those two specific points: power **quality** downstream of
-  the measured input — supply noise/ripple and the carrier's local regulator
-  output — remains untested and stays inside this open fault domain.
+- **Fault domain where the cause was found:** the USB **high-speed physical
+  path / signal integrity / rework** — D+/D− routing and symmetry across
+  the carrier, harness/pads and intervening components, controlled impedance
+  and stubs, series/ESD/common-mode components on the pair, connector and
+  solder integrity, or PHY-side / device-side silicon-level hardware —
+  exactly the boundary detailed in the hardware section below. Two supply
+  points were ruled out specifically (capacity tuning, ingress voltage);
+  power **quality** downstream of the measured input — supply noise/ripple
+  and the carrier's local regulator output — remains untested and stays
+  inside the open (now margin-focused) fault domain.
 
-Two caveats stay attached to this classification: it does not prove that
-every conceivable undocumented analog register in the vendor PHY block is
-irrelevant (the audited paths cover what the shipped source programs, not
-the full register space), and it does **not** claim any high-speed success —
-the fault is unresolved; only its domain is now sharply bounded.
+Two caveats stay attached to this record: the audited paths never
+characterized the vendor PHY's undocumented analog tuning, and this
+document distinguishes **immediate HS restoration from full acceptance** —
+long-term stability and signal margin are unproven (see the acceptance
+gates below).
 
-**First concrete physical candidate:** the traced per-line ~100 ohm series
-resistors (see the hardware section below). FS signaling at 12 Mbit/s is
+**Root cause (proven on this unit):** the traced per-line ~100 ohm series
+resistors were the negotiation blocker. FS signaling at 12 Mbit/s is
 edge-slow and tolerant, while HS chirp/negotiation is amplitude- and
-timing-critical, so excessive series damping on both lines is consistent
-with exactly this failure signature — FS survives, HS chirp is missed. This
-is a **hypothesis with a matching signature, not a proven root cause**, and
-the commonly seen external USB 2.0 series damping practice (roughly 15-33
-ohm) is **not** a substitute for the exact SSC338Q PHY/reference-design
-requirement, which is not documented in this repository.
+timing-critical; replacing both 100 ohm parts with matched 12 ohm parts
+restored `480` immediately — a direct A/B result. This proof is scoped to
+**this unit**: the exact SSC338Q PHY/reference-design series value remains
+undocumented in this repository (the commonly seen external USB 2.0
+practice of roughly 15-33 ohm is illustrative, not a requirement), so other
+builds of this carrier should not assume 12 ohm is universally correct.
 
-Operating posture while the fault stands: keep the existing
-4096 kbit/s limit appropriate to full-speed operation; do not raise it on
-the assumption of high-speed throughput until HS is actually demonstrated.
+Operating posture: the **12 ohm parts stay installed** and **no further
+resistance changes** are permitted until all three owner-run acceptance
+gates below are recorded. The **4096 kbit/s** conservative limit remains in
+force until then; one immediate speed read does not justify higher WFB
+settings or any claim about long-term signal margin.
 
 ## Audited sources
 
@@ -280,16 +289,27 @@ removed and rails discharged** (unplug, then verify the rails are at 0 V
 before touching meter probes to pads). No powered measurements are proposed
 at this stage.
 
-### Gated, reversible experiment: reduce per-line series damping
+### Series-damping experiment — COMPLETED AND SUCCESSFUL (2026-10, Piotr)
 
-Rationale: if the ~100 ohm per-line series resistors over-damp the pair,
-reducing the effective per-line series resistance by roughly four times
-(100 ohm -> ~25 ohm) into the range of common external USB 2.0 practice may
-let the HS chirp/eye reach the host squelch/timing margins again. This is a
-**bounded, fully reversible test**, not a repair commitment: the target
-value below is an example chosen from common practice, **not** the
-documented SSC338Q PHY/reference-design requirement, which must be confirmed
-from vendor material if the test succeeds.
+**Result:** instead of the planned parallel-resistor step, Piotr performed a
+direct A/B replacement: **both 100 ohm per-line series resistors were
+replaced with matched 12 ohm parts**, and `/sys/bus/usb/devices/1-1/speed`
+returned **`480`** immediately afterward. This **proves the original 100
+ohm-per-line network blocked High-Speed negotiation** on this unit. The
+proposed parallel route below is **superseded** (never executed) and is kept
+only as the historical rationale for why the series value was the prime
+suspect.
+
+Rationale (historical): if the ~100 ohm per-line series resistors over-damp
+the pair, reducing the effective per-line series resistance into the range
+of common external USB 2.0 practice may let the HS chirp/eye reach the host
+squelch/timing margins again. This was a **bounded, fully reversible**
+framing: the target value was an example chosen from common practice,
+**not** the documented SSC338Q PHY/reference-design requirement, which
+remains undocumented in this repository.
+
+Proposed steps as planned (historical — superseded by the direct
+replacement actually performed; retained for reproducibility of the method):
 
 Pre-flight gate (no soldering before this is done):
 
@@ -324,11 +344,34 @@ later diagnostic above). If behaviour regresses in any way or HS is **not**
 achieved, **revert immediately**: remove the parallel parts to restore the
 original ~100 ohm per line, and record what was observed. Until HS is
 actually demonstrated, keep the **4096 kbit/s** operating limit (see the
-conclusion) regardless of this experiment.
+conclusion) regardless of this experiment. (That historical condition is
+now met — the current rule for the 4096 kbit/s limit is the acceptance
+gates in the next subsection, not this paragraph.)
 
-Further isolation diagnostics, only **after** the gate above (all of them
-need rework access — the radio is pad-connected, not socketed, so this may
-mean a temporary rework socket or piggyback harness):
+### Acceptance gates after the successful rework (outstanding, owner-run)
+
+Immediate HS restoration is **not yet full acceptance**. The 12 ohm parts
+stay installed, and **no further resistance changes** are to be made until
+all three of these gates are recorded on this unit:
+
+1. **Fresh dmesg** shows a new high-speed enumeration for the radio without
+   relevant USB errors.
+2. A **full `soc:Sstar-ehci-1` platform-driver unbind/bind** (step 5 in the
+   on-device section below, over Ethernet/console) still returns `480`.
+3. The **established wifibroadcast baseline operates stably** with no USB
+   disconnect/reset events during operation.
+
+The **4096 kbit/s** conservative limit stays in force until all three pass;
+do not infer higher WFB settings or long-term signal margin from the single
+immediate `480` read. Safety/rework provenance as documented above applies:
+all board work was and remains de-energized work with verified discharged
+rails.
+
+Isolation diagnostics (historical — moot on this unit now that the root
+cause is fixed and HS is restored; retained for future units of this
+carrier or if symptoms return; all of them need rework access — the radio
+is pad-connected, not socketed, so this may mean a temporary rework socket
+or piggyback harness):
 
 - Try a **known-good HS USB device** (any USB 2.0 flash disk) on the same
   host pads. HS on the disk but not on the radio points at the
@@ -343,14 +386,13 @@ invalidates prior software observations; re-verify from the on-device
 commands below after any hardware change.
 
 Evidence status: the platform-driver re-probe (step 5 below), the
-input-supply-capacity change, the module-input voltage measurement, and the
-per-line series-resistor tracing (de-energized resistance checks) were
-performed on hardware (2026-10, Piotr) — none of the software-adjacent
-steps improved negotiation, the ingress voltage is in range, and the traced
-topology is as recorded above. The parallel-resistor experiment **has not
-been performed yet**; the register-read diagnostics (steps 1-4 below) have
-not been reported yet. No HS negotiation has been observed at any point,
-and this document does not claim any.
+input-supply-capacity change, the module-input voltage measurement, the
+per-line series-resistor tracing (de-energized resistance checks), and the
+series-resistor replacement (100 ohm -> matched 12 ohm per line, both data
+nets) were performed on hardware (2026-10, Piotr). The replacement restored
+`480` immediately; the three acceptance gates above are **outstanding**.
+The register-read diagnostics (steps 1-4 below) have not been reported; the
+parallel-resistor variant was never executed.
 
 ## On-device verification (read-only diagnostics; step 5 re-probe already completed on hardware)