M1 MacBooks
Overview:
This page is a stub article, but it is time to start gathering information about M1 repair practices. For now it is simply to throw things i learn during the repairs (i got 5 M1 macbooks which i cant repair but thats NOT a dead CPU / SSD, so i wont give up untill i fix them). DO not use it as a repair guide or reference of any time, i have probably no idea what i am talking about - @inwerp#2476
- There is no S5-S0 sequence anymore, Do not look for it, forget everything you knew about power rails, sequence. Finita. Like on T2, SSD is always powered on.
- The most important power rails now are 3v8 and 5v_S2. G3HOT is now called AON (Allways On?) -- Read below for more 5v_S2 info*
- If you have waterdamage and you need some ICs, stock donorboards. Go google AONE36196, thats a simple double mosFet with customized footrpint. I successfully substituted it with two standard N-fets for test purposes but thats not a repair.
- all CPU power rails are now generated with Apple proprietary PMU. This might be a good thing because you won really see high side-shorts to VCORE anymore. Bad thing, again - donor only.
- if you look at 13 inch logic board, there are WAY less chips and components compared to older devices.
- Backlight circuit is the same as on older models. Same LP8549/49 as described in this article
- wifi/bt module is a bliss. Check its fooprint and smile.
- For now 820-02020 is basically almost a development board. SV004. SV000, SV010, SC002 e.t.c are debug buttons. There are all sorts of resets, power button and force DFU on edge of the board, both sides. Important note: You need to populate 1v25 pullup RV005 for DFU button to work. There are also debug leds which i plan to stock and test. Switching Fet , 6.8K 201 resister, LED 0201
- SSD/NANDs are not paired/preprogrammed like on T2 machines. If you find source, you can replace them without need of getting a donor.
WARNING: Do not use Intel Displays to check M1 and vice versa. Displays are not electrically compatible and also use different logic level (1.8v on M1)!
5v_S2
While 5v_S2 is important power rail, it is not needed for the unit to power on. It seems to power several systems, but I have booted the board without UC300 (what generates 5v_S2). However this rail might damage lots of other components, specifically because feedback line consists of many 0201 resisters, failure of each one might cause ppbus on 5V rail which is high enough to kill all consumers at once and more of that, it causes failure of 3v8_aon generator (it has alternative VCC from 5V rail) which might be a complete disaster with both PMU failure and much worse, WLAN damage which is so far not replacable.
If you have any damage in UC300 area, do not power up to test the device, only test after you are 100% sure in feedback circuit.
Things powered by 5v_S2
- Display Backlight (directly powers LP8548)
- Keyboard Backlight
- Current sensing lines
- Fans
- Camera
- Trackpad
- It looks like PP5V_SW_LCD is also powered by 5v_S2 by looking at schematics. However, when I had board booted without UC300, I did have image, just no backlight. This rail is only used to power LP8549 backlight-return controller (check Backlight troubleshooting for more info).
Power Rails
as mentioned, 3v8_AON substitutes 3v3_g3h rail from previous modell, also partially thats similar to 3v_S5. It is enabled by CHGR_EN_MVR signal from ISL9240. It is mainly used by CPU Power IC / PMU (unlike 3v3_G3HOT it is a fat 3-phase power rail with buck converters and lots of caps).
Looks like all S2 Rails are enabled by PMU(U8100) itself, so power sequence would be something like:
Old CD3217-ISL9240 to PPBUS, + 3v8_AON, then PMU generates its internal LDOs, fires up S2 Rails. it is yet unknown if PMU is interchangable between Air/Pro boards, however it might be - most of enable signals are named GPIO on PMU.
P3V3S2 Line is used for auxillary components like Wifi/BT, sensors, switches.
5v_S2 is also important rail. It is generated by UC300(LT8642EV-2 Stepdown converter with integrated fet). If this rail is unstable, you will get all sorts of issues like weird 3v8 Rail (next rail to power up CPU PMU), blown backlight switch, etc. If any sign corrosion, check all surrounding area, especially Feedback circuit. Unlike many other power ICs we seen before, this one has 5 Resisters and 1 Capacitor on feedback line. 1 Corroded feedback and you have PPBUS on your 5vRail. Not good at all.
Possible damage from bad Feedback: UP700(Display power switch), U5700 (3v8 driver, there will be a very weird short 5V to Phase 3 low side gate which looks like hot Q5840 BUT some random voltage on L75840 ). As described in schematics, 3v8 Driver (U5700) might be powered from both PPBUS_VMAIN_VIN as well as PP5v_S2, so its overvoltage is quite dangerous for PMU and possibly CPU too.
Power Consumption during boot: 19v. 0.1-,25 is a normal during POST / Boot phase. It also POSTS with 5V-1A if PD is disabled on USB Meter(weird but true).
Tricks:
- Turning on from battery only: connect battery, jump S5191, this will activate battery and keep it enabled, useful if you need data before you fix cd3217/TB circuit.
A2337 820-02016 slight clicking sound near CPU and PPBUS pulsing down from 12v to 11v
This was caused by 3v8AON Controller (U5700)
CPU/DRAM/NAND Resistance to ground (MacBook Pro 2020 M1 820-02020)
PPVDD_PCPU_AWAKE 19-21Ω
PPVDD_ECPU_AWAKE 80-95Ω
PPVDD_GPU_AWAKE 20Ω
PPVDD_SRAM_AWAKE 250-300Ω
PPVDD_DISP_S1 115Ω
PPVDD_SOC_S1 20Ω
PPVSS_DCS_S1 185Ω
PP0V764_S1_SRAM 260Ω
PP0V6_S1_VDDQL 0.5kΩ
PP1V06_S2SW_DRAM 18Ω
PP1V2_AWAKE_PLL 430Ω
PP1V25_S2 5+kΩ, used both for CPU and CD3217 VDDIO Supply, so burned CD3217 with short on this line will almost definetely mean dead CPU.
NAND:
PP2V5_AWAKE_NAND 35KΩ
PP0V88_AWAKESW_NAND 190Ω
PPVDD_GPU_AWAKE 20Ω
PMU Master (U8100, provides main voltage rail to CPU)
PP5V_BSTLQ_VOUT_MPMU 10MΩ, internal LDO
Ths LDO is really important for AON Enable / IO system. Its absence/short will cause 5v 0A with 3v3 on 5v_S2 enable and few others (normal level is 1.8v). If shorted, check L8300(input filtering inductor)
PP1V2_S2 20MΩ+, external LDO for audio FPGA processor UR300
PP3v3_S2_UPC 40MΩ+ external LDO for CD3217 (substitutes 3V3_RTC on Intel models)
PP1V8_AON_MPMU 30KΩ+ external LDO used for few pullups and 1.8, 3v3 AON > LDO enables which are used for some SMC functions and communication lines pullups.
PMU Slave (U7700, provides voltages for RAM and few AUX supplies for CPU)
PP0V88_S1 10MΩ, internal LDO
PP5V_BSTLQ_VOUT_SPMU 10MΩ, internal LDO
Backlight troubleshooting
Refer to old Backlight troubleshooting for most of possible issues. However, there is one weird thing to check: 1v8_AON rail is not critical for boot and start up but it is used for LID signal. If 1v8_AON is not present there will be communication between Backlight Drivers, there will be Boost and backlight enable signal. Looks like this was implemented that way so backlight voltage will be always present in S2 state for the famous "instant on" effect which turns backlight on with zero delay.
Compared to older models, LID trigger is way more complicated. It consists of many stages and powered by PP1v8_AON LDO (enabled by PMU itself). It is being generated from 3v8_AON rail by UC120 converter. It is very sensitive to any waterdamage on LID or overvoltage on 3v8 rail. It also worth to mention that AMR_RIGHT_OR_ND_1V8(located on audioboard) and AMR_LEFT_OR_ND_1V8(JR200 miniboard on main LB) are real LID signals from both HAL sensors.
Both signals are directly routed to UR300 FPGA chip which probably hardware-disables mic and camera once LID is closed. It also issues LID_OPEN signal sent to M1 SoC.
There is also UR200 OR gate which issues IPD_LID_OPEN_1V8 signal which is sent to Trackpad, Touchbar and PMU. So basically, this means that problems in LID circuit might cause no camera / microphone, no backlight but working touchbar and Trackpad haptic. Touchbar uses inverted signal (Low if "open"), most other circuits use high if "open".
Low PP1V8_AON (1.5 or 1.4v due to bad cap near regulator) would cause partial LID problems like disabled touchscreen on Toucbar, random no haptic click)
WIFI Module death
unfortunately it happens on many MacBook Pro 13" 2020 devices. The reason for this fault is waterdamage in 3v3_S2 regulator, located at UC710 right next to backlight circuit. This place of the board is on the airflow path Once waterdamaged corroded feedback causes regulator to output =ppbus into 3vs2 which kills Wifi module.
So far there is no known way to replace wifi chip: its configuration data is most likely stored on hidden SSD partition (similar to BridgeOS on T2 devices), and it wont work even after full DFU restore. It might probably work if you swap WIFI with SSD module.
WiFi chip is tied to the CPU and its configuration information is stored in internal CPU ROM. There are rumors that new revision of JCID tool might have ability to untie iPhone 14 Wifi, which would probably be the same process for M1 chips. For now there is no known way to replace WIFI IC.
Without WIFI IC macOs triggers KP and not able to boot into OS. Older Recovery OS did not boot as well, however this information needs regular updates / checks.
Update 2023:
It seems that the Wi-Fi chip does not die as a whole part. Basically, what's getting damaged seems to be two DrMos on 3.3V inputs close to the antenna or maybe some caps nearby. My speculation on the DrMos version is based on a light partial 50 ohm short, which does not generate any heat, but both C0 and C1 amps are not working (the device is not able to connect to any type of Wi-Fi network unless it is really close to the router). Such a short would not prevent DrMos from getting powered, so amp malfunction most likely indicates that DrMos is damaged.
Most likely, these are power supplies for transmitter signal amplifiers. This means that if the 3.3V rail is not shut off due to OCP, the Wi-Fi chip will be visible in the system, but it won't connect to any network unless you put it directly on the Wi-Fi router. Two to five centimeters from the router antenna will give you full connectivity. So basically, this short causes the Wi-Fi chip to be unable to amplify TX, but it will still see all Wi-Fi networks around.
A possible workaround would be to cut traces to the shorted parts of the chip from the power rail (much safer than drilling the IC). If you do not have visible heat on both 3.3V inputs and resistance is above 50 Ohms, it might be totally fine to leave it as it is.
Refer to the images:
M1 WIFI Chip footprint
As a mobile solution to get wifi via ethernet i am using Gl-iNet 300M mini Smart router. this tiny thing is powered from usb port and can be used in a repeater mode. Disable internal wifi, use web interface to connect to your wifi and here you go - just one dongle more and you got wifi connectivity.
Tools and chips
Chip identification
RAM:
HYNIX: H9HCNNNFBPMVGR-NEH 64Gbit(8GB) or H9HCNNNCRMMVGR-NEH 32Gbit(4GB) chips.
SSD(same as iPhone 13 codes):
KICM227 256 GB
KICM229 1T
KICM222 512 GB
KICM5224 256 GB
KICM223R 1T
MacBook 2021 M1 MAX/PRO )Based on 820-02100 schematics
Main Power controllers
- U8100 PMIC MASTER APL1098/343S00515 Huge power IC, generating almost all rails used by CPU. Powered by PP3v8_AON, turns on bucks if VDD_HI ~4.7V is present (voltage divider PPBUS/2). PMIC Dies if there is overvoltage (VDD_HI == PPBUS)
- PP3v8_AON U5700 - basically a secondary "PPBUS" rail. Rail is described up to 30A and generated by the same IC from first 2020 M1 board. Used as a main power supply for PMIC Master. As in previous board, enabled by charger IC (U5200, RAA489900)
- Battery charging / PPBUS IC RAA489900 - since proper is not available it might be compatible with ISL9240, at least pins listen and VDDIO voltage in schematics are the same.
- PP5V_S2 - probably the same "low power state" supply which is used by many switches and as a secondary VCC rail on many ICs.
- new CD3218 Magsafe controller.