NVME-SECURITY-RECV(1)

📦
version 3.2 · 14 versions
, in arch rolling

✨ NVME-SECURITY-RECV(1) — the security recv era ✨

okay so bestie, this is a page from the NVMe Manual and it's literally all about the Security Recv command. grab a snack, we're getting into it 💅

🌸 NAME 🌸

nvme-security-recv — the Security Recv command, aka the glow-up of "hey controller, gimme back what I sent you" 🫶

✨ SYNOPSIS ✨

nvme [<global-options>] security recv <device> [--size=<size> | -x <size>]
                        [--secp=<security-protocol> | -p <security-protocol>]
                        [--spsp=<protocol-specific> | -s <protocol-specific>]
                        [--nssf=<nvme-specific> | -N <nvme-specific>]
                        [--al=<allocation-length> | -t <allocation-length>]
                        [--namespace-id=<nsid> | -n <nsid>] [--raw-binary | -b]

💖 DESCRIPTION 💖

so the Security Receive command does one iconic thing: it transfers the status and data result of one or more Security Send commands that you previously submitted to the controller. like, you sent the vibe out, now you're collecting the receipts 🔥

the association between a Security Receive command and previous Security Send commands is dependent on the Security Protocol. and the format of the data to be transferred is also dependent on the Security Protocol. for Security Protocol details, refer to SPC-4 — that's the source of truth, periodt.

every single Security Receive command returns the appropriate data corresponding to a Security Send command, as defined by the rules of the Security Protocol. ⚠️ but here's the caveat, and it's giving "don't @ me": the Security Receive command data may not be retained if there's a loss of communication between the controller and host, or if a controller reset occurs. so like, no cap, that data can just ghost you 😭

💀 deprecated-alias alert: the bare nvme security-recv form (without a space) still works as a deprecated alias and will be removed in a future major version. new scripts should use nvme security recv instead. it's giving legacy, bestie — upgrade your scripts. 🙈

🎀 OPTIONS 🎀

  • -n <nsid>, --namespace-id=<nsid> — targets a specific namespace for this security command. and plot twist: you can also pass the broadcast value 0xffffffff as all or -1 👑
  • -N <nssf>, --nssf=<nssf> — the NVMe Security Specific field. if you're using security protocol EAh (the one assigned for NVMe use), this NVMe security specific field indicates which reply memory buffer target you're going for 🦋
  • -x <size>, --size=<size> — size of the buffer to allocate. on success it'll be printed to STDOUT. ✨
  • -p <security-protocol>, --secp=<security-protocol> — the Security Protocol. this field specifies the security protocol as defined in SPC-4. and the controller shall fail the command with Invalid Parameter if you specify a reserved value of the Security Protocol — so don't try it, it's not cute 💀
  • -s <security-protocol-specific>, --spsp=<security-protocol-specific> — SP Specific. the value of this field is specific to the Security Protocol, as defined in SPC-4 (iykyk)
  • -t <allocation-length>, --al=<allocation-length> — Allocation Length. the value of this field is specific to the Security Protocol, as defined in SPC-4 💜
  • -b, --raw-binary — print the raw buffer to stdout. defaults to printing in hex 🔥

🌈 GLOBAL OPTIONS 🌈

these ones live at the top-level nvme command and they're available to this subcommand too. main character energy, honestly:

  • --dry-run — print the command that would be executed, but do not actually execute it. all talk, no action, we love a preview 👑
  • --no-ioctl-probing — disable probing for 64-bit IOCTL support
  • --no-retries — disable retry logic on transient errors (one shot, one opportunity)
  • -o <fmt>, --output-format=<fmt> — set the reporting format to normal, tabular, 'json, or binary. only one output format may be used at a time, so pick your fighter 💅
  • --output-format-version=<version> — select the output format version. version 1 uses the original field naming, while version 2 (the default) provides more consistent and script-friendly field names. other versions are rejected — no in-between, bestie 🚫
  • --quiet — suppress informational messages. errors are still reported, and --quiet cancels any --verbose for the library log level 🤫
  • --set-options=<key=value>[,<key=value>...] — set libnvme library options for this invocation. supported keys are force-4k, mi-probe-enabled, test-base-dir and test-sysfs-dir 🧚
  • --timeout=<ms> — set the timeout for the command in milliseconds. infinite or -1 waits without a time limit (0xffffffff) ⏳
  • -v, --verbose — increase the level of detail in the output. may be specified multiple times to further increase verbosity — stack it, go off 📈
also important: these options can be set as machine-wide defaults in nvme-cli.conf(5). and a command-line flag always overrides the file. always. no exceptions, periodt 💖

🦋 EXAMPLES 🦋

No Examples 😭 (yes really, that's the whole section, we're as disappointed as you are)

⭐ NVME ⭐

part of the nvme-user suite 🌸

and that's the whole page, bestie — no crumbs left behind. this iconic little page is from the NVMe manual, version/date stamped 10/30/2026, filed under NVME-SECURITY-RECV(1). go forth and security recv responsibly 🫶✨

📦 where this page comes from