hilink: trace per-line 100-ohm USB series resistors, gate reversible HS test

devices/ssc338q_fpv_openipc-urllc-aio/USB-HS-INVESTIGATION.md

@@ -25,6 +25,11 @@ USB 2.0 EHCI port (`Sstar-ehci-1`).
   module input, inside the common 4.75–5.25 V input range. The earlier
   "3.3 V fed into the 5 V input" hypothesis is therefore ruled out **at
   module ingress** (upstream of the carrier's local regulation).
+- **Verified on hardware (2026-10, Piotr):** each USB data net was physically
+  traced as `SSC338Q-side -> approximately 100 ohm series resistor ->
+  RTL8812EU-module D+ or D-`; each component measured about 100 ohm across
+  its own endpoints with all power removed. These are **two separate
+  per-line series resistors**, not one 100-ohm differential termination.
 - RF/FEC configuration is not a USB fix and is out of scope for this issue.
 - This document contains no credentials, pairing or RF-access material.
 
@@ -57,6 +62,16 @@ irrelevant (the audited paths cover what the shipped source programs, not
 the full register space), and it does **not** claim any high-speed success —
 the fault is unresolved; only its domain is now sharply bounded.
 
+**First concrete physical candidate:** the traced per-line ~100 ohm series
+resistors (see the hardware section below). FS signaling at 12 Mbit/s is
+edge-slow and tolerant, while HS chirp/negotiation is amplitude- and
+timing-critical, so excessive series damping on both lines is consistent
+with exactly this failure signature — FS survives, HS chirp is missed. This
+is a **hypothesis with a matching signature, not a proven root cause**, and
+the commonly seen external USB 2.0 series damping practice (roughly 15-33
+ohm) is **not** a substitute for the exact SSC338Q PHY/reference-design
+requirement, which is not documented in this repository.
+
 Operating posture while the fault stands: keep the existing
 4096 kbit/s limit appropriate to full-speed operation; do not raise it on
 the assumption of high-speed throughput until HS is actually demonstrated.
@@ -245,19 +260,72 @@ scope:
 
 **Next physical gate (before any rework):**
 
-1. **Macro photographs of both sides** of the carrier/module.
+1. **Macro photographs of both sides** of the carrier/module — not yet
+   reported.
 2. **Identify all four host pads** — determine which are VBUS, GND, D+,
    D- (the four-wire harness implies the classic set, but the actual
-   assignment must come from tracing, not assumption).
+   assignment must come from tracing, not assumption) — not yet reported in
+   full; the two data nets and their series resistors have been traced (see
+   the fixed observations above).
 3. **Trace D+/D- end to end**, identifying every intervening component —
    series resistors, ESD arrays, common-mode chokes, vias, connectors,
-   harness wires — and where the pair leaves the board.
+   harness wires — and where the pair leaves the board. **Status: performed
+   for both data nets** — each net is `SSC338Q-side -> ~100 ohm series
+   resistor -> module D+/D-`, each resistor measuring ~100 ohm across its
+   own endpoints, de-energized. No other intervening component was reported
+   on the data nets.
 
 **Safety rule for all continuity/ohmmeter work:** only with **all power
 removed and rails discharged** (unplug, then verify the rails are at 0 V
 before touching meter probes to pads). No powered measurements are proposed
 at this stage.
 
+### Gated, reversible experiment: reduce per-line series damping
+
+Rationale: if the ~100 ohm per-line series resistors over-damp the pair,
+reducing the effective per-line series resistance by roughly four times
+(100 ohm -> ~25 ohm) into the range of common external USB 2.0 practice may
+let the HS chirp/eye reach the host squelch/timing margins again. This is a
+**bounded, fully reversible test**, not a repair commitment: the target
+value below is an example chosen from common practice, **not** the
+documented SSC338Q PHY/reference-design requirement, which must be confirmed
+from vendor material if the test succeeds.
+
+Pre-flight gate (no soldering before this is done):
+
+1. Confirm the two resistors' **package size** and mark their **exact
+   locations** (photograph before touching anything).
+2. Confirm the workmanship/ESD plan for soldering on the carrier.
+
+Experiment (reversible — nothing is removed, parts are added in parallel):
+
+1. With **all power removed and rails discharged and verified at 0 V**
+   (same rule as above). The work setup itself must not be able to feed
+   voltage onto the unpowered board — including through the soldering
+   iron's supply path — so use an isolated or battery-powered iron or
+   equivalent isolation. Solder **one matched resistor in parallel across
+   each** existing 100 ohm part — **D+ and D- must be treated
+   identically**.
+2. Example value: 33 ohm in parallel with 100 ohm gives an effective
+   (33 x 100) / (33 + 100) = 3300 / 133 = **24.8 ohm per line** (~25 ohm).
+   Any parallel pair follows R_eff = (R1 x R2) / (R1 + R2); keep the same
+   value on both lines.
+3. Inspect under magnification for **bridges, solder balls or damage** to
+   the parts and neighbours; the two lines must look identical.
+4. **Before restoring power**, measure each modified net again (de-energized)
+   and confirm both read the same effective value, within part tolerance.
+5. Restore power **only after inspection** and run a fresh USB enumeration
+   check (`cat /sys/bus/usb/devices/1-1/speed`).
+
+**Acceptance criterion:** actual **480** Mbit/s negotiation. The
+enumeration result is the only judge of this test: no final line impedance
+or eye-quality outcome is assumed without signal-integrity measurement (a
+later diagnostic above). If behaviour regresses in any way or HS is **not**
+achieved, **revert immediately**: remove the parallel parts to restore the
+original ~100 ohm per line, and record what was observed. Until HS is
+actually demonstrated, keep the **4096 kbit/s** operating limit (see the
+conclusion) regardless of this experiment.
+
 Further isolation diagnostics, only **after** the gate above (all of them
 need rework access — the radio is pad-connected, not socketed, so this may
 mean a temporary rework socket or piggyback harness):
@@ -275,11 +343,14 @@ invalidates prior software observations; re-verify from the on-device
 commands below after any hardware change.
 
 Evidence status: the platform-driver re-probe (step 5 below), the
-input-supply-capacity change, and the module-input voltage measurement were
+input-supply-capacity change, the module-input voltage measurement, and the
-performed on hardware (2026-10, Piotr) — none improved negotiation, and the
+per-line series-resistor tracing (de-energized resistance checks) were
-ingress voltage is in range; all recorded above. The register-read
+performed on hardware (2026-10, Piotr) — none of the software-adjacent
-diagnostics (steps 1-4 below) have not been reported yet; no HS negotiation
+steps improved negotiation, the ingress voltage is in range, and the traced
-has been observed at any point, and this document does not claim any.
+topology is as recorded above. The parallel-resistor experiment **has not
+been performed yet**; the register-read diagnostics (steps 1-4 below) have
+not been reported yet. No HS negotiation has been observed at any point,
+and this document does not claim any.
 
 ## On-device verification (read-only diagnostics; step 5 re-probe already completed on hardware)