M1 MacBooks

===Overview:===
This page is a stub article, but it is time to start gathering information about M1 repair practices. For now it is simply to throw things i learn during the repairs (i got 5 M1 macbooks which i cant repair but thats NOT a dead CPU / SSD, so i wont give up untill i fix them). DO not use it as a repair guide or reference of any time, i have probably no idea what i am talking about - @inwerp#2476
#There is no S5-S0 sequence anymore, Do not look for it, forget everything you knew about power rails, sequence. Finita. Like on T2, SSD is always powered on.
#The most important power rails now are 3v8 and 5v_S2. G3HOT is now called AON (Allways On?) -- Read below for more 5v_S2 info*
#If you have waterdamage and you need some ICs, stock donorboards. Go google AONE36196, thats a simple double mosFet with customized footrpint. I successfully substituted it with two standard N-fets for test purposes but thats not a repair.
#all CPU power rails are now generated with Apple proprietary PMU. This might be a good thing because you won really see high side-shorts to VCORE anymore. Bad thing, again - donor only.
#if you look at 13 inch logic board, there are WAY less chips and components compared to older devices.
#Backlight circuit is the same as on older models. Same LP8549/49 as described in this article
#wifi/bt module is a bliss. Check its fooprint and smile.
#For now 820-02020 is basically almost a development board. SV004. SV000, SV010, SC002 e.t.c are debug buttons. There are all sorts of resets, power button and force DFU on edge of the board, both sides. Important note: You need to populate 1v25 pullup RV005 for DFU button to work. There are also debug leds which i plan to stock and test. Switching Fet , 6.8K 201 resister, LED 0201
#SSD/NANDs are not paired/preprogrammed like on T2 machines. If you find source, you can replace them without need of getting a donor.
WARNING: Do not use Intel Displays to check M1 and vice versa. Displays are not electrically compatible and also use different logic level (1.8v on M1)!
=== Getting Boot logs ===
# boot into diagnostics (hold power button 8 seconds untill startup menu, press cmd+D)
# start diagnostics and press cmd+opt+l few times
# plug in usb stick with hfs+ or apfs system and choose it as target
this will qield quite big ZIP archive with lots of useful logs including boot log. 
===5v_S2===
While 5v_S2 is important power rail, it is not needed for the unit to power on. It seems to power several systems, but I have booted the board without UC300 (what generates 5v_S2). However this rail might damage lots of other components, specifically because feedback line consists of many 0201 resisters, failure of each one might cause ppbus on 5V rail which is high enough to kill all consumers at once and more of that, it causes failure of 3v8_aon generator (it has alternative VCC from 5V rail) which might be a complete disaster with both PMU failure and much worse, WLAN damage which is so far not replacable. 
If you have any damage in UC300 area, do not power up to test the device, only test after you are 100% sure in feedback circuit. 
Things powered by 5v_S2
*Display Backlight (directly powers LP8548)
*Keyboard Backlight
*Current sensing lines
*Fans
*Camera
*Trackpad
*It looks like PP5V_SW_LCD is also powered by 5v_S2 by looking at schematics. However, when I had board booted without UC300, I did have image, just no backlight. This rail is only used to power LP8549 backlight-return controller (check Backlight troubleshooting for more info).
===Power Rails===
as mentioned, 3v8_AON substitutes 3v3_g3h rail from previous modell, also partially thats similar to 3v_S5. It is enabled by CHGR_EN_MVR signal from ISL9240. It is mainly used by CPU Power IC / PMU (unlike 3v3_G3HOT it is a fat 3-phase power rail with buck converters and lots of caps). 
Looks like all S2 Rails are enabled by PMU(U8100) itself, so power sequence would be something like: 
Old CD3217-ISL9240 to PPBUS, + 3v8_AON, then PMU generates its internal LDOs, fires up S2 Rails. it is yet unknown if PMU is interchangable between Air/Pro boards, however it might be - most of enable signals are named GPIO on PMU. 
P3V3S2 Line is used for auxillary components like Wifi/BT, sensors, switches. 
5v_S2 is also important rail. It is generated by UC300(LT8642EV-2 Stepdown converter with integrated fet). If this rail is unstable, you will get all sorts of issues like weird 3v8 Rail (next rail to power up CPU PMU), blown backlight switch, etc. If any sign corrosion, check all surrounding area, especially Feedback circuit. Unlike many other power ICs we seen before, this one has 5 Resisters and 1 Capacitor on feedback line. 1 Corroded feedback and you have PPBUS on your 5vRail. Not good at all. 
Possible damage from bad Feedback: UP700(Display power switch), U5700 (3v8 driver, there will be a very weird short 5V to Phase 3 low side gate which looks like hot Q5840 BUT some random voltage on L75840 ). As described in schematics, 3v8 Driver (U5700) might be powered from both PPBUS_VMAIN_VIN as well as PP5v_S2, so its overvoltage is quite dangerous for PMU and possibly CPU too. 
Power Consumption during boot: 19v. 0.1-,25 is a normal during POST / Boot phase. It also POSTS with 5V-1A if PD is disabled on USB Meter(weird but true).
Tricks:
- Turning on from battery only: connect battery, jump S5191, this will activate battery and keep it enabled, useful if you need data before you fix cd3217/TB circuit.
===A2337 820-02016 slight clicking sound near CPU and PPBUS pulsing down from 12v to 11v===
This was caused by 3v8AON Controller (U5700)
===CPU/DRAM/NAND Resistance to ground (MacBook Pro 2020 M1 820-02020)===
PPVDD_PCPU_AWAKE 19-21Ω
PPVDD_ECPU_AWAKE 80-95Ω
PPVDD_GPU_AWAKE 20Ω
PPVDD_SRAM_AWAKE 250-300Ω
PPVDD_DISP_S1 115Ω
PPVDD_SOC_S1 20Ω
PPVSS_DCS_S1 185Ω
PP0V764_S1_SRAM 260Ω
PP0V6_S1_VDDQL 0.5kΩ
PP1V06_S2SW_DRAM 18Ω
PP1V2_AWAKE_PLL 430Ω
PP1V25_S2 5+kΩ, used both for CPU and CD3217 VDDIO Supply, so burned CD3217 with short on this line will almost definetely mean dead CPU. 
NAND:
PP2V5_AWAKE_NAND 35KΩ
PP0V88_AWAKESW_NAND 190Ω
PPVDD_GPU_AWAKE 20Ω
PMU Master (U8100, provides main voltage rail to CPU)
PP5V_BSTLQ_VOUT_MPMU 10MΩ, internal LDO
Ths LDO is really important for AON Enable / IO system. Its absence/short will cause 5v 0A with 3v3 on 5v_S2 enable and few others (normal level is 1.8v). If shorted, check L8300(input filtering inductor)
PP1V2_S2 20MΩ+, external LDO for audio FPGA processor UR300
PP3v3_S2_UPC 40MΩ+ external LDO for CD3217 (substitutes 3V3_RTC on Intel models)
PP1V8_AON_MPMU 30KΩ+ external LDO used for few pullups and 1.8, 3v3 AON > LDO enables which are used for some SMC functions and communication lines pullups.
PMU Slave (U7700, provides voltages for RAM and few AUX supplies for CPU) 
PP0V88_S1 10MΩ, internal LDOPP5V_BSTLQ_VOUT_SPMU 10MΩ, internal LDO
===Backlight troubleshooting===
Refer to old Backlight troubleshooting for most of possible issues. However, there is one weird thing to check: 1v8_AON rail is not critical for boot and start up but it is used for LID signal. If 1v8_AON is not present there will be communication between Backlight Drivers, there will be Boost and backlight enable signal. Looks like this was implemented that way so backlight voltage will be always present in S2 state for the famous "instant on" effect which turns backlight on with zero delay. 
Compared to older models, LID trigger is way more complicated. It consists of many stages and powered by PP1v8_AON LDO (enabled by PMU itself). It is being generated from 3v8_AON rail by UC120 converter. It is very sensitive to any waterdamage on LID or overvoltage on 3v8 rail. It also worth to mention that AMR_RIGHT_OR_ND_1V8(located on audioboard) and AMR_LEFT_OR_ND_1V8(JR200 miniboard on main LB) are real LID signals from both HAL sensors. 
Both signals are directly routed to UR300 FPGA chip which probably hardware-disables mic and camera once LID is closed. It also issues LID_OPEN signal sent to M1 SoC. 
There is also UR200 OR gate which issues IPD_LID_OPEN_1V8 signal which is sent to Trackpad, Touchbar and PMU. So basically, this means that problems in LID circuit might cause no camera / microphone, no backlight but working touchbar and Trackpad haptic. Touchbar uses inverted signal (Low if "open"), most other circuits use high if "open". 
Low PP1V8_AON (1.5 or 1.4v due to bad cap near regulator) would cause partial LID problems like disabled touchscreen on Toucbar, random no haptic click) 
Check Angle sensor circuitry page to find circuit schematics on the Lid Angle Sensor for A2442 (M1 14") and A2681 (M2 MBA). 
===WIFI Module death===
unfortunately it happens on many MacBook Pro 13" 2020 devices. The reason for this fault is waterdamage in 3v3_S2 regulator, located at UC710 right next to backlight circuit. This place of the board is on the airflow path Once waterdamaged corroded feedback causes regulator to output =ppbus into 3vs2 which kills Wifi module. 
So far there is no known way to replace wifi chip: its configuration data is most likely stored on hidden SSD partition (similar to BridgeOS on T2 devices), and it wont work even after full DFU restore. It might probably work if you swap WIFI with SSD module. 
WiFi chip is tied to the CPU and its configuration information is stored in internal CPU ROM. There are rumors that new revision of JCID tool might have ability to untie iPhone 14 Wifi, which would probably be the same process for M1 chips. For now there is no known way to replace WIFI IC. 
Without WIFI IC macOs triggers KP and not able to boot into OS. Older Recovery OS did not boot as well, however this information needs regular updates / checks. 
Update 2023: 
It seems that the Wi-Fi chip does not die as a whole part. Basically, what's getting damaged seems to be two DrMos on 3.3V inputs close to the antenna or maybe some caps nearby. My speculation on the DrMos version is based on a light partial 50 ohm short, which does not generate any heat, but both C0 and C1 amps are not working (the device is not able to connect to any type of Wi-Fi network unless it is really close to the router). Such a short would not prevent DrMos from getting powered, so amp malfunction most likely indicates that DrMos is damaged. 
Most likely, these are power supplies for transmitter signal amplifiers. This means that if the 3.3V rail is not shut off due to OCP, the Wi-Fi chip will be visible in the system, but it won't connect to any network unless you put it directly on the Wi-Fi router. Two to five centimeters from the router antenna will give you full connectivity. So basically, this short causes the Wi-Fi chip to be unable to amplify TX, but it will still see all Wi-Fi networks around.
A possible workaround would be to cut traces to the shorted parts of the chip from the power rail (much safer than drilling the IC). If you do not have visible heat on both 3.3V inputs and resistance is above 50 Ohms, it might be totally fine to leave it as it is.
Refer to the images: 
 
M1 WIFI Chip  footprint 
As a mobile solution to get wifi via ethernet i am using Gl-iNet 300M mini Smart router. this tiny thing is powered from usb port and can be used in a repeater mode. Disable internal wifi, use web interface to connect to your wifi and here you go - just one dongle more and you got wifi connectivity. 
=== PMU Troubleshooting ===
There are not many things that are required for the PMU to start. First of all, it needs PP3V8_AON power supply(compared to 3 step T2 sequence PP3V3_G3H_RTC >> T2 PMU init >> PMU_VDDMAIN_EN >> PP3V3_G3H ) as it is used to generate all outputs. The second thing would be PMU_VDD_HI, which is a voltage sense similar to T2 PMU on older models. I've never seen it die; however, it was quite often the issue on T2 Macs. Overvoltage on this pin might kill the PMU on models with a non-isolated voltage divider (M1MAX/T2 boards).
If the PMU does not output any voltages at all, first check VDD_HI, then inspect all internal LDO supplies and clock generation. If an LDO is not present, inspect its input and cap wells; for example, the PP5V_BSTLO_MPMU input inductor might be burned if you have an internal buck failure. This voltage is most likely used to drive internal buck converters. It also needs CHRGR_AUX_OK from the ISL9240. MPMU_XTAL1 is also necessary for the PMU to operate.
===Tools and chips===
AMAOE MAC 9 M1 Stencil
===Chip identification===
RAM:
HYNIX: H9HCNNNFBPMVGR-NEH 64Gbit (8GB) or H9HCNNNCRMMVGR-NEH 32Gbit(4GB) chips. 
MICRON: MT53D512M64D4DG-046 XT:F D9ZGT 32Gbit (4GB) 
SSD (Same as iPhone 12/13 codes):
KICM225 + KICM232 = 256 GB 
KICM227 256 GB
KICM229 512 GB 
KICM222 512 GB
KIC5224 256 GB
KICM223R 1 TB
== CD3217 Repair ==
Like on T2 macs, all boards with more than 2 ports have OTP (Internally) configured i2c Address setting. If CD3217 has wrong address, it wont be recognized the SMC and charging won't work. 
Here is table from 820-02098 (MacBook Pro 2021 A2442 14") board
As on pior models, 0x38 and 0x3F are strap-configured. 
based on experience and schematics: 
OTP-Configured(only donor sourced) ports are: Right port UG400(0x3A) and Magsafe U5500(0x3A) port on 14/16" ports. Most likely UG400 is interchangable but Magsafe might limit max charging capacity from 14 to 16inch board. 
On Macbook Air only MagSafe port should be sourced from donor. 
Pin configuration:
U5500(Magsafe controller) - UPC5/I2CM_SDA_CNFG LOW 1M-Gnd, I2CM_SCL_CNFG HIGH 1M-3V3 UPC5_I2C_ADDR FLOAT (Not stuffed R5650), ALL PD_UPC2_DBG 100k-GND
UF400(Left Top/DFU port) - UPC0 I2CM_[SCL/SDA]_CNFG HIGH 1M-3V3 + Routed to Debug connector and Debug mux UF700 / I2C_ADDR GND Hard-routed, ALL PD_UPC2_DBG UART connection to SOC
UF500(Left Down/normal port) - UPC1 I2CM_[SCL/SDA]_CNFG HIGH 1M-3V3 + Routed to Debug connector and Debug mux I2C_ADDR Float / NC 
UG400(Right USB-C) - UPC2 I2CM_[SCL/SDA]_CNFG HIGH 1M-3V3 + Routed to Debug connector and Debug mux I2C_ADDR 0K-GND. All PD_UPC2_DBG 100k-GND
==MacBook 2021 M1 MAX/PRO Based on 820-02100 schematics==
===Main Power controllers===
#U8100 PMIC MASTER APL1098/343S00515 Huge power IC, generating almost all rails used by CPU. Powered by PP3v8_AON, turns on bucks if VDD_HI ~4.7V is present (voltage divider PPBUS/2). PMIC Dies if there is overvoltage (VDD_HI == PPBUS)
#PP3v8_AON U5700 - basically a secondary "PPBUS" rail. Rail is described up to 30A and generated by the same IC from first 2020 M1 board. Used as a main power supply for PMIC Master. As in previous board, enabled by charger IC (U5200, RAA489900)
#Battery charging / PPBUS IC RAA489900 - since proper is not available it might be compatible with ISL9240, at least pins listen and VDDIO voltage in schematics are the same.
#PP5V_S2 - probably the same "low power state" supply which is used by many switches and as a secondary VCC rail on many ICs.
#new CD3218 Magsafe controller.
=== Power ICS under SoC ===
M1Pro (339S00962 S) Power IC (3 chips under SOC)
343S00506, 343S00508, 343S00510
All have different PN on the same board.
_______________________________
M1Max 
343s00509 - 5 chips under CPU |TODO: check if its all the same PN, cause on M1Pro that's not the case|
=== RAM Differences ===
M1 Pro has different RAM vendors,
So it's important to take that into account when performing PMU/SPMU main rail measurements.
H58G78AK6HX049 (16GB per IC) is low-ohm RAM.
That will affect resistance measurements on 
PPVDD2H0_S2SW, PPVDD2H1_S2SW and PP0V95_S2SW_VDD2L power rails.
=== Resistance and miscellaneous measurements ===
==== M1Pro (applicable to A2442" and A2485") ====
M1Pro measurements below taken with UT60A:
MPMU U8100 main rails:PP0V75_S1_VDDQ1 = 650R
PPVDD2H1_S2SW = 230R (May be lower, depends on ram used)
PPVDDGPU_BMPR_S1 = 246R
PP0V81_S1_SRAM = 153R
PPVDD_ECPU_AWAKE = 137R
PPVDD_ECPU_SRAM = ~16K
PP1V8_S2SW = ~10,3K
PP1V2_S2 = ~28,7K
PPVDD_FIXED_S1 = 217R
PPVDD_AVEMSR_AWAKESW = 127R
PPVDD_AMPH_S2SW = 5,6K
SPMU U7700 main rails:PP0V575_S1_VDDQ = 600R
PPVDD_DCSS1 = 96,5R
PP0V95_S2SW_VDD2L = 1K (May be way lower, seen 75R, depends on RAM used)
PP1V8_S2 = >100K (don't know why is that differs from 1v8s2 above)
PP1V2_AWAKE = 3,5K
PPVDD_AMPH0_S2SW =5,36K
PPVDD_SOC_S1 = 34R
PP0V855_S2SW_VDDCIO = 288R
PPVDD_DISP_AWAKESW = 51R
PPVDD2H0_S2SW = 216R (May be way lower, seen 21,6R, depends on RAM used)
PMU VDDHI Rdivider stock values:R8171: 291K R8170: 1.07M (tolerance 0.1%)
Vout = 2,49V@PBUS =11,98 
Vout = 2,60V@PBUS =12,3V
BOM Variant used: 3S
Misc: PP1V8_S1_CLVR=3,3K (75mV in diode) (PP1V8VDDH*)