T2 General information
T2 serves the purpose of SIO/EC, Camera, ALS, Touch ID, Audio, DFR (Touch Bar), SSD, Encryption, and ESPI Controller. It also controls all temp sensors, peripherals (keyboard/touchpad), and CD3215/CD3217 PD communication.T2 starts iBoot from SoC ROM SPI Flash chip, which initializes its SMC instructions to proceed with the power sequence. Once initialized, it turns on the PP3V3_G3H power supply and NAND power to proceed with BridgeOS firmware, which is stored on the SSD drive. Once booted, it initializes the Intel power sequence and feeds Intel EFI via the eSPI interface to PCH.
Serial number and battery charging statistics, as well as "NVRAM" configuration, are also stored in this SPI Flash.
There are two types of T2 with two types of DDR chips each. T2 does not need DDR to boot iBoot and will be responsive in DFU.
Most devices have a "slim" version of the chip with the same size of memory, and the T2 chip itself. 2018 and 2019 MacBook Pro 2TB models have larger T2 and T2 PMIC (Calpe chips).
Known types of RAM + APL number:
- APL1027 (T2 itself)
- 339S00467 - 2GB
- 339S00533 - 1GB
- H9HKNNN8KUMUVR - 1GB Hynix Chip.
- D9LVN - Micron 1GB
- H9HKNNNBRUMUVR - Hynix 2GB
Power System(CALPE)
T2 is powered by an Apple proprietary power IC named Calpe. This IC serves as the power supply for T2, PCH, and even SSD on 13" models with 2 SSD chips populated.This chip needs PP3V3_G3H_RTC as its first power input. Like any SIO, it has a few internal LDO supplies and an external clock generator. There is also a secondary input that often gets corroded with high humidity. HI_DRV is more of a voltage sensor (it takes power directly through a voltage divider from PPBUS).
3V3_G3H_RTC to 3V3_G3H switch happens once iBoot is loaded. VDDMAIN_EN turns on 3V3_G3H/5V_G3S power supply. There are 3 Enable inputs, like in many such power controllers, which are used depending on the particular board design. Markings in schematics indicate that on desktops there might be a different enable sequence.
If clicking the trackpad produces haptic feedback, it indicates that the 5V_G3S supply is functional, allowing you to shortcut diagnostics for this part. Similarly, a power consumption of 0.01A suggests a fault either in the iBoot phase or in the early power supplies.
iBoot / BridgeOS DFU mode, revive/restore, SEP ROM
DFU is a firmware flash mode that keeps the machine completely off. In this mode T2 can boot externally from ramdisk provided via usb cable. It can be triggered either by keyboard combination (most unreliable), jumper (1.8V jumped to FORCE_DFU line on power-up), or cleaning SoC ROM (requires serial number injection after restore).If the SSD is replaced or there's corruption in iBoot/BridgeOS, restore may be a good diagnostic step.
If during restore the device reaches the S0 step with full PCH/CPU power and fan spin, it's mostly safe to say that the T2 part is fine. In some cases, SSD corruption may cause the device to power on only once and then revert to its original state.
SEP ROM is a separate chip near the T2 that contains SEP(Secure Enclave Processor) firmware. You can safely take this ROM from donor board if corruption suspected. Its corruption can cause DFU error 9 (failed to create/find/initialize BridgeOS partition).
CD3215/17 PD
corrupted iBoot and stuck T2 might cause PD malfunction. However it is important to mention that 5v-20v switch does not need T2 on board to happen on some boards. This will look like super-fast switching, without 2-3 seconds of 5V 0.2A phase. So if T2 is present but not booted, it will proactively prevent 20V switchData recovery possibility using AST2 (AASP only)
if you find competent and reliable AASP provider, they might help you to extract data from the device. There is a tool called "Data Transfer toolkit" which switches T2 into deeper target disk mode. In this mode SSD will be mounted as a normal target disk using minimal usb 2.0 interface and intel part is not turned on. AASP data toolkit will byteclone whole drive to the external drive. The tool is configured the way it will encrypt the drive with device's SN.The process requires AST2 access. AASP tech opens a ticket in Atlas(?) and after it is approved he is able to download utility.
Most likely it loads some custom signed iboot image to T2 so there is close to zero chance it will be available any time soon.
Transferring T2 to another board
if you need to move T2 to another board, you need to check if DDR size matches the SSD size of the recipient. You also need to move SoC Rom or you will get problem with activation / there will be error -3400F on loading recovery(if target SoCRom is clean)Soldering
T2 is a sandwich chip. It is quite important to remove it in a way that the RAM layer won't be separated from T2 itself. To keep it from separating, you can put some UV glue on the edge before removing the chip.Use a preheater (board to 130-150C) and a big nozzle to keep the temperature more or less even.
There are a few jigs (Amaoe / SoFix) as well as separate stencils.
The most consistent result I got was with an Amaoe jig + 0.25 mm PMTC solder balls. If you have to reball RAM, it might be a good idea to put 213C or even 260C solder paste on the RAM layer, so when you solder T2 with RAM on it, it won't even try to melt and separate.
It is normal that after soldering, DDR corners might lift a little bit. Unless you see actual solder ball separation/blob, there is nothing yet to worry about. Check for DDR power supply short if corners look suspicious before reballing the T2.
Reballing DDR is somewhat difficult if you have a lack of solder on the T2 side. You can fill holes with soldering paste, heat it up, then repeat until you have a consistent size of balls. However, in most cases, you will have to cut plastic support around balls to form a proper pattern.
Pinout chart if you got ram reballing(Credits to leshuq) and some pins are ripped/damaged.
T2 Footprint pattern in very prone to short circuit. there is a checkmate pattern in the middle between ground and DDR power supply. Do not move the chip to sides to make it settle, but rather gently tap on top of it with tweezers. Once chip is cooled down, measure resistances:
PPVDDCPU_AWAKE 10-15 Ohm
PP0V82_SLPDDR 30-40 Ohm
PPVDDCPUSRAM_AWAKE 100-120 Ohm
PP1V1_SLPS2R 1-2 kOhm
PP0V9_SLPDDR 40 Ohm
PP1V8_SLPS2R 4 kOhm
Last edited:
