Apple use a kernel extension called AppleSMC.kext to store information about a mac, including CPU temperatures, fan speeds, battery status, and so on. Accessing this data can be tough. There are a couple open efforts out there to provide APIs for the SMC: notably beltex's SMC controller which is pretty recent (last update in 2017):

• https://github.com/beltex/SMCKit
• https://github.com/beltex/libsmc

Other open source programs use SMC in order to display fan or temperature information:

• https://github.com/hholtmann/smcFanControl
• https://github.com/lavoiesl/osx-cpu-temp

I'll document here a simple c implementation, the C++ or Swift versions aren't much different.

Okay. I'm very new to the whole macOS architecture. I've got background in linux, and I once ran a FreeBSD vm, but that's as close as I've come to hacking around in macOS (until now) so please forgive me if I muck up the terminology a wee bit.

To access the SMC, you need to first access the SMC IO service, using the IOKit Framework. As I understand is, a Framework is Apple-speak for a library. Include the header, and load the service:

#include <stdlib.h>
#include <stdio.h>
#include <IOKit/IOKitLib.h>


int main()
{
  io_service_t service = IOServiceGetMatchingService(kIOMasterPortDefault,
                                                     IOServiceMatching("AppleSMC"));

  if (!service) {
    fprintf(stderr, "Error loading IOService for AppleSMC\n");
    exit(1);
  }

  // do something with service here

  IOObjectRelease(service);
}

We've also checked that the service is returned properly (should be non-zero) and then released it after we're done with it.

Next, we need to ask the service for a connection to the SMC, so we flesh out the part in the middle:

io_connect_t conn;

// Open SMC and check return value
if (!IOServiceOpen(service, mach_task_self(), 0, &conn)) {

  // Do something with SMC here

  // Close SMC
  if (IOServiceClose(this->conn)) {
    fprintf("Error closing SMC connection\n");
  }

}
else {
  fprintf("Failed to open SMC connection.\n");
}

Here, the service loads a connection to the SMC, and we check that it was loaded properly.

Now we have a connection! How to interact with it? 🤔

The SMC communicates by passing in structs to ask it for something, and it replies with another of the same struct. Hard work has been done by others to uncover the nature of this struct, which was unveiled in a piece of the Apple PowerManagement source code. From Beltex's libsmc:

/**
Defined by AppleSMC.kext.

This is the predefined struct that must be passed to communicate with the
AppleSMC driver. While the driver is closed source, the definition of this
struct happened to appear in the Apple PowerManagement project at around
version 211, and soon after disappeared. It can be seen in the PrivateLib.c
file under pmconfigd.

https://www.opensource.apple.com/source/PowerManagement/PowerManagement-211/
*/

So we define the structs as follows:

typedef struct {
    unsigned char  major;
    unsigned char  minor;
    unsigned char  build;
    unsigned char  reserved;
    unsigned short release;
} SMCVersion;


typedef struct {
    uint16_t version;
    uint16_t length;
    uint32_t cpuPLimit;
    uint32_t gpuPLimit;
    uint32_t memPLimit;
} SMCPLimitData;


// Struct containing information about the SMC key requested
typedef struct {
    IOByteCount dataSize;
    uint32_t    dataType;
    uint8_t     dataAttributes;
} SMCKeyInfoData;


// Struct passed in to/out from the SMC.
typedef struct {
    uint32_t       key;
    SMCVersion     vers;
    SMCPLimitData  pLimitData;
    SMCKeyInfoData keyInfo;
    uint8_t        result;
    uint8_t        status;
    uint8_t        data8;
    uint32_t       data32;
    uint8_t        bytes[32];
} SMCParamStruct;

This last one is the main struct that contains all the information for the SMC to give us what we want. Most of it is pretty self explanatory.

I just want to note that the key is a four character code in 8bit ascii, re-expressed as a 32 bit unsigned integer. We can write simple to/from conversion functions:

uint32_t key_to_uint(char *key)
{
  uint32_t rv = 0;
  rv += key[0] << 24;
  rv += key[1] << 16;
  rv += key[2] << 8;
  rv += key[3];
  return rv;
}

void key_to_char(uint32_t key, char *rv)
{
  rv[0] = key >> 24;
  rv[1] = (key >> 16) & 0xff;
  rv[2] = (key >> 8) & 0xff;
  rv[3] = key & 0xff;
}

These functions make assumptions about the char arrays passed to them: that they are blocks of memory at least 4 chars in size which is a bit dangerous. It would be best to check to be safe, perhaps using `strlen`.

A final piece of the puzzle are the interacting specifiers or selectors: we need to tell the SMC what it is that we want.

typedef enum {
    kSMCUserClientOpen  = 0,
    kSMCUserClientClose = 1,
    kSMCHandleYPCEvent  = 2,
    kSMCReadKey         = 5,
    kSMCWriteKey        = 6,
    kSMCGetKeyCount     = 7,
    kSMCGetKeyFromIndex = 8,
    kSMCGetKeyInfo      = 9
} selector_t;

The three important ones for us here are kSMCGetKeyInfo, kSMCReadKey, kSMCWriteKey.

We have out envelope, now we need to fill it, and send it away. (I mean, we need to make a call to the SMC and pass in out input struct, and receive a filled out output struct.)

SMCParamStruct in_struct = {0}, out_struct = {0};

in_struct.key = key_to_uint("TC0P");
in_struct.data8 = kSMCGetKeyInfo;

size_t s = sizeof(SMCParamStruct);
kern_return_t result = IOConnectCallStructMethod(conn,
                                                 kSMCHandleYPCEvent,
                                                 &input_struct,
                                                 s,
                                                 &output_struct,
                                                 &s);

if (!result) {
  if (!output_struct.result) {

    // next part goes here

  }
  else {
    fprintf(stderr, "Call to SMC failed.\n");
  }
}
else {
  fprintf(stderr, "Call to SMC failed.\n");
}

In this simple call, the SMC is asked for information about the key "TC0P". This key gets the Temperature for CPU0, in its Proximity. Other keys include "F0Ac" - Actual speed of Fan 0, and "BATP" - battery power level in percent. Take these with a pinch of salt: Apple changes the keys about adding new ones and dropping old. You can poll your system for keys by trying loads of combinations of four characters and seeing what sticks, or look at dumps obtained by others and posted online (an example).

With that key info we verify that we have the right key, and we find out the format it is stored in. SMC data are stored in a 32 byte array, but its exact format can vary. Is the data a float or int? is it a fixed point? Is it a UInt16?

This is given in the SMCKeyInfoData struct in the dataType member. As with key, this is a four character code written as a long unsigned int, so we can decode it using the function we wrote earlier.

As with the keys, the data types change too. Common types are the "fpe2", "sp78", "flt ", and "ui8 " types. Note the spaces in the last two.

We've almost done something useful! We've got the key data for our desired key of "TC0P" - CPU temperature. This should be a "flt " - or it was for me. Other people have reported "sp78" for temperatures. Your mileage may vary on this.

Whatever your SMC says the data type is, we can now get the value of the key using a successive call to the SMC:

uint32_t type = out_struct.keyInfo.dataType;

in_struct.keyInfo.dataSize = out_struct.keyInfo.dataSize;
in_struct.data8 = kSMCReadKey;

s = sizeof(SMCParamStruct);
result = IOConnectCallStructMethod(conn,
                                   kSMCHandleYPCEvent,
                                   &input_struct,
                                   s,
                                   &output_struct,
                                   &s);

if (!result) {
  if (!output_struct.result) {

    double temperature = from_flt_(out_struct.bytes);
    fprintf(stdout, "CPU Proximity temperature %fºC", temperature);

  }
  else {
    fprintf(stderr, "Call to SMC Read failed.\n");
  }
}
else {
  fprintf(stderr, "Call to SMC Read failed.\n");
}

And that's reading! There's a similar process for writing, just with a different key in the input param, and you set the in_param.bytes member as the payload for the write operation.

Now that was a very brief intro to the SMC, with some resources dotted about. The program above has not been tested or run, and it would be a mess to write out in full. I have a better implementation in C++ on github, or there's beltex's c or Swift versions linked at the top of this post.

Some relevant information:

• SMC on Wikipedia
• InsanelyMac forum post on SMC Keys
• Documented list of SMC Keys
• Stackoverflow post about sp78 and fpe2 types