I am developing a diagnostic tool for an external NVMe storage device connected to a Mac through USB4 PCIe tunnelling. The device appears under IONVMeController and IONVMeBlockStorageDevice, not as USB mass storage.
Basic communication works through IONVMeSMARTInterface, but I have not found a supported way to request a fresh host-initiated telemetry snapshot or retrieve its data using log-page offsets.
Environment
macOS 26.5.1, build 25F80
Apple Silicon, arm64
NVMe SMART interface version 1, revision 0
Controller Identify reports Log Page Attributes 0x0f, including telemetry support
What Works
I open the interface using IOCreatePlugInInterfaceForService and QueryInterface with the UUIDs declared in the SDK’s NVMeSMARTLibExternal.h.
The following operations succeed:
GetIdentifyData
SMARTReadData
GetLogPage for the SMART/health log, LID 0x02
Reading the host-initiated telemetry header, LID 0x07
My current prototype uses Python ctypes, with the layout and signatures matching the SDK header.
Required Telemetry Operations
For host-initiated telemetry, the application needs to:
Issue Get Log Page for LID 0x07, with LSP bit 0 set to request snapshot creation: CDW10 bit 8.
Read the 512-byte telemetry header to determine the available data size.
Retrieve subsequent portions of the same snapshot using the log-page offset in CDW12/CDW13.
I would also like to understand whether RAE, CDW10 bit 15, can be controlled.
This workflow works on Windows and Linux against the same device. We have access to device-side command logging, so we can inspect the command fields received by the firmware.
Available macOS API
The SDK declares: IOReturn (*GetLogPage)( void *interface, void *data, uint32_t inLogPageId, uint32_t inNumDWords);
The header describes inNumDWords as zero-based and references NVMe revision 1.0c. I do not see parameters for LSP, RAE, or the log-page offset.
The published documentation is:
https://developer.apple.com/documentation/iokit/ionvmesmartinterface/3521169-getlogpage
Observed Behavior
An ordinary 512-byte telemetry read produces the following device-side command:
CDW10 = 0x007f0007
CDW11 = 0x00000000
CDW12 = 0x00000000
CDW13 = 0x00000000
LID = 0x07
LSP = 0
Create = false
NUMD = 127
Offset = 0
The firmware returns a valid telemetry header advertising no payload because no snapshot has been created.
For comparison, the working Windows request reaches the device as:
CDW10 = 0x007f0107
Create = true
The firmware then creates an approximately 32 KiB diagnostic archive. Subsequent Windows requests retrieve it in chunks using nonzero CDW12 offsets.
As an explicitly unsupported experiment, I passed inLogPageId = 0x0107 to test whether the additional bit could reach CDW10. The call succeeded, but the device still received CDW10 = 0x007f0007; Create was not set.
Inspection of the installed NVMeSMARTLib plugin shows that its wrapper forwards the two 32-bit arguments unchanged toIOConnectCallStructMethod, selector 5. This does not establish how the kernel driver interprets them, and I am not relying on that experimental encoding as a supported API.
Questions
Is there a supported userspace interface for NVMe Get Log Page that exposes LSP/Create, RAE, and the 64-bit log-page offset?
Does IONVMeSMARTInterface.GetLogPage support these fields through any documented mechanism that I have missed?
If not, is there another supported NVMe admin-command interface available to third-party applications for external PCIe-tunnelled controllers?
What transfer-size limits and privilege or entitlement requirements apply to the recommended interface?
If this functionality is not currently exposed, is Feedback Assistant the appropriate place to request it, and which component should the report target?
I am looking for a supported solution that works with normal macOS security settings, without disabling SIP or replacing the active storage driver. The goal is diagnostic telemetry retrieval, not firmware updating or namespace writes.
1
0
68