I am developing a diagnostic tool for an external NVMe storage device connected to a Mac through USB4 PCIe tunnelling. The device appears under IONVMeController and IONVMeBlockStorageDevice, not as USB mass storage.
Basic communication works through IONVMeSMARTInterface, but I have not found a supported way to request a fresh host-initiated telemetry snapshot or retrieve its data using log-page offsets.
Environment
- macOS 26.5.1, build 25F80
- Apple Silicon, arm64
- NVMe SMART interface version 1, revision 0
- Controller Identify reports Log Page Attributes
0x0f, including telemetry support
What Works
I open the interface using IOCreatePlugInInterfaceForService and QueryInterface with the UUIDs declared in the SDK’s NVMeSMARTLibExternal.h.
The following operations succeed:
GetIdentifyDataSMARTReadDataGetLogPagefor the SMART/health log, LID0x02- Reading the host-initiated telemetry header, LID
0x07
My current prototype uses Python ctypes, with the layout and signatures matching the SDK header.
Required Telemetry Operations
For host-initiated telemetry, the application needs to:
- Issue Get Log Page for LID
0x07,with LSP bit 0 set to request snapshot creation: CDW10 bit 8. - Read the 512-byte telemetry header to determine the available data size.
- Retrieve subsequent portions of the same snapshot using the log-page offset in CDW12/CDW13.
I would also like to understand whether RAE, CDW10 bit 15, can be controlled.
This workflow works on Windows and Linux against the same device. We have access to device-side command logging, so we can inspect the command fields received by the firmware.
Available macOS API
The SDK declares: IOReturn (*GetLogPage)( void *interface, void *data, uint32_t inLogPageId, uint32_t inNumDWords);
The header describes inNumDWords as zero-based and references NVMe revision 1.0c. I do not see parameters for LSP, RAE, or the log-page offset.
The published documentation is: https://developer.apple.com/documentation/iokit/ionvmesmartinterface/3521169-getlogpage
Observed Behavior
An ordinary 512-byte telemetry read produces the following device-side command:
CDW10 = 0x007f0007
CDW11 = 0x00000000
CDW12 = 0x00000000
CDW13 = 0x00000000
LID = 0x07
LSP = 0
Create = false
NUMD = 127
Offset = 0
The firmware returns a valid telemetry header advertising no payload because no snapshot has been created.
For comparison, the working Windows request reaches the device as:
CDW10 = 0x007f0107
Create = true
The firmware then creates an approximately 32 KiB diagnostic archive. Subsequent Windows requests retrieve it in chunks using nonzero CDW12 offsets.
As an explicitly unsupported experiment, I passed inLogPageId = 0x0107 to test whether the additional bit could reach CDW10. The call succeeded, but the device still received CDW10 = 0x007f0007; Create was not set.
Inspection of the installed NVMeSMARTLib plugin shows that its wrapper forwards the two 32-bit arguments unchanged toIOConnectCallStructMethod, selector 5. This does not establish how the kernel driver interprets them, and I am not relying on that experimental encoding as a supported API.
Questions
- Is there a supported userspace interface for NVMe Get Log Page that exposes LSP/Create, RAE, and the 64-bit log-page offset?
- Does
IONVMeSMARTInterface.GetLogPagesupport these fields through any documented mechanism that I have missed? - If not, is there another supported NVMe admin-command interface available to third-party applications for external PCIe-tunnelled controllers?
- What transfer-size limits and privilege or entitlement requirements apply to the recommended interface?
- If this functionality is not currently exposed, is Feedback Assistant the appropriate place to request it, and which component should the report target?
I am looking for a supported solution that works with normal macOS security settings, without disabling SIP or replacing the active storage driver. The goal is diagnostic telemetry retrieval, not firmware updating or namespace writes.