Ictc
Member
Initial problem:
MacBook Pro 15" 2019 board (T2, board 820-01827) won't boot. PM_RSMRST_L stays at 0V. Revive via cfgutil halts at 66% (Step 4 "Installing system") with error AMRestoreErrorDomain 6 - Failed to handle message type StatusMsg. Current draw during the attempt: idle ~0.05A, rises to ~0.12A in the first steps, then drops and stays fixed at 0.06A at the failure point. SSD data needs to be preserved if possible.
Initial measurements (main rails OK):
PPBUS_G3H: 12.6V
PP3V3_G3H_RTC: 3.3V
PPVDDCPU_AWAKE: 0.754V stable
All 4 USB-C ports negotiate 20V correctly (even without battery, after correcting an earlier faulty reading)
PP2V5_NAND_SSD1: present and stable, SSD clean with no shorts
SLPS2R/AWAKE rails (PP1V8, PP3V3, PP1V1, PP0V8): all present
Missing rail identified: PP3V3_S5 = 0V (diode mode ~0.30V, no short to ground). As a result, PCH_BATLOW_L stays at 0V (pull-up dependent on S5).
T2 ↔ PMIC (U7800) communication verified via oscilloscope on the SPMI bus:
Confirmed a 1.8V data/clock burst at power-on → T2 correctly sends the SPMI command, but U7800 fails to generate/sustain PP3V3_S5.
Checks on U7800 and surrounding components:
PMIC enables and supplies all present and correct (P3V3G3S_EN, PMU_LDOS_OUT, PMU_ONOFF_L)
No shorts on adjacent components (C7802, C7803, C7864, PP1V8_SSD0, PP0V9_SSD0)
R7800/R7801 don't exist on this board revision
Instead of the expected ~8V jump on the bootstrap (C7864) during the SPMI burst, only 3.3V is observed
Root cause identified: UPC_PMU_RESET (Pad 167 on U7800) is stuck at 0V, holding the PMIC in permanent hardware reset and preventing PP3V3_S5 from being generated.
Analysis of the reset generator U6940 (SLG4AP41183):
Pin 1 (VDD), Pin 3 (PMU_ONOFF_L), Pin 4 (PMU_RSLOC_RST_L): all present/correct
Pin 10 (RESET output): 0V, no short to ground detected
→ Suspected internal logic failure in U6940
Bypass test performed:
Isolated pin 10 of U6940 (removed R6940 and R6941), injected 3.3V via a 1kΩ pull-up directly onto the UPC_PMU_RESET line toward U7800.
Result: the board immediately dropped from 20V back to 5V and entered a continuous power-cycle loop.
DFU attempts after the bypass:
Revive: still halts at 66% (the phase where T2 attempts to init NAND/PMIC S5 state)
Restore: fails with AMRestoreErrorDomain -1 - Generic error
Question for the forum:
Since no shorts are measured in diode mode, the fault seems to only trigger under load, when U7800 attempts to enable the secondary rails (or during the T2/NAND handshake). The post-bypass behavior (20V→5V collapse, power-cycle loop) suggests UPC_PMU_RESET might be held low by design/protection rather than a simple U6940 failure.
Has anyone encountered this behavior before? Could this be:
Internal OCP in PMIC U7800 triggering under load?
A failing internal buck regulator?
An issue with the NAND controller or the T2 itself?
Next step being considered: direct replacement of U6940, but before proceeding I'd like confirmation whether that makes sense, or if the issue lies further upstream (T2/NAND).
Want me to also save this as a downloadable file, or is this good to paste directly?
MacBook Pro 15" 2019 board (T2, board 820-01827) won't boot. PM_RSMRST_L stays at 0V. Revive via cfgutil halts at 66% (Step 4 "Installing system") with error AMRestoreErrorDomain 6 - Failed to handle message type StatusMsg. Current draw during the attempt: idle ~0.05A, rises to ~0.12A in the first steps, then drops and stays fixed at 0.06A at the failure point. SSD data needs to be preserved if possible.
Initial measurements (main rails OK):
PPBUS_G3H: 12.6V
PP3V3_G3H_RTC: 3.3V
PPVDDCPU_AWAKE: 0.754V stable
All 4 USB-C ports negotiate 20V correctly (even without battery, after correcting an earlier faulty reading)
PP2V5_NAND_SSD1: present and stable, SSD clean with no shorts
SLPS2R/AWAKE rails (PP1V8, PP3V3, PP1V1, PP0V8): all present
Missing rail identified: PP3V3_S5 = 0V (diode mode ~0.30V, no short to ground). As a result, PCH_BATLOW_L stays at 0V (pull-up dependent on S5).
T2 ↔ PMIC (U7800) communication verified via oscilloscope on the SPMI bus:
Confirmed a 1.8V data/clock burst at power-on → T2 correctly sends the SPMI command, but U7800 fails to generate/sustain PP3V3_S5.
Checks on U7800 and surrounding components:
PMIC enables and supplies all present and correct (P3V3G3S_EN, PMU_LDOS_OUT, PMU_ONOFF_L)
No shorts on adjacent components (C7802, C7803, C7864, PP1V8_SSD0, PP0V9_SSD0)
R7800/R7801 don't exist on this board revision
Instead of the expected ~8V jump on the bootstrap (C7864) during the SPMI burst, only 3.3V is observed
Root cause identified: UPC_PMU_RESET (Pad 167 on U7800) is stuck at 0V, holding the PMIC in permanent hardware reset and preventing PP3V3_S5 from being generated.
Analysis of the reset generator U6940 (SLG4AP41183):
Pin 1 (VDD), Pin 3 (PMU_ONOFF_L), Pin 4 (PMU_RSLOC_RST_L): all present/correct
Pin 10 (RESET output): 0V, no short to ground detected
→ Suspected internal logic failure in U6940
Bypass test performed:
Isolated pin 10 of U6940 (removed R6940 and R6941), injected 3.3V via a 1kΩ pull-up directly onto the UPC_PMU_RESET line toward U7800.
Result: the board immediately dropped from 20V back to 5V and entered a continuous power-cycle loop.
DFU attempts after the bypass:
Revive: still halts at 66% (the phase where T2 attempts to init NAND/PMIC S5 state)
Restore: fails with AMRestoreErrorDomain -1 - Generic error
Question for the forum:
Since no shorts are measured in diode mode, the fault seems to only trigger under load, when U7800 attempts to enable the secondary rails (or during the T2/NAND handshake). The post-bypass behavior (20V→5V collapse, power-cycle loop) suggests UPC_PMU_RESET might be held low by design/protection rather than a simple U6940 failure.
Has anyone encountered this behavior before? Could this be:
Internal OCP in PMIC U7800 triggering under load?
A failing internal buck regulator?
An issue with the NAND controller or the T2 itself?
Next step being considered: direct replacement of U6940, but before proceeding I'd like confirmation whether that makes sense, or if the issue lies further upstream (T2/NAND).
Want me to also save this as a downloadable file, or is this good to paste directly?
